komp sie muli

**Posty:** 20 · przez **mietek158** 27 Lip 2007, 01:26

raz już wstawiłem log ,ale ktoś zablokował temat , przeczytałem regulamin i mam nadzieje że wszystko jest ok

Kod: Zaznacz wszystko: Logfile of HijackThis v1.99.1 Scan saved at 14:02:44, on 2007-07-28 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe C:\Program Files\AntiVir PersonalEdition Classic\sched.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\system32\WgaTray.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe C:\WINDOWS\SOUNDMAN.EXE C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Internet Explorer\iexplore.exe D:\Nowy folder\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://onet.pl/ R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: Microsoft Configuration - {40205287-E793-41AC-B95C-D8D064BA33CA} - C:\WINDOWS\system32\mscfg.dll (file missing) O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O2 - BHO: (no name) - {E3280496-2AF9-DE84-A8B0-C8916158435F} - C:\DOCUME~1\JANKOW~1\DANEAP~1\FORDFL~1\batsize.exe (file missing) O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe" O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd O4 - HKLM\..\Run: [SmartSync - ScheduleSync] C:\PROGRA~1\MOBILE~1\SMARTS~1\SCHEDU~1.EXE O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [avgnt] "C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe" /min O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [IDLEDRAW] C:\DOCUME~1\JANKOW~1\DANEAP~1\BALLDE~1\helpadminmove.exe O4 - Startup: Mobile Phone Manager.lnk = C:\Program Files\Mobile Phone Manager\bin\Mobile Phone Manager.exe O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Control Panel present O8 - Extra context menu item: &Clean Traces - C:\Program Files\DAP\Privacy Package\dapcleanerie.htm O8 - Extra context menu item: &Download with &DAP - C:\Program Files\DAP\dapextie.htm O8 - Extra context menu item: Download &all with DAP - C:\Program Files\DAP\dapextie2.htm O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O8 - Extra context menu item: Pobierz wszystko z Free Download Manager - file://C:\Program Files\Free Download Manager\dlall.htm O8 - Extra context menu item: Pobierz z Free Download Manager - file://C:\Program Files\Free Download Manager\dllink.htm O8 - Extra context menu item: Pobierz zaznaczenie z Free Download Manager - file://C:\Program Files\Free Download Manager\dlselected.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: RaptisoftGameLoader - http://www.miniclip.com/haphazard/raptisoftgameloader.cab O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://downloads.ewido.net/ewidoOnlineScan.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{0F3DEFA0-4DA0-4662-AB48-4B4C570CE33B}: NameServer = 80.240.162.70 80.240.162.114 O17 - HKLM\System\CS1\Services\Tcpip\..\{0F3DEFA0-4DA0-4662-AB48-4B4C570CE33B}: NameServer = 80.240.162.70 80.240.162.114 O17 - HKLM\System\CS2\Services\Tcpip\..\{0F3DEFA0-4DA0-4662-AB48-4B4C570CE33B}: NameServer = 80.240.162.70 80.240.162.114 O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll O20 - Winlogon Notify: wineyx32 - wineyx32.dll (file missing) O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\sched.exe O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe

**Posty:** 18165 · przez **wojtas** 28 Lip 2007, 20:55

skasuj te wpisy + pogrubione do kosza wywal:

O2 - BHO: Microsoft Configuration - {40205287-E793-41AC-B95C-D8D064BA33CA} - C:\WINDOWS\system32\mscfg.dll (file missing)
O2 - BHO: (no name) - {E3280496-2AF9-DE84-A8B0-C8916158435F} - C:\DOCUME~1\JANKOW~1\DANEAP~1\FORDFL~1\batsize.exe (file missing)
O4 - HKCU\..\Run: [IDLEDRAW] C:\DOCUME~1\JANKOW~1\DANEAP~1\BALLDE~1\helpadminmove.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O20 - Winlogon Notify: wineyx32 - wineyx32.dll (file missing)

**Posty:** 20 · przez **mietek158** 28 Lip 2007, 21:01

co znaczy + pogrubione do kosza wywal, chodzi Ci o BALLDE~1 ? co mam z tym zrobić

**Posty:** 18165 · przez **wojtas** 28 Lip 2007, 21:04

mietek158 napisał(a):co mam z tym zrobić

znalesc i wywalic do kosza

tak tego systemowego

**Posty:** 20 · przez **mietek158** 28 Lip 2007, 21:42

Kod: Zaznacz wszystko: Logfile of HijackThis v1.99.1 Scan saved at 21:37:23, on 2007-07-28 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe C:\Program Files\AntiVir PersonalEdition Classic\sched.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\system32\WgaTray.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe C:\WINDOWS\SOUNDMAN.EXE C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe C:\WINDOWS\system32\ctfmon.exe C:\WINDOWS\system32\taskmgr.exe C:\Program Files\Internet Explorer\iexplore.exe D:\Nowy folder\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://onet.pl/ R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe" O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd O4 - HKLM\..\Run: [SmartSync - ScheduleSync] C:\PROGRA~1\MOBILE~1\SMARTS~1\SCHEDU~1.EXE O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [avgnt] "C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe" /min O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - Startup: Mobile Phone Manager.lnk = C:\Program Files\Mobile Phone Manager\bin\Mobile Phone Manager.exe O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O8 - Extra context menu item: &Clean Traces - C:\Program Files\DAP\Privacy Package\dapcleanerie.htm O8 - Extra context menu item: &Download with &DAP - C:\Program Files\DAP\dapextie.htm O8 - Extra context menu item: Download &all with DAP - C:\Program Files\DAP\dapextie2.htm O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O8 - Extra context menu item: Pobierz wszystko z Free Download Manager - file://C:\Program Files\Free Download Manager\dlall.htm O8 - Extra context menu item: Pobierz z Free Download Manager - file://C:\Program Files\Free Download Manager\dllink.htm O8 - Extra context menu item: Pobierz zaznaczenie z Free Download Manager - file://C:\Program Files\Free Download Manager\dlselected.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: RaptisoftGameLoader - http://www.miniclip.com/haphazard/raptisoftgameloader.cab O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://downloads.ewido.net/ewidoOnlineScan.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{0F3DEFA0-4DA0-4662-AB48-4B4C570CE33B}: NameServer = 80.240.162.70 80.240.162.114 O17 - HKLM\System\CS1\Services\Tcpip\..\{0F3DEFA0-4DA0-4662-AB48-4B4C570CE33B}: NameServer = 80.240.162.70 80.240.162.114 O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\sched.exe O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe

tego pliku co go miałem do kosza usunąąć to nie mogę znależć

**Posty:** 18165 · przez **wojtas** 28 Lip 2007, 21:47

daj loga z combofixa

**Posty:** 20 · przez **mietek158** 28 Lip 2007, 22:17

Kod: Zaznacz wszystko: C:\Program Files\Common Files\{583EC~1 C:\Program Files\inetget2 C:\Program Files\ipwins C:\Program Files\ipwins\Uninst.exe C:\WINDOWS\system32\components C:\WINDOWS\system32\components\flx0.dll C:\WINDOWS\system32\components\flx1.dll C:\WINDOWS\system32\components\flx10.dll C:\WINDOWS\system32\components\flx2.dll C:\WINDOWS\system32\components\flx3.dll C:\WINDOWS\system32\components\flx4.dll C:\WINDOWS\system32\components\flx5.dll C:\WINDOWS\system32\components\flx6.dll C:\WINDOWS\system32\components\flx7.dll C:\WINDOWS\system32\components\flx8.dll C:\WINDOWS\system32\components\flx9.dll ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) -------\LEGACY_WINDOWS_LOG ((((((((((((((((((((((((( Files Created from 2007-06-28 to 2007-07-28 ))))))))))))))))))))))))))))))) 2007-07-28 21:53 51,200 --a------ C:\WINDOWS\nircmd.exe 2007-07-28 20:18 <DIR> d-------- C:\Program Files\Grupa33 2007-07-28 11:10 <DIR> d--hs---- C:\found.004 2007-07-26 12:40 27,008 --a------ C:\WINDOWS\system32\drivers\siusbmod.sys 2007-07-26 12:38 <DIR> d-------- C:\Program Files\Mobile Phone Manager 2007-07-26 12:38 <DIR> d-------- C:\Program Files\Common Files\XCPCSync.OEM 2007-07-25 16:34 <DIR> d--hs---- C:\found.003 2007-07-22 23:58 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\AntiVir PersonalEdition Classic 2007-07-17 18:54 <DIR> d-------- C:\DOCUME~1\JANKOW~1\DANEAP~1\XCPCSync.OEM 2007-07-17 18:50 89,360 --a------ C:\WINDOWS\system32\VB5DB.DLL 2007-07-17 18:11 <DIR> d-------- C:\Program Files\WMV9_VCM 2007-07-03 20:22 <DIR> d-------- C:\Program Files\sXe Injected 2007-07-02 21:04 <DIR> d--hs---- C:\found.002 (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) 2007-07-28 18:23:51 -------- d-----w C:\Program Files\Zylom Games 2007-07-26 10:41:01 -------- d--h--w C:\Program Files\InstallShield Installation Information 2007-07-25 11:16:29 -------- d-----w C:\Program Files\Winamp 2007-07-20 18:08:37 644,324 --sha-w C:\WINDOWS\system32\drivers\fidbox.idx 2007-07-20 18:08:37 0 --sha-w C:\WINDOWS\system32\drivers\fidbox.dat 2007-07-19 18:20:52 -------- d-----w C:\Program Files\MobTime Cell Phone Manager 2007-07-15 17:34:22 -------- d-----w C:\Program Files\Valve 2007-07-07 11:12:26 -------- d-----w C:\DOCUME~1\JANKOW~1\DANEAP~1\BearShare 2007-06-18 22:14:04 -------- d-----w C:\Program Files\Gadu-Gadu 2007-06-18 19:05:17 -------- d-----w C:\DOCUME~1\JANKOW~1\DANEAP~1\Gadu-Gadu 2007-06-18 19:01:52 -------- d-----w C:\Program Files\eMule0.46c 2007-06-15 11:23:35 482,358 ----a-w C:\WINDOWS\system32\perfh015.dat 2007-06-15 11:23:35 216,988 ----a-w C:\WINDOWS\system32\perfc015.dat 2007-06-13 13:47:43 -------- d-----w C:\Program Files\EA GAMES 2006-10-20 21:28:00 91,856 ----a-w C:\DOCUME~1\JANKOW~1\DANEAP~1\errorsafefreeinstall_pl[1].exe ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe" [2007-03-14 03:43] "Cmaudio"="cmicnfg.cpl" [] "SmartSync - ScheduleSync"="C:\PROGRA~1\MOBILE~1\SMARTS~1\SCHEDU~1.EXE" [2006-03-30 16:49] "SpeedTouch USB Diagnostics"="C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" [2004-03-23 13:06] "SoundMan"="SOUNDMAN.EXE" [2006-11-17 06:42 C:\WINDOWS\soundman.exe] "avgnt"="C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe" [2007-04-02 10:35] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 02:44] C:\Documents and Settings\Jankowska Cecylia\Menu Start\Programy\Autostart\ Mobile Phone Manager.lnk - C:\Program Files\Mobile Phone Manager\bin\Mobile Phone Manager.exe [2006-05-24 12:27:22] C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\ Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 23:05:26]

Chciałbym jeszcze dodac że czasami komp nagle spowalnia mogę jedynie ruszać myszką słychać wtedy dziwny dźwiek coś jak przy restarcie , trwa ok. 1sec. czasmi powtarza się to seriami

**Posty:** 18165 · przez **wojtas** 28 Lip 2007, 22:54

log jest uciety wklej caly

**Posty:** 20 · przez **mietek158** 29 Lip 2007, 14:57

Kod: Zaznacz wszystko: catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-07-28 22:06:14 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... scanning hidden registry entries ... [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\A\1\5\1c] "Order"=hex:08,00,00,00,02,00,00,00,b8,01,00,00,01,00,00,00,04,00,00,00,8c,.. scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** Completion time: 2007-07-28 22:10:19 - machine was rebooted C:\ComboFix-quarantined-files.txt ... 2007-07-28 22:09 --- E O F ---

Kod: Zaznacz wszystko: 2006-09-05 19:13 34718 --a------ C:\Qoobox\Quarantine\C\Program Files\ipwins\Uninst.exe.vir 2006-10-07 18:49 0 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\components\flx0.dll.vir 2006-10-15 09:38 0 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\components\flx1.dll.vir 2006-10-15 09:49 0 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\components\flx2.dll.vir 2006-10-15 09:55 0 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\components\flx3.dll.vir 2006-10-15 10:23 0 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\components\flx4.dll.vir 2006-10-15 10:30 0 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\components\flx5.dll.vir 2006-10-15 10:58 0 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\components\flx6.dll.vir 2006-10-15 11:04 0 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\components\flx7.dll.vir 2006-10-15 11:33 0 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\components\flx8.dll.vir 2006-10-15 11:39 0 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\components\flx9.dll.vir 2006-10-15 11:52 0 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\components\flx10.dll.vir 2007-07-28 21:59 830 --a------ C:\Qoobox\Quarantine\Registry_backups\LEGACY_WINDOWS_LOG.reg.cf Zmienna PATH folderu Numer seryjny woluminu: 583E-C804 C:\QOOBOX \---Quarantine +---C | +---Program Files | | \---ipwins | | Uninst.exe.vir | | | \---WINDOWS | \---system32 | \---components | flx0.dll.vir | flx1.dll.vir | flx10.dll.vir | flx2.dll.vir | flx3.dll.vir | flx4.dll.vir | flx5.dll.vir | flx6.dll.vir | flx7.dll.vir | flx8.dll.vir | flx9.dll.vir | \---Registry_backups LEGACY_WINDOWS_LOG.reg.cf

**Posty:** 18165 · przez **wojtas** 29 Lip 2007, 15:01

mietek158 wklej caly nowy log jesli nie nie miesci wrzuc na www.rapidshare.com

**Posty:** 20 · przez **mietek158** 29 Lip 2007, 18:13

Kod: Zaznacz wszystko: "Jankowska Cecylia" - 2007-07-29 17:59:33 - ComboFix 07-07-23.6 - Dodatek Service Pack 2 NTFS ((((((((((((((((((((((((( Files Created from 2007-06-28 to 2007-07-29 ))))))))))))))))))))))))))))))) 2007-07-28 21:53 51,200 --a------ C:\WINDOWS\nircmd.exe 2007-07-28 20:18 <DIR> d-------- C:\Program Files\Grupa33 2007-07-28 11:10 <DIR> d--hs---- C:\found.004 2007-07-26 12:40 27,008 --a------ C:\WINDOWS\system32\drivers\siusbmod.sys 2007-07-26 12:38 <DIR> d-------- C:\Program Files\Mobile Phone Manager 2007-07-26 12:38 <DIR> d-------- C:\Program Files\Common Files\XCPCSync.OEM 2007-07-25 16:34 <DIR> d--hs---- C:\found.003 2007-07-22 23:58 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\AntiVir PersonalEdition Classic 2007-07-17 18:54 <DIR> d-------- C:\DOCUME~1\JANKOW~1\DANEAP~1\XCPCSync.OEM 2007-07-17 18:50 89,360 --a------ C:\WINDOWS\system32\VB5DB.DLL 2007-07-17 18:11 <DIR> d-------- C:\Program Files\WMV9_VCM 2007-07-03 20:22 <DIR> d-------- C:\Program Files\sXe Injected 2007-07-02 21:04 <DIR> d--hs---- C:\found.002 (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) 2007-07-28 18:23:51 -------- d-----w C:\Program Files\Zylom Games 2007-07-26 10:41:01 -------- d--h--w C:\Program Files\InstallShield Installation Information 2007-07-25 11:16:29 -------- d-----w C:\Program Files\Winamp 2007-07-20 18:08:37 644,324 --sha-w C:\WINDOWS\system32\drivers\fidbox.idx 2007-07-20 18:08:37 0 --sha-w C:\WINDOWS\system32\drivers\fidbox.dat 2007-07-19 18:20:52 -------- d-----w C:\Program Files\MobTime Cell Phone Manager 2007-07-15 17:34:22 -------- d-----w C:\Program Files\Valve 2007-07-07 11:12:26 -------- d-----w C:\DOCUME~1\JANKOW~1\DANEAP~1\BearShare 2007-06-18 22:14:04 -------- d-----w C:\Program Files\Gadu-Gadu 2007-06-18 19:05:17 -------- d-----w C:\DOCUME~1\JANKOW~1\DANEAP~1\Gadu-Gadu 2007-06-18 19:01:52 -------- d-----w C:\Program Files\eMule0.46c 2007-06-15 11:23:35 482,358 ----a-w C:\WINDOWS\system32\perfh015.dat 2007-06-15 11:23:35 216,988 ----a-w C:\WINDOWS\system32\perfc015.dat 2007-06-13 13:47:43 -------- d-----w C:\Program Files\EA GAMES 2006-10-20 21:28:00 91,856 ----a-w C:\DOCUME~1\JANKOW~1\DANEAP~1\errorsafefreeinstall_pl[1].exe ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe" [2007-03-14 03:43] "Cmaudio"="cmicnfg.cpl" [] "SmartSync - ScheduleSync"="C:\PROGRA~1\MOBILE~1\SMARTS~1\SCHEDU~1.EXE" [2006-03-30 16:49] "SpeedTouch USB Diagnostics"="C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" [2004-03-23 13:06] "SoundMan"="SOUNDMAN.EXE" [2006-11-17 06:42 C:\WINDOWS\soundman.exe] "avgnt"="C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe" [2007-04-02 10:35] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 02:44] C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\ Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 23:05:26] ************************************************************************** catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-07-29 18:05:03 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... scanning hidden registry entries ... [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\A\1\5\1c] "Order"=hex:08,00,00,00,02,00,00,00,b8,01,00,00,01,00,00,00,04,00,00,00,8c,.. scanning hidden files ... ************************************************************************** Completion time: 2007-07-29 18:06:37 C:\ComboFix-quarantined-files.txt ... 2007-07-29 18:05 --- E O F ---

Kod: Zaznacz wszystko: 2006-09-05 19:13 34718 --a------ C:\Qoobox\Quarantine\C\Program Files\ipwins\Uninst.exe.vir 2006-10-07 18:49 0 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\components\flx0.dll.vir 2006-10-15 09:38 0 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\components\flx1.dll.vir 2006-10-15 09:49 0 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\components\flx2.dll.vir 2006-10-15 09:55 0 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\components\flx3.dll.vir 2006-10-15 10:23 0 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\components\flx4.dll.vir 2006-10-15 10:30 0 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\components\flx5.dll.vir 2006-10-15 10:58 0 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\components\flx6.dll.vir 2006-10-15 11:04 0 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\components\flx7.dll.vir 2006-10-15 11:33 0 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\components\flx8.dll.vir 2006-10-15 11:39 0 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\components\flx9.dll.vir 2006-10-15 11:52 0 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\components\flx10.dll.vir 2007-07-28 21:59 830 --a------ C:\Qoobox\Quarantine\Registry_backups\LEGACY_WINDOWS_LOG.reg.cf Zmienna PATH folderu Numer seryjny woluminu: 583E-C804 C:\QOOBOX \---Quarantine +---C | +---Program Files | | \---ipwins | | Uninst.exe.vir | | | \---WINDOWS | \---system32 | \---components | flx0.dll.vir | flx1.dll.vir | flx10.dll.vir | flx2.dll.vir | flx3.dll.vir | flx4.dll.vir | flx5.dll.vir | flx6.dll.vir | flx7.dll.vir | flx8.dll.vir | flx9.dll.vir | \---Registry_backups LEGACY_WINDOWS_LOG.reg.cf

**Posty:** 18165 · przez **wojtas** 29 Lip 2007, 18:15

sciagnij killbox’a

Odpalasz Killboxa zaznacz opcję Delete on Reboot następnie w polu Full Path of File to Delete wklej ścieżkę

C:\DOCUME~1\JANKOW~1\DANEAP~1\errorsafefreeinstall_pl[1].exe

i nacisnij x
Program będzie pytał o restart (oczywiście zgadzasz się)

potem skasuj:

C:\Qoobox

komp sie muli

komp sie muli

Kto jest na forum