Nie można usunąć pliku temp2.exe

**Posty:** 84 · przez **zooo** 29 Lip 2009, 16:19

Witam!!! Mam problem wiem ze było, ale szukam pomocy. Nie moge usunac pliku temp2.exe
Oto logi:
1. HijackThis:

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 16:10:57, on 2009-07-29 Platform: Windows XP Dodatek SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v8.00 (8.00.6001.18241) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\CTsvcCDA.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\MsPMSPSv.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\RunDLL32.exe C:\WINDOWS\system32\CTHELPER.EXE C:\WINDOWS\system32\temp1.exe C:\WINDOWS\system32\rundll32.exe C:\Program Files\Java\jre6\bin\jusched.exe C:\Program Files\CyberLink\PowerDVD9\PDVD9Serv.exe C:\Program Files\Cyberlink\Shared Files\brs.exe C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Nokia\Nokia PC Suite 7\PCSuite.exe C:\Program Files\Logitech\SetPoint\SetPoint.exe C:\Program Files\SAGEM WiFi manager\WLANUTL.exe C:\Documents and Settings\SZEWCO\Menu Start\Programy\Autostart\Save2pc Pro Updater.exe C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE C:\Program Files\PC Connectivity Solution\ServiceLayer.exe C:\Program Files\PC Connectivity Solution\Transports\NclUSBSrv.exe C:\Program Files\PC Connectivity Solution\Transports\NclRSSrv.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.onet.pl/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.microsoft.com/fwlink/?linkid=54834&clcid=0x409 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza F3 - REG:win.ini: load=C:\WINDOWS\svchost.exe O1 - Hosts: 72.232.248.222 nprotect.battlelands.net O1 - Hosts: 69.80.225.31 nprotect.ryl.com.my O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [WINDVDPatch] CTHELPER.EXE O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE O4 - HKLM\..\Run: [Jet Detection] "C:\Program Files\Creative\SBLive\PROGRAM\ADGJDet.exe" O4 - HKLM\..\Run: [CTStartup] C:\Program Files\Creative\Splash Screen\CTEaxSpl.EXE /run O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe" O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE O4 - HKLM\..\Run: [RemoteControl9] "C:\Program Files\CyberLink\PowerDVD9\PDVD9Serv.exe" O4 - HKLM\..\Run: [PDVD9LanguageShortcut] "C:\Program Files\CyberLink\PowerDVD9\Language\Language.exe" O4 - HKLM\..\Run: [BDRegion] C:\Program Files\Cyberlink\Shared Files\brs.exe O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe" O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [PC Suite Tray] "C:\Program Files\Nokia\Nokia PC Suite 7\PCSuite.exe" -onlytray O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Startup: Save2pc Pro Updater.exe O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe O4 - Global Startup: Program sieciowy dla SAGEM Wi-Fi 11g USB adapter.lnk = ? O8 - Extra context menu item: E&ksportuj do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000 O16 - DPF: {68282C51-9459-467B-95BF-3C0E89627E55} (MksSkanerOnline Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O22 - SharedTaskScheduler: IE Component Categories cache daemon - {553858A7-4922-4e7e-B1C1-97140C1C16EF} - C:\WINDOWS\system32\ieframe.dll O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Common Files\Logishrd\Bluetooth\LBTServ.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe

2. SR:

Kod: Zaznacz wszystko: "Silent Runners.vbs", revision 59, http://www.silentrunners.org/ Operating System: Windows XP Output limited to non-default values, except where indicated by "{++}" Startup items buried in registry: --------------------------------- HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ {++} "CTFMON.EXE" = "C:\WINDOWS\system32\ctfmon.exe" [MS] "PC Suite Tray" = ""C:\Program Files\Nokia\Nokia PC Suite 7\PCSuite.exe" -onlytray" ["Nokia"] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++} "NvCplDaemon" = "RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup" [MS] "nwiz" = "nwiz.exe /install" ["NVIDIA Corporation"] "NvMediaCenter" = "RunDLL32.exe NvMCTray.dll,NvTaskbarInit" [MS] "WINDVDPatch" = "CTHELPER.EXE" ["Creative Technology Ltd"] "UpdReg" = "C:\WINDOWS\UpdReg.EXE" ["Creative Technology Ltd."] "Jet Detection" = ""C:\Program Files\Creative\SBLive\PROGRAM\ADGJDet.exe"" [empty string] "CTStartup" = "C:\Program Files\Creative\Splash Screen\CTEaxSpl.EXE /run" ["Creative Technology Ltd."] "SunJavaUpdateSched" = ""C:\Program Files\Java\jre6\bin\jusched.exe"" ["Sun Microsystems, Inc."] "Kernel and Hardware Abstraction Layer" = "KHALMNPR.EXE" ["Logitech, Inc."] "RemoteControl9" = ""C:\Program Files\CyberLink\PowerDVD9\PDVD9Serv.exe"" ["CyberLink Corp."] "PDVD9LanguageShortcut" = ""C:\Program Files\CyberLink\PowerDVD9\Language\Language.exe"" ["CyberLink Corp."] "BDRegion" = "C:\Program Files\Cyberlink\Shared Files\brs.exe" ["cyberlink"] "GrooveMonitor" = ""C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"" [MS] "Adobe Reader Speed Launcher" = ""C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"" ["Adobe Systems Incorporated"] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\ "{42071714-76d4-11d1-8b24-00a0c9068ff3}" = "Rozszerzenie CPL kadrowania wyświetlania" -> {HKLM...CLSID} = "Rozszerzenie CPL kadrowania wyświetlania" \InProcServer32\(Default) = "deskpan.dll" [file not found] "{88895560-9AA2-1069-930E-00AA0030EBC8}" = "Rozszerzenie ikony HyperTerminalu" -> {HKLM...CLSID} = "HyperTerminal Icon Ext" \InProcServer32\(Default) = "C:\WINDOWS\system32\hticons.dll" ["Hilgraeve, Inc."] "{A70C977A-BF00-412C-90B7-034C51DA2439}" = "NvCpl DesktopContext Class" -> {HKLM...CLSID} = "DesktopContext Class" \InProcServer32\(Default) = "C:\WINDOWS\system32\nvcpl.dll" ["NVIDIA Corporation"] "{FFB699E0-306A-11d3-8BD1-00104B6F7516}" = "Play on my TV helper" -> {HKLM...CLSID} = "NVIDIA CPL Extension" \InProcServer32\(Default) = "C:\WINDOWS\system32\nvcpl.dll" ["NVIDIA Corporation"] "{1CDB2949-8F65-4355-8456-263E7C208A5D}" = "Desktop Explorer" -> {HKLM...CLSID} = "Desktop Explorer" \InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"] "{1E9B04FB-F9E5-4718-997B-B8DA88302A47}" = "Desktop Explorer Menu" -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"] "{1E9B04FB-F9E5-4718-997B-B8DA88302A48}" = "nView Desktop Context Menu" -> {HKLM...CLSID} = "nView Desktop Context Menu" \InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"] "{0D6D4F41-2994-4ba0-8FEF-620E43CD2812}" = "IE Microsoft Internet Toolbar" -> {HKLM...CLSID} = "IE Microsoft Internet Toolbar" \InProcServer32\(Default) = "C:\WINDOWS\system32\ieframe.dll" [MS] "{C4EC38BD-4E9E-4b5e-935A-D1BFF237D980}" = "Explorer Travel Band" -> {HKLM...CLSID} = "Explorer Travel Band" \InProcServer32\(Default) = "C:\WINDOWS\system32\ieframe.dll" [MS] "{6D8BB3D3-9D87-4a91-AB56-4F30CFFEFE9F}" = "Explorer Search Band" -> {HKLM...CLSID} = "Explorer Search Band" \InProcServer32\(Default) = "C:\WINDOWS\system32\ieframe.dll" [MS] "{DE011590-0531-4804-9C9C-3FEDC7E6E5C8}" = "IE &Address" -> {HKLM...CLSID} = "IE &Address" \InProcServer32\(Default) = "C:\WINDOWS\system32\ieframe.dll" [MS] "{7E48925F-FF5C-47fa-A99A-F5912A10623B}" = "IE Address EditBox" -> {HKLM...CLSID} = "IE Address EditBox" \InProcServer32\(Default) = "C:\WINDOWS\system32\ieframe.dll" [MS] "{7EDC7DE1-DD42-457a-8B36-B422F8E94E14}" = "IE Shell DeskBar" -> {HKLM...CLSID} = "IE Shell DeskBar" \InProcServer32\(Default) = "C:\WINDOWS\system32\ieframe.dll" [MS] "{DBC04CF4-BE36-4f53-9C48-2D3625CA7694}" = "IE Thumbnail Image" -> {HKLM...CLSID} = "IE Thumbnail Image" \InProcServer32\(Default) = "C:\WINDOWS\system32\ieframe.dll" [MS] "{482A7CB3-2EDF-4595-A315-A5244F1E96E6}" = "IE Search Control" -> {HKLM...CLSID} = "IE Search Control" \InProcServer32\(Default) = "C:\WINDOWS\system32\ieframe.dll" [MS] "{0B1818A2-EA07-4a55-AF57-1F410EBD21D3}" = "Favorites Band" -> {HKLM...CLSID} = "Favorites Band" \InProcServer32\(Default) = "C:\WINDOWS\system32\ieframe.dll" [MS] "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" = "WinRAR shell extension" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" ["Alexander Roshal"] "{E0D79304-84BE-11CE-9641-444553540000}" = "WinZip" -> {HKLM...CLSID} = "WinZip" \InProcServer32\(Default) = "C:\PROGRA~1\WINZIP\WZSHLSTB.DLL" ["WinZip Computing, S.L."] "{E0D79305-84BE-11CE-9641-444553540000}" = "WinZip" -> {HKLM...CLSID} = "WinZip" \InProcServer32\(Default) = "C:\PROGRA~1\WINZIP\WZSHLSTB.DLL" ["WinZip Computing, S.L."] "{E0D79306-84BE-11CE-9641-444553540000}" = "WinZip" -> {HKLM...CLSID} = "WinZip" \InProcServer32\(Default) = "C:\PROGRA~1\WINZIP\WZSHLSTB.DLL" ["WinZip Computing, S.L."] "{E0D79307-84BE-11CE-9641-444553540000}" = "WinZip" -> {HKLM...CLSID} = "WinZip" \InProcServer32\(Default) = "C:\PROGRA~1\WINZIP\WZSHLSTB.DLL" ["WinZip Computing, S.L."] "{416651E4-9C3C-11D9-8BDE-F66BAD1E3F3A}" = "Nokia Phone Browser" -> {HKLM...CLSID} = "Nokia Phone Browser" \InProcServer32\(Default) = "C:\Program Files\Nokia\Nokia PC Suite 7\PhoneBrowser.dll" ["Nokia"] "{DC70C4A5-2044-4c59-B806-DEFB9AE0DF7C}" = "Logitech Setpoint Extension" -> {HKLM...CLSID} = "KbLogiExt Class" \InProcServer32\(Default) = "C:\Program Files\Logitech\SetPoint\kbcplext.dll" ["Logitech, Inc."] "{B9B9F083-2B04-452A-8691-83694AC1037B}" = "Logitech Setpoint Extension" -> {HKLM...CLSID} = "LogiExt Class" \InProcServer32\(Default) = "C:\Program Files\Logitech\SetPoint\mcplext.dll" ["Logitech, Inc."] "{72853161-30C5-4D22-B7F9-0BBC1D38A37E}" = "Groove GFS Browser Helper" -> {HKLM...CLSID} = "Groove GFS Browser Helper" \InProcServer32\(Default) = "C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll" [MS] "{2A541AE1-5BF6-4665-A8A3-CFA9672E4291}" = "Groove GFS Explorer Bar" -> {HKLM...CLSID} = "Groove Folder Synchronization" \InProcServer32\(Default) = "C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll" [MS] "{A449600E-1DC6-4232-B948-9BD794D62056}" = "Groove GFS Stub Icon Handler" -> {HKLM...CLSID} = "Groove GFS Stub Icon Handler" \InProcServer32\(Default) = "C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll" [MS] "{B5A7F190-DDA6-4420-B3BA-52453494E6CD}" = "Groove GFS Stub Execution Hook" -> {HKLM...CLSID} = "Groove GFS Stub Execution Hook" \InProcServer32\(Default) = "C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll" [MS] "{6C467336-8281-4E60-8204-430CED96822D}" = "Groove GFS Context Menu Handler" -> {HKLM...CLSID} = "Groove GFS Context Menu Handler" \InProcServer32\(Default) = "C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll" [MS] "{387E725D-DC16-4D76-B310-2C93ED4752A0}" = "Groove XML Icon Handler" -> {HKLM...CLSID} = "Groove XML Icon Handler" \InProcServer32\(Default) = "C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll" [MS] "{16F3DD56-1AF5-4347-846D-7C10C4192619}" = "Groove Explorer Icon Overlay 3 (GFS Folder)" -> {HKLM...CLSID} = "Groove Explorer Icon Overlay 3 (GFS Folder)" \InProcServer32\(Default) = "C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll" [MS] "{AB5C5600-7E6E-4B06-9197-9ECEF74D31CC}" = "Groove Explorer Icon Overlay 2 (GFS Stub)" -> {HKLM...CLSID} = "Groove Explorer Icon Overlay 2 (GFS Stub)" \InProcServer32\(Default) = "C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll" [MS] "{2916C86E-86A6-43FE-8112-43ABE6BF8DCC}" = "Groove Explorer Icon Overlay 4 (GFS Unread Mark)" -> {HKLM...CLSID} = "Groove Explorer Icon Overlay 4 (GFS Unread Mark)" \InProcServer32\(Default) = "C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll" [MS] "{99FD978C-D287-4F50-827F-B2C658EDA8E7}" = "Groove Explorer Icon Overlay 1 (GFS Unread Stub)" -> {HKLM...CLSID} = "Groove Explorer Icon Overlay 1 (GFS Unread Stub)" \InProcServer32\(Default) = "C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll" [MS] "{920E6DB1-9907-4370-B3A0-BAFC03D81399}" = "Groove Explorer Icon Overlay 2.5 (GFS Unread Folder)" -> {HKLM...CLSID} = "Groove Explorer Icon Overlay 2.5 (GFS Unread Folder)" \InProcServer32\(Default) = "C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll" [MS] "{0006F045-0000-0000-C000-000000000046}" = "Microsoft Office Outlook Custom Icon Handler" -> {HKLM...CLSID} = "Outlook File Icon Extension" \InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\Office12\OLKFSTUB.DLL" [MS] "{00020D75-0000-0000-C000-000000000046}" = "Microsoft Office Outlook Desktop Icon Handler" -> {HKLM...CLSID} = "Microsoft Office Outlook" \InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\Office12\MLSHEXT.DLL" [MS] "{5858A72C-C2B4-4dd7-B2BF-B76DB1BD9F6C}" = "Microsoft Office OneNote Namespace Extension for Windows Desktop Search" -> {HKLM...CLSID} = "Microsoft Office OneNote Namespace Extension for Windows Desktop Search" \InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\Office12\ONFILTER.DLL" [MS] "{42042206-2D85-11D3-8CFF-005004838597}" = "Microsoft Office HTML Icon Handler" -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "C:\Program Files\Microsoft Office\Office12\msohevi.dll" [MS] "{993BE281-6695-4BA5-8A2A-7AACBFAAB69E}" = "Microsoft Office Metadata Handler" -> {HKLM...CLSID} = "Microsoft Office Metadata Handler" \InProcServer32\(Default) = "C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\msoshext.dll" [MS] "{C41662BB-1FA0-4CE0-8DC5-9B7F8279FF97}" = "Microsoft Office Thumbnail Handler" -> {HKLM...CLSID} = "Microsoft Office Thumbnail Handler" \InProcServer32\(Default) = "C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\msoshext.dll" [MS] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\ <<!>> "{B5A7F190-DDA6-4420-B3BA-52453494E6CD}" = "Groove GFS Stub Execution Hook" -> {HKLM...CLSID} = "Groove GFS Stub Execution Hook" \InProcServer32\(Default) = "C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll" [MS] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\ "WPDShServiceObj" = "{AAA288BA-9A4C-45B0-95D7-94D524869DB5}" -> {HKLM...CLSID} = "WPDShServiceObj Class" \InProcServer32\(Default) = "C:\WINDOWS\system32\WPDShServiceObj.dll" [MS] HKLM\SOFTWARE\Classes\PROTOCOLS\Filter\ <<!>> text/xml\CLSID = "{807563E5-5146-11D5-A672-00B0D022E945}" -> {HKLM...CLSID} = "Microsoft Office InfoPath XML Mime Filter" \InProcServer32\(Default) = "C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL" [MS] HKLM\SOFTWARE\Classes\Folder\shellex\ColumnHandlers\ {F9DB5320-233E-11D1-9F84-707F02C10627}\(Default) = "PDF Column Info" -> {HKLM...CLSID} = "PDF Shell Extension" \InProcServer32\(Default) = "C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\PDFShell.dll" ["Adobe Systems, Inc."] HKLM\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\ WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" ["Alexander Roshal"] WinZip\(Default) = "{E0D79304-84BE-11CE-9641-444553540000}" -> {HKLM...CLSID} = "WinZip" \InProcServer32\(Default) = "C:\PROGRA~1\WINZIP\WZSHLSTB.DLL" ["WinZip Computing, S.L."] XXX Groove GFS Context Menu Handler XXX\(Default) = "{6C467336-8281-4E60-8204-430CED96822D}" -> {HKLM...CLSID} = "Groove GFS Context Menu Handler" \InProcServer32\(Default) = "C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll" [MS] HKLM\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\ WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" ["Alexander Roshal"] WinZip\(Default) = "{E0D79304-84BE-11CE-9641-444553540000}" -> {HKLM...CLSID} = "WinZip" \InProcServer32\(Default) = "C:\PROGRA~1\WINZIP\WZSHLSTB.DLL" ["WinZip Computing, S.L."] XXX Groove GFS Context Menu Handler XXX\(Default) = "{6C467336-8281-4E60-8204-430CED96822D}" -> {HKLM...CLSID} = "Groove GFS Context Menu Handler" \InProcServer32\(Default) = "C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll" [MS] HKLM\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\ WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" ["Alexander Roshal"] WinZip\(Default) = "{E0D79304-84BE-11CE-9641-444553540000}" -> {HKLM...CLSID} = "WinZip" \InProcServer32\(Default) = "C:\PROGRA~1\WINZIP\WZSHLSTB.DLL" ["WinZip Computing, S.L."] XXX Groove GFS Context Menu Handler XXX\(Default) = "{6C467336-8281-4E60-8204-430CED96822D}" -> {HKLM...CLSID} = "Groove GFS Context Menu Handler" \InProcServer32\(Default) = "C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll" [MS] HKLM\SOFTWARE\Classes\AllFilesystemObjects\shellex\ContextMenuHandlers\ XXX Groove GFS Context Menu Handler XXX\(Default) = "{6C467336-8281-4E60-8204-430CED96822D}" -> {HKLM...CLSID} = "Groove GFS Context Menu Handler" \InProcServer32\(Default) = "C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll" [MS] Group Policies {GPedit.msc branch and setting}: ----------------------------------------------- Note: detected settings may not have any effect. HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System\ "DisableRegistryTools" = (REG_DWORD) dword:0x00000000 {User Configuration|Administrative Templates|System| Prevent access to registry editing tools} HKCU\Software\Policies\Microsoft\Windows\System\ "DisableCMD" = (REG_DWORD) dword:0x00000000 {User Configuration|Administrative Templates|System| Disable the command prompt} HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ "shutdownwithoutlogon" = (REG_DWORD) dword:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| Shutdown: Allow system to be shut down without having to log on} "undockwithoutlogon" = (REG_DWORD) dword:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| Devices: Allow undock without having to log on} Active Desktop and Wallpaper: ----------------------------- Active Desktop may be disabled at this entry: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState Displayed if Active Desktop enabled and wallpaper not set by Group Policy: HKCU\Software\Microsoft\Internet Explorer\Desktop\General\ "Wallpaper" = "C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp" Displayed if Active Desktop disabled and wallpaper not set by Group Policy: HKCU\Control Panel\Desktop\ "Wallpaper" = "C:\Documents and Settings\SZEWCO\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp" Windows Portable Device AutoPlay Handlers ----------------------------------------- HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers\Handlers\ ACDSee110ImportPicturesOnArrival\ "Provider" = "ACDSee Photo Manager 2009" "InvokeProgID" = "ACDSee 11.0.AutoPlayHandlerImport" "InvokeVerb" = "Import" HKLM\SOFTWARE\Classes\ACDSee 11.0.AutoPlayHandlerImport\shell\Import\command\(Default) = ""C:\Program Files\ACD Systems\ACDSee\11.0\ACDSeeQV11.exe" /detect:%1" ["ACD Systems"] ACDSee110ImportVideoFilesOnArrival\ "Provider" = "ACDSee Photo Manager 2009" "InvokeProgID" = "ACDSee 11.0.AutoPlayHandlerImport" "InvokeVerb" = "Import" HKLM\SOFTWARE\Classes\ACDSee 11.0.AutoPlayHandlerImport\shell\Import\command\(Default) = ""C:\Program Files\ACD Systems\ACDSee\11.0\ACDSeeQV11.exe" /detect:%1" ["ACD Systems"] ACDSee110PlayVideoFilesOnArrival\ "Provider" = "ACDSee Photo Manager 2009" "InvokeProgID" = "ACDSee 11.0.AutoPlayHandler" "InvokeVerb" = "Open" HKLM\SOFTWARE\Classes\ACDSee 11.0.AutoPlayHandler\shell\Open\command\(Default) = ""C:\Program Files\ACD Systems\ACDSee\11.0\ACDSeeQV11.exe" "%1"" ["ACD Systems"] ACDSee110ShowPicturesOnArrival\ "Provider" = "ACDSee Photo Manager 2009" "InvokeProgID" = "ACDSee 11.0.AutoPlayHandler" "InvokeVerb" = "Open" HKLM\SOFTWARE\Classes\ACDSee 11.0.AutoPlayHandler\shell\Open\command\(Default) = ""C:\Program Files\ACD Systems\ACDSee\11.0\ACDSeeQV11.exe" "%1"" ["ACD Systems"] CTPCPlayCDAudioOnArrival\ "Provider" = "@C:\Program Files\Creative\SBLive\PlayCenter2\CTP2res.dll,-114" "InvokeProgID" = "PlayCenter.AudioCD" "InvokeVerb" = "Play" HKLM\SOFTWARE\Classes\PlayCenter.AudioCD\shell\Play\Command\(Default) = "C:\Program Files\Creative\SBLive\PlayCenter2\CTPlay2.exe /PLAYCD %1" ["Creative Technology Ltd."] MSWPDShellNamespaceHandler\ "Provider" = "@%SystemRoot%\system32\wpdshext.dll,-501" "CLSID" = "{A55803CC-4D53-404c-8557-FD63DBA95D24}" "InitCmdLine" = " " -> {HKLM...CLSID} = "WPDShextAutoplay" \LocalServer32\(Default) = "C:\WINDOWS\system32\WPDShextAutoplay.exe" [MS] PDVD9PlayCDAudioOnArrival\ "Provider" = "PowerDVD 9" "InvokeProgID" = "AudioCD" "InvokeVerb" = "PlayWithPowerDVD9" HKLM\SOFTWARE\Classes\AudioCD\shell\PlayWithPowerDVD9\Command\(Default) = ""C:\Program Files\CyberLink\PowerDVD9\PowerDVD9.exe" "%L"" ["CyberLink Corp."] PDVD9PlayDVDMovieOnArrival\ "Provider" = "PowerDVD 9" "InvokeProgID" = "DVD" "InvokeVerb" = "PlayWithPowerDVD9" HKLM\SOFTWARE\Classes\DVD\shell\PlayWithPowerDVD9\Command\(Default) = ""C:\Program Files\CyberLink\PowerDVD9\PDVDLaunchPolicy.exe" "%L"" ["CyberLink Corp."] PDVD9PlayVCDMovieOnArrival\ "Provider" = "PowerDVD 9" "InvokeProgID" = "VCD" "InvokeVerb" = "PlayWithPowerDVD9" HKLM\SOFTWARE\Classes\VCD\shell\PlayWithPowerDVD9\Command\(Default) = ""C:\Program Files\CyberLink\PowerDVD9\PDVDLaunchPolicy.exe" "%L"" ["CyberLink Corp."] WinampMTPHandler\ "Provider" = "Winamp" "ProgID" = "Shell.HWEventHandlerShellExecute" "InitCmdLine" = "C:\Program Files\Winamp\winamp.exe" HKLM\SOFTWARE\Classes\Shell.HWEventHandlerShellExecute\CLSID\(Default) = "{FFB8655F-81B9-4fce-B89C-9A6BA76D13E7}" -> {HKLM...CLSID} = "ShellExecute HW Event Handler" \LocalServer32\(Default) = "rundll32.exe shell32.dll,SHCreateLocalServerRunDll {FFB8655F-81B9-4fce-B89C-9A6BA76D13E7}" [MS] WinampPlayMediaOnArrival\ "Provider" = "Winamp" "InvokeProgID" = "Winamp.File" "InvokeVerb" = "Play" HKLM\SOFTWARE\Classes\Winamp.File\shell\Play\command\(Default) = ""C:\Program Files\Winamp\winamp.exe" "%1"" ["Nullsoft"] HKLM\SOFTWARE\Classes\Winamp.File\shell\Play\DropTarget\CLSID = "{46986115-84D6-459c-8F95-52DD653E532E}" -> {HKLM...CLSID} = (no title provided) \LocalServer32\(Default) = ""C:\Program Files\Winamp\winamp.exe"" ["Nullsoft"] Startup items in "SZEWCO" & "All Users" startup folders: -------------------------------------------------------- C:\Documents and Settings\SZEWCO\Menu Start\Programy\Autostart <<!>> "Save2pc Pro Updater.exe" [null data] C:\Documents and Settings\All Users\Menu Start\Programy\Autostart "Logitech SetPoint" -> shortcut to: "C:\Program Files\Logitech\SetPoint\SetPoint.exe" ["Logitech, Inc."] "Program sieciowy dla SAGEM Wi-Fi 11g USB adapter" -> shortcut to: "C:\Program Files\SAGEM WiFi manager\WLANUTL.exe" [" "] Winsock2 Service Provider DLLs: ------------------------------- Namespace Service Providers HKLM\SYSTEM\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++} 000000000001\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS] 000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS] 000000000003\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS] Transport Service Providers HKLM\SYSTEM\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++} 0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range: %SystemRoot%\system32\mswsock.dll [MS], 01 - 03, 06 - 13 %SystemRoot%\system32\rsvpsp.dll [MS], 04 - 05 Toolbars, Explorer Bars, Extensions: ------------------------------------ Explorer Bars HKLM\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\ HKLM\SOFTWARE\Classes\CLSID\{0B1818A2-EA07-4A55-AF57-1F410EBD21D3}\(Default) = "Favorites Band" Implemented Categories\{00021493-0000-0000-C000-000000000046}\ [vertical bar] InProcServer32\(Default) = "C:\WINDOWS\system32\ieframe.dll" [MS] HKLM\SOFTWARE\Classes\CLSID\{2A541AE1-5BF6-4665-A8A3-CFA9672E4291}\(Default) = "Groove Folder Synchronization" Implemented Categories\{00021493-0000-0000-C000-000000000046}\ [vertical bar] InProcServer32\(Default) = "C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll" [MS] HKLM\SOFTWARE\Classes\CLSID\{9405EDEF-0848-4181-9F7A-88C763D4A67C}\(Default) = "History Band" Implemented Categories\{00021493-0000-0000-C000-000000000046}\ [vertical bar] InProcServer32\(Default) = "C:\WINDOWS\system32\ieframe.dll" [MS] HKLM\SOFTWARE\Classes\CLSID\{FF059E31-CC5A-4E2E-BF3B-96E929D65503}\(Default) = "&Poszukaj" Implemented Categories\{00021493-0000-0000-C000-000000000046}\ [vertical bar] InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL" [MS] Miscellaneous IE Hijack Points ------------------------------ C:\WINDOWS\INF\IERESET.INF (used to "Reset Web Settings") Added lines (compared with English-language version): [Strings]: START_PAGE_URL="http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome" [Strings]: MS_START_PAGE_URL="http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome" Missing lines (compared with English-language version): [Strings]: 2 lines HKLM\SOFTWARE\Microsoft\Internet Explorer\AboutURLs\ <<H>> "InPrivate" = "res://ieframe.dll/inprivate.htm" [MS] HOSTS file ---------- C:\WINDOWS\System32\drivers\etc\HOSTS maps: 3 domain names to IP addresses, 2 of the IP addresses are *not* localhost! Running Services (Display Name, Service Name, Path {Service DLL}): ------------------------------------------------------------------ Creative Service for CDROM Access, Creative Service for CDROM Access, "C:\WINDOWS\system32\CTsvcCDA.exe" ["Creative Technology Ltd"] Java Quick Starter, JavaQuickStarterService, ""C:\Program Files\Java\jre6\bin\jqs.exe" -service -config "C:\Program Files\Java\jre6\lib\deploy\jqs\jqs.conf"" ["Sun Microsystems, Inc."] Machine Debug Manager, MDM, ""C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe"" [MS] NVIDIA Display Driver Service, NVSvc, "C:\WINDOWS\system32\nvsvc32.exe" ["NVIDIA Corporation"] ServiceLayer, ServiceLayer, ""C:\Program Files\PC Connectivity Solution\ServiceLayer.exe"" ["Nokia."] Windows Driver Foundation - User-mode Driver Framework, WudfSvc, "C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup" {"C:\WINDOWS\System32\WUDFSvc.dll" [MS]} WMDM PMSP Service, WMDM PMSP Service, "C:\WINDOWS\system32\MsPMSPSv.exe" [MS] Print Monitors: --------------- HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors\ Microsoft Document Imaging Writer Monitor\Driver = "mdimon.dll" [MS] Send To Microsoft OneNote Monitor\Driver = "msonpmon.dll" [MS] ---------- (launch time: 2009-07-29 16:17:27) <<!>>: Suspicious data at a malware launch point. <<H>>: Suspicious data at a browser hijack point. + This report excludes default entries except where indicated. + To see *everywhere* the script checks and *everything* it finds, launch it from a command prompt or a shortcut with the -all parameter. + To search all directories of local fixed drives for DESKTOP.INI DLL launch points, use the -supp parameter or answer "No" at the first message box and "Yes" at the second message box. ---------- (total run time: 57 seconds, including 19 seconds for message boxes)

Prosze o pomoc :]

**Posty:** 18165 · przez **wojtas** 29 Lip 2009, 19:56

Pobierz OTL i daj z niego loga

**Posty:** 84 · przez **zooo** 29 Lip 2009, 21:17

wyskoczylo mi 2 pliki .txt Extas i OTL ktory wstawic? i OTL ma za duzo znakow

Dodano 29.07.2009 20:58:43:
Tu jest log:
http://wklej.org/id/127877/

**Posty:** 18165 · przez **wojtas** 01 Sie 2009, 14:00

Uruchom OTL i w oknie Custom Scans/Fixes wklej :

:OTL
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O1 - Hosts: 72.232.248.222 nprotect.battlelands.net
O1 - Hosts: 69.80.225.31 nprotect.ryl.com.my
F3 - HKCU WinNT: Load - (C:\WINDOWS\svchost.exe) - C:\WINDOWS\svchost.exe ()
O20 - Winlogon\Notify\VMApplet: DllName - Reg Error: Key error. - Reg Error: Key error. File not found
O32 - AutoRun File - [2009-07-25 10:12:42 | 00,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O32 - AutoRun File - [2006-05-09 19:36:18 | 00,000,034 | RHS- | M] () - C:\autorun.inf -- [ NTFS ]
O32 - AutoRun File - [2006-05-09 19:36:18 | 00,000,034 | RHS- | M] () - D:\autorun.inf -- [ NTFS ]
O32 - AutoRun File - [2006-05-09 19:36:18 | 00,000,034 | RHS- | M] () - E:\autorun.inf -- [ NTFS ]

:Files
C:\host.exe
C:\copy.exe
C:\autorun.inf
d:\host.exe
d:\copy.exe
d:\autorun.inf
e:\host.exe
e:\copy.exe
e:\autorun.inf
C:\WINDOWS\svchost.exe
C:\WINDOWS\xcopy.exe
C:\WINDOWS\autorun.inf
C:\WINDOWS\temp.exe
C:\WINDOWS\system.exe

:Reg
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{db1b3e60-05ac-11de-a5d3-00001cd72a97}]
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
"SuperHidden"=dword:00000001
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
"Hidden"=dword:00000001
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
"ShowSuperHidden"=dword:00000001
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL]
"CheckedValue"=dword:00000001
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\SuperHidden\Policy\DontShowSuperHidden]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\SuperHidden\Policy\DontShowSuperHidden]
@=""

:Commands
[emptytemp]
[start explorer]
[Reboot]

Kliknij w Run Fix. I potwierdz reset kompa .

Następnie uruchamiasz OTL z opcją Run Scan. Pokazujesz nowy log OTL.txt oraz raport z czyszczenia kompa

**Posty:** 84 · przez **zooo** 03 Sie 2009, 20:39

Witam!!! Sorka nie bylo mnie, mialem wypad za miasto ale juz jestem.
1. Nowy log z OTL:
http://wklej.org/id/129972/
2. Raport z czyszczenia kompa:

Kod: Zaznacz wszystko: All processes killed ========== OTL ========== No active process named explorer.exe was found! 72.232.248.222 nprotect.battlelands.net removed from HOSTS file successfully 69.80.225.31 nprotect.ryl.com.my removed from HOSTS file successfully File (C:\WINDOWS\svchost.exe) - C:\WINDOWS\svchost.exe not found. Registry key HEKY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\VMApplet\ not found. C:\AUTOEXEC.BAT moved successfully. File C:\autorun.inf not found. File D:\autorun.inf not found. File E:\autorun.inf not found. ========== FILES ========== File\Folder C:\host.exe not found. File\Folder C:\copy.exe not found. Folder move failed. C:\autorun.inf scheduled to be moved on reboot. File\Folder d:\host.exe not found. File\Folder d:\copy.exe not found. Folder move failed. d:\autorun.inf scheduled to be moved on reboot. File\Folder e:\host.exe not found. File\Folder e:\copy.exe not found. Folder move failed. e:\autorun.inf scheduled to be moved on reboot. File\Folder C:\WINDOWS\svchost.exe not found. File\Folder C:\WINDOWS\xcopy.exe not found. File\Folder C:\WINDOWS\autorun.inf not found. C:\WINDOWS\temp.exe moved successfully. C:\WINDOWS\system.exe moved successfully. ========== REGISTRY ========== Registry key HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{db1b3e60-05ac-11de-a5d3-00001cd72a97}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{db1b3e60-05ac-11de-a5d3-00001cd72a97}\ not found. HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\\"SuperHidden"|dword:00000001 /E : value set successfully! HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\\"Hidden"|dword:00000001 /E : value set successfully! HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\\"ShowSuperHidden"|dword:00000001 /E : value set successfully! HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL\\"CheckedValue"|dword:00000001 /E : value set successfully! Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\SuperHidden\Policy\DontShowSuperHidden\ deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\SuperHidden\Policy\DontShowSuperHidden\\@|"" /E : value set successfully! ========== COMMANDS ========== [EMPTYTEMP] User: All Users User: Default User ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 67 bytes User: LocalService ->Temp folder emptied: 0 bytes File delete failed. C:\Documents and Settings\LocalService\Ustawienia lokalne\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot. ->Temporary Internet Files folder emptied: 32902 bytes User: NetworkService ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 67 bytes User: SZEWCO ->Temp folder emptied: 95044577 bytes ->Temporary Internet Files folder emptied: 2367741 bytes ->Java cache emptied: 13598415 bytes ->FireFox cache emptied: 49356991 bytes %systemdrive% .tmp files removed: 0 bytes %systemroot% .tmp files removed: 2134153 bytes %systemroot%\System32 .tmp files removed: 2596 bytes Windows Temp folder emptied: 0 bytes RecycleBin emptied: 0 bytes Total Files Cleaned = 155,01 mb OTL by OldTimer - Version 3.0.10.3 log created on 08032009_201047 Files\Folders moved on Reboot... Folder move failed. C:\autorun.inf scheduled to be moved on reboot. Folder move failed. d:\autorun.inf scheduled to be moved on reboot. Folder move failed. e:\autorun.inf scheduled to be moved on reboot. Registry entries deleted on Reboot...

**Posty:** 8001 · przez **Okocza** 03 Sie 2009, 21:41

zooo, daj log z RSIT

**Posty:** 84 · przez **zooo** 05 Sie 2009, 15:49

Proszę bardzo log z RSIT

http://www.wklej.org/id/130913/

**Posty:** 8001 · przez **Okocza** 05 Sie 2009, 15:56

zooo, masz infekcję goldun. zastosuj program haxfix

specjalne-narzedzia-czyszczace-vt96631.html

z opcji 2 i wróć z logiem z RSIT

**Posty:** 84 · przez **zooo** 05 Sie 2009, 19:24

Prosze bardzo log po haxfix-ie:
http://wklej.org/id/131032/

**Posty:** 8001 · przez **Okocza** 05 Sie 2009, 20:41

po dobroci nie chce, to usuniemy go inaczej...

otwórz noatnik i wklej:

Kod: Zaznacz wszystko: Files:: C:\WINDOWS\PEV.exe C:\autorun.inf Registry:: [-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\rbadza.sys] [-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\rbadza.sys]

zapisz jako cfscript.txt i przeciagnij na combofix.exe

wróć z logiem

wejdź w start - uruchom - cmd

wpisz

sc stop rbadza
sc delete rbadza

**Posty:** 84 · przez **zooo** 06 Sie 2009, 17:33

jezeli chodzi o log z combofix-a to prosze bardzo:

Kod: Zaznacz wszystko: ComboFix 09-08-04.04 - SZEWCO 2009-08-06 17:14.1.1 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.3.1250.48.1045.18.1023.681 [GMT 2:00] Uruchomiony z: c:\documents and settings\SZEWCO\Pulpit\ComboFix.exe Użyto następujących komend :: c:\documents and settings\SZEWCO\Pulpit\cfscript.txt * Utworzono nowy punkt przywracania UWAGA - TEN KOMPUTER NIE MA ZAINSTALOWANEJ KONSOLI ODZYSKIWANIA !! . ((((((((((((((((((((((((((((((((((((((( Usunięto ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\kmd.exe c:\windows\system32\drivers\mrxdavv.sys c:\windows\system32\kwave.sys . ((((((((((((((((((((((((( Pliki utworzone od 2009-07-06 do 2009-08-06 ))))))))))))))))))))))))))))))) . 2009-08-05 15:16 . 2009-08-05 15:15 518030 ----a-w- C:\HaxFix.exe 2009-08-05 13:58 . 2009-08-05 14:01 -------- d-----w- c:\documents and settings\All Users\Dane aplikacji\GARMIN 2009-08-05 13:58 . 2009-08-05 14:01 -------- d-----w- c:\documents and settings\SZEWCO\Dane aplikacji\GARMIN 2009-08-05 13:46 . 2009-08-05 13:47 -------- d-----w- C:\rsit 2009-08-02 21:38 . 2009-08-02 21:38 24500120 ----a-w- c:\documents and settings\All Users\Dane aplikacji\Installations\{F983B4FE-547B-4C44-BAF7-4F4DBA93D548}\NokiaSoftwareUpdaterSetup_en_us.exe 2009-08-02 21:38 . 2009-08-02 21:38 3351812 ----a-w- c:\documents and settings\All Users\Dane aplikacji\Installations\{F983B4FE-547B-4C44-BAF7-4F4DBA93D548}\Installer\CommonCustomActions\msxml6Exec.exe 2009-08-02 21:38 . 2009-08-02 21:38 36864 ----a-w- c:\documents and settings\All Users\Dane aplikacji\Installations\{F983B4FE-547B-4C44-BAF7-4F4DBA93D548}\Installer\CommonCustomActions\Sleep.exe 2009-08-02 21:38 . 2009-08-02 21:38 3181612 ----a-w- c:\documents and settings\All Users\Dane aplikacji\Installations\{F983B4FE-547B-4C44-BAF7-4F4DBA93D548}\Installer\CommonCustomActions\vcredistExec.exe 2009-08-02 21:14 . 2009-08-02 21:14 -------- d-----w- c:\documents and settings\All Users\Dane aplikacji\Nokia 2009-08-02 21:13 . 2009-08-02 21:13 -------- d-----w- c:\program files\MSXML 6.0 2009-07-31 14:52 . 2009-07-31 14:52 -------- d-----w- c:\documents and settings\SZEWCO\Ustawienia lokalne\Dane aplikacji\Ahead 2009-07-31 14:48 . 2009-07-31 14:48 -------- d-----w- c:\documents and settings\SZEWCO\Dane aplikacji\Ahead 2009-07-31 14:45 . 2009-07-31 14:45 -------- d-----w- c:\program files\Nero 2009-07-31 14:45 . 2009-07-31 14:45 -------- d-----w- c:\program files\Common Files\Ahead 2009-07-31 14:43 . 2009-07-31 14:43 -------- d-----w- c:\documents and settings\All Users\Dane aplikacji\DAEMON Tools Lite 2009-07-31 14:42 . 2009-07-31 14:42 -------- d-----w- c:\program files\DAEMON Tools Toolbar 2009-07-31 14:42 . 2009-07-31 14:42 -------- d-----w- c:\program files\DAEMON Tools Lite 2009-07-31 14:40 . 2009-07-31 14:40 721904 ----a-w- c:\windows\system32\drivers\sptd.sys 2009-07-31 14:40 . 2009-08-03 15:26 -------- d-----w- c:\documents and settings\SZEWCO\Dane aplikacji\DAEMON Tools Lite 2009-07-31 14:35 . 2009-07-31 14:35 -------- d-----w- c:\program files\DAEMON Tools 2009-07-31 14:21 . 2009-07-31 20:52 -------- d-----w- c:\documents and settings\SZEWCO\Ustawienia lokalne\Dane aplikacji\Autodesk 2009-07-31 14:21 . 2009-07-31 20:52 -------- d-----w- c:\documents and settings\All Users\Dane aplikacji\Autodesk 2009-07-31 14:21 . 2009-07-31 14:25 -------- d-----w- c:\program files\AutoCAD 2009 2009-07-31 14:19 . 2007-07-19 16:14 3727720 ----a-w- c:\windows\system32\d3dx9_35.dll 2009-07-31 14:18 . 2009-07-31 20:52 -------- d-----w- c:\documents and settings\SZEWCO\Dane aplikacji\Autodesk 2009-07-31 14:18 . 2009-07-31 14:26 -------- d-----w- c:\program files\Common Files\Autodesk Shared 2009-07-31 14:18 . 2009-07-31 14:18 -------- d-----w- c:\program files\Autodesk 2009-07-30 20:13 . 2009-07-30 20:13 -------- d-----w- C:\Autodesk 2009-07-30 17:12 . 2009-07-30 17:13 -------- d-----w- c:\documents and settings\SZEWCO\Ustawienia lokalne\Dane aplikacji\Adobe 2009-07-29 14:10 . 2009-07-29 14:10 -------- d-----w- c:\program files\Trend Micro 2009-07-27 19:58 . 2009-07-27 19:58 8416 ----a-w- c:\windows\system32\ZDPNDIS5.SYS 2009-07-27 19:58 . 2009-07-27 19:58 8416 ----a-w- c:\windows\system32\ZDCndis5.SYS 2009-07-27 19:58 . 2009-07-27 19:58 8416 ----a-w- c:\windows\system32\PCANDIS5.SYS 2009-07-27 11:18 . 2009-07-27 11:18 152576 ----a-w- c:\documents and settings\SZEWCO\Dane aplikacji\Sun\Java\jre1.6.0_14\lzma.dll 2009-07-27 00:34 . 2004-12-29 00:43 4682 ----a-w- c:\windows\system32\npptNT2.sys 2009-07-27 00:33 . 2009-07-27 00:33 -------- d-----w- c:\program files\Common Files\INCA Shared 2009-07-27 00:19 . 2009-07-27 00:19 -------- d-----w- c:\program files\directx 2009-07-27 00:11 . 2009-07-27 00:11 -------- d-----w- c:\program files\YouxiLand 2009-07-26 22:40 . 2009-07-26 22:48 -------- d-----w- c:\documents and settings\All Users\Dane aplikacji\NCH Swift Sound 2009-07-26 22:40 . 2009-07-26 22:40 -------- d-----w- c:\documents and settings\SZEWCO\Dane aplikacji\NCH Swift Sound 2009-07-26 22:40 . 2009-07-26 22:40 -------- d-----w- c:\program files\NCH Software 2009-07-26 22:40 . 2009-07-26 22:54 -------- d-----w- c:\program files\NCH Swift Sound 2009-07-26 22:01 . 2009-07-26 22:01 -------- d-----w- c:\program files\TSO 2009-07-26 22:00 . 2009-07-26 22:00 -------- d-----w- c:\documents and settings\SZEWCO\Dane aplikacji\teamspeak2 2009-07-26 22:00 . 2009-07-26 22:00 -------- d-----w- c:\program files\Teamspeak2_RC2 2009-07-26 09:56 . 2009-07-26 10:10 -------- d-----w- c:\program files\SkanerOnline 2009-07-26 09:45 . 2009-07-26 09:45 -------- d-----w- c:\documents and settings\SZEWCO\Ustawienia lokalne\Dane aplikacji\ACD Systems 2009-07-26 09:45 . 2009-07-26 09:45 -------- d-----w- c:\documents and settings\SZEWCO\Dane aplikacji\ACD Systems 2009-07-26 08:03 . 2009-07-26 08:03 -------- d-----w- c:\windows\Sun 2009-07-26 07:10 . 2009-07-26 07:12 -------- d-----w- c:\program files\English Translator 3 2009-07-26 07:08 . 2009-07-26 07:08 -------- d-----w- c:\program files\ToniArts 2009-07-26 07:03 . 2009-07-26 07:03 -------- d-----w- c:\documents and settings\SZEWCO\Dane aplikacji\Media Player Classic 2009-07-26 06:54 . 2009-07-26 06:57 -------- d-----w- c:\documents and settings\SZEWCO\Dane aplikacji\Winamp 2009-07-26 06:54 . 2009-07-26 06:54 -------- d-----w- c:\program files\Winamp 2009-07-26 06:51 . 2009-07-26 06:51 -------- d-----w- c:\program files\FDRLab 2009-07-26 06:49 . 2009-07-26 06:49 -------- d-----w- c:\program files\Common Files\Adobe 2009-07-26 06:49 . 2009-07-26 06:49 -------- d-----w- c:\documents and settings\SZEWCO\Dane aplikacji\DivX 2009-07-26 06:47 . 2009-07-26 06:47 -------- d-----w- c:\documents and settings\All Users\Dane aplikacji\ACD Systems 2009-07-26 06:47 . 2009-07-26 06:47 -------- d-----w- c:\program files\Common Files\ACD Systems 2009-07-26 06:47 . 2009-07-26 06:47 -------- d-----w- c:\program files\ACD Systems 2009-07-26 06:46 . 2009-07-26 06:46 -------- d-----w- c:\documents and settings\SZEWCO\Ustawienia lokalne\Dane aplikacji\Downloaded Installations 2009-07-26 06:40 . 2007-09-20 11:04 114688 ----a-w- c:\windows\system32\BTCamVideoSource.dll 2009-07-26 06:40 . 2009-07-26 06:41 -------- d-----w- c:\program files\Mobiola Web Camera for S60 2009-07-25 13:33 . 2009-07-25 13:33 -------- d-----w- c:\program files\Switch Off 2009-07-25 13:19 . 2006-10-26 17:58 30512 ----a-w- c:\windows\system32\mdimon.dll 2009-07-25 13:19 . 2006-10-26 17:56 32592 ----a-w- c:\windows\system32\msonpmon.dll 2009-07-25 13:15 . 2009-07-25 13:15 -------- d-----w- c:\program files\Microsoft Works 2009-07-25 13:13 . 2009-07-25 13:13 -------- d-----w- c:\program files\Microsoft.NET 2009-07-25 13:10 . 2009-07-25 13:14 -------- d-----w- c:\windows\SHELLNEW 2009-07-25 13:09 . 2009-07-25 13:09 -------- d--h--r- C:\MSOCache 2009-07-25 13:07 . 2009-07-25 13:07 -------- d-----w- c:\documents and settings\SZEWCO\Ustawienia lokalne\Dane aplikacji\PowerDVDCox 2009-07-25 13:06 . 2009-07-25 13:06 -------- d-----w- c:\documents and settings\SZEWCO\Ustawienia lokalne\Dane aplikacji\PowerDVDCinema 2009-07-25 13:06 . 2009-07-25 13:07 -------- d-----w- c:\documents and settings\SZEWCO\Dane aplikacji\CyberLink 2009-07-25 13:06 . 2009-07-25 13:07 -------- d-----w- c:\documents and settings\All Users\Dane aplikacji\CyberLink 2009-07-25 13:05 . 2009-07-25 13:05 -------- d-----w- c:\program files\Common Files\CyberLink 2009-07-25 13:04 . 2009-07-25 13:05 -------- d-----w- c:\program files\CyberLink 2009-07-25 13:02 . 2009-07-25 13:04 29480 ----a-w- c:\windows\system32\msxml3a.dll 2009-07-25 13:02 . 2009-07-25 13:04 53319 ----a-w- c:\documents and settings\All Users\Dane aplikacji\Temp\{A8516AC9-AAF1-47F9-9766-03E2D4CDBCF8}\PostBuild.exe 2009-07-25 13:02 . 2009-07-25 13:02 -------- d-----w- c:\documents and settings\All Users\Dane aplikacji\Temp 2009-07-25 13:01 . 2009-07-25 13:01 -------- d-----w- C:\IDE 2009-07-25 13:01 . 2009-07-25 13:02 -------- d-----w- c:\program files\Microsoft Visual Studio 8 2009-07-25 12:59 . 2009-07-25 12:59 -------- d-----w- c:\documents and settings\SZEWCO\Ustawienia lokalne\Dane aplikacji\Microsoft Help 2009-07-25 12:58 . 2009-07-25 13:32 -------- d-----w- c:\documents and settings\All Users\Dane aplikacji\Microsoft Help 2009-07-25 12:55 . 2009-07-25 12:55 -------- d-----w- c:\documents and settings\SZEWCO\Dane aplikacji\Logitech 2009-07-25 12:49 . 2009-07-25 12:49 -------- d-----w- c:\documents and settings\All Users\Dane aplikacji\LogiShrd 2009-07-25 12:48 . 2008-09-26 07:52 10384 ----a-w- c:\windows\system32\drivers\LBeepKE.sys 2009-07-25 12:48 . 2009-02-18 22:26 301656 ----a-w- c:\windows\system32\BtCoreIf.dll 2009-07-25 12:48 . 2009-02-18 22:27 84496 ----a-w- c:\windows\system32\KemXML.dll 2009-07-25 12:48 . 2009-02-18 22:27 117264 ----a-w- c:\windows\system32\KemWnd.dll 2009-07-25 12:48 . 2009-02-18 22:27 145936 ----a-w- c:\windows\system32\KemUtil.dll 2009-07-25 12:48 . 2009-02-18 22:27 170512 ----a-w- c:\windows\system32\kemutb.dll 2009-07-25 12:47 . 2009-07-25 12:47 -------- d-----w- c:\documents and settings\All Users\Dane aplikacji\Logitech 2009-07-25 12:47 . 2009-07-25 12:48 -------- d-----w- c:\program files\Common Files\Logishrd 2009-07-25 12:47 . 2009-07-25 12:47 -------- d-----w- c:\program files\Logitech 2009-07-25 12:13 . 2009-08-03 19:07 -------- d-----w- c:\program files\SD EnterNET 2009-07-25 12:02 . 2009-07-25 12:02 -------- d-----w- C:\totalcmd 2009-07-25 12:02 . 2008-07-29 05:04 545 ----a-w- c:\windows\UC.PIF 2009-07-25 12:02 . 2008-07-29 05:04 545 ----a-w- c:\windows\RAR.PIF 2009-07-25 12:02 . 2008-07-29 05:04 545 ----a-w- c:\windows\PKZIP.PIF 2009-07-25 12:02 . 2008-07-29 05:04 545 ----a-w- c:\windows\PKUNZIP.PIF 2009-07-25 12:02 . 2008-07-29 05:04 545 ----a-w- c:\windows\NOCLOSE.PIF 2009-07-25 12:02 . 2008-07-29 05:04 545 ----a-w- c:\windows\LHA.PIF 2009-07-25 12:02 . 2008-07-29 05:04 545 ----a-w- c:\windows\ARJ.PIF 2009-07-25 11:52 . 2006-12-14 00:21 231424 ----a-w- c:\windows\system32\ConnAPI.dll 2009-07-25 10:47 . 2009-07-31 14:27 101248 ----a-w- c:\documents and settings\SZEWCO\Ustawienia lokalne\Dane aplikacji\GDIPFONTCACHEV1.DAT 2009-07-25 10:19 . 2009-07-25 10:19 -------- d-----w- c:\windows\system32\LogFiles 2009-07-25 10:18 . 2008-04-13 22:15 26112 -c--a-w- c:\windows\system32\dllcache\usbser.sys 2009-07-25 10:18 . 2008-04-13 22:15 26112 ----a-w- c:\windows\system32\drivers\usbser.sys 2009-07-25 10:18 . 2008-03-21 11:57 14640 ------w- c:\windows\system32\spmsgXP_2k3.dll 2009-07-25 10:17 . 2009-02-09 06:37 659968 ----a-w- c:\windows\system32\nmwcdcocls.dll 2009-07-25 10:17 . 2009-02-09 06:37 91136 ----a-w- c:\windows\system32\nmwcdcls.dll 2009-07-25 10:17 . 2009-02-09 06:37 17664 ----a-w- c:\windows\system32\drivers\ccdcmb.sys 2009-07-25 10:17 . 2009-02-09 06:32 1112288 ----a-w- c:\windows\system32\wdfcoinstaller01007.dll 2009-07-25 10:17 . 2009-08-02 21:38 -------- d-----w- c:\program files\Nokia 2009-07-25 10:17 . 2009-07-22 16:02 33984304 ----a-w- c:\documents and settings\All Users\Dane aplikacji\Installations\{3D39E775-DDDA-4327-B747-0BDC5F191331}\Nokia_PC_Suite_7_1_30_9_pol_web.exe 2009-07-25 10:17 . 2009-07-25 10:17 95232 ----a-w- c:\documents and settings\All Users\Dane aplikacji\Installations\{3D39E775-DDDA-4327-B747-0BDC5F191331}\Installer\CommonCustomActions\pcswpcsi.exe 2009-07-25 10:17 . 2009-07-25 10:17 8192 ----a-w- c:\documents and settings\All Users\Dane aplikacji\Installations\{3D39E775-DDDA-4327-B747-0BDC5F191331}\Installer\CommonCustomActions\UninstCCD.exe 2009-07-25 10:17 . 2009-07-25 10:17 61440 ----a-w- c:\documents and settings\All Users\Dane aplikacji\Installations\{3D39E775-DDDA-4327-B747-0BDC5F191331}\Installer\CommonCustomActions\UninstPCSFEMsi.exe 2009-07-25 10:17 . 2009-07-25 10:17 10240 ----a-w- c:\documents and settings\All Users\Dane aplikacji\Installations\{3D39E775-DDDA-4327-B747-0BDC5F191331}\Installer\CommonCustomActions\UninstPCS.exe 2009-07-25 10:16 . 2009-08-02 21:39 -------- d-----w- c:\documents and settings\All Users\Dane aplikacji\Installations 2009-07-25 10:15 . 2009-07-25 10:15 56 ---ha-w- c:\windows\system32\ezsidmv.dat 2009-07-25 10:15 . 2009-07-25 10:15 -------- d-----w- c:\documents and settings\SZEWCO\Dane aplikacji\skypePM 2009-07-25 10:14 . 2009-07-25 12:47 -------- d-----w- c:\documents and settings\SZEWCO\Dane aplikacji\Skype 2009-07-25 10:14 . 2009-07-25 10:14 -------- d-----w- c:\program files\Common Files\Skype 2009-07-25 10:14 . 2009-07-25 10:14 -------- d-----r- c:\program files\Skype . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-08-06 15:22 . 2009-07-25 08:47 24 ----a-w- c:\windows\system32\DVCStateBkp-{00000001-00000000-00000008-00001102-00000002-80651102}.dat 2009-08-06 15:22 . 2009-07-25 08:47 24 ----a-w- c:\windows\system32\DVCState-{00000001-00000000-00000008-00001102-00000002-80651102}.dat 2009-08-03 19:07 . 2009-07-25 08:24 -------- d--h--w- c:\program files\InstallShield Installation Information 2009-08-02 21:38 . 2009-07-25 10:17 -------- d-----w- c:\program files\Common Files\Nokia 2009-07-31 21:46 . 2009-07-25 09:38 567064 ----a-w- c:\documents and settings\LocalService\Ustawienia lokalne\Dane aplikacji\FontCache3.0.0.0.dat 2009-07-26 06:41 . 2001-10-26 18:15 90202 ----a-w- c:\windows\system32\perfc015.dat 2009-07-26 06:41 . 2001-10-26 18:15 503830 ----a-w- c:\windows\system32\perfh015.dat 2009-07-25 13:14 . 2009-07-25 09:38 -------- d-----w- c:\program files\MSBuild 2009-07-25 13:04 . 2009-07-25 08:49 505128 ----a-w- c:\windows\system32\msvcp71.dll 2009-07-25 13:04 . 2009-07-25 08:49 353576 ----a-w- c:\windows\system32\msvcr71.dll 2009-07-25 12:48 . 2009-07-25 12:48 0 ---ha-w- c:\windows\system32\drivers\Msft_Kernel_LMouFilt_01005.Wdf 2009-07-25 12:48 . 2009-07-25 12:48 0 ---ha-w- c:\windows\system32\drivers\Msft_Kernel_LHidFilt_01005.Wdf 2009-07-25 12:48 . 2009-07-25 12:48 0 ---ha-w- c:\windows\system32\drivers\Msft_Kernel_LUsbFilt_01005.Wdf 2009-07-25 10:19 . 2009-07-25 10:19 0 ---ha-w- c:\windows\system32\drivers\Msft_User_PCCSWpdDriver_01_07_00.Wdf 2009-07-25 10:19 . 2009-07-25 10:19 0 ---ha-w- c:\windows\system32\drivers\MsftWdf_user_01_07_00.Wdf 2009-07-25 10:19 . 2009-07-25 10:18 -------- d-----w- c:\documents and settings\SZEWCO\Dane aplikacji\PC Suite 2009-07-25 10:19 . 2009-07-25 10:18 -------- d-----w- c:\documents and settings\SZEWCO\Dane aplikacji\Nokia 2009-07-25 10:18 . 2009-07-25 10:18 -------- d-----w- c:\documents and settings\All Users\Dane aplikacji\PC Suite 2009-07-25 10:18 . 2009-07-25 10:18 0 ---ha-w- c:\windows\system32\drivers\Msft_Kernel_ccdcmb_01007.Wdf 2009-07-25 10:18 . 2009-07-25 10:18 0 ---ha-w- c:\windows\system32\drivers\MsftWdf_Kernel_01007_Coinstaller_Critical.Wdf 2009-07-25 10:18 . 2009-07-25 10:17 -------- d-----w- c:\program files\DIFX 2009-07-25 10:17 . 2009-07-25 10:17 -------- d-----w- c:\program files\Common Files\PCSuite 2009-07-25 10:17 . 2009-07-25 10:17 -------- d-----w- c:\program files\PC Connectivity Solution 2009-07-25 09:59 . 2009-07-25 09:58 -------- d-----w- c:\program files\SubEdit-Player 2009-07-25 09:58 . 2009-07-25 09:58 -------- d-----w- c:\program files\AC3Filter 2009-07-25 09:58 . 2009-07-25 09:58 28672 ----a-r- c:\documents and settings\SZEWCO\Dane aplikacji\Microsoft\Installer\{A05BE20E-6510-44BC-95ED-6E6D730407D3}\_CA18F2C35CF8_400D_9D49_6D74AFB2D0CC.exe 2009-07-25 09:58 . 2009-07-25 09:58 -------- d-----w- c:\program files\Vplayer 2009-07-25 09:58 . 2009-07-25 09:58 -------- d-----w- c:\program files\XviD 2009-07-25 09:58 . 2009-07-25 09:58 -------- d-----w- c:\program files\ffdshow 2009-07-25 09:57 . 2009-07-25 09:57 -------- d-----w- c:\program files\DivX 2009-07-25 09:43 . 2009-07-25 09:43 -------- d-----w- c:\documents and settings\All Users\Dane aplikacji\nView_Profiles 2009-07-25 09:43 . 2009-07-25 09:43 -------- d-----w- c:\documents and settings\All Users\Dane aplikacji\NVIDIA 2009-07-25 09:37 . 2009-07-25 09:37 -------- d-----w- c:\program files\Reference Assemblies 2009-07-25 09:21 . 2009-07-25 08:11 86327 ----a-w- c:\windows\pchealth\helpctr\OfflineCache\index.dat 2009-07-25 09:04 . 2009-07-25 09:04 0 ----a-w- c:\windows\nsreg.dat 2009-07-25 08:58 . 2009-07-25 08:58 -------- d-----w- c:\program files\nsp 2009-07-25 08:57 . 2009-07-25 08:57 -------- d-----w- c:\program files\Sun 2009-07-25 08:56 . 2009-07-25 08:54 -------- d-----w- c:\program files\Java 2009-07-25 08:54 . 2009-07-25 08:54 410984 ----a-w- c:\windows\system32\deploytk.dll 2009-07-25 08:43 . 2009-07-25 08:43 -------- d-----w- c:\program files\SAGEM WiFi manager 2009-07-25 08:43 . 2009-07-25 08:43 -------- d-----w- c:\program files\SAGEM 2009-07-25 08:37 . 2009-07-25 08:22 -------- d-----w- c:\program files\Creative 2009-07-25 08:32 . 2009-07-25 08:32 2232 ----a-w- c:\windows\java\Packages\Data\NTB1VNT3.DAT 2009-07-25 08:32 . 2009-07-25 08:32 155995 ----a-w- c:\windows\java\Packages\SNB1F5VL.ZIP 2009-07-25 08:32 . 2009-07-25 08:32 2678 ----a-w- c:\windows\java\Packages\Data\HJLFPRJ9.DAT 2009-07-25 08:31 . 2009-07-25 08:31 2678 ----a-w- c:\windows\java\Packages\Data\66NBHZXJ.DAT 2009-07-25 08:31 . 2009-07-25 08:31 2678 ----a-w- c:\windows\java\Packages\Data\LFNB9JVX.DAT 2009-07-25 08:31 . 2009-07-25 08:31 2678 ----a-w- c:\windows\java\Packages\Data\AWWOO137.DAT 2009-07-25 08:31 . 2009-07-25 08:31 2678 ----a-w- c:\windows\java\Packages\Data\2F3Z9NBB.DAT 2009-07-25 08:25 . 2009-07-25 08:22 -------- d-----w- c:\program files\Common Files\InstallShield 2009-07-25 08:25 . 2009-07-25 08:25 -------- d-----w- c:\documents and settings\All Users\Dane aplikacji\Creative 2009-07-25 08:13 . 2009-07-25 08:13 -------- d-----w- c:\program files\microsoft frontpage 2009-07-25 08:11 . 2009-07-25 08:11 -------- d-----w- c:\program files\Usługi online 2009-07-25 08:09 . 2009-07-25 08:09 21856 ----a-w- c:\windows\system32\emptyregdb.dat 2009-07-14 09:19 . 2009-07-14 09:19 42088 ----a-w- c:\documents and settings\SZEWCO\Dane aplikacji\Nowe Gadu-Gadu\_userdata\ggbho.1.dll 2009-07-14 08:40 . 2009-07-14 08:40 11264 ----a-w- c:\documents and settings\SZEWCO\Dane aplikacji\Nowe Gadu-Gadu\_userdata\npgg.1.dll 2009-06-02 16:11 . 2009-07-25 09:58 85504 ----a-w- c:\windows\system32\ff_vfw.dll 2009-05-11 10:47 . 2009-05-11 10:47 1302600 ----a-w- c:\windows\system32\WUDFUpdate_01007.dll . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "PC Suite Tray"="c:\program files\Nokia\Nokia PC Suite 7\PCSuite.exe" [2009-06-25 1414144] "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Ahead\lib\NMBgMonitor.exe" [2005-09-08 94208] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-11-17 7700480] "UpdReg"="c:\windows\UpdReg.EXE" [2000-05-10 90112] "Jet Detection"="c:\program files\Creative\SBLive\PROGRAM\ADGJDet.exe" [2001-11-28 28672] "CTStartup"="c:\program files\Creative\Splash Screen\CTEaxSpl.EXE" [2001-12-19 28672] "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-07-25 148888] "RemoteControl9"="c:\program files\CyberLink\PowerDVD9\PDVD9Serv.exe" [2009-02-16 87336] "PDVD9LanguageShortcut"="c:\program files\CyberLink\PowerDVD9\Language\Language.exe" [2008-10-13 50472] "BDRegion"="c:\program files\Cyberlink\Shared Files\brs.exe" [2009-02-28 75048] "GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2007-08-24 33648] "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696] "NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648] "nwiz"="nwiz.exe" - c:\windows\system32\nwiz.exe [2006-11-17 1622016] "NvMediaCenter"="NvMCTray.dll" - c:\windows\system32\nvmctray.dll [2006-11-17 86016] "WINDVDPatch"="CTHELPER.EXE" - c:\windows\system32\CTHELPER.EXE [2002-07-02 24576] "Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" - c:\windows\KHALMNPR.Exe [2008-12-18 76304] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360] c:\documents and settings\SZEWCO\Menu Start\Programy\Autostart\ Save2pc Pro Updater.exe [2009-7-26 46275] c:\documents and settings\All Users\Menu Start\Programy\Autostart\ Logitech SetPoint.lnk - c:\program files\Logitech\SetPoint\SetPoint.exe [2009-7-25 809488] Program sieciowy dla SAGEM Wi-Fi 11g USB adapter.lnk - c:\program files\SAGEM WiFi manager\WLANUTL.exe [2009-7-25 925696] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LBTWlgn] 2009-02-18 22:30 72208 ----a-w- c:\program files\Common Files\Logishrd\Bluetooth\LBTWLgn.dll [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys] @="Driver" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup] @="" [HKEY_LOCAL_MACHINE\software\microsoft\security center] "UpdatesDisableNotify"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "c:\\Program Files\\Nowe Gadu-Gadu\\gg.exe"= "c:\\Program Files\\Mobiola Web Camera for S60\\webcam.exe"= "c:\\Program Files\\Skype\\Phone\\Skype.exe"= "c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"= "c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"= "c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"= "c:\\Program Files\\Nokia\\Nokia Software Updater\\nsu_ui_client.exe"= "c:\\Program Files\\Common Files\\Nokia\\Service Layer\\A\\nsl_host_process.exe"= "c:\\Program Files\\SD EnterNET\\NavyFIELD\\NavyFIELD Launcher.exe"= "e:\\Program TV 3.2.8d\\programtv\\programtv.exe"= R0 SI3112r;Silicon Image SiI 3112 SATARaid Controller;c:\windows\system32\drivers\SI3112r.sys [2009-07-08 97408] R2 {B154377D-700F-42cc-9474-23858FBDF4BD};Power Control [2009/07/25 15:05];c:\program files\CyberLink\PowerDVD9\000.fcl [2009-02-28 19:40 87536] R2 LBeepKE;LBeepKE;c:\windows\system32\drivers\LBeepKE.sys [2009-07-25 10384] S1 sterownik;sterownik;\??\c:\docume~1\SZEWCO\USTAWI~1\Temp\Rar$EX01.735\Save2pc Pro 3.5.0.0\sterownik.sys --> c:\docume~1\SZEWCO\USTAWI~1\Temp\Rar$EX01.735\Save2pc Pro 3.5.0.0\sterownik.sys [?] S1 ZDCndis5;ZDCndis5 Protocol Driver;c:\windows\system32\ZDCndis5.SYS [2009-07-27 8416] S3 SG762_XP;SAGEM 802.11g XG762 1211B Driver;c:\windows\system32\drivers\WlanBZXP.sys [2009-07-25 402432] . - - - - USUNIĘTO PUSTE WPISY - - - - HKLM-Run-NWEReboot - (no file) SafeBoot-rbadza.sys . ------- Skan uzupełniający ------- . uStart Page = hxxp://www.onet.pl/ IE: E&ksportuj do programu Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000 Trusted Zone: gaz-system.pl\poczta DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab FF - ProfilePath - c:\documents and settings\SZEWCO\Dane aplikacji\Mozilla\Firefox\Profiles\6rzsj93w.default\ FF - prefs.js: browser.startup.homepage - hxxp://www.onet.pl/ FF - component: c:\program files\Mozilla Firefox\extensions\{B13721C7-F507-4982-B2E5-502A71474FED}\components\NPComponent.dll FF - plugin: c:\documents and settings\SZEWCO\Dane aplikacji\Mozilla\Firefox\Profiles\6rzsj93w.default\extensions\{eaf8a4ef-d221-45ca-9deb-d0934b45fa34}\plugins\npOggX.dll FF - plugin: c:\documents and settings\SZEWCO\Dane aplikacji\Nowe Gadu-Gadu\_userdata\npgg.1.dll FF - plugin: c:\program files\Mozilla Firefox\plugins\npOggX.dll ---- FIREFOX - SPOSÓB POSTĘPOWANIA ---- c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.enforce_same_site_origin", false); c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.cache_size", 51200); c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.ogg.enabled", true); c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.wave.enabled", true); c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.autoplay.enabled", true); c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.urlbar.autocomplete.enabled", true); c:\program files\Mozilla Firefox\greprefs\all.js - pref("capability.policy.mailnews.*.wholeText", "noAccess"); c:\program files\Mozilla Firefox\greprefs\all.js - pref("dom.storage.default_quota", 5120); c:\program files\Mozilla Firefox\greprefs\all.js - pref("content.sink.event_probe_rate", 3); c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.http.prompt-temp-redirect", true); c:\program files\Mozilla Firefox\greprefs\all.js - pref("layout.css.dpi", -1); c:\program files\Mozilla Firefox\greprefs\all.js - pref("layout.css.devPixelsPerPx", -1); c:\program files\Mozilla Firefox\greprefs\all.js - pref("gestures.enable_single_finger_input", true); c:\program files\Mozilla Firefox\greprefs\all.js - pref("dom.max_chrome_script_run_time", 0); c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.tcp.sendbuffer", 131072); c:\program files\Mozilla Firefox\greprefs\all.js - pref("geo.enabled", true); c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.remember_cert_checkbox_default_setting", true); c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr", "moz35"); c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-cjkt", "moz35"); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.blocklist.level", 2); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.urlbar.restrict.typed", "~"); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.urlbar.default.behavior", 0); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.history", true); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.formdata", true); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.passwords", false); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.downloads", true); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cookies", true); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cache", true); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.sessions", true); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.offlineApps", false); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.siteSettings", false); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.history", true); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.formdata", true); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.passwords", false); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.downloads", true); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.cookies", true); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.cache", true); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.sessions", true); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.offlineApps", false); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.siteSettings", false); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.sanitize.migrateFx3Prefs", false); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.ssl_override_behavior", 2); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("security.alternate_certificate_error_page", "certerror"); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.autostart", false); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.dont_prompt_on_enter", false); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("geo.wifi.uri", "https://www.google.com/loc/json"); . ************************************************************************** catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-08-06 17:23 Windows 5.1.2600 Dodatek Service Pack 3 NTFS skanowanie ukrytych procesów ... skanowanie ukrytych wpisów autostartu ... HKLM\Software\Microsoft\Windows\CurrentVersion\Run CTStartup = c:\program files\Creative\Splash Screen\CTEaxSpl.EXE /run???h??????s?????\?w? ?w???????w???w4???????.??w4???????4???TA?s4????????&8?????\??? ??? ???\???\???????????5?7~e?7~\???\?????????a??????C@?\???\??????s????\??????s\????&8?A??s?&8??C@?x???`|?w\?????@ skanowanie ukrytych plików ... skanowanie pomyślnie ukończone ukryte pliki: 0 ************************************************************************** [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\{B154377D-700F-42cc-9474-23858FBDF4BD}] "ImagePath"="\??\c:\program files\CyberLink\PowerDVD9\000.fcl" . --------------------- Pliki DLL ładowane pod uruchomionymi procesami --------------------- - - - - - - - > 'winlogon.exe'(504) c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll c:\program files\common files\logishrd\bluetooth\LBTServ.dll - - - - - - - > 'explorer.exe'(2028) c:\windows\system32\nview.dll c:\windows\system32\NVWRSPL.DLL c:\program files\Logitech\SetPoint\lgscroll.dll c:\windows\system32\msi.dll c:\windows\system32\ieframe.dll c:\windows\system32\nvwddi.dll c:\windows\system32\webcheck.dll c:\windows\system32\WPDShServiceObj.dll c:\program files\Nokia\Nokia PC Suite 7\PhoneBrowser.dll c:\program files\Nokia\Nokia PC Suite 7\NGSCM.DLL c:\program files\Nokia\Nokia PC Suite 7\Lang\PhoneBrowser_pol.nlr c:\program files\Nokia\Nokia PC Suite 7\Resource\PhoneBrowser_Nokia.ngr c:\windows\system32\PortableDeviceTypes.dll c:\windows\system32\PortableDeviceApi.dll . ------------------------ Pozostałe uruchomione procesy ------------------------ . c:\windows\system32\CTSVCCDA.EXE c:\program files\Java\jre6\bin\jqs.exe c:\program files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe c:\windows\system32\nvsvc32.exe c:\windows\system32\MsPMSPSv.exe c:\windows\system32\wscntfy.exe c:\windows\system32\rundll32.exe c:\windows\system32\rundll32.exe c:\program files\Common Files\Logishrd\KHAL2\KHALMNPR.exe c:\documents and settings\SZEWCO\Menu Start\Programy\Autostart\Save2pc Pro Updater.exe c:\program files\PC Connectivity Solution\ServiceLayer.exe c:\program files\PC Connectivity Solution\Transports\NclUSBSrv.exe c:\program files\PC Connectivity Solution\Transports\NclRSSrv.exe . ************************************************************************** . Czas ukończenia: 2009-08-06 17:26 - komputer został uruchomiony ponownie ComboFix-quarantined-files.txt 2009-08-06 15:26 Przed: 3 110 191 104 bajtów wolnych Po: 3 111 890 944 bajtów wolnych 384

Dodano 06.08.2009 17:03:03:
ops a jeszcze male pytanko jak przywrocic pasek jezyka?? bo zginal

**Posty:** 8001 · przez **Okocza** 06 Sie 2009, 21:49

Kod: Zaznacz wszystko: c:\documents and settings\All Users\Dane aplikacji\Installations\{F983B4FE-547B-4C44-BAF7-4F4DBA93D548}\Installer\CommonCustomActions\msxml6Exec.exe c:\documents and settings\All Users\Dane aplikacji\Installations\{F983B4FE-547B-4C44-BAF7-4F4DBA93D548}\Installer\CommonCustomActions\Sleep.exe c:\documents and settings\All Users\Dane aplikacji\Installations\{F983B4FE-547B-4C44-BAF7-4F4DBA93D548}\Installer\CommonCustomActions\vcredistExec.exe

te 3 pliki przeskanuj na www.virustotal.com i daj raport

co do paska języka - ppm na pasek aplikacji - paski narzędzi - pasek języka

**Posty:** 84 · przez **zooo** 07 Sie 2009, 18:09

Nie wiem czy to oto chodzilo ale daje raport z tych 3 plikow :

Kod: Zaznacz wszystko: 1. Plik [b]msxml6Exec.exe[/b] otrzymany 2009.07.02 04:51:06 (UTC) Obecny status: zakończono Wynik: 0/40 (0.00%) Zwięzły Zwięzły Drukuj wyniki Drukuj wyniki Antywirus Wersja Ostatnia aktualizacja Wynik a-squared 4.5.0.18 2009.07.02 - AhnLab-V3 5.0.0.2 2009.07.01 - AntiVir 7.9.0.199 2009.07.01 - Antiy-AVL 2.0.3.1 2009.07.02 - Authentium 5.1.2.4 2009.07.01 - Avast 4.8.1335.0 2009.07.01 - AVG 8.5.0.386 2009.07.01 - BitDefender 7.2 2009.07.02 - CAT-QuickHeal 10.00 2009.07.01 - ClamAV 0.94.1 2009.07.02 - Comodo 1538 2009.07.02 - DrWeb 5.0.0.12182 2009.07.02 - eSafe 7.0.17.0 2009.06.29 - eTrust-Vet 31.6.6592 2009.07.02 - F-Prot 4.4.4.56 2009.07.01 - Fortinet 3.117.0.0 2009.07.02 - GData 19 2009.07.02 - Ikarus T3.1.1.64.0 2009.07.02 - Jiangmin 11.0.706 2009.07.01 - K7AntiVirus 7.10.768 2009.06.19 - Kaspersky 7.0.0.125 2009.07.02 - McAfee 5663 2009.07.01 - McAfee+Artemis 5663 2009.07.01 - McAfee-GW-Edition 6.7.6 2009.07.02 - Microsoft 1.4803 2009.07.01 - NOD32 4206 2009.07.02 - Norman 6.01.09 2009.07.01 - nProtect 2009.1.8.0 2009.07.01 - Panda 10.0.0.14 2009.07.01 - PCTools 4.4.2.0 2009.07.01 - Prevx 3.0 2009.07.02 - Rising 21.36.30.00 2009.07.02 - Sophos 4.43.0 2009.07.02 - Sunbelt 3.2.1858.2 2009.07.01 - Symantec 1.4.4.12 2009.07.02 - TheHacker 6.3.4.3.359 2009.07.02 - TrendMicro 8.950.0.1094 2009.07.01 - VBA32 3.12.10.7 2009.07.02 - ViRobot 2009.7.1.1814 2009.07.01 - VirusBuster 4.6.5.0 2009.07.01 - Dodatkowe informacje File size: 3351812 bytes MD5 : 2a855375d65403f1550a4d43f8c0f682 SHA1 : 9b41159b04b5209320a4c923e0d13ae787b9c94a SHA256: 93041307d96ca2001da7563cdecc1b8f17e2c595e7a9fcffa1ec1e8acef2e0e7 PEInfo: PE Structure information ( base data ) entrypointaddress.: 0x1000 timedatestamp.....: 0x46F268EA (Thu Sep 20 14:34:50 2007) machinetype.......: 0x14C (Intel I386) ( 4 sections ) name viradd virsiz rawdsiz ntrpy md5 .text 0x1000 0xB000 0xA800 6.39 2f3efeaab3f070a77a5dc69c8fadb07c .data 0xC000 0x10000 0xE00 5.98 938a043a7b06ccf992f08dfdb9f9b126 .idata 0x1C000 0x1000 0x1000 4.90 6e50fa10a5bf6c5e2604dc1ae847e7b0 .rsrc 0x1D000 0x68520 0x68600 4.98 40189a0eee9ee5c323708b26f79fe852 ( 7 imports ) > advapi32.dll: RegCloseKey, RegCreateKeyExA, RegOpenKeyExA, RegQueryValueExA, RegSetValueExA > comctl32.dll: - > gdi32.dll: DeleteObject > kernel32.dll: CloseHandle, CompareStringA, CreateDirectoryA, CreateDirectoryW, CreateFileA, CreateFileW, DeleteFileA, DeleteFileW, DosDateTimeToFileTime, ExitProcess, ExpandEnvironmentStringsA, FileTimeToLocalFileTime, FileTimeToSystemTime, FindClose, FindFirstFileA, FindFirstFileW, FindNextFileA, FindNextFileW, FindResourceA, FreeLibrary, GetCPInfo, GetCommandLineA, GetCurrentDirectoryA, GetDateFormatA, GetFileAttributesA, GetFileAttributesW, GetFileType, GetFullPathNameA, GetLastError, GetLocaleInfoA, GetModuleFileNameA, GetModuleHandleA, GetNumberFormatA, GetProcAddress, GetProcessHeap, GetStdHandle, GetTempPathA, GetTickCount, GetTimeFormatA, GetVersionExA, GlobalAlloc, HeapAlloc, HeapFree, HeapReAlloc, IsDBCSLeadByte, LoadLibraryA, LocalFileTimeToFileTime, MoveFileA, MoveFileExA, MultiByteToWideChar, OpenFile, ReadFile, SetCurrentDirectoryA, SetEnvironmentVariableA, SetFileAttributesA, SetFileAttributesW, SetFilePointer, SetFileTime, SetLastError, SetVolumeLabelA, Sleep, SystemTimeToFileTime, WaitForSingleObject, WideCharToMultiByte, WriteFile, _lclose, lstrcmpiA, lstrlenA > ole32.dll: CLSIDFromString, CoCreateInstance, CreateStreamOnHGlobal, OleInitialize, OleUninitialize > shell32.dll: SHBrowseForFolderA, SHChangeNotify, SHFileOperationA, SHGetFileInfoA, SHGetMalloc, SHGetSpecialFolderLocation, ShellExecuteExA, SHGetPathFromIDListA > user32.dll: CharLowerA, CharToOemA, CharToOemBuffA, CharUpperA, CopyRect, CreateWindowExA, DefWindowProcA, DestroyIcon, DestroyWindow, DialogBoxParamA, DispatchMessageA, EnableWindow, EndDialog, FindWindowExA, GetClassNameA, GetClientRect, GetDlgItem, GetDlgItemTextA, GetMessageA, GetParent, GetSysColor, GetSystemMetrics, GetWindow, GetWindowLongA, GetWindowRect, GetWindowTextA, IsWindow, IsWindowVisible, LoadBitmapA, LoadCursorA, LoadIconA, LoadStringA, MapWindowPoints, MessageBoxA, OemToCharA, OemToCharBuffA, PeekMessageA, PostMessageA, RegisterClassExA, SendDlgItemMessageA, SendMessageA, SetDlgItemTextA, SetFocus, SetMenu, SetWindowLongA, SetWindowPos, SetWindowTextA, ShowWindow, TranslateMessage, UpdateWindow, WaitForInputIdle, wsprintfA, wvsprintfA ( 0 exports ) TrID : File type identification WinRAR Self Extracting archive (96.2%) Win32 Executable Generic (1.5%) Win32 Dynamic Link Library (generic) (1.4%) Generic Win/DOS Executable (0.3%) DOS Executable Generic (0.3%) ssdeep: 98304:+k6jbvl78dZUz4ORKN2YNcr7YdQdvfjECI0h4+Ruhmu:+k6jbvl7GZUz4OEjNSdvB4+8Eu PEiD : - packers (F-Prot): ZIP RDS : NSRL Reference Data Set - 2. Plik [b]Sleep.exe[/b] otrzymany 2009.07.02 04:51:18 (UTC) Obecny status: zakończono Wynik: 0/40 (0.00%) Zwięzły Zwięzły Drukuj wyniki Drukuj wyniki Antywirus Wersja Ostatnia aktualizacja Wynik a-squared 4.5.0.18 2009.07.02 - AhnLab-V3 5.0.0.2 2009.07.01 - AntiVir 7.9.0.199 2009.07.01 - Antiy-AVL 2.0.3.1 2009.07.02 - Authentium 5.1.2.4 2009.07.01 - Avast 4.8.1335.0 2009.07.01 - AVG 8.5.0.386 2009.07.01 - BitDefender 7.2 2009.07.02 - CAT-QuickHeal 10.00 2009.07.01 - ClamAV 0.94.1 2009.07.02 - Comodo 1538 2009.07.02 - DrWeb 5.0.0.12182 2009.07.02 - eSafe 7.0.17.0 2009.06.29 - eTrust-Vet 31.6.6592 2009.07.02 - F-Prot 4.4.4.56 2009.07.01 - Fortinet 3.117.0.0 2009.07.02 - GData 19 2009.07.02 - Ikarus T3.1.1.64.0 2009.07.02 - Jiangmin 11.0.706 2009.07.01 - K7AntiVirus 7.10.768 2009.06.19 - Kaspersky 7.0.0.125 2009.07.02 - McAfee 5663 2009.07.01 - McAfee+Artemis 5663 2009.07.01 - McAfee-GW-Edition 6.7.6 2009.07.02 - Microsoft 1.4803 2009.07.01 - NOD32 4206 2009.07.02 - Norman 6.01.09 2009.07.01 - nProtect 2009.1.8.0 2009.07.01 - Panda 10.0.0.14 2009.07.01 - PCTools 4.4.2.0 2009.07.01 - Prevx 3.0 2009.07.02 - Rising 21.36.30.00 2009.07.02 - Sophos 4.43.0 2009.07.02 - Sunbelt 3.2.1858.2 2009.07.01 - Symantec 1.4.4.12 2009.07.02 - TheHacker 6.3.4.3.359 2009.07.02 - TrendMicro 8.950.0.1094 2009.07.01 - VBA32 3.12.10.7 2009.07.02 - ViRobot 2009.7.1.1814 2009.07.01 - VirusBuster 4.6.5.0 2009.07.01 - Dodatkowe informacje File size: 36864 bytes MD5 : b487a65d01d5465fdc299a1e08f26f15 SHA1 : f2b3a8d1b9fca5713b6d39033d45be7e80bc22f8 SHA256: fd00833f60c2d34acab006364d548a9d06dd54d225272ce79fd6774b7680739e PEInfo: PE Structure information ( base data ) entrypointaddress.: 0x12BE timedatestamp.....: 0x46F37ED4 (Fri Sep 21 10:20:36 2007) machinetype.......: 0x14C (Intel I386) ( 3 sections ) name viradd virsiz rawdsiz ntrpy md5 .text 0x1000 0x4FAD 0x5000 6.62 0a59d836f8180a7288a6a9df4a6dd7ef .rdata 0x6000 0x174A 0x2000 3.96 feb7c19d3deb80c0b632e03cbb35da95 .data 0x8000 0x1124 0x1000 1.51 fae798e10e704aedb3d6589aedb1ca6b ( 2 imports ) > advapi32.dll: RegOpenKeyExA > kernel32.dll: Sleep, GetProcAddress, GetModuleHandleA, GetModuleFileNameA, GetCurrentProcess, GetStartupInfoA, GetCommandLineA, GetVersionExA, GetACP, GetOEMCP, GetCPInfo, TlsAlloc, SetLastError, GetCurrentThreadId, GetLastError, TlsFree, TlsSetValue, TlsGetValue, HeapFree, HeapAlloc, ExitProcess, TerminateProcess, WriteFile, GetStdHandle, UnhandledExceptionFilter, FreeEnvironmentStringsA, GetEnvironmentStrings, FreeEnvironmentStringsW, WideCharToMultiByte, GetEnvironmentStringsW, SetHandleCount, GetFileType, DeleteCriticalSection, HeapDestroy, HeapCreate, VirtualFree, LCMapStringA, MultiByteToWideChar, LCMapStringW, GetStringTypeA, GetStringTypeW, LeaveCriticalSection, EnterCriticalSection, VirtualAlloc, HeapReAlloc, LoadLibraryA, InitializeCriticalSection, RtlUnwind, InterlockedExchange, VirtualQuery, GetLocaleInfoA, VirtualProtect, GetSystemInfo, QueryPerformanceCounter, GetTickCount, GetCurrentProcessId, GetSystemTimeAsFileTime, HeapSize ( 0 exports ) TrID : File type identification 60.8% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 16.6% (.EXE) Win32 Executable Generic (8527/13/3) 14.7% (.DLL) Win32 Dynamic Link Library (generic) (7583/30/2) 3.9% (.EXE) Generic Win/DOS Executable (2002/3) 3.8% (.EXE) DOS Executable Generic (2000/1) ssdeep: 768:FBfjdvEbi1KjF8ME9UkutHfLJKOE4PylU:FBh+qME9Uk2HfLJKWql PEiD : - RDS : NSRL Reference Data Set - 3. Plik [b]vcredistExec.exe[/b] otrzymany 2009.07.02 04:52:48 (UTC) Obecny status: zakończono Wynik: 0/41 (0.00%) Zwięzły Zwięzły Drukuj wyniki Drukuj wyniki Antywirus Wersja Ostatnia aktualizacja Wynik a-squared 4.5.0.18 2009.07.02 - AhnLab-V3 5.0.0.2 2009.07.01 - AntiVir 7.9.0.199 2009.07.01 - Antiy-AVL 2.0.3.1 2009.07.02 - Authentium 5.1.2.4 2009.07.01 - Avast 4.8.1335.0 2009.07.01 - AVG 8.5.0.386 2009.07.01 - BitDefender 7.2 2009.07.02 - CAT-QuickHeal 10.00 2009.07.01 - ClamAV 0.94.1 2009.07.02 - Comodo 1538 2009.07.02 - DrWeb 5.0.0.12182 2009.07.02 - eSafe 7.0.17.0 2009.06.29 - eTrust-Vet 31.6.6592 2009.07.02 - F-Prot 4.4.4.56 2009.07.01 - F-Secure 8.0.14470.0 2009.07.02 - Fortinet 3.117.0.0 2009.07.02 - GData 19 2009.07.02 - Ikarus T3.1.1.64.0 2009.07.02 - Jiangmin 11.0.706 2009.07.01 - K7AntiVirus 7.10.768 2009.06.19 - Kaspersky 7.0.0.125 2009.07.02 - McAfee 5663 2009.07.01 - McAfee+Artemis 5663 2009.07.01 - McAfee-GW-Edition 6.7.6 2009.07.02 - Microsoft 1.4803 2009.07.01 - NOD32 4206 2009.07.02 - Norman 6.01.09 2009.07.01 - nProtect 2009.1.8.0 2009.07.01 - Panda 10.0.0.14 2009.07.01 - PCTools 4.4.2.0 2009.07.01 - Prevx 3.0 2009.07.02 - Rising 21.36.30.00 2009.07.02 - Sophos 4.43.0 2009.07.02 - Sunbelt 3.2.1858.2 2009.07.01 - Symantec 1.4.4.12 2009.07.02 - TheHacker 6.3.4.3.359 2009.07.02 - TrendMicro 8.950.0.1094 2009.07.01 - VBA32 3.12.10.7 2009.07.02 - ViRobot 2009.7.1.1814 2009.07.01 - VirusBuster 4.6.5.0 2009.07.01 - Dodatkowe informacje File size: 3181612 bytes MD5 : 59005b3a42ec11aa4699b16bd521c700 SHA1 : b5c080c53ee163e277b34920b31a9da10dd5656c SHA256: 7d8a68dca596bd95a48223038d900574372c4d7c0c612d37389ecb6593659b58 PEInfo: PE Structure information ( base data ) entrypointaddress.: 0x1000 timedatestamp.....: 0x46F268EA (Thu Sep 20 14:34:50 2007) machinetype.......: 0x14C (Intel I386) ( 4 sections ) name viradd virsiz rawdsiz ntrpy md5 .text 0x1000 0xB000 0xA800 6.39 2f3efeaab3f070a77a5dc69c8fadb07c .data 0xC000 0x10000 0xE00 5.98 938a043a7b06ccf992f08dfdb9f9b126 .idata 0x1C000 0x1000 0x1000 4.90 6e50fa10a5bf6c5e2604dc1ae847e7b0 .rsrc 0x1D000 0x68520 0x68600 4.98 40189a0eee9ee5c323708b26f79fe852 ( 7 imports ) > advapi32.dll: RegCloseKey, RegCreateKeyExA, RegOpenKeyExA, RegQueryValueExA, RegSetValueExA > comctl32.dll: - > gdi32.dll: DeleteObject > kernel32.dll: CloseHandle, CompareStringA, CreateDirectoryA, CreateDirectoryW, CreateFileA, CreateFileW, DeleteFileA, DeleteFileW, DosDateTimeToFileTime, ExitProcess, ExpandEnvironmentStringsA, FileTimeToLocalFileTime, FileTimeToSystemTime, FindClose, FindFirstFileA, FindFirstFileW, FindNextFileA, FindNextFileW, FindResourceA, FreeLibrary, GetCPInfo, GetCommandLineA, GetCurrentDirectoryA, GetDateFormatA, GetFileAttributesA, GetFileAttributesW, GetFileType, GetFullPathNameA, GetLastError, GetLocaleInfoA, GetModuleFileNameA, GetModuleHandleA, GetNumberFormatA, GetProcAddress, GetProcessHeap, GetStdHandle, GetTempPathA, GetTickCount, GetTimeFormatA, GetVersionExA, GlobalAlloc, HeapAlloc, HeapFree, HeapReAlloc, IsDBCSLeadByte, LoadLibraryA, LocalFileTimeToFileTime, MoveFileA, MoveFileExA, MultiByteToWideChar, OpenFile, ReadFile, SetCurrentDirectoryA, SetEnvironmentVariableA, SetFileAttributesA, SetFileAttributesW, SetFilePointer, SetFileTime, SetLastError, SetVolumeLabelA, Sleep, SystemTimeToFileTime, WaitForSingleObject, WideCharToMultiByte, WriteFile, _lclose, lstrcmpiA, lstrlenA > ole32.dll: CLSIDFromString, CoCreateInstance, CreateStreamOnHGlobal, OleInitialize, OleUninitialize > shell32.dll: SHBrowseForFolderA, SHChangeNotify, SHFileOperationA, SHGetFileInfoA, SHGetMalloc, SHGetSpecialFolderLocation, ShellExecuteExA, SHGetPathFromIDListA > user32.dll: CharLowerA, CharToOemA, CharToOemBuffA, CharUpperA, CopyRect, CreateWindowExA, DefWindowProcA, DestroyIcon, DestroyWindow, DialogBoxParamA, DispatchMessageA, EnableWindow, EndDialog, FindWindowExA, GetClassNameA, GetClientRect, GetDlgItem, GetDlgItemTextA, GetMessageA, GetParent, GetSysColor, GetSystemMetrics, GetWindow, GetWindowLongA, GetWindowRect, GetWindowTextA, IsWindow, IsWindowVisible, LoadBitmapA, LoadCursorA, LoadIconA, LoadStringA, MapWindowPoints, MessageBoxA, OemToCharA, OemToCharBuffA, PeekMessageA, PostMessageA, RegisterClassExA, SendDlgItemMessageA, SendMessageA, SetDlgItemTextA, SetFocus, SetMenu, SetWindowLongA, SetWindowPos, SetWindowTextA, ShowWindow, TranslateMessage, UpdateWindow, WaitForInputIdle, wsprintfA, wvsprintfA ( 0 exports ) TrID : File type identification 96.2% (.EXE) WinRAR Self Extracting archive (518022/5) 1.5% (.EXE) Win32 Executable Generic (8527/13/3) 1.4% (.DLL) Win32 Dynamic Link Library (generic) (7583/30/2) 0.3% (.EXE) Generic Win/DOS Executable (2002/3) 0.3% (.EXE) DOS Executable Generic (2000/1) ThreatExpert: http://www.threatexpert.com/report.aspx?md5=59005b3a42ec11aa4699b16bd521c700 ssdeep: 49152:+k6jbvl7JtzrTusiR1E43Y67pYoYxQggC3FL3h/BZQdNcoIOoGLC4YBWE+QNPlnX:+k6jbvl7zCztPajgC1zBPc5IVj9nrr PEiD : - packers (F-Prot): ZIP, CAB RDS : NSRL Reference Data Set -

**Posty:** 8001 · przez **Okocza** 07 Sie 2009, 23:07

zooo, tak, o to chodziło

wykonaj to co jest napisane w poście:

zhakowane-konto-wow-a-logi-po-czyszczeniu-vt111408.html#p844321