Firefox nie otwiera nowych okien

**Posty:** 10 · przez **pjotr3k** 31 Mar 2009, 13:32

Witam, od jakiegoś czasu Firefox nie otwiera nowych okien, również na forach, kiedy powinno wyskakiwać nowe okno do napisania postu, nic się nie dzieje... Zainstalowałem bearshare i ares, przeskanowałem kompa i wykryło kilka wirusów, które usunąłem, ale nadal nie otwierają się, nie kombinowałem nic przy popupach i Javie. Proszę o pomoc, używam najnowszej wersji, z góry dziękuję.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 14:24:17, on 2009-03-31
Platform: Windows XP Dodatek SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16791)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Google\Update\GoogleUpdate.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\ASUS\ATK Hotkey\MsgTranAgt.exe
C:\Program Files\ASUS\ATK Hotkey\HControlUser.exe
C:\Program Files\ASUS\ATK Hotkey\HControl.exe
C:\WINDOWS\ASScrPro.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Nokia\Nokia PC Suite 7\PCSuite.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\PC Connectivity Solution\Transports\NclUSBSrv.exe
C:\Program Files\PC Connectivity Solution\Transports\NclRSSrv.exe
C:\Program Files\PC Connectivity Solution\Transports\NclBCBTSrv.exe
C:\Program Files\ASUS\ATK Hotkey\ATKOSD.exe
C:\Program Files\ASUS\ATK Hotkey\WDC.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\Program Files\Xfire\Xfire.exe
C:\Program Files\uTorrent\uTorrent.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [MsgTranAgt] C:\Program Files\ASUS\ATK Hotkey\MsgTranAgt.exe
O4 - HKLM\..\Run: [HControlUser] C:\Program Files\ASUS\ATK Hotkey\HControlUser.exe
O4 - HKLM\..\Run: [ATKHOTKEY] C:\Program Files\ASUS\ATK Hotkey\HControl.exe
O4 - HKLM\..\Run: [ASUS Screen Saver Protector] C:\WINDOWS\ASScrPro.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [PC Suite Tray] "C:\Program Files\Nokia\Nokia PC Suite 7\PCSuite.exe" -onlytray
O4 - Startup: lsass.exe
O4 - Global Startup: BTTray.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: Wyślij do interfejsu Bluetooth - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O8 - Extra context menu item: Wyślij do urządzenia &Bluetooth... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
O23 - Service: Usługa Google Update (gupdate1c98ed37d9d42a7) (gupdate1c98ed37d9d42a7) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Usługa iPod (iPod Service) - Unknown owner - C:\Program Files\iPod\bin\iPodService.exe (file missing)
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe

--
End of file - 7428 bytes

**Posty:** 3874 · przez **Wojtasgls** 31 Mar 2009, 13:49

wstaw logi
HijackThis:
http://forum.programosy.pl/hijackthis-silent-runners-regulamin-tego-dzialu-vt9452.html
Combofix:
http://forum.programosy.pl/jak-generujemy-logi-z-combofixa-oraz-rsita-vt95026.html

**Posty:** 10 · przez **pjotr3k** 31 Mar 2009, 14:24

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 14:24:17, on 2009-03-31
Platform: Windows XP Dodatek SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16791)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Google\Update\GoogleUpdate.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\ASUS\ATK Hotkey\MsgTranAgt.exe
C:\Program Files\ASUS\ATK Hotkey\HControlUser.exe
C:\Program Files\ASUS\ATK Hotkey\HControl.exe
C:\WINDOWS\ASScrPro.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Nokia\Nokia PC Suite 7\PCSuite.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\PC Connectivity Solution\Transports\NclUSBSrv.exe
C:\Program Files\PC Connectivity Solution\Transports\NclRSSrv.exe
C:\Program Files\PC Connectivity Solution\Transports\NclBCBTSrv.exe
C:\Program Files\ASUS\ATK Hotkey\ATKOSD.exe
C:\Program Files\ASUS\ATK Hotkey\WDC.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\Program Files\Xfire\Xfire.exe
C:\Program Files\uTorrent\uTorrent.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [MsgTranAgt] C:\Program Files\ASUS\ATK Hotkey\MsgTranAgt.exe
O4 - HKLM\..\Run: [HControlUser] C:\Program Files\ASUS\ATK Hotkey\HControlUser.exe
O4 - HKLM\..\Run: [ATKHOTKEY] C:\Program Files\ASUS\ATK Hotkey\HControl.exe
O4 - HKLM\..\Run: [ASUS Screen Saver Protector] C:\WINDOWS\ASScrPro.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [PC Suite Tray] "C:\Program Files\Nokia\Nokia PC Suite 7\PCSuite.exe" -onlytray
O4 - Startup: lsass.exe
O4 - Global Startup: BTTray.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: Wyślij do interfejsu Bluetooth - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O8 - Extra context menu item: Wyślij do urządzenia &Bluetooth... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
O23 - Service: Usługa Google Update (gupdate1c98ed37d9d42a7) (gupdate1c98ed37d9d42a7) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Usługa iPod (iPod Service) - Unknown owner - C:\Program Files\iPod\bin\iPodService.exe (file missing)
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe

--
End of file - 7428 bytes

**Posty:** 3874 · przez **Wojtasgls** 31 Mar 2009, 14:32

przeczytaj jeszcze raz tamte tematy i edytuj posta i wstaw w tagi

**Posty:** 10 · przez **pjotr3k** 31 Mar 2009, 14:36

Wojtasgls napisał(a):przeczytaj jeszcze raz tamte tematy i edytuj posta i wstaw w tagi

Które tematy?

**Posty:** 4459 · przez **jarski185** 31 Mar 2009, 15:27

wszystkie, ktore powinienes przeczytac wstawiajac logi, dla ulatwienia powiem ze zostaly podane w tym temacie

**Posty:** 7838 · przez **Lukesh** 31 Mar 2009, 16:29

sposob-na-problemy-z-firefoxem-vt79402.html

**Posty:** 10 · przez **pjotr3k** 03 Kwi 2009, 16:13

Lukesh napisał(a):http://forum.programosy.pl/sposob-na-problemy-z-firefoxem-vt79402.html

Niestety nie podziałało, proszę o pomoc.

**Posty:** 18165 · przez **wojtas** 03 Kwi 2009, 18:42

prosze objąć log w tagi i daj loga z combofixa

**Posty:** 10 · przez **pjotr3k** 06 Kwi 2009, 11:20

Hijack

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 11:10:15, on 2009-04-06 Platform: Windows XP Dodatek SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16791) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\Program Files\Google\Update\GoogleUpdate.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\nvsvc32.exe C:\Program Files\Spyware Doctor\pctsAuxs.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\RTHDCPL.EXE C:\WINDOWS\system32\RUNDLL32.EXE C:\Program Files\ASUS\ATK Hotkey\MsgTranAgt.exe C:\Program Files\ASUS\ATK Hotkey\HControlUser.exe C:\Program Files\ASUS\ATK Hotkey\HControl.exe C:\WINDOWS\system32\wbem\wmiapsrv.exe C:\WINDOWS\ASScrPro.exe C:\Program Files\Java\jre6\bin\jusched.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Messenger\msmsgs.exe C:\Program Files\Nokia\Nokia PC Suite 7\PCSuite.exe C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe C:\Program Files\PC Connectivity Solution\ServiceLayer.exe C:\Program Files\ASUS\ATK Hotkey\ATKOSD.exe C:\Program Files\ASUS\ATK Hotkey\WDC.exe C:\Program Files\PC Connectivity Solution\Transports\NclUSBSrv.exe C:\Program Files\PC Connectivity Solution\Transports\NclRSSrv.exe C:\Program Files\PC Connectivity Solution\Transports\NclBCBTSrv.exe C:\Program Files\foobar2000\foobar2000.exe C:\Program Files\Last.fm\LastFM.exe C:\Program Files\uTorrent\uTorrent.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe O4 - HKLM\..\Run: [MsgTranAgt] C:\Program Files\ASUS\ATK Hotkey\MsgTranAgt.exe O4 - HKLM\..\Run: [HControlUser] C:\Program Files\ASUS\ATK Hotkey\HControlUser.exe O4 - HKLM\..\Run: [ATKHOTKEY] C:\Program Files\ASUS\ATK Hotkey\HControl.exe O4 - HKLM\..\Run: [ASUS Screen Saver Protector] C:\WINDOWS\ASScrPro.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe" O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [PC Suite Tray] "C:\Program Files\Nokia\Nokia PC Suite 7\PCSuite.exe" -onlytray O4 - Startup: lsass.exe O4 - Global Startup: BTTray.lnk = ? O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE O8 - Extra context menu item: Wyślij do interfejsu Bluetooth - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm O8 - Extra context menu item: Wyślij do urządzenia &Bluetooth... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe O23 - Service: Usługa Google Update (gupdate1c98ed37d9d42a7) (gupdate1c98ed37d9d42a7) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: Usługa iPod (iPod Service) - Unknown owner - C:\Program Files\iPod\bin\iPodService.exe (file missing) O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe -- End of file - 7325 bytes

Combofix nic nie wykrywa.

**Posty:** 8001 · przez **Okocza** 06 Kwi 2009, 15:29

pjotr3k,

pjotr3k napisał(a):Combofix nic nie wykrywa.

ten program nie jest do wykrywania sciana

daj log z combofixa. masz wirusa.

**Posty:** 10 · przez **pjotr3k** 06 Kwi 2009, 21:43

Okocza napisał(a):pjotr3k,
pjotr3k napisał(a):Combofix nic nie wykrywa.

ten program nie jest do wykrywania daj log z combofixa. masz wirusa.

Wiem o tym, ale trochę się wkurzyłem, bo grałem w grę po sieci, a tu nagle mi wyłączyło wszystkie procesy, wyszedłem na debila, ale nie jestem :cry:

Jutro wstawię log, a tak BTW wiesz już po logu z Hijacka, że mam wira? Teraz to już w ogóle się zwalił Firefox, raz się włączają gwiazdki, raz nie, ale coś czuje, że ma to związek z kolejnym wspaniałym antywirem zainstalowanym przez mojego ojca, tym razem Spyware Doctor...

**Posty:** 18165 · przez **wojtas** 06 Kwi 2009, 21:51

cos tam widać ale bez combofixa nic nie zrobimy

zainstaluj z darmowych avirę lub noda 32 z platnych

**Posty:** 10 · przez **pjotr3k** 09 Kwi 2009, 09:23

Kod: Zaznacz wszystko: ComboFix 09-04-04.01 - Użytkownik 2009-04-08 20:41:30.1 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.3.1250.1.1045.18.3071.2563 [GMT 2:00] Uruchomiony z: c:\documents and settings\Użytkownik\Pulpit\JJ\ComboFix.exe AV: Spyware Doctor with AntiVirus *On-access scanning disabled* (Updated) * Utworzono nowy punkt przywracania UWAGA - TEN KOMPUTER NIE MA ZAINSTALOWANEJ KONSOLI ODZYSKIWANIA !! . ((((((((((((((((((((((((((((((((((((((( Usunięto ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\documents and settings\Użytkownik\Dane aplikacji\BITS c:\documents and settings\Użytkownik\Dane aplikacji\BITS\BITS.ini c:\documents and settings\Użytkownik\Dane aplikacji\BITS\DHTTable.dat c:\documents and settings\Użytkownik\Dane aplikacji\BITS\ProxyList.ini c:\documents and settings\Użytkownik\Dane aplikacji\BITS\UPnP.ini c:\documents and settings\Użytkownik\Menu Start\Programy\Autostart\lsass.exe c:\program files\Mozilla Firefox\plugins\NPMyGlSh.dll c:\windows\system32\tmp43.tmp c:\windows\system32\tmp44.tmp . ((((((((((((((((((((((((( Pliki utworzone od 2009-03-08 do 2009-04-08 ))))))))))))))))))))))))))))))) . 2009-04-08 15:41 . 2009-04-08 15:41 <DIR> d-------- c:\program files\Ares 2009-04-07 20:08 . 2009-04-07 20:08 <DIR> d-------- c:\documents and settings\Użytkownik\Dane aplikacji\Xfire Plus 2009-04-07 20:02 . 2009-04-07 20:02 <DIR> d-------- c:\program files\BearShare 2009-04-07 19:52 . 2009-04-08 15:39 <DIR> d-------- c:\documents and settings\Użytkownik\Dane aplikacji\LimeWire 2009-04-07 19:51 . 2009-04-07 19:52 <DIR> d-------- c:\program files\LimeWire 2009-03-29 14:34 . 2009-03-29 14:34 <DIR> d-------- c:\program files\Trend Micro 2009-03-29 00:12 . 2009-03-29 00:12 <DIR> d-------- c:\documents and settings\Użytkownik\Dane aplikacji\PC Tools 2009-03-29 00:12 . 2009-04-08 20:37 <DIR> d-a------ c:\documents and settings\All Users\Dane aplikacji\TEMP 2009-03-29 00:12 . 2009-03-29 00:12 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\PC Tools 2009-03-29 00:11 . 2009-04-08 13:46 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\Google Updater 2009-03-28 19:57 . 2009-04-08 20:08 <DIR> d-------- c:\program files\Spyware Doctor 2009-03-28 19:57 . 2009-03-28 23:01 <DIR> d-------- c:\program files\Common Files\PC Tools 2009-03-28 19:57 . 2008-12-11 09:38 159,600 --a------ c:\windows\system32\drivers\pctgntdi.sys 2009-03-28 19:57 . 2009-03-06 17:45 130,424 --a------ c:\windows\system32\drivers\PCTCore.sys 2009-03-28 19:57 . 2008-12-18 13:16 73,840 --a------ c:\windows\system32\drivers\PCTAppEvent.sys 2009-03-28 19:57 . 2008-12-10 13:36 64,392 --a------ c:\windows\system32\drivers\pctplsg.sys 2009-03-26 13:54 . 2009-03-26 14:02 <DIR> d-------- c:\documents and settings\Użytkownik\Dane aplikacji\Nowe Gadu-Gadu 2009-03-26 13:46 . 2009-03-26 13:49 <DIR> d-------- c:\documents and settings\Użytkownik\Dane aplikacji\stamina 2009-03-25 18:11 . 2008-09-25 15:20 483,328 --a------ c:\windows\system32\actskn45.ocx 2009-03-24 15:34 . 2009-03-24 15:34 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\Electronic Arts 2009-03-21 00:25 . 2009-03-21 00:25 41,808 --a------ c:\windows\system32\xfcodec.dll 2009-03-18 13:43 . 2008-10-13 17:18 116,760 --a------ c:\windows\Loader.mp3 2009-03-18 13:18 . 2009-03-18 13:25 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\Skype 2009-03-16 11:58 . 2008-11-26 20:26 199,196 --a------ C:\temp670.tmp 2009-03-16 09:30 . 2009-03-16 09:30 <DIR> d-------- c:\program files\MSXML 4.0 2009-03-16 09:30 . 2009-03-16 09:30 <DIR> d-------- c:\program files\Cyanide . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-04-08 13:58 --------- d-----w c:\documents and settings\Użytkownik\Dane aplikacji\uTorrent 2009-04-08 13:58 --------- d-----w c:\documents and settings\Użytkownik\Dane aplikacji\foobar2000 2009-04-08 11:57 --------- d-----w c:\program files\Xfire 2009-04-06 19:49 --------- d-----w c:\program files\Common Files\Adobe 2009-04-04 18:21 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\TrackMania 2009-03-31 16:30 --------- d-----w c:\program files\Java 2009-03-31 11:20 --------- d--h--w c:\program files\InstallShield Installation Information 2009-03-28 22:12 --------- d-----w c:\program files\Last.fm 2009-03-24 13:00 --------- d-----w c:\program files\Common Files\Wise Installation Wizard 2009-03-24 13:00 --------- d-----w c:\program files\AGEIA Technologies 2009-03-16 09:58 121,882 ----a-w c:\windows\Help\ECC.EXE 2009-03-09 03:19 410,984 ----a-w c:\windows\system32\deploytk.dll 2009-02-27 17:00 --------- d-----w c:\program files\UltraISO 2009-02-27 17:00 --------- d-----w c:\program files\Common Files\EZB Systems 2009-02-25 20:43 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\TrackMania United 2009-02-25 08:16 --------- d-----w c:\documents and settings\Użytkownik\Dane aplikacji\bdec 2009-02-24 15:24 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\Test Drive Unlimited 2009-02-14 18:39 --------- d-----w c:\program files\Google 2009-02-10 11:05 1,700,352 ----a-w c:\windows\system32\gdiplus.dll 2009-02-09 14:07 1,847,040 ----a-w c:\windows\system32\win32k.sys 2009-01-09 20:15 33,136 ----a-w c:\windows\ASScrPro.exe . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-15 15360] "MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-14 1695232] "PC Suite Tray"="c:\program files\Nokia\Nokia PC Suite 7\PCSuite.exe" [2008-12-03 1205760] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-12-08 13594624] "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-12-08 86016] "MsgTranAgt"="c:\program files\ASUS\ATK Hotkey\MsgTranAgt.exe" [2008-08-18 117304] "HControlUser"="c:\program files\ASUS\ATK Hotkey\HControlUser.exe" [2008-08-18 98304] "ATKHOTKEY"="c:\program files\ASUS\ATK Hotkey\HControl.exe" [2008-08-29 223800] "ASUS Screen Saver Protector"="c:\windows\ASScrPro.exe" [2009-01-09 33136] "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-03-09 148888] "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696] "RTHDCPL"="RTHDCPL.EXE" [2008-07-29 c:\windows\RTHDCPL.exe] "nwiz"="nwiz.exe" [2008-12-08 c:\windows\system32\nwiz.exe] c:\documents and settings\All Users\Menu Start\Programy\Autostart\ BTTray.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2008-04-14 596584] Microsoft Office.lnk - c:\program files\Microsoft Office\Office\OSA9.EXE [2000-01-21 65588] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "VIDC.XFR1"= xfcodec.dll [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\Bonjour\\mDNSResponder.exe"= "c:\\Program Files\\Xfire\\Xfire.exe"= "c:\\Program Files\\uTorrent\\uTorrent.exe"= "c:\\Documents and Settings\\Użytkownik\\Moje dokumenty\\PES 2009\\PES 2009\\pes2009.exe"= "c:\\Documents and Settings\\Użytkownik\\Moje dokumenty\\Left 4 Dead\\Left 4 Dead\\left4dead.exe"= "c:\\Program Files\\Electronic Arts\\Crytek\\Crysis SP Demo\\Bin32\\Crysis.exe"= "d:\\Program Files\\Ubisoft\\Splinter Cell Pandora Tomorrow\\pandora.exe"= "d:\\Nowy folder\\Race.Driver.GRID.Multi-5.Full-Rip.Skullptura\\Grid\\GRID.exe"= "d:\\Nowy folder\\Call of Duty 4 Modern Warfare Full-Rip Skullptura\\Call of Duty 4 - Modern Warfare\\iw3mp.exe"= "d:\\Nowy folder\\[PC] Test Drive Unlimited [PROPER] [RIP] [dopeman]\\TDU\\TestDriveUnlimited.exe"= "d:\\Program Files\\Aspyr Media, Inc\\THAW\\Game\\THAW.exe"= "c:\\Program Files\\Empire Interactive\\FlatOut2\\FlatOut2.exe"= "d:\\Program Files\\Ubisoft\\Splinter Cell Pandora Tomorrow\\online\\System\\shadowstrike_static_retail.exe"= "c:\\Documents and Settings\\Użytkownik\\Ustawienia lokalne\\Dane aplikacji\\Dyyno Receiver\\DPPM.exe"= "c:\\Program Files\\BearShare\\BearShare.exe"= "d:\\Program Files\\THQ\\Dawn of War\\W40k.exe"= "d:\\Program Files\\Rockstar Games\\Rockstar Games Social Club\\RGSCLauncher.exe"= "d:\\Program Files\\Rockstar Games\\Grand Theft Auto IV\\LaunchGTAIV.exe"= "d:\\Program Files\\Rockstar Games\\Grand Theft Auto IV\\GTAIV.exe"= "d:\\Program Files\\Electronic Arts\\Burnout(TM) Paradise The Ultimate Box\\BurnoutLauncher.exe"= "d:\\Program Files\\Electronic Arts\\Burnout(TM) Paradise The Ultimate Box\\BurnoutConfigTool.exe"= "d:\\Program Files\\Electronic Arts\\Burnout(TM) Paradise The Ultimate Box\\BurnoutParadise.exe"= "d:\\Nowy folder\\Call.of.Duty.World.at.War.Full-Rip.Skullptura\\Call of Duty - World at War\\CoDWaW.exe"= "d:\\Nowy folder\\Call.of.Duty.World.at.War.Full-Rip.Skullptura\\Call of Duty - World at War\\CoDWaWmp.exe"= "d:\\Program Files\\TmNationsForever\\TmForever.exe"= "d:\\Program Files\\Steam\\steamapps\\pjotr3k95\\counter-strike\\hl.exe"= "d:\\Program Files\\Steam\\steamapps\\pjotr3k95\\condition zero\\hl.exe"= "d:\\Program Files\\TrackMania United\\TmUnited.exe"= "d:\\Program Files\\Steam\\steamapps\\pjotr3k95\\counter-strike beta\\hl.exe"= "d:\\Program Files\\Metin2_PL\\metin2.bin"= "d:\\Program Files\\TrackMania United\\TmUnitedForever\\TmForever.exe"= "c:\\Program Files\\Cyanide\\GameCenter\\GameCenter.exe"= "d:\\Program Files\\Cyanide\\Loki\\Loki.exe"= "d:\\Program Files\\Cyanide\\Loki\\Autorun\\Autorun.exe"= "d:\\Program Files\\THQ\\Saints Row 2\\SR2_pc defaults.exe"= "d:\\Program Files\\8BallClub\\GameDirector.exe"= "d:\\Program Files\\EA GAMES\\Mirror's Edge\\Binaries\\MirrorsEdge.exe"= "c:\\Program Files\\Ares\\Ares.exe"= R0 PCTCore;PCTools KDS;c:\windows\system32\drivers\PCTCore.sys [2009-03-28 130424] R3 ASNDIS5;ASNDIS5 Protocol Driver;c:\progra~1\ASUS\ATKHOT~1\ASNDIS5.SYS [2004-05-27 16269] S2 gupdate1c98ed37d9d42a7;Usługa Google Update (gupdate1c98ed37d9d42a7);c:\program files\Google\Update\GoogleUpdate.exe [2009-02-14 133104] S3 sdAuxService;PC Tools Auxiliary Service;c:\program files\Spyware Doctor\pctsAuxs.exe [2009-03-28 348752] --- Inne Usługi/Sterowniki w Pamięci --- *Deregistered* - mchInjDrv . Zawartość folderu 'Zaplanowane zadania' 2009-04-08 c:\windows\Tasks\Google Software Updater.job - c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-03-23 14:48] 2009-04-08 c:\windows\Tasks\GoogleUpdateTaskMachine.job - c:\program files\Google\Update\GoogleUpdate.exe [2009-02-14 20:38] . - - - - USUNIĘTO PUSTE WPISY - - - - HKLM-Run-QuickTime Task - c:\program files\QuickTime\QTTask.exe HKLM-Run-iTunesHelper - c:\program files\iTunes\iTunesHelper.exe HKLM-Run-SynTPEnh - c:\program files\Synaptics\SynTP\SynTPEnh.exe . ------- Skan uzupełniający ------- . uStart Page = hxxp://search.bearshare.com/pl/ uInternet Settings,ProxyOverride = *.local IE: Wyślij do interfejsu Bluetooth - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm IE: Wyślij do urządzenia &Bluetooth... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm FF - ProfilePath - c:\documents and settings\Użytkownik\Dane aplikacji\Mozilla\Firefox\Profiles\[u]0[/u]57bkmh0.default\ FF - plugin: c:\program files\Google\Google Updater\2.4.1536.6592\npCIDetect13.dll FF - plugin: c:\program files\Google\Update\1.2.141.5\npGoogleOneClick7.dll FF - plugin: c:\program files\K-Lite Codec Pack\Real\browser\plugins\nppl3260.dll FF - plugin: c:\program files\K-Lite Codec Pack\Real\browser\plugins\nprpjplug.dll . ************************************************************************** catchme 0.3.1375 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-04-08 20:43:09 Windows 5.1.2600 Dodatek Service Pack 3 NTFS skanowanie ukrytych procesów ... skanowanie ukrytych wpisów autostartu ... skanowanie ukrytych plików ... skanowanie pomyślnie ukończone ukryte pliki: 0 ************************************************************************** . --------------------- ZABLOKOWANE KLUCZE REJESTRU --------------------- [HKEY_USERS\S-1-5-21-1757981266-1935655697-1801674531-1004\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*] "??"=hex:40,a8,b3,72,36,5a,f7,2a,8e,27,01,50,be,3d,7e,da,3e,d1,0b,60,31,1c,ac, 9d,9a,fe,cc,d5,2f,12,f4,84,da,d8,79,1c,24,b1,e4,3f,ea,aa,58,41,87,e7,76,5a,\ "??"=hex:a6,82,e1,1c,d6,16,fd,84,ab,ae,2c,4f,80,cd,37,33 [HKEY_USERS\S-1-5-21-1757981266-1935655697-1801674531-1004\Software\SecuROM\License information*] "datasecu"=hex:be,2e,35,90,2f,cb,05,50,d4,56,c0,19,88,0c,a6,28,b9,84,29,e4,2b, 93,65,3d,9c,53,a6,90,d9,6d,d1,02,19,ea,49,84,3f,30,92,31,4e,f5,cc,d6,fe,b9,\ "rkeysecu"=hex:b5,13,5a,16,1e,7f,60,5f,71,39,59,42,99,91,1f,c6 [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\961ad301-8580-f589-f072-b648b65ec26] @Denied: (Full) (AuthenticatedUsers) @Denied: (Full) (Administrators) "1wn55d1wl46sw"=hex:36,31,34,32,62,30,63,65,2d,63,64,65,38,2d,34,31,65,39,2d, 61,33,62,38,2d,39,36,31,62,65,34,65,65,65,38,35,66 "1937ilsodshfz"=hex:65,00,00,00,f8,00,00,00,4d,71,43,45,50,4a,6f,54,72,33,4b, 00,00,00,00,00,00,00,00,00,ce,b0,42,61,e8,cd,e9,41,a3,b8,96,1b,e4,ee,e8,5f,\ . Czas ukończenia: 2009-04-08 20:44:23 ComboFix-quarantined-files.txt 2009-04-08 18:44:21 Przed: 11,301,236,736 bajtów wolnych Po: 11,292,565,504 bajtów wolnych 200 --- E O F --- 2009-03-22 12:51:43

Sorry, że dopiero dzisiaj wysłałem, ale nie miałem czasu wcześniej.

**Posty:** 18165 · przez **wojtas** 09 Kwi 2009, 14:02

Otworz notatnik i wklej w nim to:

File::
C:\temp670.tmp
C:\WINDOWS\Help\ECC.EXE

>>Plik>>Zapisz jako... >>> CFScript
Przeciągnij i upuść plik CFScript.txt na plik ComboFix.exe
-->

Ma się rozpocząć usuwanie. (i powstanie log).Daj ten log, który powstanie w trakcie usuwania

**Posty:** 10 · przez **pjotr3k** 09 Kwi 2009, 14:27

Podejrzewałem, że w tym jest wir, wykonałem operację, ale na razie jest tak samo, nowe okna się nie pojawiają.

Kod: Zaznacz wszystko: ComboFix 09-04-04.01 - Użytkownik 2009-04-09 14:20:14.2 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.3.1250.1.1045.18.3071.2629 [GMT 2:00] Uruchomiony z: c:\documents and settings\Użytkownik\Pulpit\ComboFix.exe Użyto następujących komend :: c:\documents and settings\Użytkownik\Pulpit\CFScript.txt AV: Spyware Doctor with AntiVirus *On-access scanning disabled* (Updated) * Utworzono nowy punkt przywracania UWAGA - TEN KOMPUTER NIE MA ZAINSTALOWANEJ KONSOLI ODZYSKIWANIA !! FILE :: C:\temp670.tmp c:\windows\Help\ECC.EXE . ((((((((((((((((((((((((((((((((((((((( Usunięto ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\temp670.tmp c:\windows\Help\ECC.EXE . ((((((((((((((((((((((((( Pliki utworzone od 2009-03-09 do 2009-04-09 ))))))))))))))))))))))))))))))) . 2009-04-08 15:41 . 2009-04-08 15:41 <DIR> d-------- c:\program files\Ares 2009-04-07 20:08 . 2009-04-07 20:08 <DIR> d-------- c:\documents and settings\Użytkownik\Dane aplikacji\Xfire Plus 2009-04-07 20:02 . 2009-04-07 20:02 <DIR> d-------- c:\program files\BearShare 2009-04-07 19:52 . 2009-04-08 15:39 <DIR> d-------- c:\documents and settings\Użytkownik\Dane aplikacji\LimeWire 2009-04-07 19:51 . 2009-04-07 19:52 <DIR> d-------- c:\program files\LimeWire 2009-03-29 14:34 . 2009-03-29 14:34 <DIR> d-------- c:\program files\Trend Micro 2009-03-29 00:12 . 2009-03-29 00:12 <DIR> d-------- c:\documents and settings\Użytkownik\Dane aplikacji\PC Tools 2009-03-29 00:12 . 2009-04-08 20:37 <DIR> d-a------ c:\documents and settings\All Users\Dane aplikacji\TEMP 2009-03-29 00:12 . 2009-03-29 00:12 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\PC Tools 2009-03-29 00:11 . 2009-04-08 13:46 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\Google Updater 2009-03-28 19:57 . 2009-04-08 20:08 <DIR> d-------- c:\program files\Spyware Doctor 2009-03-28 19:57 . 2009-03-28 23:01 <DIR> d-------- c:\program files\Common Files\PC Tools 2009-03-28 19:57 . 2008-12-11 09:38 159,600 --a------ c:\windows\system32\drivers\pctgntdi.sys 2009-03-28 19:57 . 2009-03-06 17:45 130,424 --a------ c:\windows\system32\drivers\PCTCore.sys 2009-03-28 19:57 . 2008-12-18 13:16 73,840 --a------ c:\windows\system32\drivers\PCTAppEvent.sys 2009-03-28 19:57 . 2008-12-10 13:36 64,392 --a------ c:\windows\system32\drivers\pctplsg.sys 2009-03-26 13:54 . 2009-03-26 14:02 <DIR> d-------- c:\documents and settings\Użytkownik\Dane aplikacji\Nowe Gadu-Gadu 2009-03-26 13:46 . 2009-03-26 13:49 <DIR> d-------- c:\documents and settings\Użytkownik\Dane aplikacji\stamina 2009-03-25 18:11 . 2008-09-25 15:20 483,328 --a------ c:\windows\system32\actskn45.ocx 2009-03-24 15:34 . 2009-03-24 15:34 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\Electronic Arts 2009-03-21 00:25 . 2009-03-21 00:25 41,808 --a------ c:\windows\system32\xfcodec.dll 2009-03-18 13:43 . 2008-10-13 17:18 116,760 --a------ c:\windows\Loader.mp3 2009-03-18 13:18 . 2009-03-18 13:25 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\Skype 2009-03-16 09:30 . 2009-03-16 09:30 <DIR> d-------- c:\program files\MSXML 4.0 2009-03-16 09:30 . 2009-03-16 09:30 <DIR> d-------- c:\program files\Cyanide . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-04-09 12:22 --------- d-----w c:\documents and settings\Użytkownik\Dane aplikacji\uTorrent 2009-04-09 07:57 --------- d-----w c:\program files\Xfire 2009-04-09 07:56 --------- d-----w c:\documents and settings\Użytkownik\Dane aplikacji\foobar2000 2009-04-08 19:57 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\TrackMania 2009-04-06 19:49 --------- d-----w c:\program files\Common Files\Adobe 2009-03-31 16:30 --------- d-----w c:\program files\Java 2009-03-31 11:20 --------- d--h--w c:\program files\InstallShield Installation Information 2009-03-28 22:12 --------- d-----w c:\program files\Last.fm 2009-03-24 13:00 --------- d-----w c:\program files\Common Files\Wise Installation Wizard 2009-03-24 13:00 --------- d-----w c:\program files\AGEIA Technologies 2009-03-09 03:19 410,984 ----a-w c:\windows\system32\deploytk.dll 2009-02-27 17:00 --------- d-----w c:\program files\UltraISO 2009-02-27 17:00 --------- d-----w c:\program files\Common Files\EZB Systems 2009-02-25 20:43 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\TrackMania United 2009-02-25 08:16 --------- d-----w c:\documents and settings\Użytkownik\Dane aplikacji\bdec 2009-02-24 15:24 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\Test Drive Unlimited 2009-02-14 18:39 --------- d-----w c:\program files\Google 2009-02-10 11:05 1,700,352 ----a-w c:\windows\system32\gdiplus.dll 2009-02-09 14:07 1,847,040 ----a-w c:\windows\system32\win32k.sys 2009-01-09 20:15 33,136 ----a-w c:\windows\ASScrPro.exe . ((((((((((((((((((((((((((((( SnapShot@2009-04-08_20.43.34.60 ))))))))))))))))))))))))))))))))))))))))) . + 2009-04-09 12:14:32 16,384 ----atw c:\windows\Temp\Perflib_Perfdata_7ac.dat . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-15 15360] "MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-14 1695232] "PC Suite Tray"="c:\program files\Nokia\Nokia PC Suite 7\PCSuite.exe" [2008-12-03 1205760] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-12-08 13594624] "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-12-08 86016] "MsgTranAgt"="c:\program files\ASUS\ATK Hotkey\MsgTranAgt.exe" [2008-08-18 117304] "HControlUser"="c:\program files\ASUS\ATK Hotkey\HControlUser.exe" [2008-08-18 98304] "ATKHOTKEY"="c:\program files\ASUS\ATK Hotkey\HControl.exe" [2008-08-29 223800] "ASUS Screen Saver Protector"="c:\windows\ASScrPro.exe" [2009-01-09 33136] "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-03-09 148888] "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696] "RTHDCPL"="RTHDCPL.EXE" [2008-07-29 c:\windows\RTHDCPL.exe] "nwiz"="nwiz.exe" [2008-12-08 c:\windows\system32\nwiz.exe] c:\documents and settings\All Users\Menu Start\Programy\Autostart\ BTTray.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2008-04-14 596584] Microsoft Office.lnk - c:\program files\Microsoft Office\Office\OSA9.EXE [2000-01-21 65588] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "VIDC.XFR1"= xfcodec.dll [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\Bonjour\\mDNSResponder.exe"= "c:\\Program Files\\Xfire\\Xfire.exe"= "c:\\Program Files\\uTorrent\\uTorrent.exe"= "c:\\Documents and Settings\\Użytkownik\\Moje dokumenty\\PES 2009\\PES 2009\\pes2009.exe"= "c:\\Documents and Settings\\Użytkownik\\Moje dokumenty\\Left 4 Dead\\Left 4 Dead\\left4dead.exe"= "c:\\Program Files\\Electronic Arts\\Crytek\\Crysis SP Demo\\Bin32\\Crysis.exe"= "d:\\Program Files\\Ubisoft\\Splinter Cell Pandora Tomorrow\\pandora.exe"= "d:\\Nowy folder\\Race.Driver.GRID.Multi-5.Full-Rip.Skullptura\\Grid\\GRID.exe"= "d:\\Nowy folder\\Call of Duty 4 Modern Warfare Full-Rip Skullptura\\Call of Duty 4 - Modern Warfare\\iw3mp.exe"= "d:\\Nowy folder\\[PC] Test Drive Unlimited [PROPER] [RIP] [dopeman]\\TDU\\TestDriveUnlimited.exe"= "d:\\Program Files\\Aspyr Media, Inc\\THAW\\Game\\THAW.exe"= "c:\\Program Files\\Empire Interactive\\FlatOut2\\FlatOut2.exe"= "d:\\Program Files\\Ubisoft\\Splinter Cell Pandora Tomorrow\\online\\System\\shadowstrike_static_retail.exe"= "c:\\Documents and Settings\\Użytkownik\\Ustawienia lokalne\\Dane aplikacji\\Dyyno Receiver\\DPPM.exe"= "c:\\Program Files\\BearShare\\BearShare.exe"= "d:\\Program Files\\THQ\\Dawn of War\\W40k.exe"= "d:\\Program Files\\Rockstar Games\\Rockstar Games Social Club\\RGSCLauncher.exe"= "d:\\Program Files\\Rockstar Games\\Grand Theft Auto IV\\LaunchGTAIV.exe"= "d:\\Program Files\\Rockstar Games\\Grand Theft Auto IV\\GTAIV.exe"= "d:\\Program Files\\Electronic Arts\\Burnout(TM) Paradise The Ultimate Box\\BurnoutLauncher.exe"= "d:\\Program Files\\Electronic Arts\\Burnout(TM) Paradise The Ultimate Box\\BurnoutConfigTool.exe"= "d:\\Program Files\\Electronic Arts\\Burnout(TM) Paradise The Ultimate Box\\BurnoutParadise.exe"= "d:\\Nowy folder\\Call.of.Duty.World.at.War.Full-Rip.Skullptura\\Call of Duty - World at War\\CoDWaW.exe"= "d:\\Nowy folder\\Call.of.Duty.World.at.War.Full-Rip.Skullptura\\Call of Duty - World at War\\CoDWaWmp.exe"= "d:\\Program Files\\TmNationsForever\\TmForever.exe"= "d:\\Program Files\\Steam\\steamapps\\pjotr3k95\\counter-strike\\hl.exe"= "d:\\Program Files\\Steam\\steamapps\\pjotr3k95\\condition zero\\hl.exe"= "d:\\Program Files\\TrackMania United\\TmUnited.exe"= "d:\\Program Files\\Steam\\steamapps\\pjotr3k95\\counter-strike beta\\hl.exe"= "d:\\Program Files\\Metin2_PL\\metin2.bin"= "d:\\Program Files\\TrackMania United\\TmUnitedForever\\TmForever.exe"= "c:\\Program Files\\Cyanide\\GameCenter\\GameCenter.exe"= "d:\\Program Files\\Cyanide\\Loki\\Loki.exe"= "d:\\Program Files\\Cyanide\\Loki\\Autorun\\Autorun.exe"= "d:\\Program Files\\THQ\\Saints Row 2\\SR2_pc defaults.exe"= "d:\\Program Files\\8BallClub\\GameDirector.exe"= "d:\\Program Files\\EA GAMES\\Mirror's Edge\\Binaries\\MirrorsEdge.exe"= "c:\\Program Files\\Ares\\Ares.exe"= R0 PCTCore;PCTools KDS;c:\windows\system32\drivers\PCTCore.sys [2009-03-28 130424] R3 ASNDIS5;ASNDIS5 Protocol Driver;c:\progra~1\ASUS\ATKHOT~1\ASNDIS5.SYS [2004-05-27 16269] S2 gupdate1c98ed37d9d42a7;Usługa Google Update (gupdate1c98ed37d9d42a7);c:\program files\Google\Update\GoogleUpdate.exe [2009-02-14 133104] S3 sdAuxService;PC Tools Auxiliary Service;c:\program files\Spyware Doctor\pctsAuxs.exe [2009-03-28 348752] . Zawartość folderu 'Zaplanowane zadania' 2009-04-09 c:\windows\Tasks\Google Software Updater.job - c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-03-23 14:48] 2009-04-09 c:\windows\Tasks\GoogleUpdateTaskMachine.job - c:\program files\Google\Update\GoogleUpdate.exe [2009-02-14 20:38] . . ------- Skan uzupełniający ------- . uStart Page = hxxp://search.bearshare.com/pl/ uInternet Settings,ProxyOverride = *.local IE: Wyślij do interfejsu Bluetooth - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm IE: Wyślij do urządzenia &Bluetooth... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm FF - ProfilePath - c:\documents and settings\Użytkownik\Dane aplikacji\Mozilla\Firefox\Profiles\[u]0[/u]57bkmh0.default\ FF - plugin: c:\program files\Google\Google Updater\2.4.1536.6592\npCIDetect13.dll FF - plugin: c:\program files\Google\Update\1.2.141.5\npGoogleOneClick7.dll FF - plugin: c:\program files\K-Lite Codec Pack\Real\browser\plugins\nppl3260.dll FF - plugin: c:\program files\K-Lite Codec Pack\Real\browser\plugins\nprpjplug.dll . ************************************************************************** catchme 0.3.1375 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-04-09 14:22:00 Windows 5.1.2600 Dodatek Service Pack 3 NTFS skanowanie ukrytych procesów ... skanowanie ukrytych wpisów autostartu ... skanowanie ukrytych plików ... skanowanie pomyślnie ukończone ukryte pliki: 0 ************************************************************************** . --------------------- ZABLOKOWANE KLUCZE REJESTRU --------------------- [HKEY_USERS\S-1-5-21-1757981266-1935655697-1801674531-1004\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*] "??"=hex:40,a8,b3,72,36,5a,f7,2a,8e,27,01,50,be,3d,7e,da,3e,d1,0b,60,31,1c,ac, 9d,9a,fe,cc,d5,2f,12,f4,84,da,d8,79,1c,24,b1,e4,3f,ea,aa,58,41,87,e7,76,5a,\ "??"=hex:a6,82,e1,1c,d6,16,fd,84,ab,ae,2c,4f,80,cd,37,33 [HKEY_USERS\S-1-5-21-1757981266-1935655697-1801674531-1004\Software\SecuROM\License information*] "datasecu"=hex:be,2e,35,90,2f,cb,05,50,d4,56,c0,19,88,0c,a6,28,b9,84,29,e4,2b, 93,65,3d,9c,53,a6,90,d9,6d,d1,02,19,ea,49,84,3f,30,92,31,4e,f5,cc,d6,fe,b9,\ "rkeysecu"=hex:b5,13,5a,16,1e,7f,60,5f,71,39,59,42,99,91,1f,c6 [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\961ad301-8580-f589-f072-b648b65ec26] @Denied: (Full) (AuthenticatedUsers) @Denied: (Full) (Administrators) "1wn55d1wl46sw"=hex:36,31,34,32,62,30,63,65,2d,63,64,65,38,2d,34,31,65,39,2d, 61,33,62,38,2d,39,36,31,62,65,34,65,65,65,38,35,66 "1937ilsodshfz"=hex:65,00,00,00,f8,00,00,00,4d,71,43,45,50,4a,6f,54,72,33,4b, 00,00,00,00,00,00,00,00,00,ce,b0,42,61,e8,cd,e9,41,a3,b8,96,1b,e4,ee,e8,5f,\ . Czas ukończenia: 2009-04-09 14:23:16 ComboFix-quarantined-files.txt 2009-04-09 12:23:13 ComboFix2.txt 2009-04-08 18:44:25 Przed: 10,892,136,448 bajtów wolnych Po: 11,283,443,712 bajtów wolnych 194 --- E O F --- 2009-03-22 12:51:43

**Posty:** 18165 · przez **wojtas** 09 Kwi 2009, 14:33

1. Ściągnij OTMoveIt i go włacz i odpal go z opcji CleanUp

oraz skasuj folder C:\Qoobox
2. wykonaj optymalizację windowsa
3.sciagnij ATF_Cleaner
zaznacz
Windows Temp
All users Temp
Temporary internet files
Recycle Bin
i wcisnij EMPTY SELECTED
4.Wyłącz przywracanie systemu ( właściwości mój komputer-zakładka przywracanie - wyłącz przywracanie na wszystkich dyskach). Po chwili włącz je powrotem
5. Wykonaj skan Dr. Web CureIt
6. Przeskanuj obszar mojego komputera http://www.kaspersky.pl/virusscanner.html (uruchom przez IE) Daj raport z niego na forum.

i tym:

FixIEDef.