Przy łączeniu się z internetem komputer "zasysa" wirusy

**Posty:** 5 · przez **savage_pl** 26 Sty 2010, 11:11

Witam,
mam poważny problem.
Krótko opiszę co jest grane:

Komputer - serwer (windows 2003 server)
Zainstalowany Symantec Antyvirus + SuperAntiSpyware + Dr Web (wersja bez instalowania)
Codziennie praktycznie server wręcz "zasysa" różnego typu virusy, robaki. Dr Web opisuje je zazwyczaj jako BackDoor, trojanki itp.
A jest ich po prostu od GROMS.
Ostatnio ponad 900.
Połowa w folderze system32 w folderach o nazwach mniej więcej "gfdbdkjfdsfd" w których pliki nazywają się A001.exe itp.

Od kilku dni walczę z tym i nie mogę sobie poradzić.
Co wyczyszczę system to po podłączeniu do internetu zasysa ponownie.
Dodam jeszcze że serwer posiada 2 sieciówki (udostępnianie łącza jest zrobione + usługa "zdalny pulpit" )
Do tego szkodniki usuwają wpisy w rejestrze i np. blokują dostęp do zapory windows (muszę dodawać plik rejestru sharedaccess.reg oraz komendy w wierszu poleceń "CMD /K NETSH FIREWALL RESET") Inaczej nie ma dostępu do internetu osoba, która łączy się poprzez 2 sieciówkę - zapora windows blokuje.

Do sieci podłączonych jest około 50 komputerów (skanowałem już praktycznie wszystkie)

Podaję log z OTL. http://wklej.org/id/268899/
Combofix i Avenger nie działają pod 2003 serwer.
Dodam jeszcze, że OTL próbowałem już kasować pliki, ale nie mogę pozbyć się wszystkiego..
Pomysłów już kompletnie nie mam... proszę o pomoc...

Wyczyściłem rejestr jeszcze na koniec i próbowałem zainstalować Eset smart security (po uprzednim odinstalowaniu symantec) i pojawia mi się błąd : "nie powiodło się uruchomienie usługi eset service (ekrn). Upewnij się, że masz uprawnienia administratora....."

Proszę o pomoc....

**Posty:** 2183 · przez **NieWiem** 26 Sty 2010, 11:16

A bo ComboFix i Avenger to jedyne nasze narzędzia??

Pobierz program Malwarebytes' Anti-Malware i zainstaluj.
Wersja freeware nie ma opcji automatycznych aktualizacji, dlatego pod koniec instalacji upewnij się, że zaznaczone są opcje:
- Update Malwarebytes' Anti-Malware
- Launch Malwarebytes' Anti-Malware
Wciśnij Finish.
Przeprowadź pełne skanowanie komputera.
Raport z tego skanowania proszę wkleić na forum w tagach [code], lub na stronie http://www.wklej.org a w odpowiedzi podać tylko linka do tej strony.

Po Malwarebytes nowy log z OTL.

**Posty:** 5 · przez **savage_pl** 26 Sty 2010, 12:09

Oczywiście znam inne programy:)
Ale akurat tamte są chyba jedne z bardziej popularnych

Malwarybetes miałem zainstalowane i używałem... ale po 5 skanowaniu i non stop usuwaniu tych samych wirusów/robaków itp. miałem dość

Log z Malwarebytes

Kod: Zaznacz wszystko: Malwarebytes' Anti-Malware 1.43 Wersja bazy definicji: 3458 Windows 5.2.3790 Dodatek Service Pack 2 Internet Explorer 7.0.5730.11 2010-01-26 11:01:52 mbam-log-2010-01-26 (11-01-52).txt Typ skanowania: Pełne skanowanie (C:\|D:\|E:\|) Przeskanowane obiekty: 143136 Upłynęło: 33 minute(s), 39 second(s) Zainfekowane procesy w pamięci: 0 Zainfekowane moduły pamięci: 1 Zainfekowane klucze rejestru: 63 Zainfekowane wartości rejestru: 4 Zainfekowane pliki rejestru: 0 Zainfekowane foldery: 0 Zainfekowane pliki: 1 Zainfekowane procesy w pamięci: (Nie wykryto groźnych plików) Zainfekowane moduły pamięci: c:\WINDOWS\system32\erpsx.bmp (Trojan.Downloader) -> Delete on reboot. Zainfekowane klucze rejestru: HKEY_CLASSES_ROOT\CLSID\{86aefbe8-763f-0647-899c-a93278894599} (Trojan.Agent) -> Delete on reboot. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360sd.exe (Security.Hijack) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360rp.exe (Security.Hijack) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360rpt.exe (Trojan.Agent) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360Safe.exe (Trojan.Agent) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360tray.exe (Trojan.Agent) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avp.exe (Trojan.Agent) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CCenter.exe (Trojan.Agent) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ccSvcHst.exe (Trojan.Agent) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KAVStart.exe (Trojan.Agent) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KMailMon.exe (Trojan.Agent) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KPFW32.exe (Trojan.Agent) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KPFWSvc.exe (Trojan.Agent) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVMonXP.kxp (Trojan.Agent) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVSrvXP.exe (Trojan.Agent) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KWatch.exe (Trojan.Agent) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavMonD.exe (Trojan.Agent) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavTask.exe (Trojan.Agent) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ias (Trojan.Downloader) -> Delete on reboot. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360hotfix.exe (Security.Hijack) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360safebox.exe (Security.Hijack) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360se.exe (Security.Hijack) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360softmgrsvc.exe (Security.Hijack) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360speedld.exe (Security.Hijack) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AST.exe (Security.Hijack) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avcenter.exe (Security.Hijack) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgnt.exe (Security.Hijack) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avguard.exe (Security.Hijack) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avmailc.exe (Security.Hijack) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avwebgrd.exe (Security.Hijack) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ĐŢ¸´ą¤ľß.exe (Security.Hijack) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\egui.exe (Security.Hijack) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ekrn.exe (Security.Hijack) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kissvc.exe (Security.Hijack) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KSWebShield.exe (Security.Hijack) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mcAgent.exe (Security.Hijack) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mcmscsvc.exe (Security.Hijack) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mcnasvc.exe (Security.Hijack) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Mcods.exe (Security.Hijack) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mcproxy.exe (Security.Hijack) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\McSACore.exe (Security.Hijack) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mcshield.exe (Security.Hijack) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mcsysmon.exe (Security.Hijack) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mcvsshld.exe (Security.Hijack) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MpfSrv.exe (Security.Hijack) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MPMon.exe (Security.Hijack) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MPSVC.exe (Security.Hijack) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MPSVC1.exe (Security.Hijack) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MPSVC2.exe (Security.Hijack) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msksrver.exe (Security.Hijack) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\qutmserv.exe (Security.Hijack) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RsAgent.exe (Security.Hijack) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rsnetsvr.exe (Security.Hijack) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RsTray.exe (Security.Hijack) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\safeboxTray.exe (Security.Hijack) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ScanFrm.exe (Security.Hijack) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sched.exe (Security.Hijack) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SFCTLCOM.exe (Security.Hijack) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TMBMSRV.exe (Security.Hijack) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tmproxy.exe (Security.Hijack) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UFSEAGNT.exe (Security.Hijack) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\krnl360svc.exe (Security.Hijack) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\zhudongfangyu.exe (Security.Hijack) -> Quarantined and deleted successfully. Zainfekowane wartości rejestru: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bdAgent.exe\debugger (Security.Hijack) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\livesrv.exe\debugger (Security.Hijack) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\seccenter.exe\debugger (Security.Hijack) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vsserv.exe\debugger (Security.Hijack) -> Quarantined and deleted successfully. Zainfekowane pliki rejestru: (Nie wykryto groźnych plików) Zainfekowane foldery: (Nie wykryto groźnych plików) Zainfekowane pliki: C:\WINDOWS\system32\erpsx.bmp (Trojan.Downloader) -> Delete on reboot.

log z OTL po Malwarybetes:

Kod: Zaznacz wszystko: OTL logfile created on: 2010-01-26 11:04:54 - Run 9 OTL by OldTimer - Version 3.1.25.2 Folder = C:\ Windows Server 2003 Standard Edition Dodatek Service Pack 2 (Version = 5.2.3790) - Type = NTServer Internet Explorer (Version = 7.0.5730.11) Locale: 00000415 | Country: Polska | Language: PLK | Date Format: yyyy-MM-dd 511,00 Mb Total Physical Memory | 282,00 Mb Available Physical Memory | 55,00% Memory free 1,00 Gb Paging File | 1,00 Gb Available in Paging File | 79,00% Paging File free Paging file location(s): C:\pagefile.sys 768 1536 [binary data] %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files Drive C: | 15,96 Gb Total Space | 7,30 Gb Free Space | 45,76% Space Free | Partition Type: NTFS Drive D: | 29,29 Gb Total Space | 16,08 Gb Free Space | 54,91% Space Free | Partition Type: NTFS Drive E: | 29,30 Gb Total Space | 28,52 Gb Free Space | 97,34% Space Free | Partition Type: NTFS F: Drive not present or media not loaded G: Drive not present or media not loaded H: Drive not present or media not loaded I: Drive not present or media not loaded Computer Name: SERWER Current User Name: Administrator Logged in as Administrator. Current Boot Mode: Normal Scan Mode: All users Company Name Whitelist: Off Skip Microsoft Files: Off File Age = 60 Days Output = Standard [color=#E56717]========== Processes (SafeList) ==========[/color] PRC - [2010-01-20 07:39:44 | 00,547,328 | ---- | M] (OldTimer Tools) -- C:\OTL.exe PRC - [2009-12-16 16:26:56 | 02,002,160 | ---- | M] (SUPERAntiSpyware.com) -- C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe PRC - [2008-05-26 21:19:14 | 00,123,904 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Windows Desktop Search\WindowsSearch.exe PRC - [2007-02-17 19:11:45 | 01,054,720 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe PRC - [2003-05-30 08:42:22 | 00,585,728 | ---- | M] (Analog Devices, Inc.) -- C:\Program Files\Analog Devices\SoundMAX\SMax4.exe PRC - [2003-05-29 15:28:32 | 00,790,528 | ---- | M] (Analog Devices, Inc.) -- C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe PRC - [2002-09-20 14:50:10 | 00,045,056 | ---- | M] (Analog Devices, Inc.) -- C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe [color=#E56717]========== Modules (SafeList) ==========[/color] MOD - [2010-01-20 07:39:44 | 00,547,328 | ---- | M] (OldTimer Tools) -- C:\OTL.exe MOD - [2007-02-17 23:14:50 | 01,051,648 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.3790.3959_x-ww_D8713E55\comctl32.dll [color=#E56717]========== Win32 Services (SafeList) ==========[/color] SRV - [2007-08-24 02:19:12 | 00,443,776 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE -- (odserv) SRV - [2007-06-05 08:49:40 | 00,000,000 | ---D | M] [Unknown | Stopped] -- C:\WINDOWS\system32\ias -- (ias) SRV - [2007-02-17 19:13:21 | 00,071,168 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\WINDOWS\system32\tssdis.exe -- (Tssdis) SRV - [2007-02-17 19:12:54 | 00,067,072 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\WINDOWS\system32\rsopprov.exe -- (RSoPProv) SRV - [2007-02-17 19:12:41 | 00,792,576 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\WINDOWS\system32\ntfrs.exe -- (NtFrs) SRV - [2007-02-17 19:11:58 | 00,094,720 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\WINDOWS\system32\llssrv.exe -- (LicenseService) SRV - [2007-02-17 19:11:57 | 00,040,448 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\WINDOWS\system32\ismserv.exe -- (IsmServ) SRV - [2007-02-17 19:11:31 | 00,164,864 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\WINDOWS\system32\dfssvc.exe -- (Dfs) SRV - [2007-02-17 19:03:09 | 00,221,696 | ---- | M] (Shenzhen QVOD Technology Co.,Ltd) [Auto | Stopped] -- C:\WINDOWS\system32\appmgmts.dll -- (AppMgmt) SRV - [2006-10-26 12:03:08 | 00,145,184 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE -- (ose) SRV - [2003-12-05 13:00:00 | 00,050,688 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\WINDOWS\system32\trksvr.dll -- (TrkSvr) SRV - [2003-12-05 13:00:00 | 00,012,288 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\WINDOWS\system32\sacsvr.dll -- (sacsvr) SRV - [2003-06-09 15:45:18 | 00,053,305 | ---- | M] (Intel® Corporation) [Auto | Stopped] -- C:\WINDOWS\system32\AMS_II\IAO.EXE -- (Intel Alert Originator) SRV - [2003-06-09 15:43:38 | 00,028,743 | ---- | M] (Intel® Corporation) [Auto | Stopped] -- C:\WINDOWS\system32\AMS_II\HNDLRSVC.EXE -- (Intel Alert Handler) SRV - [2003-06-09 15:37:20 | 00,036,915 | ---- | M] (Intel® Corporation) [Auto | Stopped] -- C:\WINDOWS\system32\CBA\XFR.EXE -- (Intel File Transfer) SRV - [2002-09-20 14:50:10 | 00,045,056 | ---- | M] (Analog Devices, Inc.) [Auto | Running] -- C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe -- (SoundMAX Agent Service (default)) SRV - [2001-01-05 11:41:24 | 00,022,016 | ---- | M] (Inprise Corporation) [On_Demand | Stopped] -- C:\Program Files\Borland\InterBase\bin\ibguard.exe -- (InterBaseGuardian) SRV - [2001-01-05 11:40:58 | 01,701,888 | ---- | M] (Inprise Corporation) [On_Demand | Stopped] -- C:\Program Files\Borland\InterBase\bin\ibserver.exe -- (InterBaseServer) [color=#E56717]========== Driver Services (SafeList) ==========[/color] DRV - File not found [Kernel | Unknown | Running] -- -- (Oraber) DRV - [2009-12-16 16:27:00 | 00,007,408 | R--- | M] ( SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | On_Demand | Running] -- C:\Program Files\SUPERAntiSpyware\SASENUM.SYS -- (SASENUM) DRV - [2009-12-16 16:26:58 | 00,009,968 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] -- C:\Program Files\SUPERAntiSpyware\sasdifsv.sys -- (SASDIFSV) DRV - [2009-12-16 16:26:56 | 00,074,480 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] -- C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS -- (SASKUTIL) DRV - [2007-11-13 10:32:27 | 00,020,480 | ---- | M] (Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\secdrv.sys -- (Secdrv) DRV - [2007-02-17 17:49:15 | 00,179,712 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\wlbs.sys -- (WLBS) DRV - [2007-02-17 07:06:39 | 00,020,480 | ---- | M] (Parallel Technologies, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ptilink.sys -- (Ptilink) DRV - [2007-02-17 07:02:56 | 00,069,120 | ---- | M] (Microsoft Corporation) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\drivers\clusdisk.sys -- (ClusDisk) DRV - [2007-02-17 06:51:18 | 00,034,816 | ---- | M] (Microsoft Corporation) [File_System | Boot | Running] -- C:\WINDOWS\system32\drivers\Dfs.sys -- (DfsDriver) DRV - [2005-06-28 14:36:01 | 00,274,816 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\WINDOWS\system32\drivers\iaStor.sys -- (iaStor) DRV - [2005-03-24 17:57:28 | 00,020,992 | ---- | M] (Realtek Semiconductor Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\RTL8139.sys -- (rtl8139) Sterownik NT karty Realtek RTL8139(A/B/C) DRV - [2005-03-24 16:57:20 | 01,897,408 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\nv4_mini.sys -- (nv) DRV - [2003-07-31 10:53:28 | 00,147,456 | ---- | M] (3Com Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\EL2K_XP.sys -- (EL2000) DRV - [2003-06-02 12:42:14 | 00,578,304 | ---- | M] (Analog Devices, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\smwdm.sys -- (smwdm) DRV - [2003-03-25 06:15:56 | 00,070,687 | ---- | M] (3Com Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\el90xbc5.sys -- (EL90XBC) DRV - [2003-03-13 11:34:48 | 00,100,224 | ---- | M] (Andrea Electronics Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\aeaudio.sys -- (aeaudio) DRV - [2002-09-20 03:53:34 | 00,235,100 | ---- | M] (Analog Devices Inc) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\MidiSyn.sys -- (MidiSyn) [color=#E56717]========== Standard Registry (SafeList) ==========[/color] [color=#E56717]========== Internet Explorer ==========[/color] IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm IE - HKU\.DEFAULT\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-18\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-21-736918724-1550886709-2363648436-500\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = res://shdoclc.dll/hardAdmin.htm IE - HKU\S-1-5-21-736918724-1550886709-2363648436-500\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = res://shdoclc.dll/hardAdmin.htm IE - HKU\S-1-5-21-736918724-1550886709-2363648436-500\S-1-5-21-736918724-1550886709-2363648436-500\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 [color=#E56717]========== FireFox ==========[/color] FF - HKLM\software\mozilla\Mozilla Firefox 3.5.7\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010-01-08 08:53:02 | 00,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Firefox 3.5.7\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010-01-08 08:52:49 | 00,000,000 | ---D | M] [2010-01-08 08:53:06 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Extensions [2010-01-08 08:53:06 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Firefox\Profiles\i7i5fd9i.default\extensions [2010-01-06 07:54:15 | 00,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions [2009-12-22 04:48:34 | 00,002,767 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\allegro-pl.xml [2009-12-22 04:48:34 | 00,001,406 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\fbc-pl.xml [2009-12-22 04:48:34 | 00,000,917 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\merlin-pl.xml [2009-12-22 04:48:34 | 00,000,858 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\pwn-pl.xml [2009-12-22 04:48:34 | 00,001,183 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\wikipedia-pl.xml [2009-12-22 04:48:34 | 00,001,683 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\wp-pl.xml O1 HOSTS File: ([2003-12-05 13:00:00 | 00,000,742 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts O1 - Hosts: 127.0.0.1 localhost O2 - BHO: (AcroIEHlprObj Class) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0 CE\Reader\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated) O4 - HKLM..\Run: [SoundMAX] C:\Program Files\Analog Devices\SoundMAX\Smax4.exe (Analog Devices, Inc.) O4 - HKLM..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe (Analog Devices, Inc.) O4 - HKU\S-1-5-21-736918724-1550886709-2363648436-500..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe File not found O4 - HKU\S-1-5-21-736918724-1550886709-2363648436-500..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe (SUPERAntiSpyware.com) O4 - HKU\.DEFAULT..\RunOnce: [tscuninstall] C:\WINDOWS\system32\tscupgrd.exe (Microsoft Corporation) O4 - HKU\S-1-5-18..\RunOnce: [tscuninstall] C:\WINDOWS\system32\tscupgrd.exe (Microsoft Corporation) O4 - HKU\S-1-5-19..\RunOnce: [tscuninstall] C:\WINDOWS\system32\tscupgrd.exe (Microsoft Corporation) O4 - HKU\S-1-5-20..\RunOnce: [tscuninstall] C:\WINDOWS\system32\tscupgrd.exe (Microsoft Corporation) O4 - Startup: C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Windows Search.lnk = C:\Program Files\Windows Desktop Search\WindowsSearch.exe (Microsoft Corporation) O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: ShowSuperHidden = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: disablecad = 0 O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 149 O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 149 O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 149 O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 149 O7 - HKU\S-1-5-21-736918724-1550886709-2363648436-500\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 149 O8 - Extra context menu item: E&ksportuj do programu Microsoft Excel - C:\Program Files\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation) O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program Files\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation) O15 - HKLM\..Trusted Domains: 1 domain(s) and sub-domain(s) not assigned to a zone. O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1119961872862 (WUWebControl Class) O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll (Microsoft Corporation) O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation) O20 - Winlogon\Notify\!SASWinLogon: DllName - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll (SUPERAntiSpyware.com) O24 - Desktop Components:0 (Moja bieżąca strona główna) - About:Home O28 - HKLM ShellExecuteHooks: {56F9679E-7826-4C84-81F3-532071A8BCC5} - C:\Program Files\Windows Desktop Search\MsnlNamespaceMgr.dll (Microsoft Corporation) O28 - HKLM ShellExecuteHooks: {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - C:\Program Files\SUPERAntiSpyware\SASSEH.DLL (SuperAdBlocker.com) O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2005-06-28 12:50:31 | 00,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ] O34 - HKLM BootExecute: (autocheck autochk *) - File not found O35 - comfile [open] -- "%1" %* O35 - exefile [open] -- "%1" %* [color=#E56717]========== Files/Folders - Created Within 60 Days ==========[/color] [2010-01-26 09:38:02 | 00,000,000 | ---D | C] -- C:\Program Files\ESET [2010-01-26 09:26:59 | 00,000,000 | RH-D | C] -- C:\Documents and Settings\Administrator\Recent [2010-01-26 09:26:01 | 00,000,000 | ---D | C] -- C:\Program Files\CCleaner [2010-01-20 14:40:21 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Dane aplikacji\Windows Search [2010-01-20 10:20:27 | 00,547,328 | ---- | C] (OldTimer Tools) -- C:\OTL.exe [2010-01-20 08:26:55 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Ustawienia lokalne\Dane aplikacji\PCHealth [2010-01-14 07:52:13 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Moje dokumenty\Pobieranie [2010-01-13 09:06:00 | 00,421,376 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\aclayers.dll [2010-01-08 08:52:59 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Ustawienia lokalne\Dane aplikacji\Mozilla [2010-01-08 08:52:59 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla [2010-01-08 08:52:34 | 08,794,176 | ---- | C] (Mozilla) -- C:\Documents and Settings\Administrator\Pulpit\Firefox Setup 3.5.7.exe [2010-01-07 14:39:55 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Dane aplikacji\SUPERAntiSpyware.com [2010-01-07 14:39:44 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Dane aplikacji\SUPERAntiSpyware.com [2010-01-07 14:39:44 | 00,000,000 | ---D | C] -- C:\Program Files\SUPERAntiSpyware [2010-01-07 14:39:30 | 00,000,000 | ---D | C] -- C:\Program Files\Common Files\Wise Installation Wizard [2010-01-07 13:37:08 | 00,000,000 | ---D | C] -- C:\WINDOWS\System32\MMX7S9 [2010-01-07 13:23:59 | 00,000,000 | ---D | C] -- C:\WINDOWS\System32\JHV [2010-01-07 12:59:08 | 00,000,000 | ---D | C] -- C:\WINDOWS\System32\iSql [2010-01-06 15:22:32 | 01,871,872 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\mstscax.dll [2010-01-06 15:22:31 | 00,282,624 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\wmpdxm.dll [2010-01-06 15:22:23 | 00,067,584 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\mqdssvc.exe [2010-01-06 15:22:23 | 00,054,784 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\mqupgrd.dll [2010-01-06 15:22:23 | 00,051,712 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\mqdssrv.dll [2010-01-06 15:22:23 | 00,045,056 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\mqgentr.dll [2010-01-06 15:22:23 | 00,029,184 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\mqise.dll [2010-01-06 15:22:22 | 00,836,608 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\mqqm.dll [2010-01-06 15:22:22 | 00,540,160 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\mqsnap.dll [2010-01-06 15:22:22 | 00,240,640 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\mqoa.dll [2010-01-06 15:22:22 | 00,200,704 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\mqads.dll [2010-01-06 15:22:22 | 00,180,736 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\mqrt.dll [2010-01-06 15:22:22 | 00,155,136 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\mqad.dll [2010-01-06 15:22:22 | 00,142,336 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\mqsec.dll [2010-01-06 15:22:22 | 00,140,288 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\mqtrig.dll [2010-01-06 15:22:22 | 00,125,440 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\mqrtdep.dll [2010-01-06 15:22:22 | 00,101,888 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\mqac.sys [2010-01-06 15:22:22 | 00,086,528 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\mqtgsvc.exe [2010-01-06 15:22:22 | 00,076,288 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\mqlogmgr.dll [2010-01-06 15:22:22 | 00,049,664 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\mqdscli.dll [2010-01-06 15:22:22 | 00,030,208 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\mqbkup.exe [2010-01-06 15:22:22 | 00,014,336 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\mqperf.dll [2010-01-06 15:22:22 | 00,009,728 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\mqcertui.dll [2010-01-06 15:22:22 | 00,006,144 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\mqsvc.exe [2010-01-06 15:21:48 | 00,086,016 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\avifil32.dll [2010-01-06 15:20:58 | 00,353,792 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\kerberos.dll [2010-01-06 15:20:58 | 00,150,016 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\schannel.dll [2010-01-06 15:20:58 | 00,134,656 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\ksecdd.sys [2010-01-06 15:20:58 | 00,081,408 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\wdigest.dll [2010-01-06 15:20:58 | 00,065,536 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\secur32.dll [2010-01-06 15:20:46 | 00,315,392 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\mscorjit.dll [2010-01-06 15:20:43 | 00,049,664 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\sc.exe [2010-01-06 09:53:58 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Dane aplikacji\Malwarebytes [2010-01-06 09:53:53 | 00,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys [2010-01-06 09:53:46 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Dane aplikacji\Malwarebytes [2010-01-06 09:53:45 | 00,019,160 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys [2010-01-06 09:41:03 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\DoctorWeb [2010-01-06 09:38:21 | 00,028,160 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\usbstor.sys [2010-01-06 09:05:30 | 00,020,992 | ---- | C] (Realtek Semiconductor Corporation) -- C:\WINDOWS\System32\drivers\RTL8139.sys [2010-01-06 09:05:30 | 00,020,992 | ---- | C] (Realtek Semiconductor Corporation) -- C:\WINDOWS\System32\dllcache\rtl8139.sys [2010-01-06 08:29:25 | 00,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware [2010-01-06 07:54:13 | 00,000,000 | ---D | C] -- C:\Program Files\Mozilla Firefox [2010-01-05 14:36:10 | 00,000,000 | ---D | C] -- C:\combo dla 2003 [2010-01-05 14:36:08 | 00,000,000 | ---D | C] -- C:\nowe [2005-06-28 12:54:48 | 00,000,000 | ---D | M] -- C:\Documents and Settings\NetworkService\Ustawienia lokalne\Dane aplikacji\Microsoft [2005-06-28 12:54:48 | 00,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Ustawienia lokalne\Dane aplikacji\Microsoft [2005-06-28 12:50:16 | 00,000,000 | --SD | M] -- C:\Documents and Settings\NetworkService\Dane aplikacji\Microsoft [2005-06-28 12:50:16 | 00,000,000 | --SD | M] -- C:\Documents and Settings\LocalService\Dane aplikacji\Microsoft [color=#E56717]========== Files - Modified Within 60 Days ==========[/color] [2010-01-26 11:03:44 | 00,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat [2010-01-26 11:03:44 | 00,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT [2010-01-26 11:02:41 | 00,000,188 | -HS- | M] () -- C:\Documents and Settings\Administrator\ntuser.ini [2010-01-26 11:02:35 | 02,097,152 | -H-- | M] () -- C:\Documents and Settings\Administrator\NTUSER.DAT [2010-01-26 10:35:47 | 01,126,608 | ---- | M] () -- C:\WINDOWS\System32\PerfStringBackup.INI [2010-01-26 10:35:47 | 00,517,464 | ---- | M] () -- C:\WINDOWS\System32\perfh015.dat [2010-01-26 10:35:47 | 00,435,834 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat [2010-01-26 10:35:47 | 00,091,926 | ---- | M] () -- C:\WINDOWS\System32\perfc015.dat [2010-01-26 10:35:47 | 00,066,714 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat [2010-01-26 09:46:08 | 00,035,608 | ---- | M] () -- C:\Documents and Settings\Administrator\Pulpit\eset.JPG [2010-01-26 09:29:54 | 38,743,552 | ---- | M] () -- C:\essbe_nt32_plk.msi [2010-01-26 09:26:02 | 00,001,548 | ---- | M] () -- C:\Documents and Settings\Administrator\Pulpit\CCleaner.lnk [2010-01-25 09:22:15 | 00,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl [2010-01-25 09:19:10 | 00,007,135 | ---- | M] () -- C:\fix.reg [2010-01-21 07:29:20 | 00,001,367 | ---- | M] () -- C:\Documents and Settings\All Users\Pulpit\Kreator konfiguracji zabezpieczeń.lnk [2010-01-20 14:23:36 | 00,000,162 | -H-- | M] () -- C:\Documents and Settings\Administrator\Pulpit\~$uchom OTL i w oknie Custom Scans.docx [2010-01-20 08:22:20 | 00,269,392 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT [2010-01-20 08:21:01 | 05,884,688 | -H-- | M] () -- C:\Documents and Settings\Administrator\Ustawienia lokalne\Dane aplikacji\IconCache.db [2010-01-20 07:55:56 | 00,000,118 | ---- | M] () -- C:\WINDOWS\System32\MRT.INI [2010-01-20 07:39:44 | 00,547,328 | ---- | M] (OldTimer Tools) -- C:\OTL.exe [2010-01-15 07:28:21 | 00,013,030 | ---- | M] () -- C:\PDOXUSRS.NET [2010-01-08 08:53:04 | 00,000,000 | ---- | M] () -- C:\WINDOWS\nsreg.dat [2010-01-08 08:52:51 | 00,001,602 | ---- | M] () -- C:\Documents and Settings\All Users\Pulpit\Mozilla Firefox.lnk [2010-01-07 14:39:49 | 00,000,780 | ---- | M] () -- C:\Documents and Settings\All Users\Pulpit\SUPERAntiSpyware Free Edition.lnk [2010-01-06 09:53:55 | 00,000,696 | ---- | M] () -- C:\Documents and Settings\All Users\Pulpit\Malwarebytes' Anti-Malware.lnk [2010-01-06 07:52:06 | 08,794,176 | ---- | M] (Mozilla) -- C:\Documents and Settings\Administrator\Pulpit\Firefox Setup 3.5.7.exe [2010-01-05 14:48:20 | 00,731,136 | ---- | M] () -- C:\avenger.exe [2010-01-05 14:23:02 | 03,819,182 | ---- | M] () -- C:\ComboFix.exe [2009-12-30 14:55:24 | 00,038,224 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys [2009-12-30 14:54:58 | 00,019,160 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys [color=#E56717]========== Files Created - No Company Name ==========[/color] [2010-01-26 09:46:07 | 00,035,608 | ---- | C] () -- C:\Documents and Settings\Administrator\Pulpit\eset.JPG [2010-01-26 09:37:17 | 38,743,552 | ---- | C] () -- C:\essbe_nt32_plk.msi [2010-01-26 09:26:02 | 00,001,548 | ---- | C] () -- C:\Documents and Settings\Administrator\Pulpit\CCleaner.lnk [2010-01-25 09:19:10 | 00,007,135 | ---- | C] () -- C:\fix.reg [2010-01-25 07:44:02 | 00,731,136 | ---- | C] () -- C:\avenger.exe [2010-01-20 14:23:36 | 00,000,162 | -H-- | C] () -- C:\Documents and Settings\Administrator\Pulpit\~$uchom OTL i w oknie Custom Scans.docx [2010-01-20 07:55:56 | 00,000,118 | ---- | C] () -- C:\WINDOWS\System32\MRT.INI [2010-01-08 08:53:04 | 00,000,000 | ---- | C] () -- C:\WINDOWS\nsreg.dat [2010-01-08 08:52:51 | 00,001,602 | ---- | C] () -- C:\Documents and Settings\All Users\Pulpit\Mozilla Firefox.lnk [2010-01-07 14:39:49 | 00,000,780 | ---- | C] () -- C:\Documents and Settings\All Users\Pulpit\SUPERAntiSpyware Free Edition.lnk [2010-01-06 09:53:55 | 00,000,696 | ---- | C] () -- C:\Documents and Settings\All Users\Pulpit\Malwarebytes' Anti-Malware.lnk [2010-01-05 14:20:42 | 03,819,182 | ---- | C] () -- C:\ComboFix.exe [2008-05-26 21:22:36 | 00,016,222 | ---- | C] () -- C:\WINDOWS\System32\gthrctr.ini [2008-05-26 21:22:34 | 00,021,728 | ---- | C] () -- C:\WINDOWS\System32\idxcntrs.ini [2008-05-26 21:22:32 | 00,016,164 | ---- | C] () -- C:\WINDOWS\System32\gsrvctr.ini [2007-03-30 07:48:23 | 00,061,080 | ---- | C] () -- C:\Documents and Settings\LocalService\Ustawienia lokalne\Dane aplikacji\FontCache3.0.0.0.dat [2007-01-24 12:01:33 | 00,000,466 | ---- | C] () -- C:\WINDOWS\WININIT.INI [2005-07-05 19:53:50 | 00,000,138 | ---- | C] () -- C:\Documents and Settings\Administrator\Ustawienia lokalne\Dane aplikacji\fusioncache.dat [2005-06-28 14:18:48 | 00,000,000 | ---- | C] () -- C:\WINDOWS\VPC32.INI [2005-06-28 13:07:22 | 00,005,824 | ---- | C] () -- C:\WINDOWS\System32\drivers\ASUSHWIO.SYS [2005-06-28 13:07:22 | 00,002,444 | ---- | C] () -- C:\WINDOWS\Ascd_tmp.ini [2005-03-24 18:17:30 | 00,179,577 | ---- | C] () -- C:\WINDOWS\System32\schema.ini [2003-12-05 13:00:00 | 00,051,737 | ---- | C] () -- C:\WINDOWS\System32\ntdsctrs.ini [2003-12-05 13:00:00 | 00,041,400 | ---- | C] () -- C:\WINDOWS\System32\ntfrsrep.ini [2003-12-05 13:00:00 | 00,023,348 | ---- | C] () -- C:\WINDOWS\System32\iasperf.ini [2003-12-05 13:00:00 | 00,023,192 | ---- | C] () -- C:\WINDOWS\System32\ipsecprf.ini [2003-12-05 13:00:00 | 00,010,621 | ---- | C] () -- C:\WINDOWS\System32\ntfrscon.ini < End of report >

**Posty:** 2183 · przez **NieWiem** 26 Sty 2010, 12:30

Tu jest rootkit, którego nie widzi OTL.

Pobierz RootRepeal.
Kliknij dwukrotnie na ikonę, aby uruchomić program (użytkownicy systemów Vista oraz Se7en => prawoklik oraz wybrać opcję Uruchom jako Administrator).
Na dole okna wybierz zakładkę Report
Wciśnij przycisk Scan. W wyskakującym oknie zaznacz następujące opcje:
- Drivers
- Processes
- SSDT
- Hidden Services
Wciskamy OK i w następnym oknie zaznaczamy all drives.
Upewniamy się, żę wszystkie inne okna czy komunikatory są wyłączone - ten skan może dawać wiele fałszywych odczytów, więc nie powinno się mu przeszkadzać.
Ponowne wciśnięcie OK uruchomi program.
Po zakończonym skanowaniu dostępny stanie się przycisk Save Report. Wciskamy i zapisujemy wyniki skanowania.
Ten raport może być dość długi, dlatego zalecam, aby wkleić go na stronie http://www.wklej.org, a w swoim poście podać tylko link do strony z wynikami.

Jeśli nie będzie chciało pójść - napisz.

**Posty:** 5 · przez **savage_pl** 26 Sty 2010, 12:37

No niestety;/

Po kliknięciou scan i wybraniu
* Drivers
* Processes
* SSDT
* Hidden Services

Następuje zrzut pamięci;/ (ulubiony bluescreen);/

**Posty:** 2183 · przez **NieWiem** 26 Sty 2010, 12:42

Widzę, że założyłeś na kilku forach tematy i wszędzie Ci pomagają.

W związku z tym ten temat jest zamknięty.

Kontynuuj tutaj:
http://www.searchengines.pl/Problem-z-robakami-virusami-typu-BackDoor-itp-t134427.html

Bo jak Ci wszyscy zaczną naraz pomagać, to dopiero będziesz miał burdel na kompie.

**Posty:** 5 · przez **savage_pl** 26 Sty 2010, 12:44

Tak, założyłem temat też na innym forum,
ale nikt nie potrafi pomóc...
na SE mój temat stoi w miejscu ;(
Wydaje mi się, że tylko tu mogę znaleźć pomoc i zakończyć trwający już ponad tydzień męki z tym ;(

Proszę nie zamykać tematu

**Posty:** 2183 · przez **NieWiem** 26 Sty 2010, 12:47

Na pebie osobiście zamknąłem dzisiaj kolejny Twój temat. Nie popieram takiego działania.

Kto jest na forum