Komp muli, ComboFix coś wykrył

[Rysiu (Rysiu320)]

Log z HJT:

Logfile of Trend Micro HijackThis v2.0.0 (BETA) Scan saved at 12:10:27, on 2007-04-24 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe D:\Programy\Kaspersky Internet Security 6.0\avp.exe D:\Programy\Alcohol 120\StarWind\StarWindService.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\Ati2evxx.exe C:\Program Files\ATI Technologies\ATI.ACE\cli.exe D:\Programy\Kaspersky Internet Security 6.0\avp.exe C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe C:\WINDOWS\explorer.exe C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE C:\WINDOWS\system32\NOTEPAD.EXE C:\Program Files\Mozilla Firefox\firefox.exe C:\Documents and Settings\Leszek\Pulpit\instalki\HiJackThis_v2.exe C:\WINDOWS\system32\cmd.exe R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Programy\Acrobat 7.0\ActiveX\AcroIEHelper.dll O4 - HKLM…\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe O4 - HKLM…\Run: [ATICCC] “C:\Program Files\ATI Technologies\ATI.ACE\cli.exe” runtime O4 - HKLM…\Run: [kis] “D:\Programy\Kaspersky Internet Security 6.0\avp.exe” O4 - HKUS\S-1-5-19…\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User ‘USŁUGA LOKALNA’) O4 - HKUS\S-1-5-20…\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User ‘USŁUGA SIECIOWA’) O4 - HKUS\S-1-5-18…\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User ‘SYSTEM’) O4 - HKUS.DEFAULT…\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User ‘Default user’) O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe O8 - Extra context menu item: Dodaj do Kaspersky Anti-Banner - D:\Programy\Kaspersky Internet Security 6.0\ie_banner_deny.htm O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://D:\Programy\MSOFFI~1\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: Ochrona WWW - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - D:\Programy\Kaspersky Internet Security 6.0\scieplugin.dll O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\Programy\MSOFFI~1\OFFICE11\REFIEBAR.DLL O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra ‘Tools’ menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra ‘Tools’ menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/s … wflash.cab O17 - HKLM\System\CCS\Services\Tcpip…{9F91B5DE-FCCC-46A4-B9E7-A00DA98801B6}: NameServer = 194.204.152.34 217.98.63.164 O20 - AppInit_DLLs: D:\Programy\KASPER~1.0\adialhk.dll O22 - SharedTaskScheduler: Moduł wstępnego ładowania interfejsu Browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll O22 - SharedTaskScheduler: Demon buforu kategorii składników - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: Kaspersky Internet Security 6.0 (AVP) - Kaspersky Lab - D:\Programy\Kaspersky Internet Security 6.0\avp.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - D:\Programy\Alcohol 120\StarWind\StarWindService.exe – End of file - 4443 bytes

“Leszek” - 07-04-24 12:00:30 Dodatek Service Pack 2 ComboFix 07-04-24.2V - Running from: “C:\Documents and Settings\Leszek\Pulpit” ((((((((((((((((((((((((((((((( Files Created from 2007-03-24 to 2007-04-24 )))))))))))))))))))))))))))))))))) 2007-04-24 11:54 1,546 --a------ C:\WINDOWS\system32\tmp.reg 2007-04-24 07:21 2007-04-24 07:04 2007-04-21 20:00 10,345 --a------ C:\WINDOWS\system32\drivers\hamachi.sys 2007-04-21 20:00 2007-04-17 17:18 2007-04-16 15:35 2007-04-16 15:16 2007-04-16 07:13 2007-04-16 07:11 2007-04-15 19:14 2007-04-15 12:38 2007-04-15 11:07 2007-04-15 10:52 2007-04-15 10:51 1,048,576 --ah----- C:\DOCUME~1\UKASZ~1.RYC\NTUSER.DAT 2007-04-15 10:51 2007-04-15 10:51 2007-04-15 10:51 2007-04-15 10:51 2007-04-15 10:51 2007-04-15 10:51 2007-04-14 20:08 2007-04-14 20:05 2007-04-14 20:04 1,048,576 --ah----- C:\DOCUME~1\RYQ~1\NTUSER.DAT 2007-04-14 20:04 2007-04-14 20:04 2007-04-14 20:04 2007-04-14 20:04 2007-04-14 20:04 2007-04-14 20:04 2007-04-14 20:04 2007-04-14 17:00 2007-04-14 15:59 2007-04-14 15:41 2007-04-14 15:22 24,072 --a------ C:\WINDOWS\system32\uxtuneup.dll 2007-04-14 15:22 2007-04-14 15:20 2007-04-14 15:20 2007-04-14 14:50 2007-04-14 14:49 2007-04-14 14:48 1,048,576 --ah----- C:\DOCUME~1\UKASZ~1\NTUSER.DAT 2007-04-14 14:48 2007-04-14 14:48 2007-04-14 14:48 2007-04-14 14:48 2007-04-14 14:48 2007-04-14 14:48 2007-04-14 14:48 2007-04-11 21:05 2007-04-07 18:51 306,688 --a------ C:\WINDOWS\IsUninst.exe 2007-04-02 14:55 2007-03-28 20:23 2007-03-26 18:44 0 -ra------ C:\logwmemory.bin 2007-03-26 17:31 2007-03-26 17:31 2007-03-24 12:47 679,936 --a------ C:\WINDOWS\system32\D3DX81ab.dll (((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))) 2007-04-24 09:43 -------- d-------- C:\DOCUME~1\Leszek\DANEAP~1\utorrent 2007-04-24 07:04 -------- d–h----- C:\Program Files\installshield installation information 2007-04-24 07:04 -------- d-------- C:\Program Files\Common Files\installshield 2007-04-16 07:10 2592 --a------ C:\WINDOWS\unins000.dat 2007-04-14 15:54 219648 --a------ C:\WINDOWS\system32\uxtheme.dll 2007-03-25 15:16 67078 --a------ C:\WINDOWS\system32\perfc015.dat 2007-03-25 15:16 435978 --a------ C:\WINDOWS\system32\perfh015.dat 2007-03-23 18:26 76232 --a------ C:\WINDOWS\war3unin.dat 2007-03-23 18:06 2829 --a------ C:\WINDOWS\war3unin.pif 2007-03-23 18:06 139264 --a------ C:\WINDOWS\war3unin.exe 2007-03-19 19:58 0 --a------ C:\WINDOWS\nsreg.dat 2007-03-19 19:58 -------- d-------- C:\DOCUME~1\Leszek\DANEAP~1\thunderbird 2007-03-19 19:58 -------- d-------- C:\DOCUME~1\Leszek\DANEAP~1\talkback 2007-03-19 19:54 4057 --a------ C:\WINDOWS\mozver.dat 2007-03-17 15:45 293376 --a------ C:\WINDOWS\system32\winsrv.dll 2007-03-16 07:24 985 --a------ C:\DOCUME~1\Leszek\DANEAP~1\adobedlm.log 2007-03-15 19:49 824 --a------ C:\DOCUME~1\Leszek\DANEAP~1\dm.ini 2007-03-12 21:34 -------- d-------- C:\Program Files\messenger 2007-03-10 19:33 -------- d-------- C:\Program Files\Common Files\blizzard entertainment 2007-03-10 18:53 223128 --a------ C:\WINDOWS\system32\drivers\vaxscsi.sys 2007-03-10 18:51 96256 --a------ C:\WINDOWS\system32\drivers\sptd0509.sys 2007-03-10 18:51 643072 --a------ C:\WINDOWS\system32\drivers\sptd.sys 2007-03-10 14:52 -------- d-------- C:\Program Files\microsoft.net 2007-03-10 13:23 -------- d-------- C:\Program Files\Common Files\nero 2007-03-09 17:30 -------- d-------- C:\DOCUME~1\Leszek\DANEAP~1\bittorrent 2007-03-08 17:38 579072 --a------ C:\WINDOWS\system32\user32.dll 2007-03-08 17:38 40960 --a------ C:\WINDOWS\system32\mf3216.dll 2007-03-08 17:38 281600 --a------ C:\WINDOWS\system32\gdi32.dll 2007-03-08 17:37 1843840 --a------ C:\WINDOWS\system32\win32k.sys 2007-03-07 20:00 -------- d-------- C:\Program Files\opera 2007-03-07 18:32 -------- d-------- C:\DOCUME~1\Leszek\DANEAP~1\opera 2007-03-07 18:23 62 --ahs---- C:\DOCUME~1\Leszek\DANEAP~1\desktop.ini 2007-03-07 18:23 -------- d-------- C:\Program Files\Common Files\speechengines 2007-03-07 18:23 -------- d-------- C:\Program Files\Common Files\odbc 2007-03-07 18:15 -------- d-------- C:\Program Files\neostrada tp 2007-03-07 18:03 -------- d-------- C:\Program Files\sagem 2007-03-07 17:41 0 -rahs---- C:\MSDOS.SYS 2007-03-07 17:41 0 -rahs---- C:\IO.SYS 2007-03-07 17:41 0 --a------ C:\CONFIG.SYS 2007-03-07 17:41 0 --a------ C:\AUTOEXEC.BAT 2007-03-07 17:41 -------- d-------- C:\Program Files\microsoft frontpage 2007-03-07 17:38 -------- d–h----- C:\Program Files\windowsupdate 2007-03-07 17:38 -------- d-------- C:\Program Files\usˆugi online 2007-03-07 17:37 -------- d-------- C:\Program Files\movie maker 2007-03-07 17:37 -------- d-------- C:\Program Files\Common Files\mssoap 2007-03-07 17:35 21856 --a------ C:\WINDOWS\system32\emptyregdb.dat 2007-03-07 17:35 -------- d-------- C:\Program Files\windows nt 2007-03-07 17:35 -------- d-------- C:\Program Files\msn gaming zone 2007-02-05 22:19 185856 --a------ C:\WINDOWS\system32\upnphost.dll (((((((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run] “ATIPTA”=“C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe” “ATICCC”="“C:\Program Files\ATI Technologies\ATI.ACE\cli.exe” runtime" “kis”="“D:\Programy\Kaspersky Internet Security 6.0\avp.exe”" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] “appinit_dlls”=“D:\Programy\KASPER~1.0\adialhk.dll” HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa Authentication Packages REG_MULTI_SZ msv1_0\0\0 Security Packages REG_MULTI_SZ kerberos\0msv1_0\0schannel\0wdigest\0\0 Notification Packages REG_MULTI_SZ scecli\0\0 [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg] “key”=“SOFTWARE\Microsoft\Windows\CurrentVersion\Run” “item”="" “hkey”=“HKLM” “command”="" “inimapping”=“0” [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BitTorrent] “key”=“SOFTWARE\Microsoft\Windows\CurrentVersion\Run” “item”=“bittorrent” “hkey”=“HKCU” “command”="“D:\Programy\BitTorrent\bittorrent.exe” --force_start_minimized" “inimapping”=“0” [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE] “key”=“SOFTWARE\Microsoft\Windows\CurrentVersion\Run” “item”=“CTFMON” “hkey”=“HKCU” “command”=“C:\WINDOWS\system32\CTFMON.EXE” “inimapping”=“0” [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Svchost] HTTPFilter REG_MULTI_SZ HTTPFilter\0\0 LocalService REG_MULTI_SZ Alerter\0WebClient\0LmHosts\0RemoteRegistry\0upnphost\0SSDPSRV\0\0 NetworkService REG_MULTI_SZ DnsCache\0\0 DcomLaunch REG_MULTI_SZ DcomLaunch\0TermService\0\0 rpcss REG_MULTI_SZ RpcSs\0\0 imgsvc REG_MULTI_SZ StiSvc\0\0 termsvcs REG_MULTI_SZ TermService\0\0 hklm\software\Microsoft\Windows NT\CurrentVersion\Svchost *netsvcs* UxTuneUp Contents of the ‘Scheduled Tasks’ folder C:\WINDOWS\tasks\1-Click Maintenance.job ******************************************************************** catchme 0.3.660 W2K/XP/Vista - userland rootkit detector by Gmer, http://www.gmer.net Rootkit scan 2007-04-24 12:07:01 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes … scanning hidden services … scanning hidden autostart entries … scanning hidden files … scan completed successfully hidden processes: 0 hidden services: 0 hidden files: 0 ******************************************************************** Completion time: 07-04-24 12:07:17 C:\ComboFix-quarantined-files.txt … 07-04-24 12:07

SmitFraudFix v2.171 Scan done at 11:53:58,96, 2007-04-24 Run from C:\Documents and Settings\Leszek\Pulpit\SmitfraudFix OS: Microsoft Windows XP [Wersja 5.1.2600] - Windows_NT The filesystem type is NTFS Fix run in normal mode »»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Before SmitFraudFix !Attention, following keys are not inevitably infected! SrchSTS.exe by S!Ri Search SharedTaskScheduler’s .dll »»»»»»»»»»»»»»»»»»»»»»»» Killing process »»»»»»»»»»»»»»»»»»»»»»»» hosts 127.0.0.1 localhost »»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix GenericRenosFix by S!Ri »»»»»»»»»»»»»»»»»»»»»»»» Deleting infected files »»»»»»»»»»»»»»»»»»»»»»»» DNS »»»»»»»»»»»»»»»»»»»»»»»» Deleting Temp Files »»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System !Attention, following keys are not inevitably infected! [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] “System”="" »»»»»»»»»»»»»»»»»»»»»»»» Registry Cleaning Registry Cleaning done. »»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler After SmitFraudFix !Attention, following keys are not inevitably infected! SrchSTS.exe by S!Ri Search SharedTaskScheduler’s .dll »»»»»»»»»»»»»»»»»»»»»»»» End “Silent Runners.vbs”, revision R50, http://www.silentrunners.org/ Operating System: Windows XP SP2 Output limited to non-default values, except where indicated by “{++}” Startup items buried in registry: --------------------------------- HKLM\Software\Microsoft\Windows\CurrentVersion\Run\ {++} “ATIPTA” = “C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe” [“ATI Technologies, Inc.”] “ATICCC” = ““C:\Program Files\ATI Technologies\ATI.ACE\cli.exe” runtime” [null data] “kis” = ““D:\Programy\Kaspersky Internet Security 6.0\avp.exe”” [“Kaspersky Lab”] HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}(Default) = (no title provided) - {HKLM…CLSID} = “Adobe PDF Reader Link Helper” \InProcServer32(Default) = “D:\Programy\Acrobat 7.0\ActiveX\AcroIEHelper.dll” [“Adobe Systems Incorporated”] HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\ “{42071714-76d4-11d1-8b24-00a0c9068ff3}” = “Rozszerzenie CPL kadrowania wyświetlania” - {HKLM…CLSID} = “Rozszerzenie CPL kadrowania wyświetlania” \InProcServer32(Default) = “deskpan.dll” [file not found] “{88895560-9AA2-1069-930E-00AA0030EBC8}” = “Rozszerzenie ikony HyperTerminalu” - {HKLM…CLSID} = “HyperTerminal Icon Ext” \InProcServer32(Default) = “C:\WINDOWS\system32\hticons.dll” [“Hilgraeve, Inc.”] “{5E2121EE-0300-11D4-8D3B-444553540000}” = “Catalyst Context Menu extension” - {HKLM…CLSID} = “SimpleShlExt Class” \InProcServer32(Default) = “C:\Program Files\ATI Technologies\ATI.ACE\atiacmxx.dll” [empty string] “{85E0B171-04FA-11D1-B7DA-00A0C90348D6}” = “Ochrona WWW” - {HKLM…CLSID} = “Ochrona WWW” \InProcServer32(Default) = “D:\Programy\Kaspersky Internet Security 6.0\scieplugin.dll” [“Kaspersky Lab”] “{453D1B6D-BD6A-4FA1-B876-9E4DD848D434}” = “AQQ File Transfer Shell Extension” - {HKLM…CLSID} = “AQQ File Transfer Shell Extension” \InProcServer32(Default) = “D:\Programy\AQQ\System\AQQShellExt.dll” [null data] “{42042206-2D85-11D3-8CFF-005004838597}” = “Microsoft Office HTML Icon Handler” - {HKLM…CLSID} = (no title provided) \InProcServer32(Default) = “D:\Programy\MS Office\OFFICE11\msohev.dll” [MS] “{32020A01-506E-484D-A2A8-BE3CF17601C3}” = “AlcoholShellEx” - {HKLM…CLSID} = “AlcoholShellEx” \InProcServer32(Default) = “D:\Programy\ALCOHO~1\axshlex.dll” [“Alcohol Soft Development Team”] “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” = “WinRAR shell extension” - {HKLM…CLSID} = “WinRAR” \InProcServer32(Default) = “C:\Program Files\WinRAR\rarext.dll” [null data] “{4858E7D9-8E12-45a3-B6A3-1CD128C9D403}” = “TuneUp Shredder Shell Extension” - {HKLM…CLSID} = “TuneUp Shredder Shell Extension” \InProcServer32(Default) = “D:\Programy\TuneUp\SDShelEx-win32.dll” [“TuneUp Software GmbH”] “{44440D00-FF19-4AFC-B765-9A0970567D97}” = “TuneUp Theme Extension” - {HKLM…CLSID} = “TuneUp Theme Extension” \InProcServer32(Default) = “C:\WINDOWS\system32\uxtuneup.dll” [“TuneUp Software GmbH”] “{71A466B0-65CC-4B41-9043-6090F2C830D3}” = “QCD IconHandler” - {HKLM…CLSID} = “QIconHandler Class” \InProcServer32(Default) = “D:\Programy\Quintessential Media Player\QMPShell.dll” [“Quinnware”] “{71A068F3-2DC9-438D-8944-6B4FF540D2F5}” = “QCD ContextMenu” - {HKLM…CLSID} = “QContextMenu Class” \InProcServer32(Default) = “D:\Programy\Quintessential Media Player\QMPShell.dll” [“Quinnware”] HKLM\Software\Microsoft\Windows NT\CurrentVersion\Windows\ “AppInit_DLLs” = “D:\Programy\KASPER~1.0\adialhk.dll” [“Kaspersky Lab”] HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ AtiExtEvent\DLLName = “Ati2evxx.dll” [“ATI Technologies Inc.”] klogon\DLLName = “C:\WINDOWS\system32\klogon.dll” [“Kaspersky Lab”] HKLM\Software\Classes\PROTOCOLS\Filter\ text/xml\CLSID = “{807553E5-5146-11D5-A672-00B0D022E945}” - {HKLM…CLSID} = (no title provided) \InProcServer32(Default) = “C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL” [MS] HKLM\Software\Classes\Folder\shellex\ColumnHandlers\ {F9DB5320-233E-11D1-9F84-707F02C10627}(Default) = “PDF Column Info” - {HKLM…CLSID} = “PDF Shell Extension” \InProcServer32(Default) = “D:\Programy\Acrobat 7.0\ActiveX\PDFShell.dll” [“Adobe Systems, Inc.”] HKLM\Software\Classes*\shellex\ContextMenuHandlers\ AQQFileTransfer(Default) = “{453D1B6D-BD6A-4FA1-B876-9E4DD848D434}” - {HKLM…CLSID} = “AQQ File Transfer Shell Extension” \InProcServer32(Default) = “D:\Programy\AQQ\System\AQQShellExt.dll” [null data] Kaspersky Anti-Virus(Default) = “{dd230880-495a-11d1-b064-008048ec2fc5}” - {HKLM…CLSID} = (no title provided) \InProcServer32(Default) = “D:\Programy\Kaspersky Internet Security 6.0\shellex.dll” [“Kaspersky Lab”] TuneUp Shredder Shell Extension(Default) = “{4858E7D9-8E12-45a3-B6A3-1CD128C9D403}” - {HKLM…CLSID} = “TuneUp Shredder Shell Extension” \InProcServer32(Default) = “D:\Programy\TuneUp\SDShelEx-win32.dll” [“TuneUp Software GmbH”] WinRAR(Default) = “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” - {HKLM…CLSID} = “WinRAR” \InProcServer32(Default) = “C:\Program Files\WinRAR\rarext.dll” [null data] HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\ TuneUp Shredder Shell Extension(Default) = “{4858E7D9-8E12-45a3-B6A3-1CD128C9D403}” - {HKLM…CLSID} = “TuneUp Shredder Shell Extension” \InProcServer32(Default) = “D:\Programy\TuneUp\SDShelEx-win32.dll” [“TuneUp Software GmbH”] WinRAR(Default) = “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” - {HKLM…CLSID} = “WinRAR” \InProcServer32(Default) = “C:\Program Files\WinRAR\rarext.dll” [null data] HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\ Kaspersky Anti-Virus(Default) = “{dd230880-495a-11d1-b064-008048ec2fc5}” - {HKLM…CLSID} = (no title provided) \InProcServer32(Default) = “D:\Programy\Kaspersky Internet Security 6.0\shellex.dll” [“Kaspersky Lab”] WinRAR(Default) = “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” - {HKLM…CLSID} = “WinRAR” \InProcServer32(Default) = “C:\Program Files\WinRAR\rarext.dll” [null data] Group Policies {GPedit.msc branch and setting}: ----------------------------------------------- Note: detected settings may not have any effect. HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\ “shutdownwithoutlogon” = (REG_DWORD) hex:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| Shutdown: Allow system to be shut down without having to log on} “undockwithoutlogon” = (REG_DWORD) hex:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| Devices: Allow undock without having to log on} Active Desktop and Wallpaper: ----------------------------- Active Desktop may be disabled at this entry: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState Displayed if Active Desktop enabled and wallpaper not set by Group Policy: HKCU\Software\Microsoft\Internet Explorer\Desktop\General\ “Wallpaper” = “C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp” Startup items in “Leszek” “All Users” startup folders: -------------------------------------------------------- C:\Documents and Settings\All Users\Menu Start\Programy\Autostart “DSLMON” - shortcut to: “C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe /W” [empty string] Enabled Scheduled Tasks: ------------------------ “1-Click Maintenance” - launches: “D:\Programy\TuneUp\SystemOptimizer.exe /schedulestart” [“TuneUp Software GmbH”] Winsock2 Service Provider DLLs: ------------------------------- Namespace Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++} 000000000001\LibraryPath = “%SystemRoot%\System32\mswsock.dll” [MS] 000000000002\LibraryPath = “%SystemRoot%\System32\winrnr.dll” [MS] 000000000003\LibraryPath = “%SystemRoot%\System32\mswsock.dll” [MS] Transport Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++} 0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range: %SystemRoot%\system32\mswsock.dll [MS], 01 - 03, 06 - 17 %SystemRoot%\system32\rsvpsp.dll [MS], 04 - 05 Toolbars, Explorer Bars, Extensions: ------------------------------------ Explorer Bars HKLM\Software\Microsoft\Internet Explorer\Explorer Bars\ HKLM\Software\Classes\CLSID{85E0B171-04FA-11D1-B7DA-00A0C90348D6}(Default) = “Ochrona WWW” Implemented Categories{00021493-0000-0000-C000-000000000046}\ [vertical bar] InProcServer32(Default) = “D:\Programy\Kaspersky Internet Security 6.0\scieplugin.dll” [“Kaspersky Lab”] HKLM\Software\Classes\CLSID{FF059E31-CC5A-4E2E-BF3B-96E929D65503}(Default) = “Badanie” Implemented Categories{00021493-0000-0000-C000-000000000046}\ [vertical bar] InProcServer32(Default) = “D:\Programy\MSOFFI~1\OFFICE11\REFIEBAR.DLL” [MS] Extensions (Tools menu items, main toolbar menu buttons) HKLM\Software\Microsoft\Internet Explorer\Extensions\ {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E}\ “ButtonText” = “Ochrona WWW” {92780B25-18CC-41C8-B9BE-3C9C571A8263}\ “ButtonText” = “Badanie” {E2E2DD38-D088-4134-82B7-F2BA38496583}\ “MenuText” = “@xpsp3res.dll,-20001” “Exec” = “%windir%\Network Diagnostic\xpnetdiag.exe” [MS] {FB5F1910-F110-11D2-BB9E-00C04F795683}\ “ButtonText” = “Messenger” “MenuText” = “Windows Messenger” “Exec” = “C:\Program Files\Messenger\msmsgs.exe” [MS] Miscellaneous IE Hijack Points ------------------------------ HKLM\Software\Microsoft\Internet Explorer\AboutURLs\ “TuneUp” = “file://C|/Documents and Settings/All Users/Dane aplikacji/TuneUp Software/Common/base.css” [file not found] Running Services (Display Name, Service Name, Path {Service DLL}): ------------------------------------------------------------------ Ati HotKey Poller, Ati HotKey Poller, “C:\WINDOWS\system32\Ati2evxx.exe” [“ATI Technologies Inc.”] Kaspersky Internet Security 6.0, AVP, ““D:\Programy\Kaspersky Internet Security 6.0\avp.exe” -r” [“Kaspersky Lab”] StarWind iSCSI Service, StarWindService, “D:\Programy\Alcohol 120\StarWind\StarWindService.exe” [“Rocket Division Software”] TuneUp Design Expansion, UxTuneUp, “C:\WINDOWS\System32\svchost.exe -k netsvcs” {“C:\WINDOWS\System32\uxtuneup.dll” [“TuneUp Software GmbH”]} ---------- : Suspicious data at a malware launch point. : Suspicious data at a browser hijack point. + This report excludes default entries except where indicated. + To see *everywhere* the script checks and *everything* it finds, launch it from a command prompt or a shortcut with the -all parameter. + To search all directories of local fixed drives for DESKTOP.INI DLL launch points, use the -supp parameter or answer “No” at the first message box and “Yes” at the second message box. ---------- (total run time: 129 seconds, including 2 seconds for message boxes) 07-04-24 12:04 10570 --a------ C:\Qoobox\Quarantine\Registry_backups\services_nm.reg.cf 07-04-24 12:04 1150 --a------ C:\Qoobox\Quarantine\Registry_backups\LEGACY_NM.reg.cf 07-04-24 12:04 284 --a------ C:\Qoobox\Quarantine\Registry_backups\LEGACY_NPF.reg.cf Zmienna PATH folderu Numer seryjny woluminu: 64E9-0F16 C:\QOOBOX —Quarantine —Registry_backups LEGACY_NM.reg.cf LEGACY_NPF.reg.cf services_nm.reg.cf

[adam9870]

Wszystkie logi są ok. Tak więc nie ma powodów do obaw, a ComboFix zawsze coś wykryje, albo pliki i foldery utworzone lub zmodyfikowane w ciągu ostatnich trzydziestu dni, albo rzeczy uruchamiane przy starcie systemu lub wyłączone stamtąd.

[Rysiu (Rysiu320)]

adam9870 , ale komp muli strasznie, tryb awaryjny nie odpala, a CHDSK odpala się przy każdym starcie. Dać jeszcze coś?

[adam9870]

Poczytaj:

http://forum.dobreprogramy.pl/viewtopic.php?t=147397

http://www.searchengines.pl/phpbb203/in … topic=5989

http://www.searchengines.pl/phpbb203/in … t&p=394788