Temat jest zamknięty
Potrzebuję pomocy w sprawie wirusa, który dopadł mój komputer jakiś czas temu. Niestety samodzielnie nie mogę sobie z nim poradzić. Pewnego razu straciłem możliwość normalnego otwierania dysków (Windows pytał o to, jakim programem je otworzyć!). Oczywiście z problemem sobie poradziłem - użyłem Combofixa. Postanowiłem jednak zrobić skan. No i cóż - AVG wykrył kilkadziesiąt wirusów trzech różnych typów PSW.OnlineGames ->
PSW.OnlineGames.x
PSW.OnlineGames.AE
oraz PSW.OnlineGames.AHOJ
Znajdowały się one głównie bezpośrednio na każdej z partycji (na przykład na E:/, a nie w którymś z katalogów). AVG nie miał problemów z usunięciem plików - wydawało się, że wszystko jest okej. A po godzinie problem znów odżył... I znów AVG... Znów usunięte. I znowu!
Niestety nie znam się na wirusach i generalnie moja wiedza komputerowa nie jest zbyt wysoka, więc ciężki mi przedstawić jakieś szczegóły. Mam jednak aktualne logi z ComboFixa i HiJackThis. Oto one:
HIJACKTHIS:
Logfile of HijackThis v1.99.1
Scan saved at 19:07:01, on 2008-03-29
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\ESRI\License\arcgis9x\lmgrd.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\ESRI\License\arcgis9x\ARCGIS.EXE
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Borland\InterBase\bin\ibguard.exe
C:\WINDOWS\system32\RunDll32.exe
C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Borland\InterBase\bin\ibserver.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\System32\svchost.exe
C:\HijackThis\HijackThis.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [AWMON] "C:\Program Files\Lavasoft\Ad-Aware SE Professional\Ad-Watch.exe"
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [Acrobat Assistant 7.0] "C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKCU\..\Run: [NBJ] "C:\Program Files\Ahead\Nero BackItUp\NBJ.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\program files\bonjour\mdnsnsp.dll
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5co...b?1115192447607
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://go.divx.com/plugin/DivXBrowserPlugin.cab
O16 - DPF: {DE625294-70E6-45ED-B895-CFFA13AEB044} (AxisMediaControlEmb Class) - http://217.29.93.100/activex/AMC.cab
O20 - Winlogon Notify: winopn32 - winopn32.dll (file missing)
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: ArcGIS License Manager - Unknown owner - C:\PROGRA~1\ESRI\License\arcgis9x\lmgrd.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: InterBase Guardian (InterBaseGuardian) - Borland Software Corporation - C:\Program Files\Borland\InterBase\bin\ibguard.exe
O23 - Service: InterBase Server (InterBaseServer) - Borland Software Corporation - C:\Program Files\Borland\InterBase\bin\ibserver.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
COMBOFIX
ComboFix 08-03-27.5 - stacja2 2008-03-29 18:36:56.3 - FAT32x86
Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.291 [GMT 1:00]
Running from: C:\Documents and Settings\stacja2\Pulpit\ComboFix.exe
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\Service_npf
((((((((((((((((((((((((( Files Created from 2008-02-28 to 2008-03-29 )))))))))))))))))))))))))))))))
.
2008-03-27 14:10 . 2008-03-27 14:10 <DIR> d-------- C:\Documents and Settings\stacja2\Dane aplikacji\Warsow
2008-03-24 22:08 . 2008-03-24 22:08 7,680 --ahs---- C:\WINDOWS\Thumbs.db
2008-03-17 19:22 . 2008-03-17 19:22 <DIR> d-------- C:\Program Files\Common Files\DVDVIDEOSOFT
2008-03-14 16:57 . 2008-03-14 16:57 <DIR> d-------- C:\Program Files\7-Zip
2008-03-12 11:11 . 2008-03-12 11:11 23,392 --a------ C:\WINDOWS\system32\nscompat.tlb
2008-03-12 11:11 . 2008-03-12 11:11 16,832 --a------ C:\WINDOWS\system32\amcompat.tlb
2008-03-11 15:58 . 2008-03-11 15:58 <DIR> d-------- C:\Program Files\RapidCheck
2008-03-11 09:34 . 2006-10-04 15:06 1,197,294 --------- C:\WINDOWS\system32\dllcache\sysmain.sdb
2008-03-11 09:34 . 2006-10-04 15:06 764,868 --------- C:\WINDOWS\system32\dllcache\apph_sp.sdb
2008-03-11 09:34 . 2006-10-04 15:06 217,118 --------- C:\WINDOWS\system32\dllcache\apphelp.sdb
2008-03-11 09:33 . 2008-03-11 09:33 <DIR> d-------- C:\Program Files\Windows Media Connect 2
2008-03-11 09:31 . 2008-03-11 09:31 <DIR> d-------- C:\WINDOWS\system32\drivers\UMDF
2008-03-08 17:51 . 2008-03-08 17:51 <DIR> d-------- C:\Documents and Settings\stacja2\Dane aplikacji\Gearbox Software
2008-03-08 17:49 . 2005-04-11 14:07 115,016 --a------ C:\WINDOWS\system32\MSINET.OCX
2008-03-08 17:49 . 2005-04-11 14:07 69,632 --a------ C:\WINDOWS\system32\xmltok.dll
2008-03-08 17:49 . 2005-04-11 14:07 36,864 --a------ C:\WINDOWS\system32\xmlparse.dll
2008-03-08 17:49 . 2005-04-11 14:07 35,840 --a------ C:\WINDOWS\system32\comdlg32.oca
2008-03-08 17:49 . 2005-04-11 14:07 29,184 --a------ C:\WINDOWS\system32\MSINET.oca
2008-03-08 17:49 . 2005-04-11 14:07 26,064 --a------ C:\WINDOWS\system32\xmlinst.exe
2008-03-08 17:47 . 2008-03-08 17:47 <DIR> d-------- C:\Program Files\Ubisoft
2008-03-08 16:26 . 2008-03-08 16:26 <DIR> d-------- C:\Program Files\Techland
2008-03-05 17:41 . 2008-03-05 17:41 <DIR> d-------- C:\Program Files\Common Files\AVSMedia
2008-03-05 17:41 . 2003-05-22 12:26 221,215 --a------ C:\WINDOWS\system32\divxdec.ax
2008-03-05 17:41 . 2004-02-04 21:11 81,920 --a------ C:\WINDOWS\system32\AC3ACM.acm
2008-03-05 17:41 . 2004-09-06 16:06 53,248 --a------ C:\WINDOWS\system32\xvid.ax
2008-03-05 17:41 . 2003-05-21 23:50 38,912 --a------ C:\WINDOWS\system32\alf2cd.acm
2008-03-05 17:41 . 2000-03-14 20:55 13,239 --a------ C:\WINDOWS\system32\Scg726.acm
2008-03-05 17:40 . 2008-03-05 17:41 <DIR> d-------- C:\Program Files\AVSMedia
2008-03-05 17:40 . 2003-05-21 23:50 1,700,352 --a------ C:\WINDOWS\system32\GdiPlus.dll
2008-03-05 17:40 . 2002-01-05 15:48 974,848 --a------ C:\WINDOWS\system32\mfc70.dll
2008-03-05 17:40 . 2003-05-22 12:26 638,976 --a------ C:\WINDOWS\system32\divx.dll
2008-03-05 17:40 . 2004-07-03 20:59 524,288 --a------ C:\WINDOWS\system32\xvidcore.dll
2008-03-05 17:40 . 2002-01-05 14:40 487,424 --a------ C:\WINDOWS\system32\msvcp70.dll
2008-03-05 17:40 . 2003-05-21 23:50 261,632 --a------ C:\WINDOWS\system32\mcdvd_32.dll
2008-03-05 17:40 . 2003-05-21 23:50 156,910 --a------ C:\WINDOWS\WMSysPr8.prx
2008-03-05 17:40 . 2004-07-03 21:08 139,264 --a------ C:\WINDOWS\system32\xvidvfw.dll
2008-03-05 17:40 . 2003-05-21 12:50 24,576 --a------ C:\WINDOWS\system32\msxml3a.dll
2008-03-05 16:30 . 2008-03-05 16:30 <DIR> d-------- C:\Documents and Settings\stacja2\Dane aplikacji\CyberLink
2008-03-05 16:30 . 2008-03-05 16:30 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\CyberLink
2008-03-05 16:29 . 2008-03-05 16:29 <DIR> d-------- C:\Program Files\CyberLink
2008-03-01 15:34 . 2008-03-01 15:34 <DIR> d-------- C:\Program Files\Common Files\Download Manager
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-02-26 20:25 86,016 ----a-w C:\WINDOWS\system32\OpenAL32.dll
2008-02-26 20:25 262,144 ----a-w C:\WINDOWS\system32\wrap_oal.dll
2008-02-25 17:14 --------- d-----w C:\Documents and Settings\stacja2\Dane aplikacji\dvdcss
2008-02-18 15:56 --------- d-----w C:\Documents and Settings\stacja2\Dane aplikacji\Corel
2008-02-18 15:29 --------- d-----w C:\Program Files\Corel
2008-02-18 14:56 --------- d-----w C:\Program Files\ReflexiveArcade
2008-02-15 16:27 --------- d-----w C:\Program Files\VLCPortable
2008-02-14 11:32 --------- d-----w C:\Program Files\SystemRequirementsLab
2008-01-11 05:41 44,544 ----a-w C:\WINDOWS\system32\dllcache\pngfilt.dll
2007-10-08 17:09 500,224 ----a-w C:\Program Files\Sc174.exe
2005-05-06 13:10 36 ----a-w C:\Documents and Settings\stacja2\klextlock.dat
2005-05-04 10:24 82,944 --sh--r C:\Documents and Settings\stacja2\Dane aplikacji\aauw.exe
2003-08-27 10:49 3,424 ----a-w C:\WINDOWS\inf\OTHER\cmiainfo.sys
2005-05-02 17:22 421,888 --sh--r C:\WINDOWS\system32\??oolsv.exe
2006-05-03 10:06 163,328 --sh--r C:\WINDOWS\system32\flvDX.dll
2007-02-21 11:47 31,232 --sh--r C:\WINDOWS\system32\msfDX.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NBJ"="C:\Program Files\Ahead\Nero BackItUp\NBJ.exe" [2005-04-08 18:43 1953792]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:44 15360]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AWMON"="C:\Program Files\Lavasoft\Ad-Aware SE Professional\Ad-Watch.exe" [2004-09-16 16:15 538112]
"Cmaudio"="cmicnfg.cpl" []
"Acrobat Assistant 7.0"="C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe" [2006-01-12 20:52 483328]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11 132496]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2005-05-04 11:23 98304]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 11:50 155648]
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2008-01-03 14:05 579072]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-12-05 01:41 8523776]
"nwiz"="nwiz.exe" [2007-12-05 01:41 1626112 C:\WINDOWS\system32\nwiz.exe]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-12-05 01:41 81920]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-08-04 00:44 15360]
"AVG7_Run"="C:\PROGRA~1\Grisoft\AVG7\avgw.exe" [2007-10-24 09:42 219136]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\winopn32]
winopn32.dll
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\DC++\\DCPlusPlus.exe"=
"C:\\Program Files\\Gadu-Gadu\\gg.exe"=
"E:\\gry\\cm0102\\cm0102.exe"=
"C:\\Program Files\\Grisoft\\AVG7\\avginet.exe"=
"C:\\Program Files\\Grisoft\\AVG7\\avgamsvr.exe"=
"C:\\Program Files\\Grisoft\\AVG7\\avgcc.exe"=
"C:\\Program Files\\Grisoft\\AVG7\\avgemc.exe"=
"C:\\Program Files\\mIRC\\mirc.exe"=
"C:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"F:\\gry\\S.T.A.L.K.E.R. - Shadow of Chernobyl\\bin\\XR_3DA.exe"=
"F:\\gry\\S.T.A.L.K.E.R. - Shadow of Chernobyl\\bin\\dedicated\\XR_3DA.exe"=
"C:\\Program Files\\Internet Explorer\\iexplore.exe"=
"C:\\Program Files\\uTorrent\\uTorrent.exe"=
"C:\\WINDOWS\\system32\\winver.exe"=
"C:\\Program Files\\TC PowerPack\\TOTALCMD.EXE"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"E:\\gry\\Cannon Smash\\csmash.exe"=
"E:\\gry\\Nexuiz\\nexuiz.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009
R0 sfdrv01a;StarForce Protection Environment Driver (version 1.x.a);C:\WINDOWS\system32\drivers\sfdrv01a.sys [2006-07-05 13:46]
R0 viasraid;viasraid;C:\WINDOWS\system32\DRIVERS\viasraid.sys [2003-10-31 05:22]
R2 ArcGIS License Manager;ArcGIS License Manager;C:\PROGRA~1\ESRI\License\arcgis9x\lmgrd.exe [1999-12-01 12:38]
R2 InterBaseGuardian;InterBase Guardian;C:\Program Files\Borland\InterBase\bin\ibguard.exe [2001-11-29 08:50]
R2 ithsgt;ithsgt;C:\WINDOWS\system32\DRIVERS\ithsgt.sys [2007-10-21 20:01]
R2 lilsgt;lilsgt;C:\WINDOWS\system32\DRIVERS\lilsgt.sys [2007-10-21 20:01]
R3 InterBaseServer;InterBase Server;C:\Program Files\Borland\InterBase\bin\ibserver.exe [2001-11-29 08:50]
S2 BulkUsb;Plustek USB Scanner;C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-03 22:58]
S3 s115bus;Sony Ericsson Device 115 driver (WDM);C:\WINDOWS\system32\DRIVERS\s115bus.sys [2007-04-23 15:54]
S3 s115mdfl;Sony Ericsson Device 115 USB WMC Modem Filter;C:\WINDOWS\system32\DRIVERS\s115mdfl.sys [2007-04-23 15:54]
S3 s115mdm;Sony Ericsson Device 115 USB WMC Modem Driver;C:\WINDOWS\system32\DRIVERS\s115mdm.sys [2007-04-23 15:54]
S3 s115mgmt;Sony Ericsson Device 115 USB WMC Device Management Drivers (WDM);C:\WINDOWS\system32\DRIVERS\s115mgmt.sys [2007-04-23 15:54]
S3 s115obex;Sony Ericsson Device 115 USB WMC OBEX Interface;C:\WINDOWS\system32\DRIVERS\s115obex.sys [2007-04-23 15:54]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\K]
\Shell\AutoRun\command - K:\autorun.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{568845a8-5870-11dc-8ded-000b6a64e0a4}]
\Shell\AutoRun\command - J:\v.cmd
\Shell\explore\Command - J:\v.cmd
\Shell\open\Command - J:\v.cmd
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{5a2295e2-7efe-11dc-8e5a-000b6a64e0a4}]
\Shell\AutoRun\command - J:\3o.exe
\Shell\explore\Command - J:\3o.exe
\Shell\open\Command - J:\3o.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{9f292d2a-b869-11dc-8ee5-000b6a64e0a4}]
\Shell\AutoRun\command - J:\PortableApps\PortableAppsMenu\PortableAppsMenu.exe
.
**************************************************************************
catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-03-29 18:41:41
Windows 5.1.2600 Dodatek Service Pack 2 FAT NTAPI
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\ESRI\License\arcgis9x\ARCGIS.EXE
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\RunDll32.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\System32\imapi.exe
.
**************************************************************************
.
Completion time: 2008-03-29 18:43:33 - machine was rebooted
ComboFix-quarantined-files.txt 2008-03-29 17:43:30
ComboFix3.txt 2008-03-24 17:03:00
ComboFix2.txt 2008-03-29 16:30:50
Pre-Run: 9,745,088,512 bajtów wolnych
Post-Run: 9,735,143,424 bajt˘w wolnych
.
2008-03-12 10:17:21 --- E O F ---
Serdecznie proszę o pomoc, bo sam nie potrafię już sobie poradzić. Przy okazji - w międzyczasie - znajoma podłączyła się ze swoją MP-trójką, no i u niej także znalazł się wirus PSW.OnlineGames. Jednym słowem mam zasyfione 2 kompy i empetrójkę. Czy ktoś mi pomoże?
Pozdrawiam!
