Zainstalowałem na tej samej partycji drugiego windowsa - wszystkie programy na nim działają poprawnie.
(win xp SP2)
Proszę o szybką pomoc !!
- Kod: Zaznacz wszystko
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:25:51, on 2009-03-08
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16791)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Programy\Gadu-Gadu\gg.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programy\Logitech\SetPoint\SetPoint.exe
C:\Documents and Settings\czeresio\Menu Start\Programy\Autostart\gamma.exe
C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE
C:\Programy\Winamp\winamp.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\Programy\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.eu.microsoft.com/poland/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programy\Acrobat 6.0 CE\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: My Global Search Bar BHO - {37B85A21-692B-4205-9CAD-2626E4993404} - C:\Program Files\MyGlobalSearch\bar\1.bin\MGSBAR.DLL (file missing)
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programy\java\bin\ssv.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programy\java\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Programy\java\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: My Global Search Bar - {37B85A29-692B-4205-9CAD-2626E4993404} - C:\Program Files\MyGlobalSearch\bar\1.bin\MGSBAR.DLL (file missing)
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Programy\Gadu-Gadu\gg.exe" /tray
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'Default user')
O4 - Startup: gamma.exe
O4 - Startup: radiozet.lnk = C:\Documents and Settings\czeresio\Pulpit\radiozet.pls
O4 - Global Startup: Logitech SetPoint.lnk = C:\Programy\Logitech\SetPoint\SetPoint.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\Programy\Microsoft Office\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\WINDOWS\system32\shdocvw.dll
--
End of file - 3975 bytes
COMBOFIX
- Kod: Zaznacz wszystko
ComboFix 09-03-02.01 - czeresio 2009-03-08 14:41:44.7 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.1023.656 [GMT 1:00]
Uruchomiony z: C:\ComboFix.exe
.
((((((((((((((((((((((((((((((((((((((( Usunięto )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\autorun.inf
c:\windows\svchost.exe
D:\Autorun.inf
.
((((((((((((((((((((((((((((((((((((((( Sterowniki/Usługi )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\Legacy_POWERMANAGER
-------\Service_PowerManager
((((((((((((((((((((((((( Pliki utworzone od 2009-02-08 do 2009-03-08 )))))))))))))))))))))))))))))))
.
2009-03-07 19:00 . 2009-03-07 19:01 <DIR> d-------- c:\program files\ATI Technologies
2009-03-07 19:00 . 2008-10-28 21:05 593,920 --------- c:\windows\system32\ati2sgag.exe
2009-03-07 18:57 . 2009-03-07 18:57 <DIR> d-------- C:\ATI
2009-03-07 15:33 . 2009-03-07 18:28 664 --a------ c:\windows\system32\d3d9caps.dat
2009-03-07 15:10 . 2005-05-26 15:34 2,297,552 --a------ c:\windows\system32\d3dx9_26.dll
2009-03-03 17:57 . 2009-03-03 17:57 <DIR> d-------- c:\documents and settings\czeresio\Dane aplikacji\ipla
2009-03-03 17:57 . 2009-03-03 17:57 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\ipla
2009-03-02 21:32 . 2009-03-02 21:33 <DIR> d-------- C:\steamapps
2009-03-01 20:32 . 2009-03-01 19:54 52,224 --a------ C:\glikozydy fenolowe.doc
2009-03-01 19:00 . 2009-03-02 22:44 2,933,037 -ra------ C:\ComboFix.exe
2009-02-26 17:00 . 2006-03-24 05:39 49,152 --a------ c:\windows\system32\SET91.tmp
2009-02-24 09:07 . 2009-02-24 09:06 140,811 -r-hs---- C:\tvlx2fg.exe
2009-02-21 10:46 . 2009-02-21 10:46 142,266 -r-hs---- C:\f9cvum.exe
2009-02-18 14:46 . 2009-02-18 14:45 107,407 -r-hs---- C:\yftvl.com
2009-02-16 09:17 . 2009-02-16 09:16 143,100 -r-hs---- C:\32agsg.exe
.
(((((((((((((((((((((((((((((((((((((((( Sekcja Find3M ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-03-07 18:00 --------- d--h--w c:\program files\InstallShield Installation Information
2009-02-10 18:23 --------- d-----w c:\program files\IrfanView
2009-02-05 13:18 142,846 --sh--r C:\ft96s.exe
2009-01-30 18:23 23,252 ----a-w C:\aaa.reg
2009-01-20 19:08 145,221 --sh--r C:\gy.exe
2009-01-17 09:08 146,355 --sh--r C:\x2csvg.exe
2009-01-14 20:05 107,336 --sh--r C:\lel3cx.com
2009-01-01 15:56 121,472 --sh--r C:\fr.com
2008-12-30 09:56 122,535 --sh--r C:\e8kj.exe
2007-09-27 15:02 2,510,070 ----a-w c:\windows\inf\SETD6.tmp
.
.
-- Migawka wyzerowana --
.
((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Gadu-Gadu"="c:\programy\Gadu-Gadu\gg.exe" [2008-03-20 2127296]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-03 15360]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-08-29 61440]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-03 15360]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"tscuninstall"="c:\windows\system32\tscupgrd.exe" [2004-08-03 44544]
c:\documents and settings\czeresio\Menu Start\Programy\Autostart\
gamma.exe [2002-09-05 53248]
radiozet.lnk - c:\documents and settings\czeresio\Pulpit\radiozet.pls [2008-11-17 1006]
c:\documents and settings\All Users\Menu Start\Programy\Autostart\
Logitech SetPoint.lnk - c:\programy\Logitech\SetPoint\SetPoint.exe [2008-11-18 805392]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoMSHelp"= 0 (0x0)
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoSMHelp"= 1 (0x1)
"NoWelcomeScreen"= 1 (0x1)
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{BB4C402F-882A-4526-8C08-51278EA437C1}"= "c:\windows\system32\afmain1.dll" [2004-08-03 78848]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LBTWlgn]
2008-05-02 02:42 72208 c:\program files\Common Files\Logishrd\Bluetooth\LBTWLgn.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux1"= ctwdm32.dll
"aux3"= ctwdm32.dll
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]
@=""
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]
--a------ 2009-03-02 21:39 1446648 c:\gry\Steam\Steam.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"PowerManager"=2 (0x2)
"LBTServ"=3 (0x3)
"JavaQuickStarterService"=2 (0x2)
"idsvc"=3 (0x3)
"FLEXnet Licensing Service"=3 (0x3)
"Bonjour Service"=2 (0x2)
"BlueSoleil Hid Service"=2 (0x2)
"ATI Smart"=2 (0x2)
"Ati HotKey Poller"=2 (0x2)
"Adobe LM Service"=3 (0x3)
"wuauserv"=2 (0x2)
"wscsvc"=2 (0x2)
"helpsvc"=2 (0x2)
"Alerter"=2 (0x2)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Programy\\BearShare\\BearShare.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Programy\\BlueSoleil\\BlueSoleil.exe"=
"c:\\Programy\\Ventrilo\\Ventrilo.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Gry\\Steam\\steamapps\\timothy10\\counter-strike\\hl.exe"=
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{35aca80e-e3a9-11dd-be0f-001167aa70fc}]
\Shell\AutoRun\command - F:\tvlx2fg.exe
\Shell\open\Command - F:\tvlx2fg.exe
.
.
------- Skan uzupełniający -------
.
uInternet Settings,ProxyOverride = *.local
IE: E&xport to Microsoft Excel - c:\programy\Microsoft Office\Office10\EXCEL.EXE/3000
FF - ProfilePath - c:\documents and settings\czeresio\Dane aplikacji\Mozilla\Firefox\Profiles\cxmeqkiu.default\
FF - prefs.js: browser.search.selectedEngine - Allegro
FF - prefs.js: browser.startup.homepage - www.google.pl
FF - plugin: c:\programy\Acrobat 6.0 CE\Reader\browser\nppdf32.dll
FF - plugin: c:\programy\java\bin\new_plugin\npdeploytk.dll
FF - plugin: c:\programy\java\bin\new_plugin\npjp2.dll
FF - plugin: c:\programy\Mozilla Firefox\plugins\NPMyGlSh.dll
FF - plugin: c:\programy\Real Alternative\browser\plugins\nppl3260.dll
FF - plugin: c:\programy\Real Alternative\browser\plugins\nprpjplug.dll
.
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-03-08 14:44:52
Windows 5.1.2600 Dodatek Service Pack 2 NTFS
skanowanie ukrytych procesów ...
skanowanie ukrytych wpisów autostartu ...
skanowanie ukrytych plików ...
skanowanie pomyślnie ukończone
ukryte pliki:
**************************************************************************
.
--------------------- Pliki DLL ładowane pod uruchomionymi procesami ---------------------
- - - - - - - > 'winlogon.exe'(712)
c:\windows\system32\Ati2evxx.dll
c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll
c:\program files\common files\logishrd\bluetooth\LBTServ.dll
.
------------------------ Pozostałe uruchomione procesy ------------------------
.
c:\windows\system32\ati2evxx.exe
c:\windows\system32\devldr32.exe
c:\windows\system32\ati2evxx.exe
c:\windows\system32\wdfmgr.exe
c:\windows\system32\wscntfy.exe
c:\program files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
c:\documents and settings\czeresio\Menu Start\Programy\Autostart\gamma.exe
c:\program files\Common Files\Logishrd\KHAL2\KHALMNPR.exe
c:\programy\Winamp\winamp.exe
c:\program files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
.
**************************************************************************
.
Czas ukończenia: 2009-03-08 14:46:44 - komputer został uruchomiony ponownie
ComboFix-quarantined-files.txt 2009-03-08 13:46:41
ComboFix2.txt 2009-03-02 21:53:29
ComboFix3.txt 2009-03-01 18:18:24
ComboFix4.txt 2009-02-10 18:53:07
ComboFix5.txt 2009-03-08 13:41:29
Przed: 1 397 403 648 bajtów wolnych
Po: 1,406,558,208 bajtów wolnych
734 --- E O F --- 2009-02-26 16:07:24
