internet czesto zwalnia, prośba o sprawdzenie loga

**Posty:** 2008 · przez **fibi07** 07 Paź 2007, 13:03

ostatnio mam tak, że od niczego internet nagle zwalnia, tak jak by się podłączył ktoś i zaczął coś ściągać lub coś. w domu sam mam net na kompie (czyt. nie używam routera i nie dziele z nikim internetu)
posiadam neostrade 1024

log z hjt:

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 12:59:35, on 2007-10-07 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Ahead\InCD\InCDsrv.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Microsoft SQL Server\MSSQL$AUTODESKVAULT\Binn\sqlservr.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\System32\PAStiSvc.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\WINDOWS\system32\wscntfy.exe C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\Program Files\Winamp\winamp.exe C:\Konnekt\konnekt.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Documents and Settings\Admin\Pulpit\Fibi\Akcesoria\logi\HiJackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.wiadomosci.wp.pl/ R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.windowsxlive.net R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx O2 - BHO: flashget urlcatch - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\FlashGet\jccatch.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O2 - BHO: FlashGet GetFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\FlashGet\getflash.dll O4 - HKLM\..\Run: [internat.exe] internat.exe O4 - HKLM\..\Run: [Zasobnik systemowy] SysTray.Exe O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user') O8 - Extra context menu item: &Ściągnij przy pomocy FlashGet'a - C:\FlashGet\jc_link.htm O8 - Extra context menu item: &Ściągnij wszystko przy pomocy FlashGet'a - C:\FlashGet\jc_all.htm O8 - Extra context menu item: Pobierz z &BitSpirit - C:\BitSpirit\bsurl.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\FlashGet\FlashGet.exe O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\FlashGet\FlashGet.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll O16 - DPF: {CD995117-98E5-4169-9920-6C12D4C0B548} (HGPlugin9USA Class) - http://gamedownload.ijjimax.com/gamedownload/dist/hgstart/HGPlugin9USA.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{293EF9E3-F5F1-4101-9252-6D8F3B0F3BBE}: NameServer = 194.204.159.1 217.98.63.164 O17 - HKLM\System\CS1\Services\Tcpip\..\{293EF9E3-F5F1-4101-9252-6D8F3B0F3BBE}: NameServer = 194.204.159.1 217.98.63.164 O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Ahead\InCD\InCDsrv.exe O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe O23 - Service: STI Simulator - Unknown owner - C:\WINDOWS\System32\PAStiSvc.exe O24 - Desktop Component 0: (no name) - 131A6951-7F78-11D0-A979-00C04FD705A2 -- End of file - 5486 bytes

z SR jest problem gdyż nie chce się opalić 0.o tj. jak chce go odpalić to chce abym wybrał program z listy i nie wiem co wybrać

**Posty:** 18165 · przez **wojtas** 07 Paź 2007, 13:05

O16 - DPF: {CD995117-98E5-4169-9920-6C12D4C0B548} (HGPlugin9USA Class) - http://gamedownload.ijjimax.com/gamedownload/dist/hgstart/HGPlugin9USA.cab
O24 - Desktop Component 0: (no name) - 131A6951-7F78-11D0-A979-00C04FD705A2

skasuj te wpisy i daj loga z combofixa

**Posty:** 2008 · przez **fibi07** 07 Paź 2007, 13:18

skasowane.

combofix:

Kod: Zaznacz wszystko: ComboFix 07-10-07.1 - Admin 2007-10-07 13:10:20.1 - NTFSx86 BˆĄd wej˜cia: Brak aparatu skrypt˘w dla plik˘w o rozszerzeniu ".vbs". Running from: C:\Documents and Settings\Admin\Pulpit\Fibi\Akcesoria\logi\ComboFix.exe . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\Program Files\winupdates C:\Program Files\winupdates\a.zip C:\WINDOWS\FONTS\acrsecI.fon C:\WINDOWS\hosts C:\WINDOWS\start.exe . ((((((((((((((((((((((((( Files Created from 2007-09-07 to 2007-10-07 ))))))))))))))))))))))))))))))) . 2007-10-07 13:09 51,200 --a------ C:\WINDOWS\NirCmd.exe 2007-10-04 20:12 <DIR> dr-h----- C:\Documents and Settings\Go˜†\Dane aplikacji 2007-10-04 20:12 <DIR> dr------- C:\Documents and Settings\Go˜†\Ulubione 2007-10-04 20:12 <DIR> dr------- C:\Documents and Settings\Go˜†\Moje dokumenty 2007-10-04 20:12 <DIR> dr------- C:\Documents and Settings\Go˜†\Menu Start 2007-10-04 20:12 <DIR> d--h----- C:\Documents and Settings\Go˜†\Ustawienia lokalne 2007-10-04 20:12 <DIR> d--h----- C:\Documents and Settings\Go˜†\Szablony 2007-10-04 20:12 <DIR> d-------- C:\Documents and Settings\Go˜†\Pulpit 2007-09-21 20:52 2,829 --a------ C:\WINDOWS\War3Unin.pif 2007-09-21 20:52 14,616 --a------ C:\WINDOWS\War3Unin.dat 2007-09-21 20:52 126,976 --a------ C:\WINDOWS\War3Unin.exe . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2007-10-06 21:36 --------- d-------- C:\Documents and Settings\Admin\Dane aplikacji\uTorrent 2007-10-06 21:36 --------- d-------- C:\Documents and Settings\Admin\Dane aplikacji\uTorrent 2007-10-06 21:36 --------- d-------- C:\Documents and Settings\Admin\Dane aplikacji\uTorrent 2007-09-23 11:55 --------- d-------- C:\Documents and Settings\Admin\Dane aplikacji\Skype 2007-09-23 11:55 --------- d-------- C:\Documents and Settings\Admin\Dane aplikacji\Skype 2007-09-23 11:55 --------- d-------- C:\Documents and Settings\Admin\Dane aplikacji\Skype 2007-09-21 20:17 --------- d--h----- C:\Program Files\InstallShield Installation Information 2007-09-06 12:05 94416 --a------ C:\WINDOWS\system32\drivers\aswmon2.sys 2007-09-06 12:05 92848 --a------ C:\WINDOWS\system32\drivers\aswmon.sys 2007-09-06 12:03 23152 --a------ C:\WINDOWS\system32\drivers\aswRdr.sys 2007-09-06 12:02 42912 --a------ C:\WINDOWS\system32\drivers\aswTdi.sys 2007-09-06 12:00 26624 --a------ C:\WINDOWS\system32\drivers\aavmker4.sys 2007-09-02 17:44 28400 --a------ C:\WINDOWS\system32\drivers\secdrv.sys 2007-08-30 20:57 --------- d-------- C:\Program Files\Guitar Pro 5 2007-08-22 20:58 20 --a------ C:\sccfg.sys 2007-08-20 10:39 --------- d-------- C:\Documents and Settings\Admin\Dane aplikacji\Nexon 2007-08-20 10:39 --------- d-------- C:\Documents and Settings\Admin\Dane aplikacji\Nexon 2007-08-20 10:39 --------- d-------- C:\Documents and Settings\Admin\Dane aplikacji\Nexon 2005-12-17 19:42 266 --ahs---- C:\Program Files\desktop.ini 2005-12-17 19:42 11232 --ah----- C:\Program Files\folder.htt 2005-05-13 16:12:00 217,073 --sha-r C:\WINDOWS\meta4.exe 2005-10-24 10:13:58 66,560 --sha-r C:\WINDOWS\MOTA113.exe 2005-10-13 20:27:00 422,400 --sha-r C:\WINDOWS\x2.64.exe 2005-10-07 18:14:52 308,224 --sha-r C:\WINDOWS\SYSTEM32\avisynth.dll 2005-07-14 11:31:20 27,648 --sha-r C:\WINDOWS\SYSTEM32\AVSredirect.dll 2005-06-26 14:32:28 616,448 --sha-r C:\WINDOWS\SYSTEM32\cygwin1.dll 2005-06-21 21:37:42 45,568 --sha-r C:\WINDOWS\SYSTEM32\cygz.dll 2004-01-24 23:00:00 70,656 --sha-r C:\WINDOWS\SYSTEM32\i420vfw.dll 2006-04-27 09:24:24 2,945,024 --sha-r C:\WINDOWS\SYSTEM32\Smab.dll 2005-02-28 12:16:22 240,128 --sha-r C:\WINDOWS\SYSTEM32\x.264.exe 2004-01-24 23:00:00 70,656 --sha-r C:\WINDOWS\SYSTEM32\yv12vfw.dll . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "internat.exe"="internat.exe" [] "Zasobnik systemowy"="SysTray.Exe" [2001-10-26 19:30 C:\WINDOWS\SYSTEM32\systray.exe] "avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-09-06 12:06] "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-08-11 15:43] "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2006-05-09 21:32] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Admin^Menu Start^Programs^Autostart^Adobe Gamma.lnk] path=C:\Documents and Settings\Admin\Menu Start\Programs\Autostart\Adobe Gamma.lnk backup=C:\WINDOWS\pss\Adobe Gamma.lnkStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^DSLMON.lnk] path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\DSLMON.lnk backup=C:\WINDOWS\pss\DSLMON.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Przyspieszenie uruchomienia programu AutoCAD.lnk] path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Przyspieszenie uruchomienia programu AutoCAD.lnk backup=C:\WINDOWS\pss\Przyspieszenie uruchomienia programu AutoCAD.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Service Manager.lnk] path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Service Manager.lnk backup=C:\WINDOWS\pss\Service Manager.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AltnetPointsManager] c:\program files\altnet\points manager\points manager.exe -s [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Blaero Start Orb] C:\Program Files\Blaero Start Orb\Blaero Start Orb.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033 [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DXDllRegExe] dxdllreg.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EdHTML] C:\EdHTMLv5.0\EdHTML.exe /none [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\InCD] C:\Program Files\Ahead\InCD\InCD.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\InstaFinderK] C:\Program Files\INSTAFINK\InstaFinderK_inst.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KAZAA] C:\Program Files\Kazaa\kazaa.exe /SYSTRAY [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Konnekt] "C:\Program Files\Konnekt\konnekt.exe" /autostart [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LClock] C:\Program Files\LClock\LClock.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz] nwiz.exe /install [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PcSync] C:\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PWRISOVM.EXE] C:\Program Files\PowerISO\PWRISOVM.EXE [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl] "C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SemanticInsight] C:\Program Files\RXToolBar\Semantic Insight\SemanticInsight.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan] SOUNDMAN.EXE [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Spik] C:\Program Files\Spik\Spik.exe -autostart [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Styler] C:\Program Files\Styler\Styler.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SystemTray] SysTray.Exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Vista Sidebar] C:\Program Files\Vista Sidebar\sidebar.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent] C:\Program Files\Winamp\winampa.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\winupdates] C:\Program Files\winupdates\winupdates.exe /auto [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\setup\disabledrunkeys] "LoadPowerProfile"=Rundll32.exe powrprof.dll,LoadCurrentPwrScheme "NvCplDaemon"=RUNDLL32.EXE C:\WINDOWS\SYSTEM32\NvCpl.dll,NvStartup "nwiz"=nwiz.exe /install "WinampAgent"=C:\Program Files\Winamp\winampa.exe "Cmaudio"=RunDll32 cmicnfg.cpl,CMICtrlWnd "LoadQM"=loadqm.exe "InCD"=C:\Program Files\Ahead\InCD\InCD.exe "SoundMan"=SOUNDMAN.EXE "autoclk"=autoclk.exe "StillImageMonitor"=C:\WINDOWS\SYSTEM32\STIMON.EXE "HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd.exe" S2 nvtvSND;nVidia WDM TVAudio Crossbar;C:\WINDOWS\system32\DRIVERS\nvtvsnd.sys S3 LMImirr;LMImirr;C:\WINDOWS\system32\DRIVERS\LMImirr.sys [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{28239b20-457b-11db-89ed-4d6564696130}] AutoRun\command- I:\EXPLORER.EXE explore\Command- I:\EXPLORER.EXE open\Command- I:\EXPLORER.EXE [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{51d73800-4739-11db-89f6-4d6564696130}] AutoRun\command- I:\EXPLORER.EXE explore\Command- I:\EXPLORER.EXE open\Command- I:\EXPLORER.EXE [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{5dd3d9b0-812f-11da-86cb-fea6786649f8}] AutoRun\command- EXPLORER.EXE explore\Command- EXPLORER.EXE open\Command- EXPLORER.EXE *Newly Created Service* - CATCHME [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}] rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msimn.inf,User.Install "C:\PROGRA~1\OUTLOO~1\setup50.exe" /APP:OE /CALLER:IE50 /user /install [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{9EF0045A-CDD9-438e-95E6-02B9AFEC8E11}] C:\WINDOWS\SYSTEM32\updcrl.exe -e -u C:\WINDOWS\SYSTEM\verisignpub1.crl . Contents of the 'Scheduled Tasks' folder "2007-10-06 17:00:00 C:\WINDOWS\Tasks\Uruchomienie aplikacji dostrajania.job" . ************************************************************************** catchme 0.3.1169 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-10-07 13:13:39 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2007-10-07 13:15:17 C:\ComboFix-quarantined-files.txt ... 2007-10-07 13:14 . --- E O F ---

**Posty:** 18165 · przez **wojtas** 07 Paź 2007, 13:35

wklej do notatnika

Windows Registry Editor Version 5.00

[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SemanticInsight]

[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KAZAA]

[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\winupdates]

[-HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}]

[-HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{9EF0045A-CDD9-438e-95E6-02B9AFEC8E11}]

w notatniku u góry>>>plik zapisz jako>>>Zmien rozszerzenie z TXT na Wszystkie pliki *.* >>> Zapisz pod nazwą FIX.REG

Klikasz dwa razy na powstały plik fix i dodajesz go do rejestru....

ten plik

C:\WINDOWS\SYSTEM32\Smab.dll

przeskanuj tu:

http://virusscan.jotti.org/
http://www.virustotal.com/

(zeby go zobaczyc musisz :przejdz do opcji: Narzedzia>>Widok>>Pokaz ukryte pliki lub foldery oraz Ukryj chronione pliki systemu operacyjnego)

potem daj raporty i nowy log z combofixa i hijacka

**Posty:** 2008 · przez **fibi07** 07 Paź 2007, 14:40

wojtas19162 napisał(a):http://virusscan.jotti.org/

Scan taken on 07 Oct 2007 11:49:31 (GMT)
A-Squared
Found nothing
AntiVir
Found nothing
ArcaVir
Found nothing
Avast
Found nothing
AVG Antivirus
Found nothing
BitDefender
Found nothing
ClamAV
Found nothing
CPsecure
Found nothing
Dr.Web
Found nothing
F-Prot Antivirus
Found nothing
F-Secure Anti-Virus
Found nothing
Fortinet
Found nothing
Kaspersky Anti-Virus
Found nothing
NOD32
Found nothing
Norman Virus Control
Found nothing
Panda Antivirus
Found nothing
Rising Antivirus
Found nothing
Sophos Antivirus
Found nothing
VirusBuster
Found nothing
VBA32
Found nothing

http://www.virustotal.com/

coś dziwne bo cały czas jest
Obecny status: zakończono
Wynik: 0/31 (0%)

i tak już dosyć długo.

HJT:

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 13:52:53, on 2007-10-07 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Ahead\InCD\InCDsrv.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Microsoft SQL Server\MSSQL$AUTODESKVAULT\Binn\sqlservr.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\System32\PAStiSvc.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\WINDOWS\system32\wscntfy.exe C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\Program Files\Winamp\winamp.exe C:\Konnekt\konnekt.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\WINDOWS\explorer.exe C:\Documents and Settings\Admin\Pulpit\Fibi\Akcesoria\logi\HiJackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.wiadomosci.wp.pl/ R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.windowsxlive.net R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx O2 - BHO: flashget urlcatch - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\FlashGet\jccatch.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O2 - BHO: FlashGet GetFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\FlashGet\getflash.dll O4 - HKLM\..\Run: [internat.exe] internat.exe O4 - HKLM\..\Run: [Zasobnik systemowy] SysTray.Exe O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user') O8 - Extra context menu item: &Ściągnij przy pomocy FlashGet'a - C:\FlashGet\jc_link.htm O8 - Extra context menu item: &Ściągnij wszystko przy pomocy FlashGet'a - C:\FlashGet\jc_all.htm O8 - Extra context menu item: Pobierz z &BitSpirit - C:\BitSpirit\bsurl.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\FlashGet\FlashGet.exe O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\FlashGet\FlashGet.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll O17 - HKLM\System\CCS\Services\Tcpip\..\{293EF9E3-F5F1-4101-9252-6D8F3B0F3BBE}: NameServer = 194.204.159.1 217.98.63.164 O17 - HKLM\System\CS1\Services\Tcpip\..\{293EF9E3-F5F1-4101-9252-6D8F3B0F3BBE}: NameServer = 194.204.159.1 217.98.63.164 O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Ahead\InCD\InCDsrv.exe O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe O23 - Service: STI Simulator - Unknown owner - C:\WINDOWS\System32\PAStiSvc.exe -- End of file - 5260 bytes

Kod: Zaznacz wszystko: ComboFix 07-10-07.1 - Admin 2007-10-07 14:30:44.2 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.39 [GMT 2:00] Running from: C:\Documents and Settings\Admin\Pulpit\Fibi\Akcesoria\logi\ComboFix.exe . ((((((((((((((((((((((((( Files Created from 2007-09-07 to 2007-10-07 ))))))))))))))))))))))))))))))) . 2007-10-07 13:09 51,200 --a------ C:\WINDOWS\NirCmd.exe 2007-10-04 20:12 <DIR> dr-h----- C:\Documents and Settings\Go˜†\Dane aplikacji 2007-10-04 20:12 <DIR> dr------- C:\Documents and Settings\Go˜†\Ulubione 2007-10-04 20:12 <DIR> dr------- C:\Documents and Settings\Go˜†\Moje dokumenty 2007-10-04 20:12 <DIR> dr------- C:\Documents and Settings\Go˜†\Menu Start 2007-10-04 20:12 <DIR> d--h----- C:\Documents and Settings\Go˜†\Ustawienia lokalne 2007-10-04 20:12 <DIR> d--h----- C:\Documents and Settings\Go˜†\Szablony 2007-10-04 20:12 <DIR> d-------- C:\Documents and Settings\Go˜†\Pulpit 2007-09-21 20:52 2,829 --a------ C:\WINDOWS\War3Unin.pif 2007-09-21 20:52 14,616 --a------ C:\WINDOWS\War3Unin.dat 2007-09-21 20:52 126,976 --a------ C:\WINDOWS\War3Unin.exe . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2007-10-06 21:36 --------- d-------- C:\Documents and Settings\Admin\Dane aplikacji\uTorrent 2007-10-06 21:36 --------- d-------- C:\Documents and Settings\Admin\Dane aplikacji\uTorrent 2007-10-06 21:36 --------- d-------- C:\Documents and Settings\Admin\Dane aplikacji\uTorrent 2007-09-23 11:55 --------- d-------- C:\Documents and Settings\Admin\Dane aplikacji\Skype 2007-09-23 11:55 --------- d-------- C:\Documents and Settings\Admin\Dane aplikacji\Skype 2007-09-23 11:55 --------- d-------- C:\Documents and Settings\Admin\Dane aplikacji\Skype 2007-09-21 20:17 --------- d--h----- C:\Program Files\InstallShield Installation Information 2007-09-06 12:05 94416 --a------ C:\WINDOWS\system32\drivers\aswmon2.sys 2007-09-06 12:05 92848 --a------ C:\WINDOWS\system32\drivers\aswmon.sys 2007-09-06 12:03 23152 --a------ C:\WINDOWS\system32\drivers\aswRdr.sys 2007-09-06 12:02 42912 --a------ C:\WINDOWS\system32\drivers\aswTdi.sys 2007-09-06 12:00 26624 --a------ C:\WINDOWS\system32\drivers\aavmker4.sys 2007-09-02 17:44 28400 --a------ C:\WINDOWS\system32\drivers\secdrv.sys 2007-08-30 20:57 --------- d-------- C:\Program Files\Guitar Pro 5 2007-08-22 20:58 20 --a------ C:\sccfg.sys 2007-08-20 10:39 --------- d-------- C:\Documents and Settings\Admin\Dane aplikacji\Nexon 2007-08-20 10:39 --------- d-------- C:\Documents and Settings\Admin\Dane aplikacji\Nexon 2007-08-20 10:39 --------- d-------- C:\Documents and Settings\Admin\Dane aplikacji\Nexon 2005-12-17 19:42 266 --ahs---- C:\Program Files\desktop.ini 2005-12-17 19:42 11232 --ah----- C:\Program Files\folder.htt 2005-05-13 16:12:00 217,073 --sha-r C:\WINDOWS\meta4.exe 2005-10-24 10:13:58 66,560 --sha-r C:\WINDOWS\MOTA113.exe 2005-10-13 20:27:00 422,400 --sha-r C:\WINDOWS\x2.64.exe 2005-10-07 18:14:52 308,224 --sha-r C:\WINDOWS\SYSTEM32\avisynth.dll 2005-07-14 11:31:20 27,648 --sha-r C:\WINDOWS\SYSTEM32\AVSredirect.dll 2005-06-26 14:32:28 616,448 --sha-r C:\WINDOWS\SYSTEM32\cygwin1.dll 2005-06-21 21:37:42 45,568 --sha-r C:\WINDOWS\SYSTEM32\cygz.dll 2004-01-24 23:00:00 70,656 --sha-r C:\WINDOWS\SYSTEM32\i420vfw.dll 2006-04-27 09:24:24 2,945,024 --sha-r C:\WINDOWS\SYSTEM32\Smab.dll 2005-02-28 12:16:22 240,128 --sha-r C:\WINDOWS\SYSTEM32\x.264.exe 2004-01-24 23:00:00 70,656 --sha-r C:\WINDOWS\SYSTEM32\yv12vfw.dll . ((((((((((((((((((((((((((((( snapshot@2007-10-07_13.14.23,25 ))))))))))))))))))))))))))))))))))))))))) . ----a-w 3,915,776 2007-10-07 12:13:54 C:\WINDOWS\Temporary Internet Files\Content.IE5\index.dat . ----a-w 3,915,776 2007-10-07 10:49:22 C:\WINDOWS\Temporary Internet Files\Content.IE5\index.dat . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "internat.exe"="internat.exe" [] "Zasobnik systemowy"="SysTray.Exe" [2001-10-26 19:30 C:\WINDOWS\SYSTEM32\systray.exe] "avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-09-06 12:06] "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-08-11 15:43] "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2006-05-09 21:32] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Admin^Menu Start^Programs^Autostart^Adobe Gamma.lnk] path=C:\Documents and Settings\Admin\Menu Start\Programs\Autostart\Adobe Gamma.lnk backup=C:\WINDOWS\pss\Adobe Gamma.lnkStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^DSLMON.lnk] path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\DSLMON.lnk backup=C:\WINDOWS\pss\DSLMON.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Przyspieszenie uruchomienia programu AutoCAD.lnk] path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Przyspieszenie uruchomienia programu AutoCAD.lnk backup=C:\WINDOWS\pss\Przyspieszenie uruchomienia programu AutoCAD.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Service Manager.lnk] path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Service Manager.lnk backup=C:\WINDOWS\pss\Service Manager.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AltnetPointsManager] c:\program files\altnet\points manager\points manager.exe -s [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Blaero Start Orb] C:\Program Files\Blaero Start Orb\Blaero Start Orb.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033 [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DXDllRegExe] dxdllreg.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EdHTML] C:\EdHTMLv5.0\EdHTML.exe /none [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\InCD] C:\Program Files\Ahead\InCD\InCD.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\InstaFinderK] C:\Program Files\INSTAFINK\InstaFinderK_inst.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Konnekt] "C:\Program Files\Konnekt\konnekt.exe" /autostart [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LClock] C:\Program Files\LClock\LClock.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz] nwiz.exe /install [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PcSync] C:\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PWRISOVM.EXE] C:\Program Files\PowerISO\PWRISOVM.EXE [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl] "C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan] SOUNDMAN.EXE [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Spik] C:\Program Files\Spik\Spik.exe -autostart [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Styler] C:\Program Files\Styler\Styler.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SystemTray] SysTray.Exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Vista Sidebar] C:\Program Files\Vista Sidebar\sidebar.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent] C:\Program Files\Winamp\winampa.exe [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\setup\disabledrunkeys] "LoadPowerProfile"=Rundll32.exe powrprof.dll,LoadCurrentPwrScheme "NvCplDaemon"=RUNDLL32.EXE C:\WINDOWS\SYSTEM32\NvCpl.dll,NvStartup "nwiz"=nwiz.exe /install "WinampAgent"=C:\Program Files\Winamp\winampa.exe "Cmaudio"=RunDll32 cmicnfg.cpl,CMICtrlWnd "LoadQM"=loadqm.exe "InCD"=C:\Program Files\Ahead\InCD\InCD.exe "SoundMan"=SOUNDMAN.EXE "autoclk"=autoclk.exe "StillImageMonitor"=C:\WINDOWS\SYSTEM32\STIMON.EXE "HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd.exe" R1 oreans32;oreans32;\??\C:\WINDOWS\system32\drivers\oreans32.sys R1 VIAPFD;VIAPFD;C:\WINDOWS\system32\Drivers\VIAPFD.SYS R2 MSSQL$AUTODESKVAULT;MSSQL$AUTODESKVAULT;"C:\Program Files\Microsoft SQL Server\MSSQL$AUTODESKVAULT\Binn\sqlservr.exe" -sAUTODESKVAULT R2 Vcs;Vcs support;\??\C:\WINDOWS\system32\Drivers\Vcs.sys S2 nvtvSND;nVidia WDM TVAudio Crossbar;C:\WINDOWS\system32\DRIVERS\nvtvsnd.sys S3 LMImirr;LMImirr;C:\WINDOWS\system32\DRIVERS\LMImirr.sys S3 PAC207;Trust WB-1200p Mini Webcam;C:\WINDOWS\system32\DRIVERS\pfc027.sys S3 SQLAgent$AUTODESKVAULT;SQLAgent$AUTODESKVAULT;"C:\Program Files\Microsoft SQL Server\MSSQL$AUTODESKVAULT\Binn\sqlagent.EXE" -i AUTODESKVAULT S3 ZDCndis5;ZDCndis5 Protocol Driver;\??\C:\WINDOWS\system32\ZDCndis5.SYS [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{28239b20-457b-11db-89ed-4d6564696130}] AutoRun\command- I:\EXPLORER.EXE explore\Command- I:\EXPLORER.EXE open\Command- I:\EXPLORER.EXE [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{51d73800-4739-11db-89f6-4d6564696130}] AutoRun\command- I:\EXPLORER.EXE explore\Command- I:\EXPLORER.EXE open\Command- I:\EXPLORER.EXE [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{5dd3d9b0-812f-11da-86cb-fea6786649f8}] AutoRun\command- EXPLORER.EXE explore\Command- EXPLORER.EXE open\Command- EXPLORER.EXE *Newly Created Service* - CATCHME . Contents of the 'Scheduled Tasks' folder "2007-10-06 17:00:00 C:\WINDOWS\Tasks\Uruchomienie aplikacji dostrajania.job" . ************************************************************************** catchme 0.3.1169 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-10-07 14:33:24 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2007-10-07 14:35:01 C:\ComboFix-quarantined-files.txt ... 2007-10-07 14:34 C:\ComboFix2.txt ... 2007-10-07 13:15 . --- E O F ---

**Posty:** 18165 · przez **wojtas** 07 Paź 2007, 14:45

C:\sccfg.sys

miales w systemie program folder lock ? bo ten plik jest od niego... jesli nie miales badz juz nie masz skasuj ten plik .. po za tym w logu nic wiecej nie widze jesli problem z Internetem nie ustapil proponuje zadzwonij do swojego uslugodawcy

wklej do notatnika:

REGEDIT 4

[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{28239b20-457b-11db-89ed-4d6564696130}]

[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{51d73800-4739-11db-89f6-4d6564696130}]

[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{5dd3d9b0-812f-11da-86cb-fea6786649f8}]

zapisz pod nazwa FIX.reg i dodaj do rejestru

Autor postu otrzymał pochwałę

**Posty:** 2008 · przez **fibi07** 07 Paź 2007, 15:00

i to wszystko? dzięki. co do internetu to się zobaczy

w sumie na ip.wp.pl podaje ze mam 900kb/s ale zobacze później czy coś się bedzie dziać dzieki.

internet czesto zwalnia, prośba o sprawdzenie loga

internet czesto zwalnia, prośba o sprawdzenie loga

Kto jest na forum