Internet działa bardzo wolno

**Posty:** 66 · przez **stryju** 18 Paź 2008, 16:02

Witam, włączając pobieranie pliku zauważyłem że pobierany jest on bardzo wolno, powinno iść 60 - 64 Kbit/s a idzie 5 - 10 Kbit/s. Mam neostrade 512, obawiam się że to jakieś "gówienko" bo wczoraj nic się takiego nie działo, restartowałem liveboxa, restartowałem komputer. Dodam jeszcze że w grach multiplayer mam również ten problem.
Oto log z HijackThis

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 16:01:30, on 2008-10-18 Platform: Windows XP Dodatek SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16735) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\RTHDCPL.EXE C:\WINDOWS\SOUNDMAN.EXE C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe C:\Program Files\iTunes\iTunesHelper.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe C:\WINDOWS\system32\IoctlSvc.exe C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe C:\Program Files\iPod\bin\iPodService.exe C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\wuauclt.exe C:\Program Files\Gadu-Gadu\gg.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.microsoft.com/fwlink/?LinkId=74005 R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~1\Office12\GRA8E1~1.DLL O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [AlcWzrd] ALCWZRD.EXE O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" ASO-616B5711-6DAE-4795-A05F-39A1E5104020 O4 - HKCU\..\Run: [kamsoft] C:\WINDOWS\system32\ckvo.exe O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-19\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-20\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'Default user') O8 - Extra context menu item: E&ksportuj do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~1\Office12\EXCEL.EXE/3000 O9 - Extra button: Wyślij do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~1\Office12\ONBttnIE.dll O9 - Extra 'Tools' menuitem: Wyślij &do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~1\Office12\ONBttnIE.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~1\Office12\REFIEBAR.DLL O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O17 - HKLM\System\CCS\Services\Tcpip\..\{E618FA5A-CA91-4740-A425-EF93A021E1B8}: NameServer = 194.204.159.1,194.204.152.34 O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~1\Office12\GR99D3~1.DLL O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: Ares Chatroom server (AresChatServer) - Ares Development Group - C:\Program Files\Ares\chatServer.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: Usługa iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe O23 - Service: PLFlash DeviceIoControl Service - Prolific Technology Inc. - C:\WINDOWS\system32\IoctlSvc.exe -- End of file - 6445 bytes

EDIT:

To raczej wina providera, bo na Linuxie również mi bardzo muli i kiepsko ściąga pliki...

**Posty:** 18165 · przez **wojtas** 18 Paź 2008, 17:01

Wykonaj to co jest podane w tym temacie

Zastosuj SDFix . Po pobraniu uruchom go a rozpakuje się do C:\SDFix. Uruchom komputer w trybie awaryjnym (F8 przy stracie systemu). Będąc w awaryjnym uruchom plik RunThis.bat z folderu SDFixa. Zatwierdź czyszczenie przez Y. Poczekaj aż ukończy i komputer zresetuje

Potem wejdz do folderu C:\SDFix wrzuc zawartość pliku Report.txt + log z combofixa oraz daj loga z hijacka

**Posty:** 66 · przez **stryju** 18 Paź 2008, 17:25

Kod: Zaznacz wszystko: ComboFix 08-10-17.01 - Stryju 2008-10-18 17:20:38.1 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.3.1250.1.1045.18.1582 [GMT 2:00] Uruchomiony z: C:\Documents and Settings\Stryju\Pulpit\ComboFix.exe [COLOR=RED][B]UWAGA - TEN KOMPUTER NIE MA ZAINSTALOWANEJ KONSOLI ODZYSKIWANIA !![/B][/COLOR] . ((((((((((((((((((((((((((((((((((((((( Usunięto ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\68.exe C:\9.cmd C:\autorun.inf C:\bo1dhu.bat C:\itsduel.exe C:\n6t1h.cmd C:\otyh.cmd C:\vva0hc0p.cmd C:\WINDOWS\system32\ckvo.exe C:\WINDOWS\system32\ckvo0.dll C:\WINDOWS\system32\ckvo1.dll C:\wjlfhtfm.cmd C:\xk2n.bat C:\yew.bat D:\9.cmd D:\Autorun.inf D:\bo1dhu.bat D:\itsduel.exe D:\n6t1h.cmd D:\otyh.cmd D:\vva0hc0p.cmd D:\wjlfhtfm.cmd D:\xk2n.bat D:\yew.bat E:\9.cmd E:\Autorun.inf E:\bo1dhu.bat E:\itsduel.exe E:\n6t1h.cmd E:\otyh.cmd E:\vva0hc0p.cmd E:\wjlfhtfm.cmd E:\xk2n.bat E:\yew.bat . ((((((((((((((((((((((((( Pliki utworzone od 2008-09-18 do 2008-10-18 ))))))))))))))))))))))))))))))) . 2008-10-18 17:14 . 2008-10-18 17:14 <DIR> d-------- C:\WINDOWS\system32\xircom 2008-10-18 17:14 . 2008-10-18 17:14 <DIR> d-------- C:\Program Files\microsoft frontpage 2008-10-18 17:12 . 2008-10-18 17:12 580,096 --a------ C:\WINDOWS\system32\dllcache\user32.dll 2008-10-18 17:11 . 2008-10-18 17:11 <DIR> d-------- C:\WINDOWS\ERUNT 2008-10-18 17:08 . 2008-10-18 17:19 <DIR> d-------- C:\SDFix 2008-10-18 16:01 . 2008-10-18 16:01 <DIR> d-------- C:\Program Files\Trend Micro 2008-10-18 11:49 . 2008-10-18 11:48 104,758 -r-hs---- C:\2fiji.com 2008-10-16 20:06 . 2008-10-16 20:06 <DIR> d-------- C:\Program Files\Teamspeak2_RC2 2008-10-16 20:06 . 2008-10-16 20:06 <DIR> d-------- C:\Documents and Settings\Stryju\Dane aplikacji\teamspeak2 2008-10-16 20:06 . 2008-10-16 20:06 34,064 --a------ C:\WINDOWS\system32\lhacm.acm 2008-10-15 06:26 . 2008-09-15 17:27 1,846,656 --------- C:\WINDOWS\system32\dllcache\win32k.sys 2008-10-15 06:26 . 2008-09-08 12:41 333,824 --------- C:\WINDOWS\system32\dllcache\srv.sys 2008-10-15 06:25 . 2008-08-14 15:26 2,190,464 --------- C:\WINDOWS\system32\dllcache\ntoskrnl.exe 2008-10-15 06:25 . 2008-08-14 15:26 2,146,816 --------- C:\WINDOWS\system32\dllcache\ntkrnlmp.exe 2008-10-15 06:25 . 2008-08-14 15:26 2,067,328 --------- C:\WINDOWS\system32\dllcache\ntkrnlpa.exe 2008-10-15 06:25 . 2008-08-14 15:26 2,025,472 --------- C:\WINDOWS\system32\dllcache\ntkrpamp.exe 2008-10-14 13:10 . 2008-10-14 13:11 <DIR> d-------- C:\Documents and Settings\Stryju\Dane aplikacji\Tibia 2008-10-12 11:41 . 2008-10-12 11:41 <DIR> d-------- C:\Program Files\Hamachi 2008-10-12 11:41 . 2008-10-12 12:38 <DIR> d-------- C:\Documents and Settings\Stryju\Dane aplikacji\Hamachi 2008-10-12 11:41 . 2008-10-12 11:41 25,280 --a------ C:\WINDOWS\system32\drivers\hamachi.sys 2008-10-12 10:51 . 2008-10-12 10:51 <DIR> d-------- C:\Program Files\K-Lite Codec Pack 2008-10-12 10:51 . 2008-01-10 13:15 755,027 --a------ C:\WINDOWS\system32\xvidcore.dll 2008-10-12 10:51 . 2007-09-04 17:56 164,352 --a------ C:\WINDOWS\system32\unrar.dll 2008-10-12 10:36 . 2008-10-12 11:41 <DIR> d-------- C:\Temp 2008-10-12 10:35 . 2008-10-12 10:35 <DIR> d-------- C:\Program Files\Magicbit 2008-10-12 08:52 . 2008-04-14 00:15 10,368 --a------ C:\WINDOWS\system32\drivers\hidusb.sys 2008-10-10 16:43 . 2008-10-10 16:42 101,500 -r-hs---- C:\[u]0[/u]8dgu.com 2008-10-09 16:56 . 2008-10-13 17:04 <DIR> d-------- C:\Program Files\eMule 2008-10-09 16:27 . 2008-10-13 17:07 <DIR> d-------- C:\Program Files\Ares 2008-10-07 21:45 . 2008-10-07 21:50 <DIR> d-------- C:\Documents and Settings\Stryju\Dane aplikacji\gtk-2.0 2008-10-07 21:41 . 2008-10-07 21:41 <DIR> d-------- C:\Documents and Settings\Stryju\.thumbnails 2008-10-07 21:40 . 2008-10-07 21:40 <DIR> d-------- C:\Program Files\Gimp-2.0 2008-10-07 21:40 . 2008-10-07 21:59 <DIR> d-------- C:\Documents and Settings\Stryju\.gimp-2.6 2008-10-07 21:40 . 2008-10-07 21:40 <DIR> d-------- C:\Documents and Settings\Stryju\.gegl-0.0 2008-09-28 10:44 . 2008-09-28 10:44 <DIR> d-------- C:\Documents and Settings\Stryju\Dane aplikacji\Disney Interactive Studios 2008-09-28 10:31 . 2008-09-28 10:31 <DIR> d-------- C:\WINDOWS\Logs 2008-09-26 21:46 . 2008-09-26 21:46 <DIR> d-------- C:\Program Files\Audacity 2008-09-26 20:03 . 2008-09-26 20:03 <DIR> d-------- C:\WINDOWS\system32\LogFiles 2008-09-26 19:26 . 2008-09-26 19:26 <DIR> d-------- C:\Program Files\Real Alternative 2008-09-26 19:26 . 2008-09-26 19:26 <DIR> d-------- C:\Program Files\Media Player Classic 2008-09-26 19:26 . 2008-09-26 19:26 <DIR> d-------- C:\Documents and Settings\Stryju\Dane aplikacji\Media Player Classic 2008-09-26 16:00 . 2008-10-17 17:53 <DIR> d-------- C:\Program Files\MoorHunt 2008-09-26 15:13 . 2008-09-26 15:13 <DIR> d--hs---- C:\WINDOWS\ftpcache 2008-09-26 00:50 . 2008-09-26 00:50 <DIR> d-------- C:\Program Files\MSXML 4.0 2008-09-25 23:12 . 2008-09-25 23:12 <DIR> d-------- C:\Program Files\QuickTime 2008-09-25 23:12 . 2008-09-25 23:12 <DIR> d-------- C:\Program Files\iTunes 2008-09-25 23:12 . 2008-09-25 23:12 <DIR> d-------- C:\Program Files\iPod 2008-09-25 23:12 . 2008-09-25 23:12 <DIR> d-------- C:\Program Files\Bonjour 2008-09-25 23:12 . 2008-09-26 14:31 <DIR> d-------- C:\Documents and Settings\Stryju\Dane aplikacji\Apple Computer 2008-09-25 23:12 . 2008-09-25 23:12 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Apple Computer 2008-09-25 23:12 . 2008-09-25 23:12 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\{3276BE95_AF08_429F_A64F_CA64CB79BCF6} 2008-09-25 23:12 . 2008-04-17 13:12 107,368 --a------ C:\WINDOWS\system32\GEARAspi.dll 2008-09-25 23:12 . 2008-04-17 13:12 15,464 --a------ C:\WINDOWS\system32\drivers\GEARAspiWDM.sys 2008-09-25 23:11 . 2008-09-25 23:12 <DIR> d-------- C:\Program Files\Common Files\Apple 2008-09-25 23:11 . 2008-09-25 23:11 <DIR> d-------- C:\Program Files\Apple Software Update 2008-09-25 23:11 . 2008-09-25 23:11 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Apple 2008-09-25 17:03 . 2008-09-28 10:41 107,888 --a------ C:\WINDOWS\system32\CmdLineExt.dll 2008-09-25 16:48 . 2008-10-14 12:41 69 --a------ C:\WINDOWS\NeroDigital.ini 2008-09-25 11:33 . 2008-10-13 15:40 <DIR> d-------- C:\Program Files\DAEMON Tools Lite 2008-09-25 11:32 . 2008-09-25 11:32 0 --a------ C:\WINDOWS\ativpsrm.bin 2008-09-25 11:31 . 2008-09-25 11:31 <DIR> d-------- C:\Documents and Settings\Stryju\Dane aplikacji\Gadu-Gadu 2008-09-25 11:31 . 2008-09-25 11:31 <DIR> d-------- C:\Documents and Settings\Stryju\Dane aplikacji\DAEMON Tools 2008-09-25 11:31 . 2008-09-25 11:31 717,296 --a------ C:\WINDOWS\system32\drivers\sptd.sys 2008-09-25 11:28 . 2008-09-25 11:28 664 --a------ C:\WINDOWS\system32\d3d9caps.dat 2008-09-25 03:13 . 2008-06-14 19:36 273,024 --------- C:\WINDOWS\system32\drivers\bthport.sys 2008-09-25 03:13 . 2008-06-14 19:36 273,024 --------- C:\WINDOWS\system32\dllcache\bthport.sys 2008-09-25 03:12 . 2008-05-27 19:26 765,952 --------- C:\WINDOWS\system32\dllcache\vgx.dll 2008-09-25 03:12 . 2008-05-08 16:02 203,136 --------- C:\WINDOWS\system32\dllcache\rmcast.sys 2008-09-25 03:09 . 2008-04-11 21:06 691,712 --------- C:\WINDOWS\system32\dllcache\inetcomm.dll 2008-09-25 03:00 . 2005-06-28 10:21 22,752 --a------ C:\WINDOWS\system32\spupdsvc.exe 2008-09-25 01:29 . 2008-09-25 01:29 <DIR> d-------- C:\Documents and Settings\Stryju\Dane aplikacji\Nero 2008-09-25 01:27 . 2008-09-25 01:27 <DIR> d-------- C:\Program Files\Nero 2008-09-25 01:27 . 2008-09-25 01:28 <DIR> d-------- C:\Program Files\Common Files\Nero 2008-09-25 01:27 . 2008-09-25 01:27 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Nero 2008-09-24 23:52 . 2008-05-01 16:37 331,776 --------- C:\WINDOWS\system32\dllcache\msadce.dll 2008-09-24 23:19 . 2008-09-24 23:19 <DIR> d-------- C:\Documents and Settings\Stryju\Gadu-Gadu . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-10-03 17:26 6,066,176 ------w C:\WINDOWS\system32\dllcache\ieframe.dll 2008-09-26 14:00 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-09-25 16:46 --------- d-----w C:\Documents and Settings\Stryju\Dane aplikacji\Ventrilo 2008-09-25 11:46 --------- d-----w C:\Program Files\Realtek 2008-09-24 22:21 --------- d-----w C:\Program Files\Ventrilo 2008-09-24 22:20 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard 2008-09-24 22:19 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Microsoft Help 2008-09-24 22:18 --------- d-----w C:\Program Files\MSBuild 2008-09-24 22:18 --------- d-----w C:\Program Files\Microsoft Works 2008-09-24 22:01 --------- d-----w C:\Program Files\Common Files\InstallShield 2008-09-24 21:53 --------- d-----w C:\Program Files\Intel 2008-09-24 21:49 319,488 ----a-w C:\WINDOWS\HideWin.exe 2008-09-24 21:19 --------- d-----w C:\Program Files\Gadu-Gadu 2008-09-24 20:33 --------- d-----w C:\Program Files\Usługi online 2008-09-24 20:31 --------- d-----w C:\Program Files\Windows Media Connect 2 2008-09-15 15:27 1,846,656 ----a-w C:\WINDOWS\system32\win32k.sys 2008-09-08 10:41 333,824 ----a-w C:\WINDOWS\system32\drivers\srv.sys 2008-08-29 08:18 87,336 ----a-w C:\WINDOWS\system32\dns-sd.exe 2008-08-29 07:53 61,440 ----a-w C:\WINDOWS\system32\dnssd.dll 2008-08-27 09:27 3,593,216 ------w C:\WINDOWS\system32\dllcache\mshtml.dll 2008-08-26 08:27 826,368 ----a-w C:\WINDOWS\system32\wininet.dll 2008-08-26 08:27 826,368 ------w C:\WINDOWS\system32\dllcache\wininet.dll 2008-08-26 08:27 671,232 ------w C:\WINDOWS\system32\dllcache\mstime.dll 2008-08-26 08:27 477,696 ------w C:\WINDOWS\system32\dllcache\mshtmled.dll 2008-08-26 08:27 44,544 ------w C:\WINDOWS\system32\dllcache\pngfilt.dll 2008-08-26 08:27 233,472 ------w C:\WINDOWS\system32\dllcache\webcheck.dll 2008-08-26 08:27 193,024 ------w C:\WINDOWS\system32\dllcache\msrating.dll 2008-08-26 08:27 105,984 ------w C:\WINDOWS\system32\dllcache\url.dll 2008-08-26 08:27 102,912 ------w C:\WINDOWS\system32\dllcache\occache.dll 2008-08-26 08:27 1,159,680 ------w C:\WINDOWS\system32\dllcache\urlmon.dll 2008-08-25 08:42 70,656 ------w C:\WINDOWS\system32\dllcache\ie4uinit.exe 2008-08-25 08:38 13,824 ------w C:\WINDOWS\system32\dllcache\ieudinit.exe 2008-08-23 05:56 635,848 ------w C:\WINDOWS\system32\dllcache\iexplore.exe 2008-08-23 05:54 161,792 ------w C:\WINDOWS\system32\dllcache\ieakui.dll 2008-08-21 04:52 3,299,840 ----a-w C:\WINDOWS\system32\drivers\ati2mtag.sys 2008-08-21 02:19 425,984 ----a-w C:\WINDOWS\system32\ATIDEMGX.dll 2008-08-21 02:18 314,880 ----a-w C:\WINDOWS\system32\ati2dvag.dll 2008-08-21 02:08 184,320 ----a-w C:\WINDOWS\system32\atipdlxx.dll 2008-08-21 02:08 143,360 ----a-w C:\WINDOWS\system32\Oemdspif.dll 2008-08-21 02:07 43,520 ----a-w C:\WINDOWS\system32\ati2edxx.dll 2008-08-21 02:07 26,112 ----a-w C:\WINDOWS\system32\Ati2mdxx.exe 2008-08-21 02:07 143,360 ----a-w C:\WINDOWS\system32\ati2evxx.dll 2008-08-21 02:05 573,440 ----a-w C:\WINDOWS\system32\ati2evxx.exe 2008-08-21 02:04 53,248 ----a-w C:\WINDOWS\system32\ATIDDC.DLL 2008-08-21 02:01 10,084,352 ----a-w C:\WINDOWS\system32\atioglxx.dll 2008-08-21 01:55 4,094,560 ----a-w C:\WINDOWS\system32\ati3duag.dll 2008-08-21 01:50 307,200 ----a-w C:\WINDOWS\system32\atiiiexx.dll 2008-08-21 01:38 2,377,856 ----a-w C:\WINDOWS\system32\ativvaxx.dll 2008-08-21 01:23 48,640 ----a-w C:\WINDOWS\system32\amdpcom32.dll 2008-08-21 01:19 380,928 ----a-w C:\WINDOWS\system32\atikvmag.dll 2008-08-21 01:18 37,376 ----a-w C:\WINDOWS\system32\atiadlxx.dll 2008-08-21 01:18 17,408 ----a-w C:\WINDOWS\system32\atitvo32.dll 2008-08-21 01:17 53,248 ----a-w C:\WINDOWS\system32\drivers\ati2erec.dll 2008-08-21 01:17 253,952 ----a-w C:\WINDOWS\system32\atiok3x2.dll 2008-08-21 01:11 561,152 ----a-w C:\WINDOWS\system32\ati2cqag.dll 2008-08-20 19:05 593,920 ------w C:\WINDOWS\system32\ati2sgag.exe 2008-08-14 13:26 2,146,816 ----a-w C:\WINDOWS\system32\ntoskrnl.exe 2008-08-14 13:26 2,025,472 ----a-w C:\WINDOWS\system32\ntkrnlpa.exe 2008-08-14 10:04 138,496 ------w C:\WINDOWS\system32\dllcache\afd.sys 2008-08-05 21:14 90,112 ----a-w C:\WINDOWS\system32\ATIBRTMON.EXE 2008-07-31 08:41 68,616 ----a-w C:\WINDOWS\system32\XAPOFX1_1.dll 2008-07-31 08:41 238,088 ----a-w C:\WINDOWS\system32\xactengine3_2.dll 2008-07-31 08:40 509,448 ----a-w C:\WINDOWS\system32\XAudio2_2.dll 2008-07-23 14:51 16,804,864 ----a-w C:\WINDOWS\RTHDCPL.exe 2008-07-18 20:10 94,920 ----a-w C:\WINDOWS\system32\cdm.dll 2008-07-18 20:10 53,448 ----a-w C:\WINDOWS\system32\wuauclt.exe 2008-07-18 20:10 45,768 ----a-w C:\WINDOWS\system32\wups2.dll 2008-07-18 20:10 36,552 ----a-w C:\WINDOWS\system32\wups.dll 2008-07-18 20:09 563,912 ----a-w C:\WINDOWS\system32\wuapi.dll 2008-07-18 20:09 325,832 ----a-w C:\WINDOWS\system32\wucltui.dll 2008-07-18 20:09 205,000 ----a-w C:\WINDOWS\system32\wuweb.dll 2008-07-18 20:09 1,811,656 ----a-w C:\WINDOWS\system32\wuaueng.dll . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2008-04-14 15360] "IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" [2008-06-24 1840424] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "GrooveMonitor"="C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-27 31016] "NeroFilterCheck"="C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe" [2008-06-19 570664] "NBKeyScan"="C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" [2008-06-08 2221352] "QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-09-06 413696] "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-09-10 289576] "RTHDCPL"="RTHDCPL.EXE" [2008-07-23 C:\WINDOWS\RTHDCPL.exe] "SoundMan"="SOUNDMAN.EXE" [2008-06-18 C:\WINDOWS\SoundMan.exe] "AlcWzrd"="ALCWZRD.EXE" [2008-06-19 C:\WINDOWS\alcwzrd.exe] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2008-04-14 15360] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce] "nltide_2"="shell32" [X] "nltide_3"="advpack.dll" [2008-08-26 C:\WINDOWS\system32\advpack.dll] [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "%windir%\\system32\\sessmgr.exe"= "C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"= "C:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"= "C:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"= "D:\\Steam\\SteamApps\\10112000\\counter-strike\\hl.exe"= "C:\\Program Files\\Bonjour\\mDNSResponder.exe"= "C:\\Program Files\\iTunes\\iTunes.exe"= "D:\\Steam\\SteamApps\\10112000\\half-life 2 deathmatch\\hl2.exe"= "D:\\Steam\\SteamApps\\10112000\\insurgency\\hl2.exe"= "D:\\Steam\\SteamApps\\10112000\\team fortress 2\\hl2.exe"= "D:\\Steam\\SteamApps\\10112000\\synergy\\hl2.exe"= "C:\\Program Files\\eMule\\emule.exe"= "C:\\Program Files\\Mozilla Firefox\\Steamcrackv0.13.exe"= "C:\\Program Files\\Ares\\Ares.exe"= "D:\\FIFA 09\\FIFA09.exe"= "D:\\Steam\\SteamApps\\10112000\\half-life\\hl.exe"= "C:\\Program Files\\Gadu-Gadu\\gg.exe"= "D:\\duke3d\\eduke32.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "4662:TCP"= 4662:TCP:4662 "4662:UDP"= 4662:UDP:4662 R3 SG762_XP;SAGEM 802.11g XG762 1211B Driver;C:\WINDOWS\system32\DRIVERS\WlanBZXP.sys [2007-01-16 450560] S3 athrusb;Atheros Wireless LAN USB device driver;C:\WINDOWS\system32\DRIVERS\athrusb.sys [2006-12-22 449536] S3 se46bus;Sony Ericsson Device 070 driver (WDM);C:\WINDOWS\system32\DRIVERS\se46bus.sys [2006-07-25 61536] S3 se46mdfl;Sony Ericsson Device 070 USB WMC Modem Filter;C:\WINDOWS\system32\DRIVERS\se46mdfl.sys [2006-07-25 9360] S3 se46mdm;Sony Ericsson Device 070 USB WMC Modem Driver;C:\WINDOWS\system32\DRIVERS\se46mdm.sys [2006-07-25 97088] S3 se46mgmt;Sony Ericsson Device 070 USB WMC Device Management Drivers (WDM);C:\WINDOWS\system32\DRIVERS\se46mgmt.sys [2006-07-25 88624] S3 se46nd5;Sony Ericsson Device 070 USB Ethernet Emulation SEMC46 (NDIS);C:\WINDOWS\system32\DRIVERS\se46nd5.sys [2006-07-25 18704] S3 se46obex;Sony Ericsson Device 070 USB WMC OBEX Interface;C:\WINDOWS\system32\DRIVERS\se46obex.sys [2006-07-25 86432] S3 se46unic;Sony Ericsson Device 070 USB Ethernet Emulation SEMC46 (WDM);C:\WINDOWS\system32\DRIVERS\se46unic.sys [2006-07-25 90800] S3 ZDCndis5;ZDCndis5 Protocol Driver;C:\WINDOWS\system32\ZDCndis5.SYS [ ] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\C] \Shell\AutoRun\command - C:\2fiji.com \Shell\explore\Command - C:\2fiji.com \Shell\open\Command - C:\2fiji.com [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\D] \Shell\AutoRun\command - D:\2fiji.com \Shell\explore\Command - D:\2fiji.com \Shell\open\Command - D:\2fiji.com [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\E] \Shell\AutoRun\command - E:\2fiji.com \Shell\explore\Command - E:\2fiji.com \Shell\open\Command - E:\2fiji.com [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\G] \Shell\AutoRun\command - G:\AutoRunMorrowind.exe \Shell\install\command - G:\Setup.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a41db5ba-8c6c-11dd-8327-0060b306c920}] \Shell\AutoRun\command - F:\bo1dhu.bat \Shell\explore\Command - F:\bo1dhu.bat \Shell\open\Command - F:\bo1dhu.bat [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a41db5bb-8c6c-11dd-8327-0060b306c920}] \Shell\AutoRun\command - J:\bo1dhu.bat \Shell\explore\Command - J:\bo1dhu.bat \Shell\open\Command - J:\bo1dhu.bat [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{ac94e0b0-8ba8-11dd-8326-0060b306c920}] \Shell\AutoRun\command - F:\bo1dhu.bat \Shell\explore\Command - F:\bo1dhu.bat \Shell\open\Command - F:\bo1dhu.bat [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{ac94e0b1-8ba8-11dd-8326-0060b306c920}] \Shell\AutoRun\command - K:\bo1dhu.bat \Shell\explore\Command - K:\bo1dhu.bat \Shell\open\Command - K:\bo1dhu.bat [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{ba380b56-8a86-11dd-9898-806d6172696f}] \Shell\AutoRun\command - F:\wjlfhtfm.cmd \Shell\explore\Command - F:\wjlfhtfm.cmd \Shell\open\Command - F:\wjlfhtfm.cmd . Zawartość folderu 'Zaplanowane zadania' 2008-09-25 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job - C:\Program Files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 12:34] . - - - - USUNIĘTO PUSTE WPISY - - - - HKCU-Run-kamsoft - C:\WINDOWS\system32\ckvo.exe . ------- Skan uzupełniający ------- . FireFox -: Profile - C:\Documents and Settings\Stryju\Dane aplikacji\Mozilla\Firefox\Profiles\5vh9l5yk.default\ FF -: plugin - C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-10-18 17:23:25 Windows 5.1.2600 Dodatek Service Pack 3 NTFS skanowanie ukrytych procesów ... skanowanie ukrytych wpisów autostartu ... skanowanie ukrytych plików ... skanowanie pomyślnie ukończone ukryte pliki: 0 ************************************************************************** . ------------------------ Pozostałe uruchomione procesy ------------------------ . C:\WINDOWS\system32\ati2evxx.exe C:\WINDOWS\system32\ati2evxx.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe C:\WINDOWS\system32\IoctlSvc.exe C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe C:\Program Files\iPod\bin\iPodService.exe C:\WINDOWS\system32\wscntfy.exe . ************************************************************************** . Czas ukończenia: 2008-10-18 17:24:22 - komputer został uruchomiony ponownie [Stryju] ComboFix-quarantined-files.txt 2008-10-18 15:24:19 Przed: 12,602,032,128 bajtów wolnych Po: 12,646,981,632 bajtów wolnych 328 --- E O F --- 2008-10-15 05:20:18

Kod: Zaznacz wszystko: [b]SDFix: Version 1.236 [/b] Run by Stryju on 2008-10-18 at 17:12 Microsoft Windows XP [Wersja 5.1.2600] Running From: C:\SDFix [b]Checking Services [/b]: Restoring Default Security Values Restoring Default Hosts File Rebooting [b]Checking Files [/b]: Trojan Files Found: C:\autorun.inf - Deleted Removing Temp Files [b]ADS Check [/b]: [b]Final Check [/b]: catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-10-18 17:18:14 Windows 5.1.2600 Dodatek Service Pack 3 NTFS scanning hidden processes ... scanning hidden services & system hive ... [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg] "s1"=dword:2df9c43f "s2"=dword:110480d0 "h0"=dword:00000001 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4] "p0"="C:\Program Files\DAEMON Tools Lite\" "h0"=dword:00000000 "khjeh"=hex:dd,0a,0d,2d,82,26,29,86,6f,ec,81,8b,94,35,c7,4d,ce,6d,ce,69,a6,.. [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001] "a0"=hex:20,01,00,00,11,24,6b,8e,5f,f5,90,52,79,3e,56,58,8f,3f,62,62,b7,.. "khjeh"=hex:9e,2f,67,1a,24,17,a6,ed,f2,c4,1a,4d,8b,f8,4e,68,79,a1,a4,fe,d4,.. [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40] "khjeh"=hex:3c,60,44,ae,6e,87,08,0b,47,75,4e,d2,c6,81,6c,fb,68,c9,fb,c0,9e,.. [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41] "khjeh"=hex:4c,24,cd,b3,22,7b,d5,7c,d5,c6,7a,b7,4a,3d,b7,a6,8c,fc,fb,f2,d7,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4] "p0"="C:\Program Files\DAEMON Tools Lite\" "h0"=dword:00000000 "khjeh"=hex:dd,0a,0d,2d,82,26,29,86,6f,ec,81,8b,94,35,c7,4d,ce,6d,ce,69,a6,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001] "a0"=hex:20,01,00,00,11,24,6b,8e,5f,f5,90,52,79,3e,56,58,8f,3f,62,62,b7,.. "khjeh"=hex:9e,2f,67,1a,24,17,a6,ed,f2,c4,1a,4d,8b,f8,4e,68,79,a1,a4,fe,d4,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40] "khjeh"=hex:3c,60,44,ae,6e,87,08,0b,47,75,4e,d2,c6,81,6c,fb,68,c9,fb,c0,9e,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41] "khjeh"=hex:4c,24,cd,b3,22,7b,d5,7c,d5,c6,7a,b7,4a,3d,b7,a6,8c,fc,fb,f2,d7,.. scanning hidden registry entries ... [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] "AppInit_DLLs"="" "DeviceNotSelectedTimeout"="15" "GDIProcessHandleQuota"=dword:00002710 "Spooler"="yes" "swapdisk"="" "TransmissionRetryTimeout"="90" "USERProcessHandleQuota"=dword:00002710 scanning hidden files ... scan completed successfully hidden processes: 0 hidden services: 0 hidden files: 0 [b]Remaining Services [/b]: Authorized Application Key Export: [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] "%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000" "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"="C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook" "C:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"="C:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE:*:Enabled:Microsoft Office Groove" "C:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"="C:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE:*:Enabled:Microsoft Office OneNote" "D:\\Steam\\SteamApps\\10112000\\counter-strike\\hl.exe"="D:\\Steam\\SteamApps\\10112000\\counter-strike\\hl.exe:*:Enabled:Half-Life Launcher" "C:\\Program Files\\Bonjour\\mDNSResponder.exe"="C:\\Program Files\\Bonjour\\mDNSResponder.exe:*:Enabled:Bonjour" "C:\\Program Files\\iTunes\\iTunes.exe"="C:\\Program Files\\iTunes\\iTunes.exe:*:Enabled:iTunes" "D:\\Steam\\SteamApps\\10112000\\half-life 2 deathmatch\\hl2.exe"="D:\\Steam\\SteamApps\\10112000\\half-life 2 deathmatch\\hl2.exe:*:Enabled:hl2" "D:\\Steam\\SteamApps\\10112000\\insurgency\\hl2.exe"="D:\\Steam\\SteamApps\\10112000\\insurgency\\hl2.exe:*:Enabled:hl2" "D:\\Steam\\SteamApps\\10112000\\team fortress 2\\hl2.exe"="D:\\Steam\\SteamApps\\10112000\\team fortress 2\\hl2.exe:*:Enabled:hl2" "D:\\Steam\\SteamApps\\10112000\\synergy\\hl2.exe"="D:\\Steam\\SteamApps\\10112000\\synergy\\hl2.exe:*:Enabled:hl2" "C:\\Program Files\\eMule\\emule.exe"="C:\\Program Files\\eMule\\emule.exe:*:Enabled:eMule" "C:\\Program Files\\Mozilla Firefox\\Steamcrackv0.13.exe"="C:\\Program Files\\Mozilla Firefox\\Steamcrackv0.13.exe:*:Enabled:Steamcrackv0.13" "C:\\Program Files\\Ares\\Ares.exe"="C:\\Program Files\\Ares\\Ares.exe:*:Enabled:Ares p2p for windows" "D:\\FIFA 09\\FIFA09.exe"="D:\\FIFA 09\\FIFA09.exe:*:Enabled:FIFA09" "D:\\Steam\\SteamApps\\10112000\\half-life\\hl.exe"="D:\\Steam\\SteamApps\\10112000\\half-life\\hl.exe:*:Enabled:Half-Life Launcher" "C:\\Program Files\\Gadu-Gadu\\gg.exe"="C:\\Program Files\\Gadu-Gadu\\gg.exe:*:Enabled:Gadu-Gadu - program główny" "D:\\duke3d\\eduke32.exe"="D:\\duke3d\\eduke32.exe:*:Enabled:eduke32" [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list] "%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000" "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" [b]Remaining Files [/b]: File Backups: - C:\SDFix\backups\backups.zip [b]Files with Hidden Attributes [/b]: Fri 10 Oct 2008 101,500 ..SHR --- "C:\08dgu.com" Sat 18 Oct 2008 104,758 ..SHR --- "C:\2fiji.com" Mon 13 Oct 2008 105,503 ..SHR --- "C:\68.exe" Tue 7 Oct 2008 100,569 ..SHR --- "C:\itsduel.exe" Sat 18 Oct 2008 104,758 ..SHR --- "C:\WINDOWS\system32\ckvo.exe" Sat 18 Oct 2008 85,504 ..SHR --- "C:\WINDOWS\system32\ckvo0.dll" Sat 18 Oct 2008 85,504 ..SHR --- "C:\WINDOWS\system32\ckvo1.dll" Thu 9 Oct 2008 4,348 A.SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak" Thu 9 Oct 2008 0 A.SH. --- "C:\Documents and Settings\All Users\DRM\Cache\Indiv01.tmp" Fri 26 Sep 2008 3,010,560 A..H. --- "C:\Documents and Settings\Stryju\Ustawienia lokalne\Temp\dotnetfx3521022.08\1033\dotnetfx20\BIT19B.tmp" [b]Finished![/b]

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 17:24:46, on 2008-10-18 Platform: Windows XP Dodatek SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16735) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\RTHDCPL.EXE C:\WINDOWS\SOUNDMAN.EXE C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\iTunes\iTunesHelper.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe C:\WINDOWS\system32\IoctlSvc.exe C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe C:\Program Files\iPod\bin\iPodService.exe C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\system32\wuauclt.exe C:\WINDOWS\explorer.exe C:\WINDOWS\system32\notepad.exe C:\WINDOWS\system32\wuauclt.exe C:\WINDOWS\system32\NOTEPAD.EXE C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.microsoft.com/fwlink/?LinkId=74005 R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~1\Office12\GRA8E1~1.DLL O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [AlcWzrd] ALCWZRD.EXE O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" ASO-616B5711-6DAE-4795-A05F-39A1E5104020 O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-19\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-20\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'Default user') O8 - Extra context menu item: E&ksportuj do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~1\Office12\EXCEL.EXE/3000 O9 - Extra button: Wyślij do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~1\Office12\ONBttnIE.dll O9 - Extra 'Tools' menuitem: Wyślij &do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~1\Office12\ONBttnIE.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~1\Office12\REFIEBAR.DLL O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O17 - HKLM\System\CCS\Services\Tcpip\..\{E618FA5A-CA91-4740-A425-EF93A021E1B8}: NameServer = 194.204.159.1,194.204.152.34 O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~1\Office12\GR99D3~1.DLL O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: Ares Chatroom server (AresChatServer) - Ares Development Group - C:\Program Files\Ares\chatServer.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: Usługa iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe O23 - Service: PLFlash DeviceIoControl Service - Prolific Technology Inc. - C:\WINDOWS\system32\IoctlSvc.exe -- End of file - 5818 bytes

**Posty:** 18165 · przez **wojtas** 18 Paź 2008, 17:35

Otworz notatnik i wklej w nim to:

File::
C:\2fiji.com
C:\08dgu.com
C:\08dgu.com"
C:\2fiji.com"
C:\68.exe"
C:\itsduel.exe"
C:\WINDOWS\system32\ckvo.exe
C:\WINDOWS\system32\ckvo0.dll
C:\WINDOWS\system32\ckvo1.dll

Registry::
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\C]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\D]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\E]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a41db5ba-8c6c-11dd-8327-0060b306c920}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a41db5bb-8c6c-11dd-8327-0060b306c920}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{ac94e0b0-8ba8-11dd-8326-0060b306c920}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{ac94e0b1-8ba8-11dd-8326-0060b306c920}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{ba380b56-8a86-11dd-9898-806d6172696f}]

>>Plik>>Zapisz jako... >>> CFScript
Przeciągnij i upuść plik CFScript.txt na plik ComboFix.exe
-->

Ma się rozpocząć usuwanie. (i powstanie log).Daj ten log, który powstanie w trakcie usuwania.

**Posty:** 66 · przez **stryju** 18 Paź 2008, 17:54

Kod: Zaznacz wszystko: ComboFix 08-10-17.01 - Stryju 2008-10-18 17:50:56.2 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.3.1250.1.1045.18.1520 [GMT 2:00] Uruchomiony z: C:\Documents and Settings\Stryju\Pulpit\ComboFix.exe Użyto następujących komend :: C:\Documents and Settings\Stryju\Pulpit\CFScript.txt * Utworzono nowy punkt przywracania [COLOR=RED][B]UWAGA - TEN KOMPUTER NIE MA ZAINSTALOWANEJ KONSOLI ODZYSKIWANIA !![/B][/COLOR] FILE :: C:\[u]0[/u]8dgu.com C:\[u]0[/u]8dgu.com" C:\2fiji.com C:\2fiji.com" C:\68.exe" C:\itsduel.exe" C:\WINDOWS\system32\ckvo.exe C:\WINDOWS\system32\ckvo0.dll C:\WINDOWS\system32\ckvo1.dll . ((((((((((((((((((((((((((((((((((((((( Usunięto ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\[u]0[/u]8dgu.com C:\2fiji.com . ((((((((((((((((((((((((( Pliki utworzone od 2008-09-18 do 2008-10-18 ))))))))))))))))))))))))))))))) . 2008-10-18 17:14 . 2008-10-18 17:14 <DIR> d-------- C:\WINDOWS\system32\xircom 2008-10-18 17:14 . 2008-10-18 17:14 <DIR> d-------- C:\Program Files\microsoft frontpage 2008-10-18 17:12 . 2008-10-18 17:12 580,096 --a------ C:\WINDOWS\system32\dllcache\user32.dll 2008-10-18 17:11 . 2008-10-18 17:11 <DIR> d-------- C:\WINDOWS\ERUNT 2008-10-18 17:08 . 2008-10-18 17:19 <DIR> d-------- C:\SDFix 2008-10-18 16:01 . 2008-10-18 16:01 <DIR> d-------- C:\Program Files\Trend Micro 2008-10-16 20:06 . 2008-10-16 20:06 <DIR> d-------- C:\Program Files\Teamspeak2_RC2 2008-10-16 20:06 . 2008-10-16 20:06 <DIR> d-------- C:\Documents and Settings\Stryju\Dane aplikacji\teamspeak2 2008-10-16 20:06 . 2008-10-16 20:06 34,064 --a------ C:\WINDOWS\system32\lhacm.acm 2008-10-15 06:26 . 2008-09-15 17:27 1,846,656 --------- C:\WINDOWS\system32\dllcache\win32k.sys 2008-10-15 06:26 . 2008-09-08 12:41 333,824 --------- C:\WINDOWS\system32\dllcache\srv.sys 2008-10-15 06:25 . 2008-08-14 15:26 2,190,464 --------- C:\WINDOWS\system32\dllcache\ntoskrnl.exe 2008-10-15 06:25 . 2008-08-14 15:26 2,146,816 --------- C:\WINDOWS\system32\dllcache\ntkrnlmp.exe 2008-10-15 06:25 . 2008-08-14 15:26 2,067,328 --------- C:\WINDOWS\system32\dllcache\ntkrnlpa.exe 2008-10-15 06:25 . 2008-08-14 15:26 2,025,472 --------- C:\WINDOWS\system32\dllcache\ntkrpamp.exe 2008-10-14 13:10 . 2008-10-14 13:11 <DIR> d-------- C:\Documents and Settings\Stryju\Dane aplikacji\Tibia 2008-10-12 11:41 . 2008-10-12 11:41 <DIR> d-------- C:\Program Files\Hamachi 2008-10-12 11:41 . 2008-10-12 12:38 <DIR> d-------- C:\Documents and Settings\Stryju\Dane aplikacji\Hamachi 2008-10-12 11:41 . 2008-10-12 11:41 25,280 --a------ C:\WINDOWS\system32\drivers\hamachi.sys 2008-10-12 10:51 . 2008-10-12 10:51 <DIR> d-------- C:\Program Files\K-Lite Codec Pack 2008-10-12 10:51 . 2008-01-10 13:15 755,027 --a------ C:\WINDOWS\system32\xvidcore.dll 2008-10-12 10:51 . 2007-09-04 17:56 164,352 --a------ C:\WINDOWS\system32\unrar.dll 2008-10-12 10:36 . 2008-10-12 11:41 <DIR> d-------- C:\Temp 2008-10-12 10:35 . 2008-10-12 10:35 <DIR> d-------- C:\Program Files\Magicbit 2008-10-12 08:52 . 2008-04-14 00:15 10,368 --a------ C:\WINDOWS\system32\drivers\hidusb.sys 2008-10-09 16:56 . 2008-10-13 17:04 <DIR> d-------- C:\Program Files\eMule 2008-10-09 16:27 . 2008-10-13 17:07 <DIR> d-------- C:\Program Files\Ares 2008-10-07 21:45 . 2008-10-07 21:50 <DIR> d-------- C:\Documents and Settings\Stryju\Dane aplikacji\gtk-2.0 2008-10-07 21:41 . 2008-10-07 21:41 <DIR> d-------- C:\Documents and Settings\Stryju\.thumbnails 2008-10-07 21:40 . 2008-10-07 21:40 <DIR> d-------- C:\Program Files\Gimp-2.0 2008-10-07 21:40 . 2008-10-07 21:59 <DIR> d-------- C:\Documents and Settings\Stryju\.gimp-2.6 2008-10-07 21:40 . 2008-10-07 21:40 <DIR> d-------- C:\Documents and Settings\Stryju\.gegl-0.0 2008-09-28 10:44 . 2008-09-28 10:44 <DIR> d-------- C:\Documents and Settings\Stryju\Dane aplikacji\Disney Interactive Studios 2008-09-28 10:31 . 2008-09-28 10:31 <DIR> d-------- C:\WINDOWS\Logs 2008-09-26 21:46 . 2008-09-26 21:46 <DIR> d-------- C:\Program Files\Audacity 2008-09-26 20:03 . 2008-09-26 20:03 <DIR> d-------- C:\WINDOWS\system32\LogFiles 2008-09-26 19:26 . 2008-09-26 19:26 <DIR> d-------- C:\Program Files\Real Alternative 2008-09-26 19:26 . 2008-09-26 19:26 <DIR> d-------- C:\Program Files\Media Player Classic 2008-09-26 19:26 . 2008-09-26 19:26 <DIR> d-------- C:\Documents and Settings\Stryju\Dane aplikacji\Media Player Classic 2008-09-26 16:00 . 2008-10-17 17:53 <DIR> d-------- C:\Program Files\MoorHunt 2008-09-26 15:13 . 2008-09-26 15:13 <DIR> d--hs---- C:\WINDOWS\ftpcache 2008-09-26 00:50 . 2008-09-26 00:50 <DIR> d-------- C:\Program Files\MSXML 4.0 2008-09-25 23:12 . 2008-09-25 23:12 <DIR> d-------- C:\Program Files\QuickTime 2008-09-25 23:12 . 2008-09-25 23:12 <DIR> d-------- C:\Program Files\iTunes 2008-09-25 23:12 . 2008-09-25 23:12 <DIR> d-------- C:\Program Files\iPod 2008-09-25 23:12 . 2008-09-25 23:12 <DIR> d-------- C:\Program Files\Bonjour 2008-09-25 23:12 . 2008-09-26 14:31 <DIR> d-------- C:\Documents and Settings\Stryju\Dane aplikacji\Apple Computer 2008-09-25 23:12 . 2008-09-25 23:12 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Apple Computer 2008-09-25 23:12 . 2008-09-25 23:12 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\{3276BE95_AF08_429F_A64F_CA64CB79BCF6} 2008-09-25 23:12 . 2008-04-17 13:12 107,368 --a------ C:\WINDOWS\system32\GEARAspi.dll 2008-09-25 23:12 . 2008-04-17 13:12 15,464 --a------ C:\WINDOWS\system32\drivers\GEARAspiWDM.sys 2008-09-25 23:11 . 2008-09-25 23:12 <DIR> d-------- C:\Program Files\Common Files\Apple 2008-09-25 23:11 . 2008-09-25 23:11 <DIR> d-------- C:\Program Files\Apple Software Update 2008-09-25 23:11 . 2008-09-25 23:11 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Apple 2008-09-25 17:03 . 2008-09-28 10:41 107,888 --a------ C:\WINDOWS\system32\CmdLineExt.dll 2008-09-25 16:48 . 2008-10-14 12:41 69 --a------ C:\WINDOWS\NeroDigital.ini 2008-09-25 11:33 . 2008-10-13 15:40 <DIR> d-------- C:\Program Files\DAEMON Tools Lite 2008-09-25 11:32 . 2008-09-25 11:32 0 --a------ C:\WINDOWS\ativpsrm.bin 2008-09-25 11:31 . 2008-09-25 11:31 <DIR> d-------- C:\Documents and Settings\Stryju\Dane aplikacji\Gadu-Gadu 2008-09-25 11:31 . 2008-09-25 11:31 <DIR> d-------- C:\Documents and Settings\Stryju\Dane aplikacji\DAEMON Tools 2008-09-25 11:31 . 2008-09-25 11:31 717,296 --a------ C:\WINDOWS\system32\drivers\sptd.sys 2008-09-25 11:28 . 2008-09-25 11:28 664 --a------ C:\WINDOWS\system32\d3d9caps.dat 2008-09-25 03:13 . 2008-06-14 19:36 273,024 --------- C:\WINDOWS\system32\drivers\bthport.sys 2008-09-25 03:13 . 2008-06-14 19:36 273,024 --------- C:\WINDOWS\system32\dllcache\bthport.sys 2008-09-25 03:12 . 2008-05-27 19:26 765,952 --------- C:\WINDOWS\system32\dllcache\vgx.dll 2008-09-25 03:12 . 2008-05-08 16:02 203,136 --------- C:\WINDOWS\system32\dllcache\rmcast.sys 2008-09-25 03:09 . 2008-04-11 21:06 691,712 --------- C:\WINDOWS\system32\dllcache\inetcomm.dll 2008-09-25 03:00 . 2005-06-28 10:21 22,752 --a------ C:\WINDOWS\system32\spupdsvc.exe 2008-09-25 01:29 . 2008-09-25 01:29 <DIR> d-------- C:\Documents and Settings\Stryju\Dane aplikacji\Nero 2008-09-25 01:27 . 2008-09-25 01:27 <DIR> d-------- C:\Program Files\Nero 2008-09-25 01:27 . 2008-09-25 01:28 <DIR> d-------- C:\Program Files\Common Files\Nero 2008-09-25 01:27 . 2008-09-25 01:27 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Nero 2008-09-24 23:52 . 2008-05-01 16:37 331,776 --------- C:\WINDOWS\system32\dllcache\msadce.dll 2008-09-24 23:19 . 2008-09-24 23:19 <DIR> d-------- C:\Documents and Settings\Stryju\Gadu-Gadu . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-10-03 17:26 6,066,176 ------w C:\WINDOWS\system32\dllcache\ieframe.dll 2008-09-26 14:00 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-09-25 16:46 --------- d-----w C:\Documents and Settings\Stryju\Dane aplikacji\Ventrilo 2008-09-25 11:46 --------- d-----w C:\Program Files\Realtek 2008-09-24 22:21 --------- d-----w C:\Program Files\Ventrilo 2008-09-24 22:20 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard 2008-09-24 22:19 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Microsoft Help 2008-09-24 22:18 --------- d-----w C:\Program Files\MSBuild 2008-09-24 22:18 --------- d-----w C:\Program Files\Microsoft Works 2008-09-24 22:01 --------- d-----w C:\Program Files\Common Files\InstallShield 2008-09-24 21:53 --------- d-----w C:\Program Files\Intel 2008-09-24 21:49 319,488 ----a-w C:\WINDOWS\HideWin.exe 2008-09-24 21:19 --------- d-----w C:\Program Files\Gadu-Gadu 2008-09-24 20:33 --------- d-----w C:\Program Files\Usługi online 2008-09-24 20:31 --------- d-----w C:\Program Files\Windows Media Connect 2 2008-09-15 15:27 1,846,656 ----a-w C:\WINDOWS\system32\win32k.sys 2008-09-08 10:41 333,824 ----a-w C:\WINDOWS\system32\drivers\srv.sys 2008-08-29 08:18 87,336 ----a-w C:\WINDOWS\system32\dns-sd.exe 2008-08-29 07:53 61,440 ----a-w C:\WINDOWS\system32\dnssd.dll 2008-08-27 09:27 3,593,216 ------w C:\WINDOWS\system32\dllcache\mshtml.dll 2008-08-26 08:27 826,368 ----a-w C:\WINDOWS\system32\wininet.dll 2008-08-26 08:27 826,368 ------w C:\WINDOWS\system32\dllcache\wininet.dll 2008-08-26 08:27 671,232 ------w C:\WINDOWS\system32\dllcache\mstime.dll 2008-08-26 08:27 477,696 ------w C:\WINDOWS\system32\dllcache\mshtmled.dll 2008-08-26 08:27 44,544 ------w C:\WINDOWS\system32\dllcache\pngfilt.dll 2008-08-26 08:27 233,472 ------w C:\WINDOWS\system32\dllcache\webcheck.dll 2008-08-26 08:27 193,024 ------w C:\WINDOWS\system32\dllcache\msrating.dll 2008-08-26 08:27 105,984 ------w C:\WINDOWS\system32\dllcache\url.dll 2008-08-26 08:27 102,912 ------w C:\WINDOWS\system32\dllcache\occache.dll 2008-08-26 08:27 1,159,680 ------w C:\WINDOWS\system32\dllcache\urlmon.dll 2008-08-25 08:42 70,656 ------w C:\WINDOWS\system32\dllcache\ie4uinit.exe 2008-08-25 08:38 13,824 ------w C:\WINDOWS\system32\dllcache\ieudinit.exe 2008-08-23 05:56 635,848 ------w C:\WINDOWS\system32\dllcache\iexplore.exe 2008-08-23 05:54 161,792 ------w C:\WINDOWS\system32\dllcache\ieakui.dll 2008-08-21 04:52 3,299,840 ----a-w C:\WINDOWS\system32\drivers\ati2mtag.sys 2008-08-21 02:19 425,984 ----a-w C:\WINDOWS\system32\ATIDEMGX.dll 2008-08-21 02:18 314,880 ----a-w C:\WINDOWS\system32\ati2dvag.dll 2008-08-21 02:08 184,320 ----a-w C:\WINDOWS\system32\atipdlxx.dll 2008-08-21 02:08 143,360 ----a-w C:\WINDOWS\system32\Oemdspif.dll 2008-08-21 02:07 43,520 ----a-w C:\WINDOWS\system32\ati2edxx.dll 2008-08-21 02:07 26,112 ----a-w C:\WINDOWS\system32\Ati2mdxx.exe 2008-08-21 02:07 143,360 ----a-w C:\WINDOWS\system32\ati2evxx.dll 2008-08-21 02:05 573,440 ----a-w C:\WINDOWS\system32\ati2evxx.exe 2008-08-21 02:04 53,248 ----a-w C:\WINDOWS\system32\ATIDDC.DLL 2008-08-21 02:01 10,084,352 ----a-w C:\WINDOWS\system32\atioglxx.dll 2008-08-21 01:55 4,094,560 ----a-w C:\WINDOWS\system32\ati3duag.dll 2008-08-21 01:50 307,200 ----a-w C:\WINDOWS\system32\atiiiexx.dll 2008-08-21 01:38 2,377,856 ----a-w C:\WINDOWS\system32\ativvaxx.dll 2008-08-21 01:23 48,640 ----a-w C:\WINDOWS\system32\amdpcom32.dll 2008-08-21 01:19 380,928 ----a-w C:\WINDOWS\system32\atikvmag.dll 2008-08-21 01:18 37,376 ----a-w C:\WINDOWS\system32\atiadlxx.dll 2008-08-21 01:18 17,408 ----a-w C:\WINDOWS\system32\atitvo32.dll 2008-08-21 01:17 53,248 ----a-w C:\WINDOWS\system32\drivers\ati2erec.dll 2008-08-21 01:17 253,952 ----a-w C:\WINDOWS\system32\atiok3x2.dll 2008-08-21 01:11 561,152 ----a-w C:\WINDOWS\system32\ati2cqag.dll 2008-08-20 19:05 593,920 ------w C:\WINDOWS\system32\ati2sgag.exe 2008-08-14 13:26 2,146,816 ----a-w C:\WINDOWS\system32\ntoskrnl.exe 2008-08-14 13:26 2,025,472 ----a-w C:\WINDOWS\system32\ntkrnlpa.exe 2008-08-14 10:04 138,496 ------w C:\WINDOWS\system32\dllcache\afd.sys 2008-08-05 21:14 90,112 ----a-w C:\WINDOWS\system32\ATIBRTMON.EXE 2008-07-31 08:41 68,616 ----a-w C:\WINDOWS\system32\XAPOFX1_1.dll 2008-07-31 08:41 238,088 ----a-w C:\WINDOWS\system32\xactengine3_2.dll 2008-07-31 08:40 509,448 ----a-w C:\WINDOWS\system32\XAudio2_2.dll 2008-07-23 14:51 16,804,864 ----a-w C:\WINDOWS\RTHDCPL.exe 2008-07-18 20:10 94,920 ----a-w C:\WINDOWS\system32\cdm.dll 2008-07-18 20:10 53,448 ----a-w C:\WINDOWS\system32\wuauclt.exe 2008-07-18 20:10 45,768 ----a-w C:\WINDOWS\system32\wups2.dll 2008-07-18 20:10 36,552 ----a-w C:\WINDOWS\system32\wups.dll 2008-07-18 20:09 563,912 ----a-w C:\WINDOWS\system32\wuapi.dll 2008-07-18 20:09 325,832 ----a-w C:\WINDOWS\system32\wucltui.dll 2008-07-18 20:09 205,000 ----a-w C:\WINDOWS\system32\wuweb.dll 2008-07-18 20:09 1,811,656 ----a-w C:\WINDOWS\system32\wuaueng.dll . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2008-04-14 15360] "IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" [2008-06-24 1840424] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "GrooveMonitor"="C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-27 31016] "NeroFilterCheck"="C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe" [2008-06-19 570664] "NBKeyScan"="C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" [2008-06-08 2221352] "QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-09-06 413696] "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-09-10 289576] "RTHDCPL"="RTHDCPL.EXE" [2008-07-23 C:\WINDOWS\RTHDCPL.exe] "SoundMan"="SOUNDMAN.EXE" [2008-06-18 C:\WINDOWS\SoundMan.exe] "AlcWzrd"="ALCWZRD.EXE" [2008-06-19 C:\WINDOWS\alcwzrd.exe] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2008-04-14 15360] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce] "nltide_2"="shell32" [X] "nltide_3"="advpack.dll" [2008-08-26 C:\WINDOWS\system32\advpack.dll] [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "%windir%\\system32\\sessmgr.exe"= "C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"= "C:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"= "C:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"= "D:\\Steam\\SteamApps\\10112000\\counter-strike\\hl.exe"= "C:\\Program Files\\Bonjour\\mDNSResponder.exe"= "C:\\Program Files\\iTunes\\iTunes.exe"= "D:\\Steam\\SteamApps\\10112000\\half-life 2 deathmatch\\hl2.exe"= "D:\\Steam\\SteamApps\\10112000\\insurgency\\hl2.exe"= "D:\\Steam\\SteamApps\\10112000\\team fortress 2\\hl2.exe"= "D:\\Steam\\SteamApps\\10112000\\synergy\\hl2.exe"= "C:\\Program Files\\eMule\\emule.exe"= "C:\\Program Files\\Mozilla Firefox\\Steamcrackv0.13.exe"= "C:\\Program Files\\Ares\\Ares.exe"= "D:\\FIFA 09\\FIFA09.exe"= "D:\\Steam\\SteamApps\\10112000\\half-life\\hl.exe"= "C:\\Program Files\\Gadu-Gadu\\gg.exe"= "D:\\duke3d\\eduke32.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "4662:TCP"= 4662:TCP:4662 "4662:UDP"= 4662:UDP:4662 R3 SG762_XP;SAGEM 802.11g XG762 1211B Driver;C:\WINDOWS\system32\DRIVERS\WlanBZXP.sys [2007-01-16 450560] S3 athrusb;Atheros Wireless LAN USB device driver;C:\WINDOWS\system32\DRIVERS\athrusb.sys [2006-12-22 449536] S3 se46bus;Sony Ericsson Device 070 driver (WDM);C:\WINDOWS\system32\DRIVERS\se46bus.sys [2006-07-25 61536] S3 se46mdfl;Sony Ericsson Device 070 USB WMC Modem Filter;C:\WINDOWS\system32\DRIVERS\se46mdfl.sys [2006-07-25 9360] S3 se46mdm;Sony Ericsson Device 070 USB WMC Modem Driver;C:\WINDOWS\system32\DRIVERS\se46mdm.sys [2006-07-25 97088] S3 se46mgmt;Sony Ericsson Device 070 USB WMC Device Management Drivers (WDM);C:\WINDOWS\system32\DRIVERS\se46mgmt.sys [2006-07-25 88624] S3 se46nd5;Sony Ericsson Device 070 USB Ethernet Emulation SEMC46 (NDIS);C:\WINDOWS\system32\DRIVERS\se46nd5.sys [2006-07-25 18704] S3 se46obex;Sony Ericsson Device 070 USB WMC OBEX Interface;C:\WINDOWS\system32\DRIVERS\se46obex.sys [2006-07-25 86432] S3 se46unic;Sony Ericsson Device 070 USB Ethernet Emulation SEMC46 (WDM);C:\WINDOWS\system32\DRIVERS\se46unic.sys [2006-07-25 90800] S3 ZDCndis5;ZDCndis5 Protocol Driver;C:\WINDOWS\system32\ZDCndis5.SYS [ ] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\G] \Shell\AutoRun\command - G:\AutoRunMorrowind.exe \Shell\install\command - G:\Setup.exe . Zawartość folderu 'Zaplanowane zadania' 2008-09-25 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job - C:\Program Files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 12:34] . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-10-18 17:52:04 Windows 5.1.2600 Dodatek Service Pack 3 NTFS skanowanie ukrytych procesów ... skanowanie ukrytych wpisów autostartu ... skanowanie ukrytych plików ... skanowanie pomyślnie ukończone ukryte pliki: 0 ************************************************************************** . Czas ukończenia: 2008-10-18 17:52:23 ComboFix-quarantined-files.txt 2008-10-18 15:52:21 ComboFix2.txt 2008-10-18 15:24:22 Przed: 12 853 915 648 bajtów wolnych Po: 12,845,105,152 bajtów wolnych 253 --- E O F --- 2008-10-15 05:20:18

Dodano 20.10.2008 15:20:10:
Sry że post pod postem, ale temat można już zamknąć, była to usterka ze strony telekomunikacji polskiej.