Czy to wirus...?

**Posty:** 8 · przez **Reeze** 04 Paź 2008, 18:08

Od pewnego czasu zaczynam podejrzewać pewne pliki w procesach... Oto one:
alg.exe
spoolsv.exe
wdfmgr.exe
lsass.exe
services.exe
winlogon.exe
csrss.exe
RichVideo.exe
nvsvc32.exe
smss.exe
MDM.EXE
RTHDCPL.exe
KMWDSrv.exe
KMProcess.exe
avp.exe
KMCONFIG.exe
jusched.exe
StartAutorun.exe

No nie wiem co to jest.. Przecież nic takiego nie instalowałam... Dlatego się pytam co to, bo może to procesy wirusów...

**Posty:** 7956 · przez **Magik** 04 Paź 2008, 18:11

dla przykladu

Reeze napisał(a):jusched.exe

java

Reeze napisał(a):avp.exe

kaspersky

Reeze napisał(a):alg.exe

systemowy

Reeze napisał(a):smss.exe

systemowy

itd

wklej log z Hijacka i sie przekonamy w jakiej lokalizacji leza te pliczki?? moga byc systemowe lub podszywac sie pod systemowe, ale bez sciezki nic na oko

**Posty:** 8001 · przez **Okocza** 04 Paź 2008, 18:11

prawie wszystkie to pliki systemowe...

**Posty:** 684 · przez **djarta** 04 Paź 2008, 18:12

- to normalne procesy Windowskie!

Możliwe, że coś pod nie podpięło:

Daj log z ComboFixa.

======================
K.

**Posty:** 8 · przez **Reeze** 04 Paź 2008, 18:25

Oto log z Hijacka:

Kod: Zaznacz wszystko: Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe C:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe C:\Program Files\Keyboard Driver\KMWDSrv.exe C:\WINDOWS\RTHDCPL.EXE C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\WINDOWS\system32\nvsvc32.exe C:\Program Files\CyberLink\Shared Files\RichVideo.exe C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe C:\Program Files\lg_fwupdate\fwupdate.exe C:\Program Files\Nero\Nero 7\InCD\NBHGui.exe C:\Program Files\Nero\Nero 7\InCD\InCD.exe C:\Program Files\Keyboard Driver\StartAutorun.exe C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe E:\Program Files\Winamp\winampa.exe C:\Program Files\Keyboard Driver\KMConfig.exe D:\Program Files\Gadu-Gadu\gg.exe C:\Program Files\Keyboard Driver\KMProcess.exe C:\Program Files\Skype\Phone\Skype.exe D:\Program Files\ivo\UniSpiker-2.6\uni_spiker-2.6.exe C:\Program Files\Skype\Plugin Manager\skypePM.exe D:\Program Files\Mozilla Firefox\firefox.exe E:\Program Files\Winamp\winamp.exe C:\WINDOWS\system32\svchost.exe D:\Program Files\Gadu-Gadu\gg.exe C:\Documents and Settings\Rayne15\Pulpit\HiJackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.daemon-search.com/startpage R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza R3 - URLSearchHook: Winamp Search Class - {57BCA5FA-5DBB-45a2-B558-1755C3F6253B} - C:\Program Files\Winamp Toolbar\winamptb.dll O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Program Files\Adobe\Acrobat 6.0 CE\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll O2 - BHO: Winamp Toolbar Loader - {25CEE8EC-5730-41bc-8B58-22DDC8AB8C20} - C:\Program Files\Winamp Toolbar\winamptb.dll O2 - BHO: IEVkbdBHO - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\ievkbd.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O3 - Toolbar: Winamp Toolbar - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - C:\Program Files\Winamp Toolbar\winamptb.dll O4 - HKLM\..\Run: [Gainward] C:\Program Files\VDOTool\TBPanel.exe /A O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" O4 - HKLM\..\Run: [LanguageShortcut] "C:\Program Files\CyberLink\PowerDVD\Language\Language.exe" O4 - HKLM\..\Run: [LGODDFU] "C:\Program Files\lg_fwupdate\fwupdate.exe" blrun O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe O4 - HKLM\..\Run: [SecurDisc] C:\Program Files\Nero\Nero 7\InCD\NBHGui.exe O4 - HKLM\..\Run: [InCD] C:\Program Files\Nero\Nero 7\InCD\InCD.exe O4 - HKLM\..\Run: [KMCONFIG] C:\Program Files\Keyboard Driver\StartAutorun.exe KMConfig.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" O4 - HKLM\..\Run: [AVP] "D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe" O4 - HKLM\..\Run: [WinampAgent] "E:\Program Files\Winamp\winampa.exe" O4 - HKCU\..\Run: [Gadu-Gadu] "D:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - HKCU\..\Run: [Odkurzacz-MCD] D:\Program Files\Odkurzacz\odk_mcd.exe O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized O4 - HKCU\..\Run: [DAEMON Tools Lite] "D:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun O4 - HKCU\..\Run: [Nowe Gadu-Gadu] "D:\Program Files\Nowe Gadu-Gadu\gg.exe" O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Startup: UniSpiker-2.6.lnk = ? O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O8 - Extra context menu item: &Winamp Search - C:\Documents and Settings\All Users\Dane aplikacji\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html O8 - Extra context menu item: Dodaj do listy blokowanych banerów - D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\ie_banner_deny.htm O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://D:\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra button: Statystyki ochrony WWW - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\SCIEPlgn.dll O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\PROGRA~1\MICROS~1\OFFICE11\REFIEBAR.DLL O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O20 - AppInit_DLLs: D:\PROGRA~1\KASPER~1\KASPER~1\mzvkbd.dll,D:\PROGRA~1\KASPER~1\KASPER~1\adialhk.dll,D:\PROGRA~1\KASPER~1\KASPER~1\kloehk.dll O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: Kaspersky Internet Security (avp) - Kaspersky Lab - D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe O23 - Service: Keyboard And Mouse Communication Service (KMWDSERVICE) - UASSOFT.COM - C:\Program Files\Keyboard Driver\KMWDSrv.exe O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe O23 - Service: SF FrontLine Drivers Auto Removal (v1) (sfrem01) - Protection Technology (StarForce) - C:\WINDOWS\system32\sfrem01.exe

Wydaje to się śmieszne że takie pytanie padło no ale ja już tak mam że z byle czego (ba, nawet w kompie!) panikuje... I jakby co to pierwszy raz loga zamieszczam, więc mogłam coś źle to zrobić.

**Posty:** 7956 · przez **Magik** 04 Paź 2008, 18:27

Reeze napisał(a):Wydaje to się śmieszne że takie pytanie padło no ale ja już tak mam że z byle czego (ba, nawet w kompie!) panikuje... I jakby co to pierwszy raz loga zamieszczam, więc mogłam coś źle to zrobić

spoko oko

reasumujac: wszystkie te pliczki sa w pelni "zdrowe"

**Posty:** 684 · przez **djarta** 04 Paź 2008, 18:32

Daj na wszelki wypadek ComboFixa.

=============================
K.

**Posty:** 8 · przez **Reeze** 11 Sty 2009, 22:13

Sorry że tak późno to daje. Powodu chyba nie trzeba pisać... xD Daje świeże logi:
HijackThis:

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 13:25:45, on 2009-01-11 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16762) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\VDOTool\TBPanel.exe C:\WINDOWS\system32\RUNDLL32.EXE C:\WINDOWS\RTHDCPL.EXE C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe C:\Program Files\lg_fwupdate\fwupdate.exe C:\Program Files\Nero\Nero 7\InCD\NBHGui.exe C:\Program Files\Nero\Nero 7\InCD\InCD.exe C:\Program Files\Keyboard Driver\StartAutorun.exe C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe C:\Program Files\Keyboard Driver\KMConfig.exe C:\Program Files\Keyboard Driver\KMProcess.exe C:\Program Files\Skype\Phone\Skype.exe C:\Documents and Settings\Rayne15\Ustawienia lokalne\Dane aplikacji\Google\Update\GoogleUpdate.exe D:\Program Files\ivo\UniSpiker-2.6\uni_spiker-2.6.exe E:\PROGRA~1\TOMBRA~2\bin\np.exe C:\Program Files\Common Files\EPSON\EBAPI\eEBSVC.exe D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe C:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe C:\Program Files\Keyboard Driver\KMWDSrv.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\WINDOWS\system32\nvsvc32.exe C:\Program Files\CyberLink\Shared Files\RichVideo.exe C:\WINDOWS\system32\tlntsvr.exe C:\Program Files\Skype\Plugin Manager\skypePM.exe C:\Program Files\Java\jre1.6.0_07\bin\jucheck.exe C:\WINDOWS\explorer.exe C:\WINDOWS\system32\NOTEPAD.EXE C:\Documents and Settings\Rayne15\Ustawienia lokalne\Dane aplikacji\Google\Update\GoogleUpdate.exe C:\Documents and Settings\Rayne15\Pulpit\Pliki\HiJackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.daemon-search.com/startpage R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza R3 - URLSearchHook: Winamp Search Class - {57BCA5FA-5DBB-45a2-B558-1755C3F6253B} - C:\Program Files\Winamp Toolbar\winamptb.dll O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Program Files\Adobe\Acrobat 6.0 CE\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll O2 - BHO: Winamp Toolbar Loader - {25CEE8EC-5730-41bc-8B58-22DDC8AB8C20} - C:\Program Files\Winamp Toolbar\winamptb.dll O2 - BHO: IEVkbdBHO - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\ievkbd.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O3 - Toolbar: Winamp Toolbar - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - C:\Program Files\Winamp Toolbar\winamptb.dll O4 - HKLM\..\Run: [Gainward] C:\Program Files\VDOTool\TBPanel.exe /A O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" O4 - HKLM\..\Run: [LanguageShortcut] "C:\Program Files\CyberLink\PowerDVD\Language\Language.exe" O4 - HKLM\..\Run: [LGODDFU] "C:\Program Files\lg_fwupdate\fwupdate.exe" blrun O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe O4 - HKLM\..\Run: [SecurDisc] C:\Program Files\Nero\Nero 7\InCD\NBHGui.exe O4 - HKLM\..\Run: [InCD] C:\Program Files\Nero\Nero 7\InCD\InCD.exe O4 - HKLM\..\Run: [KMCONFIG] C:\Program Files\Keyboard Driver\StartAutorun.exe KMConfig.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" O4 - HKLM\..\Run: [EPSON Stylus CX3200] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S10IC2.EXE /P19 "EPSON Stylus CX3200" /O5 "LPT1:" /M "Stylus CX3200" O4 - HKLM\..\Run: [\\RAJ\EPSON Stylus CX3200] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S10IC2.EXE /P25 "\\RAJ\EPSON Stylus CX3200" /O6 "USB001" /M "Stylus CX3200" O4 - HKLM\..\Run: [AVP] "D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe" O4 - HKCU\..\Run: [Gadu-Gadu] "D:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized O4 - HKCU\..\Run: [DAEMON Tools Lite] "D:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun O4 - HKCU\..\Run: [Odkurzacz-MCD] D:\Program Files\Odkurzacz\odk_mcd.exe O4 - HKCU\..\Run: [Nowe Gadu-Gadu] "D:\Program Files\Nowe Gadu-Gadu\gg.exe" O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Rayne15\Ustawienia lokalne\Dane aplikacji\Google\Update\GoogleUpdate.exe" /c O4 - HKCU\..\Run: [AQQ] D:\PROGRA~1\WapSter\AQQ\AQQ.exe O4 - HKCU\..\Run: [ALLUpdate] "D:\Program Files\ALLPlayer\ALLUpdate.exe" "sleep" O4 - HKCU\..\Run: [Fraps] D:\FRAPS\FRAPS.EXE O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Startup: Tombraider Browser.lnk = E:\Program Files\Tombraider Browser\bin\Neo.exe O4 - Startup: UniSpiker-2.6.lnk = ? O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O8 - Extra context menu item: &Winamp Search - C:\Documents and Settings\All Users\Dane aplikacji\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://D:\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra button: Statystyki ochrony WWW - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\SCIEPlgn.dll O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\PROGRA~1\MICROS~1\OFFICE11\REFIEBAR.DLL O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {3D8700FB-86A4-4CB4-B738-6F0FC016AC7D} (MainControl Class) - http://slimak.onet.pl/_m/wirusy/ArcaOnline.cab O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: Kaspersky Internet Security (avp) - Kaspersky Lab - D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe O23 - Service: EpsonBidirectionalService - Unknown owner - C:\Program Files\Common Files\EPSON\EBAPI\eEBSVC.exe O23 - Service: EPSON Printer Status Agent2 (EPSONStatusAgent2) - SEIKO EPSON CORPORATION - C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe O23 - Service: Keyboard And Mouse Communication Service (KMWDSERVICE) - UASSOFT.COM - C:\Program Files\Keyboard Driver\KMWDSrv.exe O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: Tomb Raider Legenda Drivers Auto Removal (pr2ak82b) (pr2ak82b) - Cenega Poland - C:\WINDOWS\system32\pr2ak82b.exe O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe O23 - Service: SF FrontLine Drivers Auto Removal (v1) (sfrem01) - Protection Technology (StarForce) - C:\WINDOWS\system32\sfrem01.exe O23 - Service: SpIDer Guard for Windows (SPIDERNT) - Unknown owner - E:\PROGRA~1\DrWeb\spidernt.exe (file missing) -- End of file - 9487 bytes

ComboFix:

Kod: Zaznacz wszystko: ComboFix 09-01-10.01 - Rayne15 2009-01-11 13:03:54.2 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.2047.1599 [GMT 1:00] Uruchomiony z: c:\documents and settings\Rayne15\Pulpit\ComboFix.exe * Utworzono nowy punkt przywracania . ((((((((((((((((((((((((((((((((((((((( Usunięto ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\windows\system32\ccaaaffaa7_z.dll c:\windows\system32\java2.sys c:\windows\system32\snjava.dll c:\windows\system32\msrdo20.dll c:\windows\system32\rdocurs.dll . ((((((((((((((((((((((((( Pliki utworzone od 2008-12-11 do 2009-01-11 ))))))))))))))))))))))))))))))) . 2009-01-08 00:15 . 2009-01-08 00:15 <DIR> d-------- c:\documents and settings\Rayne15\Dane aplikacji\AVI ReComp 2009-01-07 23:35 . 2009-01-07 23:35 <DIR> d-------- c:\documents and settings\Rayne15\Dane aplikacji\EPSON 2009-01-07 23:35 . 2009-01-07 23:35 29 --a------ c:\windows\DEBUGSM.INI 2009-01-07 23:02 . 2001-12-12 11:46 131,072 --a------ c:\windows\system32\Epcmlib.dll 2009-01-07 23:01 . 2001-10-16 10:23 163,840 --a------ c:\windows\system32\PhotoImpression Screen Saver.scr 2009-01-07 23:00 . 1999-05-26 09:46 212,480 --a------ c:\windows\pcdlib32.dll 2009-01-07 22:58 . 2009-01-07 22:58 <DIR> d-------- c:\program files\Common Files\Python 2009-01-07 22:58 . 2001-10-19 12:18 708,696 --a------ c:\windows\system32\python21.dll 2009-01-07 22:58 . 2001-10-19 12:18 290,919 --a------ c:\windows\system32\pythoncom21.dll 2009-01-07 22:58 . 2001-10-19 12:19 57,344 --a------ c:\windows\system32\PyWinTypes21.dll 2009-01-07 22:52 . 1999-06-15 11:31 96,768 --a------ c:\windows\SlantAdj.dll 2009-01-07 22:52 . 1999-12-07 02:03 73,216 --a------ c:\windows\ADE.DLL 2009-01-07 22:52 . 1999-04-27 00:17 3,136 --a------ c:\windows\Ade001.bin 2009-01-07 22:52 . 2000-09-08 13:31 72 -ra------ c:\windows\system32\epDPE.ini 2009-01-07 22:49 . 2002-05-10 19:56 122,880 --a------ c:\windows\system32\EEBAPI.dll 2009-01-07 22:49 . 2002-05-10 19:56 102,400 --a------ c:\windows\system32\EEBDSCVR.dll 2009-01-07 22:49 . 2002-01-10 19:05 65,536 --a------ c:\windows\system32\EEBUtil.dll 2009-01-07 22:49 . 2002-01-29 13:33 65,536 --a------ c:\windows\system32\EBAPI.dll 2009-01-07 22:49 . 2001-08-21 01:00 54,272 --a------ c:\windows\system32\EEBSDKIF.dll 2009-01-07 22:47 . 2009-01-07 22:47 <DIR> d-------- c:\program files\Common Files\EPSON 2009-01-07 22:47 . 2001-08-23 01:04 139,264 --a------ c:\windows\system32\EBAPI2.dll 2009-01-07 22:45 . 2009-01-07 23:02 <DIR> d-------- c:\program files\EPSON 2008-12-30 11:27 . 2007-06-28 18:55 77,824 --a------ c:\windows\system32\xvid.ax 2008-12-29 21:59 . 2008-12-29 21:59 <DIR> d-------- c:\documents and settings\Rayne15\.gstreamer-0.10 2008-12-28 11:36 . 2001-06-01 16:23 198,416 --a------ c:\windows\system32\Mschatpr.ocx 2008-12-28 11:36 . 2001-06-01 16:23 171,520 --a------ c:\windows\system32\patchw32.dll 2008-12-28 05:16 . 1999-08-03 10:50 172,032 --a------ c:\windows\system32\binkw32.dll 2008-12-28 04:50 . 2008-12-28 11:21 <DIR> d-------- C:\TOMBRAID 2008-12-26 00:55 . 2003-10-14 13:25 128 --a------ c:\windows\system32\vssver.scc 2008-12-26 00:51 . 2003-10-14 11:48 974,848 -ra------ c:\windows\system32\mfc70.dll 2008-12-26 00:51 . 2003-10-14 11:48 487,424 -ra------ c:\windows\system32\msvcp70.dll 2008-12-26 00:51 . 2003-10-14 11:48 344,064 -ra------ c:\windows\system32\msvcr70.dll 2008-12-25 23:09 . 2008-12-25 23:09 471,040 --a------ c:\windows\mp2_screensaver_1024x768.scr 2008-12-25 23:08 . 2008-12-25 23:09 <DIR> d-------- c:\windows\mp2_screensaver_1024x768 dir 2008-12-25 23:08 . 2008-12-25 23:08 12,288 --a------ c:\windows\impborl.dll 2008-12-23 19:12 . 2008-12-23 19:12 206 --a------ c:\windows\system32\bceadeeb_z.ocx 2008-12-21 21:28 . 2008-12-22 16:59 <DIR> d-------- c:\program files\NAPI-PROJEKT 2008-12-18 23:20 . 2008-12-18 23:20 <DIR> d-------- c:\documents and settings\LocalService\Dane aplikacji\Xfire 2008-12-18 23:16 . 2008-12-19 21:19 <DIR> d-------- c:\documents and settings\Rayne15\Dane aplikacji\Xfire 2008-12-14 21:07 . 2008-12-26 20:39 194 --a------ c:\windows\wcx_ftp.ini 2008-12-14 21:03 . 2008-12-26 20:39 1,070 --a------ c:\windows\wincmd.ini 2008-12-14 21:03 . 2008-08-08 07:04 545 --a------ c:\windows\UC.PIF 2008-12-14 21:03 . 2008-08-08 07:04 545 --a------ c:\windows\RAR.PIF 2008-12-14 21:03 . 2008-08-08 07:04 545 --a------ c:\windows\PKZIP.PIF 2008-12-14 21:03 . 2008-08-08 07:04 545 --a------ c:\windows\PKUNZIP.PIF 2008-12-14 21:03 . 2008-08-08 07:04 545 --a------ c:\windows\NOCLOSE.PIF 2008-12-14 21:03 . 2008-08-08 07:04 545 --a------ c:\windows\LHA.PIF 2008-12-14 21:03 . 2008-08-08 07:04 545 --a------ c:\windows\ARJ.PIF 2008-12-13 13:47 . 2008-06-19 17:24 28,544 --a------ c:\windows\system32\drivers\pavboot.sys 2008-12-13 13:46 . 2008-12-13 13:46 <DIR> d-------- c:\program files\Panda Security 2008-12-11 21:38 . 2008-12-11 21:38 42,320 --a------ c:\windows\system32\xfcodec.dll . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-01-11 12:12 --------- d---a-w c:\documents and settings\All Users\Dane aplikacji\TEMP 2009-01-11 12:10 --------- d-----w c:\program files\lg_fwupdate 2009-01-11 12:10 --------- d-----w c:\documents and settings\Rayne15\Dane aplikacji\Skype 2009-01-11 12:07 38,612 --sha-w c:\windows\system32\drivers\fidbox2.idx 2009-01-11 12:07 165,788 --sha-w c:\windows\system32\drivers\fidbox.idx 2009-01-11 12:07 11,986,720 --sha-w c:\windows\system32\drivers\fidbox.dat 2009-01-11 12:07 1,040,416 --sha-w c:\windows\system32\drivers\fidbox2.dat 2009-01-11 12:00 --------- d-----w c:\documents and settings\Rayne15\Dane aplikacji\skypePM 2009-01-11 11:59 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\Kaspersky Lab 2009-01-07 22:02 --------- d--h--w c:\program files\InstallShield Installation Information 2008-12-19 19:58 77,824 ----atw c:\windows\system32\DRWEBSP.DLL 2008-12-07 16:49 --------- d-----w c:\documents and settings\Rayne15\Dane aplikacji\Flock 2008-11-28 13:55 --------- d-----w c:\documents and settings\Rayne15\Dane aplikacji\SPORE Creature Creator 2008-11-22 19:54 --------- d-----w c:\program files\Windows Media Connect 2 2008-11-20 14:40 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\OrbNetworks 2008-11-20 14:39 --------- d-----w c:\program files\Winamp Remote 2008-10-23 13:01 283,648 ----a-w c:\windows\system32\gdi32.dll 2008-10-16 20:33 826,368 ----a-w c:\windows\system32\wininet.dll 2008-10-16 13:13 202,776 ----a-w c:\windows\system32\wuweb.dll 2008-10-16 13:13 1,809,944 ----a-w c:\windows\system32\wuaueng.dll 2008-10-16 13:12 561,688 ----a-w c:\windows\system32\wuapi.dll 2008-10-16 13:12 323,608 ----a-w c:\windows\system32\wucltui.dll 2008-10-16 13:09 92,696 ----a-w c:\windows\system32\cdm.dll 2008-10-16 13:09 51,224 ----a-w c:\windows\system32\wuauclt.exe 2008-10-16 13:09 43,544 ----a-w c:\windows\system32\wups2.dll 2008-10-16 13:08 34,328 ----a-w c:\windows\system32\wups.dll 2008-04-07 09:21 67,696 ----a-w c:\program files\mozilla firefox\components\jar50.dll 2008-04-07 09:21 54,376 ----a-w c:\program files\mozilla firefox\components\jsd3250.dll 2008-04-07 09:21 34,952 ----a-w c:\program files\mozilla firefox\components\myspell.dll 2008-04-07 09:21 46,720 ----a-w c:\program files\mozilla firefox\components\spellchk.dll 2008-04-07 09:21 172,144 ----a-w c:\program files\mozilla firefox\components\xpinstal.dll 2008-09-06 17:55 32,768 --sha-w c:\windows\system32\config\systemprofile\Ustawienia lokalne\Historia\History.IE5\MSHist012008090620080907\index.dat . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks] "{57BCA5FA-5DBB-45a2-B558-1755C3F6253B}"= "c:\program files\Winamp Toolbar\winamptb.dll" [2008-07-16 1266992] [HKEY_CLASSES_ROOT\clsid\{57bca5fa-5dbb-45a2-b558-1755c3f6253b}] [HKEY_CLASSES_ROOT\WINAMPTB.AOLTBSearch.1] [HKEY_CLASSES_ROOT\TypeLib\{538CD77C-BFDD-49b0-9562-77419CAB89D1}] [HKEY_CLASSES_ROOT\WINAMPTB.AOLTBSearch] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Gadu-Gadu"="d:\program files\Gadu-Gadu\gg.exe" [2007-07-09 2119104] "Skype"="c:\program files\Skype\Phone\Skype.exe" [2008-05-30 21718312] "DAEMON Tools Lite"="d:\program files\DAEMON Tools Lite\daemon.exe" [2008-04-01 486856] "Odkurzacz-MCD"="d:\program files\Odkurzacz\odk_mcd.exe" [2008-08-16 264704] "Nowe Gadu-Gadu"="d:\program files\Nowe Gadu-Gadu\gg.exe" [2008-12-22 8966760] "Google Update"="c:\documents and settings\Rayne15\Ustawienia lokalne\Dane aplikacji\Google\Update\GoogleUpdate.exe" [2008-12-06 133104] "AQQ"="d:\progra~1\WapSter\AQQ\AQQ.exe" [2007-02-28 2351864] "ALLUpdate"="d:\program files\ALLPlayer\ALLUpdate.exe" [2008-11-24 869888] "Fraps"="d:\fraps\FRAPS.EXE" [2008-01-14 3182248] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Gainward"="c:\program files\VDOTool\TBPanel.exe" [2007-11-27 2169368] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-11-28 8523776] "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2007-11-28 81920] "RemoteControl"="c:\program files\CyberLink\PowerDVD\PDVDServ.exe" [2006-11-23 56928] "LanguageShortcut"="c:\program files\CyberLink\PowerDVD\Language\Language.exe" [2006-12-05 54832] "LGODDFU"="c:\program files\lg_fwupdate\fwupdate.exe" [2008-12-11 548864] "NeroFilterCheck"="c:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2007-03-01 153136] "SecurDisc"="c:\program files\Nero\Nero 7\InCD\NBHGui.exe" [2007-05-15 1628208] "InCD"="c:\program files\Nero\Nero 7\InCD\InCD.exe" [2007-05-15 1057328] "KMCONFIG"="c:\program files\Keyboard Driver\StartAutorun.exe" [2007-03-06 212992] "SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784] "EPSON Stylus CX3200"="c:\windows\System32\spool\DRIVERS\W32X86\3\E_S10IC2.EXE" [2002-09-23 74752] "\\RAJ\EPSON Stylus CX3200"="c:\windows\System32\spool\DRIVERS\W32X86\3\E_S10IC2.EXE" [2002-09-23 74752] "AVP"="d:\program files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe" [2008-04-25 201992] "nwiz"="nwiz.exe" [2007-11-28 c:\windows\system32\nwiz.exe] "RTHDCPL"="RTHDCPL.EXE" [2007-05-10 c:\windows\RTHDCPL.exe] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-03 15360] c:\documents and settings\Rayne15\Menu Start\Programy\Autostart\ Adobe Gamma.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2008-04-12 113664] Tombraider Browser.lnk - e:\program files\Tombraider Browser\bin\Neo.exe [2008-12-28 94208] UniSpiker-2.6.lnk - d:\program files\ivo\UniSpiker-2.6\uni_spiker-2.6.exe [2007-09-21 86016] c:\documents and settings\All Users\Menu Start\Programy\Autostart\ Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2008-04-12 113664] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "VIDC.XFR1"= xfcodec.dll [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusOverride"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "d:\\Program Files\\Gadu-Gadu\\gg.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "c:\\WINDOWS\\system32\\sessmgr.exe"= "d:\\Program Files\\Nowe Gadu-Gadu\\gg.exe"= "%windir%\\system32\\sessmgr.exe"= "d:\\Program Files\\Mozilla Firefox\\firefox.exe"= "d:\\Program Files\\Codemasters\\GRID Demo\\GRID.exe"= "c:\\Program Files\\Winamp Remote\\bin\\Orb.exe"= "c:\\Program Files\\Winamp Remote\\bin\\OrbStreamerClient.exe"= "c:\\Program Files\\Winamp Remote\\bin\\OrbTray.exe"= "d:\\Program Files\\TmNationsForever\\TmForever.exe"= "d:\\Program Files\\WapSter\\WapSter AQQ\\AQQ.exe"= "d:\\Program Files\\WapSter\\AQQ\\AQQ.exe"= "d:\\totalcmd\\TOTALCMD.EXE"= "c:\\Program Files\\Reallusion\\CrazyTalk for Skype\\CT4Skype.exe"= "e:\\Program Files\\Metin2_PL\\metin2.bin"= "c:\\Program Files\\Skype\\Phone\\Skype.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings] "AllowInboundMaskRequest"= 0 (0x0) "AllowInboundRouterRequest"= 0 (0x0) "AllowOutboundSourceQuench"= 0 (0x0) "AllowOutboundParameterProblem"= 0 (0x0) "AllowInboundTimestampRequest"= 0 (0x0) "AllowOutboundDestinationUnreachable"= 0 (0x0) "AllowOutboundPacketTooBig"= 0 (0x0) R0 klbg;Kaspersky Lab Boot Guard Driver;c:\windows\system32\drivers\klbg.sys [2008-01-29 32784] R0 pavboot;pavboot;c:\windows\system32\drivers\pavboot.sys [2008-12-13 28544] R0 pe3ak82b;Tomb Raider Legenda Environment Driver (pe3ak82b);c:\windows\system32\drivers\pe3ak82b.sys [2007-05-22 65424] R0 ps6ak82b;Tomb Raider Legenda Synchronization Driver (ps6ak82b);c:\windows\system32\drivers\ps6ak82b.sys [2007-05-22 55704] R1 is-483INdrv;is-483INdrv;c:\windows\system32\drivers\31921080.sys [2008-10-02 148496] R3 KLFLTDEV;Kaspersky Lab KLFltDev;c:\windows\system32\drivers\klfltdev.sys [2008-03-13 26640] R4 KMWDSERVICE;Keyboard And Mouse Communication Service;c:\program files\Keyboard Driver\KMWDSrv.exe [2007-04-05 208896] S3 ATE_PROCMON;ATE_PROCMON;\??\d:\program files\Anti Trojan Elite\ATEPMon.sys --> d:\program files\Anti Trojan Elite\ATEPMon.sys [?] S3 klim5;Kaspersky Anti-Virus NDIS Filter;c:\windows\system32\drivers\klim5.sys [2007-12-13 24592] S3 SetupNTGLM7X;SetupNTGLM7X;\??\g:\ntglm7x.sys --> g:\NTGLM7X.sys [?] S4 pr2ak82b;Tomb Raider Legenda Drivers Auto Removal (pr2ak82b);c:\windows\system32\pr2ak82b.exe svc --> c:\windows\system32\pr2ak82b.exe svc [?] S4 SPIDER;SpIDer Guard File System Monitor;\??\e:\progra~1\DrWeb\spider.sys --> e:\progra~1\DrWeb\spider.sys [?] S4 SPIDERNT;SpIDer Guard for Windows;e:\progra~1\DrWeb\spidernt.exe --> e:\progra~1\DrWeb\spidernt.exe [?] --- Other Services/Drivers In Memory --- *Deregistered* - InCDrec . Zawartość folderu 'Zaplanowane zadania' 2009-01-10 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1844237615-839522115-682003330-1003.job - c:\documents and settings\Rayne15\Ustawienia lokalne\Dane aplikacji\Google\Update\GoogleUpdate.exe [2008-12-06 17:17] 2009-01-09 c:\windows\Tasks\Norton Security Scan.job - c:\program files\Norton Security Scan\Nss.exe [] . . ------- Skan uzupełniający ------- . uStart Page = hxxp://www.daemon-search.com/startpage uInternet Connection Wizard,ShellNext = iexplore IE: &Winamp Search - c:\documents and settings\All Users\Dane aplikacji\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html IE: E&ksport do programu Microsoft Excel - d:\progra~1\MICROS~1\OFFICE11\EXCEL.EXE/3000 LSP: c:\windows\system32\DRWEBSP.DLL c:\windows\system32\ArcaMicroScanUpdater.exe - c:\windows\system32\ArcaOnlineUninstall.exe c:\windows\system32\ArcaOnline.dll O16 -: {3D8700FB-86A4-4CB4-B738-6F0FC016AC7D} hxxp://slimak.onet.pl/_m/wirusy/ArcaOnline.cab c:\windows\Downloaded Program Files\ArcaOnline.inf FF - ProfilePath - c:\documents and settings\Rayne15\Dane aplikacji\Mozilla\Firefox\Profiles\z4wpxp4r.default\ FF - prefs.js: browser.startup.homepage - hxxp://www.onet.pl/ FF - component: c:\documents and settings\Rayne15\Dane aplikacji\Mozilla\Firefox\Profiles\z4wpxp4r.default\extensions\{0b38152b-1b20-484d-a11f-5e04a9b0661f}\components\WinampTBPlayer.dll FF - plugin: c:\documents and settings\Rayne15\Ustawienia lokalne\Dane aplikacji\Google\Update\1.2.133.33\npGoogleOneClick7.dll FF - plugin: d:\program files\Adobe\Acrobat 6.0 CE\Reader\browser\nppdf32.dll FF - plugin: d:\program files\GameTap\bin\Release\npgametaptool.dll FF - plugin: d:\program files\Opera\program\plugins\npdsplay.dll FF - plugin: d:\program files\Opera\program\plugins\NPSWF32.dll FF - plugin: d:\program files\Opera\program\plugins\npwmsdrm.dll . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-01-11 13:13:20 Windows 5.1.2600 Dodatek Service Pack 2 NTFS skanowanie ukrytych procesów ... skanowanie ukrytych wpisów autostartu ... skanowanie ukrytych plików ... skanowanie pomyślnie ukończone ukryte pliki: 0 ************************************************************************** . --------------------- LOCKED REGISTRY KEYS --------------------- [HKEY_USERS\S-1-5-21-1844237615-839522115-682003330-1003\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*] "??"=hex:e4,47,9b,c0,7e,62,ae,69,df,5d,9a,79,5e,5f,cf,93,81,77,27,d1,9a,46,56, da,ac,f3,d4,a0,be,64,ef,8d,ed,38,bb,6e,d4,53,09,81,82,15,76,ff,73,8b,d6,00,\ "??"=hex:86,de,b0,98,f5,10,dd,0b,f0,68,3d,f7,4c,35,70,c9 [HKEY_USERS\S-1-5-21-1844237615-839522115-682003330-1003\Software\SecuROM\License information*] "datasecu"=hex:84,7d,4a,34,bc,d2,13,63,cf,51,70,79,c1,1f,44,d7,69,06,76,6d,04, a2,09,e1,cc,02,87,5e,29,1a,cc,46,85,b8,47,42,7b,c3,e6,10,cd,87,33,59,35,90,\ "rkeysecu"=hex:c8,92,02,bb,21,32,67,fb,51,0a,e3,c2,95,b8,a6,4a . --------------------- Pliki DLL ładowane pod uruchomionymi procesami --------------------- - - - - - - - > 'winlogon.exe'(556) c:\windows\system32\klogon.dll - - - - - - - > 'lsass.exe'(612) c:\windows\system32\DRWEBSP.DLL - - - - - - - > 'explorer.exe'(2724) d:\program files\Microsoft Office\OFFICE11\msohev.dll c:\windows\system32\DRWEBSP.DLL c:\windows\system32\WPDShServiceObj.dll c:\windows\system32\PortableDeviceTypes.dll c:\windows\system32\PortableDeviceApi.dll . ------------------------ Pozostałe uruchomione procesy ------------------------ . c:\windows\system32\rundll32.exe c:\program files\Keyboard Driver\KMCONFIG.exe c:\program files\Keyboard Driver\KMProcess.exe e:\progra~1\TOMBRA~2\bin\NP.exe c:\program files\Common Files\EPSON\EBAPI\eEBSvc.exe c:\program files\Common Files\EPSON\EBAPI\SAgent2.exe c:\program files\Nero\Nero 7\InCD\InCDsrv.exe c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE c:\windows\system32\nvsvc32.exe c:\program files\CyberLink\Shared Files\RichVideo.exe c:\windows\system32\tlntsvr.exe c:\program files\Skype\Plugin Manager\skypePM.exe c:\program files\Java\jre1.6.0_07\bin\jucheck.exe c:\windows\system32\imapi.exe . ************************************************************************** . Czas ukończenia: 2009-01-11 13:16:48 - komputer został uruchomiony ponownie Przed: 2 814 930 944 bajtów wolnych Po: 3,418,406,912 bajtów wolnych Current=4 Default=4 Failed=1 LastKnownGood=5 Sets=1,2,3,4,5 282 --- E O F --- 2008-12-18 13:09:31

**Posty:** 8001 · przez **Okocza** 11 Sty 2009, 22:36

Reeze, Wykonaj to co jest podane w tym temacie

1. tym programem przejdź komputer
2. wykonaj optymalizację windowsa
3.sciagnij ATF_Cleaner
zaznacz
Windows Temp
All users Temp
Temporary internet files
Recycle Bin
i wcisnij EMPTY SELECTED
4.Wyłącz przywracanie systemu ( właściwości mój komputer-zakładka przywracanie - wyłącz przywracanie na wszystkich dyskach). Po chwili włącz je powrotem
5. Przeskanuj komputer pod względem Trojanów tym programem
6. Wstaw na forum screen z zakładki uruchamianie (start – uruchom – msconfig – uruchamianie) może uda się cos wyrzucic stamtąd. Ewentualnie daj screen z programu Starter
7. Przeskanuj obszar mojego komputera http://www.kaspersky.pl/virusscanner.html (uruchom przez IE) Daj raport z niego na forum.

Kto jest na forum