brak zasobów systemowych i inne dziwne rzeczy

**Posty:** 7 · przez **TiMeRo** 21 Kwi 2008, 02:37

Mój problem polega na tym, że po pewnym czasie system zaczyna sie dziwnie zachowywać:
w jednych programach brakuje większej cześci GUI inne się nie uruchamiają, a zamiaste teo otrzymuje komunikat, że "nie jest to właściwy obraz systemu NT", jeden z progamów "o których nie rozmawiamy" wyświetla błąd "Brak zasobów sytemowych". Strony w przglądarce wyglądają niewłaście, brakuje czcionki i są bardzo szerokie.

Antywirus (Kasperski) nic nie wykazuje, Spyware Doctor tez nic.

Spotkałem się tez z 3 podobnymi przypadkami.

Nie wklejałem loga za HiJackThis ponieważ po przejrzeniu nie znalazłem w nim nietypowych wpisów, wszystkie zawierają informacje o programach które znami i wiem co robią.

Proszę o radę, bo skończyły mi się pomysły.

**Posty:** 8001 · przez **Okocza** 21 Kwi 2008, 08:08

daj loga z combofixa i sdfixa. w takiej kolejności.

**Posty:** 7 · przez **TiMeRo** 21 Kwi 2008, 12:42

No wiec logi:
Combofix:

Kod: Zaznacz wszystko: ComboFix 08-04-20.2 - TiMeRo 2008-04-21 12:05:39.1 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.522 [GMT 2:00] Running from: F:\»INSTALKI«\»SYSTEM«\»Diagnostyka«\ComboFix.exe [color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color] . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\Documents and Settings\TiMeRo\Dane aplikacji\inst.exe C:\WINDOWS\system32\Cache . ((((((((((((((((((((((((( Files Created from 2008-03-21 to 2008-04-21 ))))))))))))))))))))))))))))))) . 2008-04-20 23:49 . 2008-04-20 23:49 <DIR> d--h----- C:\WINDOWS\PIF 2008-04-20 21:38 . 2008-04-20 21:38 <DIR> d-------- C:\fsaua.data 2008-04-20 01:26 . 2008-04-20 01:27 <DIR> d-------- C:\Program Files\FLVPlayer 2008-04-18 22:09 . 2008-04-18 22:09 <DIR> d-------- C:\Program Files\Microsoft CAPICOM 2.1.0.2 2008-04-18 15:09 . 2008-04-18 15:11 <DIR> d-------- C:\Program Files\XP Repair Pro 2007 2008-04-18 14:46 . 2008-04-18 14:46 <DIR> d-------- C:\Documents and Settings\TiMeRo\Dane aplikacji\Thinstall 2008-04-18 02:33 . 2008-04-18 02:33 <DIR> d-------- C:\Documents and Settings\TiMeRo\Dane aplikacji\BinarySense 2008-04-18 02:32 . 2008-04-19 15:36 <DIR> d-------- C:\Program Files\Common Files\BinarySense 2008-04-18 02:25 . 2008-04-18 02:25 <DIR> d-------- C:\Program Files\HDD Regenerator 2008-04-17 20:44 . 2008-04-21 00:50 250 --a------ C:\WINDOWS\gmer.ini 2008-04-07 17:06 . 2008-04-07 17:06 <DIR> d-------- C:\Program Files\Apache Group 2008-03-21 15:23 . 2008-03-21 17:46 <DIR> d-------- C:\Documents and Settings\TiMeRo\Dane aplikacji\Command & Conquer 3 Gniew Kane'a 2008-03-21 15:21 . 2007-10-12 16:14 3,734,536 --a------ C:\WINDOWS\system32\d3dx9_36.dll 2008-03-21 15:21 . 2007-10-12 16:14 1,374,232 --a------ C:\WINDOWS\system32\D3DCompiler_36.dll 2008-03-21 15:21 . 2007-10-02 10:56 444,776 --a------ C:\WINDOWS\system32\d3dx10_36.dll 2008-03-21 15:21 . 2007-10-22 04:39 267,272 --a------ C:\WINDOWS\system32\xactengine2_10.dll . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-04-21 10:05 --------- d-----w C:\Documents and Settings\TiMeRo\Dane aplikacji\uTorrent 2008-04-21 10:03 --------- d---a-w C:\Documents and Settings\All Users\Dane aplikacji\TEMP 2008-04-21 09:52 --------- d-----w C:\Program Files\eMule 2008-04-21 09:52 --------- d-----w C:\Documents and Settings\TiMeRo\Dane aplikacji\VMware 2008-04-21 09:52 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab 2008-04-21 09:51 --------- d-----w C:\Documents and Settings\LocalService\Dane aplikacji\VMware 2008-04-21 09:49 998,432 --sha-w C:\WINDOWS\system32\drivers\fidbox2.dat 2008-04-21 09:49 76,625,952 --sha-w C:\WINDOWS\system32\drivers\fidbox.dat 2008-04-21 09:49 104,540 --sha-w C:\WINDOWS\system32\drivers\fidbox2.idx 2008-04-21 09:49 1,034,456 --sha-w C:\WINDOWS\system32\drivers\fidbox.idx 2008-04-20 23:40 --------- d-----w C:\Program Files\Syslogd 2008-04-20 18:05 --------- d-----w C:\Program Files\FreeCall 2008-04-19 18:01 --------- d-----w C:\Program Files\Spyware Doctor 2008-04-19 17:13 --------- d-----w C:\Program Files\DC++ v0.674 2008-04-19 09:05 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Microsoft Help 2008-04-17 13:44 96,645 ----a-w C:\WINDOWS\system32\drivers\klin.dat 2008-04-17 13:44 87,941 ----a-w C:\WINDOWS\system32\drivers\klick.dat 2008-04-13 20:01 --------- d-----w C:\Program Files\FlashGet 2008-04-07 20:29 --------- d-----w C:\Program Files\Opera 2008-04-06 19:14 --------- d-----w C:\Program Files\Tlen.pl 2008-04-06 11:03 --------- d-----w C:\Documents and Settings\TiMeRo\Dane aplikacji\The Bat! 2008-04-06 09:45 --------- d-----w C:\Program Files\OPR 2008-04-04 01:16 --------- d-----w C:\Program Files\PartyGaming 2008-03-31 21:42 --------- d-----w C:\Program Files\Easy File Sharing Web Server 2008-03-28 21:39 --------- d-----w C:\Documents and Settings\TiMeRo\Dane aplikacji\Wireshark 2008-03-26 19:17 --------- d-----w C:\Program Files\Java 2008-03-26 16:50 --------- d-----w C:\Program Files\DC++ v0.705 2008-03-26 13:10 --------- d-----w C:\Program Files\DC++ v0.403 2008-03-25 23:18 --------- d-----w C:\Program Files\hkSFV 2008-03-20 08:09 1,845,504 ----a-w C:\WINDOWS\system32\win32k.sys 2008-03-17 15:05 --------- d-----w C:\Program Files\SmartDraw 2007 2008-03-17 15:04 --------- d-----w C:\Documents and Settings\TiMeRo\Dane aplikacji\SmartDraw 2008-03-17 13:33 --------- d-----w C:\Program Files\DiaGen-DiaMeta 2008-03-12 15:26 --------- d-----w C:\Program Files\DC++ 2008-03-10 19:46 --------- d-----w C:\Program Files\Microsoft 2008-03-10 15:58 --------- d-----w C:\Program Files\Actual Window Minimizer 2008-03-04 23:57 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\ABBYY 2008-03-04 23:54 --------- d-----w C:\Documents and Settings\TiMeRo\Dane aplikacji\ABBYY 2008-03-04 23:43 --------- d-----w C:\Program Files\ABBYY FineReader 9.0 2008-03-04 23:40 --------- d-----w C:\Program Files\Common Files\ABBYY 2008-02-29 18:13 --------- d-----w C:\Program Files\vghd 2008-02-27 01:46 --------- d-----w C:\Program Files\The Bat! 2008-02-23 16:38 --------- d-----w C:\Documents and Settings\TiMeRo\Dane aplikacji\Skype 2008-02-22 20:17 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-02-20 06:51 282,624 ----a-w C:\WINDOWS\system32\gdi32.dll 2008-02-20 05:38 45,568 ----a-w C:\WINDOWS\system32\dnsrslvr.dll 2008-02-16 09:32 668,672 ----a-w C:\WINDOWS\system32\wininet.dll 2008-02-11 21:37 47,360 ----a-w C:\Documents and Settings\TiMeRo\Dane aplikacji\pcouffin.sys . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SkinClock"="C:\Program Files\Clock Tray Skins\ClockTraySkins.exe" [2008-02-12 21:18 459264] "Gadu-Gadu"="C:\Program Files\Gadu-Gadu\StrongGG.exe" [2007-08-18 22:29 21504] "AlcoholAutomount"="C:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe" [2007-07-02 12:29 220544] "uTorrent"="C:\Program Files\uTorrent\uTorrent.exe" [2008-02-02 22:48 219952] "Actual Window Minimizer"="C:\Program Files\Actual Window Minimizer\ActualWindowMinimizerCenter.exe" [2008-01-16 06:00 742400] "eMuleAutoStart"="C:\Program Files\eMule\emule.exe" [2007-05-13 16:57 5308416] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NVMixerTray"="C:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe" [2004-12-20 18:12 131072] "WheelMouse"="C:\PROGRA~1\A4Tech\Mouse\Amoumain.exe" [2004-08-25 18:31 147456] "AVP"="C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe" [2007-06-28 13:51 218376] "FSWebServer"="C:\Program Files\Easy File Sharing Web Server\fsws.exe" [2007-11-11 15:01 1323008] "FinePrint Dyspozytor v5"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\fpdisp5a.exe" [2006-08-24 15:55 499712] "HP Component Manager"="C:\Program Files\HP\hpcoretech\hpcmpmgr.exe" [2003-12-22 09:38 241664] "HPDJ Taskbar Utility"="C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb10.exe" [2004-03-04 16:46 172032] "vmware-tray"="C:\Program Files\VMware\VMware Workstation\vmware-tray.exe" [2007-10-08 10:27 72240] "VMware hqtray"="C:\Program Files\VMware\VMware Workstation\hqtray.exe" [2007-10-08 10:26 55856] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 05:25 144784] "RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [2005-01-12 04:01 32768] "ISTray"="C:\Program Files\Spyware Doctor\pctsTray.exe" [2008-02-01 12:55 1103240] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-08-04 01:44 15360] C:\Documents and Settings\TiMeRo\Menu Start\Programy\Autostart\ IE.lnk - C:\Program Files\Internet Explorer\iexplore.exe [2007-11-10 16:13:46 93184] Klamm.lnk - E:\Zarabianie\klamm2\LicznikDoKlamma2.exe [2006-04-24 17:44:55 36864] C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\ Kiwi Syslog Daemon.lnk - C:\Program Files\Syslogd\Syslogd_Manager.exe [2008-03-02 23:38:12 1810432] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] "ForceClassicControlPanel"= 1 (0x1) [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "AppInit_DLLs"=C:\PROGRA~1\KASPER~1\KASPER~1.0\adialhk.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "VIDC.YV12"= yv12vfw.dll "msacm.ac3acm"= ac3acm.acm "msacm.lameacm"= lameACM.acm [HKLM\~\startupfolder\C:^Documents and Settings^TiMeRo^Menu Start^Programy^Autostart^HDDlife.lnk] path=C:\Documents and Settings\TiMeRo\Menu Start\Programy\Autostart\HDDlife.lnk backup=C:\WINDOWS\pss\HDDlife.lnkStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher] --a------ 2007-05-11 14:06 40048 C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] --a------ 2007-09-20 16:35 202024 C:\Program Files\Common Files\Nero\Lib\NMBgMonitor.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update] --a------ 2004-02-18 19:55 49152 C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] --a------ 2007-03-01 16:57 153136 C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OrderReminder] -ra------ 2005-12-21 11:00 98304 C:\Program Files\Hewlett-Packard\OrderReminder\OrderReminder.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RSX++] d-------- 2008-03-11 03:04 0 F:\»PROGRAMY«\rsxpp_1.00_beta3\ [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched] --a------ 2007-09-25 02:11 132496 C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services] "NetCom"=2 (0x2) [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusDisableNotify"=dword:00000001 "UpdatesDisableNotify"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "C:\\Program Files\\uTorrent\\uTorrent.exe"= "C:\\Program Files\\FreeCall\\FreeCall.exe"= "C:\\Program Files\\FlashGet\\flashget.exe"= "C:\\Program Files\\VoipDiscount\\VoipDiscount.exe"= "C:\\Program Files\\Skype\\Phone\\Skype.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009 R0 si3112r;Silicon Image SiI 3112 SATARaid Controller;C:\WINDOWS\system32\drivers\si3112r.sys [2003-05-09 11:55] R0 SiWinAcc;SiWinAcc;C:\WINDOWS\system32\drivers\SiWinAcc.sys [2003-02-12 08:37] R2 ABBYY.Licensing.FineReader.Professional.9.0;ABBYY FineReader 9.0 PE Licensing Service;"C:\Program Files\Common Files\ABBYY\FineReader\9.00\Licensing\PE\NetworkLicenseServer.exe" -service [] R2 cvintdrv;cvintdrv;C:\WINDOWS\system32\drivers\cvintdrv.sys [2003-07-29 11:00] R2 Kiwi Syslog Daemon;Kiwi Syslog Daemon;C:\Program Files\Syslogd\Syslogd_Service.exe [2008-03-02 23:37] R3 Amps2prt;A4Tech PS/2 Port Mouse Driver;C:\WINDOWS\system32\DRIVERS\Amps2prt.sys [2004-08-25 18:09] R3 klim5;Kaspersky Anti-Virus NDIS Filter;C:\WINDOWS\system32\DRIVERS\klim5.sys [2007-04-04 15:58] R3 NPF;WinPcap Packet Driver (NPF);C:\WINDOWS\system32\drivers\NPF.sys [2007-11-19 05:31] R3 usbscan;Sterownik skanera USB;C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-03 23:58] S2 SMTPSVC;Simple Mail Transport Protocol (SMTP);C:\WINDOWS\system32\inetsrv\inetinfo.exe [2004-08-04 01:44] S3 siusbmod;siusbmod;C:\WINDOWS\system32\DRIVERS\siusbmod.sys [2005-07-14 12:39] S3 USBSTOR;Sterownik magazynu masowego USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-04 00:08] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{699bec62-9154-11dc-a41d-00e05200089d}] \Shell\AutoRun\command - nxvhpc.exe \Shell\explore\Command - nxvhpc.exe \Shell\open\Command - nxvhpc.exe *Newly Created Service* - CATCHME . ************************************************************************** catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-04-21 12:09:48 Windows 5.1.2600 Dodatek Service Pack 2 NTFS detected NTDLL code modification: ZwClose scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2008-04-21 12:11:48 ComboFix-quarantined-files.txt 2008-04-21 10:11:31 Pre-Run: 3,538,472,960 bajtów wolnych Post-Run: 3,747,729,408 bajtów wolnych 191

oraz SDfix:

Kod: Zaznacz wszystko: [b]SDFix: Version 1.173 [/b] Run by TiMeRo on 2008-04-21 at 12:27 Microsoft Windows XP [Wersja 5.1.2600] Running From: C:\SDFix [b]Checking Services [/b]: Restoring Windows Registry Values Restoring Windows Default Hosts File Rebooting [b]Checking Files [/b]: No Trojan Files Found Removing Temp Files [b]ADS Check [/b]: [b]Final Check [/b]: catchme 0.3.1353.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-04-21 12:32:37 Windows 5.1.2600 Dodatek Service Pack 2 NTFS detected NTDLL code modification: ZwClose scanning hidden processes ... scanning hidden services & system hive ... [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg] "s1"=dword:2df9c43f "s2"=dword:110480d0 "h0"=dword:00000002 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04] "p0"="C:\Program Files\Alcohol Soft\Alcohol 120\" "h0"=dword:00000000 "ujdew"=hex:a0,20,de,d8,8f,40,a5,15,96,a5,5e,55,de,3f,14,b0,aa,60,d4,b5,13,.. [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC] "p0"="C:\Program Files\DAEMON Tools Pro\" "h0"=dword:00000001 "hdf12"=hex:94,c7,68,9b,fe,c3,fc,5c,5a,08,93,74,f7,b3,d6,f4,04,a3,24,ec,b4,.. [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001] "a0"=hex:20,01,00,00,2c,a9,1b,c8,e7,ca,38,94,0c,fc,41,39,f0,83,a8,27,62,.. "hdf12"=hex:57,a9,90,d8,03,d5,ae,a9,71,7b,0d,2b,6b,20,18,f9,b8,5d,ca,be,6c,.. [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0] "hdf12"=hex:e8,ac,ec,6a,b8,9d,75,2c,fb,31,b4,ca,6d,40,16,da,f8,83,16,81,ee,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04] "p0"="C:\Program Files\Alcohol Soft\Alcohol 120\" "h0"=dword:00000000 "ujdew"=hex:a0,20,de,d8,8f,40,a5,15,96,a5,5e,55,de,3f,14,b0,aa,60,d4,b5,13,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC] "p0"="C:\Program Files\DAEMON Tools Pro\" "h0"=dword:00000001 "hdf12"=hex:94,c7,68,9b,fe,c3,fc,5c,5a,08,93,74,f7,b3,d6,f4,04,a3,24,ec,b4,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001] "a0"=hex:20,01,00,00,2c,a9,1b,c8,e7,ca,38,94,0c,fc,41,39,f0,83,a8,27,62,.. "hdf12"=hex:57,a9,90,d8,03,d5,ae,a9,71,7b,0d,2b,6b,20,18,f9,b8,5d,ca,be,6c,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0] "hdf12"=hex:e8,ac,ec,6a,b8,9d,75,2c,fb,31,b4,ca,6d,40,16,da,f8,83,16,81,ee,.. scanning hidden registry entries ... scanning hidden files ... scan completed successfully hidden processes: 0 hidden services: 0 hidden files: 0 [b]Remaining Services [/b]: Authorized Application Key Export: [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000" "C:\\Program Files\\uTorrent\\uTorrent.exe"="C:\\Program Files\\uTorrent\\uTorrent.exe:*:Enabled:uTorrent" "C:\\Program Files\\FreeCall\\FreeCall.exe"="C:\\Program Files\\FreeCall\\FreeCall.exe:*:Enabled:FreeCall" "C:\\Program Files\\FlashGet\\flashget.exe"="C:\\Program Files\\FlashGet\\flashget.exe:*:Enabled:Flashget" "C:\\Program Files\\VoipDiscount\\VoipDiscount.exe"="C:\\Program Files\\VoipDiscount\\VoipDiscount.exe:*:Enabled:VoipDiscount" "C:\\Program Files\\Skype\\Phone\\Skype.exe"="C:\\Program Files\\Skype\\Phone\\Skype.exe:*:Enabled:Skype" [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list] "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000" [b]Remaining Files [/b]: File Backups: - C:\SDFix\backups\backups.zip [b]Files with Hidden Attributes [/b]: Wed 16 Jan 2008 343,040 A.SHR --- "C:\Program Files\Actual Window Minimizer\awmemb.dll" Wed 16 Jan 2008 23,552 A.SHR --- "C:\Program Files\Actual Window Minimizer\ConsoleHelper.dll" Wed 16 Jan 2008 48,640 A.SHR --- "C:\Program Files\Actual Window Minimizer\ConsolePatch.exe" [b]Finished![/b]

**Posty:** 8001 · przez **Okocza** 21 Kwi 2008, 14:38

wstaw jeszcze hijack, tak dla pewnosci ;]

**Posty:** 3854 · przez **Dzi@dek** 21 Kwi 2008, 14:52

Otwórz notatnik i wklej:

Registry::
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{699bec62-9154-11dc-a41d-00e05200089d}]

Plik

Zapisz jako... :arrow:

CFScript - najlepiej jeśli zapiszesz w

takiej lokalizacji, by ikona CFScript.txt znalazła się obok ikony ComboFix.exe
Przeciągnij i upuść plik CFScript.txt na plik :arrow:

ComboFix.exe

Potwierdz

zrestartuje sie komputer.

Jeśli pojawi się pytanie "1 or 2" - to wpisz 1 i naciśnij ENTER. Rozpocznie się proces usuwania.

Daj nowe logi z Combofix oraz Hijackthis.

**Posty:** 7 · przez **TiMeRo** 21 Kwi 2008, 15:43

Tyle, że przy uruchomieniu w ten sposób ComboFix nie restartował komputera i nie było wyboru 1 czy 2.

A oto nowy log z ComboFixa:

Kod: Zaznacz wszystko: ComboFix 08-04-20.2 - TiMeRo 2008-04-21 15:36:41.2 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.518 [GMT 2:00] Running from: F:\»INSTALKI«\»SYSTEM«\»Diagnostyka«\ComboFix.exe Command switches used :: F:\»INSTALKI«\»SYSTEM«\»Diagnostyka«\CFScript.txt * Created a new restore point [color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color] . ((((((((((((((((((((((((( Files Created from 2008-03-21 to 2008-04-21 ))))))))))))))))))))))))))))))) . 2008-04-21 12:24 . 2008-04-21 12:24 <DIR> d-------- C:\WINDOWS\ERUNT 2008-04-21 12:20 . 2008-04-21 12:37 <DIR> d-------- C:\SDFix 2008-04-20 23:49 . 2008-04-20 23:49 <DIR> d--h----- C:\WINDOWS\PIF 2008-04-20 21:38 . 2008-04-20 21:38 <DIR> d-------- C:\fsaua.data 2008-04-20 01:26 . 2008-04-20 01:27 <DIR> d-------- C:\Program Files\FLVPlayer 2008-04-18 22:09 . 2008-04-18 22:09 <DIR> d-------- C:\Program Files\Microsoft CAPICOM 2.1.0.2 2008-04-18 15:09 . 2008-04-18 15:11 <DIR> d-------- C:\Program Files\XP Repair Pro 2007 2008-04-18 14:46 . 2008-04-18 14:46 <DIR> d-------- C:\Documents and Settings\TiMeRo\Dane aplikacji\Thinstall 2008-04-18 02:33 . 2008-04-18 02:33 <DIR> d-------- C:\Documents and Settings\TiMeRo\Dane aplikacji\BinarySense 2008-04-18 02:32 . 2008-04-19 15:36 <DIR> d-------- C:\Program Files\Common Files\BinarySense 2008-04-18 02:25 . 2008-04-18 02:25 <DIR> d-------- C:\Program Files\HDD Regenerator 2008-04-17 20:44 . 2008-04-21 00:50 250 --a------ C:\WINDOWS\gmer.ini 2008-04-07 17:06 . 2008-04-07 17:06 <DIR> d-------- C:\Program Files\Apache Group 2008-03-21 15:23 . 2008-03-21 17:46 <DIR> d-------- C:\Documents and Settings\TiMeRo\Dane aplikacji\Command & Conquer 3 Gniew Kane'a 2008-03-21 15:21 . 2007-10-12 16:14 3,734,536 --a------ C:\WINDOWS\system32\d3dx9_36.dll 2008-03-21 15:21 . 2007-10-12 16:14 1,374,232 --a------ C:\WINDOWS\system32\D3DCompiler_36.dll 2008-03-21 15:21 . 2007-10-02 10:56 444,776 --a------ C:\WINDOWS\system32\d3dx10_36.dll 2008-03-21 15:21 . 2007-10-22 04:39 267,272 --a------ C:\WINDOWS\system32\xactengine2_10.dll . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-04-21 13:35 --------- d---a-w C:\Documents and Settings\All Users\Dane aplikacji\TEMP 2008-04-21 13:35 --------- d-----w C:\Documents and Settings\TiMeRo\Dane aplikacji\VMware 2008-04-21 13:35 --------- d-----w C:\Documents and Settings\TiMeRo\Dane aplikacji\uTorrent 2008-04-21 12:01 --------- d-----w C:\Program Files\FreeCall 2008-04-21 10:38 --------- d-----w C:\Program Files\eMule 2008-04-21 10:38 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab 2008-04-21 10:32 --------- d-----w C:\Documents and Settings\LocalService\Dane aplikacji\VMware 2008-04-21 10:22 998,432 --sha-w C:\WINDOWS\system32\drivers\fidbox2.dat 2008-04-21 10:22 76,625,952 --sha-w C:\WINDOWS\system32\drivers\fidbox.dat 2008-04-21 10:22 104,756 --sha-w C:\WINDOWS\system32\drivers\fidbox2.idx 2008-04-21 10:22 1,035,224 --sha-w C:\WINDOWS\system32\drivers\fidbox.idx 2008-04-20 23:40 --------- d-----w C:\Program Files\Syslogd 2008-04-19 18:01 --------- d-----w C:\Program Files\Spyware Doctor 2008-04-19 17:13 --------- d-----w C:\Program Files\DC++ v0.674 2008-04-19 09:05 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Microsoft Help 2008-04-17 13:44 96,645 ----a-w C:\WINDOWS\system32\drivers\klin.dat 2008-04-17 13:44 87,941 ----a-w C:\WINDOWS\system32\drivers\klick.dat 2008-04-13 20:01 --------- d-----w C:\Program Files\FlashGet 2008-04-07 20:29 --------- d-----w C:\Program Files\Opera 2008-04-06 19:14 --------- d-----w C:\Program Files\Tlen.pl 2008-04-06 11:03 --------- d-----w C:\Documents and Settings\TiMeRo\Dane aplikacji\The Bat! 2008-04-06 09:45 --------- d-----w C:\Program Files\OPR 2008-04-04 01:16 --------- d-----w C:\Program Files\PartyGaming 2008-03-31 21:42 --------- d-----w C:\Program Files\Easy File Sharing Web Server 2008-03-28 21:39 --------- d-----w C:\Documents and Settings\TiMeRo\Dane aplikacji\Wireshark 2008-03-26 19:17 --------- d-----w C:\Program Files\Java 2008-03-26 16:50 --------- d-----w C:\Program Files\DC++ v0.705 2008-03-26 13:10 --------- d-----w C:\Program Files\DC++ v0.403 2008-03-25 23:18 --------- d-----w C:\Program Files\hkSFV 2008-03-20 08:09 1,845,504 ----a-w C:\WINDOWS\system32\win32k.sys 2008-03-17 15:05 --------- d-----w C:\Program Files\SmartDraw 2007 2008-03-17 15:04 --------- d-----w C:\Documents and Settings\TiMeRo\Dane aplikacji\SmartDraw 2008-03-17 13:33 --------- d-----w C:\Program Files\DiaGen-DiaMeta 2008-03-12 15:26 --------- d-----w C:\Program Files\DC++ 2008-03-10 19:46 --------- d-----w C:\Program Files\Microsoft 2008-03-10 15:58 --------- d-----w C:\Program Files\Actual Window Minimizer 2008-03-04 23:57 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\ABBYY 2008-03-04 23:54 --------- d-----w C:\Documents and Settings\TiMeRo\Dane aplikacji\ABBYY 2008-03-04 23:43 --------- d-----w C:\Program Files\ABBYY FineReader 9.0 2008-03-04 23:40 --------- d-----w C:\Program Files\Common Files\ABBYY 2008-02-29 18:13 --------- d-----w C:\Program Files\vghd 2008-02-27 01:46 --------- d-----w C:\Program Files\The Bat! 2008-02-23 16:38 --------- d-----w C:\Documents and Settings\TiMeRo\Dane aplikacji\Skype 2008-02-22 20:17 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-02-20 06:51 282,624 ----a-w C:\WINDOWS\system32\gdi32.dll 2008-02-20 05:38 45,568 ----a-w C:\WINDOWS\system32\dnsrslvr.dll 2008-02-16 09:32 668,672 ----a-w C:\WINDOWS\system32\wininet.dll 2008-02-11 21:37 47,360 ----a-w C:\Documents and Settings\TiMeRo\Dane aplikacji\pcouffin.sys . ((((((((((((((((((((((((((((( snapshot@2008-04-21_12.10.55.22 ))))))))))))))))))))))))))))))))))))))))) . - 2008-04-21 09:50:26 2,048 --s-a-w C:\WINDOWS\bootstat.dat + 2008-04-21 10:31:06 2,048 --s-a-w C:\WINDOWS\bootstat.dat + 2008-04-21 00:32:39 163,328 ----a-w C:\WINDOWS\ERUNT\SDFIX\ERDNT.EXE + 2008-04-21 10:24:05 8,372,224 ----a-w C:\WINDOWS\ERUNT\SDFIX\Users\[u]0[/u]0000001\NTUSER.DAT + 2008-04-21 10:24:05 163,840 ----a-w C:\WINDOWS\ERUNT\SDFIX\Users\[u]0[/u]0000002\UsrClass.dat + 2008-04-21 00:32:39 163,328 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\ERDNT.EXE + 2008-04-21 10:24:04 8,372,224 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\Users\[u]0[/u]0000001\NTUSER.DAT + 2008-04-21 10:24:04 163,840 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\Users\[u]0[/u]0000002\UsrClass.dat - 2008-04-21 09:52:19 227,520 ----a-w C:\WINDOWS\system32\inetsrv\MetaBase.bin + 2008-04-21 10:31:39 227,512 ----a-w C:\WINDOWS\system32\inetsrv\MetaBase.bin + 2008-04-21 10:32:09 16,384 ----atw C:\WINDOWS\Temp\Perflib_Perfdata_344.dat . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SkinClock"="C:\Program Files\Clock Tray Skins\ClockTraySkins.exe" [2008-02-12 21:18 459264] "Gadu-Gadu"="C:\Program Files\Gadu-Gadu\StrongGG.exe" [2007-08-18 22:29 21504] "AlcoholAutomount"="C:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe" [2007-07-02 12:29 220544] "uTorrent"="C:\Program Files\uTorrent\uTorrent.exe" [2008-02-02 22:48 219952] "Actual Window Minimizer"="C:\Program Files\Actual Window Minimizer\ActualWindowMinimizerCenter.exe" [2008-01-16 06:00 742400] "eMuleAutoStart"="C:\Program Files\eMule\emule.exe" [2007-05-13 16:57 5308416] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NVMixerTray"="C:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe" [2004-12-20 18:12 131072] "WheelMouse"="C:\PROGRA~1\A4Tech\Mouse\Amoumain.exe" [2004-08-25 18:31 147456] "AVP"="C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe" [2007-06-28 13:51 218376] "FSWebServer"="C:\Program Files\Easy File Sharing Web Server\fsws.exe" [2007-11-11 15:01 1323008] "FinePrint Dyspozytor v5"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\fpdisp5a.exe" [2006-08-24 15:55 499712] "HP Component Manager"="C:\Program Files\HP\hpcoretech\hpcmpmgr.exe" [2003-12-22 09:38 241664] "HPDJ Taskbar Utility"="C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb10.exe" [2004-03-04 16:46 172032] "vmware-tray"="C:\Program Files\VMware\VMware Workstation\vmware-tray.exe" [2007-10-08 10:27 72240] "VMware hqtray"="C:\Program Files\VMware\VMware Workstation\hqtray.exe" [2007-10-08 10:26 55856] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 05:25 144784] "RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [2005-01-12 04:01 32768] "ISTray"="C:\Program Files\Spyware Doctor\pctsTray.exe" [2008-02-01 12:55 1103240] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-08-04 01:44 15360] C:\Documents and Settings\TiMeRo\Menu Start\Programy\Autostart\ IE.lnk - C:\Program Files\Internet Explorer\iexplore.exe [2007-11-10 16:13:46 93184] Klamm.lnk - E:\Zarabianie\klamm2\LicznikDoKlamma2.exe [2006-04-24 17:44:55 36864] C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\ Kiwi Syslog Daemon.lnk - C:\Program Files\Syslogd\Syslogd_Manager.exe [2008-03-02 23:38:12 1810432] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] "ForceClassicControlPanel"= 1 (0x1) [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "AppInit_DLLs"=C:\PROGRA~1\KASPER~1\KASPER~1.0\adialhk.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "VIDC.YV12"= yv12vfw.dll "msacm.ac3acm"= ac3acm.acm "msacm.lameacm"= lameACM.acm [HKLM\~\startupfolder\C:^Documents and Settings^TiMeRo^Menu Start^Programy^Autostart^HDDlife.lnk] path=C:\Documents and Settings\TiMeRo\Menu Start\Programy\Autostart\HDDlife.lnk backup=C:\WINDOWS\pss\HDDlife.lnkStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher] --a------ 2007-05-11 14:06 40048 C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] --a------ 2007-09-20 16:35 202024 C:\Program Files\Common Files\Nero\Lib\NMBgMonitor.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update] --a------ 2004-02-18 19:55 49152 C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] --a------ 2007-03-01 16:57 153136 C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OrderReminder] -ra------ 2005-12-21 11:00 98304 C:\Program Files\Hewlett-Packard\OrderReminder\OrderReminder.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RSX++] d-------- 2008-03-11 03:04 0 F:\»PROGRAMY«\rsxpp_1.00_beta3\ [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched] --a------ 2007-09-25 02:11 132496 C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services] "NetCom"=2 (0x2) [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusDisableNotify"=dword:00000001 "UpdatesDisableNotify"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "C:\\Program Files\\uTorrent\\uTorrent.exe"= "C:\\Program Files\\FreeCall\\FreeCall.exe"= "C:\\Program Files\\FlashGet\\flashget.exe"= "C:\\Program Files\\VoipDiscount\\VoipDiscount.exe"= "C:\\Program Files\\Skype\\Phone\\Skype.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009 R0 si3112r;Silicon Image SiI 3112 SATARaid Controller;C:\WINDOWS\system32\drivers\si3112r.sys [2003-05-09 11:55] R0 SiWinAcc;SiWinAcc;C:\WINDOWS\system32\drivers\SiWinAcc.sys [2003-02-12 08:37] R2 ABBYY.Licensing.FineReader.Professional.9.0;ABBYY FineReader 9.0 PE Licensing Service;"C:\Program Files\Common Files\ABBYY\FineReader\9.00\Licensing\PE\NetworkLicenseServer.exe" -service [] R2 cvintdrv;cvintdrv;C:\WINDOWS\system32\drivers\cvintdrv.sys [2003-07-29 11:00] R2 Kiwi Syslog Daemon;Kiwi Syslog Daemon;C:\Program Files\Syslogd\Syslogd_Service.exe [2008-03-02 23:37] R3 Amps2prt;A4Tech PS/2 Port Mouse Driver;C:\WINDOWS\system32\DRIVERS\Amps2prt.sys [2004-08-25 18:09] R3 klim5;Kaspersky Anti-Virus NDIS Filter;C:\WINDOWS\system32\DRIVERS\klim5.sys [2007-04-04 15:58] R3 NPF;WinPcap Packet Driver (NPF);C:\WINDOWS\system32\drivers\NPF.sys [2007-11-19 05:31] R3 usbscan;Sterownik skanera USB;C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-03 23:58] S2 SMTPSVC;Simple Mail Transport Protocol (SMTP);C:\WINDOWS\system32\inetsrv\inetinfo.exe [2004-08-04 01:44] S3 siusbmod;siusbmod;C:\WINDOWS\system32\DRIVERS\siusbmod.sys [2005-07-14 12:39] S3 USBSTOR;Sterownik magazynu masowego USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-04 00:08] . ************************************************************************** catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-04-21 15:40:07 Windows 5.1.2600 Dodatek Service Pack 2 NTFS detected NTDLL code modification: ZwClose scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . --------------------- DLLs Loaded Under Running Processes --------------------- PROCESS: C:\WINDOWS\explorer.exe -> C:\Program Files\Clock Tray Skins\Clock.dll . Completion time: 2008-04-21 15:41:46 ComboFix-quarantined-files.txt 2008-04-21 13:41:40 ComboFix2.txt 2008-04-21 10:11:55 Pre-Run: 3,623,993,344 bajtów wolnych Post-Run: 3,600,801,792 bajtów wolnych 204

oraz z HijackThis:

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 15:42:48, on 2008-04-21 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\csrss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Common Files\ABBYY\FineReader\9.00\Licensing\PE\NetworkLicenseServer.exe C:\WINDOWS\system32\Ati2evxx.exe C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe C:\WINDOWS\system32\inetsrv\inetinfo.exe C:\Program Files\Syslogd\Syslogd_Service.exe C:\Program Files\Spyware Doctor\pctsAuxs.exe C:\Program Files\Spyware Doctor\pctsSvc.exe C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\HP1005MC.EXE C:\Program Files\Spyware Doctor\pctsTray.exe C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Common Files\VMware\VMware Virtual Image Editing\vmount2.exe C:\Program Files\VMware\VMware Workstation\vmware-authd.exe C:\WINDOWS\System32\alg.exe C:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe C:\PROGRA~1\A4Tech\Mouse\Amoumain.exe C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe C:\Program Files\Easy File Sharing Web Server\fsws.exe C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\fpdisp5a.exe C:\Program Files\HP\hpcoretech\hpcmpmgr.exe C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb10.exe C:\Program Files\VMware\VMware Workstation\vmware-tray.exe C:\Program Files\VMware\VMware Workstation\hqtray.exe C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe C:\Program Files\Clock Tray Skins\ClockTraySkins.exe C:\Program Files\Actual Window Minimizer\ActualWindowMinimizerCenter.exe C:\Program Files\HP\hpcoretech\comp\hptskmgr.exe C:\Program Files\Syslogd\Syslogd_Manager.exe C:\WINDOWS\System32\wbem\wmiprvse.exe C:\WINDOWS\explorer.exe C:\WINDOWS\system32\notepad.exe C:\WINDOWS\system32\NOTEPAD.EXE F:\»INSTALKI«\»SYSTEM«\»Diagnostyka«\HiJackThis 2.0.2.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.klamm.de/partner/velerion.php R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: flashget urlcatch - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\Program Files\FlashGet\jccatch.dll O2 - BHO: WebCGMHlprObj Class - {56B38F40-4E70-11d4-A076-0080AD86BA2F} - C:\WINDOWS\system32\cgmopenbho.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O2 - BHO: FlashGet GetFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\Program Files\FlashGet\getflash.dll O4 - HKLM\..\Run: [NVMixerTray] "C:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe" O4 - HKLM\..\Run: [WheelMouse] C:\PROGRA~1\A4Tech\Mouse\Amoumain.exe O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe" O4 - HKLM\..\Run: [FSWebServer] C:\Program Files\Easy File Sharing Web Server\fsws.exe O4 - HKLM\..\Run: [FinePrint Dyspozytor v5] "C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\fpdisp5a.exe" /source=HKLM O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe" O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb10.exe O4 - HKLM\..\Run: [vmware-tray] C:\Program Files\VMware\VMware Workstation\vmware-tray.exe O4 - HKLM\..\Run: [VMware hqtray] "C:\Program Files\VMware\VMware Workstation\hqtray.exe" O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" O4 - HKLM\..\Run: [ISTray] "C:\Program Files\Spyware Doctor\pctsTray.exe" O4 - HKCU\..\Run: [SkinClock] C:\Program Files\Clock Tray Skins\ClockTraySkins.exe O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\StrongGG.exe" O4 - HKCU\..\Run: [AlcoholAutomount] "C:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe" /automount O4 - HKCU\..\Run: [uTorrent] "C:\Program Files\uTorrent\uTorrent.exe" O4 - HKCU\..\Run: [Actual Window Minimizer] "C:\Program Files\Actual Window Minimizer\ActualWindowMinimizerCenter.exe" O4 - HKCU\..\Run: [eMuleAutoStart] C:\Program Files\eMule\emule.exe -AutoStart O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user') O4 - Startup: IE.lnk = C:\Program Files\Internet Explorer\iexplore.exe O4 - Startup: Klamm.lnk = E:\Zarabianie\klamm2\LicznikDoKlamma2.exe O4 - Global Startup: Kiwi Syslog Daemon.lnk = C:\Program Files\Syslogd\Syslogd_Manager.exe O8 - Extra context menu item: &Ściągnij przy pomocy FlashGet'a - C:\Program Files\FlashGet\jc_link.htm O8 - Extra context menu item: &Ściągnij wszystko przy pomocy FlashGet'a - C:\Program Files\FlashGet\jc_all.htm O8 - Extra context menu item: Add to Anti-Banner - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\ie_banner_deny.htm O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000 O8 - Extra context menu item: Sothink SWF Catcher - C:\Program Files\Common Files\SourceTec\SWF Catcher\InternetExplorer.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra button: Web Anti-Virus statistics - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\SCIEPlgn.dll O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL O9 - Extra button: PartyCasino - {B4B52284-A248-4c51-9F7C-F0A0C67FCC9D} - C:\Program Files\PartyGaming\PartyCasino\RunApp.exe O9 - Extra 'Tools' menuitem: PartyCasino - {B4B52284-A248-4c51-9F7C-F0A0C67FCC9D} - C:\Program Files\PartyGaming\PartyCasino\RunApp.exe O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe O9 - Extra button: Sothink SWF Catcher - {E19ADC6E-3909-43E4-9A89-B7B676377EE3} - C:\Program Files\Common Files\SourceTec\SWF Catcher\InternetExplorer.htm O9 - Extra 'Tools' menuitem: Sothink SWF Catcher - {E19ADC6E-3909-43E4-9A89-B7B676377EE3} - C:\Program Files\Common Files\SourceTec\SWF Catcher\InternetExplorer.htm O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1197851292031 O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1202334457421 O16 - DPF: {BDBDE413-7B1C-4C68-A8FF-C5B2B4090876} (F-Secure Online Scanner 3.3) - http://support.f-secure.com/ols/fscax.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{5147CB32-4F98-4064-A3C9-8F238B6C5DDD}: NameServer = 208.67.222.222,208.67.220.220 O17 - HKLM\System\CCS\Services\Tcpip\..\{6038C2C4-55C8-4F76-A25E-EB33F0FB50FC}: NameServer = 212.182.63.66,212.182.63.146 O17 - HKLM\System\CCS\Services\Tcpip\..\{93B8EF5D-2DAB-4E38-A994-533E5C68167E}: NameServer = 212.182.63.66,212.182.63.146 O17 - HKLM\System\CS1\Services\Tcpip\..\{5147CB32-4F98-4064-A3C9-8F238B6C5DDD}: NameServer = 208.67.222.222,208.67.220.220 O20 - AppInit_DLLs: C:\PROGRA~1\KASPER~1\KASPER~1.0\adialhk.dll O23 - Service: ABBYY FineReader 9.0 PE Licensing Service (ABBYY.Licensing.FineReader.Professional.9.0) - ABBYY (BIT Software) - C:\Program Files\Common Files\ABBYY\FineReader\9.00\Licensing\PE\NetworkLicenseServer.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: Kaspersky Internet Security 7.0 (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: Kiwi Syslog Daemon - Kiwi Enterprises - C:\Program Files\Syslogd\Syslogd_Service.exe O23 - Service: NILM License manager - Macrovision Corporation - C:\Program Files\National Instruments\Shared\License Manager\Bin\lmgrd.exe O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe O23 - Service: VMware Agent Service (ufad-ws60) - VMware, Inc. - C:\Program Files\VMware\VMware Workstation\vmware-ufad.exe O23 - Service: VMware Authorization Service (VMAuthdService) - VMware, Inc. - C:\Program Files\VMware\VMware Workstation\vmware-authd.exe O23 - Service: VMware Virtual Mount Manager Extended (vmount2) - VMware, Inc. - C:\Program Files\Common Files\VMware\VMware Virtual Image Editing\vmount2.exe -- End of file - 10796 bytes

**Posty:** 8001 · przez **Okocza** 21 Kwi 2008, 15:47

zastosuj fixwarout w awaryjnym i zamieść loga

**Posty:** 7 · przez **TiMeRo** 21 Kwi 2008, 16:05

Log z Fixwareouta:

Kod: Zaznacz wszystko: Username "TiMeRo" - 2008-04-21 15:55:28 [Fixwareout edited 9/01/2007] ~~~~~ Prerun check System was rebooted successfully. ~~~~~ Postrun check HKLM\SOFTWARE\~\Winlogon\ "System"="" .... .... ~~~~~ Misc files. .... ~~~~~ Checking for older varients. .... ~~~~~ Current runs (hklm hkcu "run" Keys Only) [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\run] "NVMixerTray"="\"C:\\Program Files\\NVIDIA Corporation\\NvMixer\\NVMixerTray.exe\"" "WheelMouse"="C:\\PROGRA~1\\A4Tech\\Mouse\\Amoumain.exe" "AVP"="\"C:\\Program Files\\Kaspersky Lab\\Kaspersky Internet Security 7.0\\avp.exe\"" "FSWebServer"="C:\\Program Files\\Easy File Sharing Web Server\\fsws.exe" "FinePrint Dyspozytor v5"="\"C:\\WINDOWS\\System32\\spool\\DRIVERS\\W32X86\\3\\fpdisp5a.exe\" /source=HKLM" "HP Component Manager"="\"C:\\Program Files\\HP\\hpcoretech\\hpcmpmgr.exe\"" "HPDJ Taskbar Utility"="C:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\hpztsb10.exe" "vmware-tray"="C:\\Program Files\\VMware\\VMware Workstation\\vmware-tray.exe" "VMware hqtray"="\"C:\\Program Files\\VMware\\VMware Workstation\\hqtray.exe\"" "SunJavaUpdateSched"="\"C:\\Program Files\\Java\\jre1.6.0_05\\bin\\jusched.exe\"" "RemoteControl"="\"C:\\Program Files\\CyberLink\\PowerDVD\\PDVDServ.exe\"" "ISTray"="\"C:\\Program Files\\Spyware Doctor\\pctsTray.exe\"" [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\run] "SkinClock"="C:\\Program Files\\Clock Tray Skins\\ClockTraySkins.exe" "Gadu-Gadu"="\"C:\\Program Files\\Gadu-Gadu\\StrongGG.exe\"" "AlcoholAutomount"="\"C:\\Program Files\\Alcohol Soft\\Alcohol 120\\axcmd.exe\" /automount" "uTorrent"="\"C:\\Program Files\\uTorrent\\uTorrent.exe\"" "Actual Window Minimizer"="\"C:\\Program Files\\Actual Window Minimizer\\ActualWindowMinimizerCenter.exe\"" "eMuleAutoStart"="C:\\Program Files\\eMule\\emule.exe -AutoStart" .... Hosts file was reset, If you use a custom hosts file please replace it... ~~~~~ End report ~~~~~

Na razie się nic nie dzieje zobaczę jak Win pochodzi trochę czy coś się zmieniło na lepsze

**Posty:** 8001 · przez **Okocza** 21 Kwi 2008, 16:07

powinno już być ok.

brak zasobów systemowych i inne dziwne rzeczy

brak zasobów systemowych i inne dziwne rzeczy

Kto jest na forum