Prosze o sprawdzenie loga , komputer sie wiesza

**Posty:** 72 · przez **Quakker** 01 Kwi 2009, 20:44

jak w temacie .... co chwile sie wiesza i strasznie muli...

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 20:23, on 2009-04-01 Platform: Windows XP Dodatek SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\RTHDCPL.EXE C:\Program Files\A4Tech\Mouse\Amoumain.exe C:\Program Files\Comodo\Firewall\CPF.exe C:\Program Files\Java\jre6\bin\jusched.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\RUNDLL32.EXE C:\Program Files\Winamp\winampa.exe C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\DAEMON Tools Lite\daemon.exe C:\Program Files\Messenger\msmsgs.exe C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe C:\Program Files\Comodo\Firewall\cmdagent.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\Program Files\Sony\Shared Plug-Ins\Media Manager\MSSQL$SONY_MEDIAMGR\Binn\sqlservr.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\HPZipm12.exe C:\WINDOWS\system32\PnkBstrA.exe E:\GTA4\Rockstar Games Social Club\1_1_3_0\RGSC.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\system32\wuauclt.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Documents and Settings\Tomek\Pulpit\HiJackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.bearshare.com/pl R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll O3 - Toolbar: DAEMON Tools Toolbar - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [WheelMouse] C:\Program Files\A4Tech\Mouse\Amoumain.exe O4 - HKLM\..\Run: [amd_dc_opt] C:\Program Files\AMD\Dual-Core Optimizer\amd_dc_opt.exe O4 - HKLM\..\Run: [COMODO Firewall Pro] "C:\Program Files\Comodo\Firewall\CPF.exe" /background O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe" O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe" O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun O4 - HKCU\..\Run: [Komunikator] C:\Program Files\Tlen.pl\tlen.exe O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [RGSC] E:\GTA4\Rockstar Games Social Club\RGSCLauncher.exe /silent O4 - HKCU\..\Run: [Tomek] C:\Documents and Settings\Tomek\Tomek.exe /i O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Startup: RocketDock.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe O4 - Startup: TransBar.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat 2\TransBar\TransBar.exe O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe O23 - Service: Comodo Application Agent (CmdAgent) - COMODO - C:\Program Files\Comodo\Firewall\cmdagent.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe -- End of file - 6381 bytes

Kod: Zaznacz wszystko: ComboFix 09-03-31.04 - Tomek 2009-04-01 20:31:26.5 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.3.1250.1.1045.18.2047.1408 [GMT 2:00] Uruchomiony z: C:\Documents and Settings\Tomek\Pulpit\ComboFix.exe AV: avast! antivirus 4.8.1335 [VPS 090331-0] *On-access scanning enabled* (Updated) FW: ArcaFirewall 2007 *enabled* * Utworzono nowy punkt przywracania UWAGA - TEN KOMPUTER NIE MA ZAINSTALOWANEJ KONSOLI ODZYSKIWANIA !! . ((((((((((((((((((((((((((((((((((((((( Usunięto ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\WINDOWS\system32\5_exception.nls C:\WINDOWS\system32\hrpdcf.bin C:\WINDOWS\system32\kl80.bin C:\WINDOWS\system32\shell31.dll C:\WINDOWS\system32\wpv331232632526.cpx C:\WINDOWS\system32\wpv761232632494.cpx C:\WINDOWS\wiaserviv.log . ((((((((((((((((((((((((( Pliki utworzone od 2009-03-01 do 2009-04-01 ))))))))))))))))))))))))))))))) . 2009-03-27 00:11 . 2009-03-27 15:24 <DIR> d-------- C:\WINDOWS\leogeo_timebeat Uninstaller 2009-03-27 00:11 . 2008-09-19 13:21 252,390 --a------ C:\WINDOWS\leogeo_timebeat.swf 2009-03-27 00:11 . 2009-01-02 18:41 42,015 --a------ C:\WINDOWS\leogeo_timebeat.c2 2009-03-27 00:11 . 2009-01-02 18:46 679 --a------ C:\WINDOWS\leogeo_timebeat.c3 2009-03-27 00:11 . 2009-01-02 18:46 679 --a------ C:\WINDOWS\leogeo_timebeat.c1 2009-03-27 00:11 . 2006-10-24 18:06 639 --a------ C:\WINDOWS\leogeo_timebeat.c4 2009-03-10 15:34 . 2009-03-10 15:34 <DIR> d-------- C:\Program Files\Microsoft Silverlight 2009-03-08 01:00 . 2009-03-08 01:00 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Tlen.pl 2009-03-07 13:25 . 2009-04-01 18:33 <DIR> d-------- C:\Documents and Settings\Tomek\Dane aplikacji\Winamp . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-04-01 13:52 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard 2009-04-01 13:46 --------- d-----w C:\Documents and Settings\Tomek\Dane aplikacji\Nowe Gadu-Gadu 2009-03-14 19:41 --------- d--h--w C:\Program Files\InstallShield Installation Information 2009-03-07 23:03 --------- d-----w C:\Documents and Settings\Tomek\Dane aplikacji\Tlen.pl 2009-03-07 11:25 --------- d-----w C:\Program Files\Winamp 2009-02-24 17:29 --------- d-----w C:\Program Files\Sports Interactive 2009-02-22 15:46 --------- d-----w C:\Program Files\DC++ 2009-02-19 20:06 --------- d-----w C:\Documents and Settings\Tomek\Dane aplikacji\Ventrilo 2009-02-01 18:26 --------- d-----w C:\Program Files\Valve 2008-11-26 15:29 22,328 ----a-w C:\Documents and Settings\Tomek\Dane aplikacji\PnkBstrK.sys . ------- Sigcheck ------- 2004-08-04 01:44 693248 7d46293106e58ca7878509ccc4071f2f C:\WINDOWS\system32\wininet.dll 2004-08-04 01:44 693248 7d46293106e58ca7878509ccc4071f2f C:\WINDOWS\system32\dllcache\wininet.dll 2004-08-04 01:44 975872 196c130d31317fe53de984220b5e13b9 C:\WINDOWS\explorer.exe 2004-08-04 01:44 975872 196c130d31317fe53de984220b5e13b9 C:\WINDOWS\system32\dllcache\explorer.exe 2004-08-04 01:44 101888 6db9ebc8d26603f3b04c7c2809aaf935 C:\WINDOWS\system32\wuauclt.exe 2004-08-04 01:44 101888 6db9ebc8d26603f3b04c7c2809aaf935 C:\WINDOWS\system32\dllcache\wuauclt.exe . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 01:44 15360] "DAEMON Tools Lite"="C:\Program Files\DAEMON Tools Lite\daemon.exe" [2008-08-08 14:11 490952] "MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-08-04 00:55 1667584] "RGSC"="E:\GTA4\Rockstar Games Social Club\RGSCLauncher.exe" [2008-12-14 21:38 306088] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2008-11-12 15:54 13672448] "WheelMouse"="C:\Program Files\A4Tech\Mouse\Amoumain.exe" [2006-04-07 08:26 225280] "amd_dc_opt"="C:\Program Files\AMD\Dual-Core Optimizer\amd_dc_opt.exe" [2006-11-17 16:49 77824] "COMODO Firewall Pro"="C:\Program Files\Comodo\Firewall\CPF.exe" [2007-08-17 15:43 1115728] "SunJavaUpdateSched"="C:\Program Files\Java\jre6\bin\jusched.exe" [2008-12-07 14:18 136600] "NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 11:50 155648] "NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2008-11-12 15:54 86016] "WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2009-02-25 23:26 37888] "avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2009-02-05 22:08 81000] "RTHDCPL"="RTHDCPL.EXE" [2006-11-14 11:21 16270848 C:\WINDOWS\RTHDCPL.exe] "nwiz"="nwiz.exe" [2008-11-12 15:54 1630208 C:\WINDOWS\system32\nwiz.exe] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 01:44 15360] C:\Documents and Settings\Tomek\Menu Start\Programy\Autostart\ RocketDock.lnk - C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe [2007-03-19 00:05:02 630784] TransBar.lnk - C:\WINDOWS\BricoPacks\Vista Inspirat 2\TransBar\TransBar.exe [2005-06-01 21:41:18 65536] [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Adobe Gamma Loader.lnk] path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Adobe Gamma Loader.lnk backup=C:\WINDOWS\pss\Adobe Gamma Loader.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Adobe Reader Speed Launch.lnk] path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Adobe Reader Speed Launch.lnk backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^HP Digital Imaging Monitor.lnk] path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\HP Digital Imaging Monitor.lnk backup=C:\WINDOWS\pss\HP Digital Imaging Monitor.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^PC Alert 4.lnk] path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\PC Alert 4.lnk backup=C:\WINDOWS\pss\PC Alert 4.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^Tomek^Menu Start^Programy^Autostart^hamachi.lnk] path=C:\Documents and Settings\Tomek\Menu Start\Programy\Autostart\hamachi.lnk backup=C:\WINDOWS\pss\hamachi.lnkStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update] --a------ 2006-02-19 02:41 49152 C:\Program Files\HP\HP Software Update\hpwuSchd2.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IPLA!] --a------ 2008-12-08 15:26 2732792 C:\Program Files\ipla\ipla.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RGSC] --a------ 2008-12-14 21:38 306088 E:\GTA4\Rockstar Games Social Club\RGSCLauncher.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype] -ra------ 2007-09-13 13:31 22880040 C:\Program Files\Skype\Phone\Skype.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam] --a------ 2008-12-02 15:12 1410296 e:\CS\steam.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SkyTel] -r------- 2006-05-16 12:04 2879488 C:\WINDOWS\SkyTel.exe [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "D:\\Pekin08\\Beijing.exe"= "E:\\PES 09\\pes2009.exe"= "C:\\WINDOWS\\system32\\PnkBstrA.exe"= "C:\\WINDOWS\\system32\\PnkBstrB.exe"= "E:\\CoD5\\CoDWaW.exe"= "E:\\CoD5\\CoDWaWmp.exe"= "E:\\GTA4\\Rockstar Games Social Club\\RGSCLauncher.exe"= "E:\\GTA4\\Grand Theft Auto IV\\LaunchGTAIV.exe"= "C:\\Program Files\\Skype\\Phone\\Skype.exe"= "D:\\fm09\\fm.exe"= "C:\\WINDOWS\\system32\\userinit.exe"= R0 sojubus;sojubus;C:\WINDOWS\system32\drivers\sojubus.sys [2003-10-05 10:41:14 123520] R0 sojuscsi;sojuscsi;C:\WINDOWS\system32\drivers\sojuscsi.sys [2003-09-28 10:57:52 5504] R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2009-04-01 18:45:59 114768] R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\drivers\aswFsBlk.sys [2009-04-01 18:45:59 20560] R3 Amps2prt;A4Tech PS/2 Port Mouse Driver;C:\WINDOWS\system32\drivers\Amps2prt.sys [2006-01-11 08:34:00 13824] S2 acpi32;acpi32;\??\C:\WINDOWS\system32\drivers\acpi32.sys --> C:\WINDOWS\system32\drivers\acpi32.sys [?] S2 amd64si;amd64si;\??\C:\WINDOWS\system32\drivers\amd64si.sys --> C:\WINDOWS\system32\drivers\amd64si.sys [?] S2 ati64si;ati64si;\??\C:\WINDOWS\system32\drivers\ati64si.sys --> C:\WINDOWS\system32\drivers\ati64si.sys [?] S2 fips32cup;fips32cup;\??\C:\WINDOWS\system32\drivers\fips32cup.sys --> C:\WINDOWS\system32\drivers\fips32cup.sys [?] S3 {DEF85C80-216A-43ab-AF70-1665EDBE2780};{DEF85C80-216A-43ab-AF70-1665EDBE2780};\??\C:\WINDOWS\TEMP\346.tmp --> C:\WINDOWS\TEMP\346.tmp [?] S3 ZDCndis5;ZDCndis5 Protocol Driver;\??\C:\WINDOWS\system32\ZDCndis5.SYS --> C:\WINDOWS\system32\ZDCndis5.SYS [?] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\J] \Shell\AutoRun\command - J:\LaunchU3.exe -a [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c52b5790-1271-11de-96ca-0019db70a7f1}] \Shell\AutoRun\command - J:\LaunchU3.exe -a . - - - - USUNIĘTO PUSTE WPISY - - - - HKCU-Run-Komunikator - C:\Program Files\Tlen.pl\tlen.exe HKCU-Run-Tomek - C:\Documents and Settings\Tomek\Tomek.exe MSConfigStartUp-AGEIA PhysX SysTray - C:\Program Files\AGEIA Technologies\TrayIcon.exe . ------- Skan uzupełniający ------- . uStart Page = hxxp://google.bearshare.com/pl IE: E&ksport do programu Microsoft Excel - C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 FF - ProfilePath - C:\Documents and Settings\Tomek\Dane aplikacji\Mozilla\Firefox\Profiles\9ykqgopv.default\ FF - prefs.js: browser.search.selectedEngine - GooglePL FF - plugin: C:\Program Files\Mozilla Firefox\plugins\np-mswmp.dll ---- FIREFOX - SPOSÓB POSTĘPOWANIA ---- FF - user.js: browser.search.selectedEngine - GooglePL . ************************************************************************** catchme 0.3.1375 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-04-01 20:36:49 Windows 5.1.2600 Dodatek Service Pack 3 NTFS skanowanie ukrytych procesów ...

**Posty:** 18165 · przez **wojtas** 01 Kwi 2009, 22:48

Wykonaj to co jest podane w tym temacie

Zastosuj SDFix . Po pobraniu uruchom go a rozpakuje się do C:\SDFix. Uruchom komputer w trybie awaryjnym (F8 przy stracie systemu). Będąc w awaryjnym uruchom plik RunThis.bat z folderu SDFixa. Zatwierdź czyszczenie przez Y. Poczekaj aż ukończy i komputer zresetuje

Potem wejdz do folderu C:\SDFix wrzuc zawartość pliku Report.txt + log z combofixa oraz daj loga z hijacka

**Posty:** 72 · przez **Quakker** 02 Kwi 2009, 15:57

Kod: Zaznacz wszystko: ComboFix 09-03-31.04 - Tomek 2009-04-02 15:47:30.6 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.3.1250.1.1045.18.2047.1417 [GMT 2:00] Uruchomiony z: C:\Documents and Settings\Tomek\Pulpit\ComboFix.exe AV: avast! antivirus 4.8.1335 [VPS 090402-0] *On-access scanning enabled* (Updated) FW: ArcaFirewall 2007 *enabled* UWAGA - TEN KOMPUTER NIE MA ZAINSTALOWANEJ KONSOLI ODZYSKIWANIA !! . ((((((((((((((((((((((((((((((((((((((( Usunięto ))))))))))))))))))))))))))))))))))))))))))))))))) . . ---- Poprzednie uruchomienie ------- . C:\WINDOWS\system32\5_exception.nls C:\WINDOWS\system32\hrpdcf.bin C:\WINDOWS\system32\kl80.bin C:\WINDOWS\system32\shell31.dll C:\WINDOWS\system32\wpv331232632526.cpx C:\WINDOWS\system32\wpv761232632494.cpx C:\WINDOWS\wiaserviv.log . ((((((((((((((((((((((((( Pliki utworzone od 2009-03-02 do 2009-04-02 ))))))))))))))))))))))))))))))) . 2009-04-01 23:15 . 2009-04-01 23:15 <DIR> d-------- C:\WINDOWS\ERUNT 2009-04-01 23:09 . 2009-04-01 23:41 <DIR> d-------- C:\SDFix 2009-03-27 00:11 . 2009-03-27 15:24 <DIR> d-------- C:\WINDOWS\leogeo_timebeat Uninstaller 2009-03-27 00:11 . 2008-09-19 13:21 252,390 --a------ C:\WINDOWS\leogeo_timebeat.swf 2009-03-27 00:11 . 2009-01-02 18:41 42,015 --a------ C:\WINDOWS\leogeo_timebeat.c2 2009-03-27 00:11 . 2009-01-02 18:46 679 --a------ C:\WINDOWS\leogeo_timebeat.c3 2009-03-27 00:11 . 2009-01-02 18:46 679 --a------ C:\WINDOWS\leogeo_timebeat.c1 2009-03-27 00:11 . 2006-10-24 18:06 639 --a------ C:\WINDOWS\leogeo_timebeat.c4 2009-03-10 15:34 . 2009-03-10 15:34 <DIR> d-------- C:\Program Files\Microsoft Silverlight 2009-03-08 01:00 . 2009-03-08 01:00 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Tlen.pl 2009-03-07 13:25 . 2009-04-02 15:09 <DIR> d-------- C:\Documents and Settings\Tomek\Dane aplikacji\Winamp . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-04-01 13:52 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard 2009-04-01 13:46 --------- d-----w C:\Documents and Settings\Tomek\Dane aplikacji\Nowe Gadu-Gadu 2009-03-14 19:41 --------- d--h--w C:\Program Files\InstallShield Installation Information 2009-03-07 23:03 --------- d-----w C:\Documents and Settings\Tomek\Dane aplikacji\Tlen.pl 2009-03-07 11:25 --------- d-----w C:\Program Files\Winamp 2009-02-24 17:29 --------- d-----w C:\Program Files\Sports Interactive 2009-02-22 15:46 --------- d-----w C:\Program Files\DC++ 2009-02-19 20:06 --------- d-----w C:\Documents and Settings\Tomek\Dane aplikacji\Ventrilo 2008-11-26 15:29 22,328 ----a-w C:\Documents and Settings\Tomek\Dane aplikacji\PnkBstrK.sys . ------- Sigcheck ------- 2004-08-04 01:44 693248 7d46293106e58ca7878509ccc4071f2f C:\WINDOWS\system32\wininet.dll 2004-08-04 01:44 693248 7d46293106e58ca7878509ccc4071f2f C:\WINDOWS\system32\dllcache\wininet.dll 2004-08-04 01:44 975872 196c130d31317fe53de984220b5e13b9 C:\WINDOWS\explorer.exe 2004-08-04 01:44 975872 196c130d31317fe53de984220b5e13b9 C:\WINDOWS\system32\dllcache\explorer.exe 2004-08-04 01:44 101888 6db9ebc8d26603f3b04c7c2809aaf935 C:\WINDOWS\system32\wuauclt.exe 2004-08-04 01:44 101888 6db9ebc8d26603f3b04c7c2809aaf935 C:\WINDOWS\system32\dllcache\wuauclt.exe . ((((((((((((((((((((((((((((( SnapShot@2009-04-01_20.39.20.75 ))))))))))))))))))))))))))))))))))))))))) . + 2008-08-07 13:27:04 163,328 ----a-w C:\WINDOWS\ERUNT\SDFIX\ERDNT.EXE + 2009-04-01 21:16:01 10,829,824 ----a-w C:\WINDOWS\ERUNT\SDFIX\Users\00000001\NTUSER.DAT + 2009-04-01 21:16:01 200,704 ----a-w C:\WINDOWS\ERUNT\SDFIX\Users\00000002\UsrClass.dat + 2008-08-07 13:27:04 163,328 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\ERDNT.EXE + 2009-04-01 21:15:59 10,829,824 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\Users\00000001\NTUSER.DAT + 2009-04-01 21:15:59 200,704 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\Users\00000002\UsrClass.dat + 2009-04-02 13:34:54 16,384 ----atw C:\WINDOWS\Temp\Perflib_Perfdata_160.dat + 2009-04-02 13:44:04 16,384 ----atw C:\WINDOWS\Temp\Perflib_Perfdata_66c.dat + 2009-04-02 13:44:13 16,384 ----atw C:\WINDOWS\Temp\Perflib_Perfdata_7e4.dat . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 01:44 15360] "DAEMON Tools Lite"="C:\Program Files\DAEMON Tools Lite\daemon.exe" [2008-08-08 14:11 490952] "Komunikator"="C:\Program Files\Tlen.pl\tlen.exe" [BU] "MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-08-04 00:55 1667584] "RGSC"="E:\GTA4\Rockstar Games Social Club\RGSCLauncher.exe" [2008-12-14 21:38 306088] "Tomek"="C:\Documents and Settings\Tomek\Tomek.exe" [BU] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2008-11-12 15:54 13672448] "WheelMouse"="C:\Program Files\A4Tech\Mouse\Amoumain.exe" [2006-04-07 08:26 225280] "amd_dc_opt"="C:\Program Files\AMD\Dual-Core Optimizer\amd_dc_opt.exe" [2006-11-17 16:49 77824] "COMODO Firewall Pro"="C:\Program Files\Comodo\Firewall\CPF.exe" [2007-08-17 15:43 1115728] "SunJavaUpdateSched"="C:\Program Files\Java\jre6\bin\jusched.exe" [2008-12-07 14:18 136600] "NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 11:50 155648] "NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2008-11-12 15:54 86016] "WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2009-02-25 23:26 37888] "avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2009-02-05 22:08 81000] "RTHDCPL"="RTHDCPL.EXE" [2006-11-14 11:21 16270848 C:\WINDOWS\RTHDCPL.exe] "nwiz"="nwiz.exe" [2008-11-12 15:54 1630208 C:\WINDOWS\system32\nwiz.exe] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 01:44 15360] C:\Documents and Settings\Tomek\Menu Start\Programy\Autostart\ RocketDock.lnk - C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe [2007-03-19 00:05:02 630784] TransBar.lnk - C:\WINDOWS\BricoPacks\Vista Inspirat 2\TransBar\TransBar.exe [2005-06-01 21:41:18 65536] [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Adobe Gamma Loader.lnk] path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Adobe Gamma Loader.lnk backup=C:\WINDOWS\pss\Adobe Gamma Loader.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Adobe Reader Speed Launch.lnk] path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Adobe Reader Speed Launch.lnk backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^HP Digital Imaging Monitor.lnk] path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\HP Digital Imaging Monitor.lnk backup=C:\WINDOWS\pss\HP Digital Imaging Monitor.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^PC Alert 4.lnk] path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\PC Alert 4.lnk backup=C:\WINDOWS\pss\PC Alert 4.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^Tomek^Menu Start^Programy^Autostart^hamachi.lnk] path=C:\Documents and Settings\Tomek\Menu Start\Programy\Autostart\hamachi.lnk backup=C:\WINDOWS\pss\hamachi.lnkStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AGEIA PhysX SysTray] C:\Program Files\AGEIA Technologies\TrayIcon.exe [BU] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update] --a------ 2006-02-19 02:41 49152 C:\Program Files\HP\HP Software Update\hpwuSchd2.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RGSC] --a------ 2008-12-14 21:38 306088 E:\GTA4\Rockstar Games Social Club\RGSCLauncher.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype] -ra------ 2007-09-13 13:31 22880040 C:\Program Files\Skype\Phone\Skype.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam] --a------ 2008-12-02 15:12 1410296 e:\CS\steam.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SkyTel] -r------- 2006-05-16 12:04 2879488 C:\WINDOWS\SkyTel.exe [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "D:\\Pekin08\\Beijing.exe"= "E:\\PES 09\\pes2009.exe"= "E:\\CoD5\\CoDWaW.exe"= "E:\\CoD5\\CoDWaWmp.exe"= "E:\\GTA4\\Rockstar Games Social Club\\RGSCLauncher.exe"= "E:\\GTA4\\Grand Theft Auto IV\\LaunchGTAIV.exe"= "C:\\Program Files\\Skype\\Phone\\Skype.exe"= "D:\\fm09\\fm.exe"= "C:\\WINDOWS\\system32\\userinit.exe"= R0 sojubus;sojubus;C:\WINDOWS\system32\drivers\sojubus.sys [2003-10-05 10:41:14 123520] R0 sojuscsi;sojuscsi;C:\WINDOWS\system32\drivers\sojuscsi.sys [2003-09-28 10:57:52 5504] R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2009-04-01 18:45:59 114768] R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\drivers\aswFsBlk.sys [2009-04-01 18:45:59 20560] R3 Amps2prt;A4Tech PS/2 Port Mouse Driver;C:\WINDOWS\system32\drivers\Amps2prt.sys [2006-01-11 08:34:00 13824] S2 acpi32;acpi32;\??\C:\WINDOWS\system32\drivers\acpi32.sys --> C:\WINDOWS\system32\drivers\acpi32.sys [?] S2 amd64si;amd64si;\??\C:\WINDOWS\system32\drivers\amd64si.sys --> C:\WINDOWS\system32\drivers\amd64si.sys [?] S2 ati64si;ati64si;\??\C:\WINDOWS\system32\drivers\ati64si.sys --> C:\WINDOWS\system32\drivers\ati64si.sys [?] S2 fips32cup;fips32cup;\??\C:\WINDOWS\system32\drivers\fips32cup.sys --> C:\WINDOWS\system32\drivers\fips32cup.sys [?] S3 ZDCndis5;ZDCndis5 Protocol Driver;\??\C:\WINDOWS\system32\ZDCndis5.SYS --> C:\WINDOWS\system32\ZDCndis5.SYS [?] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\J] \Shell\AutoRun\command - J:\LaunchU3.exe -a [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c52b5790-1271-11de-96ca-0019db70a7f1}] \Shell\AutoRun\command - J:\LaunchU3.exe -a . - - - - USUNIĘTO PUSTE WPISY - - - - MSConfigStartUp-IPLA! - C:\Program Files\ipla\ipla.exe . ------- Skan uzupełniający ------- . uStart Page = hxxp://google.bearshare.com/pl IE: E&ksport do programu Microsoft Excel - C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 FF - ProfilePath - C:\Documents and Settings\Tomek\Dane aplikacji\Mozilla\Firefox\Profiles\9ykqgopv.default\ FF - prefs.js: browser.search.selectedEngine - GooglePL FF - plugin: C:\Program Files\Mozilla Firefox\plugins\np-mswmp.dll ---- FIREFOX - SPOSÓB POSTĘPOWANIA ---- FF - user.js: browser.search.selectedEngine - GooglePL .

Kod: Zaznacz wszystko: [b]SDFix: Version 1.240 [/b] Run by Tomek on 2009-04-01 at 23:17 Microsoft Windows XP [Wersja 5.1.2600] Running From: C:\SDFix [b]Checking Services [/b]: [b]Name [/b]: {DEF85C80-216A-43ab-AF70-1665EDBE2780} [b]Path [/b]: \??\C:\WINDOWS\TEMP\346.tmp {DEF85C80-216A-43ab-AF70-1665EDBE2780} - Deleted Restoring Default Security Values Restoring Default Hosts File Rebooting [b]Checking Files [/b]: No Trojan Files Found [color=red]Note - Files associated with the MBR Rootkit have been found on this system, to check the PC use the [url=http://www2.gmer.net/mbr/]MBR Rootkit Detector[/url] by Gmer[/color] Removing Temp Files [b]ADS Check [/b]: [b]Final Check [/b]: catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-04-01 23:40:19 Windows 5.1.2600 Dodatek Service Pack 3 NTFS scanning hidden processes ... scanning hidden services & system hive ... [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg] "s1"=dword:1a2b0ed6 "s2"=dword:7a6d5c6f "h0"=dword:00000002 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC] "h0"=dword:00000001 "hdf12"=hex:fc,1b,72,19,b4,b9,7e,75,1e,47,1c,ac,ff,3a,e9,03,93,bd,11,11,12,.. [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4] "h0"=dword:00000000 "khjeh"=hex:16,1f,54,81,4f,16,ca,65,fe,6a,93,8a,be,dd,d0,76,6a,fa,d3,ef,b4,.. "p0"="C:\Program Files\DAEMON Tools Lite\" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001] "a0"=hex:20,01,00,00,0a,5a,da,3f,52,70,95,76,56,55,f5,74,fa,90,9a,54,2c,.. "khjeh"=hex:41,24,36,02,e3,88,04,da,a3,2b,42,67,19,62,93,e5,4d,f3,a3,96,92,.. [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40] "khjeh"=hex:77,54,53,75,6b,29,0a,95,e5,b4,bd,6d,9d,0a,84,01,1c,d4,39,11,f1,.. [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41] "khjeh"=hex:89,07,1e,b6,9e,f8,05,aa,fb,e3,f0,4a,36,fe,0b,af,2e,48,8b,e6,01,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC] "h0"=dword:00000001 "hdf12"=hex:fc,1b,72,19,b4,b9,7e,75,1e,47,1c,ac,ff,3a,e9,03,93,bd,11,11,12,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4] "h0"=dword:00000000 "khjeh"=hex:16,1f,54,81,4f,16,ca,65,fe,6a,93,8a,be,dd,d0,76,6a,fa,d3,ef,b4,.. "p0"="C:\Program Files\DAEMON Tools Lite\" [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001] "a0"=hex:20,01,00,00,0a,5a,da,3f,52,70,95,76,56,55,f5,74,fa,90,9a,54,2c,.. "khjeh"=hex:41,24,36,02,e3,88,04,da,a3,2b,42,67,19,62,93,e5,4d,f3,a3,96,92,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40] "khjeh"=hex:77,54,53,75,6b,29,0a,95,e5,b4,bd,6d,9d,0a,84,01,1c,d4,39,11,f1,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41] "khjeh"=hex:89,07,1e,b6,9e,f8,05,aa,fb,e3,f0,4a,36,fe,0b,af,2e,48,8b,e6,01,.. scanning hidden registry entries ... [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] "AppInit_DLLs"="" "DeviceNotSelectedTimeout"="15" "GDIProcessHandleQuota"=dword:00002710 "Spooler"="yes" "swapdisk"="" "TransmissionRetryTimeout"="90" "USERProcessHandleQuota"=dword:00002710 scanning hidden files ... scan completed successfully hidden processes: 0 hidden services: 0 hidden files: 0 [b]Remaining Services [/b]: Authorized Application Key Export: [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] "D:\\Pekin08\\Beijing.exe"="D:\\Pekin08\\Beijing.exe:*:Enabled:Beijing 2008™" "E:\\PES 09\\pes2009.exe"="E:\\PES 09\\pes2009.exe:*:Enabled:Pro Evolution Soccer 2009" "C:\\WINDOWS\\system32\\PnkBstrA.exe"="C:\\WINDOWS\\system32\\PnkBstrA.exe:*:Enabled:PnkBstrA" "C:\\WINDOWS\\system32\\PnkBstrB.exe"="C:\\WINDOWS\\system32\\PnkBstrB.exe:*:Enabled:PnkBstrB" "E:\\CoD5\\CoDWaW.exe"="E:\\CoD5\\CoDWaW.exe:*:Enabled:Call of Duty(R) - World at War(TM) " "E:\\CoD5\\CoDWaWmp.exe"="E:\\CoD5\\CoDWaWmp.exe:*:Enabled:Call of Duty(R) - World at War(TM) " "E:\\GTA4\\Rockstar Games Social Club\\RGSCLauncher.exe"="E:\\GTA4\\Rockstar Games Social Club\\RGSCLauncher.exe:*:Enabled:Rockstar Games Social Club" "E:\\GTA4\\Grand Theft Auto IV\\LaunchGTAIV.exe"="E:\\GTA4\\Grand Theft Auto IV\\LaunchGTAIV.exe:*:Enabled:Grand Theft Auto IV" "C:\\Program Files\\Skype\\Phone\\Skype.exe"="C:\\Program Files\\Skype\\Phone\\Skype.exe:*:Enabled:Skype" "D:\\fm09\\fm.exe"="D:\\fm09\\fm.exe:*:Enabled:Football Manager 2009" "C:\\WINDOWS\\system32\\userinit.exe"="C:\\WINDOWS\\system32\\userinit.exe:*:Enabled:ENABLE" [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list] [b]Remaining Files [/b]: File Backups: - C:\SDFix\backups\backups.zip [b]Files with Hidden Attributes [/b]: Tue 15 Jan 2002 548,864 A.SH. --- "C:\Program Files\DBME2k8\ALLEG40.DLL" Tue 29 Jul 2008 230,912 A.SH. --- "C:\Program Files\DBME2k8\cheat.exe" Sun 27 Jul 2008 161,792 A.SH. --- "C:\Program Files\DBME2k8\readme.exe" Sat 26 Jul 2008 285,696 A.SH. --- "C:\Program Files\DBME2k8\Winmugen.exe" Wed 13 Mar 2002 53,248 A.SH. --- "C:\Program Files\DBME2k8\zlib.dll" Wed 12 Mar 2008 4,348 ..SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak" Mon 28 Aug 2006 20,480 A.SH. --- "C:\Program Files\DBME2k8\plugins\in_adx.dll" Mon 28 Aug 2006 200,704 A.SH. --- "C:\Program Files\DBME2k8\plugins\in_ape.dll" Mon 28 Aug 2006 17,920 A.SH. --- "C:\Program Files\DBME2k8\plugins\in_bass.dll" Mon 28 Aug 2006 181,248 A.SH. --- "C:\Program Files\DBME2k8\plugins\in_mad.dll" Thu 15 Apr 2004 303,104 A.SH. --- "C:\Program Files\DBME2k8\plugins\in_mad150b.dll" Mon 28 Aug 2006 207,872 A.SH. --- "C:\Program Files\DBME2k8\plugins\in_mp3.dll" Mon 28 Aug 2006 438,272 A.SH. --- "C:\Program Files\DBME2k8\plugins\in_mp3pro.dll" Mon 28 Aug 2006 304,128 A.SH. --- "C:\Program Files\DBME2k8\plugins\in_psf.dll" Mon 28 Aug 2006 156,672 A.SH. --- "C:\Program Files\DBME2k8\plugins\in_qsf.dll" Mon 28 Aug 2006 226,816 A.SH. --- "C:\Program Files\DBME2k8\plugins\in_vorbis.dll" Mon 28 Aug 2006 37,888 A.SH. --- "C:\Program Files\DBME2k8\plugins\in_ym.dll" Sat 20 Oct 2007 1,745 ...HR --- "C:\Documents and Settings\Tomek\Dane aplikacji\SecuROM\UserData\securom_v7_01.bak" [b]Finished![/b]

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 15:57, on 2009-04-02 Platform: Windows XP Dodatek SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\RTHDCPL.EXE C:\Program Files\A4Tech\Mouse\Amoumain.exe C:\Program Files\Comodo\Firewall\CPF.exe C:\Program Files\Java\jre6\bin\jusched.exe C:\WINDOWS\system32\RUNDLL32.EXE C:\Program Files\Winamp\winampa.exe C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\DAEMON Tools Lite\daemon.exe C:\Program Files\Messenger\msmsgs.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe C:\Program Files\Comodo\Firewall\cmdagent.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\Program Files\Sony\Shared Plug-Ins\Media Manager\MSSQL$SONY_MEDIAMGR\Binn\sqlservr.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\HPZipm12.exe E:\GTA4\Rockstar Games Social Club\1_1_3_0\RGSC.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\WINDOWS\system32\wscntfy.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\WINDOWS\system32\wuauclt.exe C:\Documents and Settings\Tomek\Pulpit\HiJackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.bearshare.com/pl R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [WheelMouse] C:\Program Files\A4Tech\Mouse\Amoumain.exe O4 - HKLM\..\Run: [amd_dc_opt] C:\Program Files\AMD\Dual-Core Optimizer\amd_dc_opt.exe O4 - HKLM\..\Run: [COMODO Firewall Pro] "C:\Program Files\Comodo\Firewall\CPF.exe" /background O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe" O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe" O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun O4 - HKCU\..\Run: [Komunikator] C:\Program Files\Tlen.pl\tlen.exe O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [RGSC] E:\GTA4\Rockstar Games Social Club\RGSCLauncher.exe /silent O4 - HKCU\..\Run: [Tomek] C:\Documents and Settings\Tomek\Tomek.exe /i O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Startup: RocketDock.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe O4 - Startup: TransBar.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat 2\TransBar\TransBar.exe O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe O23 - Service: Comodo Application Agent (CmdAgent) - COMODO - C:\Program Files\Comodo\Firewall\cmdagent.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe -- End of file - 6222 bytes

**Posty:** 18165 · przez **wojtas** 02 Kwi 2009, 17:57

skasuj;

O4 - HKCU\..\Run: [Tomek] C:\Documents and Settings\Tomek\Tomek.exe /i

. Wykonaj skan Dr. Web CureIt
2. Robisz loga z mbr.exe

**Posty:** 72 · przez **Quakker** 02 Kwi 2009, 22:09

Kod: Zaznacz wszystko: Stealth MBR rootkit detector 0.2.4 by Gmer, http://www.gmer.net device: opened successfully user: MBR read successfully kernel: MBR read successfully user & kernel MBR OK

**Posty:** 18165 · przez **wojtas** 02 Kwi 2009, 22:15

1. Ściągnij OTMoveIt i go włacz i odpal go z opcji CleanUp

oraz skasuj folder C:\Qoobox
2. wykonaj optymalizację windowsa
3.sciagnij ATF_Cleaner
zaznacz
Windows Temp
All users Temp
Temporary internet files
Recycle Bin
i wcisnij EMPTY SELECTED
4.Wyłącz przywracanie systemu ( właściwości mój komputer-zakładka przywracanie - wyłącz przywracanie na wszystkich dyskach). Po chwili włącz je powrotem
5. Wykonaj skan Dr. Web CureIt
6. Przeskanuj obszar mojego komputera http://www.kaspersky.pl/virusscanner.html (uruchom przez IE) Daj raport z niego na forum.

i tym:

FixIEDef.

**Posty:** 72 · przez **Quakker** 03 Kwi 2009, 22:58

Kod: Zaznacz wszystko: ******************************************************************************** * * * FixIEDef Log * * Version 1.7.22.7514 * * * ******************************************************************************** Created at 21:36:04 on Friday, April 03, 2009 Time Zone : Logged On User : Tomek Operating System : Microsoft Windows XP Professional Dodatek Service Pack 3 OS Architecture : X86 System Langauge : Polish Keyboard Layout : Polish Processor : X64 AMD Athlon(tm) 64 X2 Dual Core Processor 4800+ System Drive : C:\ Windows Directory : C:\WINDOWS System Directory : C:\WINDOWS\system32 System Drive Type : Fixed System Drive Status : READY System Drive Label : System Drive Size : 30 GB System Drive Free : 2.59 GB Total Physical Memory: 2047 MB Free Physical Memory : 1558 MB Total Page File : 2047 MB Free Page File : 3499 MB Total Virtual Memory : 2048 MB Free Virtual Memory : 1957 MB Boot State : Normal boot -------------------------------------------------------------------------------- !!! userinit.exe is Clean !!! -------------------------------------------------------------------------------- !!! Files that have been deleted !!! No malicious files found -------------------------------------------------------------------------------- !!! Directories that have been removed !!! No malicious directories to be removed -------------------------------------------------------------------------------- !!! Registry entries that have been removed !!! No malicious Registry entries found ================================================================================ All Done :) ShadowPuterDude Safe Surfing!!!

Kasperskym nie da rady przeskanowac bo sie wiesza... ;/

**Posty:** 18165 · przez **wojtas** 04 Kwi 2009, 14:11

no czyli powinno być czysto

Autor postu otrzymał pochwałę

**Posty:** 72 · przez **Quakker** 06 Kwi 2009, 15:42

Jeszcze jeden problem... gg nie chce sie zaladowac ... wyskakuje crash reporter

, przeinstalowanie z wyczyszczeniem rejestru nic nie dalo ... z straszymi wersjami gg jest to samo

**Posty:** 18165 · przez **wojtas** 06 Kwi 2009, 17:16

napisz może do nich ... a jak nie to może na innej partycji zainstaluj .. jesli nie pomoże to ja tez nie wiem