bład drwatson przy starcie windy

[Radzio]

Okocza kazał załozyć temat bo chciał sobie psoty nabić

Kod: Zaznacz wszystko

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:00:23, on 2008-05-12
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0011)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Programs\Avast4\aswUpdSv.exe
C:\Programs\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\CTHELPER.EXE
C:\WINDOWS\system32\CTXFIHLP.EXE
C:\Programs\Avast4\ashDisp.exe
C:\Program Files\Creative\Shared Files\Module Loader\DLLML.exe
C:\Programs\Nokia\NOKIAP~1\LAUNCH~1.EXE
C:\Programs\CyberLink\PowerDVD8\PowerDVD8\PDVD8Serv.exe
C:\winhost.exe
C:\programs\Tlen.pl\tlen.exe
C:\Programs\Nokia\Nokia PC Suite 6\PcSync2.exe
C:\Programs\DAEMON Tools Lite\daemon.exe
C:\programs\sony\SsAAD.exe
C:\Programs\Diskeeper\DkService.exe
C:\WINDOWS\SYSTEM32\CTXFISPI.EXE
C:\Programs\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
C:\PROGRA~1\COMMON~1\Nokia\MPAPI\MPAPI3s.exe
C:\Programs\Avast4\ashMaiSv.exe
C:\Programs\Avast4\ashWebSv.exe
C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe
C:\Program Files\Creative\ShareDLL\CADI\NotiMan.exe
C:\WINDOWS\explorer.exe
C:\programs\Winamp\winamp.exe
C:\programs\Opera\Opera.exe
c:\winhost.exe
c:\winhost.exe
C:\programs\MoorHunt\MoorHunt.exe
C:\Documents and Settings\Opas\Pulpit\wm 3sezon dvd\HiJackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.daemon-search.com/startpage
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
O4 - HKLM\..\Run: [CTxfiHlp] CTXFIHLP.EXE
O4 - HKLM\..\Run: [avast!] C:\Programs\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [DiskeeperSystray] "C:\Programs\Diskeeper\DkIcon.exe"
O4 - HKLM\..\Run: [RCSystem] "C:\Program Files\Creative\Shared Files\Module Loader\DLLML.exe" RCSystem * -Startup
O4 - HKLM\..\Run: [AudioDrvEmulator] "C:\Program Files\Creative\Shared Files\Module Loader\DLLML.exe" -1 AudioDrvEmulator "C:\Program Files\Creative\Shared Files\Module Loader\Audio Emulator\AudDrvEm.dll"
O4 - HKLM\..\Run: [VolPanel] "C:\Programs\Sound Blaster X-Fi\Volume Panel\VolPanel.exe" /r
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\Programs\Nokia\NOKIAP~1\LAUNCH~1.EXE -startup
O4 - HKLM\..\Run: [WinampAgent] C:\Programs\Winamp\winampa.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Programs\adobe Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [RemoteControl8] C:\Programs\CyberLink\PowerDVD8\PowerDVD8\PDVD8Serv.exe
O4 - HKLM\..\Run: [PDVD8LanguageShortcut] C:\Programs\CyberLink\PowerDVD8\PowerDVD8\Language\Language.exe
O4 - HKLM\..\Run: [NvGraphicsInterface] c:\winhost.exe
O4 - HKCU\..\Run: [Komunikator] C:\programs\Tlen.pl\tlen.exe
O4 - HKCU\..\Run: [PcSync] C:\Programs\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Programs\DAEMON Tools Lite\daemon.exe" -autorun
O4 - HKCU\..\Run: [SsAAD.exe] C:\programs\sony\SsAAD.exe
O4 - Global Startup: Microsoft Office.lnk = C:\programs\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\Programs\MICROS~1\Office10\EXCEL.EXE/3000
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{36BD55EF-C28C-4D16-92FF-DB63828935E6}: NameServer = 172.16.13.1,217.76.112.66
O17 - HKLM\System\CS1\Services\Tcpip\..\{36BD55EF-C28C-4D16-92FF-DB63828935E6}: NameServer = 172.16.13.1,217.76.112.66
O17 - HKLM\System\CS2\Services\Tcpip\..\{36BD55EF-C28C-4D16-92FF-DB63828935E6}: NameServer = 172.16.13.1,217.76.112.66
O23 - Service: Ares Chatroom server (AresChatServer) - Ares Development Group - C:\Programs\Ares\chatServer.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Programs\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Programs\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Programs\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Programs\Avast4\ashWebSv.exe
O23 - Service: Diskeeper - Diskeeper Corporation - C:\Programs\Diskeeper\DkService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe
O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe
O23 - Service: SonicStage SCSI Service (SSScsiSV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SSScsiSV.exe
O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Programs\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe

--
End of file - 6432 bytes


[Okocza]

C:\winhost.exe
c:\winhost.exe
c:\winhost.exe
O4 - HKLM\..\Run: [NvGraphicsInterface] c:\winhost.exe

to kasujesz w hijacku, daj log z combofixa

Okocza kazał załozyć temat bo chciał sobie psoty nabić rotfl

[wojtas]

Tadzio a masz jakiś problem z kompem ? tak na serio...

[Radzio]

Tadzio a masz jakiś problem z kompem ? tak na serio...

Sorki za opis,ale jakoś cięzki humor mi się wkręcił (wszystko przez te durne baby)
Fakt faktem mam i to zaczyna się robić dośc upierdliwe
A jakbym nie miał to bym na pewno nie zakładał tematu


Co do problemu-przy każdym uruchomieniu wyskakuje błąd z aplikacją drwatson,przy czym nastepuje zwiecha,pozostaje tylko ctrl alt del i wylączenie procesu drwatson...i tak w koło

[Okocza]

radzio napisał:
C:\winhost.exe
c:\winhost.exe
c:\winhost.exe
O4 - HKLM\..\Run: [NvGraphicsInterface] c:\winhost.exe


to kasujesz w hijacku, daj log z combofixa

[Radzio]

no i pupa blada,dalej to samo

Kod: Zaznacz wszystko

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:51:56, on 2008-05-12
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0011)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Programs\Avast4\aswUpdSv.exe
C:\Programs\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programs\Diskeeper\DkService.exe
C:\WINDOWS\CTHELPER.EXE
C:\WINDOWS\system32\CTXFIHLP.EXE
C:\Programs\Avast4\ashDisp.exe
C:\Programs\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
C:\Program Files\Creative\Shared Files\Module Loader\DLLML.exe
C:\WINDOWS\SYSTEM32\CTXFISPI.EXE
C:\Programs\Nokia\NOKIAP~1\LAUNCH~1.EXE
C:\Programs\CyberLink\PowerDVD8\PowerDVD8\PDVD8Serv.exe
C:\Programs\Avast4\ashMaiSv.exe
C:\Programs\Avast4\ashWebSv.exe
C:\Program Files\Creative\ShareDLL\CADI\NotiMan.exe
C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe
C:\WINDOWS\explorer.exe
C:\programs\Opera\Opera.exe
C:\Documents and Settings\Opas\Pulpit\wm 3sezon dvd\HiJackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.daemon-search.com/startpage
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
O4 - HKLM\..\Run: [CTxfiHlp] CTXFIHLP.EXE
O4 - HKLM\..\Run: [avast!] C:\Programs\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [DiskeeperSystray] "C:\Programs\Diskeeper\DkIcon.exe"
O4 - HKLM\..\Run: [RCSystem] "C:\Program Files\Creative\Shared Files\Module Loader\DLLML.exe" RCSystem * -Startup
O4 - HKLM\..\Run: [AudioDrvEmulator] "C:\Program Files\Creative\Shared Files\Module Loader\DLLML.exe" -1 AudioDrvEmulator "C:\Program Files\Creative\Shared Files\Module Loader\Audio Emulator\AudDrvEm.dll"
O4 - HKLM\..\Run: [VolPanel] "C:\Programs\Sound Blaster X-Fi\Volume Panel\VolPanel.exe" /r
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\Programs\Nokia\NOKIAP~1\LAUNCH~1.EXE -startup
O4 - HKLM\..\Run: [WinampAgent] C:\Programs\Winamp\winampa.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Programs\adobe Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [RemoteControl8] C:\Programs\CyberLink\PowerDVD8\PowerDVD8\PDVD8Serv.exe
O4 - HKLM\..\Run: [PDVD8LanguageShortcut] C:\Programs\CyberLink\PowerDVD8\PowerDVD8\Language\Language.exe
O4 - HKCU\..\Run: [Komunikator] C:\programs\Tlen.pl\tlen.exe
O4 - HKCU\..\Run: [PcSync] C:\Programs\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Programs\DAEMON Tools Lite\daemon.exe" -autorun
O4 - HKCU\..\Run: [SsAAD.exe] C:\programs\sony\SsAAD.exe
O4 - Global Startup: Microsoft Office.lnk = C:\programs\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\Programs\MICROS~1\Office10\EXCEL.EXE/3000
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{36BD55EF-C28C-4D16-92FF-DB63828935E6}: NameServer = 172.16.13.1,217.76.112.66
O17 - HKLM\System\CS1\Services\Tcpip\..\{36BD55EF-C28C-4D16-92FF-DB63828935E6}: NameServer = 172.16.13.1,217.76.112.66
O17 - HKLM\System\CS2\Services\Tcpip\..\{36BD55EF-C28C-4D16-92FF-DB63828935E6}: NameServer = 172.16.13.1,217.76.112.66
O23 - Service: Ares Chatroom server (AresChatServer) - Ares Development Group - C:\Programs\Ares\chatServer.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Programs\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Programs\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Programs\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Programs\Avast4\ashWebSv.exe
O23 - Service: Diskeeper - Diskeeper Corporation - C:\Programs\Diskeeper\DkService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe
O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe
O23 - Service: SonicStage SCSI Service (SSScsiSV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SSScsiSV.exe
O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Programs\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe

--
End of file - 6068 bytes



z combofixa

Kod: Zaznacz wszystko

ComboFix 08-05-11.1 - Opas 2008-05-12 18:49:45.2 - NTFSx86
Microsoft Windows XP Professional  5.1.2600.2.1250.1.1045.18.610 [GMT 2:00]
Running from: C:\Documents and Settings\Opas\Pulpit\wm 3sezon dvd\ComboFix.exe

[color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color]
.

(((((((((((((((((((((((((   Files Created from 2008-04-12 to 2008-05-12  )))))))))))))))))))))))))))))))
.

2008-05-11 17:55 . 2008-05-11 17:57   <DIR>   d--------   C:\Program Files\SopCast
2008-05-11 14:03 . 2008-05-11 14:03   <DIR>   d--------   C:\Documents and Settings\Opas\Dane aplikacji\Media Player Classic
2008-05-11 14:02 . 2008-05-11 14:02   <DIR>   d--------   C:\Program Files\K-Lite Codec Pack
2008-05-09 13:11 . 2008-05-09 13:12   <DIR>   d--------   C:\Nowy folder
2008-05-09 12:46 . 2008-05-09 12:47   <DIR>   d--------   C:\Tecktonik
2008-05-07 23:21 . 2008-05-07 23:21   30,208   --a------   C:\mont.exe
2008-05-07 17:25 . 2008-05-07 17:25   <DIR>   d--------   C:\Documents and Settings\Opas\Dane aplikacji\Lavasoft
2008-05-06 21:16 . 2008-05-06 21:16   28   --a------   C:\s32.exe
2008-05-06 21:13 . 2008-05-06 21:14   60,416   --a------   C:\dos32.exe
2008-05-06 20:45 . 2008-05-06 20:46   60,416   --a------   C:\mon.exe
2008-05-05 21:20 . 2008-05-12 18:39   29,696   --a------   C:\winhost.exe
2008-05-05 21:20 . 2008-05-09 20:20   19,931   --a------   C:\WINDOWS\system32\drivers\hosts
2008-05-04 14:33 . 2008-05-04 15:34   <DIR>   d--------   C:\Program Files\Graph
2008-05-03 02:33 . 2008-05-04 23:47   92   --a------   C:\ResumeOmgApDeliveryMgrCntrl_SonicStage_EmdDownloadObj.dmf
2008-05-03 01:43 . 2008-05-03 01:43   <DIR>   d--------   C:\Program Files\Audacity 1.3 Beta (Unicode)
2008-05-03 01:43 . 2008-05-03 14:58   <DIR>   d--------   C:\Documents and Settings\Opas\Dane aplikacji\Audacity
2008-05-01 17:11 . 2008-05-09 12:47   <DIR>   d--------   C:\Program Files\Total Video Converter
2008-05-01 16:59 . 2008-05-01 16:59   193   --a------   C:\WINDOWS\dvdtoaviconverter.ini
2008-05-01 15:59 . 2008-05-01 16:59   <DIR>   d--------   C:\Program Files\MyDVDTools
2008-05-01 15:59 . 2008-05-01 15:59   1   --a------   C:\WINDOWS\system32\SysDVDtoavi.dat
2008-05-01 15:39 . 2008-05-01 15:39   188,794   ---h-----   C:\treeinfo.wc
2008-05-01 14:33 . 2008-05-01 14:33   <DIR>   d--------   C:\Program Files\Gabest
2008-05-01 14:33 . 2008-05-01 14:33   <DIR>   d--------   C:\Program Files\AviSynth 2.5
2008-05-01 14:33 . 2008-05-01 14:33   43,698   --a------   C:\WINDOWS\system32\xvid-uninstall.exe
2008-05-01 14:05 . 2008-05-01 14:21   <DIR>   d--------   C:\Program Files\Super DVD Ripper
2008-05-01 13:38 . 2008-05-01 13:38   <DIR>   d--------   C:\Documents and Settings\Opas\Dane aplikacji\CyberLink
2008-05-01 13:38 . 2008-05-01 13:38   <DIR>   d--------   C:\Documents and Settings\All Users\Dane aplikacji\CyberLink
2008-05-01 13:37 . 2008-05-01 13:37   <DIR>   d--------   C:\Program Files\Common Files\CyberLink
2008-04-27 17:49 . 2008-04-27 17:49   <DIR>   d--------   C:\Documents and Settings\Opas\Dane aplikacji\Ubisoft
2008-04-27 17:48 . 2008-04-27 17:48   <DIR>   d--------   C:\Documents and Settings\All Users\Dane aplikacji\Ubisoft
2008-04-27 17:47 . 2007-10-12 15:14   3,734,536   --a------   C:\WINDOWS\system32\d3dx9_36.dll
2008-04-27 17:47 . 2007-07-19 18:14   3,727,720   --a------   C:\WINDOWS\system32\d3dx9_35.dll
2008-04-27 17:47 . 2007-10-12 15:14   1,374,232   --a------   C:\WINDOWS\system32\D3DCompiler_36.dll
2008-04-27 17:47 . 2007-07-19 18:14   1,358,192   --a------   C:\WINDOWS\system32\D3DCompiler_35.dll
2008-04-27 17:47 . 2007-10-02 09:56   444,776   --a------   C:\WINDOWS\system32\d3dx10_36.dll
2008-04-27 17:47 . 2007-07-19 18:14   444,776   --a------   C:\WINDOWS\system32\d3dx10_35.dll
2008-04-27 17:47 . 2007-10-22 03:39   267,272   --a------   C:\WINDOWS\system32\xactengine2_10.dll
2008-04-27 17:47 . 2007-07-20 00:57   267,112   --a------   C:\WINDOWS\system32\xactengine2_9.dll
2008-04-26 18:56 . 2008-05-01 17:30   <DIR>   d--------   C:\Downloads
2008-04-25 19:15 . 2008-04-29 14:02   <DIR>   d--------   C:\Documents and Settings\Opas\Dane aplikacji\Bioshock
2008-04-25 14:34 . 2008-04-25 14:34   <DIR>   d--------   C:\Documents and Settings\Opas\Dane aplikacji\InstallShield
2008-04-25 14:13 . 2008-04-25 14:13   108,144   --a------   C:\WINDOWS\system32\CmdLineExt.dll
2008-04-25 13:03 . 2008-04-25 13:03   <DIR>   d--------   C:\Documents and Settings\Opas\Dane aplikacji\DAEMON Tools
2008-04-25 13:03 . 2008-04-25 13:03   716,272   --a------   C:\WINDOWS\system32\drivers\sptd.sys
2008-04-21 20:42 . 2008-04-21 20:42   <DIR>   d--------   C:\Documents and Settings\Opas\Dane aplikacji\Nokia
2008-04-21 20:42 . 2008-04-21 20:42   <DIR>   d--------   C:\Documents and Settings\Opas\Dane aplikacji\Datalayer
2008-04-21 20:41 . 2008-04-22 10:08   <DIR>   d--------   C:\Documents and Settings\Opas\Phone Browser
2008-04-21 19:57 . 2008-04-21 19:54   27,958   --a------   C:\WINDOWS\system32\SpoonUninstall-dBpowerAMP Music Converter.bmp
2008-04-21 19:57 . 2008-04-21 19:57   17,855   --a------   C:\WINDOWS\system32\SpoonUninstall-dBpowerAMP Music Converter.dat
2008-04-20 20:18 . 2008-04-20 20:18   <DIR>   d--------   C:\Program Files\Common Files\ACD Systems
2008-04-20 20:18 . 2008-04-20 20:18   <DIR>   d--------   C:\Program Files\ACD Systems
2008-04-20 20:18 . 2008-04-20 20:18   <DIR>   d--------   C:\Documents and Settings\Opas\Dane aplikacji\ACD Systems
2008-04-20 20:18 . 2008-04-20 20:18   <DIR>   d--------   C:\Documents and Settings\All Users\Dane aplikacji\ACD Systems
2008-04-20 20:18 . 2008-04-20 20:18   9,856   --a------   C:\WINDOWS\system32\drivers\pfc.sys
2008-04-20 18:08 . 2008-05-11 13:28   1,368   --a------   C:\WINDOWS\bestplayer.ini
2008-04-20 18:08 . 2008-05-11 13:28   794   --a------   C:\WINDOWS\bestplayer.bbt
2008-04-20 18:08 . 2008-05-11 13:28   117   --a------   C:\WINDOWS\bestplayer.bpp
2008-04-20 15:56 . 2008-04-25 13:57   <DIR>   d--------   C:\Documents and Settings\Opas\Dane aplikacji\Azureus
2008-04-20 15:56 . 2008-04-20 15:56   <DIR>   d--------   C:\Documents and Settings\All Users\Dane aplikacji\Azureus
2008-04-20 14:29 . 2008-05-12 09:22   69   --a------   C:\WINDOWS\NeroDigital.ini
2008-04-20 12:21 . 2004-08-03 23:08   26,496   --a--c---   C:\WINDOWS\system32\dllcache\usbstor.sys
2008-04-20 10:47 . 2008-04-20 10:51   <DIR>   d--------   C:\[u]0[/u]3.04.2008_iiyama_drivers
2008-04-20 00:08 . 2008-04-20 00:08   <DIR>   d--------   C:\Program Files\MSBuild
2008-04-20 00:07 . 2008-04-20 00:09   <DIR>   d--------   C:\WINDOWS\system32\XPSViewer
2008-04-20 00:07 . 2008-04-20 00:07   <DIR>   d--------   C:\Program Files\Reference Assemblies
2008-04-20 00:07 . 2006-06-29 13:07   14,048   ---------   C:\WINDOWS\system32\spmsg2.dll
2008-04-20 00:05 . 2008-04-20 00:05   <DIR>   d--------   C:\Program Files\MSXML 6.0
2008-04-19 23:43 . 2008-04-19 23:43   0   --a------   C:\WINDOWS\ativpsrm.bin
2008-04-19 23:41 . 2008-04-20 00:05   1,374   --a------   C:\WINDOWS\imsins.BAK
2008-04-19 23:37 . 2008-04-19 23:37   <DIR>   d--------   C:\Program Files\Common Files\Adobe
2008-04-19 22:48 . 2008-04-19 22:50   <DIR>   d--------   C:\Documents and Settings\Opas\Dane aplikacji\Winamp
2008-04-19 21:27 . 2004-08-04 00:44   21,504   --a------   C:\WINDOWS\system32\hidserv.dll
2008-04-19 21:27 . 2004-08-04 00:44   21,504   --a--c---   C:\WINDOWS\system32\dllcache\hidserv.dll
2008-04-19 21:27 . 2004-08-04 00:38   14,848   --a------   C:\WINDOWS\system32\drivers\kbdhid.sys
2008-04-19 21:27 . 2004-08-04 00:38   14,848   --a--c---   C:\WINDOWS\system32\dllcache\kbdhid.sys
2008-04-19 21:27 . 2001-08-17 22:02   9,600   --a------   C:\WINDOWS\system32\drivers\hidusb.sys
2008-04-19 21:27 . 2001-08-17 22:02   9,600   --a--c---   C:\WINDOWS\system32\dllcache\hidusb.sys
2008-04-19 21:26 . 2004-08-03 23:08   31,616   --a------   C:\WINDOWS\system32\drivers\usbccgp.sys
2008-04-19 21:26 . 2004-08-03 23:08   31,616   --a--c---   C:\WINDOWS\system32\dllcache\usbccgp.sys

.
((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-05-12 15:42   ---------   d-----w   C:\Documents and Settings\Opas\Dane aplikacji\Tlen.pl
2008-05-02 22:15   ---------   d-----w   C:\Documents and Settings\Opas\Dane aplikacji\Sony Corporation
2008-05-01 11:37   ---------   d--h--w   C:\Program Files\InstallShield Installation Information
2008-04-21 17:57   167,936   ----a-w   C:\WINDOWS\system32\SpoonUninstall.exe
2008-03-31 21:25   682,496   ----a-w   C:\WINDOWS\system32\divx.dll
2008-03-29 06:21   2,873,856   ----a-w   C:\WINDOWS\system32\drivers\ati2mtag.sys
2008-03-29 05:19   9,801,728   ----a-w   C:\WINDOWS\system32\atioglx2.dll
2008-03-29 04:40   167,936   ----a-w   C:\WINDOWS\system32\atiok3x2.dll
2008-03-29 04:05   372,736   ----a-w   C:\WINDOWS\system32\ATIDEMGX.dll
2008-03-29 04:04   299,008   ----a-w   C:\WINDOWS\system32\ati2dvag.dll
2008-03-29 03:56   172,032   ----a-w   C:\WINDOWS\system32\atipdlxx.dll
2008-03-29 03:56   126,976   ----a-w   C:\WINDOWS\system32\Oemdspif.dll
2008-03-29 03:55   43,520   ----a-w   C:\WINDOWS\system32\ati2edxx.dll
2008-03-29 03:55   26,112   ----a-w   C:\WINDOWS\system32\Ati2mdxx.exe
2008-03-29 03:55   126,976   ----a-w   C:\WINDOWS\system32\ati2evxx.dll
2008-03-29 03:54   536,576   ----a-w   C:\WINDOWS\system32\ati2evxx.exe
2008-03-29 03:52   53,248   ----a-w   C:\WINDOWS\system32\ATIDDC.DLL
2008-03-29 03:43   3,176,480   ----a-w   C:\WINDOWS\system32\ati3duag.dll
2008-03-29 03:39   307,200   ----a-w   C:\WINDOWS\system32\atiiiexx.dll
2008-03-29 03:36   1,765,120   ----a-w   C:\WINDOWS\system32\ativvaxx.dll
2008-03-29 03:24   46,080   ----a-w   C:\WINDOWS\system32\amdpcom32.dll
2008-03-29 03:21   393,216   ----a-w   C:\WINDOWS\system32\atikvmag.dll
2008-03-29 03:19   17,408   ----a-w   C:\WINDOWS\system32\atitvo32.dll
2008-03-29 03:18   49,152   ----a-w   C:\WINDOWS\system32\drivers\ati2erec.dll
2008-03-29 03:12   520,192   ----a-w   C:\WINDOWS\system32\ati2cqag.dll
2008-03-28 19:05   593,920   ------w   C:\WINDOWS\system32\ati2sgag.exe
2008-03-28 17:41   7,680   ----a-w   C:\WINDOWS\system32\ff_vfw.dll
2008-03-21 20:30   3,596,288   ----a-w   C:\WINDOWS\system32\qt-dx331.dll
2008-03-21 20:28   81,920   ----a-w   C:\WINDOWS\system32\dpl100.dll
.

(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Komunikator"="C:\programs\Tlen.pl\tlen.exe" [2007-10-16 12:53 6234112]
"PcSync"="C:\Programs\Nokia\Nokia PC Suite 6\PcSync2.exe" [2006-06-27 16:21 1449984]
"DAEMON Tools Lite"="C:\Programs\DAEMON Tools Lite\daemon.exe" [2008-02-14 01:09 486856]
"SsAAD.exe"="C:\programs\sony\SsAAD.exe" [2006-09-05 05:18 81920]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTHelper"="CTHELPER.EXE" [2006-08-17 11:32 17920 C:\WINDOWS\CTHELPER.EXE]
"CTxfiHlp"="CTXFIHLP.EXE" [2006-08-17 11:32 18944 C:\WINDOWS\system32\CTXFIHLP.EXE]
"avast!"="C:\Programs\Avast4\ashDisp.exe" [2007-09-06 12:06 79224]
"DiskeeperSystray"="C:\Programs\Diskeeper\DkIcon.exe" [2005-11-22 17:38 221184]
"RCSystem"="C:\Program Files\Creative\Shared Files\Module Loader\DLLML.exe" [2005-06-16 18:25 49152]
"AudioDrvEmulator"="C:\Program Files\Creative\Shared Files\Module Loader\DLLML.exe" [2005-06-16 18:25 49152]
"VolPanel"="C:\Programs\Sound Blaster X-Fi\Volume Panel\VolPanel.exe" [2005-07-11 11:34 122880]
"UpdReg"="C:\WINDOWS\UpdReg.EXE" [2000-05-11 01:00 90112]
"NWEReboot"="" []
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 11:50 155648]
"PCSuiteTrayApplication"="C:\Programs\Nokia\NOKIAP~1\LAUNCH~1.exe" [2006-06-15 12:36 229376]
"WinampAgent"="C:\Programs\Winamp\winampa.exe" [ ]
"Adobe Reader Speed Launcher"="C:\Programs\adobe Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 22:16 39792]
"RemoteControl8"="C:\Programs\CyberLink\PowerDVD8\PowerDVD8\PDVD8Serv.exe" [2008-03-20 20:23 83240]
"PDVD8LanguageShortcut"="C:\Programs\CyberLink\PowerDVD8\PowerDVD8\Language\Language.exe" [2007-12-14 11:36 50472]

C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\
Microsoft Office.lnk - C:\programs\Microsoft Office\Office10\OSA.EXE [2001-02-13 10:01:04 83360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.YV12"= yv12vfw.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
"AntiVirusOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\programs\\Tlen.pl\\tlen.exe"=
"C:\\programs\\Azureus\\Azureus.exe"=
"D:\\Internet\\emule\\program\\emule.exe"=
"C:\\programs\\Ares\\Ares.exe"=
"D:\\Internet\\dc++\\LDC++\\LDCPlusPlus.exe"=
"D:\\Assassin's Creed\\AssassinsCreed_Dx9.exe"=
"D:\\Assassin's Creed\\AssassinsCreed_Dx10.exe"=
"D:\\Assassin's Creed\\AssassinsCreed_Launcher.exe"=
"C:\\programs\\CyberLink\\PowerDVD8\\PowerDVD8\\PowerDVD8.exe"=
"c:\\mon.exe"=
"c:\\dos32.exe"= C:\\dos32.exe
"c:\\mont.exe"= C:\\mont.exe
"D:\\Internet\\Moorhunt 5\\Stranglehold_FULLRIP\\Stranglehold\\Stranglehold\\Binaries\\Retail-Stranglehold.exe"=
"c:\\winhost.exe"=
"C:\\Program Files\\SopCast\\adv\\SopAdver.exe"=
"C:\\Program Files\\SopCast\\SopCast.exe"=

R3 ha20x2k;Creative 20X HAL Driver;C:\WINDOWS\system32\drivers\ha20x2k.sys [2006-08-17 11:16]
S3 USBSTOR;Sterownik magazynu masowego USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-03 23:08]

*Newly Created Service* - CATCHME

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{28ABC5C0-4FCB-11CF-AAX5-81CX1C635612}]
C:\RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013\sys32.exe
.
**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-05-12 18:50:24
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-05-12 18:50:50
ComboFix-quarantined-files.txt  2008-05-12 16:50:44
ComboFix2.txt  2008-05-12 16:48:27

Pre-Run: 1,114,738,688 bajtów wolnych
Post-Run: 1,106,006,016 bajtów wolnych

193


[Okocza]

do notatnika wklejasz:

File::
C:\mont.exe
C:\s32.exe
C:\dos32.exe
C:\mon.exe
C:\winhost.exe

Registry::
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\mon.exe"=-
"c:\\dos32.exe"= C:\\dos32.exe=-
"c:\\mont.exe"= C:\\mont.exe=-
"c:\\winhost.exe"=-

Plik >>> zapisz jako CFScript.txt .Plik przeciągnij i upuść na ikonę ComboFixa (tak jak tu ) . odczekaj az wygeneruje sie nowy log i go daj na forum

[Radzio]

Kod: Zaznacz wszystko

ComboFix 08-05-11.1 - Opas 2008-05-12 19:01:02.3 - NTFSx86
Microsoft Windows XP Professional  5.1.2600.2.1250.1.1045.18.555 [GMT 2:00]
Running from: C:\Documents and Settings\Opas\Pulpit\wm 3sezon dvd\ComboFix.exe
Command switches used :: C:\Documents and Settings\Opas\Pulpit\wm 3sezon dvd\CFScript.txt
* Created a new restore point

[color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color]

FILE ::
C:\dos32.exe
C:\mon.exe
C:\mont.exe
C:\s32.exe
C:\winhost.exe
.

(((((((((((((((((((((((((((((((((((((((   Other Deletions   )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\dos32.exe
C:\mon.exe
C:\mont.exe
C:\s32.exe
C:\winhost.exe

.
(((((((((((((((((((((((((   Files Created from 2008-04-12 to 2008-05-12  )))))))))))))))))))))))))))))))
.

2008-05-11 17:55 . 2008-05-11 17:57   <DIR>   d--------   C:\Program Files\SopCast
2008-05-11 14:03 . 2008-05-11 14:03   <DIR>   d--------   C:\Documents and Settings\Opas\Dane aplikacji\Media Player Classic
2008-05-11 14:02 . 2008-05-11 14:02   <DIR>   d--------   C:\Program Files\K-Lite Codec Pack
2008-05-09 13:11 . 2008-05-09 13:12   <DIR>   d--------   C:\Nowy folder
2008-05-09 12:46 . 2008-05-09 12:47   <DIR>   d--------   C:\Tecktonik
2008-05-07 17:25 . 2008-05-07 17:25   <DIR>   d--------   C:\Documents and Settings\Opas\Dane aplikacji\Lavasoft
2008-05-05 21:20 . 2008-05-09 20:20   19,931   --a------   C:\WINDOWS\system32\drivers\hosts
2008-05-04 14:33 . 2008-05-04 15:34   <DIR>   d--------   C:\Program Files\Graph
2008-05-03 02:33 . 2008-05-04 23:47   92   --a------   C:\ResumeOmgApDeliveryMgrCntrl_SonicStage_EmdDownloadObj.dmf
2008-05-03 01:43 . 2008-05-03 01:43   <DIR>   d--------   C:\Program Files\Audacity 1.3 Beta (Unicode)
2008-05-03 01:43 . 2008-05-03 14:58   <DIR>   d--------   C:\Documents and Settings\Opas\Dane aplikacji\Audacity
2008-05-01 17:11 . 2008-05-09 12:47   <DIR>   d--------   C:\Program Files\Total Video Converter
2008-05-01 16:59 . 2008-05-01 16:59   193   --a------   C:\WINDOWS\dvdtoaviconverter.ini
2008-05-01 15:59 . 2008-05-01 16:59   <DIR>   d--------   C:\Program Files\MyDVDTools
2008-05-01 15:59 . 2008-05-01 15:59   1   --a------   C:\WINDOWS\system32\SysDVDtoavi.dat
2008-05-01 15:39 . 2008-05-01 15:39   188,794   ---h-----   C:\treeinfo.wc
2008-05-01 14:33 . 2008-05-01 14:33   <DIR>   d--------   C:\Program Files\Gabest
2008-05-01 14:33 . 2008-05-01 14:33   <DIR>   d--------   C:\Program Files\AviSynth 2.5
2008-05-01 14:33 . 2008-05-01 14:33   43,698   --a------   C:\WINDOWS\system32\xvid-uninstall.exe
2008-05-01 14:05 . 2008-05-01 14:21   <DIR>   d--------   C:\Program Files\Super DVD Ripper
2008-05-01 13:38 . 2008-05-01 13:38   <DIR>   d--------   C:\Documents and Settings\Opas\Dane aplikacji\CyberLink
2008-05-01 13:38 . 2008-05-01 13:38   <DIR>   d--------   C:\Documents and Settings\All Users\Dane aplikacji\CyberLink
2008-05-01 13:37 . 2008-05-01 13:37   <DIR>   d--------   C:\Program Files\Common Files\CyberLink
2008-04-27 17:49 . 2008-04-27 17:49   <DIR>   d--------   C:\Documents and Settings\Opas\Dane aplikacji\Ubisoft
2008-04-27 17:48 . 2008-04-27 17:48   <DIR>   d--------   C:\Documents and Settings\All Users\Dane aplikacji\Ubisoft
2008-04-27 17:47 . 2007-10-12 15:14   3,734,536   --a------   C:\WINDOWS\system32\d3dx9_36.dll
2008-04-27 17:47 . 2007-07-19 18:14   3,727,720   --a------   C:\WINDOWS\system32\d3dx9_35.dll
2008-04-27 17:47 . 2007-10-12 15:14   1,374,232   --a------   C:\WINDOWS\system32\D3DCompiler_36.dll
2008-04-27 17:47 . 2007-07-19 18:14   1,358,192   --a------   C:\WINDOWS\system32\D3DCompiler_35.dll
2008-04-27 17:47 . 2007-10-02 09:56   444,776   --a------   C:\WINDOWS\system32\d3dx10_36.dll
2008-04-27 17:47 . 2007-07-19 18:14   444,776   --a------   C:\WINDOWS\system32\d3dx10_35.dll
2008-04-27 17:47 . 2007-10-22 03:39   267,272   --a------   C:\WINDOWS\system32\xactengine2_10.dll
2008-04-27 17:47 . 2007-07-20 00:57   267,112   --a------   C:\WINDOWS\system32\xactengine2_9.dll
2008-04-26 18:56 . 2008-05-01 17:30   <DIR>   d--------   C:\Downloads
2008-04-25 19:15 . 2008-04-29 14:02   <DIR>   d--------   C:\Documents and Settings\Opas\Dane aplikacji\Bioshock
2008-04-25 14:34 . 2008-04-25 14:34   <DIR>   d--------   C:\Documents and Settings\Opas\Dane aplikacji\InstallShield
2008-04-25 14:13 . 2008-04-25 14:13   108,144   --a------   C:\WINDOWS\system32\CmdLineExt.dll
2008-04-25 13:03 . 2008-04-25 13:03   <DIR>   d--------   C:\Documents and Settings\Opas\Dane aplikacji\DAEMON Tools
2008-04-25 13:03 . 2008-04-25 13:03   716,272   --a------   C:\WINDOWS\system32\drivers\sptd.sys
2008-04-21 20:42 . 2008-04-21 20:42   <DIR>   d--------   C:\Documents and Settings\Opas\Dane aplikacji\Nokia
2008-04-21 20:42 . 2008-04-21 20:42   <DIR>   d--------   C:\Documents and Settings\Opas\Dane aplikacji\Datalayer
2008-04-21 20:41 . 2008-04-22 10:08   <DIR>   d--------   C:\Documents and Settings\Opas\Phone Browser
2008-04-21 19:57 . 2008-04-21 19:54   27,958   --a------   C:\WINDOWS\system32\SpoonUninstall-dBpowerAMP Music Converter.bmp
2008-04-21 19:57 . 2008-04-21 19:57   17,855   --a------   C:\WINDOWS\system32\SpoonUninstall-dBpowerAMP Music Converter.dat
2008-04-20 20:18 . 2008-04-20 20:18   <DIR>   d--------   C:\Program Files\Common Files\ACD Systems
2008-04-20 20:18 . 2008-04-20 20:18   <DIR>   d--------   C:\Program Files\ACD Systems
2008-04-20 20:18 . 2008-04-20 20:18   <DIR>   d--------   C:\Documents and Settings\Opas\Dane aplikacji\ACD Systems
2008-04-20 20:18 . 2008-04-20 20:18   <DIR>   d--------   C:\Documents and Settings\All Users\Dane aplikacji\ACD Systems
2008-04-20 20:18 . 2008-04-20 20:18   9,856   --a------   C:\WINDOWS\system32\drivers\pfc.sys
2008-04-20 18:08 . 2008-05-11 13:28   1,368   --a------   C:\WINDOWS\bestplayer.ini
2008-04-20 18:08 . 2008-05-11 13:28   794   --a------   C:\WINDOWS\bestplayer.bbt
2008-04-20 18:08 . 2008-05-11 13:28   117   --a------   C:\WINDOWS\bestplayer.bpp
2008-04-20 15:56 . 2008-04-25 13:57   <DIR>   d--------   C:\Documents and Settings\Opas\Dane aplikacji\Azureus
2008-04-20 15:56 . 2008-04-20 15:56   <DIR>   d--------   C:\Documents and Settings\All Users\Dane aplikacji\Azureus
2008-04-20 14:29 . 2008-05-12 18:57   69   --a------   C:\WINDOWS\NeroDigital.ini
2008-04-20 12:21 . 2004-08-03 23:08   26,496   --a--c---   C:\WINDOWS\system32\dllcache\usbstor.sys
2008-04-20 10:47 . 2008-04-20 10:51   <DIR>   d--------   C:\[u]0[/u]3.04.2008_iiyama_drivers
2008-04-20 00:08 . 2008-04-20 00:08   <DIR>   d--------   C:\Program Files\MSBuild
2008-04-20 00:07 . 2008-04-20 00:09   <DIR>   d--------   C:\WINDOWS\system32\XPSViewer
2008-04-20 00:07 . 2008-04-20 00:07   <DIR>   d--------   C:\Program Files\Reference Assemblies
2008-04-20 00:07 . 2006-06-29 13:07   14,048   ---------   C:\WINDOWS\system32\spmsg2.dll
2008-04-20 00:05 . 2008-04-20 00:05   <DIR>   d--------   C:\Program Files\MSXML 6.0
2008-04-19 23:43 . 2008-04-19 23:43   0   --a------   C:\WINDOWS\ativpsrm.bin
2008-04-19 23:41 . 2008-04-20 00:05   1,374   --a------   C:\WINDOWS\imsins.BAK
2008-04-19 23:37 . 2008-04-19 23:37   <DIR>   d--------   C:\Program Files\Common Files\Adobe
2008-04-19 22:48 . 2008-04-19 22:50   <DIR>   d--------   C:\Documents and Settings\Opas\Dane aplikacji\Winamp
2008-04-19 21:27 . 2004-08-04 00:44   21,504   --a------   C:\WINDOWS\system32\hidserv.dll
2008-04-19 21:27 . 2004-08-04 00:44   21,504   --a--c---   C:\WINDOWS\system32\dllcache\hidserv.dll
2008-04-19 21:27 . 2004-08-04 00:38   14,848   --a------   C:\WINDOWS\system32\drivers\kbdhid.sys
2008-04-19 21:27 . 2004-08-04 00:38   14,848   --a--c---   C:\WINDOWS\system32\dllcache\kbdhid.sys
2008-04-19 21:27 . 2001-08-17 22:02   9,600   --a------   C:\WINDOWS\system32\drivers\hidusb.sys
2008-04-19 21:27 . 2001-08-17 22:02   9,600   --a--c---   C:\WINDOWS\system32\dllcache\hidusb.sys
2008-04-19 21:26 . 2004-08-03 23:08   31,616   --a------   C:\WINDOWS\system32\drivers\usbccgp.sys
2008-04-19 21:26 . 2004-08-03 23:08   31,616   --a--c---   C:\WINDOWS\system32\dllcache\usbccgp.sys

.
((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-05-12 15:42   ---------   d-----w   C:\Documents and Settings\Opas\Dane aplikacji\Tlen.pl
2008-05-02 22:15   ---------   d-----w   C:\Documents and Settings\Opas\Dane aplikacji\Sony Corporation
2008-05-01 11:37   ---------   d--h--w   C:\Program Files\InstallShield Installation Information
2008-04-21 17:57   167,936   ----a-w   C:\WINDOWS\system32\SpoonUninstall.exe
2008-03-31 21:25   682,496   ----a-w   C:\WINDOWS\system32\divx.dll
2008-03-29 06:21   2,873,856   ----a-w   C:\WINDOWS\system32\drivers\ati2mtag.sys
2008-03-29 05:19   9,801,728   ----a-w   C:\WINDOWS\system32\atioglx2.dll
2008-03-29 04:40   167,936   ----a-w   C:\WINDOWS\system32\atiok3x2.dll
2008-03-29 04:05   372,736   ----a-w   C:\WINDOWS\system32\ATIDEMGX.dll
2008-03-29 04:04   299,008   ----a-w   C:\WINDOWS\system32\ati2dvag.dll
2008-03-29 03:56   172,032   ----a-w   C:\WINDOWS\system32\atipdlxx.dll
2008-03-29 03:56   126,976   ----a-w   C:\WINDOWS\system32\Oemdspif.dll
2008-03-29 03:55   43,520   ----a-w   C:\WINDOWS\system32\ati2edxx.dll
2008-03-29 03:55   26,112   ----a-w   C:\WINDOWS\system32\Ati2mdxx.exe
2008-03-29 03:55   126,976   ----a-w   C:\WINDOWS\system32\ati2evxx.dll
2008-03-29 03:54   536,576   ----a-w   C:\WINDOWS\system32\ati2evxx.exe
2008-03-29 03:52   53,248   ----a-w   C:\WINDOWS\system32\ATIDDC.DLL
2008-03-29 03:43   3,176,480   ----a-w   C:\WINDOWS\system32\ati3duag.dll
2008-03-29 03:39   307,200   ----a-w   C:\WINDOWS\system32\atiiiexx.dll
2008-03-29 03:36   1,765,120   ----a-w   C:\WINDOWS\system32\ativvaxx.dll
2008-03-29 03:24   46,080   ----a-w   C:\WINDOWS\system32\amdpcom32.dll
2008-03-29 03:21   393,216   ----a-w   C:\WINDOWS\system32\atikvmag.dll
2008-03-29 03:19   17,408   ----a-w   C:\WINDOWS\system32\atitvo32.dll
2008-03-29 03:18   49,152   ----a-w   C:\WINDOWS\system32\drivers\ati2erec.dll
2008-03-29 03:12   520,192   ----a-w   C:\WINDOWS\system32\ati2cqag.dll
2008-03-28 19:05   593,920   ------w   C:\WINDOWS\system32\ati2sgag.exe
2008-03-28 17:41   7,680   ----a-w   C:\WINDOWS\system32\ff_vfw.dll
2008-03-21 20:30   3,596,288   ----a-w   C:\WINDOWS\system32\qt-dx331.dll
2008-03-21 20:28   81,920   ----a-w   C:\WINDOWS\system32\dpl100.dll
.

(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Komunikator"="C:\programs\Tlen.pl\tlen.exe" [2007-10-16 12:53 6234112]
"PcSync"="C:\Programs\Nokia\Nokia PC Suite 6\PcSync2.exe" [2006-06-27 16:21 1449984]
"DAEMON Tools Lite"="C:\Programs\DAEMON Tools Lite\daemon.exe" [2008-02-14 01:09 486856]
"SsAAD.exe"="C:\programs\sony\SsAAD.exe" [2006-09-05 05:18 81920]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTHelper"="CTHELPER.EXE" [2006-08-17 11:32 17920 C:\WINDOWS\CTHELPER.EXE]
"CTxfiHlp"="CTXFIHLP.EXE" [2006-08-17 11:32 18944 C:\WINDOWS\system32\CTXFIHLP.EXE]
"avast!"="C:\Programs\Avast4\ashDisp.exe" [2007-09-06 12:06 79224]
"DiskeeperSystray"="C:\Programs\Diskeeper\DkIcon.exe" [2005-11-22 17:38 221184]
"RCSystem"="C:\Program Files\Creative\Shared Files\Module Loader\DLLML.exe" [2005-06-16 18:25 49152]
"AudioDrvEmulator"="C:\Program Files\Creative\Shared Files\Module Loader\DLLML.exe" [2005-06-16 18:25 49152]
"VolPanel"="C:\Programs\Sound Blaster X-Fi\Volume Panel\VolPanel.exe" [2005-07-11 11:34 122880]
"UpdReg"="C:\WINDOWS\UpdReg.EXE" [2000-05-11 01:00 90112]
"NWEReboot"="" []
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 11:50 155648]
"PCSuiteTrayApplication"="C:\Programs\Nokia\NOKIAP~1\LAUNCH~1.exe" [2006-06-15 12:36 229376]
"WinampAgent"="C:\Programs\Winamp\winampa.exe" [ ]
"Adobe Reader Speed Launcher"="C:\Programs\adobe Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 22:16 39792]
"RemoteControl8"="C:\Programs\CyberLink\PowerDVD8\PowerDVD8\PDVD8Serv.exe" [2008-03-20 20:23 83240]
"PDVD8LanguageShortcut"="C:\Programs\CyberLink\PowerDVD8\PowerDVD8\Language\Language.exe" [2007-12-14 11:36 50472]

C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\
Microsoft Office.lnk - C:\programs\Microsoft Office\Office10\OSA.EXE [2001-02-13 10:01:04 83360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.YV12"= yv12vfw.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
"AntiVirusOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\programs\\Tlen.pl\\tlen.exe"=
"C:\\programs\\Azureus\\Azureus.exe"=
"D:\\Internet\\emule\\program\\emule.exe"=
"C:\\programs\\Ares\\Ares.exe"=
"D:\\Internet\\dc++\\LDC++\\LDCPlusPlus.exe"=
"D:\\Assassin's Creed\\AssassinsCreed_Dx9.exe"=
"D:\\Assassin's Creed\\AssassinsCreed_Dx10.exe"=
"D:\\Assassin's Creed\\AssassinsCreed_Launcher.exe"=
"C:\\programs\\CyberLink\\PowerDVD8\\PowerDVD8\\PowerDVD8.exe"=
"D:\\Internet\\Moorhunt 5\\Stranglehold_FULLRIP\\Stranglehold\\Stranglehold\\Binaries\\Retail-Stranglehold.exe"=
"C:\\Program Files\\SopCast\\adv\\SopAdver.exe"=
"C:\\Program Files\\SopCast\\SopCast.exe"=

R3 ha20x2k;Creative 20X HAL Driver;C:\WINDOWS\system32\drivers\ha20x2k.sys [2006-08-17 11:16]
S3 USBSTOR;Sterownik magazynu masowego USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-03 23:08]

*Newly Created Service* - CATCHME

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{28ABC5C0-4FCB-11CF-AAX5-81CX1C635612}]
C:\RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013\sys32.exe
.
**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-05-12 19:01:41
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-05-12 19:02:04
ComboFix-quarantined-files.txt  2008-05-12 17:02:01
ComboFix2.txt  2008-05-12 16:50:51
ComboFix3.txt  2008-05-12 16:48:27

Pre-Run: 1,092,243,456 bajtów wolnych
Post-Run: 1,082,994,688 bajtów wolnych

201


[Okocza]

wklej do notatnika:

Windows Registry Editor Version 5.00

[-HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{28ABC5C0-4FCB-11CF-AAX5-81CX1C635612}]

w notatniku u góry>>>plik zapisz jako>>>Zmien rozszerzenie z TXT na Wszystkie pliki *.* >>> Zapisz pod nazwą FIX.REG

Klikasz dwa razy na powstały plik fix i dodajesz go do rejestru....

C:\RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013\sys32.exe

skanuj na www.virustotal.com

jak wykryje jakiś "dodatek" to usuwasz go killboxem z opcji delete on reboot.

potem wykonujesz tzw. "modlitwę okoczy":

1. Ściągnij OTMoveIt i go włacz i odpal go z opcji CleanUp
2. wykonaj optymalizację windowsa
3.sciagnij ATF_Cleaner
zaznacz
Windows Temp
All users Temp
Temporary internet files
Recycle Bin
i wcisnij EMPTY SELECTED
4.Wyłącz przywracanie systemu ( właściwości mój komputer-zakładka przywracanie - wyłącz przywracanie na wszystkich dyskach). Po chwili włącz je powrotem

Autor postu otrzymał pochwałę

[Radzio]

łoki mysiu pysiu poradziłeś sobie,dziękuję ;*