Wyniki wyszukiwania w google prowadzą do ://realserch.cc/fee

[morales (Amierzejewski)]

avast wykrywa wirusy

ciagle i ciagle

dodatkowo i co ciekawe sukam w google po hasle i klikajac w jakakolwiek strone otwiera sie karta z http://realsearch/feed z informacja “Relevant Google Links for…”

co z tym zrobić

podaje loga z smit’a

SmitFraudFix v2.234 Scan done at 20:57:35,63, 2007-11-27 Run from C:\Documents and Settings\Arkadiusz\Moje dokumenty\Dobre programy\SmitfraudFix OS: Microsoft Windows XP [Wersja 5.1.2600] - Windows_NT The filesystem type is NTFS Fix run in normal mode »»»»»»»»»»»»»»»»»»»»»»»» Process C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\System32\igfxtray.exe C:\WINDOWS\System32\hkcmd.exe C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe C:\WINDOWS\system32\dla\tfswctrl.exe C:\Program Files\Synaptics\SynTP\SynTPLpr.exe C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe C:\WINDOWS\System32\hphmon05.exe C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\WINDOWS\system32\spoolv.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Messenger\msmsgs.exe C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Last.fm\LastFMHelper.exe C:\Program Files\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\HPQ\SHARED\HPQWMI.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Documents and Settings\Arkadiusz\Dane aplikacji\29353.exe C:\WINDOWS\system32\cmd.exe »»»»»»»»»»»»»»»»»»»»»»»» hosts »»»»»»»»»»»»»»»»»»»»»»»» C:\ »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS C:\WINDOWS\svchost.exe FOUND ! »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32 »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32\LogFiles »»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Arkadiusz »»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Arkadiusz\Application Data »»»»»»»»»»»»»»»»»»»»»»»» Start Menu »»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\ARKADI~1\Ulubione »»»»»»»»»»»»»»»»»»»»»»»» Desktop »»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files »»»»»»»»»»»»»»»»»»»»»»»» Corrupted keys »»»»»»»»»»»»»»»»»»»»»»»» Desktop Components »»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler !Attention, following keys are not inevitably infected! SrchSTS.exe by S!Ri Search SharedTaskScheduler’s .dll »»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs !Attention, following keys are not inevitably infected! [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] “AppInit_DLLs”=“C:\WINDOWS\system32\append.dll” »»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System !Attention, following keys are not inevitably infected! [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] “System”="" »»»»»»»»»»»»»»»»»»»»»»»» Rustock »»»»»»»»»»»»»»»»»»»»»»»» DNS Description: Realtek RTL8139/810x Family Fast Ethernet NIC - Sterownik miniport Harmonogramu pakietów DNS Server Search Order: 212.76.33.137 DNS Server Search Order: 212.76.33.138 DNS Server Search Order: 212.76.39.211 HKLM\SYSTEM\CCS\Services\Tcpip…{629512A9-7C36-41D3-8582-13E31AAB81F6}: DhcpNameServer=212.76.33.137 212.76.33.138 212.76.39.211 HKLM\SYSTEM\CS1\Services\Tcpip…{629512A9-7C36-41D3-8582-13E31AAB81F6}: DhcpNameServer=212.76.33.137 212.76.33.138 212.76.39.211 HKLM\SYSTEM\CS3\Services\Tcpip…{629512A9-7C36-41D3-8582-13E31AAB81F6}: DhcpNameServer=212.76.33.137 212.76.33.138 212.76.39.211 HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=212.76.33.137 212.76.33.138 212.76.39.211 HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=212.76.33.137 212.76.33.138 212.76.39.211 HKLM\SYSTEM\CS3\Services\Tcpip\Parameters: DhcpNameServer=212.76.33.137 212.76.33.138 212.76.39.211 »»»»»»»»»»»»»»»»»»»»»»»» Scanning for wininet.dll infection »»»»»»»»»»»»»»»»»»»»»»»» End

[Gutek]

Zastosuj się do tego Tematu i zmień tytuł tematu na konkretny inaczej KOSZ

Pozdrawiam Gutek2222

Daj log z ComboFix

[morales (Amierzejewski)]

sukam w google po hasle i klikajac w jakakolwiek strone otwiera sie karta z http://realsearch/feed z informacja “Relevant Google Links for…”

co z tym zrobić

poza tym avast wykrywa wirusy

wklejam loga z combo

ComboFix 07-11-19.4 - Arkadiusz 2007-11-28 17:40:50.10 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.2.1250.1.1045.18.197 [GMT 1:00] Running from: C:\Documents and Settings\Arkadiusz\Moje dokumenty\Dobre programy\ComboFix.exe . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\Documents and Settings\Arkadiusz\Dane aplikacji\30882.exe C:\WINDOWS\system32\append.dll . ((((((((((((((((((((((((( Files Created from 2007-10-28 to 2007-11-28 ))))))))))))))))))))))))))))))) . 2007-11-27 20:30 23,074 --a------ C:\Documents and Settings\Arkadiusz\Dane aplikacji\info.dat 2007-11-27 20:12 18,432 --a------ C:\WINDOWS\system32\append.dll 2007-11-27 20:12 9,728 --a------ C:\Documents and Settings\Arkadiusz\Dane aplikacji\printer.exe 2007-11-27 20:11 6,058,496 --------- C:\WINDOWS\system32\dllcache\ieframe.dll 2007-11-27 20:11 2,455,488 --------- C:\WINDOWS\system32\dllcache\ieapfltr.dat 2007-11-27 20:11 1,036,288 --------- C:\WINDOWS\system32\dllcache\ieframe.dll.mui 2007-11-27 20:11 459,264 --------- C:\WINDOWS\system32\dllcache\msfeeds.dll 2007-11-27 20:11 383,488 --------- C:\WINDOWS\system32\dllcache\ieapfltr.dll 2007-11-27 20:11 267,776 --------- C:\WINDOWS\system32\dllcache\iertutil.dll 2007-11-27 20:11 63,488 --------- C:\WINDOWS\system32\dllcache\icardie.dll 2007-11-27 20:11 52,224 --------- C:\WINDOWS\system32\dllcache\msfeedsbs.dll 2007-11-27 20:11 13,824 --------- C:\WINDOWS\system32\dllcache\ieudinit.exe 2007-11-27 20:10 2007-11-27 20:06 33,792 --a------ C:\WINDOWS\system32\dllcache\custsat.dll 2007-11-19 18:25 2,852 --a------ C:\WINDOWS\system32\AcroIEHelper.xml 2007-11-18 20:23 13,057 --a------ C:\Documents and Settings\Arkadiusz\wn852.exe 2007-11-14 18:07 2007-11-12 19:40 289,280 --a------ C:\WINDOWS\system32\libcurl.dll 2007-11-12 19:40 55,808 --a------ C:\WINDOWS\system32\spoolv.exe 2007-11-10 15:27 2007-11-08 22:03 2007-11-08 22:03 2007-11-08 22:03 2007-11-08 22:03 2007-11-08 22:03 2007-11-08 22:03 2007-11-08 22:03 2007-11-08 22:03 2007-11-08 22:03 2007-11-06 21:42 2007-11-06 21:37 2007-11-05 15:03 528,896 --a------ C:\WINDOWS\system32\AcroIEHelper.dll . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2007-11-28 16:45 --------- d-----w C:\Documents and Settings\Arkadiusz\Dane aplikacji\Skype 2007-11-27 20:31 --------- d-----w C:\Program Files\Agent Hugo RoboRumble 2007-11-06 20:51 --------- d-----w C:\Documents and Settings\Arkadiusz\Dane aplikacji\AdobeUM 2007-11-06 20:16 --------- d-----w C:\Program Files\Windows Media Connect 2 2007-11-06 20:15 --------- d-----w C:\Program Files\RegCleaner 2007-11-06 20:15 --------- d-----w C:\Program Files\RecordNow! 2007-11-06 20:15 --------- d-----w C:\Program Files\QuickTime 2007-11-06 20:14 --------- d-----w C:\Program Files\Last.fm 2007-11-06 20:14 --------- d-----w C:\Program Files\Gwiezdny Mściciel 2007-11-06 20:14 --------- d-----w C:\Program Files\Google 2007-11-06 20:14 --------- d-----w C:\Program Files\Gadu-Gadu 2007-11-06 20:14 --------- d-----w C:\Program Files\Easy Internet signup 2007-11-06 20:14 --------- d-----w C:\Program Files\DivX 2007-10-13 19:48 --------- d-----w C:\Program Files\Real 2007-10-13 19:48 --------- d-----w C:\Program Files\Common Files\xing shared 2007-10-13 19:48 --------- d-----w C:\Program Files\Common Files\Real 2007-10-02 17:16 --------- d-----w C:\Program Files\Alwil Software 2007-09-30 16:53 --------- d-----w C:\Program Files\Trend Micro 2007-07-24 17:56 2,803,440 ----a-w C:\Program Files\Shockwave_Installer_Slim.exe 2007-07-07 20:42 676,878 ----a-w C:\Program Files\setup_AAC_aacPlus_plugin_1_0_33.exe 2007-07-07 17:33 4,028,461 ----a-w C:\Program Files\LastFM_Win_1.3.0.58.exe 2007-06-30 19:10 23,640,104 ----a-w C:\Program Files\SkypeSetup.exe 2007-06-24 20:26 4,109,584 ----a-w C:\Program Files\gg77.exe 2005-09-30 12:39 17,144 ----a-w C:\Documents and Settings\Arkadiusz\Dane aplikacji\GDIPFONTCACHEV1.DAT . ((((((((((((((((((((((((((((( snapshot@2007-11-27_22.07.03.16 ))))))))))))))))))))))))))))))))))))))))) . + 2007-11-28 16:44:27 16,384 ----atw C:\WINDOWS\temp\Perflib_Perfdata_48c.dat . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE~\Browser Helper Objects{F3CFA533-7680-4943-A863-B8216390E847}] 2007-11-05 15:03 528896 --a------ C:\WINDOWS\system32\AcroIEHelper.dll [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “CTFMON.EXE”=“C:\WINDOWS\system32\ctfmon.exe” [2004-08-04 08:44] “RecordNow!”="" [] “MSMSGS”=“C:\Program Files\Messenger\msmsgs.exe” [2004-10-13 17:24] “Gadu-Gadu”=“C:\Program Files\Gadu-Gadu\gg.exe” [2007-05-10 15:36] “Skype”=“C:\Program Files\Skype\Phone\Skype.exe” [2007-06-08 14:18] “swg”=“C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe” [2007-07-10 19:46] “timeNoticeSL001”=“C:\Documents and Settings\Arkadiusz\wn852.exe” [2007-11-18 20:52] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “IgfxTray”=“C:\WINDOWS\System32\igfxtray.exe” [2003-10-30 09:46] “HotKeysCmds”=“C:\WINDOWS\System32\hkcmd.exe” [2003-10-30 09:33] “SunJavaUpdateSched”=“C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe” [2003-05-03 02:17] “UpdateManager”=“C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe” [2003-08-19 00:01] “dla”=“C:\WINDOWS\system32\dla\tfswctrl.exe” [2004-03-25 00:04] “SynTPLpr”=“C:\Program Files\Synaptics\SynTP\SynTPLpr.exe” [2004-05-26 18:15] “SynTPEnh”=“C:\Program Files\Synaptics\SynTP\SynTPEnh.exe” [2004-05-26 18:15] “HPHUPD05”=“c:\Program Files\Hewlett-Packard{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe” [2003-05-22 19:03] “HP Software Update”=“c:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe” [2002-12-17 10:40] “HPHmon05”=“C:\WINDOWS\System32\hphmon05.exe” [2003-05-22 18:59] “Cpqset”=“C:\Program Files\HPQ\Default Settings\cpqset.exe” [2004-04-30 09:32] “eabconfg.cpl”=“C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe” [2004-04-30 12:50] “Adobe Photo Downloader”=“C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe” [2005-06-06 22:46] “avast!”=“C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe” [2007-09-06 11:06] “TkBellExe”=“C:\Program Files\Common Files\Real\Update_OB\realsched.exe” [2007-10-13 20:47] “UserFaultCheck”=“C:\WINDOWS\system32\dumprep 0 -u” [] “dumprep”=“C:\WINDOWS\system32\spoolv.exe” [2007-11-12 19:40] [HKEY_USERS.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] “CTFMON.EXE”=“C:\WINDOWS\System32\CTFMON.EXE” [2004-08-04 08:44] C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\ Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 21:05:26] Last.fm Helper.lnk - C:\Program Files\Last.fm\LastFMHelper.exe [2007-07-07 18:33:34] Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 10:01:04] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] “AppInit_DLLs”=C:\WINDOWS\system32\append.dll [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders] SecurityProviders msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll, append.dll S3 USBSTOR;Sterownik magazynu masowego USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS . Contents of the ‘Scheduled Tasks’ folder “2005-04-10 17:43:17 C:\WINDOWS\Tasks\Symantec NetDetect.job” - C:\Program Files\Symantec\LiveUpdate\NDETECT.EXE . ************************************************************************** catchme 0.3.1262 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-11-28 17:46:01 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes … scanning hidden autostart entries … HKLM\Software\Microsoft\Windows\CurrentVersion\Run Cpqset = C:\Program Files\HPQ\Default Settings\cpqset.exe???3?6?5?3??? ???B???B? ??? scanning hidden files … scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2007-11-28 17:48:22 - machine was rebooted C:\ComboFix2.txt … 2007-11-27 22:08 . — E O F —

Złączono Posta : 28.11.2007 (Sro) 18:09

Gutek2222

przepraszam ale nie wie jak mam zmienić temat

nie umiem

przepraszam nie specjalnie dobrze poruszam sie po forum

[Gutek]

Zmień tytuł na konkretny, używając

funkcji

Wklej do Notatnika:

File:: C:\Documents and Settings\Arkadiusz\Dane aplikacji\info.dat C:\WINDOWS\system32\append.dll C:\Documents and Settings\Arkadiusz\Dane aplikacji\printer.exe C:\Documents and Settings\Arkadiusz\wn852.exe Registry:: [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “timeNoticeSL001”=- [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] “AppInit_DLLs”=- “AppInit_DLLs”="" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders] “SecurityProviders”=- “SecurityProviders”=“msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll”

PlikZapisz jako… CFScript (najwygodniej będzie, jeśli zapiszesz w takiej lokalizacji, by ikonka CFScript.txt znalazła się obok ikonki ComboFix.exe )

Przeciągnij i upuść plik CFScript.txt na plik ComboFix.exe (czyli ikonkę CFScript.txt na ikonkę ComboFix.exe )

– podobnie jak na tym obrazku –

(jeśli pojawi się pytanie " 1 or 2" - to wpisz 1 i naciśnij ENTER) Ma się rozpocząć usuwanie. (i powstanie log)

Po restarcie usuń ręcznie folder C: ** Qoobox**.

Po tym nowy log z Combo

C:\WINDOWS\system32\libcurl.dll C:\WINDOWS\system32\spoolv.exe

przeskanuj pliki na http://virusscan.jotti.org/ i powiedz co wykrył skaner

[morales (Amierzejewski)]

log z combo

ComboFix 07-11-19.4 - Arkadiusz 2007-11-28 19:44:37.12 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.2.1250.1.1045.18.202 [GMT 1:00] Running from: C:\Documents and Settings\Arkadiusz\Moje dokumenty\Dobre programy\ComboFix.exe . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\Documents and Settings\Arkadiusz\Dane aplikacji\21184.exe C:\WINDOWS\system32\append.dll . ((((((((((((((((((((((((( Files Created from 2007-10-28 to 2007-11-28 ))))))))))))))))))))))))))))))) . 2007-11-28 19:39 24,932 --a------ C:\Documents and Settings\Arkadiusz\Dane aplikacji\info.dat 2007-11-27 20:12 18,432 --a------ C:\WINDOWS\system32\append.dll 2007-11-27 20:11 6,058,496 --------- C:\WINDOWS\system32\dllcache\ieframe.dll 2007-11-27 20:11 2,455,488 --------- C:\WINDOWS\system32\dllcache\ieapfltr.dat 2007-11-27 20:11 1,036,288 --------- C:\WINDOWS\system32\dllcache\ieframe.dll.mui 2007-11-27 20:11 459,264 --------- C:\WINDOWS\system32\dllcache\msfeeds.dll 2007-11-27 20:11 383,488 --------- C:\WINDOWS\system32\dllcache\ieapfltr.dll 2007-11-27 20:11 267,776 --------- C:\WINDOWS\system32\dllcache\iertutil.dll 2007-11-27 20:11 63,488 --------- C:\WINDOWS\system32\dllcache\icardie.dll 2007-11-27 20:11 52,224 --------- C:\WINDOWS\system32\dllcache\msfeedsbs.dll 2007-11-27 20:11 13,824 --------- C:\WINDOWS\system32\dllcache\ieudinit.exe 2007-11-27 20:10 2007-11-27 20:06 33,792 --a------ C:\WINDOWS\system32\dllcache\custsat.dll 2007-11-19 18:25 2,852 --a------ C:\WINDOWS\system32\AcroIEHelper.xml 2007-11-14 18:07 2007-11-12 19:40 289,280 --a------ C:\WINDOWS\system32\libcurl.dll 2007-11-12 19:40 55,808 --a------ C:\WINDOWS\system32\spoolv.exe 2007-11-10 15:27 2007-11-08 22:03 2007-11-08 22:03 2007-11-08 22:03 2007-11-08 22:03 2007-11-08 22:03 2007-11-08 22:03 2007-11-08 22:03 2007-11-08 22:03 2007-11-08 22:03 2007-11-06 21:42 2007-11-06 21:37 2007-11-05 15:03 528,896 --a------ C:\WINDOWS\system32\AcroIEHelper.dll . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2007-11-28 18:43 --------- d-----w C:\Documents and Settings\Arkadiusz\Dane aplikacji\Skype 2007-11-27 20:31 --------- d-----w C:\Program Files\Agent Hugo RoboRumble 2007-11-06 20:51 --------- d-----w C:\Documents and Settings\Arkadiusz\Dane aplikacji\AdobeUM 2007-11-06 20:16 --------- d-----w C:\Program Files\Windows Media Connect 2 2007-11-06 20:15 --------- d-----w C:\Program Files\RegCleaner 2007-11-06 20:15 --------- d-----w C:\Program Files\RecordNow! 2007-11-06 20:15 --------- d-----w C:\Program Files\QuickTime 2007-11-06 20:14 --------- d-----w C:\Program Files\Last.fm 2007-11-06 20:14 --------- d-----w C:\Program Files\Gwiezdny Mściciel 2007-11-06 20:14 --------- d-----w C:\Program Files\Google 2007-11-06 20:14 --------- d-----w C:\Program Files\Gadu-Gadu 2007-11-06 20:14 --------- d-----w C:\Program Files\Easy Internet signup 2007-11-06 20:14 --------- d-----w C:\Program Files\DivX 2007-10-13 19:48 --------- d-----w C:\Program Files\Real 2007-10-13 19:48 --------- d-----w C:\Program Files\Common Files\xing shared 2007-10-13 19:48 --------- d-----w C:\Program Files\Common Files\Real 2007-10-02 17:16 --------- d-----w C:\Program Files\Alwil Software 2007-09-30 16:53 --------- d-----w C:\Program Files\Trend Micro 2007-07-24 17:56 2,803,440 ----a-w C:\Program Files\Shockwave_Installer_Slim.exe 2007-07-07 20:42 676,878 ----a-w C:\Program Files\setup_AAC_aacPlus_plugin_1_0_33.exe 2007-07-07 17:33 4,028,461 ----a-w C:\Program Files\LastFM_Win_1.3.0.58.exe 2007-06-30 19:10 23,640,104 ----a-w C:\Program Files\SkypeSetup.exe 2007-06-24 20:26 4,109,584 ----a-w C:\Program Files\gg77.exe 2005-09-30 12:39 17,144 ----a-w C:\Documents and Settings\Arkadiusz\Dane aplikacji\GDIPFONTCACHEV1.DAT . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE~\Browser Helper Objects{F3CFA533-7680-4943-A863-B8216390E847}] 2007-11-05 15:03 528896 --a------ C:\WINDOWS\system32\AcroIEHelper.dll [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “CTFMON.EXE”=“C:\WINDOWS\system32\ctfmon.exe” [2004-08-04 08:44] “RecordNow!”="" [] “MSMSGS”=“C:\Program Files\Messenger\msmsgs.exe” [2004-10-13 17:24] “Gadu-Gadu”=“C:\Program Files\Gadu-Gadu\gg.exe” [2007-05-10 15:36] “Skype”=“C:\Program Files\Skype\Phone\Skype.exe” [2007-06-08 14:18] “swg”=“C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe” [2007-07-10 19:46] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “IgfxTray”=“C:\WINDOWS\System32\igfxtray.exe” [2003-10-30 09:46] “HotKeysCmds”=“C:\WINDOWS\System32\hkcmd.exe” [2003-10-30 09:33] “SunJavaUpdateSched”=“C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe” [2003-05-03 02:17] “UpdateManager”=“C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe” [2003-08-19 00:01] “dla”=“C:\WINDOWS\system32\dla\tfswctrl.exe” [2004-03-25 00:04] “SynTPLpr”=“C:\Program Files\Synaptics\SynTP\SynTPLpr.exe” [2004-05-26 18:15] “SynTPEnh”=“C:\Program Files\Synaptics\SynTP\SynTPEnh.exe” [2004-05-26 18:15] “HPHUPD05”=“c:\Program Files\Hewlett-Packard{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe” [2003-05-22 19:03] “HP Software Update”=“c:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe” [2002-12-17 10:40] “HPHmon05”=“C:\WINDOWS\System32\hphmon05.exe” [2003-05-22 18:59] “Cpqset”=“C:\Program Files\HPQ\Default Settings\cpqset.exe” [2004-04-30 09:32] “eabconfg.cpl”=“C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe” [2004-04-30 12:50] “Adobe Photo Downloader”=“C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe” [2005-06-06 22:46] “avast!”=“C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe” [2007-09-06 11:06] “TkBellExe”=“C:\Program Files\Common Files\Real\Update_OB\realsched.exe” [2007-10-13 20:47] “UserFaultCheck”=“C:\WINDOWS\system32\dumprep 0 -u” [] “dumprep”=“C:\WINDOWS\system32\spoolv.exe” [2007-11-12 19:40] [HKEY_USERS.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] “CTFMON.EXE”=“C:\WINDOWS\System32\CTFMON.EXE” [2004-08-04 08:44] C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\ Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 21:05:26] Last.fm Helper.lnk - C:\Program Files\Last.fm\LastFMHelper.exe [2007-07-07 18:33:34] Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 10:01:04] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] “AppInit_DLLs”=C:\WINDOWS\system32\append.dll [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders] SecurityProviders msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll, append.dll S3 USBSTOR;Sterownik magazynu masowego USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS . Contents of the ‘Scheduled Tasks’ folder “2005-04-10 17:43:17 C:\WINDOWS\Tasks\Symantec NetDetect.job” - C:\Program Files\Symantec\LiveUpdate\NDETECT.EXE . ************************************************************************** catchme 0.3.1262 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-11-28 19:48:38 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes … scanning hidden autostart entries … HKLM\Software\Microsoft\Windows\CurrentVersion\Run Cpqset = C:\Program Files\HPQ\Default Settings\cpqset.exe???t???|?p??? ???B???B? ??? scanning hidden files … scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2007-11-28 19:51:07 - machine was rebooted C:\ComboFix2.txt … 2007-11-28 19:33 C:\ComboFix3.txt … 2007-11-28 17:48 . — E O F —

skaner wykrył

C:\WINDOWS\system32\libcurl.dll Status: INFECTED/MALWARE Norman Virus Control Found W32/DLoader.EGRY C:\WINDOWS\system32\spoolv.exe Status: INFECTED/MALWARE AntiVir Found BDS/Agent.cpv AVG Antivirus Found Generic9.TFG ClamAV Found Trojan.Agent-9113 F-Secure Anti-Virus Found Backdoor.Win32.Agent.cpv Ikarus Found Backdoor.Win32.Agent.cpv Kaspersky Anti-Virus Found Backdoor.Win32.Agent.cpv NOD32 Found Win32/PSW.Agent.NGU Norman Virus Control Found W32/Malware.BFWQ Panda Antivirus Found Trj/Passtealer.FI Sophos Antivirus Found Troj/BDoor-AIF VBA32 Found Backdoor.Win32.Agent.cpv

[Gutek]

Wklej do Notatnika:

File:: C:\Documents and Settings\Arkadiusz\Dane aplikacji\info.dat C:\WINDOWS\system32\append.dll C:\Documents and Settings\Arkadiusz\Dane aplikacji\printer.exe C:\Documents and Settings\Arkadiusz\wn852.exe C:\WINDOWS\system32\libcurl.dll C:\WINDOWS\system32\spoolv.exe Registry:: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “dumprep”=- [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] “AppInit_DLLs”=- “AppInit_DLLs”="" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders] “SecurityProviders”=- “SecurityProviders”=“msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll”

>>Plik>>Zapisz jako… >>> CFScript (najwygodniej będzie, jeśli zapiszesz w takiej lokalizacji, by ikonka CFScript.txt znalazła się obok ikonki ComboFix.exe )

Przeciągnij i upuść plik CFScript.txt na plik ComboFix.exe (czyli ikonkę CFScript.txt na ikonkę ComboFix.exe )

– podobnie jak na tym obrazku –>

(jeśli pojawi się pytanie " 1 or 2" - to wpisz 1 i naciśnij ENTER) Ma się rozpocząć usuwanie. (i powstanie log)

Po restarcie usuń ręcznie folder C: ** Qoobox**.

Po tym nowy log z Combo

[morales (Amierzejewski)]

Niżej log z combo.

Ciągle dodtkowo mam jakieś alerty zabezpieczeń systemu czy chce nadal blokować progam “Skype. Take a deep breath”

ComboFix 07-11-19.4 - Arkadiusz 2007-11-29 11:33:32.14 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.2.1250.1.1045.18.205 [GMT 1:00] Running from: C:\Documents and Settings\Arkadiusz\Moje dokumenty\Dobre programy\ComboFix.exe . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\WINDOWS\system32\append.dll . ((((((((((((((((((((((((( Files Created from 2007-10-28 to 2007-11-29 ))))))))))))))))))))))))))))))) . 2007-11-28 19:39 21,900 --a------ C:\Documents and Settings\Arkadiusz\Dane aplikacji\info.dat 2007-11-27 20:12 18,432 --a------ C:\WINDOWS\system32\append.dll 2007-11-27 20:11 6,058,496 --------- C:\WINDOWS\system32\dllcache\ieframe.dll 2007-11-27 20:11 2,455,488 --------- C:\WINDOWS\system32\dllcache\ieapfltr.dat 2007-11-27 20:11 1,036,288 --------- C:\WINDOWS\system32\dllcache\ieframe.dll.mui 2007-11-27 20:11 459,264 --------- C:\WINDOWS\system32\dllcache\msfeeds.dll 2007-11-27 20:11 383,488 --------- C:\WINDOWS\system32\dllcache\ieapfltr.dll 2007-11-27 20:11 267,776 --------- C:\WINDOWS\system32\dllcache\iertutil.dll 2007-11-27 20:11 63,488 --------- C:\WINDOWS\system32\dllcache\icardie.dll 2007-11-27 20:11 52,224 --------- C:\WINDOWS\system32\dllcache\msfeedsbs.dll 2007-11-27 20:11 13,824 --------- C:\WINDOWS\system32\dllcache\ieudinit.exe 2007-11-27 20:10 2007-11-27 20:06 33,792 --a------ C:\WINDOWS\system32\dllcache\custsat.dll 2007-11-19 18:25 2,852 --a------ C:\WINDOWS\system32\AcroIEHelper.xml 2007-11-14 18:07 2007-11-12 19:40 289,280 --a------ C:\WINDOWS\system32\libcurl.dll 2007-11-12 19:40 55,808 --a------ C:\WINDOWS\system32\spoolv.exe 2007-11-10 15:27 2007-11-08 22:03 2007-11-08 22:03 2007-11-08 22:03 2007-11-08 22:03 2007-11-08 22:03 2007-11-08 22:03 2007-11-08 22:03 2007-11-08 22:03 2007-11-08 22:03 2007-11-06 21:42 2007-11-06 21:37 2007-11-05 15:03 528,896 --a------ C:\WINDOWS\system32\AcroIEHelper.dll . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2007-11-29 10:31 --------- d-----w C:\Documents and Settings\Arkadiusz\Dane aplikacji\Skype 2007-11-27 20:31 --------- d-----w C:\Program Files\Agent Hugo RoboRumble 2007-11-06 20:51 --------- d-----w C:\Documents and Settings\Arkadiusz\Dane aplikacji\AdobeUM 2007-11-06 20:16 --------- d-----w C:\Program Files\Windows Media Connect 2 2007-11-06 20:15 --------- d-----w C:\Program Files\RegCleaner 2007-11-06 20:15 --------- d-----w C:\Program Files\RecordNow! 2007-11-06 20:15 --------- d-----w C:\Program Files\QuickTime 2007-11-06 20:14 --------- d-----w C:\Program Files\Last.fm 2007-11-06 20:14 --------- d-----w C:\Program Files\Gwiezdny Mściciel 2007-11-06 20:14 --------- d-----w C:\Program Files\Google 2007-11-06 20:14 --------- d-----w C:\Program Files\Gadu-Gadu 2007-11-06 20:14 --------- d-----w C:\Program Files\Easy Internet signup 2007-11-06 20:14 --------- d-----w C:\Program Files\DivX 2007-10-13 19:48 --------- d-----w C:\Program Files\Real 2007-10-13 19:48 --------- d-----w C:\Program Files\Common Files\xing shared 2007-10-13 19:48 --------- d-----w C:\Program Files\Common Files\Real 2007-10-02 17:16 --------- d-----w C:\Program Files\Alwil Software 2007-09-30 16:53 --------- d-----w C:\Program Files\Trend Micro 2007-07-24 17:56 2,803,440 ----a-w C:\Program Files\Shockwave_Installer_Slim.exe 2007-07-07 20:42 676,878 ----a-w C:\Program Files\setup_AAC_aacPlus_plugin_1_0_33.exe 2007-07-07 17:33 4,028,461 ----a-w C:\Program Files\LastFM_Win_1.3.0.58.exe 2007-06-30 19:10 23,640,104 ----a-w C:\Program Files\SkypeSetup.exe 2007-06-24 20:26 4,109,584 ----a-w C:\Program Files\gg77.exe 2005-09-30 12:39 17,144 ----a-w C:\Documents and Settings\Arkadiusz\Dane aplikacji\GDIPFONTCACHEV1.DAT . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE~\Browser Helper Objects{F3CFA533-7680-4943-A863-B8216390E847}] 2007-11-05 15:03 528896 --a------ C:\WINDOWS\system32\AcroIEHelper.dll [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “CTFMON.EXE”=“C:\WINDOWS\system32\ctfmon.exe” [2004-08-04 08:44] “RecordNow!”="" [] “MSMSGS”=“C:\Program Files\Messenger\msmsgs.exe” [2004-10-13 17:24] “Gadu-Gadu”=“C:\Program Files\Gadu-Gadu\gg.exe” [2007-05-10 15:36] “Skype”=“C:\Program Files\Skype\Phone\Skype.exe” [2007-06-08 14:18] “swg”=“C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe” [2007-07-10 19:46] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “IgfxTray”=“C:\WINDOWS\System32\igfxtray.exe” [2003-10-30 09:46] “HotKeysCmds”=“C:\WINDOWS\System32\hkcmd.exe” [2003-10-30 09:33] “SunJavaUpdateSched”=“C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe” [2003-05-03 02:17] “UpdateManager”=“C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe” [2003-08-19 00:01] “dla”=“C:\WINDOWS\system32\dla\tfswctrl.exe” [2004-03-25 00:04] “SynTPLpr”=“C:\Program Files\Synaptics\SynTP\SynTPLpr.exe” [2004-05-26 18:15] “SynTPEnh”=“C:\Program Files\Synaptics\SynTP\SynTPEnh.exe” [2004-05-26 18:15] “HPHUPD05”=“c:\Program Files\Hewlett-Packard{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe” [2003-05-22 19:03] “HP Software Update”=“c:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe” [2002-12-17 10:40] “HPHmon05”=“C:\WINDOWS\System32\hphmon05.exe” [2003-05-22 18:59] “Cpqset”=“C:\Program Files\HPQ\Default Settings\cpqset.exe” [2004-04-30 09:32] “eabconfg.cpl”=“C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe” [2004-04-30 12:50] “Adobe Photo Downloader”=“C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe” [2005-06-06 22:46] “avast!”=“C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe” [2007-09-06 11:06] “TkBellExe”=“C:\Program Files\Common Files\Real\Update_OB\realsched.exe” [2007-10-13 20:47] “UserFaultCheck”=“C:\WINDOWS\system32\dumprep 0 -u” [] [HKEY_USERS.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] “CTFMON.EXE”=“C:\WINDOWS\System32\CTFMON.EXE” [2004-08-04 08:44] C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\ Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 21:05:26] Last.fm Helper.lnk - C:\Program Files\Last.fm\LastFMHelper.exe [2007-07-07 18:33:34] Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 10:01:04] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] “AppInit_DLLs”=C:\WINDOWS\system32\append.dll [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders] SecurityProviders msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll, append.dll S3 USBSTOR;Sterownik magazynu masowego USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS . Contents of the ‘Scheduled Tasks’ folder “2005-04-10 17:43:17 C:\WINDOWS\Tasks\Symantec NetDetect.job” - C:\Program Files\Symantec\LiveUpdate\NDETECT.EXE . ************************************************************************** catchme 0.3.1262 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-11-29 11:50:01 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes … scanning hidden autostart entries … HKLM\Software\Microsoft\Windows\CurrentVersion\Run Cpqset = C:\Program Files\HPQ\Default Settings\cpqset.exe???x???|??? ???B???B? ??? scanning hidden files … scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2007-11-29 11:52:17 - machine was rebooted C:\ComboFix2.txt … 2007-11-29 07:52 C:\ComboFix3.txt … 2007-11-28 19:51 . — E O F —

[Gutek]

Pobierz The Avenger. Wypakuj => uruchom => zaznacz opcję Input script manually => kliknij w taką lupkę => w okienku, które się otworzy wklej:

Files to delete: C:\Documents and Settings\Arkadiusz\Dane aplikacji\info.dat C:\WINDOWS\system32\append.dll C:\Documents and Settings\Arkadiusz\Dane aplikacji\printer.exe C:\Documents and Settings\Arkadiusz\wn852.exe C:\WINDOWS\system32\libcurl.dll C:\WINDOWS\system32\spoolv.exe Registry keys to delete: HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\botreg Registry values to delete: “HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run” | “dumprep”

kliknij klawisz Done => teraz kliknij na zielone światełko => powinna pojawić się pewna informacja i kliknij OK (teraz restart).

Otwórz Notatnik i wklej w nim to:

Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] “AppInit_DLLs”=- “AppInit_DLLs”="" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders] “SecurityProviders”=- “SecurityProviders”=“msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll”

Plik >>> Zapisz jako >>> Zmień rozszerzenie z TXT na Wszystkie pliki >>> Zapisz pod nazwą FIX.REG >>> kliknij dwa razy na utworzony plik FIX.REG i potwierdź dodanie do rejestru >>> restart.

[morales (Amierzejewski)]

zrobilem wszystko jak w poleceniach

problem wydaje sie ustąpił

z google ok

avast nie informuje o wirusach

nie ma inf o alertach

czy podac loga tak dla sprawdzenia czy wszystko ok?

[Gutek]

Tak podaj do kontroli log-a

[morales (Amierzejewski)]

log z combo

ComboFix 07-11-19.4 - Arkadiusz 2007-12-03 9:12:31.15 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.2.1250.1.1045.18.208 [GMT 1:00] Running from: C:\Documents and Settings\Arkadiusz\Moje dokumenty\Dobre programy\ComboFix.exe . ((((((((((((((((((((((((( Files Created from 2007-11-03 to 2007-12-03 ))))))))))))))))))))))))))))))) . 2007-12-02 20:51 60,416 --a------ C:\WINDOWS\system32\drivers\rv^jabjm.sys 2007-11-27 20:11 6,058,496 --------- C:\WINDOWS\system32\dllcache\ieframe.dll 2007-11-27 20:11 2,455,488 --------- C:\WINDOWS\system32\dllcache\ieapfltr.dat 2007-11-27 20:11 1,036,288 --------- C:\WINDOWS\system32\dllcache\ieframe.dll.mui 2007-11-27 20:11 459,264 --------- C:\WINDOWS\system32\dllcache\msfeeds.dll 2007-11-27 20:11 383,488 --------- C:\WINDOWS\system32\dllcache\ieapfltr.dll 2007-11-27 20:11 267,776 --------- C:\WINDOWS\system32\dllcache\iertutil.dll 2007-11-27 20:11 63,488 --------- C:\WINDOWS\system32\dllcache\icardie.dll 2007-11-27 20:11 52,224 --------- C:\WINDOWS\system32\dllcache\msfeedsbs.dll 2007-11-27 20:11 13,824 --------- C:\WINDOWS\system32\dllcache\ieudinit.exe 2007-11-27 20:10 2007-11-27 20:06 33,792 --a------ C:\WINDOWS\system32\dllcache\custsat.dll 2007-11-19 18:25 2,852 --a------ C:\WINDOWS\system32\AcroIEHelper.xml 2007-11-14 18:07 2007-11-10 15:27 2007-11-08 22:03 2007-11-08 22:03 2007-11-08 22:03 2007-11-08 22:03 2007-11-08 22:03 2007-11-08 22:03 2007-11-08 22:03 2007-11-08 22:03 2007-11-08 22:03 2007-11-06 21:42 2007-11-06 21:37 2007-11-05 15:03 528,896 --a------ C:\WINDOWS\system32\AcroIEHelper.dll . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2007-12-03 08:11 --------- d-----w C:\Documents and Settings\Arkadiusz\Dane aplikacji\Skype 2007-11-27 20:47 3,912 ----a-w C:\WINDOWS\system32\tmp.reg 2007-11-27 20:31 --------- d-----w C:\Program Files\Agent Hugo RoboRumble 2007-11-06 20:51 --------- d-----w C:\Documents and Settings\Arkadiusz\Dane aplikacji\AdobeUM 2007-11-06 20:16 --------- d-----w C:\Program Files\Windows Media Connect 2 2007-11-06 20:15 --------- d-----w C:\Program Files\RegCleaner 2007-11-06 20:15 --------- d-----w C:\Program Files\RecordNow! 2007-11-06 20:15 --------- d-----w C:\Program Files\QuickTime 2007-11-06 20:14 --------- d-----w C:\Program Files\Last.fm 2007-11-06 20:14 --------- d-----w C:\Program Files\Gwiezdny Mściciel 2007-11-06 20:14 --------- d-----w C:\Program Files\Google 2007-11-06 20:14 --------- d-----w C:\Program Files\Gadu-Gadu 2007-11-06 20:14 --------- d-----w C:\Program Files\Easy Internet signup 2007-11-06 20:14 --------- d-----w C:\Program Files\DivX 2007-11-06 20:02 128,362 ----a-w C:\WINDOWS\Help\Tours\mmTour_install.exe 2007-10-25 16:44 8,488,960 ----a-w C:\WINDOWS\system32\dllcache\shell32.dll 2007-10-13 19:48 --------- d-----w C:\Program Files\Real 2007-10-13 19:48 --------- d-----w C:\Program Files\Common Files\xing shared 2007-10-13 19:48 --------- d-----w C:\Program Files\Common Files\Real 2007-09-06 10:09 801,144 ----a-w C:\WINDOWS\system32\aswBoot.exe 2007-09-06 10:00 95,608 ----a-w C:\WINDOWS\system32\AvastSS.scr 2007-07-24 17:56 2,803,440 ----a-w C:\Program Files\Shockwave_Installer_Slim.exe 2007-07-07 20:42 676,878 ----a-w C:\Program Files\setup_AAC_aacPlus_plugin_1_0_33.exe 2007-07-07 17:33 4,028,461 ----a-w C:\Program Files\LastFM_Win_1.3.0.58.exe 2007-06-30 19:10 23,640,104 ----a-w C:\Program Files\SkypeSetup.exe 2007-06-24 20:26 4,109,584 ----a-w C:\Program Files\gg77.exe 2005-09-30 12:39 17,144 ----a-w C:\Documents and Settings\Arkadiusz\Dane aplikacji\GDIPFONTCACHEV1.DAT . ((((((((((((((((((((((((((((( snapshot@2007-11-29_11.51.26.31 ))))))))))))))))))))))))))))))))))))))))) . - 2005-03-04 14:58:22 167,936 ----a-r C:\WINDOWS\Installer{90280415-6000-11D3-8CFE-0050048383C9}\accicons.exe + 2007-11-29 16:04:29 167,936 ----a-r C:\WINDOWS\Installer{90280415-6000-11D3-8CFE-0050048383C9}\accicons.exe - 2005-03-04 14:58:22 81,920 ----a-r C:\WINDOWS\Installer{90280415-6000-11D3-8CFE-0050048383C9}\fpicon.exe + 2007-11-29 16:04:29 81,920 ----a-r C:\WINDOWS\Installer{90280415-6000-11D3-8CFE-0050048383C9}\fpicon.exe - 2005-03-04 14:58:22 34,304 ----a-r C:\WINDOWS\Installer{90280415-6000-11D3-8CFE-0050048383C9}\misc.exe + 2007-11-29 16:04:29 34,304 ----a-r C:\WINDOWS\Installer{90280415-6000-11D3-8CFE-0050048383C9}\misc.exe - 2005-03-04 14:58:22 8,192 ----a-r C:\WINDOWS\Installer{90280415-6000-11D3-8CFE-0050048383C9}\mspicons.exe + 2007-11-29 16:04:29 8,192 ----a-r C:\WINDOWS\Installer{90280415-6000-11D3-8CFE-0050048383C9}\mspicons.exe - 2005-03-04 14:58:22 3,584 ----a-r C:\WINDOWS\Installer{90280415-6000-11D3-8CFE-0050048383C9}\opwicon.exe + 2007-11-29 16:04:30 3,584 ----a-r C:\WINDOWS\Installer{90280415-6000-11D3-8CFE-0050048383C9}\opwicon.exe - 2005-03-04 14:58:22 114,688 ----a-r C:\WINDOWS\Installer{90280415-6000-11D3-8CFE-0050048383C9}\outicon.exe + 2007-11-29 16:04:30 114,688 ----a-r C:\WINDOWS\Installer{90280415-6000-11D3-8CFE-0050048383C9}\outicon.exe - 2005-03-04 14:58:22 16,384 ----a-r C:\WINDOWS\Installer{90280415-6000-11D3-8CFE-0050048383C9}\PEicons.exe + 2007-11-29 16:04:29 16,384 ----a-r C:\WINDOWS\Installer{90280415-6000-11D3-8CFE-0050048383C9}\PEicons.exe - 2005-03-04 14:58:22 30,720 ----a-r C:\WINDOWS\Installer{90280415-6000-11D3-8CFE-0050048383C9}\pptico.exe + 2007-11-29 16:04:29 30,720 ----a-r C:\WINDOWS\Installer{90280415-6000-11D3-8CFE-0050048383C9}\pptico.exe - 2005-03-04 14:58:22 22,528 ----a-r C:\WINDOWS\Installer{90280415-6000-11D3-8CFE-0050048383C9}\unbndico.exe + 2007-11-29 16:04:30 22,528 ----a-r C:\WINDOWS\Installer{90280415-6000-11D3-8CFE-0050048383C9}\unbndico.exe - 2005-03-04 14:58:22 45,056 ----a-r C:\WINDOWS\Installer{90280415-6000-11D3-8CFE-0050048383C9}\wordicon.exe + 2007-11-29 16:04:29 45,056 ----a-r C:\WINDOWS\Installer{90280415-6000-11D3-8CFE-0050048383C9}\wordicon.exe - 2005-03-04 14:58:22 90,112 ----a-r C:\WINDOWS\Installer{90280415-6000-11D3-8CFE-0050048383C9}\xlicons.exe + 2007-11-29 16:04:29 90,112 ----a-r C:\WINDOWS\Installer{90280415-6000-11D3-8CFE-0050048383C9}\xlicons.exe + 2007-12-03 08:07:18 16,384 ----atw C:\WINDOWS\temp\Perflib_Perfdata_474.dat . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE~\Browser Helper Objects{F3CFA533-7680-4943-A863-B8216390E847}] 2007-11-05 15:03 528896 --a------ C:\WINDOWS\system32\AcroIEHelper.dll [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “CTFMON.EXE”=“C:\WINDOWS\system32\ctfmon.exe” [2004-08-04 08:44] “RecordNow!”="" [] “MSMSGS”=“C:\Program Files\Messenger\msmsgs.exe” [2004-10-13 17:24] “Gadu-Gadu”=“C:\Program Files\Gadu-Gadu\gg.exe” [2007-05-10 15:36] “Skype”=“C:\Program Files\Skype\Phone\Skype.exe” [2007-06-08 14:18] “swg”=“C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe” [2007-07-10 19:46] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “IgfxTray”=“C:\WINDOWS\System32\igfxtray.exe” [2003-10-30 09:46] “HotKeysCmds”=“C:\WINDOWS\System32\hkcmd.exe” [2003-10-30 09:33] “SunJavaUpdateSched”=“C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe” [2003-05-03 02:17] “UpdateManager”=“C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe” [2003-08-19 00:01] “dla”=“C:\WINDOWS\system32\dla\tfswctrl.exe” [2004-03-25 00:04] “SynTPLpr”=“C:\Program Files\Synaptics\SynTP\SynTPLpr.exe” [2004-05-26 18:15] “SynTPEnh”=“C:\Program Files\Synaptics\SynTP\SynTPEnh.exe” [2004-05-26 18:15] “HPHUPD05”=“c:\Program Files\Hewlett-Packard{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe” [2003-05-22 19:03] “HP Software Update”=“c:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe” [2002-12-17 10:40] “HPHmon05”=“C:\WINDOWS\System32\hphmon05.exe” [2003-05-22 18:59] “Cpqset”=“C:\Program Files\HPQ\Default Settings\cpqset.exe” [2004-04-30 09:32] “eabconfg.cpl”=“C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe” [2004-04-30 12:50] “Adobe Photo Downloader”=“C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe” [2005-06-06 22:46] “avast!”=“C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe” [2007-09-06 11:06] “TkBellExe”=“C:\Program Files\Common Files\Real\Update_OB\realsched.exe” [2007-10-13 20:47] “UserFaultCheck”=“C:\WINDOWS\system32\dumprep 0 -u” [] [HKEY_USERS.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] “CTFMON.EXE”=“C:\WINDOWS\System32\CTFMON.EXE” [2004-08-04 08:44] C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\ Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 21:05:26] Last.fm Helper.lnk - C:\Program Files\Last.fm\LastFMHelper.exe [2007-07-07 18:33:34] Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 10:01:04] S3 USBSTOR;Sterownik magazynu masowego USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS . Contents of the ‘Scheduled Tasks’ folder “2005-04-10 17:43:17 C:\WINDOWS\Tasks\Symantec NetDetect.job” - C:\Program Files\Symantec\LiveUpdate\NDETECT.EXE . ************************************************************************** catchme 0.3.1262 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-12-03 09:14:21 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes … scanning hidden autostart entries … HKLM\Software\Microsoft\Windows\CurrentVersion\Run Cpqset = C:\Program Files\HPQ\Default Settings\cpqset.exe???`???|??? ???B???B? ??? scanning hidden files … scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2007-12-03 9:15:22 C:\ComboFix2.txt … 2007-11-29 11:52 C:\ComboFix3.txt … 2007-11-29 07:52 . — E O F —

[Gutek]

Ja już nic nie widzę