Skocz do zawartości

r   e   k   l   a   m   a

Zdjęcie

PROCESOR NA 100% ..


  • Zamknięty Temat jest zamknięty
10 odpowiedzi w tym temacie

#1 1kalor

1kalor
  • Użytkownicy
  • 445 postów

Napisano 04.12.2007 - 23:50

Proszę o srawdzenie loga to co w temacie procek na 100%

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 23:19:38, on 2007-12-04
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Ahead\InCD\InCDsrv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\hmaovgms.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe
C:\Program Files\Ahead\InCD\InCD.exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\Common Files\OnlineHelpmate\mc.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Common Files\StorageProtector\strpmon.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\taskmgr.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O3 - Toolbar: Security Toolbar - {11A69AE4-FBED-4832-A2BF-45AF82825583} - C:\WINDOWS\system32\sqogatuj.dll (file missing)
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Salestart] "C:\Program Files\Common Files\OnlineHelpmate\mc.exe" dm=http://onlinehelpmate.com ad=http://onlinehelpmate.com sd=http://ilp.onlinehelpmate.com
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [Salestart(1)] "C:\Program Files\Common Files\StorageProtector\strpmon.exe" dm=http://storageprotector.com ad=http://storageprotector.com sd=http://inspaid.storageprotector.com
O4 - HKLM\..\Run: [c811e51e] rundll32.exe "C:\WINDOWS\system32\cdlyndui.dll",b
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: DomainService - - C:\WINDOWS\system32\hmaovgms.exe
O23 - Service: Forceware Web Interface (ForcewareWebInterface) - Apache Software Foundation - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: ForceWare IP service (nSvcIp) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe
O23 - Service: ForceWare user log service (nSvcLog) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe

--
End of file - 6098 bytes


SAMSUNG :))

Subaru to coś więcej niż tylko samochód...
Dołączona grafika

#2 Gutek

Gutek

    Uczestnik HotZlotu

  • Użytkownicy
  • 27006 postów

Napisano 05.12.2007 - 14:37

Użyj VundoFix + Trojan.Vundo Removal Tool + VirtumundoBeGone.

Daj log z ComboFix
Walka do końca, nie format :-)
Proszę nie pisać na PW odpowiem na forum - dziękuję :-)

#3 1kalor

1kalor
  • Użytkownicy
  • 445 postów

Napisano 05.12.2007 - 18:43

trojan vundo removal tool

Symantec Trojan.Vundo Removal Tool 1.5.0

C:\System Volume Information: (not scanned)
D:\System Volume Information: (not scanned)
E:\System Volume Information: (not scanned)
Trojan.Vundo has not been found on your computer.


SAMSUNG :))

Subaru to coś więcej niż tylko samochód...
Dołączona grafika

#4 adam9870

adam9870
  • Użytkownicy
  • 14551 postów

Napisano 05.12.2007 - 18:47

Użyj również pozostałych narzędzi wymienionych przez Gutka, tj. VundoFix oraz VirtumundoBeGone jeśli jeszcze tego nie zrobiłeś, a następnie wklej log z ComboFix.

#5 1kalor

1kalor
  • Użytkownicy
  • 445 postów

Napisano 05.12.2007 - 18:49

ale jak// mam włączyć to wszystko razem???

Złączono Posta: 05.12.2007 (Sro) 19:12
Combo Fix

ComboFix 07-12-04.3 - Karol 2007-12-05 18:52:16.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.637 [GMT 1:00]
Running from: C:\Documents and Settings\Karol\Pulpit\ComboFix.exe
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\All Users\Dane aplikacji\OnlineHelpmate
C:\Documents and Settings\All Users\Dane aplikacji\OnlineHelpmate\Abbr
C:\Documents and Settings\All Users\Dane aplikacji\OnlineHelpmate\ProdCode
C:\Documents and Settings\All Users\Menu Start\Live Safety Center.lnk
C:\Documents and Settings\All Users\Menu Start\Online Security Guide.lnk
C:\Documents and Settings\All Users\Menu Start\Programy\BestsellerAntivirus
C:\Documents and Settings\All Users\Menu Start\Programy\BestsellerAntivirus\BestsellerAntivirus.lnk
C:\Documents and Settings\All Users\Menu Start\Programy\BestsellerAntivirus\Contact Customer Support.lnk
C:\Documents and Settings\All Users\Menu Start\Programy\BestsellerAntivirus\Uninstall BestsellerAntivirus.lnk
C:\Documents and Settings\Karol\Dane aplikacji\BestsellerAntivirus
C:\Documents and Settings\Karol\Dane aplikacji\BestsellerAntivirus\avtasks.dat
C:\Documents and Settings\Karol\Dane aplikacji\BestsellerAntivirus\Logs\av.log
C:\Documents and Settings\Karol\Dane aplikacji\BestsellerAntivirus\Logs\ga6Support.log
C:\Documents and Settings\Karol\Dane aplikacji\BestsellerAntivirus\Logs\update.log
C:\Documents and Settings\Karol\Dane aplikacji\installer_en[1].exe
C:\Documents and Settings\Karol\Dane aplikacji\OnlineHelpmate
C:\Documents and Settings\Karol\Dane aplikacji\OnlineHelpmate\Logs\update.log
C:\Documents and Settings\Karol\Dane aplikacji\storageprotector
C:\Documents and Settings\Karol\Dane aplikacji\storageprotector\Logs\update.log
C:\Documents and Settings\Karol\Ulubione\Online Security Guide.lnk
C:\Program Files\BestsellerAntivirus
C:\Program Files\BestsellerAntivirus\Activate.exe
C:\Program Files\BestsellerAntivirus\Config\pgs.xml
C:\Program Files\BestsellerAntivirus\Dat\Activate.dat
C:\Program Files\BestsellerAntivirus\Dat\BkSites.dat
C:\Program Files\BestsellerAntivirus\Dat\bnlink.dat
C:\Program Files\BestsellerAntivirus\Dat\incmp.dat
C:\Program Files\BestsellerAntivirus\Dat\index.dat
C:\Program Files\BestsellerAntivirus\Dat\pv.dat
C:\Program Files\BestsellerAntivirus\Engines\AWBase\database\enemies.dat
C:\Program Files\BestsellerAntivirus\Engines\AWBase\vbpv.dat
C:\Program Files\BestsellerAntivirus\Engines\PGBase\vbpv.dat
C:\Program Files\BestsellerAntivirus\Engines\plugins\BORLNDMM.DLL
C:\Program Files\BestsellerAntivirus\Engines\plugins\SCANADWR.DLL
C:\Program Files\BestsellerAntivirus\Engines\plugins\SCANBCDR.DLL
C:\Program Files\BestsellerAntivirus\Engines\plugins\SCANDLDR.DLL
C:\Program Files\BestsellerAntivirus\Engines\plugins\SCANDOS1.DLL
C:\Program Files\BestsellerAntivirus\Engines\plugins\SCANEMUL.DLL
C:\Program Files\BestsellerAntivirus\Engines\plugins\SCANFUNC.DLL
C:\Program Files\BestsellerAntivirus\Engines\plugins\SCANMCR1.DLL
C:\Program Files\BestsellerAntivirus\Engines\plugins\SCANOTHR.DLL
C:\Program Files\BestsellerAntivirus\Engines\plugins\SCANSCR.DLL
C:\Program Files\BestsellerAntivirus\Engines\plugins\SCANTOOL.DLL
C:\Program Files\BestsellerAntivirus\Engines\plugins\SCANTROJ.DLL
C:\Program Files\BestsellerAntivirus\Engines\plugins\SCANWIN1.DLL
C:\Program Files\BestsellerAntivirus\Engines\plugins\UNACPU.DLL
C:\Program Files\BestsellerAntivirus\Engines\plugins\UNADBX.DLL
C:\Program Files\BestsellerAntivirus\Engines\plugins\unamscan.dll
C:\Program Files\BestsellerAntivirus\Engines\plugins\UNMIME.DLL
C:\Program Files\BestsellerAntivirus\Engines\plugins\UNPACK.DLL
C:\Program Files\BestsellerAntivirus\Engines\plugins\UNPACKS.DLL
C:\Program Files\BestsellerAntivirus\Engines\plugins\UNPACKS2.DLL
C:\Program Files\BestsellerAntivirus\Engines\plugins\UNPEPACK.DLL
C:\Program Files\BestsellerAntivirus\Engines\plugins\UpDate\UA27601.DLL
C:\Program Files\BestsellerAntivirus\Engines\plugins\UpDate\UA27602.DLL
C:\Program Files\BestsellerAntivirus\Engines\plugins\UpDate\UA27603.DLL
C:\Program Files\BestsellerAntivirus\Engines\plugins\UpDate\UA27604.DLL
C:\Program Files\BestsellerAntivirus\Engines\plugins\UpDate\UADAILY.DLL
C:\Program Files\BestsellerAntivirus\Engines\plugins\vbpv.dat
C:\Program Files\BestsellerAntivirus\FMTR.sys
C:\Program Files\BestsellerAntivirus\fopnl.dll
C:\Program Files\BestsellerAntivirus\Graphics\cross.gif
C:\Program Files\BestsellerAntivirus\Graphics\ga6p.gif
C:\Program Files\BestsellerAntivirus\Graphics\kb.url
C:\Program Files\BestsellerAntivirus\Graphics\main.ico
C:\Program Files\BestsellerAntivirus\Graphics\mini.ico
C:\Program Files\BestsellerAntivirus\Graphics\Online.url
C:\Program Files\BestsellerAntivirus\Graphics\rm.url
C:\Program Files\BestsellerAntivirus\Graphics\support.ico
C:\Program Files\BestsellerAntivirus\Graphics\Support.url
C:\Program Files\BestsellerAntivirus\Graphics\uninstall.ico
C:\Program Files\BestsellerAntivirus\history.db
C:\Program Files\BestsellerAntivirus\LA\lapv.dat
C:\Program Files\BestsellerAntivirus\LA\License.rtf
C:\Program Files\BestsellerAntivirus\ResErrors.log
C:\Program Files\BestsellerAntivirus\Restart.exe
C:\Program Files\BestsellerAntivirus\rpt.dll
C:\Program Files\BestsellerAntivirus\RTasks.exe
C:\Program Files\BestsellerAntivirus\scnkrnl.dll
C:\Program Files\BestsellerAntivirus\settings.ini
C:\Program Files\BestsellerAntivirus\sqlite3.dll
C:\Program Files\BestsellerAntivirus\Tools\IEFWBHO.dll
C:\Program Files\BestsellerAntivirus\unins000.dat
C:\Program Files\BestsellerAntivirus\unins000.exe
C:\Program Files\BestsellerAntivirus\Up\ASupdater.dat
C:\Program Files\BestsellerAntivirus\Up\gup.exe
C:\Program Files\BestsellerAntivirus\Up\PGupdater.dat
C:\Program Files\BestsellerAntivirus\Up\UBupdater.dat
C:\Program Files\BestsellerAntivirus\Up\up.dat
C:\Program Files\BestsellerAntivirus\Up\updater.dat
C:\Program Files\Common Files\BestsellerAntivirus
C:\Program Files\Common Files\BestsellerAntivirus\bm.exe
C:\Program Files\Common Files\OnlineHelpmate
C:\Program Files\Common Files\OnlineHelpmate\mc.exe
C:\Program Files\Common Files\StorageProtector
C:\Program Files\Common Files\StorageProtector\strpmon.exe
C:\Program Files\StorageProtector
C:\Program Files\StorageProtector\swupd.log
C:\UGA6P
C:\WINDOWS\system32\ahtjbdon.dll
C:\WINDOWS\system32\bhseroql.dll
C:\WINDOWS\system32\cdlyndui.dll
C:\WINDOWS\system32\csgpyfqh.exe
C:\WINDOWS\system32\drivers\fmtr.sys
C:\WINDOWS\system32\eygfujqp.exe
C:\WINDOWS\system32\fiebwyvn.dll
C:\WINDOWS\system32\gekpxccs.exe
C:\WINDOWS\system32\gpdnqicl.dll
C:\WINDOWS\system32\hmaovgms.exe
C:\WINDOWS\system32\hrxpgcvl.dll
C:\WINDOWS\system32\hytcctsp.dll
C:\WINDOWS\system32\iifddby.dll
C:\WINDOWS\system32\iudnyldc.ini
C:\WINDOWS\system32\jutaimow.dll
C:\WINDOWS\system32\kjgsijkj.dll
C:\WINDOWS\system32\nvywbeif.ini
C:\WINDOWS\system32\orutv.ini
C:\WINDOWS\system32\orutv.ini2
C:\WINDOWS\system32\qfypuasl.dll
C:\WINDOWS\system32\sqogatuj.dllbox
C:\WINDOWS\system32\tqbyaemy.dll
C:\WINDOWS\system32\ulnsloit.exe
C:\WINDOWS\system32\uqkgdpat.exe
C:\WINDOWS\system32\vturo.dll
C:\WINDOWS\system32\ymeaybqt.ini
C:\WINDOWS\system32\ysghdvxc.exe

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.
-------\LEGACY_DOMAINSERVICE
-------\DomainService


((((((((((((((((((((((((( Files Created from 2007-11-05 to 2007-12-05 )))))))))))))))))))))))))))))))
.

2007-12-05 18:44 . 2007-12-05 18:50

d-------- C:\VundoFix Backups
2007-12-05 17:11 . 2007-12-05 17:12 d-------- C:\Program Files\Picasa2
2007-12-05 17:11 . 2007-12-05 17:11 d-------- C:\Program Files\Google
2007-12-04 23:17 . 2007-12-04 23:17 d-------- C:\Program Files\Trend Micro
2007-12-03 19:48 . 2007-12-04 19:48 807,040 ---hs---- C:\WINDOWS\system32\codcuhep.ini
2007-12-02 19:47 . 2007-12-03 19:48 794,640 ---hs---- C:\WINDOWS\system32\frigltcj.ini
2007-12-02 13:33 . 2007-12-02 13:33 d-------- C:\Documents and Settings\Karol\Contacts
2007-12-02 13:32 . 2007-12-02 13:35 d----c--- C:\WINDOWS\system32\DRVSTORE
2007-12-02 13:32 . 2007-12-02 13:32 d-------- C:\Program Files\Real
2007-12-02 13:32 . 2007-12-02 13:32 268 --ah----- C:\sqmdata00.sqm
2007-12-02 13:32 . 2007-12-02 13:32 244 --ah----- C:\sqmnoopt00.sqm
2007-12-01 21:20 . 2007-12-01 21:20 d-------- C:\Documents and Settings\Karol\Dane aplikacji\Gadu-Gadu
2007-12-01 20:58 . 2007-12-01 20:58 d-------- C:\Program Files\MoorHunt
2007-12-01 20:44 . 2007-12-01 20:45 d-------- C:\Documents and Settings\Karol\Gadu-Gadu
2007-12-01 20:34 . 2007-12-02 16:35 794,213 ---hs---- C:\WINDOWS\system32\luujmxmo.ini
2007-11-30 19:44 . 2007-12-01 17:32 793,844 ---hs---- C:\WINDOWS\system32\lrtbtufp.ini
2007-11-29 18:23 . 2004-10-07 13:39 89,088 --a------ C:\WINDOWS\system32\atl71.dll
2007-11-29 18:23 . 2001-03-08 18:30 24,064 --a------ C:\WINDOWS\system32\msxml3a.dll
2007-11-29 18:02 . 2007-12-04 14:04 837,496 --a------ C:\WINDOWS\system32\aswBoot.exe
2007-11-29 18:02 . 2004-01-09 10:13 380,928 --a------ C:\WINDOWS\system32\actskin4.ocx
2007-11-29 18:02 . 2007-12-04 13:54 95,608 --a------ C:\WINDOWS\system32\AVASTSS.scr
2007-11-29 18:02 . 2007-12-04 15:55 94,544 --a------ C:\WINDOWS\system32\drivers\aswmon2.sys
2007-11-29 18:02 . 2007-12-04 15:56 93,264 --a------ C:\WINDOWS\system32\drivers\aswmon.sys
2007-11-29 18:02 . 2007-12-04 15:51 42,912 --a------ C:\WINDOWS\system32\drivers\aswTdi.sys
2007-11-29 18:02 . 2007-12-04 15:49 26,624 --a------ C:\WINDOWS\system32\drivers\aavmker4.sys
2007-11-29 18:02 . 2007-12-04 15:53 23,152 --a------ C:\WINDOWS\system32\drivers\aswRdr.sys
2007-11-27 21:19 . 2007-11-28 19:42 784,425 ---hs---- C:\WINDOWS\system32\xagwaseh.ini
2007-11-27 19:06 . 2007-12-04 22:14 107,832 --a------ C:\WINDOWS\system32\PnkBstrB.exe
2007-11-27 19:06 . 2007-12-04 22:15 22,328 --a------ C:\WINDOWS\system32\drivers\PnkBstrK.sys
2007-11-27 19:05 . 2007-11-27 19:05 d-------- C:\WINDOWS\system32\LogFiles
2007-11-27 19:05 . 2007-11-27 23:43 66,872 --a------ C:\WINDOWS\system32\PnkBstrA.exe
2007-11-27 18:25 . 2007-11-30 20:48 d-------- C:\Program Files\The All-Seeing Eye
2007-11-26 23:49 . 2007-12-04 21:53 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2007-11-26 23:49 . 2007-11-26 23:49 1,409 --a------ C:\WINDOWS\QTFont.for
2007-11-26 23:43 . 2007-11-26 23:44 d-------- C:\Program Files\QuickTime
2007-11-26 23:43 . 2007-11-26 23:43 d-------- C:\Program Files\Apple Software Update
2007-11-26 23:43 . 2007-11-26 23:43 d-------- C:\Documents and Settings\All Users\Dane aplikacji\Apple Computer
2007-11-26 23:43 . 2007-11-26 23:43 d-------- C:\Documents and Settings\All Users\Dane aplikacji\Apple
2007-11-26 21:12 . 2007-11-26 21:12 252 --a------ C:\WINDOWS\game.ini
2007-11-26 20:07 . 2007-11-26 20:07 d--hs---- C:\WINDOWS\ftpcache
2007-11-26 19:44 . 2007-11-26 19:45 d-------- C:\Program Files\ATI Technologies
2007-11-26 19:44 . 2007-11-01 21:05 593,920 --------- C:\WINDOWS\system32\ati2sgag.exe
2007-11-25 19:24 . 2007-11-25 19:24 d-------- C:\Documents and Settings\Karol\Dane aplikacji\Media Player Classic
2007-11-25 15:21 . 2007-11-25 15:21 d-------- C:\Program Files\Java
2007-11-25 15:21 . 2007-09-24 23:31 69,632 --a------ C:\WINDOWS\system32\javacpl.cpl
2007-11-25 15:19 . 2007-11-25 15:19 d-------- C:\Program Files\Common Files\Java
2007-11-23 19:48 . 2007-10-25 17:44 8,488,960 -----c--- C:\WINDOWS\system32\dllcache\shell32.dll
2007-11-23 19:47 . 2007-07-09 14:20 582,656 -----c--- C:\WINDOWS\system32\dllcache\rpcrt4.dll
2007-11-23 19:47 . 2007-04-02 07:37 546,304 -----c--- C:\WINDOWS\system32\dllcache\hhctrl.ocx
2007-11-22 21:06 . 2004-08-03 23:08 26,496 --a--c--- C:\WINDOWS\system32\dllcache\usbstor.sys
2007-11-21 21:26 . 2007-11-29 22:40 d-------- C:\Program Files\Save
2007-11-21 21:21 . 2007-11-21 21:21 d-------- C:\Program Files\DivX
2007-11-21 20:47 . 2007-12-05 16:50 69 --a------ C:\WINDOWS\NeroDigital.ini
2007-11-21 20:42 . 2007-11-25 15:51 1,542 --a------ C:\WINDOWS\mozver.dat
2007-11-21 20:36 . 2007-11-21 20:36 0 --a------ C:\WINDOWS\nsreg.dat
2007-11-21 20:22 . 2007-11-29 22:39 d-------- C:\Program Files\DAEMON Tools
2007-11-21 20:22 . 2007-11-21 20:22 223,128 --a------ C:\WINDOWS\system32\drivers\dtscsi.sys
2007-11-21 20:20 . 2007-11-21 20:20 642,560 --a------ C:\WINDOWS\system32\drivers\sptd.sys
2007-11-21 20:20 . 2007-11-21 20:20 96,256 --a------ C:\WINDOWS\system32\drivers\sptd6877.sys
2007-11-21 20:19 . 2007-11-21 20:19 d-------- C:\WINDOWS\system32\Futuremark
2007-11-21 20:19 . 2007-11-21 20:19 d-------- C:\Program Files\Futuremark
2007-11-21 20:19 . 2004-10-25 20:02 21,664 --a------ C:\WINDOWS\system32\drivers\Entech.sys
2007-11-21 20:19 . 2001-11-19 18:05 3,972 --------- C:\WINDOWS\system32\drivers\PciBus.sys
2007-11-21 20:18 . 2007-11-21 20:18 d-------- C:\Program Files\Alwil Software
2007-11-21 20:18 . 2003-03-18 21:20 1,060,864 --a------ C:\WINDOWS\system32\MFC71.dll
2007-11-21 20:17 . 2007-11-26 23:44 d-------- C:\Program Files\ffdshow
2007-11-21 20:17 . 2007-01-01 00:00 499,712 --a------ C:\WINDOWS\system32\msvcp71.dll
2007-11-21 20:17 . 2007-01-01 00:00 348,160 --a------ C:\WINDOWS\system32\msvcr71.dll
2007-11-21 20:17 . 2007-03-03 23:24 10,752 --a------ C:\WINDOWS\system32\ff_vfw.dll
2007-11-21 20:17 . 2007-03-03 23:24 6,144 --a------ C:\WINDOWS\system32\ff_acm.acm
2007-11-21 20:17 . 2007-01-01 00:00 547 --a------ C:\WINDOWS\system32\ff_vfw.dll.manifest
2007-11-21 20:16 . 2007-11-26 23:43 d-------- C:\Program Files\Real Alternative
2007-11-21 20:16 . 2007-11-21 20:16 d-------- C:\Program Files\Media Player Classic
2007-11-21 20:13 . 2007-11-21 20:13 d-------- C:\WINDOWS\system32\Adobe
2007-11-21 20:13 . 2007-11-21 20:13 d-------- C:\WINDOWS\Profiles
2007-11-21 20:13 . 2007-11-23 18:45 d-------- C:\Program Files\Common Files\LightScribe
2007-11-21 20:13 . 2007-11-22 11:57 d-------- C:\Program Files\Common Files\Adobe
2007-11-21 20:13 . 2007-11-21 20:13 d-------- C:\Documents and Settings\Karol\Dane aplikacji\InterTrust
2007-11-21 20:13 . 1998-10-29 15:45 306,688 --a------ C:\WINDOWS\IsUninst.exe
2007-11-21 20:11 . 2007-11-21 20:11 d-------- C:\Program Files\Common Files\Ahead
2007-11-21 20:11 . 2007-11-21 20:11 d-------- C:\Program Files\Ahead
2007-11-21 20:10 . 2007-11-21 20:10 d-------- C:\Program Files\CyberLink
2007-11-21 20:09 . 2007-11-21 20:10 d-------- C:\Program Files\CyberLink DVD Solution
2007-11-21 20:09 . 2004-10-01 15:00 40,960 --a------ C:\Program Files\Uninstall_CDS.exe
2007-11-21 20:05 . 2006-09-13 19:14 3,072 --a------ C:\WINDOWS\system32\drivers\audstub.sys
2007-11-21 20:04 . 2006-09-13 19:18 58,624 --a------ C:\WINDOWS\system32\drivers\redbook.sys
2007-11-21 20:04 . 2006-09-13 19:15 6,400 --a------ C:\WINDOWS\system32\drivers\enum1394.sys
2007-11-21 20:03 . 2007-11-21 20:04 d-------- C:\Program Files\Winamp
2007-11-21 20:03 . 2007-11-21 20:04 d-------- C:\Documents and Settings\Karol\Dane aplikacji\Winamp
2007-11-21 20:02 . 2007-11-21 20:02 d-------- C:\WINDOWS\system32\Lang
2007-11-21 20:02 . 2007-12-05 18:53 dr-h----- C:\Documents and Settings\Default User\Ustawienia lokalne
2007-11-21 20:02 . 2007-11-21 20:02 d-------- C:\Documents and Settings\Default User\Ulubione
2007-11-21 20:02 . 2007-11-21 19:09 d--h----- C:\Documents and Settings\Default User\Szablony
2007-11-21 20:02 . 2007-11-21 20:02 d-------- C:\Documents and Settings\Default User\Pulpit
2007-11-21 20:02 . 2007-11-21 20:02 d-------- C:\Documents and Settings\Default User\Moje dokumenty
2007-11-21 20:02 . 2007-11-21 20:02 dr------- C:\Documents and Settings\Default User\Menu Start
2007-11-21 20:02 . 2007-11-21 20:02 d-------- C:\Documents and Settings\All Users\Ulubione
2007-11-21 20:02 . 2007-11-21 20:02 d--h----- C:\Documents and Settings\All Users\Szablony
2007-11-21 20:02 . 2007-12-05 18:50 d-------- C:\Documents and Settings\All Users\Pulpit
2007-11-21 20:02 . 2007-12-05 18:53 dr------- C:\Documents and Settings\All Users\Menu Start

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-11-27 17:48 --------- d--h--w C:\Program Files\InstallShield Installation Information
2007-11-21 19:09 --------- d-----w C:\Program Files\Common Files\InstallShield
2007-11-21 18:59 --------- d-----w C:\Program Files\Realtek
2007-11-21 18:58 --------- d-----w C:\Program Files\microsoft frontpage
2007-11-21 18:39 --------- d-----w C:\Program Files\NVIDIA Corporation
2007-11-21 18:11 --------- d-----w C:\Program Files\Usługi online
2007-11-02 05:52 2,644,480 ----a-w C:\WINDOWS\system32\drivers\ati2mtag.sys
2007-11-02 03:22 49,152 ----a-w C:\WINDOWS\system32\drivers\ati2erec.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.exe" []
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 17:24]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SkyTel"="SkyTel.EXE" [2006-05-16 11:04 C:\WINDOWS\SkyTel.exe]
"RTHDCPL"="RTHDCPL.EXE" [2006-08-14 07:00 C:\WINDOWS\RTHDCPL.exe]
"WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2007-10-10 06:28]
"RemoteControl"="C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe" [2004-11-02 20:24]
"InCD"="C:\Program Files\Ahead\InCD\InCD.exe" [2006-11-02 07:55]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 10:50]
"DAEMON Tools"="C:\Program Files\DAEMON Tools\daemon.exe" [2005-12-10 15:57]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11]
"StartCCC"="C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2006-11-10 11:35]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-06-29 06:24]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-12-04 14:00]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 00:44]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\sqogatuj]
sqogatuj.dll


.
Contents of the 'Scheduled Tasks' folder
"2007-11-28 20:08:00 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
.
**************************************************************************

catchme 0.3.1318 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-12-05 18:54:58
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-12-05 18:55:28 - machine was rebooted
.
--- E O F ---


SAMSUNG :))

Subaru to coś więcej niż tylko samochód...
Dołączona grafika

#6 Gutek

Gutek

    Uczestnik HotZlotu

  • Użytkownicy
  • 27006 postów

Napisano 05.12.2007 - 22:27

Wklej do Notatnika:

File::
C:\WINDOWS\system32\codcuhep.ini
C:\WINDOWS\system32\frigltcj.ini
C:\WINDOWS\system32\luujmxmo.ini
C:\WINDOWS\system32\lrtbtufp.ini
C:\WINDOWS\system32\xagwaseh.ini

Registry::
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\sqogatuj]

>>Plik>>Zapisz jako... >>> CFScript (najwygodniej będzie, jeśli zapiszesz w takiej lokalizacji, by ikonka CFScript.txt znalazła się obok ikonki ComboFix.exe)
Przeciągnij i upuść plik CFScript.txt na plik ComboFix.exe (czyli ikonkę CFScript.txt na ikonkę ComboFix.exe)
– podobnie jak na tym obrazku -->Dołączona grafika
(jeśli pojawi się pytanie "1 or 2" - to wpisz 1 i naciśnij ENTER) Ma się rozpocząć usuwanie. (i powstanie log)
Po restarcie usuń ręcznie folder C: \Qoobox.
Po tym nowy log z Combo
Walka do końca, nie format :-)
Proszę nie pisać na PW odpowiem na forum - dziękuję :-)

#7 1kalor

1kalor
  • Użytkownicy
  • 445 postów

Napisano 06.12.2007 - 17:53

witaj,
po tym przeniesieniu i restarcie wyszło mi takie coś

ComboFix 07-12-04.3 - Karol 2007-12-06 17:50:14.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.623 [GMT 1:00]
Running from: C:\Documents and Settings\Karol\Pulpit\ComboFix.exe
Command switches used :: C:\Documents and Settings\Karol\Pulpit\CFScript.txt
* Created a new restore point

FILE
C:\WINDOWS\system32\codcuhep.ini
C:\WINDOWS\system32\frigltcj.ini
C:\WINDOWS\system32\lrtbtufp.ini
C:\WINDOWS\system32\luujmxmo.ini
C:\WINDOWS\system32\xagwaseh.ini
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\system32\codcuhep.ini
C:\WINDOWS\system32\frigltcj.ini
C:\WINDOWS\system32\lrtbtufp.ini
C:\WINDOWS\system32\luujmxmo.ini
C:\WINDOWS\system32\xagwaseh.ini

.
((((((((((((((((((((((((( Files Created from 2007-11-06 to 2007-12-06 )))))))))))))))))))))))))))))))
.

2007-12-05 18:44 . 2007-12-05 18:50

d-------- C:\VundoFix Backups
2007-12-05 17:11 . 2007-12-05 17:12 d-------- C:\Program Files\Picasa2
2007-12-05 17:11 . 2007-12-05 17:11 d-------- C:\Program Files\Google
2007-12-04 23:17 . 2007-12-04 23:17 d-------- C:\Program Files\Trend Micro
2007-12-02 13:33 . 2007-12-02 13:33 d-------- C:\Documents and Settings\Karol\Contacts
2007-12-02 13:32 . 2007-12-02 13:35 d----c--- C:\WINDOWS\system32\DRVSTORE
2007-12-02 13:32 . 2007-12-02 13:32 d-------- C:\Program Files\Real
2007-12-02 13:32 . 2007-12-02 13:32 268 --ah----- C:\sqmdata00.sqm
2007-12-02 13:32 . 2007-12-02 13:32 244 --ah----- C:\sqmnoopt00.sqm
2007-12-01 21:20 . 2007-12-01 21:20 d-------- C:\Documents and Settings\Karol\Dane aplikacji\Gadu-Gadu
2007-12-01 20:58 . 2007-12-01 20:58 d-------- C:\Program Files\MoorHunt
2007-12-01 20:44 . 2007-12-01 20:45 d-------- C:\Documents and Settings\Karol\Gadu-Gadu
2007-11-29 18:23 . 2004-10-07 13:39 89,088 --a------ C:\WINDOWS\system32\atl71.dll
2007-11-29 18:23 . 2001-03-08 18:30 24,064 --a------ C:\WINDOWS\system32\msxml3a.dll
2007-11-29 18:02 . 2007-12-04 14:04 837,496 --a------ C:\WINDOWS\system32\aswBoot.exe
2007-11-29 18:02 . 2004-01-09 10:13 380,928 --a------ C:\WINDOWS\system32\actskin4.ocx
2007-11-29 18:02 . 2007-12-04 13:54 95,608 --a------ C:\WINDOWS\system32\AVASTSS.scr
2007-11-29 18:02 . 2007-12-04 15:55 94,544 --a------ C:\WINDOWS\system32\drivers\aswmon2.sys
2007-11-29 18:02 . 2007-12-04 15:56 93,264 --a------ C:\WINDOWS\system32\drivers\aswmon.sys
2007-11-29 18:02 . 2007-12-04 15:51 42,912 --a------ C:\WINDOWS\system32\drivers\aswTdi.sys
2007-11-29 18:02 . 2007-12-04 15:49 26,624 --a------ C:\WINDOWS\system32\drivers\aavmker4.sys
2007-11-29 18:02 . 2007-12-04 15:53 23,152 --a------ C:\WINDOWS\system32\drivers\aswRdr.sys
2007-11-27 19:06 . 2007-12-05 21:37 107,832 --a------ C:\WINDOWS\system32\PnkBstrB.exe
2007-11-27 19:06 . 2007-12-05 21:37 22,328 --a------ C:\WINDOWS\system32\drivers\PnkBstrK.sys
2007-11-27 19:05 . 2007-11-27 19:05 d-------- C:\WINDOWS\system32\LogFiles
2007-11-27 19:05 . 2007-11-27 23:43 66,872 --a------ C:\WINDOWS\system32\PnkBstrA.exe
2007-11-27 18:25 . 2007-11-30 20:48 d-------- C:\Program Files\The All-Seeing Eye
2007-11-26 23:49 . 2007-12-05 20:30 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2007-11-26 23:49 . 2007-11-26 23:49 1,409 --a------ C:\WINDOWS\QTFont.for
2007-11-26 23:43 . 2007-11-26 23:44 d-------- C:\Program Files\QuickTime
2007-11-26 23:43 . 2007-11-26 23:43 d-------- C:\Program Files\Apple Software Update
2007-11-26 23:43 . 2007-11-26 23:43 d-------- C:\Documents and Settings\All Users\Dane aplikacji\Apple Computer
2007-11-26 23:43 . 2007-11-26 23:43 d-------- C:\Documents and Settings\All Users\Dane aplikacji\Apple
2007-11-26 21:12 . 2007-11-26 21:12 252 --a------ C:\WINDOWS\game.ini
2007-11-26 20:07 . 2007-11-26 20:07 d--hs---- C:\WINDOWS\ftpcache
2007-11-26 19:44 . 2007-11-26 19:45 d-------- C:\Program Files\ATI Technologies
2007-11-26 19:44 . 2007-11-01 21:05 593,920 --------- C:\WINDOWS\system32\ati2sgag.exe
2007-11-25 19:24 . 2007-11-25 19:24 d-------- C:\Documents and Settings\Karol\Dane aplikacji\Media Player Classic
2007-11-25 15:21 . 2007-11-25 15:21 d-------- C:\Program Files\Java
2007-11-25 15:21 . 2007-09-24 23:31 69,632 --a------ C:\WINDOWS\system32\javacpl.cpl
2007-11-25 15:19 . 2007-11-25 15:19 d-------- C:\Program Files\Common Files\Java
2007-11-23 19:48 . 2007-10-25 17:44 8,488,960 -----c--- C:\WINDOWS\system32\dllcache\shell32.dll
2007-11-23 19:47 . 2007-07-09 14:20 582,656 -----c--- C:\WINDOWS\system32\dllcache\rpcrt4.dll
2007-11-23 19:47 . 2007-04-02 07:37 546,304 -----c--- C:\WINDOWS\system32\dllcache\hhctrl.ocx
2007-11-22 21:06 . 2004-08-03 23:08 26,496 --a--c--- C:\WINDOWS\system32\dllcache\usbstor.sys
2007-11-21 21:26 . 2007-11-29 22:40 d-------- C:\Program Files\Save
2007-11-21 21:21 . 2007-11-21 21:21 d-------- C:\Program Files\DivX
2007-11-21 20:47 . 2007-12-05 21:03 69 --a------ C:\WINDOWS\NeroDigital.ini
2007-11-21 20:42 . 2007-11-25 15:51 1,542 --a------ C:\WINDOWS\mozver.dat
2007-11-21 20:36 . 2007-11-21 20:36 0 --a------ C:\WINDOWS\nsreg.dat
2007-11-21 20:22 . 2007-11-29 22:39 d-------- C:\Program Files\DAEMON Tools
2007-11-21 20:22 . 2007-11-21 20:22 223,128 --a------ C:\WINDOWS\system32\drivers\dtscsi.sys
2007-11-21 20:20 . 2007-11-21 20:20 642,560 --a------ C:\WINDOWS\system32\drivers\sptd.sys
2007-11-21 20:20 . 2007-11-21 20:20 96,256 --a------ C:\WINDOWS\system32\drivers\sptd6877.sys
2007-11-21 20:19 . 2007-11-21 20:19 d-------- C:\WINDOWS\system32\Futuremark
2007-11-21 20:19 . 2007-11-21 20:19 d-------- C:\Program Files\Futuremark
2007-11-21 20:19 . 2004-10-25 20:02 21,664 --a------ C:\WINDOWS\system32\drivers\Entech.sys
2007-11-21 20:19 . 2001-11-19 18:05 3,972 --------- C:\WINDOWS\system32\drivers\PciBus.sys
2007-11-21 20:18 . 2007-11-21 20:18 d-------- C:\Program Files\Alwil Software
2007-11-21 20:18 . 2003-03-18 21:20 1,060,864 --a------ C:\WINDOWS\system32\MFC71.dll
2007-11-21 20:17 . 2007-11-26 23:44 d-------- C:\Program Files\ffdshow
2007-11-21 20:17 . 2007-01-01 00:00 499,712 --a------ C:\WINDOWS\system32\msvcp71.dll
2007-11-21 20:17 . 2007-01-01 00:00 348,160 --a------ C:\WINDOWS\system32\msvcr71.dll
2007-11-21 20:17 . 2007-03-03 23:24 10,752 --a------ C:\WINDOWS\system32\ff_vfw.dll
2007-11-21 20:17 . 2007-03-03 23:24 6,144 --a------ C:\WINDOWS\system32\ff_acm.acm
2007-11-21 20:17 . 2007-01-01 00:00 547 --a------ C:\WINDOWS\system32\ff_vfw.dll.manifest
2007-11-21 20:16 . 2007-11-26 23:43 d-------- C:\Program Files\Real Alternative
2007-11-21 20:16 . 2007-11-21 20:16 d-------- C:\Program Files\Media Player Classic
2007-11-21 20:13 . 2007-11-21 20:13 d-------- C:\WINDOWS\system32\Adobe
2007-11-21 20:13 . 2007-11-21 20:13 d-------- C:\WINDOWS\Profiles
2007-11-21 20:13 . 2007-11-23 18:45 d-------- C:\Program Files\Common Files\LightScribe
2007-11-21 20:13 . 2007-11-22 11:57 d-------- C:\Program Files\Common Files\Adobe
2007-11-21 20:13 . 2007-11-21 20:13 d-------- C:\Documents and Settings\Karol\Dane aplikacji\InterTrust
2007-11-21 20:13 . 1998-10-29 15:45 306,688 --a------ C:\WINDOWS\IsUninst.exe
2007-11-21 20:11 . 2007-11-21 20:11 d-------- C:\Program Files\Common Files\Ahead
2007-11-21 20:11 . 2007-11-21 20:11 d-------- C:\Program Files\Ahead
2007-11-21 20:10 . 2007-11-21 20:10 d-------- C:\Program Files\CyberLink
2007-11-21 20:09 . 2007-11-21 20:10 d-------- C:\Program Files\CyberLink DVD Solution
2007-11-21 20:09 . 2004-10-01 15:00 40,960 --a------ C:\Program Files\Uninstall_CDS.exe
2007-11-21 20:05 . 2006-09-13 19:14 3,072 --a------ C:\WINDOWS\system32\drivers\audstub.sys
2007-11-21 20:04 . 2006-09-13 19:18 58,624 --a------ C:\WINDOWS\system32\drivers\redbook.sys
2007-11-21 20:04 . 2006-09-13 19:15 6,400 --a------ C:\WINDOWS\system32\drivers\enum1394.sys
2007-11-21 20:03 . 2007-11-21 20:04 d-------- C:\Program Files\Winamp
2007-11-21 20:03 . 2007-11-21 20:04 d-------- C:\Documents and Settings\Karol\Dane aplikacji\Winamp
2007-11-21 20:02 . 2007-11-21 20:02 d-------- C:\WINDOWS\system32\Lang
2007-11-21 20:02 . 2007-12-05 18:55 dr-h----- C:\Documents and Settings\Default User\Ustawienia lokalne
2007-11-21 20:02 . 2007-11-21 20:02 d-------- C:\Documents and Settings\Default User\Ulubione
2007-11-21 20:02 . 2007-11-21 19:09 d--h----- C:\Documents and Settings\Default User\Szablony
2007-11-21 20:02 . 2007-11-21 20:02 d-------- C:\Documents and Settings\Default User\Pulpit
2007-11-21 20:02 . 2007-11-21 20:02 d-------- C:\Documents and Settings\Default User\Moje dokumenty
2007-11-21 20:02 . 2007-11-21 20:02 dr------- C:\Documents and Settings\Default User\Menu Start
2007-11-21 20:02 . 2007-11-21 20:02 d-------- C:\Documents and Settings\All Users\Ulubione
2007-11-21 20:02 . 2007-11-21 20:02 d--h----- C:\Documents and Settings\All Users\Szablony
2007-11-21 20:02 . 2007-12-05 18:50 d-------- C:\Documents and Settings\All Users\Pulpit
2007-11-21 20:02 . 2007-12-05 18:53 dr------- C:\Documents and Settings\All Users\Menu Start
2007-11-21 20:02 . 2007-11-30 00:20 dr------- C:\Documents and Settings\All Users\Dokumenty
2007-11-21 20:01 . 2004-08-03 23:15 60,800 --a------ C:\WINDOWS\system32\drivers\sysaudio.sys
2007-11-21 20:01 . 2004-08-03 22:58 7,552 --a------ C:\WINDOWS\system32\drivers\MSKSSRV.sys
2007-11-21 20:01 . 2004-08-03 22:58 5,376 --a------ C:\WINDOWS\system32\drivers\MSPCLOCK.sys
2007-11-21 20:01 . 2004-08-03 22:58 4,992 --a------ C:\WINDOWS\system32\drivers\MSPQM.sys

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-11-27 17:48 --------- d--h--w C:\Program Files\InstallShield Installation Information
2007-11-21 19:09 --------- d-----w C:\Program Files\Common Files\InstallShield
2007-11-21 18:59 --------- d-----w C:\Program Files\Realtek
2007-11-21 18:58 --------- d-----w C:\Program Files\microsoft frontpage
2007-11-21 18:39 --------- d-----w C:\Program Files\NVIDIA Corporation
2007-11-21 18:11 --------- d-----w C:\Program Files\Usługi online
2007-11-02 05:52 2,644,480 ----a-w C:\WINDOWS\system32\drivers\ati2mtag.sys
2007-11-02 04:57 9,314,304 ----a-w C:\WINDOWS\system32\atioglx2.dll
2007-11-02 04:24 176,128 ----a-w C:\WINDOWS\system32\atiok3x2.dll
2007-11-02 04:10 364,544 ----a-w C:\WINDOWS\system32\ATIDEMGX.dll
2007-11-02 04:09 268,288 ----a-w C:\WINDOWS\system32\ati2dvag.dll
2007-11-02 04:01 26,112 ----a-w C:\WINDOWS\system32\Ati2mdxx.exe
2007-11-02 04:01 143,360 ----a-w C:\WINDOWS\system32\atipdlxx.dll
2007-11-02 04:01 122,880 ----a-w C:\WINDOWS\system32\Oemdspif.dll
2007-11-02 04:00 43,520 ----a-w C:\WINDOWS\system32\ati2edxx.dll
2007-11-02 04:00 122,880 ----a-w C:\WINDOWS\system32\ati2evxx.dll
2007-11-02 03:59 495,616 ----a-w C:\WINDOWS\system32\ati2evxx.exe
2007-11-02 03:58 53,248 ----a-w C:\WINDOWS\system32\ATIDDC.DLL
2007-11-02 03:50 3,133,728 ----a-w C:\WINDOWS\system32\ati3duag.dll
2007-11-02 03:39 1,602,176 ----a-w C:\WINDOWS\system32\ativvaxx.dll
2007-11-02 03:35 307,200 ----a-w C:\WINDOWS\system32\atiiiexx.dll
2007-11-02 03:26 5,435,392 ----a-w C:\WINDOWS\system32\atioglxx.dll
2007-11-02 03:24 376,832 ----a-w C:\WINDOWS\system32\atikvmag.dll
2007-11-02 03:22 49,152 ----a-w C:\WINDOWS\system32\drivers\ati2erec.dll
2007-11-02 03:22 17,408 ----a-w C:\WINDOWS\system32\atitvo32.dll
2007-11-02 03:16 499,712 ----a-w C:\WINDOWS\system32\ati2cqag.dll
2007-10-20 00:56 200,704 ----a-w C:\WINDOWS\system32\ssldivx.dll
2007-10-20 00:56 1,044,480 ----a-w C:\WINDOWS\system32\libdivx.dll
.

((((((((((((((((((((((((((((( snapshot@2007-12-05_18.55.02.45 )))))))))))))))))))))))))))))))))))))))))
.
+ 2007-12-06 16:41:43 16,384 ----atw C:\WINDOWS\Temp\Perflib_Perfdata_77c.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.exe" []
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 17:24]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SkyTel"="SkyTel.EXE" [2006-05-16 11:04 C:\WINDOWS\SkyTel.exe]
"RTHDCPL"="RTHDCPL.EXE" [2006-08-14 07:00 C:\WINDOWS\RTHDCPL.exe]
"WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2007-10-10 06:28]
"RemoteControl"="C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe" [2004-11-02 20:24]
"InCD"="C:\Program Files\Ahead\InCD\InCD.exe" [2006-11-02 07:55]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 10:50]
"DAEMON Tools"="C:\Program Files\DAEMON Tools\daemon.exe" [2005-12-10 15:57]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11]
"StartCCC"="C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2006-11-10 11:35]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-06-29 06:24]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-12-04 14:00]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 00:44]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\sqogatuj]
sqogatuj.dll

S3 USBSTOR;Sterownik magazynu masowego USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS

.
Contents of the 'Scheduled Tasks' folder
"2007-12-05 20:08:02 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
.
**************************************************************************

catchme 0.3.1318 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-12-06 17:51:00
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-12-06 17:51:26
C:\ComboFix2.txt ... 2007-12-05 18:55
.
--- E O F ---



Złączono Posta: 06.12.2007 (Czw) 17:56
ok już zrobiłem loga nowego po usunięciu tego qooo coś tam

ComboFix 07-12-04.3 - Karol 2007-12-06 17:54:34.3 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.613 [GMT 1:00]
Running from: C:\Documents and Settings\Karol\Pulpit\ComboFix.exe
.

((((((((((((((((((((((((( Files Created from 2007-11-06 to 2007-12-06 )))))))))))))))))))))))))))))))
.

2007-12-05 18:44 . 2007-12-05 18:50

d-------- C:\VundoFix Backups
2007-12-05 17:11 . 2007-12-05 17:12 d-------- C:\Program Files\Picasa2
2007-12-05 17:11 . 2007-12-05 17:11 d-------- C:\Program Files\Google
2007-12-04 23:17 . 2007-12-04 23:17 d-------- C:\Program Files\Trend Micro
2007-12-02 13:33 . 2007-12-02 13:33 d-------- C:\Documents and Settings\Karol\Contacts
2007-12-02 13:32 . 2007-12-02 13:35 d----c--- C:\WINDOWS\system32\DRVSTORE
2007-12-02 13:32 . 2007-12-02 13:32 d-------- C:\Program Files\Real
2007-12-02 13:32 . 2007-12-02 13:32 268 --ah----- C:\sqmdata00.sqm
2007-12-02 13:32 . 2007-12-02 13:32 244 --ah----- C:\sqmnoopt00.sqm
2007-12-01 21:20 . 2007-12-01 21:20 d-------- C:\Documents and Settings\Karol\Dane aplikacji\Gadu-Gadu
2007-12-01 20:58 . 2007-12-01 20:58 d-------- C:\Program Files\MoorHunt
2007-12-01 20:44 . 2007-12-01 20:45 d-------- C:\Documents and Settings\Karol\Gadu-Gadu
2007-11-29 18:23 . 2004-10-07 13:39 89,088 --a------ C:\WINDOWS\system32\atl71.dll
2007-11-29 18:23 . 2001-03-08 18:30 24,064 --a------ C:\WINDOWS\system32\msxml3a.dll
2007-11-29 18:02 . 2007-12-04 14:04 837,496 --a------ C:\WINDOWS\system32\aswBoot.exe
2007-11-29 18:02 . 2004-01-09 10:13 380,928 --a------ C:\WINDOWS\system32\actskin4.ocx
2007-11-29 18:02 . 2007-12-04 13:54 95,608 --a------ C:\WINDOWS\system32\AVASTSS.scr
2007-11-29 18:02 . 2007-12-04 15:55 94,544 --a------ C:\WINDOWS\system32\drivers\aswmon2.sys
2007-11-29 18:02 . 2007-12-04 15:56 93,264 --a------ C:\WINDOWS\system32\drivers\aswmon.sys
2007-11-29 18:02 . 2007-12-04 15:51 42,912 --a------ C:\WINDOWS\system32\drivers\aswTdi.sys
2007-11-29 18:02 . 2007-12-04 15:49 26,624 --a------ C:\WINDOWS\system32\drivers\aavmker4.sys
2007-11-29 18:02 . 2007-12-04 15:53 23,152 --a------ C:\WINDOWS\system32\drivers\aswRdr.sys
2007-11-27 19:06 . 2007-12-05 21:37 107,832 --a------ C:\WINDOWS\system32\PnkBstrB.exe
2007-11-27 19:06 . 2007-12-05 21:37 22,328 --a------ C:\WINDOWS\system32\drivers\PnkBstrK.sys
2007-11-27 19:05 . 2007-11-27 19:05 d-------- C:\WINDOWS\system32\LogFiles
2007-11-27 19:05 . 2007-11-27 23:43 66,872 --a------ C:\WINDOWS\system32\PnkBstrA.exe
2007-11-27 18:25 . 2007-11-30 20:48 d-------- C:\Program Files\The All-Seeing Eye
2007-11-26 23:49 . 2007-12-05 20:30 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2007-11-26 23:49 . 2007-11-26 23:49 1,409 --a------ C:\WINDOWS\QTFont.for
2007-11-26 23:43 . 2007-11-26 23:44 d-------- C:\Program Files\QuickTime
2007-11-26 23:43 . 2007-11-26 23:43 d-------- C:\Program Files\Apple Software Update
2007-11-26 23:43 . 2007-11-26 23:43 d-------- C:\Documents and Settings\All Users\Dane aplikacji\Apple Computer
2007-11-26 23:43 . 2007-11-26 23:43 d-------- C:\Documents and Settings\All Users\Dane aplikacji\Apple
2007-11-26 21:12 . 2007-11-26 21:12 252 --a------ C:\WINDOWS\game.ini
2007-11-26 20:07 . 2007-11-26 20:07 d--hs---- C:\WINDOWS\ftpcache
2007-11-26 19:44 . 2007-11-26 19:45 d-------- C:\Program Files\ATI Technologies
2007-11-26 19:44 . 2007-11-01 21:05 593,920 --------- C:\WINDOWS\system32\ati2sgag.exe
2007-11-25 19:24 . 2007-11-25 19:24 d-------- C:\Documents and Settings\Karol\Dane aplikacji\Media Player Classic
2007-11-25 15:21 . 2007-11-25 15:21 d-------- C:\Program Files\Java
2007-11-25 15:21 . 2007-09-24 23:31 69,632 --a------ C:\WINDOWS\system32\javacpl.cpl
2007-11-25 15:19 . 2007-11-25 15:19 d-------- C:\Program Files\Common Files\Java
2007-11-23 19:48 . 2007-10-25 17:44 8,488,960 -----c--- C:\WINDOWS\system32\dllcache\shell32.dll
2007-11-23 19:47 . 2007-07-09 14:20 582,656 -----c--- C:\WINDOWS\system32\dllcache\rpcrt4.dll
2007-11-23 19:47 . 2007-04-02 07:37 546,304 -----c--- C:\WINDOWS\system32\dllcache\hhctrl.ocx
2007-11-22 21:06 . 2004-08-03 23:08 26,496 --a--c--- C:\WINDOWS\system32\dllcache\usbstor.sys
2007-11-21 21:26 . 2007-11-29 22:40 d-------- C:\Program Files\Save
2007-11-21 21:21 . 2007-11-21 21:21 d-------- C:\Program Files\DivX
2007-11-21 20:47 . 2007-12-05 21:03 69 --a------ C:\WINDOWS\NeroDigital.ini
2007-11-21 20:42 . 2007-11-25 15:51 1,542 --a------ C:\WINDOWS\mozver.dat
2007-11-21 20:36 . 2007-11-21 20:36 0 --a------ C:\WINDOWS\nsreg.dat
2007-11-21 20:22 . 2007-11-29 22:39 d-------- C:\Program Files\DAEMON Tools
2007-11-21 20:22 . 2007-11-21 20:22 223,128 --a------ C:\WINDOWS\system32\drivers\dtscsi.sys
2007-11-21 20:20 . 2007-11-21 20:20 642,560 --a------ C:\WINDOWS\system32\drivers\sptd.sys
2007-11-21 20:20 . 2007-11-21 20:20 96,256 --a------ C:\WINDOWS\system32\drivers\sptd6877.sys
2007-11-21 20:19 . 2007-11-21 20:19 d-------- C:\WINDOWS\system32\Futuremark
2007-11-21 20:19 . 2007-11-21 20:19 d-------- C:\Program Files\Futuremark
2007-11-21 20:19 . 2004-10-25 20:02 21,664 --a------ C:\WINDOWS\system32\drivers\Entech.sys
2007-11-21 20:19 . 2001-11-19 18:05 3,972 --------- C:\WINDOWS\system32\drivers\PciBus.sys
2007-11-21 20:18 . 2007-11-21 20:18 d-------- C:\Program Files\Alwil Software
2007-11-21 20:18 . 2003-03-18 21:20 1,060,864 --a------ C:\WINDOWS\system32\MFC71.dll
2007-11-21 20:17 . 2007-11-26 23:44 d-------- C:\Program Files\ffdshow
2007-11-21 20:17 . 2007-01-01 00:00 499,712 --a------ C:\WINDOWS\system32\msvcp71.dll
2007-11-21 20:17 . 2007-01-01 00:00 348,160 --a------ C:\WINDOWS\system32\msvcr71.dll
2007-11-21 20:17 . 2007-03-03 23:24 10,752 --a------ C:\WINDOWS\system32\ff_vfw.dll
2007-11-21 20:17 . 2007-03-03 23:24 6,144 --a------ C:\WINDOWS\system32\ff_acm.acm
2007-11-21 20:17 . 2007-01-01 00:00 547 --a------ C:\WINDOWS\system32\ff_vfw.dll.manifest
2007-11-21 20:16 . 2007-11-26 23:43 d-------- C:\Program Files\Real Alternative
2007-11-21 20:16 . 2007-11-21 20:16 d-------- C:\Program Files\Media Player Classic
2007-11-21 20:13 . 2007-11-21 20:13 d-------- C:\WINDOWS\system32\Adobe
2007-11-21 20:13 . 2007-11-21 20:13 d-------- C:\WINDOWS\Profiles
2007-11-21 20:13 . 2007-11-23 18:45 d-------- C:\Program Files\Common Files\LightScribe
2007-11-21 20:13 . 2007-11-22 11:57 d-------- C:\Program Files\Common Files\Adobe
2007-11-21 20:13 . 2007-11-21 20:13 d-------- C:\Documents and Settings\Karol\Dane aplikacji\InterTrust
2007-11-21 20:13 . 1998-10-29 15:45 306,688 --a------ C:\WINDOWS\IsUninst.exe
2007-11-21 20:11 . 2007-11-21 20:11 d-------- C:\Program Files\Common Files\Ahead
2007-11-21 20:11 . 2007-11-21 20:11 d-------- C:\Program Files\Ahead
2007-11-21 20:10 . 2007-11-21 20:10 d-------- C:\Program Files\CyberLink
2007-11-21 20:09 . 2007-11-21 20:10 d-------- C:\Program Files\CyberLink DVD Solution
2007-11-21 20:09 . 2004-10-01 15:00 40,960 --a------ C:\Program Files\Uninstall_CDS.exe
2007-11-21 20:05 . 2006-09-13 19:14 3,072 --a------ C:\WINDOWS\system32\drivers\audstub.sys
2007-11-21 20:04 . 2006-09-13 19:18 58,624 --a------ C:\WINDOWS\system32\drivers\redbook.sys
2007-11-21 20:04 . 2006-09-13 19:15 6,400 --a------ C:\WINDOWS\system32\drivers\enum1394.sys
2007-11-21 20:03 . 2007-11-21 20:04 d-------- C:\Program Files\Winamp
2007-11-21 20:03 . 2007-11-21 20:04 d-------- C:\Documents and Settings\Karol\Dane aplikacji\Winamp
2007-11-21 20:02 . 2007-11-21 20:02 d-------- C:\WINDOWS\system32\Lang
2007-11-21 20:02 . 2007-12-06 17:51 dr-h----- C:\Documents and Settings\Default User\Ustawienia lokalne
2007-11-21 20:02 . 2007-11-21 20:02 d-------- C:\Documents and Settings\Default User\Ulubione
2007-11-21 20:02 . 2007-11-21 19:09 d--h----- C:\Documents and Settings\Default User\Szablony
2007-11-21 20:02 . 2007-11-21 20:02 d-------- C:\Documents and Settings\Default User\Pulpit
2007-11-21 20:02 . 2007-11-21 20:02 d-------- C:\Documents and Settings\Default User\Moje dokumenty
2007-11-21 20:02 . 2007-11-21 20:02 dr------- C:\Documents and Settings\Default User\Menu Start
2007-11-21 20:02 . 2007-11-21 20:02 d-------- C:\Documents and Settings\All Users\Ulubione
2007-11-21 20:02 . 2007-11-21 20:02 d--h----- C:\Documents and Settings\All Users\Szablony
2007-11-21 20:02 . 2007-12-05 18:50 d-------- C:\Documents and Settings\All Users\Pulpit
2007-11-21 20:02 . 2007-12-05 18:53 dr------- C:\Documents and Settings\All Users\Menu Start
2007-11-21 20:02 . 2007-11-30 00:20 dr------- C:\Documents and Settings\All Users\Dokumenty
2007-11-21 20:01 . 2004-08-03 23:15 60,800 --a------ C:\WINDOWS\system32\drivers\sysaudio.sys
2007-11-21 20:01 . 2004-08-03 22:58 7,552 --a------ C:\WINDOWS\system32\drivers\MSKSSRV.sys
2007-11-21 20:01 . 2004-08-03 22:58 5,376 --a------ C:\WINDOWS\system32\drivers\MSPCLOCK.sys
2007-11-21 20:01 . 2004-08-03 22:58 4,992 --a------ C:\WINDOWS\system32\drivers\MSPQM.sys

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-11-27 17:48 --------- d--h--w C:\Program Files\InstallShield Installation Information
2007-11-21 19:09 --------- d-----w C:\Program Files\Common Files\InstallShield
2007-11-21 18:59 --------- d-----w C:\Program Files\Realtek
2007-11-21 18:58 --------- d-----w C:\Program Files\microsoft frontpage
2007-11-21 18:39 --------- d-----w C:\Program Files\NVIDIA Corporation
2007-11-21 18:11 --------- d-----w C:\Program Files\Usługi online
2007-11-02 05:52 2,644,480 ----a-w C:\WINDOWS\system32\drivers\ati2mtag.sys
2007-11-02 04:57 9,314,304 ----a-w C:\WINDOWS\system32\atioglx2.dll
2007-11-02 04:24 176,128 ----a-w C:\WINDOWS\system32\atiok3x2.dll
2007-11-02 04:10 364,544 ----a-w C:\WINDOWS\system32\ATIDEMGX.dll
2007-11-02 04:09 268,288 ----a-w C:\WINDOWS\system32\ati2dvag.dll
2007-11-02 04:01 26,112 ----a-w C:\WINDOWS\system32\Ati2mdxx.exe
2007-11-02 04:01 143,360 ----a-w C:\WINDOWS\system32\atipdlxx.dll
2007-11-02 04:01 122,880 ----a-w C:\WINDOWS\system32\Oemdspif.dll
2007-11-02 04:00 43,520 ----a-w C:\WINDOWS\system32\ati2edxx.dll
2007-11-02 04:00 122,880 ----a-w C:\WINDOWS\system32\ati2evxx.dll
2007-11-02 03:59 495,616 ----a-w C:\WINDOWS\system32\ati2evxx.exe
2007-11-02 03:58 53,248 ----a-w C:\WINDOWS\system32\ATIDDC.DLL
2007-11-02 03:50 3,133,728 ----a-w C:\WINDOWS\system32\ati3duag.dll
2007-11-02 03:39 1,602,176 ----a-w C:\WINDOWS\system32\ativvaxx.dll
2007-11-02 03:35 307,200 ----a-w C:\WINDOWS\system32\atiiiexx.dll
2007-11-02 03:26 5,435,392 ----a-w C:\WINDOWS\system32\atioglxx.dll
2007-11-02 03:24 376,832 ----a-w C:\WINDOWS\system32\atikvmag.dll
2007-11-02 03:22 49,152 ----a-w C:\WINDOWS\system32\drivers\ati2erec.dll
2007-11-02 03:22 17,408 ----a-w C:\WINDOWS\system32\atitvo32.dll
2007-11-02 03:16 499,712 ----a-w C:\WINDOWS\system32\ati2cqag.dll
2007-10-20 00:56 200,704 ----a-w C:\WINDOWS\system32\ssldivx.dll
2007-10-20 00:56 1,044,480 ----a-w C:\WINDOWS\system32\libdivx.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.exe" []
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 17:24]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SkyTel"="SkyTel.EXE" [2006-05-16 11:04 C:\WINDOWS\SkyTel.exe]
"RTHDCPL"="RTHDCPL.EXE" [2006-08-14 07:00 C:\WINDOWS\RTHDCPL.exe]
"WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2007-10-10 06:28]
"RemoteControl"="C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe" [2004-11-02 20:24]
"InCD"="C:\Program Files\Ahead\InCD\InCD.exe" [2006-11-02 07:55]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 10:50]
"DAEMON Tools"="C:\Program Files\DAEMON Tools\daemon.exe" [2005-12-10 15:57]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11]
"StartCCC"="C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2006-11-10 11:35]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-06-29 06:24]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-12-04 14:00]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 00:44]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\sqogatuj]
sqogatuj.dll

S3 USBSTOR;Sterownik magazynu masowego USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS

.
Contents of the 'Scheduled Tasks' folder
"2007-12-05 20:08:02 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
.
**************************************************************************

catchme 0.3.1318 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-12-06 17:55:12
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-12-06 17:55:32
C:\ComboFix2.txt ... 2007-12-06 17:51
C:\ComboFix3.txt ... 2007-12-05 18:55
.
--- E O F ---


SAMSUNG :))

Subaru to coś więcej niż tylko samochód...
Dołączona grafika

#8 Gutek

Gutek

    Uczestnik HotZlotu

  • Użytkownicy
  • 27006 postów

Napisano 06.12.2007 - 18:12

Otwórz Notatnik i wklej w nim to:

Windows Registry Editor Version 5.00

[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\sqogatuj]

Plik >>> Zapisz jako >>> Zmień rozszerzenie z TXT na Wszystkie pliki >>> Zapisz pod nazwą FIX.REG >>> kliknij dwa razy na utworzony plik FIX.REG i potwierdź dodanie do rejestru >>> restart.

Skan AVG Anti-Spyware 7.5 po update + raport ;)
Walka do końca, nie format :-)
Proszę nie pisać na PW odpowiem na forum - dziękuję :-)

#9 Gutek

Gutek

    Uczestnik HotZlotu

  • Użytkownicy
  • 27006 postów

Napisano 06.12.2007 - 18:12

Otwórz Notatnik i wklej w nim to:

Windows Registry Editor Version 5.00

[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\sqogatuj]

Plik >>> Zapisz jako >>> Zmień rozszerzenie z TXT na Wszystkie pliki >>> Zapisz pod nazwą FIX.REG >>> kliknij dwa razy na utworzony plik FIX.REG i potwierdź dodanie do rejestru >>> restart.

Skan AVG Anti-Spyware 7.5 po update + raport ;)
Walka do końca, nie format :-)
Proszę nie pisać na PW odpowiem na forum - dziękuję :-)

#10 1kalor

1kalor
  • Użytkownicy
  • 445 postów

Napisano 06.12.2007 - 19:32

z avg teraz :D

---------------------------------------------------------
AVG Anti-Spyware - Scan Report
---------------------------------------------------------

+ Created at: 19:31:58 2007-12-06

+ Scan result:



HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SaveNow -> Adware.SaveNow : Ignored.
D:\SERIAL+Programy\KIS6.0.2.621PL\crack.rar/crack\Crack.exe -> Downloader.VB : Ignored.
C:\System Volume Information\_restore{D437FE3F-A25A-42FF-A7EA-277D1451263F}\RP38\A0010043.exe -> Not-A-Virus.Downloader.Win32.WinFixer.au : Ignored.
:mozilla.361:C:\Documents and Settings\Karol\Dane aplikacji\Mozilla\Firefox\Profiles\3vujjkvb.default\cookies.txt -> TrackingCookie.2o7 : Ignored.
:mozilla.362:C:\Documents and Settings\Karol\Dane aplikacji\Mozilla\Firefox\Profiles\3vujjkvb.default\cookies.txt -> TrackingCookie.2o7 : Ignored.
C:\Documents and Settings\Karol\Cookies\karol@2o7[2].txt -> TrackingCookie.2o7 : Ignored.
:mozilla.147:C:\Documents and Settings\Karol\Dane aplikacji\Mozilla\Firefox\Profiles\3vujjkvb.default\cookies.txt -> TrackingCookie.Adbrite : Ignored.
:mozilla.36:C:\Documents and Settings\Karol\Dane aplikacji\Mozilla\Firefox\Profiles\3vujjkvb.default\cookies.txt -> TrackingCookie.Adbrite : Ignored.
:mozilla.37:C:\Documents and Settings\Karol\Dane aplikacji\Mozilla\Firefox\Profiles\3vujjkvb.default\cookies.txt -> TrackingCookie.Adbrite : Ignored.
:mozilla.38:C:\Documents and Settings\Karol\Dane aplikacji\Mozilla\Firefox\Profiles\3vujjkvb.default\cookies.txt -> TrackingCookie.Adbrite : Ignored.
:mozilla.45:C:\Documents and Settings\Karol\Dane aplikacji\Mozilla\Firefox\Profiles\3vujjkvb.default\cookies.txt -> TrackingCookie.Adbrite : Ignored.
:mozilla.46:C:\Documents and Settings\Karol\Dane aplikacji\Mozilla\Firefox\Profiles\3vujjkvb.default\cookies.txt -> TrackingCookie.Adbrite : Ignored.
:mozilla.47:C:\Documents and Settings\Karol\Dane aplikacji\Mozilla\Firefox\Profiles\3vujjkvb.default\cookies.txt -> TrackingCookie.Adbrite : Ignored.
:mozilla.48:C:\Documents and Settings\Karol\Dane aplikacji\Mozilla\Firefox\Profiles\3vujjkvb.default\cookies.txt -> TrackingCookie.Adbrite : Ignored.
:mozilla.22:C:\Documents and Settings\Karol\Dane aplikacji\Mozilla\Firefox\Profiles\3vujjkvb.default\cookies.txt -> TrackingCookie.Adengage : Ignored.
:mozilla.23:C:\Documents and Settings\Karol\Dane aplikacji\Mozilla\Firefox\Profiles\3vujjkvb.default\cookies.txt -> TrackingCookie.Adengage : Ignored.
:mozilla.24:C:\Documents and Settings\Karol\Dane aplikacji\Mozilla\Firefox\Profiles\3vujjkvb.default\cookies.txt -> TrackingCookie.Adengage : Ignored.
:mozilla.181:C:\Documents and Settings\Karol\Dane aplikacji\Mozilla\Firefox\Profiles\3vujjkvb.default\cookies.txt -> TrackingCookie.Atdmt : Ignored.
:mozilla.137:C:\Documents and Settings\Karol\Dane aplikacji\Mozilla\Firefox\Profiles\3vujjkvb.default\cookies.txt -> TrackingCookie.Bbmedia : Ignored.
:mozilla.217:C:\Documents and Settings\Karol\Dane aplikacji\Mozilla\Firefox\Profiles\3vujjkvb.default\cookies.txt -> TrackingCookie.Clickzs : Ignored.
:mozilla.221:C:\Documents and Settings\Karol\Dane aplikacji\Mozilla\Firefox\Profiles\3vujjkvb.default\cookies.txt -> TrackingCookie.Clickzs : Ignored.
:mozilla.139:C:\Documents and Settings\Karol\Dane aplikacji\Mozilla\Firefox\Profiles\3vujjkvb.default\cookies.txt -> TrackingCookie.Doubleclick : Ignored.
C:\Documents and Settings\Karol\Cookies\karol@doubleclick[1].txt -> TrackingCookie.Doubleclick : Ignored.
:mozilla.297:C:\Documents and Settings\Karol\Dane aplikacji\Mozilla\Firefox\Profiles\3vujjkvb.default\cookies.txt -> TrackingCookie.Googleadservices : Ignored.
:mozilla.310:C:\Documents and Settings\Karol\Dane aplikacji\Mozilla\Firefox\Profiles\3vujjkvb.default\cookies.txt -> TrackingCookie.Googleadservices : Ignored.
:mozilla.333:C:\Documents and Settings\Karol\Dane aplikacji\Mozilla\Firefox\Profiles\3vujjkvb.default\cookies.txt -> TrackingCookie.Googleadservices : Ignored.
:mozilla.342:C:\Documents and Settings\Karol\Dane aplikacji\Mozilla\Firefox\Profiles\3vujjkvb.default\cookies.txt -> TrackingCookie.Googleadservices : Ignored.
:mozilla.330:C:\Documents and Settings\Karol\Dane aplikacji\Mozilla\Firefox\Profiles\3vujjkvb.default\cookies.txt -> TrackingCookie.Hitbox : Ignored.
:mozilla.331:C:\Documents and Settings\Karol\Dane aplikacji\Mozilla\Firefox\Profiles\3vujjkvb.default\cookies.txt -> TrackingCookie.Hitbox : Ignored.
:mozilla.332:C:\Documents and Settings\Karol\Dane aplikacji\Mozilla\Firefox\Profiles\3vujjkvb.default\cookies.txt -> TrackingCookie.Hitbox : Ignored.
:mozilla.213:C:\Documents and Settings\Karol\Dane aplikacji\Mozilla\Firefox\Profiles\3vujjkvb.default\cookies.txt -> TrackingCookie.Idot : Ignored.
:mozilla.349:C:\Documents and Settings\Karol\Dane aplikacji\Mozilla\Firefox\Profiles\3vujjkvb.default\cookies.txt -> TrackingCookie.Imrworldwide : Ignored.
:mozilla.350:C:\Documents and Settings\Karol\Dane aplikacji\Mozilla\Firefox\Profiles\3vujjkvb.default\cookies.txt -> TrackingCookie.Imrworldwide : Ignored.
C:\Documents and Settings\Karol\Cookies\karol@auto.search.msn[2].txt -> TrackingCookie.Msn : Ignored.
:mozilla.68:C:\Documents and Settings\Karol\Dane aplikacji\Mozilla\Firefox\Profiles\3vujjkvb.default\cookies.txt -> TrackingCookie.Netflame : Ignored.
:mozilla.259:C:\Documents and Settings\Karol\Dane aplikacji\Mozilla\Firefox\Profiles\3vujjkvb.default\cookies.txt -> TrackingCookie.Planetactive : Ignored.
:mozilla.175:C:\Documents and Settings\Karol\Dane aplikacji\Mozilla\Firefox\Profiles\3vujjkvb.default\cookies.txt -> TrackingCookie.Serving-sys : Ignored.
:mozilla.176:C:\Documents and Settings\Karol\Dane aplikacji\Mozilla\Firefox\Profiles\3vujjkvb.default\cookies.txt -> TrackingCookie.Serving-sys : Ignored.
:mozilla.177:C:\Documents and Settings\Karol\Dane aplikacji\Mozilla\Firefox\Profiles\3vujjkvb.default\cookies.txt -> TrackingCookie.Serving-sys : Ignored.
:mozilla.178:C:\Documents and Settings\Karol\Dane aplikacji\Mozilla\Firefox\Profiles\3vujjkvb.default\cookies.txt -> TrackingCookie.Serving-sys : Ignored.
:mozilla.179:C:\Documents and Settings\Karol\Dane aplikacji\Mozilla\Firefox\Profiles\3vujjkvb.default\cookies.txt -> TrackingCookie.Serving-sys : Ignored.
:mozilla.180:C:\Documents and Settings\Karol\Dane aplikacji\Mozilla\Firefox\Profiles\3vujjkvb.default\cookies.txt -> TrackingCookie.Serving-sys : Ignored.
:mozilla.183:C:\Documents and Settings\Karol\Dane aplikacji\Mozilla\Firefox\Profiles\3vujjkvb.default\cookies.txt -> TrackingCookie.Serving-sys : Ignored.
:mozilla.192:C:\Documents and Settings\Karol\Dane aplikacji\Mozilla\Firefox\Profiles\3vujjkvb.default\cookies.txt -> TrackingCookie.Sexlist : Ignored.
:mozilla.193:C:\Documents and Settings\Karol\Dane aplikacji\Mozilla\Firefox\Profiles\3vujjkvb.default\cookies.txt -> TrackingCookie.Sexlist : Ignored.
:mozilla.117:C:\Documents and Settings\Karol\Dane aplikacji\Mozilla\Firefox\Profiles\3vujjkvb.default\cookies.txt -> TrackingCookie.Tradedoubler : Ignored.
:mozilla.118:C:\Documents and Settings\Karol\Dane aplikacji\Mozilla\Firefox\Profiles\3vujjkvb.default\cookies.txt -> TrackingCookie.Tradedoubler : Ignored.
:mozilla.120:C:\Documents and Settings\Karol\Dane aplikacji\Mozilla\Firefox\Profiles\3vujjkvb.default\cookies.txt -> TrackingCookie.Tradedoubler : Ignored.
:mozilla.123:C:\Documents and Settings\Karol\Dane aplikacji\Mozilla\Firefox\Profiles\3vujjkvb.default\cookies.txt -> TrackingCookie.Tradedoubler : Ignored.
C:\Documents and Settings\Karol\Cookies\karol@tradedoubler[2].txt -> TrackingCookie.Tradedoubler : Ignored.
:mozilla.172:C:\Documents and Settings\Karol\Dane aplikacji\Mozilla\Firefox\Profiles\3vujjkvb.default\cookies.txt -> TrackingCookie.Tribalfusion : Ignored.


::Report end


SAMSUNG :))

Subaru to coś więcej niż tylko samochód...
Dołączona grafika

#11 Gutek

Gutek

    Uczestnik HotZlotu

  • Użytkownicy
  • 27006 postów

Napisano 06.12.2007 - 20:19

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SaveNow -> Adware.SaveNow : Ignored.
D:\SERIAL+Programy\KIS6.0.2.621PL\crack.rar/crack\Crack.exe -> Downloader.VB : Ignored.

:x
Regulamin - temat zamykam, nie dziwota, że syf łapiecie jak po warezowych stronach itp. chodzicie :(
Walka do końca, nie format :-)
Proszę nie pisać na PW odpowiem na forum - dziękuję :-)