Witam
Nod32 wykrywa mi Win32/Pacex.Gen ale nie potrafi usunąć ani naprawić :
C:\Qoobox\Quarantine\C\q9.cmd.vir - odmiana wirusa Win32/Pacex.Gen wirus - wybrana akcja zostanie wykonana po zakończeniu skanowania
C:\Qoobox\Quarantine\C\WINDOWS\system32\nmdfgds0.dll.vir - odmiana wirusa Win32/Pacex.Gen wirus - wybrana akcja zostanie wykonana po zakończeniu skanowania
C:\Qoobox\Quarantine\C\WINDOWS\system32\nmdfgds1.dll.vir - odmiana wirusa Win32/Pacex.Gen wirus - wybrana akcja zostanie wykonana po zakończeniu skanowania
C:\Qoobox\Quarantine\C\WINDOWS\system32\olhrwef.exe.vir - odmiana wirusa Win32/Pacex.Gen wirus - wybrana akcja zostanie wykonana po zakończeniu skanowania
Liczba przeskanowanych obiektów: 77597
Liczba znalezionych zagrożeń: 4
Liczba wyleczonych obiektów:0
LOG Z COMBOFIXA :
ComboFix 09-05-31.06 - Administrator 2009-06-01 21:09.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1250.48.1045.18.2038.1482 [GMT 2:00]
Uruchomiony z: c:\documents and settings\Administrator\Pulpit\ComboFix.exe
AV: ESET NOD32 Antivirus 4.0 *On-access scanning disabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
.
((((((((((((((((((((((((((((((((((((((( Usunięto )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\Autorun.inf
C:\q9.cmd
c:\windows\system32\nmdfgds0.dll
c:\windows\system32\nmdfgds1.dll
c:\windows\system32\olhrwef.exe
.
((((((((((((((((((((((((((((((((((((((( Sterowniki/Usługi )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\Service_AVPsys
((((((((((((((((((((((((( Pliki utworzone od 2009-05-01 do 2009-06-01 )))))))))))))))))))))))))))))))
.
2009-06-01 18:52 . 2009-06-01 18:52 -------- d-----w- c:\program files\CCleaner
2009-06-01 18:41 . 2009-06-01 18:42 -------- d-----w- c:\program files\TweakNow PowerPack 2009
2009-06-01 18:41 . 2009-06-01 18:41 -------- d-----w- c:\documents and settings\Administrator\Dane aplikacji\TweakNow PowerPack 2009
2009-06-01 18:39 . 2004-08-03 23:44 25600 ----a-w- c:\documents and settings\LocalService\Dane aplikacji\Microsoft\UPnP Device Host\upnphost\udhisapi.dll
2009-06-01 18:36 . 2009-06-01 18:36 -------- d-----w- c:\documents and settings\Administrator\Dane aplikacji\Kerio
2009-06-01 18:26 . 2009-06-01 18:41 -------- d-----w- c:\program files\Kerio
2009-06-01 18:20 . 2009-06-01 18:20 -------- d-----w- c:\documents and settings\Administrator\Ustawienia lokalne\Dane aplikacji\ESET
2009-06-01 18:16 . 2009-06-01 18:16 -------- d-----w- c:\program files\ESET
2009-06-01 18:16 . 2009-06-01 18:16 -------- d-----w- c:\documents and settings\All Users\Dane aplikacji\ESET
2009-06-01 18:06 . 2009-06-01 18:06 -------- d-----w- c:\documents and settings\Administrator\Ustawienia lokalne\Dane aplikacji\Opera
2009-06-01 18:06 . 2009-06-01 18:06 -------- d-----w- c:\program files\Opera
2009-06-01 17:08 . 2009-06-01 17:09 -------- d-----w- c:\documents and settings\Administrator\Ustawienia lokalne\Dane aplikacji\Adobe
2009-06-01 17:04 . 2009-06-01 17:04 -------- d-----w- c:\program files\Common Files\Adobe AIR
2009-06-01 17:03 . 2009-06-01 17:04 -------- d-----w- c:\program files\Common Files\Adobe
2009-06-01 16:24 . 2009-06-01 16:24 -------- d-----w- c:\program files\AskBarDis
2009-06-01 16:24 . 2009-06-01 18:12 -------- d-----w- c:\program files\uTorrent
2009-06-01 16:24 . 2009-06-01 18:17 -------- d-----w- c:\documents and settings\Administrator\Dane aplikacji\uTorrent
2009-06-01 16:19 . 2009-06-01 16:35 -------- d-----w- c:\windows\system32\CatRoot_bak
2009-06-01 16:19 . 2009-06-01 16:19 -------- d-----w- c:\program files\NAPI-PROJEKT
2009-06-01 16:19 . 2009-06-01 16:19 -------- d-----w- c:\program files\ALLPlayer
2009-06-01 16:17 . 2008-09-16 19:23 168448 ----a-w- c:\windows\system32\unrar.dll
2009-06-01 16:17 . 2004-01-25 16:18 217088 ----a-w- c:\windows\system32\yv12vfw.dll
2009-06-01 16:17 . 2008-12-11 00:33 86016 ----a-w- c:\windows\system32\dpl100.dll
2009-06-01 16:17 . 2008-12-07 18:08 795648 ----a-w- c:\windows\system32\xvidcore.dll
2009-06-01 16:17 . 2008-12-07 18:08 130048 ----a-w- c:\windows\system32\xvidvfw.dll
2009-06-01 16:17 . 2008-11-06 16:37 3596288 ----a-w- c:\windows\system32\qt-dx331.dll
2009-06-01 16:17 . 2008-11-06 16:33 684032 ----a-w- c:\windows\system32\divx.dll
2009-06-01 16:17 . 2009-04-02 13:21 84480 ----a-w- c:\windows\system32\ff_vfw.dll
2009-06-01 16:17 . 2009-06-01 16:18 -------- d-----w- c:\program files\K-Lite Codec Pack
2009-06-01 16:17 . 2004-01-11 22:00 348160 ----a-w- c:\windows\system32\msvcr71.dll
2009-06-01 16:10 . 2009-06-01 16:10 -------- d-sh–w- c:\documents and settings\Administrator\IECompatCache
2009-06-01 16:10 . 2009-06-01 16:10 -------- d-sh–w- c:\documents and settings\Administrator\PrivacIE
2009-06-01 16:09 . 2009-06-01 16:09 -------- d-sh–w- c:\documents and settings\NetworkService\IETldCache
2009-06-01 16:07 . 2009-06-01 16:07 -------- d-sh–w- c:\documents and settings\Administrator\IETldCache
2009-06-01 16:04 . 2009-06-01 16:05 -------- d-----w- c:\windows\system32\pl-PL
2009-06-01 16:04 . 2009-06-01 16:05 -------- dc-h–w- c:\windows\ie8
2009-06-01 16:04 . 2009-06-01 16:05 -------- d–h--w- c:\windows\msdownld.tmp
2009-06-01 16:00 . 2001-10-26 14:57 12160 -c–a-w- c:\windows\system32\dllcache\mouhid.sys
2009-06-01 16:00 . 2001-10-26 14:57 12160 ----a-w- c:\windows\system32\drivers\mouhid.sys
2009-06-01 16:00 . 2001-08-17 20:02 9600 -c–a-w- c:\windows\system32\dllcache\hidusb.sys
2009-06-01 16:00 . 2001-08-17 20:02 9600 ----a-w- c:\windows\system32\drivers\hidusb.sys
2009-06-01 12:55 . 2009-06-01 16:10 -------- d-----w- c:\documents and settings\Administrator\Ustawienia lokalne\Dane aplikacji\Google
2009-06-01 12:51 . 2009-06-01 16:17 -------- d–h--w- c:\windows$hf_mig$
2009-06-01 12:48 . 2009-06-01 12:48 56 —ha-w- c:\windows\system32\ezsidmv.dat
2009-06-01 12:48 . 2009-06-01 12:48 -------- d-----w- c:\documents and settings\Administrator\Dane aplikacji\skypePM
2009-06-01 12:47 . 2009-06-01 16:09 -------- d-----w- c:\documents and settings\Administrator\Dane aplikacji\Skype
2009-06-01 12:47 . 2009-06-01 12:47 -------- d-----w- c:\program files\Google
2009-06-01 12:47 . 2009-06-01 12:47 -------- d-----w- c:\program files\Common Files\Skype
2009-06-01 12:47 . 2009-06-01 12:47 -------- d-----r- c:\program files\Skype
2009-06-01 12:47 . 2009-06-01 12:47 -------- d-----w- c:\documents and settings\All Users\Dane aplikacji\Skype
2009-05-31 17:58 . 2009-05-31 18:12 -------- d-----w- c:\program files\Ovislink
2009-05-31 17:20 . 2009-05-31 17:20 -------- d-----w- c:\documents and settings\All Users\Dane aplikacji\TOSHIBA
2009-05-31 17:20 . 2009-05-31 17:20 -------- d-----w- c:\documents and settings\Administrator\Ustawienia lokalne\Dane aplikacji\Toshiba
2009-05-31 17:18 . 2009-05-31 17:18 -------- d-----w- c:\documents and settings\Default User\Dane aplikacji\TOSHIBA
2009-05-31 17:17 . 2006-10-23 14:32 9216 ----a-w- c:\windows\system32\drivers\tosrfec.sys
2009-05-31 17:17 . 2009-03-19 12:07 43264 ----a-w- c:\windows\system32\drivers\tosrfusb.sys
2009-05-31 17:17 . 2009-03-05 09:03 74368 ----a-w- c:\windows\system32\drivers\Tosrfhid.sys
2009-05-31 17:17 . 2008-10-06 15:56 137984 ----a-w- c:\windows\system32\drivers\tosrfbd.sys
2009-05-31 17:17 . 2009-03-12 09:33 16128 ----a-w- c:\windows\system32\drivers\tosrfnds.sys
2009-05-31 17:17 . 2009-03-03 13:42 36864 ----a-w- c:\windows\system32\drivers\tosrfbnp.sys
2009-05-31 17:17 . 2009-03-23 15:28 54272 ----a-w- c:\windows\system32\drivers\TosRfSnd.sys
2009-05-31 17:17 . 2009-02-19 14:20 63872 ----a-w- c:\windows\system32\drivers\tosrfcom.sys
2009-05-31 17:17 . 2008-03-25 11:54 41472 ----a-w- c:\windows\system32\drivers\tosporte.sys
2009-05-31 17:03 . 2009-05-31 17:03 -------- d-s—w- c:\documents and settings\Administrator\UserData
2009-05-31 16:52 . 2009-02-23 08:05 338944 ----a-w- c:\windows\system32\drivers\RTL8187B.sys
2009-05-31 16:52 . 2009-02-23 08:05 338944 ----a-w- c:\windows\system\rtl8187B.sys
2009-05-31 16:52 . 2009-05-31 16:52 -------- d-----w- c:\program files\Realtek WLAN driver
2009-05-31 16:44 . 2009-05-31 16:44 -------- d-----w- c:\documents and settings\Administrator\Dane aplikacji\InstallShield
2009-05-29 18:43 . 2009-05-29 18:43 12328 ----a-w- c:\documents and settings\Administrator\Ustawienia lokalne\Dane aplikacji\GDIPFONTCACHEV1.DAT
2009-05-29 17:57 . 2008-06-02 10:28 12032 ----a-w- c:\windows\system32\drivers\Netdevio.sys
2009-05-29 17:37 . 2009-05-29 17:37 -------- d-----w- c:\documents and settings\Administrator\Dane aplikacji\WinBatch
2009-05-29 17:34 . 2009-02-23 08:05 310528 ----a-w- c:\windows\system32\drivers\rtl8187Se.sys
2009-05-29 17:34 . 2009-02-23 08:05 310528 ----a-w- c:\windows\system\rtl8187Se.sys
2009-05-29 17:34 . 2009-02-23 08:05 511872 ----a-w- c:\windows\system32\drivers\rtl819xp.sys
2009-05-29 17:34 . 2009-02-23 08:05 511872 ----a-w- c:\windows\system\rtl819xp.sys
2009-05-29 17:32 . 2009-05-29 17:32 -------- d-----w- c:\program files\DIFX
2009-05-29 16:47 . 2009-05-29 16:47 -------- d-----w- C:\TD08TBF
2009-05-29 16:45 . 2009-05-29 16:45 -------- d-----w- c:\program files\ltmoh
2009-05-29 16:45 . 2008-06-02 08:05 77824 ----a-w- c:\windows\system32\tosmreg.exe
2009-05-29 16:45 . 2008-06-02 08:05 491520 ----a-w- c:\windows\system32\cselect.exe
2009-05-29 16:45 . 2008-06-02 08:05 45056 ----a-w- c:\windows\system32\csellang.dll
2009-05-29 16:45 . 2008-06-02 08:05 9216 ----a-w- c:\windows\system32\agrsmsvc.exe
2009-05-29 16:45 . 2008-06-02 08:05 50752 ------w- c:\windows\agrsmdel.exe
2009-05-29 16:45 . 2008-06-02 08:05 1161888 ----a-w- c:\windows\system32\drivers\AGRSM.sys
2009-05-29 16:45 . 2008-06-02 08:05 13312 ----a-w- c:\windows\system32\agrscoin.dll
2009-05-29 16:41 . 2008-06-02 08:04 220032 ----a-w- c:\windows\system32\drivers\SynTP.sys
2009-05-29 16:41 . 2008-06-02 08:04 147456 ----a-w- c:\windows\system32\SynTPAPI.dll
2009-05-29 16:41 . 2008-06-02 08:04 110592 ----a-w- c:\windows\system32\SynTPCo4.dll
2009-05-29 16:41 . 2008-06-02 08:04 196608 ----a-w- c:\windows\system32\SynCtrl.dll
2009-05-29 16:41 . 2009-05-29 16:41 -------- d-----w- c:\program files\Synaptics
2009-05-29 16:41 . 2008-06-02 08:04 163840 ----a-w- c:\windows\system32\SynCOM.dll
2009-05-29 16:40 . 2007-12-17 09:45 18432 ----a-w- c:\windows\system32\drivers\UVCFTR_S.SYS
2009-05-29 16:40 . 2009-05-29 16:40 -------- d-----w- c:\program files\Camera Assistant Software for Toshiba
2009-05-29 16:39 . 2007-10-15 14:36 45056 ----a-w- c:\windows\system32\TPwrCfg.dll
2009-05-29 16:39 . 2007-10-15 14:36 40960 ----a-w- c:\windows\system32\TPSAddin.dll
2009-05-29 16:39 . 2007-10-15 14:37 266240 ----a-w- c:\windows\system32\TPSMain.exe
2009-05-29 16:39 . 2007-10-15 14:36 49152 ----a-w- c:\windows\system32\TPSDel.dll
2009-05-29 16:39 . 2007-10-15 14:36 40960 ----a-w- c:\windows\system32\TPSMainCtl.dll
2009-05-29 16:39 . 2007-10-15 14:36 86016 ----a-w- c:\windows\system32\CpuPerf.dll
2009-05-29 16:39 . 2007-10-15 14:36 40960 ----a-w- c:\windows\system32\TPSBattM.exe
2009-05-29 16:39 . 2007-10-15 14:36 49152 ----a-w- c:\windows\system32\TPSTrace.dll
2009-05-29 16:39 . 2007-10-15 14:36 77824 ----a-w- c:\windows\system32\TPwrReg.dll
2009-05-29 16:38 . 2009-05-29 16:38 -------- d-----w- c:\windows\system32\SDA
2009-05-29 16:36 . 2009-05-31 16:37 376832 ----a-w- c:\windows\system32\AegisI5Installer.exe
2009-05-29 16:36 . 2009-05-29 16:36 -------- d-----w- c:\windows\system32\config\systemprofile\Dane aplikacji\Intel
2009-05-29 16:35 . 2009-05-31 17:21 -------- d-----w- c:\documents and settings\Administrator\Dane aplikacji\toshiba
2009-05-29 16:33 . 2009-05-31 16:38 -------- d-----w- c:\program files\Intel
2009-05-29 16:28 . 2008-01-21 12:29 53248 ----a-w- c:\windows\system32\DLLVGA.dll
2009-05-29 16:28 . 2007-12-11 06:54 24576 ----a-w- c:\windows\system32\LEDONOFF.exe
2009-05-29 16:28 . 2007-10-08 11:02 28672 ----a-w- c:\windows\system32\TPeculiarity.dll
2009-05-29 16:28 . 2007-04-10 08:22 118784 ----a-w- c:\windows\system32\TCtrlIO.dll
2009-05-29 16:28 . 2007-04-10 07:08 4608 ----a-w- c:\windows\system32\TSBWLS.dll
2009-05-29 16:28 . 2007-04-10 07:05 9728 ----a-w- c:\windows\system32\TCMSVR.dll
2009-05-29 16:28 . 2007-04-04 06:56 5888 ----a-w- c:\windows\system32\drivers\FwLnk.sys
2009-05-29 16:24 . 2009-05-29 16:24 -------- d-----w- c:\documents and settings\All Users\Dane aplikacji\Atheros
2009-05-29 16:23 . 2008-06-02 08:03 105856 ----a-w- c:\windows\system32\drivers\Rtenicxp.sys
2009-05-29 16:23 . 2009-05-29 16:23 -------- d-----w- c:\windows\OPTIONS
2009-05-29 16:21 . 2008-06-02 07:57 180224 ----a-w- c:\windows\system32\igfxres.dll
2009-05-29 16:14 . 2009-05-29 16:14 -------- d-----w- c:\windows\system32\Lang
2009-05-29 16:12 . 2004-08-03 21:15 60800 -c–a-w- c:\windows\system32\dllcache\sysaudio.sys
2009-05-29 16:11 . 2009-05-31 17:59 -------- d–h--w- c:\program files\InstallShield Installation Information
2009-05-29 16:11 . 2009-05-31 17:17 -------- d-----w- c:\program files\TOSHIBA
2009-05-29 16:11 . 2009-05-29 16:12 -------- d-----w- c:\program files\Common Files\InstallShield
2009-05-29 16:00 . 2009-05-31 16:32 -------- d-----w- C:\Temp
2009-05-29 16:00 . 2008-03-14 14:02 2097152 ----a-w- c:\temp\autorun.bin
.
(((((((((((((((((((((((((((((((((((((((( Sekcja Find3M ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-06-01 18:40 . 2009-06-01 18:28 9155 ----a-w- c:\windows\system32\drivers\kwflower.log
2009-06-01 18:38 . 2009-06-01 18:30 3550 ----a-w- c:\windows\system32\drivers\kwfupper.log
2009-05-31 18:01 . 2001-10-26 16:15 49910 ----a-w- c:\windows\system32\perfc015.dat
2009-05-31 18:01 . 2001-10-26 16:15 356068 ----a-w- c:\windows\system32\perfh015.dat
2009-05-31 16:45 . 2009-05-29 16:12 -------- d-----w- c:\program files\Realtek
2009-05-29 16:12 . 2009-05-29 16:12 315392 ----a-w- c:\windows\HideWin.exe
2009-05-29 12:10 . 2009-05-29 10:41 86327 ----a-w- c:\windows\pchealth\helpctr\OfflineCache\index.dat
2009-05-29 10:42 . 2009-05-29 10:42 -------- d-----w- c:\program files\microsoft frontpage
2009-05-29 10:40 . 2009-05-29 10:40 -------- d-----w- c:\program files\Usługi online
2009-05-29 10:39 . 2009-05-29 10:39 21856 ----a-w- c:\windows\system32\emptyregdb.dat
2009-03-08 02:34 . 2004-08-03 23:44 914944 ----a-w- c:\windows\system32\wininet.dll
2009-03-08 02:34 . 2004-08-03 23:44 43008 ----a-w- c:\windows\system32\licmgr10.dll
2009-03-08 02:33 . 2004-08-03 23:43 18944 ----a-w- c:\windows\system32\corpol.dll
2009-03-08 02:33 . 2004-08-03 23:44 420352 ----a-w- c:\windows\system32\vbscript.dll
2009-03-08 02:32 . 2004-08-03 23:43 72704 ----a-w- c:\windows\system32\admparse.dll
2009-03-08 02:32 . 2004-08-03 23:44 71680 ----a-w- c:\windows\system32\iesetup.dll
2009-03-08 02:31 . 2004-08-03 23:44 34816 ----a-w- c:\windows\system32\imgutil.dll
2009-03-08 02:31 . 2004-08-03 23:42 48128 ----a-w- c:\windows\system32\mshtmler.dll
2009-03-08 02:31 . 2004-08-03 23:44 45568 ----a-w- c:\windows\system32\mshta.exe
2009-03-08 02:22 . 2001-10-26 17:26 156160 ----a-w- c:\windows\system32\msls31.dll
.
((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane
REGEDIT4
[HKEY_LOCAL_MACHINE~\Browser Helper Objects{201f27d4-3704-41d6-89c1-aa35e39143ed}]
2009-04-02 10:47 333192 ----a-w- c:\program files\AskBarDis\bar\bin\askBar.dll
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
“CTFMON.EXE”=“c:\windows\system32\ctfmon.exe” [2004-08-03 15360]
“TOSCDSPD”=“c:\program files\TOSHIBA\TOSCDSPD\toscdspd.exe” [2005-04-12 65536]
“swg”=“c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe” [2009-06-01 39408]
“ALLUpdate”=“c:\program files\ALLPlayer\ALLUpdate.exe” [2008-11-24 869888]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
“IgfxTray”=“c:\windows\system32\igfxtray.exe” [2008-06-02 141848]
“HotKeysCmds”=“c:\windows\system32\hkcmd.exe” [2008-06-02 162328]
“Persistence”=“c:\windows\system32\igfxpers.exe” [2008-06-02 137752]
“THotkey”=“c:\program files\Toshiba\Toshiba Applet\thotkey.exe” [2008-03-04 360448]
“SmoothView”=“c:\program files\TOSHIBA\Program narzędziowy TOSHIBA Zooming Utility\SmoothView.exe” [2007-05-11 143360]
“Camera Assistant Software”=“c:\program files\Camera Assistant Software for Toshiba\traybar.exe” [2007-10-25 413696]
“SynTPEnh”=“c:\program files\Synaptics\SynTP\SynTPEnh.exe” [2008-06-02 1024000]
“ITSecMng”=“c:\program files\TOSHIBA\Bluetooth Toshiba Stack\ItSecMng.exe” [2008-12-19 83336]
“Adobe Reader Speed Launcher”=“c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe” [2009-02-27 35696]
“egui”=“c:\program files\ESET\ESET NOD32 Antivirus\egui.exe” [2009-02-06 2021400]
“RTHDCPL”=“RTHDCPL.EXE” - c:\windows\RTHDCPL.exe [2008-06-02 16859648]
“BluetoothAuthenticationAgent”=“bthprops.cpl” - c:\windows\system32\bthprops.cpl [2004-08-03 110592]
“TPSMain”=“TPSMain.exe” - c:\windows\system32\TPSMain.exe [2007-10-15 266240]
“TFncKy”=“TFncKy.exe” [bU]
“NDSTray.exe”=“NDSTray.exe” [bU]
“CFSServ.exe”=“CFSServ.exe” [bU]
[HKEY_USERS.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
“CTFMON.EXE”=“c:\windows\system32\CTFMON.EXE” [2004-08-03 15360]
c:\documents and settings\All Users\Menu Start\Programy\Autostart\
Bluetooth Manager.lnk - c:\program files\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe [2009-3-19 2532680]
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
“AntiVirusDisableNotify”=dword:00000001
“UpdatesDisableNotify”=dword:00000001
[HKLM~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
“EnableFirewall”= 0 (0x0)
[HKLM~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
“%windir%\system32\sessmgr.exe”=
“c:\Program Files\Skype\Phone\Skype.exe”=
“c:\Program Files\uTorrent\uTorrent.exe”=
R1 ehdrv;ehdrv;c:\windows\system32\drivers\ehdrv.sys [2009-02-06 106208]
R1 epfwtdir;epfwtdir;c:\windows\system32\drivers\epfwtdir.sys [2009-02-06 93336]
R2 ekrn;ESET Service;c:\program files\ESET\ESET NOD32 Antivirus\ekrn.exe [2009-02-06 727720]
R3 FwLnk;FwLnk Driver;c:\windows\system32\drivers\FwLnk.sys [2009-05-29 5888]
R3 RTL8187B;Realtek RTL8187B bezprzewodowe 802.11b/g 54Mbps USB 2.0 karta sieciowa ;c:\windows\system32\drivers\RTL8187B.sys [2009-05-31 338944]
S2 ASKUpgrade;ASKUpgrade;c:\program files\AskBarDis\bar\bin\ASKUpgrade.exe [2009-06-01 234888]
S3 kvpndev;Kerio VPN adapter;c:\windows\system32\drivers\kvpndrv.sys [2008-06-24 65024]
S3 kwflower;Kerio WinRoute Firewall Driver - Lower Layer;c:\windows\system32\DRIVERS\kwflower.sys --> c:\windows\system32\DRIVERS\kwflower.sys [?]
.
-
-
-
- USUNIĘTO PUSTE WPISY - - - -
-
-
SafeBoot-procexp90.Sys
.
------- Skan uzupełniający -------
.
uStart Page = hxxp://www.ask.com/?o=13928&l=dis
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
Filter: x-sdch - {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - c:\program files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-06-01 21:12
Windows 5.1.2600 Dodatek Service Pack 2 NTFS
skanowanie ukrytych procesów …
skanowanie ukrytych wpisów autostartu …
skanowanie ukrytych plików …
skanowanie pomyślnie ukończone
ukryte pliki: 0
**************************************************************************
.
--------------------- ZABLOKOWANE KLUCZE REJESTRU ---------------------
[HKEY_USERS\S-1-5-21-1177238915-261903793-725345543-500\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (Administrator)
“88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977”=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,46,3b,74,b7,29,a9,df,46,b8,ea,96,\
“2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81”=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,46,3b,74,b7,29,a9,df,46,b8,ea,96,\
.
--------------------- Pliki DLL ładowane pod uruchomionymi procesami ---------------------
-
-
-
-
-
-
- > ‘explorer.exe’(3168)
-
-
-
-
-
c:\windows\system32\msi.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\TPwrCfg.DLL
c:\windows\system32\TPwrReg.dll
c:\windows\system32\TPSTrace.DLL
.
------------------------ Pozostałe uruchomione procesy ------------------------
.
c:\windows\system32\agrsmsvc.exe
c:\program files\TOSHIBA\ConfigFree\CFSvcs.exe
c:\program files\TOSHIBA\TOSHIBA Applet\TAPPSRV.exe
c:\program files\TOSHIBA\Bluetooth Toshiba Stack\TosBtSrv.exe
c:\windows\system32\rundll32.exe
c:\program files\TOSHIBA\Program narzc:\program files\Camera Assistant Software for Toshiba\traybar.exe
c:\windows\system32\igfxsrvc.exe
c:\program files\TOSHIBA\ConfigFree\NDSTray.exe
c:\program files\Camera Assistant Software for Toshiba\CEC_MAIN.exe
c:\windows\system32\TPSBattM.exe
c:\program files\TOSHIBA\Bluetooth Toshiba Stack\TosBtHid.exe
c:\program files\TOSHIBA\Bluetooth Toshiba Stack\TosOBEX.exe
c:\program files\TOSHIBA\Bluetooth Toshiba Stack\TosBtProc.exe
c:\windows\system32\wscntfy.exe
.
**************************************************************************
.
Czas ukończenia: 2009-06-01 21:13 - komputer został uruchomiony ponownie
ComboFix-quarantined-files.txt 2009-06-01 19:13
Przed: 239 308 263 424 bajtów wolnych
Po: 239 317 508 096 bajtów wolnych
WindowsXP-KB310994-SP2-Pro-BootDisk-PLK.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT=“Microsoft Windows Recovery Console” /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS=“Microsoft Windows XP Professional” /noexecute=optin /fastdetect
285 — E O F — 2009-06-01 15:57
PROSZĘ O POMOC 