dziwny, wkurzający błąd

**Posty:** 308 · przez **krzyhooo** 20 Lip 2007, 20:19

Witam, gdy skanuje kompa ad-aware'm najpierw wyskakuje mi tam kilkadziesiąt "critical object" (jak zawsze), a potem wyskakuje mi takie okienko odliczające czas do restartu. SCREEN
co mam z tym zrobić, żeby to okienko sie odwaliło ode mnie?
P.S wstawić loga?

**Posty:** 18165 · przez **wojtas** 20 Lip 2007, 20:23

krzyhooo napisał(a):P.S wstawić loga?

tak

**Posty:** 308 · przez **krzyhooo** 20 Lip 2007, 20:27

Kod: Zaznacz wszystko: Logfile of HijackThis v1.99.1 Scan saved at 20:23:39, on 2007-07-20 Platform: Windows XP (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 (6.00.2600.0000) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\WINDOWS\System32\CTsvcCDA.exe C:\Program Files\NetLimiter 2 Pro\nlsvc.exe C:\Program Files\Eset\nod32krn.exe C:\WINDOWS\System32\nvsvc32.exe C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe C:\WINDOWS\System32\MsPMSPSv.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Lexmark 3300 Series\lxccmon.exe C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe C:\Program Files\LClock\LClock.exe C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\WINDOWS\System32\rundll32.exe C:\Program Files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe C:\WINDOWS\System32\Rundll32.exe C:\WINDOWS\System32\lxcccoms.exe C:\WINDOWS\System32\ctfmon.exe C:\Program Files\Stardock\Object Desktop\WindowBlinds\WBInstall32.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Documents and Settings\Krzyhoo\Pulpit\yodm3D\Yodm3D.exe C:\Program Files\Creative\MediaSource5\Go\CTCMSGoU.exe c:\progra~1\intern~1\iexplore.exe C:\Program Files\Labtec Wireless Desktop\MagicKey.exe C:\Program Files\Labtec Wireless Desktop\MulMouse.exe C:\Program Files\Program sieciowy dla SAGEM Wi-Fi 11g USB adapter\WLANUTL.exe C:\Program Files\Labtec Wireless Desktop\OSD.EXE C:\Program Files\eMule\emule.exe C:\Documents and Settings\Krzyhoo\Moje dokumenty\Mozilla Firefox\firefox.exe C:\Program Files\Gadu-Gadu\gg.exe C:\Program Files\Winamp\winamp.exe C:\Documents and Settings\Krzyhoo\Pulpit\hijackthis_199\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.1.6.14.dll O2 - BHO: Big Fish Games Toolbar - {4E7BD74F-2B8D-469E-86BD-FD60BB9AAE3A} - C:\PROGRA~1\BFGTOO~1\BFGTOO~1.DLL (file missing) O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O2 - BHO: FlashFXP Helper for Internet Explorer - {E5A1691B-D188-4419-AD02-90002030B8EE} - C:\PROGRA~1\FlashFXP\IEFlash.dll O3 - Toolbar: Big Fish Games Toolbar - {4E7BD74F-2B8D-469E-86BD-FD60BB9AAE3A} - C:\PROGRA~1\BFGTOO~1\BFGTOO~1.DLL (file missing) O3 - Toolbar: Steganos Internet Anonym - {00000000-5736-4205-0008-781cd0e19f00} - c:\program files\steganos internet anonym pro 7\siapro7iep.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [LXCCCATS] rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXCCtime.dll,_RunDLLEntry@16 O4 - HKLM\..\Run: [lxccmon.exe] "C:\Program Files\Lexmark 3300 Series\lxccmon.exe" O4 - HKLM\..\Run: [FaxCenterServer] "C:\Program Files\Lexmark Fax Solutions\fm3032.exe" /s O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" O4 - HKLM\..\Run: [LClock] C:\Program Files\LClock\LClock.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe" O4 - HKLM\..\Run: [PestPatrol Control Center] c:\PROGRA~1\PESTPA~1\PPControl.exe O4 - HKLM\..\Run: [PPMemCheck] c:\PROGRA~1\PESTPA~1\PPMemCheck.exe O4 - HKLM\..\Run: [CookiePatrol] c:\PROGRA~1\PESTPA~1\CookiePatrol.exe O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [Super X Desktop Version 3.4.0730] C:\Program Files\Super X Desktop\SXDesk.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [UVS10 Preload] C:\Program Files\Ulead Systems\Ulead VideoStudio 10\uvPL.exe O4 - HKLM\..\Run: [Meow style new drive] C:\Documents and Settings\All Users\Dane aplikacji\Setup extra meow style\ACEFUNK.exe O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe /r O4 - HKLM\..\Run: [P17Helper] Rundll32 P17.dll,P17Helper O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE O4 - HKLM\..\Run: [OCAudioIni] C:\Program Files\One-click Audio Converter\OCAudioIni.exe O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe O4 - HKCU\..\Run: [Free Download Manager] C:\Program Files\Free Download Manager\fdm.exe -autorun O4 - HKCU\..\Run: [BitTorrent] "C:\Program Files\BitTorrent\bittorrent.exe" --force_start_minimized O4 - HKCU\..\Run: [WindowBlinds] C:\Program Files\Stardock\Object Desktop\WindowBlinds\WBInstall32.exe O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - HKCU\..\Run: [PlayVc] C:\DOCUME~1\Krzyhoo\DANEAP~1\16DENT~1\AntiMp3Bin.exe O4 - HKCU\..\Run: [Yodm3D] C:\Documents and Settings\Krzyhoo\Pulpit\yodm3D\Yodm3D.exe O4 - HKCU\..\Run: [Creative MediaSource Go] "C:\Program Files\Creative\MediaSource5\Go\CTCMSGoU.exe" /SCB O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: Enable Labtec Wireless Desktop.lnk = C:\Program Files\Labtec Wireless Desktop\MagicKey.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE O4 - Global Startup: Program sieciowy dla SAGEM Wi-Fi 11g USB adapter.lnk = ? O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm O8 - Extra context menu item: Add to AMV Convert Tool... - C:\Program Files\MP3 Player Utilities 4.00\AMVConverter\grab.html O8 - Extra context menu item: Add to AMV Converter... - C:\Program Files\MP3 Player Utilities 4.02\AMVConverter\grab.html O8 - Extra context menu item: MediaManager tool grab multimedia file - C:\Program Files\MP3 Player Utilities 4.00\MediaManager\grab.html O9 - Extra button: iOpus iMacros - {0483894E-2422-45E0-8384-021AFF1AF3CD} - C:\Program Files\iMacros\imacros.dll O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file) O10 - Unknown file in Winsock LSP: c:\windows\system32\ua_lsp.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\ua_lsp.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\ua_lsp.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\ua_lsp.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\ua_lsp.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\ua_lsp.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\ua_lsp.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\ua_lsp.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\ua_lsp.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\ua_lsp.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\ua_lsp.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\ua_lsp.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\ua_lsp.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\ua_lsp.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\ua_lsp.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\ua_lsp.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\ua_lsp.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\ua_lsp.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\ua_lsp.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\ua_lsp.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\ua_lsp.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\ua_lsp.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\ua_lsp.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\ua_lsp.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\ua_lsp.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\ua_lsp.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\ua_lsp.dll O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://downloads.ewido.net/ewidoOnlineScan.cab O16 - DPF: {5A09E43F-A0A7-4ABF-AF80-11367CF1DC8F} (MainControl Class) - http://mks.com.pl/skaner/SkanerOnline.cab O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1168084540624 O16 - DPF: {68282C51-9459-467B-95BF-3C0E89627E55} (MainControl Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1168084488202 O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/su2/CTL_V02002/ocx/15030/CTPID.cab O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O20 - AppInit_DLLs: wbsys.dll C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL O20 - Winlogon Notify: WBSrv - C:\PROGRA~1\Stardock\OBJECT~1\WINDOW~1\wbsrv.dll O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing) O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing) O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.exe O23 - Service: GoogleDesktopManager - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: lxcc_device - Lexmark International, Inc. - C:\WINDOWS\System32\lxcccoms.exe O23 - Service: NetLimiter (nlsvc) - Locktime Software - C:\Program Files\NetLimiter 2 Pro\nlsvc.exe O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing) O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe

Jak cokolwiek można odczytać z takiego loga? ja w nim nic nie widze

**Posty:** 18165 · przez **wojtas** 20 Lip 2007, 20:38

Użyj WWDC :
http://www.firewallleaktester.com/wwdc.htm
Zmień opcje z disable na enable. Uruchom ponownie komputer.
Tak powinny wyglądać porty (NetBIOS może być żółty) :
http://www.firewallleaktester.com/images_site/wwdc.jpg

zastosuj:

smitfraudfix z opcji 2:

http://siri.urz.free.fr/Fix/SmitfraudFix_En.php

oraz :

http://www.spywareedge.net/nolop/NoLop.exe

Start>uruchom>msconfig>zakladka uruchamianie> wylacz progsy które nie chcesz żeby startowaly z systemem przyspieszy Ci to wlaczanie kompa

potem nowy log z hijacka oraz combofixa

**Posty:** 308 · przez **krzyhooo** 20 Lip 2007, 20:54

wojtas19162 napisał(a):Zmień opcje z disable na enable.

jak to zrobić :?:

bo w tym programie to ja mam tak :arrow:

SCREEN
P.S. to drugie closed to nacisnąłem bo myślałem, że sie zmieni na enable....

**Posty:** 18165 · przez **wojtas** 20 Lip 2007, 22:17

kliknij na kazdy po jednym razie reset kompa i sprawdz czy bedziesz mial wszystkie zielone

**Posty:** 308 · przez **krzyhooo** 21 Lip 2007, 01:47

log z hijacka:

Kod: Zaznacz wszystko: Logfile of HijackThis v1.99.1 Scan saved at 01:43, on 2007-07-21 Platform: Windows XP (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 (6.00.2600.0000) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\WINDOWS\System32\CTsvcCDA.exe C:\Program Files\NetLimiter 2 Pro\nlsvc.exe C:\WINDOWS\System32\nvsvc32.exe C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe C:\WINDOWS\System32\MsPMSPSv.exe C:\Program Files\Lexmark 3300 Series\lxccmon.exe C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe C:\Program Files\LClock\LClock.exe C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\Program Files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe C:\WINDOWS\System32\Rundll32.exe C:\WINDOWS\System32\lxcccoms.exe C:\WINDOWS\System32\ctfmon.exe C:\Program Files\BitTorrent\bittorrent.exe C:\WINDOWS\System32\rundll32.exe C:\Program Files\Stardock\Object Desktop\WindowBlinds\WBInstall32.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Documents and Settings\Krzyhoo\Pulpit\yodm3D\Yodm3D.exe C:\Program Files\Creative\MediaSource5\Go\CTCMSGoU.exe c:\progra~1\intern~1\iexplore.exe C:\Program Files\Labtec Wireless Desktop\MagicKey.exe c:\progra~1\intern~1\iexplore.exe C:\Program Files\Labtec Wireless Desktop\MulMouse.exe C:\Program Files\Program sieciowy dla SAGEM Wi-Fi 11g USB adapter\WLANUTL.exe C:\Program Files\Labtec Wireless Desktop\OSD.EXE C:\Program Files\Eset\nod32krn.exe C:\Program Files\eMule\emule.exe C:\Documents and Settings\Krzyhoo\Moje dokumenty\Mozilla Firefox\firefox.exe C:\WINDOWS\explorer.exe C:\Program Files\Gadu-Gadu\gg.exe C:\Program Files\Winamp\winamp.exe C:\WINDOWS\system32\cmd.exe C:\WINDOWS\system32\cmd.exe C:\Documents and Settings\Krzyhoo\Pulpit\hijackthis_199\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = L1cza O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.1.6.14.dll O2 - BHO: Big Fish Games Toolbar - {4E7BD74F-2B8D-469E-86BD-FD60BB9AAE3A} - C:\PROGRA~1\BFGTOO~1\BFGTOO~1.DLL (file missing) O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O2 - BHO: FlashFXP Helper for Internet Explorer - {E5A1691B-D188-4419-AD02-90002030B8EE} - C:\PROGRA~1\FlashFXP\IEFlash.dll O3 - Toolbar: Big Fish Games Toolbar - {4E7BD74F-2B8D-469E-86BD-FD60BB9AAE3A} - C:\PROGRA~1\BFGTOO~1\BFGTOO~1.DLL (file missing) O3 - Toolbar: Steganos Internet Anonym - {00000000-5736-4205-0008-781cd0e19f00} - c:\program files\steganos internet anonym pro 7\siapro7iep.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [LXCCCATS] rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXCCtime.dll,_RunDLLEntry@16 O4 - HKLM\..\Run: [lxccmon.exe] "C:\Program Files\Lexmark 3300 Series\lxccmon.exe" O4 - HKLM\..\Run: [FaxCenterServer] "C:\Program Files\Lexmark Fax Solutions\fm3032.exe" /s O4 - HKLM\..\Run: [LClock] C:\Program Files\LClock\LClock.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe" O4 - HKLM\..\Run: [PestPatrol Control Center] c:\PROGRA~1\PESTPA~1\PPControl.exe O4 - HKLM\..\Run: [PPMemCheck] c:\PROGRA~1\PESTPA~1\PPMemCheck.exe O4 - HKLM\..\Run: [CookiePatrol] c:\PROGRA~1\PESTPA~1\CookiePatrol.exe O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [Super X Desktop Version 3.4.0730] C:\Program Files\Super X Desktop\SXDesk.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [UVS10 Preload] C:\Program Files\Ulead Systems\Ulead VideoStudio 10\uvPL.exe O4 - HKLM\..\Run: [Meow style new drive] C:\Documents and Settings\All Users\Dane aplikacji\Setup extra meow style\ACEFUNK.exe O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe /r O4 - HKLM\..\Run: [P17Helper] Rundll32 P17.dll,P17Helper O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE O4 - HKLM\..\Run: [OCAudioIni] C:\Program Files\One-click Audio Converter\OCAudioIni.exe O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe O4 - HKCU\..\Run: [Free Download Manager] C:\Program Files\Free Download Manager\fdm.exe -autorun O4 - HKCU\..\Run: [BitTorrent] "C:\Program Files\BitTorrent\bittorrent.exe" --force_start_minimized O4 - HKCU\..\Run: [WindowBlinds] C:\Program Files\Stardock\Object Desktop\WindowBlinds\WBInstall32.exe O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - HKCU\..\Run: [PlayVc] C:\DOCUME~1\Krzyhoo\DANEAP~1\16DENT~1\AntiMp3Bin.exe O4 - HKCU\..\Run: [Yodm3D] C:\Documents and Settings\Krzyhoo\Pulpit\yodm3D\Yodm3D.exe O4 - HKCU\..\Run: [Creative MediaSource Go] "C:\Program Files\Creative\MediaSource5\Go\CTCMSGoU.exe" /SCB O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: Enable Labtec Wireless Desktop.lnk = C:\Program Files\Labtec Wireless Desktop\MagicKey.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE O4 - Global Startup: Program sieciowy dla SAGEM Wi-Fi 11g USB adapter.lnk = ? O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm O8 - Extra context menu item: Add to AMV Convert Tool... - C:\Program Files\MP3 Player Utilities 4.00\AMVConverter\grab.html O8 - Extra context menu item: Add to AMV Converter... - C:\Program Files\MP3 Player Utilities 4.02\AMVConverter\grab.html O8 - Extra context menu item: MediaManager tool grab multimedia file - C:\Program Files\MP3 Player Utilities 4.00\MediaManager\grab.html O9 - Extra button: iOpus iMacros - {0483894E-2422-45E0-8384-021AFF1AF3CD} - C:\Program Files\iMacros\imacros.dll O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file) O10 - Unknown file in Winsock LSP: c:\windows\system32\ua_lsp.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\ua_lsp.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\ua_lsp.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\ua_lsp.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\ua_lsp.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\ua_lsp.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\ua_lsp.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\ua_lsp.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\ua_lsp.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\ua_lsp.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\ua_lsp.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\ua_lsp.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\ua_lsp.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\ua_lsp.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\ua_lsp.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\ua_lsp.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\ua_lsp.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\ua_lsp.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\ua_lsp.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\ua_lsp.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\ua_lsp.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\ua_lsp.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\ua_lsp.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\ua_lsp.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\ua_lsp.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\ua_lsp.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\ua_lsp.dll O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://downloads.ewido.net/ewidoOnlineScan.cab O16 - DPF: {5A09E43F-A0A7-4ABF-AF80-11367CF1DC8F} (MainControl Class) - http://mks.com.pl/skaner/SkanerOnline.cab O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1168084540624 O16 - DPF: {68282C51-9459-467B-95BF-3C0E89627E55} (MainControl Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1168084488202 O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/su2/CTL_V02002/ocx/15030/CTPID.cab O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O20 - AppInit_DLLs: wbsys.dll C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL O20 - Winlogon Notify: WBSrv - C:\PROGRA~1\Stardock\OBJECT~1\WINDOW~1\wbsrv.dll O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing) O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing) O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.exe O23 - Service: GoogleDesktopManager - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: lxcc_device - Lexmark International, Inc. - C:\WINDOWS\System32\lxcccoms.exe O23 - Service: NetLimiter (nlsvc) - Locktime Software - C:\Program Files\NetLimiter 2 Pro\nlsvc.exe O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing) O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe

a z tego combofix to nie wiem jak korzystać

**Posty:** 18165 · przez **wojtas** 21 Lip 2007, 17:53

krzyhooo napisał(a):a z tego combofix to nie wiem jak korzystać

sciagasz klikasz dwa razy potem 1 i enter , czekasz na loga ...

skasuj te wpisy + pogrubione:

O2 - BHO: Big Fish Games Toolbar - {4E7BD74F-2B8D-469E-86BD-FD60BB9AAE3A} - C:\PROGRA~1\BFGTOO~1\BFGTOO~1.DLL (file missing)
O3 - Toolbar: Big Fish Games Toolbar - {4E7BD74F-2B8D-469E-86BD-FD60BB9AAE3A} - C:\PROGRA~1\BFGTOO~1\BFGTOO~1.DLL (file missing)
O4 - HKLM\..\Run: [Meow style new drive] C:\Documents and Settings\All Users\Dane aplikacji\Setup extra meow style\ACEFUNK.exe
O4 - HKCU\..\Run: [PlayVc] C:\DOCUME~1\Krzyhoo\DANEAP~1\16DENT~1\AntiMp3Bin.exe
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)

znasz to:

O4 - HKCU\..\Run: [Yodm3D] C:\Documents and Settings\Krzyhoo\Pulpit\yodm3D\Yodm3D.exe

**Posty:** 8694 · przez **Red** 21 Lip 2007, 17:58

przenoszę

**Posty:** 308 · przez **krzyhooo** 21 Lip 2007, 19:19

wojtas19162 napisał(a):znasz to:

Cytat:
O4 - HKCU\..\Run: [Yodm3D] C:\Documents and Settings\Krzyhoo\Pulpit\yodm3D\Yodm3D.exe

no znam, to jest program do kostki pulpitowej, to też musze usuwać?

**Posty:** 18165 · przez **wojtas** 22 Lip 2007, 00:24

krzyhooo napisał(a):to też musze usuwać?

jesli znasz to nie ruszaj.. po usuwaniu daj nowe logi

**Posty:** 308 · przez **krzyhooo** 22 Lip 2007, 21:34

Combofix:

Kod: Zaznacz wszystko: "krzyhoo" - 2007-07-22 21:18:41 - ComboFix 07-07-14.6 NTFS ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) C:\Program Files\myglobalsearch C:\Program Files\myglobalsearch\bar\1.bin\M9FFXTBR.JAR C:\Program Files\myglobalsearch\bar\1.bin\M9FFXTBR.MANIFEST C:\Program Files\myglobalsearch\bar\1.bin\M9NTSTBR.JAR C:\Program Files\myglobalsearch\bar\1.bin\M9NTSTBR.MANIFEST C:\Program Files\myglobalsearch\bar\1.bin\MGSBAR.DLL C:\Program Files\myglobalsearch\bar\1.bin\NPMYGLSH.DLL C:\Program Files\myglobalsearch\bar\Cache\015D7B68 C:\Program Files\myglobalsearch\bar\Cache\015D8403 C:\Program Files\myglobalsearch\bar\Cache\015D880A.bin C:\Program Files\myglobalsearch\bar\Cache\015D8EFF.bin C:\Program Files\myglobalsearch\bar\Cache\015D92C8.bin C:\Program Files\myglobalsearch\bar\Cache\files.ini C:\Program Files\myglobalsearch\bar\History\search C:\Program Files\myglobalsearch\bar\Settings\prevcfg.htm ((((((((((((((((((((((((( Files Created from 2007-06-22 to 2007-07-22 ))))))))))))))))))))))))))))))) 2007-07-22 17:35 <DIR> d-------- C:\DOCUME~1\Krzyhoo\DANEAP~1\fretsonfire 2007-07-22 17:34 <DIR> d-------- C:\Program Files\Frets on Fire 2007-07-21 01:40 51,200 --a------ C:\WINDOWS\nircmd.exe 2007-07-21 00:10 4,424 --a------ C:\WINDOWS\system32\tmp.reg 2007-07-15 14:18 62,744 --a------ C:\WINDOWS\system32\xinput1_2.dll 2007-07-15 14:18 3,426,072 --a------ C:\WINDOWS\system32\d3dx9_32.dll 2007-07-15 14:18 251,672 --a------ C:\WINDOWS\system32\xactengine2_5.dll 2007-07-15 14:18 236,824 --a------ C:\WINDOWS\system32\xactengine2_3.dll 2007-07-15 14:18 15,128 --a------ C:\WINDOWS\system32\x3daudio1_1.dll 2007-07-15 13:52 <DIR> d-------- C:\Program Files\THQ 2007-07-10 21:47 <DIR> d-------- C:\DOCUME~1\Krzyhoo\DANEAP~1\Smart Recorder 2007-07-09 11:13 5,632 --a------ C:\WINDOWS\system32\drivers\Entech64.sys 2007-07-09 11:13 3,972 --a------ C:\WINDOWS\system32\drivers\PciBus.sys 2007-07-09 11:13 21,664 --a------ C:\WINDOWS\system32\drivers\Entech.sys 2007-07-09 11:13 <DIR> d-------- C:\WINDOWS\system32\Futuremark 2007-07-09 11:04 <DIR> d-------- C:\Program Files\Futuremark 2007-07-09 00:19 <DIR> d-------- C:\Program Files\MadOnion.com 2007-06-30 01:30 <DIR> d-------- C:\Program Files\One-click Audio Converter 2007-06-29 14:55 9,464 --------- C:\WINDOWS\system32\drivers\cdralw2k.sys 2007-06-29 14:55 9,336 --------- C:\WINDOWS\system32\drivers\cdr4_xp.sys 2007-06-29 14:55 129,784 --------- C:\WINDOWS\system32\pxafs.dll 2007-06-29 01:47 43,528 --------- C:\WINDOWS\system32\drivers\PxHelp20.sys 2007-06-29 01:47 151,552 --------- C:\WINDOWS\system32\pxwma.dll 2007-06-29 01:47 109,568 --------- C:\WINDOWS\system32\pxinsi64.exe 2007-06-29 01:47 108,544 --------- C:\WINDOWS\system32\pxcpyi64.exe 2007-06-28 23:32 12 --a------ C:\DOCUME~1\Krzyhoo\USERDATA.DAT 2007-06-28 19:15 44,032 --------- C:\WINDOWS\system32\CTSVCCDA.EXE 2007-06-28 19:15 25,088 --------- C:\WINDOWS\system32\CTSVCCTL.EXE 2007-06-28 18:44 <DIR> d-------- C:\DOCUME~1\Krzyhoo\DANEAP~1\Creative 2007-06-28 18:38 41,984 --------- C:\WINDOWS\Ctregrun.exe 2007-06-28 18:36 <DIR> d--h----- C:\Program Files\Creative Installation Information 2007-06-28 18:36 <DIR> d-------- C:\Program Files\Common Files\Creative 2007-06-28 18:31 90,112 --------- C:\WINDOWS\Updreg.EXE 2007-06-28 18:31 8,704 -ra------ C:\WINDOWS\system32\drivers\Pfmodnt.sys 2007-06-28 18:31 64,512 -ra------ C:\WINDOWS\system32\P17.dll 2007-06-28 18:31 57,344 --a------ C:\WINDOWS\system32\drivers\drmk.sys 2007-06-28 18:31 53,248 -ra------ C:\WINDOWS\system32\P17CPI.dll 2007-06-28 18:31 138,752 -ra------ C:\WINDOWS\system32\drivers\ctsfm2k.sys 2007-06-28 18:31 137,728 -ra------ C:\WINDOWS\system32\P17res.dll 2007-06-28 18:31 135,040 --a------ C:\WINDOWS\system32\drivers\portcls.sys 2007-06-28 18:31 133,632 -ra------ C:\WINDOWS\system32\CtDvInst.dll 2007-06-28 18:31 115,200 -ra------ C:\WINDOWS\system32\sfms32.dll 2007-06-28 18:31 11,264 --a------ C:\WINDOWS\INRES.DLL 2007-06-28 18:31 106,496 -ra------ C:\WINDOWS\system32\drivers\ctoss2k.sys 2007-06-28 18:31 1,389,056 -ra------ C:\WINDOWS\system32\drivers\P17.sys 2007-06-28 18:31 <DIR> d-------- C:\WINDOWS\system32\Data 2007-06-28 18:27 <DIR> d-------- C:\Program Files\Creative 2007-06-25 11:28 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\Spybot - Search & Destroy 2007-06-23 17:33 <DIR> d-------- C:\Program Files\Steganos Internet Anonym Pro 7 2007-06-23 17:33 <DIR> d-------- C:\Program Files\Secure Surfing Engine 2007-06-22 16:00 <DIR> d-------- C:\Program Files\WinAVI Video Converter 2007-06-22 14:35 <DIR> d-------- C:\Program Files\Recode Media 2007-06-22 14:35 <DIR> d-------- C:\DOCUME~1\Krzyhoo\DANEAP~1\Media Player Classic (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) 2007-07-22 18:09:43 -------- d-----w C:\DOCUME~1\Krzyhoo\DANEAP~1\BitTorrent 2007-07-22 15:57:55 -------- d-----w C:\Program Files\eMule 2007-07-21 21:39:45 -------- d-----w C:\DOCUME~1\Krzyhoo\DANEAP~1\16 Dent 2007-07-21 11:52:56 49,696 ----a-w C:\WINDOWS\system32\perfc015.dat 2007-07-21 11:52:56 355,816 ----a-w C:\WINDOWS\system32\perfh015.dat 2007-07-20 23:32:17 212 ----a-w C:\delete.bat 2007-07-20 12:51:40 -------- d-s---w C:\Program Files\Xfire 2007-07-19 14:14:55 -------- d-----w C:\DOCUME~1\Krzyhoo\DANEAP~1\Xfire 2007-07-18 12:56:39 -------- d-----w C:\Program Files\cFos 2007-07-09 09:04:53 -------- d--h--w C:\Program Files\InstallShield Installation Information 2007-06-29 12:56:21 -------- d-----w C:\Program Files\Winamp 2007-06-26 12:31:19 -------- d-----w C:\Program Files\Lx_cats 2007-06-25 22:48:45 -------- d-----w C:\Program Files\Fraps 2007-06-25 13:38:22 -------- d-----w C:\Program Files\BitComet 2007-06-22 10:55:36 -------- d-----w C:\Program Files\SpeedFan 2007-06-21 15:02:52 87 ----a-w C:\WINDOWS\system32\buyurl0502.dat 2007-06-20 17:01:02 2,560 ----a-w C:\WINDOWS\system32\BitCometRes.dll 2007-06-20 15:37:37 -------- d-----w C:\DOCUME~1\Krzyhoo\DANEAP~1\OpenOffice.org2 2007-06-19 22:00:00 838,360 ----a-w C:\WINDOWS\system32\drivers\cFosNT.sys 2007-06-19 18:23:05 -------- d-----w C:\DOCUME~1\Krzyhoo\DANEAP~1\Locktime 2007-06-19 18:22:02 -------- d-----w C:\Program Files\NetLimiter 2 Pro 2007-06-19 15:11:38 -------- d-----w C:\Program Files\NAPI-PROJEKT 2007-06-17 19:49:57 -------- d-----w C:\Program Files\PeerGuardian2 2007-06-15 23:59:08 -------- d-----w C:\Program Files\FreshDevices 2007-06-15 23:53:47 -------- d-----w C:\Program Files\AlienGUIse 2007-06-15 23:47:49 -------- d-----w C:\Program Files\Common Files\Stardock 2007-06-12 06:57:32 -------- d-----w C:\Program Files\Messenger 2007-05-31 23:02:46 -------- d-----w C:\DOCUME~1\Krzyhoo\DANEAP~1\Skype 2007-05-27 12:43:51 -------- d-----w C:\Program Files\Google 2007-05-25 19:56:27 -------- d-----w C:\Program Files\Kopia Gadu-Gadu 2007-05-25 19:56:27 -------- d-----w C:\Program Files\Gadu-Gadu 2007-05-25 19:55:18 -------- d-----w C:\Program Files\100 Happy Money 2 2007-05-25 19:50:10 -------- d-----w C:\Program Files\Lexmark Fax Solutions 2007-05-25 19:48:59 -------- d-----w C:\Program Files\Movie Maker 2007-05-25 19:47:59 -------- d-----w C:\Program Files\DEMO SAM ZAPROJEKTUJ Dom, Wnętrze i Ogród 2007-05-25 19:47:55 -------- d-----w C:\Program Files\Lexmark 3300 Series 2007-05-25 17:35:30 -------- d-----w C:\Program Files\ToniArts 2007-05-24 21:37:05 -------- d-----w C:\Program Files\3D Driving-School Demo 2007-05-24 19:01:04 -------- d-----w C:\Program Files\16 Dent 2007-05-19 22:22:26 87,608 ----a-w C:\DOCUME~1\Krzyhoo\DANEAP~1\inst.exe 2007-05-19 22:22:25 94,208 ----a-w C:\DOCUME~1\Krzyhoo\DANEAP~1\ezplay.sys 2007-05-19 22:22:01 47,360 ----a-w C:\DOCUME~1\Krzyhoo\DANEAP~1\pcouffin.sys 2007-05-18 15:19:56 0 ----a-w C:\Program Files\MultiTransefind.ini 2007-05-17 18:50:13 298,104 ----a-w C:\WINDOWS\system32\imon.dll 2007-04-28 10:16:21 98,304 ----a-w C:\WINDOWS\system32\CmdLineExt.dll 2006-12-21 19:46:04 952 --sha-w C:\WINDOWS\system32\KGyGaAvL.sys ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}] 2001-03-02 12:02 37808 --------- C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{39F7E362-828A-4B5A-BCAF-5B79BFDFEA60}] 2007-06-14 15:07 443968 --a------ C:\Program Files\BitComet\tools\BitCometBHO_1.1.6.14.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{53707962-6F74-2D53-2644-206D7942484F}] 2005-05-31 01:04 853672 --a------ C:\Program Files\Spybot - Search & Destroy\SDHelper.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}] 2007-03-14 03:43 501400 --a------ C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{E5A1691B-D188-4419-AD02-90002030B8EE}] 2006-03-31 22:27 191096 --a------ C:\PROGRA~1\FlashFXP\IEFlash.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "nwiz"="nwiz.exe" [2005-07-20 15:07 C:\WINDOWS\system32\nwiz.exe] "SoundMan"="SOUNDMAN.EXE" [2005-04-15 05:01 C:\WINDOWS\SOUNDMAN.EXE] "lxccmon.exe"="C:\Program Files\Lexmark 3300 Series\lxccmon.exe" [2005-07-21 02:17] "FaxCenterServer"="C:\Program Files\Lexmark Fax Solutions\fm3032.exe" [2005-07-12 11:36] "LClock"="C:\Program Files\LClock\LClock.exe" [2004-09-20 02:27] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe" [2007-03-14 03:43] "PestPatrol Control Center"="c:\PROGRA~1\PESTPA~1\PPControl.exe" [] "PPMemCheck"="c:\PROGRA~1\PESTPA~1\PPMemCheck.exe" [] "CookiePatrol"="c:\PROGRA~1\PESTPA~1\CookiePatrol.exe" [] "TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2007-02-05 14:46] "avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-01-15 19:28] "Super X Desktop Version 3.4.0730"="C:\Program Files\Super X Desktop\SXDesk.exe" [] "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-03-07 01:33] "UVS10 Preload"="C:\Program Files\Ulead Systems\Ulead VideoStudio 10\uvPL.exe" [2006-03-07 01:52] "CTSysVol"="C:\Program Files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe" [2005-10-31 10:51] "P17Helper"="P17.dll" [2005-05-03 13:38 C:\WINDOWS\system32\P17.dll] "OCAudioIni"="C:\Program Files\One-click Audio Converter\OCAudioIni.exe" [2005-03-29 18:54] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\System32\ctfmon.exe" [2001-10-26 19:29] "Free Download Manager"="C:\Program Files\Free Download Manager\fdm.exe" [] "BitTorrent"="C:\Program Files\BitTorrent\bittorrent.exe" [2007-03-02 01:11] "WindowBlinds"="C:\Program Files\Stardock\Object Desktop\WindowBlinds\WBInstall32.exe" [2005-11-22 01:21] "Gadu-Gadu"="C:\Program Files\Gadu-Gadu\gg.exe" [2007-04-17 13:12] "Yodm3D"="C:\Documents and Settings\Krzyhoo\Pulpit\yodm3D\Yodm3D.exe" [2007-04-21 21:26] "Creative MediaSource Go"="C:\Program Files\Creative\MediaSource5\Go\CTCMSGoU.exe" [2006-11-09 10:19] "PlayVc"="C:\DOCUME~1\Krzyhoo\DANEAP~1\16DENT~1\AntiMp3Bin.exe" [] [HKEY_USERS\.default\software\microsoft\windows\currentversion\runonce] "SIAPRO7"="C:\Program Files\Steganos Internet Anonym Pro 7\siapro7.exe" -firstboot [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer\Run] " "=C:\WINDOWS\System32\svchost.exe [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\WBSrv] C:\PROGRA~1\Stardock\OBJECT~1\WINDOW~1\wbsrv.dll --a------ 2006-10-10 18:53 135168 C:\PROGRA~1\Stardock\OBJECT~1\WINDOW~1\WbSrv.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "appinit_dlls"=wbsys.dll C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Krzyhoo^Menu Start^Programy^Autostart^Xfire.lnk] path=C:\Documents and Settings\Krzyhoo\Menu Start\Programy\Autostart\Xfire.lnk backup=C:\WINDOWS\pss\Xfire.lnkStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BearShare] "C:\Program Files\BearShare\BearShare.exe" /pause [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\cFosDNT] C:\Program Files\cFos\cFosDNT.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Glass2k] C:\Program Files\Glass2k\Glass2k.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HEXelon MAX] "C:\Program Files\HEXelon MAX 6\hexelon.exe" /auto [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iDesk] C:\Program Files\INTERIAPL\Desktop\iDesk.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Komunikator] C:\Program Files\Tlen.pl\tlen.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Pando] "C:\Program Files\Pando Networks\Pando\Pando.exe" /Minimized [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam] C:\GRY\Valve\Steam\\Steam.exe -silent [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TranspWndManagerPro] "C:\Program Files\Oreware.com\Transparent Window Manager\TransparentWindowManager.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent] C:\Program Files\Winamp\winampa.exe HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{ACC563BC-4266-43f0-B6ED-9D38C4202C7E} rundll32 iesetup.dll,IEAccessUserInst ************************************************************************** catchme 0.3.915 W2K/XP/Vista - rootkit detector by Gmer, http://www.gmer.net Rootkit scan 2007-07-22 21:25:55 Windows 5.1.2600 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** Completion time: 2007-07-22 21:26:18 C:\ComboFix-quarantined-files.txt ... 2007-07-22 21:26 --- E O F ---

hijack:

Kod: Zaznacz wszystko: Logfile of HijackThis v1.99.1 Scan saved at 21:31:06, on 2007-07-22 Platform: Windows XP (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 (6.00.2600.0000) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\WINDOWS\System32\CTsvcCDA.exe C:\Program Files\NetLimiter 2 Pro\nlsvc.exe C:\Program Files\Eset\nod32krn.exe C:\WINDOWS\System32\nvsvc32.exe C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe C:\WINDOWS\System32\MsPMSPSv.exe C:\Program Files\Lexmark 3300 Series\lxccmon.exe C:\Program Files\LClock\LClock.exe C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\Program Files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe C:\WINDOWS\System32\ctfmon.exe C:\WINDOWS\System32\lxcccoms.exe C:\Program Files\BitTorrent\bittorrent.exe C:\Program Files\Stardock\Object Desktop\WindowBlinds\WBInstall32.exe C:\Documents and Settings\Krzyhoo\Pulpit\yodm3D\Yodm3D.exe C:\Program Files\Creative\MediaSource5\Go\CTCMSGoU.exe C:\Program Files\Labtec Wireless Desktop\MagicKey.exe C:\Program Files\Program sieciowy dla SAGEM Wi-Fi 11g USB adapter\WLANUTL.exe C:\Program Files\Labtec Wireless Desktop\MulMouse.exe C:\Program Files\Labtec Wireless Desktop\OSD.EXE C:\Program Files\eMule\emule.exe C:\Program Files\Gadu-Gadu\gg.exe C:\Documents and Settings\Krzyhoo\Moje dokumenty\Mozilla Firefox\firefox.exe C:\Program Files\Winamp\winamp.exe C:\Documents and Settings\Krzyhoo\Pulpit\hijackthis_199\HijackThis.exe C:\WINDOWS\explorer.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.1.6.14.dll O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O2 - BHO: FlashFXP Helper for Internet Explorer - {E5A1691B-D188-4419-AD02-90002030B8EE} - C:\PROGRA~1\FlashFXP\IEFlash.dll O3 - Toolbar: Steganos Internet Anonym - {00000000-5736-4205-0008-781cd0e19f00} - c:\program files\steganos internet anonym pro 7\siapro7iep.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [lxccmon.exe] "C:\Program Files\Lexmark 3300 Series\lxccmon.exe" O4 - HKLM\..\Run: [FaxCenterServer] "C:\Program Files\Lexmark Fax Solutions\fm3032.exe" /s O4 - HKLM\..\Run: [LClock] C:\Program Files\LClock\LClock.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe" O4 - HKLM\..\Run: [PestPatrol Control Center] c:\PROGRA~1\PESTPA~1\PPControl.exe O4 - HKLM\..\Run: [PPMemCheck] c:\PROGRA~1\PESTPA~1\PPMemCheck.exe O4 - HKLM\..\Run: [CookiePatrol] c:\PROGRA~1\PESTPA~1\CookiePatrol.exe O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [Super X Desktop Version 3.4.0730] C:\Program Files\Super X Desktop\SXDesk.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [UVS10 Preload] C:\Program Files\Ulead Systems\Ulead VideoStudio 10\uvPL.exe O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe /r O4 - HKLM\..\Run: [P17Helper] Rundll32 P17.dll,P17Helper O4 - HKLM\..\Run: [OCAudioIni] C:\Program Files\One-click Audio Converter\OCAudioIni.exe O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe O4 - HKCU\..\Run: [Free Download Manager] C:\Program Files\Free Download Manager\fdm.exe -autorun O4 - HKCU\..\Run: [BitTorrent] "C:\Program Files\BitTorrent\bittorrent.exe" --force_start_minimized O4 - HKCU\..\Run: [WindowBlinds] C:\Program Files\Stardock\Object Desktop\WindowBlinds\WBInstall32.exe O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - HKCU\..\Run: [Yodm3D] C:\Documents and Settings\Krzyhoo\Pulpit\yodm3D\Yodm3D.exe O4 - HKCU\..\Run: [Creative MediaSource Go] "C:\Program Files\Creative\MediaSource5\Go\CTCMSGoU.exe" /SCB O4 - HKCU\..\Run: [PlayVc] C:\DOCUME~1\Krzyhoo\DANEAP~1\16DENT~1\AntiMp3Bin.exe O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: Enable Labtec Wireless Desktop.lnk = C:\Program Files\Labtec Wireless Desktop\MagicKey.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE O4 - Global Startup: Program sieciowy dla SAGEM Wi-Fi 11g USB adapter.lnk = ? O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm O8 - Extra context menu item: Add to AMV Convert Tool... - C:\Program Files\MP3 Player Utilities 4.00\AMVConverter\grab.html O8 - Extra context menu item: Add to AMV Converter... - C:\Program Files\MP3 Player Utilities 4.02\AMVConverter\grab.html O8 - Extra context menu item: MediaManager tool grab multimedia file - C:\Program Files\MP3 Player Utilities 4.00\MediaManager\grab.html O9 - Extra button: iOpus iMacros - {0483894E-2422-45E0-8384-021AFF1AF3CD} - C:\Program Files\iMacros\imacros.dll O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\ua_lsp.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\ua_lsp.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\ua_lsp.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\ua_lsp.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\ua_lsp.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\ua_lsp.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\ua_lsp.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\ua_lsp.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\ua_lsp.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\ua_lsp.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\ua_lsp.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\ua_lsp.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\ua_lsp.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\ua_lsp.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\ua_lsp.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\ua_lsp.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\ua_lsp.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\ua_lsp.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\ua_lsp.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\ua_lsp.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\ua_lsp.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\ua_lsp.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\ua_lsp.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\ua_lsp.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\ua_lsp.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\ua_lsp.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\ua_lsp.dll O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://downloads.ewido.net/ewidoOnlineScan.cab O16 - DPF: {5A09E43F-A0A7-4ABF-AF80-11367CF1DC8F} (MainControl Class) - http://mks.com.pl/skaner/SkanerOnline.cab O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1168084540624 O16 - DPF: {68282C51-9459-467B-95BF-3C0E89627E55} (MainControl Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1168084488202 O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/su2/CTL_V02002/ocx/15030/CTPID.cab O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O20 - AppInit_DLLs: wbsys.dll C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL O20 - Winlogon Notify: WBSrv - C:\PROGRA~1\Stardock\OBJECT~1\WINDOW~1\wbsrv.dll O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing) O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing) O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.exe O23 - Service: GoogleDesktopManager - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: lxcc_device - Lexmark International, Inc. - C:\WINDOWS\System32\lxcccoms.exe O23 - Service: NetLimiter (nlsvc) - Locktime Software - C:\Program Files\NetLimiter 2 Pro\nlsvc.exe O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing) O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe

**Posty:** 18165 · przez **wojtas** 22 Lip 2007, 23:25

c:\windows\system32\ua_lsp.dll

przeskanuj ten plik tu:

http://virusscan.jotti.org/
http://www.virustotal.com/

**Posty:** 308 · przez **krzyhooo** 23 Lip 2007, 00:04

wojtas19162 napisał(a):przeskanuj ten plik tu:

http://virusscan.jotti.org/
http://www.virustotal.com/

nie wykryło wirusa

**Posty:** 18165 · przez **wojtas** 23 Lip 2007, 11:06

Start>uruchom>msconfig>zakladka uruchamianie> wylacz progsy które nie chcesz żeby startowaly z systemem przyspieszy Ci to wlaczanie kompa

i bedzie ok

**Posty:** 308 · przez **krzyhooo** 23 Lip 2007, 15:26

ale ja już wyłączyłem wszystkie progsy, które wiem, że mogę wyłączyć

**Posty:** 18165 · przez **wojtas** 23 Lip 2007, 15:45

skasuj ten wpis w hijacku i usun pogrubiony:

O4 - HKCU\..\Run: [PlayVc] C:\DOCUME~1\Krzyhoo\DANEAP~1\16DENT~1\AntiMp3Bin.exe

te mozesz wylaczyc nie kasuj ich w hijacku tylko:

O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [lxccmon.exe] "C:\Program Files\Lexmark 3300 Series\lxccmon.exe"
O4 - HKLM\..\Run: [FaxCenterServer] "C:\Program Files\Lexmark Fax Solutions\fm3032.exe" /s
O4 - HKLM\..\Run: [LClock] C:\Program Files\LClock\LClock.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Super X Desktop Version 3.4.0730] C:\Program Files\Super X Desktop\SXDesk.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [UVS10 Preload] C:\Program Files\Ulead Systems\Ulead VideoStudio 10\uvPL.exe
O4 - HKLM\..\Run: [OCAudioIni] C:\Program Files\One-click Audio Converter\OCAudioIni.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [Free Download Manager] C:\Program Files\Free Download Manager\fdm.exe -autorun
O4 - HKCU\..\Run: [BitTorrent] "C:\Program Files\BitTorrent\bittorrent.exe" --force_start_minimized
O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray
O4 - HKCU\..\Run: [Yodm3D] C:\Documents and Settings\Krzyhoo\Pulpit\yodm3D\Yodm3D.exe
O4 - HKCU\..\Run: [Creative MediaSource Go] "C:\Program Files\Creative\MediaSource5\Go\CTCMSGoU.exe" /SCB
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Enable Labtec Wireless Desktop.lnk = C:\Program Files\Labtec Wireless Desktop\MagicKey.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE

**Posty:** 308 · przez **krzyhooo** 23 Lip 2007, 21:24

wojtas, wojtas..... myślałeś już o przejściu na emeryture?

bo niestety błąd jest nadal sciana

...... a może to przez to, że aktualizowałem ad-aware'a?

**Posty:** 18165 · przez **wojtas** 24 Lip 2007, 10:54

krzyhooo napisał(a):bo niestety błąd jest nadal

daj loga z hijacka, silent runners i combofixa

krzyhooo napisał(a):myślałeś już o przejściu na emeryture?

**Posty:** 308 · przez **krzyhooo** 24 Lip 2007, 16:31

hijack

Kod: Zaznacz wszystko: Logfile of HijackThis v1.99.1 Scan saved at 16:01:34, on 2007-07-24 Platform: Windows XP (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 (6.00.2600.0000) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\LClock\LClock.exe C:\Program Files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe C:\WINDOWS\System32\Rundll32.exe C:\Program Files\BitTorrent\bittorrent.exe C:\Program Files\Stardock\Object Desktop\WindowBlinds\WBInstall32.exe C:\Program Files\Gadu-Gadu\gg.exe C:\Program Files\Creative\MediaSource5\Go\CTCMSGoU.exe C:\Program Files\Labtec Wireless Desktop\MagicKey.exe C:\Program Files\Last.fm\LastFMHelper.exe C:\Program Files\Program sieciowy dla SAGEM Wi-Fi 11g USB adapter\WLANUTL.exe C:\WINDOWS\System32\CTsvcCDA.exe C:\Program Files\Labtec Wireless Desktop\MulMouse.exe C:\Program Files\NetLimiter 2 Pro\nlsvc.exe C:\Program Files\Eset\nod32krn.exe C:\WINDOWS\System32\nvsvc32.exe C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe C:\Program Files\Labtec Wireless Desktop\OSD.EXE C:\WINDOWS\System32\MsPMSPSv.exe C:\Program Files\eMule\emule.exe C:\Documents and Settings\Krzyhoo\Moje dokumenty\Mozilla Firefox\firefox.exe C:\Program Files\Windows Media Player\wmplayer.exe C:\Documents and Settings\Krzyhoo\Pulpit\hijackthis_199\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.1.6.14.dll O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O2 - BHO: FlashFXP Helper for Internet Explorer - {E5A1691B-D188-4419-AD02-90002030B8EE} - C:\PROGRA~1\FlashFXP\IEFlash.dll O3 - Toolbar: Steganos Internet Anonym - {00000000-5736-4205-0008-781cd0e19f00} - c:\program files\steganos internet anonym pro 7\siapro7iep.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [LClock] C:\Program Files\LClock\LClock.exe O4 - HKLM\..\Run: [PestPatrol Control Center] c:\PROGRA~1\PESTPA~1\PPControl.exe O4 - HKLM\..\Run: [PPMemCheck] c:\PROGRA~1\PESTPA~1\PPMemCheck.exe O4 - HKLM\..\Run: [CookiePatrol] c:\PROGRA~1\PESTPA~1\CookiePatrol.exe O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe /r O4 - HKLM\..\Run: [P17Helper] Rundll32 P17.dll,P17Helper O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup O4 - HKCU\..\Run: [BitTorrent] "C:\Program Files\BitTorrent\bittorrent.exe" --force_start_minimized O4 - HKCU\..\Run: [WindowBlinds] C:\Program Files\Stardock\Object Desktop\WindowBlinds\WBInstall32.exe O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - HKCU\..\Run: [Yodm3D] C:\Documents and Settings\Krzyhoo\Pulpit\yodm3D\Yodm3D.exe O4 - HKCU\..\Run: [Creative MediaSource Go] "C:\Program Files\Creative\MediaSource5\Go\CTCMSGoU.exe" /SCB O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: Enable Labtec Wireless Desktop.lnk = C:\Program Files\Labtec Wireless Desktop\MagicKey.exe O4 - Global Startup: Last.fm Helper.lnk = C:\Program Files\Last.fm\LastFMHelper.exe O4 - Global Startup: Program sieciowy dla SAGEM Wi-Fi 11g USB adapter.lnk = ? O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm O8 - Extra context menu item: Add to AMV Convert Tool... - C:\Program Files\MP3 Player Utilities 4.00\AMVConverter\grab.html O8 - Extra context menu item: Add to AMV Converter... - C:\Program Files\MP3 Player Utilities 4.02\AMVConverter\grab.html O8 - Extra context menu item: MediaManager tool grab multimedia file - C:\Program Files\MP3 Player Utilities 4.00\MediaManager\grab.html O9 - Extra button: iOpus iMacros - {0483894E-2422-45E0-8384-021AFF1AF3CD} - C:\Program Files\iMacros\imacros.dll O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\ua_lsp.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\ua_lsp.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\ua_lsp.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\ua_lsp.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\ua_lsp.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\ua_lsp.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\ua_lsp.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\ua_lsp.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\ua_lsp.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\ua_lsp.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\ua_lsp.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\ua_lsp.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\ua_lsp.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\ua_lsp.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\ua_lsp.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\ua_lsp.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\ua_lsp.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\ua_lsp.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\ua_lsp.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\ua_lsp.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\ua_lsp.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\ua_lsp.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\ua_lsp.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\ua_lsp.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\ua_lsp.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\ua_lsp.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\ua_lsp.dll O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://downloads.ewido.net/ewidoOnlineScan.cab O16 - DPF: {5A09E43F-A0A7-4ABF-AF80-11367CF1DC8F} (MainControl Class) - http://mks.com.pl/skaner/SkanerOnline.cab O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1168084540624 O16 - DPF: {68282C51-9459-467B-95BF-3C0E89627E55} (MainControl Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1168084488202 O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/su2/CTL_V02002/ocx/15030/CTPID.cab O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O20 - AppInit_DLLs: wbsys.dll C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL O20 - Winlogon Notify: WBSrv - C:\PROGRA~1\Stardock\OBJECT~1\WINDOW~1\wbsrv.dll O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing) O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing) O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.exe O23 - Service: GoogleDesktopManager - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: lxcc_device - Lexmark International, Inc. - C:\WINDOWS\System32\lxcccoms.exe O23 - Service: NetLimiter (nlsvc) - Locktime Software - C:\Program Files\NetLimiter 2 Pro\nlsvc.exe O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing) O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe

combofix

Kod: Zaznacz wszystko: "Krzyhoo" - 2007-07-24 16:03:54 - ComboFix 07-07-14.6 NTFS ((((((((((((((((((((((((( Files Created from 2007-06-24 to 2007-07-24 ))))))))))))))))))))))))))))))) 2007-07-23 02:45 <DIR> d-------- C:\Program Files\Last.fm 2007-07-23 02:43 <DIR> d-------- C:\Program Files\The Games Factory 2 2007-07-22 17:35 <DIR> d-------- C:\DOCUME~1\Krzyhoo\DANEAP~1\fretsonfire 2007-07-22 17:34 <DIR> d-------- C:\Program Files\Frets on Fire 2007-07-21 01:40 51,200 --a------ C:\WINDOWS\nircmd.exe 2007-07-21 00:10 4,424 --a------ C:\WINDOWS\system32\tmp.reg 2007-07-15 14:18 62,744 --a------ C:\WINDOWS\system32\xinput1_2.dll 2007-07-15 14:18 3,426,072 --a------ C:\WINDOWS\system32\d3dx9_32.dll 2007-07-15 14:18 251,672 --a------ C:\WINDOWS\system32\xactengine2_5.dll 2007-07-15 14:18 236,824 --a------ C:\WINDOWS\system32\xactengine2_3.dll 2007-07-15 14:18 15,128 --a------ C:\WINDOWS\system32\x3daudio1_1.dll 2007-07-15 13:52 <DIR> d-------- C:\Program Files\THQ 2007-07-10 21:47 <DIR> d-------- C:\DOCUME~1\Krzyhoo\DANEAP~1\Smart Recorder 2007-07-09 11:13 5,632 --a------ C:\WINDOWS\system32\drivers\Entech64.sys 2007-07-09 11:13 3,972 --a------ C:\WINDOWS\system32\drivers\PciBus.sys 2007-07-09 11:13 21,664 --a------ C:\WINDOWS\system32\drivers\Entech.sys 2007-07-09 11:13 <DIR> d-------- C:\WINDOWS\system32\Futuremark 2007-07-09 11:04 <DIR> d-------- C:\Program Files\Futuremark 2007-07-09 00:19 <DIR> d-------- C:\Program Files\MadOnion.com 2007-06-30 01:30 <DIR> d-------- C:\Program Files\One-click Audio Converter 2007-06-29 14:55 9,464 --------- C:\WINDOWS\system32\drivers\cdralw2k.sys 2007-06-29 14:55 9,336 --------- C:\WINDOWS\system32\drivers\cdr4_xp.sys 2007-06-29 14:55 129,784 --------- C:\WINDOWS\system32\pxafs.dll 2007-06-29 01:47 43,528 --------- C:\WINDOWS\system32\drivers\PxHelp20.sys 2007-06-29 01:47 151,552 --------- C:\WINDOWS\system32\pxwma.dll 2007-06-29 01:47 109,568 --------- C:\WINDOWS\system32\pxinsi64.exe 2007-06-29 01:47 108,544 --------- C:\WINDOWS\system32\pxcpyi64.exe 2007-06-28 23:32 12 --a------ C:\DOCUME~1\Krzyhoo\USERDATA.DAT 2007-06-28 19:15 44,032 --------- C:\WINDOWS\system32\CTSVCCDA.EXE 2007-06-28 19:15 25,088 --------- C:\WINDOWS\system32\CTSVCCTL.EXE 2007-06-28 18:44 <DIR> d-------- C:\DOCUME~1\Krzyhoo\DANEAP~1\Creative 2007-06-28 18:38 41,984 --------- C:\WINDOWS\Ctregrun.exe 2007-06-28 18:36 <DIR> d--h----- C:\Program Files\Creative Installation Information 2007-06-28 18:36 <DIR> d-------- C:\Program Files\Common Files\Creative 2007-06-28 18:31 90,112 --------- C:\WINDOWS\Updreg.EXE 2007-06-28 18:31 8,704 -ra------ C:\WINDOWS\system32\drivers\Pfmodnt.sys 2007-06-28 18:31 64,512 -ra------ C:\WINDOWS\system32\P17.dll 2007-06-28 18:31 57,344 --a------ C:\WINDOWS\system32\drivers\drmk.sys 2007-06-28 18:31 53,248 -ra------ C:\WINDOWS\system32\P17CPI.dll 2007-06-28 18:31 138,752 -ra------ C:\WINDOWS\system32\drivers\ctsfm2k.sys 2007-06-28 18:31 137,728 -ra------ C:\WINDOWS\system32\P17res.dll 2007-06-28 18:31 135,040 --a------ C:\WINDOWS\system32\drivers\portcls.sys 2007-06-28 18:31 133,632 -ra------ C:\WINDOWS\system32\CtDvInst.dll 2007-06-28 18:31 115,200 -ra------ C:\WINDOWS\system32\sfms32.dll 2007-06-28 18:31 11,264 --a------ C:\WINDOWS\INRES.DLL 2007-06-28 18:31 106,496 -ra------ C:\WINDOWS\system32\drivers\ctoss2k.sys 2007-06-28 18:31 1,389,056 -ra------ C:\WINDOWS\system32\drivers\P17.sys 2007-06-28 18:31 <DIR> d-------- C:\WINDOWS\system32\Data 2007-06-28 18:27 <DIR> d-------- C:\Program Files\Creative 2007-06-25 11:28 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\Spybot - Search & Destroy (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) 2007-07-24 13:57:09 -------- d-----w C:\DOCUME~1\Krzyhoo\DANEAP~1\BitTorrent 2007-07-24 13:51:42 -------- d-----w C:\Program Files\eMule 2007-07-24 13:48:46 1,324 ----a-w C:\WINDOWS\system32\d3d9caps.dat 2007-07-21 11:52:56 49,696 ----a-w C:\WINDOWS\system32\perfc015.dat 2007-07-21 11:52:56 355,816 ----a-w C:\WINDOWS\system32\perfh015.dat 2007-07-20 23:32:17 212 ----a-w C:\delete.bat 2007-07-20 12:51:40 -------- d-s---w C:\Program Files\Xfire 2007-07-19 14:14:55 -------- d-----w C:\DOCUME~1\Krzyhoo\DANEAP~1\Xfire 2007-07-18 12:56:39 -------- d-----w C:\Program Files\cFos 2007-07-09 09:04:53 -------- d--h--w C:\Program Files\InstallShield Installation Information 2007-06-29 12:56:21 -------- d-----w C:\Program Files\Winamp 2007-06-26 12:31:19 -------- d-----w C:\Program Files\Lx_cats 2007-06-25 22:48:45 -------- d-----w C:\Program Files\Fraps 2007-06-25 13:38:22 -------- d-----w C:\Program Files\BitComet 2007-06-23 15:33:17 -------- d-----w C:\Program Files\Secure Surfing Engine 2007-06-23 15:33:15 -------- d-----w C:\Program Files\Steganos Internet Anonym Pro 7 2007-06-22 14:36:09 -------- d-----w C:\Program Files\WinAVI Video Converter 2007-06-22 12:38:34 -------- d-----w C:\DOCUME~1\Krzyhoo\DANEAP~1\Media Player Classic 2007-06-22 12:35:23 -------- d-----w C:\Program Files\Recode Media 2007-06-22 10:55:36 -------- d-----w C:\Program Files\SpeedFan 2007-06-21 15:02:52 87 ----a-w C:\WINDOWS\system32\buyurl0502.dat 2007-06-20 17:01:02 2,560 ----a-w C:\WINDOWS\system32\BitCometRes.dll 2007-06-20 15:37:37 -------- d-----w C:\DOCUME~1\Krzyhoo\DANEAP~1\OpenOffice.org2 2007-06-19 22:00:00 838,360 ----a-w C:\WINDOWS\system32\drivers\cFosNT.sys 2007-06-19 18:23:05 -------- d-----w C:\DOCUME~1\Krzyhoo\DANEAP~1\Locktime 2007-06-19 18:22:02 -------- d-----w C:\Program Files\NetLimiter 2 Pro 2007-06-19 15:11:38 -------- d-----w C:\Program Files\NAPI-PROJEKT 2007-06-17 19:49:57 -------- d-----w C:\Program Files\PeerGuardian2 2007-06-15 23:59:08 -------- d-----w C:\Program Files\FreshDevices 2007-06-15 23:53:47 -------- d-----w C:\Program Files\AlienGUIse 2007-06-15 23:47:49 -------- d-----w C:\Program Files\Common Files\Stardock 2007-06-12 06:57:32 -------- d-----w C:\Program Files\Messenger 2007-05-31 23:02:46 -------- d-----w C:\DOCUME~1\Krzyhoo\DANEAP~1\Skype 2007-05-27 12:43:51 -------- d-----w C:\Program Files\Google 2007-05-25 19:56:27 -------- d-----w C:\Program Files\Kopia Gadu-Gadu 2007-05-25 19:56:27 -------- d-----w C:\Program Files\Gadu-Gadu 2007-05-25 19:55:18 -------- d-----w C:\Program Files\100 Happy Money 2 2007-05-25 19:50:10 -------- d-----w C:\Program Files\Lexmark Fax Solutions 2007-05-25 19:48:59 -------- d-----w C:\Program Files\Movie Maker 2007-05-25 19:47:59 -------- d-----w C:\Program Files\DEMO SAM ZAPROJEKTUJ Dom, Wnętrze i Ogród 2007-05-25 19:47:55 -------- d-----w C:\Program Files\Lexmark 3300 Series 2007-05-25 17:35:30 -------- d-----w C:\Program Files\ToniArts 2007-05-24 21:37:05 -------- d-----w C:\Program Files\3D Driving-School Demo 2007-05-24 19:01:04 -------- d-----w C:\Program Files\16 Dent 2007-05-19 22:22:26 87,608 ----a-w C:\DOCUME~1\Krzyhoo\DANEAP~1\inst.exe 2007-05-19 22:22:25 94,208 ----a-w C:\DOCUME~1\Krzyhoo\DANEAP~1\ezplay.sys 2007-05-19 22:22:01 47,360 ----a-w C:\DOCUME~1\Krzyhoo\DANEAP~1\pcouffin.sys 2007-05-18 15:19:56 0 ----a-w C:\Program Files\MultiTransefind.ini 2007-05-17 18:50:13 298,104 ----a-w C:\WINDOWS\system32\imon.dll 2007-04-28 10:16:21 98,304 ----a-w C:\WINDOWS\system32\CmdLineExt.dll 2006-12-21 19:46:04 952 --sha-w C:\WINDOWS\system32\KGyGaAvL.sys ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}] 2001-03-02 12:02 37808 --------- C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{39F7E362-828A-4B5A-BCAF-5B79BFDFEA60}] 2007-06-14 15:07 443968 --a------ C:\Program Files\BitComet\tools\BitCometBHO_1.1.6.14.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{53707962-6F74-2D53-2644-206D7942484F}] 2005-05-31 01:04 853672 --a------ C:\Program Files\Spybot - Search & Destroy\SDHelper.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}] 2007-03-14 03:43 501400 --a------ C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{E5A1691B-D188-4419-AD02-90002030B8EE}] 2006-03-31 22:27 191096 --a------ C:\PROGRA~1\FlashFXP\IEFlash.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SoundMan"="SOUNDMAN.EXE" [2005-04-15 05:01 C:\WINDOWS\SOUNDMAN.EXE] "LClock"="C:\Program Files\LClock\LClock.exe" [2004-09-20 02:27] "PestPatrol Control Center"="c:\PROGRA~1\PESTPA~1\PPControl.exe" [] "PPMemCheck"="c:\PROGRA~1\PESTPA~1\PPMemCheck.exe" [] "CookiePatrol"="c:\PROGRA~1\PESTPA~1\CookiePatrol.exe" [] "avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-01-15 19:28] "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-03-07 01:33] "CTSysVol"="C:\Program Files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe" [2005-10-31 10:51] "P17Helper"="P17.dll" [2005-05-03 13:38 C:\WINDOWS\system32\P17.dll] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "BitTorrent"="C:\Program Files\BitTorrent\bittorrent.exe" [2007-03-02 01:11] "WindowBlinds"="C:\Program Files\Stardock\Object Desktop\WindowBlinds\WBInstall32.exe" [2005-11-22 01:21] "Gadu-Gadu"="C:\Program Files\Gadu-Gadu\gg.exe" [2007-04-17 13:12] "Yodm3D"="C:\Documents and Settings\Krzyhoo\Pulpit\yodm3D\Yodm3D.exe" [2007-04-21 21:26] "Creative MediaSource Go"="C:\Program Files\Creative\MediaSource5\Go\CTCMSGoU.exe" [2006-11-09 10:19] [HKEY_USERS\.default\software\microsoft\windows\currentversion\runonce] "SIAPRO7"="C:\Program Files\Steganos Internet Anonym Pro 7\siapro7.exe" -firstboot [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer\Run] " "=C:\WINDOWS\System32\svchost.exe [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\WBSrv] C:\PROGRA~1\Stardock\OBJECT~1\WINDOW~1\wbsrv.dll --a------ 2006-10-10 18:53 135168 C:\PROGRA~1\Stardock\OBJECT~1\WINDOW~1\WbSrv.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "appinit_dlls"=wbsys.dll C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Adobe Gamma Loader.exe.lnk] path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Adobe Gamma Loader.exe.lnk backup=C:\WINDOWS\pss\Adobe Gamma Loader.exe.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Microsoft Office.lnk] path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Microsoft Office.lnk backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Krzyhoo^Menu Start^Programy^Autostart^Xfire.lnk] path=C:\Documents and Settings\Krzyhoo\Menu Start\Programy\Autostart\Xfire.lnk backup=C:\WINDOWS\pss\Xfire.lnkStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BearShare] "C:\Program Files\BearShare\BearShare.exe" /pause [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\cFosDNT] C:\Program Files\cFos\cFosDNT.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\FaxCenterServer] "C:\Program Files\Lexmark Fax Solutions\fm3032.exe" /s [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Free Download Manager] C:\Program Files\Free Download Manager\fdm.exe -autorun [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Glass2k] C:\Program Files\Glass2k\Glass2k.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HEXelon MAX] "C:\Program Files\HEXelon MAX 6\hexelon.exe" /auto [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iDesk] C:\Program Files\INTERIAPL\Desktop\iDesk.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Komunikator] C:\Program Files\Tlen.pl\tlen.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\lxccmon.exe] "C:\Program Files\Lexmark 3300 Series\lxccmon.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz] nwiz.exe /install [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OCAudioIni] C:\Program Files\One-click Audio Converter\OCAudioIni.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Pando] "C:\Program Files\Pando Networks\Pando\Pando.exe" /Minimized [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam] C:\GRY\Valve\Steam\\Steam.exe -silent [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Super X Desktop Version 3.4.0730] C:\Program Files\Super X Desktop\SXDesk.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TranspWndManagerPro] "C:\Program Files\Oreware.com\Transparent Window Manager\TransparentWindowManager.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UVS10 Preload] C:\Program Files\Ulead Systems\Ulead VideoStudio 10\uvPL.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent] C:\Program Files\Winamp\winampa.exe HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{ACC563BC-4266-43f0-B6ED-9D38C4202C7E} rundll32 iesetup.dll,IEAccessUserInst ************************************************************************** catchme 0.3.915 W2K/XP/Vista - rootkit detector by Gmer, http://www.gmer.net Rootkit scan 2007-07-24 16:10:51 Windows 5.1.2600 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... ************************************************************************** Completion time: 2007-07-24 16:11:54 C:\ComboFix-quarantined-files.txt ... 2007-07-24 16:11 C:\ComboFix2.txt ... 2007-07-22 21:26 --- E O F ---

silent runners

Kod: Zaznacz wszystko: "Silent Runners.vbs", revision R50, http://www.silentrunners.org/ Operating System: Windows XP Output limited to non-default values, except where indicated by "{++}" Startup items buried in registry: --------------------------------- HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ {++} "BitTorrent" = ""C:\Program Files\BitTorrent\bittorrent.exe" --force_start_minimized" [null data] "WindowBlinds" = "C:\Program Files\Stardock\Object Desktop\WindowBlinds\WBInstall32.exe" [null data] "Gadu-Gadu" = ""C:\Program Files\Gadu-Gadu\gg.exe" /tray" ["Gadu-Gadu S.A."] "Yodm3D" = "C:\Documents and Settings\Krzyhoo\Pulpit\yodm3D\Yodm3D.exe" ["Christian SALMON"] "Creative MediaSource Go" = ""C:\Program Files\Creative\MediaSource5\Go\CTCMSGoU.exe" /SCB" ["Creative Technology Ltd"] HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ {++} " " = "C:\WINDOWS\System32\svchost.exe" [MS] HKLM\Software\Microsoft\Windows\CurrentVersion\Run\ {++} "SoundMan" = "SOUNDMAN.EXE" ["Realtek Semiconductor Corp."] "LClock" = "C:\Program Files\LClock\LClock.exe" [null data] "PestPatrol Control Center" = "c:\PROGRA~1\PESTPA~1\PPControl.exe" [file not found] "PPMemCheck" = "c:\PROGRA~1\PESTPA~1\PPMemCheck.exe" [file not found] "CookiePatrol" = "c:\PROGRA~1\PESTPA~1\CookiePatrol.exe" [file not found] "avast!" = "C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [null data] "QuickTime Task" = ""C:\Program Files\QuickTime\qttask.exe" -atboottime" ["Apple Computer, Inc."] "CTSysVol" = "C:\Program Files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe /r" ["Creative Technology Ltd"]

dziwny, wkurzający błąd

dziwny, wkurzający błąd

Kto jest na forum