[log] dziwne komunikaty

**Posty:** 40 · przez **ziggyddx** 18 Sie 2008, 02:06

Samoistnie zainstalował się program Antivirus 2009

i pokazuje mi różne dziwne komunikaty

Kaspersky niczego nie wykrywa, a komp działa w miarę normalnie.

Logi:

Kod: Zaznacz wszystko: ComboFix 08-08-17.03 - Ela 2008-08-18 1:20:48.1 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.475 [GMT 2:00] Running from: C:\Documents and Settings\Ela\Pulpit\ComboFix.exe * Created a new restore point [color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color] . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\WINDOWS\system32\ieupdates.exe C:\WINDOWS\system32\scui.cpl . ((((((((((((((((((((((((( Files Created from 2008-07-17 to 2008-08-17 ))))))))))))))))))))))))))))))) . 2008-08-18 01:30 . 2008-08-18 01:30 78,336 --a------ C:\WINDOWS\system32\scui.cpl 2008-08-18 01:15 . 2008-08-18 01:15 <DIR> d-------- C:\Program Files\Trend Micro 2008-08-18 00:12 . 2008-08-18 00:12 <DIR> d----c--- C:\Documents and Settings\Ela\Dane aplikacji\Media Player Classic 2008-08-17 18:26 . 2004-08-04 00:44 221,184 --a------ C:\WINDOWS\system32\wmpns.dll 2008-08-17 15:31 . 2008-08-17 15:31 2,560 --a------ C:\WINDOWS\system32\bitcometres.dll 2008-08-17 13:28 . 2008-06-10 02:32 73,728 --a------ C:\WINDOWS\system32\javacpl.cpl 2008-08-17 13:26 . 2008-08-17 13:28 <DIR> d-------- C:\Program Files\Java 2008-08-17 12:29 . 2008-08-17 12:29 <DIR> d----c--- C:\Documents and Settings\All Users\Dane aplikacji\Extreme Picture Finder 2008-08-17 11:27 . 2008-08-17 11:28 <DIR> d-------- C:\WINDOWS\vf_hip 2008-08-17 11:27 . 2008-08-17 11:27 32 --a------ C:\WINDOWS\go 2008-08-17 11:18 . 2008-08-17 11:24 <DIR> d----c--- C:\Documents and Settings\Ela\Dane aplikacji\Hide IP NG 2008-08-17 10:39 . 2004-08-03 23:08 26,496 --a--c--- C:\WINDOWS\system32\dllcache\usbstor.sys 2008-08-17 10:17 . 2008-08-17 10:17 427 --a------ C:\WINDOWS\ODBC.INI 2008-08-17 09:28 . 2008-08-18 00:15 69 --a------ C:\WINDOWS\NeroDigital.ini 2008-08-17 09:19 . 2008-08-17 09:22 <DIR> d----c--- C:\Documents and Settings\Ela\Dane aplikacji\Ahead 2008-08-17 09:11 . 2008-08-17 09:11 <DIR> d----c--- C:\Documents and Settings\All Users\Dane aplikacji\Nero 2008-08-17 08:09 . 2008-08-17 08:10 <DIR> d----c--- C:\Documents and Settings\Ela\Dane aplikacji\Tla Pulpitu 2008-08-17 00:59 . 2008-08-17 01:00 <DIR> d-------- C:\Program Files\AV9 2008-08-16 21:17 . 2008-08-17 16:53 <DIR> d----c--- C:\Documents and Settings\Ela\Dane aplikacji\Orbit 2008-08-16 21:07 . 2008-08-16 21:07 <DIR> d----c--- C:\Documents and Settings\Ela\Dane aplikacji\vlc 2008-08-16 18:48 . 2008-08-16 18:48 <DIR> d-------- C:\Program Files\SW Flash 2008-08-16 16:34 . 2001-08-17 23:59 3,072 --a------ C:\WINDOWS\system32\drivers\audstub.sys 2008-08-16 16:33 . 2004-08-04 02:35 58,624 --a------ C:\WINDOWS\system32\drivers\redbook.sys 2008-08-16 16:32 . 2004-08-04 02:44 4,274,816 --a------ C:\WINDOWS\system32\nv4_disp.dll 2008-08-16 16:32 . 2004-08-04 00:29 1,897,408 --a------ C:\WINDOWS\system32\drivers\nv4_mini.sys 2008-08-16 16:32 . 2008-06-14 20:01 273,024 --------- C:\WINDOWS\system32\drivers\bthport.sys 2008-08-16 16:32 . 2008-06-14 20:01 273,024 -----c--- C:\WINDOWS\system32\dllcache\bthport.sys 2008-08-16 16:32 . 2004-08-04 01:07 44,672 --a------ C:\WINDOWS\system32\drivers\UAGP35.SYS 2008-08-16 16:32 . 2004-08-04 00:31 32,768 --a------ C:\WINDOWS\system32\drivers\sisnic.sys 2008-08-16 16:31 . 2004-08-04 02:44 77,312 --a------ C:\WINDOWS\system32\usbui.dll 2008-08-16 16:31 . 2004-08-04 01:08 10,624 --a------ C:\WINDOWS\system32\drivers\gameenum.sys 2008-08-16 16:27 . 2008-08-18 01:25 <DIR> dr-h-c--- C:\Documents and Settings\Default User.WINDOWS\Ustawienia lokalne 2008-08-16 16:27 . 2008-08-16 16:27 <DIR> d----c--- C:\Documents and Settings\Default User.WINDOWS\Ulubione 2008-08-16 16:27 . 2008-08-16 14:41 <DIR> d--h-c--- C:\Documents and Settings\Default User.WINDOWS\Szablony 2008-08-16 16:27 . 2008-08-16 16:27 <DIR> d----c--- C:\Documents and Settings\Default User.WINDOWS\Pulpit 2008-08-16 16:27 . 2008-08-16 16:27 <DIR> d----c--- C:\Documents and Settings\Default User.WINDOWS\Moje dokumenty 2008-08-16 16:27 . 2008-08-16 16:27 <DIR> dr---c--- C:\Documents and Settings\Default User.WINDOWS\Menu Start 2008-08-16 16:27 . 2008-08-16 16:27 <DIR> d----c--- C:\Documents and Settings\All Users\Ulubione 2008-08-16 16:27 . 2008-08-17 13:29 <DIR> d--h-c--- C:\Documents and Settings\All Users\Szablony 2008-08-16 16:27 . 2008-08-17 13:35 <DIR> d----c--- C:\Documents and Settings\All Users\Pulpit 2008-08-16 16:27 . 2008-08-17 13:29 <DIR> dr---c--- C:\Documents and Settings\All Users\Menu Start 2008-08-16 16:27 . 2008-08-16 14:43 <DIR> dr---c--- C:\Documents and Settings\All Users\Dokumenty 2008-08-16 16:27 . 2004-08-04 01:27 1,896,400 --a--c--- C:\WINDOWS\system32\dllcache\NT5.CAT 2008-08-16 16:26 . 2008-08-16 16:27 <DIR> dr-h-c--- C:\Documents and Settings\Default User.WINDOWS\Dane aplikacji 2008-08-16 16:26 . 2008-08-16 15:01 <DIR> d--h-c--- C:\Documents and Settings\Default User.WINDOWS 2008-08-16 16:26 . 2008-08-17 12:29 <DIR> dr-h-c--- C:\Documents and Settings\All Users\Dane aplikacji 2008-08-16 16:26 . 2008-08-16 14:46 <DIR> d----c--- C:\Documents and Settings\All Users 2008-08-16 16:25 . 2005-02-25 05:36 22,752 --a------ C:\WINDOWS\system32\spupdsvc.exe 2008-08-16 16:25 . 2008-08-16 14:56 623 --a------ C:\WINDOWS\system32\$winnt$.inf 2008-08-16 16:16 . 2008-08-16 16:16 <DIR> d-------- C:\Program Files\Google 2008-08-16 15:57 . 2004-08-03 23:15 145,792 --a------ C:\WINDOWS\system32\drivers\portcls.sys 2008-08-16 15:56 . 1998-10-29 16:45 306,688 --a------ C:\WINDOWS\IsUninst.exe 2008-08-16 15:56 . 2003-08-05 14:23 266,240 --a------ C:\WINDOWS\CMIUninstall.exe 2008-08-16 15:56 . 2003-07-22 11:15 225,280 --a------ C:\WINDOWS\CmiRmRedundDir.exe 2008-08-16 15:56 . 2002-10-18 15:56 28,672 --a------ C:\WINDOWS\CMIRmDriver.dll 2008-08-16 15:56 . 2008-08-16 15:56 2,314 --a------ C:\WINDOWS\Ascd_tmp.ini 2008-08-16 15:49 . 2000-03-29 16:17 5,824 --a------ C:\WINDOWS\system32\drivers\ASUSHWIO.SYS 2008-08-16 15:44 . 2008-08-16 15:44 0 --a------ C:\WINDOWS\nsreg.dat 2008-08-16 15:25 . 2003-12-08 11:53 70,688 --a------ C:\WINDOWS\system32\drivers\alcaudsl.sys 2008-08-16 15:25 . 2003-12-08 11:53 53,600 --a------ C:\WINDOWS\system32\drivers\alcan5wn.sys 2008-08-16 15:25 . 2003-12-08 11:53 5,606 --a------ C:\WINDOWS\system32\stci.dll 2008-08-16 15:25 . 2003-12-08 11:53 5,280 --a------ C:\WINDOWS\system32\drivers\alcawh.sys 2008-08-16 15:25 . 2003-12-08 11:53 3,968 --a------ C:\WINDOWS\system32\drivers\alcacr.sys 2008-08-16 15:17 . 2008-08-16 15:32 96,976 --a------ C:\WINDOWS\system32\drivers\klin.dat 2008-08-16 15:17 . 2008-08-16 15:32 87,855 --a------ C:\WINDOWS\system32\drivers\klick.dat 2008-08-16 15:16 . 2008-08-16 15:16 <DIR> d-------- C:\Program Files\Kaspersky Lab 2008-08-16 15:16 . 2008-08-18 01:30 <DIR> d----c--- C:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab 2008-08-16 15:16 . 2008-08-18 01:27 1,254,432 --ahs---- C:\WINDOWS\system32\drivers\fidbox.dat 2008-08-16 15:16 . 2008-08-18 01:27 270,368 --ahs---- C:\WINDOWS\system32\drivers\fidbox2.dat 2008-08-16 15:16 . 2008-08-18 01:27 14,024 --ahs---- C:\WINDOWS\system32\drivers\fidbox.idx 2008-08-16 15:16 . 2008-08-18 01:27 5,148 --ahs---- C:\WINDOWS\system32\drivers\fidbox2.idx 2008-08-16 15:12 . 2008-08-16 15:12 <DIR> d----c--- C:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab Setup Files 2008-08-16 15:01 . 2008-08-18 01:25 <DIR> d--h-c--- C:\Documents and Settings\Ela\Ustawienia lokalne 2008-08-16 15:01 . 2008-08-16 15:59 <DIR> dr---c--- C:\Documents and Settings\Ela\Ulubione 2008-08-16 15:01 . 2008-08-16 14:41 <DIR> d--h-c--- C:\Documents and Settings\Ela\Szablony 2008-08-16 15:01 . 2008-08-18 01:31 <DIR> d----c--- C:\Documents and Settings\Ela\Pulpit 2008-08-16 15:01 . 2008-08-17 12:31 <DIR> dr---c--- C:\Documents and Settings\Ela\Moje dokumenty 2008-08-16 15:01 . 2008-08-18 01:31 <DIR> dr---c--- C:\Documents and Settings\Ela\Menu Start 2008-08-16 15:01 . 2008-08-18 00:12 <DIR> dr-h-c--- C:\Documents and Settings\Ela\Dane aplikacji 2008-08-16 15:01 . 2008-08-18 01:26 <DIR> d----c--- C:\Documents and Settings\Ela 2008-08-16 14:58 . 2008-08-16 14:58 <DIR> d--hsc--- C:\Documents and Settings\NetworkService.ZARZ¤DZANIE NT.000 2008-08-16 14:58 . <DIR> C:\Documents and Settings\NetworkService.ZARZąDZANIE NT.000\Ustawienia lokalne 2008-08-16 14:58 . <DIR> C:\Documents and Settings\NetworkService.ZARZąDZANIE NT.000\Ustawienia lokalne 2008-08-16 14:58 . <DIR> C:\Documents and Settings\NetworkService.ZARZąDZANIE NT.000\Dane aplikacji\Microsoft 2008-08-16 14:58 . <DIR> C:\Documents and Settings\NetworkService.ZARZąDZANIE NT.000\Dane aplikacji 2008-08-16 14:58 . <DIR> C:\Documents and Settings\NetworkService.ZARZąDZANIE NT.000\Dane aplikacji 2008-08-16 14:58 . <DIR> C:\Documents and Settings\NetworkService.ZARZąDZANIE NT.000\Cookies 2008-08-16 14:58 . <DIR> C:\Documents and Settings\NetworkService.ZARZąDZANIE NT.000\Cookies 2008-08-16 14:58 . 2008-08-16 14:58 <DIR> d--hsc--- C:\Documents and Settings\LocalService.ZARZ¤DZANIE NT.000 2008-08-16 14:58 . <DIR> C:\Documents and Settings\LocalService.ZARZąDZANIE NT.000\Ustawienia lokalne 2008-08-16 14:58 . <DIR> C:\Documents and Settings\LocalService.ZARZąDZANIE NT.000\Ustawienia lokalne 2008-08-16 14:58 . <DIR> C:\Documents and Settings\LocalService.ZARZąDZANIE NT.000\Dane aplikacji\Microsoft 2008-08-16 14:58 . <DIR> C:\Documents and Settings\LocalService.ZARZąDZANIE NT.000\Dane aplikacji\Microsoft 2008-08-16 14:58 . <DIR> C:\Documents and Settings\LocalService.ZARZąDZANIE NT.000\Dane aplikacji\Microsoft 2008-08-16 14:58 . <DIR> C:\Documents and Settings\LocalService.ZARZąDZANIE NT.000\Dane aplikacji 2008-08-16 14:58 . <DIR> C:\Documents and Settings\LocalService.ZARZąDZANIE NT.000\Dane aplikacji 2008-08-16 14:58 . <DIR> C:\Documents and Settings\LocalService.ZARZąDZANIE NT.000\Cookies 2008-08-16 14:58 . <DIR> C:\Documents and Settings\LocalService.ZARZąDZANIE NT.000\Cookies 2008-08-16 14:58 . 262,144 C:\Documents and Settings\NetworkService.ZARZąDZANIE NT.000\NTUSER.DAT 2008-08-16 14:58 . 262,144 C:\Documents and Settings\NetworkService.ZARZąDZANIE NT.000\NTUSER.DAT 2008-08-16 14:58 . 262,144 C:\Documents and Settings\LocalService.ZARZąDZANIE NT.000\NTUSER.DAT 2008-08-16 14:58 . 262,144 C:\Documents and Settings\LocalService.ZARZąDZANIE NT.000\NTUSER.DAT 2008-08-16 14:56 . 2004-08-03 23:04 156,672 --a--c--- C:\WINDOWS\system32\dllcache\winzm.ime 2008-08-16 14:56 . 2004-08-03 23:04 156,672 --a--c--- C:\WINDOWS\system32\dllcache\winsp.ime 2008-08-16 14:56 . 2004-08-03 23:04 156,672 --a--c--- C:\WINDOWS\system32\dllcache\winpy.ime 2008-08-16 14:56 . 2004-08-03 23:04 79,360 --a--c--- C:\WINDOWS\system32\dllcache\winar30.ime 2008-08-16 14:56 . 2001-08-17 21:55 69,120 --a--c--- C:\WINDOWS\system32\dllcache\wingb.ime 2008-08-16 14:56 . 2004-08-03 23:04 65,536 --a--c--- C:\WINDOWS\system32\dllcache\winime.ime 2008-08-16 14:56 . 2001-10-26 17:29 41,600 --a--c--- C:\WINDOWS\system32\dllcache\weitekp9.dll 2008-08-16 14:56 . 2001-10-26 16:58 31,360 --a--c--- C:\WINDOWS\system32\dllcache\weitekp9.sys 2008-08-16 14:56 . 2001-07-21 22:20 28,288 --a--c--- C:\WINDOWS\system32\dllcache\xjis.nls 2008-08-16 14:54 . 2001-07-21 22:23 1,875,968 --a--c--- C:\WINDOWS\system32\dllcache\msir3jp.lex 2008-08-16 14:53 . 2001-07-21 22:23 1,158,818 --a--c--- C:\WINDOWS\system32\dllcache\korwbrkr.lex 2008-08-16 14:52 . 2001-10-26 17:28 13,463,552 --a--c--- C:\WINDOWS\system32\dllcache\hwxjpn.dll 2008-08-16 14:51 . 2001-10-26 17:28 1,677,824 --a--c--- C:\WINDOWS\system32\dllcache\chsbrkr.dll 2008-08-16 14:50 . 2004-08-04 00:44 2,134,528 --a--c--- C:\WINDOWS\system32\dllcache\smtpsnap.dll 2008-08-16 14:49 . 2008-08-17 09:09 316,640 --a------ C:\WINDOWS\WMSysPr9.prx 2008-08-16 14:49 . 2008-08-16 14:49 23,392 --a------ C:\WINDOWS\system32\nscompat.tlb 2008-08-16 14:49 . 2008-08-16 14:49 16,832 --a------ C:\WINDOWS\system32\amcompat.tlb 2008-08-16 14:49 . 2008-08-16 14:49 2,596 --a------ C:\WINDOWS\system32\CONFIG.NT 2008-08-16 14:49 . 2008-08-16 14:49 0 --a------ C:\WINDOWS\control.ini 2008-08-16 14:46 . 2008-08-17 09:07 <DIR> d--hsc--- C:\Documents and Settings\All Users\DRM 2008-08-16 14:46 . 2008-08-16 14:46 749 -rah----- C:\WINDOWS\WindowsShell.Manifest 2008-08-16 14:46 . 2008-08-16 14:46 749 -rah----- C:\WINDOWS\system32\wuaucpl.cpl.manifest 2008-08-16 14:46 . 2008-08-16 14:46 749 -rah----- C:\WINDOWS\system32\sapi.cpl.manifest . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-08-12 11:59 --------- d-----w C:\Program Files\Common Files\Ahead 2008-08-12 09:36 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-08-03 08:19 --------- d-----w C:\Program Files\Winamp 2008-08-02 16:49 --------- d-----w C:\Program Files\Common Files\Symantec Shared 2008-08-02 00:43 --------- d-----w C:\Program Files\Real Alternative 2008-08-02 00:43 --------- d-----w C:\Program Files\QT Lite 2008-07-28 21:30 --------- d-----w C:\Program Files\Common Files\SWF Studio 2008-07-28 21:19 --------- d-----w C:\Program Files\Common Files\Real 2008-07-25 08:34 81,920 ----a-w C:\WINDOWS\system32\dpl100.dll 2008-07-25 08:34 683,520 ----a-w C:\WINDOWS\system32\divx.dll 2008-07-23 16:50 3,596,288 ----a-w C:\WINDOWS\system32\qt-dx331.dll 2008-07-12 19:44 --------- d-----w C:\Program Files\Vimicro 2008-07-12 19:44 --------- d-----w C:\Program Files\Common Files\InstallShield 2008-07-12 16:48 --------- d-----w C:\Program Files\Common Files\xing shared 2008-07-11 07:27 --------- d-----w C:\Program Files\Sun 2008-07-07 20:33 253,952 ----a-w C:\WINDOWS\system32\es.dll 2008-07-04 09:22 --------- d-----w C:\Program Files\Software Informer 2008-06-28 23:28 --------- d-----w C:\Program Files\Common Files\Skype 2008-06-28 23:18 --------- d-----w C:\Program Files\Yahoo! 2008-06-24 16:24 74,240 ----a-w C:\WINDOWS\system32\mscms.dll 2008-06-24 09:35 --------- d-----w C:\Program Files\SiSLan 2008-06-24 09:22 --------- d-----w C:\Program Files\Malicious Software Removal Tool 2008-06-24 09:17 --------- d-----w C:\Program Files\MSXML 4.0 2008-06-24 09:17 --------- d-----w C:\Program Files\Common Files\Java 2008-06-24 09:16 --------- d-----w C:\Program Files\MSXML 6.0 2008-06-24 08:39 --------- d-----w C:\Program Files\Windows Media Connect 2 2008-06-24 07:57 --------- d-----w C:\Program Files\MSBuild 2008-06-24 07:50 --------- d-----w C:\Program Files\Reference Assemblies 2008-06-24 07:19 --------- d-----w C:\Program Files\HighMAT CD Writing Wizard 2008-06-24 07:06 --------- d-----w C:\Program Files\Common Files\Adobe 2008-06-24 06:59 --------- d-----w C:\Program Files\MarBit 2008-06-24 06:22 --------- d-----w C:\Program Files\Microsoft.NET 2008-06-24 06:20 --------- d-----w C:\Program Files\Microsoft Works 2008-06-23 21:29 --------- d-----w C:\Program Files\microsoft frontpage 2008-06-23 21:25 --------- d-----w C:\Program Files\Usługi online 2008-06-23 15:41 662,016 ----a-w C:\WINDOWS\system32\wininet.dll 2008-06-20 17:42 246,784 ----a-w C:\WINDOWS\system32\mswsock.dll 2008-06-20 10:45 360,320 ----a-w C:\WINDOWS\system32\drivers\tcpip.sys 2008-06-20 10:44 138,368 ----a-w C:\WINDOWS\system32\drivers\afd.sys 2008-06-20 09:52 225,920 ----a-w C:\WINDOWS\system32\drivers\tcpip6.sys 2008-06-12 18:36 7,680 ----a-w C:\WINDOWS\system32\ff_vfw.dll 2004-10-01 13:00 40,960 ----a-w C:\Program Files\Uninstall_CDS.exe 2001-11-23 04:08 712,704 ----a-w C:\WINDOWS\inf\OTHER\AUDIO3D.DLL . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:44 15360] "swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-08-16 18:06 68856] "Gadu-Gadu"="F:\Program Files\Gadu-Gadu\gg.exe" [2005-03-31 11:18 790528] "68543899212063908279651347102434"="C:\Program Files\AV9\av2009.exe" [2008-08-17 01:00 979968] "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2007-06-27 19:03 152872] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SpeedTouch USB Diagnostics"="F:\Program Files\Speed Touch USB\Dragdiag.exe" [2004-03-23 12:06 888832] "NeroFilterCheck"="C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" [2007-03-01 15:57 153136] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 04:27 144784] "AVP"="C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe" [2008-04-25 18:21 201992] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 00:44 15360] C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\ Microsoft Office.lnk - F:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 10:01:04 83360] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "VIDC.YV12"= yv12vfw.dll [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "16618:TCP"= 16618:TCP:BitComet 16618 TCP "16618:UDP"= 16618:UDP:BitComet 16618 UDP R0 klbg;Kaspersky Lab Boot Guard Driver;C:\WINDOWS\system32\drivers\klbg.sys [2008-01-29 18:29] R3 KLFLTDEV;Kaspersky Lab KLFltDev;C:\WINDOWS\system32\DRIVERS\klfltdev.sys [2008-03-13 19:02] R3 klim5;Kaspersky Anti-Virus NDIS Filter;C:\WINDOWS\system32\DRIVERS\klim5.sys [2008-03-25 20:07] . - - - - ORPHANS REMOVED - - - - HKLM-Run-Cmaudio - cmicnfg.cpl . ------- Supplementary Scan ------- . FireFox -: Profile - C:\Documents and Settings\Ela\Dane aplikacji\Mozilla\Firefox\Profiles\v6oinza3.default\ FF -: plugin - F:\Program Files\Firefox\plugins\npBitCometAgent.dll FF -: plugin - F:\Program Files\Firefox\plugins\npnul32.dll FF -: plugin - F:\Program Files\Firefox\plugins\nppl3260.dll FF -: plugin - F:\Program Files\Firefox\plugins\nprjplug.dll FF -: plugin - F:\Program Files\Firefox\plugins\nprpjplug.dll ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-08-18 01:30:24 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... C:\WINDOWS\system32\scui.cpl 78336 bytes executable C:\WINDOWS\system32\ieupdates.exe.tmp 0 bytes scan completed successfully hidden files: 2 ************************************************************************** . ------------------------ Other Running Processes ------------------------ . C:\WINDOWS\system32\wdfmgr.exe C:\WINDOWS\system32\rundll32.exe C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe . ************************************************************************** . Completion time: 2008-08-18 1:37:16 - machine was rebooted ComboFix-quarantined-files.txt 2008-08-17 23:37:06 Pre-Run: 3,768,524,800 bajtów wolnych Post-Run: 3,740,827,648 bajt˘w wolnych 257 --- E O F --- 2008-08-16 17:11:02

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 01:16:12, on 2008-08-18 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe F:\Program Files\Speed Touch USB\Dragdiag.exe C:\WINDOWS\system32\RunDll32.exe C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe C:\Program Files\AV9\av2009.exe C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe C:\Program Files\Windows Media Player\wmplayer.exe F:\Program Files\Firefox\firefox.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\WINDOWS\system32\dumprep.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = : R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - F:\Program Files\Bit Comet\tools\BitCometBHO_1.2.2.28.dll O2 - BHO: IEVkbdBHO - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\ievkbd.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.0.1225.9868\swg.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe" O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "F:\Program Files\Speed Touch USB\Dragdiag.exe" /icon O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe O4 - HKCU\..\Run: [Gadu-Gadu] "F:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - HKCU\..\Run: [68543899212063908279651347102434] C:\Program Files\AV9\av2009.exe O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Global Startup: Microsoft Office.lnk = F:\Program Files\Microsoft Office\Office10\OSA.EXE O8 - Extra context menu item: &D&ownload &with BitComet - res://F:\Program Files\Bit Comet\BitComet.exe/AddLink.htm O8 - Extra context menu item: &D&ownload all video with BitComet - res://F:\Program Files\Bit Comet\BitComet.exe/AddVideo.htm O8 - Extra context menu item: &D&ownload all with BitComet - res://F:\Program Files\Bit Comet\BitComet.exe/AddAllLink.htm O8 - Extra context menu item: Dodaj do listy blokowanych banerów - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\ie_banner_deny.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra button: Statystyki ochrony WWW - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\SCIEPlgn.dll O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://F:\Program Files\Bit Comet\tools\BitCometBHO_1.2.2.28.dll/206 (file missing) O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O17 - HKLM\System\CCS\Services\Tcpip\..\{DE5CD21A-0E6C-4290-AF48-CF95D0336AC0}: NameServer = 80.244.140.241 80.244.128.1 O20 - AppInit_DLLs: C:\PROGRA~1\KASPER~1\KASPER~1\mzvkbd.dll,C:\PROGRA~1\KASPER~1\KASPER~1\adialhk.dll,C:\PROGRA~1\KASPER~1\KASPER~1\kloehk.dll O23 - Service: Kaspersky Internet Security (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe -- End of file - 5743 bytes

**Posty:** 18165 · przez **wojtas** 18 Sie 2008, 11:36

Wykonaj to co jest podane w tym temacie

zastosuj:

smitfraudfix z opcji 2
(sciagasz -> uruchamiasz-> klikasz dowolny klawisz -> wpisujesz w programie 2 i enter potem czekasz chwile -> gdy wyskoczy pytanie w programie Do you want to clean the registry ? to wpisujesz literke Y i znowu enter i czekasz do wyskoczenia raportu (znak ze skan dobiegł konca)

Zastosuj SDFix . Po pobraniu uruchom go a rozpakuje się do C:\SDFix. Uruchom komputer w trybie awaryjnym (F8 przy stracie systemu). Będąc w awaryjnym uruchom plik RunThis.bat z folderu SDFixa. Zatwierdź czyszczenie przez Y. Poczekaj aż ukończy i komputer zresetuje

Potem wejdz do folderu C:\SDFix wrzuc zawartość pliku Report.txt + log z combofixa oraz daj loga z hijacka

**Posty:** 40 · przez **ziggyddx** 18 Sie 2008, 14:16

Kod: Zaznacz wszystko: SmitFraudFix v2.337 Scan done at 13:29:33,92, 2008-08-18 Run from C:\Documents and Settings\Ela\Pulpit\SmitfraudFix OS: Microsoft Windows XP [Wersja 5.1.2600] - Windows_NT The filesystem type is NTFS Fix run in normal mode »»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Before SmitFraudFix !!!Attention, following keys are not inevitably infected!!! SrchSTS.exe by S!Ri Search SharedTaskScheduler's .dll »»»»»»»»»»»»»»»»»»»»»»»» Killing process »»»»»»»»»»»»»»»»»»»»»»»» hosts 127.0.0.1 localhost »»»»»»»»»»»»»»»»»»»»»»»» VACFix VACFix Credits: Malware Analysis & Diagnostic Code: S!Ri »»»»»»»»»»»»»»»»»»»»»»»» Winsock2 Fix S!Ri's WS2Fix: LSP not Found. »»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix GenericRenosFix by S!Ri »»»»»»»»»»»»»»»»»»»»»»»» Deleting infected files C:\WINDOWS\system32\scui.cpl Deleted C:\DOCUME~1\Ela\MENUST~1\Antivirus 2009 Deleted C:\DOCUME~1\Ela\Pulpit\Antivirus 2009.lnk Deleted C:\Program Files\AV9\ Deleted »»»»»»»»»»»»»»»»»»»»»»»» IEDFix IEDFix Credits: Malware Analysis & Diagnostic Code: S!Ri »»»»»»»»»»»»»»»»»»»»»»»» 404Fix 404Fix Credits: Malware Analysis & Diagnostic Code: S!Ri »»»»»»»»»»»»»»»»»»»»»»»» RK »»»»»»»»»»»»»»»»»»»»»»»» DNS Description: WAN (PPP/SLIP) Interface DNS Server Search Order: 80.244.140.241 DNS Server Search Order: 80.244.128.1 HKLM\SYSTEM\CCS\Services\Tcpip\..\{DE5CD21A-0E6C-4290-AF48-CF95D0336AC0}: NameServer=80.244.140.241 80.244.128.1 HKLM\SYSTEM\CS1\Services\Tcpip\..\{DE5CD21A-0E6C-4290-AF48-CF95D0336AC0}: NameServer=80.244.140.241 80.244.128.1 »»»»»»»»»»»»»»»»»»»»»»»» Deleting Temp Files »»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System !!!Attention, following keys are not inevitably infected!!! [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] "System"="" »»»»»»»»»»»»»»»»»»»»»»»» Registry Cleaning Registry Cleaning done. »»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler After SmitFraudFix !!!Attention, following keys are not inevitably infected!!! SrchSTS.exe by S!Ri Search SharedTaskScheduler's .dll »»»»»»»»»»»»»»»»»»»»»»»» End

Kod: Zaznacz wszystko: [b]SDFix: Version 1.217 [/b] Run by Ela on 2008-08-18 at 13:43 Microsoft Windows XP [Wersja 5.1.2600] Running From: C:\SDFix [b]Checking Services [/b]: Restoring Default Security Values Restoring Default Hosts File Rebooting [b]Checking Files [/b]: No Trojan Files Found Removing Temp Files [b]ADS Check [/b]: [b]Final Check [/b]: catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-08-18 13:49:50 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... scanning hidden services & system hive ... scanning hidden registry entries ... scanning hidden files ... scan completed successfully hidden processes: 0 hidden services: 0 hidden files: 0 [b]Remaining Services [/b]: Authorized Application Key Export: [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list] "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" [b]Remaining Files [/b]: [b]Files with Hidden Attributes [/b]: [b]Finished![/b]

Kod: Zaznacz wszystko: ComboFix 08-08-17.03 - Ela 2008-08-18 14:00:56.2 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.519 [GMT 2:00] Running from: C:\Documents and Settings\Ela\Pulpit\Wirus\ComboFix.exe [color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color] . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\WINDOWS\system32\ieupdates.exe.tmp . ((((((((((((((((((((((((( Files Created from 2008-07-18 to 2008-08-18 ))))))))))))))))))))))))))))))) . 2008-08-18 13:34 . 2008-08-18 13:58 <DIR> d----c--- C:\SDFix 2008-08-18 13:30 . 2008-08-18 13:30 1,778 --a------ C:\WINDOWS\system32\tmp.reg 2008-08-18 13:29 . 2007-09-06 00:22 289,144 --a------ C:\WINDOWS\system32\VCCLSID.exe 2008-08-18 13:29 . 2006-04-27 17:49 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe 2008-08-18 13:29 . 2008-05-29 09:35 86,528 --a------ C:\WINDOWS\system32\VACFix.exe 2008-08-18 13:29 . 2008-05-18 21:40 82,944 --a------ C:\WINDOWS\system32\IEDFix.exe 2008-08-18 13:29 . 2008-08-14 21:52 82,432 --a------ C:\WINDOWS\system32\IEDFix.C.exe 2008-08-18 13:29 . 2008-08-09 15:37 82,432 --a------ C:\WINDOWS\system32\404Fix.exe 2008-08-18 13:29 . 2003-06-05 21:13 53,248 --a------ C:\WINDOWS\system32\Process.exe 2008-08-18 13:29 . 2004-07-31 18:50 51,200 --a------ C:\WINDOWS\system32\dumphive.exe 2008-08-18 13:29 . 2007-10-04 00:36 25,600 --a------ C:\WINDOWS\system32\WS2Fix.exe 2008-08-18 01:15 . 2008-08-18 01:15 <DIR> d-------- C:\Program Files\Trend Micro 2008-08-18 00:12 . 2008-08-18 00:12 <DIR> d----c--- C:\Documents and Settings\Ela\Dane aplikacji\Media Player Classic 2008-08-17 18:26 . 2004-08-04 00:44 221,184 --a------ C:\WINDOWS\system32\wmpns.dll 2008-08-17 15:31 . 2008-08-17 15:31 2,560 --a------ C:\WINDOWS\system32\bitcometres.dll 2008-08-17 13:28 . 2008-06-10 02:32 73,728 --a------ C:\WINDOWS\system32\javacpl.cpl 2008-08-17 13:26 . 2008-08-17 13:28 <DIR> d-------- C:\Program Files\Java 2008-08-17 12:29 . 2008-08-17 12:29 <DIR> d----c--- C:\Documents and Settings\All Users\Dane aplikacji\Extreme Picture Finder 2008-08-17 11:27 . 2008-08-17 11:28 <DIR> d-------- C:\WINDOWS\vf_hip 2008-08-17 11:27 . 2008-08-17 11:27 32 --a------ C:\WINDOWS\go 2008-08-17 11:18 . 2008-08-17 11:24 <DIR> d----c--- C:\Documents and Settings\Ela\Dane aplikacji\Hide IP NG 2008-08-17 10:39 . 2004-08-03 23:08 26,496 --a--c--- C:\WINDOWS\system32\dllcache\usbstor.sys 2008-08-17 10:17 . 2008-08-17 10:17 427 --a------ C:\WINDOWS\ODBC.INI 2008-08-17 09:28 . 2008-08-18 00:15 69 --a------ C:\WINDOWS\NeroDigital.ini 2008-08-17 09:19 . 2008-08-17 09:22 <DIR> d----c--- C:\Documents and Settings\Ela\Dane aplikacji\Ahead 2008-08-17 09:11 . 2008-08-17 09:11 <DIR> d----c--- C:\Documents and Settings\All Users\Dane aplikacji\Nero 2008-08-17 08:09 . 2008-08-17 08:10 <DIR> d----c--- C:\Documents and Settings\Ela\Dane aplikacji\Tla Pulpitu 2008-08-16 21:17 . 2008-08-17 16:53 <DIR> d----c--- C:\Documents and Settings\Ela\Dane aplikacji\Orbit 2008-08-16 21:07 . 2008-08-16 21:07 <DIR> d----c--- C:\Documents and Settings\Ela\Dane aplikacji\vlc 2008-08-16 18:48 . 2008-08-16 18:48 <DIR> d-------- C:\Program Files\SW Flash 2008-08-16 16:34 . 2001-08-17 23:59 3,072 --a------ C:\WINDOWS\system32\drivers\audstub.sys 2008-08-16 16:33 . 2004-08-04 02:35 58,624 --a------ C:\WINDOWS\system32\drivers\redbook.sys 2008-08-16 16:32 . 2004-08-04 02:44 4,274,816 --a------ C:\WINDOWS\system32\nv4_disp.dll 2008-08-16 16:32 . 2004-08-04 00:29 1,897,408 --a------ C:\WINDOWS\system32\drivers\nv4_mini.sys 2008-08-16 16:32 . 2008-06-14 20:01 273,024 --------- C:\WINDOWS\system32\drivers\bthport.sys 2008-08-16 16:32 . 2008-06-14 20:01 273,024 -----c--- C:\WINDOWS\system32\dllcache\bthport.sys 2008-08-16 16:32 . 2004-08-04 01:07 44,672 --a------ C:\WINDOWS\system32\drivers\UAGP35.SYS 2008-08-16 16:32 . 2004-08-04 00:31 32,768 --a------ C:\WINDOWS\system32\drivers\sisnic.sys 2008-08-16 16:31 . 2004-08-04 02:44 77,312 --a------ C:\WINDOWS\system32\usbui.dll 2008-08-16 16:31 . 2004-08-04 01:08 10,624 --a------ C:\WINDOWS\system32\drivers\gameenum.sys 2008-08-16 16:27 . 2008-08-18 14:04 <DIR> dr-h-c--- C:\Documents and Settings\Default User.WINDOWS\Ustawienia lokalne 2008-08-16 16:27 . 2008-08-16 16:27 <DIR> d----c--- C:\Documents and Settings\Default User.WINDOWS\Ulubione 2008-08-16 16:27 . 2008-08-16 14:41 <DIR> d--h-c--- C:\Documents and Settings\Default User.WINDOWS\Szablony 2008-08-16 16:27 . 2008-08-16 16:27 <DIR> d----c--- C:\Documents and Settings\Default User.WINDOWS\Pulpit 2008-08-16 16:27 . 2008-08-16 16:27 <DIR> d----c--- C:\Documents and Settings\Default User.WINDOWS\Moje dokumenty 2008-08-16 16:27 . 2008-08-16 16:27 <DIR> dr---c--- C:\Documents and Settings\Default User.WINDOWS\Menu Start 2008-08-16 16:27 . 2008-08-16 16:27 <DIR> d----c--- C:\Documents and Settings\All Users\Ulubione 2008-08-16 16:27 . 2008-08-17 13:29 <DIR> d--h-c--- C:\Documents and Settings\All Users\Szablony 2008-08-16 16:27 . 2008-08-17 13:35 <DIR> d----c--- C:\Documents and Settings\All Users\Pulpit 2008-08-16 16:27 . 2008-08-18 02:16 <DIR> dr---c--- C:\Documents and Settings\All Users\Menu Start 2008-08-16 16:27 . 2008-08-16 14:43 <DIR> dr---c--- C:\Documents and Settings\All Users\Dokumenty 2008-08-16 16:27 . 2004-08-04 01:27 1,896,400 --a--c--- C:\WINDOWS\system32\dllcache\NT5.CAT 2008-08-16 16:26 . 2008-08-16 16:27 <DIR> dr-h-c--- C:\Documents and Settings\Default User.WINDOWS\Dane aplikacji 2008-08-16 16:26 . 2008-08-16 15:01 <DIR> d--h-c--- C:\Documents and Settings\Default User.WINDOWS 2008-08-16 16:26 . 2008-08-17 12:29 <DIR> dr-h-c--- C:\Documents and Settings\All Users\Dane aplikacji 2008-08-16 16:26 . 2008-08-16 14:46 <DIR> d----c--- C:\Documents and Settings\All Users 2008-08-16 16:25 . 2005-02-25 05:36 22,752 --a------ C:\WINDOWS\system32\spupdsvc.exe 2008-08-16 16:25 . 2008-08-16 14:56 623 --a------ C:\WINDOWS\system32\$winnt$.inf 2008-08-16 16:16 . 2008-08-16 16:16 <DIR> d-------- C:\Program Files\Google 2008-08-16 15:57 . 2004-08-03 23:15 145,792 --a------ C:\WINDOWS\system32\drivers\portcls.sys 2008-08-16 15:56 . 1998-10-29 16:45 306,688 --a------ C:\WINDOWS\IsUninst.exe 2008-08-16 15:56 . 2003-08-05 14:23 266,240 --a------ C:\WINDOWS\CMIUninstall.exe 2008-08-16 15:56 . 2003-07-22 11:15 225,280 --a------ C:\WINDOWS\CmiRmRedundDir.exe 2008-08-16 15:56 . 2002-10-18 15:56 28,672 --a------ C:\WINDOWS\CMIRmDriver.dll 2008-08-16 15:56 . 2008-08-16 15:56 2,314 --a------ C:\WINDOWS\Ascd_tmp.ini 2008-08-16 15:49 . 2000-03-29 16:17 5,824 --a------ C:\WINDOWS\system32\drivers\ASUSHWIO.SYS 2008-08-16 15:44 . 2008-08-16 15:44 0 --a------ C:\WINDOWS\nsreg.dat 2008-08-16 15:25 . 2003-12-08 11:53 70,688 --a------ C:\WINDOWS\system32\drivers\alcaudsl.sys 2008-08-16 15:25 . 2003-12-08 11:53 53,600 --a------ C:\WINDOWS\system32\drivers\alcan5wn.sys 2008-08-16 15:25 . 2003-12-08 11:53 5,606 --a------ C:\WINDOWS\system32\stci.dll 2008-08-16 15:25 . 2003-12-08 11:53 5,280 --a------ C:\WINDOWS\system32\drivers\alcawh.sys 2008-08-16 15:25 . 2003-12-08 11:53 3,968 --a------ C:\WINDOWS\system32\drivers\alcacr.sys 2008-08-16 15:17 . 2008-08-16 15:32 96,976 --a------ C:\WINDOWS\system32\drivers\klin.dat 2008-08-16 15:17 . 2008-08-16 15:32 87,855 --a------ C:\WINDOWS\system32\drivers\klick.dat 2008-08-16 15:16 . 2008-08-16 15:16 <DIR> d-------- C:\Program Files\Kaspersky Lab 2008-08-16 15:16 . 2008-08-18 13:58 <DIR> d----c--- C:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab 2008-08-16 15:16 . 2008-08-18 13:35 1,261,600 --ahs---- C:\WINDOWS\system32\drivers\fidbox.dat 2008-08-16 15:16 . 2008-08-18 13:35 270,368 --ahs---- C:\WINDOWS\system32\drivers\fidbox2.dat 2008-08-16 15:16 . 2008-08-18 13:35 14,080 --ahs---- C:\WINDOWS\system32\drivers\fidbox.idx 2008-08-16 15:16 . 2008-08-18 13:35 5,148 --ahs---- C:\WINDOWS\system32\drivers\fidbox2.idx 2008-08-16 15:12 . 2008-08-16 15:12 <DIR> d----c--- C:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab Setup Files 2008-08-16 15:01 . 2008-08-18 14:04 <DIR> d--h-c--- C:\Documents and Settings\Ela\Ustawienia lokalne 2008-08-16 15:01 . 2008-08-16 15:59 <DIR> dr---c--- C:\Documents and Settings\Ela\Ulubione 2008-08-16 15:01 . 2008-08-16 14:41 <DIR> d--h-c--- C:\Documents and Settings\Ela\Szablony 2008-08-16 15:01 . 2008-08-18 13:58 <DIR> d----c--- C:\Documents and Settings\Ela\Pulpit 2008-08-16 15:01 . 2008-08-17 12:31 <DIR> dr---c--- C:\Documents and Settings\Ela\Moje dokumenty 2008-08-16 15:01 . 2008-08-18 13:30 <DIR> dr---c--- C:\Documents and Settings\Ela\Menu Start 2008-08-16 15:01 . 2008-08-18 00:12 <DIR> dr-h-c--- C:\Documents and Settings\Ela\Dane aplikacji 2008-08-16 15:01 . 2008-08-18 13:35 <DIR> d----c--- C:\Documents and Settings\Ela 2008-08-16 14:58 . 2008-08-18 14:04 <DIR> d--h-c--- C:\Documents and Settings\NetworkService.ZARZĄDZANIE NT.000\Ustawienia lokalne 2008-08-16 14:58 . 2008-08-18 14:04 <DIR> d--h-c--- C:\Documents and Settings\NetworkService.ZARZĄDZANIE NT.000\Ustawienia lokalne 2008-08-16 14:58 . 2008-08-16 14:58 <DIR> d----c--- C:\Documents and Settings\NetworkService.ZARZĄDZANIE NT.000\Dane aplikacji 2008-08-16 14:58 . 2008-08-16 14:58 <DIR> d----c--- C:\Documents and Settings\NetworkService.ZARZĄDZANIE NT.000\Dane aplikacji 2008-08-16 14:58 . 2008-08-16 14:58 <DIR> d--hsc--- C:\Documents and Settings\NetworkService.ZARZĄDZANIE NT.000 2008-08-16 14:58 . 2008-08-18 14:04 <DIR> d--h-c--- C:\Documents and Settings\LocalService.ZARZĄDZANIE NT.000\Ustawienia lokalne 2008-08-16 14:58 . 2008-08-18 14:04 <DIR> d--h-c--- C:\Documents and Settings\LocalService.ZARZĄDZANIE NT.000\Ustawienia lokalne 2008-08-16 14:58 . 2008-08-16 14:58 <DIR> d----c--- C:\Documents and Settings\LocalService.ZARZĄDZANIE NT.000\Dane aplikacji 2008-08-16 14:58 . 2008-08-16 14:58 <DIR> d----c--- C:\Documents and Settings\LocalService.ZARZĄDZANIE NT.000\Dane aplikacji 2008-08-16 14:58 . 2008-08-16 14:58 <DIR> d--hsc--- C:\Documents and Settings\LocalService.ZARZĄDZANIE NT.000 2008-08-16 14:56 . 2004-08-03 23:04 156,672 --a--c--- C:\WINDOWS\system32\dllcache\winzm.ime 2008-08-16 14:56 . 2004-08-03 23:04 156,672 --a--c--- C:\WINDOWS\system32\dllcache\winsp.ime 2008-08-16 14:56 . 2004-08-03 23:04 156,672 --a--c--- C:\WINDOWS\system32\dllcache\winpy.ime 2008-08-16 14:56 . 2004-08-03 23:04 79,360 --a--c--- C:\WINDOWS\system32\dllcache\winar30.ime 2008-08-16 14:56 . 2001-08-17 21:55 69,120 --a--c--- C:\WINDOWS\system32\dllcache\wingb.ime 2008-08-16 14:56 . 2004-08-03 23:04 65,536 --a--c--- C:\WINDOWS\system32\dllcache\winime.ime 2008-08-16 14:56 . 2001-10-26 17:29 41,600 --a--c--- C:\WINDOWS\system32\dllcache\weitekp9.dll 2008-08-16 14:56 . 2001-10-26 16:58 31,360 --a--c--- C:\WINDOWS\system32\dllcache\weitekp9.sys 2008-08-16 14:56 . 2001-07-21 22:20 28,288 --a--c--- C:\WINDOWS\system32\dllcache\xjis.nls 2008-08-16 14:54 . 2001-07-21 22:23 1,875,968 --a--c--- C:\WINDOWS\system32\dllcache\msir3jp.lex 2008-08-16 14:53 . 2001-07-21 22:23 1,158,818 --a--c--- C:\WINDOWS\system32\dllcache\korwbrkr.lex 2008-08-16 14:52 . 2001-10-26 17:28 13,463,552 --a--c--- C:\WINDOWS\system32\dllcache\hwxjpn.dll 2008-08-16 14:51 . 2001-10-26 17:28 1,677,824 --a--c--- C:\WINDOWS\system32\dllcache\chsbrkr.dll 2008-08-16 14:50 . 2004-08-04 00:44 2,134,528 --a--c--- C:\WINDOWS\system32\dllcache\smtpsnap.dll 2008-08-16 14:49 . 2008-08-17 09:09 316,640 --a------ C:\WINDOWS\WMSysPr9.prx 2008-08-16 14:49 . 2008-08-16 14:49 23,392 --a------ C:\WINDOWS\system32\nscompat.tlb 2008-08-16 14:49 . 2008-08-16 14:49 16,832 --a------ C:\WINDOWS\system32\amcompat.tlb 2008-08-16 14:49 . 2008-08-16 14:49 2,596 --a------ C:\WINDOWS\system32\CONFIG.NT 2008-08-16 14:49 . 2008-08-16 14:49 0 --a------ C:\WINDOWS\control.ini 2008-08-16 14:46 . 2008-08-17 09:07 <DIR> d--hsc--- C:\Documents and Settings\All Users\DRM 2008-08-16 14:46 . 2008-08-16 14:46 749 -rah----- C:\WINDOWS\WindowsShell.Manifest 2008-08-16 14:46 . 2008-08-16 14:46 749 -rah----- C:\WINDOWS\system32\wuaucpl.cpl.manifest 2008-08-16 14:46 . 2008-08-16 14:46 749 -rah----- C:\WINDOWS\system32\sapi.cpl.manifest 2008-08-16 14:46 . 2008-08-16 14:46 749 -rah----- C:\WINDOWS\system32\nwc.cpl.manifest 2008-08-16 14:46 . 2008-08-16 14:46 749 -rah----- C:\WINDOWS\system32\ncpa.cpl.manifest 2008-08-16 14:46 . 2008-08-16 14:46 749 -rah----- C:\WINDOWS\system32\cdplayer.exe.manifest . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-08-12 11:59 --------- d-----w C:\Program Files\Common Files\Ahead 2008-08-12 09:36 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-08-03 08:19 --------- d-----w C:\Program Files\Winamp 2008-08-02 16:49 --------- d-----w C:\Program Files\Common Files\Symantec Shared 2008-08-02 00:43 --------- d-----w C:\Program Files\Real Alternative 2008-08-02 00:43 --------- d-----w C:\Program Files\QT Lite 2008-07-28 21:30 --------- d-----w C:\Program Files\Common Files\SWF Studio 2008-07-28 21:19 --------- d-----w C:\Program Files\Common Files\Real 2008-07-25 08:34 81,920 ----a-w C:\WINDOWS\system32\dpl100.dll 2008-07-25 08:34 683,520 ----a-w C:\WINDOWS\system32\divx.dll 2008-07-23 16:50 3,596,288 ----a-w C:\WINDOWS\system32\qt-dx331.dll 2008-07-12 19:44 --------- d-----w C:\Program Files\Vimicro 2008-07-12 19:44 --------- d-----w C:\Program Files\Common Files\InstallShield 2008-07-12 16:48 --------- d-----w C:\Program Files\Common Files\xing shared 2008-07-11 07:27 --------- d-----w C:\Program Files\Sun 2008-07-07 20:33 253,952 ----a-w C:\WINDOWS\system32\es.dll 2008-07-04 09:22 --------- d-----w C:\Program Files\Software Informer 2008-06-28 23:28 --------- d-----w C:\Program Files\Common Files\Skype 2008-06-28 23:18 --------- d-----w C:\Program Files\Yahoo! 2008-06-24 16:24 74,240 ----a-w C:\WINDOWS\system32\mscms.dll 2008-06-24 09:35 --------- d-----w C:\Program Files\SiSLan 2008-06-24 09:22 --------- d-----w C:\Program Files\Malicious Software Removal Tool 2008-06-24 09:17 --------- d-----w C:\Program Files\MSXML 4.0 2008-06-24 09:17 --------- d-----w C:\Program Files\Common Files\Java 2008-06-24 09:16 --------- d-----w C:\Program Files\MSXML 6.0 2008-06-24 08:39 --------- d-----w C:\Program Files\Windows Media Connect 2 2008-06-24 07:57 --------- d-----w C:\Program Files\MSBuild 2008-06-24 07:50 --------- d-----w C:\Program Files\Reference Assemblies 2008-06-24 07:19 --------- d-----w C:\Program Files\HighMAT CD Writing Wizard 2008-06-24 07:06 --------- d-----w C:\Program Files\Common Files\Adobe 2008-06-24 06:59 --------- d-----w C:\Program Files\MarBit 2008-06-24 06:22 --------- d-----w C:\Program Files\Microsoft.NET 2008-06-24 06:20 --------- d-----w C:\Program Files\Microsoft Works 2008-06-23 21:29 --------- d-----w C:\Program Files\microsoft frontpage 2008-06-23 21:25 --------- d-----w C:\Program Files\Usługi online 2008-06-23 15:41 662,016 ----a-w C:\WINDOWS\system32\wininet.dll 2008-06-20 17:42 246,784 ----a-w C:\WINDOWS\system32\mswsock.dll 2008-06-20 10:45 360,320 ----a-w C:\WINDOWS\system32\drivers\tcpip.sys 2008-06-20 10:44 138,368 ----a-w C:\WINDOWS\system32\drivers\afd.sys 2008-06-20 09:52 225,920 ----a-w C:\WINDOWS\system32\drivers\tcpip6.sys 2008-06-12 18:36 7,680 ----a-w C:\WINDOWS\system32\ff_vfw.dll 2004-10-01 13:00 40,960 ----a-w C:\Program Files\Uninstall_CDS.exe 2001-11-23 04:08 712,704 ----a-w C:\WINDOWS\inf\OTHER\AUDIO3D.DLL . ((((((((((((((((((((((((((((( snapshot@2008-08-18_ 1.36.02.06 ))))))))))))))))))))))))))))))))))))))))) . + 2008-08-07 14:27:04 163,328 ----a-w C:\WINDOWS\ERUNT\SDFIX\ERDNT.EXE + 2008-08-18 11:40:03 1,404,928 ----a-w C:\WINDOWS\ERUNT\SDFIX\Users\[u]0[/u]0000001\NTUSER.DAT + 2008-08-18 11:40:03 176,128 ----a-w C:\WINDOWS\ERUNT\SDFIX\Users\[u]0[/u]0000002\UsrClass.dat + 2008-08-07 14:27:04 163,328 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\ERDNT.EXE + 2008-08-18 11:39:52 1,404,928 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\Users\[u]0[/u]0000001\NTUSER.DAT + 2008-08-18 11:39:52 176,128 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\Users\[u]0[/u]0000002\UsrClass.dat + 2008-08-18 01:02:38 32,768 ----a-r C:\WINDOWS\Installer\{C04E32E0-0416-434D-AFB9-6969D703A9EF}\icon.exe - 2004-08-10 23:45:04 229,376 -c--a-w C:\WINDOWS\system32\dllcache\wmasf.dll + 2007-10-20 04:01:32 227,328 -c--a-w C:\WINDOWS\system32\dllcache\wmasf.dll - 2004-08-10 23:45:06 2,362,104 -c--a-w C:\WINDOWS\system32\dllcache\wmvcore.dll + 2006-12-07 06:40:49 2,362,184 -c--a-w C:\WINDOWS\system32\dllcache\wmvcore.dll - 2003-04-18 14:46:22 1,233,920 ----a-w C:\WINDOWS\system32\msxml4.dll + 2007-05-08 13:03:04 1,275,392 ----a-w C:\WINDOWS\system32\msxml4.dll - 2008-08-17 16:30:22 39,992 ----a-w C:\WINDOWS\system32\perfc009.dat + 2008-08-18 11:59:45 39,992 ----a-w C:\WINDOWS\system32\perfc009.dat - 2008-08-17 16:30:22 49,492 ----a-w C:\WINDOWS\system32\perfc015.dat + 2008-08-18 11:59:45 49,492 ----a-w C:\WINDOWS\system32\perfc015.dat - 2008-08-17 16:30:22 311,604 ----a-w C:\WINDOWS\system32\perfh009.dat + 2008-08-18 11:59:45 311,604 ----a-w C:\WINDOWS\system32\perfh009.dat - 2008-08-17 16:30:22 355,486 ----a-w C:\WINDOWS\system32\perfh015.dat + 2008-08-18 11:59:45 355,486 ----a-w C:\WINDOWS\system32\perfh015.dat - 2004-08-10 23:45:04 229,376 ----a-w C:\WINDOWS\system32\wmasf.dll + 2007-10-20 04:01:32 227,328 ----a-w C:\WINDOWS\system32\wmasf.dll - 2004-08-10 23:45:06 2,362,104 ----a-w C:\WINDOWS\system32\wmvcore.dll + 2006-12-07 06:40:49 2,362,184 ----a-w C:\WINDOWS\system32\wmvcore.dll + 2007-05-08 13:06:44 1,275,392 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.MSXML2_6bd6b9abf345378f_4.20.9848.0_x-ww_1b897e9a\msxml4.dll + 2007-04-18 08:36:40 82,432 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.MSXML2R_6bd6b9abf345378f_4.1.0.0_x-ww_29c3ad6a\msxml4r.dll . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:44 15360] "swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-08-16 18:06 68856] "Gadu-Gadu"="F:\Program Files\Gadu-Gadu\gg.exe" [2005-03-31 11:18 790528] "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2007-06-27 19:03 152872] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SpeedTouch USB Diagnostics"="F:\Program Files\Speed Touch USB\Dragdiag.exe" [2004-03-23 12:06 888832] "NeroFilterCheck"="C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" [2007-03-01 15:57 153136] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 04:27 144784] "AVP"="C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe" [2008-04-25 18:21 201992] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 00:44 15360] C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\ Microsoft Office.lnk - F:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 10:01:04 83360] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "VIDC.YV12"= yv12vfw.dll [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "16618:TCP"= 16618:TCP:BitComet 16618 TCP "16618:UDP"= 16618:UDP:BitComet 16618 UDP R0 klbg;Kaspersky Lab Boot Guard Driver;C:\WINDOWS\system32\drivers\klbg.sys [2008-01-29 18:29] R3 KLFLTDEV;Kaspersky Lab KLFltDev;C:\WINDOWS\system32\DRIVERS\klfltdev.sys [2008-03-13 19:02] R3 klim5;Kaspersky Anti-Virus NDIS Filter;C:\WINDOWS\system32\DRIVERS\klim5.sys [2008-03-25 20:07] . - - - - ORPHANS REMOVED - - - - HKCU-Run-68543899212063908279651347102434 - C:\Program Files\AV9\av2009.exe . ------- Supplementary Scan ------- . FireFox -: Profile - C:\Documents and Settings\Ela\Dane aplikacji\Mozilla\Firefox\Profiles\v6oinza3.default\ FF -: plugin - F:\Program Files\Firefox\plugins\npBitCometAgent.dll FF -: plugin - F:\Program Files\Firefox\plugins\npnul32.dll FF -: plugin - F:\Program Files\Firefox\plugins\nppl3260.dll FF -: plugin - F:\Program Files\Firefox\plugins\nprjplug.dll FF -: plugin - F:\Program Files\Firefox\plugins\nprpjplug.dll ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-08-18 14:05:13 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2008-08-18 14:09:46 ComboFix-quarantined-files.txt 2008-08-18 12:08:56 ComboFix2.txt 2008-08-17 23:37:18 Pre-Run: 3,656,007,680 bajtów wolnych Post-Run: 3,638,964,224 bajtów wolnych 274 --- E O F --- 2008-08-18 01:05:18

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 14:13:21, on 2008-08-18 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe F:\Program Files\Speed Touch USB\Dragdiag.exe C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe C:\WINDOWS\explorer.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = : R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - F:\Program Files\Bit Comet\tools\BitCometBHO_1.2.2.28.dll O2 - BHO: IEVkbdBHO - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\ievkbd.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.0.1225.9868\swg.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "F:\Program Files\Speed Touch USB\Dragdiag.exe" /icon O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe" O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe O4 - HKCU\..\Run: [Gadu-Gadu] "F:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Global Startup: Microsoft Office.lnk = F:\Program Files\Microsoft Office\Office10\OSA.EXE O8 - Extra context menu item: &D&ownload &with BitComet - res://F:\Program Files\Bit Comet\BitComet.exe/AddLink.htm O8 - Extra context menu item: &D&ownload all video with BitComet - res://F:\Program Files\Bit Comet\BitComet.exe/AddVideo.htm O8 - Extra context menu item: &D&ownload all with BitComet - res://F:\Program Files\Bit Comet\BitComet.exe/AddAllLink.htm O8 - Extra context menu item: Dodaj do listy blokowanych banerów - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\ie_banner_deny.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra button: Statystyki ochrony WWW - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\SCIEPlgn.dll O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://F:\Program Files\Bit Comet\tools\BitCometBHO_1.2.2.28.dll/206 (file missing) O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O23 - Service: Kaspersky Internet Security (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe -- End of file - 5304 bytes

**Posty:** 18165 · przez **wojtas** 18 Sie 2008, 14:23

Czysto, wykonaj:

1. Ściągnij OTMoveIt i go włacz i odpal go z opcji CleanUp

2. wykonaj optymalizację windowsa
3.sciagnij ATF_Cleaner
zaznacz
Windows Temp
All users Temp
Temporary internet files
Recycle Bin
i wcisnij EMPTY SELECTED
4.Wyłącz przywracanie systemu ( właściwości mój komputer-zakładka przywracanie - wyłącz przywracanie na wszystkich dyskach). Po chwili włącz je powrotem

Autor postu otrzymał pochwałę

**Posty:** 40 · przez **ziggyddx** 18 Sie 2008, 22:24

Już jest OK, wielkie dzięki za pomoc

. Mam jeszcze jedną prośbę, czy mógłbyś mi polecić jakiś program, który pomoże mi się chronić przed podobnymi przypadkami? Myślałam, że Kaspersky wystarczy, ale widać nie do końca...

**Posty:** 18165 · przez **wojtas** 18 Sie 2008, 22:38

jeszcze mozesz kerio personal (firewall) dla pewności.. ale nic nie zastąpi ludzkiego umyslu

pozdrawiam