Straszni mi wszystko zwalnia

przez **aragorn** » 24 Maj 2008, 13:48

zastalowal mi sie jakis wirus i nie moge sobie z nim poradzic, otwiera mi dziesiatki stron i caly czas mieli dyskiem - straszni mi wszystko zwalnia. mm antywirus nod32, alenic nie znaduje, ad-aware ez nic nie znajduje, ani spybot. skanowalem online kasperski i cos znalaz ale nie moglem tgo usunac.ponizej wkleja loga z hijack'a. bedebardzo dzieczy za pomoc.

Kod: Zaznacz wszystko: Logfile of HiJackFree v3.0 Scan saved at 05:33:22, on 2008-05-24 Platform: Windows Vista32 (Windows NT 6.0.6000) MSIE: Internet Explorer v 7.0 (7.0.6000.16643) Running processes: C:\Windows\System32\smss.exe C:\Windows\System32\csrss.exe C:\Windows\System32\wininit.exe C:\Windows\System32\csrss.exe C:\Windows\System32\services.exe C:\Windows\System32\lsass.exe C:\Windows\System32\lsm.exe C:\Windows\System32\winlogon.exe C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe C:\Windows\System32\SLsvc.exe C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe C:\Windows\System32\spoolsv.exe C:\Windows\System32\svchost.exe C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe C:\Windows\System32\SearchIndexer.exe C:\Windows\System32\taskeng.exe C:\Windows\System32\taskeng.exe C:\Windows\System32\dwm.exe C:\Windows\explorer.exe C:\Program Files\Windows Defender\MSASCui.exe C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe C:\Windows\System32\igfxtray.exe C:\Windows\System32\hkcmd.exe C:\Windows\System32\igfxpers.exe C:\Windows\OEM02Mon.exe C:\Windows\System32\rundll32.exe C:\Program Files\Spybot C:\Windows\System32\rundll32.exe C:\Windows\System32\igfxsrvc.exe C:\Windows\System32\wuauclt.exe C:\Program Files\Internet Explorer\ieuser.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\a-squared HiJackFree\a2hijackfree.exe C:\Windows\System32\dllhost.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.centrumxp.pl/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(.Default) = R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = O2 - BHO: - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe O4 - HKLM\..\Run: [OEM02Mon.exe] C:\Windows\OEM02Mon.exe O4 - HKLM\..\Run: [MSConfig] "C:\Windows\system32\msconfig.exe" /auto O4 - HKLM\..\Run: [cmds] rundll32.exe C:\Users\Maciek\AppData\Local\Temp\geBsrRjH.dll,c O4 - HKLM\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe O4 - HKLM\..\Run: [BM77bb9c92] Rundll32.exe "C:\Users\Maciek\AppData\Local\Temp\eetbhvya.dll",s O4 - HKLM\..\Run: [7488af0e] rundll32.exe "C:\Users\Maciek\AppData\Local\Temp\merpykal.dll",b O4 - HKLM\..\Run: [BM77bb9c92] Rundll32.exe "C:\Users\Maciek\AppData\Local\Temp\eetbhvya.dll",s O4 - HKLM\..\Run: [MSServer] rundll32.exe C:\Users\Maciek\AppData\Local\Temp\qoMExutq.dll,#1 O7 - Regedit - Enabled O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000 O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFBAR.ICO O14 - IERESET.INF: SearchAssistant= O14 - IERESET.INF: CustomizeSearch= O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab O20 - Winlogon Notify: igfxcui - C:\Windows\System32\igfxdev.dll O21 - ShellServiceObjectDelayLoad: WebCheck - O22 - SharedTaskScheduler: Component Categories cache daemon - C:\Windows\system32\browseui.dll O23 - Usługa: Ad-Aware 2007 Service - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe O23 - Usługa: Application Experience Service - C:\Windows\system32\svchost.exe O23 - Usługa: Application Layer Gateway Service - C:\Windows\System32\alg.exe O23 - Usługa: Application Information Service - C:\Windows\system32\svchost.exe O23 - Usługa: Windows Audio Service - C:\Windows\System32\svchost.exe O23 - Usługa: Windows Audio Service - C:\Windows\System32\svchost.exe O23 - Usługa: Background Intelligent Transfer Service - C:\Windows\System32\svchost.exe O23 - Usługa: Computer Browser Service DLL - C:\Windows\System32\svchost.exe O23 - Usługa: Microsoft Smartcard Certificate Propagation Service - C:\Windows\system32\svchost.exe O23 - Usługa: Microsoft .NET Framework NGEN v2.0.50727_X86 - C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe O23 - Usługa: COMSysApp - C:\Windows\system32\dllhost.exe O23 - Usługa: Cryptographic Services - C:\Windows\system32\svchost.exe O23 - Usługa: DFSR - C:\Windows\system32\DFSR.exe O23 - Usługa: DHCP Client Service - C:\Windows\system32\svchost.exe O23 - Usługa: DNS Client API DLL - C:\Windows\system32\svchost.exe O23 - Usługa: Wired AutoConfig Service - C:\Windows\system32\svchost.exe O23 - Usługa: Microsoft EAPHost service - C:\Windows\System32\svchost.exe O23 - Usługa: Windows Media Center Receiver Service - C:\Windows\ehome\ehRecvr.exe O23 - Usługa: Windows Media Center Scheduler Service - C:\Windows\ehome\ehsched.exe O23 - Usługa: Windows Media Center Service Launcher - C:\Windows\\system32\svchost.exe O23 - Usługa: Eset HTTP Server - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe O23 - Usługa: Eset Service - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe O23 - Usługa: ReadyBoost Service - C:\Windows\system32\svchost.exe O23 - Usługa: Event Logging Service - C:\Windows\System32\svchost.exe O23 - Usługa: EventSystem - C:\Windows\system32\svchost.exe O23 - Usługa: WS Discovery Service - C:\Windows\system32\svchost.exe O23 - Usługa: Function Discovery Resource Publication Service - C:\Windows\system32\svchost.exe O23 - Usługa: Windows Presentation Foundation Host - C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe O23 - Usługa: HID Service - C:\Windows\system32\svchost.exe O23 - Usługa: Key Management Service - C:\Windows\System32\svchost.exe O23 - Usługa: Service Model Installer Resource Library - C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe O23 - Usługa: IKE extension - C:\Windows\system32\svchost.exe O23 - Usługa: PnP-X IP Bus Enumerator DLL - C:\Windows\system32\svchost.exe O23 - Usługa: Service that offers IPv6 connectivity over an IPv4 network. - C:\Windows\System32\svchost.exe O23 - Usługa: KeyIso - C:\Windows\system32\lsass.exe O23 - Usługa: KtmRm - C:\Windows\System32\svchost.exe O23 - Usługa: Server Service DLL - C:\Windows\system32\svchost.exe O23 - Usługa: Workstation Service DLL - C:\Windows\System32\svchost.exe O23 - Usługa: Link-Layer Topology Discovery Resources - C:\Windows\System32\svchost.exe O23 - Usługa: TCPIP NetBios Transport Services DLL - C:\Windows\system32\svchost.exe O23 - Usługa: Media Center Resources - C:\Windows\system32\svchost.exe O23 - Usługa: Multimedia Class Scheduler Service - C:\Windows\system32\svchost.exe O23 - Usługa: Windows Firewall API - C:\Windows\system32\svchost.exe O23 - Usługa: MSDTC - C:\Windows\System32\msdtc.exe O23 - Usługa: iSCSI Discovery api - C:\Windows\system32\svchost.exe O23 - Usługa: Windows® Installer International Messages - C:\Windows\system32\msiexec O23 - Usługa: Quarantine Agent Service Run-Time - C:\Windows\System32\svchost.exe O23 - Usługa: Nero BackItUp Scheduler 3 - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe O23 - Usługa: Net Logon Services DLL - C:\Windows\system32\lsass.exe O23 - Usługa: Network Connections Manager - C:\Windows\System32\svchost.exe O23 - Usługa: Network Profile Management UI - C:\Windows\System32\svchost.exe O23 - Usługa: Service Model Installer Resource Library - C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe O23 - Usługa: Network Location Awareness 2 - C:\Windows\System32\svchost.exe O23 - Usługa: NMIndexingService - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe O23 - Usługa: Eset Nod32 Boot - C:\Windows\system32\regedt32.exe O23 - Usługa: Network Store Interface RPC server - C:\Windows\system32\svchost.exe O23 - Usługa: Microsoft Office Diagnostics Service - C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE O23 - Usługa: Office Source Engine - C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE O23 - Usługa: Peer-to-Peer Services - C:\Windows\System32\svchost.exe O23 - Usługa: Peer-to-Peer Services - C:\Windows\System32\svchost.exe O23 - Usługa: Program Compatibility Assistant Service - C:\Windows\system32\svchost.exe O23 - Usługa: Performance Logs & Alerts - C:\Windows\System32\svchost.exe O23 - Usługa: User-mode Plug-and-Play Service - C:\Windows\system32\svchost.exe O23 - Usługa: Peer-to-Peer Services - C:\Windows\System32\svchost.exe O23 - Usługa: Peer-to-Peer Services - C:\Windows\System32\svchost.exe O23 - Usługa: Policy Storage dll - C:\Windows\system32\svchost.exe O23 - Usługa: ProfSvc - C:\Windows\system32\svchost.exe O23 - Usługa: Protected Storage default provider - C:\Windows\system32\lsass.exe O23 - Usługa: Windows NT - C:\Windows\\system32\svchost.exe O23 - Usługa: Remote Access AutoDial Manager - C:\Windows\system32\svchost.exe O23 - Usługa: Remote Access Connection Manager - C:\Windows\system32\svchost.exe O23 - Usługa: RemoteRegistry - C:\Windows\system32\svchost.exe O23 - Usługa: Rpc Locator - C:\Windows\system32\locator.exe O23 - Usługa: Smart Card Resource Management Server - C:\Windows\system32\svchost.exe O23 - Usługa: Task Scheduler Service - C:\Windows\system32\svchost.exe O23 - Usługa: Microsoft Smartcard Certificate Propagation Service - C:\Windows\system32\svchost.exe O23 - Usługa: Microsoft® Windows Backup Service - C:\Windows\system32\svchost.exe O23 - Usługa: System Event Notification Service (SENS) - C:\Windows\system32\svchost.exe O23 - Usługa: Terminal Services Configuration service - C:\Windows\System32\svchost.exe O23 - Usługa: Microsoft NAT Helper Components - C:\Windows\System32\svchost.exe O23 - Usługa: Windows Shell Services Dll - C:\Windows\System32\svchost.exe O23 - Usługa: Microsoft Software Licensing Service - C:\Windows\system32\SLsvc.exe O23 - Usługa: Software Licensing UI Notification Service - C:\Windows\system32\svchost.exe O23 - Usługa: SNMP Trap - C:\Windows\System32\snmptrap.exe O23 - Usługa: SSDP Service DLL - C:\Windows\system32\svchost.exe O23 - Usługa: Still Image Devices Service - C:\Windows\system32\svchost.exe O23 - Usługa: Microsoft® Volume Shadow Copy Service software provider - C:\Windows\System32\svchost.exe O23 - Usługa: Superfetch Service Host - C:\Windows\system32\svchost.exe O23 - Usługa: Microsoft Tablet PC Input Service - C:\Windows\System32\svchost.exe O23 - Usługa: Microsoft® Windows(TM) Telephony Server - C:\Windows\System32\svchost.exe O23 - Usługa: TBS Service - C:\Windows\System32\svchost.exe O23 - Usługa: Terminal Server Remote Connections Manager - C:\Windows\System32\svchost.exe O23 - Usługa: Windows Shell Services Dll - C:\Windows\System32\svchost.exe O23 - Usługa: Multimedia Class Scheduler Service - C:\Windows\system32\svchost.exe O23 - Usługa: Interactive services detection - C:\Windows\system32\UI0Detect.exe O23 - Usługa: UPnP Device Host - C:\Windows\system32\svchost.exe O23 - Usługa: Desktop Window Manager - C:\Windows\System32\svchost.exe O23 - Usługa: Virtual Disk Service - C:\Windows\System32\vds.exe O23 - Usługa: Microsoft® Volume Shadow Copy Service - C:\Windows\system32\vssvc.exe O23 - Usługa: Windows Time Service - C:\Windows\system32\svchost.exe O23 - Usługa: Windows Connect Now - Config Registrar Service - C:\Windows\System32\svchost.exe O23 - Usługa: WcsPlugInService DLL - C:\Windows\system32\svchost.exe O23 - Usługa: Web DAV Service DLL - C:\Windows\system32\svchost.exe O23 - Usługa: Event Collector Service - C:\Windows\system32\svchost.exe O23 - Usługa: Problem Reports and Solutions - C:\Windows\System32\svchost.exe O23 - Usługa: Windows Error Reporting Service - C:\Windows\System32\svchost.exe O23 - Usługa: Resource Module - C:\Windows\System32\svchost.exe O23 - Usługa: Windows HTTP Services - C:\Windows\system32\svchost.exe O23 - Usługa: WMI - C:\Windows\system32\svchost.exe O23 - Usługa: WSMan Service - C:\Windows\System32\svchost.exe O23 - Usługa: Windows WLAN AutoConfig Service DLL - C:\Windows\system32\svchost.exe O23 - Usługa: WMI Performance Reverse Adapter - C:\Windows\system32\wbem\WmiApSrv.exe O23 - Usługa: Windows Media Player Network Sharing Service - C:\Program Files\Windows Media Player\wmpnetwk.exe O23 - Usługa: WPC Filtering Service - C:\Windows\system32\svchost.exe O23 - Usługa: Portable Device Enumerator - C:\Windows\system32\svchost.exe O23 - Usługa: Windows Security Center Service - C:\Windows\System32\svchost.exe O23 - Usługa: Microsoft Windows Search Indexer - C:\Windows\system32\SearchIndexer.exe O23 - Usługa: Windows Update Agent - C:\Windows\system32\svchost.exe O23 - Usługa: Windows Driver Foundation - User-mode Driver Framework Service - C:\Windows\system32\svchost.exe

przez **aragorn** » 24 Maj 2008, 13:50

zapomnialem dodac ze to vista jesli to ma jakies znaczenie

przez **aragorn** » 24 Maj 2008, 13:54

i jeszce jedno zainstalowalem spybota i caly czas (srednio co sekunde wiec juz tego nawet nie klikam) wyskakuje mi okienko o probie zmiany rejestru

przez **huber2t** » 24 Maj 2008, 14:21

Wyłącz strażnika Spybota

fix w hijackthis

O4 - HKLM\..\Run: [cmds] rundll32.exe C:\Users\Maciek\AppData\Local\Temp\geBsrRjH.dll,c
O4 - HKLM\..\Run: [BM77bb9c92] Rundll32.exe "C:\Users\Maciek\AppData\Local\Temp\eetbhvya.dll",s
O4 - HKLM\..\Run: [7488af0e] rundll32.exe "C:\Users\Maciek\AppData\Local\Temp\merpykal.dll",b
O4 - HKLM\..\Run: [BM77bb9c92] Rundll32.exe "C:\Users\Maciek\AppData\Local\Temp\eetbhvya.dll",s
O4 - HKLM\..\Run: [MSServer] rundll32.exe C:\Users\Maciek\AppData\Local\Temp\qoMExutq.dll,#1
O14 - IERESET.INF: SearchAssistant=
O14 - IERESET.INF: CustomizeSearch=
O21 - ShellServiceObjectDelayLoad: WebCheck -

Pobierz ComboFix, ale nie uruchamiaj
Wklej do notatnika:

Kod: Zaznacz wszystko: File:: C:\Users\Maciek\AppData\Local\Temp\qoMExutq.dll C:\Users\Maciek\AppData\Local\Temp\geBsrRjH.dll C:\Users\Maciek\AppData\Local\Temp\merpykal.dll C:\Users\Maciek\AppData\Local\Temp\eetbhvya.dll C:\Windows\system32\dllhost.exe Driver:: Application Experience Service Application Information Service Windows Audio Service Background Intelligent Transfer Service Computer Browser Service DLL Microsoft Smartcard Certificate Propagation Service COMSysApp Cryptographic Services DHCP Client Service DNS Client API DLL Wired AutoConfig Service Windows Media Center Service Launcher ReadyBoost Service Event Logging Service EventSystem WS Discovery Service HID Service Key Management Service IKE extension PnP-X IP Bus Enumerator DLL Service that offers IPv6 connectivity over an IPv4 network. KeyIso KtmRm Server Service DLL Workstation Service DLL Link-Layer Topology Discovery Resources TCPIP NetBios Transport Services DLL Media Center Resources Multimedia Class Scheduler Service Windows Firewall API MSDTC

Plik

zapisz jako

CFScript.txt (najwygodniej będzie, jeśli zapiszesz w takiej lokalizacji, by ikonka CFScript.txt znalazła się obok ikonki ComboFix.exe)
Przeciągnij i upuść ikonkę CFScript.txt na ikonkę ComboFix.exe tak jak tu

Rozpocznie się usuwanie i powstanie log, daj ten log na forum.

przez **aragorn** » 24 Maj 2008, 17:53

chyba cos poszlo nie tak, w kazdymm razie wydaje mi sie ze zrobilem wszystko zgdonie z zaleceniami. przez dwie godziny probowalem odpalic intenet ale nie dalo rady, chyba cos mi blokowale, bo jak dalem napraw polaczenie to w tle pojawialo sie na ulame sekundy okno "cmd" i znikale ale nic sie nie dzialo w koncu zrobilem nakladke windowsa i poszlo. wklejam ten log ktory mi wyskoczyl. tak czy siak wydaje sie zejest duzo lepiej ale nadal dysk mi mieli. coz jak sie nietobede musial przeinstalowac sytem.

Kod: Zaznacz wszystko: ComboFix 08-05-21.3 - Maciek 2008-05-24 14:04:25.2 - NTFSx86 Microsoft® Windows Vista™ Home Premium 6.0.6000.0.1250.1.1033.18.1283 [GMT 1:00] Running from: C:\Users\Maciek\Desktop\ComboFix.exe * Resident AV is active . ((((((((((((((((((((((((( Files Created from 2008-04-24 to 2008-05-24 ))))))))))))))))))))))))))))))) . 2008-05-23 21:50 . 2008-05-23 21:50 <DIR> d-------- C:\Program Files\a-squared HiJackFree 2008-05-23 20:48 . 2008-05-23 20:48 <DIR> d-------- C:\Windows\System32\Kaspersky Lab 2008-05-23 19:59 . 2008-05-23 20:38 <DIR> d-------- C:\Users\All Users\Spybot - Search & Destroy 2008-05-23 19:59 . 2008-05-23 20:38 <DIR> d-------- C:\ProgramData\Spybot - Search & Destroy 2008-05-23 19:59 . 2008-05-23 19:59 <DIR> d-------- C:\Program Files\Spybot - Search & Destroy 2008-05-23 18:24 . 2008-05-23 18:24 <DIR> d-------- C:\Users\All Users\Lavasoft 2008-05-23 18:24 . 2008-05-23 18:24 <DIR> d-------- C:\ProgramData\Lavasoft 2008-05-23 18:24 . 2008-05-23 18:24 <DIR> d-------- C:\Program Files\Lavasoft 2008-05-23 18:23 . 2008-05-23 18:23 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard 2008-05-22 21:27 . 2008-05-22 21:27 <DIR> d-------- C:\audiograbber 2008-05-22 18:13 . 2008-05-22 18:21 <DIR> d-------- C:\Users\Maciek\AppData\Roaming\AccurateRip 2008-05-22 18:13 . 2008-05-22 21:22 <DIR> d-------- C:\Program Files\Exact Audio Copy 2008-05-22 17:58 . 2008-05-22 17:58 <DIR> d-------- C:\Users\All Users\WinZip 2008-05-22 17:58 . 2008-05-22 17:58 <DIR> d-------- C:\ProgramData\WinZip 2008-05-22 17:25 . 2008-05-22 17:25 <DIR> d-------- C:\Program Files\MSXML 4.0 2008-05-21 21:50 . 2008-05-21 21:55 <DIR> d-------- C:\Program Files\Edgard Multimedia 2008-05-21 21:44 . 2008-05-21 21:44 <DIR> d-------- C:\Program Files\PWN 2008-05-21 21:44 . 1998-11-13 14:10 307,200 --a------ C:\Windows\IsUn0415.exe 2008-05-21 21:44 . 2001-04-04 14:00 245,760 --------- C:\Windows\System32\DECO_32.DLL 2008-05-21 21:25 . 2008-05-21 21:25 <DIR> d-------- C:\Windows\PCHEALTH 2008-05-21 21:25 . 2008-05-21 21:25 <DIR> d-------- C:\Program Files\Microsoft.NET 2008-05-21 21:21 . 2008-05-21 21:29 <DIR> d-------- C:\Users\All Users\Microsoft Help 2008-05-21 21:21 . 2008-05-21 21:29 <DIR> d-------- C:\ProgramData\Microsoft Help 2008-05-21 21:17 . 2008-05-21 21:17 <DIR> dr-h----- C:\MSOCache 2008-05-20 14:04 . 2008-05-20 14:04 <DIR> d-------- C:\Users\All Users\HP 2008-05-20 14:04 . 2008-05-20 14:04 <DIR> d-------- C:\Users\All Users\Hewlett-Packard 2008-05-20 14:04 . 2008-05-20 14:04 <DIR> d-------- C:\ProgramData\HP 2008-05-20 14:04 . 2008-05-20 14:04 <DIR> d-------- C:\ProgramData\Hewlett-Packard 2008-05-20 14:02 . 2007-03-30 16:07 267,864 --a------ C:\Windows\System32\hpzids01.dll 2008-05-20 14:02 . 2007-03-28 14:01 117,760 --a------ C:\Windows\System32\hpzll5ha.dll 2008-05-20 13:55 . 2007-03-17 17:11 675,840 --a------ C:\Windows\System32\hpowiax3.dll 2008-05-20 13:55 . 2007-03-17 17:11 569,344 --a------ C:\Windows\System32\hpotscl3.dll 2008-05-20 13:55 . 2007-03-08 05:20 364,544 --a------ C:\Windows\System32\hppldcoi.dll 2008-05-20 13:55 . 2007-03-17 17:11 303,104 --a------ C:\Windows\System32\hpovst10.dll 2008-05-19 19:02 . 2008-05-23 19:42 <DIR> d-------- C:\Users\Maciek\AppData\Roaming\uTorrent 2008-05-19 19:02 . 2008-05-19 19:02 <DIR> d-------- C:\Program Files\uTorrent 2008-05-15 19:29 . 2008-05-15 19:30 <DIR> d-------- C:\Users\Maciek\AppData\Roaming\InternetCalls 2008-05-15 19:29 . 2008-05-15 19:29 <DIR> d-------- C:\Program Files\InternetCalls.com 2008-05-15 05:32 . 2008-05-15 05:33 <DIR> d-------- C:\Users\All Users\Adobe 2008-05-15 05:32 . 2008-05-15 05:33 <DIR> d-------- C:\Program Files\Common Files\Adobe 2008-05-14 20:34 . 2008-05-14 20:34 <DIR> d-------- C:\Users\Wiesia\AppData\Roaming\Nero 2008-05-14 20:20 . 2008-05-14 20:20 <DIR> d-------- C:\Users\Maciek\AppData\Roaming\Nero 2008-05-14 20:18 . 2008-05-14 20:18 <DIR> d-------- C:\Users\All Users\Nero 2008-05-14 20:18 . 2008-05-14 20:18 <DIR> d-------- C:\ProgramData\Nero 2008-05-14 20:18 . 2008-05-14 20:18 <DIR> d-------- C:\Program Files\Nero 2008-05-14 20:18 . 2008-05-14 20:20 <DIR> d-------- C:\Program Files\Common Files\Nero 2008-05-14 11:03 . 2008-05-14 11:03 200,575,262 --a------ C:\Windows\MEMORY.DMP 2008-05-13 20:33 . 2003-06-23 02:44 1,415,680 --a------ C:\Windows\System32\WMV9VCM.DLL 2008-05-13 20:33 . 1999-11-12 16:25 215,216 --a------ C:\Windows\System32\msadds32.ax 2008-05-13 20:33 . 1999-12-16 00:01 49,152 --a------ C:\Windows\System32\TSCCVID.DLL 2008-05-13 20:24 . 2008-05-13 20:37 <DIR> d-------- C:\Program Files\TESTOUT 2008-05-13 17:46 . 2008-05-13 17:46 <DIR> d-------- C:\Windows\System32\Macromed 2008-05-13 17:21 . 2008-05-13 17:21 205,824 --a------ C:\Windows\System32\msoeacct.dll 2008-05-13 17:21 . 2008-05-13 17:21 194,560 --a------ C:\Windows\System32\WebClnt.dll 2008-05-13 17:21 . 2008-05-13 17:21 110,080 --a------ C:\Windows\System32\drivers\mrxdav.sys 2008-05-13 17:21 . 2008-05-13 17:21 87,040 --a------ C:\Windows\System32\msoert2.dll 2008-05-13 17:21 . 2008-05-13 17:21 39,424 --a------ C:\Windows\System32\ACCTRES.dll 2008-05-13 17:20 . 2008-05-13 17:20 376,320 --a------ C:\Windows\System32\winsrv.dll 2008-05-13 17:20 . 2008-05-13 17:20 49,664 --a------ C:\Windows\System32\csrsrv.dll 2008-05-13 17:19 . 2008-05-13 17:19 374,456 --a------ C:\Windows\System32\mcupdate_GenuineIntel.dll 2008-05-13 17:18 . 2008-02-11 20:13 920,088 --a------ C:\Windows\System32\igxpun.exe 2008-05-13 17:18 . 2008-05-13 17:18 414,208 --a------ C:\Windows\System32\msscp.dll 2008-05-13 17:18 . 2006-11-10 16:25 319,456 --a------ C:\Windows\System32\difxapi.dll 2008-05-13 17:16 . 2008-05-13 17:16 1,191,936 --a------ C:\Windows\System32\msxml3.dll 2008-05-13 17:16 . 2008-05-13 17:16 104,448 --a------ C:\Windows\System32\DWWIN.EXE 2008-05-13 17:16 . 2008-05-13 17:16 2,048 --a------ C:\Windows\System32\msxml3r.dll 2008-05-13 17:15 . 2008-05-13 17:15 1,327,104 --a------ C:\Windows\System32\quartz.dll 2008-05-13 17:15 . 2008-05-13 17:15 803,328 --a------ C:\Windows\System32\drivers\tcpip.sys 2008-05-13 17:15 . 2008-05-13 17:15 216,632 --a------ C:\Windows\System32\drivers\netio.sys 2008-05-13 17:15 . 2008-05-13 17:15 167,424 --a------ C:\Windows\System32\tcpipcfg.dll 2008-05-13 17:15 . 2008-05-13 17:15 24,064 --a------ C:\Windows\System32\netcfg.exe 2008-05-13 17:15 . 2008-05-13 17:15 22,016 --a------ C:\Windows\System32\netiougc.exe 2008-05-13 17:11 . 2008-05-13 17:11 2,027,008 --a------ C:\Windows\System32\win32k.sys 2008-05-13 17:11 . 2008-05-13 17:11 296,448 --a------ C:\Windows\System32\gdi32.dll 2008-05-13 17:11 . 2008-05-13 17:11 223,232 --a------ C:\Windows\System32\WMASF.DLL 2008-05-13 17:11 . 2008-05-13 17:11 9,728 --a------ C:\Windows\System32\LAPRXY.DLL 2008-05-13 17:11 . 2008-05-13 17:11 2,048 --a------ C:\Windows\System32\asferror.dll 2008-05-13 17:10 . 2008-05-13 17:10 1,335,296 --a------ C:\Windows\System32\msxml6.dll 2008-05-13 17:10 . 2008-05-13 17:10 737,792 --a------ C:\Windows\System32\inetcomm.dll 2008-05-13 17:10 . 2008-05-13 17:10 84,480 --a------ C:\Windows\System32\INETRES.dll 2008-05-13 17:10 . 2008-05-13 17:10 2,048 --a------ C:\Windows\System32\msxml6r.dll 2008-05-13 17:09 . 2008-05-13 17:09 11,776 --a------ C:\Windows\System32\sbunattend.exe 2008-05-13 17:08 . 2008-05-13 17:08 788,992 --a------ C:\Windows\System32\rpcrt4.dll 2008-05-13 17:08 . 2008-05-13 17:08 130,048 --a------ C:\Windows\System32\drivers\srv2.sys 2008-05-13 17:08 . 2008-05-13 17:08 101,888 --a------ C:\Windows\System32\drivers\mrxsmb.sys 2008-05-13 17:08 . 2008-05-13 17:08 84,992 --a------ C:\Windows\System32\drivers\srvnet.sys 2008-05-13 17:08 . 2008-05-13 17:08 83,968 --a------ C:\Windows\System32\dnsrslvr.dll 2008-05-13 17:08 . 2008-05-13 17:08 58,368 --a------ C:\Windows\System32\drivers\mrxsmb20.sys 2008-05-13 17:08 . 2008-05-13 17:08 24,576 --a------ C:\Windows\System32\dnscacheugc.exe 2008-05-13 17:05 . 2008-05-13 17:05 3,504,824 --a------ C:\Windows\System32\ntkrnlpa.exe 2008-05-13 17:05 . 2008-05-13 17:05 3,470,520 --a------ C:\Windows\System32\ntoskrnl.exe 2008-05-13 17:05 . 2008-05-13 17:05 633,856 --a------ C:\Windows\System32\user32.dll 2008-05-13 17:05 . 2008-05-13 17:05 152,576 --a------ C:\Windows\System32\imagehlp.dll 2008-05-13 17:05 . 2008-05-13 17:05 99,840 --a------ C:\Windows\System32\poqexec.exe 2008-05-13 17:05 . 2008-05-13 17:05 12,800 --a------ C:\Windows\System32\drivers\fs_rec.sys 2008-05-13 17:05 . 2008-05-13 17:05 5,120 --a------ C:\Windows\System32\wmi.dll 2008-05-13 17:05 . 2008-05-13 17:05 2,048 --a------ C:\Windows\System32\tzres.dll 2008-05-13 17:04 . 2008-05-13 17:04 750,080 --a------ C:\Windows\System32\qmgr.dll 2008-05-13 06:40 . 2008-05-13 06:40 <DIR> d-------- C:\Windows\System32\OEM 2008-05-13 06:40 . 2008-05-12 20:47 <DIR> d-------- C:\Windows\Panther 2008-05-13 06:40 . 2007-02-21 20:56 36 -rah----- C:\Windows\DELL_VERSION 2008-05-13 05:24 . 2008-05-13 05:24 1,712,984 --a------ C:\Windows\System32\wuaueng.dll 2008-05-13 05:24 . 2008-05-13 05:24 1,524,224 --a------ C:\Windows\System32\wucltux.dll 2008-05-13 05:24 . 2008-05-13 05:24 53,080 --a------ C:\Windows\System32\wuauclt.exe 2008-05-13 05:24 . 2008-05-13 05:24 43,352 --a------ C:\Windows\System32\wups2.dll 2008-05-13 05:23 . 2008-05-13 05:23 549,720 --a------ C:\Windows\System32\wuapi.dll 2008-05-13 05:23 . 2008-05-13 05:23 163,000 --a------ C:\Windows\System32\wuwebv.dll 2008-05-13 05:23 . 2008-05-13 05:23 80,896 --a------ C:\Windows\System32\wudriver.dll 2008-05-13 05:23 . 2008-05-13 05:23 33,624 --a------ C:\Windows\System32\wups.dll 2008-05-13 05:23 . 2008-05-13 05:23 31,232 --a------ C:\Windows\System32\wuapp.exe 2008-05-12 22:32 . 2008-05-12 22:32 <DIR> dr------- C:\Users\Wiesia\Videos 2008-05-12 22:32 . 2008-05-12 22:32 <DIR> dr------- C:\Users\Wiesia\Searches 2008-05-12 22:32 . 2008-05-12 22:32 <DIR> dr------- C:\Users\Wiesia\Saved Games 2008-05-12 22:32 . 2008-05-12 22:32 <DIR> dr------- C:\Users\Wiesia\Pictures 2008-05-12 22:32 . 2008-05-12 22:32 <DIR> dr------- C:\Users\Wiesia\Music 2008-05-12 22:32 . 2008-05-12 22:32 <DIR> dr------- C:\Users\Wiesia\Links 2008-05-12 22:32 . 2008-05-12 22:32 <DIR> dr------- C:\Users\Wiesia\Downloads 2008-05-12 22:32 . 2008-05-23 10:10 <DIR> dr------- C:\Users\Wiesia\Documents 2008-05-12 22:32 . 2008-05-12 22:34 <DIR> dr------- C:\Users\Wiesia\Contacts 2008-05-12 22:32 . 2006-11-02 13:37 <DIR> d-------- C:\Users\Wiesia\AppData\Roaming\Media Center Programs 2008-05-12 22:32 . 2008-05-12 22:32 <DIR> d--h----- C:\Users\Wiesia\AppData 2008-05-12 22:32 . 2008-05-12 22:32 <DIR> d-------- C:\Users\Wiesia 2008-05-12 22:26 . 2008-05-13 08:56 418 --a------ C:\Windows\ODBC.INI 2008-05-12 22:12 . 2008-03-03 14:25 5,702 --ah----- C:\Windows\nod32restoretemdono.reg 2008-05-12 22:12 . 2008-03-03 18:21 568 --ah----- C:\Windows\nod32fixtemdono.reg . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-05-13 16:40 --------- d-----w C:\Program Files\Windows Mail 2008-05-13 16:39 --------- d-----w C:\Program Files\Windows Sidebar 2008-05-13 16:17 86,016 ----a-w C:\Windows\System32\icfupgd.dll 2008-05-13 16:17 8,147,968 ----a-w C:\Windows\System32\wmploc.DLL 2008-05-13 16:17 7,680 ----a-w C:\Windows\System32\spwmp.dll 2008-05-13 16:17 63,488 ----a-w C:\Windows\system32\drivers\mpsdrv.sys 2008-05-13 16:17 61,952 ----a-w C:\Windows\System32\cmifw.dll 2008-05-13 16:17 4,096 ----a-w C:\Windows\System32\dxmasf.dll 2008-05-13 16:17 396,800 ----a-w C:\Windows\System32\MPSSVC.dll 2008-05-13 16:17 392,192 ----a-w C:\Windows\System32\FirewallAPI.dll 2008-05-13 16:17 23,040 ----a-w C:\Windows\system32\drivers\tunnel.sys 2008-05-13 16:17 178,688 ----a-w C:\Windows\System32\iphlpsvc.dll 2008-05-13 16:17 16,896 ----a-w C:\Windows\System32\wfapigp.dll 2008-05-13 16:17 15,360 ----a-w C:\Windows\system32\drivers\TUNMP.SYS 2008-05-13 16:06 826,368 ----a-w C:\Windows\System32\wininet.dll 2008-05-13 16:06 56,320 ----a-w C:\Windows\System32\iesetup.dll 2008-05-13 16:06 52,736 ----a-w C:\Windows\AppPatch\iebrshim.dll 2008-05-13 16:06 26,624 ----a-w C:\Windows\System32\ieUnatt.exe 2006-11-02 12:50 174 --sha-w C:\Program Files\desktop.ini . ------- Sigcheck ------- . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2008-01-28 11:43 2097488] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "egui"="C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" [2008-02-20 11:06 1443072] "IgfxTray"="C:\Windows\system32\igfxtray.exe" [2008-02-11 20:13 141848] "HotKeysCmds"="C:\Windows\system32\hkcmd.exe" [2008-02-11 20:13 166424] "Persistence"="C:\Windows\system32\igfxpers.exe" [2008-02-11 20:13 133656] "OEM02Mon.exe"="C:\Windows\OEM02Mon.exe" [2007-05-09 17:01 36864] "MSConfig"="C:\Windows\system32\msconfig.exe" [2006-11-02 10:45 222208] [hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks] "{8053AF4F-F35D-4EC6-A411-039EFB515CD8}"= C:\Windows\system32\urqOIcCR.dll [ ] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "vidc.tscc"= tsccvid.dll 0 [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\7488af0e] C:\Users\Maciek\AppData\Local\Temp\merpykal.dll [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher] --a------ 2008-01-11 22:16 39792 C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BM77bb9c92] C:\Users\Maciek\AppData\Local\Temp\eetbhvya.dll [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\cmds] C:\Users\Maciek\AppData\Local\Temp\geBsrRjH.dll [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] --a------ 2007-12-13 19:10 1688872 C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSServer] C:\Windows\system32\urqOIcCR.dll [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NBKeyScan] --a------ 2007-12-03 14:21 2213160 C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] --a------ 2007-03-01 14:57 153136 C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-] "7488af0e"=rundll32.exe "C:\Users\Maciek\AppData\Local\Temp\merpykal.dll",b "BM77bb9c92"=Rundll32.exe "C:\Users\Maciek\AppData\Local\Temp\eetbhvya.dll",s "MSServer"=rundll32.exe C:\Users\Maciek\AppData\Local\Temp\qoMExutq.dll,#1 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\DomainProfile\AuthorizedApplications\List] "C:\\Program Files\\TESTOUT\\Cmi\\Navigator.exe"= C:\Program Files\TESTOUT\Cmi\Navigator.exe:*:Disabled:TestOut Navigator [HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules] "{F045A0CD-9F26-4382-A024-97CC70F00292}"= UDP:C:\Program Files\InternetCalls.com\InternetCalls\InternetCalls.exe:InternetCalls "{EE6DBF4F-E83A-48C3-8D8C-D4D66D9AC85D}"= TCP:C:\Program Files\InternetCalls.com\InternetCalls\InternetCalls.exe:InternetCalls "{5A773A69-7CC0-4CC1-BC3C-C61166C795A1}"= UDP:C:\Program Files\uTorrent\uTorrent.exe:µTorrent "{917D37CA-4F2A-4A9C-A653-0E725068F843}"= TCP:C:\Program Files\uTorrent\uTorrent.exe:µTorrent [HKLM\~\services\sharedaccess\parameters\firewallpolicy\RestrictedServices\Static\System] "DFSR-1"= RPort=5722|UDP:%SystemRoot%\system32\svchost.exe|Svc=DFSR:Allow inbound TCP traffic| [HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile\AuthorizedApplications\List] "C:\\Program Files\\TESTOUT\\Cmi\\Navigator.exe"= C:\Program Files\TESTOUT\Cmi\Navigator.exe:*:Disabled:TestOut Navigator R1 epfwtdir;epfwtdir;C:\Windows\system32\DRIVERS\epfwtdir.sys [2008-02-20 11:11] R3 igfx;igfx;C:\Windows\system32\DRIVERS\igdkmd32.sys [2008-02-11 19:36] R3 OEM02Dev;Creative Camera OEM002 Driver;C:\Windows\system32\DRIVERS\OEM02Dev.sys [2007-10-10 17:03] R3 OEM02Vfx;Creative Camera OEM002 Video VFX Driver;C:\Windows\system32\DRIVERS\OEM02Vfx.sys [2007-03-05 10:45] S2 NOD32FiXTemDono;Eset Nod32 Boot;C:\Windows\system32\regedt32.exe [2006-11-02 10:45] . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-05-24 14:05:24 Windows 6.0.6000 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2008-05-24 14:05:53 ComboFix-quarantined-files.txt 2008-05-24 13:05:44 Pre-Run: 117,320,024,064 bytes free Post-Run: 117,296,136,192 bytes free 227 --- E O F --- 2008-05-22 16:25:57

przez **huber2t** » 24 Maj 2008, 18:00

Pobierz ComboFix, ale nie uruchamiaj
Wklej do notatnika:

Kod: Zaznacz wszystko: File:: C:\Windows\system32\urqOIcCR.dll C:\Users\Maciek\AppData\Local\Temp\merpykal.dll C:\Users\Maciek\AppData\Local\Temp\eetbhvya.dll C:\Users\Maciek\AppData\Local\Temp\geBsrRjH.dll C:\Users\Maciek\AppData\Local\Temp\merpykal.dll C:\Users\Maciek\AppData\Local\Temp\qoMExutq.dll C:\Users\Maciek\AppData\Local\Temp\eetbhvya.dll Registry:: [hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks] "{8053AF4F-F35D-4EC6-A411-039EFB515CD8}"=- [-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\7488af0e] [-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BM77bb9c92] [-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\cmds] [-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-] "7488af0e"=- "BM77bb9c92"=- "MSServer"=-

Plik

zapisz jako

CFScript.txt (najwygodniej będzie, jeśli zapiszesz w takiej lokalizacji, by ikonka CFScript.txt znalazła się obok ikonki ComboFix.exe)
Przeciągnij i upuść ikonkę CFScript.txt na ikonkę ComboFix.exe tak jak tu

Rozpocznie się usuwanie i powstanie log, daj ten log na forum.

przez **huber2t** » 24 Maj 2008, 18:37

Wytnij z loga sekcję
((((((((((((((((((((((((((((( snapshot@2008-05-24_14.05.39.34 )))))))))))))))))))))))))))))))))))))))))
i daj go na forum jeszcze raz

przez **aragorn** » 24 Maj 2008, 22:26

oto log

Kod: Zaznacz wszystko: -- Snapshot reset to current date -- . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "WindowsWelcomeCenter"="oobefldr.dll" [2006-11-02 13:34 2159104 C:\Windows\System32\oobefldr.dll] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "IgfxTray"="C:\Windows\system32\igfxtray.exe" [2008-02-11 20:13 141848] "HotKeysCmds"="C:\Windows\system32\hkcmd.exe" [2008-02-11 20:13 166424] "Persistence"="C:\Windows\system32\igfxpers.exe" [2008-02-11 20:13 133656] "OEM02Mon.exe"="C:\Windows\OEM02Mon.exe" [2007-05-09 17:01 36864] "MSConfig"="C:\Windows\System32\msconfig.exe" [2006-11-02 10:45 222208] "egui"="C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" [2008-02-20 11:06 1443072] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "vidc.tscc"= tsccvid.dll 0 [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher] --a------ 2008-01-11 22:16 39792 C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSServer] C:\Windows\system32\urqOIcCR.dll [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NBKeyScan] --a------ 2007-12-03 14:21 2213160 C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] --a------ 2007-03-01 14:57 153136 C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe [HKLM\~\services\sharedaccess\parameters\firewallpolicy\DomainProfile\AuthorizedApplications\List] "C:\\Program Files\\TESTOUT\\Cmi\\Navigator.exe"= C:\Program Files\TESTOUT\Cmi\Navigator.exe:*:Disabled:TestOut Navigator [HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules] "{917D37CA-4F2A-4A9C-A653-0E725068F843}"= TCP:C:\Program Files\uTorrent\uTorrent.exe:µTorrent "{5A773A69-7CC0-4CC1-BC3C-C61166C795A1}"= UDP:C:\Program Files\uTorrent\uTorrent.exe:µTorrent "{EE6DBF4F-E83A-48C3-8D8C-D4D66D9AC85D}"= TCP:C:\Program Files\InternetCalls.com\InternetCalls\InternetCalls.exe:InternetCalls "{F045A0CD-9F26-4382-A024-97CC70F00292}"= UDP:C:\Program Files\InternetCalls.com\InternetCalls\InternetCalls.exe:InternetCalls [HKLM\~\services\sharedaccess\parameters\firewallpolicy\RestrictedServices\Static\System] "DFSR-1"= RPort=5722|UDP:%SystemRoot%\system32\svchost.exe|Svc=DFSR:Allow inbound TCP traffic| [HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile\AuthorizedApplications\List] "C:\\Program Files\\TESTOUT\\Cmi\\Navigator.exe"= C:\Program Files\TESTOUT\Cmi\Navigator.exe:*:Disabled:TestOut Navigator R1 epfwtdir;epfwtdir;C:\Windows\system32\DRIVERS\epfwtdir.sys [2008-02-20 11:11] R3 igfx;igfx;C:\Windows\system32\DRIVERS\igdkmd32.sys [2008-02-11 19:36] R3 OEM02Dev;Creative Camera OEM002 Driver;C:\Windows\system32\DRIVERS\OEM02Dev.sys [2007-10-10 17:03] R3 OEM02Vfx;Creative Camera OEM002 Video VFX Driver;C:\Windows\system32\DRIVERS\OEM02Vfx.sys [2007-03-05 10:45] R3 yukonwlh;NDIS6.0 Miniport Driver for Marvell Yukon Ethernet Controller;C:\Windows\system32\DRIVERS\yk60x86.sys [2007-12-06 09:51] *Newly Created Service* - CATCHME *Newly Created Service* - VOLSNAP . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-05-24 17:26:10 Windows 6.0.6000 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2008-05-24 17:27:04 ComboFix-quarantined-files.txt 2008-05-24 16:26:56 ComboFix2.txt 2008-05-24 13:05:53 Pre-Run: 114,506,366,976 bytes free Post-Run: 114,498,351,104 bytes free 678

przez **huber2t** » 25 Maj 2008, 04:14

widziałem tamtą stronę loga i było ok ta tez jest ok

Przeskanuj obszar mojego komputera http://www.kaspersky.pl/virusscanner.html (uruchom przez IE) Daj raport z niego na forum

Straszni mi wszystko zwalnia

Straszni mi wszystko zwalnia

Kto jest na forum