Złapałem trojany Horse, Dropper, Downloader

AndrzejS_236237882 · 14 Lipiec 2007 20:47

Witam uczestników Forum.

To mój pierwszy post. Niestety od razu z problemami.

Proszę o pomoc.

Od trzech dni pracujący w tle Symantec AntiVirus sygnalizuje wykrywanie aż trzech trojanów Horse, Downloader i Dropper. Próbowałem skanowania. Doinstalowałem „Spyware Doctor” i wczoraj jeszcze NOD 32 ale one chyba się wykluczają, bo kiedy uruchomiłem skanowanie Nodem, działający w tle Symantec zaczął sypać komunikatami. Dosłownie setki komunikatów. Noda odinstalowałem. Najczęściej mam komunikaty o „Dropperze”.

Nie jestem biegłym komputerowcem, więc proszę o wyrozumiałość.

Dopisek z 16 07 2007:

W niedzielę uruchamiałem Combofix i skanownie on-line (Ewido) i chyba AVG Anti-Spyware 7,5. Trochę się zmieniło dlatego usuwam piątkowe logi i wklejam dzisiejsze. Dziś rano (w nocy skanowałem on-line ) miałem na ekranie dwa komunikaty od Symanteca o trojanie Backdoor :shock: . Jak narazie jeszcze dziś innych komunikatów nie było.

Podaję logi

Logfile of HijackThis v1.99.1 Scan saved at 09:52:32, on 2007-07-16 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\DefWatch.exe C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\Rtvscan.exe C:\Program Files\Spyware Doctor\svcntaux.exe C:\Program Files\Analog Devices\SoundMAX\Smtray.exe C:\Program Files\QuickTime\qttask.exe C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\vptray.exe C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe C:\Program Files\Spyware Doctor\SDTrayApp.exe C:\Program Files\Skype\Phone\Skype.exe C:\Program Files\Spyware Doctor\swdsvc.exe C:\Program Files\Adobe\Acrobat 7.0\Acrobat\acrobat_sl.exe C:\Program Files\SAGEM WiFi manager\WLANUTL.exe C:\Program Files\Intel\Intel® Active Monitor\imonnt.exe C:\Program Files\Skype\Plugin Manager\SkypePM.exe C:\WINDOWS\system32\wuauclt.exe C:\Documents and Settings\Administrator\Pulpit\ROMAN\Walka z wirusem\HijackThis.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza R3 - URLSearchHook: Multi_Media toolbar - {b5146c40-189a-4311-bda9-fbae3e023187} - C:\Program Files\Multi_Media\tbMult.dll O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {259F616C-A300-44F5-B04A-ED001A26C85C} - (no file) O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll O2 - BHO: Multi_Media toolbar - {b5146c40-189a-4311-bda9-fbae3e023187} - C:\Program Files\Multi_Media\tbMult.dll O2 - BHO: (no name) - {D1159422-16E3-462F-A93D-FB718E100408} - C:\WINDOWS\system32\d3dxim.dll O2 - BHO: Kwyshell MidpX - {EBE9E2B5-B526-48BC-AD46-687263EDCB0E} - C:\Program Files\Kwyshell\MidpX\JadInvoker\MidpInvoker.dll O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll O3 - Toolbar: Kwyshell MidpX - {EBE9E2B5-B526-48BC-AD46-687263EDCB0E} - C:\Program Files\Kwyshell\MidpX\JadInvoker\MidpInvoker.dll O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll O3 - Toolbar: Multi_Media toolbar - {b5146c40-189a-4311-bda9-fbae3e023187} - C:\Program Files\Multi_Media\tbMult.dll O4 - HKLM…\Run: [smapp] C:\Program Files\Analog Devices\SoundMAX\Smtray.exe O4 - HKLM…\Run: [QuickTime Task] “C:\Program Files\QuickTime\qttask.exe” -atboottime O4 - HKLM…\Run: [vptray] C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\vptray.exe O4 - HKLM…\Run: [Acrobat Assistant 7.0] “C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe” O4 - HKLM…\Run: [sDTray] “C:\Program Files\Spyware Doctor\SDTrayApp.exe” O4 - HKCU…\Run: [skype] “C:\Program Files\Skype\Phone\Skype.exe” /nosplash /minimized O4 - HKCU…\Run: [Lyj] “C:\Program Files\Common Files\s?curity\l?ass.exe” O4 - Global Startup: Adobe Acrobat Speed Launcher.lnk = ? O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE O4 - Global Startup: Program sieciowy dla SAGEM Wi-Fi 11g USB adapter.lnk = ? O8 - Extra context menu item: Konwertuj do Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html O8 - Extra context menu item: Konwertuj do istniejącego pliku PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html O8 - Extra context menu item: Konwertuj miejsce docelowe łącza do Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html O8 - Extra context menu item: Konwertuj miejsce docelowe łącza do istniejącego pliku PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html O8 - Extra context menu item: Konwertuj wybrane łącza do Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html O8 - Extra context menu item: Konwertuj wybrane łącza do istniejącego pliku PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html O8 - Extra context menu item: Konwertuj zaznaczenie do Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html O8 - Extra context menu item: Konwertuj zaznaczenie do istniejącego pliku PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html O8 - Extra context menu item: Link to &MidpX - C:\Program Files\Kwyshell\MidpX\JadInvoker\Extent\jad_wrap.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll O9 - Extra ‘Tools’ menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra ‘Tools’ menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra button: (no name) - SolidConverterPDF - (no file) (HKCU) O9 - Extra button: (no name) - {6685509E-B47B-4f47-8E16-9A5F3A62F683} - file://C:\Program Files\Ebates_MoeMoneyMaker\Sy350\Tp350\scri350a.htm (file missing) (HKCU) O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://downloads.ewido.net/ewidoOnlineScan.cab O16 - DPF: {31B7EB4E-8B4B-11D1-A789-00A0CC6651A8} (Cult3D ActiveX Player) - http://81.216.10.59/cult.cab O16 - DPF: {37A49D66-2735-4BB9-8503-82BA5E2333D0} (MailCfg Control) - http://www.poczta.wp.pl/autoryzacja/mailcfg.ocx O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://apple.speedera.net/qtinstall.inf … taller.exe O16 - DPF: {53E6E8F0-D6EE-11D5-A857-525405F66B21} (AvatarX Class) - http://ssm.seestorm.com/COM/AvatarX/AvatarX.dll O16 - DPF: {E7544C6C-CFD6-43EA-B4E9-360CEE20BDF7} (MainControl Class) - http://skaner.mks.com.pl/SkanerOnline.cab O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O20 - Winlogon Notify: aaeacacbc - C:\WINDOWS\system32\aaeacacbc.dll O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll O20 - Winlogon Notify: NavLogon - C:\WINDOWS\system32\NavLogon.dll O20 - Winlogon Notify: wudb - C:\WINDOWS\system32\wudb.dll (file missing) O23 - Service: DefWatch - Symantec Corporation - C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\DefWatch.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: Intel® Active Monitor (imonNT) - Intel Corp. - C:\Program Files\Intel\Intel® Active Monitor\imonnt.exe O23 - Service: Klient Symantec AntiVirus (Norton AntiVirus Server) - Symantec Corporation - C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\Rtvscan.exe O23 - Service: Pml Driver HPZ12 - Unknown owner - C:\WINDOWS\system32\HPZipm12.exe (file missing) O23 - Service: Spyware Doctor Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\svcntaux.exe O23 - Service: Spyware Doctor Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\swdsvc.exe

“Silent Runners.vbs”, revision R50, http://www.silentrunners.org/ Operating System: Windows XP SP2 Output limited to non-default values, except where indicated by “{++}” Startup items buried in registry: --------------------------------- HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ {++} “Skype” = ““C:\Program Files\Skype\Phone\Skype.exe” /nosplash /minimized” [“Skype Technologies S.A.”] “Lyj” = ““C:\Program Files\Common Files\s*curity\l*ass.exe”” (unwritable string) [file not found] HKLM\Software\Microsoft\Windows\CurrentVersion\Run\ {++} “Smapp” = “C:\Program Files\Analog Devices\SoundMAX\Smtray.exe” [“Analog Devices, Inc.”] “QuickTime Task” = ““C:\Program Files\QuickTime\qttask.exe” -atboottime” [“Apple Computer, Inc.”] “vptray” = “C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\vptray.exe” [“Symantec Corporation”] “Acrobat Assistant 7.0” = ““C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe”” [“Adobe Systems Inc.”] “SDTray” = ““C:\Program Files\Spyware Doctor\SDTrayApp.exe”” [“PC Tools”] HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ {02478D38-C3F9-4EFB-9B51-7695ECA05670}(Default) = (no title provided) -> {HKLM…CLSID} = “Yahoo! Toolbar Helper” \InProcServer32(Default) = “C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll” [“Yahoo! Inc.”] {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}(Default) = (no title provided) -> {HKLM…CLSID} = “AcroIEHlprObj Class” \InProcServer32(Default) = “C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll” [“Adobe Systems Incorporated”] {AE7CD045-E861-484f-8273-0445EE161910}(Default) = (no title provided) -> {HKLM…CLSID} = “AcroIEToolbarHelper Class” \InProcServer32(Default) = “C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll” [“Adobe Systems Incorporated”] {b5146c40-189a-4311-bda9-fbae3e023187}(Default) = (no title provided) -> {HKLM…CLSID} = “Multi_Media toolbar” \InProcServer32(Default) = “C:\Program Files\Multi_Media\tbMult.dll” [“Conduit Ltd.”] {D1159422-16E3-462F-A93D-FB718E100408}(Default) = (no title provided) -> {HKLM…CLSID} = (no title provided) \InProcServer32(Default) = “C:\WINDOWS\system32\d3dxim.dll” [null data] {EBE9E2B5-B526-48BC-AD46-687263EDCB0E}(Default) = (no title provided) -> {HKLM…CLSID} = “Kwyshell MidpX” \InProcServer32(Default) = “C:\Program Files\Kwyshell\MidpX\JadInvoker\MidpInvoker.dll” [“Kwyshell G.Corp”] HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\ “{88895560-9AA2-1069-930E-00AA0030EBC8}” = “Rozszerzenie ikony HyperTerminalu” -> {HKLM…CLSID} = “HyperTerminal Icon Ext” \InProcServer32(Default) = “C:\WINDOWS\System32\hticons.dll” [“Hilgraeve, Inc.”] “{0006F045-0000-0000-C000-000000000046}” = “Microsoft Outlook Custom Icon Handler” -> {HKLM…CLSID} = “Rozszerzenie ikon plików programu Outlook” \InProcServer32(Default) = “C:\PROGRA~1\MICROS~2\Office\OLKFSTUB.DLL” [MS] “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” = “WinRAR shell extension” -> {HKLM…CLSID} = “WinRAR” \InProcServer32(Default) = “C:\Program Files\WinRAR\rarext.dll” [null data] “{E0D79304-84BE-11CE-9641-444553540000}” = “WinZip” -> {HKLM…CLSID} = “WinZip” \InProcServer32(Default) = “C:\PROGRA~1\WinZip\WZSHLSTB.DLL” [“WinZip Computing, Inc.”] “{E0D79305-84BE-11CE-9641-444553540000}” = “WinZip” -> {HKLM…CLSID} = “WinZip” \InProcServer32(Default) = “C:\PROGRA~1\WinZip\WZSHLSTB.DLL” [“WinZip Computing, Inc.”] “{E0D79306-84BE-11CE-9641-444553540000}” = “WinZip” -> {HKLM…CLSID} = “WinZip” \InProcServer32(Default) = “C:\PROGRA~1\WinZip\WZSHLSTB.DLL” [“WinZip Computing, Inc.”] “{cc86590a-b60a-48e6-996b-41d25ed39a1e}” = “Portable Media Devices Menu” -> {HKLM…CLSID} = “Portable Media Devices Menu” \InProcServer32(Default) = “C:\WINDOWS\system32\Audiodev.dll” [MS] “{BDA77241-42F6-11d0-85E2-00AA001FE28C}” = “LDVP Shell Extensions” -> {HKLM…CLSID} = “VpshellEx Class” \InProcServer32(Default) = “C:\Program Files\Common Files\Symantec Shared\SSC\vpshell2.dll” [“Symantec Corporation”] “{A5110426-177D-4e08-AB3F-785F10B4439C}” = “Sony Ericsson File Manager” -> {HKLM…CLSID} = “Sony Ericsson File Manager” \InProcServer32(Default) = “C:\Program Files\Sony Ericsson\Mobile\File Manager\fmgrgui.dll” [“Sony Ericsson Mobile Communications AB”] “{D25B2CAB-8A9A-4517-A9B2-CB5F68A5A802}” = “Adobe.Acrobat.ContextMenu” -> {HKLM…CLSID} = “Acrobat Elements Context Menu” \InProcServer32(Default) = “C:\Program Files\Adobe\Acrobat 7.0\Acrobat Elements\ContextMenu.dll” [“Adobe Systems Inc.”] “{1530F7EE-5128-43BD-9977-84A4B0FAD7DF}” = “PhotoToys” -> {HKLM…CLSID} = (no title provided) \InProcServer32(Default) = “C:\WINDOWS\system32\phototoys.dll” [MS] HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler\ <> “{D1159422-16E3-462F-A93D-FB718E100408}” = “za” -> {HKLM…CLSID} = (no title provided) \InProcServer32(Default) = “C:\WINDOWS\system32\d3dxim.dll” [null data] HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ <> aaeacacbc\DLLName = “C:\WINDOWS\system32\aaeacacbc.dll” [null data] <> igfxcui\DLLName = “igfxsrvc.dll” [“Intel Corporation”] <> NavLogon\DLLName = “C:\WINDOWS\system32\NavLogon.dll” [null data] <> wudb\DLLName = “C:\WINDOWS\system32\wudb.dll” [file not found] HKLM\Software\Classes\Folder\shellex\ColumnHandlers\ {F9DB5320-233E-11D1-9F84-707F02C10627}(Default) = “PDF Column Info” -> {HKLM…CLSID} = “PDF Shell Extension” \InProcServer32(Default) = “C:\Program Files\Adobe\Acrobat 7.0\ActiveX\PDFShell.dll” [“Adobe Systems, Inc.”] HKLM\Software\Classes*\shellex\ContextMenuHandlers\ Adobe.Acrobat.ContextMenu(Default) = “{D25B2CAB-8A9A-4517-A9B2-CB5F68A5A802}” -> {HKLM…CLSID} = “Acrobat Elements Context Menu” \InProcServer32(Default) = “C:\Program Files\Adobe\Acrobat 7.0\Acrobat Elements\ContextMenu.dll” [“Adobe Systems Inc.”] LDVPMenu(Default) = “{BDA77241-42F6-11d0-85E2-00AA001FE28C}” -> {HKLM…CLSID} = “VpshellEx Class” \InProcServer32(Default) = “C:\Program Files\Common Files\Symantec Shared\SSC\vpshell2.dll” [“Symantec Corporation”] WinRAR(Default) = “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” -> {HKLM…CLSID} = “WinRAR” \InProcServer32(Default) = “C:\Program Files\WinRAR\rarext.dll” [null data] WinZip(Default) = “{E0D79304-84BE-11CE-9641-444553540000}” -> {HKLM…CLSID} = “WinZip” \InProcServer32(Default) = “C:\PROGRA~1\WinZip\WZSHLSTB.DLL” [“WinZip Computing, Inc.”] HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\ WinRAR(Default) = “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” -> {HKLM…CLSID} = “WinRAR” \InProcServer32(Default) = “C:\Program Files\WinRAR\rarext.dll” [null data] WinZip(Default) = “{E0D79304-84BE-11CE-9641-444553540000}” -> {HKLM…CLSID} = “WinZip” \InProcServer32(Default) = “C:\PROGRA~1\WinZip\WZSHLSTB.DLL” [“WinZip Computing, Inc.”] HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\ LDVPMenu(Default) = “{BDA77241-42F6-11d0-85E2-00AA001FE28C}” -> {HKLM…CLSID} = “VpshellEx Class” \InProcServer32(Default) = “C:\Program Files\Common Files\Symantec Shared\SSC\vpshell2.dll” [“Symantec Corporation”] WinRAR(Default) = “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” -> {HKLM…CLSID} = “WinRAR” \InProcServer32(Default) = “C:\Program Files\WinRAR\rarext.dll” [null data] WinZip(Default) = “{E0D79304-84BE-11CE-9641-444553540000}” -> {HKLM…CLSID} = “WinZip” \InProcServer32(Default) = “C:\PROGRA~1\WinZip\WZSHLSTB.DLL” [“WinZip Computing, Inc.”] Group Policies {GPedit.msc branch and setting}: ----------------------------------------------- Note: detected settings may not have any effect. HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\ “shutdownwithoutlogon” = (REG_DWORD) hex:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| Shutdown: Allow system to be shut down without having to log on} “undockwithoutlogon” = (REG_DWORD) hex:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| Devices: Allow undock without having to log on} Active Desktop and Wallpaper: ----------------------------- Active Desktop may be disabled at this entry: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState Displayed if Active Desktop enabled and wallpaper not set by Group Policy: HKCU\Software\Microsoft\Internet Explorer\Desktop\General\ “Wallpaper” = “C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp” Displayed if Active Desktop disabled and wallpaper not set by Group Policy: HKCU\Control Panel\Desktop\ “Wallpaper” = “C:\Documents and Settings\Administrator\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp” Startup items in “Administrator” & “All Users” startup folders: --------------------------------------------------------------- C:\Documents and Settings\All Users\Menu Start\Programy\Autostart “Adobe Acrobat Speed Launcher” -> shortcut to: “C:\WINDOWS\Installer{AC76BA86-1033-C740-7760-100000000002}\SC_Acrobat.exe” [null data] “Microsoft Office” -> shortcut to: “C:\Program Files\Microsoft Office\Office\OSA9.EXE -b -l” [MS] “Program sieciowy dla SAGEM Wi-Fi 11g USB adapter” -> shortcut to: “C:\Program Files\SAGEM WiFi manager\WLANUTL.exe” [" "] Winsock2 Service Provider DLLs: ------------------------------- Namespace Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++} 000000000001\LibraryPath = “%SystemRoot%\System32\mswsock.dll” [MS] 000000000002\LibraryPath = “%SystemRoot%\System32\winrnr.dll” [MS] 000000000003\LibraryPath = “%SystemRoot%\System32\mswsock.dll” [MS] Transport Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++} 0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range: %SystemRoot%\system32\mswsock.dll [MS], 01 - 03, 06 - 14 %SystemRoot%\system32\rsvpsp.dll [MS], 04 - 05 Toolbars, Explorer Bars, Extensions: ------------------------------------ Toolbars HKCU\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ “{EBE9E2B5-B526-48BC-AD46-687263EDCB0E}” -> {HKLM…CLSID} = “Kwyshell MidpX” \InProcServer32(Default) = “C:\Program Files\Kwyshell\MidpX\JadInvoker\MidpInvoker.dll” [“Kwyshell G.Corp”] HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\ “{47833539-D0C5-4125-9FA8-0819E2EAAC93}” -> {HKLM…CLSID} = “Adobe PDF” \InProcServer32(Default) = “C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll” [“Adobe Systems Incorporated”] “{EBE9E2B5-B526-48BC-AD46-687263EDCB0E}” -> {HKLM…CLSID} = “Kwyshell MidpX” \InProcServer32(Default) = “C:\Program Files\Kwyshell\MidpX\JadInvoker\MidpInvoker.dll” [“Kwyshell G.Corp”] “{EF99BD32-C1FB-11D2-892F-0090271D4F88}” -> {HKLM…CLSID} = “Yahoo! Toolbar” \InProcServer32(Default) = “C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll” [“Yahoo! Inc.”] “{B5146C40-189A-4311-BDA9-FBAE3E023187}” -> {HKLM…CLSID} = “Multi_Media toolbar” \InProcServer32(Default) = “C:\Program Files\Multi_Media\tbMult.dll” [“Conduit Ltd.”] HKLM\Software\Microsoft\Internet Explorer\Toolbar\ “{47833539-D0C5-4125-9FA8-0819E2EAAC93}” = (no title provided) -> {HKLM…CLSID} = “Adobe PDF” \InProcServer32(Default) = “C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll” [“Adobe Systems Incorporated”] “{EBE9E2B5-B526-48BC-AD46-687263EDCB0E}” = “Kwyshell MidpX” -> {HKLM…CLSID} = “Kwyshell MidpX” \InProcServer32(Default) = “C:\Program Files\Kwyshell\MidpX\JadInvoker\MidpInvoker.dll” [“Kwyshell G.Corp”] “{EF99BD32-C1FB-11D2-892F-0090271D4F88}” = (no title provided) -> {HKLM…CLSID} = “Yahoo! Toolbar” \InProcServer32(Default) = “C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll” [“Yahoo! Inc.”] “{B5146C40-189A-4311-BDA9-FBAE3E023187}” = “Multi Media Toolbar” -> {HKLM…CLSID} = “Multi_Media toolbar” \InProcServer32(Default) = “C:\Program Files\Multi_Media\tbMult.dll” [“Conduit Ltd.”] Explorer Bars HKLM\Software\Microsoft\Internet Explorer\Explorer Bars\ {182EC0BE-5110-49C8-A062-BEB1D02A220B}(Default) = (no title provided) -> {HKLM…CLSID} = “Adobe PDF” \InProcServer32(Default) = “C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll” [“Adobe Systems Incorporated”] Extensions (Tools menu items, main toolbar menu buttons) HKCU\Software\Microsoft\Internet Explorer\Extensions\ {6685509E-B47B-4F47-8E16-9A5F3A62F683}\ “Script” = “file://C:\Program Files\Ebates_MoeMoneyMaker\Sy350\Tp350\scri350a.htm” [file not found] HKLM\Software\Microsoft\Internet Explorer\Extensions\ {08B0E5C0-4FCB-11CF-AAA5-00401C608501}\ “MenuText” = “Sun Java Console” “CLSIDExtension” = “{08B0E5C0-4FCB-11CF-AAA5-00401C608501}” -> {HKLM…CLSID} = “Web Browser Applet Control” \InProcServer32(Default) = “C:\WINDOWS\System32\msjava.dll” [MS] {FB5F1910-F110-11D2-BB9E-00C04F795683}\ “ButtonText” = “Messenger” “MenuText” = “Windows Messenger” “Exec” = “C:\Program Files\Messenger\msmsgs.exe” [MS] Miscellaneous IE Hijack Points ------------------------------ HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks\ <> “{b5146c40-189a-4311-bda9-fbae3e023187}” = (no title provided) -> {HKLM…CLSID} = “Multi_Media toolbar” \InProcServer32(Default) = “C:\Program Files\Multi_Media\tbMult.dll” [“Conduit Ltd.”] Running Services (Display Name, Service Name, Path {Service DLL}): ------------------------------------------------------------------ DefWatch, DefWatch, ““C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\DefWatch.exe”” [“Symantec Corporation”] Intel® Active Monitor, imonNT, “C:\Program Files\Intel\Intel® Active Monitor\imonnt.exe” [“Intel Corp.”] Klient Symantec AntiVirus, Norton AntiVirus Server, ““C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\Rtvscan.exe”” [“Symantec Corporation”] Spyware Doctor Auxiliary Service, sdAuxService, “C:\Program Files\Spyware Doctor\svcntaux.exe” [“PC Tools”] Spyware Doctor Service, sdCoreService, “C:\Program Files\Spyware Doctor\swdsvc.exe” [“PC Tools”] Windows User Mode Driver Framework, UMWdf, “C:\WINDOWS\system32\wdfmgr.exe” [MS] Print Monitors: --------------- HKLM\System\CurrentControlSet\Control\Print\Monitors\ Adobe PDF Port\Driver = “C:\WINDOWS\system32\AdobePDF.dll” [“Adobe Systems Incorporated.”] Canon BJ Language Monitor PIXMA iP2000\Driver = “CNMLM66.DLL” [“CANON INC.”] Canon BJ Language Monitor S600\Driver = “CNMLM2v.DLL” [“CANON INC.”] CPCA Language Monitor2\Driver = “AUCPLMNT.DLL” [“CANON INC.”] hp laserjet 5 language monitor\Driver = “hpdcmon.dll” [“Hewlett-Packard”] Monitor 2 języka BJ\Driver = “CNBJMON2.DLL” [MS] Monitor języka BJ\Driver = “CNBJMON.DLL” [MS] Monitor języka PJL\Driver = “PJLMON.DLL” [MS] ---------- <>: Suspicious data at a malware launch point. <>: Suspicious data at a browser hijack point. + This report excludes default entries except where indicated. + To see *everywhere* the script checks and *everything* it finds, launch it from a command prompt or a shortcut with the -all parameter. + The search for DESKTOP.INI DLL launch points on all local fixed drives took 275 seconds. ---------- (total run time: 470 seconds)

I jeszcze Log po Combofix

“Administrator” - 2007-07-16 10:39:31 - ComboFix 07-07-13.8 - Dodatek Service Pack 2 NTFS ((((((((((((((((((((((((( Files Created from 2007-06-16 to 2007-07-16 ))))))))))))))))))))))))))))))) 2007-07-14 23:56 51,200 --a------ C:\WINDOWS\nircmd.exe 2007-07-13 01:48 2007-07-12 21:02 83,024 --a------ C:\WINDOWS\system32\drivers\iksyssec.sys 2007-07-12 21:02 57,424 --a------ C:\WINDOWS\system32\drivers\iksysflt.sys 2007-07-12 21:02 53,840 --a------ C:\WINDOWS\system32\drivers\ikfilesec.sys 2007-07-12 21:02 39,376 --a------ C:\WINDOWS\system32\drivers\ikfileflt.sys 2007-07-12 21:02 29,264 --a------ C:\WINDOWS\system32\drivers\kcom.sys 2007-07-12 21:01 2007-07-12 21:01 2007-07-12 14:35 2007-07-12 13:45 626,688 --a------ C:\WINDOWS\system32\msvcr80.dll 2007-07-10 23:10 2007-07-09 22:40 2007-07-09 22:38 94,688 --a------ C:\WINDOWS\system32\drivers\upatc.sys 2007-06-28 23:12 2007-06-27 21:01 93,184 --a------ C:\WINDOWS\system32\aaeacacbc.dll 2007-06-23 14:36 0 --a------ C:\WINDOWS\system32\d3dxim.dll (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) 2007-07-16 08:47:56 -------- d-----w C:\DOCUME~1\ADMINI~1\DANEAP~1\Skype 2007-07-15 21:01:26 -------- d-----w C:\Program Files\SolidDocuments 2007-07-15 20:56:15 -------- d-----w C:\DOCUME~1\ADMINI~1\DANEAP~1\SolidDocuments 2007-07-13 06:17:39 -------- d-----w C:\Program Files\Opera 2007-07-13 06:07:26 49,712 ----a-w C:\WINDOWS\system32\perfc015.dat 2007-07-13 06:07:26 355,830 ----a-w C:\WINDOWS\system32\perfh015.dat 2007-07-12 20:54:22 -------- d-----w C:\Program Files\Multimedialny swiat Biblii 2007-07-12 11:24:51 -------- d-----w C:\Program Files\eMule 2007-07-09 15:22:36 -------- d-----w C:\Program Files\Hewlett-Packard 2007-06-28 10:44:19 -------- d-----w C:\Program Files\Diablo II 2007-06-28 10:44:00 21,840 ----atw C:\WINDOWS\system32\SIntfNT.dll 2007-06-28 10:44:00 17,212 ----atw C:\WINDOWS\system32\SIntf32.dll 2007-06-28 10:44:00 12,067 ----atw C:\WINDOWS\system32\SIntf16.dll 2007-06-22 06:48:51 -------- d-----w C:\Program Files\ServiceSupportTool 2007-06-21 21:31:44 -------- d-----w C:\Program Files\Leksykonia 2007-06-21 21:19:31 -------- d-----w C:\Program Files\Winamp 2007-06-21 21:00:54 -------- d-----w C:\Program Files\Direct Connect 2007-06-21 20:03:22 -------- d-----w C:\Program Files\Tlen.pl 2007-06-06 20:47:47 -------- d-----w C:\Program Files\DC++ 2007-06-06 07:11:33 -------- d-----w C:\Program Files\SoftMaker Viewer 2007-05-23 23:22:29 -------- d-----w C:\Program Files\Common Files\Real 2007-05-16 15:18:58 683,520 ----a-w C:\WINDOWS\system32\inetcomm.dll 2007-04-25 14:23:30 144,896 ----a-w C:\WINDOWS\system32\schannel.dll 2007-04-18 16:14:32 2,854,400 ----a-w C:\WINDOWS\system32\msi.dll 2007-04-16 20:47:36 33,624 ----a-w C:\WINDOWS\system32\wups.dll 2007-04-16 20:45:54 1,710,936 ----a-w C:\WINDOWS\system32\wuaueng.dll 2007-04-16 20:45:48 549,720 ----a-w C:\WINDOWS\system32\wuapi.dll 2007-04-16 20:45:42 325,976 ----a-w C:\WINDOWS\system32\wucltui.dll 2007-04-16 20:45:36 203,096 ----a-w C:\WINDOWS\system32\wuweb.dll 2007-04-16 20:45:28 92,504 ----a-w C:\WINDOWS\system32\cdm.dll 2007-04-16 20:45:20 53,080 ----a-w C:\WINDOWS\system32\wuauclt.exe 2007-04-16 20:45:20 43,352 ----a-w C:\WINDOWS\system32\wups2.dll 2001-10-30 12:00:00 94,832 --sh–w C:\WINDOWS\twain.dll 2004-08-04 07:44:12 50,688 --sh–w C:\WINDOWS\twain_32.dll 2003-10-22 19:44:40 8 --sh–r C:\WINDOWS\system32\140A160817.sys 2003-11-03 23:36:56 1,890 --sha-w C:\WINDOWS\system32\KGyGaAvL.sys 2004-08-04 07:44:01 1,028,096 --sh–w C:\WINDOWS\system32\mfc42.dll 2004-08-04 07:44:05 54,784 --sh–w C:\WINDOWS\system32\msvcirt.dll 2004-08-04 07:44:05 413,696 --sh–w C:\WINDOWS\system32\msvcp60.dll 2004-08-04 07:44:05 343,040 --sh–w C:\WINDOWS\system32\msvcrt.dll 2004-08-04 07:44:07 553,472 --sh–w C:\WINDOWS\system32\oleaut32.dll 2004-08-04 07:44:07 83,456 --sh–w C:\WINDOWS\system32\olepro32.dll 2004-08-04 07:44:26 12,288 --sh–w C:\WINDOWS\system32\regsvr32.exe ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE~\Browser Helper Objects{02478D38-C3F9-4EFB-9B51-7695ECA05670}] 2006-06-07 11:09 399352 --a------ C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll [HKEY_LOCAL_MACHINE~\Browser Helper Objects{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}] 2004-12-14 10:56 63136 --a------ C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll [HKEY_LOCAL_MACHINE~\Browser Helper Objects{259F616C-A300-44F5-B04A-ED001A26C85C}] [HKEY_LOCAL_MACHINE~\Browser Helper Objects{AE7CD045-E861-484f-8273-0445EE161910}] 2004-12-14 11:13 225280 --a------ C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll [HKEY_LOCAL_MACHINE~\Browser Helper Objects{b5146c40-189a-4311-bda9-fbae3e023187}] 2007-06-18 17:50 1383448 --a------ C:\Program Files\Multi_Media\tbMult.dll [HKEY_LOCAL_MACHINE~\Browser Helper Objects{D1159422-16E3-462F-A93D-FB718E100408}] 2007-07-13 02:08 0 --a------ C:\WINDOWS\system32\d3dxim.dll [HKEY_LOCAL_MACHINE~\Browser Helper Objects{EBE9E2B5-B526-48BC-AD46-687263EDCB0E}] 2004-12-03 05:14 100864 --a------ C:\Program Files\Kwyshell\MidpX\JadInvoker\MidpInvoker.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “Smapp”=“C:\Program Files\Analog Devices\SoundMAX\Smtray.exe” [2002-01-30 18:01] “QuickTime Task”=“C:\Program Files\QuickTime\qttask.exe” [2005-05-05 00:14] “vptray”=“C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\vptray.exe” [2002-10-07 14:41] “Acrobat Assistant 7.0”=“C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe” [2004-12-14 11:12] “SDTray”=“C:\Program Files\Spyware Doctor\SDTrayApp.exe” [2007-07-12 23:33] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “Skype”=“C:\Program Files\Skype\Phone\Skype.exe” [2007-02-05 18:35] “Lyj”=“C:\Program Files\Common Files\s?curity\l?ass.exe” [] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler] “{D1159422-16E3-462F-A93D-FB718E100408}”=“C:\WINDOWS\system32\d3dxim.dll” [2007-07-13 02:08] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\aaeacacbc] C:\WINDOWS\system32\aaeacacbc.dll --a------ 2007-07-01 11:05 93184 C:\WINDOWS\system32\aaeacacbc.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\wudb] C:\WINDOWS\system32\wudb.dll [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\sdauxservice] [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\sdcoreservice] ************************************************************************** catchme 0.3.915 W2K/XP/Vista - rootkit detector by Gmer, http://www.gmer.net Rootkit scan 2007-07-16 10:47:45 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes … scanning hidden autostart entries … scanning hidden files … C:\WINDOWS\Q330994.exe:menhd 55808 bytes executable C:\WINDOWS\Q811630.log:ijula 55808 bytes executable C:\WINDOWS\KB837001.log:lynka 55808 bytes executable C:\WINDOWS\Lotr22.exe:ewgro 55808 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:aadkn 35701 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:aagzy 35701 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:aapge 35701 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:aarel 35701 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:aaylw 35701 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:aayujr 35701 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:abdyn 35701 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:abksd 125564 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:abmib 125564 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:abnfu 125564 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:abryk 125564 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:abshg 35701 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:abwqi 35701 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:abzit 35701 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:acbrp 125564 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:acgaq 35701 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:acjqh 125564 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:aczlz 35701 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:adbwn 125564 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:adcgm 125564 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:adffk 125564 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:adhvy 35701 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:adiuz 125564 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:adlam 125564 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:adlhr 35701 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:adqlt 35701 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:adsfx 35701 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:adzgk 35701 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:aebir 125564 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:aefqt 125564 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:aeidz 125564 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:aeiqbj 11825 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:aelpbt 35701 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:aeoww 125564 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:aewvn 35701 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:afbsd 35701 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:afilh 125564 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:afkgu 125564 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:afkwe 125564 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:afpyl 35701 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:aftmr 125564 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:afugn 125564 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:agdci 35701 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:agdsn 125564 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:agfcl 35701 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:agjrw 125564 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:agprk 35701 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:agpsf 125564 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:agzev 125564 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:agzqk 125564 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:ahajyd 35701 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:ahbzx 35701 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:ahcoo 35701 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:ahfgr 125564 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:ahhio 35701 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:ahlmy 35701 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:ahrpz 35701 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:ahxhd 125564 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:ahyahx 35701 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:aiafc 125564 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:aibvr 125564 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:aiczv 125564 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:aidtg 35701 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:aieis 35701 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:aigpw 35701 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:aiibi 125564 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:aiiry 125564 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:aimjc 125564 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:aipqo 35701 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:ajaes 35701 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:ajebd 35701 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:ajmar 35701 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:ajmma 35701 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:ajnrb 35701 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:ajqsz 125564 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:ajswh 35701 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:ajvmn 35701 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:akgso 35701 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:akofv 125564 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:aktpj 125564 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:akyvy 125564 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:alcpu 35701 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:aldhhy 35701 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:algch 125564 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:aljrv 35701 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:alkai 125564 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:alkgc 125564 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:alxxe 35701 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:alytu 125564 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:alzvn 35701 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:amchb 35701 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:amdji 125564 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:amrxa 35701 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:amuyw 125564 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:amvqh 35701 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:amysc 125564 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:anfuv 35701 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:aniqf 35701 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:ansfu 35701 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:antxn 35701 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:anxxs 125564 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:anytr 125564 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:aoanp 125564 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:aoche 35701 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:aoqst 125564 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:aorwo 35701 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:aoxrp 35701 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:aozwc 35701 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:apgvi 125564 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:appjj 35701 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:apskli 35701 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:aptti 35701 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:apvox 35701 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:aqdbr 35701 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:aqdod 35701 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:aqeka 125564 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:aqhym 35701 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:aqlqm 125564 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:aqrfz 35701 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:aqtse 35701 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:arezq 125564 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:arfjm 35701 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:arkbi 125564 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:armagl 35701 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:arpak 35701 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:arseb 35701 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:asdfh 125564 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:asiwr 125564 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:asnfu 35701 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:aspqo 125564 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:assdx 125564 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:aswip 125564 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:atcld 125564 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:atmhl 125564 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:atomv 125564 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:atqza 35701 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:atssz 125564 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:atulw 125564 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:atxrg 125564 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:atxrk 35701 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:atzodx 11825 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:aucxqb 66560 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:auhhl 125564 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:aulor 35701 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:aumnc 35701 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:aupcf 125564 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:ausho 35701 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:ausqp 35701 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:auvzd 35701 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:avbbk 125564 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:avbqx 125564 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:avbuf 35701 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:avftp 35701 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:avgcf 35701 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:avhtd 35701 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:avive 125564 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:avjpnt 35701 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:avlew 125564 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:avpbv 125564 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:avvky 125564 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:avvrle 35701 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:avztw 35701 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:awawh 125564 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:awckv 35701 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:awfup 125564 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:awngq 125564 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:awopo 35701 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:awpan 35701 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:awqjo 35701 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:awuax 125564 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:awvbc 35701 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:axrrx 125564 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:axvqg 125564 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:ayida 125564 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:ayira 35701 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:aytpi 125564 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:azbzz 35701 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:azpscu 35701 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:azqqa 125564 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:azqsp 35701 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:azssz 125564 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:azzuw 125564 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:babtn 125564 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:backj 35701 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:baitl 125564 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:bakas 35701 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:bataz 35701 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:bavlek 35701 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:bawqd 125564 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:bawtc 125564 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:bblwy 125564 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:bboof 125564 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:bboqp 125564 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:bbzao 125564 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:bcbgj 125564 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:bcnqtp 35701 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:bcrxy 125564 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:bcsct 125564 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:bcurp 125564 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:bdffm 125564 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:bdfya 125564 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:bdgpq 35701 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:bdhhw 35701 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:bdlsvf 35701 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:bdtnm 35701 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:bdtrh 35701 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:bdugjc 11825 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:bduqt 35701 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:bdvmi 125564 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:bdwdg 35701 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:beghj 125564 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:begzf 125564 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:behiz 125564 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:beixm 125564 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:belro 125564 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:bepla 125564 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:bfpqk 125564 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:bfvne 35701 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:bfvyd 125564 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:bfvyr 35701 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:bgcyx 35701 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:bgfld 125564 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:bghjm 125564 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:bgjmw 125564 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:bgowi 125564 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:bgrab 35701 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:bgxpu 35701 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:bgzxt 35701 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:bhjnz 125564 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:bhtok 125564 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:bhvmb 125564 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:bhysn 35701 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:bierv 125564 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:bigkat 35701 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:bihop 35701 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:bikdt 35701 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:bikot 125564 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:bisuz 35701 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:bizhh 35701 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:bizvg 125564 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:bjcge 35701 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:bjhir 125564 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:bjjrf 35701 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:bjmyb 35701 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:bjpfk 125564 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:bjrep 35701 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:bjtvi 35701 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:bjuqq 125564 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:bjvir 125564 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:bjvlx 125564 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:bjwlv 35701 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:bkbsa 125564 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:bkemi 35701 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:bkgnc 35701 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:bkhlim 35701 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:bkmnp 125564 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:bkrqx 125564 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:bkuot 35701 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:bkvzo 125564 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:blfql 125564 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:blhjc 35701 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:bliji 35701 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:bllije 35701 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:blphs 35701 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:bltpd 35701 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:blwof 35701 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:blztf 125564 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:bmepp 125564 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:bmfkg 35701 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:bmfxp 125564 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:bmgpc 125564 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:bmilnt 11825 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:bnaid 125564 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:bnmoy 35701 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:bnnez 125564 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:bnpxn 35701 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:bntbv 125564 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:bntlo 125564 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:bobcx 125564 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:bokvm 35701 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:bpcdna 35701 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:bpfvg 125564 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:bpijk 35701 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:bpqcn 125564 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:bpqcu 125564 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:bpqew 125564 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:bqdam 125564 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:bqfzs 125564 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:bqiaz 125564 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:bqjku 35701 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:bqkyl 125564 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:bqqwh 35701 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:bqvhj 125564 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:bqwxhf 35701 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:brduz 35701 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:brgrm 125564 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:brhla 35701 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:brkqo 125564 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:brlsa 125564 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:bromz 125564 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:brpsf 35701 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:brqqs 125564 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:bsfyf 35701 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:bsydx 125564 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:btfot 35701 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:bticz 35701 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:btltz 35701 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:btlzd 35701 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:btqlbd 35701 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:btshy 125564 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:btuip 35701 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:btvdt 125564 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:btwzi 35701 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:btxrmj 35701 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:btxth 125564 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:buadk 35701 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:buajz 125564 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:buczwg 35701 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:bufbz 125564 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:bukbc 125564 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:buqsu 35701 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:busuw 35701 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:butoi 125564 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:bvhlj 125564 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:bvouc 125564 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:bvpev 35701 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:bvqcv 125564 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:bvqsj 125564 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:bvsjv 125564 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:bvywh 125564 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:bwank 35701 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:bwazt 35701 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:bwgxv 35701 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:bwgyc 35701 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:bwrwc 35701 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:bwumc 125564 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:bwuwj 35701 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:bwwmy 125564 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:bxezo 35701 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:bxjnrp 35701 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:bxkrt 35701 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:bxshr 125564 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:bxtew 125564 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:bxwwt 35701 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:bxzox 125564 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:byhoeo 35701 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:bypdx 35701 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:byzel 35701 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:bzhyl 125564 bytes executable C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:bznes 125564 bytes executable

Niestety cały nie wchodzi

Joan · 16 Lipiec 2007 10:17

R3 - URLSearchHook: Multi_Media toolbar - {b5146c40-189a-4311-bda9-fbae3e023187} - C:\Program Files\Multi_Media\tbMult.dll O2 - BHO: (no name) - {259F616C-A300-44F5-B04A-ED001A26C85C} - (no file) O2 - BHO: Multi_Media toolbar - {b5146c40-189a-4311-bda9-fbae3e023187} - C:\Program Files\Multi_Media\tbMult.dll O2 - BHO: (no name) - {D1159422-16E3-462F-A93D-FB718E100408} - C:\WINDOWS\system32\d3dxim.dll O3 - Toolbar: Multi_Media toolbar - {b5146c40-189a-4311-bda9-fbae3e023187} - C:\Program Files\Multi_Media\tbMult.dll O9 - Extra button: (no name) - SolidConverterPDF - (no file) (HKCU) O9 - Extra button: (no name) - {6685509E-B47B-4f47-8E16-9A5F3A62F683} - file://C:\Program Files\Ebates_MoeMoneyMaker\Sy350\Tp350\scri350a.htm (file missing) (HKCU) O20 - Winlogon Notify: aaeacacbc - C:\WINDOWS\system32\aaeacacbc.dll O20 - Winlogon Notify: wudb - C:\WINDOWS\system32\wudb.dll (file missing)

usun wszystko co na czerwono w trybie awaryjnym z dysku a wpisy w hijacku

zobacz Usuwanie PurityScan

Wklej logi z GMERA

Zakładka Rootkit > zaznacz wszystko oprócz Pokaż wszystko > kliknij Szukaj
Zakładka Rootkit > zaznacz tylko Usługi oraz Pokaż wszystko > kliknij Szukaj i w obydwu przypadkach poczekaj cierpliwie, aż skończy pracę

AndrzejS_236237882 · 16 Lipiec 2007 12:12

Przepraszam, że tak długo trwa, ale nie mogę usunąć tego trzeciego pliku.

Pojawia się komunikat Nie można usunąć. Plik jest używany przez inną osobę lub program. Resztę usunąłem.

Co dalej? Gmera jeszcze nie puszczałem.

Joan · 16 Lipiec 2007 12:38

rób jak napisałam po kolei i daj nowe logi

AndrzejS_236237882 · 16 Lipiec 2007 14:29

Udało mi się ten ostatni plik skasować ale za pomocą “KillBox”

Logi z gmera:

GMER 1.0.13.12551 - http://www.gmer.net Rootkit scan 2007-07-16 16:22:40 Windows 5.1.2600 Dodatek Service Pack 2 ---- Devices - GMER 1.0.13 ---- AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_CREATE [bAA49380] SYMEVENT.SYS AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_CREATE_NAMED_PIPE [bAA49380] SYMEVENT.SYS AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_CLOSE [bAA49380] SYMEVENT.SYS AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_READ [bAA49420] SYMEVENT.SYS AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_WRITE [bAA49380] SYMEVENT.SYS AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_QUERY_INFORMATION [bAA49380] SYMEVENT.SYS AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_SET_INFORMATION [bAA49380] SYMEVENT.SYS AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_QUERY_EA [bAA49380] SYMEVENT.SYS AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_SET_EA [bAA49380] SYMEVENT.SYS AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_FLUSH_BUFFERS [bAA49380] SYMEVENT.SYS AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_QUERY_VOLUME_INFORMATION [bAA49380] SYMEVENT.SYS AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_SET_VOLUME_INFORMATION [bAA49380] SYMEVENT.SYS AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_DIRECTORY_CONTROL [bAA49380] SYMEVENT.SYS AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_FILE_SYSTEM_CONTROL [bAA49380] SYMEVENT.SYS AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_DEVICE_CONTROL [bAA49380] SYMEVENT.SYS AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_INTERNAL_DEVICE_CONTROL [bAA49380] SYMEVENT.SYS AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_SHUTDOWN [bAA49380] SYMEVENT.SYS AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_LOCK_CONTROL [bAA49380] SYMEVENT.SYS AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_CLEANUP [bAA49380] SYMEVENT.SYS AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_CREATE_MAILSLOT [bAA49380] SYMEVENT.SYS AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_QUERY_SECURITY [bAA49380] SYMEVENT.SYS AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_SET_SECURITY [bAA49380] SYMEVENT.SYS AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_POWER [bAA49380] SYMEVENT.SYS AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_SYSTEM_CONTROL [bAA49380] SYMEVENT.SYS AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_DEVICE_CHANGE [bAA49380] SYMEVENT.SYS AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_QUERY_QUOTA [bAA49380] SYMEVENT.SYS AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_SET_QUOTA [bAA49380] SYMEVENT.SYS ---- Files - GMER 1.0.13 ---- ADS C:\WINDOWS\KB837001.log:lynka ADS C:\WINDOWS\Lotr22.exe:ewgro ADS C:\WINDOWS\Q330994.exe:menhd ADS C:\WINDOWS\Q811630.log:ijula ---- EOF - GMER 1.0.13 ----

GMER 1.0.13.12551 - http://www.gmer.net Rootkit scan 2007-07-16 16:26:43 Windows 5.1.2600 Dodatek Service Pack 2 ---- Services - GMER 1.0.13 ---- Service [DISABLED] Abiosdsk Service [DISABLED] abp480n5 Service C:\WINDOWS\System32\DRIVERS\ACPI.sys [bOOT] ACPI Service [DISABLED] ACPIEC Service [DISABLED] adpu160m Service C:\WINDOWS\system32\drivers\aec.sys [MANUAL] aec Service C:\WINDOWS\System32\drivers\afd.sys [sYSTEM] AFD Service [DISABLED] Aha154x Service [DISABLED] aic78u2 Service [DISABLED] aic78xx Service C:\WINDOWS\System32\svchost.exe [DISABLED] Alerter Service C:\WINDOWS\System32\alg.exe [MANUAL] ALG Service [DISABLED] AliIde Service [DISABLED] amsint Service C:\WINDOWS\system32\svchost.exe [MANUAL] AppMgmt Service [DISABLED] asc Service [DISABLED] asc3350p Service [DISABLED] asc3550 Service [AUTO] Aspi32 Service C:\WINDOWS\System32\DRIVERS\asyncmac.sys [MANUAL] AsyncMac Service C:\WINDOWS\System32\DRIVERS\atapi.sys [bOOT] atapi Service [DISABLED] Atdisk Service C:\WINDOWS\System32\DRIVERS\atmarpc.sys [MANUAL] Atmarpc Service C:\WINDOWS\System32\svchost.exe [AUTO] AudioSrv Service C:\WINDOWS\System32\DRIVERS\audstub.sys [MANUAL] audstub Service BattC Service [sYSTEM] Beep Service C:\WINDOWS\System32\svchost.exe [MANUAL] BITS Service C:\WINDOWS\System32\drivers\BPP.SYS [AUTO] BppPort Service C:\WINDOWS\System32\svchost.exe [AUTO] Browser Service C:\DOCUME~1\ADMINI~1\USTAWI~1\Temp\catchme.sys [MANUAL] catchme Service [DISABLED] cbidf2k Service [DISABLED] cd20xrnt Service [sYSTEM] Cdaudio Service [DISABLED] Cdfs Service C:\WINDOWS\System32\DRIVERS\cdrom.sys [sYSTEM] Cdrom Service [sYSTEM] Changer Service C:\WINDOWS\system32\cisvc.exe [MANUAL] cisvc Service C:\WINDOWS\system32\clipsrv.exe [DISABLED] ClipSrv Service [DISABLED] CmdIde Service C:\WINDOWS\System32\dllhost.exe [MANUAL] COMSysApp Service ContentFilter Service ContentIndex Service [DISABLED] Cpqarray Service C:\WINDOWS\system32\svchost.exe [AUTO] CryptSvc Service [DISABLED] dac2w2k Service [DISABLED] dac960nt Service C:\WINDOWS\system32\svchost.exe [AUTO] DcomLaunch Service C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\DefWatch.exe [AUTO] DefWatch Service C:\WINDOWS\System32\Drivers\DgivEcp.Sys [AUTO] DgivEcp Service C:\WINDOWS\System32\svchost.exe [AUTO] Dhcp Service C:\WINDOWS\System32\DRIVERS\disk.sys [bOOT] Disk Service C:\WINDOWS\System32\dmadmin.exe [MANUAL] dmadmin Service C:\WINDOWS\System32\drivers\dmboot.sys [DISABLED] dmboot Service C:\WINDOWS\System32\drivers\dmio.sys [bOOT] dmio Service C:\WINDOWS\System32\drivers\dmload.sys [bOOT] dmload Service C:\WINDOWS\System32\svchost.exe [AUTO] dmserver Service C:\WINDOWS\system32\drivers\DMusic.sys [MANUAL] DMusic Service C:\WINDOWS\System32\svchost.exe [AUTO] Dnscache Service C:\WINDOWS\system32\DRIVERS\Dot4.sys [MANUAL] dot4 Service C:\WINDOWS\system32\DRIVERS\Dot4Prt.sys [MANUAL] Dot4Print Service C:\WINDOWS\system32\DRIVERS\dot4usb.sys [MANUAL] dot4usb Service [DISABLED] dpti2o Service C:\WINDOWS\system32\drivers\drmkaud.sys [MANUAL] drmkaud Service System32\DRIVERS\ElbyVCD.sys [bOOT] ElbyVCD Service C:\WINDOWS\System32\svchost.exe [AUTO] ERSvc Service System32\DRIVERS\ESIirnet.sys [MANUAL] ESIIRDA Service C:\WINDOWS\system32\services.exe [AUTO] Eventlog Service C:\WINDOWS\System32\svchost.exe [MANUAL] EventSystem Service [DISABLED] Fastfat Service C:\WINDOWS\System32\svchost.exe [MANUAL] FastUserSwitchingCompatibility Service C:\WINDOWS\System32\DRIVERS\fdc.sys [MANUAL] Fdc Service [sYSTEM] Fips Service C:\WINDOWS\System32\DRIVERS\flpydisk.sys [MANUAL] Flpydisk Service C:\WINDOWS\system32\drivers\fltmgr.sys [bOOT] FltMgr Service [sYSTEM] Fs_Rec Service C:\WINDOWS\System32\DRIVERS\ftdisk.sys [bOOT] Ftdisk Service GEARAspiWDM Service C:\WINDOWS\System32\DRIVERS\gmer.sys [MANUAL] gmer Service C:\WINDOWS\System32\DRIVERS\msgpc.sys [MANUAL] Gpc Service C:\WINDOWS\System32\svchost.exe [AUTO] helpsvc Service C:\WINDOWS\System32\svchost.exe [DISABLED] HidServ Service C:\WINDOWS\System32\DRIVERS\hidusb.sys [MANUAL] HidUsb Service [DISABLED] hpn Service [DISABLED] hpt3xx Service C:\WINDOWS\System32\Drivers\HTTP.sys [MANUAL] HTTP Service C:\WINDOWS\System32\svchost.exe [MANUAL] HTTPFilter Service [sYSTEM] i2omgmt Service [DISABLED] i2omp Service C:\WINDOWS\System32\DRIVERS\i8042prt.sys [sYSTEM] i8042prt Service C:\WINDOWS\System32\DRIVERS\ialmnt5.sys [MANUAL] ialm Service C:\WINDOWS\System32\DRIVERS\IdeBusDr.sys [bOOT] IdeBusDr Service C:\WINDOWS\System32\DRIVERS\IdeChnDr.sys [bOOT] IdeChnDr Service C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [MANUAL] IDriverT Service C:\WINDOWS\system32\drivers\ikfileflt.sys [MANUAL] IKFileFlt Service C:\WINDOWS\system32\drivers\ikfilesec.sys [MANUAL] IKFileSec Service C:\WINDOWS\system32\drivers\iksysflt.sys [MANUAL] IkSysFlt Service C:\WINDOWS\system32\drivers\iksyssec.sys [MANUAL] IKSysSec Service C:\WINDOWS\System32\DRIVERS\imapi.sys [sYSTEM] Imapi Service C:\WINDOWS\System32\imapi.exe [MANUAL] ImapiService Service C:\Program Files\Intel\Intel® Active Monitor\imonnt.exe [AUTO] imonNT Service inetaccs Service [DISABLED] ini910u Service Inport Service [DISABLED] IntelIde Service C:\WINDOWS\system32\drivers\ip6fw.sys [MANUAL] ip6fw Service C:\WINDOWS\System32\DRIVERS\ipfltdrv.sys [MANUAL] IpFilterDriver Service C:\WINDOWS\System32\DRIVERS\ipinip.sys [MANUAL] IpInIp Service C:\WINDOWS\System32\DRIVERS\ipnat.sys [MANUAL] IpNat Service C:\WINDOWS\System32\DRIVERS\ipsec.sys [sYSTEM] IPSec Service C:\WINDOWS\System32\DRIVERS\irda.sys [AUTO] irda Service C:\WINDOWS\System32\DRIVERS\irenum.sys [MANUAL] IRENUM Service C:\WINDOWS\System32\svchost.exe [AUTO] Irmon Service ISAPISearch Service C:\WINDOWS\System32\DRIVERS\isapnp.sys [bOOT] isapnp Service C:\WINDOWS\System32\drivers\iSMBIOS.SYS [AUTO] iSMBIOS Service C:\WINDOWS\system32\DRIVERS\k750bus.sys [MANUAL] k750bus Service C:\WINDOWS\system32\DRIVERS\k750mdfl.sys [MANUAL] k750mdfl Service C:\WINDOWS\system32\DRIVERS\k750mdm.sys [MANUAL] k750mdm Service C:\WINDOWS\system32\DRIVERS\k750mgmt.sys [MANUAL] k750mgmt Service C:\WINDOWS\system32\DRIVERS\k750obex.sys [MANUAL] k750obex Service C:\WINDOWS\System32\DRIVERS\kbdclass.sys [sYSTEM] Kbdclass Service C:\WINDOWS\system32\drivers\kmixer.sys [MANUAL] kmixer Service [bOOT] KSecDD Service C:\WINDOWS\System32\svchost.exe [AUTO] lanmanserver Service C:\WINDOWS\System32\svchost.exe [AUTO] lanmanworkstation Service [sYSTEM] lbrtfdc Service ldap Service LicenseService Service C:\WINDOWS\System32\svchost.exe [AUTO] LmHosts Service C:\WINDOWS\System32\svchost.exe [DISABLED] Messenger Service [sYSTEM] mnmdd Service C:\WINDOWS\System32\mnmsrvc.exe [MANUAL] mnmsrvc Service [MANUAL] Modem Service C:\WINDOWS\System32\DRIVERS\mouclass.sys [sYSTEM] Mouclass Service C:\WINDOWS\System32\DRIVERS\mouhid.sys [MANUAL] mouhid Service [bOOT] MountMgr Service [DISABLED] mraid35x Service C:\WINDOWS\System32\DRIVERS\mrxdav.sys [MANUAL] MRxDAV Service C:\WINDOWS\System32\DRIVERS\mrxsmb.sys [sYSTEM] MRxSmb Service C:\WINDOWS\System32\msdtc.exe [MANUAL] MSDTC Service [sYSTEM] Msfs Service C:\WINDOWS\System32\DRIVERS\MSIRCOMM.sys [MANUAL] MSIRCOMM Service C:\WINDOWS\system32\msiexec.exe [MANUAL] MSIServer Service C:\WINDOWS\system32\drivers\MSKSSRV.sys [MANUAL] MSKSSRV Service C:\WINDOWS\system32\drivers\MSPCLOCK.sys [MANUAL] MSPCLOCK Service C:\WINDOWS\system32\drivers\MSPQM.sys [MANUAL] MSPQM Service C:\WINDOWS\System32\DRIVERS\mssmbios.sys [MANUAL] mssmbios Service [bOOT] Mup Service C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\NAVAP.sys [MANUAL] NAVAP Service C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\NAVAPEL.SYS [AUTO] NAVAPEL Service C:\Program Files\Common Files\Symantec Shared\VirusDefs\20070711.016\NAVENG.SYS [MANUAL] NAVENG Service C:\Program Files\Common Files\Symantec Shared\VirusDefs\20070711.016\NAVEX15.SYS [MANUAL] NAVEX15 Service [bOOT] NDIS Service C:\WINDOWS\System32\DRIVERS\ndistapi.sys [MANUAL] NdisTapi Service C:\WINDOWS\System32\DRIVERS\ndisuio.sys [MANUAL] Ndisuio Service C:\WINDOWS\System32\DRIVERS\ndiswan.sys [MANUAL] NdisWan Service [MANUAL] NDProxy Service C:\WINDOWS\System32\DRIVERS\netbios.sys [sYSTEM] NetBIOS Service C:\WINDOWS\System32\DRIVERS\netbt.sys [sYSTEM] NetBT Service C:\WINDOWS\system32\netdde.exe [DISABLED] NetDDE Service C:\WINDOWS\system32\netdde.exe [DISABLED] NetDDEdsdm Service C:\WINDOWS\System32\lsass.exe [MANUAL] Netlogon Service C:\WINDOWS\System32\svchost.exe [MANUAL] Netman Service C:\WINDOWS\System32\svchost.exe [MANUAL] Nla Service C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\Rtvscan.exe [AUTO] Norton AntiVirus Server Service [sYSTEM] Npfs Service [DISABLED] Ntfs Service C:\WINDOWS\System32\lsass.exe [MANUAL] NtLmSsp Service C:\WINDOWS\system32\svchost.exe [MANUAL] NtmsSvc Service [sYSTEM] Null Service C:\WINDOWS\System32\DRIVERS\nwlnkflt.sys [MANUAL] NwlnkFlt Service C:\WINDOWS\System32\DRIVERS\nwlnkfwd.sys [MANUAL] NwlnkFwd Service C:\WINDOWS\System32\DRIVERS\parport.sys [MANUAL] Parport Service [bOOT] PartMgr Service [AUTO] ParVdm Service C:\WINDOWS\system32\PCANDIS5.SYS [MANUAL] PCANDIS5 Service C:\WINDOWS\System32\DRIVERS\pci.sys [bOOT] PCI Service [sYSTEM] PCIDump Service C:\WINDOWS\System32\DRIVERS\pciide.sys [bOOT] PCIIde Service [DISABLED] Pcmcia Service [MANUAL] PDCOMP Service [MANUAL] PDFRAME Service [MANUAL] PDRELI Service [MANUAL] PDRFRAME Service [DISABLED] perc2 Service [DISABLED] perc2hib Service PerfDisk Service PerfNet Service PerfOS Service PerfProc Service C:\WINDOWS\system32\services.exe [AUTO] PlugPlay Service C:\WINDOWS\system32\HPZipm12.exe [MANUAL] Pml Driver HPZ12 Service C:\WINDOWS\System32\lsass.exe [AUTO] PolicyAgent Service C:\WINDOWS\System32\DRIVERS\raspptp.sys [MANUAL] PptpMiniport Service C:\WINDOWS\System32\DRIVERS\processr.sys [sYSTEM] Processor Service C:\WINDOWS\system32\lsass.exe [AUTO] ProtectedStorage Service C:\WINDOWS\System32\DRIVERS\psched.sys [MANUAL] PSched Service C:\WINDOWS\System32\DRIVERS\ptilink.sys [MANUAL] Ptilink Service C:\WINDOWS\System32\DRIVERS\PxHelp20.sys [bOOT] PxHelp20 Service [DISABLED] ql1080 Service [DISABLED] Ql10wnt Service [DISABLED] ql12160 Service [DISABLED] ql1240 Service [DISABLED] ql1280 Service C:\WINDOWS\System32\DRIVERS\rasacd.sys [sYSTEM] RasAcd Service C:\WINDOWS\System32\svchost.exe [MANUAL] RasAuto Service C:\WINDOWS\System32\DRIVERS\rasirda.sys [MANUAL] Rasirda Service C:\WINDOWS\System32\DRIVERS\rasl2tp.sys [MANUAL] Rasl2tp Service C:\WINDOWS\System32\svchost.exe [MANUAL] RasMan Service C:\WINDOWS\System32\DRIVERS\raspppoe.sys [MANUAL] RasPppoe Service C:\WINDOWS\System32\DRIVERS\raspti.sys [MANUAL] Raspti Service C:\WINDOWS\System32\DRIVERS\rdbss.sys [sYSTEM] Rdbss Service C:\WINDOWS\System32\DRIVERS\RDPCDD.sys [sYSTEM] RDPCDD Service RDPDD Service C:\WINDOWS\System32\DRIVERS\rdpdr.sys [MANUAL] rdpdr Service RDPNP Service [MANUAL] RDPWD Service C:\WINDOWS\system32\sessmgr.exe [MANUAL] RDSessMgr Service C:\WINDOWS\System32\DRIVERS\redbook.sys [sYSTEM] redbook Service C:\WINDOWS\System32\svchost.exe [DISABLED] RemoteAccess Service C:\WINDOWS\system32\svchost.exe [AUTO] RemoteRegistry Service C:\WINDOWS\System32\locator.exe [MANUAL] RpcLocator Service C:\WINDOWS\system32\svchost.exe [AUTO] RpcSs Service C:\WINDOWS\System32\rsvp.exe [MANUAL] RSVP Service C:\WINDOWS\System32\DRIVERS\RTL8139.SYS [MANUAL] rtl8139 Service C:\WINDOWS\system32\lsass.exe [AUTO] SamSs Service C:\WINDOWS\System32\SCardSvr.exe [MANUAL] SCardSvr Service C:\WINDOWS\System32\svchost.exe [DISABLED] Schedule Service ScsiPort Service C:\Program Files\Spyware Doctor\svcntaux.exe [MANUAL] sdAuxService Service C:\Program Files\Spyware Doctor\swdsvc.exe [MANUAL] sdCoreService Service C:\WINDOWS\System32\DRIVERS\secdrv.sys [AUTO] Secdrv Service C:\WINDOWS\System32\svchost.exe [MANUAL] seclogon Service C:\WINDOWS\system32\svchost.exe [AUTO] SENS Service C:\WINDOWS\System32\DRIVERS\serenum.sys [MANUAL] serenum Service C:\WINDOWS\System32\DRIVERS\serial.sys [sYSTEM] Serial Service [sYSTEM] Sfloppy Service C:\WINDOWS\system32\DRIVERS\WlanBZXP.sys [MANUAL] SG762_XP Service C:\WINDOWS\System32\svchost.exe [AUTO] SharedAccess Service C:\WINDOWS\System32\svchost.exe [AUTO] ShellHWDetection Service [DISABLED] Simbad Service C:\WINDOWS\System32\drivers\SIODRV.SYS [AUTO] SIODRV Service C:\WINDOWS\System32\DRIVERS\smb.sys [MANUAL] smbusp Service C:\WINDOWS\system32\drivers\smwdm.sys [MANUAL] smwdm Service [DISABLED] Sparrow Service C:\WINDOWS\system32\drivers\splitter.sys [MANUAL] splitter Service C:\WINDOWS\system32\spoolsv.exe [AUTO] Spooler Service C:\WINDOWS\System32\DRIVERS\sr.sys [DISABLED] sr Service C:\WINDOWS\System32\svchost.exe [AUTO] srservice Service C:\WINDOWS\System32\DRIVERS\srv.sys [MANUAL] Srv Service C:\WINDOWS\System32\svchost.exe [MANUAL] SSDPSRV Service C:\WINDOWS\System32\DRIVERS\irstusb.sys [MANUAL] STIrUsb Service C:\WINDOWS\System32\svchost.exe [MANUAL] stisvc Service C:\WINDOWS\System32\DRIVERS\swenum.sys [MANUAL] swenum Service C:\WINDOWS\system32\drivers\swmidi.sys [MANUAL] swmidi Service C:\WINDOWS\System32\dllhost.exe [MANUAL] SwPrv Service swwd Service [DISABLED] symc810 Service [DISABLED] symc8xx Service C:\Program Files\Symantec\SYMEVENT.SYS [MANUAL] SymEvent Service [DISABLED] sym_hi Service [DISABLED] sym_u3 Service C:\WINDOWS\system32\drivers\sysaudio.sys [MANUAL] sysaudio Service C:\WINDOWS\system32\smlogsvc.exe [MANUAL] SysmonLog Service C:\WINDOWS\System32\svchost.exe [MANUAL] TapiSrv Service C:\WINDOWS\System32\DRIVERS\tcpip.sys [sYSTEM] Tcpip Service [MANUAL] TDPIPE Service [MANUAL] TDTCP Service C:\WINDOWS\System32\DRIVERS\termdd.sys [sYSTEM] TermDD Service C:\WINDOWS\System32\svchost.exe [MANUAL] TermService Service C:\WINDOWS\System32\svchost.exe [AUTO] Themes Service C:\WINDOWS\System32\tlntsvr.exe [MANUAL] TlntSvr Service [DISABLED] TosIde Service C:\WINDOWS\system32\svchost.exe [AUTO] TrkWks Service TSDDD Service [DISABLED] Udfs Service [DISABLED] ultra Service C:\WINDOWS\system32\wdfmgr.exe [AUTO] UMWdf Service C:\WINDOWS\system32\DRIVERS\upatc.sys [MANUAL] UPATC Service C:\WINDOWS\System32\DRIVERS\update.sys [MANUAL] Update Service C:\WINDOWS\System32\svchost.exe [DISABLED] upnphost Service C:\WINDOWS\System32\ups.exe [MANUAL] UPS Service C:\WINDOWS\system32\DRIVERS\usbehci.sys [MANUAL] usbehci Service C:\WINDOWS\System32\DRIVERS\usbhub.sys [MANUAL] usbhub Service C:\WINDOWS\system32\DRIVERS\usbprint.sys [MANUAL] usbprint Service C:\WINDOWS\System32\DRIVERS\USBSTOR.SYS [MANUAL] USBSTOR Service C:\WINDOWS\System32\DRIVERS\usbuhci.sys [MANUAL] usbuhci Service C:\WINDOWS\System32\drivers\vga.sys [sYSTEM] VgaSave Service [DISABLED] ViaIde Service [bOOT] VolSnap Service C:\WINDOWS\System32\vssvc.exe [MANUAL] VSS Service VXD Service C:\WINDOWS\System32\svchost.exe [DISABLED] W32Time Service W3SVC Service C:\WINDOWS\System32\DRIVERS\wanarp.sys [MANUAL] Wanarp Service [MANUAL] WDICA Service C:\WINDOWS\system32\drivers\wdmaud.sys [MANUAL] wdmaud Service C:\WINDOWS\System32\svchost.exe [AUTO] WebClient Service C:\WINDOWS\system32\svchost.exe [AUTO] winmgmt Service [MANUAL] Winsock Service WinSock2 Service WinTrust Service C:\WINDOWS\System32\svchost.exe [MANUAL] WmdmPmSN Service C:\WINDOWS\System32\svchost.exe [MANUAL] Wmi Service WmiApRpl Service C:\WINDOWS\System32\wbem\wmiapsrv.exe [MANUAL] WmiApSrv Service C:\WINDOWS\System32\drivers\ws2ifsl.sys [DISABLED] WS2IFSL Service C:\WINDOWS\System32\svchost.exe [AUTO] wscsvc Service C:\WINDOWS\system32\svchost.exe [AUTO] wuauserv Service C:\WINDOWS\System32\svchost.exe [AUTO] WZCSVC Service C:\WINDOWS\System32\svchost.exe [MANUAL] xmlprov Service C:\WINDOWS\system32\ZDCndis5.SYS [MANUAL] ZDCndis5 Service C:\WINDOWS\system32\ZDPNDIS5.SYS [MANUAL] ZDPNDIS5 Service C:\WINDOWS\System32\Drivers\ZDPSp50.sys [MANUAL] ZDPSp50 Service C:\WINDOWS\system32\drivers\ialmsbw.sys [sYSTEM] {6080A529-897E-4629-A488-ABA0C29B635E} Service {A940493D-B3FD-41BF-8EE6-F5FD2B03D304} Service C:\WINDOWS\system32\drivers\ialmkchw.sys [MANUAL] {D31A0762-0CEB-444e-ACFF-B049A1F6FE91} Service {D3D3A397-4037-440A-A2BB-B45EFF322B61} ---- EOF - GMER 1.0.13 ----

Gutek · 17 Lipiec 2007 05:32

Pobierz: ATF-Cleaner i oczyść TEMP

Dokończyć skanerami online - Skanery do wyboru

AndrzejS_236237882 · 17 Lipiec 2007 07:08

Witam

Serdecznie dziękuję za pomoc.

Od wczoraj nie pojawił się żaden komunikat z Symanteca.

Mam nadzieję, że nic nie zostało. Poczekam ze dwa dni i zobaczymy.

A które ze skanerów byś polecił? Ewido już puszczałem. (długo skanuje )

Pozdrawiam

Andrzej

Gutek · 17 Lipiec 2007 08:20

Użyj jeszcze Nod32 albo polecam - http://pl.trendmicro-europe.com/consume … launch.php

AndrzejS_236237882 · 18 Lipiec 2007 21:14

Puściłem NODA i wyrzuca mi już 10 zainfekowany plik z pytaniem, czy usunąć, czy zostawić.

Pierwszego skasowałem bez zastanowienia pozostałe skasowałem, ale zapisałem w notatniku, jakie to pliki. Zanosi się, że to jeszcze nie koniec.

Mam pytanie czy tego rodzaju pliki pozwolić mu kasować?

Jeśli można proszę kogoś znającego się na tym o odpowiedź jeszcze dziś.

Na razie wstrzymałem się z kasowaniem, bo boję się, że rozwalę Windowsa.

Oto te komunikaty Noda:

Plik C:\Instalki\OVERNET\overnet0.50.1.exe jest zainfekowany - Program Win32/Adware.UCmore.

Plik C:\WINDOWS\Lotr22.exe:ewgro jest zainfekowany - trojan Win32/TrojanDownloader.WinShow.NAK.

Plik C:\WINDOWS\Q330994.exe:menhd jest zainfekowany - trojan Win32/TrojanDownloader.WinShow.NAK.

Plik C:\WINDOWS\Q811630.log:ijula jest zainfekowany - trojan Win32/TrojanDownloader.WinShow.NAK.

Plik C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:aadkn jest zainfekowany - trojan Win32/TrojanDownloader.Agent.BQ.

Plik C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:aagzy jest zainfekowany - trojan Win32/TrojanDownloader.Agent.BQ.

Plik C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:aapge jest zainfekowany - trojan Win32/TrojanDownloader.Agent.BQ.

Plik C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:aarel jest zainfekowany - trojan Win32/TrojanDownloader.Agent.BQ.

Plik C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:aaylw jest zainfekowany - trojan Win32/TrojanDownloader.Agent.BQ.

Gutek · 18 Lipiec 2007 22:22

Do usunięcia i nowy log z Combofixa

AndrzejS_236237882 · 18 Lipiec 2007 22:54

O dziękuję, już przestałem liczyć, że się ktoś odezwie.

Kasuję i kasuję. Pewnie ze stosześćdziesiąt albo i więcej a końca nie widać. Jestem dopiero na literze “e”.

np. “Plik C:\WINDOWS{F3E4487D-D3D2-48F9-8C78-5D6BEDB0DEB0}.dat:egdad jest zainfekowany - trojan Win32/TrojanDownloader.Agent.BQ.”

Jak skończę, to oczywiście Combofixa puszczę.

Złączono Posta : 19.07.2007 (Czw) 7:25

Podczas skanowania Nodem 4157 zainfekowanych plików :shock:

4156 wyleczonych plików

1 liczba aktywnych wirusów

Kiedy ręcznie usuwałem pliki z katalogu w którym Nod wykrył wirusa: “Plik C:\Instalki\OVERNET\overnet0.50.1.exe jest zainfekowany - Program Win32/Adware.UCmore.” pojawiło się to:

Shot at 2007-07-18

Oto log z combofixa:

“Administrator” - 2007-07-19 7:39:44 - ComboFix 07-07-13.8 - Dodatek Service Pack 2 NTFS ((((((((((((((((((((((((( Files Created from 2007-06-19 to 2007-07-19 ))))))))))))))))))))))))))))))) 2007-07-18 09:22 512,096 --a------ C:\WINDOWS\system32\drivers\amon.sys 2007-07-18 09:22 298,104 --a------ C:\WINDOWS\system32\imon.dll 2007-07-18 09:22 15,424 --a------ C:\WINDOWS\system32\drivers\nod32drv.sys 2007-07-18 00:49 2007-07-16 14:43 2007-07-14 23:56 51,200 --a------ C:\WINDOWS\nircmd.exe 2007-07-13 01:48 2007-07-12 21:02 83,024 --a------ C:\WINDOWS\system32\drivers\iksyssec.sys 2007-07-12 21:02 57,424 --a------ C:\WINDOWS\system32\drivers\iksysflt.sys 2007-07-12 21:02 53,840 --a------ C:\WINDOWS\system32\drivers\ikfilesec.sys 2007-07-12 21:02 39,376 --a------ C:\WINDOWS\system32\drivers\ikfileflt.sys 2007-07-12 21:02 29,264 --a------ C:\WINDOWS\system32\drivers\kcom.sys 2007-07-12 21:01 2007-07-12 21:01 2007-07-12 14:35 2007-07-12 13:45 626,688 --a------ C:\WINDOWS\system32\msvcr80.dll 2007-07-09 22:40 2007-07-09 22:38 94,688 --a------ C:\WINDOWS\system32\drivers\upatc.sys 2007-06-28 23:12 (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) 2007-07-18 17:50:37 -------- d-----w C:\DOCUME~1\ADMINI~1\DANEAP~1\Skype 2007-07-15 21:01:26 -------- d-----w C:\Program Files\SolidDocuments 2007-07-15 20:56:15 -------- d-----w C:\DOCUME~1\ADMINI~1\DANEAP~1\SolidDocuments 2007-07-13 06:17:39 -------- d-----w C:\Program Files\Opera 2007-07-13 06:07:26 49,712 ----a-w C:\WINDOWS\system32\perfc015.dat 2007-07-13 06:07:26 355,830 ----a-w C:\WINDOWS\system32\perfh015.dat 2007-07-12 20:54:22 -------- d-----w C:\Program Files\Multimedialny swiat Biblii 2007-07-12 11:24:51 -------- d-----w C:\Program Files\eMule 2007-07-09 15:22:36 -------- d-----w C:\Program Files\Hewlett-Packard 2007-06-28 10:44:19 -------- d-----w C:\Program Files\Diablo II 2007-06-28 10:44:00 21,840 ----atw C:\WINDOWS\system32\SIntfNT.dll 2007-06-28 10:44:00 17,212 ----atw C:\WINDOWS\system32\SIntf32.dll 2007-06-28 10:44:00 12,067 ----atw C:\WINDOWS\system32\SIntf16.dll 2007-06-22 06:48:51 -------- d-----w C:\Program Files\ServiceSupportTool 2007-06-21 21:31:44 -------- d-----w C:\Program Files\Leksykonia 2007-06-21 21:19:31 -------- d-----w C:\Program Files\Winamp 2007-06-21 21:00:54 -------- d-----w C:\Program Files\Direct Connect 2007-06-21 20:03:22 -------- d-----w C:\Program Files\Tlen.pl 2007-06-06 20:47:47 -------- d-----w C:\Program Files\DC++ 2007-06-06 07:11:33 -------- d-----w C:\Program Files\SoftMaker Viewer 2007-05-23 23:22:29 -------- d-----w C:\Program Files\Common Files\Real 2007-05-16 15:18:58 683,520 ----a-w C:\WINDOWS\system32\inetcomm.dll 2007-04-25 14:23:30 144,896 ----a-w C:\WINDOWS\system32\schannel.dll 2001-10-30 12:00:00 94,832 --sh–w C:\WINDOWS\twain.dll 2004-08-04 07:44:12 50,688 --sh–w C:\WINDOWS\twain_32.dll 2003-10-22 19:44:40 8 --sha-r C:\WINDOWS\system32\140A160817.sys 2003-11-03 23:36:56 1,890 --sha-w C:\WINDOWS\system32\KGyGaAvL.sys 2004-08-04 07:44:01 1,028,096 --sh–w C:\WINDOWS\system32\mfc42.dll 2004-08-04 07:44:05 54,784 --sh–w C:\WINDOWS\system32\msvcirt.dll 2004-08-04 07:44:05 413,696 --sh–w C:\WINDOWS\system32\msvcp60.dll 2004-08-04 07:44:05 343,040 --sh–w C:\WINDOWS\system32\msvcrt.dll 2004-08-04 07:44:07 553,472 --sh–w C:\WINDOWS\system32\oleaut32.dll 2004-08-04 07:44:07 83,456 --sh–w C:\WINDOWS\system32\olepro32.dll 2004-08-04 07:44:26 12,288 --sh–w C:\WINDOWS\system32\regsvr32.exe ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries legit default entries are not shown [HKEY_LOCAL_MACHINE~\Browser Helper Objects{02478D38-C3F9-4EFB-9B51-7695ECA05670}] 2006-06-07 11:09 399352 --a------ C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll [HKEY_LOCAL_MACHINE~\Browser Helper Objects{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}] 2004-12-14 10:56 63136 --a------ C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll [HKEY_LOCAL_MACHINE~\Browser Helper Objects{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}] 2007-07-12 04:00 501136 --a------ C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll [HKEY_LOCAL_MACHINE~\Browser Helper Objects{AE7CD045-E861-484f-8273-0445EE161910}] 2004-12-14 11:13 225280 --a------ C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll [HKEY_LOCAL_MACHINE~\Browser Helper Objects{EBE9E2B5-B526-48BC-AD46-687263EDCB0E}] 2004-12-03 05:14 100864 --a------ C:\Program Files\Kwyshell\MidpX\JadInvoker\MidpInvoker.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “Smapp”=“C:\Program Files\Analog Devices\SoundMAX\Smtray.exe” [2002-01-30 18:01] “QuickTime Task”=“C:\Program Files\QuickTime\qttask.exe” [2005-05-05 00:14] “vptray”=“C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\vptray.exe” [2002-10-07 14:41] “Acrobat Assistant 7.0”=“C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe” [2004-12-14 11:12] “SunJavaUpdateSched”=“C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe” [2007-07-12 04:00] “nod32kui”=“C:\Program Files\Eset\nod32kui.exe” [2007-07-18 09:21] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “Lyj”=“C:\Program Files\Common Files\s?curity\l?ass.exe” [] [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\sdauxservice] [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\sdcoreservice] ************************************************************************** catchme 0.3.915 W2K/XP/Vista - rootkit detector by Gmer, http://www.gmer.net Rootkit scan 2007-07-19 07:44:54 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes … scanning hidden autostart entries … scanning hidden files … ************************************************************************** Completion time: 2007-07-19 7:47:04 C:\ComboFix-quarantined-files.txt … 2007-07-19 07:46 C:\ComboFix2.txt … 2007-07-16 10:54 C:\ComboFix3.txt … 2007-07-15 00:38 — E O F —

adam9870 · 19 Lipiec 2007 11:00

Poczytaj o usuwaniu plików z pytajnikiem, a następnie usuń wskazany katalog.

Otwórz Notatnik i wklej w nim to:

Plik >>> Zapisz jako >>> Zmień rozszerzenie z TXT na Wszystkie pliki >>> Zapisz pod nazwą FIX.REG >>> kliknij dwa razy na utworzony plik FIX.REG i potwierdź dodanie do rejestru >>> restart.

Przeskanuj plik C:\WINDOWS\system32\140A160817.sys na stronie http://virusscan.jotti.org/ bądź http://www.virustotal.com/pl/, a następnie przedstaw tu wyniki skanowania.

Uwaga : przed skanowaniem włącz pokazywanie ukrytych oraz systemowych plików i folderów. W przeciwnym wypadku nie ujrzysz wskazanego pliku poprzez Eksplolator Windows. W tym celu wejdź do Panelu Sterowania -> uruchom aplet Opcje folderów -> przejdź na zakładkę Widok -> zaznacz opcję Pokaż ukryte pliki i foldery oraz odznacz opcję Ukryj chronione pliki systemu operacyjnego (zalecane) -> potwierdź zmiany klikając Zastosuj, a następnie OK.

Przeskanuj system którymś z tych skanerów on-line i usuń wszystko to, co znajdą:

http://www.ewido.net/de/onlinescan/

http://www.kaspersky.pl/virusscanner.html

Opróżnij Kosz. Dodatkowo będąc w trybie awaryjnym korzystając z wiersza polecenia wydaj polecenie RD /S Q C:\RECYCLER

Po wykonaniu zdaj relacje i wklej nowy log z ComboFix.

AndrzejS_236237882 · 19 Lipiec 2007 21:39

Niestety musiałem nieoczekiwanie wyjechać w delegację (taka praca).

Wróciłem dwie godziny temu. Dlatego dopiero teraz się odzywam.

Próbuję, zgodnie z podaną instrukcją za pomocą linii komend wejść w katalog s?curity, ale nie mogę. Kiedy piszę: CD C:\Program Files\Common Files\s?curity\ otrzymuję komunikat: nazwa pliku, nazwa katalogu lub składnia etykiety woluminu jest niepoprawna"

Mogę wejść do Common files, ale nie dalej.

Próbowałem wylistować pliki ukryte bez i z rozszerzeniem na katalogi ( /S)

ale katalog s?curity się nie wyświetla.

Próbowałem mimo to zmienić atrybut tego katalogu ale skutek ten sam. Jakby go tam nie było.

Czy jest jakiś inny sposób dotarcia i skasowania tego katalogu?

Gutek · 20 Lipiec 2007 00:54

Daj nowy log z ComboFix

AndrzejS_236237882 · 20 Lipiec 2007 07:21

Chwileczkę

Wygląda na to, że tego katalogu i pliku już po prostu nie ma.

Za pomocą HijackThis usunąłem ten wpis:

O4 - HKCU…\Run: [Lyj] “C:\Program Files\Common Files\s?curity\l?ass.exe”

Czy mimo to zrobić ten wpis za pomocą notatnika?

Rezultat skanowania pliku C:\WINDOWS\system32\140A160817.sys

Service load: 0% 100%

File: 140A160817.sys

Status: OK

MD5: ba898b29f0dbf9307f494475a8393f03

Packers detected: -

Bit9 reports: File not found

Scan taken on 20 Jul 2007 06:44:35 (GMT)

A-Squared Found nothing

AntiVir Found nothing

ArcaVir Found nothing

Avast Found nothing

AVG Antivirus Found nothing

BitDefender Found nothing

ClamAV Found nothing

CPsecure Found nothing

Dr.Web Found nothing

F-Prot Antivirus Found nothing

F-Secure Anti-Virus Found nothing

Fortinet Found nothing

Kaspersky Anti-Virus Found nothing

NOD32 Found nothing

Norman Virus Control Found nothing

Panda Antivirus Found nothing

Rising Antivirus Found nothing

Sophos Antivirus Found nothing

VirusBuster Found nothing

VBA32 Found nothing

Polecenie RD /S Q C:\RECYCLER w trybie awaryjnym wokonałem.

Log z Combofix:

“Administrator” - 2007-07-20 9:09:06 - ComboFix 07-07-13.8 - Dodatek Service Pack 2 NTFS ((((((((((((((((((((((((( Files Created from 2007-06-20 to 2007-07-20 ))))))))))))))))))))))))))))))) 2007-07-20 01:04 2007-07-18 09:22 512,096 --a------ C:\WINDOWS\system32\drivers\amon.sys 2007-07-18 09:22 298,104 --a------ C:\WINDOWS\system32\imon.dll 2007-07-18 09:22 15,424 --a------ C:\WINDOWS\system32\drivers\nod32drv.sys 2007-07-18 00:49 2007-07-16 14:43 2007-07-14 23:56 51,200 --a------ C:\WINDOWS\nircmd.exe 2007-07-13 01:48 2007-07-12 21:02 83,024 --a------ C:\WINDOWS\system32\drivers\iksyssec.sys 2007-07-12 21:02 57,424 --a------ C:\WINDOWS\system32\drivers\iksysflt.sys 2007-07-12 21:02 53,840 --a------ C:\WINDOWS\system32\drivers\ikfilesec.sys 2007-07-12 21:02 39,376 --a------ C:\WINDOWS\system32\drivers\ikfileflt.sys 2007-07-12 21:02 29,264 --a------ C:\WINDOWS\system32\drivers\kcom.sys 2007-07-12 21:01 2007-07-12 21:01 2007-07-12 14:35 2007-07-12 13:45 626,688 --a------ C:\WINDOWS\system32\msvcr80.dll 2007-07-09 22:40 2007-07-09 22:38 94,688 --a------ C:\WINDOWS\system32\drivers\upatc.sys 2007-06-28 23:12 (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) 2007-07-19 22:06:35 0 ----a-w C:\Program Files\Common Files\Teleca 2007-07-19 22:06:35 0 ----a-w C:\Program Files\Common Files\Symantec 2007-07-19 22:06:35 0 ----a-w C:\Program Files\Common Files\Microsoft 2007-07-19 22:06:35 0 ----a-w C:\Program Files\Common Files\DIR 2007-07-19 22:06:35 0 ----a-w C:\Program Files\Common Files\3DO 2007-07-18 17:50:37 -------- d-----w C:\DOCUME~1\ADMINI~1\DANEAP~1\Skype 2007-07-15 20:56:15 -------- d-----w C:\DOCUME~1\ADMINI~1\DANEAP~1\SolidDocuments 2007-07-13 06:17:39 -------- d-----w C:\Program Files\Opera 2007-07-13 06:07:26 49,712 ----a-w C:\WINDOWS\system32\perfc015.dat 2007-07-13 06:07:26 355,830 ----a-w C:\WINDOWS\system32\perfh015.dat 2007-07-12 20:54:22 -------- d-----w C:\Program Files\Multimedialny swiat Biblii 2007-07-12 11:24:51 -------- d-----w C:\Program Files\eMule 2007-07-09 15:22:36 -------- d-----w C:\Program Files\Hewlett-Packard 2007-06-28 10:44:19 -------- d-----w C:\Program Files\Diablo II 2007-06-28 10:44:00 21,840 ----atw C:\WINDOWS\system32\SIntfNT.dll 2007-06-28 10:44:00 17,212 ----atw C:\WINDOWS\system32\SIntf32.dll 2007-06-28 10:44:00 12,067 ----atw C:\WINDOWS\system32\SIntf16.dll 2007-06-22 06:48:51 -------- d-----w C:\Program Files\ServiceSupportTool 2007-06-21 21:31:44 -------- d-----w C:\Program Files\Leksykonia 2007-06-21 21:19:31 -------- d-----w C:\Program Files\Winamp 2007-06-21 21:00:54 -------- d-----w C:\Program Files\Direct Connect 2007-06-21 20:03:22 -------- d-----w C:\Program Files\Tlen.pl 2007-06-06 20:47:47 -------- d-----w C:\Program Files\DC++ 2007-06-06 07:11:33 -------- d-----w C:\Program Files\SoftMaker Viewer 2007-05-23 23:22:29 -------- d-----w C:\Program Files\Common Files\Real 2007-05-16 15:18:58 683,520 ----a-w C:\WINDOWS\system32\inetcomm.dll 2007-04-25 14:23:30 144,896 ----a-w C:\WINDOWS\system32\schannel.dll 2001-10-30 12:00:00 94,832 --sh–w C:\WINDOWS\twain.dll 2004-08-04 07:44:12 50,688 --sh–w C:\WINDOWS\twain_32.dll 2003-10-22 19:44:40 8 --sha-r C:\WINDOWS\system32\140A160817.sys 2003-11-03 23:36:56 1,890 --sha-w C:\WINDOWS\system32\KGyGaAvL.sys 2004-08-04 07:44:01 1,028,096 --sh–w C:\WINDOWS\system32\mfc42.dll 2004-08-04 07:44:05 54,784 --sh–w C:\WINDOWS\system32\msvcirt.dll 2004-08-04 07:44:05 413,696 --sh–w C:\WINDOWS\system32\msvcp60.dll 2004-08-04 07:44:05 343,040 --sh–w C:\WINDOWS\system32\msvcrt.dll 2004-08-04 07:44:07 553,472 --sh–w C:\WINDOWS\system32\oleaut32.dll 2004-08-04 07:44:07 83,456 --sh–w C:\WINDOWS\system32\olepro32.dll 2004-08-04 07:44:26 12,288 --sh–w C:\WINDOWS\system32\regsvr32.exe ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE~\Browser Helper Objects{02478D38-C3F9-4EFB-9B51-7695ECA05670}] 2006-06-07 11:09 399352 --a------ C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll [HKEY_LOCAL_MACHINE~\Browser Helper Objects{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}] 2004-12-14 10:56 63136 --a------ C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll [HKEY_LOCAL_MACHINE~\Browser Helper Objects{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}] 2007-07-12 04:00 501136 --a------ C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll [HKEY_LOCAL_MACHINE~\Browser Helper Objects{AE7CD045-E861-484f-8273-0445EE161910}] 2004-12-14 11:13 225280 --a------ C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll [HKEY_LOCAL_MACHINE~\Browser Helper Objects{EBE9E2B5-B526-48BC-AD46-687263EDCB0E}] 2004-12-03 05:14 100864 --a------ C:\Program Files\Kwyshell\MidpX\JadInvoker\MidpInvoker.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “Smapp”=“C:\Program Files\Analog Devices\SoundMAX\Smtray.exe” [2002-01-30 18:01] “QuickTime Task”=“C:\Program Files\QuickTime\qttask.exe” [2005-05-05 00:14] “vptray”=“C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\vptray.exe” [2002-10-07 14:41] “Acrobat Assistant 7.0”=“C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe” [2004-12-14 11:12] “SunJavaUpdateSched”=“C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe” [2007-07-12 04:00] “nod32kui”=“C:\Program Files\Eset\nod32kui.exe” [2007-07-18 09:21] “SpyHunter”=“C:\Program Files\Enigma Software Group\SpyHunter\SpyHunter.exe” [2007-04-26 19:03] [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\sdauxservice] [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\sdcoreservice] ************************************************************************** catchme 0.3.915 W2K/XP/Vista - rootkit detector by Gmer, http://www.gmer.net Rootkit scan 2007-07-20 09:15:35 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes … scanning hidden autostart entries … scanning hidden files … scan completed successfully hidden files: 0 ************************************************************************** Completion time: 2007-07-20 9:17:19 C:\ComboFix-quarantined-files.txt … 2007-07-20 09:16 C:\ComboFix2.txt … 2007-07-19 07:47 C:\ComboFix3.txt … 2007-07-16 10:54 — E O F —

Gutek · 20 Lipiec 2007 12:09

No już Ok

AndrzejS_236237882 · 20 Lipiec 2007 22:00

Jeszcze raz wielkie podziękowania za udzieloną mi pomoc.

Pozdrawiam

Andrzej