Czeste lagi [log]

**Posty:** 110 · przez **cnx1234** 03 Mar 2009, 19:09

otoz mam czeste lagi w grach przez internet. oto log hijactkihs:

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 18:07:05, on 2009-03-03 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\ESET\ESET Smart Security\ekrn.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\RUNDLL32.EXE C:\Program Files\ESET\ESET Smart Security\egui.exe C:\Program Files\Java\jre6\bin\jusched.exe C:\Program Files\DU Meter\DUMeter.exe C:\Program Files\TweakMASTER\TMTray.exe C:\Program Files\Process Lasso\processlasso.exe C:\Program Files\Process Lasso\processgovernor.exe C:\WINDOWS\SOUNDMAN.EXE C:\Program Files\Magic Network\Perfect Shutdown\PSD.EXE C:\WINDOWS\system32\wscntfy.exe C:\gamaa adjuster\GammaAdjuster.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\ivo\Expressivo Demo\integr\OutlookExpress\ExprOElauncher.exe C:\Program Files\RALINK\Common\RaUI.exe C:\Program Files\OpenOffice.ux.pl 2.1.0\program\soffice.exe C:\Program Files\OpenOffice.ux.pl 2.1.0\program\soffice.BIN C:\Program Files\Gadu-Gadu\gg.exe C:\Program Files\Opera\opera.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza R3 - URLSearchHook: Softonic English Toolbar - {930f1200-f5f1-4870-bac6-e233ec8e7023} - C:\Program Files\Softonic_English\tbSof1.dll R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll O2 - BHO: TweakMASTER PRO Component - {7DAAC7DE-9EF0-4FF0-BFA5-AFF3E899054C} - C:\PROGRA~1\TWEAKM~1\TweakBHO.dll O2 - BHO: Expressivo - {85F685C3-20D9-4943-95E4-EB4224056C3F} - C:\Program Files\ivo\Expressivo Demo\integr\ih-iexplorer\IH_iexplorer.dll O2 - BHO: Softonic English Toolbar - {930f1200-f5f1-4870-bac6-e233ec8e7023} - C:\Program Files\Softonic_English\tbSof1.dll O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll O2 - BHO: JQSIEStartDetectorImpl Class - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll O3 - Toolbar: Softonic English Toolbar - {930f1200-f5f1-4870-bac6-e233ec8e7023} - C:\Program Files\Softonic_English\tbSof1.dll O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O3 - Toolbar: Expressivo - {85F685C3-20D9-4943-95E4-EB4224056C3F} - C:\Program Files\ivo\Expressivo Demo\integr\ih-iexplorer\IH_iexplorer.dll O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET Smart Security\egui.exe" /hide /waitservice O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe" O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [DU Meter] C:\Program Files\DU Meter\DUMeter.exe O4 - HKLM\..\Run: [TweakMASTER] "C:\Program Files\TweakMASTER\TMTray.exe" O4 - HKLM\..\Run: [ProcessSupervisorGUI] C:\Program Files\Process Lasso\processlasso.exe O4 - HKLM\..\Run: [ProcessGovernor] C:\Program Files\Process Lasso\processgovernor.exe O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [PSD] C:\Program Files\Magic Network\Perfect Shutdown\PSD.EXE O4 - HKLM\..\Run: [GammaAdjuster] C:\gamaa adjuster\GammaAdjuster.exe O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - HKCU\..\Run: [ExprOElauncher] C:\Program Files\ivo\Expressivo Demo\integr\OutlookExpress\ExprOElauncher.exe O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Startup: OpenOffice.ux.pl 2.1.0.lnk = C:\Program Files\OpenOffice.ux.pl 2.1.0\program\quickstart.exe O4 - Global Startup: Ralink Wireless Utility.lnk = C:\Program Files\RALINK\Common\RaUI.exe O8 - Extra context menu item: Add to &LinkFox - res://C:\PROGRA~1\TWEAKM~1\TweakBHO.dll/IESCRIPT O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll O17 - HKLM\System\CCS\Services\Tcpip\..\{C120C1C0-0106-48F2-B10C-BF5CCAA5BCB0}: NameServer = 208.67.222.222,208.67.220.220 O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET Smart Security\ekrn.exe O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe -- End of file - 6496 bytes

**Posty:** 18165 · przez **wojtas** 03 Mar 2009, 23:46

Wykonaj to co jest podane w tym temacie

Zastosuj SDFix . Po pobraniu uruchom go a rozpakuje się do C:\SDFix. Uruchom komputer w trybie awaryjnym (F8 przy stracie systemu). Będąc w awaryjnym uruchom plik RunThis.bat z folderu SDFixa. Zatwierdź czyszczenie przez Y. Poczekaj aż ukończy i komputer zresetuje

Potem wejdz do folderu C:\SDFix wrzuc zawartość pliku Report.txt + log z combofixa oraz daj loga z hijacka

**Posty:** 110 · przez **cnx1234** 06 Mar 2009, 14:15

combofix:

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 13:07:13, on 2009-03-06 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\ESET\ESET Smart Security\ekrn.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\system32\notepad.exe C:\WINDOWS\system32\RUNDLL32.EXE C:\Program Files\ESET\ESET Smart Security\egui.exe C:\Program Files\Java\jre6\bin\jusched.exe C:\Program Files\DU Meter\DUMeter.exe C:\Program Files\TweakMASTER\TMTray.exe C:\Program Files\Process Lasso\processlasso.exe C:\Program Files\Process Lasso\processgovernor.exe C:\WINDOWS\SOUNDMAN.EXE C:\gamaa adjuster\GammaAdjuster.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Gadu-Gadu\gg.exe C:\Program Files\ivo\Expressivo Demo\integr\OutlookExpress\ExprOElauncher.exe C:\Program Files\RALINK\Common\RaUI.exe C:\Program Files\OpenOffice.ux.pl 2.1.0\program\soffice.exe C:\Program Files\OpenOffice.ux.pl 2.1.0\program\soffice.BIN C:\Program Files\Opera\opera.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza R3 - URLSearchHook: Softonic English Toolbar - {930f1200-f5f1-4870-bac6-e233ec8e7023} - C:\Program Files\Softonic_English\tbSof1.dll R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll O2 - BHO: TweakMASTER PRO Component - {7DAAC7DE-9EF0-4FF0-BFA5-AFF3E899054C} - C:\PROGRA~1\TWEAKM~1\TweakBHO.dll O2 - BHO: Expressivo - {85F685C3-20D9-4943-95E4-EB4224056C3F} - C:\Program Files\ivo\Expressivo Demo\integr\ih-iexplorer\IH_iexplorer.dll O2 - BHO: Softonic English Toolbar - {930f1200-f5f1-4870-bac6-e233ec8e7023} - C:\Program Files\Softonic_English\tbSof1.dll O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll O2 - BHO: JQSIEStartDetectorImpl Class - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll O3 - Toolbar: Softonic English Toolbar - {930f1200-f5f1-4870-bac6-e233ec8e7023} - C:\Program Files\Softonic_English\tbSof1.dll O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O3 - Toolbar: Expressivo - {85F685C3-20D9-4943-95E4-EB4224056C3F} - C:\Program Files\ivo\Expressivo Demo\integr\ih-iexplorer\IH_iexplorer.dll O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET Smart Security\egui.exe" /hide /waitservice O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe" O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [DU Meter] C:\Program Files\DU Meter\DUMeter.exe O4 - HKLM\..\Run: [TweakMASTER] "C:\Program Files\TweakMASTER\TMTray.exe" O4 - HKLM\..\Run: [ProcessSupervisorGUI] C:\Program Files\Process Lasso\processlasso.exe O4 - HKLM\..\Run: [ProcessGovernor] C:\Program Files\Process Lasso\processgovernor.exe O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [GammaAdjuster] C:\gamaa adjuster\GammaAdjuster.exe O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - HKCU\..\Run: [ExprOElauncher] C:\Program Files\ivo\Expressivo Demo\integr\OutlookExpress\ExprOElauncher.exe O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Startup: OpenOffice.ux.pl 2.1.0.lnk = C:\Program Files\OpenOffice.ux.pl 2.1.0\program\quickstart.exe O4 - Global Startup: Ralink Wireless Utility.lnk = C:\Program Files\RALINK\Common\RaUI.exe O8 - Extra context menu item: Add to &LinkFox - res://C:\PROGRA~1\TWEAKM~1\TweakBHO.dll/IESCRIPT O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll O17 - HKLM\System\CCS\Services\Tcpip\..\{C120C1C0-0106-48F2-B10C-BF5CCAA5BCB0}: NameServer = 208.67.222.222,208.67.220.220 O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET Smart Security\ekrn.exe O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe -- End of file - 6391 bytes

Sdfix

Kod: Zaznacz wszystko: [b]SDFix: Version 1.240 [/b] Run by N on 2009-03-06 at 12:55 Microsoft Windows XP [Wersja 5.1.2600] Running From: C:\SDFix [b]Checking Services [/b]: Restoring Default Security Values Restoring Default Hosts File Rebooting [b]Checking Files [/b]: No Trojan Files Found Removing Temp Files [b]ADS Check [/b]: [b]Final Check [/b]: catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-03-06 13:03:36 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... scanning hidden services & system hive ... [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg] "s1"=dword:2df9c43f "s2"=dword:110480d0 "h0"=dword:00000001 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4] "p0"="C:\Program Files\DAEMON Tools Lite\" "h0"=dword:00000000 "khjeh"=hex:e2,4d,a5,af,41,fa,f4,af,05,15,b8,3c,e0,16,99,8b,93,57,11,e4,cd,.. [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001] "a0"=hex:20,01,00,00,0d,b8,d2,e2,2a,9a,4c,f6,1d,51,76,60,db,98,10,81,73,.. "khjeh"=hex:4c,2a,31,31,d7,6a,b9,50,b1,01,25,6f,62,10,e1,80,4d,41,91,70,0e,.. [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40] "khjeh"=hex:8d,a6,53,50,67,4b,2e,63,d8,08,d5,e9,98,be,11,5b,6f,15,04,17,cc,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4] "p0"="C:\Program Files\DAEMON Tools Lite\" "h0"=dword:00000000 "khjeh"=hex:e2,4d,a5,af,41,fa,f4,af,05,15,b8,3c,e0,16,99,8b,93,57,11,e4,cd,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001] "a0"=hex:20,01,00,00,0d,b8,d2,e2,2a,9a,4c,f6,1d,51,76,60,db,98,10,81,73,.. "khjeh"=hex:4c,2a,31,31,d7,6a,b9,50,b1,01,25,6f,62,10,e1,80,4d,41,91,70,0e,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40] "khjeh"=hex:8d,a6,53,50,67,4b,2e,63,d8,08,d5,e9,98,be,11,5b,6f,15,04,17,cc,.. scanning hidden registry entries ... [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Prefetcher] "TracesProcessed"=dword:000000ee scanning hidden files ... scan completed successfully hidden processes: 0 hidden services: 0 hidden files: 0 [b]Remaining Services [/b]: Authorized Application Key Export: [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "C:\\Program Files\\Metin2_PL\\metin2.bin"="C:\\Program Files\\Metin2_PL\\metin2.bin:*:Enabled:metin2" "C:\\Program Files\\Gadu-Gadu\\gg.exe"="C:\\Program Files\\Gadu-Gadu\\gg.exe:*:Enabled:Gadu-Gadu - program g˘wny" "C:\\Program Files\\Ares\\Ares.exe"="C:\\Program Files\\Ares\\Ares.exe:*:Enabled:Ares p2p for windows" "C:\\Program Files\\Valve\\hl.exe"="C:\\Program Files\\Valve\\hl.exe:*:Enabled:Half-Life Launcher" "C:\\Program Files\\Skype\\Phone\\Skype.exe"="C:\\Program Files\\Skype\\Phone\\Skype.exe:*:Enabled:Skype" [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list] "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" [b]Remaining Files [/b]: [b]Files with Hidden Attributes [/b]: Mon 7 Jan 2008 352 A..H. --- "C:\WINDOWS\nod32fixtemdono.reg" Thu 7 Aug 2008 1,024 A..H. --- "C:\System Volume Information\_restore{DCD64AE8-67E2-4AB9-80B1-144C7572B644}\RP31\A0005996.sys" Tue 13 Jan 2009 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\11a57a6ce332895115505eafdfc919de\BIT8E.tmp" Tue 13 Jan 2009 618,760 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\18f04ce5208bf85f21aa56793fc206ed\BIT8A.tmp" Tue 13 Jan 2009 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\2c7c094c07d8ab1c6d2c7df6e96d2df0\BITA5.tmp" Tue 13 Jan 2009 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\55fe03e59c7b98ebc21dc3c36e54eaf0\BIT8B.tmp" Tue 13 Jan 2009 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\6d3e4a8f99a381f392de0d99b22fc9a6\BIT9D.tmp" Tue 13 Jan 2009 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\762fc57e7d7138faef1f37e9eec268dc\BITA2.tmp" Tue 13 Jan 2009 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\a700888399b59cee38c0ae52e87f0a91\BITA7.tmp" Tue 13 Jan 2009 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\abf37927fe96bc682b342849c5743771\BIT98.tmp" Fri 1 Jun 2007 106,080 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\baf5873d097c20aedd3e06e2ff27a933\BIT88.tmp" Tue 13 Jan 2009 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\be1ffa8cce945fce80b8bcf08e4890c5\BIT8D.tmp" Tue 13 Jan 2009 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\c636f36b2a084e07ecb5cf11b488b148\BIT9C.tmp" Tue 13 Jan 2009 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\c7b4f55875889c9c9ecb3c2a0d57a3fb\BIT96.tmp" Tue 13 Jan 2009 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\ce6ce445a88a6f40117b1bf83ba65bc4\BITA6.tmp" Tue 13 Jan 2009 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\e6a7525a4b32c7adb3b1c81ba8f28cb5\BIT8C.tmp" Tue 13 Jan 2009 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\f0b88fe1ffe91bd3a9ea0d5ad18f24b7\BITA9.tmp" Fri 28 Jul 2006 152,772 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\fd43c53f6dd72556f6c8c981a93ce522\BIT87.tmp" Tue 13 Jan 2009 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\31383aab90693af2687520e301606b09\download\BIT8C.tmp" Tue 13 Jan 2009 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\4c41adde360d8087c4b4dd4e2d835dec\download\BITE2.tmp" Tue 13 Jan 2009 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\4d39b1b575a5584d11abd56a8de2f045\download\BIT95.tmp" Tue 13 Jan 2009 408,804 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\607c3e95df650a193f50ba0792fb4a68\download\BITC8.tmp" Tue 13 Jan 2009 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\67363d1e42ce421cde25a6a620fabf78\download\BITCA.tmp" Tue 13 Jan 2009 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\81968cc7f0ee4f3ea56bf21096a0eb8a\download\BITD1.tmp" Tue 13 Jan 2009 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\955f27c5c4f218cbb2ef80aaafccb6df\download\BITDF.tmp" Tue 13 Jan 2009 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\99c63b8154c86bb80bd4d4ef1f97d4ee\download\BITE4.tmp" Tue 13 Jan 2009 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\9ec74fb7ec17ab7a6f098ff95504d6d2\download\BIT93.tmp" Tue 13 Jan 2009 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\aa5843f35b888e23da16633e2a1ea0ba\download\BIT8A.tmp" Tue 13 Jan 2009 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\b96f4018a5a1e8840e523891e4664d45\download\BIT8B.tmp" Tue 13 Jan 2009 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\e0afa7c543f98972689a91dc65aaf2ee\download\BITCC.tmp" Tue 13 Jan 2009 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\f99caf315eddf99a1888d73e43fa1f8d\download\BITCB.tmp" Tue 13 Jan 2009 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\ff7cdeb5b319e52da26114e216140ae5\download\BITD4.tmp" [b]Finished![/b]

Hijackiths:

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 13:15:08, on 2009-03-06 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\ESET\ESET Smart Security\ekrn.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\system32\RUNDLL32.EXE C:\Program Files\ESET\ESET Smart Security\egui.exe C:\Program Files\Java\jre6\bin\jusched.exe C:\Program Files\TweakMASTER\TMTray.exe C:\Program Files\Process Lasso\processlasso.exe C:\Program Files\Process Lasso\processgovernor.exe C:\gamaa adjuster\GammaAdjuster.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Gadu-Gadu\gg.exe C:\Program Files\ivo\Expressivo Demo\integr\OutlookExpress\ExprOElauncher.exe C:\Program Files\OpenOffice.ux.pl 2.1.0\program\soffice.exe C:\Program Files\OpenOffice.ux.pl 2.1.0\program\soffice.BIN C:\WINDOWS\system32\imapi.exe C:\Program Files\Opera\opera.exe C:\WINDOWS\system32\notepad.exe C:\WINDOWS\explorer.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza R3 - URLSearchHook: Softonic English Toolbar - {930f1200-f5f1-4870-bac6-e233ec8e7023} - C:\Program Files\Softonic_English\tbSof1.dll R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll O2 - BHO: TweakMASTER PRO Component - {7DAAC7DE-9EF0-4FF0-BFA5-AFF3E899054C} - C:\PROGRA~1\TWEAKM~1\TweakBHO.dll O2 - BHO: Expressivo - {85F685C3-20D9-4943-95E4-EB4224056C3F} - C:\Program Files\ivo\Expressivo Demo\integr\ih-iexplorer\IH_iexplorer.dll O2 - BHO: Softonic English Toolbar - {930f1200-f5f1-4870-bac6-e233ec8e7023} - C:\Program Files\Softonic_English\tbSof1.dll O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll O2 - BHO: JQSIEStartDetectorImpl Class - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll O3 - Toolbar: Softonic English Toolbar - {930f1200-f5f1-4870-bac6-e233ec8e7023} - C:\Program Files\Softonic_English\tbSof1.dll O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O3 - Toolbar: Expressivo - {85F685C3-20D9-4943-95E4-EB4224056C3F} - C:\Program Files\ivo\Expressivo Demo\integr\ih-iexplorer\IH_iexplorer.dll O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET Smart Security\egui.exe" /hide /waitservice O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe" O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [DU Meter] C:\Program Files\DU Meter\DUMeter.exe O4 - HKLM\..\Run: [TweakMASTER] "C:\Program Files\TweakMASTER\TMTray.exe" O4 - HKLM\..\Run: [ProcessSupervisorGUI] C:\Program Files\Process Lasso\processlasso.exe O4 - HKLM\..\Run: [ProcessGovernor] C:\Program Files\Process Lasso\processgovernor.exe O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [GammaAdjuster] C:\gamaa adjuster\GammaAdjuster.exe O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - HKCU\..\Run: [ExprOElauncher] C:\Program Files\ivo\Expressivo Demo\integr\OutlookExpress\ExprOElauncher.exe O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Startup: OpenOffice.ux.pl 2.1.0.lnk = C:\Program Files\OpenOffice.ux.pl 2.1.0\program\quickstart.exe O4 - Global Startup: Ralink Wireless Utility.lnk = C:\Program Files\RALINK\Common\RaUI.exe O8 - Extra context menu item: Add to &LinkFox - res://C:\PROGRA~1\TWEAKM~1\TweakBHO.dll/IESCRIPT O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll O17 - HKLM\System\CCS\Services\Tcpip\..\{C120C1C0-0106-48F2-B10C-BF5CCAA5BCB0}: NameServer = 208.67.222.222,208.67.220.220 O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET Smart Security\ekrn.exe O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe -- End of file - 6317 bytes

**Posty:** 18165 · przez **wojtas** 06 Mar 2009, 16:55

daj loga z combofixa po dales 2 razy log z hijacka.

**Posty:** 110 · przez **cnx1234** 06 Mar 2009, 17:13

a i jeszcze chcem dodac iz od pory popoludniowej net gorzej chodzi. a moj brat ma ten sam i wzzystko ok. czyli nie da sie grac a pingi sa rozne. oto statystyka co robilem przed chwila Szacunkowy Czas bladzenia pakietow w milisekundach : Minimum = 24ms , maksimum - 4160 ms czas sredni =514 ms. 6 pakietow utraconych laczylem sie z onet.pl
a oto log :

Kod: Zaznacz wszystko: ComboFix 09-03-04.01 - N 2009-03-06 13:11:23.3 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.511.212 [GMT 1:00] Uruchomiony z: c:\instalki\ComboFix.exe AV: ESET Smart Security 3.0 *On-access scanning enabled* (Updated) FW: ESET Personal firewall *enabled* * Utworzono nowy punkt przywracania * Resident AV is active . ((((((((((((((((((((((((( Pliki utworzone od 2009-02-06 do 2009-03-06 ))))))))))))))))))))))))))))))) . 2009-03-06 12:50 . 2009-03-06 13:04 <DIR> d-------- C:\SDFix 2009-02-28 17:07 . 2009-02-28 17:08 <DIR> d-------- C:\zdjątka 2009-02-26 13:10 . 2009-03-06 10:55 <DIR> d-------- c:\documents and settings\Nikola\Dane aplikacji\OpenOffice.ux.pl2 2009-02-25 19:54 . 2009-02-25 19:54 <DIR> d-------- c:\documents and settings\N\WINDOWS 2009-02-25 19:54 . 1998-01-23 14:15 304,640 --a------ c:\windows\IsUn0415.exe 2009-02-24 17:10 . 2009-02-24 17:10 8,975 --a------ C:\wos.odt 2009-02-23 20:31 . 2009-03-06 13:05 <DIR> d-------- c:\documents and settings\N\Dane aplikacji\OpenOffice.ux.pl2 2009-02-23 20:29 . 2009-02-23 20:29 <DIR> d-------- c:\program files\OpenOffice.ux.pl 2.1.0 2009-02-20 19:53 . 2009-02-21 16:54 <DIR> d-------- c:\documents and settings\N\Dane aplikacji\skypePM 2009-02-20 19:53 . 2009-02-20 19:53 56 --ah----- c:\windows\system32\ezsidmv.dat 2009-02-20 19:52 . 2009-02-21 16:54 <DIR> d-------- c:\documents and settings\N\Dane aplikacji\Skype 2009-02-20 19:51 . 2009-02-20 19:51 <DIR> dr------- c:\program files\Skype 2009-02-20 19:51 . 2009-02-20 19:51 <DIR> d-------- c:\program files\Common Files\Skype 2009-02-20 19:51 . 2009-02-20 19:51 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\Skype 2009-02-18 20:06 . 2009-02-18 20:06 <DIR> d-------- c:\documents and settings\Nikola\Dane aplikacji\Samsung 2009-02-18 20:05 . 2009-02-18 20:04 5,632 --a------ c:\windows\system32\drivers\StarOpen.sys 2009-02-18 19:36 . 2009-02-18 19:36 <DIR> d-------- c:\program files\Samsung 2009-02-18 14:14 . 2009-02-18 14:14 <DIR> d-------- c:\program files\ZhyperMU 2009-02-17 17:43 . 2009-02-17 17:43 <DIR> d-------- c:\program files\ivo 2009-02-17 17:43 . 2009-02-17 18:08 <DIR> d-------- c:\documents and settings\N\Dane aplikacji\Expressivo 2009-02-16 21:24 . 2009-02-16 21:24 <DIR> d-------- c:\program files\Magic Network 2009-02-13 12:29 . 2005-10-14 17:45 <DIR> d-a------ C:\Zbot 2009-02-13 12:29 . 2008-05-06 14:51 9,351,679 --a------ C:\Zbot.zip . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-03-06 06:37 --------- d-----w c:\program files\Valve 2009-03-06 06:21 --------- d-----w c:\program files\Metin2_PL 2009-02-24 15:25 --------- d-----w c:\program files\Gadu-Gadu 2009-02-21 11:20 --------- d-----w c:\program files\ALLPlayer 2009-02-18 18:36 --------- d--h--w c:\program files\InstallShield Installation Information 2009-02-11 15:57 --------- d-----w c:\program files\Softonic_English 2009-02-05 11:18 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\Yahoo! Companion 2009-01-28 19:05 --------- d-----w c:\documents and settings\Nikola\Dane aplikacji\ProcessLasso 2009-01-27 19:47 --------- d-----w c:\program files\Realtek AC97 2009-01-27 19:32 --------- d-----w c:\program files\Process Lasso 2009-01-27 19:32 --------- d-----w c:\documents and settings\N\Dane aplikacji\ProcessLasso 2009-01-27 19:11 --------- d-----w c:\documents and settings\N\Dane aplikacji\Auslogics 2009-01-27 19:04 --------- d-----w c:\program files\Auslogics 2009-01-26 17:49 --------- d-----w c:\program files\Yahoo! 2009-01-26 17:49 --------- d-----w c:\program files\CCleaner 2009-01-22 13:54 --------- d-----w c:\program files\NAPI-PROJEKT 2009-01-16 12:31 --------- d-----w c:\program files\AvRack 2009-01-15 15:03 --------- d-----w c:\documents and settings\Nikola\Dane aplikacji\Hagel Technologies 2009-01-13 14:21 --------- d-----w c:\program files\cFosSpeed 2009-01-11 19:56 --------- d-----w c:\program files\TweakMASTER 2009-01-11 19:56 --------- d-----w c:\program files\DU Meter 2009-01-11 19:56 --------- d-----w c:\documents and settings\N\Dane aplikacji\Hagel Technologies 2009-01-11 19:56 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\Hagel Technologies 2009-01-10 19:19 --------- d-----w c:\documents and settings\N\Dane aplikacji\dvdcss 2009-01-07 17:58 --------- d-----w c:\program files\Trend Micro 2008-12-31 12:49 315,392 ----a-w c:\windows\HideWin.exe 2008-12-29 13:01 921,600 ----a-w c:\windows\system32\vorbisenc.dll 2008-12-29 13:01 892,928 ----a-w c:\windows\system32\iconv.dll 2008-12-29 13:01 237,568 ----a-w c:\windows\system32\OggDS.dll 2008-12-29 13:00 9,216 ----a-w c:\windows\system32\cpuinf32.dll 2008-12-29 13:00 795,648 ----a-w c:\windows\system32\xvidcore.dll 2008-12-29 13:00 45,056 ----a-w c:\windows\system32\ogg.dll 2008-12-29 13:00 245,760 ----a-w c:\windows\system32\mplvpx.dll 2008-12-29 13:00 188,416 ----a-w c:\windows\system32\vorbis.dll 2008-12-29 13:00 1,415,680 ----a-w c:\windows\system32\WMV9VCM.dll 2008-12-29 12:59 130,048 ----a-w c:\windows\system32\xvidvfw.dll 2008-12-17 19:42 410,984 ----a-w c:\windows\system32\deploytk.dll . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks] "{930f1200-f5f1-4870-bac6-e233ec8e7023}"= "c:\program files\Softonic_English\tbSof1.dll" [2009-02-11 1881112] [HKEY_CLASSES_ROOT\clsid\{930f1200-f5f1-4870-bac6-e233ec8e7023}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{930f1200-f5f1-4870-bac6-e233ec8e7023}] 2009-02-11 16:58 1881112 --a------ c:\program files\Softonic_English\tbSof1.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar] "{930f1200-f5f1-4870-bac6-e233ec8e7023}"= "c:\program files\Softonic_English\tbSof1.dll" [2009-02-11 1881112] [HKEY_CLASSES_ROOT\clsid\{930f1200-f5f1-4870-bac6-e233ec8e7023}] [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser] "{930F1200-F5F1-4870-BAC6-E233EC8E7023}"= "c:\program files\Softonic_English\tbSof1.dll" [2009-02-11 1881112] [HKEY_CLASSES_ROOT\clsid\{930f1200-f5f1-4870-bac6-e233ec8e7023}] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2004-08-03 15360] "Gadu-Gadu"="c:\program files\Gadu-Gadu\gg.exe" [2007-07-09 2119104] "ExprOElauncher"="c:\program files\ivo\Expressivo Demo\integr\OutlookExpress\ExprOElauncher.exe" [2008-09-24 86016] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2004-05-14 81920] "egui"="c:\program files\ESET\ESET Smart Security\egui.exe" [2007-12-21 1443072] "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2008-12-17 136600] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2004-05-14 3784704] "DU Meter"="c:\program files\DU Meter\DUMeter.exe" [2006-11-27 1582616] "TweakMASTER"="c:\program files\TweakMASTER\TMTray.exe" [2006-11-27 284712] "ProcessSupervisorGUI"="c:\program files\Process Lasso\processlasso.exe" [2008-12-18 313872] "ProcessGovernor"="c:\program files\Process Lasso\processgovernor.exe" [2008-12-18 131088] "GammaAdjuster"="c:\gamaa adjuster\GammaAdjuster.exe" [2003-02-21 191488] "SoundMan"="SOUNDMAN.EXE" [2007-04-16 c:\windows\soundman.exe] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-03 15360] c:\documents and settings\Nikola\Menu Start\Programy\Autostart\ OpenOffice.ux.pl 2.1.0.lnk - c:\program files\OpenOffice.ux.pl 2.1.0\program\quickstart.exe [2006-12-30 17408] c:\documents and settings\N\Menu Start\Programy\Autostart\ OpenOffice.ux.pl 2.1.0.lnk - c:\program files\OpenOffice.ux.pl 2.1.0\program\quickstart.exe [2006-12-30 17408] c:\documents and settings\All Users\Menu Start\Programy\Autostart\ Ralink Wireless Utility.lnk - c:\program files\RALINK\Common\RaUI.exe [2008-12-17 614400] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ares] --a------ 2008-12-17 03:08 887808 c:\program files\Ares\Ares.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite] --a------ 2008-12-10 10:02 216520 c:\program files\DAEMON Tools Lite\daemon.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Expressivo] --a------ 2009-02-12 18:38 1257472 c:\program files\ivo\Expressivo Demo\expressivo.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Gadu-Gadu] --a------ 2007-07-09 08:39 2119104 c:\program files\Gadu-Gadu\gg.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GammaAdjuster] --a------ 2003-02-21 11:46 191488 c:\gamaa adjuster\GammaAdjuster.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype] -ra------ 2009-02-04 12:27 23975720 c:\program files\Skype\Phone\Skype.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz] -ra------ 2004-05-14 06:41 831488 c:\windows\system32\nwiz.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan] --a------ 2007-04-16 15:28 577536 c:\windows\soundman.exe [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\Metin2_PL\\metin2.bin"= "c:\\Program Files\\Gadu-Gadu\\gg.exe"= "c:\\Program Files\\Ares\\Ares.exe"= "c:\\Program Files\\Valve\\hl.exe"= "c:\\Program Files\\Skype\\Phone\\Skype.exe"= R2 ekrn;Eset Service;c:\program files\ESET\ESET Smart Security\ekrn.exe [2007-12-21 468224] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{840798c2-cc60-11dd-801a-806d6172696f}] \Shell\AutoRun\command - d:\autorun\AUTORUN.EXE . . ------- Skan uzupełniający ------- . uStart Page = about:blank IE: Add to &LinkFox - c:\progra~1\TWEAKM~1\TweakBHO.dll/IESCRIPT TCP: {C120C1C0-0106-48F2-B10C-BF5CCAA5BCB0} = 208.67.222.222,208.67.220.220 . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-03-06 13:12:47 Windows 5.1.2600 Dodatek Service Pack 2 NTFS skanowanie ukrytych procesów ... skanowanie ukrytych wpisów autostartu ... skanowanie ukrytych plików ... skanowanie pomyślnie ukończone ukryte pliki: 0 ************************************************************************** . Czas ukończenia: 2009-03-06 13:13:42 ComboFix-quarantined-files.txt 2009-03-06 12:13:40 Przed: 105 577 607 168 bajtów wolnych Po: 105,632,231,424 bajtów wolnych 162 --- E O F --- 2009-01-13 13:16:42

**Posty:** 18165 · przez **wojtas** 06 Mar 2009, 18:59

1. Ściągnij OTMoveIt i go włacz i odpal go z opcji CleanUp

oraz skasuj folder C:\Qoobox
2. wykonaj optymalizację windowsa
3.sciagnij ATF_Cleaner
zaznacz
Windows Temp
All users Temp
Temporary internet files
Recycle Bin
i wcisnij EMPTY SELECTED
4.Wyłącz przywracanie systemu ( właściwości mój komputer-zakładka przywracanie - wyłącz przywracanie na wszystkich dyskach). Po chwili włącz je powrotem
5. Wykonaj skan Dr. Web CureIt
6. Przeskanuj obszar mojego komputera http://www.kaspersky.pl/virusscanner.html (uruchom przez IE) Daj raport z niego na forum.

i tym:

FixIEDef.

**Posty:** 110 · przez **cnx1234** 06 Mar 2009, 22:00

jak przeskanowalem Dr. Web CureIt to nie bylo zadnych wirow a tak wogle to juz robilem to kilka razy. moj komp szybko chodzi i jest dobrze ale z netem mam problem najwiekszy wiec nie ma wirow to jaki powod jak u mojego brata jest dobrze ?
a najgorzej to jest po poludniu do 21 np wiec prosze o rade.

**Posty:** 18165 · przez **wojtas** 07 Mar 2009, 18:27

zadzwoń do providera internetoweg

Czeste lagi [log]

Czeste lagi [log]

Czeste lagi [log]

Re: czeste lagi [log]

Czeste lagi [log]

Re: czeste lagi [log]

Czeste lagi [log]

Re: czeste lagi [log]

Czeste lagi [log]

Kto jest na forum