Gap

info z Kasperskyego : Physical disk sector contains Trojan Program: Backdoor.Win32.Sinowal.kv. Physical disc sector: \Device\Harddisk1\DR1. Komp mi muli już totalnie, system uruchamia się chyba z 5 min...8O Dysk twardy mieli non stop przy uruchamianiu. » Naciśnij aby pokazać/ukryć tekst oznaczony jako spoiler « - "log ComboFix" ComboFix 08-12-15.01 - Marcin 2008-12-15 20:32:15.1 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.511.236 [GMT 1:00] Uruchomiony z: c:\documents and settings\Marcin\Moje dokumenty\ComboFix.exe . ((((((((((((((((((((((((((((((((((((((( Usunięto ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\windows\IE4 Error Log.txt . ((((((((((((((((((((((((((((((((((((((( Sterowniki/Usługi ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Legacy_IPRIP -------\Service_Iprip ((((((((((((((((((((((((( Pliki utworzone od 2008-11-15 do 2008-12-15 ))))))))))))))))))))))))))))))) . 2008-12-14 21:26 . 2008-12-14 21:26 <DIR> d---s---- c:\documents and settings\Marcin\UserData 2008-12-14 20:42 . 2008-12-15 18:03 <DIR> d-------- c:\program files\Spyware Doctor 2008-12-14 20:42 . 2008-12-14 20:42 <DIR> d-------- c:\documents and settings\Marcin\Dane aplikacji\PC Tools 2008-12-14 20:42 . 2008-08-25 12:36 81,288 --a------ c:\windows\system32\drivers\iksyssec.sys 2008-12-14 20:42 . 2008-08-25 12:36 66,952 --a------ c:\windows\system32\drivers\iksysflt.sys 2008-12-14 20:42 . 2008-08-25 12:36 40,840 --a------ c:\windows\system32\drivers\ikfilesec.sys 2008-12-14 20:42 . 2008-06-02 16:19 29,576 --a------ c:\windows\system32\drivers\kcom.sys 2008-12-12 21:50 . 2008-12-15 20:39 <DIR> d-a------ c:\documents and settings\All Users\Dane aplikacji\TEMP 2008-12-12 08:45 . 2008-12-12 08:45 <DIR> d-------- c:\windows\system32\LogFiles 2008-12-11 22:34 . 2008-12-11 22:38 <DIR> d-------- c:\program files\SkanerOnline 2008-12-09 17:04 . 2008-12-09 17:04 <DIR> d---s---- c:\documents and settings\Iva\UserData 2008-12-08 22:17 . 2008-12-08 22:17 <DIR> d-------- c:\program files\Kaspersky Lab 2008-12-08 22:17 . 2008-12-15 17:38 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\Kaspersky Lab 2008-12-08 22:17 . 2008-12-15 20:38 6,901,024 --ahs---- c:\windows\system32\drivers\fidbox.dat 2008-12-08 22:17 . 2008-12-15 20:38 99,740 --ahs---- c:\windows\system32\drivers\fidbox.idx 2008-12-08 22:17 . 2008-12-08 22:46 96,976 --a------ c:\windows\system32\drivers\klin.dat 2008-12-08 22:17 . 2008-12-08 22:46 87,855 --a------ c:\windows\system32\drivers\klick.dat 2008-12-08 22:17 . 2008-12-15 20:38 37,408 --ahs---- c:\windows\system32\drivers\fidbox2.dat 2008-12-08 22:17 . 2008-12-15 20:38 5,480 --ahs---- c:\windows\system32\drivers\fidbox2.idx 2008-12-08 22:16 . 2008-12-08 22:16 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\Kaspersky Lab Setup Files 2008-11-28 22:40 . 2008-11-28 22:40 <DIR> d-------- c:\program files\Winamp 2008-11-28 22:40 . 2008-11-28 22:40 <DIR> d-------- c:\documents and settings\Marcin\Dane aplikacji\Winamp 2008-11-28 22:32 . 2008-11-28 22:32 <DIR> d-------- c:\program files\Winamp Toolbar 2008-11-28 22:32 . 2008-11-28 22:32 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\Winamp Toolbar 2008-11-28 22:30 . 2007-03-08 00:51 129,784 --------- c:\windows\system32\pxafs.dll 2008-11-28 22:30 . 2007-03-08 00:51 9,464 --------- c:\windows\system32\drivers\cdralw2k.sys 2008-11-28 22:30 . 2007-03-08 00:51 9,336 --------- c:\windows\system32\drivers\cdr4_xp.sys 2008-11-28 20:13 . 2005-07-30 21:00 114,688 --a------ c:\windows\system32\OdiOlDVR.dll 2008-11-28 20:13 . 2005-07-30 21:14 86,016 --a------ c:\windows\system32\STRDEVAPI.dll 2008-11-28 20:13 . 2006-04-07 17:05 73,728 --a------ c:\windows\system32\VNUSB.dll 2008-11-28 20:13 . 2003-06-13 17:49 73,728 --a------ c:\windows\system32\DW90USB.DLL 2008-11-28 20:13 . 2004-06-21 10:14 53,248 --a------ c:\windows\system32\OdiAPI.dll 2008-11-28 20:13 . 2001-04-09 19:17 39,096 --a------ c:\windows\system32\drivers\DW90USB.SYS 2008-11-28 20:13 . 2006-04-07 17:06 38,496 --a------ c:\windows\system32\drivers\VNUSB.sys 2008-11-22 17:29 . 2008-11-22 17:29 <DIR> d-------- c:\program files\SAGEM 2008-11-22 17:29 . 2008-11-22 17:29 <DIR> d-------- c:\documents and settings\Marcin\Dane aplikacji\InstallShield 2008-11-22 13:35 . 2008-11-22 13:35 78 --a------ C:\moj_plik.ini 2008-11-22 13:32 . 2008-11-22 13:34 <DIR> d-------- c:\program files\Misja_Bakolandia - Gra 2008-11-20 22:51 . 2008-11-20 22:51 <DIR> d-------- c:\documents and settings\Marcin\Dane aplikacji\Gadu-Gadu 2008-11-20 22:50 . 2008-12-13 09:22 <DIR> d-------- c:\program files\Gadu-Gadu 2008-11-20 22:50 . 2008-11-20 22:51 <DIR> d-------- c:\documents and settings\Marcin\Gadu-Gadu 2008-11-17 21:24 . 2008-11-17 21:24 <DIR> d-------- c:\program files\totalcmd 2008-11-17 21:24 . 2008-12-13 10:19 1,771 --a------ c:\windows\wincmd.ini 2008-11-17 21:24 . 2008-07-29 07:04 545 --a------ c:\windows\UC.PIF 2008-11-17 21:24 . 2008-07-29 07:04 545 --a------ c:\windows\RAR.PIF 2008-11-17 21:24 . 2008-07-29 07:04 545 --a------ c:\windows\PKZIP.PIF 2008-11-17 21:24 . 2008-07-29 07:04 545 --a------ c:\windows\PKUNZIP.PIF 2008-11-17 21:24 . 2008-07-29 07:04 545 --a------ c:\windows\NOCLOSE.PIF 2008-11-17 21:24 . 2008-07-29 07:04 545 --a------ c:\windows\LHA.PIF 2008-11-17 21:24 . 2008-07-29 07:04 545 --a------ c:\windows\ARJ.PIF 2008-11-17 11:50 . 2008-11-17 11:50 <DIR> d-------- c:\documents and settings\Iva\Dane aplikacji\Teleca 2008-11-17 11:49 . 2008-11-17 11:49 <DIR> d-------- c:\documents and settings\Iva\Dane aplikacji\Sony Ericsson 2008-11-16 21:50 . 2008-11-16 21:50 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\HP 2008-11-16 21:49 . 2008-11-16 21:49 <DIR> d-------- c:\program files\Common Files\Sonic Shared 2008-11-16 21:49 . 2008-11-16 21:49 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\Sonic 2008-11-16 21:48 . 2008-11-16 21:48 <DIR> d-------- c:\program files\Common Files\HP 2008-11-16 21:47 . 2008-11-16 21:47 <DIR> d-------- c:\program files\Hewlett-Packard 2008-11-16 21:46 . 2008-11-16 21:46 <DIR> d-------- c:\program files\Common Files\Hewlett-Packard 2008-11-16 21:45 . 2005-03-08 05:43 51,120 -ra------ c:\windows\system32\drivers\HPZid412.sys 2008-11-16 21:45 . 2005-03-08 05:43 21,744 -ra------ c:\windows\system32\drivers\HPZius12.sys 2008-11-16 21:45 . 2005-03-08 05:43 16,496 -ra------ c:\windows\system32\drivers\HPZipr12.sys 2008-11-16 21:45 . 2004-08-03 22:58 15,104 --a------ c:\windows\system32\drivers\usbscan.sys 2008-11-16 21:45 . 2004-08-03 22:58 15,104 --a--c--- c:\windows\system32\dllcache\usbscan.sys 2008-11-16 21:39 . 2004-09-29 12:12 278,584 --a------ c:\windows\system32\HPZidr12.dll 2008-11-16 21:39 . 2004-09-29 12:15 204,800 --a------ c:\windows\system32\HPZipr12.dll 2008-11-16 21:39 . 2004-09-29 12:09 94,208 --a------ c:\windows\system32\HPZipt12.dll 2008-11-16 21:39 . 2004-09-29 12:14 69,632 --a------ c:\windows\system32\HPZipm12.exe 2008-11-16 21:39 . 2004-09-29 12:08 61,440 --a------ c:\windows\system32\HPZinw12.exe 2008-11-16 21:39 . 2004-09-29 12:09 57,344 --a------ c:\windows\system32\HPZisn12.dll 2008-11-16 21:37 . 2008-11-16 21:47 <DIR> d-------- c:\program files\HP 2008-11-16 21:37 . 2004-08-03 23:01 25,856 --a------ c:\windows\system32\drivers\usbprint.sys 2008-11-16 21:37 . 2004-08-03 23:01 25,856 --a--c--- c:\windows\system32\dllcache\usbprint.sys 2008-11-16 21:34 . 2008-11-18 19:11 <DIR> d-------- c:\documents and settings\Marcin\Dane aplikacji\HP 2008-11-16 21:34 . 2008-11-16 21:50 113,047 --a------ c:\windows\hpoins07.dat 2008-11-16 21:34 . 2005-05-24 09:22 21,124 --------- c:\windows\hpomdl07.dat 2008-11-16 11:13 . 2008-11-16 11:13 <DIR> d-------- c:\documents and settings\Marcin\Dane aplikacji\EFSoftware 2008-11-16 10:04 . 2008-11-16 10:04 <DIR> d-------- c:\program files\Disc2Phone 2008-11-16 10:02 . 2008-11-16 10:02 <DIR> d-------- c:\windows\system32\URTTEMP 2008-11-16 09:48 . 2004-08-03 23:08 31,616 --a------ c:\windows\system32\drivers\usbccgp.sys 2008-11-16 09:48 . 2004-08-03 23:08 31,616 --a--c--- c:\windows\system32\dllcache\usbccgp.sys 2008-11-16 09:46 . 2006-09-18 14:58 97,184 -ra------ c:\windows\system32\drivers\SE27mdm.sys 2008-11-16 09:46 . 2006-09-18 14:59 90,800 -ra------ c:\windows\system32\drivers\se27unic.sys 2008-11-16 09:46 . 2006-09-18 14:58 88,688 -ra------ c:\windows\system32\drivers\SE27mgmt.sys 2008-11-16 09:46 . 2006-09-18 14:59 86,560 -ra------ c:\windows\system32\drivers\SE27obex.sys 2008-11-16 09:46 . 2006-09-18 14:58 61,600 -ra------ c:\windows\system32\drivers\SE27bus.sys 2008-11-16 09:46 . 2006-09-18 14:59 18,704 -ra------ c:\windows\system32\drivers\se27nd5.sys 2008-11-16 09:46 . 2006-09-18 14:58 9,360 -ra------ c:\windows\system32\drivers\SE27mdfl.sys 2008-11-16 09:46 . 2006-09-18 14:58 6,240 -ra------ c:\windows\system32\drivers\SE27cmnt.sys 2008-11-16 09:46 . 2006-09-18 14:58 6,240 -ra------ c:\windows\system32\drivers\SE27cm.sys 2008-11-16 09:46 . 2006-09-18 14:59 5,872 -ra------ c:\windows\system32\drivers\SE27whnt.sys 2008-11-16 09:46 . 2006-09-18 14:59 5,872 -ra------ c:\windows\system32\drivers\SE27wh.sys 2008-11-16 09:46 . 2006-09-18 14:58 4,128 -ra------ c:\windows\system32\drivers\se27cr.sys 2008-11-16 09:45 . 2008-11-16 09:47 <DIR> d-------- c:\documents and settings\Marcin\Dane aplikacji\Teleca 2008-11-16 09:44 . 2008-11-16 09:44 <DIR> d-------- c:\documents and settings\Marcin\Dane aplikacji\Sony Ericsson 2008-11-16 09:43 . 2008-12-13 10:12 <DIR> d----c--- c:\windows\system32\DRVSTORE 2008-11-16 09:43 . 2008-12-13 10:14 <DIR> d-------- c:\program files\Common Files\Teleca Shared . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-12-08 21:46 112,144 ----a-w c:\windows\system32\drivers\kl1.sys 2008-11-28 19:13 --------- d--h--w c:\program files\InstallShield Installation Information 2008-11-28 19:13 --------- d-----w c:\program files\OLYMPUS 2008-11-25 06:10 --------- d-----w c:\program files\Google 2008-11-14 12:13 --------- d-----w c:\documents and settings\Iva\Dane aplikacji\AdobeUM 2008-11-12 22:14 --------- d-----w c:\program files\VZM-1 2008-11-04 17:10 --------- d-----w c:\program files\Sun 2008-11-04 17:09 410,976 ----a-w c:\windows\system32\deploytk.dll 2008-11-04 17:09 --------- d-----w c:\program files\Java 2008-11-03 21:55 --------- d-----w c:\documents and settings\Marcin\Dane aplikacji\Mikrotik 2008-11-02 22:00 --------- d-----w c:\documents and settings\Marcin\Dane aplikacji\AdobeUM 2008-11-02 16:40 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\OLYMPUS 2008-11-02 16:35 --------- d-----w c:\program files\IrfanView 2008-11-02 13:51 --------- d-----w c:\program files\7-Zip 2008-11-02 12:11 --------- d-----w c:\documents and settings\Marcin\Dane aplikacji\FabrykaGier 2008-11-02 12:08 --------- d-----w c:\program files\Pluszaki Rozrabiaki 2008-11-02 11:38 --------- d-----w c:\program files\Common Files\Ahead 2008-11-02 11:38 --------- d-----w c:\program files\Ahead 2008-11-02 11:32 --------- d-----w c:\program files\Common Files\Adobe 2008-11-02 10:59 --------- d-----w c:\program files\QuickTime 2008-11-02 10:59 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\QuickTime 2008-10-30 12:38 --------- d-----w c:\program files\Nicolas Games 2008-10-30 06:51 --------- d-----w c:\documents and settings\Iva\Dane aplikacji\ATI 2008-10-29 22:03 --------- d-----w c:\program files\ASUS 2008-10-29 22:02 --------- d-----w c:\program files\AMD 2008-10-29 21:54 --------- d-----w c:\program files\Common Files\InstallShield 2008-10-29 21:52 --------- d-----w c:\program files\Realtek Sound Manager 2008-10-29 21:52 --------- d-----w c:\program files\AvRack 2008-10-29 21:01 --------- d-----w c:\program files\Paragon Software 2008-10-29 20:44 --------- d-----w c:\program files\microsoft frontpage 2008-10-29 20:44 --------- d-----w c:\documents and settings\Marcin\Dane aplikacji\Microsoft Web Folders 2008-10-29 19:18 --------- d-----w c:\documents and settings\Marcin\Dane aplikacji\ATI 2008-10-29 19:15 --------- d-----w c:\program files\ATI Technologies 2008-10-29 19:14 --------- d-----w c:\program files\Common Files\ATI Technologies 2008-10-29 19:02 --------- d-----w c:\program files\Usługi online 2008-10-16 13:13 202,776 ----a-w c:\windows\system32\wuweb.dll 2008-10-16 13:13 1,809,944 ----a-w c:\windows\system32\wuaueng.dll 2008-10-16 13:12 561,688 ----a-w c:\windows\system32\wuapi.dll 2008-10-16 13:12 323,608 ----a-w c:\windows\system32\wucltui.dll 2008-10-16 13:09 92,696 ----a-w c:\windows\system32\cdm.dll 2008-10-16 13:09 51,224 ----a-w c:\windows\system32\wuauclt.exe 2008-10-16 13:09 43,544 ----a-w c:\windows\system32\wups2.dll 2008-10-16 13:08 34,328 ----a-w c:\windows\system32\wups.dll . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2004-08-03 15360] "Gadu-Gadu"="c:\program files\Gadu-Gadu\gg.exe" [2008-03-20 2127296] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ATICCC"="c:\program files\ATI Technologies\ATI.ACE\CLIStart.exe" [2006-05-10 90112] "QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2008-11-02 77824] "NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648] "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2008-11-04 136600] "HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2005-05-11 49152] "WinampAgent"="c:\program files\Winamp\winampa.exe" [2008-08-04 36352] "ISTray"="c:\program files\Spyware Doctor\pctsTray.exe" [2008-08-25 1168264] "AVP"="c:\program files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe" [2008-02-08 227856] "SoundMan"="SOUNDMAN.EXE" [2004-06-18 c:\windows\SOUNDMAN.EXE] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-03 15360] c:\documents and settings\All Users\Menu Start\Programy\Autostart\ Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-24 29696] Device Detector 3.lnk - c:\program files\OLYMPUS\DeviceDetector\DevDtct2.exe [2008-11-28 118784] HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2005-05-11 282624] HP Image Zone - szybkie uruchamianie.lnk - c:\program files\HP\Digital Imaging\bin\hpqthb08.exe [2005-05-12 73728] Microsoft Office.lnk - c:\program files\Microsoft Office\Office\OSA9.EXE [1999-02-17 65588] [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"= "c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"= "c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"= "c:\\Documents and Settings\\All Users\\Dane aplikacji\\Kaspersky Lab Setup Files\\Kaspersky Anti-Virus 7.0.1.325\\English\\setup.exe"= "c:\\Program Files\\Kaspersky Lab\\Kaspersky Anti-Virus 7.0\\avp.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "3587:TCP"= 3587:TCP:Grupowanie sieci równorzędnej Windows "3540:UDP"= 3540:UDP:Protokół rozpoznawania nazw równorzędnych (PNRP) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings] "AllowInboundEchoRequest"= 1 (0x1) [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] p2psvc REG_MULTI_SZ p2psvc p2pimsvc p2pgasvc PNRPSvc [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a9cb014f-a5ed-11dd-a30d-806d6172696f}] \Shell\AutoRun\command - Y:\livebox_tp.EXE . Zawartość folderu 'Zaplanowane zadania' 2008-12-11 c:\windows\Tasks\WebReg psc 1500 series.job - c:\program files\HP\Digital Imaging\bin\hpqwrg.exe [2005-05-12 00:21] . . ------- Skan uzupełniający ------- . uStart Page = hxxp://www.google.pl/ uInternet Connection Wizard,ShellNext = iexplore IE: &Winamp Search - c:\documents and settings\All Users\Dane aplikacji\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html c:\windows\system32\SkanerOnlineUninstall.exe - c:\windows\system32\SkanerOnline.dll O16 -: {68282C51-9459-467B-95BF-3C0E89627E55} hxxp://www.mks.com.pl/skaner/SkanerOnline.cab c:\windows\Downloaded Program Files\SkanerOnline.inf . . ------- Skojarzenia plików ------- . . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-12-15 20:38:50 Windows 5.1.2600 Dodatek Service Pack 2 NTFS skanowanie ukrytych procesów ... skanowanie ukrytych wpisów autostartu ... skanowanie ukrytych plików ... skanowanie pomyślnie ukończone ukryte pliki: 0 ************************************************************************** . --------------------- Pliki DLL ładowane pod uruchomionymi procesami --------------------- - - - - - - - > 'winlogon.exe'(1116) c:\program files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\miscr3.dll c:\windows\system32\Ati2evxx.dll c:\windows\system32\klogon.dll - - - - - - - > 'lsass.exe'(1184) c:\program files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\dnsq.dll c:\program files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\miscr3.dll c:\program files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\fssync.dll - - - - - - - > 'explorer.exe'(1672) c:\program files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\miscr3.dll c:\program files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\fssync.dll c:\program files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\scrchpg.dll . ------------------------ Pozostałe uruchomione procesy ------------------------ . c:\windows\system32\ati2evxx.exe c:\windows\system32\ati2evxx.exe c:\program files\Java\jre6\bin\jqs.exe c:\program files\Spyware Doctor\pctsAuxs.exe c:\program files\Spyware Doctor\pctsSvc.exe c:\program files\ATI Technologies\ATI.ACE\CLI.exe c:\windows\system32\tcpsvcs.exe c:\windows\system32\snmp.exe c:\windows\system32\wdfmgr.exe c:\program files\HP\Digital Imaging\bin\hpqimzone.exe c:\program files\HP\Digital Imaging\bin\hpqste08.exe c:\program files\ATI Technologies\ATI.ACE\CLI.exe c:\program files\ATI Technologies\ATI.ACE\CLI.exe c:\windows\system32\wscntfy.exe c:\program files\HP\Digital Imaging\Product Assistant\bin\hprblog.exe . ************************************************************************** . Czas ukończenia: 2008-12-15 20:44:39 - komputer został uruchomiony ponownie [Marcin] ComboFix-quarantined-files.txt 2008-12-15 19:44:24 Przed: 84,336,250,880 bajtów wolnych Po: 85,299,322,880 bajtów wolnych 280 Raport ze skanowania http://www.kaspersky.pl/virusscanner.html » Naciśnij aby pokazać/ukryć tekst oznaczony jako spoiler « - "KASPERSKY Raport" -------------------------------------------------------------------------------- RAPORT KASPERSKY ONLINE SCANNER 7.0 poniedziałek, 15 grudzień 2008 System operacyjny: Microsoft Windows XP Professional Dodatek Service Pack 2 (build 2600) Wersja Kaspersky Online Scanner: 7.0.26.12 Data ostatniej aktualizacji bazy danych: Monday, December 15, 2008 15:04:21 Liczba wpisów: 1462884 -------------------------------------------------------------------------------- Ustawienia skanowania: Typ bazy danych użytej do skanowania: rozszerzona Skanuj archiwa: tak Skanuj pocztowe bazy danych: tak Obszar skanowania - Obszary krytyczne: C:\Documents and Settings\All Users\Menu Start\Programy\Autostart C:\Documents and Settings\Marcin\Menu Start\Programy\Autostart C:\Program Files C:\WINDOWS Statystyki skanowania: Przeskanowanych plików: 31864 Nazwa zagrożenia: 1 Zainfekowanych obiektów: 1 Podejrzanych obiektów: 0 Czas skanowania: 00:29:49 Nazwa pliku / Nazwa zagrożenia / Liczba zagrożeń \Device\Harddisk1\DR1/\Device\Harddisk1\DR1 Zainfekowany: Backdoor.Win32.Sinowal.kv 1 Wybrany obszar został przeskanowany.

Bardzo prosze o sprawdzenie loga z HijackThis. Kaspersky Anty-Virus (niestety mam tylko ver trial) wykrywa trojana: backdoor.win32.sinowal.kv. Nie wiem jak się dziada pozbyć. Bede wdzieczny. » Naciśnij aby pokazać/ukryć tekst oznaczony jako spoiler « - "log" Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 20:51:58, on 2008-12-14 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\tcpsvcs.exe C:\WINDOWS\System32\snmp.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\ATI Technologies\ATI.ACE\CLI.EXE C:\WINDOWS\SOUNDMAN.EXE C:\Program Files\QuickTime\qttask.exe C:\Program Files\Java\jre6\bin\jusched.exe C:\Program Files\HP\HP Software Update\HPWuSchd2.exe C:\Program Files\Winamp\winampa.exe C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Gadu-Gadu\gg.exe C:\Program Files\OLYMPUS\DeviceDetector\DevDtct2.exe C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe C:\Program Files\ATI Technologies\ATI.ACE\cli.exe C:\Program Files\ATI Technologies\ATI.ACE\cli.exe C:\Program Files\HP\Digital Imaging\Product Assistant\bin\hprblog.exe C:\WINDOWS\system32\wuauclt.exe C:\Program Files\Spyware Doctor\pctsAuxs.exe C:\Program Files\Spyware Doctor\pctsSvc.exe C:\Program Files\Spyware Doctor\pctsTray.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\DOCUME~1\Marcin\USTAWI~1\Temp\Rar$EX0c.s30\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.pl/ R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: Winamp Toolbar Loader - {25CEE8EC-5730-41bc-8B58-22DDC8AB8C20} - C:\Program Files\Winamp Toolbar\winamptb.dll O2 - BHO: Java Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll O3 - Toolbar: Winamp Toolbar - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - C:\Program Files\Winamp Toolbar\winamptb.dll O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe" O4 - HKLM\..\Run: [soundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe" O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe" O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe" O4 - HKLM\..\Run: [iSTray] "C:\Program Files\Spyware Doctor\pctsTray.exe" O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O4 - Global Startup: Device Detector 3.lnk = C:\Program Files\OLYMPUS\DeviceDetector\DevDtct2.exe O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe O4 - Global Startup: HP Image Zone - szybkie uruchamianie.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE O8 - Extra context menu item: &Winamp Search - C:\Documents and Settings\All Users\Dane aplikacji\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html O9 - Extra button: Web Anti-Virus statistics - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\SCIEPlgn.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {68282C51-9459-467B-95BF-3C0E89627E55} (MksSkanerOnline Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: Kaspersky Anti-Virus 7.0 (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe -- End of file - 6072 bytes