Wirus - komputer restartuje sie co 5minut

**Posty:** 189 · przez **Olek9** 04 Mar 2009, 22:15

Komputer restartuje sie co jakieś 5minut

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 21:12:57, on 2009-03-04 Platform: Windows XP Dodatek SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\ATKKBService.exe C:\WINDOWS\system32\crypserv.exe C:\Program Files\iolo\common\lib\ioloServiceManager.exe C:\WINDOWS\runservice.exe C:\WINDOWS\system32\nvsvc32.exe C:\Program Files\PC Tools Firewall Plus\FWService.exe C:\WINDOWS\system32\PnkBstrA.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\SOUNDMAN.EXE C:\Program Files\PC Tools Firewall Plus\FirewallGUI.exe C:\Program Files\Netia\Net\netianet.exe C:\Program Files\DAEMON Tools Lite\daemon.exe C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe C:\WINDOWS\system32\wuauclt.exe C:\Program Files\Opera\opera.exe C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe C:\Gadu-Gadu 7.0.6\gg.exe C:\WINDOWS\system32\taskmgr.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\NEOSTR~1\SEARCH~1.DLL O1 - Hosts: <HTML><HEAD><TITLE>Yahoo!</TITLE> O1 - Hosts: </HEAD><BODY BGCOLOR=white vlink=blue> O1 - Hosts:  O1 - Hosts: <center> O1 - Hosts: <table width=675 cellpadding=0 cellspacing=2 border=0> O1 - Hosts: <tr> O1 - Hosts: <td width=1% valign=top><a href="http://www.yahoo.com"><img src=http://us.i1.yimg.com/us.yimg.com/i/yahoo.gif width=147 height=31 border=0 alt="Yahoo"></a></td> O1 - Hosts: <td align=right><font face=arial size=-1><a href="/404/*http://www.yahoo.com">Yahoo!</a> - <a href="http://help.yahoo.com">Help</a></font><hr size=1 noshade></td> O1 - Hosts: </tr> O1 - Hosts: </table> O1 - Hosts: <br> O1 - Hosts: <table border=0 width=675 cellspacing=0 cellpadding=3> O1 - Hosts: <tr> O1 - Hosts: <td bgcolor=003399 colspan=2> O1 - Hosts: <font face=Arial size=+1 color=white><b>Sorry, the page you requested was not found.</b></font> O1 - Hosts: </td> O1 - Hosts: </tr></table> O1 - Hosts: <br> O1 - Hosts: <table border=0 width=675 cellspacing=0 cellpadding=1> O1 - Hosts: <tr> O1 - Hosts: <td valign=top width=229 bgcolor=ffffff> O1 - Hosts: <table width="100%" cellpadding=1 cellspacing=0 border=0 bgcolor=dcdcdc><tr> O1 - Hosts: <td valign=top align=center><table width="100%" cellpadding=3 cellspacing=0 border=0 bgcolor=ffffff> O1 - Hosts: <tr bgcolor=dcdcdc><td><font face=arial><b>Search Yahoo!</b></font></td></tr> O1 - Hosts: <tr bgcolor=white><td valign=top align=center> O1 - Hosts: <form action="http://search.yahoo.com/search"> O1 - Hosts: <input size="14" name="p" value="">  O1 - Hosts: <input type="SUBMIT" value="Search"> O1 - Hosts: <font face=arial size=-2> <a href="http://search.yahoo.com/search/options?p=">advanced search</a>  <a href="http://buzz.yahoo.com">most popular</a></font> O1 - Hosts: </form></td></tr></table> O1 - Hosts: <table width=100% border=0 cellspacing=0 cellpadding=3 bgcolor=ffffff> O1 - Hosts: <tr bgcolor=ccccff><td> O1 - Hosts: <FONT face=arial size=+1>Yahoo! Web Hosting</font> O1 - Hosts: </td></tr> O1 - Hosts: <tr><td> O1 - Hosts: <a href=http://webhosting.yahoo.com/ps/wh/prod/><img align=left src=http://us.i1.yimg.com/us.yimg.com/i/us/wh/gr/j_advan48.gif width=48 height=48 border=0 alt="Yahoo! Web Hosting"></a> O1 - Hosts: <font face=arial size=-1>Yahoo! Web Hosting has <a href="http://webhosting.yahoo.com/ps/wh/prod/">three affordable plans</a> to meet your needs - starting at just $11.95. O1 - Hosts: </td></tr> O1 - Hosts: <tr><td align=right> O1 - Hosts: <b><font face=arial size=-1><a href=http://webhosting.yahoo.com/ps/wh/prod/>Learn more...</a></font></b> O1 - Hosts: </td></tr> O1 - Hosts: </table> O1 - Hosts: </td></tr></table> O1 - Hosts: </td> O1 - Hosts: <td width=1> </td> O1 - Hosts: <td valign=top align=center width=445> O1 - Hosts: <script language="JavaScript" type="text/javascript" O1 - Hosts: src="http://adserver.yahoo.com/a?f=76001284&p=geocities&l=MON&c=sr"> O1 - Hosts: </script> O1 - Hosts: <noscript> O1 - Hosts: <iframe O1 - Hosts: src="http://adserver.yahoo.com/a?f=76001284&p=geocities&l=MON&c=sh&bg=ffffff" O1 - Hosts: width=470 height=580 marginwidth=0 marginheight=0 hspace=0 O1 - Hosts: vspace=0 frameborder=0 scrolling=no> O1 - Hosts: </iframe> O1 - Hosts: </noscript> O1 - Hosts: </td> O1 - Hosts: </tr> O1 - Hosts: </table> O1 - Hosts: <br> O1 - Hosts: <table cellpadding=0 cellspacing=0 border=0 width=675><tr><td bgcolor=a0b8c8> O1 - Hosts: <table cellpadding=1 cellspacing=1 border=0 width="100%"> O1 - Hosts: <tr valign=top bgcolor=ffffff><td align=center> O1 - Hosts: <font face=arial size=-2><A O1 - Hosts: href="http://rd.yahoo.com/footer/?http://address.yahoo.com/">Address Book</A> · <A O1 - Hosts: href="http://rd.yahoo.com/footer/?http://alerts.yahoo.com/">Alerts</A> · <A O1 - Hosts: href="http://rd.yahoo.com/footer/?http://auctions.yahoo.com/">Auctions</A> · <A O1 - Hosts: href="http://rd.yahoo.com/footer/?http://billpay.yahoo.com/">Bill Pay</A> · <A O1 - Hosts: href="http://rd.yahoo.com/footer/?http://bookmarks.yahoo.com/">Bookmarks</A> · <A O1 - Hosts: href="http://rd.yahoo.com/footer/?http://briefcase.yahoo.com/">Briefcase</A> · <A O1 - Hosts: href="http://rd.yahoo.com/footer/?http://broadcast.yahoo.com/">Broadcast</A> · <A O1 - Hosts: href="http://rd.yahoo.com/footer/?http://calendar.yahoo.com/">Calendar</A> · <A O1 - Hosts: href="http://rd.yahoo.com/footer/?http://chat.yahoo.com/">Chat</A> · <A O1 - Hosts: href="http://rd.yahoo.com/footer/?http://classifieds.yahoo.com/">Classifieds</A> · <A O1 - Hosts: href="http://rd.yahoo.com/footer/?http://clubs.yahoo.com/">Clubs</A> · <A O1 - Hosts: href="http://rd.yahoo.com/footer/?http://companion.yahoo.com/">Companion</A> · <A O1 - Hosts: href="http://rd.yahoo.com/footer/?http://experts.yahoo.com/">Experts</A> · <A O1 - Hosts: href="http://rd.yahoo.com/footer/?http://games.yahoo.com/">Games</A> · <A O1 - Hosts: href="http://rd.yahoo.com/footer/?http://greetings.yahoo.com/">Greetings</A> · <A O1 - Hosts: href="http://rd.yahoo.com/footer/?http://geocities.yahoo.com/">Home Pages</A> · <A O1 - Hosts: href="http://rd.yahoo.com/footer/?http://invites.yahoo.com/">Invites</A> · <A O1 - Hosts: href="http://rd.yahoo.com/footer/?http://mail.yahoo.com/">Mail</A> · <A O1 - Hosts: href="http://rd.yahoo.com/footer/?http://maps.yahoo.com/">Maps</A> · <A O1 - Hosts: href="http://rd.yahoo.com/footer/?http://members.yahoo.com/">Member Directory</A> · <A O1 - Hosts: href="http://rd.yahoo.com/footer/?http://messenger.yahoo.com/">Messenger</A> · <A O1 - Hosts: href="http://rd.yahoo.com/footer/?http://my.yahoo.com/">My Yahoo!</A> · <A O1 - Hosts: href="http://rd.yahoo.com/footer/?http://news.yahoo.com/">News</A> · <A O1 - Hosts: href="http://rd.yahoo.com/footer/?http://paydirect.yahoo.com/">PayDirect</A> · <A O1 - Hosts: href="http://rd.yahoo.com/footer/?http://people.yahoo.com/">People Search</A> · <A O1 - Hosts: href="http://rd.yahoo.com/footer/?http://personals.yahoo.com/">Personals</A> · <A O1 - Hosts: href="http://rd.yahoo.com/footer/?http://photos.yahoo.com/">Photos</A> · <A O1 - Hosts: href="http://rd.yahoo.com/footer/?http://shopping.yahoo.com/">Shopping</A> · <A O1 - Hosts: href="http://rd.yahoo.com/footer/?http://sports.yahoo.com/">Sports</A> · <A O1 - Hosts: href="http://rd.yahoo.com/footer/?http://finance.yahoo.com/">Stock Quotes</A> · <A O1 - Hosts: href="http://rd.yahoo.com/footer/?http://tv.yahoo.com/">TV</A> · <A O1 - Hosts: href="http://rd.yahoo.com/footer/?http://travel.yahoo.com/">Travel</A> · <A O1 - Hosts: href="http://rd.yahoo.com/footer/?http://weather.yahoo.com/">Weather</A> · <A O1 - Hosts: href="http://rd.yahoo.com/footer/?http://www.yahooligans.com/">Yahooligans</A> · <A O1 - Hosts: href="http://rd.yahoo.com/footer/?http://yp.yahoo.com/">Yellow Pages</A> · <A O1 - Hosts: href="http://rd.yahoo.com/footer/?http://docs.yahoo.com/docs/family/more.html">more...</A> O1 - Hosts: </font></td></tr></table></td></tr></table> O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.1.9.24.dll O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [00PCTFW] "C:\Program Files\PC Tools Firewall Plus\FirewallGUI.exe" -s O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k O4 - HKLM\..\Run: [RivaTunerStartupDaemon] "C:\Program Files\RivaTuner v2.22\RivaTuner.exe" /S O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [NETIANET] C:\Program Files\Netia\Net\netianet.exe -auto O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\pchealth\helpctr\Binaries\MSCONFIG.EXE /auto O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe O4 - HKUS\S-1-5-21-1547161642-329068152-682003330-500\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe (User 'Administrator') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1 O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\WINDOWS\system32\shdocvw.dll O9 - Extra 'Tools' menuitem: Windows Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\WINDOWS\system32\shdocvw.dll O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\npjpi160_07.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\npjpi160_07.dll O9 - Extra button: BitComet Search - {461CC20B-FB6E-4f16-8FE8-C29359DB100E} - C:\Program Files\BitComet\tools\BitCometBHO_1.1.9.24.dll O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} - http://download.bitdefender.com/resources/scan8/oscan8.cab O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - https://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{390A465C-446F-4A51-9070-8242F6ACA0E7}: NameServer = 213.241.79.37 83.238.255.76 O23 - Service: Ares Chatroom server (AresChatServer) - Ares Development Group - C:\Program Files\Ares\chatServer.exe O23 - Service: ATK Keyboard Service (ATKKeyboardService) - ASUSTeK COMPUTER INC. - C:\WINDOWS\ATKKBService.exe O23 - Service: Crypkey License - CrypKey (Canada) Ltd. - C:\WINDOWS\SYSTEM32\crypserv.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iolo FileInfoList Service (ioloFileInfoList) - Unknown owner - C:\Program Files\iolo\common\lib\ioloServiceManager.exe O23 - Service: iolo System Service (ioloSystemService) - Unknown owner - C:\Program Files\iolo\common\lib\ioloServiceManager.exe O23 - Service: LicCtrl Service (LicCtrlService) - Unknown owner - C:\WINDOWS\runservice.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: PC Tools Firewall Plus (PCToolsFirewallPlus) - PC Tools - C:\Program Files\PC Tools Firewall Plus\FWService.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe O23 - Service: SF FrontLine Drivers Auto Removal (v1) (sfrem01) - Protection Technology (StarForce) - C:\WINDOWS\system32\sfrem01.exe O23 - Service: FrontLine Drivers Auto Removal (v2) (sfrem02) - Protection Technology (StarForce) - C:\WINDOWS\system32\sfrem02.exe -- End of file - 14747 bytes

Kod: Zaznacz wszystko: ComboFix 09-03-03.01 - User 2009-03-04 21:27:31.4 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.3.1250.1.1045.18.1023.685 [GMT 1:00] Uruchomiony z: c:\documents and settings\User\Pulpit\Ja vs Wirusy\ComboFix.exe FW: PC Tools Firewall Plus *enabled* * Utworzono nowy punkt przywracania UWAGA - TEN KOMPUTER NIE MA ZAINSTALOWANEJ KONSOLI ODZYSKIWANIA !! . ((((((((((((((((((((((((((((((((((((((( Usunięto ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\documents and settings\User\Dane aplikacji\EurekaLog c:\windows\system32\SrchSTS.exe . ((((((((((((((((((((((((( Pliki utworzone od 2009-02-04 do 2009-03-04 ))))))))))))))))))))))))))))))) . 2009-03-03 21:59 . 2009-03-03 21:59 <DIR> d-------- c:\documents and settings\User\Dane aplikacji\Disney Interactive Studios 2009-03-03 21:12 . 2009-03-03 21:58 836 --a------ c:\windows\disney.ini 2009-03-02 15:38 . 2009-03-02 15:38 2,321,408 --a------ c:\windows\system32\TUKernel.exe 2009-03-02 15:34 . 2009-03-02 15:34 <DIR> d-------- c:\program files\TuneUp Utilities 2007 2009-03-02 15:34 . 2009-03-02 15:34 <DIR> d-------- c:\documents and settings\User\Dane aplikacji\TuneUp Software 2009-03-02 15:34 . 2009-03-02 15:34 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\TuneUp Software 2009-03-02 15:34 . 2007-05-16 08:41 29,704 --a------ c:\windows\system32\uxtuneup.dll 2009-03-02 14:47 . 2009-03-02 14:47 <DIR> d-------- c:\program files\Reg Organizer 2009-03-02 14:47 . 2009-03-02 14:47 <DIR> d-------- c:\documents and settings\User\Dane aplikacji\ChemTable Software 2009-03-02 14:47 . 2009-03-02 14:47 <DIR> d-------- C:\ChemTable Software 2009-03-01 17:02 . 2009-03-01 17:02 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\nView_Profiles 2009-02-28 01:13 . 2009-02-28 09:46 420,641,269 --a------ C:\wrestler.rmvb 2009-02-27 18:42 . 2009-02-27 18:42 <DIR> d-------- c:\program files\CCleaner 2009-02-26 19:46 . 2009-02-26 19:46 42,320 --a------ c:\windows\system32\xfcodec.dll 2009-02-26 10:47 . 2009-02-26 10:47 1,388,544 --a------ c:\windows\system32\msvbvm60.dll 2009-02-26 10:47 . 2009-02-26 10:47 459,776 --a------ c:\windows\system32\converter.dll 2009-02-26 10:47 . 2009-02-26 10:47 417,792 --a------ c:\windows\system32\DICOM_DLL.dll 2009-02-26 10:47 . 2009-02-26 10:47 245,760 --a------ c:\windows\system32\qprinter.dll 2009-02-26 10:47 . 2009-02-26 10:47 140,488 --a------ c:\windows\system32\comdlg32.ocx 2009-02-26 10:47 . 2009-02-26 10:47 101,888 --a------ c:\windows\system32\VB6STKIT.DLL 2009-02-26 10:47 . 2009-02-26 10:47 40,960 --a------ c:\windows\system32\CreateAVI.dll 2009-02-25 17:11 . 2009-02-25 17:11 <DIR> d-------- c:\windows\nview 2009-02-25 17:11 . 2009-02-09 13:18 453,152 --a------ c:\windows\system32\nvudisp.exe 2009-02-25 17:11 . 2009-03-04 21:04 212,010 --a------ c:\windows\system32\nvapps.xml 2009-02-25 17:11 . 2009-02-09 13:18 18,795 --a------ c:\windows\system32\nvdisp.nvu 2009-02-25 17:10 . 2009-02-05 10:54 453,152 --a------ c:\windows\system32\NVUNINST.EXE 2009-02-24 22:01 . 2009-02-24 22:01 <DIR> d-------- c:\program files\SoftprojectGP 2009-02-19 17:39 . 2009-02-20 11:25 45,032 --a------ C:\GDIPFONTCACHEV1.DAT 2009-02-18 18:30 . 2009-02-18 18:30 <DIR> d-------- C:\NVIDIA 2009-02-17 11:17 . 2009-03-04 16:31 <DIR> d-------- C:\Fraps 2009-02-13 01:58 . 2009-02-17 03:10 366,694,400 --a------ C:\Bestia.z.tropików.2005.DVDRip.LektorPL[szadek].avi 2009-02-11 19:13 . 2009-02-22 19:35 <DIR> d-------- c:\program files\Activision 2009-02-09 18:29 . 2009-02-09 18:29 <DIR> d-------- c:\program files\RivaTuner v2.22 2009-02-07 16:12 . 2009-02-07 16:23 <DIR> d-------- c:\program files\RAXCO 2009-02-07 12:10 . 2008-12-29 09:30 4,224 --a------ c:\windows\system32\drivers\NVStrap.sys 2009-02-06 14:24 . 2005-07-20 12:48 59,904 --a------ c:\windows\system32\zlib.dll . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-03-04 20:04 --------- d---a-w c:\documents and settings\All Users\Dane aplikacji\TEMP 2009-03-04 19:52 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\Spybot - Search & Destroy 2009-03-04 19:48 --------- d-----w c:\documents and settings\User\Dane aplikacji\teamspeak2 2009-03-04 19:40 139,152 ----a-w c:\windows\system32\drivers\PnkBstrK.sys 2009-03-04 19:39 111,928 ----a-w c:\windows\system32\PnkBstrB.exe 2009-03-04 19:39 --------- d-----w c:\documents and settings\User\Dane aplikacji\Xfire 2009-03-04 15:33 --------- d-----w c:\program files\eMule 2009-03-03 20:39 --------- d--h--w c:\program files\InstallShield Installation Information 2009-03-03 20:08 --------- d-s---w c:\program files\Xfire 2009-03-02 20:06 --------- d-----w c:\program files\SpeedFan 2009-03-02 14:33 --------- d-----w c:\program files\Common Files\Wise Installation Wizard 2009-03-01 16:08 --------- d-----w c:\program files\The All-Seeing Eye 2009-03-01 16:08 --------- d-----w c:\program files\RivaTuner v2(3).10 2009-03-01 16:08 --------- d-----w c:\program files\RivaTuner v2(2).10 2009-03-01 16:08 --------- d-----w c:\program files\NetScream 2009-03-01 16:08 --------- d-----w c:\program files\Neostrada TP 2009-03-01 16:08 --------- d-----w c:\documents and settings\User\Dane aplikacji\Ventrilo 2009-03-01 16:08 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\fssg 2009-02-27 16:10 --------- d-----w c:\program files\Driver Cleaner 2009-02-24 19:10 --------- d-----w c:\program files\PC Tools Firewall Plus 2009-02-24 19:08 73,840 ----a-w c:\windows\system32\drivers\PCTAppEvent.sys 2009-02-24 19:07 95,640 ----a-w c:\windows\system32\drivers\pctplfw.sys 2009-02-20 16:51 --------- d-----w c:\program files\AGEIA Technologies 2009-02-20 10:39 --------- d-----w c:\program files\YouTube Video Downloader 2009-02-20 09:33 --------- d-----w c:\documents and settings\User\Dane aplikacji\Skype 2009-02-20 09:17 --------- d-----w c:\program files\Defraggler 2009-02-19 20:48 --------- d-----w c:\program files\Premium Booster 2009-02-13 11:36 --------- d-----w c:\documents and settings\User\Dane aplikacji\ipla 2009-02-05 20:11 86,016 ----a-w c:\windows\system32\OpenAL32.dll 2009-02-05 20:11 262,144 ----a-w c:\windows\system32\wrap_oal.dll 2009-02-01 15:25 --------- d-----w c:\documents and settings\User\Dane aplikacji\ATI 2009-01-31 22:09 --------- d-----w c:\documents and settings\User\Dane aplikacji\Hamachi 2009-01-31 21:16 --------- d-----w c:\program files\Dziobas Rar Player 2009-01-31 15:42 --------- d-----w c:\documents and settings\User\Dane aplikacji\Publish Providers 2009-01-31 15:11 --------- d-----w c:\documents and settings\User\Dane aplikacji\Sony 2009-01-31 14:59 --------- d-----w c:\program files\Common Files\PC Tools 2009-01-31 14:57 --------- d-----w c:\program files\Vstplugins 2009-01-31 14:57 --------- d-----w c:\program files\Sony 2009-01-31 14:57 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\Sony 2009-01-27 21:36 --------- d-----w c:\program files\WorldOfGoo 2009-01-27 21:36 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\2DBoy 2009-01-22 14:21 729,088 ----a-w c:\windows\iun6002.exe 2009-01-16 17:24 70,936 ----a-w c:\windows\system32\PhysXLoader.dll 2009-01-12 19:14 66,872 ----a-w c:\windows\system32\PnkBstrA.exe 2009-01-12 16:32 22,328 ----a-w c:\documents and settings\User\Dane aplikacji\PnkBstrK.sys 2009-01-10 12:52 --------- d-----w c:\documents and settings\User\Dane aplikacji\dyyno-vlc 2009-01-10 12:50 --------- d-----w c:\program files\Dyyno 2009-01-09 16:01 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\ATI 2009-01-09 12:32 --------- d-----w c:\documents and settings\User\Dane aplikacji\Apple Computer 2009-01-09 12:26 --------- d-----w c:\program files\SubEdit-Player 2009-01-09 09:42 --------- d-----w c:\program files\KRAISOFT 2009-01-08 18:30 --------- d-----w c:\documents and settings\User\Dane aplikacji\Smart PC Solutions 2009-01-06 14:03 --------- d-----w c:\program files\AML Products 2009-01-03 08:07 81,920 ----a-w c:\windows\system32\frapsvid.dll 2008-12-12 13:35 74,703 ----a-w c:\windows\system32\mfc45.dll 2008-12-04 15:44 935,776 ----a-w c:\windows\system32\Incinerator.dll 2008-12-04 08:28 24,344 ----a-w c:\windows\system32\PhysXDevice.dll 2008-03-30 19:09 176 ---ha-w c:\documents and settings\User\Dane aplikacji\hpothb07.dat 2008-03-30 13:29 1,599,488 --sha-w c:\documents and settings\User\Moje dokumentyUxm2Pl_cfdg.exe 2006-07-20 00:17 93,653 ----a-w c:\program files\fasterfox-1.0.3-fx.xpi 2006-06-19 10:08 774,144 ----a-w c:\program files\RngInterstitial.dll 2008-10-16 15:06 1,345 --sha-w c:\windows\system32\mmf(10)(2).sys 2008-10-16 16:17 1,345 --sha-w c:\windows\system32\mmf(2)(2).sys 2008-10-16 15:50 1,345 --sha-w c:\windows\system32\mmf(2)(3).sys 2008-10-16 15:42 1,345 --sha-w c:\windows\system32\mmf(2)(4).sys 2008-10-16 16:12 1,345 --sha-w c:\windows\system32\mmf(3)(2).sys 2008-10-16 15:32 1,345 --sha-w c:\windows\system32\mmf(3)(3).sys 2008-10-16 16:08 1,345 --sha-w c:\windows\system32\mmf(4)(2).sys 2008-10-16 15:30 1,345 --sha-w c:\windows\system32\mmf(4)(3).sys 2008-10-16 15:55 1,345 --sha-w c:\windows\system32\mmf(5)(2).sys 2008-10-16 15:23 1,345 --sha-w c:\windows\system32\mmf(5)(3).sys 2008-10-15 13:33 1,345 --sha-w c:\windows\system32\mmf(6)(2).sys 2008-10-16 15:06 1,345 --sha-w c:\windows\system32\mmf(6)(3).sys 2008-10-16 14:33 1,345 --sha-w c:\windows\system32\mmf(7)(2).sys 2008-10-15 20:09 1,345 --sha-w c:\windows\system32\mmf(8)(2).sys 2008-10-15 17:12 1,345 --sha-w c:\windows\system32\mmf(9)(2).sys . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\daemon.exe" [2008-07-24 490952] "SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2008-11-13 2105176] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "00PCTFW"="c:\program files\PC Tools Firewall Plus\FirewallGUI.exe" [2009-02-24 2652056] "RivaTunerStartupDaemon"="c:\program files\RivaTuner v2.22\RivaTuner.exe" [2008-12-29 2732032] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-02-09 13680640] "NETIANET"="c:\program files\Netia\Net\netianet.exe" [2008-10-22 493568] "MSConfig"="c:\windows\pchealth\helpctr\Binaries\MSCONFIG.EXE" [2004-08-03 159744] "SoundMan"="SOUNDMAN.EXE" [2005-07-12 c:\windows\SOUNDMAN.EXE] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-03 15360] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer] "NoResolveTrack"= 1 (0x1) "NoFileAssociate"= 0 (0x0) [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] "NoResolveTrack"= 1 (0x1) [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon] "UIHost"="c:\documents and settings\All Users\Dane aplikacji\TuneUp Software\TuneUp Utilities\WinStyler\tu_logonui.exe" [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "vidc.I420"= i263_32.drv "msacm.l3acm"= l3codecp.acm "vidc.3iv2"= 3ivxVfWCodec.dll "msacm.divxa32"= divxa32.acm "VIDC.HFYU"= huffyuv.dll "VIDC.i263"= i263_32.drv "msacm.imc"= imc32.acm "VIDC.VP31"= vp31vfw.dll "msacm.avis"= ff_acm.acm "VIDC.XFR1"= xfcodec.dll [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager] BootExecute REG_MULTI_SZ autocheck autochk *\[u]0[/u]OODBS [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^GetRight - Tray Icon.lnk] backup=c:\windows\pss\GetRight - Tray Icon.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^hp psc 1000 series.lnk] backup=c:\windows\pss\hp psc 1000 series.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^hpoddt01.exe.lnk] backup=c:\windows\pss\hpoddt01.exe.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^User^Menu Start^Programy^Autostart^Empty.pif] path=c:\documents and settings\User\Menu Start\Programy\Autostart\Empty.pif backup=c:\windows\pss\Empty.pifStartup [HKLM\~\startupfolder\C:^Documents and Settings^User^Menu Start^Programy^Autostart^GM_DevUpdate.lnk] backup=c:\windows\pss\GM_DevUpdate.lnkStartup [HKLM\~\startupfolder\C:^Documents and Settings^User^Menu Start^Programy^Autostart^Morpheus.lnk] [HKLM\~\startupfolder\C:^Documents and Settings^User^Menu Start^Programy^Autostart^Xfire.lnk] backup=c:\windows\pss\Xfire.lnkStartup HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATICCC HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OODefragTray HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TBPanel [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Launch Ai Booster] --a------ 2005-05-05 16:31 3632640 c:\asus\Ai Booster\OverClk.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl] --a------ 2003-10-31 18:42 32768 c:\program files\CyberLink\PowerDVD\PDVDServ.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype] --a------ 2006-05-19 17:11 18577448 c:\program files\Skype\Phone\Skype.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpeedTouch USB Diagnostics] --a------ 2004-01-26 10:38 866816 c:\program files\Thomson\SpeedTouch USB\dragdiag.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched] --a------ 2008-06-10 03:27 144784 c:\program files\Java\jre1.6.0_07\bin\jusched.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Tok-Cirrhatus] --a------ 2008-11-25 09:06 43476 c:\windows\Media\smss.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Tok-Cirrhatus-1398] --a------ 2008-11-25 09:06 43476 c:\windows\Media\smss.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent] --a------ 2008-09-12 17:45 36352 c:\program files\Winamp\winampa.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz] --a------ 2009-02-09 13:18 1657376 c:\windows\system32\nwiz.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-] "ares"="c:\program files\Ares\Ares.exe" -h [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusOverride"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "c:\\Program Files\\Xfire\\xfire.exe"= "c:\\Program Files\\eMule\\emule.exe"= "c:\\Program Files\\The All-Seeing Eye\\eye.exe"= "c:\\Program Files\\BitComet\\BitComet.exe"= "e:\\Battlefield\\Battlefield 1942\\BF1942.exe"= "c:\\Program Files\\Hamachi\\hamachi.exe"= "c:\\WINDOWS\\system32\\dpvsetup.exe"= "c:\\Program Files\\Ares\\Ares.exe"= "c:\\Program Files\\Kazaa Lite Rewolucja\\kazaalite.kpp"= "c:\\WINDOWS\\system32\\dplaysvr.exe"= "c:\\WINDOWS\\system32\\dpnsvr.exe"= "c:\\Documents and Settings\\All Users\\Dane aplikacji\\Kaspersky Lab Setup Files\\Kaspersky Internet Security 2009\\Polish\\setup.exe"= "e:\\Battlefield\\Battlefield 2\\BF2.exe"= "c:\\Gadu-Gadu 7.0.6\\gg.exe"= "c:\\Program Files\\Mozilla Firefox\\firefox.exe"= "c:\\Program Files\\Opera\\opera.exe"= "c:\\Program Files\\Skype\\Phone\\Skype.exe"= R0 sfdrv01a;StarForce Protection Environment Driver (version 1.x.a);c:\windows\system32\drivers\sfdrv01a.sys [2006-07-05 63352] R0 sfdrv02;FrontLine Environment Driver (v2);c:\windows\system32\drivers\sfdrv02.sys [2006-09-11 67960] R0 sfsync05;FrontLine Synchronization Driver (v5);c:\windows\system32\drivers\sfsync05.sys [2006-11-03 61312] R0 VirtualK;VirtaulK;c:\windows\system32\drivers\VirtualK.sys [2008-08-04 3968] R1 pctgntdi;pctgntdi;c:\windows\system32\drivers\pctgntdi.sys [2009-01-31 159600] R2 ioloFileInfoList;iolo FileInfoList Service;c:\program files\iolo\Common\Lib\ioloServiceManager.exe [2008-12-12 596336] R2 ioloSystemService;iolo System Service;c:\program files\iolo\Common\Lib\ioloServiceManager.exe [2008-12-12 596336] R2 LicCtrlService;LicCtrl Service;c:\windows\Runservice.exe [2007-08-19 2560] R2 PCTAppEvent;PCTAppEvent Driver;c:\windows\system32\drivers\PCTAppEvent.sys [2009-01-31 73840] R2 Vcs;Vcs support;c:\windows\system32\drivers\Vcs.sys [2007-12-20 6852] R3 GMFilter;GMFilter HID Filter Driver;c:\windows\system32\drivers\GMFilter.sys [2008-08-04 21760] R3 pctplfw;pctplfw;c:\windows\system32\drivers\pctplfw.sys [2009-01-31 95640] R3 skbusenum;SKBus Enumerator;c:\windows\system32\drivers\SKBusEnum.sys [2008-08-04 10880] R3 uscsc108;uscsc108;c:\windows\system32\drivers\uscsc108.sys [2003-03-09 102336] S0 NVStrap;NVStrap;c:\windows\system32\drivers\NVStrap.sys [2009-02-07 4224] S1 ShldDrv;Panda File Shield Driver;c:\windows\system32\DRIVERS\ShlDrv51.sys --> c:\windows\system32\DRIVERS\ShlDrv51.sys [?] S2 ArcaVirMonitor;ArcaVir Antivirus Monitor Service; [x] S2 PavProc;Panda Process Protection Driver; [x] S2 sfrem02;FrontLine Drivers Auto Removal (v2);c:\windows\system32\sfrem02.exe svc --> c:\windows\system32\sfrem02.exe svc [?] S3 arcaen;ArcaVir Monitor Kernel Engine Driver; [x] S3 arcaev;ArcaVir Monitor Kernel Events Driver; [x] S3 arcafd;ArcaVir Monitor Kernel Filter Driver; [x] S3 ATE_PROCMON;ATE_PROCMON; [x] S3 KS-959;Kingsun KS-959 USB Infrared Adapter;c:\windows\system32\drivers\KS-959.sys [2006-05-10 19034] S3 XDva189;XDva189; [x] HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs UxTuneUp . Zawartość folderu 'Zaplanowane zadania' 2009-03-02 c:\windows\Tasks\1-Click Maintenance.job - c:\program files\TuneUp Utilities 2007\SystemOptimizer.exe [2007-08-02 18:35] . - - - - USUNIĘTO PUSTE WPISY - - - - MSConfigStartUp-Bron-Spizaetus - c:\windows\ShellNew\RakyatKelaparan.exe . ------- Skan uzupełniający ------- . mStart Page = about:blank IE: &D&ownload &with BitComet - c:\program files\BitComet\BitComet.exe/AddLink.htm IE: &D&ownload all video with BitComet - c:\program files\BitComet\BitComet.exe/AddVideo.htm IE: &D&ownload all with BitComet - c:\program files\BitComet\BitComet.exe/AddAllLink.htm IE: E&ksport do programu Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 TCP: {390A465C-446F-4A51-9070-8242F6ACA0E7} = 213.241.79.37 83.238.255.76 FF - ProfilePath - c:\documents and settings\User\Dane aplikacji\Mozilla\Firefox\Profiles\o4f53a07.default\ FF - plugin: c:\documents and settings\User\Dane aplikacji\Mozilla\Firefox\Profiles\o4f53a07.default\extensions\NPDyyno@dyyno.com\plugins\npDyyno.dll FF - plugin: c:\program files\Dyyno\Dyyno Player\npvlc.dll FF - plugin: c:\program files\K-Lite Codec Pack\Real\browser\plugins\nppl3260.dll FF - plugin: c:\program files\K-Lite Codec Pack\Real\browser\plugins\nprpjplug.dll FF - plugin: c:\program files\Opera\program\plugins\npdivx32.dll ---- FIREFOX - SPOSÓB POSTĘPOWANIA ---- FF - user.js: network.prefetch-next - true FF - user.js: nglayout.initialpaint.delay - 250 FF - user.js: layout.spellcheckDefault - 1 FF - user.js: browser.urlbar.autoFill - false FF - user.js: browser.search.openintab - false FF - user.js: browser.tabs.closeButtons - 1 FF - user.js: browser.tabs.opentabfor.middleclick - true FF - user.js: browser.tabs.tabMinWidth - 100 FF - user.js: browser.urlbar.hideGoButton - false . . ------- Skojarzenia plików ------- . JSEFile=NOTEPAD.EXE %1 VBEFile=NOTEPAD.EXE %1 VBSFile=NOTEPAD.EXE %1 . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-03-04 21:29:13 Windows 5.1.2600 Dodatek Service Pack 3 NTFS skanowanie ukrytych procesów ... skanowanie ukrytych wpisów autostartu ... skanowanie ukrytych plików ... skanowanie pomyślnie ukończone ukryte pliki: 0 ************************************************************************** . --------------------- ZABLOKOWANE KLUCZE REJESTRU --------------------- [HKEY_USERS\S-1-5-21-1547161642-329068152-682003330-1003\Software\Microsoft\SystemCertificates\AddressBook*] @Allowed: (Read) (RestrictedCode) @Allowed: (Read) (RestrictedCode) [HKEY_LOCAL_MACHINE\software\LicCtrl\LicCtrl\LicCtrl\LicCtrl*lkzs$i&#&y@^t! #^$ g9^$&pgb SDB36o \D25BC253F035D347] "1"=hex:6a,0b,56,13,c1,93,dc,9c,fb,61,a2,a0,e4,ff,91,20,60,bf,2f,c2,35,91,ae, 25 "2"=hex:fb,e6,50,7f,41,f4,51,a7,7f,ec,2d,f9,42,45,3a,02,3a,b7,45,15,3f,9d,8b, c3 "3"=hex:6a,0b,56,13,c1,93,dc,9c,fb,61,a2,a0,e4,ff,91,20,5d,f5,58,d1,21,e0,48, 8b,38,57,44,9c,4e,8d,78,88,fd,f1,01,9d,86,d8,b5,cb,d9,bf,23,55,4a,bb,31,1f [HKEY_LOCAL_MACHINE\software\LicCtrl\LicCtrl\LicCtrl\LicCtrl*lkzs$i&#&y@^t! #^$ g9^$&pgb SDB36o \D25BC253F035D347\B3E62936FE1487AF4E0CC9BD2A26433C] "1"=hex:df,c7,3a,96,ab,66,13,d2,35,84,aa,2e,3b,c4,59,82 "2"=hex:a5,2d,b1,39,25,57,b6,7c,bd,55,f5,f4,85,30,c7,12 "3"=hex:81,20,8f,ab,28,6a,52,9c "4"=hex:2f,ad,a2,e7,8a,bf,05,5e "5"=hex:bf,e5,23,7b,b0,66,d6,fc,b8,e8,6b,a0,96,52,f7,32,80,09,8f,24,b7,b3,55, 1a,98,d1,47,16,02,43,61,1c,b9,d5,8f,2a,7b,81,b1,fb,95,22,f8,b3,2c,53,9d,ae,\ "6"=hex:bf,e5,23,7b,b0,66,d6,fc,bc,64,22,fb,7e,d3,39,3e,a3,00,33,13,c0,21,f4, 51,6c,4e,0c,96,e2,dd,ad,8a,b6,c4,05,e8,5a,bd,9a,e9,d4,1a,3d,68,9d,00,32,20 "7"=hex:93,41,de,56,34,94,a7,b2,13,ca,26,2f,35,a5,e0,53,1e,d5,e7,20,4a,dd,09, c9,2d,37,7b,a2,3c,71,f4,5e,ed,02,2a,97,fd,fb,2c,72,12,5f,23,ff,c4,2a,48,c4,\ "8"=hex:fa,d8,7d,bf,60,1d,e1,43,49,72,95,82,0a,91,d2,75,3f,f0,66,24,31,42,8d, 99,a4,1d,13,bc,fc,c6,27,e9,fd,d1,2c,4d,7f,d7,1f,7e "9"=hex:81,20,8f,ab,28,6a,52,9c "18"=hex:b6,dd,00,4d,9d,38,11,d1 "10"=hex:81,20,8f,ab,28,6a,52,9c "11"=hex:81,20,8f,ab,28,6a,52,9c "12"=hex:81,20,8f,ab,28,6a,52,9c "13"=hex:81,20,8f,ab,28,6a,52,9c "14"=hex:81,20,8f,ab,28,6a,52,9c "24"=hex:81,20,8f,ab,28,6a,52,9c "26"=hex:81,20,8f,ab,28,6a,52,9c "27"=hex:81,20,8f,ab,28,6a,52,9c "19"=hex:81,20,8f,ab,28,6a,52,9c "22"=hex:81,20,8f,ab,28,6a,52,9c [HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\System*] "OODEFRAG10.00.00.01WORKSTATION"="C4C81B9AC6E1195EFB0393593059A798C64BA2EA6EBAD5B4B396702FD044D5BC41A49F2F83B23EA5FEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CA6A0AC4980AC7933A6A0AC4980AC7933A2D97226D213B555A2D97226D213B555F3DBEBC3D39706F665BCE16574F89B87D8B0EBBC29CE4F165D9D0E0B4D269F34857405F4E51EA9B379F46D8BFD53519617477CAD8D2A0556A964C32D79D88979A74E89541946D6F686182EABCF410BE81FC024183E79E4921E5A73CA765855B70600537749981BB9C3224F65A03CF514D01F7FCD68CC5B1E632649008BEA539BB2773E67FA2EC9A74C667E524CD40463EEB62B11E1481EFE85C2745EA5E9180C2472AB2452B4F4A19C076B7C51AD6C5321B14A9AA2A322EF757D29EB56C27A1FB185801E1A70F8BC197ECC6352FD2914F28F0695442C235F87FB9E20D1F5989F9B19A4BBBF35EFC08698DD799612F78CD39F06A38941A16FF3B290E9F01AD10E81678356556F3D2A11F559A588C75BD5170979D8D4D75E76D6ECBF28B1D6499E678211BD8F9C05AAC40D8343B713193D73C5943BAEF7638031C9ED31B36A6736B94CBEB2CACD30A59624A0A1567BBBC586238C48C23DF84A673B644DBC255A7344FC086C03ABEC33DB5A7A03BC1B91234D429CEF6059B0C742896D3A366E0FA3B8A0E6935B6EABA1CE1FDE2063232C3FAB998216FB0F5C1EECCDD9A82BBDBC4C2C165D469965A1EE0EB620A1EA5561B86AF20391AD3892A8F878FBBD4DA1D9231813EF9626F248D29B3C92A79689CC60B26CE1B0B0BFAFF659CA2D92733AA214D99DA70C100DDBB2DD1A11C6CB2BCBBA96F7ECB2662653C868DB48B314BB973F3312909E093DDEAD9F12F70396B97F8308D970CAD001DE97E118ACA24C72FCF749A0BB3DE7A316928F392A59264850A6DCAD3F219976FA8B643CBDD45EBADA45A5CCBCCAA4F00AE540F78C384BFCE6C5D3DF31D10B441285F6DBE432AE047C63B66E2E9BDEEB8761A60A89047F1431370A33A0ED16BA5316805E0B9844D4F3C14B30AAFA57EEA1F01E028E125CDC618304BC6B78CD3DB1844E7DA2D84FC614839A1354A6F4672BB465C40D2D213B6E6828E575696BC565CA8FC79D379E06F401BEEACFD0C1D93F821E887A1630A592D7426EA3AC4A5EE819D92273EE27D5F244335FC49E69D93961CFDC50FD1127CA7702E562A368A8FA50A4C0A02A82892E0EDA6CDF2B40133C0EE3A10D0E6E5FDA207AB21FA1ECD89F08CC30250C6D0B0B51FA60D204BB442C7A288AB1DE9681C6E0238F4D6D9D371D89924E8328C9D732B63CDFD1AA753EB1C9D0A1C3017DD5DA78D88863C46720FE549B4DC38899818E18ABE31695AAE83B5473434D77BAB6A4DED781DBD65982141A6E36F22A082DD006BBB6D9AF3E3D7928" . Czas ukończenia: 2009-03-04 21:31:25 ComboFix-quarantined-files.txt 2009-03-04 20:30:40 Przed: 734 318 592 bajtów wolnych Po: 1,344,831,488 bajtów wolnych Current=4 Default=4 Failed=3 LastKnownGood=5 Sets=1,2,3,4,5 348 --- E O F --- 2009-01-06 20:42:34

**Posty:** 18165 · przez **wojtas** 05 Mar 2009, 19:53

Wykonaj to co jest podane w tym temacie

Zastosuj SDFix . Po pobraniu uruchom go a rozpakuje się do C:\SDFix. Uruchom komputer w trybie awaryjnym (F8 przy stracie systemu). Będąc w awaryjnym uruchom plik RunThis.bat z folderu SDFixa. Zatwierdź czyszczenie przez Y. Poczekaj aż ukończy i komputer zresetuje

Potem wejdz do folderu C:\SDFix wrzuc zawartość pliku Report.txt + log z combofixa oraz daj loga z hijacka
Przeskanuj obszar mojego komputera http://www.kaspersky.pl/virusscanner.html (uruchom przez IE) Daj raport z niego na forum.