Wirus na komputerze, prośba o pomoc w zlikwidowaniu go...

przez **Jagla** » 31 Mar 2008, 17:14

Witam, ściągłem dzisiaj program który na 95% był wirusem. Po włączeniu go nie moge włączyć menadżera zadan bo pisze że administrator go zablokował, jak włączyłem combofix to w mjiejscu deleting file/program( czy jakoś tak) zawiesił sie itd.

O to log, z combo. Jak z jht bedzie trzeba to mówić

Kod: Zaznacz wszystko: ComboFix 08-03-30.3 - Maaciek 2008-03-31 17:09:47.2 - [color=red][b]FAT32[/b][/color]x86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.1656 [GMT 2:00] Running from: C:\Documents and Settings\Maaciek\Pulpit\ComboFix.exe [color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color] . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\WINDOWS\Installer\{04c64212-5786-4774-8892-91e7db916c98} C:\WINDOWS\Installer\{04c64212-5786-4774-8892-91e7db916c98}\DrvPrx.dll C:\WINDOWS\Installer\{b3c3f7e5-b46f-4c20-a971-47070df4c855} C:\WINDOWS\Installer\{b3c3f7e5-b46f-4c20-a971-47070df4c855}\zip.dll C:\WINDOWS\svpekgonlop.dll . ---- Previous Run ------- . C:\WINDOWS\dwltqnmx.exe C:\WINDOWS\fkdnrwsv.dll C:\WINDOWS\stfngdvw.dll C:\WINDOWS\sxfnewqb.dll . ((((((((((((((((((((((((( Files Created from 2008-02-28 to 2008-03-31 ))))))))))))))))))))))))))))))) . 2008-03-31 17:03 . 2008-03-31 17:03 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\tunalwvq 2008-03-31 17:03 . 2008-03-31 17:03 90,112 --a------ C:\WINDOWS\system32\fonafelo.exe 2008-03-31 17:03 . 2008-03-31 17:03 21,616 --a------ C:\Program Files\antiviirus.exe 2008-03-31 17:03 . 2008-03-31 17:03 16,492 -r-hs---- C:\Program Files\tmp3.exe 2008-03-31 17:03 . 2008-03-31 17:03 16,492 -r-hs---- C:\Program Files\tmp2.exe 2008-03-31 17:03 . 2008-03-31 17:03 16,492 -r-hs---- C:\Program Files\tmp1.exe 2008-03-31 17:03 . 2008-03-31 17:03 16,492 -r-hs---- C:\Program Files\tmp0.exe 2008-03-31 17:00 . 2008-03-31 17:01 43,520 --a------ C:\WINDOWS\system32\CmdLineExt03.dll 2008-03-31 16:10 . 2008-03-31 16:10 21,840 --a------ C:\WINDOWS\system32\SIntfNT.dll 2008-03-31 16:10 . 2008-03-31 16:10 17,212 --a------ C:\WINDOWS\system32\SIntf32.dll 2008-03-31 16:10 . 2008-03-31 16:10 12,067 --a------ C:\WINDOWS\system32\SIntf16.dll 2008-03-31 15:52 . 2008-03-31 15:52 106,496 --a------ C:\WINDOWS\DIIUnin.exe 2008-03-31 15:52 . 2008-03-31 17:00 31,464 --a------ C:\WINDOWS\DIIUnin.dat 2008-03-31 15:52 . 2008-03-31 15:52 2,829 --a------ C:\WINDOWS\DIIUnin.pif 2008-03-31 15:30 . 2008-03-31 15:30 <DIR> d--hs---- C:\FOUND.007 2008-03-30 14:17 . 2008-03-30 14:17 <DIR> d-------- C:\Program Files\Lexmark_3300 Series 2008-03-30 14:17 . 2008-03-30 14:17 10,432 --a------ C:\WINDOWS\system32\LexFiles.ulf 2008-03-30 13:50 . 2008-03-30 13:50 <DIR> d-------- C:\Temp\{9F5FBC24-EFE2-4f90-B498-EC0FB7D47D15} 2008-03-30 13:50 . 2008-03-30 13:50 <DIR> d-------- C:\Program Files\Lexmark 3300 Series 2008-03-30 11:01 . 2008-03-30 11:01 <DIR> d--hs---- C:\FOUND.006 2008-03-29 09:20 . 2008-03-29 09:20 <DIR> d--h----- C:\WINDOWS\$hf_mig$ 2008-03-28 20:26 . 2001-05-16 17:54 309,616 --a------ C:\WINDOWS\system32\wmv8dmod.dll 2008-03-28 20:26 . 2001-03-26 04:41 245,760 --a------ C:\WINDOWS\system32\mp4sds32.ax 2008-03-28 20:25 . 2001-05-11 13:18 420,240 --a------ C:\WINDOWS\system32\mpg4c32.dll 2008-03-28 20:25 . 2001-12-19 15:47 49,152 --------- C:\WINDOWS\system32\TempDel.EXE 2008-03-28 20:25 . 2005-01-06 16:55 9,446 --a------ C:\WINDOWS\system32\drivers\WFIOCTL.sys 2008-03-28 20:25 . 2002-06-03 23:01 8,734 --a------ C:\WINDOWS\system32\WFSch.ICO 2008-03-28 20:21 . 2008-03-28 20:21 <DIR> d-------- C:\WINDOWS\system32\DX9 2008-03-28 20:21 . 2004-10-18 11:25 208,851 --a------ C:\WINDOWS\system32\drivers\wf88vcap.sys 2008-03-28 20:21 . 2004-10-18 11:25 34,789 --a------ C:\WINDOWS\system32\drivers\wf88tune.sys 2008-03-28 20:21 . 2004-10-18 11:25 10,324 --a------ C:\WINDOWS\system32\drivers\WF88XBAR.sys 2008-03-28 20:21 . 2002-06-03 22:52 2,238 --a------ C:\WINDOWS\system32\WFDRV.ico 2008-03-28 20:11 . 2008-03-28 20:11 <DIR> d-------- C:\Program Files\Ulead Systems 2008-03-28 20:11 . 2008-03-28 20:11 <DIR> d-------- C:\Program Files\Common Files\Ulead Systems 2008-03-28 20:10 . 2008-03-28 20:10 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Ulead Systems 2008-03-28 20:04 . 2008-03-28 20:04 <DIR> d-------- C:\WINDOWS\system32\WinFox 2008-03-28 20:04 . 2008-03-28 20:04 <DIR> d-------- C:\WINDOWS\system32\WinFast 2008-03-28 20:04 . 2003-09-05 09:57 9,469 --a------ C:\WINDOWS\system32\drivers\WINFOXIO.sys 2008-03-28 16:06 . 2008-03-28 16:06 <DIR> d--hs---- C:\FOUND.005 2008-03-28 13:49 . 2008-03-28 13:49 <DIR> d--hs---- C:\FOUND.004 2008-03-27 21:45 . 2008-03-27 21:45 <DIR> d---s---- C:\Documents and Settings\Maaciek\UserData 2008-03-26 21:13 . 2008-03-26 21:13 <DIR> d--hs---- C:\FOUND.003 2008-03-26 07:32 . 2008-03-26 07:32 <DIR> d--hs---- C:\FOUND.002 2008-03-25 16:45 . 2008-03-25 16:45 <DIR> d--hs---- C:\FOUND.001 2008-03-24 17:49 . 2008-03-24 17:49 <DIR> d-------- C:\Program Files\Common Files\INCA Shared 2008-03-24 15:59 . 2008-03-24 15:59 <DIR> d-------- C:\Documents and Settings\Maaciek\Dane aplikacji\Winamp 2008-03-24 15:56 . 2008-03-24 15:56 1,210 --a------ C:\WINDOWS\mozver.dat 2008-03-24 15:49 . 2008-03-24 15:49 69 --a------ C:\WINDOWS\NeroDigital.ini 2008-03-24 15:47 . 2008-03-24 15:47 <DIR> d-------- C:\Documents and Settings\Maaciek\Gadu-Gadu 2008-03-24 15:47 . 2008-03-24 15:47 <DIR> d-------- C:\Documents and Settings\Maaciek\Dane aplikacji\Gadu-Gadu 2008-03-24 15:42 . 2008-03-24 15:42 <DIR> d-------- C:\Documents and Settings\Maaciek\Dane aplikacji\Talkback 2008-03-24 15:42 . 2008-03-24 15:42 0 --a------ C:\WINDOWS\nsreg.dat 2008-03-24 15:38 . 2003-06-18 17:31 17,920 --a------ C:\WINDOWS\system32\mdimon.dll 2008-03-24 15:38 . 2008-03-24 15:38 385 --a------ C:\WINDOWS\ODBC.INI 2008-03-24 15:37 . 2008-03-24 15:37 <DIR> d-------- C:\Program Files\Microsoft.NET 2008-03-24 15:37 . 2008-03-24 15:37 <DIR> d-------- C:\Program Files\Microsoft ActiveSync 2008-03-24 15:36 . 2001-10-26 20:29 176,157 --a------ C:\WINDOWS\system32\dllcache\dgrpsetu.dll 2008-03-24 15:34 . 2008-03-24 15:34 <DIR> d-------- C:\Documents and Settings\Maaciek\Dane aplikacji\DAEMON Tools 2008-03-24 15:34 . 2008-03-24 15:34 716,272 --a------ C:\WINDOWS\system32\drivers\sptd.sys 2008-03-24 15:33 . 2008-03-24 15:33 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\LightScribe 2008-03-24 15:29 . 2008-03-24 15:29 <DIR> d-------- C:\Program Files\Common Files\LightScribe 2008-03-24 15:28 . 2008-03-24 15:28 <DIR> d-------- C:\WINDOWS\Cache 2008-03-24 15:28 . 2008-03-24 15:28 <DIR> d-------- C:\Documents and Settings\Maaciek\Dane aplikacji\Ahead 2008-03-24 15:28 . 2008-03-24 15:28 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Ahead 2008-03-24 15:26 . 2008-03-24 15:26 <DIR> d-------- C:\Program Files\Common Files\Ahead 2008-03-24 15:26 . 2008-03-24 15:26 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Nero 2008-03-24 15:18 . 2008-03-24 15:18 <DIR> d-------- C:\WINDOWS\system32\Lang 2008-03-24 15:18 . 2008-03-24 15:18 940,794 --a------ C:\WINDOWS\system32\LoopyMusic.wav 2008-03-24 15:18 . 2008-03-24 15:18 146,650 --a------ C:\WINDOWS\system32\BuzzingBee.wav 2008-03-24 15:17 . 2008-03-24 15:17 <DIR> d-------- C:\Program Files\Realtek 2008-03-24 15:17 . 2008-03-24 15:17 <DIR> d--h----- C:\Program Files\InstallShield Installation Information 2008-03-24 15:16 . 2008-03-24 15:16 <DIR> d-------- C:\WINDOWS\system32\DRVSTORE 2008-03-24 15:16 . 2008-03-24 15:16 <DIR> d-------- C:\Program Files\DIFX 2008-03-24 15:16 . 2006-06-18 23:51 43,520 --a------ C:\WINDOWS\system32\drivers\AmdK8.sys 2008-03-24 15:16 . 2004-11-18 10:42 22,752 --a------ C:\WINDOWS\system32\spupdsvc.exe 2008-03-24 15:14 . 2008-03-24 15:14 <DIR> d-------- C:\Documents and Settings\Maaciek\Dane aplikacji\InstallShield 2008-03-24 15:14 . 2006-11-07 14:58 356,352 --a------ C:\WINDOWS\system32\nvunrm.exe 2008-03-24 15:14 . 2006-10-05 16:35 356,352 --------- C:\WINDOWS\system32\nvuide.exe 2008-03-24 15:14 . 2006-10-19 09:36 3,903 --a------ C:\WINDOWS\system32\nvnrm.nvu 2008-03-24 15:14 . 2006-10-24 13:13 1,732 --a------ C:\WINDOWS\system32\drivers\nvphy.bin 2008-03-24 15:14 . 2006-09-11 15:14 1,570 --------- C:\WINDOWS\system32\nvide.nvu 2008-03-24 15:13 . 2008-03-24 15:18 15,600 --a------ C:\WINDOWS\gdrv.sys 2008-03-24 15:08 . 2008-03-24 15:08 <DIR> d--hs---- C:\Recycled 2008-03-24 15:04 . 2008-03-24 15:04 <DIR> d-------- C:\WINDOWS\nview 2008-03-24 15:04 . 2007-09-16 18:07 356,352 --a------ C:\WINDOWS\system32\nvudisp.exe 2008-03-24 15:04 . 2008-03-24 15:06 138,893 --a------ C:\WINDOWS\system32\nvapps.xml 2008-03-24 15:04 . 2007-09-16 18:07 17,525 --a------ C:\WINDOWS\system32\nvdisp.nvu 2008-03-24 15:03 . 2008-03-24 15:03 <DIR> d-------- C:\Program Files\Common Files\InstallShield 2008-03-24 15:02 . 2005-05-26 15:34 2,297,552 --a------ C:\WINDOWS\system32\d3dx9_26.dll . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-03-24 13:17 315,392 ----a-w C:\WINDOWS\HideWin.exe 2008-03-24 12:46 --------- d-----w C:\Program Files\microsoft frontpage 2008-03-24 12:44 --------- d-----w C:\Program Files\Usługi online . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:44 15360] "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2007-06-01 10:21 153136] "LightScribe Control Panel"="C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe" [2007-07-18 17:55 451872] "Gadu-Gadu"="D:\Gadu-Gadu\gg.exe" [2007-11-14 12:54 2131392] "stljsejc"="C:\WINDOWS\system32\fonafelo.exe" [2008-03-31 17:03 90112] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-09-16 18:07 8491008] "nwiz"="nwiz.exe" [2007-09-16 18:07 1626112 C:\WINDOWS\system32\nwiz.exe] "NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-09-16 18:07 81920] "RTHDCPL"="RTHDCPL.EXE" [2007-07-05 09:08 16380416 C:\WINDOWS\RTHDCPL.exe] "NeroFilterCheck"="C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" [2007-03-01 15:57 153136] "WinFast Schedule"="d:\TV\WFWIZ.exe" [2005-03-02 14:21 278528] "lxccmon.exe"="C:\Program Files\Lexmark 3300 Series\lxccmon.exe" [2005-02-21 06:23 192512] "antiviirus"="C:\Program Files\antiviirus.exe" [2008-03-31 17:03 21616] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 00:44 15360] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer\run] "1O78Urwa50"= C:\Documents and Settings\All Users\Dane aplikacji\tunalwvq\rwbwdepa.exe [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "D:\\Gadu-Gadu\\gg.exe"= "D:\\Maciek\\CS\\hl.exe"= R2 WF23880;WinFast TV2000/DV2000 WDM Video Capture.;C:\WINDOWS\system32\drivers\wf88vcap.sys [2004-10-18 11:25] R2 WF88XBAR;WinFast TV2000/DV2000 WDM Crossbar.;C:\WINDOWS\system32\drivers\WF88XBAR.sys [2004-10-18 11:25] R2 WFTUNE;WinFast TV2000/DV2000 WDM Tuner.;C:\WINDOWS\system32\drivers\WF88TUNE.sys [2004-10-18 11:25] R3 WFIOCTL;WFIOCTL;d:\TV\WFIOCTL.SYS [2005-01-06 17:55] S3 ddsxeiservice;ddsxeiservice2;D:\Maciek\CS\sXe Injected\ddsxei.sys [2008-02-09 04:02] S3 gdrv;gdrv;C:\WINDOWS\gdrv.sys [2008-03-24 15:18] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}] "C:\Program Files\Common Files\LightScribe\LSRunOnce.exe" . ************************************************************************** catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-03-31 17:10:27 Windows 5.1.2600 Dodatek Service Pack 2 FAT NTAPI scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2008-03-31 17:10:38 ComboFix-quarantined-files.txt 2008-03-31 15:10:38 Pre-Run: 17,120,935,936 bajtów wolnych Post-Run: 17,112,317,952 bajtów wolnych

przez **pp3088** » 01 Kwi 2008, 14:57

Wklej do Notatnika:

File::
C:\Program Files\antiviirus.exe
C:\WINDOWS\system32\fonafelo.exe
C:\Program Files\tmp3.exe
C:\Program Files\tmp2.exe
C:\Program Files\tmp1.exe
C:\Program Files\tmp0.exe
C:\WINDOWS\system32\CmdLineExt03.dll
C:\Documents and Settings\All Users\Dane aplikacji\tunalwvq\rwbwdepa.exe

Folder:
C:\FOUND.001
C:\FOUND.002
C:\FOUND.003
C:\FOUND.004
C:\FOUND.005
C:\FOUND.006
C:\FOUND.007

>>Plik>>Zapisz jako... >>> CFScript (najwygodniej będzie, jeśli zapiszesz w takiej lokalizacji, by ikonka CFScript.txt znalazła się obok ikonki ComboFix.exe)
Przeciągnij i upuść plik CFScript.txt na plik ComboFix.exe (czyli ikonkę CFScript.txt na ikonkę ComboFix.exe)
– podobnie jak na tym obrazku -

(jeśli pojawi się pytanie "1 or 2" - to wpisz 1 i naciśnij ENTER) Ma się rozpocząć usuwanie. (i powstanie log)
Po restarcie usuń ręcznie folder C: \Qoobox.
Po tym nowy log z Combofix.

przez **Jagla** » 03 Kwi 2008, 13:56

Co do tego wirusa, doszło do takiej sytuacij że nie mogłem ruszyć myszką chodź działała i żadne resety nie działały dlatego wgrałem system jeszcze raz ale dam tu loga żeby sprawdzić na wszelki wypadek.

Kod: Zaznacz wszystko: ComboFix 08-04-02.1 - Maaciek 2008-04-03 13:53:34.1 - [color=red][b]FAT32[/b][/color]x86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.1596 [GMT 2:00] Running from: C:\Documents and Settings\Maaciek\Pulpit\ComboFix.exe * Created a new restore point [color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color] . ((((((((((((((((((((((((( Files Created from 2008-03-03 to 2008-04-03 ))))))))))))))))))))))))))))))) . 2008-04-02 21:55 . 2008-04-02 21:55 <DIR> d-------- C:\Documents and Settings\Maaciek\Dane aplikacji\Ulead Systems 2008-04-02 21:54 . 2008-04-02 21:54 <DIR> d-------- C:\WINDOWS\system32\windows media 2008-04-02 21:54 . 2008-04-02 21:54 <DIR> d--h----- C:\WINDOWS\msdownld.tmp 2008-04-02 21:53 . 2008-04-02 21:53 <DIR> d-------- C:\Program Files\Windows Media Components 2008-04-01 20:09 . 2008-04-01 20:09 <DIR> d-------- C:\Program Files\Ulead Systems 2008-04-01 20:09 . 2008-04-01 20:09 <DIR> d-------- C:\Program Files\Common Files\Ulead Systems 2008-04-01 20:09 . 2008-04-01 20:09 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Ulead Systems 2008-04-01 20:09 . 2001-12-19 15:47 49,152 --------- C:\WINDOWS\system32\TempDel.EXE 2008-04-01 20:09 . 2005-01-06 16:55 9,446 --a------ C:\WINDOWS\system32\drivers\WFIOCTL.sys 2008-04-01 20:09 . 2002-06-03 23:01 8,734 --a------ C:\WINDOWS\system32\WFSch.ICO 2008-04-01 20:05 . 2008-04-01 20:05 <DIR> d-------- C:\WINDOWS\system32\DX9 2008-04-01 20:04 . 2008-04-01 20:04 <DIR> d-------- C:\WINDOWS\system32\WinFox 2008-04-01 20:04 . 2008-04-01 20:04 <DIR> d-------- C:\WINDOWS\system32\WinFast 2008-04-01 20:04 . 2003-09-05 09:57 9,469 --a------ C:\WINDOWS\system32\drivers\WINFOXIO.sys 2008-04-01 12:12 . 2008-04-01 12:12 <DIR> d-------- C:\Program Files\uTorrent 2008-04-01 12:12 . 2008-04-01 12:12 <DIR> d-------- C:\Documents and Settings\Maaciek\Dane aplikacji\uTorrent 2008-04-01 12:03 . 2008-04-02 20:22 22,328 --a------ C:\WINDOWS\system32\drivers\PnkBstrK.sys 2008-04-01 12:03 . 2008-04-01 12:03 22,328 --a------ C:\Documents and Settings\Maaciek\Dane aplikacji\PnkBstrK.sys 2008-04-01 12:02 . 2008-04-01 12:02 <DIR> d-------- C:\WINDOWS\system32\LogFiles 2008-04-01 12:02 . 2008-04-02 20:22 103,736 --a------ C:\WINDOWS\system32\PnkBstrB.exe 2008-04-01 12:02 . 2008-04-01 13:04 66,872 --a------ C:\WINDOWS\system32\PnkBstrA.exe 2008-04-01 12:02 . 2008-04-01 12:02 275 --a------ C:\WINDOWS\game.ini 2008-04-01 11:47 . 2008-04-01 11:47 <DIR> d--hs---- C:\WINDOWS\ftpcache 2008-04-01 08:03 . 2008-04-01 08:03 <DIR> d-------- C:\Documents and Settings\Maaciek\Dane aplikacji\Winamp 2008-04-01 07:58 . 2008-04-01 07:58 1,229 --a------ C:\WINDOWS\mozver.dat 2008-04-01 07:56 . 2008-04-01 07:56 <DIR> d-------- C:\Documents and Settings\Maaciek\Dane aplikacji\Talkback 2008-04-01 07:56 . 2008-04-01 07:56 0 --a------ C:\WINDOWS\nsreg.dat 2008-04-01 07:50 . 2008-04-01 07:50 <DIR> d-------- C:\Temp\{9F5FBC24-EFE2-4f90-B498-EC0FB7D47D15} 2008-04-01 07:50 . 2008-04-01 07:50 <DIR> d-------- C:\Program Files\Lexmark 3300 Series 2008-04-01 07:48 . 2008-04-01 07:48 <DIR> d-------- C:\Program Files\Common Files\LightScribe 2008-04-01 07:48 . 2008-04-01 07:48 <DIR> d-------- C:\Documents and Settings\Maaciek\Dane aplikacji\Ahead 2008-04-01 07:47 . 2008-04-01 07:47 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Ahead 2008-04-01 07:45 . 2008-04-01 07:45 <DIR> d-------- C:\Program Files\Common Files\Ahead 2008-04-01 07:45 . 2008-04-01 07:45 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Nero 2008-04-01 07:38 . 2007-03-23 13:19 9,715,200 -r------- C:\WINDOWS\RTLCPL.exe 2008-04-01 07:38 . 2007-07-18 13:26 4,547,584 -r------- C:\WINDOWS\system32\drivers\RtkHDAud.sys 2008-04-01 07:38 . 2007-06-15 10:45 1,826,816 -r------- C:\WINDOWS\SkyTel.exe 2008-04-01 07:38 . 2007-01-16 04:39 1,191,936 -r------- C:\WINDOWS\RtlUpd.exe 2008-04-01 07:38 . 2006-08-18 00:58 282,624 -r------- C:\WINDOWS\system32\RTSndMgr.cpl 2008-04-01 07:38 . 2006-07-21 10:14 86,016 -r------- C:\WINDOWS\SoundMan.exe 2008-04-01 07:38 . 2006-08-01 09:02 49,152 -r------- C:\WINDOWS\system32\ChCfg.exe 2008-04-01 07:37 . 2008-04-01 07:37 <DIR> d-------- C:\Program Files\Realtek 2008-04-01 07:37 . 2008-04-01 07:37 <DIR> d--h----- C:\Program Files\InstallShield Installation Information 2008-04-01 07:37 . 2007-07-05 10:08 16,380,416 -r------- C:\WINDOWS\RTHDCPL.exe 2008-04-01 07:37 . 2006-05-04 10:26 2,808,832 -r------- C:\WINDOWS\alcwzrd.exe 2008-04-01 07:37 . 2007-06-28 10:44 2,165,760 -r------- C:\WINDOWS\MicCal.exe 2008-04-01 07:37 . 2007-01-12 10:54 520,192 -r------- C:\WINDOWS\RtlExUpd.dll 2008-04-01 07:37 . 2005-09-21 04:25 299,008 -r------- C:\WINDOWS\system32\ALSndMgr.cpl 2008-04-01 07:37 . 2005-05-03 12:43 69,632 -r------- C:\WINDOWS\Alcmtr.exe 2008-04-01 07:37 . 2006-06-18 23:51 43,520 --a------ C:\WINDOWS\system32\drivers\AmdK8.sys 2008-04-01 07:36 . 2006-11-07 14:58 356,352 --a------ C:\WINDOWS\system32\nvunrm.exe 2008-04-01 07:36 . 2006-10-05 16:35 356,352 --------- C:\WINDOWS\system32\nvuide.exe 2008-04-01 07:36 . 2006-10-19 09:36 3,903 --a------ C:\WINDOWS\system32\nvnrm.nvu 2008-04-01 07:36 . 2006-10-24 13:13 1,732 --a------ C:\WINDOWS\system32\drivers\nvphy.bin 2008-04-01 07:36 . 2006-09-11 15:14 1,570 --------- C:\WINDOWS\system32\nvide.nvu 2008-04-01 07:35 . 2008-04-01 07:35 <DIR> d-------- C:\Documents and Settings\Maaciek\Dane aplikacji\InstallShield 2008-04-01 07:33 . 2008-04-01 07:33 <DIR> d-------- C:\WINDOWS\nview 2008-04-01 07:33 . 2007-09-16 19:07 356,352 --a------ C:\WINDOWS\system32\nvudisp.exe 2008-04-01 07:33 . 2008-04-01 07:34 138,893 --a------ C:\WINDOWS\system32\nvapps.xml 2008-04-01 07:33 . 2007-09-16 19:07 17,525 --a------ C:\WINDOWS\system32\nvdisp.nvu 2008-03-31 22:08 . 2008-03-31 22:08 <DIR> d-------- C:\WINDOWS\system32\Lang 2008-03-31 22:08 . 2008-03-31 22:08 940,794 --a------ C:\WINDOWS\system32\LoopyMusic.wav 2008-03-31 22:08 . 2008-03-31 22:08 146,650 --a------ C:\WINDOWS\system32\BuzzingBee.wav 2008-03-31 22:06 . 2008-03-31 22:06 <DIR> d-------- C:\WINDOWS\system32\DRVSTORE 2008-03-31 22:06 . 2008-03-31 22:06 <DIR> d-------- C:\Program Files\DIFX 2008-03-31 22:06 . 2008-03-31 22:06 315,392 --a------ C:\WINDOWS\HideWin.exe 2008-03-31 22:06 . 2004-11-18 10:42 22,752 --a------ C:\WINDOWS\system32\spupdsvc.exe 2008-03-31 21:44 . 2008-04-01 07:35 15,600 --a------ C:\WINDOWS\gdrv.sys 2008-03-31 19:15 . 2008-03-31 19:15 <DIR> d--hs---- C:\Recycled 2008-03-31 19:13 . 2008-03-31 19:13 <DIR> d-------- C:\Documents and Settings\Maaciek\Gadu-Gadu 2008-03-31 19:13 . 2008-03-31 19:13 <DIR> d-------- C:\Documents and Settings\Maaciek\Dane aplikacji\Gadu-Gadu 2008-03-31 19:09 . 2008-04-03 13:52 557 --a------ C:\WINDOWS\DFC.INI 2008-03-31 19:07 . 2008-03-31 19:07 <DIR> d-------- C:\Program Files\Common Files\InstallShield 2008-03-31 19:07 . 2007-09-16 19:07 6,853,088 --a------ C:\WINDOWS\system32\drivers\nv4_mini.sys 2008-03-31 19:07 . 2007-09-16 19:07 6,853,088 --a------ C:\WINDOWS\system32\dllcache\nv4_mini.sys 2008-03-31 19:07 . 2007-09-16 19:07 5,783,040 --a------ C:\WINDOWS\system32\nv4_disp.dll 2008-03-31 19:07 . 2007-09-16 19:07 5,783,040 --a------ C:\WINDOWS\system32\dllcache\nv4_disp.dll 2008-03-31 19:06 . 2008-03-31 19:06 <DIR> d-------- C:\Program Files\VDOTool 2008-03-31 19:02 . 2008-03-31 18:40 <DIR> d--h----- C:\Documents and Settings\Maaciek\Ustawienia lokalne 2008-03-31 19:02 . 2008-03-31 19:02 <DIR> dr------- C:\Documents and Settings\Maaciek\Ulubione 2008-03-31 19:02 . 2008-03-31 18:40 <DIR> d--h----- C:\Documents and Settings\Maaciek\Szablony 2008-03-31 19:02 . 2008-03-31 18:40 <DIR> d-------- C:\Documents and Settings\Maaciek\Pulpit 2008-03-31 19:02 . 2008-03-31 19:02 <DIR> dr------- C:\Documents and Settings\Maaciek\Moje dokumenty 2008-03-31 19:02 . 2008-03-31 18:40 <DIR> dr------- C:\Documents and Settings\Maaciek\Menu Start 2008-03-31 19:02 . 2008-03-31 18:40 <DIR> dr-h----- C:\Documents and Settings\Maaciek\Dane aplikacji 2008-03-31 19:01 . 2008-03-31 19:01 <DIR> d---s---- C:\WINDOWS\system32\Microsoft 2008-03-31 19:01 . 2008-03-31 19:01 <DIR> d--h----- C:\Documents and Settings\NetworkService\Ustawienia lokalne 2008-03-31 19:01 . 2008-03-31 19:01 <DIR> d-------- C:\Documents and Settings\NetworkService\Dane aplikacji 2008-03-31 19:01 . 2008-03-31 19:01 <DIR> d--h----- C:\Documents and Settings\LocalService\Ustawienia lokalne 2008-03-31 19:01 . 2008-03-31 19:01 <DIR> d-------- C:\Documents and Settings\LocalService\Dane aplikacji 2008-03-31 19:01 . 2008-03-31 19:01 8,192 --a------ C:\WINDOWS\REGLOCS.OLD 2008-03-31 19:00 . 2008-03-31 18:40 <DIR> dr-h----- C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne 2008-03-31 19:00 . 2008-03-31 18:40 <DIR> d-------- C:\WINDOWS\system32\config\systemprofile\Ulubione 2008-03-31 19:00 . 2008-03-31 18:40 <DIR> d--h----- C:\WINDOWS\system32\config\systemprofile\Szablony 2008-03-31 19:00 . 2008-03-31 18:40 <DIR> d-------- C:\WINDOWS\system32\config\systemprofile\Pulpit 2008-03-31 19:00 . 2008-03-31 18:40 <DIR> d-------- C:\WINDOWS\system32\config\systemprofile\Moje dokumenty 2008-03-31 19:00 . 2008-03-31 18:40 <DIR> dr------- C:\WINDOWS\system32\config\systemprofile\Menu Start 2008-03-31 19:00 . 2008-03-31 18:40 <DIR> dr-h----- C:\WINDOWS\system32\config\systemprofile\Dane aplikacji . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-03-31 16:57 --------- d-----w C:\Program Files\microsoft frontpage 2008-03-31 16:55 --------- d-----w C:\Program Files\Usługi online . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:44 15360] "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2007-06-01 10:21 153136] "Gadu-Gadu"="D:\Gadu-Gadu\gg.exe" [2008-03-20 12:04 2127296] "LightScribe Control Panel"="C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe" [2007-07-18 17:55 451872] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Gainward"="C:\Program Files\VDOTool\TBPanel.exe" [2007-11-01 13:25 2165272] "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-09-16 19:07 8491008] "nwiz"="nwiz.exe" [2007-09-16 19:07 1626112 C:\WINDOWS\system32\nwiz.exe] "NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-09-16 19:07 81920] "RTHDCPL"="RTHDCPL.EXE" [2007-07-05 10:08 16380416 C:\WINDOWS\RTHDCPL.exe] "NeroFilterCheck"="C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" [2007-03-01 15:57 153136] "WinFast Schedule"="D:\TV\WFWIZ.exe" [2005-03-02 13:21 278528] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 00:44 15360] [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusDisableNotify"=dword:00000001 "UpdatesDisableNotify"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "C:\\WINDOWS\\System32\\PnkBstrA.exe"= "C:\\WINDOWS\\System32\\PnkBstrB.exe"= "D:\\Maciek\\COD 4\\iw3mp.exe"= "C:\\Program Files\\uTorrent\\uTorrent.exe"= "D:\\Maciek\\cs\\hl.exe"= R2 WF23880;WinFast TV2000/DV2000 WDM Video Capture.;C:\WINDOWS\system32\drivers\wf88vcap.sys [2004-10-18 11:25] R2 WF88XBAR;WinFast TV2000/DV2000 WDM Crossbar.;C:\WINDOWS\system32\drivers\WF88XBAR.sys [2004-10-18 11:25] R2 WFTUNE;WinFast TV2000/DV2000 WDM Tuner.;C:\WINDOWS\system32\drivers\WF88TUNE.sys [2004-10-18 11:25] R3 WFIOCTL;WFIOCTL;D:\TV\WFIOCTL.SYS [2005-01-06 16:55] S3 ddsxeiservice;ddsxeiservice2;D:\Maciek\cs\ddsxei.sys [2008-02-04 04:51] S3 gdrv;gdrv;C:\WINDOWS\gdrv.sys [2008-04-01 07:35] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}] "C:\Program Files\Common Files\LightScribe\LSRunOnce.exe" . ************************************************************************** catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-04-03 13:54:05 Windows 5.1.2600 Dodatek Service Pack 2 FAT NTAPI scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2008-04-03 13:54:17 ComboFix-quarantined-files.txt 2008-04-03 11:54:16 Pre-Run: 20,108,886,016 bajtów wolnych Post-Run: 20,100,235,264 bajtów wolnych

przez **pp3088** » 03 Kwi 2008, 15:09

http://www.atribune.org/index.php?optio ... &Itemid=25

przez **Jagla** » 04 Kwi 2008, 14:13

napewno nic tu nie ma ?? bo mam wrażenie że komputer/internet wolniej chodzi. Jak trzeba to wkleje loga nowego...

przez **pp3088** » 04 Kwi 2008, 17:15

Nic nie pokazuje. Użyj czyściela podanego wyżej, powinno pomóc :wink:

przez **huber2t** » 12 Kwi 2008, 06:42

Pobierz ComboFix, ale nie uruchamiaj
Wklej do notatnika:

Kod: Zaznacz wszystko: File:: C:\WINDOWS\system32\TempDel.EXE

Plik

zapisz jako

CFScript.txt (najwygodniej będzie, jeśli zapiszesz w takiej lokalizacji, by ikonka CFScript.txt znalazła się obok ikonki ComboFix.exe)
Przeciągnij i upuść ikonkę CFScript.txt na ikonkę ComboFix.exe tak jak tu

Powinno się rozpocząć usuwanie i powstanie log, daj ten log na forum.
Jeśli wszystko pójdzie dobrze, to po restarcie usuń ręcznie folder C: \Qoobox

Wirus na komputerze, prośba o pomoc w zlikwidowaniu go...

Wirus na komputerze, prośba o pomoc w zlikwidowaniu go...

Kto jest na forum