Błąd generic host process for win32 services logi hijackthis

**Posty:** 4 · przez **hawaj10** 04 Gru 2008, 23:45

Proszę o sprawdzenie logów. Po krótkim czasie połączenia z internetem pojawia mi się błąd generic host process for win32.

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 22:38:49, on 2008-12-04 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe C:\Program Files\DAEMON Tools\daemon.exe C:\Program Files\PowerDVD\PDVDServ.exe C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Messenger\msmsgs.exe C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://search.bearshare.com/pl/ R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll O4 - HKLM\..\Run: [NvidMediaCenter] C:\Program Files\Common Files\System\wmsncs.exe O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033 O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe" O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\PowerDVD\PDVDServ.exe" O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - HKCU\..\Run: [ALLUpdate] "C:\Program Files\ALLPlayer\ALLUpdate.exe" "sleep" O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [RemoveIT Pro XT] C:\Program Files\InCode Solutions\RemoveIT Pro v4-Trial\removeit.exe O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\S-1-5-18\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user') O4 - HKUS\.DEFAULT\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'Default user') O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe -- End of file - 3693 bytes

**Posty:** 8079 · przez **kajtekjr** 04 Gru 2008, 23:57

Na początek polecam:
http://forum.programosy.pl/blad-generic-host-process-for-win32-services-vt79489.html

**Posty:** 4 · przez **hawaj10** 05 Gru 2008, 16:40

Zrobiłem wszystko zgodnie z instrukcją ale błąd nadal się pojawia. Internet po jakimś czasie zwalnia a następnie wyskakuje komunikat o błędzie i zostaje rozłączony.

**Posty:** 18165 · przez **wojtas** 05 Gru 2008, 16:56

Wykonaj to co jest podane w tym temacie

Zastosuj SDFix . Po pobraniu uruchom go a rozpakuje się do C:\SDFix. Uruchom komputer w trybie awaryjnym (F8 przy stracie systemu). Będąc w awaryjnym uruchom plik RunThis.bat z folderu SDFixa. Zatwierdź czyszczenie przez Y. Poczekaj aż ukończy i komputer zresetuje

Potem wejdz do folderu C:\SDFix wrzuc zawartość pliku Report.txt + log z combofixa oraz daj loga z hijacka

**Posty:** 4 · przez **hawaj10** 05 Gru 2008, 19:18

Zamieszczam wg kolejności raport z SDfix + logi z Combofixa i HijackThis.

Kod: Zaznacz wszystko: [b]SDFix: Version 1.240 [/b] Run by hawaj on 2008-12-05 at 17:57 Microsoft Windows XP [Wersja 5.1.2600] Running From: C:\SDFix [b]Checking Services [/b]: Restoring Default Security Values Restoring Default Hosts File Rebooting [b]Checking Files [/b]: Trojan Files Found: C:\WINDOWS\SYSTEM32\WIN_50~1.EXE - Deleted C:\Documents and Settings\hawaj\Ustawienia lokalne\Temp\nsn76.tmp.exe - Deleted C:\Documents and Settings\hawaj\Ustawienia lokalne\Temp\nsu60.tmp.exe - Deleted C:\WINDOWS\system32\i - Deleted Removing Temp Files [b]ADS Check [/b]: [b]Final Check [/b]: catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-12-05 18:01:43 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... scanning hidden services & system hive ... [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg] "s0"=dword:0dd4057a "s1"=dword:66b79121 "s2"=dword:a909009f "h0"=dword:00000001 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4] "p0"="C:\Program Files\DAEMON Tools\" "h0"=dword:00000000 "khjeh"=hex:34,64,f9,90,36,ef,0d,ff,21,de,54,d8,d6,e1,cf,63,e7,d5,9f,55,51,.. [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001] "a0"=hex:20,01,00,00,a9,78,7e,6f,b6,9a,32,d0,59,58,05,b8,17,cf,fb,d3,9f,.. "khjeh"=hex:e0,e1,f4,d4,73,0f,71,0c,2e,a0,b0,1b,5f,9c,59,3c,cc,f8,b5,57,21,.. [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40] "khjeh"=hex:59,24,9e,4c,dc,d5,de,7e,b4,a0,f0,d8,31,06,3d,e8,b3,00,c7,44,04,.. [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41] "khjeh"=hex:59,24,9e,4c,dc,d5,de,7e,b4,a0,f0,d8,31,06,3d,e8,b3,00,c7,44,04,.. [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf42] "khjeh"=hex:59,24,9e,4c,dc,d5,de,7e,b4,a0,f0,d8,31,06,3d,e8,b3,00,c7,44,04,.. [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf43] "khjeh"=hex:59,24,9e,4c,dc,d5,de,7e,b4,a0,f0,d8,31,06,3d,e8,b3,00,c7,44,04,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4] "p0"="C:\Program Files\DAEMON Tools\" "h0"=dword:00000000 "khjeh"=hex:34,64,f9,90,36,ef,0d,ff,21,de,54,d8,d6,e1,cf,63,e7,d5,9f,55,51,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001] "a0"=hex:20,01,00,00,a9,78,7e,6f,b6,9a,32,d0,59,58,05,b8,17,cf,fb,d3,9f,.. "khjeh"=hex:e0,e1,f4,d4,73,0f,71,0c,2e,a0,b0,1b,5f,9c,59,3c,cc,f8,b5,57,21,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40] "khjeh"=hex:59,24,9e,4c,dc,d5,de,7e,b4,a0,f0,d8,31,06,3d,e8,b3,00,c7,44,04,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41] "khjeh"=hex:59,24,9e,4c,dc,d5,de,7e,b4,a0,f0,d8,31,06,3d,e8,b3,00,c7,44,04,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf42] "khjeh"=hex:59,24,9e,4c,dc,d5,de,7e,b4,a0,f0,d8,31,06,3d,e8,b3,00,c7,44,04,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf43] "khjeh"=hex:59,24,9e,4c,dc,d5,de,7e,b4,a0,f0,d8,31,06,3d,e8,b3,00,c7,44,04,.. scanning hidden registry entries ... scanning hidden files ... scan completed successfully hidden processes: 0 hidden services: 0 hidden files: 0 [b]Remaining Services [/b]: Authorized Application Key Export: [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] "C:\\WINDOWS\\system32\\csrsc.exe"="C:\\WINDOWS\\system32\\csrsc.exe:*:Enabled:Microsoft Enabled" "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "C:\\Program Files\\Skype\\Phone\\Skype.exe"="C:\\Program Files\\Skype\\Phone\\Skype.exe:*:Enabled:Skype" [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list] "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" [b]Remaining Files [/b]: File Backups: - C:\SDFix\backups\backups.zip [b]Files with Hidden Attributes [/b]: Fri 3 Jan 2003 45,568 A..H. --- "C:\Documents and Settings\hawaj\Pulpit\W\WSTE\Paczka dla studentow\Stosunki mi©dzynarodowe 3\ORGANIZACJE MI¨DZYN\~WRL1728.tmp" [b]Finished![/b]

Kod: Zaznacz wszystko: ComboFix 08-12-05.01 - hawaj 2008-12-05 18:06:38.1 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.237 [GMT 1:00] Uruchomiony z: c:\documents and settings\hawaj\Pulpit\ComboFix.exe * Utworzono nowy punkt przywracania * Resident AV is active . ((((((((((((((((((((((((((((((((((((((( Usunięto ))))))))))))))))))))))))))))))))))))))))))))))))) . . ((((((((((((((((((((((((((((((((((((((( Sterowniki/Usługi ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Legacy_WINSPOOLSVC ((((((((((((((((((((((((( Pliki utworzone od 2008-11-05 do 2008-12-05 ))))))))))))))))))))))))))))))) . 2008-12-05 17:57 . 2008-12-05 17:57 578,560 --a--c--- c:\windows\system32\dllcache\user32.dll 2008-12-05 17:56 . 2008-12-05 17:56 <DIR> d-------- c:\windows\ERUNT 2008-12-05 17:52 . 2008-12-05 18:02 <DIR> d-------- C:\SDFix 2008-12-04 23:04 . 2008-12-04 23:04 <DIR> d-------- c:\windows\Sun 2008-12-04 23:00 . 2008-12-04 23:00 <DIR> d--h----- c:\windows\$hf_mig$ 2008-12-04 22:52 . 2008-12-04 22:52 410,984 --a------ c:\windows\system32\deploytk.dll 2008-12-04 22:52 . 2008-12-04 22:52 73,728 --a------ c:\windows\system32\javacpl.cpl 2008-12-04 22:51 . 2008-12-04 22:51 <DIR> d-------- c:\program files\Java 2008-12-04 20:58 . 2008-12-04 20:58 <DIR> d-------- c:\program files\Trend Micro 2008-12-04 20:49 . 2008-12-04 20:55 <DIR> d-a------ c:\documents and settings\All Users\Dane aplikacji\TEMP 2008-12-04 15:32 . 2008-12-04 15:32 <DIR> d-------- c:\documents and settings\hawaj\Dane aplikacji\Malwarebytes 2008-12-04 15:32 . 2008-12-04 15:32 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\Malwarebytes 2008-12-04 00:01 . 2008-12-04 16:03 <DIR> d-------- c:\documents and settings\hawaj\Dane aplikacji\skypePM 2008-12-04 00:01 . 2008-12-04 00:01 56 --ah----- c:\windows\system32\ezsidmv.dat 2008-12-03 23:16 . 2008-12-03 23:16 <DIR> d-------- c:\program files\ESET 2008-12-03 23:16 . 2008-12-03 23:16 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\ESET 2008-12-03 20:16 . 2008-12-03 20:16 <DIR> d-------- c:\documents and settings\hawaj\Dane aplikacji\BESTplayer 2008-12-03 19:46 . 2008-12-05 16:20 49 --a------ c:\windows\NeroDigital.ini 2008-12-03 12:02 . 2008-12-03 12:07 <DIR> d-------- c:\program files\Fahrenheit 2008-12-03 09:58 . 2008-12-03 09:58 391 --a------ c:\windows\ODBC.INI 2008-12-03 09:56 . 2008-12-03 09:56 <DIR> d-------- c:\windows\ShellNew 2008-12-03 09:51 . 2008-12-03 09:51 <DIR> d-------- c:\program files\Common Files\Ahead 2008-12-03 09:51 . 2008-12-03 09:51 <DIR> d-------- c:\program files\Ahead 2008-12-03 09:51 . 2001-07-06 14:41 569,344 -ra------ c:\windows\system32\imagr5.dll 2008-12-03 09:51 . 2001-07-06 12:44 544,768 -ra------ c:\windows\system32\imagx5.dll 2008-12-03 09:51 . 2001-07-06 18:24 283,920 -ra------ c:\windows\system32\ImagXpr5.dll 2008-12-03 09:51 . 2001-06-26 08:15 38,912 -ra------ c:\windows\system32\picn20.dll 2008-12-02 22:04 . 2008-12-02 22:04 <DIR> d-------- c:\program files\Real Alternative 2008-12-02 22:04 . 2008-12-02 22:04 <DIR> d-------- c:\program files\Media Player Classic 2008-12-02 22:00 . 2008-12-02 22:00 1,415,680 --a------ c:\windows\system32\WMV9VCM.dll 2008-12-02 22:00 . 2008-12-02 22:00 892,928 --a------ c:\windows\system32\iconv.dll 2008-12-02 22:00 . 2008-12-02 22:00 301,568 --a------ c:\windows\system32\l3codecp.acm 2008-12-02 22:00 . 2008-12-02 22:00 245,760 --a------ c:\windows\system32\mplvpx.dll 2008-12-02 22:00 . 2008-12-02 22:00 118,784 --a------ c:\windows\system32\ac3acm.acm 2008-12-02 22:00 . 2008-12-02 22:00 106,496 --a------ c:\windows\system32\lmpgspl.ax 2008-12-02 22:00 . 2008-12-02 22:00 94,208 --a------ c:\windows\system32\lmpgvd.ax 2008-12-02 22:00 . 2008-12-02 22:00 86,528 --a------ c:\windows\system32\DVDVideo.ax 2008-12-02 22:00 . 2008-12-02 22:00 9,216 --a------ c:\windows\system32\cpuinf32.dll 2008-12-02 21:58 . 2008-12-02 21:58 <DIR> d-------- c:\program files\Codec Pack - All In 1 2008-12-02 21:39 . 2008-12-02 21:48 <DIR> d-------- c:\program files\DivX 2008-12-02 21:29 . 2008-12-02 21:29 <DIR> d-------- c:\documents and settings\hawaj\Dane aplikacji\CyberLink 2008-12-02 21:21 . 2008-12-02 21:21 <DIR> d-------- c:\program files\Skype 2008-12-02 21:21 . 2008-12-02 21:21 <DIR> d-------- c:\program files\Common Files\Skype 2008-12-02 21:21 . 2008-12-05 18:05 <DIR> d-------- c:\documents and settings\hawaj\Dane aplikacji\Skype 2008-12-02 21:21 . 2008-12-02 21:21 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\Skype 2008-12-02 21:20 . 2008-12-02 21:20 <DIR> d-------- c:\program files\QuickTime 2008-12-02 21:20 . 2008-12-02 21:20 <DIR> d-------- c:\program files\Common Files\Apple 2008-12-02 21:20 . 2008-12-02 21:20 <DIR> d-------- c:\program files\Apple Software Update 2008-12-02 21:20 . 2008-12-02 21:20 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\Apple Computer 2008-12-02 21:20 . 2008-12-02 21:20 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\Apple 2008-12-02 21:16 . 2008-12-02 21:16 <DIR> d-------- c:\program files\IrfanView 2008-12-02 21:02 . 2008-12-02 21:44 <DIR> d-------- c:\windows\SxsCaPendDel 2008-12-02 20:46 . 2008-12-04 10:43 <DIR> d-------- c:\program files\eMule 2008-12-02 19:09 . 2008-12-02 19:09 <DIR> d-------- c:\documents and settings\hawaj\Dane aplikacji\Gadu-Gadu 2008-12-02 17:29 . 2008-12-02 17:29 <DIR> d-------- c:\program files\InCode Solutions 2008-12-02 16:12 . 2008-12-02 16:12 <DIR> d-------- c:\program files\NAPI-PROJEKT 2008-12-02 16:11 . 2008-12-02 21:02 <DIR> d-------- c:\program files\Common Files\Adobe 2008-12-02 14:20 . 2008-12-02 19:24 <DIR> d-------- c:\documents and settings\hawaj\Gadu-Gadu 2008-12-02 14:19 . 2008-12-02 14:20 <DIR> d-------- c:\program files\Gadu-Gadu 2008-12-02 14:18 . 2008-12-02 14:18 <DIR> d-------- c:\program files\CyberLink 2008-12-02 14:18 . 2008-12-02 14:18 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\CyberLink 2008-12-02 14:17 . 2008-12-02 14:18 <DIR> d-------- c:\program files\PowerDVD 2008-12-02 14:15 . 2008-12-03 22:37 <DIR> d-------- c:\program files\BitLord 2008-12-02 14:12 . 2008-12-02 14:13 <DIR> d-------- c:\program files\Winamp 2008-12-02 14:12 . 2008-12-02 14:13 <DIR> d-------- c:\documents and settings\hawaj\Dane aplikacji\Winamp 2008-12-02 14:08 . 2008-12-02 14:08 <DIR> d-------- c:\windows\OPTIONS 2008-12-02 14:06 . 2008-12-02 14:06 <DIR> d-------- c:\program files\DAEMON Tools 2008-12-02 14:06 . 2008-12-02 14:06 223,128 --a------ c:\windows\system32\drivers\dtscsi.sys 2008-12-02 14:04 . 2008-12-02 14:04 642,560 --a------ c:\windows\system32\drivers\sptd.sys 2008-12-02 14:04 . 2008-12-02 14:04 96,256 --a------ c:\windows\system32\drivers\sptd3789.sys 2008-12-02 14:03 . 2008-12-04 10:42 <DIR> d-------- c:\program files\EasyCleaner 2008-12-02 14:01 . 2008-12-05 16:20 <DIR> d-------- c:\program files\ALLPlayer 2008-12-02 13:07 . 2008-12-02 13:07 <DIR> d---s---- c:\windows\system32\Microsoft 2008-12-02 13:07 . 2008-12-02 13:07 <DIR> d-------- c:\documents and settings\LocalService\Menu Start 2008-12-02 13:02 . 2008-12-02 13:08 316,640 --a------ c:\windows\WMSysPr9.prx 2008-12-02 12:59 . 2008-12-02 12:59 <DIR> d-------- c:\windows\ServicePackFiles 2008-12-02 12:56 . 2004-08-03 22:43 15,872 --a------ c:\windows\system32\spupdsvc.exe 2008-12-02 12:54 . 2008-12-02 13:01 <DIR> d-------- c:\windows\EHome 2008-12-02 11:26 . 2004-08-03 23:15 145,792 --a------ c:\windows\system32\drivers\portcls.sys 2008-12-02 11:26 . 2004-08-03 23:15 140,928 --a------ c:\windows\system32\drivers\ks.sys 2008-12-02 11:26 . 2004-08-04 00:44 130,048 --a------ c:\windows\system32\ksproxy.ax 2008-12-02 11:26 . 2002-11-20 17:06 126,976 --------- c:\windows\system32\NVNFINST.DLL 2008-12-02 11:26 . 2004-08-03 23:08 60,288 --a------ c:\windows\system32\drivers\drmk.sys 2008-12-02 11:26 . 2004-08-03 23:08 48,640 --a------ c:\windows\system32\drivers\stream.sys 2008-12-02 11:26 . 2004-08-04 00:44 4,096 --a------ c:\windows\system32\ksuser.dll 2008-12-02 11:21 . 2002-09-23 10:37 80,896 -ra------ c:\windows\system32\drivers\NVENET.sys 2008-12-02 11:21 . 2002-09-06 11:24 13,568 -ra------ c:\windows\system32\drivers\nv_agp.SYS 2008-12-02 11:21 . 2002-09-23 10:37 1,024 -ra------ c:\windows\system32\drivers\jedih2rx.bin 2008-12-02 11:21 . 2002-09-23 10:37 122 -ra------ c:\windows\system32\drivers\ramsed.bin 2008-12-02 11:21 . 2002-09-23 10:37 42 -ra------ c:\windows\system32\drivers\jedireg.pat 2008-12-02 11:18 . 2008-12-02 11:18 0 --a------ c:\windows\nsreg.dat 2008-12-02 11:03 . 2001-10-26 18:28 13,463,552 --a--c--- c:\windows\system32\dllcache\hwxjpn.dll 2008-12-02 11:02 . 2001-10-26 17:29 2,134,528 --a--c--- c:\windows\system32\dllcache\EXCH_smtpsnap.dll 2008-12-02 11:01 . 2001-10-26 18:29 73,728 --a--c--- c:\windows\system32\dllcache\icwtutor.exe 2008-12-02 11:01 . 2001-10-26 18:28 65,536 --a--c--- c:\windows\system32\dllcache\icwres.dll 2008-12-02 11:01 . 2001-10-26 18:29 40,960 --a--c--- c:\windows\system32\dllcache\trialoc.dll 2008-12-02 11:01 . 2008-12-02 11:01 749 -rah----- c:\windows\WindowsShell.Manifest 2008-12-02 11:01 . 2008-12-02 11:01 749 -rah----- c:\windows\system32\wuaucpl.cpl.manifest 2008-12-02 11:01 . 2008-12-02 11:01 749 -rah----- c:\windows\system32\sapi.cpl.manifest 2008-12-02 11:01 . 2008-12-02 11:01 749 -rah----- c:\windows\system32\nwc.cpl.manifest 2008-12-02 11:01 . 2008-12-02 11:01 749 -rah----- c:\windows\system32\ncpa.cpl.manifest 2008-12-02 11:01 . 2008-12-02 11:01 488 -rah----- c:\windows\system32\logonui.exe.manifest 2008-12-02 10:56 . 2001-10-27 12:35 1,085,938 -ra------ c:\windows\SET16.tmp 2008-12-02 10:56 . 2001-10-27 12:34 808,524 --a--c--- c:\windows\system32\dllcache\NT5IIS.CAT 2008-12-02 10:56 . 2001-10-27 12:34 399,670 --a--c--- c:\windows\system32\dllcache\MAPIMIG.CAT 2008-12-02 10:56 . 2001-10-27 12:34 37,509 --a--c--- c:\windows\system32\dllcache\MW770.CAT 2008-12-02 10:56 . 2001-10-26 18:29 24,661 --a------ c:\windows\system32\spxcoins.dll 2008-12-02 10:56 . 2001-10-26 18:29 24,661 --a--c--- c:\windows\system32\dllcache\spxcoins.dll 2008-12-02 10:56 . 2001-10-27 12:34 13,923 -ra------ c:\windows\SET22.tmp 2008-12-02 10:56 . 2001-10-27 12:34 13,497 --a--c--- c:\windows\system32\dllcache\HPCRDP.CAT 2008-12-02 10:56 . 2001-10-26 18:29 13,312 --a------ c:\windows\system32\irclass.dll 2008-12-02 10:56 . 2001-10-26 18:29 13,312 --a--c--- c:\windows\system32\dllcache\irclass.dll 2008-12-02 10:56 . 2001-10-27 12:34 8,599 --a--c--- c:\windows\system32\dllcache\IASNT4.CAT 2008-12-02 10:56 . 2001-08-23 14:00 7,382 --a--c--- c:\windows\system32\dllcache\OEMBIOS.CAT 2008-12-02 09:47 . 2008-12-03 23:47 <DIR> d-------- c:\program files\Avast4 2008-12-02 09:47 . 2003-03-18 21:20 1,060,864 --a------ c:\windows\system32\MFC71.dll 2008-12-02 09:47 . 2003-03-18 20:14 499,712 --a------ c:\windows\system32\MSVCP71.dll 2008-12-02 09:47 . 2003-02-21 04:42 348,160 --a------ c:\windows\system32\MSVCR71.dll 2008-12-02 09:34 . 2008-12-02 09:34 <DIR> d---s---- c:\documents and settings\hawaj\UserData 2008-12-02 09:24 . 2008-12-02 14:18 <DIR> d--h----- c:\program files\InstallShield Installation Information 2008-12-02 09:23 . 2008-12-02 09:23 <DIR> d-------- c:\program files\SAGEM 2008-12-02 09:23 . 2008-12-02 14:02 <DIR> d-------- c:\program files\Common Files\InstallShield . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-12-02 21:00 755,027 ----a-w c:\windows\system32\xvidcore.dll 2008-12-02 08:24 23 ----a-w c:\windows\system32\drivers\adidsl.cfg 2008-12-02 02:40 --------- d-----w c:\program files\microsoft frontpage 2008-12-02 02:39 --------- d-----w c:\program files\Usługi online 2008-10-27 09:04 70,992 ----a-w c:\windows\system32\XAPOFX1_2.dll 2008-10-27 09:04 514,384 ----a-w c:\windows\system32\XAudio2_3.dll 2008-10-27 09:04 235,856 ----a-w c:\windows\system32\xactengine3_3.dll 2008-10-27 09:04 23,376 ----a-w c:\windows\system32\X3DAudio1_5.dll 2008-10-10 03:52 452,440 ----a-w c:\windows\system32\d3dx10_40.dll 2008-10-10 03:52 4,379,984 ----a-w c:\windows\system32\D3DX9_40.dll 2008-10-10 03:52 2,036,576 ----a-w c:\windows\system32\D3DCompiler_40.dll . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360] "Gadu-Gadu"="c:\program files\Gadu-Gadu\gg.exe" [2008-03-20 2127296] "ALLUpdate"="c:\program files\ALLPlayer\ALLUpdate.exe" [2008-11-24 869888] "Skype"="c:\program files\Skype\Phone\Skype.exe" [2008-11-07 21633320] "MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2004-08-04 1667584] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "DAEMON Tools"="c:\program files\DAEMON Tools\daemon.exe" [2005-12-10 133016] "RemoteControl"="c:\program files\PowerDVD\PDVDServ.exe" [2003-10-31 32768] "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672] "QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2008-09-06 413696] "egui"="c:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2008-07-01 1447168] "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2008-12-04 136600] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2004-08-04 15360] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce] "tscuninstall"="c:\windows\system32\tscupgrd.exe" [2004-08-04 44544] c:\documents and settings\All Users\Menu Start\Programy\Autostart\ DSLMON.lnk - c:\program files\SAGEM\SAGEM F@st 800-840\dslmon.exe [2008-12-02 962661] Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-02-13 83360] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ati5ejxx.sys] @="Driver" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ati7txxx.sys] @="Driver" [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) "DisableNotifications"= 1 (0x1) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\Skype\\Phone\\Skype.exe"= R1 epfwtdir;epfwtdir;c:\windows\system32\DRIVERS\epfwtdir.sys [2008-07-01 34312] R2 ekrn;Eset Service;"c:\program files\ESET\ESET NOD32 Antivirus\ekrn.exe" [2008-07-01 468224] S0 ati5ejxx;ati5ejxx;c:\windows\system32\Drivers\ati5ejxx.sys [] S0 ati7txxx;ati7txxx;c:\windows\system32\Drivers\ati7txxx.sys [] . - - - - USUNIĘTO PUSTE WPISY - - - - HKCU-Run-RemoveIT Pro XT - c:\program files\InCode Solutions\RemoveIT Pro v4-Trial\removeit.exe HKLM-Run-WinampAgent - c:\program files\Winamp\winampa.exe SafeBoot-ati4glxx.sys . ------- Skan uzupełniający ------- . uStart Page = hxxp://search.bearshare.com/pl/ IE: &??????? ? Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000 FireFox -: Profile - c:\documents and settings\hawaj\Dane aplikacji\Mozilla\Firefox\Profiles\owyp8cq3.default\ FireFox -: prefs.js - STARTUP.HOMEPAGE - onet.pl FF -: plugin - c:\program files\Java\jre6\bin\new_plugin\npdeploytk.dll FF -: plugin - c:\program files\Java\jre6\bin\new_plugin\npjp2.dll FF -: plugin - c:\program files\Mozilla Firefox\plugins\npdeploytk.dll . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-12-05 18:09:30 Windows 5.1.2600 Dodatek Service Pack 2 NTFS skanowanie ukrytych procesów ... skanowanie ukrytych wpisów autostartu ... skanowanie ukrytych plików ... skanowanie pomyślnie ukończone ukryte pliki: 0 ************************************************************************** . ------------------------ Pozostałe uruchomione procesy ------------------------ . c:\program files\Java\jre6\bin\jqs.exe c:\program files\Skype\Plugin Manager\skypePM.exe c:\windows\system32\wscntfy.exe . ************************************************************************** . Czas ukończenia: 2008-12-05 18:10:36 - komputer został uruchomiony ponownie ComboFix-quarantined-files.txt 2008-12-05 17:10:29 Przed: 19 948 498 944 bajtów wolnych Po: 19,905,409,024 bajtów wolnych WindowsXP-KB310994-SP2-Pro-BootDisk-PLK.exe [boot loader] timeout=2 default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS [operating systems] c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /fastdetect /NoExecute=OptIn 236

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 18:11:12, on 2008-12-05 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\Program Files\DAEMON Tools\daemon.exe C:\Program Files\PowerDVD\PDVDServ.exe C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe C:\Program Files\Java\jre6\bin\jusched.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Gadu-Gadu\gg.exe C:\Program Files\ALLPlayer\ALLUpdate.exe C:\Program Files\Skype\Phone\Skype.exe C:\Program Files\Messenger\msmsgs.exe C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe C:\Program Files\Skype\Plugin Manager\skypePM.exe C:\WINDOWS\system32\wuauclt.exe C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\explorer.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://search.bearshare.com/pl/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033 O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\PowerDVD\PDVDServ.exe" O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe" O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - HKCU\..\Run: [ALLUpdate] "C:\Program Files\ALLPlayer\ALLUpdate.exe" "sleep" O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\S-1-5-18\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user') O4 - HKUS\.DEFAULT\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'Default user') O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe -- End of file - 4556 bytes

**Posty:** 18165 · przez **wojtas** 05 Gru 2008, 20:35

Otworz notatnik i wklej w nim to:

File::
c:\windows\system32\Drivers\ati5ejxx.sys
c:\windows\system32\Drivers\ati7txxx.sys

Registry::
[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ati5ejxx.sys]
[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ati7txxx.sys]

Driver::
ati7txxx
ati5ejxx

>>Plik>>Zapisz jako... >>> CFScript
Przeciągnij i upuść plik CFScript.txt na plik ComboFix.exe
-->

Ma się rozpocząć usuwanie. (i powstanie log).Daj ten log, który powstanie w trakcie usuwania.

**Posty:** 4 · przez **hawaj10** 05 Gru 2008, 22:55

Podaje log:

Kod: Zaznacz wszystko: ComboFix 08-12-05.01 - hawaj 2008-12-05 21:47:30.2 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.226 [GMT 1:00] Uruchomiony z: c:\documents and settings\hawaj\Pulpit\ComboFix.exe Użyto następujących komend :: c:\documents and settings\hawaj\Pulpit\CFScript.txt * Utworzono nowy punkt przywracania * Resident AV is active FILE :: c:\windows\system32\Drivers\ati5ejxx.sys c:\windows\system32\Drivers\ati7txxx.sys . ((((((((((((((((((((((((((((((((((((((( Usunięto ))))))))))))))))))))))))))))))))))))))))))))))))) . . ((((((((((((((((((((((((((((((((((((((( Sterowniki/Usługi ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Legacy_ATI7TXXX -------\Service_ati5ejxx -------\Service_ati7txxx ((((((((((((((((((((((((( Pliki utworzone od 2008-11-05 do 2008-12-05 ))))))))))))))))))))))))))))))) . 2008-12-05 17:57 . 2008-12-05 17:57 578,560 --a--c--- c:\windows\system32\dllcache\user32.dll 2008-12-05 17:56 . 2008-12-05 17:56 <DIR> d-------- c:\windows\ERUNT 2008-12-05 17:52 . 2008-12-05 18:02 <DIR> d-------- C:\SDFix 2008-12-04 23:04 . 2008-12-04 23:04 <DIR> d-------- c:\windows\Sun 2008-12-04 23:00 . 2008-12-04 23:00 <DIR> d--h----- c:\windows\$hf_mig$ 2008-12-04 22:52 . 2008-12-04 22:52 410,984 --a------ c:\windows\system32\deploytk.dll 2008-12-04 22:52 . 2008-12-04 22:52 73,728 --a------ c:\windows\system32\javacpl.cpl 2008-12-04 22:51 . 2008-12-04 22:51 <DIR> d-------- c:\program files\Java 2008-12-04 20:58 . 2008-12-04 20:58 <DIR> d-------- c:\program files\Trend Micro 2008-12-04 20:49 . 2008-12-04 20:55 <DIR> d-a------ c:\documents and settings\All Users\Dane aplikacji\TEMP 2008-12-04 15:32 . 2008-12-04 15:32 <DIR> d-------- c:\documents and settings\hawaj\Dane aplikacji\Malwarebytes 2008-12-04 15:32 . 2008-12-04 15:32 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\Malwarebytes 2008-12-04 00:01 . 2008-12-04 16:03 <DIR> d-------- c:\documents and settings\hawaj\Dane aplikacji\skypePM 2008-12-04 00:01 . 2008-12-04 00:01 56 --ah----- c:\windows\system32\ezsidmv.dat 2008-12-03 23:16 . 2008-12-03 23:16 <DIR> d-------- c:\program files\ESET 2008-12-03 23:16 . 2008-12-03 23:16 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\ESET 2008-12-03 20:16 . 2008-12-03 20:16 <DIR> d-------- c:\documents and settings\hawaj\Dane aplikacji\BESTplayer 2008-12-03 19:46 . 2008-12-05 18:27 49 --a------ c:\windows\NeroDigital.ini 2008-12-03 12:02 . 2008-12-03 12:07 <DIR> d-------- c:\program files\Fahrenheit 2008-12-03 09:58 . 2008-12-03 09:58 391 --a------ c:\windows\ODBC.INI 2008-12-03 09:56 . 2008-12-03 09:56 <DIR> d-------- c:\windows\ShellNew 2008-12-03 09:51 . 2008-12-03 09:51 <DIR> d-------- c:\program files\Common Files\Ahead 2008-12-03 09:51 . 2008-12-03 09:51 <DIR> d-------- c:\program files\Ahead 2008-12-03 09:51 . 2001-07-06 14:41 569,344 -ra------ c:\windows\system32\imagr5.dll 2008-12-03 09:51 . 2001-07-06 12:44 544,768 -ra------ c:\windows\system32\imagx5.dll 2008-12-03 09:51 . 2001-07-06 18:24 283,920 -ra------ c:\windows\system32\ImagXpr5.dll 2008-12-03 09:51 . 2001-06-26 08:15 38,912 -ra------ c:\windows\system32\picn20.dll 2008-12-02 22:04 . 2008-12-02 22:04 <DIR> d-------- c:\program files\Real Alternative 2008-12-02 22:04 . 2008-12-02 22:04 <DIR> d-------- c:\program files\Media Player Classic 2008-12-02 22:00 . 2008-12-02 22:00 1,415,680 --a------ c:\windows\system32\WMV9VCM.dll 2008-12-02 22:00 . 2008-12-02 22:00 892,928 --a------ c:\windows\system32\iconv.dll 2008-12-02 22:00 . 2008-12-02 22:00 301,568 --a------ c:\windows\system32\l3codecp.acm 2008-12-02 22:00 . 2008-12-02 22:00 245,760 --a------ c:\windows\system32\mplvpx.dll 2008-12-02 22:00 . 2008-12-02 22:00 118,784 --a------ c:\windows\system32\ac3acm.acm 2008-12-02 22:00 . 2008-12-02 22:00 106,496 --a------ c:\windows\system32\lmpgspl.ax 2008-12-02 22:00 . 2008-12-02 22:00 94,208 --a------ c:\windows\system32\lmpgvd.ax 2008-12-02 22:00 . 2008-12-02 22:00 86,528 --a------ c:\windows\system32\DVDVideo.ax 2008-12-02 22:00 . 2008-12-02 22:00 9,216 --a------ c:\windows\system32\cpuinf32.dll 2008-12-02 21:58 . 2008-12-02 21:58 <DIR> d-------- c:\program files\Codec Pack - All In 1 2008-12-02 21:39 . 2008-12-02 21:48 <DIR> d-------- c:\program files\DivX 2008-12-02 21:29 . 2008-12-02 21:29 <DIR> d-------- c:\documents and settings\hawaj\Dane aplikacji\CyberLink 2008-12-02 21:21 . 2008-12-02 21:21 <DIR> d-------- c:\program files\Skype 2008-12-02 21:21 . 2008-12-02 21:21 <DIR> d-------- c:\program files\Common Files\Skype 2008-12-02 21:21 . 2008-12-05 21:26 <DIR> d-------- c:\documents and settings\hawaj\Dane aplikacji\Skype 2008-12-02 21:21 . 2008-12-02 21:21 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\Skype 2008-12-02 21:20 . 2008-12-02 21:20 <DIR> d-------- c:\program files\QuickTime 2008-12-02 21:20 . 2008-12-02 21:20 <DIR> d-------- c:\program files\Common Files\Apple 2008-12-02 21:20 . 2008-12-02 21:20 <DIR> d-------- c:\program files\Apple Software Update 2008-12-02 21:20 . 2008-12-02 21:20 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\Apple Computer 2008-12-02 21:20 . 2008-12-02 21:20 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\Apple 2008-12-02 21:16 . 2008-12-02 21:16 <DIR> d-------- c:\program files\IrfanView 2008-12-02 21:02 . 2008-12-02 21:44 <DIR> d-------- c:\windows\SxsCaPendDel 2008-12-02 20:46 . 2008-12-04 10:43 <DIR> d-------- c:\program files\eMule 2008-12-02 19:09 . 2008-12-02 19:09 <DIR> d-------- c:\documents and settings\hawaj\Dane aplikacji\Gadu-Gadu 2008-12-02 17:29 . 2008-12-02 17:29 <DIR> d-------- c:\program files\InCode Solutions 2008-12-02 16:12 . 2008-12-02 16:12 <DIR> d-------- c:\program files\NAPI-PROJEKT 2008-12-02 16:11 . 2008-12-02 21:02 <DIR> d-------- c:\program files\Common Files\Adobe 2008-12-02 14:20 . 2008-12-02 19:24 <DIR> d-------- c:\documents and settings\hawaj\Gadu-Gadu 2008-12-02 14:19 . 2008-12-02 14:20 <DIR> d-------- c:\program files\Gadu-Gadu 2008-12-02 14:18 . 2008-12-02 14:18 <DIR> d-------- c:\program files\CyberLink 2008-12-02 14:18 . 2008-12-02 14:18 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\CyberLink 2008-12-02 14:17 . 2008-12-02 14:18 <DIR> d-------- c:\program files\PowerDVD 2008-12-02 14:15 . 2008-12-03 22:37 <DIR> d-------- c:\program files\BitLord 2008-12-02 14:12 . 2008-12-02 14:13 <DIR> d-------- c:\program files\Winamp 2008-12-02 14:12 . 2008-12-02 14:13 <DIR> d-------- c:\documents and settings\hawaj\Dane aplikacji\Winamp 2008-12-02 14:08 . 2008-12-02 14:08 <DIR> d-------- c:\windows\OPTIONS 2008-12-02 14:06 . 2008-12-02 14:06 <DIR> d-------- c:\program files\DAEMON Tools 2008-12-02 14:06 . 2008-12-02 14:06 223,128 --a------ c:\windows\system32\drivers\dtscsi.sys 2008-12-02 14:04 . 2008-12-02 14:04 642,560 --a------ c:\windows\system32\drivers\sptd.sys 2008-12-02 14:04 . 2008-12-02 14:04 96,256 --a------ c:\windows\system32\drivers\sptd3789.sys 2008-12-02 14:03 . 2008-12-04 10:42 <DIR> d-------- c:\program files\EasyCleaner 2008-12-02 14:01 . 2008-12-05 16:20 <DIR> d-------- c:\program files\ALLPlayer 2008-12-02 13:07 . 2008-12-02 13:07 <DIR> d---s---- c:\windows\system32\Microsoft 2008-12-02 13:07 . 2008-12-02 13:07 <DIR> d-------- c:\documents and settings\LocalService\Menu Start 2008-12-02 13:02 . 2008-12-02 13:08 316,640 --a------ c:\windows\WMSysPr9.prx 2008-12-02 12:59 . 2008-12-02 12:59 <DIR> d-------- c:\windows\ServicePackFiles 2008-12-02 12:56 . 2004-08-03 22:43 15,872 --a------ c:\windows\system32\spupdsvc.exe 2008-12-02 12:54 . 2008-12-02 13:01 <DIR> d-------- c:\windows\EHome 2008-12-02 11:26 . 2004-08-03 23:15 145,792 --a------ c:\windows\system32\drivers\portcls.sys 2008-12-02 11:26 . 2004-08-03 23:15 140,928 --a------ c:\windows\system32\drivers\ks.sys 2008-12-02 11:26 . 2004-08-04 00:44 130,048 --a------ c:\windows\system32\ksproxy.ax 2008-12-02 11:26 . 2002-11-20 17:06 126,976 --------- c:\windows\system32\NVNFINST.DLL 2008-12-02 11:26 . 2004-08-03 23:08 60,288 --a------ c:\windows\system32\drivers\drmk.sys 2008-12-02 11:26 . 2004-08-03 23:08 48,640 --a------ c:\windows\system32\drivers\stream.sys 2008-12-02 11:26 . 2004-08-04 00:44 4,096 --a------ c:\windows\system32\ksuser.dll 2008-12-02 11:21 . 2002-09-23 10:37 80,896 -ra------ c:\windows\system32\drivers\NVENET.sys 2008-12-02 11:21 . 2002-09-06 11:24 13,568 -ra------ c:\windows\system32\drivers\nv_agp.SYS 2008-12-02 11:21 . 2002-09-23 10:37 1,024 -ra------ c:\windows\system32\drivers\jedih2rx.bin 2008-12-02 11:21 . 2002-09-23 10:37 122 -ra------ c:\windows\system32\drivers\ramsed.bin 2008-12-02 11:21 . 2002-09-23 10:37 42 -ra------ c:\windows\system32\drivers\jedireg.pat 2008-12-02 11:18 . 2008-12-02 11:18 0 --a------ c:\windows\nsreg.dat 2008-12-02 11:03 . 2001-10-26 18:28 13,463,552 --a--c--- c:\windows\system32\dllcache\hwxjpn.dll 2008-12-02 11:02 . 2001-10-26 17:29 2,134,528 --a--c--- c:\windows\system32\dllcache\EXCH_smtpsnap.dll 2008-12-02 11:01 . 2001-10-26 18:29 73,728 --a--c--- c:\windows\system32\dllcache\icwtutor.exe 2008-12-02 11:01 . 2001-10-26 18:28 65,536 --a--c--- c:\windows\system32\dllcache\icwres.dll 2008-12-02 11:01 . 2001-10-26 18:29 40,960 --a--c--- c:\windows\system32\dllcache\trialoc.dll 2008-12-02 11:01 . 2008-12-02 11:01 749 -rah----- c:\windows\WindowsShell.Manifest 2008-12-02 11:01 . 2008-12-02 11:01 749 -rah----- c:\windows\system32\wuaucpl.cpl.manifest 2008-12-02 11:01 . 2008-12-02 11:01 749 -rah----- c:\windows\system32\sapi.cpl.manifest 2008-12-02 11:01 . 2008-12-02 11:01 749 -rah----- c:\windows\system32\nwc.cpl.manifest 2008-12-02 11:01 . 2008-12-02 11:01 749 -rah----- c:\windows\system32\ncpa.cpl.manifest 2008-12-02 11:01 . 2008-12-02 11:01 488 -rah----- c:\windows\system32\logonui.exe.manifest 2008-12-02 10:56 . 2001-10-27 12:35 1,085,938 -ra------ c:\windows\SET16.tmp 2008-12-02 10:56 . 2001-10-27 12:34 808,524 --a--c--- c:\windows\system32\dllcache\NT5IIS.CAT 2008-12-02 10:56 . 2001-10-27 12:34 399,670 --a--c--- c:\windows\system32\dllcache\MAPIMIG.CAT 2008-12-02 10:56 . 2001-10-27 12:34 37,509 --a--c--- c:\windows\system32\dllcache\MW770.CAT 2008-12-02 10:56 . 2001-10-26 18:29 24,661 --a------ c:\windows\system32\spxcoins.dll 2008-12-02 10:56 . 2001-10-26 18:29 24,661 --a--c--- c:\windows\system32\dllcache\spxcoins.dll 2008-12-02 10:56 . 2001-10-27 12:34 13,923 -ra------ c:\windows\SET22.tmp 2008-12-02 10:56 . 2001-10-27 12:34 13,497 --a--c--- c:\windows\system32\dllcache\HPCRDP.CAT 2008-12-02 10:56 . 2001-10-26 18:29 13,312 --a------ c:\windows\system32\irclass.dll 2008-12-02 10:56 . 2001-10-26 18:29 13,312 --a--c--- c:\windows\system32\dllcache\irclass.dll 2008-12-02 10:56 . 2001-10-27 12:34 8,599 --a--c--- c:\windows\system32\dllcache\IASNT4.CAT 2008-12-02 10:56 . 2001-08-23 14:00 7,382 --a--c--- c:\windows\system32\dllcache\OEMBIOS.CAT 2008-12-02 09:47 . 2008-12-03 23:47 <DIR> d-------- c:\program files\Avast4 2008-12-02 09:47 . 2003-03-18 21:20 1,060,864 --a------ c:\windows\system32\MFC71.dll 2008-12-02 09:47 . 2003-03-18 20:14 499,712 --a------ c:\windows\system32\MSVCP71.dll 2008-12-02 09:47 . 2003-02-21 04:42 348,160 --a------ c:\windows\system32\MSVCR71.dll 2008-12-02 09:34 . 2008-12-02 09:34 <DIR> d---s---- c:\documents and settings\hawaj\UserData 2008-12-02 09:24 . 2008-12-02 14:18 <DIR> d--h----- c:\program files\InstallShield Installation Information 2008-12-02 09:23 . 2008-12-02 09:23 <DIR> d-------- c:\program files\SAGEM 2008-12-02 09:23 . 2008-12-02 14:02 <DIR> d-------- c:\program files\Common Files\InstallShield . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-12-02 21:00 755,027 ----a-w c:\windows\system32\xvidcore.dll 2008-12-02 08:24 23 ----a-w c:\windows\system32\drivers\adidsl.cfg 2008-12-02 02:40 --------- d-----w c:\program files\microsoft frontpage 2008-12-02 02:39 --------- d-----w c:\program files\Usługi online 2008-10-27 09:04 70,992 ----a-w c:\windows\system32\XAPOFX1_2.dll 2008-10-27 09:04 514,384 ----a-w c:\windows\system32\XAudio2_3.dll 2008-10-27 09:04 235,856 ----a-w c:\windows\system32\xactengine3_3.dll 2008-10-27 09:04 23,376 ----a-w c:\windows\system32\X3DAudio1_5.dll 2008-10-10 03:52 452,440 ----a-w c:\windows\system32\d3dx10_40.dll 2008-10-10 03:52 4,379,984 ----a-w c:\windows\system32\D3DX9_40.dll 2008-10-10 03:52 2,036,576 ----a-w c:\windows\system32\D3DCompiler_40.dll . ((((((((((((((((((((((((((((( snapshot@2008-12-05_18.10.01.16 ))))))))))))))))))))))))))))))))))))))))) . + 2008-12-05 20:49:55 16,384 ----atw c:\windows\Temp\Perflib_Perfdata_644.dat . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360] "Gadu-Gadu"="c:\program files\Gadu-Gadu\gg.exe" [2008-03-20 2127296] "ALLUpdate"="c:\program files\ALLPlayer\ALLUpdate.exe" [2008-11-24 869888] "Skype"="c:\program files\Skype\Phone\Skype.exe" [2008-11-07 21633320] "MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2004-08-04 1667584] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "DAEMON Tools"="c:\program files\DAEMON Tools\daemon.exe" [2005-12-10 133016] "RemoteControl"="c:\program files\PowerDVD\PDVDServ.exe" [2003-10-31 32768] "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672] "QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2008-09-06 413696] "egui"="c:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2008-07-01 1447168] "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2008-12-04 136600] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2004-08-04 15360] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce] "tscuninstall"="c:\windows\system32\tscupgrd.exe" [2004-08-04 44544] c:\documents and settings\All Users\Menu Start\Programy\Autostart\ DSLMON.lnk - c:\program files\SAGEM\SAGEM F@st 800-840\dslmon.exe [2008-12-02 962661] Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-02-13 83360] [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) "DisableNotifications"= 1 (0x1) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\Skype\\Phone\\Skype.exe"= R1 epfwtdir;epfwtdir;c:\windows\system32\DRIVERS\epfwtdir.sys [2008-07-01 34312] R2 ekrn;Eset Service;"c:\program files\ESET\ESET NOD32 Antivirus\ekrn.exe" [2008-07-01 468224] . . ------- Skan uzupełniający ------- . uStart Page = hxxp://search.bearshare.com/pl/ IE: &??????? ? Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000 FireFox -: Profile - c:\documents and settings\hawaj\Dane aplikacji\Mozilla\Firefox\Profiles\owyp8cq3.default\ FireFox -: prefs.js - STARTUP.HOMEPAGE - onet.pl FF -: plugin - c:\program files\Java\jre6\bin\new_plugin\npdeploytk.dll FF -: plugin - c:\program files\Java\jre6\bin\new_plugin\npjp2.dll FF -: plugin - c:\program files\Mozilla Firefox\plugins\npdeploytk.dll . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-12-05 21:50:03 Windows 5.1.2600 Dodatek Service Pack 2 NTFS skanowanie ukrytych procesów ... skanowanie ukrytych wpisów autostartu ... skanowanie ukrytych plików ... skanowanie pomyślnie ukończone ukryte pliki: 0 ************************************************************************** . ------------------------ Pozostałe uruchomione procesy ------------------------ . c:\program files\Java\jre6\bin\jqs.exe c:\program files\Skype\Plugin Manager\skypePM.exe c:\windows\system32\wscntfy.exe . ************************************************************************** . Czas ukończenia: 2008-12-05 21:51:11 - komputer został uruchomiony ponownie [hawaj] ComboFix-quarantined-files.txt 2008-12-05 20:51:04 ComboFix2.txt 2008-12-05 17:10:37 Przed: 19 930 513 408 bajtów wolnych Po: 19,923,001,344 bajtów wolnych 230

Dodano Dzisiaj, 02:10:
Panowie pomóżcie bo mam net 4 mb/s a chodzi jak 128kb/s. Dramat !