Log(komputer sie zawiesza)

**Posty:** 105 · przez **kristof200** 20 Wrz 2008, 20:19

Czesc a wiec mam problem tzn kolega .A wiec wylacza mu sie komp po niewiem kolo 10-15 minut .
Ma nowego Windowsa wiec niewiem czy to to bo wszystko dobrze dzialalo.
Log z hijacka.Dac z combo?albo z FixIEDef.?

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 19:58:57, on 2008-09-20 Platform: Windows XP Dodatek SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16705) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\Program Files\ESET\ESET Smart Security\egui.exe C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe C:\Program Files\ESET\ESET Smart Security\ekrn.exe C:\Program Files\Alcohol Soft\Alcohol 52\StarWind\StarWindServiceAE.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Gadu-Gadu\gg.exe C:\Program Files\PC Connectivity Solution\ServiceLayer.exe C:\Program Files\Teamspeak2_RC2\TeamSpeak.exe C:\WINDOWS\system32\wuauclt.exe C:\Documents and Settings\User\Pulpit\HiJackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://search.conduit.com?SearchSource=10&ctid=CT1098640 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.microsoft.com/fwlink/?LinkId=74005 R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = socks= R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = plimus.com,www.plimus.com,regnow.com,www.regnow.com, R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll R3 - URLSearchHook: free-downloads.net Toolbar - {ecdee021-0d17-467f-a1ff-c7a115230949} - C:\Program Files\free-downloads.net\tbfree.dll O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: free-downloads.net Toolbar - {ecdee021-0d17-467f-a1ff-c7a115230949} - C:\Program Files\free-downloads.net\tbfree.dll O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O3 - Toolbar: free-downloads.net Toolbar - {ecdee021-0d17-467f-a1ff-c7a115230949} - C:\Program Files\free-downloads.net\tbfree.dll O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET Smart Security\egui.exe" /hide /waitservice O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -startup O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background O4 - HKCU\..\Run: [AlcoholAutomount] "C:\Program Files\Alcohol Soft\Alcohol 52\axcmd.exe" /automount O4 - HKUS\S-1-5-19\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-19\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [Nokia.PCSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog (User 'SYSTEM') O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [Nokia.PCSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog (User 'Default user') O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'Default user') O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - (no file) O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - (no file) O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll O17 - HKLM\System\CCS\Services\Tcpip\..\{4B7E02ED-CC7C-4B81-B9BC-775EE0A41D2D}: NameServer = 208.67.222.222,208.67.222.220 O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: Usługa bramy warstwy aplikacji (ALG) - Unknown owner - C:\WINDOWS\System32\alg.exe (file missing) O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET Smart Security\ekrn.exe O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 52\StarWind\StarWindServiceAE.exe -- End of file - 6600 bytes

**Posty:** 684 · przez **djarta** 20 Wrz 2008, 20:22

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://search.conduit.com?SearchSource=10&ctid=CT1098640
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - (no file)
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - (no file)

Te w/w wpisy sfiksuj w Hijacku:
>>Hijack>>scan(Do a system scan only)>>zaznacz je >>Fix checked.

Daj log z ComboFixa.

===========================
K.

**Posty:** 105 · przez **kristof200** 20 Wrz 2008, 21:23

Kod: Zaznacz wszystko: combo. ComboFix 08-09-16.05 - User 2008-09-20 21:17:55.1 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.3.1250.1.1045.18.267 [GMT 2:00] Uruchomiony z: C:\Documents and Settings\User\Pulpit\ComboFix.exe * Utworzono nowy punkt przywracania * Resident AV is active [color=red][b]UWAGA - TEN KOMPUTER NIE MA ZAINSTALOWANEJ KONSOLI ODZYSKIWANIA !![/b][/color] . ((((((((((((((((((((((((((((((((((((((( Usunięto ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\Documents and Settings\User\Dane aplikacji\inst.exe . ((((((((((((((((((((((((( Pliki utworzone od 2008-08-20 do 2008-09-20 ))))))))))))))))))))))))))))))) . 2008-09-20 17:58 . 2008-09-20 17:58 <DIR> d-------- C:\!FixIEDef 2008-09-17 19:29 . 2008-09-17 19:29 <DIR> d-------- C:\temp\photosmart 2008-09-16 16:22 . 2004-05-04 12:53 1,645,320 --a------ C:\WINDOWS\system32\gdiplus.dll 2008-09-16 16:18 . 2008-09-16 16:22 <DIR> d-------- C:\Program Files\BurnAware Free 2008-09-14 22:19 . 2008-09-14 22:19 <DIR> d-------- C:\Documents and Settings\User\DoctorWeb 2008-09-14 22:19 . 2008-09-14 22:19 <DIR> d-------- C:\Documents and Settings\User\Dane aplikacji\FDRLab 2008-09-13 22:12 . 2008-09-13 22:12 <DIR> d-------- C:\Documents and Settings\User\WINDOWS 2008-09-13 11:57 . 2008-09-13 11:57 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Yahoo! Companion 2008-09-11 19:37 . 2008-09-17 19:32 <DIR> d-------- C:\WINDOWS\system32\NtmsData 2008-09-11 19:35 . 2008-09-17 19:29 <DIR> d-------- C:\temp 2008-09-09 13:17 . 2008-09-09 13:18 <DIR> d-------- C:\Program Files\Shut Down-O-Matic 2008-09-07 12:21 . 2008-09-04 21:02 17,290 --------- C:\WINDOWS\HPHins01.dat.temp 2008-09-07 12:21 . 2003-09-12 23:31 4,308 --------- C:\WINDOWS\hphmdl01.dat.temp 2008-09-06 16:55 . 2008-09-06 16:56 191 --a------ C:\WINDOWS\wcx_ftp.ini 2008-09-06 16:51 . 2008-09-06 16:54 <DIR> d-------- C:\totalcmd 2008-09-06 16:51 . 2006-11-22 07:00 545 --a------ C:\WINDOWS\UC.PIF 2008-09-06 16:51 . 2006-11-22 07:00 545 --a------ C:\WINDOWS\RAR.PIF 2008-09-06 16:51 . 2006-11-22 07:00 545 --a------ C:\WINDOWS\PKZIP.PIF 2008-09-06 16:51 . 2006-11-22 07:00 545 --a------ C:\WINDOWS\PKUNZIP.PIF 2008-09-06 16:51 . 2006-11-22 07:00 545 --a------ C:\WINDOWS\NOCLOSE.PIF 2008-09-06 16:51 . 2006-11-22 07:00 545 --a------ C:\WINDOWS\LHA.PIF 2008-09-06 16:51 . 2006-11-22 07:00 545 --a------ C:\WINDOWS\ARJ.PIF 2008-09-06 16:51 . 2008-09-06 17:02 528 --a------ C:\WINDOWS\wincmd.ini 2008-09-06 16:48 . 2008-09-06 16:49 <DIR> d-------- C:\Program Files\JalbumWin 2008-09-06 16:46 . 2008-09-06 16:46 <DIR> d-------- C:\Documents and Settings\User\Dane aplikacji\Nokia Multimedia Player 2008-09-05 21:30 . 2008-09-05 21:30 <DIR> d-------- C:\Program Files\Theorica Divx ;-) Codecs 2008-09-05 20:52 . 2008-09-05 20:52 <DIR> d-------- C:\Program Files\XviD 2008-09-04 21:05 . 2003-05-14 21:21 266,296 -ra------ C:\WINDOWS\system32\HPZidr12.dll 2008-09-04 21:05 . 2003-05-14 21:23 196,608 -ra------ C:\WINDOWS\system32\HPZipr12.dll 2008-09-04 21:05 . 2003-05-14 21:14 94,208 -ra------ C:\WINDOWS\system32\HPZipt12.dll 2008-09-04 21:05 . 2003-05-14 21:45 65,795 -ra------ C:\WINDOWS\system32\HPZipm12.exe 2008-09-04 21:05 . 2003-05-14 21:45 61,699 -ra------ C:\WINDOWS\system32\HPZinw12.exe 2008-09-04 21:05 . 2003-05-14 21:14 57,344 -ra------ C:\WINDOWS\system32\HPZisn12.dll 2008-09-04 21:05 . 2003-05-14 21:19 51,056 -ra------ C:\WINDOWS\system32\drivers\hpzid412.sys 2008-09-04 21:05 . 2003-05-14 21:19 16,496 -ra------ C:\WINDOWS\system32\drivers\HPZipr12.sys 2008-09-04 21:02 . 2008-09-11 19:38 <DIR> d-------- C:\Program Files\Hewlett-Packard 2008-09-04 21:02 . 2003-05-14 21:24 262,144 -ra------ C:\WINDOWS\system32\HPZc3212.dll 2008-09-04 21:02 . 2003-05-14 21:17 21,488 -ra------ C:\WINDOWS\system32\drivers\HPZius12.sys 2008-09-04 20:47 . 2008-04-13 22:17 25,856 --a------ C:\WINDOWS\system32\drivers\usbprint.sys 2008-09-04 20:44 . 2008-09-04 20:59 <DIR> d-------- C:\WINDOWS\SHELLNEW 2008-09-04 20:43 . 2008-09-04 20:43 <DIR> dr-h----- C:\MSOCache 2008-09-04 20:43 . 2008-09-05 08:31 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Microsoft Help 2008-09-04 20:34 . 2008-09-04 20:34 <DIR> d-------- C:\Program Files\Conduit 2008-09-04 20:33 . 2008-09-04 20:34 <DIR> d-------- C:\Program Files\free-downloads.net 2008-09-04 20:33 . 2008-09-04 20:33 <DIR> d-------- C:\Program Files\Alcohol Soft 2008-09-04 19:58 . 2008-09-04 19:58 716,272 --a------ C:\WINDOWS\system32\drivers\sptd.sys 2008-09-03 21:27 . 2008-09-03 21:29 <DIR> d-------- C:\Documents and Settings\User\Dane aplikacji\Hide IP NG 2008-09-02 18:41 . 2008-09-02 18:41 <DIR> d-------- C:\Documents and Settings\User\Dane aplikacji\uniblue 2008-09-01 21:16 . 2008-09-01 21:16 <DIR> d-------- C:\Program Files\VSO 2008-09-01 21:16 . 2008-09-01 21:34 <DIR> d-------- C:\Documents and Settings\User\Dane aplikacji\Vso 2008-09-01 21:16 . 2006-09-29 11:24 217,127 --a------ C:\WINDOWS\system32\drv43260.dll 2008-09-01 21:16 . 2006-09-29 11:25 208,935 --a------ C:\WINDOWS\system32\drv33260.dll 2008-09-01 21:16 . 2006-09-29 11:26 176,165 --a------ C:\WINDOWS\system32\drv23260.dll 2008-09-01 21:16 . 2008-09-01 21:16 47,360 --a------ C:\WINDOWS\system32\drivers\pcouffin.sys 2008-09-01 21:16 . 2008-09-01 21:16 47,360 --a------ C:\Documents and Settings\User\Dane aplikacji\pcouffin.sys 2008-09-01 19:40 . 2008-09-01 19:40 <DIR> d-------- C:\Program Files\Uniblue 2008-09-01 19:35 . 2008-09-01 19:35 <DIR> d-------- C:\Program Files\Reference Assemblies 2008-09-01 19:29 . 2008-09-01 19:29 <DIR> dr-h----- C:\AHCache 2008-09-01 08:50 . 2008-09-01 08:50 <DIR> d-------- C:\Program Files\MSXML 4.0 2008-08-31 22:38 . 2008-08-31 22:38 <DIR> d-------- C:\Program Files\Video mp3 Extractor 2008-08-31 22:25 . 2008-09-14 22:21 <DIR> d-------- C:\Program Files\FDRLab 2008-08-31 20:55 . 2008-08-31 21:22 <DIR> d-------- C:\Documents and Settings\User\Dane aplikacji\Dev-Cpp 2008-08-31 20:52 . 2008-08-31 20:54 <DIR> d-------- C:\Dev-Cpp 2008-08-31 19:38 . 2008-09-09 17:48 <DIR> d-------- C:\Program Files\Maxtor 2008-08-31 19:37 . 2008-09-10 11:43 <DIR> d-------- C:\WINDOWS\SxsCaPendDel 2008-08-28 16:39 . 2008-08-28 16:43 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Maxtor 2008-08-28 16:38 . 2008-08-28 16:38 <DIR> d--hs---- C:\WINDOWS\ftpcache 2008-08-28 16:38 . 2008-08-28 16:38 <DIR> d-------- C:\WINDOWS\Downloaded Installations 2008-08-27 19:54 . 2008-09-20 19:59 <DIR> d-------- C:\Documents and Settings\User\Dane aplikacji\skypePM 2008-08-27 19:54 . 2008-08-27 19:54 56 --ah----- C:\WINDOWS\system32\ezsidmv.dat 2008-08-27 19:49 . 2008-08-27 19:49 <DIR> d-------- C:\Program Files\Skype 2008-08-27 19:49 . 2008-08-27 19:49 <DIR> d-------- C:\Program Files\Common Files\Skype 2008-08-27 19:49 . 2008-09-20 20:21 <DIR> d-------- C:\Documents and Settings\User\Dane aplikacji\Skype 2008-08-27 19:49 . 2008-08-27 19:49 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Skype 2008-08-27 08:31 . 2008-05-27 19:26 765,952 --------- C:\WINDOWS\system32\dllcache\vgx.dll 2008-08-26 20:58 . 2008-08-26 20:59 <DIR> d-------- C:\Documents and Settings\User\Dane aplikacji\Any Video Converter 2008-08-26 20:57 . 2008-08-26 20:59 <DIR> d-------- C:\Program Files\Any Video Converter 2008-08-25 19:58 . 2008-08-25 19:58 <DIR> d-------- C:\Program Files\NAPI-PROJEKT 2008-08-24 19:23 . 2008-06-10 02:32 73,728 --a------ C:\WINDOWS\system32\javacpl.cpl 2008-08-24 19:22 . 2008-08-24 19:23 <DIR> d-------- C:\Program Files\Java 2008-08-24 19:20 . 2008-08-24 19:20 <DIR> d-------- C:\Program Files\Common Files\Java 2008-08-24 18:57 . 2008-04-14 20:50 159,232 --a------ C:\WINDOWS\system32\ptpusd.dll 2008-08-24 18:57 . 2008-04-13 22:15 15,104 --a------ C:\WINDOWS\system32\drivers\usbscan.sys 2008-08-24 18:57 . 2001-10-26 15:29 5,632 --a------ C:\WINDOWS\system32\ptpusb.dll 2008-08-24 18:55 . 2008-08-24 18:55 <DIR> d-------- C:\Program Files\IrfanView 2008-08-24 14:31 . 2008-08-24 14:31 <DIR> d-------- C:\Documents and Settings\User\Dane aplikacji\Thinstall 2008-08-24 10:20 . 2008-08-24 10:20 <DIR> d-------- C:\Program Files\Common Files\Adobe AIR 2008-08-24 10:19 . 2008-08-24 10:19 <DIR> d-------- C:\Program Files\Common Files\Adobe 2008-08-24 00:44 . 2008-09-01 21:30 <DIR> d-------- C:\Program Files\A4Desk 2008-08-24 00:40 . 2008-08-24 00:40 <DIR> d-------- C:\Documents and Settings\User\Dane aplikacji\JLC's Software 2008-08-24 00:37 . 2008-08-24 00:43 <DIR> d-------- C:\Program Files\JLC's Software 2008-08-24 00:32 . 2008-08-24 00:32 <DIR> d-------- C:\Documents and Settings\User\LocalLow 2008-08-24 00:32 . 2008-08-24 00:32 <DIR> d-------- C:\Documents and Settings\User\Dane aplikacji\TVU Networks 2008-08-24 00:32 . 2008-08-24 00:32 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\TVU Networks 2008-08-24 00:27 . 2008-08-24 00:28 <DIR> d-------- C:\Program Files\Free TV Online 2008-08-24 00:23 . 2008-08-24 00:23 <DIR> d-------- C:\Program Files\TVPlayerClassic 2008-08-24 00:04 . 2008-08-24 00:04 <DIR> d-------- C:\WINDOWS\system32\LogFiles 2008-08-23 21:16 . 2008-08-23 21:16 <DIR> d-------- C:\Program Files\Teamspeak2_RC2 2008-08-23 21:16 . 2008-08-23 21:16 <DIR> d-------- C:\Documents and Settings\User\Dane aplikacji\teamspeak2 2008-08-23 21:16 . 2008-08-23 21:16 34,064 --a------ C:\WINDOWS\system32\lhacm.acm 2008-08-23 20:40 . 2008-08-23 20:40 <DIR> d-------- C:\Program Files\Real Alternative 2008-08-23 20:34 . 2008-08-23 20:34 <DIR> d-------- C:\Documents and Settings\User\Dane aplikacji\Media Player Classic 2008-08-23 20:31 . 2008-09-05 21:28 <DIR> d-------- C:\Program Files\K-Lite Codec Pack 2008-08-23 18:55 . 2008-06-14 19:36 273,024 --------- C:\WINDOWS\system32\drivers\bthport.sys 2008-08-23 18:55 . 2008-06-14 19:36 273,024 --------- C:\WINDOWS\system32\dllcache\bthport.sys 2008-08-23 18:53 . 2008-08-23 18:53 <DIR> d-------- C:\Documents and Settings\User\Phone Browser 2008-08-23 18:52 . 2008-04-11 21:06 691,712 --------- C:\WINDOWS\system32\dllcache\inetcomm.dll 2008-08-23 18:50 . 2006-09-16 03:02 23,856 --a------ C:\WINDOWS\system32\spupdsvc.exe 2008-08-23 18:45 . 2008-08-23 18:45 <DIR> d-------- C:\Documents and Settings\User\Contacts 2008-08-23 18:40 . 2008-08-23 18:43 <DIR> d-------- C:\Program Files\Windows Live 2008-08-23 18:40 . 2008-08-23 18:42 <DIR> d--hsc--- C:\Program Files\Common Files\WindowsLiveInstaller 2008-08-23 18:40 . 2008-07-18 22:07 270,880 --a------ C:\WINDOWS\system32\mucltui.dll 2008-08-23 18:40 . 2008-07-18 22:07 210,976 --a------ C:\WINDOWS\system32\muweb.dll 2008-08-23 18:40 . 2008-07-18 22:07 29,728 --a------ C:\WINDOWS\system32\mucltui.dll.mui 2008-08-23 18:39 . 2008-08-23 18:39 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\WLInstaller 2008-08-23 16:05 . 2008-08-23 16:05 <DIR> d-------- C:\Program Files\Common Files\InstallShield 2008-08-23 15:55 . 2008-08-23 15:55 <DIR> d-------- C:\Program Files\NovaLogic 2008-08-23 15:55 . 2008-09-09 17:50 <DIR> d--h----- C:\Program Files\InstallShield Installation Information 2008-08-23 12:46 . 2008-08-23 18:52 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\PC Suite 2008-08-23 12:44 . 2008-08-23 12:44 <DIR> d-------- C:\Program Files\Common Files\PCSuite 2008-08-23 12:44 . 2008-08-23 12:44 <DIR> d-------- C:\Program Files\Common Files\Nokia 2008-08-23 12:44 . 2008-08-23 12:44 <DIR> d-------- C:\Documents and Settings\User\Dane aplikacji\Nokia 2008-08-23 12:43 . 2008-08-23 18:43 <DIR> d----c--- C:\WINDOWS\system32\DRVSTORE 2008-08-23 12:43 . 2008-08-23 12:43 <DIR> d-------- C:\Program Files\PC Connectivity Solution 2008-08-23 12:43 . 2008-08-23 12:44 <DIR> d-------- C:\Program Files\Nokia . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-08-22 21:34 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\ESET 2008-08-22 21:24 --------- d-----w C:\Program Files\Usługi online 2008-08-22 21:22 --------- d-----w C:\Program Files\Windows Media Connect 2 2008-07-29 23:34 96,760 ----a-w C:\WINDOWS\system32\dfshim.dll 2008-07-29 23:34 83,968 ----a-w C:\WINDOWS\system32\mscories.dll 2008-07-29 23:34 41,984 ----a-w C:\WINDOWS\system32\netfxperf.dll 2008-07-29 23:34 282,112 ----a-w C:\WINDOWS\system32\mscoree.dll 2008-07-29 23:34 158,720 ----a-w C:\WINDOWS\system32\mscorier.dll 2008-07-29 19:10 73,720 ----a-w C:\WINDOWS\system32\dxva2.dll 2008-07-29 19:10 493,048 ----a-w C:\WINDOWS\system32\evr.dll 2008-07-29 18:35 326,160 ----a-w C:\WINDOWS\system32\PresentationHost.exe 2008-07-29 17:59 781,344 ----a-w C:\WINDOWS\system32\PresentationNative_v0300.dll 2008-07-29 17:59 43,544 ----a-w C:\WINDOWS\system32\PresentationHostProxy.dll 2008-07-29 17:59 161,296 ----a-w C:\WINDOWS\system32\UIAutomationCore.dll 2008-07-29 17:59 105,016 ----a-w C:\WINDOWS\system32\PresentationCFFRasterizerNative_v0300.dll 2008-07-18 20:10 94,920 ----a-w C:\WINDOWS\system32\cdm.dll 2008-07-18 20:10 53,448 ----a-w C:\WINDOWS\system32\wuauclt.exe 2008-07-18 20:10 45,768 ----a-w C:\WINDOWS\system32\wups2.dll 2008-07-18 20:10 36,552 ----a-w C:\WINDOWS\system32\wups.dll 2008-07-18 20:09 563,912 ----a-w C:\WINDOWS\system32\wuapi.dll 2008-07-18 20:09 325,832 ----a-w C:\WINDOWS\system32\wucltui.dll 2008-07-18 20:09 205,000 ----a-w C:\WINDOWS\system32\wuweb.dll 2008-07-18 20:09 1,811,656 ----a-w C:\WINDOWS\system32\wuaueng.dll 2008-07-10 21:08 3,169,792 ----a-w C:\WINDOWS\system32\msgina.dll 2008-07-07 20:29 253,952 ----a-w C:\WINDOWS\system32\es.dll 2008-07-07 20:29 253,952 ------w C:\WINDOWS\system32\dllcache\es.dll 2008-07-06 21:44 2,153,472 ----a-w C:\WINDOWS\system32\ntoskrnl.exe 2008-07-05 02:04 2,706,432 ----a-w C:\WINDOWS\system32\winntbbu.dll 2008-07-04 23:05 4,045,312 ----a-w C:\WINDOWS\system32\logonui.exe 2008-07-02 23:21 81,408 ----a-w C:\WINDOWS\system32\mydocs.dll 2008-06-29 16:33 908,800 ----a-w C:\WINDOWS\system32\logon.scr 2008-06-27 03:36 1,424,896 ----a-w C:\WINDOWS\explorer.exe 2008-06-24 16:46 74,240 ----a-w C:\WINDOWS\system32\mscms.dll 2008-06-24 16:46 74,240 ------w C:\WINDOWS\system32\dllcache\mscms.dll 2008-06-24 16:12 295,936 ----a-w C:\WINDOWS\system32\wmpeffects.dll 2008-06-24 08:42 3,592,192 ------w C:\WINDOWS\system32\dllcache\mshtml.dll 2008-06-23 09:23 70,656 ------w C:\WINDOWS\system32\dllcache\ie4uinit.exe 2008-06-23 09:23 625,664 ------w C:\WINDOWS\system32\dllcache\iexplore.exe 2008-06-23 09:20 13,824 ------w C:\WINDOWS\system32\dllcache\ieudinit.exe 2008-06-21 05:23 161,792 ------w C:\WINDOWS\system32\dllcache\ieakui.dll 2008-06-20 17:48 246,784 ----a-w C:\WINDOWS\system32\mswsock.dll 2008-06-20 17:48 246,784 ------w C:\WINDOWS\system32\dllcache\mswsock.dll 2008-06-20 17:48 147,968 ------w C:\WINDOWS\system32\dllcache\dnsapi.dll 2008-06-20 11:51 361,600 ------w C:\WINDOWS\system32\dllcache\tcpip.sys 2008-06-20 11:40 138,496 ------w C:\WINDOWS\system32\dllcache\afd.sys 2008-06-20 11:08 225,856 ------w C:\WINDOWS\system32\dllcache\tcpip6.sys . ------- Sigcheck ------- 2007-07-10 19:06 642560 ce594e18fe0d0af804f1f3694921ce62 C:\WINDOWS\system32\user32.dll 2008-06-16 03:28 549888 335813eacd16e84f3047a3326f6e5473 C:\WINDOWS\system32\winlogon.exe 2008-07-07 23:43 2032128 2bc05e243b86aa8e569ee3c5d8b3c424 C:\WINDOWS\system32\ntkrnlpa.exe 2008-07-06 23:44 2153472 04404b7f25984558ad3390bf84c4eb95 C:\WINDOWS\system32\ntoskrnl.exe 2008-06-27 05:36 1424896 4ec7ed41d95d18b3cd1a2bd9dfefb591 C:\WINDOWS\explorer.exe . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks] "{ecdee021-0d17-467f-a1ff-c7a115230949}"= "C:\Program Files\free-downloads.net\tbfree.dll" [2008-02-14 1555480] [HKEY_CLASSES_ROOT\clsid\{ecdee021-0d17-467f-a1ff-c7a115230949}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{ecdee021-0d17-467f-a1ff-c7a115230949}] 2008-02-14 14:54 1555480 --a------ C:\Program Files\free-downloads.net\tbfree.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar] "{ecdee021-0d17-467f-a1ff-c7a115230949}"= "C:\Program Files\free-downloads.net\tbfree.dll" [2008-02-14 1555480] [HKEY_CLASSES_ROOT\clsid\{ecdee021-0d17-467f-a1ff-c7a115230949}] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar] "{ECDEE021-0D17-467F-A1FF-C7A115230949}"= "C:\Program Files\free-downloads.net\tbfree.dll" [2008-02-14 1555480] [HKEY_CLASSES_ROOT\clsid\{ecdee021-0d17-467f-a1ff-c7a115230949}] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 5724184] "AlcoholAutomount"="C:\Program Files\Alcohol Soft\Alcohol 52\axcmd.exe" [2008-02-22 216520] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "egui"="C:\Program Files\ESET\ESET Smart Security\egui.exe" [2007-12-21 1443072] "PCSuiteTrayApplication"="C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe" [2007-03-23 227328] "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "Nokia.PCSync"="C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2007-03-27 1744896] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce] "nltide_2"="shell32" [X] "nltide_3"="advpack.dll" [2008-06-23 C:\WINDOWS\system32\advpack.dll] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "DisableStatusMessages"= 1 (0x1) [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer] "NoDesktopCleanupWizard"= 1 (0x1) [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] "NoSMHelp"= 1 (0x1) "NoSMMyPictures"= 1 (0x1) "NoSMConfigurePrograms"= 1 (0x1) "NoResolveTrack"= 1 (0x1) "NoResolveSearch"= 1 (0x1) [HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer] "NoSMHelp"= 1 (0x1) "NoSMMyPictures"= 1 (0x1) "NoSMConfigurePrograms"= 1 (0x1) "NoResolveTrack"= 1 (0x1) "NoResolveSearch"= 1 (0x1) [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "vidc.I420"= C:\WINDOWS\system32\i263_32.drv "vidc.DIV3"= DivXc32.dll "vidc.DIV4"= DivXc32f.dll "msacm.divxa32"= DivXa32.acm "VIDC.HFYU"= huffyuv.dll "msacm.avis"= ff_acm.acm "vidc.i263"= C:\WINDOWS\system32\i263_32.drv "msacm.imc"= C:\WINDOWS\system32\imc32.acm [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\dotnet3.exe] "Debugger"=C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\DotNetFxInstallBlock.exe [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\dotnet3[1].exe] "Debugger"=C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\DotNetFxInstallBlock.exe [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\dotnet3[2].exe] "Debugger"=C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\DotNetFxInstallBlock.exe [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\dotnetfx.exe] "Debugger"=C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\DotNetFxInstallBlock.exe [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\dotnetfx3.exe] "Debugger"=C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\DotNetFxInstallBlock.exe [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\dotnetfx30SP1setup.exe] "Debugger"=C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\DotNetFxInstallBlock.exe [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\dotnetfx30SP1setup[1].exe] "Debugger"=C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\DotNetFxInstallBlock.exe [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\dotnetfx30SP1setup[2].exe] "Debugger"=C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\DotNetFxInstallBlock.exe [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\dotnetfx35.exe] "Debugger"=C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\DotNetFxInstallBlock.exe [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\dotnetfx35setup.exe] "Debugger"=C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\DotNetFxInstallBlock.exe [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\dotnetfx35setup[1].exe] "Debugger"=C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\DotNetFxInstallBlock.exe [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\dotnetfx35setup[2].exe] "Debugger"=C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\DotNetFxInstallBlock.exe [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\dotnetfx35[1].exe] "Debugger"=C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\DotNetFxInstallBlock.exe [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\dotnetfx35[2].exe] "Debugger"=C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\DotNetFxInstallBlock.exe [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\dotnetfx3setup.exe] "Debugger"=C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\DotNetFxInstallBlock.exe [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\dotnetfx3setup[1].exe] "Debugger"=C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\DotNetFxInstallBlock.exe [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\dotnetfx3setup[2].exe] "Debugger"=C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\DotNetFxInstallBlock.exe [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\dotnetfx3[1].exe] "Debugger"=C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\DotNetFxInstallBlock.exe [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\dotnetfx3[2].exe] "Debugger"=C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\DotNetFxInstallBlock.exe [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\dotnetfx3_ia64.exe] "Debugger"=C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\DotNetFxInstallBlock.exe [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\dotnetfx3_ia64[1].exe] "Debugger"=C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\DotNetFxInstallBlock.exe [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\dotnetfx3_ia64[2].exe] "Debugger"=C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\DotNetFxInstallBlock.exe [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\dotnetfx3_x64.exe] "Debugger"=C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\DotNetFxInstallBlock.exe [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\dotnetfx3_x64[1].exe] "Debugger"=C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\DotNetFxInstallBlock.exe [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\dotnetfx3_x64[2].exe] "Debugger"=C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\DotNetFxInstallBlock.exe [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\dotnetfx[1].exe] "Debugger"=C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\DotNetFxInstallBlock.exe [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\dotnetfx[2].exe] "Debugger"=C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\DotNetFxInstallBlock.exe [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\NetFx20SP1_ia64.exe] "Debugger"=C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\DotNetFxInstallBlock.exe [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\NetFx20SP1_ia64[1].exe] "Debugger"=C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\DotNetFxInstallBlock.exe [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\NetFx20SP1_ia64[2].exe] "Debugger"=C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\DotNetFxInstallBlock.exe [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\NetFx20SP1_x64.exe] "Debugger"=C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\DotNetFxInstallBlock.exe [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\NetFx20SP1_x64[1].exe] "Debugger"=C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\DotNetFxInstallBlock.exe [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\NetFx20SP1_x64[2].exe] "Debugger"=C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\DotNetFxInstallBlock.exe [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\NetFx20SP1_x86.exe] "Debugger"=C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\DotNetFxInstallBlock.exe [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\NetFx20SP1_x86[1].exe] "Debugger"=C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\DotNetFxInstallBlock.exe [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\NetFx20SP1_x86[2].exe] "Debugger"=C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\DotNetFxInstallBlock.exe [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\NetFx20SP2_ia64.exe] "Debugger"=C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\DotNetFxInstallBlock.exe [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\NetFx20SP2_ia64[1].exe] "Debugger"=C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\DotNetFxInstallBlock.exe [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\NetFx20SP2_ia64[2].exe] "Debugger"=C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\DotNetFxInstallBlock.exe [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\NetFx20SP2_x64.exe] "Debugger"=C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\DotNetFxInstallBlock.exe [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\NetFx20SP2_x64[1].exe] "Debugger"=C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\DotNetFxInstallBlock.exe [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\NetFx20SP2_x64[2].exe] "Debugger"=C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\DotNetFxInstallBlock.exe [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\NetFx20SP2_x86.exe] "Debugger"=C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\DotNetFxInstallBlock.exe [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\NetFx20SP2_x86[1].exe] "Debugger"=C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\DotNetFxInstallBlock.exe [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\NetFx20SP2_x86[2].exe] "Debugger"=C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\DotNetFxInstallBlock.exe [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\NetFx30SP1_x64.exe] "Debugger"=C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\DotNetFxInstallBlock.exe [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\NetFx30SP1_x64[1].exe] "Debugger"=C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\DotNetFxInstallBlock.exe [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\NetFx30SP1_x64[2].exe] "Debugger"=C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\DotNetFxInstallBlock.exe [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\NetFx30SP1_x86.exe] "Debugger"=C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\DotNetFxInstallBlock.exe [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\NetFx30SP1_x86[1].exe] "Debugger"=C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\DotNetFxInstallBlock.exe [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\NetFx30SP1_x86[2].exe] "Debugger"=C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\DotNetFxInstallBlock.exe [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\NetFx35_ia64.exe] "Debugger"=C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\DotNetFxInstallBlock.exe [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\NetFx35_ia64[1].exe] "Debugger"=C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\DotNetFxInstallBlock.exe [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\NetFx35_ia64[2].exe] "Debugger"=C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\DotNetFxInstallBlock.exe [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\NetFx35_x64.exe] "Debugger"=C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\DotNetFxInstallBlock.exe [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\NetFx35_x64[1].exe] "Debugger"=C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\DotNetFxInstallBlock.exe [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\NetFx35_x64[2].exe] "Debugger"=C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\DotNetFxInstallBlock.exe [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\NetFx35_x86.exe] "Debugger"=C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\DotNetFxInstallBlock.exe [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\NetFx35_x86[1].exe] "Debugger"=C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\DotNetFxInstallBlock.exe [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\NetFx35_x86[2].exe] "Debugger"=C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\DotNetFxInstallBlock.exe [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\NetFx64.exe] "Debugger"=C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\DotNetFxInstallBlock.exe [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\NetFx64[1].exe] "Debugger"=C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\DotNetFxInstallBlock.exe [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\NetFx64[2].exe] "Debugger"=C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\DotNetFxInstallBlock.exe [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "%windir%\\system32\\sessmgr.exe"= "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"= "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"= "C:\\Program Files\\Skype\\Phone\\Skype.exe"= R3 SISNICXP;SiS PCI Fast Ethernet Adapter Driver for NDIS51;C:\WINDOWS\system32\DRIVERS\sisnicxp.sys [2008-06-16 32768] *Newly Created Service* - PROCEXP90 . . ------- Skan uzupełniający ------- . FireFox -: Profile - C:\Documents and Settings\User\Dane aplikacji\Mozilla\Firefox\Profiles\otcy7gf4.default\ FF -: plugin - C:\Program Files\Opera\program\plugins\nppl3260.dll FF -: plugin - C:\Program Files\Opera\program\plugins\nprpjplug.dll FF -: plugin - C:\Program Files\Yahoo!\Common\npyaxmpb.dll FF -: plugin - C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-09-20 21:20:40 Windows 5.1.2600 Dodatek Service Pack 3 NTFS skanowanie ukrytych procesów ... skanowanie ukrytych wpisów autostartu ... skanowanie ukrytych plików ... skanowanie pomyślnie ukończone ukryte pliki: 0 ************************************************************************** . Czas ukończenia: 2008-09-20 21:21:52 ComboFix-quarantined-files.txt 2008-09-20 19:21:48 Przed: 8,737,857,536 bajt˘w wolnych Po: 9,386,078,208 bajt˘w wolnych 410 --- E O F --- 2008-09-10 09:48:28

**Posty:** 684 · przez **djarta** 20 Wrz 2008, 21:30

Czysto.

Wykonaj to co jest podane w tym temacie (jeśli wykonałeś/łaś to wcześniej to nie rób tego).

Usuń ręcznie folder C:\Qoobox,

Usuń instalkę ComboFix z dysku.

Wykonaj optymalizację autostartu

Przeczyść komputer ATF-Cleaner

Wyłącz i włącz przywracanie systemu na wszystkich dyskach.Instrukcja

Przeskanuj obszar mojego komputera http://www.kaspersky.pl/virusscanner.html (uruchom przez IE) Daj raport z niego na forum.

i tym:

FixIEDef.

=======================
K.

Autor postu otrzymał pochwałę

**Posty:** 105 · przez **kristof200** 21 Wrz 2008, 13:17

Niestety niestarcza czasu na caly skan bo pojawia sie niebieski ekran.I na nim niema napisanego bledu

.

FixEIDef log

Kod: Zaznacz wszystko: ******************************************************************************** * * * FixIEDef Log * * Version 1.6.10.6162 * * * ******************************************************************************** Created at 13:04:19 on Sunday, September 21, 2008 Time Zone : Logged On User : User Operating System : Microsoft Windows XP Professional Dodatek Service Pack 3 OS Version : 5.1.2600 System Langauge : Polish Keyboard Layout : Polish Processor : X86 Intel(R) Pentium(R) 4 CPU 3.00GHz System Drive : C:\ Windows Directory : C:\WINDOWS System Directory : C:\WINDOWS\system32 System Drive Type : Fixed System Drive Status : READY System Drive Label : System Drive Size : 20 GB System Drive Free : 8.86 GB Total Physical Memory: 511 MB Free Physical Memory : 274 MB Total Page File : 511 MB Free Page File : 1045 MB Total Virtual Memory : 2048 MB Free Virtual Memory : 1957 MB Boot State : Normal boot -------------------------------------------------------------------------------- !!! Files that have been deleted !!! No malicious files found -------------------------------------------------------------------------------- !!! Directories that have been removed !!! No malicious directories to be removed -------------------------------------------------------------------------------- !!! Registry entries that have been removed !!! No malicious Registry entries found ================================================================================ All Done :) ShadowPuterDude Safe Surfing!!!

**Posty:** 8001 · przez **Okocza** 21 Wrz 2008, 13:21

kristof200 napisał(a):bo pojawia sie niebieski ekran

Prawym na ,,Mój komputer">właściwości>Zakładka "Zaawansowane" -> Uruchamianie i odzyskiwanie i klikamy "ustawienia">
w części "Awaria systemu" odznaczamy pole "Automatycznie uruchom ponownie"

teraz zamiast resetu pojawi sie bluescreen przepisz kod bledu z dolu strony bluescreena

**Posty:** 105 · przez **kristof200** 21 Wrz 2008, 14:23

Ale mam to odznaczone .Tzn bylo juz odznaczone.

**Posty:** 8001 · przez **Okocza** 21 Wrz 2008, 14:30

jak wyskoczy Ci teraz BSoD zrób zdjęcie i pokaż je.

Autor postu otrzymał pochwałę

**Posty:** 105 · przez **kristof200** 21 Wrz 2008, 21:38

Jakos narazie komp dziala caly czas i nic sie nie dzieje wiec mysle ze spoko jest.
Z gory dzieki.

Dodano 29.09.2008 21:51:46:
A co to jest Atrax ten?tzn to jakis program chyba jest ale czego w ccleaner jak czyszcze rejestr to zawsze mi sie pokazuje nawet jak go wyczyszcze??

Dodano 05.10.2008 12:18:11:
Czesc udalo mi sie zrobic zdjecie neibieskiego ekranu niejest genialne wiec moze nic niepomoze

.

ups sorka

**Posty:** 8001 · przez **Okocza** 05 Paź 2008, 18:29

kristof200,

1. Wykonaj skan Dr. Web CureIt
2. Robisz loga z mbr.exe
3. dajesz loga z combofixa

Przenieś program mbr.exe bezpośrednio na C:\
nastepnie przejdz do trybu awaryjnego z z obsługą linii komend
w linii komend wpisz polecenie C:\mbr.exe -f (tam jest spacja między mbr.exe a -f) i ENTER
Reset komputera do trybu normalnego i robisz nowy log z mbr.exe

**Posty:** 684 · przez **djarta** 06 Paź 2008, 13:09

Okocza - z logu wynika, ze autor nie ma zadnego Rootkita na MBR dysku.

A log z ComboFixa i "Doktorka" moze zrobic.

=======================
K.

**Posty:** 105 · przez **kristof200** 06 Paź 2008, 19:00

to robic loga z mbr ?

Dodano 06.10.2008 19:11:27:
combofix

Kod: Zaznacz wszystko: ComboFix 08-10-05.11 - User 2008-10-06 19:06:40.2 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.3.1250.1.1045.18.257 [GMT 2:00] Uruchomiony z: M:\Mlody\programy\Security\ComboFix.exe * Utworzono nowy punkt przywracania [COLOR=RED][B]UWAGA - TEN KOMPUTER NIE MA ZAINSTALOWANEJ KONSOLI ODZYSKIWANIA !![/B][/COLOR] . /wow section nieukończony ((((((((((((((((((((((((( Pliki utworzone od 2008-09-06 do 2008-10-06 ))))))))))))))))))))))))))))))) . 2008-10-06 17:50 . 2008-10-06 17:50 268 --ah----- C:\sqmdata01.sqm 2008-10-06 17:50 . 2008-10-06 17:50 244 --ah----- C:\sqmnoopt01.sqm 2008-10-06 08:34 . 2008-10-06 08:34 268 --ah----- C:\sqmdata00.sqm 2008-10-06 08:34 . 2008-10-06 08:34 244 --ah----- C:\sqmnoopt00.sqm 2008-10-04 23:18 . 2008-10-04 23:21 <DIR> d-------- C:\Program Files\WYSIWYG Web Builder 5 2008-10-04 23:18 . 2008-10-04 23:18 737,280 --a------ C:\WINDOWS\iun6002.exe 2008-10-04 16:48 . 2008-10-05 21:14 156 --a------ C:\WINDOWS\Twunk001.MTX 2008-10-04 16:48 . 2008-10-05 21:14 3 --a------ C:\WINDOWS\Twain001.Mtx 2008-10-04 16:48 . 2008-10-04 16:48 0 --a------ C:\WINDOWS\Twunk002.MTX 2008-10-04 15:38 . 2008-10-04 15:38 <DIR> d-------- C:\Program Files\Passware 2008-09-22 19:40 . 2008-09-22 19:40 <DIR> d-------- C:\Program Files\Microsoft IntelliPoint 2008-09-22 19:39 . 2008-09-22 19:39 <DIR> d-------- C:\Program Files\Microsoft IntelliType Pro 2008-09-22 17:37 . 2006-10-26 19:56 32,592 --a------ C:\WINDOWS\system32\msonpmon.dll 2008-09-22 17:33 . 2008-10-04 12:28 <DIR> d-------- C:\Program Files\Microsoft Works 2008-09-22 17:29 . 2008-09-22 17:29 <DIR> d-------- C:\Program Files\Microsoft.NET 2008-09-22 17:26 . 2008-09-22 17:26 <DIR> d-------- C:\Program Files\Microsoft Visual Studio 8 2008-09-21 13:34 . 2008-09-21 13:34 <DIR> d-------- C:\WINDOWS\system32\XPSViewer 2008-09-21 13:34 . 2008-09-22 17:33 <DIR> d-------- C:\Program Files\MSBuild 2008-09-21 13:33 . 2008-07-06 14:06 1,676,288 --------- C:\WINDOWS\system32\xpssvcs.dll 2008-09-21 13:33 . 2008-07-06 14:06 1,676,288 --------- C:\WINDOWS\system32\dllcache\xpssvcs.dll 2008-09-21 13:33 . 2008-07-06 12:50 597,504 --------- C:\WINDOWS\system32\dllcache\printfilterpipelinesvc.exe 2008-09-21 13:33 . 2008-07-06 14:06 575,488 --------- C:\WINDOWS\system32\xpsshhdr.dll 2008-09-21 13:33 . 2008-07-06 14:06 575,488 --------- C:\WINDOWS\system32\dllcache\xpsshhdr.dll 2008-09-21 13:33 . 2008-07-06 14:06 117,760 --------- C:\WINDOWS\system32\prntvpt.dll 2008-09-21 13:33 . 2008-07-06 14:06 89,088 --------- C:\WINDOWS\system32\dllcache\filterpipelineprintproc.dll 2008-09-21 13:30 . 2008-09-21 13:30 <DIR> d-------- C:\Documents and Settings\User\Dane aplikacji\Nvu 2008-09-21 13:29 . 2008-09-21 13:29 <DIR> d-------- C:\Program Files\Nvu 2008-09-21 13:23 . 2008-09-21 13:36 <DIR> d-------- C:\Program Files\Street Hacker 2008-09-21 10:10 . 2008-09-21 10:10 <DIR> d-------- C:\WINDOWS\system32\xircom 2008-09-21 10:10 . 2008-09-21 10:10 <DIR> d-------- C:\WINDOWS\system32\oobe 2008-09-21 10:10 . 2008-09-21 10:10 <DIR> d-------- C:\WINDOWS\srchasst 2008-09-21 10:10 . 2008-09-21 10:10 <DIR> d-------- C:\WINDOWS\msagent 2008-09-21 10:10 . 2008-09-21 10:10 <DIR> d-------- C:\Program Files\microsoft frontpage 2008-09-20 22:26 . 2008-09-20 22:26 <DIR> d-------- C:\WINDOWS\system32\Kaspersky Lab 2008-09-20 22:26 . 2008-09-20 22:26 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab 2008-09-20 17:58 . 2008-09-20 17:58 <DIR> d-------- C:\!FixIEDef 2008-09-16 16:22 . 2004-05-04 12:53 1,645,320 --a------ C:\WINDOWS\system32\gdiplus.dll 2008-09-16 16:18 . 2008-09-16 16:22 <DIR> d-------- C:\Program Files\BurnAware Free 2008-09-14 22:19 . 2008-09-14 22:19 <DIR> d-------- C:\Documents and Settings\User\DoctorWeb 2008-09-14 22:19 . 2008-09-14 22:19 <DIR> d-------- C:\Documents and Settings\User\Dane aplikacji\FDRLab 2008-09-13 22:12 . 2008-09-13 22:12 <DIR> d-------- C:\Documents and Settings\User\WINDOWS 2008-09-13 11:57 . 2008-09-13 11:57 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Yahoo! Companion 2008-09-11 19:37 . 2008-09-22 19:36 <DIR> d-------- C:\WINDOWS\system32\NtmsData 2008-09-11 19:35 . 2008-09-26 22:41 <DIR> d-------- C:\temp 2008-09-09 13:17 . 2008-09-09 13:18 <DIR> d-------- C:\Program Files\Shut Down-O-Matic 2008-09-07 12:21 . 2008-09-04 21:02 17,290 --------- C:\WINDOWS\HPHins01.dat.temp 2008-09-07 12:21 . 2003-09-12 23:31 4,308 --------- C:\WINDOWS\hphmdl01.dat.temp 2008-09-06 16:55 . 2008-09-22 11:42 292 --a------ C:\WINDOWS\wcx_ftp.ini 2008-09-06 16:51 . 2008-09-06 16:54 <DIR> d-------- C:\totalcmd 2008-09-06 16:51 . 2008-09-22 11:46 801 --a------ C:\WINDOWS\wincmd.ini 2008-09-06 16:51 . 2006-11-22 07:00 545 --a------ C:\WINDOWS\UC.PIF 2008-09-06 16:51 . 2006-11-22 07:00 545 --a------ C:\WINDOWS\RAR.PIF 2008-09-06 16:51 . 2006-11-22 07:00 545 --a------ C:\WINDOWS\PKZIP.PIF 2008-09-06 16:51 . 2006-11-22 07:00 545 --a------ C:\WINDOWS\PKUNZIP.PIF 2008-09-06 16:51 . 2006-11-22 07:00 545 --a------ C:\WINDOWS\NOCLOSE.PIF 2008-09-06 16:51 . 2006-11-22 07:00 545 --a------ C:\WINDOWS\LHA.PIF 2008-09-06 16:51 . 2006-11-22 07:00 545 --a------ C:\WINDOWS\ARJ.PIF 2008-09-06 16:46 . 2008-09-06 16:46 <DIR> d-------- C:\Documents and Settings\User\Dane aplikacji\Nokia Multimedia Player . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-10-06 06:48 --------- d-----w C:\Documents and Settings\User\Dane aplikacji\foobar2000 2008-10-05 21:46 --------- d-----w C:\Documents and Settings\User\Dane aplikacji\Skype 2008-10-05 19:08 --------- d-----w C:\Documents and Settings\User\Dane aplikacji\skypePM 2008-10-04 14:48 --------- d-----w C:\Documents and Settings\User\Dane aplikacji\Thinstall 2008-09-23 15:59 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Microsoft Help 2008-09-14 20:21 --------- d-----w C:\Program Files\FDRLab 2008-09-11 17:38 --------- d-----w C:\Program Files\Hewlett-Packard 2008-09-09 15:50 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-09-09 15:48 --------- d-----w C:\Program Files\Maxtor 2008-09-05 19:30 --------- d-----w C:\Program Files\Theorica Divx ;-) Codecs 2008-09-05 19:28 --------- d-----w C:\Program Files\K-Lite Codec Pack 2008-09-05 18:52 --------- d-----w C:\Program Files\XviD 2008-09-04 18:34 --------- d-----w C:\Program Files\free-downloads.net 2008-09-04 18:34 --------- d-----w C:\Program Files\Conduit 2008-09-04 18:33 --------- d-----w C:\Program Files\Alcohol Soft 2008-09-04 17:58 716,272 ----a-w C:\WINDOWS\system32\drivers\sptd.sys 2008-09-03 19:29 --------- d-----w C:\Documents and Settings\User\Dane aplikacji\Hide IP NG 2008-09-02 16:41 --------- d-----w C:\Documents and Settings\User\Dane aplikacji\uniblue 2008-09-01 19:34 --------- d-----w C:\Documents and Settings\User\Dane aplikacji\Vso 2008-09-01 19:16 47,360 ----a-w C:\WINDOWS\system32\drivers\pcouffin.sys 2008-09-01 19:16 47,360 ----a-w C:\Documents and Settings\User\Dane aplikacji\pcouffin.sys 2008-09-01 19:16 --------- d-----w C:\Program Files\VSO 2008-09-01 17:40 --------- d-----w C:\Program Files\Uniblue 2008-09-01 17:35 --------- d-----w C:\Program Files\Reference Assemblies 2008-09-01 06:50 --------- d-----w C:\Program Files\MSXML 4.0 2008-08-31 20:38 --------- d-----w C:\Program Files\Video mp3 Extractor 2008-08-31 19:22 --------- d-----w C:\Documents and Settings\User\Dane aplikacji\Dev-Cpp 2008-08-28 14:43 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Maxtor 2008-08-27 17:49 --------- d-----w C:\Program Files\Skype 2008-08-27 17:49 --------- d-----w C:\Program Files\Common Files\Skype 2008-08-27 17:49 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Skype 2008-08-26 18:59 --------- d-----w C:\Program Files\Any Video Converter 2008-08-26 18:59 --------- d-----w C:\Documents and Settings\User\Dane aplikacji\Any Video Converter 2008-08-25 17:58 --------- d-----w C:\Program Files\NAPI-PROJEKT 2008-08-24 17:23 --------- d-----w C:\Program Files\Java 2008-08-24 17:20 --------- d-----w C:\Program Files\Common Files\Java 2008-08-24 16:55 --------- d-----w C:\Program Files\IrfanView 2008-08-24 08:20 --------- d-----w C:\Program Files\Common Files\Adobe AIR 2008-08-24 08:19 --------- d-----w C:\Program Files\Common Files\Adobe 2008-08-23 22:43 --------- d-----w C:\Program Files\JLC's Software 2008-08-23 22:40 --------- d-----w C:\Documents and Settings\User\Dane aplikacji\JLC's Software 2008-08-23 22:32 --------- d-----w C:\Documents and Settings\User\Dane aplikacji\TVU Networks 2008-08-23 22:32 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\TVU Networks 2008-08-23 22:28 --------- d-----w C:\Program Files\Free TV Online 2008-08-23 22:23 --------- d-----w C:\Program Files\TVPlayerClassic 2008-08-23 19:16 --------- d-----w C:\Program Files\Teamspeak2_RC2 2008-08-23 19:16 --------- d-----w C:\Documents and Settings\User\Dane aplikacji\teamspeak2 2008-08-23 18:40 --------- d-----w C:\Program Files\Real Alternative 2008-08-23 18:34 --------- d-----w C:\Documents and Settings\User\Dane aplikacji\Media Player Classic 2008-08-23 16:52 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\PC Suite 2008-08-23 16:43 --------- d-----w C:\Program Files\Windows Live 2008-08-23 16:42 --------- dcsh--w C:\Program Files\Common Files\WindowsLiveInstaller 2008-08-23 16:39 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\WLInstaller 2008-08-23 14:05 --------- d-----w C:\Program Files\Common Files\InstallShield 2008-08-23 13:55 --------- d-----w C:\Program Files\NovaLogic 2008-08-23 10:44 --------- d-----w C:\Program Files\Nokia 2008-08-23 10:44 --------- d-----w C:\Program Files\DIFX 2008-08-23 10:44 --------- d-----w C:\Program Files\Common Files\PCSuite 2008-08-23 10:44 --------- d-----w C:\Program Files\Common Files\Nokia 2008-08-23 10:44 --------- d-----w C:\Documents and Settings\User\Dane aplikacji\Nokia 2008-08-23 10:43 --------- d-----w C:\Program Files\PC Connectivity Solution 2008-08-23 10:43 --------- d-----w C:\Documents and Settings\User\Dane aplikacji\PC Suite 2008-08-23 10:43 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Installations 2008-08-23 10:18 --------- d-----w C:\Program Files\foobar2000 2008-08-23 10:16 --------- d-----w C:\Documents and Settings\User\Dane aplikacji\BESTplayer 2008-08-23 10:00 --------- d-----w C:\Program Files\ESET 2008-08-23 09:57 --------- d-----w C:\Documents and Settings\User\Dane aplikacji\Gadu-Gadu 2008-08-23 09:56 --------- d-----w C:\Program Files\Yahoo! 2008-08-23 09:56 --------- d-----w C:\Program Files\CCleaner 2008-08-23 09:55 --------- d-----w C:\Program Files\Gadu-Gadu 2008-08-23 09:53 --------- d-----w C:\Program Files\Opera 2008-08-22 22:01 --------- d-----w C:\Documents and Settings\User\Dane aplikacji\ESET 2008-08-22 21:34 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\ESET 2008-08-22 21:24 --------- d-----w C:\Program Files\Usługi online 2008-08-22 21:22 --------- d-----w C:\Program Files\Windows Media Connect 2 2008-07-29 23:34 96,760 ----a-w C:\WINDOWS\system32\dfshim.dll 2008-07-29 23:34 83,968 ----a-w C:\WINDOWS\system32\mscories.dll 2008-07-29 23:34 41,984 ----a-w C:\WINDOWS\system32\netfxperf.dll 2008-07-29 23:34 282,112 ----a-w C:\WINDOWS\system32\mscoree.dll 2008-07-29 23:34 158,720 ----a-w C:\WINDOWS\system32\mscorier.dll 2008-07-29 19:10 73,720 ----a-w C:\WINDOWS\system32\dxva2.dll 2008-07-29 19:10 493,048 ----a-w C:\WINDOWS\system32\evr.dll 2008-07-29 19:10 26,112 ----a-w C:\WINDOWS\system32\TsWpfWrp.exe 2008-07-29 18:35 326,160 ----a-w C:\WINDOWS\system32\PresentationHost.exe 2008-07-29 17:59 781,344 ----a-w C:\WINDOWS\system32\PresentationNative_v0300.dll 2008-07-29 17:59 43,544 ----a-w C:\WINDOWS\system32\PresentationHostProxy.dll 2008-07-29 17:59 161,296 ----a-w C:\WINDOWS\system32\UIAutomationCore.dll 2008-07-29 17:59 105,016 ----a-w C:\WINDOWS\system32\PresentationCFFRasterizerNative_v0300.dll 2008-07-29 17:24 97,800 ----a-w C:\WINDOWS\system32\infocardapi.dll 2008-07-29 17:24 622,080 ----a-w C:\WINDOWS\system32\icardagt.exe 2008-07-29 17:24 11,264 ----a-w C:\WINDOWS\system32\icardres.dll 2008-07-18 20:10 94,920 ----a-w C:\WINDOWS\system32\cdm.dll 2008-07-18 20:10 53,448 ----a-w C:\WINDOWS\system32\wuauclt.exe 2008-07-18 20:10 45,768 ----a-w C:\WINDOWS\system32\wups2.dll 2008-07-18 20:10 36,552 ----a-w C:\WINDOWS\system32\wups.dll 2008-07-18 20:09 563,912 ----a-w C:\WINDOWS\system32\wuapi.dll 2008-07-18 20:09 325,832 ----a-w C:\WINDOWS\system32\wucltui.dll 2008-07-18 20:09 205,000 ----a-w C:\WINDOWS\system32\wuweb.dll 2008-07-18 20:09 1,811,656 ----a-w C:\WINDOWS\system32\wuaueng.dll 2008-07-18 20:07 270,880 ----a-w C:\WINDOWS\system32\mucltui.dll . ------- Sigcheck ------- 2007-07-10 19:06 642560 ce594e18fe0d0af804f1f3694921ce62 C:\WINDOWS\system32\user32.dll 2008-06-16 03:28 549888 335813eacd16e84f3047a3326f6e5473 C:\WINDOWS\system32\winlogon.exe 2008-07-07 23:43 2032128 2bc05e243b86aa8e569ee3c5d8b3c424 C:\WINDOWS\system32\ntkrnlpa.exe 2008-07-06 23:44 2153472 04404b7f25984558ad3390bf84c4eb95 C:\WINDOWS\system32\ntoskrnl.exe 2008-06-27 05:36 1424896 4ec7ed41d95d18b3cd1a2bd9dfefb591 C:\WINDOWS\explorer.exe . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks] "{ecdee021-0d17-467f-a1ff-c7a115230949}"= "C:\Program Files\free-downloads.net\tbfree.dll" [2008-02-14 1555480] [HKEY_CLASSES_ROOT\clsid\{ecdee021-0d17-467f-a1ff-c7a115230949}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{ecdee021-0d17-467f-a1ff-c7a115230949}] 2008-02-14 14:54 1555480 --a------ C:\Program Files\free-downloads.net\tbfree.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar] "{ecdee021-0d17-467f-a1ff-c7a115230949}"= "C:\Program Files\free-downloads.net\tbfree.dll" [2008-02-14 1555480] [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser] "{ECDEE021-0D17-467F-A1FF-C7A115230949}"= "C:\Program Files\free-downloads.net\tbfree.dll" [2008-02-14 1555480] [HKEY_CLASSES_ROOT\clsid\{ecdee021-0d17-467f-a1ff-c7a115230949}] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "msnmsgr"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe" [2007-10-18 5724184] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "egui"="C:\Program Files\ESET\ESET Smart Security\egui.exe" [2007-12-21 1443072] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784] "GrooveMonitor"="C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [2007-08-24 33648] "type32"="C:\Program Files\Microsoft IntelliType Pro\type32.exe" [2004-06-03 172032] "IntelliPoint"="C:\Program Files\Microsoft IntelliPoint\point32.exe" [2004-06-03 204800] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "Nokia.PCSync"="C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2007-03-27 1744896] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce] "nltide_2"="shell32" [X] "nltide_3"="advpack.dll" [2008-06-23 C:\WINDOWS\system32\advpack.dll] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "DisableStatusMessages"= 1 (0x1) [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer] "NoDesktopCleanupWizard"= 1 (0x1) [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] "NoSMHelp"= 1 (0x1) "NoSMMyPictures"= 1 (0x1) "NoSMConfigurePrograms"= 1 (0x1) "NoResolveTrack"= 1 (0x1) "NoResolveSearch"= 1 (0x1) [HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer] "NoSMHelp"= 1 (0x1) "NoSMMyPictures"= 1 (0x1) "NoSMConfigurePrograms"= 1 (0x1) "NoResolveTrack"= 1 (0x1) "NoResolveSearch"= 1 (0x1) [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "vidc.I420"= C:\WINDOWS\system32\i263_32.drv "vidc.DIV3"= DivXc32.dll "vidc.DIV4"= DivXc32f.dll "msacm.divxa32"= DivXa32.acm "VIDC.HFYU"= huffyuv.dll "msacm.avis"= ff_acm.acm "vidc.i263"= C:\WINDOWS\system32\i263_32.drv "msacm.imc"= C:\WINDOWS\system32\imc32.acm [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher] --a------ 2008-06-12 02:38 34672 C:\Program Files\Adobe\Reader 9.0\Reader\reader_sl.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AlcoholAutomount] --a------ 2008-02-22 13:22 216520 C:\Program Files\Alcohol Soft\Alcohol 52\AxCmd.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr] --a------ 2007-10-18 11:34 5724184 C:\Program Files\Windows Live\Messenger\msnmsgr.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCSuiteTrayApplication] --a------ 2007-03-23 13:20 227328 C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "%windir%\\system32\\sessmgr.exe"= "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"= "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"= "C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"= "C:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"= "C:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"= "C:\\Program Files\\Skype\\Phone\\Skype.exe"= R3 SISNICXP;SiS PCI Fast Ethernet Adapter Driver for NDIS51;C:\WINDOWS\system32\DRIVERS\sisnicxp.sys [2008-06-16 32768] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\M] \Shell\AutoRun\command - M:\Launch.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{685cd6cc-9163-11dd-a37d-00300567f70a}] \Shell\AutoRun\command - M:\Launch.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{adde3db5-9219-11dd-a381-00300567f70a}] \Shell\AutoRun\command - E:\Launch.exe . . ------- Skan uzupełniający ------- . FireFox -: Profile - C:\Documents and Settings\User\Dane aplikacji\Mozilla\Firefox\Profiles\otcy7gf4.default\ FF -: plugin - C:\Program Files\Opera\program\plugins\NPOFF12.DLL FF -: plugin - C:\Program Files\Opera\program\plugins\nppl3260.dll FF -: plugin - C:\Program Files\Opera\program\plugins\nprpjplug.dll FF -: plugin - C:\Program Files\Yahoo!\Common\npyaxmpb.dll FF -: plugin - C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-10-06 19:07:07 Windows 5.1.2600 Dodatek Service Pack 3 NTFS skanowanie ukrytych procesów ... skanowanie ukrytych wpisów autostartu ... skanowanie ukrytych plików ... ************************************************************************** . Czas ukończenia: 2008-10-06 19:08:34 ComboFix-quarantined-files.txt 2008-10-06 17:08:32 ComboFix2.txt 2008-09-20 19:21:53 Przed: 4 852 703 232 bajtów wolnych Po: 5,365,321,728 bajtów wolnych 282 --- E O F --- 2008-09-27 12:38:34

**Posty:** 8001 · przez **Okocza** 06 Paź 2008, 19:16

djarta, ale z kodu bluescreena wynika co innego

**Posty:** 105 · przez **kristof200** 06 Paź 2008, 19:51

Dr. Web CureIt nic niewykryl .

Dodano 06.10.2008 20:05:39:

Kod: Zaznacz wszystko: Stealth MBR rootkit detector 0.2.4 by Gmer, http://www.gmer.net device: opened successfully user: MBR read successfully kernel: MBR read successfully user & kernel MBR OK

Dodano 06.10.2008 20:06:26:
a co do tego Atrax programu ??
Moze to on to powoduje ?

Dodano 06.10.2008 20:07:00:
tzn on juz odinstalowny jest tylko ze jak skanuje rejestr to z nim zawsze jest cos.

Kto jest na forum