No cześć!
Po wyczyszczeniu ComboFixem ....wszystko powróciło do normy!....ale...zainstalowałem NOD32 i przeskanowałem wszystko...i NOD znalazł mi 9 virusów w tym na dysku D: w folderze (gdzie mam aplikacje z netu) ... znalazł trojana ...była to aplikacja "Flasch Player",którą ściągnołem niegdyś z netu.Wszystko wywaliłem zrobiłem obraz w Ghoście i jak narazie chodzi super.
A to log ComboFixa:
ComboFix 08-05-15.3 - Paciorkowski Krzyszt 2008-05-20 17:01:18.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.738 [GMT 2:00]
Running from: C:\Pobierane z internetu\ComboFix.exe
* Created a new restore point
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
F:\WINDOWS\system32\awvvw.dll
F:\WINDOWS\system32\ddcbxyv.dll
F:\WINDOWS\system32\efcbcyv.dll
F:\WINDOWS\system32\fcccdba.dll
F:\WINDOWS\system32\hggdcab.dll
F:\WINDOWS\system32\jkkkjkk.dll
F:\WINDOWS\system32\jkklkjg.dll
F:\WINDOWS\system32\mcrh.tmp
F:\WINDOWS\system32\wvvwa.ini
F:\WINDOWS\system32\wvvwa.ini2
F:\WINDOWS\system32\xxyvuur.dll
F:\WINDOWS\system32\yayaxya.dll
.
((((((((((((((((((((((((( Files Created from 2008-04-20 to 2008-05-20 )))))))))))))))))))))))))))))))
.
2008-04-23 18:36 . 2008-04-23 18:36 <DIR> d---s---- F:\Documents and Settings\Paciorkowski Krzyszt\UserData
2008-04-23 18:33 . 2008-04-23 18:33 <DIR> d-------- F:\Program Files\Common Files\PCSuite
2008-04-23 18:33 . 2008-04-23 18:33 <DIR> d-------- F:\Program Files\Common Files\Nokia
2008-04-23 18:32 . 2008-04-23 18:32 <DIR> d-------- F:\Program Files\PC Connectivity Solution
2008-04-23 18:32 . 2007-09-17 15:53 21,632 --a------ F:\WINDOWS\system32\drivers\pccsmcfd.sys
2008-04-23 18:26 . 2008-04-23 18:26 7,237,978 --a------ F:\Temp\Free3GPVideoConverter.exe
2008-04-23 18:24 . 2008-04-23 18:24 <DIR> d-------- F:\Program Files\ASIO4ALL v2
2008-04-23 18:24 . 2002-07-08 00:14 1,294,336 --a------ F:\WINDOWS\system32\vorbis.acm
2008-04-23 18:24 . 2006-06-20 10:56 225,280 --a------ F:\WINDOWS\system32\rewire.dll
2008-04-23 18:23 . 2008-04-23 18:23 <DIR> d-------- F:\Program Files\Outsim
2008-04-23 18:23 . 2008-04-23 18:24 7,217,261 --a------ F:\Temp\FreeVideoToiPhoneConverter.exe
2008-04-23 18:22 . 2008-04-23 18:24 <DIR> d-------- F:\Program Files\Image-Line
2008-04-23 18:20 . 2008-04-23 18:20 <DIR> d-------- F:\Program Files\Common Files\AVSMedia
2008-04-23 18:20 . 2008-04-23 18:20 <DIR> d-------- F:\Program Files\AVSMedia
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-05-20 14:48 --------- d-----w F:\Program Files\DialNet
2008-05-20 14:47 --------- d-----w F:\Program Files\Spybot - Search & Destroy
2008-05-20 14:46 --------- d-----w F:\Documents and Settings\All Users\Dane aplikacji\Spybot - Search & Destroy
2008-05-20 14:43 --------- d-----w F:\Documents and Settings\Paciorkowski Krzyszt\Dane aplikacji\uTorrent
2008-04-23 16:33 --------- d-----w F:\Program Files\Nokia
2008-04-23 16:30 --------- d-----w F:\Documents and Settings\All Users\Dane aplikacji\Installations
2008-04-23 16:27 --------- d-----w F:\Program Files\DVDVideoSoft
2008-04-23 16:27 --------- d-----w F:\Program Files\Common Files\DVDVideoSoft
2008-04-23 16:16 --------- d-----w F:\Program Files\TuneUp Utilities 2004
2008-03-28 12:32 --------- d--h--w F:\Program Files\InstallShield Installation Information
2008-03-28 11:48 --------- d-----w F:\Program Files\Common Files\InstallShield
2008-03-28 11:27 --------- d-----w F:\Program Files\Gadu-Gadu
2008-03-28 11:27 --------- d-----w F:\Documents and Settings\Paciorkowski Krzyszt\Dane aplikacji\Skype
2008-03-20 18:20 --------- d-----w F:\Program Files\Zanag
2008-03-20 18:12 --------- d-----w F:\Documents and Settings\Paciorkowski Krzyszt\Dane aplikacji\Nokia
2008-03-20 17:28 --------- d-----w F:\Program Files\Steinberg
2008-03-20 17:21 --------- d-----w F:\Program Files\MOV to AVI MPEG WMV Converter
2008-03-20 16:55 --------- d-----w F:\Program Files\Xvid
2008-03-20 16:53 --------- d-----w F:\Program Files\DIFX
2008-03-20 16:53 --------- d-----w F:\Documents and Settings\All Users\Dane aplikacji\PC Suite
2008-03-20 16:52 --------- d-----w F:\Documents and Settings\Paciorkowski Krzyszt\Dane aplikacji\PC Suite
2008-03-20 16:45 --------- d-----w F:\Program Files\CDex150beta7
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="F:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:44 15360]
"PC Suite Tray"="F:\Program Files\Nokia\Nokia PC Suite 6\PCSuite.exe" [2008-03-28 11:20 1079296]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NeroFilterCheck"="F:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" [2007-03-09 19:53 153136]
"a-winpoet-service"="F:\Program Files\DialNet\winpppoverethernet.exe" [2007-07-06 09:40 405504]
"NvCplDaemon"="F:\WINDOWS\system32\NvCpl.dll" [2007-12-05 02:41 8523776]
"nwiz"="nwiz.exe" [2007-12-05 02:41 1626112 F:\WINDOWS\system32\nwiz.exe]
"NvMediaCenter"="F:\WINDOWS\system32\NvMcTray.dll" [2007-12-05 02:41 81920]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="F:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 00:44 15360]
"Nokia.PCSync"="F:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2008-03-26 18:41 1232896]
F:\Documents and Settings\All Users\Menu Start\Programy\Autostart\
Adobe Gamma Loader.lnk.disabled [2008-03-13 12:48:22 986]
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UpdatesDisableNotify"=dword:00000001
"AntiVirusOverride"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"F:\\Program Files\\Tlen.pl\\tlen.exe"=
"F:\\Program Files\\uTorrent\\uTorrent.exe"=
"F:\\Program Files\\Skype\\Phone\\Skype.exe"=
R2 TopWinPoETDriver;WinPoET PPPoE Optimized Driver;F:\WINDOWS\system32\DRIVERS\WrKPoET2000.sys [2007-07-04 17:27]
R3 FPD;Fine Point Packet Service;F:\WINDOWS\system32\drivers\fpd.sys [2007-07-04 17:27]
R3 WrKPoET2000;WrKPoET2000;F:\Program Files\DialNet\WrKPoET2000.sys [2007-07-04 17:27]
R3 WRSWanDD;WinPoET PPPoE Adapter;F:\WINDOWS\system32\DRIVERS\WrKPoETNic2000.sys [2007-07-04 17:27]
S3 KS-959;Kingsun KS-959 USB Infrared Adapter;F:\WINDOWS\system32\DRIVERS\KS-959.sys [2003-01-01 07:08]
S3 pccsmcfd;PCCS Mode Change Filter Driver;F:\WINDOWS\system32\DRIVERS\pccsmcfd.sys [2007-09-17 15:53]
.
Contents of the 'Scheduled Tasks' folder
"2008-03-13 10:27:56 F:\WINDOWS\Tasks\1-Click Maintenance.job"
- F:\Program Files\TuneUp Utilities 2004\SystemOptimizer.exe
.
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
http://www.gmer.net
Rootkit scan 2008-05-20 17:04:44
Windows 5.1.2600 Dodatek Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
F:\WINDOWS\system32\rundll32.exe
F:\WINDOWS\system32\nvsvc32.exe
F:\WINDOWS\system32\wdfmgr.exe
F:\Program Files\DialNet\WrOS.exe
F:\Program Files\PC Connectivity Solution\ServiceLayer.exe
F:\Program Files\PC Connectivity Solution\Transports\NclUSBSrv.exe
F:\Program Files\PC Connectivity Solution\Transports\NclIrSrv.exe
F:\Program Files\PC Connectivity Solution\Transports\NclRSSrv.exe
.
**************************************************************************
.
Completion time: 2008-05-20 17:06:08 - machine was rebooted
ComboFix-quarantined-files.txt 2008-05-20 15:06:05
Pre-Run: 15,699,140,608 bajtów wolnych
Post-Run: 15,649,144,832 bajt˘w wolnych
131
Jeszcze raz wielkie dzięki za pomoc!
Pozdro!