Błąd przy uruchamianiu programów

**Posty:** 2 · przez **Drakula** 15 Wrz 2008, 23:00

Podczas uruchamiania nowozainstalowanych (niektorych starych rowniez) aplikacji (programow, gier) wyskakuje mi nastepujacy blad:

Antywirus (Avast) nie znajduje zadnego wirusa.

Co z tym zrobic?

**Posty:** 684 · przez **djarta** 16 Wrz 2008, 08:41

Ściągnij -----> ComboFixa,przeskanuj daj log.

=========================================
K.

**Posty:** 2 · przez **Drakula** 16 Wrz 2008, 10:52

Kod: Zaznacz wszystko: ((((((((((((((((((((((((((((((((((((((( Usunięto ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\Documents and Settings\Mateusz\Cookies\mateusz@adidm07.idmnet[1].txt C:\Documents and Settings\Mateusz\Cookies\mateusz@insightexpressai[1].txt C:\Documents and Settings\Mateusz\Cookies\mateusz@nuggad[2].txt C:\Documents and Settings\Mateusz\Cookies\mateusz@tradedoubler[1].txt C:\Program Files\Common Files\{1CE82~1 C:\Program Files\Common Files\Yazzle1122OinUninstaller.exe C:\Program Files\inetget2 C:\Program Files\myglobalsearch C:\Program Files\myglobalsearch\bar\History\search C:\Program Files\newdotnet C:\Program Files\newdotnet\readme.html C:\Program Files\ShoppingReport C:\Program Files\ShoppingReport\Uninst.exe . ((((((((((((((((((((((((( Pliki utworzone od 2008-08-16 do 2008-09-16 ))))))))))))))))))))))))))))))) . 2008-09-16 02:13 . 2008-09-16 02:13 <DIR> d-------- C:\Program Files\Ogonki 97 2008-09-15 12:05 . 2008-09-16 01:43 <DIR> d-------- C:\Program Files\Gľegľ˘ka XP 2008-09-15 12:05 . 2008-09-16 02:27 <DIR> d-------- C:\Documents and Settings\Mateusz\Dane aplikacji\Gzegzolka XP 2008-08-20 01:47 . 2008-08-20 01:47 <DIR> d-------- C:\Program Files\Serif 2008-08-20 01:47 . 2008-08-20 01:47 <DIR> d-------- C:\Documents and Settings\Mateusz\Dane aplikacji\Serif 2008-08-18 10:31 . 2008-09-13 22:26 54,156 --ah----- C:\WINDOWS\QTFont.qfn 2008-08-18 10:31 . 2008-08-18 10:31 1,409 --a------ C:\WINDOWS\QTFont.for . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-09-15 23:43 --------- d-----w C:\Program Files\Gżegżółka XP 2008-09-14 21:50 --------- d-----w C:\Documents and Settings\Mateusz\Dane aplikacji\uTorrent 2008-08-19 23:47 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-07-25 17:25 --------- d-----w C:\Documents and Settings\Mateusz\Dane aplikacji\BearShare 2008-06-20 11:20 1,901 ----a-w C:\WINDOWS\panose.bin 2004-10-01 14:00 40,960 ----a-w C:\Program Files\Uninstall_CDS.exe . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Gadu-Gadu"="C:\Program Files\Gadu-Gadu\gg.exe" [2007-07-09 2119104] "MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 1694208] "DAEMON Tools Lite"="D:\Program Files\DAEMON Tools Lite\daemon.exe" [2008-07-08 486856] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SpeedTouch USB Diagnostics"="C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" [2004-08-06 877568] "WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2006-02-15 35328] "RemoteControl"="C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe" [2003-12-08 32768] "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2006-05-23 282624] "NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 155648] "InCD"="C:\Program Files\Ahead\InCD\InCD.exe" [2005-07-08 1397760] "avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2008-07-19 78008] "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2005-07-20 7110656] "NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2005-07-20 86016] "nwiz"="nwiz.exe" [2005-07-20 C:\WINDOWS\system32\nwiz.exe] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-08-04 15360] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\WBSrv] 2008-03-29 00:52 210168 C:\Program Files\Stardock\Object Desktop\WindowBlinds\WbSrv.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "AppInit_DLLs"=wbsys.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "VIDC.YV12"= yv12vfw.dll [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Adobe Gamma Loader.lnk] path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Adobe Gamma Loader.lnk backup=C:\WINDOWS\pss\Adobe Gamma Loader.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^HP Digital Imaging Monitor.lnk] path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\HP Digital Imaging Monitor.lnk backup=C:\WINDOWS\pss\HP Digital Imaging Monitor.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Microsoft Office.lnk] path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Microsoft Office.lnk backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update] --a------ 2006-02-19 03:41 49152 C:\Program Files\HP\HP Software Update\hpwuSchd2.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LGODDFU] --a------ 2005-04-12 11:11 229376 C:\Program Files\lg_fwupdate\fwupdate.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon] --a------ 2005-07-20 15:07 7110656 C:\WINDOWS\system32\nvcpl.dll [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter] --a------ 2005-07-20 15:07 86016 C:\WINDOWS\system32\nvmctray.dll [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\snpstd] --a------ 2004-06-10 14:48 286720 C:\WINDOWS\vsnpstd.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz] --a------ 2005-07-20 15:07 1519616 C:\WINDOWS\system32\nwiz.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan] -ra------ 2005-06-20 15:42 77824 C:\WINDOWS\SOUNDMAN.EXE [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services] "NVSvc"=2 (0x2) "MySql"=2 (0x2) "InCDsrv"=2 (0x2) "IDriverT"=3 (0x3) "Adobe LM Service"=3 (0x3) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "C:\\Program Files\\Gadu-Gadu\\gg.exe"= "C:\\totalcmd\\TOTALCMD.EXE"= "C:\\usr\\SMTP Server\\localsrv.exe"= "C:\\usr\\apache\\Apache.exe"= "C:\\Program Files\\BearShare\\BearShare.exe"= "D:\\gry\\blobby\\volley.exe"= "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"= "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"= "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"= "C:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"= "C:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"= "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"= "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"= "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"= "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"= "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"= "C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"= "C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"= "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"= "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"= "C:\\Program Files\\Sports Interactive\\Football Manager 2007\\fm.exe"= "C:\\Program Files\\uTorrent\\utorrent.exe"= S0 AFPAnsi;G-DATA Ukrywacz Ansi;C:\WINDOWS\System32\Drivers\AFPAnsi.sys [2002-10-09 14:53] S0 FO_PAnt;FotoOffice VirtualDisc Driver;C:\WINDOWS\System32\Drivers\FO_PAnt.sys [2003-07-17 13:56] S1 aswSP;avast! Self Protection;C:\WINDOWS\system32\DRIVERS\aswSP.syS [2008-07-19 16:35] S2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-07-19 16:37] S2 PSI_SVC_2;Protexis Licensing V2;c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe [2007-07-24 11:15] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{f01245d4-bde9-11dc-9e84-000e50ae2293}] \Shell\AutoRun\command - G:\wfyvpcny.exe \Shell\explore\Command - G:\wfyvpcny.exe \Shell\open\Command - G:\wfyvpcny.exe *Newly Created Service* - PROCEXP90 . - - - - USUNIĘTO PUSTE WPISY - - - - HKLM-Run-CafeNews - C:\Program Files\Press-Service\CafeNews\CN.exe HKU-Default-Run-Picasa Media Detector - C:\Program Files\Picasa2\PicasaMediaDetector.exe HKCU-Explorer_Run-{1CE82338-0BB0-1045-1014-050527050030} - C:\Program Files\Common Files\{1CE82338-0BB0-1045-1014-050527050030}\Update.exe MSConfigStartUp-New - C:\PROGRA~1\NEWDOT~1\NEWDOT~2.DLL MSConfigStartUp-PersonalWeb - C:\Program Files\Claria\PersonalWeb\PersonalWeb.exe . ------- Skan uzupełniający ------- . FireFox -: Profile - C:\Documents and Settings\Mateusz\Dane aplikacji\Mozilla\Firefox\Profiles\t1mz54td.default\ . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-09-16 10:47:06 Windows 5.1.2600 Dodatek Service Pack 2 NTFS skanowanie ukrytych procesów ... skanowanie ukrytych wpisów autostartu ... skanowanie ukrytych plików ... skanowanie pomyślnie ukończone ukryte pliki: 0 ************************************************************************** [HKEY_LOCAL_MACHINE\system\ControlSet003\Services\MySql] "ImagePath"="c:\usr/MYSQL/bin/mysqld.exe" . Czas ukończenia: 2008-09-16 10:50:36 ComboFix-quarantined-files.txt 2008-09-16 08:50:32 Przed: 2,103,574,528 bajt˘w wolnych Po: 7,197,429,760 bajt˘w wolnych 159 --- E O F --- 2008-09-10 11:00:11

**Posty:** 684 · przez **djarta** 16 Wrz 2008, 17:27

1)

Wylecz pendriva lub kartę pamięci
Perlovga Removal Tool
Flash Disinfector
lub format

2)

Wklej do Notatnika:

Kod: Zaznacz wszystko: File:: C:\wfyvpcny.exe D:\wfyvpcny.exe G:\wfyvpcny.exe Registry:: [-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{f01245d4-bde9-11dc-9e84-000e50ae2293}]

>>Plik>>Zapisz jako... >>> CFScript
Przeciągnij i upuść plik CFScript.txt na plik ComboFix.exe
-->

Ma się rozpocząć usuwanie. (i powstanie log).Daj ten log, który powstanie w trakcie usuwania.
Jeśli pójdzie dobrze, to: Po restarcie usuń ręcznie folder C:\Qoobox.

===========================
K.