Prośba o pomoc w usunięciu trojanów.

**Posty:** 21 · przez **Ciamek88** 06 Maj 2009, 18:30

Log z ComboFixa:

Kod: Zaznacz wszystko: ComboFix 09-05-05.04 - Michałek 2009-05-06 16:19.1 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.3.1250.48.1045.18.2047.1378 [GMT 2:00] Uruchomiony z: c:\documents and settings\Michałek\Pulpit\ComboFix.exe AV: ESET NOD32 Antivirus 3.0 *On-access scanning disabled* (Updated) . ((((((((((((((((((((((((( Pliki utworzone od 2009-04-06 do 2009-05-06 ))))))))))))))))))))))))))))))) . 2009-05-05 18:37 . 2008-12-11 06:38 159600 ----a-w c:\windows\system32\drivers\pctgntdi.sys 2009-05-05 18:37 . 2009-03-06 14:45 130424 ----a-w c:\windows\system32\drivers\PCTCore.sys 2009-05-05 18:37 . 2008-12-18 10:16 73840 ----a-w c:\windows\system32\drivers\PCTAppEvent.sys 2009-05-05 18:37 . 2009-05-05 18:39 -------- d-----w c:\program files\Common Files\PC Tools 2009-05-05 18:37 . 2008-12-10 10:36 64392 ----a-w c:\windows\system32\drivers\pctplsg.sys 2009-05-05 18:37 . 2009-05-05 18:37 -------- d-----w c:\documents and settings\All Users\Dane aplikacji\PC Tools 2009-05-05 18:37 . 2009-05-06 12:49 -------- d-----w c:\program files\Spyware Doctor 2009-05-05 18:09 . 2009-05-05 18:09 -------- d-----w c:\documents and settings\All Users\Dane aplikacji\Kaspersky Lab Setup Files 2009-05-03 12:04 . 2009-05-03 12:04 -------- d-----w c:\program files\Antares 2009-04-16 05:34 . 2009-02-06 10:10 227840 -c----w c:\windows\system32\dllcache\wmiprvse.exe 2009-04-16 05:34 . 2009-03-06 14:22 285696 -c----w c:\windows\system32\dllcache\pdh.dll 2009-04-16 05:34 . 2009-02-09 11:25 111104 -c----w c:\windows\system32\dllcache\services.exe 2009-04-16 05:34 . 2009-02-09 10:53 401408 -c----w c:\windows\system32\dllcache\rpcss.dll 2009-04-16 05:34 . 2009-02-09 10:53 473600 -c----w c:\windows\system32\dllcache\fastprox.dll 2009-04-16 05:34 . 2009-02-09 10:53 686592 -c----w c:\windows\system32\dllcache\advapi32.dll 2009-04-16 05:34 . 2009-02-09 10:53 731136 -c----w c:\windows\system32\dllcache\lsasrv.dll 2009-04-16 05:34 . 2009-02-09 10:53 453120 -c----w c:\windows\system32\dllcache\wmiprvsd.dll 2009-04-16 05:34 . 2009-02-09 10:53 722944 -c----w c:\windows\system32\dllcache\ntdll.dll 2009-04-16 05:34 . 2008-04-21 21:16 218112 -c----w c:\windows\system32\dllcache\wordpad.exe 2009-04-13 20:05 . 2009-04-13 20:05 -------- d-----w c:\program files\Common Files\PCSuite 2009-04-13 20:04 . 2008-08-26 07:26 18816 ----a-w c:\windows\system32\drivers\pccsmcfd.sys 2009-04-13 20:04 . 2009-04-13 20:04 -------- d-----w c:\program files\PC Connectivity Solution 2009-04-13 10:51 . 2009-04-13 10:51 -------- d-----w c:\program files\GIMP-2.0 2009-04-10 15:06 . 2009-04-10 15:06 -------- d-----w c:\program files\Common Files\Mobipocket Shared 2009-04-08 03:21 . 2009-04-08 03:21 -------- d-----w c:\documents and settings\NetworkService\Ustawienia lokalne\Dane aplikacji\Google . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-05-06 12:26 . 2001-10-30 12:00 88224 ----a-w c:\windows\system32\perfc015.dat 2009-05-06 12:26 . 2001-10-30 12:00 497656 ----a-w c:\windows\system32\perfh015.dat 2009-05-04 18:15 . 2008-01-28 20:08 -------- d-----w c:\program files\English Translator 3 2009-04-22 14:17 . 2007-07-16 18:00 -------- d-----w c:\program files\Common Files\Adobe 2009-04-13 20:05 . 2007-08-26 11:27 -------- d-----w c:\program files\Nokia 2009-04-13 20:05 . 2007-08-26 11:27 -------- d-----w c:\program files\Common Files\Nokia 2009-04-10 14:32 . 2009-01-23 18:27 -------- d-----w c:\program files\Softick 2009-04-07 16:19 . 2007-09-10 09:20 -------- d-----w c:\program files\Google 2009-03-21 22:23 . 2009-03-20 04:29 634992 ----a-w c:\documents and settings\LocalService\Ustawienia lokalne\Dane aplikacji\FontCache3.0.0.0.dat 2009-03-20 04:35 . 2009-03-20 04:31 -------- d-----w c:\program files\AutoCAD Architecture 2009 2009-03-20 04:33 . 2008-03-15 09:14 -------- d-----w c:\program files\Common Files\Autodesk Shared 2009-03-20 04:29 . 2008-01-19 14:12 -------- d-----w c:\program files\MSBuild 2009-03-20 04:26 . 2009-03-20 04:26 -------- d-----w c:\program files\Reference Assemblies 2009-03-20 04:24 . 2008-03-15 09:18 -------- d-----w c:\program files\Autodesk 2009-03-19 04:33 . 2009-03-19 04:33 -------- d-----w c:\program files\Autodesk Student Community Download Tool 2009-03-16 15:39 . 2009-03-16 15:37 -------- d-----w c:\program files\Portrait Professional Max 6 2009-03-13 17:52 . 2009-03-13 17:52 -------- d-----w c:\program files\TI Education 2009-03-12 18:30 . 2009-03-12 18:30 -------- d-----w c:\program files\Common Files\IPSPI 2009-03-12 18:30 . 2009-03-12 18:30 -------- d-----w c:\program files\PITy 2009-03-06 14:22 . 2001-10-30 12:00 285696 ----a-w c:\windows\system32\pdh.dll 2009-02-20 08:12 . 2001-10-30 12:00 668672 ----a-w c:\windows\system32\wininet.dll 2009-02-20 08:11 . 2007-07-16 16:12 81920 ------w c:\windows\system32\ieencode.dll 2009-02-16 13:44 . 2009-02-16 13:44 127034 ------r c:\windows\bwUnin-8.1.1.50-8876480SL.exe 2009-02-09 14:07 . 2001-10-30 12:00 1847040 ----a-w c:\windows\system32\win32k.sys 2009-02-09 11:26 . 2001-10-26 16:50 2025472 ----a-w c:\windows\system32\ntkrnlpa.exe 2009-02-09 11:26 . 2001-10-30 12:00 2146816 ----a-w c:\windows\system32\ntoskrnl.exe 2009-02-09 11:25 . 2001-10-30 12:00 111104 ----a-w c:\windows\system32\services.exe 2009-02-09 10:53 . 2001-10-30 12:00 731136 ----a-w c:\windows\system32\lsasrv.dll 2009-02-09 10:53 . 2001-10-30 12:00 686592 ----a-w c:\windows\system32\advapi32.dll 2009-02-09 10:53 . 2001-10-30 12:00 401408 ----a-w c:\windows\system32\rpcss.dll 2009-02-09 10:53 . 2001-10-30 12:00 722944 ----a-w c:\windows\system32\ntdll.dll 2009-02-06 10:39 . 2001-10-30 12:00 35328 ----a-w c:\windows\system32\sc.exe . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "H/PC Connection Agent"="c:\program files\Microsoft ActiveSync\wcescomm.exe" [2006-11-13 1289000] "Gadu-Gadu"="c:\program files\Gadu-Gadu\gg.exe" [2008-03-20 2127296] "ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360] "Google Update"="c:\documents and settings\Michałek\Ustawienia lokalne\Dane aplikacji\Google\Update\GoogleUpdate.exe" [2008-09-07 133104] "PC Suite Tray"="c:\program files\Nokia\Nokia PC Suite 7\PCSuite.exe" [2008-12-03 1205760] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-08-11 7630848] "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2006-08-11 86016] "JMB36X Configure"="c:\windows\system32\JMRaidSetup.exe" [2006-10-30 1953792] "SoundMAXPnP"="c:\program files\Analog Devices\Core\smax4pnp.exe" [2006-12-18 868352] "Phase One Media Reader"="c:\progra~1\PHASEO~1\CAPTUR~1\DCIMImp.exe" [2007-04-25 229376] "HPDJ Taskbar Utility"="c:\windows\system32\spool\drivers\w32x86\3\hpztsb08.exe" [2003-03-26 172032] "DeviceDiscovery"="c:\program files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe" [2002-12-02 40960] "IMAQBoot"="c:\program files\National Instruments\NI-IMAQ\bin\ImaqBoot.exe" [1999-12-14 32849] "GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-26 31016] "googletalk"="c:\program files\Google\Google Talk\googletalk.exe" [2007-01-01 3739648] "SunJavaUpdateSched"="c:\program files\Java\jre1.5.0_11\bin\jusched.exe" [2006-12-15 75520] "egui"="c:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2008-02-20 1443072] "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696] "ISTray"="c:\program files\Spyware Doctor\pctsTray.exe" [2008-12-08 1173384] "BluetoothAuthenticationAgent"="bthprops.cpl" - c:\windows\system32\bthprops.cpl [2008-04-14 110592] "Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" - c:\windows\KHALMNPR.Exe [2007-04-11 56080] "Logitech Hardware Abstraction Layer"="KHALMNPR.EXE" - c:\windows\KHALMNPR.Exe [2007-04-11 56080] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2008-04-14 15360] c:\documents and settings\Michaek\Menu Start\Programy\Autostart\ Tworzenie wycink˘w ekranu i uruchamianie programu OneNote 2007.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2006-10-26 98632] c:\documents and settings\All Users\Menu Start\Programy\Autostart\ Logitech Desktop Messenger.lnk - c:\program files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe [2009-2-16 67128] Logitech SetPoint.lnk - c:\program files\Logitech\SetPoint\SetPoint.exe [2009-2-16 692224] Send Crash Reports to FotoWare.lnk - c:\windows\Installer\{B52C1A3B-A9FC-49EF-909A-3373A21BC610}\NewShortcut1.CC6BC988_E897_4B98_94B4_10417EFCE47E.exe [2008-9-16 45056] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup] @="" [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Adobe Gamma Loader.lnk] path=c:\documents and settings\All Users\Menu Start\Programy\Autostart\Adobe Gamma Loader.lnk backup=c:\windows\pss\Adobe Gamma Loader.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Adobe Reader Speed Launch.lnk] path=c:\documents and settings\All Users\Menu Start\Programy\Autostart\Adobe Reader Speed Launch.lnk backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Aktywacja Testera.lnk] path=c:\documents and settings\All Users\Menu Start\Programy\Autostart\Aktywacja Testera.lnk backup=c:\windows\pss\Aktywacja Testera.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^InterVideo WinCinema Manager.lnk] path=c:\documents and settings\All Users\Menu Start\Programy\Autostart\InterVideo WinCinema Manager.lnk backup=c:\windows\pss\InterVideo WinCinema Manager.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusOverride"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\Gadu-Gadu\\gg.exe"= "c:\\Program Files\\totalcmd\\TOTALCMD.EXE"= "c:\\WINDOWS\\system32\\javaw.exe"= "e:\\SZAFA\\Komorka\\IRC\\mIRC_aivanet_od_itq5\\mirc.exe"= "c:\\Program Files\\Nokia\\Nokia Software Updater\\nsu_ui_client.exe"= "c:\\Program Files\\Common Files\\Nokia\\Service Layer\\A\\nsl_host_process.exe"= "f:\\Q3Ademo\\Q3Ademo\\quake3.exe"= "c:\program files\Microsoft ActiveSync\rapimgr.exe"= c:\program files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager "c:\program files\Microsoft ActiveSync\wcescomm.exe"= c:\program files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager "c:\program files\Microsoft ActiveSync\WCESMgr.exe"= c:\program files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application "c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"= "c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"= "c:\\Program Files\\Bonjour\\mDNSResponder.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "c:\\WINDOWS\\system32\\dpvsetup.exe"= "c:\\WINDOWS\\system32\\dplaysvr.exe"= "c:\\Program Files\\Google\\Google Talk\\googletalk.exe"= "c:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe"= "c:\\Documents and Settings\\Michałek\\Ustawienia lokalne\\Dane aplikacji\\Google\\Google Talk Plugin\\googletalkplugin.dll"= "c:\\Documents and Settings\\Michałek\\Ustawienia lokalne\\Dane aplikacji\\Google\\Google Talk Plugin\\googletalkplugin.exe"= "c:\\Program Files\\Skype\\Phone\\Skype.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service R0 PCTCore;PCTools KDS;c:\windows\system32\drivers\PCTCore.sys [2009-05-05 130424] R1 epfwtdir;epfwtdir;c:\windows\system32\drivers\epfwtdir.sys [2008-02-20 33800] R2 ekrn;Eset Service;c:\program files\ESET\ESET NOD32 Antivirus\ekrn.exe [2008-02-20 472320] R2 Nidaq32k;Nidaq32k;c:\windows\system32\drivers\nidaq32k.sys [2000-07-21 653312] R2 sdAuxService;PC Tools Auxiliary Service;c:\program files\Spyware Doctor\pctsAuxs.exe [2009-05-05 348752] S2 gupdate1c9b79c3e2c85fa;Google Update Service (gupdate1c9b79c3e2c85fa);c:\program files\Google\Update\GoogleUpdate.exe [2009-04-07 133104] S2 NatMotion;NatMotion;c:\windows\system32\drivers\NatMotion.sys [2000-07-13 103513] S2 NOD32FiXTemDono;Eset Nod32 Boot;c:\windows\system32\regedt32.exe [2001-10-30 3584] S3 gpibclsb;GPIB Board Class Driver;c:\windows\system32\drivers\gpibclsb.sys [1999-07-01 56904] S3 gpibclsd;GPIB Device Class Driver;c:\windows\system32\drivers\gpibclsd.sys [1999-07-01 34664] S3 L6DP;L6DP;c:\windows\system32\Drivers\l6dp.sys --> c:\windows\system32\Drivers\l6dp.sys [?] S3 L6PODLV;PODxt Live Service;c:\windows\system32\drivers\L6PODLV.sys [2008-07-13 530560] S3 NiViPxiK;NiViPxiK;c:\windows\system32\drivers\NiViPxiK.sys [2000-06-30 9728] S3 PanasonicDECT-USBGEAR;Panasonic USB GEAR Driver;c:\windows\system32\drivers\pccusbdd.sys [2007-09-25 47712] --- Inne Usługi/Sterowniki w Pamięci --- *Deregistered* - mchInjDrv [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{2a8ca1c1-33bc-11dc-b5bc-806d6172696f}] \Shell\AutoRun\command - d:\bin\Assetup.exe . Zawartość folderu 'Zaplanowane zadania' 2009-05-06 c:\windows\Tasks\GoogleUpdateTaskMachine.job - c:\program files\Google\Update\GoogleUpdate.exe [2009-04-07 16:16] . . ------- Skan uzupełniający ------- . uStart Page = hxxp://kamera.krapkowice.pl/ uDefault_Search_URL = hxxp://www.google.com/ie uSearchURL,(Default) = hxxp://www.google.com/search?q=%s IE: &Winamp Toolbar Search - c:\documents and settings\All Users\Dane aplikacji\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200 IE: E&ksport do programu Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 IE: E&ksportuj do programu Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000 Trusted Zone: line6.net Handler: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - c:\program files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll DPF: {0EC4C9E3-EC6A-11CF-8E3B-444553540000} - file://f:\vocal class room\Rivaisatch\setup\RiffLick.cab DPF: {68282C51-9459-467B-95BF-3C0E89627E55} - hxxp://www.mks.com.pl/skaner/SkanerOnline.cab FF - ProfilePath - c:\documents and settings\Michałek\Dane aplikacji\Mozilla\Firefox\Profiles\xcx9fpjp.default\ FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q= FF - prefs.js: browser.startup.homepage - hxxp://onet.pl FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=megaup&p= FF - component: c:\program files\Nokia\Nokia PC Suite 7\bkmrksync\components\BkMrkExt.dll FF - plugin: c:\program files\Google\Picasa3\npPicasa3.dll FF - plugin: c:\program files\Google\Update\1.2.145.5\npGoogleOneClick8.dll FF - plugin: c:\program files\Java\jre1.5.0_11\bin\NPJava11.dll FF - plugin: c:\program files\Java\jre1.5.0_11\bin\NPJava12.dll FF - plugin: c:\program files\Java\jre1.5.0_11\bin\NPJava13.dll FF - plugin: c:\program files\Java\jre1.5.0_11\bin\NPJava14.dll FF - plugin: c:\program files\Java\jre1.5.0_11\bin\NPJava32.dll FF - plugin: c:\program files\Java\jre1.5.0_11\bin\NPJPI150_11.dll FF - plugin: c:\program files\Java\jre1.5.0_11\bin\NPOJI610.dll FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll . ************************************************************************** catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-05-06 16:22 Windows 5.1.2600 Dodatek Service Pack 3 NTFS skanowanie ukrytych procesów ... skanowanie ukrytych wpisów autostartu ... skanowanie ukrytych plików ... skanowanie pomyślnie ukończone ukryte pliki: 0 ************************************************************************** . --------------------- Pliki DLL ładowane pod uruchomionymi procesami --------------------- - - - - - - - > 'explorer.exe'(1164) c:\program files\Logitech\SetPoint\GameHook.dll c:\program files\Logitech\SetPoint\lgscroll.dll c:\windows\system32\WPDShServiceObj.dll c:\windows\system32\PortableDeviceTypes.dll c:\windows\system32\PortableDeviceApi.dll . Czas ukończenia: 2009-05-06 16:23 ComboFix-quarantined-files.txt 2009-05-06 14:23 ComboFix2.txt 2009-05-06 03:23 Przed: 71 917 010 944 bajtów wolnych Po: 71 905 382 400 bajtów wolnych 223 --- E O F --- 2009-04-20 20:07

log z hijackthis:

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 18:28:05, on 2009-05-06 Platform: Windows XP Dodatek SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\csrss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Google\Update\GoogleUpdate.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Analog Devices\Core\smax4pnp.exe C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb08.exe C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe C:\WINDOWS\system32\rundll32.exe C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe C:\Program Files\Google\Google Talk\googletalk.exe C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe C:\Program Files\Spyware Doctor\pctsTray.exe C:\Program Files\Microsoft ActiveSync\wcescomm.exe C:\WINDOWS\system32\ctfmon.exe C:\Documents and Settings\Michałek\Ustawienia lokalne\Dane aplikacji\Google\Update\GoogleUpdate.exe C:\PROGRA~1\MICROS~3\rapimgr.exe C:\Program Files\Nokia\Nokia PC Suite 7\PCSuite.exe C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe C:\Program Files\Logitech\SetPoint\SetPoint.exe C:\Program Files\Common Files\Logitech\KhalShared\KHALMNPR.EXE C:\WINDOWS\System32\svchost.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\drivers\CDAC11BA.EXE C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe C:\WINDOWS\SYSTEM32\GEARSEC.EXE C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\WINDOWS\system32\nvsvc32.exe C:\Program Files\Spyware Doctor\pctsAuxs.exe C:\Program Files\Spyware Doctor\pctsSvc.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\UTSCSI.EXE C:\Program Files\PC Connectivity Solution\ServiceLayer.exe C:\Program Files\PC Connectivity Solution\Transports\NclMSBTSrv.exe C:\WINDOWS\System32\alg.exe C:\Program Files\PC Connectivity Solution\Transports\NclUSBSrv.exe C:\Program Files\PC Connectivity Solution\Transports\NclRSSrv.exe C:\Program Files\Spyware Doctor\pctsGui.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Gadu-Gadu\gg.exe C:\Documents and Settings\Michałek\Ustawienia lokalne\Dane aplikacji\Google\Google Talk Plugin\googletalkplugin.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe C:\WINDOWS\system32\wbem\wmiprvse.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://kamera.krapkowice.pl/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll O2 - BHO: AddTask Class - {24F06550-65E3-4D1C-8CFE-839C296B5530} - C:\Program Files\real\IEeREAD.dll O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [JMB36X Configure] C:\WINDOWS\system32\JMRaidSetup.exe boot O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe O4 - HKLM\..\Run: [Phase One Media Reader] C:\PROGRA~1\PHASEO~1\CAPTUR~1\DCIMImp.exe /noscan /CheckAutoStart O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb08.exe O4 - HKLM\..\Run: [DeviceDiscovery] C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent O4 - HKLM\..\Run: [IMAQBoot] C:\Program Files\National Instruments\NI-IMAQ\bin\ImaqBoot.exe O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" O4 - HKLM\..\Run: [googletalk] C:\Program Files\Google\Google Talk\googletalk.exe /autostart O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe" O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [ISTray] "C:\Program Files\Spyware Doctor\pctsTray.exe" O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe" O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Michałek\Ustawienia lokalne\Dane aplikacji\Google\Update\GoogleUpdate.exe" /c O4 - HKCU\..\Run: [PC Suite Tray] "C:\Program Files\Nokia\Nokia PC Suite 7\PCSuite.exe" -onlytray O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user') O4 - Startup: Tworzenie wycinków ekranu i uruchamianie programu OneNote 2007.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe O4 - Global Startup: Send Crash Reports to FotoWare.lnk = ? O8 - Extra context menu item: &Winamp Toolbar Search - C:\Documents and Settings\All Users\Dane aplikacji\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\WINDOWS\system32\GPhotos.scr/200 O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O8 - Extra context menu item: E&ksportuj do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll O9 - Extra button: Wyślij do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra 'Tools' menuitem: Wyślij &do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll O9 - Extra 'Tools' menuitem: Utwórz Ulubione dla urządzenia przenośnego... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll O9 - Extra button: (no name) - {53F6FCCD-9E22-4d71-86EA-6E43136192AB} - (no file) O9 - Extra button: (no name) - {925DAB62-F9AC-4221-806A-057BFB1014AA} - (no file) O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - E:\PROGRA~1\MICROS~1\OFFICE11\REFIEBAR.DLL O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O15 - Trusted Zone: *.line6.net O16 - DPF: {0EC4C9E3-EC6A-11CF-8E3B-444553540000} (WaveTab Control) - file://F:\Vocal Class Room\Rivaisatch\setup\RiffLick.cab O16 - DPF: {68282C51-9459-467B-95BF-3C0E89627E55} - http://www.mks.com.pl/skaner/SkanerOnline.cab O16 - DPF: {A3D93B25-4601-49D2-B3AF-F447C73D561F} (Sony SNC-RZ25 Control) - http://213.17.144.50:8888/program/SonySncRz25View.cab O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\system32\drivers\CDAC11BA.EXE O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe O23 - Service: GEARSecurity - GEAR Software - C:\WINDOWS\SYSTEM32\GEARSEC.EXE O23 - Service: Google Update Service (gupdate1c9b79c3e2c85fa) (gupdate1c9b79c3e2c85fa) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe O23 - Service: CLCV0 (UTSCSI) - Unknown owner - C:\WINDOWS\system32\UTSCSI.EXE -- End of file - 11176 bytes

Witam,
spyware doctor znalazł mi:
Trojan-PWS.Delf!ct
Trojan.Encode!ct
pierwszy usunął się jakoś, a drugiego nie da się. Proszę o pomoc.

Pozdrawiam serdecznie.

**Posty:** 18165 · przez **wojtas** 06 Maj 2009, 19:04

1. Ściągnij OTMoveIt i go włacz i odpal go z opcji CleanUp

oraz skasuj folder C:\Qoobox
2. wykonaj optymalizację windowsa
3.sciagnij ATF_Cleaner
zaznacz
Windows Temp
All users Temp
Temporary internet files
Recycle Bin
i wcisnij EMPTY SELECTED
4.Wyłącz przywracanie systemu ( właściwości mój komputer-zakładka przywracanie - wyłącz przywracanie na wszystkich dyskach). Po chwili włącz je powrotem
5. Wykonaj skan Dr. Web CureIt
6. Przeskanuj obszar mojego komputera http://www.kaspersky.pl/virusscanner.html (uruchom przez IE) Daj raport z niego na forum.

i tym:

FixIEDef.

**Posty:** 21 · przez **Ciamek88** 06 Maj 2009, 19:19

Ale nie mam takiego folderu: C:\Qoobox ?

pozdrawiam serdecznie.

**Posty:** 18165 · przez **wojtas** 06 Maj 2009, 19:26

ok jesli nie masz rob dalej

pozdro

**Posty:** 21 · przez **Ciamek88** 07 Maj 2009, 16:16

Zostawiam skan włączony na noc, dużo czasu zajęły wszystkie poprzednie czynności, mam nadzieję, że otrzymam oczekiwany efekt, rano wrzucę loga

Pozdrawiam serdecznie.

Dodano 07.05.2009 05:17:08:
log z kaspersky'ego:

Kod: Zaznacz wszystko: -------------------------------------------------------------------------------- RAPORT KASPERSKY ONLINE SCANNER 7.0 czwartek, 7 maj 2009 System operacyjny: Microsoft Windows XP Home Edition Dodatek Service Pack 3 (build 2600) Wersja Kaspersky Online Scanner: 7.0.26.12 Data ostatniej aktualizacji bazy danych: Wednesday, May 06, 2009 20:06:02 Zainfekowany: 2138404 -------------------------------------------------------------------------------- Ustawienia skanowania: Typ bazy danych użytej do skanowania: rozszerzona Skanuj archiwa: tak Skanuj pocztowe bazy danych: tak Obszar skanowania - Mój komputer: A:\ C:\ D:\ E:\ F:\ Statystyki skanowania: Przeskanowanych plików: 255064 Nazwa zagrożenia: 4 Zainfekowanych obiektów: 10 Podejrzanych obiektów: 0 Czas skanowania: 04:09:26 Nazwa pliku / Nazwa zagrożenia / Liczba zagrożeń E:\KAISER\Programy\Phonealarm\phoneAlarm.v1.65.1.PPC.incl.keygen\keygen.exe Zainfekowany: Trojan.Win32.Genome.aeeu 1 E:\KAISER\Programy\phonealarm.v1.65.1.ppc.incl.keygen.zip Zainfekowany: Trojan.Win32.Genome.aeeu 1 E:\SZAFA\Komorka\IRC\mIRC_aivanet_od_itq5\mirc.exe Zainfekowany: not-a-virus:Client-IRC.Win32.mIRC.616 1 E:\SZAFA\Komorka\IRC\mIRC_aivanet_od_itq5.zip Zainfekowany: not-a-virus:Client-IRC.Win32.mIRC.616 1 E:\SZAFA\Komorka\ostatnie z IRC\Call_Of_Duty-nie\Call_Of_Duty.rar Zainfekowany: Trojan.SymbOS.Blocker.a 1 E:\SZAFA\Komorka\ostatnie z IRC\Call_Of_Duty-nie\rozpak\Call Of Duty\system\libs\ECOM.DLL Zainfekowany: Trojan.SymbOS.Blocker.a 1 E:\SZAFA\Komorka\Używane na 6630\Call of Duty ostatn z IRC\Call_of_Duty_Repacked_by_neiltoe.zip Zainfekowany: Trojan.SymbOS.Blocker.a 1 E:\SZAFA\Komorka\Używane na 6630\Call of Duty ostatn z IRC\rozpak\system\libs\ECOM.DLL Zainfekowany: Trojan.SymbOS.Blocker.a 1 F:\nod 64\ESET_Smart_Security_3.0.621_for_64-bit.rar Zainfekowany: Trojan.Win32.Autoit.wh 1 F:\nod 64\ESET_Smart_Security_64bitNodLogin.rar Zainfekowany: Trojan.Win32.Autoit.wh 1 Wybrany obszar został przeskanowany.

**Posty:** 18165 · przez **wojtas** 07 Maj 2009, 19:13

czysto...