komputer muli, a anwet się zawiesza

**Posty:** 69 · przez **Fingfolin** 01 Gru 2007, 16:01

Witam, komputer nie chodzi jak powinien. W logu widzę masę sterów, wolę nie działac na własną rękę. Oto log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 14:38:09, on 2007-12-01
Platform: Windows XP Dodatek SP. 1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\NVIDIA Corporation\nTune\nTuneService.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Winamp\winampa.exe
C:\Program Files\Nero\Nero 7\InCD\NBHGui.exe
C:\Program Files\ATI Technologies\ATI.ACE\CLI.EXE
C:\Program Files\Nero\Nero 7\InCD\InCD.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\WINDOWS\System32\ctfmon.exe
C:\WINDOWS\System32\temp1.exe
E:\Gadu-Gadu\gg.exe
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe
C:\Program Files\DAEMON Tools Pro\DTProAgent.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
C:\Program Files\SAGEM WiFi manager\WLANUTL.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
C:\Program Files\MagicDisc\MagicDisc.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\PROGRA~1\Mozilla Firefox\firefox.exe
C:\Program Files\Winamp\winamp.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
E:\Program Files\eMule\emule.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
F3 - REG:win.ini: load=C:\WINDOWS\svchost.exe
O2 - BHO: ConnectionServices module - {6D7B211A-88EA-490c-BAB9-3600D8D7C503} - C:\Program Files\ConnectionServices\ConnectionServices.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: BitAccelerator module - {92860A02-4D69-48c1-82D7-EF6B2C609502} - C:\Program Files\BitAccelerator\BitAccelerator.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [SecurDisc] C:\Program Files\Nero\Nero 7\InCD\NBHGui.exe
O4 - HKLM\..\Run: [InCD] C:\Program Files\Nero\Nero 7\InCD\InCD.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [Gadu-Gadu] "E:\Gadu-Gadu\gg.exe" /tray
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [LightScribe Control Panel] C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe -hidden
O4 - HKCU\..\Run: [DAEMON Tools Pro Agent] "C:\Program Files\DAEMON Tools Pro\DTProAgent.exe"
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'USŁUGA LOKALNA')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'USŁUGA SIECIOWA')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Startup: MagicDisc.lnk = C:\Program Files\MagicDisc\MagicDisc.exe
O4 - Global Startup: Program sieciowy dla SAGEM Wi-Fi 11g USB adapter.lnk = ?
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: nTune Service (nTuneService) - NVIDIA - C:\Program Files\NVIDIA Corporation\nTune\nTuneService.exe
O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe

--
End of file - 5359 bytes

**Posty:** 18165 · przez **wojtas** 01 Gru 2007, 17:01

F3 - REG:win.ini: load=C:\WINDOWS\svchost.exe
O2 - BHO: ConnectionServices module - {6D7B211A-88EA-490c-BAB9-3600D8D7C503} - C:\Program Files\ConnectionServices\ConnectionServices.dll
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm

kasujesz wpisy + pogrubione do kosza

znasz to:

O2 - BHO: BitAccelerator module - {92860A02-4D69-48c1-82D7-EF6B2C609502} - C:\Program Files\BitAccelerator\BitAccelerator.dll

Zastosuj SDFix . Po pobraniu uruchom go a rozpakuje się do C:\SDFix. Uruchom komputer w trybie awaryjnym (F8 przy stracie systemu). Będąc w awaryjnym uruchom plik RunThis.bat z folderu SDFixa. Zatwierdź czyszczenie przez Y. Poczekaj aż ukończy i komputer zresetuje

Potem wejdz do folderu SDFix wrzuc zawartość pliku Report.txt + log z hijacka oraz z combofixa (tylko przed uzyciem combo zmien date w komputerze np. na 15.11.2007 zeby byla wczesniejsza niz dzisiejsza data)

Autor postu otrzymał pochwałę

**Posty:** 69 · przez **Fingfolin** 02 Gru 2007, 11:57

wojtas19162 napisał(a):O2 - BHO: BitAccelerator module - {92860A02-4D69-48c1-82D7-EF6B2C609502} - C:\Program Files\BitAccelerator\BitAccelerator.dll

Instalowałem ten program. Wirus się tam jakiś zakradł, czy sam program uważasz za wirusa ?

**Posty:** 18165 · przez **wojtas** 02 Gru 2007, 12:59

pytam sie czy znasz go

bo ja nie znam. wykonaj co kazalem i wroc z logami

**Posty:** 69 · przez **Fingfolin** 02 Gru 2007, 15:15

Cholera, usunąłem svchost z system 32 ... xD. Nie da się puścić przywracania systemu, nie da się przywrócić nawet z kosza, nie wiem co mam zrobić :roll:

. Help!

**Posty:** 7838 · przez **Lukesh** 02 Gru 2007, 15:26

Wejdz do konsoli odzyskiwania wg opisu: http://www.searchengines.pl/index.php?showtopic=14270,
Przy wlozonej instalce windowsa wpisz komende:

expand X:\i386\svchost.ex_ C:\Windows\system32\svchost.exe

X - litera Twojego napędu.

C - litera partycji, na której znajduje się system operacyjny.

Autor postu otrzymał pochwałę

**Posty:** 69 · przez **Fingfolin** 02 Gru 2007, 19:10

Zrobione :

Kod: Zaznacz wszystko: ComboFix 07-12-02.5 - OLWE 2007-01-02 18:02:28.2 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.1.1250.1.1045.18.1529 [GMT 1:00] Running from: C:\Documents and Settings\OLWE\Pulpit\ComboFix.exe . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\copy.exe C:\host.exe C:\WINDOWS\system32\temp1.exe C:\WINDOWS\system32\temp2.exe C:\WINDOWS\xcopy.exe E:\copy.exe E:\host.exe . ((((((((((((((((((((((((( Files Created from 2007-11-02 to 2007-12-02 ))))))))))))))))))))))))))))))) . 2007-12-02 17:59 . 2007-12-02 17:59 <DIR> d-------- C:\WINDOWS\LastGood 2007-12-02 17:59 . 2004-08-03 14:00 421,656 --a------ C:\WINDOWS\system32\wuapi.dll 2007-12-02 17:59 . 2004-08-03 14:04 187,160 --a------ C:\WINDOWS\system32\wuaueng1.dll 2007-12-02 17:59 . 2004-08-03 14:03 170,264 --a------ C:\WINDOWS\system32\wuauclt1.exe 2007-12-02 17:59 . 2004-08-03 14:02 168,728 --a------ C:\WINDOWS\system32\wuaucpl.cpl 2007-12-02 17:59 . 2004-08-03 13:58 120,288 --a------ C:\WINDOWS\system32\wuweb.dll 2007-12-02 17:59 . 2004-08-03 14:03 119,576 --a------ C:\WINDOWS\system32\wucltui.dll 2007-12-02 17:59 . 2004-08-03 14:01 39,704 --a------ C:\WINDOWS\system32\wups.dll 2007-12-02 17:25 . 2007-12-02 17:25 <DIR> d-------- C:\WINDOWS\SDFIX 2007-12-02 17:13 . 2001-10-26 17:30 12,800 --a------ C:\WINDOWS\system32\svchost.exe 2007-12-02 17:13 . 2001-10-26 17:30 12,800 --a--c--- C:\WINDOWS\system32\dllcache\svchost.exe 2007-12-02 11:08 . 2007-11-14 18:09 <DIR> d--h----- C:\Documents and Settings\Administrator\Ustawienia lokalne 2007-12-02 11:08 . 2007-11-14 18:09 <DIR> d-------- C:\Documents and Settings\Administrator\Ulubione 2007-12-02 11:08 . 2007-11-14 18:13 <DIR> d--h----- C:\Documents and Settings\Administrator\Szablony 2007-12-02 11:08 . 2007-11-14 18:09 <DIR> d-------- C:\Documents and Settings\Administrator\Pulpit 2007-12-02 11:08 . 2007-11-14 18:09 <DIR> d-------- C:\Documents and Settings\Administrator\Moje dokumenty 2007-12-02 11:08 . 2007-11-14 18:09 <DIR> dr------- C:\Documents and Settings\Administrator\Menu Start 2007-12-02 11:08 . 2007-11-14 18:09 <DIR> dr-h----- C:\Documents and Settings\Administrator\Dane aplikacji 2007-12-02 11:06 . 2007-12-02 11:06 <DIR> d-------- C:\WINDOWS\system32\NtmsData 2007-12-01 19:16 . 2007-12-01 19:16 <DIR> d--h----- C:\WINDOWS\PIF 2007-12-01 16:55 . 2007-12-01 16:55 <DIR> d-------- C:\WINDOWS\AM 2007-12-01 16:55 . 2007-12-01 16:55 <DIR> d-------- C:\Program Files\reksio 2007-12-01 13:50 . 2007-12-01 13:50 <DIR> d-------- C:\Program Files\Trend Micro 2007-11-26 22:06 . 2007-11-26 22:06 88 --a------ C:\WINDOWS\VplayerINI.vpl 2007-11-26 22:03 . 2007-11-26 22:06 919 --a------ C:\WINDOWS\VPlayer.INI 2007-11-26 19:02 . 2002-08-29 01:32 21,760 --a--c--- C:\WINDOWS\system32\dllcache\usbstor.sys 2007-11-24 20:34 . 2007-11-24 20:34 <DIR> d-------- C:\Program Files\Codec Pack - All In 1 2007-11-24 20:34 . 2007-11-24 20:33 737,280 --a------ C:\WINDOWS\iun6002.exe 2007-11-19 21:24 . 2007-11-19 21:24 <DIR> d-------- C:\Wiedźmin 2007-11-19 21:11 . 2007-11-19 21:11 <DIR> d-------- C:\Documents and Settings\OLWE\Dane aplikacji\DAEMON Tools Pro 2007-11-19 21:11 . 2007-11-19 21:22 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\DAEMON Tools Pro 2007-11-19 21:08 . 2007-11-19 21:11 <DIR> d-------- C:\Program Files\RarZilla Free Unrar 2007-11-19 21:08 . 2007-11-19 21:23 <DIR> d-------- C:\Program Files\DAEMON Tools Pro 2007-11-19 16:04 . 2007-11-19 16:04 278,984 --a------ C:\WINDOWS\system32\drivers\atksgt.sys 2007-11-19 16:04 . 2007-11-19 16:04 25,416 --a------ C:\WINDOWS\system32\drivers\lirsgt.sys 2007-11-17 23:08 . 2007-11-18 23:03 <DIR> d-------- C:\Program Files\IDoser v4 2007-11-17 14:01 . 2007-12-01 13:29 69 --a------ C:\WINDOWS\NeroDigital.ini 2007-11-17 00:34 . 2007-11-17 00:34 <DIR> d-------- C:\Program Files\BitAccelerator 2007-11-17 00:18 . 2007-11-17 00:18 <DIR> d-------- C:\Program Files\BitAccelleratorFull 2007-11-16 23:43 . 2007-11-16 23:43 <DIR> d-------- C:\Program Files\SystemRequirementsLab 2007-11-16 23:42 . 2007-11-16 23:42 <DIR> d-------- C:\Documents and Settings\OLWE\SystemRequirementsLab 2007-11-16 23:41 . 2007-11-16 23:41 <DIR> d-------- C:\WINDOWS\Sun 2007-11-16 23:41 . 2007-11-16 23:41 <DIR> d-------- C:\Program Files\Java 2007-11-16 23:41 . 2007-09-24 23:31 69,632 --a------ C:\WINDOWS\system32\javacpl.cpl 2007-11-16 23:38 . 2007-11-16 23:38 <DIR> d-------- C:\Program Files\Common Files\Java 2007-11-16 19:52 . 2007-11-16 19:52 <DIR> d-------- C:\Program Files\Common Files\LightScribe 2007-11-16 19:51 . 2007-11-16 19:51 <DIR> d-------- C:\Documents and Settings\OLWE\Dane aplikacji\Ahead 2007-11-16 19:51 . 2007-11-16 19:51 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Ahead 2007-11-16 19:48 . 2007-11-16 19:48 <DIR> d-------- C:\Program Files\Nero 2007-11-16 19:48 . 2007-11-16 19:51 <DIR> d-------- C:\Program Files\Common Files\Ahead 2007-11-16 19:48 . 2007-11-16 19:48 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Nero 2007-11-16 19:48 . 2007-11-16 19:48 316,640 --a------ C:\WINDOWS\WMSysPr9.prx 2007-11-16 14:26 . 2007-11-16 14:26 <DIR> d-------- C:\Program Files\NVIDIA Corporation 2007-11-15 10:56 . 2007-11-16 23:40 1,286 --a------ C:\WINDOWS\mozver.dat 2007-11-15 10:54 . 2007-11-15 10:54 <DIR> d-------- C:\Program Files\AbiSuite2 2007-11-15 10:54 . 2007-11-15 10:55 <DIR> d-------- C:\Documents and Settings\OLWE\AbiSuite 2007-11-14 19:50 . 2007-11-14 19:50 <DIR> d-------- C:\Program Files\MagicDisc 2007-11-14 19:50 . 2007-09-05 01:46 92,544 --a------ C:\WINDOWS\system32\drivers\mcdbus.sys 2007-11-14 19:49 . 2007-11-14 19:49 <DIR> d-------- C:\Documents and Settings\OLWE\Dane aplikacji\Talkback 2007-11-14 19:49 . 2007-11-14 19:49 0 --a------ C:\WINDOWS\nsreg.dat 2007-11-14 19:45 . 2007-11-14 19:45 <DIR> d-------- C:\WINDOWS\system32\config\systemprofile\Dane aplikacji\ATI 2007-11-14 19:36 . 2007-11-14 19:36 <DIR> d-------- C:\Program Files\SAGEM WiFi manager 2007-11-14 19:36 . 2007-11-14 19:36 <DIR> d-------- C:\Program Files\SAGEM 2007-11-14 19:36 . 2007-01-16 13:52 20,608 --a------ C:\WINDOWS\system32\drivers\BRGSp50.sys 2007-11-14 19:36 . 2007-01-16 13:52 17,664 --a------ C:\WINDOWS\system32\drivers\ZDPSp50.sys 2007-11-14 19:34 . 2007-01-10 10:14 450,560 --a------ C:\WINDOWS\system32\drivers\WlanBZXP.sys 2007-11-14 19:33 . 2005-06-17 10:26 114,688 --a------ C:\WINDOWS\system32\WLANUTL.dll 2007-11-14 19:33 . 2005-06-17 10:26 61,440 --a------ C:\WINDOWS\system32\W32N50.dll 2007-11-14 19:28 . 2002-12-12 00:14 4,096 --a------ C:\WINDOWS\system32\ksuser.dll 2007-11-14 19:24 . 2007-11-14 19:24 <DIR> d-------- C:\Documents and Settings\OLWE\Dane aplikacji\ATI 2007-11-14 19:21 . 2007-11-14 19:21 <DIR> d-------- C:\Program Files\Common Files\ATI Technologies 2007-11-14 19:20 . 2007-11-14 19:20 <DIR> d-------- C:\Program Files\Alcohol Soft 2007-11-14 19:20 . 2007-11-14 19:20 <DIR> d-------- C:\Documents and Settings\OLWE\Dane aplikacji\Gadu-Gadu 2007-11-14 19:19 . 2007-11-14 19:47 <DIR> d-------- C:\Documents and Settings\OLWE\Gadu-Gadu 2007-11-14 19:19 . 2006-12-20 21:05 520,192 --------- C:\WINDOWS\system32\ati2sgag.exe 2007-11-14 19:19 . 2006-12-17 03:41 307,200 -ra------ C:\WINDOWS\system32\atiiiexx.dll 2007-11-14 19:19 . 2006-11-21 23:48 6,973 -ra------ C:\WINDOWS\system32\atifglpf.xml 2007-11-14 19:18 . 2007-11-14 19:22 <DIR> d-------- C:\Program Files\ATI Technologies 2007-11-14 19:18 . 2006-12-17 03:30 3,107,788 -ra------ C:\WINDOWS\system32\ativvaxx.dat 2007-11-14 19:18 . 2006-08-23 23:26 655,842 -ra------ C:\WINDOWS\system32\drivers\ativcaxx.cpa 2007-11-14 19:18 . 2006-11-28 20:55 142,347 -ra------ C:\WINDOWS\system32\atiicdxx.dat 2007-11-14 19:18 . 2006-12-17 04:08 38,944 -ra------ C:\WINDOWS\system32\drivers\ativvpxx.vp 2007-11-14 19:18 . 2006-08-23 23:26 2,096 -ra------ C:\WINDOWS\system32\drivers\ativdkxx.vp 2007-11-14 19:18 . 2006-08-23 23:26 2,096 -ra------ C:\WINDOWS\system32\drivers\ativckxx.vp 2007-11-14 19:18 . 2006-08-23 23:26 929 -ra------ C:\WINDOWS\system32\drivers\ativcaxx.vp 2007-11-14 19:09 . 2007-11-19 20:51 685,816 --a------ C:\WINDOWS\system32\drivers\sptd.sys 2007-11-14 19:08 . 2007-11-14 18:16 261 --a------ C:\WINDOWS\system32\$winnt$.inf 2007-11-14 19:08 . 2007-11-14 18:12 194 ---hs---- C:\boot.ini . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2007-11-19 20:57 --------- d--h--w C:\Program Files\InstallShield Installation Information 2007-11-14 18:21 --------- d-----w C:\Program Files\Common Files\InstallShield 2007-11-14 17:58 --------- d-----w C:\Program Files\NAPI-PROJEKT 2007-11-14 17:57 --------- d-----w C:\Program Files\Winamp 2007-11-14 17:57 --------- d-----w C:\Program Files\UltraISO 2007-11-14 17:57 --------- d-----w C:\Program Files\Common Files\EZB Systems 2007-11-14 17:57 --------- d-----w C:\Documents and Settings\OLWE\Dane aplikacji\MusicIP 2007-11-14 17:23 --------- d-----w C:\Program Files\Realtek 2007-11-14 17:22 315,392 ----a-w C:\WINDOWS\HideWin.exe 2007-11-14 17:22 --------- d-----w C:\Documents and Settings\OLWE\Dane aplikacji\InstallShield 2007-11-14 17:15 558,142 ----a-w C:\WINDOWS\java\Packages\ZXZPN5BX.ZIP 2007-11-14 17:15 155,995 ----a-w C:\WINDOWS\java\Packages\3DN1NRVB.ZIP 2007-11-14 17:15 --------- d-----w C:\Program Files\microsoft frontpage 2007-11-14 17:13 --------- d-----w C:\Program Files\Usługi online . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{92860A02-4D69-48c1-82D7-EF6B2C609502}] 2007-10-24 18:28 73728 --a------ C:\Program Files\BitAccelerator\BitAccelerator.dll [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\System32\ctfmon.exe" [2002-09-28 23:00] "Gadu-Gadu"="E:\Gadu-Gadu\gg.exe" [2007-07-09 08:39] "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2007-06-01 10:21] "LightScribe Control Panel"="C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe" [2007-05-15 17:12] "DAEMON Tools Pro Agent"="C:\Program Files\DAEMON Tools Pro\DTProAgent.exe" [2007-09-06 14:08] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "RTHDCPL"="RTHDCPL.EXE" [2007-06-13 07:49 C:\WINDOWS\RTHDCPL.EXE] "WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2007-04-25 16:44] "ATICCC"="C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe" [2006-09-25 09:12] "NeroFilterCheck"="C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" [2007-03-01 15:57] "SecurDisc"="C:\Program Files\Nero\Nero 7\InCD\NBHGui.exe" [2007-06-01 10:06] "InCD"="C:\Program Files\Nero\Nero 7\InCD\InCD.exe" [2007-06-01 10:05] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11] "SDFix"="E:\SDFix\RunThis.bat /second" [] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2002-09-28 23:00] C:\Documents and Settings\OLWE\Menu Start\Programy\Autostart\ MagicDisc.lnk - C:\Program Files\MagicDisc\MagicDisc.exe [2007-11-14 19:50:37] C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\ Program sieciowy dla SAGEM Wi-Fi 11g USB adapter.lnk - C:\Program Files\SAGEM WiFi manager\WLANUTL.exe [2007-11-14 19:36:07] R1 ISODrive;ISO DVD/CD-ROM Device Driver;\??\C:\Program Files\UltraISO\drivers\ISODrive.sys R3 SG762_XP;SAGEM 802.11g XG762 1211B Driver;C:\WINDOWS\System32\DRIVERS\WlanBZXP.sys S3 ZDCndis5;ZDCndis5 Protocol Driver;\??\C:\WINDOWS\System32\ZDCndis5.SYS S3 ZDPNDIS5;ZDPNDIS5 NDIS Protocol Driver;\??\C:\WINDOWS\System32\ZDPNDIS5.SYS *Newly Created Service* - CATCHME *Newly Created Service* - PROCEXP90 [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}] "C:\Program Files\Common Files\LightScribe\LSRunOnce.exe" . ************************************************************************** catchme 0.3.1318 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-12-02 18:02:52 Windows 5.1.2600 Dodatek Service Pack. 1 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2007-12-02 18:03:00 . --- E O F ---

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:09:48, on 2007-12-02
Platform: Windows XP Dodatek SP. 1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\NVIDIA Corporation\nTune\nTuneService.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Winamp\winampa.exe
C:\Program Files\ATI Technologies\ATI.ACE\CLI.EXE
C:\Program Files\Nero\Nero 7\InCD\NBHGui.exe
C:\Program Files\Nero\Nero 7\InCD\InCD.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\WINDOWS\System32\ctfmon.exe
E:\Gadu-Gadu\gg.exe
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe
C:\Program Files\DAEMON Tools Pro\DTProAgent.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
C:\Program Files\SAGEM WiFi manager\WLANUTL.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
C:\Program Files\MagicDisc\MagicDisc.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\PROGRA~1\Mozilla Firefox\firefox.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: BitAccelerator module - {92860A02-4D69-48c1-82D7-EF6B2C609502} - C:\Program Files\BitAccelerator\BitAccelerator.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [SecurDisc] C:\Program Files\Nero\Nero 7\InCD\NBHGui.exe
O4 - HKLM\..\Run: [InCD] C:\Program Files\Nero\Nero 7\InCD\InCD.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [SDFix] E:\SDFix\RunThis.bat /second
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [Gadu-Gadu] "E:\Gadu-Gadu\gg.exe" /tray
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [LightScribe Control Panel] C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe -hidden
O4 - HKCU\..\Run: [DAEMON Tools Pro Agent] "C:\Program Files\DAEMON Tools Pro\DTProAgent.exe"
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'USŁUGA LOKALNA')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'USŁUGA SIECIOWA')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Startup: MagicDisc.lnk = C:\Program Files\MagicDisc\MagicDisc.exe
O4 - Global Startup: Program sieciowy dla SAGEM Wi-Fi 11g USB adapter.lnk = ?
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: nTune Service (nTuneService) - NVIDIA - C:\Program Files\NVIDIA Corporation\nTune\nTuneService.exe
O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe

--
End of file - 4937 bytes

**Posty:** 18165 · przez **wojtas** 02 Gru 2007, 19:16

skasuj:

O4 - HKLM\..\Run: [SDFix] E:\SDFix\RunThis.bat /second

i bedzie ok

komputer muli, a anwet się zawiesza

komputer muli, a anwet się zawiesza

Kto jest na forum