Zawieszanie się komputera, problem z programami

**Posty:** 24 · przez **Kamil636** 14 Gru 2008, 20:31

Wiem że często do was pisze z problemami ...

ale nic nie poradzę, mój komp nie miał formata od nowości ...
aktualnie jestem w UK a całe moje oprogramowanie zostało w Polsce

więc proszę pomóżcie mi jeszcze ostatni raz ...
za tydzień jadę do Polski to zrobię mu format jak wrócę ...

chodzi o to że moja siostra dzisiaj weszła na komputer ...
grała sobie na jakiś portalach z grami ...
i powiedziała mi że komputer nie działa ...
przyszedłem do pokoju ... zobaczyłem tylko tapetę bez ikon ...
zrestartowałem go ...
gdy się włączył ... jak zwykle włączyło mi się okno gg z prośbą o poddanie gasła ...
myślałem że wszystko jest ok ... ale gdy wpisałem hasło gg nie wyświetliło się ...
wszedłem w mój folder ( żeby jakąś muzykę puścić ) ...
kliknołem 2 razy na plik z muzyką ... i chciałem zamknąć folder ...
wyświetliło się okienko ( zakończ zadanie lub anuluj )
nie mogłem zamknąć prostego zwyczajnego folderu !!!
nie wiem o co chodzi ... włączyłem avasta ... wyświetlił sie normalnie ... włączyłem skan ...
po jakiś 13 minutach włączyło się gg ... nie mogłem zmienić statusu ...
używałem już :
avast
odkurzacz
adaware
spyware terminator

i nic !!! ... avast znalazł kilka wirusów ... ale to nic nie dało ...
próbowałem użyć programu który zawsze mi pomagał ...
ComboFix ... ale gdy sie załadował i wyświetliło sie okienko ...
``program ComboFix zaczyna swoje działanie ... proszę czekać``
nic się więcej nie działo ...
czekałem z 15 minut i nic !! ...

podobnie hijackthis oraz FixIEDef ... nie działają

ciągle sie muli i zawiesza .... musze go co chwile restartować ...
internet działa normalnie ... nie zawiesza sie ani nic ....
ratujcie

... nigdy czegoś takiego nie miałem ...
a musze mieć stały dostęp do komputera ...
proszę o jak najszybaszą odpowiedź

P.S próbowałem zrobić scan avastem jeszcze raz ... ale zacioł sie na 1 % ... i nie ruszył dalej ...

**Posty:** 8001 · przez **Okocza** 14 Gru 2008, 20:36

Kamil636, wejdź w awaryjny - wygeneruj logi i wstaw je

**Posty:** 24 · przez **Kamil636** 14 Gru 2008, 20:48

LOG ZE SKANOWANIA COMBOFIX

Kod: Zaznacz wszystko: ComboFix 08-12-14.01 - Monika 2008-12-14 18:43:24.6 - NTFSx86 NETWORK Microsoft Windows XP Home Edition 5.1.2600.3.1250.1.1045.18.1007.805 [GMT 0:00] Uruchomiony z: c:\documents and settings\Monika\Pulpit\ComboFix.exe . ((((((((((((((((((((((((( Pliki utworzone od 2008-11-14 do 2008-12-14 ))))))))))))))))))))))))))))))) . 2008-12-13 19:45 . 2008-12-13 19:45 <DIR> d-------- c:\program files\Rockstar Games 2008-12-12 17:49 . 2008-12-12 17:50 <DIR> d-------- c:\program files\mp3DirectCut 2008-12-06 19:27 . 2008-12-06 19:27 <DIR> d-------- c:\windows\ERUNT 2008-12-06 19:27 . 2008-12-06 19:27 <DIR> d-------- C:\ERDNT 2008-12-06 19:27 . 2008-12-06 19:27 <DIR> d-------- C:\!FixIEDef 2008-12-06 17:53 . 2008-12-06 18:19 <DIR> d-------- c:\program files\Odkurzacz 2008-11-24 18:25 . 2008-11-24 18:25 <DIR> d-------- c:\program files\Common Files\Skype 2008-11-24 18:25 . 2008-11-24 18:25 56 --ah----- c:\windows\system32\ezsidmv.dat . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2060-08-18 17:02 1,496,064 -c----w c:\windows\system32\CC3250MT.DLL 2060-08-18 16:40 909,824 -c----w c:\windows\system32\cp3245mt.dll 2060-08-18 16:40 24,064 -c----w c:\windows\system32\borlndmm.dll 2008-12-14 18:35 --------- d-----w c:\program files\Spyware Terminator 2008-12-14 17:27 --------- d-----w c:\program files\FlashGet 2008-12-14 17:27 --------- d-----w c:\program files\FaxTools 2008-12-14 17:27 --------- d-----w c:\program files\Codec Pack - All In 1 2008-12-14 17:24 --------- d-----w c:\documents and settings\Monika\Dane aplikacji\skypePM 2008-12-14 14:38 --------- d-----w c:\program files\Mozilla Thunderbird 2008-12-14 11:56 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\Spyware Terminator 2008-12-14 11:54 --------- d-----w c:\documents and settings\Monika\Dane aplikacji\Spyware Terminator 2008-12-14 11:50 --------- d-----w c:\documents and settings\Monika\Dane aplikacji\Skype 2008-12-14 11:23 163,644 ----a-w c:\windows\system32\drivers\secdrv.sys 2008-12-11 17:34 --------- d-----w c:\documents and settings\Monika\Dane aplikacji\OpenOffice.ux.pl2 2008-12-06 18:06 --------- d-----w c:\program files\QuickTime 2008-12-06 18:06 --------- d-----w c:\program files\IrfanView 2008-12-06 18:06 --------- d-----w c:\program files\Call of Duty 2008-12-02 21:52 --------- d-----w c:\program files\Java 2008-11-28 19:21 --------- d-----w c:\program files\Gadu-Gadu 2008-11-24 18:25 --------- d-----w c:\program files\Skype 2008-11-10 05:43 410,984 ----a-w c:\windows\system32\deploytk.dll 2008-11-08 20:18 --------- d-----w c:\documents and settings\Monika\Dane aplikacji\gtk-2.0 2008-11-04 20:03 --------- d-----w c:\program files\Yahoo! 2008-11-04 20:02 --------- d-----w c:\program files\DAEMON Tools Toolbar 2008-11-04 20:01 --------- d-----w c:\program files\Google 2008-11-04 20:00 --------- d-----w c:\program files\ContextProgram 2008-11-04 19:34 141,312 ----a-w c:\windows\system32\drivers\sp_rsdrv2.sys 2008-11-02 15:54 --------- d-----w c:\program files\Windows Live 2008-11-01 13:59 --------- d-----w c:\documents and settings\Administrator\Dane aplikacji\OpenOffice.ux.pl2 2008-10-31 20:49 --------- d-----w c:\program files\CCleaner 2008-10-31 20:21 --------- d-----w c:\documents and settings\Administrator\Dane aplikacji\Thunderbird 2008-10-31 20:21 --------- d-----w c:\documents and settings\Administrator\Dane aplikacji\Talkback 2008-10-31 16:04 --------- d-----w c:\documents and settings\Administrator\Dane aplikacji\Winamp 2008-10-30 20:32 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\NVIDIA 2008-10-29 10:44 --------- d-----w c:\program files\directx 2008-10-29 10:12 --------- d-----w c:\program files\iXi Tools 2008-10-27 13:39 --------- d-----w c:\program files\Microsoft CAPICOM 2.1.0.2 2008-10-26 19:03 --------- d-----w c:\program files\Microsoft SQL Server Compact Edition 2008-10-26 19:01 --------- dcsh--w c:\program files\Common Files\WindowsLiveInstaller 2008-10-26 18:59 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\WLInstaller 2008-10-26 13:52 --------- d-----w c:\program files\VstPlugins 2008-10-24 11:21 455,296 ----a-w c:\windows\system32\drivers\mrxsmb.sys 2008-10-23 12:42 286,720 ----a-w c:\windows\system32\gdi32.dll 2008-10-17 17:49 --------- d-----w c:\program files\Lexmark 1200 Series 2008-10-16 20:33 826,368 ----a-w c:\windows\system32\wininet.dll 2008-10-16 14:13 202,776 ----a-w c:\windows\system32\wuweb.dll 2008-10-16 14:13 1,809,944 ----a-w c:\windows\system32\wuaueng.dll 2008-10-16 14:12 561,688 ----a-w c:\windows\system32\wuapi.dll 2008-10-16 14:12 323,608 ----a-w c:\windows\system32\wucltui.dll 2008-10-16 14:09 92,696 ----a-w c:\windows\system32\cdm.dll 2008-10-16 14:09 51,224 ----a-w c:\windows\system32\wuauclt.exe 2008-10-16 14:09 43,544 ----a-w c:\windows\system32\wups2.dll 2008-10-16 14:08 34,328 ----a-w c:\windows\system32\wups.dll 2008-10-16 14:06 268,648 ----a-w c:\windows\system32\mucltui.dll 2008-10-16 14:06 208,744 ----a-w c:\windows\system32\muweb.dll 2008-10-03 10:04 247,326 ----a-w c:\windows\system32\strmdll.dll 2008-09-30 16:43 1,286,152 ----a-w c:\windows\system32\msxml4.dll 2008-09-15 15:27 1,846,656 ----a-w c:\windows\system32\win32k.sys 2007-12-15 15:41 32 ----a-w c:\documents and settings\All Users\Dane aplikacji\ezsid.dat 2008-08-27 09:37 88 --sh--r c:\windows\system32\B67796535D.sys 2007-09-25 20:32 88 -csh--r c:\windows\system32\DAB99D55BF.sys 2008-08-27 09:58 6,268 -csha-w c:\windows\system32\KGyGaAvL.sys . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360] "Gadu-Gadu"="c:\program files\Gadu-Gadu\gg.exe" [2007-07-09 2119104] "Odkurzacz-MCD"="c:\program files\Odkurzacz\odk_mcd.exe" [2008-08-16 264704] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-08-16 7630848] "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2006-08-16 86016] "LogitechCommunicationsManager"="c:\program files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe" [2007-02-08 488984] "avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2008-07-19 78008] "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2008-11-10 136600] "nwiz"="nwiz.exe" [2006-08-16 c:\windows\system32\nwiz.exe] "SkyTel"="SkyTel.EXE" [2006-05-16 c:\windows\SkyTel.exe] "RTHDCPL"="RTHDCPL.EXE" [2006-06-01 c:\windows\RTHDCPL.exe] c:\documents and settings\Administrator\Menu Start\Programy\Autostart\ OpenOffice.ux.pl 2.1.0.lnk - c:\program files\OpenOffice.ux.pl 2.1.0\program\quickstart.exe [2006-12-30 17408] c:\documents and settings\All Users\Menu Start\Programy\Autostart\ Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2004-12-14 29696] Belkin Wireless USB Utility.lnk - d:\program files\Belkin\USB F5D7050\Wireless Utility\Belkinwcui.exe [2005-10-28 1404928] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "msacm.l3codec"= l3codecp.acm [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Logitech Desktop Messenger.lnk] path=c:\documents and settings\All Users\Menu Start\Programy\Autostart\Logitech Desktop Messenger.lnk backup=c:\windows\pss\Logitech Desktop Messenger.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^Monika^Menu Start^Programy^Autostart^OpenOffice.ux.pl 2.1.0.lnk] path=c:\documents and settings\Monika\Menu Start\Programy\Autostart\OpenOffice.ux.pl 2.1.0.lnk backup=c:\windows\pss\OpenOffice.ux.pl 2.1.0.lnkStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Lexmark 1200 Series] --a------ 2006-07-13 05:33 57344 c:\program files\Lexmark 1200 Series\lxczbmgr.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechQuickCamRibbon] --a------ 2007-02-08 00:13 774168 c:\program files\Logitech\QuickCam10\QuickCam10.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] --a------ 2008-02-12 20:02 77824 c:\program files\QuickTime\qttask.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent] --a------ 2008-04-01 18:49 36352 c:\program files\Winamp\winampa.exe [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusOverride"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "c:\\Program Files\\Gadu-Gadu\\gg.exe"= "c:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe"= "c:\\WINDOWS\\system32\\dpvsetup.exe"= "c:\\Program Files\\BearShare\\BearShare.exe"= "c:\\Program Files\\FlashGet\\FlashGet.exe"= "c:\\Program Files\\Mozilla Firefox\\firefox.exe"= "c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"= "c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"= "c:\\Program Files\\Messenger\\msmsgs.exe"= "c:\\Program Files\\Skype\\Phone\\Skype.exe"= S1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2008-11-04 78416] S1 sp_rsdrv2;Spyware Terminator Driver 2;\??\c:\windows\system32\drivers\sp_rsdrv2.sys [2008-11-04 141312] S2 aswFsBlk;aswFsBlk;c:\windows\system32\DRIVERS\aswFsBlk.sys [2008-11-04 20560] S3 PavSRK.sys;PavSRK.sys;\??\c:\windows\system32\PavSRK.sys [] S3 PavTPK.sys;PavTPK.sys;\??\c:\windows\system32\PavTPK.sys [] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{3482b442-b3e7-11dd-b809-001966000032}] \Shell\AutoRun\command - G:\InstallTomTomHOME.exe . Zawartość folderu 'Zaplanowane zadania' 2008-09-12 c:\windows\Tasks\Norton Security Scan.job - c:\program files\Norton Security Scan\Nss.exe [] . . ------- Skan uzupełniający ------- . uStart Page = hxxp://google.pl/ IE: &Download All with FlashGet - c:\progra~1\FlashGet\jc_all.htm IE: &Download with FlashGet - c:\progra~1\FlashGet\jc_link.htm Trusted Zone: *.amaena.com Trusted Zone: *.antimalwareguard.com Trusted Zone: *.antispyexpert.com Trusted Zone: *.avsystemcare.com Trusted Zone: *.gomyhit.com Trusted Zone: *.imageservr.com Trusted Zone: *.imagesrvr.com Trusted Zone: *.onerateld.com Trusted Zone: *.safetydownload.com Trusted Zone: *.spyguardpro.com Trusted Zone: *.storageguardsoft.com Trusted Zone: *.trustedantivirus.com Trusted Zone: *.virusremover2008.com Trusted Zone: *.virusschlacht.com Trusted Zone: *.amaena.com Trusted Zone: *.antimalwareguard.com Trusted Zone: *.antispyexpert.com Trusted Zone: *.avsystemcare.com Trusted Zone: *.gomyhit.com Trusted Zone: *.imageservr.com Trusted Zone: *.imagesrvr.com Trusted Zone: *.onerateld.com Trusted Zone: *.safetydownload.com Trusted Zone: *.spyguardpro.com Trusted Zone: *.storageguardsoft.com Trusted Zone: *.trustedantivirus.com Trusted Zone: *.virusremover2008.com Trusted Zone: *.virusschlacht.com Handler: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - c:\program files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll FF - ProfilePath - c:\documents and settings\Monika\Dane aplikacji\Mozilla\Firefox\Profiles\mtqsc3mx.default\ FF - prefs.js: browser.search.selectedEngine - DAEMON Search FF - plugin: c:\program files\Adobe\Acrobat 7.0\Reader\browser\nppdf32.dll FF - plugin: c:\program files\Java\jre6\bin\new_plugin\npdeploytk.dll FF - plugin: c:\program files\Java\jre6\bin\new_plugin\npjp2.dll FF - plugin: c:\program files\Mozilla Firefox\plugins\npdeploytk.dll FF - plugin: c:\program files\Yahoo!\Common\npyaxmpb.dll . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-12-14 18:44:55 Windows 5.1.2600 Dodatek Service Pack 3 NTFS skanowanie ukrytych procesów ... skanowanie ukrytych wpisów autostartu ... skanowanie ukrytych plików ... skanowanie pomyślnie ukończone ukryte pliki: 0 ************************************************************************** . Czas ukończenia: 2008-12-14 18:46:21 ComboFix-quarantined-files.txt 2008-12-14 18:45:17 Przed: 10 059 026 432 bajtów wolnych Po: 10,049,544,192 bajtów wolnych 204 --- E O F --- 2008-12-11 21:09:30

log z hijackthis

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 18:48:37, on 2008-12-14 Platform: Windows XP Dodatek SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16762) Boot mode: Safe mode with network support Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\SYSTEM32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe C:\WINDOWS\explorer.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.pl/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [LogitechCommunicationsManager] "C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe" O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe" O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - HKCU\..\Run: [Odkurzacz-MCD] C:\Program Files\Odkurzacz\odk_mcd.exe O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O4 - Global Startup: Belkin Wireless USB Utility.lnk = D:\Program Files\Belkin\USB F5D7050\Wireless Utility\Belkinwcui.exe O8 - Extra context menu item: &Download All with FlashGet - C:\PROGRA~1\FlashGet\jc_all.htm O8 - Extra context menu item: &Download with FlashGet - C:\PROGRA~1\FlashGet\jc_link.htm O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O15 - Trusted Zone: *.amaena.com O15 - Trusted Zone: *.antimalwareguard.com O15 - Trusted Zone: *.antispyexpert.com O15 - Trusted Zone: *.avsystemcare.com O15 - Trusted Zone: *.gomyhit.com O15 - Trusted Zone: *.imageservr.com O15 - Trusted Zone: *.imagesrvr.com O15 - Trusted Zone: *.onerateld.com O15 - Trusted Zone: *.safetydownload.com O15 - Trusted Zone: *.spyguardpro.com O15 - Trusted Zone: *.storageguardsoft.com O15 - Trusted Zone: *.trustedantivirus.com O15 - Trusted Zone: *.virusremover2008.com O15 - Trusted Zone: *.virusschlacht.com O15 - Trusted Zone: *.amaena.com (HKLM) O15 - Trusted Zone: *.antimalwareguard.com (HKLM) O15 - Trusted Zone: *.antispyexpert.com (HKLM) O15 - Trusted Zone: *.avsystemcare.com (HKLM) O15 - Trusted Zone: *.gomyhit.com (HKLM) O15 - Trusted Zone: *.imageservr.com (HKLM) O15 - Trusted Zone: *.imagesrvr.com (HKLM) O15 - Trusted Zone: *.onerateld.com (HKLM) O15 - Trusted Zone: *.safetydownload.com (HKLM) O15 - Trusted Zone: *.spyguardpro.com (HKLM) O15 - Trusted Zone: *.storageguardsoft.com (HKLM) O15 - Trusted Zone: *.trustedantivirus.com (HKLM) O15 - Trusted Zone: *.virusremover2008.com (HKLM) O15 - Trusted Zone: *.virusschlacht.com (HKLM) O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w2/resources/MSNPUpld.cab O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1174301425562 O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - c:\program files\common files\logishrd\lvmvfm\LVPrcSrv.exe O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\SrvLnch\SrvLnch.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: ProtexisLicensing - Unknown owner - C:\WINDOWS\system32\PSIService.exe O23 - Service: Spyware Terminator Realtime Shield Service (sp_rssrv) - Crawler.com - C:\Program Files\Spyware Terminator\sp_rsser.exe -- End of file - 6207 bytes

PS. wykonałem też operacje programem FixIedEF

**Posty:** 8001 · przez **Okocza** 14 Gru 2008, 21:00

http://forum.programosy.pl/specjalne-narzedzia-czyszczace-vt96631.html

zastosuj smitfraudfix

i wstawiaj logi w tagi 'code' :!:

**Posty:** 24 · przez **Kamil636** 14 Gru 2008, 21:11

Zastosowałem 2 opcje w SmitfraudFix ...

Search

Kod: Zaznacz wszystko: SmitFraudFix v2.385 Scan done at 19:08:06,95, 2008-12-14 Run from C:\Documents and Settings\Monika\Pulpit\SmitfraudFix OS: Microsoft Windows XP [Wersja 5.1.2600] - Windows_NT The filesystem type is NTFS Fix run in safe mode »»»»»»»»»»»»»»»»»»»»»»»» Process C:\WINDOWS\System32\smss.exe C:\WINDOWS\SYSTEM32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe C:\WINDOWS\system32\cmd.exe C:\WINDOWS\explorer.exe »»»»»»»»»»»»»»»»»»»»»»»» hosts »»»»»»»»»»»»»»»»»»»»»»»» C:\ »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32 »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32\LogFiles »»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Monika »»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\Monika\USTAWI~1\Temp »»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Monika\Application Data »»»»»»»»»»»»»»»»»»»»»»»» Start Menu »»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\Monika\Ulubione »»»»»»»»»»»»»»»»»»»»»»»» Desktop »»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files »»»»»»»»»»»»»»»»»»»»»»»» Corrupted keys »»»»»»»»»»»»»»»»»»»»»»»» Desktop Components »»»»»»»»»»»»»»»»»»»»»»»» o4Patch !!!Attention, following keys are not inevitably infected!!! o4Patch Credits: Malware Analysis & Diagnostic Code: S!Ri »»»»»»»»»»»»»»»»»»»»»»»» IEDFix !!!Attention, following keys are not inevitably infected!!! IEDFix Credits: Malware Analysis & Diagnostic Code: S!Ri »»»»»»»»»»»»»»»»»»»»»»»» Agent.OMZ.Fix !!!Attention, following keys are not inevitably infected!!! Agent.OMZ.Fix Credits: Malware Analysis & Diagnostic Code: S!Ri »»»»»»»»»»»»»»»»»»»»»»»» VACFix !!!Attention, following keys are not inevitably infected!!! VACFix Credits: Malware Analysis & Diagnostic Code: S!Ri »»»»»»»»»»»»»»»»»»»»»»»» 404Fix !!!Attention, following keys are not inevitably infected!!! 404Fix Credits: Malware Analysis & Diagnostic Code: S!Ri »»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler !!!Attention, following keys are not inevitably infected!!! SrchSTS.exe by S!Ri Search SharedTaskScheduler's .dll »»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs !!!Attention, following keys are not inevitably infected!!! »»»»»»»»»»»»»»»»»»»»»»»» Winlogon !!!Attention, following keys are not inevitably infected!!! [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] "Userinit"="C:\\WINDOWS\\system32\\userinit.exe," "System"="" »»»»»»»»»»»»»»»»»»»»»»»» RK »»»»»»»»»»»»»»»»»»»»»»»» DNS Description: NVIDIA nForce Networking Controller - Sterownik miniport Harmonogramu pakietów DNS Server Search Order: 194.168.4.100 DNS Server Search Order: 194.168.8.100 HKLM\SYSTEM\CCS\Services\Tcpip\..\{A7D1ADE1-BB9F-4433-9E43-0DB988FF7F0C}: DhcpNameServer=194.168.4.100 194.168.8.100 HKLM\SYSTEM\CCS\Services\Tcpip\..\{C208D72F-4E28-4639-A840-CF142545AE28}: DhcpNameServer=192.168.2.1 HKLM\SYSTEM\CCS\Services\Tcpip\..\{D6A8ACF5-2EDE-482A-ABAB-C28AB6B62EC6}: DhcpNameServer=192.168.2.1 HKLM\SYSTEM\CS1\Services\Tcpip\..\{A7D1ADE1-BB9F-4433-9E43-0DB988FF7F0C}: DhcpNameServer=194.168.4.100 194.168.8.100 HKLM\SYSTEM\CS1\Services\Tcpip\..\{C208D72F-4E28-4639-A840-CF142545AE28}: DhcpNameServer=192.168.2.1 HKLM\SYSTEM\CS1\Services\Tcpip\..\{D6A8ACF5-2EDE-482A-ABAB-C28AB6B62EC6}: DhcpNameServer=192.168.2.1 HKLM\SYSTEM\CS2\Services\Tcpip\..\{A7D1ADE1-BB9F-4433-9E43-0DB988FF7F0C}: DhcpNameServer=194.168.4.100 194.168.8.100 HKLM\SYSTEM\CS2\Services\Tcpip\..\{C208D72F-4E28-4639-A840-CF142545AE28}: DhcpNameServer=192.168.2.1 HKLM\SYSTEM\CS2\Services\Tcpip\..\{D6A8ACF5-2EDE-482A-ABAB-C28AB6B62EC6}: DhcpNameServer=192.168.2.1 HKLM\SYSTEM\CS3\Services\Tcpip\..\{A7D1ADE1-BB9F-4433-9E43-0DB988FF7F0C}: DhcpNameServer=194.168.4.100 194.168.8.100 HKLM\SYSTEM\CS3\Services\Tcpip\..\{C208D72F-4E28-4639-A840-CF142545AE28}: DhcpNameServer=192.168.2.1 HKLM\SYSTEM\CS3\Services\Tcpip\..\{D6A8ACF5-2EDE-482A-ABAB-C28AB6B62EC6}: DhcpNameServer=192.168.2.1 HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=194.168.4.100 194.168.8.100 HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=194.168.4.100 194.168.8.100 HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=194.168.4.100 194.168.8.100 HKLM\SYSTEM\CS3\Services\Tcpip\Parameters: DhcpNameServer=194.168.4.100 194.168.8.100 »»»»»»»»»»»»»»»»»»»»»»»» Scanning for wininet.dll infection »»»»»»»»»»»»»»»»»»»»»»»» End

Clean

Kod: Zaznacz wszystko: SmitFraudFix v2.385 Scan done at 19:06:25,98, 2008-12-14 Run from C:\Documents and Settings\Monika\Pulpit\SmitfraudFix OS: Microsoft Windows XP [Wersja 5.1.2600] - Windows_NT The filesystem type is NTFS Fix run in safe mode »»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Before SmitFraudFix !!!Attention, following keys are not inevitably infected!!! SrchSTS.exe by S!Ri Search SharedTaskScheduler's .dll »»»»»»»»»»»»»»»»»»»»»»»» Killing process »»»»»»»»»»»»»»»»»»»»»»»» hosts 127.0.0.1 localhost »»»»»»»»»»»»»»»»»»»»»»»» VACFix VACFix Credits: Malware Analysis & Diagnostic Code: S!Ri »»»»»»»»»»»»»»»»»»»»»»»» Winsock2 Fix S!Ri's WS2Fix: LSP not Found. »»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix GenericRenosFix by S!Ri »»»»»»»»»»»»»»»»»»»»»»»» Deleting infected files »»»»»»»»»»»»»»»»»»»»»»»» IEDFix IEDFix Credits: Malware Analysis & Diagnostic Code: S!Ri »»»»»»»»»»»»»»»»»»»»»»»» Agent.OMZ.Fix Agent.OMZ.Fix Credits: Malware Analysis & Diagnostic Code: S!Ri »»»»»»»»»»»»»»»»»»»»»»»» 404Fix 404Fix Credits: Malware Analysis & Diagnostic Code: S!Ri »»»»»»»»»»»»»»»»»»»»»»»» RK »»»»»»»»»»»»»»»»»»»»»»»» DNS Description: NVIDIA nForce Networking Controller - Sterownik miniport Harmonogramu pakietów DNS Server Search Order: 194.168.4.100 DNS Server Search Order: 194.168.8.100 HKLM\SYSTEM\CCS\Services\Tcpip\..\{A7D1ADE1-BB9F-4433-9E43-0DB988FF7F0C}: DhcpNameServer=194.168.4.100 194.168.8.100 HKLM\SYSTEM\CCS\Services\Tcpip\..\{C208D72F-4E28-4639-A840-CF142545AE28}: DhcpNameServer=192.168.2.1 HKLM\SYSTEM\CCS\Services\Tcpip\..\{D6A8ACF5-2EDE-482A-ABAB-C28AB6B62EC6}: DhcpNameServer=192.168.2.1 HKLM\SYSTEM\CS1\Services\Tcpip\..\{A7D1ADE1-BB9F-4433-9E43-0DB988FF7F0C}: DhcpNameServer=194.168.4.100 194.168.8.100 HKLM\SYSTEM\CS1\Services\Tcpip\..\{C208D72F-4E28-4639-A840-CF142545AE28}: DhcpNameServer=192.168.2.1 HKLM\SYSTEM\CS1\Services\Tcpip\..\{D6A8ACF5-2EDE-482A-ABAB-C28AB6B62EC6}: DhcpNameServer=192.168.2.1 HKLM\SYSTEM\CS2\Services\Tcpip\..\{A7D1ADE1-BB9F-4433-9E43-0DB988FF7F0C}: DhcpNameServer=194.168.4.100 194.168.8.100 HKLM\SYSTEM\CS2\Services\Tcpip\..\{C208D72F-4E28-4639-A840-CF142545AE28}: DhcpNameServer=192.168.2.1 HKLM\SYSTEM\CS2\Services\Tcpip\..\{D6A8ACF5-2EDE-482A-ABAB-C28AB6B62EC6}: DhcpNameServer=192.168.2.1 HKLM\SYSTEM\CS3\Services\Tcpip\..\{A7D1ADE1-BB9F-4433-9E43-0DB988FF7F0C}: DhcpNameServer=194.168.4.100 194.168.8.100 HKLM\SYSTEM\CS3\Services\Tcpip\..\{C208D72F-4E28-4639-A840-CF142545AE28}: DhcpNameServer=192.168.2.1 HKLM\SYSTEM\CS3\Services\Tcpip\..\{D6A8ACF5-2EDE-482A-ABAB-C28AB6B62EC6}: DhcpNameServer=192.168.2.1 HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=194.168.4.100 194.168.8.100 HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=194.168.4.100 194.168.8.100 HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=194.168.4.100 194.168.8.100 HKLM\SYSTEM\CS3\Services\Tcpip\Parameters: DhcpNameServer=194.168.4.100 194.168.8.100 »»»»»»»»»»»»»»»»»»»»»»»» Deleting Temp Files »»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System !!!Attention, following keys are not inevitably infected!!! [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] "System"="" »»»»»»»»»»»»»»»»»»»»»»»» Registry Cleaning Registry Cleaning done. »»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler After SmitFraudFix !!!Attention, following keys are not inevitably infected!!! SrchSTS.exe by S!Ri Search SharedTaskScheduler's .dll »»»»»»»»»»»»»»»»»»»»»»»» End

**Posty:** 8001 · przez **Okocza** 14 Gru 2008, 21:16

Kamil636, wstaw log z combofixa teraz

**Posty:** 24 · przez **Kamil636** 14 Gru 2008, 21:26

Dobra gotowe

Kod: Zaznacz wszystko: ComboFix 08-12-14.01 - Monika 2008-12-14 19:22:03.7 - NTFSx86 NETWORK Microsoft Windows XP Home Edition 5.1.2600.3.1250.1.1045.18.1007.792 [GMT 0:00] Uruchomiony z: c:\documents and settings\Monika\Pulpit\ComboFix.exe . ((((((((((((((((((((((((((((((((((((((( Usunięto ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\windows\system32\404Fix.exe c:\windows\system32\dumphive.exe c:\windows\system32\IEDFix.C.exe c:\windows\system32\IEDFix.exe c:\windows\system32\o4Patch.exe c:\windows\system32\Process.exe c:\windows\system32\SrchSTS.exe c:\windows\system32\tmp.reg c:\windows\system32\VACFix.exe c:\windows\system32\VCCLSID.exe c:\windows\system32\WS2Fix.exe . ((((((((((((((((((((((((( Pliki utworzone od 2008-11-14 do 2008-12-14 ))))))))))))))))))))))))))))))) . 2008-12-14 19:05 . 2008-12-12 00:57 78,336 --a------ c:\windows\system32\Agent.OMZ.Fix.exe 2008-12-13 19:45 . 2008-12-13 19:45 <DIR> d-------- c:\program files\Rockstar Games 2008-12-12 17:49 . 2008-12-12 17:50 <DIR> d-------- c:\program files\mp3DirectCut 2008-12-06 19:27 . 2008-12-06 19:27 <DIR> d-------- c:\windows\ERUNT 2008-12-06 19:27 . 2008-12-06 19:27 <DIR> d-------- C:\ERDNT 2008-12-06 19:27 . 2008-12-06 19:27 <DIR> d-------- C:\!FixIEDef 2008-12-06 17:53 . 2008-12-06 18:19 <DIR> d-------- c:\program files\Odkurzacz 2008-11-24 18:25 . 2008-11-24 18:25 <DIR> d-------- c:\program files\Common Files\Skype 2008-11-24 18:25 . 2008-11-24 18:25 56 --ah----- c:\windows\system32\ezsidmv.dat . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2060-08-18 17:02 1,496,064 -c----w c:\windows\system32\CC3250MT.DLL 2060-08-18 16:40 909,824 -c----w c:\windows\system32\cp3245mt.dll 2060-08-18 16:40 24,064 -c----w c:\windows\system32\borlndmm.dll 2008-12-14 18:35 --------- d-----w c:\program files\Spyware Terminator 2008-12-14 17:27 --------- d-----w c:\program files\FlashGet 2008-12-14 17:27 --------- d-----w c:\program files\FaxTools 2008-12-14 17:27 --------- d-----w c:\program files\Codec Pack - All In 1 2008-12-14 17:24 --------- d-----w c:\documents and settings\Monika\Dane aplikacji\skypePM 2008-12-14 14:38 --------- d-----w c:\program files\Mozilla Thunderbird 2008-12-14 11:56 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\Spyware Terminator 2008-12-14 11:54 --------- d-----w c:\documents and settings\Monika\Dane aplikacji\Spyware Terminator 2008-12-14 11:50 --------- d-----w c:\documents and settings\Monika\Dane aplikacji\Skype 2008-12-14 11:23 163,644 ----a-w c:\windows\system32\drivers\secdrv.sys 2008-12-11 17:34 --------- d-----w c:\documents and settings\Monika\Dane aplikacji\OpenOffice.ux.pl2 2008-12-06 18:06 --------- d-----w c:\program files\QuickTime 2008-12-06 18:06 --------- d-----w c:\program files\IrfanView 2008-12-06 18:06 --------- d-----w c:\program files\Call of Duty 2008-12-02 21:52 --------- d-----w c:\program files\Java 2008-11-28 19:21 --------- d-----w c:\program files\Gadu-Gadu 2008-11-24 18:25 --------- d-----w c:\program files\Skype 2008-11-10 05:43 410,984 ----a-w c:\windows\system32\deploytk.dll 2008-11-08 20:18 --------- d-----w c:\documents and settings\Monika\Dane aplikacji\gtk-2.0 2008-11-04 20:03 --------- d-----w c:\program files\Yahoo! 2008-11-04 20:02 --------- d-----w c:\program files\DAEMON Tools Toolbar 2008-11-04 20:01 --------- d-----w c:\program files\Google 2008-11-04 20:00 --------- d-----w c:\program files\ContextProgram 2008-11-04 19:34 141,312 ----a-w c:\windows\system32\drivers\sp_rsdrv2.sys 2008-11-02 15:54 --------- d-----w c:\program files\Windows Live 2008-11-01 13:59 --------- d-----w c:\documents and settings\Administrator\Dane aplikacji\OpenOffice.ux.pl2 2008-10-31 20:49 --------- d-----w c:\program files\CCleaner 2008-10-31 20:21 --------- d-----w c:\documents and settings\Administrator\Dane aplikacji\Thunderbird 2008-10-31 20:21 --------- d-----w c:\documents and settings\Administrator\Dane aplikacji\Talkback 2008-10-31 16:04 --------- d-----w c:\documents and settings\Administrator\Dane aplikacji\Winamp 2008-10-30 20:32 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\NVIDIA 2008-10-29 10:44 --------- d-----w c:\program files\directx 2008-10-29 10:12 --------- d-----w c:\program files\iXi Tools 2008-10-27 13:39 --------- d-----w c:\program files\Microsoft CAPICOM 2.1.0.2 2008-10-26 19:03 --------- d-----w c:\program files\Microsoft SQL Server Compact Edition 2008-10-26 19:01 --------- dcsh--w c:\program files\Common Files\WindowsLiveInstaller 2008-10-26 18:59 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\WLInstaller 2008-10-26 13:52 --------- d-----w c:\program files\VstPlugins 2008-10-24 11:21 455,296 ----a-w c:\windows\system32\drivers\mrxsmb.sys 2008-10-23 12:42 286,720 ----a-w c:\windows\system32\gdi32.dll 2008-10-17 17:49 --------- d-----w c:\program files\Lexmark 1200 Series 2008-10-16 20:33 826,368 ----a-w c:\windows\system32\wininet.dll 2008-10-16 14:13 202,776 ----a-w c:\windows\system32\wuweb.dll 2008-10-16 14:13 1,809,944 ----a-w c:\windows\system32\wuaueng.dll 2008-10-16 14:12 561,688 ----a-w c:\windows\system32\wuapi.dll 2008-10-16 14:12 323,608 ----a-w c:\windows\system32\wucltui.dll 2008-10-16 14:09 92,696 ----a-w c:\windows\system32\cdm.dll 2008-10-16 14:09 51,224 ----a-w c:\windows\system32\wuauclt.exe 2008-10-16 14:09 43,544 ----a-w c:\windows\system32\wups2.dll 2008-10-16 14:08 34,328 ----a-w c:\windows\system32\wups.dll 2008-10-16 14:06 268,648 ----a-w c:\windows\system32\mucltui.dll 2008-10-16 14:06 208,744 ----a-w c:\windows\system32\muweb.dll 2008-10-03 10:04 247,326 ----a-w c:\windows\system32\strmdll.dll 2008-09-30 16:43 1,286,152 ----a-w c:\windows\system32\msxml4.dll 2008-09-15 15:27 1,846,656 ----a-w c:\windows\system32\win32k.sys 2007-12-15 15:41 32 ----a-w c:\documents and settings\All Users\Dane aplikacji\ezsid.dat 2008-08-27 09:37 88 --sh--r c:\windows\system32\B67796535D.sys 2007-09-25 20:32 88 -csh--r c:\windows\system32\DAB99D55BF.sys 2008-08-27 09:58 6,268 -csha-w c:\windows\system32\KGyGaAvL.sys . ((((((((((((((((((((((((((((( snapshot@2008-12-14_18.45.04,68 ))))))))))))))))))))))))))))))))))))))))) . + 2006-01-09 09:36:06 40,960 ----a-w c:\windows\system32\swsc.exe . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360] "Gadu-Gadu"="c:\program files\Gadu-Gadu\gg.exe" [2007-07-09 2119104] "Odkurzacz-MCD"="c:\program files\Odkurzacz\odk_mcd.exe" [2008-08-16 264704] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-08-16 7630848] "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2006-08-16 86016] "LogitechCommunicationsManager"="c:\program files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe" [2007-02-08 488984] "avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2008-07-19 78008] "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2008-11-10 136600] "nwiz"="nwiz.exe" [2006-08-16 c:\windows\system32\nwiz.exe] "SkyTel"="SkyTel.EXE" [2006-05-16 c:\windows\SkyTel.exe] "RTHDCPL"="RTHDCPL.EXE" [2006-06-01 c:\windows\RTHDCPL.exe] c:\documents and settings\Administrator\Menu Start\Programy\Autostart\ OpenOffice.ux.pl 2.1.0.lnk - c:\program files\OpenOffice.ux.pl 2.1.0\program\quickstart.exe [2006-12-30 17408] c:\documents and settings\All Users\Menu Start\Programy\Autostart\ Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2004-12-14 29696] Belkin Wireless USB Utility.lnk - d:\program files\Belkin\USB F5D7050\Wireless Utility\Belkinwcui.exe [2005-10-28 1404928] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "msacm.l3codec"= l3codecp.acm [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Logitech Desktop Messenger.lnk] path=c:\documents and settings\All Users\Menu Start\Programy\Autostart\Logitech Desktop Messenger.lnk backup=c:\windows\pss\Logitech Desktop Messenger.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^Monika^Menu Start^Programy^Autostart^OpenOffice.ux.pl 2.1.0.lnk] path=c:\documents and settings\Monika\Menu Start\Programy\Autostart\OpenOffice.ux.pl 2.1.0.lnk backup=c:\windows\pss\OpenOffice.ux.pl 2.1.0.lnkStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Lexmark 1200 Series] --a------ 2006-07-13 05:33 57344 c:\program files\Lexmark 1200 Series\lxczbmgr.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechQuickCamRibbon] --a------ 2007-02-08 00:13 774168 c:\program files\Logitech\QuickCam10\QuickCam10.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] --a------ 2008-02-12 20:02 77824 c:\program files\QuickTime\qttask.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent] --a------ 2008-04-01 18:49 36352 c:\program files\Winamp\winampa.exe [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusDisableNotify"="0x00000000" "UpdatesDisableNotify"="0x00000000" "AntiVirusOverride"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "c:\\Program Files\\Gadu-Gadu\\gg.exe"= "c:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe"= "c:\\WINDOWS\\system32\\dpvsetup.exe"= "c:\\Program Files\\BearShare\\BearShare.exe"= "c:\\Program Files\\FlashGet\\FlashGet.exe"= "c:\\Program Files\\Mozilla Firefox\\firefox.exe"= "c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"= "c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"= "c:\\Program Files\\Messenger\\msmsgs.exe"= "c:\\Program Files\\Skype\\Phone\\Skype.exe"= S1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2008-11-04 78416] S1 sp_rsdrv2;Spyware Terminator Driver 2;\??\c:\windows\system32\drivers\sp_rsdrv2.sys [2008-11-04 141312] S2 aswFsBlk;aswFsBlk;c:\windows\system32\DRIVERS\aswFsBlk.sys [2008-11-04 20560] S3 PavSRK.sys;PavSRK.sys;\??\c:\windows\system32\PavSRK.sys [] S3 PavTPK.sys;PavTPK.sys;\??\c:\windows\system32\PavTPK.sys [] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{3482b442-b3e7-11dd-b809-001966000032}] \Shell\AutoRun\command - G:\InstallTomTomHOME.exe . Zawartość folderu 'Zaplanowane zadania' 2008-09-12 c:\windows\Tasks\Norton Security Scan.job - c:\program files\Norton Security Scan\Nss.exe [] . . ------- Skan uzupełniający ------- . IE: &Download All with FlashGet - c:\progra~1\FlashGet\jc_all.htm IE: &Download with FlashGet - c:\progra~1\FlashGet\jc_link.htm Handler: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - c:\program files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll FF - ProfilePath - c:\documents and settings\Monika\Dane aplikacji\Mozilla\Firefox\Profiles\mtqsc3mx.default\ FF - prefs.js: browser.search.selectedEngine - DAEMON Search FF - plugin: c:\program files\Adobe\Acrobat 7.0\Reader\browser\nppdf32.dll FF - plugin: c:\program files\Java\jre6\bin\new_plugin\npdeploytk.dll FF - plugin: c:\program files\Java\jre6\bin\new_plugin\npjp2.dll FF - plugin: c:\program files\Mozilla Firefox\plugins\npdeploytk.dll FF - plugin: c:\program files\Yahoo!\Common\npyaxmpb.dll . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-12-14 19:23:29 Windows 5.1.2600 Dodatek Service Pack 3 NTFS skanowanie ukrytych procesów ... skanowanie ukrytych wpisów autostartu ... skanowanie ukrytych plików ... skanowanie pomyślnie ukończone ukryte pliki: 0 ************************************************************************** . Czas ukończenia: 2008-12-14 19:24:56 ComboFix-quarantined-files.txt 2008-12-14 19:23:53 ComboFix2.txt 2008-12-14 18:46:21 Przed: 10 077 876 224 bajtów wolnych Po: 10,060,238,848 bajtów wolnych 197 --- E O F --- 2008-12-11 21:09:30

dam jeszcze drugi bo zeskanowałem 2 razy -,- ...
sory bo mi sie pomieszało ...

Kod: Zaznacz wszystko: ComboFix 08-12-14.01 - Monika 2008-12-14 18:43:24.6 - NTFSx86 NETWORK Microsoft Windows XP Home Edition 5.1.2600.3.1250.1.1045.18.1007.805 [GMT 0:00] Uruchomiony z: c:\documents and settings\Monika\Pulpit\ComboFix.exe . ((((((((((((((((((((((((( Pliki utworzone od 2008-11-14 do 2008-12-14 ))))))))))))))))))))))))))))))) . 2008-12-13 19:45 . 2008-12-13 19:45 <DIR> d-------- c:\program files\Rockstar Games 2008-12-12 17:49 . 2008-12-12 17:50 <DIR> d-------- c:\program files\mp3DirectCut 2008-12-06 19:27 . 2008-12-06 19:27 <DIR> d-------- c:\windows\ERUNT 2008-12-06 19:27 . 2008-12-06 19:27 <DIR> d-------- C:\ERDNT 2008-12-06 19:27 . 2008-12-06 19:27 <DIR> d-------- C:\!FixIEDef 2008-12-06 17:53 . 2008-12-06 18:19 <DIR> d-------- c:\program files\Odkurzacz 2008-11-24 18:25 . 2008-11-24 18:25 <DIR> d-------- c:\program files\Common Files\Skype 2008-11-24 18:25 . 2008-11-24 18:25 56 --ah----- c:\windows\system32\ezsidmv.dat . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2060-08-18 17:02 1,496,064 -c----w c:\windows\system32\CC3250MT.DLL 2060-08-18 16:40 909,824 -c----w c:\windows\system32\cp3245mt.dll 2060-08-18 16:40 24,064 -c----w c:\windows\system32\borlndmm.dll 2008-12-14 18:35 --------- d-----w c:\program files\Spyware Terminator 2008-12-14 17:27 --------- d-----w c:\program files\FlashGet 2008-12-14 17:27 --------- d-----w c:\program files\FaxTools 2008-12-14 17:27 --------- d-----w c:\program files\Codec Pack - All In 1 2008-12-14 17:24 --------- d-----w c:\documents and settings\Monika\Dane aplikacji\skypePM 2008-12-14 14:38 --------- d-----w c:\program files\Mozilla Thunderbird 2008-12-14 11:56 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\Spyware Terminator 2008-12-14 11:54 --------- d-----w c:\documents and settings\Monika\Dane aplikacji\Spyware Terminator 2008-12-14 11:50 --------- d-----w c:\documents and settings\Monika\Dane aplikacji\Skype 2008-12-14 11:23 163,644 ----a-w c:\windows\system32\drivers\secdrv.sys 2008-12-11 17:34 --------- d-----w c:\documents and settings\Monika\Dane aplikacji\OpenOffice.ux.pl2 2008-12-06 18:06 --------- d-----w c:\program files\QuickTime 2008-12-06 18:06 --------- d-----w c:\program files\IrfanView 2008-12-06 18:06 --------- d-----w c:\program files\Call of Duty 2008-12-02 21:52 --------- d-----w c:\program files\Java 2008-11-28 19:21 --------- d-----w c:\program files\Gadu-Gadu 2008-11-24 18:25 --------- d-----w c:\program files\Skype 2008-11-10 05:43 410,984 ----a-w c:\windows\system32\deploytk.dll 2008-11-08 20:18 --------- d-----w c:\documents and settings\Monika\Dane aplikacji\gtk-2.0 2008-11-04 20:03 --------- d-----w c:\program files\Yahoo! 2008-11-04 20:02 --------- d-----w c:\program files\DAEMON Tools Toolbar 2008-11-04 20:01 --------- d-----w c:\program files\Google 2008-11-04 20:00 --------- d-----w c:\program files\ContextProgram 2008-11-04 19:34 141,312 ----a-w c:\windows\system32\drivers\sp_rsdrv2.sys 2008-11-02 15:54 --------- d-----w c:\program files\Windows Live 2008-11-01 13:59 --------- d-----w c:\documents and settings\Administrator\Dane aplikacji\OpenOffice.ux.pl2 2008-10-31 20:49 --------- d-----w c:\program files\CCleaner 2008-10-31 20:21 --------- d-----w c:\documents and settings\Administrator\Dane aplikacji\Thunderbird 2008-10-31 20:21 --------- d-----w c:\documents and settings\Administrator\Dane aplikacji\Talkback 2008-10-31 16:04 --------- d-----w c:\documents and settings\Administrator\Dane aplikacji\Winamp 2008-10-30 20:32 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\NVIDIA 2008-10-29 10:44 --------- d-----w c:\program files\directx 2008-10-29 10:12 --------- d-----w c:\program files\iXi Tools 2008-10-27 13:39 --------- d-----w c:\program files\Microsoft CAPICOM 2.1.0.2 2008-10-26 19:03 --------- d-----w c:\program files\Microsoft SQL Server Compact Edition 2008-10-26 19:01 --------- dcsh--w c:\program files\Common Files\WindowsLiveInstaller 2008-10-26 18:59 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\WLInstaller 2008-10-26 13:52 --------- d-----w c:\program files\VstPlugins 2008-10-24 11:21 455,296 ----a-w c:\windows\system32\drivers\mrxsmb.sys 2008-10-23 12:42 286,720 ----a-w c:\windows\system32\gdi32.dll 2008-10-17 17:49 --------- d-----w c:\program files\Lexmark 1200 Series 2008-10-16 20:33 826,368 ----a-w c:\windows\system32\wininet.dll 2008-10-16 14:13 202,776 ----a-w c:\windows\system32\wuweb.dll 2008-10-16 14:13 1,809,944 ----a-w c:\windows\system32\wuaueng.dll 2008-10-16 14:12 561,688 ----a-w c:\windows\system32\wuapi.dll 2008-10-16 14:12 323,608 ----a-w c:\windows\system32\wucltui.dll 2008-10-16 14:09 92,696 ----a-w c:\windows\system32\cdm.dll 2008-10-16 14:09 51,224 ----a-w c:\windows\system32\wuauclt.exe 2008-10-16 14:09 43,544 ----a-w c:\windows\system32\wups2.dll 2008-10-16 14:08 34,328 ----a-w c:\windows\system32\wups.dll 2008-10-16 14:06 268,648 ----a-w c:\windows\system32\mucltui.dll 2008-10-16 14:06 208,744 ----a-w c:\windows\system32\muweb.dll 2008-10-03 10:04 247,326 ----a-w c:\windows\system32\strmdll.dll 2008-09-30 16:43 1,286,152 ----a-w c:\windows\system32\msxml4.dll 2008-09-15 15:27 1,846,656 ----a-w c:\windows\system32\win32k.sys 2007-12-15 15:41 32 ----a-w c:\documents and settings\All Users\Dane aplikacji\ezsid.dat 2008-08-27 09:37 88 --sh--r c:\windows\system32\B67796535D.sys 2007-09-25 20:32 88 -csh--r c:\windows\system32\DAB99D55BF.sys 2008-08-27 09:58 6,268 -csha-w c:\windows\system32\KGyGaAvL.sys . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360] "Gadu-Gadu"="c:\program files\Gadu-Gadu\gg.exe" [2007-07-09 2119104] "Odkurzacz-MCD"="c:\program files\Odkurzacz\odk_mcd.exe" [2008-08-16 264704] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-08-16 7630848] "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2006-08-16 86016] "LogitechCommunicationsManager"="c:\program files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe" [2007-02-08 488984] "avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2008-07-19 78008] "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2008-11-10 136600] "nwiz"="nwiz.exe" [2006-08-16 c:\windows\system32\nwiz.exe] "SkyTel"="SkyTel.EXE" [2006-05-16 c:\windows\SkyTel.exe] "RTHDCPL"="RTHDCPL.EXE" [2006-06-01 c:\windows\RTHDCPL.exe] c:\documents and settings\Administrator\Menu Start\Programy\Autostart\ OpenOffice.ux.pl 2.1.0.lnk - c:\program files\OpenOffice.ux.pl 2.1.0\program\quickstart.exe [2006-12-30 17408] c:\documents and settings\All Users\Menu Start\Programy\Autostart\ Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2004-12-14 29696] Belkin Wireless USB Utility.lnk - d:\program files\Belkin\USB F5D7050\Wireless Utility\Belkinwcui.exe [2005-10-28 1404928] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "msacm.l3codec"= l3codecp.acm [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Logitech Desktop Messenger.lnk] path=c:\documents and settings\All Users\Menu Start\Programy\Autostart\Logitech Desktop Messenger.lnk backup=c:\windows\pss\Logitech Desktop Messenger.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^Monika^Menu Start^Programy^Autostart^OpenOffice.ux.pl 2.1.0.lnk] path=c:\documents and settings\Monika\Menu Start\Programy\Autostart\OpenOffice.ux.pl 2.1.0.lnk backup=c:\windows\pss\OpenOffice.ux.pl 2.1.0.lnkStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Lexmark 1200 Series] --a------ 2006-07-13 05:33 57344 c:\program files\Lexmark 1200 Series\lxczbmgr.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechQuickCamRibbon] --a------ 2007-02-08 00:13 774168 c:\program files\Logitech\QuickCam10\QuickCam10.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] --a------ 2008-02-12 20:02 77824 c:\program files\QuickTime\qttask.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent] --a------ 2008-04-01 18:49 36352 c:\program files\Winamp\winampa.exe [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusOverride"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "c:\\Program Files\\Gadu-Gadu\\gg.exe"= "c:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe"= "c:\\WINDOWS\\system32\\dpvsetup.exe"= "c:\\Program Files\\BearShare\\BearShare.exe"= "c:\\Program Files\\FlashGet\\FlashGet.exe"= "c:\\Program Files\\Mozilla Firefox\\firefox.exe"= "c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"= "c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"= "c:\\Program Files\\Messenger\\msmsgs.exe"= "c:\\Program Files\\Skype\\Phone\\Skype.exe"= S1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2008-11-04 78416] S1 sp_rsdrv2;Spyware Terminator Driver 2;\??\c:\windows\system32\drivers\sp_rsdrv2.sys [2008-11-04 141312] S2 aswFsBlk;aswFsBlk;c:\windows\system32\DRIVERS\aswFsBlk.sys [2008-11-04 20560] S3 PavSRK.sys;PavSRK.sys;\??\c:\windows\system32\PavSRK.sys [] S3 PavTPK.sys;PavTPK.sys;\??\c:\windows\system32\PavTPK.sys [] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{3482b442-b3e7-11dd-b809-001966000032}] \Shell\AutoRun\command - G:\InstallTomTomHOME.exe . Zawartość folderu 'Zaplanowane zadania' 2008-09-12 c:\windows\Tasks\Norton Security Scan.job - c:\program files\Norton Security Scan\Nss.exe [] . . ------- Skan uzupełniający ------- . uStart Page = hxxp://google.pl/ IE: &Download All with FlashGet - c:\progra~1\FlashGet\jc_all.htm IE: &Download with FlashGet - c:\progra~1\FlashGet\jc_link.htm Trusted Zone: *.amaena.com Trusted Zone: *.antimalwareguard.com Trusted Zone: *.antispyexpert.com Trusted Zone: *.avsystemcare.com Trusted Zone: *.gomyhit.com Trusted Zone: *.imageservr.com Trusted Zone: *.imagesrvr.com Trusted Zone: *.onerateld.com Trusted Zone: *.safetydownload.com Trusted Zone: *.spyguardpro.com Trusted Zone: *.storageguardsoft.com Trusted Zone: *.trustedantivirus.com Trusted Zone: *.virusremover2008.com Trusted Zone: *.virusschlacht.com Trusted Zone: *.amaena.com Trusted Zone: *.antimalwareguard.com Trusted Zone: *.antispyexpert.com Trusted Zone: *.avsystemcare.com Trusted Zone: *.gomyhit.com Trusted Zone: *.imageservr.com Trusted Zone: *.imagesrvr.com Trusted Zone: *.onerateld.com Trusted Zone: *.safetydownload.com Trusted Zone: *.spyguardpro.com Trusted Zone: *.storageguardsoft.com Trusted Zone: *.trustedantivirus.com Trusted Zone: *.virusremover2008.com Trusted Zone: *.virusschlacht.com Handler: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - c:\program files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll FF - ProfilePath - c:\documents and settings\Monika\Dane aplikacji\Mozilla\Firefox\Profiles\mtqsc3mx.default\ FF - prefs.js: browser.search.selectedEngine - DAEMON Search FF - plugin: c:\program files\Adobe\Acrobat 7.0\Reader\browser\nppdf32.dll FF - plugin: c:\program files\Java\jre6\bin\new_plugin\npdeploytk.dll FF - plugin: c:\program files\Java\jre6\bin\new_plugin\npjp2.dll FF - plugin: c:\program files\Mozilla Firefox\plugins\npdeploytk.dll FF - plugin: c:\program files\Yahoo!\Common\npyaxmpb.dll . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-12-14 18:44:55 Windows 5.1.2600 Dodatek Service Pack 3 NTFS skanowanie ukrytych procesów ... skanowanie ukrytych wpisów autostartu ... skanowanie ukrytych plików ... skanowanie pomyślnie ukończone ukryte pliki: 0 ************************************************************************** . Czas ukończenia: 2008-12-14 18:46:21 ComboFix-quarantined-files.txt 2008-12-14 18:45:17 Przed: 10 059 026 432 bajtów wolnych Po: 10,049,544,192 bajtów wolnych 204 --- E O F --- 2008-12-11 21:09:30

dodam jeszcze ze robie wszystkie scany w trybie awaryjnym ...
nie na administratorze ale na moim ``userze``
nie wiem czy to robi jakąś różnicę ...

**Posty:** 8001 · przez **Okocza** 14 Gru 2008, 21:37

przeskanuj na www.virustotal.com

Kod: Zaznacz wszystko: c:\windows\system32\Agent.OMZ.Fix.exe c:\windows\system32\B67796535D.sys c:\windows\system32\DAB99D55BF.sys

wstaw logi ze skanów

**Posty:** 24 · przez **Kamil636** 14 Gru 2008, 21:50

c:\windows\system32\Agent.OMZ.Fix.exe - tego nie ma ...

c:\windows\system32\B67796535D.sys

Kod: Zaznacz wszystko: Antywirus Wersja Ostatnia aktualizacja Wynik AhnLab-V3 2008.12.12.2 2008.12.14 - AntiVir 7.9.0.45 2008.12.14 - Authentium 5.1.0.4 2008.12.14 - Avast 4.8.1281.0 2008.12.14 - AVG 8.0.0.199 2008.12.14 - BitDefender 7.2 2008.12.14 - CAT-QuickHeal 10.00 2008.12.13 - ClamAV 0.94.1 2008.12.14 - Comodo 754 2008.12.14 - DrWeb 4.44.0.09170 2008.12.14 - eSafe 7.0.17.0 2008.12.14 - eTrust-Vet 31.6.6258 2008.12.12 - Ewido 4.0 2008.12.14 - F-Prot 4.4.4.56 2008.12.14 - F-Secure 8.0.14332.0 2008.12.14 - Fortinet 3.117.0.0 2008.12.14 - GData 19 2008.12.14 - Ikarus T3.1.1.45.0 2008.12.14 - K7AntiVirus 7.10.553 2008.12.13 - Kaspersky 7.0.0.125 2008.12.14 - McAfee 5463 2008.12.13 - McAfee+Artemis 5463 2008.12.13 - Microsoft 1.4205 2008.12.14 - NOD32 3691 2008.12.14 - Norman 5.80.02 2008.12.12 - Panda 9.0.0.4 2008.12.14 - PCTools 4.4.2.0 2008.12.14 - Prevx1 V2 2008.12.14 - Rising 21.07.62.00 2008.12.14 - SecureWeb-Gateway 6.7.6 2008.12.14 - Sophos 4.36.0 2008.12.14 - Sunbelt 3.2.1801.2 2008.12.11 - Symantec 10 2008.12.14 - TheHacker 6.3.1.4.187 2008.12.13 - TrendMicro 8.700.0.1004 2008.12.12 - VBA32 3.12.8.10 2008.12.14 - ViRobot 2008.12.12.1515 2008.12.12 - VirusBuster 4.5.11.0 2008.12.14 - Dodatkowe informacje File size: 88 bytes MD5...: 1c9e23e24cd1d4d713a5b68eead6eaff SHA1..: 0ae6fa3dd0a01f5cf44da25c206c1ac544e336e6 SHA256: 4bedd0eec14f660a594499bc68c4917a02bc2ab5bc88d94ee8dfd25af8467fef SHA512: 0b8c4c430f49770036a8806b2ddeca2cd6f02c867a56654bf9686d58ba028575 068968258073da92c974659a09b8ca8f9ede8e3c737e3956f9749ec63eca38c8 ssdeep: 3:hl/JgMlll/VipXu7n:K2ViWn PEiD..: - TrID..: File type identification MS Flight Simulator Aircraft Performance Info (100.0%) PEInfo: -

c:\windows\system32\DAB99D55BF.sys

Kod: Zaznacz wszystko: Antywirus Wersja Ostatnia aktualizacja Wynik AhnLab-V3 2008.12.12.2 2008.12.14 - AntiVir 7.9.0.45 2008.12.14 - Authentium 5.1.0.4 2008.12.14 - Avast 4.8.1281.0 2008.12.14 - AVG 8.0.0.199 2008.12.14 - BitDefender 7.2 2008.12.14 - CAT-QuickHeal 10.00 2008.12.13 - ClamAV 0.94.1 2008.12.14 - Comodo 754 2008.12.14 - DrWeb 4.44.0.09170 2008.12.14 - eSafe 7.0.17.0 2008.12.14 - eTrust-Vet 31.6.6258 2008.12.12 - Ewido 4.0 2008.12.14 - F-Prot 4.4.4.56 2008.12.14 - F-Secure 8.0.14332.0 2008.12.14 - Fortinet 3.117.0.0 2008.12.14 - GData 19 2008.12.14 - Ikarus T3.1.1.45.0 2008.12.14 - K7AntiVirus 7.10.553 2008.12.13 - Kaspersky 7.0.0.125 2008.12.14 - McAfee 5463 2008.12.13 - McAfee+Artemis 5463 2008.12.13 - Microsoft 1.4205 2008.12.14 - NOD32 3691 2008.12.14 - Norman 5.80.02 2008.12.12 - Panda 9.0.0.4 2008.12.14 - PCTools 4.4.2.0 2008.12.14 - Prevx1 V2 2008.12.14 - Rising 21.07.62.00 2008.12.14 - SecureWeb-Gateway 6.7.6 2008.12.14 - Sophos 4.36.0 2008.12.14 - Sunbelt 3.2.1801.2 2008.12.11 - Symantec 10 2008.12.14 - TheHacker 6.3.1.4.187 2008.12.13 - TrendMicro 8.700.0.1004 2008.12.12 - VBA32 3.12.8.10 2008.12.14 - ViRobot 2008.12.12.1514 2008.12.12 - VirusBuster 4.5.11.0 2008.12.14 - Dodatkowe informacje File size: 88 bytes MD5...: 1d9533f22bb7c5f71416a831519c28a7 SHA1..: 33a0aec88e98a9fa18d8dd8f9fe7a62c5dc3ec17 SHA256: 94e074829a5db5d4a64b94d1f2e0796059abeb3f76c274c361171cef6e602ed8 SHA512: 3a70123e27ed058f39bcc43952d9f5c59bd94e43fdf76001f396dc05c43ddcb4 c4a6325b7713d8414cf263d14e85a41e61ff80d0471cfcb43d2a5cc9f47ad67c ssdeep: 3:hl/X3P/tpKXrMOn:bXXzOn PEiD..: - TrID..: File type identification MS Flight Simulator Aircraft Performance Info (100.0%) PEInfo: -

**Posty:** 18165 · przez **wojtas** 14 Gru 2008, 22:32

1. Ściągnij OTMoveIt i go włacz i odpal go z opcji CleanUp

oraz skasuj folder C:\Qoobox
2. wykonaj optymalizację windowsa
3.sciagnij ATF_Cleaner
zaznacz
Windows Temp
All users Temp
Temporary internet files
Recycle Bin
i wcisnij EMPTY SELECTED
4.Wyłącz przywracanie systemu ( właściwości mój komputer-zakładka przywracanie - wyłącz przywracanie na wszystkich dyskach). Po chwili włącz je powrotem
5.Przeskanuj obszar mojego komputera http://www.kaspersky.pl/virusscanner.html (uruchom przez IE) Daj raport z niego na forum.

i tym:

FixIEDef.

**Posty:** 24 · przez **Kamil636** 15 Gru 2008, 00:29

kurde

jak wyłączyłem przywracanie systemu (w trybie awaryjnym)
to jak chciałem włączyć spowrotem ...to pisało że w awaryjnym sie nie da ...
włączyłem normalnie windowsa ... i jak chciałem zmienic już w normalnym trybie ...
to albo jak klikam w mój komputer ... właściwości to sie nie pokazuje albo jak klikam zastosuj to muli i stoi w miejscu ...
a za chwile że program nie odpowiada

... jak ja mam to spowrotem włączyć ?

PS ... Wojtas ... zrobiłem to co napisałeś ale nie pomogło

a kaspersky scanner też nic nie wykrył

pomocy ;( ~!!

Dodano Dzisiaj, 14:18:
sory że spamuje ... ale popatrzcie na to ...
http://wstaw.org/p/477/
to wyskoczyło mi ... jakieś 15 minut temu ...
co mam robić dalej ?
za ten program trzeba płacić ...

skanuje narazie avastem ... na trybie awaryjnym .. już kilka wykrył więc jest dobrze

Log z ComboFix ... chyba już wszystko wyczyściłem ...

Kod: Zaznacz wszystko: ComboFix 08-12-14.05 - Monika 2008-12-15 14:40:01.9 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.3.1250.1.1045.18.1007.599 [GMT 0:00] Uruchomiony z: c:\documents and settings\Monika\Pulpit\ComboFix.exe * Utworzono nowy punkt przywracania . ((((((((((((((((((((((((((((((((((((((( Usunięto ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\documents and settings\Monika\Ustawienia lokalne\Temporary Internet Files\fbk.sts c:\windows\system32\elivajev.dll c:\windows\system32\EOnXbccf.ini c:\windows\system32\EOnXbccf.ini2 c:\windows\system32\fccbXnOE.dll c:\windows\system32\lavarv.dll c:\windows\system32\mphnijgs.dll c:\windows\system32\nfhkguss.dll c:\windows\system32\nnnnKBsp.dll c:\windows\system32\pmnljJBT.dll c:\windows\system32\vejavile.ini . ((((((((((((((((((((((((( Pliki utworzone od 2008-11-15 do 2008-12-15 ))))))))))))))))))))))))))))))) . 2008-12-15 11:54 . 2008-12-15 11:54 34,816 --a------ c:\windows\system32\khfcstnf.dll.ren 2008-12-15 10:11 . 2008-12-15 10:52 <DIR> d-------- c:\program files\Spybot - Search & Destroy 2008-12-15 10:11 . 2008-12-15 10:52 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\Spybot - Search & Destroy 2008-12-14 22:32 . 2008-12-14 22:32 <DIR> d-------- C:\!FixIEDef 2008-12-14 20:32 . 2005-02-12 16:43 245,760 --a------ c:\windows\system32\vbalColumnTreeView6.ocx 2008-12-14 20:32 . 2003-01-26 14:41 40,960 --a------ c:\windows\system32\SSubTmr6.dll 2008-12-14 20:32 . 1998-03-18 17:45 8,096 --a------ c:\windows\system32\OLEGUIDS.TLB 2008-12-14 20:31 . 1999-08-02 17:11 57,344 --a------ c:\windows\system32\CGZipLibrary.DLL 2008-12-14 20:31 . 1999-03-12 02:20 18,728 --a------ c:\windows\system32\ISHF_Ex.tlb 2008-12-14 19:05 . 2008-12-12 00:57 78,336 --a------ c:\windows\system32\Agent.OMZ.Fix.exe 2008-12-13 19:45 . 2008-12-13 19:45 <DIR> d-------- c:\program files\Rockstar Games 2008-12-12 17:49 . 2008-12-12 17:50 <DIR> d-------- c:\program files\mp3DirectCut 2008-12-06 19:27 . 2008-12-06 19:27 <DIR> d-------- c:\windows\ERUNT 2008-12-06 19:27 . 2008-12-06 19:27 <DIR> d-------- C:\ERDNT 2008-12-06 17:53 . 2008-12-15 11:37 <DIR> d-------- c:\program files\Odkurzacz 2008-11-24 18:25 . 2008-11-24 18:25 <DIR> d-------- c:\program files\Common Files\Skype 2008-11-24 18:25 . 2008-11-24 18:25 56 --ah----- c:\windows\system32\ezsidmv.dat . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-12-15 14:15 --------- d-----w c:\program files\Spyware Terminator 2008-12-15 14:15 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\Spyware Terminator 2008-12-15 14:13 --------- d-----w c:\documents and settings\Monika\Dane aplikacji\Spyware Terminator 2008-12-15 08:28 --------- d-----w c:\program files\Mozilla Thunderbird 2008-12-14 17:27 --------- d-----w c:\program files\FlashGet 2008-12-14 17:27 --------- d-----w c:\program files\FaxTools 2008-12-14 17:27 --------- d-----w c:\program files\Codec Pack - All In 1 2008-12-14 17:24 --------- d-----w c:\documents and settings\Monika\Dane aplikacji\skypePM 2008-12-14 11:50 --------- d-----w c:\documents and settings\Monika\Dane aplikacji\Skype 2008-12-14 11:23 163,644 ----a-w c:\windows\system32\drivers\secdrv.sys 2008-12-11 17:34 --------- d-----w c:\documents and settings\Monika\Dane aplikacji\OpenOffice.ux.pl2 2008-12-06 18:06 --------- d-----w c:\program files\QuickTime 2008-12-06 18:06 --------- d-----w c:\program files\IrfanView 2008-12-06 18:06 --------- d-----w c:\program files\Call of Duty 2008-12-02 21:52 --------- d-----w c:\program files\Java 2008-11-28 19:21 --------- d-----w c:\program files\Gadu-Gadu 2008-11-24 18:25 --------- d-----w c:\program files\Skype 2008-11-08 20:18 --------- d-----w c:\documents and settings\Monika\Dane aplikacji\gtk-2.0 2008-11-04 20:03 --------- d-----w c:\program files\Yahoo! 2008-11-04 20:02 --------- d-----w c:\program files\DAEMON Tools Toolbar 2008-11-04 20:01 --------- d-----w c:\program files\Google 2008-11-04 20:00 --------- d-----w c:\program files\ContextProgram 2008-11-04 19:34 141,312 ----a-w c:\windows\system32\drivers\sp_rsdrv2.sys 2008-11-02 15:54 --------- d-----w c:\program files\Windows Live 2008-11-01 13:59 --------- d-----w c:\documents and settings\Administrator\Dane aplikacji\OpenOffice.ux.pl2 2008-10-31 20:49 --------- d-----w c:\program files\CCleaner 2008-10-31 20:21 --------- d-----w c:\documents and settings\Administrator\Dane aplikacji\Thunderbird 2008-10-31 20:21 --------- d-----w c:\documents and settings\Administrator\Dane aplikacji\Talkback 2008-10-31 16:04 --------- d-----w c:\documents and settings\Administrator\Dane aplikacji\Winamp 2008-10-30 20:32 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\NVIDIA 2008-10-29 10:44 --------- d-----w c:\program files\directx 2008-10-29 10:12 --------- d-----w c:\program files\iXi Tools 2008-10-27 13:39 --------- d-----w c:\program files\Microsoft CAPICOM 2.1.0.2 2008-10-26 19:03 --------- d-----w c:\program files\Microsoft SQL Server Compact Edition 2008-10-26 19:01 --------- dcsh--w c:\program files\Common Files\WindowsLiveInstaller 2008-10-26 18:59 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\WLInstaller 2008-10-26 13:52 --------- d-----w c:\program files\VstPlugins 2008-10-24 11:21 455,296 ----a-w c:\windows\system32\drivers\mrxsmb.sys 2008-10-17 17:49 --------- d-----w c:\program files\Lexmark 1200 Series 2007-12-15 15:41 32 ----a-w c:\documents and settings\All Users\Dane aplikacji\ezsid.dat 2008-08-27 09:37 88 --sh--r c:\windows\system32\B67796535D.sys 2007-09-25 20:32 88 -csh--r c:\windows\system32\DAB99D55BF.sys 2008-08-27 09:58 6,268 -csha-w c:\windows\system32\KGyGaAvL.sys . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360] "Gadu-Gadu"="c:\program files\Gadu-Gadu\gg.exe" [2007-07-09 2119104] "Odkurzacz-MCD"="c:\program files\Odkurzacz\odk_mcd.exe" [2008-08-16 264704] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-08-16 7630848] "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2006-08-16 86016] "LogitechCommunicationsManager"="c:\program files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe" [2007-02-08 488984] "avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2008-07-19 78008] "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2008-11-10 136600] "nwiz"="nwiz.exe" [2006-08-16 c:\windows\system32\nwiz.exe] c:\documents and settings\Administrator\Menu Start\Programy\Autostart\ OpenOffice.ux.pl 2.1.0.lnk - c:\program files\OpenOffice.ux.pl 2.1.0\program\quickstart.exe [2006-12-30 17408] c:\documents and settings\All Users\Menu Start\Programy\Autostart\ Belkin Wireless USB Utility.lnk - d:\program files\Belkin\USB F5D7050\Wireless Utility\Belkinwcui.exe [2005-10-28 1404928] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "msacm.l3codec"= l3codecp.acm [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Logitech Desktop Messenger.lnk] backup=c:\windows\pss\Logitech Desktop Messenger.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^Monika^Menu Start^Programy^Autostart^OpenOffice.ux.pl 2.1.0.lnk] backup=c:\windows\pss\OpenOffice.ux.pl 2.1.0.lnkStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Lexmark 1200 Series] --a------ 2006-07-13 05:33 57344 c:\program files\Lexmark 1200 Series\lxczbmgr.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechQuickCamRibbon] --a------ 2007-02-08 00:13 774168 c:\program files\Logitech\QuickCam10\QuickCam10.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] --a------ 2008-02-12 20:02 77824 c:\program files\QuickTime\qttask.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent] --a------ 2008-04-01 18:49 36352 c:\program files\Winamp\winampa.exe [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "c:\\Program Files\\Gadu-Gadu\\gg.exe"= "c:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe"= "c:\\WINDOWS\\system32\\dpvsetup.exe"= "c:\\Program Files\\FlashGet\\FlashGet.exe"= "c:\\Program Files\\Mozilla Firefox\\firefox.exe"= "c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"= "c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"= "c:\\Program Files\\Messenger\\msmsgs.exe"= "c:\\Program Files\\Skype\\Phone\\Skype.exe"= R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2008-11-04 78416] R1 sp_rsdrv2;Spyware Terminator Driver 2;\??\c:\windows\system32\drivers\sp_rsdrv2.sys [2008-11-04 141312] R2 aswFsBlk;aswFsBlk;c:\windows\system32\DRIVERS\aswFsBlk.sys [2008-11-04 20560] S3 PavSRK.sys;PavSRK.sys;\??\c:\windows\system32\PavSRK.sys [] S3 PavTPK.sys;PavTPK.sys;\??\c:\windows\system32\PavTPK.sys [] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{3482b442-b3e7-11dd-b809-001966000032}] \Shell\AutoRun\command - G:\InstallTomTomHOME.exe . Zawartość folderu 'Zaplanowane zadania' 2008-09-12 c:\windows\Tasks\Norton Security Scan.job - c:\program files\Norton Security Scan\Nss.exe [] . - - - - USUNIĘTO PUSTE WPISY - - - - BHO-{0fa3bb68-1cbf-4360-8bce-213b6cacd9ba} - c:\windows\system32\lavarv.dll BHO-{9DF408C9-4215-4897-94DD-CCD5D6ED87C2} - c:\windows\system32\fccbXnOE.dll Notify-khfCsTNF - khfCsTNF.dll . ------- Skan uzupełniający ------- . IE: &Download All with FlashGet - c:\progra~1\FlashGet\jc_all.htm IE: &Download with FlashGet - c:\progra~1\FlashGet\jc_link.htm Handler: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - c:\program files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll FF - ProfilePath - c:\documents and settings\Monika\Dane aplikacji\Mozilla\Firefox\Profiles\mtqsc3mx.default\ FF - plugin: c:\program files\Yahoo!\Common\npyaxmpb.dll . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-12-15 14:43:18 Windows 5.1.2600 Dodatek Service Pack 3 NTFS skanowanie ukrytych procesów ... skanowanie ukrytych wpisów autostartu ... skanowanie ukrytych plików ... skanowanie pomyślnie ukończone ukryte pliki: 0 ************************************************************************** . ------------------------ Pozostałe uruchomione procesy ------------------------ . c:\program files\Lavasoft\Ad-Aware\aawservice.exe c:\program files\Alwil Software\Avast4\aswUpdSv.exe c:\program files\Alwil Software\Avast4\ashServ.exe c:\windows\system32\LEXBCES.EXE c:\windows\system32\LEXPPS.EXE c:\program files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe c:\program files\Java\jre6\bin\jqs.exe c:\windows\system32\rundll32.exe c:\windows\system32\nvsvc32.exe c:\windows\system32\PSIService.exe c:\program files\Spyware Terminator\sp_rsser.exe c:\program files\Alwil Software\Avast4\ashMaiSv.exe c:\program files\Alwil Software\Avast4\ashWebSv.exe c:\windows\system32\wbem\wmiapsrv.exe c:\windows\system32\wscntfy.exe . ************************************************************************** . Czas ukończenia: 2008-12-15 14:45:56 - komputer został uruchomiony ponownie ComboFix-quarantined-files.txt 2008-12-15 14:45:52 Przed: 10 218 479 616 bajtów wolnych Po: 10,182,389,760 bajtów wolnych 193 --- E O F --- 2008-12-11 21:09:30

Log z Hijackthis

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 14:48:08, on 2008-12-15 Platform: Windows XP Dodatek SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16762) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\SYSTEM32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\system32\LEXBCES.EXE C:\WINDOWS\system32\LEXPPS.EXE C:\WINDOWS\system32\spoolsv.exe c:\program files\common files\logishrd\lvmvfm\LVPrcSrv.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\WINDOWS\system32\RUNDLL32.EXE C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\Program Files\Java\jre6\bin\jusched.exe C:\WINDOWS\system32\ctfmon.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\PSIService.exe C:\Program Files\Spyware Terminator\sp_rsser.exe D:\Program Files\Belkin\USB F5D7050\Wireless Utility\Belkinwcui.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\WINDOWS\system32\wbem\wmiapsrv.exe C:\WINDOWS\system32\wuauclt.exe C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\explorer.exe C:\WINDOWS\system32\notepad.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [LogitechCommunicationsManager] "C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe" O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe" O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - HKCU\..\Run: [Odkurzacz-MCD] C:\Program Files\Odkurzacz\odk_mcd.exe O4 - Global Startup: Belkin Wireless USB Utility.lnk = D:\Program Files\Belkin\USB F5D7050\Wireless Utility\Belkinwcui.exe O8 - Extra context menu item: &Download All with FlashGet - C:\PROGRA~1\FlashGet\jc_all.htm O8 - Extra context menu item: &Download with FlashGet - C:\PROGRA~1\FlashGet\jc_link.htm O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w2/resources/MSNPUpld.cab O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1174301425562 O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - c:\program files\common files\logishrd\lvmvfm\LVPrcSrv.exe O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\SrvLnch\SrvLnch.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: ProtexisLicensing - Unknown owner - C:\WINDOWS\system32\PSIService.exe O23 - Service: Spyware Terminator Realtime Shield Service (sp_rssrv) - Crawler.com - C:\Program Files\Spyware Terminator\sp_rsser.exe -- End of file - 5619 bytes

**Posty:** 18165 · przez **wojtas** 15 Gru 2008, 18:11

Wykonaj to co jest podane w tym temacie

Zastosuj SDFix . Po pobraniu uruchom go a rozpakuje się do C:\SDFix. Uruchom komputer w trybie awaryjnym (F8 przy stracie systemu). Będąc w awaryjnym uruchom plik RunThis.bat z folderu SDFixa. Zatwierdź czyszczenie przez Y. Poczekaj aż ukończy i komputer zresetuje

Potem wejdz do folderu C:\SDFix wrzuc zawartość pliku Report.txt + log z combofixa oraz daj loga z hijacka

**Posty:** 24 · przez **Kamil636** 15 Gru 2008, 18:55

ok ...
moge teraz usunąć te programy ?
czyli wwdc i SDfix i SeconfigXP ...

Report

Kod: Zaznacz wszystko: [b]SDFix: Version 1.240 [/b] Run by Monika on 2008-12-15 at 16:41 Microsoft Windows XP [Wersja 5.1.2600] Running From: C:\SDFix [b]Checking Services [/b]: Restoring Default Security Values Restoring Default Hosts File Rebooting [b]Checking Files [/b]: No Trojan Files Found Removing Temp Files [b]ADS Check [/b]: [b]Final Check [/b]: catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-12-15 16:44:52 Windows 5.1.2600 Dodatek Service Pack 3 NTFS scanning hidden processes ... scanning hidden services & system hive ... [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4] "p0"="C:\Program Files\DAEMON Tools Lite\" "h0"=dword:00000000 "khjeh"=hex:dd,5b,85,f6,8d,8f,1c,39,d4,9c,18,52,7e,35,3d,28,c3,0b,3d,5e,c7,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001] "a0"=hex:20,01,00,00,7f,08,a5,08,85,e7,cf,03,5b,2d,37,c0,41,b9,d0,f4,e1,.. "khjeh"=hex:7f,c4,10,81,72,b3,dd,c1,22,67,9c,86,de,47,e6,a6,f3,50,c1,ea,1e,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40] "khjeh"=hex:77,5c,a5,cd,76,66,42,a1,7c,20,32,b0,c0,f2,b5,df,67,b2,7b,5a,a8,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41] "khjeh"=hex:e2,9f,1d,83,ed,e7,54,ce,39,2f,a0,b1,79,57,79,1e,c3,bb,b6,78,7d,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4] "p0"="C:\Program Files\DAEMON Tools Lite\" "h0"=dword:00000000 "khjeh"=hex:dd,5b,85,f6,8d,8f,1c,39,d4,9c,18,52,7e,35,3d,28,c3,0b,3d,5e,c7,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001] "a0"=hex:20,01,00,00,7f,08,a5,08,85,e7,cf,03,5b,2d,37,c0,41,b9,d0,f4,e1,.. "khjeh"=hex:7f,c4,10,81,72,b3,dd,c1,22,67,9c,86,de,47,e6,a6,f3,50,c1,ea,1e,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40] "khjeh"=hex:e2,9f,1d,83,ed,e7,54,ce,39,2f,a0,b1,79,57,79,1e,c3,bb,b6,78,7d,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41] "khjeh"=hex:e2,9f,1d,83,ed,e7,54,ce,39,2f,a0,b1,79,57,79,1e,c3,bb,b6,78,7d,.. [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg] "s1"=dword:2df9c43f "s2"=dword:110480d0 "h0"=dword:00000001 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4] "p0"="C:\Program Files\DAEMON Tools Lite\" "h0"=dword:00000000 "khjeh"=hex:dd,5b,85,f6,8d,8f,1c,39,d4,9c,18,52,7e,35,3d,28,c3,0b,3d,5e,c7,.. [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001] "a0"=hex:20,01,00,00,7f,08,a5,08,85,e7,cf,03,5b,2d,37,c0,41,b9,d0,f4,e1,.. "khjeh"=hex:7f,c4,10,81,72,b3,dd,c1,22,67,9c,86,de,47,e6,a6,f3,50,c1,ea,1e,.. [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40] "khjeh"=hex:77,5c,a5,cd,76,66,42,a1,7c,20,32,b0,c0,f2,b5,df,67,b2,7b,5a,a8,.. [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41] "khjeh"=hex:e2,9f,1d,83,ed,e7,54,ce,39,2f,a0,b1,79,57,79,1e,c3,bb,b6,78,7d,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4] "p0"="C:\Program Files\DAEMON Tools Lite\" "h0"=dword:00000000 "khjeh"=hex:dd,5b,85,f6,8d,8f,1c,39,d4,9c,18,52,7e,35,3d,28,c3,0b,3d,5e,c7,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001] "a0"=hex:20,01,00,00,7f,08,a5,08,85,e7,cf,03,5b,2d,37,c0,41,b9,d0,f4,e1,.. "khjeh"=hex:7f,c4,10,81,72,b3,dd,c1,22,67,9c,86,de,47,e6,a6,f3,50,c1,ea,1e,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40] "khjeh"=hex:77,5c,a5,cd,76,66,42,a1,7c,20,32,b0,c0,f2,b5,df,67,b2,7b,5a,a8,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41] "khjeh"=hex:e2,9f,1d,83,ed,e7,54,ce,39,2f,a0,b1,79,57,79,1e,c3,bb,b6,78,7d,.. scanning hidden registry entries ... [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Prefetcher] "TracesProcessed"=dword:000000ae scanning hidden files ... scan completed successfully hidden processes: 0 hidden services: 0 hidden files: 0 [b]Remaining Services [/b]: Authorized Application Key Export: [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000" "C:\\Program Files\\Gadu-Gadu\\gg.exe"="C:\\Program Files\\Gadu-Gadu\\gg.exe:*:Enabled:Gadu-Gadu - program g˘wny" "C:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe"="C:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe:*:Enabled:Logitech Desktop Messenger" "C:\\WINDOWS\\system32\\dpvsetup.exe"="C:\\WINDOWS\\system32\\dpvsetup.exe:*:Enabled:Microsoft DirectPlay Voice Test" "C:\\Program Files\\FlashGet\\FlashGet.exe"="C:\\Program Files\\FlashGet\\FlashGet.exe:*:Enabled:Flashget" "C:\\Program Files\\Mozilla Firefox\\firefox.exe"="C:\\Program Files\\Mozilla Firefox\\firefox.exe:*:Enabled:Firefox" "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger" "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"="C:\\Program Files\\Windows Live\\Messenger\\livecall.exe:*:Enabled:Windows Live Messenger (Phone)" "C:\\Program Files\\Messenger\\msmsgs.exe"="C:\\Program Files\\Messenger\\msmsgs.exe:*:Enabled:Windows Messenger" "C:\\Program Files\\Skype\\Phone\\Skype.exe"="C:\\Program Files\\Skype\\Phone\\Skype.exe:*:Enabled:Skype. Take a deep breath " [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list] "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000" "C:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe"="C:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe:*:Enabled:Logitech Desktop Messenger" "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger" "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"="C:\\Program Files\\Windows Live\\Messenger\\livecall.exe:*:Enabled:Windows Live Messenger (Phone)" [b]Remaining Files [/b]: [b]Files with Hidden Attributes [/b]: Wed 27 Aug 2008 88 ..SHR --- "C:\WINDOWS\system32\B67796535D.sys" Tue 25 Sep 2007 88 ..SHR --- "C:\WINDOWS\system32\DAB99D55BF.sys" Wed 27 Aug 2008 6,268 A.SH. --- "C:\WINDOWS\system32\KGyGaAvL.sys" [b]Finished![/b]

HIjacktis

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 16:55:15, on 2008-12-15 Platform: Windows XP Dodatek SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16762) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\SYSTEM32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\LEXBCES.EXE C:\WINDOWS\system32\LEXPPS.EXE C:\WINDOWS\system32\spoolsv.exe c:\program files\common files\logishrd\lvmvfm\LVPrcSrv.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\PSIService.exe C:\Program Files\Spyware Terminator\sp_rsser.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\WINDOWS\system32\wbem\wmiapsrv.exe C:\WINDOWS\system32\RUNDLL32.EXE C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\Program Files\Java\jre6\bin\jusched.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Gadu-Gadu\gg.exe D:\Program Files\Belkin\USB F5D7050\Wireless Utility\Belkinwcui.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [LogitechCommunicationsManager] "C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe" O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe" O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe" O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - HKCU\..\Run: [Odkurzacz-MCD] C:\Program Files\Odkurzacz\odk_mcd.exe O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe O4 - Global Startup: Belkin Wireless USB Utility.lnk = D:\Program Files\Belkin\USB F5D7050\Wireless Utility\Belkinwcui.exe O8 - Extra context menu item: &Download All with FlashGet - C:\PROGRA~1\FlashGet\jc_all.htm O8 - Extra context menu item: &Download with FlashGet - C:\PROGRA~1\FlashGet\jc_link.htm O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w2/resources/MSNPUpld.cab O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1174301425562 O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - c:\program files\common files\logishrd\lvmvfm\LVPrcSrv.exe O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\SrvLnch\SrvLnch.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: ProtexisLicensing - Unknown owner - C:\WINDOWS\system32\PSIService.exe O23 - Service: Spyware Terminator Realtime Shield Service (sp_rssrv) - Crawler.com - C:\Program Files\Spyware Terminator\sp_rsser.exe -- End of file - 5900 bytes

Log z ComboFix

Kod: Zaznacz wszystko: ComboFix 08-12-14.05 - Monika 2008-12-15 16:56:43.10 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.3.1250.1.1045.18.1007.671 [GMT 0:00] Uruchomiony z: c:\documents and settings\Monika\Pulpit\ComboFix.exe . ((((((((((((((((((((((((( Pliki utworzone od 2008-11-15 do 2008-12-15 ))))))))))))))))))))))))))))))) . 2008-12-15 16:40 . 2008-12-15 16:40 580,096 --a--c--- c:\windows\system32\dllcache\user32.dll 2008-12-15 16:35 . 2008-12-15 16:46 <DIR> d-------- C:\SDFix 2008-12-15 15:53 . 2008-12-15 15:53 <DIR> d-------- c:\program files\Common Files\Adobe 2008-12-15 15:21 . 2008-12-15 15:21 32 --a------ c:\windows\VplayerINI.vpl 2008-12-15 15:10 . 2008-12-15 15:10 <DIR> d-------- c:\program files\Common Files\Wise Installation Wizard 2008-12-15 11:54 . 2008-12-15 11:54 34,816 --a------ c:\windows\system32\khfcstnf.dll.ren 2008-12-15 10:11 . 2008-12-15 16:13 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\Spybot - Search & Destroy 2008-12-14 20:32 . 2005-02-12 16:43 245,760 --a------ c:\windows\system32\vbalColumnTreeView6.ocx 2008-12-14 20:32 . 2003-01-26 14:41 40,960 --a------ c:\windows\system32\SSubTmr6.dll 2008-12-14 20:32 . 1998-03-18 17:45 8,096 --a------ c:\windows\system32\OLEGUIDS.TLB 2008-12-14 20:31 . 1999-08-02 17:11 57,344 --a------ c:\windows\system32\CGZipLibrary.DLL 2008-12-14 20:31 . 1999-03-12 02:20 18,728 --a------ c:\windows\system32\ISHF_Ex.tlb 2008-12-14 19:05 . 2008-12-12 00:57 78,336 --a------ c:\windows\system32\Agent.OMZ.Fix.exe 2008-12-13 19:45 . 2008-12-13 19:45 <DIR> d-------- c:\program files\Rockstar Games 2008-12-12 17:49 . 2008-12-12 17:50 <DIR> d-------- c:\program files\mp3DirectCut 2008-12-06 19:27 . 2008-12-15 16:39 <DIR> d-------- c:\windows\ERUNT 2008-12-06 17:53 . 2008-12-15 11:37 <DIR> d-------- c:\program files\Odkurzacz 2008-11-24 18:25 . 2008-11-24 18:25 <DIR> d-------- c:\program files\Common Files\Skype 2008-11-24 18:25 . 2008-11-24 18:25 56 --ah----- c:\windows\system32\ezsidmv.dat . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2060-08-18 17:02 1,496,064 -c----w c:\windows\system32\CC3250MT.DLL 2060-08-18 16:40 909,824 -c----w c:\windows\system32\cp3245mt.dll 2060-08-18 16:40 24,064 -c----w c:\windows\system32\borlndmm.dll 2008-12-15 16:18 --------- d-----w c:\program files\Mozilla Thunderbird 2008-12-15 15:25 --------- d-----w c:\program files\FlashGet 2008-12-15 15:25 --------- d-----w c:\program files\FaxTools 2008-12-15 15:25 --------- d-----w c:\program files\Codec Pack - All In 1 2008-12-15 15:06 --------- d-----w c:\documents and settings\Monika\Dane aplikacji\Spyware Terminator 2008-12-15 14:50 --------- d-----w c:\program files\Spyware Terminator 2008-12-15 14:15 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\Spyware Terminator 2008-12-14 17:24 --------- d-----w c:\documents and settings\Monika\Dane aplikacji\skypePM 2008-12-14 11:50 --------- d-----w c:\documents and settings\Monika\Dane aplikacji\Skype 2008-12-14 11:23 163,644 ----a-w c:\windows\system32\drivers\secdrv.sys 2008-12-11 17:34 --------- d-----w c:\documents and settings\Monika\Dane aplikacji\OpenOffice.ux.pl2 2008-12-06 18:06 --------- d-----w c:\program files\QuickTime 2008-12-06 18:06 --------- d-----w c:\program files\IrfanView 2008-12-02 21:52 --------- d-----w c:\program files\Java 2008-11-28 19:21 --------- d-----w c:\program files\Gadu-Gadu 2008-11-24 18:25 --------- d-----w c:\program files\Skype 2008-11-10 05:43 410,984 ----a-w c:\windows\system32\deploytk.dll 2008-11-08 20:18 --------- d-----w c:\documents and settings\Monika\Dane aplikacji\gtk-2.0 2008-11-04 20:03 --------- d-----w c:\program files\Yahoo! 2008-11-04 20:02 --------- d-----w c:\program files\DAEMON Tools Toolbar 2008-11-04 20:01 --------- d-----w c:\program files\Google 2008-11-04 20:00 --------- d-----w c:\program files\ContextProgram 2008-11-04 19:34 141,312 ----a-w c:\windows\system32\drivers\sp_rsdrv2.sys 2008-11-02 15:54 --------- d-----w c:\program files\Windows Live 2008-11-01 13:59 --------- d-----w c:\documents and settings\Administrator\Dane aplikacji\OpenOffice.ux.pl2 2008-10-31 20:49 --------- d-----w c:\program files\CCleaner 2008-10-31 20:21 --------- d-----w c:\documents and settings\Administrator\Dane aplikacji\Thunderbird 2008-10-31 20:21 --------- d-----w c:\documents and settings\Administrator\Dane aplikacji\Talkback 2008-10-31 16:04 --------- d-----w c:\documents and settings\Administrator\Dane aplikacji\Winamp 2008-10-30 20:32 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\NVIDIA 2008-10-29 10:44 --------- d-----w c:\program files\directx 2008-10-29 10:12 --------- d-----w c:\program files\iXi Tools 2008-10-27 13:39 --------- d-----w c:\program files\Microsoft CAPICOM 2.1.0.2 2008-10-26 19:03 --------- d-----w c:\program files\Microsoft SQL Server Compact Edition 2008-10-26 19:01 --------- dcsh--w c:\program files\Common Files\WindowsLiveInstaller 2008-10-26 18:59 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\WLInstaller 2008-10-26 13:52 --------- d-----w c:\program files\VstPlugins 2008-10-24 11:21 455,296 ----a-w c:\windows\system32\drivers\mrxsmb.sys 2008-10-23 12:42 286,720 ----a-w c:\windows\system32\gdi32.dll 2008-10-17 17:49 --------- d-----w c:\program files\Lexmark 1200 Series 2008-10-16 20:33 826,368 ----a-w c:\windows\system32\wininet.dll 2008-10-16 14:13 202,776 ----a-w c:\windows\system32\wuweb.dll 2008-10-16 14:13 1,809,944 ----a-w c:\windows\system32\wuaueng.dll 2008-10-16 14:12 561,688 ----a-w c:\windows\system32\wuapi.dll 2008-10-16 14:12 323,608 ----a-w c:\windows\system32\wucltui.dll 2008-10-16 14:09 92,696 ----a-w c:\windows\system32\cdm.dll 2008-10-16 14:09 51,224 ----a-w c:\windows\system32\wuauclt.exe 2008-10-16 14:09 43,544 ----a-w c:\windows\system32\wups2.dll 2008-10-16 14:08 34,328 ----a-w c:\windows\system32\wups.dll 2008-10-16 14:06 268,648 ----a-w c:\windows\system32\mucltui.dll 2008-10-16 14:06 208,744 ----a-w c:\windows\system32\muweb.dll 2008-10-03 10:04 247,326 ----a-w c:\windows\system32\strmdll.dll 2008-09-30 16:43 1,286,152 ----a-w c:\windows\system32\msxml4.dll 2008-09-15 15:27 1,846,656 ----a-w c:\windows\system32\win32k.sys 2007-12-15 15:41 32 ----a-w c:\documents and settings\All Users\Dane aplikacji\ezsid.dat 2008-08-27 09:37 88 --sh--r c:\windows\system32\B67796535D.sys 2007-09-25 20:32 88 -csh--r c:\windows\system32\DAB99D55BF.sys 2008-08-27 09:58 6,268 -csha-w c:\windows\system32\KGyGaAvL.sys . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360] "Gadu-Gadu"="c:\program files\Gadu-Gadu\gg.exe" [2007-07-09 2119104] "Odkurzacz-MCD"="c:\program files\Odkurzacz\odk_mcd.exe" [2008-08-16 264704] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-08-16 7630848] "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2006-08-16 86016] "LogitechCommunicationsManager"="c:\program files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe" [2007-02-08 488984] "avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2008-07-19 78008] "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2008-11-10 136600] "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672] "nwiz"="nwiz.exe" [2006-08-16 c:\windows\system32\nwiz.exe] c:\documents and settings\Administrator\Menu Start\Programy\Autostart\ OpenOffice.ux.pl 2.1.0.lnk - c:\program files\OpenOffice.ux.pl 2.1.0\program\quickstart.exe [2006-12-30 17408] c:\documents and settings\All Users\Menu Start\Programy\Autostart\ Belkin Wireless USB Utility.lnk - d:\program files\Belkin\USB F5D7050\Wireless Utility\Belkinwcui.exe [2005-10-28 1404928] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "msacm.l3codec"= l3codecp.acm [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Logitech Desktop Messenger.lnk] backup=c:\windows\pss\Logitech Desktop Messenger.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^Monika^Menu Start^Programy^Autostart^OpenOffice.ux.pl 2.1.0.lnk] backup=c:\windows\pss\OpenOffice.ux.pl 2.1.0.lnkStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Lexmark 1200 Series] --a------ 2006-07-13 05:33 57344 c:\program files\Lexmark 1200 Series\lxczbmgr.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechQuickCamRibbon] --a------ 2007-02-08 00:13 774168 c:\program files\Logitech\QuickCam10\QuickCam10.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] --a------ 2008-02-12 20:02 77824 c:\program files\QuickTime\qttask.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent] --a------ 2008-04-01 18:49 36352 c:\program files\Winamp\winampa.exe [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "c:\\Program Files\\Gadu-Gadu\\gg.exe"= "c:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe"= "c:\\WINDOWS\\system32\\dpvsetup.exe"= "c:\\Program Files\\FlashGet\\FlashGet.exe"= "c:\\Program Files\\Mozilla Firefox\\firefox.exe"= "c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"= "c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"= "c:\\Program Files\\Messenger\\msmsgs.exe"= "c:\\Program Files\\Skype\\Phone\\Skype.exe"= R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2008-11-04 78416] R1 sp_rsdrv2;Spyware Terminator Driver 2;\??\c:\windows\system32\drivers\sp_rsdrv2.sys [2008-11-04 141312] R2 aswFsBlk;aswFsBlk;c:\windows\system32\DRIVERS\aswFsBlk.sys [2008-11-04 20560] S3 PavSRK.sys;PavSRK.sys;\??\c:\windows\system32\PavSRK.sys [] S3 PavTPK.sys;PavTPK.sys;\??\c:\windows\system32\PavTPK.sys [] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{3482b442-b3e7-11dd-b809-001966000032}] \Shell\AutoRun\command - G:\InstallTomTomHOME.exe . Zawartość folderu 'Zaplanowane zadania' 2008-09-12 c:\windows\Tasks\Norton Security Scan.job - c:\program files\Norton Security Scan\Nss.exe [] . - - - - USUNIĘTO PUSTE WPISY - - - - HKCU-Run-SpybotSD TeaTimer - c:\program files\Spybot - Search & Destroy\TeaTimer.exe . ------- Skan uzupełniający ------- . IE: &Download All with FlashGet - c:\progra~1\FlashGet\jc_all.htm IE: &Download with FlashGet - c:\progra~1\FlashGet\jc_link.htm Handler: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - c:\program files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll FF - ProfilePath - c:\documents and settings\Monika\Dane aplikacji\Mozilla\Firefox\Profiles\mtqsc3mx.default\ FF - plugin: c:\program files\Yahoo!\Common\npyaxmpb.dll . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-12-15 16:57:37 Windows 5.1.2600 Dodatek Service Pack 3 NTFS skanowanie ukrytych procesów ... skanowanie ukrytych wpisów autostartu ... skanowanie ukrytych plików ... skanowanie pomyślnie ukończone ukryte pliki: 0 ************************************************************************** . Czas ukończenia: 2008-12-15 16:58:29 ComboFix-quarantined-files.txt 2008-12-15 16:58:10 Przed: 9 769 603 072 bajtów wolnych Po: 9,753,153,536 bajtów wolnych 175 --- E O F --- 2008-12-11 21:09:30

**Posty:** 18165 · przez **wojtas** 15 Gru 2008, 22:03

przeskanuj ten plik jeszcze:

c:\windows\system32\khfcstnf.dll.ren

tymi skanerami i daj raport