Błąd przy uruchamianiu windowsa - "temp2.exe-błąd aplikaji"

**Posty:** 503 · przez **Lucky17** 13 Sie 2009, 09:59

Tak jak w temacie do wyboru przyciski "OK" lub "Anuluj"

Oto skan:

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 09:54:42, on 2009-08-13 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\RTHDCPL.EXE C:\Program Files\Razer\Diamondback 3G\razerhid.exe C:\Program Files\Brother\ControlCenter3\brccMCtl.exe C:\WINDOWS\system32\temp1.exe C:\WINDOWS\system32\temp2.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\PnkBstrA.exe C:\WINDOWS\system32\PnkBstrB.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Razer\Diamondback 3G\razertra.exe C:\Program Files\Razer\Diamondback 3G\razerofa.exe C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Nowe Gadu-Gadu\gg.exe C:\Program Files\Nowe Gadu-Gadu\spellchecker_gg.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.yahoo.com/ R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza R3 - URLSearchHook: free-downloads.net Toolbar - {ecdee021-0d17-467f-a1ff-c7a115230949} - C:\Program Files\free-downloads.net\tbfre0.dll F3 - REG:win.ini: load=C:\WINDOWS\svchost.exe O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\ycomp5_6_2_0.dll O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll O2 - BHO: free-downloads.net Toolbar - {ecdee021-0d17-467f-a1ff-c7a115230949} - C:\Program Files\free-downloads.net\tbfre0.dll O3 - Toolbar: &Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\ycomp5_6_2_0.dll O3 - Toolbar: DAEMON Tools Toolbar - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll O3 - Toolbar: free-downloads.net Toolbar - {ecdee021-0d17-467f-a1ff-c7a115230949} - C:\Program Files\free-downloads.net\tbfre0.dll O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [Diamondback] C:\Program Files\Razer\Diamondback 3G\razerhid.exe O4 - HKLM\..\Run: [PPort11reminder] "C:\Program Files\ScanSoft\PaperPort\Ereg\Ereg.exe" -r "C:\Documents and Settings\All Users\Dane aplikacji\ScanSoft\PaperPort\11\Config\Ereg\Ereg.ini O4 - HKLM\..\Run: [ControlCenter3] C:\Program Files\Brother\ControlCenter3\brctrcen.exe /autorun O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe O23 - Service: PnkBstrB - Unknown owner - C:\WINDOWS\system32\PnkBstrB.exe -- End of file - 3836 bytes

**Posty:** 8001 · przez **Okocza** 13 Sie 2009, 10:40

Lucky17, wstaw log z RSIT oczywiście w tagi code a nie quote

**Posty:** 503 · przez **Lucky17** 14 Sie 2009, 09:28

Zrobiłem tak jak kazałeś

Kod: Zaznacz wszystko: Logfile of random's system information tool 1.06 (written by random/random) Run by Lucky at 2009-08-14 09:23:07 Microsoft Windows XP Professional Dodatek Service Pack 2 System drive C: has 2 GB (19%) free of 10 GB Total RAM: 2047 MB (71% free) Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 09:23:10, on 2009-08-14 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\csrss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\RTHDCPL.EXE C:\Program Files\Razer\Diamondback 3G\razerhid.exe C:\Program Files\Brother\ControlCenter3\brccMCtl.exe C:\WINDOWS\system32\temp1.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\PnkBstrA.exe C:\WINDOWS\system32\PnkBstrB.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\alg.exe C:\Program Files\Razer\Diamondback 3G\razertra.exe C:\Program Files\Razer\Diamondback 3G\razerofa.exe C:\Program Files\Nowe Gadu-Gadu\gg.exe C:\Program Files\Nowe Gadu-Gadu\spellchecker_gg.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Documents and Settings\Lucky\Pulpit\RSIT.exe C:\WINDOWS\System32\wbem\wmiprvse.exe C:\Program Files\Trend Micro\HijackThis\Lucky.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.yahoo.com/ R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza R3 - URLSearchHook: free-downloads.net Toolbar - {ecdee021-0d17-467f-a1ff-c7a115230949} - C:\Program Files\free-downloads.net\tbfre0.dll F3 - REG:win.ini: load=C:\WINDOWS\svchost.exe O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\ycomp5_6_2_0.dll O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll O2 - BHO: free-downloads.net Toolbar - {ecdee021-0d17-467f-a1ff-c7a115230949} - C:\Program Files\free-downloads.net\tbfre0.dll O3 - Toolbar: &Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\ycomp5_6_2_0.dll O3 - Toolbar: DAEMON Tools Toolbar - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll O3 - Toolbar: free-downloads.net Toolbar - {ecdee021-0d17-467f-a1ff-c7a115230949} - C:\Program Files\free-downloads.net\tbfre0.dll O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [Diamondback] C:\Program Files\Razer\Diamondback 3G\razerhid.exe O4 - HKLM\..\Run: [PPort11reminder] "C:\Program Files\ScanSoft\PaperPort\Ereg\Ereg.exe" -r "C:\Documents and Settings\All Users\Dane aplikacji\ScanSoft\PaperPort\11\Config\Ereg\Ereg.ini O4 - HKLM\..\Run: [ControlCenter3] C:\Program Files\Brother\ControlCenter3\brctrcen.exe /autorun O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe O23 - Service: PnkBstrB - Unknown owner - C:\WINDOWS\system32\PnkBstrB.exe -- End of file - 3996 bytes ======Registry dump====== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4efb-9B51-7695ECA05670}] Yahoo! Companion BHO - C:\Program Files\Yahoo!\Companion\Installs\cpn0\ycomp5_6_2_0.dll [2005-04-22 328275] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}] Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2009-03-07 35840] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}] JQSIEStartDetectorImpl Class - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2009-03-07 73728] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{ecdee021-0d17-467f-a1ff-c7a115230949}] free-downloads.net Toolbar - C:\Program Files\free-downloads.net\tbfre0.dll [2009-08-12 2215960] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar] {EF99BD32-C1FB-11D2-892F-0090271D4F88} - &Yahoo! Companion - C:\Program Files\Yahoo!\Companion\Installs\cpn0\ycomp5_6_2_0.dll [2005-04-22 328275] {32099AAC-C132-4136-9E9A-4E364A424E17} - DAEMON Tools Toolbar - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll [2009-04-23 937416] {ecdee021-0d17-467f-a1ff-c7a115230949} - free-downloads.net Toolbar - C:\Program Files\free-downloads.net\tbfre0.dll [2009-08-12 2215960] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run] "RTHDCPL"=C:\WINDOWS\RTHDCPL.EXE [2006-05-27 16208384] "Diamondback"=C:\Program Files\Razer\Diamondback 3G\razerhid.exe [2007-08-01 147456] "PPort11reminder"=C:\Program Files\ScanSoft\PaperPort\Ereg\Ereg.exe [2007-02-01 255528] "ControlCenter3"=C:\Program Files\Brother\ControlCenter3\brctrcen.exe [2007-01-26 126976] "KernelFaultCheck"=C:\WINDOWS\system32\dumprep 0 -k [] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AlcoholAutomount] C:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe [2009-04-24 203928] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ALLUpdate] C:\Program Files\ALLPlayer\ALLUpdate.exe [2008-11-24 869888] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BrMfcWnd] C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe [2007-03-12 716800] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite] C:\Program Files\DAEMON Tools Lite\daemon.exe [2009-04-23 691656] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IndexSearch] C:\Program Files\ScanSoft\PaperPort\IndexSearch.exe [2007-01-29 46632] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck] C:\WINDOWS\system32\dumprep 0 -k [] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe [2001-07-09 155648] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Nowe Gadu-Gadu] C:\Program Files\Nowe Gadu-Gadu\gg.exe [2009-02-16 9302632] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter] C:\WINDOWS\system32\NvMcTray.dll [2006-08-11 86016] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PaperPort PTD] C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe [2007-01-29 30248] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype] C:\Program Files\Skype\Phone\Skype.exe [2009-03-27 24103720] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SkyTel] C:\WINDOWS\SkyTel.EXE [2006-05-16 2879488] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SSBkgdUpdate] C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe [2006-10-25 210472] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent] F:\Program Files\Winamp\winampa.exe [2008-07-09 36352] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Microsoft Office.lnk] F:\PROGRA~1\MICROS~1\Office\OSA9.EXE [1999-02-17 122932] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Symantec Fax Starter Edition Port.lnk] F:\PROGRA~1\MICROS~1\Office\1045\OLFSNT40.EXE [1999-05-17 46080] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Lucky^Menu Start^Programy^Autostart^hamachi.lnk] C:\PROGRA~1\Hamachi\hamachi.exe [2009-04-10 625952] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services] "StarWindServiceAE"=2 "JavaQuickStarterService"=2 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] "AppInit_DLLS"="wbsys.dll" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WBSrv] C:\PROGRA~1\Stardock\OBJECT~1\WINDOW~1\wbsrv.dll [2005-12-20 176128] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\UploadMgr] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{1a3e09be-1e45-494b-9174-d7385b45bbf5}] [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System] "NoDispAppearancePage"=0 "NoColorChoice"=0 "NoDispCPL"=0 "NoDispSettingsPage"=0 "NoDispScrSavPage"=0 "NoVisualStyleChoice"=0 "NoSizeChoice"=0 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System] "dontdisplaylastusername"=0 "legalnoticecaption"= "legalnoticetext"= "shutdownwithoutlogon"=1 "undockwithoutlogon"=1 "SynchronousMachineGroupPolicy"=0 "SynchronousUserGroupPolicy"=0 [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer] "NoSMBalloonTip"=1 "NoDriveTypeAutoRun"=149 "MemCheckBoxInRunDlg"=0 "NoClose"=0 "NoAutoTrayNotify"=0 "NoResolveTrack"=0 "NoResolveSearch"=1 "NoWelcomeScreen"=1 "NoRecentDocsNetHood"=1 "NoDesktopCleanupWizard"=1 "NoSharedDocuments"=1 "NoThemesTab"=0 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer] "NoStrCmpLogical"= "NoClose"= [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] "%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "E:\Program Files\Deep Silver\Sacred 2 - Fallen Angel\system\s2gs.exe"="E:\Program Files\Deep Silver\Sacred 2 - Fallen Angel\system\s2gs.exe:*:Enabled:Sacred 2 Game Server" "E:\Program Files\Deep Silver\Sacred 2 - Fallen Angel\system\sacred2.exe"="E:\Program Files\Deep Silver\Sacred 2 - Fallen Angel\system\sacred2.exe:*:Enabled:Sacred 2" "C:\Program Files\MiniRacingOnline\MiniRacingOnLine.exe"="C:\Program Files\MiniRacingOnline\MiniRacingOnLine.exe:*:Enabled:MiniRacingOnLine" "C:\Program Files\uTorrent\uTorrent.exe"="C:\Program Files\uTorrent\uTorrent.exe:*:Enabled:µTorrent" "C:\WINDOWS\system32\PnkBstrA.exe"="C:\WINDOWS\system32\PnkBstrA.exe:*:Enabled:PnkBstrA" "C:\WINDOWS\system32\PnkBstrB.exe"="C:\WINDOWS\system32\PnkBstrB.exe:*:Enabled:PnkBstrB" "D:\instalki\PES 2009\pes2009.exe"="D:\instalki\PES 2009\pes2009.exe:*:Enabled:Pro Evolution Soccer 2009" "C:\Program Files\Skype\Phone\Skype.exe"="C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype" [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list] "%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\H] shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL copy.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\J] shell\AutoRun\command - J:\USBAutoRun.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{50d55952-77a9-11de-bd4a-000fea5b782e}] shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL copy.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{50d55953-77a9-11de-bd4a-000fea5b782e}] shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL copy.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{5405d512-0022-11de-be8a-806d6172696f}] shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL copy.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{5405d514-0022-11de-be8a-806d6172696f}] shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL copy.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{5405d515-0022-11de-be8a-806d6172696f}] shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL copy.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{5405d517-0022-11de-be8a-806d6172696f}] shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL copy.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{72779a11-2c1a-11de-bc6a-000fea5b782e}] shell\AutoRun\command - J:\SETUP.EXE [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c9d22718-7dee-11de-bd65-000fea5b782e}] shell\AutoRun\command - J:\USBAutoRun.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{e409193c-335e-11de-bc82-000fea5b782e}] shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL copy.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{fbad9b44-87ff-11de-98d7-806d6172696f}] shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL copy.exe ======List of files/folders created in the last 1 months====== 2009-08-14 09:23:07 ----D---- C:\rsit 2009-08-13 10:03:18 ----D---- C:\Program Files\JAM2 2009-08-13 09:54:34 ----D---- C:\Program Files\Trend Micro 2009-08-12 20:04:10 ----D---- C:\Documents and Settings\All Users\Dane aplikacji\id Software 2009-07-31 18:40:35 ----D---- C:\Documents and Settings\All Users\Dane aplikacji\Windows Genuine Advantage 2009-07-30 12:12:22 ----RASH---- C:\WINDOWS\svchost.exe 2009-07-28 10:21:41 ----RASH---- C:\host.exe 2009-07-28 10:21:41 ----RASH---- C:\copy.exe 2009-07-23 15:40:06 ----D---- C:\Sounds 2009-07-23 15:36:47 ----D---- C:\Program Files\LG Electronics 2009-07-23 15:35:29 ----A---- C:\WINDOWS\system32\NMSDVDXU.dll 2009-07-23 15:35:18 ----D---- C:\Program Files\LG PC Suite II 2009-07-23 15:35:18 ----D---- C:\Documents and Settings\Lucky\Dane aplikacji\LG Electronics 2009-07-21 14:05:09 ----D---- C:\Documents and Settings\Lucky\Dane aplikacji\id Software 2009-07-19 13:58:24 ----D---- C:\Documents and Settings\Lucky\Dane aplikacji\Mount&Blade 2009-07-16 22:04:34 ----D---- C:\Documents and Settings\Lucky\Dane aplikacji\SpeedSim 2009-07-16 22:04:29 ----D---- C:\Program Files\SpeedSim ======List of files/folders modified in the last 1 months====== 2009-08-14 09:16:31 ----D---- C:\Program Files\Mozilla Firefox 2009-08-14 09:11:04 ----D---- C:\WINDOWS\Temp 2009-08-14 09:10:50 ----A---- C:\WINDOWS\system32\temp2.exe 2009-08-14 09:10:49 ----A---- C:\WINDOWS\system32\temp1.exe 2009-08-13 13:54:33 ----D---- C:\WINDOWS\system32\CatRoot2 2009-08-13 10:03:18 ----RD---- C:\Program Files 2009-08-13 09:43:09 ----D---- C:\WINDOWS 2009-08-13 00:55:41 ----A---- C:\WINDOWS\NeroDigital.ini 2009-08-12 22:54:08 ----SHD---- C:\WINDOWS\Installer 2009-08-12 22:54:08 ----D---- C:\WINDOWS\system32\drivers 2009-08-12 22:54:00 ----HD---- C:\WINDOWS\inf 2009-08-12 22:53:51 ----RSD---- C:\WINDOWS\assembly 2009-08-12 22:53:33 ----D---- C:\WINDOWS\system32\DirectX 2009-08-12 22:46:40 ----HD---- C:\Program Files\InstallShield Installation Information 2009-08-12 20:04:10 ----A---- C:\WINDOWS\system32\pbsvc.exe 2009-08-12 19:44:10 ----A---- C:\WINDOWS\WORDPAD.INI 2009-08-12 19:26:54 ----D---- C:\Documents and Settings\Lucky\Dane aplikacji\teamspeak2 2009-08-12 19:16:39 ----D---- C:\Documents and Settings\Lucky\Dane aplikacji\gtk-2.0 2009-07-31 22:44:25 ----D---- C:\Documents and Settings\Lucky\Dane aplikacji\Nowe Gadu-Gadu 2009-07-31 17:16:23 ----D---- C:\WINDOWS\system32 2009-07-31 17:10:21 ----A---- C:\WINDOWS\system32\PnkBstrB.exe 2009-07-31 12:38:21 ----A---- C:\WINDOWS\langorig.ini 2009-07-30 22:08:25 ----AD---- C:\Documents and Settings\All Users\Dane aplikacji\TEMP 2009-07-30 22:08:06 ----D---- C:\Fraps 2009-07-30 12:11:20 ----SH---- C:\boot.ini 2009-07-30 12:11:20 ----A---- C:\WINDOWS\win.ini 2009-07-30 12:11:20 ----A---- C:\WINDOWS\system.ini 2009-07-30 12:08:48 ----RAH---- C:\WINDOWS\system32\cdplayer.exe.manifest 2009-07-23 01:21:46 ----D---- C:\Documents and Settings\Lucky\Dane aplikacji\Skype 2009-07-22 19:13:40 ----D---- C:\WINDOWS\pss 2009-07-18 13:42:00 ----D---- C:\Documents and Settings\Lucky\Dane aplikacji\Hamachi 2009-07-16 22:02:55 ----D---- C:\Program Files\AV Vcs 4.0 DIAMOND ======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)====== R1 AmdK8;Sterownik procesora AMD; C:\WINDOWS\system32\DRIVERS\AmdK8.sys [2005-03-09 43008] R2 atksgt;atksgt; C:\WINDOWS\system32\DRIVERS\atksgt.sys [2009-08-12 278984] R2 lirsgt;lirsgt; C:\WINDOWS\system32\DRIVERS\lirsgt.sys [2009-08-12 25416] R2 Vcs;Vcs support; \??\C:\WINDOWS\system32\Drivers\Vcs.sys [] R3 Arp1394;Protokół klienta 1394 ARP; C:\WINDOWS\System32\DRIVERS\arp1394.sys [2004-08-03 60800] R3 BrScnUsb;Brother USB Still Image driver; C:\WINDOWS\system32\DRIVERS\BrScnUsb.sys [2004-10-15 15295] R3 hamachi;Hamachi Network Interface; C:\WINDOWS\system32\DRIVERS\hamachi.sys [2009-04-10 25280] R3 HDAudBus;Sterownik magistrali Microsoft UAA dla High Definition Audio; C:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2005-01-07 138752] R3 hidusb;Sterownik Microsoft klasy HID; C:\WINDOWS\System32\DRIVERS\hidusb.sys [2001-08-17 9600] R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\WINDOWS\system32\drivers\RtkHDAud.sys [2006-05-26 4279296] R3 mouhid;Sterownik myszy HID; C:\WINDOWS\System32\DRIVERS\mouhid.sys [2001-10-26 12160] R3 NIC1394;Sterownik sieci 1394; C:\WINDOWS\System32\DRIVERS\nic1394.sys [2004-08-03 61824] R3 nv;nv; C:\WINDOWS\system32\DRIVERS\nv4_mini.sys [2006-08-11 3958496] R3 NVENETFD;NVIDIA nForce Networking Controller Driver; C:\WINDOWS\system32\DRIVERS\NVENETFD.sys [2006-03-22 52736] R3 nvnetbus;NVIDIA Network Bus Enumerator; C:\WINDOWS\system32\DRIVERS\nvnetbus.sys [2006-03-22 18944] R3 Razerlow;Diamondback 3G USB Filter Driver; C:\WINDOWS\System32\Drivers\DB3G.sys [2005-04-24 13225] R3 usbccgp;Rodzajowy sterownik nadrzędny USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2004-08-04 31616] R3 usbehci;Sterownik Miniport rozszerzonego kontrolera hosta USB 2.0 Microsoft; C:\WINDOWS\System32\DRIVERS\usbehci.sys [2004-08-04 26624] R3 usbhub;Koncentrator z obsługą USB2; C:\WINDOWS\System32\DRIVERS\usbhub.sys [2004-08-04 57600] R3 usbohci;Sterownik Miniport otwartego kontrolera hosta USB Microsoft; C:\WINDOWS\System32\DRIVERS\usbohci.sys [2004-08-04 17024] R3 usbprint;Klasa PRINTER USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2004-08-04 25856] R3 USBSTOR;Sterownik magazynu masowego USB; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-04 26496] S3 a4aom0xg;a4aom0xg; C:\WINDOWS\system32\drivers\a4aom0xg.sys [] S3 PnkBstrK;PnkBstrK; \??\C:\WINDOWS\system32\drivers\PnkBstrK.sys [] S3 USB_RNDIS;USB Remote NDIS Network Device Driver; C:\WINDOWS\system32\DRIVERS\usb8023.sys [2004-08-04 12672] S3 usbbus;LGE Mobile Composite USB Device; C:\WINDOWS\system32\DRIVERS\lgusbbus.sys [2008-09-04 13056] S3 UsbDiag;LGE Mobile USB Serial Port; C:\WINDOWS\system32\DRIVERS\lgusbdiag.sys [2008-09-04 19968] S3 USBModem;LGE Mobile USB Modem; C:\WINDOWS\system32\DRIVERS\lgusbmodem.sys [2008-09-04 24832] S3 usbscan;Sterownik skanera USB; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-03 15104] S4 IntelIde;IntelIde; C:\WINDOWS\system32\drivers\IntelIde.sys [] ======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)====== R2 NVSvc;NVIDIA Display Driver Service; C:\WINDOWS\system32\nvsvc32.exe [2006-08-11 217155] R2 PnkBstrA;PnkBstrA; C:\WINDOWS\system32\PnkBstrA.exe [2009-06-28 75064] R2 PnkBstrB;PnkBstrB; C:\WINDOWS\system32\PnkBstrB.exe [2009-07-31 189784] S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2005-09-23 29896] S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2005-09-23 66240] S4 JavaQuickStarterService;Java Quick Starter; C:\Program Files\Java\jre6\bin\jqs.exe [2009-03-07 152984] S4 StarWindServiceAE;StarWind AE Service; C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe [2007-05-28 275968] -----------------EOF-----------------

Da się coś z tym zrobić?

**Posty:** 8001 · przez **Okocza** 14 Sie 2009, 15:18

Lucky17, użyj SDFixa a potem Combofixa, daj z nich logi...

http://forum.programosy.pl/specjalne-narzedzia-czyszczace-vt96631.html <--- sposób użycia SDFixa

Autor postu otrzymał pochwałę

**Posty:** 503 · przez **Lucky17** 14 Sie 2009, 16:49

Logo z SD fixa:

Kod: Zaznacz wszystko: Run by Administrator on 2009-08-14 at 16:40 Microsoft Windows XP [Wersja 5.1.2600] Running From: C:\SDFix [b]Checking Services [/b]: Restoring Default Security Values Restoring Default Hosts File Rebooting [b]Checking Files [/b]: Trojan Files Found: C:\autorun.inf - Deleted C:\WINDOWS\autorun.inf - Deleted C:\WINDOWS\svchost.exe - Deleted Removing Temp Files [b]ADS Check [/b]: [b]Final Check [/b]: catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-08-14 16:42:31 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... scanning hidden services & system hive ... [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4] "p0"="C:\Program Files\DAEMON Tools Lite\" "h0"=dword:00000000 "khjeh"=hex:1d,0a,3c,8d,3a,e1,d3,91,e3,5b,26,dd,af,de,56,e6,c1,c8,47,df,97,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001] "a0"=hex:20,01,00,00,04,ae,c8,8d,c5,0a,b9,44,ac,d1,51,ef,b8,30,f8,30,8a,.. "khjeh"=hex:10,7e,de,27,e6,b9,c2,63,bc,db,22,62,0e,f0,4e,8f,0c,72,5a,65,07,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40] "khjeh"=hex:54,27,7f,16,ca,bc,51,01,ea,a1,4f,55,f0,4d,64,7d,93,1f,25,33,fe,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4] "p0"="C:\Program Files\DAEMON Tools Lite\" "h0"=dword:00000000 "khjeh"=hex:1d,0a,3c,8d,3a,e1,d3,91,e3,5b,26,dd,af,de,56,e6,c1,c8,47,df,97,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001] "a0"=hex:20,01,00,00,04,ae,c8,8d,c5,0a,b9,44,ac,d1,51,ef,b8,30,f8,30,8a,.. "khjeh"=hex:10,7e,de,27,e6,b9,c2,63,bc,db,22,62,0e,f0,4e,8f,0c,72,5a,65,07,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40] "khjeh"=hex:54,27,7f,16,ca,bc,51,01,ea,a1,4f,55,f0,4d,64,7d,93,1f,25,33,fe,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4] "p0"="C:\Program Files\DAEMON Tools Lite\" "h0"=dword:00000000 "khjeh"=hex:1d,0a,3c,8d,3a,e1,d3,91,e3,5b,26,dd,af,de,56,e6,c1,c8,47,df,97,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001] "a0"=hex:20,01,00,00,04,ae,c8,8d,c5,0a,b9,44,ac,d1,51,ef,b8,30,f8,30,8a,.. "khjeh"=hex:10,7e,de,27,e6,b9,c2,63,bc,db,22,62,0e,f0,4e,8f,0c,72,5a,65,07,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40] "khjeh"=hex:54,27,7f,16,ca,bc,51,01,ea,a1,4f,55,f0,4d,64,7d,93,1f,25,33,fe,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04] "h0"=dword:00000001 "ujdew"=hex:47,85,ab,3c,7e,85,8b,6c,a1,7f,cb,2f,69,36,d6,00,ed,64,c2,3e,8f,.. "p0"="C:\Program Files\Alcohol Soft\Alcohol 120\" [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC] "p0"="C:\Program Files\DAEMON Tools Lite\" "h0"=dword:00000002 "hdf12"=hex:33,75,48,e9,26,17,98,1f,16,cd,d7,b5,6f,c8,1d,48,f2,b4,3d,7a,21,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001] "a0"=hex:20,01,00,00,93,d4,2e,ef,be,ab,d0,4b,07,30,48,1e,a5,f3,d1,31,15,.. "hdf12"=hex:99,90,35,b6,f6,5a,a0,67,06,af,5f,09,80,6d,0b,ef,41,e9,91,cd,17,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0] "hdf12"=hex:c7,b0,1a,da,5e,19,3f,24,49,68,b7,5f,60,a6,ab,7f,19,16,80,e2,e9,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4] "h0"=dword:00000000 "khjeh"=hex:1d,0a,3c,8d,3a,e1,d3,91,e3,5b,26,dd,af,de,56,e6,c1,c8,47,df,97,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001] "khjeh"=hex:10,7e,de,27,e6,b9,c2,63,bc,db,22,62,0e,f0,4e,8f,0c,72,5a,65,07,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40] "khjeh"=hex:54,27,7f,16,ca,bc,51,01,ea,a1,4f,55,f0,4d,64,7d,93,1f,25,33,fe,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet005\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04] "h0"=dword:00000001 "ujdew"=hex:47,85,ab,3c,7e,85,8b,6c,a1,7f,cb,2f,69,36,d6,00,ed,64,c2,3e,8f,.. "p0"="C:\Program Files\Alcohol Soft\Alcohol 120\" [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet005\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC] "h0"=dword:00000002 "hdf12"=hex:33,75,48,e9,26,17,98,1f,16,cd,d7,b5,6f,c8,1d,48,f2,b4,3d,7a,21,.. "p0"="C:\Program Files\DAEMON Tools Lite\" [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet005\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001] "hdf12"=hex:99,90,35,b6,f6,5a,a0,67,06,af,5f,09,80,6d,0b,ef,41,e9,91,cd,17,.. "a0"=hex:20,01,00,00,ea,e2,84,e6,b5,18,4e,35,76,70,bb,a4,1a,af,d7,6a,cc,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet005\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0] "hdf12"=hex:f3,eb,bd,43,46,7a,92,1a,6a,0a,4b,fe,65,9e,2d,41,87,32,dc,8b,cb,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet005\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4] "h0"=dword:00000000 "khjeh"=hex:1d,0a,3c,8d,3a,e1,d3,91,e3,5b,26,dd,af,de,56,e6,c1,c8,47,df,97,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet005\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001] "khjeh"=hex:10,7e,de,27,e6,b9,c2,63,bc,db,22,62,0e,f0,4e,8f,0c,72,5a,65,07,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet005\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40] "khjeh"=hex:54,27,7f,16,ca,bc,51,01,ea,a1,4f,55,f0,4d,64,7d,93,1f,25,33,fe,.. [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg] "s1"=dword:2df9c43f "s2"=dword:110480d0 "h0"=dword:00000003 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04] "h0"=dword:00000001 "ujdew"=hex:47,85,ab,3c,7e,85,8b,6c,a1,7f,cb,2f,69,36,d6,00,ed,64,c2,3e,8f,.. "p0"="C:\Program Files\Alcohol Soft\Alcohol 120\" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC] "h0"=dword:00000002 "hdf12"=hex:33,75,48,e9,26,17,98,1f,16,cd,d7,b5,6f,c8,1d,48,f2,b4,3d,7a,21,.. "p0"="C:\Program Files\DAEMON Tools Lite\" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001] "hdf12"=hex:99,90,35,b6,f6,5a,a0,67,06,af,5f,09,80,6d,0b,ef,41,e9,91,cd,17,.. "a0"=hex:20,01,00,00,ea,e2,84,e6,b5,18,4e,35,76,70,bb,a4,1a,af,d7,6a,cc,.. [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0] "hdf12"=hex:f3,eb,bd,43,46,7a,92,1a,6a,0a,4b,fe,65,9e,2d,41,87,32,dc,8b,cb,.. [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4] "h0"=dword:00000000 "khjeh"=hex:1d,0a,3c,8d,3a,e1,d3,91,e3,5b,26,dd,af,de,56,e6,c1,c8,47,df,97,.. [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001] "khjeh"=hex:10,7e,de,27,e6,b9,c2,63,bc,db,22,62,0e,f0,4e,8f,0c,72,5a,65,07,.. [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40] "khjeh"=hex:54,27,7f,16,ca,bc,51,01,ea,a1,4f,55,f0,4d,64,7d,93,1f,25,33,fe,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet007\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04] "h0"=dword:00000001 "ujdew"=hex:47,85,ab,3c,7e,85,8b,6c,a1,7f,cb,2f,69,36,d6,00,ed,64,c2,3e,8f,.. "p0"="C:\Program Files\Alcohol Soft\Alcohol 120\" [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet007\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC] "h0"=dword:00000002 "hdf12"=hex:33,75,48,e9,26,17,98,1f,16,cd,d7,b5,6f,c8,1d,48,f2,b4,3d,7a,21,.. "p0"="C:\Program Files\DAEMON Tools Lite\" [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet007\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001] "hdf12"=hex:99,90,35,b6,f6,5a,a0,67,06,af,5f,09,80,6d,0b,ef,41,e9,91,cd,17,.. "a0"=hex:20,01,00,00,ea,e2,84,e6,b5,18,4e,35,76,70,bb,a4,1a,af,d7,6a,cc,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet007\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0] "hdf12"=hex:f3,eb,bd,43,46,7a,92,1a,6a,0a,4b,fe,65,9e,2d,41,87,32,dc,8b,cb,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet007\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4] "h0"=dword:00000000 "khjeh"=hex:1d,0a,3c,8d,3a,e1,d3,91,e3,5b,26,dd,af,de,56,e6,c1,c8,47,df,97,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet007\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001] "khjeh"=hex:10,7e,de,27,e6,b9,c2,63,bc,db,22,62,0e,f0,4e,8f,0c,72,5a,65,07,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet007\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40] "khjeh"=hex:54,27,7f,16,ca,bc,51,01,ea,a1,4f,55,f0,4d,64,7d,93,1f,25,33,fe,.. scanning hidden registry entries ... scanning hidden files ... scan completed successfully hidden processes: 0 hidden services: 0 hidden files: 0 [b]Remaining Services [/b]: Authorized Application Key Export: [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "E:\\Program Files\\Deep Silver\\Sacred 2 - Fallen Angel\\system\\s2gs.exe"="E:\\Program Files\\Deep Silver\\Sacred 2 - Fallen Angel\\system\\s2gs.exe:*:Enabled:Sacred 2 Game Server" "E:\\Program Files\\Deep Silver\\Sacred 2 - Fallen Angel\\system\\sacred2.exe"="E:\\Program Files\\Deep Silver\\Sacred 2 - Fallen Angel\\system\\sacred2.exe:*:Enabled:Sacred 2" "C:\\Program Files\\MiniRacingOnline\\MiniRacingOnLine.exe"="C:\\Program Files\\MiniRacingOnline\\MiniRacingOnLine.exe:*:Enabled:MiniRacingOnLine" "C:\\Program Files\\uTorrent\\uTorrent.exe"="C:\\Program Files\\uTorrent\\uTorrent.exe:*:Enabled:uTorrent" "C:\\WINDOWS\\system32\\PnkBstrA.exe"="C:\\WINDOWS\\system32\\PnkBstrA.exe:*:Enabled:PnkBstrA" "C:\\WINDOWS\\system32\\PnkBstrB.exe"="C:\\WINDOWS\\system32\\PnkBstrB.exe:*:Enabled:PnkBstrB" "D:\\instalki\\PES 2009\\pes2009.exe"="D:\\instalki\\PES 2009\\pes2009.exe:*:Enabled:Pro Evolution Soccer 2009" "C:\\Program Files\\Skype\\Phone\\Skype.exe"="C:\\Program Files\\Skype\\Phone\\Skype.exe:*:Enabled:Skype" [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list] "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" [b]Remaining Files [/b]: File Backups: - C:\SDFix\backups\backups.zip [b]Files with Hidden Attributes [/b]: Sat 13 May 2006 1,211 A.SHR --- "C:\copy.exe" Sat 20 May 2006 70,207 A.SHR --- "C:\host.exe" Sat 13 May 2006 1,211 A.SHR --- "C:\WINDOWS\xcopy.exe" Sat 18 Apr 2009 20,992 ...H. --- "C:\Documents and Settings\Lucky\Dane aplikacji\Microsoft\Word\~WRL2824.tmp" Wed 22 Jul 2009 857 ...HR --- "C:\Documents and Settings\Lucky\Dane aplikacji\SecuROM\UserData\securom_v7_01.bak" [b]Finished![/b]

**Posty:** 8001 · przez **Okocza** 14 Sie 2009, 17:02

Lucky17, jeszcze combofix

**Posty:** 503 · przez **Lucky17** 14 Sie 2009, 22:38

Combo Fix:

Kod: Zaznacz wszystko: ComboFix 09-08-10.06 - Lucky 2009-08-14 22:30.1.1 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.48.1045.18.2047.1490 [GMT 2:00] Uruchomiony z: c:\documents and settings\Lucky\Pulpit\ComboFix.exe . ((((((((((((((((((((((((((((((((((((((( Usunięto ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\Autorun.inf C:\copy.exe C:\host.exe c:\windows\autorun.inf c:\windows\svchost.exe c:\windows\system32\mdm.exe c:\windows\system32\temp1.exe c:\windows\system32\temp2.exe c:\windows\xcopy.exe D:\autorun.inf D:\copy.exe D:\host.exe E:\Autorun.inf E:\copy.exe E:\host.exe F:\autorun.inf F:\copy.exe F:\host.exe . ((((((((((((((((((((((((( Pliki utworzone od 2009-07-14 do 2009-08-14 ))))))))))))))))))))))))))))))) . 2009-08-14 14:40 . 2009-08-14 14:40 578560 -c--a-w- c:\windows\system32\dllcache\user32.dll 2009-08-14 14:39 . 2009-08-14 14:39 -------- d-----w- c:\windows\ERUNT 2009-08-14 14:23 . 2009-08-14 14:43 -------- d-----w- C:\SDFix 2009-08-14 11:18 . 2009-08-14 15:26 -------- d-----w- c:\documents and settings\Lucky\Dane aplikacji\GanymedeNet 2009-08-14 11:17 . 2009-08-14 11:18 -------- d-----w- c:\program files\Ganymede 2009-08-14 07:23 . 2009-08-14 07:23 -------- d-----w- C:\rsit 2009-08-13 08:03 . 2009-08-13 08:06 -------- d-----w- c:\program files\JAM2 2009-08-13 07:54 . 2009-08-13 07:54 -------- d-----w- c:\program files\Trend Micro 2009-08-12 20:54 . 2009-08-12 20:54 -------- d-----w- c:\documents and settings\Lucky\Ustawienia lokalne\Dane aplikacji\The Witcher 2009-08-12 20:54 . 2009-08-12 20:54 278984 ----a-w- c:\windows\system32\drivers\atksgt.sys 2009-08-12 20:54 . 2009-08-12 20:54 25416 ----a-w- c:\windows\system32\drivers\lirsgt.sys 2009-08-12 18:04 . 2009-08-12 18:04 -------- d-----w- c:\documents and settings\All Users\Dane aplikacji\id Software 2009-08-05 21:55 . 2009-08-05 21:55 625728 ----a-w- c:\documents and settings\All Users\Dane aplikacji\id Software\QuakeLive\npquakezero.dll 2009-07-23 13:40 . 2009-07-23 13:40 -------- d-----w- C:\Sounds 2009-07-23 13:36 . 2008-09-04 04:28 19968 ----a-w- c:\windows\system32\drivers\lgusbdiag.sys 2009-07-23 13:36 . 2008-09-04 04:27 24832 ----a-w- c:\windows\system32\drivers\lgusbmodem.sys 2009-07-23 13:36 . 2008-09-04 04:27 13056 ----a-w- c:\windows\system32\drivers\lgusbbus.sys 2009-07-23 13:36 . 2009-07-23 13:36 -------- d-----w- c:\program files\LG Electronics 2009-07-23 13:35 . 2007-11-08 14:26 1164728 ----a-w- c:\windows\system32\NMSDVDXU.dll 2009-07-23 13:35 . 2009-07-31 17:27 -------- d-----w- c:\program files\LG PC Suite II 2009-07-23 13:35 . 2009-07-31 16:20 -------- d-----w- c:\documents and settings\Lucky\Dane aplikacji\LG Electronics 2009-07-22 15:48 . 2009-08-14 09:29 355392 ----a-w- c:\documents and settings\Lucky\Dane aplikacji\id Software\quakelive\home\baseq3\cgamex86.dll 2009-07-22 15:48 . 2009-07-22 15:52 453696 ----a-w- c:\documents and settings\Lucky\Dane aplikacji\id Software\quakelive\home\baseq3\qagamex86.dll 2009-07-22 15:48 . 2009-08-14 09:29 179264 ----a-w- c:\documents and settings\Lucky\Dane aplikacji\id Software\quakelive\home\baseq3\uix86.dll 2009-07-22 15:41 . 2009-08-14 09:28 874660 ----a-w- c:\documents and settings\Lucky\Dane aplikacji\id Software\quakelive\home\pb\pbcl.dll 2009-07-22 15:41 . 2009-08-14 09:28 57344 ----a-w- c:\documents and settings\Lucky\Dane aplikacji\id Software\quakelive\home\pb\pbag.dll 2009-07-22 15:41 . 2009-08-14 09:28 2661440 ----a-w- c:\documents and settings\Lucky\Dane aplikacji\id Software\quakelive\home\baseq3\quakelive.dll 2009-07-21 12:05 . 2009-07-21 12:05 -------- d-----w- c:\documents and settings\Lucky\Dane aplikacji\id Software 2009-07-19 11:58 . 2009-07-19 11:58 -------- d-----w- c:\documents and settings\Lucky\Dane aplikacji\Mount&Blade 2009-07-16 20:04 . 2009-07-16 20:05 -------- d-----w- c:\documents and settings\Lucky\Dane aplikacji\SpeedSim 2009-07-16 20:04 . 2009-07-16 20:04 -------- d-----w- c:\program files\SpeedSim . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-08-14 14:46 . 2009-04-10 17:30 -------- d-----w- c:\documents and settings\Lucky\Dane aplikacji\Hamachi 2009-08-14 09:29 . 2009-03-19 21:48 138944 ----a-w- c:\windows\system32\drivers\PnkBstrK.sys 2009-08-14 09:28 . 2009-03-19 21:48 189784 ----a-w- c:\windows\system32\PnkBstrB.exe 2009-08-12 20:46 . 2009-02-21 13:45 -------- d--h--w- c:\program files\InstallShield Installation Information 2009-08-12 18:04 . 2009-06-28 12:50 2373712 ----a-w- c:\windows\system32\pbsvc.exe 2009-08-12 17:26 . 2009-02-23 16:21 -------- d-----w- c:\documents and settings\Lucky\Dane aplikacji\teamspeak2 2009-08-12 17:16 . 2009-04-12 20:12 -------- d-----w- c:\documents and settings\Lucky\Dane aplikacji\gtk-2.0 2009-07-31 20:44 . 2009-02-23 14:57 -------- d-----w- c:\documents and settings\Lucky\Dane aplikacji\Nowe Gadu-Gadu 2009-07-30 20:08 . 2009-03-19 15:34 -------- d---a-w- c:\documents and settings\All Users\Dane aplikacji\TEMP 2009-07-22 23:21 . 2009-04-18 15:41 -------- d-----w- c:\documents and settings\Lucky\Dane aplikacji\Skype 2009-07-22 13:18 . 2009-04-18 15:11 -------- d-----w- c:\program files\free-downloads.net 2009-07-19 13:18 . 2009-07-19 13:18 2855 ----a-w- c:\windows\PIF\SETUP.PIF 2009-07-16 20:02 . 2009-03-20 20:50 -------- d-----w- c:\program files\AV Vcs 4.0 DIAMOND 2009-07-16 19:37 . 2002-03-25 17:02 163644 ----a-w- c:\windows\system32\drivers\secdrv.sys 2009-07-16 15:19 . 2009-04-04 21:22 -------- d-----w- c:\documents and settings\Lucky\Dane aplikacji\Any Video Converter 2009-07-12 21:04 . 2009-07-12 21:04 -------- d-----w- c:\program files\DAEMON Tools Lite 2009-07-12 21:04 . 2009-02-21 15:35 -------- d-----w- c:\program files\DAEMON Tools Toolbar 2009-07-12 21:01 . 2009-06-09 19:47 -------- d-----w- c:\documents and settings\Lucky\Dane aplikacji\uTorrent 2009-07-06 12:01 . 2009-07-06 12:01 2373712 ----a-w- c:\documents and settings\All Users\Dane aplikacji\id Software\QuakeLive\pbsvc.exe 2009-06-28 13:07 . 2009-03-19 21:48 75064 ----a-w- c:\windows\system32\PnkBstrA.exe 2009-06-28 12:50 . 2009-06-28 12:50 139152 ----a-w- c:\documents and settings\Lucky\Dane aplikacji\PnkBstrK.sys 2009-06-28 12:50 . 2009-06-28 12:50 139152 ----a-w- c:\documents and settings\Lucky\Dane aplikacji\PnkBstrK.sys 2009-06-25 14:36 . 2009-06-28 12:00 1291640 ----a-w- c:\documents and settings\Lucky\Dane aplikacji\Mozilla\Firefox\Profiles\hhuoiydo.default\extensions\battlefieldheroespatcher@ea.com\platform\WINNT_x86-msvc\plugins\BFHUpdater.exe 2009-06-25 14:36 . 2009-06-28 12:00 729088 ----a-w- c:\documents and settings\Lucky\Dane aplikacji\Mozilla\Firefox\Profiles\hhuoiydo.default\extensions\battlefieldheroespatcher@ea.com\platform\WINNT_x86-msvc\plugins\npBFHUpdater.dll 2009-06-12 07:22 . 2009-06-12 07:06 50704 ----a-w- c:\windows\War3Unin.dat 2009-06-12 07:08 . 2009-06-12 07:06 2829 ----a-w- c:\windows\War3Unin.pif 2009-06-12 07:08 . 2009-06-12 07:06 200704 ----a-w- c:\windows\War3Unin.exe 2009-05-25 14:35 . 2009-05-25 14:35 10134 ----a-r- c:\documents and settings\Lucky\Dane aplikacji\Microsoft\Installer\{E3E71D07-CD27-46CB-8448-16D4FB29AA13}\ARPPRODUCTICON.exe 2009-05-25 14:33 . 2001-10-26 17:15 76130 ----a-w- c:\windows\system32\perfc015.dat 2009-05-25 14:33 . 2001-10-26 17:15 451738 ----a-w- c:\windows\system32\perfh015.dat 2009-05-22 04:38 . 2009-02-21 15:33 721904 ----a-w- c:\windows\system32\drivers\sptd.sys 1999-05-17 11:58 . 1999-05-17 11:58 99840 ----a-w- c:\program files\Common Files\IRAABOUT.DLL 1998-12-09 00:53 . 1998-12-09 00:53 70144 ----a-w- c:\program files\Common Files\IRAMDMTR.DLL 1998-12-09 00:53 . 1998-12-09 00:53 48640 ----a-w- c:\program files\Common Files\IRALPTTR.DLL 1998-12-09 00:53 . 1998-12-09 00:53 31744 ----a-w- c:\program files\Common Files\IRAWEBTR.DLL 1998-12-09 00:53 . 1998-12-09 00:53 186368 ----a-w- c:\program files\Common Files\IRAREG.DLL 1998-12-09 00:53 . 1998-12-09 00:53 17920 ----a-w- c:\program files\Common Files\IRASRIAL.DLL . ------- Sigcheck ------- [-] 2002-09-20 17:05 142336 2BDCBF19C5222FDA21B049D1FBAC7B36 c:\windows\$NtServicePackUninstall$\wuauclt.exe [7] 2004-08-03 23:44 112128 EBF4AC22004504C422FC8B5EE5B6FFD1 c:\windows\ServicePackFiles\i386\wuauclt.exe [-] 2004-08-03 23:44 172544 57C1FC3E1D66940B44B511C72F798E7E c:\windows\system32\wuauclt.exe . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks] "{ecdee021-0d17-467f-a1ff-c7a115230949}"= "c:\program files\free-downloads.net\tbfre0.dll" [2009-08-12 2215960] [HKEY_CLASSES_ROOT\clsid\{ecdee021-0d17-467f-a1ff-c7a115230949}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{ecdee021-0d17-467f-a1ff-c7a115230949}] 2009-08-12 20:43 2215960 ----a-w- c:\program files\free-downloads.net\tbfre0.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar] "{ecdee021-0d17-467f-a1ff-c7a115230949}"= "c:\program files\free-downloads.net\tbfre0.dll" [2009-08-12 2215960] [HKEY_CLASSES_ROOT\clsid\{ecdee021-0d17-467f-a1ff-c7a115230949}] [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser] "{ECDEE021-0D17-467F-A1FF-C7A115230949}"= "c:\program files\free-downloads.net\tbfre0.dll" [2009-08-12 2215960] [HKEY_CLASSES_ROOT\clsid\{ecdee021-0d17-467f-a1ff-c7a115230949}] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Diamondback"="c:\program files\Razer\Diamondback 3G\razerhid.exe" [2007-08-01 147456] "PPort11reminder"="c:\program files\ScanSoft\PaperPort\Ereg\Ereg.exe" [2007-02-01 255528] "ControlCenter3"="c:\program files\Brother\ControlCenter3\brctrcen.exe" [2007-01-26 126976] "RTHDCPL"="RTHDCPL.EXE" - c:\windows\RTHDCPL.exe [2006-05-27 16208384] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "SynchronousMachineGroupPolicy"= 0 (0x0) "SynchronousUserGroupPolicy"= 0 (0x0) [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer] "NoStrCmpLogical"= 1 (0x1) [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] "NoSMBalloonTip"= 1 (0x1) "MemCheckBoxInRunDlg"= 0 (0x0) "NoResolveTrack"= 0 (0x0) "NoWelcomeScreen"= 1 (0x1) "NoRecentDocsNetHood"= 1 (0x1) [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\WBSrv] 2005-12-20 21:57 176128 ----a-w- c:\progra~1\Stardock\OBJECT~1\WINDOW~1\WbSrv.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "AppInit_DLLs"=c:\windows\system32\wbsys.dll [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Microsoft Office.lnk] path=c:\documents and settings\All Users\Menu Start\Programy\Autostart\Microsoft Office.lnk backup=c:\windows\pss\Microsoft Office.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Symantec Fax Starter Edition Port.lnk] path=c:\documents and settings\All Users\Menu Start\Programy\Autostart\Symantec Fax Starter Edition Port.lnk backup=c:\windows\pss\Symantec Fax Starter Edition Port.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^Lucky^Menu Start^Programy^Autostart^hamachi.lnk] path=c:\documents and settings\Lucky\Menu Start\Programy\Autostart\hamachi.lnk backup=c:\windows\pss\hamachi.lnkStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services] "StarWindServiceAE"=2 (0x2) "JavaQuickStarterService"=2 (0x2) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "e:\\Program Files\\Deep Silver\\Sacred 2 - Fallen Angel\\system\\s2gs.exe"= "e:\\Program Files\\Deep Silver\\Sacred 2 - Fallen Angel\\system\\sacred2.exe"= "c:\\Program Files\\MiniRacingOnline\\MiniRacingOnLine.exe"= "c:\\Program Files\\uTorrent\\uTorrent.exe"= "c:\\WINDOWS\\system32\\PnkBstrA.exe"= "c:\\WINDOWS\\system32\\PnkBstrB.exe"= "d:\\instalki\\PES 2009\\pes2009.exe"= "c:\\Program Files\\Skype\\Phone\\Skype.exe"= R2 Vcs;Vcs support;c:\windows\system32\drivers\Vcs.sys [2009-03-20 6852] R3 Razerlow;Diamondback 3G USB Filter Driver;c:\windows\system32\drivers\DB3G.sys [2009-02-23 13225] . . ------- Skan uzupełniający ------- . uStart Page = hxxp://www.yahoo.com uInternet Connection Wizard,ShellNext = hxxp://www.yahoo.com/ DPF: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab FF - ProfilePath - c:\documents and settings\Lucky\Dane aplikacji\Mozilla\Firefox\Profiles\hhuoiydo.default\ FF - component: c:\documents and settings\Lucky\Dane aplikacji\Mozilla\Firefox\Profiles\hhuoiydo.default\extensions\DTToolbar@toolbarnet.com\components\DTToolbarFF.dll FF - component: c:\program files\Mozilla Firefox\extensions\{B13721C7-F507-4982-B2E5-502A71474FED}\components\NPComponent.dll FF - plugin: c:\documents and settings\All Users\Dane aplikacji\id Software\QuakeLive\npquakezero.dll FF - plugin: c:\documents and settings\Lucky\Dane aplikacji\Mozilla\Firefox\Profiles\hhuoiydo.default\extensions\battlefieldheroespatcher@ea.com\platform\WINNT_x86-msvc\plugins\npBFHUpdater.dll FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll FF - plugin: c:\program files\Mozilla Firefox\plugins\npganymedenet.dll . ************************************************************************** catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-08-14 22:32 Windows 5.1.2600 Dodatek Service Pack 2 NTFS skanowanie ukrytych procesów ... skanowanie ukrytych wpisów autostartu ... skanowanie ukrytych plików ... skanowanie pomyślnie ukończone ukryte pliki: 0 ************************************************************************** . --------------------- ZABLOKOWANE KLUCZE REJESTRU --------------------- [HKEY_USERS\S-1-5-21-117609710-1659004503-839522115-1003\Software\SecuROM\License information*] "datasecu"=hex:59,54,f3,d4,22,2e,49,60,32,38,39,ae,64,0c,ce,f5,3a,7b,86,4b,ea, d4,c1,7e,d8,f7,84,ff,9b,d8,8c,bf,31,5c,04,38,89,c6,2d,4a,11,a8,09,59,b2,97,\ "rkeysecu"=hex:fb,c6,cc,ba,61,c7,74,fa,35,d1,07,7a,52,e5,c7,7c . --------------------- Pliki DLL ładowane pod uruchomionymi procesami --------------------- - - - - - - - > 'winlogon.exe'(884) c:\progra~1\Stardock\OBJECT~1\WINDOW~1\wbsrv.dll . Czas ukończenia: 2009-08-14 22:33 ComboFix-quarantined-files.txt 2009-08-14 20:33 Przed: 1 935 638 528 bajtów wolnych Po: 1 930 330 112 bajtów wolnych WindowsXP-KB310994-SP2-Pro-BootDisk-PLK.exe [boot loader] timeout=2 default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS [operating systems] c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /fastdetect /NoExecute=OptIn Current=6 Default=6 Failed=5 LastKnownGood=7 Sets=1,2,3,4,5,6,7 215

Temp2.exe nie występuje już. Dzięki za pomoc.
Jeżeli ma ktoś jeszcze jakieś propozycje co tu jeszcze da sie zrobić by komp działał lepiej to będę wdzięczny za każdą radę.Oczywiście daje "+".

**Posty:** 18165 · przez **wojtas** 15 Sie 2009, 20:28

odinstaluj jesli masz free-downloads.net

2. wykonaj optymalizację windowsa
3.Wyłącz przywracanie systemu ( właściwości mój komputer-zakładka przywracanie - wyłącz przywracanie na wszystkich dyskach). Po chwili włącz je powrotem]
4. zrób skan Malwarebytes Anti-Malware

Autor postu otrzymał pochwałę

**Posty:** 503 · przez **Lucky17** 17 Sie 2009, 06:05

wojtas napisał(a):odinstaluj jesli masz free-downloads.net

2. wykonaj optymalizację windowsa
3.Wyłącz przywracanie systemu ( właściwości mój komputer-zakładka przywracanie - wyłącz przywracanie na wszystkich dyskach). Po chwili włącz je powrotem]
4. zrób skan Malwarebytes Anti-Malware

Zrobiłem tak jak powiedziałeś. Dzięki za pomoc.