dziwne zachowanie systemu

**Posty:** 52 · przez **rav2000** 14 Mar 2007, 08:35

Witam.
Mam dziwny problem od kilku dni.
Zaczęło się od jakiegoś błędu który wyskoczył, niestety nie umie powtorzyc co to za proces go wygenerował. Chwilę po tym wywaliło mi komunikat, że jakiś kolejny proces zainicjował restart komputera pojawił sie licznik sekund i jak zeszło do zera to sie faktycznie komp zrestartował. Po tym restarcie niby wszystko było ok. Zostawiłem komp włączony na noc, a rano gdy chciałem go wyłączyć to mi wywaliło komunikat że nie mam uprawnien do zamknięcia systemu. Zrestartowałem go na twardo i niby wszystko działa ale wywala mi co jakiś czas neta i muszę modem restartować, żeby spowrotem zaskoczyło - nigdy wcześniej sie tak nie działo.
Proszę bardzo o poradę co powinienem zrobić z tym fantem.
Pracuję na win 2000.
Pozdrawiam.
hijack:

Kod: Zaznacz wszystko: Logfile of HijackThis v1.99.1 Scan saved at 07:29:06, on 2007-03-14 Platform: Windows 2000 (WinNT 5.00.2195) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINNT\System32\smss.exe C:\WINNT\system32\winlogon.exe C:\WINNT\system32\services.exe C:\WINNT\system32\lsass.exe C:\WINNT\system32\svchost.exe C:\WINNT\system32\LEXBCES.EXE C:\WINNT\system32\spoolsv.exe C:\WINNT\system32\LEXPPS.EXE C:\WINNT\msnmessangern.exe C:\WINNT\System32\svchost.exe C:\Program Files\ewido anti-malware\ewidoctrl.exe C:\Program Files\Ahead\InCD\InCDsrv.exe C:\Program Files\Common Files\LightScribe\LSSrvc.exe C:\WINNT\System32\dllcache\qxchost.exe C:\WINNT\System32\nvsvc32.exe C:\WINNT\system32\regsvc.exe C:\WINNT\system32\MSTask.exe C:\WINNT\system32\stisvc.exe C:\WINNT\System32\WBEM\WinMgmt.exe C:\WINNT\explorer.exe C:\WINNT\System32\mspmspsv.exe C:\Program Files\WinFast\WFTVFM\WFWIZ.exe C:\WINNT\System32\WF2K.EXE C:\WINNT\System32\spool\DRIVERS\W32X86\2\printray.exe C:\Program Files\QuickTime\qttask.exe C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe C:\Program Files\Ahead\InCD\InCD.exe C:\Program Files\lg_fwupdate\fwupdate.exe C:\WINNT\System32\internat.exe C:\Program Files\File Sharing Revolution\Shareaza.exe C:\Program Files\Internet Explorer\iexplore.exe C:\WINNT\System32\WScript.exe E:\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.onet.pl/ R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx O4 - HKLM\..\Run: [WinFast Schedule] C:\Program Files\WinFast\WFTVFM\WFWIZ.exe O4 - HKLM\..\Run: [WinFoxV2] C:\WINNT\System32\WF2K.EXE O4 - HKLM\..\Run: [WinFast2KLoadDefault] rundll32.exe wf2kcpl.dll,DllLoadDefaultSettings O4 - HKLM\..\Run: [PrinTray] C:\WINNT\System32\spool\DRIVERS\W32X86\2\printray.exe O4 - HKLM\..\Run: [Resume copy] copyfstq.exe /startup O4 - HKLM\..\Run: [CloneCDTray] "C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe" /s O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINNT\system32\NeroCheck.exe O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe" O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe O4 - HKLM\..\Run: [LGODDFU] "C:\Program Files\lg_fwupdate\fwupdate.exe" blrun O4 - HKCU\..\Run: [internat.exe] internat.exe O4 - HKCU\..\Run: [Shareaza] "C:\Program Files\File Sharing Revolution\Shareaza.exe" -tray O4 - HKCU\..\Run: [NBJ] "C:\Program Files\Ahead\Nero BackItUp\NBJ.exe" O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE O4 - Global Startup: Przyspieszenie uruchomienia programu AutoCAD.lnk = C:\Program Files\Common Files\Autodesk Shared\acstart16.exe O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar2.dll/cmsearch.html O8 - Extra context menu item: Backward &Links - res://C:\Program Files\Google\GoogleToolbar2.dll/cmbacklinks.html O8 - Extra context menu item: Cac&hed Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar2.dll/cmcache.html O8 - Extra context menu item: Si&milar Pages - res://C:\Program Files\Google\GoogleToolbar2.dll/cmsimilar.html O8 - Extra context menu item: Translate into English - res://C:\Program Files\Google\GoogleToolbar2.dll/cmtrans.html O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://download.ewido.net/ewidoOnlineScan.cab O23 - Service: antivirusdll - Unknown owner - C:\WINNT\msnmessangern.exe O23 - Service: Autodesk Licensing Service - Autodesk, Inc. - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe O23 - Service: Usługa administracyjna Menedżera dysków logicznych (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Ahead\InCD\InCDsrv.exe O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINNT\system32\LEXBCES.EXE O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe O23 - Service: Microsoft Agent - Unknown owner - C:\WINNT\System32\dllcache\qxchost.exe O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINNT\System32\nvsvc32.exe

silent:

Kod: Zaznacz wszystko: "Silent Runners.vbs", revision 45, http://www.silentrunners.org/ Operating System: Windows 2000 Output limited to non-default values, except where indicated by "{++}" Startup items buried in registry: --------------------------------- HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++} "internat.exe" = "internat.exe" [MS] "Shareaza" = ""C:\Program Files\File Sharing Revolution\Shareaza.exe" -tray" ["Shareaza Development Team"] "NBJ" = ""C:\Program Files\Ahead\Nero BackItUp\NBJ.exe"" ["Ahead Software AG"] "Skype" = ""C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized" ["Skype Technologies S.A."] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++} "WinFast Schedule" = "C:\Program Files\WinFast\WFTVFM\WFWIZ.exe" ["Leadtek Research Inc."] "WinFoxV2" = "C:\WINNT\System32\WF2K.EXE" ["Leadtek Research Inc."] "WinFast2KLoadDefault" = "rundll32.exe wf2kcpl.dll,DllLoadDefaultSettings" [MS] "PrinTray" = "C:\WINNT\System32\spool\DRIVERS\W32X86\2\printray.exe" ["Lexmark"] "Resume copy" = "copyfstq.exe /startup" [null data] "CloneCDTray" = ""C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe" /s" ["SlySoft, Inc."] "NeroFilterCheck" = "C:\WINNT\system32\NeroCheck.exe" ["Ahead Software Gmbh"] "Synchronization Manager" = "mobsync.exe /logon" [MS] "QuickTime Task" = ""C:\Program Files\QuickTime\qttask.exe" -atboottime" ["Apple Computer, Inc."] "RemoteControl" = ""C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe"" ["Cyberlink Corp."] "InCD" = "C:\Program Files\Ahead\InCD\InCD.exe" ["Nero AG"] "LGODDFU" = ""C:\Program Files\lg_fwupdate\fwupdate.exe" blrun" [null data] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx\ {++} "Flag" = 2 HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\(Default) = (no title provided) -> {HKLM...CLSID} = "AcroIEHlprObj Class" \InProcServer32\(Default) = "C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx" [empty string] {AA58ED58-01DD-4d91-8333-CF10577473F7}\(Default) = (no title provided) -> {HKLM...CLSID} = "Google Toolbar Helper" \InProcServer32\(Default) = "c:\program files\google\googletoolbar2.dll" ["Google Inc."] HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\ "{CCA60260-A2C9-11D2-BA62-0020188191B2}" = "Registrar Registry Manager SHell Extension" -> {HKLM...CLSID} = "Registrar Registry Manager SHell Extension" \InProcServer32\(Default) = "rrShellX.dll" [file not found] "{E0D79304-84BE-11CE-9641-444553540000}" = "WinZip" -> {HKLM...CLSID} = "WinZip" \InProcServer32\(Default) = "C:\PROGRA~1\WINZIP\WZSHLSTB.DLL" ["WinZip Computing, Inc."] "{E0D79305-84BE-11CE-9641-444553540000}" = "WinZip" -> {HKLM...CLSID} = "WinZip" \InProcServer32\(Default) = "C:\PROGRA~1\WINZIP\WZSHLSTB.DLL" ["WinZip Computing, Inc."] "{E0D79306-84BE-11CE-9641-444553540000}" = "WinZip" -> {HKLM...CLSID} = "WinZip" \InProcServer32\(Default) = "C:\PROGRA~1\WINZIP\WZSHLSTB.DLL" ["WinZip Computing, Inc."] "{E0D79307-84BE-11CE-9641-444553540000}" = "WinZip" -> {HKLM...CLSID} = "WinZip" \InProcServer32\(Default) = "C:\PROGRA~1\WINZIP\WZSHLSTB.DLL" ["WinZip Computing, Inc."] "{950FF917-7A57-46BC-8017-59D9BF474000}" = "Shell Extension for CDRW" -> {HKLM...CLSID} = "Shell Extension for CDRW" \InProcServer32\(Default) = "C:\Program Files\Ahead\InCD\incdshx.dll" ["Nero AG"] HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\ INFECTION WARNING! "{54D9498B-CF93-414F-8984-8CE7FDE0D391}" = "ewido shell guard" -> {HKLM...CLSID} = "CShellExecuteHookImpl Object" \InProcServer32\(Default) = "C:\Program Files\ewido anti-malware\shellhook.dll" ["TODO: <Firmenname>"] HKLM\Software\Classes\*\shellex\ContextMenuHandlers\ ewido\(Default) = "{57BD36D7-CE32-4600-9B1C-1A0C47EFC02E}" -> {HKLM...CLSID} = "Ctest Object" \InProcServer32\(Default) = "C:\Program Files\ewido anti-malware\context.dll" ["ewido networks"] WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] WinZip\(Default) = "{E0D79304-84BE-11CE-9641-444553540000}" -> {HKLM...CLSID} = "WinZip" \InProcServer32\(Default) = "C:\PROGRA~1\WINZIP\WZSHLSTB.DLL" ["WinZip Computing, Inc."] HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\ ewido\(Default) = "{57BD36D7-CE32-4600-9B1C-1A0C47EFC02E}" -> {HKLM...CLSID} = "Ctest Object" \InProcServer32\(Default) = "C:\Program Files\ewido anti-malware\context.dll" ["ewido networks"] WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] WinZip\(Default) = "{E0D79304-84BE-11CE-9641-444553540000}" -> {HKLM...CLSID} = "WinZip" \InProcServer32\(Default) = "C:\PROGRA~1\WINZIP\WZSHLSTB.DLL" ["WinZip Computing, Inc."] HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\ WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] WinZip\(Default) = "{E0D79304-84BE-11CE-9641-444553540000}" -> {HKLM...CLSID} = "WinZip" \InProcServer32\(Default) = "C:\PROGRA~1\WINZIP\WZSHLSTB.DLL" ["WinZip Computing, Inc."] Default executables: -------------------- HKCU\Software\Classes\.scr\(Default) = "AutoCADScriptFile" HKCU\Software\Classes\AutoCADScriptFile\shell\open\command\(Default) = ""C:\WINNT\notepad.exe" "%1"" [MS] Active Desktop and Wallpaper: ----------------------------- Active Desktop is disabled at this entry: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState HKCU\Control Panel\Desktop\ "Wallpaper" = "C:\WINNT\ACD Wallpaper.cmp" Enabled Screen Saver: --------------------- HKCU\Control Panel\Desktop\ "SCRNSAVE.EXE" = "(BRAK)" [file not found] Startup items in "Administrator" & "All Users" startup folders: --------------------------------------------------------------- C:\Documents and Settings\All Users\Menu Start\Programy\Autostart "Microsoft Office" -> shortcut to: "C:\Program Files\Microsoft Office\Office\OSA9.EXE -b -l" [MS] "Przyspieszenie uruchomienia programu AutoCAD" -> shortcut to: "C:\Program Files\Common Files\Autodesk Shared\acstart16.exe" [null data] Winsock2 Service Provider DLLs: ------------------------------- Namespace Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++} 000000000001\LibraryPath = "%SystemRoot%\System32\rnr20.dll" [MS] 000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS] 000000000003\LibraryPath = "%SystemRoot%\System32\nwprovau.dll" [MS] Transport Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++} 0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range: %SystemRoot%\system32\msafd.dll [MS], 01 - 03, 06 - 45 %SystemRoot%\system32\rsvpsp.dll [MS], 04 - 05 Toolbars, Explorer Bars, Extensions: ------------------------------------ Toolbars HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\ "{014DA6C9-189F-421A-88CD-07CFE51CFF10}" -> {HKLM...CLSID} = "My Search Bar" \InProcServer32\(Default) = "C:\Program Files\MySearch\bar\1.bin\S4BAR.DLL" [file not found] "{2318C2B1-4965-11D4-9B18-009027A5CD4F}" -> {HKLM...CLSID} = "&Google" \InProcServer32\(Default) = "c:\program files\google\googletoolbar2.dll" ["Google Inc."] HKLM\Software\Microsoft\Internet Explorer\Toolbar\ "{2318C2B1-4965-11D4-9B18-009027A5CD4F}" = (no title provided) -> {HKLM...CLSID} = "&Google" \InProcServer32\(Default) = "c:\program files\google\googletoolbar2.dll" ["Google Inc."] Explorer Bars Dormant Explorer Bars in "View, Explorer Bar" menu HKLM\Software\Classes\CLSID\{014DA6CE-189F-421A-88CD-07CFE51CFF10}\(Default) = "My Search Bar Quick View" Implemented Categories\{00021493-0000-0000-C000-000000000046}\ [vertical bar] InProcServer32\(Default) = "C:\WINNT\System32\shdocvw.dll" [MS] Running Services (Display Name, Service Name, Path {Service DLL}): ------------------------------------------------------------------ antivirusdll, antivirusdll, ""C:\WINNT\msnmessangern.exe"" [null data] ewido security suite control, ewido security suite control, "C:\Program Files\ewido anti-malware\ewidoctrl.exe" ["ewido networks"] InCD Helper, InCDsrv, "C:\Program Files\Ahead\InCD\InCDsrv.exe" ["Nero AG"] LexBce Server, LexBceS, "C:\WINNT\system32\LEXBCES.EXE" ["Lexmark International, Inc."] LightScribeService Direct Disc Labeling Service, LightScribeService, "C:\Program Files\Common Files\LightScribe\LSSrvc.exe" ["Hewlett-Packard Company"] Microsoft Agent, Microsoft Agent, ""C:\WINNT\System32\dllcache\qxchost.exe"" [null data] NVIDIA Driver Helper Service, NVSvc, "C:\WINNT\System32\nvsvc32.exe" ["NVIDIA Corporation"] System zdarzeń COM+, EventSystem, "C:\WINNT\System32\svchost.exe -k netsvcs" {"C:\WINNT\System32\es.dll" [null data]} USB Data Adapter, Usbpda, "C:\WINNT\System32\svchost.exe -k netsvcs" {"C:\WINNT\System32\usbpda.dll" [MS]} Print Monitors: --------------- HKLM\System\CurrentControlSet\Control\Print\Monitors\ Lexmark Network Port\Driver = "LEXLMPM.DLL" ["Lexmark International, Inc."] Port sieciowy Hewlett-Packard\Driver = "hpmon.dll" [MS] Urządzenia drukujące AppleTalk\Driver = "sfmmon.dll" [MS] ---------- + This report excludes default entries except where indicated. + To see *everywhere* the script checks and *everything* it finds, launch it from a command prompt or a shortcut with the -all parameter. + The search for DESKTOP.INI DLL launch points on all local fixed drives took 22 seconds. + The search for all Registry CLSIDs containing dormant Explorer Bars took 7 seconds. ---------- (total run time: 39 seconds)

**Posty:** 18165 · przez **wojtas** 14 Mar 2007, 09:27

Start -> uruchom -> services.msc -> zatrzymaj i wyłącz usługi antivirusdll oraz
Microsoft Agent

O23 - Service: antivirusdll - Unknown owner - C:\WINNT\msnmessangern.exe
O23 - Service: Microsoft Agent - Unknown owner - C:\WINNT\System32\dllcache\qxchost.exe

Odpalasz hijackthis i zaznaczasz ptaszkami powyższe wpisy i dajesz Fix checked.
Pogrubione pliki usuwasz ręcznie z dysku

wklej do notatnika:

Windows Registry Editor Version 5.00

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser]
"{014DA6C9-189F-421A-88CD-07CFE51CFF10}"=-

w notatniku u góry>>>plik zapisz jako>>>Zmien rozszerzenie z TXT na Wszystkie pliki *.* >>> Zapisz pod nazwą FIX.REG

Klikasz dwa razy na powstały plik fix i dodajesz go do rejestru....
potem nowe logi z Hijack This oraz Silent runners

**Posty:** 52 · przez **rav2000** 14 Mar 2007, 21:13

Wykonałem polecenia.

Cytat:
Start -> uruchom -> services.msc -> zatrzymaj i wyłącz usługi antivirusdll oraz
Microsoft Agent

podczas tego polecenia wywala mi, ze nie mozna odnalezc pliku lub zła scieżka dostępu(mam win 2000)
Usunąłem wpisy w hijack, ale nie znalazłem tych pogrubionych plików żeby usunąć ręczne z dysku - porostu ich tam nie było.
Uzupełniłem rejestr o podany mi wpis.
Nowe logi:
hijack

Kod: Zaznacz wszystko: Logfile of HijackThis v1.99.1 Scan saved at 20:03:17, on 2007-03-14 Platform: Windows 2000 (WinNT 5.00.2195) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINNT\System32\smss.exe C:\WINNT\system32\winlogon.exe C:\WINNT\system32\services.exe C:\WINNT\system32\lsass.exe C:\WINNT\system32\svchost.exe C:\WINNT\system32\LEXBCES.EXE C:\WINNT\system32\spoolsv.exe C:\WINNT\system32\LEXPPS.EXE C:\WINNT\System32\svchost.exe C:\Program Files\ewido anti-malware\ewidoctrl.exe C:\Program Files\Ahead\InCD\InCDsrv.exe C:\Program Files\Common Files\LightScribe\LSSrvc.exe C:\WINNT\System32\nvsvc32.exe C:\WINNT\system32\regsvc.exe C:\WINNT\system32\MSTask.exe C:\WINNT\system32\stisvc.exe C:\WINNT\System32\WBEM\WinMgmt.exe C:\WINNT\System32\mspmspsv.exe C:\WINNT\explorer.exe C:\Program Files\WinFast\WFTVFM\WFWIZ.exe C:\WINNT\System32\WF2K.EXE C:\WINNT\System32\spool\DRIVERS\W32X86\2\printray.exe C:\Program Files\QuickTime\qttask.exe C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe C:\Program Files\Ahead\InCD\InCD.exe C:\WINNT\System32\internat.exe C:\WINNT\system32\cmd.exe C:\Program Files\Internet Explorer\iexplore.exe E:\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.onet.pl/ R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx O4 - HKLM\..\Run: [WinFast Schedule] C:\Program Files\WinFast\WFTVFM\WFWIZ.exe O4 - HKLM\..\Run: [WinFoxV2] C:\WINNT\System32\WF2K.EXE O4 - HKLM\..\Run: [WinFast2KLoadDefault] rundll32.exe wf2kcpl.dll,DllLoadDefaultSettings O4 - HKLM\..\Run: [PrinTray] C:\WINNT\System32\spool\DRIVERS\W32X86\2\printray.exe O4 - HKLM\..\Run: [Resume copy] copyfstq.exe /startup O4 - HKLM\..\Run: [CloneCDTray] "C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe" /s O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINNT\system32\NeroCheck.exe O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe" O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe O4 - HKLM\..\Run: [LGODDFU] "C:\Program Files\lg_fwupdate\fwupdate.exe" blrun O4 - HKCU\..\Run: [internat.exe] internat.exe O4 - HKCU\..\Run: [Shareaza] "C:\Program Files\File Sharing Revolution\Shareaza.exe" -tray O4 - HKCU\..\Run: [NBJ] "C:\Program Files\Ahead\Nero BackItUp\NBJ.exe" O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE O4 - Global Startup: Przyspieszenie uruchomienia programu AutoCAD.lnk = C:\Program Files\Common Files\Autodesk Shared\acstart16.exe O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar2.dll/cmsearch.html O8 - Extra context menu item: Backward &Links - res://C:\Program Files\Google\GoogleToolbar2.dll/cmbacklinks.html O8 - Extra context menu item: Cac&hed Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar2.dll/cmcache.html O8 - Extra context menu item: Si&milar Pages - res://C:\Program Files\Google\GoogleToolbar2.dll/cmsimilar.html O8 - Extra context menu item: Translate into English - res://C:\Program Files\Google\GoogleToolbar2.dll/cmtrans.html O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://download.ewido.net/ewidoOnlineScan.cab O23 - Service: Autodesk Licensing Service - Autodesk, Inc. - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe O23 - Service: Usługa administracyjna Menedżera dysków logicznych (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Ahead\InCD\InCDsrv.exe O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINNT\system32\LEXBCES.EXE O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINNT\System32\nvsvc32.exe

silent:

Kod: Zaznacz wszystko: "Silent Runners.vbs", revision 45, http://www.silentrunners.org/ Operating System: Windows 2000 Output limited to non-default values, except where indicated by "{++}" Startup items buried in registry: --------------------------------- HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++} "internat.exe" = "internat.exe" [MS] "Shareaza" = ""C:\Program Files\File Sharing Revolution\Shareaza.exe" -tray" ["Shareaza Development Team"] "NBJ" = ""C:\Program Files\Ahead\Nero BackItUp\NBJ.exe"" ["Ahead Software AG"] "Skype" = ""C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized" ["Skype Technologies S.A."] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++} "WinFast Schedule" = "C:\Program Files\WinFast\WFTVFM\WFWIZ.exe" ["Leadtek Research Inc."] "WinFoxV2" = "C:\WINNT\System32\WF2K.EXE" ["Leadtek Research Inc."] "WinFast2KLoadDefault" = "rundll32.exe wf2kcpl.dll,DllLoadDefaultSettings" [MS] "PrinTray" = "C:\WINNT\System32\spool\DRIVERS\W32X86\2\printray.exe" ["Lexmark"] "Resume copy" = "copyfstq.exe /startup" [null data] "CloneCDTray" = ""C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe" /s" ["SlySoft, Inc."] "NeroFilterCheck" = "C:\WINNT\system32\NeroCheck.exe" ["Ahead Software Gmbh"] "Synchronization Manager" = "mobsync.exe /logon" [MS] "QuickTime Task" = ""C:\Program Files\QuickTime\qttask.exe" -atboottime" ["Apple Computer, Inc."] "RemoteControl" = ""C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe"" ["Cyberlink Corp."] "InCD" = "C:\Program Files\Ahead\InCD\InCD.exe" ["Nero AG"] "LGODDFU" = ""C:\Program Files\lg_fwupdate\fwupdate.exe" blrun" [null data] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx\ {++} "Flag" = 2 HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\(Default) = (no title provided) -> {HKLM...CLSID} = "AcroIEHlprObj Class" \InProcServer32\(Default) = "C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx" [empty string] {AA58ED58-01DD-4d91-8333-CF10577473F7}\(Default) = (no title provided) -> {HKLM...CLSID} = "Google Toolbar Helper" \InProcServer32\(Default) = "c:\program files\google\googletoolbar2.dll" ["Google Inc."] HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\ "{CCA60260-A2C9-11D2-BA62-0020188191B2}" = "Registrar Registry Manager SHell Extension" -> {HKLM...CLSID} = "Registrar Registry Manager SHell Extension" \InProcServer32\(Default) = "rrShellX.dll" [file not found] "{E0D79304-84BE-11CE-9641-444553540000}" = "WinZip" -> {HKLM...CLSID} = "WinZip" \InProcServer32\(Default) = "C:\PROGRA~1\WINZIP\WZSHLSTB.DLL" ["WinZip Computing, Inc."] "{E0D79305-84BE-11CE-9641-444553540000}" = "WinZip" -> {HKLM...CLSID} = "WinZip" \InProcServer32\(Default) = "C:\PROGRA~1\WINZIP\WZSHLSTB.DLL" ["WinZip Computing, Inc."] "{E0D79306-84BE-11CE-9641-444553540000}" = "WinZip" -> {HKLM...CLSID} = "WinZip" \InProcServer32\(Default) = "C:\PROGRA~1\WINZIP\WZSHLSTB.DLL" ["WinZip Computing, Inc."] "{E0D79307-84BE-11CE-9641-444553540000}" = "WinZip" -> {HKLM...CLSID} = "WinZip" \InProcServer32\(Default) = "C:\PROGRA~1\WINZIP\WZSHLSTB.DLL" ["WinZip Computing, Inc."] "{950FF917-7A57-46BC-8017-59D9BF474000}" = "Shell Extension for CDRW" -> {HKLM...CLSID} = "Shell Extension for CDRW" \InProcServer32\(Default) = "C:\Program Files\Ahead\InCD\incdshx.dll" ["Nero AG"] HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\ INFECTION WARNING! "{54D9498B-CF93-414F-8984-8CE7FDE0D391}" = "ewido shell guard" -> {HKLM...CLSID} = "CShellExecuteHookImpl Object" \InProcServer32\(Default) = "C:\Program Files\ewido anti-malware\shellhook.dll" ["TODO: <Firmenname>"] HKLM\Software\Classes\*\shellex\ContextMenuHandlers\ ewido\(Default) = "{57BD36D7-CE32-4600-9B1C-1A0C47EFC02E}" -> {HKLM...CLSID} = "Ctest Object" \InProcServer32\(Default) = "C:\Program Files\ewido anti-malware\context.dll" ["ewido networks"] WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] WinZip\(Default) = "{E0D79304-84BE-11CE-9641-444553540000}" -> {HKLM...CLSID} = "WinZip" \InProcServer32\(Default) = "C:\PROGRA~1\WINZIP\WZSHLSTB.DLL" ["WinZip Computing, Inc."] HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\ ewido\(Default) = "{57BD36D7-CE32-4600-9B1C-1A0C47EFC02E}" -> {HKLM...CLSID} = "Ctest Object" \InProcServer32\(Default) = "C:\Program Files\ewido anti-malware\context.dll" ["ewido networks"] WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] WinZip\(Default) = "{E0D79304-84BE-11CE-9641-444553540000}" -> {HKLM...CLSID} = "WinZip" \InProcServer32\(Default) = "C:\PROGRA~1\WINZIP\WZSHLSTB.DLL" ["WinZip Computing, Inc."] HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\ WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] WinZip\(Default) = "{E0D79304-84BE-11CE-9641-444553540000}" -> {HKLM...CLSID} = "WinZip" \InProcServer32\(Default) = "C:\PROGRA~1\WINZIP\WZSHLSTB.DLL" ["WinZip Computing, Inc."] Default executables: -------------------- HKCU\Software\Classes\.scr\(Default) = "AutoCADScriptFile" HKCU\Software\Classes\AutoCADScriptFile\shell\open\command\(Default) = ""C:\WINNT\notepad.exe" "%1"" [MS] Active Desktop and Wallpaper: ----------------------------- Active Desktop is disabled at this entry: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState HKCU\Control Panel\Desktop\ "Wallpaper" = "C:\WINNT\ACD Wallpaper.cmp" Enabled Screen Saver: --------------------- HKCU\Control Panel\Desktop\ "SCRNSAVE.EXE" = "(BRAK)" [file not found] Startup items in "Administrator" & "All Users" startup folders: --------------------------------------------------------------- C:\Documents and Settings\All Users\Menu Start\Programy\Autostart "Microsoft Office" -> shortcut to: "C:\Program Files\Microsoft Office\Office\OSA9.EXE -b -l" [MS] "Przyspieszenie uruchomienia programu AutoCAD" -> shortcut to: "C:\Program Files\Common Files\Autodesk Shared\acstart16.exe" [null data] Winsock2 Service Provider DLLs: ------------------------------- Namespace Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++} 000000000001\LibraryPath = "%SystemRoot%\System32\rnr20.dll" [MS] 000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS] 000000000003\LibraryPath = "%SystemRoot%\System32\nwprovau.dll" [MS] Transport Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++} 0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range: %SystemRoot%\system32\msafd.dll [MS], 01 - 03, 06 - 45 %SystemRoot%\system32\rsvpsp.dll [MS], 04 - 05 Toolbars, Explorer Bars, Extensions: ------------------------------------ Toolbars HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\ "{2318C2B1-4965-11D4-9B18-009027A5CD4F}" -> {HKLM...CLSID} = "&Google" \InProcServer32\(Default) = "c:\program files\google\googletoolbar2.dll" ["Google Inc."] HKLM\Software\Microsoft\Internet Explorer\Toolbar\ "{2318C2B1-4965-11D4-9B18-009027A5CD4F}" = (no title provided) -> {HKLM...CLSID} = "&Google" \InProcServer32\(Default) = "c:\program files\google\googletoolbar2.dll" ["Google Inc."] Explorer Bars Dormant Explorer Bars in "View, Explorer Bar" menu HKLM\Software\Classes\CLSID\{014DA6CE-189F-421A-88CD-07CFE51CFF10}\(Default) = "My Search Bar Quick View" Implemented Categories\{00021493-0000-0000-C000-000000000046}\ [vertical bar] InProcServer32\(Default) = "C:\WINNT\System32\shdocvw.dll" [MS] Running Services (Display Name, Service Name, Path {Service DLL}): ------------------------------------------------------------------ ewido security suite control, ewido security suite control, "C:\Program Files\ewido anti-malware\ewidoctrl.exe" ["ewido networks"] InCD Helper, InCDsrv, "C:\Program Files\Ahead\InCD\InCDsrv.exe" ["Nero AG"] LexBce Server, LexBceS, "C:\WINNT\system32\LEXBCES.EXE" ["Lexmark International, Inc."] LightScribeService Direct Disc Labeling Service, LightScribeService, "C:\Program Files\Common Files\LightScribe\LSSrvc.exe" ["Hewlett-Packard Company"] NVIDIA Driver Helper Service, NVSvc, "C:\WINNT\System32\nvsvc32.exe" ["NVIDIA Corporation"] System zdarzeń COM+, EventSystem, "C:\WINNT\System32\svchost.exe -k netsvcs" {"C:\WINNT\System32\es.dll" [null data]} USB Data Adapter, Usbpda, "C:\WINNT\System32\svchost.exe -k netsvcs" {"C:\WINNT\System32\usbpda.dll" [MS]} Print Monitors: --------------- HKLM\System\CurrentControlSet\Control\Print\Monitors\ Lexmark Network Port\Driver = "LEXLMPM.DLL" ["Lexmark International, Inc."] Port sieciowy Hewlett-Packard\Driver = "hpmon.dll" [MS] Urządzenia drukujące AppleTalk\Driver = "sfmmon.dll" [MS] ---------- + This report excludes default entries except where indicated. + To see *everywhere* the script checks and *everything* it finds, launch it from a command prompt or a shortcut with the -all parameter. + The search for DESKTOP.INI DLL launch points on all local fixed drives took 19 seconds. + The search for all Registry CLSIDs containing dormant Explorer Bars took 6 seconds. ---------- (total run time: 35 seconds)

**Posty:** 18165 · przez **wojtas** 14 Mar 2007, 21:20

Użyj WWDC :
http://www.firewallleaktester.com/wwdc.htm
Zmień opcje z disable na enable. Uruchom ponownie komputer.
Tak powinny wyglądać porty (NetBIOS może być żółty) :
http://www.firewallleaktester.com/images_site/wwdc.jpg

Pobierz i uruchom narzędzie : The Avenger
http://swandog46.geekstogo.com/avenger.zip
Zaznacz opcję Input script manually i kliknij na Lupkę z prawej strony. W okienku, które się otworzy wklejasz:

Files to delete:

C:\WINNT\msnmessangern.exe
C:\WINNT\System32\dllcache\qxchost.exe

Klikasz Done, a następnie zielone światełko i zgadzasz się na restart klikając OK.

Kasujesz ręcznie z dysku plik: C:\Avenger\backup.zip i wklejasz na forum raport: C:\avenger.txt + log z comboscana

comboscan

http://www.techsupportforum.com/sectools/Deckard/comboscan.exe :arrow:

**Posty:** 52 · przez **rav2000** 14 Mar 2007, 21:23

Proszę oto log:

Kod: Zaznacz wszystko: ComboScan v20070306.20 run by Administrator on 2007-03-14 at 20:18:41 Computer is in Normal Mode. -------------------------------------------------------------------------------- Performed disk cleanup. -- HijackThis (run as Administrator.exe) --------------------------------------- Logfile of HijackThis v1.99.1 Scan saved at 20:18:42, on 2007-03-14 Platform: Windows 2000 (WinNT 5.00.2195) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINNT\System32\smss.exe C:\WINNT\system32\winlogon.exe C:\WINNT\system32\services.exe C:\WINNT\system32\lsass.exe C:\WINNT\system32\svchost.exe C:\WINNT\system32\LEXBCES.EXE C:\WINNT\system32\spoolsv.exe C:\WINNT\system32\LEXPPS.EXE C:\WINNT\System32\svchost.exe C:\Program Files\ewido anti-malware\ewidoctrl.exe C:\Program Files\Ahead\InCD\InCDsrv.exe C:\Program Files\Common Files\LightScribe\LSSrvc.exe C:\WINNT\System32\nvsvc32.exe C:\WINNT\system32\regsvc.exe C:\WINNT\system32\MSTask.exe C:\WINNT\system32\stisvc.exe C:\WINNT\System32\WBEM\WinMgmt.exe C:\WINNT\System32\mspmspsv.exe C:\WINNT\explorer.exe C:\Program Files\WinFast\WFTVFM\WFWIZ.exe C:\WINNT\System32\WF2K.EXE C:\WINNT\System32\spool\DRIVERS\W32X86\2\printray.exe C:\Program Files\QuickTime\qttask.exe C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe C:\Program Files\Ahead\InCD\InCD.exe C:\WINNT\System32\internat.exe C:\WINNT\system32\cmd.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Documents and Settings\Administrator\Pulpit\comboscan.exe E:\HIJACK~1\Administrator.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.onet.pl/ R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx O4 - HKLM\..\Run: [WinFast Schedule] C:\Program Files\WinFast\WFTVFM\WFWIZ.exe O4 - HKLM\..\Run: [WinFoxV2] C:\WINNT\System32\WF2K.EXE O4 - HKLM\..\Run: [WinFast2KLoadDefault] rundll32.exe wf2kcpl.dll,DllLoadDefaultSettings O4 - HKLM\..\Run: [PrinTray] C:\WINNT\System32\spool\DRIVERS\W32X86\2\printray.exe O4 - HKLM\..\Run: [Resume copy] copyfstq.exe /startup O4 - HKLM\..\Run: [CloneCDTray] "C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe" /s O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINNT\system32\NeroCheck.exe O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe" O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe O4 - HKLM\..\Run: [LGODDFU] "C:\Program Files\lg_fwupdate\fwupdate.exe" blrun O4 - HKCU\..\Run: [internat.exe] internat.exe O4 - HKCU\..\Run: [Shareaza] "C:\Program Files\File Sharing Revolution\Shareaza.exe" -tray O4 - HKCU\..\Run: [NBJ] "C:\Program Files\Ahead\Nero BackItUp\NBJ.exe" O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE O4 - Global Startup: Przyspieszenie uruchomienia programu AutoCAD.lnk = C:\Program Files\Common Files\Autodesk Shared\acstart16.exe O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar2.dll/cmsearch.html O8 - Extra context menu item: Backward &Links - res://C:\Program Files\Google\GoogleToolbar2.dll/cmbacklinks.html O8 - Extra context menu item: Cac&hed Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar2.dll/cmcache.html O8 - Extra context menu item: Si&milar Pages - res://C:\Program Files\Google\GoogleToolbar2.dll/cmsimilar.html O8 - Extra context menu item: Translate into English - res://C:\Program Files\Google\GoogleToolbar2.dll/cmtrans.html O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://download.ewido.net/ewidoOnlineScan.cab O23 - Service: Autodesk Licensing Service - Autodesk, Inc. - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe O23 - Service: Usługa administracyjna Menedżera dysków logicznych (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Ahead\InCD\InCDsrv.exe O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINNT\system32\LEXBCES.EXE O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINNT\System32\nvsvc32.exe -- HijackThis Fixed Entries (E:\HIJACK~1\backups\) ----------------------------- backup-20060507-183845-533 O2 - BHO: (no name) - {44C4682F-A694-D946-CC66-ABEF4F0EA4EA} - C:\WINNT\System32\gojl.dll (file missing) backup-20060507-184138-649 O2 - BHO: URLLink - {4A2AACF3-ADF6-11D5-98A9-00E018981B9E} - C:\Program Files\NewDotNet\newdotnet7_22.dll (file missing) backup-20060507-184138-429 O2 - BHO: (no name) - {4ADFA89F-607C-1CAC-2978-3AB60A18A0EA} - C:\WINNT\System32\xmvnciuv.dll (file missing) backup-20060507-184138-824 O2 - BHO: (no name) - {7154109C-8122-A0FE-2DF8-D2F88D91CFB5} - C:\WINNT\System32\jitlbz.dll (file missing) backup-20060507-184138-639 O3 - Toolbar: My Search Bar - {014DA6C9-189F-421a-88CD-07CFE51CFF10} - C:\Program Files\MySearch\bar\1.bin\S4BAR.DLL (file missing) backup-20060507-184525-841 O4 - HKLM\..\Run: [salm] c:\program files\180searchassistant\salm.exe backup-20060507-184525-758 O4 - HKLM\..\Run: [Media Access] C:\Program Files\Media Access\MediaAccK.exe backup-20060507-184525-538 O4 - HKLM\..\Run: [Media Pass] C:\Program Files\Media Pass\MediaPassK.exe backup-20060507-184525-933 O4 - HKLM\..\Run: [System] C:\WINNT\System32\kernels64.exe backup-20060507-184525-747 O4 - HKCU\..\Run: [Wpcvoygv] C:\WINNT\System32\??rss.exe backup-20060507-184525-570 O4 - HKCU\..\Run: [180ClientStubInstall] "C:\DOCUME~1\ADMINI~1\USTAWI~1\Temp\zang.exe" backup-20060507-184525-837 O4 - HKCU\..\Run: [Windows installer] C:\winstall.exe backup-20060507-184525-705 O4 - HKCU\..\Run: [pro] C:\WINNT\System32\vxh8jkdq2.exe backup-20060507-184525-698 O4 - HKCU\..\Run: [WhenUSave] "C:\Program Files\Save\Save.exe" backup-20060507-184525-452 O4 - Startup: iMesh.lnk = C:\Program Files\iMesh\Client\iMeshClient.exe backup-20060508-203306-999 R3 - URLSearchHook: (no name) - {4ADFA89F-607C-1CAC-2978-3AB60A18A0EA} - (no file) backup-20060508-203306-447 R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file) backup-20060508-203306-227 F2 - REG:system.ini: Shell=Explorer.exe C:\WINNT\System32\kernels64.exe backup-20060508-203306-622 O2 - BHO: My Search BHO - {014DA6C1-189F-421a-88CD-07CFE51CFF10} - C:\Program Files\MySearch\bar\1.bin\S4BAR.DLL (file missing) backup-20060508-203306-436 O2 - BHO: C:\WINNT\lbbho.dll - {BEF88D36-4F90-4EF4-94AE-87F555D5FBCF} - C:\WINNT\lbbho.dll (file missing) backup-20060508-203306-259 O4 - HKLM\..\Run: [New.net Startup] rundll32 C:\PROGRA~1\NEWDOT~1\NEWDOT~2.DLL,ClientStartup -s backup-20060508-203306-526 O16 - DPF: {15AD4789-CDB4-47E1-A9DA-992EE8E6BAD6} - ms-its:mhtml:file://c:\nesunel.mht!http://adextension.com/ext1/lca.chm::/bridge-c18.cab backup-20060509-220037-737 O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm backup-20060509-220037-837 O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm backup-20060510-002026-543 R3 - URLSearchHook: (no name) - {C32531BB-F35B-D989-087A-FA3AF25672B2} - C:\WINNT\System32\tvxto.dll backup-20060526-014334-904 O4 - HKLM\..\Run: [6efb5886.exe] C:\WINNT\System32\6efb5886.exe backup-20060526-014334-991 O4 - HKCU\..\Run: [677f6159.exe] C:\Documents and Settings\Administrator\Ustawienia lokalne\Dane aplikacji\677f6159.exe backup-20060526-014334-771 O4 - HKCU\..\Run: [6efb5886.exe] C:\Documents and Settings\Administrator\Ustawienia lokalne\Dane aplikacji\6efb5886.exe backup-20060526-182033-959 R3 - URLSearchHook: (no name) - {C82032EF-A00B-D9DD-087A-FA3AF25672E7} - C:\WINNT\System32\kzi.dll (file missing) backup-20060526-182033-939 R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file) backup-20060526-182033-718 R3 - URLSearchHook: (no name) - {9195768E-BF6C-CCBA-3C89-E57B468D2BB6} - C:\WINNT\System32\uzq.dll (file missing) backup-20060526-182033-114 R3 - URLSearchHook: (no name) - {0E3F7B01-E5B3-966F-E174-EAABBB32BFBF} - C:\WINNT\System32\ryewps.dll (file missing) backup-20060526-182033-928 R3 - URLSearchHook: (no name) - {0D3E2E54-B7E2-9A35-E174-EAABBB32E5EA} - C:\WINNT\System32\cigow.dll (file missing) backup-20060526-182033-750 O1 - Hosts: 200.73.174.154 STORAGE.HOSTANCE.NET backup-20060526-182033-216 O1 - Hosts: 200.73.174.154 STORAGE-TASP.COM backup-20060526-182033-885 O2 - BHO: (no name) - {0D3E2E54-B7E2-9A35-E174-EAABBB32E5EA} - C:\WINNT\System32\cigow.dll (file missing) backup-20060526-182033-879 O2 - BHO: (no name) - {0E3F7B01-E5B3-966F-E174-EAABBB32BFBF} - C:\WINNT\System32\ryewps.dll (file missing) backup-20060526-182033-633 O2 - BHO: (no name) - {9195768E-BF6C-CCBA-3C89-E57B468D2BB6} - C:\WINNT\System32\uzq.dll (file missing) backup-20060526-182033-370 O2 - BHO: (no name) - {C82032EF-A00B-D9DD-087A-FA3AF25672E7} - C:\WINNT\System32\kzi.dll (file missing) backup-20060526-182033-893 O16 - DPF: {00000000-0000-0000-0000-100000000002} - http://code.jcash.biz/l/988ce6488e555669fe3c63f2169aa171_13.exe backup-20060526-182033-979 O16 - DPF: {42F2C9BA-614F-47C0-B3E3-ECFD34EED658} - http://promo.dollarrevenue.com/activex/promocache/3631382D2D2D.exe backup-20060526-182033-752 O16 - DPF: {97B79133-88F0-45F0-8D57-0F2EF27D9C66} - http://85.255.114.166/1/rdgPL2404.exe backup-20060526-182033-670 O20 - Winlogon Notify: winrkp32 - winrkp32.dll (file missing) backup-20060528-231259-814 O4 - Startup: .protected backup-20060528-231259-200 O23 - Service: SoftGuard Service (SG_Service) - Unknown owner - C:\Program Files\Common Files\RbtProt\sgsrv.exe (file missing) backup-20060528-231320-667 O4 - Startup: .protected backup-20060528-231526-456 O4 - HKCU\..\Run: [Bbrnd] C:\Program Files\??sembly\m?dtc.exe backup-20060528-231526-271 O4 - HKCU\..\Run: [Bcet] "C:\WINNT\SMANTE~1\winword.exe" -vt mt backup-20060528-231715-379 O4 - Global Startup: .protected backup-20060528-231811-146 O4 - Global Startup: .protected backup-20060528-232127-228 O23 - Service: SoftGuard Service (SG_Service) - Unknown owner - C:\Program Files\Common Files\RbtProt\sgsrv.exe (file missing) backup-20060528-233216-107 O23 - Service: SoftGuard Service (SG_Service) - Unknown owner - C:\Program Files\Common Files\RbtProt\sgsrv.exe (file missing) backup-20060528-233310-818 O4 - Global Startup: .protected backup-20060528-233416-985 O4 - Global Startup: .protected backup-20060528-233416-902 O23 - Service: SoftGuard Service (SG_Service) - Unknown owner - C:\Program Files\Common Files\RbtProt\sgsrv.exe (file missing) backup-20060528-233927-105 O4 - Global Startup: .protected backup-20060528-233945-628 O23 - Service: SoftGuard Service (SG_Service) - Unknown owner - C:\Program Files\Common Files\RbtProt\sgsrv.exe (file missing) backup-20060826-223611-641 O4 - HKLM\..\Run: [E-nrgyPlus] C:\Program Files\E-nrgyPlus\E-nrgyPlus.exe backup-20060826-223704-511 O16 - DPF: {74CD40EA-EF77-4BAD-808A-B5982DA73F20} - http://yax-download.yazzle.net/YazzleActiveX.cab?refid=1162 backup-20061126-231000-252 O4 - Startup: MSWin--1070726820.exe backup-20061126-231000-231 O4 - Global Startup: Uninstall.exe backup-20061126-231000-480 O16 - DPF: {23746592-4354-3445-3565-000000000000} - http://66.199.235.67/bin/win.exe backup-20061209-183932-335 O20 - Winlogon Notify: rpcc - C:\WINNT\System32\rpcc.dll (file missing) backup-20061224-122550-930 F3 - REG:win.ini: run=C:\WINNT\inet20000\services.exe backup-20061224-122551-304 O2 - BHO: edit_html Class - {14D1A72D-8705-11D8-B120-0040F46CB696} - C:\WINNT\inet20000\1224104214.dll backup-20061224-122551-417 O2 - BHO: Bar888 - {C1B4DEC2-2623-438e-9CA2-C9043AB28508} - C:\PROGRA~1\COMMON~1\{37171~1\Bar888.dll backup-20061224-122551-107 O4 - HKLM\..\Run: [7v3j] C:\WINNT\System32\z1409.exe gdtgh backup-20061224-122551-929 O4 - HKLM\..\Run: [xp_system] C:\WINNT\inet20000\services.exe backup-20061224-122551-196 O4 - HKLM\..\Run: [Microsoft WPCEmail] C:\WINNT\inet20000\svchost.exe backup-20061224-122551-395 O4 - HKLM\..\Run: [system spool] C:\WINNT\System32\syspools.exe backup-20061224-122551-812 O4 - HKLM\..\Run: [System] C:\WINNT\System32\kernels1118.exe backup-20061224-122551-549 O4 - HKLM\..\Run: [{271717F3-072D-1045-0514-031016200030}] "C:\Program Files\Common Files\{271717F3-072D-1045-0514-031016200030}\Update.exe" te-110-12-0000273 backup-20061224-122551-502 O4 - HKLM\..\Run: [ControlPanel] C:\WINNT\System32\cmd32.exe internat.dll,LoadKeyboardProfile backup-20061224-122551-743 O4 - HKCU\..\Run: [xp_system] C:\WINNT\inet20000\services.exe backup-20061224-122551-662 O4 - HKCU\..\Run: [Windows installer] C:\winstall.exe backup-20061224-122551-997 O4 - HKCU\..\Run: [taskdir] C:\WINNT\System32\taskdir.exe backup-20061224-122551-726 O4 - HKCU\..\Run: [system spool] C:\WINNT\System32\syspools.exe backup-20061224-122551-805 O4 - HKCU\..\Run: [Key] C:\DOCUME~1\ADMINI~1\USTAWI~1\Temp\7.tmp backup-20061224-122551-303 O4 - HKCU\..\Run: [WinMedia] C:\DOCUME~1\ADMINI~1\USTAWI~1\Temp\33774156.exe backup-20061224-122551-908 O4 - HKCU\..\Run: [WinUpgrade] "C:\DOCUME~1\ADMINI~1\USTAWI~1\Temp\33782609.exe " backup-20061224-122551-260 O4 - HKCU\..\Run: [WinUpdate] "C:\DOCUME~1\ADMINI~1\USTAWI~1\Temp\33813328.exe " backup-20061224-122718-472 O21 - SSODL: ytkbvcFj - {271717F4-8DBD-BD5E-DC19-8E285D218ECC} - C:\WINNT\System32\fxco.dll backup-20061224-122718-883 O21 - SSODL: CDRecorder026 - {A3BC5E20-0235-1ABF-9CE1-00AA00512026} - C:\WINNT\System32\hldk32.dll backup-20061224-122718-934 O23 - Service: Microsoft ASPI Manager (aspi113210) - Unknown owner - C:\WINNT\System32\aspi2471812.exe backup-20061224-122718-859 O23 - Service: COM+ Messages - Unknown owner - C:\WINNT\System32\svchosts.exe" -e te-110-12-0000273 (file missing) backup-20061224-135333-826 O3 - Toolbar: (no name) - {C1B4DEC2-2623-438e-9CA2-C9043AB28508} - (no file) backup-20061224-230817-490 F2 - REG:system.ini: UserInit=userinit.exe backup-20061224-230817-407 O20 - Winlogon Notify: rpcc - C:\WINNT\System32\rpcc.dll backup-20061224-230817-249 O23 - Service: Microsoft ASPI Manager (aspi113210) - Unknown owner - C:\WINNT\System32\aspi2471812.exe (file missing) backup-20061224-230914-106 O23 - Service: Microsoft ASPI Manager (aspi113210) - Unknown owner - C:\WINNT\System32\aspi2471812.exe (file missing) backup-20061225-113220-192 O20 - Winlogon Notify: rpcc - C:\WINNT\System32\rpcc.dll backup-20061225-113220-237 O23 - Service: ICF - Unknown owner - C:\WINNT\System32\icf.exe backup-20061225-134929-827 O20 - Winlogon Notify: rpcc - C:\WINNT\System32\rpcc.dll (file missing) backup-20061225-134929-347 O23 - Service: Microsoft ASPI Manager (aspi113210) - Unknown owner - C:\WINNT\System32\aspi2471812.exe (file missing) backup-20061225-183316-398 O23 - Service: Microsoft ASPI Manager (aspi113210) - Unknown owner - C:\WINNT\System32\aspi2471812.exe (file missing) backup-20061225-200441-865 O23 - Service: Microsoft ASPI Manager (aspi113210) - Unknown owner - C:\WINNT\System32\aspi2471812.exe (file missing) backup-20061225-200453-383 O23 - Service: Microsoft ASPI Manager (aspi113210) - Unknown owner - C:\WINNT\System32\aspi2471812.exe (file missing) backup-20061226-120717-709 O23 - Service: Microsoft ASPI Manager (aspi113210) - Unknown owner - C:\WINNT\System32\aspi2471812.exe (file missing) backup-20061226-120730-527 O23 - Service: Microsoft ASPI Manager (aspi113210) - Unknown owner - C:\WINNT\System32\aspi2471812.exe (file missing) backup-20061226-120746-992 O23 - Service: Microsoft ASPI Manager (aspi113210) - Unknown owner - C:\WINNT\System32\aspi2471812.exe (file missing) backup-20070314-194142-613 O23 - Service: antivirusdll - Unknown owner - C:\WINNT\msnmessangern.exe backup-20070314-194142-373 O23 - Service: Microsoft Agent - Unknown owner - C:\WINNT\System32\dllcache\qxchost.exe -- File Associations ----------------------------------------------------------- .bat - batfile - "%1" %* .chm - chm.file - "C:\WINNT\hh.exe" %1 .cmd - cmdfile - "%1" %* .com - comfile - "%1" %* .exe - exefile - "%1" %* .hlp - hlpfile - %SystemRoot%\System32\winhlp32.exe %1 .inf - inffile - %SystemRoot%\System32\NOTEPAD.EXE %1 .ini - inifile - %SystemRoot%\System32\NOTEPAD.EXE %1 [COLOR=red].js - JSFile - C:\WINNT\System32\WScript.exe "%1" %*[/COLOR] .lnk - lnkfile - {00021401-0000-0000-C000-000000000046} .pif - piffile - "%1" %* .reg - regfile - regedit.exe "%1" [COLOR=red].scr - AutoCADScriptFile - "C:\WINNT\notepad.exe" "%1"[/COLOR] .txt - txtfile - %SystemRoot%\system32\NOTEPAD.EXE %1 [COLOR=red].vbs - VBSFile - C:\WINNT\System32\WScript.exe "%1" %*[/COLOR] -- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------- 3S AIRPLUS (D-Link AirPlus Wireless Adapter) - C:\WINNT\System32\DRIVERS\airplus.sys (not found) 2R AmosNT - C:\WINNT\system32\drivers\Amosnt.sys 2R AppleTalk (Protokół AppleTalk) - C:\WINNT\system32\drivers\sfmatalk.sys 2R basic2 - C:\WINNT\system32\drivers\basic2.sys 3S ccdecode (Closed Caption Decoder) - C:\WINNT\system32\drivers\ccdecode.sys 1R Cdr4_2K - C:\WINNT\system32\drivers\cdr4_2k.sys 2R Cdralw2k - C:\WINNT\system32\drivers\cdralw2k.sys 2R CX23880 (V-Stream TV88X Video Capture) - C:\WINNT\system32\drivers\cx88vid.sys 2R CX88XBAR (V-Stream TV88X Crossbar) - C:\WINNT\system32\drivers\cx88xbar.sys 2R CXTUNE (V-Stream TV88X Tuner) - C:\WINNT\system32\drivers\cx88tune.sys 1R Dlc (Protokół DLC) - C:\WINNT\system32\drivers\dlc.sys 3S DWL520 (D-Link Air DWL-520 Wireless PCI Adapter) - C:\WINNT\system32\drivers\DWL520.sys 3R ElbyCDFL - C:\WINNT\system32\drivers\ElbyCDFL.sys 2R ElbyCDIO (ElbyCDIO Driver) - C:\WINNT\system32\drivers\ElbyCDIO.sys 1R ewido security suite driver - C:\Program Files\ewido anti-malware\guard.sys 2R Fallback - C:\WINNT\system32\drivers\fallback.sys 2R Fsks - C:\WINNT\system32\drivers\fsksnt.sys 3S gmer - C:\WINNT\system32\drivers\gmer.sys 2R hardlock - C:\WINNT\system32\drivers\hardlock.sys 2R Haspnt - C:\WINNT\system32\drivers\Haspnt.sys 2R hidusb (Sterownik Microsoft klasy HID) - C:\WINNT\system32\drivers\hidusb.sys 3S InCDFat (Ahead InCDFat File System Driver) - C:\WINNT\system32\drivers\InCDFat.sys 4R InCDfs (InCD File System) - C:\WINNT\system32\drivers\InCDfs.sys 1R InCDPass - C:\WINNT\system32\drivers\InCDpass.sys 1R incdrm (InCD Reader) - C:\WINNT\system32\drivers\InCDrm.sys 2R K56 - C:\WINNT\system32\drivers\k56nt.sys 3R MODEMCSA (Urządzenie filtru strumieniowego usługi Unimodem) - C:\WINNT\system32\drivers\MODEMCSA.sys 3R mouhid (Sterownik myszy HID) - C:\WINNT\system32\drivers\mouhid.sys 3S MPE (BDA MPE Filter) - C:\WINNT\system32\drivers\mpe.sys 3S MSTEE (Microsoft Streaming Tee/Sink-to-Sink Converter) - C:\WINNT\system32\drivers\mstee.sys 3R ms_mpu401 (Sterownik portu MIDI UART Microsoft MPU-401) - C:\WINNT\system32\drivers\msmpu401.sys 3S NABTSFEC (NABTS/FEC VBI Codec) - C:\WINNT\system32\drivers\nabtsfec.sys 2R Nbf (Protokół NetBEUI) - C:\WINNT\system32\drivers\nbf.sys 3R ndiscm (Motorola SurfBoard USB Cable Modem Windows 2000 Driver) - C:\WINNT\system32\drivers\netmotcm.sys 3S NdisIP (Microsoft TV/Video Connection) - C:\WINNT\system32\drivers\ndisip.sys 3S nm (Sterownik monitora sieci) - C:\WINNT\system32\drivers\nmnt.sys 3S NPF (Netgroup Packet Filter) - C:\WINNT\system32\drivers\npf.sys 3R nv - C:\WINNT\system32\drivers\nv4_mini.sys 3R nvax (Service for NVIDIA(R) nForce(TM) Audio Enumerator) - C:\WINNT\system32\drivers\nvax.sys 2S nvcap (nVidia WDM Video Capture (universal)) - C:\WINNT\system32\drivers\NVCAP.SYS 0S NVDual - C:\WINNT\System32\DRIVERS\nvDual.sys (not found) 3R NVENET (NVIDIA nForce MCP Networking Adapter Driver) - C:\WINNT\system32\drivers\NVENET.sys 3R nvnforce (Service for NVIDIA(R) nForce(TM) Audio) - C:\WINNT\system32\drivers\nvapu.sys 2R nvTUNEP (nVidia WDM TVTuner) - C:\WINNT\system32\drivers\NVTUNEP.SYS 2R nvtvSND (nVidia WDM TVAudio Crossbar) - C:\WINNT\system32\drivers\NVTVSND.SYS 2R NVXBAR (nVidia WDM A/V Crossbar) - C:\WINNT\system32\drivers\NVXBAR.SYS 0R nv_agp (NVIDIA nForce AGP Bus Filter) - C:\WINNT\system32\drivers\nv_agp.SYS 2R NwlnkIpx (Protokół transportowy zgodny z NWLink IPX/SPX/NetBIOS) - C:\WINNT\system32\drivers\nwlnkipx.sys 2R NwlnkNb (NWLink NetBIOS) - C:\WINNT\system32\drivers\nwlnknb.sys 2R NwlnkSpx (Protokół NWLink SPX/SPXII) - C:\WINNT\system32\drivers\nwlnkspx.sys 3R openhci (Sterownik otwartego kontrolera hosta USB Microsoft) - C:\WINNT\system32\drivers\openhci.sys 2R Rksample - C:\WINNT\system32\drivers\rksample.sys 2R Sentinel - C:\WINNT\system32\drivers\SENTINEL.SYS 3S SLIP (BDA Slip De-Framer) - C:\WINNT\system32\drivers\slip.sys 2R SoftFax - C:\WINNT\system32\drivers\faxnt.sys 3S streamip (BDA IPSink) - C:\WINNT\system32\drivers\streamip.sys 2R Tones - C:\WINNT\system32\drivers\tonesnt.sys 3R usbehci (Microsoft USB 2.0 Enhanced Host Controller Miniport Driver) - C:\WINNT\system32\drivers\usbehci.sys 3R usbhub20 (USB 2.0 Root Hub Support) - C:\WINNT\system32\drivers\usbhub20.sys 3S usbscan (Sterownik skanera USB) - C:\WINNT\system32\drivers\usbscan.sys 3S USBSTOR (Sterownik pamięci masowej USB) - C:\WINNT\system32\drivers\USBSTOR.SYS 2R V124 - C:\WINNT\system32\drivers\v124nt.sys 3R WFIOCTL - C:\Program Files\WinFast\WFTVFM\WFIOCTL.sys 3R WFsys (WinFox Control I/O Driver) - C:\WINNT\system32\drivers\wfsys.sys 3R winachsf - C:\WINNT\system32\drivers\winachsf.sys 3S WSTCODEC (World Standard Teletext Codec) - C:\WINNT\system32\drivers\wstcodec.sys 4R WINFOXIO - C:\WINNT\system32\drivers\WINFOXIO.sys [COLOR=red][B]pe386 driver present[/B][/COLOR] -- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled -------------------- 4S antivirusdll - "C:\WINNT\msnmessangern.exe" 3S aspnet_state (ASP.NET State Service) - C:\WINNT\Microsoft.NET\Framework\v1.1.4322\aspnet_state.exe 3S Autodesk Licensing Service - "C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe" 4S COM+ Messages - "C:\WINNT\System32\svchosts.exe" -e te-110-12-0000273 2S ewido security suite control - C:\Program Files\ewido anti-malware\ewidoctrl.exe 4S ewido security suite guard - C:\Program Files\ewido anti-malware\ewidoguard.exe 4S ICF - C:\WINNT\System32\icf.exe 2R InCDsrv (InCD Helper) - C:\Program Files\Ahead\InCD\InCDsrv.exe 2R LexBceS (LexBce Server) - C:\WINNT\system32\LEXBCES.EXE 2R LightScribeService (LightScribeService Direct Disc Labeling Service) - C:\Program Files\Common Files\LightScribe\LSSrvc.exe 4S Microsoft Agent - "C:\WINNT\System32\dllcache\qxchost.exe" 2R NVSvc (NVIDIA Driver Helper Service) - C:\WINNT\System32\nvsvc32.exe 2R StiSvc (Still Image Service) - C:\WINNT\system32\stisvc.exe 2R Usbpda (USB Data Adapter) - C:\WINNT\System32\svchost.exe -k netsvcs 2R WMDM PMSP Service - C:\WINNT\System32\mspmspsv.exe -- Files created between 2007-02-14 and 2007-03-14 ----------------------------- 2007-03-14 20:07:23 16384 --a-----t C:\WINNT\System32\Perflib_Perfdata_398.dat<PERFLI~2.DAT> 2007-03-13 23:11:17 151552 -r-hs---- C:\WINNT\msnmessangern.exe<MSNMES~1.EXE> 2007-03-10 23:40:05 8464 --a------ C:\WINNT\System32\kbdkor.dll 2007-03-10 23:40:05 6416 --a------ C:\WINNT\System32\kbd103.dll 2007-03-10 23:40:05 6928 --a------ C:\WINNT\System32\kbd101c.dll 2007-03-10 23:40:05 6416 --a------ C:\WINNT\System32\kbd101b.dll 2007-03-10 23:35:21 0 d-------- C:\Temp 2007-03-10 23:12:20 102912 --a------ C:\WINNT\System32\Vb6stkit.dll 2007-03-10 23:12:20 102160 --a------ C:\WINNT\System32\VB6KO.DLL 2007-03-10 23:12:20 16384 --a------ C:\WINNT\System32\lgfwunis.exe 2007-03-10 23:12:19 0 d-------- C:\Program Files\lg_fwupdate<LG_FWU~1> 2007-03-10 23:05:22 0 d-------- C:\Program Files\Common Files\LightScribe<LIGHTS~1> 2007-03-10 23:04:05 2973696 -----n--- C:\WINNT\NuNinst.exe 2007-03-10 23:04:03 6400 -----n--- C:\WINNT\System32\drivers\InCDFatRec.sys<INCDFA~1.SYS> 2007-03-10 23:04:03 134144 -----n--- C:\WINNT\System32\drivers\InCDFat.sys 2007-03-10 23:04:02 28672 -----n--- C:\WINNT\System32\drivers\InCDrm.sys 2007-03-10 23:04:02 8704 -----n--- C:\WINNT\System32\drivers\InCDrec.sys 2007-03-10 23:04:02 29696 -----n--- C:\WINNT\System32\drivers\InCDpass.sys 2007-03-10 23:04:02 99584 -----n--- C:\WINNT\System32\drivers\InCDfs.sys 2007-03-10 23:04:00 0 d-------- C:\WINNT\InCD 2007-03-10 23:02:35 40960 --a------ C:\Program Files\Uninstall_CDS.exe<UNINST~1.EXE> 2007-03-10 23:02:34 0 d-------- C:\Program Files\CyberLink DVD Solution<CYBERL~2> 2007-03-10 16:24:36 2916352 -----n--- C:\WINNT\UNNMP.exe 2007-03-10 16:23:25 0 d-------- C:\Program Files\Common Files\Nero 2007-03-10 16:19:57 416800 --a------ C:\WINNT\System32\msvcp60.dll 2007-03-10 16:19:54 0 d-------- C:\Program Files\CyberLink<CYBERL~1> 2007-03-10 16:05:01 364544 -----n--- C:\WINNT\System32\TwnLib4.dll 2007-03-10 16:05:01 106496 --a------ C:\WINNT\System32\TwnLib20.dll 2007-03-10 16:05:01 471040 -----n--- C:\WINNT\System32\ImagXRA7.dll 2007-03-10 16:05:01 262144 -----n--- C:\WINNT\System32\ImagXR7.dll 2007-03-10 16:05:01 476320 -----n--- C:\WINNT\System32\ImagXpr7.dll 2007-03-10 16:05:01 1568768 -----n--- C:\WINNT\System32\ImagX7.dll 2007-03-10 15:26:27 30 --a------ C:\AUTOEXEC.BAT 2007-03-10 15:26:22 0 d-------- C:\CDROM -- Find3M Report --------------------------------------------------------------- 2007-03-14 18:56:02 17168 --a------ C:\WINNT\System32\tftp.exe 2007-03-14 18:56:02 39696 --a------ C:\WINNT\System32\ftp.exe 2007-03-10 16:35:34 0 d-------- C:\Documents and Settings\Administrator\Dane aplikacji\CyberLink<CYBERL~1> 2007-03-10 15:26:28 46 --ah----- C:\CONFIG.SYS 2007-02-11 19:25:04 18944 --a------ C:\WINNT\System32\usbpda.dll 2006-12-24 22:58:22 80 --a------ C:\WINNT\gmer_uninstall.cmd<GMER_U~1.CMD> 2006-12-24 11:44:22 6239 --a------ C:\WINNT\m00rp88.exe 2006-12-24 11:42:36 13557 --a------ C:\WINNT\System32\start2.exe 2006-12-24 11:42:24 53299 --a------ C:\WINNT\System32\pthreadVC.dll<PTHREA~1.DLL> 2006-12-24 11:42:04 45056 --a------ C:\WINNT\wpcem.exe 2006-12-24 11:42:04 20480 --a------ C:\WINNT\System32\z3128.dll 2006-12-24 11:42:04 233472 --a------ C:\WINNT\System32\wpcap.dll 2006-12-24 11:42:04 61440 --a------ C:\WINNT\System32\WanPacket.dll<WANPAC~1.DLL> 2006-12-24 11:42:04 81920 --a------ C:\WINNT\System32\Packet.dll 2006-12-24 02:36:20 6239 --a------ C:\WINNT\k4axkP0.exe 2006-12-24 02:34:02 20480 --a------ C:\WINNT\System32\z3619.dll 2006-12-24 02:25:12 16384 --a------ C:\WINNT\System32\Perflib_Perfdata_d1c.dat<PERFLI~1.DAT> 2006-12-24 02:23:32 34997 --a------ C:\WINNT\System32\kgjf32.dll 2006-12-24 02:23:30 38069 --a------ C:\WINNT\System32\z2271.exe 2006-12-24 02:23:12 6239 --a------ C:\WINNT\f˙fwŕu5.exe 2006-12-24 02:20:44 20480 --a------ C:\WINNT\System32\z3609.dll 2006-12-24 02:18:04 1443483 --a------ C:\Documents and Settings\Administrator\Dane aplikacji\Install.dat 2006-12-24 02:17:24 20425 -r-h----- C:\WINNT\System32\syst7.exe 2006-12-24 02:17:22 6239 --a------ C:\WINNT\System32\IURv6n7.exe 2006-12-24 02:17:20 46592 --a------ C:\WINNT\System32\zlbw.dll 2006-12-24 02:17:20 128607 --a------ C:\WINNT\System32\ss.exe 2006-12-24 02:17:12 18015 --a------ C:\WINNT\System32\w.exe 2006-12-24 02:17:12 6239 --a------ C:\WINNT\System32\se.exe 2006-12-24 02:16:48 91973 --a------ C:\WINNT\System32\z16.exe 2006-12-24 02:16:44 391 --a------ C:\WINNT\System32\z14.exe 2006-12-24 02:16:44 6239 --a------ C:\WINNT\System32\z13.exe 2006-12-24 02:16:42 8609 --a------ C:\WINNT\System32\z2934.exe 2006-12-24 02:16:40 6239 --a------ C:\WINNT\System32\z2743.exe 2006-12-24 02:16:08 13824 --a------ C:\WINNT\System32\z2489.exe 2006-12-24 02:16:06 20480 --a------ C:\WINNT\System32\z3716.dll -- Registry Dump --------------------------------------------------------------- [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run] "internat.exe"="internat.exe" "Shareaza"="\"C:\\Program Files\\File Sharing Revolution\\Shareaza.exe\" -tray" "NBJ"="\"C:\\Program Files\\Ahead\\Nero BackItUp\\NBJ.exe\"" "Skype"="\"C:\\Program Files\\Skype\\Phone\\Skype.exe\" /nosplash /minimized" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run] "WinFast Schedule"="C:\\Program Files\\WinFast\\WFTVFM\\WFWIZ.exe" "WinFoxV2"="C:\\WINNT\\System32\\WF2K.EXE" "WinFast2KLoadDefault"="rundll32.exe wf2kcpl.dll,DllLoadDefaultSettings" "PrinTray"="C:\\WINNT\\System32\\spool\\DRIVERS\\W32X86\\2\\printray.exe" "Resume copy"="copyfstq.exe /startup" "CloneCDTray"="\"C:\\Program Files\\SlySoft\\CloneCD\\CloneCDTray.exe\" /s" "NeroFilterCheck"="C:\\WINNT\\system32\\NeroCheck.exe" "Synchronization Manager"="mobsync.exe /logon" "QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime" "RemoteControl"="\"C:\\Program Files\\CyberLink DVD Solution\\PowerDVD\\PDVDServ.exe\"" "InCD"="C:\\Program Files\\Ahead\\InCD\\InCD.exe" "LGODDFU"="\"C:\\Program Files\\lg_fwupdate\\fwupdate.exe\" blrun" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\IMAIL] "Installed"="1" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MAPI] "NoChange"="1" "Installed"="1" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MSFS] "Installed"="1" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\runonceex] "Flag"=dword:00000002 [HKEY_USERS\.default\software\microsoft\windows\currentversion\runonce] "^SetupICWDesktop"="C:\\Program Files\\Internet Explorer\\Connection Wizard\\icwconn1.exe /desktop" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks] "{54D9498B-CF93-414F-8984-8CE7FDE0D391}"="ewido shell guard" [HKEY_USERS\.default\software\microsoft\windows\currentversion\run] "internat.exe"="internat.exe" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "DisableRegistryTools"="0" [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system] @="0" "DisableRegristyTools"="0" [HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\system] "DisableTaskMgr"=dword:00000001 [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders] "SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll" [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Svchost] rpcss REG_MULTI_SZ RpcSs\0\0 HKLM\software\Microsoft\Windows NT\CurrentVersion\Svchost *netsvcs* Usbpda -- Hosts ----------------------------------------------------------------------- 127.0.0.1 01.SHAREDSOURCE.ORG 127.0.0.1 03.SHAREDSOURCE.ORG 127.0.0.1 05.SHAREDSOURCE.ORG 127.0.0.1 05P.COM 127.0.0.1 09.SHAREDSOURCE.ORG 127.0.0.1 093QPEUQPMZ6EBFA.COM 127.0.0.1 0TEXKAX7C6HZUIDK.COM 127.0.0.1 0XSEARCH.COM 127.0.0.1 17.SHAREDSOURCE.ORG 127.0.0.1 18.SHAREDSOURCE.ORG 423 more entries in hosts file. -- End of ComboScan: finished at 2007-03-14 at 20:18:57 ------------------------

**Posty:** 18165 · przez **wojtas** 14 Mar 2007, 21:32

Pobierz i uruchom narzędzie : The Avenger
http://swandog46.geekstogo.com/avenger.zip
Zaznacz opcję Input script manually i kliknij na Lupkę z prawej strony. W okienku, które się otworzy wklejasz:

Files to delete:

C:\WINNT\msnmessangern.exe
C:\WINNT\System32\dllcache\qxchost.exe

Klikasz Done, a następnie zielone światełko i zgadzasz się na restart klikając OK.

Kasujesz ręcznie z dysku plik: C:\Avenger\backup.zip i wklejasz na forum raport: C:\avenger.txt + log z comboscana

**Posty:** 52 · przez **rav2000** 14 Mar 2007, 21:36

NAJMOCNIEJ PRZEPREZASZAM!
źle wykonałem polecenia.
teraz wykonałem poprawnie i daje nowe logi:

Kod: Zaznacz wszystko: Logfile of The Avenger version 1, by Swandog46 Running from registry key: \Registry\Machine\System\CurrentControlSet\Services\xlmoirgq ******************* Script file located at: \??\C:\gsknbxai.txt Script file opened successfully. Script file read successfully Backups directory opened successfully at C:\Avenger ******************* Beginning to process script file: File C:\WINNT\msnmessangern.exe deleted successfully. File C:\WINNT\System32\dllcache\qxchost.exe deleted successfully. Completed script processing. ******************* Finished! Terminate.

comboscan:

Kod: Zaznacz wszystko: ComboScan v20070306.20 run by Administrator on 2007-03-14 at 20:30:58 Computer is in Normal Mode. -------------------------------------------------------------------------------- -- HijackThis (run as Administrator.exe) --------------------------------------- Logfile of HijackThis v1.99.1 Scan saved at 20:30:59, on 2007-03-14 Platform: Windows 2000 (WinNT 5.00.2195) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINNT\System32\smss.exe C:\WINNT\system32\winlogon.exe C:\WINNT\system32\services.exe C:\WINNT\system32\lsass.exe C:\WINNT\system32\svchost.exe C:\WINNT\system32\LEXBCES.EXE C:\WINNT\system32\spoolsv.exe C:\WINNT\system32\LEXPPS.EXE C:\WINNT\System32\svchost.exe C:\Program Files\ewido anti-malware\ewidoctrl.exe C:\Program Files\Ahead\InCD\InCDsrv.exe C:\Program Files\Common Files\LightScribe\LSSrvc.exe C:\WINNT\System32\nvsvc32.exe C:\WINNT\system32\regsvc.exe C:\WINNT\system32\MSTask.exe C:\WINNT\system32\stisvc.exe C:\WINNT\System32\WBEM\WinMgmt.exe C:\WINNT\System32\mspmspsv.exe C:\WINNT\explorer.exe C:\Program Files\WinFast\WFTVFM\WFWIZ.exe C:\WINNT\System32\WF2K.EXE C:\WINNT\System32\spool\DRIVERS\W32X86\2\printray.exe C:\Program Files\QuickTime\qttask.exe C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe C:\Program Files\Ahead\InCD\InCD.exe C:\WINNT\System32\internat.exe C:\WINNT\system32\notepad.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Documents and Settings\Administrator\Pulpit\comboscan.exe E:\HIJACK~1\ADMINI~1.EXE R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.onet.pl/ R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx O4 - HKLM\..\Run: [WinFast Schedule] C:\Program Files\WinFast\WFTVFM\WFWIZ.exe O4 - HKLM\..\Run: [WinFoxV2] C:\WINNT\System32\WF2K.EXE O4 - HKLM\..\Run: [WinFast2KLoadDefault] rundll32.exe wf2kcpl.dll,DllLoadDefaultSettings O4 - HKLM\..\Run: [PrinTray] C:\WINNT\System32\spool\DRIVERS\W32X86\2\printray.exe O4 - HKLM\..\Run: [Resume copy] copyfstq.exe /startup O4 - HKLM\..\Run: [CloneCDTray] "C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe" /s O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINNT\system32\NeroCheck.exe O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe" O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe O4 - HKLM\..\Run: [LGODDFU] "C:\Program Files\lg_fwupdate\fwupdate.exe" blrun O4 - HKCU\..\Run: [internat.exe] internat.exe O4 - HKCU\..\Run: [Shareaza] "C:\Program Files\File Sharing Revolution\Shareaza.exe" -tray O4 - HKCU\..\Run: [NBJ] "C:\Program Files\Ahead\Nero BackItUp\NBJ.exe" O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE O4 - Global Startup: Przyspieszenie uruchomienia programu AutoCAD.lnk = C:\Program Files\Common Files\Autodesk Shared\acstart16.exe O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar2.dll/cmsearch.html O8 - Extra context menu item: Backward &Links - res://C:\Program Files\Google\GoogleToolbar2.dll/cmbacklinks.html O8 - Extra context menu item: Cac&hed Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar2.dll/cmcache.html O8 - Extra context menu item: Si&milar Pages - res://C:\Program Files\Google\GoogleToolbar2.dll/cmsimilar.html O8 - Extra context menu item: Translate into English - res://C:\Program Files\Google\GoogleToolbar2.dll/cmtrans.html O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://download.ewido.net/ewidoOnlineScan.cab O23 - Service: Autodesk Licensing Service - Autodesk, Inc. - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe O23 - Service: Usługa administracyjna Menedżera dysków logicznych (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Ahead\InCD\InCDsrv.exe O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINNT\system32\LEXBCES.EXE O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINNT\System32\nvsvc32.exe -- Files created between 2007-02-14 and 2007-03-14 ----------------------------- 2007-03-14 20:26:17 0 d-------- C:\avenger 2007-03-10 23:40:05 8464 --a------ C:\WINNT\System32\kbdkor.dll 2007-03-10 23:40:05 6416 --a------ C:\WINNT\System32\kbd103.dll 2007-03-10 23:40:05 6928 --a------ C:\WINNT\System32\kbd101c.dll 2007-03-10 23:40:05 6416 --a------ C:\WINNT\System32\kbd101b.dll 2007-03-10 23:35:21 0 d-------- C:\Temp 2007-03-10 23:12:20 102912 --a------ C:\WINNT\System32\Vb6stkit.dll 2007-03-10 23:12:20 102160 --a------ C:\WINNT\System32\VB6KO.DLL 2007-03-10 23:12:20 16384 --a------ C:\WINNT\System32\lgfwunis.exe 2007-03-10 23:12:19 0 d-------- C:\Program Files\lg_fwupdate<LG_FWU~1> 2007-03-10 23:05:22 0 d-------- C:\Program Files\Common Files\LightScribe<LIGHTS~1> 2007-03-10 23:04:05 2973696 -----n--- C:\WINNT\NuNinst.exe 2007-03-10 23:04:03 6400 -----n--- C:\WINNT\System32\drivers\InCDFatRec.sys<INCDFA~1.SYS> 2007-03-10 23:04:03 134144 -----n--- C:\WINNT\System32\drivers\InCDFat.sys 2007-03-10 23:04:02 28672 -----n--- C:\WINNT\System32\drivers\InCDrm.sys 2007-03-10 23:04:02 8704 -----n--- C:\WINNT\System32\drivers\InCDrec.sys 2007-03-10 23:04:02 29696 -----n--- C:\WINNT\System32\drivers\InCDpass.sys 2007-03-10 23:04:02 99584 -----n--- C:\WINNT\System32\drivers\InCDfs.sys 2007-03-10 23:04:00 0 d-------- C:\WINNT\InCD 2007-03-10 23:02:35 40960 --a------ C:\Program Files\Uninstall_CDS.exe<UNINST~1.EXE> 2007-03-10 23:02:34 0 d-------- C:\Program Files\CyberLink DVD Solution<CYBERL~2> 2007-03-10 16:24:36 2916352 -----n--- C:\WINNT\UNNMP.exe 2007-03-10 16:23:25 0 d-------- C:\Program Files\Common Files\Nero 2007-03-10 16:19:57 416800 --a------ C:\WINNT\System32\msvcp60.dll 2007-03-10 16:19:54 0 d-------- C:\Program Files\CyberLink<CYBERL~1> 2007-03-10 16:05:01 364544 -----n--- C:\WINNT\System32\TwnLib4.dll 2007-03-10 16:05:01 106496 --a------ C:\WINNT\System32\TwnLib20.dll 2007-03-10 16:05:01 471040 -----n--- C:\WINNT\System32\ImagXRA7.dll 2007-03-10 16:05:01 262144 -----n--- C:\WINNT\System32\ImagXR7.dll 2007-03-10 16:05:01 476320 -----n--- C:\WINNT\System32\ImagXpr7.dll 2007-03-10 16:05:01 1568768 -----n--- C:\WINNT\System32\ImagX7.dll 2007-03-10 15:26:27 30 --a------ C:\AUTOEXEC.BAT 2007-03-10 15:26:22 0 d-------- C:\CDROM -- Find3M Report --------------------------------------------------------------- 2007-03-14 18:56:02 17168 --a------ C:\WINNT\System32\tftp.exe 2007-03-14 18:56:02 39696 --a------ C:\WINNT\System32\ftp.exe 2007-03-10 16:35:34 0 d-------- C:\Documents and Settings\Administrator\Dane aplikacji\CyberLink<CYBERL~1> 2007-03-10 15:26:28 46 --ah----- C:\CONFIG.SYS 2007-02-11 19:25:04 18944 --a------ C:\WINNT\System32\usbpda.dll 2006-12-24 22:58:22 80 --a------ C:\WINNT\gmer_uninstall.cmd<GMER_U~1.CMD> 2006-12-24 11:44:22 6239 --a------ C:\WINNT\m00rp88.exe 2006-12-24 11:42:36 13557 --a------ C:\WINNT\System32\start2.exe 2006-12-24 11:42:24 53299 --a------ C:\WINNT\System32\pthreadVC.dll<PTHREA~1.DLL> 2006-12-24 11:42:04 45056 --a------ C:\WINNT\wpcem.exe 2006-12-24 11:42:04 20480 --a------ C:\WINNT\System32\z3128.dll 2006-12-24 11:42:04 233472 --a------ C:\WINNT\System32\wpcap.dll 2006-12-24 11:42:04 61440 --a------ C:\WINNT\System32\WanPacket.dll<WANPAC~1.DLL> 2006-12-24 11:42:04 81920 --a------ C:\WINNT\System32\Packet.dll 2006-12-24 02:36:20 6239 --a------ C:\WINNT\k4axkP0.exe 2006-12-24 02:34:02 20480 --a------ C:\WINNT\System32\z3619.dll 2006-12-24 02:25:12 16384 --a------ C:\WINNT\System32\Perflib_Perfdata_d1c.dat<PERFLI~1.DAT> 2006-12-24 02:23:32 34997 --a------ C:\WINNT\System32\kgjf32.dll 2006-12-24 02:23:30 38069 --a------ C:\WINNT\System32\z2271.exe 2006-12-24 02:23:12 6239 --a------ C:\WINNT\f˙fwŕu5.exe 2006-12-24 02:20:44 20480 --a------ C:\WINNT\System32\z3609.dll 2006-12-24 02:18:04 1443483 --a------ C:\Documents and Settings\Administrator\Dane aplikacji\Install.dat 2006-12-24 02:17:24 20425 -r-h----- C:\WINNT\System32\syst7.exe 2006-12-24 02:17:22 6239 --a------ C:\WINNT\System32\IURv6n7.exe 2006-12-24 02:17:20 46592 --a------ C:\WINNT\System32\zlbw.dll 2006-12-24 02:17:20 128607 --a------ C:\WINNT\System32\ss.exe 2006-12-24 02:17:12 18015 --a------ C:\WINNT\System32\w.exe 2006-12-24 02:17:12 6239 --a------ C:\WINNT\System32\se.exe 2006-12-24 02:16:48 91973 --a------ C:\WINNT\System32\z16.exe 2006-12-24 02:16:44 391 --a------ C:\WINNT\System32\z14.exe 2006-12-24 02:16:44 6239 --a------ C:\WINNT\System32\z13.exe 2006-12-24 02:16:42 8609 --a------ C:\WINNT\System32\z2934.exe 2006-12-24 02:16:40 6239 --a------ C:\WINNT\System32\z2743.exe 2006-12-24 02:16:08 13824 --a------ C:\WINNT\System32\z2489.exe 2006-12-24 02:16:06 20480 --a------ C:\WINNT\System32\z3716.dll -- Registry Dump --------------------------------------------------------------- [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run] "internat.exe"="internat.exe" "Shareaza"="\"C:\\Program Files\\File Sharing Revolution\\Shareaza.exe\" -tray" "NBJ"="\"C:\\Program Files\\Ahead\\Nero BackItUp\\NBJ.exe\"" "Skype"="\"C:\\Program Files\\Skype\\Phone\\Skype.exe\" /nosplash /minimized" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run] "WinFast Schedule"="C:\\Program Files\\WinFast\\WFTVFM\\WFWIZ.exe" "WinFoxV2"="C:\\WINNT\\System32\\WF2K.EXE" "WinFast2KLoadDefault"="rundll32.exe wf2kcpl.dll,DllLoadDefaultSettings" "PrinTray"="C:\\WINNT\\System32\\spool\\DRIVERS\\W32X86\\2\\printray.exe" "Resume copy"="copyfstq.exe /startup" "CloneCDTray"="\"C:\\Program Files\\SlySoft\\CloneCD\\CloneCDTray.exe\" /s" "NeroFilterCheck"="C:\\WINNT\\system32\\NeroCheck.exe" "Synchronization Manager"="mobsync.exe /logon" "QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime" "RemoteControl"="\"C:\\Program Files\\CyberLink DVD Solution\\PowerDVD\\PDVDServ.exe\"" "InCD"="C:\\Program Files\\Ahead\\InCD\\InCD.exe" "LGODDFU"="\"C:\\Program Files\\lg_fwupdate\\fwupdate.exe\" blrun" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\IMAIL] "Installed"="1" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MAPI] "NoChange"="1" "Installed"="1" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MSFS] "Installed"="1" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\runonceex] "Flag"=dword:00000002 [HKEY_USERS\.default\software\microsoft\windows\currentversion\runonce] "^SetupICWDesktop"="C:\\Program Files\\Internet Explorer\\Connection Wizard\\icwconn1.exe /desktop" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks] "{54D9498B-CF93-414F-8984-8CE7FDE0D391}"="ewido shell guard" [HKEY_USERS\.default\software\microsoft\windows\currentversion\run] "internat.exe"="internat.exe" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "DisableRegistryTools"="0" [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system] @="0" "DisableRegristyTools"="0" [HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\system] "DisableTaskMgr"=dword:00000001 [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders] "SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll" [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Svchost] rpcss REG_MULTI_SZ RpcSs\0\0 HKLM\software\Microsoft\Windows NT\CurrentVersion\Svchost *netsvcs* Usbpda -- End of ComboScan: finished at 2007-03-14 at 20:31:12 ------------------------

**Posty:** 18165 · przez **wojtas** 14 Mar 2007, 22:05

Odpal avengera
Zaznacz opcję Input script manually i kliknij na Lupkę z prawej strony. W okienku, które się otworzy wklejasz:

Files to delete:

C:\WINNT\m00rp88.exe
C:\WINNT\System32\start2.exe
C:\WINNT\System32\z3128.dll
C:\WINNT\k4axkP0.exe
C:\WINNT\System32\z3619.dll
C:\WINNT\System32\kgjf32.dll
C:\WINNT\System32\z2271.exe
C:\WINNT\f˙fwŕu5.exe
C:\WINNT\System32\z3609.dll
C:\WINNT\System32\syst7.exe
C:\WINNT\System32\IURv6n7.exe
C:\WINNT\System32\zlbw.dll
C:\WINNT\System32\ss.exe
C:\WINNT\System32\w.exe
C:\WINNT\System32\se.exe
C:\WINNT\System32\z16.exe
C:\WINNT\System32\z14.exe
C:\WINNT\System32\z13.exe
C:\WINNT\System32\z2934.exe
C:\WINNT\System32\z2743.exe
C:\WINNT\System32\z2489.exe
C:\WINNT\System32\z3716.dll

Klikasz Done, a następnie zielone światełko i zgadzasz się na restart klikając OK.

Kasujesz ręcznie z dysku plik: C:\Avenger\backup.zip i wklejasz na forum raport: C:\avenger.txt + log z comboscana

**Posty:** 52 · przez **rav2000** 14 Mar 2007, 22:48

Wykonałem
Oto nowe logi:

Kod: Zaznacz wszystko: Logfile of The Avenger version 1, by Swandog46 Running from registry key: \Registry\Machine\System\CurrentControlSet\Services\wyolopxx ******************* Script file located at: \??\C:\ubycfeeu.txt Script file opened successfully. Script file read successfully Backups directory opened successfully at C:\Avenger ******************* Beginning to process script file: File C:\WINNT\m00rp88.exe deleted successfully. File C:\WINNT\System32\start2.exe deleted successfully. File C:\WINNT\System32\z3128.dll deleted successfully. File C:\WINNT\k4axkP0.exe deleted successfully. File C:\WINNT\System32\z3619.dll deleted successfully. File C:\WINNT\System32\kgjf32.dll deleted successfully. File C:\WINNT\System32\z2271.exe deleted successfully. File C:\WINNT\f˙fwŕu5.exe deleted successfully. File C:\WINNT\System32\z3609.dll deleted successfully. File C:\WINNT\System32\syst7.exe deleted successfully. File C:\WINNT\System32\IURv6n7.exe deleted successfully. File C:\WINNT\System32\zlbw.dll deleted successfully. File C:\WINNT\System32\ss.exe deleted successfully. File C:\WINNT\System32\w.exe deleted successfully. File C:\WINNT\System32\se.exe deleted successfully. File C:\WINNT\System32\z16.exe deleted successfully. File C:\WINNT\System32\z14.exe deleted successfully. File C:\WINNT\System32\z13.exe deleted successfully. File C:\WINNT\System32\z2934.exe deleted successfully. File C:\WINNT\System32\z2743.exe deleted successfully. File C:\WINNT\System32\z2489.exe deleted successfully. File C:\WINNT\System32\z3716.dll deleted successfully. Completed script processing. ******************* Finished! Terminate.

comboscan:

Kod: Zaznacz wszystko: ComboScan v20070306.20 run by Administrator on 2007-03-14 at 21:44:03 Computer is in Normal Mode. -------------------------------------------------------------------------------- -- HijackThis (run as Administrator.exe) --------------------------------------- Logfile of HijackThis v1.99.1 Scan saved at 21:44:04, on 2007-03-14 Platform: Windows 2000 (WinNT 5.00.2195) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINNT\System32\smss.exe C:\WINNT\system32\winlogon.exe C:\WINNT\system32\services.exe C:\WINNT\system32\lsass.exe C:\WINNT\system32\svchost.exe C:\WINNT\system32\LEXBCES.EXE C:\WINNT\system32\spoolsv.exe C:\WINNT\system32\LEXPPS.EXE C:\WINNT\System32\svchost.exe C:\Program Files\ewido anti-malware\ewidoctrl.exe C:\Program Files\Ahead\InCD\InCDsrv.exe C:\Program Files\Common Files\LightScribe\LSSrvc.exe C:\WINNT\System32\nvsvc32.exe C:\WINNT\system32\regsvc.exe C:\WINNT\system32\MSTask.exe C:\WINNT\system32\stisvc.exe C:\WINNT\System32\WBEM\WinMgmt.exe C:\WINNT\System32\mspmspsv.exe C:\WINNT\explorer.exe C:\Program Files\WinFast\WFTVFM\WFWIZ.exe C:\WINNT\System32\WF2K.EXE C:\WINNT\System32\spool\DRIVERS\W32X86\2\printray.exe C:\Program Files\QuickTime\qttask.exe C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe C:\Program Files\Ahead\InCD\InCD.exe C:\WINNT\System32\internat.exe C:\WINNT\system32\notepad.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Documents and Settings\Administrator\Pulpit\comboscan.exe E:\HIJACK~1\ADMINI~1.EXE R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.onet.pl/ R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx O4 - HKLM\..\Run: [WinFast Schedule] C:\Program Files\WinFast\WFTVFM\WFWIZ.exe O4 - HKLM\..\Run: [WinFoxV2] C:\WINNT\System32\WF2K.EXE O4 - HKLM\..\Run: [WinFast2KLoadDefault] rundll32.exe wf2kcpl.dll,DllLoadDefaultSettings O4 - HKLM\..\Run: [PrinTray] C:\WINNT\System32\spool\DRIVERS\W32X86\2\printray.exe O4 - HKLM\..\Run: [Resume copy] copyfstq.exe /startup O4 - HKLM\..\Run: [CloneCDTray] "C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe" /s O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINNT\system32\NeroCheck.exe O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe" O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe O4 - HKLM\..\Run: [LGODDFU] "C:\Program Files\lg_fwupdate\fwupdate.exe" blrun O4 - HKCU\..\Run: [internat.exe] internat.exe O4 - HKCU\..\Run: [Shareaza] "C:\Program Files\File Sharing Revolution\Shareaza.exe" -tray O4 - HKCU\..\Run: [NBJ] "C:\Program Files\Ahead\Nero BackItUp\NBJ.exe" O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE O4 - Global Startup: Przyspieszenie uruchomienia programu AutoCAD.lnk = C:\Program Files\Common Files\Autodesk Shared\acstart16.exe O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar2.dll/cmsearch.html O8 - Extra context menu item: Backward &Links - res://C:\Program Files\Google\GoogleToolbar2.dll/cmbacklinks.html O8 - Extra context menu item: Cac&hed Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar2.dll/cmcache.html O8 - Extra context menu item: Si&milar Pages - res://C:\Program Files\Google\GoogleToolbar2.dll/cmsimilar.html O8 - Extra context menu item: Translate into English - res://C:\Program Files\Google\GoogleToolbar2.dll/cmtrans.html O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://download.ewido.net/ewidoOnlineScan.cab O23 - Service: Autodesk Licensing Service - Autodesk, Inc. - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe O23 - Service: Usługa administracyjna Menedżera dysków logicznych (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Ahead\InCD\InCDsrv.exe O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINNT\system32\LEXBCES.EXE O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINNT\System32\nvsvc32.exe -- Files created between 2007-02-14 and 2007-03-14 ----------------------------- 2007-03-14 21:40:45 0 d-------- C:\avenger 2007-03-10 23:40:05 8464 --a------ C:\WINNT\System32\kbdkor.dll 2007-03-10 23:40:05 6416 --a------ C:\WINNT\System32\kbd103.dll 2007-03-10 23:40:05 6928 --a------ C:\WINNT\System32\kbd101c.dll 2007-03-10 23:40:05 6416 --a------ C:\WINNT\System32\kbd101b.dll 2007-03-10 23:35:21 0 d-------- C:\Temp 2007-03-10 23:12:20 102912 --a------ C:\WINNT\System32\Vb6stkit.dll 2007-03-10 23:12:20 102160 --a------ C:\WINNT\System32\VB6KO.DLL 2007-03-10 23:12:20 16384 --a------ C:\WINNT\System32\lgfwunis.exe 2007-03-10 23:12:19 0 d-------- C:\Program Files\lg_fwupdate<LG_FWU~1> 2007-03-10 23:05:22 0 d-------- C:\Program Files\Common Files\LightScribe<LIGHTS~1> 2007-03-10 23:04:05 2973696 -----n--- C:\WINNT\NuNinst.exe 2007-03-10 23:04:03 6400 -----n--- C:\WINNT\System32\drivers\InCDFatRec.sys<INCDFA~1.SYS> 2007-03-10 23:04:03 134144 -----n--- C:\WINNT\System32\drivers\InCDFat.sys 2007-03-10 23:04:02 28672 -----n--- C:\WINNT\System32\drivers\InCDrm.sys 2007-03-10 23:04:02 8704 -----n--- C:\WINNT\System32\drivers\InCDrec.sys 2007-03-10 23:04:02 29696 -----n--- C:\WINNT\System32\drivers\InCDpass.sys 2007-03-10 23:04:02 99584 -----n--- C:\WINNT\System32\drivers\InCDfs.sys 2007-03-10 23:04:00 0 d-------- C:\WINNT\InCD 2007-03-10 23:02:35 40960 --a------ C:\Program Files\Uninstall_CDS.exe<UNINST~1.EXE> 2007-03-10 23:02:34 0 d-------- C:\Program Files\CyberLink DVD Solution<CYBERL~2> 2007-03-10 16:24:36 2916352 -----n--- C:\WINNT\UNNMP.exe 2007-03-10 16:23:25 0 d-------- C:\Program Files\Common Files\Nero 2007-03-10 16:19:57 416800 --a------ C:\WINNT\System32\msvcp60.dll 2007-03-10 16:19:54 0 d-------- C:\Program Files\CyberLink<CYBERL~1> 2007-03-10 16:05:01 364544 -----n--- C:\WINNT\System32\TwnLib4.dll 2007-03-10 16:05:01 106496 --a------ C:\WINNT\System32\TwnLib20.dll 2007-03-10 16:05:01 471040 -----n--- C:\WINNT\System32\ImagXRA7.dll 2007-03-10 16:05:01 262144 -----n--- C:\WINNT\System32\ImagXR7.dll 2007-03-10 16:05:01 476320 -----n--- C:\WINNT\System32\ImagXpr7.dll 2007-03-10 16:05:01 1568768 -----n--- C:\WINNT\System32\ImagX7.dll 2007-03-10 15:26:27 30 --a------ C:\AUTOEXEC.BAT 2007-03-10 15:26:22 0 d-------- C:\CDROM -- Find3M Report --------------------------------------------------------------- 2007-03-14 18:56:02 17168 --a------ C:\WINNT\System32\tftp.exe 2007-03-14 18:56:02 39696 --a------ C:\WINNT\System32\ftp.exe 2007-03-10 16:35:34 0 d-------- C:\Documents and Settings\Administrator\Dane aplikacji\CyberLink<CYBERL~1> 2007-03-10 15:26:28 46 --ah----- C:\CONFIG.SYS 2007-02-11 19:25:04 18944 --a------ C:\WINNT\System32\usbpda.dll 2006-12-24 22:58:22 80 --a------ C:\WINNT\gmer_uninstall.cmd<GMER_U~1.CMD> 2006-12-24 11:42:24 53299 --a------ C:\WINNT\System32\pthreadVC.dll<PTHREA~1.DLL> 2006-12-24 11:42:04 45056 --a------ C:\WINNT\wpcem.exe 2006-12-24 11:42:04 233472 --a------ C:\WINNT\System32\wpcap.dll 2006-12-24 11:42:04 61440 --a------ C:\WINNT\System32\WanPacket.dll<WANPAC~1.DLL> 2006-12-24 11:42:04 81920 --a------ C:\WINNT\System32\Packet.dll 2006-12-24 02:25:12 16384 --a------ C:\WINNT\System32\Perflib_Perfdata_d1c.dat<PERFLI~1.DAT> 2006-12-24 02:18:04 1443483 --a------ C:\Documents and Settings\Administrator\Dane aplikacji\Install.dat -- Registry Dump --------------------------------------------------------------- [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run] "internat.exe"="internat.exe" "Shareaza"="\"C:\\Program Files\\File Sharing Revolution\\Shareaza.exe\" -tray" "NBJ"="\"C:\\Program Files\\Ahead\\Nero BackItUp\\NBJ.exe\"" "Skype"="\"C:\\Program Files\\Skype\\Phone\\Skype.exe\" /nosplash /minimized" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run] "WinFast Schedule"="C:\\Program Files\\WinFast\\WFTVFM\\WFWIZ.exe" "WinFoxV2"="C:\\WINNT\\System32\\WF2K.EXE" "WinFast2KLoadDefault"="rundll32.exe wf2kcpl.dll,DllLoadDefaultSettings" "PrinTray"="C:\\WINNT\\System32\\spool\\DRIVERS\\W32X86\\2\\printray.exe" "Resume copy"="copyfstq.exe /startup" "CloneCDTray"="\"C:\\Program Files\\SlySoft\\CloneCD\\CloneCDTray.exe\" /s" "NeroFilterCheck"="C:\\WINNT\\system32\\NeroCheck.exe" "Synchronization Manager"="mobsync.exe /logon" "QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime" "RemoteControl"="\"C:\\Program Files\\CyberLink DVD Solution\\PowerDVD\\PDVDServ.exe\"" "InCD"="C:\\Program Files\\Ahead\\InCD\\InCD.exe" "LGODDFU"="\"C:\\Program Files\\lg_fwupdate\\fwupdate.exe\" blrun" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\IMAIL] "Installed"="1" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MAPI] "NoChange"="1" "Installed"="1" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MSFS] "Installed"="1" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\runonceex] "Flag"=dword:00000002 [HKEY_USERS\.default\software\microsoft\windows\currentversion\runonce] "^SetupICWDesktop"="C:\\Program Files\\Internet Explorer\\Connection Wizard\\icwconn1.exe /desktop" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks] "{54D9498B-CF93-414F-8984-8CE7FDE0D391}"="ewido shell guard" [HKEY_USERS\.default\software\microsoft\windows\currentversion\run] "internat.exe"="internat.exe" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "DisableRegistryTools"="0" [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system] @="0" "DisableRegristyTools"="0" [HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\system] "DisableTaskMgr"=dword:00000001 [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders] "SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll" [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Svchost] rpcss REG_MULTI_SZ RpcSs\0\0 HKLM\software\Microsoft\Windows NT\CurrentVersion\Svchost *netsvcs* Usbpda -- End of ComboScan: finished at 2007-03-14 at 21:44:16 ------------------------

**Posty:** 18165 · przez **wojtas** 14 Mar 2007, 22:52

wklej do notatnika:

REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"DisableTaskMgr"=dword:00000000

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Group Policy Objects\LocalUser\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"DisableTaskMgr"=dword:00000000
"**del.DisableTaskMgr"=" "

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system]
"DisableTaskMgr"=dword:00000000

Plik >>> Zapisz jako >>> Zmień rozszerzenie z TXT na Wszystkie pliki >>> zasejwuj pod nazwą TASKMG.REG

Plik podwójnie klikasz i potwierdzasz.

jak to wykonasz to bedzie ok :banan:

**Posty:** 52 · przez **rav2000** 14 Mar 2007, 23:14

Wykonałem:
Podaje jescze logi:
comboscan

Kod: Zaznacz wszystko: ComboScan v20070306.20 run by Administrator on 2007-03-14 at 22:09:43 Computer is in Normal Mode. -------------------------------------------------------------------------------- -- HijackThis (run as Administrator.exe) --------------------------------------- Logfile of HijackThis v1.99.1 Scan saved at 22:09:44, on 2007-03-14 Platform: Windows 2000 (WinNT 5.00.2195) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINNT\System32\smss.exe C:\WINNT\system32\winlogon.exe C:\WINNT\system32\services.exe C:\WINNT\system32\lsass.exe C:\WINNT\system32\svchost.exe C:\WINNT\system32\LEXBCES.EXE C:\WINNT\system32\spoolsv.exe C:\WINNT\system32\LEXPPS.EXE C:\WINNT\System32\svchost.exe C:\Program Files\ewido anti-malware\ewidoctrl.exe C:\Program Files\Ahead\InCD\InCDsrv.exe C:\Program Files\Common Files\LightScribe\LSSrvc.exe C:\WINNT\System32\nvsvc32.exe C:\WINNT\system32\regsvc.exe C:\WINNT\system32\MSTask.exe C:\WINNT\system32\stisvc.exe C:\WINNT\System32\WBEM\WinMgmt.exe C:\WINNT\System32\mspmspsv.exe C:\WINNT\explorer.exe C:\Program Files\WinFast\WFTVFM\WFWIZ.exe C:\WINNT\System32\WF2K.EXE C:\WINNT\System32\spool\DRIVERS\W32X86\2\printray.exe C:\Program Files\QuickTime\qttask.exe C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe C:\Program Files\Ahead\InCD\InCD.exe C:\WINNT\System32\internat.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Documents and Settings\Administrator\Pulpit\comboscan.exe E:\HIJACK~1\ADMINI~1.EXE R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.onet.pl/ R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx O4 - HKLM\..\Run: [WinFast Schedule] C:\Program Files\WinFast\WFTVFM\WFWIZ.exe O4 - HKLM\..\Run: [WinFoxV2] C:\WINNT\System32\WF2K.EXE O4 - HKLM\..\Run: [WinFast2KLoadDefault] rundll32.exe wf2kcpl.dll,DllLoadDefaultSettings O4 - HKLM\..\Run: [PrinTray] C:\WINNT\System32\spool\DRIVERS\W32X86\2\printray.exe O4 - HKLM\..\Run: [Resume copy] copyfstq.exe /startup O4 - HKLM\..\Run: [CloneCDTray] "C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe" /s O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINNT\system32\NeroCheck.exe O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe" O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe O4 - HKLM\..\Run: [LGODDFU] "C:\Program Files\lg_fwupdate\fwupdate.exe" blrun O4 - HKCU\..\Run: [internat.exe] internat.exe O4 - HKCU\..\Run: [Shareaza] "C:\Program Files\File Sharing Revolution\Shareaza.exe" -tray O4 - HKCU\..\Run: [NBJ] "C:\Program Files\Ahead\Nero BackItUp\NBJ.exe" O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE O4 - Global Startup: Przyspieszenie uruchomienia programu AutoCAD.lnk = C:\Program Files\Common Files\Autodesk Shared\acstart16.exe O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar2.dll/cmsearch.html O8 - Extra context menu item: Backward &Links - res://C:\Program Files\Google\GoogleToolbar2.dll/cmbacklinks.html O8 - Extra context menu item: Cac&hed Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar2.dll/cmcache.html O8 - Extra context menu item: Si&milar Pages - res://C:\Program Files\Google\GoogleToolbar2.dll/cmsimilar.html O8 - Extra context menu item: Translate into English - res://C:\Program Files\Google\GoogleToolbar2.dll/cmtrans.html O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://download.ewido.net/ewidoOnlineScan.cab O23 - Service: Autodesk Licensing Service - Autodesk, Inc. - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe O23 - Service: Usługa administracyjna Menedżera dysków logicznych (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Ahead\InCD\InCDsrv.exe O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINNT\system32\LEXBCES.EXE O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINNT\System32\nvsvc32.exe -- Files created between 2007-02-14 and 2007-03-14 ----------------------------- 2007-03-14 21:40:45 0 d-------- C:\avenger 2007-03-10 23:40:05 8464 --a------ C:\WINNT\System32\kbdkor.dll 2007-03-10 23:40:05 6416 --a------ C:\WINNT\System32\kbd103.dll 2007-03-10 23:40:05 6928 --a------ C:\WINNT\System32\kbd101c.dll 2007-03-10 23:40:05 6416 --a------ C:\WINNT\System32\kbd101b.dll 2007-03-10 23:35:21 0 d-------- C:\Temp 2007-03-10 23:12:20 102912 --a------ C:\WINNT\System32\Vb6stkit.dll 2007-03-10 23:12:20 102160 --a------ C:\WINNT\System32\VB6KO.DLL 2007-03-10 23:12:20 16384 --a------ C:\WINNT\System32\lgfwunis.exe 2007-03-10 23:12:19 0 d-------- C:\Program Files\lg_fwupdate<LG_FWU~1> 2007-03-10 23:05:22 0 d-------- C:\Program Files\Common Files\LightScribe<LIGHTS~1> 2007-03-10 23:04:05 2973696 -----n--- C:\WINNT\NuNinst.exe 2007-03-10 23:04:03 6400 -----n--- C:\WINNT\System32\drivers\InCDFatRec.sys<INCDFA~1.SYS> 2007-03-10 23:04:03 134144 -----n--- C:\WINNT\System32\drivers\InCDFat.sys 2007-03-10 23:04:02 28672 -----n--- C:\WINNT\System32\drivers\InCDrm.sys 2007-03-10 23:04:02 8704 -----n--- C:\WINNT\System32\drivers\InCDrec.sys 2007-03-10 23:04:02 29696 -----n--- C:\WINNT\System32\drivers\InCDpass.sys 2007-03-10 23:04:02 99584 -----n--- C:\WINNT\System32\drivers\InCDfs.sys 2007-03-10 23:04:00 0 d-------- C:\WINNT\InCD 2007-03-10 23:02:35 40960 --a------ C:\Program Files\Uninstall_CDS.exe<UNINST~1.EXE> 2007-03-10 23:02:34 0 d-------- C:\Program Files\CyberLink DVD Solution<CYBERL~2> 2007-03-10 16:24:36 2916352 -----n--- C:\WINNT\UNNMP.exe 2007-03-10 16:23:25 0 d-------- C:\Program Files\Common Files\Nero 2007-03-10 16:19:57 416800 --a------ C:\WINNT\System32\msvcp60.dll 2007-03-10 16:19:54 0 d-------- C:\Program Files\CyberLink<CYBERL~1> 2007-03-10 16:05:01 364544 -----n--- C:\WINNT\System32\TwnLib4.dll 2007-03-10 16:05:01 106496 --a------ C:\WINNT\System32\TwnLib20.dll 2007-03-10 16:05:01 471040 -----n--- C:\WINNT\System32\ImagXRA7.dll 2007-03-10 16:05:01 262144 -----n--- C:\WINNT\System32\ImagXR7.dll 2007-03-10 16:05:01 476320 -----n--- C:\WINNT\System32\ImagXpr7.dll 2007-03-10 16:05:01 1568768 -----n--- C:\WINNT\System32\ImagX7.dll 2007-03-10 15:26:27 30 --a------ C:\AUTOEXEC.BAT 2007-03-10 15:26:22 0 d-------- C:\CDROM -- Find3M Report --------------------------------------------------------------- 2007-03-14 18:56:02 17168 --a------ C:\WINNT\System32\tftp.exe 2007-03-14 18:56:02 39696 --a------ C:\WINNT\System32\ftp.exe 2007-03-10 16:35:34 0 d-------- C:\Documents and Settings\Administrator\Dane aplikacji\CyberLink<CYBERL~1> 2007-03-10 15:26:28 46 --ah----- C:\CONFIG.SYS 2007-02-11 19:25:04 18944 --a------ C:\WINNT\System32\usbpda.dll 2006-12-24 22:58:22 80 --a------ C:\WINNT\gmer_uninstall.cmd<GMER_U~1.CMD> 2006-12-24 11:42:24 53299 --a------ C:\WINNT\System32\pthreadVC.dll<PTHREA~1.DLL> 2006-12-24 11:42:04 45056 --a------ C:\WINNT\wpcem.exe 2006-12-24 11:42:04 233472 --a------ C:\WINNT\System32\wpcap.dll 2006-12-24 11:42:04 61440 --a------ C:\WINNT\System32\WanPacket.dll<WANPAC~1.DLL> 2006-12-24 11:42:04 81920 --a------ C:\WINNT\System32\Packet.dll 2006-12-24 02:25:12 16384 --a------ C:\WINNT\System32\Perflib_Perfdata_d1c.dat<PERFLI~1.DAT> 2006-12-24 02:18:04 1443483 --a------ C:\Documents and Settings\Administrator\Dane aplikacji\Install.dat -- Registry Dump --------------------------------------------------------------- [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run] "internat.exe"="internat.exe" "Shareaza"="\"C:\\Program Files\\File Sharing Revolution\\Shareaza.exe\" -tray" "NBJ"="\"C:\\Program Files\\Ahead\\Nero BackItUp\\NBJ.exe\"" "Skype"="\"C:\\Program Files\\Skype\\Phone\\Skype.exe\" /nosplash /minimized" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run] "WinFast Schedule"="C:\\Program Files\\WinFast\\WFTVFM\\WFWIZ.exe" "WinFoxV2"="C:\\WINNT\\System32\\WF2K.EXE" "WinFast2KLoadDefault"="rundll32.exe wf2kcpl.dll,DllLoadDefaultSettings" "PrinTray"="C:\\WINNT\\System32\\spool\\DRIVERS\\W32X86\\2\\printray.exe" "Resume copy"="copyfstq.exe /startup" "CloneCDTray"="\"C:\\Program Files\\SlySoft\\CloneCD\\CloneCDTray.exe\" /s" "NeroFilterCheck"="C:\\WINNT\\system32\\NeroCheck.exe" "Synchronization Manager"="mobsync.exe /logon" "QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime" "RemoteControl"="\"C:\\Program Files\\CyberLink DVD Solution\\PowerDVD\\PDVDServ.exe\"" "InCD"="C:\\Program Files\\Ahead\\InCD\\InCD.exe" "LGODDFU"="\"C:\\Program Files\\lg_fwupdate\\fwupdate.exe\" blrun" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\IMAIL] "Installed"="1" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MAPI] "NoChange"="1" "Installed"="1" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MSFS] "Installed"="1" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\runonceex] "Flag"=dword:00000002 [HKEY_USERS\.default\software\microsoft\windows\currentversion\runonce] "^SetupICWDesktop"="C:\\Program Files\\Internet Explorer\\Connection Wizard\\icwconn1.exe /desktop" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks] "{54D9498B-CF93-414F-8984-8CE7FDE0D391}"="ewido shell guard" [HKEY_USERS\.default\software\microsoft\windows\currentversion\run] "internat.exe"="internat.exe" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "DisableRegistryTools"="0" "DisableTaskMgr"=dword:00000000 [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system] @="0" "DisableRegristyTools"="0" "DisableTaskMgr"=dword:00000000 [HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\system] "DisableTaskMgr"=dword:00000001 [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders] "SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll" [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Svchost] rpcss REG_MULTI_SZ RpcSs\0\0 HKLM\software\Microsoft\Windows NT\CurrentVersion\Svchost *netsvcs* Usbpda -- End of ComboScan: finished at 2007-03-14 at 22:09:55 ------------------------

**Posty:** 18165 · przez **wojtas** 14 Mar 2007, 23:16

jest ok

**Posty:** 52 · przez **rav2000** 14 Mar 2007, 23:30

Ślicznie dziękuję za pomoc.
Pozdrawiam.

dziwne zachowanie systemu

dziwne zachowanie systemu

Kto jest na forum