Irytujace programy przy uruchamianiu systemu.

**Posty:** 482 · przez **Patriota** 09 Lis 2008, 12:09

Otoz mam dosc dziwny problem, wlaczam kompa, klikam na swoj profil laduje sie system i w tym czasie podwojnie uruchamiaja mi sie moje dokumenty, i instalcja programu Any DVD. Wpienia mnie to bo za kazdym uruchomieniem systemu musze trzy razy kliknac na X zeby to wszystko pozamykac zanim zabiore sie do pracy. Gdzie cos takiego wylaczyc?

**Posty:** 10264 · przez **Mike** 09 Lis 2008, 12:19

wstaw loga z combofix'a i z hijackthis'a

poza tym wstaw screena z:
start => uruchom => wpisz: msconfig => zakładka uruchamianie (z jej zawartości wstaw screena)

**Posty:** 482 · przez **Patriota** 09 Lis 2008, 12:39

Kod: Zaznacz wszystko: ComboFix 08-11-07.01 - Michał 2008-11-09 11:29:45.1 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.2783 [GMT 1:00] Uruchomiony z: c:\documents and settings\Michał\Pulpit\ComboFix.exe * Utworzono nowy punkt przywracania . [i] ADS - WINDOWS: deleted 48 bytes in 1 streams. [/i] ((((((((((((((((((((((((((((((((((((((( Usunięto ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\Autorun.inf c:\documents and settings\Michał\Dane aplikacji\BITS c:\documents and settings\Michał\Dane aplikacji\BITS\BITS.ini c:\documents and settings\Michał\Dane aplikacji\BITS\DHTTable.dat c:\documents and settings\Michał\Dane aplikacji\BITS\ProxyList.ini c:\documents and settings\Michał\Dane aplikacji\BITS\UPnP.ini c:\program files\FlashGet Network c:\program files\FlashGet Network\FlashGet universal\dbtrans_verbose.log c:\program files\FlashGet Network\FlashGet universal\fgoption.ini c:\program files\FlashGet Network\FlashGet universal\P2PCfg.ini c:\program files\FlashGet Network\FlashGet universal\p2spmgr.ini c:\program files\FlashGet Network\FlashGet universal\p4spmgr.ini c:\program files\FlashGet Network\FlashGet universal\Profiles\config.dat c:\program files\FlashGet Network\FlashGet universal\Profiles\tasks.dat c:\program files\FlashGet Network\FlashGet universal\transaction.log c:\windows\89559.exe c:\windows\ufdata2000.log E:\Autorun.inf F:\Autorun.inf . ((((((((((((((((((((((((( Pliki utworzone od 2008-10-09 do 2008-11-09 ))))))))))))))))))))))))))))))) . 2008-11-07 11:23 . 2007-08-07 16:59 3,801,448 --a------ c:\windows\system32\d3dx9d_34.dll 2008-11-07 11:22 . 2008-11-07 11:23 <DIR> d-------- c:\program files\I-Fluid Demo 2008-11-06 18:37 . 2008-11-06 18:37 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\Elaborate Bytes 2008-11-06 18:36 . 2008-11-06 18:36 <DIR> d-------- c:\program files\Elaborate Bytes 2008-11-06 18:35 . 2008-11-06 18:35 <DIR> d-------- c:\program files\SlySoft 2008-11-06 18:35 . 2008-11-06 18:35 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\SlySoft 2008-11-06 18:35 . 2008-11-06 18:36 48 ---hs---- c:\windows\S12BD2F82.tmp 2008-11-06 18:18 . 2008-11-06 18:18 <DIR> d-------- c:\program files\DVD Decrypter 2008-11-05 21:05 . 2008-11-07 21:47 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\Test Drive Unlimited 2008-11-05 20:45 . 2008-11-05 20:45 <DIR> d-------- c:\program files\Atari 2008-11-02 12:43 . 2008-11-02 12:43 <DIR> d-------- c:\windows\nview 2008-11-02 12:43 . 2008-10-02 10:07 453,152 --a------ c:\windows\system32\NVUNINST.EXE 2008-11-02 12:43 . 2008-10-07 13:33 453,152 --a------ c:\windows\system32\nvudisp.exe 2008-11-02 12:43 . 2008-11-09 11:02 201,151 --a------ c:\windows\system32\nvapps.xml 2008-11-02 12:43 . 2008-10-07 13:33 18,477 --a------ c:\windows\system32\nvdisp.nvu 2008-10-31 23:59 . 2008-10-31 23:59 <DIR> d-------- c:\program files\Lonely Cat Games 2008-10-30 20:07 . 2008-10-30 20:07 <DIR> d--hs---- c:\windows\ftpcache 2008-10-30 20:07 . 2008-10-30 20:07 319 --a------ c:\windows\game.ini 2008-10-29 19:55 . 2008-10-31 23:41 <DIR> d-------- c:\documents and settings\Michał\Dane aplikacji\Nokia Multimedia Player 2008-10-29 19:01 . 2008-10-31 19:37 <DIR> d-------- c:\documents and settings\Michał\Dane aplikacji\Nokia 2008-10-29 18:06 . 2008-10-29 18:06 <DIR> d-------- c:\documents and settings\Michał\Dane aplikacji\Datalayer 2008-10-29 17:30 . 2008-10-31 23:35 <DIR> d-------- c:\documents and settings\Michał\Phone Browser 2008-10-29 17:30 . 2008-10-31 23:35 <DIR> d-------- c:\documents and settings\Michał\Phone Browser 2008-10-29 17:25 . 2008-10-29 17:25 <DIR> d-------- c:\windows\Downloaded Installations 2008-10-29 17:24 . 2008-10-29 18:07 <DIR> d-------- c:\program files\Nokia 2008-10-29 17:24 . 2008-10-29 17:24 <DIR> d-------- c:\program files\DIFX 2008-10-29 17:24 . 2008-10-29 17:24 <DIR> d-------- c:\program files\Common Files\PCSuite 2008-10-29 17:24 . 2008-10-29 17:24 <DIR> d-------- c:\program files\Common Files\Nokia 2008-10-29 17:24 . 2008-10-29 17:24 <DIR> d-------- c:\documents and settings\Michał\Dane aplikacji\PC Suite 2008-10-29 17:24 . 2008-10-29 17:24 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\PC Suite 2008-10-29 17:24 . 2008-10-29 17:24 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\Downloaded Installations 2008-10-29 17:24 . 2006-05-29 08:26 127,488 --a------ c:\windows\system32\drivers\nmwcd.sys 2008-10-29 17:24 . 2006-05-29 08:26 50,688 --a------ c:\windows\system32\nmwcdcls.dll 2008-10-29 17:24 . 2006-05-29 08:26 30,720 --a------ c:\windows\system32\nmwcdcocls.dll 2008-10-29 17:24 . 2006-05-29 08:26 13,312 --a------ c:\windows\system32\drivers\nmwcdcm.sys 2008-10-29 17:24 . 2006-05-29 08:26 13,312 --a------ c:\windows\system32\drivers\nmwcdcj.sys 2008-10-29 17:24 . 2006-05-29 08:26 8,704 --a------ c:\windows\system32\drivers\nmwcdc.sys 2008-10-29 17:24 . 2006-05-29 08:26 4,608 --a------ c:\windows\system32\nmwcdlog.dll 2008-10-26 19:35 . 2008-10-26 19:41 139,264 --a------ c:\windows\War3Unin.exe 2008-10-26 19:35 . 2008-10-26 19:41 52,088 --a------ c:\windows\War3Unin.dat 2008-10-26 19:35 . 2008-10-26 19:41 2,829 --a------ c:\windows\War3Unin.pif 2008-10-26 17:42 . 2008-11-02 11:32 <DIR> d-------- c:\program files\Magic Video Converter 2008-10-26 17:42 . 2004-05-26 21:37 719,872 --a------ c:\windows\system32\devil.dll 2008-10-26 17:42 . 2003-03-19 11:03 544,768 --a------ c:\windows\system32\msvcr71d.dll 2008-10-26 17:42 . 2002-01-05 14:37 344,064 --a------ c:\windows\system32\msvcr70.dll 2008-10-26 17:42 . 2006-09-16 19:44 314,368 --a------ c:\windows\system32\avisynth.dll 2008-10-23 20:19 . 2004-08-03 22:08 31,616 --a------ c:\windows\system32\drivers\usbccgp.sys 2008-10-16 16:42 . 2008-10-23 14:09 138,280 --a------ c:\windows\system32\drivers\PnkBstrK.sys 2008-10-13 20:46 . 2008-10-13 20:46 <DIR> d-------- c:\program files\Alwil Software . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-11-09 08:41 --------- d-----w c:\program files\AIMP2 2008-11-06 22:28 --------- d-----w c:\program files\The KMPlayer 2008-11-05 19:43 --------- d-----w c:\program files\Common Files\InstallShield 2008-11-02 11:46 --------- d-----w c:\program files\Damian Pasternak 2008-10-30 19:27 --------- d--h--w c:\program files\InstallShield Installation Information 2008-10-25 18:06 --------- d-----w c:\documents and settings\Michał\Dane aplikacji\uTorrent 2008-10-23 13:09 111,928 ----a-w c:\windows\system32\PnkBstrB.exe 2008-10-09 18:42 --------- d-----w c:\program files\Microsoft ActiveSync 2008-10-01 15:50 --------- d-----w c:\documents and settings\Michał\Dane aplikacji\XRay Engine 2008-09-30 15:08 --------- d-----w c:\program files\7-Zip 2008-09-28 18:50 --------- d-----w c:\program files\ASUS 2008-09-28 14:02 --------- d-----w c:\program files\RivaTuner v2.11 2008-09-28 12:36 --------- d-----w c:\program files\Common Files\Wise Installation Wizard 2008-09-28 12:35 --------- d-----w c:\program files\AGEIA Technologies 2008-09-27 14:24 --------- d-----w c:\documents and settings\Michał\Dane aplikacji\gtk-2.0 2008-09-26 14:24 --------- d-----w c:\program files\GIMP-2.0 2008-09-26 11:42 304,528 ----a-w c:\windows\system32\appdrvrem01.exe 2008-09-26 11:42 2,915,944 ----a-w c:\windows\system32\drivers\appdrv01.sys 2008-09-26 09:31 --------- d-----w c:\program files\Folding@Home #01 2008-09-26 08:36 --------- d-----w c:\program files\Common Files\Adobe 2008-09-26 08:35 --------- d-----w c:\program files\Common Files\Adobe Systems Shared 2008-09-26 08:35 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\Adobe Systems 2008-09-25 11:03 --------- d-----w c:\program files\NAPI-PROJEKT 2008-09-24 16:14 2,634,008 ----a-w c:\windows\74828.exe 2008-09-24 16:02 --------- d-----w c:\documents and settings\Michał\Dane aplikacji\Bioshock 2008-09-23 13:02 66,872 ----a-w c:\windows\system32\PnkBstrA.exe 2008-09-23 13:02 22,328 ----a-w c:\documents and settings\Michał\Dane aplikacji\PnkBstrK.sys 2008-09-23 13:02 2,337,865 ----a-w c:\windows\system32\pbsvc.exe 2008-09-23 13:02 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\Ubisoft 2008-09-22 19:48 --------- d-----w c:\documents and settings\Michał\Dane aplikacji\Disney Interactive Studios 2008-09-22 19:46 107,888 ----a-w c:\windows\system32\CmdLineExt.dll 2008-09-22 19:26 --------- d-----w c:\documents and settings\Michał\Dane aplikacji\BESTplayer 2008-09-20 10:44 99,648 ----a-w c:\windows\system32\drivers\AnyDVD.sys 2008-09-17 07:33 --------- d-----w c:\documents and settings\Michał\Dane aplikacji\FastStone 2008-09-17 07:32 --------- d-----w c:\program files\FastStone Image Viewer 2008-09-16 18:42 --------- d-----w c:\program files\uTorrent 2008-09-16 10:55 --------- d-----w c:\program files\Windows Media Components 2008-09-16 10:44 --------- d-----w c:\program files\Futuremark 2008-09-15 13:11 --------- d-----w c:\program files\Pcsx2_0.9.4 2008-09-14 15:14 --------- d-----w c:\documents and settings\Michał\Dane aplikacji\Creative 2008-09-04 07:31 288,024 ----a-w c:\windows\system32\PhysXCplUI.exe 2008-08-29 06:57 70,936 ----a-w c:\windows\system32\PhysXLoader.dll 2008-08-22 22:26 444,952 ----a-w c:\windows\system32\wrap_oal.dll 2006-06-24 06:48 32,768 ----a-r c:\windows\inf\UpdateUSB.exe . ------- Sigcheck ------- 2007-07-10 14:06 642560 ce594e18fe0d0af804f1f3694921ce62 c:\windows\system32\user32.dll 2007-07-13 23:56 814592 ce7193c5f7c01b19768e066087c1c919 c:\windows\system32\wininet.dll 2007-07-28 02:15 360576 0fb6743e937c7bb248b2530a5a77abc6 c:\windows\system32\drivers\tcpip.sys 2007-07-26 18:30 2145792 316acc3ac43fc855204ce5e775f66b91 c:\windows\system32\ntoskrnl.exe 2007-07-13 23:42 974848 32f67215c57df2c401bf93b7ee65987f c:\windows\explorer.exe . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360] "74828"="C:\WINDOWS/74828.exe" [2008-09-24 2634008] "EXPLORER.EXE"="EXPLORER.EXE" [2007-07-13 c:\windows\explorer.exe] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2008-07-19 78008] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-10-07 13574144] "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-10-07 86016] "Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2008-02-29 c:\windows\KHALMNPR.Exe] "nwiz"="nwiz.exe" [2008-10-07 c:\windows\system32\nwiz.exe] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-04 15360] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce] "nltide_2"="shell32" [X] "nltide_3"="advpack.dll" [2007-07-27 c:\windows\system32\advpack.dll] c:\documents and settings\All Users\Menu Start\Programy\Autostart\ Logitech SetPoint.lnk - c:\program files\Logitech\SetPoint\SetPoint.exe [2008-09-27 805392] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "DisableStatusMessages"= 1 (0x1) [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] "NoSMMyPictures"= 1 (0x1) "NoSMConfigurePrograms"= 1 (0x1) "NoSMHelp"= 1 (0x1) "NoResolveTrack"= 1 (0x1) "NoResolveSearch"= 1 (0x1) [HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer] "NoSMMyPictures"= 1 (0x1) "NoSMConfigurePrograms"= 1 (0x1) "NoSMHelp"= 1 (0x1) "NoResolveTrack"= 1 (0x1) "NoResolveSearch"= 1 (0x1) [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LBTWlgn] 2008-05-02 01:42 72208 c:\program files\Common Files\Logishrd\Bluetooth\LBTWLgn.dll [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup] @="" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Photo Downloader] --a------ 2005-06-06 23:46 57344 c:\program files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AnyDVD] --a------ 2008-11-06 18:57 2177984 c:\program files\SlySoft\AnyDVD\AnyDVDtray.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTCheck] --------- 2007-11-06 10:08 397312 c:\program files\Creative\ZEN Media Explorer\CTCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE] --a------ 2004-08-04 01:44 15360 c:\windows\system32\ctfmon.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTSyncU.exe] --------- 2007-07-17 10:03 868352 c:\program files\Creative\Sync Manager Unicode\CTSyncU.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Pro Agent] --a------ 2007-09-06 14:08 136136 c:\program files\DAEMON Tools Pro\DTProAgent.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] --a------ 2008-02-28 16:07 1828136 c:\program files\Common Files\Nero\Lib\NMIndexStoreSvr.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] --a------ 2008-03-25 12:33 570664 c:\program files\Common Files\Nero\Lib\NeroCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCSuiteTrayApplication] --a------ 2006-06-15 12:36 229376 c:\progra~1\Nokia\NOKIAP~1\LAUNCH~1.EXE [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PcSync] --a------ 2006-06-27 16:21 1449984 c:\program files\Nokia\Nokia PC Suite 6\PcSync2.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RivaTunerStartupDaemon] --a------ 2008-09-16 18:15 2715648 c:\program files\RivaTuner v2.11\RivaTuner.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched] --a------ 2008-06-10 03:27 144784 c:\program files\Java\jre1.6.0_07\bin\jusched.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Alcmtr] -ra------ 2005-05-03 11:43 69632 c:\windows\ALCMTR.EXE [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Kernel and Hardware Abstraction Layer] --a------ 2008-02-29 02:12 76304 c:\windows\KHALMNPR.Exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz] --a------ 2008-10-07 13:33 1630208 c:\windows\system32\nwiz.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RTHDCPL] -ra------ 2008-05-16 07:39 16862720 c:\windows\RTHDCPL.EXE [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusDisableNotify"=dword:00000001 "AntiVirusOverride"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "%windir%\\system32\\sessmgr.exe"= "e:\\Program Files\\Ubisoft\\Assassin's Creed\\AssassinsCreed_Dx9.exe"= "e:\\Program Files\\Ubisoft\\Assassin's Creed\\AssassinsCreed_Dx10.exe"= "e:\\Program Files\\Ubisoft\\Assassin's Creed\\AssassinsCreed_Launcher.exe"= "c:\\Documents and Settings\\All Users\\Dane aplikacji\\Kaspersky Lab Setup Files\\Kaspersky Anti-Virus 7.0.1.325\\Polish\\setup.exe"= "e:\\Program Files\\Codemasters\\GRID\\GRID.exe"= "c:\\Program Files\\BitSpirit\\BitSpirit.exe"= "e:\\Program Files\\Electronic Arts\\Crytek\\Crysis\\Bin32\\Crysis.exe"= "e:\\Program Files\\Electronic Arts\\Crytek\\Crysis\\Bin32\\CrysisDedicatedServer.exe"= "c:\\Program Files\\uTorrent\\uTorrent.exe"= "e:\\obrazy\\PES2008\\PES-08-RIP-SKULL MG\\Pro Evolution Soccer 2008\\PES2008.exe"= "c:\\WINDOWS\\system32\\PnkBstrA.exe"= "c:\\WINDOWS\\system32\\PnkBstrB.exe"= "e:\\Program Files\\Ubisoft\\Tom Clancy's Rainbow Six Vegas 2\\Binaries\\R6Vegas2_Game.exe"= "e:\\Program Files\\Ubisoft\\Tom Clancy's Rainbow Six Vegas 2\\Binaries\\R6Vegas2_Launcher.exe"= "e:\\Program Files\\GSC World Publishing\\Ń.Ň.Ŕ.Ë.Ę.Ĺ.Đ. - ×čńňîĺ Íĺáî\\bin\\xrEngine.exe"= "e:\\Program Files\\GSC World Publishing\\Ń.Ň.Ŕ.Ë.Ę.Ĺ.Đ. - ×čńňîĺ Íĺáî\\bin\\dedicated\\xrEngine.exe"= "e:\\Program Files\\Atari\\Neverwinter Nights 2\\nwn2main.exe"= "e:\\Program Files\\Atari\\Neverwinter Nights 2\\nwn2main_amdxp.exe"= "e:\\Program Files\\Atari\\Neverwinter Nights 2\\nwupdate.exe"= "e:\\Program Files\\Atari\\Neverwinter Nights 2\\nwn2server.exe"= "e:\\Program Files\\Unreal Tournament 3\\Binaries\\UT3.exe"= "e:\\Program Files\\Electronic Arts\\Dead Space\\Dead Space.exe"= "e:\\Program Files\\Activision\\Call of Duty 4 - Modern Warfare\\iw3mp.exe"= "e:\\Program Files\\Ubisoft\\Far Cry 2\\bin\\FarCry2.exe"= "e:\\Program Files\\Ubisoft\\Far Cry 2\\bin\\FC2Launcher.exe"= "e:\\Program Files\\Ubisoft\\Far Cry 2\\bin\\FC2Editor.exe"= "e:\\Program Files\\PES 2009\\pes2009.exe"= "c:\\Program Files\\Gadu-Gadu\\gg.exe"= "c:\\Program Files\\Atari\\Test Drive Unlimited\\TestDriveUnlimited.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "25306:TCP"= 25306:TCP:utorrent [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings] "AllowInboundEchoRequest"= 1 (0x1) R0 mv61xx;mv61xx;c:\windows\system32\DRIVERS\mv61xx.sys [2008-06-10 150568] R1 appdrv01;Application Driver (01);c:\windows\system32\Drivers\appdrv01.sys [2008-09-26 2915944] R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2008-07-19 78416] R2 aswFsBlk;aswFsBlk;c:\windows\system32\DRIVERS\aswFsBlk.sys [2008-07-19 20560] R2 FAH-01;Folding Service #01;c:\program files\Folding@Home #01\Folding@Home #01\FAH-Console.exe [2008-06-30 253952] R2 FAH-02;Folding Service #02;c:\program files\Folding@Home #01\Folding@Home #02\FAH-Console.exe [2008-06-30 253952] R3 L1e;Miniport Driver for Atheros AR8121/AR8113 PCI-E Ethernet Controller;c:\windows\system32\DRIVERS\l1e51x86.sys [2008-02-02 36864] S2 appdrvrem01;Application Driver Auto Removal Service (01);c:\windows\System32\appdrvrem01.exe svc [ ] S3 USBSTOR;Sterownik magazynu masowego USB;c:\windows\system32\DRIVERS\USBSTOR.SYS [2004-08-03 26496] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{35429141-a1e2-11dd-90b5-002215571b69}] \Shell\Auto\command - fun.xls.exe \Shell\AutoRun\command - c:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL fun.xls.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{881c132b-70a6-11dd-b8ce-002215571b69}] \Shell\Auto\command - G:\fun.xls.exe \Shell\AutoRun\command - c:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL fun.xls.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{8aa06546-80df-11dd-9044-002215571b69}] \Shell\Auto\command - fun.xls.exe \Shell\AutoRun\command - c:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL fun.xls.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{941475e8-a137-11dd-90b3-002215571b69}] \Shell\Auto\command - G:\fun.xls.exe \Shell\AutoRun\command - c:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL fun.xls.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{941475e9-a137-11dd-90b3-002215571b69}] \Shell\Auto\command - fun.xls.exe \Shell\AutoRun\command - c:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL fun.xls.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{b314d197-7080-11dd-9014-806d6172696f}] \Shell\AutoRun\command - G:\EXPLORER.EXE \Shell\explore\Command - G:\EXPLORER.EXE \Shell\open\Command - G:\EXPLORER.EXE [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{f3345af5-7110-11dd-901c-002215571b69}] \Shell\AutoRun\command - G:\EXPLORER.EXE \Shell\explore\Command - G:\EXPLORER.EXE \Shell\open\Command - G:\EXPLORER.EXE *Newly Created Service* - PROCEXP90 . - - - - USUNIĘTO PUSTE WPISY - - - - HKLM-Run-IMJPMIG8.2 - msime82.exe MSConfigStartUp-MsServer - msfun80.exe MSConfigStartUp-wsctf - wsctf.exe . ------- Skan uzupełniający ------- . FireFox -: Profile - c:\documents and settings\Michał\Dane aplikacji\Mozilla\Firefox\Profiles\p4im0a26.default\ FireFox -: prefs.js - STARTUP.HOMEPAGE - onet.pl . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-11-09 11:31:21 Windows 5.1.2600 Dodatek Service Pack 2 NTFS skanowanie ukrytych procesów ... skanowanie ukrytych wpisów autostartu ... HKLM\Software\Microsoft\Windows\CurrentVersion\Run IMJPMIG8.2 = msime82.exe???. skanowanie ukrytych plików ... skanowanie pomyślnie ukończone ukryte pliki: 0 ************************************************************************** . Czas ukończenia: 2008-11-09 11:31:38 ComboFix-quarantined-files.txt 2008-11-09 10:31:36 Przed: 63 973 572 608 bajtów wolnych Po: 64,542,392,320 bajtów wolnych WindowsXP-KB310994-SP2-Pro-BootDisk-PLK.exe [boot loader] timeout=2 default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS [operating systems] c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect 313

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 11:35:33, on 2008-11-09 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.20583) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\system32\spoolsv.exe C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Logitech\SetPoint\SetPoint.exe C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE C:\WINDOWS\system32\CTsvcCDA.exe C:\Program Files\Folding@Home #01\Folding@Home #01\FAH-Console.exe C:\Program Files\Folding@Home #01\Folding@Home #02\FAH-Console.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\PnkBstrA.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\Program Files\BitSpirit\BitSpirit.exe C:\Program Files\Gadu-Gadu\gg.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\explorer.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Documents and Settings\Michał\Pulpit\HiJackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.microsoft.com/fwlink/?LinkId=74005 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [EXPLORER.EXE] EXPLORER.EXE O4 - HKCU\..\Run: [74828] C:\WINDOWS/74828.exe O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-19\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-20\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'Default user') O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe O8 - Extra context menu item: Pobierz z &BitSpirit - C:\Program Files\BitSpirit\bsurl.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: Application Driver Auto Removal Service (01) (appdrvrem01) - Protection Technology - C:\WINDOWS\System32\appdrvrem01.exe O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe O23 - Service: Indexing Service (CiSvc) - Unknown owner - C:\WINDOWS\system32\cisvc.exe (file missing) O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe O23 - Service: Folding Service #01 (FAH-01) - Stanford University - C:\Program Files\Folding@Home #01\Folding@Home #01\FAH-Console.exe O23 - Service: Folding Service #02 (FAH-02) - Stanford University - C:\Program Files\Folding@Home #01\Folding@Home #02\FAH-Console.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Common Files\Logishrd\Bluetooth\LBTServ.exe O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe O23 - Service: ServiceLayer - Nokia. - C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe -- End of file - 5881 bytes

**Posty:** 8001 · przez **Okocza** 09 Lis 2008, 12:56

Otwórz notatnik i wklej:

Kod: Zaznacz wszystko: File:: c:\windows\S12BD2F82.tmp c:\windows\74828.exe Registry:: [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "74828"=- [-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{35429141-a1e2-11dd-90b5-002215571b69}] [-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{881c132b-70a6-11dd-b8ce-002215571b69}] [-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{8aa06546-80df-11dd-9044-002215571b69}] [-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{941475e8-a137-11dd-90b3-002215571b69}] [-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{941475e9-a137-11dd-90b3-002215571b69}] [-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{b314d197-7080-11dd-9014-806d6172696f}] [-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{f3345af5-7110-11dd-901c-002215571b69}]

Plik >>> zapisz jako CFScript.txt .Plik przeciągnij i upuść na ikonę ComboFixa (tak jak tu ) . odczekaj az wygeneruje sie nowy log i go daj na forum

Kod: Zaznacz wszystko: O4 - HKCU\..\Run: [74828] C:\WINDOWS/[b]74828.exe[/b] O4 - HKUS\S-1-5-19\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'Default user') O23 - Service: Indexing Service (CiSvc) - Unknown owner - C:\WINDOWS\system32\cisvc.exe (file missing)

to na fix w hj - pogrubiony ręcznie z dysku