Worn.win32.netbooster

**Posty:** 128 · przez **Jarczew** 07 Wrz 2008, 13:51

Wirus Worn.win32.NetBooster sciana

W pasku koło zegara wyskoczył napis wirus alert. Z pulpitu poznikały niektóre ikony a pokazały się nieznane mi trzy programy zabezpieczajace prze wirusami. Zablokowane zostały podgląd dysków C i D. Nie był widoczny Panel sterowania, zablokowane wyjście do internetu, nie ma wejścia do wejścia do start-run.
W chwili obecnej odblokowałem podglad dysków za pomoca programu "RegAlyzer".Mogę wejść do panelu sterowania.
Niestety nie potrafię odblokować wyjścia do internetu, i nie mama możliwości wejścia do start-run.Niestety ComboScan nie mógł zrobić loga (informował że zablokowane sa niektóre opcje przez administratora).
Sprawdzałem pliki Hosts wyglądają chyba prawidłowo.
Teraz korzystam z osobnego dysku który podpiołem dodatkowo.

oto logi;

Kod: Zaznacz wszystko: Logfile of HijackThis v1.99.1 Scan saved at 11:55: VIRUS ALERT!, on 2008-09-07 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16705) Running processes: C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb07.exe C:\WINDOWS\SOUNDMAN.EXE C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe C:\Program Files\Common Files\Grass Valley\ProCoder 3\Kernel\PNXSERVR.exe C:\Program Files\iTunes\iTunesHelper.exe C:\WINDOWS\system32\RunDLL32.exe C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe C:\Program Files\SAGEM WiFi manager\WLANUTL.exe C:\Program Files\HijackThis\HijackThis.exe C:\WINDOWS\system32\notepad.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://wp.pl/ R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: QXK Olive - {26027218-80B3-40FA-9FA1-70FD56AA5328} - C:\WINDOWS\rodqgpvldbv.dll O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll O3 - Toolbar: &Translator Internet - {8E4AA109-7239-4B85-8196-7377A53DDEFF} - C:\PROGRA~1\Antadis\TRANSL~1\DELPHI~1.DLL O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll O4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINDOWS\system32\PSDrvCheck.exe -CheckReg O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb07.exe O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" O4 - HKLM\..\Run: [Acrobat Assistant 8.0] "C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe" O4 - HKLM\..\Run: [Adobe_ID0EYTHM] C:\PROGRA~1\COMMON~1\Adobe\ADOBEV~1\Server\bin\VERSIO~2.EXE O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [DigidesignMMERefresh] C:\Program Files\Digidesign\Drivers\MMERefresh.exe O4 - HKLM\..\Run: [NexusServer] "C:\Program Files\Common Files\Grass Valley\ProCoder 3\Kernel\PNXSERVR.exe" -SelfLaunch O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [PCLEPCI] C:\PROGRA~1\PINNAC~1\PPE\PPE.EXE O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice O4 - HKLM\..\Run: [QD FastAndSafe] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [iKeyWorks] C:\PROGRA~1\A4Tech\Keyboard\Ikeymain.exe O4 - HKLM\..\Run: [GhostStartTrayApp] C:\Program Files\Norton SystemWorks\Norton Ghost\GhostStartTrayApp.exe O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe" O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [EPSON Stylus Photo R285 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATICKE.EXE /FU "C:\WINDOWS\TEMP\E_S38D.tmp" /EF "HKCU" O4 - HKCU\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe O4 - Global Startup: Program sieciowy dla SAGEM Wi-Fi 11g USB adapter.lnk = ? O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present O8 - Extra context menu item: Append to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra button: Szybkie dostosowywanie programu Outpost Firewall Pro - {44627E97-789B-40d4-B5C2-58BD171129A1} - C:\WINDOWS\System32\shdocvw.dll O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O10 - Unknown file in Winsock LSP: c:\program files\bonjour\mdnsnsp.dll O11 - Options group: [INTERNATIONAL] International* O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - http://www.nvidia.com/content/DriverDownload/srl/2.0.0.1/sysreqlab2.cab O16 - DPF: {68282C51-9459-467B-95BF-3C0E89627E55} (MksSkanerOnline Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab O16 - DPF: {74DBCB52-F298-4110-951D-AD2FF67BC8AB} (NVIDIA Smart Scan) - http://www.nvidia.com/content/DriverDownload/nforce/NvidiaSmartScan.cab O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: Adobe Version Cue CS3 - Unknown owner - C:\Program Files\Common Files\Adobe\Adobe Version Cue CS3\Server\bin\VersionCueCS3.exe" -win32service (file missing) O23 - Service: Urządzenie mobilne Apple (Apple Mobile Device) - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: AutoComplete Service (Autocomplete) - Unknown owner - --C:\Program Files\Acesoft\Tracks Eraser Pro\delautocomp.exe (file missing) O23 - Service: AVG Anti-Spyware Guard - Unknown owner - -C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe (file missing) O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe O23 - Service: Avid SDM Service (AvidSDMService) - Avid Technology, Inc. - C:\WINDOWS\system32\AvidSDMService.exe O23 - Service: Avid Startup (AvidStartup) - Unknown owner - C:\WINDOWS\system32\AvidStartup.exe O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: Digidesign MME Refresh Service (DigiRefresh) - Digidesign, A Division of Avid Technology, Inc. - C:\Program Files\Digidesign\Drivers\MMERefresh.exe O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe O23 - Service: GhostStartService - Unknown owner - --C:\Program Files\Norton SystemWorks\Norton Ghost\GhostStartService.exe (file missing) O23 - Service: Google Updater Service (gusvc) - Unknown owner - --"C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe (file missing) O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: Usługa iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe O23 - Service: Norton Unerase Protection (NProtectService) - Unknown owner - --C:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.EXE (file missing) O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: Office Source Engine (ose) - Unknown owner - --"C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE (file missing) O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared files\RichVideo.exe

Kod: Zaznacz wszystko: "Silent Runners.vbs", revision 49, http://www.silentrunners.org/ Operating System: Windows XP SP2 Output limited to non-default values, except where indicated by "{++}" Startup items buried in registry: --------------------------------- HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ {++} "ctfmon.exe" = "C:\WINDOWS\system32\ctfmon.exe" [MS] "EPSON Stylus Photo R285 Series" = "C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATICKE.EXE /FU "C:\WINDOWS\TEMP\E_S38D.tmp" /EF "HKCU"" ["SEIKO EPSON CORPORATION"] "QuickTime Task" = ""C:\Program Files\QuickTime\QTTask.exe" -atboottime" ["Apple Inc."] HKLM\Software\Microsoft\Windows\CurrentVersion\Run\ {++} "PinnacleDriverCheck" = "C:\WINDOWS\system32\PSDrvCheck.exe -CheckReg" [empty string] "HPDJ Taskbar Utility" = "C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb07.exe" ["HP"] "SoundMan" = "SOUNDMAN.EXE" ["Realtek Semiconductor Corp."] "SunJavaUpdateSched" = ""C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"" ["Sun Microsystems, Inc."] "Acrobat Assistant 8.0" = ""C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe"" ["Adobe Systems Inc."] "(Default)" = "(empty string)" [file not found] "Adobe_ID0EYTHM" = "C:\PROGRA~1\COMMON~1\Adobe\ADOBEV~1\Server\bin\VERSIO~2.EXE" ["Adobe Systems Incorporated"] "Adobe Reader Speed Launcher" = ""C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"" ["Adobe Systems Incorporated"] "DigidesignMMERefresh" = "C:\Program Files\Digidesign\Drivers\MMERefresh.exe" ["Digidesign, A Division of Avid Technology, Inc."] "NexusServer" = ""C:\Program Files\Common Files\Grass Valley\ProCoder 3\Kernel\PNXSERVR.exe" -SelfLaunch" [null data] "QuickTime Task" = ""C:\Program Files\QuickTime\QTTask.exe" -atboottime" ["Apple Inc."] "iTunesHelper" = ""C:\Program Files\iTunes\iTunesHelper.exe"" ["Apple Inc."] "PCLEPCI" = "C:\PROGRA~1\PINNAC~1\PPE\PPE.EXE" ["Pinnacle Systems GmbH"] "NvCplDaemon" = "RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup" [MS] "nwiz" = "nwiz.exe /install" ["NVIDIA Corporation"] "NvMediaCenter" = "RunDLL32.exe NvMCTray.dll,NvTaskbarInit" [MS] "egui" = ""C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice" ["ESET"] "QD FastAndSafe" = "C:\WINDOWS\system32\NeroCheck.exe" ["Ahead Software Gmbh"] "NeroFilterCheck" = "C:\WINDOWS\system32\NeroCheck.exe" ["Ahead Software Gmbh"] "iKeyWorks" = "C:\PROGRA~1\A4Tech\Keyboard\Ikeymain.exe" ["A4Tech Co.,Ltd."] "GhostStartTrayApp" = "C:\Program Files\Norton SystemWorks\Norton Ghost\GhostStartTrayApp.exe" ["Symantec Corporation"] "AVG7_CC" = "C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP" ["GRISOFT, s.r.o."] "Adobe Photo Downloader" = ""C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe"" ["Adobe Systems Incorporated"] HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\(Default) = (no title provided) -> {HKLM...CLSID} = "Adobe PDF Reader Link Helper" \InProcServer32\(Default) = "C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll" ["Adobe Systems Incorporated"] {26027218-80B3-40FA-9FA1-70FD56AA5328}\(Default) = (no title provided) -> {HKLM...CLSID} = "QXK Olive" \InProcServer32\(Default) = "C:\WINDOWS\rodqgpvldbv.dll" [null data] {3049C3E9-B461-4BC5-8870-4C09146192CA}\(Default) = (no title provided) -> {HKLM...CLSID} = "RealPlayer Download and Record Plugin for Internet Explorer" \InProcServer32\(Default) = "C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll" ["RealPlayer"] {761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\(Default) = (no title provided) -> {HKLM...CLSID} = "SSVHelper Class" \InProcServer32\(Default) = "C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll" ["Sun Microsystems, Inc."] {AA58ED58-01DD-4d91-8333-CF10577473F7}\(Default) = (no title provided) -> {HKLM...CLSID} = "Google Toolbar Helper" \InProcServer32\(Default) = "c:\program files\google\googletoolbar3.dll" ["Google Inc."] {AE7CD045-E861-484f-8273-0445EE161910}\(Default) = (no title provided) -> {HKLM...CLSID} = "Adobe PDF Conversion Toolbar Helper" \InProcServer32\(Default) = "C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll" ["Adobe Systems Incorporated"] HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\ "{88895560-9AA2-1069-930E-00AA0030EBC8}" = "Rozszerzenie ikony HyperTerminalu" -> {HKLM...CLSID} = "HyperTerminal Icon Ext" \InProcServer32\(Default) = "C:\WINDOWS\System32\hticons.dll" ["Hilgraeve, Inc."] "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" = "WinRAR shell extension" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] "{00020D75-0000-0000-C000-000000000046}" = "Microsoft Office Outlook Desktop Icon Handler" -> {HKLM...CLSID} = "Microsoft Office Outlook" \InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\OFFICE11\MLSHEXT.DLL" [MS] "{0006F045-0000-0000-C000-000000000046}" = "Microsoft Office Outlook Custom Icon Handler" -> {HKLM...CLSID} = "Rozszerzenie ikon plików programu Outlook" \InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\OFFICE11\OLKFSTUB.DLL" [MS] "{42042206-2D85-11D3-8CFF-005004838597}" = "Microsoft Office HTML Icon Handler" -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "C:\Program Files\Microsoft Office\OFFICE11\msohev.dll" [MS] "{57C51AF9-DEF7-11D3-A801-00C04F163490}" = "Ghost Shell Extension" -> {HKLM...CLSID} = "PropPage Class" \InProcServer32\(Default) = "C:\Program Files\Norton SystemWorks\Norton Ghost\GhoShExt.dll" ["Symantec Corporation"] "{9F97547E-4609-42C5-AE0C-81C61FFAEBC3}" = "AVG7 Shell Extension" -> {HKLM...CLSID} = "AVG7 Shell Extension Class" \InProcServer32\(Default) = "C:\Program Files\Grisoft\AVG7\avgse.dll" ["GRISOFT, s.r.o."] "{9F97547E-460A-42C5-AE0C-81C61FFAEBC3}" = "AVG7 Find Extension" -> {HKLM...CLSID} = "AVG7 Find Extension Class" \InProcServer32\(Default) = "C:\Program Files\Grisoft\AVG7\avgse.dll" ["GRISOFT, s.r.o."] "{B327765E-D724-4347-8B16-78AE18552FC3}" = "NeroDigitalIconHandler" -> {HKLM...CLSID} = "NeroDigitalIconHandler Class" \InProcServer32\(Default) = "C:\Program Files\Common Files\Ahead\lib\NeroDigitalExt.dll" ["Nero AG"] "{7F1CF152-04F8-453A-B34C-E609530A9DC8}" = "NeroDigitalPropSheetHandler" -> {HKLM...CLSID} = "NeroDigitalPropSheetHandler Class" \InProcServer32\(Default) = "C:\Program Files\Common Files\Ahead\lib\NeroDigitalExt.dll" ["Nero AG"] "{A426B331-7F6F-4937-9B08-676A10A62F95}" = "Record Image to CD" -> {HKLM...CLSID} = "CDBurnerContextMenuHandler Class" \InProcServer32\(Default) = "C:\Program Files\Alex Feinman\ISO Recorder\ISORecorder.dll" ["Alex Feinman"] "{967B2D40-8B7D-4127-9049-61EA0C2C6DCE}" = "PowerISO" -> {HKLM...CLSID} = "PowerISO" \InProcServer32\(Default) = "C:\Program Files\PowerISO\PWRISOSH.DLL" ["PowerISO Computing, Inc."] "{792F0537-F929-4eb7-AC1D-FB6334C71550}" = "LG Phone" -> {HKLM...CLSID} = "LG Phone" \InProcServer32\(Default) = "C:\PROGRA~1\LGPCSU~1\LGPHON~1\Phone.dll" ["LG Electornics"] "{D25B2CAB-8A9A-4517-A9B2-CB5F68A5A802}" = "Adobe.Acrobat.ContextMenu" -> {HKLM...CLSID} = "Acrobat Elements Context Menu" \InProcServer32\(Default) = "C:\Program Files\Adobe\Acrobat 8.0\Acrobat Elements\ContextMenu.dll" ["Adobe Systems Inc."] "{F0CB00CD-5A07-4D91-97F5-A8C92CDA93E4}" = "Shell Extensions for RealOne Player" -> {HKLM...CLSID} = "RealOne Player Context Menu Class" \InProcServer32\(Default) = "C:\Program Files\Real\RealPlayer\rpshell.dll" ["RealNetworks, Inc."] "{B9E1D2CB-CCFF-4AA6-9579-D7A4754030EF}" = "iTunes" -> {HKLM...CLSID} = "iTunes" \InProcServer32\(Default) = "C:\Program Files\iTunes\iTunesMiniPlayer.dll" ["Apple Inc."] "{A70C977A-BF00-412C-90B7-034C51DA2439}" = "NvCpl DesktopContext Class" -> {HKLM...CLSID} = "DesktopContext Class" \InProcServer32\(Default) = "C:\WINDOWS\system32\nvcpl.dll" ["NVIDIA Corporation"] "{1CDB2949-8F65-4355-8456-263E7C208A5D}" = "Desktop Explorer" -> {HKLM...CLSID} = "Desktop Explorer" \InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"] "{1E9B04FB-F9E5-4718-997B-B8DA88302A47}" = "Desktop Explorer Menu" -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"] "{1E9B04FB-F9E5-4718-997B-B8DA88302A48}" = "nView Desktop Context Menu" -> {HKLM...CLSID} = "nView Desktop Context Menu" \InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"] "{FFB699E0-306A-11d3-8BD1-00104B6F7516}" = "Play on my TV helper" -> {HKLM...CLSID} = "NVIDIA CPL Extension" \InProcServer32\(Default) = "C:\WINDOWS\system32\nvcpl.dll" ["NVIDIA Corporation"] "{B089FE88-FB52-11D3-BDF1-0050DA34150D}" = "Eset Smart Security - Context Menu Shell Extension" -> {HKLM...CLSID} = "Eset Smart Security - Context Menu Shell Extension" \InProcServer32\(Default) = "C:\Program Files\ESET\ESET NOD32 Antivirus\shellExt.dll" ["ESET"] HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\ <<!>> "{57B86673-276A-48B2-BAE7-C6DBB3020EB8}" = "AVG Anti-Spyware 7.5" -> {HKLM...CLSID} = "CShellExecuteHookImpl Object" \InProcServer32\(Default) = "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\shellexecutehook.dll" ["GRISOFT s.r.o."] HKLM\Software\Classes\PROTOCOLS\Filter\ <<!>> text/xml\CLSID = "{807553E5-5146-11D5-A672-00B0D022E945}" -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL" [MS] HKLM\Software\Classes\Folder\shellex\ColumnHandlers\ {7D4D6379-F301-4311-BEBA-E26EB0561882}\(Default) = "NeroDigitalExt.NeroDigitalColumnHandler" -> {HKLM...CLSID} = "NeroDigitalColumnHandler Class" \InProcServer32\(Default) = "C:\Program Files\Common Files\Ahead\lib\NeroDigitalExt.dll" ["Nero AG"] {F9DB5320-233E-11D1-9F84-707F02C10627}\(Default) = "PDF Column Info" -> {HKLM...CLSID} = "PDF Shell Extension" \InProcServer32\(Default) = "C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\PDFShell.dll" ["Adobe Systems, Inc."] HKLM\Software\Classes\*\shellex\ContextMenuHandlers\ Adobe.Acrobat.ContextMenu\(Default) = "{D25B2CAB-8A9A-4517-A9B2-CB5F68A5A802}" -> {HKLM...CLSID} = "Acrobat Elements Context Menu" \InProcServer32\(Default) = "C:\Program Files\Adobe\Acrobat 8.0\Acrobat Elements\ContextMenu.dll" ["Adobe Systems Inc."] AVG Anti-Spyware\(Default) = "{8934FCEF-F5B8-468f-951F-78A921CD3920}" -> {HKLM...CLSID} = "CContextScan Object" \InProcServer32\(Default) = "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\context.dll" ["GRISOFT s.r.o."] AVG7 Shell Extension\(Default) = "{9F97547E-4609-42C5-AE0C-81C61FFAEBC3}" -> {HKLM...CLSID} = "AVG7 Shell Extension Class" \InProcServer32\(Default) = "C:\Program Files\Grisoft\AVG7\avgse.dll" ["GRISOFT, s.r.o."] Eset Smart Security - Context Menu Shell Extension\(Default) = "{B089FE88-FB52-11D3-BDF1-0050DA34150D}" -> {HKLM...CLSID} = "Eset Smart Security - Context Menu Shell Extension" \InProcServer32\(Default) = "C:\Program Files\ESET\ESET NOD32 Antivirus\shellExt.dll" ["ESET"] MagicISO\(Default) = "{DB85C504-C730-49DD-BEC1-7B39C6103B7A}" -> {HKLM...CLSID} = "MShellExtMenu Class" \InProcServer32\(Default) = "C:\Program Files\MagicISO\misosh.dll" ["MagicISO, Inc."] PowerISO\(Default) = "{967B2D40-8B7D-4127-9049-61EA0C2C6DCE}" -> {HKLM...CLSID} = "PowerISO" \InProcServer32\(Default) = "C:\Program Files\PowerISO\PWRISOSH.DLL" ["PowerISO Computing, Inc."] WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\ AVG Anti-Spyware\(Default) = "{8934FCEF-F5B8-468f-951F-78A921CD3920}" -> {HKLM...CLSID} = "CContextScan Object" \InProcServer32\(Default) = "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\context.dll" ["GRISOFT s.r.o."] MagicISO\(Default) = "{DB85C504-C730-49DD-BEC1-7B39C6103B7A}" -> {HKLM...CLSID} = "MShellExtMenu Class" \InProcServer32\(Default) = "C:\Program Files\MagicISO\misosh.dll" ["MagicISO, Inc."] PowerISO\(Default) = "{967B2D40-8B7D-4127-9049-61EA0C2C6DCE}" -> {HKLM...CLSID} = "PowerISO" \InProcServer32\(Default) = "C:\Program Files\PowerISO\PWRISOSH.DLL" ["PowerISO Computing, Inc."] WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\ Adobe.Acrobat.ContextMenu\(Default) = "{D25B2CAB-8A9A-4517-A9B2-CB5F68A5A802}" -> {HKLM...CLSID} = "Acrobat Elements Context Menu" \InProcServer32\(Default) = "C:\Program Files\Adobe\Acrobat 8.0\Acrobat Elements\ContextMenu.dll" ["Adobe Systems Inc."] AVG7 Shell Extension\(Default) = "{9F97547E-4609-42C5-AE0C-81C61FFAEBC3}" -> {HKLM...CLSID} = "AVG7 Shell Extension Class" \InProcServer32\(Default) = "C:\Program Files\Grisoft\AVG7\avgse.dll" ["GRISOFT, s.r.o."] Eset Smart Security - Context Menu Shell Extension\(Default) = "{B089FE88-FB52-11D3-BDF1-0050DA34150D}" -> {HKLM...CLSID} = "Eset Smart Security - Context Menu Shell Extension" \InProcServer32\(Default) = "C:\Program Files\ESET\ESET NOD32 Antivirus\shellExt.dll" ["ESET"] MagicISO\(Default) = "{DB85C504-C730-49DD-BEC1-7B39C6103B7A}" -> {HKLM...CLSID} = "MShellExtMenu Class" \InProcServer32\(Default) = "C:\Program Files\MagicISO\misosh.dll" ["MagicISO, Inc."] PowerISO\(Default) = "{967B2D40-8B7D-4127-9049-61EA0C2C6DCE}" -> {HKLM...CLSID} = "PowerISO" \InProcServer32\(Default) = "C:\Program Files\PowerISO\PWRISOSH.DLL" ["PowerISO Computing, Inc."] WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] Group Policies {GPedit.msc branch and setting}: ----------------------------------------------- Note: detected settings may not have any effect. HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\ "NoCDBurning" = (REG_DWORD) hex:0x00000000 {unrecognized setting} HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions\ "NoBrowserOptions" = (REG_DWORD) hex:0x00000000 {User Configuration|Administrative Templates|Windows Components|Internet Explorer|Browser Menus| Tools menu: Disable Internet Options... menu option} HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\ "shutdownwithoutlogon" = (REG_DWORD) hex:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| Shutdown: Allow system to be shut down without having to log on} "undockwithoutlogon" = (REG_DWORD) hex:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| Devices: Allow undock without having to log on} Active Desktop and Wallpaper: ----------------------------- Active Desktop may be disabled at this entry: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState Displayed if Active Desktop enabled and wallpaper not set by Group Policy: HKCU\Software\Microsoft\Internet Explorer\Desktop\General\ "Wallpaper" = "C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp" Displayed if Active Desktop disabled and wallpaper not set by Group Policy: HKCU\Control Panel\Desktop\ "Wallpaper" = "C:\Documents and Settings\Jarczew\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp" Startup items in "Jarczew" & "All Users" startup folders: --------------------------------------------------------- C:\Documents and Settings\All Users\Menu Start\Programy\Autostart "DSLMON" -> shortcut to: "C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe" [empty string] "Program sieciowy dla SAGEM Wi-Fi 11g USB adapter" -> shortcut to: "C:\Program Files\SAGEM WiFi manager\WLANUTL.exe" [" "] Enabled Scheduled Tasks: ------------------------ "AppleSoftwareUpdate.job" -- insufficient permission to read this file! Winsock2 Service Provider DLLs: ------------------------------- Namespace Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++} 000000000001\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS] 000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS] 000000000003\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS] 000000000004\LibraryPath = "C:\Program Files\Bonjour\mdnsNSP.dll" ["Apple Computer, Inc."] Transport Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++} 0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range: %SystemRoot%\system32\mswsock.dll [MS], 01 - 03, 06 - 23 %SystemRoot%\system32\rsvpsp.dll [MS], 04 - 05 Toolbars, Explorer Bars, Extensions: ------------------------------------ Toolbars HKCU\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ "{2318C2B1-4965-11D4-9B18-009027A5CD4F}" -> {HKLM...CLSID} = "&Google" \InProcServer32\(Default) = "c:\program files\google\googletoolbar3.dll" ["Google Inc."] HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\ "{2318C2B1-4965-11D4-9B18-009027A5CD4F}" -> {HKLM...CLSID} = "&Google" \InProcServer32\(Default) = "c:\program files\google\googletoolbar3.dll" ["Google Inc."] "{47833539-D0C5-4125-9FA8-0819E2EAAC93}" -> {HKLM...CLSID} = "Adobe PDF" \InProcServer32\(Default) = "C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll" ["Adobe Systems Incorporated"] HKLM\Software\Microsoft\Internet Explorer\Toolbar\ "{8E4AA109-7239-4B85-8196-7377A53DDEFF}" = (no title provided) -> {HKLM...CLSID} = "&Translator Internet" \InProcServer32\(Default) = "C:\PROGRA~1\Antadis\TRANSL~1\DELPHI~1.DLL" [null data] "{2318C2B1-4965-11D4-9B18-009027A5CD4F}" = (no title provided) -> {HKLM...CLSID} = "&Google" \InProcServer32\(Default) = "c:\program files\google\googletoolbar3.dll" ["Google Inc."] "{47833539-D0C5-4125-9FA8-0819E2EAAC93}" = (no title provided) -> {HKLM...CLSID} = "Adobe PDF" \InProcServer32\(Default) = "C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll" ["Adobe Systems Incorporated"] Explorer Bars HKLM\Software\Microsoft\Internet Explorer\Explorer Bars\ {182EC0BE-5110-49C8-A062-BEB1D02A220B}\(Default) = (no title provided) -> {HKLM...CLSID} = "Adobe PDF" \InProcServer32\(Default) = "C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll" ["Adobe Systems Incorporated"] HKLM\Software\Classes\CLSID\{8E4AA109-7239-4B85-8196-7377A53DDEFF}\(Default) = "&Translator Internet" Implemented Categories\{00021494-0000-0000-C000-000000000046}\ [horizontal bar] InProcServer32\(Default) = "C:\PROGRA~1\Antadis\TRANSL~1\DELPHI~1.DLL" [null data] HKLM\Software\Classes\CLSID\{FF059E31-CC5A-4E2E-BF3B-96E929D65503}\(Default) = "&Badanie" Implemented Categories\{00021493-0000-0000-C000-000000000046}\ [vertical bar] InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL" [MS] Extensions (Tools menu items, main toolbar menu buttons) HKLM\Software\Microsoft\Internet Explorer\Extensions\ {08B0E5C0-4FCB-11CF-AAA5-00401C608501}\ "MenuText" = "Sun Java Console" "CLSIDExtension" = "{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBC}" -> {HKCU...CLSID} = "Java Plug-in 1.6.0_07" \InProcServer32\(Default) = "C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll" ["Sun Microsystems, Inc."] -> {HKLM...CLSID} = "Java Plug-in 1.6.0_07" \InProcServer32\(Default) = "C:\Program Files\Java\jre1.6.0_07\bin\npjpi160_07.dll" ["Sun Microsystems, Inc."] {44627E97-789B-40D4-B5C2-58BD171129A1}\ "ButtonText" = "Szybkie dostosowywanie programu Outpost Firewall Pro" {92780B25-18CC-41C8-B9BE-3C9C571A8263}\ "ButtonText" = "Badanie" {E2E2DD38-D088-4134-82B7-F2BA38496583}\ "MenuText" = "@xpsp3res.dll,-20001" "Exec" = "%windir%\Network Diagnostic\xpnetdiag.exe" [MS] Running Services (Display Name, Service Name, Path {Service DLL}): ------------------------------------------------------------------ AVG7 Alert Manager Server, Avg7Alrt, "C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe" ["GRISOFT, s.r.o."] AVG7 Update Service, Avg7UpdSvc, "C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe" ["GRISOFT, s.r.o."] Avid SDM Service, AvidSDMService, "system32\AvidSDMService.exe" ["Avid Technology, Inc."] Cyberlink RichVideo Service(CRVS), RichVideo, ""C:\Program Files\CyberLink\Shared files\RichVideo.exe"" [empty string] Digidesign MME Refresh Service, DigiRefresh, "C:\Program Files\Digidesign\Drivers\MMERefresh.exe -s" ["Digidesign, A Division of Avid Technology, Inc."] Eset Service, ekrn, ""C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe"" ["ESET"] FLEXnet Licensing Service, FLEXnet Licensing Service, ""C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe"" ["Macrovision Europe Ltd."] LightScribeService Direct Disc Labeling Service, LightScribeService, ""C:\Program Files\Common Files\LightScribe\LSSrvc.exe"" ["Hewlett-Packard Company"] NVIDIA Display Driver Service, NVSvc, "C:\WINDOWS\system32\nvsvc32.exe" ["NVIDIA Corporation"] Urządzenie mobilne Apple, Apple Mobile Device, ""C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe"" ["Apple, Inc."] Usługa iPod, iPod Service, ""C:\Program Files\iPod\bin\iPodService.exe"" ["Apple Inc."] Print Monitors: --------------- HKLM\System\CurrentControlSet\Control\Print\Monitors\ Adobe PDF Port\Driver = "C:\WINDOWS\system32\AdobePDF.dll" ["Adobe Systems Incorporated."] EPSON Stylus Photo R285 Series 32MonitorBE\Driver = "E_FLBCKE.DLL" ["SEIKO EPSON CORPORATION"] hpzsnt05\Driver = "hpzsnt05.dll" ["HP"] hpzsnt07\Driver = "hpzsnt07.dll" ["HP"] Microsoft Document Imaging Writer Monitor\Driver = "mdimon.dll" [MS] ---------- <<!>>: Suspicious data at a malware launch point. + This report excludes default entries except where indicated. + To see *everywhere* the script checks and *everything* it finds, launch it from a command prompt or a shortcut with the -all parameter. + To search all directories of local fixed drives for DESKTOP.INI DLL launch points, use the -supp parameter or answer "No" at the first message box and "Yes" at the second message box. ---------- (total run time: 45 seconds, including 12 seconds for message boxes)

**Posty:** 684 · przez **djarta** 07 Wrz 2008, 14:01

O2 - BHO: QXK Olive - {26027218-80B3-40FA-9FA1-70FD56AA5328} - C:\WINDOWS\rodqgpvldbv.dll

>>Hijack>>scan(Do a system scan only)>>zaznacz>>Fix checked

Ściągnij -----> ComboFixa, ale nie uruchamiaj

Wklej do Notatnika:

Kod: Zaznacz wszystko: File:: C:\WINDOWS\rodqgpvldbv.dll Registry:: [-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{26027218-80B3-40FA-9FA1-70FD56AA5328}]

>>Plik>>Zapisz jako... >>> CFScript
Przeciągnij i upuść plik CFScript.txt na plik ComboFix.exe
-->

Ma się rozpocząć usuwanie. (i powstanie log).Daj ten log, który powstanie w trakcie usuwania.
Jeśli pójdzie dobrze, to: Po restarcie usuń ręcznie folder C:\Qoobox.

=====================
K.

**Posty:** 128 · przez **Jarczew** 08 Wrz 2008, 10:17

Z góry dziękuję za pomoc oto logi z Comboscan"
Niestety nie znalazłem tego folderu." Jeśli pójdzie dobrze, to: Po restarcie usuń ręcznie folder C:\Qoobox."
Progam AVG powiadomił ze zmiany sa w:
Bootsector of disk change
kernel32.dll change
user32.dll change
shell32.dll change
intoskrnl.eve change

ComboScan v20070306.20 run by Jarczew on 2008-09-08 at 09:51:04
Computer is in Normal Mode.
--------------------------------------------------------------------------------

Kod: Zaznacz wszystko: -- HijackThis (run as Jarczew.exe) --------------------------------------------- Logfile of HijackThis v1.99.1 Scan saved at 09:51: VIRUS ALERT!, on 2008-09-08 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16705) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe C:\WINDOWS\system32\AvidSDMService.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\Program Files\Digidesign\Drivers\MMERefresh.exe C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe C:\Program Files\Common Files\LightScribe\LSSrvc.exe C:\WINDOWS\system32\nvsvc32.exe C:\Program Files\CyberLink\Shared files\RichVideo.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb07.exe C:\WINDOWS\SOUNDMAN.EXE C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe C:\Program Files\Common Files\Grass Valley\ProCoder 3\Kernel\PNXSERVR.exe C:\Program Files\iTunes\iTunesHelper.exe C:\WINDOWS\system32\RunDLL32.exe C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe C:\PROGRA~1\A4Tech\Keyboard\Ikeymain.exe C:\Program Files\Norton SystemWorks\Norton Ghost\GhostStartTrayApp.exe C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe C:\Program Files\SAGEM WiFi manager\WLANUTL.exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe C:\WINDOWS\system32\wuauclt.exe C:\WINDOWS\system32\wuauclt.exe C:\Documents and Settings\Jarczew\Pulpit\comboscan.exe C:\PROGRA~1\HIJACK~1\Jarczew.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://wp.pl/ R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: QXK Olive - {26027218-80B3-40FA-9FA1-70FD56AA5328} - C:\WINDOWS\rodqgpvldbv.dll O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll O3 - Toolbar: &Translator Internet - {8E4AA109-7239-4B85-8196-7377A53DDEFF} - C:\PROGRA~1\Antadis\TRANSL~1\DELPHI~1.DLL O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll O4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINDOWS\system32\PSDrvCheck.exe -CheckReg O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb07.exe O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" O4 - HKLM\..\Run: [Acrobat Assistant 8.0] "C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe" O4 - HKLM\..\Run: [Adobe_ID0EYTHM] C:\PROGRA~1\COMMON~1\Adobe\ADOBEV~1\Server\bin\VERSIO~2.EXE O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [DigidesignMMERefresh] C:\Program Files\Digidesign\Drivers\MMERefresh.exe O4 - HKLM\..\Run: [NexusServer] "C:\Program Files\Common Files\Grass Valley\ProCoder 3\Kernel\PNXSERVR.exe" -SelfLaunch O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [PCLEPCI] C:\PROGRA~1\PINNAC~1\PPE\PPE.EXE O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice O4 - HKLM\..\Run: [QD FastAndSafe] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [iKeyWorks] C:\PROGRA~1\A4Tech\Keyboard\Ikeymain.exe O4 - HKLM\..\Run: [GhostStartTrayApp] C:\Program Files\Norton SystemWorks\Norton Ghost\GhostStartTrayApp.exe O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe" O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [EPSON Stylus Photo R285 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATICKE.EXE /FU "C:\WINDOWS\TEMP\E_S38D.tmp" /EF "HKCU" O4 - HKCU\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe O4 - Global Startup: Program sieciowy dla SAGEM Wi-Fi 11g USB adapter.lnk = ? O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present O8 - Extra context menu item: Append to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra button: Szybkie dostosowywanie programu Outpost Firewall Pro - {44627E97-789B-40d4-B5C2-58BD171129A1} - C:\WINDOWS\System32\shdocvw.dll O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O10 - Unknown file in Winsock LSP: c:\program files\bonjour\mdnsnsp.dll O11 - Options group: [INTERNATIONAL] International* O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - http://www.nvidia.com/content/DriverDownload/srl/2.0.0.1/sysreqlab2.cab O16 - DPF: {68282C51-9459-467B-95BF-3C0E89627E55} (MksSkanerOnline Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab O16 - DPF: {74DBCB52-F298-4110-951D-AD2FF67BC8AB} (NVIDIA Smart Scan) - http://www.nvidia.com/content/DriverDownload/nforce/NvidiaSmartScan.cab O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: Adobe Version Cue CS3 - Unknown owner - C:\Program Files\Common Files\Adobe\Adobe Version Cue CS3\Server\bin\VersionCueCS3.exe" -win32service (file missing) O23 - Service: Urządzenie mobilne Apple (Apple Mobile Device) - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: AutoComplete Service (Autocomplete) - Unknown owner - --C:\Program Files\Acesoft\Tracks Eraser Pro\delautocomp.exe (file missing) O23 - Service: AVG Anti-Spyware Guard - Unknown owner - -C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe (file missing) O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe O23 - Service: Avid SDM Service (AvidSDMService) - Avid Technology, Inc. - C:\WINDOWS\system32\AvidSDMService.exe O23 - Service: Avid Startup (AvidStartup) - Unknown owner - C:\WINDOWS\system32\AvidStartup.exe O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: Digidesign MME Refresh Service (DigiRefresh) - Digidesign, A Division of Avid Technology, Inc. - C:\Program Files\Digidesign\Drivers\MMERefresh.exe O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe O23 - Service: GhostStartService - Unknown owner - --C:\Program Files\Norton SystemWorks\Norton Ghost\GhostStartService.exe (file missing) O23 - Service: Google Updater Service (gusvc) - Unknown owner - --"C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe (file missing) O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: Usługa iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe O23 - Service: Norton Unerase Protection (NProtectService) - Unknown owner - --C:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.EXE (file missing) O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: Office Source Engine (ose) - Unknown owner - --"C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE (file missing) O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared files\RichVideo.exe -- Files created between 2008-08-08 and 2008-09-08 ----------------------------- 2008-09-08 09:41:12 0 d-------- C:\327882R2FWJFW<327882~1> 2008-09-07 13:12:31 0 d-------- C:\WINDOWS\ERUNT 2008-09-05 12:45:26 0 d-------- C:\Egipt2008<EGIPT2~1> 2008-09-04 18:50:01 0 d-------- C:\WINDOWS\ERDNT 2008-09-04 18:19:48 0 d-------- C:\SDFix 2008-09-04 17:50:55 0 d-------- C:\Nowy folder<NOWYFO~1> 2008-09-02 23:52:06 0 d-------- C:\Program Files\Styles 2008-09-02 23:52:06 0 d-------- C:\Program Files\Skin 2008-09-02 23:52:06 0 d-------- C:\Program Files\program 2008-09-02 23:52:06 0 d-------- C:\Program Files\defaults 2008-09-02 23:52:05 0 d-------- C:\Program Files\locale 2008-09-02 23:52:05 0 d-------- C:\Program Files\classes 2008-09-02 22:26:25 0 d-------- C:\Program Files\Enigma Software Group<ENIGMA~1> 2008-09-01 01:52:21 311296 --a------ C:\WINDOWS\rqbmvpso.dll 2008-09-01 01:52:21 393216 --a------ C:\WINDOWS\rodqgpvldbv.dll<RODQGP~1.DLL> 2008-09-01 01:52:21 192512 --a------ C:\WINDOWS\qalkfxor.dll 2008-09-01 01:52:21 143360 --a------ C:\WINDOWS\eaxf.exe 2008-09-01 01:52:20 311296 --a------ C:\WINDOWS\pdoskegl.dll 2008-08-31 22:15:46 0 d-------- C:\WINDOWS\NV23123872.TMP<NV2312~1.TMP> 2008-08-31 22:15:07 208896 --a------ C:\WINDOWS\system32\NVUNINST.EXE 2008-08-30 21:57:10 1632 --a------ C:\WINDOWS\system32\d3d8caps.dat 2008-08-30 21:52:16 208896 --a------ C:\WINDOWS\system32\nvudisp.exe 2008-08-30 21:52:16 0 d-------- C:\WINDOWS\nview 2008-08-25 20:16:51 0 d-------- C:\ConvertTemp<CONVER~1> 2008-08-25 20:04:28 174592 --a------ C:\WINDOWS\system32\framedyn.dll 2008-08-25 20:03:58 106792 --a------ C:\WINDOWS\system32\drivers\sscdmdm.sys 2008-08-25 20:03:58 9256 --a------ C:\WINDOWS\system32\drivers\sscdcmnt.sys 2008-08-25 20:03:58 9256 --a------ C:\WINDOWS\system32\drivers\sscdcm.sys 2008-08-25 20:03:57 9256 --a------ C:\WINDOWS\system32\drivers\sscdwhnt.sys 2008-08-25 20:03:57 9256 --a------ C:\WINDOWS\system32\drivers\sscdwh.sys 2008-08-25 20:03:57 11944 --a------ C:\WINDOWS\system32\drivers\sscdmdfl.sys 2008-08-25 20:03:57 80552 --a------ C:\WINDOWS\system32\drivers\sscdbus.sys 2008-08-25 20:03:46 0 d-------- C:\WINDOWS\system32\Samsung_USB_Drivers<SAMSUN~1> 2008-08-25 20:02:59 5632 --a------ C:\WINDOWS\system32\drivers\StarOpen.sys 2008-08-25 20:02:22 0 d-------- C:\Program Files\Samsung 2008-08-20 01:39:49 0 d-------- C:\Program Files\Common Files\SureThing Shared<SURETH~1> 2008-08-20 01:39:48 0 d-------- C:\Program Files\SureThing<SURETH~2> 2008-08-14 15:52:44 36864 --a------ C:\Program Files\spellcheck.dll<SPELLC~1.DLL> 2008-08-14 15:52:44 20480 --a------ C:\Program Files\OUniAnsi.dll 2008-08-14 15:52:44 3698688 --a------ C:\Program Files\opera.dll 2008-08-14 15:52:32 98816 --a------ C:\Program Files\opera.exe 2008-08-11 17:30:40 0 d-------- C:\Program Files\NOD32view<NOD32V~1> -- Find3M Report --------------------------------------------------------------- 2008-09-08 09:32:43 0 d-------- C:\Documents and Settings\Jarczew\Dane aplikacji\AVG7 2008-09-04 21:38:01 0 d-------- C:\Program Files\English Translator 3<ENGLIS~1> 2008-09-04 21:08:39 0 d-------- C:\Program Files\Opera 2008-09-03 21:31:49 0 d-------- C:\Program Files\jv16 PowerTools<JV16PO~1> 2008-09-02 23:52:08 1638 --a------ C:\Program Files\operadef6.ini<OPERAD~1.INI> 2008-09-01 01:52:33 0 d-------- C:\Documents and Settings\Jarczew\Dane aplikacji\TmpRecentIcons<TMPREC~1> 2008-08-30 23:16:19 4588 --a------ C:\WINDOWS\system32\d3d9caps.dat 2008-08-25 20:11:56 0 d-------- C:\Documents and Settings\Jarczew\Dane aplikacji\Samsung 2008-08-25 20:06:17 0 d--h----- C:\Program Files\InstallShield Installation Information<INSTAL~1> 2008-08-15 23:09:07 0 d-------- C:\Documents and Settings\Jarczew\Dane aplikacji\ameCache 2008-08-15 22:55:38 0 d-------- C:\Documents and Settings\Jarczew\Dane aplikacji\dvdcss 2008-08-14 23:05:47 45 --a------ C:\WINDOWS\system32\imon1.dat 2008-08-14 16:04:24 8250 --a------ C:\Program Files\license.rtf 2008-08-14 16:04:22 226437 --a------ C:\Program Files\english.lng 2008-08-14 15:52:38 653419 --a------ C:\Program Files\encoding.bin 2008-08-14 10:41:01 0 d-------- C:\Documents and Settings\Jarczew\Dane aplikacji\uTorrent 2008-08-14 10:40:44 0 d-------- C:\Program Files\SureThing(2)<SURETH~1> 2008-08-14 10:40:35 0 d-------- C:\Program Files\EPSON 2008-08-13 17:02:34 7002 --a------ C:\Program Files\search.ini 2008-08-13 12:05:03 0 d---s---- C:\Documents and Settings\Jarczew\Dane aplikacji\Microsoft<MICROS~1> 2008-08-03 21:01:39 0 d-------- C:\Documents and Settings\Jarczew\Dane aplikacji\Azureus 2008-08-03 12:27:10 0 d-------- C:\Program Files\OLYMPUS 2008-08-01 19:47:04 0 d-------- C:\Documents and Settings\Jarczew\Dane aplikacji\4Team 2008-08-01 19:46:40 0 d-------- C:\Program Files\4Team Corporation<4TEAMC~1> 2008-07-31 19:44:08 0 ---h----- C:\Documents and Settings\Jarczew\Dane aplikacji\Folder Icons<FOLDER~1> 2008-07-27 19:15:45 0 d-------- C:\Program Files\Norton SystemWorks<NORTON~3> 2008-07-14 21:58:17 0 d-------- C:\Program Files\Sun 2008-07-14 21:57:49 0 d-------- C:\Program Files\Java 2008-07-14 13:09:18 62976 -----n--- C:\WINDOWS\system32\tzchange.exe 2008-07-12 10:26:15 0 d-------- C:\Program Files\CyberLink<CYBERL~1> 2008-07-07 22:33:22 253952 --a------ C:\WINDOWS\system32\es.dll 2008-06-24 18:24:26 74240 --a------ C:\WINDOWS\system32\mscms.dll 2008-06-23 18:42:12 233472 --a------ C:\WINDOWS\system32\webcheck.dll 2008-06-23 18:42:11 105984 --a------ C:\WINDOWS\system32\url.dll 2008-06-23 18:42:11 102912 --a------ C:\WINDOWS\system32\occache.dll 2008-06-23 18:42:09 52224 --a------ C:\WINDOWS\system32\msfeedsbs.dll<MSFEED~1.DLL> 2008-06-23 18:42:09 459264 --a------ C:\WINDOWS\system32\msfeeds.dll 2008-06-23 18:42:08 267776 --a------ C:\WINDOWS\system32\iertutil.dll 2008-06-23 18:42:07 44544 --a------ C:\WINDOWS\system32\iernonce.dll 2008-06-23 18:42:07 6066176 --a------ C:\WINDOWS\system32\ieframe.dll 2008-06-23 18:42:06 384512 --a------ C:\WINDOWS\system32\iedkcs32.dll 2008-06-23 18:42:05 383488 --a------ C:\WINDOWS\system32\ieapfltr.dll 2008-06-23 18:42:05 230400 --a------ C:\WINDOWS\system32\ieaksie.dll 2008-06-23 18:42:05 153088 --a------ C:\WINDOWS\system32\ieakeng.dll 2008-06-23 18:42:05 63488 --a------ C:\WINDOWS\system32\icardie.dll 2008-06-23 18:42:04 124928 --a------ C:\WINDOWS\system32\advpack.dll 2008-06-23 11:23:08 70656 --a------ C:\WINDOWS\system32\ie4uinit.exe 2008-06-23 11:20:26 13824 --a------ C:\WINDOWS\system32\ieudinit.exe 2008-06-21 07:23:54 161792 --a------ C:\WINDOWS\system32\ieakui.dll 2008-06-20 19:42:21 246784 --a------ C:\WINDOWS\system32\mswsock.dll -- Registry Dump --------------------------------------------------------------- [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run] "ctfmon.exe"="C:\\WINDOWS\\system32\\ctfmon.exe" "EPSON Stylus Photo R285 Series"="C:\\WINDOWS\\System32\\spool\\DRIVERS\\W32X86\\3\\E_FATICKE.EXE /FU \"C:\\WINDOWS\\TEMP\\E_S38D.tmp\" /EF \"HKCU\"" "QuickTime Task"="\"C:\\Program Files\\QuickTime\\QTTask.exe\" -atboottime" [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run\AdobeUpdater] @="" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run] "PinnacleDriverCheck"="C:\\WINDOWS\\system32\\PSDrvCheck.exe -CheckReg" "HPDJ Taskbar Utility"="C:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\hpztsb07.exe" "SoundMan"="SOUNDMAN.EXE" "SunJavaUpdateSched"="\"C:\\Program Files\\Java\\jre1.6.0_07\\bin\\jusched.exe\"" "Acrobat Assistant 8.0"="\"C:\\Program Files\\Adobe\\Acrobat 8.0\\Acrobat\\Acrotray.exe\"" @="" "Adobe_ID0EYTHM"="C:\\PROGRA~1\\COMMON~1\\Adobe\\ADOBEV~1\\Server\\bin\\VERSIO~2.EXE" "Adobe Reader Speed Launcher"="\"C:\\Program Files\\Adobe\\Reader 8.0\\Reader\\Reader_sl.exe\"" "DigidesignMMERefresh"="C:\\Program Files\\Digidesign\\Drivers\\MMERefresh.exe" "NexusServer"="\"C:\\Program Files\\Common Files\\Grass Valley\\ProCoder 3\\Kernel\\PNXSERVR.exe\" -SelfLaunch" "QuickTime Task"="\"C:\\Program Files\\QuickTime\\QTTask.exe\" -atboottime" "iTunesHelper"="\"C:\\Program Files\\iTunes\\iTunesHelper.exe\"" "PCLEPCI"="C:\\PROGRA~1\\PINNAC~1\\PPE\\PPE.EXE" "NvCplDaemon"="RUNDLL32.EXE C:\\WINDOWS\\system32\\NvCpl.dll,NvStartup" "nwiz"="nwiz.exe /install" "NvMediaCenter"="RunDLL32.exe NvMCTray.dll,NvTaskbarInit" "egui"="\"C:\\Program Files\\ESET\\ESET NOD32 Antivirus\\egui.exe\" /hide /waitservice" "QD FastAndSafe"="C:\\WINDOWS\\system32\\NeroCheck.exe" "NeroFilterCheck"="C:\\WINDOWS\\system32\\NeroCheck.exe" "iKeyWorks"="C:\\PROGRA~1\\A4Tech\\Keyboard\\Ikeymain.exe" "GhostStartTrayApp"="C:\\Program Files\\Norton SystemWorks\\Norton Ghost\\GhostStartTrayApp.exe" "AVG7_CC"="C:\\PROGRA~1\\Grisoft\\AVG7\\avgcc.exe /STARTUP" "Adobe Photo Downloader"="\"C:\\Program Files\\Adobe\\Photoshop Album Starter Edition\\3.2\\Apps\\apdproxy.exe\"" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents] @="" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\IMAIL] "Installed"="1" @="" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MAPI] "NoChange"="1" "Installed"="1" @="" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MSFS] "Installed"="1" @="" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Jarczew^Menu Start^Programy^Autostart^ AutoKiller.lnk] "path"="C:\\Documents and Settings\\Jarczew\\Menu Start\\Programy\\Autostart\\ AutoKiller.lnk" "backup"="C:\\WINDOWS\\pss\\ AutoKiller.lnkStartup" "location"="Startup" "item"=" AutoKiller" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="" "hkey"="HKLM" "command"="" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BearShare] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="BearShare" "hkey"="HKLM" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LanguageShortcut] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="Language" "hkey"="HKLM" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="msmsgs" "hkey"="HKCU" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="PDVDServ" "hkey"="HKLM" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="GoogleToolbarNotifier" "hkey"="HKCU" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks] "{57B86673-276A-48B2-BAE7-C6DBB3020EB8}"="AVG Anti-Spyware 7.5" [HKEY_USERS\.default\software\microsoft\windows\currentversion\run] "AVG7_Run"="C:\\PROGRA~1\\Grisoft\\AVG7\\avgw.exe /RUNONCE" [HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\run] "AVG7_Run"="C:\\PROGRA~1\\Grisoft\\AVG7\\avgw.exe /RUNONCE" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer] "NoCDBurning"=dword:00000000 [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer\run] [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders] "SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll" HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\AVG Anti-Spyware Driver HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\AVG Anti-Spyware Guard [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Svchost] LocalService REG_MULTI_SZ Alerter\0WebClient\0LmHosts\0RemoteRegistry\0upnphost\0SSDPSRV\0\0 NetworkService REG_MULTI_SZ DnsCache\0\0 rpcss REG_MULTI_SZ RpcSs\0\0 imgsvc REG_MULTI_SZ StiSvc\0\0 termsvcs REG_MULTI_SZ TermService\0\0 HTTPFilter REG_MULTI_SZ HTTPFilter\0\0 DcomLaunch REG_MULTI_SZ DcomLaunch\0TermService\0\0 WudfServiceGroup REG_MULTI_SZ WUDFSvc\0\0 -- End of ComboScan: finished at 2008-09-08 at 09:51:27 ------------------------

**Posty:** 684 · przez **djarta** 08 Wrz 2008, 15:25

Dałeś log z DSSa, ale mniejsza z tym.

Pobierz ---> The Avenger

Wklej do niego ten tekst:

Kod: Zaznacz wszystko: Files to delete: C:\WINDOWS\rqbmvpso.dll C:\WINDOWS\rodqgpvldbv.dll C:\WINDOWS\qalkfxor.dll C:\WINDOWS\eaxf.exe C:\WINDOWS\pdoskegl.dll Folders to delete: C:\WINDOWS\NV23123872.TMP

Kopiujesz - Klikasz na Paste Script from Clipboard - Execute - Potwierdzasz i zgadzasz się na restart klikając OK.
Po wykonaniu skasuj z dysku plik: C:\Avenger\backup.zip i wklej raport na forum C:\avenger.txt

Potem nowy log z DSSa (jeśli masz taką możliwość to log z ComboFixa.)

=========================
K.

**Posty:** 128 · przez **Jarczew** 08 Wrz 2008, 19:15

Wszystko wróciło do normy . :papryczka:

Pojawiły się ikony , jest panel sterowania. Nie mogę tylko połączyć się z internetem. Coś blokuje dy wpisuje nazwe i haslo użytkownika neostrady ,teraz wchodzę zdodatkowego dysku.
Uzyłem Combofixa i The Avenger.
oto logi"

Kod: Zaznacz wszystko: ComboFix 08-09-05.05 - Jarczew 2008-09-08 17:19:20.1 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.1538 [GMT 2:00] Running from: C:\Documents and Settings\Jarczew\Pulpit\ComboFix.exe * Created a new restore point * Resident AV is active [color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color] . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\Documents and Settings\Jarczew\Cookies\jarczew@www4.1nces02dgv7k9at[1].txt C:\Documents and Settings\Jarczew\Pulpit\Error Cleaner.url C:\Documents and Settings\Jarczew\Pulpit\Privacy Protector.url C:\Documents and Settings\Jarczew\Pulpit\Spyware&Malware Protection.url C:\Documents and Settings\Jarczew\Ulubione\Error Cleaner.url C:\Documents and Settings\Jarczew\Ulubione\Privacy Protector.url C:\Documents and Settings\Jarczew\Ulubione\Spyware&Malware Protection.url C:\WINDOWS\system32\actskn43.ocx C:\WINDOWS\system32\dfhkj.ini C:\WINDOWS\system32\tdssl.dll C:\WINDOWS\twain_16.dll . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Legacy_NPF ((((((((((((((((((((((((( Files Created from 2008-08-08 to 2008-09-08 ))))))))))))))))))))))))))))))) . 2008-09-08 12:14 . 2008-09-08 14:49 <DIR> d-------- C:\Pr˘ba 2008-09-08 11:29 . 2008-09-08 11:59 <DIR> d-------- C:\Zdjecia 2008-09-07 13:12 . 2008-09-07 13:12 <DIR> d-------- C:\WINDOWS\ERUNT 2008-09-05 12:45 . 2008-09-05 17:24 <DIR> d-------- C:\Egipt2008 2008-09-04 21:02 . 2008-09-04 21:02 <DIR> d-------- C:\Documents and Settings\Trebor\Dane aplikacji\Apple Computer 2008-09-04 18:19 . 2008-08-29 04:05 <DIR> d-------- C:\SDFix 2008-09-04 17:51 . 2008-09-04 17:51 51,094 --a------ C:\netbt3.gif 2008-09-04 17:50 . 2008-09-04 18:08 <DIR> d-------- C:\Nowy folder 2008-09-04 16:10 . 2008-09-04 16:10 <DIR> d-------- C:\Documents and Settings\Trebor\Dane aplikacji\Lavasoft 2008-09-04 16:03 . 2008-09-08 09:39 <DIR> d-------- C:\Documents and Settings\Trebor\Dane aplikacji\AVG7 2008-09-04 01:52 . 2008-09-04 01:52 <DIR> d-------- C:\Documents and Settings\Trebor\Dane aplikacji\DivX 2008-09-04 01:51 . 2008-09-04 15:58 <DIR> d--h----- C:\Documents and Settings\Trebor\Ustawienia lokalne 2008-09-04 01:51 . 2008-09-04 01:51 <DIR> dr------- C:\Documents and Settings\Trebor\Ulubione 2008-09-04 01:51 . 2006-11-24 21:22 <DIR> d--h----- C:\Documents and Settings\Trebor\Szablony 2008-09-04 01:51 . 2008-09-08 17:27 <DIR> d-------- C:\Documents and Settings\Trebor\Pulpit 2008-09-04 01:51 . 2008-09-04 01:51 <DIR> dr------- C:\Documents and Settings\Trebor\Moje dokumenty 2008-09-04 01:51 . 2006-11-24 21:16 <DIR> dr------- C:\Documents and Settings\Trebor\Menu Start 2008-09-04 01:51 . 2008-09-04 16:10 <DIR> dr-h----- C:\Documents and Settings\Trebor\Dane aplikacji 2008-09-04 01:51 . 2008-09-04 01:51 <DIR> d-------- C:\Documents and Settings\Trebor 2008-09-03 01:46 . 2008-09-08 17:29 54,156 --ah----- C:\WINDOWS\QTFont.qfn 2008-09-03 01:46 . 2008-09-03 01:46 1,409 --a------ C:\WINDOWS\QTFont.for 2008-09-02 23:52 . 2008-09-02 23:52 <DIR> d-------- C:\Program Files\Styles 2008-09-02 23:52 . 2008-09-02 23:52 <DIR> d-------- C:\Program Files\Skin 2008-09-02 23:52 . 2008-09-02 23:52 <DIR> d-------- C:\Program Files\program 2008-09-02 23:52 . 2008-09-02 23:52 <DIR> d-------- C:\Program Files\locale 2008-09-02 23:52 . 2008-09-02 23:52 <DIR> d-------- C:\Program Files\defaults 2008-09-02 23:52 . 2008-09-02 23:52 <DIR> d-------- C:\Program Files\classes 2008-09-02 22:26 . 2008-09-02 22:26 <DIR> d-------- C:\Program Files\Enigma Software Group 2008-08-31 22:15 . 2006-10-22 15:06 208,896 --a------ C:\WINDOWS\system32\NVUNINST.EXE 2008-08-30 21:57 . 2008-08-30 21:57 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\nView_Profiles 2008-08-30 21:57 . 2008-08-30 21:58 1,632 --a------ C:\WINDOWS\system32\d3d8caps.dat 2008-08-30 21:52 . 2008-08-31 22:19 <DIR> d-------- C:\WINDOWS\nview 2008-08-30 21:52 . 2006-06-01 11:22 208,896 --a------ C:\WINDOWS\system32\nvudisp.exe 2008-08-30 21:52 . 2006-10-22 12:22 17,056 --a------ C:\WINDOWS\system32\nvdisp.nvu 2008-08-30 21:38 . 2008-05-01 16:33 331,776 -----c--- C:\WINDOWS\system32\dllcache\msadce.dll 2008-08-25 20:16 . 2008-08-25 20:16 <DIR> d-------- C:\ConvertTemp 2008-08-25 20:11 . 2008-08-25 20:11 <DIR> d-------- C:\Documents and Settings\Jarczew\Dane aplikacji\Samsung 2008-08-25 20:04 . 2006-05-03 22:53 174,592 --a------ C:\WINDOWS\system32\framedyn.dll 2008-08-25 20:03 . 2008-08-25 20:04 <DIR> d-------- C:\WINDOWS\system32\Samsung_USB_Drivers 2008-08-25 20:03 . 2007-07-03 16:58 106,792 --a------ C:\WINDOWS\system32\drivers\sscdmdm.sys 2008-08-25 20:03 . 2007-07-03 16:54 80,552 --a------ C:\WINDOWS\system32\drivers\sscdbus.sys 2008-08-25 20:03 . 2007-07-03 16:57 11,944 --a------ C:\WINDOWS\system32\drivers\sscdmdfl.sys 2008-08-25 20:03 . 2007-07-03 17:00 9,256 --a------ C:\WINDOWS\system32\drivers\sscdwhnt.sys 2008-08-25 20:03 . 2007-07-03 17:00 9,256 --a------ C:\WINDOWS\system32\drivers\sscdwh.sys 2008-08-25 20:03 . 2007-07-03 16:56 9,256 --a------ C:\WINDOWS\system32\drivers\sscdcmnt.sys 2008-08-25 20:03 . 2007-07-03 16:56 9,256 --a------ C:\WINDOWS\system32\drivers\sscdcm.sys 2008-08-25 20:03 . 2005-08-28 20:51 766 --a------ C:\WINDOWS\system32\Uninstall.ico 2008-08-25 20:02 . 2008-08-25 20:02 <DIR> d-------- C:\Program Files\Samsung 2008-08-25 20:02 . 2006-07-24 16:05 5,632 --a------ C:\WINDOWS\system32\drivers\StarOpen.sys 2008-08-20 01:39 . 2008-08-20 01:40 <DIR> d-------- C:\Program Files\SureThing 2008-08-20 01:39 . 2008-08-20 01:39 <DIR> d-------- C:\Program Files\Common Files\SureThing Shared 2008-08-14 15:52 . 2008-08-14 15:52 3,698,688 --a------ C:\Program Files\opera.dll 2008-08-14 15:52 . 2008-08-14 15:52 653,419 --a------ C:\Program Files\encoding.bin 2008-08-14 15:52 . 2008-08-14 15:52 98,816 --a------ C:\Program Files\opera.exe 2008-08-14 15:52 . 2008-08-14 15:52 36,864 --a------ C:\Program Files\spellcheck.dll 2008-08-14 15:52 . 2008-08-14 15:52 20,480 --a------ C:\Program Files\OUniAnsi.dll 2008-08-11 17:30 . 2008-08-14 10:40 <DIR> d-------- C:\Program Files\NOD32view . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-09-08 07:32 --------- d-----w C:\Documents and Settings\Jarczew\Dane aplikacji\AVG7 2008-09-04 19:38 --------- d-----w C:\Program Files\English Translator 3 2008-09-04 19:08 --------- d-----w C:\Program Files\Opera 2008-09-04 17:07 --------- d-----w C:\Program Files\ESET 2008-09-03 19:31 --------- d-----w C:\Program Files\jv16 PowerTools 2008-09-03 19:20 --------- d-----w C:\Program Files\Spybot - Search & Destroy 2008-09-03 19:18 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Spybot - Search & Destroy 2008-09-02 21:52 1,638 ----a-w C:\Program Files\operadef6.ini 2008-08-25 18:06 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-08-19 23:35 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\EPSON 2008-08-15 21:09 --------- d-----w C:\Documents and Settings\Jarczew\Dane aplikacji\ameCache 2008-08-15 20:55 --------- d-----w C:\Documents and Settings\Jarczew\Dane aplikacji\dvdcss 2008-08-14 14:04 8,250 ----a-w C:\Program Files\license.rtf 2008-08-14 14:04 226,437 ----a-w C:\Program Files\english.lng 2008-08-14 08:41 --------- d-----w C:\Documents and Settings\Jarczew\Dane aplikacji\uTorrent 2008-08-14 08:40 --------- d-----w C:\Program Files\SureThing(2) 2008-08-14 08:40 --------- d-----w C:\Program Files\EPSON 2008-08-14 08:17 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\FLEXnet 2008-08-13 15:02 7,002 ----a-w C:\Program Files\search.ini 2008-08-03 19:01 --------- d-----w C:\Documents and Settings\Jarczew\Dane aplikacji\Azureus 2008-08-03 10:27 --------- d-----w C:\Program Files\OLYMPUS 2008-08-01 17:47 --------- d-----w C:\Documents and Settings\Jarczew\Dane aplikacji\4Team 2008-08-01 17:46 --------- d-----w C:\Program Files\4Team Corporation 2008-07-31 16:47 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\UDL 2008-07-27 17:15 --------- d-----w C:\Program Files\Norton SystemWorks 2008-07-14 19:58 --------- d-----w C:\Program Files\Sun 2008-07-14 19:57 --------- d-----w C:\Program Files\Java 2008-07-12 08:26 --------- d-----w C:\Program Files\CyberLink 2008-07-07 20:33 253,952 ----a-w C:\WINDOWS\system32\es.dll 2008-06-24 16:24 74,240 ----a-w C:\WINDOWS\system32\mscms.dll 2008-06-23 16:42 826,368 ----a-w C:\WINDOWS\system32\wininet.dll 2008-06-20 17:42 246,784 ----a-w C:\WINDOWS\system32\mswsock.dll 2008-05-05 08:51 3,873 ----a-w C:\Program Files\lngcode.txt 2006-12-24 13:03 92,064 ----a-w C:\Documents and Settings\Jarczew\mqdmmdm.sys 2006-12-24 13:03 9,232 ----a-w C:\Documents and Settings\Jarczew\mqdmmdfl.sys 2006-12-24 13:03 79,328 ----a-w C:\Documents and Settings\Jarczew\mqdmserd.sys 2006-12-24 13:03 66,656 ----a-w C:\Documents and Settings\Jarczew\mqdmbus.sys 2006-12-24 13:03 6,208 ----a-w C:\Documents and Settings\Jarczew\mqdmcmnt.sys 2006-12-24 13:03 5,936 ----a-w C:\Documents and Settings\Jarczew\mqdmwhnt.sys 2006-12-24 13:03 4,048 ----a-w C:\Documents and Settings\Jarczew\mqdmcr.sys 2006-12-24 13:03 25,600 ----a-w C:\Documents and Settings\Jarczew\usbsermptxp.sys 2006-12-24 13:03 22,768 ----a-w C:\Documents and Settings\Jarczew\usbsermpt.sys 2004-08-20 12:56 301 ----a-w C:\Program Files\c3nform.vxml 2004-02-26 12:35 7,904 ----a-w C:\Program Files\html40_entities.dtd 2006-11-24 21:11 32 --sha-w C:\WINDOWS\{266801D5-4013-4D6A-B377-5DAB609B2AA5}.dat 2006-11-24 21:12 32 --sha-w C:\WINDOWS\{AB398A76-AA2D-43D1-8FDB-12573D291DE9}.dat 2006-11-24 21:11 32 --sha-w C:\WINDOWS\{BBC06AA3-0DFB-42F0-84FE-0FB977CBB5EB}.dat 2006-11-24 21:11 32 --sha-w C:\WINDOWS\{F80AD1C0-674E-44DD-AE58-E66846087076}.dat 2006-11-24 21:13 32 --sha-w C:\WINDOWS\{FE3F9671-933F-4CAE-BA5F-A33DEA08BDC0}.dat 2007-12-16 18:30 1,056 --sha-w C:\WINDOWS\system32\KGyGaAvL.sys 2006-11-24 21:12 32 --sha-w C:\WINDOWS\system32\{431DDD0B-3165-4AB1-95E5-28DA73B57621}.dat 2006-11-24 21:11 32 --sha-w C:\WINDOWS\system32\{875BDC63-996B-4C90-B2EB-490F10627E72}.dat 2006-11-24 21:11 32 --sha-w C:\WINDOWS\system32\{8BAECD84-FB19-4E64-ABDA-512BC164E8F8}.dat 2006-11-24 21:11 32 --sha-w C:\WINDOWS\system32\{9FBDD33A-9B90-4B13-92C0-EE4EF3883183}.dat 2006-11-24 21:13 32 --sha-w C:\WINDOWS\system32\{E662EC9F-3D54-49D1-A926-EDFEA74C2CB9}.dat . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 15360] "EPSON Stylus Photo R285 Series"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATICKE.EXE" [2007-04-13 182272] "QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-03-28 413696] "AdobeUpdater"="C:\Program Files\Common Files\Adobe\Updater5\AdobeUpdater.exe" [2007-03-01 2321600] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "PinnacleDriverCheck"="C:\WINDOWS\system32\PSDrvCheck.exe" [2003-12-04 406016] "HPDJ Taskbar Utility"="C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb07.exe" [2002-12-18 188416] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784] "Acrobat Assistant 8.0"="C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe" [2008-01-11 623992] "Adobe_ID0EYTHM"="C:\PROGRA~1\COMMON~1\Adobe\ADOBEV~1\Server\bin\VERSIO~2.EXE" [2007-03-20 1884160] "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792] "DigidesignMMERefresh"="C:\Program Files\Digidesign\Drivers\MMERefresh.exe" [2006-12-09 61440] "NexusServer"="C:\Program Files\Common Files\Grass Valley\ProCoder 3\Kernel\PNXSERVR.exe" [2008-01-16 520192] "QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-03-28 413696] "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-03-30 267048] "PCLEPCI"="C:\PROGRA~1\PINNAC~1\PPE\PPE.EXE" [2003-09-23 32768] "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-10-22 7700480] "egui"="C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" [2008-07-01 1447168] "QD FastAndSafe"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 155648] "NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 155648] "iKeyWorks"="C:\PROGRA~1\A4Tech\Keyboard\Ikeymain.exe" [2002-11-22 73728] "GhostStartTrayApp"="C:\Program Files\Norton SystemWorks\Norton Ghost\GhostStartTrayApp.exe" [2002-08-14 94208] "AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2008-05-22 579584] "Adobe Photo Downloader"="C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe" [2007-03-09 63712] "SoundMan"="SOUNDMAN.EXE" [2007-04-16 C:\WINDOWS\soundman.exe] "nwiz"="nwiz.exe" [2006-10-22 C:\WINDOWS\system32\nwiz.exe] "NvMediaCenter"="NvMCTray.dll" [2006-10-22 C:\WINDOWS\system32\nvmctray.dll] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "AVG7_Run"="C:\PROGRA~1\Grisoft\AVG7\avgw.exe" [2007-12-05 219136] C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\ DSLMON.lnk - C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe [2007-02-14 962661] Program sieciowy dla SAGEM Wi-Fi 11g USB adapter.lnk - C:\Program Files\SAGEM WiFi manager\WLANUTL.exe [2008-01-05 950272] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "vidc.CDVC"= cdvccodc.dll "vidc.DIV3"= DivXc32.dll "vidc.DIV4"= DivXc32f.dll "msacm.divxa32"= DivXa32.acm "VIDC.MJPG"= Pvmjpg21.dll "VIDC.PIM1"= pclepim1.dll "vidc.CDV5"= cdv5codc.dll "vidc.CLLC"= cllccodc.dll "vidc.CUVC"= cuvccodc.dll "vidc.CDVH"= cdvhcodc.dll "vidc.CMIC"= cmiccodc.dll "msacm.avis"= ff_acm.acm "MIDI1"= diomidi.dll "wave1"= Digi32.dll "vidc.AVRn"= AvidAVICodec.dll "SENTINEL"= snti386.dll [HKLM\~\startupfolder\C:^Documents and Settings^Jarczew^Menu Start^Programy^Autostart^ AutoKiller.lnk] path=C:\Documents and Settings\Jarczew\Menu Start\Programy\Autostart\ AutoKiller.lnk backup=C:\WINDOWS\pss\ AutoKiller.lnkStartup HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BearShare HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LanguageShortcut HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusDisableNotify"=dword:00000001 "UpdatesDisableNotify"=dword:00000001 "AntiVirusOverride"=dword:00000001 "FirewallOverride"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "C:\\Program Files\\PPStream\\PPStream.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "C:\\Program Files\\AdorageI-GfxDatas\\AdorageI-SAL\\bittorrent.exe"= "%windir%\\system32\\sessmgr.exe"= "C:\\Program Files\\Bonjour\\mDNSResponder.exe"= R1 cdrblock;cdrblock;C:\WINDOWS\system32\DRIVERS\cdrblock.sys [2007-05-31 20864] R1 cdrport;cdrport;C:\WINDOWS\system32\DRIVERS\cdrport.sys [2005-03-11 4608] R1 epfwtdir;epfwtdir;C:\WINDOWS\system32\DRIVERS\epfwtdir.sys [2008-07-01 34312] R2 DigiNet;Digidesign Ethernet Support;C:\WINDOWS\system32\DRIVERS\diginet.sys [2006-12-08 11776] R3 Amps2prt;A4Tech PS/2 Port Mouse Driver;C:\WINDOWS\system32\DRIVERS\Amps2prt.sys [2002-11-20 9344] S0 DAL;DAL;C:\WINDOWS\system32\drivers\DAL.sys [ ] S1 ati2mtaa;ati2mtaa;C:\WINDOWS\system32\DRIVERS\ati2mtaa.sys [2004-08-04 327040] S1 Pinnacle;Genie Adapter;C:\WINDOWS\system32\drivers\pgenie.sys [ ] S3 s3legacy;s3legacy;C:\WINDOWS\system32\DRIVERS\s3legacy.sys [2001-08-17 65664] S3 s3m;s3m;C:\WINDOWS\system32\DRIVERS\s3m.sys [2001-08-17 166720] S3 SG762_XP;SAGEM 802.11g XG762 1211B Driver;C:\WINDOWS\system32\DRIVERS\WlanBZXP.sys [2007-01-10 450560] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}] "C:\Program Files\Common Files\LightScribe\LSRunOnce.exe" . Contents of the 'Scheduled Tasks' folder . . ------- Supplementary Scan ------- . R0 -: HKCU-Main,Start Page = hxxp://wp.pl/ R0 -: HKCU-Main,SearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8 R0 -: HKLM-Main,Start Page = about:blank R1 -: HKCU-Internet Settings,ProxyOverride = *.local R1 -: HKCU-SearchURL,(Default) = hxxp://www.google.com/search?q=%s O8 -: Append to existing PDF - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html O8 -: Convert link target to Adobe PDF - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html O8 -: Convert link target to existing PDF - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html O8 -: Convert selected links to Adobe PDF - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html O8 -: Convert selected links to existing PDF - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html O8 -: Convert selection to Adobe PDF - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html O8 -: Convert selection to existing PDF - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html O8 -: Convert to Adobe PDF - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html O8 -: E&ksport do programu Microsoft Excel - C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O16 -: {68282C51-9459-467B-95BF-3C0E89627E55} - hxxp://www.mks.com.pl/skaner/SkanerOnline.cab C:\WINDOWS\Downloaded Program Files\SkanerOnline.inf C:\WINDOWS\system32\SkanerOnlineUninstall.exe C:\WINDOWS\system32\SkanerOnline.dll . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-09-08 17:27:26 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** [HKEY_LOCAL_MACHINE\System\ControlSet004\Services\gusvc] "ImagePath"="--\"C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe\"" [HKEY_LOCAL_MACHINE\System\ControlSet004\Services\ose] "ImagePath"="--\"C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE\"" . ------------------------ Other Running Processes ------------------------ . C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe C:\WINDOWS\system32\AvidSDMService.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe C:\Program Files\Common Files\LightScribe\LSSrvc.exe C:\WINDOWS\system32\nvsvc32.exe C:\Program Files\CyberLink\Shared files\RichVideo.exe C:\WINDOWS\system32\rundll32.exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe . ************************************************************************** . Completion time: 2008-09-08 17:37:45 - machine was rebooted ComboFix-quarantined-files.txt 2008-09-08 15:37:21 Pre-Run: 5,648,482,304 bajtów wolnych Post-Run: 5,650,456,576 bajt˘w wolnych 290 --- E O F --- 2008-08-30 22:29:43

Kod: Zaznacz wszystko: Logfile of The Avenger Version 2.0, (c) by Swandog46 http://swandog46.geekstogo.com Platform: Windows XP ******************* Script file opened successfully. Script file read successfully. Backups directory opened successfully at C:\Avenger ******************* Beginning to process script file: Rootkit scan active. Hidden driver "TDSSserv" found! ImagePath: \systemroot\system32\drivers\TDSSserv.sys Start Type: 1 (System) Rootkit scan completed. File "C:\WINDOWS\rqbmvpso.dll" deleted successfully. File "C:\WINDOWS\rodqgpvldbv.dll" deleted successfully. File "C:\WINDOWS\qalkfxor.dll" deleted successfully. File "C:\WINDOWS\eaxf.exe" deleted successfully. File "C:\WINDOWS\pdoskegl.dll" deleted successfully. Folder "C:\WINDOWS\NV23123872.TMP" deleted successfully. Completed script processing. ******************* Finished! Terminate.

**Posty:** 684 · przez **djarta** 08 Wrz 2008, 20:00

Wg mnie - czysto.

Wykonaj to co jest podane w tym temacie (jeśli wykonałeś/łaś to wcześniej to nie rób tego).

Usuń ręcznie folder C:\Qoobox,

Usuń instalkę ComboFix z dysku.

Wykonaj optymalizację autostartu

Przeczyść komputer ATF-Cleaner

Wyłącz i włącz przywracanie systemu na wszystkich dyskach.Instrukcja

Przeskanuj obszar mojego komputera http://www.kaspersky.pl/virusscanner.html (uruchom przez IE) Daj raport z niego na forum.

i tym:

FixIEDef.

======================
K.

**Posty:** 128 · przez **Jarczew** 08 Wrz 2008, 20:36

Bardzo Bardzo dziękuję za poświęcony mi czas i wpaniałe porady.
Jedno pytanko jak mogę dać pochwałę?
Jeszcze raz dziękuje i pozdrawiam :banan:

Dodano 08.09.2008 22:18:37:
Niestety brak w dalszym ciągu polączenia zinternetem. w tpsa powiedziano mi że cos jest jeszcze w rejestrze ponieważ z innego dysku mogę się połączyć. Czy znacie może jakiś sposób że to wykryć? Za pomoc z góry dziękuję. :oops:

oto logi

Kod: Zaznacz wszystko: ******************************************************************************** * * * FixIEDef Log * * Version 1.5.6.6088 * * * ******************************************************************************** Created at 21:01:36 on Monday, September 08, 2008 Time Zone : Logged On User : Jarczew Operating System : Microsoft Windows XP Professional Dodatek Service Pack 2 OS Version : 5.1.2600 System Langauge : Polish Keyboard Layout : Polish Processor : X86 Intel(R) Pentium(R) 4 CPU 3.20GHz System Drive : C:\ Windows Directory : C:\WINDOWS System Directory : C:\WINDOWS\system32 Total Physical Memory : 2096620 KB Free Physical Memory : 1596652 KB Total Virtual Memory : 2097024 KB Free Virtual Memory : 2023700 KB Boot State : Normal boot -------------------------------------------------------------------------------- !!! Files that have been deleted !!! C:\Documents and Settings\Jarczew\Dane aplikacji\Sun\Java\Deployment\cache\javapi\*.* C:\WINDOWS\SwSys1.bmp C:\WINDOWS\SwSys2.bmp C:\WINDOWS\system32\Uninstall.ico -------------------------------------------------------------------------------- !!! Directories that have been removed !!! No malicious directories to be removed -------------------------------------------------------------------------------- !!! Registry entries that have been removed !!! No malicious Registry entries found ================================================================================ All Done :) ShadowPuterDude Safe Surfing!!!

**Posty:** 684 · przez **djarta** 09 Wrz 2008, 07:49

Przeskanuj Kasperskym.Daj nowy log z ComboFixa.

============================
K.

**Posty:** 128 · przez **Jarczew** 10 Wrz 2008, 23:07

Niestety nie mam połączenia internetowego z dysku na którym powinienem przeskanować kasperskym. Jutro dam logi z combofixa

Dodano 13.09.2008 10:34:47:
Witam po przerwie. Miałem problem z uruchomieniem tego dysku z którego łącze się z internetem. Nie chciał ruszyc bo to stary dysk .
Niestety w dalszym ciagu nie mogę uruchomić połaczenia zinternetem z dysku ktorego system zaatakował wirus. sciana

Bardzo proszę o poradę z jakiego żródła mogę wiecej dowiedziec się co zostało zmienione na tym dysku , w dalszym ciagu nie mogę uzyskać polączenia z serwerem ( z dyku na którym mam drugi system mogę się połączyć). Pan z servisu TPSA powiedział że w takiej sytuacji trzeba instalować system bo sprawa usuniecia tych przekierowań ktore wirus zainstalował w systemie nie da się usunać. Próbowałem odinstalować wszystkie połączenia internetowe, ale niestery nie można tego zrobić, nie chcą się usunąć. Chyba gdzieś w systenie są jakieś zapisy które blokują połączenia.
Za pomoc z góry dziękuję.

Oto log z ComboFixa"

Kod: Zaznacz wszystko: ComboFix 08-09-05.05 - Jarczew 2008-09-13 10:50:18.2 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.1586 [GMT 2:00] Running from: C:\Documents and Settings\Jarczew\Pulpit\Miotła\Różne\avenger\ComboFix.exe * Resident AV is active [color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color] . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\Documents and Settings\Jarczew\Cookies\jarczew@~~local~~[2].txt C:\Documents and Settings\Jarczew\Cookies\jarczew@www4.pdh37ehp7oqk7d[1].txt . ((((((((((((((((((((((((( Files Created from 2008-08-13 to 2008-09-13 ))))))))))))))))))))))))))))))) . 2008-09-09 08:42 . 2007-09-29 21:57 141,312 --a------ C:\WINDOWS\system32\FFBTN32.dll 2008-09-09 08:42 . 2007-09-29 20:29 66,560 --a------ C:\WINDOWS\system32\ntrights.exe 2008-09-09 08:42 . 2007-09-29 20:33 65,536 --a------ C:\WINDOWS\system32\AvidQTUpdaterVC7.dll 2008-09-09 08:42 . 2007-09-29 20:38 56,832 --a------ C:\WINDOWS\system32\drivers\AvidXPSerial.sys 2008-09-09 08:42 . 2007-09-29 21:30 19,968 --a------ C:\WINDOWS\system32\Cpuinf32.dll 2008-09-08 22:24 . 2008-09-09 08:42 <DIR> d-------- C:\WINDOWS\system32\MEDIA 2008-09-08 22:17 . 2008-09-08 22:17 <DIR> d-------- C:\WINDOWS\system32\MEDIA(2) 2008-09-08 12:14 . 2008-09-08 14:49 <DIR> d-------- C:\Próba 2008-09-08 11:29 . 2008-09-08 11:59 <DIR> d-------- C:\Zdjecia 2008-09-07 13:12 . 2008-09-07 13:12 <DIR> d-------- C:\WINDOWS\ERUNT 2008-09-05 12:45 . 2008-09-05 17:24 <DIR> d-------- C:\Egipt2008 2008-09-04 21:02 . 2008-09-04 21:02 <DIR> d-------- C:\Documents and Settings\Trebor\Dane aplikacji\Apple Computer 2008-09-04 18:19 . 2008-08-29 04:05 <DIR> d-------- C:\SDFix 2008-09-04 17:51 . 2008-09-04 17:51 51,094 --a------ C:\netbt3.gif 2008-09-04 17:50 . 2008-09-04 18:08 <DIR> d-------- C:\Nowy folder 2008-09-04 16:10 . 2008-09-04 16:10 <DIR> d-------- C:\Documents and Settings\Trebor\Dane aplikacji\Lavasoft 2008-09-04 16:03 . 2008-09-08 09:39 <DIR> d-------- C:\Documents and Settings\Trebor\Dane aplikacji\AVG7 2008-09-04 01:52 . 2008-09-04 01:52 <DIR> d-------- C:\Documents and Settings\Trebor\Dane aplikacji\DivX 2008-09-04 01:51 . 2008-09-13 10:55 <DIR> d--h----- C:\Documents and Settings\Trebor\Ustawienia lokalne 2008-09-04 01:51 . 2008-09-04 01:51 <DIR> dr------- C:\Documents and Settings\Trebor\Ulubione 2008-09-04 01:51 . 2006-11-24 21:22 <DIR> d--h----- C:\Documents and Settings\Trebor\Szablony 2008-09-04 01:51 . 2008-09-08 17:27 <DIR> d-------- C:\Documents and Settings\Trebor\Pulpit 2008-09-04 01:51 . 2008-09-04 01:51 <DIR> dr------- C:\Documents and Settings\Trebor\Moje dokumenty 2008-09-04 01:51 . 2006-11-24 21:16 <DIR> dr------- C:\Documents and Settings\Trebor\Menu Start 2008-09-04 01:51 . 2008-09-04 16:10 <DIR> dr-h----- C:\Documents and Settings\Trebor\Dane aplikacji 2008-09-04 01:51 . 2008-09-08 22:26 <DIR> d-------- C:\Documents and Settings\Trebor 2008-09-03 01:46 . 2008-09-12 09:53 54,156 --ah----- C:\WINDOWS\QTFont.qfn 2008-09-03 01:46 . 2008-09-03 01:46 1,409 --a------ C:\WINDOWS\QTFont.for 2008-09-02 23:52 . 2008-09-02 23:52 <DIR> d-------- C:\Program Files\Styles 2008-09-02 23:52 . 2008-09-02 23:52 <DIR> d-------- C:\Program Files\Skin 2008-09-02 23:52 . 2008-09-02 23:52 <DIR> d-------- C:\Program Files\program 2008-09-02 23:52 . 2008-09-02 23:52 <DIR> d-------- C:\Program Files\locale 2008-09-02 23:52 . 2008-09-02 23:52 <DIR> d-------- C:\Program Files\defaults 2008-09-02 23:52 . 2008-09-02 23:52 <DIR> d-------- C:\Program Files\classes 2008-09-02 22:26 . 2008-09-02 22:26 <DIR> d-------- C:\Program Files\Enigma Software Group 2008-08-31 22:15 . 2006-10-22 15:06 208,896 --a------ C:\WINDOWS\system32\NVUNINST.EXE 2008-08-30 21:57 . 2008-08-30 21:57 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\nView_Profiles 2008-08-30 21:57 . 2008-08-30 21:58 1,632 --a------ C:\WINDOWS\system32\d3d8caps.dat 2008-08-30 21:52 . 2008-08-31 22:19 <DIR> d-------- C:\WINDOWS\nview 2008-08-30 21:52 . 2006-06-01 11:22 208,896 --a------ C:\WINDOWS\system32\nvudisp.exe 2008-08-30 21:52 . 2006-10-22 12:22 17,056 --a------ C:\WINDOWS\system32\nvdisp.nvu 2008-08-30 21:38 . 2008-05-01 16:33 331,776 -----c--- C:\WINDOWS\system32\dllcache\msadce.dll 2008-08-25 20:16 . 2008-08-25 20:16 <DIR> d-------- C:\ConvertTemp 2008-08-25 20:11 . 2008-08-25 20:11 <DIR> d-------- C:\Documents and Settings\Jarczew\Dane aplikacji\Samsung 2008-08-25 20:04 . 2006-05-03 22:53 174,592 --a------ C:\WINDOWS\system32\framedyn.dll 2008-08-25 20:03 . 2008-08-25 20:04 <DIR> d-------- C:\WINDOWS\system32\Samsung_USB_Drivers 2008-08-25 20:03 . 2007-07-03 16:58 106,792 --a------ C:\WINDOWS\system32\drivers\sscdmdm.sys 2008-08-25 20:03 . 2007-07-03 16:54 80,552 --a------ C:\WINDOWS\system32\drivers\sscdbus.sys 2008-08-25 20:03 . 2007-07-03 16:57 11,944 --a------ C:\WINDOWS\system32\drivers\sscdmdfl.sys 2008-08-25 20:03 . 2007-07-03 17:00 9,256 --a------ C:\WINDOWS\system32\drivers\sscdwhnt.sys 2008-08-25 20:03 . 2007-07-03 17:00 9,256 --a------ C:\WINDOWS\system32\drivers\sscdwh.sys 2008-08-25 20:03 . 2007-07-03 16:56 9,256 --a------ C:\WINDOWS\system32\drivers\sscdcmnt.sys 2008-08-25 20:03 . 2007-07-03 16:56 9,256 --a------ C:\WINDOWS\system32\drivers\sscdcm.sys 2008-08-25 20:03 . 2005-08-28 20:51 766 --a------ C:\WINDOWS\system32\Uninstall.ico 2008-08-25 20:02 . 2008-08-25 20:02 <DIR> d-------- C:\Program Files\Samsung 2008-08-25 20:02 . 2006-07-24 16:05 5,632 --a------ C:\WINDOWS\system32\drivers\StarOpen.sys 2008-08-20 01:39 . 2008-08-20 01:40 <DIR> d-------- C:\Program Files\SureThing 2008-08-20 01:39 . 2008-08-20 01:39 <DIR> d-------- C:\Program Files\Common Files\SureThing Shared 2008-08-14 15:52 . 2008-08-14 15:52 3,698,688 --a------ C:\Program Files\opera.dll 2008-08-14 15:52 . 2008-08-14 15:52 653,419 --a------ C:\Program Files\encoding.bin 2008-08-14 15:52 . 2008-08-14 15:52 98,816 --a------ C:\Program Files\opera.exe 2008-08-14 15:52 . 2008-08-14 15:52 36,864 --a------ C:\Program Files\spellcheck.dll 2008-08-14 15:52 . 2008-08-14 15:52 20,480 --a------ C:\Program Files\OUniAnsi.dll . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-09-11 15:56 --------- d-----w C:\Program Files\jv16 PowerTools 2008-09-11 15:17 --------- d-----w C:\Documents and Settings\Jarczew\Dane aplikacji\AVG7 2008-09-09 06:40 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-09-09 06:38 --------- d-----w C:\Program Files\Common Files\Avid 2008-09-08 22:15 --------- d-----w C:\Program Files\Avid 2008-09-08 19:29 --------- d-----w C:\Program Files\Norton SystemWorks 2008-09-04 19:38 --------- d-----w C:\Program Files\English Translator 3 2008-09-04 19:08 --------- d-----w C:\Program Files\Opera 2008-09-04 17:07 --------- d-----w C:\Program Files\ESET 2008-09-03 19:20 --------- d-----w C:\Program Files\Spybot - Search & Destroy 2008-09-03 19:18 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Spybot - Search & Destroy 2008-09-02 21:52 1,638 ----a-w C:\Program Files\operadef6.ini 2008-08-19 23:35 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\EPSON 2008-08-15 21:09 --------- d-----w C:\Documents and Settings\Jarczew\Dane aplikacji\ameCache 2008-08-15 20:55 --------- d-----w C:\Documents and Settings\Jarczew\Dane aplikacji\dvdcss 2008-08-14 14:04 8,250 ----a-w C:\Program Files\license.rtf 2008-08-14 14:04 226,437 ----a-w C:\Program Files\english.lng 2008-08-14 08:41 --------- d-----w C:\Documents and Settings\Jarczew\Dane aplikacji\uTorrent 2008-08-14 08:40 --------- d-----w C:\Program Files\SureThing(2) 2008-08-14 08:40 --------- d-----w C:\Program Files\NOD32view 2008-08-14 08:40 --------- d-----w C:\Program Files\EPSON 2008-08-14 08:17 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\FLEXnet 2008-08-13 15:02 7,002 ----a-w C:\Program Files\search.ini 2008-08-03 19:01 --------- d-----w C:\Documents and Settings\Jarczew\Dane aplikacji\Azureus 2008-08-03 10:27 --------- d-----w C:\Program Files\OLYMPUS 2008-08-01 17:47 --------- d-----w C:\Documents and Settings\Jarczew\Dane aplikacji\4Team 2008-08-01 17:46 --------- d-----w C:\Program Files\4Team Corporation 2008-07-31 16:47 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\UDL 2008-07-14 19:58 --------- d-----w C:\Program Files\Sun 2008-07-14 19:57 --------- d-----w C:\Program Files\Java 2008-07-07 20:33 253,952 ----a-w C:\WINDOWS\system32\es.dll 2008-06-24 16:24 74,240 ----a-w C:\WINDOWS\system32\mscms.dll 2008-06-23 16:42 826,368 ----a-w C:\WINDOWS\system32\wininet.dll 2008-06-20 17:42 246,784 ----a-w C:\WINDOWS\system32\mswsock.dll 2008-05-05 08:51 3,873 ----a-w C:\Program Files\lngcode.txt 2006-12-24 13:03 92,064 ----a-w C:\Documents and Settings\Jarczew\mqdmmdm.sys 2006-12-24 13:03 9,232 ----a-w C:\Documents and Settings\Jarczew\mqdmmdfl.sys 2006-12-24 13:03 79,328 ----a-w C:\Documents and Settings\Jarczew\mqdmserd.sys 2006-12-24 13:03 66,656 ----a-w C:\Documents and Settings\Jarczew\mqdmbus.sys 2006-12-24 13:03 6,208 ----a-w C:\Documents and Settings\Jarczew\mqdmcmnt.sys 2006-12-24 13:03 5,936 ----a-w C:\Documents and Settings\Jarczew\mqdmwhnt.sys 2006-12-24 13:03 4,048 ----a-w C:\Documents and Settings\Jarczew\mqdmcr.sys 2006-12-24 13:03 25,600 ----a-w C:\Documents and Settings\Jarczew\usbsermptxp.sys 2006-12-24 13:03 22,768 ----a-w C:\Documents and Settings\Jarczew\usbsermpt.sys 2004-08-20 12:56 301 ----a-w C:\Program Files\c3nform.vxml 2004-02-26 12:35 7,904 ----a-w C:\Program Files\html40_entities.dtd 2006-11-24 21:11 32 --sha-w C:\WINDOWS\{266801D5-4013-4D6A-B377-5DAB609B2AA5}.dat 2006-11-24 21:12 32 --sha-w C:\WINDOWS\{AB398A76-AA2D-43D1-8FDB-12573D291DE9}.dat 2006-11-24 21:11 32 --sha-w C:\WINDOWS\{BBC06AA3-0DFB-42F0-84FE-0FB977CBB5EB}.dat 2006-11-24 21:11 32 --sha-w C:\WINDOWS\{F80AD1C0-674E-44DD-AE58-E66846087076}.dat 2006-11-24 21:13 32 --sha-w C:\WINDOWS\{FE3F9671-933F-4CAE-BA5F-A33DEA08BDC0}.dat 2007-12-16 18:30 1,056 --sha-w C:\WINDOWS\system32\KGyGaAvL.sys 2006-11-24 21:12 32 --sha-w C:\WINDOWS\system32\{431DDD0B-3165-4AB1-95E5-28DA73B57621}.dat 2006-11-24 21:11 32 --sha-w C:\WINDOWS\system32\{875BDC63-996B-4C90-B2EB-490F10627E72}.dat 2006-11-24 21:11 32 --sha-w C:\WINDOWS\system32\{8BAECD84-FB19-4E64-ABDA-512BC164E8F8}.dat 2006-11-24 21:11 32 --sha-w C:\WINDOWS\system32\{9FBDD33A-9B90-4B13-92C0-EE4EF3883183}.dat 2006-11-24 21:13 32 --sha-w C:\WINDOWS\system32\{E662EC9F-3D54-49D1-A926-EDFEA74C2CB9}.dat . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 15360] "QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-03-28 413696] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "PinnacleDriverCheck"="C:\WINDOWS\system32\PSDrvCheck.exe" [2003-12-04 406016] "HPDJ Taskbar Utility"="C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb07.exe" [2002-12-18 188416] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784] "DigidesignMMERefresh"="C:\Program Files\Digidesign\Drivers\MMERefresh.exe" [2006-12-09 61440] "QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-03-28 413696] "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-10-22 7700480] "egui"="C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" [2008-07-01 1447168] "iKeyWorks"="C:\PROGRA~1\A4Tech\Keyboard\Ikeymain.exe" [2002-11-22 73728] "SoundMan"="SOUNDMAN.EXE" [2007-04-16 C:\WINDOWS\soundman.exe] "nwiz"="nwiz.exe" [2006-10-22 C:\WINDOWS\system32\nwiz.exe] "NvMediaCenter"="NvMCTray.dll" [2006-10-22 C:\WINDOWS\system32\nvmctray.dll] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "AVG7_Run"="C:\PROGRA~1\Grisoft\AVG7\avgw.exe" [2007-12-05 219136] C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\ DSLMON.lnk - C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe [2007-02-14 962661] Program sieciowy dla SAGEM Wi-Fi 11g USB adapter.lnk - C:\Program Files\SAGEM WiFi manager\WLANUTL.exe [2008-01-05 950272] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "vidc.CDVC"= cdvccodc.dll "vidc.DIV3"= DivXc32.dll "vidc.DIV4"= DivXc32f.dll "msacm.divxa32"= DivXa32.acm "VIDC.MJPG"= Pvmjpg21.dll "VIDC.PIM1"= pclepim1.dll "vidc.CDV5"= cdv5codc.dll "vidc.CLLC"= cllccodc.dll "vidc.CUVC"= cuvccodc.dll "vidc.CDVH"= cdvhcodc.dll "vidc.CMIC"= cmiccodc.dll "msacm.avis"= ff_acm.acm "MIDI1"= diomidi.dll "wave1"= Digi32.dll "vidc.AVRn"= AvidAVICodec.dll "SENTINEL"= snti386.dll [HKLM\~\startupfolder\C:^Documents and Settings^Jarczew^Menu Start^Programy^Autostart^ AutoKiller.lnk] path=C:\Documents and Settings\Jarczew\Menu Start\Programy\Autostart\ AutoKiller.lnk backup=C:\WINDOWS\pss\ AutoKiller.lnkStartup HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BearShare HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LanguageShortcut HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusDisableNotify"=dword:00000001 "UpdatesDisableNotify"=dword:00000001 "AntiVirusOverride"=dword:00000001 "FirewallOverride"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "C:\\Program Files\\PPStream\\PPStream.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "C:\\Program Files\\AdorageI-GfxDatas\\AdorageI-SAL\\bittorrent.exe"= "%windir%\\system32\\sessmgr.exe"= "C:\\Program Files\\Bonjour\\mDNSResponder.exe"= R1 cdrblock;cdrblock;C:\WINDOWS\system32\DRIVERS\cdrblock.sys [2007-05-31 20864] R1 cdrport;cdrport;C:\WINDOWS\system32\DRIVERS\cdrport.sys [2005-03-11 4608] R1 epfwtdir;epfwtdir;C:\WINDOWS\system32\DRIVERS\epfwtdir.sys [2008-07-01 34312] R2 DigiNet;Digidesign Ethernet Support;C:\WINDOWS\system32\DRIVERS\diginet.sys [2006-12-08 11776] R3 Amps2prt;A4Tech PS/2 Port Mouse Driver;C:\WINDOWS\system32\DRIVERS\Amps2prt.sys [2002-11-20 9344] R3 SG762_XP;SAGEM 802.11g XG762 1211B Driver;C:\WINDOWS\system32\DRIVERS\WlanBZXP.sys [2007-01-10 450560] S0 DAL;DAL;C:\WINDOWS\system32\drivers\DAL.sys [ ] S1 ati2mtaa;ati2mtaa;C:\WINDOWS\system32\DRIVERS\ati2mtaa.sys [2004-08-04 327040] S1 Pinnacle;Genie Adapter;C:\WINDOWS\system32\drivers\pgenie.sys [ ] S3 s3legacy;s3legacy;C:\WINDOWS\system32\DRIVERS\s3legacy.sys [2001-08-17 65664] S3 s3m;s3m;C:\WINDOWS\system32\DRIVERS\s3m.sys [2001-08-17 166720] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}] "C:\Program Files\Common Files\LightScribe\LSRunOnce.exe" . Contents of the 'Scheduled Tasks' folder . . ------- Supplementary Scan ------- . R0 -: HKCU-Main,Start Page = hxxp://wp.pl/ R0 -: HKCU-Main,SearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8 R0 -: HKLM-Main,Start Page = about:blank R1 -: HKCU-Internet Settings,ProxyOverride = *.local R1 -: HKCU-SearchURL,(Default) = hxxp://www.google.com/search?q=%s O8 -: Append to existing PDF - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html O8 -: Convert link target to Adobe PDF - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html O8 -: Convert link target to existing PDF - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html O8 -: Convert selected links to Adobe PDF - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html O8 -: Convert selected links to existing PDF - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html O8 -: Convert selection to Adobe PDF - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html O8 -: Convert selection to existing PDF - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html O8 -: Convert to Adobe PDF - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html O8 -: E&ksport do programu Microsoft Excel - C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O16 -: {68282C51-9459-467B-95BF-3C0E89627E55} - hxxp://www.mks.com.pl/skaner/SkanerOnline.cab C:\WINDOWS\Downloaded Program Files\SkanerOnline.inf C:\WINDOWS\system32\SkanerOnlineUninstall.exe C:\WINDOWS\system32\SkanerOnline.dll . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-09-13 10:55:32 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** [HKEY_LOCAL_MACHINE\system\ControlSet004\Services\gusvc] "ImagePath"="--\"C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe\"" [HKEY_LOCAL_MACHINE\system\ControlSet004\Services\ose] "ImagePath"="--\"C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE\"" . Completion time: 2008-09-13 10:57:49 ComboFix-quarantined-files.txt 2008-09-13 08:57:17 ComboFix2.txt 2008-09-08 15:37:46 Pre-Run: 13,282,631,680 bajtów wolnych Post-Run: 13,268,119,552 bajtów wolnych 256 --- E O F --- 2008-08-30 22:29:43

**Posty:** 684 · przez **djarta** 13 Wrz 2008, 11:39

Wg mnie - czysto.

Przeskanuj obszar swojego komputera http://www.kaspersky.pl/virusscanner.html (uruchom przez IE) Daj raport z niego na forum.

=========================
K.

**Posty:** 128 · przez **Jarczew** 13 Wrz 2008, 12:02

Niestety nie mam połączenia internetowego z dysku na którym powinienem przeskanować kasperskym.Nie wiem czy dobrze Cię zrozumiałem.Kasperski skanuje dysk przez IE, ale wtym problem że , nie moę połączyć się z inernetem przez dysk który ma być skanowany przez internet.
Pytanie czy Kasperski przeskanuje mi system na dysku który był zainfekowany, a połącze się z internetem przez inny dysk na którym jest drugi system który nie był zainfekowany?
Moze dać logi z hijacka.

Ma jesze ogromną prośbę czy mam szanse uzyskać połączenie z netem z dysku w którym wirus poczynił zmiany. Czy jest jakaś mozliwoś zeby zlokalizować jakie zmiany poczynił wirus ze zablokował mi połączeniaz tego zainfekowanego dysku.
Za pomoc z góry dziękuję.

**Posty:** 684 · przez **djarta** 13 Wrz 2008, 12:07

A czy możesz przeskanować Dr.WEB CureIt!

C:\WINDOWS\system32\MEDIA

Znasz to? ComboFix wywala samoczynnie ten folder, ale ostatni wyraz musi mieć nazwę "media", przez małe litery.

===============================
K.

**Posty:** 128 · przez **Jarczew** 14 Wrz 2008, 00:08

Mam połaczeniaz internetem. Plik C:\WINDOWS\system32\MEDIA jest z programu do edycji video firmy Avid czyli o.k..
Bardzo jeszcze raz dziekuję za pomoc. :banan:

Skanowałem Dr.WEB CureIt prawie 6 godz. oto log;

Kod: Zaznacz wszystko: 00183890.FIL C:\$VAULT$.AVG Win32.HLLM.Netsky.35328 Usunięty. 04346000.FIL C:\$VAULT$.AVG Trojan.Virtumod.223 Usunięty. 04354531.FIL C:\$VAULT$.AVG Trojan.Virtumod.223 Usunięty. 07678859.FIL\data002 C:\$VAULT$.AVG\07678859.FIL Trojan.DnsChange 07678859.FIL C:\$VAULT$.AVG Archiwum zawierające zainfekowane obiekty Przeniesiony. 10003109.FIL\data002 C:\$VAULT$.AVG\10003109.FIL Trojan.DnsChange 10003109.FIL C:\$VAULT$.AVG Archiwum zawierające zainfekowane obiekty Przeniesiony. ComboFix.exe\327882R2FWJFW\List-C.bat C:\Documents and Settings\Jarczew\Pulpit\Miotła\Różne\avenger\ComboFix.exe Prawdopodobnie BATCH.Virus ComboFix.exe\327882R2FWJFW\psexec.cfexe C:\Documents and Settings\Jarczew\Pulpit\Miotła\Różne\avenger\ComboFix.exe Program.PsExec.171 ComboFix.exe C:\Documents and Settings\Jarczew\Pulpit\Miotła\Różne\avenger Archiwum zawierające zainfekowane obiekty Przeniesiony. SDFix.exe\SDFix\apps\Process.exe C:\Documents and Settings\Jarczew\Pulpit\Usuwanie wirusa\SDFix.exe Tool.Prockill SDFix.exe C:\Documents and Settings\Jarczew\Pulpit\Usuwanie wirusa Archiwum zawierające zainfekowane obiekty Przeniesiony. Process.exe C:\Documents and Settings\Jarczew\Pulpit\Usuwanie wirusa\SDFix\SDFix\apps Tool.Prockill Process.exe C:\Documents and Settings\Jarczew\Pulpit\Usuwanie wirusa\SmitfraudFix\SmitfraudFix Tool.Prockill restart.exe C:\Documents and Settings\Jarczew\Pulpit\Usuwanie wirusa\SmitfraudFix\SmitfraudFix Tool.ShutDown.11 Process.exe C:\Documents and Settings\Trebor\Pulpit\SDFix\apps Tool.Prockill Process.exe C:\SDFix\apps Tool.Prockill A0002537.bat C:\System Volume Information\_restore{9A7236AA-2F8A-4F44-9A1D-2BA27D113E33}\RP25 Prawdopodobnie BATCH.Virus A0002581.exe\327882R2FWJFW\List-C.bat C:\System Volume Information\_restore{9A7236AA-2F8A-4F44-9A1D-2BA27D113E33}\RP26\A0002581.exe Prawdopodobnie BATCH.Virus A0002581.exe\327882R2FWJFW\psexec.cfexe C:\System Volume Information\_restore{9A7236AA-2F8A-4F44-9A1D-2BA27D113E33}\RP26\A0002581.exe Program.PsExec.171 A0002581.exe C:\System Volume Information\_restore{9A7236AA-2F8A-4F44-9A1D-2BA27D113E33}\RP26 Archiwum zawierające zainfekowane obiekty Przeniesiony. A0002582.exe\SDFix\apps\Process.exe C:\System Volume Information\_restore{9A7236AA-2F8A-4F44-9A1D-2BA27D113E33}\RP26\A0002582.exe Tool.Prockill A0002582.exe C:\System Volume Information\_restore{9A7236AA-2F8A-4F44-9A1D-2BA27D113E33}\RP26 Archiwum zawierające zainfekowane obiekty Przeniesiony. Process.exe C:\WINDOWS\system32 Tool.Prockill 03590203.FIL D:\$VAULT$.AVG Trojan.DownLoader.19397 Usunięty. 03594343.FIL D:\$VAULT$.AVG Trojan.MulDrop.5684 Usunięty. 29117829.FIL D:\$VAULT$.AVG BackDoor.IRC.Sdbot.2654 Usunięty.

**Posty:** 684 · przez **djarta** 14 Wrz 2008, 10:04

Czy sytuacja się poprawiła?

========================
K.

**Posty:** 128 · przez **Jarczew** 15 Wrz 2008, 00:57

Tak wszystko jest w porzadku. Jeszcze raz dziękuję za pomoc. :banan:

**Posty:** 9 · przez **FANGTA** 30 Wrz 2008, 20:15

witam nie zakładam nowego tematu ponieważ mam taki sam problem,tzn. podobny, z tym samym wirusem tylko że inny log mi wyskakuje z hijackthis, reszta praktycznie to samo poukrywane dyski, menu start/wszystkie programy do dysków moge sie dostać tylko takim sposobem: wejść w moje dokumenty bo to ma mdostępne i wpisać np. d:\ także brak dostępu do np. menedżera zadań (pisze menedżer zadań zablokowany przez administratora);/

Oto treść loga:

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 20:02: VIRUS ALERT!, on 2008-09-30 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16705) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Ahead\InCD\InCDsrv.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\PnkBstrA.exe C:\WINDOWS\system32\RUNDLL32.EXE C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe C:\Program Files\Ahead\InCD\InCD.exe C:\PROGRA~1\AVG\AVG8\avgtray.exe C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe D:\Programy\iTunes\iTunesHelper.exe C:\WINDOWS\system32\ctfmon.exe D:\Programy\HP\HP WebInspect\WIScheduler.exe C:\PROGRA~1\AVG\AVG8\avgrsx.exe C:\PROGRA~1\AVG\AVG8\avgemc.exe C:\Program Files\iPod\bin\iPodService.exe C:\WINDOWS\system32\wuauclt.exe C:\Program Files\Internet Explorer\Iexplore.exe C:\Program Files\Internet Explorer\Iexplore.exe C:\WINDOWS\system32\wuauclt.exe C:\Program Files\Opera\opera.exe D:\Programy\Safer Networking\RegAlyzer\RegAlyzer.exe C:\Documents and Settings\Tomek\Pulpit\HiJackThis.exe C:\WINDOWS\system32\rundll32.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://softwarereferral.com/jump.php?wmid=6010&mid=MjI6Ojg5&lid=2 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx O2 - BHO: QXK Olive - {27C553CA-8F48-410F-9BCF-A50AB83641F8} - C:\WINDOWS\dfmlxbpkkpf.dll O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll O2 - BHO: AlpGld.Tb6 - {57BE2636-F271-4151-9D4A-40A2663E4FD7} - C:\WINDOWS\system32\SYSBAS~1.DLL O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll O2 - BHO: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL O2 - BHO: (no name) - {C2503670-6D0E-4662-AC65-EFA76E33056C} - C:\WINDOWS\system32\ljJARhFU.dll O2 - BHO: HP.AppSec.IEPlugin.BrowserHelperObject - {D2F2FF19-6C6D-42e7-A57E-5949C856DC04} - C:\Program Files\Common Files\HP\HP Security Toolkit\wrapmscoree.dll O3 - Toolbar: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL O3 - Toolbar: (no name) - {37B85A29-692B-4205-9CAD-2626E4993404} - (no file) O3 - Toolbar: peltodgx - {D84FF92C-BFC4-4FEB-A61B-7C260B6CD914} - C:\WINDOWS\peltodgx.dll O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe" O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe" O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe O4 - HKLM\..\Run: [iTunesHelper] "D:\Programy\iTunes\iTunesHelper.exe" O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [NBJ] "C:\Program Files\Ahead\Nero BackItUp\NBJ.exe" O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Startup: hamachi.lnk = D:\Programy\Hamachi\hamachi.exe O4 - Global Startup: HP ASC Monitor.lnk = D:\Programy\HP\HP WebInspect\SPIMonitor.exe O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll O20 - AppInit_DLLs: avgrsstx.dll O20 - Winlogon Notify: ljJARhFU - C:\WINDOWS\SYSTEM32\ljJARhFU.dll O21 - SSODL: onfwbsak - {9B6DF179-0E44-4E9F-A44A-E857584DB2C8} - C:\WINDOWS\onfwbsak.dll O21 - SSODL: rwlfsdmk - {7F738536-97DC-424B-ABF5-C6546893A1F8} - C:\WINDOWS\rwlfsdmk.dll O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: AMP 3.0 Sensor for WebInspect (AmpSensor3.0-WebInspect) - Hewlett Packard, Inc. - D:\Programy\HP\HP WebInspect\AmpSensorWI.exe O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: AVG8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Ahead\InCD\InCDsrv.exe O23 - Service: Usługa iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe O23 - Service: WebInspect Scheduler Service - Hewlett Packard, Inc. - D:\Programy\HP\HP WebInspect\WIScheduler.exe -- End of file - 7618 bytes

**Posty:** 8001 · przez **Okocza** 30 Wrz 2008, 20:25

FANGTA, załóż swój własny temat... i wklej w nim log z combofixa...

**Posty:** 9 · przez **FANGTA** 30 Wrz 2008, 20:28

zrobione;) sorki chciałem tylko nie tworzyć drugiego podobnego tematu ale skoro tak to ok ps. jak któyśz modó lub adminów możę to neich usunie te dwa posty moej w tym temacie żęby go nei zaśmiecały;)