Bardzo wolny komputer,zawiesza się nawet pisanie tego tematu

**Posty:** 24 · przez **dunhill** 29 Wrz 2008, 00:01

komputer ogólnie zamulony, zawiesza się. Jak włączę muzykę to rwie strasznie jak bym słuchał z internetu na słabym łączu. System uruchamia się bardzo długo. Zawiesza mi się nawet pisanie tego posta.

Skanowałem kompa antywirusem ESET smart security, CCliner, odkurzacz, ATF-cleaner, FixIEDef, Reg cleaner... Nie pomogło..
combofix nie chce mi zrobić loga ale zamieszczam z Hijack'a

Bardzo proszę o sprawdzenie logów.

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 23:19, on 08-09-28 Platform: Windows XP Dodatek SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\Ati2evxx.exe C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\WINDOWS\system32\CTsvcCDA.exe C:\Program Files\Creative\Shared Files\CTDevSrv.exe C:\Program Files\ESET\ESET Smart Security\ekrn.exe C:\Program Files\Autodesk\3ds Max 9\mentalray\satellite\raysat_3dsmax9_32server.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe C:\Program Files\Toshiba\Windows Utilities\Hotkey.exe C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe C:\Program Files\ESET\ESET Smart Security\egui.exe C:\Program Files\Creative\Creative Media Lite\CTZDetec.exe C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Ares\Ares.exe C:\Program Files\Gadu-Gadu\gg.exe C:\WINDOWS\explorer.exe C:\Documents and Settings\Administrator\Pulpit\HiJackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.pl/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza R3 - URLSearchHook: (no name) - {0579B4B6-0293-4d73-B02D-5EBB0BA0F0A2} - C:\Program Files\AskSBar\SrchAstt\1.bin\A2SRCHAS.DLL R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file) O2 - BHO: Ask Search Assistant BHO - {0579B4B1-0293-4d73-B02D-5EBB0BA0F0A2} - C:\Program Files\AskSBar\SrchAstt\1.bin\A2SRCHAS.DLL O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: Ofb1 - {3E1500AC-87A5-416b-A211-82E848649DA9} - (no file) O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: (no name) - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - (no file) O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O2 - BHO: Ask Toolbar BHO - {F0D4B231-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\AskSBar\bar\1.bin\ASKSBAR.DLL O3 - Toolbar: (no name) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - (no file) O3 - Toolbar: Ask Toolbar - {F0D4B239-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\AskSBar\bar\1.bin\ASKSBAR.DLL O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" O4 - HKLM\..\Run: [Toshiba Hotkey Utility] "C:\Program Files\Toshiba\Windows Utilities\Hotkey.exe" /lang PL O4 - HKLM\..\Run: [ISUSPM Startup] "C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" -startup O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [OpwareSE2] "C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe" O4 - HKLM\..\Run: [NeroFilterCheck] "C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET Smart Security\egui.exe" /hide /waitservice O4 - HKCU\..\Run: [CTZDetec.exe] "C:\Program Files\Creative\Creative Media Lite\CTZDetec.exe" O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [ares] "C:\Program Files\Ares\Ares.exe" -h O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: Ares Chatroom server (AresChatServer) - Ares Development Group - C:\Program Files\Ares\chatServer.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe O23 - Service: CT Device Query service (CTDevice_Srv) - Creative Technology Ltd - C:\Program Files\Creative\Shared Files\CTDevSrv.exe O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET Smart Security\ekrn.exe O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe O23 - Service: mental ray 3.5 Satellite (32-bit) (mi-raysat_3dsmax9_32) - Unknown owner - C:\Program Files\Autodesk\3ds Max 9\mentalray\satellite\raysat_3dsmax9_32server.exe O23 - Service: SolidWorks Licensing Service - SolidWorks - C:\Program Files\Common Files\SolidWorks Shared\Service\SolidWorksLicensing.exe -- End of file - 7477 bytes

**Posty:** 7956 · przez **Magik** 29 Wrz 2008, 01:02

w HJT wtrybie awaryjnym na fix:

Kod: Zaznacz wszystko: R3 - URLSearchHook: (no name) - {0579B4B6-0293-4d73-B02D-5EBB0BA0F0A2} - C:\Program Files\AskSBar\SrchAstt\1.bin\A2SRCHAS.DLL O2 - BHO: Ofb1 - {3E1500AC-87A5-416b-A211-82E848649DA9} - (no file) O2 - BHO: (no name) - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - (no file) O3 - Toolbar: (no name) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - (no file)

jako ze juz widac 'searchassistant' log z combofix'a ino chyzio

Zastosuj SDFix . Po pobraniu uruchom go a rozpakuje się do C:\SDFix. Uruchom komputer w trybie awaryjnym (F8 przy stracie systemu). Będąc w awaryjnym uruchom plik RunThis.bat z folderu SDFixa. Zatwierdź czyszczenie przez Y. Poczekaj aż ukończy i komputer zresetuje

Potem wejdz do folderu C:\SDFix wrzuc zawartość pliku Report.txt

nastepnie
http://forum.programosy.pl/program-szukajacy-trojanow-i-malware-vt97108.html

i sprobuj odpalic combo

**Posty:** 24 · przez **dunhill** 29 Wrz 2008, 15:37

ok wykonałem polecenia. Jednak mam dodatkowy problem. Mianowicie komp nie chce mi się uruchomić w normalnym trybie. Tzn. wygląda na to, że się uruchamia normalnie ale nie obsługuje sieci. Czyli tak jakby ciągle był w awaryjnym. Udało mi się jedynie uruchomić go w trybie awaryjnym z obsługą sieci.
Wygląda to tak, że po zrobieniu logów zmienił mi się nawet wygląd pulpitu na taki jak w Win98. Przy czym przy uruchamianiu zaznaczam opcję uruchom normalnie - więc nie bardzo rozumiem co się dzieje. Aha i to wygląda na to że Combofix coś nabroił bo on zmienia godzinę podczas skanowania. i u mnie jest teraz 00:26

dodaje logi i raporty po wykonanych poleceniach.

log HJT

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 13:59, on 08-09-29 Platform: Windows XP Dodatek SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512) Boot mode: Safe mode Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\Explorer.EXE C:\Documents and Settings\Administrator\Pulpit\HiJackThis.exe C:\WINDOWS\system32\NOTEPAD.EXE R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.pl/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file) O2 - BHO: Ask Search Assistant BHO - {0579B4B1-0293-4d73-B02D-5EBB0BA0F0A2} - C:\Program Files\AskSBar\SrchAstt\1.bin\A2SRCHAS.DLL O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O2 - BHO: Ask Toolbar BHO - {F0D4B231-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\AskSBar\bar\1.bin\ASKSBAR.DLL O3 - Toolbar: Ask Toolbar - {F0D4B239-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\AskSBar\bar\1.bin\ASKSBAR.DLL O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" O4 - HKLM\..\Run: [Toshiba Hotkey Utility] "C:\Program Files\Toshiba\Windows Utilities\Hotkey.exe" /lang PL O4 - HKLM\..\Run: [ISUSPM Startup] "C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" -startup O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [OpwareSE2] "C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe" O4 - HKLM\..\Run: [NeroFilterCheck] "C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET Smart Security\egui.exe" /hide /waitservice O4 - HKCU\..\Run: [CTZDetec.exe] "C:\Program Files\Creative\Creative Media Lite\CTZDetec.exe" O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [ares] "C:\Program Files\Ares\Ares.exe" -h O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: Ares Chatroom server (AresChatServer) - Ares Development Group - C:\Program Files\Ares\chatServer.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe O23 - Service: CT Device Query service (CTDevice_Srv) - Creative Technology Ltd - C:\Program Files\Creative\Shared Files\CTDevSrv.exe O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET Smart Security\ekrn.exe O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe O23 - Service: mental ray 3.5 Satellite (32-bit) (mi-raysat_3dsmax9_32) - Unknown owner - C:\Program Files\Autodesk\3ds Max 9\mentalray\satellite\raysat_3dsmax9_32server.exe O23 - Service: SolidWorks Licensing Service - SolidWorks - C:\Program Files\Common Files\SolidWorks Shared\Service\SolidWorksLicensing.exe -- End of file - 6199 bytes

raport SDFixed

Kod: Zaznacz wszystko: [b]SDFix: Version 1.230 [/b] Run by Administrator on 08-09-29 at 14:05 Microsoft Windows XP [Wersja 5.1.2600] Running From: C:\SDFix [b]Checking Services [/b]: Restoring Default Security Values Restoring Default Hosts File Rebooting [b]Checking Files [/b]: No Trojan Files Found Removing Temp Files [b]ADS Check [/b]: [b]Final Check [/b]: catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-09-29 14:16:22 Windows 5.1.2600 Dodatek Service Pack 3 NTFS scanning hidden processes ... scanning hidden services & system hive ... [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg] "s0"=dword:f6df915a "s1"=dword:751d975b "s2"=dword:42b50ed6 "h0"=dword:00000001 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4] "p0"="C:\Program Files\DAEMON Tools\" "h0"=dword:00000000 "khjeh"=hex:dd,2d,5a,10,e4,f4,21,91,b4,ce,8d,2a,49,67,3f,17,2a,53,0a,9d,cb,.. [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001] "a0"=hex:20,01,00,00,00,80,05,0d,81,60,27,05,28,fb,1d,75,94,bf,e1,e3,56,.. "khjeh"=hex:f8,44,88,73,b3,ee,aa,e8,1c,b7,b9,46,6b,4f,61,e7,48,13,52,f5,a9,.. [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40] "khjeh"=hex:35,d6,58,f4,13,5e,f9,ad,5e,1b,dc,d1,84,c3,d6,66,fb,88,ae,a9,5b,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4] "p0"="C:\Program Files\DAEMON Tools\" "h0"=dword:00000000 "khjeh"=hex:dd,2d,5a,10,e4,f4,21,91,b4,ce,8d,2a,49,67,3f,17,2a,53,0a,9d,cb,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001] "a0"=hex:20,01,00,00,00,80,05,0d,81,60,27,05,28,fb,1d,75,94,bf,e1,e3,56,.. "khjeh"=hex:f8,44,88,73,b3,ee,aa,e8,1c,b7,b9,46,6b,4f,61,e7,48,13,52,f5,a9,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40] "khjeh"=hex:35,d6,58,f4,13,5e,f9,ad,5e,1b,dc,d1,84,c3,d6,66,fb,88,ae,a9,5b,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4] "p0"="C:\Program Files\DAEMON Tools\" "h0"=dword:00000000 "khjeh"=hex:dd,2d,5a,10,e4,f4,21,91,b4,ce,8d,2a,49,67,3f,17,2a,53,0a,9d,cb,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001] "a0"=hex:20,01,00,00,00,80,05,0d,81,60,27,05,28,fb,1d,75,94,bf,e1,e3,56,.. "khjeh"=hex:f8,44,88,73,b3,ee,aa,e8,1c,b7,b9,46,6b,4f,61,e7,48,13,52,f5,a9,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40] "khjeh"=hex:35,d6,58,f4,13,5e,f9,ad,5e,1b,dc,d1,84,c3,d6,66,fb,88,ae,a9,5b,.. scanning hidden registry entries ... [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{E48A889C-FE5B-DC4A-DB6E-73C13860B866}] "abfbpndkokbjhaekbppabgeemkapojgckp"=hex:69,61,6a,6e,69,66,68,66,6f,63,62,67,6e,6d,69,68,6f,67,00,00 "pahbjbbdjcpjhmdkfijbeaclanicbcci"=hex:69,61,6a,6e,69,66,68,66,6f,63,62,67,6e,6d,69,68,6f,67,00,00 [HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Twain] "y\1r?ó?d?B\1o? ?d?o?m?y?[\1l?n?e?"="C:\WINDOWS\Twain_32\CNQL35\CISDS.DS" scanning hidden files ... scan completed successfully hidden processes: 0 hidden services: 0 hidden files: 0 [b]Remaining Services [/b]: Authorized Application Key Export: [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "C:\\Program Files\\Ares\\Ares.exe"="C:\\Program Files\\Ares\\Ares.exe:*:Enabled:Ares" "C:\\Program Files\\Adobe\\Acrobat 5.0\\Reader\\AcroRd32.exe"="C:\\Program Files\\Adobe\\Acrobat 5.0\\Reader\\AcroRd32.exe:*:Enabled:Acrobat Reader 5.0" "C:\\WINDOWS\\system32\\mmc.exe"="C:\\WINDOWS\\system32\\mmc.exe:*:Disabled:Microsoft Management Console" "C:\\Program Files\\Nero\\Nero 7\\Nero Home\\NeroHome.exe"="C:\\Program Files\\Nero\\Nero 7\\Nero Home\\NeroHome.exe:*:Disabled:Nero Home" "C:\\Program Files\\Bonjour\\mDNSResponder.exe"="C:\\Program Files\\Bonjour\\mDNSResponder.exe:*:Enabled:Bonjour" "C:\\Program Files\\Autodesk\\3ds Max 9\\3dsmax.exe"="C:\\Program Files\\Autodesk\\3ds Max 9\\3dsmax.exe:*:Enabled:Autodesk 3ds Max 9 32-bit" "C:\\Program Files\\Autodesk\\Backburner\\monitor.exe"="C:\\Program Files\\Autodesk\\Backburner\\monitor.exe:*:Enabled:backburner 2.3 monitor" "C:\\Program Files\\Autodesk\\Backburner\\manager.exe"="C:\\Program Files\\Autodesk\\Backburner\\manager.exe:*:Enabled:backburner 2.3 manager" "C:\\Program Files\\Autodesk\\Backburner\\server.exe"="C:\\Program Files\\Autodesk\\Backburner\\server.exe:*:Enabled:backburner 2.3 server" "C:\\Program Files\\DNA\\btdna.exe"="C:\\Program Files\\DNA\\btdna.exe:*:Enabled:DNA" "%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000" [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list] "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000" [b]Remaining Files [/b]: [b]Files with Hidden Attributes [/b]: Fri 17 Aug 2001 24,448 A.SHR --- "C:\NTBOOTDD.SYS" Mon 13 Mar 2006 560,640 A.SH. --- "C:\Program Files\Cell Phone Manager\MobCfg.dll" Sat 11 Mar 2006 615,424 A.SH. --- "C:\Program Files\Cell Phone Manager\MobSvr.exe" Mon 7 Jul 2008 1,429,840 A.SHR --- "C:\Program Files\Spybot - Search & Destroy\SDUpdate.exe" Mon 7 Jul 2008 4,891,472 A.SHR --- "C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe" Mon 7 Jul 2008 2,156,368 A.SHR --- "C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" Fri 23 May 2008 848 A.SH. --- "C:\WINDOWS\system32\KGyGaAvL.sys" [b]Finished![/b]

raport FixIEDef

Kod: Zaznacz wszystko: ******************************************************************************** * * * FixIEDef Log * * Version 1.5.1.6012 * * * ******************************************************************************** Created at 14:29:18 on Monday, September 29, 2008 Time Zone : Logged On User : Administrator Operating System : Microsoft Windows XP Professional Dodatek Service Pack 3 OS Version : 5.1.2600 System Langauge : Polish Keyboard Layout : Polish Processor : X86 Intel(R) Celeron(R) M processor 1.60GHz System Drive : C:\ Windows Directory : C:\WINDOWS System Directory : C:\WINDOWS\system32 Total Physical Memory : 1964184 KB Free Physical Memory : 1599164 KB Total Virtual Memory : 2097024 KB Free Virtual Memory : 2018520 KB Boot State : Normal boot -------------------------------------------------------------------------------- !!! Files that have been deleted !!! C:\autorun.inf -------------------------------------------------------------------------------- !!! Directories that have been removed !!! No malicious directories to be removed -------------------------------------------------------------------------------- !!! Registry entries that have been removed !!! No malicious Registry entries found ================================================================================ All Done :) ShadowPuterDude Safe Surfing!!!

log Combofix

Kod: Zaznacz wszystko: ComboFix 08-09-27.06 - Administrator 2008-09-29 14:44:03.8 - NTFSx86 MINIMAL Microsoft Windows XP Professional 5.1.2600.3.1250.1.1045.18.1539 [GMT 2:00] Uruchomiony z: C:\Documents and Settings\Administrator\Pulpit\ComboFix.exe [color=red][b]UWAGA - TEN KOMPUTER NIE MA ZAINSTALOWANEJ KONSOLI ODZYSKIWANIA !![/b][/color] . ((((((((((((((((((((((((( Pliki utworzone od 2008-08-28 do 2008-09-29 ))))))))))))))))))))))))))))))) . 2008-09-29 14:03 . 2008-09-29 14:03 580,096 --a--c--- C:\WINDOWS\system32\dllcache\user32.dll 2008-09-29 13:47 . 2008-09-29 14:24 <DIR> d-------- C:\SDFix 2008-09-27 22:41 . 2008-09-27 22:41 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Avg8 2008-09-25 10:36 . 2008-09-25 13:25 <DIR> d--h----- C:\$AVG8.VAULT$ 2008-09-24 17:13 . 2008-09-24 17:13 <DIR> d-------- C:\Program Files\2MScreenSaver 2008-09-24 17:13 . 2003-02-26 11:20 647,168 --a------ C:\WINDOWS\2M-Woman-vol2.scr 2008-09-24 17:13 . 2008-09-24 17:13 99 --a------ C:\WINDOWS\2M-Woman-vol2.ini 2008-09-24 17:13 . 2008-09-24 17:13 70 --a------ C:\WINDOWS\FSaver.ini 2008-09-24 11:41 . 2008-09-24 11:41 <DIR> d-------- C:\WINDOWS\system32\pl 2008-09-24 11:41 . 2008-09-24 11:41 <DIR> d-------- C:\WINDOWS\system32\bits 2008-09-24 11:36 . 2008-09-24 11:36 <DIR> d-------- C:\WINDOWS\ServicePackFiles 2008-09-16 20:12 . 2004-07-17 11:36 184,137 -----c--- C:\WINDOWS\system32\dllcache\compact.wmz 2008-09-16 20:12 . 2001-10-26 17:48 9,585 -----c--- C:\WINDOWS\system32\dllcache\controls.css 2008-09-16 20:12 . 2001-10-26 17:48 5,971 -----c--- C:\WINDOWS\system32\dllcache\events.js 2008-09-16 20:12 . 2001-10-26 17:48 999 -----c--- C:\WINDOWS\system32\dllcache\bktrh.gif 2008-09-16 20:12 . 2001-10-26 17:48 773 -----c--- C:\WINDOWS\system32\dllcache\cnth.gif 2008-09-16 20:12 . 2001-10-26 17:48 773 -----c--- C:\WINDOWS\system32\dllcache\cnt.gif 2008-09-16 20:12 . 2001-10-26 17:48 772 -----c--- C:\WINDOWS\system32\dllcache\cntd.gif 2008-09-16 20:12 . 2001-10-26 17:48 760 -----c--- C:\WINDOWS\system32\dllcache\cloapph.gif 2008-09-16 20:12 . 2001-10-26 17:48 717 -----c--- C:\WINDOWS\system32\dllcache\cloapp.gif 2008-09-13 01:00 . 2008-09-13 01:00 <DIR> d-------- C:\Program Files\Real Alternative 2008-09-12 22:24 . 2008-09-12 22:29 <DIR> d-------- C:\Documents and Settings\Administrator\Dane aplikacji\BESTplayer 2008-09-12 22:18 . 2008-09-12 22:21 <DIR> d-------- C:\Program Files\K-Lite Codec Pack . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-09-28 20:22 --------- d-----w C:\Documents and Settings\Administrator\Dane aplikacji\uTorrent 2008-09-28 20:22 --------- d-----w C:\Documents and Settings\Administrator\Dane aplikacji\SolidWorks 2008-09-28 20:22 --------- d-----w C:\Documents and Settings\Administrator\Dane aplikacji\DNA 2008-09-28 19:39 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-09-28 19:39 --------- d-----w C:\Program Files\PhotomatixPro3 2008-09-27 23:10 --------- d-----w C:\Program Files\Winamp 2008-09-24 21:54 --------- d-----w C:\Program Files\Gadu-Gadu 2008-09-24 20:24 --------- d-----w C:\Program Files\Cell Phone Manager 2008-09-24 10:12 --------- d-----w C:\Program Files\ESET 2008-09-24 10:01 96,384 ----a-w C:\WINDOWS\system32\drivers\sptd6141.sys 2008-08-30 09:39 --------- d-----w C:\Program Files\DNA 2008-08-14 02:02 --------- d-----w C:\Program Files\nQuake 2008-08-04 21:42 --------- d-----w C:\Documents and Settings\Administrator\Dane aplikacji\Winamp 2008-07-25 08:34 81,920 ----a-w C:\WINDOWS\system32\dpl100.dll 2008-07-25 08:34 683,520 ----a-w C:\WINDOWS\system32\divx.dll 2008-07-23 16:50 3,596,288 ----a-w C:\WINDOWS\system32\qt-dx331.dll 2008-07-23 12:53 728,576 ----a-w C:\WINDOWS\MSBLT.EXE 2008-07-22 09:48 160 ----a-w C:\install.dat 2008-07-21 20:37 25,991 ----a-w C:\WINDOWS\system32\epfwdata.bin 2008-07-19 23:07 728,576 ----a-w C:\WINDOWS\ rpl.exe 2008-07-18 20:10 94,920 ----a-w C:\WINDOWS\system32\cdm.dll 2008-07-18 20:10 53,448 ----a-w C:\WINDOWS\system32\wuauclt.exe 2008-07-18 20:10 45,768 ----a-w C:\WINDOWS\system32\wups2.dll 2008-07-18 20:10 36,552 ----a-w C:\WINDOWS\system32\wups.dll 2008-07-18 20:09 563,912 ----a-w C:\WINDOWS\system32\wuapi.dll 2008-07-18 20:09 325,832 ----a-w C:\WINDOWS\system32\wucltui.dll 2008-07-18 20:09 205,000 ----a-w C:\WINDOWS\system32\wuweb.dll 2008-07-18 20:09 1,811,656 ----a-w C:\WINDOWS\system32\wuaueng.dll 2008-07-10 11:53 20 ---h--w C:\Documents and Settings\All Users\Dane aplikacji\PKP_DLbz.DAT 2008-07-07 20:29 253,952 ----a-w C:\WINDOWS\system32\es.dll 2008-05-02 11:21 36 ----a-w C:\Documents and Settings\Administrator\klextlock.dat 2008-04-13 21:54 20 ---h--w C:\Documents and Settings\All Users\Dane aplikacji\PKP_DLec.DAT 2008-05-22 23:27 848 --sha-w C:\WINDOWS\system32\KGyGaAvL.sys . ((((((((((((((((((((((((((((( snapshot@2008-09-29_ 1.58.21.40 ))))))))))))))))))))))))))))))))))))))))) . - 2008-07-20 12:35:20 163,328 ----a-w C:\WINDOWS\ERUNT\SDFIX\ERDNT.EXE + 2008-08-07 14:27:04 163,328 ----a-w C:\WINDOWS\ERUNT\SDFIX\ERDNT.EXE - 2008-07-23 11:19:55 5,173,248 ----a-w C:\WINDOWS\ERUNT\SDFIX\Users\[u]0[/u]0000001\NTUSER.DAT + 2008-09-29 12:01:11 5,369,856 ----a-w C:\WINDOWS\ERUNT\SDFIX\Users\[u]0[/u]0000001\NTUSER.DAT - 2008-07-23 11:19:55 417,792 ----a-w C:\WINDOWS\ERUNT\SDFIX\Users\[u]0[/u]0000002\UsrClass.dat + 2008-09-29 12:01:12 421,888 ----a-w C:\WINDOWS\ERUNT\SDFIX\Users\[u]0[/u]0000002\UsrClass.dat . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks] "{0579B4B6-0293-4d73-B02D-5EBB0BA0F0A2}"= "C:\Program Files\AskSBar\SrchAstt\1.bin\A2SRCHAS.DLL" [2008-07-22 66912] [HKEY_CLASSES_ROOT\clsid\{0579b4b6-0293-4d73-b02d-5ebb0ba0f0a2}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{0579B4B1-0293-4d73-B02D-5EBB0BA0F0A2}] 2008-07-22 11:49 66912 --a------ C:\Program Files\AskSBar\SrchAstt\1.bin\A2SRCHAS.DLL [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTZDetec.exe"="C:\Program Files\Creative\Creative Media Lite\CTZDetec.exe" [2007-05-15 98304] "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2006-04-21 94208] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2008-04-14 15360] "ares"="C:\Program Files\Ares\Ares.exe" [2007-05-04 961024] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-06-28 344064] "Toshiba Hotkey Utility"="C:\Program Files\Toshiba\Windows Utilities\Hotkey.exe" [2005-08-01 1093632] "ISUSPM Startup"="C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" [2005-08-11 249856] "ISUSScheduler"="C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [2005-08-11 81920] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784] "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792] "OpwareSE2"="C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe" [2003-05-08 49152] "NeroFilterCheck"="C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-12 155648] "egui"="C:\Program Files\ESET\ESET Smart Security\egui.exe" [2008-06-10 1447168] C:\Documents and Settings\Administrator\Menu Start\Programy\Autostart\ Adobe Gamma.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-03-16 113664] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "VIDC.YV12"= yv12vfw.dll [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WebrootSpySweeperService] @="" [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "C:\\Program Files\\Ares\\Ares.exe"= "C:\\Program Files\\Adobe\\Acrobat 5.0\\Reader\\AcroRd32.exe"= "C:\\WINDOWS\\system32\\mmc.exe"= "C:\\Program Files\\Nero\\Nero 7\\Nero Home\\NeroHome.exe"= "C:\\Program Files\\Bonjour\\mDNSResponder.exe"= "C:\\Program Files\\Autodesk\\3ds Max 9\\3dsmax.exe"= "C:\\Program Files\\Autodesk\\Backburner\\monitor.exe"= "C:\\Program Files\\Autodesk\\Backburner\\manager.exe"= "C:\\Program Files\\Autodesk\\Backburner\\server.exe"= "C:\\Program Files\\DNA\\btdna.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "1723:TCP"= 1723:TCP:@xpsp2res.dll,-22015 "1701:UDP"= 1701:UDP:@xpsp2res.dll,-22016 "500:UDP"= 500:UDP:@xpsp2res.dll,-22017 R3 qkbfiltr;Quanta HotKey Keyboard Filter Driver;C:\WINDOWS\system32\drivers\qkbfiltr.sys [2005-05-09 31360] R3 qmofiltr;Quanta HotKey Mouse Filter Driver;C:\WINDOWS\system32\drivers\qmofiltr.sys [2005-05-05 7936] S1 eusk2par;EUTRON SmartKey Parallel Driver;C:\WINDOWS\system32\Drivers\eusk2par.sys [2004-11-18 24786] S3 BoiHwsetup;Access 32bits INT15 routine;C:\WINDOWS\system32\drivers\BoiHwSetup.sys [2005-06-10 5504] . . ------- Skan uzupełniający ------- . FireFox -: Profile - C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Firefox\Profiles\7msz3ld9.default\ FireFox -: prefs.js - STARTUP.HOMEPAGE - www.google.pl FF -: plugin - C:\Program Files\DNA\plugins\npbtdna.dll FF -: plugin - C:\Program Files\Mozilla Firefox\plugins\np_gp.dll FF -: plugin - C:\Program Files\Mozilla Firefox\plugins\NPAskSBr.dll FF -: plugin - C:\Program Files\Yahoo!\Common\npyaxmpb.dll . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-09-29 14:45:34 Windows 5.1.2600 Dodatek Service Pack 3 NTFS skanowanie ukrytych procesów ... skanowanie ukrytych wpisów autostartu ... skanowanie ukrytych plików ... skanowanie pomyślnie ukończone ukryte pliki: 0 ************************************************************************** . Czas ukończenia: 2008-09-29 14:47:27 ComboFix-quarantined-files.txt 2008-09-29 12:47:18 ComboFix2.txt 2008-09-29 12:39:52 ComboFix3.txt 2008-09-29 00:01:48 ComboFix4.txt 2008-07-23 14:57:53 ComboFix5.txt 2008-09-29 12:42:56 Przed: 3 393 335 296 bajt˘w wolnych Po: 3,382,276,096 bajt˘w wolnych 160 --- E O F --- 2008-09-25 00:46:51

**Posty:** 684 · przez **djarta** 29 Wrz 2008, 16:16

Wklej do Notatnika:

Kod: Zaznacz wszystko: File:: C:\WINDOWS\MSBLT.EXE C:\WINDOWS\ rpl.exe

>>Plik>>Zapisz jako... >>> CFScript
Przeciągnij i upuść plik CFScript.txt na plik ComboFix.exe
-->

Ma się rozpocząć usuwanie. (i powstanie log).Daj ten log, który powstanie w trakcie usuwania.
Jeśli pójdzie dobrze, to: Po restarcie usuń ręcznie folder C:\Qoobox.

================================
K.

**Posty:** 24 · przez **dunhill** 29 Wrz 2008, 16:35

nie ma szans

nie da się zrobić loga z Combofixa wyskakuje Error - "check your settings"

proszę o pomoc

**Posty:** 684 · przez **djarta** 29 Wrz 2008, 18:45

dunhill napisał(a):nie ma szans

nie da się zrobić loga z Combofixa wyskakuje Error - "check your settings"

proszę o pomoc

Zmień datę o parę miesięcy wstecz!

==================================
K.

**Posty:** 24 · przez **dunhill** 29 Wrz 2008, 20:58

dobra udało się odpalić Combofixa.

Aha i taka informacja, że dźwięki już się nie wieszają. Nie działają wcale...

log z Combofixa

Kod: Zaznacz wszystko: ComboFix 08-09-28.01 - Administrator 2008-09-29 20:45:50.10 - NTFSx86 NETWORK Microsoft Windows XP Professional 5.1.2600.3.1250.1.1045.18.1641 [GMT 2:00] Uruchomiony z: C:\Documents and Settings\Administrator\Pulpit\ComboFix.exe Użyto następujących komend :: C:\Documents and Settings\Administrator\Pulpit\CFScript.txt [color=red][b]UWAGA - TEN KOMPUTER NIE MA ZAINSTALOWANEJ KONSOLI ODZYSKIWANIA !![/b][/color] FILE :: C:\WINDOWS\ rpl.exe C:\WINDOWS\MSBLT.EXE . ((((((((((((((((((((((((( Pliki utworzone od 2008-08-28 do 2008-09-29 ))))))))))))))))))))))))))))))) . 2008-09-29 14:03 . 2008-09-29 14:03 580,096 --a--c--- C:\WINDOWS\system32\dllcache\user32.dll 2008-09-29 13:47 . 2008-09-29 14:24 <DIR> d-------- C:\SDFix 2008-09-27 22:41 . 2008-09-27 22:41 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Avg8 2008-09-25 10:36 . 2008-09-25 13:25 <DIR> d--h----- C:\$AVG8.VAULT$ 2008-09-24 17:13 . 2008-09-24 17:13 <DIR> d-------- C:\Program Files\2MScreenSaver 2008-09-24 17:13 . 2003-02-26 11:20 647,168 --a------ C:\WINDOWS\2M-Woman-vol2.scr 2008-09-24 17:13 . 2008-09-24 17:13 99 --a------ C:\WINDOWS\2M-Woman-vol2.ini 2008-09-24 17:13 . 2008-09-24 17:13 70 --a------ C:\WINDOWS\FSaver.ini 2008-09-24 11:41 . 2008-09-24 11:41 <DIR> d-------- C:\WINDOWS\system32\pl 2008-09-24 11:41 . 2008-09-24 11:41 <DIR> d-------- C:\WINDOWS\system32\bits 2008-09-24 11:36 . 2008-09-24 11:36 <DIR> d-------- C:\WINDOWS\ServicePackFiles 2008-09-16 20:12 . 2004-07-17 11:36 184,137 -----c--- C:\WINDOWS\system32\dllcache\compact.wmz 2008-09-16 20:12 . 2001-10-26 17:48 9,585 -----c--- C:\WINDOWS\system32\dllcache\controls.css 2008-09-16 20:12 . 2001-10-26 17:48 5,971 -----c--- C:\WINDOWS\system32\dllcache\events.js 2008-09-16 20:12 . 2001-10-26 17:48 999 -----c--- C:\WINDOWS\system32\dllcache\bktrh.gif 2008-09-16 20:12 . 2001-10-26 17:48 773 -----c--- C:\WINDOWS\system32\dllcache\cnth.gif 2008-09-16 20:12 . 2001-10-26 17:48 773 -----c--- C:\WINDOWS\system32\dllcache\cnt.gif 2008-09-16 20:12 . 2001-10-26 17:48 772 -----c--- C:\WINDOWS\system32\dllcache\cntd.gif 2008-09-16 20:12 . 2001-10-26 17:48 760 -----c--- C:\WINDOWS\system32\dllcache\cloapph.gif 2008-09-16 20:12 . 2001-10-26 17:48 717 -----c--- C:\WINDOWS\system32\dllcache\cloapp.gif 2008-09-13 01:00 . 2008-09-13 01:00 <DIR> d-------- C:\Program Files\Real Alternative 2008-09-12 22:24 . 2008-09-12 22:29 <DIR> d-------- C:\Documents and Settings\Administrator\Dane aplikacji\BESTplayer 2008-09-12 22:18 . 2008-09-12 22:21 <DIR> d-------- C:\Program Files\K-Lite Codec Pack . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-09-28 20:22 --------- d-----w C:\Documents and Settings\Administrator\Dane aplikacji\uTorrent 2008-09-28 20:22 --------- d-----w C:\Documents and Settings\Administrator\Dane aplikacji\SolidWorks 2008-09-28 20:22 --------- d-----w C:\Documents and Settings\Administrator\Dane aplikacji\DNA 2008-09-28 19:39 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-09-28 19:39 --------- d-----w C:\Program Files\PhotomatixPro3 2008-09-27 23:10 --------- d-----w C:\Program Files\Winamp 2008-09-24 21:54 --------- d-----w C:\Program Files\Gadu-Gadu 2008-09-24 20:24 --------- d-----w C:\Program Files\Cell Phone Manager 2008-09-24 10:12 --------- d-----w C:\Program Files\ESET 2008-09-24 10:01 96,384 ----a-w C:\WINDOWS\system32\drivers\sptd6141.sys 2008-08-30 09:39 --------- d-----w C:\Program Files\DNA 2008-08-14 02:02 --------- d-----w C:\Program Files\nQuake 2008-08-04 21:42 --------- d-----w C:\Documents and Settings\Administrator\Dane aplikacji\Winamp 2008-07-25 08:34 81,920 ----a-w C:\WINDOWS\system32\dpl100.dll 2008-07-25 08:34 683,520 ----a-w C:\WINDOWS\system32\divx.dll 2008-07-23 16:50 3,596,288 ----a-w C:\WINDOWS\system32\qt-dx331.dll 2008-07-22 09:48 160 ----a-w C:\install.dat 2008-07-21 20:37 25,991 ----a-w C:\WINDOWS\system32\epfwdata.bin 2008-07-19 23:07 728,576 ----a-w C:\WINDOWS\ rpl.exe 2008-07-18 20:10 94,920 ----a-w C:\WINDOWS\system32\cdm.dll 2008-07-18 20:10 53,448 ----a-w C:\WINDOWS\system32\wuauclt.exe 2008-07-18 20:10 45,768 ----a-w C:\WINDOWS\system32\wups2.dll 2008-07-18 20:10 36,552 ----a-w C:\WINDOWS\system32\wups.dll 2008-07-18 20:09 563,912 ----a-w C:\WINDOWS\system32\wuapi.dll 2008-07-18 20:09 325,832 ----a-w C:\WINDOWS\system32\wucltui.dll 2008-07-18 20:09 205,000 ----a-w C:\WINDOWS\system32\wuweb.dll 2008-07-18 20:09 1,811,656 ----a-w C:\WINDOWS\system32\wuaueng.dll 2008-07-10 11:53 20 ---h--w C:\Documents and Settings\All Users\Dane aplikacji\PKP_DLbz.DAT 2008-07-07 20:29 253,952 ----a-w C:\WINDOWS\system32\es.dll 2008-05-02 11:21 36 ----a-w C:\Documents and Settings\Administrator\klextlock.dat 2008-04-13 21:54 20 ---h--w C:\Documents and Settings\All Users\Dane aplikacji\PKP_DLec.DAT 2008-05-22 23:27 848 --sha-w C:\WINDOWS\system32\KGyGaAvL.sys . ((((((((((((((((((((((((((((( snapshot@2008-09-29_ 1.58.21.40 ))))))))))))))))))))))))))))))))))))))))) . - 2008-07-20 12:35:20 163,328 ----a-w C:\WINDOWS\ERUNT\SDFIX\ERDNT.EXE + 2008-08-07 14:27:04 163,328 ----a-w C:\WINDOWS\ERUNT\SDFIX\ERDNT.EXE - 2008-07-23 11:19:55 5,173,248 ----a-w C:\WINDOWS\ERUNT\SDFIX\Users\[u]0[/u]0000001\NTUSER.DAT + 2008-09-29 12:01:11 5,369,856 ----a-w C:\WINDOWS\ERUNT\SDFIX\Users\[u]0[/u]0000001\NTUSER.DAT - 2008-07-23 11:19:55 417,792 ----a-w C:\WINDOWS\ERUNT\SDFIX\Users\[u]0[/u]0000002\UsrClass.dat + 2008-09-29 12:01:12 421,888 ----a-w C:\WINDOWS\ERUNT\SDFIX\Users\[u]0[/u]0000002\UsrClass.dat . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks] "{0579B4B6-0293-4d73-B02D-5EBB0BA0F0A2}"= "C:\Program Files\AskSBar\SrchAstt\1.bin\A2SRCHAS.DLL" [2008-07-22 66912] [HKEY_CLASSES_ROOT\clsid\{0579b4b6-0293-4d73-b02d-5ebb0ba0f0a2}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{0579B4B1-0293-4d73-B02D-5EBB0BA0F0A2}] 2008-07-22 11:49 66912 --a------ C:\Program Files\AskSBar\SrchAstt\1.bin\A2SRCHAS.DLL [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTZDetec.exe"="C:\Program Files\Creative\Creative Media Lite\CTZDetec.exe" [2007-05-15 98304] "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2006-04-21 94208] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2008-04-14 15360] "ares"="C:\Program Files\Ares\Ares.exe" [2007-05-04 961024] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-06-28 344064] "Toshiba Hotkey Utility"="C:\Program Files\Toshiba\Windows Utilities\Hotkey.exe" [2005-08-01 1093632] "ISUSPM Startup"="C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" [2005-08-11 249856] "ISUSScheduler"="C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [2005-08-11 81920] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784] "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792] "OpwareSE2"="C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe" [2003-05-08 49152] "NeroFilterCheck"="C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-12 155648] "egui"="C:\Program Files\ESET\ESET Smart Security\egui.exe" [2008-06-10 1447168] C:\Documents and Settings\Administrator\Menu Start\Programy\Autostart\ Adobe Gamma.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-03-16 113664] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "VIDC.YV12"= yv12vfw.dll [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WebrootSpySweeperService] @="" [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "C:\\Program Files\\Ares\\Ares.exe"= "C:\\Program Files\\Adobe\\Acrobat 5.0\\Reader\\AcroRd32.exe"= "C:\\WINDOWS\\system32\\mmc.exe"= "C:\\Program Files\\Nero\\Nero 7\\Nero Home\\NeroHome.exe"= "C:\\Program Files\\Bonjour\\mDNSResponder.exe"= "C:\\Program Files\\Autodesk\\3ds Max 9\\3dsmax.exe"= "C:\\Program Files\\Autodesk\\Backburner\\monitor.exe"= "C:\\Program Files\\Autodesk\\Backburner\\manager.exe"= "C:\\Program Files\\Autodesk\\Backburner\\server.exe"= "C:\\Program Files\\DNA\\btdna.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "1723:TCP"= 1723:TCP:@xpsp2res.dll,-22015 "1701:UDP"= 1701:UDP:@xpsp2res.dll,-22016 "500:UDP"= 500:UDP:@xpsp2res.dll,-22017 R3 qkbfiltr;Quanta HotKey Keyboard Filter Driver;C:\WINDOWS\system32\drivers\qkbfiltr.sys [2005-05-09 31360] R3 qmofiltr;Quanta HotKey Mouse Filter Driver;C:\WINDOWS\system32\drivers\qmofiltr.sys [2005-05-05 7936] S1 eusk2par;EUTRON SmartKey Parallel Driver;C:\WINDOWS\system32\Drivers\eusk2par.sys [2004-11-18 24786] S3 BoiHwsetup;Access 32bits INT15 routine;C:\WINDOWS\system32\drivers\BoiHwSetup.sys [2005-06-10 5504] . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-09-29 20:50:05 Windows 5.1.2600 Dodatek Service Pack 3 NTFS skanowanie ukrytych procesów ... skanowanie ukrytych wpisów autostartu ... skanowanie ukrytych plików ... skanowanie pomyślnie ukończone ukryte pliki: 0 ************************************************************************** . Czas ukończenia: 2008-09-29 20:53:04 ComboFix-quarantined-files.txt 2008-09-29 18:52:42 ComboFix2.txt 2008-09-29 18:12:14 ComboFix3.txt 2008-09-29 12:47:28 ComboFix4.txt 2008-09-29 12:39:52 ComboFix5.txt 2008-09-29 18:44:31 Przed: 3 381 628 928 bajt˘w wolnych Po: 3,368,984,576 bajt˘w wolnych 153 --- E O F --- 2008-09-25 00:46:51

**Posty:** 18165 · przez **wojtas** 29 Wrz 2008, 21:13

Kod: Zaznacz wszystko: R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file) O2 - BHO: Ask Search Assistant BHO - {0579B4B1-0293-4d73-B02D-5EBB0BA0F0A2} - C:\Program Files\AskSBar\SrchAstt\1.bin\A2SRCHAS.DLL O2 - BHO: Ask Toolbar BHO - {F0D4B231-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\AskSBar\bar\1.bin\ASKSBAR.DLL O3 - Toolbar: Ask Toolbar - {F0D4B239-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\[b]AskSBar[/b]\bar\1.bin\ASKSBAR.DLL

skasuj te wpisy w hijacku i pogrubiony folder wywal do kosza...

Klikasz prawym przyciskiem myszy na Mój komputer => Właściwości => Sprzęt => Menadżer urządzeń => Kontrolery IDE ATA/ATAPI => Podstawowy kanał IDE => Ustawienia zaawansowane i sprawdź czy dysk pracuje w trybie PIO czy DMA. Sprawdz tez w pomocniczym kanale IDE. Jeśli w którymś kanale jest tryb PIO to klikasz na niego PPM i Odinstaluj. Po restarcie sprawdz czy jest lepiej

**Posty:** 24 · przez **dunhill** 29 Wrz 2008, 21:34

spoko teraz już nie jest na PIO. Ale:
- ESET Smart security nie chce się załadować - wyskakuje błąd jądra

- dźwięku nie ma - "WARRNING - Cannot Access Volume Control!"

Reszta poza wyglądem jak z WINDOWS 98 jest ok. Wiem jak zmienić wygląd

dobra nie przeszkadza mi to bardzo ale mam win XP a nie ma opcji wyglądu XP. Jakoś specjalnie mi to nie przeszkadza ale jak to się stało? i czy da się przywrócić tą opcję?
i pytanie czy to normalne przy takich operacjach?
I czy mam dla pewności coś jeszcze zrobić? logi, skany itp???

Pytam bo nie wiem czy coś tam jeszcze zostało. Swoją drogą nie działa mi antyvir a WINZGROZA

nie informuje mnie że komputer jest zagrożony!
Wydaje mi się, że coś jest nie tak skoro tyle dziwnych rzeczy się nadal dzieje.