z netem / programami => log

**Posty:** 2547 · przez **lance87** 20 Kwi 2007, 22:46

Witam, postaram się streścić, choć będzie ciężko...
Wczoraj włączyłem komputer po zaniku napięcia. Włączając komputer wyskoczył komunikat w BIOS-ie "CMOS Settings Wrong", po restarcie kompa BIOS się zresetował. Uruchomiłem komputer pierwsze co oczywiście net - tu niespodzianka mocno 'zamula'. W NetMeter'ze max 4kB/s i jakby było ograniczenie nic więcej, tak jest do teraz

Chcą sprawdzić czy nie mam jakiegoś wirusa czy spyware (choć mam codziennie aktualizowanego Kasperskiego 6 i co jakiś czas skanuję Spybot'em) próbowałem uruchomić Ad-Aware i tu pojawia się komunikat " Exception Processing Message c 0000013 parameters 75b6bf9c 75bf9c 4 75b6bf9c" uniemożliwiając dalsze uruchomienie programu. Spybot uruchomił się, ale przy próbie skanowania również ten komunikat i kredki... Pojawia się on z resztą przy uruchamianiu innych programów i "od tak". Skanowałem różnymi skanerami Online itp. znajdowało jakieś wiry i spyware, ale nadal problem z komunikatem i wielkością transferu nie ustąpił. Robiłem to oczywiście w trybie awaryjnym i przy wył. przywracaniu. Komp ogólnie trochę 'zamula', najważniejsze jednak dla mnie to by internet chodził z normalną prędkością, a nie był 'ograniczony' i te błędy się nie pojawiały... Chyba "dogłębnie" opisałem problem, nie chcąc ryzykować usunięciem czegoś potrzebnego umieszczam tu wszystkie potrzebne logi, mam nadzieję, że pomożecie

Hijack:

Logfile of HijackThis v1.99.1
Scan saved at 22:07:58, on 2007-04-20
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
M:\WINDOWS\System32\smss.exe
M:\WINDOWS\system32\winlogon.exe
M:\WINDOWS\system32\services.exe
M:\WINDOWS\system32\lsass.exe
M:\WINDOWS\system32\svchost.exe
M:\WINDOWS\System32\svchost.exe
M:\WINDOWS\system32\spoolsv.exe
M:\Program Files\DU Meter\DUMeter.exe
M:\Program Files\DAEMON Tools\daemon.exe
M:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
M:\WINDOWS\system32\ctfmon.exe
M:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
M:\Program Files\Gadu-Gadu\gg.exe
M:\PROGRA~1\MyPortal\Speed-X\SpeedX.exe
M:\Program Files\NetMeter\NetMeter.exe
M:\WINDOWS\system32\nvsvc32.exe
M:\WINDOWS\system32\svchost.exe
M:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
M:\Documents and Settings\Adam\Moje dokumenty\Sharing\sbclv1.0i\SBCL v1.0i.exe
M:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
M:\WINDOWS\system32\taskmgr.exe
M:\Program Files\Mozilla Firefox\firefox.exe
M:\WINDOWS\explorer.exe
M:\WINDOWS\NOTEPAD.EXE
M:\WINDOWS\NOTEPAD.EXE
P:\Inne\INSTALKI\zzz-RESZTA-zzz\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.onet.pl/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
F2 - REG:system.ini: Shell=explorer.exe
O2 - BHO: (no name) - {034BCF48-D4E7-4335-8F56-CE9AB44F6961} - M:\WINDOWS\system32\opnmkii.dll (file missing)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - M:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: IeCatch5 Class - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - M:\PROGRA~1\FlashGet\jccatch.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - M:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: (no name) - {A16229AC-D0FB-4FA4-B405-6B8E95029014} - M:\WINDOWS\system32\qaysybqm.dll
O2 - BHO: gFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - M:\PROGRA~1\FlashGet\getflash.dll
O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - M:\PROGRA~1\FlashGet\fgiebar.dll
O4 - HKLM\..\Run: [DU Meter] M:\Program Files\DU Meter\DUMeter.exe
O4 - HKLM\..\Run: [DAEMON Tools] "M:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [SunJavaUpdateSched] "M:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE M:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKCU\..\Run: [CTFMON.EXE] M:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Gadu-Gadu] "M:\Program Files\Gadu-Gadu\gg.exe" /tray
O4 - HKCU\..\Run: [SpeedX] M:\PROGRA~1\MyPortal\Speed-X\SpeedX.exe
O4 - HKCU\..\Run: [M:\Program Files\NetMeter\NetMeter.exe] M:\Program Files\NetMeter\NetMeter.exe
O4 - Startup: Skrót do SBCL v1.lnk = M:\Documents and Settings\Adam\Moje dokumenty\Sharing\sbclv1.0i\SBCL v1.0i.exe
O4 - Startup: Yahoo! Widget Engine.lnk = M:\Program Files\Yahoo!\Widgets\YahooWidgetEngine.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = M:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = M:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://M:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Ściągnij przy pomocy FlashGet'a - M:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: Ściągnij wszystko przy pomocy FlashGet'a - M:\Program Files\FlashGet\jc_all.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - M:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - M:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - M:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - M:\PROGRA~1\FlashGet\flashget.exe
O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - M:\PROGRA~1\FlashGet\flashget.exe
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://kaspersky.pl/resources/virusscanner/kavwebscan_unicode.cab
O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://downloads.ewido.net/ewidoOnlineScan.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - M:\Program Files\Yahoo!\Common\Yinsthelper.dll
O20 - Winlogon Notify: opnmkii - opnmkii.dll (file missing)
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - M:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - M:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: kavsvc - Kaspersky Lab - M:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\kavsvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - M:\WINDOWS\system32\nvsvc32.exe
O23 - Service: ServiceLayer - Nokia. - M:\Program Files\PC Connectivity Solution\ServiceLayer.exe

ComboScan:

ComboScan v20070306.20 run by Adam on 2007-04-20 at 22:46:02
Computer is in Normal Mode.
--------------------------------------------------------------------------------

-- HijackThis (run as Adam.exe) ------------------------------------------------

Logfile of HijackThis v1.99.1
Scan saved at 22:46:03, on 2007-04-20
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
M:\WINDOWS\System32\smss.exe
M:\WINDOWS\system32\winlogon.exe
M:\WINDOWS\system32\services.exe
M:\WINDOWS\system32\lsass.exe
M:\WINDOWS\system32\svchost.exe
M:\WINDOWS\System32\svchost.exe
M:\WINDOWS\system32\spoolsv.exe
M:\Program Files\DU Meter\DUMeter.exe
M:\Program Files\DAEMON Tools\daemon.exe
M:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
M:\WINDOWS\system32\ctfmon.exe
M:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
M:\Program Files\Gadu-Gadu\gg.exe
M:\PROGRA~1\MyPortal\Speed-X\SpeedX.exe
M:\Program Files\NetMeter\NetMeter.exe
M:\WINDOWS\system32\nvsvc32.exe
M:\WINDOWS\system32\svchost.exe
M:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
M:\Documents and Settings\Adam\Moje dokumenty\Sharing\sbclv1.0i\SBCL v1.0i.exe
M:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
M:\WINDOWS\system32\taskmgr.exe
M:\Program Files\Mozilla Firefox\firefox.exe
M:\WINDOWS\explorer.exe
M:\Documents and Settings\Adam\Pulpit\comboscan.exe
P:\Inne\INSTALKI\ZZZ-RE~1\Adam.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.onet.pl/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
F2 - REG:system.ini: Shell=explorer.exe
O2 - BHO: (no name) - {034BCF48-D4E7-4335-8F56-CE9AB44F6961} - M:\WINDOWS\system32\opnmkii.dll (file missing)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - M:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: IeCatch5 Class - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - M:\PROGRA~1\FlashGet\jccatch.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - M:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: (no name) - {A16229AC-D0FB-4FA4-B405-6B8E95029014} - M:\WINDOWS\system32\qaysybqm.dll
O2 - BHO: gFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - M:\PROGRA~1\FlashGet\getflash.dll
O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - M:\PROGRA~1\FlashGet\fgiebar.dll
O4 - HKLM\..\Run: [DU Meter] M:\Program Files\DU Meter\DUMeter.exe
O4 - HKLM\..\Run: [DAEMON Tools] "M:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [SunJavaUpdateSched] "M:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE M:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKCU\..\Run: [CTFMON.EXE] M:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Gadu-Gadu] "M:\Program Files\Gadu-Gadu\gg.exe" /tray
O4 - HKCU\..\Run: [SpeedX] M:\PROGRA~1\MyPortal\Speed-X\SpeedX.exe
O4 - HKCU\..\Run: [M:\Program Files\NetMeter\NetMeter.exe] M:\Program Files\NetMeter\NetMeter.exe
O4 - Startup: Skrót do SBCL v1.lnk = M:\Documents and Settings\Adam\Moje dokumenty\Sharing\sbclv1.0i\SBCL v1.0i.exe
O4 - Startup: Yahoo! Widget Engine.lnk = M:\Program Files\Yahoo!\Widgets\YahooWidgetEngine.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = M:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = M:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://M:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Ściągnij przy pomocy FlashGet'a - M:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: Ściągnij wszystko przy pomocy FlashGet'a - M:\Program Files\FlashGet\jc_all.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - M:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - M:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - M:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - M:\PROGRA~1\FlashGet\flashget.exe
O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - M:\PROGRA~1\FlashGet\flashget.exe
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://kaspersky.pl/resources/virusscanner/kavwebscan_unicode.cab
O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://downloads.ewido.net/ewidoOnlineScan.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - M:\Program Files\Yahoo!\Common\Yinsthelper.dll
O20 - Winlogon Notify: opnmkii - opnmkii.dll (file missing)
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - M:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - M:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: kavsvc - Kaspersky Lab - M:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\kavsvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - M:\WINDOWS\system32\nvsvc32.exe
O23 - Service: ServiceLayer - Nokia. - M:\Program Files\PC Connectivity Solution\ServiceLayer.exe

-- Files created between 2007-03-20 and 2007-04-20 -----------------------------

2007-04-20 19:00:07 0 d-------- M:\WINDOWS\CSC
2007-04-20 18:49:37 123972 --a------ M:\WINDOWS\system32\uwgeenym.dll
2007-04-20 15:25:42 125460 --a------ M:\WINDOWS\system32\qaysybqm.dll
2007-04-20 15:24:11 123972 --a------ M:\WINDOWS\system32\tyylqmim.dll
2007-04-20 15:20:42 353 ---hs---- M:\WINDOWS\system32\nqtwa.ini2<NQTWA~1.INI>
2007-04-20 14:42:17 123972 --a------ M:\WINDOWS\system32\ynjvumht.dll
2007-04-20 14:33:18 281172 -----n--- M:\WINDOWS\system32\awtqn.dll
2007-04-14 21:13:02 0 d-------- M:\WINDOWS\Performance<PERFOR~1>
2007-04-13 21:00:25 0 d-------- M:\Program Files\BearShare Applications<BEARSH~2>
2007-04-10 18:00:15 0 d-------- M:\Program Files\EDU CD<EDUCD~1>
2007-03-25 19:19:30 0 d-------- M:\Program Files\NetMeter
2007-03-23 00:39:26 0 d-------- M:\Program Files\VideoLAN
2007-03-22 00:26:29 0 d-------- M:\Program Files\English Translator 2<ENGLIS~1>
2007-03-21 23:20:47 0 d-------- M:\Program Files\Corel
2007-03-20 02:23:54 0 d-------- M:\Program Files\SiGSOFT
2007-03-20 00:47:04 0 d-------- M:\Program Files\Yahoo!

-- Find3M Report ---------------------------------------------------------------

2007-04-20 21:43:28 0 d-------- M:\Program Files\Mozilla Firefox<MOZILL~1>
2007-04-20 15:13:01 0 d-------- M:\Program Files\Uniblue
2007-04-20 15:10:34 0 d-------- M:\Documents and Settings\Adam\Dane aplikacji\Uniblue
2007-04-20 15:09:58 0 d-------- M:\Program Files\DAEMON Tools<DAEMON~1>
2007-04-20 02:30:26 0 d-------- M:\Program Files\FlashGet
2007-04-20 01:43:49 0 d-------- M:\Program Files\Java
2007-04-20 00:18:30 448004 --a------ M:\WINDOWS\system32\perfh015.dat
2007-04-20 00:18:30 74230 --a------ M:\WINDOWS\system32\perfc015.dat
2007-04-19 23:07:25 0 d-------- M:\Documents and Settings\Adam\Dane aplikacji\dvdcss
2007-04-18 20:03:09 0 d-------- M:\Documents and Settings\Adam\Dane aplikacji\foobar2000<FOOBAR~1>
2007-04-17 12:24:16 0 d-------- M:\Program Files\Opera
2007-04-14 23:19:22 0 d-------- M:\Program Files\Winamp
2007-04-14 21:38:31 0 d---s---- M:\Documents and Settings\Adam\Dane aplikacji\Microsoft<MICROS~1>
2007-04-13 23:35:19 0 d-------- M:\Program Files\AllMyMovies<ALLMYM~1>
2007-04-13 23:18:06 0 d-------- M:\Program Files\Ad-Aware SE Personal<AD-AWA~1>
2007-04-13 21:15:44 0 d-------- M:\Documents and Settings\Adam\Dane aplikacji\BearShare<BEARSH~1>
2007-03-29 13:58:06 0 d-------- M:\Documents and Settings\Adam\Dane aplikacji\uTorrent
2007-03-23 00:40:10 0 d-------- M:\Documents and Settings\Adam\Dane aplikacji\vlc
2007-03-20 01:15:34 0 d-------- M:\Program Files\SpeedFan
2007-03-19 18:54:09 0 d-------- M:\Program Files\LPS
2007-03-19 16:09:00 0 d-------- M:\Program Files\K-litePro<K-LITE~2>
2007-03-18 15:09:28 0 d-------- M:\Program Files\Microsoft Games<MICROS~3>
2007-03-17 21:33:02 0 d-------- M:\Program Files\WinUHA
2007-03-17 21:01:40 0 d-------- M:\Documents and Settings\Adam\Dane aplikacji\Kingston
2007-03-17 15:45:36 293376 --a------ M:\WINDOWS\system32\winsrv.dll
2007-03-16 14:48:38 0 d-------- M:\Program Files\XMotorRacingDemo<XMOTOR~1>
2007-03-15 23:50:40 0 d-------- M:\Program Files\Peer2Mail<PEER2M~1>
2007-03-15 15:55:58 0 d-------- M:\Documents and Settings\Adam\Dane aplikacji\GRETECH
2007-03-15 15:55:25 0 d-------- M:\Program Files\GRETECH
2007-03-14 20:27:33 0 d-------- M:\Program Files\Nokia
2007-03-12 19:45:43 0 d-------- M:\Program Files\WorldUnlock Codes Calculator<WORLDU~1>
2007-03-09 17:43:33 0 d-------- M:\Program Files\BearShare Acceleration Patch<BEARSH~1>
2007-03-08 17:38:47 579072 --a------ M:\WINDOWS\system32\user32.dll
2007-03-08 17:38:47 40960 --a------ M:\WINDOWS\system32\mf3216.dll
2007-03-08 17:38:47 281600 --a------ M:\WINDOWS\system32\gdi32.dll
2007-03-08 17:37:33 1843840 --a------ M:\WINDOWS\system32\win32k.sys
2007-03-07 23:03:59 0 d-------- M:\Program Files\HDD Regenerator<HDDREG~1>
2007-03-07 01:54:10 0 d-------- M:\Program Files\foobar2000<FOOBAR~1>
2007-03-06 19:22:19 0 d-------- M:\Program Files\Badongo
2007-03-05 15:30:54 0 d--h----- M:\Program Files\InstallShield Installation Information<INSTAL~1>
2007-03-03 16:39:11 0 dr-h----- M:\Documents and Settings\Adam\Dane aplikacji\SecuROM
2007-03-03 16:39:10 108144 --a------ M:\WINDOWS\system32\CmdLineExt.dll<CMDLIN~1.DLL>
2007-03-01 23:00:48 0 d-------- M:\Program Files\Cartall
2007-03-01 20:45:27 0 d-------- M:\Program Files\Windows NT<WINDOW~1>
2007-03-01 14:49:49 0 d-------- M:\Program Files\Lavalys
2007-02-27 15:44:52 0 d-------- M:\Program Files\MyPortal
2007-02-26 22:22:36 0 d-------- M:\Program Files\Shortcut
2007-02-26 02:04:32 0 d-------- M:\Program Files\NAPI-PROJEKT<NAPI-P~1>
2007-02-23 01:46:39 0 d-------- M:\Documents and Settings\Adam\Dane aplikacji\GanymedeNet<GANYME~1>
2007-02-21 01:05:01 0 d-------- M:\Program Files\Ganymede
2007-02-05 22:19:48 185856 --a------ M:\WINDOWS\system32\upnphost.dll
2007-01-29 10:58:06 60416 -----n--- M:\WINDOWS\system32\tzchange.exe
2007-01-26 15:47:44 3614 --a------ M:\WINDOWS\mozver.dat
2007-01-24 21:19:04 5 --ahs---- M:\WINDOWS\system32\aecdfbfcd6_s.dll<AECDFB~1.DLL>
2007-01-22 20:47:58 249856 --a------ M:\WINDOWS\Setup1.exe
2007-01-22 20:47:56 73216 --a------ M:\WINDOWS\ST6UNST.EXE

-- Registry Dump ---------------------------------------------------------------

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run]
"CTFMON.EXE"="M:\\WINDOWS\\system32\\ctfmon.exe"
"Gadu-Gadu"="\"M:\\Program Files\\Gadu-Gadu\\gg.exe\" /tray"
"SpeedX"="M:\\PROGRA~1\\MyPortal\\Speed-X\\SpeedX.exe"
"M:\\Program Files\\NetMeter\\NetMeter.exe"="M:\\Program Files\\NetMeter\\NetMeter.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run]
"DU Meter"="M:\\Program Files\\DU Meter\\DUMeter.exe"
"DAEMON Tools"="\"M:\\Program Files\\DAEMON Tools\\daemon.exe\" -lang 1033"
"SunJavaUpdateSched"="\"M:\\Program Files\\Java\\jre1.6.0_01\\bin\\jusched.exe\""
"NvCplDaemon"="RUNDLL32.EXE M:\\WINDOWS\\system32\\NvCpl.dll,NvStartup"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\IMAIL]
"Installed"="1"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MAPI]
"Installed"="1"
"NoChange"="1"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MSFS]
"Installed"="1"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{57B86673-276A-48B2-BAE7-C6DBB3020EB8}"="AVG Anti-Spyware 7.5"
"{034BCF48-D4E7-4335-8F56-CE9AB44F6961}"=""

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"CTFMON.EXE"="M:\\WINDOWS\\system32\\CTFMON.EXE"

[HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\run]
"CTFMON.EXE"="M:\\WINDOWS\\system32\\CTFMON.EXE"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"DisableRegistryTools"=dword:00000000

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoLowDiskSpaceChecks"=dword:00000000

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\DisAllowRun]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\Run]

HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\opnmkii

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll"

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Svchost]
HTTPFilter REG_MULTI_SZ HTTPFilter\0\0
LocalService REG_MULTI_SZ Alerter\0WebClient\0LmHosts\0RemoteRegistry\0upnphost\0SSDPSRV\0\0
NetworkService REG_MULTI_SZ DnsCache\0\0
DcomLaunch REG_MULTI_SZ DcomLaunch\0TermService\0\0
rpcss REG_MULTI_SZ RpcSs\0\0
imgsvc REG_MULTI_SZ StiSvc\0\0
termsvcs REG_MULTI_SZ TermService\0\0

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\F]
Shell\AutoRun\command F:\Autorun.exe

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\G]
Shell\AutoRun\command G:\start.exe

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{8b562a0e-4426-11db-9bde-000ae60852ae}]
Shell\AutoRun\command F:\Autorun.exe

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{8b562a0f-4426-11db-9bde-000ae60852ae}]
Shell\AutoRun\command G:\start.exe

-- End of ComboScan: finished at 2007-04-20 at 22:46:39 ------------------------

**Posty:** 18165 · przez **wojtas** 20 Kwi 2007, 23:03

jest syf uzyj po kilka razy:

VundoFix
http://www.atribune.org/ccount/click.php?id=4

VirtumundoBeGone
http://secured2k.home.comcast.net/tools/VirtumundoBeGone.exe

FixVundo
http://securityresponse.symantec.com/avcenter/FixVundo.exe

log z silent runners jest zly ten skasuj bo strona sie rozwala

**Posty:** 2547 · przez **lance87** 20 Kwi 2007, 23:12

Ok, już pobieram te pliki, ale wolno ciągnie - wiadomo dlaczego...
Log z Silent Runners pokazuje mi właśnie taki długi, dałem na wszelki wypadek z ComboScan
BTW te programy użyć w trybie awaryjnym czy nie trzeba?

**Posty:** 18165 · przez **wojtas** 20 Kwi 2007, 23:17

lance87 napisał(a):BTW te programy użyć w trybie awaryjnym czy nie trzeba?

tak uzyj w awaryjnym po 2-3 razy kazdy potem nowy log z comboscana (ma w sobie Hijacka) oraz silenta: tylko ze ten co wygenrowales wczesniej byl zly

**Posty:** 2547 · przez **lance87** 21 Kwi 2007, 01:02

Według tego loga:

[04/20/2007, 23:02:56] - VirtumundoBeGone v1.5 ( "M:\Documents and Settings\Adam\Pulpit\VirtumundoBeGone.exe" )
[04/20/2007, 23:03:07] - Detected System Information:
[04/20/2007, 23:03:07] - Windows Version: 5.1.2600, Dodatek Service Pack 2
[04/20/2007, 23:03:07] - Current Username: Adam (Admin)
[04/20/2007, 23:03:07] - Windows is in SAFE mode with Networking.
[04/20/2007, 23:03:07] - Searching for Browser Helper Objects:
[04/20/2007, 23:03:07] - BHO 1: {034BCF48-D4E7-4335-8F56-CE9AB44F6961} ()
[04/20/2007, 23:03:07] - WARNING: BHO has no default name. Checking for Winlogon reference.
[04/20/2007, 23:03:07] - Checking for HKLM\...\Winlogon\Notify\opnmkii
[04/20/2007, 23:03:07] - Found: HKLM\...\Winlogon\Notify\opnmkii - This is probably Virtumundo.
[04/20/2007, 23:03:07] - Assigning {034BCF48-D4E7-4335-8F56-CE9AB44F6961} MSEvents Object
[04/20/2007, 23:03:07] - BHO list has been changed! Starting over...
[04/20/2007, 23:03:07] - BHO 1: {034BCF48-D4E7-4335-8F56-CE9AB44F6961} (MSEvents Object)
[04/20/2007, 23:03:07] - ALERT: Found MSEvents Object!
[04/20/2007, 23:03:07] - BHO 2: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} (AcroIEHlprObj Class)
[04/20/2007, 23:03:07] - BHO 3: {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} (IeCatch5 Class)
[04/20/2007, 23:03:07] - BHO 4: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} (SSVHelper Class)
[04/20/2007, 23:03:07] - BHO 5: {A16229AC-D0FB-4FA4-B405-6B8E95029014} ()
[04/20/2007, 23:03:07] - WARNING: BHO has no default name. Checking for Winlogon reference.
[04/20/2007, 23:03:07] - Checking for HKLM\...\Winlogon\Notify\qaysybqm
[04/20/2007, 23:03:07] - Key not found: HKLM\...\Winlogon\Notify\qaysybqm, continuing.
[04/20/2007, 23:03:07] - BHO 6: {F156768E-81EF-470C-9057-481BA8380DBA} (gFlash Class)
[04/20/2007, 23:03:07] - Finished Searching Browser Helper Objects
[04/20/2007, 23:03:07] - *** Detected MSEvents Object
[04/20/2007, 23:03:07] - Trying to remove MSEvents Object...
[04/20/2007, 23:03:08] - Terminating Process: IEXPLORE.EXE
[04/20/2007, 23:03:08] - Terminating Process: RUNDLL32.EXE
[04/20/2007, 23:03:08] - Disabling Automatic Shell Restart
[04/20/2007, 23:03:08] - Terminating Process: EXPLORER.EXE
[04/20/2007, 23:03:08] - Suspending the NT Session Manager System Service
[04/20/2007, 23:03:08] - Terminating Windows NT Logon/Logoff Manager
[04/20/2007, 23:03:08] - Re-enabling Automatic Shell Restart
[04/20/2007, 23:03:08] - File to disable: M:\WINDOWS\system32\opnmkii.dll
[04/20/2007, 23:03:08] - Removing HKLM\...\Browser Helper Objects\{034BCF48-D4E7-4335-8F56-CE9AB44F6961}
[04/20/2007, 23:03:08] - Removing HKCR\CLSID\{034BCF48-D4E7-4335-8F56-CE9AB44F6961}
[04/20/2007, 23:03:08] - Adding Kill Bit for ActiveX for GUID: {034BCF48-D4E7-4335-8F56-CE9AB44F6961}
[04/20/2007, 23:03:08] - Deleting ATLEvents/MSEvents Registry entries
[04/20/2007, 23:03:08] - Removing HKLM\...\Winlogon\Notify\opnmkii
[04/20/2007, 23:03:08] - Searching for Browser Helper Objects:
[04/20/2007, 23:03:08] - BHO 1: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} (AcroIEHlprObj Class)
[04/20/2007, 23:03:08] - BHO 2: {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} (IeCatch5 Class)
[04/20/2007, 23:03:08] - BHO 3: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} (SSVHelper Class)
[04/20/2007, 23:03:08] - BHO 4: {A16229AC-D0FB-4FA4-B405-6B8E95029014} ()
[04/20/2007, 23:03:08] - WARNING: BHO has no default name. Checking for Winlogon reference.
[04/20/2007, 23:03:08] - Checking for HKLM\...\Winlogon\Notify\qaysybqm
[04/20/2007, 23:03:08] - Key not found: HKLM\...\Winlogon\Notify\qaysybqm, continuing.
[04/20/2007, 23:03:08] - BHO 5: {F156768E-81EF-470C-9057-481BA8380DBA} (gFlash Class)
[04/20/2007, 23:03:08] - Finished Searching Browser Helper Objects
[04/20/2007, 23:03:08] - Finishing up...
[04/20/2007, 23:03:08] - A restart is needed.
[04/20/2007, 23:03:25] - Attempting to Restart via STOP error (Blue Screen!)

[04/21/2007, 0:35:47] - VirtumundoBeGone v1.5 ( "M:\Documents and Settings\Adam\Pulpit\VirtumundoBeGone.exe" )
[04/21/2007, 0:35:51] - Detected System Information:
[04/21/2007, 0:35:51] - Windows Version: 5.1.2600, Dodatek Service Pack 2
[04/21/2007, 0:35:51] - Current Username: Adam (Admin)
[04/21/2007, 0:35:51] - Windows is in SAFE mode with Networking.
[04/21/2007, 0:35:51] - Searching for Browser Helper Objects:
[04/21/2007, 0:35:51] - BHO 1: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} (AcroIEHlprObj Class)
[04/21/2007, 0:35:51] - BHO 2: {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} (IeCatch5 Class)
[04/21/2007, 0:35:51] - BHO 3: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} (SSVHelper Class)
[04/21/2007, 0:35:51] - BHO 4: {A16229AC-D0FB-4FA4-B405-6B8E95029014} ()
[04/21/2007, 0:35:51] - WARNING: BHO has no default name. Checking for Winlogon reference.
[04/21/2007, 0:35:51] - Checking for HKLM\...\Winlogon\Notify\qaysybqm
[04/21/2007, 0:35:51] - Key not found: HKLM\...\Winlogon\Notify\qaysybqm, continuing.
[04/21/2007, 0:35:51] - BHO 5: {F156768E-81EF-470C-9057-481BA8380DBA} (gFlash Class)
[04/21/2007, 0:35:51] - Finished Searching Browser Helper Objects
[04/21/2007, 0:35:51] - Finishing up...
[04/21/2007, 0:35:51] - Nothing found! Exiting...

[04/21/2007, 0:36:04] - VirtumundoBeGone v1.5 ( "M:\Documents and Settings\Adam\Pulpit\VirtumundoBeGone.exe" )
[04/21/2007, 0:36:07] - Detected System Information:
[04/21/2007, 0:36:07] - Windows Version: 5.1.2600, Dodatek Service Pack 2
[04/21/2007, 0:36:07] - Current Username: Adam (Admin)
[04/21/2007, 0:36:07] - Windows is in SAFE mode with Networking.
[04/21/2007, 0:36:07] - Searching for Browser Helper Objects:
[04/21/2007, 0:36:07] - BHO 1: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} (AcroIEHlprObj Class)
[04/21/2007, 0:36:07] - BHO 2: {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} (IeCatch5 Class)
[04/21/2007, 0:36:07] - BHO 3: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} (SSVHelper Class)
[04/21/2007, 0:36:07] - BHO 4: {A16229AC-D0FB-4FA4-B405-6B8E95029014} ()
[04/21/2007, 0:36:07] - WARNING: BHO has no default name. Checking for Winlogon reference.
[04/21/2007, 0:36:07] - Checking for HKLM\...\Winlogon\Notify\qaysybqm
[04/21/2007, 0:36:07] - Key not found: HKLM\...\Winlogon\Notify\qaysybqm, continuing.
[04/21/2007, 0:36:07] - BHO 5: {F156768E-81EF-470C-9057-481BA8380DBA} (gFlash Class)
[04/21/2007, 0:36:07] - Finished Searching Browser Helper Objects
[04/21/2007, 0:36:07] - Finishing up...
[04/21/2007, 0:36:07] - Nothing found! Exiting...

wirus Vundo jak domniemam został usunięty, niestety 'objawy' nie ustąpiły, nadal wyskakują błędy i transfer jest ograniczony do 4kB/s...
Kolejne logi...

ComboScan:

ComboScan v20070306.20 run by Adam on 2007-04-21 at 00:46:48
Computer is in Normal Mode.
--------------------------------------------------------------------------------

-- HijackThis (run as Adam.exe) ------------------------------------------------

Logfile of HijackThis v1.99.1
Scan saved at 00:46:52, on 2007-04-21
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
M:\WINDOWS\System32\smss.exe
M:\WINDOWS\system32\winlogon.exe
M:\WINDOWS\system32\services.exe
M:\WINDOWS\system32\lsass.exe
M:\WINDOWS\system32\svchost.exe
M:\WINDOWS\System32\svchost.exe
M:\WINDOWS\system32\spoolsv.exe
M:\WINDOWS\explorer.exe
M:\Program Files\DU Meter\DUMeter.exe
M:\Program Files\DAEMON Tools\daemon.exe
M:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
M:\WINDOWS\system32\ctfmon.exe
M:\Program Files\Gadu-Gadu\gg.exe
M:\PROGRA~1\MyPortal\Speed-X\SpeedX.exe
M:\Program Files\NetMeter\NetMeter.exe
M:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
M:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
M:\Documents and Settings\Adam\Moje dokumenty\Sharing\sbclv1.0i\SBCL v1.0i.exe
M:\Program Files\Yahoo!\Widgets\YahooWidgetEngine.exe
M:\WINDOWS\system32\nvsvc32.exe
M:\WINDOWS\system32\svchost.exe
M:\Program Files\Yahoo!\Widgets\YahooWidgetEngine.exe
M:\Program Files\Yahoo!\Widgets\YahooWidgetEngine.exe
M:\Program Files\Yahoo!\Widgets\YahooWidgetEngine.exe
M:\Program Files\Yahoo!\Widgets\YahooWidgetEngine.exe
M:\Program Files\Yahoo!\Widgets\YahooWidgetEngine.exe
M:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
M:\Program Files\Yahoo!\Widgets\YahooWidgetEngine.exe
M:\Program Files\Mozilla Firefox\firefox.exe
M:\WINDOWS\system32\taskmgr.exe
M:\Documents and Settings\Adam\Pulpit\comboscan.exe
P:\Inne\INSTALKI\ZZZ-RE~1\Adam.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.onet.pl/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
F2 - REG:system.ini: Shell=explorer.exe
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - M:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: IeCatch5 Class - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - M:\PROGRA~1\FlashGet\jccatch.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - M:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: (no name) - {A16229AC-D0FB-4FA4-B405-6B8E95029014} - M:\WINDOWS\system32\qaysybqm.dll
O2 - BHO: gFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - M:\PROGRA~1\FlashGet\getflash.dll
O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - M:\PROGRA~1\FlashGet\fgiebar.dll
O4 - HKLM\..\Run: [DU Meter] M:\Program Files\DU Meter\DUMeter.exe
O4 - HKLM\..\Run: [DAEMON Tools] "M:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [SunJavaUpdateSched] "M:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE M:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKCU\..\Run: [CTFMON.EXE] M:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Gadu-Gadu] "M:\Program Files\Gadu-Gadu\gg.exe" /tray
O4 - HKCU\..\Run: [SpeedX] M:\PROGRA~1\MyPortal\Speed-X\SpeedX.exe
O4 - HKCU\..\Run: [M:\Program Files\NetMeter\NetMeter.exe] M:\Program Files\NetMeter\NetMeter.exe
O4 - Startup: Skrót do SBCL v1.lnk = M:\Documents and Settings\Adam\Moje dokumenty\Sharing\sbclv1.0i\SBCL v1.0i.exe
O4 - Startup: Yahoo! Widget Engine.lnk = M:\Program Files\Yahoo!\Widgets\YahooWidgetEngine.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = M:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = M:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://M:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Ściągnij przy pomocy FlashGet'a - M:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: Ściągnij wszystko przy pomocy FlashGet'a - M:\Program Files\FlashGet\jc_all.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - M:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - M:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - M:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - M:\PROGRA~1\FlashGet\flashget.exe
O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - M:\PROGRA~1\FlashGet\flashget.exe
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://kaspersky.pl/resources/virusscanner/kavwebscan_unicode.cab
O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://downloads.ewido.net/ewidoOnlineScan.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - M:\Program Files\Yahoo!\Common\Yinsthelper.dll
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - M:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - M:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: kavsvc - Kaspersky Lab - M:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\kavsvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - M:\WINDOWS\system32\nvsvc32.exe
O23 - Service: ServiceLayer - Nokia. - M:\Program Files\PC Connectivity Solution\ServiceLayer.exe

-- Files created between 2007-03-21 and 2007-04-21 -----------------------------

2007-04-20 22:51:40 0 d-------- M:\VundoFix Backups<VUNDOF~1>
2007-04-20 19:00:07 0 d-------- M:\WINDOWS\CSC
2007-04-20 15:25:42 125460 --a------ M:\WINDOWS\system32\qaysybqm.dll
2007-04-20 15:20:42 353 ---hs---- M:\WINDOWS\system32\nqtwa.ini2<NQTWA~1.INI>
2007-04-14 21:13:02 0 d-------- M:\WINDOWS\Performance<PERFOR~1>
2007-04-13 21:00:25 0 d-------- M:\Program Files\BearShare Applications<BEARSH~2>
2007-04-10 18:00:15 0 d-------- M:\Program Files\EDU CD<EDUCD~1>
2007-03-25 19:19:30 0 d-------- M:\Program Files\NetMeter
2007-03-23 00:39:26 0 d-------- M:\Program Files\VideoLAN
2007-03-22 00:26:29 0 d-------- M:\Program Files\English Translator 2<ENGLIS~1>
2007-03-21 23:20:47 0 d-------- M:\Program Files\Corel

-- Find3M Report ---------------------------------------------------------------

2007-04-21 00:38:02 0 d-------- M:\Program Files\Mozilla Firefox<MOZILL~1>
2007-04-20 15:13:01 0 d-------- M:\Program Files\Uniblue
2007-04-20 15:10:34 0 d-------- M:\Documents and Settings\Adam\Dane aplikacji\Uniblue
2007-04-20 15:09:58 0 d-------- M:\Program Files\DAEMON Tools<DAEMON~1>
2007-04-20 02:30:26 0 d-------- M:\Program Files\FlashGet
2007-04-20 01:43:49 0 d-------- M:\Program Files\Java
2007-04-20 00:18:30 448004 --a------ M:\WINDOWS\system32\perfh015.dat
2007-04-20 00:18:30 74230 --a------ M:\WINDOWS\system32\perfc015.dat
2007-04-19 23:07:25 0 d-------- M:\Documents and Settings\Adam\Dane aplikacji\dvdcss
2007-04-18 20:03:09 0 d-------- M:\Documents and Settings\Adam\Dane aplikacji\foobar2000<FOOBAR~1>
2007-04-17 12:24:16 0 d-------- M:\Program Files\Opera
2007-04-14 23:19:22 0 d-------- M:\Program Files\Winamp
2007-04-14 21:38:31 0 d---s---- M:\Documents and Settings\Adam\Dane aplikacji\Microsoft<MICROS~1>
2007-04-13 23:35:19 0 d-------- M:\Program Files\AllMyMovies<ALLMYM~1>
2007-04-13 23:18:06 0 d-------- M:\Program Files\Ad-Aware SE Personal<AD-AWA~1>
2007-04-13 21:15:44 0 d-------- M:\Documents and Settings\Adam\Dane aplikacji\BearShare<BEARSH~1>
2007-03-29 13:58:06 0 d-------- M:\Documents and Settings\Adam\Dane aplikacji\uTorrent
2007-03-23 00:40:10 0 d-------- M:\Documents and Settings\Adam\Dane aplikacji\vlc
2007-03-20 02:23:54 0 d-------- M:\Program Files\SiGSOFT
2007-03-20 01:15:34 0 d-------- M:\Program Files\SpeedFan
2007-03-20 00:47:14 0 d-------- M:\Program Files\Yahoo!
2007-03-19 18:54:09 0 d-------- M:\Program Files\LPS
2007-03-19 16:09:00 0 d-------- M:\Program Files\K-litePro<K-LITE~2>
2007-03-18 15:09:28 0 d-------- M:\Program Files\Microsoft Games<MICROS~3>
2007-03-17 21:33:02 0 d-------- M:\Program Files\WinUHA
2007-03-17 21:01:40 0 d-------- M:\Documents and Settings\Adam\Dane aplikacji\Kingston
2007-03-17 15:45:36 293376 --a------ M:\WINDOWS\system32\winsrv.dll
2007-03-16 14:48:38 0 d-------- M:\Program Files\XMotorRacingDemo<XMOTOR~1>
2007-03-15 23:50:40 0 d-------- M:\Program Files\Peer2Mail<PEER2M~1>
2007-03-15 15:55:58 0 d-------- M:\Documents and Settings\Adam\Dane aplikacji\GRETECH
2007-03-15 15:55:25 0 d-------- M:\Program Files\GRETECH
2007-03-14 20:27:33 0 d-------- M:\Program Files\Nokia
2007-03-12 19:45:43 0 d-------- M:\Program Files\WorldUnlock Codes Calculator<WORLDU~1>
2007-03-09 17:43:33 0 d-------- M:\Program Files\BearShare Acceleration Patch<BEARSH~1>
2007-03-08 17:38:47 579072 --a------ M:\WINDOWS\system32\user32.dll
2007-03-08 17:38:47 40960 --a------ M:\WINDOWS\system32\mf3216.dll
2007-03-08 17:38:47 281600 --a------ M:\WINDOWS\system32\gdi32.dll
2007-03-08 17:37:33 1843840 --a------ M:\WINDOWS\system32\win32k.sys
2007-03-07 23:03:59 0 d-------- M:\Program Files\HDD Regenerator<HDDREG~1>
2007-03-07 01:54:10 0 d-------- M:\Program Files\foobar2000<FOOBAR~1>
2007-03-06 19:22:19 0 d-------- M:\Program Files\Badongo
2007-03-05 15:30:54 0 d--h----- M:\Program Files\InstallShield Installation Information<INSTAL~1>
2007-03-03 16:39:11 0 dr-h----- M:\Documents and Settings\Adam\Dane aplikacji\SecuROM
2007-03-03 16:39:10 108144 --a------ M:\WINDOWS\system32\CmdLineExt.dll<CMDLIN~1.DLL>
2007-03-01 23:00:48 0 d-------- M:\Program Files\Cartall
2007-03-01 20:45:27 0 d-------- M:\Program Files\Windows NT<WINDOW~1>
2007-03-01 14:49:49 0 d-------- M:\Program Files\Lavalys
2007-02-27 15:44:52 0 d-------- M:\Program Files\MyPortal
2007-02-26 22:22:36 0 d-------- M:\Program Files\Shortcut
2007-02-26 02:04:32 0 d-------- M:\Program Files\NAPI-PROJEKT<NAPI-P~1>
2007-02-23 01:46:39 0 d-------- M:\Documents and Settings\Adam\Dane aplikacji\GanymedeNet<GANYME~1>
2007-02-21 01:05:01 0 d-------- M:\Program Files\Ganymede
2007-02-05 22:19:48 185856 --a------ M:\WINDOWS\system32\upnphost.dll
2007-01-29 10:58:06 60416 -----n--- M:\WINDOWS\system32\tzchange.exe
2007-01-26 15:47:44 3614 --a------ M:\WINDOWS\mozver.dat
2007-01-24 21:19:04 5 --ahs---- M:\WINDOWS\system32\aecdfbfcd6_s.dll<AECDFB~1.DLL>
2007-01-22 20:47:58 249856 --a------ M:\WINDOWS\Setup1.exe
2007-01-22 20:47:56 73216 --a------ M:\WINDOWS\ST6UNST.EXE

-- Registry Dump ---------------------------------------------------------------

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run]
"CTFMON.EXE"="M:\\WINDOWS\\system32\\ctfmon.exe"
"Gadu-Gadu"="\"M:\\Program Files\\Gadu-Gadu\\gg.exe\" /tray"
"SpeedX"="M:\\PROGRA~1\\MyPortal\\Speed-X\\SpeedX.exe"
"M:\\Program Files\\NetMeter\\NetMeter.exe"="M:\\Program Files\\NetMeter\\NetMeter.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run]
"DU Meter"="M:\\Program Files\\DU Meter\\DUMeter.exe"
"DAEMON Tools"="\"M:\\Program Files\\DAEMON Tools\\daemon.exe\" -lang 1033"
"SunJavaUpdateSched"="\"M:\\Program Files\\Java\\jre1.6.0_01\\bin\\jusched.exe\""
"NvCplDaemon"="RUNDLL32.EXE M:\\WINDOWS\\system32\\NvCpl.dll,NvStartup"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\IMAIL]
"Installed"="1"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MAPI]
"Installed"="1"
"NoChange"="1"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MSFS]
"Installed"="1"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{57B86673-276A-48B2-BAE7-C6DBB3020EB8}"="AVG Anti-Spyware 7.5"
"{034BCF48-D4E7-4335-8F56-CE9AB44F6961}"=""

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"CTFMON.EXE"="M:\\WINDOWS\\system32\\CTFMON.EXE"

[HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\run]
"CTFMON.EXE"="M:\\WINDOWS\\system32\\CTFMON.EXE"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"DisableRegistryTools"=dword:00000000

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoLowDiskSpaceChecks"=dword:00000000

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\DisAllowRun]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\Run]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll"

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Svchost]
HTTPFilter REG_MULTI_SZ HTTPFilter\0\0
LocalService REG_MULTI_SZ Alerter\0WebClient\0LmHosts\0RemoteRegistry\0upnphost\0SSDPSRV\0\0
NetworkService REG_MULTI_SZ DnsCache\0\0
DcomLaunch REG_MULTI_SZ DcomLaunch\0TermService\0\0
rpcss REG_MULTI_SZ RpcSs\0\0
imgsvc REG_MULTI_SZ StiSvc\0\0
termsvcs REG_MULTI_SZ TermService\0\0

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\F]
Shell\AutoRun\command F:\Autorun.exe

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\G]
Shell\AutoRun\command G:\start.exe

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{8b562a0e-4426-11db-9bde-000ae60852ae}]
Shell\AutoRun\command F:\Autorun.exe

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{8b562a0f-4426-11db-9bde-000ae60852ae}]
Shell\AutoRun\command G:\start.exe

-- End of ComboScan: finished at 2007-04-21 at 00:47:29 ------------------------

Po uruchomieniu Silent Runners wyskakuje od razu notatnik z długim "logiem" który podałem wcześniej

**Posty:** 4043 · przez **prog** 21 Kwi 2007, 08:55

Jakim logiem? Vundo jeszcze jest, potrzebny silent...

**Posty:** 2547 · przez **lance87** 21 Kwi 2007, 12:33

prog napisał(a):Jakim logiem?

Usunąłem go, bo rozwalał forum - pobrałem nawet na nowo Silent'a i jak klikam na ikonkę to od razu wyskakuje zamiast okienka z wyborem opcji notatnik z niepoprawnym jak napisał wojtas19162 logiem

Najważniejsze, że co do jednego się wyjaśniło - ograniczenie sieci to był jednak problem ze strony dostawcy i dzisiaj jest już OK

Co do Vundo w skanerze Nortona w ogóle mi go nie wykrył, "VirtumundoBeGone " wykrył go w trzech plikach w katalogu Windows'a (u mnie M:\WINDOWS\system32\), a po następnych dwóch uruchomieniach wskazywał że go nie ma, tak samo z trzecim narzędziem...
Teraz w sumie trapi mnie tylko błąd podany wyżej, a więc i niemożliwość uruchomienia Ad-Aware ani Spybot'a (nawet po reinstalce). Poza tym raczej nie ma problemów...
A myślałem, że wystarczająco dbam o system, a tu jednak chyba dzień hakera zrobił swoje

Jakieś dalsze instrukcje co do pozbycia się syfów, czy w końcu lepiej zrobić, choć mi się nie chce tego format'a od grubo ponad pół roku?

**Posty:** 18165 · przez **wojtas** 21 Kwi 2007, 14:10

formata nie robimy :wink:

czy napeno robisz silenta zgodnie z instrukcja??

http://forum.programosy.pl/hijackthis-amp-silent-runners-gtobsuga-i-umieszczanie-vt9452.html

pokaz nowy log z comboscana i damy usuwanie

**Posty:** 2547 · przez **lance87** 21 Kwi 2007, 14:28

Wiem, że format to ostateczność i też chcę się bez niego obejść, choć przydałby się już

Przechodząc do meritum - Silent'a miałem ustawionego "Otwórz za pomocą.." notatnika i to dlatego. Normalnie niestety też nie chce się włączyć, wyskakuje, że nie jest prawidłową aplikacją Win32

Log z ComboScan'a:

ComboScan v20070306.20 run by Adam on 2007-04-21 at 14:12:23
Computer is in Normal Mode.
--------------------------------------------------------------------------------

-- HijackThis (run as Adam.exe) ------------------------------------------------

Logfile of HijackThis v1.99.1
Scan saved at 14:12:36, on 2007-04-21
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
M:\WINDOWS\System32\smss.exe
M:\WINDOWS\system32\winlogon.exe
M:\WINDOWS\system32\services.exe
M:\WINDOWS\system32\lsass.exe
M:\WINDOWS\system32\svchost.exe
M:\WINDOWS\System32\svchost.exe
M:\WINDOWS\system32\spoolsv.exe
M:\WINDOWS\explorer.exe
M:\Program Files\DU Meter\DUMeter.exe
M:\Program Files\DAEMON Tools\daemon.exe
M:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
M:\WINDOWS\system32\ctfmon.exe
M:\Program Files\Gadu-Gadu\gg.exe
M:\PROGRA~1\MyPortal\Speed-X\SpeedX.exe
M:\Program Files\NetMeter\NetMeter.exe
M:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
M:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
M:\Documents and Settings\Adam\Moje dokumenty\Sharing\sbclv1.0i\SBCL v1.0i.exe
M:\Program Files\Yahoo!\Widgets\YahooWidgetEngine.exe
M:\WINDOWS\system32\nvsvc32.exe
M:\WINDOWS\system32\svchost.exe
M:\Program Files\Yahoo!\Widgets\YahooWidgetEngine.exe
M:\Program Files\Yahoo!\Widgets\YahooWidgetEngine.exe
M:\Program Files\Yahoo!\Widgets\YahooWidgetEngine.exe
M:\Program Files\Yahoo!\Widgets\YahooWidgetEngine.exe
M:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
M:\Program Files\Yahoo!\Widgets\YahooWidgetEngine.exe
M:\Program Files\Yahoo!\Widgets\YahooWidgetEngine.exe
M:\Program Files\Mozilla Firefox\firefox.exe
M:\WINDOWS\system32\taskmgr.exe
M:\Program Files\Winamp\winampa.exe
M:\Program Files\Winamp\winamp.exe
M:\Documents and Settings\Adam\Pulpit\comboscan.exe
P:\Inne\INSTALKI\ZZZ-RE~1\Adam.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.onet.pl/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
F2 - REG:system.ini: Shell=explorer.exe
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - M:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: IeCatch5 Class - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - M:\PROGRA~1\FlashGet\jccatch.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - M:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: (no name) - {A16229AC-D0FB-4FA4-B405-6B8E95029014} - M:\WINDOWS\system32\qaysybqm.dll
O2 - BHO: gFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - M:\PROGRA~1\FlashGet\getflash.dll
O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - M:\PROGRA~1\FlashGet\fgiebar.dll
O4 - HKLM\..\Run: [DU Meter] M:\Program Files\DU Meter\DUMeter.exe
O4 - HKLM\..\Run: [DAEMON Tools] "M:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [SunJavaUpdateSched] "M:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE M:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [WinampAgent] "M:\Program Files\Winamp\winampa.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] M:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Gadu-Gadu] "M:\Program Files\Gadu-Gadu\gg.exe" /tray
O4 - HKCU\..\Run: [SpeedX] M:\PROGRA~1\MyPortal\Speed-X\SpeedX.exe
O4 - HKCU\..\Run: [M:\Program Files\NetMeter\NetMeter.exe] M:\Program Files\NetMeter\NetMeter.exe
O4 - Startup: Skrót do SBCL v1.lnk = M:\Documents and Settings\Adam\Moje dokumenty\Sharing\sbclv1.0i\SBCL v1.0i.exe
O4 - Startup: Yahoo! Widget Engine.lnk = M:\Program Files\Yahoo!\Widgets\YahooWidgetEngine.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = M:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = M:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://M:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Ściągnij przy pomocy FlashGet'a - M:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: Ściągnij wszystko przy pomocy FlashGet'a - M:\Program Files\FlashGet\jc_all.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - M:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - M:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - M:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - M:\PROGRA~1\FlashGet\flashget.exe
O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - M:\PROGRA~1\FlashGet\flashget.exe
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://kaspersky.pl/resources/virusscanner/kavwebscan_unicode.cab
O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://downloads.ewido.net/ewidoOnlineScan.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - M:\Program Files\Yahoo!\Common\Yinsthelper.dll
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - M:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - M:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: kavsvc - Kaspersky Lab - M:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\kavsvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - M:\WINDOWS\system32\nvsvc32.exe
O23 - Service: ServiceLayer - Nokia. - M:\Program Files\PC Connectivity Solution\ServiceLayer.exe

-- Files created between 2007-03-21 and 2007-04-21 -----------------------------

2007-04-20 22:51:40 0 d-------- M:\VundoFix Backups<VUNDOF~1>
2007-04-20 19:00:07 0 d--hs---- M:\WINDOWS\CSC
2007-04-20 15:25:42 125460 --a------ M:\WINDOWS\system32\qaysybqm.dll
2007-04-20 15:20:42 353 ---hs---- M:\WINDOWS\system32\nqtwa.ini2<NQTWA~1.INI>
2007-04-14 21:13:02 0 d-------- M:\WINDOWS\Performance<PERFOR~1>
2007-04-13 21:00:25 0 d-------- M:\Program Files\BearShare Applications<BEARSH~2>
2007-04-10 18:00:15 0 d-------- M:\Program Files\EDU CD<EDUCD~1>
2007-03-25 19:19:30 0 d-------- M:\Program Files\NetMeter
2007-03-23 00:39:26 0 d-------- M:\Program Files\VideoLAN
2007-03-22 00:26:29 0 d-------- M:\Program Files\English Translator 2<ENGLIS~1>
2007-03-21 23:20:47 0 d-------- M:\Program Files\Corel

-- Find3M Report ---------------------------------------------------------------

2007-04-21 11:32:27 0 d-------- M:\Program Files\Mozilla Firefox<MOZILL~1>
2007-04-20 15:13:01 0 d-------- M:\Program Files\Uniblue
2007-04-20 15:10:34 0 d-------- M:\Documents and Settings\Adam\Dane aplikacji\Uniblue
2007-04-20 15:09:58 0 d-------- M:\Program Files\DAEMON Tools<DAEMON~1>
2007-04-20 02:30:26 0 d-------- M:\Program Files\FlashGet
2007-04-20 01:43:49 0 d-------- M:\Program Files\Java
2007-04-20 00:18:30 448004 --a------ M:\WINDOWS\system32\perfh015.dat
2007-04-20 00:18:30 74230 --a------ M:\WINDOWS\system32\perfc015.dat
2007-04-19 23:07:25 0 d-------- M:\Documents and Settings\Adam\Dane aplikacji\dvdcss
2007-04-18 20:03:09 0 d-------- M:\Documents and Settings\Adam\Dane aplikacji\foobar2000<FOOBAR~1>
2007-04-17 12:24:16 0 d-------- M:\Program Files\Opera
2007-04-14 23:19:22 0 d-------- M:\Program Files\Winamp
2007-04-14 21:38:31 0 d---s---- M:\Documents and Settings\Adam\Dane aplikacji\Microsoft<MICROS~1>
2007-04-13 23:35:19 0 d-------- M:\Program Files\AllMyMovies<ALLMYM~1>
2007-04-13 23:18:06 0 d-------- M:\Program Files\Ad-Aware SE Personal<AD-AWA~1>
2007-04-13 21:15:44 0 d-------- M:\Documents and Settings\Adam\Dane aplikacji\BearShare<BEARSH~1>
2007-03-29 13:58:06 0 d-------- M:\Documents and Settings\Adam\Dane aplikacji\uTorrent
2007-03-23 00:40:10 0 d-------- M:\Documents and Settings\Adam\Dane aplikacji\vlc
2007-03-20 02:23:54 0 d-------- M:\Program Files\SiGSOFT
2007-03-20 01:15:34 0 d-------- M:\Program Files\SpeedFan
2007-03-20 00:47:14 0 d-------- M:\Program Files\Yahoo!
2007-03-19 18:54:09 0 d-------- M:\Program Files\LPS
2007-03-19 16:09:00 0 d-------- M:\Program Files\K-litePro<K-LITE~2>
2007-03-18 15:09:28 0 d-------- M:\Program Files\Microsoft Games<MICROS~3>
2007-03-17 21:33:02 0 d-------- M:\Program Files\WinUHA
2007-03-17 21:01:40 0 d-------- M:\Documents and Settings\Adam\Dane aplikacji\Kingston
2007-03-17 15:45:36 293376 --a------ M:\WINDOWS\system32\winsrv.dll
2007-03-16 14:48:38 0 d-------- M:\Program Files\XMotorRacingDemo<XMOTOR~1>
2007-03-15 23:50:40 0 d-------- M:\Program Files\Peer2Mail<PEER2M~1>
2007-03-15 15:55:58 0 d-------- M:\Documents and Settings\Adam\Dane aplikacji\GRETECH
2007-03-15 15:55:25 0 d-------- M:\Program Files\GRETECH
2007-03-14 20:27:33 0 d-------- M:\Program Files\Nokia
2007-03-12 19:45:43 0 d-------- M:\Program Files\WorldUnlock Codes Calculator<WORLDU~1>
2007-03-09 17:43:33 0 d-------- M:\Program Files\BearShare Acceleration Patch<BEARSH~1>
2007-03-08 17:38:47 579072 --a------ M:\WINDOWS\system32\user32.dll
2007-03-08 17:38:47 40960 --a------ M:\WINDOWS\system32\mf3216.dll
2007-03-08 17:38:47 281600 --a------ M:\WINDOWS\system32\gdi32.dll
2007-03-08 17:37:33 1843840 --a------ M:\WINDOWS\system32\win32k.sys
2007-03-07 23:03:59 0 d-------- M:\Program Files\HDD Regenerator<HDDREG~1>
2007-03-07 01:54:10 0 d-------- M:\Program Files\foobar2000<FOOBAR~1>
2007-03-06 19:22:19 0 d-------- M:\Program Files\Badongo
2007-03-05 15:30:54 0 d--h----- M:\Program Files\InstallShield Installation Information<INSTAL~1>
2007-03-03 16:39:11 0 dr-h----- M:\Documents and Settings\Adam\Dane aplikacji\SecuROM
2007-03-03 16:39:10 108144 --a------ M:\WINDOWS\system32\CmdLineExt.dll<CMDLIN~1.DLL>
2007-03-01 23:00:48 0 d-------- M:\Program Files\Cartall
2007-03-01 20:45:27 0 d-------- M:\Program Files\Windows NT<WINDOW~1>
2007-03-01 14:49:49 0 d-------- M:\Program Files\Lavalys
2007-02-27 15:44:52 0 d-------- M:\Program Files\MyPortal
2007-02-26 22:22:36 0 d-------- M:\Program Files\Shortcut
2007-02-26 02:04:32 0 d-------- M:\Program Files\NAPI-PROJEKT<NAPI-P~1>
2007-02-23 01:46:39 0 d-------- M:\Documents and Settings\Adam\Dane aplikacji\GanymedeNet<GANYME~1>
2007-02-21 01:05:01 0 d-------- M:\Program Files\Ganymede
2007-02-05 22:19:48 185856 --a------ M:\WINDOWS\system32\upnphost.dll
2007-01-29 10:58:06 60416 -----n--- M:\WINDOWS\system32\tzchange.exe
2007-01-26 15:47:44 3614 --a------ M:\WINDOWS\mozver.dat
2007-01-24 21:19:04 5 --ahs---- M:\WINDOWS\system32\aecdfbfcd6_s.dll<AECDFB~1.DLL>
2007-01-22 20:47:58 249856 --a------ M:\WINDOWS\Setup1.exe
2007-01-22 20:47:56 73216 --a------ M:\WINDOWS\ST6UNST.EXE

-- Registry Dump ---------------------------------------------------------------

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run]
"CTFMON.EXE"="M:\\WINDOWS\\system32\\ctfmon.exe"
"Gadu-Gadu"="\"M:\\Program Files\\Gadu-Gadu\\gg.exe\" /tray"
"SpeedX"="M:\\PROGRA~1\\MyPortal\\Speed-X\\SpeedX.exe"
"M:\\Program Files\\NetMeter\\NetMeter.exe"="M:\\Program Files\\NetMeter\\NetMeter.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run]
"DU Meter"="M:\\Program Files\\DU Meter\\DUMeter.exe"
"DAEMON Tools"="\"M:\\Program Files\\DAEMON Tools\\daemon.exe\" -lang 1033"
"SunJavaUpdateSched"="\"M:\\Program Files\\Java\\jre1.6.0_01\\bin\\jusched.exe\""
"NvCplDaemon"="RUNDLL32.EXE M:\\WINDOWS\\system32\\NvCpl.dll,NvStartup"
"WinampAgent"="\"M:\\Program Files\\Winamp\\winampa.exe\""

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\IMAIL]
"Installed"="1"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MAPI]
"Installed"="1"
"NoChange"="1"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MSFS]
"Installed"="1"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{57B86673-276A-48B2-BAE7-C6DBB3020EB8}"="AVG Anti-Spyware 7.5"
"{034BCF48-D4E7-4335-8F56-CE9AB44F6961}"=""

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"CTFMON.EXE"="M:\\WINDOWS\\system32\\CTFMON.EXE"

[HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\run]
"CTFMON.EXE"="M:\\WINDOWS\\system32\\CTFMON.EXE"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"DisableRegistryTools"=dword:00000000

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoLowDiskSpaceChecks"=dword:00000000

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\DisAllowRun]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\Run]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll"

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Svchost]
HTTPFilter REG_MULTI_SZ HTTPFilter\0\0
LocalService REG_MULTI_SZ Alerter\0WebClient\0LmHosts\0RemoteRegistry\0upnphost\0SSDPSRV\0\0
NetworkService REG_MULTI_SZ DnsCache\0\0
DcomLaunch REG_MULTI_SZ DcomLaunch\0TermService\0\0
rpcss REG_MULTI_SZ RpcSs\0\0
imgsvc REG_MULTI_SZ StiSvc\0\0
termsvcs REG_MULTI_SZ TermService\0\0

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\F]
Shell\AutoRun\command F:\Autorun.exe

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\G]
Shell\AutoRun\command G:\start.exe

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{8b562a0e-4426-11db-9bde-000ae60852ae}]
Shell\AutoRun\command F:\Autorun.exe

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{8b562a0f-4426-11db-9bde-000ae60852ae}]
Shell\AutoRun\command G:\start.exe

-- End of ComboScan: finished at 2007-04-21 at 14:15:02 ------------------------

**Posty:** 18165 · przez **wojtas** 21 Kwi 2007, 14:35

Pobierz i uruchom narzędzie : The Avenger
http://swandog46.geekstogo.com/avenger.zip
Zaznacz opcję Input script manually i kliknij na Lupkę z prawej strony. W okienku, które się otworzy wklejasz:

Files to delete:

M:\WINDOWS\system32\qaysybqm.dll
M:\WINDOWS\system32\nqtwa.ini2
M:\WINDOWS\Setup1.exe
M:\WINDOWS\ST6UNST.EXE

Folders to delete:

M:\VundoFix Backups
M:\Program Files\BearShare Applications

Klikasz Done, a następnie zielone światełko i zgadzasz się na restart klikając OK.
Po restarcie w HijackThis usuwasz wpis/y

Kod: Zaznacz wszystko: O2 - BHO: (no name) - {A16229AC-D0FB-4FA4-B405-6B8E95029014} - M:\WINDOWS\system32\qaysybqm.dll

Kasujesz ręcznie z dysku plik: C:\Avenger\backup.zip i wklejasz na forum raport: C:\avenger.txt + combo

otwierasz notatnik i wklejasz:

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{034BCF48-D4E7-4335-8F56-CE9AB44F6961}"=-

w notatniku u góry>>>plik zapisz jako>>>Zmien rozszerzenie z TXT na Wszystkie pliki *.* >>> Zapisz pod nazwą FIX.REG

Klikasz dwa razy na powstały plik fix i dodajesz go do rejestru....

Autor postu otrzymał pochwałę

**Posty:** 2547 · przez **lance87** 21 Kwi 2007, 14:49

Wszystko zrobione
AVENGER:

Logfile of The Avenger version 1, by Swandog46
Running from registry key:
\Registry\Machine\System\CurrentControlSet\Services\gcm^dejh

*******************

Script file located at: \??\M:\Documents and Settings\aispbehg.txt
Script file opened successfully.

Script file read successfully

Backups directory opened successfully at M:\Avenger

*******************

Beginning to process script file:

File M:\WINDOWS\system32\qaysybqm.dll deleted successfully.
File M:\WINDOWS\system32\nqtwa.ini2 deleted successfully.
Folder M:\VundoFix Backups deleted successfully.
Folder M:\Program Files\BearShare Applications deleted successfully.

Completed script processing.

*******************

Finished! Terminate.

ComboScan:

ComboScan v20070306.20 run by Adam on 2007-04-21 at 14:33:29
Computer is in Normal Mode.
--------------------------------------------------------------------------------

-- HijackThis (run as Adam.exe) ------------------------------------------------

Logfile of HijackThis v1.99.1
Scan saved at 14:33:30, on 2007-04-21
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
M:\WINDOWS\System32\smss.exe
M:\WINDOWS\system32\winlogon.exe
M:\WINDOWS\system32\services.exe
M:\WINDOWS\system32\lsass.exe
M:\WINDOWS\system32\svchost.exe
M:\WINDOWS\System32\svchost.exe
M:\WINDOWS\system32\spoolsv.exe
M:\WINDOWS\explorer.exe
M:\Program Files\DU Meter\DUMeter.exe
M:\Program Files\DAEMON Tools\daemon.exe
M:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
M:\Program Files\Winamp\winampa.exe
M:\WINDOWS\system32\ctfmon.exe
M:\PROGRA~1\MyPortal\Speed-X\SpeedX.exe
M:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
M:\Program Files\NetMeter\NetMeter.exe
M:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
M:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
M:\Documents and Settings\Adam\Moje dokumenty\Sharing\sbclv1.0i\SBCL v1.0i.exe
M:\WINDOWS\system32\nvsvc32.exe
M:\WINDOWS\system32\svchost.exe
M:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
M:\WINDOWS\system32\NOTEPAD.EXE
M:\WINDOWS\system32\wuauclt.exe
M:\Documents and Settings\Adam\Pulpit\comboscan.exe
M:\DOCUME~1\Adam\Pulpit\Adam.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.onet.pl/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
F2 - REG:system.ini: Shell=explorer.exe
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - M:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: IeCatch5 Class - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - M:\PROGRA~1\FlashGet\jccatch.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - M:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: gFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - M:\PROGRA~1\FlashGet\getflash.dll
O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - M:\PROGRA~1\FlashGet\fgiebar.dll
O4 - HKLM\..\Run: [DU Meter] M:\Program Files\DU Meter\DUMeter.exe
O4 - HKLM\..\Run: [DAEMON Tools] "M:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [SunJavaUpdateSched] "M:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE M:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [WinampAgent] "M:\Program Files\Winamp\winampa.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] M:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Gadu-Gadu] "M:\Program Files\Gadu-Gadu\gg.exe" /tray
O4 - HKCU\..\Run: [SpeedX] M:\PROGRA~1\MyPortal\Speed-X\SpeedX.exe
O4 - HKCU\..\Run: [M:\Program Files\NetMeter\NetMeter.exe] M:\Program Files\NetMeter\NetMeter.exe
O4 - Startup: Skrót do SBCL v1.lnk = M:\Documents and Settings\Adam\Moje dokumenty\Sharing\sbclv1.0i\SBCL v1.0i.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = M:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = M:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://M:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Ściągnij przy pomocy FlashGet'a - M:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: Ściągnij wszystko przy pomocy FlashGet'a - M:\Program Files\FlashGet\jc_all.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - M:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - M:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - M:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - M:\PROGRA~1\FlashGet\flashget.exe
O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - M:\PROGRA~1\FlashGet\flashget.exe
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://kaspersky.pl/resources/virusscanner/kavwebscan_unicode.cab
O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://downloads.ewido.net/ewidoOnlineScan.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - M:\Program Files\Yahoo!\Common\Yinsthelper.dll
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - M:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - M:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: kavsvc - Kaspersky Lab - M:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\kavsvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - M:\WINDOWS\system32\nvsvc32.exe
O23 - Service: ServiceLayer - Nokia. - M:\Program Files\PC Connectivity Solution\ServiceLayer.exe

-- Files created between 2007-03-21 and 2007-04-21 -----------------------------

2007-04-20 19:00:07 0 d--hs---- M:\WINDOWS\CSC
2007-04-14 21:13:02 0 d-------- M:\WINDOWS\Performance<PERFOR~1>
2007-04-10 18:00:15 0 d-------- M:\Program Files\EDU CD<EDUCD~1>
2007-03-25 19:19:30 0 d-------- M:\Program Files\NetMeter
2007-03-23 00:39:26 0 d-------- M:\Program Files\VideoLAN
2007-03-22 00:26:29 0 d-------- M:\Program Files\English Translator 2<ENGLIS~1>
2007-03-21 23:20:47 0 d-------- M:\Program Files\Corel

-- Find3M Report ---------------------------------------------------------------

2007-04-21 14:33:41 0 d-------- M:\Program Files\Mozilla Firefox<MOZILL~1>
2007-04-20 15:13:01 0 d-------- M:\Program Files\Uniblue
2007-04-20 15:10:34 0 d-------- M:\Documents and Settings\Adam\Dane aplikacji\Uniblue
2007-04-20 15:09:58 0 d-------- M:\Program Files\DAEMON Tools<DAEMON~1>
2007-04-20 02:30:26 0 d-------- M:\Program Files\FlashGet
2007-04-20 01:43:49 0 d-------- M:\Program Files\Java
2007-04-20 00:18:30 448004 --a------ M:\WINDOWS\system32\perfh015.dat
2007-04-20 00:18:30 74230 --a------ M:\WINDOWS\system32\perfc015.dat
2007-04-19 23:07:25 0 d-------- M:\Documents and Settings\Adam\Dane aplikacji\dvdcss
2007-04-18 20:03:09 0 d-------- M:\Documents and Settings\Adam\Dane aplikacji\foobar2000<FOOBAR~1>
2007-04-17 12:24:16 0 d-------- M:\Program Files\Opera
2007-04-14 23:19:22 0 d-------- M:\Program Files\Winamp
2007-04-14 21:38:31 0 d---s---- M:\Documents and Settings\Adam\Dane aplikacji\Microsoft<MICROS~1>
2007-04-13 23:35:19 0 d-------- M:\Program Files\AllMyMovies<ALLMYM~1>
2007-04-13 23:18:06 0 d-------- M:\Program Files\Ad-Aware SE Personal<AD-AWA~1>
2007-04-13 21:15:44 0 d-------- M:\Documents and Settings\Adam\Dane aplikacji\BearShare<BEARSH~1>
2007-03-29 13:58:06 0 d-------- M:\Documents and Settings\Adam\Dane aplikacji\uTorrent
2007-03-23 00:40:10 0 d-------- M:\Documents and Settings\Adam\Dane aplikacji\vlc
2007-03-20 02:23:54 0 d-------- M:\Program Files\SiGSOFT
2007-03-20 01:15:34 0 d-------- M:\Program Files\SpeedFan
2007-03-20 00:47:14 0 d-------- M:\Program Files\Yahoo!
2007-03-19 18:54:09 0 d-------- M:\Program Files\LPS
2007-03-19 16:09:00 0 d-------- M:\Program Files\K-litePro<K-LITE~2>
2007-03-18 15:09:28 0 d-------- M:\Program Files\Microsoft Games<MICROS~3>
2007-03-17 21:33:02 0 d-------- M:\Program Files\WinUHA
2007-03-17 21:01:40 0 d-------- M:\Documents and Settings\Adam\Dane aplikacji\Kingston
2007-03-17 15:45:36 293376 --a------ M:\WINDOWS\system32\winsrv.dll
2007-03-16 14:48:38 0 d-------- M:\Program Files\XMotorRacingDemo<XMOTOR~1>
2007-03-15 23:50:40 0 d-------- M:\Program Files\Peer2Mail<PEER2M~1>
2007-03-15 15:55:58 0 d-------- M:\Documents and Settings\Adam\Dane aplikacji\GRETECH
2007-03-15 15:55:25 0 d-------- M:\Program Files\GRETECH
2007-03-14 20:27:33 0 d-------- M:\Program Files\Nokia
2007-03-12 19:45:43 0 d-------- M:\Program Files\WorldUnlock Codes Calculator<WORLDU~1>
2007-03-09 17:43:33 0 d-------- M:\Program Files\BearShare Acceleration Patch<BEARSH~1>
2007-03-08 17:38:47 579072 --a------ M:\WINDOWS\system32\user32.dll
2007-03-08 17:38:47 40960 --a------ M:\WINDOWS\system32\mf3216.dll
2007-03-08 17:38:47 281600 --a------ M:\WINDOWS\system32\gdi32.dll
2007-03-08 17:37:33 1843840 --a------ M:\WINDOWS\system32\win32k.sys
2007-03-07 23:03:59 0 d-------- M:\Program Files\HDD Regenerator<HDDREG~1>
2007-03-07 01:54:10 0 d-------- M:\Program Files\foobar2000<FOOBAR~1>
2007-03-06 19:22:19 0 d-------- M:\Program Files\Badongo
2007-03-05 15:30:54 0 d--h----- M:\Program Files\InstallShield Installation Information<INSTAL~1>
2007-03-03 16:39:11 0 dr-h----- M:\Documents and Settings\Adam\Dane aplikacji\SecuROM
2007-03-03 16:39:10 108144 --a------ M:\WINDOWS\system32\CmdLineExt.dll<CMDLIN~1.DLL>
2007-03-01 23:00:48 0 d-------- M:\Program Files\Cartall
2007-03-01 20:45:27 0 d-------- M:\Program Files\Windows NT<WINDOW~1>
2007-03-01 14:49:49 0 d-------- M:\Program Files\Lavalys
2007-02-27 15:44:52 0 d-------- M:\Program Files\MyPortal
2007-02-26 22:22:36 0 d-------- M:\Program Files\Shortcut
2007-02-26 02:04:32 0 d-------- M:\Program Files\NAPI-PROJEKT<NAPI-P~1>
2007-02-23 01:46:39 0 d-------- M:\Documents and Settings\Adam\Dane aplikacji\GanymedeNet<GANYME~1>
2007-02-21 01:05:01 0 d-------- M:\Program Files\Ganymede
2007-02-05 22:19:48 185856 --a------ M:\WINDOWS\system32\upnphost.dll
2007-01-29 10:58:06 60416 -----n--- M:\WINDOWS\system32\tzchange.exe
2007-01-26 15:47:44 3614 --a------ M:\WINDOWS\mozver.dat
2007-01-24 21:19:04 5 --ahs---- M:\WINDOWS\system32\aecdfbfcd6_s.dll<AECDFB~1.DLL>
2007-01-22 20:47:58 249856 --a------ M:\WINDOWS\Setup1.exe
2007-01-22 20:47:56 73216 --a------ M:\WINDOWS\ST6UNST.EXE

-- Registry Dump ---------------------------------------------------------------

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run]
"CTFMON.EXE"="M:\\WINDOWS\\system32\\ctfmon.exe"
"Gadu-Gadu"="\"M:\\Program Files\\Gadu-Gadu\\gg.exe\" /tray"
"SpeedX"="M:\\PROGRA~1\\MyPortal\\Speed-X\\SpeedX.exe"
"M:\\Program Files\\NetMeter\\NetMeter.exe"="M:\\Program Files\\NetMeter\\NetMeter.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run]
"DU Meter"="M:\\Program Files\\DU Meter\\DUMeter.exe"
"DAEMON Tools"="\"M:\\Program Files\\DAEMON Tools\\daemon.exe\" -lang 1033"
"SunJavaUpdateSched"="\"M:\\Program Files\\Java\\jre1.6.0_01\\bin\\jusched.exe\""
"NvCplDaemon"="RUNDLL32.EXE M:\\WINDOWS\\system32\\NvCpl.dll,NvStartup"
"WinampAgent"="\"M:\\Program Files\\Winamp\\winampa.exe\""

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\IMAIL]
"Installed"="1"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MAPI]
"Installed"="1"
"NoChange"="1"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MSFS]
"Installed"="1"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{57B86673-276A-48B2-BAE7-C6DBB3020EB8}"="AVG Anti-Spyware 7.5"

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"CTFMON.EXE"="M:\\WINDOWS\\system32\\CTFMON.EXE"

[HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\run]
"CTFMON.EXE"="M:\\WINDOWS\\system32\\CTFMON.EXE"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"DisableRegistryTools"=dword:00000000

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoLowDiskSpaceChecks"=dword:00000000

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\DisAllowRun]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\Run]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll"

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Svchost]
HTTPFilter REG_MULTI_SZ HTTPFilter\0\0
LocalService REG_MULTI_SZ Alerter\0WebClient\0LmHosts\0RemoteRegistry\0upnphost\0SSDPSRV\0\0
NetworkService REG_MULTI_SZ DnsCache\0\0
DcomLaunch REG_MULTI_SZ DcomLaunch\0TermService\0\0
rpcss REG_MULTI_SZ RpcSs\0\0
imgsvc REG_MULTI_SZ StiSvc\0\0
termsvcs REG_MULTI_SZ TermService\0\0

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\F]
Shell\AutoRun\command F:\Autorun.exe

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\G]
Shell\AutoRun\command G:\start.exe

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{8b562a0e-4426-11db-9bde-000ae60852ae}]
Shell\AutoRun\command F:\Autorun.exe

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{8b562a0f-4426-11db-9bde-000ae60852ae}]
Shell\AutoRun\command G:\start.exe

-- End of ComboScan: finished at 2007-04-21 at 14:34:22 ------------------------

Błąd dalej nie daje mi spokoju...
[EDIT]
Zauważyłem też, że przy ponownym uruchomieniu komputera pokazuje rozszerzenia plików oraz pliki ukryte, chociaż tego nie włączałem :roll:

Denerwuje mnie tez, że nie mogę uruchomić też tego Silent Runners'a

**Posty:** 4043 · przez **prog** 21 Kwi 2007, 15:00

Są jeszcze dwa pliki:

M:\WINDOWS\Setup1.exe
M:\WINDOWS\ST6UNST.EXE

Ściągnij proszę Pocket Killbox.

Zaznaczasz opcje delete on reboot. W polu full path of file to delete wpisujesz kolejno podane przezemnie ścieżki i klikasz X (dopiero przy ostatnim zgadzasz sie na reseta).

[ Dodano: Dzisiaj o 15:06 ]
Co do SR - spróbuj we właściwościach ustawić tryb zgodności.

Autor postu otrzymał pochwałę

**Posty:** 2547 · przez **lance87** 21 Kwi 2007, 17:32

Po użyciu Pocket Killbox'a błędy ustąpiły

Jako że mogę już używać Ad-Aware i Spybota przy okazji przeskanowałem nimi jak i Ewido dysk. Wykryło kilka "syfków", ale raczej nie groźnych - głównie 'TrackingCookie', co często wcześniej się zdarzało - może jest sposób by się tego raz na zawsze pozbyć?

prog napisał(a):Co do SR - spróbuj we właściwościach ustawić tryb zgodności

Nie ma nawet takiej opcji we właściwościach (to samo przy ponownym pobraniu), chyba coś mocno z tym plikiem jest namieszane...
W sumie to chyba byłoby na tyle

Wielkie dzięki za pomoc i oczywiście nagroda za nią :mrgreen:

[EDIT]
Bym zapomniał - log z ComboScan'a (Silent'a dalej nie umię uruchomić

) do 'weryfikacji':

ComboScan v20070306.20 run by Adam on 2007-04-21 at 17:21:44
Computer is in Normal Mode.
--------------------------------------------------------------------------------

-- HijackThis (run as Adam.exe) ------------------------------------------------

Logfile of HijackThis v1.99.1
Scan saved at 17:21:56, on 2007-04-21
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
M:\WINDOWS\System32\smss.exe
M:\WINDOWS\system32\winlogon.exe
M:\WINDOWS\system32\services.exe
M:\WINDOWS\system32\lsass.exe
M:\WINDOWS\system32\svchost.exe
M:\WINDOWS\System32\svchost.exe
M:\WINDOWS\system32\spoolsv.exe
M:\WINDOWS\explorer.exe
M:\Program Files\DU Meter\DUMeter.exe
M:\Program Files\DAEMON Tools\daemon.exe
M:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
M:\Program Files\Winamp\winampa.exe
M:\WINDOWS\system32\ctfmon.exe
M:\Program Files\Gadu-Gadu\gg.exe
M:\PROGRA~1\MyPortal\Speed-X\SpeedX.exe
M:\Program Files\NetMeter\NetMeter.exe
M:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
M:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
M:\WINDOWS\system32\nvsvc32.exe
M:\Documents and Settings\Adam\Moje dokumenty\Sharing\sbclv1.0i\SBCL v1.0i.exe
M:\WINDOWS\system32\svchost.exe
M:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
M:\Program Files\Opera\Opera.exe
M:\Program Files\Uniblue\SpyEraser\SpyEraser.exe
M:\Documents and Settings\Adam\Pulpit\ewido_micro.exe
M:\WINDOWS\system32\taskmgr.exe
M:\Documents and Settings\Adam\Pulpit\comboscan.exe
M:\DOCUME~1\Adam\Pulpit\Adam.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.onet.pl
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - M:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: IeCatch5 Class - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - M:\PROGRA~1\FlashGet\jccatch.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - M:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: gFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - M:\PROGRA~1\FlashGet\getflash.dll
O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - M:\PROGRA~1\FlashGet\fgiebar.dll
O4 - HKLM\..\Run: [DU Meter] M:\Program Files\DU Meter\DUMeter.exe
O4 - HKLM\..\Run: [DAEMON Tools] "M:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [SunJavaUpdateSched] "M:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE M:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [WinampAgent] "M:\Program Files\Winamp\winampa.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] M:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Gadu-Gadu] "M:\Program Files\Gadu-Gadu\gg.exe" /tray
O4 - HKCU\..\Run: [SpeedX] M:\PROGRA~1\MyPortal\Speed-X\SpeedX.exe
O4 - HKCU\..\Run: [M:\Program Files\NetMeter\NetMeter.exe] M:\Program Files\NetMeter\NetMeter.exe
O4 - Startup: Skrót do SBCL v1.lnk = M:\Documents and Settings\Adam\Moje dokumenty\Sharing\sbclv1.0i\SBCL v1.0i.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = M:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = M:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://M:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Ściągnij przy pomocy FlashGet'a - M:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: Ściągnij wszystko przy pomocy FlashGet'a - M:\Program Files\FlashGet\jc_all.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - M:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - M:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - M:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - M:\PROGRA~1\FlashGet\flashget.exe
O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - M:\PROGRA~1\FlashGet\flashget.exe
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://kaspersky.pl/resources/virusscanner/kavwebscan_unicode.cab
O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://downloads.ewido.net/ewidoOnlineScan.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - M:\Program Files\Yahoo!\Common\Yinsthelper.dll
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - M:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - M:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: kavsvc - Kaspersky Lab - M:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\kavsvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - M:\WINDOWS\system32\nvsvc32.exe
O23 - Service: ServiceLayer - Nokia. - M:\Program Files\PC Connectivity Solution\ServiceLayer.exe

-- Files created between 2007-03-21 and 2007-04-21 -----------------------------

2007-04-21 16:32:46 0 d-------- M:\!KillBox
2007-04-20 19:00:07 0 d--hs---- M:\WINDOWS\CSC
2007-04-14 21:13:02 0 d-------- M:\WINDOWS\Performance<PERFOR~1>
2007-04-10 18:00:15 0 d-------- M:\Program Files\EDU CD<EDUCD~1>
2007-03-25 19:19:30 0 d-------- M:\Program Files\NetMeter
2007-03-23 00:39:26 0 d-------- M:\Program Files\VideoLAN
2007-03-22 00:26:29 0 d-------- M:\Program Files\English Translator 2<ENGLIS~1>
2007-03-21 23:20:47 0 d-------- M:\Program Files\Corel

-- Find3M Report ---------------------------------------------------------------

2007-04-21 16:38:46 0 d-------- M:\Program Files\Ad-Aware SE Personal<AD-AWA~1>
2007-04-21 16:31:34 0 d-------- M:\Program Files\Mozilla Firefox<MOZILL~1>
2007-04-20 15:13:01 0 d-------- M:\Program Files\Uniblue
2007-04-20 15:10:34 0 d-------- M:\Documents and Settings\Adam\Dane aplikacji\Uniblue
2007-04-20 15:09:58 0 d-------- M:\Program Files\DAEMON Tools<DAEMON~1>
2007-04-20 02:30:26 0 d-------- M:\Program Files\FlashGet
2007-04-20 01:43:49 0 d-------- M:\Program Files\Java
2007-04-20 00:18:30 448004 --a------ M:\WINDOWS\system32\perfh015.dat
2007-04-20 00:18:30 74230 --a------ M:\WINDOWS\system32\perfc015.dat
2007-04-19 23:07:25 0 d-------- M:\Documents and Settings\Adam\Dane aplikacji\dvdcss
2007-04-18 20:03:09 0 d-------- M:\Documents and Settings\Adam\Dane aplikacji\foobar2000<FOOBAR~1>
2007-04-17 12:24:16 0 d-------- M:\Program Files\Opera
2007-04-14 23:19:22 0 d-------- M:\Program Files\Winamp
2007-04-14 21:38:31 0 d---s---- M:\Documents and Settings\Adam\Dane aplikacji\Microsoft<MICROS~1>
2007-04-13 23:35:19 0 d-------- M:\Program Files\AllMyMovies<ALLMYM~1>
2007-04-13 21:15:44 0 d-------- M:\Documents and Settings\Adam\Dane aplikacji\BearShare<BEARSH~1>
2007-03-29 13:58:06 0 d-------- M:\Documents and Settings\Adam\Dane aplikacji\uTorrent
2007-03-23 00:40:10 0 d-------- M:\Documents and Settings\Adam\Dane aplikacji\vlc
2007-03-20 02:23:54 0 d-------- M:\Program Files\SiGSOFT
2007-03-20 01:15:34 0 d-------- M:\Program Files\SpeedFan
2007-03-20 00:47:14 0 d-------- M:\Program Files\Yahoo!
2007-03-19 18:54:09 0 d-------- M:\Program Files\LPS
2007-03-19 16:09:00 0 d-------- M:\Program Files\K-litePro<K-LITE~2>
2007-03-18 15:09:28 0 d-------- M:\Program Files\Microsoft Games<MICROS~3>
2007-03-17 21:33:02 0 d-------- M:\Program Files\WinUHA
2007-03-17 21:01:40 0 d-------- M:\Documents and Settings\Adam\Dane aplikacji\Kingston
2007-03-17 15:45:36 293376 --a------ M:\WINDOWS\system32\winsrv.dll
2007-03-16 14:48:38 0 d-------- M:\Program Files\XMotorRacingDemo<XMOTOR~1>
2007-03-15 23:50:40 0 d-------- M:\Program Files\Peer2Mail<PEER2M~1>
2007-03-15 15:55:58 0 d-------- M:\Documents and Settings\Adam\Dane aplikacji\GRETECH
2007-03-15 15:55:25 0 d-------- M:\Program Files\GRETECH
2007-03-14 20:27:33 0 d-------- M:\Program Files\Nokia
2007-03-12 19:45:43 0 d-------- M:\Program Files\WorldUnlock Codes Calculator<WORLDU~1>
2007-03-09 17:43:33 0 d-------- M:\Program Files\BearShare Acceleration Patch<BEARSH~1>
2007-03-08 17:38:47 579072 --a------ M:\WINDOWS\system32\user32.dll
2007-03-08 17:38:47 40960 --a------ M:\WINDOWS\system32\mf3216.dll
2007-03-08 17:38:47 281600 --a------ M:\WINDOWS\system32\gdi32.dll
2007-03-08 17:37:33 1843840 --a------ M:\WINDOWS\system32\win32k.sys
2007-03-07 23:03:59 0 d-------- M:\Program Files\HDD Regenerator<HDDREG~1>
2007-03-07 01:54:10 0 d-------- M:\Program Files\foobar2000<FOOBAR~1>
2007-03-06 19:22:19 0 d-------- M:\Program Files\Badongo
2007-03-05 15:30:54 0 d--h----- M:\Program Files\InstallShield Installation Information<INSTAL~1>
2007-03-03 16:39:11 0 dr-h----- M:\Documents and Settings\Adam\Dane aplikacji\SecuROM
2007-03-03 16:39:10 108144 --a------ M:\WINDOWS\system32\CmdLineExt.dll<CMDLIN~1.DLL>
2007-03-01 23:00:48 0 d-------- M:\Program Files\Cartall
2007-03-01 20:45:27 0 d-------- M:\Program Files\Windows NT<WINDOW~1>
2007-03-01 14:49:49 0 d-------- M:\Program Files\Lavalys
2007-02-27 15:44:52 0 d-------- M:\Program Files\MyPortal
2007-02-26 22:22:36 0 d-------- M:\Program Files\Shortcut
2007-02-26 02:04:32 0 d-------- M:\Program Files\NAPI-PROJEKT<NAPI-P~1>
2007-02-23 01:46:39 0 d-------- M:\Documents and Settings\Adam\Dane aplikacji\GanymedeNet<GANYME~1>
2007-02-21 01:05:01 0 d-------- M:\Program Files\Ganymede
2007-02-05 22:19:48 185856 --a------ M:\WINDOWS\system32\upnphost.dll
2007-01-29 10:58:06 60416 -----n--- M:\WINDOWS\system32\tzchange.exe
2007-01-26 15:47:44 3614 --a------ M:\WINDOWS\mozver.dat
2007-01-24 21:19:04 5 --ahs---- M:\WINDOWS\system32\aecdfbfcd6_s.dll<AECDFB~1.DLL>

-- Registry Dump ---------------------------------------------------------------

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run]
"CTFMON.EXE"="M:\\WINDOWS\\system32\\ctfmon.exe"
"Gadu-Gadu"=""M:\\Program Files\\Gadu-Gadu\\gg.exe" /tray"
"SpeedX"="M:\\PROGRA~1\\MyPortal\\Speed-X\\SpeedX.exe"
"M:\\Program Files\\NetMeter\\NetMeter.exe"="M:\\Program Files\\NetMeter\\NetMeter.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run]
"DU Meter"="M:\\Program Files\\DU Meter\\DUMeter.exe"
"DAEMON Tools"=""M:\\Program Files\\DAEMON Tools\\daemon.exe" -lang 1033"
"SunJavaUpdateSched"=""M:\\Program Files\\Java\\jre1.6.0_01\\bin\\jusched.exe""
"NvCplDaemon"="RUNDLL32.EXE M:\\WINDOWS\\system32\\NvCpl.dll,NvStartup"
"WinampAgent"=""M:\\Program Files\\Winamp\\winampa.exe""

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\IMAIL]
"Installed"="1"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MAPI]
"Installed"="1"
"NoChange"="1"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MSFS]
"Installed"="1"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{57B86673-276A-48B2-BAE7-C6DBB3020EB8}"="AVG Anti-Spyware 7.5"

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"CTFMON.EXE"="M:\\WINDOWS\\system32\\CTFMON.EXE"

[HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\run]
"CTFMON.EXE"="M:\\WINDOWS\\system32\\CTFMON.EXE"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"DisableRegistryTools"=dword:00000000

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoLowDiskSpaceChecks"=dword:00000000

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\DisAllowRun]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\Run]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll"

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Svchost]
HTTPFilter REG_MULTI_SZ HTTPFilter\0\0
LocalService REG_MULTI_SZ Alerter\0WebClient\0LmHosts\0RemoteRegistry\0upnphost\0SSDPSRV\0\0
NetworkService REG_MULTI_SZ DnsCache\0\0
DcomLaunch REG_MULTI_SZ DcomLaunch\0TermService\0\0
rpcss REG_MULTI_SZ RpcSs\0\0
imgsvc REG_MULTI_SZ StiSvc\0\0
termsvcs REG_MULTI_SZ TermService\0\0

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\F]
Shell\AutoRun\command F:\Autorun.exe

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\G]
Shell\AutoRun\command G:\start.exe

-- End of ComboScan: finished at 2007-04-21 at 17:23:37 ------------------------

**Posty:** 18165 · przez **wojtas** 21 Kwi 2007, 17:55

lance87 napisał(a):jest sposób by się tego raz na zawsze pozbyć?

to sa ciasteczka od przegladarki raczej nie da sie ich calkowicie usunac

M:\!KillBox

ten folder na kasacje i bedzie OK

**Posty:** 4043 · przez **prog** 21 Kwi 2007, 17:57

Możesz spróbować jakimś EasyCleaner może, nie wiem czy coś da

BTW, winda na M :papryczka:

**Posty:** 2547 · przez **lance87** 21 Kwi 2007, 18:52

wojtas19162 napisał(a):to sa ciasteczka od przegladarki raczej nie da sie ich calkowicie usunac

Wiem, tylko dziwne, że wykrywa w nich tak często jakieś spyware u mnie...

wojtas19162 napisał(a):
M:\!KillBox

ten folder na kasacje i bedzie OK

(już jest) OK :banan:

choć było

prog napisał(a):Możesz spróbować jakimś EasyCleaner może, nie wiem czy coś da

Raczej nie, co jakiś czas nim czyszczę, ale to nie jest uciążliwe, więc dam sobie z tym spokój

prog napisał(a):BTW, winda na M

Wiem

Miałem podpięty inny dysk z 4 partycjami i z nim robiłem partycje na obecnym sciana

Teraz tego nie zmienię, bo wszystkie programy i gry odwołujące się do M: jak zmienię na C: raczej odmówią posłuszeństwa. Przy formacie jak kiedyś już będę mocno zmuszony to naprawię :papryczka:

z netem / programami => log

z netem / programami => log

Kto jest na forum