Komp muli i jakby cały czs skanowany był

[nomik]

mam taki problem- net b.wolno chodzi, długo się ładuje, a komp zachowuje się tak jakby cały czas się skanował...
raport z hijacka:

Kod: Zaznacz wszystko

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 13:29, on 2009-05-03
Platform: Windows XP  (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Sunbelt Software\Personal Firewall 4\kpf4ss.exe
C:\WINDOWS\System32\irdvxc.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Sunbelt Software\Personal Firewall 4\kpf4gui.exe
C:\Program Files\DialNet\WrOS.EXE
C:\WINDOWS\System32\wbem\wmiapsrv.exe
C:\Program Files\Sunbelt Software\Personal Firewall 4\kpf4gui.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\bedika\Pulpit\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.onet.pl/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray
O17 - HKLM\System\CCS\Services\Tcpip\..\{59B39933-DF6D-4719-800A-9A6BFD3F5902}: NameServer = 217.30.129.149 217.30.137.200
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Sunbelt Kerio Personal Firewall 4 (KPF4) - Sunbelt Software - C:\Program Files\Sunbelt Software\Personal Firewall 4\kpf4ss.exe
O23 - Service: Network helper Service (MSDisk) - Unknown owner - C:\WINDOWS\System32\irdvxc.exe
O23 - Service: WinPPPoverEthernet - Fine Point Technologies, Inc. - C:\Program Files\DialNet\WrOS.EXE

--
End of file - 2264 bytes

[Okocza]

O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k

sfixuj to w hj

daj log z combofixa

[nomik]

podaje loga

Kod: Zaznacz wszystko

info.txt logfile of random's system information tool 1.06 2009-08-15 15:18:58

======Uninstall list======

-->rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf
32 Bit HP CIO Components Installer-->MsiExec.exe /I{F1E63043-54FC-429B-AB2C-31AF9FBA4BC7}
Adobe Acrobat 5.0-->C:\WINDOWS\ISUNINST.EXE -f"C:\Program Files\Common Files\Adobe\Acrobat 5.0\NT\Uninst.isu" -c"C:\Program Files\Common Files\Adobe\Acrobat 5.0\NT\Uninst.dll"
Adobe Flash Player 10 Plugin-->C:\WINDOWS\System32\Macromed\Flash\uninstall_plugin.exe
BearShare-->C:\PROGRA~1\BEARSH~1\UNWISE.EXE C:\PROGRA~1\BEARSH~1\INSTALL.LOG
Codec Pack - All In 1 6.0.3.0-->C:\WINDOWS\iun6002.exe "C:\Program Files\Codec Pack - All In 1\irunin.ini"
DAEMON Tools-->MsiExec.exe /I{3DED3A72-61A8-4B87-98A5-EF0BC8038AA0}
DialNet-->C:\Program Files\InstallShield Installation Information\{94CFF341-2471-44E7-8439-2D12A2611D2F}\setup.exe -runfromtemp -l0x0015 -removeonly
DVD Solution-->"C:\Program Files\Uninstall_CDS.exe"
HijackThis 2.0.2-->"C:\Documents and Settings\bedik100\Pulpit\HijackThis.exe" /uninstall
HouseCall 6.6-->"C:\Documents and Settings\bedik100\Dane aplikacji\HouseCall 6.6\uninstaller.exe"
HP Deskjet All-In-One Software 9.0-->C:\Program Files\HP\Digital Imaging\{FA8A44D7-3E8A-4034-9C4F-088FA6B72BC4}\setup\hpzscr01.exe -datfile hposcr14.dat
HP Imaging Device Functions 9.0-->C:\Program Files\HP\Digital Imaging\DeviceManagement\hpzscr01.exe -datfile hpqbud01.dat
Java(TM) 6 Update 14-->MsiExec.exe /X{26A24AE4-039D-4CA4-87B4-2F83216014FF}
Microsoft Age of Empires II-->"C:\Program Files\Microsoft Games\Age of Empires II\UNINSTAL.EXE" /runtemp /uninstall
Microsoft Office 2000 Premium-->MsiExec.exe /I{00000415-78E1-11D2-B60F-006097C998E7}
Microsoft Visual C++ 2005 Redistributable-->MsiExec.exe /X{7299052b-02a4-4627-81f2-1818da5d550d}
Mozilla Firefox (3.0.13)-->C:\Program Files\Mozilla Firefox\uninstall\helper.exe
Multimedia Launcher-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}\setup.exe"  -uninstall
My Global Search Bar-->rundll32 C:\PROGRA~1\MYGLOB~1\bar\1.bin\mgsBar.dll,O
Nero OEM-->C:\Program Files\Ahead\nero\uninstall\UNNERO.exe /UNINSTALL
QuickTime Alternative 1.56-->"C:\Program Files\QuickTime Alternative\unins000.exe"
Sunbelt Personal Firewall-->MsiExec.exe /X{82B1150E-9B37-49FC-83EB-D52197D900D0}
Tlen.pl-->"C:\Program Files\Tlen.pl\uninstall.exe"
Zylom Games Player Plugin-->"C:\Program Files\Zylom Games\UninstallPlugin.exe" --uninstall

=====HijackThis Backups=====

O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm [2009-06-05]
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe [2009-06-05]
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx [2009-06-05]
O9 - Extra button: Zaznaczanie HP Smart - {700259D7-1666-479a-93B1-3250410481E8} - C:\Program Files\HP\Smart Web Printing\hpswp_extensions.dll [2009-06-05]
O2 - BHO: HP Print Clips - {053F9267-DC04-4294-A72C-58F732D338C0} - C:\Program Files\HP\Smart Web Printing\hpswp_framework.dll [2009-06-05]
O2 - BHO: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files\HP\Smart Web Printing\hpswp_printenhancer.dll [2009-06-05]
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background [2009-06-05]
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza [2009-06-05]
O9 - Extra button: Kolekcja wycinków HP - {58ECB495-38F0-49cb-A538-10282ABF65E7} - C:\Program Files\HP\Smart Web Printing\hpswp_extensions.dll [2009-06-05]
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe [2009-06-05]
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll [2009-06-05]
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm [2009-06-05]
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'USŁUGA LOKALNA') [2009-06-22]
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM') [2009-06-22]
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user') [2009-06-22]
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'USŁUGA SIECIOWA') [2009-06-22]
O4 - HKUS\.DEFAULT\..\RunOnce: [Java VM v6.9.2]  (User 'Default user') [2009-07-22]
O4 - HKUS\S-1-5-18\..\RunOnce: [Java VM v6.9.2]  (User 'SYSTEM') [2009-07-22]
O2 - BHO: My Global Search Bar BHO - {37B85A21-692B-4205-9CAD-2626E4993404} - C:\Program Files\MyGlobalSearch\bar\1.bin\MGSBAR.DLL [2009-07-22]
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://search.bearshare.com/ [2009-07-22]
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx [2009-07-22]
O4 - HKLM\..\RunServices: [XP HOT Rebild] Win15763.exe [2009-08-10]
O4 - HKCU\..\Run: [XP HOT Rebild] Win15763.exe [2009-08-10]
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (file missing) [2009-08-10]
O4 - HKLM\..\Run: [XP HOT Rebild] Win15763.exe [2009-08-10]
O4 - HKCU\..\RunOnce: [XP HOT Rebild] Win15763.exe [2009-08-10]
O4 - HKLM\..\Run: [Microsoft Driver Setup] C:\WINDOWS\mssrv32.exe [2009-08-10]
O23 - Service: 8hut56u (7truityui) - Unknown owner - C:\Program Files\Common Files\yrujg2wn\ginder86.exe [2009-08-10]
O4 - HKUS\S-1-5-18\..\Run: [XP HOT Rebild] Win15763.exe (User 'SYSTEM') [2009-08-10]
O3 - Toolbar: My Global Search Bar - {37B85A29-692B-4205-9CAD-2626E4993404} - C:\Program Files\MyGlobalSearch\bar\1.bin\MGSBAR.DLL (file missing) [2009-08-10]
O4 - HKLM\..\Policies\Explorer\Run: [Microsoft Driver Setup] C:\WINDOWS\mssrv32.exe [2009-08-10]
O4 - HKCU\..\Run: [Java VM v6.9.2] C:\WINDOWS\System32\jdk-1_5_0_19-windows-i393-pp\jav.bat [2009-08-10]
O23 - Service: 8hut56u (7truityui) - Unknown owner - C:\Program Files\Common Files\yrujg2wn\ginder86.exe [2009-08-10]
O23 - Service: 8hut56u (7truityui) - Unknown owner - C:\Program Files\Common Files\yrujg2wn\ginder86.exe [2009-08-10]
O4 - HKLM\..\RunOnce: [XP HOT Rebild] Win15763.exe [2009-08-10]
O4 - HKLM\..\Run: [Universal Serial Bus device] usb_magr.exe [2009-08-10]
O23 - Service: 8hut56u (7truityui) - Unknown owner - C:\Program Files\Common Files\yrujg2wn\ginder86.exe [2009-08-10]
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2009-08-15]
O23 - Service: 8hut56u (7truityui) - Unknown owner - C:\Program Files\Common Files\yrujg2wn\ginder86.exe [2009-08-15]
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2009-08-15]
O4 - Startup: _uninst_.bat [2009-08-15]

======System event log======

Computer Name: BEDIK100-DAM7JQ
Event Code: 7035
Message: Do usługi Menedżer połączeń usługi Dostęp zdalny został pomyślnie wysłany kod sterowania uruchom.

Record Number: 2925
Source Name: Service Control Manager
Time Written: 20090712112553.000000+120
Event Type: informacje
User: BEDIK100-DAM7JQ\bedik100

Computer Name: BEDIK100-DAM7JQ
Event Code: 7036
Message: Usługa Telefonia weszła w stan uruchomienia.

Record Number: 2924
Source Name: Service Control Manager
Time Written: 20090712112553.000000+120
Event Type: informacje
User:

Computer Name: BEDIK100-DAM7JQ
Event Code: 7036
Message: Usługa Zgodność szybkiego przełączania użytkowników weszła w stan uruchomienia.

Record Number: 2923
Source Name: Service Control Manager
Time Written: 20090712112553.000000+120
Event Type: informacje
User:

Computer Name: BEDIK100-DAM7JQ
Event Code: 7035
Message: Do usługi Zgodność szybkiego przełączania użytkowników został pomyślnie wysłany kod sterowania uruchom.

Record Number: 2922
Source Name: Service Control Manager
Time Written: 20090712112553.000000+120
Event Type: informacje
User: BEDIK100-DAM7JQ\bedik100

Computer Name: BEDIK100-DAM7JQ
Event Code: 7036
Message: Usługa Usługi terminalowe weszła w stan uruchomienia.

Record Number: 2921
Source Name: Service Control Manager
Time Written: 20090712112553.000000+120
Event Type: informacje
User:

=====Application event log=====

Computer Name: BEDIK100-DAM7JQ
Event Code: 1000
Message: Info: Received DISCOVERY_TERMINATE packet, session_id: 0.

Record Number: 7054
Source Name: PPPOE
Time Written: 20090807130210.000000+120
Event Type: informacje
User: ZARZĄDZANIE NT\SYSTEM

Computer Name: BEDIK100-DAM7JQ
Event Code: 1000
Message: Info: Received DISCOVERY_TERMINATE packet, session_id: 0.

Record Number: 7053
Source Name: PPPOE
Time Written: 20090807130141.000000+120
Event Type: informacje
User: ZARZĄDZANIE NT\SYSTEM

Computer Name: BEDIK100-DAM7JQ
Event Code: 1000
Message: Info: Received DISCOVERY_TERMINATE packet, session_id: 0.

Record Number: 7052
Source Name: PPPOE
Time Written: 20090807123245.000000+120
Event Type: informacje
User: ZARZĄDZANIE NT\SYSTEM

Computer Name: BEDIK100-DAM7JQ
Event Code: 1000
Message: Info: Received DISCOVERY_TERMINATE packet, session_id: 0.

Record Number: 7051
Source Name: PPPOE
Time Written: 20090807123012.000000+120
Event Type: informacje
User: ZARZĄDZANIE NT\SYSTEM

Computer Name: BEDIK100-DAM7JQ
Event Code: 1000
Message: Info: Received DISCOVERY_TERMINATE packet, session_id: 0.

Record Number: 7050
Source Name: PPPOE
Time Written: 20090807122827.000000+120
Event Type: informacje
User: ZARZĄDZANIE NT\SYSTEM

======Environment variables======

"ComSpec"=%SystemRoot%\system32\cmd.exe
"Path"=%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem
"windir"=%SystemRoot%
"OS"=Windows_NT
"PROCESSOR_ARCHITECTURE"=x86
"PROCESSOR_LEVEL"=15
"PROCESSOR_IDENTIFIER"=x86 Family 15 Model 1 Stepping 2, GenuineIntel
"PROCESSOR_REVISION"=0102
"NUMBER_OF_PROCESSORS"=1
"PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
"TEMP"=%SystemRoot%\TEMP
"TMP"=%SystemRoot%\TEMP

-----------------EOF-----------------


[Okocza]

nomik, daj log z RSIT - plik LOG

[nomik]

ok, podaję:

Kod: Zaznacz wszystko

Logfile of random's system information tool 1.06 (written by random/random)
Run by bedik100 at 2009-08-15 15:25:18
Microsoft Windows XP Professional
System drive C: has 9 GB (61%) free of 15 GB
Total RAM: 127 MB (7% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 15:25:40, on 2009-08-15
Platform: Windows XP  (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\yrujg2wn\ginder86.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\DialNet\winpppoverethernet.exe
C:\Program Files\D-Tools\daemon.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Sunbelt Software\Personal Firewall\SbPFLnch.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\DialNet\WrOS.EXE
C:\WINDOWS\System32\wbem\wmiapsrv.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\bedik100\Pulpit\RSIT.exe
C:\Documents and Settings\bedik100\Pulpit\bedik100.exe

O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [a-winpoet-service] "C:\Program Files\DialNet\winpppoverethernet.exe"
O4 - HKLM\..\Run: [] "C:\PROGRA~1\DialNet\FPLICE~1.EXE zhimakaimen//WINPOET_QUITTING_EVENT"
O4 - HKLM\..\Run: [z-wrdialer] "C:\Program Files\DialNet\wrdialer.exe"
O4 - HKLM\..\Run: [Java VM v6.9.2] C:\WINDOWS\System32\jdk-1_5_0_19-windows-i393-pp\jav.bat
O4 - HKLM\..\Run: [Java VM v6.91] C:\WINDOWS\System32\jdk-1_5_0_19-windows-i391-pp\jav.bat
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKCU\..\Run: [Komunikator] C:\Program Files\Tlen.pl\tlen.exe
O4 - HKCU\..\Run: [Java VM v6.91] C:\WINDOWS\System32\jdk-1_5_0_19-windows-i391-pp\jav.bat
O4 - HKCU\..\Run: [Java VM v6.9.2] C:\WINDOWS\System32\jdk-1_5_0_19-windows-i393-pp\jav.bat
O4 - HKUS\S-1-5-18\..\Run: [Java VM v6.9.2] C:\WINDOWS\System32\jdk-1_5_0_19-windows-i393-pp\jav.bat (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [Java VM v6.91] C:\WINDOWS\System32\jdk-1_5_0_19-windows-i391-pp\jav.bat (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [Java VM v6.91]  (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [Java VM v6.9.2] C:\WINDOWS\System32\jdk-1_5_0_19-windows-i393-pp\jav.bat (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [Java VM v6.91]  (User 'Default user')
O4 - Startup: is-DANFA.lnk = C:\Documents and Settings\bedik100\Pulpit\Virus Removal Tool\is-DANFA\startup.exe
O4 - Startup: is-F43BA.lnk = C:\Documents and Settings\bedik100\Pulpit\Virus Removal Tool2\Virus Removal Tool\is-F43BA\startup.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O17 - HKLM\System\CCS\Services\Tcpip\..\{94FCDD73-6AA0-4EFC-BD29-D4C57A060A1C}: NameServer = 217.30.129.149 217.30.137.200
O23 - Service: 8hut56u (7truityui) - Unknown owner - C:\Program Files\Common Files\yrujg2wn\ginder86.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: SbPF.Launcher - Sunbelt Software, Inc. - C:\Program Files\Sunbelt Software\Personal Firewall\SbPFLnch.exe
O23 - Service: Sunbelt Personal Firewall 4 (SPF4) - Sunbelt Software, Inc. - C:\Program Files\Sunbelt Software\Personal Firewall\SbPFSvc.exe
O23 - Service: WinPPPoverEthernet - Fine Point Technologies, Inc. - C:\Program Files\DialNet\WrOS.EXE

--
End of file - 3887 bytes

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2009-08-10 41368]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"SoundMan"=C:\WINDOWS\SOUNDMAN.EXE [2002-06-14 46592]
"NeroFilterCheck"=C:\WINDOWS\system32\NeroCheck.exe [2001-07-09 155648]
"a-winpoet-service"=C:\Program Files\DialNet\winpppoverethernet.exe [2007-01-18 405504]
""=C:\PROGRA~1\DialNet\FPLICE~1.EXE [2004-11-05 110592]
"z-wrdialer"=C:\Program Files\DialNet\wrdialer.exe [2007-01-18 483328]
"Java VM v6.9.2"=C:\WINDOWS\System32\jdk-1_5_0_19-windows-i393-pp\jav.bat [2008-03-06 87]
"Java VM v6.91"=C:\WINDOWS\System32\jdk-1_5_0_19-windows-i391-pp\jav.bat [2008-01-21 87]
"DAEMON Tools-1033"=C:\Program Files\D-Tools\daemon.exe [2004-08-22 81920]
"SunJavaUpdateSched"=C:\Program Files\Java\jre6\bin\jusched.exe [2009-08-10 148888]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Komunikator"=C:\Program Files\Tlen.pl\tlen.exe [2009-01-17 5853672]
"Java VM v6.91"=C:\WINDOWS\System32\jdk-1_5_0_19-windows-i391-pp\jav.bat [2008-01-21 87]
"Java VM v6.9.2"=C:\WINDOWS\System32\jdk-1_5_0_19-windows-i393-pp\jav.bat [2008-03-06 87]

C:\Documents and Settings\All Users\Menu Start\Programy\Autostart
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office\OSA9.EXE

C:\Documents and Settings\bedik100\Menu Start\Programy\Autostart
is-DANFA.lnk - C:\Documents and Settings\bedik100\Pulpit\Virus Removal Tool\is-DANFA\startup.exe
is-F43BA.lnk - C:\Documents and Settings\bedik100\Pulpit\Virus Removal Tool2\Virus Removal Tool\is-F43BA\startup.exe

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\UploadMgr]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"C:\Program Files\Common Files\yrujg2wn\ginder86.exe"="C:\Program Files\Common Files\yrujg2wn\ginder86.exe:*:Enabled:b0tgh7678"
"trkwksvc.exe"="trkwksvc.exe:*:Enabled:SYSTEM"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{11fc49d4-6d7c-11de-a62a-806d6172696f}]
shell\AutoRun\command - H:\aoesetup.exe /autorun
shell\directx\command - H:\DirectX\dxsetup.exe
shell\dplay\command - H:\DirectX\dplay61a.exe
shell\dxdiag\command - H:\goodies\ar40eng.exe
shell\dxinfo\command - H:\goodies\DirectX\dxinfo.exe
shell\dxtest\command - H:\DirectX\dxdiag.exe
shell\dxtool\command - H:\goodies\DirectX\dxtool.exe
shell\log\command - H:\goodies\machine\machine.exe -l
shell\machine\command - H:\goodies\machine\machine.exe
shell\setup\command - H:\aoesetup.exe /autorun
shell\zone\command - H:\goodies\mszone\zoneA600.exe


======List of files/folders created in the last 1 months======

2009-08-15 15:18:33 ----D---- C:\rsit
2009-08-15 14:20:29 ----D---- C:\Documents and Settings\bedik100\Dane aplikacji\HouseCall 6.6
2009-08-10 21:23:50 ----D---- C:\WINDOWS\Sun
2009-08-10 21:23:48 ----A---- C:\WINDOWS\System32\Win3bht.exe
2009-08-10 21:20:49 ----A---- C:\WINDOWS\System32\javaws.exe
2009-08-10 21:20:49 ----A---- C:\WINDOWS\System32\javaw.exe
2009-08-10 21:20:49 ----A---- C:\WINDOWS\System32\java.exe
2009-08-10 21:19:27 ----D---- C:\Program Files\Java
2009-08-09 22:12:40 ----A---- C:\fdfggbef.exe
2009-08-06 13:17:16 ----A---- C:\WINDOWS\nigzss.txt
2009-08-06 13:16:55 ----RSH---- C:\WINDOWS\usb_magr.exe
2009-08-06 13:15:58 ----A---- C:\WINDOWS\System32\Ms12x.exe
2009-08-06 13:01:12 ----A---- C:\WINDOWS\System32\Win15763.exe
2009-08-06 12:14:46 ----A---- C:\logfile32.txt
2009-08-06 12:14:45 ----RSH---- C:\WINDOWS\mssrv32.exe
2009-08-06 12:14:38 ----RSHD---- C:\Program Files\Common Files\yrujg2wn
2009-07-31 22:44:03 ----D---- C:\Documents and Settings\All Users\Dane aplikacji\Zylom
2009-07-31 22:44:02 ----D---- C:\Program Files\Zylom Games
2009-07-29 12:40:59 ----D---- C:\Documents and Settings\All Users\Dane aplikacji\NortonInstaller
2009-07-29 12:39:26 ----D---- C:\Documents and Settings\bedik100\Dane aplikacji\Media Player Classic
2009-07-29 12:38:36 ----D---- C:\Documents and Settings\All Users\Dane aplikacji\Apple Computer
2009-07-29 12:38:33 ----D---- C:\WINDOWS\System32\QuickTime
2009-07-29 12:38:33 ----A---- C:\WINDOWS\System32\qtmlClient.dll
2009-07-29 12:38:28 ----D---- C:\Program Files\Media Player Classic
2009-07-29 12:38:27 ----D---- C:\Program Files\QuickTime Alternative
2009-07-29 12:30:11 ----A---- C:\WINDOWS\iun6002.exe
2009-07-29 12:30:04 ----D---- C:\Program Files\Codec Pack - All In 1
2009-07-29 12:29:00 ----A---- C:\WINDOWS\Codec Pack - All In 1 Setup Log.txt
2009-07-27 21:58:14 ----A---- C:\WINDOWS\System32\deploytk.dll
2009-07-27 21:55:40 ----A---- C:\WINDOWS\System32\mshshsui.exe
2009-07-27 21:54:02 ----D---- C:\Documents and Settings\bedik100\Dane aplikacji\Sun

======List of files/folders modified in the last 1 months======

2009-08-15 15:16:58 ----D---- C:\Program Files\Mozilla Firefox
2009-08-15 15:06:07 ----D---- C:\Program Files\DialNet
2009-08-15 14:21:54 ----D---- C:\WINDOWS\System32\drivers
2009-08-15 14:15:30 ----D---- C:\WINDOWS\System32\CatRoot2
2009-08-15 14:13:30 ----HD---- C:\WINDOWS\inf
2009-08-15 14:13:30 ----D---- C:\WINDOWS\Temp
2009-08-15 14:13:30 ----D---- C:\WINDOWS\LastGood
2009-08-15 14:12:21 ----D---- C:\WINDOWS\System32\jdk-1_5_0_19-windows-i393-pp
2009-08-15 14:12:21 ----D---- C:\WINDOWS\System32\jdk-1_5_0_19-windows-i391-pp
2009-08-15 14:11:38 ----A---- C:\WINDOWS\WinPoET_Runtime.txt
2009-08-15 14:11:34 ----D---- C:\WINDOWS\Debug
2009-08-15 14:10:50 ----A---- C:\WINDOWS\win.ini
2009-08-15 14:10:46 ----A---- C:\WINDOWS\SchedLgU.Txt
2009-08-15 13:27:57 ----D---- C:\WINDOWS\Prefetch
2009-08-15 13:09:16 ----A---- C:\WINDOWS\ntbtlog.txt
2009-08-15 12:05:50 ----A---- C:\AILog.txt
2009-08-15 11:26:22 ----D---- C:\WINDOWS\PCHEALTH
2009-08-10 21:23:50 ----D---- C:\WINDOWS
2009-08-10 21:23:48 ----D---- C:\WINDOWS\system32
2009-08-10 21:21:41 ----SHD---- C:\WINDOWS\Installer
2009-08-10 21:21:28 ----HD---- C:\Config.Msi
2009-08-10 21:19:27 ----RD---- C:\Program Files
2009-08-09 22:13:46 ----D---- C:\Documents and Settings\bedik100\Dane aplikacji\Tlen.pl
2009-08-06 12:14:38 ----D---- C:\Program Files\Common Files
2009-07-29 12:30:50 ----A---- C:\WINDOWS\NeroDigital.ini
2009-07-23 22:51:15 ----SD---- C:\Documents and Settings\bedik100\Dane aplikacji\Microsoft
2009-07-23 22:51:14 ----D---- C:\WINDOWS\Help
2009-07-22 21:30:58 ----SHD---- C:\System Volume Information
2009-07-22 21:30:58 ----D---- C:\WINDOWS\System32\Restore

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 SbFw;SbFw; C:\WINDOWS\system32\drivers\SbFw.sys [2008-10-31 270888]
R1 sbhips;Sunbelt HIPS Driver; C:\WINDOWS\system32\drivers\sbhips.sys [2008-06-21 66600]
R2 tmcomm;tmcomm; \??\C:\WINDOWS\System32\drivers\tmcomm.sys []
R2 TopWinPoETDriver;WinPoET PPPoE Optimized Driver; C:\WINDOWS\System32\DRIVERS\WrKPoET2000.sys [2004-09-16 52214]
R3 ALCXWDM;Service for Avance AC97 Audio (WDM); C:\WINDOWS\system32\drivers\ALCXWDM.SYS [2002-06-12 654604]
R3 FPD;Fine Point Packet Service; \??\C:\WINDOWS\System32\drivers\fpd.sys []
R3 nv4;nv4; C:\WINDOWS\System32\DRIVERS\nv4.sys [2001-08-17 731648]
R3 rtl8139;Realtek RTL8139/810x Family Fast Ethernet NIC NT Driver; C:\WINDOWS\System32\DRIVERS\R8139n51.SYS [2002-03-26 45568]
R3 SBFWIMCL;Sunbelt Software Firewall NDIS IM Filter Miniport; C:\WINDOWS\System32\DRIVERS\sbfwim.sys [2008-06-21 65576]
R3 usbhub;Koncentrator z obsługą USB2; C:\WINDOWS\System32\DRIVERS\usbhub.sys [2001-08-17 50688]
R3 usbuhci;Sterownik Miniport uniwersalnego kontrolera hosta USB Microsoft; C:\WINDOWS\System32\DRIVERS\usbuhci.sys [2001-08-17 18944]
R3 WrKPoET2000;WrKPoET2000; \??\C:\Program Files\DialNet\WrKPoET2000.sys []
R3 WRSWanDD;WinPoET PPPoE Adapter; C:\WINDOWS\System32\DRIVERS\WrKPoETNic2000.sys [2002-10-28 65604]
S1 is-DANFAdrv;is-DANFAdrv; C:\WINDOWS\System32\DRIVERS\72200413.sys [2008-07-08 148496]
S1 is-F43BAdrv;is-F43BAdrv; C:\WINDOWS\System32\DRIVERS\64130644.sys [2008-07-08 148496]
S3 GMSIPCI;GMSIPCI; \??\F:\INSTALL\GMSIPCI.SYS []
S3 HPZid412;IEEE-1284.4 Driver HPZid412; C:\WINDOWS\System32\DRIVERS\HPZid412.sys [2007-03-07 49920]
S3 HPZipr12;Print Class Driver for IEEE-1284.4 HPZipr12; C:\WINDOWS\System32\DRIVERS\HPZipr12.sys [2007-03-07 16496]
S3 HPZius12;USB to IEEE-1284.4 Translation Driver HPZius12; C:\WINDOWS\System32\DRIVERS\HPZius12.sys [2007-03-07 21568]
S3 NTACCESS;NTACCESS; \??\F:\NTACCESS.sys []
S3 SetupNTGLM7X;SetupNTGLM7X; \??\F:\NTGLM7X.sys []
S3 usbccgp;Rodzajowy sterownik nadrzędny USB Microsoft; C:\WINDOWS\System32\DRIVERS\usbccgp.sys [2001-08-17 24960]
S3 usbprint;Klasa PRINTER USB Microsoft; C:\WINDOWS\System32\DRIVERS\usbprint.sys [2001-08-17 24832]
S3 usbscan;Sterownik skanera USB; C:\WINDOWS\System32\DRIVERS\usbscan.sys [2001-08-17 13824]
S3 USBSTOR;Sterownik magazynu masowego USB; C:\WINDOWS\System32\DRIVERS\USBSTOR.SYS [2001-08-17 21760]
S4 IntelIde;IntelIde; C:\WINDOWS\System32\drivers\IntelIde.sys []
S4 sr;Sterownik filtru Przywracania systemu; C:\WINDOWS\System32\DRIVERS\sr.sys [2001-10-26 70400]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 hpqddsvc;Usługa HP CUE DeviceDiscovery; C:\WINDOWS\system32\svchost.exe [2001-10-26 12800]
R2 JavaQuickStarterService;Java Quick Starter; C:\Program Files\Java\jre6\bin\jqs.exe [2009-08-10 152984]
R2 Net Driver HPZ12;Net Driver HPZ12; C:\WINDOWS\System32\svchost.exe [2001-10-26 12800]
R2 NET Service;NET Service; C:\WINDOWS\trkwksvc.exe [2009-05-26 216576]
R2 Pml Driver HPZ12;Pml Driver HPZ12; C:\WINDOWS\System32\svchost.exe [2001-10-26 12800]
R2 SbPF.Launcher;SbPF.Launcher; C:\Program Files\Sunbelt Software\Personal Firewall\SbPFLnch.exe [2008-10-31 95528]
R2 WinPPPoverEthernet;WinPPPoverEthernet; C:\Program Files\DialNet\WrOS.EXE [2004-04-26 135168]
R3 hpqcxs08;hpqcxs08; C:\WINDOWS\system32\svchost.exe [2001-10-26 12800]
S2 7truityui;8hut56u; C:\Program Files\Common Files\yrujg2wn\ginder86.exe [2009-08-06 78336]
S2 SPF4;Sunbelt Personal Firewall 4; C:\Program Files\Sunbelt Software\Personal Firewall\SbPFSvc.exe [2008-10-31 1365288]

-----------------EOF-----------------


[Okocza]

nomik, zastosuj combofixa, jest infekcja..

Autor postu otrzymał pochwałę

[nomik]

a oto wynik użycia combo:

Kod: Zaznacz wszystko

ComboFix 09-08-10.06 - bedik100 2009-08-15 15:54.1.1 - NTFSx86
Uruchomiony z: c:\documents and settings\bedik100\Pulpit\ComboFix.exe
.

(((((((((((((((((((((((((((((((((((((((   Usunięto   )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\LocalService\Ustawienia lokalne\Temporary Internet Files\boflfi.exe
c:\documents and settings\LocalService\Ustawienia lokalne\Temporary Internet Files\bvairh.exe
c:\documents and settings\LocalService\Ustawienia lokalne\Temporary Internet Files\chkhee.exe
c:\documents and settings\LocalService\Ustawienia lokalne\Temporary Internet Files\drauna.exe
c:\documents and settings\LocalService\Ustawienia lokalne\Temporary Internet Files\hsfedk.exe
c:\documents and settings\LocalService\Ustawienia lokalne\Temporary Internet Files\jcrznc.exe
c:\documents and settings\LocalService\Ustawienia lokalne\Temporary Internet Files\jcvome.exe
c:\documents and settings\LocalService\Ustawienia lokalne\Temporary Internet Files\kkbkzs.exe
c:\documents and settings\LocalService\Ustawienia lokalne\Temporary Internet Files\kpitao.exe
c:\documents and settings\LocalService\Ustawienia lokalne\Temporary Internet Files\lcrpxi.exe
c:\documents and settings\LocalService\Ustawienia lokalne\Temporary Internet Files\lfvkcp.exe
c:\documents and settings\LocalService\Ustawienia lokalne\Temporary Internet Files\nafoai.exe
c:\documents and settings\LocalService\Ustawienia lokalne\Temporary Internet Files\nhnvqr.exe
c:\documents and settings\LocalService\Ustawienia lokalne\Temporary Internet Files\nqhonr.exe
c:\documents and settings\LocalService\Ustawienia lokalne\Temporary Internet Files\ptozqq.exe
c:\documents and settings\LocalService\Ustawienia lokalne\Temporary Internet Files\qacepj.exe
c:\documents and settings\LocalService\Ustawienia lokalne\Temporary Internet Files\qfcpnl.exe
c:\documents and settings\LocalService\Ustawienia lokalne\Temporary Internet Files\qirdfx.exe
c:\documents and settings\LocalService\Ustawienia lokalne\Temporary Internet Files\raalie.exe
c:\documents and settings\LocalService\Ustawienia lokalne\Temporary Internet Files\typhnw.exe
c:\documents and settings\LocalService\Ustawienia lokalne\Temporary Internet Files\vusioy.exe
c:\documents and settings\LocalService\Ustawienia lokalne\Temporary Internet Files\wquwqd.exe
c:\documents and settings\LocalService\Ustawienia lokalne\Temporary Internet Files\xuzzal.exe
C:\fdfggbef.exe
c:\program files\Mozilla Firefox\plugins\NPMyGlSh.dll
c:\program files\myglobalsearch
c:\program files\myglobalsearch\bar\1.bin\M9FFXTBR.JAR
c:\program files\myglobalsearch\bar\1.bin\M9FFXTBR.MANIFEST
c:\program files\myglobalsearch\bar\1.bin\M9NTSTBR.JAR
c:\program files\myglobalsearch\bar\1.bin\M9NTSTBR.MANIFEST
c:\program files\myglobalsearch\bar\1.bin\M9PLUGIN.DLL
c:\program files\myglobalsearch\bar\1.bin\NPMYGLSH.DLL
c:\program files\myglobalsearch\bar\Cache\00097A35
c:\program files\myglobalsearch\bar\Cache\00097C48
c:\program files\myglobalsearch\bar\Cache\00097DEE.bin
c:\program files\myglobalsearch\bar\Cache\00098011.bin
c:\program files\myglobalsearch\bar\Cache\000981A7.bin
c:\program files\myglobalsearch\bar\Cache\files.ini
c:\program files\myglobalsearch\bar\History\search
c:\program files\myglobalsearch\bar\Settings\prevcfg.htm
c:\windows\system32\AutoRun.inf
c:\windows\system32\hqghumea.dll
c:\windows\system32\i
c:\windows\system32\jdk-1_5_0_19-windows-i391-pp
c:\windows\system32\jdk-1_5_0_19-windows-i391-pp\dc.class
c:\windows\system32\jdk-1_5_0_19-windows-i391-pp\hs_err_pid1020.log
c:\windows\system32\jdk-1_5_0_19-windows-i391-pp\hs_err_pid1072.log
c:\windows\system32\jdk-1_5_0_19-windows-i391-pp\hs_err_pid1088.log
c:\windows\system32\jdk-1_5_0_19-windows-i391-pp\hs_err_pid1092.log
c:\windows\system32\jdk-1_5_0_19-windows-i391-pp\hs_err_pid1140.log
c:\windows\system32\jdk-1_5_0_19-windows-i391-pp\hs_err_pid1172.log
c:\windows\system32\jdk-1_5_0_19-windows-i391-pp\hs_err_pid1184.log
c:\windows\system32\jdk-1_5_0_19-windows-i391-pp\hs_err_pid1200.log
c:\windows\system32\jdk-1_5_0_19-windows-i391-pp\hs_err_pid128.log
c:\windows\system32\jdk-1_5_0_19-windows-i391-pp\hs_err_pid1396.log
c:\windows\system32\jdk-1_5_0_19-windows-i391-pp\hs_err_pid144.log
c:\windows\system32\jdk-1_5_0_19-windows-i391-pp\hs_err_pid176.log
c:\windows\system32\jdk-1_5_0_19-windows-i391-pp\hs_err_pid1848.log
c:\windows\system32\jdk-1_5_0_19-windows-i391-pp\hs_err_pid1856.log
c:\windows\system32\jdk-1_5_0_19-windows-i391-pp\hs_err_pid1876.log
c:\windows\system32\jdk-1_5_0_19-windows-i391-pp\hs_err_pid1896.log
c:\windows\system32\jdk-1_5_0_19-windows-i391-pp\hs_err_pid1924.log
c:\windows\system32\jdk-1_5_0_19-windows-i391-pp\hs_err_pid1984.log
c:\windows\system32\jdk-1_5_0_19-windows-i391-pp\hs_err_pid1988.log
c:\windows\system32\jdk-1_5_0_19-windows-i391-pp\hs_err_pid2000.log
c:\windows\system32\jdk-1_5_0_19-windows-i391-pp\hs_err_pid2016.log
c:\windows\system32\jdk-1_5_0_19-windows-i391-pp\hs_err_pid2032.log
c:\windows\system32\jdk-1_5_0_19-windows-i391-pp\hs_err_pid216.log
c:\windows\system32\jdk-1_5_0_19-windows-i391-pp\hs_err_pid220.log
c:\windows\system32\jdk-1_5_0_19-windows-i391-pp\hs_err_pid224.log
c:\windows\system32\jdk-1_5_0_19-windows-i391-pp\hs_err_pid236.log
c:\windows\system32\jdk-1_5_0_19-windows-i391-pp\hs_err_pid252.log
c:\windows\system32\jdk-1_5_0_19-windows-i391-pp\hs_err_pid260.log
c:\windows\system32\jdk-1_5_0_19-windows-i391-pp\hs_err_pid268.log
c:\windows\system32\jdk-1_5_0_19-windows-i391-pp\hs_err_pid296.log
c:\windows\system32\jdk-1_5_0_19-windows-i391-pp\hs_err_pid304.log
c:\windows\system32\jdk-1_5_0_19-windows-i391-pp\hs_err_pid312.log
c:\windows\system32\jdk-1_5_0_19-windows-i391-pp\hs_err_pid316.log
c:\windows\system32\jdk-1_5_0_19-windows-i391-pp\hs_err_pid332.log
c:\windows\system32\jdk-1_5_0_19-windows-i391-pp\hs_err_pid340.log
c:\windows\system32\jdk-1_5_0_19-windows-i391-pp\hs_err_pid348.log
c:\windows\system32\jdk-1_5_0_19-windows-i391-pp\hs_err_pid352.log
c:\windows\system32\jdk-1_5_0_19-windows-i391-pp\hs_err_pid360.log
c:\windows\system32\jdk-1_5_0_19-windows-i391-pp\hs_err_pid372.log
c:\windows\system32\jdk-1_5_0_19-windows-i391-pp\hs_err_pid384.log
c:\windows\system32\jdk-1_5_0_19-windows-i391-pp\hs_err_pid388.log
c:\windows\system32\jdk-1_5_0_19-windows-i391-pp\hs_err_pid396.log
c:\windows\system32\jdk-1_5_0_19-windows-i391-pp\hs_err_pid400.log
c:\windows\system32\jdk-1_5_0_19-windows-i391-pp\hs_err_pid404.log
c:\windows\system32\jdk-1_5_0_19-windows-i391-pp\hs_err_pid408.log
c:\windows\system32\jdk-1_5_0_19-windows-i391-pp\hs_err_pid428.log
c:\windows\system32\jdk-1_5_0_19-windows-i391-pp\hs_err_pid436.log
c:\windows\system32\jdk-1_5_0_19-windows-i391-pp\hs_err_pid444.log
c:\windows\system32\jdk-1_5_0_19-windows-i391-pp\hs_err_pid448.log
c:\windows\system32\jdk-1_5_0_19-windows-i391-pp\hs_err_pid452.log
c:\windows\system32\jdk-1_5_0_19-windows-i391-pp\hs_err_pid460.log
c:\windows\system32\jdk-1_5_0_19-windows-i391-pp\hs_err_pid468.log
c:\windows\system32\jdk-1_5_0_19-windows-i391-pp\hs_err_pid476.log
c:\windows\system32\jdk-1_5_0_19-windows-i391-pp\hs_err_pid492.log
c:\windows\system32\jdk-1_5_0_19-windows-i391-pp\hs_err_pid504.log
c:\windows\system32\jdk-1_5_0_19-windows-i391-pp\hs_err_pid520.log
c:\windows\system32\jdk-1_5_0_19-windows-i391-pp\hs_err_pid544.log
c:\windows\system32\jdk-1_5_0_19-windows-i391-pp\hs_err_pid548.log
c:\windows\system32\jdk-1_5_0_19-windows-i391-pp\hs_err_pid552.log
c:\windows\system32\jdk-1_5_0_19-windows-i391-pp\hs_err_pid560.log
c:\windows\system32\jdk-1_5_0_19-windows-i391-pp\hs_err_pid576.log
c:\windows\system32\jdk-1_5_0_19-windows-i391-pp\hs_err_pid580.log
c:\windows\system32\jdk-1_5_0_19-windows-i391-pp\hs_err_pid592.log
c:\windows\system32\jdk-1_5_0_19-windows-i391-pp\hs_err_pid596.log
c:\windows\system32\jdk-1_5_0_19-windows-i391-pp\hs_err_pid600.log
c:\windows\system32\jdk-1_5_0_19-windows-i391-pp\hs_err_pid608.log
c:\windows\system32\jdk-1_5_0_19-windows-i391-pp\hs_err_pid628.log
c:\windows\system32\jdk-1_5_0_19-windows-i391-pp\hs_err_pid636.log
c:\windows\system32\jdk-1_5_0_19-windows-i391-pp\hs_err_pid648.log
c:\windows\system32\jdk-1_5_0_19-windows-i391-pp\hs_err_pid660.log
c:\windows\system32\jdk-1_5_0_19-windows-i391-pp\hs_err_pid664.log
c:\windows\system32\jdk-1_5_0_19-windows-i391-pp\hs_err_pid668.log
c:\windows\system32\jdk-1_5_0_19-windows-i391-pp\hs_err_pid700.log
c:\windows\system32\jdk-1_5_0_19-windows-i391-pp\hs_err_pid720.log
c:\windows\system32\jdk-1_5_0_19-windows-i391-pp\hs_err_pid736.log
c:\windows\system32\jdk-1_5_0_19-windows-i391-pp\hs_err_pid896.log
c:\windows\system32\jdk-1_5_0_19-windows-i391-pp\hs_err_pid924.log
c:\windows\system32\jdk-1_5_0_19-windows-i391-pp\jav.bat
c:\windows\system32\jdk-1_5_0_19-windows-i391-pp\js.exe

Zainfekowana kopia c:\windows\system32\qmgr.dll została znaleziona. Problem naprawiono
Plik odzyskano z - c:\windows\system32\dllcache\qmgr.dll

.
(((((((((((((((((((((((((((((((((((((((   Sterowniki/Usługi   )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_NET_SERVICE
-------\Service_NET Service


(((((((((((((((((((((((((   Pliki utworzone od 2009-07-15 do 2009-08-15  )))))))))))))))))))))))))))))))
.

2009-08-15 13:18 . 2009-08-15 13:18   --------   d-----w-   C:\rsit
2009-08-15 12:22 . 2008-03-30 16:55   1213784   ----a-w-   c:\documents and settings\bedik100\Dane aplikacji\HouseCall 6.6\vsapi32.dll
2009-08-15 12:22 . 2006-11-22 15:48   91744   ----a-w-   c:\documents and settings\bedik100\Dane aplikacji\HouseCall 6.6\BPMNT.dll
2009-08-15 12:20 . 2009-08-15 12:20   218736   ----a-w-   c:\documents and settings\bedik100\Dane aplikacji\HouseCall 6.6\patch.exe
2009-08-15 12:20 . 2009-08-15 12:20   189968   ----a-w-   c:\documents and settings\bedik100\Dane aplikacji\HouseCall 6.6\ciussi32.dll
2009-08-15 12:20 . 2009-08-15 12:20   170512   ----a-w-   c:\documents and settings\bedik100\Dane aplikacji\HouseCall 6.6\PATCHW32.DLL
2009-08-15 12:20 . 2009-08-15 12:20   1267320   ----a-w-   c:\documents and settings\bedik100\Dane aplikacji\HouseCall 6.6\TmUpdate.dll
2009-08-15 12:20 . 2009-08-15 12:20   61440   ----a-w-   c:\documents and settings\bedik100\Dane aplikacji\HouseCall 6.6\Toolkit.dll
2009-08-15 12:20 . 2009-08-15 12:20   832776   ----a-w-   c:\documents and settings\bedik100\Dane aplikacji\HouseCall 6.6\lea.dll
2009-08-15 12:20 . 2009-08-15 12:20   439560   ----a-w-   c:\documents and settings\bedik100\Dane aplikacji\HouseCall 6.6\jlea.dll
2009-08-15 12:20 . 2009-08-15 12:20   42320   ----a-w-   c:\documents and settings\bedik100\Dane aplikacji\HouseCall 6.6\dsvout.dll
2009-08-15 12:20 . 2009-08-15 12:20   183356   ----a-w-   c:\documents and settings\bedik100\Dane aplikacji\HouseCall 6.6\Uninstaller.exe
2009-08-15 12:20 . 2009-08-15 12:26   --------   d-----w-   c:\documents and settings\bedik100\Dane aplikacji\HouseCall 6.6
2009-08-15 12:13 . 2008-07-08 12:54   148496   ----a-w-   c:\windows\system32\drivers\64130644.sys
2009-08-15 10:11 . 2008-07-08 12:54   148496   ----a-w-   c:\windows\system32\drivers\72200413.sys
2009-08-10 19:23 . 2009-08-10 19:23   --------   d-----w-   c:\windows\Sun
2009-08-10 19:23 . 2009-08-10 19:23   39473   ----a-w-   c:\windows\system32\Win3bht.exe
2009-08-10 19:19 . 2009-08-10 19:19   --------   d-----w-   c:\program files\Java
2009-08-10 19:18 . 2009-08-10 19:18   152576   ----a-w-   c:\documents and settings\bedik100\Dane aplikacji\Sun\Java\jre1.6.0_14\lzma.dll
2009-08-06 11:52 . 2009-08-06 11:52   78336   ----a-w-   c:\windows\system32\82.scr
2009-08-06 11:38 . 2009-08-06 11:38   78336   ----a-w-   c:\windows\system32\85.scr
2009-08-06 11:36 . 2009-08-06 11:36   78336   ----a-w-   c:\windows\system32\18.scr
2009-08-06 11:16 . 2009-08-06 11:15   76288   --sh--r-   c:\windows\usb_magr.exe
2009-08-06 11:15 . 2009-08-06 11:15   76288   ----a-w-   c:\windows\system32\Ms12x.exe
2009-08-06 11:03 . 2009-08-06 11:03   78336   ----a-w-   c:\windows\system32\22.scr
2009-08-06 11:01 . 2009-08-06 11:02   503808   ----a-w-   c:\windows\system32\Win15763.exe
2009-08-06 10:45 . 2009-08-06 10:45   78336   ----a-w-   c:\windows\system32\17.scr
2009-08-06 10:37 . 2009-08-06 10:37   78336   ----a-w-   c:\windows\system32\10.scr
2009-08-06 10:28 . 2009-08-06 10:28   78336   ----a-w-   c:\windows\system32\78.scr
2009-08-06 10:14 . 2009-08-06 10:14   77824   --sh--r-   c:\windows\mssrv32.exe
2009-08-06 10:14 . 2009-08-06 10:14   --------   d-sh--r-   c:\program files\Common Files\yrujg2wn
2009-07-31 20:44 . 2009-07-31 20:44   --------   d-----w-   c:\documents and settings\All Users\Dane aplikacji\Zylom
2009-07-31 20:44 . 2009-03-24 09:10   114688   ----a-w-   c:\documents and settings\All Users\Dane aplikacji\Zylom\ZylomGamesPlayer\npzylomgamesplayer.dll
2009-07-31 20:44 . 2006-12-12 15:07   161976   ----a-w-   c:\documents and settings\All Users\Dane aplikacji\Zylom\ZylomGamesPlayer\zylomgamesplayer.dll
2009-07-31 20:44 . 2009-07-31 20:44   --------   d-----w-   c:\program files\Zylom Games
2009-07-29 10:40 . 2009-07-29 10:40   --------   d-----w-   c:\documents and settings\All Users\Dane aplikacji\NortonInstaller
2009-07-29 10:39 . 2009-07-29 10:39   --------   d-----w-   c:\documents and settings\bedik100\Dane aplikacji\Media Player Classic
2009-07-29 10:38 . 2009-07-29 10:38   --------   d-----w-   c:\documents and settings\All Users\Dane aplikacji\Apple Computer
2009-07-29 10:38 . 2009-07-29 10:38   --------   d-----w-   c:\windows\system32\QuickTime
2009-07-29 10:38 . 2002-11-08 18:04   225280   ----a-w-   c:\windows\system32\qtmlClient.dll
2009-07-29 10:38 . 2005-09-16 19:07   106496   ----a-w-   c:\documents and settings\bedik100\Dane aplikacji\Nowe Gadu-Gadu\_userdata\npqtplugin4.dll
2009-07-29 10:38 . 2005-09-16 19:07   106496   ----a-w-   c:\documents and settings\bedik100\Dane aplikacji\Nowe Gadu-Gadu\_userdata\npqtplugin3.dll
2009-07-29 10:38 . 2005-09-16 19:07   106496   ----a-w-   c:\documents and settings\bedik100\Dane aplikacji\Nowe Gadu-Gadu\_userdata\npqtplugin2.dll
2009-07-29 10:38 . 2005-09-16 19:07   106496   ----a-w-   c:\documents and settings\bedik100\Dane aplikacji\Nowe Gadu-Gadu\_userdata\npqtplugin.dll
2009-07-29 10:38 . 2009-07-29 10:38   --------   d-----w-   c:\program files\Media Player Classic
2009-07-29 10:38 . 2009-07-29 10:38   --------   d-----w-   c:\program files\QuickTime Alternative
2009-07-29 10:30 . 2009-07-29 10:29   737280   ----a-w-   c:\windows\iun6002.exe
2009-07-29 10:30 . 2009-07-29 10:30   --------   d-----w-   c:\program files\Codec Pack - All In 1
2009-07-27 19:58 . 2009-08-10 19:19   410984   ----a-w-   c:\windows\system32\deploytk.dll
2009-07-27 19:55 . 2009-07-27 19:55   114616   ----a-w-   c:\windows\system32\mshshsui.exe

.
((((((((((((((((((((((((((((((((((((((((   Sekcja Find3M   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-08-15 14:22 . 2009-05-26 20:25   --------   d-----w-   c:\program files\DialNet
2009-08-15 12:21 . 2009-08-15 12:21   90183   ----a-w-   c:\documents and settings\bedik100\Dane aplikacji\HouseCall 6.6\TmEngDrv.dll
2009-08-15 12:21 . 2009-08-15 12:21   98304   ----a-w-   c:\documents and settings\bedik100\Dane aplikacji\HouseCall 6.6\getMac.exe
2009-08-15 12:21 . 2009-08-15 12:21   69632   ----a-w-   c:\documents and settings\bedik100\Dane aplikacji\HouseCall 6.6\mfcm80.dll
2009-08-15 12:21 . 2009-08-15 12:21   626688   ----a-w-   c:\documents and settings\bedik100\Dane aplikacji\HouseCall 6.6\msvcr80.dll
2009-08-15 12:21 . 2009-08-15 12:21   57344   ----a-w-   c:\documents and settings\bedik100\Dane aplikacji\HouseCall 6.6\mfcm80u.dll
2009-08-15 12:21 . 2009-08-15 12:21   548864   ----a-w-   c:\documents and settings\bedik100\Dane aplikacji\HouseCall 6.6\msvcp80.dll
2009-08-15 12:21 . 2009-08-15 12:21   479232   ----a-w-   c:\documents and settings\bedik100\Dane aplikacji\HouseCall 6.6\msvcm80.dll
2009-08-15 12:21 . 2009-08-15 12:21   1093632   ----a-w-   c:\documents and settings\bedik100\Dane aplikacji\HouseCall 6.6\mfc80.dll
2009-08-15 12:21 . 2009-08-15 12:21   1079808   ----a-w-   c:\documents and settings\bedik100\Dane aplikacji\HouseCall 6.6\mfc80u.dll
2009-08-09 20:13 . 2009-06-03 09:02   --------   d-----w-   c:\documents and settings\bedik100\Dane aplikacji\Tlen.pl
2009-08-05 11:54 . 2009-06-22 18:48   155227   ----a-w-   c:\windows\hpoins14.dat
2009-07-14 19:20 . 2009-07-14 19:20   115102   ----a-w-   c:\windows\system32\mskskiosa.exe
2009-07-11 16:21 . 2009-07-11 16:21   --------   d-----w-   c:\program files\Microsoft Games
2009-07-11 16:08 . 2009-07-11 16:08   114616   ----a-w-   c:\windows\system32\mskskiosb.exe
2009-07-10 18:12 . 2009-07-10 18:01   --------   d-----w-   c:\program files\D-Tools
2009-06-28 10:39 . 2009-06-28 10:38   --------   d-----w-   c:\program files\BearShare
2009-06-22 18:56 . 2009-06-22 18:56   --------   d-----w-   c:\program files\Hewlett-Packard
2009-06-22 18:42 . 2009-05-29 19:32   --------   d-----w-   c:\program files\HP
2009-06-22 18:14 . 2009-05-29 19:36   --------   d-----w-   c:\documents and settings\All Users\Dane aplikacji\HP
2009-06-22 06:42 . 2009-06-22 06:42   114616   ----a-w-   c:\windows\system32\msmshdll1b.exe
2009-06-16 19:18 . 2009-06-16 19:18   114616   ----a-w-   c:\windows\system32\msjsudlls1b.exe
2009-06-13 14:18 . 2009-06-13 14:18   114616   ----a-w-   c:\windows\system32\msjsidll2b.exe
2009-06-11 19:32 . 2009-06-11 19:32   15192   ----a-w-   c:\documents and settings\bedik100\Ustawienia lokalne\Dane aplikacji\GDIPFONTCACHEV1.DAT
2009-06-07 18:06 . 2009-06-07 18:06   114613   ----a-w-   c:\windows\system32\msjsidll1b.exe
2009-05-28 08:54 . 2009-05-28 08:54   115099   ----a-w-   c:\windows\system32\msjsidll1a.exe
2009-05-26 20:43 . 2009-05-26 20:41   24140   ----a-w-   c:\windows\system32\ReKey.exe
2009-05-26 20:42 . 2009-05-26 20:42   0   ----a-w-   c:\windows\nsreg.dat
2009-05-26 20:31 . 2009-05-26 20:30   257536   ----a-w-   c:\windows\system32\wmsoft52255.exe
2009-05-26 20:31 . 2009-05-26 20:31   216576   --sh--r-   c:\windows\trkwksvc.exe
2009-05-26 20:31 . 2009-05-26 20:30   216576   ------w-   c:\windows\system32\wmsoft01437.exe
2009-05-26 20:29 . 2001-10-26 16:15   49712   ----a-w-   c:\windows\system32\perfc015.dat
2009-05-26 20:29 . 2001-10-26 16:15   355830   ----a-w-   c:\windows\system32\perfh015.dat
2009-05-26 19:58 . 2009-05-26 19:58   80007   ----a-w-   c:\windows\PCHEALTH\HELPCTR\OfflineCache\index.dat
2009-05-26 19:55 . 2009-05-26 19:55   21856   ----a-w-   c:\windows\system32\emptyregdb.dat
2009-05-26 16:01 . 2009-05-26 16:01   42088   ----a-w-   c:\documents and settings\bedik100\Dane aplikacji\Nowe Gadu-Gadu\_userdata\ggbho.1.dll
2009-05-26 15:12 . 2009-05-26 15:12   11264   ----a-w-   c:\documents and settings\bedik100\Dane aplikacji\Nowe Gadu-Gadu\_userdata\npgg.1.dll
2004-10-01 13:00 . 2009-05-26 20:12   40960   ----a-w-   c:\program files\Uninstall_CDS.exe
.

(((((((((((((((((((((((((((((((((((((   Wpisy startowe rejestru   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane 
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Komunikator"="c:\program files\Tlen.pl\tlen.exe" [2009-01-17 5853672]
"Java VM v6.9.2"="c:\windows\System32\jdk-1_5_0_19-windows-i393-pp\jav.bat" [2008-03-05 87]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"a-winpoet-service"="c:\program files\DialNet\winpppoverethernet.exe" [2007-01-18 405504]
"z-wrdialer"="c:\program files\DialNet\wrdialer.exe" [2007-01-18 483328]
"Java VM v6.9.2"="c:\windows\System32\jdk-1_5_0_19-windows-i393-pp\jav.bat" [2008-03-05 87]
"DAEMON Tools-1033"="c:\program files\D-Tools\daemon.exe" [2004-08-22 81920]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-08-10 148888]
"SoundMan"="SOUNDMAN.EXE" - c:\windows\SOUNDMAN.EXE [2002-06-14 46592]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"Java VM v6.9.2"="c:\windows\System32\jdk-1_5_0_19-windows-i393-pp\jav.bat" [2008-03-05 87]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"XP HOT Rebild"="Win15763.exe" - c:\windows\system32\Win15763.exe [2009-08-06 503808]

c:\documents and settings\All Users\Menu Start\Programy\Autostart\
Microsoft Office.lnk - c:\program files\Microsoft Office\Office\OSA9.EXE [1999-2-17 65588]

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001
"UpdatesDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
"DisableNotifications"= 1 (0x1)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\Program Files\\Common Files\\yrujg2wn\\ginder86.exe"=
"trkwksvc.exe"= trkwksvc.exe:SYSTEM

R1 SbFw;SbFw;c:\windows\system32\drivers\SbFw.sys [2009-05-26 270888]
R1 sbhips;Sunbelt HIPS Driver;c:\windows\system32\drivers\sbhips.sys [2008-06-21 66600]
R2 SbPF.Launcher;SbPF.Launcher;c:\program files\Sunbelt Software\Personal Firewall\SbPFLnch.exe [2008-10-31 95528]
R2 SPF4;Sunbelt Personal Firewall 4;c:\program files\Sunbelt Software\Personal Firewall\SbPFSvc.exe [2008-10-31 1365288]
R2 TopWinPoETDriver;WinPoET PPPoE Optimized Driver;c:\windows\system32\drivers\WrKPoET2000.sys [2009-05-26 52214]
R3 FPD;Fine Point Packet Service;c:\windows\system32\drivers\fpd.sys [2009-05-26 30336]
R3 SBFWIMCL;Sunbelt Software Firewall NDIS IM Filter Miniport;c:\windows\system32\drivers\SbFwIm.sys [2009-05-26 65576]
R3 WrKPoET2000;WrKPoET2000;c:\program files\DialNet\WrKPoET2000.sys [2009-05-26 52214]
R3 WRSWanDD;WinPoET PPPoE Adapter;c:\windows\system32\drivers\WrKPoETNic2000.sys [2009-05-26 65604]
S1 is-DANFAdrv;is-DANFAdrv;c:\windows\system32\drivers\72200413.sys [2009-08-15 148496]
S1 is-F43BAdrv;is-F43BAdrv;c:\windows\system32\drivers\64130644.sys [2009-08-15 148496]
S2 7truityui;8hut56u;c:\program files\Common Files\yrujg2wn\ginder86.exe [2009-08-06 78336]
S3 SetupNTGLM7X;SetupNTGLM7X;\??\f:\ntglm7x.sys --> f:\NTGLM7X.sys [?]

--- Inne Usługi/Sterowniki w Pamięci ---

*NewlyCreated* - ALG
*NewlyCreated* - IPNAT

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12   REG_MULTI_SZ      Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt   REG_MULTI_SZ      hpqcxs08 hpqddsvc
.
- - - - USUNIĘTO PUSTE WPISY - - - -

HKCU-Run-Java VM v6.91 - c:\windows\System32\jdk-1_5_0_19-windows-i391-pp\jav.bat
HKLM-Run-Java VM v6.91 - c:\windows\System32\jdk-1_5_0_19-windows-i391-pp\jav.bat
HKLM-RunOnce-Java VM v6.9.2 - (no file)
HKU-Default-Run-Java VM v6.91 - c:\windows\System32\jdk-1_5_0_19-windows-i391-pp\jav.bat
HKU-Default-RunOnce-Java VM v6.91 - (no file)


.
------- Skan uzupełniający -------
.
FF - ProfilePath - c:\documents and settings\bedik100\Dane aplikacji\Mozilla\Firefox\Profiles\nrevri8o.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.onet.pl/
FF - plugin: c:\documents and settings\All Users\Dane aplikacji\Zylom\ZylomGamesPlayer\npzylomgamesplayer.dll
FF - plugin: c:\documents and settings\bedik100\Dane aplikacji\Nowe Gadu-Gadu\_userdata\npgg.1.dll
FF - plugin: c:\documents and settings\bedik100\Dane aplikacji\Nowe Gadu-Gadu\_userdata\npqtplugin.dll
FF - plugin: c:\documents and settings\bedik100\Dane aplikacji\Nowe Gadu-Gadu\_userdata\npqtplugin2.dll
FF - plugin: c:\documents and settings\bedik100\Dane aplikacji\Nowe Gadu-Gadu\_userdata\npqtplugin3.dll
FF - plugin: c:\documents and settings\bedik100\Dane aplikacji\Nowe Gadu-Gadu\_userdata\npqtplugin4.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npzylomgamesplayer.dll
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-08-15 16:23
Windows 5.1.2600  NTFS

skanowanie ukrytych procesów ... 

skanowanie ukrytych wpisów autostartu ...

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
  Java VM v6.9.2 = c:\windows\System32\jdk-1_5_0_19-windows-i393-pp\jav.bat???????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????
  Java VM v6.91 = c:\windows\System32\jdk-1_5_0_19-windows-i391-pp\jav.bat???????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????
HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce
  Java VM v6.9.2 = ???????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
  Java VM v6.9.2 = c:\windows\System32\jdk-1_5_0_19-windows-i393-pp\jav.bat???????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????

skanowanie ukrytych plików ... 

skanowanie pomyślnie ukończone
ukryte pliki: 0

**************************************************************************
.
--------------------- Pliki DLL ładowane pod uruchomionymi procesami ---------------------

- - - - - - - > 'winlogon.exe'(792)
c:\windows\system32\ODBC32.dll

- - - - - - - > 'lsass.exe'(856)
c:\windows\system32\mswsock.dll
c:\windows\System32\wshtcpip.dll
c:\windows\System32\dssenh.dll
.
------------------------ Pozostałe uruchomione procesy ------------------------
.
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\DialNet\WrOS.exe
c:\program files\Sunbelt Software\Personal Firewall\SbPFCl.exe
c:\windows\system32\wbem\wmiapsrv.exe
.
**************************************************************************
.
Czas ukończenia: 2009-08-15 16:28 - komputer został uruchomiony ponownie
ComboFix-quarantined-files.txt  2009-08-15 14:28

Przed: 9 590 341 632 bajtów wolnych
Po: 9 733 787 648 bajtów wolnych

WinXP_PL_PRO_BF.EXE
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /fastdetect

347

[wojtas]

Otworz notatnik i wklej w nim to:

File::
c:\windows\system32\82.scr
c:\windows\system32\85.scr
c:\windows\system32\18.scr
c:\windows\usb_magr.exe
c:\windows\system32\Ms12x.exe
c:\windows\system32\22.scr
c:\windows\system32\Win15763.exe
c:\windows\system32\17.scr
c:\windows\system32\10.scr
c:\windows\system32\78.scr
c:\windows\mssrv32.exe
c:\windows\system32\mshshsui.exe
c:\windows\system32\mskskiosa.exe
c:\windows\system32\mskskiosb.exe
c:\windows\system32\msmshdll1b.exe
c:\windows\system32\msjsudlls1b.exe
c:\windows\system32\msjsidll2b.exe
c:\windows\system32\msjsidll1b.exe
c:\windows\system32\msjsidll1a.exe
c:\windows\system32\ReKey.exe
c:\windows\system32\wmsoft52255.exe
c:\windows\trkwksvc.exe
c:\windows\system32\wmsoft01437.exe
c:\program files\Common Files\yrujg2wn\ginder86.exe

Folder::
c:\program files\Common Files\yrujg2wn

Registry::
[HKEY_LOCAL_MACHINE\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\Program Files\\Common Files\\yrujg2wn\\ginder86.exe"=
"trkwksvc.exe"=-

Driver::
is-DANFAdrv
is-F43BAdrv
7truityui
8hut56u

>>Plik>>Zapisz jako... >>> CFScript
Przeciągnij i upuść plik CFScript.txt na plik ComboFix.exe
-->