Wolna praca komputera, zwisy itp.

**Posty:** 57 · przez **Inik** 20 Paź 2008, 17:16

Dodam że ktoś włamał się mi na jednej ze stron na której miałem konto oraz na konto e-mail które straciłem.

Kod: Zaznacz wszystko: Logfile of HijackThis v1.99.1 Scan saved at 10:38:44, on 2008-10-20 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.5730.0013) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe C:\WINDOWS\system32\crypserv.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\PnkBstrA.exe C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe C:\Program Files\Winamp\winampa.exe C:\WINDOWS\SOUNDMAN.EXE C:\WINDOWS\system32\RUNDLL32.EXE C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE C:\Program Files\Messenger\msmsgs.exe C:\WINDOWS\system32\ctfmon.exe D:\Program Files\Free Download Manager\fum\fum.exe D:\Program Files\Free Download Manager\FUM\fumoei.exe C:\Program Files\Stardock\CursorFX\CursorFX.exe C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe C:\Program Files\DAEMON Tools Lite\daemon.exe C:\Program Files\PLANET WL-8314\WLANMON.exe C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe C:\PROGRA~1\COMMON~1\Nokia\MPAPI\MPAPI3s.exe C:\Program Files\Gadu-Gadu\gg.exe C:\Program Files\Mozilla Firefox\firefox.exe D:\Moje programy\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.onet.pl/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = proxy.megainternet.pl:3128 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza R3 - URLSearchHook: SrchHook Class - {F4F10C1D-87C7-404A-B4B3-000000000000} - C:\PROGRA~1\DAP\SBSearch.dll (file missing) O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: flashget urlcatch - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\Program Files\FlashGet\jccatch.dll O2 - BHO: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL O2 - BHO: IEVkbdBHO - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\ievkbd.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O2 - BHO: FDMIECookiesBHO Class - {CC59E0F9-7E43-44FA-9FAA-8377850BF205} - D:\Program Files\Free Download Manager\iefdm2.dll O2 - BHO: FlashGet GetFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\Program Files\FlashGet\getflash.dll O3 - Toolbar: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe" O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe" O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE -startup O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [Free Upload Manager] "D:\Program Files\Free Download Manager\fum\fum.exe" -autorun O4 - HKCU\..\Run: [Free Uploader Oe Integration] D:\Program Files\Free Download Manager\FUM\fumoei.exe O4 - HKCU\..\Run: [CursorFX] "C:\Program Files\Stardock\CursorFX\CursorFX.exe" O4 - HKCU\..\Run: [PcSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: WL-8314 Configuration Utility.lnk = ? O8 - Extra context menu item: &Ściągnij przy pomocy FlashGet'a - C:\Program Files\FlashGet\jc_link.htm O8 - Extra context menu item: &Ściągnij wszystko przy pomocy FlashGet'a - C:\Program Files\FlashGet\jc_all.htm O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://D:\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000 O8 - Extra context menu item: Pobierz plik wideo we Free Download Manager - file://D:\Program Files\Free Download Manager\dlfvideo.htm O8 - Extra context menu item: Pobierz w Free Download Manager - file://D:\Program Files\Free Download Manager\dllink.htm O8 - Extra context menu item: Pobierz wszystkie pliki w Free Download Manager - file://D:\Program Files\Free Download Manager\dlall.htm O8 - Extra context menu item: Pobierz zaznaczone w Free Download Manager - file://D:\Program Files\Free Download Manager\dlselected.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra button: Statystyki ochrony WWW - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\SCIEPlgn.dll O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\PROGRA~1\MICROS~1\OFFICE11\REFIEBAR.DLL O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra button: Upload - {FD4E2FF8-973C-4A19-89BD-8E86B3CFCFE1} - D:\Program Files\Free Download Manager\FUM\fumiebtn.dll O11 - Options group: [INTERNATIONAL] International* O16 - DPF: {4BFD075D-C36E-4F28-BB0A-5D472795197A} (PowerLoader Class) - http://powersoccer.minigry.pl/applet/PowerLoader.cab O16 - DPF: {66F7F252-3FE1-4650-B1E5-94B2A38271C5} (ActiveView Control) - http://83.14.10.131/ActiveView.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{91BE16DE-BD82-43BD-A335-C39AEEC8F844}: NameServer = 85.117.17.1 O20 - AppInit_DLLs: C:\PROGRA~1\KASPER~1\KASPER~1\mzvkbd.dll O20 - Winlogon Notify: klogon - C:\WINDOWS\system32\klogon.dll O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: Kaspersky Anti-Virus (AVP) - Unknown owner - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe" -r (file missing) O23 - Service: Crypkey License - CrypKey (Canada) Ltd. - C:\WINDOWS\SYSTEM32\crypserv.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe O23 - Service: ServiceLayer - Nokia. - C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe O23 - Service: StyleXPService - Unknown owner - C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe

**Posty:** 7956 · przez **Magik** 20 Paź 2008, 17:33

Witam

gdzie log z combofixa?? wklej

czysta kosmetyka, fix:

Kod: Zaznacz wszystko: R3 - URLSearchHook: SrchHook Class - {F4F10C1D-87C7-404A-B4B3-000000000000} - C:\PROGRA~1\DAP\SBSearch.dll (file missing)

do tego

od Mariusza
1. Ściągnij OTMoveIt i go włacz i odpal go z opcji CleanUp

2. wykonaj optymalizację windowsa
3.sciagnij ATF_Cleaner
zaznacz
Windows Temp
All users Temp
Temporary internet files
Recycle Bin
i wcisnij EMPTY SELECTED
4.Wyłącz przywracanie systemu ( właściwości mój komputer-zakładka przywracanie - wyłącz przywracanie na wszystkich dyskach). Po chwili włącz je powrotem

**Posty:** 57 · przez **Inik** 21 Paź 2008, 18:52

Kod: Zaznacz wszystko: ComboFix 08-10-19.04 - Administrator 2008-10-23 0:37:12.1 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.633 [GMT 2:00] Uruchomiony z: C:\Documents and Settings\Administrator\Pulpit\ComboFix.exe * Utworzono nowy punkt przywracania [COLOR=RED][B]UWAGA - TEN KOMPUTER NIE MA ZAINSTALOWANEJ KONSOLI ODZYSKIWANIA !![/B][/COLOR] . ((((((((((((((((((((((((((((((((((((((( Usunięto ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\windows\system32\tmp39.tmp . ((((((((((((((((((((((((( Pliki utworzone od 2008-09-22 do 2008-10-22 ))))))))))))))))))))))))))))))) . 2008-10-21 02:56 . 2008-10-23 00:39 <DIR> dr-h----- C:\Documents and Settings\Default User.WINDOWS.0\Ustawienia lokalne 2008-10-21 02:56 . 2008-10-21 02:56 <DIR> d-------- C:\Documents and Settings\Default User.WINDOWS.0\Ulubione 2008-10-21 02:56 . 2008-10-21 01:03 <DIR> d--h----- C:\Documents and Settings\Default User.WINDOWS.0\Szablony 2008-10-21 02:56 . 2008-10-21 02:56 <DIR> d-------- C:\Documents and Settings\Default User.WINDOWS.0\Pulpit 2008-10-21 02:56 . 2008-10-21 02:56 <DIR> d-------- C:\Documents and Settings\Default User.WINDOWS.0\Moje dokumenty 2008-10-21 02:56 . 2008-10-21 02:56 <DIR> dr------- C:\Documents and Settings\Default User.WINDOWS.0\Menu Start 2008-10-21 02:56 . 2008-10-21 02:56 <DIR> d-------- C:\Documents and Settings\All Users.WINDOWS.0\Ulubione 2008-10-21 02:56 . 2008-10-21 02:56 <DIR> d--h----- C:\Documents and Settings\All Users.WINDOWS.0\Szablony 2008-10-21 02:56 . 2008-10-21 02:56 <DIR> d-------- C:\Documents and Settings\All Users.WINDOWS.0\Pulpit 2008-10-21 02:56 . 2008-10-21 01:08 <DIR> dr------- C:\Documents and Settings\All Users.WINDOWS.0\Menu Start 2008-10-21 02:56 . 2008-10-21 01:04 <DIR> dr------- C:\Documents and Settings\All Users.WINDOWS.0\Dokumenty 2008-10-21 02:55 . 2008-10-21 02:56 <DIR> dr-h----- C:\Documents and Settings\Default User.WINDOWS.0\Dane aplikacji 2008-10-21 02:55 . 2008-10-23 00:35 <DIR> d--h----- C:\Documents and Settings\Default User.WINDOWS.0 2008-10-21 02:55 . 2008-10-21 02:56 <DIR> dr-h----- C:\Documents and Settings\All Users.WINDOWS.0\Dane aplikacji 2008-10-21 02:55 . 2008-10-21 01:06 <DIR> d-------- C:\Documents and Settings\All Users.WINDOWS.0 2008-10-21 01:11 . 2008-10-23 00:39 <DIR> d--h----- C:\Documents and Settings\Dominik\Ustawienia lokalne 2008-10-21 01:11 . 2008-10-21 01:11 <DIR> dr------- C:\Documents and Settings\Dominik\Ulubione 2008-10-21 01:11 . 2008-10-21 01:03 <DIR> d--h----- C:\Documents and Settings\Dominik\Szablony 2008-10-21 01:11 . 2008-10-21 01:13 <DIR> d-------- C:\Documents and Settings\Dominik\Pulpit 2008-10-21 01:11 . 2008-10-21 01:11 <DIR> dr------- C:\Documents and Settings\Dominik\Moje dokumenty 2008-10-21 01:11 . 2008-10-21 02:56 <DIR> dr------- C:\Documents and Settings\Dominik\Menu Start 2008-10-21 01:11 . 2008-10-21 01:11 <DIR> dr-h----- C:\Documents and Settings\Dominik\Dane aplikacji 2008-10-21 01:11 . 2008-10-21 01:11 <DIR> d-------- C:\Documents and Settings\Dominik 2008-10-21 01:09 . 2008-10-23 00:39 <DIR> d--h----- C:\Documents and Settings\NetworkService.ZARZĄDZANIE NT\Ustawienia lokalne 2008-10-21 01:09 . 2008-10-21 01:09 <DIR> d-------- C:\Documents and Settings\NetworkService.ZARZĄDZANIE NT\Dane aplikacji 2008-10-21 01:09 . 2008-10-21 01:09 <DIR> d--hs---- C:\Documents and Settings\NetworkService.ZARZĄDZANIE NT 2008-10-21 01:09 . 2008-10-23 00:39 <DIR> d--h----- C:\Documents and Settings\LocalService.ZARZĄDZANIE NT\Ustawienia lokalne 2008-10-21 01:09 . 2008-10-21 01:09 <DIR> d-------- C:\Documents and Settings\LocalService.ZARZĄDZANIE NT\Dane aplikacji 2008-10-21 01:09 . 2008-10-21 01:09 <DIR> d--hs---- C:\Documents and Settings\LocalService.ZARZĄDZANIE NT 2008-10-21 01:06 . 2008-10-21 01:06 <DIR> d--hs---- C:\Documents and Settings\All Users.WINDOWS.0\DRM 2008-10-18 11:06 . 2008-10-18 11:06 <DIR> d-------- C:\WINDOWS\Logs 2008-10-18 11:05 . 2008-04-28 16:53 805,400 -ra------ C:\WINDOWS\system32\tmp3F.tmp 2008-10-18 11:05 . 2008-04-28 16:53 805,400 -ra------ C:\WINDOWS\system32\tmp3E.tmp 2008-10-18 09:55 . 2008-10-18 09:55 2,240 --a------ C:\WINDOWS\system32\esnecil.nlp 2008-10-18 09:55 . 2003-07-23 00:14 4 --a------ C:\WINDOWS\vx86036.dat 2008-10-18 01:06 . 2008-10-18 01:06 <DIR> d-------- C:\WINDOWS\system32\Adobe 2008-10-18 01:06 . 2003-07-23 00:04 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\INFO-TECH 2008-10-04 03:54 . 2008-10-04 03:54 <DIR> d-------- C:\Documents and Settings\Administrator\Dane aplikacji\Leadertech . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-10-22 22:42 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab 2008-10-22 22:41 475,168 --sha-w C:\windows\system32\drivers\fidbox2.dat 2008-10-22 22:41 4,800 --sha-w C:\windows\system32\drivers\fidbox2.idx 2008-10-22 22:41 24,512 --sha-w C:\windows\system32\drivers\fidbox.idx 2008-10-22 22:41 2,731,040 --sha-w C:\windows\system32\drivers\fidbox.dat 2008-10-22 22:39 --------- d-----w C:\Documents and Settings\Administrator\Dane aplikacji\Free Download Manager 2008-10-18 09:42 --------- d-----w C:\Documents and Settings\Administrator\Dane aplikacji\BearShare 2008-10-18 09:05 444,952 ----a-w C:\windows\system32\wrap_oal.dll 2008-10-18 09:05 109,080 ----a-w C:\windows\system32\OpenAL32.dll 2008-10-17 23:06 --------- d-----w C:\Program Files\Common Files\Adobe 2008-09-20 08:35 --------- d-----w C:\Documents and Settings\Administrator\Dane aplikacji\Disney Interactive Studios 2008-09-20 08:28 --------- d-----w C:\Program Files\DAEMON Tools Lite 2008-09-20 08:18 717,296 ----a-w C:\windows\system32\drivers\sptd.sys 2008-09-20 08:18 --------- d-----w C:\Documents and Settings\Administrator\Dane aplikacji\DAEMON Tools 2008-09-20 08:13 --------- d-----w C:\Program Files\DAEMON Tools Pro 2008-09-14 00:04 --------- d-----w C:\Program Files\SopCast 2008-08-29 02:36 96,976 ----a-w C:\windows\system32\drivers\klin.dat 2008-08-29 02:36 87,855 ----a-w C:\windows\system32\drivers\klick.dat 2008-08-29 02:26 --------- d-----w C:\Program Files\Kaspersky Lab 2008-08-29 02:25 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab Setup Files 2008-08-27 00:57 --------- d-----w C:\Program Files\7-Zip 2008-08-09 10:37 219,648 ----a-w C:\windows\system32\uxtheme.dll 2008-08-09 09:23 2,194,688 ----a-w C:\windows\system32\kernel1.exe 2008-08-09 02:40 2,194,688 ----a-w C:\windows\system32\KERNEL.TMP 2008-08-08 07:27 107,888 ----a-w C:\windows\system32\CmdLineExt.dll 2008-07-31 08:41 68,616 ----a-w C:\windows\system32\XAPOFX1_1.dll 2008-07-31 08:41 238,088 ----a-w C:\windows\system32\xactengine3_2.dll 2008-07-31 08:40 509,448 ----a-w C:\windows\system32\XAudio2_2.dll 2008-07-22 04:41 50,688 ----a-w C:\windows\system32\wbhelp2.dll 2008-07-19 20:28 22,328 ----a-w C:\Documents and Settings\Administrator\Dane aplikacji\PnkBstrK.sys . ------- Sigcheck ------- 2004-08-03 22:14 359040 9f4b36614a0fc234525ba224957de55c C:\windows\system32\dllcache\tcpip.sys 2004-08-03 22:14 359040 6a603809f598332dbedd535bdbce313e C:\windows\system32\drivers\tcpip.sys . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-08-04 1667584] "ctfmon.exe"="C:\windows\system32\ctfmon.exe" [2004-08-03 15360] "Free Upload Manager"="D:\Program Files\Free Download Manager\fum\fum.exe" [2007-07-29 253952] "Free Uploader Oe Integration"="D:\Program Files\Free Download Manager\FUM\fumoei.exe" [2007-06-10 40960] "CursorFX"="C:\Program Files\Stardock\CursorFX\CursorFX.exe" [2008-02-20 418632] "PcSync"="C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2006-04-11 1409024] "DAEMON Tools Lite"="C:\Program Files\DAEMON Tools Lite\daemon.exe" [2008-07-24 490952] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [2004-11-02 32768] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784] "WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2008-08-04 36352] "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792] "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2008-05-16 13529088] "NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2008-05-16 86016] "PCSuiteTrayApplication"="C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE" [2006-04-26 237568] "SoundMan"="SOUNDMAN.EXE" [2007-04-16 C:\WINDOWS\soundman.exe] "nwiz"="nwiz.exe" [2008-05-16 C:\WINDOWS\system32\nwiz.exe] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-03 15360] C:\Documents and Settings\Administrator\Menu Start\Programy\Autostart\ Adobe Gamma.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-03-16 113664] C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\ WL-8314 Configuration Utility.lnk - C:\Program Files\PLANET WL-8314\WLANMON.exe [2008-04-03 299008] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "VIDC.AP41"= APmpg4v1.dll [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusDisableNotify"=dword:00000001 "UpdatesDisableNotify"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "D:\\Program Files\\eMule\\emule.exe"= "C:\\Program Files\\Gadu-Gadu\\gg.exe"= "C:\\Program Files\\SopCast\\adv\\SopAdver.exe"= "C:\\Program Files\\SopCast\\SopCast.exe"= "C:\\WINDOWS\\system32\\PnkBstrA.exe"= "C:\\WINDOWS\\system32\\PnkBstrB.exe"= "D:\\Program Files\\BearShare Applications\\BearShare\\BearShare.exe"= "C:\\Program Files\\FlashGet\\flashget.exe"= "D:\\My Downloads\\Pure\\Pure.exe"= "C:\\Program Files\\Opera\\opera.exe"= R0 klbg;Kaspersky Lab Boot Guard Driver;C:\windows\system32\drivers\klbg.sys [2008-01-29 32784] R0 sfsync03;StarForce Protection Synchronization Driver (version 3.x);C:\windows\system32\drivers\sfsync03.sys [2005-12-06 35328] R3 klim5;Kaspersky Anti-Virus NDIS Filter;C:\windows\system32\DRIVERS\klim5.sys [2008-03-25 24592] S0 pavboot;pavboot;C:\windows\system32\drivers\pavboot.sys [ ] S2 NOD32FiXTemDono;Eset Nod32 Boot;C:\WINDOWS\system32\regedt32.exe [2001-10-26 3584] S3 usb2vcom;USB to Serial Bridge Controller;C:\windows\system32\Drivers\usb2vcom.sys [2006-07-17 30368] . - - - - USUNIĘTO PUSTE WPISY - - - - URLSearchHooks-{F4F10C1D-87C7-404A-B4B3-000000000000} - C:\PROGRA~1\DAP\SBSearch.dll . ------- Skan uzupełniający ------- . FireFox -: Profile - C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Firefox\Profiles\t94ncv0c.default\ FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://beta.onet.pl/ FF -: plugin - C:\Program Files\Opera\program\plugins\NP_IDM1.dll FF -: plugin - C:\Program Files\Opera\program\plugins\NP_IDM2.dll FF -: plugin - C:\Program Files\Opera\program\plugins\NP_IDM3.dll FF -: plugin - C:\Program Files\Opera\program\plugins\NP_IDM5.dll FF -: plugin - C:\Program Files\Opera\program\plugins\NP_IDM6.dll . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-10-23 00:42:58 Windows 5.1.2600 Dodatek Service Pack 2 NTFS skanowanie ukrytych procesów ... skanowanie ukrytych wpisów autostartu ... skanowanie ukrytych plików ... skanowanie pomyślnie ukończone ukryte pliki: 0 ************************************************************************** . --------------------- Pliki DLL ładowane pod uruchomionymi procesami --------------------- PROCES: C:\windows\explorer.exe -> ?:\windows\system32\MLANG.dll -> ?:\windows\system32\MLANG.dll -> ?:\windows\system32\MLANG.dll -> ?:\windows\system32\MLANG.dll . ------------------------ Pozostałe uruchomione procesy ------------------------ . C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe C:\WINDOWS\system32\Crypserv.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\PnkBstrA.exe C:\WINDOWS\system32\rundll32.exe C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe C:\PROGRA~1\COMMON~1\Nokia\MPAPI\MPAPI3s.exe . ************************************************************************** . Czas ukończenia: 2008-10-23 0:47:08 - komputer został uruchomiony ponownie ComboFix-quarantined-files.txt 2008-10-22 22:47:01 Przed: 3 754 008 576 bajtów wolnych Po: 3,683,753,984 bajtów wolnych 191

**Posty:** 18165 · przez **wojtas** 21 Paź 2008, 19:32

te plik/i :

C:\WINDOWS\system32\tmp3F.tmp
C:\WINDOWS\system32\tmp3E.tmp
C:\WINDOWS\system32\esnecil.nlp
C:\WINDOWS\vx86036.dat

przesaknuj tu

http://virusscan.jotti.org/
http://www.virustotal.com/

i daj raporty ze skanow

**Posty:** 57 · przez **Inik** 21 Paź 2008, 20:11

Kod: Zaznacz wszystko: [code]File: tmp3F.tmp Status: OK(Note: file has been scanned before. Therefore, this file's scan results will not be stored in the database) MD5: 60bd14d7e2b924f56785ded69056d886 Packers detected: -[/code] [code] Scan taken on 21 Oct 2008 17:44:29 (GMT) A-Squared Found nothing AntiVir Found nothing ArcaVir Found nothing Avast Found nothing AVG Antivirus Found nothing BitDefender Found nothing ClamAV Found nothing CPsecure Found nothing Dr.Web Found nothing F-Prot Antivirus Found nothing F-Secure Anti-Virus Found nothing G DATA Found nothing Ikarus Found nothing Kaspersky Anti-Virus Found nothing NOD32 Found nothing Norman Virus Control Found nothing Panda Antivirus Found nothing Sophos Antivirus Found nothing VirusBuster Found nothing VBA32 Found nothing[/code] [code]File: tmp3E.tmp Status: OK(Note: file has been scanned before. Therefore, this file's scan results will not be stored in the database) MD5: 60bd14d7e2b924f56785ded69056d886 Packers detected: -[/code] [code] Scan taken on 21 Oct 2008 17:48:15 (GMT) A-Squared Found nothing AntiVir Found nothing ArcaVir Found nothing Avast Found nothing AVG Antivirus Found nothing BitDefender Found nothing ClamAV Found nothing CPsecure Found nothing Dr.Web Found nothing F-Prot Antivirus Found nothing F-Secure Anti-Virus Found nothing G DATA Found nothing Ikarus Found nothing Kaspersky Anti-Virus Found nothing NOD32 Found nothing Norman Virus Control Found nothing Panda Antivirus Found nothing Sophos Antivirus Found nothing VirusBuster Found nothing VBA32 Found nothing[/code] [code]File: esnecil.nlp Status: OK MD5: b6b5bb2eb0daa3bcfc7c7e87ebbd9870 Packers detected: -[/code] [code]Scan taken on 21 Oct 2008 17:51:27 (GMT) A-Squared Found nothing AntiVir Found nothing ArcaVir Found nothing Avast Found nothing AVG Antivirus Found nothing BitDefender Found nothing ClamAV Found nothing CPsecure Found nothing Dr.Web Found nothing F-Prot Antivirus Found nothing F-Secure Anti-Virus Found nothing G DATA Found nothing Ikarus Found nothing Kaspersky Anti-Virus Found nothing NOD32 Found nothing Norman Virus Control Found nothing Panda Antivirus Found nothing Sophos Antivirus Found nothing VirusBuster Found nothing VBA32 Found nothing[/code] [code]File: vx86036.dat Status: OK MD5: 81ba65ae1dd4c2233b12a6b91ad5a43d Packers detected: -[/code] [code]Scan taken on 21 Oct 2008 17:54:53 (GMT) A-Squared Found nothing AntiVir Found nothing ArcaVir Found nothing Avast Found nothing AVG Antivirus Found nothing BitDefender Found nothing ClamAV Found nothing CPsecure Found nothing Dr.Web Found nothing F-Prot Antivirus Found nothing F-Secure Anti-Virus Found nothing G DATA Found nothing Ikarus Found nothing Kaspersky Anti-Virus Found nothing NOD32 Found nothing Norman Virus Control Found nothing Panda Antivirus Found nothing Sophos Antivirus Found nothing VirusBuster Found nothing VBA32 Found nothing[/code] Antywirus Wersja Ostatnia aktualizacja Wynik AhnLab-V3 - - - AntiVir - - - Authentium - - - Avast - - - AVG - - - BitDefender - - - CAT-QuickHeal - - - ClamAV - - - DrWeb - - - eSafe - - - eTrust-Vet - - - Ewido - - - F-Prot - - - F-Secure - - Suspicious:W32/Patched.ac!Gemini Fortinet - - - GData - - - Ikarus - - - K7AntiVirus - - - Kaspersky - - - McAfee - - - Microsoft - - - NOD32 - - - Norman - - - Panda - - - PCTools - - - Prevx1 - - - Rising - - - SecureWeb-Gateway - - - Sophos - - - Sunbelt - - - Symantec - - - TheHacker - - - TrendMicro - - - VBA32 - - - ViRobot - - - VirusBuster - - - Dodatkowe informacje MD5: 60bd14d7e2b924f56785ded69056d886 SHA1: 223b34b267cf3763bc87bcfde25ff7cb9c7d94e3 SHA256: b24206751018706dd7dbff4bb5465cf4a8dfbf3653171fa19034dd8ce6a056b6 SHA512: b30438306f42e32a0837d57ff71f07ea834d44d7a34846ce18e954cbcc5a7256b65e2c67b7508ecf5eee3c0d2040407019f8b52959623dd55299a2ea0e6c13c5

Kod: Zaznacz wszystko: [code]Antywirus Wersja Ostatnia aktualizacja Wynik AhnLab-V3 - - - AntiVir - - - Authentium - - - Avast - - - AVG - - - BitDefender - - - CAT-QuickHeal - - - ClamAV - - - DrWeb - - - eSafe - - - eTrust-Vet - - - Ewido - - - F-Prot - - - F-Secure - - Suspicious:W32/Patched.ac!Gemini Fortinet - - - GData - - - Ikarus - - - K7AntiVirus - - - Kaspersky - - - McAfee - - - Microsoft - - - NOD32 - - - Norman - - - Panda - - - PCTools - - - Prevx1 - - - Rising - - - SecureWeb-Gateway - - - Sophos - - - Sunbelt - - - Symantec - - - TheHacker - - - TrendMicro - - - VBA32 - - - ViRobot - - - VirusBuster - - - Dodatkowe informacje MD5: 60bd14d7e2b924f56785ded69056d886 SHA1: 223b34b267cf3763bc87bcfde25ff7cb9c7d94e3 SHA256: b24206751018706dd7dbff4bb5465cf4a8dfbf3653171fa19034dd8ce6a056b6 SHA512: b30438306f42e32a0837d57ff71f07ea834d44d7a34846ce18e954cbcc5a7256b65e2c67b7508ecf5eee3c0d2040407019f8b52959623dd55299a2ea0e6c13c5[/code] Antywirus Wersja Ostatnia aktualizacja Wynik AhnLab-V3 2008.10.18.0 2008.10.21 - AntiVir 7.9.0.5 2008.10.21 - Authentium 5.1.0.4 2008.10.21 - Avast 4.8.1248.0 2008.10.21 - AVG 8.0.0.161 2008.10.21 - BitDefender 7.2 2008.10.21 - CAT-QuickHeal 9.50 2008.10.21 - ClamAV 0.93.1 2008.10.21 - DrWeb 4.44.0.09170 2008.10.21 - eSafe 7.0.17.0 2008.10.19 - eTrust-Vet 31.6.6161 2008.10.21 - Ewido 4.0 2008.10.21 - F-Prot 4.4.4.56 2008.10.21 - F-Secure 8.0.14332.0 2008.10.21 - Fortinet 3.113.0.0 2008.10.21 - GData 19 2008.10.21 - Ikarus T3.1.1.44.0 2008.10.21 - K7AntiVirus 7.10.501 2008.10.21 - Kaspersky 7.0.0.125 2008.10.21 - McAfee 5409 2008.10.21 - Microsoft 1.4005 2008.10.21 - NOD32 3542 2008.10.21 - Norman 5.80.02 2008.10.21 - Panda 9.0.0.4 2008.10.21 - PCTools 4.4.2.0 2008.10.21 - Prevx1 V2 2008.10.21 - Rising 20.67.12.00 2008.10.21 - SecureWeb-Gateway 6.7.6 2008.10.21 - Sophos 4.34.0 2008.10.21 - Sunbelt 3.1.1741.1 2008.10.21 - Symantec 10 2008.10.21 - TheHacker 6.3.1.0.121 2008.10.21 - TrendMicro 8.700.0.1004 2008.10.21 - VBA32 3.12.8.8 2008.10.21 - ViRobot 2008.10.21.1430 2008.10.21 - VirusBuster 4.5.11.0 2008.10.21 - Dodatkowe informacje File size: 2240 bytes MD5...: b6b5bb2eb0daa3bcfc7c7e87ebbd9870 SHA1..: e043367f467e7e97448512688f513589e8d98c05 SHA256: 7982819d1d5cc268450af7db925e7eca3bbbde78cc2669d3f9e015322825ad40 SHA512: 18bd97b5d1b26c9f504e48a7e436946bf3048df25a8151e95c5e6d44b0e37940 98550f39c6841642e6fc8de90d6206b45027a9e9e94fed7c755b801fa4ad55b3 PEiD..: - TrID..: File type identification Unknown! PEInfo: -

Kod: Zaznacz wszystko: Antywirus Wersja Ostatnia aktualizacja Wynik AhnLab-V3 2008.10.18.0 2008.10.21 - AntiVir 7.9.0.5 2008.10.21 - Authentium 5.1.0.4 2008.10.21 - Avast 4.8.1248.0 2008.10.21 - AVG 8.0.0.161 2008.10.21 - BitDefender 7.2 2008.10.21 - CAT-QuickHeal 9.50 2008.10.21 - ClamAV 0.93.1 2008.10.21 - DrWeb 4.44.0.09170 2008.10.21 - eSafe 7.0.17.0 2008.10.19 - eTrust-Vet 31.6.6161 2008.10.21 - Ewido 4.0 2008.10.21 - F-Prot 4.4.4.56 2008.10.21 - F-Secure 8.0.14332.0 2008.10.21 - Fortinet 3.113.0.0 2008.10.21 - GData 19 2008.10.21 - Ikarus T3.1.1.44.0 2008.10.21 - K7AntiVirus 7.10.501 2008.10.21 - Kaspersky 7.0.0.125 2008.10.21 - McAfee 5409 2008.10.21 - Microsoft 1.4005 2008.10.21 - NOD32 3542 2008.10.21 - Norman 5.80.02 2008.10.21 - Panda 9.0.0.4 2008.10.21 - PCTools 4.4.2.0 2008.10.21 - Prevx1 V2 2008.10.21 - Rising 20.67.12.00 2008.10.21 - SecureWeb-Gateway 6.7.6 2008.10.21 - Sophos 4.34.0 2008.10.21 - Sunbelt 3.1.1741.1 2008.10.21 - Symantec 10 2008.10.21 - TheHacker 6.3.1.0.121 2008.10.21 - TrendMicro 8.700.0.1004 2008.10.21 - VBA32 3.12.8.8 2008.10.21 - ViRobot 2008.10.21.1430 2008.10.21 - VirusBuster 4.5.11.0 2008.10.21 - Dodatkowe informacje File size: 4 bytes MD5...: 81ba65ae1dd4c2233b12a6b91ad5a43d SHA1..: 669f9b9c1be8e9a4ef1eec04acb72a1e8c343283 SHA256: 258b1d7e908c2e1605515963e08bb38f5eb874a4483fcd730ee3bab463927768 SHA512: bff60b2b80307ef22d6b3ea71cb626f7e04a57808093324345a4e29eec99bad1 1595548a2b4089c040d2b08a28107bb717a961cd363e75b0fbea0dbfdf109e59 PEiD..: - TrID..: File type identification Unknown! PEInfo: -

**Posty:** 18165 · przez **wojtas** 21 Paź 2008, 20:37

czyli ok..Przeskanuj obszar mojego komputera http://www.kaspersky.pl/virusscanner.html (uruchom przez IE) Daj raport z niego na forum.