Błąd z plikiem .exe.problem z odpaleniem gry

**Posty:** 14 · przez **Fagi** 01 Kwi 2009, 23:17

Bardzo proszę o sprawdzenie loga, bo przypuszczam że problem z odpaleniem gry która wcześniej działała mi bez zarzutu może być spowodowany jakimś syfem na dysku systemowym:/

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 23:14, on 2009-04-01 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.5730.0013) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\PnkBstrA.exe C:\Program Files\VDOTool\TBPanel.exe C:\Program Files\Winamp\winampa.exe C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe C:\WINDOWS\RTHDCPL.EXE C:\WINDOWS\system32\RUNDLL32.EXE C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Messenger\msmsgs.exe C:\Program Files\DAEMON Tools\daemon.exe C:\Program Files\DAEMON Tools Pro\DTProAgent.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0 CE\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: IeCatch5 Class - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\PROGRA~1\FlashGet\jccatch.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\fgiebar.dll O4 - HKLM\..\Run: [Gainward] C:\Program Files\VDOTool\TBPanel.exe /A O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE O4 - HKLM\..\Run: [\YUR1.exe] C:\Windows\system32\YUR1.exe O4 - HKLM\..\Run: [BearShare] "C:\Program Files\BearShare\BearShare.exe" /pause O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033 O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - HKCU\..\Run: [DAEMON Tools Pro Agent] "C:\Program Files\DAEMON Tools Pro\DTProAgent.exe" O4 - HKCU\..\Run: [\YUR1.exe] C:\Windows\system32\YUR1.exe O4 - HKCU\..\Run: [IPLA!] C:\Program Files\ipla\ipla.exe /autorun O4 - HKCU\..\Run: [Wru] C:\Program Files\Wru\Wru.exe O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user') O4 - Startup: OpenOffice.org 2.0.lnk = D:\Program Files\OFFICE11\program\quickstart.exe O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O8 - Extra context menu item: Download All by FlashGet - C:\Program Files\FlashGet\jc_all.htm O8 - Extra context menu item: Download using FlashGet - C:\Program Files\FlashGet\jc_link.htm O8 - Extra context menu item: Pobierz z &BitSpirit - D:\Program Files\BitSpirit\bsurl.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O21 - SSODL: qmafxprs - {10A3C312-15B9-4C7B-B75A-D296D72ACD7B} - \qmafxprs.dll O23 - Service: Application Driver Auto Removal Service (01) (appdrvrem01) - Protection Technology - C:\WINDOWS\System32\appdrvrem01.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe

**Posty:** 8001 · przez **Okocza** 02 Kwi 2009, 13:29

Wykonaj to co jest podane w tym temacie

Zastosuj SDFix . Po pobraniu uruchom go a rozpakuje się do C:\SDFix. Uruchom komputer w trybie awaryjnym (F8 przy stracie systemu). Będąc w awaryjnym uruchom plik RunThis.bat z folderu SDFixa. Zatwierdź czyszczenie przez Y. Poczekaj aż ukończy i komputer zresetuje

Potem wejdz do folderu C:\SDFix wrzuc zawartość pliku Report.txt + log z combofixa oraz daj loga z hijacka

**Posty:** 14 · przez **Fagi** 02 Kwi 2009, 18:15

Report .txt

Kod: Zaznacz wszystko: [b]SDFix: Version 1.240 [/b] Run by Fagi on 2009-04-02 at 18:00 Microsoft Windows XP [Wersja 5.1.2600] Running From: C:\SDFix [b]Checking Services [/b]: Restoring Default Security Values Restoring Default Hosts File Restoring Default HomePage Value Restoring Default Desktop Components Value Restoring Windows Product ID To Remove Fake Virus Alert Rebooting [b]Checking Files [/b]: Trojan Files Found: C:\autorun.inf - Deleted C:\Documents and Settings\Fagi\Ulubione\Malware Defender.url - Deleted C:\Documents and Settings\Fagi\Ulubione\Protect Your Privacy.url - Deleted C:\Documents and Settings\Fagi\Ulubione\System Error Fixer.url - Deleted C:\resycled\ntldr.com - Deleted C:\DOCUME~1\Fagi\USTAWI~1\Temp\tmp9D.tmp - Deleted C:\DOCUME~1\Fagi\USTAWI~1\Temp\tmp9E.tmp - Deleted C:\WINDOWS\system32\MicroAV.cpl - Deleted Folder C:\resycled - Removed Removing Temp Files [b]ADS Check [/b]: [b]Final Check [/b]: catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-04-02 18:02:17 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... scanning hidden services & system hive ... disk error: C:\WINDOWS\system32\config\system, 0 scanning hidden registry entries ... disk error: C:\WINDOWS\system32\config\software, 0 disk error: C:\Documents and Settings\Fagi\ntuser.dat, 0 scanning hidden files ... disk error: C:\WINDOWS\ please note that you need administrator rights to perform deep scan [b]Remaining Services [/b]: Authorized Application Key Export: [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] "C:\\Program Files\\BearShare\\BearShare.exe"="C:\\Program Files\\BearShare\\BearShare.exe:*:Disabled:BearShare" "C:\\Program Files\\Gadu-Gadu\\gg.exe"="C:\\Program Files\\Gadu-Gadu\\gg.exe:*:Disabled:Gadu-Gadu - program główny" "C:\\WINDOWS\\system32\\dpvsetup.exe"="C:\\WINDOWS\\system32\\dpvsetup.exe:*:Disabled:Microsoft DirectPlay Voice Test" "C:\\Program Files\\mIRC\\mirc.exe"="C:\\Program Files\\mIRC\\mirc.exe:*:Disabled:mIRC" "C:\\WINDOWS\\system32\\sessmgr.exe"="C:\\WINDOWS\\system32\\sessmgr.exe:*:Disabled:@xpsp2res.dll,-22019" "D:\\Program Files\\BitSpirit\\BitSpirit.exe"="D:\\Program Files\\BitSpirit\\BitSpirit.exe:*:Enabled:The powerful and easy-to-use BitTorrent Client" "C:\\Program Files\\Cyanide\\GameCenter\\GameCenter.exe"="C:\\Program Files\\Cyanide\\GameCenter\\GameCenter.exe:*:Enabled:GameCenter" "E:\\Pro Cycling Manager - Saison 2006\\PCM.exe"="E:\\Pro Cycling Manager - Saison 2006\\PCM.exe:*:Enabled:pcm" "D:\\My Downloads\\Moto GP Ultimate Racing Technology 3\\motogp.exe"="D:\\My Downloads\\Moto GP Ultimate Racing Technology 3\\motogp.exe:*:Enabled:motogp" "D:\\Program Files\\Wolfenstein - Enemy Territory\\ET.exe"="D:\\Program Files\\Wolfenstein - Enemy Territory\\ET.exe:*:Enabled:ET" "C:\\Documents and Settings\\Fagi\\Pulpit\\Qtracker48-NoInstaller\\qtracker.exe"="C:\\Documents and Settings\\Fagi\\Pulpit\\Qtracker48-NoInstaller\\qtracker.exe:*:Enabled:Qtracker" "C:\\Program Files\\Skype\\Phone\\Skype.exe"="C:\\Program Files\\Skype\\Phone\\Skype.exe:*:Enabled:Skype" "D:\\Program Files\\Pro Cycling Manager - Season 2008\\PCM.exe"="D:\\Program Files\\Pro Cycling Manager - Season 2008\\PCM.exe:*:Enabled:Pro Cycling Manager - Season 2008" "D:\\Program Files\\Pro Cycling Manager - Season 2008\\Autorun\\Exe\\Autorun.exe"="D:\\Program Files\\Pro Cycling Manager - Season 2008\\Autorun\\Exe\\Autorun.exe:*:Enabled:Pro Cycling Manager - Season 2008 - AutoRun" "D:\\Pro Cycling Manager - Season 2008\\PCM.exe"="D:\\Pro Cycling Manager - Season 2008\\PCM.exe:*:Enabled:Pro Cycling Manager - Season 2008" "D:\\Pro Cycling Manager - Season 2008\\Autorun\\Exe\\Autorun.exe"="D:\\Pro Cycling Manager - Season 2008\\Autorun\\Exe\\Autorun.exe:*:Enabled:Pro Cycling Manager - Season 2008 - AutoRun" [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list] "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" [b]Remaining Files [/b]: File Backups: - C:\SDFix\backups\backups.zip [b]Files with Hidden Attributes [/b]: Sun 9 Mar 2008 236 A..H. --- "C:\Program Files\Common Files\dx.reg" Mon 31 Dec 2007 4,348 ..SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak" Mon 31 Dec 2007 4,348 ...H. --- "C:\Documents and Settings\Fagi\Moje dokumenty\Moja muzyka\Kopia zapasowa licencji\drmv1key.bak" Mon 19 Jan 2009 20 A..H. --- "C:\Documents and Settings\Fagi\Moje dokumenty\Moja muzyka\Kopia zapasowa licencji\drmv1lic.bak" Fri 18 Jan 2008 312 ...H. --- "C:\Documents and Settings\Fagi\Moje dokumenty\Moja muzyka\Kopia zapasowa licencji\drmv2key.bak" Mon 19 Jan 2009 1,536 A..H. --- "C:\Documents and Settings\Fagi\Moje dokumenty\Moja muzyka\Kopia zapasowa licencji\drmv2lic.bak" [b]Finished![/b]

ComboFix:

Kod: Zaznacz wszystko: ComboFix 09-04-01.01 - Fagi 2009-04-02 18:11:23.2 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.1023.794 [GMT 2:00] Uruchomiony z: d:\my downloads\ComboFix.exe . ((((((((((((((((((((((((((((((((((((((( Usunięto ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\documents and settings\Fagi\Dane aplikacji\Adobe\Player.exe.bak c:\documents and settings\Fagi\Menu Start\Programy\videoplay c:\documents and settings\Fagi\Menu Start\Programy\videoplay\Uninstall.lnk c:\program files\Mozilla Firefox\components\iamfamous.dll c:\program files\videoplay c:\program files\videoplay\Uninstall.exe c:\windows\system32\advapi32new.dll c:\windows\system32\apphelpnew.dll c:\windows\system32\crypt32new.dll c:\windows\system32\d3d10core.dll c:\windows\system32\drivers\gaopdxduxxrmay.sys c:\windows\system32\dwmapi.dll c:\windows\system32\dxgi.dll c:\windows\system32\gaopdxbnbmblwo.dll c:\windows\system32\kernel32new.dll c:\windows\system32\msvcrtnew.dll c:\windows\system32\ntdsapinew.dll c:\windows\system32\powrprofnew.dll c:\windows\system32\secur32new.dll c:\windows\system32\user32new.dll c:\windows\system32\winstanew.dll D:\Autorun.inf D:\resycled d:\resycled\ntldr.com E:\Autorun.inf E:\resycled e:\resycled\ntldr.com . ((((((((((((((((((((((((((((((((((((((( Sterowniki/Usługi ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Service_gaopdxserv.sys ((((((((((((((((((((((((( Pliki utworzone od 2009-03-02 do 2009-04-02 ))))))))))))))))))))))))))))))) . 2009-04-02 17:59 . 2009-04-02 17:59 578,560 --a--c--- c:\windows\system32\dllcache\user32.dll 2009-04-02 17:58 . 2009-04-02 17:58 <DIR> d-------- c:\windows\ERUNT 2009-04-02 17:49 . 2009-04-02 18:02 <DIR> d-------- C:\SDFix 2009-04-01 23:54 . 2009-04-01 23:57 <DIR> d-------- c:\program files\Nero 2009-04-01 23:54 . 2003-03-18 21:12 1,047,552 --a------ c:\windows\system32\mfc71u.dll 2009-04-01 23:43 . 2001-07-09 11:50 155,648 --a------ c:\windows\system32\NeroCheck.exe 2009-04-01 23:43 . 2003-03-29 16:45 89,184 --a------ c:\windows\system32\drivers\imagedrv.sys 2009-04-01 23:43 . 2003-07-29 17:09 57,344 --a------ c:\windows\system32\ImageDrive.cpl 2009-04-01 23:43 . 2001-06-26 08:15 38,912 --a------ c:\windows\system32\picn20.dll 2009-04-01 00:29 . 2009-04-01 00:29 3,468,904 --a------ c:\windows\system32\drivers\appdrv01.sys 2009-04-01 00:29 . 2009-04-01 00:29 304,528 --a------ c:\windows\system32\appdrvrem01.exe 2009-03-31 23:09 . 2009-03-31 23:09 <DIR> d-------- c:\program files\Cyanide 2009-03-31 22:57 . 2008-04-22 22:20 1,584,149 --a------ c:\windows\system32\setupapinew.dll 2009-03-31 22:57 . 2006-11-02 12:47 1,162,656 --a------ c:\windows\system32\ntdllnew.dll 2009-03-31 22:57 . 2008-04-12 18:13 1,029,126 --a------ c:\windows\system32\d3d10.dll 2009-03-31 22:57 . 2008-05-04 17:42 789,525 --a------ c:\windows\system32\rpcrt4new.dll 2009-03-31 22:57 . 2006-11-29 14:06 440,080 --a------ c:\windows\system32\d3dx10.dll 2009-03-31 22:57 . 2004-12-08 17:57 376,832 --a------ c:\windows\system32\M2000Twn.dll 2009-03-31 22:57 . 2007-04-18 02:13 25,037 --a------ c:\windows\system32\Nucleus.dll 2009-03-31 22:57 . 2008-03-09 07:25 236 --ah----- c:\program files\Common Files\dx.reg 2009-03-31 21:22 . 2009-03-31 21:23 <DIR> d-------- c:\windows\NV24163748.TMP 2009-03-31 20:33 . 2009-03-31 20:34 <DIR> d-------- c:\windows\NV28122760.TMP . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-04-02 16:04 --------- d-----w c:\documents and settings\Fagi\Dane aplikacji\Pro Cycling Manager 2008 2009-04-01 21:57 --------- d-----w c:\program files\Common Files\Ahead 2009-03-31 21:08 --------- d--h--w c:\program files\InstallShield Installation Information 2009-03-31 21:08 --------- d-----w c:\program files\Common Files\InstallShield 2009-03-31 18:34 --------- d-----w c:\program files\VDOTool 2009-03-30 21:21 --------- d-----w c:\documents and settings\Fagi\Dane aplikacji\Skype 2009-02-23 21:56 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\NVIDIA 2009-02-21 14:50 --------- d-----w c:\program files\FlashGet 2009-02-21 13:56 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\Wru 2009-02-18 20:21 201,440 ----a-w c:\windows\system32\PnkBstrB.exe 2009-02-18 20:21 138,512 ----a-w c:\windows\system32\drivers\PnkBstrK.sys 2009-02-18 20:13 66,872 ----a-w c:\windows\system32\PnkBstrA.exe 2009-02-11 19:23 --------- d-----w c:\documents and settings\Fagi\Dane aplikacji\Ahead 2009-02-11 16:50 --------- d-----w c:\program files\Common Files\Adobe 2008-12-20 10:38 67,688 ----a-w c:\program files\mozilla firefox\components\jar50.dll 2008-12-20 10:38 54,368 ----a-w c:\program files\mozilla firefox\components\jsd3250.dll 2008-12-20 10:38 34,944 ----a-w c:\program files\mozilla firefox\components\myspell.dll 2008-12-20 10:38 46,712 ----a-w c:\program files\mozilla firefox\components\spellchk.dll 2008-12-20 10:38 172,136 ----a-w c:\program files\mozilla firefox\components\xpinstal.dll . ------- Sigcheck ------- 2001-08-18 08:24 327168 e7774698bb0d14b0710a9a31e209f9b6 c:\windows\$NtServicePackUninstall$\tcpip.sys 2004-08-04 00:14 359040 9f4b36614a0fc234525ba224957de55c c:\windows\ServicePackFiles\i386\tcpip.sys 2004-08-04 00:14 359040 6a603809f598332dbedd535bdbce313e c:\windows\system32\drivers\tcpip.sys . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360] "MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2004-08-04 1667584] "DAEMON Tools"="c:\program files\DAEMON Tools\daemon.exe" [2007-04-04 165784] "Gadu-Gadu"="c:\program files\Gadu-Gadu\gg.exe" [2007-07-09 2119104] "DAEMON Tools Pro Agent"="c:\program files\DAEMON Tools Pro\DTProAgent.exe" [2007-09-06 136136] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Gainward"="c:\program files\VDOTool\TBPanel.exe" [2007-02-01 2154496] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-10-22 7700480] "WinampAgent"="c:\program files\Winamp\winampa.exe" [2003-12-13 33792] "SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784] "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2006-10-22 86016] "NeroCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648] "nwiz"="nwiz.exe" [2006-10-22 c:\windows\system32\nwiz.exe] "RTHDCPL"="RTHDCPL.EXE" [2006-12-12 c:\windows\RTHDCPL.exe] "SkyTel"="SkyTel.EXE" [2006-12-12 c:\windows\SkyTel.exe] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2004-08-04 15360] c:\documents and settings\All Users\Menu Start\Programy\Autostart\ Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2009-02-11 113664] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "vidc.X264"= x264vfw.dll [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "c:\\Program Files\\Gadu-Gadu\\gg.exe"= "c:\\WINDOWS\\system32\\dpvsetup.exe"= "c:\\WINDOWS\\system32\\sessmgr.exe"= "d:\\Program Files\\BitSpirit\\BitSpirit.exe"= "c:\\Program Files\\Cyanide\\GameCenter\\GameCenter.exe"= "c:\\Program Files\\Skype\\Phone\\Skype.exe"= "d:\\Pro Cycling Manager - Season 2008\\PCM.exe"= "d:\\Pro Cycling Manager - Season 2008\\Autorun\\Exe\\Autorun.exe"= R0 sfdrv01a;StarForce Protection Environment Driver (version 1.x.a);c:\windows\system32\drivers\sfdrv01a.sys [2006-07-05 63352] R1 appdrv01;Application Driver (01);c:\windows\system32\drivers\appdrv01.sys [2009-04-01 3468904] R3 tj2knd5;Terayon Cable Modem (NDIS);c:\windows\system32\drivers\tj2knd5.sys [2007-12-16 17616] R3 tj2kunic;Terayon Cable Modem (WDM);c:\windows\system32\drivers\tj2kunic.sys [2007-12-16 69680] S2 appdrvrem01;Application Driver Auto Removal Service (01);c:\windows\System32\appdrvrem01.exe svc --> c:\windows\System32\appdrvrem01.exe svc [?] . - - - - USUNIĘTO PUSTE WPISY - - - - HKCU-Run-IPLA! - c:\program files\ipla\ipla.exe HKCU-Run-Wru - c:\program files\Wru\Wru.exe HKLM-Run-BearShare - c:\program files\BearShare\BearShare.exe . ------- Skan uzupełniający ------- . IE: Download All by FlashGet - c:\program files\FlashGet\jc_all.htm IE: Download using FlashGet - c:\program files\FlashGet\jc_link.htm IE: Pobierz z &BitSpirit - d:\program files\BitSpirit\bsurl.htm FF - ProfilePath - c:\documents and settings\Fagi\Dane aplikacji\Mozilla\Firefox\Profiles\58zu7grb.default\ FF - prefs.js: browser.startup.homepage - hxxp://www.onet.pl/ FF - component: c:\program files\Mozilla Firefox\components\xpinstal.dll . ************************************************************************** catchme 0.3.1375 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-04-02 18:12:24 Windows 5.1.2600 Dodatek Service Pack 2 NTFS skanowanie ukrytych procesów ... skanowanie ukrytych wpisów autostartu ... skanowanie ukrytych plików ... skanowanie pomyślnie ukończone ukryte pliki: 0 ************************************************************************** . Czas ukończenia: 2009-04-02 18:13:23 ComboFix-quarantined-files.txt 2009-04-02 16:13:10 Przed: 1,257,713,664 bajtów wolnych Po: 1,259,679,744 bajtów wolnych WindowsXP-KB310994-SP2-Pro-BootDisk-PLK.exe [boot loader] timeout=2 default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS [operating systems] c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /fastdetect /NoExecute=OptIn 167

HijackThis:

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 18:14, on 2009-04-02 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.5730.0013) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\PnkBstrA.exe C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\explorer.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0 CE\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: IeCatch5 Class - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\PROGRA~1\FlashGet\jccatch.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\fgiebar.dll O4 - HKLM\..\Run: [Gainward] C:\Program Files\VDOTool\TBPanel.exe /A O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033 O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - HKCU\..\Run: [DAEMON Tools Pro Agent] "C:\Program Files\DAEMON Tools Pro\DTProAgent.exe" O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user') O4 - Startup: OpenOffice.org 2.0.lnk = D:\Program Files\OFFICE11\program\quickstart.exe O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O8 - Extra context menu item: Download All by FlashGet - C:\Program Files\FlashGet\jc_all.htm O8 - Extra context menu item: Download using FlashGet - C:\Program Files\FlashGet\jc_link.htm O8 - Extra context menu item: Pobierz z &BitSpirit - D:\Program Files\BitSpirit\bsurl.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O23 - Service: Application Driver Auto Removal Service (01) (appdrvrem01) - Protection Technology - C:\WINDOWS\System32\appdrvrem01.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe -- End of file - 4422 bytes

**Posty:** 18165 · przez **wojtas** 02 Kwi 2009, 20:07

nie znam kilku plików wiec:

1. Ściągnij OTMoveIt i go włacz i odpal go z opcji CleanUp

oraz skasuj folder C:\Qoobox
2. wykonaj optymalizację windowsa
3.sciagnij ATF_Cleaner
zaznacz
Windows Temp
All users Temp
Temporary internet files
Recycle Bin
i wcisnij EMPTY SELECTED
4.Wyłącz przywracanie systemu ( właściwości mój komputer-zakładka przywracanie - wyłącz przywracanie na wszystkich dyskach). Po chwili włącz je powrotem
5. Wykonaj skan Dr. Web CureIt
6. Przeskanuj obszar mojego komputera http://www.kaspersky.pl/virusscanner.html (uruchom przez IE) Daj raport z niego na forum.

i tym:

FixIEDef.

**Posty:** 14 · przez **Fagi** 10 Kwi 2009, 15:09

Log z FixIEDef:

Kod: Zaznacz wszystko: Created at 19:59:06 on Thursday, April 09, 2009 Time Zone : Logged On User : Fagi Operating System : Microsoft Windows XP Professional Dodatek Service Pack 2 OS Architecture : X86 System Langauge : Polish Keyboard Layout : Polish Processor : X64 Intel(R) Core(TM)2 CPU 4300 @ 1.80GHz System Drive : C:\ Windows Directory : C:\WINDOWS System Directory : C:\WINDOWS\system32 System Drive Type : Fixed System Drive Status : READY System Drive Label : System Drive Size : 6 GB System Drive Free : 730.85 MB Total Physical Memory: 1023 MB Free Physical Memory : 619 MB Total Page File : 1023 MB Free Page File : 2258 MB Total Virtual Memory : 2048 MB Free Virtual Memory : 1954 MB Boot State : Normal boot -------------------------------------------------------------------------------- !!! userinit.exe is Clean !!! -------------------------------------------------------------------------------- !!! Files that have been deleted !!! No malicious files found -------------------------------------------------------------------------------- !!! Directories that have been removed !!! No malicious directories to be removed -------------------------------------------------------------------------------- !!! Registry entries that have been removed !!! No malicious Registry entries found ================================================================================ All Done :) ShadowPuterDude Safe Surfing!!!

Log z Kaspersky:

Kod: Zaznacz wszystko: piątek, 10 kwiecień 2009 System operacyjny: Microsoft Windows XP Professional Dodatek Service Pack 2 (build 2600) Wersja Kaspersky Online Scanner: 7.0.26.12 Data ostatniej aktualizacji bazy danych: Thursday, April 09, 2009 22:59:11 Liczba wpisów: 2029138 Ustawienia skanowania Typ bazy danych użytej do skanowania rozszerzona Skanuj archiwa tak Skanuj pocztowe bazy danych tak Obszar skanowania Mój komputer A:\ C:\ D:\ E:\ F:\ G:\ H:\ I:\ Statystyki skanowania Przeskanowanych plików 69010 Nazwa zagrożenia 6 Zainfekowanych obiektów 8 Podejrzanych obiektów 0 Czas skanowania 02:44:54 Nazwa pliku Nazwa zagrożenia Liczba zagrożeń C:\lfstbwvd.dll Zainfekowany: Trojan.Win32.Vapsup.rfz 1 C:\Program Files\DAEMON Tools\SetupDTSB.exe Zainfekowany: not-a-virus:WebToolbar.Win32.WhenU.a 1 D:\programiki\mirc617.exe Zainfekowany: not-a-virus:Client-IRC.Win32.mIRC.617 1 D:\programiki\tightvnc-1.2.9-setup.exe Zainfekowany: not-a-virus:RemoteAdmin.Win32.WinVNC-based.h 1 D:\programiki\tightvnc-1.2.9-setup.exe Zainfekowany: not-a-virus:RemoteAdmin.Win32.WinVNC-based.b 1 D:\programiki\tleninst52025.exe Zainfekowany: not-a-virus:AdWare.Win32.Doza.a 1 D:\tightvnc-1.2.9-setup.exe Zainfekowany: not-a-virus:RemoteAdmin.Win32.WinVNC-based.h 1 D:\tightvnc-1.2.9-setup.exe Zainfekowany: not-a-virus:RemoteAdmin.Win32.WinVNC-based.b 1 Wybrany obszar został przeskanowany.

**Posty:** 684 · przez **djarta** 10 Kwi 2009, 15:42

C:\lfstbwvd.dll

Spróbuj usunąć ten plik w Trybie Awaryjnym. Jeśli nie będziesz dał rady to pisz.

=============
K.