problem z worm.win32.netsky

**Posty:** 29 · przez **podek** 16 Gru 2007, 07:05

Tak jak w temacie mam problem z worm.win32.netsky Proszę o natychmiastową pomoc w miarę możliwości. Zamieszczam log z hijack this.

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 00:25:40, on 2007-12-16 Platform: Windows XP Dodatek SP. 1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\csrss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe C:\Program Files\Eset\nod32krn.exe C:\WINDOWS\System32\nvsvc32.exe C:\WINDOWS\System32\HPZipm12.exe C:\WINDOWS\System32\PnkBstrA.exe C:\Program Files\Spyware Doctor\svcntaux.exe C:\Program Files\Spyware Doctor\swdsvc.exe C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Spyware Doctor\SDTrayApp.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe C:\Program Files\Eset\nod32kui.exe C:\Program Files\Anti-Trojan-55\ATWatch.exe C:\WINDOWS\System32\RUNDLL32.EXE C:\Program Files\Common Files\Teleca Shared\CapabilityManager.exe D:\Program Files\Gadu-Gadu\gg.exe C:\WINDOWS\System32\rundll32.exe C:\Program Files\Messenger\msmsgs.exe C:\Program Files\Skype\Phone\Skype.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Common Files\Teleca Shared\Generic.exe C:\Program Files\Skype\Plugin Manager\skypePM.exe C:\Program Files\Sony Ericsson\Mobile2\Mobile Phone Monitor\epmworker.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\Program Files\Trend Micro\HijackThis\HijackThis.exe C:\WINDOWS\System32\wbem\wmiprvse.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://softwarereferral.com/jump.php?wmid=6010&mid=MjI6Ojg5&lid=2 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: flashget urlcatch - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\Program Files\FlashGet\jccatch.dll O2 - BHO: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) O2 - BHO: BDEX System - {A8565FBC-8D53-4D4F-9BB0-CBC68A22B126} - C:\WINDOWS\blopenvxdt.dll O2 - BHO: Mega Manager IE Click Monitor - {bf00e119-21a3-4fd1-b178-3b8537e75c92} - C:\Program Files\Megaupload\Mega Manager\MegaIEMn.dll O2 - BHO: FlashGet GetFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\Program Files\FlashGet\getflash.dll O3 - Toolbar: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O3 - Toolbar: The retnsrp - {CC304A4D-FC79-4CD3-9A67-46E3AF59319D} - C:\WINDOWS\retnsrp.dll O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" O4 - HKLM\..\Run: [Sony Ericsson PC Suite] "C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [AT-Watch] C:\Program Files\Anti-Trojan-55\ATWatch.exe O4 - HKLM\..\Run: [Anti-Trojan-Watch] C:\Program Files\Anti-Trojan-55\ATWatch.exe O4 - HKLM\..\Run: [SDTray] "C:\Program Files\Spyware Doctor\SDTrayApp.exe" O4 - HKLM\..\RunServices: [Microsft Security Monitor Process] mssmpp.exe O4 - HKLM\..\RunServices: [Windows Config System] config.exe O4 - HKCU\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NVMCTRAY.DLL,NvTaskbarInit O4 - HKCU\..\Run: [NVIEW] rundll32.exe nview.dll,nViewLoadHook O4 - HKCU\..\Run: [Gadu-Gadu] "D:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized O4 - HKCU\..\Run: [AlcoholAutomount] "C:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe" /automount O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user') O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE O8 - Extra context menu item: &Download All with FlashGet - C:\Program Files\FlashGet\jc_all.htm O8 - Extra context menu item: &Download with FlashGet - C:\Program Files\FlashGet\jc_link.htm O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O8 - Extra context menu item: Pobierz za pomocą Mega Manager... - C:\Program Files\Megaupload\Mega Manager\mm_file.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload.adobe.com/pub/shockwave/cabs/flash/swflash.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{C1BCEED8-0096-4211-A825-3E640B412B77}: NameServer = 194.204.159.1 217.98.63.164 O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O21 - SSODL: leorop - {975BD964-E4E5-430E-85F7-3237B942D334} - C:\WINDOWS\leorop.dll O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\System32\PnkBstrA.exe O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\svcntaux.exe O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\swdsvc.exe O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe O23 - Service: Windows User Mode Driver Framework (UMWdf) - Unknown owner - C:\WINDOWS\System32\wdfmgr.exe (file missing) -- End of file - 8029 bytes

**Posty:** 1340 · przez **eSpEY** 16 Gru 2007, 11:10

Kod: Zaznacz wszystko: R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://softwarereferral.com/jump.php?wmid=6010&mid=MjI6Ojg5&lid=2

Kod: Zaznacz wszystko: O4 - HKLM\..\RunServices: [Windows Config System] config.exe

znasz to? nie? delete

Zastosuj się do tego tematu

**Posty:** 29 · przez **podek** 16 Gru 2007, 12:33

Jestem zielony jeżeli chodzi o te sprawy, ale postaram się przeanalizować tamten temat.

**Posty:** 3854 · przez **Dzi@dek** 16 Gru 2007, 12:45

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://softwarereferral.com/jump.php?wmid=6010&mid=MjI6Ojg5&lid=2
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: BDEX System - {A8565FBC-8D53-4D4F-9BB0-CBC68A22B126} - C:\WINDOWS\blopenvxdt.dll
O3 - Toolbar: The retnsrp - {CC304A4D-FC79-4CD3-9A67-46E3AF59319D} - C:\WINDOWS\retnsrp.dll
O4 - HKLM\..\RunServices: [Microsft Security Monitor Process] mssmpp.exe
O4 - HKLM\..\RunServices: [Windows Config System] config.exe
O21 - SSODL: leorop - {975BD964-E4E5-430E-85F7-3237B942D334} - C:\WINDOWS\leorop.dll

Zaznacz te wpisy w hijackthis i -> fix checked.

Daj nowy log po zabiegu oraz log z combofix
http://www.programosy.pl/program,combofix.html

**Posty:** 29 · przez **podek** 16 Gru 2007, 13:33

Po usunięciu nie wyświetlają się już te komunikaty, ale gdy włączam komputer i wybieram swój profil, komputer wchodzi na mój profil bardzo powoli i ładuje się około 5-10 minut. Można na to coś poradzić? Może brakuje jakiegoś pliku do windowsa?

Log z hijack this po usunięciu tych plików

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 12:36:44, on 2007-12-16 Platform: Windows XP Dodatek SP. 1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\csrss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe C:\Program Files\Eset\nod32krn.exe C:\WINDOWS\System32\nvsvc32.exe C:\WINDOWS\System32\HPZipm12.exe C:\WINDOWS\System32\PnkBstrA.exe C:\Program Files\Spyware Doctor\svcntaux.exe C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe C:\Program Files\Eset\nod32kui.exe C:\Program Files\Anti-Trojan-55\ATWatch.exe C:\Program Files\Spyware Doctor\SDTrayApp.exe C:\Program Files\Spyware Doctor\swdsvc.exe C:\Program Files\Common Files\Teleca Shared\CapabilityManager.exe C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Common Files\Teleca Shared\Generic.exe C:\Program Files\Sony Ericsson\Mobile2\Mobile Phone Monitor\epmworker.exe C:\WINDOWS\explorer.exe C:\WINDOWS\system32\notepad.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe C:\WINDOWS\System32\wbem\wmiprvse.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: flashget urlcatch - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\Program Files\FlashGet\jccatch.dll O2 - BHO: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O2 - BHO: Mega Manager IE Click Monitor - {bf00e119-21a3-4fd1-b178-3b8537e75c92} - C:\Program Files\Megaupload\Mega Manager\MegaIEMn.dll O2 - BHO: FlashGet GetFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\Program Files\FlashGet\getflash.dll O3 - Toolbar: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" O4 - HKLM\..\Run: [Sony Ericsson PC Suite] "C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [AT-Watch] C:\Program Files\Anti-Trojan-55\ATWatch.exe O4 - HKLM\..\Run: [Anti-Trojan-Watch] C:\Program Files\Anti-Trojan-55\ATWatch.exe O4 - HKLM\..\Run: [SDTray] "C:\Program Files\Spyware Doctor\SDTrayApp.exe" O4 - HKCU\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NVMCTRAY.DLL,NvTaskbarInit O4 - HKCU\..\Run: [NVIEW] rundll32.exe nview.dll,nViewLoadHook O4 - HKCU\..\Run: [Gadu-Gadu] "D:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized O4 - HKCU\..\Run: [AlcoholAutomount] "C:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe" /automount O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user') O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE O8 - Extra context menu item: &Download All with FlashGet - C:\Program Files\FlashGet\jc_all.htm O8 - Extra context menu item: &Download with FlashGet - C:\Program Files\FlashGet\jc_link.htm O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O8 - Extra context menu item: Pobierz za pomocą Mega Manager... - C:\Program Files\Megaupload\Mega Manager\mm_file.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe O16 - DPF: {68282C51-9459-467B-95BF-3C0E89627E55} (MksSkanerOnline Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload.adobe.com/pub/shockwave/cabs/flash/swflash.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{C1BCEED8-0096-4211-A825-3E640B412B77}: NameServer = 194.204.159.1 217.98.63.164 O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O21 - SSODL: leorop - {ECBF39AC-EF04-4274-B8BF-41ABDBA727DD} - C:\WINDOWS\leorop.dll O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\System32\PnkBstrA.exe O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\svcntaux.exe O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\swdsvc.exe O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe O23 - Service: Windows User Mode Driver Framework (UMWdf) - Unknown owner - C:\WINDOWS\System32\wdfmgr.exe (file missing) -- End of file - 7376 bytes

Log z combofixa. Jeżeli coś źle wkleiłem to napiszcie, bo nie jestem dobry w tych sprawach..

Kod: Zaznacz wszystko: ComboFix 07-12-16.3 - Podek 2007-12-16 12:18:33.1 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.1.1250.1.1045.18.76 [GMT 1:00] Running from: C:\Documents and Settings\Podek\Pulpit\ComboFix.exe * Created a new restore point . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\Documents and Settings\Mama\Pulpit\Error Cleaner.url C:\Documents and Settings\Mama\Pulpit\Privacy Protector.url C:\Documents and Settings\Mama\Ulubione\Error Cleaner.url C:\Documents and Settings\Mama\Ulubione\Privacy Protector.url C:\Documents and Settings\Mama\Ulubione\Spyware&Malware Protection.url C:\Documents and Settings\Podek\Pulpit\Error Cleaner.url C:\Documents and Settings\Podek\Pulpit\Privacy Protector.url C:\Documents and Settings\Podek\Pulpit\Spyware&Malware Protection.url C:\Documents and Settings\Podek\Ulubione\Error Cleaner.url C:\Documents and Settings\Podek\Ulubione\Privacy Protector.url C:\Documents and Settings\Podek\Ulubione\Spyware&Malware Protection.url C:\Program Files\FunWebProducts C:\Program Files\MyWebSearch C:\Program Files\MyWebSearch\bar\History\search2 C:\Program Files\MyWebSearch\bar\Settings\s_pid.dat C:\WINDOWS\dat.txt C:\WINDOWS\rs.txt . ((((((((((((((((((((((((( Files Created from 2007-11-16 to 2007-12-16 ))))))))))))))))))))))))))))))) . 2007-12-16 11:54 . 2007-08-20 10:40 <DIR> d--h----- C:\Documents and Settings\Administrator\Ustawienia lokalne 2007-12-16 11:54 . 2007-08-20 10:40 <DIR> d-------- C:\Documents and Settings\Administrator\Ulubione 2007-12-16 11:54 . 2007-08-20 09:47 <DIR> d--h----- C:\Documents and Settings\Administrator\Szablony 2007-12-16 11:54 . 2007-08-20 10:40 <DIR> d-------- C:\Documents and Settings\Administrator\Pulpit 2007-12-16 11:54 . 2007-08-20 10:40 <DIR> d-------- C:\Documents and Settings\Administrator\Moje dokumenty 2007-12-16 11:54 . 2007-08-20 10:40 <DIR> dr------- C:\Documents and Settings\Administrator\Menu Start 2007-12-16 11:54 . 2007-08-20 10:40 <DIR> dr-h----- C:\Documents and Settings\Administrator\Dane aplikacji 2007-12-16 00:29 . 2007-12-16 00:47 <DIR> d-------- C:\Program Files\SkanerOnline 2007-12-16 00:25 . 2007-12-16 00:25 <DIR> d-------- C:\Program Files\Trend Micro 2007-12-15 14:15 . 2007-12-16 12:04 <DIR> d-a------ C:\Documents and Settings\All Users\Dane aplikacji\TEMP 2007-12-15 14:13 . 2007-12-15 20:21 <DIR> d-------- C:\Program Files\Spyware Doctor 2007-12-15 14:13 . 2007-12-15 14:13 <DIR> d-------- C:\Documents and Settings\Podek\Dane aplikacji\PC Tools 2007-12-15 14:13 . 2005-09-23 08:29 626,688 --a------ C:\WINDOWS\system32\msvcr80.dll 2007-12-15 14:13 . 2007-10-18 00:16 79,688 --a------ C:\WINDOWS\system32\drivers\iksyssec.sys 2007-12-15 14:13 . 2007-10-18 00:15 62,280 --a------ C:\WINDOWS\system32\drivers\iksysflt.sys 2007-12-15 14:13 . 2007-10-18 00:14 41,288 --a------ C:\WINDOWS\system32\drivers\ikfilesec.sys 2007-12-15 14:13 . 2007-10-18 00:16 29,000 --a------ C:\WINDOWS\system32\drivers\kcom.sys 2007-12-15 10:53 . 2007-12-15 10:53 <DIR> d-------- C:\Documents and Settings\Mama\Dane aplikacji\Lavasoft 2007-12-14 23:10 . 2007-12-14 18:57 208,896 --a------ C:\WINDOWS\leorop.dll 2007-12-14 23:10 . 2007-12-14 18:57 167,936 --a------ C:\WINDOWS\retnsrp.dll 2007-12-14 23:10 . 2007-12-14 18:57 77,824 --a------ C:\WINDOWS\jokvip.exe 2007-12-14 23:09 . 2007-12-14 23:20 <DIR> d-------- C:\Program Files\SmartVideoCodec 2007-12-11 19:20 . 2007-12-11 19:20 <DIR> d-------- C:\Documents and Settings\Podek\Dane aplikacji\Talkback 2007-12-11 00:27 . 2007-12-11 00:48 <DIR> d-------- C:\Documents and Settings\Podek\Dane aplikacji\DeepBurner 2007-12-11 00:26 . 2007-12-11 00:26 <DIR> d-------- C:\Program Files\Astonsoft 2007-12-11 00:13 . 2007-12-11 00:13 <DIR> d-------- C:\Program Files\Alcohol Soft 2007-12-07 16:25 . 2007-12-07 16:25 <DIR> d-------- C:\Documents and Settings\Podek\Dane aplikacji\AdobeAUM 2007-12-05 23:58 . 2007-12-16 01:02 <DIR> d-------- C:\Program Files\Counter-Strike 1.6 2007-12-05 13:22 . 2007-12-15 08:49 <DIR> d-------- C:\Documents and Settings\Mama\Dane aplikacji\skypePM 2007-12-05 13:21 . 2007-12-15 11:05 <DIR> d-------- C:\Documents and Settings\Mama\Dane aplikacji\Skype 2007-12-04 15:59 . 2007-12-16 11:10 <DIR> d-------- C:\Documents and Settings\Podek\Dane aplikacji\skypePM 2007-12-04 15:59 . 2007-12-04 15:59 32 --a------ C:\Documents and Settings\All Users\Dane aplikacji\ezsid.dat 2007-12-04 15:58 . 2007-12-16 12:08 <DIR> d-------- C:\Documents and Settings\Podek\Dane aplikacji\Skype 2007-12-04 15:57 . 2007-12-04 15:57 <DIR> d-------- C:\Program Files\Skype 2007-12-04 15:57 . 2007-12-04 15:57 <DIR> d-------- C:\Program Files\Common Files\Skype 2007-12-04 15:56 . 2007-12-04 15:57 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Skype 2007-12-01 22:12 . 2007-12-01 22:12 40,448 --ahs---- C:\Thumbs.db 2007-11-25 18:06 . 2007-11-25 18:09 <DIR> d-------- C:\Program Files\DemoRec 2007-11-25 09:08 . 2007-12-16 12:04 <DIR> d-------- C:\Program Files\Anti-Trojan-55 2007-11-25 08:51 . 2007-11-25 09:01 <DIR> d-------- C:\Program Files\SpyRemover 2007-11-23 18:41 . 2007-11-25 12:44 <DIR> d-------- C:\Program Files\Replay Converter 2007-11-23 18:41 . 2007-11-23 18:41 737,280 --a------ C:\WINDOWS\iun6002.exe 2007-11-20 19:17 . 2007-12-15 23:53 <DIR> d-------- C:\Program Files\GrupaFP 2007-11-18 16:39 . 2007-11-18 16:39 <DIR> d--h----- C:\WINDOWS\PIF 2007-11-16 17:36 . 2007-11-16 17:38 24 ---hs---- C:\WINDOWS\S02800523.tmp 2007-11-16 17:34 . 2007-12-15 23:52 <DIR> d-------- C:\Program Files\SlySoft 2007-11-16 16:48 . 2007-11-16 16:48 685,816 --a------ C:\WINDOWS\system32\drivers\sptd.sys . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2007-12-16 10:30 --------- d-----w C:\Documents and Settings\Podek\Dane aplikacji\MegauploadToolbar 2007-12-15 22:12 --------- d-----w C:\Documents and Settings\Podek\Dane aplikacji\teamspeak2 2007-12-15 21:50 --------- d-----w C:\Documents and Settings\Mama\Dane aplikacji\MEGAUPLOADTOOLBAR 2007-12-15 12:41 --------- d-----w C:\Program Files\FlashGet 2007-12-12 20:47 --------- d-----w C:\Program Files\TibiaCam TV Lite 2007-12-07 17:01 --------- d--h--w C:\Program Files\InstallShield Installation Information 2007-12-05 15:50 22,328 ----a-w C:\WINDOWS\system32\drivers\PnkBstrK.sys 2007-12-05 15:49 103,736 ----a-w C:\WINDOWS\system32\PnkBstrB.exe 2007-12-02 16:08 --------- d-----w C:\Documents and Settings\Podek\Dane aplikacji\Tibia 2007-11-25 07:48 --------- d-----w C:\Program Files\Common Files\Adobe 2007-11-10 12:12 --------- d-----w C:\Program Files\Java 2007-11-09 18:55 --------- d-----w C:\Program Files\Vista Start Menu 2007-11-06 11:55 --------- d-----w C:\Program Files\neoSoftware 2007-11-02 12:15 --------- d-----w C:\Documents and Settings\Podek\Dane aplikacji\Temporary 2007-11-02 12:06 --------- d-----w C:\Documents and Settings\Podek\Dane aplikacji\TransRender 2007-11-02 12:06 --------- d-----w C:\Documents and Settings\Podek\Dane aplikacji\Samsung 2007-11-02 12:06 --------- d-----w C:\Documents and Settings\Podek\Dane aplikacji\ConvertTemp 2007-11-02 12:03 --------- d-----w C:\Program Files\Samsung 2007-11-01 14:32 --------- d-----w C:\Documents and Settings\Monika\Dane aplikacji\Nero 2007-10-30 19:50 --------- d-----w C:\Documents and Settings\Podek\Dane aplikacji\SopCast 2007-10-30 19:49 --------- d-----w C:\Program Files\SopCast 2007-10-30 18:00 --------- d-----w C:\Program Files\18 WoS Across America 2007-10-30 15:41 --------- d-----w C:\Program Files\Hard Truck 2007-10-29 20:48 --------- d-----w C:\Program Files\K-Lite Codec Pack 2007-10-29 13:36 66,872 ----a-w C:\WINDOWS\system32\PnkBstrA.exe 2007-10-27 12:18 --------- d-----w C:\Documents and Settings\Michał\Dane aplikacji\AdobeUM 2007-10-27 12:17 --------- d-----w C:\Documents and Settings\Michał\Dane aplikacji\Leadertech 2007-10-26 18:28 --------- d-----w C:\Documents and Settings\Monika\Dane aplikacji\MEGAUPLOADTOOLBAR 2007-10-20 17:30 --------- d-----w C:\Documents and Settings\Michał\Dane aplikacji\Vista Start Menu 2007-10-07 10:09 7,680 ----a-w C:\WINDOWS\system32\ff_vfw.dll 2007-10-04 22:27 73,216 ----a-w C:\WINDOWS\ST6UNST.EXE 2007-10-04 22:27 249,856 ------w C:\WINDOWS\Setup1.exe 2007-10-01 18:33 60,273 ----a-w C:\WINDOWS\system32\pthreadGC2.dll 2007-09-20 07:59 972,072 ----a-w C:\WINDOWS\UNRecode.exe 2007-09-20 07:55 972,072 ----a-w C:\WINDOWS\UNNeroMediaHome.exe 2007-09-20 07:55 95,600 ----a-w C:\WINDOWS\system32\NeroCo.dll 2005-07-14 19:31 27,648 --sha-w C:\WINDOWS\system32\AVSredirect.dll . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NvMediaCenter"="RUNDLL32.exe" [2001-10-26 18:30 C:\WINDOWS\system32\rundll32.exe] "NVIEW"="nview.dll" [2003-07-29 06:19 C:\WINDOWS\system32\nview.dll] "Gadu-Gadu"="D:\Program Files\Gadu-Gadu\gg.exe" [2007-07-09 08:39] "MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2002-08-20 14:08] "Skype"="C:\Program Files\Skype\Phone\Skype.exe" [2007-11-16 12:39] "AlcoholAutomount"="C:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe" [2007-07-02 11:27] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11] "Sony Ericsson PC Suite"="C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" [2005-10-26 15:17] "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-05-11 02:06] "nod32kui"="C:\Program Files\Eset\nod32kui.exe" [2007-09-08 20:31] "NBKeyScan"="C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" [2007-09-20 08:51] "NvCplDaemon"="RUNDLL32.exe" [2001-10-26 18:30 C:\WINDOWS\system32\rundll32.exe] "nwiz"="nwiz.exe" [2003-07-29 06:19 C:\WINDOWS\system32\nwiz.exe] "AT-Watch"="C:\Program Files\Anti-Trojan-55\ATWatch.exe" [2002-09-08 09:03] "Anti-Trojan-Watch"="C:\Program Files\Anti-Trojan-55\ATWatch.exe" [2002-09-08 09:03] "SDTray"="C:\Program Files\Spyware Doctor\SDTrayApp.exe" [2007-11-02 17:24] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2002-09-20 17:05] "NvMediaCenter"="RUNDLL32.exe" [2001-10-26 18:30 C:\WINDOWS\system32\rundll32.exe] C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\ Adobe Gamma Loader.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2007-11-25 08:48:52] Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 09:01:04] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad] "leorop"= {ECBF39AC-EF04-4274-B8BF-41ABDBA727DD} - C:\WINDOWS\leorop.dll [2007-12-14 18:57 208896] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdauxservice] @="" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdcoreservice] @="" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Microsoft Office.lnk] path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Microsoft Office.lnk backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Photo Downloader] 2005-06-06 22:46 57344 --a------ C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BearShare] C:\Program Files\BearShare\BearShare.exe /pause [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE] 2002-09-20 17:05 13312 --a------ C:\WINDOWS\System32\ctfmon.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Flashget] C:\Program Files\FlashGet\FlashGet.exe /min [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Microsft Security Monitor Process] mssmpp.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\mmsass] mmdmm.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroCheck] C:\WINDOWS\system32\NeroCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] 2007-03-01 14:57 153136 --a------ C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz] nwiz.exe /install [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] C:\Program Files\QuickTime\qttask.exe -atboottime [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Sony Ericsson PC Suite] C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe /startoptions [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpeedTouch USB Diagnostics] C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe /icon [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent] 2007-05-19 10:39 35328 --a------ C:\Program Files\Winamp\winampa.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows Config System] config.exe R2 Nero BackItUp Scheduler 3;Nero BackItUp Scheduler 3;C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe S3 ss_bus;SAMSUNG Mobile USB Device 1.0 driver (WDM);C:\WINDOWS\System32\DRIVERS\ss_bus.sys S3 ss_mdfl;SAMSUNG Mobile USB Modem 1.0 Filter;C:\WINDOWS\System32\DRIVERS\ss_mdfl.sys S3 ss_mdm;SAMSUNG Mobile USB Modem 1.0 Drivers;C:\WINDOWS\System32\DRIVERS\ss_mdm.sys *Newly Created Service* - CATCHME *Newly Created Service* - PROCEXP90 . Contents of the 'Scheduled Tasks' folder "2007-10-19 10:02:28 C:\WINDOWS\Tasks\Norton Security Scan.job" - C:\Program Files\Norton Security Scan\Nss.exe . ************************************************************************** catchme 0.3.1333 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-12-16 12:21:02 Windows 5.1.2600 Dodatek Service Pack. 1 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . --------------------- DLLs Loaded Under Running Processes --------------------- PROCESS: C:\WINDOWS\system32\lsass.exe [5.01.2600.1106] -> C:\Program Files\Eset\pr_imon.dll . Completion time: 2007-12-16 12:21:56

**Posty:** 3854 · przez **Dzi@dek** 16 Gru 2007, 14:34

Otwórz notatnik i wklej

File::
C:\WINDOWS\leorop.dll
C:\WINDOWS\retnsrp.dll
C:\WINDOWS\jokvip.exe

Plik>>Zapisz jako > CFScript (najwygodniej będzie, jeśli zapiszesz w takiej lokalizacji, by ikonka CFScript.txt znalazła się obok ikonki ComboFix.exe)

Przeciągnij i upuść plik CFScript.txt na plik ComboFix.exe (czyli ikonkę CFScript.txt na ikonkę ComboFix.exe)

I daj nowy log z combo

[ Dodano: Dzisiaj o 13:41 ]
Pobierz ATF Cleaner i wyczyść wszystko.

**Posty:** 29 · przez **podek** 16 Gru 2007, 17:44

ATF-Cleanr'a miałem już zainstalowanego i usunąłem wszystko. System działa już stabilnie, są pojedyncze zacięcia, ale to nie jest problem. Nowy skan z combofixa:

Kod: Zaznacz wszystko: ComboFix 07-12-16.3 - Podek 2007-12-16 16:36:14.4 - NTFSx86 Running from: C:\Documents and Settings\Podek\Pulpit\ComboFix.exe . ((((((((((((((((((((((((( Files Created from 2007-11-16 to 2007-12-16 ))))))))))))))))))))))))))))))) . 2007-12-16 11:54 . 2007-12-16 13:53 <DIR> d--h----- C:\Documents and Settings\Administrator\Ustawienia lokalne 2007-12-16 11:54 . 2007-08-20 10:40 <DIR> d-------- C:\Documents and Settings\Administrator\Ulubione 2007-12-16 11:54 . 2007-08-20 09:47 <DIR> d--h----- C:\Documents and Settings\Administrator\Szablony 2007-12-16 11:54 . 2007-08-20 10:40 <DIR> d-------- C:\Documents and Settings\Administrator\Pulpit 2007-12-16 11:54 . 2007-08-20 10:40 <DIR> d-------- C:\Documents and Settings\Administrator\Moje dokumenty 2007-12-16 11:54 . 2007-08-20 10:40 <DIR> dr------- C:\Documents and Settings\Administrator\Menu Start 2007-12-16 11:54 . 2007-08-20 10:40 <DIR> dr-h----- C:\Documents and Settings\Administrator\Dane aplikacji 2007-12-16 00:29 . 2007-12-16 00:47 <DIR> d-------- C:\Program Files\SkanerOnline 2007-12-16 00:25 . 2007-12-16 00:25 <DIR> d-------- C:\Program Files\Trend Micro 2007-12-15 14:15 . 2007-12-16 16:21 <DIR> d-a------ C:\Documents and Settings\All Users\Dane aplikacji\TEMP 2007-12-15 14:13 . 2005-09-23 08:29 626,688 --a------ C:\WINDOWS\system32\msvcr80.dll 2007-12-15 10:53 . 2007-12-15 10:53 <DIR> d-------- C:\Documents and Settings\Mama\Dane aplikacji\Lavasoft 2007-12-14 23:09 . 2007-12-14 23:20 <DIR> d-------- C:\Program Files\SmartVideoCodec 2007-12-11 19:20 . 2007-12-11 19:20 <DIR> d-------- C:\Documents and Settings\Podek\Dane aplikacji\Talkback 2007-12-11 00:27 . 2007-12-11 00:48 <DIR> d-------- C:\Documents and Settings\Podek\Dane aplikacji\DeepBurner 2007-12-11 00:26 . 2007-12-11 00:26 <DIR> d-------- C:\Program Files\Astonsoft 2007-12-11 00:13 . 2007-12-11 00:13 <DIR> d-------- C:\Program Files\Alcohol Soft 2007-12-07 16:25 . 2007-12-07 16:25 <DIR> d-------- C:\Documents and Settings\Podek\Dane aplikacji\AdobeAUM 2007-12-05 23:58 . 2007-12-16 01:02 <DIR> d-------- C:\Program Files\Counter-Strike 1.6 2007-12-05 13:22 . 2007-12-16 16:00 <DIR> d-------- C:\Documents and Settings\Mama\Dane aplikacji\skypePM 2007-12-05 13:21 . 2007-12-16 15:59 <DIR> d-------- C:\Documents and Settings\Mama\Dane aplikacji\Skype 2007-12-04 15:59 . 2007-12-16 16:24 <DIR> d-------- C:\Documents and Settings\Podek\Dane aplikacji\skypePM 2007-12-04 15:59 . 2007-12-04 15:59 32 --a------ C:\Documents and Settings\All Users\Dane aplikacji\ezsid.dat 2007-12-04 15:58 . 2007-12-16 16:25 <DIR> d-------- C:\Documents and Settings\Podek\Dane aplikacji\Skype 2007-12-04 15:57 . 2007-12-04 15:57 <DIR> d-------- C:\Program Files\Skype 2007-12-04 15:57 . 2007-12-04 15:57 <DIR> d-------- C:\Program Files\Common Files\Skype 2007-12-04 15:56 . 2007-12-04 15:57 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Skype 2007-12-01 22:12 . 2007-12-01 22:12 40,448 --ahs---- C:\Thumbs.db 2007-11-25 18:06 . 2007-11-25 18:09 <DIR> d-------- C:\Program Files\DemoRec 2007-11-25 09:08 . 2007-12-16 16:23 <DIR> d-------- C:\Program Files\Anti-Trojan-55 2007-11-23 18:41 . 2007-11-25 12:44 <DIR> d-------- C:\Program Files\Replay Converter 2007-11-23 18:41 . 2007-11-23 18:41 737,280 --a------ C:\WINDOWS\iun6002.exe 2007-11-20 19:17 . 2007-12-15 23:53 <DIR> d-------- C:\Program Files\GrupaFP 2007-11-18 16:39 . 2007-11-18 16:39 <DIR> d--h----- C:\WINDOWS\PIF 2007-11-16 17:36 . 2007-11-16 17:38 24 ---hs---- C:\WINDOWS\S02800523.tmp 2007-11-16 17:34 . 2007-12-15 23:52 <DIR> d-------- C:\Program Files\SlySoft 2007-11-16 16:48 . 2007-11-16 16:48 685,816 --a------ C:\WINDOWS\system32\drivers\sptd.sys . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2007-12-16 14:08 --------- d-----w C:\Documents and Settings\Podek\Dane aplikacji\MegauploadToolbar 2007-12-15 22:12 --------- d-----w C:\Documents and Settings\Podek\Dane aplikacji\teamspeak2 2007-12-15 21:50 --------- d-----w C:\Documents and Settings\Mama\Dane aplikacji\MEGAUPLOADTOOLBAR 2007-12-15 12:41 --------- d-----w C:\Program Files\FlashGet 2007-12-12 20:47 --------- d-----w C:\Program Files\TibiaCam TV Lite 2007-12-07 17:01 --------- d--h--w C:\Program Files\InstallShield Installation Information 2007-12-05 15:50 22,328 ----a-w C:\WINDOWS\system32\drivers\PnkBstrK.sys 2007-12-05 15:49 103,736 ----a-w C:\WINDOWS\system32\PnkBstrB.exe 2007-12-02 16:08 --------- d-----w C:\Documents and Settings\Podek\Dane aplikacji\Tibia 2007-11-25 07:48 --------- d-----w C:\Program Files\Common Files\Adobe 2007-11-10 12:12 --------- d-----w C:\Program Files\Java 2007-11-09 18:55 --------- d-----w C:\Program Files\Vista Start Menu 2007-11-06 11:55 --------- d-----w C:\Program Files\neoSoftware 2007-11-02 12:15 --------- d-----w C:\Documents and Settings\Podek\Dane aplikacji\Temporary 2007-11-02 12:06 --------- d-----w C:\Documents and Settings\Podek\Dane aplikacji\TransRender 2007-11-02 12:06 --------- d-----w C:\Documents and Settings\Podek\Dane aplikacji\Samsung 2007-11-02 12:06 --------- d-----w C:\Documents and Settings\Podek\Dane aplikacji\ConvertTemp 2007-11-02 12:03 --------- d-----w C:\Program Files\Samsung 2007-11-01 14:32 --------- d-----w C:\Documents and Settings\Monika\Dane aplikacji\Nero 2007-10-30 19:50 --------- d-----w C:\Documents and Settings\Podek\Dane aplikacji\SopCast 2007-10-30 19:49 --------- d-----w C:\Program Files\SopCast 2007-10-30 18:00 --------- d-----w C:\Program Files\18 WoS Across America 2007-10-30 15:41 --------- d-----w C:\Program Files\Hard Truck 2007-10-29 20:48 --------- d-----w C:\Program Files\K-Lite Codec Pack 2007-10-29 13:36 66,872 ----a-w C:\WINDOWS\system32\PnkBstrA.exe 2007-10-27 12:18 --------- d-----w C:\Documents and Settings\Michał\Dane aplikacji\AdobeUM 2007-10-27 12:17 --------- d-----w C:\Documents and Settings\Michał\Dane aplikacji\Leadertech 2007-10-26 18:28 --------- d-----w C:\Documents and Settings\Monika\Dane aplikacji\MEGAUPLOADTOOLBAR 2007-10-20 17:30 --------- d-----w C:\Documents and Settings\Michał\Dane aplikacji\Vista Start Menu 2007-10-07 10:09 7,680 ----a-w C:\WINDOWS\system32\ff_vfw.dll 2007-10-04 22:27 73,216 ----a-w C:\WINDOWS\ST6UNST.EXE 2007-10-04 22:27 249,856 ------w C:\WINDOWS\Setup1.exe 2007-10-01 18:33 60,273 ----a-w C:\WINDOWS\system32\pthreadGC2.dll 2007-09-20 07:59 972,072 ----a-w C:\WINDOWS\UNRecode.exe 2007-09-20 07:55 972,072 ----a-w C:\WINDOWS\UNNeroMediaHome.exe 2007-09-20 07:55 95,600 ----a-w C:\WINDOWS\system32\NeroCo.dll 2005-07-14 19:31 27,648 --sha-w C:\WINDOWS\system32\AVSredirect.dll . ((((((((((((((((((((((((((((( snapshot@2007-12-16_12.21.15,40 ))))))))))))))))))))))))))))))))))))))))) . - 2007-08-29 07:33:20 16,384 ----a-w C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat + 2007-12-16 11:46:16 16,384 ----a-w C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat - 2007-08-29 07:33:20 32,768 ----a-w C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Historia\History.IE5\index.dat + 2007-12-16 11:46:16 32,768 ----a-w C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Historia\History.IE5\index.dat - 2007-08-29 07:33:20 32,768 ----a-w C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Temporary Internet Files\Content.IE5\index.dat + 2007-12-16 11:51:09 32,768 ----a-w C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Temporary Internet Files\Content.IE5\index.dat - 2007-10-28 17:57:13 39,992 ----a-w C:\WINDOWS\system32\perfc009.dat + 2007-12-16 11:51:13 39,992 ----a-w C:\WINDOWS\system32\perfc009.dat - 2007-10-28 17:57:14 49,492 ----a-w C:\WINDOWS\system32\perfc015.dat + 2007-12-16 11:51:13 49,492 ----a-w C:\WINDOWS\system32\perfc015.dat - 2007-10-28 17:57:14 311,604 ----a-w C:\WINDOWS\system32\perfh009.dat + 2007-12-16 11:51:13 311,604 ----a-w C:\WINDOWS\system32\perfh009.dat - 2007-10-28 17:57:14 355,486 ----a-w C:\WINDOWS\system32\perfh015.dat + 2007-12-16 11:51:13 355,486 ----a-w C:\WINDOWS\system32\perfh015.dat . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NvMediaCenter"="RUNDLL32.exe" [2001-10-26 18:30 C:\WINDOWS\system32\rundll32.exe] "NVIEW"="nview.dll" [2003-07-29 06:19 C:\WINDOWS\system32\nview.dll] "Gadu-Gadu"="D:\Program Files\Gadu-Gadu\gg.exe" [2007-07-09 08:39] "MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2002-08-20 14:08] "Skype"="C:\Program Files\Skype\Phone\Skype.exe" [2007-11-16 12:39] "AlcoholAutomount"="C:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe" [2007-07-02 11:27] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11] "Sony Ericsson PC Suite"="C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" [2005-10-26 15:17] "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-05-11 02:06] "nod32kui"="C:\Program Files\Eset\nod32kui.exe" [2007-09-08 20:31] "NBKeyScan"="C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" [2007-09-20 08:51] "NvCplDaemon"="RUNDLL32.exe" [2001-10-26 18:30 C:\WINDOWS\system32\rundll32.exe] "nwiz"="nwiz.exe" [2003-07-29 06:19 C:\WINDOWS\system32\nwiz.exe] "AT-Watch"="C:\Program Files\Anti-Trojan-55\ATWatch.exe" [2002-09-08 09:03] "Anti-Trojan-Watch"="C:\Program Files\Anti-Trojan-55\ATWatch.exe" [2002-09-08 09:03] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2002-09-20 17:05] "NvMediaCenter"="RUNDLL32.exe" [2001-10-26 18:30 C:\WINDOWS\system32\rundll32.exe] C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\ Adobe Gamma Loader.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2007-11-25 08:48:52] Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 09:01:04] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Microsoft Office.lnk] path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Microsoft Office.lnk backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Photo Downloader] 2005-06-06 22:46 57344 --a------ C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BearShare] C:\Program Files\BearShare\BearShare.exe /pause [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE] 2002-09-20 17:05 13312 --a------ C:\WINDOWS\System32\ctfmon.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Flashget] C:\Program Files\FlashGet\FlashGet.exe /min [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Microsft Security Monitor Process] mssmpp.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\mmsass] mmdmm.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroCheck] C:\WINDOWS\system32\NeroCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] 2007-03-01 14:57 153136 --a------ C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz] nwiz.exe /install [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] C:\Program Files\QuickTime\qttask.exe -atboottime [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Sony Ericsson PC Suite] C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe /startoptions [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpeedTouch USB Diagnostics] C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe /icon [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent] 2007-05-19 10:39 35328 --a------ C:\Program Files\Winamp\winampa.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows Config System] config.exe R2 Nero BackItUp Scheduler 3;Nero BackItUp Scheduler 3;C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe S3 ss_bus;SAMSUNG Mobile USB Device 1.0 driver (WDM);C:\WINDOWS\System32\DRIVERS\ss_bus.sys S3 ss_mdfl;SAMSUNG Mobile USB Modem 1.0 Filter;C:\WINDOWS\System32\DRIVERS\ss_mdfl.sys S3 ss_mdm;SAMSUNG Mobile USB Modem 1.0 Drivers;C:\WINDOWS\System32\DRIVERS\ss_mdm.sys . Contents of the 'Scheduled Tasks' folder "2007-10-19 10:02:28 C:\WINDOWS\Tasks\Norton Security Scan.job" - C:\Program Files\Norton Security Scan\Nss.exe . ************************************************************************** catchme 0.3.1333 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-12-16 16:38:38 Windows 5.1.2600 Dodatek Service Pack. 1 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . --------------------- DLLs Loaded Under Running Processes --------------------- PROCESS: C:\WINDOWS\system32\lsass.exe [5.01.2600.1106] -> C:\Program Files\Eset\pr_imon.dll . Completion time: 2007-12-16 16:39:32 C:\ComboFix2.txt ... 2007-12-16 13:53 C:\ComboFix3.txt ... 2007-12-16 13:45

**Posty:** 3854 · przez **Dzi@dek** 16 Gru 2007, 17:57

File::
C:\WINDOWS\S02800523.tmp

Plik>>Zapisz jako > CFScript (najwygodniej będzie, jeśli zapiszesz w takiej lokalizacji, by ikonka CFScript.txt znalazła się obok ikonki ComboFix.exe)

Przeciągnij i upuść plik CFScript.txt na plik ComboFix.exe (czyli ikonkę CFScript.txt na ikonkę ComboFix.exe)

**Posty:** 18165 · przez **wojtas** 16 Gru 2007, 17:57

zastosuj:

smitfraudfix z opcji 2

wklej do notatnika

Windows Registry Editor Version 5.00

[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows Config System]

[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\mmsass]

[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Microsft Security Monitor Process]

w notatniku u góry>>>plik zapisz jako>>>Zmien rozszerzenie z TXT na Wszystkie pliki *.* >>> Zapisz pod nazwą FIX.REG

Klikasz dwa razy na powstały plik fix i dodajesz go do rejestru....

potem nowy log z combo + raport z smitfraudfix

C:\rapport.txt. < log z smitfraudfixa

**Posty:** 29 · przez **podek** 16 Gru 2007, 18:37

Jeżeli dodałem ten wpis do rejestru to mogę usunąć ten plik z pulpitu?

SmitFraudFix log

Kod: Zaznacz wszystko: SmitFraudFix v2.269 Scan done at 17:33:48,83, 2007-12-16 Run from C:\Documents and Settings\Podek\Pulpit\SmitfraudFix OS: Microsoft Windows XP [Wersja 5.1.2600] - Windows_NT The filesystem type is NTFS Fix run in normal mode »»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Before SmitFraudFix !!!Attention, following keys are not inevitably infected!!! SrchSTS.exe by S!Ri Search SharedTaskScheduler's .dll »»»»»»»»»»»»»»»»»»»»»»»» Killing process »»»»»»»»»»»»»»»»»»»»»»»» hosts 127.0.0.1 localhost »»»»»»»»»»»»»»»»»»»»»»»» Winsock2 Fix S!Ri's WS2Fix: LSP not Found. »»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix GenericRenosFix by S!Ri »»»»»»»»»»»»»»»»»»»»»»»» Deleting infected files »»»»»»»»»»»»»»»»»»»»»»»» DNS Description: WAN (PPP/SLIP) Interface DNS Server Search Order: 194.204.159.1 DNS Server Search Order: 217.98.63.164 HKLM\SYSTEM\CCS\Services\Tcpip\..\{C1BCEED8-0096-4211-A825-3E640B412B77}: NameServer=194.204.159.1 217.98.63.164 HKLM\SYSTEM\CS1\Services\Tcpip\..\{C1BCEED8-0096-4211-A825-3E640B412B77}: NameServer=194.204.159.1 217.98.63.164 »»»»»»»»»»»»»»»»»»»»»»»» Deleting Temp Files »»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System !!!Attention, following keys are not inevitably infected!!! [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] "System"="" »»»»»»»»»»»»»»»»»»»»»»»» Registry Cleaning Registry Cleaning not selected. »»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler After SmitFraudFix !!!Attention, following keys are not inevitably infected!!! SrchSTS.exe by S!Ri Search SharedTaskScheduler's .dll »»»»»»»»»»»»»»»»»»»»»»»» End

ComboFix log:

Kod: Zaznacz wszystko: ComboFix 07-12-16.3 - Podek 2007-12-16 17:25:16.6 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.1.1250.1.1045.18.22 [GMT 1:00] Running from: D:\Damian na D\Fix\ComboFix.exe . ((((((((((((((((((((((((( Files Created from 2007-11-16 to 2007-12-16 ))))))))))))))))))))))))))))))) . 2007-12-16 17:12 . 2007-12-16 17:18 2,534 --a------ C:\WINDOWS\system32\tmp.reg 2007-12-16 11:54 . 2007-12-16 17:11 <DIR> d--h----- C:\Documents and Settings\Administrator\Ustawienia lokalne 2007-12-16 11:54 . 2007-08-20 10:40 <DIR> d-------- C:\Documents and Settings\Administrator\Ulubione 2007-12-16 11:54 . 2007-08-20 09:47 <DIR> d--h----- C:\Documents and Settings\Administrator\Szablony 2007-12-16 11:54 . 2007-08-20 10:40 <DIR> d-------- C:\Documents and Settings\Administrator\Pulpit 2007-12-16 11:54 . 2007-08-20 10:40 <DIR> d-------- C:\Documents and Settings\Administrator\Moje dokumenty 2007-12-16 11:54 . 2007-08-20 10:40 <DIR> dr------- C:\Documents and Settings\Administrator\Menu Start 2007-12-16 11:54 . 2007-08-20 10:40 <DIR> dr-h----- C:\Documents and Settings\Administrator\Dane aplikacji 2007-12-16 00:29 . 2007-12-16 00:47 <DIR> d-------- C:\Program Files\SkanerOnline 2007-12-16 00:25 . 2007-12-16 00:25 <DIR> d-------- C:\Program Files\Trend Micro 2007-12-15 14:15 . 2007-12-16 16:21 <DIR> d-a------ C:\Documents and Settings\All Users\Dane aplikacji\TEMP 2007-12-15 14:13 . 2005-09-23 08:29 626,688 --a------ C:\WINDOWS\system32\msvcr80.dll 2007-12-15 10:53 . 2007-12-15 10:53 <DIR> d-------- C:\Documents and Settings\Mama\Dane aplikacji\Lavasoft 2007-12-14 23:09 . 2007-12-14 23:20 <DIR> d-------- C:\Program Files\SmartVideoCodec 2007-12-11 19:20 . 2007-12-11 19:20 <DIR> d-------- C:\Documents and Settings\Podek\Dane aplikacji\Talkback 2007-12-11 00:27 . 2007-12-11 00:48 <DIR> d-------- C:\Documents and Settings\Podek\Dane aplikacji\DeepBurner 2007-12-11 00:26 . 2007-12-11 00:26 <DIR> d-------- C:\Program Files\Astonsoft 2007-12-11 00:13 . 2007-12-11 00:13 <DIR> d-------- C:\Program Files\Alcohol Soft 2007-12-07 16:25 . 2007-12-07 16:25 <DIR> d-------- C:\Documents and Settings\Podek\Dane aplikacji\AdobeAUM 2007-12-05 23:58 . 2007-12-16 01:02 <DIR> d-------- C:\Program Files\Counter-Strike 1.6 2007-12-05 13:22 . 2007-12-16 16:00 <DIR> d-------- C:\Documents and Settings\Mama\Dane aplikacji\skypePM 2007-12-05 13:21 . 2007-12-16 15:59 <DIR> d-------- C:\Documents and Settings\Mama\Dane aplikacji\Skype 2007-12-04 15:59 . 2007-12-16 16:24 <DIR> d-------- C:\Documents and Settings\Podek\Dane aplikacji\skypePM 2007-12-04 15:59 . 2007-12-04 15:59 32 --a------ C:\Documents and Settings\All Users\Dane aplikacji\ezsid.dat 2007-12-04 15:58 . 2007-12-16 17:12 <DIR> d-------- C:\Documents and Settings\Podek\Dane aplikacji\Skype 2007-12-04 15:57 . 2007-12-04 15:57 <DIR> d-------- C:\Program Files\Skype 2007-12-04 15:57 . 2007-12-04 15:57 <DIR> d-------- C:\Program Files\Common Files\Skype 2007-12-04 15:56 . 2007-12-04 15:57 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Skype 2007-12-01 22:12 . 2007-12-01 22:12 40,448 --ahs---- C:\Thumbs.db 2007-11-25 18:06 . 2007-11-25 18:09 <DIR> d-------- C:\Program Files\DemoRec 2007-11-25 09:08 . 2007-12-16 16:23 <DIR> d-------- C:\Program Files\Anti-Trojan-55 2007-11-23 18:41 . 2007-11-25 12:44 <DIR> d-------- C:\Program Files\Replay Converter 2007-11-23 18:41 . 2007-11-23 18:41 737,280 --a------ C:\WINDOWS\iun6002.exe 2007-11-20 19:17 . 2007-12-15 23:53 <DIR> d-------- C:\Program Files\GrupaFP 2007-11-18 16:39 . 2007-11-18 16:39 <DIR> d--h----- C:\WINDOWS\PIF 2007-11-16 17:36 . 2007-11-16 17:38 24 ---hs---- C:\WINDOWS\S02800523.tmp 2007-11-16 17:34 . 2007-12-15 23:52 <DIR> d-------- C:\Program Files\SlySoft 2007-11-16 16:48 . 2007-11-16 16:48 685,816 --a------ C:\WINDOWS\system32\drivers\sptd.sys . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2007-12-16 14:08 --------- d-----w C:\Documents and Settings\Podek\Dane aplikacji\MegauploadToolbar 2007-12-15 22:12 --------- d-----w C:\Documents and Settings\Podek\Dane aplikacji\teamspeak2 2007-12-15 21:50 --------- d-----w C:\Documents and Settings\Mama\Dane aplikacji\MEGAUPLOADTOOLBAR 2007-12-15 12:41 --------- d-----w C:\Program Files\FlashGet 2007-12-12 20:47 --------- d-----w C:\Program Files\TibiaCam TV Lite 2007-12-07 17:01 --------- d--h--w C:\Program Files\InstallShield Installation Information 2007-12-05 15:50 22,328 ----a-w C:\WINDOWS\system32\drivers\PnkBstrK.sys 2007-12-05 15:49 103,736 ----a-w C:\WINDOWS\system32\PnkBstrB.exe 2007-12-02 16:08 --------- d-----w C:\Documents and Settings\Podek\Dane aplikacji\Tibia 2007-11-25 07:48 --------- d-----w C:\Program Files\Common Files\Adobe 2007-11-10 12:12 --------- d-----w C:\Program Files\Java 2007-11-09 18:55 --------- d-----w C:\Program Files\Vista Start Menu 2007-11-06 11:55 --------- d-----w C:\Program Files\neoSoftware 2007-11-02 12:15 --------- d-----w C:\Documents and Settings\Podek\Dane aplikacji\Temporary 2007-11-02 12:06 --------- d-----w C:\Documents and Settings\Podek\Dane aplikacji\TransRender 2007-11-02 12:06 --------- d-----w C:\Documents and Settings\Podek\Dane aplikacji\Samsung 2007-11-02 12:06 --------- d-----w C:\Documents and Settings\Podek\Dane aplikacji\ConvertTemp 2007-11-02 12:03 --------- d-----w C:\Program Files\Samsung 2007-11-01 14:32 --------- d-----w C:\Documents and Settings\Monika\Dane aplikacji\Nero 2007-10-30 19:50 --------- d-----w C:\Documents and Settings\Podek\Dane aplikacji\SopCast 2007-10-30 19:49 --------- d-----w C:\Program Files\SopCast 2007-10-30 18:00 --------- d-----w C:\Program Files\18 WoS Across America 2007-10-30 15:41 --------- d-----w C:\Program Files\Hard Truck 2007-10-29 20:48 --------- d-----w C:\Program Files\K-Lite Codec Pack 2007-10-29 13:36 66,872 ----a-w C:\WINDOWS\system32\PnkBstrA.exe 2007-10-27 12:18 --------- d-----w C:\Documents and Settings\Michał\Dane aplikacji\AdobeUM 2007-10-27 12:17 --------- d-----w C:\Documents and Settings\Michał\Dane aplikacji\Leadertech 2007-10-26 18:28 --------- d-----w C:\Documents and Settings\Monika\Dane aplikacji\MEGAUPLOADTOOLBAR 2007-10-20 17:30 --------- d-----w C:\Documents and Settings\Michał\Dane aplikacji\Vista Start Menu 2007-10-07 10:09 7,680 ----a-w C:\WINDOWS\system32\ff_vfw.dll 2007-10-04 22:27 73,216 ----a-w C:\WINDOWS\ST6UNST.EXE 2007-10-04 22:27 249,856 ------w C:\WINDOWS\Setup1.exe 2007-10-01 18:33 60,273 ----a-w C:\WINDOWS\system32\pthreadGC2.dll 2007-09-20 07:59 972,072 ----a-w C:\WINDOWS\UNRecode.exe 2007-09-20 07:55 972,072 ----a-w C:\WINDOWS\UNNeroMediaHome.exe 2007-09-20 07:55 95,600 ----a-w C:\WINDOWS\system32\NeroCo.dll 2005-07-14 19:31 27,648 --sha-w C:\WINDOWS\system32\AVSredirect.dll . ((((((((((((((((((((((((((((( snapshot@2007-12-16_12.21.15,40 ))))))))))))))))))))))))))))))))))))))))) . - 2007-08-29 07:33:20 16,384 ----a-w C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat + 2007-12-16 11:46:16 16,384 ----a-w C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat - 2007-08-29 07:33:20 32,768 ----a-w C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Historia\History.IE5\index.dat + 2007-12-16 11:46:16 32,768 ----a-w C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Historia\History.IE5\index.dat - 2007-10-28 17:57:13 39,992 ----a-w C:\WINDOWS\system32\perfc009.dat + 2007-12-16 11:51:13 39,992 ----a-w C:\WINDOWS\system32\perfc009.dat - 2007-10-28 17:57:14 49,492 ----a-w C:\WINDOWS\system32\perfc015.dat + 2007-12-16 11:51:13 49,492 ----a-w C:\WINDOWS\system32\perfc015.dat - 2007-10-28 17:57:14 311,604 ----a-w C:\WINDOWS\system32\perfh009.dat + 2007-12-16 11:51:13 311,604 ----a-w C:\WINDOWS\system32\perfh009.dat - 2007-10-28 17:57:14 355,486 ----a-w C:\WINDOWS\system32\perfh015.dat + 2007-12-16 11:51:13 355,486 ----a-w C:\WINDOWS\system32\perfh015.dat . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NvMediaCenter"="RUNDLL32.exe" [2001-10-26 18:30 C:\WINDOWS\system32\rundll32.exe] "NVIEW"="nview.dll" [2003-07-29 06:19 C:\WINDOWS\system32\nview.dll] "Gadu-Gadu"="D:\Program Files\Gadu-Gadu\gg.exe" [2007-07-09 08:39] "MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2002-08-20 14:08] "Skype"="C:\Program Files\Skype\Phone\Skype.exe" [2007-11-16 12:39] "AlcoholAutomount"="C:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe" [2007-07-02 11:27] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11] "Sony Ericsson PC Suite"="C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" [2005-10-26 15:17] "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-05-11 02:06] "nod32kui"="C:\Program Files\Eset\nod32kui.exe" [2007-09-08 20:31] "NBKeyScan"="C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" [2007-09-20 08:51] "NvCplDaemon"="RUNDLL32.exe" [2001-10-26 18:30 C:\WINDOWS\system32\rundll32.exe] "nwiz"="nwiz.exe" [2003-07-29 06:19 C:\WINDOWS\system32\nwiz.exe] "AT-Watch"="C:\Program Files\Anti-Trojan-55\ATWatch.exe" [2002-09-08 09:03] "Anti-Trojan-Watch"="C:\Program Files\Anti-Trojan-55\ATWatch.exe" [2002-09-08 09:03] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2002-09-20 17:05] "NvMediaCenter"="RUNDLL32.exe" [2001-10-26 18:30 C:\WINDOWS\system32\rundll32.exe] C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\ Adobe Gamma Loader.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2007-11-25 08:48:52] Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 09:01:04] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Microsoft Office.lnk] path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Microsoft Office.lnk backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Photo Downloader] 2005-06-06 22:46 57344 --a------ C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BearShare] C:\Program Files\BearShare\BearShare.exe /pause [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE] 2002-09-20 17:05 13312 --a------ C:\WINDOWS\System32\ctfmon.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Flashget] C:\Program Files\FlashGet\FlashGet.exe /min [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroCheck] C:\WINDOWS\system32\NeroCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] 2007-03-01 14:57 153136 --a------ C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz] nwiz.exe /install [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] C:\Program Files\QuickTime\qttask.exe -atboottime [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Sony Ericsson PC Suite] C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe /startoptions [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpeedTouch USB Diagnostics] C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe /icon [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent] 2007-05-19 10:39 35328 --a------ C:\Program Files\Winamp\winampa.exe R2 Nero BackItUp Scheduler 3;Nero BackItUp Scheduler 3;C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe S3 ss_bus;SAMSUNG Mobile USB Device 1.0 driver (WDM);C:\WINDOWS\System32\DRIVERS\ss_bus.sys S3 ss_mdfl;SAMSUNG Mobile USB Modem 1.0 Filter;C:\WINDOWS\System32\DRIVERS\ss_mdfl.sys S3 ss_mdm;SAMSUNG Mobile USB Modem 1.0 Drivers;C:\WINDOWS\System32\DRIVERS\ss_mdm.sys . Contents of the 'Scheduled Tasks' folder "2007-10-19 10:02:28 C:\WINDOWS\Tasks\Norton Security Scan.job" - C:\Program Files\Norton Security Scan\Nss.exe . ************************************************************************** catchme 0.3.1333 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-12-16 17:29:46 Windows 5.1.2600 Dodatek Service Pack. 1 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . --------------------- DLLs Loaded Under Running Processes --------------------- PROCESS: C:\WINDOWS\system32\lsass.exe [5.01.2600.1106] -> C:\Program Files\Eset\pr_imon.dll . Completion time: 2007-12-16 17:32:54 C:\ComboFix2.txt ... 2007-12-16 17:10 C:\ComboFix3.txt ... 2007-12-16 16:39

**Posty:** 18165 · przez **wojtas** 16 Gru 2007, 19:03

podek napisał(a):Jeżeli dodałem ten wpis do rejestru to mogę usunąć ten plik z pulpitu?

tak

sciagnij killbox’a

Odpalasz Killboxa zaznacz opcję Delete on Reboot następnie w polu Full Path of File to Delete wklej ścieżkę

c:\WINDOWS\S02800523.tmp

i nacisnij x
Program będzie pytał o restart (oczywiście zgadzasz się)

znasz to;

C:\Program Files\SmartVideoCodec

jesli nie to skasuj folder SmartVideoCodec do kosza

**Posty:** 29 · przez **podek** 16 Gru 2007, 20:12

Zastosowałem się do wszystkich poleceń. Czy teraz jest już wszystko ok? Mam jeszcze jeden problem

Chodzi mi o 'użycie procesora'. Zazwyczaj zużycie procka mam niewielkie, czasem zdarzało się, że było ono na 100%, ale ostatnio zaczęło się pojawiać obciążenie na 100% + na czerwono. Nie wiem co z tym zrobić. Muszę założyć nowy temat aby uzyskać pomoc czy mogę uzyskać ją w tym temacie?

**Posty:** 18165 · przez **wojtas** 16 Gru 2007, 21:05

daj screena z zakladki procesy

jaki proces zabiera tyle procka?

**Posty:** 29 · przez **podek** 16 Gru 2007, 22:19

Przedtem (znaczy, gdy użycie procesora było tylko zielone) mogłem spokojnie grać w tibię z 2 włączonymi klientami (tibia zżera mnóstwo pamięci), a teraz przy włączonym firefoxie, mam już czerwone :oops:

**Posty:** 18165 · przez **wojtas** 16 Gru 2007, 22:20

daj jeszcze raz log z hijacka i combo

**Posty:** 29 · przez **podek** 16 Gru 2007, 22:28

Log z hijacka:

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 21:27:12, on 2007-12-16 Platform: Windows XP Dodatek SP. 1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Eset\nod32krn.exe C:\WINDOWS\System32\nvsvc32.exe C:\WINDOWS\System32\HPZipm12.exe C:\WINDOWS\System32\PnkBstrA.exe C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe C:\Program Files\Eset\nod32kui.exe C:\Program Files\Anti-Trojan-55\ATWatch.exe C:\WINDOWS\System32\RUNDLL32.EXE C:\Program Files\Common Files\Teleca Shared\CapabilityManager.exe C:\WINDOWS\System32\rundll32.exe C:\Program Files\Common Files\Teleca Shared\Generic.exe C:\Program Files\Sony Ericsson\Mobile2\Mobile Phone Monitor\epmworker.exe C:\WINDOWS\System32\wuauclt.exe C:\Program Files\Mozilla Firefox\firefox.exe D:\Program Files\Gadu-Gadu\gg.exe C:\Documents and Settings\Podek\Pulpit\hijackthis.com R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: flashget urlcatch - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\Program Files\FlashGet\jccatch.dll O2 - BHO: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O2 - BHO: Mega Manager IE Click Monitor - {bf00e119-21a3-4fd1-b178-3b8537e75c92} - C:\Program Files\Megaupload\Mega Manager\MegaIEMn.dll O2 - BHO: FlashGet GetFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\Program Files\FlashGet\getflash.dll O3 - Toolbar: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" O4 - HKLM\..\Run: [Sony Ericsson PC Suite] "C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [AT-Watch] C:\Program Files\Anti-Trojan-55\ATWatch.exe O4 - HKLM\..\Run: [Anti-Trojan-Watch] C:\Program Files\Anti-Trojan-55\ATWatch.exe O4 - HKCU\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NVMCTRAY.DLL,NvTaskbarInit O4 - HKCU\..\Run: [NVIEW] rundll32.exe nview.dll,nViewLoadHook O4 - HKCU\..\Run: [Gadu-Gadu] "D:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized O4 - HKCU\..\Run: [AlcoholAutomount] "C:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe" /automount O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user') O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE O8 - Extra context menu item: &Download All with FlashGet - C:\Program Files\FlashGet\jc_all.htm O8 - Extra context menu item: &Download with FlashGet - C:\Program Files\FlashGet\jc_link.htm O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O8 - Extra context menu item: Pobierz za pomocą Mega Manager... - C:\Program Files\Megaupload\Mega Manager\mm_file.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe O16 - DPF: {68282C51-9459-467B-95BF-3C0E89627E55} (MksSkanerOnline Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload.adobe.com/pub/shockwave/cabs/flash/swflash.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{C1BCEED8-0096-4211-A825-3E640B412B77}: NameServer = 194.204.159.1 217.98.63.164 O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\System32\PnkBstrA.exe O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe O23 - Service: Windows User Mode Driver Framework (UMWdf) - Unknown owner - C:\WINDOWS\System32\wdfmgr.exe (file missing) -- End of file - 6891 bytes

Zaraz editne i dam z combaka
EDIT:

ComboFix log:

Kod: Zaznacz wszystko: ComboFix 07-12-16.3 - Podek 2007-12-16 21:28:57.7 - NTFSx86 Running from: D:\Damian na D\Fix\ComboFix.exe . ((((((((((((((((((((((((( Files Created from 2007-11-16 to 2007-12-16 ))))))))))))))))))))))))))))))) . 2007-12-16 17:12 . 2007-12-16 17:34 2,534 --a------ C:\WINDOWS\system32\tmp.reg 2007-12-16 11:54 . 2007-12-16 17:33 <DIR> d--h----- C:\Documents and Settings\Administrator\Ustawienia lokalne 2007-12-16 11:54 . 2007-08-20 10:40 <DIR> d-------- C:\Documents and Settings\Administrator\Ulubione 2007-12-16 11:54 . 2007-08-20 09:47 <DIR> d--h----- C:\Documents and Settings\Administrator\Szablony 2007-12-16 11:54 . 2007-08-20 10:40 <DIR> d-------- C:\Documents and Settings\Administrator\Pulpit 2007-12-16 11:54 . 2007-08-20 10:40 <DIR> d-------- C:\Documents and Settings\Administrator\Moje dokumenty 2007-12-16 11:54 . 2007-08-20 10:40 <DIR> dr------- C:\Documents and Settings\Administrator\Menu Start 2007-12-16 11:54 . 2007-08-20 10:40 <DIR> dr-h----- C:\Documents and Settings\Administrator\Dane aplikacji 2007-12-16 00:29 . 2007-12-16 00:47 <DIR> d-------- C:\Program Files\SkanerOnline 2007-12-16 00:25 . 2007-12-16 00:25 <DIR> d-------- C:\Program Files\Trend Micro 2007-12-15 14:15 . 2007-12-16 16:21 <DIR> d-a------ C:\Documents and Settings\All Users\Dane aplikacji\TEMP 2007-12-15 14:13 . 2005-09-23 08:29 626,688 --a------ C:\WINDOWS\system32\msvcr80.dll 2007-12-15 10:53 . 2007-12-15 10:53 <DIR> d-------- C:\Documents and Settings\Mama\Dane aplikacji\Lavasoft 2007-12-11 19:20 . 2007-12-11 19:20 <DIR> d-------- C:\Documents and Settings\Podek\Dane aplikacji\Talkback 2007-12-11 00:27 . 2007-12-11 00:48 <DIR> d-------- C:\Documents and Settings\Podek\Dane aplikacji\DeepBurner 2007-12-11 00:26 . 2007-12-11 00:26 <DIR> d-------- C:\Program Files\Astonsoft 2007-12-11 00:13 . 2007-12-11 00:13 <DIR> d-------- C:\Program Files\Alcohol Soft 2007-12-07 16:25 . 2007-12-07 16:25 <DIR> d-------- C:\Documents and Settings\Podek\Dane aplikacji\AdobeAUM 2007-12-05 23:58 . 2007-12-16 01:02 <DIR> d-------- C:\Program Files\Counter-Strike 1.6 2007-12-05 13:22 . 2007-12-16 16:00 <DIR> d-------- C:\Documents and Settings\Mama\Dane aplikacji\skypePM 2007-12-05 13:21 . 2007-12-16 15:59 <DIR> d-------- C:\Documents and Settings\Mama\Dane aplikacji\Skype 2007-12-04 15:59 . 2007-12-16 18:48 <DIR> d-------- C:\Documents and Settings\Podek\Dane aplikacji\skypePM 2007-12-04 15:59 . 2007-12-04 15:59 32 --a------ C:\Documents and Settings\All Users\Dane aplikacji\ezsid.dat 2007-12-04 15:58 . 2007-12-16 18:48 <DIR> d-------- C:\Documents and Settings\Podek\Dane aplikacji\Skype 2007-12-04 15:57 . 2007-12-04 15:57 <DIR> d-------- C:\Program Files\Skype 2007-12-04 15:57 . 2007-12-04 15:57 <DIR> d-------- C:\Program Files\Common Files\Skype 2007-12-04 15:56 . 2007-12-04 15:57 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Skype 2007-12-01 22:12 . 2007-12-01 22:12 40,448 --ahs---- C:\Thumbs.db 2007-11-25 18:06 . 2007-11-25 18:09 <DIR> d-------- C:\Program Files\DemoRec 2007-11-25 09:08 . 2007-12-16 18:47 <DIR> d-------- C:\Program Files\Anti-Trojan-55 2007-11-23 18:41 . 2007-11-25 12:44 <DIR> d-------- C:\Program Files\Replay Converter 2007-11-23 18:41 . 2007-11-23 18:41 737,280 --a------ C:\WINDOWS\iun6002.exe 2007-11-20 19:17 . 2007-12-15 23:53 <DIR> d-------- C:\Program Files\GrupaFP 2007-11-18 16:39 . 2007-11-18 16:39 <DIR> d--h----- C:\WINDOWS\PIF 2007-11-16 17:34 . 2007-12-15 23:52 <DIR> d-------- C:\Program Files\SlySoft 2007-11-16 16:48 . 2007-11-16 16:48 685,816 --a------ C:\WINDOWS\system32\drivers\sptd.sys . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2007-12-16 18:32 --------- d-----w C:\Documents and Settings\Podek\Dane aplikacji\teamspeak2 2007-12-16 14:08 --------- d-----w C:\Documents and Settings\Podek\Dane aplikacji\MegauploadToolbar 2007-12-15 21:50 --------- d-----w C:\Documents and Settings\Mama\Dane aplikacji\MEGAUPLOADTOOLBAR 2007-12-15 12:41 --------- d-----w C:\Program Files\FlashGet 2007-12-12 20:47 --------- d-----w C:\Program Files\TibiaCam TV Lite 2007-12-07 17:01 --------- d--h--w C:\Program Files\InstallShield Installation Information 2007-12-05 15:50 22,328 ----a-w C:\WINDOWS\system32\drivers\PnkBstrK.sys 2007-12-05 15:49 103,736 ----a-w C:\WINDOWS\system32\PnkBstrB.exe 2007-12-02 16:08 --------- d-----w C:\Documents and Settings\Podek\Dane aplikacji\Tibia 2007-11-25 07:48 --------- d-----w C:\Program Files\Common Files\Adobe 2007-11-10 12:12 --------- d-----w C:\Program Files\Java 2007-11-09 18:55 --------- d-----w C:\Program Files\Vista Start Menu 2007-11-06 11:55 --------- d-----w C:\Program Files\neoSoftware 2007-11-02 12:15 --------- d-----w C:\Documents and Settings\Podek\Dane aplikacji\Temporary 2007-11-02 12:06 --------- d-----w C:\Documents and Settings\Podek\Dane aplikacji\TransRender 2007-11-02 12:06 --------- d-----w C:\Documents and Settings\Podek\Dane aplikacji\Samsung 2007-11-02 12:06 --------- d-----w C:\Documents and Settings\Podek\Dane aplikacji\ConvertTemp 2007-11-02 12:03 --------- d-----w C:\Program Files\Samsung 2007-11-01 14:32 --------- d-----w C:\Documents and Settings\Monika\Dane aplikacji\Nero 2007-10-30 19:50 --------- d-----w C:\Documents and Settings\Podek\Dane aplikacji\SopCast 2007-10-30 19:49 --------- d-----w C:\Program Files\SopCast 2007-10-30 18:00 --------- d-----w C:\Program Files\18 WoS Across America 2007-10-30 15:41 --------- d-----w C:\Program Files\Hard Truck 2007-10-29 20:48 --------- d-----w C:\Program Files\K-Lite Codec Pack 2007-10-29 13:36 66,872 ----a-w C:\WINDOWS\system32\PnkBstrA.exe 2007-10-27 12:18 --------- d-----w C:\Documents and Settings\Michał\Dane aplikacji\AdobeUM 2007-10-27 12:17 --------- d-----w C:\Documents and Settings\Michał\Dane aplikacji\Leadertech 2007-10-26 18:28 --------- d-----w C:\Documents and Settings\Monika\Dane aplikacji\MEGAUPLOADTOOLBAR 2007-10-20 17:30 --------- d-----w C:\Documents and Settings\Michał\Dane aplikacji\Vista Start Menu 2007-10-07 10:09 7,680 ----a-w C:\WINDOWS\system32\ff_vfw.dll 2007-10-04 22:27 73,216 ----a-w C:\WINDOWS\ST6UNST.EXE 2007-10-04 22:27 249,856 ------w C:\WINDOWS\Setup1.exe 2007-10-01 18:33 60,273 ----a-w C:\WINDOWS\system32\pthreadGC2.dll 2007-09-20 07:59 972,072 ----a-w C:\WINDOWS\UNRecode.exe 2007-09-20 07:55 972,072 ----a-w C:\WINDOWS\UNNeroMediaHome.exe 2007-09-20 07:55 95,600 ----a-w C:\WINDOWS\system32\NeroCo.dll 2005-07-14 19:31 27,648 --sha-w C:\WINDOWS\system32\AVSredirect.dll . ((((((((((((((((((((((((((((( snapshot@2007-12-16_12.21.15,40 ))))))))))))))))))))))))))))))))))))))))) . - 2007-08-29 07:33:20 16,384 ----a-w C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat + 2007-12-16 11:46:16 16,384 ----a-w C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat - 2007-08-29 07:33:20 32,768 ----a-w C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Historia\History.IE5\index.dat + 2007-12-16 11:46:16 32,768 ----a-w C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Historia\History.IE5\index.dat - 2007-10-28 17:57:13 39,992 ----a-w C:\WINDOWS\system32\perfc009.dat + 2007-12-16 11:51:13 39,992 ----a-w C:\WINDOWS\system32\perfc009.dat - 2007-10-28 17:57:14 49,492 ----a-w C:\WINDOWS\system32\perfc015.dat + 2007-12-16 11:51:13 49,492 ----a-w C:\WINDOWS\system32\perfc015.dat - 2007-10-28 17:57:14 311,604 ----a-w C:\WINDOWS\system32\perfh009.dat + 2007-12-16 11:51:13 311,604 ----a-w C:\WINDOWS\system32\perfh009.dat - 2007-10-28 17:57:14 355,486 ----a-w C:\WINDOWS\system32\perfh015.dat + 2007-12-16 11:51:13 355,486 ----a-w C:\WINDOWS\system32\perfh015.dat . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NvMediaCenter"="RUNDLL32.exe" [2001-10-26 18:30 C:\WINDOWS\system32\rundll32.exe] "NVIEW"="nview.dll" [2003-07-29 06:19 C:\WINDOWS\system32\nview.dll] "Gadu-Gadu"="D:\Program Files\Gadu-Gadu\gg.exe" [2007-07-09 08:39] "MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2002-08-20 14:08] "Skype"="C:\Program Files\Skype\Phone\Skype.exe" [2007-11-16 12:39] "AlcoholAutomount"="C:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe" [2007-07-02 11:27] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11] "Sony Ericsson PC Suite"="C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" [2005-10-26 15:17] "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-05-11 02:06] "nod32kui"="C:\Program Files\Eset\nod32kui.exe" [2007-09-08 20:31] "NBKeyScan"="C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" [2007-09-20 08:51] "NvCplDaemon"="RUNDLL32.exe" [2001-10-26 18:30 C:\WINDOWS\system32\rundll32.exe] "nwiz"="nwiz.exe" [2003-07-29 06:19 C:\WINDOWS\system32\nwiz.exe] "AT-Watch"="C:\Program Files\Anti-Trojan-55\ATWatch.exe" [2002-09-08 09:03] "Anti-Trojan-Watch"="C:\Program Files\Anti-Trojan-55\ATWatch.exe" [2002-09-08 09:03] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2002-09-20 17:05] "NvMediaCenter"="RUNDLL32.exe" [2001-10-26 18:30 C:\WINDOWS\system32\rundll32.exe] C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\ Adobe Gamma Loader.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2007-11-25 08:48:52] Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 09:01:04] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Microsoft Office.lnk] path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Microsoft Office.lnk backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Photo Downloader] 2005-06-06 22:46 57344 --a------ C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BearShare] C:\Program Files\BearShare\BearShare.exe /pause [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE] 2002-09-20 17:05 13312 --a------ C:\WINDOWS\System32\ctfmon.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Flashget] C:\Program Files\FlashGet\FlashGet.exe /min [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroCheck] C:\WINDOWS\system32\NeroCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] 2007-03-01 14:57 153136 --a------ C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz] nwiz.exe /install [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] C:\Program Files\QuickTime\qttask.exe -atboottime [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Sony Ericsson PC Suite] C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe /startoptions [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpeedTouch USB Diagnostics] C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe /icon [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent] 2007-05-19 10:39 35328 --a------ C:\Program Files\Winamp\winampa.exe . Contents of the 'Scheduled Tasks' folder "2007-10-19 10:02:28 C:\WINDOWS\Tasks\Norton Security Scan.job" - C:\Program Files\Norton Security Scan\Nss.exe . ************************************************************************** catchme 0.3.1333 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-12-16 21:31:47 Windows 5.1.2600 Dodatek Service Pack. 1 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . --------------------- DLLs Loaded Under Running Processes --------------------- PROCESS: C:\WINDOWS\system32\lsass.exe [5.01.2600.1106] -> C:\Program Files\Eset\pr_imon.dll . Completion time: 2007-12-16 21:33:13 C:\ComboFix2.txt ... 2007-12-16 17:32 C:\ComboFix3.txt ... 2007-12-16 17:10

**Posty:** 18165 · przez **wojtas** 16 Gru 2007, 22:36

jest czysto przeinstaluj moze firefoxa.. nie masz wirusow

**Posty:** 29 · przez **podek** 17 Gru 2007, 16:29

To napewno nie od firefoxa, bo już to sprawdzałem. Przyszło mi jednak na myśl, że może to wina pamięci wirtualnej. Podczas gry w warrocka wyskakiwało mi ostrzeżenie, a gra się wyłączała. Wtedy z 382 powiększyłem na 700 i komunikat się nie pojawia. Może w tym tkwi problem?

**Posty:** 18165 · przez **wojtas** 17 Gru 2007, 16:54

ile masz ramu

**Posty:** 29 · przez **podek** 17 Gru 2007, 19:01

256DDR

problem z worm.win32.netsky

problem z worm.win32.netsky

Kto jest na forum