amvo - prośba o sprawdzenie loga

**Posty:** 15 · przez **Rudy13** 07 Kwi 2008, 19:54

Witam,
bardzo bym prosił o sprawdzenie loga. wiem że mam tego amvo... za każdym uruchomieniem wyskakuje mi komunikat że pamięć nie może być read... (jeszcze coś tam piszą.. jaieś numery) i ogólnie komp mi muli troche... poza tym przy każdym uruchomieniu kompa windows sprawdza piki na dysku czy nie ma błędów.. (jak ja nie lubie niebieskich ekranów:)wiem że mam tego amvo.. ale nie wiem jakie wpisy usunąć programami hijackthis i combofix. Prosze o pomoc... wklejam logi:

ComboFix:

Kod: Zaznacz wszystko: ComboFix 08-04-06.1 - Bolki 2008-04-07 19:38:17.2 - [color=red][b]FAT32[/b][/color]x86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.185 [GMT 2:00] Running from: H:\download\ComboFix.exe [color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color] . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . . ---- Previous Run ------- . C:\Autorun.inf C:\WINDOWS\system32\amvo.exe C:\WINDOWS\system32\amvo0.dll C:\WINDOWS\system32\amvo1.dll D:\Autorun.inf E:\Autorun.inf F:\Autorun.inf G:\Autorun.inf H:\Autorun.inf . ((((((((((((((((((((((((( Files Created from 2008-03-07 to 2008-04-07 ))))))))))))))))))))))))))))))) . 2008-04-06 19:44 . 2008-04-06 19:44 103,343 -r-hs---- C:\2.bat 2008-04-04 21:40 . 2008-04-04 21:39 103,664 -r-hs---- C:\m9j.com 2008-04-04 21:38 . 2008-04-04 21:38 <DIR> d--hs---- C:\FOUND.004 2008-04-04 20:23 . 2008-04-04 20:23 8,623 --a------ C:\WINDOWS\FontData.fdb 2008-04-04 06:45 . 2008-04-01 15:36 103,084 -r-hs---- C:\gy.cmd 2008-04-02 21:28 . 2008-04-01 15:36 103,084 -r-hs---- C:\qwc.exe 2008-04-01 21:46 . 2008-04-01 15:36 103,084 -r-hs---- C:\6l6w8.com 2008-04-01 21:45 . 2008-04-01 21:45 <DIR> d--hs---- C:\FOUND.003 2008-03-31 14:11 . 2008-03-31 14:11 <DIR> d--hs---- C:\FOUND.002 2008-03-31 08:48 . 2008-03-31 08:48 <DIR> d--hs---- C:\FOUND.001 2008-03-30 22:17 . 2007-04-09 13:23 28,040 --a------ C:\WINDOWS\system32\mdimon.dll 2008-03-30 22:17 . 2008-03-30 22:17 421 --a------ C:\WINDOWS\ODBC.INI 2008-03-30 22:14 . 2008-03-30 22:14 <DIR> d-------- C:\WINDOWS\SHELLNEW 2008-03-30 07:51 . 2008-03-30 07:50 103,951 -r-hs---- C:\cl.bat 2008-03-29 19:39 . 2008-04-06 13:12 54,156 --ah----- C:\WINDOWS\QTFont.qfn 2008-03-29 19:39 . 2008-03-29 19:39 1,409 --a------ C:\WINDOWS\QTFont.for 2008-03-29 15:24 . 2008-03-29 15:24 <DIR> d-------- C:\Documents and Settings\Bolki\Dane aplikacji\Corel 2008-03-29 15:24 . 2008-03-29 15:24 848 --ahs---- C:\WINDOWS\system32\KGyGaAvL.sys 2008-03-29 15:21 . 2008-03-29 15:21 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\InstallShield 2008-03-29 15:18 . 2008-03-29 15:18 <DIR> d-------- C:\Program Files\Common Files\Corel 2008-03-29 14:36 . 2004-08-22 16:31 155,136 --a------ C:\WINDOWS\system32\drivers\d347bus.sys 2008-03-29 14:36 . 2004-08-22 16:31 5,248 --a------ C:\WINDOWS\system32\drivers\d347prt.sys 2008-03-28 19:01 . 2002-08-29 19:00 1,703,936 --a------ C:\WINDOWS\system32\gdiplus.dll 2008-03-28 19:01 . 2007-04-15 00:05 991,232 --a------ C:\WINDOWS\system32\imageviewer2.ocx 2008-03-28 19:01 . 2000-05-22 00:00 608,448 --a------ C:\WINDOWS\system32\comctl32.ocx 2008-03-28 19:01 . 2004-03-08 23:00 224,016 --a------ C:\WINDOWS\system32\tabctl32.ocx 2008-03-28 19:01 . 1996-01-12 00:00 200,704 --a------ C:\WINDOWS\system32\threed32.ocx 2008-03-28 19:01 . 1998-06-24 00:00 164,144 --a------ C:\WINDOWS\system32\comct232.ocx 2008-03-28 19:01 . 1999-09-16 09:04 151,552 --a------ C:\WINDOWS\system32\ccrpfd6.ocx 2008-03-28 19:01 . 2000-05-01 23:02 110,592 --a------ C:\WINDOWS\system32\ccrpbds6.dll 2008-03-28 19:01 . 2000-07-09 18:15 106,496 --a------ C:\WINDOWS\system32\mbprgbar.ocx 2008-03-28 16:49 . 2008-03-28 16:49 102,814 -r-hs---- C:\kxax.cmd 2008-03-27 16:00 . 2004-08-03 23:08 26,496 --a------ C:\WINDOWS\system32\dllcache\usbstor.sys 2008-03-27 15:59 . 2004-08-03 23:08 31,616 --a------ C:\WINDOWS\system32\drivers\usbccgp.sys 2008-03-27 15:59 . 2004-08-03 23:08 31,616 --a------ C:\WINDOWS\system32\dllcache\usbccgp.sys 2008-03-26 20:42 . 2008-03-26 20:42 4 --a------ C:\WINDOWS\system32\proc20744962.bin 2008-03-26 20:36 . 2008-03-26 20:36 <DIR> d-------- C:\Program Files\MSXML 4.0 2008-03-26 20:28 . 2008-03-27 21:26 104,310 -r-hs---- C:\tknn6.bat 2008-03-25 20:05 . 2008-03-25 20:04 101,345 -r-hs---- C:\6.bat 2008-03-25 15:18 . 2008-03-25 15:18 <DIR> d-------- C:\Documents and Settings\Bolki\Dane aplikacji\Apple Computer 2008-03-25 12:38 . 2008-03-29 19:44 7,858 --a------ C:\logfile 2008-03-25 12:06 . 2008-03-25 12:06 <DIR> d-------- C:\Documents and Settings\Bolki\Dane aplikacji\gtk-2.0 2008-03-25 12:06 . 2008-03-25 12:06 <DIR> d-------- C:\Documents and Settings\Bolki\.thumbnails 2008-03-25 12:01 . 2008-03-25 12:01 <DIR> d-------- C:\Documents and Settings\Bolki\.gimp-2.4 2008-03-25 11:59 . 2008-03-25 11:59 <DIR> d-------- C:\Program Files\GIMP-2.0 2008-03-25 11:35 . 2008-03-25 11:35 <DIR> d-------- C:\WINDOWS\system32\DRVSTORE 2008-03-25 11:35 . 2008-03-25 11:35 <DIR> d-------- C:\Program Files\QuickTime 2008-03-25 11:35 . 2008-03-25 11:35 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Apple Computer 2008-03-25 11:34 . 2008-03-25 11:34 <DIR> d-------- C:\Program Files\Common Files\Kodak 2008-03-25 11:34 . 2004-08-04 00:44 159,232 --a------ C:\WINDOWS\system32\ptpusd.dll 2008-03-25 11:34 . 2004-08-03 22:58 15,104 --a------ C:\WINDOWS\system32\drivers\usbscan.sys 2008-03-25 11:34 . 2004-08-03 22:58 15,104 --a------ C:\WINDOWS\system32\dllcache\usbscan.sys 2008-03-25 11:34 . 2001-10-26 17:29 5,632 --a------ C:\WINDOWS\system32\ptpusb.dll 2008-03-25 11:32 . 2008-03-25 11:32 <DIR> d-------- C:\Program Files\Kodak 2008-03-25 11:31 . 2008-03-25 11:31 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Kodak 2008-03-24 16:23 . 2008-03-24 16:22 101,835 -r-hs---- C:\nlblkhq.com 2008-03-24 13:09 . 2008-03-24 13:24 690 --a------ C:\WINDOWS\eReg.dat 2008-03-24 13:02 . 2008-03-24 13:02 <DIR> d-------- C:\WINDOWS\Downloaded Installations 2008-03-24 10:41 . 2008-03-24 10:41 <DIR> d-------- C:\WINDOWS\Sun 2008-03-24 10:40 . 2008-02-22 02:33 69,632 --a------ C:\WINDOWS\system32\javacpl.cpl 2008-03-24 10:39 . 2008-03-24 10:39 <DIR> d-------- C:\Program Files\Java 2008-03-24 10:36 . 2008-03-24 10:36 <DIR> d-------- C:\Program Files\Common Files\Java 2008-03-24 10:29 . 2008-03-24 10:29 <DIR> d-------- C:\Program Files\Common Files\Onet.pl 2008-03-24 10:29 . 2008-03-24 10:29 <DIR> d-------- C:\Documents and Settings\Bolki\Dane aplikacji\Kamerzysta 2008-03-24 10:29 . 2008-03-24 10:29 <DIR> d-------- C:\Documents and Settings\Bolki\Dane aplikacji\AutoUpdate 2008-03-24 10:19 . 2008-03-24 10:19 <DIR> d-------- C:\Documents and Settings\Bolki\Dane aplikacji\skypePM 2008-03-24 10:19 . 2008-03-24 10:19 32 --a------ C:\Documents and Settings\All Users\Dane aplikacji\ezsid.dat 2008-03-24 10:17 . 2008-03-24 10:17 <DIR> d-------- C:\Documents and Settings\Bolki\Dane aplikacji\Skype 2008-03-24 10:14 . 2008-03-24 10:14 <DIR> d-------- C:\Program Files\Skype 2008-03-24 10:14 . 2008-03-24 10:14 <DIR> d-------- C:\Program Files\Common Files\Skype 2008-03-24 10:14 . 2008-03-24 10:14 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Skype 2008-03-23 14:35 . 2008-03-23 14:35 <DIR> d-------- C:\Documents and Settings\Bolki\Dane aplikacji\Media Player Classic 2008-03-23 14:35 . 2008-03-31 19:01 69 --a------ C:\WINDOWS\NeroDigital.ini 2008-03-23 14:03 . 2008-03-23 14:03 <DIR> d-------- C:\Program Files\Common Files\Nero 2008-03-23 14:02 . 2000-06-26 11:45 106,496 --a------ C:\WINDOWS\system32\TwnLib20.dll 2008-03-23 14:01 . 2008-03-23 14:01 <DIR> d-------- C:\Program Files\Common Files\Ahead 2008-03-23 14:01 . 2004-07-26 17:16 1,568,768 --------- C:\WINDOWS\system32\ImagX7.dll 2008-03-23 14:01 . 2004-07-26 17:16 476,320 --------- C:\WINDOWS\system32\ImagXpr7.dll 2008-03-23 14:01 . 2004-07-26 17:16 471,040 --------- C:\WINDOWS\system32\ImagXRA7.dll 2008-03-23 14:01 . 2004-07-26 17:16 262,144 --------- C:\WINDOWS\system32\ImagXR7.dll 2008-03-23 14:01 . 2001-07-09 11:50 155,648 --a------ C:\WINDOWS\system32\NeroCheck.exe 2008-03-23 08:47 . 2004-10-11 18:21 372,736 -ra------ C:\WINDOWS\system32\LVUI2RC.dll 2008-03-23 08:41 . 2008-03-23 08:41 <DIR> d-------- C:\Program Files\Common Files\Logitech 2008-03-23 08:41 . 2004-12-14 19:16 53,248 -ra------ C:\WINDOWS\system32\InstMed.exe 2008-03-23 08:40 . 2008-03-23 08:40 <DIR> d-------- C:\Program Files\Logitech 2008-03-23 06:59 . 2008-03-23 06:59 <DIR> d-------- C:\Downloads 2008-03-23 06:43 . 2008-04-07 08:07 732 --a------ C:\WINDOWS\wcx_ftp.ini 2008-03-23 06:42 . 2008-04-07 08:16 606 --a------ C:\WINDOWS\wincmd.ini 2008-03-23 06:42 . 2002-11-04 05:50 545 --a------ C:\WINDOWS\UC.PIF 2008-03-23 06:42 . 2002-11-04 05:50 545 --a------ C:\WINDOWS\RAR.PIF 2008-03-23 06:42 . 2002-11-04 05:50 545 --a------ C:\WINDOWS\PKZIP.PIF 2008-03-23 06:42 . 2002-11-04 05:50 545 --a------ C:\WINDOWS\PKUNZIP.PIF 2008-03-23 06:42 . 2002-11-04 05:50 545 --a------ C:\WINDOWS\NOCLOSE.PIF 2008-03-23 06:42 . 2002-11-04 05:50 545 --a------ C:\WINDOWS\LHA.PIF 2008-03-23 06:42 . 2002-11-04 05:50 545 --a------ C:\WINDOWS\ARJ.PIF 2008-03-22 22:45 . 2008-03-22 17:02 101,092 -r-hs---- C:\stw1ojde.bat 2008-03-22 21:38 . 2008-03-22 21:38 <DIR> d-------- C:\Documents and Settings\Bolki\Dane aplikacji\Thinstall 2008-03-22 21:32 . 2007-12-07 03:14 6,066,176 --------- C:\WINDOWS\system32\dllcache\ieframe.dll 2008-03-22 21:32 . 2007-07-01 04:31 2,455,488 --------- C:\WINDOWS\system32\dllcache\ieapfltr.dat 2008-03-22 21:32 . 2007-07-01 04:36 1,036,288 --------- C:\WINDOWS\system32\dllcache\ieframe.dll.mui . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-03-22 14:38 33 ----a-w C:\WINDOWS\system32\drivers\adidsl.cfg 2008-03-22 13:50 --------- d-----w C:\Program Files\microsoft frontpage 2008-03-22 13:49 --------- d-----w C:\Program Files\Usługi online 2008-03-20 08:26 102,455 --sh--r C:\ser.com 2008-01-11 04:41 44,544 ------w C:\WINDOWS\system32\dllcache\pngfilt.dll 2008-01-10 11:16 159,839 ----a-w C:\WINDOWS\system32\xvidvfw.dll 2008-01-10 11:15 755,027 ----a-w C:\WINDOWS\system32\xvidcore.dll . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "AutoConnect"="f:\Program Files\AutoConnect\AutoConnect.exe" [2004-08-28 19:27 295424] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-03 22:44 15360] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SoundMan"="SOUNDMAN.EXE" [2005-04-15 04:01 77824 C:\WINDOWS\SOUNDMAN.EXE] "AtiPTA"="atiptaxx.exe" [2006-02-22 02:05 344064 C:\WINDOWS\system32\atiptaxx.exe] "MKS_MENU"="f:\Program Files\MKS\Bin\mks_menu.exe" [2008-03-22 16:30 125952] "ABREGMON"="F:\Program Files\MKS\Bin\ABregmon.exe" [2008-03-22 16:30 70656] "WinampAgent"="f:\Program Files\Winamp\winampa.exe" [2003-12-13 01:50 33792] "LVCOMSX"="C:\WINDOWS\system32\LVCOMSX.EXE" [2004-12-14 18:19 221184] "LogitechVideoRepair"="C:\Program Files\Logitech\Video\ISStart.exe" [2004-12-14 18:57 458752] "LogitechVideoTray"="C:\Program Files\Logitech\Video\LogiTray.exe" [2004-12-14 18:51 217088] "NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 11:50 155648] "Onet.pl AutoUpdate"="C:\Program Files\Common Files\Onet.pl\NewAutoUpdate.exe" [ ] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 04:25 144784] "QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2007-06-29 06:24 286720] "DAEMON Tools-1033"="F:\Program Files\D-Tools\daemon.exe" [2004-08-22 17:05 81920] "ISUSPM Startup"="C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" [2005-08-11 16:30 249856] "ISUSScheduler"="C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [2005-08-11 16:30 81920] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-03 22:44 15360] C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\ DSLMON.lnk - C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe [2008-03-22 16:38:47 839680] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "VIDC.I420"= lvcodec2.dll "MSVideo"= vfwwdm32.dll "MSVideo8"= VfWWDM32.dll "VIDC.YV12"= yv12vfw.dll "msacm.ac3acm"= ac3acm.acm "msacm.lameacm"= lameACM.acm [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusDisableNotify"=dword:00000001 "UpdatesDisableNotify"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "f:\\Program Files\\Wapster\\AQQ\\AQQ.exe"= "F:\\PROGRA~1\\Wapster\\AQQ\\AQQ.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "F:\\Program Files\\totalcmd\\TOTALCMD.EXE"= "C:\\Program Files\\Kodak\\Kodak EasyShare software\\bin\\EasyShare.exe"= "C:\\Program Files\\Skype\\Phone\\Skype.exe"= R0 nvcchflt;NVIDIA Disk Cache Filter Driver;C:\WINDOWS\system32\DRIVERS\nvcchflt.sys [2005-02-12 02:11] R1 ABTDI;ABTDI;f:\Program Files\MKS\Bin\ABTDI.sys [2008-03-22 16:30] R3 e4usbaw;USB ADSL2 WAN Adapter;C:\WINDOWS\system32\DRIVERS\e4usbaw.sys [2006-09-19 11:03] R3 MksMonFd;MkS_Mon Kernel Filter Driver;f:\Program Files\MKS\Bin\MksMonFd.sys [2008-03-22 16:30] S2 IKANLOADER2;General Purpose USB Driver (e4ldr.sys);C:\WINDOWS\system32\Drivers\e4ldr.sys [2006-09-15 11:07] S3 MksMonEn;MkS_Mon Kernel Engine;f:\Program Files\MKS\Bin\MksMonEn.sys [2008-03-22 16:30] S3 MksMonEv;MkS_Mon Kernel Events;f:\Program Files\MKS\Bin\MksMonEv.sys [2008-03-22 16:30] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\I] \Shell\AutoRun\command - I:\AUTORUN\AUTORUN.EXE [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{029b15cf-f825-11dc-9783-806d6172696f}] \Shell\AutoRun\command - I:\AUTORUN\AUTORUN.EXE [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{03700942-fdab-11dc-a974-4d6564696130}] \Shell\AutoRun\command - K:\kxax.cmd \Shell\explore\Command - K:\kxax.cmd \Shell\open\Command - K:\kxax.cmd [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{7a897926-fc0e-11dc-a030-4d6564696130}] \Shell\AutoRun\command - K:\m9j.com \Shell\explore\Command - K:\m9j.com \Shell\open\Command - K:\m9j.com [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{7a897927-fc0e-11dc-a030-4d6564696130}] \Shell\AutoRun\command - L:\m9j.com \Shell\explore\Command - L:\m9j.com \Shell\open\Command - L:\m9j.com [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a8438f8c-024e-11dd-a996-4d6564696130}] \Shell\AutoRun\command - 6l6w8.com \Shell\explore\Command - 6l6w8.com \Shell\open\Command - 6l6w8.com . ************************************************************************** catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-04-07 19:38:53 Windows 5.1.2600 Dodatek Service Pack 2 FAT NTAPI scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2008-04-07 19:39:04 ComboFix-quarantined-files.txt 2008-04-07 17:39:04 Pre-Run: 3,866,763,264 bajtów wolnych Post-Run: 3,858,690,048 bajtów wolnych . 2008-03-31 14:04:43 --- E O F ---

HijackThis:

Kod: Zaznacz wszystko: Logfile of HijackThis v1.99.1 Scan saved at 19:52:43, on 2008-04-07 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16608) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\spoolsv.exe f:\Program Files\MKS\Bin\NetMonSV.exe f:\Program Files\MKS\Bin\mksmonsv.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\SOUNDMAN.EXE F:\Program Files\MKS\Bin\mks_menu.exe F:\Program Files\Winamp\winampa.exe C:\WINDOWS\system32\LVCOMSX.EXE C:\Program Files\Logitech\Video\LogiTray.exe C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe C:\Program Files\Logitech\Video\FxSvr2.exe F:\Program Files\D-Tools\daemon.exe C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe F:\Program Files\AutoConnect\AutoConnect.exe C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe f:\Program Files\MKS\Bin\mks_scan.exe C:\WINDOWS\explorer.exe C:\Program Files\Mozilla Firefox 3 Beta 4\firefox.exe C:\WINDOWS\system32\NOTEPAD.EXE H:\instalki\hijackthis1.99.1\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://sms.orange.pl/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [AtiPTA] atiptaxx.exe O4 - HKLM\..\Run: [MKS_MENU] f:\Program Files\MKS\Bin\mks_menu.exe O4 - HKLM\..\Run: [ABREGMON] F:\Program Files\MKS\Bin\ABregmon.exe O4 - HKLM\..\Run: [WinampAgent] f:\Program Files\Winamp\winampa.exe O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [Onet.pl AutoUpdate] "C:\Program Files\Common Files\Onet.pl\NewAutoUpdate.exe" /updateexetsr O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime O4 - HKLM\..\Run: [DAEMON Tools-1033] "F:\Program Files\D-Tools\daemon.exe" -lang 1033 O4 - HKLM\..\Run: [ISUSPM Startup] "C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -startup O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start O4 - HKCU\..\Run: [AutoConnect] f:\Program Files\AutoConnect\AutoConnect.exe O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://F:\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - F:\PROGRA~1\MICROS~1\OFFICE11\REFIEBAR.DLL O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O11 - Options group: [INTERNATIONAL] International* O16 - DPF: {1A781DED-C22D-4153-3213-A3211E29DF13} (GameDesire Card Games) - http://67.15.101.33/g_bin/pl/cards_2_0_0_77.cab O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/flashplayer/current/swflash.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{C379DEE5-330D-4B16-AC1B-04367BBBF62C}: NameServer = 194.204.159.1 217.98.63.164 O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll O23 - Service: ArcaBit NetMonitor (ABNetMon) - ArcaBit sp. z o.o. - f:\Program Files\MKS\Bin\NetMonSV.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: MkSUpdateInt - MkS Sp. z o. o. - f:\Program Files\MKS\bin\MkSUpdateInt.exe O23 - Service: MkS_Vir Monitor (MksVirMonSvc) - Unknown owner - f:\Program Files\MKS\Bin\mksmonsv.exe O23 - Service: MkS_Scan - Unknown owner - f:\Program Files\MKS\Bin\mks_scan.exe

**Posty:** 18165 · przez **wojtas** 07 Kwi 2008, 21:16

Wykonaj to co jest podane w tym temacie

Otworz notatnik i wklej w nim to:

File::
C:\2.bat
C:\m9j.com
C:\gy.cmd
C:\qwc.exe
C:\6l6w8.com
C:\cl.bat
C:\kxax.cmd
C:\6.bat
C:\tknn6.bat
C:\nlblkhq.com
C:\stw1ojde.bat
C:\ser.com

Registry::
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{03700942-fdab-11dc-a974-4d6564696130}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{7a897926-fc0e-11dc-a030-4d6564696130}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{7a897927-fc0e-11dc-a030-4d6564696130}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a8438f8c-024e-11dd-a996-4d6564696130}]

Plik >>> zapisz jako CFScript.txt .Plik przeciągnij i upuść na ikonę ComboFixa (tak jak tu ) . odczekaj az wygeneruje sie nowy log i go daj na forum

**Posty:** 15 · przez **Rudy13** 10 Kwi 2008, 19:22

Witam ponownie,
Właśnie wykonałem WSZYSTKiE wskazówki... efektów jako takich nie mogę spostrzec bo dopiero to zrobiłem... Taki zabiagany jestem:) ale jedno co już widze a co mnie wkurzało to to że po wejściu na jakiś dysk z mojego komputea uruchamia mi się w tym samym oknie:) a przez jakiś czas denerwowało mnie otwieranie dysku w osobnym oknie;p. Czy to od tego?? Póki co to wklejam log po całej robocie. Jak to wygląda?

ComboFix:

Kod: Zaznacz wszystko: ComboFix 08-04-06.1 - Bolki 2008-04-10 19:15:13.4 - [color=red][b]FAT32[/b][/color]x86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.188 [GMT 2:00] Running from: H:\download\ComboFix.exe [color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color] . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . . ---- Previous Run ------- . C:\2.bat C:\6.bat C:\6l6w8.com C:\Autorun.inf C:\cl.bat C:\gy.cmd C:\kxax.cmd C:\m9j.com C:\nlblkhq.com C:\qwc.exe C:\ser.com C:\stw1ojde.bat C:\tknn6.bat C:\WINDOWS\system32\amvo.exe C:\WINDOWS\system32\amvo0.dll D:\Autorun.inf E:\Autorun.inf F:\Autorun.inf G:\Autorun.inf H:\Autorun.inf . ((((((((((((((((((((((((( Files Created from 2008-03-10 to 2008-04-10 ))))))))))))))))))))))))))))))) . 2008-04-10 16:48 . 2008-04-10 16:48 <DIR> d--h----- C:\BJPrinter 2008-04-10 16:48 . 2003-02-28 08:00 100,352 --------- C:\WINDOWS\system32\CNMLM53.DLL 2008-04-10 16:48 . 2003-02-14 18:01 73,728 -ra------ C:\WINDOWS\system32\CNMCP53.exe 2008-04-10 16:48 . 2003-02-28 08:00 5,632 --a------ C:\WINDOWS\system32\CNMVS53.DLL 2008-04-10 16:43 . 2004-08-03 23:01 25,856 --a------ C:\WINDOWS\system32\drivers\usbprint.sys 2008-04-10 16:43 . 2004-08-03 23:01 25,856 --a------ C:\WINDOWS\system32\dllcache\usbprint.sys 2008-04-10 06:52 . 2008-02-27 18:14 108,099 -r-hs---- C:\fppg1.exe 2008-04-09 14:22 . 2008-04-09 14:22 <DIR> d--hs---- C:\FOUND.005 2008-04-04 21:38 . 2008-04-04 21:38 <DIR> d--hs---- C:\FOUND.004 2008-04-04 20:23 . 2008-04-04 20:23 8,623 --a------ C:\WINDOWS\FontData.fdb 2008-04-01 21:45 . 2008-04-01 21:45 <DIR> d--hs---- C:\FOUND.003 2008-03-31 14:11 . 2008-03-31 14:11 <DIR> d--hs---- C:\FOUND.002 2008-03-31 08:48 . 2008-03-31 08:48 <DIR> d--hs---- C:\FOUND.001 2008-03-30 22:17 . 2007-04-09 13:23 28,040 --a------ C:\WINDOWS\system32\mdimon.dll 2008-03-30 22:17 . 2008-03-30 22:17 421 --a------ C:\WINDOWS\ODBC.INI 2008-03-30 22:14 . 2008-03-30 22:14 <DIR> d-------- C:\WINDOWS\SHELLNEW 2008-03-29 19:39 . 2008-04-08 17:45 54,156 --ah----- C:\WINDOWS\QTFont.qfn 2008-03-29 19:39 . 2008-03-29 19:39 1,409 --a------ C:\WINDOWS\QTFont.for 2008-03-29 15:24 . 2008-03-29 15:24 <DIR> d-------- C:\Documents and Settings\Bolki\Dane aplikacji\Corel 2008-03-29 15:24 . 2008-03-29 15:24 848 --ahs---- C:\WINDOWS\system32\KGyGaAvL.sys 2008-03-29 15:21 . 2008-03-29 15:21 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\InstallShield 2008-03-29 15:18 . 2008-03-29 15:18 <DIR> d-------- C:\Program Files\Common Files\Corel 2008-03-29 14:36 . 2004-08-22 16:31 155,136 --a------ C:\WINDOWS\system32\drivers\d347bus.sys 2008-03-29 14:36 . 2004-08-22 16:31 5,248 --a------ C:\WINDOWS\system32\drivers\d347prt.sys 2008-03-28 19:01 . 2002-08-29 19:00 1,703,936 --a------ C:\WINDOWS\system32\gdiplus.dll 2008-03-28 19:01 . 2007-04-15 00:05 991,232 --a------ C:\WINDOWS\system32\imageviewer2.ocx 2008-03-28 19:01 . 2000-05-22 00:00 608,448 --a------ C:\WINDOWS\system32\comctl32.ocx 2008-03-28 19:01 . 2004-03-08 23:00 224,016 --a------ C:\WINDOWS\system32\tabctl32.ocx 2008-03-28 19:01 . 1996-01-12 00:00 200,704 --a------ C:\WINDOWS\system32\threed32.ocx 2008-03-28 19:01 . 1998-06-24 00:00 164,144 --a------ C:\WINDOWS\system32\comct232.ocx 2008-03-28 19:01 . 1999-09-16 09:04 151,552 --a------ C:\WINDOWS\system32\ccrpfd6.ocx 2008-03-28 19:01 . 2000-05-01 23:02 110,592 --a------ C:\WINDOWS\system32\ccrpbds6.dll 2008-03-28 19:01 . 2000-07-09 18:15 106,496 --a------ C:\WINDOWS\system32\mbprgbar.ocx 2008-03-27 16:00 . 2004-08-03 23:08 26,496 --a------ C:\WINDOWS\system32\dllcache\usbstor.sys 2008-03-27 15:59 . 2004-08-03 23:08 31,616 --a------ C:\WINDOWS\system32\drivers\usbccgp.sys 2008-03-27 15:59 . 2004-08-03 23:08 31,616 --a------ C:\WINDOWS\system32\dllcache\usbccgp.sys 2008-03-26 20:42 . 2008-03-26 20:42 4 --a------ C:\WINDOWS\system32\proc20744962.bin 2008-03-26 20:36 . 2008-03-26 20:36 <DIR> d-------- C:\Program Files\MSXML 4.0 2008-03-25 15:18 . 2008-03-25 15:18 <DIR> d-------- C:\Documents and Settings\Bolki\Dane aplikacji\Apple Computer 2008-03-25 12:38 . 2008-03-29 19:44 7,858 --a------ C:\logfile 2008-03-25 12:06 . 2008-03-25 12:06 <DIR> d-------- C:\Documents and Settings\Bolki\Dane aplikacji\gtk-2.0 2008-03-25 12:06 . 2008-03-25 12:06 <DIR> d-------- C:\Documents and Settings\Bolki\.thumbnails 2008-03-25 12:01 . 2008-03-25 12:01 <DIR> d-------- C:\Documents and Settings\Bolki\.gimp-2.4 2008-03-25 11:59 . 2008-03-25 11:59 <DIR> d-------- C:\Program Files\GIMP-2.0 2008-03-25 11:35 . 2008-03-25 11:35 <DIR> d-------- C:\WINDOWS\system32\DRVSTORE 2008-03-25 11:35 . 2008-03-25 11:35 <DIR> d-------- C:\Program Files\QuickTime 2008-03-25 11:35 . 2008-03-25 11:35 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Apple Computer 2008-03-25 11:34 . 2008-03-25 11:34 <DIR> d-------- C:\Program Files\Common Files\Kodak 2008-03-25 11:34 . 2004-08-04 00:44 159,232 --a------ C:\WINDOWS\system32\ptpusd.dll 2008-03-25 11:34 . 2004-08-03 22:58 15,104 --a------ C:\WINDOWS\system32\drivers\usbscan.sys 2008-03-25 11:34 . 2004-08-03 22:58 15,104 --a------ C:\WINDOWS\system32\dllcache\usbscan.sys 2008-03-25 11:34 . 2001-10-26 17:29 5,632 --a------ C:\WINDOWS\system32\ptpusb.dll 2008-03-25 11:32 . 2008-03-25 11:32 <DIR> d-------- C:\Program Files\Kodak 2008-03-25 11:31 . 2008-03-25 11:31 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Kodak 2008-03-24 13:09 . 2008-03-24 13:24 690 --a------ C:\WINDOWS\eReg.dat 2008-03-24 13:02 . 2008-03-24 13:02 <DIR> d-------- C:\WINDOWS\Downloaded Installations 2008-03-24 10:41 . 2008-03-24 10:41 <DIR> d-------- C:\WINDOWS\Sun 2008-03-24 10:40 . 2008-02-22 02:33 69,632 --a------ C:\WINDOWS\system32\javacpl.cpl 2008-03-24 10:39 . 2008-03-24 10:39 <DIR> d-------- C:\Program Files\Java 2008-03-24 10:36 . 2008-03-24 10:36 <DIR> d-------- C:\Program Files\Common Files\Java 2008-03-24 10:29 . 2008-03-24 10:29 <DIR> d-------- C:\Program Files\Common Files\Onet.pl 2008-03-24 10:29 . 2008-03-24 10:29 <DIR> d-------- C:\Documents and Settings\Bolki\Dane aplikacji\Kamerzysta 2008-03-24 10:29 . 2008-03-24 10:29 <DIR> d-------- C:\Documents and Settings\Bolki\Dane aplikacji\AutoUpdate 2008-03-24 10:19 . 2008-03-24 10:19 <DIR> d-------- C:\Documents and Settings\Bolki\Dane aplikacji\skypePM 2008-03-24 10:19 . 2008-03-24 10:19 32 --a------ C:\Documents and Settings\All Users\Dane aplikacji\ezsid.dat 2008-03-24 10:17 . 2008-03-24 10:17 <DIR> d-------- C:\Documents and Settings\Bolki\Dane aplikacji\Skype 2008-03-24 10:14 . 2008-03-24 10:14 <DIR> d-------- C:\Program Files\Skype 2008-03-24 10:14 . 2008-03-24 10:14 <DIR> d-------- C:\Program Files\Common Files\Skype 2008-03-24 10:14 . 2008-03-24 10:14 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Skype 2008-03-23 14:35 . 2008-03-23 14:35 <DIR> d-------- C:\Documents and Settings\Bolki\Dane aplikacji\Media Player Classic 2008-03-23 14:35 . 2008-04-08 20:31 69 --a------ C:\WINDOWS\NeroDigital.ini 2008-03-23 14:03 . 2008-03-23 14:03 <DIR> d-------- C:\Program Files\Common Files\Nero 2008-03-23 14:02 . 2000-06-26 11:45 106,496 --a------ C:\WINDOWS\system32\TwnLib20.dll 2008-03-23 14:01 . 2008-03-23 14:01 <DIR> d-------- C:\Program Files\Common Files\Ahead 2008-03-23 14:01 . 2004-07-26 17:16 1,568,768 --------- C:\WINDOWS\system32\ImagX7.dll 2008-03-23 14:01 . 2004-07-26 17:16 476,320 --------- C:\WINDOWS\system32\ImagXpr7.dll 2008-03-23 14:01 . 2004-07-26 17:16 471,040 --------- C:\WINDOWS\system32\ImagXRA7.dll 2008-03-23 14:01 . 2004-07-26 17:16 262,144 --------- C:\WINDOWS\system32\ImagXR7.dll 2008-03-23 14:01 . 2001-07-09 11:50 155,648 --a------ C:\WINDOWS\system32\NeroCheck.exe 2008-03-23 08:47 . 2004-10-11 18:21 372,736 -ra------ C:\WINDOWS\system32\LVUI2RC.dll 2008-03-23 08:41 . 2008-03-23 08:41 <DIR> d-------- C:\Program Files\Common Files\Logitech 2008-03-23 08:41 . 2004-12-14 19:16 53,248 -ra------ C:\WINDOWS\system32\InstMed.exe 2008-03-23 08:40 . 2008-03-23 08:40 <DIR> d-------- C:\Program Files\Logitech 2008-03-23 06:59 . 2008-03-23 06:59 <DIR> d-------- C:\Downloads 2008-03-23 06:43 . 2008-04-10 08:08 727 --a------ C:\WINDOWS\wcx_ftp.ini 2008-03-23 06:42 . 2008-04-10 15:36 582 --a------ C:\WINDOWS\wincmd.ini 2008-03-23 06:42 . 2002-11-04 05:50 545 --a------ C:\WINDOWS\UC.PIF 2008-03-23 06:42 . 2002-11-04 05:50 545 --a------ C:\WINDOWS\RAR.PIF 2008-03-23 06:42 . 2002-11-04 05:50 545 --a------ C:\WINDOWS\PKZIP.PIF 2008-03-23 06:42 . 2002-11-04 05:50 545 --a------ C:\WINDOWS\PKUNZIP.PIF 2008-03-23 06:42 . 2002-11-04 05:50 545 --a------ C:\WINDOWS\NOCLOSE.PIF 2008-03-23 06:42 . 2002-11-04 05:50 545 --a------ C:\WINDOWS\LHA.PIF 2008-03-23 06:42 . 2002-11-04 05:50 545 --a------ C:\WINDOWS\ARJ.PIF 2008-03-22 21:38 . 2008-03-22 21:38 <DIR> d-------- C:\Documents and Settings\Bolki\Dane aplikacji\Thinstall 2008-03-22 21:32 . 2008-03-01 15:02 6,066,176 --------- C:\WINDOWS\system32\dllcache\ieframe.dll 2008-03-22 21:32 . 2007-07-01 04:31 2,455,488 --------- C:\WINDOWS\system32\dllcache\ieapfltr.dat 2008-03-22 21:32 . 2007-07-01 04:36 1,036,288 --------- C:\WINDOWS\system32\dllcache\ieframe.dll.mui 2008-03-22 21:32 . 2008-03-01 15:02 459,264 --------- C:\WINDOWS\system32\dllcache\msfeeds.dll 2008-03-22 21:32 . 2008-03-01 15:02 383,488 --------- C:\WINDOWS\system32\dllcache\ieapfltr.dll 2008-03-22 21:32 . 2008-03-01 15:02 267,776 --------- C:\WINDOWS\system32\dllcache\iertutil.dll . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-03-22 14:38 33 ----a-w C:\WINDOWS\system32\drivers\adidsl.cfg 2008-03-22 13:50 --------- d-----w C:\Program Files\microsoft frontpage 2008-03-22 13:49 --------- d-----w C:\Program Files\Usługi online 2008-03-20 08:09 1,845,504 ----a-w C:\WINDOWS\system32\win32k.sys 2008-03-20 08:09 1,845,504 ------w C:\WINDOWS\system32\dllcache\win32k.sys 2008-03-01 16:32 3,591,680 ------w C:\WINDOWS\system32\dllcache\mshtml.dll 2008-02-29 08:59 70,656 ------w C:\WINDOWS\system32\dllcache\ie4uinit.exe 2008-02-29 08:59 625,664 ------w C:\WINDOWS\system32\dllcache\iexplore.exe 2008-02-20 06:51 282,624 ----a-w C:\WINDOWS\system32\gdi32.dll 2008-02-20 06:51 282,624 ------w C:\WINDOWS\system32\dllcache\gdi32.dll 2008-02-20 05:38 45,568 ----a-w C:\WINDOWS\system32\dnsrslvr.dll 2008-02-20 05:38 45,568 ------w C:\WINDOWS\system32\dllcache\dnsrslvr.dll 2008-02-20 05:38 148,992 ------w C:\WINDOWS\system32\dllcache\dnsapi.dll 2008-02-15 05:44 161,792 ------w C:\WINDOWS\system32\dllcache\ieakui.dll 2008-01-10 11:16 159,839 ----a-w C:\WINDOWS\system32\xvidvfw.dll 2008-01-10 11:15 755,027 ----a-w C:\WINDOWS\system32\xvidcore.dll . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "AutoConnect"="f:\Program Files\AutoConnect\AutoConnect.exe" [2004-08-28 19:27 295424] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-03 22:44 15360] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SoundMan"="SOUNDMAN.EXE" [2005-04-15 04:01 77824 C:\WINDOWS\SOUNDMAN.EXE] "AtiPTA"="atiptaxx.exe" [2006-02-22 02:05 344064 C:\WINDOWS\system32\atiptaxx.exe] "MKS_MENU"="f:\Program Files\MKS\Bin\mks_menu.exe" [2008-03-22 16:30 125952] "ABREGMON"="F:\Program Files\MKS\Bin\ABregmon.exe" [2008-03-22 16:30 70656] "WinampAgent"="f:\Program Files\Winamp\winampa.exe" [2003-12-13 01:50 33792] "LVCOMSX"="C:\WINDOWS\system32\LVCOMSX.EXE" [2004-12-14 18:19 221184] "LogitechVideoRepair"="C:\Program Files\Logitech\Video\ISStart.exe" [2004-12-14 18:57 458752] "LogitechVideoTray"="C:\Program Files\Logitech\Video\LogiTray.exe" [2004-12-14 18:51 217088] "NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 11:50 155648] "Onet.pl AutoUpdate"="C:\Program Files\Common Files\Onet.pl\NewAutoUpdate.exe" [ ] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 04:25 144784] "QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2007-06-29 06:24 286720] "DAEMON Tools-1033"="F:\Program Files\D-Tools\daemon.exe" [2004-08-22 17:05 81920] "ISUSPM Startup"="C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" [2005-08-11 16:30 249856] "ISUSScheduler"="C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [2005-08-11 16:30 81920] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-03 22:44 15360] C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\ DSLMON.lnk - C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe [2008-03-22 16:38:47 839680] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "VIDC.I420"= lvcodec2.dll "MSVideo"= vfwwdm32.dll "MSVideo8"= VfWWDM32.dll "VIDC.YV12"= yv12vfw.dll "msacm.ac3acm"= ac3acm.acm "msacm.lameacm"= lameACM.acm [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusDisableNotify"=dword:00000001 "UpdatesDisableNotify"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "f:\\Program Files\\Wapster\\AQQ\\AQQ.exe"= "F:\\PROGRA~1\\Wapster\\AQQ\\AQQ.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "F:\\Program Files\\totalcmd\\TOTALCMD.EXE"= "C:\\Program Files\\Kodak\\Kodak EasyShare software\\bin\\EasyShare.exe"= "C:\\Program Files\\Skype\\Phone\\Skype.exe"= R0 nvcchflt;NVIDIA Disk Cache Filter Driver;C:\WINDOWS\system32\DRIVERS\nvcchflt.sys [2005-02-12 02:11] R1 ABTDI;ABTDI;f:\Program Files\MKS\Bin\ABTDI.sys [2008-03-22 16:30] R3 e4usbaw;USB ADSL2 WAN Adapter;C:\WINDOWS\system32\DRIVERS\e4usbaw.sys [2006-09-19 11:03] R3 MksMonFd;MkS_Mon Kernel Filter Driver;f:\Program Files\MKS\Bin\MksMonFd.sys [2008-03-22 16:30] S2 IKANLOADER2;General Purpose USB Driver (e4ldr.sys);C:\WINDOWS\system32\Drivers\e4ldr.sys [2006-09-15 11:07] S3 MksMonEn;MkS_Mon Kernel Engine;f:\Program Files\MKS\Bin\MksMonEn.sys [2008-03-22 16:30] S3 MksMonEv;MkS_Mon Kernel Events;f:\Program Files\MKS\Bin\MksMonEv.sys [2008-03-22 16:30] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\I] \Shell\AutoRun\command - I:\AUTORUN\AUTORUN.EXE [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{029b15cf-f825-11dc-9783-806d6172696f}] \Shell\AutoRun\command - I:\AUTORUN\AUTORUN.EXE [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{03700943-fdab-11dc-a974-4d6564696130}] \Shell\AutoRun\command - L:\fppg1.exe \Shell\explore\Command - L:\fppg1.exe \Shell\open\Command - L:\fppg1.exe . ************************************************************************** catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-04-10 19:15:55 Windows 5.1.2600 Dodatek Service Pack 2 FAT NTAPI scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2008-04-10 19:16:07 ComboFix-quarantined-files.txt 2008-04-10 17:16:06 ComboFix2.txt 2008-04-07 17:39:06 Pre-Run: 3,459,538,944 bajtów wolnych Post-Run: 3,451,273,216 bajtów wolnych . 2008-04-09 14:48:00 --- E O F ---

**Posty:** 18165 · przez **wojtas** 10 Kwi 2008, 20:13

Zastosuj SDFix . Po pobraniu uruchom go a rozpakuje się do C:\SDFix. Uruchom komputer w trybie awaryjnym (F8 przy stracie systemu). Będąc w awaryjnym uruchom plik RunThis.bat z folderu SDFixa. Zatwierdź czyszczenie przez Y. Poczekaj aż ukończy i komputer zresetuje

wklej do notatnika:

File::
C:\fppg1.exe

Registry::
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{03700943-fdab-11dc-a974-4d6564696130}]

Plik >>> zapisz jako CFScript.txt .Plik przeciągnij i upuść na ikonę ComboFixa. i czekaj na nowy log i go daj oraz wejdz do folderu C:\SDFix wrzuc zawartość pliku Report.txt

**Posty:** 15 · przez **Rudy13** 10 Kwi 2008, 21:00

Wszystko poszło bezproblemowo. A teraz jeszcze pytanko.. czy mam usunąć ten folder z plikami w kwarantannie? c:\qoobox

Wstawiam świeżego loga z ComboFix. Ocena jego mnie przerasta:):

A tak na marginesie to super to forum.. bezproblemowo szybka dokładna odpowiedź.. super...

Kod: Zaznacz wszystko: ComboFix 08-04-06.1 - Bolki 2008-04-10 20:53:51.5 - [color=red][b]FAT32[/b][/color]x86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.193 [GMT 2:00] Running from: H:\download\ComboFix.exe Command switches used :: H:\download\CFScript.txt * Created a new restore point [color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color] FILE :: C:\fppg1.exe . ((((((((((((((((((((((((( Files Created from 2008-03-10 to 2008-04-10 ))))))))))))))))))))))))))))))) . 2008-04-10 20:45 . 2008-04-10 20:45 <DIR> d-------- C:\WINDOWS\ERUNT 2008-04-10 20:39 . 2008-04-09 10:46 <DIR> d-------- C:\SDFix 2008-04-10 19:38 . 2008-04-10 19:39 <DIR> d-------- C:\Documents and Settings\Bolki\Dane aplikacji\Lavasoft 2008-04-10 16:48 . 2008-04-10 16:48 <DIR> d--h----- C:\BJPrinter 2008-04-10 16:48 . 2003-02-28 08:00 100,352 --------- C:\WINDOWS\system32\CNMLM53.DLL 2008-04-10 16:48 . 2003-02-14 18:01 73,728 -ra------ C:\WINDOWS\system32\CNMCP53.exe 2008-04-10 16:48 . 2003-02-28 08:00 5,632 --a------ C:\WINDOWS\system32\CNMVS53.DLL 2008-04-10 16:43 . 2004-08-03 23:01 25,856 --a------ C:\WINDOWS\system32\drivers\usbprint.sys 2008-04-10 16:43 . 2004-08-03 23:01 25,856 --a------ C:\WINDOWS\system32\dllcache\usbprint.sys 2008-04-09 14:22 . 2008-04-09 14:22 <DIR> d--hs---- C:\FOUND.005 2008-04-04 21:38 . 2008-04-04 21:38 <DIR> d--hs---- C:\FOUND.004 2008-04-04 20:23 . 2008-04-04 20:23 8,623 --a------ C:\WINDOWS\FontData.fdb 2008-04-01 21:45 . 2008-04-01 21:45 <DIR> d--hs---- C:\FOUND.003 2008-03-31 14:11 . 2008-03-31 14:11 <DIR> d--hs---- C:\FOUND.002 2008-03-31 08:48 . 2008-03-31 08:48 <DIR> d--hs---- C:\FOUND.001 2008-03-30 22:17 . 2007-04-09 13:23 28,040 --a------ C:\WINDOWS\system32\mdimon.dll 2008-03-30 22:17 . 2008-03-30 22:17 421 --a------ C:\WINDOWS\ODBC.INI 2008-03-30 22:14 . 2008-03-30 22:14 <DIR> d-------- C:\WINDOWS\SHELLNEW 2008-03-29 19:39 . 2008-04-08 17:45 54,156 --ah----- C:\WINDOWS\QTFont.qfn 2008-03-29 19:39 . 2008-03-29 19:39 1,409 --a------ C:\WINDOWS\QTFont.for 2008-03-29 15:24 . 2008-03-29 15:24 <DIR> d-------- C:\Documents and Settings\Bolki\Dane aplikacji\Corel 2008-03-29 15:24 . 2008-03-29 15:24 848 --ahs---- C:\WINDOWS\system32\KGyGaAvL.sys 2008-03-29 15:21 . 2008-03-29 15:21 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\InstallShield 2008-03-29 15:18 . 2008-03-29 15:18 <DIR> d-------- C:\Program Files\Common Files\Corel 2008-03-29 14:36 . 2004-08-22 16:31 155,136 --a------ C:\WINDOWS\system32\drivers\d347bus.sys 2008-03-29 14:36 . 2004-08-22 16:31 5,248 --a------ C:\WINDOWS\system32\drivers\d347prt.sys 2008-03-28 19:01 . 2002-08-29 19:00 1,703,936 --a------ C:\WINDOWS\system32\gdiplus.dll 2008-03-28 19:01 . 2007-04-15 00:05 991,232 --a------ C:\WINDOWS\system32\imageviewer2.ocx 2008-03-28 19:01 . 2000-05-22 00:00 608,448 --a------ C:\WINDOWS\system32\comctl32.ocx 2008-03-28 19:01 . 2004-03-08 23:00 224,016 --a------ C:\WINDOWS\system32\tabctl32.ocx 2008-03-28 19:01 . 1996-01-12 00:00 200,704 --a------ C:\WINDOWS\system32\threed32.ocx 2008-03-28 19:01 . 1998-06-24 00:00 164,144 --a------ C:\WINDOWS\system32\comct232.ocx 2008-03-28 19:01 . 1999-09-16 09:04 151,552 --a------ C:\WINDOWS\system32\ccrpfd6.ocx 2008-03-28 19:01 . 2000-05-01 23:02 110,592 --a------ C:\WINDOWS\system32\ccrpbds6.dll 2008-03-28 19:01 . 2000-07-09 18:15 106,496 --a------ C:\WINDOWS\system32\mbprgbar.ocx 2008-03-27 16:00 . 2004-08-03 23:08 26,496 --a------ C:\WINDOWS\system32\dllcache\usbstor.sys 2008-03-27 15:59 . 2004-08-03 23:08 31,616 --a------ C:\WINDOWS\system32\drivers\usbccgp.sys 2008-03-27 15:59 . 2004-08-03 23:08 31,616 --a------ C:\WINDOWS\system32\dllcache\usbccgp.sys 2008-03-26 20:42 . 2008-03-26 20:42 4 --a------ C:\WINDOWS\system32\proc20744962.bin 2008-03-26 20:36 . 2008-03-26 20:36 <DIR> d-------- C:\Program Files\MSXML 4.0 2008-03-25 15:18 . 2008-03-25 15:18 <DIR> d-------- C:\Documents and Settings\Bolki\Dane aplikacji\Apple Computer 2008-03-25 12:38 . 2008-03-29 19:44 7,858 --a------ C:\logfile 2008-03-25 12:06 . 2008-03-25 12:06 <DIR> d-------- C:\Documents and Settings\Bolki\Dane aplikacji\gtk-2.0 2008-03-25 12:06 . 2008-03-25 12:06 <DIR> d-------- C:\Documents and Settings\Bolki\.thumbnails 2008-03-25 12:01 . 2008-03-25 12:01 <DIR> d-------- C:\Documents and Settings\Bolki\.gimp-2.4 2008-03-25 11:59 . 2008-03-25 11:59 <DIR> d-------- C:\Program Files\GIMP-2.0 2008-03-25 11:35 . 2008-03-25 11:35 <DIR> d-------- C:\WINDOWS\system32\DRVSTORE 2008-03-25 11:35 . 2008-03-25 11:35 <DIR> d-------- C:\Program Files\QuickTime 2008-03-25 11:35 . 2008-03-25 11:35 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Apple Computer 2008-03-25 11:34 . 2008-03-25 11:34 <DIR> d-------- C:\Program Files\Common Files\Kodak 2008-03-25 11:34 . 2004-08-04 00:44 159,232 --a------ C:\WINDOWS\system32\ptpusd.dll 2008-03-25 11:34 . 2004-08-03 22:58 15,104 --a------ C:\WINDOWS\system32\drivers\usbscan.sys 2008-03-25 11:34 . 2004-08-03 22:58 15,104 --a------ C:\WINDOWS\system32\dllcache\usbscan.sys 2008-03-25 11:34 . 2001-10-26 17:29 5,632 --a------ C:\WINDOWS\system32\ptpusb.dll 2008-03-25 11:32 . 2008-03-25 11:32 <DIR> d-------- C:\Program Files\Kodak 2008-03-25 11:31 . 2008-03-25 11:31 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Kodak 2008-03-24 13:09 . 2008-03-24 13:24 690 --a------ C:\WINDOWS\eReg.dat 2008-03-24 13:02 . 2008-03-24 13:02 <DIR> d-------- C:\WINDOWS\Downloaded Installations 2008-03-24 10:41 . 2008-03-24 10:41 <DIR> d-------- C:\WINDOWS\Sun 2008-03-24 10:40 . 2008-02-22 02:33 69,632 --a------ C:\WINDOWS\system32\javacpl.cpl 2008-03-24 10:39 . 2008-03-24 10:39 <DIR> d-------- C:\Program Files\Java 2008-03-24 10:36 . 2008-03-24 10:36 <DIR> d-------- C:\Program Files\Common Files\Java 2008-03-24 10:29 . 2008-03-24 10:29 <DIR> d-------- C:\Program Files\Common Files\Onet.pl 2008-03-24 10:29 . 2008-03-24 10:29 <DIR> d-------- C:\Documents and Settings\Bolki\Dane aplikacji\Kamerzysta 2008-03-24 10:29 . 2008-03-24 10:29 <DIR> d-------- C:\Documents and Settings\Bolki\Dane aplikacji\AutoUpdate 2008-03-24 10:19 . 2008-03-24 10:19 <DIR> d-------- C:\Documents and Settings\Bolki\Dane aplikacji\skypePM 2008-03-24 10:19 . 2008-03-24 10:19 32 --a------ C:\Documents and Settings\All Users\Dane aplikacji\ezsid.dat 2008-03-24 10:17 . 2008-03-24 10:17 <DIR> d-------- C:\Documents and Settings\Bolki\Dane aplikacji\Skype 2008-03-24 10:14 . 2008-03-24 10:14 <DIR> d-------- C:\Program Files\Skype 2008-03-24 10:14 . 2008-03-24 10:14 <DIR> d-------- C:\Program Files\Common Files\Skype 2008-03-24 10:14 . 2008-03-24 10:14 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Skype 2008-03-23 14:35 . 2008-03-23 14:35 <DIR> d-------- C:\Documents and Settings\Bolki\Dane aplikacji\Media Player Classic 2008-03-23 14:35 . 2008-04-08 20:31 69 --a------ C:\WINDOWS\NeroDigital.ini 2008-03-23 14:03 . 2008-03-23 14:03 <DIR> d-------- C:\Program Files\Common Files\Nero 2008-03-23 14:02 . 2000-06-26 11:45 106,496 --a------ C:\WINDOWS\system32\TwnLib20.dll 2008-03-23 14:01 . 2008-03-23 14:01 <DIR> d-------- C:\Program Files\Common Files\Ahead 2008-03-23 14:01 . 2004-07-26 17:16 1,568,768 --------- C:\WINDOWS\system32\ImagX7.dll 2008-03-23 14:01 . 2004-07-26 17:16 476,320 --------- C:\WINDOWS\system32\ImagXpr7.dll 2008-03-23 14:01 . 2004-07-26 17:16 471,040 --------- C:\WINDOWS\system32\ImagXRA7.dll 2008-03-23 14:01 . 2004-07-26 17:16 262,144 --------- C:\WINDOWS\system32\ImagXR7.dll 2008-03-23 14:01 . 2001-07-09 11:50 155,648 --a------ C:\WINDOWS\system32\NeroCheck.exe 2008-03-23 08:47 . 2004-10-11 18:21 372,736 -ra------ C:\WINDOWS\system32\LVUI2RC.dll 2008-03-23 08:41 . 2008-03-23 08:41 <DIR> d-------- C:\Program Files\Common Files\Logitech 2008-03-23 08:41 . 2004-12-14 19:16 53,248 -ra------ C:\WINDOWS\system32\InstMed.exe 2008-03-23 08:40 . 2008-03-23 08:40 <DIR> d-------- C:\Program Files\Logitech 2008-03-23 06:59 . 2008-03-23 06:59 <DIR> d-------- C:\Downloads 2008-03-23 06:43 . 2008-04-10 08:08 727 --a------ C:\WINDOWS\wcx_ftp.ini 2008-03-23 06:42 . 2008-04-10 15:36 582 --a------ C:\WINDOWS\wincmd.ini 2008-03-23 06:42 . 2002-11-04 05:50 545 --a------ C:\WINDOWS\UC.PIF 2008-03-23 06:42 . 2002-11-04 05:50 545 --a------ C:\WINDOWS\RAR.PIF 2008-03-23 06:42 . 2002-11-04 05:50 545 --a------ C:\WINDOWS\PKZIP.PIF 2008-03-23 06:42 . 2002-11-04 05:50 545 --a------ C:\WINDOWS\PKUNZIP.PIF 2008-03-23 06:42 . 2002-11-04 05:50 545 --a------ C:\WINDOWS\NOCLOSE.PIF 2008-03-23 06:42 . 2002-11-04 05:50 545 --a------ C:\WINDOWS\LHA.PIF 2008-03-23 06:42 . 2002-11-04 05:50 545 --a------ C:\WINDOWS\ARJ.PIF 2008-03-22 21:38 . 2008-03-22 21:38 <DIR> d-------- C:\Documents and Settings\Bolki\Dane aplikacji\Thinstall 2008-03-22 21:32 . 2008-03-01 15:02 6,066,176 --------- C:\WINDOWS\system32\dllcache\ieframe.dll 2008-03-22 21:32 . 2007-07-01 04:31 2,455,488 --------- C:\WINDOWS\system32\dllcache\ieapfltr.dat 2008-03-22 21:32 . 2007-07-01 04:36 1,036,288 --------- C:\WINDOWS\system32\dllcache\ieframe.dll.mui 2008-03-22 21:32 . 2008-03-01 15:02 459,264 --------- C:\WINDOWS\system32\dllcache\msfeeds.dll . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-03-22 14:38 33 ----a-w C:\WINDOWS\system32\drivers\adidsl.cfg 2008-03-22 13:50 --------- d-----w C:\Program Files\microsoft frontpage 2008-03-22 13:49 --------- d-----w C:\Program Files\Usługi online 2008-03-20 08:09 1,845,504 ----a-w C:\WINDOWS\system32\win32k.sys 2008-03-20 08:09 1,845,504 ------w C:\WINDOWS\system32\dllcache\win32k.sys 2008-03-01 16:32 3,591,680 ------w C:\WINDOWS\system32\dllcache\mshtml.dll 2008-02-29 08:59 70,656 ------w C:\WINDOWS\system32\dllcache\ie4uinit.exe 2008-02-29 08:59 625,664 ------w C:\WINDOWS\system32\dllcache\iexplore.exe 2008-02-20 06:51 282,624 ----a-w C:\WINDOWS\system32\gdi32.dll 2008-02-20 06:51 282,624 ------w C:\WINDOWS\system32\dllcache\gdi32.dll 2008-02-20 05:38 45,568 ----a-w C:\WINDOWS\system32\dnsrslvr.dll 2008-02-20 05:38 45,568 ------w C:\WINDOWS\system32\dllcache\dnsrslvr.dll 2008-02-20 05:38 148,992 ------w C:\WINDOWS\system32\dllcache\dnsapi.dll 2008-02-15 05:44 161,792 ------w C:\WINDOWS\system32\dllcache\ieakui.dll 2008-01-10 11:16 159,839 ----a-w C:\WINDOWS\system32\xvidvfw.dll 2008-01-10 11:15 755,027 ----a-w C:\WINDOWS\system32\xvidcore.dll . ((((((((((((((((((((((((((((( snapshot_2008-04-10_19.13.14.34 ))))))))))))))))))))))))))))))))))))))))) . + 2008-04-09 08:45:50 163,328 ----a-w C:\WINDOWS\ERUNT\SDFIX\ERDNT.EXE + 2008-04-10 18:45:30 2,629,632 ----a-w C:\WINDOWS\ERUNT\SDFIX\Users\[u]0[/u]0000001\ntuser.dat + 2008-04-10 18:45:30 258,048 ----a-w C:\WINDOWS\ERUNT\SDFIX\Users\[u]0[/u]0000002\UsrClass.dat + 2008-04-09 08:45:50 163,328 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\ERDNT.EXE + 2008-04-10 18:45:28 2,629,632 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\Users\[u]0[/u]0000001\ntuser.dat + 2008-04-10 18:45:28 258,048 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\Users\[u]0[/u]0000002\UsrClass.dat . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "AutoConnect"="f:\Program Files\AutoConnect\AutoConnect.exe" [2004-08-28 19:27 295424] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-03 22:44 15360] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SoundMan"="SOUNDMAN.EXE" [2005-04-15 04:01 77824 C:\WINDOWS\SOUNDMAN.EXE] "AtiPTA"="atiptaxx.exe" [2006-02-22 02:05 344064 C:\WINDOWS\system32\atiptaxx.exe] "MKS_MENU"="f:\Program Files\MKS\Bin\mks_menu.exe" [2008-03-22 16:30 125952] "ABREGMON"="F:\Program Files\MKS\Bin\ABregmon.exe" [2008-03-22 16:30 70656] "WinampAgent"="f:\Program Files\Winamp\winampa.exe" [2003-12-13 01:50 33792] "LVCOMSX"="C:\WINDOWS\system32\LVCOMSX.EXE" [2004-12-14 18:19 221184] "LogitechVideoRepair"="C:\Program Files\Logitech\Video\ISStart.exe" [2004-12-14 18:57 458752] "LogitechVideoTray"="C:\Program Files\Logitech\Video\LogiTray.exe" [2004-12-14 18:51 217088] "NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 11:50 155648] "Onet.pl AutoUpdate"="C:\Program Files\Common Files\Onet.pl\NewAutoUpdate.exe" [ ] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 04:25 144784] "QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2007-06-29 06:24 286720] "DAEMON Tools-1033"="F:\Program Files\D-Tools\daemon.exe" [2004-08-22 17:05 81920] "ISUSPM Startup"="C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" [2005-08-11 16:30 249856] "ISUSScheduler"="C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [2005-08-11 16:30 81920] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-03 22:44 15360] C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\ DSLMON.lnk - C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe [2008-03-22 16:38:47 839680] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "VIDC.I420"= lvcodec2.dll "MSVideo"= vfwwdm32.dll "MSVideo8"= VfWWDM32.dll "VIDC.YV12"= yv12vfw.dll "msacm.ac3acm"= ac3acm.acm "msacm.lameacm"= lameACM.acm [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "f:\\Program Files\\Wapster\\AQQ\\AQQ.exe"= "F:\\PROGRA~1\\Wapster\\AQQ\\AQQ.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "F:\\Program Files\\totalcmd\\TOTALCMD.EXE"= "C:\\Program Files\\Kodak\\Kodak EasyShare software\\bin\\EasyShare.exe"= "C:\\Program Files\\Skype\\Phone\\Skype.exe"= R0 nvcchflt;NVIDIA Disk Cache Filter Driver;C:\WINDOWS\system32\DRIVERS\nvcchflt.sys [2005-02-12 02:11] R1 ABTDI;ABTDI;f:\Program Files\MKS\Bin\ABTDI.sys [2008-03-22 16:30] R3 e4usbaw;USB ADSL2 WAN Adapter;C:\WINDOWS\system32\DRIVERS\e4usbaw.sys [2006-09-19 11:03] R3 MksMonFd;MkS_Mon Kernel Filter Driver;f:\Program Files\MKS\Bin\MksMonFd.sys [2008-03-22 16:30] S2 IKANLOADER2;General Purpose USB Driver (e4ldr.sys);C:\WINDOWS\system32\Drivers\e4ldr.sys [2006-09-15 11:07] S3 MksMonEn;MkS_Mon Kernel Engine;f:\Program Files\MKS\Bin\MksMonEn.sys [2008-03-22 16:30] S3 MksMonEv;MkS_Mon Kernel Events;f:\Program Files\MKS\Bin\MksMonEv.sys [2008-03-22 16:30] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{029b15cf-f825-11dc-9783-806d6172696f}] \Shell\AutoRun\command - I:\AUTORUN\AUTORUN.EXE . ************************************************************************** catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-04-10 20:54:31 Windows 5.1.2600 Dodatek Service Pack 2 FAT NTAPI scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2008-04-10 20:54:43 ComboFix-quarantined-files.txt 2008-04-10 18:54:42 ComboFix3.txt 2008-04-07 17:39:06 ComboFix2.txt 2008-04-10 17:16:08 Pre-Run: 3,392,229,376 bajtów wolnych Post-Run: 3,384,205,312 bajtów wolnych . 2008-04-09 14:48:00 --- E O F ---

**Posty:** 18165 · przez **wojtas** 10 Kwi 2008, 22:01

daj raport jeszcze z sdfixa

wystepuje jeszcze jakis problem?

**Posty:** 15 · przez **Rudy13** 10 Kwi 2008, 22:24

No na razie nie widze nic niepokojącego... A to mam usunąć jakiś folder?

Wielkie dzięki za pomoc. Naprawde dziękuwa;d

Kod: Zaznacz wszystko: [b]SDFix: Version 1.168 [/b] Run by Bolki on 2008-04-10 at 20:46 Microsoft Windows XP [Wersja 5.1.2600] Running From: C:\SDFix [b]Checking Services [/b]: Restoring Windows Registry Values Restoring Windows Default Hosts File Rebooting [b]Checking Files [/b]: No Trojan Files Found

**Posty:** 18165 · przez **wojtas** 10 Kwi 2008, 22:25

raport z sdfixa za krótki

wykonaj:

1. Ściągnij OTMoveIt i go włacz i odpal go z opcji CleanUp

2. wykonaj optymalizację windowsa
3.sciagnij ATF_Cleaner
zaznacz
Windows Temp
All users Temp
Temporary internet files
Recycle Bin
i wcisnij EMPTY SELECTED
4.Wyłącz przywracanie systemu ( właściwości mój komputer-zakładka przywracanie - wyłącz przywracanie na wszystkich dyskach). Po chwili włącz je powrotem i bedzie OK

amvo - prośba o sprawdzenie loga

amvo - Prośba o sprawdzenie loga

Kto jest na forum