długo uruchamia się plik wlnotify.dll

**Posty:** 43 · przez **pasta271** 03 Maj 2008, 10:00

Witam!
Długo ładuję się plik wlnotify.dll przy starcie systemu.

Logfile of Trend Micro HijackThis v2.0.2

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 09:56:42, on 2008-05-03 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16640) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Creative\SBAudigy2\Surround Mixer\CTSysVol.exe C:\WINDOWS\system32\oodtray.exe C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe C:\WINDOWS\system32\ctfmon.exe E:\_program no install\HijackThis v2.0.2\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = res://C:\Program Files\IEPro\IEProRs.dll/easyhome.html R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: IE7Pro - {00011268-E188-40DF-A514-835FCD78B1BF} - C:\Program Files\IEPro\iepro.dll O2 - BHO: flashget urlcatch - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\Program Files\FlashGet\jccatch.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O2 - BHO: FlashGet GetFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\Program Files\FlashGet\getflash.dll O4 - HKLM\..\Run: [CTSysVol] "C:\Program Files\Creative\SBAudigy2\Surround Mixer\CTSysVol.exe" O4 - HKLM\..\Run: [SBDrvDet] "C:\Program Files\Creative\SB Drive Det\SBDrvDet.exe" /r O4 - HKLM\..\Run: [OODefragTray] C:\WINDOWS\system32\oodtray.exe O4 - HKLM\..\Run: [NodLogin] "C:\Program Files\ESET\ESET NOD32 Antivirus\nodlogin.exe" /o O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-19\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-20\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'Default user') O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O8 - Extra context menu item: &Ściągnij przy pomocy FlashGet'a - C:\Program Files\FlashGet\jc_link.htm O8 - Extra context menu item: &Ściągnij wszystko przy pomocy FlashGet'a - C:\Program Files\FlashGet\jc_all.htm O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: IE7Pro Preferences - {0026439F-A980-4f18-8C95-4F1CBBF9C1D8} - C:\Program Files\IEPro\iepro.dll O9 - Extra 'Tools' menuitem: IE7Pro Preferences - {0026439F-A980-4f18-8C95-4F1CBBF9C1D8} - C:\Program Files\IEPro\iepro.dll O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1206193659760 O17 - HKLM\System\CCS\Services\Tcpip\..\{40D44716-33E2-49AE-AF50-D196E1716F6F}: NameServer = 217.96.107.2,194.204.159.1 O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe O23 - Service: O&O Defrag - O&O Software GmbH - C:\WINDOWS\system32\oodag.exe -- End of file - 6033 bytes

**Posty:** 18165 · przez **wojtas** 03 Maj 2008, 14:24

Wykonaj to co jest podane w tym temacie

Zastosuj SDFix . Po pobraniu uruchom go a rozpakuje się do C:\SDFix. Uruchom komputer w trybie awaryjnym (F8 przy stracie systemu). Będąc w awaryjnym uruchom plik RunThis.bat z folderu SDFixa. Zatwierdź czyszczenie przez Y. Poczekaj aż ukończy i komputer zresetuje

Potem wejdz do folderu C:\SDFix wrzuc zawartość pliku Report.txt + log z combofixa

**Posty:** 43 · przez **pasta271** 03 Maj 2008, 16:48

Log z SDFix v1.178:

Kod: Zaznacz wszystko: [b]SDFix: Version 1.178 [/b] Run by usr on 2008-05-03 at 16:07 Microsoft Windows XP [Wersja 5.1.2600] Running From: C:\SDFix [b]Checking Services [/b]: Restoring Windows Registry Values Restoring Windows Default Hosts File Rebooting [b]Checking Files [/b]: No Trojan Files Found Removing Temp Files [b]ADS Check [/b]: [b]Final Check [/b]: catchme 0.3.1353.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-05-03 16:13:31 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... scanning hidden services & system hive ... [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg] "s1"=dword:2df9c43f "s2"=dword:110480d0 "h0"=dword:00000001 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4] "p0"="C:\Program Files\DAEMON Tools Lite\" "h0"=dword:00000000 "khjeh"=hex:19,99,f7,3e,90,2e,70,5b,cd,71,59,f7,7b,50,ff,70,92,be,2e,7f,cb,.. [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001] "a0"=hex:20,01,00,00,97,a4,70,4e,4d,c0,99,45,63,9b,a6,6a,49,de,5f,b3,49,.. "khjeh"=hex:73,45,c8,bf,c2,8e,77,42,ce,4c,12,e4,33,24,4e,3b,79,ea,3b,cf,4a,.. [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40] "khjeh"=hex:d8,bd,e4,c1,86,9d,be,39,1e,f8,39,42,1d,37,16,fa,f4,29,fa,ea,c6,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4] "p0"="C:\Program Files\DAEMON Tools Lite\" "h0"=dword:00000000 "khjeh"=hex:19,99,f7,3e,90,2e,70,5b,cd,71,59,f7,7b,50,ff,70,92,be,2e,7f,cb,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001] "a0"=hex:20,01,00,00,97,a4,70,4e,4d,c0,99,45,63,9b,a6,6a,49,de,5f,b3,49,.. "khjeh"=hex:73,45,c8,bf,c2,8e,77,42,ce,4c,12,e4,33,24,4e,3b,79,ea,3b,cf,4a,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40] "khjeh"=hex:d8,bd,e4,c1,86,9d,be,39,1e,f8,39,42,1d,37,16,fa,f4,29,fa,ea,c6,.. scanning hidden registry entries ... [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\System]0 hidden processes: 0 hidden services: 0 hidden files: 0 [b]Remaining Services [/b]: Authorized Application Key Export: [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] "%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000" "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "C:\\Program Files\\IEPro\\MiniDM.exe"="C:\\Program Files\\IEPro\\MiniDM.exe:*:Enabled:MiniDM" [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list] "%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000" "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" [b]Remaining Files [/b]: File Backups: - C:\SDFix\backups\backups.zip [b]Files with Hidden Attributes [/b]: Mon 24 Mar 2008 56 ..SHR --- "C:\WINDOWS\system32\262DACA6DF.sys" Mon 24 Mar 2008 3,714 A.SH. --- "C:\WINDOWS\system32\KGyGaAvL.sys" [b]Finished![/b]

log z ComboFix:

Kod: Zaznacz wszystko: ComboFix 08-05-01.3 - usr 2008-05-03 16:18:38.1 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.104 [GMT 2:00] Running from: E:\software\_Spyware\ComboFix.exe * Created a new restore point * Resident AV is active [color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color] . ((((((((((((((((((((((((( Files Created from 2008-04-03 to 2008-05-03 ))))))))))))))))))))))))))))))) . 2008-05-03 16:05 . 2008-05-03 16:05 <DIR> d-------- C:\WINDOWS\ERUNT 2008-05-03 16:01 . 2008-05-03 16:15 <DIR> d-------- C:\SDFix 2008-05-02 09:35 . 2008-05-02 09:43 <DIR> d-------- C:\Program Files\RegCure 2008-05-02 09:00 . 2008-05-02 09:00 <DIR> d-------- C:\Program Files\IEPro 2008-05-02 09:00 . 2008-05-02 09:00 <DIR> d-------- C:\Documents and Settings\usr\Dane aplikacji\IEPro 2008-05-02 00:35 . 2008-05-02 00:35 <DIR> d-------- C:\Program Files\Uniblue 2008-05-02 00:35 . 2008-05-02 00:35 <DIR> d-------- C:\Documents and Settings\usr\Dane aplikacji\Uniblue 2008-05-01 14:08 . 2008-05-01 14:08 <DIR> d-------- C:\Program Files\ESET 2008-05-01 13:51 . 2008-05-01 13:51 <DIR> d-------- C:\Program Files\ffdshow 2008-05-01 13:51 . 2008-04-21 15:00 60,273 --a------ C:\WINDOWS\system32\pthreadGC2.dll 2008-05-01 13:51 . 2008-04-21 15:00 7,680 --a------ C:\WINDOWS\system32\ff_vfw.dll 2008-05-01 13:51 . 2008-04-21 15:00 547 --a------ C:\WINDOWS\system32\ff_vfw.dll.manifest 2008-05-01 13:44 . 2008-05-01 13:46 <DIR> d-------- C:\Documents and Settings\usr\Dane aplikacji\PrevxCSI 2008-05-01 13:19 . 2008-05-01 13:20 <DIR> d-------- C:\Program Files\Nero 2008-05-01 13:19 . 2008-05-01 13:19 <DIR> d-------- C:\Program Files\Common Files\Nero 2008-05-01 13:19 . 2008-05-01 13:19 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Nero 2008-05-01 13:19 . 2006-03-17 11:45 1,757,184 --a------ C:\WINDOWS\system32\imagX7.dll 2008-05-01 13:19 . 2006-03-17 11:45 802,816 --a------ C:\WINDOWS\system32\imagXRA7.dll 2008-05-01 13:19 . 2006-03-17 11:45 497,296 --a------ C:\WINDOWS\system32\imagXpr7.dll 2008-05-01 13:19 . 2006-03-17 14:49 368,640 --a------ C:\WINDOWS\system32\TwnLib4.dll 2008-05-01 13:19 . 2006-03-17 11:45 258,048 --a------ C:\WINDOWS\system32\imagXR7.dll 2008-05-01 13:05 . 2008-05-02 14:03 <DIR> d-------- C:\Program Files\SpeedFan 2008-05-01 11:45 . 2008-05-01 11:45 <DIR> d-------- C:\Documents and Settings\usr\Dane aplikacji\vlc 2008-05-01 11:36 . 2008-05-01 11:36 <DIR> d-------- C:\Program Files\Foxit Software 2008-05-01 10:41 . 2008-05-01 10:41 <DIR> d-------- C:\Program Files\Zards software 2008-04-20 12:18 . 2008-04-20 12:18 54,156 --ah----- C:\WINDOWS\QTFont.qfn 2008-04-20 12:18 . 2008-04-20 12:18 1,409 --a------ C:\WINDOWS\QTFont.for 2008-04-03 19:59 . 2008-04-30 22:05 <DIR> d-------- C:\Program Files\bwin . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-05-03 13:46 --------- d-----w C:\Documents and Settings\usr\Dane aplikacji\Azureus 2008-05-03 13:37 --------- d-----w C:\Documents and Settings\usr\Dane aplikacji\foobar2000 2008-05-01 18:16 --------- d-----w C:\Documents and Settings\usr\Dane aplikacji\Hamachi 2008-05-01 13:56 --------- d-----w C:\Documents and Settings\usr\Dane aplikacji\Skype 2008-05-01 12:36 --------- d-----w C:\Program Files\CoreCodec 2008-05-01 12:07 --------- d-----w C:\Program Files\totalcmd 2008-05-01 12:00 --------- d-----w C:\Program Files\Azureus 2008-05-01 11:16 --------- d-----w C:\Program Files\Gadu-Gadu 2008-05-01 11:10 --------- d-----w C:\Program Files\Real Alternative 2008-05-01 11:10 --------- d-----w C:\Program Files\QuickTime Alternative 2008-05-01 09:35 --------- d-----w C:\Program Files\foobar2000 2008-05-01 08:44 --------- d-----w C:\Program Files\Common Files\Adobe 2008-04-30 17:17 --------- d-----w C:\Program Files\Betsson Poker 2008-04-24 17:35 --------- d-----w C:\Documents and Settings\usr\Dane aplikacji\skypePM 2008-03-29 18:22 --------- d-----w C:\Program Files\FlashGet 2008-03-24 17:08 --------- d-----w C:\Program Files\Common Files\Corel 2008-03-24 13:08 --------- d---a-w C:\Documents and Settings\All Users\Dane aplikacji\TEMP 2008-03-24 13:07 --------- d-----w C:\Documents and Settings\usr\Dane aplikacji\Gadu-Gadu 2008-03-24 11:53 3,714 --sha-w C:\WINDOWS\system32\KGyGaAvL.sys 2008-03-24 11:50 --------- d-----w C:\Documents and Settings\usr\Dane aplikacji\Corel 2008-03-24 11:48 --------- d-----w C:\Program Files\Common Files\InstallShield 2008-03-24 11:48 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\InstallShield 2008-03-24 11:33 --------- d-----w C:\Program Files\MagicISO 2008-03-23 16:08 2,208 ----a-w C:\WINDOWS\system32\drivers\nxsIO32.sys 2008-03-23 12:14 32 ----a-w C:\Documents and Settings\All Users\Dane aplikacji\ezsid.dat 2008-03-23 12:10 --------- d-----w C:\Program Files\Skype 2008-03-23 12:10 --------- d-----w C:\Program Files\Common Files\Skype 2008-03-23 12:10 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Skype 2008-03-23 10:54 --------- d-----w C:\Program Files\Microsoft.NET 2008-03-22 23:30 --------- d-----w C:\Program Files\DAEMON Tools Lite 2008-03-22 23:27 717,296 ----a-w C:\WINDOWS\system32\drivers\sptd.sys 2008-03-22 23:27 --------- d-----w C:\Documents and Settings\usr\Dane aplikacji\DAEMON Tools 2008-03-22 23:17 --------- d-----w C:\Documents and Settings\usr\Dane aplikacji\Media Player Classic 2008-03-22 23:08 --------- d-----w C:\Program Files\VideoLAN 2008-03-22 23:06 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Apple Computer 2008-03-22 22:53 --------- d-----w C:\Program Files\Paint.NET 2008-03-22 22:46 --------- d-----w C:\Program Files\ImageShack 2008-03-22 22:43 --------- d-----w C:\Program Files\Hamachi 2008-03-22 22:42 25,280 ----a-w C:\WINDOWS\system32\drivers\hamachi.sys 2008-03-22 22:30 --------- d-----w C:\Program Files\Auslogics 2008-03-22 22:30 --------- d-----w C:\Documents and Settings\usr\Dane aplikacji\Auslogics 2008-03-22 22:29 --------- d-----w C:\Program Files\Atomic Clock Sync 2008-03-22 22:14 --------- d-----w C:\Program Files\OO Software 2008-03-22 22:12 --------- d-----w C:\Documents and Settings\usr\Dane aplikacji\Nero 2008-03-22 22:05 --------- d-----w C:\Program Files\CDCheck 2008-03-22 21:54 --------- d-----w C:\Program Files\Common Files\Adobe Systems Shared 2008-03-22 21:27 --------- d-----w C:\Program Files\Common Files\ACD Systems 2008-03-22 21:27 --------- d-----w C:\Program Files\ACD Systems 2008-03-22 21:27 --------- d-----w C:\Documents and Settings\usr\Dane aplikacji\ACD Systems 2008-03-22 21:27 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\ACD Systems 2008-03-22 21:19 --------- d-----w C:\Program Files\DAMN NFO Viewer 2008-03-22 21:15 --------- d-----w C:\Program Files\QuickPar 2008-03-22 21:14 --------- d-----w C:\Program Files\hkSFV 2008-03-22 21:12 --------- d-----w C:\Program Files\7-Zip 2008-03-22 21:09 --------- d-----w C:\Documents and Settings\usr\Dane aplikacji\Grisoft 2008-03-22 21:08 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Grisoft 2008-03-22 20:55 --------- d-----w C:\Program Files\OpenSource MPEG2 Video Decoder 2008-03-22 20:54 --------- d-----w C:\Program Files\Haali 2008-03-22 20:51 --------- d-----w C:\Program Files\AC3Filter 2008-03-22 19:43 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Azureus 2008-03-22 19:13 --------- d-----w C:\Program Files\Java 2008-03-22 19:11 --------- d-----w C:\Program Files\Common Files\Java 2008-03-22 18:53 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\ESET 2008-03-22 17:57 --------- d-----w C:\Program Files\MSXML 4.0 2008-03-22 17:45 --------- d-----w C:\Program Files\MSXML 6.0 2008-03-22 13:14 86,016 ----a-w C:\WINDOWS\system32\OpenAL32.dll 2008-03-22 13:14 409,600 ----a-w C:\WINDOWS\system32\wrap_oal.dll 2008-03-22 13:14 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-03-22 13:14 --------- d-----w C:\Program Files\Creative 2008-03-22 13:14 --------- d-----w C:\Documents and Settings\usr\Dane aplikacji\Creative 2008-03-22 13:03 --------- d-----w C:\Program Files\Hewlett-Packard 2008-03-22 13:02 --------- d-----w C:\Program Files\HP 2008-03-22 12:02 --------- d-----w C:\Program Files\microsoft frontpage 2008-03-22 10:11 1,548,288 ----a-w C:\WINDOWS\system32\sfcfiles.dll 2008-03-22 10:06 86,073 ----a-w C:\WINDOWS\system32\usrfaxa.dll 2008-03-22 09:47 360,832 ----a-w C:\WINDOWS\system32\drivers\tcpip.sys 2008-03-22 09:43 991,744 ----a-w C:\WINDOWS\system32\syssetup.dll 2008-03-22 09:43 729,088 ----a-w C:\WINDOWS\system32\lsasrv.dll 2008-03-22 09:43 20,480 ----a-w C:\WINDOWS\system32\drivers\secdrv.sys 2008-03-22 09:43 179,712 ----a-w C:\WINDOWS\system32\drivers\mrxdav.sys 2008-03-22 09:41 551,936 ----a-w C:\WINDOWS\system32\oleaut32.dll 2008-03-22 09:40 683,520 ----a-w C:\WINDOWS\system32\inetcomm.dll 2008-03-22 09:40 1,291,264 ----a-w C:\WINDOWS\system32\quartz.dll 2008-03-22 09:39 512,000 ----a-w C:\WINDOWS\system32\mqutil.dll 2008-03-22 09:39 1,034,752 ----a-w C:\WINDOWS\explorer.exe 2008-03-22 09:38 95,744 ----a-w C:\WINDOWS\system32\mqsec.dll 2008-03-22 09:38 72,960 ----a-w C:\WINDOWS\system32\drivers\mqac.sys 2008-03-22 09:38 660,992 ----a-w C:\WINDOWS\system32\mqqm.dll 2008-03-22 09:38 48,640 ----a-w C:\WINDOWS\system32\mqupgrd.dll 2008-03-22 09:38 47,104 ----a-w C:\WINDOWS\system32\mqdscli.dll 2008-03-22 09:38 177,152 ----a-w C:\WINDOWS\system32\mqrt.dll 2008-03-22 09:38 16,896 ----a-w C:\WINDOWS\system32\mqise.dll 2008-03-22 09:38 138,240 ----a-w C:\WINDOWS\system32\mqad.dll 2008-03-22 09:37 582,656 ----a-w C:\WINDOWS\system32\rpcrt4.dll 2008-03-22 09:37 364,160 ----a-w C:\WINDOWS\system32\drivers\update.sys 2008-03-22 09:37 144,896 ----a-w C:\WINDOWS\system32\schannel.dll 2008-03-22 09:37 1,104,896 ----a-w C:\WINDOWS\system32\msxml3.dll 2008-03-22 09:36 2,183,424 ----a-w C:\WINDOWS\system32\ntoskrnl.exe 2008-03-22 09:35 293,376 ----a-w C:\WINDOWS\system32\winsrv.dll 2008-03-22 09:32 2,854,400 ----a-w C:\WINDOWS\system32\msi.dll . ------- Sigcheck ------- 2008-03-22 11:47 360832 64af914216535bc450f85253462d6f24 C:\WINDOWS\system32\drivers\tcpip.sys . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 01:44 15360] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTSysVol"="C:\Program Files\Creative\SBAudigy2\Surround Mixer\CTSysVol.exe" [2002-10-29 06:48 49152] "SBDrvDet"="C:\Program Files\Creative\SB Drive Det\SBDrvDet.exe" [2002-12-03 15:36 45056] "OODefragTray"="C:\WINDOWS\system32\oodtray.exe" [2007-05-11 03:08 2512392] "NodLogin"="C:\Program Files\ESET\ESET NOD32 Antivirus\nodlogin.exe" [2008-04-11 08:47 299804] "egui"="C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" [2008-03-13 16:48 1443072] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 01:44 15360] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce] "nltide_3"="advpack.dll" [2008-03-01 15:02 124928 C:\WINDOWS\system32\advpack.dll] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "DisableStatusMessages"= 0 (0x0) [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer] "NoDesktopCleanupWizard"= 1 (0x1) [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] "NoSMHelp"= 1 (0x1) "ForceClassicControlPanel"= 1 (0x1) "ForceStartMenuLogoff"= 0 (0x0) [HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer] "NoSMHelp"= 1 (0x1) "ForceClassicControlPanel"= 1 (0x1) "StartMenuLogoff"= 1 (0x1) "ForceStartMenuLogoff"= 0 (0x0) [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "msacm.ac3filter"= ac3filter.acm "VIDC.ACDV"= ACDV.dll [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "%windir%\\system32\\sessmgr.exe"= "C:\\Program Files\\IEPro\\MiniDM.exe"= R1 epfwtdir;epfwtdir;C:\WINDOWS\system32\DRIVERS\epfwtdir.sys [2008-03-13 16:52] R2 nxsIO32;NextSensor Kernel I/O Driver;C:\WINDOWS\System32\DRIVERS\nxsIO32.sys [2008-03-23 18:08] R3 ctgame;Game Port;C:\WINDOWS\system32\DRIVERS\ctgame.sys [2002-12-30 08:23] S3 usbscan;Sterownik skanera USB;C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-03 22:58] S3 USBSTOR;Sterownik magazynu masowego USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-03 23:08] . Contents of the 'Scheduled Tasks' folder "2008-05-02 07:35:23 C:\WINDOWS\Tasks\RegCure Program Check.job" - C:\Program Files\RegCure\RegCure.exe "2008-05-02 07:35:23 C:\WINDOWS\Tasks\RegCure.job" - C:\Program Files\RegCure\RegCure.exe . ************************************************************************** catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-05-03 16:20:30 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2008-05-03 16:23:21 ComboFix-quarantined-files.txt 2008-05-03 14:22:41 Pre-Run: 2,157,469,696 bajtów wolnych Post-Run: 2,141,057,024 bajtów wolnych 210

**Posty:** 18165 · przez **wojtas** 03 Maj 2008, 20:31

1. Ściągnij OTMoveIt i go włacz i odpal go z opcji CleanUp

2. wykonaj optymalizację windowsa
3.sciagnij ATF_Cleaner
zaznacz
Windows Temp
All users Temp
Temporary internet files
Recycle Bin
i wcisnij EMPTY SELECTED
4.Wyłącz przywracanie systemu ( właściwości mój komputer-zakładka przywracanie - wyłącz przywracanie na wszystkich dyskach). Po chwili włącz je powrotem

**Posty:** 43 · przez **pasta271** 03 Maj 2008, 21:40

Witam!
Nadal długo uruchamia się plik wlnotify.dll.

**Posty:** 7956 · przez **Magik** 03 Maj 2008, 23:40

pasta271 napisał(a):wlnotify.dll.

To jest biblioteka obslugujaca logowanie, on tutaj jest glowna przyczyna.

Przywracanie systemu??

Start :arrow:

uruchom

regedit

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system :arrow:

VerboseStatus ma miec wartość 1

jesli nie ma utworz nowa wartosc Dword i nadaj jej wartosc 1

Wsio

**Posty:** 43 · przez **pasta271** 04 Maj 2008, 08:36

Ma wartość 1

**Posty:** 7956 · przez **Magik** 04 Maj 2008, 14:34

Ma wartość 1

hmm......prawie godzinke lookalem na technet i googlegroups.....Coz moge rzec: 2 opcje
:arrow:

jesli uzywasz zonealarm odinstaluj go, on powodowal takie wlasnie cyrki
:arrow:

usun ten plik w trybie awaryjnym.......czas logowania wroci do normy, bedzie sie ejdnak pojawial za akzdym razem po wlaczeniu komunikat nt. sieci

Kilkadzieisiat topickow z zagranicy przerzucilem, tam ludzie tez nie maja wiecej pomyslow
D!

**Posty:** 43 · przez **pasta271** 04 Maj 2008, 19:24

Wielkie dzięki

długo uruchamia się plik wlnotify.dll

długo uruchamia się plik wlnotify.dll

Kto jest na forum