brak neta, dysków i sterów

**Posty:** 419 · przez **baniol22** 25 Paź 2007, 08:24

Wczoraj kiedy byłem w Googlach nagle zawiesił mi się komputer. Po ponownym uruchomieniu nie było internetu, nie dalo się otworzyć dysków, oraz znikneły sterowniki do karty graficznej. Najdziwniejsze jest to, że 2 dni temu ktoś zmienił mi hasło do pewnego serwisu. Nie mogę wkleić loga bo nie da się uruchomić neta

Zablokowałem wszystkie porty, ale to nie pomogło. Kiedy wejdę do menadżera zadań widać, że działa proces "kill", który ma ikonkę jak MS word. Kiedy przejdę do procesu jest napisane, że to svchost.exe (czy jakoś tak). Proszę o pomoc, z góry dziękuję

**Posty:** 237 · przez **Kuba1** 25 Paź 2007, 14:04

Rozumiem, że dostęp do internetu masz w innym komputerze, dlategotez:
Ściągnij sobie SDFix

Ściągnij następnie BOOTSAFE

uruchom w trybie normalnym>>Zaznacz >>Safe Mode Networking>>Klikasz Reboot >>Znajdujesz się w trybie awaryjnym .

Teraz używasz SDFix

*Gdy już jesteśmy w trybie awaryjnym,wchodzimy do folderu SDFix i uruchamiamy narzędzie klikająć
2-krotnie na plik RunThis.bat lewym przyciskiem myszy.

*Wciskamy Y co uruchomi proces usuwania

*Kiedy proces usuwania się zakończy wciskamy dowolny klawisz>>nastąpi restart.

*Po restarcie SDFix dokończy proces usuwania,kiedy w oknie narzędzia SDFix pojawi się napis Finished
klikamy dowolny klawisz,narzędzie zakończy swoją pracę,na pulpicie załadują się ikony.

*Wchodzimy do folderu SDFix i kopiujemy zawartość pliku tekstowego Report.txt i wklejamy go na forum

Jeśli teraz możesz to ściągnij ComboFix zastosuj w trybie normalnym i wklej z niego loga.

Postaraj sie na forum wkleic raport z SDFix oraz log z ComboFix.

Wogóle to najlepiej by było gdybyś w innym komputerze który ma dostęp do neta pobrał ComboFix i SDFix i zastosował je. SDFix>> tryb awaryjny ComboFix>>Tryb normalny

Żebysmy mogli wykluczyć wirusy potrzebne są nam logi..

**Posty:** 419 · przez **baniol22** 25 Paź 2007, 16:35

SdFix (to miało być takie małe)

Kod: Zaznacz wszystko: SDFix: Version 1.112 Run by Administrator on 07-10-25 at 16:11 Microsoft Windows XP [Wersja 5.1.2600] Running From: J:\NOWYFO~1\NOWYFO~1\SDFix Safe Mode: Checking Services: Restoring Windows Registry Values Restoring Windows Default Hosts File

ComboFix

Kod: Zaznacz wszystko: ComboFix 07-10-23.1 - Baniol 2007-10-25 16:23:58.1 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.2.1250.1.1045.18.469 [GMT 2:00] Running from: J:\Nowy folder\ComboFix.exe * Created a new restore point . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\Autorun.inf C:\tel.xls.exe D:\autorun.inf E:\Autorun.inf E:\WINDOWS\backinf.tab E:\WINDOWS\ufdata2000.log J:\autorun.inf . ((((((((((((((((((((((((( Files Created from 2007-09-25 to 2007-10-25 ))))))))))))))))))))))))))))))) . 2007-10-25 16:22 51,200 --a------ E:\WINDOWS\NirCmd.exe 2007-10-25 16:17 1,422 --a------ E:\Documents and Settings\Baniol\clean.reg 2007-10-25 16:11 <DIR> d-------- E:\WINDOWS\ERUNT 2007-10-25 16:10 <DIR> d--h----- E:\Documents and Settings\Administrator\Ustawienia lokalne 2007-10-25 16:10 <DIR> d-------- E:\Documents and Settings\Administrator\Ulubione 2007-10-25 16:10 <DIR> d--h----- E:\Documents and Settings\Administrator\Szablony 2007-10-25 16:10 <DIR> d-------- E:\Documents and Settings\Administrator\Pulpit 2007-10-25 16:10 <DIR> d-------- E:\Documents and Settings\Administrator\Moje dokumenty 2007-10-25 16:10 <DIR> dr------- E:\Documents and Settings\Administrator\Menu Start 2007-10-25 16:10 <DIR> dr-h----- E:\Documents and Settings\Administrator\Dane aplikacji 2007-10-25 15:12 20,992 --a------ E:\WINDOWS\system32\drivers\RTL8139.sys 2007-10-25 15:09 24,661 --a------ E:\WINDOWS\system32\spxcoins.dll 2007-10-25 15:09 13,312 --a------ E:\WINDOWS\system32\irclass.dll 2007-10-25 13:24 <DIR> d-------- E:\Program Files\Neostrada TP 2007-10-24 22:14 502,368 --a------ E:\WINDOWS\system32\drivers\amon.sys 2007-10-24 22:14 274,432 --a------ E:\WINDOWS\system32\imon.dll 2007-10-22 19:33 43,520 --a------ E:\WINDOWS\system32\CmdLineExt03.dll 2007-10-22 14:22 <DIR> d-------- E:\Program Files\Common Files\Blizzard Entertainment 2007-10-21 13:57 3,629,056 --a------ E:\WINDOWS\system32\nvvitvsr.dll 2007-10-21 13:57 3,551,232 --a------ E:\WINDOWS\system32\nvvitvs.dll 2007-10-21 13:57 2,441,216 --a------ E:\WINDOWS\system32\nvwssr.dll 2007-10-21 13:57 2,371,584 --a------ E:\WINDOWS\system32\nvwss.dll 2007-10-21 13:57 36,864 --a------ E:\WINDOWS\system32\nvcodins.dll 2007-10-21 13:57 36,864 --a------ E:\WINDOWS\system32\nvcod.dll 2007-10-21 01:04 <DIR> d-------- E:\WINDOWS\nview 2007-10-21 01:03 4,274,816 --a------ E:\WINDOWS\system32\nv4_disp.dll 2007-10-21 01:03 1,897,408 --a------ E:\WINDOWS\system32\drivers\nv4_mini.sys 2007-10-21 01:02 356,352 --a------ E:\WINDOWS\system32\nvudisp.exe 2007-10-21 00:58 356,352 --a------ E:\WINDOWS\system32\NVUNINST.EXE 2007-10-15 21:12 122,884 --a------ E:\WINDOWS\UnGins.exe 2007-10-12 21:41 <DIR> d-------- E:\WING 2007-10-12 21:41 188,960 --a------ E:\WINDOWS\system\WINGDE.DLL 2007-10-12 21:41 92,208 --a------ E:\WINDOWS\system\WING.DLL 2007-10-10 15:36 <DIR> d-------- E:\Documents and Settings\Tata.BANIOLEK\Dane aplikacji\Ahead 2007-10-10 15:35 <DIR> d-------- E:\Documents and Settings\Tata.BANIOLEK\Dane aplikacji\DivX 2007-10-07 22:22 314,368 --a------ E:\WINDOWS\KSGDeInstall.exe 2007-10-04 22:28 <DIR> d-------- E:\Documents and Settings\Baniol\Dane aplikacji\MEGAUPLOADTOOLBAR 2007-10-04 22:27 <DIR> d-------- E:\Program Files\Malicious Software Removal Tool 2007-10-04 22:16 288,768 --a------ E:\WINDOWS\system32\rhttpaa.dll 2007-10-04 22:16 116,736 --a------ E:\WINDOWS\system32\aaclient.dll 2007-10-04 22:16 36,352 --a------ E:\WINDOWS\system32\tsgqec.dll 2007-10-04 22:06 <DIR> d-------- E:\WINDOWS\l2schemas 2007-10-04 22:05 69,120 --a------ E:\WINDOWS\system32\wlanapi.dll 2007-10-04 22:04 62,336 --a------ E:\WINDOWS\system32\drivers\rspndr.sys 2007-10-04 22:04 10,752 --a------ E:\WINDOWS\system32\rspndr.exe 2007-10-04 21:49 <DIR> d-------- E:\WINDOWS\ServicePackFiles 2007-10-04 21:48 6,144 --a------ E:\WINDOWS\system32\kbdpash.dll 2007-10-04 21:48 6,144 --a------ E:\WINDOWS\system32\kbdnepr.dll 2007-10-04 21:48 6,144 --a------ E:\WINDOWS\system32\kbdiultn.dll 2007-10-04 21:48 6,144 --a------ E:\WINDOWS\system32\kbdbhc.dll 2007-10-04 21:19 349,696 --a------ E:\WINDOWS\system32\hypertrm.dll 2007-10-04 21:16 <DIR> d-------- E:\Program Files\HighMAT CD Writing Wizard 2007-10-04 21:15 40,960 --a------ E:\WINDOWS\system32\SSUBTMR6.DLL 2007-10-04 21:15 10,752 --a------ E:\WINDOWS\system32\aamd532.dll 2007-09-29 14:37 163,712 --a------ E:\WINDOWS\system32\drivers\vidstub.sys 2007-09-29 10:04 <DIR> d-------- E:\Documents and Settings\Tata.BANIOLEK\Dane aplikacji\Azureus 2007-09-29 10:03 <DIR> d-------- E:\Program Files\Azureus 2007-09-28 17:52 <DIR> d-------- E:\registry 2007-09-27 22:13 <DIR> dr-h----- E:\MSOCache 2007-09-27 21:57 <DIR> d-------- E:\Program Files\Microsoft Works 2007-09-27 21:55 <DIR> d-------- E:\Program Files\Microsoft.NET 2007-09-27 21:52 <DIR> d-------- E:\Program Files\Microsoft Visual Studio 8 2007-09-26 18:41 <DIR> d-------- E:\Documents and Settings\Baniol\SystemRequirementsLab 2007-09-26 16:13 <DIR> d-------- E:\WINDOWS\DF5A03CCD5AA43D8B948D9903F2AF94A.TMP 2007-09-26 16:09 <DIR> d-------- E:\WINDOWS\AiOTemp 2007-09-26 16:09 38,912 --a------ E:\WINDOWS\system32\hh.exe 2007-09-26 14:16 <DIR> d-------- E:\Documents and Settings\Baniol\Dane aplikacji\Ahead 2007-09-25 17:42 218,137 --ah----- E:\WINDOWS\system32\SVGHOST.SCR . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2007-10-25 14:24 --------- d-----w E:\Program Files\FlashGet 2007-10-25 14:18 --------- d-----w E:\Program Files\AutoConnect 2007-10-25 14:08 --------- d-----w E:\Documents and Settings\Baniol\Dane aplikacji\Desktop Sidebar 2007-10-24 20:10 --------- d-----w E:\Program Files\Norton Security Scan 2007-10-22 17:32 --------- d-----w E:\Program Files\AWS 2007-10-22 08:19 685,816 ----a-w E:\WINDOWS\system32\drivers\sptd.sys 2007-10-18 21:18 --------- d--h--w E:\Program Files\InstallShield Installation Information 2007-10-11 15:11 --------- d-----w E:\Documents and Settings\Tata.BANIOLEK\Dane aplikacji\MEGAUPLOADTOOLBAR 2007-10-01 14:55 --------- d-----w E:\Program Files\Image-Line 2007-09-28 20:48 4,285,952 ----a-w E:\WINDOWS\system32\logonuiX.exe 2007-09-27 19:57 --------- d-----w E:\Program Files\MSBuild 2007-09-25 20:33 --------- d-----w E:\Program Files\AMT 2007-09-23 19:11 --------- d-----w E:\Program Files\Thomson 2007-09-22 18:47 98,304 ----a-w E:\WINDOWS\system32\CmdLineExt.dll 2007-09-22 18:34 --------- d-----w E:\Documents and Settings\Tata.BANIOLEK\Dane aplikacji\Skype 2007-09-22 18:16 --------- d-----w E:\Program Files\KotOR2-PL 2007-09-21 17:06 --------- d-----w E:\Program Files\Windows Media Connect 2 2007-09-16 23:07 81,920 ----a-w E:\WINDOWS\system32\nvwddi.dll 2007-09-16 23:07 81,920 ----a-w E:\WINDOWS\system32\nvmctray.dll 2007-09-16 23:07 8,491,008 ----a-w E:\WINDOWS\system32\nvcpl.dll 2007-09-16 23:07 753,664 ----a-w E:\WINDOWS\system32\nvcplui.exe 2007-09-16 23:07 6,746,112 ----a-w E:\WINDOWS\system32\nvoglnt.dll 2007-09-16 23:07 6,344,704 ----a-w E:\WINDOWS\system32\nvdisps.dll 2007-09-16 23:07 5,509,120 ----a-w E:\WINDOWS\system32\nvdispsr.dll 2007-09-16 23:07 466,944 ----a-w E:\WINDOWS\system32\nvshell.dll 2007-09-16 23:07 458,752 ----a-w E:\WINDOWS\system32\nvmccssr.dll 2007-09-16 23:07 45,056 ----a-w E:\WINDOWS\system32\nvmccsrs.dll 2007-09-16 23:07 442,368 ----a-w E:\WINDOWS\system32\nvappbar.exe 2007-09-16 23:07 425,984 ----a-w E:\WINDOWS\system32\keystone.exe 2007-09-16 23:07 364,544 ----a-w E:\WINDOWS\system32\nvapi.dll 2007-09-16 23:07 335,872 ----a-w E:\WINDOWS\system32\nvwrses.dll 2007-09-16 23:07 335,872 ----a-w E:\WINDOWS\system32\nvwrsel.dll 2007-09-16 23:07 327,680 ----a-w E:\WINDOWS\system32\nvwrsfr.dll 2007-09-16 23:07 327,680 ----a-w E:\WINDOWS\system32\nvwrsesm.dll 2007-09-16 23:07 327,680 ----a-w E:\WINDOWS\system32\nvrshe.dll 2007-09-16 23:07 327,680 ----a-w E:\WINDOWS\system32\nvrsar.dll 2007-09-16 23:07 323,584 ----a-w E:\WINDOWS\system32\nvwrspt.dll 2007-09-16 23:07 323,584 ----a-w E:\WINDOWS\system32\nvwrsit.dll 2007-09-16 23:07 319,488 ----a-w E:\WINDOWS\system32\nvwrsptb.dll 2007-09-16 23:07 319,488 ----a-w E:\WINDOWS\system32\nvwrsnl.dll 2007-09-16 23:07 315,392 ----a-w E:\WINDOWS\system32\nvwrsru.dll 2007-09-16 23:07 315,392 ----a-w E:\WINDOWS\system32\nvwrshu.dll 2007-09-16 23:07 311,296 ----a-w E:\WINDOWS\system32\nvwrsde.dll 2007-09-16 23:07 307,200 ----a-w E:\WINDOWS\system32\nvexpbar.dll 2007-09-16 23:07 303,104 ----a-w E:\WINDOWS\system32\nvwrstr.dll 2007-09-16 23:07 303,104 ----a-w E:\WINDOWS\system32\nvwrssl.dll 2007-09-16 23:07 303,104 ----a-w E:\WINDOWS\system32\nvwrsfi.dll 2007-09-16 23:07 3,334,144 ----a-w E:\WINDOWS\system32\nvgames.dll 2007-09-16 23:07 3,166,208 ----a-w E:\WINDOWS\system32\nvgamesr.dll 2007-09-16 23:07 299,008 ----a-w E:\WINDOWS\system32\nvwrssk.dll 2007-09-16 23:07 299,008 ----a-w E:\WINDOWS\system32\nvwrsno.dll 2007-09-16 23:07 294,912 ----a-w E:\WINDOWS\system32\nvwrssv.dll 2007-09-16 23:07 294,912 ----a-w E:\WINDOWS\system32\nvwrspl.dll 2007-09-16 23:07 294,912 ----a-w E:\WINDOWS\system32\nvwrsda.dll 2007-09-16 23:07 290,816 ----a-w E:\WINDOWS\system32\nvwrsth.dll 2007-09-16 23:07 286,720 ----a-w E:\WINDOWS\system32\nvwrseng.dll 2007-09-16 23:07 286,720 ----a-w E:\WINDOWS\system32\nvwrscs.dll 2007-09-16 23:07 286,720 ----a-w E:\WINDOWS\system32\nvnt4cpl.dll 2007-09-16 23:07 282,624 ----a-w E:\WINDOWS\system32\nvwrsar.dll 2007-09-16 23:07 282,624 ----a-w E:\WINDOWS\system32\nvrsfr.dll 2007-09-16 23:07 282,624 ----a-w E:\WINDOWS\system32\nvrses.dll 2007-09-16 23:07 282,624 ----a-w E:\WINDOWS\system32\nvrsel.dll 2007-09-16 23:07 278,528 ----a-w E:\WINDOWS\system32\nvwrshe.dll 2007-09-16 23:07 278,528 ----a-w E:\WINDOWS\system32\nvrsit.dll 2007-09-16 23:07 278,528 ----a-w E:\WINDOWS\system32\nvrsde.dll 2007-09-16 23:07 274,432 ----a-w E:\WINDOWS\system32\nvrspt.dll 2007-09-16 23:07 274,432 ----a-w E:\WINDOWS\system32\nvrsnl.dll 2007-09-16 23:07 274,432 ----a-w E:\WINDOWS\system32\nvrsesm.dll 2007-09-16 23:07 270,336 ----a-w E:\WINDOWS\system32\nvrsru.dll 2007-09-16 23:07 266,240 ----a-w E:\WINDOWS\system32\nvrsptb.dll 2007-09-16 23:07 266,240 ----a-w E:\WINDOWS\system32\nvrsja.dll 2007-09-16 23:07 258,048 ----a-w E:\WINDOWS\system32\nvrstr.dll 2007-09-16 23:07 258,048 ----a-w E:\WINDOWS\system32\nvrssl.dll 2007-09-16 23:07 258,048 ----a-w E:\WINDOWS\system32\nvrssk.dll 2007-09-16 23:07 258,048 ----a-w E:\WINDOWS\system32\nvrsko.dll 2007-09-16 23:07 258,048 ----a-w E:\WINDOWS\system32\nvrshu.dll 2007-09-16 23:07 253,952 ----a-w E:\WINDOWS\system32\nvrsth.dll 2007-09-16 23:07 253,952 ----a-w E:\WINDOWS\system32\nvrssv.dll 2007-09-16 23:07 253,952 ----a-w E:\WINDOWS\system32\nvrspl.dll 2007-09-16 23:07 253,952 ----a-w E:\WINDOWS\system32\nvrsno.dll 2007-09-16 23:07 253,952 ----a-w E:\WINDOWS\system32\nvrsda.dll 2007-09-16 23:07 249,856 ----a-w E:\WINDOWS\system32\nvrsfi.dll 2007-09-16 23:07 249,856 ----a-w E:\WINDOWS\system32\nvrscs.dll 2007-09-16 23:07 245,760 ----a-w E:\WINDOWS\system32\nvrseng.dll 2007-09-16 23:07 229,376 ----a-w E:\WINDOWS\system32\nvmccs.dll 2007-09-16 23:07 225,280 ----a-w E:\WINDOWS\system32\nvrszhc.dll 2007-09-16 23:07 212,992 ----a-w E:\WINDOWS\system32\nvwrsja.dll 2007-09-16 23:07 2,854,912 ----a-w E:\WINDOWS\system32\nvmoblsr.dll 2007-09-16 23:07 196,608 ----a-w E:\WINDOWS\system32\nvwrsko.dll 2007-09-16 23:07 188,416 ----a-w E:\WINDOWS\system32\nvmccss.dll 2007-09-16 23:07 167,936 ----a-w E:\WINDOWS\system32\nvwrszht.dll 2007-09-16 23:07 163,840 ----a-w E:\WINDOWS\system32\nvwrszhc.dll 2007-09-16 23:07 155,716 ----a-w E:\WINDOWS\system32\nvsvc32.exe 2007-09-16 23:07 147,456 ----a-w E:\WINDOWS\system32\nvcolor.exe 2007-09-16 23:07 126,976 ----a-w E:\WINDOWS\system32\nvrszht.dll 2007-09-16 23:07 1,703,936 ----a-w E:\WINDOWS\system32\nvwdmcpl.dll 2007-09-16 23:07 1,626,112 ----a-w E:\WINDOWS\system32\nwiz.exe 2007-09-16 23:07 1,478,656 ----a-w E:\WINDOWS\system32\nview.dll 2007-09-16 23:07 1,339,392 ----a-w E:\WINDOWS\system32\nvdspsch.exe 2007-09-16 23:07 1,150,976 ----a-w E:\WINDOWS\system32\nvmobls.dll . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Absolute StartUp monitor"="J:\Program Files\F-Group\Absolute StartUp\ASMon.exe" [2007-07-03 13:59] "BootSkin Startup Jobs"="J:\Program Files\Stardock\WinCustomize\BootSkin\BootSkin.exe" [2004-04-26 16:21] "CloneCDTray"="J:\Program Files\SlySoft\CloneCD\CloneCDTray.exe" [2006-09-28 21:21] "GrooveMonitor"="D:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-27 00:47] "LogonStudio"="J:\Program Files\WinCustomize\LogonStudio\logonstudio.exe" [2002-09-03 18:38] "NeroFilterCheck"="E:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-12 16:40] "NvMediaCenter"="E:\WINDOWS\system32\NvMcTray.dll" [2007-09-17 01:07] "SpeedTouch USB Diagnostics"="E:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" [2004-01-26 11:38] "nod32kui"="E:\Program Files\Eset\nod32kui.exe" [2007-10-24 22:14] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "AutoConnect"="E:\Program Files\AutoConnect\AutoConnect.exe" [2006-12-03 01:14] "DAEMON Tools"="J:\Program Files\DAEMON Tools\daemon.exe" [2007-08-29 17:09] E:\Documents and Settings\Tata\Menu Start\Programy\Autostart\ Skr˘t do kaiLaunch.lnk - E:\Program Files\XLink Kai Evolution VII\kaiLaunch.exe [2006-08-02] E:\Documents and Settings\Baniol\Menu Start\Programy\Autostart\ Skr˘t do Skr˘t do dsidebar.lnk - J:\Program Files\Desktop Sidebar\dsidebar.exe [2006-07-09 21:58:00] E:\Documents and Settings\Tata.BANIOLEK\Menu Start\Programy\Autostart\ Skr˘t do kaiLaunch.lnk - E:\Program Files\XLink Kai Evolution VII\kaiLaunch.exe [2006-08-02] Tworzenie wycink˘w ekranu i uruchamianie programu OneNote 2007.lnk - D:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE [2006-10-26 20:24:54] [HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\1] FriendlyName= Forum Komputerowe Pececik.com :: Strona Główna [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\J:] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\J:\Program Files] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\J:\Program Files\NetMeter] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\J:\Program Files\NetMeter\NetMeter.exe] J:\Program Files\NetMeter\NetMeter.exe S3 PsSdk30;PsSdk30;\??\E:\WINDOWS\system32\Drivers\PsSdk30.drv [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{afe4c9cc-6844-11dc-a34c-00e04cc9b4c4}] AutoRun\command - F:\start.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{dce565b5-15c7-11dc-a462-806d6172696f}] Auto\command - C:\tel.xls.exe AutoRun\command - E:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL tel.xls.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{dce565b6-15c7-11dc-a462-806d6172696f}] Auto\command - tel.xls.exe AutoRun\command - E:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL tel.xls.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{dce565b7-15c7-11dc-a462-806d6172696f}] Auto\command - tel.xls.exe AutoRun\command - E:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL tel.xls.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{dce565b8-15c7-11dc-a462-806d6172696f}] Auto\command - tel.xls.exe AutoRun\command - E:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL tel.xls.exe *Newly Created Service* - CATCHME . Contents of the 'Scheduled Tasks' folder "2007-10-12 13:11:45 E:\WINDOWS\Tasks\Norton Security Scan.job" . ************************************************************************** catchme 0.3.1232 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-10-25 16:26:32 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2007-10-25 16:27:09 . --- E O F ---

Mam jeszcze hijackthis:

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 16:29:31, on 2007-10-25 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: E:\WINDOWS\System32\smss.exe E:\WINDOWS\system32\winlogon.exe E:\WINDOWS\system32\services.exe E:\WINDOWS\system32\lsass.exe E:\WINDOWS\system32\svchost.exe E:\WINDOWS\System32\svchost.exe E:\WINDOWS\system32\spoolsv.exe E:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe E:\Program Files\Eset\nod32krn.exe E:\WINDOWS\system32\svchost.exe E:\WINDOWS\system32\wscntfy.exe J:\Program Files\F-Group\Absolute StartUp\ASMon.exe D:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe E:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe E:\Program Files\Eset\nod32kui.exe E:\Program Files\AutoConnect\AutoConnect.exe J:\Program Files\Desktop Sidebar\dsidebar.exe E:\WINDOWS\explorer.exe J:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.bearshare.com/pl R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - E:\PROGRA~1\NEOSTR~1\SEARCH~1.DLL (file missing) O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - E:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: Flashget Catch Url Class - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - E:\Program Files\FlashGet\jccatch.dll O2 - BHO: Idea2 SidebarBrowserMonitor Class - {45AD732C-2CE2-4666-B366-B2214AD57A49} - J:\Program Files\Desktop Sidebar\sbhelp.dll O2 - BHO: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - E:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - D:\PROGRA~1\MICROS~1\Office12\GRA8E1~1.DLL O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - E:\Program Files\Java\jre1.6.0_02\bin\ssv.dll O3 - Toolbar: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - E:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL O4 - HKLM\..\Run: [Absolute StartUp monitor] J:\Program Files\F-Group\Absolute StartUp\ASMon.exe O4 - HKLM\..\Run: [BootSkin Startup Jobs] "J:\Program Files\Stardock\WinCustomize\BootSkin\BootSkin.exe" /StartupJobs O4 - HKLM\..\Run: [CloneCDTray] "J:\Program Files\SlySoft\CloneCD\CloneCDTray.exe" /s O4 - HKLM\..\Run: [GrooveMonitor] "D:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" O4 - HKLM\..\Run: [LogonStudio] "J:\Program Files\WinCustomize\LogonStudio\logonstudio.exe" /RANDOM O4 - HKLM\..\Run: [NeroFilterCheck] E:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE E:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "E:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon O4 - HKLM\..\Run: [nod32kui] "E:\Program Files\Eset\nod32kui.exe" /WAITSERVICE O4 - HKCU\..\Run: [AutoConnect] E:\Program Files\AutoConnect\AutoConnect.exe O4 - HKCU\..\Run: [DAEMON Tools] "J:\Program Files\DAEMON Tools\daemon.exe" -lang 1033 O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] E:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] E:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-21-527237240-842925246-682003330-1005\..\Run: [CTFMON.EXE] E:\WINDOWS\system32\ctfmon.exe (User 'Tata') O4 - HKUS\S-1-5-21-527237240-842925246-682003330-1005\..\Run: [SkinClock] J:\Program Files\Atomic Alarm Clock\AtomicAlarmClock.exe (User 'Tata') O4 - HKUS\S-1-5-21-527237240-842925246-682003330-1005\..\Run: [AutoConnect] E:\Program Files\AutoConnect\AutoConnect.exe (User 'Tata') O4 - HKUS\S-1-5-21-527237240-842925246-682003330-500\..\Run: [CTFMON.EXE] E:\WINDOWS\system32\CTFMON.EXE (User 'Administrator') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] E:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] E:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - S-1-5-21-527237240-842925246-682003330-1005 Startup: Skrót do kaiLaunch.lnk = E:\Program Files\XLink Kai Evolution VII\kaiLaunch.exe (User 'Tata') O4 - S-1-5-21-527237240-842925246-682003330-1005 Startup: Tworzenie wycinków ekranu i uruchamianie programu OneNote 2007.lnk = D:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE (User 'Tata') O4 - Startup: Skrót do Skrót do dsidebar.lnk = J:\Program Files\Desktop Sidebar\dsidebar.exe O4 - Startup: Stardock ObjectDock.lnk = ? O8 - Extra context menu item: &Ściągnij przy pomocy FlashGet'a - E:\Program Files\FlashGet\jc_link.htm O8 - Extra context menu item: &Ściągnij wszystko przy pomocy FlashGet'a - E:\Program Files\FlashGet\jc_all.htm O8 - Extra context menu item: Add to AMV Converter... - J:\Program Files\MP3 Player Utilities 4.07\AMVConverter\grab.html O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://D:\Office10\EXCEL.EXE/3000 O8 - Extra context menu item: E&ksportuj do programu Microsoft Excel - res://D:\Office12\EXCEL.EXE/3000 O8 - Extra context menu item: MediaManager tool grab multimedia file - J:\Program Files\MP3 Player Utilities 4.07\MediaManager\grab.html O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - E:\Program Files\Java\jre1.6.0_02\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - E:\Program Files\Java\jre1.6.0_02\bin\ssv.dll O9 - Extra button: Subscribe in Desktop Sidebar - {09FE188B-6E85-479e-9411-51FB2220DF80} - J:\Program Files\Desktop Sidebar\sbhelp.dll O9 - Extra 'Tools' menuitem: Subscribe in Desktop Sidebar - {09FE188B-6E85-479e-9411-51FB2220DF80} - J:\Program Files\Desktop Sidebar\sbhelp.dll O9 - Extra button: Wyślij do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - D:\PROGRA~1\MICROS~1\Office12\ONBttnIE.dll O9 - Extra 'Tools' menuitem: Wyślij &do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - D:\PROGRA~1\MICROS~1\Office12\ONBttnIE.dll O9 - Extra button: Run WinHTTrack - {36ECAF82-3300-8F84-092E-AFF36D6C7040} - J:\Program Files\WinHTTrack\WinHTTrackIEBar.dll O9 - Extra 'Tools' menuitem: Launch WinHTTrack - {36ECAF82-3300-8F84-092E-AFF36D6C7040} - J:\Program Files\WinHTTrack\WinHTTrackIEBar.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\PROGRA~1\MICROS~1\Office12\REFIEBAR.DLL O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - E:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - E:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - E:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - E:\Program Files\Messenger\msmsgs.exe O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{4756C2B7-1941-4965-8253-8DC531D395C7}: NameServer = 212.85.112.32,193.110.121.20 O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - D:\PROGRA~1\MICROS~1\Office12\GR99D3~1.DLL O23 - Service: Adobe LM Service - Adobe Systems - E:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - E:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: NBService - Nero AG - E:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - E:\Program Files\Eset\nod32krn.exe O24 - Desktop Component 1: Forum Komputerowe Pececik.com :: Strona Główna - http://www.pececik.com/ -- End of file - 8011 bytes

Aha, dostęp do internetu mam w laptopie

**Posty:** 237 · przez **Kuba1** 25 Paź 2007, 20:25

E:\WINDOWS\DF5A03CCD5AA43D8B948D9903F2AF94A.TMP
E:\WINDOWS\system32\SVGHOST.SCR

Te pliki trzeba usunąć.

Otwórz notatnik i wklej w nim:

Windows Registry Editor Version 5.00

[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{afe4c9cc-6844-11dc-a34c-00e04cc9b4c4}]

[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{dce565b5-15c7-11dc-a462-806d6172696f}]

[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{dce565b6-15c7-11dc-a462-806d6172696f}]

[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{dce565b8-15c7-11dc-a462-806d6172696f}]

Plik>>zapisz jako>>zmien rozszerzenie z txt na wszystkie pliki i zapidz pod nazwa FIX.Reg uruchom powstały plik i i dodaj go do rejestru.

Jeszcze raz poprawnie użyj SDFix, ponieważ log który dałes jest niepełny(wklej pełny) oraz log z ComboFix oraz pobierz Gmer'a i daj 2 logi na takich ustawieniach(oba na www.wklej.org)

* Rootkit >>> zaznaczone Pokaż wszystko >>> wskazane tylko Usługi >>> Szukaj >>> Kopiuj >>> CTRL+V na www.wklej.org
* Rootkit >>> odznaczone Pokaż wszystko >>> wskazane wszystkie obiekty do skanu >>> Szukaj>>> Kopiuj >>> CTRL+V na www.wklej.org

**Posty:** 419 · przez **baniol22** 25 Paź 2007, 22:29

Kuba1 napisał(a):* Rootkit >>> zaznaczone Pokaż wszystko >>> wskazane tylko Usługi >>> Szukaj >>> Kopiuj >>> CTRL+V na www.wklej.org

http://www.wklej.org/id/f4cf218fd9

Kuba1 napisał(a):* Rootkit >>> odznaczone Pokaż wszystko >>> wskazane wszystkie obiekty do skanu >>> Szukaj>>> Kopiuj >>> CTRL+V na www.wklej.org

http://www.wklej.org/id/37092da1be

Kuba1 napisał(a):Jeszcze raz poprawnie użyj SDFix, ponieważ log który dałes jest niepełny(wklej pełny) oraz log z ComboFix

Wyszło to samo co wcześniej

**Posty:** 18165 · przez **wojtas** 26 Paź 2007, 13:38

daj nowy log z hijacka oraz combofixa

**Posty:** 419 · przez **baniol22** 26 Paź 2007, 16:23

Hijackthis

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 16:13:14, on 2007-10-26 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: E:\WINDOWS\System32\smss.exe E:\WINDOWS\system32\winlogon.exe E:\WINDOWS\system32\services.exe E:\WINDOWS\system32\lsass.exe E:\WINDOWS\system32\svchost.exe E:\WINDOWS\System32\svchost.exe E:\WINDOWS\system32\spoolsv.exe E:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe E:\Program Files\Eset\nod32krn.exe E:\WINDOWS\system32\svchost.exe E:\WINDOWS\Explorer.EXE E:\WINDOWS\system32\wscntfy.exe J:\Program Files\F-Group\Absolute StartUp\ASMon.exe D:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe E:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe E:\Program Files\Eset\nod32kui.exe E:\Program Files\AutoConnect\AutoConnect.exe J:\Program Files\Desktop Sidebar\dsidebar.exe E:\WINDOWS\system32\wuauclt.exe J:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.bearshare.com/pl R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - E:\PROGRA~1\NEOSTR~1\SEARCH~1.DLL (file missing) O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - E:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: Flashget Catch Url Class - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - E:\Program Files\FlashGet\jccatch.dll O2 - BHO: Idea2 SidebarBrowserMonitor Class - {45AD732C-2CE2-4666-B366-B2214AD57A49} - J:\Program Files\Desktop Sidebar\sbhelp.dll O2 - BHO: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - E:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - D:\PROGRA~1\MICROS~1\Office12\GRA8E1~1.DLL O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - E:\Program Files\Java\jre1.6.0_02\bin\ssv.dll O3 - Toolbar: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - E:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL O4 - HKLM\..\Run: [Absolute StartUp monitor] J:\Program Files\F-Group\Absolute StartUp\ASMon.exe O4 - HKLM\..\Run: [BootSkin Startup Jobs] "J:\Program Files\Stardock\WinCustomize\BootSkin\BootSkin.exe" /StartupJobs O4 - HKLM\..\Run: [CloneCDTray] "J:\Program Files\SlySoft\CloneCD\CloneCDTray.exe" /s O4 - HKLM\..\Run: [GrooveMonitor] "D:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" O4 - HKLM\..\Run: [LogonStudio] "J:\Program Files\WinCustomize\LogonStudio\logonstudio.exe" /RANDOM O4 - HKLM\..\Run: [NeroFilterCheck] E:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE E:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "E:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon O4 - HKLM\..\Run: [nod32kui] "E:\Program Files\Eset\nod32kui.exe" /WAITSERVICE O4 - HKCU\..\Run: [AutoConnect] E:\Program Files\AutoConnect\AutoConnect.exe O4 - HKCU\..\Run: [DAEMON Tools] "J:\Program Files\DAEMON Tools\daemon.exe" -lang 1033 O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] E:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] E:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] E:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] E:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Startup: Skrót do Skrót do dsidebar.lnk = J:\Program Files\Desktop Sidebar\dsidebar.exe O4 - Startup: Stardock ObjectDock.lnk = ? O8 - Extra context menu item: &Ściągnij przy pomocy FlashGet'a - E:\Program Files\FlashGet\jc_link.htm O8 - Extra context menu item: &Ściągnij wszystko przy pomocy FlashGet'a - E:\Program Files\FlashGet\jc_all.htm O8 - Extra context menu item: Add to AMV Converter... - J:\Program Files\MP3 Player Utilities 4.07\AMVConverter\grab.html O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://D:\Office10\EXCEL.EXE/3000 O8 - Extra context menu item: E&ksportuj do programu Microsoft Excel - res://D:\Office12\EXCEL.EXE/3000 O8 - Extra context menu item: MediaManager tool grab multimedia file - J:\Program Files\MP3 Player Utilities 4.07\MediaManager\grab.html O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - E:\Program Files\Java\jre1.6.0_02\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - E:\Program Files\Java\jre1.6.0_02\bin\ssv.dll O9 - Extra button: Subscribe in Desktop Sidebar - {09FE188B-6E85-479e-9411-51FB2220DF80} - J:\Program Files\Desktop Sidebar\sbhelp.dll O9 - Extra 'Tools' menuitem: Subscribe in Desktop Sidebar - {09FE188B-6E85-479e-9411-51FB2220DF80} - J:\Program Files\Desktop Sidebar\sbhelp.dll O9 - Extra button: Wyślij do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - D:\PROGRA~1\MICROS~1\Office12\ONBttnIE.dll O9 - Extra 'Tools' menuitem: Wyślij &do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - D:\PROGRA~1\MICROS~1\Office12\ONBttnIE.dll O9 - Extra button: Run WinHTTrack - {36ECAF82-3300-8F84-092E-AFF36D6C7040} - J:\Program Files\WinHTTrack\WinHTTrackIEBar.dll O9 - Extra 'Tools' menuitem: Launch WinHTTrack - {36ECAF82-3300-8F84-092E-AFF36D6C7040} - J:\Program Files\WinHTTrack\WinHTTrackIEBar.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\PROGRA~1\MICROS~1\Office12\REFIEBAR.DLL O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - E:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - E:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - E:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - E:\Program Files\Messenger\msmsgs.exe O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{4756C2B7-1941-4965-8253-8DC531D395C7}: NameServer = 212.85.112.32,193.110.121.20 O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - D:\PROGRA~1\MICROS~1\Office12\GR99D3~1.DLL O23 - Service: Adobe LM Service - Adobe Systems - E:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - E:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: NBService - Nero AG - E:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - E:\Program Files\Eset\nod32krn.exe O24 - Desktop Component 1: Forum Komputerowe Pececik.com :: Strona Główna - http://www.pececik.com/ -- End of file - 7161 bytes

ComboFix

Kod: Zaznacz wszystko: ComboFix 07-10-23.1 - Baniol 2007-10-26 16:15:54.2 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.2.1250.1.1045.18.482 [GMT 2:00] Running from: J:\Nowy folder\ComboFix.exe . ((((((((((((((((((((((((( Files Created from 2007-09-26 to 2007-10-26 ))))))))))))))))))))))))))))))) . 2007-10-25 16:22 51,200 --a------ E:\WINDOWS\NirCmd.exe 2007-10-25 16:17 1,422 --a------ E:\Documents and Settings\Baniol\clean.reg 2007-10-25 16:11 <DIR> d-------- E:\WINDOWS\ERUNT 2007-10-25 16:10 <DIR> d--h----- E:\Documents and Settings\Administrator\Ustawienia lokalne 2007-10-25 16:10 <DIR> d-------- E:\Documents and Settings\Administrator\Ulubione 2007-10-25 16:10 <DIR> d--h----- E:\Documents and Settings\Administrator\Szablony 2007-10-25 16:10 <DIR> d-------- E:\Documents and Settings\Administrator\Pulpit 2007-10-25 16:10 <DIR> d-------- E:\Documents and Settings\Administrator\Moje dokumenty 2007-10-25 16:10 <DIR> dr------- E:\Documents and Settings\Administrator\Menu Start 2007-10-25 16:10 <DIR> dr-h----- E:\Documents and Settings\Administrator\Dane aplikacji 2007-10-25 15:12 20,992 --a------ E:\WINDOWS\system32\drivers\RTL8139.sys 2007-10-25 15:09 24,661 --a------ E:\WINDOWS\system32\spxcoins.dll 2007-10-25 15:09 13,312 --a------ E:\WINDOWS\system32\irclass.dll 2007-10-25 13:24 <DIR> d-------- E:\Program Files\Neostrada TP 2007-10-24 22:14 502,368 --a------ E:\WINDOWS\system32\drivers\amon.sys 2007-10-24 22:14 274,432 --a------ E:\WINDOWS\system32\imon.dll 2007-10-22 19:33 43,520 --a------ E:\WINDOWS\system32\CmdLineExt03.dll 2007-10-22 14:22 <DIR> d-------- E:\Program Files\Common Files\Blizzard Entertainment 2007-10-21 13:57 3,629,056 --a------ E:\WINDOWS\system32\nvvitvsr.dll 2007-10-21 13:57 3,551,232 --a------ E:\WINDOWS\system32\nvvitvs.dll 2007-10-21 13:57 2,441,216 --a------ E:\WINDOWS\system32\nvwssr.dll 2007-10-21 13:57 2,371,584 --a------ E:\WINDOWS\system32\nvwss.dll 2007-10-21 13:57 36,864 --a------ E:\WINDOWS\system32\nvcodins.dll 2007-10-21 13:57 36,864 --a------ E:\WINDOWS\system32\nvcod.dll 2007-10-21 01:04 <DIR> d-------- E:\WINDOWS\nview 2007-10-21 01:03 4,274,816 --a------ E:\WINDOWS\system32\nv4_disp.dll 2007-10-21 01:03 1,897,408 --a------ E:\WINDOWS\system32\drivers\nv4_mini.sys 2007-10-21 01:02 356,352 --a------ E:\WINDOWS\system32\nvudisp.exe 2007-10-21 00:58 356,352 --a------ E:\WINDOWS\system32\NVUNINST.EXE 2007-10-15 21:12 122,884 --a------ E:\WINDOWS\UnGins.exe 2007-10-12 21:41 <DIR> d-------- E:\WING 2007-10-12 21:41 188,960 --a------ E:\WINDOWS\system\WINGDE.DLL 2007-10-12 21:41 92,208 --a------ E:\WINDOWS\system\WING.DLL 2007-10-10 15:36 <DIR> d-------- E:\Documents and Settings\Tata.BANIOLEK\Dane aplikacji\Ahead 2007-10-10 15:35 <DIR> d-------- E:\Documents and Settings\Tata.BANIOLEK\Dane aplikacji\DivX 2007-10-07 22:22 314,368 --a------ E:\WINDOWS\KSGDeInstall.exe 2007-10-04 22:28 <DIR> d-------- E:\Documents and Settings\Baniol\Dane aplikacji\MEGAUPLOADTOOLBAR 2007-10-04 22:27 <DIR> d-------- E:\Program Files\Malicious Software Removal Tool 2007-10-04 22:16 288,768 --a------ E:\WINDOWS\system32\rhttpaa.dll 2007-10-04 22:16 116,736 --a------ E:\WINDOWS\system32\aaclient.dll 2007-10-04 22:16 36,352 --a------ E:\WINDOWS\system32\tsgqec.dll 2007-10-04 22:06 <DIR> d-------- E:\WINDOWS\l2schemas 2007-10-04 22:05 69,120 --a------ E:\WINDOWS\system32\wlanapi.dll 2007-10-04 22:04 62,336 --a------ E:\WINDOWS\system32\drivers\rspndr.sys 2007-10-04 22:04 10,752 --a------ E:\WINDOWS\system32\rspndr.exe 2007-10-04 21:49 <DIR> d-------- E:\WINDOWS\ServicePackFiles 2007-10-04 21:48 6,144 --a------ E:\WINDOWS\system32\kbdpash.dll 2007-10-04 21:48 6,144 --a------ E:\WINDOWS\system32\kbdnepr.dll 2007-10-04 21:48 6,144 --a------ E:\WINDOWS\system32\kbdiultn.dll 2007-10-04 21:48 6,144 --a------ E:\WINDOWS\system32\kbdbhc.dll 2007-10-04 21:19 349,696 --a------ E:\WINDOWS\system32\hypertrm.dll 2007-10-04 21:16 <DIR> d-------- E:\Program Files\HighMAT CD Writing Wizard 2007-10-04 21:15 40,960 --a------ E:\WINDOWS\system32\SSUBTMR6.DLL 2007-10-04 21:15 10,752 --a------ E:\WINDOWS\system32\aamd532.dll 2007-09-29 14:37 163,712 --a------ E:\WINDOWS\system32\drivers\vidstub.sys 2007-09-29 10:04 <DIR> d-------- E:\Documents and Settings\Tata.BANIOLEK\Dane aplikacji\Azureus 2007-09-29 10:03 <DIR> d-------- E:\Program Files\Azureus 2007-09-28 17:52 <DIR> d-------- E:\registry 2007-09-27 22:13 <DIR> dr-h----- E:\MSOCache 2007-09-27 21:57 <DIR> d-------- E:\Program Files\Microsoft Works 2007-09-27 21:55 <DIR> d-------- E:\Program Files\Microsoft.NET 2007-09-27 21:52 <DIR> d-------- E:\Program Files\Microsoft Visual Studio 8 2007-09-26 18:41 <DIR> d-------- E:\Documents and Settings\Baniol\SystemRequirementsLab 2007-09-26 16:13 <DIR> d-------- E:\WINDOWS\DF5A03CCD5AA43D8B948D9903F2AF94A.TMP 2007-09-26 16:09 <DIR> d-------- E:\WINDOWS\AiOTemp 2007-09-26 16:09 38,912 --a------ E:\WINDOWS\system32\hh.exe 2007-09-26 14:16 <DIR> d-------- E:\Documents and Settings\Baniol\Dane aplikacji\Ahead . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2007-10-26 14:16 --------- d-----w E:\Program Files\FlashGet 2007-10-26 14:11 --------- d-----w E:\Program Files\AutoConnect 2007-10-25 19:35 --------- d-----w E:\Documents and Settings\Baniol\Dane aplikacji\Desktop Sidebar 2007-10-24 20:10 --------- d-----w E:\Program Files\Norton Security Scan 2007-10-22 17:32 --------- d-----w E:\Program Files\AWS 2007-10-22 08:19 685,816 ----a-w E:\WINDOWS\system32\drivers\sptd.sys 2007-10-18 21:18 --------- d--h--w E:\Program Files\InstallShield Installation Information 2007-10-11 15:11 --------- d-----w E:\Documents and Settings\Tata.BANIOLEK\Dane aplikacji\MEGAUPLOADTOOLBAR 2007-10-01 14:55 --------- d-----w E:\Program Files\Image-Line 2007-09-28 20:48 4,285,952 ----a-w E:\WINDOWS\system32\logonuiX.exe 2007-09-27 19:57 --------- d-----w E:\Program Files\MSBuild 2007-09-25 20:33 --------- d-----w E:\Program Files\AMT 2007-09-25 15:42 218,137 ---ha-w E:\WINDOWS\system32\SVGHOST.SCR 2007-09-23 19:11 --------- d-----w E:\Program Files\Thomson 2007-09-22 18:47 98,304 ----a-w E:\WINDOWS\system32\CmdLineExt.dll 2007-09-22 18:34 --------- d-----w E:\Documents and Settings\Tata.BANIOLEK\Dane aplikacji\Skype 2007-09-22 18:16 --------- d-----w E:\Program Files\KotOR2-PL 2007-09-21 17:06 --------- d-----w E:\Program Files\Windows Media Connect 2 2007-09-16 23:07 81,920 ----a-w E:\WINDOWS\system32\nvwddi.dll 2007-09-16 23:07 81,920 ----a-w E:\WINDOWS\system32\nvmctray.dll 2007-09-16 23:07 8,491,008 ----a-w E:\WINDOWS\system32\nvcpl.dll 2007-09-16 23:07 753,664 ----a-w E:\WINDOWS\system32\nvcplui.exe 2007-09-16 23:07 6,746,112 ----a-w E:\WINDOWS\system32\nvoglnt.dll 2007-09-16 23:07 6,344,704 ----a-w E:\WINDOWS\system32\nvdisps.dll 2007-09-16 23:07 5,509,120 ----a-w E:\WINDOWS\system32\nvdispsr.dll 2007-09-16 23:07 466,944 ----a-w E:\WINDOWS\system32\nvshell.dll 2007-09-16 23:07 458,752 ----a-w E:\WINDOWS\system32\nvmccssr.dll 2007-09-16 23:07 45,056 ----a-w E:\WINDOWS\system32\nvmccsrs.dll 2007-09-16 23:07 442,368 ----a-w E:\WINDOWS\system32\nvappbar.exe 2007-09-16 23:07 425,984 ----a-w E:\WINDOWS\system32\keystone.exe 2007-09-16 23:07 364,544 ----a-w E:\WINDOWS\system32\nvapi.dll 2007-09-16 23:07 335,872 ----a-w E:\WINDOWS\system32\nvwrses.dll 2007-09-16 23:07 335,872 ----a-w E:\WINDOWS\system32\nvwrsel.dll 2007-09-16 23:07 327,680 ----a-w E:\WINDOWS\system32\nvwrsfr.dll 2007-09-16 23:07 327,680 ----a-w E:\WINDOWS\system32\nvwrsesm.dll 2007-09-16 23:07 327,680 ----a-w E:\WINDOWS\system32\nvrshe.dll 2007-09-16 23:07 327,680 ----a-w E:\WINDOWS\system32\nvrsar.dll 2007-09-16 23:07 323,584 ----a-w E:\WINDOWS\system32\nvwrspt.dll 2007-09-16 23:07 323,584 ----a-w E:\WINDOWS\system32\nvwrsit.dll 2007-09-16 23:07 319,488 ----a-w E:\WINDOWS\system32\nvwrsptb.dll 2007-09-16 23:07 319,488 ----a-w E:\WINDOWS\system32\nvwrsnl.dll 2007-09-16 23:07 315,392 ----a-w E:\WINDOWS\system32\nvwrsru.dll 2007-09-16 23:07 315,392 ----a-w E:\WINDOWS\system32\nvwrshu.dll 2007-09-16 23:07 311,296 ----a-w E:\WINDOWS\system32\nvwrsde.dll 2007-09-16 23:07 307,200 ----a-w E:\WINDOWS\system32\nvexpbar.dll 2007-09-16 23:07 303,104 ----a-w E:\WINDOWS\system32\nvwrstr.dll 2007-09-16 23:07 303,104 ----a-w E:\WINDOWS\system32\nvwrssl.dll 2007-09-16 23:07 303,104 ----a-w E:\WINDOWS\system32\nvwrsfi.dll 2007-09-16 23:07 3,334,144 ----a-w E:\WINDOWS\system32\nvgames.dll 2007-09-16 23:07 3,166,208 ----a-w E:\WINDOWS\system32\nvgamesr.dll 2007-09-16 23:07 299,008 ----a-w E:\WINDOWS\system32\nvwrssk.dll 2007-09-16 23:07 299,008 ----a-w E:\WINDOWS\system32\nvwrsno.dll 2007-09-16 23:07 294,912 ----a-w E:\WINDOWS\system32\nvwrssv.dll 2007-09-16 23:07 294,912 ----a-w E:\WINDOWS\system32\nvwrspl.dll 2007-09-16 23:07 294,912 ----a-w E:\WINDOWS\system32\nvwrsda.dll 2007-09-16 23:07 290,816 ----a-w E:\WINDOWS\system32\nvwrsth.dll 2007-09-16 23:07 286,720 ----a-w E:\WINDOWS\system32\nvwrseng.dll 2007-09-16 23:07 286,720 ----a-w E:\WINDOWS\system32\nvwrscs.dll 2007-09-16 23:07 286,720 ----a-w E:\WINDOWS\system32\nvnt4cpl.dll 2007-09-16 23:07 282,624 ----a-w E:\WINDOWS\system32\nvwrsar.dll 2007-09-16 23:07 282,624 ----a-w E:\WINDOWS\system32\nvrsfr.dll 2007-09-16 23:07 282,624 ----a-w E:\WINDOWS\system32\nvrses.dll 2007-09-16 23:07 282,624 ----a-w E:\WINDOWS\system32\nvrsel.dll 2007-09-16 23:07 278,528 ----a-w E:\WINDOWS\system32\nvwrshe.dll 2007-09-16 23:07 278,528 ----a-w E:\WINDOWS\system32\nvrsit.dll 2007-09-16 23:07 278,528 ----a-w E:\WINDOWS\system32\nvrsde.dll 2007-09-16 23:07 274,432 ----a-w E:\WINDOWS\system32\nvrspt.dll 2007-09-16 23:07 274,432 ----a-w E:\WINDOWS\system32\nvrsnl.dll 2007-09-16 23:07 274,432 ----a-w E:\WINDOWS\system32\nvrsesm.dll 2007-09-16 23:07 270,336 ----a-w E:\WINDOWS\system32\nvrsru.dll 2007-09-16 23:07 266,240 ----a-w E:\WINDOWS\system32\nvrsptb.dll 2007-09-16 23:07 266,240 ----a-w E:\WINDOWS\system32\nvrsja.dll 2007-09-16 23:07 258,048 ----a-w E:\WINDOWS\system32\nvrstr.dll 2007-09-16 23:07 258,048 ----a-w E:\WINDOWS\system32\nvrssl.dll 2007-09-16 23:07 258,048 ----a-w E:\WINDOWS\system32\nvrssk.dll 2007-09-16 23:07 258,048 ----a-w E:\WINDOWS\system32\nvrsko.dll 2007-09-16 23:07 258,048 ----a-w E:\WINDOWS\system32\nvrshu.dll 2007-09-16 23:07 253,952 ----a-w E:\WINDOWS\system32\nvrsth.dll 2007-09-16 23:07 253,952 ----a-w E:\WINDOWS\system32\nvrssv.dll 2007-09-16 23:07 253,952 ----a-w E:\WINDOWS\system32\nvrspl.dll 2007-09-16 23:07 253,952 ----a-w E:\WINDOWS\system32\nvrsno.dll 2007-09-16 23:07 253,952 ----a-w E:\WINDOWS\system32\nvrsda.dll 2007-09-16 23:07 249,856 ----a-w E:\WINDOWS\system32\nvrsfi.dll 2007-09-16 23:07 249,856 ----a-w E:\WINDOWS\system32\nvrscs.dll 2007-09-16 23:07 245,760 ----a-w E:\WINDOWS\system32\nvrseng.dll 2007-09-16 23:07 229,376 ----a-w E:\WINDOWS\system32\nvmccs.dll 2007-09-16 23:07 225,280 ----a-w E:\WINDOWS\system32\nvrszhc.dll 2007-09-16 23:07 212,992 ----a-w E:\WINDOWS\system32\nvwrsja.dll 2007-09-16 23:07 2,854,912 ----a-w E:\WINDOWS\system32\nvmoblsr.dll 2007-09-16 23:07 196,608 ----a-w E:\WINDOWS\system32\nvwrsko.dll 2007-09-16 23:07 188,416 ----a-w E:\WINDOWS\system32\nvmccss.dll 2007-09-16 23:07 167,936 ----a-w E:\WINDOWS\system32\nvwrszht.dll 2007-09-16 23:07 163,840 ----a-w E:\WINDOWS\system32\nvwrszhc.dll 2007-09-16 23:07 155,716 ----a-w E:\WINDOWS\system32\nvsvc32.exe 2007-09-16 23:07 147,456 ----a-w E:\WINDOWS\system32\nvcolor.exe 2007-09-16 23:07 126,976 ----a-w E:\WINDOWS\system32\nvrszht.dll 2007-09-16 23:07 1,703,936 ----a-w E:\WINDOWS\system32\nvwdmcpl.dll 2007-09-16 23:07 1,626,112 ----a-w E:\WINDOWS\system32\nwiz.exe 2007-09-16 23:07 1,478,656 ----a-w E:\WINDOWS\system32\nview.dll 2007-09-16 23:07 1,339,392 ----a-w E:\WINDOWS\system32\nvdspsch.exe . ((((((((((((((((((((((((((((( snapshot@2007-10-25_16.26.38,57 ))))))))))))))))))))))))))))))))))))))))) . - 2007-10-25 14:11:35 495,616 ----a-w E:\WINDOWS\ERUNT\SDFIX\Users\[u]0[/u]0000001\NTUSER.DAT + 2007-10-25 19:38:38 8,777,728 ----a-w E:\WINDOWS\ERUNT\SDFIX\Users\[u]0[/u]0000001\NTUSER.DAT - 2007-10-25 14:11:35 8,192 ----a-w E:\WINDOWS\ERUNT\SDFIX\Users\[u]0[/u]0000002\UsrClass.dat + 2007-10-25 19:38:39 155,648 ----a-w E:\WINDOWS\ERUNT\SDFIX\Users\[u]0[/u]0000002\UsrClass.dat + 2007-10-25 19:50:21 585,791 ----a-w E:\WINDOWS\gmer.dll + 2007-06-29 07:38:18 581,632 ----a-w E:\WINDOWS\gmer.exe + 2007-10-25 19:50:22 70,001 ----a-w E:\WINDOWS\system32\drivers\gmer.sys . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Absolute StartUp monitor"="J:\Program Files\F-Group\Absolute StartUp\ASMon.exe" [2007-07-03 13:59] "BootSkin Startup Jobs"="J:\Program Files\Stardock\WinCustomize\BootSkin\BootSkin.exe" [2004-04-26 16:21] "CloneCDTray"="J:\Program Files\SlySoft\CloneCD\CloneCDTray.exe" [2006-09-28 21:21] "GrooveMonitor"="D:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-27 00:47] "LogonStudio"="J:\Program Files\WinCustomize\LogonStudio\logonstudio.exe" [2002-09-03 18:38] "NeroFilterCheck"="E:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-12 16:40] "NvMediaCenter"="E:\WINDOWS\system32\NvMcTray.dll" [2007-09-17 01:07] "SpeedTouch USB Diagnostics"="E:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" [2004-01-26 11:38] "nod32kui"="E:\Program Files\Eset\nod32kui.exe" [2007-10-24 22:14] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "AutoConnect"="E:\Program Files\AutoConnect\AutoConnect.exe" [2006-12-03 01:14] "DAEMON Tools"="J:\Program Files\DAEMON Tools\daemon.exe" [2007-08-29 17:09] E:\Documents and Settings\Tata\Menu Start\Programy\Autostart\ Skr˘t do kaiLaunch.lnk - E:\Program Files\XLink Kai Evolution VII\kaiLaunch.exe [2006-08-02] E:\Documents and Settings\Tata.BANIOLEK\Menu Start\Programy\Autostart\ Skr˘t do kaiLaunch.lnk - E:\Program Files\XLink Kai Evolution VII\kaiLaunch.exe [2006-08-02] Tworzenie wycink˘w ekranu i uruchamianie programu OneNote 2007.lnk - D:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE [2006-10-26 20:24:54] E:\Documents and Settings\Baniol\Menu Start\Programy\Autostart\ Skr˘t do Skr˘t do dsidebar.lnk - J:\Program Files\Desktop Sidebar\dsidebar.exe [2006-07-09 21:58:00] [HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\1] FriendlyName= Forum Komputerowe Pececik.com :: Strona Główna [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\J:] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\J:\Program Files] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\J:\Program Files\NetMeter] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\J:\Program Files\NetMeter\NetMeter.exe] J:\Program Files\NetMeter\NetMeter.exe S3 PsSdk30;PsSdk30;\??\E:\WINDOWS\system32\Drivers\PsSdk30.drv . Contents of the 'Scheduled Tasks' folder "2007-10-12 13:11:45 E:\WINDOWS\Tasks\Norton Security Scan.job" . ************************************************************************** catchme 0.3.1232 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-10-26 16:18:29 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2007-10-26 16:19:14 . --- E O F ---

**Posty:** 18165 · przez **wojtas** 26 Paź 2007, 16:30

Otworz notatnik i wklej w nim to:

File::
E:\WINDOWS\system32\SVGHOST.SCR
E:\WINDOWS\DF5A03CCD5AA43D8B948D9903F2AF94A.TMP

Plik >>> zapisz jako CFScript.txt .Plik przeciągnij i upuść na ikonę ComboFixa (tak jak tu ) . Potwierdz >>> zresetuje sie komputer

(jeśli pojawi się pytanie "1 or 2" - to wpisz 1 i naciśnij ENTER). Rozpocznie się proces usuwania
Potem nowy log z hijacka oraz combofixa

ten plik:

E:\WINDOWS\system32\hh.exe

Przeskanuj tu:
http://virusscan.jotti.org/
http://www.virustotal.com/

i daj raporty ze skanu + nowe logi

**Posty:** 419 · przez **baniol22** 26 Paź 2007, 17:02

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 16:51:25, on 2007-10-26 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: E:\WINDOWS\System32\smss.exe E:\WINDOWS\system32\winlogon.exe E:\WINDOWS\system32\services.exe E:\WINDOWS\system32\lsass.exe E:\WINDOWS\system32\svchost.exe E:\WINDOWS\System32\svchost.exe E:\WINDOWS\system32\spoolsv.exe E:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe E:\Program Files\Eset\nod32krn.exe E:\WINDOWS\system32\svchost.exe E:\WINDOWS\system32\wscntfy.exe J:\Program Files\F-Group\Absolute StartUp\ASMon.exe D:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe E:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe E:\Program Files\Eset\nod32kui.exe E:\Program Files\AutoConnect\AutoConnect.exe J:\Program Files\Desktop Sidebar\dsidebar.exe E:\WINDOWS\explorer.exe J:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.bearshare.com/pl R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - E:\PROGRA~1\NEOSTR~1\SEARCH~1.DLL (file missing) O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - E:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: Flashget Catch Url Class - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - E:\Program Files\FlashGet\jccatch.dll O2 - BHO: Idea2 SidebarBrowserMonitor Class - {45AD732C-2CE2-4666-B366-B2214AD57A49} - J:\Program Files\Desktop Sidebar\sbhelp.dll O2 - BHO: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - E:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - D:\PROGRA~1\MICROS~1\Office12\GRA8E1~1.DLL O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - E:\Program Files\Java\jre1.6.0_02\bin\ssv.dll O3 - Toolbar: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - E:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL O4 - HKLM\..\Run: [Absolute StartUp monitor] J:\Program Files\F-Group\Absolute StartUp\ASMon.exe O4 - HKLM\..\Run: [BootSkin Startup Jobs] "J:\Program Files\Stardock\WinCustomize\BootSkin\BootSkin.exe" /StartupJobs O4 - HKLM\..\Run: [CloneCDTray] "J:\Program Files\SlySoft\CloneCD\CloneCDTray.exe" /s O4 - HKLM\..\Run: [GrooveMonitor] "D:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" O4 - HKLM\..\Run: [LogonStudio] "J:\Program Files\WinCustomize\LogonStudio\logonstudio.exe" /RANDOM O4 - HKLM\..\Run: [NeroFilterCheck] E:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE E:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "E:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon O4 - HKLM\..\Run: [nod32kui] "E:\Program Files\Eset\nod32kui.exe" /WAITSERVICE O4 - HKCU\..\Run: [AutoConnect] E:\Program Files\AutoConnect\AutoConnect.exe O4 - HKCU\..\Run: [DAEMON Tools] "J:\Program Files\DAEMON Tools\daemon.exe" -lang 1033 O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] E:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] E:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] E:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] E:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Startup: Skrót do Skrót do dsidebar.lnk = J:\Program Files\Desktop Sidebar\dsidebar.exe O4 - Startup: Stardock ObjectDock.lnk = ? O8 - Extra context menu item: &Ściągnij przy pomocy FlashGet'a - E:\Program Files\FlashGet\jc_link.htm O8 - Extra context menu item: &Ściągnij wszystko przy pomocy FlashGet'a - E:\Program Files\FlashGet\jc_all.htm O8 - Extra context menu item: Add to AMV Converter... - J:\Program Files\MP3 Player Utilities 4.07\AMVConverter\grab.html O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://D:\Office10\EXCEL.EXE/3000 O8 - Extra context menu item: E&ksportuj do programu Microsoft Excel - res://D:\Office12\EXCEL.EXE/3000 O8 - Extra context menu item: MediaManager tool grab multimedia file - J:\Program Files\MP3 Player Utilities 4.07\MediaManager\grab.html O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - E:\Program Files\Java\jre1.6.0_02\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - E:\Program Files\Java\jre1.6.0_02\bin\ssv.dll O9 - Extra button: Subscribe in Desktop Sidebar - {09FE188B-6E85-479e-9411-51FB2220DF80} - J:\Program Files\Desktop Sidebar\sbhelp.dll O9 - Extra 'Tools' menuitem: Subscribe in Desktop Sidebar - {09FE188B-6E85-479e-9411-51FB2220DF80} - J:\Program Files\Desktop Sidebar\sbhelp.dll O9 - Extra button: Wyślij do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - D:\PROGRA~1\MICROS~1\Office12\ONBttnIE.dll O9 - Extra 'Tools' menuitem: Wyślij &do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - D:\PROGRA~1\MICROS~1\Office12\ONBttnIE.dll O9 - Extra button: Run WinHTTrack - {36ECAF82-3300-8F84-092E-AFF36D6C7040} - J:\Program Files\WinHTTrack\WinHTTrackIEBar.dll O9 - Extra 'Tools' menuitem: Launch WinHTTrack - {36ECAF82-3300-8F84-092E-AFF36D6C7040} - J:\Program Files\WinHTTrack\WinHTTrackIEBar.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\PROGRA~1\MICROS~1\Office12\REFIEBAR.DLL O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - E:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - E:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - E:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - E:\Program Files\Messenger\msmsgs.exe O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{4756C2B7-1941-4965-8253-8DC531D395C7}: NameServer = 212.85.112.32,193.110.121.20 O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - D:\PROGRA~1\MICROS~1\Office12\GR99D3~1.DLL O23 - Service: Adobe LM Service - Adobe Systems - E:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - E:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: NBService - Nero AG - E:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - E:\Program Files\Eset\nod32krn.exe O24 - Desktop Component 1: Forum Komputerowe Pececik.com :: Strona Główna - http://www.pececik.com/ -- End of file - 7128 bytes

Kod: Zaznacz wszystko: ComboFix 07-10-23.1 - Baniol 2007-10-26 16:47:13.3 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.2.1250.1.1045.18.473 [GMT 2:00] Running from: F:\ComboFix.exe Command switches used :: F:\CFScript.txt * Created a new restore point FILE:: E:\WINDOWS\DF5A03CCD5AA43D8B948D9903F2AF94A.TMP E:\WINDOWS\system32\SVGHOST.SCR . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . E:\WINDOWS\system32\SVGHOST.SCR . ((((((((((((((((((((((((( Files Created from 2007-09-26 to 2007-10-26 ))))))))))))))))))))))))))))))) . 2007-10-25 16:22 51,200 --a------ E:\WINDOWS\NirCmd.exe 2007-10-25 16:17 1,422 --a------ E:\Documents and Settings\Baniol\clean.reg 2007-10-25 16:11 <DIR> d-------- E:\WINDOWS\ERUNT 2007-10-25 16:10 <DIR> d--h----- E:\Documents and Settings\Administrator\Ustawienia lokalne 2007-10-25 16:10 <DIR> d-------- E:\Documents and Settings\Administrator\Ulubione 2007-10-25 16:10 <DIR> d--h----- E:\Documents and Settings\Administrator\Szablony 2007-10-25 16:10 <DIR> d-------- E:\Documents and Settings\Administrator\Pulpit 2007-10-25 16:10 <DIR> d-------- E:\Documents and Settings\Administrator\Moje dokumenty 2007-10-25 16:10 <DIR> dr------- E:\Documents and Settings\Administrator\Menu Start 2007-10-25 16:10 <DIR> dr-h----- E:\Documents and Settings\Administrator\Dane aplikacji 2007-10-25 15:12 20,992 --a------ E:\WINDOWS\system32\drivers\RTL8139.sys 2007-10-25 15:09 24,661 --a------ E:\WINDOWS\system32\spxcoins.dll 2007-10-25 15:09 13,312 --a------ E:\WINDOWS\system32\irclass.dll 2007-10-25 13:24 <DIR> d-------- E:\Program Files\Neostrada TP 2007-10-24 22:14 502,368 --a------ E:\WINDOWS\system32\drivers\amon.sys 2007-10-24 22:14 274,432 --a------ E:\WINDOWS\system32\imon.dll 2007-10-22 19:33 43,520 --a------ E:\WINDOWS\system32\CmdLineExt03.dll 2007-10-22 14:22 <DIR> d-------- E:\Program Files\Common Files\Blizzard Entertainment 2007-10-21 13:57 3,629,056 --a------ E:\WINDOWS\system32\nvvitvsr.dll 2007-10-21 13:57 3,551,232 --a------ E:\WINDOWS\system32\nvvitvs.dll 2007-10-21 13:57 2,441,216 --a------ E:\WINDOWS\system32\nvwssr.dll 2007-10-21 13:57 2,371,584 --a------ E:\WINDOWS\system32\nvwss.dll 2007-10-21 13:57 36,864 --a------ E:\WINDOWS\system32\nvcodins.dll 2007-10-21 13:57 36,864 --a------ E:\WINDOWS\system32\nvcod.dll 2007-10-21 01:04 <DIR> d-------- E:\WINDOWS\nview 2007-10-21 01:03 4,274,816 --a------ E:\WINDOWS\system32\nv4_disp.dll 2007-10-21 01:03 1,897,408 --a------ E:\WINDOWS\system32\drivers\nv4_mini.sys 2007-10-21 01:02 356,352 --a------ E:\WINDOWS\system32\nvudisp.exe 2007-10-21 00:58 356,352 --a------ E:\WINDOWS\system32\NVUNINST.EXE 2007-10-15 21:12 122,884 --a------ E:\WINDOWS\UnGins.exe 2007-10-12 21:41 <DIR> d-------- E:\WING 2007-10-12 21:41 188,960 --a------ E:\WINDOWS\system\WINGDE.DLL 2007-10-12 21:41 92,208 --a------ E:\WINDOWS\system\WING.DLL 2007-10-10 15:36 <DIR> d-------- E:\Documents and Settings\Tata.BANIOLEK\Dane aplikacji\Ahead 2007-10-10 15:35 <DIR> d-------- E:\Documents and Settings\Tata.BANIOLEK\Dane aplikacji\DivX 2007-10-07 22:22 314,368 --a------ E:\WINDOWS\KSGDeInstall.exe 2007-10-04 22:28 <DIR> d-------- E:\Documents and Settings\Baniol\Dane aplikacji\MEGAUPLOADTOOLBAR 2007-10-04 22:27 <DIR> d-------- E:\Program Files\Malicious Software Removal Tool 2007-10-04 22:16 288,768 --a------ E:\WINDOWS\system32\rhttpaa.dll 2007-10-04 22:16 116,736 --a------ E:\WINDOWS\system32\aaclient.dll 2007-10-04 22:16 36,352 --a------ E:\WINDOWS\system32\tsgqec.dll 2007-10-04 22:06 <DIR> d-------- E:\WINDOWS\l2schemas 2007-10-04 22:05 69,120 --a------ E:\WINDOWS\system32\wlanapi.dll 2007-10-04 22:04 62,336 --a------ E:\WINDOWS\system32\drivers\rspndr.sys 2007-10-04 22:04 10,752 --a------ E:\WINDOWS\system32\rspndr.exe 2007-10-04 21:49 <DIR> d-------- E:\WINDOWS\ServicePackFiles 2007-10-04 21:48 6,144 --a------ E:\WINDOWS\system32\kbdpash.dll 2007-10-04 21:48 6,144 --a------ E:\WINDOWS\system32\kbdnepr.dll 2007-10-04 21:48 6,144 --a------ E:\WINDOWS\system32\kbdiultn.dll 2007-10-04 21:48 6,144 --a------ E:\WINDOWS\system32\kbdbhc.dll 2007-10-04 21:19 349,696 --a------ E:\WINDOWS\system32\hypertrm.dll 2007-10-04 21:16 <DIR> d-------- E:\Program Files\HighMAT CD Writing Wizard 2007-10-04 21:15 40,960 --a------ E:\WINDOWS\system32\SSUBTMR6.DLL 2007-10-04 21:15 10,752 --a------ E:\WINDOWS\system32\aamd532.dll 2007-09-29 14:37 163,712 --a------ E:\WINDOWS\system32\drivers\vidstub.sys 2007-09-29 10:04 <DIR> d-------- E:\Documents and Settings\Tata.BANIOLEK\Dane aplikacji\Azureus 2007-09-29 10:03 <DIR> d-------- E:\Program Files\Azureus 2007-09-28 17:52 <DIR> d-------- E:\registry 2007-09-27 22:13 <DIR> dr-h----- E:\MSOCache 2007-09-27 21:57 <DIR> d-------- E:\Program Files\Microsoft Works 2007-09-27 21:55 <DIR> d-------- E:\Program Files\Microsoft.NET 2007-09-27 21:52 <DIR> d-------- E:\Program Files\Microsoft Visual Studio 8 2007-09-26 18:41 <DIR> d-------- E:\Documents and Settings\Baniol\SystemRequirementsLab 2007-09-26 16:13 <DIR> d-------- E:\WINDOWS\DF5A03CCD5AA43D8B948D9903F2AF94A.TMP 2007-09-26 16:09 <DIR> d-------- E:\WINDOWS\AiOTemp 2007-09-26 16:09 38,912 --a------ E:\WINDOWS\system32\hh.exe 2007-09-26 14:16 <DIR> d-------- E:\Documents and Settings\Baniol\Dane aplikacji\Ahead . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2007-10-26 14:47 --------- d-----w E:\Program Files\FlashGet 2007-10-26 14:45 --------- d-----w E:\Program Files\AutoConnect 2007-10-26 14:20 --------- d-----w E:\Documents and Settings\Baniol\Dane aplikacji\Desktop Sidebar 2007-10-24 20:10 --------- d-----w E:\Program Files\Norton Security Scan 2007-10-22 17:32 --------- d-----w E:\Program Files\AWS 2007-10-22 08:19 685,816 ----a-w E:\WINDOWS\system32\drivers\sptd.sys 2007-10-18 21:18 --------- d--h--w E:\Program Files\InstallShield Installation Information 2007-10-11 15:11 --------- d-----w E:\Documents and Settings\Tata.BANIOLEK\Dane aplikacji\MEGAUPLOADTOOLBAR 2007-10-01 14:55 --------- d-----w E:\Program Files\Image-Line 2007-09-28 20:48 4,285,952 ----a-w E:\WINDOWS\system32\logonuiX.exe 2007-09-27 19:57 --------- d-----w E:\Program Files\MSBuild 2007-09-25 20:33 --------- d-----w E:\Program Files\AMT 2007-09-23 19:11 --------- d-----w E:\Program Files\Thomson 2007-09-22 18:47 98,304 ----a-w E:\WINDOWS\system32\CmdLineExt.dll 2007-09-22 18:34 --------- d-----w E:\Documents and Settings\Tata.BANIOLEK\Dane aplikacji\Skype 2007-09-22 18:16 --------- d-----w E:\Program Files\KotOR2-PL 2007-09-21 17:06 --------- d-----w E:\Program Files\Windows Media Connect 2 2007-09-16 23:07 81,920 ----a-w E:\WINDOWS\system32\nvwddi.dll 2007-09-16 23:07 81,920 ----a-w E:\WINDOWS\system32\nvmctray.dll 2007-09-16 23:07 8,491,008 ----a-w E:\WINDOWS\system32\nvcpl.dll 2007-09-16 23:07 753,664 ----a-w E:\WINDOWS\system32\nvcplui.exe 2007-09-16 23:07 6,746,112 ----a-w E:\WINDOWS\system32\nvoglnt.dll 2007-09-16 23:07 6,344,704 ----a-w E:\WINDOWS\system32\nvdisps.dll 2007-09-16 23:07 5,509,120 ----a-w E:\WINDOWS\system32\nvdispsr.dll 2007-09-16 23:07 466,944 ----a-w E:\WINDOWS\system32\nvshell.dll 2007-09-16 23:07 458,752 ----a-w E:\WINDOWS\system32\nvmccssr.dll 2007-09-16 23:07 45,056 ----a-w E:\WINDOWS\system32\nvmccsrs.dll 2007-09-16 23:07 442,368 ----a-w E:\WINDOWS\system32\nvappbar.exe 2007-09-16 23:07 425,984 ----a-w E:\WINDOWS\system32\keystone.exe 2007-09-16 23:07 364,544 ----a-w E:\WINDOWS\system32\nvapi.dll 2007-09-16 23:07 335,872 ----a-w E:\WINDOWS\system32\nvwrses.dll 2007-09-16 23:07 335,872 ----a-w E:\WINDOWS\system32\nvwrsel.dll 2007-09-16 23:07 327,680 ----a-w E:\WINDOWS\system32\nvwrsfr.dll 2007-09-16 23:07 327,680 ----a-w E:\WINDOWS\system32\nvwrsesm.dll 2007-09-16 23:07 327,680 ----a-w E:\WINDOWS\system32\nvrshe.dll 2007-09-16 23:07 327,680 ----a-w E:\WINDOWS\system32\nvrsar.dll 2007-09-16 23:07 323,584 ----a-w E:\WINDOWS\system32\nvwrspt.dll 2007-09-16 23:07 323,584 ----a-w E:\WINDOWS\system32\nvwrsit.dll 2007-09-16 23:07 319,488 ----a-w E:\WINDOWS\system32\nvwrsptb.dll 2007-09-16 23:07 319,488 ----a-w E:\WINDOWS\system32\nvwrsnl.dll 2007-09-16 23:07 315,392 ----a-w E:\WINDOWS\system32\nvwrsru.dll 2007-09-16 23:07 315,392 ----a-w E:\WINDOWS\system32\nvwrshu.dll 2007-09-16 23:07 311,296 ----a-w E:\WINDOWS\system32\nvwrsde.dll 2007-09-16 23:07 307,200 ----a-w E:\WINDOWS\system32\nvexpbar.dll 2007-09-16 23:07 303,104 ----a-w E:\WINDOWS\system32\nvwrstr.dll 2007-09-16 23:07 303,104 ----a-w E:\WINDOWS\system32\nvwrssl.dll 2007-09-16 23:07 303,104 ----a-w E:\WINDOWS\system32\nvwrsfi.dll 2007-09-16 23:07 3,334,144 ----a-w E:\WINDOWS\system32\nvgames.dll 2007-09-16 23:07 3,166,208 ----a-w E:\WINDOWS\system32\nvgamesr.dll 2007-09-16 23:07 299,008 ----a-w E:\WINDOWS\system32\nvwrssk.dll 2007-09-16 23:07 299,008 ----a-w E:\WINDOWS\system32\nvwrsno.dll 2007-09-16 23:07 294,912 ----a-w E:\WINDOWS\system32\nvwrssv.dll 2007-09-16 23:07 294,912 ----a-w E:\WINDOWS\system32\nvwrspl.dll 2007-09-16 23:07 294,912 ----a-w E:\WINDOWS\system32\nvwrsda.dll 2007-09-16 23:07 290,816 ----a-w E:\WINDOWS\system32\nvwrsth.dll 2007-09-16 23:07 286,720 ----a-w E:\WINDOWS\system32\nvwrseng.dll 2007-09-16 23:07 286,720 ----a-w E:\WINDOWS\system32\nvwrscs.dll 2007-09-16 23:07 286,720 ----a-w E:\WINDOWS\system32\nvnt4cpl.dll 2007-09-16 23:07 282,624 ----a-w E:\WINDOWS\system32\nvwrsar.dll 2007-09-16 23:07 282,624 ----a-w E:\WINDOWS\system32\nvrsfr.dll 2007-09-16 23:07 282,624 ----a-w E:\WINDOWS\system32\nvrses.dll 2007-09-16 23:07 282,624 ----a-w E:\WINDOWS\system32\nvrsel.dll 2007-09-16 23:07 278,528 ----a-w E:\WINDOWS\system32\nvwrshe.dll 2007-09-16 23:07 278,528 ----a-w E:\WINDOWS\system32\nvrsit.dll 2007-09-16 23:07 278,528 ----a-w E:\WINDOWS\system32\nvrsde.dll 2007-09-16 23:07 274,432 ----a-w E:\WINDOWS\system32\nvrspt.dll 2007-09-16 23:07 274,432 ----a-w E:\WINDOWS\system32\nvrsnl.dll 2007-09-16 23:07 274,432 ----a-w E:\WINDOWS\system32\nvrsesm.dll 2007-09-16 23:07 270,336 ----a-w E:\WINDOWS\system32\nvrsru.dll 2007-09-16 23:07 266,240 ----a-w E:\WINDOWS\system32\nvrsptb.dll 2007-09-16 23:07 266,240 ----a-w E:\WINDOWS\system32\nvrsja.dll 2007-09-16 23:07 258,048 ----a-w E:\WINDOWS\system32\nvrstr.dll 2007-09-16 23:07 258,048 ----a-w E:\WINDOWS\system32\nvrssl.dll 2007-09-16 23:07 258,048 ----a-w E:\WINDOWS\system32\nvrssk.dll 2007-09-16 23:07 258,048 ----a-w E:\WINDOWS\system32\nvrsko.dll 2007-09-16 23:07 258,048 ----a-w E:\WINDOWS\system32\nvrshu.dll 2007-09-16 23:07 253,952 ----a-w E:\WINDOWS\system32\nvrsth.dll 2007-09-16 23:07 253,952 ----a-w E:\WINDOWS\system32\nvrssv.dll 2007-09-16 23:07 253,952 ----a-w E:\WINDOWS\system32\nvrspl.dll 2007-09-16 23:07 253,952 ----a-w E:\WINDOWS\system32\nvrsno.dll 2007-09-16 23:07 253,952 ----a-w E:\WINDOWS\system32\nvrsda.dll 2007-09-16 23:07 249,856 ----a-w E:\WINDOWS\system32\nvrsfi.dll 2007-09-16 23:07 249,856 ----a-w E:\WINDOWS\system32\nvrscs.dll 2007-09-16 23:07 245,760 ----a-w E:\WINDOWS\system32\nvrseng.dll 2007-09-16 23:07 229,376 ----a-w E:\WINDOWS\system32\nvmccs.dll 2007-09-16 23:07 225,280 ----a-w E:\WINDOWS\system32\nvrszhc.dll 2007-09-16 23:07 212,992 ----a-w E:\WINDOWS\system32\nvwrsja.dll 2007-09-16 23:07 2,854,912 ----a-w E:\WINDOWS\system32\nvmoblsr.dll 2007-09-16 23:07 196,608 ----a-w E:\WINDOWS\system32\nvwrsko.dll 2007-09-16 23:07 188,416 ----a-w E:\WINDOWS\system32\nvmccss.dll 2007-09-16 23:07 167,936 ----a-w E:\WINDOWS\system32\nvwrszht.dll 2007-09-16 23:07 163,840 ----a-w E:\WINDOWS\system32\nvwrszhc.dll 2007-09-16 23:07 155,716 ----a-w E:\WINDOWS\system32\nvsvc32.exe 2007-09-16 23:07 147,456 ----a-w E:\WINDOWS\system32\nvcolor.exe 2007-09-16 23:07 126,976 ----a-w E:\WINDOWS\system32\nvrszht.dll 2007-09-16 23:07 1,703,936 ----a-w E:\WINDOWS\system32\nvwdmcpl.dll 2007-09-16 23:07 1,626,112 ----a-w E:\WINDOWS\system32\nwiz.exe 2007-09-16 23:07 1,478,656 ----a-w E:\WINDOWS\system32\nview.dll 2007-09-16 23:07 1,339,392 ----a-w E:\WINDOWS\system32\nvdspsch.exe 2007-09-16 23:07 1,150,976 ----a-w E:\WINDOWS\system32\nvmobls.dll . ((((((((((((((((((((((((((((( snapshot@2007-10-25_16.26.38,57 ))))))))))))))))))))))))))))))))))))))))) . - 2007-10-25 14:11:35 495,616 ----a-w E:\WINDOWS\ERUNT\SDFIX\Users\[u]0[/u]0000001\NTUSER.DAT + 2007-10-25 19:38:38 8,777,728 ----a-w E:\WINDOWS\ERUNT\SDFIX\Users\[u]0[/u]0000001\NTUSER.DAT - 2007-10-25 14:11:35 8,192 ----a-w E:\WINDOWS\ERUNT\SDFIX\Users\[u]0[/u]0000002\UsrClass.dat + 2007-10-25 19:38:39 155,648 ----a-w E:\WINDOWS\ERUNT\SDFIX\Users\[u]0[/u]0000002\UsrClass.dat + 2007-10-25 19:50:21 585,791 ----a-w E:\WINDOWS\gmer.dll + 2007-06-29 07:38:18 581,632 ----a-w E:\WINDOWS\gmer.exe + 2007-10-25 19:50:22 70,001 ----a-w E:\WINDOWS\system32\drivers\gmer.sys . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Absolute StartUp monitor"="J:\Program Files\F-Group\Absolute StartUp\ASMon.exe" [2007-07-03 13:59] "BootSkin Startup Jobs"="J:\Program Files\Stardock\WinCustomize\BootSkin\BootSkin.exe" [2004-04-26 16:21] "CloneCDTray"="J:\Program Files\SlySoft\CloneCD\CloneCDTray.exe" [2006-09-28 21:21] "GrooveMonitor"="D:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-27 00:47] "LogonStudio"="J:\Program Files\WinCustomize\LogonStudio\logonstudio.exe" [2002-09-03 18:38] "NeroFilterCheck"="E:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-12 16:40] "NvMediaCenter"="E:\WINDOWS\system32\NvMcTray.dll" [2007-09-17 01:07] "SpeedTouch USB Diagnostics"="E:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" [2004-01-26 11:38] "nod32kui"="E:\Program Files\Eset\nod32kui.exe" [2007-10-24 22:14] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "AutoConnect"="E:\Program Files\AutoConnect\AutoConnect.exe" [2006-12-03 01:14] "DAEMON Tools"="J:\Program Files\DAEMON Tools\daemon.exe" [2007-08-29 17:09] E:\Documents and Settings\Tata\Menu Start\Programy\Autostart\ Skr˘t do kaiLaunch.lnk - E:\Program Files\XLink Kai Evolution VII\kaiLaunch.exe [2006-08-02] E:\Documents and Settings\Tata.BANIOLEK\Menu Start\Programy\Autostart\ Skr˘t do kaiLaunch.lnk - E:\Program Files\XLink Kai Evolution VII\kaiLaunch.exe [2006-08-02] Tworzenie wycink˘w ekranu i uruchamianie programu OneNote 2007.lnk - D:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE [2006-10-26 20:24:54] E:\Documents and Settings\Baniol\Menu Start\Programy\Autostart\ Skr˘t do Skr˘t do dsidebar.lnk - J:\Program Files\Desktop Sidebar\dsidebar.exe [2006-07-09 21:58:00] [HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\1] FriendlyName= Forum Komputerowe Pececik.com :: Strona Główna [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\J:] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\J:\Program Files] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\J:\Program Files\NetMeter] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\J:\Program Files\NetMeter\NetMeter.exe] J:\Program Files\NetMeter\NetMeter.exe S3 PsSdk30;PsSdk30;\??\E:\WINDOWS\system32\Drivers\PsSdk30.drv . Contents of the 'Scheduled Tasks' folder "2007-10-12 13:11:45 E:\WINDOWS\Tasks\Norton Security Scan.job" . ************************************************************************** catchme 0.3.1232 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-10-26 16:49:45 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2007-10-26 16:50:25 E:\ComboFix2.txt ... 2007-10-26 16:19 . --- E O F ---

wojtas19162 napisał(a):Przeskanuj

Czysto

**Posty:** 18165 · przez **wojtas** 26 Paź 2007, 17:09

Wykonaj to co jest podane w tym temacie

E:\WINDOWS\DF5A03CCD5AA43D8B948D9903F2AF94A.TMP

skasuj ten folder

**Posty:** 419 · przez **baniol22** 26 Paź 2007, 17:15

wojtas19162 napisał(a):Wykonaj to co jest podane w tym temacie

Tak robię, ale po ponownym uruchomieniu kompa port 135 jest dalej disable.

**Posty:** 18165 · przez **wojtas** 26 Paź 2007, 17:20

baniol22 ok to zostaw tak jak jest

czy masz jakis problem

**Posty:** 419 · przez **baniol22** 29 Paź 2007, 16:59

Wydawałoby się, że wszystko jest ok, ale już dzisiaj 3 raz komputer mi się zawiesił (trzeba było resetować

)

**Posty:** 18165 · przez **wojtas** 29 Paź 2007, 17:34

wykonaj defragmentacje dysku. czy podczas zawiechy zaden program w menadzerze zadan nie zuzywa 100% procka ?

brak neta, dysków i sterów

Brak neta, dysków i sterów

Kto jest na forum