Czeste zawiasy komputera i straszne przymulanie

Dudis · 31 Październik 2007 16:08

Logfile of HijackThis v1.99.1 Scan saved at 17:02:46, on 2007-10-31 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\SYSTEM32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\SYSTEM32\Ati2evxx.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\wscntfy.exe C:\Program Files\ATI Technologies\ATI.ACE\cli.exe C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe C:\Program Files\SAGEM WiFi manager\WLANUTL.exe C:\Program Files\DAEMON Tools\daemon.exe C:\PROGRA~1\MOZILL~1\FIREFOX.EXE D:\Programy\Gadu-Gadu\gg.exe D:\instalki\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza R3 - URLSearchHook: (no name) - {0A94B116-4504-4e26-AB05-E61E474AA38B} - C:\Program Files\AskPBar\SrchAstt\1.bin\A9SRCHAS.DLL O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Programy\adobe\ActiveX\AcroIEHelper.dll O2 - BHO: Ask Search Assistant BHO - {0A94B111-4504-4e26-AB05-E61E474AA38B} - C:\Program Files\AskPBar\SrchAstt\1.bin\A9SRCHAS.DLL O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O2 - BHO: Ask Toolbar BHO - {F4D76F01-7896-458a-890F-E1F05C46069F} - C:\Program Files\AskPBar\bar\1.bin\ASKPBAR.DLL (file missing) O3 - Toolbar: Ask Toolbar - {F4D76F09-7896-458a-890F-E1F05C46069F} - C:\Program Files\AskPBar\bar\1.bin\ASKPBAR.DLL (file missing) O4 - HKLM…\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe O4 - HKLM…\Run: [ATICCC] “C:\Program Files\ATI Technologies\ATI.ACE\cli.exe” runtime O4 - HKLM…\Run: [DAEMON Tools] “C:\Program Files\DAEMON Tools\daemon.exe” -lang 1033 O4 - HKLM…\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM…\Run: [sunJavaUpdateSched] “C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe” O4 - HKLM…\Run: [CBitSpirit] “D:\Programy\BitSpirit\BitSpirit.exe” /start O4 - HKCU…\Run: [RSD_HDDThermo] D:\Programy\HDD Thermometer\HDD Thermometer.exe O4 - HKCU…\Run: [MSMSGS] “C:\Program Files\Messenger\msmsgs.exe” /background O4 - HKCU…\Run: [AQQ] D:\Programy\AQQ\AQQ.exe O4 - Global Startup: Adobe Reader Speed Launch.lnk = D:\Programy\adobe\Reader\reader_sl.exe O4 - Global Startup: ATI CATALYST System Tray.lnk = C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE O4 - Global Startup: Program sieciowy dla SAGEM Wi-Fi 11g USB adapter.lnk = ? O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O8 - Extra context menu item: Pobierz z &BitSpirit - D:\Programy\BitSpirit\bsurl.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra ‘Tools’ menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra ‘Tools’ menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe

“Silent Runners.vbs”, revision R50, http://www.silentrunners.org/ Operating System: Windows XP SP2 Output limited to non-default values, except where indicated by “{++}” Startup items buried in registry: --------------------------------- HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ {++} “RSD_HDDThermo” = “D:\Programy\HDD Thermometer\HDD Thermometer.exe” [null data] “MSMSGS” = ““C:\Program Files\Messenger\msmsgs.exe” /background” [MS] “AQQ” = “D:\Programy\AQQ\AQQ.exe” [“AQQ Sp. z o.o.”] HKLM\Software\Microsoft\Windows\CurrentVersion\Run\ {++} “ATIPTA” = “C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe” [“ATI Technologies, Inc.”] “(Default)” = “(empty string)” [file not found] “ATICCC” = ““C:\Program Files\ATI Technologies\ATI.ACE\cli.exe” runtime” [null data] “DAEMON Tools” = ““C:\Program Files\DAEMON Tools\daemon.exe” -lang 1033” [“DT Soft Ltd.”] “NeroFilterCheck” = “C:\WINDOWS\system32\NeroCheck.exe” [“Ahead Software Gmbh”] “SunJavaUpdateSched” = ““C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe”” [“Sun Microsystems, Inc.”] “CBitSpirit” = ““D:\Programy\BitSpirit\BitSpirit.exe” /start” [file not found] “JLYL Agent” = “C:\WINDOWS\system32\28463\JLYL.exe” [null data] HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}(Default) = (no title provided) -> {HKLM…CLSID} = “Adobe PDF Reader Link Helper” \InProcServer32(Default) = “D:\Programy\adobe\ActiveX\AcroIEHelper.dll” [“Adobe Systems Incorporated”] {0A94B111-4504-4e26-AB05-E61E474AA38B}(Default) = “Ask Search Assistant BHO” -> {HKLM…CLSID} = “Ask Search Assistant BHO” \InProcServer32(Default) = “C:\Program Files\AskPBar\SrchAstt\1.bin\A9SRCHAS.DLL” [“Ask.com”] {761497BB-D6F0-462C-B6EB-D4DAF1D92D43}(Default) = (no title provided) -> {HKLM…CLSID} = “SSVHelper Class” \InProcServer32(Default) = “C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll” [“Sun Microsystems, Inc.”] {F4D76F01-7896-458a-890F-E1F05C46069F}(Default) = “Ask Toolbar BHO” -> {HKLM…CLSID} = “Ask Toolbar BHO” \InProcServer32(Default) = “C:\Program Files\AskPBar\bar\1.bin\ASKPBAR.DLL” [file not found] HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\ “{42071714-76d4-11d1-8b24-00a0c9068ff3}” = “Rozszerzenie CPL kadrowania wyświetlania” -> {HKLM…CLSID} = “Rozszerzenie CPL kadrowania wyświetlania” \InProcServer32(Default) = “deskpan.dll” [file not found] “{88895560-9AA2-1069-930E-00AA0030EBC8}” = “Rozszerzenie ikony HyperTerminalu” -> {HKLM…CLSID} = “HyperTerminal Icon Ext” \InProcServer32(Default) = “C:\WINDOWS\system32\hticons.dll” [“Hilgraeve, Inc.”] “{5E2121EE-0300-11D4-8D3B-444553540000}” = “Catalyst Context Menu extension” -> {HKLM…CLSID} = “SimpleShlExt Class” \InProcServer32(Default) = “C:\Program Files\ATI Technologies\ATI.ACE\atiacmxx.dll” [empty string] “{0006F045-0000-0000-C000-000000000046}” = “Microsoft Outlook Custom Icon Handler” -> {HKLM…CLSID} = “Rozszerzenie ikon plików programu Outlook” \InProcServer32(Default) = “C:\Program Files\Microsoft Office\Office10\OLKFSTUB.DLL” [MS] “{42042206-2D85-11D3-8CFF-005004838597}” = “Microsoft Office HTML Icon Handler” -> {HKLM…CLSID} = (no title provided) \InProcServer32(Default) = “C:\Program Files\Microsoft Office\Office10\msohev.dll” [MS] “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” = “WinRAR shell extension” -> {HKLM…CLSID} = “WinRAR” \InProcServer32(Default) = “C:\Program Files\WinRAR\rarext.dll” [null data] “{453D1B6D-BD6A-4FA1-B876-9E4DD848D434}” = “AQQ File Transfer Shell Extension” -> {HKLM…CLSID} = “AQQ File Transfer Shell Extension” \InProcServer32(Default) = “D:\Programy\AQQ\System\AQQShellExt.dll” [null data] HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ <> AtiExtEvent\DLLName = “Ati2evxx.dll” [“ATI Technologies Inc.”] HKLM\Software\Classes\Folder\shellex\ColumnHandlers\ {F9DB5320-233E-11D1-9F84-707F02C10627}(Default) = “PDF Column Info” -> {HKLM…CLSID} = “PDF Shell Extension” \InProcServer32(Default) = “D:\Programy\adobe\ActiveX\PDFShell.dll” [“Adobe Systems, Inc.”] HKLM\Software\Classes*\shellex\ContextMenuHandlers\ AQQFileTransfer(Default) = “{453D1B6D-BD6A-4FA1-B876-9E4DD848D434}” -> {HKLM…CLSID} = “AQQ File Transfer Shell Extension” \InProcServer32(Default) = “D:\Programy\AQQ\System\AQQShellExt.dll” [null data] WinRAR(Default) = “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” -> {HKLM…CLSID} = “WinRAR” \InProcServer32(Default) = “C:\Program Files\WinRAR\rarext.dll” [null data] HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\ WinRAR(Default) = “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” -> {HKLM…CLSID} = “WinRAR” \InProcServer32(Default) = “C:\Program Files\WinRAR\rarext.dll” [null data] HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\ WinRAR(Default) = “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” -> {HKLM…CLSID} = “WinRAR” \InProcServer32(Default) = “C:\Program Files\WinRAR\rarext.dll” [null data] Group Policies {GPedit.msc branch and setting}: ----------------------------------------------- Note: detected settings may not have any effect. HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\ “shutdownwithoutlogon” = (REG_DWORD) hex:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| Shutdown: Allow system to be shut down without having to log on} “undockwithoutlogon” = (REG_DWORD) hex:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| Devices: Allow undock without having to log on} Active Desktop and Wallpaper: ----------------------------- Active Desktop may be disabled at this entry: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState Startup items in “xx” & “All Users” startup folders: ---------------------------------------------------- C:\Documents and Settings\All Users\Menu Start\Programy\Autostart “Adobe Reader Speed Launch” -> shortcut to: “D:\Programy\adobe\Reader\reader_sl.exe” [“Adobe Systems Incorporated”] “ATI CATALYST System Tray” -> shortcut to: “C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe SystemTray” [null data] “Microsoft Office” -> shortcut to: “C:\Program Files\Microsoft Office\Office10\OSA.EXE -b -l” [MS] “Program sieciowy dla SAGEM Wi-Fi 11g USB adapter” -> shortcut to: “C:\Program Files\SAGEM WiFi manager\WLANUTL.exe” [" "] Winsock2 Service Provider DLLs: ------------------------------- Namespace Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++} 000000000001\LibraryPath = “%SystemRoot%\System32\mswsock.dll” [MS] 000000000002\LibraryPath = “%SystemRoot%\System32\winrnr.dll” [MS] 000000000003\LibraryPath = “%SystemRoot%\System32\mswsock.dll” [MS] Transport Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++} 0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range: %SystemRoot%\system32\mswsock.dll [MS], 01 - 03, 06 - 14 %SystemRoot%\system32\rsvpsp.dll [MS], 04 - 05 Toolbars, Explorer Bars, Extensions: ------------------------------------ Toolbars HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\ “{F4D76F09-7896-458A-890F-E1F05C46069F}” -> {HKLM…CLSID} = “Ask Toolbar” \InProcServer32(Default) = “C:\Program Files\AskPBar\bar\1.bin\ASKPBAR.DLL” [file not found] HKLM\Software\Microsoft\Internet Explorer\Toolbar\ “{F4D76F09-7896-458A-890F-E1F05C46069F}” = (no title provided) -> {HKLM…CLSID} = “Ask Toolbar” \InProcServer32(Default) = “C:\Program Files\AskPBar\bar\1.bin\ASKPBAR.DLL” [file not found] Extensions (Tools menu items, main toolbar menu buttons) HKLM\Software\Microsoft\Internet Explorer\Extensions\ {08B0E5C0-4FCB-11CF-AAA5-00401C608501}\ “MenuText” = “Sun Java Console” “CLSIDExtension” = “{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBC}” -> {HKCU…CLSID} = “Java Plug-in 1.6.0_03” \InProcServer32(Default) = “C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll” [“Sun Microsystems, Inc.”] -> {HKLM…CLSID} = “Java Plug-in 1.6.0_03” \InProcServer32(Default) = “C:\Program Files\Java\jre1.6.0_03\bin\npjpi160_03.dll” [“Sun Microsystems, Inc.”] {FB5F1910-F110-11D2-BB9E-00C04F795683}\ “ButtonText” = “Messenger” “MenuText” = “Windows Messenger” “Exec” = “C:\Program Files\Messenger\msmsgs.exe” [MS] Miscellaneous IE Hijack Points ------------------------------ HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks\ <> “{0A94B116-4504-4e26-AB05-E61E474AA38B}” = (no title provided) -> {HKLM…CLSID} = (no title provided) \InProcServer32(Default) = “C:\Program Files\AskPBar\SrchAstt\1.bin\A9SRCHAS.DLL” [“Ask.com”] Running Services (Display Name, Service Name, Path {Service DLL}): ------------------------------------------------------------------ Ati HotKey Poller, Ati HotKey Poller, “C:\WINDOWS\system32\Ati2evxx.exe” [“ATI Technologies Inc.”] Windows User Mode Driver Framework, UMWdf, “C:\WINDOWS\system32\wdfmgr.exe” [MS] ---------- <>: Suspicious data at a malware launch point. <>: Suspicious data at a browser hijack point. + This report excludes default entries except where indicated. + To see *everywhere* the script checks and *everything* it finds, launch it from a command prompt or a shortcut with the -all parameter. + The search for DESKTOP.INI DLL launch points on all local fixed drives took 95 seconds. ---------- (total run time: 202 seconds)

Gutek · 1 Listopad 2007 10:49

wpisy usuń HJT a folder ręcznie

Daj log z ComboFix

Dudis · 1 Listopad 2007 13:29

zrobione (usuniete)

log combofix

jessica · 1 Listopad 2007 14:12

Wklej do Notatnika :

File::

C:\WINDOWS\system32\28463\JLYL.exe


Folder::

C:\WINDOWS\system32\28463


Registry::

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"JLYL Agent"=-

>>Plik>>Zapisz jako… >>> CFScript (najwygodniej będzie, jeśli zapiszesz w takiej lokalizacji, by ikonka CFScript.txt znalazła się obok ikonki ComboFix.exe )

Przeciągnij i upuść plik CFScript.txt na plik ComboFix.exe (czyli ikonkę CFScript.txt na ikonkę ComboFix.exe )

– podobnie jak na tym obrazku –>

(jeśli pojawi się pytanie " 1 or 2" - to wpisz 1 i naciśnij ENTER) Ma się rozpocząć usuwanie. (i powstanie log)

Po restarcie usuń ręcznie folder C: ** Qoobox**.

Daj ten log.

jessi

Dudis · 1 Listopad 2007 14:31

Log po wykonaniu czynnosci

ComboFix 07-11-01.1** - xx 2007-11-01 15:22:10.2 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.52 [GMT 1:00] Running from: D:\instalki\ComboFix.exe Command switches used :: D:\instalki\CFScript.txt * Created a new restore point FILE:: C:\WINDOWS\system32\28463\JLYL.exe . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\WINDOWS\system32\28463 C:\WINDOWS\system32\28463\AKV.exe C:\WINDOWS\system32\28463\JLYL.001 C:\WINDOWS\system32\28463\JLYL.002 C:\WINDOWS\system32\28463\JLYL.002.tmp C:\WINDOWS\system32\28463\JLYL.005 C:\WINDOWS\system32\28463\JLYL.005.tmp C:\WINDOWS\system32\28463\JLYL.006 C:\WINDOWS\system32\28463\JLYL.007 C:\WINDOWS\system32\28463\JLYL.009 C:\WINDOWS\system32\28463\JLYL.009.tmp C:\WINDOWS\system32\28463\JLYL.exe C:\WINDOWS\system32\28463\Nov_01_2007__00_00_50.jpg C:\WINDOWS\system32\28463\Nov_01_2007__00_20_51.jpg C:\WINDOWS\system32\28463\Nov_01_2007__09_47_58.jpg C:\WINDOWS\system32\28463\Nov_01_2007__09_58_08.jpg C:\WINDOWS\system32\28463\Nov_01_2007__10_08_18.jpg C:\WINDOWS\system32\28463\Nov_01_2007__10_18_20.jpg C:\WINDOWS\system32\28463\Nov_01_2007__10_28_59.jpg C:\WINDOWS\system32\28463\Nov_01_2007__10_59_31.jpg C:\WINDOWS\system32\28463\Nov_01_2007__11_09_33.jpg C:\WINDOWS\system32\28463\Nov_01_2007__11_29_35.jpg C:\WINDOWS\system32\28463\Nov_01_2007__11_39_36.jpg C:\WINDOWS\system32\28463\Nov_01_2007__11_49_36.jpg C:\WINDOWS\system32\28463\Nov_01_2007__11_59_37.jpg C:\WINDOWS\system32\28463\Nov_01_2007__12_09_37.jpg C:\WINDOWS\system32\28463\Nov_01_2007__12_19_37.jpg C:\WINDOWS\system32\28463\Nov_01_2007__12_29_38.jpg C:\WINDOWS\system32\28463\Nov_01_2007__12_39_39.jpg C:\WINDOWS\system32\28463\Nov_01_2007__12_59_39.jpg C:\WINDOWS\system32\28463\Nov_01_2007__13_19_44.jpg C:\WINDOWS\system32\28463\Nov_01_2007__13_29_45.jpg C:\WINDOWS\system32\28463\Nov_01_2007__13_39_45.jpg C:\WINDOWS\system32\28463\Nov_01_2007__13_49_45.jpg C:\WINDOWS\system32\28463\Nov_01_2007__13_59_45.jpg C:\WINDOWS\system32\28463\Nov_01_2007__14_22_33.jpg C:\WINDOWS\system32\28463\Oct_25_2007__17_01_59.jpg C:\WINDOWS\system32\28463\Oct_25_2007__17_11_59.jpg C:\WINDOWS\system32\28463\Oct_25_2007__17_21_59.jpg C:\WINDOWS\system32\28463\Oct_25_2007__18_35_23.jpg C:\WINDOWS\system32\28463\Oct_25_2007__18_45_23.jpg C:\WINDOWS\system32\28463\Oct_25_2007__18_55_23.jpg C:\WINDOWS\system32\28463\Oct_25_2007__19_05_24.jpg C:\WINDOWS\system32\28463\Oct_25_2007__19_15_24.jpg C:\WINDOWS\system32\28463\Oct_25_2007__19_25_24.jpg C:\WINDOWS\system32\28463\Oct_25_2007__19_44_13.jpg C:\WINDOWS\system32\28463\Oct_25_2007__20_08_23.jpg C:\WINDOWS\system32\28463\Oct_25_2007__20_18_23.jpg C:\WINDOWS\system32\28463\Oct_25_2007__20_28_23.jpg C:\WINDOWS\system32\28463\Oct_25_2007__20_38_23.jpg C:\WINDOWS\system32\28463\Oct_25_2007__20_48_23.jpg C:\WINDOWS\system32\28463\Oct_25_2007__20_58_24.jpg C:\WINDOWS\system32\28463\Oct_26_2007__13_20_49.jpg C:\WINDOWS\system32\28463\Oct_26_2007__13_30_49.jpg C:\WINDOWS\system32\28463\Oct_26_2007__13_40_49.jpg C:\WINDOWS\system32\28463\Oct_26_2007__13_50_49.jpg C:\WINDOWS\system32\28463\Oct_26_2007__14_00_50.jpg C:\WINDOWS\system32\28463\Oct_26_2007__14_10_50.jpg C:\WINDOWS\system32\28463\Oct_26_2007__14_20_50.jpg C:\WINDOWS\system32\28463\Oct_26_2007__14_30_50.jpg C:\WINDOWS\system32\28463\Oct_26_2007__15_53_56.jpg C:\WINDOWS\system32\28463\Oct_26_2007__16_24_42.jpg C:\WINDOWS\system32\28463\Oct_26_2007__16_34_42.jpg C:\WINDOWS\system32\28463\Oct_26_2007__16_44_42.jpg C:\WINDOWS\system32\28463\Oct_26_2007__16_54_42.jpg C:\WINDOWS\system32\28463\Oct_26_2007__17_04_42.jpg C:\WINDOWS\system32\28463\Oct_26_2007__17_14_43.jpg C:\WINDOWS\system32\28463\Oct_26_2007__17_24_43.jpg C:\WINDOWS\system32\28463\Oct_26_2007__17_44_43.jpg C:\WINDOWS\system32\28463\Oct_26_2007__17_59_59.jpg C:\WINDOWS\system32\28463\Oct_26_2007__18_10_00.jpg C:\WINDOWS\system32\28463\Oct_26_2007__18_20_00.jpg C:\WINDOWS\system32\28463\Oct_26_2007__18_30_00.jpg C:\WINDOWS\system32\28463\Oct_26_2007__18_50_00.jpg C:\WINDOWS\system32\28463\Oct_26_2007__19_00_00.jpg C:\WINDOWS\system32\28463\Oct_27_2007__08_52_03.jpg C:\WINDOWS\system32\28463\Oct_27_2007__09_12_03.jpg C:\WINDOWS\system32\28463\Oct_27_2007__09_22_03.jpg C:\WINDOWS\system32\28463\Oct_27_2007__09_32_03.jpg C:\WINDOWS\system32\28463\Oct_27_2007__09_42_04.jpg C:\WINDOWS\system32\28463\Oct_27_2007__09_52_04.jpg C:\WINDOWS\system32\28463\Oct_27_2007__10_12_04.jpg C:\WINDOWS\system32\28463\Oct_27_2007__10_22_04.jpg C:\WINDOWS\system32\28463\Oct_27_2007__10_32_04.jpg C:\WINDOWS\system32\28463\Oct_27_2007__10_42_04.jpg C:\WINDOWS\system32\28463\Oct_27_2007__10_52_05.jpg C:\WINDOWS\system32\28463\Oct_27_2007__11_02_05.jpg C:\WINDOWS\system32\28463\Oct_27_2007__11_22_05.jpg C:\WINDOWS\system32\28463\Oct_27_2007__11_32_05.jpg C:\WINDOWS\system32\28463\Oct_27_2007__11_42_05.jpg C:\WINDOWS\system32\28463\Oct_27_2007__12_02_05.jpg C:\WINDOWS\system32\28463\Oct_27_2007__12_12_05.jpg C:\WINDOWS\system32\28463\Oct_27_2007__12_22_06.jpg C:\WINDOWS\system32\28463\Oct_27_2007__12_32_06.jpg C:\WINDOWS\system32\28463\Oct_27_2007__12_42_06.jpg C:\WINDOWS\system32\28463\Oct_27_2007__12_52_06.jpg C:\WINDOWS\system32\28463\Oct_27_2007__13_12_06.jpg C:\WINDOWS\system32\28463\Oct_27_2007__13_22_06.jpg C:\WINDOWS\system32\28463\Oct_27_2007__13_32_06.jpg C:\WINDOWS\system32\28463\Oct_27_2007__13_42_07.jpg C:\WINDOWS\system32\28463\Oct_27_2007__15_11_13.jpg C:\WINDOWS\system32\28463\Oct_27_2007__15_21_13.jpg C:\WINDOWS\system32\28463\Oct_27_2007__15_31_14.jpg C:\WINDOWS\system32\28463\Oct_27_2007__15_41_14.jpg C:\WINDOWS\system32\28463\Oct_27_2007__16_01_14.jpg C:\WINDOWS\system32\28463\Oct_27_2007__16_11_14.jpg C:\WINDOWS\system32\28463\Oct_27_2007__16_21_14.jpg C:\WINDOWS\system32\28463\Oct_27_2007__16_41_15.jpg C:\WINDOWS\system32\28463\Oct_27_2007__16_51_15.jpg C:\WINDOWS\system32\28463\Oct_28_2007__14_33_59.jpg C:\WINDOWS\system32\28463\Oct_28_2007__15_35_07.jpg C:\WINDOWS\system32\28463\Oct_28_2007__15_55_12.jpg C:\WINDOWS\system32\28463\Oct_28_2007__16_05_12.jpg C:\WINDOWS\system32\28463\Oct_28_2007__16_15_12.jpg C:\WINDOWS\system32\28463\Oct_28_2007__16_55_35.jpg C:\WINDOWS\system32\28463\Oct_28_2007__17_05_35.jpg C:\WINDOWS\system32\28463\Oct_28_2007__17_15_39.jpg C:\WINDOWS\system32\28463\Oct_28_2007__18_06_47.jpg C:\WINDOWS\system32\28463\Oct_28_2007__18_41_08.jpg C:\WINDOWS\system32\28463\Oct_28_2007__18_51_09.jpg C:\WINDOWS\system32\28463\Oct_28_2007__19_01_09.jpg C:\WINDOWS\system32\28463\Oct_28_2007__19_11_09.jpg C:\WINDOWS\system32\28463\Oct_28_2007__19_21_09.jpg C:\WINDOWS\system32\28463\Oct_28_2007__19_31_09.jpg C:\WINDOWS\system32\28463\Oct_28_2007__19_42_58.jpg C:\WINDOWS\system32\28463\Oct_28_2007__19_52_58.jpg C:\WINDOWS\system32\28463\Oct_28_2007__20_02_58.jpg C:\WINDOWS\system32\28463\Oct_28_2007__20_12_58.jpg C:\WINDOWS\system32\28463\Oct_28_2007__20_42_58.jpg C:\WINDOWS\system32\28463\Oct_28_2007__20_52_59.jpg C:\WINDOWS\system32\28463\Oct_28_2007__21_02_59.jpg C:\WINDOWS\system32\28463\Oct_28_2007__21_12_59.jpg C:\WINDOWS\system32\28463\Oct_29_2007__16_37_41.jpg C:\WINDOWS\system32\28463\Oct_29_2007__17_40_38.jpg C:\WINDOWS\system32\28463\Oct_29_2007__17_50_48.jpg C:\WINDOWS\system32\28463\Oct_29_2007__18_10_48.jpg C:\WINDOWS\system32\28463\Oct_29_2007__18_20_49.jpg C:\WINDOWS\system32\28463\Oct_29_2007__18_40_50.jpg C:\WINDOWS\system32\28463\Oct_29_2007__18_50_51.jpg C:\WINDOWS\system32\28463\Oct_29_2007__19_00_51.jpg C:\WINDOWS\system32\28463\Oct_29_2007__19_10_52.jpg C:\WINDOWS\system32\28463\Oct_29_2007__20_01_06.jpg C:\WINDOWS\system32\28463\Oct_29_2007__20_21_55.jpg C:\WINDOWS\system32\28463\Oct_29_2007__20_43_26.jpg C:\WINDOWS\system32\28463\Oct_29_2007__20_53_27.jpg C:\WINDOWS\system32\28463\Oct_29_2007__21_03_27.jpg C:\WINDOWS\system32\28463\Oct_29_2007__21_13_27.jpg C:\WINDOWS\system32\28463\Oct_29_2007__21_23_27.jpg C:\WINDOWS\system32\28463\Oct_29_2007__21_33_29.jpg C:\WINDOWS\system32\28463\Oct_29_2007__23_59_29.jpg C:\WINDOWS\system32\28463\Oct_30_2007__00_09_29.jpg C:\WINDOWS\system32\28463\Oct_30_2007__00_19_30.jpg C:\WINDOWS\system32\28463\Oct_30_2007__00_39_30.jpg C:\WINDOWS\system32\28463\Oct_30_2007__16_07_45.jpg C:\WINDOWS\system32\28463\Oct_30_2007__16_17_46.jpg C:\WINDOWS\system32\28463\Oct_30_2007__16_27_47.jpg C:\WINDOWS\system32\28463\Oct_30_2007__16_37_48.jpg C:\WINDOWS\system32\28463\Oct_30_2007__16_57_49.jpg C:\WINDOWS\system32\28463\Oct_30_2007__17_48_16.jpg C:\WINDOWS\system32\28463\Oct_30_2007__18_18_50.jpg C:\WINDOWS\system32\28463\Oct_30_2007__18_29_11.jpg C:\WINDOWS\system32\28463\Oct_30_2007__18_49_15.jpg C:\WINDOWS\system32\28463\Oct_30_2007__18_59_17.jpg C:\WINDOWS\system32\28463\Oct_30_2007__19_09_18.jpg C:\WINDOWS\system32\28463\Oct_30_2007__19_19_20.jpg C:\WINDOWS\system32\28463\Oct_30_2007__19_39_23.jpg C:\WINDOWS\system32\28463\Oct_30_2007__19_49_23.jpg C:\WINDOWS\system32\28463\Oct_30_2007__20_19_24.jpg C:\WINDOWS\system32\28463\Oct_30_2007__20_29_24.jpg C:\WINDOWS\system32\28463\Oct_30_2007__20_39_24.jpg C:\WINDOWS\system32\28463\Oct_30_2007__20_49_24.jpg C:\WINDOWS\system32\28463\Oct_30_2007__20_59_24.jpg C:\WINDOWS\system32\28463\Oct_30_2007__21_19_25.jpg C:\WINDOWS\system32\28463\Oct_30_2007__21_29_25.jpg C:\WINDOWS\system32\28463\Oct_30_2007__21_39_25.jpg C:\WINDOWS\system32\28463\Oct_30_2007__21_49_25.jpg C:\WINDOWS\system32\28463\Oct_30_2007__21_59_25.jpg C:\WINDOWS\system32\28463\Oct_30_2007__22_09_25.jpg C:\WINDOWS\system32\28463\Oct_30_2007__22_19_26.jpg C:\WINDOWS\system32\28463\Oct_30_2007__22_29_26.jpg C:\WINDOWS\system32\28463\Oct_30_2007__22_39_26.jpg C:\WINDOWS\system32\28463\Oct_30_2007__22_49_26.jpg C:\WINDOWS\system32\28463\Oct_30_2007__22_59_26.jpg C:\WINDOWS\system32\28463\Oct_30_2007__23_09_27.jpg C:\WINDOWS\system32\28463\Oct_30_2007__23_19_27.jpg C:\WINDOWS\system32\28463\Oct_30_2007__23_29_27.jpg C:\WINDOWS\system32\28463\Oct_30_2007__23_39_28.jpg C:\WINDOWS\system32\28463\Oct_31_2007__14_05_39.jpg C:\WINDOWS\system32\28463\Oct_31_2007__14_15_51.jpg C:\WINDOWS\system32\28463\Oct_31_2007__14_46_21.jpg C:\WINDOWS\system32\28463\Oct_31_2007__15_57_24.jpg C:\WINDOWS\system32\28463\Oct_31_2007__16_17_26.jpg C:\WINDOWS\system32\28463\Oct_31_2007__16_47_27.jpg C:\WINDOWS\system32\28463\Oct_31_2007__16_57_27.jpg C:\WINDOWS\system32\28463\Oct_31_2007__17_07_28.jpg C:\WINDOWS\system32\28463\Oct_31_2007__17_27_28.jpg C:\WINDOWS\system32\28463\Oct_31_2007__17_47_32.jpg C:\WINDOWS\system32\28463\Oct_31_2007__17_57_33.jpg C:\WINDOWS\system32\28463\Oct_31_2007__18_17_34.jpg C:\WINDOWS\system32\28463\Oct_31_2007__18_37_34.jpg C:\WINDOWS\system32\28463\Oct_31_2007__20_50_37.jpg C:\WINDOWS\system32\28463\Oct_31_2007__21_20_41.jpg C:\WINDOWS\system32\28463\Oct_31_2007__21_30_41.jpg C:\WINDOWS\system32\28463\Oct_31_2007__21_40_41.jpg C:\WINDOWS\system32\28463\Oct_31_2007__21_50_42.jpg C:\WINDOWS\system32\28463\Oct_31_2007__22_00_42.jpg C:\WINDOWS\system32\28463\Oct_31_2007__22_10_44.jpg C:\WINDOWS\system32\28463\Oct_31_2007__23_00_47.jpg C:\WINDOWS\system32\28463\Oct_31_2007__23_10_49.jpg C:\WINDOWS\system32\28463\Oct_31_2007__23_20_49.jpg C:\WINDOWS\system32\28463\Oct_31_2007__23_30_50.jpg C:\WINDOWS\system32\28463\Oct_31_2007__23_40_50.jpg . ((((((((((((((((((((((((( Files Created from 2007-10-01 to 2007-11-01 ))))))))))))))))))))))))))))))) . 2007-11-01 14:18 51,200 --a------ C:\WINDOWS\NirCmd.exe 2007-11-01 14:10 2007-11-01 14:10 2007-11-01 14:10 2007-11-01 14:10 2007-11-01 14:10 2007-11-01 14:10 2007-11-01 14:10 2007-10-29 20:47 2007-10-28 19:03 2007-10-28 19:03 2007-10-28 19:03 31,744 --a------ C:\WINDOWS\system32\drivers\ZDPSp50a64.sys 2007-10-28 19:03 29,184 --a------ C:\WINDOWS\system32\drivers\BRGSp50a64.sys 2007-10-28 19:03 20,608 --a------ C:\WINDOWS\system32\drivers\BRGSp50.sys 2007-10-28 19:03 17,664 --a------ C:\WINDOWS\system32\drivers\ZDPSp50.sys 2007-10-28 19:02 493,440 --a------ C:\WINDOWS\system32\drivers\WlanBZ64.SYS 2007-10-28 19:02 402,432 --a------ C:\WINDOWS\system32\drivers\WlanBZXP.sys 2007-10-25 15:24 2007-10-25 15:24 2007-10-16 20:05 2007-10-15 19:24 2007-10-15 19:24 107,888 --a------ C:\WINDOWS\system32\CmdLineExt.dll 2007-10-06 10:29 2007-10-05 15:23 2007-10-03 14:32 . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2007-11-01 13:12 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\HDD Thermometer 2007-10-29 16:33 --------- d–h--w C:\Program Files\InstallShield Installation Information 2007-10-25 13:56 --------- d-----w C:\Program Files\Common Files\Panda Software 2007-10-24 16:47 --------- d-----w C:\Documents and Settings\xx\Dane aplikacji\Azureus 2007-10-21 12:32 --------- d-----w C:\Documents and Settings\xx\Dane aplikacji\Skype 2007-10-21 08:22 --------- d-----w C:\Program Files\Java 2007-10-07 19:02 --------- d-----w C:\Program Files\NAPI-PROJEKT 2007-09-29 14:16 --------- d-----w C:\Documents and Settings\xx\Dane aplikacji\HDD Thermometer 2007-09-29 13:44 --------- d-----w C:\Program Files\Panda Software 2007-08-14 15:09 17,536 ----a-w C:\Documents and Settings\xx\Dane aplikacji\GDIPFONTCACHEV1.DAT . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “ATIPTA”=“C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe” [2004-09-29 06:15] “ATICCC”=“C:\Program Files\ATI Technologies\ATI.ACE\cli.exe” [2004-09-29 09:37] “DAEMON Tools”=“C:\Program Files\DAEMON Tools\daemon.exe” [2005-12-10 15:57] “NeroFilterCheck”=“C:\WINDOWS\system32\NeroCheck.exe” [2001-07-09 10:50] “SunJavaUpdateSched”=“C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe” [2007-09-25 00:11] “CBitSpirit”=“D:\Programy\BitSpirit\BitSpirit.exe” [] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “RSD_HDDThermo”=“D:\Programy\HDD Thermometer\HDD Thermometer.exe” [2005-04-01 18:02] “MSMSGS”=“C:\Program Files\Messenger\msmsgs.exe” [2004-08-03 23:55] “AQQ”=“D:\Programy\AQQ\AQQ.exe” [2007-02-28 13:18] [HKEY_USERS.default\software\microsoft\windows\currentversion\run] “ATICCC”=“C:\Program Files\ATI Technologies\ATI.ACE\cli.exe” runtime C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\ Adobe Reader Speed Launch.lnk - D:\Programy\adobe\Reader\reader_sl.exe [2005-09-23 22:05:26] ATI CATALYST System Tray.lnk - C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe [2004-09-29 09:37:26] Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 09:01:04] Program sieciowy dla SAGEM Wi-Fi 11g USB adapter.lnk - C:\Program Files\SAGEM WiFi manager\WLANUTL.exe [2007-10-28 19:03:24] R2 ithsgt;ithsgt;C:\WINDOWS\system32\DRIVERS\ithsgt.sys R2 lilsgt;lilsgt;C:\WINDOWS\system32\DRIVERS\lilsgt.sys R3 SG762_XP;SAGEM 802.11g XG762 1211B Driver;C:\WINDOWS\system32\DRIVERS\WlanBZXP.sys S3 ZDCndis5;ZDCndis5 Protocol Driver;??\C:\WINDOWS\system32\ZDCndis5.SYS S3 ZDPNDIS5;ZDPNDIS5 NDIS Protocol Driver;??\C:\WINDOWS\system32\ZDPNDIS5.SYS *Newly Created Service* - CATCHME . ************************************************************************** catchme 0.3.1250 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-11-01 15:24:35 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes … scanning hidden autostart entries … scanning hidden files … scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2007-11-01 15:25:14 C:\ComboFix2.txt … 2007-11-01 14:21 . — E O F —

jessica · 1 Listopad 2007 14:35

Nic tu więcej podejrzanego nie widzę.

jessi

Dudis · 1 Listopad 2007 20:18

Dzieki wielkie pozdrawiam!!