Niestabilność systemu

**Posty:** 69 · przez **Fingfolin** 30 Wrz 2008, 21:33

Komputer przestaje chwilami reagowac na polecenia. Bardzo proszę o sprawdzenie logów.

Kod: Zaznacz wszystko: ComboFix 08-09-28.05 - Olwe 2008-09-30 19:59:38.1 - NTFSx86 Running from: D:\Documents and Settings\Olwe\Desktop\ComboFix.exe [color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color] . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . . ---- Previous Run ------- . C:\Autorun.inf D:\autorun.inf D:\WINDOWS\mdm.exe D:\WINDOWS\svchost.exe D:\WINDOWS\svchost.ini D:\WINDOWS\system32\sysproc64 D:\WINDOWS\system32\sysproc64\sysproc32.sys D:\WINDOWS\system32\sysproc64\sysproc86.sys E:\Autorun.inf . ((((((((((((((((((((((((( Files Created from 2008-08-28 to 2008-09-30 ))))))))))))))))))))))))))))))) . 2008-09-27 10:19 . 2008-09-27 10:19 <DIR> d-------- D:\Documents and Settings\Olwe\Application Data\Ubisoft 2008-09-27 09:48 . 2008-09-27 09:48 <DIR> d-------- D:\Documents and Settings\All Users\Application Data\Ubisoft 2008-09-27 09:45 . 2008-09-27 09:45 <DIR> d-------- D:\temp\ext47680 2008-09-27 09:45 . 2008-09-27 09:45 <DIR> d-------- D:\temp 2008-09-27 09:45 . 2001-12-05 11:00 65,536 --a------ D:\WINDOWS\system32\WMErrPLK.dll 2008-09-27 09:45 . 2001-12-05 11:00 36,946 --a------ D:\WINDOWS\WMPrfPLK.prx 2008-09-26 15:31 . 2008-09-26 15:31 <DIR> d-------- D:\Program Files\Common Files\Ahead 2008-09-26 15:31 . 2008-09-26 15:31 <DIR> d-------- D:\Program Files\Ahead 2008-09-26 15:31 . 2004-07-26 17:16 1,568,768 --------- D:\WINDOWS\system32\ImagX7.dll 2008-09-26 15:31 . 2004-07-26 17:16 476,320 --------- D:\WINDOWS\system32\ImagXpr7.dll 2008-09-26 15:31 . 2004-07-26 17:16 471,040 --------- D:\WINDOWS\system32\ImagXRA7.dll 2008-09-26 15:31 . 2004-07-26 17:16 262,144 --------- D:\WINDOWS\system32\ImagXR7.dll 2008-09-26 15:31 . 2001-07-09 11:50 155,648 --a------ D:\WINDOWS\system32\NeroCheck.exe 2008-09-26 15:31 . 2004-03-02 17:37 125,184 --------- D:\WINDOWS\system32\drivers\imagesrv.sys 2008-09-26 15:31 . 2000-06-26 11:45 106,496 --a------ D:\WINDOWS\system32\TwnLib20.dll 2008-09-26 15:31 . 2004-03-02 17:37 5,504 --------- D:\WINDOWS\system32\drivers\imagedrv.sys 2008-09-26 15:05 . 2008-09-26 15:05 <DIR> d-------- D:\Documents and Settings\All Users\Application Data\DAEMON Tools Pro 2008-09-26 15:04 . 2008-09-26 15:09 <DIR> d-------- D:\Program Files\DAEMON Tools Pro 2008-09-25 18:50 . 2008-09-25 18:50 <DIR> d-------- D:\Program Files\ALLPlayer 2008-09-24 18:08 . 2008-09-24 18:08 <DIR> d-------- D:\Documents and Settings\Olwe\Application Data\Spore 2008-09-24 16:15 . 2008-09-24 16:15 <DIR> d-------- D:\Program Files\iPod 2008-09-24 16:15 . 2008-09-24 16:15 <DIR> d-------- D:\Program Files\Bonjour 2008-09-24 16:15 . 2008-09-24 16:16 <DIR> d-------- D:\Documents and Settings\All Users\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6} 2008-09-19 17:25 . 2008-09-19 17:25 <DIR> d-------- D:\Program Files\Common Files\Adobe AIR 2008-09-19 17:25 . 2008-09-19 17:25 <DIR> d-------- D:\Program Files\Adobe Media Player 2008-09-17 20:50 . 2008-09-17 20:50 <DIR> d-------- D:\Documents and Settings\All Users\Application Data\Last.fm 2008-09-17 20:49 . 2008-09-17 20:49 <DIR> d-------- D:\Program Files\Last.fm 2008-09-15 21:30 . 2008-09-18 19:57 4,096 --a------ D:\WINDOWS\system32\crash 2008-09-15 19:14 . 2008-09-15 19:14 <DIR> d-------- D:\Program Files\Reality Pump 2008-09-15 15:44 . 2007-05-16 16:45 3,497,832 --a------ D:\WINDOWS\system32\d3dx9_34.dll 2008-09-15 15:36 . 2008-09-15 15:36 <DIR> d-------- D:\Documents and Settings\Olwe\Application Data\gnupg 2008-09-14 13:50 . 2008-09-14 13:50 <DIR> d-------- D:\Program Files\AbiSuite2 2008-09-14 13:50 . 2008-09-14 13:50 <DIR> d-------- D:\Documents and Settings\Olwe\AbiSuite 2008-09-14 04:46 . 2008-09-30 20:00 <DIR> d--hs---- D:\WINDOWS\system32\twain_32 2008-09-14 04:46 . 2008-09-14 04:46 <DIR> d--hs---- D:\Documents and Settings\LocalService\Application Data\twain_32 2008-09-14 04:46 . 2008-09-30 17:00 37,566 --a------ D:\WINDOWS\system32\twain_32\local.ds 2008-09-14 04:46 . 2008-09-30 20:00 106 --------- D:\WINDOWS\system32\twain_32\user.ds.cla 2008-09-14 04:46 . 2008-09-30 20:00 100 --a------ D:\WINDOWS\system32\twain_32\user.ds 2008-09-12 20:30 . 2008-09-12 20:30 <DIR> d-------- D:\Program Files\Common Files\Adobe Systems Shared 2008-09-12 20:30 . 2008-09-12 20:30 <DIR> d-------- D:\Documents and Settings\All Users\Application Data\Macrovision 2008-09-11 18:09 . 2008-09-11 18:09 51,200 --a------ D:\Documents and Settings\Olwe\drvsyst.exe 2008-09-09 22:37 . 2008-09-09 22:37 <DIR> d-------- D:\Documents and Settings\Administrator.OLWE-69D8FA7C49.000 2008-09-09 18:17 . 2008-09-09 18:22 <DIR> d-------- D:\Program Files\SopCast 2008-09-09 17:16 . 2008-09-09 17:16 <DIR> d-------- D:\Documents and Settings\Administrator.OLWE-69D8FA7C49 2008-09-09 17:13 . 2008-09-24 16:16 <DIR> d-------- D:\Program Files\iTunes 2008-09-09 17:11 . 2008-09-09 17:12 <DIR> d---s---- D:\Documents and Settings\Administrator 2008-09-07 19:59 . 2008-09-09 17:13 <DIR> d-------- D:\Program Files\iTunes(2) 2008-09-07 19:59 . 2008-09-09 17:13 <DIR> d-------- D:\Program Files\iPod(2) 2008-09-06 15:09 . 2008-09-06 15:09 90,112 --a------ D:\WINDOWS\system32\QuickTimeVR.qtx 2008-09-06 15:09 . 2008-09-06 15:09 57,344 --a------ D:\WINDOWS\system32\QuickTime.qts 2008-09-04 17:35 . 2008-09-04 17:35 <DIR> d-------- D:\Documents and Settings\Olwe\Application Data\Media Player Classic 2008-09-04 17:34 . 2008-09-09 17:13 <DIR> d-------- D:\Program Files\Real Alternative 2008-08-31 23:08 . 2007-05-02 11:12 109,704 --a------ D:\WINDOWS\system32\drivers\ssm_mdm.sys 2008-08-31 23:08 . 2007-05-02 11:12 83,592 --a------ D:\WINDOWS\system32\drivers\ssm_bus.sys 2008-08-31 23:08 . 2007-05-02 11:12 15,112 --a------ D:\WINDOWS\system32\drivers\ssm_mdfl.sys 2008-08-31 23:08 . 2007-05-02 11:12 12,424 --a------ D:\WINDOWS\system32\drivers\ssm_whnt.sys 2008-08-31 23:08 . 2007-05-02 11:12 12,424 --a------ D:\WINDOWS\system32\drivers\ssm_wh.sys 2008-08-31 23:08 . 2007-05-02 11:12 12,424 --a------ D:\WINDOWS\system32\drivers\ssm_cmnt.sys 2008-08-31 23:08 . 2007-05-02 11:12 12,424 --a------ D:\WINDOWS\system32\drivers\ssm_cm.sys 2008-08-31 23:07 . 2008-08-31 23:08 <DIR> d-------- D:\WINDOWS\system32\Samsung_USB_Drivers 2008-08-31 23:07 . 2008-08-31 23:07 <DIR> d-------- D:\Program Files\Samsung 2008-08-31 23:07 . 2008-09-12 20:30 <DIR> d-------- D:\Program Files\Common Files\Adobe 2008-08-31 23:07 . 2005-08-28 20:51 766 --a------ D:\WINDOWS\system32\Uninstall.ico 2008-08-31 22:22 . 2008-08-31 22:22 <DIR> d-------- D:\Program Files\CM 03-04 2008-08-31 14:34 . 2008-08-31 14:34 262,144 --a------ D:\WINDOWS\system32\wrap_oal.dll 2008-08-31 14:34 . 2008-08-31 14:34 86,016 --a------ D:\WINDOWS\system32\OpenAL32.dll 2008-08-31 14:33 . 2008-08-31 14:33 <DIR> d-------- D:\WINDOWS\system32\Futuremark 2008-08-31 14:33 . 2004-10-25 20:02 21,664 --a------ D:\WINDOWS\system32\drivers\Entech.sys 2008-08-31 14:33 . 2008-08-31 14:33 7,680 --ahs---- D:\WINDOWS\Thumbs.db 2008-08-31 14:33 . 1999-11-02 10:01 6,173 --a------ D:\WINDOWS\system32\drivers\Entech.vxd 2008-08-31 14:33 . 2004-06-22 15:44 5,632 --a------ D:\WINDOWS\system32\drivers\Entech64.sys 2008-08-31 14:33 . 2001-11-19 19:05 3,972 --a------ D:\WINDOWS\system32\drivers\PciBus.sys 2008-08-31 14:32 . 2008-08-31 14:32 <DIR> d-------- D:\Program Files\Futuremark 2008-08-30 22:01 . 2008-08-30 22:01 <DIR> d-------- D:\Documents and Settings\Olwe\Application Data\ATI 2008-08-30 22:01 . 2008-08-30 22:01 <DIR> d-------- D:\Documents and Settings\All Users\Application Data\ATI 2008-08-30 15:25 . 2008-08-30 15:25 <DIR> d-------- D:\Program Files\Trend Micro 2008-08-30 15:14 . 2008-08-30 15:14 0 --a------ D:\WINDOWS\ativpsrm.bin 2008-08-30 15:11 . 2008-09-13 10:51 <DIR> d-------- D:\Program Files\ATI 2008-08-30 15:10 . 2008-08-30 15:10 <DIR> d-------- D:\Program Files\ATI Technologies 2008-08-30 15:10 . 2008-07-31 21:05 593,920 --------- D:\WINDOWS\system32\ati2sgag.exe 2008-08-30 14:35 . 2008-08-30 14:35 <DIR> d-------- D:\Program Files\The KMPlayer 2008-08-30 14:34 . 2008-08-31 14:33 <DIR> d-------- D:\Tapety 2008-08-30 14:23 . 2008-08-30 14:23 <DIR> d-------- D:\Documents and Settings\Olwe\Application Data\Gadu-Gadu 2008-08-30 14:12 . 2008-08-30 14:12 <DIR> d-------- D:\Program Files\Sun 2008-08-30 14:11 . 2008-06-10 02:32 73,728 --a------ D:\WINDOWS\system32\javacpl.cpl 2008-08-30 14:08 . 2008-09-12 21:09 <DIR> d-------- D:\Program Files\NAPI-PROJEKT 2008-08-30 14:08 . 2008-08-30 14:08 <DIR> d-------- D:\Program Files\Common Files\Java 2008-08-30 14:04 . 2008-08-30 14:23 <DIR> d-------- D:\Documents and Settings\Olwe\Gadu-Gadu 2008-08-30 13:31 . 2008-08-30 13:32 <DIR> d-------- D:\Program Files\Common Files\AVSMedia 2008-08-30 13:31 . 2008-08-30 13:31 <DIR> d-------- D:\Program Files\AVSMedia 2008-08-30 13:29 . 2008-09-27 00:23 <DIR> d-------- D:\Filmy 2008-08-30 12:52 . 2008-08-30 15:08 <DIR> d-------- D:\Program Files\FileSubmit 2008-08-30 12:48 . 2008-08-30 12:48 <DIR> d-------- D:\Program Files\TGTSoft 2008-08-30 12:36 . 2008-08-30 13:30 <DIR> d-------- D:\Program Files\RelevantKnowledge 2008-08-30 11:08 . 2008-08-30 13:33 <DIR> d-------- D:\Instalki 2008-08-30 11:07 . 2008-08-30 11:07 <DIR> d-------- D:\Program Files\Opera 2008-08-30 10:57 . 2008-08-30 10:57 <DIR> d-------- D:\Program Files\SAGEM 2008-08-30 10:42 . 2008-08-30 10:42 <DIR> d-------- D:\Program Files\NVIDIA Corporation 2008-08-30 10:41 . 2008-08-30 10:41 <DIR> d-------- D:\Documents and Settings\Olwe\Application Data\Apple Computer 2008-08-30 10:41 . 2006-10-05 16:35 356,352 --a------ D:\WINDOWS\system32\nvuide.exe 2008-08-30 10:41 . 2008-09-07 19:35 54,156 --ah----- D:\WINDOWS\QTFont.qfn 2008-08-30 10:41 . 2006-09-11 15:14 1,570 --a------ D:\WINDOWS\system32\nvide.nvu 2008-08-30 10:41 . 2008-08-30 10:41 1,409 --a------ D:\WINDOWS\QTFont.for 2008-08-30 10:40 . 2008-08-30 10:40 <DIR> d-------- D:\Documents and Settings\Olwe\Application Data\InstallShield 2008-08-30 10:40 . 2008-08-30 10:41 <DIR> d-------- D:\Documents and Settings\All Users\Application Data\Apple Computer 2008-08-30 10:40 . 2006-11-07 14:58 356,352 --a------ D:\WINDOWS\system32\nvunrm.exe 2008-08-30 10:40 . 2007-03-16 17:21 356,352 --a------ D:\WINDOWS\system32\NVUNINST.EXE 2008-08-30 10:40 . 2006-06-07 18:49 208,896 --a------ D:\WINDOWS\system32\nvusmb.exe 2008-08-30 10:40 . 2006-10-19 09:36 3,903 --a------ D:\WINDOWS\system32\nvnrm.nvu 2008-08-30 10:40 . 2006-06-01 14:32 1,864 --a------ D:\WINDOWS\system32\nvsmb.nvu 2008-08-30 10:40 . 2006-10-05 13:07 1,428 --a------ D:\WINDOWS\system32\drivers\nvphy.bin 2008-08-30 10:39 . 2008-09-24 16:16 <DIR> d----c--- D:\WINDOWS\system32\DRVSTORE 2008-08-30 10:39 . 2008-09-24 16:14 <DIR> d-------- D:\Program Files\Common Files\Apple 2008-08-30 10:39 . 2008-08-30 14:47 <DIR> d-------- D:\Program Files\Apple Software Update 2008-08-30 10:39 . 2008-08-30 10:39 <DIR> d-------- D:\Documents and Settings\All Users\Application Data\Apple 2008-08-29 17:24 . 2008-08-29 17:24 <DIR> d---s---- D:\Program Files\Xfire 2008-08-29 17:24 . 2008-08-29 17:24 <DIR> d-------- D:\Documents and Settings\Olwe\Application Data\Xfire 2008-08-29 17:12 . 2008-08-29 17:12 271,360 --a------ D:\WINDOWS\system32\drivers\atksgt.sys 2008-08-29 17:12 . 2008-08-29 17:12 18,048 --a------ D:\WINDOWS\system32\drivers\lirsgt.sys 2008-08-29 10:22 . 2008-08-29 10:22 <DIR> d-------- D:\Documents and Settings\Olwe\Application Data\DivX 2008-08-29 10:18 . 2008-08-29 10:18 87,336 --a------ D:\WINDOWS\system32\dns-sd.exe 2008-08-29 09:53 . 2008-08-29 09:53 61,440 --a------ D:\WINDOWS\system32\dnssd.dll 2008-08-29 09:14 . 2008-08-29 09:14 <DIR> d-------- D:\WINDOWS\system32\custom matrices 2008-08-29 09:13 . 2008-08-29 09:14 <DIR> d-------- D:\WINDOWS\system32\C2MP 2008-08-28 16:46 . 2008-08-28 16:46 <DIR> dr-h----- D:\Documents and Settings\Olwe\Application Data\SecuROM . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-09-29 15:16 --------- d-----w D:\Program Files\AIMP2 2008-09-27 07:34 --------- d--h--w D:\Program Files\InstallShield Installation Information 2008-09-24 14:15 --------- d-----w D:\Program Files\QuickTime 2008-08-31 12:33 --------- d-----w D:\Program Files\Baldur's Gate 2 2008-08-31 07:54 --------- d-----w D:\Program Files\Gadu-Gadu 2008-08-30 13:10 --------- d-----w D:\Program Files\Common Files\InstallShield 2008-08-30 13:07 --------- d-----w D:\Program Files\Java 2008-08-30 12:08 73,216 ----a-w D:\WINDOWS\ST6UNST.EXE 2008-08-30 12:08 286,720 ------w D:\WINDOWS\Setup1.exe 2008-08-28 13:50 --------- d-----w D:\Documents and Settings\Olwe\Application Data\Sports Interactive . ((((((((((((((((((((((((((((( snapshot_2008-09-30_17.57.38.39 ))))))))))))))))))))))))))))))))))))))))) . + 2004-08-04 12:00:00 242,688 ----a-r D:\WINDOWS\system32\twext.exe + 2008-09-30 17:59:42 16,384 ----a-w D:\WINDOWS\Temp\Cookies\index.dat + 2008-09-30 17:59:42 16,384 ----a-w D:\WINDOWS\Temp\Historia\History.IE5\index.dat + 2008-09-30 17:59:42 32,768 ----a-w D:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\index.dat . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="D:\WINDOWS\system32\ctfmon.exe" [2004-08-04 15360] "STYLEXP"="D:\Program Files\TGTSoft\StyleXP\StyleXP.exe" [2006-05-24 1372160] "Gadu-Gadu"="D:\Program Files\Gadu-Gadu\gg.exe" [2007-07-09 2119104] "DAEMON Tools Pro Agent"="D:\Program Files\DAEMON Tools Pro\DTProAgent.exe" [2007-09-06 136136] "MSMSGS"="D:\Program Files\Messenger\msmsgs.exe" [2004-08-04 1667584] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SunJavaUpdateSched"="D:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784] "StartCCC"="D:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-07-16 61440] "QuickTime Task"="D:\Program Files\QuickTime\qttask.exe" [2008-09-06 413696] "iTunesHelper"="D:\Program Files\iTunes\iTunesHelper.exe" [2008-09-10 289576] "NeroFilterCheck"="D:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 155648] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="D:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 15360] D:\Documents and Settings\All Users\Start Menu\Programs\Startup\ Adobe Gamma Loader.lnk - D:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2008-09-12 113664] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon] "Userinit"="D:\\WINDOWS\\system32\\userinit.exe,D:\\WINDOWS\\system32\\twext.exe," "UIHost"="D:\\Program Files\\TGTSoft\\StyleXP\\Logon\\CurrentLogon.EXE" [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "vidc.iv32"= ir32.dll "msacm.ac3filter"= ac3filter.acm "vidc.hfyu"= huffyuv.dll "vidc.IV45"= Ir41_qc.dll "msacm.divxa32"= DivXa32.acm "msacm.l3codec"= l3codecp.acm [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "E:\\Program Files\\Sports Interactive\\Football Manager 2008\\fm.exe"= "D:\\Program Files\\Gadu-Gadu\\gg.exe"= "E:\\Program Files\\KONAMI\\Pro Evolution Soccer 2008\\PES2008.exe"= "E:\\Pulpit\\PES2008.exe"= "D:\\Program Files\\SopCast\\adv\\SopAdver.exe"= "D:\\Program Files\\SopCast\\SopCast.exe"= "d:\\program files\\relevantknowledge\\rlvknlg.exe"= "E:\\AITD\\Alone.exe"= "D:\\Program Files\\Bonjour\\mDNSResponder.exe"= "D:\\Program Files\\iTunes\\iTunes.exe"= "E:\\Assassin's Creed\\AssassinsCreed_Dx9.exe"= "E:\\Assassin's Creed\\AssassinsCreed_Dx10.exe"= "E:\\Assassin's Creed\\AssassinsCreed_Launcher.exe"= [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{1ad3fbb9-0882-11dd-86f4-00044b0707aa}] \Shell\AutoRun\command - J:\RavMon.exe \Shell\explore\Command - J:\RavMon.exe -e \Shell\open\Command - J:\RavMon.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{48818d70-0e2d-11dd-86fe-00044b0707aa}] \Shell\AutoRun\command - H:\RavMon.exe \Shell\explore\Command - H:\RavMon.exe -e \Shell\open\Command - H:\RavMon.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{4f6e3830-0cb6-11dd-86fb-00044b0707aa}] \shell\AutoRun\command - J:\RavMon.exe \shell\explore\Command - J:\RavMon.exe -e \shell\open\Command - J:\RavMon.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{875dcb3c-7599-11dd-980c-9e77f978cd3b}] \Shell\AutoRun\command - K:\RavMon.exe \Shell\explore\Command - K:\RavMon.exe -e \Shell\open\Command - K:\RavMon.exe *Newly Created Service* - CATCHME . Contents of the 'Scheduled Tasks' folder . . ------- Supplementary Scan ------- . R1 -: HKCU-Internet Settings,ProxyOverride = *.local . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-09-30 20:00:48 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2008-09-30 20:01:16 ComboFix-quarantined-files.txt 2008-09-30 18:01:10 ComboFix.txt 2008-08-30 13:39:20 Pre-Run: 7,050,764,288 bytes free Post-Run: 7,039,275,008 bajtów wolnych 256

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 21:33:12, on 2008-09-30 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: D:\WINDOWS\system32\winlogon.exe D:\WINDOWS\system32\services.exe D:\WINDOWS\system32\lsass.exe D:\WINDOWS\system32\Ati2evxx.exe D:\WINDOWS\system32\svchost.exe D:\WINDOWS\System32\svchost.exe D:\Program Files\TGTSoft\StyleXP\StyleXPService.exe D:\WINDOWS\system32\Ati2evxx.exe D:\WINDOWS\system32\spoolsv.exe D:\Program Files\Java\jre1.6.0_07\bin\jusched.exe D:\Program Files\iTunes\iTunesHelper.exe D:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe D:\WINDOWS\system32\ctfmon.exe D:\Program Files\DAEMON Tools Pro\DTProAgent.exe D:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe D:\Program Files\Bonjour\mDNSResponder.exe D:\Program Files\NVIDIA Corporation\nTune\nTuneService.exe D:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe D:\Program Files\iPod\bin\iPodService.exe D:\Program Files\iTunes\iTunes.exe D:\Program Files\Last.fm\LastFM.exe D:\Program Files\Opera\opera.exe D:\WINDOWS\explorer.exe D:\WINDOWS\system32\notepad.exe D:\Program Files\Trend Micro\HijackThis\HijackThis.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local F2 - REG:system.ini: UserInit=D:\WINDOWS\system32\userinit.exe,D:\WINDOWS\system32\twext.exe, O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - D:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O4 - HKLM\..\Run: [SunJavaUpdateSched] "D:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" O4 - HKLM\..\Run: [StartCCC] "D:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun O4 - HKLM\..\Run: [QuickTime Task] "D:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "D:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [NeroFilterCheck] D:\WINDOWS\system32\NeroCheck.exe O4 - HKCU\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [STYLEXP] D:\Program Files\TGTSoft\StyleXP\StyleXP.exe -Hide O4 - HKCU\..\Run: [Gadu-Gadu] "D:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - HKCU\..\Run: [DAEMON Tools Pro Agent] "D:\Program Files\DAEMON Tools Pro\DTProAgent.exe" O4 - HKCU\..\Run: [MSMSGS] "D:\Program Files\Messenger\msmsgs.exe" /background O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Startup: iTunes.lnk = ? O4 - Global Startup: Adobe Gamma Loader.lnk = D:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe O23 - Service: Adobe LM Service - Unknown owner - D:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: Apple Mobile Device - Apple Inc. - D:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - D:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - D:\WINDOWS\system32\ati2sgag.exe O23 - Service: Bonjour Service - Apple Inc. - D:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: Usługa iPod (iPod Service) - Apple Inc. - D:\Program Files\iPod\bin\iPodService.exe O23 - Service: nTune Service (nTuneService) - NVIDIA - D:\Program Files\NVIDIA Corporation\nTune\nTuneService.exe O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - D:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe O23 - Service: StyleXPService - Unknown owner - D:\Program Files\TGTSoft\StyleXP\StyleXPService.exe -- End of file - 4839 bytes

**Posty:** 18165 · przez **wojtas** 01 Paź 2008, 19:06

skasuj ten wpis:

Kod: Zaznacz wszystko: F2 - REG:system.ini: UserInit=D:\WINDOWS\system32\userinit.exe,D:\WINDOWS\system32\twext.exe,

Otworz notatnik i wklej w nim to:

File::
D:\WINDOWS\system32\twext.exe

Folder::
D:\temp\
D:\Program Files\RelevantKnowledge

Registry::
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{1ad3fbb9-0882-11dd-86f4-00044b0707aa}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{48818d70-0e2d-11dd-86fe-00044b0707aa}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{4f6e3830-0cb6-11dd-86fb-00044b0707aa}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{875dcb3c-7599-11dd-980c-9e77f978cd3b}]

DirLook::
D:\Documents and Settings\All Users\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}

>>Plik>>Zapisz jako... >>> CFScript
Przeciągnij i upuść plik CFScript.txt na plik ComboFix.exe
-->

Ma się rozpocząć usuwanie. (i powstanie log).Daj ten log, który powstanie w trakcie usuwania.

**Posty:** 69 · przez **Fingfolin** 01 Paź 2008, 22:12

Kod: Zaznacz wszystko: ComboFix 08-09-28.05 - Olwe 2008-10-01 20:53:17.2 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1033.18.1603 [GMT 2:00] Running from: D:\Documents and Settings\Olwe\Desktop\ComboFix.exe Command switches used :: D:\Documents and Settings\Olwe\Desktop\cfscript.txt * Created a new restore point [color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color] FILE :: D:\WINDOWS\system32\twext.exe . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . D:\Program Files\RelevantKnowledge D:\Program Files\RelevantKnowledge\rk.bin D:\Program Files\RelevantKnowledge\rlls.dll D:\Program Files\RelevantKnowledge\rloci.bin D:\Program Files\RelevantKnowledge\rlservice.exe D:\Program Files\RelevantKnowledge\rlvknlg.exe D:\Program Files\RelevantKnowledge\sporder.dll D:\temp\ D:\temp\\ext47680\update\update.exe . ((((((((((((((((((((((((( Files Created from 2008-09-01 to 2008-10-01 ))))))))))))))))))))))))))))))) . 2008-10-01 17:51 . 2008-10-01 17:53 <DIR> d-------- D:\Crysis WARHEAD 2008-10-01 17:45 . 2008-10-01 17:47 <DIR> d-------- D:\World of Warcraft 2008-09-27 10:19 . 2008-09-27 10:19 <DIR> d-------- D:\Documents and Settings\Olwe\Application Data\Ubisoft 2008-09-27 09:48 . 2008-09-27 09:48 <DIR> d-------- D:\Documents and Settings\All Users\Application Data\Ubisoft 2008-09-27 09:45 . 2001-12-05 11:00 65,536 --a------ D:\WINDOWS\system32\WMErrPLK.dll 2008-09-27 09:45 . 2001-12-05 11:00 36,946 --a------ D:\WINDOWS\WMPrfPLK.prx 2008-09-26 15:31 . 2008-09-26 15:31 <DIR> d-------- D:\Program Files\Common Files\Ahead 2008-09-26 15:31 . 2008-09-26 15:31 <DIR> d-------- D:\Program Files\Ahead 2008-09-26 15:31 . 2004-07-26 17:16 1,568,768 --------- D:\WINDOWS\system32\ImagX7.dll 2008-09-26 15:31 . 2004-07-26 17:16 476,320 --------- D:\WINDOWS\system32\ImagXpr7.dll 2008-09-26 15:31 . 2004-07-26 17:16 471,040 --------- D:\WINDOWS\system32\ImagXRA7.dll 2008-09-26 15:31 . 2004-07-26 17:16 262,144 --------- D:\WINDOWS\system32\ImagXR7.dll 2008-09-26 15:31 . 2001-07-09 11:50 155,648 --a------ D:\WINDOWS\system32\NeroCheck.exe 2008-09-26 15:31 . 2004-03-02 17:37 125,184 --------- D:\WINDOWS\system32\drivers\imagesrv.sys 2008-09-26 15:31 . 2000-06-26 11:45 106,496 --a------ D:\WINDOWS\system32\TwnLib20.dll 2008-09-26 15:31 . 2004-03-02 17:37 5,504 --------- D:\WINDOWS\system32\drivers\imagedrv.sys 2008-09-26 15:05 . 2008-09-26 15:05 <DIR> d-------- D:\Documents and Settings\All Users\Application Data\DAEMON Tools Pro 2008-09-26 15:04 . 2008-09-26 15:09 <DIR> d-------- D:\Program Files\DAEMON Tools Pro 2008-09-25 18:50 . 2008-09-25 18:50 <DIR> d-------- D:\Program Files\ALLPlayer 2008-09-24 18:08 . 2008-09-24 18:08 <DIR> d-------- D:\Documents and Settings\Olwe\Application Data\Spore 2008-09-24 16:15 . 2008-09-24 16:15 <DIR> d-------- D:\Program Files\iPod 2008-09-24 16:15 . 2008-09-24 16:15 <DIR> d-------- D:\Program Files\Bonjour 2008-09-24 16:15 . 2008-09-24 16:16 <DIR> d-------- D:\Documents and Settings\All Users\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6} 2008-09-19 17:25 . 2008-09-19 17:25 <DIR> d-------- D:\Program Files\Common Files\Adobe AIR 2008-09-19 17:25 . 2008-09-19 17:25 <DIR> d-------- D:\Program Files\Adobe Media Player 2008-09-17 20:50 . 2008-09-17 20:50 <DIR> d-------- D:\Documents and Settings\All Users\Application Data\Last.fm 2008-09-17 20:49 . 2008-09-17 20:49 <DIR> d-------- D:\Program Files\Last.fm 2008-09-15 21:30 . 2008-09-18 19:57 4,096 --a------ D:\WINDOWS\system32\crash 2008-09-15 19:14 . 2008-09-15 19:14 <DIR> d-------- D:\Program Files\Reality Pump 2008-09-15 15:44 . 2007-05-16 16:45 3,497,832 --a------ D:\WINDOWS\system32\d3dx9_34.dll 2008-09-15 15:36 . 2008-09-15 15:36 <DIR> d-------- D:\Documents and Settings\Olwe\Application Data\gnupg 2008-09-14 13:50 . 2008-09-14 13:50 <DIR> d-------- D:\Program Files\AbiSuite2 2008-09-14 13:50 . 2008-09-14 13:50 <DIR> d-------- D:\Documents and Settings\Olwe\AbiSuite 2008-09-14 04:46 . 2008-09-14 04:46 <DIR> d--hs---- D:\Documents and Settings\LocalService\Application Data\twain_32 2008-09-12 20:30 . 2008-09-12 20:30 <DIR> d-------- D:\Program Files\Common Files\Adobe Systems Shared 2008-09-12 20:30 . 2008-09-12 20:30 <DIR> d-------- D:\Documents and Settings\All Users\Application Data\Macrovision 2008-09-11 18:09 . 2008-09-11 18:09 51,200 --a------ D:\Documents and Settings\Olwe\drvsyst.exe 2008-09-09 22:37 . 2008-09-09 22:37 <DIR> d-------- D:\Documents and Settings\Administrator.OLWE-69D8FA7C49.000 2008-09-09 18:17 . 2008-09-09 18:22 <DIR> d-------- D:\Program Files\SopCast 2008-09-09 17:16 . 2008-09-09 17:16 <DIR> d-------- D:\Documents and Settings\Administrator.OLWE-69D8FA7C49 2008-09-09 17:13 . 2008-09-24 16:16 <DIR> d-------- D:\Program Files\iTunes 2008-09-09 17:11 . 2008-09-09 17:12 <DIR> d---s---- D:\Documents and Settings\Administrator 2008-09-07 19:59 . 2008-09-09 17:13 <DIR> d-------- D:\Program Files\iTunes(2) 2008-09-07 19:59 . 2008-09-09 17:13 <DIR> d-------- D:\Program Files\iPod(2) 2008-09-06 15:09 . 2008-09-06 15:09 90,112 --a------ D:\WINDOWS\system32\QuickTimeVR.qtx 2008-09-06 15:09 . 2008-09-06 15:09 57,344 --a------ D:\WINDOWS\system32\QuickTime.qts 2008-09-04 17:35 . 2008-09-04 17:35 <DIR> d-------- D:\Documents and Settings\Olwe\Application Data\Media Player Classic 2008-09-04 17:34 . 2008-09-09 17:13 <DIR> d-------- D:\Program Files\Real Alternative . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-09-29 15:16 --------- d-----w D:\Program Files\AIMP2 2008-09-27 07:34 --------- d--h--w D:\Program Files\InstallShield Installation Information 2008-09-24 14:15 --------- d-----w D:\Program Files\QuickTime 2008-09-24 14:14 --------- d-----w D:\Program Files\Common Files\Apple 2008-09-15 13:44 107,888 ----a-w D:\WINDOWS\system32\CmdLineExt.dll 2008-09-13 08:51 --------- d-----w D:\Program Files\ATI 2008-09-12 19:09 --------- d-----w D:\Program Files\NAPI-PROJEKT 2008-09-12 18:30 --------- d-----w D:\Program Files\Common Files\Adobe 2008-08-31 21:07 --------- d-----w D:\Program Files\Samsung 2008-08-31 20:22 --------- d-----w D:\Program Files\CM 03-04 2008-08-31 12:34 86,016 ----a-w D:\WINDOWS\system32\OpenAL32.dll 2008-08-31 12:34 262,144 ----a-w D:\WINDOWS\system32\wrap_oal.dll 2008-08-31 12:32 --------- d-----w D:\Program Files\Futuremark 2008-08-31 07:54 --------- d-----w D:\Program Files\Gadu-Gadu 2008-08-30 20:01 --------- d-----w D:\Documents and Settings\Olwe\Application Data\ATI 2008-08-30 20:01 --------- d-----w D:\Documents and Settings\All Users\Application Data\ATI 2008-08-30 13:25 --------- d-----w D:\Program Files\Trend Micro 2008-08-30 13:10 --------- d-----w D:\Program Files\Common Files\InstallShield 2008-08-30 13:10 --------- d-----w D:\Program Files\ATI Technologies 2008-08-30 13:08 --------- d-----w D:\Program Files\FileSubmit 2008-08-30 13:07 --------- d-----w D:\Program Files\Java 2008-08-30 12:47 --------- d-----w D:\Program Files\Apple Software Update 2008-08-30 12:35 --------- d-----w D:\Program Files\The KMPlayer 2008-08-30 12:23 --------- d-----w D:\Documents and Settings\Olwe\Application Data\Gadu-Gadu 2008-08-30 12:12 --------- d-----w D:\Program Files\Sun 2008-08-30 12:08 73,216 ----a-w D:\WINDOWS\ST6UNST.EXE 2008-08-30 12:08 286,720 ------w D:\WINDOWS\Setup1.exe 2008-08-30 12:08 --------- d-----w D:\Program Files\Common Files\Java 2008-08-30 11:32 --------- d-----w D:\Program Files\Common Files\AVSMedia 2008-08-30 11:31 --------- d-----w D:\Program Files\AVSMedia 2008-08-30 10:48 --------- d-----w D:\Program Files\TGTSoft 2008-08-30 09:07 --------- d-----w D:\Program Files\Opera 2008-08-30 08:57 --------- d-----w D:\Program Files\SAGEM 2008-08-30 08:42 --------- d-----w D:\Program Files\NVIDIA Corporation 2008-08-30 08:41 --------- d-----w D:\Documents and Settings\Olwe\Application Data\Apple Computer 2008-08-30 08:41 --------- d-----w D:\Documents and Settings\All Users\Application Data\Apple Computer 2008-08-30 08:40 --------- d-----w D:\Documents and Settings\Olwe\Application Data\InstallShield 2008-08-30 08:39 --------- d-----w D:\Documents and Settings\All Users\Application Data\Apple 2008-08-29 15:24 --------- d-s---w D:\Program Files\Xfire 2008-08-29 15:24 --------- d-----w D:\Documents and Settings\Olwe\Application Data\Xfire 2008-08-29 15:12 271,360 ----a-w D:\WINDOWS\system32\drivers\atksgt.sys 2008-08-29 15:12 18,048 ----a-w D:\WINDOWS\system32\drivers\lirsgt.sys 2008-08-29 08:22 --------- d-----w D:\Documents and Settings\Olwe\Application Data\DivX 2008-08-29 08:18 87,336 ----a-w D:\WINDOWS\system32\dns-sd.exe 2008-08-29 07:53 61,440 ----a-w D:\WINDOWS\system32\dnssd.dll 2008-08-28 14:46 --------- d--h--r D:\Documents and Settings\Olwe\Application Data\SecuROM 2008-08-28 14:45 --------- d--h--w D:\Program Files\Zero G Registry 2008-08-28 13:50 --------- d-----w D:\Documents and Settings\Olwe\Application Data\Sports Interactive 2008-08-15 20:02 --------- d-----w D:\Program Files\Little Fighter 2.5 - v2.0 2008-08-01 06:38 3,266,560 ----a-w D:\WINDOWS\system32\drivers\ati2mtag.sys 2008-08-01 05:40 9,928,704 ----a-w D:\WINDOWS\system32\atioglxx.dll 2008-08-01 04:58 253,952 ----a-w D:\WINDOWS\system32\atiok3x2.dll 2008-08-01 04:33 425,984 ----a-w D:\WINDOWS\system32\ATIDEMGX.dll 2008-08-01 04:32 311,296 ----a-w D:\WINDOWS\system32\ati2dvag.dll 2008-08-01 04:23 184,320 ----a-w D:\WINDOWS\system32\atipdlxx.dll 2008-08-01 04:23 143,360 ----a-w D:\WINDOWS\system32\Oemdspif.dll 2008-08-01 04:22 43,520 ----a-w D:\WINDOWS\system32\ati2edxx.dll 2008-08-01 04:22 26,112 ----a-w D:\WINDOWS\system32\Ati2mdxx.exe 2008-08-01 04:22 143,360 ----a-w D:\WINDOWS\system32\ati2evxx.dll 2008-08-01 04:21 573,440 ----a-w D:\WINDOWS\system32\ati2evxx.exe 2008-08-01 04:19 53,248 ----a-w D:\WINDOWS\system32\ATIDDC.DLL 2008-08-01 04:10 3,917,568 ----a-w D:\WINDOWS\system32\ati3duag.dll 2008-08-01 03:59 2,183,552 ----a-w D:\WINDOWS\system32\ativvaxx.dll 2008-08-01 03:46 48,640 ----a-w D:\WINDOWS\system32\amdpcom32.dll 2008-08-01 03:42 376,832 ----a-w D:\WINDOWS\system32\atikvmag.dll 2008-08-01 03:40 35,328 ----a-w D:\WINDOWS\system32\atiadlxx.dll 2008-08-01 03:40 17,408 ----a-w D:\WINDOWS\system32\atitvo32.dll 2008-08-01 03:39 53,248 ----a-w D:\WINDOWS\system32\drivers\ati2erec.dll 2008-08-01 03:39 307,200 ----a-w D:\WINDOWS\system32\atiiiexx.dll 2008-08-01 03:34 561,152 ----a-w D:\WINDOWS\system32\ati2cqag.dll 2008-07-31 19:05 593,920 ------w D:\WINDOWS\system32\ati2sgag.exe . (((((((((((((((((((((((((((((((((((((((((((( Look ))))))))))))))))))))))))))))))))))))))))))))))))))))))))) . ---- Directory of D:\Documents and Settings\All Users\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6} ---- 2008-07-04 13:35 54632 --a------ D:\Documents and Settings\All Users\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}\x86\DifXInstall32.exe 2008-04-24 08:25 11168 --a------ D:\Documents and Settings\All Users\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}\x86\gearaspiwdmx86.cat 2008-04-17 13:12 319456 --a------ D:\Documents and Settings\All Users\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}\x86\DIFxAPI.dll 2008-04-17 13:12 2761 --a------ D:\Documents and Settings\All Users\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}\x86\GEARAspiWDM.inf 2008-04-17 13:12 15464 --a------ D:\Documents and Settings\All Users\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}\x86\x86\GEARAspiWDM.sys 2008-04-17 13:12 107368 --a------ D:\Documents and Settings\All Users\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}\x86\x86\GEARAspi.dll ((((((((((((((((((((((((((((( snapshot_2008-09-30_17.57.38.39 ))))))))))))))))))))))))))))))))))))))))) . - 2008-09-30 15:00:29 16,384 -c--a-w D:\WINDOWS\system32\config\systemprofile\Cookies\index.dat + 2008-10-01 18:43:03 16,384 -c--a-w D:\WINDOWS\system32\config\systemprofile\Cookies\index.dat - 2008-09-30 15:00:29 32,768 -c--a-w D:\WINDOWS\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat + 2008-10-01 18:43:03 32,768 -c--a-w D:\WINDOWS\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat - 2008-09-30 15:00:29 32,768 -c--a-w D:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat + 2008-10-01 18:43:03 32,768 -c--a-w D:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat + 2008-10-01 18:43:15 16,384 ----atw D:\WINDOWS\Temp\Perflib_Perfdata_708.dat . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="D:\WINDOWS\system32\ctfmon.exe" [2004-08-04 15360] "STYLEXP"="D:\Program Files\TGTSoft\StyleXP\StyleXP.exe" [2006-05-24 1372160] "Gadu-Gadu"="D:\Program Files\Gadu-Gadu\gg.exe" [2007-07-09 2119104] "DAEMON Tools Pro Agent"="D:\Program Files\DAEMON Tools Pro\DTProAgent.exe" [2007-09-06 136136] "MSMSGS"="D:\Program Files\Messenger\msmsgs.exe" [2004-08-04 1667584] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SunJavaUpdateSched"="D:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784] "StartCCC"="D:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-07-16 61440] "QuickTime Task"="D:\Program Files\QuickTime\qttask.exe" [2008-09-06 413696] "iTunesHelper"="D:\Program Files\iTunes\iTunesHelper.exe" [2008-09-10 289576] "NeroFilterCheck"="D:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 155648] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="D:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 15360] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon] "Userinit"="D:\\WINDOWS\\system32\\userinit.exe,D:\\WINDOWS\\system32\\twext.exe," "UIHost"="D:\\Program Files\\TGTSoft\\StyleXP\\Logon\\CurrentLogon.EXE" [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "vidc.iv32"= ir32.dll "msacm.ac3filter"= ac3filter.acm "vidc.hfyu"= huffyuv.dll "vidc.IV45"= Ir41_qc.dll "msacm.divxa32"= DivXa32.acm "msacm.l3codec"= l3codecp.acm [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "E:\\Program Files\\Sports Interactive\\Football Manager 2008\\fm.exe"= "D:\\Program Files\\Gadu-Gadu\\gg.exe"= "E:\\Program Files\\KONAMI\\Pro Evolution Soccer 2008\\PES2008.exe"= "E:\\Pulpit\\PES2008.exe"= "D:\\Program Files\\SopCast\\adv\\SopAdver.exe"= "D:\\Program Files\\SopCast\\SopCast.exe"= "E:\\AITD\\Alone.exe"= "D:\\Program Files\\Bonjour\\mDNSResponder.exe"= "D:\\Program Files\\iTunes\\iTunes.exe"= "E:\\Assassin's Creed\\AssassinsCreed_Dx9.exe"= "E:\\Assassin's Creed\\AssassinsCreed_Dx10.exe"= "E:\\Assassin's Creed\\AssassinsCreed_Launcher.exe"= . Contents of the 'Scheduled Tasks' folder . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-10-01 20:55:47 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... D:\WINDOWS\system32\twain_32 D:\WINDOWS\system32\twext.exe 242688 bytes executable scan completed successfully hidden files: 2 ************************************************************************** . Completion time: 2008-10-01 20:56:52 ComboFix-quarantined-files.txt 2008-10-01 18:56:49 ComboFix.txt 2008-08-30 13:39:20 ComboFix2.txt 2008-09-30 18:01:17 Pre-Run: 763 715 584 bytes free Post-Run: 748,687,360 bajtów wolnych 232

**Posty:** 18165 · przez **wojtas** 01 Paź 2008, 22:40

1. Ściągnij OTMoveIt i go włacz i odpal go z opcji CleanUp

2. wykonaj optymalizację windowsa
3.sciagnij ATF_Cleaner
zaznacz
Windows Temp
All users Temp
Temporary internet files
Recycle Bin
i wcisnij EMPTY SELECTED
4.Wyłącz przywracanie systemu ( właściwości mój komputer-zakładka przywracanie - wyłącz przywracanie na wszystkich dyskach). Po chwili włącz je powrotem
5.Przeskanuj obszar mojego komputera http://www.kaspersky.pl/virusscanner.html (uruchom przez IE) Daj raport z niego na forum.

i tym:

FixIEDef.

**Posty:** 69 · przez **Fingfolin** 04 Paź 2008, 11:52

Kod: Zaznacz wszystko: 4 październik 2008 11:49:01 System operacyjny: Microsoft Windows XP Professional, Service Pack 2 (Build 2600) Kaspersky Online Scanner wersja: 5.0.98.1 Ostatnia aktualizacja Kaspersky Anti-Virus 3/10/2008 Liczba wpisów w bazie danych Kaspersky Anti-Virus1287039 Ustawienia skanowania Skanowanie przy użyciu następujących baz danych rozszerzone Skanuj archiwa tak Skanuj pocztowe bazy danych tak Obszar skanowania Mój komputer C:\ D:\ E:\ F:\ G:\ H:\ I:\ Statystyki skanowania Liczba skanowanych obiektów 117146 Liczba wykrytych wirusów 16 Liczba zainfekowanych obiektów 27 Liczba podejrzanych obiektów 0 Czas trwania skanowania 01:34:20 Nazwa zainfekowanego obiektu Nazwa wirusa Ostatnie działanie C:\Documents and Settings\ART\Dane aplikacji\Gadu-Gadu\backup\_cache\banner.htm Zainfekowanych: Trojan-Downloader.JS.Agent.cnn pominięty C:\Documents and Settings\ART\Dane aplikacji\Gadu-Gadu\backup\_cache\sbanner.htm Zainfekowanych: Trojan-Downloader.JS.Agent.cnn pominięty C:\Documents and Settings\ART\Dane aplikacji\Nero\Nero8\OnlineServices\registrationinfo.xml Object is locked pominięty C:\Documents and Settings\ART\Ustawienia lokalne\Temp\.tt37F.tmp.vbs Zainfekowanych: Backdoor.Win32.Frauder.eo pominięty C:\Documents and Settings\ART\Ustawienia lokalne\Temporary Internet Files\Content.IE5\7M87VTST\ad[1].htm Zainfekowanych: Trojan-Downloader.JS.Agent.cnn pominięty C:\Documents and Settings\ART\Ustawienia lokalne\Temporary Internet Files\Content.IE5\7M87VTST\anonwww[1].htm Zainfekowanych: Trojan-Downloader.JS.Agent.cnn pominięty C:\Documents and Settings\ART\Ustawienia lokalne\Temporary Internet Files\Content.IE5\7M87VTST\CA05E7C5 Zainfekowanych: Trojan-Downloader.JS.Agent.cnn pominięty C:\Documents and Settings\ART\Ustawienia lokalne\Temporary Internet Files\Content.IE5\7M87VTST\CAQVWXW9 Zainfekowanych: Trojan-Downloader.JS.Agent.cnn pominięty C:\Documents and Settings\ART\Ustawienia lokalne\Temporary Internet Files\Content.IE5\7M87VTST\ComboFix[1].htm Zainfekowanych: Trojan-Downloader.JS.Agent.cnn pominięty C:\Documents and Settings\ART\Ustawienia lokalne\Temporary Internet Files\Content.IE5\7M87VTST\google[2] Zainfekowanych: Trojan-Downloader.JS.Agent.cnn pominięty C:\Documents and Settings\ART\Ustawienia lokalne\Temporary Internet Files\Content.IE5\K1YFS5MR\getmainbanner[5].htm Zainfekowanych: Trojan-Downloader.JS.Agent.cnn pominięty C:\RavMon.exe Zainfekowanych: Trojan.Win32.Agent.aeim pominięty C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked pominięty C:\WINDOWS\MDM.EXE Zainfekowanych: Trojan.Win32.Agent.abt pominięty C:\WINDOWS\SVCHOST.EXE Zainfekowanych: Trojan.Win32.Agent.aeim pominięty C:\WINDOWS\system32\a.exe Zainfekowanych: Trojan-Downloader.Win32.Small.ackc pominięty C:\WINDOWS\system32\drivers\tdssserv.sys Zainfekowanych: Backdoor.Win32.Agent.qdy pominięty C:\WINDOWS\system32\tdssadw.dll Zainfekowanych: Rootkit.Win32.Clbd.ja pominięty C:\WINDOWS\system32\tdssl.dll Zainfekowanych: Trojan-Downloader.Win32.Small.acio pominięty C:\WINDOWS\system32\tdsslog.dll Zainfekowanych: Hoax.Win32.Renos.ebd pominięty C:\WINDOWS\system32\tdssmain.dll Zainfekowanych: Backdoor.Win32.Agent.rhb pominięty C:\WINDOWS\system32\tdssserf.dll Zainfekowanych: Trojan.Win32.Agent.acjd pominięty D:\Documents and Settings\LocalService\Cookies\index.dat Object is locked pominięty D:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked pominięty D:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked pominięty D:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked pominięty D:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked pominięty D:\Documents and Settings\LocalService\ntuser.dat Object is locked pominięty D:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked pominięty D:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked pominięty D:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked pominięty D:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked pominięty D:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked pominięty D:\Documents and Settings\Olwe\Cookies\index.dat Object is locked pominięty D:\Documents and Settings\Olwe\drvsyst.exe Zainfekowanych: Trojan-Spy.Win32.Zbot.eof pominięty D:\Documents and Settings\Olwe\Local Settings\Application Data\Last.fm\Client\iTunesPlays.db Object is locked pominięty D:\Documents and Settings\Olwe\Local Settings\Application Data\Last.fm\Client\iTunesPlugin.log Object is locked pominięty D:\Documents and Settings\Olwe\Local Settings\Application Data\Last.fm\Client\Last.fm.log Object is locked pominięty D:\Documents and Settings\Olwe\Local Settings\Application Data\Last.fm\collection.db Object is locked pominięty D:\Documents and Settings\Olwe\Local Settings\Application Data\Microsoft\Media Player\CurrentDatabase_59R.wmdb Object is locked pominięty D:\Documents and Settings\Olwe\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked pominięty D:\Documents and Settings\Olwe\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked pominięty D:\Documents and Settings\Olwe\Local Settings\Application Data\Opera\Opera\mail\indexer\indexer.ax Object is locked pominięty D:\Documents and Settings\Olwe\Local Settings\Application Data\Opera\Opera\mail\indexer\indexer.bx Object is locked pominięty D:\Documents and Settings\Olwe\Local Settings\Application Data\Opera\Opera\mail\indexer\message_id Object is locked pominięty D:\Documents and Settings\Olwe\Local Settings\Application Data\Opera\Opera\mail\lexicon\lexicon.ax Object is locked pominięty D:\Documents and Settings\Olwe\Local Settings\Application Data\Opera\Opera\mail\lexicon\lexicon.bx Object is locked pominięty D:\Documents and Settings\Olwe\Local Settings\Application Data\Opera\Opera\mail\omailbase.dat Object is locked pominięty D:\Documents and Settings\Olwe\Local Settings\Application Data\Opera\Opera\profile\vps\0000\adoc.bx Object is locked pominięty D:\Documents and Settings\Olwe\Local Settings\Application Data\Opera\Opera\profile\vps\0000\md.dat Object is locked pominięty D:\Documents and Settings\Olwe\Local Settings\Application Data\Opera\Opera\profile\vps\0000\url.ax Object is locked pominięty D:\Documents and Settings\Olwe\Local Settings\Application Data\Opera\Opera\profile\vps\0000\w.ax Object is locked pominięty D:\Documents and Settings\Olwe\Local Settings\Application Data\Opera\Opera\profile\vps\0000\wb.vx Object is locked pominięty D:\Documents and Settings\Olwe\Local Settings\Application Data\Opera\Opera\profile\vps\0001\adoc.bx Object is locked pominięty D:\Documents and Settings\Olwe\Local Settings\Application Data\Opera\Opera\profile\vps\0001\md.dat Object is locked pominięty D:\Documents and Settings\Olwe\Local Settings\Application Data\Opera\Opera\profile\vps\0001\url.ax Object is locked pominięty D:\Documents and Settings\Olwe\Local Settings\Application Data\Opera\Opera\profile\vps\0001\w.ax Object is locked pominięty D:\Documents and Settings\Olwe\Local Settings\Application Data\Opera\Opera\profile\vps\0001\wb.vx Object is locked pominięty D:\Documents and Settings\Olwe\Local Settings\Application Data\Opera\Opera\profile\vps\0002\adoc.bx Object is locked pominięty D:\Documents and Settings\Olwe\Local Settings\Application Data\Opera\Opera\profile\vps\0002\md.dat Object is locked pominięty D:\Documents and Settings\Olwe\Local Settings\Application Data\Opera\Opera\profile\vps\0002\url.ax Object is locked pominięty D:\Documents and Settings\Olwe\Local Settings\Application Data\Opera\Opera\profile\vps\0002\w.ax Object is locked pominięty D:\Documents and Settings\Olwe\Local Settings\Application Data\Opera\Opera\profile\vps\0002\wb.vx Object is locked pominięty D:\Documents and Settings\Olwe\Local Settings\Application Data\Opera\Opera\profile\vps\0003\adoc.bx Object is locked pominięty D:\Documents and Settings\Olwe\Local Settings\Application Data\Opera\Opera\profile\vps\0003\md.dat Object is locked pominięty D:\Documents and Settings\Olwe\Local Settings\Application Data\Opera\Opera\profile\vps\0003\url.ax Object is locked pominięty D:\Documents and Settings\Olwe\Local Settings\Application Data\Opera\Opera\profile\vps\0003\w.ax Object is locked pominięty D:\Documents and Settings\Olwe\Local Settings\Application Data\Opera\Opera\profile\vps\0003\wb.vx Object is locked pominięty D:\Documents and Settings\Olwe\Local Settings\Application Data\Opera\Opera\profile\vps\0004\adoc.bx Object is locked pominięty D:\Documents and Settings\Olwe\Local Settings\Application Data\Opera\Opera\profile\vps\0004\md.dat Object is locked pominięty D:\Documents and Settings\Olwe\Local Settings\Application Data\Opera\Opera\profile\vps\0004\url.ax Object is locked pominięty D:\Documents and Settings\Olwe\Local Settings\Application Data\Opera\Opera\profile\vps\0004\w.ax Object is locked pominięty D:\Documents and Settings\Olwe\Local Settings\Application Data\Opera\Opera\profile\vps\0004\wb.vx Object is locked pominięty D:\Documents and Settings\Olwe\Local Settings\Application Data\Opera\Opera\profile\vps\0005\adoc.bx Object is locked pominięty D:\Documents and Settings\Olwe\Local Settings\Application Data\Opera\Opera\profile\vps\0005\md.dat Object is locked pominięty D:\Documents and Settings\Olwe\Local Settings\Application Data\Opera\Opera\profile\vps\0005\url.ax Object is locked pominięty D:\Documents and Settings\Olwe\Local Settings\Application Data\Opera\Opera\profile\vps\0005\w.ax Object is locked pominięty D:\Documents and Settings\Olwe\Local Settings\Application Data\Opera\Opera\profile\vps\0005\wb.vx Object is locked pominięty D:\Documents and Settings\Olwe\Local Settings\Application Data\Opera\Opera\profile\vps\0006\adoc.bx Object is locked pominięty D:\Documents and Settings\Olwe\Local Settings\Application Data\Opera\Opera\profile\vps\0006\md.dat Object is locked pominięty D:\Documents and Settings\Olwe\Local Settings\Application Data\Opera\Opera\profile\vps\0006\url.ax Object is locked pominięty D:\Documents and Settings\Olwe\Local Settings\Application Data\Opera\Opera\profile\vps\0006\w.ax Object is locked pominięty D:\Documents and Settings\Olwe\Local Settings\Application Data\Opera\Opera\profile\vps\0006\wb.vx Object is locked pominięty D:\Documents and Settings\Olwe\Local Settings\Application Data\Opera\Opera\profile\vps\0007\adoc.bx Object is locked pominięty D:\Documents and Settings\Olwe\Local Settings\Application Data\Opera\Opera\profile\vps\0007\md.dat Object is locked pominięty D:\Documents and Settings\Olwe\Local Settings\Application Data\Opera\Opera\profile\vps\0007\url.ax Object is locked pominięty D:\Documents and Settings\Olwe\Local Settings\Application Data\Opera\Opera\profile\vps\0007\w.ax Object is locked pominięty D:\Documents and Settings\Olwe\Local Settings\Application Data\Opera\Opera\profile\vps\0007\wb.vx Object is locked pominięty D:\Documents and Settings\Olwe\Local Settings\Application Data\Opera\Opera\profile\vps\0009\adoc.bx Object is locked pominięty D:\Documents and Settings\Olwe\Local Settings\Application Data\Opera\Opera\profile\vps\0009\md.dat Object is locked pominięty D:\Documents and Settings\Olwe\Local Settings\Application Data\Opera\Opera\profile\vps\0009\url.ax Object is locked pominięty D:\Documents and Settings\Olwe\Local Settings\Application Data\Opera\Opera\profile\vps\0009\w.ax Object is locked pominięty D:\Documents and Settings\Olwe\Local Settings\Application Data\Opera\Opera\profile\vps\0009\wb.vx Object is locked pominięty D:\Documents and Settings\Olwe\Local Settings\Application Data\Opera\Opera\profile\vps\0010\adoc.bx Object is locked pominięty D:\Documents and Settings\Olwe\Local Settings\Application Data\Opera\Opera\profile\vps\0010\md.dat Object is locked pominięty D:\Documents and Settings\Olwe\Local Settings\Application Data\Opera\Opera\profile\vps\0010\url.ax Object is locked pominięty D:\Documents and Settings\Olwe\Local Settings\Application Data\Opera\Opera\profile\vps\0010\w.ax Object is locked pominięty D:\Documents and Settings\Olwe\Local Settings\Application Data\Opera\Opera\profile\vps\0010\wb.vx Object is locked pominięty D:\Documents and Settings\Olwe\Local Settings\History\History.IE5\index.dat Object is locked pominięty D:\Documents and Settings\Olwe\Local Settings\History\History.IE5\MSHist012008100420081005\index.dat Object is locked pominięty D:\Documents and Settings\Olwe\Local Settings\temp\etilqs_4KmQAfbopXcakwf Object is locked pominięty D:\Documents and Settings\Olwe\Local Settings\temp\etilqs_m8uOx1OfI4D07gI-journal Object is locked pominięty D:\Documents and Settings\Olwe\Local Settings\temp\hsperfdata_Olwe\2544 Object is locked pominięty D:\Documents and Settings\Olwe\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked pominięty D:\Documents and Settings\Olwe\My Documents\My Music\iTunes\iTunes Library Extras.itdb Object is locked pominięty D:\Documents and Settings\Olwe\My Documents\My Music\iTunes\iTunes Library Genius.itdb Object is locked pominięty D:\Documents and Settings\Olwe\My Documents\My Music\iTunes\iTunes Library.itl Object is locked pominięty D:\Documents and Settings\Olwe\ntuser.dat Object is locked pominięty D:\Documents and Settings\Olwe\ntuser.dat.LOG Object is locked pominięty D:\Program Files\Alcohol Soft\Alcohol 120\StarWind\logs\sw_ae-20081003-232145.log Object is locked pominięty D:\Program Files\SDFix\backups_old1\svchost.exe Zainfekowanych: Trojan-Dropper.Win32.Small.apl pominięty D:\RavMon.exe Zainfekowanych: Trojan.Win32.Agent.aeim pominięty D:\System Volume Information\MountPointManagerRemoteDatabase Object is locked pominięty D:\System Volume Information\_restore{793F2BC7-69B4-4CD8-91B5-2BD0775CC591}\RP81\change.log Object is locked pominięty D:\WINDOWS\Debug\PASSWD.LOG Object is locked pominięty D:\WINDOWS\SchedLgU.Txt Object is locked pominięty D:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked pominięty D:\WINDOWS\system32\CatRoot2\edb.log Object is locked pominięty D:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked pominięty D:\WINDOWS\system32\config\ACEEvent.evt Object is locked pominięty D:\WINDOWS\system32\config\AppEvent.Evt Object is locked pominięty D:\WINDOWS\system32\config\default Object is locked pominięty D:\WINDOWS\system32\config\default.LOG Object is locked pominięty D:\WINDOWS\system32\config\SAM Object is locked pominięty D:\WINDOWS\system32\config\SAM.LOG Object is locked pominięty D:\WINDOWS\system32\config\SecEvent.Evt Object is locked pominięty D:\WINDOWS\system32\config\SECURITY Object is locked pominięty D:\WINDOWS\system32\config\SECURITY.LOG Object is locked pominięty D:\WINDOWS\system32\config\software Object is locked pominięty D:\WINDOWS\system32\config\software.LOG Object is locked pominięty D:\WINDOWS\system32\config\SysEvent.Evt Object is locked pominięty D:\WINDOWS\system32\config\system Object is locked pominięty D:\WINDOWS\system32\config\system.LOG Object is locked pominięty D:\WINDOWS\system32\config\systemprofile\Cookies\index.dat Object is locked pominięty D:\WINDOWS\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat Object is locked pominięty D:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked pominięty D:\WINDOWS\system32\drivers\sptd.sys Object is locked pominięty D:\WINDOWS\system32\h323log.txt Object is locked pominięty D:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked pominięty D:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked pominięty D:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked pominięty D:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked pominięty D:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked pominięty D:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked pominięty D:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked pominięty D:\WINDOWS\Temp\Perflib_Perfdata_714.dat Object is locked pominięty D:\WINDOWS\WindowsUpdate.log Object is locked pominięty E:\Program Files\Futuremark\3DMark06\install.exe Zainfekowanych: Virus.Win32.Virut.av pominięty E:\Program Files\Futuremark\3DMark06\keygen.exe Zainfekowanych: Trojan.Win32.Inject.mt pominięty E:\Program Files\Futuremark\3DMark06\serial.exe Zainfekowanych: Trojan.Win32.Dialer.yz pominięty E:\RavMon.exe Zainfekowanych: Trojan.Win32.Agent.aeim pominięty E:\System Volume Information\MountPointManagerRemoteDatabase Object is locked pominięty Proces skanowania został zakończony.

**Posty:** 684 · przez **djarta** 04 Paź 2008, 12:10

Aż tyle trojanów?

Pobierz ---> The Avenger

Wklej do niego ten tekst:

Kod: Zaznacz wszystko: Folders to delete: C:\Documents and Settings\ART\Dane aplikacji\Gadu-Gadu\backup\_cache C:\Documents and Settings\ART\Ustawienia lokalne\Temp C:\Documents and Settings\ART\Ustawienia lokalne\Temporary Internet Files D:\Program Files\SDFix Files to delete: C:\RavMon.exe C:\WINDOWS\MDM.EXE C:\WINDOWS\SVCHOST.EXE C:\WINDOWS\system32\a.exe C:\WINDOWS\system32\drivers\tdssserv.sys C:\WINDOWS\system32\tdssadw.dll C:\WINDOWS\system32\tdssl.dll C:\WINDOWS\system32\tdsslog.dll C:\WINDOWS\system32\tdssmain.dll C:\WINDOWS\system32\tdssserf.dll D:\Documents and Settings\Olwe\drvsyst.exe D:\RavMon.exe E:\Program Files\Futuremark\3DMark06\serial.exe E:\Program Files\Futuremark\3DMark06\keygen.exe E:\Program Files\Futuremark\3DMark06\install.exe Registry keys to delete: HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\tdssserv.sys HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\tdssserv.sys HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\tdssdata HKLM\SOFTWARE\tdss Drivers to delete: tdssserv

Kopiujesz - Klikasz na Paste Script from Clipboard - Execute - Potwierdzasz i zgadzasz się na restart klikając OK.
Po wykonaniu skasuj z dysku plik: C:\Avenger\backup.zip i wklej raport na forum C:\avenger.txt

Następny Scan kasperksym.

============================
K.

Autor postu otrzymał pochwałę

**Posty:** 69 · przez **Fingfolin** 04 Paź 2008, 22:13

Kod: Zaznacz wszystko: Logfile of The Avenger Version 2.0, (c) by Swandog46 http://swandog46.geekstogo.com Platform: Windows XP ******************* Script file opened successfully. Script file read successfully. Backups directory opened successfully at D:\Avenger ******************* Beginning to process script file: Rootkit scan active. No rootkits found! Folder "C:\Documents and Settings\ART\Dane aplikacji\Gadu-Gadu\backup\_cache" deleted successfully. Folder "C:\Documents and Settings\ART\Ustawienia lokalne\Temp" deleted successfully. Folder "C:\Documents and Settings\ART\Ustawienia lokalne\Temporary Internet Files" deleted successfully. Folder "D:\Program Files\SDFix" deleted successfully. File "C:\RavMon.exe" deleted successfully. File "C:\WINDOWS\MDM.EXE" deleted successfully. File "C:\WINDOWS\SVCHOST.EXE" deleted successfully. File "C:\WINDOWS\system32\a.exe" deleted successfully. File "C:\WINDOWS\system32\drivers\tdssserv.sys" deleted successfully. File "C:\WINDOWS\system32\tdssadw.dll" deleted successfully. File "C:\WINDOWS\system32\tdssl.dll" deleted successfully. File "C:\WINDOWS\system32\tdsslog.dll" deleted successfully. File "C:\WINDOWS\system32\tdssmain.dll" deleted successfully. File "C:\WINDOWS\system32\tdssserf.dll" deleted successfully. File "D:\Documents and Settings\Olwe\drvsyst.exe" deleted successfully. File "D:\RavMon.exe" deleted successfully. File "E:\Program Files\Futuremark\3DMark06\serial.exe" deleted successfully. File "E:\Program Files\Futuremark\3DMark06\keygen.exe" deleted successfully. File "E:\Program Files\Futuremark\3DMark06\install.exe" deleted successfully. Error: registry key "HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\tdssserv.sys" not found! Deletion of registry key "HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\tdssserv.sys" failed! Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND) --> the object does not exist Error: registry key "HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\tdssserv.sys" not found! Deletion of registry key "HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\tdssserv.sys" failed! Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND) --> the object does not exist Error: registry key "\Registry\Machine\System\CurrentControlSet\Services\tdssserv" not found! Deletion of driver "tdssserv" failed! Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND) --> the object does not exist Error: registry key "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\tdssdata" not found! Deletion of registry key "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\tdssdata" failed! Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND) --> the object does not exist Error: registry key "HKLM\SOFTWARE\tdss" not found! Deletion of registry key "HKLM\SOFTWARE\tdss" failed! Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND) --> the object does not exist Completed script processing. ******************* Finished! Terminate.

Kod: Zaznacz wszystko: 4 październik 2008 22:11:00 System operacyjny: Microsoft Windows XP Professional, Service Pack 2 (Build 2600) Kaspersky Online Scanner wersja: 5.0.98.1 Ostatnia aktualizacja Kaspersky Anti-Virus 4/10/2008 Liczba wpisów w bazie danych Kaspersky Anti-Virus1289130 Ustawienia skanowania Skanowanie przy użyciu następujących baz danych rozszerzone Skanuj archiwa tak Skanuj pocztowe bazy danych tak Obszar skanowania Mój komputer C:\ D:\ E:\ F:\ G:\ H:\ I:\ Statystyki skanowania Liczba skanowanych obiektów 113428 Liczba wykrytych wirusów 2 Liczba zainfekowanych obiektów 1 Liczba podejrzanych obiektów 2 Czas trwania skanowania 01:30:20 Nazwa zainfekowanego obiektu Nazwa wirusa Ostatnie działanie C:\Documents and Settings\ART\Dane aplikacji\Nero\Nero8\OnlineServices\registrationinfo.xml Object is locked pominięty C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked pominięty D:\Avenger\backup-2008-10-04-14.49.31,87.zip/avenger/a.exe Podejrzanych: Password-protected-EXE pominięty D:\Avenger\backup-2008-10-04-14.49.31,87.zip ZIP: podejrzany - 1 pominięty D:\Documents and Settings\LocalService\Cookies\index.dat Object is locked pominięty D:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked pominięty D:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked pominięty D:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked pominięty D:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked pominięty D:\Documents and Settings\LocalService\ntuser.dat Object is locked pominięty D:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked pominięty D:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked pominięty D:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked pominięty D:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked pominięty D:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked pominięty D:\Documents and Settings\Olwe\Cookies\index.dat Object is locked pominięty D:\Documents and Settings\Olwe\Gadu-Gadu\Ja\archives.dat Object is locked pominięty D:\Documents and Settings\Olwe\Local Settings\Application Data\Last.fm\Client\iTunesPlays.db Object is locked pominięty D:\Documents and Settings\Olwe\Local Settings\Application Data\Last.fm\Client\iTunesPlugin.log Object is locked pominięty D:\Documents and Settings\Olwe\Local Settings\Application Data\Last.fm\Client\Last.fm.log Object is locked pominięty D:\Documents and Settings\Olwe\Local Settings\Application Data\Last.fm\collection.db Object is locked pominięty D:\Documents and Settings\Olwe\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked pominięty D:\Documents and Settings\Olwe\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked pominięty D:\Documents and Settings\Olwe\Local Settings\Application Data\Opera\Opera\mail\indexer\indexer.ax Object is locked pominięty D:\Documents and Settings\Olwe\Local Settings\Application Data\Opera\Opera\mail\indexer\indexer.bx Object is locked pominięty D:\Documents and Settings\Olwe\Local Settings\Application Data\Opera\Opera\mail\indexer\message_id Object is locked pominięty D:\Documents and Settings\Olwe\Local Settings\Application Data\Opera\Opera\mail\lexicon\lexicon.ax Object is locked pominięty D:\Documents and Settings\Olwe\Local Settings\Application Data\Opera\Opera\mail\lexicon\lexicon.bx Object is locked pominięty D:\Documents and Settings\Olwe\Local Settings\Application Data\Opera\Opera\mail\omailbase.dat Object is locked pominięty D:\Documents and Settings\Olwe\Local Settings\Application Data\Opera\Opera\profile\vps\0000\adoc.bx Object is locked pominięty D:\Documents and Settings\Olwe\Local Settings\Application Data\Opera\Opera\profile\vps\0000\md.dat Object is locked pominięty D:\Documents and Settings\Olwe\Local Settings\Application Data\Opera\Opera\profile\vps\0000\url.ax Object is locked pominięty D:\Documents and Settings\Olwe\Local Settings\Application Data\Opera\Opera\profile\vps\0000\w.ax Object is locked pominięty D:\Documents and Settings\Olwe\Local Settings\Application Data\Opera\Opera\profile\vps\0000\wb.vx Object is locked pominięty D:\Documents and Settings\Olwe\Local Settings\Application Data\Opera\Opera\profile\vps\0001\adoc.bx Object is locked pominięty D:\Documents and Settings\Olwe\Local Settings\Application Data\Opera\Opera\profile\vps\0001\md.dat Object is locked pominięty D:\Documents and Settings\Olwe\Local Settings\Application Data\Opera\Opera\profile\vps\0001\url.ax Object is locked pominięty D:\Documents and Settings\Olwe\Local Settings\Application Data\Opera\Opera\profile\vps\0001\w.ax Object is locked pominięty D:\Documents and Settings\Olwe\Local Settings\Application Data\Opera\Opera\profile\vps\0001\wb.vx Object is locked pominięty D:\Documents and Settings\Olwe\Local Settings\Application Data\Opera\Opera\profile\vps\0002\adoc.bx Object is locked pominięty D:\Documents and Settings\Olwe\Local Settings\Application Data\Opera\Opera\profile\vps\0002\md.dat Object is locked pominięty D:\Documents and Settings\Olwe\Local Settings\Application Data\Opera\Opera\profile\vps\0002\url.ax Object is locked pominięty D:\Documents and Settings\Olwe\Local Settings\Application Data\Opera\Opera\profile\vps\0002\w.ax Object is locked pominięty D:\Documents and Settings\Olwe\Local Settings\Application Data\Opera\Opera\profile\vps\0002\wb.vx Object is locked pominięty D:\Documents and Settings\Olwe\Local Settings\Application Data\Opera\Opera\profile\vps\0003\adoc.bx Object is locked pominięty D:\Documents and Settings\Olwe\Local Settings\Application Data\Opera\Opera\profile\vps\0003\md.dat Object is locked pominięty D:\Documents and Settings\Olwe\Local Settings\Application Data\Opera\Opera\profile\vps\0003\url.ax Object is locked pominięty D:\Documents and Settings\Olwe\Local Settings\Application Data\Opera\Opera\profile\vps\0003\w.ax Object is locked pominięty D:\Documents and Settings\Olwe\Local Settings\Application Data\Opera\Opera\profile\vps\0003\wb.vx Object is locked pominięty D:\Documents and Settings\Olwe\Local Settings\Application Data\Opera\Opera\profile\vps\0004\adoc.bx Object is locked pominięty D:\Documents and Settings\Olwe\Local Settings\Application Data\Opera\Opera\profile\vps\0004\md.dat Object is locked pominięty D:\Documents and Settings\Olwe\Local Settings\Application Data\Opera\Opera\profile\vps\0004\url.ax Object is locked pominięty D:\Documents and Settings\Olwe\Local Settings\Application Data\Opera\Opera\profile\vps\0004\w.ax Object is locked pominięty D:\Documents and Settings\Olwe\Local Settings\Application Data\Opera\Opera\profile\vps\0004\wb.vx Object is locked pominięty D:\Documents and Settings\Olwe\Local Settings\Application Data\Opera\Opera\profile\vps\0005\adoc.bx Object is locked pominięty D:\Documents and Settings\Olwe\Local Settings\Application Data\Opera\Opera\profile\vps\0005\md.dat Object is locked pominięty D:\Documents and Settings\Olwe\Local Settings\Application Data\Opera\Opera\profile\vps\0005\url.ax Object is locked pominięty D:\Documents and Settings\Olwe\Local Settings\Application Data\Opera\Opera\profile\vps\0005\w.ax Object is locked pominięty D:\Documents and Settings\Olwe\Local Settings\Application Data\Opera\Opera\profile\vps\0005\wb.vx Object is locked pominięty D:\Documents and Settings\Olwe\Local Settings\Application Data\Opera\Opera\profile\vps\0006\adoc.bx Object is locked pominięty D:\Documents and Settings\Olwe\Local Settings\Application Data\Opera\Opera\profile\vps\0006\md.dat Object is locked pominięty D:\Documents and Settings\Olwe\Local Settings\Application Data\Opera\Opera\profile\vps\0006\url.ax Object is locked pominięty D:\Documents and Settings\Olwe\Local Settings\Application Data\Opera\Opera\profile\vps\0006\w.ax Object is locked pominięty D:\Documents and Settings\Olwe\Local Settings\Application Data\Opera\Opera\profile\vps\0006\wb.vx Object is locked pominięty D:\Documents and Settings\Olwe\Local Settings\Application Data\Opera\Opera\profile\vps\0007\adoc.bx Object is locked pominięty D:\Documents and Settings\Olwe\Local Settings\Application Data\Opera\Opera\profile\vps\0007\md.dat Object is locked pominięty D:\Documents and Settings\Olwe\Local Settings\Application Data\Opera\Opera\profile\vps\0007\url.ax Object is locked pominięty D:\Documents and Settings\Olwe\Local Settings\Application Data\Opera\Opera\profile\vps\0007\w.ax Object is locked pominięty D:\Documents and Settings\Olwe\Local Settings\Application Data\Opera\Opera\profile\vps\0007\wb.vx Object is locked pominięty D:\Documents and Settings\Olwe\Local Settings\Application Data\Opera\Opera\profile\vps\0009\adoc.bx Object is locked pominięty D:\Documents and Settings\Olwe\Local Settings\Application Data\Opera\Opera\profile\vps\0009\md.dat Object is locked pominięty D:\Documents and Settings\Olwe\Local Settings\Application Data\Opera\Opera\profile\vps\0009\url.ax Object is locked pominięty D:\Documents and Settings\Olwe\Local Settings\Application Data\Opera\Opera\profile\vps\0009\w.ax Object is locked pominięty D:\Documents and Settings\Olwe\Local Settings\Application Data\Opera\Opera\profile\vps\0009\wb.vx Object is locked pominięty D:\Documents and Settings\Olwe\Local Settings\Application Data\Opera\Opera\profile\vps\0010\adoc.bx Object is locked pominięty D:\Documents and Settings\Olwe\Local Settings\Application Data\Opera\Opera\profile\vps\0010\md.dat Object is locked pominięty D:\Documents and Settings\Olwe\Local Settings\Application Data\Opera\Opera\profile\vps\0010\url.ax Object is locked pominięty D:\Documents and Settings\Olwe\Local Settings\Application Data\Opera\Opera\profile\vps\0010\w.ax Object is locked pominięty D:\Documents and Settings\Olwe\Local Settings\Application Data\Opera\Opera\profile\vps\0010\wb.vx Object is locked pominięty D:\Documents and Settings\Olwe\Local Settings\History\History.IE5\index.dat Object is locked pominięty D:\Documents and Settings\Olwe\Local Settings\History\History.IE5\MSHist012008100420081005\index.dat Object is locked pominięty D:\Documents and Settings\Olwe\Local Settings\temp\etilqs_eC1TK134Q1Aaao4 Object is locked pominięty D:\Documents and Settings\Olwe\Local Settings\temp\etilqs_Z0V1hUqNt6ybaUM-journal Object is locked pominięty D:\Documents and Settings\Olwe\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked pominięty D:\Documents and Settings\Olwe\My Documents\My Music\iTunes\iTunes Library Extras.itdb Object is locked pominięty D:\Documents and Settings\Olwe\My Documents\My Music\iTunes\iTunes Library Genius.itdb Object is locked pominięty D:\Documents and Settings\Olwe\My Documents\My Music\iTunes\iTunes Library.itl Object is locked pominięty D:\Documents and Settings\Olwe\ntuser.dat Object is locked pominięty D:\Documents and Settings\Olwe\ntuser.dat.LOG Object is locked pominięty D:\Program Files\Alcohol Soft\Alcohol 120\StarWind\logs\sw_ae-20081004-144939.log Object is locked pominięty D:\System Volume Information\MountPointManagerRemoteDatabase Object is locked pominięty D:\WINDOWS\Debug\PASSWD.LOG Object is locked pominięty D:\WINDOWS\SchedLgU.Txt Object is locked pominięty D:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked pominięty D:\WINDOWS\system32\config\ACEEvent.evt Object is locked pominięty D:\WINDOWS\system32\config\AppEvent.Evt Object is locked pominięty D:\WINDOWS\system32\config\default Object is locked pominięty D:\WINDOWS\system32\config\default.LOG Object is locked pominięty D:\WINDOWS\system32\config\SAM Object is locked pominięty D:\WINDOWS\system32\config\SAM.LOG Object is locked pominięty D:\WINDOWS\system32\config\SecEvent.Evt Object is locked pominięty D:\WINDOWS\system32\config\SECURITY Object is locked pominięty D:\WINDOWS\system32\config\SECURITY.LOG Object is locked pominięty D:\WINDOWS\system32\config\software Object is locked pominięty D:\WINDOWS\system32\config\software.LOG Object is locked pominięty D:\WINDOWS\system32\config\SysEvent.Evt Object is locked pominięty D:\WINDOWS\system32\config\system Object is locked pominięty D:\WINDOWS\system32\config\system.LOG Object is locked pominięty D:\WINDOWS\system32\config\systemprofile\Cookies\index.dat Object is locked pominięty D:\WINDOWS\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat Object is locked pominięty D:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked pominięty D:\WINDOWS\system32\drivers\sptd.sys Object is locked pominięty D:\WINDOWS\system32\h323log.txt Object is locked pominięty D:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked pominięty D:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked pominięty D:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked pominięty D:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked pominięty D:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked pominięty D:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked pominięty D:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked pominięty D:\WINDOWS\Temp\Perflib_Perfdata_814.dat Object is locked pominięty D:\WINDOWS\WindowsUpdate.log Object is locked pominięty E:\RavMon.exe Zainfekowanych: Trojan.Win32.Agent.aeim pominięty E:\System Volume Information\MountPointManagerRemoteDatabase Object is locked pominięty Proces skanowania został zakończony.

**Posty:** 684 · przez **djarta** 04 Paź 2008, 22:16

Wklej do niego ten tekst:

Kod: Zaznacz wszystko: Files to delete: E:\RavMon.exe

Kopiujesz - Klikasz na Paste Script from Clipboard - Execute - Potwierdzasz i zgadzasz się na restart klikając OK.
Po wykonaniu skasuj z dysku plik: C:\Avenger\backup.zip i wklej raport na forum C:\avenger.txt

========================
K.

Autor postu otrzymał pochwałę

**Posty:** 69 · przez **Fingfolin** 04 Paź 2008, 23:13

Dziękuje za pomoc : )

Kod: Zaznacz wszystko: Logfile of The Avenger Version 2.0, (c) by Swandog46 http://swandog46.geekstogo.com Platform: Windows XP ******************* Script file opened successfully. Script file read successfully. Backups directory opened successfully at D:\Avenger ******************* Beginning to process script file: Rootkit scan active. No rootkits found! File "E:\RavMon.exe" deleted successfully. Completed script processing. ******************* Finished! Terminate.

**Posty:** 684 · przez **djarta** 04 Paź 2008, 23:23

D:\Avenger

Usuń ręcznie.

To wszystko z mojej strony.

========================
K.