prosze loga do sprawdzenia

**Posty:** 319 · przez **hugo91** 09 Kwi 2007, 17:10

Witam...
Log do sprawdzenia komp tnie jak poje*****, bear share tez na smietnik

Kod: Zaznacz wszystko: Logfile of HijackThis v1.99.1 Scan saved at 16:58:25, on 2007-04-09 Platform: Windows XP (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 (6.00.2600.0000) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\csrss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\devldr32.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\System32\CTsvcCDA.EXE C:\WINDOWS\System32\nvsvc32.exe C:\WINDOWS\System32\HPZipm12.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Winamp\winampa.exe C:\Program Files\Creative\SBLive\AudioHQ\AHQTB.EXE C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\Program Files\Messenger\msmsgs.exe C:\Program Files\Creative\SBLive\PlayCenter2\CTNMRun.exe C:\WINDOWS\System32\MsPMSPSv.exe C:\Program Files\SEC\Natural Color\NaturalColorLoad.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\Program Files\Alwil Software\Avast4\setup\avast.setup C:\WINDOWS\System32\WgaTray.exe C:\WINDOWS\System32\wbem\wmiprvse.exe C:\Program Files\Gadu-Gadu\gg.exe C:\Documents and Settings\Kinia\Ustawienia lokalne\Temp\Katalog tymczasowy 3 dla hijackthis_199.zip\HijackThis.exe C:\WINDOWS\System32\wuauclt.exe C:\WINDOWS\System32\svchost.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://search.bearshare.com/sidebar.html?src=ssb R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://search.bearshare.com/sidebar.html?src=ssb R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://search.bearshare.com/sidebar.html?src=ssb R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.pl/ R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://search.bearshare.com/sidebar.html?src=ssb R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza R3 - URLSearchHook: BearShare MediaBar - {D3DEE18F-DB64-4BEB-9FF1-E1F0A5033E4A} - C:\Program Files\BearShare applications\BearShare MediaBar\MediaBar.dll O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll O2 - BHO: XBTP02634 - {F97DA966-F09D-4cab-BF29-75A0026986EA} - C:\PROGRA~1\BEARSH~1\BEARSH~2\MediaBar.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll O3 - Toolbar: BearShare MediaBar - {D3DEE18F-DB64-4BEB-9FF1-E1F0A5033E4A} - C:\Program Files\BearShare applications\BearShare MediaBar\MediaBar.dll O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\Updreg.exe O4 - HKLM\..\Run: [AHQInit] C:\Program Files\Creative\SBLive\Program\AHQInit.exe O4 - HKLM\..\Run: [AudioHQ] C:\Program Files\Creative\SBLive\AudioHQ\AHQTB.EXE O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - HKCU\..\Run: [NOMAD Detector] "C:\Program Files\Creative\SBLive\PlayCenter2\CTNMRun.exe" O4 - HKCU\..\Run: [Windows update loader] C:\Windows\xpupdate.exe O4 - HKCU\..\Run: [SpyMarshal] C:\Program Files\SpyMarshal\SpyMarshal.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE O4 - Global Startup: NaturalColorLoad.lnk = ? O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm O9 - Extra button: eBay - Homepage - {EF79EAC5-3452-4E02-B8BD-BA4C89F1AC7A} - C:\Program Files\IrfanView\Ebay\Ebay.htm O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.exe.imgfarm.com/images/nocache/funwebproducts/ei/ZwinkyInitialSetup1.0.0.15.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{631D21E3-95A5-4F98-BA21-1E94F16DAB54}: NameServer = 85.255.116.43,85.255.112.145 O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.116.43 85.255.112.145 O17 - HKLM\System\CS2\Services\Tcpip\Parameters: NameServer = 85.255.116.43 85.255.112.145 O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.116.43 85.255.112.145 O20 - AppInit_DLLs: O20 - Winlogon Notify: rpcc - C:\WINDOWS\System32\rpcc.dll O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing) O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.EXE O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe O23 - Service: Windows Management Service - Unknown owner - C:\WINDOWS\System32\.exe (file missing)

**Posty:** 18165 · przez **wojtas** 09 Kwi 2007, 17:13

odpal SmitfraudFix z opcji 2

http://siri.urz.free.fr/Fix/SmitfraudFix.php
opis >>

http://forum.programosy.pl/trudne-przypadki-i-metody-usuwania-vt41947.html

i przejedź nim dysk.

Ściągnij program http://downloads.subratam.org/Fixwareout.exe i zastosuj go.

Po zabiegach dajesz nowy log

**Posty:** 319 · przez **hugo91** 09 Kwi 2007, 20:51

Kod: Zaznacz wszystko: Logfile of HijackThis v1.99.1 Scan saved at 20:40:01, on 2007-04-09 Platform: Windows XP (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 (6.00.2600.0000) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\System32\CTsvcCDA.EXE C:\WINDOWS\System32\nvsvc32.exe C:\WINDOWS\System32\HPZipm12.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\MsPMSPSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\WINDOWS\System32\WgaTray.exe C:\WINDOWS\System32\wuauclt.exe C:\Program Files\Winamp\winampa.exe C:\Program Files\Creative\SBLive\AudioHQ\AHQTB.EXE C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\Program Files\Messenger\msmsgs.exe C:\Program Files\Gadu-Gadu\gg.exe C:\Program Files\Creative\SBLive\PlayCenter2\CTNMRun.exe C:\Program Files\SEC\Natural Color\NaturalColorLoad.exe C:\WINDOWS\System32\wuauclt.exe C:\Documents and Settings\Kinia\Ustawienia lokalne\Temp\Katalog tymczasowy 4 dla hijackthis_199.zip\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://search.bearshare.com/sidebar.html?src=ssb R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://search.bearshare.com/sidebar.html?src=ssb R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://search.bearshare.com/sidebar.html?src=ssb R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.pl/ R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://search.bearshare.com/sidebar.html?src=ssb R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza R3 - URLSearchHook: BearShare MediaBar - {D3DEE18F-DB64-4BEB-9FF1-E1F0A5033E4A} - C:\Program Files\BearShare applications\BearShare MediaBar\MediaBar.dll O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll O2 - BHO: XBTP02634 - {F97DA966-F09D-4cab-BF29-75A0026986EA} - C:\PROGRA~1\BEARSH~1\BEARSH~2\MediaBar.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll O3 - Toolbar: BearShare MediaBar - {D3DEE18F-DB64-4BEB-9FF1-E1F0A5033E4A} - C:\Program Files\BearShare applications\BearShare MediaBar\MediaBar.dll O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\Updreg.exe O4 - HKLM\..\Run: [AHQInit] C:\Program Files\Creative\SBLive\Program\AHQInit.exe O4 - HKLM\..\Run: [AudioHQ] C:\Program Files\Creative\SBLive\AudioHQ\AHQTB.EXE O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - HKCU\..\Run: [NOMAD Detector] "C:\Program Files\Creative\SBLive\PlayCenter2\CTNMRun.exe" O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE O4 - Global Startup: NaturalColorLoad.lnk = ? O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm O9 - Extra button: eBay - Homepage - {EF79EAC5-3452-4E02-B8BD-BA4C89F1AC7A} - C:\Program Files\IrfanView\Ebay\Ebay.htm O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.exe.imgfarm.com/images/nocache/funwebproducts/ei/ZwinkyInitialSetup1.0.0.15.cab O20 - AppInit_DLLs: O20 - Winlogon Notify: rpcc - C:\WINDOWS\System32\rpcc.dll O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing) O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.EXE O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe

nawet nawet smiga

**Posty:** 18165 · przez **wojtas** 09 Kwi 2007, 21:09

Wyłącz przywracanie systemu ( właściwości mój komputer-zakładka przywracanie - wyłącz przywracanie na wszystkich dyskach)
Start do awaryjnego ( F8 ) przy starcie komputera.

sciagnij killbox`a:

http://www.wiruskill.pl/forum/viewtopic.php?t=58

Odpalasz Killboxa zaznacz opcję Delete on Reboot następnie w polu Full Path of File to Delete wklej ścieżkę :

C:\WINDOWS\system32\rpcc.dll

i nacisnij x
Program będzie pytał o restart (oczywiście zgadzasz się)

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://search.bearshare.com/sidebar.html?src=ssb
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://search.bearshare.com/sidebar.html?src=ssb
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://search.bearshare.com/sidebar.html?src=ssb
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://search.bearshare.com/sidebar.html?src=ssb
R3 - URLSearchHook: BearShare MediaBar - {D3DEE18F-DB64-4BEB-9FF1-E1F0A5033E4A} - C:\Program Files\BearShare applications\BearShare MediaBar\MediaBar.dll
O2 - BHO: XBTP02634 - {F97DA966-F09D-4cab-BF29-75A0026986EA} - C:\PROGRA~1\BEARSH~1\BEARSH~2\MediaBar.dll
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.exe.imgfarm.com/images/nocache/funwebproducts/ei/ZwinkyInitialSetup1.0.0.15.cab
O20 - AppInit_DLLs:
O20 - Winlogon Notify: rpcc - C:\WINDOWS\System32\rpcc

Odpalasz hijackthis i zaznaczasz ptaszkami powyższe wpisy i dajesz Fix checked.
Pogrubione pliki usuwasz ręcznie z dysku
potem nowe logi z Hijack This oraz Silent runners

**Posty:** 319 · przez **hugo91** 10 Kwi 2007, 11:05

takie cos wyskakuje jak chce usunac to rpcc.dll

logi:

Kod: Zaznacz wszystko: Logfile of HijackThis v1.99.1 Scan saved at 10:37:50, on 2007-04-10 Platform: Windows XP (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 (6.00.2600.0000) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\Program Files\Winamp\winampa.exe C:\WINDOWS\System32\CTsvcCDA.EXE C:\WINDOWS\System32\nvsvc32.exe C:\WINDOWS\System32\HPZipm12.exe C:\Program Files\Creative\SBLive\AudioHQ\AHQTB.EXE C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\Program Files\Messenger\msmsgs.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\MsPMSPSv.exe C:\Program Files\Gadu-Gadu\gg.exe C:\Program Files\Creative\SBLive\PlayCenter2\CTNMRun.exe C:\Program Files\SEC\Natural Color\NaturalColorLoad.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\WINDOWS\System32\WgaTray.exe C:\WINDOWS\System32\wuauclt.exe C:\WINDOWS\System32\wuauclt.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Documents and Settings\Kinia\Pulpit\Nowy folder\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.pl/ R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll O3 - Toolbar: BearShare MediaBar - {D3DEE18F-DB64-4BEB-9FF1-E1F0A5033E4A} - C:\Program Files\BearShare applications\BearShare MediaBar\MediaBar.dll (file missing) O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\Updreg.exe O4 - HKLM\..\Run: [AHQInit] C:\Program Files\Creative\SBLive\Program\AHQInit.exe O4 - HKLM\..\Run: [AudioHQ] C:\Program Files\Creative\SBLive\AudioHQ\AHQTB.EXE O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - HKCU\..\Run: [NOMAD Detector] "C:\Program Files\Creative\SBLive\PlayCenter2\CTNMRun.exe" O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE O4 - Global Startup: NaturalColorLoad.lnk = ? O9 - Extra button: eBay - Homepage - {EF79EAC5-3452-4E02-B8BD-BA4C89F1AC7A} - C:\Program Files\IrfanView\Ebay\Ebay.htm O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing) O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.EXE O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe

silient

bedzie za chwile bo juz chyba jedzie przez 10 min

[ Dodano: Dzisiaj o 11:20 ]
prawie 30 min spox

Kod: Zaznacz wszystko: "Silent Runners.vbs", revision R50, http://www.silentrunners.org/ Operating System: Windows XP Output limited to non-default values, except where indicated by "{++}" Startup items buried in registry: --------------------------------- HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ {++} "MSMSGS" = ""C:\Program Files\Messenger\msmsgs.exe" /background" [MS] "Gadu-Gadu" = ""C:\Program Files\Gadu-Gadu\gg.exe" /tray" ["sms-express.com"] "NOMAD Detector" = ""C:\Program Files\Creative\SBLive\PlayCenter2\CTNMRun.exe"" ["Creative Technology Ltd."] HKLM\Software\Microsoft\Windows\CurrentVersion\Run\ {++} "NvCplDaemon" = "RUNDLL32.EXE NvQTwk,NvCplDaemon initialize" [MS] "WinampAgent" = "C:\Program Files\Winamp\winampa.exe" [null data] "UpdReg" = "C:\WINDOWS\Updreg.exe" ["Creative Technology Ltd."] "AHQInit" = "C:\Program Files\Creative\SBLive\Program\AHQInit.exe" ["Creative Technology Ltd"] "AudioHQ" = "C:\Program Files\Creative\SBLive\AudioHQ\AHQTB.EXE" ["Creative Technology Ltd."] "avast!" = "C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [null data] HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\(Default) = (no title provided) -> {HKLM...CLSID} = "AcroIEHlprObj Class" \InProcServer32\(Default) = "C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx" [empty string] {761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\(Default) = (no title provided) -> {HKLM...CLSID} = "SSVHelper Class" \InProcServer32\(Default) = "C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll" ["Sun Microsystems, Inc."] {AA58ED58-01DD-4d91-8333-CF10577473F7}\(Default) = (no title provided) -> {HKLM...CLSID} = "Google Toolbar Helper" \InProcServer32\(Default) = "c:\program files\google\googletoolbar3.dll" ["Google Inc."] HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\ "{42071714-76d4-11d1-8b24-00a0c9068ff3}" = "Rozszerzenie CPL kadrowania wyświetlania" -> {HKLM...CLSID} = "Rozszerzenie CPL kadrowania wyświetlania" \InProcServer32\(Default) = "deskpan.dll" [file not found] "{88895560-9AA2-1069-930E-00AA0030EBC8}" = "Rozszerzenie ikony HyperTerminalu" -> {HKLM...CLSID} = "HyperTerminal Icon Ext" \InProcServer32\(Default) = "C:\WINDOWS\System32\hticons.dll" ["Hilgraeve, Inc."] "{0006F045-0000-0000-C000-000000000046}" = "Microsoft Outlook Custom Icon Handler" -> {HKLM...CLSID} = "Rozszerzenie ikon plików programu Outlook" \InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\Office\OLKFSTUB.DLL" [MS] "{472083B0-C522-11CF-8763-00608CC02F24}" = "avast" -> {HKLM...CLSID} = "avast" \InProcServer32\(Default) = "C:\Program Files\Alwil Software\Avast4\ashShell.dll" ["ALWIL Software"] HKLM\Software\Classes\*\shellex\ContextMenuHandlers\ avast\(Default) = "{472083B0-C522-11CF-8763-00608CC02F24}" -> {HKLM...CLSID} = "avast" \InProcServer32\(Default) = "C:\Program Files\Alwil Software\Avast4\ashShell.dll" ["ALWIL Software"] WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\ WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\ avast\(Default) = "{472083B0-C522-11CF-8763-00608CC02F24}" -> {HKLM...CLSID} = "avast" \InProcServer32\(Default) = "C:\Program Files\Alwil Software\Avast4\ashShell.dll" ["ALWIL Software"] WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] Group Policies {GPedit.msc branch and setting}: ----------------------------------------------- Note: detected settings may not have any effect. HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\ "ClassicShell" = (REG_DWORD) hex:0x00000000 {User Configuration|Administrative Templates|Windows Components|Windows Explorer| Enable Classic Shell / Turn on Classic Shell} HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\ "shutdownwithoutlogon" = (REG_DWORD) hex:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| Shutdown: Allow system to be shut down without having to log on} "undockwithoutlogon" = (REG_DWORD) hex:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| Devices: Allow undock without having to log on} Active Desktop and Wallpaper: ----------------------------- Active Desktop may be disabled at this entry: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState Displayed if Active Desktop enabled and wallpaper not set by Group Policy: HKCU\Software\Microsoft\Internet Explorer\Desktop\General\ "Wallpaper" = "C:\Documents and Settings\Kinia\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp" Displayed if Active Desktop disabled and wallpaper not set by Group Policy: HKCU\Control Panel\Desktop\ "Wallpaper" = "C:\Documents and Settings\Kinia\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp" Enabled Screen Saver: --------------------- HKCU\Control Panel\Desktop\ "SCRNSAVE.EXE" = "C:\WINDOWS\System32\logon.scr" [MS] Startup items in "Kinia" & "All Users" startup folders: ------------------------------------------------------- C:\Documents and Settings\All Users\Menu Start\Programy\Autostart "Microsoft Office" -> shortcut to: "C:\Program Files\Microsoft Office\Office\OSA9.EXE -b -l" [MS] "NaturalColorLoad" -> shortcut to: "C:\Program Files\SEC\Natural Color\NaturalColorLoad.exe" [empty string] Winsock2 Service Provider DLLs: ------------------------------- Namespace Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++} 000000000001\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS] 000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS] 000000000003\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS] Transport Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++} 0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range: %SystemRoot%\system32\mswsock.dll [MS], 01 - 03, 06 - 15 %SystemRoot%\system32\rsvpsp.dll [MS], 04 - 05 Toolbars, Explorer Bars, Extensions: ------------------------------------ Toolbars HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\ "{2318C2B1-4965-11D4-9B18-009027A5CD4F}" -> {HKLM...CLSID} = "&Google" \InProcServer32\(Default) = "c:\program files\google\googletoolbar3.dll" ["Google Inc."] "{D3DEE18F-DB64-4BEB-9FF1-E1F0A5033E4A}" -> {HKLM...CLSID} = "BearShare MediaBar" \InProcServer32\(Default) = "C:\Program Files\BearShare applications\BearShare MediaBar\MediaBar.dll" [file not found] HKLM\Software\Microsoft\Internet Explorer\Toolbar\ "{2318C2B1-4965-11D4-9B18-009027A5CD4F}" = (no title provided) -> {HKLM...CLSID} = "&Google" \InProcServer32\(Default) = "c:\program files\google\googletoolbar3.dll" ["Google Inc."] "{D3DEE18F-DB64-4BEB-9FF1-E1F0A5033E4A}" = (no title provided) -> {HKLM...CLSID} = "BearShare MediaBar" \InProcServer32\(Default) = "C:\Program Files\BearShare applications\BearShare MediaBar\MediaBar.dll" [file not found] Extensions (Tools menu items, main toolbar menu buttons) HKLM\Software\Microsoft\Internet Explorer\Extensions\ {EF79EAC5-3452-4E02-B8BD-BA4C89F1AC7A}\ "ButtonText" = "eBay - Homepage" "CLSIDExtension" = "{1FBA04EE-3024-11D2-8F1F-0000F87ABD16}" -> {HKLM...CLSID} = "Toolbar Extension for Executable" \InProcServer32\(Default) = "C:\WINDOWS\System32\shdocvw.dll" [MS] "Exec" = "C:\Program Files\IrfanView\Ebay\Ebay.htm" [null data] Running Services (Display Name, Service Name, Path {Service DLL}): ------------------------------------------------------------------ avast! Antivirus, avast! Antivirus, ""C:\Program Files\Alwil Software\Avast4\ashServ.exe"" [null data] avast! iAVS4 Control Service, aswUpdSv, ""C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe"" [null data] avast! Web Scanner, avast! Web Scanner, ""C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service" ["ALWIL Software"] Creative Service for CDROM Access, Creative Service for CDROM Access, "C:\WINDOWS\System32\CTsvcCDA.EXE" ["Creative Technology Ltd"] NVIDIA Driver Helper Service, NVSvc, "C:\WINDOWS\System32\nvsvc32.exe" ["NVIDIA Corporation"] Pml Driver HPZ12, Pml Driver HPZ12, "C:\WINDOWS\System32\HPZipm12.exe" ["HP"] WMDM PMSP Service, WMDM PMSP Service, "C:\WINDOWS\System32\MsPMSPSv.exe" [MS] Print Monitors: --------------- HKLM\System\CurrentControlSet\Control\Print\Monitors\ LIDIL hpzll43a\Driver = "hpzll43a.dll" ["Hewlett-Packard Company"] ---------- + This report excludes default entries except where indicated. + To see *everywhere* the script checks and *everything* it finds, launch it from a command prompt or a shortcut with the -all parameter. + The search for DESKTOP.INI DLL launch points on all local fixed drives took 251 seconds. ---------- (total run time: 1774 seconds)

**Posty:** 18165 · przez **wojtas** 10 Kwi 2007, 11:20

do skasowania masz

O3 - Toolbar: BearShare MediaBar - {D3DEE18F-DB64-4BEB-9FF1-E1F0A5033E4A} - C:\Program Files\BearShare applications\BearShare MediaBar\MediaBar.dll (file missing)

sciagnij:
ATF_Cleaner
http://www.atribune.org/ccount/click.php?id=1
zaznacz
Windows Temp
Temporary internet files
i wcisnij EMPTY SELECTED

Pobierz i uruchom narzędzie : The Avenger
http://swandog46.geekstogo.com/avenger.zip
Zaznacz opcję Input script manually i kliknij na Lupkę z prawej strony. W okienku, które się otworzy wklejasz:

Files to delete:

C:\WINDOWS\system32\rpcc.dll

Klikasz Done, a następnie zielone światełko i zgadzasz się na restart klikając OK.

wklejasz do notatnika:

Windows Registry Editor Version 5.00

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser]
"{D3DEE18F-DB64-4BEB-9FF1-E1F0A5033E4A}"=-

[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar]
"{D3DEE18F-DB64-4BEB-9FF1-E1F0A5033E4A}"=-

w notatniku u góry>>>plik zapisz jako>>>Zmien rozszerzenie z TXT na Wszystkie pliki *.* >>> Zapisz pod nazwą FIX.REG

Klikasz dwa razy na powstały plik fix i dodajesz go do rejestru....

Kasujesz ręcznie z dysku plik: C:\Avenger\backup.zip i wklejasz na forum raport: C:\avenger.txt + silent runners + comboscan

http://forum.programosy.pl/dodatkowe-narzedzia-do-usuwania-i-ochrony-vt42021.html

**Posty:** 319 · przez **hugo91** 10 Kwi 2007, 13:53

avenger

Kod: Zaznacz wszystko: ////////////////////////////////////////// Avenger Pre-Processor log ////////////////////////////////////////// Error: could not create zip file. Error code: 1813 ////////////////////////////////////////// Logfile of The Avenger version 1, by Swandog46 Running from registry key: \Registry\Machine\System\CurrentControlSet\Services\vexbfsyl ******************* Script file located at: \??\C:\Documents and Settings\petuyjuq.txt Script file opened successfully. Script file read successfully Backups directory opened successfully at C:\Avenger ******************* Beginning to process script file: File C:\WINDOWS\system32\rpcc.dll not found! Deletion of file C:\WINDOWS\system32\rpcc.dll failed! Could not process line: C:\WINDOWS\system32\rpcc.dll Status: 0xc0000034 Completed script processing. ******************* Finished! Terminate.

Kod: Zaznacz wszystko: ComboScan v20070306.20 run by Kinia on 2007-04-10 at 13:26:19 Computer is in Normal Mode. -------------------------------------------------------------------------------- -- System Restore -------------------------------------------------------------- System Restore is disabled; attempting to re-enable...success. -- Last 1 Restore Point(s) -- 1: 2007-04-10 11:26:27 UTC - RP1 - Punkt kontrolny systemu Performed disk cleanup. -- HijackThis (run as Kinia.exe) ----------------------------------------------- Logfile of HijackThis v1.99.1 Scan saved at 13:27:55, on 2007-04-10 Platform: Windows XP (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 (6.00.2600.0000) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Winamp\winampa.exe C:\Program Files\Creative\SBLive\AudioHQ\AHQTB.EXE C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\Program Files\Messenger\msmsgs.exe C:\Program Files\Gadu-Gadu\gg.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Creative\SBLive\PlayCenter2\CTNMRun.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\Program Files\SEC\Natural Color\NaturalColorLoad.exe C:\WINDOWS\System32\CTsvcCDA.EXE C:\WINDOWS\System32\nvsvc32.exe C:\WINDOWS\System32\HPZipm12.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\MsPMSPSv.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\WINDOWS\System32\WgaTray.exe C:\WINDOWS\System32\wuauclt.exe C:\WINDOWS\System32\WScript.exe G:\comboscan.exe C:\DOCUME~1\Kinia\Pulpit\NOWYFO~1\Kinia.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.pl/ R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\Updreg.exe O4 - HKLM\..\Run: [AHQInit] C:\Program Files\Creative\SBLive\Program\AHQInit.exe O4 - HKLM\..\Run: [AudioHQ] C:\Program Files\Creative\SBLive\AudioHQ\AHQTB.EXE O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - HKCU\..\Run: [NOMAD Detector] "C:\Program Files\Creative\SBLive\PlayCenter2\CTNMRun.exe" O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE O4 - Global Startup: NaturalColorLoad.lnk = ? O9 - Extra button: eBay - Homepage - {EF79EAC5-3452-4E02-B8BD-BA4C89F1AC7A} - C:\Program Files\IrfanView\Ebay\Ebay.htm O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing) O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.EXE O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe -- HijackThis Fixed Entries (C:\DOCUME~1\Kinia\Pulpit\NOWYFO~1\backups\) ------- backup-20070410-102739-968 O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm (file missing) backup-20070410-102740-389 O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm (file missing) backup-20070410-102740-797 O20 - Winlogon Notify: rpcc - C:\WINDOWS\System32\rpcc.dll (file missing) backup-20070410-130830-350 O3 - Toolbar: BearShare MediaBar - {D3DEE18F-DB64-4BEB-9FF1-E1F0A5033E4A} - C:\Program Files\BearShare applications\BearShare MediaBar\MediaBar.dll (file missing) -- File Associations ----------------------------------------------------------- .bat - batfile - "%1" %* .chm - chm.file - "C:\WINDOWS\hh.exe" %1 .cmd - cmdfile - "%1" %* .com - comfile - "%1" %* .exe - exefile - "%1" %* .hlp - hlpfile - %SystemRoot%\System32\winhlp32.exe %1 .inf - inffile - %SystemRoot%\System32\NOTEPAD.EXE %1 .ini - inifile - %SystemRoot%\System32\NOTEPAD.EXE %1 .js - JSFile - %SystemRoot%\System32\WScript.exe "%1" %* .lnk - lnkfile - {00021401-0000-0000-C000-000000000046} .pif - piffile - "%1" %* .reg - regfile - regedit.exe "%1" .scr - scrfile - "%1" /S .txt - txtfile - %SystemRoot%\system32\NOTEPAD.EXE %1 .vbs - VBSFile - %SystemRoot%\System32\WScript.exe "%1" %* -- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------- 1R Aavmker4 (avast! Asynchronous Virus Monitor) - C:\WINDOWS\system32\drivers\aavmker4.sys 2R aswMon2 (avast! Standard Shield Support) - C:\WINDOWS\system32\drivers\aswmon2.sys 3R aswRdr - C:\WINDOWS\system32\drivers\aswRdr.sys 1R aswTdi (avast! Network Shield Support) - C:\WINDOWS\system32\drivers\aswTdi.sys 3R ctljystk (Port gier dla karty Creative SB Live!) - C:\WINDOWS\system32\drivers\ctljystk.sys 3R emu10k (Creative SB Live! series(WDM)) - C:\WINDOWS\system32\drivers\emu10k1f.sys 3R emu10k1 (Creative Interface Manager Driver (WDM)) - C:\WINDOWS\system32\drivers\ctlface.sys 3S HPZid412 (IEEE-1284.4 Driver HPZid412) - C:\WINDOWS\system32\drivers\HPZid412.sys 3S HPZipr12 (Print Class Driver for IEEE-1284.4 HPZipr12) - C:\WINDOWS\system32\drivers\HPZipr12.sys 3S HPZius12 (USB to IEEE-1284.4 Translation Driver HPZius12) - C:\WINDOWS\system32\drivers\HPZius12.sys 3S hSONYPVh - C:\DOCUME~1\Kinia\USTAWI~1\Temp\hSONYPVh.sys (not found) 3R nv - C:\WINDOWS\system32\drivers\nv4_mini.sys 2R PfModNT - C:\WINDOWS\system32\PfModNT.sys 0R PxHelp20 - C:\WINDOWS\system32\drivers\pxhelp20.sys 3R rtl8139 (Sterownik NT karty Realtek RTL8139(A/B/C)-based PCI Fast Ethernet) - C:\WINDOWS\system32\drivers\RTL8139.sys 3R sfman (Creative SoundFont Manager Driver (WDM)) - C:\WINDOWS\system32\drivers\sfman.sys 3S usbccgp (Rodzajowy sterownik nadrzędny USB Microsoft) - C:\WINDOWS\system32\drivers\usbccgp.sys 3S usbprint (Klasa PRINTER USB Microsoft) - C:\WINDOWS\system32\drivers\usbprint.sys 3S usbscan (Sterownik skanera USB) - C:\WINDOWS\system32\drivers\usbscan.sys 3S usbsermpt (Motorola USB Modem Driver for MPT) - C:\WINDOWS\system32\drivers\usbsermpt.sys 3R USBSTOR (Sterownik magazynu masowego USB) - C:\WINDOWS\system32\drivers\USBSTOR.SYS 0R viaagp (Filtr magistrali AGP VIA) - C:\WINDOWS\system32\drivers\VIAAGP.SYS 0R xmasbus - C:\WINDOWS\system32\drivers\xmasbus.sys 0R xmasscsi - C:\WINDOWS\system32\drivers\xmasscsi.sys -- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled -------------------- 2R aswUpdSv (avast! iAVS4 Control Service) - "C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe" 2R avast! Antivirus - "C:\Program Files\Alwil Software\Avast4\ashServ.exe" 3R avast! Web Scanner - "C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service 2R Creative Service for CDROM Access - C:\WINDOWS\System32\CTsvcCDA.EXE 3S gusvc (Google Updater Service) - "C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe" 2R NVSvc (NVIDIA Driver Helper Service) - C:\WINDOWS\System32\nvsvc32.exe 2R Pml Driver HPZ12 - C:\WINDOWS\System32\HPZipm12.exe 3S SCardDrv (Pomocnik karty inteligentnej) - C:\WINDOWS\System32\SCardSvr.exe 2R uploadmgr (Menedżer przekazywania) - C:\WINDOWS\System32\svchost.exe -k netsvcs 2R WMDM PMSP Service - C:\WINDOWS\System32\MsPMSPSv.exe 2R WmdmPmSp (Numer seryjny nośnika przenośnego) - C:\WINDOWS\System32\svchost.exe -k netsvcs -- Files created between 2007-03-10 and 2007-04-10 ----------------------------- 2007-04-09 20:35:55 0 d-------- C:\fixwareout<FIXWAR~1> 2007-04-09 20:03:36 1788 --a------ C:\WINDOWS\System32\tmp.reg 2007-04-09 20:01:30 79360 --a------ C:\WINDOWS\System32\swxcacls.exe 2007-04-09 20:01:30 40960 --a------ C:\WINDOWS\System32\swsc.exe 2007-04-09 20:01:30 288417 --a------ C:\WINDOWS\System32\SrchSTS.exe 2007-04-09 20:01:30 51200 --a------ C:\WINDOWS\System32\dumphive.exe 2007-04-09 20:01:29 135168 --a------ C:\WINDOWS\System32\swreg.exe 2007-04-09 20:01:29 53248 --a------ C:\WINDOWS\System32\Process.exe 2007-04-09 19:59:50 52805 --a------ C:\WINDOWS\System32\csqgy.exe 2007-04-02 22:21:11 841 --a------ C:\WINDOWS\unins001.dat 2007-04-02 22:21:10 1026 --a------ C:\WINDOWS\unins000.dat 2007-04-02 22:21:10 0 d-------- C:\Program Files\kswiat 2007-04-02 22:18:55 5120 --a------ C:\WINDOWS\System32\ff_vfw.dll 2007-04-02 22:18:52 0 d-------- C:\Program Files\ffdshow 2007-04-02 21:17:04 23352 --a------ C:\WINDOWS\System32\drivers\aswRdr.sys 2007-04-02 21:17:03 43176 --a------ C:\WINDOWS\System32\drivers\aswTdi.sys 2007-04-02 21:17:02 31560 --a------ C:\WINDOWS\System32\drivers\aavmker4.sys 2007-04-02 21:16:55 94424 --a------ C:\WINDOWS\System32\drivers\aswmon2.sys 2007-04-02 21:16:55 85952 --a------ C:\WINDOWS\System32\drivers\aswmon.sys 2007-04-02 21:16:43 348160 --a------ C:\WINDOWS\System32\MSVCR71.dll 2007-04-02 21:16:43 499712 --a------ C:\WINDOWS\System32\MSVCP71.dll 2007-04-02 21:16:43 1060864 --a------ C:\WINDOWS\System32\MFC71.dll 2007-04-02 21:16:43 90112 --a------ C:\WINDOWS\System32\AVASTSS.scr 2007-04-02 21:16:43 689280 --a------ C:\WINDOWS\System32\aswBoot.exe 2007-04-02 21:16:38 0 d-------- C:\Program Files\Alwil Software<ALWILS~1> 2007-04-02 21:15:49 25600 --a------ C:\WINDOWS\System32\xpsp1hfm.exe 2007-04-02 21:15:49 0 d--h---c- C:\WINDOWS\$xpsp1hfm$<$XPSP1~1> 2007-04-02 20:32:27 41984 --a------ C:\WINDOWS\CTREGRUN.EXE 2007-04-02 20:31:53 135040 --a------ C:\WINDOWS\System32\drivers\portcls.sys 2007-04-02 20:31:53 57344 --a------ C:\WINDOWS\System32\drivers\drmk.sys 2007-04-02 20:31:35 90112 --a------ C:\WINDOWS\Updreg.exe 2007-04-02 20:31:27 51200 --a------ C:\WINDOWS\System32\sfman32.dll 2007-04-02 20:31:27 36992 --a------ C:\WINDOWS\System32\drivers\sfman.sys 2007-04-02 20:31:26 495616 --a------ C:\WINDOWS\System32\sblfx.dll 2007-04-02 20:31:26 775296 --a------ C:\WINDOWS\System32\drivers\emu10k1f.sys 2007-04-02 20:31:25 6912 --a------ C:\WINDOWS\System32\drivers\ctlface.sys 2007-04-02 20:31:25 25600 --a------ C:\WINDOWS\System32\devldr32.exe 2007-04-02 20:31:25 352256 --a------ C:\WINDOWS\System32\devcon32.dll 2007-04-02 20:31:25 3584 --a------ C:\WINDOWS\System32\ctwdm32.dll 2007-04-02 20:31:25 59392 --a------ C:\WINDOWS\System32\a3d.dll 2007-04-02 20:30:18 1048576 -----n--- C:\WINDOWS\System32\sfman.dat 2007-04-02 20:30:18 84992 -----n--- C:\WINDOWS\System32\sfcvrt32.dll 2007-04-02 20:30:18 108032 -----n--- C:\WINDOWS\System32\mfcuia32.dll 2007-04-02 20:30:17 149504 -----n--- C:\WINDOWS\System32\mfcans32.dll 2007-04-02 20:30:17 82432 -----n--- C:\WINDOWS\System32\Ctwflt32.dll 2007-04-02 20:30:17 26768 -----n--- C:\WINDOWS\System32\ctl3d.dll 2007-04-02 20:30:17 34816 -----n--- C:\WINDOWS\CTRes32.dll 2007-04-02 20:30:17 24976 -----n--- C:\WINDOWS\ctres.dll 2007-04-02 20:30:17 53552 -----n--- C:\WINDOWS\ctccw.dll 2007-04-02 20:29:00 3584 --a------ C:\WINDOWS\System32\Ahqcpres.dll 2007-04-02 20:28:38 0 d-------- C:\Media 2007-04-02 20:28:37 44032 --a------ C:\WINDOWS\System32\CTSVCCDA.EXE 2007-04-02 20:04:50 65536 --a------ C:\WINDOWS\System32\Gif89.dll 2007-04-02 20:04:47 0 d-------- C:\Program Files\SEC 2007-04-02 18:48:43 0 d-------- C:\WINDOWS\System32\ReinstallBackups<REINST~1> 2007-04-02 18:48:08 5504 --a------ C:\WINDOWS\System32\drivers\xmasscsi.sys 2007-04-02 18:48:08 140800 --a------ C:\WINDOWS\System32\drivers\xmasbus.sys 2007-04-02 18:48:05 0 d-------- C:\Program Files\Alcohol Soft<ALCOHO~1> 2007-04-02 18:46:56 0 d-------- C:\Program Files\IrfanView<IRFANV~1> 2007-04-02 18:39:48 20016 -----n--- C:\WINDOWS\System32\drivers\pxhelp20.sys 2007-04-02 18:39:45 0 d-------- C:\Program Files\Winamp 2007-03-24 11:38:31 0 d-------- C:\Program Files\Max Payne<MAXPAY~1> 2007-03-24 11:28:47 0 d-------- C:\Program Files\HIP GAMES<HIPGAM~1> -- Find3M Report --------------------------------------------------------------- 2007-04-10 12:01:27 0 d-------- C:\Program Files\DC++<DC__~1> 2007-04-09 16:19:53 0 d-------- C:\Program Files\Messenger<MESSEN~1> 2007-04-09 16:08:25 0 d-------- C:\Program Files\MyWebSearch<MYWEBS~1> 2007-04-02 22:21:12 73393 --a------ C:\WINDOWS\unins001.exe 2007-04-02 22:21:12 73393 --a------ C:\WINDOWS\unins000.exe 2007-04-02 22:05:03 0 d-------- C:\Documents and Settings\Kinia\Dane aplikacji\BearShare<BEARSH~1> 2007-04-02 20:32:27 0 d-------- C:\Program Files\Creative 2007-04-02 20:06:36 0 d--h----- C:\Program Files\InstallShield Installation Information<INSTAL~1> 2007-04-02 19:57:26 355830 --a------ C:\WINDOWS\System32\perfh015.dat 2007-04-02 19:57:26 49712 --a------ C:\WINDOWS\System32\perfc015.dat 2007-04-02 17:15:50 0 d---s---- C:\Documents and Settings\Kinia\Dane aplikacji\Microsoft<MICROS~1> 2007-04-02 17:11:12 0 d-------- C:\Documents and Settings\Kinia\Dane aplikacji\Help 2007-03-14 17:23:58 0 d-------- C:\Program Files\Gadu-Gadu<GADU-G~1> 2007-03-02 17:55:57 43520 --a------ C:\WINDOWS\System32\CmdLineExt03.dll<CMDLIN~1.DLL> 2007-03-02 17:16:18 16060 --a------ C:\WINDOWS\System32\16185472ld.exe<161854~1.EXE> 2007-02-18 18:33:01 2920 --a------ C:\WINDOWS\System32\32578462ld.exe<325784~1.EXE> 2007-02-17 20:10:54 29200 --a------ C:\WINDOWS\System32\8195952ld.exe<819595~1.EXE> 2007-02-10 12:40:55 0 d-------- C:\Program Files\Google 2007-02-08 20:03:03 20440 --a------ C:\WINDOWS\System32\33632ld.exe 2007-02-07 17:05:11 11680 --a------ C:\WINDOWS\System32\582142ld.exe 2007-01-15 18:26:21 103782 --a------ C:\WINDOWS\hpoins08.dat -- Registry Dump --------------------------------------------------------------- [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run] "MSMSGS"="\"C:\\Program Files\\Messenger\\msmsgs.exe\" /background" "Gadu-Gadu"="\"C:\\Program Files\\Gadu-Gadu\\gg.exe\" /tray" "NOMAD Detector"="\"C:\\Program Files\\Creative\\SBLive\\PlayCenter2\\CTNMRun.exe\"" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run] "NvCplDaemon"="RUNDLL32.EXE NvQTwk,NvCplDaemon initialize" "WinampAgent"="C:\\Program Files\\Winamp\\winampa.exe" "UpdReg"="C:\\WINDOWS\\Updreg.exe" "AHQInit"="C:\\Program Files\\Creative\\SBLive\\Program\\AHQInit.exe" "AudioHQ"="C:\\Program Files\\Creative\\SBLive\\AudioHQ\\AHQTB.EXE" "avast!"="C:\\PROGRA~1\\ALWILS~1\\Avast4\\ashDisp.exe" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\IMAIL] "Installed"="1" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MAPI] "NoChange"="1" "Installed"="1" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MSFS] "Installed"="1" [HKEY_USERS\.default\software\microsoft\windows\currentversion\run] "CTFMON.EXE"="C:\\WINDOWS\\System32\\CTFMON.EXE" [HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\run] "CTFMON.EXE"="C:\\WINDOWS\\System32\\CTFMON.EXE" [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] @="" [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders] "SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll" [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Svchost] LocalService REG_MULTI_SZ Alerter\0WebClient\0LmHosts\0RemoteRegistry\0upnphost\0SSDPSRV\0\0 NetworkService REG_MULTI_SZ DnsCache\0\0 rpcss REG_MULTI_SZ RpcSs\0\0 imgsvc REG_MULTI_SZ StiSvc\0\0 termsvcs REG_MULTI_SZ TermService\0\0 -- End of ComboScan: finished at 2007-04-10 at 13:29:10 ------------------------

2 combo

Kod: Zaznacz wszystko: ComboScan v20070306.20 run by Kinia on 2007-04-10 at 13:26:19 Supplementary logfile - please post this as an attachment with your post. -------------------------------------------------------------------------------- -- System Information ---------------------------------------------------------- Microsoft Windows XP Professional (build 2600) Architecture: X86; Language: Polish CPU 0: AMD Athlon(tm) XP 1700+ Percentage of Memory in Use: 64% Physical Memory (total/avail): 255.48 MiB / 91.14 MiB Pagefile Memory (total/avail): 618.46 MiB / 445.04 MiB Virtual Memory (total/avail): 2047.88 MiB / 2004.7 MiB A: is Removable (No Media) C: is Fixed (NTFS) - 7.45 GiB total, 3.2 GiB free. D: is Fixed (NTFS) - 14.91 GiB total, 8.59 GiB free. E: is Fixed (FAT32) - 14.89 GiB total, 0.17 GiB free. F: is CDROM (No Media) G: is Removable (FAT) -- Security Center ------------------------------------------------------------- AUOptions is set to notify before install. Windows Internal Firewall is enabled. -- Environment Variables ------------------------------------------------------- ALLUSERSPROFILE=C:\Documents and Settings\All Users APPDATA=C:\Documents and Settings\Kinia\Dane aplikacji CLIENTNAME=Console CommonProgramFiles=C:\Program Files\Common Files COMPUTERNAME=TEKIELI-DU1XS17 ComSpec=C:\WINDOWS\system32\cmd.exe HOMEDRIVE=C: HOMEPATH=\Documents and Settings\Kinia LOGONSERVER=\\TEKIELI-DU1XS17 NUMBER_OF_PROCESSORS=1 OS=Windows_NT Path=C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH PROCESSOR_ARCHITECTURE=x86 PROCESSOR_IDENTIFIER=x86 Family 6 Model 6 Stepping 2, AuthenticAMD PROCESSOR_LEVEL=6 PROCESSOR_REVISION=0602 ProgramFiles=C:\Program Files PROMPT=$P$G SESSIONNAME=Console SystemDrive=C: SystemRoot=C:\WINDOWS TEMP=C:\DOCUME~1\Kinia\USTAWI~1\Temp TMP=C:\DOCUME~1\Kinia\USTAWI~1\Temp USERDOMAIN=TEKIELI-DU1XS17 USERNAME=Kinia USERPROFILE=C:\Documents and Settings\Kinia windir=C:\WINDOWS -- User Profiles --------------------------------------------------------------- Kinia [I](admin)[/I] sen [I](new local, admin)[/I] Administrator.TEKIELI-DU1XS17.000 [I](admin)[/I] -- Add/Remove Programs --------------------------------------------------------- --> C:\Program Files\Creative\SBLive\Program\Upddrv2k.EXE --> C:\WINDOWS\IsUninst.exe -f"C:\Program Files\Creative\News\CTNews.isu" --> C:\WINDOWS\IsUninst.exe -f"C:\Program Files\Creative\SBLive\AudioHQ.isu" --> C:\WINDOWS\IsUninst.exe -f"C:\Program Files\Creative\SBLive\Diagnose.isu" --> C:\WINDOWS\IsUninst.exe -f"C:\Program Files\Creative\SBLive\PlayCenter2\Player2.isu" --> C:\WINDOWS\IsUninst.exe -f"C:\Program Files\Creative\SBLive\Recorder\Recorder.isu" --> C:\WINDOWS\IsUninst.exe -f"C:\Program Files\Creative\SBLive\Restore.isu" --> C:\WINDOWS\IsUninst.exe -f"C:\Program Files\Creative\SBLive\SoundFont.isu" --> C:\WINDOWS\IsUninst.exe -f"C:\Program Files\Creative\SBLive\SurMixer.isu" --> C:\WINDOWS\IsUninst.exe -f"C:\Program Files\Creative\SBLive\WaveStudio\Wstudio.isu" --> C:\WINDOWS\IsUninst.exe -f"C:\Program Files\Creative\Uninstall\Installer.isu" --> rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf Adobe Acrobat 5.0 --> C:\WINDOWS\ISUN0415.EXE -f"C:\Program Files\Common Files\Adobe\Acrobat 5.0 CE\NT\Uninst.isu" -c"C:\Program Files\Common Files\Adobe\Acrobat 5.0 CE\NT\Uninst.dll" Adobe Flash Player 9 ActiveX --> C:\WINDOWS\System32\Macromed\Flash\UninstFl.exe -q Adobe Shockwave Player --> C:\WINDOWS\system32\Macromed\SHOCKW~1\UNWISE.EXE C:\WINDOWS\system32\Macromed\SHOCKW~1\Install.log Alcohol 120% (Trial Version) --> MsiExec.exe /X{E9F81423-211E-46B6-9AE0-38568BC5CF6F} ALLPlayer V2.4 --> "C:\Program Files\MarBit\ALLPlayer\unins000.exe" Archiwizator WinRAR --> C:\Program Files\WinRAR\uninstall.exe Avanquest update --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{76E41F43-59D2-4F30-BA42-9A762EE1E8DE}\Setup.exe" -l0x15 avast! Antivirus --> rundll32 C:\PROGRA~1\ALWILS~1\Avast4\Setup\setiface.dll,RunSetup BearShare --> C:\PROGRA~1\BEARSH~1\BEARSH~1\UNWISE.EXE C:\PROGRA~1\BEARSH~1\BEARSH~1\INSTALL.LOG BearShare MediaBar --> C:\Program Files\BearShare applications\BearShare MediaBar\Uninstall.exe DC++ 0.674 --> "C:\Program Files\DC++\uninstall.exe" eMule Plus 1.2a --> "C:\Program Files\eMule\unins000.exe" ffdshow [rev 187] [2006-09-15] --> "C:\Program Files\ffdshow\unins000.exe" Gadu-Gadu 6.1 --> C:\Program Files\Gadu-Gadu\Setup.exe Garfield --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{7C3A6A3C-4F55-4025-BB8C-7DFBDF090620}\setup.exe" -l0x15 Google Toolbar for Internet Explorer --> regsvr32 /u /s "c:\program files\google\googletoolbar3.dll" HijackThis 1.99.1 --> C:\Documents and Settings\Kinia\Ustawienia lokalne\Temp\Katalog tymczasowy 2 dla hijackthis_199.zip\HijackThis.exe /uninstall HP PSC & OfficeJet 6.1.A --> "C:\Program Files\HP\Digital Imaging\{27555031-A116-4EC6-9991-7B400142A936}\setup\hpzscr01.exe" -datfile hposcr08.dat Iniemamocni - Rodzinka --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{B6E9E262-60FC-43AD-AD3D-EE2A66767ED8}\SETUP.EXE" -l0x15 IrfanView (remove only) --> C:\Program Files\IrfanView\iv_uninstall.exe J2SE Runtime Environment 5.0 Update 9 --> MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0150090} Max Payne --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{ABFD7740-A95F-11D5-B8B5-0050FC1A64AD}\setup.exe" Microsoft Office 2000 Dysk 2 --> MsiExec.exe /I{00040415-78E1-11D2-B60F-006097C998E7} Microsoft Office 2000 Professional --> MsiExec.exe /I{00010415-78E1-11D2-B60F-006097C998E7} Motorola Phone Tools --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\10\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{BAD8CA9C-77C0-4663-B00B-A8D3B13C341B}\setup.exe" -l0x15 -removeonly Natural Color --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{F51D9393-BB14-4566-99BF-D6ED63AEFCD7}\setup.exe" Niezbędnik CD --> C:\WINDOWS\unins000.exe NVIDIA Windows 2000/XP Display Drivers --> rundll32.exe C:\WINDOWS\System32\nvinstnt.dll,NvUninstallNT4 nv4_disp.inf PGGForever 0.1.18 Full --> "C:\Program Files\Gadu-Gadu\unins000.exe" Poprawka systemu Windows XP - KB842773 --> C:\WINDOWS\$NtUninstallKB842773$\spuninst\spuninst.exe Sound Blaster Live! --> C:\Program Files\Creative\Uninstall\CTUNINST.EXE /U:UNINST1.INI VideoLAN VLC media player 0.8.6 --> C:\Program Files\VideoLAN\VLC\uninstall.exe Wesoła Szkoła 2 --> "C:\Program Files\Wesola_Szkola_2\unins000.exe" Winamp (remove only) --> "C:\Program Files\Winamp\UninstWA.exe" -- End of ComboScan: finished at 2007-04-10 at 13:29:10 ------------------------

silent

Kod: Zaznacz wszystko: "Silent Runners.vbs", revision R50, http://www.silentrunners.org/ Operating System: Windows XP Output limited to non-default values, except where indicated by "{++}" Startup items buried in registry: --------------------------------- HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ {++} "MSMSGS" = ""C:\Program Files\Messenger\msmsgs.exe" /background" [MS] "Gadu-Gadu" = ""C:\Program Files\Gadu-Gadu\gg.exe" /tray" ["sms-express.com"] "NOMAD Detector" = ""C:\Program Files\Creative\SBLive\PlayCenter2\CTNMRun.exe"" ["Creative Technology Ltd."] HKLM\Software\Microsoft\Windows\CurrentVersion\Run\ {++} "NvCplDaemon" = "RUNDLL32.EXE NvQTwk,NvCplDaemon initialize" [MS] "WinampAgent" = "C:\Program Files\Winamp\winampa.exe" [null data] "UpdReg" = "C:\WINDOWS\Updreg.exe" ["Creative Technology Ltd."] "AHQInit" = "C:\Program Files\Creative\SBLive\Program\AHQInit.exe" ["Creative Technology Ltd"] "AudioHQ" = "C:\Program Files\Creative\SBLive\AudioHQ\AHQTB.EXE" ["Creative Technology Ltd."] "avast!" = "C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [null data] HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\(Default) = (no title provided) -> {HKLM...CLSID} = "AcroIEHlprObj Class" \InProcServer32\(Default) = "C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx" [empty string] {761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\(Default) = (no title provided) -> {HKLM...CLSID} = "SSVHelper Class" \InProcServer32\(Default) = "C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll" ["Sun Microsystems, Inc."] {AA58ED58-01DD-4d91-8333-CF10577473F7}\(Default) = (no title provided) -> {HKLM...CLSID} = "Google Toolbar Helper" \InProcServer32\(Default) = "c:\program files\google\googletoolbar3.dll" ["Google Inc."] HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\ "{42071714-76d4-11d1-8b24-00a0c9068ff3}" = "Rozszerzenie CPL kadrowania wyświetlania" -> {HKLM...CLSID} = "Rozszerzenie CPL kadrowania wyświetlania" \InProcServer32\(Default) = "deskpan.dll" [file not found] "{88895560-9AA2-1069-930E-00AA0030EBC8}" = "Rozszerzenie ikony HyperTerminalu" -> {HKLM...CLSID} = "HyperTerminal Icon Ext" \InProcServer32\(Default) = "C:\WINDOWS\System32\hticons.dll" ["Hilgraeve, Inc."] "{0006F045-0000-0000-C000-000000000046}" = "Microsoft Outlook Custom Icon Handler" -> {HKLM...CLSID} = "Rozszerzenie ikon plików programu Outlook" \InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\Office\OLKFSTUB.DLL" [MS] "{472083B0-C522-11CF-8763-00608CC02F24}" = "avast" -> {HKLM...CLSID} = "avast" \InProcServer32\(Default) = "C:\Program Files\Alwil Software\Avast4\ashShell.dll" ["ALWIL Software"] "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" = "WinRAR shell extension" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] HKLM\Software\Classes\*\shellex\ContextMenuHandlers\ avast\(Default) = "{472083B0-C522-11CF-8763-00608CC02F24}" -> {HKLM...CLSID} = "avast" \InProcServer32\(Default) = "C:\Program Files\Alwil Software\Avast4\ashShell.dll" ["ALWIL Software"] WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\ WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\ avast\(Default) = "{472083B0-C522-11CF-8763-00608CC02F24}" -> {HKLM...CLSID} = "avast" \InProcServer32\(Default) = "C:\Program Files\Alwil Software\Avast4\ashShell.dll" ["ALWIL Software"] WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] Group Policies {GPedit.msc branch and setting}: ----------------------------------------------- Note: detected settings may not have any effect. HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\ "ClassicShell" = (REG_DWORD) hex:0x00000000 {User Configuration|Administrative Templates|Windows Components|Windows Explorer| Enable Classic Shell / Turn on Classic Shell} HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\ "shutdownwithoutlogon" = (REG_DWORD) hex:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| Shutdown: Allow system to be shut down without having to log on} "undockwithoutlogon" = (REG_DWORD) hex:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| Devices: Allow undock without having to log on} Active Desktop and Wallpaper: ----------------------------- Active Desktop may be disabled at this entry: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState Displayed if Active Desktop enabled and wallpaper not set by Group Policy: HKCU\Software\Microsoft\Internet Explorer\Desktop\General\ "Wallpaper" = "C:\Documents and Settings\Kinia\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp" Displayed if Active Desktop disabled and wallpaper not set by Group Policy: HKCU\Control Panel\Desktop\ "Wallpaper" = "C:\Documents and Settings\Kinia\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp" Enabled Screen Saver: --------------------- HKCU\Control Panel\Desktop\ "SCRNSAVE.EXE" = "C:\WINDOWS\System32\logon.scr" [MS] Startup items in "Kinia" & "All Users" startup folders: ------------------------------------------------------- C:\Documents and Settings\All Users\Menu Start\Programy\Autostart "Microsoft Office" -> shortcut to: "C:\Program Files\Microsoft Office\Office\OSA9.EXE -b -l" [MS] "NaturalColorLoad" -> shortcut to: "C:\Program Files\SEC\Natural Color\NaturalColorLoad.exe" [empty string] Winsock2 Service Provider DLLs: ------------------------------- Namespace Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++} 000000000001\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS] 000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS] 000000000003\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS] Transport Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++} 0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range: %SystemRoot%\system32\mswsock.dll [MS], 01 - 03, 06 - 15 %SystemRoot%\system32\rsvpsp.dll [MS], 04 - 05 Toolbars, Explorer Bars, Extensions: ------------------------------------ Toolbars HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\ "{2318C2B1-4965-11D4-9B18-009027A5CD4F}" -> {HKLM...CLSID} = "&Google" \InProcServer32\(Default) = "c:\program files\google\googletoolbar3.dll" ["Google Inc."] HKLM\Software\Microsoft\Internet Explorer\Toolbar\ "{2318C2B1-4965-11D4-9B18-009027A5CD4F}" = (no title provided) -> {HKLM...CLSID} = "&Google" \InProcServer32\(Default) = "c:\program files\google\googletoolbar3.dll" ["Google Inc."] Extensions (Tools menu items, main toolbar menu buttons) HKLM\Software\Microsoft\Internet Explorer\Extensions\ {EF79EAC5-3452-4E02-B8BD-BA4C89F1AC7A}\ "ButtonText" = "eBay - Homepage" "CLSIDExtension" = "{1FBA04EE-3024-11D2-8F1F-0000F87ABD16}" -> {HKLM...CLSID} = "Toolbar Extension for Executable" \InProcServer32\(Default) = "C:\WINDOWS\System32\shdocvw.dll" [MS] "Exec" = "C:\Program Files\IrfanView\Ebay\Ebay.htm" [null data] Running Services (Display Name, Service Name, Path {Service DLL}): ------------------------------------------------------------------ avast! Antivirus, avast! Antivirus, ""C:\Program Files\Alwil Software\Avast4\ashServ.exe"" [null data] avast! iAVS4 Control Service, aswUpdSv, ""C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe"" [null data] avast! Web Scanner, avast! Web Scanner, ""C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service" ["ALWIL Software"] Creative Service for CDROM Access, Creative Service for CDROM Access, "C:\WINDOWS\System32\CTsvcCDA.EXE" ["Creative Technology Ltd"] NVIDIA Driver Helper Service, NVSvc, "C:\WINDOWS\System32\nvsvc32.exe" ["NVIDIA Corporation"] Pml Driver HPZ12, Pml Driver HPZ12, "C:\WINDOWS\System32\HPZipm12.exe" ["HP"] WMDM PMSP Service, WMDM PMSP Service, "C:\WINDOWS\System32\MsPMSPSv.exe" [MS] Print Monitors: --------------- HKLM\System\CurrentControlSet\Control\Print\Monitors\ LIDIL hpzll43a\Driver = "hpzll43a.dll" ["Hewlett-Packard Company"] ---------- + This report excludes default entries except where indicated. + To see *everywhere* the script checks and *everything* it finds, launch it from a command prompt or a shortcut with the -all parameter. + The search for DESKTOP.INI DLL launch points on all local fixed drives took 179 seconds. ---------- (total run time: 1081 seconds)

**Posty:** 18165 · przez **wojtas** 10 Kwi 2007, 13:58

uruchom narzędzie : The Avenger
http://swandog46.geekstogo.com/avenger.zip
Zaznacz opcję Input script manually i kliknij na Lupkę z prawej strony. W okienku, które się otworzy wklejasz:

Files to delete:

C:\WINDOWS\System32\tmp.reg
C:\WINDOWS\System32\582142ld.exe
C:\WINDOWS\System32\33632ld.exe
C:\WINDOWS\System32\8195952ld.exe
C:\WINDOWS\System32\32578462ld.exe
C:\WINDOWS\System32\16185472ld.exe

Folders to delete:

C:\Program Files\MyWebSearch

Klikasz Done, a następnie zielone światełko i zgadzasz się na restart klikając OK.

Kasujesz ręcznie z dysku plik: C:\Avenger\backup.zip i wklejasz na forum raport: C:\avenger.txt combo

Autor postu otrzymał pochwałę

**Posty:** 319 · przez **hugo91** 10 Kwi 2007, 14:14

Kod: Zaznacz wszystko: Logfile of The Avenger version 1, by Swandog46 Running from registry key: \Registry\Machine\System\CurrentControlSet\Services\qemtkfei ******************* Script file located at: \??\C:\qbeoekhx.txt Script file opened successfully. Script file read successfully Backups directory opened successfully at C:\Avenger ******************* Beginning to process script file: File C:\WINDOWS\System32\tmp.reg deleted successfully. File C:\WINDOWS\System32\582142ld.exe deleted successfully. File C:\WINDOWS\System32\33632ld.exe deleted successfully. File C:\WINDOWS\System32\8195952ld.exe deleted successfully. File C:\WINDOWS\System32\32578462ld.exe deleted successfully. File C:\WINDOWS\System32\16185472ld.exe deleted successfully. Folder C:\Program Files\MyWebSearch deleted successfully. Completed script processing. ******************* Finished! Terminate.

combo

Kod: Zaznacz wszystko: ComboScan v20070306.20 run by Kinia on 2007-04-10 at 14:03:50 Computer is in Normal Mode. -------------------------------------------------------------------------------- -- HijackThis (run as Kinia.exe) ----------------------------------------------- Logfile of HijackThis v1.99.1 Scan saved at 14:03:55, on 2007-04-10 Platform: Windows XP (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 (6.00.2600.0000) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\System32\CTsvcCDA.EXE C:\WINDOWS\System32\nvsvc32.exe C:\WINDOWS\System32\HPZipm12.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\MsPMSPSv.exe C:\Program Files\Winamp\winampa.exe C:\Program Files\Creative\SBLive\AudioHQ\AHQTB.EXE C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\Program Files\Messenger\msmsgs.exe C:\Program Files\Gadu-Gadu\gg.exe C:\Program Files\Creative\SBLive\PlayCenter2\CTNMRun.exe C:\Program Files\SEC\Natural Color\NaturalColorLoad.exe C:\Program Files\DC++\DCPlusPlus.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\WINDOWS\System32\WgaTray.exe C:\Program Files\Internet Explorer\iexplore.exe C:\WINDOWS\System32\wuauclt.exe C:\WINDOWS\System32\wuauclt.exe G:\comboscan.exe C:\DOCUME~1\Kinia\Pulpit\NOWYFO~1\Kinia.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.pl/ R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\Updreg.exe O4 - HKLM\..\Run: [AHQInit] C:\Program Files\Creative\SBLive\Program\AHQInit.exe O4 - HKLM\..\Run: [AudioHQ] C:\Program Files\Creative\SBLive\AudioHQ\AHQTB.EXE O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - HKCU\..\Run: [NOMAD Detector] "C:\Program Files\Creative\SBLive\PlayCenter2\CTNMRun.exe" O4 - Startup: DC++.lnk = C:\Program Files\DC++\DCPlusPlus.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE O4 - Global Startup: NaturalColorLoad.lnk = ? O9 - Extra button: eBay - Homepage - {EF79EAC5-3452-4E02-B8BD-BA4C89F1AC7A} - C:\Program Files\IrfanView\Ebay\Ebay.htm O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing) O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.EXE O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe -- Files created between 2007-03-10 and 2007-04-10 ----------------------------- 2007-04-09 20:35:55 0 d-------- C:\fixwareout<FIXWAR~1> 2007-04-09 20:01:30 79360 --a------ C:\WINDOWS\System32\swxcacls.exe 2007-04-09 20:01:30 40960 --a------ C:\WINDOWS\System32\swsc.exe 2007-04-09 20:01:30 288417 --a------ C:\WINDOWS\System32\SrchSTS.exe 2007-04-09 20:01:30 51200 --a------ C:\WINDOWS\System32\dumphive.exe 2007-04-09 20:01:29 135168 --a------ C:\WINDOWS\System32\swreg.exe 2007-04-09 20:01:29 53248 --a------ C:\WINDOWS\System32\Process.exe 2007-04-09 19:59:50 52805 --a------ C:\WINDOWS\System32\csqgy.exe 2007-04-02 22:21:11 841 --a------ C:\WINDOWS\unins001.dat 2007-04-02 22:21:10 1026 --a------ C:\WINDOWS\unins000.dat 2007-04-02 22:21:10 0 d-------- C:\Program Files\kswiat 2007-04-02 22:18:55 5120 --a------ C:\WINDOWS\System32\ff_vfw.dll 2007-04-02 22:18:52 0 d-------- C:\Program Files\ffdshow 2007-04-02 21:17:04 23352 --a------ C:\WINDOWS\System32\drivers\aswRdr.sys 2007-04-02 21:17:03 43176 --a------ C:\WINDOWS\System32\drivers\aswTdi.sys 2007-04-02 21:17:02 31560 --a------ C:\WINDOWS\System32\drivers\aavmker4.sys 2007-04-02 21:16:55 94424 --a------ C:\WINDOWS\System32\drivers\aswmon2.sys 2007-04-02 21:16:55 85952 --a------ C:\WINDOWS\System32\drivers\aswmon.sys 2007-04-02 21:16:43 348160 --a------ C:\WINDOWS\System32\MSVCR71.dll 2007-04-02 21:16:43 499712 --a------ C:\WINDOWS\System32\MSVCP71.dll 2007-04-02 21:16:43 1060864 --a------ C:\WINDOWS\System32\MFC71.dll 2007-04-02 21:16:43 90112 --a------ C:\WINDOWS\System32\AVASTSS.scr 2007-04-02 21:16:43 689280 --a------ C:\WINDOWS\System32\aswBoot.exe 2007-04-02 21:16:38 0 d-------- C:\Program Files\Alwil Software<ALWILS~1> 2007-04-02 21:15:49 25600 --a------ C:\WINDOWS\System32\xpsp1hfm.exe 2007-04-02 21:15:49 0 d--h---c- C:\WINDOWS\$xpsp1hfm$<$XPSP1~1> 2007-04-02 20:32:27 41984 --a------ C:\WINDOWS\CTREGRUN.EXE 2007-04-02 20:31:53 135040 --a------ C:\WINDOWS\System32\drivers\portcls.sys 2007-04-02 20:31:53 57344 --a------ C:\WINDOWS\System32\drivers\drmk.sys 2007-04-02 20:31:35 90112 --a------ C:\WINDOWS\Updreg.exe 2007-04-02 20:31:27 51200 --a------ C:\WINDOWS\System32\sfman32.dll 2007-04-02 20:31:27 36992 --a------ C:\WINDOWS\System32\drivers\sfman.sys 2007-04-02 20:31:26 495616 --a------ C:\WINDOWS\System32\sblfx.dll 2007-04-02 20:31:26 775296 --a------ C:\WINDOWS\System32\drivers\emu10k1f.sys 2007-04-02 20:31:25 6912 --a------ C:\WINDOWS\System32\drivers\ctlface.sys 2007-04-02 20:31:25 25600 --a------ C:\WINDOWS\System32\devldr32.exe 2007-04-02 20:31:25 352256 --a------ C:\WINDOWS\System32\devcon32.dll 2007-04-02 20:31:25 3584 --a------ C:\WINDOWS\System32\ctwdm32.dll 2007-04-02 20:31:25 59392 --a------ C:\WINDOWS\System32\a3d.dll 2007-04-02 20:30:18 1048576 -----n--- C:\WINDOWS\System32\sfman.dat 2007-04-02 20:30:18 84992 -----n--- C:\WINDOWS\System32\sfcvrt32.dll 2007-04-02 20:30:18 108032 -----n--- C:\WINDOWS\System32\mfcuia32.dll 2007-04-02 20:30:17 149504 -----n--- C:\WINDOWS\System32\mfcans32.dll 2007-04-02 20:30:17 82432 -----n--- C:\WINDOWS\System32\Ctwflt32.dll 2007-04-02 20:30:17 26768 -----n--- C:\WINDOWS\System32\ctl3d.dll 2007-04-02 20:30:17 34816 -----n--- C:\WINDOWS\CTRes32.dll 2007-04-02 20:30:17 24976 -----n--- C:\WINDOWS\ctres.dll 2007-04-02 20:30:17 53552 -----n--- C:\WINDOWS\ctccw.dll 2007-04-02 20:29:00 3584 --a------ C:\WINDOWS\System32\Ahqcpres.dll 2007-04-02 20:28:38 0 d-------- C:\Media 2007-04-02 20:28:37 44032 --a------ C:\WINDOWS\System32\CTSVCCDA.EXE 2007-04-02 20:04:50 65536 --a------ C:\WINDOWS\System32\Gif89.dll 2007-04-02 20:04:47 0 d-------- C:\Program Files\SEC 2007-04-02 18:48:43 0 d-------- C:\WINDOWS\System32\ReinstallBackups<REINST~1> 2007-04-02 18:48:08 5504 --a------ C:\WINDOWS\System32\drivers\xmasscsi.sys 2007-04-02 18:48:08 140800 --a------ C:\WINDOWS\System32\drivers\xmasbus.sys 2007-04-02 18:48:05 0 d-------- C:\Program Files\Alcohol Soft<ALCOHO~1> 2007-04-02 18:46:56 0 d-------- C:\Program Files\IrfanView<IRFANV~1> 2007-04-02 18:39:48 20016 -----n--- C:\WINDOWS\System32\drivers\pxhelp20.sys 2007-04-02 18:39:45 0 d-------- C:\Program Files\Winamp 2007-03-24 11:38:31 0 d-------- C:\Program Files\Max Payne<MAXPAY~1> 2007-03-24 11:28:47 0 d-------- C:\Program Files\HIP GAMES<HIPGAM~1> -- Find3M Report --------------------------------------------------------------- 2007-04-10 13:59:01 0 d-------- C:\Program Files\DC++<DC__~1> 2007-04-09 16:19:53 0 d-------- C:\Program Files\Messenger<MESSEN~1> 2007-04-02 22:21:12 73393 --a------ C:\WINDOWS\unins001.exe 2007-04-02 22:21:12 73393 --a------ C:\WINDOWS\unins000.exe 2007-04-02 22:05:03 0 d-------- C:\Documents and Settings\Kinia\Dane aplikacji\BearShare<BEARSH~1> 2007-04-02 20:32:27 0 d-------- C:\Program Files\Creative 2007-04-02 20:06:36 0 d--h----- C:\Program Files\InstallShield Installation Information<INSTAL~1> 2007-04-02 19:57:26 355830 --a------ C:\WINDOWS\System32\perfh015.dat 2007-04-02 19:57:26 49712 --a------ C:\WINDOWS\System32\perfc015.dat 2007-04-02 17:15:50 0 d---s---- C:\Documents and Settings\Kinia\Dane aplikacji\Microsoft<MICROS~1> 2007-04-02 17:11:12 0 d-------- C:\Documents and Settings\Kinia\Dane aplikacji\Help 2007-03-14 17:23:58 0 d-------- C:\Program Files\Gadu-Gadu<GADU-G~1> 2007-03-02 17:55:57 43520 --a------ C:\WINDOWS\System32\CmdLineExt03.dll<CMDLIN~1.DLL> 2007-02-10 12:40:55 0 d-------- C:\Program Files\Google 2007-01-15 18:26:21 103782 --a------ C:\WINDOWS\hpoins08.dat -- Registry Dump --------------------------------------------------------------- [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run] "MSMSGS"="\"C:\\Program Files\\Messenger\\msmsgs.exe\" /background" "Gadu-Gadu"="\"C:\\Program Files\\Gadu-Gadu\\gg.exe\" /tray" "NOMAD Detector"="\"C:\\Program Files\\Creative\\SBLive\\PlayCenter2\\CTNMRun.exe\"" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run] "NvCplDaemon"="RUNDLL32.EXE NvQTwk,NvCplDaemon initialize" "WinampAgent"="C:\\Program Files\\Winamp\\winampa.exe" "UpdReg"="C:\\WINDOWS\\Updreg.exe" "AHQInit"="C:\\Program Files\\Creative\\SBLive\\Program\\AHQInit.exe" "AudioHQ"="C:\\Program Files\\Creative\\SBLive\\AudioHQ\\AHQTB.EXE" "avast!"="C:\\PROGRA~1\\ALWILS~1\\Avast4\\ashDisp.exe" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\IMAIL] "Installed"="1" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MAPI] "NoChange"="1" "Installed"="1" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MSFS] "Installed"="1" [HKEY_USERS\.default\software\microsoft\windows\currentversion\run] "CTFMON.EXE"="C:\\WINDOWS\\System32\\CTFMON.EXE" [HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\run] "CTFMON.EXE"="C:\\WINDOWS\\System32\\CTFMON.EXE" [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] @="" [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders] "SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll" [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Svchost] LocalService REG_MULTI_SZ Alerter\0WebClient\0LmHosts\0RemoteRegistry\0upnphost\0SSDPSRV\0\0 NetworkService REG_MULTI_SZ DnsCache\0\0 rpcss REG_MULTI_SZ RpcSs\0\0 imgsvc REG_MULTI_SZ StiSvc\0\0 termsvcs REG_MULTI_SZ TermService\0\0 -- End of ComboScan: finished at 2007-04-10 at 14:04:10 ------------------------

**Posty:** 18165 · przez **wojtas** 10 Kwi 2007, 18:30

Użyj WWDC :
http://www.firewallleaktester.com/wwdc.htm
Zmień opcje z disable na enable. Uruchom ponownie komputer.
Tak powinny wyglądać porty (NetBIOS może być żółty) :
http://www.firewallleaktester.com/images_site/wwdc.jpg

i bedzie ok :papryczka:

**Posty:** 319 · przez **hugo91** 10 Kwi 2007, 23:46

okkej EOT

prosze loga do sprawdzenia

Prosze loga do sprawdzenia

Kto jest na forum