Pliku autorun.inf nie znalazłem wg opisu ze strony http://www.troublefixers.com/not-able-to-open-drives-on-hard-disk-by-double-click/. Combo-Fix nie pomógł. poniżej zamieszczam log. ComboFix 08-03-18.1 - kurkoto 2008-03-20 15:13:43.1 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.486 [GMT 1:00] Running from: C:\Documents and Settings\kurkoto\Pulpit\Combo-Fix.exe * Created a new restore point [color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color] . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\Documents and Settings\All Users\Dane aplikacji\Microsoft\Network\Downloader\qmgr0.dat C:\Documents and Settings\All Users\Dane aplikacji\Microsoft\Network\Downloader\qmgr1.dat ----- BITS: Possible infected sites ----- hxxp://tnt2 . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Legacy_NPF ((((((((((((((((((((((((( Files Created from 2008-02-20 to 2008-03-20 ))))))))))))))))))))))))))))))) . 2008-03-20 11:48 . 2008-03-20 11:49 d-------- C:\Program Files\MagicDisc 2008-03-20 11:48 . 2008-02-18 17:29 96,256 --a------ C:\WINDOWS\system32\drivers\mcdbus.sys 2008-03-18 08:18 . 2008-03-18 15:15 d-------- C:\Program Files\Mozilla Sunbird 2008-03-17 13:31 . 2008-03-17 13:31 d-------- C:\Program Files\MSBuild 2008-03-17 13:29 . 2008-03-17 13:29 d-------- C:\WINDOWS\system32\XPSViewer 2008-03-17 13:28 . 2008-03-17 13:28 d-------- C:\Program Files\Reference Assemblies 2008-03-17 11:13 . 2008-03-17 11:13 108,144 --a------ C:\WINDOWS\system32\CmdLineExt.dll 2008-03-11 14:10 . 2008-03-20 12:51 d-------- C:\Program Files\Mozilla Thunderbird 2008-03-11 14:10 . 2008-03-11 14:10 d-------- C:\Documents and Settings\kurkoto\Dane aplikacji\Thunderbird 2008-03-10 15:19 . 2008-03-10 15:19 d-------- C:\Documents and Settings\kurkoto\Dane aplikacji\Gadu-Gadu 2008-03-10 15:12 . 2008-03-10 15:12 d-------- C:\Program Files\Gadu-Gadu 2008-03-10 15:12 . 2008-03-10 15:23 d-------- C:\Documents and Settings\kurkoto\Gadu-Gadu 2008-03-03 14:08 . 2008-03-03 14:08 d-------- C:\Documents and Settings\kurkoto\Dane aplikacji\Ethereal 2008-03-03 14:06 . 2008-03-03 14:06 d-------- C:\Program Files\Ethereal 2008-02-25 16:49 . 2008-02-25 16:49 d-------- C:\Program Files\RJL Software, Inc 2008-02-25 15:20 . 2006-06-29 13:07 14,048 --------- C:\WINDOWS\system32\spmsg2.dll 2008-02-23 19:28 . 2008-02-23 19:28 d-------- C:\Program Files\mac 2008-02-23 19:28 . 2008-02-23 19:28 249,856 --------- C:\WINDOWS\Setup1.exe 2008-02-23 19:28 . 2008-02-23 19:28 73,216 --a------ C:\WINDOWS\ST6UNST.EXE 2008-02-22 08:40 . 2008-02-22 08:40 d-------- C:\Program Files\OpenOffice.org 2.3 . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-03-20 13:56 --------- d-----w C:\Program Files\FlashGet 2008-03-20 13:41 --------- d-----w C:\Documents and Settings\kurkoto\Dane aplikacji\OpenOffice.org2 2008-03-12 07:55 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Microsoft Help 2008-03-10 07:44 --------- d-----w C:\Program Files\Java 2008-03-03 17:04 --------- d-----w C:\Program Files\TightVNC 2008-02-28 08:30 --------- d-----w C:\Program Files\Winamp 2008-02-22 07:40 --------- d-----w C:\Program Files\OpenOffice.org 2.2 2008-02-18 08:58 --------- d-----w C:\Documents and Settings\kurkoto\Dane aplikacji\Talkback 2008-02-16 20:13 --------- d-----w C:\Documents and Settings\kurkoto\Dane aplikacji\Winamp 2008-02-15 07:37 --------- d-----w C:\Program Files\Common Files\Adobe 2008-02-10 16:14 --------- d-----w C:\Program Files\Yahoo! 2008-02-08 07:28 --------- d-----w C:\Program Files\Eset 2008-01-20 16:31 --------- d-----w C:\Program Files\Common Files\InstallShield 2008-01-11 16:38 315,392 ----a-w C:\WINDOWS\HideWin.exe 2008-01-11 16:35 9,715,200 ----a-w C:\WINDOWS\RTLCPL.exe 2008-01-11 16:35 86,016 ----a-w C:\WINDOWS\SoundMan.exe 2008-01-11 16:35 69,632 ----a-w C:\WINDOWS\Alcmtr.exe 2008-01-11 16:35 2,808,832 ----a-w C:\WINDOWS\alcwzrd.exe 2008-01-11 16:35 2,165,760 ----a-w C:\WINDOWS\MicCal.exe 2008-01-11 16:35 16,841,216 ----a-w C:\WINDOWS\RTHDCPL.exe 2008-01-11 16:35 1,826,816 ----a-w C:\WINDOWS\SkyTel.exe 2008-01-11 16:35 1,191,936 ----a-w C:\WINDOWS\RtlUpd.exe 2008-01-11 16:34 520,192 ----a-w C:\WINDOWS\RtlExUpd.dll 2008-01-11 15:09 21,361 ----a-w C:\WINDOWS\AegisP.sys . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2006-03-02 12:00 15360] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Cpqset"="C:\Program Files\Hewlett-Packard\Default Settings\cpqset.exe" [2007-01-02 15:46 40960] "hpWirelessAssistant"="C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe" [2007-01-10 15:13 472776] "HP Software Update"="c:\Program Files\Hp\HP Software Update\HPWuSchd2.exe" [2005-02-16 23:11 49152] "PTHOSTTR"="c:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\PTHOSTTR.exe" [2007-01-09 15:52 145184] "QlbCtrl"="C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2007-11-06 16:34 177456] "IgfxTray"="C:\WINDOWS\system32\igfxtray.exe" [2007-05-18 21:50 138008] "HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe" [2007-05-18 21:50 162584] "Persistence"="C:\WINDOWS\system32\igfxpers.exe" [2007-05-18 21:50 138008] "SynTPStart"="C:\Program Files\Synaptics\SynTP\SynTPStart.exe" [2007-09-14 19:29 102400] "IntelZeroConfig"="C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe" [2007-10-08 14:18 995328] "IntelWireless"="C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" [2007-10-08 14:13 1101824] "SoundMAXPnP"="C:\Program Files\Analog Devices\Core\smax4pnp.exe" [2007-01-05 17:36 872448] "SoundMAX"="C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" [2006-07-13 08:12 729088] "nod32kui"="C:\Program Files\Eset\nod32kui.exe" [2008-01-14 12:13 949376] "IFXSPMGT"="c:\WINDOWS\system32\ifxspmgt.exe" [2007-02-15 13:00 677408] "Synchronization Manager"="C:\WINDOWS\system32\mobsync.exe" [2006-03-02 12:00 143872] "OrderReminder"="C:\Program Files\Hewlett-Packard\OrderReminder\OrderReminder.exe" [2005-03-18 12:18 98304] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 04:25 144784] "Flashget"="C:\Program Files\FlashGet\flashget.exe" [2007-09-25 09:10 2007088] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2006-03-02 12:00 15360] C:\Documents and Settings\kurkoto\Menu Start\Programy\AutostartMagicDisc.lnk - C:\Program Files\MagicDisc\MagicDisc.exe [2008-03-20 11:48:56 546816] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] "DisablePersonalDirChange"= 1 (0x1) [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ackpbsc] c:\WINDOWS\system32\ackpbsc.dll 2007-05-03 18:51 112640 c:\WINDOWS\system32\ackpbsc.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\acunlock] c:\Program Files\ActivIdentity\ActivClient\acunlock.dll 2007-05-03 18:51 281088 c:\Program Files\ActivIdentity\ActivClient\acunlock.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\DeviceNP] DeviceNP.dll 2007-03-30 09:50 49152 C:\WINDOWS\system32\DeviceNP.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-3393501316-112053460-370188358-1289\Scripts\Logon\[u]0[/u]\[u]0[/u]] "Script"=\\tnt2\skrypty$\BgInfo\bginfo.bat [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\accrdsub] --------- 2007-05-03 18:51 293168 c:\Program Files\ActivIdentity\ActivClient\accrdsub.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher] --a------ 2007-05-11 13:06 40048 C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AT&T Communication Manager] --------- 2007-05-26 12:38 22528 c:\Program Files\AT&T\Communication Manager\ATTCM.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Flashget] --a------ 2007-09-25 09:10 2007088 C:\Program Files\FlashGet\FlashGet.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS] ---hs---- 2004-10-13 17:24 1694208 C:\Program Files\Messenger\msmsgs.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent] --a------ 2008-01-15 23:54 37376 C:\Program Files\Winamp\winampa.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinVNC] --a------ 2007-05-07 19:28 589824 C:\Program Files\TightVNC\WinVNC.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services] "WMPNetworkSvc"=3 (0x3) "winvnc"=2 (0x2) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "C:\\Program Files\\FlashGet\\flashget.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009 R1 PersonalSecureDrive;PersonalSecureDrive;C:\WINDOWS\system32\drivers\psd.sys [2007-01-23 20:07] R2 accoca;ActivClient Middleware Service;"c:\Program Files\ActivIdentity\ActivClient\accoca.exe" [2007-05-03 18:51] R3 IFXTPM;IFXTPM;C:\WINDOWS\system32\DRIVERS\IFXTPM.SYS [2007-01-23 19:13] S3 DAMDrv;DAMDrv;C:\WINDOWS\system32\DRIVERS\DAMDrv.sys [2007-03-30 10:12] S3 FLCDLOCK;HP ProtectTools Device Locking / Auditing;C:\WINDOWS\system32\flcdlock.exe [2007-03-30 09:55] S3 HP24X;HP PC Card Smart Card Reader;C:\WINDOWS\system32\DRIVERS\HP24X.sys [2007-07-17 01:24] S3 usbstor;Sterownik magazynu masowego USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2006-03-02 12:00] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{4cfd25a2-f40b-11dc-9429-001a4b74ca85}] \Shell\AutoRun\command - F:\autorun.exe [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}] "C:\Program Files\Common Files\LightScribe\LSRunOnce.exe" . ************************************************************************** catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-03-20 15:18:26 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... HKLM\Software\Microsoft\Windows\CurrentVersion\Run Cpqset = C:\Program Files\Hewlett-Packard\Default Settings\cpqset.exe??????????????@? ????K????????@???????@ scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . --------------------- DLLs Loaded Under Running Processes --------------------- PROCESS: C:\WINDOWS\system32\winlogon.exe -> C:\Program Files\Eset\pr_imon.dll PROCESS: C:\WINDOWS\system32\lsass.exe -> C:\Program Files\Eset\pr_imon.dll . ------------------------ Other Running Processes ------------------------ . C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe c:\Program Files\ActivIdentity\ActivClient\acevents.exe C:\WINDOWS\System32\SCardSvr.exe C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe C:\Program Files\Intel\Wireless\Bin\EvtEng.exe c:\WINDOWS\system32\ifxtcs.exe C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe C:\Program Files\Common Files\LightScribe\LSSrvc.exe C:\Program Files\Eset\nod32krn.exe c:\WINDOWS\system32\IfxPsdSv.exe C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe C:\WINDOWS\system32\sessmgr.exe C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe C:\WINDOWS\system32\igfxsrvc.exe C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\Program Files\Intel\Wireless\Bin\Dot1XCfg.exe C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe c:\Program Files\Hewlett-Packard\Embedded Security Software\PSDrt.exe . ************************************************************************** . Completion time: 2008-03-20 15:19:59 - machine was rebooted ComboFix-quarantined-files.txt 2008-03-20 14:19:55 . 2008-03-18 06:55:03 --- E O F ---

[quote]Nigdzie nie mogę znaleźć odpowiedzi na ten problem. [/quote] Poza tymi dziesiątkami postów - to pesymistyczne podejście - w archiwum forum. Nawet jeżeli nie w tym dziale to w Bezpieczeństwie na pewno. PS. Nie będę linkował, bo mam awersję do wyszukiwarki.