Generic host process for win32 services

**Posty:** 114 · przez **enter55** 14 Maj 2009, 20:52

Na początku dodam iż jestem ciemny w tych sprawach

. Otóż od pewnego czasu ( 2 -3 dni) wyskakuje mi jakiś błąd:
"Generic Host Process for win32 Services” po czym znika dźwięk w programach takich jak : winamp,ventrillo itp. Czytałem na forach, że należy zainstalować łatki i zainstalowałem i dalej to samo , poszukałem bardziej i znałazłem aby zablokować jakieś porty programem Windows Worms Door Cleaner i też tak zrobiłem , lecz problem dalej występuje. I teraz nasuwa się moja prośba o pomoc jak temu zaradzić i wklejam loga z HiJackThis:

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 20:46:36, on 2009-05-14 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\LEXBCES.EXE C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\LEXPPS.EXE C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\RunDll32.exe C:\Program Files\Winamp\winampa.exe C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe C:\Program Files\Java\jre6\bin\jusched.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Messenger\msmsgs.exe C:\WINDOWS\system32\Ati2evxx.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Documents and Settings\Tobi xD\Pulpit\Nowy folder (2)\HiJackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.entretieneteds.vze.com/ R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 128.252.19.20:3128 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe" O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe" O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [Gadu-Gadu] "E:\Gadu-Gadu\gg.exe" /tray O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [Komunikator] C:\Program Files\Tlen.pl\tlen.exe O4 - HKCU\..\Run: [ALLUpdate] "C:\Program Files\ALLPlayer\ALLUpdate.exe" "sleep" O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {69EF49E5-FE46-4B92-B5FA-2193AB7A6B8A} (GameLauncher Control) - http://www.acclaim.com/cabs/acclaim_v5.cab O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE O23 - Service: nProtect GameGuard Service (npggsvc) - Unknown owner - C:\WINDOWS\system32\GameMon.des.exe (file missing) -- End of file - 3592 bytes

**Posty:** 3874 · przez **Wojtasgls** 14 Maj 2009, 21:01

poczytaj i zastosuj ktoras z tych metod:
http://forum.programosy.pl/blad-generic-host-process-for-win32-services-vt79489.html

**Posty:** 114 · przez **enter55** 15 Maj 2009, 16:13

Wojtasgls a jak zrobiłem? Napisłem chyba , że zablokowalem porty i latki zainstalowalem a i skanowalem programem by wyszukac blastera i nie znalazlo

**Posty:** 18165 · przez **wojtas** 15 Maj 2009, 18:37

Zastosuj SDFix . Po pobraniu uruchom go a rozpakuje się do C:\SDFix. Uruchom komputer w trybie awaryjnym (F8 przy stracie systemu). Będąc w awaryjnym uruchom plik RunThis.bat z folderu SDFixa. Zatwierdź czyszczenie przez Y. Poczekaj aż ukończy i komputer zresetuje

Potem wejdz do folderu C:\SDFix wrzuc zawartość pliku Report.txt + log z OTListIt2

**Posty:** 114 · przez **enter55** 16 Maj 2009, 09:18

Report.txt :

Kod: Zaznacz wszystko: [b]SDFix: Version 1.240 [/b] Run by Administrator on 2009-05-16 at 09:11 Microsoft Windows XP [Wersja 5.1.2600] Running From: C:\SDFix [b]Checking Services [/b]: Restoring Default Security Values Restoring Default Hosts File Rebooting [b]Checking Files [/b]: Trojan Files Found: C:\RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013\drv32.exe - Deleted Folder C:\RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013 - Removed Removing Temp Files [b]ADS Check [/b]: [b]Final Check [/b]: catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-05-16 09:14:56 Windows 5.1.2600 Dodatek Service Pack 2 FAT NTAPI scanning hidden processes ... scanning hidden services ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden processes: 0 hidden services: 0 hidden files: 0 [b]Remaining Services [/b]: Authorized Application Key Export: [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "D:\\metin\\metin2.bin"="D:\\metin\\metin2.bin:*:Enabled:metin2" "D:\\Valve\\hl.exe"="D:\\Valve\\hl.exe:*:Enabled:Half-Life Launcher" "D:\\Valve\\hlds.exe"="D:\\Valve\\hlds.exe:*:Enabled:HLDS Launcher" "E:\\hl.exe"="E:\\hl.exe:*:Enabled:Half-Life Launcher" "E:\\hlds.exe"="E:\\hlds.exe:*:Enabled:HLDS Launcher" "E:\\Nowy folder (2)\\hl.exe"="E:\\Nowy folder (2)\\hl.exe:*:Enabled:Half-Life Launcher" "E:\\Nowy folder (2)\\hlds.exe"="E:\\Nowy folder (2)\\hlds.exe:*:Enabled:HLDS Launcher" "C:\\Program Files\\Counter-Strike 1.6\\hl.exe"="C:\\Program Files\\Counter-Strike 1.6\\hl.exe:*:Enabled:Half-Life Launcher" "C:\\Program Files\\Counter-Strike 1.6\\hlds.exe"="C:\\Program Files\\Counter-Strike 1.6\\hlds.exe:*:Enabled:HLDS Launcher" "E:\\Tibia\\Tibia.exe"="E:\\Tibia\\Tibia.exe:*:Enabled:Tibia Player" "C:\\Program Files\\Nowe Gadu-Gadu\\gg.exe"="C:\\Program Files\\Nowe Gadu-Gadu\\gg.exe:*:Enabled:Nowe Gadu-Gadu" "C:\\Program Files\\Tlen.pl\\TLEN.EXE"="C:\\Program Files\\Tlen.pl\\TLEN.EXE:*:Disabled:Komunikator Tlen.pl" "E:\\CABAL Online (Europe)\\launcher\\update\\ESTdnheadless.exe"="E:\\CABAL Online (Europe)\\launcher\\update\\ESTdnheadless.exe:*:Enabled:EST! download engine" "C:\\Program Files\\cs1.6\\hl.exe"="C:\\Program Files\\cs1.6\\hl.exe:*:Enabled:Half-Life Launcher" "D:\\cs\\hl.exe"="D:\\cs\\hl.exe:*:Enabled:Half-Life Launcher" "C:\\Program Files\\Counter Strike 1.6 Reloaded\\hl.exe"="C:\\Program Files\\Counter Strike 1.6 Reloaded\\hl.exe:*:Enabled:Half-Life Launcher" "C:\\Program Files\\Counter Strike 1.6 Reloaded\\hlds.exe"="C:\\Program Files\\Counter Strike 1.6 Reloaded\\hlds.exe:*:Enabled:HLDS Launcher" [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list] "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" [b]Remaining Files [/b]: File Backups: - C:\SDFix\backups\backups.zip [b]Files with Hidden Attributes [/b]: [b]Finished![/b]

log z OTListl t2:

Kod: Zaznacz wszystko: OTListIt logfile created on: 2009-05-16 09:16:24 - Run 1 OTListIt2 by OldTimer - Version 2.0.15.8 Folder = C:\Documents and Settings\Tobi xD\Pulpit Windows XP Professional Edition Dodatek Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation Internet Explorer (Version = 6.0.2900.2180) Locale: 00000415 | Country: Polska | Language: PLK | Date Format: yyyy-MM-dd 511,49 Mb Total Physical Memory | 313,08 Mb Available Physical Memory | 61,21% Memory free 1,22 Gb Paging File | 1,06 Gb Available in Paging File | 87,19% Paging File free Paging file location(s): C:\pagefile.sys 768 1536 [binary data] %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files Drive C: | 7,80 Gb Total Space | 0,24 Gb Free Space | 3,02% Space Free | Partition Type: FAT32 Drive D: | 34,18 Gb Total Space | 10,17 Gb Free Space | 29,75% Space Free | Partition Type: NTFS Drive E: | 34,33 Gb Total Space | 23,32 Gb Free Space | 67,95% Space Free | Partition Type: NTFS F: Drive not present or media not loaded G: Drive not present or media not loaded H: Drive not present or media not loaded I: Drive not present or media not loaded Computer Name: DOM-6DCD3534989 Current User Name: Tobi xD Logged in as Administrator. Current Boot Mode: Normal Scan Mode: Current user Output = Standard File Age = 30 Days Company Name Whitelist: On [color=orange]========== Processes (SafeList) ==========[/color] PRC - [2003-02-25 05:52:00 | 00,303,104 | ---- | M] (Lexmark International, Inc.) -- C:\WINDOWS\system32\LEXBCES.EXE PRC - [2003-02-25 05:50:00 | 00,174,592 | ---- | M] (Lexmark International, Inc.) -- C:\WINDOWS\system32\LEXPPS.EXE PRC - [2003-02-28 22:29:22 | 00,184,405 | ---- | M] () -- C:\WINDOWS\system32\Ati2evxx.exe PRC - [2009-03-13 10:11:32 | 00,152,984 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Java\jre6\bin\jqs.exe PRC - [2005-01-28 13:44:28 | 00,038,912 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\wdfmgr.exe PRC - [2004-08-03 22:44:20 | 01,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\Explorer.EXE PRC - [2004-08-03 22:44:30 | 00,013,824 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\wscntfy.exe PRC - [2008-08-04 00:02:20 | 00,036,352 | ---- | M] () -- C:\Program Files\Winamp\winampa.exe PRC - [2003-02-28 21:00:00 | 00,315,392 | ---- | M] (ATI Technologies, Inc.) -- C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe PRC - [2009-03-13 10:11:32 | 00,148,888 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Java\jre6\bin\jusched.exe PRC - [2004-08-04 00:55:54 | 01,667,584 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Messenger\msmsgs.exe PRC - [2009-04-28 17:06:46 | 00,307,704 | ---- | M] (Mozilla Corporation) -- C:\Program Files\Mozilla Firefox\firefox.exe PRC - [2009-05-16 09:16:10 | 00,501,248 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Tobi xD\Pulpit\OTListIt2.exe [color=orange]========== Win32 Services (SafeList) ==========[/color] SRV - [2003-02-28 22:29:22 | 00,184,405 | ---- | M] () -- C:\WINDOWS\system32\Ati2evxx.exe -- (Ati HotKey Poller [Auto | Running]) SRV - [2003-02-28 21:00:00 | 00,110,677 | ---- | M] () -- C:\WINDOWS\system32\ati2sgag.exe -- (ATI Smart [Auto | Stopped]) SRV - [2004-08-03 23:44:08 | 00,038,912 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\PCHealth\HelpCtr\Binaries\pchsvc.dll -- (helpsvc [Auto | Running]) SRV - [2009-03-13 10:11:32 | 00,152,984 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Java\jre6\bin\jqs.exe -- (JavaQuickStarterService [Auto | Running]) SRV - [2003-02-25 05:52:00 | 00,303,104 | ---- | M] (Lexmark International, Inc.) -- C:\WINDOWS\system32\LEXBCES.EXE -- (LexBceS [Auto | Running]) SRV - [2009-03-11 00:42:00 | 03,121,464 | ---- | M] (INCA Internet Co., Ltd.) -- C:\WINDOWS\system32\GameMon.des -- (npggsvc [On_Demand | Stopped]) SRV - [2005-01-28 13:44:28 | 00,038,912 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\wdfmgr.exe -- (UMWdf [Auto | Running]) [color=orange]========== Driver Services (SafeList) ==========[/color] DRV - [2003-02-28 22:38:56 | 00,576,512 | ---- | M] (ATI Technologies Inc.) -- C:\WINDOWS\system32\DRIVERS\ati2mtag.sys -- (ati2mtag [On_Demand | Running]) DRV - File not found -- -- (catchme [On_Demand | Running]) DRV - [2003-03-25 01:13:46 | 00,741,583 | ---- | M] (C-Media Inc) -- C:\WINDOWS\system32\drivers\cmuda.sys -- (cmuda [On_Demand | Running]) DRV - [2004-08-03 23:08:22 | 00,010,624 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\DRIVERS\gameenum.sys -- (gameenum [On_Demand | Running]) DRV - [2001-08-17 22:00:04 | 00,002,944 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\drivers\msmpu401.sys -- (ms_mpu401 [On_Demand | Running]) DRV - [2005-01-04 20:43:08 | 00,004,682 | ---- | M] (INCA Internet Co., Ltd.) -- C:\WINDOWS\system32\npptNT2.sys -- (NPPTNT2 [On_Demand | Stopped]) DRV - [2001-08-17 21:49:56 | 00,017,792 | ---- | M] (Parallel Technologies, Inc.) -- C:\WINDOWS\system32\DRIVERS\ptilink.sys -- (Ptilink [On_Demand | Running]) DRV - [2007-03-08 00:51:00 | 00,043,528 | ---- | M] (Sonic Solutions) -- C:\WINDOWS\System32\Drivers\PxHelp20.sys -- (PxHelp20 [Boot | Running]) DRV - [2004-08-03 22:31:34 | 00,020,992 | ---- | M] (Realtek Semiconductor Corporation) -- C:\WINDOWS\system32\DRIVERS\RTL8139.SYS -- (rtl8139 [On_Demand | Running]) DRV - [2004-07-17 09:36:38 | 00,027,440 | ---- | M] () -- C:\WINDOWS\system32\DRIVERS\secdrv.sys -- (Secdrv [On_Demand | Stopped]) [color=orange]========== Standard Registry (SafeList) ==========[/color] [color=orange]========== Internet Explorer ==========[/color] IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.microsoft.com/isapi/redir.dll?prd={SUB_PRD}&clcid={SUB_CLSID}&pver={SUB_PVER}&ar=home IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomizeSearch = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\system32\blank.htm IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com/ie IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.entretieneteds.vze.com/ IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 1 [color=orange]========== FireFox ==========[/color] FF - prefs.js..browser.search.defaultthis.engineName: "Web Search" FF - prefs.js..browser.search.defaulturl: "http://search.conduit.com/ResultsExt.aspx?ctid=CT1561552&SearchSource=3&q=" FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA}:6.0.12 FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0 FF - prefs.js..extensions.enabledItems: refspoof@mozdev.org:0.9.5 FF - prefs.js..extensions.enabledItems: {972ce4c6-7e08-4474-a285-3208198ce6fd}:3.0.10 FF - HKLM\software\mozilla\Firefox\extensions\\jqs@sun.com: C:\PROGRAM FILES\JAVA\JRE6\LIB\DEPLOY\JQS\FF [2009-03-13 10:11:32 | 00,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Firefox 3.0.10\extensions\\Components: C:\PROGRAM FILES\MOZILLA FIREFOX\COMPONENTS [2009-02-19 17:08:38 | 00,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Firefox 3.0.10\extensions\\Plugins: C:\PROGRAM FILES\MOZILLA FIREFOX\PLUGINS [2009-02-19 17:08:38 | 00,000,000 | ---D | M] [2009-02-19 17:08:44 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Tobi xD\Dane aplikacji\mozilla\Extensions [2009-02-19 17:08:44 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Tobi xD\Dane aplikacji\mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384} [2009-02-19 17:08:44 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Tobi xD\Dane aplikacji\mozilla\Firefox\Profiles\jv2idq0j.default\extensions [2009-04-21 18:52:54 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Tobi xD\Dane aplikacji\mozilla\Firefox\Profiles\jv2idq0j.default\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}(2) [2009-04-21 22:03:40 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Tobi xD\Dane aplikacji\mozilla\Firefox\Profiles\jv2idq0j.default\extensions\{c95a4e8e-816d-4655-8c79-d736da1adb6d}(2) [2009-05-08 13:44:10 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Tobi xD\Dane aplikacji\mozilla\Firefox\Profiles\jv2idq0j.default\extensions\refspoof@mozdev.org [2009-02-19 17:08:38 | 00,000,000 | ---D | M] -- C:\Program Files\mozilla firefox\extensions [2009-02-19 17:08:38 | 00,000,000 | ---D | M] -- C:\Program Files\mozilla firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd} [2009-03-13 10:11:42 | 00,000,000 | ---D | M] -- C:\Program Files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA} [2009-04-28 17:06:44 | 00,023,032 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browserdirprovider.dll [2009-04-28 17:06:44 | 00,134,648 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\brwsrcmp.dll [2006-06-03 17:43:22 | 00,000,896 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\allegro-pl.xml [2008-04-03 18:19:08 | 00,001,406 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\fbc-pl.xml [2008-04-16 05:08:20 | 00,001,706 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\google.xml [2007-03-31 18:11:54 | 00,000,917 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\merlin-pl.xml [2006-06-03 17:43:22 | 00,000,858 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\pwn-pl.xml [2008-03-28 22:36:04 | 00,001,183 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-pl.xml [2007-01-05 12:40:56 | 00,001,683 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wp-pl.xml [2008-06-26 14:34:30 | 00,000,932 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\conduit.xml O1 HOSTS File: (686 bytes) - C:\WINDOWS\System32\drivers\etc\Hosts O1 - Hosts: 127.0.0.1 localhost O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.) O2 - BHO: (JQSIEStartDetectorImpl Class) - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll (Sun Microsystems, Inc.) O4 - HKLM..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe (ATI Technologies, Inc.) O4 - HKLM..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd File not found O4 - HKLM..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe" (Sun Microsystems, Inc.) O4 - HKLM..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe" () O4 - HKCU..\Run: [ALLUpdate] "C:\Program Files\ALLPlayer\ALLUpdate.exe" "sleep" () O4 - HKCU..\Run: [Gadu-Gadu] "E:\Gadu-Gadu\gg.exe" /tray File not found O4 - HKCU..\Run: [Komunikator] C:\Program Files\Tlen.pl\tlen.exe File not found O4 - HKCU..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background (Microsoft Corporation) O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: dontdisplaylastusername = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticecaption = O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticetext = O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: shutdownwithoutlogon = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: undockwithoutlogon = 1 O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O9 - Extra Button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation) O9 - Extra 'Tools' menuitem : Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation) O15 - HKLM\..Trusted Domains: 1 domain(s) and sub-domain(s) not assigned to a zone. O16 - DPF: {69EF49E5-FE46-4B92-B5FA-2193AB7A6B8A} http://www.acclaim.com/cabs/acclaim_v5.cab (GameLauncher Control) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_12-windows-i586.cab (Java Plug-in 1.6.0_12) O16 - DPF: {CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_12-windows-i586.cab (Java Plug-in 1.6.0_12) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_12-windows-i586.cab (Java Plug-in 1.6.0_12) O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object) O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\Explorer.exe (Microsoft Corporation) O24 - Desktop Components:0 (Moja bieżąca strona główna) - About:Home O31 - SafeBoot: AlternateShell - cmd.exe O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2009-02-19 16:44:44 | 00,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ FAT32 ] O33 - MountPoints2\{43f4800a-ff45-11dd-abf3-0004614b74c5}\Shell\AutoRun\command - "" = H:\RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013\drv32.exe -- File not found O33 - MountPoints2\{43f4800a-ff45-11dd-abf3-0004614b74c5}\Shell\open\command - "" = H:\RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013\drv32.exe -- File not found O33 - MountPoints2\{83feb1fc-1093-11de-ac2a-0004614b74c5}\Shell\AutoRun\command - "" = H:\RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013\drv32.exe -- File not found O33 - MountPoints2\{83feb1fc-1093-11de-ac2a-0004614b74c5}\Shell\open\command - "" = H:\RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013\drv32.exe -- File not found O33 - MountPoints2\{921f388d-09ab-11de-ac12-0004614b74c5}\Shell\AutoRun\command - "" = H:\RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013\drv32.exe -- File not found O33 - MountPoints2\{921f388d-09ab-11de-ac12-0004614b74c5}\Shell\open\command - "" = H:\RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013\drv32.exe -- File not found O33 - MountPoints2\{f2b83b88-1483-11de-ac34-0004614b74c5}\Shell\AutoRun\command - "" = H:\RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013\drv32.exe -- File not found O33 - MountPoints2\{f2b83b88-1483-11de-ac34-0004614b74c5}\Shell\open\command - "" = H:\RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013\drv32.exe -- File not found O34 - HKLM BootExecute: (autocheck) - File not found O34 - HKLM BootExecute: (autochk) - C:\WINDOWS\System32\autochk.exe (Microsoft Corporation) O34 - HKLM BootExecute: (*) - * [2009-02-19 16:59:34 | 00,000,000 | ---D | M] [color=orange]========== Files/Folders - Created Within 30 Days ==========[/color] [1 C:\WINDOWS\System32\*.tmp files] [3 C:\WINDOWS\*.tmp files] [2009-05-16 09:16:07 | 00,501,248 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Tobi xD\Pulpit\OTListIt2.exe [2009-05-16 09:14:40 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Tobi xD\Dane aplikacji\WinRAR [2009-05-16 09:12:31 | 53,640,3968 | -HS- | C] () -- C:\hiberfil.sys [2009-05-16 09:10:00 | 00,000,000 | ---D | C] -- C:\WINDOWS\ERUNT [2009-05-16 09:07:51 | 00,000,000 | ---D | C] -- C:\SDFix [2009-05-16 09:07:34 | 01,529,241 | ---- | C] () -- C:\Documents and Settings\Tobi xD\Pulpit\SDFix.exe [2009-05-16 08:54:47 | 10,485,7844 | ---- | C] () -- C:\Documents and Settings\Tobi xD\Pulpit\Prison.Break.S04E22.HDTV.XviD-LOL-DNH.part1.rar [2009-05-16 08:24:17 | 36,675,8092 | ---- | C] () -- C:\Documents and Settings\Tobi xD\Pulpit\Prison.Break.S04E21.HDTV.XviD-LOL.avi [2009-05-15 16:06:30 | 05,599,331 | ---- | C] () -- C:\Documents and Settings\Tobi xD\Pulpit\classicalia-installer.exe [2009-05-15 12:42:53 | 00,000,000 | ---D | C] -- C:\Program Files\Common Files\NSV [2009-05-14 20:45:41 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Tobi xD\Pulpit\Nowy folder (2) [2009-05-13 19:18:36 | 00,000,000 | ---D | C] -- C:\ElfBot NG [2009-05-13 19:18:27 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Tobi xD\Pulpit\elbot8.41 [2009-05-13 19:18:06 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Tobi xD\Pulpit\Tibia 8.41 upload by Simivar for Tibia.net.pl [2009-05-13 19:16:18 | 02,027,912 | ---- | C] () -- C:\Documents and Settings\Tobi xD\Pulpit\elbot8.41.rar [2009-05-13 19:14:37 | 20,393,529 | ---- | C] () -- C:\Documents and Settings\Tobi xD\Pulpit\Tibia 8.41 upload by Simivar for Tibia.net.pl.rar [2009-05-13 15:08:45 | 00,051,232 | ---- | C] (gkweb) -- C:\Documents and Settings\Tobi xD\Pulpit\wwdc_[www.programosy.pl].exe [2009-05-13 14:55:08 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Tobi xD\Pulpit\PB.419.HDTV.XViD-LOL_RMVB [2009-05-13 14:55:08 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Tobi xD\Pulpit\PB.4.20.rmvb.up.by.wicherson.prison.org.pl [2009-05-13 14:51:08 | 00,000,000 | ---D | C] -- C:\WINDOWS\System32\NtmsData [2009-05-13 14:33:53 | 00,000,000 | ---D | C] -- C:\WINDOWS\$hf_mig$ [2009-05-12 16:03:50 | 00,019,680 | ---- | C] () -- C:\Documents and Settings\Tobi xD\Pulpit\house.m.d.(2004).pol.1cd.(3509057).zip [2009-05-12 16:02:57 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Tobi xD\Pulpit\HMD.S05E24.HDTV.XviD-LOL [2009-05-12 15:24:43 | 16,382,8316 | ---- | C] () -- C:\Documents and Settings\Tobi xD\Pulpit\HMD.S05E24.HDTV.XviD-LOL.part2.rar [2009-05-12 14:27:45 | 20,000,0000 | ---- | C] () -- C:\Documents and Settings\Tobi xD\Pulpit\HMD.S05E24.HDTV.XviD-LOL.part1.rar [2009-05-11 15:55:59 | 35,334,9728 | ---- | C] () -- C:\Documents and Settings\Tobi xD\Pulpit\c2.r5.rmvb [2009-05-10 19:11:09 | 20,398,051 | ---- | C] (CipSoft GmbH ) -- C:\Documents and Settings\Tobi xD\Pulpit\tibia842.exe [2009-05-09 22:03:24 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Tobi xD\Pulpit\Trzeci_Wymiar-Zlodzeje_Czasu-PL-2CD-2009-TNMy [2009-05-09 21:18:23 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Tobi xD\Pulpit\4x20rmvb [2009-05-08 13:50:06 | 00,000,283 | ---- | C] () -- C:\Documents and Settings\Tobi xD\Moje dokumenty\MeBoy.jad [2009-05-08 13:50:05 | 01,217,625 | ---- | C] () -- C:\Documents and Settings\Tobi xD\Moje dokumenty\MeBoy.jar [2009-05-07 19:38:26 | 02,776,115 | ---- | C] () -- C:\Documents and Settings\Tobi xD\Pulpit\pyskaty spontan remix swir.mp3 [2009-05-06 16:17:03 | 00,162,721 | ---- | C] () -- C:\Documents and Settings\Tobi xD\Pulpit\dash.JPG [2009-05-05 19:34:59 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Tobi xD\Pulpit\hmd523pl [2009-05-05 19:28:56 | 00,029,524 | ---- | C] () -- C:\Documents and Settings\Tobi xD\Pulpit\hmd523pl.zip [2009-05-05 14:13:25 | 01,310,801 | ---- | C] () -- C:\Documents and Settings\Tobi xD\Pulpit\P050509_14.09.JPG [2009-05-04 19:01:26 | 00,000,186 | ---- | C] () -- C:\Documents and Settings\Tobi xD\Pulpit\Dragon.elfc [2009-05-04 16:20:58 | 00,084,480 | ---- | C] () -- C:\WINDOWS\System32\ff_vfw.dll [2009-05-04 16:20:58 | 00,000,547 | ---- | C] () -- C:\WINDOWS\System32\ff_vfw.dll.manifest [2009-05-04 16:20:57 | 00,060,273 | ---- | C] (Open Source Software community project) -- C:\WINDOWS\System32\pthreadGC2.dll [2009-05-04 16:20:55 | 00,000,000 | ---D | C] -- C:\Program Files\ffdshow [2009-05-04 16:19:46 | 04,257,829 | ---- | C] (ffdshow ) -- C:\Documents and Settings\Tobi xD\Pulpit\ffdshow_rev2936_20090503_clsid_(www.programs.pl).exe [2009-05-04 16:15:08 | 00,000,544 | ---- | C] () -- C:\Documents and Settings\Tobi xD\Pulpit\ALLPlayer V3.7.lnk [2009-05-04 16:15:05 | 00,000,000 | ---D | C] -- C:\Program Files\ALLPlayer [2009-05-04 16:14:16 | 02,847,856 | ---- | C] (ALLPlayer ) -- C:\Documents and Settings\Tobi xD\Pulpit\ALLPlayerPL.exe [2009-05-03 20:54:32 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Tobi xD\Pulpit\Tibia841-MC-LH [2009-05-02 15:47:46 | 00,000,000 | -HSD | C] -- C:\FOUND.003 [2009-05-01 20:52:59 | 03,121,464 | ---- | C] (INCA Internet Co., Ltd.) -- C:\WINDOWS\System32\GameMon.des [2009-05-01 20:51:46 | 00,005,174 | ---- | C] () -- C:\WINDOWS\System32\nppt9x.vxd [2009-05-01 20:51:46 | 00,004,682 | ---- | C] (INCA Internet Co., Ltd.) -- C:\WINDOWS\System32\npptNT2.sys [2009-05-01 20:51:13 | 00,000,000 | ---D | C] -- C:\Program Files\Common Files\INCA Shared [2009-05-01 20:32:02 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Tobi xD\Pulpit\Dragonball_Evolution_(NAPiSY-107707).NS(2) [2009-04-28 17:45:17 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Tobi xD\Dane aplikacji\OpenFM [2009-04-22 15:51:41 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Tobi xD\Pulpit\tibiasoft_com_OrkBot 0.5.2 [2009-04-21 22:03:27 | 00,000,000 | ---D | C] -- C:\Program Files\Hotspot_Shield [2009-04-21 21:56:24 | 00,000,000 | ---D | C] -- C:\Program Files\Hotspot Shield [2009-04-21 19:29:38 | 00,000,000 | ---D | C] -- C:\Program Files\OpenVPN [2009-04-17 18:22:54 | 00,001,326 | ---- | C] () -- C:\Documents and Settings\Tobi xD\Pulpit\auto group.ng [2009-02-19 19:51:21 | 00,000,173 | ---- | C] () -- C:\WINDOWS\LEXSTAT.INI [2009-02-19 17:02:44 | 00,000,092 | ---- | C] () -- C:\WINDOWS\CMISETUP.INI [2009-02-19 17:02:43 | 00,000,026 | ---- | C] () -- C:\WINDOWS\CMCDPLAY.INI [2009-02-19 17:02:43 | 00,000,000 | ---- | C] () -- C:\WINDOWS\Wininit.ini [2009-02-19 17:02:42 | 01,892,352 | ---- | C] () -- C:\WINDOWS\System32\cmiwcnfg.dll [2009-02-19 17:02:42 | 00,028,672 | ---- | C] () -- C:\WINDOWS\System32\cmirmdrv.dll [2009-02-19 17:02:41 | 00,026,242 | ---- | C] () -- C:\WINDOWS\Cmuda.ini [2009-02-19 17:02:36 | 00,028,672 | ---- | C] () -- C:\WINDOWS\CMIRmDriver.dll [2004-08-03 22:44:00 | 00,081,920 | ---- | C] () -- C:\WINDOWS\System32\ieencode.dll [2004-07-17 09:36:38 | 00,027,440 | ---- | C] () -- C:\WINDOWS\System32\drivers\secdrv.sys [2001-07-21 22:16:20 | 00,000,477 | ---- | C] () -- C:\WINDOWS\win.ini [2001-07-21 22:15:52 | 00,000,231 | ---- | C] () -- C:\WINDOWS\system.ini [color=orange]========== Files - Modified Within 30 Days ==========[/color] [1 C:\WINDOWS\System32\*.tmp files] [3 C:\WINDOWS\*.tmp files] [2009-05-16 09:16:10 | 00,501,248 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Tobi xD\Pulpit\OTListIt2.exe [2009-05-16 09:13:36 | 00,000,062 | -HS- | M] () -- C:\Documents and Settings\Tobi xD\Ustawienia lokalne\desktop.ini [2009-05-16 09:12:36 | 00,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT [2009-05-16 09:12:34 | 00,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat [2009-05-16 09:12:32 | 53,640,3968 | -HS- | M] () -- C:\hiberfil.sys [2009-05-16 09:07:46 | 01,529,241 | ---- | M] () -- C:\Documents and Settings\Tobi xD\Pulpit\SDFix.exe [2009-05-16 09:02:14 | 10,485,7844 | ---- | M] () -- C:\Documents and Settings\Tobi xD\Pulpit\Prison.Break.S04E22.HDTV.XviD-LOL-DNH.part1.rar [2009-05-16 08:50:34 | 36,675,8092 | ---- | M] () -- C:\Documents and Settings\Tobi xD\Pulpit\Prison.Break.S04E21.HDTV.XviD-LOL.avi [2009-05-15 16:07:18 | 05,599,331 | ---- | M] () -- C:\Documents and Settings\Tobi xD\Pulpit\classicalia-installer.exe [2009-05-13 19:18:38 | 00,000,395 | ---- | M] () -- C:\Documents and Settings\Tobi xD\Pulpit\ElfBot NG.lnk [2009-05-13 19:17:58 | 20,393,529 | ---- | M] () -- C:\Documents and Settings\Tobi xD\Pulpit\Tibia 8.41 upload by Simivar for Tibia.net.pl.rar [2009-05-13 19:16:52 | 02,027,912 | ---- | M] () -- C:\Documents and Settings\Tobi xD\Pulpit\elbot8.41.rar [2009-05-13 18:00:24 | 00,000,412 | ---- | M] () -- C:\WINDOWS\tasks\Norton Security Scan for Tobi xD.job [2009-05-13 15:08:46 | 00,051,232 | ---- | M] (gkweb) -- C:\Documents and Settings\Tobi xD\Pulpit\wwdc_[www.programosy.pl].exe [2009-05-13 14:57:26 | 00,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl [2009-05-12 16:03:48 | 00,019,680 | ---- | M] () -- C:\Documents and Settings\Tobi xD\Pulpit\house.m.d.(2004).pol.1cd.(3509057).zip [2009-05-12 15:48:30 | 16,382,8316 | ---- | M] () -- C:\Documents and Settings\Tobi xD\Pulpit\HMD.S05E24.HDTV.XviD-LOL.part2.rar [2009-05-12 15:01:10 | 20,000,0000 | ---- | M] () -- C:\Documents and Settings\Tobi xD\Pulpit\HMD.S05E24.HDTV.XviD-LOL.part1.rar [2009-05-11 18:30:10 | 35,334,9728 | ---- | M] () -- C:\Documents and Settings\Tobi xD\Pulpit\c2.r5.rmvb [2009-05-10 19:14:28 | 20,398,051 | ---- | M] (CipSoft GmbH ) -- C:\Documents and Settings\Tobi xD\Pulpit\tibia842.exe [2009-05-08 13:51:20 | 01,217,625 | ---- | M] () -- C:\Documents and Settings\Tobi xD\Moje dokumenty\MeBoy.jar [2009-05-08 13:51:20 | 00,000,283 | ---- | M] () -- C:\Documents and Settings\Tobi xD\Moje dokumenty\MeBoy.jad [2009-05-07 19:40:18 | 02,776,115 | ---- | M] () -- C:\Documents and Settings\Tobi xD\Pulpit\pyskaty spontan remix swir.mp3 [2009-05-06 16:17:04 | 00,162,721 | ---- | M] () -- C:\Documents and Settings\Tobi xD\Pulpit\dash.JPG [2009-05-05 19:28:56 | 00,029,524 | ---- | M] () -- C:\Documents and Settings\Tobi xD\Pulpit\hmd523pl.zip [2009-05-05 14:12:48 | 01,310,801 | ---- | M] () -- C:\Documents and Settings\Tobi xD\Pulpit\P050509_14.09.JPG [2009-05-04 19:01:26 | 00,000,186 | ---- | M] () -- C:\Documents and Settings\Tobi xD\Pulpit\Dragon.elfc [2009-05-04 16:20:22 | 04,257,829 | ---- | M] (ffdshow ) -- C:\Documents and Settings\Tobi xD\Pulpit\ffdshow_rev2936_20090503_clsid_(www.programs.pl).exe [2009-05-04 16:15:10 | 00,000,568 | ---- | M] () -- C:\Documents and Settings\Tobi xD\Pulpit\Napi-projekt.lnk [2009-05-04 16:15:10 | 00,000,544 | ---- | M] () -- C:\Documents and Settings\Tobi xD\Pulpit\ALLPlayer V3.7.lnk [2009-05-04 16:14:40 | 02,847,856 | ---- | M] (ALLPlayer ) -- C:\Documents and Settings\Tobi xD\Pulpit\ALLPlayerPL.exe [2009-05-02 16:18:50 | 00,000,173 | ---- | M] () -- C:\WINDOWS\LEXSTAT.INI [2009-04-27 18:27:20 | 00,000,728 | ---- | M] () -- C:\WINDOWS\System\CmiCnfg.ini [2009-04-17 18:22:36 | 00,001,326 | ---- | M] () -- C:\Documents and Settings\Tobi xD\Pulpit\auto group.ng < End of report >

**Posty:** 18165 · przez **wojtas** 16 Maj 2009, 13:45

1. Ściągnij OTMoveIt i go włacz i odpal go z opcji CleanUp
2. wykonaj optymalizację windowsa
3.sciagnij ATF_Cleaner
zaznacz
Windows Temp
All users Temp
Temporary internet files
Recycle Bin
i wcisnij EMPTY SELECTED
4.Wyłącz przywracanie systemu ( właściwości mój komputer-zakładka przywracanie - wyłącz przywracanie na wszystkich dyskach). Po chwili włącz je powrotem
5. Wykonaj skan Dr. Web CureIt
6. Przeskanuj obszar mojego komputera http://www.kaspersky.pl/virusscanner.html (uruchom przez IE) Daj raport z niego na forum.

i tym:

FixIEDef.

Jeśli masz Adobe Reader to zaaktualizuj go do najnowszej wersji

**Posty:** 114 · przez **enter55** 20 Maj 2009, 19:05

Zdenerwowalem sie i sformatowyalem wszysktie dyski i nadal to samo

**Posty:** 4459 · przez **jarski185** 20 Maj 2009, 19:08

no ale musisz zainstalowac te latki rowniez zapewne i zamknac te robaczywe porty

**Posty:** 18165 · przez **wojtas** 20 Maj 2009, 19:10

looknij tu:

http://www.searchengines.pl/index.php?showtopic=12532&pid=334645&mode=threaded&start=#entry334645

**Posty:** 114 · przez **enter55** 20 Maj 2009, 19:17

To jest z odliczaniem , a ja mam tak wyskakuje blad , znika dzwiek i zmienia sie kolor pasku startu , poza tym to sa te same rady co wczesniej

. Moze to wina ze cos ze sprzetu sie walnelo?

**Posty:** 18165 · przez **wojtas** 20 Maj 2009, 22:39

zainstaluj :

http://www.sunbeltsoftware.com/Home-Home-Office/Sunbelt-Personal-Firewall/

**Posty:** 114 · przez **enter55** 22 Maj 2009, 16:38

dobra pomoglo lecz teraz mam taki problem ze nie moge zamknac nie potrzebnego procesu z menadzera urzadzen

jest to jakis szit

**Posty:** 4459 · przez **jarski185** 22 Maj 2009, 17:09

enter55 napisał(a):jest to jakis szit

tak? a nazwe ma? czy jest to cos z kategorii szitow bez nazwy?

**Posty:** 114 · przez **enter55** 22 Maj 2009, 21:00

smss.exe sie nazywa

**Posty:** 4459 · przez **jarski185** 22 Maj 2009, 21:37

http://www.liutilities.com/products/wintaskspro/processlibrary/smss/ czyli nie dotykaj, jakby pojawila sie jakas modyfikacja tego procesu wojtas zapewne zauwazylby to

**Posty:** 114 · przez **enter55** 23 Maj 2009, 11:11

to sie pojawilo 1-2dni po formacie dopiero

Other instances of SMSS.EXE:

1) smss.exe is a process which is registered as a trojan. This Trojan allows attackers to access your computer from remote locations, stealing passwords, Internet banking and personal data. This process is a security risk and should be removed from your system.

tego mam nie usuwac?

**Posty:** 4459 · przez **jarski185** 23 Maj 2009, 11:42

myslisz w zbyt prosty sposob-nie wiesz czy jest to zmodyfikowany element(szkodliwie zmodyfikowany)
formaty robiles po tym jak dawales tu logi czy przed? odpowiedz na to pytanie powinna wyjasnic Ci problem

**Posty:** 18165 · przez **wojtas** 23 Maj 2009, 20:02

przesaknuj tu ten plik

http://virusscan.jotti.org/
http://www.virustotal.com/

i daj raporty ze skanow

**Posty:** 114 · przez **enter55** 25 Maj 2009, 23:03

[ArcaVir]
2009-05-21 Backdoor.Blackhole.3331
[Ikarus]
2009-05-21 Trojan.QHosts
[Emsisoft A-squared]
2009-05-22 Trojan.QHosts!IK
[Kaspersky Anti-Virus]
2009-05-21 Found nothing
[Avast! antivirus]
2009-05-21 Win32:Delf-MCI
[Microsoft]
No result available
[Grisoft AVG Anti-Virus]
2009-05-21 Delf.KLO
[ESET NOD32]
2009-05-21 Found nothing
[Avira AntiVir]
2009-05-21 TR/Qhosts.AF
[Norman Virus Control]
2009-05-20 Found nothing
[Softwin BitDefender]
2009-05-21 Spyware.4437
[Panda Antivirus]
2009-05-21 Found nothing
[ClamAV]
2009-05-21 Found nothing
[Quick Heal]
2009-05-21 Found nothing
[CPsecure]
2009-05-21 Troj.Spy.W32.Ardamax.e
[Sophos]
2009-05-22 Found nothing
[Dr.Web]
2009-05-22 BackDoor.BlackHole.3331
[VirusBlokAda VBA32]
2009-05-21 Found nothing
[Frisk F-Prot Antivirus]
2009-05-21 Found nothing
[VirusBuster]
2009-05-21 Found nothing
[F-Secure Anti-Virus]
2009-05-21 Trojan-Proxy:W32/Agent.KOA

**Posty:** 18165 · przez **wojtas** 26 Maj 2009, 09:06

wloz plytke od WIndowsa .. start> uruchom> wpisz SFC / SCANNOW