trojan, amvo.exe, nieaktywna opcja "pokaż ukryte...&quo

**Posty:** 5 · przez **syrekgzk** 20 Lut 2008, 21:43

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 20:27:00, on 2008-02-20 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe C:\WINDOWS\system32\wscntfy.exe C:\Program Files\Gadu-Gadu\gg.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Documents and Settings\Radek\Pulpit\HiJackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://codec.kiev.ua/ R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: flashget urlcatch - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\Program Files\FlashGet\jccatch.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O2 - BHO: FlashGet GetFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\Program Files\FlashGet\getflash.dll O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe" O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O8 - Extra context menu item: &Ściągnij przy pomocy FlashGet'a - C:\Program Files\FlashGet\jc_link.htm O8 - Extra context menu item: &Ściągnij wszystko przy pomocy FlashGet'a - C:\Program Files\FlashGet\jc_all.htm O8 - Extra context menu item: Dodaj do blokowanych banerów - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\ie_banner_deny.htm O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra button: Statystyki dla ochrony WWW - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\SCIEPlgn.dll O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - cdweb:/swflash.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{0C61C924-44DC-45AD-865F-07EF665995D1}: NameServer = 88.220.67.2 213.199.194.20 O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O20 - AppInit_DLLs: C:\PROGRA~1\KASPER~1\KASPER~1.0\adialhk.dll O23 - Service: Kaspersky Internet Security 7.0 (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe -- End of file - 4013 bytes

witam wszystkich, proszę o pomoc w związku z tym uciążliwym trojanem. nieaktywna jest opcja "pokaż ukryte pliki lub foldery". zainstalowałem kasperskyego, niby usunął wszystko, jednak dalej opcja ta jest nieaktywna. podaję log z hjt, proszę o pomoc. jeśli mogę coś jeszcze zrobić, dodać, inaczej sformułować prośbę, proszę dać mi znać. jestem nowy na tym forum, mam nadzieję na odrobinę wyrozumiałości i zrozumienia

dziękuję z góry i pozdrawiam

**Posty:** 18165 · przez **wojtas** 20 Lut 2008, 21:46

Wykonaj to co jest podane w tym temacie

Zastosuj SDFix . Po pobraniu uruchom go a rozpakuje się do C:\SDFix. Uruchom komputer w trybie awaryjnym (F8 przy stracie systemu). Będąc w awaryjnym uruchom plik RunThis.bat z folderu SDFixa. Zatwierdź czyszczenie przez Y. Poczekaj aż ukończy i komputer zresetuje

Potem wejdz do folderu C:\SDFix wrzuc zawartość pliku Report.txt + log z combofixa oraz z hijacka

**Posty:** 5 · przez **syrekgzk** 20 Lut 2008, 23:19

report.txt

Kod: Zaznacz wszystko: [b][u]SDFix: Version 1.144[/u][/b] Run by Administrator on 2008-02-20 at 21:46 Microsoft Windows XP [Wersja 5.1.2600] Running From: C:\SDFix [b][u]Checking Services[/u][/b]: Restoring Windows Registry Values Restoring Windows Default Hosts File Rebooting... [b][u]Checking Files[/u][/b]: Trojan Files Found: C:\autorun.inf - Deleted Removing Temp Files... [b][u]ADS Check[/u][/b]: [b][u]Final Check[/u][/b]: catchme 0.3.1344.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-02-20 21:50:31 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... scanning hidden services & system hive ... [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\d347prt\Cfg\0Jf40] scanning hidden registry entries ... [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\A\1\5\1c] "Order"=hex:08,00,00,00,02,00,00,00,b8,01,00,00,01,00,00,00,04,00,00,00,8c,.. scanning hidden files ... scan completed successfully hidden processes: 0 hidden services: 0 hidden files: 0 [b][u]Remaining Services[/u][/b]: Authorized Application Key Export: [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "C:\\Program Files\\Mozilla Firefox\\firefox.exe"="C:\\Program Files\\Mozilla Firefox\\firefox.exe:*:Enabled:Mozilla Firefox" "C:\\Program Files\\FlashGet\\flashget.exe"="C:\\Program Files\\FlashGet\\flashget.exe:*:Enabled:Flashget" "C:\\Program Files\\Skype\\Phone\\Skype.exe"="C:\\Program Files\\Skype\\Phone\\Skype.exe:*:Enabled:Skype" [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list] "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" [b][u]Remaining Files[/u][/b]: File Backups: - C:\SDFix\backups\backups.zip [b][u]Files with Hidden Attributes[/u][/b]: Sun 17 Feb 2008 54,784 ..SHR --- "C:\WINDOWS\system32\amvo0.dll" Sun 17 Feb 2008 54,784 ..SHR --- "C:\WINDOWS\system32\amvo1.dll" Sun 17 Feb 2008 29,691 A..H. --- "C:\Documents and Settings\Radek\Ustawienia lokalne\Temp\z5.dll" [b]Finished![/b]

hj

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 22:16, on 2008-02-20 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe C:\WINDOWS\system32\ctfmon.exe C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\system32\wuauclt.exe C:\Documents and Settings\Radek\Pulpit\Hijackthis\HiJackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://codec.kiev.ua/ R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: flashget urlcatch - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\Program Files\FlashGet\jccatch.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O2 - BHO: FlashGet GetFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\Program Files\FlashGet\getflash.dll O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe" O4 - HKLM\..\Run: [combofix] C:\WINDOWS\system32\kmd.exe /c C:\ComboFix\Combobatch.bat O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O8 - Extra context menu item: &Ściągnij przy pomocy FlashGet'a - C:\Program Files\FlashGet\jc_link.htm O8 - Extra context menu item: &Ściągnij wszystko przy pomocy FlashGet'a - C:\Program Files\FlashGet\jc_all.htm O8 - Extra context menu item: Dodaj do blokowanych banerów - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\ie_banner_deny.htm O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra button: Statystyki dla ochrony WWW - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\SCIEPlgn.dll O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - cdweb:/swflash.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{0C61C924-44DC-45AD-865F-07EF665995D1}: NameServer = 88.220.67.2 213.199.194.20 O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O20 - AppInit_DLLs: C:\PROGRA~1\KASPER~1\KASPER~1.0\adialhk.dll O23 - Service: Kaspersky Internet Security 7.0 (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe -- End of file - 4061 bytes

combofixa uruchomiłem, jak uzyskać z niego loga? próbowałem znaleźć w folderu na C ale nie potrafię

ok, już jest

combofix

Kod: Zaznacz wszystko: ComboFix 08-02-20.2 - Radek 2008-02-20 22:29:25.2 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.218 [GMT 1:00] Running from: C:\Documents and Settings\Radek\Pulpit\combofix\ComboFix.exe [color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color] . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . . ---- Previous Run ------- . C:\WINDOWS\system32\amvo0.dll C:\WINDOWS\system32\amvo1.dll D:\Autorun.inf E:\Autorun.inf . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\nm ((((((((((((((((((((((((( Files Created from 2008-01-20 to 2008-02-20 ))))))))))))))))))))))))))))))) . 2008-02-20 21:44 . 2008-02-20 21:44 <DIR> d-------- C:\WINDOWS\ERUNT 2008-02-20 21:43 . 2007-12-27 22:15 <DIR> d--h----- C:\Documents and Settings\Administrator\Ustawienia lokalne 2008-02-20 21:43 . 2007-12-27 22:15 <DIR> d-------- C:\Documents and Settings\Administrator\Ulubione 2008-02-20 21:43 . 2007-12-27 21:23 <DIR> d--h----- C:\Documents and Settings\Administrator\Szablony 2008-02-20 21:43 . 2008-02-20 21:45 <DIR> d-------- C:\Documents and Settings\Administrator\Pulpit 2008-02-20 21:43 . 2007-12-27 22:15 <DIR> d-------- C:\Documents and Settings\Administrator\Moje dokumenty 2008-02-20 21:43 . 2007-12-27 22:15 <DIR> dr------- C:\Documents and Settings\Administrator\Menu Start 2008-02-20 21:43 . 2007-12-27 22:15 <DIR> dr-h----- C:\Documents and Settings\Administrator\Dane aplikacji 2008-02-20 21:40 . 2008-02-20 21:51 <DIR> d-------- C:\SDFix 2008-02-18 09:49 . 2008-02-18 09:49 249,856 --------- C:\WINDOWS\Setup1.exe 2008-02-18 09:49 . 2008-02-18 09:49 73,216 --a------ C:\WINDOWS\ST6UNST.EXE 2008-02-18 09:40 . 2008-02-18 09:40 <DIR> d-------- C:\Program Files\DomPlayer 2008-02-17 19:21 . 2008-02-17 19:21 <DIR> d-------- C:\Program Files\Kaspersky Lab 2008-02-17 19:21 . 2008-02-20 22:14 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab 2008-02-17 19:21 . 2008-02-20 22:36 1,467,680 --ahs---- C:\WINDOWS\system32\drivers\fidbox.dat 2008-02-17 19:21 . 2008-02-17 19:33 91,700 --a------ C:\WINDOWS\system32\drivers\klin.dat 2008-02-17 19:21 . 2008-02-17 19:33 85,860 --a------ C:\WINDOWS\system32\drivers\klick.dat 2008-02-17 19:21 . 2008-02-20 22:36 28,960 --ahs---- C:\WINDOWS\system32\drivers\fidbox2.dat 2008-02-17 19:21 . 2008-02-20 22:13 22,928 --ahs---- C:\WINDOWS\system32\drivers\fidbox.idx 2008-02-17 19:21 . 2008-02-20 22:13 4,664 --ahs---- C:\WINDOWS\system32\drivers\fidbox2.idx 2008-02-17 19:20 . 2008-02-17 19:20 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab Setup Files 2008-02-14 21:33 . 2008-02-14 21:33 <DIR> d-------- C:\Program Files\PITy 2008-02-13 19:05 . 2008-02-13 19:05 <DIR> d-------- C:\Program Files\CDex_150 2008-02-11 22:27 . 2008-02-11 22:27 1 --a------ C:\WINDOWS\system32\SI.bin 2008-02-04 21:14 . 2008-02-18 17:39 <DIR> d-------- C:\Documents and Settings\Radek\Dane aplikacji\OpenOffice.org2 2008-02-03 18:53 . 2008-02-03 18:53 <DIR> d-------- C:\Program Files\OpenOffice.org 2.3 2008-02-03 18:52 . 2008-02-03 18:52 <DIR> d-------- C:\Program Files\Open Office 2008-02-01 16:45 . 2008-02-01 16:45 <DIR> d-------- C:\Documents and Settings\Radek\Dane aplikacji\U3 2008-01-29 17:02 . 2008-02-19 22:47 69 --a------ C:\WINDOWS\NeroDigital.ini 2008-01-26 21:19 . 2005-09-01 11:03 127,488 --------- C:\WINDOWS\system32\drivers\imagesrv.sys 2008-01-26 21:19 . 2005-09-01 11:03 5,888 --------- C:\WINDOWS\system32\drivers\imagedrv.sys 2008-01-26 21:18 . 2008-01-26 21:18 <DIR> d-------- C:\Program Files\Common Files\Ahead 2008-01-26 21:18 . 2008-01-26 21:18 <DIR> d-------- C:\Program Files\Ahead 2008-01-26 21:18 . 2004-07-26 16:16 1,568,768 --------- C:\WINDOWS\system32\ImagX7.dll 2008-01-26 21:18 . 2004-07-26 16:16 476,320 --------- C:\WINDOWS\system32\ImagXpr7.dll 2008-01-26 21:18 . 2004-07-26 16:16 471,040 --------- C:\WINDOWS\system32\ImagXRA7.dll 2008-01-26 21:18 . 2004-07-09 08:43 364,544 --------- C:\WINDOWS\system32\TwnLib4.dll 2008-01-26 21:18 . 2004-07-26 16:16 262,144 --------- C:\WINDOWS\system32\ImagXR7.dll 2008-01-26 21:18 . 2001-07-09 10:50 155,648 --a------ C:\WINDOWS\system32\NeroCheck.exe 2008-01-26 21:18 . 2000-06-26 10:45 106,496 --a------ C:\WINDOWS\system32\TwnLib20.dll 2008-01-25 20:29 . 1994-09-21 03:00 12,800 --a------ C:\WINDOWS\system32\WING32.DLL 2008-01-25 20:28 . 2008-01-25 20:29 <DIR> d-------- C:\Program Files\Heroes2 2008-01-25 20:28 . 2008-01-25 20:28 <DIR> d-------- C:\Documents and Settings\Radek\WINDOWS 2008-01-25 20:28 . 1996-10-15 18:01 298,496 --a------ C:\WINDOWS\uninst.exe 2008-01-25 13:56 . 2008-01-25 14:02 60 --a------ C:\WINDOWS\WININIT.INI 2008-01-22 21:32 . 2008-02-19 22:46 <DIR> d-------- C:\Downloads 2008-01-22 12:50 . 2008-02-13 14:09 <DIR> d-------- C:\Program Files\NAPI-PROJEKT 2008-01-21 11:20 . 2008-02-18 15:11 <DIR> d-------- C:\Documents and Settings\Radek\Dane aplikacji\Azureus 2008-01-21 11:20 . 2008-01-21 11:20 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Azureus 2008-01-21 11:19 . 2008-01-21 11:19 <DIR> d-------- C:\Program Files\Azureus 2008-01-21 11:11 . 2008-01-21 11:11 <DIR> d-------- C:\Program Files\xp-AntiSpy . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-02-19 22:45 --------- d-----w C:\Program Files\FlashGet 2008-02-12 11:30 --------- d-----w C:\Program Files\Common Files\InstallShield 2008-02-12 11:29 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-01-29 13:15 --------- d-----w C:\Documents and Settings\Radek\Dane aplikacji\Skype 2008-01-29 10:30 --------- d-----w C:\Documents and Settings\Radek\Dane aplikacji\skypePM 2008-01-25 13:01 11,376 ----a-w C:\WINDOWS\system32\drivers\secdrv.sys 2008-01-21 10:57 359,040 ----a-w C:\WINDOWS\system32\drivers\tcpip.sys 2008-01-17 10:39 --------- d-----w C:\Program Files\Real Alternative 2008-01-17 10:39 --------- d-----w C:\Program Files\Media Player Classic 2008-01-17 10:39 --------- d-----w C:\Documents and Settings\Radek\Dane aplikacji\Media Player Classic 2008-01-06 00:20 --------- d-----w C:\Program Files\Winamp 2008-01-05 13:46 --------- d-----w C:\Program Files\Java 2008-01-05 13:36 --------- d-----w C:\Program Files\Common Files\Java 2008-01-04 19:28 --------- d-----w C:\Documents and Settings\Radek\Dane aplikacji\AdobeUM 2008-01-02 14:04 --------- d-----w C:\Documents and Settings\Radek\Dane aplikacji\teamspeak2 2008-01-01 21:14 --------- d-----w C:\Program Files\Lavasoft 2008-01-01 21:14 --------- d-----w C:\Documents and Settings\Radek\Dane aplikacji\Lavasoft 2007-12-30 21:18 32 ----a-w C:\Documents and Settings\All Users\Dane aplikacji\ezsid.dat 2007-12-30 21:15 --------- d-----w C:\Program Files\Skype 2007-12-30 21:15 --------- d-----w C:\Program Files\Common Files\Skype 2007-12-30 21:15 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Skype 2007-12-30 21:02 --------- d-----w C:\Program Files\Teamspeak2_RC2 2007-12-29 12:11 10,345 ----a-w C:\WINDOWS\system32\drivers\hamachi.sys 2007-12-29 12:11 --------- d-----w C:\Program Files\RegCleaner 2007-12-29 12:11 --------- d-----w C:\Program Files\Hamachi 2007-12-29 10:53 139,264 ----a-w C:\WINDOWS\War3Unin.exe 2007-12-29 10:37 --------- d-----w C:\Program Files\D-Tools 2007-12-27 21:37 --------- d-----w C:\Program Files\Common Files\Adobe 2007-12-27 21:34 --------- d-----w C:\Program Files\ACE Mega CoDecS Pack 2007-12-27 21:31 --------- d-----w C:\Program Files\MarBit 2007-12-27 21:25 --------- d-----w C:\Program Files\Gadu-Gadu 2007-12-27 21:24 --------- d-----w C:\Program Files\Hewlett-Packard 2007-12-27 21:20 --------- d-----w C:\Program Files\HP 2007-12-27 21:11 --------- d-----w C:\Program Files\Realtek 2007-12-27 20:28 --------- d-----w C:\Program Files\microsoft frontpage 2007-12-27 20:27 --------- d-----w C:\Program Files\Usługi online . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 01:44 15360] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "AVP"="C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe" [2007-06-28 12:51 218376] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 01:44 15360] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "AppInit_DLLs"=C:\PROGRA~1\KASPER~1\KASPER~1.0\adialhk.dll [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Adobe Reader Speed Launch.lnk] path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Adobe Reader Speed Launch.lnk backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Microsoft Office.lnk] path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Microsoft Office.lnk backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^Radek^Menu Start^Programy^Autostart^OpenOffice.org 2.3.lnk] path=C:\Documents and Settings\Radek\Menu Start\Programy\Autostart\OpenOffice.org 2.3.lnk backup=C:\WINDOWS\pss\OpenOffice.org 2.3.lnkStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Alcmtr] -r------- 2005-05-03 11:43 69632 C:\WINDOWS\Alcmtr.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\amva] C:\WINDOWS\system32\amvo.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE] --a------ 2004-08-04 01:44 15360 C:\WINDOWS\system32\ctfmon.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools-1033] --a------ 2004-08-22 17:05 81920 C:\Program Files\D-Tools\daemon.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Component Manager] --a------ 2003-12-22 08:38 241664 C:\Program Files\HP\hpcoretech\hpcmpmgr.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update] --a------ 2004-05-13 02:28 49152 C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HPDJ Taskbar Utility] --a------ 2004-05-13 02:28 172032 C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb10.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] --a------ 2001-07-09 10:50 155648 C:\WINDOWS\system32\NeroCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RTHDCPL] -r------- 2006-09-12 09:58 16264192 C:\WINDOWS\RTHDCPL.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype] -ra------ 2007-12-12 15:23 21686568 C:\Program Files\Skype\Phone\Skype.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SkyTel] -r------- 2006-05-16 11:04 2879488 C:\WINDOWS\SkyTel.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched] --a------ 2007-09-25 01:11 132496 C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe R3 klim5;Kaspersky Anti-Virus NDIS Filter;C:\WINDOWS\system32\DRIVERS\klim5.sys [2007-04-04 14:58] R3 RMSPPPOE;WAN Miniport (PPP over Ethernet Protocol);C:\WINDOWS\system32\DRIVERS\RMSPPPOE.SYS [2004-06-25 10:04] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\I] \Shell\AutoRun\command - I:\LaunchU3.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{04ceaaf8-ce54-11dc-a6e4-0040f4b1592e}] \Shell\AutoRun\command - I:\LaunchU3.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{04ceaaf9-ce54-11dc-a6e4-0040f4b1592e}] \Shell\AutoRun\command - J:\xo8wr9.exe \Shell\explore\Command - J:\xo8wr9.exe \Shell\open\Command - J:\xo8wr9.exe . ************************************************************************** catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-02-20 22:36:46 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2008-02-20 22:37:51 ComboFix-quarantined-files.txt 2008-02-20 21:37:46

**Posty:** 8001 · przez **Okocza** 20 Lut 2008, 23:22

c:\combofix.txt :arrow:

tam masz raport.

**Posty:** 18165 · przez **wojtas** 20 Lut 2008, 23:23

combofixa uruchamiasz i czekasz log sam wyskoczy a jak nie to gdzie bedzie na dysku C

**Posty:** 5 · przez **syrekgzk** 20 Lut 2008, 23:47

uaktualniłem post wcześniejszy o log z combofixa

**Posty:** 18165 · przez **wojtas** 21 Lut 2008, 00:02

Otworz notatnik i wklej w nim to:

File::
C:\Documents and Settings\Radek\Ustawienia lokalne\Temp\z5.dll

Registry::
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{04ceaaf9-ce54-11dc-a6e4-0040f4b1592e}]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\amva]

Plik >>> zapisz jako CFScript.txt .Plik przeciągnij i upuść na ikonę ComboFixa (tak jak tu ) . odczekaj az wygeneruje sie nowy log i go daj na forum

**Posty:** 5 · przez **syrekgzk** 21 Lut 2008, 00:18

Kod: Zaznacz wszystko: ComboFix 08-02-20.2 - Radek 2008-02-20 23:10:41.3 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.194 [GMT 1:00] Running from: C:\Documents and Settings\Radek\Pulpit\combofix\ComboFix.exe Command switches used :: C:\Documents and Settings\Radek\Pulpit\combofix\CFScript.txt * Created a new restore point [color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color] FILE :: C:\Documents and Settings\Radek\Ustawienia lokalne\Temp\z5.dll . ((((((((((((((((((((((((( Files Created from 2008-01-20 to 2008-02-20 ))))))))))))))))))))))))))))))) . 2008-02-20 21:44 . 2008-02-20 21:44 <DIR> d-------- C:\WINDOWS\ERUNT 2008-02-20 21:43 . 2008-02-20 22:37 <DIR> d--h----- C:\Documents and Settings\Administrator\Ustawienia lokalne 2008-02-20 21:43 . 2007-12-27 22:15 <DIR> d-------- C:\Documents and Settings\Administrator\Ulubione 2008-02-20 21:43 . 2007-12-27 21:23 <DIR> d--h----- C:\Documents and Settings\Administrator\Szablony 2008-02-20 21:43 . 2008-02-20 21:45 <DIR> d-------- C:\Documents and Settings\Administrator\Pulpit 2008-02-20 21:43 . 2007-12-27 22:15 <DIR> d-------- C:\Documents and Settings\Administrator\Moje dokumenty 2008-02-20 21:43 . 2007-12-27 22:15 <DIR> dr------- C:\Documents and Settings\Administrator\Menu Start 2008-02-20 21:43 . 2007-12-27 22:15 <DIR> dr-h----- C:\Documents and Settings\Administrator\Dane aplikacji 2008-02-20 21:40 . 2008-02-20 21:51 <DIR> d-------- C:\SDFix 2008-02-18 09:49 . 2008-02-18 09:49 249,856 --------- C:\WINDOWS\Setup1.exe 2008-02-18 09:49 . 2008-02-18 09:49 73,216 --a------ C:\WINDOWS\ST6UNST.EXE 2008-02-18 09:40 . 2008-02-18 09:40 <DIR> d-------- C:\Program Files\DomPlayer 2008-02-17 19:21 . 2008-02-17 19:21 <DIR> d-------- C:\Program Files\Kaspersky Lab 2008-02-17 19:21 . 2008-02-20 22:14 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab 2008-02-17 19:21 . 2008-02-20 23:15 1,612,832 --ahs---- C:\WINDOWS\system32\drivers\fidbox.dat 2008-02-17 19:21 . 2008-02-17 19:33 91,700 --a------ C:\WINDOWS\system32\drivers\klin.dat 2008-02-17 19:21 . 2008-02-17 19:33 85,860 --a------ C:\WINDOWS\system32\drivers\klick.dat 2008-02-17 19:21 . 2008-02-20 23:15 31,008 --ahs---- C:\WINDOWS\system32\drivers\fidbox2.dat 2008-02-17 19:21 . 2008-02-20 22:13 22,928 --ahs---- C:\WINDOWS\system32\drivers\fidbox.idx 2008-02-17 19:21 . 2008-02-20 22:13 4,664 --ahs---- C:\WINDOWS\system32\drivers\fidbox2.idx 2008-02-17 19:20 . 2008-02-17 19:20 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab Setup Files 2008-02-14 21:33 . 2008-02-14 21:33 <DIR> d-------- C:\Program Files\PITy 2008-02-13 19:05 . 2008-02-13 19:05 <DIR> d-------- C:\Program Files\CDex_150 2008-02-11 22:27 . 2008-02-11 22:27 1 --a------ C:\WINDOWS\system32\SI.bin 2008-02-04 21:14 . 2008-02-18 17:39 <DIR> d-------- C:\Documents and Settings\Radek\Dane aplikacji\OpenOffice.org2 2008-02-03 18:53 . 2008-02-03 18:53 <DIR> d-------- C:\Program Files\OpenOffice.org 2.3 2008-02-03 18:52 . 2008-02-03 18:52 <DIR> d-------- C:\Program Files\Open Office 2008-02-01 16:45 . 2008-02-01 16:45 <DIR> d-------- C:\Documents and Settings\Radek\Dane aplikacji\U3 2008-01-29 17:02 . 2008-02-19 22:47 69 --a------ C:\WINDOWS\NeroDigital.ini 2008-01-26 21:19 . 2005-09-01 11:03 127,488 --------- C:\WINDOWS\system32\drivers\imagesrv.sys 2008-01-26 21:19 . 2005-09-01 11:03 5,888 --------- C:\WINDOWS\system32\drivers\imagedrv.sys 2008-01-26 21:18 . 2008-01-26 21:18 <DIR> d-------- C:\Program Files\Common Files\Ahead 2008-01-26 21:18 . 2008-01-26 21:18 <DIR> d-------- C:\Program Files\Ahead 2008-01-26 21:18 . 2004-07-26 16:16 1,568,768 --------- C:\WINDOWS\system32\ImagX7.dll 2008-01-26 21:18 . 2004-07-26 16:16 476,320 --------- C:\WINDOWS\system32\ImagXpr7.dll 2008-01-26 21:18 . 2004-07-26 16:16 471,040 --------- C:\WINDOWS\system32\ImagXRA7.dll 2008-01-26 21:18 . 2004-07-09 08:43 364,544 --------- C:\WINDOWS\system32\TwnLib4.dll 2008-01-26 21:18 . 2004-07-26 16:16 262,144 --------- C:\WINDOWS\system32\ImagXR7.dll 2008-01-26 21:18 . 2001-07-09 10:50 155,648 --a------ C:\WINDOWS\system32\NeroCheck.exe 2008-01-26 21:18 . 2000-06-26 10:45 106,496 --a------ C:\WINDOWS\system32\TwnLib20.dll 2008-01-25 20:29 . 1994-09-21 03:00 12,800 --a------ C:\WINDOWS\system32\WING32.DLL 2008-01-25 20:28 . 2008-01-25 20:29 <DIR> d-------- C:\Program Files\Heroes2 2008-01-25 20:28 . 2008-01-25 20:28 <DIR> d-------- C:\Documents and Settings\Radek\WINDOWS 2008-01-25 20:28 . 1996-10-15 18:01 298,496 --a------ C:\WINDOWS\uninst.exe 2008-01-25 13:56 . 2008-01-25 14:02 60 --a------ C:\WINDOWS\WININIT.INI 2008-01-22 21:32 . 2008-02-19 22:46 <DIR> d-------- C:\Downloads 2008-01-22 12:50 . 2008-02-13 14:09 <DIR> d-------- C:\Program Files\NAPI-PROJEKT 2008-01-21 11:20 . 2008-02-18 15:11 <DIR> d-------- C:\Documents and Settings\Radek\Dane aplikacji\Azureus 2008-01-21 11:20 . 2008-01-21 11:20 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Azureus 2008-01-21 11:19 . 2008-01-21 11:19 <DIR> d-------- C:\Program Files\Azureus 2008-01-21 11:11 . 2008-01-21 11:11 <DIR> d-------- C:\Program Files\xp-AntiSpy . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-02-19 22:45 --------- d-----w C:\Program Files\FlashGet 2008-02-12 11:30 --------- d-----w C:\Program Files\Common Files\InstallShield 2008-02-12 11:29 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-01-29 13:15 --------- d-----w C:\Documents and Settings\Radek\Dane aplikacji\Skype 2008-01-29 10:30 --------- d-----w C:\Documents and Settings\Radek\Dane aplikacji\skypePM 2008-01-25 13:01 11,376 ----a-w C:\WINDOWS\system32\drivers\secdrv.sys 2008-01-21 10:57 359,040 ----a-w C:\WINDOWS\system32\drivers\tcpip.sys 2008-01-17 10:39 --------- d-----w C:\Program Files\Real Alternative 2008-01-17 10:39 --------- d-----w C:\Program Files\Media Player Classic 2008-01-17 10:39 --------- d-----w C:\Documents and Settings\Radek\Dane aplikacji\Media Player Classic 2008-01-06 00:20 --------- d-----w C:\Program Files\Winamp 2008-01-05 13:46 --------- d-----w C:\Program Files\Java 2008-01-05 13:36 --------- d-----w C:\Program Files\Common Files\Java 2008-01-04 19:28 --------- d-----w C:\Documents and Settings\Radek\Dane aplikacji\AdobeUM 2008-01-02 14:04 --------- d-----w C:\Documents and Settings\Radek\Dane aplikacji\teamspeak2 2008-01-01 21:14 --------- d-----w C:\Program Files\Lavasoft 2008-01-01 21:14 --------- d-----w C:\Documents and Settings\Radek\Dane aplikacji\Lavasoft 2007-12-30 21:18 32 ----a-w C:\Documents and Settings\All Users\Dane aplikacji\ezsid.dat 2007-12-30 21:15 --------- d-----w C:\Program Files\Skype 2007-12-30 21:15 --------- d-----w C:\Program Files\Common Files\Skype 2007-12-30 21:15 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Skype 2007-12-30 21:02 --------- d-----w C:\Program Files\Teamspeak2_RC2 2007-12-29 12:11 10,345 ----a-w C:\WINDOWS\system32\drivers\hamachi.sys 2007-12-29 12:11 --------- d-----w C:\Program Files\RegCleaner 2007-12-29 12:11 --------- d-----w C:\Program Files\Hamachi 2007-12-29 10:53 139,264 ----a-w C:\WINDOWS\War3Unin.exe 2007-12-29 10:37 --------- d-----w C:\Program Files\D-Tools 2007-12-27 21:37 --------- d-----w C:\Program Files\Common Files\Adobe 2007-12-27 21:34 --------- d-----w C:\Program Files\ACE Mega CoDecS Pack 2007-12-27 21:31 --------- d-----w C:\Program Files\MarBit 2007-12-27 21:25 --------- d-----w C:\Program Files\Gadu-Gadu 2007-12-27 21:24 --------- d-----w C:\Program Files\Hewlett-Packard 2007-12-27 21:20 --------- d-----w C:\Program Files\HP 2007-12-27 21:11 --------- d-----w C:\Program Files\Realtek 2007-12-27 20:28 --------- d-----w C:\Program Files\microsoft frontpage 2007-12-27 20:27 --------- d-----w C:\Program Files\Usługi online . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 01:44 15360] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "AVP"="C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe" [2007-06-28 12:51 218376] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 01:44 15360] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "AppInit_DLLs"=C:\PROGRA~1\KASPER~1\KASPER~1.0\adialhk.dll [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Adobe Reader Speed Launch.lnk] path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Adobe Reader Speed Launch.lnk backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Microsoft Office.lnk] path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Microsoft Office.lnk backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^Radek^Menu Start^Programy^Autostart^OpenOffice.org 2.3.lnk] path=C:\Documents and Settings\Radek\Menu Start\Programy\Autostart\OpenOffice.org 2.3.lnk backup=C:\WINDOWS\pss\OpenOffice.org 2.3.lnkStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Alcmtr] -r------- 2005-05-03 11:43 69632 C:\WINDOWS\Alcmtr.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE] --a------ 2004-08-04 01:44 15360 C:\WINDOWS\system32\ctfmon.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools-1033] --a------ 2004-08-22 17:05 81920 C:\Program Files\D-Tools\daemon.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Component Manager] --a------ 2003-12-22 08:38 241664 C:\Program Files\HP\hpcoretech\hpcmpmgr.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update] --a------ 2004-05-13 02:28 49152 C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HPDJ Taskbar Utility] --a------ 2004-05-13 02:28 172032 C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb10.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] --a------ 2001-07-09 10:50 155648 C:\WINDOWS\system32\NeroCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RTHDCPL] -r------- 2006-09-12 09:58 16264192 C:\WINDOWS\RTHDCPL.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype] -ra------ 2007-12-12 15:23 21686568 C:\Program Files\Skype\Phone\Skype.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SkyTel] -r------- 2006-05-16 11:04 2879488 C:\WINDOWS\SkyTel.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched] --a------ 2007-09-25 01:11 132496 C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe R3 klim5;Kaspersky Anti-Virus NDIS Filter;C:\WINDOWS\system32\DRIVERS\klim5.sys [2007-04-04 14:58] R3 RMSPPPOE;WAN Miniport (PPP over Ethernet Protocol);C:\WINDOWS\system32\DRIVERS\RMSPPPOE.SYS [2004-06-25 10:04] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\I] \Shell\AutoRun\command - I:\LaunchU3.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{04ceaaf8-ce54-11dc-a6e4-0040f4b1592e}] \Shell\AutoRun\command - I:\LaunchU3.exe . ************************************************************************** catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-02-20 23:15:50 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2008-02-20 23:17:07 ComboFix-quarantined-files.txt 2008-02-20 22:17:00 ComboFix2.txt 2008-02-20 21:37:52

oto log

**Posty:** 18165 · przez **wojtas** 21 Lut 2008, 00:19

czysto

**Posty:** 5 · przez **syrekgzk** 21 Lut 2008, 00:34

dzięki wielkie, świetne forum, bardzo szybka pomoc

wzór do naśladowania dla innych

jak będę miał jakiś problem podobnej natury na pewno tu się zwrócę o pomoc

jeszcze raz wielkie dzięki, pozdrawiam

trojan, amvo.exe, nieaktywna opcja "pokaż ukryte...&quo

trojan, amvo.exe, nieaktywna opcja "pokaż ukryte...&quo

Kto jest na forum