atak jakiegoś wirusa

**Posty:** 120 · przez **karolkamyk** 24 Cze 2008, 15:57

Witam i z góry dziękuję za pomoc. Jakiś czas temu zorientowałem się ze nie mam zainstalowanego antywirusa. Zainstalowałem nod'a 32 i przeskanowałem system. Wykryło mi kilka wirusów, nod je usunął. Użyłem jeszcze ad-adwar, avasta i Spybot - Search & Destroy. Próbowałem przeskanować w trybie awaryjnym ale komputer nie chciał się włączyć. Kiedy juz jakoś udało mi się włączyć komputer(włączał się ok 5-10min), okazało się ze menadżer zadan nie działa poprawnie, tzn. nie da się zobaczyć jakie procesy dzilałają. Wygląda to tak: http://img391.imageshack.us/img391/2845/beznazwy1pb2.jpg
Antywirusy już nic nie wykrywają, ale mozliwe ze usunąłem jakieś ważne pliki i dla tego komp tak wolno się włącza. Proszę o sprawdzenie loga, moze tam cos siedzi.

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 15:40:31, on 2008-06-24 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\ZoneLabs\vsmon.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\Program Files\Eset\nod32krn.exe C:\WINDOWS\system32\nvsvc32.exe C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Common Files\Softwin\BitDefender Communicator\xcommsvr.exe C:\WINDOWS\system32\wscntfy.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe C:\Program Files\Analog Devices\SoundMAX\smax4.exe C:\Program Files\Eset\nod32kui.exe C:\Program Files\AutoConnect\AutoConnect.exe C:\Program Files\Gadu-Gadu\gg.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\foobar2000\foobar2000.exe C:\Program Files\Opera\opera.exe C:\Program Files\Common Files\Softwin\BitDefender Update Service\livesrv.exe C:\Program Files\Common Files\Softwin\BitDefender Scan Server\bdss.exe C:\Program Files\Softwin\BitDefender10\vsserv.exe C:\Program Files\CCleaner\CCleaner.exe C:\WINDOWS\system32\msiexec.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza R3 - URLSearchHook: (no name) - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - (no file) F2 - REG:system.ini: UserInit=userinit.exe,EXPLORER.EXE O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.1.2.7.dll O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll O2 - BHO: (no name) - {8126A4A5-BFD3-46FE-BBDF-BFB5CF78E489} - (no file) O3 - Toolbar: (no name) - {ED4BD629-C1B6-4399-8A34-02CCAA921DC9} - (no file) O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [Tweak UI] RUNDLL32.EXE TWEAKUI.CPL,TweakMeUp O4 - HKLM\..\Run: [SoundMax] "C:\Program Files\Analog Devices\SoundMAX\smax4.exe" /tray O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE O4 - HKCU\..\Run: [AutoConnect] C:\Program Files\AutoConnect\AutoConnect.exe O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - HKCU\..\Run: [BitComet] "C:\Program Files\BitComet\BitComet.exe" O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O8 - Extra context menu item: Download all links using BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm O8 - Extra context menu item: Download all videos using BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm O8 - Extra context menu item: Download link using &BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O10 - Broken Internet access because of LSP provider 'c:\program files\bonjour\mdnsnsp.dll' missing O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{60E7CB4D-30A2-472C-A0F9-6631B2FAF125}: NameServer = 194.204.159.1 217.98.63.164 O20 - Winlogon Notify: Antiwpa - C:\WINDOWS\SYSTEM32\antiwpa.dll O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe O23 - Service: BitDefender Scan Server (bdss) - Unknown owner - C:\Program Files\Common Files\Softwin\BitDefender Scan Server\bdss.exe O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Unknown owner - C:\Program Files\Bonjour\mDNSResponder.exe (file missing) O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: BitDefender Desktop Update Service (LIVESRV) - SOFTWIN S.R.L. - C:\Program Files\Common Files\Softwin\BitDefender Update Service\livesrv.exe O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe O23 - Service: BitDefender Virus Shield (VSSERV) - SOFTWIN S.R.L. - C:\Program Files\Softwin\BitDefender10\vsserv.exe O23 - Service: BitDefender Communicator (XCOMM) - SOFTWIN S.R.L - C:\Program Files\Common Files\Softwin\BitDefender Communicator\xcommsvr.exe -- End of file - 8043 bytes

**Posty:** 8001 · przez **Okocza** 24 Cze 2008, 16:02

Kod: Zaznacz wszystko: R3 - URLSearchHook: (no name) - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - (no file) F2 - REG:system.ini: UserInit=userinit.exe,EXPLORER.EXE O2 - BHO: (no name) - {8126A4A5-BFD3-46FE-BBDF-BFB5CF78E489} - (no file) O3 - Toolbar: (no name) - {ED4BD629-C1B6-4399-8A34-02CCAA921DC9} - (no file)

+ log z combofixa

Autor postu otrzymał pochwałę

**Posty:** 7956 · przez **Magik** 24 Cze 2008, 16:06

http://forum.programosy.pl/przeczytaj-zanim-wstawisz-logi-na-forum-vt93842.html

:!:

karolkamyk napisał(a):okazało się ze menadżer zadan nie działa poprawnie, tzn. nie da się zobaczyć jakie procesy dzilałają. Wygląda to tak: http://img391.imageshack.us/img391/2845/beznazwy1pb2.jpg

Dwuklik na ramce znajdujacej się dookoła listy aplikacji.

**Posty:** 120 · przez **karolkamyk** 24 Cze 2008, 16:50

Nie mogę sciągnąc combofixa. Próbowałem z różnych źródeł, różnymi przeglądarkami i nic. docodzi do 95% i konczy pobieranie, a puzniej jak odpalam combofixa to wyskakuje błąd: http://img377.imageshack.us/img377/5531/beznazwy1kopiabh9.jpg . Zapmniałem dodać ze przy włączaniu, automatycznei wałączają sie moje dokumenty, chociaz nigdy tego nie bylo.

**Posty:** 7956 · przez **Magik** 24 Cze 2008, 17:01

Nie mogę sciągnąc combofixa. Próbowałem z różnych źródeł, różnymi przeglądarkami i nic. docodzi do 95% i konczy pobieranie, a puzniej jak odpalam combofixa to wyskakuje błąd: http://img377.imageshack.us/img377/5531/beznazwy1kopiabh9.jpg . Zapmniałem dodać ze przy włączaniu, automatycznei wałączają sie moje dokumenty, chociaz nigdy tego nie bylo.

sciagnij stad i odpal KONIECZNIE!!!!!Zrobiles to co Mariusz napisal??

http://www.sendspace.pl/file/gv78pDyR/

Autor postu otrzymał pochwałę

**Posty:** 120 · przez **karolkamyk** 24 Cze 2008, 18:34

Tak zrobiłem. Z sendspase tez nie idzie

. Sprawdziłem i nie mogę nic do konca sciągnąć, przy 95% wyskakuje błąd

**Posty:** 18165 · przez **wojtas** 24 Cze 2008, 18:38

wylacz antywira i firewalla i pobierz combofixa... jak nie to log z dss'a

Autor postu otrzymał pochwałę

**Posty:** 120 · przez **karolkamyk** 24 Cze 2008, 18:52

Zrobiłem tak jak napisałeś i poszło

. Oto log:

Kod: Zaznacz wszystko: ComboFix 08-06-20.4 - Kamyk 2008-06-24 18:44:05.3 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.873 [GMT 2:00] Running from: C:\Documents and Settings\Kamyk.AL-9432B1D00A34\Pulpit\ComboFix.exe * Created a new restore point * Resident AV is active [color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color] . ((((((((((((((((((((((((( Files Created from 2008-05-24 to 2008-06-24 ))))))))))))))))))))))))))))))) . 2008-06-24 15:37 . 2008-06-24 15:37 <DIR> d-------- C:\Program Files\Trend Micro 2008-06-24 15:36 . 2008-06-24 15:36 <DIR> d-------- C:\WINDOWS\BDOSCAN8 2008-06-23 22:34 . 2008-06-24 18:36 81,984 --a------ C:\WINDOWS\system32\bdod.bin 2008-06-23 22:28 . 2008-06-23 22:28 <DIR> d-------- C:\Program Files\Softwin 2008-06-23 22:25 . 2008-06-24 18:36 <DIR> d-------- C:\Program Files\Common Files\Softwin 2008-06-23 22:24 . 2008-06-23 22:25 <DIR> d-------- C:\Program Files\Spybot - Search & Destroy 2008-06-23 22:24 . 2008-06-23 22:24 <DIR> d-------- C:\Program Files\Alwil Software 2008-06-23 22:24 . 2008-06-23 22:31 <DIR> d-------- C:\Documents and Settings\All Users.WINDOWS\Dane aplikacji\Spybot - Search & Destroy 2008-06-23 22:15 . 2008-06-23 22:15 49,152 --a------ C:\WINDOWS\system32\msfun80.Vexe 2008-06-23 21:51 . 2004-08-04 00:44 116,736 --a--c--- C:\WINDOWS\system32\dllcache\xrxwiadr.dll 2008-06-23 21:51 . 2001-08-18 06:37 99,865 --a--c--- C:\WINDOWS\system32\dllcache\xlog.exe 2008-06-23 21:51 . 2001-10-26 17:30 27,648 --a--c--- C:\WINDOWS\system32\dllcache\xrxftplt.exe 2008-06-23 21:51 . 2001-10-26 17:29 23,040 --a--c--- C:\WINDOWS\system32\dllcache\xrxwbtmp.dll 2008-06-23 21:51 . 2004-08-03 22:29 19,455 --a--c--- C:\WINDOWS\system32\dllcache\wvchntxx.sys 2008-06-23 21:51 . 2001-10-26 17:29 17,408 --a--c--- C:\WINDOWS\system32\dllcache\xrxscnui.dll 2008-06-23 21:51 . 2001-08-17 20:11 16,970 --a--c--- C:\WINDOWS\system32\dllcache\xem336n5.sys 2008-06-23 21:51 . 2001-10-26 17:30 4,608 --a--c--- C:\WINDOWS\system32\dllcache\xrxflnch.exe 2008-06-23 21:50 . 2001-08-17 21:28 771,581 --a--c--- C:\WINDOWS\system32\dllcache\winacisa.sys 2008-06-23 21:50 . 2001-08-17 21:28 701,386 --a--c--- C:\WINDOWS\system32\dllcache\wdhaalba.sys 2008-06-23 21:50 . 2004-08-03 22:31 154,624 --a--c--- C:\WINDOWS\system32\dllcache\wlluc48.sys 2008-06-23 21:50 . 2001-10-26 17:29 87,040 --a--c--- C:\WINDOWS\system32\dllcache\wiafbdrv.dll 2008-06-23 21:50 . 2001-10-26 17:29 54,272 --a--c--- C:\WINDOWS\system32\dllcache\wiamsmud.dll 2008-06-23 21:50 . 2001-10-26 17:00 34,890 --a--c--- C:\WINDOWS\system32\dllcache\wlandrv2.sys 2008-06-23 21:50 . 2004-08-03 23:10 19,328 --a--c--- C:\WINDOWS\system32\dllcache\wstcodec.sys 2008-06-23 21:50 . 2004-08-03 22:29 12,063 --a--c--- C:\WINDOWS\system32\dllcache\wsiintxx.sys 2008-06-23 21:50 . 2004-08-03 23:07 8,832 --a--c--- C:\WINDOWS\system32\dllcache\wmiacpi.sys 2008-06-23 21:50 . 2004-08-04 00:44 8,192 --a--c--- C:\WINDOWS\system32\dllcache\wshirda.dll 2008-06-23 21:48 . 2001-08-17 21:28 794,654 --a--c--- C:\WINDOWS\system32\dllcache\usr1801.sys 2008-06-23 21:47 . 2001-10-26 16:47 286,272 --a--c--- C:\WINDOWS\system32\dllcache\stlnata.sys 2008-06-23 21:46 . 2001-10-26 17:29 147,200 --a--c--- C:\WINDOWS\system32\dllcache\smidispb.dll 2008-06-23 21:45 . 2004-08-03 22:41 404,990 --a--c--- C:\WINDOWS\system32\dllcache\slntamr.sys 2008-06-23 21:44 . 2001-10-26 17:01 899,530 --a--c--- C:\WINDOWS\system32\dllcache\r2mdkxga.sys 2008-06-23 21:43 . 2004-08-04 00:43 259,328 --a--c--- C:\WINDOWS\system32\dllcache\perm3dd.dll 2008-06-23 21:42 . 2001-08-17 22:05 351,616 --a--c--- C:\WINDOWS\system32\dllcache\ovcodek2.sys 2008-06-23 21:41 . 2004-08-04 00:44 1,737,856 --a--c--- C:\WINDOWS\system32\dllcache\mtxparhd.dll 2008-06-23 21:40 . 2001-08-17 21:28 802,683 --a--c--- C:\WINDOWS\system32\dllcache\ltsm.sys 2008-06-23 21:39 . 2001-10-26 16:51 728,170 --a--c--- C:\WINDOWS\system32\dllcache\ltck000c.sys 2008-06-23 21:38 . 2004-08-04 00:44 153,088 --a--c--- C:\WINDOWS\system32\dllcache\irftp.exe 2008-06-23 21:37 . 2004-08-04 00:44 702,845 --a--c--- C:\WINDOWS\system32\dllcache\i81xdnt5.dll 2008-06-23 21:36 . 2004-08-03 22:41 1,041,536 --a--c--- C:\WINDOWS\system32\dllcache\hsfdpsp2.sys 2008-06-23 21:35 . 2001-10-26 17:29 1,733,120 --a--c--- C:\WINDOWS\system32\dllcache\g400d.dll 2008-06-23 21:34 . 2001-10-26 16:57 630,016 --a--c--- C:\WINDOWS\system32\dllcache\eqn.sys 2008-06-23 21:33 . 2001-08-17 20:14 952,007 --a--c--- C:\WINDOWS\system32\dllcache\diwan.sys 2008-06-23 21:32 . 2001-10-26 17:29 421,917 --a--c--- C:\WINDOWS\system32\dllcache\dgconfig.dll 2008-06-23 21:31 . 2001-10-26 16:57 980,034 --a--c--- C:\WINDOWS\system32\dllcache\cicap.sys 2008-06-23 21:30 . 2001-08-17 21:28 871,388 --a--c--- C:\WINDOWS\system32\dllcache\bcmdm.sys 2008-06-23 21:29 . 2004-08-04 00:43 1,888,992 --a--c--- C:\WINDOWS\system32\dllcache\ati3duag.dll 2008-06-23 21:28 . 2001-08-17 20:19 747,392 --a--c--- C:\WINDOWS\system32\dllcache\adm8830.sys 2008-06-23 21:27 . 2001-08-17 21:28 762,780 --a--c--- C:\WINDOWS\system32\dllcache\3cwmcru.sys 2008-06-23 16:35 . 2008-06-23 16:35 502,208 --a------ C:\WINDOWS\system32\drivers\amon.sys 2008-06-23 16:35 . 2008-06-23 16:35 270,336 --a------ C:\WINDOWS\system32\imon.dll 2008-06-21 00:09 . 2008-06-21 00:14 <DIR> d-------- C:\WINDOWS\system32\embedded 2008-06-21 00:09 . 2008-06-21 13:49 <DIR> d-------- C:\Program Files\Kolekcja Klasyki 2008-06-19 10:49 . 2008-06-23 20:40 0 ---hs---- C:\fun.xls.exe 2008-05-25 23:14 . 2008-05-25 23:17 <DIR> d-------- C:\Program Files\Aspell . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-06-24 16:39 --------- d-----w C:\Program Files\AutoConnect 2008-06-24 16:38 3,008,512 ----a-w C:\WINDOWS\Internet Logs\xDB3D.tmp 2008-06-24 16:37 --------- d-----w C:\Documents and Settings\Kamyk.AL-9432B1D00A34\Dane aplikacji\foobar2000 2008-06-23 19:34 --------- d-----w C:\Documents and Settings\Kamyk.AL-9432B1D00A34\Dane aplikacji\Skype 2008-06-23 17:03 --------- d-----w C:\Program Files\ESET 2008-06-23 14:48 --------- d-----w C:\Program Files\Common Files\Macromedia 2008-06-23 11:15 3,049,472 ----a-w C:\WINDOWS\Internet Logs\xDB3C.tmp 2008-06-22 08:57 --------- d-----w C:\Program Files\Asystent Plusfon 601i 2008-06-21 13:55 1,321,472 ----a-w C:\WINDOWS\Internet Logs\xDB3A.tmp 2008-06-21 13:55 1,264,128 ----a-w C:\WINDOWS\Internet Logs\xDB3B.tmp 2008-06-20 22:17 3,059,200 ----a-w C:\WINDOWS\Internet Logs\xDB39.tmp 2008-06-20 10:14 2,696,704 ----a-w C:\WINDOWS\Internet Logs\xDB38.tmp 2008-06-19 17:18 3,421,184 ----a-w C:\WINDOWS\Internet Logs\xDB36.tmp 2008-06-19 17:18 1,260,544 ----a-w C:\WINDOWS\Internet Logs\xDB37.tmp 2008-06-18 11:42 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-06-18 11:36 --------- d-----w C:\Program Files\KONAMI 2008-06-12 14:57 --------- d-----w C:\Program Files\Opera 2008-05-24 11:12 3,173,376 ----a-w C:\WINDOWS\Internet Logs\xDB34.tmp 2008-05-24 11:12 1,227,776 ----a-w C:\WINDOWS\Internet Logs\xDB35.tmp 2008-05-17 15:23 --------- d-----w C:\Program Files\Real 2008-05-17 15:23 --------- d-----w C:\Program Files\Common Files\xing shared 2008-05-17 15:23 --------- d-----w C:\Program Files\Common Files\Real 2008-05-15 14:30 2,947,072 ----a-w C:\WINDOWS\Internet Logs\xDB32.tmp 2008-05-15 14:30 1,208,320 ----a-w C:\WINDOWS\Internet Logs\xDB33.tmp 2008-05-14 20:00 3,068,928 ----a-w C:\WINDOWS\Internet Logs\xDB31.tmp 2008-05-12 19:20 195,584 ----a-w C:\WINDOWS\Internet Logs\xDB30.tmp 2008-05-12 18:59 5,340,160 ----a-w C:\WINDOWS\Internet Logs\xDB2D.tmp 2008-05-12 18:59 1,686,528 ----a-w C:\WINDOWS\Internet Logs\xDB2E.tmp 2008-05-12 18:58 1,686,528 ----a-w C:\WINDOWS\Internet Logs\xDB2F.tmp 2008-05-03 11:47 --------- d-----w C:\Program Files\Common Files\Adobe 2008-04-30 16:16 --------- d-----w C:\Program Files\directx 2008-04-16 12:38 6,303,169 ----a-w C:\WINDOWS\Internet Logs\tvDebug.zip 2007-10-31 14:17 24,192 ----a-w C:\Documents and Settings\Kamyk.AL-9432B1D00A34\usbsermptxp.sys 2007-10-31 14:17 22,768 ----a-w C:\Documents and Settings\Kamyk.AL-9432B1D00A34\usbsermpt.sys 2007-06-26 15:30 92,064 ----a-w C:\Documents and Settings\Kamyk.AL-9432B1D00A34\mqdmmdm.sys 2007-06-26 15:30 9,232 ----a-w C:\Documents and Settings\Kamyk.AL-9432B1D00A34\mqdmmdfl.sys 2007-06-26 15:30 79,328 ----a-w C:\Documents and Settings\Kamyk.AL-9432B1D00A34\mqdmserd.sys 2007-06-26 15:30 66,656 ----a-w C:\Documents and Settings\Kamyk.AL-9432B1D00A34\mqdmbus.sys 2007-06-26 15:30 6,208 ----a-w C:\Documents and Settings\Kamyk.AL-9432B1D00A34\mqdmcmnt.sys 2007-06-26 15:30 5,936 ----a-w C:\Documents and Settings\Kamyk.AL-9432B1D00A34\mqdmwhnt.sys 2007-06-26 15:30 4,048 ----a-w C:\Documents and Settings\Kamyk.AL-9432B1D00A34\mqdmcr.sys . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "AutoConnect"="C:\Program Files\AutoConnect\AutoConnect.exe" [2004-08-28 20:27 295424] "Gadu-Gadu"="C:\Program Files\Gadu-Gadu\gg.exe" [2007-05-10 16:36 2111176] "BitComet"="C:\Program Files\BitComet\BitComet.exe" [2007-02-08 10:49 4526144] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 01:44 15360] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Zone Labs Client"="C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [2006-07-09 13:42 968696] "nwiz"="nwiz.exe" [2006-10-22 13:22 1622016 C:\WINDOWS\system32\nwiz.exe] "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-10-22 13:22 7700480] "Tweak UI"="TWEAKUI.CPL,TweakMeUp" [] "nod32kui"="C:\Program Files\Eset\nod32kui.exe" [2008-06-23 16:35 917504] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 01:44 15360] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] "ForceClassicControlPanel"= 1 (0x1) "NoChangeKeyboardNavigationIndicators"= 0 (0x0) "NoSMConfigurePrograms"= 1 (0x1) [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\Antiwpa] antiwpa.dll 2006-10-11 16:08 5376 C:\WINDOWS\system32\antiwpa.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "vidc.yv12"= C:\PROGRA~1\ACEMEG~1\SystemS\ATI\atiyuv12.DLL "vidc.divx"= C:\PROGRA~1\ACEMEG~1\SystemS\DivX\DivX520.dll "vidc.iyuv"= C:\PROGRA~1\ACEMEG~1\SystemS\Intel\iyuv_32.dll "vidc.yvu9"= C:\PROGRA~1\ACEMEG~1\SystemS\Intel\Iyvu9_32.dll "vidc.uyvy"= C:\PROGRA~1\ACEMEG~1\SystemS\MICROS~1\msyuv.dll "vidc.yuy2"= C:\PROGRA~1\ACEMEG~1\SystemS\MICROS~1\msyuv.dll "vidc.yvyu"= C:\PROGRA~1\ACEMEG~1\SystemS\MICROS~1\msyuv.dll [HKLM\~\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Menu Start^Programy^Autostart^Adobe Gamma Loader.lnk] path=C:\Documents and Settings\All Users.WINDOWS\Menu Start\Programy\Autostart\Adobe Gamma Loader.lnk backup=C:\WINDOWS\pss\Adobe Gamma Loader.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\avast!] --a------ 2008-05-16 01:19 79224 C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BDAgent] C:\Program Files\Softwin\BitDefender10\bdagent.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BDMCon] C:\Program Files\Softwin\BitDefender10\bdmcon.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BitComet] --a------ 2007-02-08 10:49 4526144 C:\Program Files\BitComet\BitComet.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\C:] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\C:\Program Files] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\C:\Program Files\NetMeter] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\C:\Program Files\NetMeter\NetMeter.exe] C:\Program Files\NetMeter\NetMeter.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CloneCDElbyCDFL] C:\Program Files\Elaborate Bytes\CloneCD\ElbyCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CloneCDTray] C:\Program Files\Elaborate Bytes\CloneCD\CloneCDTray.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CoolSwitch] --a------ 2002-03-19 17:30 45632 C:\WINDOWS\system32\taskswitch.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools-1033] --a------ 2004-08-22 18:05 81920 C:\Program Files\D-Tools\daemon.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EdHTML] --a------ 2003-03-24 17:38 1443328 C:\Program Files\Binboy\EdHTMLv5.0\EdHTML.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IMJPMIG8.2] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\InCD] C:\Program Files\Ahead\InCD\InCD.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsServer] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] --a------ 2001-07-09 11:50 155648 C:\WINDOWS\system32\NeroCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] --a------ 2008-02-01 00:13 385024 C:\Program Files\QuickTime\QTTask.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl] C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMAX] --a------ 2004-08-06 08:27 860160 C:\Program Files\Analog Devices\SoundMAX\Smax4.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMAXPnP] --a------ 2004-07-27 13:48 1388544 C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpeedTouch USB Diagnostics] --a------ 2004-01-26 11:38 866816 C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpybotSD TeaTimer] -rahs---- 2008-01-28 11:43 2097488 C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched] --a------ 2007-06-14 18:32 132760 C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe] --a------ 2008-05-17 17:23 151597 C:\Program Files\Real Alternative\Update_OB\realsched.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UnlockerAssistant] C:\Program Files\Unlocker\UnlockerAssistant.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\wsctf.exe] [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "C:\\Program Files\\KONAMI\\Pro Evolution Soccer 2008\\PES2008.exe"= "C:\\Program Files\\Skype\\Phone\\Skype.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "13081:TCP"= 13081:TCP:BitComet 13081 TCP "13081:UDP"= 13081:UDP:BitComet 13081 UDP R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-05-16 01:20] R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-05-16 01:16] S0 ElbyVCD;ElbyVCD;C:\WINDOWS\system32\DRIVERS\ElbyVCD.sys [] S3 k510bus;Sony Ericsson K510 Driver driver (WDM);C:\WINDOWS\system32\DRIVERS\k510bus.sys [2006-02-17 20:34] S3 k510mdfl;Sony Ericsson K510 USB WMC Modem Filter;C:\WINDOWS\system32\DRIVERS\k510mdfl.sys [2006-02-17 20:34] S3 k510mdm;Sony Ericsson K510 USB WMC Modem Driver;C:\WINDOWS\system32\DRIVERS\k510mdm.sys [2006-02-17 20:34] S3 qcusbser;ZTE USB Device for Legacy Serial Communication;C:\WINDOWS\system32\DRIVERS\ZTEusbser.sys [2007-09-18 10:20] S3 usbscan;Sterownik skanera USB;C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-03 22:58] S3 USBSTOR;Sterownik magazynu masowego USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-03 23:08] S3 w200bus;Sony Ericsson W200 driver (WDM);C:\WINDOWS\system32\DRIVERS\w200bus.sys [2006-11-07 09:42] S3 w200mdfl;Sony Ericsson W200 USB WMC Modem Filter;C:\WINDOWS\system32\DRIVERS\w200mdfl.sys [2006-11-07 09:42] S3 w200mdm;Sony Ericsson W200 USB WMC Modem Driver;C:\WINDOWS\system32\DRIVERS\w200mdm.sys [2006-11-07 09:42] S3 w200mgmt;Sony Ericsson W200 USB WMC Device Management Drivers (WDM);C:\WINDOWS\system32\DRIVERS\w200mgmt.sys [2006-11-07 09:42] S3 w200obex;Sony Ericsson W200 USB WMC OBEX Interface;C:\WINDOWS\system32\DRIVERS\w200obex.sys [2006-11-07 09:42] S3 z520bus;Sony Ericsson 520 driver (WDM);C:\WINDOWS\system32\DRIVERS\z520bus.sys [2006-03-13 17:54] S3 z520mdfl;Sony Ericsson 520 USB WMC Modem Filter;C:\WINDOWS\system32\DRIVERS\z520mdfl.sys [2006-03-13 17:54] S3 z520mdm;Sony Ericsson 520 USB WMC Modem Drivers;C:\WINDOWS\system32\DRIVERS\z520mdm.sys [2006-03-13 17:54] S3 z520mgmt;Sony Ericsson 520 USB WMC Device Management Drivers;C:\WINDOWS\system32\DRIVERS\z520mgmt.sys [2006-03-13 17:54] S3 z520obex;Sony Ericsson 520 USB WMC OBEX Interface Drivers;C:\WINDOWS\system32\DRIVERS\z520obex.sys [2006-03-13 17:54] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{7808e90b-3d32-11dc-8665-000e50937e74}] \Shell\AutoRun\command - H:\EXPLORER.EXE \Shell\explore\Command - H:\EXPLORER.EXE \Shell\open\Command - H:\EXPLORER.EXE . Contents of the 'Scheduled Tasks' folder "2008-02-17 15:47:21 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job" - C:\Program Files\Apple Software Update\SoftwareUpdate.exe .

**Posty:** 18165 · przez **wojtas** 24 Cze 2008, 19:26

log sie nie zmiescil wstaw nowy na jakis serwerek wrzuc

**Posty:** 120 · przez **karolkamyk** 24 Cze 2008, 19:31

http://www.sendspace.pl/file/2PoVzNXy/ alo tu jest to samo co podalem wczesniej, widocznie nie dokonca zapisało, zaraz zrobie jeszcze raz

[ Dodano: Dzisiaj o 18:48 ]
Teraz jest całość

Kod: Zaznacz wszystko: ComboFix 08-06-20.4 - Kamyk 2008-06-24 19:41:05.4 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.894 [GMT 2:00] Running from: C:\Documents and Settings\Kamyk.AL-9432B1D00A34\Pulpit\ComboFix.exe * Resident AV is active [color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color] . ((((((((((((((((((((((((( Files Created from 2008-05-24 to 2008-06-24 ))))))))))))))))))))))))))))))) . 2008-06-24 15:37 . 2008-06-24 15:37 <DIR> d-------- C:\Program Files\Trend Micro 2008-06-24 15:36 . 2008-06-24 15:36 <DIR> d-------- C:\WINDOWS\BDOSCAN8 2008-06-23 22:34 . 2008-06-24 18:36 81,984 --a------ C:\WINDOWS\system32\bdod.bin 2008-06-23 22:28 . 2008-06-23 22:28 <DIR> d-------- C:\Program Files\Softwin 2008-06-23 22:25 . 2008-06-24 18:36 <DIR> d-------- C:\Program Files\Common Files\Softwin 2008-06-23 22:24 . 2008-06-23 22:25 <DIR> d-------- C:\Program Files\Spybot - Search & Destroy 2008-06-23 22:24 . 2008-06-23 22:24 <DIR> d-------- C:\Program Files\Alwil Software 2008-06-23 22:24 . 2008-06-23 22:31 <DIR> d-------- C:\Documents and Settings\All Users.WINDOWS\Dane aplikacji\Spybot - Search & Destroy 2008-06-23 22:15 . 2008-06-23 22:15 49,152 --a------ C:\WINDOWS\system32\msfun80.Vexe 2008-06-23 21:51 . 2004-08-04 00:44 116,736 --a--c--- C:\WINDOWS\system32\dllcache\xrxwiadr.dll 2008-06-23 21:51 . 2001-08-18 06:37 99,865 --a--c--- C:\WINDOWS\system32\dllcache\xlog.exe 2008-06-23 21:51 . 2001-10-26 17:30 27,648 --a--c--- C:\WINDOWS\system32\dllcache\xrxftplt.exe 2008-06-23 21:51 . 2001-10-26 17:29 23,040 --a--c--- C:\WINDOWS\system32\dllcache\xrxwbtmp.dll 2008-06-23 21:51 . 2004-08-03 22:29 19,455 --a--c--- C:\WINDOWS\system32\dllcache\wvchntxx.sys 2008-06-23 21:51 . 2001-10-26 17:29 17,408 --a--c--- C:\WINDOWS\system32\dllcache\xrxscnui.dll 2008-06-23 21:51 . 2001-08-17 20:11 16,970 --a--c--- C:\WINDOWS\system32\dllcache\xem336n5.sys 2008-06-23 21:51 . 2001-10-26 17:30 4,608 --a--c--- C:\WINDOWS\system32\dllcache\xrxflnch.exe 2008-06-23 21:50 . 2001-08-17 21:28 771,581 --a--c--- C:\WINDOWS\system32\dllcache\winacisa.sys 2008-06-23 21:50 . 2001-08-17 21:28 701,386 --a--c--- C:\WINDOWS\system32\dllcache\wdhaalba.sys 2008-06-23 21:50 . 2004-08-03 22:31 154,624 --a--c--- C:\WINDOWS\system32\dllcache\wlluc48.sys 2008-06-23 21:50 . 2001-10-26 17:29 87,040 --a--c--- C:\WINDOWS\system32\dllcache\wiafbdrv.dll 2008-06-23 21:50 . 2001-10-26 17:29 54,272 --a--c--- C:\WINDOWS\system32\dllcache\wiamsmud.dll 2008-06-23 21:50 . 2001-10-26 17:00 34,890 --a--c--- C:\WINDOWS\system32\dllcache\wlandrv2.sys 2008-06-23 21:50 . 2004-08-03 23:10 19,328 --a--c--- C:\WINDOWS\system32\dllcache\wstcodec.sys 2008-06-23 21:50 . 2004-08-03 22:29 12,063 --a--c--- C:\WINDOWS\system32\dllcache\wsiintxx.sys 2008-06-23 21:50 . 2004-08-03 23:07 8,832 --a--c--- C:\WINDOWS\system32\dllcache\wmiacpi.sys 2008-06-23 21:50 . 2004-08-04 00:44 8,192 --a--c--- C:\WINDOWS\system32\dllcache\wshirda.dll 2008-06-23 21:48 . 2001-08-17 21:28 794,654 --a--c--- C:\WINDOWS\system32\dllcache\usr1801.sys 2008-06-23 21:47 . 2001-10-26 16:47 286,272 --a--c--- C:\WINDOWS\system32\dllcache\stlnata.sys 2008-06-23 21:46 . 2001-10-26 17:29 147,200 --a--c--- C:\WINDOWS\system32\dllcache\smidispb.dll 2008-06-23 21:45 . 2004-08-03 22:41 404,990 --a--c--- C:\WINDOWS\system32\dllcache\slntamr.sys 2008-06-23 21:44 . 2001-10-26 17:01 899,530 --a--c--- C:\WINDOWS\system32\dllcache\r2mdkxga.sys 2008-06-23 21:43 . 2004-08-04 00:43 259,328 --a--c--- C:\WINDOWS\system32\dllcache\perm3dd.dll 2008-06-23 21:42 . 2001-08-17 22:05 351,616 --a--c--- C:\WINDOWS\system32\dllcache\ovcodek2.sys 2008-06-23 21:41 . 2004-08-04 00:44 1,737,856 --a--c--- C:\WINDOWS\system32\dllcache\mtxparhd.dll 2008-06-23 21:40 . 2001-08-17 21:28 802,683 --a--c--- C:\WINDOWS\system32\dllcache\ltsm.sys 2008-06-23 21:39 . 2001-10-26 16:51 728,170 --a--c--- C:\WINDOWS\system32\dllcache\ltck000c.sys 2008-06-23 21:38 . 2004-08-04 00:44 153,088 --a--c--- C:\WINDOWS\system32\dllcache\irftp.exe 2008-06-23 21:37 . 2004-08-04 00:44 702,845 --a--c--- C:\WINDOWS\system32\dllcache\i81xdnt5.dll 2008-06-23 21:36 . 2004-08-03 22:41 1,041,536 --a--c--- C:\WINDOWS\system32\dllcache\hsfdpsp2.sys 2008-06-23 21:35 . 2001-10-26 17:29 1,733,120 --a--c--- C:\WINDOWS\system32\dllcache\g400d.dll 2008-06-23 21:34 . 2001-10-26 16:57 630,016 --a--c--- C:\WINDOWS\system32\dllcache\eqn.sys 2008-06-23 21:33 . 2001-08-17 20:14 952,007 --a--c--- C:\WINDOWS\system32\dllcache\diwan.sys 2008-06-23 21:32 . 2001-10-26 17:29 421,917 --a--c--- C:\WINDOWS\system32\dllcache\dgconfig.dll 2008-06-23 21:31 . 2001-10-26 16:57 980,034 --a--c--- C:\WINDOWS\system32\dllcache\cicap.sys 2008-06-23 21:30 . 2001-08-17 21:28 871,388 --a--c--- C:\WINDOWS\system32\dllcache\bcmdm.sys 2008-06-23 21:29 . 2004-08-04 00:43 1,888,992 --a--c--- C:\WINDOWS\system32\dllcache\ati3duag.dll 2008-06-23 21:28 . 2001-08-17 20:19 747,392 --a--c--- C:\WINDOWS\system32\dllcache\adm8830.sys 2008-06-23 21:27 . 2001-08-17 21:28 762,780 --a--c--- C:\WINDOWS\system32\dllcache\3cwmcru.sys 2008-06-23 16:35 . 2008-06-23 16:35 502,208 --a------ C:\WINDOWS\system32\drivers\amon.sys 2008-06-23 16:35 . 2008-06-23 16:35 270,336 --a------ C:\WINDOWS\system32\imon.dll 2008-06-21 00:09 . 2008-06-21 00:14 <DIR> d-------- C:\WINDOWS\system32\embedded 2008-06-21 00:09 . 2008-06-21 13:49 <DIR> d-------- C:\Program Files\Kolekcja Klasyki 2008-06-19 10:49 . 2008-06-23 20:40 0 ---hs---- C:\fun.xls.exe 2008-05-25 23:14 . 2008-05-25 23:17 <DIR> d-------- C:\Program Files\Aspell . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-06-24 16:39 --------- d-----w C:\Program Files\AutoConnect 2008-06-24 16:38 3,008,512 ----a-w C:\WINDOWS\Internet Logs\xDB3D.tmp 2008-06-24 16:37 --------- d-----w C:\Documents and Settings\Kamyk.AL-9432B1D00A34\Dane aplikacji\foobar2000 2008-06-23 19:34 --------- d-----w C:\Documents and Settings\Kamyk.AL-9432B1D00A34\Dane aplikacji\Skype 2008-06-23 17:03 --------- d-----w C:\Program Files\ESET 2008-06-23 14:48 --------- d-----w C:\Program Files\Common Files\Macromedia 2008-06-23 11:15 3,049,472 ----a-w C:\WINDOWS\Internet Logs\xDB3C.tmp 2008-06-22 08:57 --------- d-----w C:\Program Files\Asystent Plusfon 601i 2008-06-21 13:55 1,321,472 ----a-w C:\WINDOWS\Internet Logs\xDB3A.tmp 2008-06-21 13:55 1,264,128 ----a-w C:\WINDOWS\Internet Logs\xDB3B.tmp 2008-06-20 22:17 3,059,200 ----a-w C:\WINDOWS\Internet Logs\xDB39.tmp 2008-06-20 10:14 2,696,704 ----a-w C:\WINDOWS\Internet Logs\xDB38.tmp 2008-06-19 17:18 3,421,184 ----a-w C:\WINDOWS\Internet Logs\xDB36.tmp 2008-06-19 17:18 1,260,544 ----a-w C:\WINDOWS\Internet Logs\xDB37.tmp 2008-06-18 11:42 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-06-18 11:36 --------- d-----w C:\Program Files\KONAMI 2008-06-12 14:57 --------- d-----w C:\Program Files\Opera 2008-05-24 11:12 3,173,376 ----a-w C:\WINDOWS\Internet Logs\xDB34.tmp 2008-05-24 11:12 1,227,776 ----a-w C:\WINDOWS\Internet Logs\xDB35.tmp 2008-05-17 15:23 --------- d-----w C:\Program Files\Real 2008-05-17 15:23 --------- d-----w C:\Program Files\Common Files\xing shared 2008-05-17 15:23 --------- d-----w C:\Program Files\Common Files\Real 2008-05-15 14:30 2,947,072 ----a-w C:\WINDOWS\Internet Logs\xDB32.tmp 2008-05-15 14:30 1,208,320 ----a-w C:\WINDOWS\Internet Logs\xDB33.tmp 2008-05-14 20:00 3,068,928 ----a-w C:\WINDOWS\Internet Logs\xDB31.tmp 2008-05-12 19:20 195,584 ----a-w C:\WINDOWS\Internet Logs\xDB30.tmp 2008-05-12 18:59 5,340,160 ----a-w C:\WINDOWS\Internet Logs\xDB2D.tmp 2008-05-12 18:59 1,686,528 ----a-w C:\WINDOWS\Internet Logs\xDB2E.tmp 2008-05-12 18:58 1,686,528 ----a-w C:\WINDOWS\Internet Logs\xDB2F.tmp 2008-05-03 11:47 --------- d-----w C:\Program Files\Common Files\Adobe 2008-04-30 16:16 --------- d-----w C:\Program Files\directx 2008-04-16 12:38 6,303,169 ----a-w C:\WINDOWS\Internet Logs\tvDebug.zip 2007-10-31 14:17 24,192 ----a-w C:\Documents and Settings\Kamyk.AL-9432B1D00A34\usbsermptxp.sys 2007-10-31 14:17 22,768 ----a-w C:\Documents and Settings\Kamyk.AL-9432B1D00A34\usbsermpt.sys 2007-06-26 15:30 92,064 ----a-w C:\Documents and Settings\Kamyk.AL-9432B1D00A34\mqdmmdm.sys 2007-06-26 15:30 9,232 ----a-w C:\Documents and Settings\Kamyk.AL-9432B1D00A34\mqdmmdfl.sys 2007-06-26 15:30 79,328 ----a-w C:\Documents and Settings\Kamyk.AL-9432B1D00A34\mqdmserd.sys 2007-06-26 15:30 66,656 ----a-w C:\Documents and Settings\Kamyk.AL-9432B1D00A34\mqdmbus.sys 2007-06-26 15:30 6,208 ----a-w C:\Documents and Settings\Kamyk.AL-9432B1D00A34\mqdmcmnt.sys 2007-06-26 15:30 5,936 ----a-w C:\Documents and Settings\Kamyk.AL-9432B1D00A34\mqdmwhnt.sys 2007-06-26 15:30 4,048 ----a-w C:\Documents and Settings\Kamyk.AL-9432B1D00A34\mqdmcr.sys . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "AutoConnect"="C:\Program Files\AutoConnect\AutoConnect.exe" [2004-08-28 20:27 295424] "Gadu-Gadu"="C:\Program Files\Gadu-Gadu\gg.exe" [2007-05-10 16:36 2111176] "BitComet"="C:\Program Files\BitComet\BitComet.exe" [2007-02-08 10:49 4526144] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 01:44 15360] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Zone Labs Client"="C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [2006-07-09 13:42 968696] "nwiz"="nwiz.exe" [2006-10-22 13:22 1622016 C:\WINDOWS\system32\nwiz.exe] "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-10-22 13:22 7700480] "Tweak UI"="TWEAKUI.CPL,TweakMeUp" [] "nod32kui"="C:\Program Files\Eset\nod32kui.exe" [2008-06-23 16:35 917504] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 01:44 15360] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] "ForceClassicControlPanel"= 1 (0x1) "NoChangeKeyboardNavigationIndicators"= 0 (0x0) "NoSMConfigurePrograms"= 1 (0x1) [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\Antiwpa] antiwpa.dll 2006-10-11 16:08 5376 C:\WINDOWS\system32\antiwpa.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "vidc.yv12"= C:\PROGRA~1\ACEMEG~1\SystemS\ATI\atiyuv12.DLL "vidc.divx"= C:\PROGRA~1\ACEMEG~1\SystemS\DivX\DivX520.dll "vidc.iyuv"= C:\PROGRA~1\ACEMEG~1\SystemS\Intel\iyuv_32.dll "vidc.yvu9"= C:\PROGRA~1\ACEMEG~1\SystemS\Intel\Iyvu9_32.dll "vidc.uyvy"= C:\PROGRA~1\ACEMEG~1\SystemS\MICROS~1\msyuv.dll "vidc.yuy2"= C:\PROGRA~1\ACEMEG~1\SystemS\MICROS~1\msyuv.dll "vidc.yvyu"= C:\PROGRA~1\ACEMEG~1\SystemS\MICROS~1\msyuv.dll [HKLM\~\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Menu Start^Programy^Autostart^Adobe Gamma Loader.lnk] path=C:\Documents and Settings\All Users.WINDOWS\Menu Start\Programy\Autostart\Adobe Gamma Loader.lnk backup=C:\WINDOWS\pss\Adobe Gamma Loader.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BDAgent] C:\Program Files\Softwin\BitDefender10\bdagent.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BDMCon] C:\Program Files\Softwin\BitDefender10\bdmcon.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BitComet] --a------ 2007-02-08 10:49 4526144 C:\Program Files\BitComet\BitComet.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\C:] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\C:\Program Files] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\C:\Program Files\NetMeter] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\C:\Program Files\NetMeter\NetMeter.exe] C:\Program Files\NetMeter\NetMeter.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CloneCDElbyCDFL] C:\Program Files\Elaborate Bytes\CloneCD\ElbyCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CloneCDTray] C:\Program Files\Elaborate Bytes\CloneCD\CloneCDTray.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CoolSwitch] --a------ 2002-03-19 17:30 45632 C:\WINDOWS\system32\taskswitch.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools-1033] --a------ 2004-08-22 18:05 81920 C:\Program Files\D-Tools\daemon.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EdHTML] --a------ 2003-03-24 17:38 1443328 C:\Program Files\Binboy\EdHTMLv5.0\EdHTML.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IMJPMIG8.2] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\InCD] C:\Program Files\Ahead\InCD\InCD.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsServer] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] --a------ 2001-07-09 11:50 155648 C:\WINDOWS\system32\NeroCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] --a------ 2008-02-01 00:13 385024 C:\Program Files\QuickTime\QTTask.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl] C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMAX] --a------ 2004-08-06 08:27 860160 C:\Program Files\Analog Devices\SoundMAX\Smax4.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMAXPnP] --a------ 2004-07-27 13:48 1388544 C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpeedTouch USB Diagnostics] --a------ 2004-01-26 11:38 866816 C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpybotSD TeaTimer] -rahs---- 2008-01-28 11:43 2097488 C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched] --a------ 2007-06-14 18:32 132760 C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe] --a------ 2008-05-17 17:23 151597 C:\Program Files\Real Alternative\Update_OB\realsched.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UnlockerAssistant] C:\Program Files\Unlocker\UnlockerAssistant.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\wsctf.exe] [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "C:\\Program Files\\KONAMI\\Pro Evolution Soccer 2008\\PES2008.exe"= "C:\\Program Files\\Skype\\Phone\\Skype.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "13081:TCP"= 13081:TCP:BitComet 13081 TCP "13081:UDP"= 13081:UDP:BitComet 13081 UDP S0 ElbyVCD;ElbyVCD;C:\WINDOWS\system32\DRIVERS\ElbyVCD.sys [] S3 k510bus;Sony Ericsson K510 Driver driver (WDM);C:\WINDOWS\system32\DRIVERS\k510bus.sys [2006-02-17 20:34] S3 k510mdfl;Sony Ericsson K510 USB WMC Modem Filter;C:\WINDOWS\system32\DRIVERS\k510mdfl.sys [2006-02-17 20:34] S3 k510mdm;Sony Ericsson K510 USB WMC Modem Driver;C:\WINDOWS\system32\DRIVERS\k510mdm.sys [2006-02-17 20:34] S3 qcusbser;ZTE USB Device for Legacy Serial Communication;C:\WINDOWS\system32\DRIVERS\ZTEusbser.sys [2007-09-18 10:20] S3 usbscan;Sterownik skanera USB;C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-03 22:58] S3 USBSTOR;Sterownik magazynu masowego USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-03 23:08] S3 w200bus;Sony Ericsson W200 driver (WDM);C:\WINDOWS\system32\DRIVERS\w200bus.sys [2006-11-07 09:42] S3 w200mdfl;Sony Ericsson W200 USB WMC Modem Filter;C:\WINDOWS\system32\DRIVERS\w200mdfl.sys [2006-11-07 09:42] S3 w200mdm;Sony Ericsson W200 USB WMC Modem Driver;C:\WINDOWS\system32\DRIVERS\w200mdm.sys [2006-11-07 09:42] S3 w200mgmt;Sony Ericsson W200 USB WMC Device Management Drivers (WDM);C:\WINDOWS\system32\DRIVERS\w200mgmt.sys [2006-11-07 09:42] S3 w200obex;Sony Ericsson W200 USB WMC OBEX Interface;C:\WINDOWS\system32\DRIVERS\w200obex.sys [2006-11-07 09:42] S3 z520bus;Sony Ericsson 520 driver (WDM);C:\WINDOWS\system32\DRIVERS\z520bus.sys [2006-03-13 17:54] S3 z520mdfl;Sony Ericsson 520 USB WMC Modem Filter;C:\WINDOWS\system32\DRIVERS\z520mdfl.sys [2006-03-13 17:54] S3 z520mdm;Sony Ericsson 520 USB WMC Modem Drivers;C:\WINDOWS\system32\DRIVERS\z520mdm.sys [2006-03-13 17:54] S3 z520mgmt;Sony Ericsson 520 USB WMC Device Management Drivers;C:\WINDOWS\system32\DRIVERS\z520mgmt.sys [2006-03-13 17:54] S3 z520obex;Sony Ericsson 520 USB WMC OBEX Interface Drivers;C:\WINDOWS\system32\DRIVERS\z520obex.sys [2006-03-13 17:54] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{7808e90b-3d32-11dc-8665-000e50937e74}] \Shell\AutoRun\command - H:\EXPLORER.EXE \Shell\explore\Command - H:\EXPLORER.EXE \Shell\open\Command - H:\EXPLORER.EXE . Contents of the 'Scheduled Tasks' folder "2008-02-17 15:47:21 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job" - C:\Program Files\Apple Software Update\SoftwareUpdate.exe . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-06-24 19:45:22 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... ************************************************************************** . Completion time: 2008-06-24 19:48:11 ComboFix-quarantined-files.txt 2008-06-24 17:47:04 Pre-Run: 4,825,751,552 bajtów wolnych Post-Run: 4,809,052,160 bajtów wolnych 241

**Posty:** 8001 · przez **Okocza** 24 Cze 2008, 21:59

otwórz notatnik i wklej:

Kod: Zaznacz wszystko: Windows Registry Editor Version 5.00 [-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{7808e90b-3d32-11dc-8665-000e50937e74}]

zapisz jako: FIX.REG

2 razy klikasz i dodajesz do rejestru...

potem nowy log z cf

**Posty:** 120 · przez **karolkamyk** 25 Cze 2008, 00:15

Zrobione, oto log:

Kod: Zaznacz wszystko: ComboFix 08-06-20.4 - Kamyk 2008-06-24 23:24:03.5 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.885 [GMT 2:00] Running from: C:\Documents and Settings\Kamyk.AL-9432B1D00A34\Pulpit\ComboFix.exe * Resident AV is active [color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color] . ((((((((((((((((((((((((( Files Created from 2008-05-24 to 2008-06-24 ))))))))))))))))))))))))))))))) . 2008-06-24 15:37 . 2008-06-24 15:37 <DIR> d-------- C:\Program Files\Trend Micro 2008-06-24 15:36 . 2008-06-24 15:36 <DIR> d-------- C:\WINDOWS\BDOSCAN8 2008-06-23 22:34 . 2008-06-24 18:36 81,984 --a------ C:\WINDOWS\system32\bdod.bin 2008-06-23 22:28 . 2008-06-23 22:28 <DIR> d-------- C:\Program Files\Softwin 2008-06-23 22:25 . 2008-06-24 18:36 <DIR> d-------- C:\Program Files\Common Files\Softwin 2008-06-23 22:24 . 2008-06-23 22:25 <DIR> d-------- C:\Program Files\Spybot - Search & Destroy 2008-06-23 22:24 . 2008-06-23 22:24 <DIR> d-------- C:\Program Files\Alwil Software 2008-06-23 22:24 . 2008-06-23 22:31 <DIR> d-------- C:\Documents and Settings\All Users.WINDOWS\Dane aplikacji\Spybot - Search & Destroy 2008-06-23 22:15 . 2008-06-23 22:15 49,152 --a------ C:\WINDOWS\system32\msfun80.Vexe 2008-06-23 21:51 . 2004-08-04 00:44 116,736 --a--c--- C:\WINDOWS\system32\dllcache\xrxwiadr.dll 2008-06-23 21:51 . 2001-08-18 06:37 99,865 --a--c--- C:\WINDOWS\system32\dllcache\xlog.exe 2008-06-23 21:51 . 2001-10-26 17:30 27,648 --a--c--- C:\WINDOWS\system32\dllcache\xrxftplt.exe 2008-06-23 21:51 . 2001-10-26 17:29 23,040 --a--c--- C:\WINDOWS\system32\dllcache\xrxwbtmp.dll 2008-06-23 21:51 . 2004-08-03 22:29 19,455 --a--c--- C:\WINDOWS\system32\dllcache\wvchntxx.sys 2008-06-23 21:51 . 2001-10-26 17:29 17,408 --a--c--- C:\WINDOWS\system32\dllcache\xrxscnui.dll 2008-06-23 21:51 . 2001-08-17 20:11 16,970 --a--c--- C:\WINDOWS\system32\dllcache\xem336n5.sys 2008-06-23 21:51 . 2001-10-26 17:30 4,608 --a--c--- C:\WINDOWS\system32\dllcache\xrxflnch.exe 2008-06-23 21:50 . 2001-08-17 21:28 771,581 --a--c--- C:\WINDOWS\system32\dllcache\winacisa.sys 2008-06-23 21:50 . 2001-08-17 21:28 701,386 --a--c--- C:\WINDOWS\system32\dllcache\wdhaalba.sys 2008-06-23 21:50 . 2004-08-03 22:31 154,624 --a--c--- C:\WINDOWS\system32\dllcache\wlluc48.sys 2008-06-23 21:50 . 2001-10-26 17:29 87,040 --a--c--- C:\WINDOWS\system32\dllcache\wiafbdrv.dll 2008-06-23 21:50 . 2001-10-26 17:29 54,272 --a--c--- C:\WINDOWS\system32\dllcache\wiamsmud.dll 2008-06-23 21:50 . 2001-10-26 17:00 34,890 --a--c--- C:\WINDOWS\system32\dllcache\wlandrv2.sys 2008-06-23 21:50 . 2004-08-03 23:10 19,328 --a--c--- C:\WINDOWS\system32\dllcache\wstcodec.sys 2008-06-23 21:50 . 2004-08-03 22:29 12,063 --a--c--- C:\WINDOWS\system32\dllcache\wsiintxx.sys 2008-06-23 21:50 . 2004-08-03 23:07 8,832 --a--c--- C:\WINDOWS\system32\dllcache\wmiacpi.sys 2008-06-23 21:50 . 2004-08-04 00:44 8,192 --a--c--- C:\WINDOWS\system32\dllcache\wshirda.dll 2008-06-23 21:48 . 2001-08-17 21:28 794,654 --a--c--- C:\WINDOWS\system32\dllcache\usr1801.sys 2008-06-23 21:47 . 2001-10-26 16:47 286,272 --a--c--- C:\WINDOWS\system32\dllcache\stlnata.sys 2008-06-23 21:46 . 2001-10-26 17:29 147,200 --a--c--- C:\WINDOWS\system32\dllcache\smidispb.dll 2008-06-23 21:45 . 2004-08-03 22:41 404,990 --a--c--- C:\WINDOWS\system32\dllcache\slntamr.sys 2008-06-23 21:44 . 2001-10-26 17:01 899,530 --a--c--- C:\WINDOWS\system32\dllcache\r2mdkxga.sys 2008-06-23 21:43 . 2004-08-04 00:43 259,328 --a--c--- C:\WINDOWS\system32\dllcache\perm3dd.dll 2008-06-23 21:42 . 2001-08-17 22:05 351,616 --a--c--- C:\WINDOWS\system32\dllcache\ovcodek2.sys 2008-06-23 21:41 . 2004-08-04 00:44 1,737,856 --a--c--- C:\WINDOWS\system32\dllcache\mtxparhd.dll 2008-06-23 21:40 . 2001-08-17 21:28 802,683 --a--c--- C:\WINDOWS\system32\dllcache\ltsm.sys 2008-06-23 21:39 . 2001-10-26 16:51 728,170 --a--c--- C:\WINDOWS\system32\dllcache\ltck000c.sys 2008-06-23 21:38 . 2004-08-04 00:44 153,088 --a--c--- C:\WINDOWS\system32\dllcache\irftp.exe 2008-06-23 21:37 . 2004-08-04 00:44 702,845 --a--c--- C:\WINDOWS\system32\dllcache\i81xdnt5.dll 2008-06-23 21:36 . 2004-08-03 22:41 1,041,536 --a--c--- C:\WINDOWS\system32\dllcache\hsfdpsp2.sys 2008-06-23 21:35 . 2001-10-26 17:29 1,733,120 --a--c--- C:\WINDOWS\system32\dllcache\g400d.dll 2008-06-23 21:34 . 2001-10-26 16:57 630,016 --a--c--- C:\WINDOWS\system32\dllcache\eqn.sys 2008-06-23 21:33 . 2001-08-17 20:14 952,007 --a--c--- C:\WINDOWS\system32\dllcache\diwan.sys 2008-06-23 21:32 . 2001-10-26 17:29 421,917 --a--c--- C:\WINDOWS\system32\dllcache\dgconfig.dll 2008-06-23 21:31 . 2001-10-26 16:57 980,034 --a--c--- C:\WINDOWS\system32\dllcache\cicap.sys 2008-06-23 21:30 . 2001-08-17 21:28 871,388 --a--c--- C:\WINDOWS\system32\dllcache\bcmdm.sys 2008-06-23 21:29 . 2004-08-04 00:43 1,888,992 --a--c--- C:\WINDOWS\system32\dllcache\ati3duag.dll 2008-06-23 21:28 . 2001-08-17 20:19 747,392 --a--c--- C:\WINDOWS\system32\dllcache\adm8830.sys 2008-06-23 21:27 . 2001-08-17 21:28 762,780 --a--c--- C:\WINDOWS\system32\dllcache\3cwmcru.sys 2008-06-23 16:35 . 2008-06-23 16:35 502,208 --a------ C:\WINDOWS\system32\drivers\amon.sys 2008-06-23 16:35 . 2008-06-23 16:35 270,336 --a------ C:\WINDOWS\system32\imon.dll 2008-06-21 00:09 . 2008-06-21 00:14 <DIR> d-------- C:\WINDOWS\system32\embedded 2008-06-21 00:09 . 2008-06-21 13:49 <DIR> d-------- C:\Program Files\Kolekcja Klasyki 2008-06-19 10:49 . 2008-06-23 20:40 0 ---hs---- C:\fun.xls.exe 2008-05-25 23:14 . 2008-05-25 23:17 <DIR> d-------- C:\Program Files\Aspell . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-06-24 16:39 --------- d-----w C:\Program Files\AutoConnect 2008-06-24 16:38 3,008,512 ----a-w C:\WINDOWS\Internet Logs\xDB3D.tmp 2008-06-24 16:37 --------- d-----w C:\Documents and Settings\Kamyk.AL-9432B1D00A34\Dane aplikacji\foobar2000 2008-06-23 19:34 --------- d-----w C:\Documents and Settings\Kamyk.AL-9432B1D00A34\Dane aplikacji\Skype 2008-06-23 17:03 --------- d-----w C:\Program Files\ESET 2008-06-23 14:48 --------- d-----w C:\Program Files\Common Files\Macromedia 2008-06-23 11:15 3,049,472 ----a-w C:\WINDOWS\Internet Logs\xDB3C.tmp 2008-06-22 08:57 --------- d-----w C:\Program Files\Asystent Plusfon 601i 2008-06-21 13:55 1,321,472 ----a-w C:\WINDOWS\Internet Logs\xDB3A.tmp 2008-06-21 13:55 1,264,128 ----a-w C:\WINDOWS\Internet Logs\xDB3B.tmp 2008-06-20 22:17 3,059,200 ----a-w C:\WINDOWS\Internet Logs\xDB39.tmp 2008-06-20 10:14 2,696,704 ----a-w C:\WINDOWS\Internet Logs\xDB38.tmp 2008-06-19 17:18 3,421,184 ----a-w C:\WINDOWS\Internet Logs\xDB36.tmp 2008-06-19 17:18 1,260,544 ----a-w C:\WINDOWS\Internet Logs\xDB37.tmp 2008-06-18 11:42 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-06-18 11:36 --------- d-----w C:\Program Files\KONAMI 2008-06-12 14:57 --------- d-----w C:\Program Files\Opera 2008-05-24 11:12 3,173,376 ----a-w C:\WINDOWS\Internet Logs\xDB34.tmp 2008-05-24 11:12 1,227,776 ----a-w C:\WINDOWS\Internet Logs\xDB35.tmp 2008-05-17 15:23 --------- d-----w C:\Program Files\Real 2008-05-17 15:23 --------- d-----w C:\Program Files\Common Files\xing shared 2008-05-17 15:23 --------- d-----w C:\Program Files\Common Files\Real 2008-05-15 14:30 2,947,072 ----a-w C:\WINDOWS\Internet Logs\xDB32.tmp 2008-05-15 14:30 1,208,320 ----a-w C:\WINDOWS\Internet Logs\xDB33.tmp 2008-05-14 20:00 3,068,928 ----a-w C:\WINDOWS\Internet Logs\xDB31.tmp 2008-05-12 19:20 195,584 ----a-w C:\WINDOWS\Internet Logs\xDB30.tmp 2008-05-12 18:59 5,340,160 ----a-w C:\WINDOWS\Internet Logs\xDB2D.tmp 2008-05-12 18:59 1,686,528 ----a-w C:\WINDOWS\Internet Logs\xDB2E.tmp 2008-05-12 18:58 1,686,528 ----a-w C:\WINDOWS\Internet Logs\xDB2F.tmp 2008-05-03 11:47 --------- d-----w C:\Program Files\Common Files\Adobe 2008-04-30 16:16 --------- d-----w C:\Program Files\directx 2008-04-16 12:38 6,303,169 ----a-w C:\WINDOWS\Internet Logs\tvDebug.zip 2007-10-31 14:17 24,192 ----a-w C:\Documents and Settings\Kamyk.AL-9432B1D00A34\usbsermptxp.sys 2007-10-31 14:17 22,768 ----a-w C:\Documents and Settings\Kamyk.AL-9432B1D00A34\usbsermpt.sys 2007-06-26 15:30 92,064 ----a-w C:\Documents and Settings\Kamyk.AL-9432B1D00A34\mqdmmdm.sys 2007-06-26 15:30 9,232 ----a-w C:\Documents and Settings\Kamyk.AL-9432B1D00A34\mqdmmdfl.sys 2007-06-26 15:30 79,328 ----a-w C:\Documents and Settings\Kamyk.AL-9432B1D00A34\mqdmserd.sys 2007-06-26 15:30 66,656 ----a-w C:\Documents and Settings\Kamyk.AL-9432B1D00A34\mqdmbus.sys 2007-06-26 15:30 6,208 ----a-w C:\Documents and Settings\Kamyk.AL-9432B1D00A34\mqdmcmnt.sys 2007-06-26 15:30 5,936 ----a-w C:\Documents and Settings\Kamyk.AL-9432B1D00A34\mqdmwhnt.sys 2007-06-26 15:30 4,048 ----a-w C:\Documents and Settings\Kamyk.AL-9432B1D00A34\mqdmcr.sys . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "AutoConnect"="C:\Program Files\AutoConnect\AutoConnect.exe" [2004-08-28 20:27 295424] "Gadu-Gadu"="C:\Program Files\Gadu-Gadu\gg.exe" [2007-05-10 16:36 2111176] "BitComet"="C:\Program Files\BitComet\BitComet.exe" [2007-02-08 10:49 4526144] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 01:44 15360] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Zone Labs Client"="C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [2006-07-09 13:42 968696] "nwiz"="nwiz.exe" [2006-10-22 13:22 1622016 C:\WINDOWS\system32\nwiz.exe] "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-10-22 13:22 7700480] "Tweak UI"="TWEAKUI.CPL,TweakMeUp" [] "nod32kui"="C:\Program Files\Eset\nod32kui.exe" [2008-06-23 16:35 917504] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 01:44 15360] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] "ForceClassicControlPanel"= 1 (0x1) "NoChangeKeyboardNavigationIndicators"= 0 (0x0) "NoSMConfigurePrograms"= 1 (0x1) [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\Antiwpa] antiwpa.dll 2006-10-11 16:08 5376 C:\WINDOWS\system32\antiwpa.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "vidc.yv12"= C:\PROGRA~1\ACEMEG~1\SystemS\ATI\atiyuv12.DLL "vidc.divx"= C:\PROGRA~1\ACEMEG~1\SystemS\DivX\DivX520.dll "vidc.iyuv"= C:\PROGRA~1\ACEMEG~1\SystemS\Intel\iyuv_32.dll "vidc.yvu9"= C:\PROGRA~1\ACEMEG~1\SystemS\Intel\Iyvu9_32.dll "vidc.uyvy"= C:\PROGRA~1\ACEMEG~1\SystemS\MICROS~1\msyuv.dll "vidc.yuy2"= C:\PROGRA~1\ACEMEG~1\SystemS\MICROS~1\msyuv.dll "vidc.yvyu"= C:\PROGRA~1\ACEMEG~1\SystemS\MICROS~1\msyuv.dll [HKLM\~\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Menu Start^Programy^Autostart^Adobe Gamma Loader.lnk] path=C:\Documents and Settings\All Users.WINDOWS\Menu Start\Programy\Autostart\Adobe Gamma Loader.lnk backup=C:\WINDOWS\pss\Adobe Gamma Loader.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BDAgent] C:\Program Files\Softwin\BitDefender10\bdagent.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BDMCon] C:\Program Files\Softwin\BitDefender10\bdmcon.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BitComet] --a------ 2007-02-08 10:49 4526144 C:\Program Files\BitComet\BitComet.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\C:] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\C:\Program Files] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\C:\Program Files\NetMeter] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\C:\Program Files\NetMeter\NetMeter.exe] C:\Program Files\NetMeter\NetMeter.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CloneCDElbyCDFL] C:\Program Files\Elaborate Bytes\CloneCD\ElbyCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CloneCDTray] C:\Program Files\Elaborate Bytes\CloneCD\CloneCDTray.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CoolSwitch] --a------ 2002-03-19 17:30 45632 C:\WINDOWS\system32\taskswitch.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools-1033] --a------ 2004-08-22 18:05 81920 C:\Program Files\D-Tools\daemon.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EdHTML] --a------ 2003-03-24 17:38 1443328 C:\Program Files\Binboy\EdHTMLv5.0\EdHTML.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IMJPMIG8.2] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\InCD] C:\Program Files\Ahead\InCD\InCD.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsServer] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] --a------ 2001-07-09 11:50 155648 C:\WINDOWS\system32\NeroCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] --a------ 2008-02-01 00:13 385024 C:\Program Files\QuickTime\QTTask.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl] C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMAX] --a------ 2004-08-06 08:27 860160 C:\Program Files\Analog Devices\SoundMAX\Smax4.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMAXPnP] --a------ 2004-07-27 13:48 1388544 C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpeedTouch USB Diagnostics] --a------ 2004-01-26 11:38 866816 C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpybotSD TeaTimer] -rahs---- 2008-01-28 11:43 2097488 C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched] --a------ 2007-06-14 18:32 132760 C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe] --a------ 2008-05-17 17:23 151597 C:\Program Files\Real Alternative\Update_OB\realsched.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UnlockerAssistant] C:\Program Files\Unlocker\UnlockerAssistant.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\wsctf.exe] [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "C:\\Program Files\\KONAMI\\Pro Evolution Soccer 2008\\PES2008.exe"= "C:\\Program Files\\Skype\\Phone\\Skype.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "13081:TCP"= 13081:TCP:BitComet 13081 TCP "13081:UDP"= 13081:UDP:BitComet 13081 UDP S0 ElbyVCD;ElbyVCD;C:\WINDOWS\system32\DRIVERS\ElbyVCD.sys [] S3 k510bus;Sony Ericsson K510 Driver driver (WDM);C:\WINDOWS\system32\DRIVERS\k510bus.sys [2006-02-17 20:34] S3 k510mdfl;Sony Ericsson K510 USB WMC Modem Filter;C:\WINDOWS\system32\DRIVERS\k510mdfl.sys [2006-02-17 20:34] S3 k510mdm;Sony Ericsson K510 USB WMC Modem Driver;C:\WINDOWS\system32\DRIVERS\k510mdm.sys [2006-02-17 20:34] S3 qcusbser;ZTE USB Device for Legacy Serial Communication;C:\WINDOWS\system32\DRIVERS\ZTEusbser.sys [2007-09-18 10:20] S3 usbscan;Sterownik skanera USB;C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-03 22:58] S3 USBSTOR;Sterownik magazynu masowego USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-03 23:08] S3 w200bus;Sony Ericsson W200 driver (WDM);C:\WINDOWS\system32\DRIVERS\w200bus.sys [2006-11-07 09:42] S3 w200mdfl;Sony Ericsson W200 USB WMC Modem Filter;C:\WINDOWS\system32\DRIVERS\w200mdfl.sys [2006-11-07 09:42] S3 w200mdm;Sony Ericsson W200 USB WMC Modem Driver;C:\WINDOWS\system32\DRIVERS\w200mdm.sys [2006-11-07 09:42] S3 w200mgmt;Sony Ericsson W200 USB WMC Device Management Drivers (WDM);C:\WINDOWS\system32\DRIVERS\w200mgmt.sys [2006-11-07 09:42] S3 w200obex;Sony Ericsson W200 USB WMC OBEX Interface;C:\WINDOWS\system32\DRIVERS\w200obex.sys [2006-11-07 09:42] S3 z520bus;Sony Ericsson 520 driver (WDM);C:\WINDOWS\system32\DRIVERS\z520bus.sys [2006-03-13 17:54] S3 z520mdfl;Sony Ericsson 520 USB WMC Modem Filter;C:\WINDOWS\system32\DRIVERS\z520mdfl.sys [2006-03-13 17:54] S3 z520mdm;Sony Ericsson 520 USB WMC Modem Drivers;C:\WINDOWS\system32\DRIVERS\z520mdm.sys [2006-03-13 17:54] S3 z520mgmt;Sony Ericsson 520 USB WMC Device Management Drivers;C:\WINDOWS\system32\DRIVERS\z520mgmt.sys [2006-03-13 17:54] S3 z520obex;Sony Ericsson 520 USB WMC OBEX Interface Drivers;C:\WINDOWS\system32\DRIVERS\z520obex.sys [2006-03-13 17:54] *Newly Created Service* - CATCHME . Contents of the 'Scheduled Tasks' folder "2008-02-17 15:47:21 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job" - C:\Program Files\Apple Software Update\SoftwareUpdate.exe . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-06-24 23:28:07 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... ************************************************************************** . Completion time: 2008-06-24 23:30:57 ComboFix-quarantined-files.txt 2008-06-24 21:29:50 ComboFix2.txt 2008-06-24 17:48:17 Pre-Run: 4,854,153,216 bajtów wolnych Post-Run: 4,842,033,152 bajtów wolnych 239

**Posty:** 7956 · przez **Magik** 25 Cze 2008, 01:11

Mozesz zrobic jeszcze to i ejst zcysto

1. Ściągnij OTMoveIt i go włacz i odpal go z opcji CleanUp

2. wykonaj optymalizację windowsa
3.sciagnij ATF_Cleaner
zaznacz
Windows Temp
All users Temp
Temporary internet files
Recycle Bin
i wcisnij EMPTY SELECTED
4.Wyłącz przywracanie systemu ( właściwości mój komputer-zakładka przywracanie - wyłącz przywracanie na wszystkich dyskach). Po chwili włącz je powrotem

**Posty:** 5637 · przez **kahoona** 25 Cze 2008, 01:21

Ja bym raczej zaczął od wyboru jednego antywirusa, jednego firewalla i jednego antyspyware - a resztę odinstalował.

To tak a propos.

**Posty:** 120 · przez **karolkamyk** 25 Cze 2008, 13:54

Właśnie defragmentuje dyski, mysle ze juz wszystko w porządku.

kahoona, juz wczoraj pousówałem, zainstalowalem to żeby sprawdzic wszystkim czym miałem pod ręką

. Zostawiłem Nod 32, Zone Alarm, no i Ad-Aware. Dzięki wszystkim bardzo za pomoc

atak jakiegoś wirusa

Atak jakiegoś wirusa

Kto jest na forum