
C:\!KillBox
C:\VundoFix Backups
skasuj to i bedzie oK
Arek7777 napisał(a):jak to skasuje to bede mógł uzywać kill boxa ?
Arek7777 napisał(a):potem jest trzykrotne zachrobotanie chyba dysku i potem
wojtas19162 napisał(a):Arek7777 napisał(a):potem jest trzykrotne zachrobotanie chyba dysku i potem
wydaje mi sie ze to dysk mam na mysli głowice na dysku
ComboFix 07-04-22.6V - Running from: "C:\Documents and Settings\Arek\Pulpit"
((((((((((((((((((((((((((((((( Files Created from 2007-03-23 to 2007-04-23 ))))))))))))))))))))))))))))))))))
2007-04-23 21:16 <DIR> d--hs---- C:\FOUND.002
2007-04-23 20:08 <DIR> d-------- C:\WINDOWS\SoftwareDistribution
2007-04-23 15:59 49,152 --a------ C:\WINDOWS\nircmd.exe
2007-04-23 15:16 <DIR> d-------- C:\!KillBox
2007-04-23 10:13 <DIR> d--hs---- C:\FOUND.001
2007-04-23 09:27 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\Spybot - Search & Destroy
2007-04-22 19:18 <DIR> d-------- C:\Program Files\Lavasoft
2007-04-22 19:18 <DIR> d-------- C:\DOCUME~1\Arek\DANEAP~1\Lavasoft
2007-04-22 19:17 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2007-04-12 19:18 <DIR> d--hs---- C:\FOUND.000
2007-04-10 10:49 <DIR> d-------- C:\DOCUME~1\Arek\DANEAP~1\Ahead
2007-04-10 10:46 569,344 -ra------ C:\WINDOWS\system32\imagr5.dll
2007-04-10 10:46 544,768 -ra------ C:\WINDOWS\system32\imagx5.dll
2007-04-10 10:46 38,912 -ra------ C:\WINDOWS\system32\picn20.dll
2007-04-10 10:46 283,920 -ra------ C:\WINDOWS\system32\ImagXpr5.dll
2007-04-10 10:46 155,648 -ra------ C:\WINDOWS\system32\NeroCheck.exe
2007-04-10 10:46 <DIR> d-------- C:\Program Files\Common Files\Ahead
2007-04-10 10:46 <DIR> d-------- C:\Program Files\Ahead
2007-04-03 20:16 <DIR> d-------- C:\Program Files\SopCast
2007-04-03 20:16 <DIR> d-------- C:\DOCUME~1\Arek\DANEAP~1\SopCast
2007-03-24 15:37 <DIR> d-------- C:\Program Files\Common Files\NSV
(((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))))
2007-04-23 20:52 49492 --a------ C:\WINDOWS\system32\perfc015.dat
2007-04-23 20:52 355486 --a------ C:\WINDOWS\system32\perfh015.dat
2007-03-20 16:17 4 --a------ C:\WINDOWS\system32\proc-1262580707.bin
2007-03-08 21:48 -------- d-------- C:\Program Files\yahoo!
2007-01-18 21:02 62 --ahs---- C:\DOCUME~1\Arek\DANEAP~1\desktop.ini
(((((((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))
*Note* empty entries & legit default entries are not shown
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects]
{02478D38-C3F9-4EFB-9B51-7695ECA05670} C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
{53707962-6F74-2D53-2644-206D7942484F} C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
{761497BB-D6F0-462C-B6EB-D4DAF1D92D43} C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run]
"avgnt"=""C:\\Program Files\\AntiVir PersonalEdition Classic\\avgnt.exe" /min"
"SunJavaUpdateSched"=""C:\\Program Files\\Java\\jre1.5.0_10\\bin\\jusched.exe""
"NvCplDaemon"="RUNDLL32.EXE C:\\WINDOWS\\System32\\NvCpl.dll,NvStartup"
"nwiz"="nwiz.exe /install"
"Cmaudio"="RunDll32 cmicnfg.cpl,CMICtrlWnd"
"NeroFilterCheck"="C:\\WINDOWS\\system32\\NeroCheck.exe"
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run]
"CTFMON.EXE"="C:\\WINDOWS\\System32\\ctfmon.exe"
"NvMediaCenter"="RUNDLL32.EXE C:\\WINDOWS\\System32\\NVMCTRAY.DLL,NvTaskbarInit"
"Gadu-Gadu"=""C:\\Program Files\\Gadu-Gadu\\gg.exe" /tray"
"MSMSGS"=""C:\\Program Files\\Messenger\\msmsgs.exe" /background"
HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa
Authentication Packages REG_MULTI_SZ msv1_0\0\0
Security Packages REG_MULTI_SZ kerberos\0msv1_0\0schannel\0wdigest\0\0
Notification Packages REG_MULTI_SZ scecli\0\0
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Svchost]
LocalService REG_MULTI_SZ Alerter\0WebClient\0LmHosts\0RemoteRegistry\0upnphost\0SSDPSRV\0\0
NetworkService REG_MULTI_SZ DnsCache\0\0
rpcss REG_MULTI_SZ RpcSs\0\0
imgsvc REG_MULTI_SZ StiSvc\0\0
termsvcs REG_MULTI_SZ TermService\0\0
********************************************************************
catchme 0.3.660 W2K/XP/Vista - userland rootkit detector by Gmer, http://www.gmer.net
Rootkit scan 2007-04-23 21:24:17
Windows 5.1.2600 FAT
scanning hidden processes ...
scanning hidden services ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0
********************************************************************
Completion time: 07-04-23 21:24:20
C:\ComboFix-quarantined-files.txt ... 07-04-23 21:24
C:\ComboFix3.txt ... 07-04-23 17:11
C:\ComboFix2.txt ... 07-04-23 21:06
Arek7777 napisał(a):C:\!KillBox
prog napisał(a):Arek7777 napisał(a):C:\!KillBox
Usuń ręcznie, chociaż myślę, że to nie jest jakoś uber-szkodliwe.
Kod:
Logfile of HijackThis v1.99.1
Scan saved at 14:54:21, on 2007-04-25
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe
C:\WINDOWS\System32\ctfmon.exe
C:\WINDOWS\System32\RUNDLL32.EXE
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\internet explorer\iexplore.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Documents and Settings\Arek\Pulpit\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.onet.pl/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NVMCTRAY.DLL,NvTaskbarInit
O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1177351724122
O16 - DPF: {68282C51-9459-467B-95BF-3C0E89627E55} (MksSkanerOnline Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab
O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C5} (GameDesire Snooker) - http://67.15.101.3/g_bin/pl/snooker_2_0_0_31.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{4F842359-9D63-4915-A4C9-1EC4993E6138}: NameServer = 194.204.159.1,194.204.152.34
O17 - HKLM\System\CS1\Services\Tcpip\..\{4F842359-9D63-4915-A4C9-1EC4993E6138}: NameServer = 194.204.159.1,194.204.152.34
O17 - HKLM\System\CS2\Services\Tcpip\..\{4F842359-9D63-4915-A4C9-1EC4993E6138}: NameServer = 194.204.159.1,194.204.152.34
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - AVIRA GmbH - C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
ComboFix 07-04-22.6V - Running from: "C:\Documents and Settings\Arek\Pulpit\"
((((((((((((((((((((((((((((((( Files Created from 2007-03-25 to 2007-04-25 ))))))))))))))))))))))))))))))))))
2007-04-24 15:07 <DIR> d-------- C:\Program Files\Lavalys
2007-04-24 12:59 <DIR> d--hs---- C:\FOUND.004
2007-04-24 12:35 <DIR> d--hs---- C:\FOUND.003
2007-04-23 21:16 <DIR> d--hs---- C:\FOUND.002
2007-04-23 20:08 <DIR> d-------- C:\WINDOWS\SoftwareDistribution
2007-04-23 15:59 49,152 --a------ C:\WINDOWS\nircmd.exe
2007-04-23 10:13 <DIR> d--hs---- C:\FOUND.001
2007-04-23 09:27 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\Spybot - Search & Destroy
2007-04-22 19:18 <DIR> d-------- C:\Program Files\Lavasoft
2007-04-22 19:18 <DIR> d-------- C:\DOCUME~1\Arek\DANEAP~1\Lavasoft
2007-04-22 19:17 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2007-04-12 19:18 <DIR> d--hs---- C:\FOUND.000
2007-04-10 10:49 <DIR> d-------- C:\DOCUME~1\Arek\DANEAP~1\Ahead
2007-04-10 10:46 569,344 -ra------ C:\WINDOWS\system32\imagr5.dll
2007-04-10 10:46 544,768 -ra------ C:\WINDOWS\system32\imagx5.dll
2007-04-10 10:46 38,912 -ra------ C:\WINDOWS\system32\picn20.dll
2007-04-10 10:46 283,920 -ra------ C:\WINDOWS\system32\ImagXpr5.dll
2007-04-10 10:46 155,648 -ra------ C:\WINDOWS\system32\NeroCheck.exe
2007-04-10 10:46 <DIR> d-------- C:\Program Files\Common Files\Ahead
2007-04-10 10:46 <DIR> d-------- C:\Program Files\Ahead
2007-04-03 20:16 <DIR> d-------- C:\Program Files\SopCast
2007-04-03 20:16 <DIR> d-------- C:\DOCUME~1\Arek\DANEAP~1\SopCast
(((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))))
2007-04-23 20:52 49492 --a------ C:\WINDOWS\system32\perfc015.dat
2007-04-23 20:52 355486 --a------ C:\WINDOWS\system32\perfh015.dat
2007-03-20 16:17 4 --a------ C:\WINDOWS\system32\proc-1262580707.bin
2007-03-08 21:48 -------- d-------- C:\Program Files\yahoo!
2007-01-18 21:02 62 --ahs---- C:\DOCUME~1\Arek\DANEAP~1\desktop.ini
(((((((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))
*Note* empty entries & legit default entries are not shown
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects]
{02478D38-C3F9-4EFB-9B51-7695ECA05670} C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
{53707962-6F74-2D53-2644-206D7942484F} C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
{761497BB-D6F0-462C-B6EB-D4DAF1D92D43} C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run]
"avgnt"="\"C:\\Program Files\\AntiVir PersonalEdition Classic\\avgnt.exe\" /min"
"SunJavaUpdateSched"="\"C:\\Program Files\\Java\\jre1.5.0_10\\bin\\jusched.exe\""
"NvCplDaemon"="RUNDLL32.EXE C:\\WINDOWS\\System32\\NvCpl.dll,NvStartup"
"nwiz"="nwiz.exe /install"
"Cmaudio"="RunDll32 cmicnfg.cpl,CMICtrlWnd"
"NeroFilterCheck"="C:\\WINDOWS\\system32\\NeroCheck.exe"
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run]
"CTFMON.EXE"="C:\\WINDOWS\\System32\\ctfmon.exe"
"NvMediaCenter"="RUNDLL32.EXE C:\\WINDOWS\\System32\\NVMCTRAY.DLL,NvTaskbarInit"
"Gadu-Gadu"="\"C:\\Program Files\\Gadu-Gadu\\gg.exe\" /tray"
"MSMSGS"="\"C:\\Program Files\\Messenger\\msmsgs.exe\" /background"
HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa
Authentication Packages REG_MULTI_SZ msv1_0\0\0
Security Packages REG_MULTI_SZ kerberos\0msv1_0\0schannel\0wdigest\0\0
Notification Packages REG_MULTI_SZ scecli\0\0
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Svchost]
LocalService REG_MULTI_SZ Alerter\0WebClient\0LmHosts\0RemoteRegistry\0upnphost\0SSDPSRV\0\0
NetworkService REG_MULTI_SZ DnsCache\0\0
rpcss REG_MULTI_SZ RpcSs\0\0
imgsvc REG_MULTI_SZ StiSvc\0\0
termsvcs REG_MULTI_SZ TermService\0\0
********************************************************************
catchme 0.3.660 W2K/XP/Vista - userland rootkit detector by Gmer, http://www.gmer.net
Rootkit scan 2007-04-25 15:02:16
Windows 5.1.2600 FAT
scanning hidden processes ...
scanning hidden services ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0
********************************************************************
Completion time: 07-04-25 15:02:19
C:\ComboFix-quarantined-files.txt ... 07-04-25 15:02
C:\ComboFix3.txt ... 07-04-23 21:06
C:\ComboFix2.txt ... 07-04-23 21:24
prog napisał(a):Bo siedzą w folderach punktów przywracania systemu i jak wyłączysz i włączysz je to te foldery się opróżniają.
Logfile of HijackThis v1.99.1
Scan saved at 11:00:15, on 2000-05-06
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe
C:\WINDOWS\System32\ctfmon.exe
C:\WINDOWS\System32\RUNDLL32.EXE
C:\Program Files\Gadu-Gadu\gg.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\Lavasoft\Ad-Aware SE Personal\Ad-Aware.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Documents and Settings\Arek\Pulpit\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.wp.pl/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0 CE\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O2 - BHO: (no name) - {e5bd5c7b-ea71-4301-922a-141582bd9dab} - C:\WINDOWS\system32\msvspc.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NVMCTRAY.DLL,NvTaskbarInit
O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1177351724122
O16 - DPF: {68282C51-9459-467B-95BF-3C0E89627E55} (MksSkanerOnline Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab
O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C5} (GameDesire Snooker) - http://67.15.101.3/g_bin/pl/snooker_2_0_0_31.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{4F842359-9D63-4915-A4C9-1EC4993E6138}: NameServer = 194.204.159.1,194.204.152.34
O17 - HKLM\System\CS1\Services\Tcpip\..\{4F842359-9D63-4915-A4C9-1EC4993E6138}: NameServer = 194.204.159.1,194.204.152.34
O17 - HKLM\System\CS2\Services\Tcpip\..\{4F842359-9D63-4915-A4C9-1EC4993E6138}: NameServer = 194.204.159.1,194.204.152.34
O20 - Winlogon Notify: msvspc - C:\WINDOWS\SYSTEM32\msvspc.dll
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - AVIRA GmbH - C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
ComboFix 07-04-22.6V - Running from: "C:\Documents and Settings\Arek\Pulpit\"
((((((((((((((((((((((((((((((( Files Created from 2000-04-06 to 2000-05-06 ))))))))))))))))))))))))))))))))))
2000-05-03 21:22 21,895 --a------ C:\WINDOWS\system32\msvspc.dll
2000-05-02 10:49 <DIR> d-------- C:\WINDOWS\Cache
(((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))))
2007-01-19 12:24 163644 --a------ C:\WINDOWS\system32\drivers\secdrv.sys
2006-08-25 04:47 36528 --------- C:\WINDOWS\system32\drivers\PxHelp20.sys
2006-08-25 04:47 2560 --------- C:\WINDOWS\system32\drivers\cdralw2k.sys
2006-08-25 04:47 2432 --------- C:\WINDOWS\system32\drivers\cdr4_xp.sys
2005-12-15 13:57 1368000 --a------ C:\WINDOWS\system32\drivers\cmuda.sys
2005-01-28 13:44 18944 --a------ C:\WINDOWS\system32\drivers\wpdusb.sys
2004-07-09 04:27 48512 --a------ C:\WINDOWS\system32\drivers\stream.sys
2003-10-06 15:16 1550043 --a------ C:\WINDOWS\system32\drivers\nv4_mini.sys
2002-12-12 00:14 7424 --a------ C:\WINDOWS\system32\drivers\mskssrv.sys
2002-12-12 00:14 5504 --a------ C:\WINDOWS\system32\drivers\mstee.sys
2002-12-12 00:14 5248 --a------ C:\WINDOWS\system32\drivers\mspclock.sys
2002-12-12 00:14 4096 --a------ C:\WINDOWS\system32\drivers\swenum.sys
2002-12-12 00:14 130304 --a------ C:\WINDOWS\system32\drivers\ks.sys
2001-10-26 18:03 76288 --a------ C:\WINDOWS\system32\drivers\parport.sys
2001-10-26 18:03 62208 --a------ C:\WINDOWS\system32\drivers\mf.sys
2001-10-26 18:03 58112 --a------ C:\WINDOWS\system32\drivers\vdmindvd.sys
2001-10-26 18:03 56960 --a------ C:\WINDOWS\system32\drivers\nic1394.sys
2001-10-26 18:03 54016 --a------ C:\WINDOWS\system32\drivers\arp1394.sys
2001-10-26 18:03 51712 --a------ C:\WINDOWS\system32\drivers\tosdvd.sys
2001-10-26 18:03 37376 --a------ C:\WINDOWS\system32\drivers\p3.sys
2001-10-26 18:03 34560 --a------ C:\WINDOWS\system32\drivers\amdk6.sys
2001-10-26 18:03 33920 --a------ C:\WINDOWS\system32\drivers\crusoe.sys
2001-10-26 18:03 33152 --a------ C:\WINDOWS\system32\drivers\processr.sys
2001-10-26 18:03 28928 --a------ C:\WINDOWS\system32\drivers\modem.sys
2001-10-26 18:03 262528 --a------ C:\WINDOWS\system32\drivers\cinemst2.sys
2001-10-26 18:03 24064 --a------ C:\WINDOWS\system32\drivers\sonydcam.sys
2001-10-26 18:03 23936 --a------ C:\WINDOWS\system32\drivers\usbcamd2.sys
2001-10-26 18:03 23808 --a------ C:\WINDOWS\system32\drivers\usbcamd.sys
2001-10-26 18:03 22272 --a------ C:\WINDOWS\system32\drivers\mouclass.sys
2001-10-26 18:03 21376 --a------ C:\WINDOWS\system32\drivers\tsbvcap.sys
2001-10-26 18:03 18688 --a------ C:\WINDOWS\system32\drivers\cdaudio.sys
2001-10-26 18:03 15104 --a------ C:\WINDOWS\system32\drivers\usbintel.sys
2001-10-26 18:03 12288 --a------ C:\WINDOWS\system32\drivers\fsvga.sys
2001-10-26 18:03 12160 --a------ C:\WINDOWS\system32\drivers\ndisuio.sys
2001-10-26 18:03 12032 --a------ C:\WINDOWS\system32\drivers\riodrv.sys
2001-10-26 18:03 12032 --a------ C:\WINDOWS\system32\drivers\rio8drv.sys
2001-10-26 18:03 12032 --a------ C:\WINDOWS\system32\drivers\nikedrv.sys
2001-10-26 18:03 11776 --a------ C:\WINDOWS\system32\drivers\cpqdap01.sys
2001-10-26 17:46 70400 --a------ C:\WINDOWS\system32\drivers\sr.sys
2001-10-26 17:06 51712 --a------ C:\WINDOWS\system32\drivers\i8042prt.sys
2001-10-26 17:05 63232 --a------ C:\WINDOWS\system32\drivers\serial.sys
2001-10-26 17:02 57088 --a------ C:\WINDOWS\system32\drivers\redbook.sys
2001-10-26 16:59 125568 --a------ C:\WINDOWS\system32\drivers\ftdisk.sys
2001-10-26 16:58 35072 --a------ C:\WINDOWS\system32\drivers\fips.sys
2001-10-26 16:57 49664 --a------ C:\WINDOWS\system32\drivers\volsnap.sys
2001-10-26 16:56 62848 --a------ C:\WINDOWS\system32\drivers\pci.sys
2001-10-26 16:56 3456 --a------ C:\WINDOWS\system32\drivers\pciide.sys
2001-10-26 16:56 116480 --a------ C:\WINDOWS\system32\drivers\pcmcia.sys
2001-10-26 16:55 6912 --a------ C:\WINDOWS\system32\drivers\parvdm.sys
2001-10-26 16:48 23808 --a------ C:\WINDOWS\system32\drivers\kbdclass.sys
2001-10-26 16:47 36224 --a------ C:\WINDOWS\system32\drivers\isapnp.sys
2001-10-26 16:46 781184 --a------ C:\WINDOWS\system32\drivers\dmboot.sys
2001-10-26 16:46 179968 --a------ C:\WINDOWS\system32\drivers\acpi.sys
2001-10-26 16:46 146816 --a------ C:\WINDOWS\system32\drivers\dmio.sys
2001-10-26 16:46 12032 --a------ C:\WINDOWS\system32\drivers\acpiec.sys
2001-10-11 07:51 61312 -ra------ C:\WINDOWS\system32\drivers\sis7012.sys
2001-09-28 04:52 27008 --a------ C:\WINDOWS\system32\drivers\SISAGP.SYS
2001-08-23 05:00 4608 --a------ C:\WINDOWS\system32\drivers\mspqm.sys
2001-08-23 05:00 10496 --a------ C:\WINDOWS\system32\drivers\dxapi.sys
2001-08-18 07:38 20232 --a------ C:\WINDOWS\system32\drivers\tdtcp.sys
2001-08-18 07:38 11144 --a------ C:\WINDOWS\system32\drivers\tdpipe.sys
2001-08-18 07:38 107912 --a------ C:\WINDOWS\system32\drivers\rdpwd.sys
2001-08-18 06:38 37896 --a------ C:\WINDOWS\system32\drivers\termdd.sys
2001-08-18 06:24 88320 --a------ C:\WINDOWS\system32\drivers\ndiswan.sys
2001-08-18 06:24 79616 --a------ C:\WINDOWS\system32\drivers\wdmaud.sys
2001-08-18 06:24 62208 --a------ C:\WINDOWS\system32\drivers\cdfs.sys
2001-08-18 06:24 57472 --a------ C:\WINDOWS\system32\drivers\sysaudio.sys
2001-08-18 06:24 56064 --a------ C:\WINDOWS\system32\drivers\ipsec.sys
2001-08-18 06:24 533504 --a------ C:\WINDOWS\system32\drivers\ntfs.sys
2001-08-18 06:24 48640 --a------ C:\WINDOWS\system32\drivers\rasl2tp.sys
2001-08-18 06:24 46464 --a------ C:\WINDOWS\system32\drivers\raspptp.sys
2001-08-18 06:24 44928 --a------ C:\WINDOWS\system32\drivers\classpnp.sys
2001-08-18 06:24 407680 --a------ C:\WINDOWS\system32\drivers\mrxsmb.sys
2001-08-18 06:24 330368 --a------ C:\WINDOWS\system32\drivers\srv.sys
2001-08-18 06:24 327168 --a------ C:\WINDOWS\system32\drivers\tcpip.sys
2001-08-18 06:24 18688 --a------ C:\WINDOWS\system32\drivers\partmgr.sys
2001-08-18 06:24 163840 --a------ C:\WINDOWS\system32\drivers\rdbss.sys
2001-08-18 06:24 161536 --a------ C:\WINDOWS\system32\drivers\ndis.sys
2001-08-18 06:24 150272 --a------ C:\WINDOWS\system32\drivers\netbt.sys
2001-08-18 06:24 144768 --a------ C:\WINDOWS\system32\drivers\fastfat.sys
2001-08-18 06:24 137088 --a------ C:\WINDOWS\system32\drivers\update.sys
2001-08-18 06:24 135040 --a------ C:\WINDOWS\system32\drivers\portcls.sys
2001-08-18 06:24 130688 --a------ C:\WINDOWS\system32\drivers\afd.sys
2001-08-18 06:24 103936 --a------ C:\WINDOWS\system32\drivers\mup.sys
2001-08-17 22:55 68224 --a------ C:\WINDOWS\system32\drivers\dxg.sys
2001-08-17 22:51 10496 --a------ C:\WINDOWS\system32\drivers\irenum.sys
2001-08-17 22:07 4352 --a------ C:\WINDOWS\system32\drivers\wmilib.sys
2001-08-17 22:03 50688 --a------ C:\WINDOWS\system32\drivers\usbhub.sys
2001-08-17 22:03 4736 --a------ C:\WINDOWS\system32\drivers\usbd.sys
2001-08-17 22:03 15616 --a------ C:\WINDOWS\system32\drivers\usbohci.sys
2001-08-17 22:03 123264 --a------ C:\WINDOWS\system32\drivers\usbport.sys
2001-08-17 22:02 9728 --a------ C:\WINDOWS\system32\drivers\gameenum.sys
2001-08-17 22:02 33152 --a------ C:\WINDOWS\system32\drivers\hidclass.sys
2001-08-17 22:02 23680 --a------ C:\WINDOWS\system32\drivers\hidparse.sys
2001-08-17 22:01 57344 --a------ C:\WINDOWS\system32\drivers\drmk.sys
2001-08-17 22:01 2816 --a------ C:\WINDOWS\system32\drivers\drmkaud.sys
2001-08-17 22:00 5632 --a------ C:\WINDOWS\system32\drivers\splitter.sys
2001-08-17 22:00 54272 --a------ C:\WINDOWS\system32\drivers\swmidi.sys
2001-08-17 22:00 2944 --a------ C:\WINDOWS\system32\drivers\msmpu401.sys
2001-08-17 22:00 159232 --a------ C:\WINDOWS\system32\drivers\kmixer.sys
2001-08-17 21:59 50048 --a------ C:\WINDOWS\system32\drivers\DMusic.sys
2001-08-17 21:59 3072 --a------ C:\WINDOWS\system32\drivers\audstub.sys
2001-08-17 21:58 5888 --a------ C:\WINDOWS\system32\drivers\dmload.sys
2001-08-17 21:57 65024 --a------ C:\WINDOWS\system32\drivers\videoprt.sys
2001-08-17 21:57 5888 --a------ C:\WINDOWS\system32\drivers\rootmdm.sys
2001-08-17 21:57 4224 --a------ C:\WINDOWS\system32\drivers\mnmdd.sys
2001-08-17 21:57 3456 --a------ C:\WINDOWS\system32\drivers\oprghdlr.sys
2001-08-17 21:57 19584 --a------ C:\WINDOWS\system32\drivers\vga.sys
2001-08-17 21:57 180032 --a------ C:\WINDOWS\system32\drivers\tcpip6.sys
2001-08-17 21:57 16256 --a------ C:\WINDOWS\system32\drivers\tdi.sys
2001-08-17 21:55 9600 --a------ C:\WINDOWS\system32\drivers\ndistapi.sys
2001-08-17 21:55 8832 --a------ C:\WINDOWS\system32\drivers\rasacd.sys
2001-08-17 21:55 76288 --a------ C:\WINDOWS\system32\drivers\ipnat.sys
2001-08-17 21:55 38912 --a------ C:\WINDOWS\system32\drivers\raspppoe.sys
2001-08-17 21:55 38016 --a------ C:\WINDOWS\system32\drivers\ndproxy.sys
2001-08-17 21:55 33280 --a------ C:\WINDOWS\system32\drivers\wanarp.sys
2001-08-17 21:55 32896 --a------ C:\WINDOWS\system32\drivers\ipfltdrv.sys
2001-08-17 21:55 19584 --a------ C:\WINDOWS\system32\drivers\ipinip.sys
2001-08-17 21:55 16512 --a------ C:\WINDOWS\system32\drivers\raspti.sys
2001-08-17 21:55 13568 --a------ C:\WINDOWS\system32\drivers\asyncmac.sys
2001-08-17 21:55 12032 --a------ C:\WINDOWS\system32\drivers\ws2ifsl.sys
2001-08-17 21:54 84864 --a------ C:\WINDOWS\system32\drivers\nwlnkipx.sys
2001-08-17 21:54 65920 --a------ C:\WINDOWS\system32\drivers\psched.sys
2001-08-17 21:54 63232 --a------ C:\WINDOWS\system32\drivers\nwlnknb.sys
2001-08-17 21:54 55936 --a------ C:\WINDOWS\system32\drivers\nwlnkspx.sys
2001-08-17 21:54 33792 --a------ C:\WINDOWS\system32\drivers\msgpc.sys
2001-08-17 21:54 33152 --a------ C:\WINDOWS\system32\drivers\netbios.sys
2001-08-17 21:54 32512 --a------ C:\WINDOWS\system32\drivers\nwlnkfwd.sys
2001-08-17 21:54 27648 --a------ C:\WINDOWS\system32\drivers\rndismp.sys
2001-08-17 21:54 12416 --a------ C:\WINDOWS\system32\drivers\nwlnkflt.sys
2001-08-17 21:54 11136 --a------ C:\WINDOWS\system32\drivers\usb8023.sys
2001-08-17 21:53 39296 --a------ C:\WINDOWS\system32\drivers\imapi.sys
2001-08-17 21:53 3328 --a------ C:\WINDOWS\system32\drivers\dxgthk.sys
2001-08-17 21:53 155648 --a------ C:\WINDOWS\system32\drivers\nwrdr.sys
2001-08-17 21:52 7680 --a------ C:\WINDOWS\system32\drivers\mcd.sys
2001-08-17 21:52 47488 --a------ C:\WINDOWS\system32\drivers\cdrom.sys
2001-08-17 21:52 33664 --a------ C:\WINDOWS\system32\drivers\disk.sys
2001-08-17 21:52 200064 --a------ C:\WINDOWS\system32\drivers\RMCast.sys
2001-08-17 21:52 13952 --a------ C:\WINDOWS\system32\drivers\cbidf2k.sys
2001-08-17 21:52 13696 --a------ C:\WINDOWS\system32\drivers\tape.sys
2001-08-17 21:52 13184 --a------ C:\WINDOWS\system32\drivers\diskdump.sys
2001-08-17 21:52 10496 --a------ C:\WINDOWS\system32\drivers\sfloppy.sys
2001-08-17 21:51 89984 --a------ C:\WINDOWS\system32\drivers\scsiport.sys
2001-08-17 21:51 86656 --a------ C:\WINDOWS\system32\drivers\atapi.sys
2001-08-17 21:51 26240 --a------ C:\WINDOWS\system32\drivers\fdc.sys
2001-08-17 21:51 23680 --a------ C:\WINDOWS\system32\drivers\pciidex.sys
2001-08-17 21:51 19712 --a------ C:\WINDOWS\system32\drivers\flpydisk.sys
2001-08-17 21:50 79744 --a------ C:\WINDOWS\system32\drivers\ksecdd.sys
2001-08-17 21:50 53376 --a------ C:\WINDOWS\system32\drivers\bridge.sys
2001-08-17 21:50 29568 --a------ C:\WINDOWS\system32\drivers\npfs.sys
2001-08-17 21:50 181632 --a------ C:\WINDOWS\system32\drivers\rdpdr.sys
2001-08-17 21:50 18048 --a------ C:\WINDOWS\system32\drivers\msfs.sys
2001-08-17 21:50 172672 --a------ C:\WINDOWS\system32\drivers\mrxdav.sys
2001-08-17 21:50 14976 --a------ C:\WINDOWS\system32\drivers\serenum.sys
2001-08-17 21:50 14592 --a------ C:\WINDOWS\system32\drivers\smclib.sys
2001-08-17 21:49 7936 --a------ C:\WINDOWS\system32\drivers\fs_rec.sys
2001-08-17 21:49 63872 --a------ C:\WINDOWS\system32\drivers\udfs.sys
2001-08-17 21:49 37760 --a------ C:\WINDOWS\system32\drivers\nmnt.sys
2001-08-17 21:49 17792 --a------ C:\WINDOWS\system32\drivers\ptilink.sys
2001-08-17 21:47 4224 --a------ C:\WINDOWS\system32\drivers\beep.sys
2001-08-17 21:47 37504 --a------ C:\WINDOWS\system32\drivers\mountmgr.sys
2001-08-17 21:47 352256 --a------ C:\WINDOWS\system32\drivers\atmuni.sys
2001-08-17 21:47 2944 --a------ C:\WINDOWS\system32\drivers\null.sys
2001-08-17 21:46 66944 --a------ C:\WINDOWS\system32\drivers\mqac.sys
2001-08-17 21:46 57216 --a------ C:\WINDOWS\system32\drivers\atmarpc.sys
2001-08-17 21:46 53888 --a------ C:\WINDOWS\system32\drivers\atmlane.sys
2001-08-17 21:46 4224 --a------ C:\WINDOWS\system32\drivers\rdpcdd.sys
2001-08-17 21:46 34432 --a------ C:\WINDOWS\system32\drivers\rawwan.sys
2001-08-17 21:46 31360 --a------ C:\WINDOWS\system32\drivers\atmepvc.sys
2001-08-17 20:12 31232 --a------ C:\WINDOWS\system32\drivers\sisnic.sys
2001-08-17 20:12 23070 --a------ C:\WINDOWS\system32\drivers\RTL8139.sys
2001-07-24 01:25 122472 --a------ C:\WINDOWS\system32\drivers\aec.sys
2000-04-15 13:31 5561 --a------ C:\WINDOWS\system32\instfunc.dll
(((((((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))
*Note* empty entries & legit default entries are not shown
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects]
{02478D38-C3F9-4EFB-9B51-7695ECA05670} C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} C:\Program Files\Adobe\Acrobat 6.0 CE\Reader\ActiveX\AcroIEHelper.dll
{53707962-6F74-2D53-2644-206D7942484F} C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
{761497BB-D6F0-462C-B6EB-D4DAF1D92D43} C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
{e5bd5c7b-ea71-4301-922a-141582bd9dab} C:\WINDOWS\system32\msvspc.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run]
"avgnt"="\"C:\\Program Files\\AntiVir PersonalEdition Classic\\avgnt.exe\" /min"
"SunJavaUpdateSched"="\"C:\\Program Files\\Java\\jre1.5.0_10\\bin\\jusched.exe\""
"NvCplDaemon"="RUNDLL32.EXE C:\\WINDOWS\\System32\\NvCpl.dll,NvStartup"
"nwiz"="nwiz.exe /install"
"Cmaudio"="RunDll32 cmicnfg.cpl,CMICtrlWnd"
"NeroFilterCheck"="C:\\WINDOWS\\system32\\NeroCheck.exe"
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run]
"CTFMON.EXE"="C:\\WINDOWS\\System32\\ctfmon.exe"
"NvMediaCenter"="RUNDLL32.EXE C:\\WINDOWS\\System32\\NVMCTRAY.DLL,NvTaskbarInit"
"Gadu-Gadu"="\"C:\\Program Files\\Gadu-Gadu\\gg.exe\" /tray"
"MSMSGS"="\"C:\\Program Files\\Messenger\\msmsgs.exe\" /background"
HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\msvspc
HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa
Authentication Packages REG_MULTI_SZ msv1_0\0\0
Security Packages REG_MULTI_SZ kerberos\0msv1_0\0schannel\0wdigest\0\0
Notification Packages REG_MULTI_SZ scecli\0\0
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Svchost]
LocalService REG_MULTI_SZ Alerter\0WebClient\0LmHosts\0RemoteRegistry\0upnphost\0SSDPSRV\0\0
NetworkService REG_MULTI_SZ DnsCache\0\0
rpcss REG_MULTI_SZ RpcSs\0\0
imgsvc REG_MULTI_SZ StiSvc\0\0
termsvcs REG_MULTI_SZ TermService\0\0
********************************************************************
catchme 0.3.660 W2K/XP/Vista - userland rootkit detector by Gmer, http://www.gmer.net
Rootkit scan 2000-05-06 11:05:13
Windows 5.1.2600 FAT
scanning hidden processes ...
scanning hidden services ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0
********************************************************************
Completion time: 00-05-06 11:05:16
C:\ComboFix-quarantined-files.txt ... 00-05-06 11:05
C:\ComboFix3.txt ... 07-04-23 21:24
C:\ComboFix2.txt ... 07-04-25 15:02
wojtas19162 napisał(a):zastosuj:
smitfraudfix z opcji 2:
http://siri.urz.free.fr/Fix/SmitfraudFix_En.php
oraz te skanery po kilka razy w awaryjnym
VundoFix
http://www.atribune.org/ccount/click.php?id=4
VirtumundoBeGone
http://secured2k.home.comcast.net/tools/VirtumundoBeGone.exe
FixVundo
http://securityresponse.symantec.com/avcenter/FixVundo.exe
Użytkownicy przeglądający to forum: Brak zarejestrowanych użytkowników oraz 8 gości