Problem/błąd I Brak Pliku Idlist

[garbusik88]

Witam proszę o POMOC gdyż włączyłem dziś po południu komputer i gdy sie uruchamia widać tylko tapetę i wyskakuje komunikat o błędzie ze nie może znaleźć plik idlist i co chwilka zanika mi pulpit i powraca

ale gdy klikam na jakiś FOLDER cokolwiek mój komputer , moje dokumenty ITP

to sie wyłącza ten folder i znika cały obraz prócz TAPETY

POMOCY

co mogę z tym zrobić

Nie działa przywracanie systemu !!!

[Kolobos]

Daj moze log z hijackthis oraz combofix.

[garbusik88]

Logfile of HijackThis v1.99.1

Scan saved at 12:01:01, on 2008-06-12

Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

 

Running processes:

C:\windows\System32\smss.exe

C:\windows\system32\winlogon.exe

C:\windows\system32\services.exe

C:\windows\system32\lsass.exe

C:\windows\system32\svchost.exe

C:\windows\System32\svchost.exe

C:\windows\system32\svchost.exe

C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe

C:\Program Files\Alwil Software\Avast4\ashServ.exe

C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe

C:\windows\system32\spoolsv.exe

C:\Program Files\Gadu\gg.exe

C:\Documents and Settings\ja\Ustawienia lokalne\Dane aplikacji\Google\Update\1.1.25.0\GoogleUpdate.exe

C:\Program Files\Multimedia Keyboard Driver\PS2USBKbdDrv.exe

C:\Program Files\Office Mouse Driver\MouseDrv.exe

C:\Documents and Settings\ja\Ustawienia lokalne\Dane aplikacji\YouTube\Uploader\youtubeuploader.exe

C:\windows\system32\nvsvc32.exe

C:\windows\system32\PnkBstrA.exe

C:\windows\system32\PnkBstrB.exe

C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe

C:\Program Files\Alwil Software\Avast4\ashWebSv.exe

C:\WINDOWS\system32\imapi.exe

C:\windows\system32\wuauclt.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\windows\system32\svchost.exe

C:\Program Files\WinRAR\WinRAR.exe

C:\DOCUME~1\ja\USTAWI~1\Temp\Rar$EX00.281\HijackThis.exe

C:\windows\explorer.exe

 

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://search.bearshare.com/sidebar.html?src=ssb

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.entretieneteds.vze.com/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.yahoo.com/

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza

R3 - URLSearchHook: (no name) - {1BB22D38-A411-4B13-A746-C2A4F4EC7344} - (no file)

O3 - Toolbar: &Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_6_0_1.dll

O3 - Toolbar: My Global Search Bar - {37B85A29-692B-4205-9CAD-2626E4993404} - C:\Program Files\MyGlobalSearch\bar\1.bin\MGSBAR.DLL

O3 - Toolbar: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL

O4 - HKLM\..\Run: [iSUSPM Startup] "C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -startup

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit

O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"

O4 - HKLM\..\Run: [WireLessKeyboard] C:\Program Files\Multimedia Keyboard Driver\StartAutorun.exe PS2USBKbdDrv.exe

O4 - HKLM\..\Run: [WireLessMouse] C:\Program Files\Office Mouse Driver\StartAutorun.exe MouseDrv.exe

O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k

O4 - HKLM\..\Run: [advap32] C:\DOCUME~1\ja\USTAWI~1\Temp\srvprint.exe/r

O4 - HKLM\..\Run: [LXCCCATS] rundll32 C:\windows\system32\spool\DRIVERS\W32X86\3\LXCCtime.dll,_RunDLLEntry@16

O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu\gg.exe" /tray

O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\ja\Ustawienia lokalne\Dane aplikacji\Google\Update\1.1.25.0\GoogleUpdate.exe" /lang en

O4 - HKCU\..\Run: [NBJ] "C:\Program Files\Ahead\Nero BackItUp\NBJ.exe"

O4 - HKCU\..\Run: [ctfmon.exe] C:\windows\system32\ctfmon.exe

O4 - Startup: PowerReg Scheduler V3.exe

O4 - Startup: YouTube Uploader.lnk = C:\Documents and Settings\ja\Ustawienia lokalne\Dane aplikacji\YouTube\Uploader\youtubeuploader.exe

O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe

O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O8 - Extra context menu item: &D&ownload &with BitComet - res://G:\BitComet\BitComet.exe/AddLink.htm

O8 - Extra context menu item: &D&ownload all video with BitComet - res://G:\BitComet\BitComet.exe/AddVideo.htm

O8 - Extra context menu item: &D&ownload all with BitComet - res://G:\BitComet\BitComet.exe/AddAllLink.htm

O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000

O8 - Extra context menu item: E&ksportuj do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll

O9 - Extra button: Wyślij do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll

O9 - Extra 'Tools' menuitem: Wyślij &do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll

O9 - Extra button: BitComet Search - {461CC20B-FB6E-4f16-8FE8-C29359DB100E} - G:\BitComet\tools\BitCometBHO_1.1.7.4.dll

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll

O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL

O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll

O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL

O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL

O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\windows\system32\WPDShServiceObj.dll

O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe

O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe

O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)

O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe

O23 - Service: lxcc_device - Lexmark International, Inc. - C:\WINDOWS\system32\lxcccoms.exe

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\windows\system32\nvsvc32.exe

O23 - Service: PnkBstrA - Unknown owner - C:\windows\system32\PnkBstrA.exe

O23 - Service: PnkBstrB - Unknown owner - C:\windows\system32\PnkBstrB.exe

[Kolobos]

Chyba wyraznie napisalem hijackthis ORAZ COMBOFIX!

Edytowane 12 Czerwca 2008 przez Kolobos

[garbusik88]

Chyba wyraznie napisalem hijackthis ORAZ COMBOFIX!

Bez takich tu !!! UMIEM CZYTAC

 

ComboFix 08-06-11.3 - ja 2008-06-13 13:53:55.1 - NTFSx86

Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.610 [GMT 2:00]

Running from: D:\ComboFix.exe

* Created a new restore point

 

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

.

 

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

 

C:\Autorun.inf

C:\Program Files\inetget2

C:\Program Files\myglobalsearch

C:\Program Files\myglobalsearch\bar\1.bin\M9FFXTBR.JAR

C:\Program Files\myglobalsearch\bar\1.bin\M9FFXTBR.MANIFEST

C:\Program Files\myglobalsearch\bar\1.bin\M9NTSTBR.JAR

C:\Program Files\myglobalsearch\bar\1.bin\M9NTSTBR.MANIFEST

C:\Program Files\myglobalsearch\bar\1.bin\MGSBAR.DLL

C:\Program Files\myglobalsearch\bar\Cache\0023CD58

C:\Program Files\myglobalsearch\bar\Cache\00397ECF.bin

C:\Program Files\myglobalsearch\bar\Cache\003981FC.bin

C:\Program Files\myglobalsearch\bar\Cache\00398F4A.bin

C:\Program Files\myglobalsearch\bar\Cache\00D08F5B

C:\Program Files\myglobalsearch\bar\Cache\files.ini

C:\Program Files\myglobalsearch\bar\History\search

C:\Program Files\myglobalsearch\bar\Settings\prevcfg.htm

C:\Program Files\webhancer

C:\Program Files\webhancer\Programs\sporder.dll

C:\Program Files\XP Antivirus

C:\windows\Fonts\CALIBRIB.TTF

C:\windows\system32\hgGvvttQ.dll

C:\windows\system32\hgGyvvvT.dll

C:\windows\system32\hgGyyvwt.dll

C:\windows\system32\MSINET.oca

C:\WINDOWS\system32\QttvvGgh.ini

C:\WINDOWS\system32\QttvvGgh.ini2

C:\windows\system32\tmp18.tmp

C:\windows\system32\tmp19.tmp

D:\Autorun.inf

E:\Autorun.inf

F:\Autorun.inf

G:\Autorun.inf

J:\Autorun.inf

K:\Autorun.inf

 

.

((((((((((((((((((((((((( Files Created from 2008-05-13 to 2008-06-13 )))))))))))))))))))))))))))))))

.

 

2008-06-11 18:34 . 2008-06-11 18:34 <DIR> d-------- C:\Program Files\ToniArts

2008-06-11 15:33 . 2008-06-11 15:33 <DIR> d-------- C:\vcs5BGEffects

2008-06-11 12:52 . 2008-06-11 13:17 0 --a------ C:\WINDOWS\system32\ieupdates.exe.tmp

2008-06-11 12:51 . 2008-06-11 07:16 180,224 --a------ C:\WINDOWS\xkefqtgs.dll

2008-06-11 12:51 . 2008-06-11 07:16 81,920 --a------ C:\WINDOWS\pebgkxwq.exe

2008-06-11 08:56 . 2008-04-14 17:53 273,024 --------- C:\WINDOWS\system32\drivers\bthport.sys

2008-06-11 08:56 . 2008-04-14 17:53 273,024 -----c--- C:\WINDOWS\system32\dllcache\bthport.sys

2008-06-09 22:14 . 2008-06-09 22:14 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Cabela's African Safari Saves

2008-06-09 21:44 . 2008-06-09 21:44 203,305 ---h----- C:\treeinfo.wc

2008-06-09 21:43 . 2008-06-09 21:43 <DIR> d-------- C:\Program Files\totalcmd

2008-06-09 21:43 . 2008-06-09 21:46 579 --a------ C:\WINDOWS\wincmd.ini

2008-06-09 21:43 . 2008-04-22 07:03 545 --a------ C:\WINDOWS\UC.PIF

2008-06-09 21:43 . 2008-04-22 07:03 545 --a------ C:\WINDOWS\RAR.PIF

2008-06-09 21:43 . 2008-04-22 07:03 545 --a------ C:\WINDOWS\PKZIP.PIF

2008-06-09 21:43 . 2008-04-22 07:03 545 --a------ C:\WINDOWS\PKUNZIP.PIF

2008-06-09 21:43 . 2008-04-22 07:03 545 --a------ C:\WINDOWS\NOCLOSE.PIF

2008-06-09 21:43 . 2008-04-22 07:03 545 --a------ C:\WINDOWS\LHA.PIF

2008-06-09 21:43 . 2008-04-22 07:03 545 --a------ C:\WINDOWS\ARJ.PIF

2008-06-09 18:41 . 2008-06-09 18:41 139,264 --a------ C:\WINDOWS\~GLC0002.TMP

2008-06-09 18:41 . 2008-06-09 18:41 27,136 --a------ C:\WINDOWS\~GLH0004.TMP

2008-06-09 18:41 . 2008-06-09 18:41 5,607 --a------ C:\WINDOWS\~GLH0005.TMP

2008-06-09 18:37 . 2008-06-09 18:37 139,264 --a------ C:\WINDOWS\~GLC0000.TMP

2008-06-09 18:37 . 2008-06-09 18:37 27,136 --a------ C:\WINDOWS\~GLH0000.TMP

2008-06-09 18:37 . 2008-06-09 18:38 5,607 --a------ C:\WINDOWS\~GLH0001.TMP

2008-06-08 13:21 . 2008-06-08 13:22 <DIR> d-------- C:\Documents and Settings\ja\Dane aplikacji\FarmingSimulator2008

2008-06-02 17:32 . 2008-06-02 17:32 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Ubisoft

2008-05-31 21:02 . 2008-05-31 21:02 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Codemasters

2008-05-31 20:05 . 2008-03-05 15:56 3,786,760 --a------ C:\WINDOWS\system32\D3DX9_37.dll

2008-05-31 20:05 . 2008-03-05 15:56 1,420,824 --a------ C:\WINDOWS\system32\D3DCompiler_37.dll

2008-05-31 20:05 . 2008-04-28 15:53 805,400 -ra------ C:\WINDOWS\system32\tmp229.tmp

2008-05-31 20:05 . 2008-04-28 15:53 805,400 -ra------ C:\WINDOWS\system32\tmp228.tmp

2008-05-31 20:05 . 2008-03-05 16:03 479,752 --a------ C:\WINDOWS\system32\XAudio2_0.dll

2008-05-31 20:05 . 2008-02-05 23:07 462,864 --a------ C:\WINDOWS\system32\d3dx10_37.dll

2008-05-31 20:05 . 2008-03-05 16:03 238,088 --a------ C:\WINDOWS\system32\xactengine3_0.dll

2008-05-31 20:05 . 2008-03-05 16:00 25,608 --a------ C:\WINDOWS\system32\X3DAudio1_3.dll

2008-05-13 12:20 . 2008-05-13 12:20 <DIR> d-------- C:\WINDOWS\system32\xlive

2008-05-13 12:18 . 2008-05-31 20:05 <DIR> d-------- C:\Program Files\OpenAL

2008-05-13 12:18 . 2008-05-31 20:05 444,952 --a------ C:\WINDOWS\system32\wrap_oal.dll

2008-05-13 12:18 . 2008-05-31 20:05 109,080 --a------ C:\WINDOWS\system32\OpenAL32.dll

2008-05-13 11:14 . 2008-05-13 11:14 <DIR> d-------- C:\Documents and Settings\ja\DoctorWeb

2008-05-13 08:39 . 2008-05-13 08:39 94 ---h----- C:\WINDOWS\system32\spv1_WCssg.ini

 

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2008-06-12 17:59 --------- d-----w C:\Documents and Settings\ja\Dane aplikacji\MegauploadToolbar

2008-06-12 17:58 --------- d-----w C:\Program Files\DC++

2008-06-12 11:20 --------- d-----w C:\Program Files\Lx_cats

2008-06-11 16:58 --------- d-----w C:\Program Files\Common Files\Sandlot Shared

2008-06-11 16:34 --------- d--h--w C:\Program Files\InstallShield Installation Information

2008-06-08 11:21 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard

2008-06-08 11:20 --------- d-----w C:\Program Files\AGEIA Technologies

2008-06-02 15:32 22,328 -c--a-w C:\windows\system32\drivers\PnkBstrK.sys

2008-06-02 15:32 22,328 -c--a-w C:\Documents and Settings\ja\Dane aplikacji\PnkBstrK.sys

2008-06-02 15:32 107,832 -c--a-w C:\windows\system32\PnkBstrB.exe

2008-06-02 15:31 66,872 ----a-w C:\windows\system32\PnkBstrA.exe

2008-06-02 15:31 2,337,865 -c--a-w C:\windows\system32\pbsvc.exe

2008-06-02 10:35 --------- d-----w C:\Documents and Settings\ja\Dane aplikacji\Skype

2008-05-31 19:01 107,888 ----a-w C:\windows\system32\CmdLineExt.dll

2008-05-30 18:19 --------- d-----w C:\Documents and Settings\ja\Dane aplikacji\SpieleEntwicklungsKombinat

2008-05-23 16:30 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Test Drive Unlimited

2008-05-13 08:59 2,864 -c--a-w C:\windows\system32\winsock.dll

2008-05-12 12:13 --------- d-----w C:\Documents and Settings\ja\Dane aplikacji\Wildfire

2008-05-10 18:29 --------- d-----w C:\Documents and Settings\ja\Dane aplikacji\funkitron

2008-05-10 10:40 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Oberon Media

2008-05-10 09:53 --------- d-----w C:\Program Files\RegCleaner

2008-05-09 14:13 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Sandlot Games

2008-05-08 12:28 202,752 ----a-w C:\windows\system32\drivers\rmcast.sys

2008-05-08 12:26 --------- d-----w C:\Documents and Settings\ja\Dane aplikacji\Hamachi

2008-05-07 05:16 1,291,264 ----a-w C:\windows\system32\quartz.dll

2008-05-06 16:58 --------- d--h--w C:\Program Files\Zero G Registry

2008-05-02 15:17 43,520 -c--a-w C:\windows\system32\CmdLineExt03.dll

2008-04-21 07:03 662,016 ----a-w C:\windows\system32\wininet.dll

2008-04-18 17:41 106,496 -c--a-w C:\windows\DUMP449a.tmp

2008-04-18 14:33 106,496 -c--a-w C:\windows\DUMP45c3.tmp

2008-04-17 19:28 --------- d-----w C:\Documents and Settings\ja\Dane aplikacji\FaxCtr

2008-03-25 04:52 621,344 -c--a-w C:\windows\system32\mswstr10.dll

2008-03-25 04:52 178,976 -c--a-w C:\windows\system32\msjint40.dll

2008-03-20 08:09 1,845,504 ----a-w C:\windows\system32\win32k.sys

2007-08-27 19:05 23,528 -c--a-w C:\Documents and Settings\ja\Dane aplikacji\GDIPFONTCACHEV1.DAT

2005-07-14 10:31 27,648 -csha-r C:\windows\system32\AVSredirect.dll

2005-06-26 13:32 616,448 -csha-r C:\windows\system32\cygwin1.dll

2005-06-21 20:37 45,568 -csha-r C:\windows\system32\cygz.dll

2005-09-10 20:28 573,430 -csha-r C:\windows\system32\smab.dll

2005-02-28 11:16 240,128 -csha-r C:\windows\system32\x.264.exe

.

 

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

 

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Gadu-Gadu"="C:\Program Files\Gadu\gg.exe" [2007-11-14 12:54 2131392]

"Google Update"="C:\Documents and Settings\ja\Ustawienia lokalne\Dane aplikacji\Google\Update\1.1.25.0\GoogleUpdate.exe" [2008-03-18 20:51 51184]

"NBJ"="C:\Program Files\Ahead\Nero BackItUp\NBJ.exe" [2005-10-11 18:25 1961984]

"ctfmon.exe"="C:\windows\system32\ctfmon.exe" [2004-08-04 00:44 15360]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"ISUSPM Startup"="C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" [2005-08-11 16:30 249856]

"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2006-10-22 12:22 86016]

"GrooveMonitor"="C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-27 00:47 31016]

"WireLessKeyboard"="C:\Program Files\Multimedia Keyboard Driver\StartAutorun.exe" [2005-11-30 13:48 94208]

"WireLessMouse"="C:\Program Files\Office Mouse Driver\StartAutorun.exe" [2005-11-30 13:48 94208]

"LXCCCATS"="C:\windows\System32\spool\DRIVERS\W32X86\3\LXCCtime.dll" [2005-07-20 15:44 73728]

"NvCplDaemon"="C:\windows\system32\NvCpl.dll" [2006-10-22 12:22 7700480]

 

C:\Documents and Settings\ja\Menu Start\Programy\Autostart\

PowerReg Scheduler V3.exe [2007-05-01 09:44:22 225280]

YouTube Uploader.lnk - C:\Documents and Settings\ja\Ustawienia lokalne\Dane aplikacji\YouTube\Uploader\youtubeuploader.exe [2007-11-09 14:33:08 71152]

 

C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\

Adobe Gamma Loader.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2008-03-22 18:40:58 113664]

 

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"SynchronousMachineGroupPolicy"= 0 (0x0)

"SynchronousUserGroupPolicy"= 0 (0x0)

 

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]

"NoStrCmpLogical"= 1 (0x1)

 

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]

"NoSMBalloonTip"= 1 (0x1)

"MemCheckBoxInRunDlg"= 0 (0x0)

"NoAutoTrayNotify"= 0 (0x0)

"NoResolveTrack"= 0 (0x0)

"NoResolveSearch"= 1 (0x1)

"NoWelcomeScreen"= 1 (0x1)

"NoRecentDocsNetHood"= 1 (0x1)

"NoDesktopCleanupWizard"= 1 (0x1)

 

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]

"vidc.I420"= i263_32.drv

"vidc.iv41"= ir41_32.dll

 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\InCD]

C:\Program Files\Ahead\InCD\InCD.exe

 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LGODDFU]

--a--c--- 2006-02-20 11:40 245760 C:\Program Files\lg_fwupdate\fwupdate.exe

 

[HKEY_LOCAL_MACHINE\software\microsoft\security center]

"AntiVirusDisableNotify"=dword:00000001

"UpdatesDisableNotify"=dword:00000001

 

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"C:\\Program Files\\DC++\\DCPlusPlus.exe"=

"C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=

"C:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=

"C:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=

"C:\\Program Files\\Gadu\\gg.exe"=

"G:\\moje\\bearshare\\BearShare.exe"=

"C:\\WINDOWS\\system32\\PnkBstrA.exe"=

"C:\\WINDOWS\\system32\\PnkBstrB.exe"=

"G:\\BitComet\\BitComet.exe"=

"F:\\gry\\Test Drive Unlimited\\TestDriveUnlimited.exe"=

"F:\\Valve\\hl.exe"=

"F:\\Valve\\hlds.exe"=

"F:\\gry\\tony\\Game\\THAW.exe"=

"F:\\gry\\Stronghold Legends RipForGames\\Stronghold Legends RipForGames\\RFG_SELE\\StrongholdLegends.exe"=

"F:\\gry\\GriD\\GRID.exe"=

"C:\\Program Files\\Skype\\Phone\\Skype.exe"=

 

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]

"27253:TCP"= 27253:TCP:BitComet 27253 TCP

"27253:UDP"= 27253:UDP:BitComet 27253 UDP

"8462:TCP"= 8462:TCP:GoD Low Port

"8462:UDP"= 8462:UDP:BitComet 8462 UDP

"20153:TCP"= 20153:TCP:BitComet 20153 TCP

"20153:UDP"= 20153:UDP:BitComet 20153 UDP

"8033:TCP"= 8033:TCP:BitComet 8033 TCP

"8033:UDP"= 8033:UDP:BitComet 8033 UDP

"8461:TCP"= 8461:TCP:GoD High Port

 

R0 axwhisky;axwhisky;C:\windows\system32\DRIVERS\axwhisky.sys [2003-07-02 17:41]

R0 axwskbus;axwskbus;C:\windows\system32\DRIVERS\axwskbus.sys [2003-07-02 16:49]

R1 aswSP;avast! Self Protection;C:\windows\system32\drivers\aswSP.sys [2008-05-16 01:20]

R2 aswFsBlk;aswFsBlk;C:\windows\system32\DRIVERS\aswFsBlk.sys [2008-05-16 01:16]

R3 SCREAMINGBDRIVER;Screaming Bee Audio;C:\windows\system32\drivers\ScreamingBAudio.sys [2006-09-26 23:21]

S3 ADM8511;Konwerter z USB na Fast Ethernet ADMtek ADM8511/AN986;C:\windows\system32\DRIVERS\ADM8511.SYS [2001-08-17 20:11]

S3 ASPI;Advanced SCSI Programming Interface Driver;C:\windows\System32\DRIVERS\ASPI32.sys [2002-07-17 09:05]

S3 ewdmaudn;ewdmaudn;C:\DOCUME~1\ja\USTAWI~1\Temp\ewdmaudn.sys []

S3 Smport;Smport;C:\WINDOWS\system32\Smport.sys [2007-08-10 18:58]

S3 UsbSagCom;Mobile Device Full USB Driver;C:\windows\system32\DRIVERS\UsbSagCom.sys [2007-06-29 15:20]

S3 usbscan;Sterownik skanera USB;C:\windows\system32\DRIVERS\usbscan.sys [2004-08-03 22:58]

S3 USBSTOR;Sterownik magazynu masowego USB;C:\windows\system32\DRIVERS\USBSTOR.SYS [2004-08-03 23:08]

S3 Vl813;USB FORCE RACER;C:\windows\system32\DRIVERS\Vl813.sys [2005-08-20 17:30]

 

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{8f61fc54-fa45-11db-95c9-0016e65d986b}]

\Shell\AutoRun\command - jfvkcsy.bat

\Shell\explore\Command - jfvkcsy.bat

\Shell\open\Command - jfvkcsy.bat

 

.

Contents of the 'Scheduled Tasks' folder

"2008-06-11 10:38:04 C:\windows\Tasks\AppleSoftwareUpdate.job"

- C:\Program Files\Apple Software Update\SoftwareUpdate.exe

.

**************************************************************************

 

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2008-06-13 13:57:12

Windows 5.1.2600 Dodatek Service Pack 2 NTFS

 

scanning hidden processes ...

 

scanning hidden autostart entries ...

 

scanning hidden files ...

 

scan completed successfully

hidden files: 0

 

**************************************************************************

.

------------------------ Other Running Processes ------------------------

.

C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe

C:\Program Files\Alwil Software\Avast4\ashServ.exe

C:\Program Files\Multimedia Keyboard Driver\PS2USBKbdDrv.exe

C:\Program Files\Office Mouse Driver\MouseDrv.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\WINDOWS\system32\PnkBstrA.exe

C:\WINDOWS\system32\PnkBstrB.exe

C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe

C:\Program Files\Alwil Software\Avast4\ashWebSv.exe

.

**************************************************************************

.

Completion time: 2008-06-13 13:58:43 - machine was rebooted

ComboFix-quarantined-files.txt 2008-06-13 11:58:40

 

Pre-Run: 8,536,772,608 bajtów wolnych

Post-Run: 8,692,854,784 bajt˘w wolnych

 

256 --- E O F --- 2008-06-11 07:44:47

[Kolobos]

> Bez takich tu !!! UMIEM CZYTAC

 

Skoro tak twierdzisz..

 

 

Usun z autostartu:

PowerReg Scheduler V3

 

Uzyj Flash Disinfector.

 

Utworz na pulpicie plik CFScript.txt i wklej do niego:

 

Driver::

ewdmaudn

 

File::

C:\WINDOWS\system32\ieupdates.exe.tmp

C:\WINDOWS\xkefqtgs.dll

C:\WINDOWS\pebgkxwq.exe

C:\WINDOWS\~GLC0002.TMP

C:\WINDOWS\~GLH0004.TMP

C:\WINDOWS\~GLH0005.TMP

C:\WINDOWS\~GLC0000.TMP

C:\WINDOWS\~GLH0000.TMP

C:\WINDOWS\~GLH0001.TMP

C:\WINDOWS\system32\tmp229.tmp

C:\WINDOWS\system32\tmp228.tmp

C:\windows\DUMP449a.tmp

C:\windows\DUMP45c3.tmp

C:\windows\system32\smab.dll

 

Registry::

[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{8f61fc54-fa45-11db-95c9-0016e65d986b}]

 

Zapisz i przeciagnij na ikone combofix.

[garbusik88]

Ok dzięki , już to zrobiłem przed chwilką

[nikos777]

witam, przepraszam ze odswiezam ten temat ale mam podobny problem czy moglby mi ktos pomoc?