prosba o sprawdzenie logów

**Posty:** 2 · przez **Caitlin** 25 Wrz 2007, 18:16

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 15:54:23, on 2007-09-25 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16512) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\vtdjfplu.exe C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE C:\WINDOWS\System32\svchost.exe C:\Program Files\Fichiers communs\PCSuite\DataLayer\DataLayer.exe C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe C:\Program Files\iTunes\iTunesHelper.exe C:\WINDOWS\system32\ctfmon.exe C:\PROGRA~1\FICHIE~1\PCSuite\Services\SERVIC~1.EXE C:\Program Files\Logitech\SetPoint\SetPoint.exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\UltimateZip\uzqkst.exe C:\Program Files\Fichiers communs\Logitech\KHAL\KHALMNPR.EXE C:\WINDOWS\explorer.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Documents and Settings\KSIĘGOWOŚĆ\Bureau\HiJackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = c:\secure32.html R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = c:\secure32.html R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = c:\secure32.html R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = about:blank R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens R3 - URLSearchHook: (no name) - {0A94B116-4504-4e26-AB05-E61E474AA38B} - C:\Program Files\AskPBar\SrchAstt\1.bin\A9SRCHAS.DLL F2 - REG:system.ini: Shell=explorer.exe "C:\Program Files\Fichiers communs\Microsoft Shared\Web Folders\ibm00003.exe" O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O3 - Toolbar: (no name) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - (no file) O3 - Toolbar: Ask Toolbar - {F4D76F09-7896-458a-890F-E1F05C46069F} - C:\Program Files\AskPBar\bar\1.bin\ASKPBAR.DLL O4 - HKLM\..\Run: [enewsletterpro] C:\windows\enewsletterpro.exe O4 - HKLM\..\Run: [banmanpro] C:\windows\banmanpro.exe O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe" O4 - HKLM\..\Run: [DataLayer] C:\Program Files\Fichiers communs\PCSuite\DataLayer\DataLayer.exe O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -onlytray O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [j3271230] rundll32 C:\WINDOWS\system32\j3271230.dll sook O4 - HKLM\..\Run: [SearchIndexer] rundll32.exe "C:\WINDOWS\system32\odcrxpct.dll",sitypnow O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [Shell] "C:\Program Files\Fichiers communs\Microsoft Shared\Web Folders\ibm00003.exe" O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user') O4 - Startup: UltimateZip Quick Start.lnk = C:\Program Files\UltimateZip\uzqkst.exe O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe O8 - Extra context menu item: Download Video on This Page - C:\Program Files\Tomato\TubeDownload\TDIEPage.html O8 - Extra context menu item: Download Video This Links To - C:\Program Files\Tomato\TubeDownload\TDIELink.html O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: Download Video - {A103A693-F92C-4A81-8F7F-6C80799EFF3D} - C:\Program Files\Tomato\TubeDownload\TDIEPage.html O9 - Extra 'Tools' menuitem: Download Video on This Page - {A103A693-F92C-4A81-8F7F-6C80799EFF3D} - C:\Program Files\Tomato\TubeDownload\TDIEPage.html O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm (file missing) O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm (file missing) O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.com/dl/installs/yinst20040510.cab O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1118939038079 O17 - HKLM\System\CCS\Services\Tcpip\..\{F9AA24D1-F0B5-4B6B-AE48-935F84477D8F}: NameServer = 81.31.191.131,81.31.192.203,212.113.0.3,212.113.0.4 O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: DomainService - - C:\WINDOWS\system32\vtdjfplu.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: MySql - Unknown owner - c:\usr/MYSQL/bin/mysqld.exe (file missing) -- End of file - 7249 bytes

i jeszcze mam male problemy. Otoz za kazdym razem kiedy uruchamiam FF (firefox'a) wlacza mi sie IE. do tego komp mi sie muli.
niektore programy sie nie wlaczaja (np. GP5)
kiedy wchodze w np. moj komputer, to okno mi sie zamyka i pojawia sie jakis blad.(to przy pierwszym wejsciu na dysk c, potem juz jako tako normalnie dziala).
mam francuska wersje XP.

**Posty:** 8694 · przez **Red** 25 Wrz 2007, 19:00

usuń:

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = c:\secure32.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = c:\secure32.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = c:\secure32.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = about:blank
R3 - URLSearchHook: (no name) - {0A94B116-4504-4e26-AB05-E61E474AA38B} - C:\Program Files\AskPBar\SrchAstt\1.bin\A9SRCHAS.DLL
F2 - REG:system.ini: Shell=explorer.exe "C:\Program Files\Fichiers communs\Microsoft Shared\Web Folders\ibm00003.exe"
O3 - Toolbar: (no name) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - (no file)
O4 - HKLM\..\Run: [enewsletterpro] C:\windows\enewsletterpro.exe
O4 - HKLM\..\Run: [banmanpro] C:\windows\banmanpro.exe
O4 - HKCU\..\Run: [Shell] "C:\Program Files\Fichiers communs\Microsoft Shared\Web Folders\ibm00003.exe"
O23 - Service: DomainService - - C:\WINDOWS\system32\vtdjfplu.exe

a to jest dziwne ,znasz to:

O9 - Extra button: Download Video - {A103A693-F92C-4A81-8F7F-6C80799EFF3D} - C:\Program Files\Tomato\TubeDownload\TDIEPage.html

czy to twoje dns`y:

O17 - HKLM\System\CCS\Services\Tcpip\..\{F9AA24D1-F0B5-4B6B-AE48-935F84477D8F}: NameServer = 81.31.191.131,81.31.192.203,212.113.0.3,212.113.0.4

??

**Posty:** 237 · przez **Kuba1** 25 Wrz 2007, 20:25

Wejdźw tryb awaryjny

Start>>uruchom>>CMD i wklep

sc stop DomainService
sc delete DomainService
DEL C:\WINDOWS\system32\vtdjfplu.exe

Następnie Pobierz narzędzie SDFix

*Klikamy 2 krotknie na ikonę SDFix.exe,program wypakuje się domyślnie do lokalizacji C:\SDFix

*Wchodzimy do trybu awaryjnego z obsługą sieci:
>>>>>>Jak wejść do trybu awaryjnego z obsługą sieci?

*F8 podczas bootowania systemu.
*Używamy narzędzia BootSafe.exe zaznaczamy opcje Safe Mode- Networking i klikamy reboot

*Gdy już jesteśmy w trybie awaryjnym,wchodzimy do folderu SDFix i uruchamiamy narzędzie klikająć
2-krotnie na plik RunThis.bat lewym przyciskiem myszy.

*Wciskamy Y co uruchomi proces usuwania

*Kiedy proces usuwania się zakończy wciskamy dowolny klawisz>>nastąpi restart.

*Po restarcie SDFix dokończy proces usuwania,kiedy w oknie narzędzia SDFix pojawi się napis Finished
klikamy dowolny klawisz,narzędzie zakończy swoją pracę,na pulpicie załadują się ikony.

*Wchodzimy do folderu SDFix i kopiujemy zawartość pliku tekstowego Report.txt i wklejamy go na forum

Następnie zastosuj ComboFix

Wracasz z raportem z SDFix oraz logami z ComboFix,Hijackthis i Silentrunners.

**Posty:** 2 · przez **Caitlin** 28 Wrz 2007, 15:14

tak to moje dns'y

hijackthis

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 14:04:38, on 2007-09-28 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16512) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\noeaghsu.exe C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\system32\notepad.exe C:\Program Files\Fichiers communs\PCSuite\DataLayer\DataLayer.exe C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe C:\Program Files\iTunes\iTunesHelper.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\iPod\bin\iPodService.exe C:\PROGRA~1\FICHIE~1\PCSuite\Services\SERVIC~1.EXE C:\Program Files\Logitech\SetPoint\SetPoint.exe C:\Program Files\Fichiers communs\Logitech\KHAL\KHALMNPR.EXE C:\Program Files\HiJackThis\HiJackThis.exe C:\Program Files\Mozilla Firefox\firefox.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens R3 - URLSearchHook: (no name) - {0A94B116-4504-4e26-AB05-E61E474AA38B} - C:\Program Files\AskPBar\SrchAstt\1.bin\A9SRCHAS.DLL O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O3 - Toolbar: Ask Toolbar - {F4D76F09-7896-458a-890F-E1F05C46069F} - C:\Program Files\AskPBar\bar\1.bin\ASKPBAR.DLL O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe" O4 - HKLM\..\Run: [DataLayer] C:\Program Files\Fichiers communs\PCSuite\DataLayer\DataLayer.exe O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -onlytray O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [j3271230] rundll32 C:\WINDOWS\system32\j3271230.dll sook O4 - HKLM\..\Run: [SearchIndexer] rundll32.exe "C:\WINDOWS\system32\ldnaqnga.dll",sitypnow O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized O4 - HKCU\..\Run: [DDC] C:\WINDOWS\system32\noeaghsu.exe O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user') O4 - Startup: UltimateZip Quick Start.lnk = C:\Program Files\UltimateZip\uzqkst.exe O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe O8 - Extra context menu item: Download Video on This Page - C:\Program Files\Tomato\TubeDownload\TDIEPage.html O8 - Extra context menu item: Download Video This Links To - C:\Program Files\Tomato\TubeDownload\TDIELink.html O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: Download Video - {A103A693-F92C-4A81-8F7F-6C80799EFF3D} - C:\Program Files\Tomato\TubeDownload\TDIEPage.html O9 - Extra 'Tools' menuitem: Download Video on This Page - {A103A693-F92C-4A81-8F7F-6C80799EFF3D} - C:\Program Files\Tomato\TubeDownload\TDIEPage.html O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm (file missing) O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm (file missing) O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.com/dl/installs/yinst20040510.cab O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1118939038079 O17 - HKLM\System\CCS\Services\Tcpip\..\{F9AA24D1-F0B5-4B6B-AE48-935F84477D8F}: NameServer = 81.31.191.131,81.31.192.203,212.113.0.3,212.113.0.4 O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: DomainService - - C:\WINDOWS\system32\noeaghsu.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: MySql - Unknown owner - c:\usr/MYSQL/bin/mysqld.exe (file missing) -- End of file - 6222 bytes

raport SDFix

Kod: Zaznacz wszystko: SDFix: Version 1.107 Run by KSI¨GOWO—Ź on 2007-09-28 at 13:18 Microsoft Windows XP [version 5.1.2600] Running From: C:\SDFix Safe Mode: Checking Services: Restoring Windows Registry Values Restoring Windows Default Hosts File Rebooting... Normal Mode: Checking Files: Trojan Files Found: C:\WINDOWS\Temp\win5F7B.tmp.exe - Deleted C:\WINDOWS\Temp\winFB86.tmp.exe - Deleted C:\WINDOWS\Temp\win5F7B.tmp.exe - Deleted C:\WINDOWS\Temp\winFB86.tmp.exe - Deleted C:\DOCUME~1\KSIGOW~1\LOCALS~1\Temp\$b17a2e8.tmp - Deleted C:\WINDOWS\system32\svcp.csv - Deleted C:\WINDOWS\Temp\$_2341233.TMP - Deleted C:\WINDOWS\Temp\$_2341234.TMP - Deleted Removing Temp Files... ADS Check: C:\WINDOWS No streams found. C:\WINDOWS\system32 No streams found. C:\WINDOWS\system32\svchost.exe No streams found. C:\WINDOWS\system32\ntoskrnl.exe No streams found. Final Check: Remaining Services: ------------------ Authorized Application Key Export: [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "C:\\Documents and Settings\\All Users\\Application Data\\Spontania4IM\\spontaniavideo.exe"="C:\\Documents and Settings\\All Users\\Application Data\\Spontania4IM\\spontaniavideo.exe:*:Enabled:Dialcom Spontania video4IM" "I:\\KZTEJ\\Kazaa Lite Rewolucja\\kazaalite.kpp"="I:\\KZTEJ\\Kazaa Lite Rewolucja\\kazaalite.kpp:*:Enabled:kazaalite" "I:\\Kazaa Lite Rewolucja\\kazaalite.kpp"="I:\\Kazaa Lite Rewolucja\\kazaalite.kpp:*:Enabled:kazaalite" "I:\\KZTEJ\\emule0.46a\\emule.exe"="I:\\KZTEJ\\emule0.46a\\emule.exe:*:Enabled:eMule" "C:\\Program Files\\Gadu-Gadu\\gg.exe"="C:\\Program Files\\Gadu-Gadu\\gg.exe:*:Enabled:Gadu-Gadu - program glowny" "C:\\WINDOWS\\explorer.exe"="C:\\WINDOWS\\explorer.exe:*:Enabled:explorer" "C:\\Program Files\\Skype\\Phone\\Skype.exe"="C:\\Program Files\\Skype\\Phone\\Skype.exe:*:Enabled:Skype" "\\??\\C:\\WINDOWS\\system32\\winlogon.exe"="\\??\\C:\\WINDOWS\\system32\\winlogon.exe:*:Enabled:explorer" "%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000" "C:\\Program Files\\MSN Messenger\\msncall.exe"="C:\\Program Files\\MSN Messenger\\msncall.exe:*:Enabled:Windows Live Messenger 8.0 (Phone)" "C:\\WINDOWS\\system32\\vtdjfplu.exe"="C:\\WINDOWS\\system32\\vtd" "C:\\WINDOWS\\TEMP\\winFB7F.tmp.exe"="C:\\WINDOWS\\TEMP\\winFB7F.tmp.exe:*:Enabled:winFB7F.tmp" "C:\\Program Files\\MSN Messenger\\msnmsgr.exe"="C:\\Program Files\\MSN Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1" "C:\\Program Files\\MSN Messenger\\livecall.exe"="C:\\Program Files\\MSN Messenger\\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)" "C:\\WINDOWS\\system32\\noeaghsu.exe"="C:\\WINDOWS\\system32\\noe" [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list] "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000" "C:\\Program Files\\MSN Messenger\\msncall.exe"="C:\\Program Files\\MSN Messenger\\msncall.exe:*:Enabled:Windows Live Messenger 8.0 (Phone)" "C:\\Program Files\\MSN Messenger\\msnmsgr.exe"="C:\\Program Files\\MSN Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1" "C:\\Program Files\\MSN Messenger\\livecall.exe"="C:\\Program Files\\MSN Messenger\\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)" Remaining Files: --------------- File Backups: - C:\SDFix\backups\backups.zip Files with Hidden Attributes: Fri 13 May 2005 217,073 A.SHR --- "C:\WINDOWS\meta4.exe" Mon 24 Oct 2005 66,560 A.SHR --- "C:\WINDOWS\MOTA113.exe" Thu 13 Oct 2005 422,400 A.SHR --- "C:\WINDOWS\x2.64.exe" Fri 7 Oct 2005 308,224 A.SHR --- "C:\WINDOWS\system32\avisynth.dll" Tue 22 May 2007 746,863 ..SH. --- "C:\WINDOWS\system32\eddgh.tmp" Wed 15 Feb 2006 654,335 ..SH. --- "C:\WINDOWS\system32\eddgh.bak1" Fri 28 Sep 2007 726,184 ..SH. --- "C:\WINDOWS\system32\eddgh.bak2" Tue 24 Nov 1998 23,552 ..SH. --- "C:\WINDOWS\system32\helpdks.dll" Fri 18 May 2007 262,708 ..SH. --- "C:\WINDOWS\system32\hgdde.dll" Sun 25 Jan 2004 70,656 A.SHR --- "C:\WINDOWS\system32\i420vfw.dll" Sun 25 Jan 2004 70,656 A.SHR --- "C:\WINDOWS\system32\yv12vfw.dll" Tue 27 Sep 2005 4,348 A.SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak" Thu 13 Sep 2007 259,072 ...H. --- "C:\Documents and Settings\GO—Ź\Mes documents\~WRL1049.tmp" Sun 8 Oct 2006 72,192 ..SHR --- "C:\Program Files\eRightSoft\SUPER\Setup.exe" Wed 11 Jan 2006 16,384 A.SHR --- "C:\Program Files\eRightSoft\SUPER\_Setup.dll" Wed 16 May 2007 25,468 ...HR --- "C:\WINDOWS\Temp\EMULE3e9\#1 CD Ripper v1.72.43 serial keygen.zip" Wed 16 May 2007 25,374 ...HR --- "C:\WINDOWS\Temp\EMULE3e9\007 STARR PC and Internet Monitor Professional v3.0 serial keygen.zip" Wed 16 May 2007 26,982 ...HR --- "C:\WINDOWS\Temp\EMULE3e9\Ablaze Web Auto-Promotion v2.22 serial keygen.zip" Wed 16 May 2007 26,800 ...HR --- "C:\WINDOWS\Temp\EMULE3e9\Able2Extract v3.0 Standard Edition serial keygen.zip" Wed 16 May 2007 25,151 ...HR --- "C:\WINDOWS\Temp\EMULE3e9\Acronis Disk Director Server v10.0.2089 German serial keygen.zip" Wed 16 May 2007 25,460 ...HR --- "C:\WINDOWS\Temp\EMULE3e9\Adobe Acrobat Professional v7.0 serial keygen.zip" Wed 16 May 2007 25,592 ...HR --- "C:\WINDOWS\Temp\EMULE3e9\Adobe Indesign CS v3.0 serial keygen.zip" Wed 16 May 2007 26,765 ...HR --- "C:\WINDOWS\Temp\EMULE3e9\AEC Fasttrack Schedule v8.0.5 serial keygen.zip" Wed 16 May 2007 25,744 ...HR --- "C:\WINDOWS\Temp\EMULE3e9\Ahead Nero Burning Rom v6.6.0.8 serial keygen.zip" Wed 16 May 2007 25,526 ...HR --- "C:\WINDOWS\Temp\EMULE3e9\Alien Versus Predator 2 serial keygen.zip" Wed 16 May 2007 26,754 ...HR --- "C:\WINDOWS\Temp\EMULE3e9\Allok AVI MPEG Converter v1.3.6 serial keygen.zip" Wed 16 May 2007 25,467 ...HR --- "C:\WINDOWS\Temp\EMULE3e9\AllPornGone v2.1 serial keygen.zip" Wed 16 May 2007 25,437 ...HR --- "C:\WINDOWS\Temp\EMULE3e9\AVS video convert v3.2 serial keygen.zip" Wed 16 May 2007 25,364 ...HR --- "C:\WINDOWS\Temp\EMULE3e9\BattleField 1942 by nOOb serial keygen.zip" Wed 16 May 2007 25,403 ...HR --- "C:\WINDOWS\Temp\EMULE3e9\BlackICE PC Protection v3.6 serial keygen.zip" Wed 16 May 2007 26,555 ...HR --- "C:\WINDOWS\Temp\EMULE3e9\BlazingTools Perfect Keylogger v1.6.2.0 Dutch by CHiCNCREAM serial keygen.zip" Wed 16 May 2007 25,126 ...HR --- "C:\WINDOWS\Temp\EMULE3e9\boson router simulator v4.15 serial keygen.zip" Wed 16 May 2007 25,434 ...HR --- "C:\WINDOWS\Temp\EMULE3e9\Cakewalk Pro Audio v9.0 serial keygen.zip" Wed 16 May 2007 25,377 ...HR --- "C:\WINDOWS\Temp\EMULE3e9\Clone DVD 2 serial keygen.zip" Wed 16 May 2007 26,667 ...HR --- "C:\WINDOWS\Temp\EMULE3e9\Coolmaps Countdown Component for NetobjectsFusion v4.5 MX v5.00 serial keygen.zip" Wed 16 May 2007 26,964 ...HR --- "C:\WINDOWS\Temp\EMULE3e9\Cuckoo Timer v1.0 serial keygen.zip" Wed 16 May 2007 26,513 ...HR --- "C:\WINDOWS\Temp\EMULE3e9\DivX Pro v5.0.3 serial keygen.zip" Wed 16 May 2007 25,052 ...HR --- "C:\WINDOWS\Temp\EMULE3e9\Dragon Naturally Speaking 7 serial keygen.zip" Wed 16 May 2007 25,646 ...HR --- "C:\WINDOWS\Temp\EMULE3e9\E-Mass 2000 v4.57 serial keygen.zip" Wed 16 May 2007 25,644 ...HR --- "C:\WINDOWS\Temp\EMULE3e9\Ease MP3 CD Burner v1.40 serial keygen.zip" Wed 16 May 2007 25,536 ...HR --- "C:\WINDOWS\Temp\EMULE3e9\Easy DVD Ripper v2.23 serial keygen.zip" Wed 16 May 2007 25,115 ...HR --- "C:\WINDOWS\Temp\EMULE3e9\Easy PDF Creator v1.00 build 620 serial keygen.zip" Wed 16 May 2007 26,947 ...HR --- "C:\WINDOWS\Temp\EMULE3e9\EditPlus v2.12 76 serial keygen.zip" Wed 16 May 2007 24,983 ...HR --- "C:\WINDOWS\Temp\EMULE3e9\ExcelWeb v1.5 serial keygen.zip" Wed 16 May 2007 26,575 ...HR --- "C:\WINDOWS\Temp\EMULE3e9\FaxLine Professional v2.0 serial keygen.zip" Wed 16 May 2007 27,074 ...HR --- "C:\WINDOWS\Temp\EMULE3e9\Fireworks MX 2004 v7.0.1 serial keygen.zip" Wed 16 May 2007 25,638 ...HR --- "C:\WINDOWS\Temp\EMULE3e9\Frigate v3.19 serial keygen.zip" Wed 16 May 2007 25,707 ...HR --- "C:\WINDOWS\Temp\EMULE3e9\Frontpage 2003 no beta serial keygen.zip" Wed 16 May 2007 26,518 ...HR --- "C:\WINDOWS\Temp\EMULE3e9\Full Spectrum Warrior 1 serial keygen.zip" Wed 16 May 2007 26,639 ...HR --- "C:\WINDOWS\Temp\EMULE3e9\GFI LANguard Network Security Scanner v6.0.20050304 serial keygen.zip" Wed 16 May 2007 25,750 ...HR --- "C:\WINDOWS\Temp\EMULE3e9\Graphics WorkShop serial keygen.zip" Wed 16 May 2007 25,291 ...HR --- "C:\WINDOWS\Temp\EMULE3e9\Green Browser v1.06 serial keygen.zip" Wed 16 May 2007 26,673 ...HR --- "C:\WINDOWS\Temp\EMULE3e9\Gutterball 2 - Game House serial keygen.zip" Wed 16 May 2007 26,971 ...HR --- "C:\WINDOWS\Temp\EMULE3e9\InkSaver v2.0 serial keygen.zip" Wed 16 May 2007 26,597 ...HR --- "C:\WINDOWS\Temp\EMULE3e9\IPMonitor v5.6 serial keygen.zip" Wed 16 May 2007 25,576 ...HR --- "C:\WINDOWS\Temp\EMULE3e9\iQfx3 Plus for RealPlayer v1.0.0.3 serial keygen.zip" Wed 16 May 2007 25,320 ...HR --- "C:\WINDOWS\Temp\EMULE3e9\Journal Safe 2001 v1.0.1 serial keygen.zip" Wed 16 May 2007 25,400 ...HR --- "C:\WINDOWS\Temp\EMULE3e9\Macromedia Fireworks MX 2004 v7.0.288 serial keygen.zip" Wed 16 May 2007 25,040 ...HR --- "C:\WINDOWS\Temp\EMULE3e9\MagnaRam serial keygen.zip" Wed 16 May 2007 25,062 ...HR --- "C:\WINDOWS\Temp\EMULE3e9\Mahjong serial keygen.zip" Wed 16 May 2007 25,348 ...HR --- "C:\WINDOWS\Temp\EMULE3e9\MailChecker32.v3.7.0.1 by SCF serial keygen.zip" Wed 16 May 2007 25,619 ...HR --- "C:\WINDOWS\Temp\EMULE3e9\Microsoft Windows 2000 Server serial keygen.zip" Wed 16 May 2007 25,537 ...HR --- "C:\WINDOWS\Temp\EMULE3e9\Microsoft Windows Me Portugues serial keygen.zip" Wed 16 May 2007 25,084 ...HR --- "C:\WINDOWS\Temp\EMULE3e9\Mighty Fax v3.12 serial keygen.zip" Wed 16 May 2007 25,702 ...HR --- "C:\WINDOWS\Temp\EMULE3e9\MP3 Cutter Joiner v1.03 serial keygen.zip" Wed 16 May 2007 26,392 ...HR --- "C:\WINDOWS\Temp\EMULE3e9\My Drivers v3.11 build 2600 serial keygen.zip" Wed 16 May 2007 27,011 ...HR --- "C:\WINDOWS\Temp\EMULE3e9\Nero Media Player v1.4.0.34a serial keygen.zip" Wed 16 May 2007 26,538 ...HR --- "C:\WINDOWS\Temp\EMULE3e9\Norton Partition Magic v8.05 v8.05 serial keygen.zip" Wed 16 May 2007 25,132 ...HR --- "C:\WINDOWS\Temp\EMULE3e9\Office 97 Professional Edition upgrade SR-1 serial keygen.zip" Wed 16 May 2007 25,752 ...HR --- "C:\WINDOWS\Temp\EMULE3e9\Operation Flashpoint v2.0 serial keygen.zip" Wed 16 May 2007 25,552 ...HR --- "C:\WINDOWS\Temp\EMULE3e9\Paint Shop Pro X Retail serial keygen.zip" Wed 16 May 2007 25,622 ...HR --- "C:\WINDOWS\Temp\EMULE3e9\Passphrase Keeper v2.3.102 serial keygen.zip" Wed 16 May 2007 25,072 ...HR --- "C:\WINDOWS\Temp\EMULE3e9\PHPEdit v1.0.1 5 serial keygen.zip" Wed 16 May 2007 25,070 ...HR --- "C:\WINDOWS\Temp\EMULE3e9\Postage Saver Pro v6.2.3 serial keygen.zip" Wed 16 May 2007 25,240 ...HR --- "C:\WINDOWS\Temp\EMULE3e9\Sim City 4 Deluxe Edition serial keygen.zip" Wed 16 May 2007 25,096 ...HR --- "C:\WINDOWS\Temp\EMULE3e9\Slider v3.5 serial keygen.zip" Wed 16 May 2007 25,608 ...HR --- "C:\WINDOWS\Temp\EMULE3e9\Slots of Trivia serial keygen.zip" Wed 16 May 2007 25,149 ...HR --- "C:\WINDOWS\Temp\EMULE3e9\Snoop FTP v1 0 serial keygen.zip" Wed 16 May 2007 25,322 ...HR --- "C:\WINDOWS\Temp\EMULE3e9\Socrat Internet Polyglot v3.0 serial keygen.zip" Wed 16 May 2007 26,720 ...HR --- "C:\WINDOWS\Temp\EMULE3e9\Soldier of Fortune serial keygen.zip" Wed 16 May 2007 25,366 ...HR --- "C:\WINDOWS\Temp\EMULE3e9\Sonic Foundry Vegas v4.0e serial keygen.zip" Wed 16 May 2007 25,135 ...HR --- "C:\WINDOWS\Temp\EMULE3e9\Spacestation Pheta v2 7 serial keygen.zip" Wed 16 May 2007 26,506 ...HR --- "C:\WINDOWS\Temp\EMULE3e9\Steganos Internet Spuren Vernichter v7 0 serial keygen.zip" Wed 16 May 2007 25,526 ...HR --- "C:\WINDOWS\Temp\EMULE3e9\Steganos Anonym v7.07 serial keygen.zip" Wed 16 May 2007 25,116 ...HR --- "C:\WINDOWS\Temp\EMULE3e9\Steganos Internet Anonym v7.x serial keygen.zip" Wed 16 May 2007 25,683 ...HR --- "C:\WINDOWS\Temp\EMULE3e9\Super Internet TV v6 1 serial keygen.zip" Wed 16 May 2007 26,906 ...HR --- "C:\WINDOWS\Temp\EMULE3e9\Super Jigsaw Landscapes serial keygen.zip" Wed 16 May 2007 26,594 ...HR --- "C:\WINDOWS\Temp\EMULE3e9\Terminator 3 - War of the Machines serial keygen.zip" Wed 16 May 2007 25,528 ...HR --- "C:\WINDOWS\Temp\EMULE3e9\Terminator 3 War Of The Machines v1.0 serial keygen.zip" Wed 16 May 2007 25,224 ...HR --- "C:\WINDOWS\Temp\EMULE3e9\The All Seeing Eye serial keygen.zip" Wed 16 May 2007 26,965 ...HR --- "C:\WINDOWS\Temp\EMULE3e9\The Sims On Vacation serial keygen.zip" Wed 16 May 2007 25,576 ...HR --- "C:\WINDOWS\Temp\EMULE3e9\TMPGEnc DVD Author v1.5.13.44 serial keygen.zip" Wed 16 May 2007 25,254 ...HR --- "C:\WINDOWS\Temp\EMULE3e9\Total Recorder Standard v5.0 serial keygen.zip" Wed 16 May 2007 25,586 ...HR --- "C:\WINDOWS\Temp\EMULE3e9\Trash it! v1.71 serial keygen.zip" Wed 16 May 2007 25,242 ...HR --- "C:\WINDOWS\Temp\EMULE3e9\Turbo Cad Pro 10 serial keygen.zip" Wed 16 May 2007 25,573 ...HR --- "C:\WINDOWS\Temp\EMULE3e9\Ulead Photo Explorer v8.5 serial keygen.zip" Wed 16 May 2007 25,032 ...HR --- "C:\WINDOWS\Temp\EMULE3e9\VirtuaGirl v2.52 Retail serial keygen.zip" Wed 16 May 2007 25,256 ...HR --- "C:\WINDOWS\Temp\EMULE3e9\Warcraft 3 serial keygen.zip" Wed 16 May 2007 25,485 ...HR --- "C:\WINDOWS\Temp\EMULE3e9\WebServer v1.0 serial keygen.zip" Wed 16 May 2007 25,692 ...HR --- "C:\WINDOWS\Temp\EMULE3e9\WinImage v6.30.6136 serial keygen.zip" Wed 16 May 2007 26,755 ...HR --- "C:\WINDOWS\Temp\EMULE3e9\WinRescue 95 v10.08.18 serial keygen.zip" Wed 16 May 2007 25,036 ...HR --- "C:\WINDOWS\Temp\EMULE3e9\WinWorks95 serial keygen.zip" Wed 6 Jun 2007 30,740 A.SH. --- "C:\Documents and Settings\Kasia.KSIEGOWOSC\Local Settings\Temp\evvuernv.dll" Sun 12 Aug 2007 20 A.SH. --- "C:\Documents and Settings\Kasia.KSIEGOWOSC\Local Settings\Temp\hkqxhjos.dll" Tue 4 Jun 2002 84,992 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\14_43260.dll" Tue 4 Jun 2002 44,032 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\28_83260.dll" Tue 10 Dec 2002 73,766 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\atrc3260.dll" Tue 10 Dec 2002 65,575 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\cook3260.dll" Tue 4 Jun 2002 20,480 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\dnet3260.dll" Tue 10 Dec 2002 176,165 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\drv23260.dll" Tue 10 Dec 2002 94,208 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\drv33260.dll" Tue 10 Dec 2002 217,127 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\drv43260.dll" Sat 3 Nov 2001 225,280 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\ivvideo.dll" Tue 10 Apr 2001 225,280 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\qtmlClient.dll" Fri 20 Feb 2004 548,940 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\raac.dll" Tue 10 Dec 2002 102,439 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\sipr3260.dll" Finished!

jesli chodzi o combofix'a to okno robi sie czerwone i pisze the above environement variable was found to be corrupted

i jeszcze: pasek startu zmienil kolor z blekitnego na szary.

**Posty:** 18165 · przez **wojtas** 28 Wrz 2007, 15:19

zastosuj:

smitfraudfix z opcji 2:

http://siri.urz.free.fr/Fix/SmitfraudFix.exe

oraz te skanery po kilka razy

VundoFix
http://www.atribune.org/ccount/click.php?id=4

VirtumundoBeGone
http://secured2k.home.comcast.net/tools/VirtumundoBeGone.exe

FixVundo
http://securityresponse.symantec.com/avcenter/FixVundo.exe

prosba o sprawdzenie logów

Prosba o sprawdzenie logów

Kto jest na forum