[log]problem z wchodzeniem na strony internetowe

**Posty:** 2 · przez **@d3v** 17 Sie 2008, 16:17

Witam.Jakiś czas temu miałem duży problem z Windowsem Xp.Polegał on na tym że system po pewnym czasie restartował się,strasznie zamulał,były problemy z dostępem do dysków i był zavirusowany.Z większością problemów się uporałem jednak ciągle nie ładują sie bardziej skomplikowane strony typu programosy.pl czy dobreprogramy.pl a wchodza tylko te prostsze typu google.pl i phpfi.com jednak googlarka takze nie dziala.Strony te nie ładują się.Dlatego prosze o sprawdzenie loga pod kątem tych stron i o sprawdzenie czy nie zostało na kompie żądnego szkodliwego oprogramowania.Z góry dziękuję.

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 16:04:01, on 2008-08-17 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16674) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\System32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe C:\Program Files\NETGATE\Spy Emergency 2008\SpyEmergencySrv.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\Rundll32.exe C:\WINDOWS\system32\ctfmon.exe C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe C:\Program Files\ToniArts\EasyCleaner\EasyClea.exe C:\WINDOWS\system32\WgaTray.exe C:\Program Files\Mozilla Firefox\firefox.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://search.bearshare.com/sidebar.html?src=ssb R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://search.bearshare.com/sidebar.html?src=ssb R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.pl/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza R3 - URLSearchHook: (no name) - {D3DEE18F-DB64-4BEB-9FF1-E1F0A5033E4A} - (no file) F2 - REG:system.ini: UserInit=userinit.exe O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.2.2.28.dll O2 - BHO: (no name) - {438661C8-5814-40A0-9629-DDC0D31A233F} - (no file) O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar4.dll O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.0.1225.9868\swg.dll O2 - BHO: XBTP02634 - {F97DA966-F09D-4cab-BF29-75A0026986EA} - (no file) O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar4.dll O4 - HKLM\..\Run: [BM931523cc] Rundll32.exe "C:\WINDOWS\system32\grbtebeu.dll",s O4 - HKCU\..\Run: [SpyEmergency] "C:\Program Files\NETGATE\Spy Emergency 2008\SpyEmergency.exe" O4 - HKCU\..\Run: [BitComet] "C:\Program Files\BitComet\BitComet.exe" /tray O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user') O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Startup: avast! Antivirus.lnk = C:\Program Files\Alwil Software\Avast4\ashAvast.exe O4 - Startup: RocketDock.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe O4 - Startup: Skype.lnk = C:\Program Files\Skype\Phone\Skype.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://C:\Program Files\BitComet\tools\BitCometBHO_1.2.2.28.dll/206 (file missing) O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {3BFFE033-BF43-11D5-A271-00A024A51325} (iNotes6 Class) - https://195.136.103.251/iNotes6W.cab O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1098114699649 O16 - DPF: {92ECE6FA-AC2E-4042-BFAE-0C8608E52A43} (SignActivX Control) - https://www.bph.pl/pi/components/SignActivX.cab O16 - DPF: {BFA1F11D-3121-AFE1-4112-894323212DAC} (GameDesire Word Games) - http://67.15.101.3/g_bin/pl/words_2_0_0_49.cab O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C1} (GameDesire Pool 8) - http://67.15.101.3/g_bin/pl/billard8_2_0_0_24.cab O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: Spy Emergency Engine Service (SpyEmrgSrv) - NETGATE Technologies s.r.o. - C:\Program Files\NETGATE\Spy Emergency 2008\SpyEmergencySrv.exe -- End of file - 7629 bytes

**Posty:** 84 · przez **gloni** 17 Sie 2008, 17:33

Wykonaj to co jest podane w tym temacie

Zastosuj SDFix . Po pobraniu uruchom go a rozpakuje się do C:\SDFix. Uruchom komputer w trybie awaryjnym (F8 przy stracie systemu). Będąc w awaryjnym uruchom plik RunThis.bat z folderu SDFixa. Zatwierdź czyszczenie przez Y. Poczekaj aż ukończy i komputer zresetuje

Potem wejdz do folderu C:\SDFix wrzuc zawartość pliku Report.txt + log z combofixa oraz daj loga z hijacka

Autor postu otrzymał pochwałę

**Posty:** 2 · przez **@d3v** 17 Sie 2008, 18:15

WWDC zastosowalem juz wczesniej problem byl tylko ze stronami internetowymi teraz juz wszytsko dziala

Daje jeszcze to co mi kazales :

Report.txt z SDFix-a

Kod: Zaznacz wszystko: [b]SDFix: Version 1.216 [/b] Run by Administrator on 2008-08-17 at 17:43 Microsoft Windows XP [Wersja 5.1.2600] Running From: C:\SDFix\SDFix [b]Checking Services [/b]: Restoring Default Security Values Restoring Default Hosts File Rebooting [b]Checking Files [/b]: Trojan Files Found: C:\Temp\1cb\syscheck.log - Deleted Folder C:\Program Files\Network Monitor - Removed Folder C:\Temp\1cb - Removed Removing Temp Files [b]ADS Check [/b]: [b]Final Check [/b]: catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-08-17 17:50:48 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... scanning hidden services & system hive ... [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\d347prt\Cfg\0Jf40] "khjeh"=hex:20,02,00,00,4e,16,aa,58,74,2b,28,99,4a,7c,d6,03,97,d7,b6,6f,8e,.. "hj34z0"=hex:53,10,d4,a9,f5,20,c0,77,55,81,a1,1b,1a,48,bb,45,fa,26,e5,23,13,.. "hj34z1"=hex:9e,a3,dd,a9,9d,e3,c9,77,54,5e,a9,1b,1b,a3,b2,45,fa,d6,ec,23,c9,.. "hj34z2"=hex:9e,69,cc,a9,9d,a4,d8,77,54,09,b8,1b,1b,d9,a3,45,fa,98,fd,23,c9,.. "hj34z3"=hex:9e,54,f3,a9,00 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\d347prt\Cfg\0Jf41] "khjeh"=hex:20,02,00,00,c2,c4,cb,61,d4,53,fe,f5,e7,29,e2,45,8e,34,58,02,19,.. [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\d347prt\Cfg\0Jf42] "khjeh"=hex:20,02,00,00,b3,c4,cb,61,77,0f,93,8e,de,dd,76,36,69,a2,0d,0a,18,.. [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\d347prt\Cfg\0Jf43] "khjeh"=hex:20,02,00,00,a4,c4,cb,61,ea,ba,34,a7,35,81,fa,e6,f4,1f,bf,11,07,.. [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg] "s0"=dword:dc0da85a "s1"=dword:356ca7ff "s2"=dword:36da1143 "h0"=dword:00000001 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4] "h0"=dword:00000000 "khjeh"=hex:57,5b,cb,66,3c,5f,67,41,88,ce,bc,0a,f6,61,a4,42,cd,3f,d7,10,f0,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4] "h0"=dword:00000000 "khjeh"=hex:a1,82,ad,30,1b,6b,a6,44,da,de,75,77,f3,9e,4e,e9,ce,92,c5,8d,c7,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4] "h0"=dword:00000000 "khjeh"=hex:57,5b,cb,66,3c,5f,67,41,88,ce,bc,0a,f6,61,a4,42,cd,3f,d7,10,f0,.. scanning hidden registry entries ... scanning hidden files ... scan completed successfully hidden processes: 0 hidden services: 0 hidden files: 0 [b]Remaining Services [/b]: Authorized Application Key Export: [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] "C:\\Program Files\\Gadu-Gadu\\gg.exe"="C:\\Program Files\\Gadu-Gadu\\gg.exe:*:Enabled:Gadu-Gadu - program glowny" "C:\\WINDOWS\\system32\\sessmgr.exe"="C:\\WINDOWS\\system32\\sessmgr.exe:*:Enabled:@xpsp2res.dll,-22019" "C:\\Program Files\\JetAudio\\JcServer.exe"="C:\\Program Files\\JetAudio\\JcServer.exe:*:Disabled:jcServer" "C:\\Program Files\\BearShare\\BearShare.exe"="C:\\Program Files\\BearShare\\BearShare.exe:*:Enabled:BearShare" "%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000" "C:\\Program Files\\Skype\\Phone\\Skype.exe"="C:\\Program Files\\Skype\\Phone\\Skype.exe:*:Enabled:Skype" [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list] "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000" [b]Remaining Files [/b]: File Backups: - C:\SDFix\SDFix\backups\backups.zip [b]Files with Hidden Attributes [/b]: Tue 14 Feb 2006 67,584 A..H. --- "C:\dane\Word\Bruksela Euro-foot-Indoor\~WRL0001.tmp" Fri 17 Feb 2006 4,348 A.SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak" Sat 6 Jan 2007 72 A..H. --- "C:\Program Files\InterActual\InterActual Player\iti426.tmp" Sun 31 Mar 2002 34,304 A..H. --- "C:\dane\ze starego laptopa - do 04-2006\word\dsp\~WRL0124.tmp" Sun 9 Dec 2001 1,365,504 A..H. --- "C:\dane\ze starego laptopa - do 04-2006\word\e-money\~WRL0004.tmp" Tue 10 Oct 2000 74,752 A..H. --- "C:\dane\ze starego laptopa - do 04-2006\word\e-money\~WRL2500.tmp" Wed 7 May 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\05030212059e1b9876d47b8cf2fa5e95\BIT950.tmp" Sun 17 Aug 2008 536,616 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\8e0642fae7d401abc57aaf20ea425112\BIT8.tmp" Sun 17 Aug 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\c2931765f1055e791aa5f27823577013\BIT9.tmp" Sun 17 Aug 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\37c3cf252dd5d65ce31f2c1c0298580b\download\BIT1A.tmp" Sun 17 Aug 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\f610cc67467df7758410f947419784b3\download\BIT1B.tmp" [b]Finished![/b]

LOG z Combofixa:

Kod: Zaznacz wszystko: ComboFix 08-08-16.01 - KRZYSIEK 2008-08-17 17:58:29.1 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.161 [GMT 2:00] Running from: C:\Documents and Settings\KRZYSIEK\Pulpit\ComboFix.exe * Created a new restore point [color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color] . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\Documents and Settings\Administrator\Dane aplikacji\Microsoft\SystemCertificates\My C:\Documents and Settings\KRZYSIEK\Cookies\krzysiek@ad.yieldmanager[2].txt C:\Documents and Settings\KRZYSIEK\Cookies\krzysiek@addlvr[2].txt C:\Documents and Settings\KRZYSIEK\Cookies\krzysiek@adidm07.idmnet[2].txt C:\Documents and Settings\KRZYSIEK\Cookies\krzysiek@antispywaremaster[1].txt C:\Documents and Settings\KRZYSIEK\Cookies\krzysiek@connextra[4].txt C:\Documents and Settings\KRZYSIEK\Cookies\krzysiek@go.arbopl.bbelements[2].txt C:\Documents and Settings\KRZYSIEK\Cookies\krzysiek@go.arbopl.bbelements[3].txt C:\Documents and Settings\KRZYSIEK\Cookies\krzysiek@go.arbopl.bbelements[5].txt C:\Documents and Settings\KRZYSIEK\Cookies\krzysiek@grono[2].txt C:\Documents and Settings\KRZYSIEK\Cookies\krzysiek@nuggad[1].txt C:\Documents and Settings\KRZYSIEK\Cookies\krzysiek@oczyszczaczkomputerza[1].txt C:\Documents and Settings\KRZYSIEK\Cookies\krzysiek@onet[1].txt C:\Documents and Settings\LocalService\Dane aplikacji\Microsoft\SystemCertificates\My C:\Documents and Settings\LocalService\Dane aplikacji\NetMon C:\Documents and Settings\LocalService\Dane aplikacji\NetMon\domains.txt C:\Documents and Settings\LocalService\Dane aplikacji\NetMon\log.txt C:\Documents and Settings\NetworkService\Dane aplikacji\Microsoft\SystemCertificates\My C:\Documents and Settings\ROBERT\Cookies\robert@2.stat.cashbill[1].txt C:\Documents and Settings\ROBERT\Cookies\robert@onet[2].txt C:\Documents and Settings\ROBERT\Dane aplikacji\Microsoft\SystemCertificates\My C:\Program Files\myglobalsearch C:\Program Files\myglobalsearch\bar\1.bin\M9FFXTBR.JAR C:\Program Files\myglobalsearch\bar\1.bin\M9FFXTBR.MANIFEST C:\Program Files\myglobalsearch\bar\1.bin\M9NTSTBR.JAR C:\Program Files\myglobalsearch\bar\1.bin\M9NTSTBR.MANIFEST C:\Program Files\myglobalsearch\bar\1.bin\M9PLUGIN.DLL C:\Program Files\myglobalsearch\bar\Cache\[u]0[/u]00430A1 C:\Program Files\myglobalsearch\bar\Cache\[u]0[/u]004F009 C:\Program Files\myglobalsearch\bar\Cache\[u]0[/u]00551E0 C:\Program Files\myglobalsearch\bar\Cache\[u]0[/u]0132FED C:\Program Files\myglobalsearch\bar\Cache\[u]0[/u]0F42FE6.bin C:\Program Files\myglobalsearch\bar\Cache\[u]0[/u]0F4344B.bin C:\Program Files\myglobalsearch\bar\Cache\[u]0[/u]0F43853.bin C:\Program Files\myglobalsearch\bar\Cache\files.ini C:\Program Files\myglobalsearch\bar\History\search C:\Program Files\myglobalsearch\bar\Settings\prevcfg.htm C:\WINDOWS\BM931523cc.txt C:\WINDOWS\BM931523cc.xml C:\WINDOWS\Fonts\' C:\WINDOWS\pskt.ini C:\WINDOWS\system32\AutoRun.inf C:\WINDOWS\system32\dlegausr.ini C:\WINDOWS\system32\grbtebeu.dll C:\WINDOWS\system32\iypviqjq.dll C:\WINDOWS\system32\jjcfmvmj.exe C:\WINDOWS\system32\MpoVDcfe.ini C:\WINDOWS\system32\MpoVDcfe.ini2 C:\WINDOWS\system32\MSINET.oca C:\WINDOWS\system32\pjofycej.exe C:\WINDOWS\system32\qwymmirc.exe C:\WINDOWS\system32\wrwhylnx.dll C:\WINDOWS\system32\xxyvsSKD.dll D:\autorun.bat G:\copy.exe G:\host.exe C:\Documents and Settings\KRZYSIEK\Dane aplikacji\Microsoft\SystemCertificates\My . . . . failed to delete . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Legacy_CMDSERVICE -------\Legacy_NETWORK_MONITOR ((((((((((((((((((((((((( Files Created from 2008-07-17 to 2008-08-17 ))))))))))))))))))))))))))))))) . 2008-08-17 17:41 . 2008-08-17 17:41 <DIR> d-------- C:\WINDOWS\ERUNT 2008-08-17 17:37 . 2008-08-17 17:37 <DIR> d-------- C:\SDFix 2008-08-17 15:54 . 2008-08-17 15:54 <DIR> d-------- C:\Program Files\Trend Micro 2008-08-17 15:53 . 2008-08-17 15:53 <DIR> d-------- C:\Program Files\ToniArts 2008-08-17 15:53 . 2008-08-17 15:53 <DIR> d-------- C:\Program Files\FreeCommander 2008-08-11 16:55 . 2008-08-11 16:55 <DIR> d-------- C:\Program Files\Lavasoft 2008-08-11 13:41 . 2008-08-11 13:41 <DIR> d-------- C:\Documents and Settings\KRZYSIEK\Dane aplikacji\Gadu-Gadu 2008-08-11 12:51 . 2008-08-17 18:01 <DIR> d--h----- C:\Documents and Settings\Administrator\Ustawienia lokalne 2008-08-11 12:51 . 2004-10-18 18:27 <DIR> d-------- C:\Documents and Settings\Administrator\Ulubione 2008-08-11 12:51 . 2004-10-18 17:31 <DIR> d--h----- C:\Documents and Settings\Administrator\Szablony 2008-08-11 12:51 . 2004-10-18 18:27 <DIR> d-------- C:\Documents and Settings\Administrator\Pulpit 2008-08-11 12:51 . 2004-10-18 18:27 <DIR> d-------- C:\Documents and Settings\Administrator\Moje dokumenty 2008-08-11 12:51 . 2004-10-18 18:27 <DIR> dr------- C:\Documents and Settings\Administrator\Menu Start 2008-08-11 12:51 . 2004-10-18 18:27 <DIR> dr-h----- C:\Documents and Settings\Administrator\Dane aplikacji 2008-08-11 12:51 . 2008-08-11 12:51 <DIR> d-------- C:\Documents and Settings\Administrator 2008-08-11 12:37 . 2008-08-11 12:37 <DIR> d-------- C:\Program Files\Alwil Software 2008-08-11 12:35 . 2008-08-11 18:38 <DIR> d--hs---- C:\WINDOWS\S09NUFVURVI 2008-08-11 12:34 . 2008-08-11 12:35 <DIR> d-------- C:\WINDOWS\system32\vpe 2008-08-11 12:34 . 2008-08-12 17:00 <DIR> d-------- C:\WINDOWS\system32\kBin02 2008-08-11 12:34 . 2008-08-11 18:38 <DIR> d-------- C:\WINDOWS\system32\crc4 2008-08-11 12:34 . 2008-08-11 12:35 <DIR> d-------- C:\TEMP\epr1 2008-08-11 12:25 . 2008-08-11 12:25 77 --a------ C:\Documents and Settings\KRZYSIEK\4559.bat 2008-08-11 10:14 . 2008-08-11 16:56 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Lavasoft 2008-08-11 10:13 . 2008-08-11 10:13 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard 2008-08-11 10:07 . 2008-08-11 10:07 77 --a------ C:\Documents and Settings\KRZYSIEK\4662.bat 2008-08-10 12:57 . 2008-08-10 12:57 77 --a------ C:\Documents and Settings\KRZYSIEK\2554.bat 2008-08-10 11:12 . 2008-08-10 11:12 147,456 --a------ C:\WINDOWS\system32\vbzip10.dll 2008-08-10 11:07 . 2008-08-11 12:32 <DIR> d-a------ C:\Documents and Settings\All Users\Dane aplikacji\TEMP 2008-08-09 18:24 . 2008-08-10 11:08 <DIR> d-------- C:\Documents and Settings\KRZYSIEK\Dane aplikacji\F-Secure 2008-08-07 13:11 . 2008-08-11 12:28 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\F-Secure 2008-08-07 13:10 . 2008-08-11 12:32 <DIR> d-------- C:\Program Files\F-Secure Internet Security 2008-08-07 13:09 . 2008-08-07 13:09 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\fssg 2008-08-07 12:53 . 2008-08-07 12:53 2,560 --a------ C:\WINDOWS\system32\bitcometres.dll 2008-08-07 00:05 . 2008-08-07 00:05 <DIR> d-------- C:\Documents and Settings\KRZYSIEK\Dane aplikacji\Multi-Timer Ultimate 2008-08-06 00:17 . 2008-08-07 00:05 <DIR> d-------- C:\Program Files\Multi-Timer Ultimate 2008-08-06 00:03 . 2008-08-06 00:03 <DIR> d-------- C:\WINDOWS\system32\config\systemprofile\Phone Browser 2008-08-05 23:43 . 2008-08-05 23:43 <DIR> d-------- C:\Program Files\NETGATE 2008-08-05 23:43 . 2008-08-17 18:06 <DIR> d-------- C:\Documents and Settings\KRZYSIEK\Dane aplikacji\Spy Emergency 2008-08-05 23:43 . 2008-08-05 23:43 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\NETGATE 2008-08-05 23:43 . 2008-03-01 17:09 23,096 --a------ C:\WINDOWS\system32\sremcon.exe 2008-08-05 23:43 . 2008-02-05 12:10 14,392 --a------ C:\WINDOWS\system32\drivers\spyemrg_guard.sys 2008-08-05 23:43 . 2008-02-05 12:10 12,344 --a------ C:\WINDOWS\system32\drivers\spyemrg.sys . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-08-17 15:56 --------- d-----w C:\Documents and Settings\KRZYSIEK\Dane aplikacji\Skype 2008-08-17 13:53 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-08-14 15:57 --------- d-----w C:\Program Files\Gadu-Gadu 2008-08-11 16:38 --------- d-----w C:\Program Files\BearShare 2008-08-09 17:28 --------- d-----w C:\Program Files\BitComet 2008-08-09 16:49 --------- d-----w C:\Program Files\Common Files\Adobe 2008-08-09 11:42 --------- d-----w C:\Program Files\SnadBoy's Revelation v2 2008-08-07 10:51 --------- d-----w C:\Program Files\F-Secure 2008-08-05 22:18 --------- d-----w C:\Program Files\3DO 2008-08-05 22:09 --------- d-----w C:\Documents and Settings\KRZYSIEK\Dane aplikacji\Lavasoft 2008-07-21 10:40 22,384 ----a-w C:\Documents and Settings\ROBERT\Dane aplikacji\GDIPFONTCACHEV1.DAT 2008-07-14 05:30 --------- d-----w C:\Documents and Settings\KRZYSIEK\Dane aplikacji\BESTplayer 2008-06-20 10:45 360,320 ----a-w C:\WINDOWS\system32\drivers\tcpip.sys 2008-06-20 10:44 138,368 ----a-w C:\WINDOWS\system32\drivers\afd.sys 2008-06-20 09:52 225,920 ----a-w C:\WINDOWS\system32\drivers\tcpip6.sys 2008-06-20 09:13 65,021 ----a-w C:\WINDOWS\BricoPackUninst.cmd 2008-06-20 09:13 6,120 ----a-w C:\WINDOWS\BricoPackFoldersDelete.cmd 2008-03-16 19:20 22,384 -c--a-w C:\Documents and Settings\KRZYSIEK\Dane aplikacji\GDIPFONTCACHEV1.DAT 2007-08-30 14:17 5,632 --sha-w C:\Program Files\Thumbs.db 2006-07-30 20:20 959 --sha-r C:\WINDOWS\system32\autorun.bin . ------- Sigcheck ------- 2002-09-23 14:00 12800 b3c95bfeef6781a82a1c429f466a3a11 C:\WINDOWS\$NtServicePackUninstall$\svchost.exe 2004-08-04 01:44 14336 ba98327e90022dbd6ee76490e0622e2e C:\WINDOWS\ServicePackFiles\i386\svchost.exe 2004-08-04 01:44 14336 ba98327e90022dbd6ee76490e0622e2e C:\WINDOWS\system32\svchost.exe 2005-03-02 20:21 578560 6a93565be9b8422eb7538c66ac732d76 C:\WINDOWS\$hf_mig$\KB890859\SP2QFE\user32.dll 2007-03-08 17:51 579584 11abdecc02efc1d2b6a6a0fa46c26594 C:\WINDOWS\$hf_mig$\KB925902\SP2QFE\user32.dll 2003-09-25 19:24 561664 708b0fea59cf9446555c112695698599 C:\WINDOWS\$NtServicePackUninstall$\user32.dll md5deep: C:\WINDOWS\$NtUninstallKB824141$\user32.dll: Permission denied md5deep: C:\WINDOWS\$NtUninstallKB826939$\user32.dll: Permission denied 2004-08-04 01:44 578560 0c81764f50f32d376e6e4b9e9f4b01a0 C:\WINDOWS\$NtUninstallKB890859$\user32.dll 2005-03-02 20:18 578560 b7eeb1a1af740306049241ddf61f21ff C:\WINDOWS\$NtUninstallKB925902$\user32.dll 2004-08-04 01:44 578560 0c81764f50f32d376e6e4b9e9f4b01a0 C:\WINDOWS\ServicePackFiles\i386\user32.dll 2007-03-08 17:38 579072 a37a4637f84f8dd771274eaf8d17fa65 C:\WINDOWS\system32\user32.dll 2007-03-08 17:38 579072 a37a4637f84f8dd771274eaf8d17fa65 C:\WINDOWS\system32\dllcache\user32.dll 2002-09-23 14:00 75264 9b7d1c56cc12d806314b853bf52ecb4c C:\WINDOWS\$NtServicePackUninstall$\ws2_32.dll 2004-08-04 01:44 82944 ab82237486b727dd7dab36a76f38a3a2 C:\WINDOWS\ServicePackFiles\i386\ws2_32.dll 2004-08-04 01:44 82944 ab82237486b727dd7dab36a76f38a3a2 C:\WINDOWS\system32\ws2_32.dll 2005-10-21 05:39 664064 720005547ae4e3002ca171b50141f0ed C:\WINDOWS\$hf_mig$\KB905915\SP2QFE\wininet.dll 2006-03-04 06:01 666112 29f9cfd7c62b188e9e580455a5388880 C:\WINDOWS\$hf_mig$\KB912812\SP2QFE\wininet.dll 2006-05-10 07:27 666112 d11493e5ac4ab399bcd28130e158a56b C:\WINDOWS\$hf_mig$\KB916281\SP2QFE\wininet.dll 2006-06-23 13:27 667136 9df7509e4ca980a1c68cf737febb6017 C:\WINDOWS\$hf_mig$\KB918899\SP2QFE\wininet.dll 2006-09-14 10:37 667136 0228190b1b080b777d60ca62910dcc2c C:\WINDOWS\$hf_mig$\KB922760\SP2QFE\wininet.dll 2006-10-23 17:35 667136 94c7bc5c38ccbfe9f23edfbd680ac3d5 C:\WINDOWS\$hf_mig$\KB925454\SP2QFE\wininet.dll 2007-01-04 16:05 667648 b9cd00815effa790279a1d2f0d07323f C:\WINDOWS\$hf_mig$\KB928090\SP2QFE\wininet.dll 2007-02-19 17:23 668160 f3d9666793b8c21ef3101d367de29519 C:\WINDOWS\$hf_mig$\KB931768\SP2QFE\wininet.dll 2007-04-18 14:46 668160 96e30dc9bf788de16a305e52fcac47ef C:\WINDOWS\$hf_mig$\KB933566\SP2QFE\wininet.dll 2007-06-26 16:53 668160 d3f572c8f0e4e1036bb730820c3830bb C:\WINDOWS\$hf_mig$\KB937143\SP2QFE\wininet.dll 2007-08-22 14:58 668160 07608337038c78cdaba8650089837a58 C:\WINDOWS\$hf_mig$\KB939653\SP2QFE\wininet.dll 2007-08-20 11:51 825344 9d6da6a9c682c5156b1e6bbaad6592f9 C:\WINDOWS\$hf_mig$\KB939653-IE7\SP2QFE\wininet.dll 2007-10-11 01:41 825344 8789f8f08dea02d93e1fdc9d93e73b54 C:\WINDOWS\$hf_mig$\KB942615-IE7\SP2QFE\wininet.dll 2007-12-07 03:58 825344 fc62b038aba1fdb8ba3d7c44cb487beb C:\WINDOWS\$hf_mig$\KB944533-IE7\SP2QFE\wininet.dll 2008-03-01 14:35 827392 b1db24042f335198ead97aaa675b1078 C:\WINDOWS\$hf_mig$\KB947864-IE7\SP2QFE\wininet.dll 2008-04-23 06:21 827392 dfbdc6023a541f5a9558336fec15c75a C:\WINDOWS\$hf_mig$\KB950759-IE7\SP2QFE\wininet.dll 2004-08-23 20:36 592896 4149cb2759ffb8e1190edc86ed65bbe8 C:\WINDOWS\$NtServicePackUninstall$\wininet.dll 2002-09-23 14:00 601600 4965c02574610e9b2d1e18d63d11a772 C:\WINDOWS\$NtUninstallKB834707-IE6SP1-20040929.091901$\wininet.dll 2004-08-04 01:44 658944 d37dafb534ac8343d59a1b501abe852c C:\WINDOWS\$NtUninstallKB905915$\wininet.dll 2005-10-21 05:42 660992 406f49324af7b16c9f896e36851be621 C:\WINDOWS\$NtUninstallKB912812$\wininet.dll 2006-03-04 05:35 660992 755e3fe6352aab3f3703d37ce30456d7 C:\WINDOWS\$NtUninstallKB916281$\wininet.dll 2006-05-10 07:25 660992 ac92c3ebf39fe6c6d51d8712be805aee C:\WINDOWS\$NtUninstallKB918899$\wininet.dll 2006-06-23 13:16 661504 f8c7c74790d5910e63b9ebde0da66728 C:\WINDOWS\$NtUninstallKB922760$\wininet.dll 2006-09-14 10:41 661504 963cba719db55c439037464964fb22f4 C:\WINDOWS\$NtUninstallKB925454$\wininet.dll 2006-10-23 17:19 661504 7ff4d6cabe1bf98e4d06fb1161e7a39d C:\WINDOWS\$NtUninstallKB928090$\wininet.dll 2007-01-04 15:58 661504 88d99579dc0a7bf56a7f875a078c66e0 C:\WINDOWS\$NtUninstallKB931768$\wininet.dll 2007-02-19 17:05 661504 7e74aedaac9627358c3533b0837a6f36 C:\WINDOWS\$NtUninstallKB933566$\wininet.dll 2007-04-18 14:32 661504 15c3e2aa84ba723157cc1fb23cff659c C:\WINDOWS\$NtUninstallKB937143$\wininet.dll 2007-06-26 16:15 661504 3a4a2cd6f223f0c83ad68e6a4c566ffb C:\WINDOWS\$NtUninstallKB939653$\wininet.dll 2007-08-22 15:19 661504 ec234cc41563be7778fff21512cb0d7a C:\WINDOWS\ie7\wininet.dll 2007-08-13 19:54 818688 a4a0fc92358f39538a6494c42ef99fe9 C:\WINDOWS\ie7updates\KB939653-IE7\wininet.dll 2007-08-20 12:01 824832 ee0d310c577662b6219c0643b17c4150 C:\WINDOWS\ie7updates\KB942615-IE7\wininet.dll 2007-10-11 01:52 824832 21af9692c43e6e5f02422026e20886aa C:\WINDOWS\ie7updates\KB944533-IE7\wininet.dll 2007-12-07 04:14 824832 01412a2abd1154b25d4f5b5450585bb3 C:\WINDOWS\ie7updates\KB947864-IE7\wininet.dll 2008-03-01 15:02 826368 acb31b4ed243d4dffa5268f4ad2b0d6f C:\WINDOWS\ie7updates\KB950759-IE7\wininet.dll 2008-04-23 09:20 817152 0c29a93d66654ef9321481de58578dac C:\WINDOWS\ServicePackFiles\i386\wininet.dll 2007-08-20 12:01 824832 ee0d310c577662b6219c0643b17c4150 C:\WINDOWS\SoftwareDistribution\Download\6a08e1b6f2a447295ce7064d5ac3d3a1\SP2GDR\wininet.dll 2007-08-20 11:51 825344 9d6da6a9c682c5156b1e6bbaad6592f9 C:\WINDOWS\SoftwareDistribution\Download\6a08e1b6f2a447295ce7064d5ac3d3a1\SP2QFE\wininet.dll 2008-06-23 18:42 826368 15c09e8a74a0988fb2f24eff9d68d886 C:\WINDOWS\SoftwareDistribution\Download\ab9d78b03b368d8b59723db13556e0cc\SP2GDR\wininet.dll 2008-06-23 17:41 827904 e02939ebf940d5eb274903f58154dc56 C:\WINDOWS\SoftwareDistribution\Download\ab9d78b03b368d8b59723db13556e0cc\SP2QFE\wininet.dll 2008-04-23 09:20 817152 0c29a93d66654ef9321481de58578dac C:\WINDOWS\system32\wininet.dll 2008-04-23 09:20 826368 e1c03d3bba5fed8c37df83a57890978d C:\WINDOWS\system32\dllcache\wininet.dll 2005-05-25 21:07 359936 63fdfea54eb53de2d863ee454937ce1e C:\WINDOWS\$hf_mig$\KB893066\SP2QFE\tcpip.sys 2006-01-13 19:07 360448 5562cc0a47b2aef06d3417b733f3c195 C:\WINDOWS\$hf_mig$\KB913446\SP2QFE\tcpip.sys 2006-04-20 14:18 360576 b2220c618b42a2212a59d91ebd6fc4b4 C:\WINDOWS\$hf_mig$\KB917953\SP2QFE\tcpip.sys 2007-10-30 18:53 360832 64798ecfa43d78c7178375fcdd16d8c8 C:\WINDOWS\$hf_mig$\KB941644\SP2QFE\tcpip.sys 2008-06-20 12:44 360960 744e57c99232201ae98c49168b918f48 C:\WINDOWS\$hf_mig$\KB951748\SP2QFE\tcpip.sys 2008-06-20 13:51 361600 9aefa14bd6b182d61e3119fa5f436d3d C:\WINDOWS\$hf_mig$\KB951748\SP3GDR\tcpip.sys 2008-06-20 13:59 361600 ad978a1b783b5719720cff204b666c8e C:\WINDOWS\$hf_mig$\KB951748\SP3QFE\tcpip.sys 2002-09-23 14:00 332928 244a2f9816bc9b593957281ef577d976 C:\WINDOWS\$NtServicePackUninstall$\tcpip.sys 2004-08-04 00:14 359040 9f4b36614a0fc234525ba224957de55c C:\WINDOWS\$NtUninstallKB893066$\tcpip.sys 2005-05-25 21:04 359808 88763a98a4c26c409741b4aa162720c9 C:\WINDOWS\$NtUninstallKB913446$\tcpip.sys 2006-01-13 04:28 359808 583e063fdc888ca30d05c2724b0d7ef4 C:\WINDOWS\$NtUninstallKB917953$\tcpip.sys 2006-04-20 13:51 359808 1dbf125862891817f374f407626967f4 C:\WINDOWS\$NtUninstallKB941644$\tcpip.sys 2007-10-30 19:20 360064 90caff4b094573449a0872a0f919b178 C:\WINDOWS\$NtUninstallKB951748$\tcpip.sys 2004-08-04 00:14 359040 9f4b36614a0fc234525ba224957de55c C:\WINDOWS\ServicePackFiles\i386\tcpip.sys 2008-06-20 12:45 360320 2a5554fc5b1e04e131230e3ce035c3f9 C:\WINDOWS\system32\dllcache\tcpip.sys 2008-06-20 12:45 360320 2a5554fc5b1e04e131230e3ce035c3f9 C:\WINDOWS\system32\drivers\tcpip.sys 2002-09-23 14:00 519168 8b6e6bb5d451f8bbc0621203b687d993 C:\WINDOWS\$NtServicePackUninstall$\winlogon.exe 2004-08-04 01:44 504832 0344407089b08548d4feba62bb0f32d0 C:\WINDOWS\ServicePackFiles\i386\winlogon.exe 2004-08-04 01:44 504832 0344407089b08548d4feba62bb0f32d0 C:\WINDOWS\system32\winlogon.exe 2002-09-23 14:00 167552 3b350e5a2a5e951453f3993275a4523a C:\WINDOWS\$NtServicePackUninstall$\ndis.sys 2004-08-04 00:14 182912 558635d3af1c7546d26067d5d9b6959e C:\WINDOWS\ServicePackFiles\i386\ndis.sys 2004-08-04 00:14 182912 558635d3af1c7546d26067d5d9b6959e C:\WINDOWS\system32\drivers\ndis.sys 2004-08-04 00:00 29056 4448006b6bc60e6c027932cfc38d6855 C:\WINDOWS\ServicePackFiles\i386\ip6fw.sys 2004-08-04 00:00 29056 4448006b6bc60e6c027932cfc38d6855 C:\WINDOWS\system32\drivers\ip6fw.sys 2005-03-02 20:14 2058240 35d11fdc381536ab95e3005489131f44 C:\WINDOWS\$hf_mig$\KB890859\SP2QFE\ntkrnlpa.exe 2006-12-19 20:47 2060672 4a447a38f3d164bb634d20d0a2c6833b C:\WINDOWS\$hf_mig$\KB929338\SP2QFE\ntkrnlpa.exe 2007-02-28 18:09 2060672 2f4a36b1b03d64fb176cb0f3eb597118 C:\WINDOWS\$hf_mig$\KB931784\SP2QFE\ntkrnlpa.exe 2003-04-24 19:21 1950720 703bf7590b0bd8524e5260d8403bffba C:\WINDOWS\$NtServicePackUninstall$\ntkrnlpa.exe md5deep: C:\WINDOWS\$NtUninstallKB826939$\ntkrnlpa.exe: Permission denied 2004-08-04 01:38 2058112 44d1bc1b05e0c7c82e81687b79c653c7 C:\WINDOWS\$NtUninstallKB890859$\ntkrnlpa.exe 2005-03-02 20:08 2058112 0f6990820c6ce0a7a911fae5937ef1f6 C:\WINDOWS\$NtUninstallKB929338$\ntkrnlpa.exe 2006-12-19 20:24 2058880 3d50d5db6343c789a75523714c8ab8c2 C:\WINDOWS\$NtUninstallKB931784$\ntkrnlpa.exe 2007-02-28 18:04 2058880 2bdc1a6cefe320e9c39fabf1961ebb9d C:\WINDOWS\Driver Cache\i386\ntkrnlpa.exe 2004-08-04 01:38 2058112 44d1bc1b05e0c7c82e81687b79c653c7 C:\WINDOWS\ServicePackFiles\i386\ntkrnlpa.exe 2007-02-28 18:04 2058880 2bdc1a6cefe320e9c39fabf1961ebb9d C:\WINDOWS\system32\ntkrnlpa.exe 2007-02-28 18:04 2058880 2bdc1a6cefe320e9c39fabf1961ebb9d C:\WINDOWS\system32\dllcache\ntkrnlpa.exe 2005-03-02 20:14 2180864 dba3e4215279c8012b37d2135b531258 C:\WINDOWS\$hf_mig$\KB890859\SP2QFE\ntoskrnl.exe 2006-12-19 20:47 2183296 745c1a081aa663ea324e87432c244f70 C:\WINDOWS\$hf_mig$\KB929338\SP2QFE\ntoskrnl.exe 2007-02-28 18:09 2183424 c450518ef9acc02a2d799698021e31a8 C:\WINDOWS\$hf_mig$\KB931784\SP2QFE\ntoskrnl.exe 2003-04-24 19:22 1927040 3d9f26a88f675485d4db137c1fe1a0b5 C:\WINDOWS\$NtServicePackUninstall$\ntoskrnl.exe md5deep: C:\WINDOWS\$NtUninstallKB826939$\ntoskrnl.exe: Permission denied 2004-08-04 01:39 2182272 dcf53422b7edded3b7431fbae4a7ee3f C:\WINDOWS\$NtUninstallKB890859$\ntoskrnl.exe 2005-03-02 20:09 2180608 3f3612846d67352468d2286fc23fb0c2 C:\WINDOWS\$NtUninstallKB929338$\ntoskrnl.exe 2006-12-19 20:24 2181632 0de4e7f68803b29526ed89f6c0dd013c C:\WINDOWS\$NtUninstallKB931784$\ntoskrnl.exe 2007-02-28 18:04 2181632 c378be3a1edc5e4421d428655ac4a48c C:\WINDOWS\Driver Cache\i386\ntoskrnl.exe 2004-08-04 01:39 2182272 dcf53422b7edded3b7431fbae4a7ee3f C:\WINDOWS\ServicePackFiles\i386\ntoskrnl.exe 2007-02-28 18:04 2181632 c378be3a1edc5e4421d428655ac4a48c C:\WINDOWS\system32\ntoskrnl.exe 2007-02-28 18:04 2181632 c378be3a1edc5e4421d428655ac4a48c C:\WINDOWS\system32\dllcache\ntoskrnl.exe 2007-06-13 15:23 976896 e74ef52c79f3347a0b105b0b92bfed38 C:\WINDOWS\explorer.exe 2007-06-13 15:12 1034752 8db0650b211425b9cdb7d1c4a8f6b482 C:\WINDOWS\$hf_mig$\KB938828\SP2QFE\explorer.exe 2002-09-23 14:00 1005568 f4af85d918e83d71341fce2aa5318181 C:\WINDOWS\$NtServicePackUninstall$\explorer.exe 2004-08-04 01:44 1033728 379098a96e6c165b659de7e4328010ea C:\WINDOWS\$NtUninstallKB938828$\explorer.exe 2007-06-13 15:23 976896 e74ef52c79f3347a0b105b0b92bfed38 C:\WINDOWS\ServicePackFiles\i386\explorer.exe 2007-06-13 15:23 1034752 029a562e81bbee088c61d418bf408f44 C:\WINDOWS\system32\dllcache\explorer.exe 2002-09-23 14:00 101888 bf4cbefdce42a699389791647cb95ca2 C:\WINDOWS\$NtServicePackUninstall$\services.exe 2004-08-04 01:44 108544 3da8d964d2cc12ef8e8c342471a37917 C:\WINDOWS\ServicePackFiles\i386\services.exe 2004-08-04 01:44 108544 3da8d964d2cc12ef8e8c342471a37917 C:\WINDOWS\system32\services.exe 2002-09-23 14:00 11776 fa2c871f57352339f0a1802bb9aea6e7 C:\WINDOWS\$NtServicePackUninstall$\lsass.exe 2004-08-04 01:44 13312 f485fefc8cc4fd29243d800be5d275d1 C:\WINDOWS\ServicePackFiles\i386\lsass.exe 2004-08-04 01:44 13312 f485fefc8cc4fd29243d800be5d275d1 C:\WINDOWS\system32\lsass.exe 2002-09-23 14:00 13312 0c4c012b0a8960f48a666c240a7baa3d C:\WINDOWS\$NtServicePackUninstall$\ctfmon.exe 2004-08-04 01:44 15360 cbfa30492d70ce3938d8a7783d0c0436 C:\WINDOWS\ServicePackFiles\i386\ctfmon.exe 2004-08-04 01:44 15360 cbfa30492d70ce3938d8a7783d0c0436 C:\WINDOWS\system32\ctfmon.exe 2005-06-11 02:17 57856 ad3d9d191aea7b5445fe1d82ffbb4788 C:\WINDOWS\$hf_mig$\KB896423\SP2QFE\spoolsv.exe 2002-09-23 14:00 51200 414af353e9eeed8637d90370fd0c3b68 C:\WINDOWS\$NtServicePackUninstall$\spoolsv.exe 2004-08-04 01:44 57856 bebe8a85954ff460374fd5a0cd21e19b C:\WINDOWS\$NtUninstallKB896423$\spoolsv.exe 2004-08-04 01:44 57856 bebe8a85954ff460374fd5a0cd21e19b C:\WINDOWS\ServicePackFiles\i386\spoolsv.exe 2005-06-11 01:53 57856 da81ec57acd4cdc3d4c51cf3d409af9f C:\WINDOWS\system32\spoolsv.exe 2007-07-30 19:19 68440 84d9a61860272d6177d46c86b8431557 C:\WINDOWS\ServicePackFiles\i386\wuauclt.exe 2007-07-30 19:19 68440 84d9a61860272d6177d46c86b8431557 C:\WINDOWS\system32\wuauclt.exe 2007-07-30 19:19 53080 f3e9065eb617a7e3a832a7976bfa021b C:\WINDOWS\system32\dllcache\wuauclt.exe 2002-09-23 14:00 22528 323d3ffcbf99c59b2d20b4c5a7ece347 C:\WINDOWS\$NtServicePackUninstall$\userinit.exe 2004-08-04 01:44 25088 bd768099b4c44aa631728cb74eb54396 C:\WINDOWS\ServicePackFiles\i386\userinit.exe 2004-08-04 01:44 25088 bd768099b4c44aa631728cb74eb54396 C:\WINDOWS\system32\userinit.exe . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SpyEmergency"="C:\Program Files\NETGATE\Spy Emergency 2008\SpyEmergency.exe" [2008-03-31 11:13 2071096] "BitComet"="C:\Program Files\BitComet\BitComet.exe" [2008-06-03 05:42 2596152] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 01:44 15360] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-08-04 01:44 15360] C:\Documents and Settings\KRZYSIEK\Menu Start\Programy\Autostart\ Adobe Gamma.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-03-16 19:16:00 113664] avast! Antivirus.lnk - C:\Program Files\Alwil Software\Avast4\ashAvast.exe [2008-08-11 12:37:55 270520] RocketDock.lnk - C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe [2007-03-19 00:05:02 630784] Skype.lnk - C:\Program Files\Skype\Phone\Skype.exe [2006-04-20 20:36:53 25366056] C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\ Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 10:01:04 83360] [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "C:\\Program Files\\Gadu-Gadu\\gg.exe"= "C:\\WINDOWS\\system32\\sessmgr.exe"= "C:\\Program Files\\JetAudio\\JcServer.exe"= "C:\\Program Files\\BearShare\\BearShare.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "C:\\Program Files\\Skype\\Phone\\Skype.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "11340:TCP"= 11340:TCP:BitComet 11340 TCP "11340:UDP"= 11340:UDP:BitComet 11340 UDP R0 viasraid;viasraid;C:\WINDOWS\system32\drivers\viasraid.sys [2003-09-05 12:25] R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-07-19 16:35] R1 SpyEmrg;Spy Emergency Driver;C:\WINDOWS\system32\Drivers\spyemrg.sys [2008-02-05 12:10] R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-07-19 16:37] R3 GETNDIS;VIA Networking Velocity Family Giga-bit Ethernet Adapter Driver;C:\WINDOWS\system32\DRIVERS\getnd5b.sys [2003-09-02 12:22] R3 SpyEmrgGuard;Spy Emergency Real-Time Shield Driver;C:\WINDOWS\system32\Drivers\spyemrg_guard.sys [2008-02-05 12:10] S3 SER120;OTI Serial port driver;C:\WINDOWS\system32\DRIVERS\SER120.sys [2005-03-22 11:03] . - - - - ORPHANS REMOVED - - - - HKLM-Run-BM931523cc - C:\WINDOWS\system32\grbtebeu.dll . ------- Supplementary Scan ------- . FireFox -: Profile - C:\Documents and Settings\KRZYSIEK\Dane aplikacji\Mozilla\Firefox\Profiles\liztb2e6.default\ FireFox -: prefs.js - SEARCH.DEFAULTURL - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q= FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://en-us.start.mozilla.com/firefox?client=firefox-a&rls=org.mozilla:en-US:official ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-08-17 18:04:48 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . ------------------------ Other Running Processes ------------------------ . C:\WINDOWS\system32\ati2evxx.exe C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe C:\Program Files\NETGATE\Spy Emergency 2008\SpyEmergencySrv.exe C:\WINDOWS\system32\ati2evxx.exe C:\WINDOWS\system32\WgaTray.exe C:\WINDOWS\system32\wdfmgr.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe . ************************************************************************** . Completion time: 2008-08-17 18:10:18 - machine was rebooted ComboFix-quarantined-files.txt 2008-08-17 16:10:11 Pre-Run: 8,675,729,408 bajtów wolnych Post-Run: 10,031,636,480 bajt˘w wolnych 347 --- E O F --- 2008-07-09 14:12:31

Daje jeszcze najnowszy z HiJackThisa

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 18:14:33, on 2008-08-17 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16674) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\System32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\WgaTray.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\WINDOWS\system32\ctfmon.exe C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe C:\WINDOWS\explorer.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\WINDOWS\system32\NOTEPAD.EXE C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.pl/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza R3 - URLSearchHook: (no name) - {D3DEE18F-DB64-4BEB-9FF1-E1F0A5033E4A} - (no file) O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.2.2.28.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar4.dll O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.0.1225.9868\swg.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar4.dll O4 - HKCU\..\Run: [SpyEmergency] "C:\Program Files\NETGATE\Spy Emergency 2008\SpyEmergency.exe" O4 - HKCU\..\Run: [BitComet] "C:\Program Files\BitComet\BitComet.exe" /tray O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user') O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Startup: avast! Antivirus.lnk = C:\Program Files\Alwil Software\Avast4\ashAvast.exe O4 - Startup: RocketDock.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe O4 - Startup: Skype.lnk = C:\Program Files\Skype\Phone\Skype.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://C:\Program Files\BitComet\tools\BitCometBHO_1.2.2.28.dll/206 (file missing) O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {3BFFE033-BF43-11D5-A271-00A024A51325} (iNotes6 Class) - https://195.136.103.251/iNotes6W.cab O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1098114699649 O16 - DPF: {92ECE6FA-AC2E-4042-BFAE-0C8608E52A43} (SignActivX Control) - https://www.bph.pl/pi/components/SignActivX.cab O16 - DPF: {BFA1F11D-3121-AFE1-4112-894323212DAC} (GameDesire Word Games) - http://67.15.101.3/g_bin/pl/words_2_0_0_49.cab O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C1} (GameDesire Pool 8) - http://67.15.101.3/g_bin/pl/billard8_2_0_0_24.cab O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: Spy Emergency Engine Service (SpyEmrgSrv) - NETGATE Technologies s.r.o. - C:\Program Files\NETGATE\Spy Emergency 2008\SpyEmergencySrv.exe -- End of file - 7048 bytes

**Posty:** 84 · przez **gloni** 17 Sie 2008, 19:37

aaa przeskanuj tym programem http://info.prevx.com/downloadcsi.asp - i napisz czy coś znalazło bo niepokoim mie SREMCON.EXE
a potem :
możesz jeszcze stosotwac ten program co jakiś czas : http://download.grisoft.cz/softw/70free/setup/avgas-setup-7.5.1.43-3339.exe

i wykonaj by Mario :
1. Ściągnij OTMoveIt i go włacz i odpal go z opcji CleanUp

2. wykonaj optymalizację windowsa
3.sciagnij ATF_Cleaner
zaznacz
Windows Temp
All users Temp
Temporary internet files
Recycle Bin
i wcisnij EMPTY SELECTED
4.Wyłącz przywracanie systemu ( właściwości mój komputer-zakładka przywracanie - wyłącz przywracanie na wszystkich dyskach). Po chwili włącz je z powrotem