Powazny problem z wirusem, wirusami.
#1
Napisano 06 09 2008 - 20:59
mam straszny problem z wirusem lub tez mozliwe iz mam doczynienia z wieksza iloscia tego g..... mianowicie:
problem pojawil sie w trakcie wakacji. wszystko bylo ok a tu nagle wyskoczylo mi pelno antywirusów ktore pokazywaly mi ze mam 2500 wirosow ktorych nie da sie usunac. Osobiscie zainstalowalem tylko avasta wiec nie mam pojecia skad te inne "anty wirusy". W dodatku zmienila mi sie tapeta, nie mam ikony moj komputer ani panelu sterowania. Dokladnie w ostatni dzien wakacji zrobilem format wszystkich dyskow i wszystko wydawalo sie byc ok. Niestety dzisiaj problem powrocil. Dzieje sie dokladnie to samo co przed formatem. Prosze o pomoc, nie chce znow formatowac kompa. Dodam jeszcze ze skanowalem kompa antywirem McAfee (nic nie wykryl).
#2
Napisano 06 09 2008 - 23:38
#3
Napisano 07 09 2008 - 00:15
Nie zawsze, czasami wirusy zagnieżdżą się na innych dyskach i uaktywnią sie nawet na nowym systemie, chyba że chodzi Ci o format całego dysku.Jak jest durzo syfu lepiej zrobic format masz przynajmniej pewnosc ze wszystko usunoles
#4
Napisano 07 09 2008 - 00:57
http://ftp.kaspersky.com/devbuilds/RescueD...rescue_2008.iso
#5
Napisano 07 09 2008 - 09:27
#6
Napisano 07 09 2008 - 20:13
Mam podobny problem i nie wiem co dalej robić.
Po formacie ,jak włączyłem kompa to tylko pulpit i myszką dało się ruszać a klawiaturą nic. Na trybie awaryjnym przeskanowałem i wyszło parę wirusów.
włączył się tryb normalny ,i następne problemy: co chwile mi avast jakiegoś wirusa wykrywa w C\windows\system 32\... i nie da się go usunąć przez avasta bo pisze ,że do odczytu a ręcznie nie wiem czy mogę ? .A oprócz tego jak chcę włączyć menedżera urządzeń "menedżer zadań został wyłączony przez administratora".
proszę o pomoc pzdr
#8
Napisano 07 09 2008 - 20:52
SCSI\raid host controller.
To chyba to ????????????????
ComboFix 08-09-05.03 - x 2008-09-07 20:39:17.2 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.48.1045.18.1685 [GMT 2:00] Running from: C:\Documents and Settings\x\Pulpit\ComboFix.exe [color="red"][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED [img]http://www.forum.tweaks.pl/public/style_emoticons/default/excl.gif[/img][/b][/color] . ((((((((((((((((((((((((( Files Created from 2008-08-07 to 2008-09-07 ))))))))))))))))))))))))))))))) . 2008-09-07 20:33 . 2008-09-07 20:33 <DIR> d-------- C:\WINDOWS\system32\xircom 2008-09-07 20:33 . 2008-09-07 20:33 <DIR> d-------- C:\Program Files\microsoft frontpage 2008-09-07 18:55 . 2008-09-07 18:55 <DIR> d-------- C:\Documents and Settings\x\Dane aplikacji\Corel 2008-09-07 18:23 . 1999-02-17 13:49 1,039,360 -ra------ C:\WINDOWS\system32\MSJET35.DLL 2008-09-07 18:23 . 1998-09-25 13:18 607,744 --------- C:\WINDOWS\system32\Decslib.dll 2008-09-07 18:23 . 1999-02-17 13:49 368,912 -ra------ C:\WINDOWS\system32\VBAR332.DLL 2008-09-07 18:21 . 1997-07-30 16:21 553,984 --------- C:\WINDOWS\system32\rave.dll 2008-09-07 18:21 . 1999-07-22 13:47 211,456 --------- C:\WINDOWS\system32\qd3d_ir2.q3x 2008-09-07 18:21 . 1998-11-03 12:10 112,688 --------- C:\WINDOWS\system32\shw32.dll 2008-09-07 18:21 . 1997-07-30 16:58 70,656 --------- C:\WINDOWS\system32\3dviewer.dll 2008-09-07 18:21 . 1996-12-10 14:21 39,095 --------- C:\WINDOWS\iccsigs.dat 2008-09-07 18:21 . 1999-03-08 08:53 28,252 --------- C:\WINDOWS\corelpf.lrs 2008-09-07 18:20 . 2008-09-07 18:20 <DIR> d-------- C:\WINDOWS\Profiles 2008-09-07 18:20 . 1999-07-22 13:47 909,824 --------- C:\WINDOWS\system32\qd3d.dll 2008-09-07 18:20 . 1999-07-21 21:14 245,760 --------- C:\WINDOWS\system32\Sccomp91.dll 2008-09-07 18:20 . 1999-08-09 11:35 225,280 --------- C:\WINDOWS\system32\Scint91.dll 2008-09-07 18:20 . 1998-12-10 09:42 168,448 --------- C:\WINDOWS\system32\Awrtl30.dll 2008-09-07 18:20 . 1999-08-09 11:35 110,592 --------- C:\WINDOWS\system32\Sccres91.dll 2008-09-07 18:20 . 1999-03-21 10:49 100,864 --------- C:\WINDOWS\system32\awpe.dll 2008-09-07 18:18 . 2008-09-07 19:54 <DIR> d-------- C:\WINDOWS\Corel 2008-09-07 12:28 . 2008-09-07 12:28 98,816 --a------ C:\WINDOWS\system32\r4h.e33 2008-09-07 12:28 . 2008-09-07 12:28 64,000 --a------ C:\WINDOWS\system32\fds.i386 2008-09-07 12:28 . 2008-09-07 12:28 21,504 --a------ C:\WINDOWS\system32\sof.586 2008-09-07 12:28 . 2008-09-07 12:28 14,848 --a------ C:\Documents and Settings\LocalService\Dane aplikacji\734310160.exe 2008-09-07 12:26 . 2002-01-01 00:34 <DIR> d-------- C:\Program Files\rhc95oj0ec4t 2008-09-07 12:26 . 2008-09-07 12:26 99,328 --a------ C:\WINDOWS\stfMeane27.exe 2008-09-07 12:26 . 2002-01-01 02:40 32,256 --a------ C:\WINDOWS\system32\drivers\Lfe44.sys 2008-09-07 12:26 . 2008-09-07 12:26 14,398 --a------ C:\WINDOWS\system32\dlds7.exe 2008-09-07 12:26 . 2008-09-07 12:26 13,962 --a------ C:\WINDOWS\system32\dlds6.exe 2008-09-07 12:26 . 2008-09-07 12:26 13,682 --a------ C:\WINDOWS\system32\dlds5.exe 2008-09-07 12:26 . 2008-09-07 12:26 9,590 --a------ C:\WINDOWS\system32\dlds2.exe 2008-09-07 12:26 . 2008-09-07 12:26 9,590 --a------ C:\WINDOWS\system32\dlds1.exe 2008-09-07 12:25 . 2008-09-07 12:25 579,584 --a--c--- C:\WINDOWS\system32\dllcache\user32.dll 2008-09-07 12:25 . 2008-09-07 12:25 249,856 --a------ C:\WINDOWS\system32\nvrsol32.dll 2008-09-07 12:25 . 2008-09-07 12:26 2 --a------ C:\2016849479 2008-09-07 12:22 . 2002-01-01 01:54 <DIR> d-------- C:\Program Files\free-downloads.net 2008-09-07 12:22 . 2008-09-07 12:22 <DIR> d-------- C:\Program Files\Conduit 2008-09-07 12:22 . 2008-09-07 12:22 <DIR> d-------- C:\Program Files\Alcohol Soft 2008-09-07 12:20 . 2008-09-07 12:20 716,272 --a------ C:\WINDOWS\system32\drivers\sptd.sys 2008-09-07 12:18 . 2008-09-07 12:18 <DIR> d-------- C:\WINDOWS\Downloaded Installations 2008-09-07 12:18 . 2008-09-07 12:18 <DIR> d-------- C:\Program Files\D-Tools 2008-09-07 12:18 . 2004-08-22 16:31 155,136 --a------ C:\WINDOWS\system32\drivers\d347bus.sys 2008-09-07 12:18 . 2004-08-22 16:31 5,248 --a------ C:\WINDOWS\system32\drivers\d347prt.sys 2008-09-06 23:18 . 2008-09-06 23:18 <DIR> d-------- C:\Program Files\VideoLAN 2008-09-06 23:17 . 2008-06-08 23:58 60,273 --a------ C:\WINDOWS\system32\pthreadGC2.dll 2008-09-06 23:15 . 2008-09-06 23:15 <DIR> d-------- C:\Documents and Settings\x\Dane aplikacji\vlc 2008-09-06 23:13 . 2008-09-06 23:13 <DIR> d-------- C:\Program Files\<a href="http://www.download.net.pl/105/K-Lite-Codec-Pack/">K-Lite Codec Pack</a> 2008-09-06 23:13 . 2008-09-06 23:13 <DIR> d-------- C:\Documents and Settings\x\Dane aplikacji\Media Player Classic 2008-09-06 12:08 . 2008-09-06 12:10 <DIR> d-------- C:\Program Files\Common Files\Adobe 2008-09-06 12:07 . 2008-09-06 12:07 <DIR> d-------- C:\WINDOWS\Cache 2008-09-06 11:07 . 2008-09-06 11:07 404 --a------ C:\WINDOWS\BRWMARK.INI 2008-09-06 11:07 . 2008-09-06 11:07 50 --a------ C:\WINDOWS\system32\bridf06a.dat 2008-09-06 11:07 . 2008-09-06 11:07 27 --a------ C:\WINDOWS\BRPP2KA.INI 2008-09-06 11:06 . 2008-09-06 11:07 <DIR> d-------- C:\Program Files\Brother 2008-09-06 11:06 . 2006-02-24 17:27 1,492,480 --a------ C:\WINDOWS\system32\BrWia06a.dll 2008-09-06 11:06 . 2004-12-03 01:26 188,416 --------- C:\WINDOWS\system32\PDRVINST.DLL 2008-09-06 11:06 . 2004-12-10 16:35 147,456 --------- C:\WINDOWS\brunin03.dll 2008-09-06 11:06 . 2005-06-02 01:09 86,016 --------- C:\WINDOWS\system32\BrWebIns.dll 2008-09-06 11:06 . 2005-06-02 01:08 69,632 --------- C:\WINDOWS\system32\BRWEBUP.EXE 2008-09-06 11:06 . 2006-02-27 10:09 54,272 --a------ C:\WINDOWS\system32\brinsstr.dll 2008-09-06 11:06 . 2005-12-13 10:53 38,912 --a------ C:\WINDOWS\system32\BrUsi06a.dll 2008-09-06 11:06 . 2004-10-15 12:50 15,295 --a------ C:\WINDOWS\system32\drivers\BrScnUsb.sys 2008-09-06 11:06 . 2004-10-21 01:00 6,222 --------- C:\WINDOWS\CVRPAGE.BMP 2008-09-06 11:05 . 2008-09-06 11:05 <DIR> d-------- C:\Program Files\ScanSoft 2008-09-06 11:05 . 2008-09-06 11:05 <DIR> d-------- C:\Program Files\Common Files\ScanSoft Shared 2008-09-06 11:05 . 2008-09-06 11:05 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\ScanSoft 2008-09-06 11:05 . 2008-09-06 11:05 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\InstallShield 2008-09-06 11:05 . 2003-09-24 11:36 27,019 --a------ C:\WINDOWS\maxlink.ini 2008-09-06 11:04 . 2008-09-06 11:04 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Brother 2008-09-06 11:02 . 2006-09-13 18:18 25,856 --a------ C:\WINDOWS\system32\drivers\usbprint.sys 2008-09-06 11:01 . 2004-08-03 23:08 31,616 --a------ C:\WINDOWS\system32\drivers\usbccgp.sys 2008-09-05 18:34 . 2008-09-06 23:31 <DIR> d-------- C:\Program Files\NAPI-PROJEKT 2008-09-05 18:34 . 2008-09-05 18:34 <DIR> d-------- C:\Program Files\ALLPlayer 2008-09-05 15:52 . 2008-09-05 15:52 98,304 --a------ C:\WINDOWS\system32\CmdLineExt.dll 2008-09-05 12:58 . 2008-09-05 12:58 940,794 --a------ C:\WINDOWS\system32\LoopyMusic.wav 2008-09-05 12:58 . 2008-09-05 12:58 146,650 --a------ C:\WINDOWS\system32\BuzzingBee.wav 2008-09-05 12:57 . 2008-09-05 12:57 <DIR> d-------- C:\WINDOWS\system32\Lang 2008-09-04 22:40 . 2007-03-23 21:04 4,423,680 -ra------ C:\WINDOWS\RtHDVCpl.exe 2008-09-04 22:40 . 2007-03-21 20:58 1,844,224 -ra------ C:\WINDOWS\system32\RtkAPO.dll 2008-09-04 22:40 . 2007-03-26 21:18 1,761,696 -ra------ C:\WINDOWS\system32\drivers\RTKVHDA.sys 2008-09-04 22:40 . 2007-03-14 19:10 495,104 -ra------ C:\WINDOWS\system32\RtkPgExt.dll 2008-09-04 22:40 . 2006-12-13 12:30 339,968 -ra------ C:\WINDOWS\system32\SRSTSXT.dll 2008-09-04 22:40 . 2007-03-23 17:34 266,240 -ra------ C:\WINDOWS\system32\RtkApoApi.dll 2008-09-04 22:40 . 2006-11-29 20:47 135,168 -ra------ C:\WINDOWS\system32\SRSWOW.dll 2008-09-04 22:40 . 2007-03-22 16:30 18,432 -ra------ C:\WINDOWS\system32\RtkCoInst.dll 2008-09-04 22:34 . 2005-05-03 20:43 69,632 -r------- C:\WINDOWS\Alcmtr.exe 2008-09-04 22:27 . 2008-09-07 20:16 15,121 --a------ C:\WINDOWS\Ascd_tmp.ini 2008-09-04 22:06 . 2008-09-04 22:06 <DIR> d-------- C:\WINDOWS\system32\pl-PL 2008-09-04 22:05 . 2008-09-04 22:06 <DIR> d-------- C:\WINDOWS\system32\XPSViewer 2008-09-04 22:05 . 2008-09-04 22:05 <DIR> d-------- C:\Program Files\Reference Assemblies 2008-09-04 22:05 . 2008-09-04 22:05 <DIR> d-------- C:\Program Files\MSBuild 2008-09-04 22:05 . 2006-06-29 13:07 14,048 --------- C:\WINDOWS\system32\spmsg2.dll 2008-09-04 22:03 . 2008-09-04 22:03 <DIR> d-------- C:\Program Files\MSXML 6.0 2008-09-04 21:47 . 2008-09-04 21:47 <DIR> d-------- C:\Program Files\MoorHunt 2008-09-04 21:18 . 2008-09-04 21:18 <DIR> d-------- C:\Program Files\Nowe Gadu-Gadu 2008-09-04 21:18 . 2008-09-04 21:20 <DIR> d-------- C:\Documents and Settings\x\Dane aplikacji\Nowe Gadu-Gadu . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-09-07 14:12 163,644 ----a-w C:\WINDOWS\system32\drivers\secdrv.sys 2008-09-07 10:25 579,584 ----a-w C:\WINDOWS\system32\user32.DLL 2008-09-07 10:25 17,408 ----a-w C:\WINDOWS\system32\svchost.exe 2008-09-06 09:06 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-09-06 09:06 --------- d-----w C:\Program Files\Common Files\InstallShield 2008-09-04 20:33 --------- d-----w C:\Program Files\Realtek 2008-09-04 16:14 --------- d-----w C:\Program Files\Alwil Software 2008-09-04 15:38 --------- d-----w C:\Program Files\Attansic 2008-09-04 15:36 315,392 ----a-w C:\WINDOWS\HideWin.exe 2008-09-04 15:28 --------- d-----w C:\Program Files\Intel 2008-09-04 15:08 --------- d-----w C:\Program Files\Usługi online 2008-07-25 08:34 81,920 ----a-w C:\WINDOWS\system32\dpl100.dll 2008-07-25 08:34 683,520 ----a-w C:\WINDOWS\system32\divx.dll 2008-07-23 16:50 3,596,288 ----a-w C:\WINDOWS\system32\qt-dx331.dll 2008-06-12 18:36 7,680 ----a-w C:\WINDOWS\system32\ff_vfw.dll 2006-06-23 22:48 32,768 ----a-r C:\WINDOWS\inf\UpdateUSB.exe . [color="red"] C:\WINDOWS\system32\user32.dll ... is infected [img]http://www.forum.tweaks.pl/public/style_emoticons/default/excl.gif[/img] (additional data below) [/color] 579,584 2008-09-07 10:25:30 C:\WINDOWS\system32\user32.DLL 579,584 2008-09-07 10:25:30 C:\WINDOWS\system32\dllcache\user32.dll ------- Sigcheck ------- md5deep: C:\WINDOWS\system32\svchost.exe: Permission denied 2008-09-07 12:25 579584 f9209f4d92610f3d38a47c27c6b9ea38 C:\WINDOWS\system32\user32.DLL 2008-09-07 12:25 579584 f9209f4d92610f3d38a47c27c6b9ea38 C:\WINDOWS\system32\dllcache\user32.dll md5deep: C:\WINDOWS\system32\winlogon.exe: Permission denied md5deep: C:\WINDOWS\explorer.exe: Permission denied md5deep: C:\WINDOWS\system32\services.exe: Permission denied md5deep: C:\WINDOWS\system32\lsass.exe: Permission denied . ((((((((((((((((((((((((((((( snapshot@2008-09-07_20.33.59.26 ))))))))))))))))))))))))))))))))))))))))) . + 2008-09-07 18:36:41 16,384 ----atw C:\WINDOWS\Temp\Perflib_Perfdata_65c.dat . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks] "{ecdee021-0d17-467f-a1ff-c7a115230949}"= "C:\Program Files\free-downloads.net\tbfree.dll" [2008-02-14 1555480] [HKEY_CLASSES_ROOT\clsid\{ecdee021-0d17-467f-a1ff-c7a115230949}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{ecdee021-0d17-467f-a1ff-c7a115230949}] 2008-02-14 15:54 1555480 --a------ C:\Program Files\free-downloads.net\tbfree.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar] "{ecdee021-0d17-467f-a1ff-c7a115230949}"= "C:\Program Files\free-downloads.net\tbfree.dll" [2008-02-14 1555480] [HKEY_CLASSES_ROOT\clsid\{ecdee021-0d17-467f-a1ff-c7a115230949}] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar] "{ECDEE021-0D17-467F-A1FF-C7A115230949}"= "C:\Program Files\free-downloads.net\tbfree.dll" [2008-02-14 1555480] [HKEY_CLASSES_ROOT\clsid\{ecdee021-0d17-467f-a1ff-c7a115230949}] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "36X Raid Configurer"="C:\WINDOWS\system32\xRaidSetup.exe" [2007-03-21 1953792] "SSBkgdUpdate"="C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2003-10-14 155648] "PaperPort PTD"="C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe" [2005-03-17 57393] "IndexSearch"="C:\Program Files\ScanSoft\PaperPort\IndexSearch.exe" [2005-03-17 40960] "BrMfcWnd"="C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe" [2006-03-28 622592] "SetDefPrt"="C:\Program Files\Brother\Brmfl06a\BrStDvPt.exe" [2005-01-26 49152] "ControlCenter3"="C:\Program Files\Brother\ControlCenter3\brctrcen.exe" [2006-04-10 61440] "DAEMON Tools-1033"="C:\Program Files\D-Tools\daemon.exe" [2004-08-22 81920] "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-04-19 7700480] "RTHDCPL"="RTHDCPL.EXE" [2007-03-21 C:\WINDOWS\RTHDCPL.exe] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce] "nltide_3"="advpack.dll" [2004-08-04 C:\WINDOWS\system32\advpack.dll] C:\Documents and Settings\x\Menu Start\Programy\Autostart\ Rejestrowanie produkt˘w Corela.lnk - D:\corel\Register\Remind32.exe [2008-09-07 67584] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "VIDC.YV12"= yv12vfw.dll [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lfe44.sys] @="Driver" [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "C:\\Program Files\\Nowe Gadu-Gadu\\gg.exe"= "C:\\WINDOWS\\system32\\winver.exe"= R0 Lfe44;Lfe44;C:\WINDOWS\system32\Drivers\Lfe44.sys [2002-01-01 32256] R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-07-19 78416] R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-07-19 20560] R3 AtcL001;NDIS Miniport Driver for Attansic L1 Gigabit Ethernet Controller;C:\WINDOWS\system32\DRIVERS\atl01_xp.sys [2007-03-15 38656] S3 restore;restore;C:\WINDOWS\system32\drivers\restore.sys [ ] S3 USBSTOR;Sterownik magazynu masowego USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-03 26496] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{d5b6be3c-7cc6-11dd-8472-001e8c548cc6}] \Shell\AutoRun\command - F:\Autorun.exe . . ------- Supplementary Scan ------- . FireFox -: Profile - C:\Documents and Settings\x\Dane aplikacji\Mozilla\Firefox\Profiles\98waxic3.default\ FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://google.pl FF -: plugin - C:\Program Files\Adobe\Acrobat 6.0 CE\Reader\browser\nppdf32.dll FF -: plugin - C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, [url="http://www.gmer.net"]http://www.gmer.net[/url] Rootkit scan 2008-09-07 20:40:06 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . --------------------- DLLs Loaded Under Running Processes --------------------- -> C:\WINDOWS\system32\winlogon.exe -> C:\WINDOWS\system32\lsass.exe . Completion time: 2008-09-07 20:40:24 ComboFix-quarantined-files.txt 2008-09-07 18:40:22 ComboFix2.txt 2008-09-07 18:34:13 Pre-Run: 2,913,361,920 bajtów wolnych Post-Run: 2,905,149,440 bajtów wolnych 215
#9
Napisano 08 09 2008 - 16:19
//Poczekaj, aż ktoś sprawdzi logi.
//diablo45
#10
Napisano 08 09 2008 - 23:02
Po Kasperskym daj nowego loga z ComboFix.
#11
Napisano 09 09 2008 - 16:15
ComboFix 08-09-05.03 - x 2008-09-09 16:08:18.3 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.48.1045.18.1710 [GMT 2:00] Running from: C:\Documents and Settings\x\Pulpit\ComboFix.exe [color="red"][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED [img]http://www.forum.tweaks.pl/public/style_emoticons/default/excl.gif[/img][/b][/color] . ((((((((((((((((((((((((( Files Created from 2008-08-09 to 2008-09-09 ))))))))))))))))))))))))))))))) . 2008-09-09 14:27 . 2008-09-09 16:05 1,134,624 --ahs---- C:\WINDOWS\system32\drivers\fidbox.dat 2008-09-09 14:27 . 2008-09-09 16:05 15,416 --ahs---- C:\WINDOWS\system32\drivers\fidbox.idx 2008-09-07 20:33 . 2008-09-07 20:33 <DIR> d-------- C:\WINDOWS\system32\xircom 2008-09-07 20:33 . 2008-09-07 20:33 <DIR> d-------- C:\Program Files\microsoft frontpage 2008-09-07 18:55 . 2008-09-08 18:10 <DIR> d-------- C:\Documents and Settings\x\Dane aplikacji\Corel 2008-09-07 18:23 . 1999-02-17 13:49 1,039,360 -ra------ C:\WINDOWS\system32\MSJET35.DLL 2008-09-07 18:23 . 1998-09-25 13:18 607,744 --------- C:\WINDOWS\system32\Decslib.dll 2008-09-07 18:23 . 1999-02-17 13:49 368,912 -ra------ C:\WINDOWS\system32\VBAR332.DLL 2008-09-07 18:21 . 1997-07-30 16:21 553,984 --------- C:\WINDOWS\system32\rave.dll 2008-09-07 18:21 . 1999-07-22 13:47 211,456 --------- C:\WINDOWS\system32\qd3d_ir2.q3x 2008-09-07 18:21 . 1998-11-03 12:10 112,688 --------- C:\WINDOWS\system32\shw32.dll 2008-09-07 18:21 . 1997-07-30 16:58 70,656 --------- C:\WINDOWS\system32\3dviewer.dll 2008-09-07 18:21 . 1996-12-10 14:21 39,095 --------- C:\WINDOWS\iccsigs.dat 2008-09-07 18:21 . 1999-03-08 08:53 28,252 --------- C:\WINDOWS\corelpf.lrs 2008-09-07 18:20 . 2008-09-07 18:20 <DIR> d-------- C:\WINDOWS\Profiles 2008-09-07 18:20 . 1999-07-22 13:47 909,824 --------- C:\WINDOWS\system32\qd3d.dll 2008-09-07 18:20 . 1999-07-21 21:14 245,760 --------- C:\WINDOWS\system32\Sccomp91.dll 2008-09-07 18:20 . 1999-08-09 11:35 225,280 --------- C:\WINDOWS\system32\Scint91.dll 2008-09-07 18:20 . 1998-12-10 09:42 168,448 --------- C:\WINDOWS\system32\Awrtl30.dll 2008-09-07 18:20 . 1999-08-09 11:35 110,592 --------- C:\WINDOWS\system32\Sccres91.dll 2008-09-07 18:20 . 1999-03-21 10:49 100,864 --------- C:\WINDOWS\system32\awpe.dll 2008-09-07 18:18 . 2008-09-07 19:54 <DIR> d-------- C:\WINDOWS\Corel 2008-09-07 12:28 . 2008-09-07 12:28 98,816 --a------ C:\WINDOWS\system32\r4h.e33 2008-09-07 12:28 . 2008-09-07 12:28 64,000 --a------ C:\WINDOWS\system32\fds.i386 2008-09-07 12:28 . 2008-09-07 12:28 21,504 --a------ C:\WINDOWS\system32\sof.586 2008-09-07 12:28 . 2008-09-07 12:28 14,848 --a------ C:\Documents and Settings\LocalService\Dane aplikacji\734310160.exe 2008-09-07 12:26 . 2002-01-01 00:34 <DIR> d-------- C:\Program Files\rhc95oj0ec4t 2008-09-07 12:25 . 2008-09-09 15:26 579,584 --a--c--- C:\WINDOWS\system32\dllcache\user32.dll 2008-09-07 12:25 . 2008-09-07 12:25 249,856 --a------ C:\WINDOWS\system32\nvrsol32.dll 2008-09-07 12:25 . 2008-09-07 12:26 2 --a------ C:\2016849479 2008-09-07 12:22 . 2002-01-01 01:54 <DIR> d-------- C:\Program Files\free-downloads.net 2008-09-07 12:22 . 2008-09-07 12:22 <DIR> d-------- C:\Program Files\Conduit 2008-09-07 12:22 . 2008-09-07 12:22 <DIR> d-------- C:\Program Files\Alcohol Soft 2008-09-07 12:20 . 2008-09-07 12:20 716,272 --a------ C:\WINDOWS\system32\drivers\sptd.sys 2008-09-07 12:18 . 2008-09-07 12:18 <DIR> d-------- C:\WINDOWS\Downloaded Installations 2008-09-07 12:18 . 2008-09-07 12:18 <DIR> d-------- C:\Program Files\D-Tools 2008-09-07 12:18 . 2004-08-22 16:31 155,136 --a------ C:\WINDOWS\system32\drivers\d347bus.sys 2008-09-07 12:18 . 2004-08-22 16:31 5,248 --a------ C:\WINDOWS\system32\drivers\d347prt.sys 2008-09-06 23:18 . 2008-09-06 23:18 <DIR> d-------- C:\Program Files\VideoLAN 2008-09-06 23:17 . 2008-06-08 23:58 60,273 --a------ C:\WINDOWS\system32\pthreadGC2.dll 2008-09-06 23:15 . 2008-09-06 23:15 <DIR> d-------- C:\Documents and Settings\x\Dane aplikacji\vlc 2008-09-06 23:13 . 2008-09-06 23:13 <DIR> d-------- C:\Program Files\K-Lite Codec Pack 2008-09-06 23:13 . 2008-09-06 23:13 <DIR> d-------- C:\Documents and Settings\x\Dane aplikacji\Media Player Classic 2008-09-06 12:08 . 2008-09-06 12:10 <DIR> d-------- C:\Program Files\Common Files\Adobe 2008-09-06 12:07 . 2008-09-06 12:07 <DIR> d-------- C:\WINDOWS\Cache 2008-09-06 11:07 . 2008-09-06 11:07 404 --a------ C:\WINDOWS\BRWMARK.INI 2008-09-06 11:07 . 2008-09-06 11:07 50 --a------ C:\WINDOWS\system32\bridf06a.dat 2008-09-06 11:07 . 2008-09-06 11:07 27 --a------ C:\WINDOWS\BRPP2KA.INI 2008-09-06 11:06 . 2008-09-06 11:07 <DIR> d-------- C:\Program Files\Brother 2008-09-06 11:06 . 2006-02-24 17:27 1,492,480 --a------ C:\WINDOWS\system32\BrWia06a.dll 2008-09-06 11:06 . 2004-12-03 01:26 188,416 --------- C:\WINDOWS\system32\PDRVINST.DLL 2008-09-06 11:06 . 2004-12-10 16:35 147,456 --------- C:\WINDOWS\brunin03.dll 2008-09-06 11:06 . 2005-06-02 01:09 86,016 --------- C:\WINDOWS\system32\BrWebIns.dll 2008-09-06 11:06 . 2005-06-02 01:08 69,632 --------- C:\WINDOWS\system32\BRWEBUP.EXE 2008-09-06 11:06 . 2006-02-27 10:09 54,272 --a------ C:\WINDOWS\system32\brinsstr.dll 2008-09-06 11:06 . 2005-12-13 10:53 38,912 --a------ C:\WINDOWS\system32\BrUsi06a.dll 2008-09-06 11:06 . 2004-10-15 12:50 15,295 --a------ C:\WINDOWS\system32\drivers\BrScnUsb.sys 2008-09-06 11:06 . 2004-10-21 01:00 6,222 --------- C:\WINDOWS\CVRPAGE.BMP 2008-09-06 11:05 . 2008-09-06 11:05 <DIR> d-------- C:\Program Files\ScanSoft 2008-09-06 11:05 . 2008-09-06 11:05 <DIR> d-------- C:\Program Files\Common Files\ScanSoft Shared 2008-09-06 11:05 . 2008-09-06 11:05 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\ScanSoft 2008-09-06 11:05 . 2008-09-06 11:05 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\InstallShield 2008-09-06 11:05 . 2003-09-24 11:36 27,019 --a------ C:\WINDOWS\maxlink.ini 2008-09-06 11:04 . 2008-09-06 11:04 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Brother 2008-09-06 11:02 . 2006-09-13 18:18 25,856 --a------ C:\WINDOWS\system32\drivers\usbprint.sys 2008-09-06 11:01 . 2004-08-03 23:08 31,616 --a------ C:\WINDOWS\system32\drivers\usbccgp.sys 2008-09-05 18:34 . 2008-09-08 15:36 <DIR> d-------- C:\Program Files\NAPI-PROJEKT 2008-09-05 18:34 . 2008-09-05 18:34 <DIR> d-------- C:\Program Files\ALLPlayer 2008-09-05 15:52 . 2008-09-05 15:52 98,304 --a------ C:\WINDOWS\system32\CmdLineExt.dll 2008-09-05 12:58 . 2008-09-05 12:58 940,794 --a------ C:\WINDOWS\system32\LoopyMusic.wav 2008-09-05 12:58 . 2008-09-05 12:58 146,650 --a------ C:\WINDOWS\system32\BuzzingBee.wav 2008-09-05 12:57 . 2008-09-05 12:57 <DIR> d-------- C:\WINDOWS\system32\Lang 2008-09-04 22:40 . 2007-03-23 21:04 4,423,680 -ra------ C:\WINDOWS\RtHDVCpl.exe 2008-09-04 22:40 . 2007-03-21 20:58 1,844,224 -ra------ C:\WINDOWS\system32\RtkAPO.dll 2008-09-04 22:40 . 2007-03-26 21:18 1,761,696 -ra------ C:\WINDOWS\system32\drivers\RTKVHDA.sys 2008-09-04 22:40 . 2007-03-14 19:10 495,104 -ra------ C:\WINDOWS\system32\RtkPgExt.dll 2008-09-04 22:40 . 2006-12-13 12:30 339,968 -ra------ C:\WINDOWS\system32\SRSTSXT.dll 2008-09-04 22:40 . 2007-03-23 17:34 266,240 -ra------ C:\WINDOWS\system32\RtkApoApi.dll 2008-09-04 22:40 . 2006-11-29 20:47 135,168 -ra------ C:\WINDOWS\system32\SRSWOW.dll 2008-09-04 22:40 . 2007-03-22 16:30 18,432 -ra------ C:\WINDOWS\system32\RtkCoInst.dll 2008-09-04 22:34 . 2005-05-03 20:43 69,632 -r------- C:\WINDOWS\Alcmtr.exe 2008-09-04 22:27 . 2008-09-07 20:16 15,121 --a------ C:\WINDOWS\Ascd_tmp.ini 2008-09-04 22:06 . 2008-09-04 22:06 <DIR> d-------- C:\WINDOWS\system32\pl-PL 2008-09-04 22:05 . 2008-09-04 22:06 <DIR> d-------- C:\WINDOWS\system32\XPSViewer 2008-09-04 22:05 . 2008-09-04 22:05 <DIR> d-------- C:\Program Files\Reference Assemblies 2008-09-04 22:05 . 2008-09-04 22:05 <DIR> d-------- C:\Program Files\MSBuild 2008-09-04 22:05 . 2006-06-29 13:07 14,048 --------- C:\WINDOWS\system32\spmsg2.dll 2008-09-04 22:03 . 2008-09-04 22:03 <DIR> d-------- C:\Program Files\MSXML 6.0 2008-09-04 21:47 . 2008-09-04 21:47 <DIR> d-------- C:\Program Files\MoorHunt 2008-09-04 21:18 . 2008-09-04 21:18 <DIR> d-------- C:\Program Files\Nowe Gadu-Gadu 2008-09-04 21:18 . 2008-09-04 21:20 <DIR> d-------- C:\Documents and Settings\x\Dane aplikacji\Nowe Gadu-Gadu . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-09-08 13:08 504,832 ----a-w C:\WINDOWS\system32\winlogon.exe 2008-09-08 13:07 14,336 ----a-w C:\WINDOWS\system32\svchost.exe 2008-09-08 13:07 13,312 ----a-w C:\WINDOWS\system32\lsass.exe 2008-09-08 13:07 108,544 ----a-w C:\WINDOWS\system32\services.exe 2008-09-08 13:04 1,033,728 ----a-w C:\WINDOWS\explorer.exe 2008-09-07 14:12 163,644 ----a-w C:\WINDOWS\system32\drivers\secdrv.sys 2008-09-07 10:25 579,584 ----a-w C:\WINDOWS\system32\user32.DLL 2008-09-06 09:06 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-09-06 09:06 --------- d-----w C:\Program Files\Common Files\InstallShield 2008-09-04 20:33 --------- d-----w C:\Program Files\Realtek 2008-09-04 16:14 --------- d-----w C:\Program Files\Alwil Software 2008-09-04 15:38 --------- d-----w C:\Program Files\Attansic 2008-09-04 15:36 315,392 ----a-w C:\WINDOWS\HideWin.exe 2008-09-04 15:28 --------- d-----w C:\Program Files\Intel 2008-09-04 15:08 --------- d-----w C:\Program Files\Usługi online 2008-07-25 08:34 81,920 ----a-w C:\WINDOWS\system32\dpl100.dll 2008-07-25 08:34 683,520 ----a-w C:\WINDOWS\system32\divx.dll 2008-07-23 16:50 3,596,288 ----a-w C:\WINDOWS\system32\qt-dx331.dll 2008-06-12 18:36 7,680 ----a-w C:\WINDOWS\system32\ff_vfw.dll 2006-06-23 22:48 32,768 ----a-r C:\WINDOWS\inf\UpdateUSB.exe . [color="red"] C:\WINDOWS\system32\user32.dll ... is infected [img]http://www.forum.tweaks.pl/public/style_emoticons/default/excl.gif[/img] (additional data below) [/color] 579,584 2008-09-07 10:25:30 C:\WINDOWS\system32\user32.DLL 579,584 2008-09-09 13:26:10 C:\WINDOWS\system32\dllcache\user32.dll ------- Sigcheck ------- 2008-09-07 12:25 579584 f9209f4d92610f3d38a47c27c6b9ea38 C:\WINDOWS\system32\user32.DLL 2008-09-09 15:26 579584 11abdecc02efc1d2b6a6a0fa46c26594 C:\WINDOWS\system32\dllcache\user32.dll . ((((((((((((((((((((((((((((( snapshot@2008-09-07_20.33.59.26 ))))))))))))))))))))))))))))))))))))))))) . + 2008-09-09 14:06:27 16,384 ----atw C:\WINDOWS\Temp\Perflib_Perfdata_650.dat . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks] "{ecdee021-0d17-467f-a1ff-c7a115230949}"= "C:\Program Files\free-downloads.net\tbfree.dll" [2008-02-14 1555480] [HKEY_CLASSES_ROOT\clsid\{ecdee021-0d17-467f-a1ff-c7a115230949}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{ecdee021-0d17-467f-a1ff-c7a115230949}] 2008-02-14 15:54 1555480 --a------ C:\Program Files\free-downloads.net\tbfree.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar] "{ecdee021-0d17-467f-a1ff-c7a115230949}"= "C:\Program Files\free-downloads.net\tbfree.dll" [2008-02-14 1555480] [HKEY_CLASSES_ROOT\clsid\{ecdee021-0d17-467f-a1ff-c7a115230949}] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar] "{ECDEE021-0D17-467F-A1FF-C7A115230949}"= "C:\Program Files\free-downloads.net\tbfree.dll" [2008-02-14 1555480] [HKEY_CLASSES_ROOT\clsid\{ecdee021-0d17-467f-a1ff-c7a115230949}] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "36X Raid Configurer"="C:\WINDOWS\system32\xRaidSetup.exe" [2007-03-21 1953792] "SSBkgdUpdate"="C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2003-10-14 155648] "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-04-19 7700480] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce] "nltide_3"="advpack.dll" [2004-08-04 C:\WINDOWS\system32\advpack.dll] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "VIDC.YV12"= yv12vfw.dll [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lfe44.sys] @="Driver" [HKLM\~\startupfolder\C:^Documents and Settings^x^Menu Start^Programy^Autostart^Rejestrowanie produktów Corela.lnk] path=C:\Documents and Settings\x\Menu Start\Programy\Autostart\Rejestrowanie produktów Corela.lnk backup=C:\WINDOWS\pss\Rejestrowanie produktów Corela.lnkStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BrMfcWnd] -r------- 2006-03-28 15:48 622592 C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ControlCenter3] --------- 2006-04-10 14:58 61440 C:\Program Files\Brother\ControlCenter3\BrCtrCen.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools-1033] --a------ 2004-08-22 17:05 81920 C:\Program Files\D-Tools\daemon.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IndexSearch] --a------ 2005-03-17 14:45 40960 C:\Program Files\ScanSoft\PaperPort\IndexSearch.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PaperPort PTD] --a------ 2005-03-17 14:25 57393 C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SetDefPrt] --a------ 2005-01-26 18:02 49152 C:\Program Files\Brother\Brmfl06a\BrStDvPt.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RTHDCPL] -r------- 2007-03-21 16:49 16126464 C:\WINDOWS\RTHDCPL.exe [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "C:\\Program Files\\Nowe Gadu-Gadu\\gg.exe"= "C:\\WINDOWS\\system32\\winver.exe"= R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-07-19 78416] R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-07-19 20560] R3 AtcL001;NDIS Miniport Driver for Attansic L1 Gigabit Ethernet Controller;C:\WINDOWS\system32\DRIVERS\atl01_xp.sys [2007-03-15 38656] R3 USBSTOR;Sterownik magazynu masowego USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-03 26496] S3 restore;restore;C:\WINDOWS\system32\drivers\restore.sys [ ] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{d5b6be3c-7cc6-11dd-8472-001e8c548cc6}] \Shell\AutoRun\command - F:\Autorun.exe . . ------- Supplementary Scan ------- . FireFox -: Profile - C:\Documents and Settings\x\Dane aplikacji\Mozilla\Firefox\Profiles\98waxic3.default\ FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://google.pl FF -: plugin - C:\Program Files\Adobe\Acrobat 6.0 CE\Reader\browser\nppdf32.dll FF -: plugin - C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, [url="http://www.gmer.net"]http://www.gmer.net[/url] Rootkit scan 2008-09-09 16:09:05 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2008-09-09 16:09:24 ComboFix-quarantined-files.txt 2008-09-09 14:09:22 ComboFix2.txt 2008-09-07 18:40:25 ComboFix3.txt 2008-09-07 18:34:13 Pre-Run: 6,191,394,816 bajtów wolnych Post-Run: 6,186,889,216 bajtów wolnych 213
a jeszcze w menedże urządzń mi wykrzyknik wyskakuje na SCSI\raid host controller i nie wiem jaki sterownik jest zły??
//Logi wstawiaj w tagi [code=auto:0]
//Upominam już drugi raz...
//diablo45
#12
Napisano 09 09 2008 - 19:54
Files:: C:\WINDOWS\system32\r4h.e33 C:\WINDOWS\system32\fds.i386 C:\WINDOWS\system32\sof.586 Folder:: C:\Program Files\rhc95oj0ec4t C:\2016849479
>>Plik>>Zapisz jako... >>> CFScript (najwygodniej będzie, jeśli zapiszesz w takiej lokalizacji, by ikonka CFScript.txt znalazła się obok ikonki ComboFix.exe)
Przeciągnij i upuść plik CFScript.txt na plik ComboFix.exe (czyli ikonkę CFScript.txt na ikonkę ComboFix.exe)
– podobnie jak na tym obrazku -->
(jeśli pojawi się pytanie "1 or 2" - to wpisz 1 i naciśnij ENTER) Ma się rozpocząć usuwanie. (i powstanie log)
Po restarcie usuń ręcznie folder C: \Qoobox.
Po wykonaniu tego daj nowego loga combofix.
#13
Napisano 09 09 2008 - 21:37
ComboFix 08-09-05.09 - dawidek 2008-09-08 20:17:36.1 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.2.1250.1.1045.18.661 [GMT 2:00] Running from: C:\Documents and Settings\dawidek\Pulpit\ComboFix.exe * Created a new restore point * Resident AV is active [color="red"][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED [img]http://www.forum.tweaks.pl/public/style_emoticons/default/excl.gif[/img][/b][/color] . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\Documents and Settings\dawidek\Cookies\dawidek@oczyszczaczkomputerza[2].txt C:\Documents and Settings\dawidek\Pulpit\Error Cleaner.url C:\Documents and Settings\dawidek\Pulpit\Privacy Protector.url C:\Documents and Settings\dawidek\Pulpit\Spyware&Malware Protection.url C:\Documents and Settings\dawidek\Ulubione\Error Cleaner.url C:\Documents and Settings\dawidek\Ulubione\Privacy Protector.url C:\Documents and Settings\dawidek\Ulubione\Spyware&Malware Protection.url C:\Documents and Settings\Sebastian\Pulpit\Error Cleaner.url C:\Documents and Settings\Sebastian\Pulpit\Privacy Protector.url C:\Documents and Settings\Sebastian\Pulpit\Spyware&Malware Protection.url C:\Documents and Settings\Sebastian\Ulubione\Error Cleaner.url C:\Documents and Settings\Sebastian\Ulubione\Privacy Protector.url C:\Documents and Settings\Sebastian\Ulubione\Spyware&Malware Protection.url C:\Program Files\PCHealthCenter\[u]0[/u].exe C:\Program Files\PCHealthCenter\[u]0[/u].gif C:\Program Files\PCHealthCenter\1.exe C:\Program Files\PCHealthCenter\1.gif C:\Program Files\PCHealthCenter\1.ico C:\Program Files\PCHealthCenter\2.exe C:\Program Files\PCHealthCenter\2.gif C:\Program Files\PCHealthCenter\2.ico C:\Program Files\PCHealthCenter\3.exe C:\Program Files\PCHealthCenter\3.gif C:\Program Files\PCHealthCenter\4.exe C:\Program Files\PCHealthCenter\5.exe C:\Program Files\PCHealthCenter\7.exe C:\Program Files\PCHealthCenter\sc.html C:\Program Files\VirusRemover2008 C:\WINDOWS\dgksvbpn.dll C:\WINDOWS\eqen.exe C:\WINDOWS\gksraemq.dll C:\WINDOWS\privacy_danger C:\WINDOWS\privacy_danger\images\capt.gif C:\WINDOWS\privacy_danger\images\danger.jpg C:\WINDOWS\privacy_danger\images\down.gif C:\WINDOWS\privacy_danger\images\spacer.gif C:\WINDOWS\privacy_danger\index.htm C:\WINDOWS\system32\awtrSlig.dll C:\WINDOWS\system32\efcYpnnl.dll C:\WINDOWS\system32\geBqrooL.dll C:\WINDOWS\system32\gilSrtwa.ini C:\WINDOWS\system32\gilSrtwa.ini2 C:\WINDOWS\system32\lafovvwv.ini C:\WINDOWS\system32\mcrh.tmp C:\WINDOWS\system32\ncugfhyu.dll C:\WINDOWS\system32\nnnoMCSJ.dll C:\WINDOWS\system32\qbhanlad.ini C:\WINDOWS\system32\qoMEXRjG.dll C:\WINDOWS\system32\ubwmqfol.ini C:\WINDOWS\system32\uyhfgucn.ini C:\WINDOWS\vanwxemgato.dll C:\WINDOWS\xrdwbfgn.dll . ((((((((((((((((((((((((( Files Created from 2008-08-08 to 2008-09-08 ))))))))))))))))))))))))))))))) . 2008-09-07 21:35 . 2008-09-07 21:35 <DIR> d-------- C:\Documents and Settings\Sebastian\Dane aplikacji\VirusRemover2008 2008-09-07 21:35 . 2008-09-07 21:35 <DIR> d-------- C:\Documents and Settings\Sebastian\Dane aplikacji\TmpRecentIcons 2008-09-07 14:36 . 2008-09-07 14:36 <DIR> d-------- C:\Documents and Settings\dawidek\Dane aplikacji\VirusRemover2008 2008-09-07 11:54 . 2008-06-19 17:24 28,544 --a------ C:\WINDOWS\system32\drivers\pavboot.sys 2008-09-07 11:34 . 2008-09-07 11:34 <DIR> d-------- C:\Program Files\Panda Security 2008-09-07 11:31 . 2008-09-07 11:31 107,132 --a------ C:\WINDOWS\UninstallFirefox.exe 2008-09-07 11:31 . 2008-09-07 11:31 0 --a------ C:\WINDOWS\nsreg.dat 2008-09-07 11:30 . 2008-09-07 11:30 2,288 --a------ C:\WINDOWS\mozver.dat 2008-09-06 20:28 . 2008-09-06 21:01 <DIR> d-------- C:\WINDOWS\privacy_danger(2) 2008-09-06 19:06 . 2008-09-05 17:07 3,262 --a------ C:\WINDOWS\system32\2.ico 2008-09-06 19:04 . 2008-09-06 19:04 <DIR> d-------- C:\Program Files\Smart Antivirus 2009 2008-09-06 19:02 . 2008-09-08 20:23 <DIR> d-------- C:\Program Files\PCHealthCenter 2008-09-06 19:02 . 2008-09-07 21:29 <DIR> d-------- C:\Program Files\MSA 2008-09-06 19:02 . 2008-09-04 15:47 167,936 --a------ C:\WINDOWS\system32\MSa.cpl 2008-09-06 19:02 . 2008-09-06 16:09 94,208 --a------ C:\WINDOWS\sxmaokgf.exe 2008-09-06 19:02 . 2008-09-05 17:07 31,232 --a------ C:\x 2008-09-06 19:02 . 2008-09-05 17:07 3,262 --a------ C:\WINDOWS\system32\1.ico 2008-09-02 22:13 . 2008-09-03 08:32 <DIR> d-------- C:\WINDOWS\system32\CatRoot_bak 2008-09-01 18:05 . 2008-09-01 18:05 385 --a------ C:\WINDOWS\ODBC.INI 2008-09-01 18:04 . 2008-09-01 18:04 <DIR> d-------- C:\WINDOWS\SHELLNEW 2008-09-01 18:04 . 2008-09-01 18:04 <DIR> d-------- C:\Program Files\Microsoft ActiveSync 2008-08-31 18:48 . 2004-08-03 23:08 26,496 --a--c--- C:\WINDOWS\system32\dllcache\usbstor.sys 2008-08-31 17:35 . 2008-08-31 17:36 <DIR> d-------- C:\Program Files\NAPI-PROJEKT 2008-08-31 17:06 . 2008-08-31 17:07 <DIR> d-------- C:\Program Files\K-Lite Codec Pack 2008-08-31 17:06 . 2004-01-11 23:00 348,160 --a------ C:\WINDOWS\system32\msvcr71.dll 2008-08-30 22:30 . 2008-08-30 22:30 <DIR> d-------- C:\Documents and Settings\Sebastian\Dane aplikacji\skypePM 2008-08-30 22:30 . 2008-08-30 22:30 56 --ah----- C:\WINDOWS\system32\ezsidmv.dat 2008-08-30 22:27 . 2008-08-30 22:27 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Skype 2008-08-29 20:44 . 2008-08-29 20:44 <DIR> d-------- C:\Documents and Settings\dawidek\Dane aplikacji\Deckadance 2008-08-29 20:35 . 2008-08-29 20:40 <DIR> d-------- C:\Program Files\VstPlugins 2008-08-29 20:35 . 2008-08-29 20:35 <DIR> d-------- C:\Program Files\ASIO4ALL v2 2008-08-29 20:34 . 2008-08-29 20:34 <DIR> d-------- C:\Program Files\Outsim 2008-08-29 19:52 . 2008-08-29 19:52 1,720,086 --a------ C:\WINDOWS\system32\TmpA4009406 2008-08-29 19:43 . 2002-07-08 00:14 1,294,336 --a------ C:\WINDOWS\system32\vorbis.acm 2008-08-29 19:43 . 2006-06-20 10:56 225,280 --a------ C:\WINDOWS\system32\rewire.dll 2008-08-29 19:42 . 2008-08-29 20:41 <DIR> d-------- C:\Program Files\Image-Line 2008-08-29 19:41 . 2003-06-20 13:28 1,777,664 --a------ C:\WINDOWS\system32\gdiplus.dll 2008-08-29 19:05 . 2008-08-29 19:05 <DIR> d-------- C:\Program Files\Common Files\Adobe 2008-08-29 18:42 . 2008-08-29 18:42 <DIR> d-------- C:\Program Files\VirtualDJ 2008-08-28 13:24 . 2008-08-28 13:24 <DIR> d-------- C:\Program Files\Disney Interactive 2008-08-28 13:23 . 2008-08-28 13:23 <DIR> d-------- C:\Documents and Settings\Sebastian\WINDOWS 2008-08-28 13:23 . 2008-08-28 13:24 1,051 --a------ C:\WINDOWS\disney.ini 2008-08-28 13:23 . 2008-08-28 13:23 127 --a------ C:\WINDOWS\_delis43.ini 2008-08-26 22:06 . 2008-08-26 22:06 <DIR> d-------- C:\WINDOWS\new mario62 2008-08-26 22:06 . 2008-08-26 22:06 171,520 --a------ C:\WINDOWS\system32\cncs32.dll 2008-08-26 22:06 . 2008-08-26 22:06 18 --a------ C:\WINDOWS\gfact.ini 2008-08-26 21:55 . 2008-08-26 21:55 <DIR> d-------- C:\Program Files\TryMedia 2008-08-25 16:52 . 2008-08-24 15:28 <DIR> d--h----- C:\Documents and Settings\Rodzice\Ustawienia lokalne 2008-08-25 16:52 . 2008-08-25 16:52 <DIR> dr------- C:\Documents and Settings\Rodzice\Ulubione 2008-08-25 16:52 . 2008-08-24 13:35 <DIR> d--h----- C:\Documents and Settings\Rodzice\Szablony 2008-08-25 16:52 . 2008-08-24 15:28 <DIR> d-------- C:\Documents and Settings\Rodzice\Pulpit 2008-08-25 16:52 . 2008-08-25 16:52 <DIR> dr------- C:\Documents and Settings\Rodzice\Moje dokumenty 2008-08-25 16:52 . 2008-08-24 15:28 <DIR> dr------- C:\Documents and Settings\Rodzice\Menu Start 2008-08-25 16:52 . 2008-08-25 16:52 <DIR> d-------- C:\Documents and Settings\Rodzice\Dane aplikacji\SiteAdvisor 2008-08-25 16:52 . 2008-08-25 16:53 <DIR> dr-h----- C:\Documents and Settings\Rodzice\Dane aplikacji 2008-08-25 16:52 . 2008-09-06 21:01 <DIR> d-------- C:\Documents and Settings\Rodzice 2008-08-25 10:41 . 2008-08-25 10:44 <DIR> d-------- C:\Documents and Settings\Sebastian\Dane aplikacji\Winamp 2008-08-25 10:21 . 2008-08-25 10:21 <DIR> d-------- C:\Program Files\Winamp Toolbar 2008-08-25 10:21 . 2008-08-25 10:21 <DIR> d-------- C:\Program Files\Winamp Remote 2008-08-25 10:21 . 2008-08-25 10:21 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\OrbNetworks 2008-08-25 10:19 . 2008-08-25 10:24 <DIR> d-------- C:\Program Files\Winamp 2008-08-25 10:19 . 2008-08-25 10:24 <DIR> d-------- C:\Documents and Settings\dawidek\Dane aplikacji\Winamp 2008-08-25 10:00 . 2008-08-25 10:00 <DIR> d-------- C:\Documents and Settings\dawidek\Dane aplikacji\Gadu-Gadu 2008-08-24 23:02 . 2008-08-27 23:51 <DIR> d-------- C:\Documents and Settings\Sebastian\Gadu-Gadu 2008-08-24 23:02 . 2008-08-24 23:02 <DIR> d-------- C:\Documents and Settings\Sebastian\Dane aplikacji\Gadu-Gadu 2008-08-24 23:01 . 2008-08-24 23:01 <DIR> d-------- C:\Documents and Settings\Sebastian\Dane aplikacji\SiteAdvisor 2008-08-24 23:00 . 2008-08-24 15:28 <DIR> d--h----- C:\Documents and Settings\Sebastian\Ustawienia lokalne 2008-08-24 23:00 . 2008-09-08 20:19 <DIR> dr------- C:\Documents and Settings\Sebastian\Ulubione 2008-08-24 23:00 . 2008-08-24 13:35 <DIR> d--h----- C:\Documents and Settings\Sebastian\Szablony 2008-08-24 23:00 . 2008-09-08 20:19 <DIR> d-------- C:\Documents and Settings\Sebastian\Pulpit 2008-08-24 23:00 . 2008-08-27 23:16 <DIR> dr------- C:\Documents and Settings\Sebastian\Moje dokumenty 2008-08-24 23:00 . 2008-08-28 00:12 <DIR> dr------- C:\Documents and Settings\Sebastian\Menu Start 2008-08-24 23:00 . 2008-09-07 21:35 <DIR> dr-h----- C:\Documents and Settings\Sebastian\Dane aplikacji 2008-08-24 23:00 . 2008-09-06 21:01 <DIR> d-------- C:\Documents and Settings\Sebastian 2008-08-24 22:46 . 2008-08-24 22:46 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Winamp Toolbar 2008-08-24 22:34 . 2008-08-25 10:00 <DIR> d-------- C:\Documents and Settings\dawidek\Gadu-Gadu 2008-08-24 22:33 . 2008-08-27 23:45 <DIR> d-------- C:\Program Files\Gadu-Gadu 2008-08-24 22:25 . 2008-08-24 22:25 25 --a------ C:\WINDOWS\mixerdef.ini 2008-08-24 21:10 . 2004-08-03 23:15 145,792 --a------ C:\WINDOWS\system32\drivers\portcls.sys 2008-08-24 21:10 . 2004-08-03 23:15 145,792 --a--c--- C:\WINDOWS\system32\dllcache\portcls.sys 2008-08-24 21:10 . 2004-08-04 00:44 130,048 --a------ C:\WINDOWS\system32\ksproxy.ax 2008-08-24 21:10 . 2004-08-04 00:44 130,048 --a--c--- C:\WINDOWS\system32\dllcache\ksproxy.ax 2008-08-24 21:10 . 2004-08-03 23:08 60,288 --a------ C:\WINDOWS\system32\drivers\drmk.sys 2008-08-24 21:10 . 2004-08-03 23:08 60,288 --a--c--- C:\WINDOWS\system32\dllcache\drmk.sys 2008-08-24 21:10 . 2004-08-04 00:44 4,096 --a------ C:\WINDOWS\system32\ksuser.dll 2008-08-24 21:10 . 2004-08-04 00:44 4,096 --a--c--- C:\WINDOWS\system32\dllcache\ksuser.dll 2008-08-24 20:53 . 2008-08-24 20:53 <DIR> d-------- C:\Program Files\C-Media Audio 2008-08-24 20:53 . 2002-07-01 12:01 237,568 --a------ C:\WINDOWS\CMIUninstall.exe 2008-08-24 20:53 . 2002-07-01 12:01 212,992 --a------ C:\WINDOWS\CmiRmRedundDir.exe 2008-08-24 20:53 . 2002-02-27 17:14 28,672 --------- C:\WINDOWS\CMIRmDriver.dll 2008-08-24 20:53 . 2002-07-10 12:32 2,124 --a------ C:\WINDOWS\CMUDA.INI 2008-08-24 20:53 . 2008-08-24 20:53 92 --a------ C:\WINDOWS\CMISETUP.INI 2008-08-24 20:53 . 2008-08-24 20:53 26 --a------ C:\WINDOWS\CMCDPLAY.INI 2008-08-24 20:52 . 1998-10-29 16:45 306,688 --a------ C:\WINDOWS\IsUninst.exe 2008-08-24 20:50 . 2008-06-14 20:01 273,024 --------- C:\WINDOWS\system32\drivers\bthport.sys 2008-08-24 20:50 . 2008-06-14 20:01 273,024 -----c--- C:\WINDOWS\system32\dllcache\bthport.sys 2008-08-24 20:34 . 2008-08-25 13:56 <DIR> d--h----- C:\WINDOWS\$hf_mig$ 2008-08-24 20:34 . 2005-02-25 05:36 22,752 --a------ C:\WINDOWS\system32\spupdsvc.exe 2008-08-24 19:42 . 2008-08-25 11:16 <DIR> d-------- C:\Program Files\PhotoScape 2008-08-24 19:12 . 2008-08-24 19:12 22 --a------ C:\WINDOWS\system32\ati64hlp.stb 2008-08-24 18:25 . 2008-08-24 18:25 <DIR> d-------- C:\Program Files\Dziobas Rar Player 2008-08-24 18:17 . 2008-08-24 18:17 <DIR> d-------- C:\Documents and Settings\dawidek\Dane aplikacji\BESTplayer 2008-08-24 17:29 . 2008-08-24 17:32 <DIR> d-------- C:\unzipped 2008-08-24 16:48 . 2008-08-24 16:48 <DIR> d-------- C:\Program Files\Opera 2008-08-24 14:44 . 2008-08-24 14:44 <DIR> d-------- C:\Documents and Settings\dawidek\.thumbnails 2008-08-24 14:42 . 2008-08-24 14:43 <DIR> d-------- C:\Documents and Settings\dawidek\.<a href="http://www.download.net.pl/354/GIMP/">gimp</a>-2.3 2008-08-24 14:41 . 2008-08-24 14:41 <DIR> d-------- C:\Program Files\GIMP-2.0 2008-08-24 14:32 . 2008-08-24 14:32 <DIR> d-------- C:\Program Files\ATI Technologies 2008-08-24 14:31 . 2008-08-24 14:32 <DIR> d--h----- C:\Program Files\InstallShield Installation Information 2008-08-24 14:31 . 2003-06-03 06:52 278,528 -ra------ C:\WINDOWS\system32\atiiiexx.dll 2008-08-24 14:31 . 2003-06-05 12:35 114,688 --------- C:\WINDOWS\system32\ati2sgag.exe 2008-08-24 14:14 . 2008-08-24 14:14 13,646 --a------ C:\WINDOWS\system32\wpa.bak . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-08-25 17:12 --------- d-----w C:\Program Files\SiteAdvisor 2008-08-24 14:40 --------- d-----w C:\Program Files\McAfee 2008-08-24 13:08 --------- d-----w C:\Documents and Settings\LocalService\Dane aplikacji\SiteAdvisor 2008-08-24 13:08 --------- d-----w C:\Documents and Settings\dawidek\Dane aplikacji\SiteAdvisor 2008-08-24 13:08 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\SiteAdvisor 2008-08-24 13:08 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\McAfee 2008-08-24 13:05 --------- d-----w C:\Program Files\Common Files\McAfee 2008-08-24 13:04 --------- d-----w C:\Program Files\McAfee.com 2008-08-24 12:31 --------- d-----w C:\Program Files\Common Files\InstallShield 2008-08-24 11:59 --------- d-----w C:\Program Files\Google 2008-08-24 11:39 --------- d-----w C:\Program Files\microsoft frontpage 2008-08-24 11:37 --------- d-----w C:\Program Files\Usługi online 2008-07-18 20:10 94,920 ----a-w C:\WINDOWS\system32\cdm.dll 2008-07-18 20:10 53,448 ----a-w C:\WINDOWS\system32\wuauclt.exe 2008-07-18 20:10 45,768 ----a-w C:\WINDOWS\system32\wups2.dll 2008-07-18 20:10 36,552 ----a-w C:\WINDOWS\system32\wups.dll 2008-07-18 20:09 563,912 ----a-w C:\WINDOWS\system32\wuapi.dll 2008-07-18 20:09 325,832 ----a-w C:\WINDOWS\system32\wucltui.dll 2008-07-18 20:09 205,000 ----a-w C:\WINDOWS\system32\wuweb.dll 2008-07-18 20:09 1,811,656 ----a-w C:\WINDOWS\system32\wuaueng.dll 2008-07-07 20:33 253,952 ----a-w C:\WINDOWS\system32\es.dll 2008-06-24 16:24 74,240 ----a-w C:\WINDOWS\system32\mscms.dll 2008-06-23 15:41 662,016 ----a-w C:\WINDOWS\system32\wininet.dll 2008-06-20 17:42 246,784 ----a-w C:\WINDOWS\system32\mswsock.dll 2001-11-23 04:08 712,704 ----a-w C:\WINDOWS\inf\OTHER\AUDIO3D.DLL . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 15360] "swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-08-24 68856] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2003-06-05 335872] "mcagent_exe"="C:\Program Files\McAfee.com\Agent\mcagent.exe" [2007-11-01 582992] "SiteAdvisor"="C:\Program Files\SiteAdvisor\6261\SiteAdv.exe" [2007-08-24 36640] "C-Media Mixer"="Mixer.exe" [2002-10-15 C:\WINDOWS\mixer.exe] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 15360] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system] "NoDispSettingPage"= 1 (0x1) [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "VIDC.YV12"= yv12vfw.dll [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Adobe Gamma Loader.lnk] path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Adobe Gamma Loader.lnk backup=C:\WINDOWS\pss\Adobe Gamma Loader.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ANTIVIRUS] --a------ 2008-09-04 15:46 394240 C:\Program Files\MSA\MSA.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Orb] --a------ 2008-04-01 03:54 507904 C:\Program Files\Winamp Remote\bin\OrbTray.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg] --a------ 2008-08-24 16:40 68856 C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent] --a------ 2008-08-04 01:02 36352 C:\Program Files\Winamp\winampa.exe [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusDisableNotify"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "C:\\Program Files\\Common Files\\McAfee\\MNA\\McNASvc.exe"= "C:\\Program Files\\Winamp Remote\\bin\\Orb.exe"= "C:\\Program Files\\Winamp Remote\\bin\\OrbTray.exe"= "C:\\Program Files\\Winamp Remote\\bin\\OrbStreamerClient.exe"= R0 pavboot;pavboot;C:\WINDOWS\system32\drivers\pavboot.sys [2008-06-19 28544] S3 USBSTOR;Sterownik magazynu masowego USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-03 26496] . Contents of the 'Scheduled Tasks' folder . - - - - ORPHANS REMOVED - - - - BHO-{4F7E9D97-BEE7-4F55-811D-19F15F2120AD} - C:\WINDOWS\system32\geBqrooL.dll BHO-{80E7C6DF-52AF-43C5-A70A-CE99C52AEF67} - C:\WINDOWS\vanwxemgato.dll BHO-{D9A07E90-4D84-4EBE-9D6F-8D6609BEB217} - C:\WINDOWS\system32\awtrSlig.dll Toolbar-{F71B2A6B-F337-4737-B282-F7F721E527AC} - C:\WINDOWS\gksraemq.dll HKLM-Run-4c31d564 - C:\WINDOWS\system32\ncugfhyu.dll ShellExecuteHooks-{4F7E9D97-BEE7-4F55-811D-19F15F2120AD} - C:\WINDOWS\system32\geBqrooL.dll . ------- Supplementary Scan ------- . FireFox -: Profile - C:\Documents and Settings\dawidek\Dane aplikacji\Mozilla\Firefox\Profiles\g8h9z3aq.default\ . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, [url="http://www.gmer.net"]http://www.gmer.net[/url] Rootkit scan 2008-09-08 20:24:06 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . --------------------- DLLs Loaded Under Running Processes --------------------- PROCESS: C:\WINDOWS\explorer.exe -> C:\Program Files\SiteAdvisor\6261\saHook.dll . ------------------------ Other Running Processes ------------------------ . C:\WINDOWS\system32\ati2evxx.exe C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe C:\PROGRA~1\COMMON~1\McAfee\MNA\McNASvc.exe C:\PROGRA~1\COMMON~1\McAfee\McProxy\McProxy.exe C:\PROGRA~1\McAfee\VIRUSS~1\Mcshield.exe C:\Program Files\McAfee\MPF\MpfSrv.exe C:\Program Files\SiteAdvisor\6261\SAService.exe C:\WINDOWS\system32\wdfmgr.exe C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe C:\WINDOWS\system32\imapi.exe . ************************************************************************** . Completion time: 2008-09-08 20:28:48 - machine was rebooted ComboFix-quarantined-files.txt 2008-09-08 18:28:36 Pre-Run: 25,613,602,816 bajtów wolnych Post-Run: 25,658,552,320 bajt˘w wolnych 300 --- E O F --- 2008-08-25 11:56:24
#14
Napisano 09 09 2008 - 22:42
Wklej do notatnika KOD Files:: C:\WINDOWS\system32\r4h.e33 C:\WINDOWS\system32\fds.i386 C:\WINDOWS\system32\sof.586 Folder:: C:\Program Files\rhc95oj0ec4t C:\2016849479??????????????????????????
#15
Napisano 09 09 2008 - 23:04
Files:: C:\WINDOWS\system32\r4h.e33 C:\WINDOWS\system32\fds.i386 C:\WINDOWS\system32\sof.586 Folder:: C:\Program Files\rhc95oj0ec4t C:\2016849479Dalej juz chyba wiesz co i jak ;p
#16
Napisano 09 09 2008 - 23:15
#17
Napisano 09 09 2008 - 23:53
Ja w ogóle nie widzę w logu użycia Kaspersky Virus Removal Tool. Bez tego skanowania nie ma szans na usunięcie infekcji.
@eunstachy
2008-09-07 21:35 . 2008-09-07 21:35 <DIR> d-------- C:\Documents and Settings\Sebastian\Dane aplikacji\VirusRemover2008
C:\Program Files\Smart Antivirus 2009
Usuń te infekcje : http://www.bezpieczenstwosystemow.pl/index.php?topic=3512.0
Na więcej dziś niestety nie mam czasu.
Użytkownicy przeglądający ten temat: 0
0 użytkowników, 0 gości, 0 anonimowych