aplikacje nie działają

**Posty:** 1239 · przez **mati43** 23 Kwi 2008, 08:14

Nie włączają sie takie aplikacje jak nero,regcleaner, tibia (żal.pl),Wow,GG, itp
Coś blokuje dostęp tylko nie wiem co ;]

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 08:09:29, on 2008-04-23 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\RTHDCPL.EXE C:\WINDOWS\system32\ctfmon.exe C:\PROGRA~1\DAEMON~1\daemon.exe C:\WINDOWS\system32\RUNDLL32.EXE C:\PROGRA~1\Java\JRE16~1.0_0\bin\jusched.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\HPZipm12.exe C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\wscntfy.exe C:\PROGRA~1\MOZILL~1\FIREFOX.EXE C:\Documents and Settings\Administrator\Pulpit\hijackthis.com R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.daemon-search.com/startpage R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza R3 - URLSearchHook: Winamp Search Class - {57BCA5FA-5DBB-45a2-B558-1755C3F6253B} - C:\Program Files\Winamp Toolbar\winamptb.dll O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: Winamp Toolbar Loader - {25CEE8EC-5730-41bc-8B58-22DDC8AB8C20} - C:\Program Files\Winamp Toolbar\winamptb.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O3 - Toolbar: Winamp Toolbar - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - C:\Program Files\Winamp Toolbar\winamptb.dll O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe" O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\PROGRA~1\DAEMON~1\daemon.exe" -autorun O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O8 - Extra context menu item: &Winamp Search - C:\Documents and Settings\All Users\Dane aplikacji\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {68282C51-9459-467B-95BF-3C0E89627E55} (MksSkanerOnline Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe -- End of file - 4089 bytes

Combo

Kod: Zaznacz wszystko: ComboFix 08-04-22.1 - Administrator 2008-04-23 8:11:49.1 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.654 [GMT 2:00] Running from: C:\DOCUME~1\ADMINI~1\Pulpit\ComboFix.exe * Created a new restore point [color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color] . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\WINDOWS\svchost.com . ((((((((((((((((((((((((( Files Created from 2008-03-23 to 2008-04-23 ))))))))))))))))))))))))))))))) . 2008-04-22 20:59 . 2008-04-22 21:16 <DIR> d-------- C:\Program Files\SkanerOnline 2008-04-22 20:38 . 2008-04-22 20:38 <DIR> d-------- C:\Program Files\Asprate 2008-04-22 20:10 . 2008-04-22 20:11 <DIR> d-------- C:\Program Files\Tibia 2008-04-21 16:23 . 2008-04-21 16:23 <DIR> d-------- C:\Logs 2008-04-21 15:52 . 2008-04-21 15:52 <DIR> d-------- C:\Program Files\Common Files\Blizzard Entertainment 2008-04-20 15:09 . 2008-04-20 15:09 <DIR> d-------- C:\Program Files\Ashampoo 2008-04-20 15:09 . 2008-04-20 15:09 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\ashampoo 2008-04-20 15:09 . 2008-04-20 15:09 <DIR> d-------- C:\Documents and Settings\Administrator\Dane aplikacji\Ashampoo 2008-04-20 13:33 . 2008-04-20 13:33 <DIR> d-------- C:\Program Files\RegCleaner 2008-04-20 13:27 . 2008-04-20 13:27 <DIR> d-------- C:\Program Files\Alcohol Soft 2008-04-20 13:21 . 2008-04-20 13:21 <DIR> d-------- C:\Program Files\MSXML 4.0 2008-04-19 18:51 . 2008-04-19 18:51 86 --a------ C:\WINDOWS\musicmaker.INI 2008-04-19 18:42 . 2008-04-19 18:42 <DIR> d-------- C:\Program Files\Common Files\MAGIX Shared 2008-04-19 18:29 . 2005-11-30 21:20 2,314,332 --a------ C:\WINDOWS\system32\LIBMMD.DLL 2008-04-19 18:29 . 2000-05-21 22:00 1,066,176 --a------ C:\WINDOWS\system32\mscomctl.ocx 2008-04-19 18:29 . 2000-05-21 22:00 647,872 --a------ C:\WINDOWS\system32\mscomct2.ocx 2008-04-19 18:29 . 1998-06-23 22:00 609,584 --a------ C:\WINDOWS\system32\comctl32.ocx 2008-04-19 18:29 . 2000-05-22 15:58 115,920 --a------ C:\WINDOWS\system32\msinet.ocx 2008-04-17 16:06 . 2008-04-17 16:06 <DIR> d-------- C:\VideoOutput 2008-04-16 20:53 . 2008-02-22 02:33 69,632 --a------ C:\WINDOWS\system32\javacpl.cpl 2008-04-16 20:52 . 2008-04-16 20:53 <DIR> d-------- C:\Program Files\Java 2008-04-16 20:51 . 2008-04-16 20:51 <DIR> d-------- C:\Program Files\Common Files\Java 2008-04-15 20:41 . 2008-04-15 20:41 <DIR> d-------- C:\Program Files\DivX 2008-04-14 20:16 . 2008-04-14 20:16 <DIR> d-------- C:\Program Files\DAEMON Tools Lite 2008-04-14 20:13 . 2008-04-14 20:13 <DIR> d-------- C:\Documents and Settings\Administrator\Dane aplikacji\DAEMON Tools 2008-04-14 20:13 . 2008-04-14 20:13 716,272 --a------ C:\WINDOWS\system32\drivers\sptd.sys 2008-04-13 10:00 . 2008-04-13 10:00 <DIR> d-------- C:\Program Files\Common Files\Adobe 2008-04-11 21:24 . 2008-04-19 18:53 <DIR> d-------- C:\Program Files\MP3Producer 2008-04-11 21:24 . 2008-04-11 21:24 8 --a------ C:\WINDOWS\system32\ntP2.trk 2008-04-11 21:01 . 2008-04-11 21:01 <DIR> d-------- C:\Documents and Settings\Administrator\Dane aplikacji\COWON 2008-04-11 21:00 . 2008-04-11 21:12 <DIR> d-------- C:\Program Files\JetAudio 2008-04-11 21:00 . 2008-04-11 21:00 <DIR> d-------- C:\Program Files\Common Files\COWON 2008-04-10 21:22 . 2008-04-10 21:22 <DIR> d-------- C:\spoolerlogs 2008-04-10 08:09 . 2008-04-10 08:09 <DIR> d-------- C:\Program Files\Hewlett-Packard 2008-04-10 08:09 . 2008-04-10 08:09 <DIR> d-------- C:\Program Files\Common Files\Hewlett-Packard 2008-04-10 08:09 . 2006-04-10 14:03 38,400 --a------ C:\WINDOWS\system32\hpz3l054.dll 2008-04-10 08:08 . 2008-04-10 08:08 <DIR> d-------- C:\Program Files\HP 2008-04-10 08:08 . 2006-03-03 21:03 282,680 --a------ C:\WINDOWS\system32\HPZidr12.dll 2008-04-10 08:08 . 2006-03-03 21:02 204,800 --a------ C:\WINDOWS\system32\HPZipr12.dll 2008-04-10 08:08 . 2006-03-03 21:02 94,208 --a------ C:\WINDOWS\system32\HPZipt12.dll 2008-04-10 08:08 . 2006-03-03 21:03 69,632 --a------ C:\WINDOWS\system32\HPZipm12.exe 2008-04-10 08:08 . 2006-03-03 21:03 65,536 --a------ C:\WINDOWS\system32\HPZinw12.exe 2008-04-10 08:08 . 2006-03-03 21:02 57,344 --a------ C:\WINDOWS\system32\HPZisn12.dll 2008-04-10 08:08 . 2004-08-03 22:58 15,104 --a------ C:\WINDOWS\system32\drivers\usbscan.sys 2008-04-10 08:08 . 2004-08-03 22:58 15,104 --a--c--- C:\WINDOWS\system32\dllcache\usbscan.sys 2008-04-10 07:58 . 2004-08-03 23:01 25,856 --a------ C:\WINDOWS\system32\drivers\usbprint.sys 2008-04-10 07:58 . 2004-08-03 23:01 25,856 --a--c--- C:\WINDOWS\system32\dllcache\usbprint.sys 2008-04-09 19:18 . 2008-04-09 19:18 <DIR> d-------- C:\Documents and Settings\Administrator\Dane aplikacji\Media Player Classic 2008-04-09 19:17 . 2008-04-09 19:17 <DIR> d-------- C:\Program Files\Real Alternative 2008-04-07 17:03 . 2008-04-07 17:03 <DIR> d-------- C:\Program Files\Winamp Toolbar 2008-04-07 17:03 . 2008-04-07 17:03 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Winamp Toolbar 2008-04-07 17:03 . 2008-04-07 17:05 <DIR> d-------- C:\Documents and Settings\Administrator\Dane aplikacji\Winamp 2008-04-06 20:19 . 2004-08-03 23:08 26,496 --a--c--- C:\WINDOWS\system32\dllcache\usbstor.sys 2008-04-06 14:40 . 2008-04-18 20:13 69 --a------ C:\WINDOWS\NeroDigital.ini 2008-04-06 14:05 . 2008-04-06 14:05 <DIR> d-------- C:\Documents and Settings\Administrator\Dane aplikacji\Nero 2008-04-06 14:04 . 2008-04-20 13:33 <DIR> d-------- C:\Program Files\Nero 2008-04-06 14:04 . 2008-04-06 14:04 <DIR> d-------- C:\Program Files\Common Files\Nero 2008-04-06 14:04 . 2008-04-06 14:04 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Nero 2008-04-06 14:04 . 2006-03-17 11:45 1,757,184 --a------ C:\WINDOWS\system32\imagX7.dll 2008-04-06 14:04 . 2006-03-17 11:45 802,816 --a------ C:\WINDOWS\system32\imagXRA7.dll 2008-04-06 14:04 . 2006-03-17 11:45 497,296 --a------ C:\WINDOWS\system32\imagXpr7.dll 2008-04-06 14:04 . 2006-03-17 14:49 368,640 --a------ C:\WINDOWS\system32\TwnLib4.dll 2008-04-06 14:04 . 2006-03-17 11:45 258,048 --a------ C:\WINDOWS\system32\imagXR7.dll 2008-04-04 23:00 . 2008-04-09 20:23 <DIR> d--h----- C:\WINDOWS\$hf_mig$ 2008-04-04 09:58 . 2008-04-07 17:04 <DIR> d-------- C:\Program Files\Winamp 2008-04-04 09:56 . 2006-06-01 20:49 163,840 -----c--- C:\WINDOWS\system32\dllcache\jgdw400.dll 2008-04-04 09:56 . 2006-06-01 20:49 27,648 -----c--- C:\WINDOWS\system32\dllcache\jgpl400.dll 2008-04-03 20:08 . 2008-04-03 20:08 <DIR> d-------- C:\Program Files\ffdshow 2008-04-03 20:08 . 2006-12-10 22:32 499,712 --a------ C:\WINDOWS\system32\msvcp71.dll 2008-04-03 20:08 . 2006-12-10 22:32 348,160 --a------ C:\WINDOWS\system32\msvcr71.dll 2008-04-03 20:08 . 2007-04-24 16:30 60,273 --a------ C:\WINDOWS\system32\pthreadGC2.dll 2008-04-03 20:08 . 2008-03-04 12:33 7,680 --a------ C:\WINDOWS\system32\ff_vfw.dll 2008-04-03 20:08 . 2007-07-10 17:10 547 --a------ C:\WINDOWS\system32\ff_vfw.dll.manifest 2008-04-03 19:58 . 2008-04-03 20:09 <DIR> d-------- C:\Documents and Settings\Administrator\Dane aplikacji\BESTplayer 2008-03-31 20:58 . 2008-04-19 09:48 <DIR> d-------- C:\MU 2008-03-31 20:56 . 2008-04-05 21:07 2,611 --a------ C:\WINDOWS\sql.MIF 2008-03-31 20:55 . 2008-03-31 20:55 <DIR> d-------- C:\Program Files\Microsoft SQL Server 2008-03-31 20:55 . 1997-07-19 17:01 376,592 --a------ C:\WINDOWS\system32\msrdo20.dll 2008-03-31 20:55 . 2000-08-06 01:51 274,489 --a------ C:\WINDOWS\system32\ntwdblib.dll 2008-03-31 20:55 . 2000-08-06 01:51 192,569 --a------ C:\WINDOWS\system32\msrpjt40.dll 2008-03-31 20:55 . 2001-03-13 11:49 120,320 --a------ C:\WINDOWS\system32\comdlg32.ocx 2008-03-31 20:55 . 1997-01-13 10:49 97,552 --a------ C:\WINDOWS\system32\rdocurs.dll 2008-03-31 20:55 . 2000-08-06 01:51 32,830 --a------ C:\WINDOWS\system32\dbmsshrn.dll 2008-03-31 20:53 . 2008-04-23 07:22 <DIR> d-------- C:\WINDOWS\system32\Lang 2008-03-31 20:53 . 2008-03-31 20:53 940,794 --a------ C:\WINDOWS\system32\LoopyMusic.wav 2008-03-31 20:53 . 2008-03-31 20:53 146,650 --a------ C:\WINDOWS\system32\BuzzingBee.wav 2008-03-31 20:50 . 2008-03-31 20:50 <DIR> d-------- C:\Program Files\GIGABYTE 2008-03-31 20:50 . 2008-03-31 20:50 <DIR> d-------- C:\Program Files\BroadCom GB LAN 2008-03-31 20:49 . 2008-03-31 20:50 <DIR> d-------- C:\WINDOWS\system32\RTCOM 2008-03-31 20:49 . 2008-03-31 20:49 <DIR> d-------- C:\Program Files\Realtek 2008-03-31 20:46 . 2008-03-31 20:46 169 --a------ C:\WINDOWS\RtlRack.ini 2008-03-31 20:44 . 2005-06-28 10:21 22,752 --a------ C:\WINDOWS\system32\spupdsvc.exe 2008-03-31 20:42 . 2008-03-31 20:42 <DIR> d-------- C:\Program Files\Realtek Sound Manager 2008-03-31 20:42 . 2008-03-31 20:42 <DIR> d-------- C:\Program Files\AvRack 2008-03-31 20:42 . 2005-05-18 09:15 9,389,568 -r------- C:\WINDOWS\system32\RTLCPL.exe 2008-03-31 20:42 . 2005-05-18 11:50 2,319,680 -r------- C:\WINDOWS\system32\drivers\alcxwdm.sys 2008-03-31 20:42 . 2002-02-05 07:54 141,016 -r------- C:\WINDOWS\system32\alsndmgr.wav 2008-03-31 20:42 . 2005-09-21 04:24 86,016 -r------- C:\WINDOWS\SoundMan.exe 2008-03-31 20:42 . 2005-07-15 10:48 40,960 -r------- C:\WINDOWS\system32\ChCfg.exe 2008-03-31 20:42 . 2001-07-05 18:19 164 -r------- C:\WINDOWS\avrack.ini 2008-03-31 20:41 . 2008-04-14 22:01 <DIR> d--h----- C:\Program Files\InstallShield Installation Information 2008-03-31 20:41 . 2005-09-21 04:25 299,008 -r------- C:\WINDOWS\system32\ALSndMgr.Cpl 2008-03-31 20:41 . 2005-02-03 09:13 294,912 -r------- C:\WINDOWS\alcupd.exe 2008-03-31 20:41 . 2005-03-02 14:21 200,704 -r------- C:\WINDOWS\alcrmv.exe 2008-03-31 20:36 . 2008-03-31 20:36 <DIR> d-------- C:\Documents and Settings\Administrator\Dane aplikacji\Gadu-Gadu 2008-03-31 20:29 . 1998-10-29 16:45 306,688 --a------ C:\WINDOWS\IsUninst.exe 2008-03-31 20:29 . 2008-03-31 20:56 1,240 --a------ C:\WINDOWS\setup.iss 2008-03-31 20:23 . 2008-03-31 20:23 <DIR> d-------- C:\Program Files\Gadu-Gadu 2008-03-31 20:23 . 2008-03-31 20:26 <DIR> d-------- C:\Documents and Settings\Administrator\Gadu-Gadu 2008-03-31 20:12 . 2008-03-31 20:12 <DIR> d-------- C:\Program Files\uTorrent 2008-03-31 20:12 . 2008-04-21 20:12 <DIR> d-------- C:\Documents and Settings\Administrator\Dane aplikacji\uTorrent 2008-03-31 20:10 . 2008-03-31 20:10 <DIR> d-------- C:\WINDOWS\nview 2008-03-31 20:10 . 2008-03-31 20:10 <DIR> d-------- C:\Program Files\Common Files\InstallShield 2008-03-31 20:10 . 2008-03-31 20:10 <DIR> d-------- C:\NVIDIA 2008-03-31 20:10 . 2007-12-05 02:53 356,352 --a------ C:\WINDOWS\system32\NVUNINST.EXE 2008-03-31 20:10 . 2007-12-05 01:41 356,352 --a------ C:\WINDOWS\system32\nvudisp.exe 2008-03-31 20:10 . 2008-03-31 20:11 163,353 --a------ C:\WINDOWS\system32\nvapps.xml 2008-03-31 20:10 . 2007-12-05 01:41 17,737 --a------ C:\WINDOWS\system32\nvdisp.nvu 2008-03-31 20:07 . 2008-04-15 20:41 1,410 --a------ C:\WINDOWS\mozver.dat 2008-03-31 20:06 . 2008-03-31 20:06 <DIR> d-------- C:\Documents and Settings\Administrator\Dane aplikacji\Talkback 2008-03-31 20:05 . 2008-03-31 20:05 0 --a------ C:\WINDOWS\nsreg.dat . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-03-31 17:33 --------- d-----w C:\Program Files\microsoft frontpage 2008-03-31 17:32 --------- d-----w C:\Program Files\Usługi online 2008-03-21 20:30 200,704 ----a-w C:\WINDOWS\system32\ssldivx.dll 2008-03-21 20:30 1,044,480 ----a-w C:\WINDOWS\system32\libdivx.dll 2008-03-20 08:09 1,845,504 ----a-w C:\WINDOWS\system32\win32k.sys 2008-02-20 06:51 282,624 ----a-w C:\WINDOWS\system32\gdi32.dll 2008-02-20 05:38 45,568 ----a-w C:\WINDOWS\system32\dnsrslvr.dll 2008-02-16 09:05 662,016 ----a-w C:\WINDOWS\system32\wininet.dll . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{25CEE8EC-5730-41bc-8B58-22DDC8AB8C20}] 2008-03-20 00:36 1267040 --a------ C:\Program Files\Winamp Toolbar\winamptb.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar] "{EBF2BA02-9094-4C5A-858B-BB198F3D8DE2}"= "C:\Program Files\Winamp Toolbar\winamptb.dll" [2008-03-20 00:36 1267040] [HKEY_CLASSES_ROOT\clsid\{ebf2ba02-9094-4c5a-858b-bb198f3d8de2}] [HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand.1] [HKEY_CLASSES_ROOT\TypeLib\{538CD77C-BFDD-49b0-9562-77419CAB89D1}] [HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand] [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser] "{EBF2BA02-9094-4C5A-858B-BB198F3D8DE2}"= C:\Program Files\Winamp Toolbar\winamptb.dll [2008-03-20 00:36 1267040] [HKEY_CLASSES_ROOT\clsid\{ebf2ba02-9094-4c5a-858b-bb198f3d8de2}] [HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand.1] [HKEY_CLASSES_ROOT\TypeLib\{538CD77C-BFDD-49b0-9562-77419CAB89D1}] [HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:44 15360] "DAEMON Tools Lite"="C:\PROGRA~1\DAEMON~1\daemon.exe" [2008-02-14 01:09 486856] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-12-05 01:41 8523776] "nwiz"="nwiz.exe" [2007-12-05 01:41 1626112 C:\WINDOWS\system32\nwiz.exe] "NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-12-05 01:41 81920] "RTHDCPL"="RTHDCPL.EXE" [2005-09-22 07:36 14854144 C:\WINDOWS\RTHDCPL.exe] "WinampAgent"="C:\Program Files\Winamp\winampa.exe" [ ] "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 22:16 39792] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 04:25 144784] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 00:44 15360] [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "C:\\Program Files\\uTorrent\\uTorrent.exe"= "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"= "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"= "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"= R0 iteraid;ITERAID_Service_Install;C:\WINDOWS\system32\DRIVERS\iteraid.sys [2004-10-29 11:21] *Newly Created Service* - CATCHME . ************************************************************************** catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-04-23 08:12:37 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2008-04-23 8:12:58 ComboFix-quarantined-files.txt 2008-04-23 06:12:56 Pre-Run: 10,562,424,832 bajtów wolnych Post-Run: 10,934,906,880 bajtów wolnych 201 --- E O F --- 2008-04-20 11:21:11

**Posty:** 18165 · przez **wojtas** 23 Kwi 2008, 15:42

Wykonaj to co jest podane w tym temacie

Zastosuj SDFix . Po pobraniu uruchom go a rozpakuje się do C:\SDFix. Uruchom komputer w trybie awaryjnym (F8 przy stracie systemu). Będąc w awaryjnym uruchom plik RunThis.bat z folderu SDFixa. Zatwierdź czyszczenie przez Y. Poczekaj aż ukończy i komputer zresetuje

Potem wejdz do folderu C:\SDFix wrzuc zawartość pliku Report.txt + log z combofixa oraz daj loga z hijacka

**Posty:** 1239 · przez **mati43** 23 Kwi 2008, 22:04

zrobione, ale w trybie normalnym ponieważ w awaryjnym wyskakuje mi że cmd.exe jest uszkodzony.

Kod: Zaznacz wszystko: [b]SDFix: Version 1.173 [/b] Run by Administrator on 2008-04-23 at 21:45 Microsoft Windows XP [Wersja 5.1.2600] Running From: C:\SDFix [b]Checking Services [/b]: Restoring Windows Registry Values Restoring Windows Default Hosts File Rebooting [b]Checking Files [/b]: Trojan Files Found: C:\WINDOWS\directx.sys - Deleted C:\WINDOWS\svchost.com - Deleted C:\WINDOWS\system32\firefox.exe - Deleted Removing Temp Files [b]ADS Check [/b]: [b]Final Check [/b]: catchme 0.3.1353.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-04-23 21:58:23 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... scanning hidden services & system hive ... [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg] "s1"=dword:2df9c43f "s2"=dword:110480d0 "h0"=dword:00000002 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04] "p0"="C:\Program Files\Alcohol Soft\Alcohol 120\" "h0"=dword:00000001 "ujdew"=hex:86,5c,8d,c2,c0,f0,ca,25,6e,f9,a9,95,b1,8a,ed,4d,9d,7d,45,ab,1d,.. [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4] "p0"="C:\Program Files\DAEMON Tools Lite\" "h0"=dword:00000000 "khjeh"=hex:bf,88,2a,40,91,ef,a4,08,70,c9,fb,f9,df,74,20,d7,58,83,ce,03,2e,.. [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001] "a0"=hex:20,01,00,00,22,f4,27,39,db,8c,1f,58,36,71,b9,d1,82,83,40,19,94,.. "khjeh"=hex:20,4e,02,19,af,28,b7,2a,47,bf,5d,73,38,fe,4c,ce,28,14,ab,65,e3,.. [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40] "khjeh"=hex:b6,27,03,09,de,af,d7,09,f0,e5,a3,73,69,53,71,e5,65,20,ee,d7,9f,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04] "p0"="C:\Program Files\Alcohol Soft\Alcohol 120\" "h0"=dword:00000001 "ujdew"=hex:86,5c,8d,c2,c0,f0,ca,25,6e,f9,a9,95,b1,8a,ed,4d,9d,7d,45,ab,1d,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4] "p0"="C:\Program Files\DAEMON Tools Lite\" "h0"=dword:00000000 "khjeh"=hex:bf,88,2a,40,91,ef,a4,08,70,c9,fb,f9,df,74,20,d7,58,83,ce,03,2e,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001] "a0"=hex:20,01,00,00,22,f4,27,39,db,8c,1f,58,36,71,b9,d1,82,83,40,19,94,.. "khjeh"=hex:20,4e,02,19,af,28,b7,2a,47,bf,5d,73,38,fe,4c,ce,28,14,ab,65,e3,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40] "khjeh"=hex:b6,27,03,09,de,af,d7,09,f0,e5,a3,73,69,53,71,e5,65,20,ee,d7,9f,.. scanning hidden registry entries ... scanning hidden files ... scan completed successfully hidden processes: 0 hidden services: 0 hidden files: 0 [b]Remaining Services [/b]: Authorized Application Key Export: [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "C:\\Program Files\\uTorrent\\uTorrent.exe"="C:\\Program Files\\uTorrent\\uTorrent.exe:*:Enabled:uTorrent" "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe:*:Enabled:hpqscnvw.exe" "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe:*:Enabled:hpqkygrp.exe" "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe:*:Enabled:hpqnrs08.exe" [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list] "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" [b]Remaining Files [/b]: File Backups: - C:\SDFix\backups\backups.zip [b]Files with Hidden Attributes [/b]: Wed 16 Apr 2008 4,348 ..SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak" Wed 23 Apr 2008 561,244 A.SH. --- "C:\Documents and Settings\Administrator\Ustawienia lokalne\Dane aplikacji\firefox.exe" Wed 23 Apr 2008 2,315,776 A.SH. --- "C:\Documents and Settings\Administrator\Ustawienia lokalne\Dane aplikacji\MM-Project Evolutions-XML.exe" Wed 16 Apr 2008 4,348 ...H. --- "C:\Documents and Settings\Administrator\Moje dokumenty\Moja muzyka\Kopia zapasowa licencji\drmv1key.bak" Wed 23 Apr 2008 20 A..H. --- "C:\Documents and Settings\Administrator\Moje dokumenty\Moja muzyka\Kopia zapasowa licencji\drmv1lic.bak" Wed 16 Apr 2008 9,656 A.SH. --- "C:\Documents and Settings\Administrator\Moje dokumenty\Moja muzyka\Kopia zapasowa licencji\drmv2key.bak" Sat 23 Sep 2006 279,535 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\22d177b61fde58f114e05dfd9b70c96d\download\BIT96.tmp" Sat 5 Apr 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\2c7c094c07d8ab1c6d2c7df6e96d2df0\download\BITA9.tmp" [b]Finished![/b]

Kod: Zaznacz wszystko: ComboFix 08-04-22.5 - Administrator 2008-04-23 22:01:18.2 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.693 [GMT 2:00] Running from: C:\Documents and Settings\Administrator\Pulpit\ComboFix.exe * Created a new restore point [color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color] . ((((((((((((((((((((((((( Files Created from 2008-03-23 to 2008-04-23 ))))))))))))))))))))))))))))))) . 2008-04-23 21:44 . 2008-04-23 21:44 <DIR> d-------- C:\WINDOWS\ERUNT 2008-04-23 21:40 . 2008-04-23 21:59 <DIR> d-------- C:\SDFix 2008-04-23 21:33 . 2008-04-23 21:37 <DIR> d-------- C:\Program Files\ChomikBox 2008-04-23 16:30 . 2008-04-23 16:35 <DIR> d-------- C:\Program Files\tibia_ots24 2008-04-23 10:30 . 2008-04-23 10:30 <DIR> d-------- C:\Program Files\Tibia 2008-04-23 10:30 . 2008-04-23 10:32 <DIR> d-------- C:\Documents and Settings\Administrator\Dane aplikacji\Tibia 2008-04-23 09:45 . 2008-04-23 09:45 <DIR> d-------- C:\Program Files\WypasOTS Client 2008-04-23 09:45 . 2008-04-23 09:45 451,072 --a------ C:\WINDOWS\WypasOTS Client uninstall.exe 2008-04-22 20:59 . 2008-04-22 21:16 <DIR> d-------- C:\Program Files\SkanerOnline 2008-04-22 20:38 . 2008-04-22 20:38 <DIR> d-------- C:\Program Files\Asprate 2008-04-21 16:23 . 2008-04-21 16:23 <DIR> d-------- C:\Logs 2008-04-21 15:52 . 2008-04-21 15:52 <DIR> d-------- C:\Program Files\Common Files\Blizzard Entertainment 2008-04-20 15:09 . 2008-04-20 15:09 <DIR> d-------- C:\Program Files\Ashampoo 2008-04-20 15:09 . 2008-04-20 15:09 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\ashampoo 2008-04-20 15:09 . 2008-04-20 15:09 <DIR> d-------- C:\Documents and Settings\Administrator\Dane aplikacji\Ashampoo 2008-04-20 13:33 . 2008-04-20 13:33 <DIR> d-------- C:\Program Files\RegCleaner 2008-04-20 13:27 . 2008-04-20 13:27 <DIR> d-------- C:\Program Files\Alcohol Soft 2008-04-20 13:21 . 2008-04-20 13:21 <DIR> d-------- C:\Program Files\MSXML 4.0 2008-04-19 18:51 . 2008-04-19 18:51 86 --a------ C:\WINDOWS\musicmaker.INI 2008-04-19 18:42 . 2008-04-19 18:42 <DIR> d-------- C:\Program Files\Common Files\MAGIX Shared 2008-04-19 18:29 . 2005-11-30 21:20 2,314,332 --a------ C:\WINDOWS\system32\LIBMMD.DLL 2008-04-19 18:29 . 2000-05-21 22:00 1,066,176 --a------ C:\WINDOWS\system32\mscomctl.ocx 2008-04-19 18:29 . 2000-05-21 22:00 647,872 --a------ C:\WINDOWS\system32\mscomct2.ocx 2008-04-19 18:29 . 1998-06-23 22:00 609,584 --a------ C:\WINDOWS\system32\comctl32.ocx 2008-04-19 18:29 . 2000-05-22 15:58 115,920 --a------ C:\WINDOWS\system32\msinet.ocx 2008-04-17 16:06 . 2008-04-17 16:06 <DIR> d-------- C:\VideoOutput 2008-04-16 20:53 . 2008-02-22 02:33 69,632 --a------ C:\WINDOWS\system32\javacpl.cpl 2008-04-16 20:52 . 2008-04-16 20:53 <DIR> d-------- C:\Program Files\Java 2008-04-16 20:51 . 2008-04-16 20:51 <DIR> d-------- C:\Program Files\Common Files\Java 2008-04-15 20:41 . 2008-04-15 20:41 <DIR> d-------- C:\Program Files\DivX 2008-04-14 20:16 . 2008-04-14 20:16 <DIR> d-------- C:\Program Files\DAEMON Tools Lite 2008-04-14 20:13 . 2008-04-14 20:13 <DIR> d-------- C:\Documents and Settings\Administrator\Dane aplikacji\DAEMON Tools 2008-04-14 20:13 . 2008-04-14 20:13 716,272 --a------ C:\WINDOWS\system32\drivers\sptd.sys 2008-04-13 10:00 . 2008-04-13 10:00 <DIR> d-------- C:\Program Files\Common Files\Adobe 2008-04-11 21:24 . 2008-04-19 18:53 <DIR> d-------- C:\Program Files\MP3Producer 2008-04-11 21:24 . 2008-04-11 21:24 8 --a------ C:\WINDOWS\system32\ntP2.trk 2008-04-11 21:01 . 2008-04-11 21:01 <DIR> d-------- C:\Documents and Settings\Administrator\Dane aplikacji\COWON 2008-04-11 21:00 . 2008-04-11 21:12 <DIR> d-------- C:\Program Files\JetAudio 2008-04-11 21:00 . 2008-04-11 21:00 <DIR> d-------- C:\Program Files\Common Files\COWON 2008-04-10 21:22 . 2008-04-10 21:22 <DIR> d-------- C:\spoolerlogs 2008-04-10 08:09 . 2008-04-10 08:09 <DIR> d-------- C:\Program Files\Hewlett-Packard 2008-04-10 08:09 . 2008-04-10 08:09 <DIR> d-------- C:\Program Files\Common Files\Hewlett-Packard 2008-04-10 08:09 . 2006-04-10 14:03 38,400 --a------ C:\WINDOWS\system32\hpz3l054.dll 2008-04-10 08:08 . 2008-04-10 08:08 <DIR> d-------- C:\Program Files\HP 2008-04-10 08:08 . 2006-03-03 21:03 282,680 --a------ C:\WINDOWS\system32\HPZidr12.dll 2008-04-10 08:08 . 2006-03-03 21:02 204,800 --a------ C:\WINDOWS\system32\HPZipr12.dll 2008-04-10 08:08 . 2006-03-03 21:02 94,208 --a------ C:\WINDOWS\system32\HPZipt12.dll 2008-04-10 08:08 . 2006-03-03 21:03 69,632 --a------ C:\WINDOWS\system32\HPZipm12.exe 2008-04-10 08:08 . 2006-03-03 21:03 65,536 --a------ C:\WINDOWS\system32\HPZinw12.exe 2008-04-10 08:08 . 2006-03-03 21:02 57,344 --a------ C:\WINDOWS\system32\HPZisn12.dll 2008-04-10 08:08 . 2004-08-03 22:58 15,104 --a------ C:\WINDOWS\system32\drivers\usbscan.sys 2008-04-10 08:08 . 2004-08-03 22:58 15,104 --a--c--- C:\WINDOWS\system32\dllcache\usbscan.sys 2008-04-10 07:58 . 2004-08-03 23:01 25,856 --a------ C:\WINDOWS\system32\drivers\usbprint.sys 2008-04-10 07:58 . 2004-08-03 23:01 25,856 --a--c--- C:\WINDOWS\system32\dllcache\usbprint.sys 2008-04-09 19:18 . 2008-04-09 19:18 <DIR> d-------- C:\Documents and Settings\Administrator\Dane aplikacji\Media Player Classic 2008-04-09 19:17 . 2008-04-09 19:17 <DIR> d-------- C:\Program Files\Real Alternative 2008-04-07 17:03 . 2008-04-07 17:03 <DIR> d-------- C:\Program Files\Winamp Toolbar 2008-04-07 17:03 . 2008-04-07 17:03 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Winamp Toolbar 2008-04-07 17:03 . 2008-04-07 17:05 <DIR> d-------- C:\Documents and Settings\Administrator\Dane aplikacji\Winamp 2008-04-06 20:19 . 2004-08-03 23:08 26,496 --a--c--- C:\WINDOWS\system32\dllcache\usbstor.sys 2008-04-06 14:40 . 2008-04-18 20:13 69 --a------ C:\WINDOWS\NeroDigital.ini 2008-04-06 14:05 . 2008-04-06 14:05 <DIR> d-------- C:\Documents and Settings\Administrator\Dane aplikacji\Nero 2008-04-06 14:04 . 2008-04-20 13:33 <DIR> d-------- C:\Program Files\Nero 2008-04-06 14:04 . 2008-04-06 14:04 <DIR> d-------- C:\Program Files\Common Files\Nero 2008-04-06 14:04 . 2008-04-06 14:04 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Nero 2008-04-06 14:04 . 2006-03-17 11:45 1,757,184 --a------ C:\WINDOWS\system32\imagX7.dll 2008-04-06 14:04 . 2006-03-17 11:45 802,816 --a------ C:\WINDOWS\system32\imagXRA7.dll 2008-04-06 14:04 . 2006-03-17 11:45 497,296 --a------ C:\WINDOWS\system32\imagXpr7.dll 2008-04-06 14:04 . 2006-03-17 14:49 368,640 --a------ C:\WINDOWS\system32\TwnLib4.dll 2008-04-06 14:04 . 2006-03-17 11:45 258,048 --a------ C:\WINDOWS\system32\imagXR7.dll 2008-04-04 23:00 . 2008-04-09 20:23 <DIR> d--h----- C:\WINDOWS\$hf_mig$ 2008-04-04 09:58 . 2008-04-07 17:04 <DIR> d-------- C:\Program Files\Winamp 2008-04-04 09:56 . 2006-06-01 20:49 163,840 -----c--- C:\WINDOWS\system32\dllcache\jgdw400.dll 2008-04-04 09:56 . 2006-06-01 20:49 27,648 -----c--- C:\WINDOWS\system32\dllcache\jgpl400.dll 2008-04-03 20:08 . 2008-04-03 20:08 <DIR> d-------- C:\Program Files\ffdshow 2008-04-03 20:08 . 2006-12-10 22:32 499,712 --a------ C:\WINDOWS\system32\msvcp71.dll 2008-04-03 20:08 . 2006-12-10 22:32 348,160 --a------ C:\WINDOWS\system32\msvcr71.dll 2008-04-03 20:08 . 2007-04-24 16:30 60,273 --a------ C:\WINDOWS\system32\pthreadGC2.dll 2008-04-03 20:08 . 2008-03-04 12:33 7,680 --a------ C:\WINDOWS\system32\ff_vfw.dll 2008-04-03 20:08 . 2007-07-10 17:10 547 --a------ C:\WINDOWS\system32\ff_vfw.dll.manifest 2008-04-03 19:58 . 2008-04-03 20:09 <DIR> d-------- C:\Documents and Settings\Administrator\Dane aplikacji\BESTplayer 2008-03-31 20:58 . 2008-04-19 09:48 <DIR> d-------- C:\MU 2008-03-31 20:56 . 2008-04-05 21:07 2,611 --a------ C:\WINDOWS\sql.MIF 2008-03-31 20:55 . 2008-03-31 20:55 <DIR> d-------- C:\Program Files\Microsoft SQL Server 2008-03-31 20:55 . 1997-07-19 17:01 376,592 --a------ C:\WINDOWS\system32\msrdo20.dll 2008-03-31 20:55 . 2000-08-06 01:51 274,489 --a------ C:\WINDOWS\system32\ntwdblib.dll 2008-03-31 20:55 . 2000-08-06 01:51 192,569 --a------ C:\WINDOWS\system32\msrpjt40.dll 2008-03-31 20:55 . 2001-03-13 11:49 120,320 --a------ C:\WINDOWS\system32\comdlg32.ocx 2008-03-31 20:55 . 1997-01-13 10:49 97,552 --a------ C:\WINDOWS\system32\rdocurs.dll 2008-03-31 20:55 . 2000-08-06 01:51 32,830 --a------ C:\WINDOWS\system32\dbmsshrn.dll 2008-03-31 20:53 . 2008-04-23 21:59 <DIR> d-------- C:\WINDOWS\system32\Lang 2008-03-31 20:53 . 2008-03-31 20:53 940,794 --a------ C:\WINDOWS\system32\LoopyMusic.wav 2008-03-31 20:53 . 2008-03-31 20:53 146,650 --a------ C:\WINDOWS\system32\BuzzingBee.wav 2008-03-31 20:50 . 2008-03-31 20:50 <DIR> d-------- C:\Program Files\GIGABYTE 2008-03-31 20:50 . 2008-03-31 20:50 <DIR> d-------- C:\Program Files\BroadCom GB LAN 2008-03-31 20:49 . 2008-03-31 20:50 <DIR> d-------- C:\WINDOWS\system32\RTCOM 2008-03-31 20:49 . 2008-03-31 20:49 <DIR> d-------- C:\Program Files\Realtek 2008-03-31 20:46 . 2008-03-31 20:46 169 --a------ C:\WINDOWS\RtlRack.ini 2008-03-31 20:44 . 2005-06-28 10:21 22,752 --a------ C:\WINDOWS\system32\spupdsvc.exe 2008-03-31 20:42 . 2008-03-31 20:42 <DIR> d-------- C:\Program Files\Realtek Sound Manager 2008-03-31 20:42 . 2008-03-31 20:42 <DIR> d-------- C:\Program Files\AvRack 2008-03-31 20:42 . 2005-05-18 09:15 9,389,568 -r------- C:\WINDOWS\system32\RTLCPL.exe 2008-03-31 20:42 . 2005-05-18 11:50 2,319,680 -r------- C:\WINDOWS\system32\drivers\alcxwdm.sys 2008-03-31 20:42 . 2002-02-05 07:54 141,016 -r------- C:\WINDOWS\system32\alsndmgr.wav 2008-03-31 20:42 . 2005-09-21 04:24 86,016 -r------- C:\WINDOWS\SoundMan.exe 2008-03-31 20:42 . 2005-07-15 10:48 40,960 -r------- C:\WINDOWS\system32\ChCfg.exe 2008-03-31 20:42 . 2001-07-05 18:19 164 -r------- C:\WINDOWS\avrack.ini 2008-03-31 20:41 . 2008-04-14 22:01 <DIR> d--h----- C:\Program Files\InstallShield Installation Information 2008-03-31 20:41 . 2005-09-21 04:25 299,008 -r------- C:\WINDOWS\system32\ALSndMgr.Cpl 2008-03-31 20:41 . 2005-02-03 09:13 294,912 -r------- C:\WINDOWS\alcupd.exe 2008-03-31 20:41 . 2005-03-02 14:21 200,704 -r------- C:\WINDOWS\alcrmv.exe 2008-03-31 20:36 . 2008-03-31 20:36 <DIR> d-------- C:\Documents and Settings\Administrator\Dane aplikacji\Gadu-Gadu 2008-03-31 20:29 . 1998-10-29 16:45 306,688 --a------ C:\WINDOWS\IsUninst.exe 2008-03-31 20:29 . 2008-03-31 20:56 1,240 --a------ C:\WINDOWS\setup.iss 2008-03-31 20:23 . 2008-03-31 20:23 <DIR> d-------- C:\Program Files\Gadu-Gadu 2008-03-31 20:23 . 2008-03-31 20:26 <DIR> d-------- C:\Documents and Settings\Administrator\Gadu-Gadu 2008-03-31 20:12 . 2008-03-31 20:12 <DIR> d-------- C:\Program Files\uTorrent 2008-03-31 20:12 . 2008-04-23 21:20 <DIR> d-------- C:\Documents and Settings\Administrator\Dane aplikacji\uTorrent 2008-03-31 20:10 . 2008-03-31 20:10 <DIR> d-------- C:\WINDOWS\nview 2008-03-31 20:10 . 2008-03-31 20:10 <DIR> d-------- C:\Program Files\Common Files\InstallShield 2008-03-31 20:10 . 2008-03-31 20:10 <DIR> d-------- C:\NVIDIA 2008-03-31 20:10 . 2007-12-05 02:53 356,352 --a------ C:\WINDOWS\system32\NVUNINST.EXE 2008-03-31 20:10 . 2007-12-05 01:41 356,352 --a------ C:\WINDOWS\system32\nvudisp.exe 2008-03-31 20:10 . 2008-03-31 20:11 163,353 --a------ C:\WINDOWS\system32\nvapps.xml 2008-03-31 20:10 . 2007-12-05 01:41 17,737 --a------ C:\WINDOWS\system32\nvdisp.nvu . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-03-31 17:33 --------- d-----w C:\Program Files\microsoft frontpage 2008-03-31 17:32 --------- d-----w C:\Program Files\Usługi online 2008-03-21 20:30 200,704 ----a-w C:\WINDOWS\system32\ssldivx.dll 2008-03-21 20:30 1,044,480 ----a-w C:\WINDOWS\system32\libdivx.dll 2008-03-20 08:09 1,845,504 ----a-w C:\WINDOWS\system32\win32k.sys 2008-02-20 06:51 282,624 ----a-w C:\WINDOWS\system32\gdi32.dll 2008-02-20 05:38 45,568 ----a-w C:\WINDOWS\system32\dnsrslvr.dll 2008-02-16 09:05 662,016 ----a-w C:\WINDOWS\system32\wininet.dll . ((((((((((((((((((((((((((((( snapshot@2008-04-23_ 8.12.50,95 ))))))))))))))))))))))))))))))))))))))))) . - 2008-04-23 05:22:54 2,048 --s-a-w C:\WINDOWS\bootstat.dat + 2008-04-23 19:57:54 2,048 --s-a-w C:\WINDOWS\bootstat.dat + 2008-04-21 00:32:39 163,328 ----a-w C:\WINDOWS\ERUNT\SDFIX\ERDNT.EXE + 2008-04-23 19:44:14 2,523,136 ----a-w C:\WINDOWS\ERUNT\SDFIX\Users\[u]0[/u]0000001\NTUSER.DAT + 2008-04-23 19:44:14 151,552 ----a-w C:\WINDOWS\ERUNT\SDFIX\Users\[u]0[/u]0000002\UsrClass.dat + 2008-04-21 00:32:39 163,328 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\ERDNT.EXE + 2008-04-23 19:44:08 2,523,136 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\Users\[u]0[/u]0000001\NTUSER.DAT + 2008-04-23 19:44:08 151,552 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\Users\[u]0[/u]0000002\UsrClass.dat . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{25CEE8EC-5730-41bc-8B58-22DDC8AB8C20}] 2008-03-20 00:36 1267040 --a------ C:\Program Files\Winamp Toolbar\winamptb.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar] "{EBF2BA02-9094-4C5A-858B-BB198F3D8DE2}"= "C:\Program Files\Winamp Toolbar\winamptb.dll" [2008-03-20 00:36 1267040] [HKEY_CLASSES_ROOT\clsid\{ebf2ba02-9094-4c5a-858b-bb198f3d8de2}] [HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand.1] [HKEY_CLASSES_ROOT\TypeLib\{538CD77C-BFDD-49b0-9562-77419CAB89D1}] [HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand] [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser] "{EBF2BA02-9094-4C5A-858B-BB198F3D8DE2}"= C:\Program Files\Winamp Toolbar\winamptb.dll [2008-03-20 00:36 1267040] [HKEY_CLASSES_ROOT\clsid\{ebf2ba02-9094-4c5a-858b-bb198f3d8de2}] [HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand.1] [HKEY_CLASSES_ROOT\TypeLib\{538CD77C-BFDD-49b0-9562-77419CAB89D1}] [HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:44 15360] "DAEMON Tools Lite"="C:\PROGRA~1\DAEMON~1\daemon.exe" [2008-02-14 01:09 486856] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-12-05 01:41 8523776] "nwiz"="nwiz.exe" [2007-12-05 01:41 1626112 C:\WINDOWS\system32\nwiz.exe] "NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-12-05 01:41 81920] "RTHDCPL"="RTHDCPL.EXE" [2005-09-22 07:36 14854144 C:\WINDOWS\RTHDCPL.exe] "WinampAgent"="C:\Program Files\Winamp\winampa.exe" [ ] "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 22:16 39792] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 04:25 144784] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 00:44 15360] [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "C:\\Program Files\\uTorrent\\uTorrent.exe"= "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"= "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"= "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"= R0 iteraid;ITERAID_Service_Install;C:\WINDOWS\system32\DRIVERS\iteraid.sys [2004-10-29 11:21] . ************************************************************************** catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-04-23 22:01:54 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2008-04-23 22:02:16 ComboFix-quarantined-files.txt 2008-04-23 20:02:14 ComboFix2.txt 2008-04-23 06:12:59 Pre-Run: 11,691,499,520 bajtów wolnych Post-Run: 11,681,148,928 bajtów wolnych 214 --- E O F --- 2008-04-20 11:21:11

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 22:02:47, on 2008-04-23 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\HPZipm12.exe C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\system32\wuauclt.exe C:\WINDOWS\system32\RUNDLL32.EXE C:\WINDOWS\RTHDCPL.EXE C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe C:\WINDOWS\system32\ctfmon.exe C:\PROGRA~1\DAEMON~1\daemon.exe C:\PROGRA~1\MOZILL~1\FIREFOX.EXE C:\WINDOWS\explorer.exe C:\Documents and Settings\Administrator\Pulpit\hijackthis.com R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.daemon-search.com/startpage R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza R3 - URLSearchHook: Winamp Search Class - {57BCA5FA-5DBB-45a2-B558-1755C3F6253B} - C:\Program Files\Winamp Toolbar\winamptb.dll O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: Winamp Toolbar Loader - {25CEE8EC-5730-41bc-8B58-22DDC8AB8C20} - C:\Program Files\Winamp Toolbar\winamptb.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O3 - Toolbar: Winamp Toolbar - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - C:\Program Files\Winamp Toolbar\winamptb.dll O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe" O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\PROGRA~1\DAEMON~1\daemon.exe" -autorun O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O8 - Extra context menu item: &Winamp Search - C:\Documents and Settings\All Users\Dane aplikacji\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {68282C51-9459-467B-95BF-3C0E89627E55} (MksSkanerOnline Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe -- End of file - 4363 bytes

**Posty:** 18165 · przez **wojtas** 24 Kwi 2008, 00:22

zainstaluj jakiegos antywirusa

1. Ściągnij OTMoveIt i go włacz i odpal go z opcji CleanUp

2. wykonaj optymalizację windowsa
3.sciagnij ATF_Cleaner
zaznacz
Windows Temp
All users Temp
Temporary internet files
Recycle Bin
i wcisnij EMPTY SELECTED
4.Wyłącz przywracanie systemu ( właściwości mój komputer-zakładka przywracanie - wyłącz przywracanie na wszystkich dyskach). Po chwili włącz je powrotem

**Posty:** 1239 · przez **mati43** 24 Kwi 2008, 21:31

No i niestety nie chodzi ;( Czyżby format ?

**Posty:** 18165 · przez **wojtas** 24 Kwi 2008, 21:38

ale co sie dzieje ze sie nie właczaja? jakis blad? wykonaj jeszcze raz sdfixa i combofixa

**Posty:** 1239 · przez **mati43** 26 Kwi 2008, 07:55

wojtas właśnie nie dzieje sie nic, klikam troche po muli i stop.Teraz doszedł reset po uruchomieniu kompa.

**Posty:** 8001 · przez **Okocza** 26 Kwi 2008, 10:28

włóż płytę windowsa, niech ją zbootuje, wchodzisz do konsoli odzyskiwania systemu, logujesz się do swojej partycji systemowej i wpisujesz:

chkdsk /p

zobacz czy będzie naprawiał jakieś pliki. jeśli nie to koniecznie wchodzisz do awaryjnego i tam odpalasz sdfixa i combofixa

**Posty:** 18165 · przez **wojtas** 26 Kwi 2008, 10:40

daj jeszcze nowego loga z combofixa

**Posty:** 1239 · przez **mati43** 27 Kwi 2008, 13:54

Kod: Zaznacz wszystko: ComboFix 08-04-26.3 - Administrator 2008-04-27 13:51:34.3 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.658 [GMT 2:00] Running from: C:\DOCUME~1\ADMINI~1\Pulpit\ComboFix.exe * Created a new restore point [color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color] . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\WINDOWS\svchost.com . ((((((((((((((((((((((((( Files Created from 2008-03-27 to 2008-04-27 ))))))))))))))))))))))))))))))) . 2008-04-27 11:38 . 2008-04-27 11:38 <DIR> d-------- C:\Program Files\TibiaBot NG 2008-04-27 11:38 . 2008-04-27 11:40 <DIR> d-a------ C:\Documents and Settings\All Users\Dane aplikacji\TEMP 2008-04-26 11:19 . 2008-04-26 14:47 <DIR> d-------- C:\Program Files\Tibia 2008-04-26 10:49 . 2008-04-26 10:51 <DIR> d-------- C:\Program Files\Untitled 2008-04-26 10:47 . 2008-04-26 11:33 <DIR> d-------- C:\setups 2008-04-26 10:44 . 2008-04-26 10:48 <DIR> d-------- C:\Program Files\createinstall free 2008-04-25 23:03 . 2008-04-25 23:03 <DIR> d-------- C:\Automap 2008-04-25 14:21 . 2008-04-25 14:20 519,772 --ahs---- C:\WINDOWS\system32\firefox.exe 2008-04-25 14:20 . 2008-04-27 13:51 42 --a------ C:\WINDOWS\directx.sys 2008-04-24 07:54 . 2008-04-24 07:54 <DIR> d-------- C:\Program Files\ESET 2008-04-24 07:54 . 2008-04-24 07:54 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\ESET 2008-04-23 21:44 . 2008-04-23 21:44 <DIR> d-------- C:\WINDOWS\ERUNT 2008-04-23 21:33 . 2008-04-23 21:37 <DIR> d-------- C:\Program Files\ChomikBox 2008-04-23 16:30 . 2008-04-23 16:35 <DIR> d-------- C:\Program Files\tibia_ots24 2008-04-23 10:30 . 2008-04-27 11:40 <DIR> d-------- C:\Documents and Settings\Administrator\Dane aplikacji\Tibia 2008-04-23 09:45 . 2008-04-23 09:45 <DIR> d-------- C:\Program Files\WypasOTS Client 2008-04-23 09:45 . 2008-04-23 09:45 451,072 --a------ C:\WINDOWS\WypasOTS Client uninstall.exe 2008-04-22 20:59 . 2008-04-22 21:16 <DIR> d-------- C:\Program Files\SkanerOnline 2008-04-22 20:38 . 2008-04-22 20:38 <DIR> d-------- C:\Program Files\Asprate 2008-04-21 16:23 . 2008-04-21 16:23 <DIR> d-------- C:\Logs 2008-04-21 15:52 . 2008-04-21 15:52 <DIR> d-------- C:\Program Files\Common Files\Blizzard Entertainment 2008-04-20 15:09 . 2008-04-20 15:09 <DIR> d-------- C:\Program Files\Ashampoo 2008-04-20 15:09 . 2008-04-20 15:09 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\ashampoo 2008-04-20 15:09 . 2008-04-20 15:09 <DIR> d-------- C:\Documents and Settings\Administrator\Dane aplikacji\Ashampoo 2008-04-20 13:33 . 2008-04-20 13:33 <DIR> d-------- C:\Program Files\RegCleaner 2008-04-20 13:27 . 2008-04-20 13:27 <DIR> d-------- C:\Program Files\Alcohol Soft 2008-04-20 13:21 . 2008-04-20 13:21 <DIR> d-------- C:\Program Files\MSXML 4.0 2008-04-19 18:51 . 2008-04-19 18:51 86 --a------ C:\WINDOWS\musicmaker.INI 2008-04-19 18:42 . 2008-04-19 18:42 <DIR> d-------- C:\Program Files\Common Files\MAGIX Shared 2008-04-19 18:29 . 2005-11-30 21:20 2,314,332 --a------ C:\WINDOWS\system32\LIBMMD.DLL 2008-04-19 18:29 . 2000-05-21 22:00 1,066,176 --a------ C:\WINDOWS\system32\mscomctl.ocx 2008-04-19 18:29 . 2000-05-21 22:00 647,872 --a------ C:\WINDOWS\system32\mscomct2.ocx 2008-04-19 18:29 . 1998-06-23 22:00 609,584 --a------ C:\WINDOWS\system32\comctl32.ocx 2008-04-19 18:29 . 2000-05-22 15:58 115,920 --a------ C:\WINDOWS\system32\msinet.ocx 2008-04-17 16:06 . 2008-04-17 16:06 <DIR> d-------- C:\VideoOutput 2008-04-16 20:53 . 2008-02-22 02:33 69,632 --a------ C:\WINDOWS\system32\javacpl.cpl 2008-04-16 20:52 . 2008-04-16 20:53 <DIR> d-------- C:\Program Files\Java 2008-04-16 20:51 . 2008-04-16 20:51 <DIR> d-------- C:\Program Files\Common Files\Java 2008-04-15 20:41 . 2008-04-24 20:26 <DIR> d-------- C:\Program Files\DivX 2008-04-14 20:16 . 2008-04-14 20:16 <DIR> d-------- C:\Program Files\DAEMON Tools Lite 2008-04-14 20:13 . 2008-04-14 20:13 <DIR> d-------- C:\Documents and Settings\Administrator\Dane aplikacji\DAEMON Tools 2008-04-14 20:13 . 2008-04-14 20:13 716,272 --a------ C:\WINDOWS\system32\drivers\sptd.sys 2008-04-13 10:00 . 2008-04-13 10:00 <DIR> d-------- C:\Program Files\Common Files\Adobe 2008-04-11 21:24 . 2008-04-19 18:53 <DIR> d-------- C:\Program Files\MP3Producer 2008-04-11 21:24 . 2008-04-11 21:24 8 --a------ C:\WINDOWS\system32\ntP2.trk 2008-04-11 21:01 . 2008-04-11 21:01 <DIR> d-------- C:\Documents and Settings\Administrator\Dane aplikacji\COWON 2008-04-11 21:00 . 2008-04-11 21:12 <DIR> d-------- C:\Program Files\JetAudio 2008-04-11 21:00 . 2008-04-11 21:00 <DIR> d-------- C:\Program Files\Common Files\COWON 2008-04-10 21:22 . 2008-04-10 21:22 <DIR> d-------- C:\spoolerlogs 2008-04-10 08:09 . 2008-04-10 08:09 <DIR> d-------- C:\Program Files\Hewlett-Packard 2008-04-10 08:09 . 2008-04-10 08:09 <DIR> d-------- C:\Program Files\Common Files\Hewlett-Packard 2008-04-10 08:09 . 2006-04-10 14:03 38,400 --a------ C:\WINDOWS\system32\hpz3l054.dll 2008-04-10 08:08 . 2008-04-10 08:08 <DIR> d-------- C:\Program Files\HP 2008-04-10 08:08 . 2006-03-03 21:03 282,680 --a------ C:\WINDOWS\system32\HPZidr12.dll 2008-04-10 08:08 . 2006-03-03 21:02 204,800 --a------ C:\WINDOWS\system32\HPZipr12.dll 2008-04-10 08:08 . 2006-03-03 21:02 94,208 --a------ C:\WINDOWS\system32\HPZipt12.dll 2008-04-10 08:08 . 2006-03-03 21:03 69,632 --a------ C:\WINDOWS\system32\HPZipm12.exe 2008-04-10 08:08 . 2006-03-03 21:03 65,536 --a------ C:\WINDOWS\system32\HPZinw12.exe 2008-04-10 08:08 . 2006-03-03 21:02 57,344 --a------ C:\WINDOWS\system32\HPZisn12.dll 2008-04-10 08:08 . 2004-08-03 22:58 15,104 --a------ C:\WINDOWS\system32\drivers\usbscan.sys 2008-04-10 08:08 . 2004-08-03 22:58 15,104 --a--c--- C:\WINDOWS\system32\dllcache\usbscan.sys 2008-04-10 07:58 . 2004-08-03 23:01 25,856 --a------ C:\WINDOWS\system32\drivers\usbprint.sys 2008-04-10 07:58 . 2004-08-03 23:01 25,856 --a--c--- C:\WINDOWS\system32\dllcache\usbprint.sys 2008-04-09 19:18 . 2008-04-09 19:18 <DIR> d-------- C:\Documents and Settings\Administrator\Dane aplikacji\Media Player Classic 2008-04-09 19:17 . 2008-04-09 19:17 <DIR> d-------- C:\Program Files\Real Alternative 2008-04-07 17:03 . 2008-04-07 17:03 <DIR> d-------- C:\Program Files\Winamp Toolbar 2008-04-07 17:03 . 2008-04-07 17:03 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Winamp Toolbar 2008-04-07 17:03 . 2008-04-07 17:05 <DIR> d-------- C:\Documents and Settings\Administrator\Dane aplikacji\Winamp 2008-04-06 20:19 . 2004-08-03 23:08 26,496 --a--c--- C:\WINDOWS\system32\dllcache\usbstor.sys 2008-04-06 14:40 . 2008-04-18 20:13 69 --a------ C:\WINDOWS\NeroDigital.ini 2008-04-06 14:05 . 2008-04-06 14:05 <DIR> d-------- C:\Documents and Settings\Administrator\Dane aplikacji\Nero 2008-04-06 14:04 . 2008-04-20 13:33 <DIR> d-------- C:\Program Files\Nero 2008-04-06 14:04 . 2008-04-06 14:04 <DIR> d-------- C:\Program Files\Common Files\Nero 2008-04-06 14:04 . 2008-04-06 14:04 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Nero 2008-04-06 14:04 . 2006-03-17 11:45 1,757,184 --a------ C:\WINDOWS\system32\imagX7.dll 2008-04-06 14:04 . 2006-03-17 11:45 802,816 --a------ C:\WINDOWS\system32\imagXRA7.dll 2008-04-06 14:04 . 2006-03-17 11:45 497,296 --a------ C:\WINDOWS\system32\imagXpr7.dll 2008-04-06 14:04 . 2006-03-17 14:49 368,640 --a------ C:\WINDOWS\system32\TwnLib4.dll 2008-04-06 14:04 . 2006-03-17 11:45 258,048 --a------ C:\WINDOWS\system32\imagXR7.dll 2008-04-04 23:00 . 2008-04-09 20:23 <DIR> d--h----- C:\WINDOWS\$hf_mig$ 2008-04-04 09:58 . 2008-04-07 17:04 <DIR> d-------- C:\Program Files\Winamp 2008-04-04 09:56 . 2006-06-01 20:49 163,840 -----c--- C:\WINDOWS\system32\dllcache\jgdw400.dll 2008-04-04 09:56 . 2006-06-01 20:49 27,648 -----c--- C:\WINDOWS\system32\dllcache\jgpl400.dll 2008-04-03 20:08 . 2008-04-03 20:08 <DIR> d-------- C:\Program Files\ffdshow 2008-04-03 20:08 . 2006-12-10 22:32 499,712 --a------ C:\WINDOWS\system32\msvcp71.dll 2008-04-03 20:08 . 2006-12-10 22:32 348,160 --a------ C:\WINDOWS\system32\msvcr71.dll 2008-04-03 20:08 . 2007-04-24 16:30 60,273 --a------ C:\WINDOWS\system32\pthreadGC2.dll 2008-04-03 20:08 . 2008-03-04 12:33 7,680 --a------ C:\WINDOWS\system32\ff_vfw.dll 2008-04-03 20:08 . 2007-07-10 17:10 547 --a------ C:\WINDOWS\system32\ff_vfw.dll.manifest 2008-04-03 19:58 . 2008-04-03 20:09 <DIR> d-------- C:\Documents and Settings\Administrator\Dane aplikacji\BESTplayer 2008-03-31 20:58 . 2008-04-19 09:48 <DIR> d-------- C:\MU 2008-03-31 20:56 . 2008-04-05 21:07 2,611 --a------ C:\WINDOWS\sql.MIF 2008-03-31 20:55 . 2008-03-31 20:55 <DIR> d-------- C:\Program Files\Microsoft SQL Server 2008-03-31 20:55 . 1997-07-19 17:01 376,592 --a------ C:\WINDOWS\system32\msrdo20.dll 2008-03-31 20:55 . 2000-08-06 01:51 274,489 --a------ C:\WINDOWS\system32\ntwdblib.dll 2008-03-31 20:55 . 2000-08-06 01:51 192,569 --a------ C:\WINDOWS\system32\msrpjt40.dll 2008-03-31 20:55 . 2001-03-13 11:49 120,320 --a------ C:\WINDOWS\system32\comdlg32.ocx 2008-03-31 20:55 . 1997-01-13 10:49 97,552 --a------ C:\WINDOWS\system32\rdocurs.dll 2008-03-31 20:55 . 2000-08-06 01:51 32,830 --a------ C:\WINDOWS\system32\dbmsshrn.dll 2008-03-31 20:53 . 2008-04-27 07:43 <DIR> d-------- C:\WINDOWS\system32\Lang 2008-03-31 20:53 . 2008-03-31 20:53 940,794 --a------ C:\WINDOWS\system32\LoopyMusic.wav 2008-03-31 20:53 . 2008-03-31 20:53 146,650 --a------ C:\WINDOWS\system32\BuzzingBee.wav 2008-03-31 20:50 . 2008-03-31 20:50 <DIR> d-------- C:\Program Files\GIGABYTE 2008-03-31 20:50 . 2008-03-31 20:50 <DIR> d-------- C:\Program Files\BroadCom GB LAN 2008-03-31 20:49 . 2008-03-31 20:50 <DIR> d-------- C:\WINDOWS\system32\RTCOM 2008-03-31 20:49 . 2008-03-31 20:49 <DIR> d-------- C:\Program Files\Realtek 2008-03-31 20:46 . 2008-03-31 20:46 169 --a------ C:\WINDOWS\RtlRack.ini 2008-03-31 20:44 . 2005-06-28 10:21 22,752 --a------ C:\WINDOWS\system32\spupdsvc.exe 2008-03-31 20:42 . 2008-03-31 20:42 <DIR> d-------- C:\Program Files\Realtek Sound Manager 2008-03-31 20:42 . 2008-03-31 20:42 <DIR> d-------- C:\Program Files\AvRack 2008-03-31 20:42 . 2005-05-18 09:15 9,389,568 -r------- C:\WINDOWS\system32\RTLCPL.exe 2008-03-31 20:42 . 2005-05-18 11:50 2,319,680 -r------- C:\WINDOWS\system32\drivers\alcxwdm.sys 2008-03-31 20:42 . 2002-02-05 07:54 141,016 -r------- C:\WINDOWS\system32\alsndmgr.wav 2008-03-31 20:42 . 2005-09-21 04:24 86,016 -r------- C:\WINDOWS\SoundMan.exe 2008-03-31 20:42 . 2005-07-15 10:48 40,960 -r------- C:\WINDOWS\system32\ChCfg.exe 2008-03-31 20:42 . 2001-07-05 18:19 164 -r------- C:\WINDOWS\avrack.ini 2008-03-31 20:41 . 2008-04-14 22:01 <DIR> d--h----- C:\Program Files\InstallShield Installation Information 2008-03-31 20:41 . 2005-09-21 04:25 299,008 -r------- C:\WINDOWS\system32\ALSndMgr.Cpl 2008-03-31 20:41 . 2005-02-03 09:13 294,912 -r------- C:\WINDOWS\alcupd.exe 2008-03-31 20:41 . 2005-03-02 14:21 200,704 -r------- C:\WINDOWS\alcrmv.exe 2008-03-31 20:36 . 2008-03-31 20:36 <DIR> d-------- C:\Documents and Settings\Administrator\Dane aplikacji\Gadu-Gadu 2008-03-31 20:29 . 1998-10-29 16:45 306,688 --a------ C:\WINDOWS\IsUninst.exe 2008-03-31 20:29 . 2008-03-31 20:56 1,240 --a------ C:\WINDOWS\setup.iss 2008-03-31 20:23 . 2008-03-31 20:23 <DIR> d-------- C:\Program Files\Gadu-Gadu 2008-03-31 20:23 . 2008-03-31 20:26 <DIR> d-------- C:\Documents and Settings\Administrator\Gadu-Gadu . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-03-31 17:33 --------- d-----w C:\Program Files\microsoft frontpage 2008-03-31 17:32 --------- d-----w C:\Program Files\Usługi online 2008-03-21 20:30 200,704 ----a-w C:\WINDOWS\system32\ssldivx.dll 2008-03-21 20:30 1,044,480 ----a-w C:\WINDOWS\system32\libdivx.dll 2008-03-20 08:09 1,845,504 ----a-w C:\WINDOWS\system32\win32k.sys 2008-02-20 06:51 282,624 ----a-w C:\WINDOWS\system32\gdi32.dll 2008-02-20 05:38 45,568 ----a-w C:\WINDOWS\system32\dnsrslvr.dll 2008-02-16 09:05 662,016 ----a-w C:\WINDOWS\system32\wininet.dll . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{25CEE8EC-5730-41bc-8B58-22DDC8AB8C20}] 2008-03-20 00:36 1267040 --a------ C:\Program Files\Winamp Toolbar\winamptb.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar] "{EBF2BA02-9094-4C5A-858B-BB198F3D8DE2}"= "C:\Program Files\Winamp Toolbar\winamptb.dll" [2008-03-20 00:36 1267040] [HKEY_CLASSES_ROOT\clsid\{ebf2ba02-9094-4c5a-858b-bb198f3d8de2}] [HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand.1] [HKEY_CLASSES_ROOT\TypeLib\{538CD77C-BFDD-49b0-9562-77419CAB89D1}] [HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand] [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser] "{EBF2BA02-9094-4C5A-858B-BB198F3D8DE2}"= C:\Program Files\Winamp Toolbar\winamptb.dll [2008-03-20 00:36 1267040] [HKEY_CLASSES_ROOT\clsid\{ebf2ba02-9094-4c5a-858b-bb198f3d8de2}] [HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand.1] [HKEY_CLASSES_ROOT\TypeLib\{538CD77C-BFDD-49b0-9562-77419CAB89D1}] [HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:44 15360] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "RTHDCPL"="RTHDCPL.EXE" [2005-09-22 07:36 14854144 C:\WINDOWS\RTHDCPL.exe] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 04:25 144784] "egui"="C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" [2008-03-13 16:48 1443072] "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-12-05 01:41 8523776] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 00:44 15360] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher] --a------ 2008-01-11 22:16 39792 C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite] --a------ 2008-02-14 01:09 486856 C:\PROGRA~1\DAEMON~1\daemon.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck] C:\WINDOWS\system32\dumprep 0 -k [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon] --a------ 2007-12-05 01:41 8523776 C:\WINDOWS\system32\NvCpl.dll [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter] --a------ 2007-12-05 01:41 81920 C:\WINDOWS\system32\NvMcTray.dll [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz] --a------ 2007-12-05 01:41 1626112 C:\WINDOWS\system32\nwiz.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent] C:\Program Files\Winamp\winampa.exe [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "C:\\Program Files\\uTorrent\\uTorrent.exe"= "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"= "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"= "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"= R0 iteraid;ITERAID_Service_Install;C:\WINDOWS\system32\DRIVERS\iteraid.sys [2004-10-29 11:21] . ************************************************************************** catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-04-27 13:52:25 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2008-04-27 13:52:48 ComboFix-quarantined-files.txt 2008-04-27 11:52:46 Pre-Run: 12,333,137,920 bajtów wolnych Post-Run: 12,342,226,944 bajtów wolnych 216 --- E O F --- 2008-04-20 11:21:11

a jakiego antivira polecacie ? nod32 nie może sie zainstalować

to samo z mks_vir innych nie sprawdzałem

[ Dodano: Dzisiaj o 12:56 ]
okocza nie mam windy musze poszukać

**Posty:** 18165 · przez **wojtas** 27 Kwi 2008, 20:01

Wyłącz przywracanie systemu ( właściwości mój komputer-zakładka przywracanie - wyłącz przywracanie na wszystkich dyskach)

sprobuj avasta

zainstaluj http://www.programosy.pl/program,comodo-firewall.html

Otworz notatnik i wklej w nim to:

File::
C:\WINDOWS\system32\firefox.exe
C:\WINDOWS\directx.sys

DirLook::
C:\setups

Plik >>> zapisz jako CFScript.txt .Plik przeciągnij i upuść na ikonę ComboFixa (tak jak tu ) . odczekaj az wygeneruje sie nowy log i go daj na forum

**Posty:** 1239 · przez **mati43** 28 Kwi 2008, 14:30

combo

Kod: Zaznacz wszystko: ComboFix 08-04-26.3 - Administrator 2008-04-28 14:27:58.4 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.525 [GMT 2:00] Running from: C:\Documents and Settings\Administrator\Pulpit\ComboFix.exe Command switches used :: C:\Documents and Settings\Administrator\Pulpit\CFScript.txt * Created a new restore point [color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color] FILE :: C:\WINDOWS\directx.sys C:\WINDOWS\system32\firefox.exe . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\WINDOWS\directx.sys C:\WINDOWS\system32\firefox.exe . ((((((((((((((((((((((((( Files Created from 2008-03-28 to 2008-04-28 ))))))))))))))))))))))))))))))) . 2008-04-28 14:24 . 2008-04-28 14:24 <DIR> d-------- C:\Program Files\COMODO 2008-04-28 14:24 . 2008-04-28 14:24 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\comodo 2008-04-28 14:24 . 2008-04-28 14:24 <DIR> d-------- C:\Documents and Settings\Administrator\Dane aplikacji\Comodo 2008-04-28 14:24 . 2008-04-28 14:24 139,008 --a------ C:\WINDOWS\system32\guard32.dll 2008-04-28 14:24 . 2008-04-28 14:24 87,312 --a------ C:\WINDOWS\system32\drivers\cmdguard.sys 2008-04-28 14:24 . 2008-04-28 14:24 23,824 --a------ C:\WINDOWS\system32\drivers\cmdhlp.sys 2008-04-28 14:11 . 2008-04-28 14:11 <DIR> d--hs---- C:\Documents and Settings\LocalService.ZARZĄDZANIE NT 2008-04-27 11:38 . 2008-04-27 11:38 <DIR> d-------- C:\Program Files\TibiaBot NG 2008-04-27 11:38 . 2008-04-27 11:40 <DIR> d-a------ C:\Documents and Settings\All Users\Dane aplikacji\TEMP 2008-04-26 11:19 . 2008-04-26 14:47 <DIR> d-------- C:\Program Files\Tibia 2008-04-26 10:49 . 2008-04-26 10:51 <DIR> d-------- C:\Program Files\Untitled 2008-04-26 10:47 . 2008-04-26 11:33 <DIR> d-------- C:\setups 2008-04-26 10:44 . 2008-04-26 10:48 <DIR> d-------- C:\Program Files\createinstall free 2008-04-25 23:03 . 2008-04-25 23:03 <DIR> d-------- C:\Automap 2008-04-24 07:54 . 2008-04-24 07:54 <DIR> d-------- C:\Program Files\ESET 2008-04-24 07:54 . 2008-04-24 07:54 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\ESET 2008-04-23 21:44 . 2008-04-23 21:44 <DIR> d-------- C:\WINDOWS\ERUNT 2008-04-23 21:33 . 2008-04-23 21:37 <DIR> d-------- C:\Program Files\ChomikBox 2008-04-23 16:30 . 2008-04-23 16:35 <DIR> d-------- C:\Program Files\tibia_ots24 2008-04-23 10:30 . 2008-04-27 21:34 <DIR> d-------- C:\Documents and Settings\Administrator\Dane aplikacji\Tibia 2008-04-23 09:45 . 2008-04-23 09:45 <DIR> d-------- C:\Program Files\WypasOTS Client 2008-04-23 09:45 . 2008-04-23 09:45 451,072 --a------ C:\WINDOWS\WypasOTS Client uninstall.exe 2008-04-22 20:59 . 2008-04-22 21:16 <DIR> d-------- C:\Program Files\SkanerOnline 2008-04-22 20:38 . 2008-04-22 20:38 <DIR> d-------- C:\Program Files\Asprate 2008-04-21 16:23 . 2008-04-21 16:23 <DIR> d-------- C:\Logs 2008-04-21 15:52 . 2008-04-21 15:52 <DIR> d-------- C:\Program Files\Common Files\Blizzard Entertainment 2008-04-20 15:09 . 2008-04-20 15:09 <DIR> d-------- C:\Program Files\Ashampoo 2008-04-20 15:09 . 2008-04-20 15:09 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\ashampoo 2008-04-20 15:09 . 2008-04-20 15:09 <DIR> d-------- C:\Documents and Settings\Administrator\Dane aplikacji\Ashampoo 2008-04-20 13:33 . 2008-04-20 13:33 <DIR> d-------- C:\Program Files\RegCleaner 2008-04-20 13:27 . 2008-04-20 13:27 <DIR> d-------- C:\Program Files\Alcohol Soft 2008-04-20 13:21 . 2008-04-20 13:21 <DIR> d-------- C:\Program Files\MSXML 4.0 2008-04-19 18:51 . 2008-04-19 18:51 86 --a------ C:\WINDOWS\musicmaker.INI 2008-04-19 18:42 . 2008-04-19 18:42 <DIR> d-------- C:\Program Files\Common Files\MAGIX Shared 2008-04-19 18:29 . 2005-11-30 21:20 2,314,332 --a------ C:\WINDOWS\system32\LIBMMD.DLL 2008-04-19 18:29 . 2000-05-21 22:00 1,066,176 --a------ C:\WINDOWS\system32\mscomctl.ocx 2008-04-19 18:29 . 2000-05-21 22:00 647,872 --a------ C:\WINDOWS\system32\mscomct2.ocx 2008-04-19 18:29 . 1998-06-23 22:00 609,584 --a------ C:\WINDOWS\system32\comctl32.ocx 2008-04-19 18:29 . 2000-05-22 15:58 115,920 --a------ C:\WINDOWS\system32\msinet.ocx 2008-04-17 16:06 . 2008-04-17 16:06 <DIR> d-------- C:\VideoOutput 2008-04-16 20:53 . 2008-02-22 02:33 69,632 --a------ C:\WINDOWS\system32\javacpl.cpl 2008-04-16 20:52 . 2008-04-16 20:53 <DIR> d-------- C:\Program Files\Java 2008-04-16 20:51 . 2008-04-16 20:51 <DIR> d-------- C:\Program Files\Common Files\Java 2008-04-15 20:41 . 2008-04-24 20:26 <DIR> d-------- C:\Program Files\DivX 2008-04-14 20:16 . 2008-04-14 20:16 <DIR> d-------- C:\Program Files\DAEMON Tools Lite 2008-04-14 20:13 . 2008-04-14 20:13 <DIR> d-------- C:\Documents and Settings\Administrator\Dane aplikacji\DAEMON Tools 2008-04-14 20:13 . 2008-04-14 20:13 716,272 --a------ C:\WINDOWS\system32\drivers\sptd.sys 2008-04-13 10:00 . 2008-04-13 10:00 <DIR> d-------- C:\Program Files\Common Files\Adobe 2008-04-11 21:24 . 2008-04-19 18:53 <DIR> d-------- C:\Program Files\MP3Producer 2008-04-11 21:24 . 2008-04-11 21:24 8 --a------ C:\WINDOWS\system32\ntP2.trk 2008-04-11 21:01 . 2008-04-11 21:01 <DIR> d-------- C:\Documents and Settings\Administrator\Dane aplikacji\COWON 2008-04-11 21:00 . 2008-04-27 17:48 <DIR> d-------- C:\Program Files\JetAudio 2008-04-11 21:00 . 2008-04-11 21:00 <DIR> d-------- C:\Program Files\Common Files\COWON 2008-04-10 21:22 . 2008-04-10 21:22 <DIR> d-------- C:\spoolerlogs 2008-04-10 08:09 . 2008-04-10 08:09 <DIR> d-------- C:\Program Files\Hewlett-Packard 2008-04-10 08:09 . 2008-04-10 08:09 <DIR> d-------- C:\Program Files\Common Files\Hewlett-Packard 2008-04-10 08:09 . 2006-04-10 14:03 38,400 --a------ C:\WINDOWS\system32\hpz3l054.dll 2008-04-10 08:08 . 2008-04-10 08:08 <DIR> d-------- C:\Program Files\HP 2008-04-10 08:08 . 2006-03-03 21:03 282,680 --a------ C:\WINDOWS\system32\HPZidr12.dll 2008-04-10 08:08 . 2006-03-03 21:02 204,800 --a------ C:\WINDOWS\system32\HPZipr12.dll 2008-04-10 08:08 . 2006-03-03 21:02 94,208 --a------ C:\WINDOWS\system32\HPZipt12.dll 2008-04-10 08:08 . 2006-03-03 21:03 69,632 --a------ C:\WINDOWS\system32\HPZipm12.exe 2008-04-10 08:08 . 2006-03-03 21:03 65,536 --a------ C:\WINDOWS\system32\HPZinw12.exe 2008-04-10 08:08 . 2006-03-03 21:02 57,344 --a------ C:\WINDOWS\system32\HPZisn12.dll 2008-04-10 08:08 . 2004-08-03 22:58 15,104 --a------ C:\WINDOWS\system32\drivers\usbscan.sys 2008-04-10 08:08 . 2004-08-03 22:58 15,104 --a--c--- C:\WINDOWS\system32\dllcache\usbscan.sys 2008-04-10 07:58 . 2004-08-03 23:01 25,856 --a------ C:\WINDOWS\system32\drivers\usbprint.sys 2008-04-10 07:58 . 2004-08-03 23:01 25,856 --a--c--- C:\WINDOWS\system32\dllcache\usbprint.sys 2008-04-09 19:18 . 2008-04-09 19:18 <DIR> d-------- C:\Documents and Settings\Administrator\Dane aplikacji\Media Player Classic 2008-04-09 19:17 . 2008-04-09 19:17 <DIR> d-------- C:\Program Files\Real Alternative 2008-04-07 17:03 . 2008-04-07 17:03 <DIR> d-------- C:\Program Files\Winamp Toolbar 2008-04-07 17:03 . 2008-04-07 17:03 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Winamp Toolbar 2008-04-07 17:03 . 2008-04-07 17:05 <DIR> d-------- C:\Documents and Settings\Administrator\Dane aplikacji\Winamp 2008-04-06 20:19 . 2004-08-03 23:08 26,496 --a--c--- C:\WINDOWS\system32\dllcache\usbstor.sys 2008-04-06 14:40 . 2008-04-18 20:13 69 --a------ C:\WINDOWS\NeroDigital.ini 2008-04-06 14:05 . 2008-04-06 14:05 <DIR> d-------- C:\Documents and Settings\Administrator\Dane aplikacji\Nero 2008-04-06 14:04 . 2008-04-20 13:33 <DIR> d-------- C:\Program Files\Nero 2008-04-06 14:04 . 2008-04-06 14:04 <DIR> d-------- C:\Program Files\Common Files\Nero 2008-04-06 14:04 . 2008-04-06 14:04 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Nero 2008-04-06 14:04 . 2006-03-17 11:45 1,757,184 --a------ C:\WINDOWS\system32\imagX7.dll 2008-04-06 14:04 . 2006-03-17 11:45 802,816 --a------ C:\WINDOWS\system32\imagXRA7.dll 2008-04-06 14:04 . 2006-03-17 11:45 497,296 --a------ C:\WINDOWS\system32\imagXpr7.dll 2008-04-06 14:04 . 2006-03-17 14:49 368,640 --a------ C:\WINDOWS\system32\TwnLib4.dll 2008-04-06 14:04 . 2006-03-17 11:45 258,048 --a------ C:\WINDOWS\system32\imagXR7.dll 2008-04-04 23:00 . 2008-04-09 20:23 <DIR> d--h----- C:\WINDOWS\$hf_mig$ 2008-04-04 09:58 . 2008-04-07 17:04 <DIR> d-------- C:\Program Files\Winamp 2008-04-04 09:56 . 2006-06-01 20:49 163,840 -----c--- C:\WINDOWS\system32\dllcache\jgdw400.dll 2008-04-04 09:56 . 2006-06-01 20:49 27,648 -----c--- C:\WINDOWS\system32\dllcache\jgpl400.dll 2008-04-03 20:08 . 2008-04-03 20:08 <DIR> d-------- C:\Program Files\ffdshow 2008-04-03 20:08 . 2006-12-10 22:32 499,712 --a------ C:\WINDOWS\system32\msvcp71.dll 2008-04-03 20:08 . 2006-12-10 22:32 348,160 --a------ C:\WINDOWS\system32\msvcr71.dll 2008-04-03 20:08 . 2007-04-24 16:30 60,273 --a------ C:\WINDOWS\system32\pthreadGC2.dll 2008-04-03 20:08 . 2008-03-04 12:33 7,680 --a------ C:\WINDOWS\system32\ff_vfw.dll 2008-04-03 20:08 . 2007-07-10 17:10 547 --a------ C:\WINDOWS\system32\ff_vfw.dll.manifest 2008-04-03 19:58 . 2008-04-03 20:09 <DIR> d-------- C:\Documents and Settings\Administrator\Dane aplikacji\BESTplayer 2008-03-31 20:58 . 2008-04-19 09:48 <DIR> d-------- C:\MU 2008-03-31 20:56 . 2008-04-05 21:07 2,611 --a------ C:\WINDOWS\sql.MIF 2008-03-31 20:55 . 2008-03-31 20:55 <DIR> d-------- C:\Program Files\Microsoft SQL Server 2008-03-31 20:55 . 1997-07-19 17:01 376,592 --a------ C:\WINDOWS\system32\msrdo20.dll 2008-03-31 20:55 . 2000-08-06 01:51 274,489 --a------ C:\WINDOWS\system32\ntwdblib.dll 2008-03-31 20:55 . 2000-08-06 01:51 192,569 --a------ C:\WINDOWS\system32\msrpjt40.dll 2008-03-31 20:55 . 2001-03-13 11:49 120,320 --a------ C:\WINDOWS\system32\comdlg32.ocx 2008-03-31 20:55 . 1997-01-13 10:49 97,552 --a------ C:\WINDOWS\system32\rdocurs.dll 2008-03-31 20:55 . 2000-08-06 01:51 32,830 --a------ C:\WINDOWS\system32\dbmsshrn.dll 2008-03-31 20:53 . 2008-04-28 14:12 <DIR> d-------- C:\WINDOWS\system32\Lang 2008-03-31 20:53 . 2008-03-31 20:53 940,794 --a------ C:\WINDOWS\system32\LoopyMusic.wav 2008-03-31 20:53 . 2008-03-31 20:53 146,650 --a------ C:\WINDOWS\system32\BuzzingBee.wav 2008-03-31 20:50 . 2008-03-31 20:50 <DIR> d-------- C:\Program Files\GIGABYTE 2008-03-31 20:50 . 2008-03-31 20:50 <DIR> d-------- C:\Program Files\BroadCom GB LAN 2008-03-31 20:49 . 2008-03-31 20:50 <DIR> d-------- C:\WINDOWS\system32\RTCOM 2008-03-31 20:49 . 2008-03-31 20:49 <DIR> d-------- C:\Program Files\Realtek 2008-03-31 20:46 . 2008-03-31 20:46 169 --a------ C:\WINDOWS\RtlRack.ini 2008-03-31 20:44 . 2005-06-28 10:21 22,752 --a------ C:\WINDOWS\system32\spupdsvc.exe 2008-03-31 20:42 . 2008-03-31 20:42 <DIR> d-------- C:\Program Files\Realtek Sound Manager 2008-03-31 20:42 . 2008-03-31 20:42 <DIR> d-------- C:\Program Files\AvRack 2008-03-31 20:42 . 2005-05-18 09:15 9,389,568 -r------- C:\WINDOWS\system32\RTLCPL.exe 2008-03-31 20:42 . 2005-05-18 11:50 2,319,680 -r------- C:\WINDOWS\system32\drivers\alcxwdm.sys 2008-03-31 20:42 . 2002-02-05 07:54 141,016 -r------- C:\WINDOWS\system32\alsndmgr.wav 2008-03-31 20:42 . 2005-09-21 04:24 86,016 -r------- C:\WINDOWS\SoundMan.exe 2008-03-31 20:42 . 2005-07-15 10:48 40,960 -r------- C:\WINDOWS\system32\ChCfg.exe 2008-03-31 20:42 . 2001-07-05 18:19 164 -r------- C:\WINDOWS\avrack.ini 2008-03-31 20:41 . 2008-04-14 22:01 <DIR> d--h----- C:\Program Files\InstallShield Installation Information 2008-03-31 20:41 . 2005-09-21 04:25 299,008 -r------- C:\WINDOWS\system32\ALSndMgr.Cpl 2008-03-31 20:41 . 2005-02-03 09:13 294,912 -r------- C:\WINDOWS\alcupd.exe 2008-03-31 20:41 . 2005-03-02 14:21 200,704 -r------- C:\WINDOWS\alcrmv.exe . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-03-31 17:33 --------- d-----w C:\Program Files\microsoft frontpage 2008-03-31 17:32 --------- d-----w C:\Program Files\Usługi online 2008-03-21 20:30 200,704 ----a-w C:\WINDOWS\system32\ssldivx.dll 2008-03-21 20:30 1,044,480 ----a-w C:\WINDOWS\system32\libdivx.dll 2008-03-20 08:09 1,845,504 ----a-w C:\WINDOWS\system32\win32k.sys 2008-02-20 06:51 282,624 ----a-w C:\WINDOWS\system32\gdi32.dll 2008-02-20 05:38 45,568 ----a-w C:\WINDOWS\system32\dnsrslvr.dll 2008-02-16 09:05 662,016 ----a-w C:\WINDOWS\system32\wininet.dll . (((((((((((((((((((((((((((((((((((((((((((( Look ))))))))))))))))))))))))))))))))))))))))))))))))))))))))) . ---- Directory of C:\setups ---- 2008-04-26 11:34 14929401 --a------ C:\setups\Chilli's OTS.rar 2008-04-26 11:27 152638 --a------ C:\setups\setup.exe 2008-04-26 11:27 14806255 --a------ C:\setups\disk1.pak ((((((((((((((((((((((((((((( snapshot@2008-04-27_13.52.40,56 ))))))))))))))))))))))))))))))))))))))))) . - 2008-04-27 05:42:55 2,048 --s-a-w C:\WINDOWS\bootstat.dat + 2008-04-28 12:11:50 2,048 --s-a-w C:\WINDOWS\bootstat.dat + 2001-10-26 19:29:54 99,840 ----a-w C:\WINDOWS\pchealth\helpctr\binaries\He|pHoOt.exe + 2008-04-28 12:24:48 79,760 ----a-w C:\WINDOWS\system32\drivers\inspect.sys . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{25CEE8EC-5730-41bc-8B58-22DDC8AB8C20}] 2008-03-20 00:36 1267040 --a------ C:\Program Files\Winamp Toolbar\winamptb.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar] "{EBF2BA02-9094-4C5A-858B-BB198F3D8DE2}"= "C:\Program Files\Winamp Toolbar\winamptb.dll" [2008-03-20 00:36 1267040] [HKEY_CLASSES_ROOT\clsid\{ebf2ba02-9094-4c5a-858b-bb198f3d8de2}] [HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand.1] [HKEY_CLASSES_ROOT\TypeLib\{538CD77C-BFDD-49b0-9562-77419CAB89D1}] [HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand] [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser] "{EBF2BA02-9094-4C5A-858B-BB198F3D8DE2}"= C:\Program Files\Winamp Toolbar\winamptb.dll [2008-03-20 00:36 1267040] [HKEY_CLASSES_ROOT\clsid\{ebf2ba02-9094-4c5a-858b-bb198f3d8de2}] [HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand.1] [HKEY_CLASSES_ROOT\TypeLib\{538CD77C-BFDD-49b0-9562-77419CAB89D1}] [HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:44 15360] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "RTHDCPL"="RTHDCPL.EXE" [2005-09-22 07:36 14854144 C:\WINDOWS\RTHDCPL.exe] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 04:25 144784] "egui"="C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" [2008-03-13 16:48 1443072] "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-12-05 01:41 8523776] "COMODO Firewall Pro"="C:\Program Files\COMODO\Firewall\cfp.exe" [2008-04-28 14:24 1572608] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 00:44 15360] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "AppInit_DLLs"= C:\WINDOWS\system32\guard32.dll [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher] --a------ 2008-01-11 22:16 39792 C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite] --a------ 2008-02-14 01:09 486856 C:\PROGRA~1\DAEMON~1\daemon.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck] C:\WINDOWS\system32\dumprep 0 -k [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon] --a------ 2007-12-05 01:41 8523776 C:\WINDOWS\system32\NvCpl.dll [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter] --a------ 2007-12-05 01:41 81920 C:\WINDOWS\system32\NvMcTray.dll [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz] --a------ 2007-12-05 01:41 1626112 C:\WINDOWS\system32\nwiz.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent] C:\Program Files\Winamp\winampa.exe [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "C:\\Program Files\\uTorrent\\uTorrent.exe"= "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"= "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"= "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"= R0 iteraid;ITERAID_Service_Install;C:\WINDOWS\system32\DRIVERS\iteraid.sys [2004-10-29 11:21] . ************************************************************************** catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-04-28 14:28:48 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2008-04-28 14:29:09 ComboFix-quarantined-files.txt 2008-04-28 12:29:07 ComboFix2.txt 2008-04-27 11:52:49 Pre-Run: 12,193,112,064 bajtów wolnych Post-Run: 12,197,519,360 bajtów wolnych 238 --- E O F --- 2008-04-20 11:21:11

Ten firewall jak skanuje to mi wszystkie .exe wpisuje jako malware

**Posty:** 18165 · przez **wojtas** 28 Kwi 2008, 16:55

zastosuj to:

http://www.sophos.com/support/disinfection/jeefoa.html

i poczytaj i wykonaj te instrukcje:

http://www.searchengines.pl/index.php?showtopic=7469

**Posty:** 1239 · przez **mati43** 28 Kwi 2008, 20:43

dziwne nic nie znalazło

Aplikacje wciąż nie chodzą ;(

**Posty:** 18165 · przez **wojtas** 28 Kwi 2008, 20:59

sadze ze bez formata sie nie obejdzie niestety... musisz sformatowac wszyskie zarazone partycje.. oczywiscie muze, filmy, zdjecia mozesz sobie na plytke nagrac

Autor postu otrzymał pochwałę

**Posty:** 1239 · przez **mati43** 29 Kwi 2008, 07:53

No to trudno

Dzięki za pomoc ;]

aplikacje nie działają

Aplikacje nie działają

Kto jest na forum