Prosze o sprawdzenie loga

przez **bigbercik** » 18 Kwi 2008, 13:35

Kod: Zaznacz wszystko: Logfile of HijackThis v1.99.1 Scan saved at 13:31:40, on 2008-04-18 Platform: Unknown Windows (WinNT 6.00.1904) MSIE: Internet Explorer v7.00 (7.00.6000.16643) Running processes: C:\Windows\system32\taskeng.exe C:\Windows\system32\Dwm.exe C:\Windows\Explorer.EXE C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe C:\Windows\RtHDVCpl.exe C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE C:\Acer\Empowering Technology\eAudio\eAudio.exe C:\Acer\Empowering Technology\eDataSecurity\eDSLoader.exe C:\Program Files\Common Files\Symantec Shared\ccApp.exe C:\Program Files\Acer Arcade Deluxe\Play Movie\PMVService.exe C:\Program Files\Apoint2K\Apoint.exe C:\Program Files\Apoint2K\ApMsgFwd.exe C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe C:\Windows\ehome\ehtray.exe C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe C:\Program Files\Windows Media Player\wmpnscfg.exe C:\Acer\Empowering Technology\Acer.Empowering.Framework.Supervisor.exe C:\Users\kici\AppData\Local\Temp\RtkBtMnt.exe C:\Acer\Empowering Technology\ENET\ENMTRAY.EXE C:\Acer\Empowering Technology\EPOWER\EPOWER_DMC.EXE C:\Acer\Empowering Technology\eRecovery\ERAGENT.EXE C:\Windows\ehome\ehmsas.exe C:\Program Files\Apoint2K\Apntex.exe C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe C:\Windows\system32\conime.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Windows Media Player\wmplayer.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Users\kici\Desktop\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://search.bearshare.com/pl/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://pl.intl.acer.yahoo.com R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://pl.intl.acer.yahoo.com R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://uk.rd.yahoo.com/customize/ycomp/defaults/su/*http://uk.yahoo.com R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 82.160.0.10:8080 R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = local;<local> R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file) O1 - Hosts: ::1 localhost O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.0\NppBho.dll O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll O2 - BHO: My Global Search Bar BHO - {37B85A21-692B-4205-9CAD-2626E4993404} - C:\Program Files\MyGlobalSearch\bar\1.bin\MGSBAR.DLL O2 - BHO: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL O2 - BHO: GamesBar - {6F282B65-56BF-4BD1-A8B2-A4449A05863D} - C:\Program Files\GamesBar\oberontb.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O2 - BHO: ShowBarObj Class - {83A2F9B1-01A2-4AA5-87D1-45B6B8505E96} - C:\Windows\system32\ActiveToolBand.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\Windows\system32\eDStoolbar.dll O3 - Toolbar: Show Norton Toolbar - {90222687-F593-4738-B738-FBEE9C7B26DF} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.0\UIBHO.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll O3 - Toolbar: GamesBar - {6F282B65-56BF-4BD1-A8B2-A4449A05863D} - C:\Program Files\GamesBar\oberontb.dll O3 - Toolbar: My Global Search Bar - {37B85A29-692B-4205-9CAD-2626E4993404} - C:\Program Files\MyGlobalSearch\bar\1.bin\MGSBAR.DLL O3 - Toolbar: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide O4 - HKLM\..\Run: [IAAnotif] "C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe" O4 - HKLM\..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe O4 - HKLM\..\Run: [eAudio] "C:\Acer\Empowering Technology\eAudio\eAudio.exe" O4 - HKLM\..\Run: [eDataSecurity Loader] C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton Internet Security\osCheck.exe" O4 - HKLM\..\Run: [SetPanel] C:\Acer\APanel\APanel.cmd O4 - HKLM\..\Run: [LManager] C:\PROGRA~1\LAUNCH~1\LManager.exe O4 - HKLM\..\Run: [PlayMovie] "C:\Program Files\Acer Arcade Deluxe\Play Movie\PMVService.exe" O4 - HKLM\..\Run: [WarReg_PopUp] C:\Acer\WR_PopUp\WarReg_PopUp.exe O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint2K\Apoint.exe O4 - HKLM\..\Run: [Acer Tour Reminder] C:\Acer\AcerTour\Reminder.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" O4 - HKLM\..\Run: [Onet.pl AutoUpdate] C:\Program Files\Common Files\Onet.pl\AutoUpdate.exe /tsr O4 - HKLM\..\Run: [BearShare] "C:\Program Files\BearShare\BearShare.exe" /pause O4 - HKLM\..\Run: [Ulead AutoDetector v2] C:\Program Files\Common Files\Ulead Systems\AutoDetector\monitor.exe O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun O4 - HKCU\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe O4 - HKCU\..\Run: [IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" ASO-616B5711-6DAE-4795-A05F-39A1E5104020 O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe O4 - HKCU\..\Run: [Vidalia] "C:\Program Files\Vidalia Bundle\Vidalia\vidalia.exe" O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe O4 - Startup: Bux.to Autoclicker.lnk = ? O4 - Startup: Tworzenie wycinków ekranu i uruchamianie programu OneNote 2007.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O4 - Global Startup: BTTray.lnk = ? O4 - Global Startup: Empowering Technology Launcher.lnk = ? O4 - Global Startup: Ulead Photo Express 3.0 SE Calendar Checker.lnk = C:\Program Files\Ulead Systems\Ulead Photo Express 3.0 SE\CalCheck.exe O8 - Extra context menu item: E&ksportuj do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000 O8 - Extra context menu item: Wyślij obraz do urządzenia &Bluetooth... - c:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm O8 - Extra context menu item: Wyślij stronę do urządzenia &Bluetooth... - c:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra button: (no name) - {1A93C934-025B-4c3a-B38E-9654A7003239} - C:\Program Files\GamesBar\oberontb.dll O9 - Extra 'Tools' menuitem: GamesBar - {1A93C934-025B-4c3a-B38E-9654A7003239} - C:\Program Files\GamesBar\oberontb.dll O9 - Extra button: Wyślij do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra 'Tools' menuitem: Wyślij &do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - c:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - c:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm O10 - Unknown file in Winsock LSP: c:\windows\system32\nlaapi.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\napinsp.dll O11 - Options group: [INTERNATIONAL] International* O13 - Gopher Prefix: O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL O20 - AppInit_DLLs: eNetHook.dll O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe O23 - Service: Symantec Event Manager (ccEvtMgr) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing) O23 - Service: Symantec Settings Manager (ccSetMgr) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing) O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing) O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe O23 - Service: eDSService.exe (eDataSecurity Service) - HiTRSUT - C:\Acer\Empowering Technology\eDataSecurity\eDSService.exe O23 - Service: @%SystemRoot%\ehome\ehstart.dll,-101 (ehstart) - Unknown owner - %windir%\system32\svchost.exe (file missing) O23 - Service: eLock Service (eLockService) - Acer Inc. - C:\Acer\Empowering Technology\eLock\Service\eLockServ.exe O23 - Service: eNet Service - Acer Inc. - C:\Acer\Empowering Technology\eNet\eNet Service.exe O23 - Service: eRecovery Service (eRecoveryService) - Acer Inc. - C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe O23 - Service: eSettings Service (eSettingsService) - Unknown owner - C:\Acer\Empowering Technology\eSettings\Service\capuserv.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe O23 - Service: Symantec IS Password Validation (ISPwdSvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\isPwdSvc.exe O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE O23 - Service: MobilityService - Unknown owner - C:\Acer\Mobility Center\MobilityService.exe O23 - Service: @%SystemRoot%\system32\qwave.dll,-1 (QWAVE) - Unknown owner - %windir%\system32\svchost.exe (file missing) O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe O23 - Service: @%SystemRoot%\system32\seclogon.dll,-7001 (seclogon) - Unknown owner - %windir%\system32\svchost.exe (file missing) O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files\Common Files\Steam\SteamService.exe O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe O23 - Service: ePower Service (WMIService) - acer - C:\Acer\Empowering Technology\ePower\ePowerSvc.exe O23 - Service: @%ProgramFiles%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - %ProgramFiles%\Windows Media Player\wmpnetwk.exe (file missing)

przez **huber2t** » 18 Kwi 2008, 15:18

fix w hijackthis

O2 - BHO: My Global Search Bar BHO - {37B85A21-692B-4205-9CAD-2626E4993404} - C:\Program Files\MyGlobalSearch\bar\1.bin\MGSBAR.DLL
O2 - BHO: GamesBar - {6F282B65-56BF-4BD1-A8B2-A4449A05863D} - C:\Program Files\GamesBar\oberontb.dll
O3 - Toolbar: GamesBar - {6F282B65-56BF-4BD1-A8B2-A4449A05863D} - C:\Program Files\GamesBar\oberontb.dll
O3 - Toolbar: My Global Search Bar - {37B85A29-692B-4205-9CAD-2626E4993404} - C:\Program Files\MyGlobalSearch\bar\1.bin\MGSBAR.DLL
O9 - Extra button: (no name) - {1A93C934-025B-4c3a-B38E-9654A7003239} - C:\Program Files\GamesBar\oberontb.dll
O9 - Extra 'Tools' menuitem: GamesBar - {1A93C934-025B-4c3a-B38E-9654A7003239} - C:\Program Files\GamesBar\oberontb.dll

Pobierz ComboFix, ale nie uruchamiaj
Wklej do notatnika:

Kod: Zaznacz wszystko: File:: C:\Program Files\GamesBar\oberontb.dll C:\Program Files\MyGlobalSearch\bar\1.bin\MGSBAR.DLL Folder:: C:\Program Files\GamesBar C:\Program Files\MyGlobalSearch

Plik

zapisz jako

CFScript.txt (najwygodniej będzie, jeśli zapiszesz w takiej lokalizacji, by ikonka CFScript.txt znalazła się obok ikonki ComboFix.exe)
Przeciągnij i upuść ikonkę CFScript.txt na ikonkę ComboFix.exe tak jak tu

Powinno się rozpocząć usuwanie i powstanie log, daj ten log na forum.
Jeśli wszystko pójdzie dobrze, to po restarcie usuń ręcznie folder C: \Qoobox

przez **bigbercik** » 18 Kwi 2008, 16:49

Kod: Zaznacz wszystko: ComboFix 08-04-17.1 - kici 2008-04-18 16:34:39.1 - NTFSx86 Microsoft® Windows Vista™ Home Premium 6.0.6000.0.1250.1.1045.18.414 [GMT 2:00] Running from: C:\Users\kici\Desktop\ComboFix.exe Command switches used :: C:\Users\kici\Desktop\CFScript.txt * Created a new restore point FILE :: C:\Program Files\GamesBar\oberontb.dll C:\Program Files\MyGlobalSearch\bar\1.bin\MGSBAR.DLL . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\Program Files\GamesBar C:\Program Files\GamesBar\Localization-English.ini C:\Program Files\GamesBar\oberontb.dll C:\Program Files\GamesBar\OBGet.exe C:\Program Files\GamesBar\uninst.exe C:\Program Files\myglobalsearch C:\Program Files\MyGlobalSearch\bar\1.bin\M9FFXTBR.JAR C:\Program Files\MyGlobalSearch\bar\1.bin\M9FFXTBR.MANIFEST C:\Program Files\myglobalsearch\bar\1.bin\M9NTSTBR.JAR C:\Program Files\myglobalsearch\bar\1.bin\M9NTSTBR.MANIFEST C:\Program Files\myglobalsearch\bar\1.bin\M9PLUGIN.DLL C:\Program Files\MyGlobalSearch\bar\1.bin\MGSBAR.DLL C:\Program Files\myglobalsearch\bar\1.bin\NPMYGLSH.DLL C:\Program Files\myglobalsearch\bar\Cache\[u]0[/u]04AA6F9 C:\Program Files\MyGlobalSearch\bar\Cache\[u]0[/u]04ABAD7.bin C:\Program Files\myglobalsearch\bar\Cache\[u]0[/u]04ABD18.bin C:\Program Files\myglobalsearch\bar\Cache\[u]0[/u]04ABE40.bin C:\Program Files\myglobalsearch\bar\Cache\files.ini C:\Program Files\myglobalsearch\bar\History\search C:\Program Files\myglobalsearch\bar\Settings\prevcfg.htm C:\Windows\system32\A2D18CB417.dll C:\Windows\system32\ACER.exe . ((((((((((((((((((((((((( Files Created from 2008-03-18 to 2008-04-18 ))))))))))))))))))))))))))))))) . 2008-04-17 15:03 . 2008-04-17 15:05 1,631 --a------ C:\Bux.to Autoclicker.lnk 2008-04-16 15:10 . 2008-04-16 15:10 <DIR> d-------- C:\Program Files\Movie Maker 2.6 2008-04-16 14:30 . 2008-04-16 14:30 <DIR> d-------- C:\Program Files\SystemRequirementsLab 2008-04-16 14:29 . 2008-04-16 14:30 <DIR> d-------- C:\Users\kici\SystemRequirementsLab 2008-04-16 10:18 . 2008-04-16 10:18 <DIR> d-------- C:\Program Files\Rockstar Games 2008-04-16 10:11 . 2008-04-16 10:11 <DIR> d-------- C:\Users\kici\AppData\Roaming\MegauploadToolbar 2008-04-16 10:11 . 2008-04-16 10:11 <DIR> d-------- C:\Program Files\MegauploadToolbar 2008-04-15 19:04 . 2008-04-15 19:04 <DIR> d-------- C:\Program Files\Common Files\Thraex Software 2008-04-15 19:04 . 2008-04-18 13:19 <DIR> d-------- C:\PacSteamT 2008-04-14 18:01 . 2008-04-14 18:01 721,932 --a------ C:\plik.exe 2008-04-11 23:31 . 2008-04-17 22:22 <DIR> d-------- C:\Users\kici\AppData\Roaming\Skype 2008-04-11 22:38 . 2008-04-11 22:38 <DIR> d-------- C:\Program Files\Skype 2008-04-11 22:38 . 2008-04-11 22:38 <DIR> d-------- C:\Program Files\Common Files\Skype 2008-04-11 19:36 . 2008-04-17 18:52 <DIR> d-------- C:\Program Files\Common Files\Steam 2008-04-11 19:26 . 2008-04-15 19:54 <DIR> d-------- C:\Program Files\Steam 2008-04-09 13:31 . 2008-04-09 13:31 1,025 --a------ C:\Windows\mozver.dat 2008-04-09 07:13 . 2008-02-15 01:19 944,184 --a------ C:\Windows\System32\winload.exe 2008-04-09 07:13 . 2008-02-19 07:10 620,088 --a------ C:\Windows\System32\ci.dll 2008-04-09 07:13 . 2008-02-29 08:39 371,712 --a------ C:\Windows\System32\srcore.dll 2008-04-09 07:13 . 2008-02-29 08:38 313,856 --a------ C:\Windows\System32\rstrui.exe 2008-04-09 07:13 . 2008-02-29 08:39 40,960 --a------ C:\Windows\System32\srclient.dll 2008-04-09 07:13 . 2008-02-29 08:51 19,000 --a------ C:\Windows\System32\kd1394.dll 2008-04-09 07:13 . 2008-02-29 08:38 16,384 --a------ C:\Windows\System32\srdelayed.exe 2008-04-09 07:13 . 2008-02-29 08:34 7,168 --a------ C:\Windows\System32\f3ahvoas.dll 2008-04-09 07:13 . 2008-02-29 08:35 6,656 --a------ C:\Windows\System32\kbd106n.dll 2008-04-08 17:51 . 2008-04-08 17:51 <DIR> d-------- C:\Automap 2008-04-08 16:38 . 2008-04-18 13:36 <DIR> d-------- C:\Program Files\Cellmons 2008-04-07 18:19 . 2008-04-07 18:19 177 --a------ C:\ioSpecial.ini 2008-03-29 01:24 . 2008-03-29 01:24 <DIR> d-------- C:\Users\Gość\AppData\Roaming\Adobe 2008-03-29 01:20 . 2008-03-29 01:20 <DIR> d-------- C:\Users\Gość\AppData\Roaming\Mozilla 2008-03-29 01:20 . 2008-03-29 01:20 <DIR> d-------- C:\Users\Gość\AppData\Roaming\Kamerzysta 2008-03-27 14:22 . 2008-03-27 14:22 <DIR> d-------- C:\Users\kici\AppData\Roaming\Onet 2008-03-27 14:22 . 2008-03-27 14:22 <DIR> d-------- C:\Users\kici\AppData\Roaming\MozillaControl 2008-03-27 14:22 . 2008-03-27 14:22 <DIR> d-------- C:\Users\kici\AppData\Roaming\Listonosz 2008-03-24 08:49 . 2008-04-10 07:19 8,224 --a------ C:\Windows\System32\GDIPFONTCACHEV1.DAT 2008-03-24 00:10 . 2008-03-24 00:10 <DIR> d-------- C:\Users\kici\AppData\Roaming\Ulead Systems 2008-03-24 00:05 . 2008-03-24 08:47 <DIR> d-------- C:\Users\All Users\Ulead Systems 2008-03-24 00:05 . 2008-03-24 08:47 <DIR> d-------- C:\ProgramData\Ulead Systems 2008-03-24 00:05 . 2008-03-24 00:05 <DIR> d-------- C:\Program Files\Corel 2008-03-24 00:05 . 2008-03-24 00:08 <DIR> d-------- C:\Program Files\Common Files\Ulead Systems 2008-03-23 23:59 . 2008-03-23 23:59 <DIR> d-------- C:\Windows\Downloaded Installations 2008-03-21 18:58 . 2008-03-21 18:58 <DIR> d-------- C:\Users\kici\AppData\Roaming\Raxso 2008-03-21 18:58 . 2008-03-21 18:58 <DIR> d-------- C:\Program Files\Raxso 2008-03-21 18:41 . 2008-03-21 18:51 <DIR> d-------- C:\Users\All Users\Protexis 2008-03-21 18:41 . 2008-03-21 18:51 <DIR> d-------- C:\ProgramData\Protexis 2008-03-21 18:09 . 2008-03-21 18:09 <DIR> d-------- C:\Program Files\Trend Micro 2008-03-18 15:52 . 2008-03-18 15:52 <DIR> d-------- C:\Program Files\INTERIAPL . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-04-18 14:34 786,432 --sha-w C:\Users\Gość\NTUSER.DAT 2008-04-18 14:34 786,432 --sha-w C:\Users\Gość\NTUSER.DAT 2008-04-18 11:24 --------- d-----w C:\ProgramData\Symantec 2008-04-18 11:24 --------- d-----w C:\ProgramData\GamesBar 2008-04-18 11:20 --------- d-----w C:\Program Files\Tlen.pl 2008-04-17 18:41 --------- d-----w C:\Users\kici\AppData\Roaming\skypePM 2008-04-17 14:04 --------- d-----w C:\Program Files\Valve 2008-04-16 08:29 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-04-11 20:38 --------- d-----w C:\ProgramData\Skype 2008-04-09 10:23 --------- d-----w C:\ProgramData\Microsoft Help 2008-04-08 15:51 --------- d-----w C:\Program Files\Tibia 2008-04-07 18:10 --------- d-----w C:\Program Files\Common Files\Onet.pl 2008-04-07 16:13 --------- d-----w C:\Program Files\Yahoo! 2008-04-07 16:10 --------- d-----w C:\Program Files\sXe Injected 2008-04-06 07:15 --------- d-----w C:\Program Files\Launch Manager 2008-03-28 23:24 --------- d-----w C:\Users\Gość\AppData\Roaming\Adobe 2008-03-28 23:20 --------- d-----w C:\Users\Gość\AppData\Roaming\Mozilla 2008-03-28 23:20 --------- d-----w C:\Users\Gość\AppData\Roaming\Kamerzysta 2008-03-28 08:21 --------- d-----w C:\Program Files\Onet 2008-03-14 21:30 110 ----a-w C:\Users\kici\AppData\Roaming\wklnhst.dat 2008-02-29 04:16 2,027,008 ----a-w C:\Windows\System32\win32k.sys 2008-02-28 16:41 --------- d-----w C:\Users\kici\AppData\Roaming\Tlen.pl 2008-02-26 20:14 --------- d-----w C:\Program Files\BearShare 2008-02-26 12:47 --------- d-----w C:\Users\kici\AppData\Roaming\BearShare 2008-02-26 10:27 --------- d-----w C:\Program Files\BearShare Applications 2008-02-24 19:22 2,560 ----a-w C:\Windows\_MSRSTRT.EXE 2008-02-23 16:55 --------- d-----w C:\Users\kici\AppData\Roaming\Tibia 2008-02-23 14:18 --------- d-----w C:\Program Files\Gadu-Gadu 2008-02-23 13:42 --------- d-----w C:\Users\kici\AppData\Roaming\Kamerzysta 2008-02-23 13:42 --------- d-----w C:\Users\kici\AppData\Roaming\AutoUpdate 2008-02-22 20:06 --------- d-----w C:\Users\Gość\AppData\Roaming\Macromedia 2008-02-22 20:06 --------- d-----w C:\Users\Gość\AppData\Roaming\ATI 2008-02-22 20:05 --------- d-s---w C:\Users\Gość\AppData\Roaming\Microsoft 2008-02-22 20:04 --------- d-----w C:\Users\Gość\AppData\Roaming\Identities 2008-02-22 13:58 --------- d-----w C:\Users\kici\AppData\Roaming\Talkback 2008-02-21 04:43 826,368 ----a-w C:\Windows\System32\wininet.dll 2008-02-21 04:43 56,320 ----a-w C:\Windows\System32\iesetup.dll 2008-02-21 04:43 52,736 ----a-w C:\Windows\AppPatch\iebrshim.dll 2008-02-21 04:43 296,448 ----a-w C:\Windows\System32\gdi32.dll 2008-02-21 04:43 26,624 ----a-w C:\Windows\System32\ieUnatt.exe 2008-02-19 20:50 32 ----a-w C:\Users\All Users\ezsid.dat 2008-02-19 20:50 32 ----a-w C:\ProgramData\ezsid.dat 2008-02-14 06:39 194,560 ----a-w C:\Windows\System32\WebClnt.dll 2008-02-14 06:33 24,064 ----a-w C:\Windows\System32\netcfg.exe 2008-02-14 06:33 22,016 ----a-w C:\Windows\System32\netiougc.exe 2008-02-14 06:33 167,424 ----a-w C:\Windows\System32\tcpipcfg.dll 2008-02-03 08:38 87,040 ----a-w C:\Windows\System32\msoert2.dll 2008-02-03 08:38 49,664 ----a-w C:\Windows\System32\csrsrv.dll 2008-02-03 08:38 39,424 ----a-w C:\Windows\System32\ACCTRES.dll 2008-02-03 08:38 376,320 ----a-w C:\Windows\System32\winsrv.dll 2008-02-03 08:38 205,824 ----a-w C:\Windows\System32\msoeacct.dll 2008-02-03 08:36 86,016 ----a-w C:\Windows\System32\icfupgd.dll 2008-02-03 08:36 61,952 ----a-w C:\Windows\System32\cmifw.dll 2008-02-03 08:36 396,800 ----a-w C:\Windows\System32\MPSSVC.dll 2008-02-03 08:36 392,192 ----a-w C:\Windows\System32\FirewallAPI.dll 2008-02-03 08:36 374,456 ----a-w C:\Windows\System32\mcupdate_GenuineIntel.dll 2008-02-03 08:36 178,688 ----a-w C:\Windows\System32\iphlpsvc.dll 2008-02-03 08:36 16,896 ----a-w C:\Windows\System32\wfapigp.dll 2008-02-03 08:34 8,147,968 ----a-w C:\Windows\System32\wmploc.DLL 2008-02-03 08:34 7,680 ----a-w C:\Windows\System32\spwmp.dll 2008-02-03 08:34 4,096 ----a-w C:\Windows\System32\dxmasf.dll 2008-02-03 08:34 2,048 ----a-w C:\Windows\System32\msxml3r.dll 2008-02-03 08:34 1,191,936 ----a-w C:\Windows\System32\msxml3.dll 2008-02-03 08:33 9,728 ----a-w C:\Windows\System32\LAPRXY.DLL 2008-02-03 08:33 223,232 ----a-w C:\Windows\System32\WMASF.DLL 2008-02-03 08:33 2,048 ----a-w C:\Windows\System32\asferror.dll 2008-02-03 08:33 1,327,104 ----a-w C:\Windows\System32\quartz.dll 2008-02-03 08:32 84,480 ----a-w C:\Windows\System32\INETRES.dll 2008-02-03 08:32 737,792 ----a-w C:\Windows\System32\inetcomm.dll 2008-02-03 08:32 2,048 ----a-w C:\Windows\System32\msxml6r.dll 2008-02-03 08:32 1,335,296 ----a-w C:\Windows\System32\msxml6.dll 2008-02-03 08:31 11,776 ----a-w C:\Windows\System32\sbunattend.exe 2008-02-03 08:29 788,992 ----a-w C:\Windows\System32\rpcrt4.dll 2008-02-03 08:28 5,120 ----a-w C:\Windows\System32\wmi.dll 2008-02-03 08:28 152,576 ----a-w C:\Windows\System32\imagehlp.dll 2008-02-03 08:27 3,504,824 ----a-w C:\Windows\System32\ntkrnlpa.exe 2008-02-03 08:27 3,470,520 ----a-w C:\Windows\System32\ntoskrnl.exe 2008-02-03 08:27 2,048 ----a-w C:\Windows\System32\tzres.dll 2008-02-03 08:26 750,080 ----a-w C:\Windows\System32\qmgr.dll 2008-02-03 08:26 633,856 ----a-w C:\Windows\System32\user32.dll 2008-02-01 23:23 53,080 ----a-w C:\Windows\System32\wuauclt.exe 2008-02-01 23:23 43,352 ----a-w C:\Windows\System32\wups2.dll 2008-02-01 23:23 1,712,984 ----a-w C:\Windows\System32\wuaueng.dll 2008-02-01 23:23 1,524,224 ----a-w C:\Windows\System32\wucltux.dll 2008-02-01 23:22 80,896 ----a-w C:\Windows\System32\wudriver.dll 2008-02-01 23:22 549,720 ----a-w C:\Windows\System32\wuapi.dll 2008-02-01 23:22 33,624 ----a-w C:\Windows\System32\wups.dll 2008-02-01 23:22 31,232 ----a-w C:\Windows\System32\wuapp.exe 2008-02-01 23:22 163,000 ----a-w C:\Windows\System32\wuwebv.dll 2008-01-29 16:29 181,760 ----a-w C:\Windows\System32\fsquirt.exe 2006-11-02 12:50 174 --sha-w C:\Program Files\desktop.ini . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Sidebar"="C:\Program Files\Windows Sidebar\sidebar.exe" [2008-02-03 10:31 1232896] "WindowsWelcomeCenter"="oobefldr.dll" [2006-11-02 14:34 2159104 C:\Windows\System32\oobefldr.dll] "Gadu-Gadu"="C:\Program Files\Gadu-Gadu\gg.exe" [2007-11-14 12:54 2131392] "swg"="C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe" [2008-01-30 21:28 171448] "IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" [ ] "ehTray.exe"="C:\Windows\ehome\ehTray.exe" [2006-11-02 14:35 125440] "Vidalia"="C:\Program Files\Vidalia Bundle\Vidalia\vidalia.exe" [ ] "WMPNSCFG"="C:\Program Files\Windows Media Player\WMPNSCFG.exe" [2006-11-02 14:36 201728] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [2006-11-02 14:34 1004136] "IAAnotif"="C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe" [2007-03-21 13:00 174872] "StartCCC"="C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2006-11-10 12:35 90112] "RtHDVCpl"="RtHDVCpl.exe" [2007-05-10 11:10 4468736 C:\Windows\RtHDVCpl.exe] "eAudio"="C:\Acer\Empowering Technology\eAudio\eAudio.exe" [2007-05-09 10:36 1286144] "eDataSecurity Loader"="C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe" [2007-04-12 17:42 457728] "Acer Tour"="" [] "ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2006-11-21 06:44 107112] "osCheck"="C:\Program Files\Norton Internet Security\osCheck.exe" [2006-11-21 06:42 22696] "SetPanel"="C:\Acer\APanel\APanel.cmd" [ ] "LManager"="C:\PROGRA~1\LAUNCH~1\LManager.exe" [2007-04-04 09:02 678672] "PlayMovie"="C:\Program Files\Acer Arcade Deluxe\Play Movie\PMVService.exe" [2007-05-03 12:16 206952] "WarReg_PopUp"="C:\Acer\WR_PopUp\WarReg_PopUp.exe" [2006-11-05 22:48 57344] "Apoint"="C:\Program Files\Apoint2K\Apoint.exe" [2006-11-07 14:57 159744] "eRecoveryService"="" [] "Acer Tour Reminder"="C:\Acer\AcerTour\Reminder.exe" [2007-02-15 18:39 151552] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 02:11 132496] "NBKeyScan"="C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" [ ] "Onet.pl AutoUpdate"="C:\Program Files\Common Files\Onet.pl\AutoUpdate.exe" [2006-02-08 16:40 260096] "BearShare"="C:\Program Files\BearShare\BearShare.exe" [ ] "Ulead AutoDetector v2"="C:\Program Files\Common Files\Ulead Systems\AutoDetector\monitor.exe" [2007-08-02 22:08 95504] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "Acer Tour Reminder"="C:\Acer\AcerTour\Reminder.exe" [2007-02-15 18:39 151552] C:\Users\kici\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ Bux.to Autoclicker.lnk - C:\Users\kici\Desktop\Bux.to Autoclicker\Bux.to Autoclicker.exe [2008-04-17 15:03:08 876544] Tworzenie wycink˘w ekranu i uruchamianie programu OneNote 2007.lnk - C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE [2006-10-26 20:24:54 98632] C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\ Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2004-12-14 04:44:06 29696] BTTray.lnk - C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe [2007-03-29 14:11:50 719664] Empowering Technology Launcher.lnk - C:\Acer\Empowering Technology\eAPLauncher.exe [2007-06-02 22:46:26 535336] Ulead Photo Express 3.0 SE Calendar Checker.lnk - C:\Program Files\Ulead Systems\Ulead Photo Express 3.0 SE\CalCheck.exe [2008-02-07 22:50:29 61440] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "EnableLUA"= 0 (0x0) [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system] "LogonHoursAction"= 2 (0x2) "DontDisplayLogonHoursWarnings"= 1 (0x1) [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules] "{DD687045-C9FB-4EE3-9F4B-EDF0F5996149}"= C:\Program Files\Acer Arcade Deluxe\Acer Arcade Deluxe\Acer Arcade Deluxe.exe:Acer Arcade Deluxe "{577F3198-4CF2-4088-B1B8-CDA775F737A1}"= C:\Program Files\Acer Arcade Deluxe\DVDivine\DVDivine.exe:DVDivine "{72D1FE72-0003-4B5B-9C50-AB6356467B9F}"= C:\Program Files\Acer Arcade Deluxe\VideoMagician\VideoMagician.exe:VideoMagician "{6C0AF82D-206F-4F0E-9CAE-AA43108FD970}"= C:\Program Files\Acer Arcade Deluxe\HomeMedia\HomeMedia.exe:HomeMedia "{055D1AE9-1458-4F65-91BC-5F99BD11A21B}"= C:\Program Files\Acer Arcade Deluxe\DV Wizard\DV Wizard.exe:DV Wizard "{E53333D8-5A67-49ED-9F5D-6932C59EF80B}"= UDP:C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote "{D03477C3-CB4F-4548-96EE-C1A6EABEE069}"= TCP:C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote "{81FE2214-5C80-4944-B5CD-8B1A06D1843A}"= C:\Program Files\Acer Arcade Deluxe\Play Movie\PlayMovie.exe:Play Movie "{6423FBE7-1DFF-4EAE-9F99-9A7DAC494757}"= C:\Program Files\Acer Arcade Deluxe\Play Movie\PMVService.exe:Play Movie Resident Program "TCP Query User{E0743C2B-A7AB-41DE-80DD-894410749BE4}C:\\program files\\gadu-gadu\\gg.exe"= UDP:C:\program files\gadu-gadu\gg.exe:Gadu-Gadu - program główny "UDP Query User{69795C1A-289F-45F0-B78D-19E807ACC9E0}C:\\program files\\gadu-gadu\\gg.exe"= TCP:C:\program files\gadu-gadu\gg.exe:Gadu-Gadu - program główny "TCP Query User{845F2CC1-5437-442B-A724-1A2B75313AB2}C:\\program files\\valve\\hl.exe"= UDP:C:\program files\valve\hl.exe:Half-Life Launcher "UDP Query User{89C86222-115A-4D98-8FEE-6B75C4EE2C86}C:\\program files\\valve\\hl.exe"= TCP:C:\program files\valve\hl.exe:Half-Life Launcher "TCP Query User{6DE8B1B4-69B0-41D0-A6DC-C2914997AA72}C:\\program files\\wapster\\aqq\\aqq.exe"= UDP:C:\program files\wapster\aqq\aqq.exe:AQQ "UDP Query User{42A63859-484C-4CB5-A7AE-3A4E03A3F896}C:\\program files\\wapster\\aqq\\aqq.exe"= TCP:C:\program files\wapster\aqq\aqq.exe:AQQ "TCP Query User{5ACD0608-66A0-4C43-AB9E-26AE93F8575C}C:\\program files\\valve\\hlds.exe"= UDP:C:\program files\valve\hlds.exe:HLDS Launcher "UDP Query User{122E7EE2-4B4C-4953-AD93-04F5D4A5EBC8}C:\\program files\\valve\\hlds.exe"= TCP:C:\program files\valve\hlds.exe:HLDS Launcher "TCP Query User{78A45DAC-CF72-4D8F-886B-7556F6919751}C:\\program files\\valve\\hlds.exe"= UDP:C:\program files\valve\hlds.exe:HLDS Launcher "UDP Query User{4E8058CE-E0DE-4BA6-85A4-EE7D7AF7C47A}C:\\program files\\valve\\hlds.exe"= TCP:C:\program files\valve\hlds.exe:HLDS Launcher "{31BEE067-382C-46A7-98E5-D1327D4153AE}"= Disabled:UDP:C:\Program Files\Skype\Phone\Skype.exe:Skype "{7974C522-F4E1-4FCD-A902-9F17001BC94B}"= Disabled:TCP:C:\Program Files\Skype\Phone\Skype.exe:Skype "{0C96D961-6B04-41FA-B174-BDA8F7367878}"= Disabled:UDP:C:\Program Files\Skype\Phone\Skype.exe:Skype "{73AA0ED5-A98B-4F58-BE1C-215806EC44DD}"= Disabled:TCP:C:\Program Files\Skype\Phone\Skype.exe:Skype [HKLM\~\services\sharedaccess\parameters\firewallpolicy\RestrictedServices\Static\System] "DFSR-1"= RPort=5722|UDP:%SystemRoot%\system32\svchost.exe|Svc=DFSR:Allow inbound TCP traffic| [HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile] "EnableFirewall"= 0 (0x0) R0 PSDFilter;PSDFilter;C:\Windows\system32\DRIVERS\psdfilter.sys [2007-04-12 17:43] R0 PSDNServ;PSDNSERVER;C:\Windows\system32\drivers\PSDNServ.sys [2007-04-12 17:43] R0 psdvdisk;psdvdisk;C:\Windows\system32\drivers\psdvdisk.sys [2007-04-12 17:43] R1 IDSvix86;Symantec Intrusion Prevention Driver;C:\PROGRA~2\Symantec\DEFINI~1\SymcData\idsdefs\20080415.002\IDSvix86.sys [2008-02-13 18:18] R2 {49DE1C67-83F8-4102-99E0-C16DCC7EEC796};{49DE1C67-83F8-4102-99E0-C16DCC7EEC796};C:\Program Files\Acer Arcade Deluxe\Play Movie\[u]0[/u]00.fcl [2006-11-02 17:51] R2 eDataSecurity Service;eDSService.exe;"C:\Acer\Empowering Technology\eDataSecurity\eDSService.exe" [2007-04-12 17:43] R2 eNet Service;eNet Service;C:\Acer\Empowering Technology\eNet\eNet Service.exe [2007-04-17 19:36] R2 eSettingsService;eSettings Service;C:\Acer\Empowering Technology\eSettings\Service\capuserv.exe [2007-05-10 14:05] R2 MobilityService;MobilityService;C:\Acer\Mobility Center\MobilityService.exe [2006-11-24 12:57] R2 WMIService;ePower Service;C:\Acer\Empowering Technology\ePower\ePowerSvc.exe [2007-05-16 22:15] R2 XAudio;XAudio;C:\Windows\system32\DRIVERS\xaudio.sys [2006-11-28 10:44] R3 atikmdag;atikmdag;C:\Windows\system32\DRIVERS\atikmdag.sys [2007-05-04 16:19] R3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;C:\Windows\system32\DRIVERS\b57nd60x.sys [2007-02-08 09:03] R3 Cam5607;Acer Crystal Eye webcam;C:\Windows\system32\Drivers\BisonC07.sys [2007-04-10 05:17] R3 enecir;ENE CIR Receiver;C:\Windows\system32\DRIVERS\enecir.sys [2007-03-07 10:26] R3 SYMNDISV;SYMNDISV;C:\Windows\system32\Drivers\SYMNDISV.SYS [2006-11-21 06:45] S3 btwaudio;Urz1dzenie dYwiekowe Bluetooth;C:\Windows\system32\drivers\btwaudio.sys [2007-03-29 21:46] S3 btwavdt;Bluetooth AVDT Service;C:\Windows\system32\drivers\btwavdt.sys [2007-02-27 08:20] S3 btwrchid;btwrchid;C:\Windows\system32\DRIVERS\btwrchid.sys [2007-02-27 08:20] S3 Steam Client Service;Steam Client Service;C:\Program Files\Common Files\Steam\SteamService.exe [2008-04-17 18:51] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] bthsvcs REG_MULTI_SZ BthServ *Newly Created Service* - CATCHME *Newly Created Service* - COMHOST . Contents of the 'Scheduled Tasks' folder "2008-04-11 18:00:22 C:\Windows\Tasks\Norton Internet Security - Run Full System Scan - kici.job" - C:\PROGRA~1\NORTON~1\NORTON~1\Navw32.exeB/TASK: . ************************************************************************** catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-04-18 16:40:22 Windows 6.0.6000 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2008-04-18 16:41:37 ComboFix-quarantined-files.txt 2008-04-18 14:41:30 Pre-Run: 32,875,544,576 bajtów wolnych Post-Run: 33,558,257,664 bajtów wolnych . 2008-04-09 10:23:55 --- E O F ---

przez **pp3088** » 18 Kwi 2008, 18:13

Wklej do notatnika:

Kod: Zaznacz wszystko: File:: C:\plik.exe C:\Windows\System32\winload.exe C:\Windows\System32\rstrui.exe C:\Windows\System32\srcore.dll C:\Windows\System32\ci.dll C:\Windows\System32\srclient.dll C:\Windows\System32\kd1394.dll C:\Windows\System32\srdelayed.exe C:\Windows\System32\f3ahvoas.dll C:\Windows\System32\kbd106n.dll Folder:: C:\Users\kici\AppData\Roaming\MegauploadToolbar C:\Program Files\MegauploadToolbar C:\Program Files\BearShare Applications

Plik

zapisz jako

CFScript.txt (najwygodniej będzie, jeśli zapiszesz w takiej lokalizacji, by ikonka CFScript.txt znalazła się obok ikonki ComboFix.exe)
Przeciągnij i upuść ikonkę CFScript.txt na ikonkę ComboFix.exe tak jak tu

Powinno się rozpocząć usuwanie i powstanie log, daj ten log na forum.
Jeśli wszystko pójdzie dobrze, to po restarcie usuń ręcznie folder C: \Qoobox

przez **bigbercik** » 19 Kwi 2008, 10:52

ten log mi usunol pliki Windows, musiałem formata zrobić,nie było innego wyjścia

przez **huber2t** » 19 Kwi 2008, 10:57

No cóż pan moderator złe pliki kazał ci usunąc
trudno aby takich sytuacji było jak najmiej

miedzy innymi to jest plik systemowy "System32\winload.exe" jego nazwa sugeruje nam do czego służy

przez **bigbercik** » 19 Kwi 2008, 11:07

jak nie wie co usunąć to powinien sie nie tykać wogule, ja tyle swoich plików straciłem, po prostu Zal..

przez **pp3088** » 20 Kwi 2008, 10:56

Bardzo przepraszam. Za pózno się zorientowałem, że te logi są z Visty.

Jeszcze raz przepraszam :oops:

.

przez **bigbercik** » 21 Kwi 2008, 10:11

nic sie nie stało tylko mam limity na Radipie a prawie ściągnołem battlefielda2

Prosze o sprawdzenie loga

Prosze o sprawdzenie loga

Kto jest na forum