nieznośny trojan, albo się mylę?

**Posty:** 34 · przez **sumo22** 04 Lip 2008, 20:33

Złapałem trojana Trojan.Win32.Monderc.gen i walczyłem z nim na różne sposoby, a on ciągle powraca. Co gorsza on powoduje to że nie mam połączenia z internetem (mam ale tylko w trybie awaryjnym). Skanowałem anty-trojanem i wskazał na port 1033 - port zamknąłem. Problem dalej występuje. Nie wiem co robić. Zamieszczam loga:

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 20:31:52, on 2008-07-04 Platform: Windows XP Dodatek SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16674) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\csrss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\PC Tools Firewall Plus\FWService.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\Program Files\PC Tools Firewall Plus\FirewallGUI.exe C:\Program Files\DAEMON Tools\daemon.exe C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\ATI Technologies\ATI.ACE\CLI.EXE C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\alg.exe D:\Instalki\multimedialne\grafika\Rainlendar\Rainlendar.exe C:\Program Files\ATI Technologies\ATI.ACE\cli.exe C:\Program Files\ATI Technologies\ATI.ACE\cli.exe C:\PROGRA~1\Mozilla Firefox\firefox.exe C:\WINDOWS\system32\wbem\wmiprvse.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe" O4 - HKLM\..\Run: [00PCTFW] "C:\Program Files\PC Tools Firewall Plus\FirewallGUI.exe" -s O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033 O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe" O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Startup: Połączenie z internetem.lnk = ? O4 - Startup: Skrót do Rainlendar.lnk = D:\Instalki\multimedialne\grafika\Rainlendar\Rainlendar.exe O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll O9 - Extra button: Statystyki dla ochrony WWW - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\SCIEPlgn.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1214695443375 O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: Kaspersky Anti-Virus 7.0 (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe O23 - Service: PC Tools Firewall Plus (PCToolsFirewallPlus) - PC Tools - C:\Program Files\PC Tools Firewall Plus\FWService.exe -- End of file - 5280 bytes

Za wszelką pomoc z góry dziękuję.

**Posty:** 84 · przez **gloni** 04 Lip 2008, 21:00

Zastosuj http://downloads.andymanchesta.com/RemovalTools/SDFix.exe . Po pobraniu uruchom go a rozpakuje się do C:\SDFix. Uruchom komputer w trybie awaryjnym (F8 przy stracie systemu).W awaryjnym uruchom plik RunThis.bat z folderu SDFixa. Zatwierdź czyszczenie przez Y. Poczekaj aż ukończy i komputer zresetuje

Potem wejdz do folderu C:\SDFix wrzuc zawartość pliku Report.txt + log z combofixa (http://forum.programosy.pl/jak-generujemy-logi-z-combofixa-oraz-dssa-vt95026.html)

**Posty:** 34 · przez **sumo22** 04 Lip 2008, 21:54

SDFix:

Kod: Zaznacz wszystko: [b]SDFix: Version 1.201 [/b] Run by ťukasz on 2008-07-04 at 21:21 Microsoft Windows XP [Wersja 5.1.2600] Running From: C:\SDFix [b]Checking Services [/b]: Restoring Default Security Values Restoring Default Hosts File Rebooting [b]Checking Files [/b]: Trojan Files Found: C:\WINDOWS\Bifrost\klog.dat - Deleted C:\Documents and Settings\ťukasz.SPELUNA-4F40F48\Dane aplikacji\addon.dat - Deleted Folder C:\Documents and Settings\All Users.WINDOWS\Application Data\SalesMon - Removed Folder C:\WINDOWS\Bifrost - Removed Removing Temp Files [b]ADS Check [/b]: C:\WINDOWS\system32 :{DA6227CB-326B-4B4D-9A81-04B61F1538DD} 12 Total size: 12 bytes. system32: deleted 12 bytes in 1 streams. Checking for remaining Streams C:\WINDOWS\system32 No streams found. [b]Final Check [/b]: catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-07-04 21:26:45 Windows 5.1.2600 Dodatek Service Pack 3 NTFS scanning hidden processes ... scanning hidden services & system hive ... [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg] "s1"=dword:d666e0e4 "s2"=dword:00133f53 "h0"=dword:00000001 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4] "p0"="C:\Program Files\DAEMON Tools\" "h0"=dword:00000000 "khjeh"=hex:0d,f9,df,ae,a0,75,51,2b,34,3c,7f,9f,81,06,80,a3,a6,29,87,21,3b,.. [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001] "a0"=hex:20,01,00,00,54,f0,6f,b0,15,f7,7f,58,b4,fd,51,22,28,d3,6e,24,3a,.. "khjeh"=hex:d1,d4,9f,0e,dc,7f,eb,04,fb,05,d4,4f,e2,eb,8b,94,ad,ab,b4,cc,54,.. [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40] "khjeh"=hex:60,cc,7d,62,09,28,dd,74,50,e1,36,32,83,53,2f,c7,73,b0,09,17,3d,.. [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41] "khjeh"=hex:4a,82,73,f2,ef,1e,de,f0,82,7a,b3,86,42,04,dc,c8,12,1e,09,af,69,.. [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf42] "khjeh"=hex:9e,a0,60,3d,08,5b,b2,a3,b1,da,68,8b,05,05,6b,b2,0d,88,68,f5,ac,.. [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf43] "khjeh"=hex:40,ed,c1,13,0f,5f,2f,4d,b5,db,4b,74,0f,99,07,4d,8d,f0,02,54,ae,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4] "p0"="C:\Program Files\DAEMON Tools\" "h0"=dword:00000000 "khjeh"=hex:0d,f9,df,ae,a0,75,51,2b,34,3c,7f,9f,81,06,80,a3,a6,29,87,21,3b,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001] "a0"=hex:20,01,00,00,54,f0,6f,b0,15,f7,7f,58,b4,fd,51,22,28,d3,6e,24,3a,.. "khjeh"=hex:d1,d4,9f,0e,dc,7f,eb,04,fb,05,d4,4f,e2,eb,8b,94,ad,ab,b4,cc,54,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40] "khjeh"=hex:6e,3c,a9,47,b0,5d,65,19,2d,59,83,b6,7a,ca,37,ab,88,4d,03,36,95,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4] "p0"="C:\Program Files\DAEMON Tools\" "h0"=dword:00000000 "khjeh"=hex:0d,f9,df,ae,a0,75,51,2b,34,3c,7f,9f,81,06,80,a3,a6,29,87,21,3b,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001] "a0"=hex:20,01,00,00,54,f0,6f,b0,15,f7,7f,58,b4,fd,51,22,28,d3,6e,24,3a,.. "khjeh"=hex:d1,d4,9f,0e,dc,7f,eb,04,fb,05,d4,4f,e2,eb,8b,94,ad,ab,b4,cc,54,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40] "khjeh"=hex:6e,3c,a9,47,b0,5d,65,19,2d,59,83,b6,7a,ca,37,ab,88,4d,03,36,95,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4] "p0"="C:\Program Files\DAEMON Tools\" "h0"=dword:00000000 "khjeh"=hex:0d,f9,df,ae,a0,75,51,2b,34,3c,7f,9f,81,06,80,a3,a6,29,87,21,3b,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001] "a0"=hex:20,01,00,00,54,f0,6f,b0,15,f7,7f,58,b4,fd,51,22,28,d3,6e,24,3a,.. "khjeh"=hex:d1,d4,9f,0e,dc,7f,eb,04,fb,05,d4,4f,e2,eb,8b,94,ad,ab,b4,cc,54,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40] "khjeh"=hex:86,2b,4b,af,e1,12,04,f5,4a,0d,2c,7d,a7,31,9b,4e,a3,19,ba,d0,3b,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41] "khjeh"=hex:4a,82,73,f2,ef,1e,de,f0,82,7a,b3,86,42,04,dc,c8,12,1e,09,af,69,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf42] "khjeh"=hex:9e,a0,60,3d,08,5b,b2,a3,b1,da,68,8b,05,05,6b,b2,0d,88,68,f5,ac,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf43] "khjeh"=hex:40,ed,c1,13,0f,5f,2f,4d,b5,db,4b,74,0f,99,07,4d,8d,f0,02,54,ae,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet005\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4] "p0"="C:\Program Files\DAEMON Tools\" "h0"=dword:00000000 "khjeh"=hex:0d,f9,df,ae,a0,75,51,2b,34,3c,7f,9f,81,06,80,a3,a6,29,87,21,3b,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet005\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001] "a0"=hex:20,01,00,00,54,f0,6f,b0,15,f7,7f,58,b4,fd,51,22,28,d3,6e,24,3a,.. "khjeh"=hex:d1,d4,9f,0e,dc,7f,eb,04,fb,05,d4,4f,e2,eb,8b,94,ad,ab,b4,cc,54,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet005\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40] "khjeh"=hex:60,cc,7d,62,09,28,dd,74,50,e1,36,32,83,53,2f,c7,73,b0,09,17,3d,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet005\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41] "khjeh"=hex:4a,82,73,f2,ef,1e,de,f0,82,7a,b3,86,42,04,dc,c8,12,1e,09,af,69,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet005\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf42] "khjeh"=hex:9e,a0,60,3d,08,5b,b2,a3,b1,da,68,8b,05,05,6b,b2,0d,88,68,f5,ac,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet005\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf43] "khjeh"=hex:40,ed,c1,13,0f,5f,2f,4d,b5,db,4b,74,0f,99,07,4d,8d,f0,02,54,ae,.. scanning hidden registry entries ... [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\DocFolderPaths] "A\1u?k?a?s?z?"="C:\Documents and Settings\Aukasz.SPELUNA-4F40F48\Moje dokumenty" scanning hidden files ... scan completed successfully hidden processes: 0 hidden services: 0 hidden files: 0 [b]Remaining Services [/b]: Authorized Application Key Export: [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "C:\\Program Files\\Gadu-Gadu\\gg.exe"="C:\\Program Files\\Gadu-Gadu\\gg.exe:*:Enabled:Gadu-Gadu - program gˆ˘wny" "%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000" "C:\\Documents and Settings\\All Users.WINDOWS\\Dane aplikacji\\Kaspersky Lab Setup Files\\Kaspersky Anti-Virus 2009\\Polish\\setup.exe"="C:\\Documents and Settings\\All Users.WINDOWS\\Dane aplikacji\\Kaspersky Lab Setup Files\\Kaspersky Anti-Virus 2009\\Polish\\setup.exe:*:Enabled:Kaspersky Anti-Virus 2009 Setup" "C:\\Documents and Settings\\All Users.WINDOWS\\Dane aplikacji\\Kaspersky Lab Setup Files\\Kaspersky Anti-Virus 7.0.1.325\\Polish\\setup.exe"="C:\\Documents and Settings\\All Users.WINDOWS\\Dane aplikacji\\Kaspersky Lab Setup Files\\Kaspersky Anti-Virus 7.0.1.325\\Polish\\setup.exe:*:Enabled:Kaspersky Anti-Virus 7.0 Setup" "C:\\Program Files\\Kaspersky Lab\\Kaspersky Anti-Virus 7.0\\avp.exe"="C:\\Program Files\\Kaspersky Lab\\Kaspersky Anti-Virus 7.0\\avp.exe:*:Enabled:Kaspersky Anti-Virus" "D:\\Gry\\Worms 4 Mayhem\\WORMS 4 MAYHEM.EXE"="D:\\Gry\\Worms 4 Mayhem\\WORMS 4 MAYHEM.EXE:*:Enabled:Worms 4 Mayhem" "C:\\Program Files\\Skype\\Phone\\Skype.exe"="C:\\Program Files\\Skype\\Phone\\Skype.exe:*:Enabled:Skype" [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list] "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000" [b]Remaining Files [/b]: File Backups: - C:\SDFix\backups\backups.zip [b]Files with Hidden Attributes [/b]: Tue 1 Apr 2008 1,727,287 ..SH. --- "C:\WINDOWS\system32\swjqdtil.tmp" Wed 2 May 2001 53,248 A.SH. --- "C:\Program Files\Anti-Trojan-55\DLL\ATPS.dll" Thu 6 Sep 2001 40,960 A..H. --- "C:\Program Files\Anti-Trojan-55\DLL\ATRep.dll" Wed 16 Jan 2002 134,144 A.SH. --- "C:\Program Files\Anti-Trojan-55\DLL\ATT.dll" Wed 16 Jan 2002 113,152 A.SH. --- "C:\Program Files\Anti-Trojan-55\DLL\ATTexte.dll" Wed 16 Jan 2002 23,040 A.SH. --- "C:\Program Files\Anti-Trojan-55\DLL\BetriebsSys.dll" Wed 2 May 2001 23,552 A.SH. --- "C:\Program Files\Anti-Trojan-55\DLL\FileOp.dll" Wed 16 Jan 2002 40,960 A.SH. --- "C:\Program Files\Anti-Trojan-55\DLL\FileSys.dll" Wed 2 May 2001 28,672 A.SH. --- "C:\Program Files\Anti-Trojan-55\DLL\ListBox.dll" Wed 2 May 2001 24,064 A.SH. --- "C:\Program Files\Anti-Trojan-55\DLL\Registry.dll" Wed 2 May 2001 32,256 A.SH. --- "C:\Program Files\Anti-Trojan-55\DLL\RegValues.dll" Wed 16 Jan 2002 27,648 A.SH. --- "C:\Program Files\Anti-Trojan-55\DLL\SysIni.dll" Thu 12 Sep 2002 28,672 A.SH. --- "C:\Program Files\Anti-Trojan-55\DLL\WinExit.dll" Tue 8 May 2001 88,576 A.SHR --- "C:\Program Files\Anti-Trojan-55\PlugIns\ATPClose.dll" Wed 2 May 2001 36,352 A.SHR --- "C:\Program Files\Anti-Trojan-55\PlugIns\ProcView.dll" [b]Finished![/b]

a z combo fixa już nie daję bo pomógł SDFix. Nie wiem jak ale wszystko działa. THX

**Posty:** 3854 · przez **Dzi@dek** 04 Lip 2008, 22:45

sumo22 napisał(a):a z combo fixa już nie daję bo pomógł SDFix

A jednak poprosimy + HJ

**Posty:** 34 · przez **sumo22** 06 Lip 2008, 00:03

Kod: Zaznacz wszystko: ComboFix 08-07-04.6 - Łukasz 2008-07-05 23:16:43.2 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.3.1250.1.1045.18.564 [GMT 2:00] Running from: C:\Documents and Settings\Łukasz.SPELUNA-4F40F48\Pulpit\ComboFix.exe * Created a new restore point [color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color] . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\WINDOWS\BMaf74da0d.txt C:\WINDOWS\system32\aceOonnn.ini C:\WINDOWS\system32\aceOonnn.ini2 C:\WINDOWS\system32\qmqeciio.ini C:\WINDOWS\system32\sjbsnjtx.ini C:\WINDOWS\system32\swjqdtil.ini2 C:\WINDOWS\system32\swjqdtil.tmp C:\WINDOWS\system32\vwwvavvy.ini . ((((((((((((((((((((((((( Files Created from 2008-06-05 to 2008-07-05 ))))))))))))))))))))))))))))))) . 2008-07-05 14:29 . 2008-07-05 14:29 <DIR> d-------- C:\Downloads 2008-07-05 14:24 . 2008-07-05 14:24 <DIR> d-------- C:\Documents and Settings\All Users.WINDOWS\Dane aplikacji\FreeDownloadManager.ORG 2008-07-05 14:23 . 2008-07-05 14:24 <DIR> d-------- C:\Program Files\Free Download Manager 2008-07-05 14:12 . 2007-02-03 04:04 307,200 --a------ C:\WINDOWS\system32\ATIDEMGX.dll 2008-07-04 21:19 . 2008-07-04 21:19 <DIR> d-------- C:\WINDOWS\ERUNT 2008-07-03 22:55 . 2008-07-03 22:55 <DIR> d-------- C:\tools 2008-07-03 22:55 . 2008-07-03 22:55 <DIR> d-------- C:\plugins 2008-07-03 22:55 . 2008-07-03 22:55 <DIR> d-------- C:\common 2008-07-03 22:55 . 2008-07-03 22:55 <DIR> d-------- C:\codecs 2008-07-03 22:55 . 2008-07-03 22:55 4,755 --a------ C:\unins000.dat 2008-07-03 22:13 . 2008-07-03 22:13 <DIR> d-------- C:\Program Files\KGB Archiver 2008-07-03 22:12 . 2008-07-03 22:12 <DIR> d-------- C:\Program Files\Real Alternative 2008-07-03 21:19 . 2008-07-04 13:31 <DIR> d-------- C:\Program Files\girder32 2008-07-03 20:09 . 2008-07-03 20:09 <DIR> d-------- C:\Program Files\MSXML 4.0 2008-07-03 20:07 . 2008-04-23 09:20 6,066,176 -----c--- C:\WINDOWS\system32\dllcache\ieframe.dll 2008-07-03 20:07 . 2007-04-17 11:32 2,455,488 -----c--- C:\WINDOWS\system32\dllcache\ieapfltr.dat 2008-07-03 20:07 . 2007-03-08 07:11 1,036,288 -----c--- C:\WINDOWS\system32\dllcache\ieframe.dll.mui 2008-07-03 20:07 . 2008-04-23 09:20 459,264 -----c--- C:\WINDOWS\system32\dllcache\msfeeds.dll 2008-07-03 20:07 . 2008-04-23 09:20 383,488 -----c--- C:\WINDOWS\system32\dllcache\ieapfltr.dll 2008-07-03 20:07 . 2008-06-14 19:36 273,024 -----c--- C:\WINDOWS\system32\dllcache\bthport.sys 2008-07-03 20:07 . 2008-04-23 09:20 267,776 -----c--- C:\WINDOWS\system32\dllcache\iertutil.dll 2008-07-03 20:07 . 2008-04-23 09:20 63,488 -----c--- C:\WINDOWS\system32\dllcache\icardie.dll 2008-07-03 20:07 . 2008-04-23 09:20 52,224 -----c--- C:\WINDOWS\system32\dllcache\msfeedsbs.dll 2008-07-03 20:07 . 2008-04-22 09:39 13,824 -----c--- C:\WINDOWS\system32\dllcache\ieudinit.exe 2008-07-03 20:04 . 2008-05-08 16:02 203,136 -----c--- C:\WINDOWS\system32\dllcache\rmcast.sys 2008-07-03 20:02 . 2008-07-03 20:11 <DIR> d--h----- C:\WINDOWS\$hf_mig$ 2008-06-29 14:14 . 2008-07-04 15:57 69 --a------ C:\WINDOWS\NeroDigital.ini 2008-06-29 13:25 . 2008-06-29 13:25 <DIR> d-------- C:\Program Files\AnalogX 2008-06-29 12:10 . 2008-04-14 22:51 221,184 --a------ C:\WINDOWS\system32\wmpns.dll 2008-06-29 11:55 . 2006-12-29 00:31 19,569 --a------ C:\WINDOWS\[u]0[/u]00003_.tmp 2008-06-29 11:42 . 2008-06-29 11:42 <DIR> d-------- C:\Program Files\Trend Micro 2008-06-29 01:11 . 2008-07-04 10:53 <DIR> d-------- C:\Program Files\Anti-Trojan-55 2008-06-29 00:54 . 2008-06-29 00:54 <DIR> d-------- C:\Program Files\Innovative Solutions 2008-06-28 20:35 . 2008-07-04 13:37 <DIR> d-------- C:\Program Files\a-squared Free 2008-06-28 20:24 . 2008-06-28 20:28 <DIR> d-------- C:\Program Files\11view 2008-06-28 17:13 . 2008-07-05 23:43 <DIR> d-------- C:\WINDOWS\system32\CatRoot2 2008-06-28 14:21 . 2008-04-14 22:50 363,520 --a------ C:\WINDOWS\system32\psisdecd.dll 2008-06-28 14:21 . 2008-04-14 22:51 56,832 --a------ C:\WINDOWS\system32\msdvbnp.ax 2008-06-28 14:21 . 2008-04-14 00:16 51,200 --a------ C:\WINDOWS\system32\drivers\msdv.sys 2008-06-28 14:21 . 2002-12-12 00:14 46,592 --a------ C:\WINDOWS\system32\dxdllreg.exe 2008-06-28 14:21 . 2008-04-14 22:51 33,280 --a------ C:\WINDOWS\system32\psisrndr.ax 2008-06-28 14:21 . 2008-04-14 22:51 18,432 --a------ C:\WINDOWS\system32\bdaplgin.ax 2008-06-28 14:21 . 2008-04-14 00:16 15,232 --a------ C:\WINDOWS\system32\drivers\mpe.sys 2008-06-28 14:21 . 2002-12-12 00:14 12,288 --a------ C:\WINDOWS\system32\ksolay.ax 2008-06-28 14:21 . 2008-04-14 00:16 11,776 --a------ C:\WINDOWS\system32\drivers\bdasup.sys 2008-06-28 14:13 . 2008-06-28 14:13 146 --a------ C:\WINDOWS\Eudcedit.ini 2008-06-28 13:06 . 2008-06-28 13:06 <DIR> d-------- C:\Program Files\Common Files\OczyszczaczKomputerza 2008-06-28 13:06 . 2008-06-28 13:06 <DIR> d-------- C:\Documents and Settings\All Users.WINDOWS\Dane aplikacji\OczyszczaczKomputerza 2008-06-28 12:19 . 2008-06-28 12:19 <DIR> d-------- C:\Program Files\Promixis 2008-06-28 12:02 . 2008-04-14 00:24 22,016 --a------ C:\WINDOWS\system32\drivers\MSIRCOMM.sys 2008-06-28 12:02 . 2008-04-14 00:24 22,016 --a--c--- C:\WINDOWS\system32\dllcache\msircomm.sys 2008-06-28 12:01 . 2008-04-14 22:50 28,672 --a------ C:\WINDOWS\system32\irmon.dll 2008-06-28 12:01 . 2008-04-14 22:50 28,672 --a--c--- C:\WINDOWS\system32\dllcache\irmon.dll 2008-06-28 12:01 . 2001-08-17 21:51 19,584 --a------ C:\WINDOWS\system32\drivers\rasirda.sys 2008-06-28 12:01 . 2001-08-17 21:51 19,584 --a--c--- C:\WINDOWS\system32\dllcache\rasirda.sys 2008-06-28 12:00 . 2008-04-14 22:51 152,064 --a------ C:\WINDOWS\system32\irftp.exe 2008-06-28 12:00 . 2008-04-14 22:51 152,064 --a--c--- C:\WINDOWS\system32\dllcache\irftp.exe 2008-06-28 12:00 . 2008-04-14 00:24 88,192 --a------ C:\WINDOWS\system32\drivers\irda.sys 2008-06-28 12:00 . 2008-04-14 00:24 88,192 --a--c--- C:\WINDOWS\system32\dllcache\irda.sys 2008-06-28 12:00 . 2008-04-14 22:51 8,192 --a------ C:\WINDOWS\system32\wshirda.dll 2008-06-28 12:00 . 2008-04-14 22:51 8,192 --a--c--- C:\WINDOWS\system32\dllcache\wshirda.dll 2008-06-28 11:56 . 2008-06-28 11:56 427 --a------ C:\WINDOWS\ODBC.INI 2008-06-28 11:09 . 2008-06-28 11:09 <DIR> d-------- C:\Program Files\Microsoft Silverlight 2008-06-28 09:08 . 2008-03-25 02:37 69,632 --a------ C:\WINDOWS\system32\javacpl.cpl 2008-06-27 22:53 . 2008-06-29 00:41 <DIR> d-------- C:\WINDOWS\system32\XPSViewer 2008-06-27 22:52 . 2008-06-27 22:52 <DIR> d-------- C:\Program Files\Reference Assemblies 2008-06-27 22:50 . 2006-06-29 13:07 14,048 --------- C:\WINDOWS\system32\spmsg2.dll 2008-06-27 22:30 . 2008-06-28 12:13 110,465 --a------ C:\WINDOWS\BMaf74da0d.xml 2008-06-27 20:18 . 2004-09-03 00:00 124,688 --a------ C:\WINDOWS\system32\MSWINSCK.OCX 2008-06-27 20:18 . 2007-10-07 11:27 10,752 --a------ C:\WINDOWS\system32\aamd532.dll 2008-06-27 19:32 . 2006-12-29 00:31 19,569 --a------ C:\WINDOWS\[u]0[/u]00002_.tmp 2008-06-27 18:12 . 2008-06-27 18:12 56 --ah----- C:\WINDOWS\system32\ezsidmv.dat 2008-06-27 18:05 . 2008-06-27 18:05 <DIR> d-------- C:\Program Files\Skype 2008-06-27 18:05 . 2008-06-27 18:05 <DIR> d-------- C:\Program Files\Common Files\Skype 2008-06-27 18:04 . 2008-06-27 18:05 <DIR> d-------- C:\Documents and Settings\All Users.WINDOWS\Dane aplikacji\Skype 2008-06-27 16:49 . 2008-06-27 16:49 23,392 --a------ C:\WINDOWS\system32\nscompat.tlb 2008-06-27 16:49 . 2008-06-27 16:49 16,832 --a------ C:\WINDOWS\system32\amcompat.tlb 2008-06-27 16:13 . 2008-06-27 16:14 <DIR> d-------- C:\Program Files\SubEdit-Player 2008-06-27 15:52 . 2008-06-14 19:36 273,024 --------- C:\WINDOWS\system32\drivers\bthport.sys 2008-06-27 15:52 . 2006-07-28 09:30 236,824 --a------ C:\WINDOWS\system32\xactengine2_3.dll 2008-06-27 15:52 . 2006-07-28 09:30 62,744 --a------ C:\WINDOWS\system32\xinput1_2.dll 2008-06-27 15:06 . 2006-12-29 00:31 19,569 --a------ C:\WINDOWS\[u]0[/u]00001_.tmp 2008-06-27 14:28 . 2008-06-27 14:28 <DIR> d--hs---- C:\ckis 2008-06-27 13:47 . 2008-06-27 13:47 <DIR> d--h----- C:\Documents and Settings\LocalService\Ustawienia lokalne 2008-06-27 13:47 . 2008-06-27 13:47 <DIR> d-------- C:\Documents and Settings\LocalService\Dane aplikacji 2008-06-27 13:47 . 2008-06-27 13:47 <DIR> d--hs---- C:\Documents and Settings\LocalService 2008-06-27 13:36 . 2008-06-27 13:36 <DIR> d-------- C:\Documents and Settings\All Users.WINDOWS\Dane aplikacji\Kaspersky Lab Setup Files 2008-06-27 13:25 . 2008-06-28 10:01 <DIR> d-------- C:\WINDOWS\SoftwareDistributionOld 2008-06-27 13:19 . 2008-06-28 16:52 <DIR> d-------- C:\WINDOWS\system32\CatRoot2Old 2008-06-27 13:05 . 2008-06-27 13:05 <DIR> d-------- C:\Program Files\DIFX 2008-06-27 11:45 . 2007-07-30 19:19 43,352 --a------ C:\WINDOWS\system32\wups2.dll 2008-06-27 11:45 . 2007-07-30 19:19 38,232 --a------ C:\WINDOWS\system32\wucltui.dll.mui 2008-06-27 11:45 . 2007-07-30 19:20 30,040 --a------ C:\WINDOWS\system32\wuaucpl.cpl.mui 2008-06-27 11:45 . 2007-07-30 19:20 30,040 --a------ C:\WINDOWS\system32\wuapi.dll.mui 2008-06-27 11:45 . 2007-07-30 19:18 21,336 --a------ C:\WINDOWS\system32\wuaueng.dll.mui 2008-06-27 09:08 . 2008-07-05 23:42 4,349,216 --ahs---- C:\WINDOWS\system32\drivers\fidbox.dat 2008-06-27 09:08 . 2008-07-05 23:53 99,872 --ahs---- C:\WINDOWS\system32\drivers\fidbox2.dat 2008-06-27 09:08 . 2008-07-05 23:40 61,736 --ahs---- C:\WINDOWS\system32\drivers\fidbox.idx 2008-06-27 09:08 . 2008-07-05 23:40 10,292 --ahs---- C:\WINDOWS\system32\drivers\fidbox2.idx 2008-06-27 02:18 . 2008-06-27 11:20 1,826 --a------ C:\WINDOWS\mozver.dat 2008-06-27 02:07 . 2008-06-27 14:28 96,966 --a------ C:\WINDOWS\system32\drivers\klin.dat 2008-06-27 02:07 . 2008-06-27 14:28 88,774 --a------ C:\WINDOWS\system32\drivers\klick.dat 2008-06-27 01:06 . 2008-06-27 13:54 <DIR> d-------- C:\Documents and Settings\All Users.WINDOWS\Dane aplikacji\Lavasoft 2008-06-27 01:03 . 2008-06-27 01:03 <DIR> d-------- C:\Documents and Settings\All Users.WINDOWS\Dane aplikacji\Ahead 2008-06-27 00:58 . 2008-06-27 00:58 <DIR> d-------- C:\Program Files\Nero 2008-06-27 00:58 . 2008-06-27 00:59 <DIR> d-------- C:\Documents and Settings\All Users.WINDOWS\Dane aplikacji\Nero 2008-06-27 00:33 . 2008-06-27 00:42 <DIR> d-------- C:\Documents and Settings\All Users.WINDOWS\Dane aplikacji\Microsoft Help 2008-06-27 00:00 . 2008-06-27 00:00 <DIR> d-------- C:\Temp 2008-06-26 23:59 . 2008-07-05 22:02 <DIR> d-------- C:\Documents and Settings\All Users.WINDOWS\Dane aplikacji\Kaspersky Lab 2008-06-26 23:54 . 2008-06-26 23:55 <DIR> d-------- C:\Program Files\DaemonTools_WhenUSave_Installer 2008-06-26 23:54 . 2008-06-26 23:54 <DIR> d-------- C:\Program Files\DAEMON Tools 2008-06-26 23:51 . 2008-06-26 23:51 639,224 --a------ C:\WINDOWS\system32\drivers\sptd.sys 2008-06-26 23:50 . 2008-06-26 23:50 <DIR> d-------- C:\Program Files\CarReplacer 2008-06-26 23:50 . 2008-06-28 14:49 253,952 --------- C:\WINDOWS\Setup1.exe 2008-06-26 23:50 . 2008-06-28 14:49 74,752 --a------ C:\WINDOWS\ST6UNST.EXE 2008-06-26 23:18 . 2008-04-14 22:51 294,912 -----c--- C:\WINDOWS\system32\dllcache\dlimport.exe 2008-06-26 23:07 . 2006-12-29 00:31 19,569 --a------ C:\WINDOWS\[u]0[/u]02680_.tmp 2008-06-26 23:06 . 2007-08-10 20:53 26,488 --a------ C:\WINDOWS\system32\spupdsvc.exe 2008-06-26 19:13 . 2008-06-26 19:13 <DIR> d-------- C:\Documents and Settings\All Users.WINDOWS\Dane aplikacji\CyberLink 2008-06-26 19:09 . 2008-06-26 19:16 <DIR> d-------- C:\Program Files\Winamp 2008-06-26 19:07 . 2008-06-26 19:07 <DIR> d-------- C:\Program Files\ffdshow 2008-06-26 19:07 . 2006-12-10 22:32 499,712 --a------ C:\WINDOWS\system32\msvcp71.dll 2008-06-26 19:07 . 2006-12-10 22:32 348,160 --a------ C:\WINDOWS\system32\msvcr71.dll 2008-06-26 19:07 . 2007-04-24 16:30 60,273 --a------ C:\WINDOWS\system32\pthreadGC2.dll 2008-06-26 19:07 . 2007-12-24 13:49 7,680 --a------ C:\WINDOWS\system32\ff_vfw.dll . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-07-05 12:15 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-07-03 21:00 --------- d-----w C:\Program Files\Common Files\LightScribe 2008-06-29 10:19 510,464 ----a-w C:\WINDOWS\system32\winlogon.exe 2008-06-28 07:08 --------- d-----w C:\Program Files\Java 2008-06-27 20:53 --------- d-----w C:\Program Files\MSBuild 2008-06-27 07:03 112,144 ----a-w C:\WINDOWS\system32\drivers\kl1.sys 2008-06-25 09:54 --------- d-----w C:\Program Files\Common Files\GeoVid 2008-05-08 14:02 203,136 ----a-w C:\WINDOWS\system32\drivers\rmcast.sys 2008-05-07 05:12 1,291,776 ----a-w C:\WINDOWS\system32\quartz.dll 2008-04-23 07:20 826,368 ----a-w C:\WINDOWS\system32\wininet.dll 2008-04-14 21:16 1,804 ----a-w C:\WINDOWS\system32\dcache.bin 2008-04-14 20:56 332,288 ----a-w C:\WINDOWS\system32\netsetup.exe 2008-04-14 20:52 92,424 ----a-w C:\WINDOWS\system32\rdpdd.dll 2008-04-14 20:52 87,176 ----a-w C:\WINDOWS\system32\rdpwsx.dll 2008-04-14 20:52 12,168 ----a-w C:\WINDOWS\system32\tsddd.dll 2008-04-14 20:50 999,936 ----a-w C:\WINDOWS\system32\syssetup.dll 2008-04-14 20:49 98,304 ----a-w C:\WINDOWS\system32\actxprxy.dll 2008-04-14 20:48 5,632 ----a-w C:\WINDOWS\system32\wmi.dll 2008-04-14 20:48 1,449,472 ----a-w C:\WINDOWS\system32\winntbbu.dll 2008-04-14 20:47 57,375 ----a-w C:\WINDOWS\system32\odbcji32.dll 2008-04-14 20:47 103,424 ----a-w C:\WINDOWS\system32\dpcdll.dll 2008-04-14 20:43 4,126 ----a-w C:\WINDOWS\system32\msdxmlc.dll 2008-04-14 20:42 3,584 ----a-w C:\WINDOWS\system32\msafd.dll 2008-04-14 20:36 3,584 ----a-w C:\WINDOWS\system32\icmp.dll 2008-04-14 20:35 9,344 ----a-w C:\WINDOWS\system32\framebuf.dll 2008-04-14 20:35 569,856 ----a-w C:\WINDOWS\system32\gpedit.dll 2008-04-14 20:33 3,072 ----a-w C:\WINDOWS\system32\dpnlobby.dll 2008-04-14 20:33 3,072 ----a-w C:\WINDOWS\system32\dpnaddr.dll 2008-04-14 20:33 24,064 ----a-w C:\WINDOWS\system32\pidgen.dll 2008-04-14 20:31 16,896 ----a-w C:\WINDOWS\system32\cfgmgr32.dll 2008-04-14 20:30 285,696 ----a-w C:\WINDOWS\system32\atmfd.dll 2008-04-14 20:00 2,190,336 ----a-w C:\WINDOWS\system32\ntoskrnl.exe 2008-04-14 19:59 2,067,200 ----a-w C:\WINDOWS\system32\ntkrnlpa.exe 2008-04-14 19:55 4,096 ----a-w C:\WINDOWS\system32\dsprpres.dll 2008-04-14 19:52 89,600 ------w C:\WINDOWS\system32\msxml6r.dll 2008-04-14 19:50 80,896 ------w C:\WINDOWS\system32\msshavmsg.dll 2008-04-14 19:45 49,664 ----a-w C:\WINDOWS\system32\inetres.dll 2008-04-14 19:43 563,200 ----a-w C:\WINDOWS\system32\shdoclc.dll 2008-04-14 19:37 10,240 ----a-w C:\WINDOWS\system32\gpkrsrc.dll 2008-04-14 19:35 67,584 ----a-w C:\WINDOWS\system32\browselc.dll 2008-04-14 19:35 1,845,888 ----a-w C:\WINDOWS\system32\win32k.sys 2008-04-13 22:15 17,664 ----a-w C:\WINDOWS\system32\watchdog.sys 2008-04-13 22:13 9,728 ------w C:\WINDOWS\system32\comsdupd.exe 2008-04-13 22:13 12,800 ----a-w C:\WINDOWS\system32\spiisupd.exe 2008-04-13 22:10 427,008 ----a-w C:\WINDOWS\system32\xpob2res.dll 2008-04-13 22:08 2,953,216 ----a-w C:\WINDOWS\system32\xpsp2res.dll 2008-04-13 22:05 194,560 ----a-w C:\WINDOWS\system32\xpsp1res.dll 2008-04-13 22:01 7,424 ----a-w C:\WINDOWS\system32\kd1394.dll 2008-04-13 22:00 61,440 ----a-w C:\WINDOWS\system32\msvcrt40.dll 2008-04-13 21:07 208,384 ----a-w C:\WINDOWS\system32\rsaenh.dll 2008-04-13 21:07 138,752 ----a-w C:\WINDOWS\system32\dssenh.dll 2008-04-13 20:56 12,288 ----a-w C:\WINDOWS\system32\odbcp32r.dll 2008-04-13 20:56 12,288 ----a-w C:\WINDOWS\system32\mscpx32r.dll 2008-04-13 20:51 733,696 ----a-w C:\WINDOWS\system32\qedwipes.dll 2008-04-13 20:18 1,647,616 ----a-w C:\WINDOWS\system32\winbrand.dll 2008-04-13 20:15 216,064 ----a-w C:\WINDOWS\system32\moricons.dll 2008-04-13 19:53 48,128 ----a-w C:\WINDOWS\system32\msprivs.dll 2008-04-13 19:09 884,736 ----a-w C:\WINDOWS\system32\msimsg.dll 2007-05-20 18:14 33 -c--a-w C:\Program Files\inst_winmine.txt . ------- Sigcheck ------- 2008-04-14 22:51 510464 51fd2e13d723857b9ca239ae77150f48 C:\WINDOWS\ServicePackFiles\i386\winlogon.exe 2008-06-29 12:19 510464 6907670e591011b4fa0d4643aad4642b C:\WINDOWS\system32\winlogon.exe . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2008-04-14 22:51 15360] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ATICCC"="C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe" [2006-09-25 09:12 90112] "00PCTFW"="C:\Program Files\PC Tools Firewall Plus\FirewallGUI.exe" [2007-11-09 16:00 2598808] "DAEMON Tools"="C:\Program Files\DAEMON Tools\daemon.exe" [2006-11-12 12:48 157592] "AVP"="C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe" [2008-02-08 18:36 227856] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2008-04-14 22:51 15360] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] "NoSMHelp"= 1 (0x1) "NoInstrumentation"= 1 (0x1) "NoStartMenuMFUprogramsList"= 0 (0x0) "NoResolveTrack"= 1 (0x1) "NoResolveSearch"= 0 (0x0) "NoAutoUpdate"= 1 (0x1) [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "msacm.avis"= ff_acm.acm [HKLM\~\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Menu Start^Programy^Autostart^E-Color.lnk] path=C:\Documents and Settings\All Users.WINDOWS\Menu Start\Programy\Autostart\E-Color.lnk backup=C:\WINDOWS\pss\E-Color.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Menu Start^Programy^Autostart^Microsoft Office.lnk] path=C:\Documents and Settings\All Users.WINDOWS\Menu Start\Programy\Autostart\Microsoft Office.lnk backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Anti-Trojan-Watch] --a------ 2002-09-08 09:03 26624 C:\Program Files\Anti-Trojan-55\ATWatch.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AT-Watch] --a------ 2002-09-08 09:03 26624 C:\Program Files\Anti-Trojan-55\ATWatch.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] --a------ 2007-06-27 20:03 152872 C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CMS_RSChecker] --a------ 2006-08-08 21:41 337408 D:\Instalki\internetowe\Rapidshare Free Account Notifier.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE] --a------ 2008-04-14 22:51 15360 C:\WINDOWS\system32\ctfmon.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DaemonTools_WhenUSave_Installer] --a------ 2006-05-24 11:01 148480 C:\Program Files\DaemonTools_WhenUSave_Installer\DaemonTools_WhenUSave_Installer.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Gadu-Gadu] --a------ 2007-04-17 13:12 2113536 C:\Program Files\Gadu-Gadu\gg.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LGODDFU] --a------ 2005-04-12 10:11 229376 C:\Program Files\lg_fwupdate\fwupdate.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] --a------ 2007-03-01 15:57 153136 C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl] --a------ 2004-11-02 20:24 32768 C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusOverride"=dword:00000001 "FirewallOverride"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "C:\\Program Files\\Gadu-Gadu\\gg.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "C:\\Documents and Settings\\All Users.WINDOWS\\Dane aplikacji\\Kaspersky Lab Setup Files\\Kaspersky Anti-Virus 7.0.1.325\\Polish\\setup.exe"= "C:\\Program Files\\Kaspersky Lab\\Kaspersky Anti-Virus 7.0\\avp.exe"= "C:\\Program Files\\Skype\\Phone\\Skype.exe"= R1 pctfw2;pctfw2;C:\WINDOWS\system32\drivers\pctfw2.sys [2007-11-09 17:00] R1 pctmp;PC Tools Firewall Memory Protection Driver;C:\WINDOWS\system32\drivers\pctmp.sys [2007-11-09 16:00] R1 pctssipc;PC Tools Security Suite IPC Driver;C:\WINDOWS\system32\drivers\pctssipc.sys [2007-11-09 16:00] R3 klim5;Kaspersky Anti-Virus NDIS Filter;C:\WINDOWS\system32\DRIVERS\klim5.sys [2007-12-13 13:28] R3 RT2400;RT2400 Wireless Driver;C:\WINDOWS\system32\DRIVERS\RT2400.sys [2003-10-08 13:14] S3 SF-620;Kingsun SF-620 USB Infrared Adapter;C:\WINDOWS\system32\DRIVERS\SF-620.sys [2004-08-12 04:18] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{71154876-EB52-0CE4-66DF-103A3D413F1A}] C:\Documents and Settings\Łukasz.SPELUNA-4F40F48\Dane aplikacji\server.exe s . - - - - ORPHANS REMOVED - - - - ShellExecuteHooks-{BE7E4CE1-8CBA-44A6-956F-462A667D3286} - (no file) MSConfigStartUp-ac47e991 - C:\WINDOWS\system32\oiiceqmq.dll MSConfigStartUp-BMaf74da0d - C:\WINDOWS\system32\kswaltvn.dll MSConfigStartUp-PermissionResearch - c:\program files\permissionresearch\prmrsr.exe MSConfigStartUp-WinampAgent - C:\Program Files\Winamp\winampa.exe ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-07-05 23:53:48 Windows 5.1.2600 Dodatek Service Pack 3 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . ------------------------ Other Running Processes ------------------------ . C:\WINDOWS\system32\ati2evxx.exe C:\Program Files\PC Tools Firewall Plus\FWService.exe C:\WINDOWS\system32\ati2evxx.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe D:\Instalki\multimedialne\grafika\Rainlendar\Rainlendar.exe C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe . ************************************************************************** . Completion time: 2008-07-05 23:57:38 - machine was rebooted [ťukasz] ComboFix-quarantined-files.txt 2008-07-05 21:57:27 Pre-Run: 12,353,372,160 bajtów wolnych Post-Run: 11,637,243,904 bajt˘w wolnych 317 --- E O F --- 2008-07-03 18:11:14

no i HJ

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 00:02:38, on 2008-07-06 Platform: Windows XP Dodatek SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16674) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\csrss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\PC Tools Firewall Plus\FWService.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe C:\Program Files\PC Tools Firewall Plus\FirewallGUI.exe C:\Program Files\DAEMON Tools\daemon.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\ATI Technologies\ATI.ACE\CLI.EXE C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\alg.exe D:\Instalki\multimedialne\grafika\Rainlendar\Rainlendar.exe C:\Program Files\ATI Technologies\ATI.ACE\cli.exe C:\Program Files\ATI Technologies\ATI.ACE\cli.exe C:\WINDOWS\explorer.exe C:\PROGRA~1\Mozilla Firefox\firefox.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe C:\WINDOWS\system32\wbem\wmiprvse.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll O2 - BHO: FDMIECookiesBHO Class - {CC59E0F9-7E43-44FA-9FAA-8377850BF205} - C:\Program Files\Free Download Manager\iefdm2.dll O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe" O4 - HKLM\..\Run: [00PCTFW] "C:\Program Files\PC Tools Firewall Plus\FirewallGUI.exe" -s O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033 O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Startup: Połączenie z internetem.lnk = ? O4 - Startup: Skrót do Rainlendar.lnk = D:\Instalki\multimedialne\grafika\Rainlendar\Rainlendar.exe O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O8 - Extra context menu item: Pobierz plik wideo we Free Download Manager - file://C:\Program Files\Free Download Manager\dlfvideo.htm O8 - Extra context menu item: Pobierz w Free Download Manager - file://C:\Program Files\Free Download Manager\dllink.htm O8 - Extra context menu item: Pobierz wszystkie pliki w Free Download Manager - file://C:\Program Files\Free Download Manager\dlall.htm O8 - Extra context menu item: Pobierz zaznaczone w Free Download Manager - file://C:\Program Files\Free Download Manager\dlselected.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll O9 - Extra button: Statystyki dla ochrony WWW - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\SCIEPlgn.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1214695443375 O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: Kaspersky Anti-Virus 7.0 (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe O23 - Service: PC Tools Firewall Plus (PCToolsFirewallPlus) - PC Tools - C:\Program Files\PC Tools Firewall Plus\FWService.exe -- End of file - 5782 bytes

**Posty:** 7956 · przez **Magik** 06 Lip 2008, 00:08

dobrze ze pusicles combofix'a

Kod: Zaznacz wszystko: C:\WINDOWS\BMaf74da0d.txt C:\WINDOWS\system32\aceOonnn.ini C:\WINDOWS\system32\aceOonnn.ini2 C:\WINDOWS\system32\qmqeciio.ini C:\WINDOWS\system32\sjbsnjtx.ini C:\WINDOWS\system32\swjqdtil.ini2 C:\WINDOWS\system32\swjqdtil.tmp C:\WINDOWS\system32\vwwvavvy.ini

byl syf

usun C:\Qoobox

i na koniec

by Mario
1. Ściągnij OTMoveIt i go włacz i odpal go z opcji CleanUp

2. wykonaj optymalizację windowsa
3.sciagnij ATF_Cleaner
zaznacz
Windows Temp
All users Temp
Temporary internet files
Recycle Bin
i wcisnij EMPTY SELECTED
4.Wyłącz przywracanie systemu ( właściwości mój komputer-zakładka przywracanie - wyłącz przywracanie na wszystkich dyskach). Po chwili włącz je powrotem

**Posty:** 34 · przez **sumo22** 06 Lip 2008, 15:04

dzięki wielkie wszystko działa :banan:

nieznośny trojan, albo się mylę?

Nieznośny trojan, albo się mylę?

Kto jest na forum