błąd

**Posty:** 2116 · przez **cinek383** 29 Mar 2007, 18:00

mam problem .. skanowałem kompa antywirusem (a-squared Free) i wykryło mi tam coś mam zapis z raportu jak coś. I zaznaczyłem wszystko żeby usunąć. Teraz gdy włączam kompa wyskakuje mi błąd mam screnny

Kod: Zaznacz wszystko: C:\WINDOWS\system32\scvhost.exe System Windows nie może odnaleźć pliku "C:\WINDOWS\system32\scvhost.exe".Upewnij się, że wpisana nazwa jes poprawnie.Aby wyszukać plik, klinij Start, a następnie kliknij polecenie Wyszukaj.

Gdy klikam OK wyskakuje kolejne okienko

Kod: Zaznacz wszystko: Pulpit Nie można załadować lub uruchomić podanego w rejestrze pliku C:\WINDOWS\system32\scvhost.exe. upewnij się że plik istnieje na tym komputerze lub usuń z Rejestru odwołanie do niego.

**Posty:** 18165 · przez **wojtas** 29 Mar 2007, 20:09

hmm mamy wirusa

logi sie przydadza

**Posty:** 2116 · przez **cinek383** 29 Mar 2007, 20:27

już dałem loga w bezpieczeństwie jak coś to looknij

**Posty:** 282 · przez **Devil_punisher** 29 Mar 2007, 20:34

svhost.exe proste nie masz tego pliku lub wirus ci go zajął

**Posty:** 10790 · przez **DeadOrAlive** 29 Mar 2007, 20:44

cinek383 po cholerę zakładasz tyle tematów :?:

nie rób śmietnika, jeszcze jeden i się pożegnamy :!:

**Posty:** 2116 · przez **cinek383** 29 Mar 2007, 20:48

Kod: Zaznacz wszystko: Logfile of HijackThis v1.99.1 Scan saved at 20:12:04, on 2007-03-29 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\SYSTEM32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Ahead\InCD\InCDsrv.exe C:\WINDOWS\system32\spoolsv.exe D:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe D:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe D:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe C:\WINDOWS\system32\WgaTray.exe C:\WINDOWS\Explorer.EXE C:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe C:\WINDOWS\system32\RUNDLL32.EXE C:\PROGRA~1\A4Tech\Mouse\Amoumain.exe C:\Program Files\Ahead\InCD\InCD.exe F:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\system32\wuauclt.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Netia\Net\netianet.exe C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe D:\Program Files\Azureus\Azureus.exe F:\Gadu-Gadu\gg.exe D:\PROGRA~1\MOZILL~1\FIREFOX.EXE F:\PLIKI POBRANE\hijackthis.com R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://home.netscape.com R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://home.netscape.com/home/winsearch.html R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://home.netscape.com/home/winsearch200.html R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://home.netscape.com/home/winsearch.html R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://home.netscape.com R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://megapanel.gem.pl/q.php?s=toEWHm4c0IDs3d3WeKzqG.N7&o=7505&id=0lRxEiS829nNM_zwT5IuRvI7&t=1173594028&n=1 R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza F3 - REG:win.ini: load=C:\WINDOWS\system32\scvhost.exe F3 - REG:win.ini: run=C:\WINDOWS\system32\scvhost.exe O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - d:\Reader\ActiveX\AcroIEHelper.ocx O2 - BHO: URLLink - {4A2AACF3-ADF6-11D5-98A9-00E018981B9E} - C:\Program Files\NewDotNet\newdotnet7_48.dll O2 - BHO: (no name) - {A5366673-E8CA-11D3-9CD9-0090271D075B} - (no file) O2 - BHO: (no name) - {FFFFFEF0-5B30-21D4-945D-000000000000} - D:\PROGRA~1\STARDO~1\SDIEInt.dll (file missing) O4 - HKLM\..\Run: [NVMixerTray] "C:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe" O4 - HKLM\..\Run: [NvCplDaemon] "RUNDLL32.EXE" C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] "nwiz.exe" /install O4 - HKLM\..\Run: [BearShare] "D:\Program Files\BearShare\BearShare.exe" /pause O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe" O4 - HKLM\..\Run: [NvMediaCenter] "RUNDLL32.EXE" C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [Picasa Media Detector] D:\Program Files\Picasa2\PicasaMediaDetector.exe O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u O4 - HKLM\..\Run: [WheelMouse] C:\PROGRA~1\A4Tech\Mouse\Amoumain.exe O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe O4 - HKLM\..\Run: [RemoteControl] "f:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe" O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [ISUSPM Startup] "C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" -startup O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start O4 - HKLM\..\Run: [New.net Startup] rundll32 C:\PROGRA~1\NEWDOT~1\NEWDOT~2.DLL,ClientStartup -s O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [NETIANET] C:\Program Files\Netia\Net\netianet.exe O4 - HKCU\..\Run: [Gadu-Gadu] "F:\Gadu-Gadu\gg.exe" /tray O4 - HKCU\..\Run: [Dzieńdobry!] D:\Program Files\VSD Software\Dzieńdobry!\dziendobry.exe /auto O4 - HKCU\..\Run: [Odkurzacz-MCD] d:\Program Files\Odkurzacz\odk_mcd.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll O16 - DPF: {A7196C8E-35A5-4FF0-9E46-E28918B5CAF6} (GameDesire Domino) - http://67.15.101.3/g_bin/pl/domino_2_0_0_28.cab O16 - DPF: {BFA1F11D-3121-AFE1-4112-894323212DAC} (GameDesire Word Games) - http://67.15.101.3/g_bin/pl/words_2_0_0_46.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{80652C03-ED33-4C96-9FF5-746573208EBC}: NameServer = 213.241.79.37 83.238.255.76 O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll O20 - Winlogon Notify: WRNotifier - C:\WINDOWS\SYSTEM32\WRLogonNTF.dll O23 - Service: ArcaBit NetMonitor (ABNetMon) - Unknown owner - C:\Program Files\MKS\Bin\NetMonSV.exe (file missing) O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Ahead\InCD\InCDsrv.exe O23 - Service: Kerio Personal Firewall 4 (KPF4) - Kerio Technologies - D:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe O23 - Service: Webroot Spy Sweeper Engine (WebrootSpySweeperService) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe

**Posty:** 18165 · przez **wojtas** 29 Mar 2007, 21:35

Wyłącz przywracanie systemu ( właściwości mój komputer-zakładka przywracanie - wyłącz przywracanie na wszystkich dyskach)
Start do awaryjnego ( F8 ) przy starcie komputera.

Sciagasz:
http://www.cexx.org/LSPFix.exe

Oddpal LSP-Fix zaznacz "I know what I'm doing" następnie w okienku Keep zaznacz plik który chcesz usunac czyli newdotnet7_48.dll i za pomocą strzałki (>>) przenieś go do okienka Remover i kliknij Finish

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://megapanel.gem.pl/q.php?s=toEWHm4c0IDs3d3WeKzqG.N7&o=7505&id=0lRxEiS829nNM_zwT5IuRvI7&t=1173594028&n=1
F3 - REG:win.ini: load=C:\WINDOWS\system32\scvhost.exe
F3 - REG:win.ini: run=C:\WINDOWS\system32\scvhost.exe
2 - BHO: URLLink - {4A2AACF3-ADF6-11D5-98A9-00E018981B9E} - C:\Program Files\NewDotNet\newdotnet7_48.dll
O2 - BHO: (no name) - {A5366673-E8CA-11D3-9CD9-0090271D075B} - (no file)
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKLM\..\Run: [New.net Startup] rundll32 C:\PROGRA~1\NEWDOT~1\NEWDOT~2.DLL,ClientStartup -s

Odpalasz hijackthis i zaznaczasz ptaszkami powyższe wpisy i dajesz Fix checked.
Pogrubione pliki usuwasz ręcznie z dysku
potem nowe logi z Hijack This oraz Silent runners i comboscan

**Posty:** 2116 · przez **cinek383** 29 Mar 2007, 22:28

Kod: Zaznacz wszystko: Logfile of HijackThis v1.99.1 Scan saved at 22:19:37, on 2007-03-29 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\SYSTEM32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Ahead\InCD\InCDsrv.exe C:\WINDOWS\system32\spoolsv.exe D:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe C:\WINDOWS\Explorer.EXE C:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe D:\Program Files\BearShare\BearShare.exe C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe C:\WINDOWS\system32\RUNDLL32.EXE C:\PROGRA~1\A4Tech\Mouse\Amoumain.exe F:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Netia\Net\netianet.exe D:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe C:\WINDOWS\system32\msiexec.exe D:\Program Files\Odkurzacz\odk_mcd.exe C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe C:\WINDOWS\system32\WgaTray.exe D:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe C:\WINDOWS\system32\wuauclt.exe F:\Gadu-Gadu\gg.exe D:\PROGRA~1\MOZILL~1\FIREFOX.EXE C:\Program Files\HijackThis\HijackThis.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://home.netscape.com R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://home.netscape.com/home/winsearch.html R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://home.netscape.com/home/winsearch200.html R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://home.netscape.com/home/winsearch.html R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://home.netscape.com R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - d:\Reader\ActiveX\AcroIEHelper.ocx O2 - BHO: (no name) - {FFFFFEF0-5B30-21D4-945D-000000000000} - D:\PROGRA~1\STARDO~1\SDIEInt.dll (file missing) O4 - HKLM\..\Run: [NVMixerTray] "C:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe" O4 - HKLM\..\Run: [NvCplDaemon] "RUNDLL32.EXE" C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] "nwiz.exe" /install O4 - HKLM\..\Run: [BearShare] "D:\Program Files\BearShare\BearShare.exe" /pause O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe" O4 - HKLM\..\Run: [NvMediaCenter] "RUNDLL32.EXE" C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [WheelMouse] C:\PROGRA~1\A4Tech\Mouse\Amoumain.exe O4 - HKLM\..\Run: [RemoteControl] "f:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe" O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [ISUSPM Startup] "C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" -startup O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [Gadu-Gadu] "F:\Gadu-Gadu\gg.exe" /tray O4 - HKCU\..\Run: [Dzieńdobry!] D:\Program Files\VSD Software\Dzieńdobry!\dziendobry.exe /auto O4 - HKCU\..\Run: [Odkurzacz-MCD] d:\Program Files\Odkurzacz\odk_mcd.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll O16 - DPF: {A7196C8E-35A5-4FF0-9E46-E28918B5CAF6} (GameDesire Domino) - http://67.15.101.3/g_bin/pl/domino_2_0_0_28.cab O16 - DPF: {BFA1F11D-3121-AFE1-4112-894323212DAC} (GameDesire Word Games) - http://67.15.101.3/g_bin/pl/words_2_0_0_46.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{80652C03-ED33-4C96-9FF5-746573208EBC}: NameServer = 213.241.79.37 83.238.255.76 O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll O20 - Winlogon Notify: WRNotifier - C:\WINDOWS\SYSTEM32\WRLogonNTF.dll O23 - Service: ArcaBit NetMonitor (ABNetMon) - Unknown owner - C:\Program Files\MKS\Bin\NetMonSV.exe (file missing) O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Ahead\InCD\InCDsrv.exe O23 - Service: Kerio Personal Firewall 4 (KPF4) - Kerio Technologies - D:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe O23 - Service: Webroot Spy Sweeper Engine (WebrootSpySweeperService) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe

**Posty:** 18165 · przez **wojtas** 29 Mar 2007, 22:33

skasuj jesli nie znasz tego:

O2 - BHO: (no name) - {FFFFFEF0-5B30-21D4-945D-000000000000} - D:\PROGRA~1\STARDO~1\SDIEInt.dll (file missing)

pokaz log z silent runners i comboscan

http://forum.programosy.pl/dodatkowe-narzedzia-do-usuwania-i-ochrony-vt42021.html

**Posty:** 2116 · przez **cinek383** 29 Mar 2007, 22:38

Kod: Zaznacz wszystko: ComboScan v20070306.20 run by Cinek on 2007-03-29 at 20:31:20 Computer is in Normal Mode. -------------------------------------------------------------------------------- -- System Restore -------------------------------------------------------------- System Restore is disabled; attempting to re-enable...failed; access is denied. Performed disk cleanup. -- HijackThis (run as Cinek.exe) ----------------------------------------------- Logfile of HijackThis v1.99.1 Scan saved at 20:32:08, on 2007-03-29 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\SYSTEM32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Ahead\InCD\InCDsrv.exe C:\WINDOWS\system32\spoolsv.exe D:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe D:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe D:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe C:\WINDOWS\system32\WgaTray.exe C:\WINDOWS\Explorer.EXE C:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe C:\WINDOWS\system32\RUNDLL32.EXE C:\PROGRA~1\A4Tech\Mouse\Amoumain.exe C:\Program Files\Ahead\InCD\InCD.exe F:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\system32\wuauclt.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Netia\Net\netianet.exe C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe D:\Program Files\Azureus\Azureus.exe F:\Gadu-Gadu\gg.exe D:\PROGRA~1\MOZILL~1\FIREFOX.EXE F:\PLIKI POBRANE\comboscan.exe C:\PROGRA~1\HIJACK~1\Cinek.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://home.netscape.com R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://home.netscape.com/home/winsearch.html R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://home.netscape.com/home/winsearch200.html R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://home.netscape.com/home/winsearch.html R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://home.netscape.com R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://megapanel.gem.pl/q.php?s=toEWHm4c0IDs3d3WeKzqG.N7&o=7505&id=0lRxEiS829nNM_zwT5IuRvI7&t=1173594028&n=1 R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza F3 - REG:win.ini: load=C:\WINDOWS\system32\scvhost.exe F3 - REG:win.ini: run=C:\WINDOWS\system32\scvhost.exe O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - d:\Reader\ActiveX\AcroIEHelper.ocx O2 - BHO: URLLink - {4A2AACF3-ADF6-11D5-98A9-00E018981B9E} - C:\Program Files\NewDotNet\newdotnet7_48.dll O2 - BHO: (no name) - {A5366673-E8CA-11D3-9CD9-0090271D075B} - (no file) O2 - BHO: (no name) - {FFFFFEF0-5B30-21D4-945D-000000000000} - D:\PROGRA~1\STARDO~1\SDIEInt.dll (file missing) O4 - HKLM\..\Run: [NVMixerTray] "C:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe" O4 - HKLM\..\Run: [NvCplDaemon] "RUNDLL32.EXE" C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] "nwiz.exe" /install O4 - HKLM\..\Run: [BearShare] "D:\Program Files\BearShare\BearShare.exe" /pause O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe" O4 - HKLM\..\Run: [NvMediaCenter] "RUNDLL32.EXE" C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [Picasa Media Detector] D:\Program Files\Picasa2\PicasaMediaDetector.exe O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u O4 - HKLM\..\Run: [WheelMouse] C:\PROGRA~1\A4Tech\Mouse\Amoumain.exe O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe O4 - HKLM\..\Run: [RemoteControl] "f:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe" O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [ISUSPM Startup] "C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" -startup O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start O4 - HKLM\..\Run: [New.net Startup] rundll32 C:\PROGRA~1\NEWDOT~1\NEWDOT~2.DLL,ClientStartup -s O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [NETIANET] C:\Program Files\Netia\Net\netianet.exe O4 - HKCU\..\Run: [Gadu-Gadu] "F:\Gadu-Gadu\gg.exe" /tray O4 - HKCU\..\Run: [Dzieńdobry!] D:\Program Files\VSD Software\Dzieńdobry!\dziendobry.exe /auto O4 - HKCU\..\Run: [Odkurzacz-MCD] d:\Program Files\Odkurzacz\odk_mcd.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll O16 - DPF: {A7196C8E-35A5-4FF0-9E46-E28918B5CAF6} (GameDesire Domino) - http://67.15.101.3/g_bin/pl/domino_2_0_0_28.cab O16 - DPF: {BFA1F11D-3121-AFE1-4112-894323212DAC} (GameDesire Word Games) - http://67.15.101.3/g_bin/pl/words_2_0_0_46.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{80652C03-ED33-4C96-9FF5-746573208EBC}: NameServer = 213.241.79.37 83.238.255.76 O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll O20 - Winlogon Notify: WRNotifier - C:\WINDOWS\SYSTEM32\WRLogonNTF.dll O23 - Service: ArcaBit NetMonitor (ABNetMon) - Unknown owner - C:\Program Files\MKS\Bin\NetMonSV.exe (file missing) O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Ahead\InCD\InCDsrv.exe O23 - Service: Kerio Personal Firewall 4 (KPF4) - Kerio Technologies - D:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe O23 - Service: Webroot Spy Sweeper Engine (WebrootSpySweeperService) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe -- File Associations ----------------------------------------------------------- .bat - batfile - "%1" %* .chm - chm.file - "C:\WINDOWS\hh.exe" %1 .cmd - cmdfile - "%1" %* .com - comfile - "%1" %* .exe - exefile - "%1" %* .hlp - hlpfile - %SystemRoot%\System32\winhlp32.exe %1 .inf - inffile - %SystemRoot%\System32\NOTEPAD.EXE %1 .ini - inifile - %SystemRoot%\System32\NOTEPAD.EXE %1 .js - JSFile - %SystemRoot%\System32\WScript.exe "%1" %* .lnk - lnkfile - {00021401-0000-0000-C000-000000000046} .pif - piffile - "%1" %* .reg - regfile - regedit.exe "%1" .scr - scrfile - "%1" /S .txt - txtfile - %SystemRoot%\system32\NOTEPAD.EXE %1 .vbs - VBSFile - %SystemRoot%\System32\WScript.exe "%1" %* -- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------- 1S ABTDI - C:\Program Files\MKS\Bin\ABTDI.sys (not found) 2S ADILOADER (General Purpose USB Driver (adildr.sys)) - C:\WINDOWS\system32\drivers\adildr.sys 3R adiusbaw (USB ADSL WAN Adapter) - C:\WINDOWS\system32\drivers\adiusbaw.sys 1R AmdK7 (Sterownik procesora AMD K7) - C:\WINDOWS\system32\drivers\amdk7.sys 1R Amfilter (A4Tech Mouse Filter Driver) - C:\WINDOWS\system32\drivers\Amfilter.sys 3S Amps2prt (A4Tech PS/2 Port Mouse Driver) - C:\WINDOWS\system32\drivers\Amps2prt.sys 3R Amusbprt (A4Tech HID-compliant Mouse Driver) - C:\WINDOWS\system32\drivers\Amusbprt.sys 2R Aspi32 - C:\WINDOWS\system32\drivers\ASPI32.SYS 3S bdfdll - C:\Program Files\Softwin\BitDefender9\bdfdll.sys 0R d347bus - C:\WINDOWS\system32\drivers\d347bus.sys 0R d347prt - C:\WINDOWS\system32\drivers\d347prt.sys 2R dvdmrp - C:\WINDOWS\system32\drivers\dvdmrp.sys 1R fwdrv (Firewall Driver) - C:\WINDOWS\system32\drivers\fwdrv.sys 2R GDTdiInterceptor - C:\WINDOWS\system32\drivers\GDTdiIcpt.sys 3S GMSIPCI - G:\INSTALL\GMSIPCI.SYS (not found) 3R HidUsb (Sterownik Microsoft klasy HID) - C:\WINDOWS\system32\drivers\hidusb.sys 3R HSFHWBS2 - C:\WINDOWS\system32\drivers\HSFBS2S2.sys 3R HSF_DP - C:\WINDOWS\system32\drivers\HSFDPSP2.sys 4R InCDfs (InCD File System) - C:\WINDOWS\system32\drivers\InCDfs.sys 1R InCDPass - C:\WINDOWS\system32\drivers\InCDpass.sys 1R incdrm (InCD Reader) - C:\WINDOWS\system32\drivers\InCDrm.sys 3S MBMIoDrvr - F:\Program Files\Motherboard Monitor 5\MBMIoDrvr.sys (not found) 2R mdmxsdk - C:\WINDOWS\system32\drivers\mdmxsdk.sys 3S mouhid (Sterownik myszy HID) - C:\WINDOWS\system32\drivers\mouhid.sys 3R nv - C:\WINDOWS\system32\drivers\nv4_mini.sys 0R nvatabus - C:\WINDOWS\system32\drivers\nvatabus.sys 3R nvax (Service for NVIDIA(R) nForce(TM) Audio Enumerator) - C:\WINDOWS\system32\drivers\nvax.sys 3R NVENET (NVIDIA nForce Networking Legacy Driver) - C:\WINDOWS\system32\drivers\NVENET.sys 3R nvnforce (Service for NVIDIA(R) nForce(TM) Audio) - C:\WINDOWS\system32\drivers\nvapu.sys 0R nv_agp (NVIDIA nForce AGP Bus Filter) - C:\WINDOWS\system32\drivers\nv_agp.SYS 3S PavSRK.sys - C:\WINDOWS\system32\PavSRK.sys (not found) 3S PavTPK.sys - C:\WINDOWS\system32\PavTPK.sys (not found) 0R PxHelp20 - C:\WINDOWS\system32\drivers\pxhelp20.sys 3S rtl8029 (Sterownik NT karty Realtek RTL8029(AS)-based PCI Ethernet) - C:\WINDOWS\system32\drivers\RTL8029.sys 0R sptd - C:\WINDOWS\system32\drivers\sptd.sys 0R SSFS041A (Spy Sweeper File System Filer Driver: 041A) - C:\WINDOWS\system32\drivers\SSFS041A.sys 0R SSHRMD (Spy Sweeper Hookrack MiniDriver) - C:\WINDOWS\system32\drivers\sshrmd.sys 0R SSIDRV (Spy Sweeper Interdiction Driver) - C:\WINDOWS\system32\drivers\ssidrv.sys 3R SSKBFD (Webroot Spy Sweeper Keylogger Shield Keyboard Filter) - C:\WINDOWS\system32\drivers\sskbfd.sys 3R usbehci (Sterownik Miniport rozszerzonego kontrolera hosta USB 2.0 Microsoft) - C:\WINDOWS\system32\drivers\usbehci.sys 3R usbohci (Sterownik Miniport otwartego kontrolera hosta USB Microsoft) - C:\WINDOWS\system32\drivers\usbohci.sys 3S usbscan (Sterownik skanera USB) - C:\WINDOWS\system32\drivers\usbscan.sys 3S USBSTOR (Sterownik magazynu masowego USB) - C:\WINDOWS\system32\drivers\USBSTOR.SYS 3R winachsf - C:\WINDOWS\system32\drivers\HSFCXTS2.sys 2R windrvNT - C:\WINDOWS\system32\windrvNT.sys 4S WS2IFSL (Środowisko wspomagające dostawcę usług innych niż IFS - Windows Socket 2.0) - C:\WINDOWS\system32\drivers\ws2ifsl.sys -- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled -------------------- 2S ABNetMon (ArcaBit NetMonitor) - C:\Program Files\MKS\Bin\NetMonSV.exe 3S Adobe LM Service - "C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe" 3S gusvc (Google Updater Service) - "C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe" 3S IDriverT (InstallDriver Table Manager) - "C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe" 2R InCDsrv (InCD Helper) - C:\Program Files\Ahead\InCD\InCDsrv.exe 2R KPF4 (Kerio Personal Firewall 4) - "D:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe" 0S NVSvc (NVIDIA Display Driver Service) - \SystemRoot\C:\WINDOWS\system32\nvsvc32.exe 2R UMWdf (Windows User Mode Driver Framework) - C:\WINDOWS\system32\wdfmgr.exe 2R WebrootSpySweeperService (Webroot Spy Sweeper Engine) - "C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe" -- Files created between 2007-02-28 and 2007-03-29 ----------------------------- 2007-03-27 17:51:30 193567 --a------ C:\WINDOWS\system32\ckl009.dat 2007-03-27 17:50:58 163328 --a------ C:\WINDOWS\system32\wsock32.sys 2007-03-22 18:32:56 0 d--hs---- C:\FOUND.008 2007-03-22 18:21:04 0 d--hs---- C:\FOUND.007 2007-03-22 18:02:01 0 d-------- C:\Program Files\VVSN 2007-03-22 17:53:07 183808 --a-s---- C:\WINDOWS\NDNuninstall7_48.exe<NDNUNI~2.EXE> 2007-03-22 17:49:47 0 d-------- C:\Program Files\themexp 2007-03-22 17:49:47 0 d-a-s---- C:\Program Files\NewDotNet<NEWDOT~1> 2007-03-22 11:14:07 56 -r-hs---- C:\WINDOWS\system32\5A626C9495.sys<5A626C~1.SYS> 2007-03-22 10:46:40 3350 --ahs---- C:\WINDOWS\system32\KGyGaAvL.sys 2007-03-22 10:23:38 639224 --a------ C:\WINDOWS\system32\drivers\sptd.sys 2007-03-18 14:19:12 125184 -----n--- C:\WINDOWS\system32\drivers\imagesrv.sys 2007-03-18 14:19:12 5504 -----n--- C:\WINDOWS\system32\drivers\imagedrv.sys 2007-03-18 14:19:01 106496 --a------ C:\WINDOWS\system32\TwnLib20.dll 2007-03-18 14:19:00 155648 --a------ C:\WINDOWS\system32\NeroCheck.exe<NEROCH~1.EXE> 2007-03-18 14:19:00 471040 -----n--- C:\WINDOWS\system32\ImagXRA7.dll 2007-03-18 14:19:00 262144 -----n--- C:\WINDOWS\system32\ImagXR7.dll 2007-03-18 14:19:00 476320 -----n--- C:\WINDOWS\system32\ImagXpr7.dll 2007-03-18 14:19:00 1568768 -----n--- C:\WINDOWS\system32\ImagX7.dll 2007-03-17 23:55:55 0 d-------- C:\Program Files\MSECache 2007-03-16 19:58:19 102160 --a------ C:\WINDOWS\system32\VB6KO.DLL 2007-03-16 19:55:47 0 d-------- C:\WINDOWS\Profiles 2007-03-16 19:55:01 2973696 -----n--- C:\WINDOWS\NuNinst.exe 2007-03-16 19:54:58 8704 -----n--- C:\WINDOWS\system32\drivers\InCDrec.sys 2007-03-16 19:54:58 29696 -----n--- C:\WINDOWS\system32\drivers\InCDpass.sys 2007-03-16 19:54:58 99584 -----n--- C:\WINDOWS\system32\drivers\InCDfs.sys 2007-03-16 19:54:57 28672 -----n--- C:\WINDOWS\system32\drivers\InCDrm.sys 2007-03-16 19:54:56 0 d-------- C:\WINDOWS\InCD 2007-03-16 19:53:54 0 d-------- C:\Program Files\CyberLink<CYBERL~1> 2007-03-16 19:53:36 40960 --a------ C:\Program Files\Uninstall_CDS.exe<UNINST~1.EXE> 2007-03-14 13:34:38 0 d--hs---- C:\FOUND.006 2007-03-14 12:17:25 0 d-------- C:\!KillBox 2007-03-13 21:20:00 0 d--hs---- C:\FOUND.005 2007-03-13 16:43:03 0 d-------- C:\WINDOWS\system32\Adobe 2007-03-11 06:51:28 0 d--hs---- C:\FOUND.004 2007-03-05 16:49:07 0 d-------- C:\Program Files\Sierra OnLine<SIERRA~1> 2007-03-02 10:22:51 0 d--h----- C:\WINDOWS\PIF -- Find3M Report --------------------------------------------------------------- 2007-03-28 18:22:52 5650 --a------ C:\WINDOWS\mozver.dat 2007-03-26 19:00:42 0 d-------- C:\Documents and Settings\Cinek\Dane aplikacji\Webroot 2007-03-24 10:22:54 2560 --a------ C:\WINDOWS\_MSRSTRT.EXE 2007-03-22 11:07:44 0 d-------- C:\Documents and Settings\Cinek\Dane aplikacji\Corel 2007-03-16 20:00:30 0 d-------- C:\Documents and Settings\Cinek\Dane aplikacji\CyberLink<CYBERL~1> 2007-03-16 19:55:46 0 d-------- C:\Documents and Settings\Cinek\Dane aplikacji\InterTrust<INTERT~1> 2007-03-12 18:06:22 0 d-------- C:\Documents and Settings\Cinek\Dane aplikacji\Sun 2007-03-11 22:24:12 0 d-------- C:\Documents and Settings\Cinek\Dane aplikacji\DivX 2007-03-10 12:56:22 0 d-------- C:\Documents and Settings\Cinek\Dane aplikacji\Apple Computer<APPLEC~1> 2007-03-08 22:17:02 0 d-------- C:\Documents and Settings\Cinek\Dane aplikacji\Adobe 2007-03-08 22:11:54 0 d-------- C:\Documents and Settings\Cinek\Dane aplikacji\Azureus 2007-03-07 15:14:16 0 d-------- C:\Documents and Settings\Cinek\Dane aplikacji\Winamp 2007-03-06 22:18:36 0 d-------- C:\Documents and Settings\Cinek\Dane aplikacji\Macromedia<MACROM~1> 2007-03-06 18:40:20 0 d-------- C:\Documents and Settings\Cinek\Dane aplikacji\Thunderbird<THUNDE~1> 2007-03-06 18:15:50 0 d-------- C:\Documents and Settings\Cinek\Dane aplikacji\Talkback 2007-03-06 18:15:46 0 d-------- C:\Documents and Settings\Cinek\Dane aplikacji\Mozilla 2007-03-06 18:14:40 0 d-------- C:\Documents and Settings\Cinek\Dane aplikacji\Identities<IDENTI~1> 2007-02-18 01:06:58 0 d-------- C:\Program Files\Common Files\Adobe Systems Shared<ADOBES~1> 2007-02-17 11:41:32 0 d-------- C:\Program Files\Netia 2007-02-14 09:46:32 0 d-------- C:\Program Files\Temp 2007-02-14 09:46:32 0 d-------- C:\Program Files\GinDomino<GINDOM~1> 2007-02-14 09:46:32 0 d-------- C:\Program Files\Common 2007-02-14 09:46:32 0 d-------- C:\Program Files\Adv 2007-02-02 00:59:50 73216 --a------ C:\WINDOWS\ST6UNST.EXE 2007-02-02 00:59:50 458752 -----n--- C:\WINDOWS\Setup1.exe 2007-01-29 09:58:06 60416 -----n--- C:\WINDOWS\system32\tzchange.exe 2007-01-25 20:22:36 21759 --a------ C:\WINDOWS\nsreg.dat 2007-01-15 18:03:44 208384 --a------ C:\WINDOWS\ADS.exe -- Registry Dump --------------------------------------------------------------- Znak zach©ty wiersza polecenia zostaˆ wyˆĄczony przez administratora. Aby kontynuowa†, naci˜nij dowolny klawisz . . . -- Hosts ----------------------------------------------------------------------- 127.0.0.1 abcsearch.com 127.0.0.1 admin.abcsearch.com 127.0.0.1 www3.abcsearch.com #[Browseraid] 127.0.0.1 www.abcsearch.com 127.0.0.1 abc517.net #[Trojan.Mitglieder.H] 127.0.0.1 acestats.com 127.0.0.1 www.acestats.com 127.0.0.1 actualnames.com #[Parasite.ActualNames] 127.0.0.1 www.actualnames.com 127.0.0.1 ad-up.com 4685 more entries in hosts file. -- End of ComboScan: finished at 2007-03-29 at 20:32:27 ------------------------

Kod: Zaznacz wszystko: [size=75][ [i][b][color=#B50158]Dodano:[/b] Dzisiaj o 21:39[/i] ][/size] [/color] [code]ComboScan v20070306.20 run by Cinek on 2007-03-29 at 20:31:20 Supplementary logfile - please post this as an attachment with your post. -------------------------------------------------------------------------------- -- System Information ---------------------------------------------------------- Microsoft Windows XP Professional (build 2600) SP 2.0 Architecture: X86; Language: Polish CPU 0: AMD Athlon(tm) XP 2500+ Percentage of Memory in Use: 50% Physical Memory (total/avail): 1023.49 MiB / 506.81 MiB Pagefile Memory (total/avail): 2463.86 MiB / 2123.87 MiB Virtual Memory (total/avail): 2047.88 MiB / 1978.77 MiB A: is Removable (No Media) C: is Fixed (FAT32) - 14.63 GiB total, 4.23 GiB free. D: is Fixed (FAT32) - 19.52 GiB total, 14.28 GiB free. E: is Fixed (NTFS) - 48.83 GiB total, 20.4 GiB free. F: is Fixed (FAT32) - 28.76 GiB total, 16.87 GiB free. G: is CDROM (No Media) H: is CDROM (No Media) I: is CDROM (No Media) J: is CDROM (No Media) K: is CDROM (No Media) L: is CDROM (No Media) -- Security Center ------------------------------------------------------------- AUOptions is scheduled to auto-install. Windows Internal Firewall is disabled. -- Environment Variables ------------------------------------------------------- Znak zach©ty wiersza polecenia zostaˆ wyˆĄczony przez administratora. Aby kontynuowa†, naci˜nij dowolny klawisz . . . -- User Profiles --------------------------------------------------------------- mama [I](admin)[/I] Cinek [I](admin)[/I] Administrator [I](admin)[/I] -- Add/Remove Programs --------------------------------------------------------- Znak zach©ty wiersza polecenia zostaˆ wyˆĄczony przez administratora. Aby kontynuowa†, naci˜nij dowolny klawisz . . . -- End of ComboScan: finished at 2007-03-29 at 20:32:27 ------------------------ [/code] [size=75][ [i][b][color=#B50158]Dodano:[/b] Dzisiaj o 21:45[/i] ][/size] [/color] [code]"Silent Runners.vbs", revision R50, http://www.silentrunners.org/ Operating System: Windows XP SP2 Output limited to non-default values, except where indicated by "{++}" Startup items buried in registry: --------------------------------- HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ {++} "CTFMON.EXE" = "C:\WINDOWS\system32\ctfmon.exe" [MS] "Gadu-Gadu" = ""F:\Gadu-Gadu\gg.exe" /tray" ["sms-express.com"] "Dzieńdobry!" = "D:\Program Files\VSD Software\Dzieńdobry!\dziendobry.exe /auto" ["VSD Software"] "PowerBar" = "(empty string)" [file not found] "Odkurzacz-MCD" = "d:\Program Files\Odkurzacz\odk_mcd.exe" ["Franmo Software"] HKLM\Software\Microsoft\Windows\CurrentVersion\Run\ {++} "NVMixerTray" = ""C:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe"" ["NVIDIA Corporation"] "NvCplDaemon" = ""RUNDLL32.EXE" C:\WINDOWS\system32\NvCpl.dll,NvStartup" [MS] "nwiz" = ""nwiz.exe" /install" ["NVIDIA Corporation"] "BearShare" = ""D:\Program Files\BearShare\BearShare.exe" /pause" ["Free Peers, Inc."] "SunJavaUpdateSched" = ""C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe"" ["Sun Microsystems, Inc."] "NvMediaCenter" = ""RUNDLL32.EXE" C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit" [MS] "WheelMouse" = "C:\PROGRA~1\A4Tech\Mouse\Amoumain.exe" ["A4Tech Co.,Ltd."] "RemoteControl" = ""f:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe"" ["Cyberlink Corp."] "NeroFilterCheck" = "C:\WINDOWS\system32\NeroCheck.exe" ["Ahead Software Gmbh"] "ISUSPM Startup" = ""C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" -startup" ["Macrovision Corporation"] "ISUSScheduler" = ""C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start" ["Macrovision Corporation"] HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\(Default) = (no title provided) -> {HKLM...CLSID} = "AcroIEHlprObj Class" \InProcServer32\(Default) = "d:\Reader\ActiveX\AcroIEHelper.ocx" [empty string] HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\ "{42071714-76d4-11d1-8b24-00a0c9068ff3}" = "Rozszerzenie CPL kadrowania wyświetlania" -> {HKLM...CLSID} = "Rozszerzenie CPL kadrowania wyświetlania" \InProcServer32\(Default) = "deskpan.dll" [file not found] "{88895560-9AA2-1069-930E-00AA0030EBC8}" = "Rozszerzenie ikony HyperTerminalu" -> {HKLM...CLSID} = "HyperTerminal Icon Ext" \InProcServer32\(Default) = "C:\WINDOWS\system32\hticons.dll" ["Hilgraeve, Inc."]

**Posty:** 18165 · przez **wojtas** 29 Mar 2007, 23:02

Wyłącz przywracanie systemu ( właściwości mój komputer-zakładka przywracanie - wyłącz przywracanie na wszystkich dyskach)
Start do awaryjnego ( F8 ) przy starcie komputera

C:\Program Files\VVSN
C:\WINDOWS\NDNuninstall7_48.exe
C:\Program Files\NewDotNet
C:\WINDOWS\system32\5A626C9495.sys
C:\!KillBox
C:\WINDOWS\Setup1.exe
C:\WINDOWS\ADS.exe

Pogrubione pliki usuwasz ręcznie z dysku

C:\WINDOWS\system32\ckl009.dat

ten plik daj na skaner:

http://virusscan.jotti.org/

i wklej po tym raport ze skanera + combo

**Posty:** 2116 · przez **cinek383** 29 Mar 2007, 23:20

Kod: Zaznacz wszystko: ComboScan v20070306.20 run by Cinek on 2007-03-29 at 20:31:20 Computer is in Normal Mode. -------------------------------------------------------------------------------- -- System Restore -------------------------------------------------------------- System Restore is disabled; attempting to re-enable...failed; access is denied. Performed disk cleanup. -- HijackThis (run as Cinek.exe) ----------------------------------------------- Logfile of HijackThis v1.99.1 Scan saved at 20:32:08, on 2007-03-29 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\SYSTEM32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Ahead\InCD\InCDsrv.exe C:\WINDOWS\system32\spoolsv.exe D:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe D:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe D:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe C:\WINDOWS\system32\WgaTray.exe C:\WINDOWS\Explorer.EXE C:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe C:\WINDOWS\system32\RUNDLL32.EXE C:\PROGRA~1\A4Tech\Mouse\Amoumain.exe C:\Program Files\Ahead\InCD\InCD.exe F:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\system32\wuauclt.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Netia\Net\netianet.exe C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe D:\Program Files\Azureus\Azureus.exe F:\Gadu-Gadu\gg.exe D:\PROGRA~1\MOZILL~1\FIREFOX.EXE F:\PLIKI POBRANE\comboscan.exe C:\PROGRA~1\HIJACK~1\Cinek.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://home.netscape.com R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://home.netscape.com/home/winsearch.html R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://home.netscape.com/home/winsearch200.html R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://home.netscape.com/home/winsearch.html R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://home.netscape.com R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://megapanel.gem.pl/q.php?s=toEWHm4c0IDs3d3WeKzqG.N7&o=7505&id=0lRxEiS829nNM_zwT5IuRvI7&t=1173594028&n=1 R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza F3 - REG:win.ini: load=C:\WINDOWS\system32\scvhost.exe F3 - REG:win.ini: run=C:\WINDOWS\system32\scvhost.exe O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - d:\Reader\ActiveX\AcroIEHelper.ocx O2 - BHO: URLLink - {4A2AACF3-ADF6-11D5-98A9-00E018981B9E} - C:\Program Files\NewDotNet\newdotnet7_48.dll O2 - BHO: (no name) - {A5366673-E8CA-11D3-9CD9-0090271D075B} - (no file) O2 - BHO: (no name) - {FFFFFEF0-5B30-21D4-945D-000000000000} - D:\PROGRA~1\STARDO~1\SDIEInt.dll (file missing) O4 - HKLM\..\Run: [NVMixerTray] "C:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe" O4 - HKLM\..\Run: [NvCplDaemon] "RUNDLL32.EXE" C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] "nwiz.exe" /install O4 - HKLM\..\Run: [BearShare] "D:\Program Files\BearShare\BearShare.exe" /pause O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe" O4 - HKLM\..\Run: [NvMediaCenter] "RUNDLL32.EXE" C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [Picasa Media Detector] D:\Program Files\Picasa2\PicasaMediaDetector.exe O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u O4 - HKLM\..\Run: [WheelMouse] C:\PROGRA~1\A4Tech\Mouse\Amoumain.exe O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe O4 - HKLM\..\Run: [RemoteControl] "f:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe" O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [ISUSPM Startup] "C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" -startup O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start O4 - HKLM\..\Run: [New.net Startup] rundll32 C:\PROGRA~1\NEWDOT~1\NEWDOT~2.DLL,ClientStartup -s O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [NETIANET] C:\Program Files\Netia\Net\netianet.exe O4 - HKCU\..\Run: [Gadu-Gadu] "F:\Gadu-Gadu\gg.exe" /tray O4 - HKCU\..\Run: [Dzieńdobry!] D:\Program Files\VSD Software\Dzieńdobry!\dziendobry.exe /auto O4 - HKCU\..\Run: [Odkurzacz-MCD] d:\Program Files\Odkurzacz\odk_mcd.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll O16 - DPF: {A7196C8E-35A5-4FF0-9E46-E28918B5CAF6} (GameDesire Domino) - http://67.15.101.3/g_bin/pl/domino_2_0_0_28.cab O16 - DPF: {BFA1F11D-3121-AFE1-4112-894323212DAC} (GameDesire Word Games) - http://67.15.101.3/g_bin/pl/words_2_0_0_46.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{80652C03-ED33-4C96-9FF5-746573208EBC}: NameServer = 213.241.79.37 83.238.255.76 O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll O20 - Winlogon Notify: WRNotifier - C:\WINDOWS\SYSTEM32\WRLogonNTF.dll O23 - Service: ArcaBit NetMonitor (ABNetMon) - Unknown owner - C:\Program Files\MKS\Bin\NetMonSV.exe (file missing) O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Ahead\InCD\InCDsrv.exe O23 - Service: Kerio Personal Firewall 4 (KPF4) - Kerio Technologies - D:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe O23 - Service: Webroot Spy Sweeper Engine (WebrootSpySweeperService) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe -- File Associations ----------------------------------------------------------- .bat - batfile - "%1" %* .chm - chm.file - "C:\WINDOWS\hh.exe" %1 .cmd - cmdfile - "%1" %* .com - comfile - "%1" %* .exe - exefile - "%1" %* .hlp - hlpfile - %SystemRoot%\System32\winhlp32.exe %1 .inf - inffile - %SystemRoot%\System32\NOTEPAD.EXE %1 .ini - inifile - %SystemRoot%\System32\NOTEPAD.EXE %1 .js - JSFile - %SystemRoot%\System32\WScript.exe "%1" %* .lnk - lnkfile - {00021401-0000-0000-C000-000000000046} .pif - piffile - "%1" %* .reg - regfile - regedit.exe "%1" .scr - scrfile - "%1" /S .txt - txtfile - %SystemRoot%\system32\NOTEPAD.EXE %1 .vbs - VBSFile - %SystemRoot%\System32\WScript.exe "%1" %* -- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------- 1S ABTDI - C:\Program Files\MKS\Bin\ABTDI.sys (not found) 2S ADILOADER (General Purpose USB Driver (adildr.sys)) - C:\WINDOWS\system32\drivers\adildr.sys 3R adiusbaw (USB ADSL WAN Adapter) - C:\WINDOWS\system32\drivers\adiusbaw.sys 1R AmdK7 (Sterownik procesora AMD K7) - C:\WINDOWS\system32\drivers\amdk7.sys 1R Amfilter (A4Tech Mouse Filter Driver) - C:\WINDOWS\system32\drivers\Amfilter.sys 3S Amps2prt (A4Tech PS/2 Port Mouse Driver) - C:\WINDOWS\system32\drivers\Amps2prt.sys 3R Amusbprt (A4Tech HID-compliant Mouse Driver) - C:\WINDOWS\system32\drivers\Amusbprt.sys 2R Aspi32 - C:\WINDOWS\system32\drivers\ASPI32.SYS 3S bdfdll - C:\Program Files\Softwin\BitDefender9\bdfdll.sys 0R d347bus - C:\WINDOWS\system32\drivers\d347bus.sys 0R d347prt - C:\WINDOWS\system32\drivers\d347prt.sys 2R dvdmrp - C:\WINDOWS\system32\drivers\dvdmrp.sys 1R fwdrv (Firewall Driver) - C:\WINDOWS\system32\drivers\fwdrv.sys 2R GDTdiInterceptor - C:\WINDOWS\system32\drivers\GDTdiIcpt.sys 3S GMSIPCI - G:\INSTALL\GMSIPCI.SYS (not found) 3R HidUsb (Sterownik Microsoft klasy HID) - C:\WINDOWS\system32\drivers\hidusb.sys 3R HSFHWBS2 - C:\WINDOWS\system32\drivers\HSFBS2S2.sys 3R HSF_DP - C:\WINDOWS\system32\drivers\HSFDPSP2.sys 4R InCDfs (InCD File System) - C:\WINDOWS\system32\drivers\InCDfs.sys 1R InCDPass - C:\WINDOWS\system32\drivers\InCDpass.sys 1R incdrm (InCD Reader) - C:\WINDOWS\system32\drivers\InCDrm.sys 3S MBMIoDrvr - F:\Program Files\Motherboard Monitor 5\MBMIoDrvr.sys (not found) 2R mdmxsdk - C:\WINDOWS\system32\drivers\mdmxsdk.sys 3S mouhid (Sterownik myszy HID) - C:\WINDOWS\system32\drivers\mouhid.sys 3R nv - C:\WINDOWS\system32\drivers\nv4_mini.sys 0R nvatabus - C:\WINDOWS\system32\drivers\nvatabus.sys 3R nvax (Service for NVIDIA(R) nForce(TM) Audio Enumerator) - C:\WINDOWS\system32\drivers\nvax.sys 3R NVENET (NVIDIA nForce Networking Legacy Driver) - C:\WINDOWS\system32\drivers\NVENET.sys 3R nvnforce (Service for NVIDIA(R) nForce(TM) Audio) - C:\WINDOWS\system32\drivers\nvapu.sys 0R nv_agp (NVIDIA nForce AGP Bus Filter) - C:\WINDOWS\system32\drivers\nv_agp.SYS 3S PavSRK.sys - C:\WINDOWS\system32\PavSRK.sys (not found) 3S PavTPK.sys - C:\WINDOWS\system32\PavTPK.sys (not found) 0R PxHelp20 - C:\WINDOWS\system32\drivers\pxhelp20.sys 3S rtl8029 (Sterownik NT karty Realtek RTL8029(AS)-based PCI Ethernet) - C:\WINDOWS\system32\drivers\RTL8029.sys 0R sptd - C:\WINDOWS\system32\drivers\sptd.sys 0R SSFS041A (Spy Sweeper File System Filer Driver: 041A) - C:\WINDOWS\system32\drivers\SSFS041A.sys 0R SSHRMD (Spy Sweeper Hookrack MiniDriver) - C:\WINDOWS\system32\drivers\sshrmd.sys 0R SSIDRV (Spy Sweeper Interdiction Driver) - C:\WINDOWS\system32\drivers\ssidrv.sys 3R SSKBFD (Webroot Spy Sweeper Keylogger Shield Keyboard Filter) - C:\WINDOWS\system32\drivers\sskbfd.sys 3R usbehci (Sterownik Miniport rozszerzonego kontrolera hosta USB 2.0 Microsoft) - C:\WINDOWS\system32\drivers\usbehci.sys 3R usbohci (Sterownik Miniport otwartego kontrolera hosta USB Microsoft) - C:\WINDOWS\system32\drivers\usbohci.sys 3S usbscan (Sterownik skanera USB) - C:\WINDOWS\system32\drivers\usbscan.sys 3S USBSTOR (Sterownik magazynu masowego USB) - C:\WINDOWS\system32\drivers\USBSTOR.SYS 3R winachsf - C:\WINDOWS\system32\drivers\HSFCXTS2.sys 2R windrvNT - C:\WINDOWS\system32\windrvNT.sys 4S WS2IFSL (Środowisko wspomagające dostawcę usług innych niż IFS - Windows Socket 2.0) - C:\WINDOWS\system32\drivers\ws2ifsl.sys -- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled -------------------- 2S ABNetMon (ArcaBit NetMonitor) - C:\Program Files\MKS\Bin\NetMonSV.exe 3S Adobe LM Service - "C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe" 3S gusvc (Google Updater Service) - "C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe" 3S IDriverT (InstallDriver Table Manager) - "C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe" 2R InCDsrv (InCD Helper) - C:\Program Files\Ahead\InCD\InCDsrv.exe 2R KPF4 (Kerio Personal Firewall 4) - "D:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe" 0S NVSvc (NVIDIA Display Driver Service) - \SystemRoot\C:\WINDOWS\system32\nvsvc32.exe 2R UMWdf (Windows User Mode Driver Framework) - C:\WINDOWS\system32\wdfmgr.exe 2R WebrootSpySweeperService (Webroot Spy Sweeper Engine) - "C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe" -- Files created between 2007-02-28 and 2007-03-29 ----------------------------- 2007-03-27 17:51:30 193567 --a------ C:\WINDOWS\system32\ckl009.dat 2007-03-27 17:50:58 163328 --a------ C:\WINDOWS\system32\wsock32.sys 2007-03-22 18:32:56 0 d--hs---- C:\FOUND.008 2007-03-22 18:21:04 0 d--hs---- C:\FOUND.007 2007-03-22 18:02:01 0 d-------- C:\Program Files\VVSN 2007-03-22 17:53:07 183808 --a-s---- C:\WINDOWS\NDNuninstall7_48.exe<NDNUNI~2.EXE> 2007-03-22 17:49:47 0 d-------- C:\Program Files\themexp 2007-03-22 17:49:47 0 d-a-s---- C:\Program Files\NewDotNet<NEWDOT~1> 2007-03-22 11:14:07 56 -r-hs---- C:\WINDOWS\system32\5A626C9495.sys<5A626C~1.SYS> 2007-03-22 10:46:40 3350 --ahs---- C:\WINDOWS\system32\KGyGaAvL.sys 2007-03-22 10:23:38 639224 --a------ C:\WINDOWS\system32\drivers\sptd.sys 2007-03-18 14:19:12 125184 -----n--- C:\WINDOWS\system32\drivers\imagesrv.sys 2007-03-18 14:19:12 5504 -----n--- C:\WINDOWS\system32\drivers\imagedrv.sys 2007-03-18 14:19:01 106496 --a------ C:\WINDOWS\system32\TwnLib20.dll 2007-03-18 14:19:00 155648 --a------ C:\WINDOWS\system32\NeroCheck.exe<NEROCH~1.EXE> 2007-03-18 14:19:00 471040 -----n--- C:\WINDOWS\system32\ImagXRA7.dll 2007-03-18 14:19:00 262144 -----n--- C:\WINDOWS\system32\ImagXR7.dll 2007-03-18 14:19:00 476320 -----n--- C:\WINDOWS\system32\ImagXpr7.dll 2007-03-18 14:19:00 1568768 -----n--- C:\WINDOWS\system32\ImagX7.dll 2007-03-17 23:55:55 0 d-------- C:\Program Files\MSECache 2007-03-16 19:58:19 102160 --a------ C:\WINDOWS\system32\VB6KO.DLL 2007-03-16 19:55:47 0 d-------- C:\WINDOWS\Profiles 2007-03-16 19:55:01 2973696 -----n--- C:\WINDOWS\NuNinst.exe 2007-03-16 19:54:58 8704 -----n--- C:\WINDOWS\system32\drivers\InCDrec.sys 2007-03-16 19:54:58 29696 -----n--- C:\WINDOWS\system32\drivers\InCDpass.sys 2007-03-16 19:54:58 99584 -----n--- C:\WINDOWS\system32\drivers\InCDfs.sys 2007-03-16 19:54:57 28672 -----n--- C:\WINDOWS\system32\drivers\InCDrm.sys 2007-03-16 19:54:56 0 d-------- C:\WINDOWS\InCD 2007-03-16 19:53:54 0 d-------- C:\Program Files\CyberLink<CYBERL~1> 2007-03-16 19:53:36 40960 --a------ C:\Program Files\Uninstall_CDS.exe<UNINST~1.EXE> 2007-03-14 13:34:38 0 d--hs---- C:\FOUND.006 2007-03-14 12:17:25 0 d-------- C:\!KillBox 2007-03-13 21:20:00 0 d--hs---- C:\FOUND.005 2007-03-13 16:43:03 0 d-------- C:\WINDOWS\system32\Adobe 2007-03-11 06:51:28 0 d--hs---- C:\FOUND.004 2007-03-05 16:49:07 0 d-------- C:\Program Files\Sierra OnLine<SIERRA~1> 2007-03-02 10:22:51 0 d--h----- C:\WINDOWS\PIF -- Find3M Report --------------------------------------------------------------- 2007-03-28 18:22:52 5650 --a------ C:\WINDOWS\mozver.dat 2007-03-26 19:00:42 0 d-------- C:\Documents and Settings\Cinek\Dane aplikacji\Webroot 2007-03-24 10:22:54 2560 --a------ C:\WINDOWS\_MSRSTRT.EXE 2007-03-22 11:07:44 0 d-------- C:\Documents and Settings\Cinek\Dane aplikacji\Corel 2007-03-16 20:00:30 0 d-------- C:\Documents and Settings\Cinek\Dane aplikacji\CyberLink<CYBERL~1> 2007-03-16 19:55:46 0 d-------- C:\Documents and Settings\Cinek\Dane aplikacji\InterTrust<INTERT~1> 2007-03-12 18:06:22 0 d-------- C:\Documents and Settings\Cinek\Dane aplikacji\Sun 2007-03-11 22:24:12 0 d-------- C:\Documents and Settings\Cinek\Dane aplikacji\DivX 2007-03-10 12:56:22 0 d-------- C:\Documents and Settings\Cinek\Dane aplikacji\Apple Computer<APPLEC~1> 2007-03-08 22:17:02 0 d-------- C:\Documents and Settings\Cinek\Dane aplikacji\Adobe 2007-03-08 22:11:54 0 d-------- C:\Documents and Settings\Cinek\Dane aplikacji\Azureus 2007-03-07 15:14:16 0 d-------- C:\Documents and Settings\Cinek\Dane aplikacji\Winamp 2007-03-06 22:18:36 0 d-------- C:\Documents and Settings\Cinek\Dane aplikacji\Macromedia<MACROM~1> 2007-03-06 18:40:20 0 d-------- C:\Documents and Settings\Cinek\Dane aplikacji\Thunderbird<THUNDE~1> 2007-03-06 18:15:50 0 d-------- C:\Documents and Settings\Cinek\Dane aplikacji\Talkback 2007-03-06 18:15:46 0 d-------- C:\Documents and Settings\Cinek\Dane aplikacji\Mozilla 2007-03-06 18:14:40 0 d-------- C:\Documents and Settings\Cinek\Dane aplikacji\Identities<IDENTI~1> 2007-02-18 01:06:58 0 d-------- C:\Program Files\Common Files\Adobe Systems Shared<ADOBES~1> 2007-02-17 11:41:32 0 d-------- C:\Program Files\Netia 2007-02-14 09:46:32 0 d-------- C:\Program Files\Temp 2007-02-14 09:46:32 0 d-------- C:\Program Files\GinDomino<GINDOM~1> 2007-02-14 09:46:32 0 d-------- C:\Program Files\Common 2007-02-14 09:46:32 0 d-------- C:\Program Files\Adv 2007-02-02 00:59:50 73216 --a------ C:\WINDOWS\ST6UNST.EXE 2007-02-02 00:59:50 458752 -----n--- C:\WINDOWS\Setup1.exe 2007-01-29 09:58:06 60416 -----n--- C:\WINDOWS\system32\tzchange.exe 2007-01-25 20:22:36 21759 --a------ C:\WINDOWS\nsreg.dat 2007-01-15 18:03:44 208384 --a------ C:\WINDOWS\ADS.exe -- Registry Dump --------------------------------------------------------------- Znak zach©ty wiersza polecenia zostaˆ wyˆĄczony przez administratora. Aby kontynuowa†, naci˜nij dowolny klawisz . . . -- Hosts ----------------------------------------------------------------------- 127.0.0.1 abcsearch.com 127.0.0.1 admin.abcsearch.com 127.0.0.1 www3.abcsearch.com #[Browseraid] 127.0.0.1 www.abcsearch.com 127.0.0.1 abc517.net #[Trojan.Mitglieder.H] 127.0.0.1 acestats.com 127.0.0.1 www.acestats.com 127.0.0.1 actualnames.com #[Parasite.ActualNames] 127.0.0.1 www.actualnames.com 127.0.0.1 ad-up.com 4685 more entries in hosts file. -- End of ComboScan: finished at 2007-03-29 at 20:32:27 ------------------------ [size=9][ [i][b][color=#B50158]Dodano:[/b] Dzisiaj o 22:20[/i] ][/size] [/color] ComboScan v20070306.20 run by Cinek on 2007-03-29 at 20:31:20 Supplementary logfile - please post this as an attachment with your post. -------------------------------------------------------------------------------- -- System Information ---------------------------------------------------------- Microsoft Windows XP Professional (build 2600) SP 2.0 Architecture: X86; Language: Polish CPU 0: AMD Athlon(tm) XP 2500+ Percentage of Memory in Use: 50% Physical Memory (total/avail): 1023.49 MiB / 506.81 MiB Pagefile Memory (total/avail): 2463.86 MiB / 2123.87 MiB Virtual Memory (total/avail): 2047.88 MiB / 1978.77 MiB A: is Removable (No Media) C: is Fixed (FAT32) - 14.63 GiB total, 4.23 GiB free. D: is Fixed (FAT32) - 19.52 GiB total, 14.28 GiB free. E: is Fixed (NTFS) - 48.83 GiB total, 20.4 GiB free. F: is Fixed (FAT32) - 28.76 GiB total, 16.87 GiB free. G: is CDROM (No Media) H: is CDROM (No Media) I: is CDROM (No Media) J: is CDROM (No Media) K: is CDROM (No Media) L: is CDROM (No Media) -- Security Center ------------------------------------------------------------- AUOptions is scheduled to auto-install. Windows Internal Firewall is disabled. -- Environment Variables ------------------------------------------------------- Znak zach©ty wiersza polecenia zostaˆ wyˆĄczony przez administratora. Aby kontynuowa†, naci˜nij dowolny klawisz . . . -- User Profiles --------------------------------------------------------------- mama [i](admin)[/i] Cinek [i](admin)[/i] Administrator [i](admin)[/i] -- Add/Remove Programs --------------------------------------------------------- Znak zach©ty wiersza polecenia zostaˆ wyˆĄczony przez administratora. Aby kontynuowa†, naci˜nij dowolny klawisz . . . -- End of ComboScan: finished at 2007-03-29 at 20:32:27 ------------------------

**Posty:** 18165 · przez **wojtas** 29 Mar 2007, 23:25

Pobierz i uruchom narzędzie : The Avenger
http://swandog46.geekstogo.com/avenger.zip
Zaznacz opcję Input script manually i kliknij na Lupkę z prawej strony. W okienku, które się otworzy wklejasz:

Files to delete:
C:\WINDOWS\Setup1.exe
C:\WINDOWS\ADS.exe
C:\WINDOWS\NDNuninstall7_48.exe
C:\WINDOWS\system32\5A626C9495.sys

Folders to delete:

C:\Program Files\VVSN
C:\Program Files\NewDotNet

Klikasz Done, a następnie zielone światełko i zgadzasz się na restart klikając OK.

wejdź na dysk na którym masz windows zainstalowany, tam w katalog WINDOWS -> system 32 -> drivers -> etc
i tam za pomocą notatnika otwórz plik hosts

Jeśli są jakieś wpisy pod

# 102.54.94.97 rhino.acme.com # serwer źródłowy
# 38.25.63.10 x.acme.com # komputer kliencki x

127.0.0.1 localhost

to usun tylko zostaw te pokazane przeze mnie wyzej

Kasujesz ręcznie z dysku plik: C:\Avenger\backup.zip i wklejasz na forum raport: C:\avenger.txt i combo

błąd

błąd

Kto jest na forum