csrss.exe, mulący komp i firefox

**Posty:** 16 · przez **Shadus** 05 Kwi 2008, 23:30

Jak w temacie...

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 23:25:33, on 2008-04-05 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: E:\WINDOWS\System32\smss.exe E:\WINDOWS\system32\winlogon.exe E:\WINDOWS\system32\services.exe E:\WINDOWS\system32\lsass.exe E:\WINDOWS\system32\svchost.exe E:\WINDOWS\System32\svchost.exe E:\Program Files\Alwil Software\Avast4\aswUpdSv.exe f:\Program Files\Alwil Software\Avast4\ashServ.exe E:\WINDOWS\Explorer.EXE E:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe E:\Program Files\Java\jre1.6.0_05\bin\jusched.exe F:\Program Files\IVT Corporation\BlueSoleil\BtTray.exe F:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe E:\WINDOWS\system32\ctfmon.exe F:\FRAPS\FRAPS.EXE E:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe E:\WINDOWS\system32\spoolsv.exe F:\Program Files\IVT Corporation\BlueSoleil\BlueSoleilCS.exe E:\WINDOWS\system32\nvsvc32.exe E:\WINDOWS\system32\PnkBstrB.exe F:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe f:\Program Files\Alwil Software\Avast4\ashMaiSv.exe f:\Program Files\Alwil Software\Avast4\ashWebSv.exe F:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe E:\WINDOWS\system32\wscntfy.exe F:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe E:\PROGRA~1\NEOSTR~1\NeostradaTP.exe E:\PROGRA~1\NEOSTR~1\ComComp.exe E:\PROGRA~1\NEOSTR~1\Watch.exe F:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe F:\Program Files\Winamp\winamp.exe E:\Program Files\Gadu-Gadu\gg.exe E:\WINDOWS\system32\taskmgr.exe E:\Program Files\Mozilla Firefox\firefox.exe F:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.neostrada.pl R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Neostrada TP R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - E:\PROGRA~1\NEOSTR~1\SEARCH~1.DLL O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - F:\Program Files\Adobe\Acrobat 6.0 CE\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - E:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE E:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE E:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd O4 - HKLM\..\Run: [WooCnxMon] E:\PROGRA~1\NEOSTR~1\CnxMon.exe O4 - HKLM\..\Run: [WOOWATCH] E:\PROGRA~1\NEOSTR~1\Watch.exe O4 - HKLM\..\Run: [WOOTASKBARICON] E:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "E:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" O4 - HKLM\..\Run: [WinampAgent] "F:\Program Files\Winamp\winampa.exe" O4 - HKLM\..\Run: [BtTray] "F:\Program Files\IVT Corporation\BlueSoleil\BtTray.exe" O4 - HKLM\..\Run: [avast!] f:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKCU\..\Run: [CTFMON.EXE] E:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [Gadu-Gadu] "E:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - HKCU\..\Run: [Fraps] F:\FRAPS\FRAPS.EXE O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] E:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] E:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] E:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] E:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Global Startup: DSLMON.lnk = E:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe O9 - Extra button: Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - E:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - E:\Program Files\Messenger\msmsgs.exe O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - E:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - E:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O17 - HKLM\System\CCS\Services\Tcpip\..\{061A2DEE-ECB6-4A71-9A16-E921A26CAB57}: NameServer = 194.204.159.1 217.98.63.164 O17 - HKLM\System\CS1\Services\Tcpip\..\{061A2DEE-ECB6-4A71-9A16-E921A26CAB57}: NameServer = 194.204.159.1 217.98.63.164 O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - F:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - E:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - ALWIL Software - f:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - f:\Program Files\Alwil Software\Avast4\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - f:\Program Files\Alwil Software\Avast4\ashWebSv.exe O23 - Service: BlueSoleilCS - Unknown owner - F:\Program Files\IVT Corporation\BlueSoleil\BlueSoleilCS.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - E:\WINDOWS\system32\nvsvc32.exe O23 - Service: PnkBstrA - Unknown owner - E:\WINDOWS\system32\PnkBstrA.exe O23 - Service: PnkBstrB - Unknown owner - E:\WINDOWS\system32\PnkBstrB.exe O23 - Service: Sunbelt Personal Firewall 4 (SPF4) - Sunbelt Software - F:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe -- End of file - 5610 bytes

**Posty:** 8001 · przez **Okocza** 05 Kwi 2008, 23:34

w logu czysto, daj combofixa i fixwareout. dodatkowo http://www.forum.programosy.pl/bad-generic-host-process-for-win32-services-vt79489.html

**Posty:** 16 · przez **Shadus** 06 Kwi 2008, 00:12

Kod: Zaznacz wszystko: ComboFix 08-04-04.1 - Shadus 2008-04-06 0:01:32.2 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.801 [GMT 2:00] Running from: E:\Documents and Settings\Shadus.MALEŃSTWO\Pulpit\ComboFix.exe [color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color] . ((((((((((((((((((((((((( Files Created from 2008-03-05 to 2008-04-05 ))))))))))))))))))))))))))))))) . 2008-04-05 23:38 . 2008-04-05 23:55 <DIR> d-------- E:\fixwareout 2008-04-05 23:00 . 2007-04-24 16:30 60,273 --a------ E:\WINDOWS\system32\pthreadGC2.dll 2008-04-05 23:00 . 2008-03-28 18:41 7,680 --a------ E:\WINDOWS\system32\ff_vfw.dll 2008-04-05 23:00 . 2008-03-28 18:40 6,144 --a------ E:\WINDOWS\system32\ff_acm.acm 2008-04-05 23:00 . 2007-07-10 17:10 547 --a------ E:\WINDOWS\system32\ff_vfw.dll.manifest 2008-04-04 22:45 . 2004-08-03 23:08 26,496 --a--c--- E:\WINDOWS\system32\dllcache\usbstor.sys 2008-04-03 16:46 . 2008-04-03 16:46 <DIR> d-------- E:\Program Files\Common Files\Nero 2008-04-03 16:46 . 2008-04-03 16:46 <DIR> d-------- E:\Documents and Settings\All Users.WINDOWS\Dane aplikacji\Nero 2008-04-03 16:46 . 2006-03-17 11:45 1,757,184 --a------ E:\WINDOWS\system32\imagX7.dll 2008-04-03 16:46 . 2006-03-17 11:45 802,816 --a------ E:\WINDOWS\system32\imagXRA7.dll 2008-04-03 16:46 . 2006-03-17 11:45 497,296 --a------ E:\WINDOWS\system32\imagXpr7.dll 2008-04-03 16:46 . 2006-03-17 14:49 368,640 --a------ E:\WINDOWS\system32\TwnLib4.dll 2008-04-03 16:46 . 2006-03-17 11:45 258,048 --a------ E:\WINDOWS\system32\imagXR7.dll 2008-04-03 15:40 . 2008-04-03 15:39 107,832 --a------ E:\WINDOWS\system32\PnkBstrB.exe 2008-04-03 15:39 . 2008-04-03 15:39 66,872 --a------ E:\WINDOWS\system32\PnkBstrA.exe 2008-04-03 13:17 . 2005-09-25 20:11 2,494,464 --a------ E:\WINDOWS\advrcntr2.dll 2008-04-03 13:17 . 2008-04-03 13:10 1,052,993 --a------ E:\WINDOWS\advrcntr2.zip 2008-04-03 13:10 . 2005-09-25 20:11 2,494,464 --a------ E:\WINDOWS\system32\advrcntr2.dll 2008-04-03 13:07 . 2008-04-05 23:01 69 --a------ E:\WINDOWS\NeroDigital.ini 2008-04-03 12:34 . 2008-04-03 12:34 <DIR> d-------- E:\Documents and Settings\Shadus.MALEŃSTWO\Dane aplikacji\InstallShield Installation Information 2008-04-03 12:08 . 2008-02-22 02:33 69,632 --a------ E:\WINDOWS\system32\javacpl.cpl 2008-04-02 17:41 . 2008-04-05 23:56 <DIR> d-a------ E:\Documents and Settings\All Users.WINDOWS\Dane aplikacji\TEMP 2008-04-02 17:16 . 2004-08-03 23:08 31,616 --a------ E:\WINDOWS\system32\drivers\usbccgp.sys 2008-04-02 17:16 . 2004-08-03 23:08 31,616 --a--c--- E:\WINDOWS\system32\dllcache\usbccgp.sys 2008-04-02 16:55 . 1998-10-07 12:54 327,168 --a------ E:\WINDOWS\IsUn0415.exe 2008-04-02 16:28 . 2008-04-02 23:57 193 --a------ E:\WINDOWS\system32\drivers\fwdrv.err 2008-04-02 14:38 . 2008-04-02 14:51 2,390 --a------ E:\WINDOWS\system32\SHORTCUT.INI 2008-04-02 14:29 . 2008-04-02 15:20 229 --a------ E:\WINDOWS\system32\REMOTEDEVICE.INI 2008-04-02 14:28 . 2008-04-05 23:54 4,592 --a------ E:\WINDOWS\system32\LOCALSERVICE.INI 2008-04-02 14:28 . 2008-04-05 23:54 102 --a------ E:\WINDOWS\system32\LOCALDEVICE.INI 2008-04-02 13:24 . 2008-04-02 13:24 <DIR> d-------- E:\Documents and Settings\Shadus.MALEŃSTWO\Dane aplikacji\vlc 2008-04-02 13:24 . 2006-03-02 15:00 221,184 --a------ E:\WINDOWS\system32\wmpns.dll 2008-04-02 13:23 . 2008-04-02 13:23 <DIR> d-------- E:\Documents and Settings\Shadus.MALEŃSTWO\Dane aplikacji\Media Player Classic 2008-04-02 13:23 . 2008-04-05 23:01 1,345 --a------ E:\WINDOWS\bestplayer.ini 2008-04-02 13:23 . 2008-04-05 23:01 104 --a------ E:\WINDOWS\bestplayer.bpp 2008-04-02 13:23 . 2008-04-05 23:01 0 --a------ E:\WINDOWS\bestplayer.bbt 2008-04-02 13:19 . 2008-04-02 13:19 <DIR> d-------- E:\WINDOWS\Cache 2008-04-02 12:59 . 2008-03-29 19:45 1,146,232 --a------ E:\WINDOWS\system32\aswBoot.exe 2008-04-02 12:59 . 2004-01-09 10:13 380,928 --a------ E:\WINDOWS\system32\actskin4.ocx 2008-04-02 12:59 . 2008-03-29 19:23 95,608 --a------ E:\WINDOWS\system32\AvastSS.scr 2008-04-02 12:59 . 2008-03-29 19:35 94,544 --a------ E:\WINDOWS\system32\drivers\aswmon2.sys 2008-04-02 12:59 . 2008-01-17 17:34 93,264 --a------ E:\WINDOWS\system32\drivers\aswmon.sys 2008-04-02 12:59 . 2008-03-29 19:31 75,856 --a------ E:\WINDOWS\system32\drivers\aswSP.sys 2008-04-02 12:59 . 2008-03-29 19:27 42,912 --a------ E:\WINDOWS\system32\drivers\aswTdi.sys 2008-04-02 12:59 . 2008-03-29 19:26 26,944 --a------ E:\WINDOWS\system32\drivers\aavmker4.sys 2008-04-02 12:59 . 2008-03-29 19:29 23,152 --a------ E:\WINDOWS\system32\drivers\aswRdr.sys 2008-04-02 12:59 . 2008-03-29 19:35 20,560 --a------ E:\WINDOWS\system32\drivers\aswFsBlk.sys 2008-04-02 12:46 . 2008-04-02 12:46 0 --a------ E:\WINDOWS\system32\BSPRINT.INI 2008-04-02 12:45 . 2008-04-02 12:46 32 --a------ E:\WINDOWS\[u]0[/u] 2008-04-02 12:45 . 2008-04-02 12:45 0 --a------ E:\WINDOWS\system32\[u]0[/u] 2008-04-02 12:20 . 2008-04-02 21:16 <DIR> d-------- E:\Documents and Settings\All Users.WINDOWS\Dane aplikacji\Lavasoft 2008-04-02 12:19 . 2008-04-02 12:19 <DIR> d-------- E:\Documents and Settings\Shadus.MALEŃSTWO\Dane aplikacji\Hamachi 2008-04-02 12:19 . 2008-04-02 12:19 25,544 --a------ E:\WINDOWS\system32\drivers\hamachi.sys 2008-04-02 12:15 . 2008-04-02 12:15 642,560 --a------ E:\WINDOWS\system32\drivers\sptd.sys 2008-04-02 12:15 . 2008-04-02 12:15 96,256 --a------ E:\WINDOWS\system32\drivers\sptd6813.sys 2008-04-01 22:22 . 2001-08-17 23:59 3,072 --a------ E:\WINDOWS\system32\drivers\audstub.sys 2008-04-01 22:21 . 2004-08-04 02:35 58,624 --a------ E:\WINDOWS\system32\drivers\redbook.sys 2008-04-01 22:20 . 2004-08-04 02:44 77,312 --a------ E:\WINDOWS\system32\usbui.dll 2008-04-01 22:20 . 2004-08-04 01:07 44,672 --a------ E:\WINDOWS\system32\drivers\UAGP35.SYS 2008-04-01 22:20 . 2001-08-17 22:13 27,165 --a------ E:\WINDOWS\system32\drivers\fetnd5.sys 2008-04-01 22:20 . 2004-08-04 01:08 10,624 --a------ E:\WINDOWS\system32\drivers\gameenum.sys 2008-04-01 22:18 . 2008-04-05 23:49 <DIR> dr-h----- E:\Documents and Settings\Default User.WINDOWS\Ustawienia lokalne 2008-04-01 22:18 . 2008-04-01 22:18 <DIR> d-------- E:\Documents and Settings\Default User.WINDOWS\Ulubione 2008-04-01 22:18 . 2008-04-01 20:25 <DIR> d--h----- E:\Documents and Settings\Default User.WINDOWS\Szablony 2008-04-01 22:18 . 2008-04-01 22:18 <DIR> d-------- E:\Documents and Settings\Default User.WINDOWS\Pulpit 2008-04-01 22:18 . 2008-04-01 22:18 <DIR> d-------- E:\Documents and Settings\Default User.WINDOWS\Moje dokumenty 2008-04-01 22:18 . 2008-04-01 22:18 <DIR> dr------- E:\Documents and Settings\Default User.WINDOWS\Menu Start 2008-04-01 22:18 . 2008-04-01 22:18 <DIR> d-------- E:\Documents and Settings\All Users.WINDOWS\Ulubione 2008-04-01 22:18 . 2008-04-01 22:18 <DIR> d--h----- E:\Documents and Settings\All Users.WINDOWS\Szablony 2008-04-01 22:18 . 2008-04-02 13:30 <DIR> d-------- E:\Documents and Settings\All Users.WINDOWS\Pulpit 2008-04-01 22:18 . 2008-04-01 21:03 <DIR> dr------- E:\Documents and Settings\All Users.WINDOWS\Menu Start 2008-04-01 22:18 . 2008-04-01 20:26 <DIR> dr------- E:\Documents and Settings\All Users.WINDOWS\Dokumenty 2008-04-01 22:17 . 2008-04-01 22:18 <DIR> dr-h----- E:\Documents and Settings\Default User.WINDOWS\Dane aplikacji 2008-04-01 22:17 . 2008-04-03 16:46 <DIR> dr-h----- E:\Documents and Settings\All Users.WINDOWS\Dane aplikacji 2008-04-01 22:14 . 2008-04-01 20:33 633 --a------ E:\WINDOWS\system32\$winnt$.inf 2008-04-01 22:05 . 2008-04-02 12:16 <DIR> d-------- E:\Documents and Settings\Shadus.MALEŃSTWO\Dane aplikacji\Winamp 2008-04-01 21:56 . 2008-04-01 21:58 1,440 --a------ E:\WINDOWS\system32\PQ_BATCH.PQB 2008-04-01 21:39 . 2001-08-10 07:00 1,262,956 --------- E:\WINDOWS\system32\XMNT2001.EXE 2008-04-01 21:39 . 2001-08-10 07:00 3,252 --------- E:\WINDOWS\system32\drivers\PQNTDRV.SYS 2008-04-01 21:09 . 2008-04-01 21:13 <DIR> d-------- E:\Documents and Settings\Shadus.MALEŃSTWO\Gadu-Gadu 2008-04-01 21:09 . 2008-04-01 21:13 <DIR> d-------- E:\Documents and Settings\Shadus.MALEŃSTWO\Gadu-Gadu 2008-04-01 21:05 . 2008-04-01 21:05 <DIR> d-------- E:\Documents and Settings\Shadus.MALEŃSTWO\Dane aplikacji\Talkback 2008-04-01 21:05 . 2008-04-01 21:05 0 --a------ E:\WINDOWS\nsreg.dat 2008-04-01 21:03 . 2008-04-01 21:03 13,646 --a------ E:\WINDOWS\system32\wpa.bak 2008-04-01 20:59 . 2003-10-16 18:07 32,768 --a------ E:\WINDOWS\system32\WooDial2000.dll 2008-04-01 20:57 . 2008-04-01 20:57 <DIR> d-------- E:\Program Files\Java Web Start 2008-04-01 20:57 . 2002-11-01 20:15 45,175 --------- E:\WINDOWS\system32\plugincpl140_03.cpl 2008-04-01 20:57 . 2002-11-01 20:15 41,068 --------- E:\WINDOWS\system32\ActPanel.dll 2008-04-01 20:50 . 2008-04-01 20:50 <DIR> d-------- E:\Documents and Settings\Shadus.MALEŃSTWO\WINDOWS 2008-04-01 20:50 . 2008-04-01 20:50 <DIR> d-------- E:\Documents and Settings\Shadus.MALEŃSTWO\WINDOWS 2008-04-01 20:50 . 2002-12-27 04:41 26,880 --a------ E:\WINDOWS\system32\drivers\VIAAGP1.SYS 2008-04-01 20:49 . 2008-04-01 20:49 <DIR> d-------- E:\Documents and Settings\SHADUS~1~MAL\USTAWI~1 2008-04-01 20:48 . 2003-02-16 16:46 306,688 --a------ E:\WINDOWS\IsUninst.exe 2008-04-01 20:48 . 2000-03-29 16:17 5,824 --a------ E:\WINDOWS\system32\drivers\ASUSHWIO.SYS 2008-04-01 20:48 . 2008-04-01 20:48 2,598 --a------ E:\WINDOWS\Ascd_tmp.ini 2008-04-01 20:47 . 2007-10-04 17:14 356,352 --a------ E:\WINDOWS\system32\nvudisp.exe 2008-04-01 20:47 . 2008-04-01 20:51 140,158 --a------ E:\WINDOWS\system32\nvapps.xml 2008-04-01 20:47 . 2007-10-04 17:14 17,525 --a------ E:\WINDOWS\system32\nvdisp.nvu 2008-04-01 20:46 . 2007-10-04 18:16 356,352 --a------ E:\WINDOWS\system32\NVUNINST.EXE 2008-04-01 20:35 . 2008-04-05 23:49 <DIR> d--h----- E:\Documents and Settings\Shadus.MALEŃSTWO\Ustawienia lokalne . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-04-05 21:56 --------- d-----w E:\Program Files\Neostrada TP 2008-04-03 10:08 --------- d-----w E:\Program Files\Java 2008-04-02 11:22 --------- d-----w E:\Program Files\Common Files\Adobe 2008-04-02 11:05 --------- d-----w E:\Program Files\Common Files\Real 2008-04-01 19:39 --------- d--h--w E:\Program Files\InstallShield Installation Information 2008-04-01 18:58 23 ----a-w E:\WINDOWS\system32\drivers\adidsl.cfg 2008-04-01 18:49 --------- d-----w E:\Program Files\C-Media 3D Audio 2008-03-05 14:03 479,752 ----a-w E:\WINDOWS\system32\XAudio2_0.dll 2008-03-05 14:03 238,088 ----a-w E:\WINDOWS\system32\xactengine3_0.dll 2008-03-05 14:00 25,608 ----a-w E:\WINDOWS\system32\X3DAudio1_3.dll 2008-03-05 13:56 3,786,760 ----a-w E:\WINDOWS\system32\D3DX9_37.dll 2008-03-05 13:56 1,420,824 ----a-w E:\WINDOWS\system32\D3DCompiler_37.dll 2008-02-24 22:20 --------- d-----w E:\Documents and Settings\Shadus\Dane aplikacji\GetRightToGo 2008-02-19 18:31 94,080 ----a-w E:\Documents and Settings\Shadus\Dane aplikacji\ezplay.sys 2008-02-19 18:31 87,608 ----a-w E:\Documents and Settings\Shadus\Dane aplikacji\ezpinst.exe 2008-02-19 18:30 47,360 ----a-w E:\Documents and Settings\Shadus\Dane aplikacji\pcouffin.sys 2008-02-18 17:38 --------- d-----w E:\Documents and Settings\Shadus\Dane aplikacji\BearShare 2008-02-11 20:48 --------- d-----w E:\Program Files\Avanquest update 2008-02-05 21:07 462,864 ----a-w E:\WINDOWS\system32\d3dx10_37.dll 2008-01-14 12:15 81,920 ----a-w E:\WINDOWS\system32\frapsvid.dll 2007-12-06 09:22 22,328 ----a-w E:\Documents and Settings\Shadus\Dane aplikacji\PnkBstrK.sys 2006-12-20 22:24 0 ----a-w E:\Program Files\MultiTransefind.ini 2001-11-23 04:08 712,704 ----a-w E:\WINDOWS\inf\OTHER\AUDIO3D.DLL 2007-04-24 19:54 299,008 ----a-w E:\Program Files\internet explorer\plugins\toolbar4198185.dll . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="E:\WINDOWS\system32\ctfmon.exe" [2006-03-02 14:00 15360] "Gadu-Gadu"="E:\Program Files\Gadu-Gadu\gg.exe" [2006-02-17 15:03 2396160] "Fraps"="F:\FRAPS\FRAPS.EXE" [2008-01-14 14:18 3182248] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NvCplDaemon"="E:\WINDOWS\system32\NvCpl.dll" [2007-10-04 17:14 8491008] "nwiz"="nwiz.exe" [2007-10-04 17:14 1626112 E:\WINDOWS\system32\nwiz.exe] "NvMediaCenter"="E:\WINDOWS\system32\NvMcTray.dll" [2007-10-04 17:14 81920] "Cmaudio"="cmicnfg.cpl" [] "WooCnxMon"="E:\PROGRA~1\NEOSTR~1\CnxMon.exe" [2003-10-16 18:07 24576] "WOOWATCH"="E:\PROGRA~1\NEOSTR~1\Watch.exe" [2003-10-16 18:07 20480] "WOOTASKBARICON"="E:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe" [2003-10-16 18:07 53248] "SunJavaUpdateSched"="E:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 04:25 144784] "WinampAgent"="F:\Program Files\Winamp\winampa.exe" [ ] "BtTray"="F:\Program Files\IVT Corporation\BlueSoleil\BtTray.exe" [2007-09-10 11:08 258134] "avast!"="f:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2008-03-29 19:37 79224] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="E:\WINDOWS\system32\CTFMON.EXE" [2006-03-02 14:00 15360] E:\Documents and Settings\Shadus\Menu Start\Programy\Autostart\ Skr˘t do fraps.exe.lnk - H:\Fraps\fraps.exe [2002-12-22 04:54:22 25600] E:\Documents and Settings\All Users.WINDOWS\Menu Start\Programy\Autostart\ DSLMON.lnk - E:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe [2007-05-08 10:05:10 962661] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "VIDC.FPS1"= frapsvid.dll "msacm.avis"= ff_acm.acm [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "F:\\Program Files\\IVT Corporation\\BlueSoleil\\BlueSoleilCS.exe"= "F:\\Program Files\\Sunbelt Software\\Personal Firewall\\kpf4gui.exe"= "C:\\Program Files\\EA GAMES\\Battlefield 2\\bf2_w32ded.exe"= "C:\\Program Files\\EA GAMES\\Battlefield 2\\BF2.exe"= R1 aswSP;avast! Self Protection;E:\WINDOWS\system32\drivers\aswSP.sys [2008-03-29 19:31] R1 fwdrv;Firewall Driver;E:\WINDOWS\system32\drivers\fwdrv.sys [2007-04-26 10:21] R1 khips;Kerio HIPS Driver;E:\WINDOWS\system32\drivers\khips.sys [2007-04-26 10:21] R2 aswFsBlk;aswFsBlk;E:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-03-29 19:35] R2 BlueSoleilCS;BlueSoleilCS;F:\Program Files\IVT Corporation\BlueSoleil\BlueSoleilCS.exe [2007-09-14 09:44] R2 SPF4;Sunbelt Personal Firewall 4;"F:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe" [2007-04-26 10:21] S4 BsHelpCS;BsHelpCS;F:\Program Files\IVT Corporation\BlueSoleil\BsHelpCS.exe [2007-08-17 15:58] . ************************************************************************** catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-04-06 00:06:12 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . --------------------- DLLs Loaded Under Running Processes --------------------- PROCESS: E:\WINDOWS\explorer.exe -> E:\Program Files\Gadu-Gadu\ggwhook.dll . Completion time: 2008-04-06 0:08:04 ComboFix-quarantined-files.txt 2008-04-05 22:07:56 ComboFix2.txt 2008-04-05 21:49:53 Pre-Run: 1,978,782,208 bajtów wolnych Post-Run: 1,970,759,168 bajtów wolnych

Kod: Zaznacz wszystko: Username "Shadus" - 2008-04-05 23:52:20 [Fixwareout edited 9/01/2007] ~~~~~ Prerun check Pomyślnie opróżniono pamięć podręczną programu rozpoznawania nazw DNS. System was rebooted successfully. ~~~~~ Postrun check HKLM\SOFTWARE\~\Winlogon\ "System"="" .... .... ~~~~~ Misc files. .... ~~~~~ Checking for older varients. .... ~~~~~ Current runs (hklm hkcu "run" Keys Only) [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NvCplDaemon"="RUNDLL32.EXE E:\\WINDOWS\\system32\\NvCpl.dll,NvStartup" "nwiz"="nwiz.exe /install" "NvMediaCenter"="RUNDLL32.EXE E:\\WINDOWS\\system32\\NvMcTray.dll,NvTaskbarInit" "Cmaudio"="RunDll32 cmicnfg.cpl,CMICtrlWnd" "WooCnxMon"="E:\\PROGRA~1\\NEOSTR~1\\CnxMon.exe" "WOOWATCH"="E:\\PROGRA~1\\NEOSTR~1\\Watch.exe" "WOOTASKBARICON"="E:\\PROGRA~1\\NEOSTR~1\\TaskbarIcon.exe" "SunJavaUpdateSched"="\"E:\\Program Files\\Java\\jre1.6.0_05\\bin\\jusched.exe\"" "WinampAgent"="\"F:\\Program Files\\Winamp\\winampa.exe\"" "BtTray"="\"F:\\Program Files\\IVT Corporation\\BlueSoleil\\BtTray.exe\"" "avast!"="f:\\PROGRA~1\\ALWILS~1\\Avast4\\ashDisp.exe" [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="E:\\WINDOWS\\system32\\ctfmon.exe" "Gadu-Gadu"="\"E:\\Program Files\\Gadu-Gadu\\gg.exe\" /tray" "Fraps"="F:\\FRAPS\\FRAPS.EXE" .... Hosts file was reset, If you use a custom hosts file please replace it... ~~~~~ End report ~~~~~

I jak...?

**Posty:** 18165 · przez **wojtas** 06 Kwi 2008, 00:31

Czysto, wykonaj:

1.Wyłącz przywracanie systemu ( właściwości mój komputer-zakładka przywracanie - wyłącz przywracanie na wszystkich dyskach). Po chwili włącz je powrotem
2. Ściągnij OTMoveIt i go włacz i odpal go z opcji CleanUp

3. wykonaj optymalizację windowsa
4.sciagnij ATF_Cleaner
zaznacz
Windows Temp
All users Temp
Temporary internet files
Recycle Bin
i wcisnij EMPTY SELECTED

**Posty:** 16 · przez **Shadus** 06 Kwi 2008, 00:54

1. Zrobione

2. Skasował mi też combofix'a

3. Tu niewiele było do roboty bo komp miał tydzień temu formata po 1,5roku

4. Zrobione

Dziękuje bardzo za pomoc

Musiało pomóc bo wydaje mi sie, że komp szybciej i stabilniej chodzi :

Tylko pytanko co z tym csrss.exe ? Cały czas mam to w procesach a na necie wyczytałem, że to jakiś trojan czy coś w tym guście...

**Posty:** 18165 · przez **wojtas** 06 Kwi 2008, 00:56

Tylko pytanko co z tym csrss.exe ?

jest to poprawny plik

nie ruszaj go

csrss.exe, mulący komp i firefox

csrss.exe, mulący komp i firefox

Kto jest na forum