Blue screen przy starcie systemu

system · 28 Grudzień 2008 12:03

Od paru dni przy próbie otwarcia jednego z dyskow wyskakiwal mi blue screen i system sie resetowal. Teraz ten problem bardziej sie poglebil i przy starcie systemu wyskakuje mi ten blad doczytalem sie ze chodzi o plik klif.sys. Prosze o szybka pomoc.

Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 12:01:33, on 2008-12-28 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe D:\wywalicto\adaware\aawservice.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Java\jre1.5.0\bin\jusched.exe C:\WINDOWS\system32\hkcmd.exe C:\Program Files\Synaptics\SynTP\SynTPLpr.exe C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\Program Files\dvd43\dvd43_tray.exe C:\Program Files\Samsung\Samsung Media Studio 5\SMSTray.exe C:\Program Files\MarkAny\ContentSafer\MAAgent.exe C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Common Files\Nero\Lib\NMBgMonitor.exe C:\Program Files\Messenger\msmsgs.exe C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleil.exe C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe C:\Program Files\ivo\UniSpiker-2.6\uni_spiker-2.6.exe C:\Program Files\Common Files\Teleca Shared\Generic.exe C:\Program Files\Sony Ericsson\Mobile2\Mobile Phone Monitor\epmworker.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe C:\Program Files\Microsoft SQL Server\MSSQL\Binn\sqlservr.exe C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe D:\wywalicto\mozilla\firefox.exe D:\wywalicto\hj\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.gazetawyborcza.pl/0,0.html?p=4 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - D:\wywalicto\BitComet\tools\BitCometBHO_1.2.8.7.dll O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - D:\WYWALI~1\spybot\SPYBOT~1\SDHelper.dll O4 - HKLM…\Run: [sunJavaUpdateSched] C:\Program Files\Java\jre1.5.0\bin\jusched.exe O4 - HKLM…\Run: [igfxTray] C:\WINDOWS\system32\igfxtray.exe O4 - HKLM…\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe O4 - HKLM…\Run: [synTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe O4 - HKLM…\Run: [synTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe O4 - HKLM…\Run: [dvd43] C:\Program Files\dvd43\dvd43_tray.exe O4 - HKLM…\Run: [NeroFilterCheck] C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe O4 - HKLM…\Run: [NBKeyScan] “C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe” O4 - HKLM…\Run: [sMSTray] C:\Program Files\Samsung\Samsung Media Studio 5\SMSTray.exe O4 - HKLM…\Run: [MAAgent] C:\Program Files\MarkAny\ContentSafer\MAAgent.exe O4 - HKLM…\Run: [sony Ericsson PC Suite] “C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe” /startoptions O4 - HKLM…\Run: [VVSN] C:\Program Files\VVSN\VVSN.exe O4 - HKLM…\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k O4 - HKLM…\Run: [LXCGCATS] rundll32 C:\WINDOWS\system32\spool\DRIVERS\W32X86\3\LXCGtime.dll,_RunDLLEntry@16 O4 - HKCU…\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU…\Run: [bgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] “C:\Program Files\Common Files\Nero\Lib\NMBgMonitor.exe” O4 - HKCU…\Run: [MSMSGS] “C:\Program Files\Messenger\msmsgs.exe” /background O4 - HKCU…\Run: [vamsoft] C:\WINDOWS\system32\vamsoft.exe O4 - HKUS\S-1-5-19…\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User ‘USŁUGA LOKALNA’) O4 - HKUS\S-1-5-20…\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User ‘USŁUGA SIECIOWA’) O4 - HKUS\S-1-5-18…\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User ‘SYSTEM’) O4 - HKUS.DEFAULT…\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User ‘Default user’) O4 - Startup: UniSpiker-2.6.lnk = ? O4 - Global Startup: BlueSoleil.lnk = ? O4 - Global Startup: Service Manager.lnk = C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE12\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0\bin\npjpi150.dll O9 - Extra ‘Tools’ menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0\bin\npjpi150.dll O9 - Extra button: Titan Poker - {49783ED4-258D-4f9f-BE11-137C18D3E543} - C:\Poker\Titan Poker\casino.exe O9 - Extra ‘Tools’ menuitem: Titan Poker - {49783ED4-258D-4f9f-BE11-137C18D3E543} - C:\Poker\Titan Poker\casino.exe O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - D:\wywalicto\party\PartyPoker\RunApp.exe O9 - Extra ‘Tools’ menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - D:\wywalicto\party\PartyPoker\RunApp.exe O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://D:\wywalicto\BitComet\tools\BitCometBHO_1.2.8.7.dll/206 (file missing) O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - D:\WYWALI~1\spybot\SPYBOT~1\SDHelper.dll O9 - Extra ‘Tools’ menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - D:\WYWALI~1\spybot\SPYBOT~1\SDHelper.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra ‘Tools’ menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {68282C51-9459-467B-95BF-3C0E89627E55} (MksSkanerOnline Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - D:\wywalicto\adaware\aawservice.exe O23 - Service: BlueSoleil Hid Service - Unknown owner - C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe O23 - Service: lxcg_device - - C:\WINDOWS\system32\lxcgcoms.exe O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe – End of file - 6715 bytes

MichaelP · 28 Grudzień 2008 12:08

Fix w HijackThis. Instrukcja viewtopic.php?f=16&t=36654

Podaj log z Combofix. Instrukcja viewtopic.php?f=16&t=36654

Wirus.

system · 28 Grudzień 2008 13:10

Log z ComboFixa

ComboFix 08-12-26.03 - nowy 2008-12-28 13:54:51.1 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.2.1250.1.1045.18.246.62 [GMT 1:00] Uruchomiony z: c:\documents and settings\nowy\Pulpit\ComboFix.exe * Utworzono nowy punkt przywracania . ((((((((((((((((((((((((((((((((((((((( Usunięto ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\autorun.inf c:\documents and settings\All Users\Dane aplikacji\Microsoft\Network\Downloader\qmgr0.dat c:\documents and settings\All Users\Dane aplikacji\Microsoft\Network\Downloader\qmgr1.dat c:\documents and settings\gośka\Dane aplikacji\hidires c:\documents and settings\gośka\Dane aplikacji\hidires\hidr.exe c:\documents and settings\gośka\Dane aplikacji\hidires\m_hook.sys c:\recycled\Recycled c:\windows\exefld D:\Autorun.inf ----- BITS: Możliwe zainfekowane strony ----- hxxp://www.photoshow.com . ((((((((((((((((((((((((((((((((((((((( Sterowniki/Usługi ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Legacy_M_HOOK -------\Service_m_hook ((((((((((((((((((((((((( Pliki utworzone od 2008-11-28 do 2008-12-28 ))))))))))))))))))))))))))))))) . 2008-12-28 12:46 . 2008-12-28 12:46 2008-12-28 12:35 . 2008-12-28 12:35 85,504 -r-hs---- c:\windows\system32\vbsdfe2.dll 2008-12-28 12:14 . 2008-12-28 12:14 2008-12-28 12:14 . 2008-12-28 12:14 2008-12-28 12:14 . 2008-12-28 12:14 2008-12-28 12:14 . 2008-12-03 19:52 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys 2008-12-28 12:14 . 2008-12-03 19:52 15,504 --a------ c:\windows\system32\drivers\mbam.sys 2008-12-28 03:33 . 2008-12-28 03:33 2008-12-27 11:59 . 2008-12-27 12:32 2008-12-26 18:10 . 2008-12-26 19:09 2008-12-25 12:57 . 2008-12-25 12:57 2008-12-25 12:56 . 2008-12-25 12:56 2008-12-25 09:50 . 2008-12-25 09:50 249,344 --a------ C:\SUCKPASS.exe 2008-12-25 09:50 . 2008-12-25 09:50 112 --a------ c:\windows\system32\SUCK.sys 2008-12-24 23:43 . 2008-12-24 23:43 2008-12-24 23:43 . 2008-12-24 23:43 2008-12-24 23:37 . 2008-12-28 12:34 85,504 --------- c:\windows\system32\vbsdfe1.dll 2008-12-24 23:31 . 2008-12-24 23:31 2008-12-24 21:13 . 2008-12-24 23:31 2008-12-24 20:31 . 2008-12-25 00:03 2008-12-24 20:25 . 2008-12-25 00:02 2008-12-24 15:05 . 2008-12-25 09:50 108,032 --a------ c:\windows\tcpsrv2.exe 2008-12-24 15:04 . 2008-12-25 03:24 365,262 --a------ C:\boots.exe 2008-12-24 15:04 . 2008-12-25 09:50 24,576 --a------ c:\windows\tcpsrv1.exe 2008-12-24 15:04 . 2008-12-25 09:50 78 --a------ c:\windows\system32\dboy1.sys 2008-12-24 15:04 . 2008-12-25 09:50 77 --a------ c:\windows\system32\dboy2.sys 2008-12-24 15:04 . 2008-12-25 03:23 61 --a------ c:\windows\system32\dboy.sys 2008-12-24 14:50 . 2008-12-24 14:58 2008-12-24 14:14 . 2008-12-24 14:14 2008-12-24 13:56 . 2008-12-27 21:30 2008-12-24 13:47 . 2008-12-28 11:49 85,504 --------- c:\windows\system32\vbsdfe0.dll 2008-12-24 13:41 . 2008-12-24 13:41 2008-12-24 13:40 . 2008-12-24 13:40 2008-12-24 13:40 . 2008-12-24 13:40 2008-12-24 13:39 . 2007-11-18 14:52 2008-12-24 13:39 . 2008-12-24 13:40 2008-12-24 13:39 . 2007-11-18 13:51 2008-12-24 13:39 . 2008-12-28 13:50 2008-12-24 13:39 . 2008-12-26 02:33 2008-12-24 13:39 . 2008-12-24 13:55 2008-12-24 13:39 . 2008-12-28 12:46 2008-12-24 13:39 . 2008-12-24 13:56 . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-12-24 14:09 --------- d-----w c:\program files\DAEMON Tools 2008-12-24 11:03 --------- d-----w c:\program files\Lx_cats 2008-11-28 13:11 --------- d-----w c:\documents and settings\gośka\Dane aplikacji\foobar2000 2008-11-28 13:11 --------- d-----w c:\documents and settings\gośka\Dane aplikacji\foobar2000 2008-11-11 15:31 --------- d-----w c:\documents and settings\gośka\Dane aplikacji\wsInspector 2008-11-11 15:31 --------- d-----w c:\documents and settings\gośka\Dane aplikacji\wsInspector 2008-11-02 18:57 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\DVD Shrink 2008-10-04 16:14 255 ----a-w c:\program files\AskTBar.rar . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “CTFMON.EXE”=“c:\windows\system32\ctfmon.exe” [2004-08-04 15360] “SpybotSD TeaTimer”=“d:\wywalicto\spybot\Spybot - Search & Destroy\TeaTimer.exe” [2008-09-16 1833296] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “SunJavaUpdateSched”=“c:\program files\Java\jre1.5.0\bin\jusched.exe” [2007-11-18 36972] “IgfxTray”=“c:\windows\system32\igfxtray.exe” [2004-12-01 155648] “HotKeysCmds”=“c:\windows\system32\hkcmd.exe” [2004-12-01 126976] “SynTPLpr”=“c:\program files\Synaptics\SynTP\SynTPLpr.exe” [2004-10-08 98394] “SynTPEnh”=“c:\program files\Synaptics\SynTP\SynTPEnh.exe” [2004-10-08 688218] “dvd43”=“c:\program files\dvd43\dvd43_tray.exe” [2005-04-27 788992] “NeroFilterCheck”=“c:\program files\Common Files\Nero\Lib\NeroCheck.exe” [2007-03-01 153136] “NBKeyScan”=“c:\program files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe” [2007-08-08 1828136] “SMSTray”=“c:\program files\Samsung\Samsung Media Studio 5\SMSTray.exe” [2007-02-23 126976] “MAAgent”=“c:\program files\MarkAny\ContentSafer\MAAgent.exe” [2007-01-30 57344] “Sony Ericsson PC Suite”=“c:\program files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe” [2007-06-13 528384] “LXCGCATS”=“c:\windows\system32\spool\DRIVERS\W32X86\3\LXCGtime.dll” [2005-07-20 73728] [HKEY_USERS.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] “CTFMON.EXE”=“c:\windows\system32\CTFMON.EXE” [2004-08-04 15360] c:\documents and settings\goka\Menu Start\Programy\Autostart\ UniSpiker-2.6.lnk - c:\program files\ivo\UniSpiker-2.6\uni_spiker-2.6.exe [2005-07-20 86016] c:\documents and settings\All Users\Menu Start\Programy\Autostart\ BlueSoleil.lnk - c:\program files\IVT Corporation\BlueSoleil\BlueSoleil.exe [2008-08-21 1183744] Service Manager.lnk - c:\program files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe [2002-12-17 74308] [hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks] “{88485281-8b4b-4f8d-9ede-82e29a064277}”= “c:\progra~1\MarkAny\CONTEN~1\MACSMA~1.DLL” [2004-11-23 192512] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] “vidc.MPG4”= msmpeg4.dll “vidc.MP42”= msmpeg4.dll “vidc.MP43”= msmpeg4.dll “VIDC.DIV3”= DivXc32.dll “VIDC.DIV4”= DivXc32f.dll “VIDC.3iv2”= 3ivxVfWCodec.dll “VIDC.HFYU”= huffyuv.dll “VIDC.VP31”= vp31vfw.dll “msacm.l3fhg”= mp3fhg.acm “msacm.divxa32”= divxa32.acm [HKEY_LOCAL_MACHINE\software\microsoft\security center] “AntiVirusOverride”=dword:00000001 [HKLM~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] “%windir%\system32\sessmgr.exe”= “c:\Program Files\eMule\emule.exe”= “d:\wywalicto\BitComet\BitComet.exe”= “c:\Program Files\IVT Corporation\BlueSoleil\BlueSoleil.exe”= “d:\wywalicto\gadu\Gadu-Gadu\gg.exe”= [HKLM~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] “11985:TCP”= 11985:TCP:BitComet 11985 TCP “11985:UDP”= 11985:UDP:BitComet 11985 UDP R2 Kmm4xNT;Kmm4xNT;c:\windows\system32\drivers\Kmm4xNT.sys [2008-10-02 86708] S3 k510bus;Sony Ericsson K510 Driver driver (WDM);c:\windows\system32\DRIVERS\k510bus.sys [2007-12-13 58288] S3 k510mdfl;Sony Ericsson K510 USB WMC Modem Filter;c:\windows\system32\DRIVERS\k510mdfl.sys [2007-12-13 8336] S3 k510mdm;Sony Ericsson K510 USB WMC Modem Driver;c:\windows\system32\DRIVERS\k510mdm.sys [2007-12-13 94064] S3 k510mgmt;Sony Ericsson K510 USB WMC Device Management Drivers (WDM);c:\windows\system32\DRIVERS\k510mgmt.sys [2007-12-13 85408] S3 k510obex;Sony Ericsson K510 USB WMC OBEX Interface;c:\windows\system32\DRIVERS\k510obex.sys [2007-12-13 83344] S3 P1171VID;Creative WebCam Notebook #2;c:\windows\system32\DRIVERS\P1171Vid.sys [2007-12-13 91392] S3 s816bus;Sony Ericsson Device 816 driver (WDM);c:\windows\system32\DRIVERS\s816bus.sys [2008-09-16 81832] S3 s816mdfl;Sony Ericsson Device 816 USB WMC Modem Filter;c:\windows\system32\DRIVERS\s816mdfl.sys [2008-09-16 13864] S3 s816mdm;Sony Ericsson Device 816 USB WMC Modem Driver;c:\windows\system32\DRIVERS\s816mdm.sys [2008-09-16 107304] S3 s816mgmt;Sony Ericsson Device 816 USB WMC Device Management Drivers (WDM);c:\windows\system32\DRIVERS\s816mgmt.sys [2008-09-16 99112] S3 s816nd5;Sony Ericsson Device 816 USB Ethernet Emulation SEMCMR7 (NDIS);c:\windows\system32\DRIVERS\s816nd5.sys [2008-09-16 21928] S3 s816obex;Sony Ericsson Device 816 USB WMC OBEX Interface;c:\windows\system32\DRIVERS\s816obex.sys [2008-09-16 97320] S3 s816unic;Sony Ericsson Device 816 USB Ethernet Emulation SEMCMR7 (WDM);c:\windows\system32\DRIVERS\s816unic.sys [2008-09-16 97704] . - - - - USUNIĘTO PUSTE WPISY - - - - HKCU-Run-kamsoft - c:\windows\system32\ckvo.exe HKLM-Run-VVSN - c:\program files\VVSN\VVSN.exe . ------- Skan uzupełniający ------- . IE: Pobierz za pomocą BitComet - d:\wywalicto\BitComet\BitComet.exe/AddLink.htm c:\windows\system32\SkanerOnlineUninstall.exe - c:\windows\system32\SkanerOnline.dll O16 -: {68282C51-9459-467B-95BF-3C0E89627E55} hxxp://www.mks.com.pl/skaner/SkanerOnline.cab c:\windows\Downloaded Program Files\SkanerOnline.inf FF - ProfilePath - c:\documents and settings\nowy\Dane aplikacji\Mozilla\Firefox\Profiles\gg5bofjg.default\ FF - prefs.js: browser.startup.homepage - www.onet.pl FF - plugin: c:\program files\Java\jre1.5.0\bin\NPJava11.dll FF - plugin: c:\program files\Java\jre1.5.0\bin\NPJava12.dll FF - plugin: c:\program files\Java\jre1.5.0\bin\NPJava13.dll FF - plugin: c:\program files\Java\jre1.5.0\bin\NPJava14.dll FF - plugin: c:\program files\Java\jre1.5.0\bin\NPJava32.dll FF - plugin: c:\program files\Java\jre1.5.0\bin\NPJPI150.dll FF - plugin: c:\program files\Java\jre1.5.0\bin\NPOJI610.dll FF - plugin: c:\program files\K-Lite Codec Pack\Real\browser\plugins\nppl3260.dll FF - plugin: c:\program files\K-Lite Codec Pack\Real\browser\plugins\nprpjplug.dll . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-12-28 14:01:17 Windows 5.1.2600 Dodatek Service Pack 2 NTFS skanowanie ukrytych procesów … skanowanie ukrytych wpisów autostartu … HKLM\Software\Microsoft\Windows\CurrentVersion\Run LXCGCATS = rundll32 c:\windows\system32\spool\DRIVERS\W32X86\3\LXCGtime.dll,_RunDLLEntry@16??? skanowanie ukrytych plików … skanowanie pomyślnie ukończone ukryte pliki: 0 ************************************************************************** . ------------------------ Pozostałe uruchomione procesy ------------------------ . d:\wywalicto\adaware\aawservice.exe c:\program files\Common Files\Teleca Shared\Generic.exe c:\program files\IVT Corporation\BlueSoleil\BTNtService.exe c:\program files\Microsoft SQL Server\MSSQL\Binn\sqlservr.exe c:\program files\Sony Ericsson\Mobile2\Mobile Phone Monitor\epmworker.exe c:\program files\Nero\Nero8\Nero BackItUp\NBService.exe c:\windows\system32\wdfmgr.exe c:\windows\system32\wscntfy.exe . ************************************************************************** . Czas ukończenia: 2008-12-28 14:04:26 - komputer został uruchomiony ponownie ComboFix-quarantined-files.txt 2008-12-28 13:04:19 Przed: 4 154 105 856 bajtów wolnych Po: 4,120,551,424 bajtów wolnych WindowsXP-KB310994-SP2-Home-BootDisk-PLK.exe [boot loader] timeout=2 default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS [operating systems] c:\cmdcons\BOOTSECT.DAT=“Microsoft Windows Recovery Console” /cmdcons multi(0)disk(0)rdisk(0)partition(1)\WINDOWS=“Microsoft Windows XP Home Edition” /noexecute=optin /fastdetect 206

Leon1 · 28 Grudzień 2008 15:39

Wylecz pendriva lub kartę pamięci http://www.softpedia.com/get/Security/S … Tool.shtml

Flash Disinfector http://www.searchengines.pl/index.php?s … ntry369724

lub format

Otwórz notatnik i wklej

zapisz jako CFScript.txt (zapisz by ikonka CFScript.txt była obok ikonki ComboFix.exe) >> Przeciągnij i upuść ikonkę CFScript.txt na ikonkę ComboFix.exe

http://img.wklej.org/images/88953CFScri … iemoes.gif

Powinno rozpocząć się usuwanie

Potem log z usuwania Combofix

trochę dziwne przecież nie masz zainstalowanego programu Kasperski

start >> wyszukaj >> klif.sys

podaj lokalizacje

Agaton · 28 Grudzień 2008 15:58

luken ,

W związku ze zmianą, jaka obowiązuje przy wklejaniu logów w tym dziale, przeczytaj i zastosuj się do Tematu

system · 29 Grudzień 2008 12:35

Przepraszam nastepnym razem bede pamietal. Michael Parker dzieki serdeczne za udzielona pomoc, problem ustapil.

huber2t · 29 Grudzień 2008 12:40

Daj log z usuwania z combofix