logo do sprawdzenia ( zawiesza się komp )

**Posty:** 93 · przez **andig** 11 Maj 2007, 21:26

Gdy włączy mi się już explorator.exe, to przez chwile mogę uruchamiać różne aplikacje na kompie. Po pewnej chwili kaput i nic już nie mogę zrobić, tylko foldery mogę otwierać i tak ten stan trwa 10-15 min., a potem się odblokowuje i jest git wszystko. Kompa skanowałem ad-aware, spy sweeperem i online ( www.ewido.com ).

Kod: Zaznacz wszystko: Logfile of HijackThis v1.99.1 Scan saved at 19:46:37, on 2007-05-11 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe E:\Programy\InCD\InCDsrv.exe C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\system32\spoolsv.exe E:\Programy\MSI\bin\btwdins.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\WINDOWS\system32\VNICMon.exe C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\Program Files\Cyberlink\Shared Files\RichVideo.exe C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe C:\WINDOWS\System32\svchost.exe E:\Programy\Winamp\winampa.exe E:\Programy\Spy Sweeper\SpySweeper.exe C:\WINDOWS\system32\ctfmon.exe E:\Programy\Gadu-Gadu\gg.exe E:\Programy\MSI\BTTray.exe C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe E:\Programy\A4Tech\Mouse\Amoumain.exe E:\Programy\A4Tech\Keyboard\Ikeymain.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe E:\Programy\StyleXp\CursorXP.exe C:\WINDOWS\system32\wuauclt.exe E:\Programy\Opera\Opera.exe C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE C:\Documents and Settings\ADMIN\Pulpit\Programy\Drużyna odsyfiania\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file) O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - E:\Programy\Adobe Reader\ActiveX\AcroIEHelper.dll O2 - BHO: flashget urlcatch - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - E:\Programy\FlashGet\jccatch.dll O2 - BHO: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MegauploadToolbar\megauploadtoolbar.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: CoTGT_BHO Class - {C333CF63-767F-4831-94AC-E683D962C63C} - C:\Program Files\TGTSoft\StyleXP\TGT_BHO.dll O2 - BHO: FlashGet GetFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - E:\Programy\FlashGet\getflash.dll O3 - Toolbar: FlashGet - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - E:\Programy\FlashGet\fgiebar.dll O3 - Toolbar: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MegauploadToolbar\megauploadtoolbar.dll O4 - HKLM\..\Run: [NIC Monitor] VNICMon.exe O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe" O4 - HKLM\..\Run: [Ad-watch] "E:\Programy\Ad-aware 6\Ad-watch.exe" O4 - HKLM\..\Run: [WinampAgent] E:\Programy\Winamp\winampa.exe O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [Gadu-Gadu] "E:\Programy\Gadu-Gadu\gg.exe" /tray O4 - Startup: Amoumain.lnk = E:\Programy\A4Tech\Mouse\Amoumain.exe O4 - Startup: cursor.CurXPTheme O4 - Startup: Ikeymain.lnk = E:\Programy\A4Tech\Keyboard\Ikeymain.exe O4 - Global Startup: Adobe Reader Speed Launch.lnk = E:\Programy\Adobe Reader\Reader\reader_sl.exe O4 - Global Startup: BTTray.lnk = ? O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe O4 - Global Startup: Kalendarz XP.lnk = E:\Programy\Kalendarz XP\Kalendarz.exe O8 - Extra context menu item: &Ściągnij przy pomocy FlashGet'a - E:\Programy\FlashGet\jc_link.htm O8 - Extra context menu item: &Ściągnij wszystko przy pomocy FlashGet'a - E:\Programy\FlashGet\jc_all.htm O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O8 - Extra context menu item: Wyślij do interfejsu &Bluetooth - E:\Programy\MSI\btsendto_ie_ctx.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - E:\Programy\MSI\btsendto_ie.htm O9 - Extra 'Tools' menuitem: @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - E:\Programy\MSI\btsendto_ie.htm O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - E:\Programy\FlashGet\flashget.exe O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - E:\Programy\FlashGet\flashget.exe O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing) O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing) O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://downloads.ewido.net/ewidoOnlineScan.cab O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll O16 - DPF: {31B7EB4E-8B4B-11D1-A789-00A0CC6651A8} (Cult3D ActiveX Player) - http://host.cycore.net/plugins/windows/ie/Cult3D_IE_5.3.0.228.cab O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1155159078281 O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab31267.cab O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C1} (GameDesire Pool 8) - http://67.15.101.3/g_bin/pl/billard8_2_0_0_28.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{442584D8-2591-414A-8BC1-556222A46283}: NameServer = 85.255.116.130 85.255.112.20 O17 - HKLM\System\CCS\Services\Tcpip\..\{55622F82-5079-4398-9982-B250C053FB20}: NameServer = 85.255.116.130,85.255.112.20 O17 - HKLM\System\CCS\Services\Tcpip\..\{8BB394BD-8832-4A5B-A0AE-3AD0F81CEEEB}: NameServer = 85.255.116.130,85.255.112.20 O17 - HKLM\System\CCS\Services\Tcpip\..\{B95509AE-EF1A-4FF2-B02E-F051C6637EBC}: NameServer = 85.255.116.130,85.255.112.20 O17 - HKLM\System\CCS\Services\Tcpip\..\{BE49397D-7848-443F-B98D-6B53A6F9B593}: NameServer = 85.255.116.130,85.255.112.20 O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.116.130 85.255.112.20 O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.116.130 85.255.112.20 O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\Skype4COM.dll O20 - Winlogon Notify: WRNotifier - C:\WINDOWS\SYSTEM32\WRLogonNTF.dll O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing) O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing) O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - E:\Programy\MSI\bin\btwdins.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: InCD Helper (InCDsrv) - Nero AG - E:\Programy\InCD\InCDsrv.exe O23 - Service: SQL Server (SQLEXPRESS) (MSSQL$SQLEXPRESS) - Unknown owner - c:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe" -sSQLEXPRESS (file missing) O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\Cyberlink\Shared Files\RichVideo.exe O23 - Service: StyleXPService - Unknown owner - C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe O23 - Service: Creative VF0010 RunApp Service (VF0010Srv) - Unknown owner - h:\drivers\english\V0010bSv.exe (file missing) O23 - Service: Visual Studio Analyzer RPC bridge - Unknown owner - E:\Nauka\Visual Basic 6.0\Tools\VS-Ent98\Vanalyzr\varpc.exe (file missing) O23 - Service: Webroot Spy Sweeper Engine (WebrootSpySweeperService) - Webroot Software, Inc. - E:\Programy\Spy Sweeper\SpySweeper.exe

Kod: Zaznacz wszystko: "Silent Runners.vbs", revision 46, http://www.silentrunners.org/ Operating System: Windows XP SP2 Output limited to non-default values, except where indicated by "{++}" Startup items buried in registry: --------------------------------- HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++} "ctfmon.exe" = "C:\WINDOWS\system32\ctfmon.exe" [MS] "Gadu-Gadu" = ""E:\Programy\Gadu-Gadu\gg.exe" /tray" ["Gadu-Gadu S.A."] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++} "NIC Monitor" = "VNICMon.exe" [empty string] "avast!" = "C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" ["ALWIL Software"] "SunJavaUpdateSched" = ""C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"" ["Sun Microsystems, Inc."] "Ad-watch" = ""E:\Programy\Ad-aware 6\Ad-watch.exe"" [file not found] "WinampAgent" = "E:\Programy\Winamp\winampa.exe" [null data] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Setup\ {++} EXECUTION UNLIKELY: "Configuring Data Access Components" = "C:\WINDOWS\system32\odbcconf.exe /E /F "C:\WINDOWS\system32\odbcconf.tmp"" [MS] HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\(Default) = (no title provided) -> {HKLM...CLSID} = "AcroIEHlprObj Class" \InProcServer32\(Default) = "E:\Programy\Adobe Reader\ActiveX\AcroIEHelper.dll" ["Adobe Systems Incorporated"] {2F364306-AA45-47B5-9F9D-39A8B94E7EF7}\(Default) = "flashget urlcatch" -> {HKLM...CLSID} = "Flashget Catch Url Class" \InProcServer32\(Default) = "E:\Programy\FlashGet\jccatch.dll" ["www.flashget.com"] {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C}\(Default) = (no title provided) -> {HKLM...CLSID} = "Megaupload Toolbar" \InProcServer32\(Default) = "C:\PROGRA~1\MegauploadToolbar\megauploadtoolbar.dll" ["MegaUpload"] {761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\(Default) = (no title provided) -> {HKLM...CLSID} = "SSVHelper Class" \InProcServer32\(Default) = "C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll" ["Sun Microsystems, Inc."] {9030D464-4C02-4ABF-8ECC-5164760863C6}\(Default) = (no title provided) -> {HKLM...CLSID} = "Windows Live Sign-in Helper" \InProcServer32\(Default) = "C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll" [MS] {C333CF63-767F-4831-94AC-E683D962C63C}\(Default) = (no title provided) -> {HKLM...CLSID} = "CoTGT_BHO Class" \InProcServer32\(Default) = "C:\Program Files\TGTSoft\StyleXP\TGT_BHO.dll" [null data] {F156768E-81EF-470C-9057-481BA8380DBA}\(Default) = (no title provided) -> {HKLM...CLSID} = "FlashGet GetFlash Class" \InProcServer32\(Default) = "E:\Programy\FlashGet\getflash.dll" ["www.flashget.com"] HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\ "{42071714-76d4-11d1-8b24-00a0c9068ff3}" = "Rozszerzenie CPL kadrowania wyświetlania" -> {HKLM...CLSID} = "Rozszerzenie CPL kadrowania wyświetlania" \InProcServer32\(Default) = "deskpan.dll" [file not found] "{88895560-9AA2-1069-930E-00AA0030EBC8}" = "Rozszerzenie ikony HyperTerminalu" -> {HKLM...CLSID} = "HyperTerminal Icon Ext" \InProcServer32\(Default) = "C:\WINDOWS\System32\hticons.dll" ["Hilgraeve, Inc."] "{FF393560-C2A7-11CF-BFF4-444553540000}" = "Historia" -> {HKCU...CLSID} = "Historia" \InProcServer32\(Default) = "C:\WINDOWS\System32\shdocvw.dll" [MS] "{3DC7A020-0ACD-11CF-A9BB-00AA004AE837}" = "Internet" -> {HKCU...CLSID} = "Internet" \InProcServer32\(Default) = "C:\WINDOWS\System32\shdocvw.dll" [MS] "{88C6C381-2E85-11D0-94DE-444553540000}" = "Folder pamięci podręcznej ActiveX" -> {HKCU...CLSID} = "Folder pamięci podręcznej ActiveX" \InProcServer32\(Default) = "C:\WINDOWS\System32\occache.dll" [MS] "{F5175861-2688-11d0-9C5E-00AA00A45957}" = "Folder subskrypcji" -> {HKCU...CLSID} = "Folder subskrypcji" \InProcServer32\(Default) = "C:\WINDOWS\System32\webcheck.dll" [MS] "{00020D75-0000-0000-C000-000000000046}" = "Microsoft Office Outlook Desktop Icon Handler" -> {HKLM...CLSID} = "Microsoft Office Outlook" \InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\OFFICE11\MLSHEXT.DLL" [MS] "{0006F045-0000-0000-C000-000000000046}" = "Microsoft Office Outlook Custom Icon Handler" -> {HKLM...CLSID} = "Rozszerzenie ikon plików programu Outlook" \InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\OFFICE11\OLKFSTUB.DLL" [MS] "{42042206-2D85-11D3-8CFF-005004838597}" = "Microsoft Office HTML Icon Handler" -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "C:\Program Files\Microsoft Office\OFFICE11\msohev.dll" [MS] "{472083B0-C522-11CF-8763-00608CC02F24}" = "avast" -> {HKLM...CLSID} = "avast" \InProcServer32\(Default) = "C:\Program Files\Alwil Software\Avast4\ashShell.dll" ["ALWIL Software"] "{F0CB00CD-5A07-4D91-97F5-A8C92CDA93E4}" = "Shell Extensions for RealOne Player" -> {HKLM...CLSID} = "RealOne Player Context Menu Class" \InProcServer32\(Default) = "E:\Programy\Real Player\rpshell.dll" ["RealNetworks, Inc."] "{e82a2d71-5b2f-43a0-97b8-81be15854de8}" = "ShellLink for Application References" -> {HKLM...CLSID} = "ShellLink for Application References" \InProcServer32\(Default) = "C:\WINDOWS\system32\dfshim.dll" [MS] "{E37E2028-CE1A-4f42-AF05-6CEABC4E5D75}" = "Shell Icon Handler for Application References" -> {HKLM...CLSID} = "Shell Icon Handler for Application References" \InProcServer32\(Default) = "C:\WINDOWS\system32\dfshim.dll" [MS] "{B327765E-D724-4347-8B16-78AE18552FC3}" = "NeroDigitalIconHandler" -> {HKLM...CLSID} = "NeroDigitalIconHandler Class" \InProcServer32\(Default) = "C:\Program Files\Common Files\Ahead\Lib\NeroDigitalExt.dll" ["Nero AG"] "{7F1CF152-04F8-453A-B34C-E609530A9DC8}" = "NeroDigitalPropSheetHandler" -> {HKLM...CLSID} = "NeroDigitalPropSheetHandler Class" \InProcServer32\(Default) = "C:\Program Files\Common Files\Ahead\Lib\NeroDigitalExt.dll" ["Nero AG"] "{6B19FEC2-A45B-11CF-9045-00A0C9039735}" = "Registered ActiveX Controls" -> {HKLM...CLSID} = "Registered ActiveX Controls" \InProcServer32\(Default) = "E:\Nauka\Visual Basic 6.0\MSDev98\Bin\IDE\DEVXPGL.DLL" [file not found] "{D545EBD1-BD92-11CF-8772-00A0C9039735}" = "Developer Studio Components" -> {HKLM...CLSID} = "Developer Studio Components" \InProcServer32\(Default) = "E:\Nauka\Visual Basic 6.0\MSDev98\Bin\IDE\DEVXPGL.DLL" [file not found] "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" = "WinRAR shell extension" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "E:\Programy\WinRAR\rarext.dll" [null data] "{FC9FB64A-1EB2-4CCF-AF5E-1A497A9B5C2D}" = "Messenger Sharing Folders" -> {HKLM...CLSID} = "Moje foldery udostępniania" \InProcServer32\(Default) = "C:\Program Files\MSN Messenger\fsshext.8.1.0178.00.dll" [MS] "{6af09ec9-b429-11d4-a1fb-0090960218cb}" = "My Bluetooth Places" -> {HKLM...CLSID} = "Moje miejsca interfejsu Bluetooth" \InProcServer32\(Default) = "C:\WINDOWS\system32\btneighborhood.dll" ["Broadcom Corporation."] "{640167b4-59b0-47a6-b335-a6b3c0695aea}" = "Portable Media Devices" -> {HKLM...CLSID} = "Portable Media Devices" \InProcServer32\(Default) = "C:\WINDOWS\system32\Audiodev.dll" [MS] "{35786D3C-B075-49b9-88DD-029876E11C01}" = "Portable Devices" -> {HKLM...CLSID} = "Portable Devices" \InProcServer32\(Default) = "C:\WINDOWS\system32\wpdshext.dll" [MS] "{D6791A63-E7E2-4fee-BF52-5DED8E86E9B8}" = "Portable Devices Menu" -> {HKLM...CLSID} = "Portable Devices Menu" \InProcServer32\(Default) = "C:\WINDOWS\system32\wpdshext.dll" [MS] "{7C9D5882-CB4A-4090-96C8-430BFE8B795B}" = "Webroot Spy Sweeper Context Menu Integration" -> {HKLM...CLSID} = "Webroot Spy Sweeper Context Menu Integration" \InProcServer32\(Default) = "E:\Programy\SPYSWE~1\SSCtxMnu.dll" ["Webroot Software, Inc."] HKLM\Software\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\ "WPDShServiceObj" = "{AAA288BA-9A4C-45B0-95D7-94D524869DB5}" -> {HKLM...CLSID} = "WPDShServiceObj Class" \InProcServer32\(Default) = "C:\WINDOWS\system32\WPDShServiceObj.dll" [MS] HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ INFECTION WARNING! WRNotifier\DLLName = "WRLogonNTF.dll" ["Webroot Software, Inc."] HKLM\Software\Classes\PROTOCOLS\Filter\ INFECTION WARNING! text/xml\CLSID = "{807553E5-5146-11D5-A672-00B0D022E945}" -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL" [MS] HKLM\Software\Classes\Folder\shellex\ColumnHandlers\ {7D4D6379-F301-4311-BEBA-E26EB0561882}\(Default) = "NeroDigitalExt.NeroDigitalColumnHandler" -> {HKLM...CLSID} = "NeroDigitalColumnHandler Class" \InProcServer32\(Default) = "C:\Program Files\Common Files\Ahead\Lib\NeroDigitalExt.dll" ["Nero AG"] {F9DB5320-233E-11D1-9F84-707F02C10627}\(Default) = "PDF Column Info" -> {HKLM...CLSID} = "PDF Shell Extension" \InProcServer32\(Default) = "E:\Programy\Adobe Reader\ActiveX\PDFShell.dll" ["Adobe Systems, Inc."] HKLM\Software\Classes\*\shellex\ContextMenuHandlers\ avast\(Default) = "{472083B0-C522-11CF-8763-00608CC02F24}" -> {HKLM...CLSID} = "avast" \InProcServer32\(Default) = "C:\Program Files\Alwil Software\Avast4\ashShell.dll" ["ALWIL Software"] WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "E:\Programy\WinRAR\rarext.dll" [null data] HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\ WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "E:\Programy\WinRAR\rarext.dll" [null data] HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\ avast\(Default) = "{472083B0-C522-11CF-8763-00608CC02F24}" -> {HKLM...CLSID} = "avast" \InProcServer32\(Default) = "C:\Program Files\Alwil Software\Avast4\ashShell.dll" ["ALWIL Software"] FineReader8\(Default) = "{F7091C74-EBB1-49D7-94C7-FE4886CCC18D}" -> {HKLM...CLSID} = "FineReader8ExplorerContextMenuHandler" \InProcServer32\(Default) = "E:\Programy\ABBYY FineReader 8.0 Professional Edition\FECMenu.dll" ["ABBYY Software"] SpySweeper\(Default) = "{7C9D5882-CB4A-4090-96C8-430BFE8B795B}" -> {HKLM...CLSID} = "Webroot Spy Sweeper Context Menu Integration" \InProcServer32\(Default) = "E:\Programy\SPYSWE~1\SSCtxMnu.dll" ["Webroot Software, Inc."] WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "E:\Programy\WinRAR\rarext.dll" [null data] Active Desktop and Wallpaper: ----------------------------- Active Desktop is disabled at this entry: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState HKCU\Control Panel\Desktop\ "Wallpaper" = "C:\Documents and Settings\ADMIN\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp" Enabled Screen Saver: --------------------- HKCU\Control Panel\Desktop\ "SCRNSAVE.EXE" = "C:\WINDOWS\system32\logon.scr" [MS] DESKTOP.INI DLL launch in local fixed drive directories: -------------------------------------------------------- C:\Documents and Settings\ADMIN\Ustawienia lokalne\Historia\DESKTOP.INI [.ShellClassInfo] CLSID={FF393560-C2A7-11CF-BFF4-444553540000} -> {HKCU...CLSID}\InProcServer32\(Default) = "C:\WINDOWS\System32\shdocvw.dll" [MS] C:\Documents and Settings\ADMIN\Ustawienia lokalne\Historia\History.IE5\DESKTOP.INI [.ShellClassInfo] CLSID={FF393560-C2A7-11CF-BFF4-444553540000} -> {HKCU...CLSID}\InProcServer32\(Default) = "C:\WINDOWS\System32\shdocvw.dll" [MS] C:\Documents and Settings\Administrator\Ustawienia lokalne\Historia\DESKTOP.INI [.ShellClassInfo] CLSID={FF393560-C2A7-11CF-BFF4-444553540000} -> {HKCU...CLSID}\InProcServer32\(Default) = "C:\WINDOWS\System32\shdocvw.dll" [MS] C:\Documents and Settings\Administrator\Ustawienia lokalne\Historia\History.IE5\DESKTOP.INI [.ShellClassInfo] CLSID={FF393560-C2A7-11CF-BFF4-444553540000} -> {HKCU...CLSID}\InProcServer32\(Default) = "C:\WINDOWS\System32\shdocvw.dll" [MS] C:\Documents and Settings\Default User\Ustawienia lokalne\Historia\DESKTOP.INI [.ShellClassInfo] CLSID={FF393560-C2A7-11CF-BFF4-444553540000} -> {HKCU...CLSID}\InProcServer32\(Default) = "C:\WINDOWS\System32\shdocvw.dll" [MS] C:\Documents and Settings\Default User\Ustawienia lokalne\Historia\History.IE5\DESKTOP.INI [.ShellClassInfo] CLSID={FF393560-C2A7-11CF-BFF4-444553540000} -> {HKCU...CLSID}\InProcServer32\(Default) = "C:\WINDOWS\System32\shdocvw.dll" [MS] C:\Documents and Settings\LocalService\Ustawienia lokalne\Historia\DESKTOP.INI [.ShellClassInfo] CLSID={FF393560-C2A7-11CF-BFF4-444553540000} -> {HKCU...CLSID}\InProcServer32\(Default) = "C:\WINDOWS\System32\shdocvw.dll" [MS] C:\Documents and Settings\LocalService\Ustawienia lokalne\Historia\History.IE5\DESKTOP.INI [.ShellClassInfo] CLSID={FF393560-C2A7-11CF-BFF4-444553540000} -> {HKCU...CLSID}\InProcServer32\(Default) = "C:\WINDOWS\System32\shdocvw.dll" [MS] C:\Documents and Settings\NetworkService\Ustawienia lokalne\Historia\History.IE5\DESKTOP.INI [.ShellClassInfo] CLSID={FF393560-C2A7-11CF-BFF4-444553540000} -> {HKCU...CLSID}\InProcServer32\(Default) = "C:\WINDOWS\System32\shdocvw.dll" [MS] C:\WINDOWS\Downloaded Program Files\DESKTOP.INI [.ShellClassInfo] CLSID={88C6C381-2E85-11d0-94DE-444553540000} -> {HKCU...CLSID}\InProcServer32\(Default) = "C:\WINDOWS\System32\occache.dll" [MS] C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Historia\DESKTOP.INI [.ShellClassInfo] CLSID={FF393560-C2A7-11CF-BFF4-444553540000} -> {HKCU...CLSID}\InProcServer32\(Default) = "C:\WINDOWS\System32\shdocvw.dll" [MS] C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Historia\History.IE5\DESKTOP.INI [.ShellClassInfo] CLSID={FF393560-C2A7-11CF-BFF4-444553540000} -> {HKCU...CLSID}\InProcServer32\(Default) = "C:\WINDOWS\System32\shdocvw.dll" [MS] Startup items in "ADMIN" & "All Users" startup folders: ------------------------------------------------------- C:\Documents and Settings\ADMIN\Menu Start\Programy\Autostart "Amoumain" -> shortcut to: "E:\Programy\A4Tech\Mouse\Amoumain.exe" ["A4Tech Co.,Ltd."] INFECTION WARNING! "cursor.CurXPTheme" [null data] "Ikeymain" -> shortcut to: "E:\Programy\A4Tech\Keyboard\Ikeymain.exe" ["A4Tech Co.,Ltd."] C:\Documents and Settings\All Users\Menu Start\Programy\Autostart "Adobe Reader Speed Launch" -> shortcut to: "E:\Programy\Adobe Reader\Reader\reader_sl.exe" ["Adobe Systems Incorporated"] "BTTray" -> shortcut to: "E:\Programy\MSI\BTTray.exe" ["Broadcom Corporation."] "DSLMON" -> shortcut to: "C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe" [empty string] "Kalendarz XP" -> shortcut to: "E:\Programy\Kalendarz XP\Kalendarz.exe" [null data] Enabled Scheduled Tasks: ------------------------ "AppleSoftwareUpdate" -> launches: "C:\Program Files\Apple Software Update\SoftwareUpdate.exe -Task" ["Apple Computer, Inc."] "wrSpySweeperTrialSweep" -> launches: "E:\Programy\Spy Sweeper\SpySweeperUI.exe /ScheduleSweep=wrSpySweeperTrialSweep" ["Webroot Software, Inc."] Winsock2 Service Provider DLLs: ------------------------------- Namespace Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++} 000000000001\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS] 000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS] 000000000003\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS] Transport Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++} 0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range: %SystemRoot%\system32\mswsock.dll [MS], 01 - 03, 06 - 23 %SystemRoot%\system32\rsvpsp.dll [MS], 04 - 05 Toolbars, Explorer Bars, Extensions: ------------------------------------ Toolbars HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\ "{4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C}" -> {HKLM...CLSID} = "Megaupload Toolbar" \InProcServer32\(Default) = "C:\PROGRA~1\MegauploadToolbar\megauploadtoolbar.dll" ["MegaUpload"] HKLM\Software\Microsoft\Internet Explorer\Toolbar\ "{E0E899AB-F487-11D5-8D29-0050BA6940E3}" = "FlashGet" -> {HKLM...CLSID} = "FlashGet" \InProcServer32\(Default) = "E:\Programy\FlashGet\fgiebar.dll" ["Amaze Soft"] "{4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C}" = (no title provided) -> {HKLM...CLSID} = "Megaupload Toolbar" \InProcServer32\(Default) = "C:\PROGRA~1\MegauploadToolbar\megauploadtoolbar.dll" ["MegaUpload"] Explorer Bars Dormant Explorer Bars in "View, Explorer Bar" menu HKLM\Software\Classes\CLSID\{FF059E31-CC5A-4E2E-BF3B-96E929D65503}\(Default) = "&Badanie" Implemented Categories\{00021493-0000-0000-C000-000000000046}\ [vertical bar] InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL" [MS] Extensions (Tools menu items, main toolbar menu buttons) HKLM\Software\Microsoft\Internet Explorer\Extensions\ {08B0E5C0-4FCB-11CF-AAA5-00401C608501}\ "MenuText" = "Sun Java Console" "CLSIDExtension" = "{CAFEEFAC-0016-0000-0001-ABCDEFFEDCBC}" -> {HKCU...CLSID} = "Java Plug-in 1.6.0_01" \InProcServer32\(Default) = "C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll" ["Sun Microsystems, Inc."] -> {HKLM...CLSID} = "Java Plug-in 1.6.0_01" \InProcServer32\(Default) = "C:\Program Files\Java\jre1.6.0_01\bin\npjpi160_01.dll" ["Sun Microsystems, Inc."] {92780B25-18CC-41C8-B9BE-3C9C571A8263}\ "ButtonText" = "Badanie" {CCA281CA-C863-46EF-9331-5C8D4460577F}\ "ButtonText" = "@btrez.dll,-4015" "MenuText" = "@btrez.dll,-4017" "Script" = "E:\Programy\MSI\btsendto_ie.htm" [null data] {D6E814A0-E0C5-11D4-8D29-0050BA6940E3}\ "ButtonText" = "FlashGet" "MenuText" = "FlashGet" "Exec" = "E:\Programy\FlashGet\flashget.exe" ["FlashGet.com"] {E2E2DD38-D088-4134-82B7-F2BA38496583}\ "MenuText" = "@xpsp3res.dll,-20001" "Exec" = "%windir%\Network Diagnostic\xpnetdiag.exe" [MS] {FB5F1910-F110-11D2-BB9E-00C04F795683}\ "ButtonText" = "Messenger" "MenuText" = "Windows Messenger" "Exec" = "C:\Program Files\Messenger\msmsgs.exe" [file not found] Running Services (Display Name, Service Name, Path {Service DLL}): ------------------------------------------------------------------ avast! Antivirus, avast! Antivirus, ""C:\Program Files\Alwil Software\Avast4\ashServ.exe"" ["ALWIL Software"] avast! iAVS4 Control Service, aswUpdSv, ""C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe"" ["ALWIL Software"] avast! Mail Scanner, avast! Mail Scanner, ""C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service" ["ALWIL Software"] avast! Web Scanner, avast! Web Scanner, ""C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service" ["ALWIL Software"] Bluetooth Service, btwdins, "E:\Programy\MSI\bin\btwdins.exe" ["Broadcom Corporation."] Cyberlink RichVideo Service(CRVS), RichVideo, ""C:\Program Files\Cyberlink\Shared Files\RichVideo.exe"" [empty string] InCD Helper, InCDsrv, "E:\Programy\InCD\InCDsrv.exe" ["Nero AG"] Machine Debug Manager, MDM, ""C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE"" [MS] SQL Server (SQLEXPRESS), MSSQL$SQLEXPRESS, ""c:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe" -sSQLEXPRESS" [MS] StyleXPService, StyleXPService, ""C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe"" [empty string] Webroot Spy Sweeper Engine, WebrootSpySweeperService, "E:\Programy\Spy Sweeper\SpySweeper.exe" ["Webroot Software, Inc."] Keyboard Driver Filters: ------------------------ HKLM\System\CurrentControlSet\Control\Class\{4D36E96B-E325-11CE-BFC1-08002BE10318}\ "UpperFilters" = INFECTION WARNING! "SSKBFD" ["Webroot Software Inc (www.webroot.com)"] Print Monitors: --------------- HKLM\System\CurrentControlSet\Control\Print\Monitors\ Canon BJ Language Monitor i320\Driver = "CNMLM47.DLL" ["CANON INC."] Microsoft Document Imaging Writer Monitor\Driver = "mdimon.dll" [MS] Port drukarki interfejsu Bluetooth\Driver = "bthcrp.dll" ["Broadcom Corporation."] ---------- + This report excludes default entries except where indicated. + To see *everywhere* the script checks and *everything* it finds, launch it from a command prompt or a shortcut with the -all parameter. + The search for DESKTOP.INI DLL launch points on all local fixed drives took 612 seconds. + The search for all Registry CLSIDs containing dormant Explorer Bars took 169 seconds. ---------- (total run time: 1105 seconds)

**Posty:** 18165 · przez **wojtas** 11 Maj 2007, 21:40

skasuj wpisy:

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O17 - HKLM\System\CCS\Services\Tcpip\..\{442584D8-2591-414A-8BC1-556222A46283}: NameServer = 85.255.116.130 85.255.112.20
O17 - HKLM\System\CCS\Services\Tcpip\..\{55622F82-5079-4398-9982-B250C053FB20}: NameServer = 85.255.116.130,85.255.112.20
O17 - HKLM\System\CCS\Services\Tcpip\..\{8BB394BD-8832-4A5B-A0AE-3AD0F81CEEEB}: NameServer = 85.255.116.130,85.255.112.20
O17 - HKLM\System\CCS\Services\Tcpip\..\{B95509AE-EF1A-4FF2-B02E-F051C6637EBC}: NameServer = 85.255.116.130,85.255.112.20
O17 - HKLM\System\CCS\Services\Tcpip\..\{BE49397D-7848-443F-B98D-6B53A6F9B593}: NameServer = 85.255.116.130,85.255.112.20
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.116.130 85.255.112.20
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.116.130 85.255.112.20

Ściągnij program http://downloads.subratam.org/Fixwareout.exe i zastosuj go

oraz daj loga z :

http://www.techsupportforum.com/sectools/sUBs/ComboFix.exe

**Posty:** 93 · przez **andig** 12 Maj 2007, 18:33

Oto log o który prosiłeś:

Kod: Zaznacz wszystko: "ADMIN" - 2007-05-12 17:07:28 Dodatek Service Pack 2 ComboFix 07-05.08.3.V - Running from: "C:\Documents and Settings\ADMIN\Pulpit\" ((((((((((((((((((((((((((((((( Files Created from 2007-04-05 to 2007-05-12 )))))))))))))))))))))))))))))))))) 2007-05-11 23:56 49,152 --a------ C:\WINDOWS\nircmd.exe 2007-05-09 22:15 164 --a------ C:\install.dat 2007-05-02 13:12 122,880 --a------ C:\WINDOWS\UnGins.exe 2007-04-27 17:37 <DIR> d-------- C:\DOCUME~1\ADMIN\DANEAP~1\MusicIP 2007-04-24 23:30 <DIR> d-------- C:\Program Files\Cyberlink 2007-04-24 23:25 221,184 --a------ C:\WINDOWS\system32\wmpns.dll 2007-04-24 23:25 <DIR> d-------- C:\Program Files\Windows Media Connect 2 2007-04-24 23:22 <DIR> d-------- C:\WINDOWS\system32\LogFiles 2007-04-24 23:22 <DIR> d-------- C:\WINDOWS\system32\drivers\UMDF 2007-04-22 14:52 <DIR> d-------- C:\DOCUME~1\ADMIN\DANEAP~1\Gadu-Gadu 2007-04-17 01:25 <DIR> d-------- C:\Program Files\MegauploadToolbar 2007-04-17 01:25 <DIR> d-------- C:\DOCUME~1\ADMIN\DANEAP~1\MegauploadToolbar 2007-04-15 15:31 223,128 --a------ C:\WINDOWS\system32\drivers\dtscsi.sys 2007-04-15 15:27 96,256 --a------ C:\WINDOWS\system32\drivers\sptd2365.sys 2007-04-15 15:27 643,072 --a------ C:\WINDOWS\system32\drivers\sptd.sys (((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))) 2007-04-30 15:46:10 745,600 ----a-w C:\WINDOWS\system32\aswBoot.exe 2007-04-30 15:41:55 85,952 ----a-w C:\WINDOWS\system32\drivers\aswmon.sys 2007-04-30 15:41:42 94,552 ----a-w C:\WINDOWS\system32\drivers\aswmon2.sys 2007-04-30 15:39:41 23,416 ----a-w C:\WINDOWS\system32\drivers\aswRdr.sys 2007-04-30 15:38:51 43,176 ----a-w C:\WINDOWS\system32\drivers\aswTdi.sys 2007-04-30 15:37:23 26,888 ----a-w C:\WINDOWS\system32\drivers\aavmker4.sys 2007-04-30 15:35:28 95,872 ----a-w C:\WINDOWS\system32\AVASTSS.scr 2007-04-06 12:56:52 43,520 ----a-w C:\WINDOWS\system32\CmdLineExt03.dll 2007-03-25 10:16:45 93,128 ----a-w C:\WINDOWS\system32\perfc015.dat 2007-03-25 10:16:45 497,928 ----a-w C:\WINDOWS\system32\perfh015.dat 2007-03-11 17:00:04 77,824 ----a-w C:\WINDOWS\system32\mmswitch.dll 2007-03-11 15:54:18 237,568 ----a-w C:\WINDOWS\system32\OggDS.dll 2007-03-11 15:52:15 921,600 ----a-w C:\WINDOWS\system32\vorbisenc.dll 2007-03-11 15:44:12 188,416 ----a-w C:\WINDOWS\system32\vorbis.dll 2007-03-11 15:42:06 45,056 ----a-w C:\WINDOWS\system32\ogg.dll 2007-03-11 15:41:37 1,415,680 ----a-w C:\WINDOWS\system32\WMV9VCM.dll 2007-03-11 15:30:41 245,760 ----a-w C:\WINDOWS\system32\mplvpx.dll 2007-03-11 15:29:29 9,216 ----a-w C:\WINDOWS\system32\cpuinf32.dll 2007-03-11 15:28:25 755,200 ----a-w C:\WINDOWS\system32\ir50_32.dll 2007-03-11 15:11:58 765,952 ----a-w C:\WINDOWS\system32\xvidcore.dll 2007-03-07 23:51:00 43,528 ------w C:\WINDOWS\system32\drivers\PxHelp20.sys 2007-03-07 23:51:00 129,784 ------w C:\WINDOWS\system32\pxafs.dll 2007-02-09 17:59:20 249,856 ------w C:\WINDOWS\Setup1.exe 2007-02-09 17:59:18 73,216 ----a-w C:\WINDOWS\ST6UNST.EXE (((((((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects] "{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}"="E:\Programy\Adobe Reader\ActiveX\AcroIEHelper.dll" "{2F364306-AA45-47B5-9F9D-39A8B94E7EF7}"="E:\Programy\FlashGet\jccatch.dll" "{4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C}"="C:\PROGRA~1\MegauploadToolbar\megauploadtoolbar.dll" "{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}"="C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll" "{9030D464-4C02-4ABF-8ECC-5164760863C6}"="C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll" "{C333CF63-767F-4831-94AC-E683D962C63C}"="C:\Program Files\TGTSoft\StyleXP\TGT_BHO.dll" "{F156768E-81EF-470C-9057-481BA8380DBA}"="E:\Programy\FlashGet\getflash.dll" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run] "NIC Monitor"="VNICMon.exe" "avast!"="C:\\PROGRA~1\\ALWILS~1\\Avast4\\ashDisp.exe" "SunJavaUpdateSched"="\"C:\\Program Files\\Java\\jre1.6.0_01\\bin\\jusched.exe\"" "Ad-watch"="\"E:\\Programy\\Ad-aware 6\\Ad-watch.exe\"" "WinampAgent"="E:\\Programy\\Winamp\\winampa.exe" "QuickTime Task"="\"E:\\Programy\\Quick Time\\qttask.exe\" -atboottime" [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run] "ctfmon.exe"="C:\\WINDOWS\\system32\\ctfmon.exe" "Gadu-Gadu"="\"E:\\Programy\\Gadu-Gadu\\gg.exe\" /tray" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\runonce] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\runonce\Setup] "Configuring Data Access Components"="C:\\WINDOWS\\system32\\odbcconf.exe /E /F \"C:\\WINDOWS\\system32\\odbcconf.tmp\"" HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa Authentication Packages msv1_0\0\0 Security Packages kerberos\0msv1_0\0schannel\0wdigest\0\0 Notification Packages scecli\0\0 HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\WebrootSpySweeperService HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ad-watch "E:\Programy\Ad-aware 6\Ad-watch.exe" HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msmsgs "C:\Program Files\Messenger\msmsgs.exe" /background HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\quicktime task "E:\Programy\Quick Time\qttask.exe" -atboottime [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Svchost] LocalService Alerter\0WebClient\0LmHosts\0RemoteRegistry\0upnphost\0SSDPSRV\0\0 NetworkService DnsCache\0\0 rpcss RpcSs\0\0 imgsvc StiSvc\0\0 termsvcs TermService\0\0 HTTPFilter HTTPFilter\0\0 DcomLaunch DcomLaunch\0TermService\0\0 WudfServiceGroup WUDFSvc\0\0 HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost [HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{74ddef9c-a94a-11db-a019-806d6172696f}] Shell\AutoRun\command D:\SETUP.EXE Contents of the 'Scheduled Tasks' folder C:\WINDOWS\tasks\AppleSoftwareUpdate.job C:\WINDOWS\tasks\wrSpySweeperTrialSweep.job ******************************************************************** catchme 0.3.660 W2K/XP/Vista - userland rootkit detector by Gmer, http://www.gmer.net Rootkit scan 2007-05-12 17:10:38 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... scanning hidden services ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden processes: 0 hidden services: 0 hidden files: 0 ******************************************************************** Completion time: 2007-05-12 17:10:47 C:\ComboFix-quarantined-files.txt ... 2007-05-12 17:10 C:\ComboFix2.txt ... 2007-05-11 23:56

Tamten drugi program wywalił to:

Kod: Zaznacz wszystko: Fixwareout Last edited 4/5/2007 Post this report in the forums please ... »»»»»Prerun check »»»»» System restarted »»»»» Postrun check HKLM\SOFTWARE\~\Winlogon\ "System"="" .... .... »»»»» Misc files. .... »»»»» Checking for older varients. .... Search five digit cs, dm, kd, jb, other, files. The following files NEED TO BE SUBMITTED to one of the following URL'S for further inspection. Click browse, find the file then click submit. http://www.virustotal.com/flash/index_en.html Or http://virusscan.jotti.org/ »»»»» Other »»»»» Current runs [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NIC Monitor"="VNICMon.exe" "avast!"="C:\\PROGRA~1\\ALWILS~1\\Avast4\\ashDisp.exe" "SunJavaUpdateSched"="\"C:\\Program Files\\Java\\jre1.6.0_01\\bin\\jusched.exe\"" "Ad-watch"="\"E:\\Programy\\Ad-aware 6\\Ad-watch.exe\"" "WinampAgent"="E:\\Programy\\Winamp\\winampa.exe" "QuickTime Task"="\"E:\\Programy\\Quick Time\\qttask.exe\" -atboottime" [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="C:\\WINDOWS\\system32\\ctfmon.exe" "Gadu-Gadu"="\"E:\\Programy\\Gadu-Gadu\\gg.exe\" /tray" .... Hosts file was reset, If you use a custom hosts file please replace it »»»»» End report »»»»»

Wydaje mi się, że teraz chodzi dobrze, poza pewnymi rzeczami....Mianowicie wywala mi błąd --> Generic Host Process for Win32 Servives i jeszcze błąd aplikacji --> Svchost.exe. W aplikacji wystąpił wyjątek nieznany wyjątek programu (0xc0000409) pod adresem 0x6ff4a3c0. I jeszcze jedno. Zapenwe gdy to wszystko pozamykam, zaraz nie będę mógł korzystać z neta. Wszystko szlak weźmie i tylko restart go odblokuje, ale to też do chwili gdy znum nie zmknę tych komunikatów. Prosze o rade.

PS. No i stało się tak jak napisałem. Odrazu po naciśnieciu ,, Nie wysyłaj " internet kaput. Teraz nie wiem czy już po tym, ale na pewno po zamknięciu błędu aplikacji ( po naciśnięciu ok ), zapora windowsa przestała działać i jak chciałem się do nie dostać to pokazuje mi coś takiego:

,, Nie można wyświetlić ustawieć Zapory systemu Windows, ponieważ skojarzona usługa nie jest uruchomiona. Czy chcesz uruchomić usługę Windows Firewall/Internet Connection Sharing (ICS)?"

Po naciśnięciu ok pisze:

,,System Windows nie może uruchomić usługi Windows Firewall/Internet Connection Sharing (ICS).

**Posty:** 18165 · przez **wojtas** 12 Maj 2007, 20:11

Użyj WWDC :
http://www.firewallleaktester.com/wwdc.htm
Zmień opcje z disable na enable. Uruchom ponownie komputer.
Tak powinny wyglądać porty (NetBIOS może być żółty) :
http://www.firewallleaktester.com/images_site/wwdc.jpg

skasuj plik:

C:\install.dat

**Posty:** 93 · przez **andig** 12 Maj 2007, 22:21

Zrobiłem to co napisałeś i nadal to samo mi wywala, teraz po dłuższym czasie korzystania. WWDC wywala mi teraz, że mam wirusa w svchost i żebym przeskanował kompa. Teraz zrestartował kompa i na razie wygląda wszystko ok. To dopisuje po jego zrestartowaniu. Niestety musze pisać wszystko na dwa razy. Bo jak sokńcze pisać to wywala mi błąd i po necie, więc zapisuje to co wcześniej i potem to wykorzystuje. Zobacze co będzie teraz, w razie co zrobie edita. Wkleijam logi i jeszcze raz proszę o pomoc i informacje.

Kod: Zaznacz wszystko: Logfile of HijackThis v1.99.1 Scan saved at 21:46:42, on 2007-05-12 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe E:\Programy\InCD\InCDsrv.exe C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\system32\spoolsv.exe E:\Programy\MSI\bin\btwdins.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\Program Files\Cyberlink\Shared Files\RichVideo.exe C:\WINDOWS\System32\svchost.exe E:\Programy\Spy Sweeper\SpySweeper.exe C:\WINDOWS\system32\VNICMon.exe C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe C:\WINDOWS\system32\ctfmon.exe E:\Programy\MSI\BTTray.exe C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe E:\Programy\A4Tech\Mouse\Amoumain.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe E:\Programy\A4Tech\Keyboard\Ikeymain.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe E:\Programy\StyleXp\CursorXP.exe E:\Programy\Opera\Opera.exe C:\WINDOWS\system32\wuauclt.exe C:\WINDOWS\system32\wuauclt.exe E:\Programy\Gadu-Gadu\gg.exe E:\Programy\Winamp\winamp.exe C:\WINDOWS\system32\dwwin.exe C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE C:\Documents and Settings\ADMIN\Pulpit\Programy\Drużyna odsyfiania\wwdc.exe C:\WINDOWS\system32\dwwin.exe C:\Documents and Settings\ADMIN\Pulpit\Programy\Drużyna odsyfiania\HijackThis\HijackThis.exe C:\WINDOWS\System32\WScript.exe C:\WINDOWS\System32\svchost.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file) O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - E:\Programy\Adobe Reader\ActiveX\AcroIEHelper.dll O2 - BHO: flashget urlcatch - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - E:\Programy\FlashGet\jccatch.dll O2 - BHO: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MegauploadToolbar\megauploadtoolbar.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: CoTGT_BHO Class - {C333CF63-767F-4831-94AC-E683D962C63C} - C:\Program Files\TGTSoft\StyleXP\TGT_BHO.dll O2 - BHO: FlashGet GetFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - E:\Programy\FlashGet\getflash.dll O3 - Toolbar: FlashGet - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - E:\Programy\FlashGet\fgiebar.dll O3 - Toolbar: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MegauploadToolbar\megauploadtoolbar.dll O4 - HKLM\..\Run: [NIC Monitor] VNICMon.exe O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe" O4 - HKLM\..\Run: [Ad-watch] "E:\Programy\Ad-aware 6\Ad-watch.exe" O4 - HKLM\..\Run: [WinampAgent] E:\Programy\Winamp\winampa.exe O4 - HKLM\..\Run: [QuickTime Task] "E:\Programy\Quick Time\qttask.exe" -atboottime O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [Gadu-Gadu] "E:\Programy\Gadu-Gadu\gg.exe" /tray O4 - Startup: Amoumain.lnk = E:\Programy\A4Tech\Mouse\Amoumain.exe O4 - Startup: cursor.CurXPTheme O4 - Startup: Ikeymain.lnk = E:\Programy\A4Tech\Keyboard\Ikeymain.exe O4 - Global Startup: Adobe Reader Speed Launch.lnk = E:\Programy\Adobe Reader\Reader\reader_sl.exe O4 - Global Startup: BTTray.lnk = ? O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe O4 - Global Startup: Kalendarz XP.lnk = E:\Programy\Kalendarz XP\Kalendarz.exe O8 - Extra context menu item: &Ściągnij przy pomocy FlashGet'a - E:\Programy\FlashGet\jc_link.htm O8 - Extra context menu item: &Ściągnij wszystko przy pomocy FlashGet'a - E:\Programy\FlashGet\jc_all.htm O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O8 - Extra context menu item: Wyślij do interfejsu &Bluetooth - E:\Programy\MSI\btsendto_ie_ctx.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - E:\Programy\MSI\btsendto_ie.htm O9 - Extra 'Tools' menuitem: @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - E:\Programy\MSI\btsendto_ie.htm O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - E:\Programy\FlashGet\flashget.exe O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - E:\Programy\FlashGet\flashget.exe O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing) O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing) O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://downloads.ewido.net/ewidoOnlineScan.cab O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll O16 - DPF: {31B7EB4E-8B4B-11D1-A789-00A0CC6651A8} (Cult3D ActiveX Player) - http://host.cycore.net/plugins/windows/ie/Cult3D_IE_5.3.0.228.cab O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1155159078281 O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab31267.cab O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C1} (GameDesire Pool 8) - http://67.15.101.3/g_bin/pl/billard8_2_0_0_28.cab O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\Skype4COM.dll O20 - Winlogon Notify: WRNotifier - C:\WINDOWS\SYSTEM32\WRLogonNTF.dll O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing) O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing) O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - E:\Programy\MSI\bin\btwdins.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: InCD Helper (InCDsrv) - Nero AG - E:\Programy\InCD\InCDsrv.exe O23 - Service: SQL Server (SQLEXPRESS) (MSSQL$SQLEXPRESS) - Unknown owner - c:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe" -sSQLEXPRESS (file missing) O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\Cyberlink\Shared Files\RichVideo.exe O23 - Service: StyleXPService - Unknown owner - C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe O23 - Service: Creative VF0010 RunApp Service (VF0010Srv) - Unknown owner - h:\drivers\english\V0010bSv.exe (file missing) O23 - Service: Visual Studio Analyzer RPC bridge - Unknown owner - E:\Nauka\Visual Basic 6.0\Tools\VS-Ent98\Vanalyzr\varpc.exe (file missing) O23 - Service: Webroot Spy Sweeper Engine (WebrootSpySweeperService) - Webroot Software, Inc. - E:\Programy\Spy Sweeper\SpySweeper.exe

Kod: Zaznacz wszystko: "Silent Runners.vbs", revision 46, http://www.silentrunners.org/ Operating System: Windows XP SP2 Output limited to non-default values, except where indicated by "{++}" Startup items buried in registry: --------------------------------- HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++} "ctfmon.exe" = "C:\WINDOWS\system32\ctfmon.exe" [MS] "Gadu-Gadu" = ""E:\Programy\Gadu-Gadu\gg.exe" /tray" ["Gadu-Gadu S.A."] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++} "NIC Monitor" = "VNICMon.exe" [empty string] "avast!" = "C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" ["ALWIL Software"] "SunJavaUpdateSched" = ""C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"" ["Sun Microsystems, Inc."] "Ad-watch" = ""E:\Programy\Ad-aware 6\Ad-watch.exe"" [file not found] "WinampAgent" = "E:\Programy\Winamp\winampa.exe" [null data] "QuickTime Task" = ""E:\Programy\Quick Time\qttask.exe" -atboottime" ["Apple Computer, Inc."] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Setup\ {++} EXECUTION UNLIKELY: "Configuring Data Access Components" = "C:\WINDOWS\system32\odbcconf.exe /E /F "C:\WINDOWS\system32\odbcconf.tmp"" [MS] HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\(Default) = (no title provided) -> {HKLM...CLSID} = "AcroIEHlprObj Class" \InProcServer32\(Default) = "E:\Programy\Adobe Reader\ActiveX\AcroIEHelper.dll" ["Adobe Systems Incorporated"] {2F364306-AA45-47B5-9F9D-39A8B94E7EF7}\(Default) = "flashget urlcatch" -> {HKLM...CLSID} = "Flashget Catch Url Class" \InProcServer32\(Default) = "E:\Programy\FlashGet\jccatch.dll" ["www.flashget.com"] {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C}\(Default) = (no title provided) -> {HKLM...CLSID} = "Megaupload Toolbar" \InProcServer32\(Default) = "C:\PROGRA~1\MegauploadToolbar\megauploadtoolbar.dll" ["MegaUpload"] {761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\(Default) = (no title provided) -> {HKLM...CLSID} = "SSVHelper Class" \InProcServer32\(Default) = "C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll" ["Sun Microsystems, Inc."] {9030D464-4C02-4ABF-8ECC-5164760863C6}\(Default) = (no title provided) -> {HKLM...CLSID} = "Windows Live Sign-in Helper" \InProcServer32\(Default) = "C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll" [MS] {C333CF63-767F-4831-94AC-E683D962C63C}\(Default) = (no title provided) -> {HKLM...CLSID} = "CoTGT_BHO Class" \InProcServer32\(Default) = "C:\Program Files\TGTSoft\StyleXP\TGT_BHO.dll" [null data] {F156768E-81EF-470C-9057-481BA8380DBA}\(Default) = (no title provided) -> {HKLM...CLSID} = "FlashGet GetFlash Class" \InProcServer32\(Default) = "E:\Programy\FlashGet\getflash.dll" ["www.flashget.com"] HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\ "{42071714-76d4-11d1-8b24-00a0c9068ff3}" = "Rozszerzenie CPL kadrowania wyświetlania" -> {HKLM...CLSID} = "Rozszerzenie CPL kadrowania wyświetlania" \InProcServer32\(Default) = "deskpan.dll" [file not found] "{88895560-9AA2-1069-930E-00AA0030EBC8}" = "Rozszerzenie ikony HyperTerminalu" -> {HKLM...CLSID} = "HyperTerminal Icon Ext" \InProcServer32\(Default) = "C:\WINDOWS\System32\hticons.dll" ["Hilgraeve, Inc."] "{FF393560-C2A7-11CF-BFF4-444553540000}" = "Historia" -> {HKCU...CLSID} = "Historia" \InProcServer32\(Default) = "C:\WINDOWS\System32\shdocvw.dll" [MS] "{3DC7A020-0ACD-11CF-A9BB-00AA004AE837}" = "Internet" -> {HKCU...CLSID} = "Internet" \InProcServer32\(Default) = "C:\WINDOWS\System32\shdocvw.dll" [MS] "{88C6C381-2E85-11D0-94DE-444553540000}" = "Folder pamięci podręcznej ActiveX" -> {HKCU...CLSID} = "Folder pamięci podręcznej ActiveX" \InProcServer32\(Default) = "C:\WINDOWS\System32\occache.dll" [MS] "{F5175861-2688-11d0-9C5E-00AA00A45957}" = "Folder subskrypcji" -> {HKCU...CLSID} = "Folder subskrypcji" \InProcServer32\(Default) = "C:\WINDOWS\System32\webcheck.dll" [MS] "{00020D75-0000-0000-C000-000000000046}" = "Microsoft Office Outlook Desktop Icon Handler" -> {HKLM...CLSID} = "Microsoft Office Outlook" \InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\OFFICE11\MLSHEXT.DLL" [MS] "{0006F045-0000-0000-C000-000000000046}" = "Microsoft Office Outlook Custom Icon Handler" -> {HKLM...CLSID} = "Rozszerzenie ikon plików programu Outlook" \InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\OFFICE11\OLKFSTUB.DLL" [MS] "{42042206-2D85-11D3-8CFF-005004838597}" = "Microsoft Office HTML Icon Handler" -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "C:\Program Files\Microsoft Office\OFFICE11\msohev.dll" [MS] "{472083B0-C522-11CF-8763-00608CC02F24}" = "avast" -> {HKLM...CLSID} = "avast" \InProcServer32\(Default) = "C:\Program Files\Alwil Software\Avast4\ashShell.dll" ["ALWIL Software"] "{F0CB00CD-5A07-4D91-97F5-A8C92CDA93E4}" = "Shell Extensions for RealOne Player" -> {HKLM...CLSID} = "RealOne Player Context Menu Class" \InProcServer32\(Default) = "E:\Programy\Real Player\rpshell.dll" ["RealNetworks, Inc."] "{e82a2d71-5b2f-43a0-97b8-81be15854de8}" = "ShellLink for Application References" -> {HKLM...CLSID} = "ShellLink for Application References" \InProcServer32\(Default) = "C:\WINDOWS\system32\dfshim.dll" [MS] "{E37E2028-CE1A-4f42-AF05-6CEABC4E5D75}" = "Shell Icon Handler for Application References" -> {HKLM...CLSID} = "Shell Icon Handler for Application References" \InProcServer32\(Default) = "C:\WINDOWS\system32\dfshim.dll" [MS] "{B327765E-D724-4347-8B16-78AE18552FC3}" = "NeroDigitalIconHandler" -> {HKLM...CLSID} = "NeroDigitalIconHandler Class" \InProcServer32\(Default) = "C:\Program Files\Common Files\Ahead\Lib\NeroDigitalExt.dll" ["Nero AG"] "{7F1CF152-04F8-453A-B34C-E609530A9DC8}" = "NeroDigitalPropSheetHandler" -> {HKLM...CLSID} = "NeroDigitalPropSheetHandler Class" \InProcServer32\(Default) = "C:\Program Files\Common Files\Ahead\Lib\NeroDigitalExt.dll" ["Nero AG"] "{6B19FEC2-A45B-11CF-9045-00A0C9039735}" = "Registered ActiveX Controls" -> {HKLM...CLSID} = "Registered ActiveX Controls" \InProcServer32\(Default) = "E:\Nauka\Visual Basic 6.0\MSDev98\Bin\IDE\DEVXPGL.DLL" [file not found] "{D545EBD1-BD92-11CF-8772-00A0C9039735}" = "Developer Studio Components" -> {HKLM...CLSID} = "Developer Studio Components" \InProcServer32\(Default) = "E:\Nauka\Visual Basic 6.0\MSDev98\Bin\IDE\DEVXPGL.DLL" [file not found] "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" = "WinRAR shell extension" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "E:\Programy\WinRAR\rarext.dll" [null data] "{FC9FB64A-1EB2-4CCF-AF5E-1A497A9B5C2D}" = "Messenger Sharing Folders" -> {HKLM...CLSID} = "Moje foldery udostępniania" \InProcServer32\(Default) = "C:\Program Files\MSN Messenger\fsshext.8.1.0178.00.dll" [MS] "{6af09ec9-b429-11d4-a1fb-0090960218cb}" = "My Bluetooth Places" -> {HKLM...CLSID} = "Moje miejsca interfejsu Bluetooth" \InProcServer32\(Default) = "C:\WINDOWS\system32\btneighborhood.dll" ["Broadcom Corporation."] "{640167b4-59b0-47a6-b335-a6b3c0695aea}" = "Portable Media Devices" -> {HKLM...CLSID} = "Portable Media Devices" \InProcServer32\(Default) = "C:\WINDOWS\system32\Audiodev.dll" [MS] "{35786D3C-B075-49b9-88DD-029876E11C01}" = "Portable Devices" -> {HKLM...CLSID} = "Portable Devices" \InProcServer32\(Default) = "C:\WINDOWS\system32\wpdshext.dll" [MS] "{D6791A63-E7E2-4fee-BF52-5DED8E86E9B8}" = "Portable Devices Menu" -> {HKLM...CLSID} = "Portable Devices Menu" \InProcServer32\(Default) = "C:\WINDOWS\system32\wpdshext.dll" [MS] "{7C9D5882-CB4A-4090-96C8-430BFE8B795B}" = "Webroot Spy Sweeper Context Menu Integration" -> {HKLM...CLSID} = "Webroot Spy Sweeper Context Menu Integration" \InProcServer32\(Default) = "E:\Programy\SPYSWE~1\SSCtxMnu.dll" ["Webroot Software, Inc."] HKLM\Software\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\ "WPDShServiceObj" = "{AAA288BA-9A4C-45B0-95D7-94D524869DB5}" -> {HKLM...CLSID} = "WPDShServiceObj Class" \InProcServer32\(Default) = "C:\WINDOWS\system32\WPDShServiceObj.dll" [MS] HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ INFECTION WARNING! WRNotifier\DLLName = "WRLogonNTF.dll" ["Webroot Software, Inc."] HKLM\Software\Classes\PROTOCOLS\Filter\ INFECTION WARNING! text/xml\CLSID = "{807553E5-5146-11D5-A672-00B0D022E945}" -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL" [MS] HKLM\Software\Classes\Folder\shellex\ColumnHandlers\ {7D4D6379-F301-4311-BEBA-E26EB0561882}\(Default) = "NeroDigitalExt.NeroDigitalColumnHandler" -> {HKLM...CLSID} = "NeroDigitalColumnHandler Class" \InProcServer32\(Default) = "C:\Program Files\Common Files\Ahead\Lib\NeroDigitalExt.dll" ["Nero AG"] {F9DB5320-233E-11D1-9F84-707F02C10627}\(Default) = "PDF Column Info" -> {HKLM...CLSID} = "PDF Shell Extension" \InProcServer32\(Default) = "E:\Programy\Adobe Reader\ActiveX\PDFShell.dll" ["Adobe Systems, Inc."] HKLM\Software\Classes\*\shellex\ContextMenuHandlers\ avast\(Default) = "{472083B0-C522-11CF-8763-00608CC02F24}" -> {HKLM...CLSID} = "avast" \InProcServer32\(Default) = "C:\Program Files\Alwil Software\Avast4\ashShell.dll" ["ALWIL Software"] WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "E:\Programy\WinRAR\rarext.dll" [null data] HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\ WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "E:\Programy\WinRAR\rarext.dll" [null data] HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\ avast\(Default) = "{472083B0-C522-11CF-8763-00608CC02F24}" -> {HKLM...CLSID} = "avast" \InProcServer32\(Default) = "C:\Program Files\Alwil Software\Avast4\ashShell.dll" ["ALWIL Software"] FineReader8\(Default) = "{F7091C74-EBB1-49D7-94C7-FE4886CCC18D}" -> {HKLM...CLSID} = "FineReader8ExplorerContextMenuHandler" \InProcServer32\(Default) = "E:\Programy\ABBYY FineReader 8.0 Professional Edition\FECMenu.dll" ["ABBYY Software"] SpySweeper\(Default) = "{7C9D5882-CB4A-4090-96C8-430BFE8B795B}" -> {HKLM...CLSID} = "Webroot Spy Sweeper Context Menu Integration" \InProcServer32\(Default) = "E:\Programy\SPYSWE~1\SSCtxMnu.dll" ["Webroot Software, Inc."] WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "E:\Programy\WinRAR\rarext.dll" [null data] Active Desktop and Wallpaper: ----------------------------- Active Desktop is disabled at this entry: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState HKCU\Control Panel\Desktop\ "Wallpaper" = "C:\Documents and Settings\ADMIN\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp" Startup items in "ADMIN" & "All Users" startup folders: ------------------------------------------------------- C:\Documents and Settings\ADMIN\Menu Start\Programy\Autostart "Amoumain" -> shortcut to: "E:\Programy\A4Tech\Mouse\Amoumain.exe" ["A4Tech Co.,Ltd."] INFECTION WARNING! "cursor.CurXPTheme" [null data] "Ikeymain" -> shortcut to: "E:\Programy\A4Tech\Keyboard\Ikeymain.exe" ["A4Tech Co.,Ltd."] C:\Documents and Settings\All Users\Menu Start\Programy\Autostart "Adobe Reader Speed Launch" -> shortcut to: "E:\Programy\Adobe Reader\Reader\reader_sl.exe" ["Adobe Systems Incorporated"] "BTTray" -> shortcut to: "E:\Programy\MSI\BTTray.exe" ["Broadcom Corporation."] "DSLMON" -> shortcut to: "C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe" [empty string] "Kalendarz XP" -> shortcut to: "E:\Programy\Kalendarz XP\Kalendarz.exe" [null data] Enabled Scheduled Tasks: ------------------------ "AppleSoftwareUpdate" -> launches: "C:\Program Files\Apple Software Update\SoftwareUpdate.exe -Task" ["Apple Computer, Inc."] "wrSpySweeperTrialSweep" -> launches: "E:\Programy\Spy Sweeper\SpySweeperUI.exe /ScheduleSweep=wrSpySweeperTrialSweep" ["Webroot Software, Inc."] Winsock2 Service Provider DLLs: ------------------------------- Namespace Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++} 000000000001\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS] 000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS] 000000000003\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS] Transport Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++} 0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range: %SystemRoot%\system32\mswsock.dll [MS], 01 - 03, 06 - 23 %SystemRoot%\system32\rsvpsp.dll [MS], 04 - 05 Toolbars, Explorer Bars, Extensions: ------------------------------------ Toolbars HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\ "{4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C}" -> {HKLM...CLSID} = "Megaupload Toolbar" \InProcServer32\(Default) = "C:\PROGRA~1\MegauploadToolbar\megauploadtoolbar.dll" ["MegaUpload"] HKLM\Software\Microsoft\Internet Explorer\Toolbar\ "{E0E899AB-F487-11D5-8D29-0050BA6940E3}" = "FlashGet" -> {HKLM...CLSID} = "FlashGet" \InProcServer32\(Default) = "E:\Programy\FlashGet\fgiebar.dll" ["Amaze Soft"] "{4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C}" = (no title provided) -> {HKLM...CLSID} = "Megaupload Toolbar" \InProcServer32\(Default) = "C:\PROGRA~1\MegauploadToolbar\megauploadtoolbar.dll" ["MegaUpload"] Extensions (Tools menu items, main toolbar menu buttons) HKLM\Software\Microsoft\Internet Explorer\Extensions\ {08B0E5C0-4FCB-11CF-AAA5-00401C608501}\ "MenuText" = "Sun Java Console" "CLSIDExtension" = "{CAFEEFAC-0016-0000-0001-ABCDEFFEDCBC}" -> {HKCU...CLSID} = "Java Plug-in 1.6.0_01" \InProcServer32\(Default) = "C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll" ["Sun Microsystems, Inc."] -> {HKLM...CLSID} = "Java Plug-in 1.6.0_01" \InProcServer32\(Default) = "C:\Program Files\Java\jre1.6.0_01\bin\npjpi160_01.dll" ["Sun Microsystems, Inc."] {92780B25-18CC-41C8-B9BE-3C9C571A8263}\ "ButtonText" = "Badanie" {CCA281CA-C863-46EF-9331-5C8D4460577F}\ "ButtonText" = "@btrez.dll,-4015" "MenuText" = "@btrez.dll,-4017" "Script" = "E:\Programy\MSI\btsendto_ie.htm" [null data] {D6E814A0-E0C5-11D4-8D29-0050BA6940E3}\ "ButtonText" = "FlashGet"; "MenuText" = "FlashGet" "Exec" = "E:\Programy\FlashGet\flashget.exe" ["FlashGet.com"] {E2E2DD38-D088-4134-82B7-F2BA38496583}\ "MenuText" = "@xpsp3res.dll,-20001" "Exec" = "%windir%\Network Diagnostic\xpnetdiag.exe" [MS] {FB5F1910-F110-11D2-BB9E-00C04F795683}\ "ButtonText" = "Messenger" "MenuText" = "Windows Messenger" "Exec" = "C:\Program Files\Messenger\msmsgs.exe" [file not found] Running Services (Display Name, Service Name, Path {Service DLL}): ------------------------------------------------------------------ avast! Antivirus, avast! Antivirus, ""C:\Program Files\Alwil Software\Avast4\ashServ.exe"" ["ALWIL Software"] avast! iAVS4 Control Service, aswUpdSv, ""C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe"" ["ALWIL Software"] avast! Mail Scanner, avast! Mail Scanner, ""C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service" ["ALWIL Software"] avast! Web Scanner, avast! Web Scanner, ""C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service" ["ALWIL Software"] Bluetooth Service, btwdins, "E:\Programy\MSI\bin\btwdins.exe" ["Broadcom Corporation."] Cyberlink RichVideo Service(CRVS), RichVideo, ""C:\Program Files\Cyberlink\Shared Files\RichVideo.exe"" [empty string] InCD Helper, InCDsrv, "E:\Programy\InCD\InCDsrv.exe" ["Nero AG"] Machine Debug Manager, MDM, ""C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE"" [MS] SQL Server (SQLEXPRESS), MSSQL$SQLEXPRESS, ""c:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe" -sSQLEXPRESS" [MS] StyleXPService, StyleXPService, ""C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe"" [empty string] Webroot Spy Sweeper Engine, WebrootSpySweeperService, "E:\Programy\Spy Sweeper\SpySweeper.exe" ["Webroot Software, Inc."] Keyboard Driver Filters: ------------------------ HKLM\System\CurrentControlSet\Control\Class\{4D36E96B-E325-11CE-BFC1-08002BE10318}\ "UpperFilters" = INFECTION WARNING! "SSKBFD" ["Webroot Software Inc (www.webroot.com)"] Print Monitors: --------------- HKLM\System\CurrentControlSet\Control\Print\Monitors\ Canon BJ Language Monitor i320\Driver = "CNMLM47.DLL" ["CANON INC."] Microsoft Document Imaging Writer Monitor\Driver = "mdimon.dll" [MS] Port drukarki interfejsu Bluetooth\Driver = "bthcrp.dll" ["Broadcom Corporation."] ---------- + This report excludes default entries except where indicated. + To see *everywhere* the script checks and *everything* it finds, launch it from a command prompt or a shortcut with the -all parameter. + To search all directories of local fixed drives for DESKTOP.INI DLL launch points and all Registry CLSIDs for dormant Explorer Bars, use the -supp parameter or answer "No" at the first message box. ---------- (total run time: 291 seconds, including 18 seconds for message boxes)

Edit:
Długo czekać nie musiałem. Błędy się co prawda nie pokazały jeszcze, ale to pewnie kwestia czasu, a za to nie moge żadnych programów uruchomić. Obiawy jak w 1 poście.

**Posty:** 18165 · przez **wojtas** 12 Maj 2007, 22:56

sciagnij gmera i dajesz 2 logi :

http://gmer.net/gmer.zip

1. Zakładka Rootkit >>> zaznaczone wszystko oprócz Pokazuj wszystko >>> kliknij Szukaj >>> czekaj cierpliwie aż skończy >>> Kopiuj >>> wklej do posta
2. Zakładka Rootkit >>> zaznaczone tylko Usługi i Pokazuj wszystko >>> kliknij Szukaj >>> czekaj cierpliwie aż skończy >>> Kopiuj >>> wklej do posta

**Posty:** 93 · przez **andig** 13 Maj 2007, 14:24

Błędy oczywiście wywaliło, tylko po dłuższym czasie...

Oto logi o które prosiłeś:

Kod: Zaznacz wszystko: GMER 1.0.12.12244 - http://www.gmer.net Rootkit scan 2007-05-13 13:36:55 Windows 5.1.2600 Dodatek Service Pack 2 ---- System - GMER 1.0.12 ---- SSDT 8231B918 ZwAllocateVirtualMemory SSDT 823AE490 ZwCreateKey SSDT 8231BE40 ZwCreateProcess SSDT 8231BDC8 ZwCreateProcessEx SSDT 8231BBE8 ZwCreateThread SSDT 8231C0A8 ZwDeleteKey SSDT 8231BEB8 ZwDeleteValueKey SSDT sptd.sys ZwEnumerateKey SSDT sptd.sys ZwEnumerateValueKey SSDT sptd.sys ZwOpenKey SSDT sptd.sys ZwQueryKey SSDT sptd.sys ZwQueryValueKey SSDT 8231B990 ZwQueueApcThread SSDT 82326FA8 ZwReadVirtualMemory SSDT 822D7188 ZwRenameKey SSDT 8231BA80 ZwSetContextThread SSDT 8231BFA8 ZwSetInformationKey SSDT 8231BCD8 ZwSetInformationProcess SSDT 8231BAF8 ZwSetInformationThread SSDT 8231BF30 ZwSetValueKey SSDT 8231BC60 ZwSuspendProcess SSDT 8231BA08 ZwSuspendThread SSDT 8231BD50 ZwTerminateProcess SSDT 8231BB70 ZwTerminateThread SSDT 82326020 ZwWriteVirtualMemory ---- Kernel code sections - GMER 1.0.12 ---- ? C:\WINDOWS\system32\drivers\sptd.sys Proces nie może uzyskać dostępu do pliku, ponieważ jest on używany przez inny proces. ? C:\WINDOWS\System32\Drivers\SPTD2365.SYS Proces nie może uzyskać dostępu do pliku, ponieważ jest on używany przez inny proces. ? C:\WINDOWS\System32\Drivers\dtscsi.sys Proces nie może uzyskać dostępu do pliku, ponieważ jest on używany przez inny proces. ? C:\WINDOWS\System32\DRIVERS\update.sys ---- User code sections - GMER 1.0.12 ---- .text E:\Programy\Spy Sweeper\SpySweeper.exe[540] kernel32.dll!CreateThread + 1A 7C810849 4 Bytes [ B3, F8, C3, 83 ] .text C:\WINDOWS\system32\dwwin.exe[1244] USER32.dll!GetCursor 77D3CECD 5 Bytes JMP 00D61080 E:\Programy\StyleXp\CurXP0.dll .text C:\WINDOWS\system32\dwwin.exe[1244] USER32.dll!GetIconInfo 77D3E9A1 5 Bytes JMP 00D61030 E:\Programy\StyleXp\CurXP0.dll .text C:\WINDOWS\system32\dwwin.exe[1244] USER32.dll!DrawIconEx 77D3F38A 5 Bytes JMP 00D61120 E:\Programy\StyleXp\CurXP0.dll .text C:\WINDOWS\system32\dwwin.exe[1972] USER32.dll!GetCursor 77D3CECD 5 Bytes JMP 00D71080 E:\Programy\StyleXp\CurXP0.dll .text C:\WINDOWS\system32\dwwin.exe[1972] USER32.dll!GetIconInfo 77D3E9A1 5 Bytes JMP 00D71030 E:\Programy\StyleXp\CurXP0.dll .text C:\WINDOWS\system32\dwwin.exe[1972] USER32.dll!DrawIconEx 77D3F38A 5 Bytes JMP 00D71120 E:\Programy\StyleXp\CurXP0.dll .text C:\WINDOWS\system32\dwwin.exe[2208] USER32.dll!GetCursor 77D3CECD 5 Bytes JMP 00E21080 E:\Programy\StyleXp\CurXP0.dll .text C:\WINDOWS\system32\dwwin.exe[2208] USER32.dll!GetIconInfo 77D3E9A1 5 Bytes JMP 00E21030 E:\Programy\StyleXp\CurXP0.dll .text C:\WINDOWS\system32\dwwin.exe[2208] USER32.dll!DrawIconEx 77D3F38A 5 Bytes JMP 00E21120 E:\Programy\StyleXp\CurXP0.dll .text C:\Documents and Settings\ADMIN\Pulpit\gmer.exe[2668] USER32.dll!GetCursor 77D3CECD 5 Bytes JMP 00E11080 .text C:\Documents and Settings\ADMIN\Pulpit\gmer.exe[2668] USER32.dll!GetIconInfo 77D3E9A1 5 Bytes JMP 00E11030 .text C:\Documents and Settings\ADMIN\Pulpit\gmer.exe[2668] USER32.dll!DrawIconEx 77D3F38A 5 Bytes JMP 00E11120 .text C:\WINDOWS\system32\dwwin.exe[2972] USER32.dll!GetCursor 77D3CECD 5 Bytes JMP 00E21080 E:\Programy\StyleXp\CurXP0.dll .text C:\WINDOWS\system32\dwwin.exe[2972] USER32.dll!GetIconInfo 77D3E9A1 5 Bytes JMP 00E21030 E:\Programy\StyleXp\CurXP0.dll .text C:\WINDOWS\system32\dwwin.exe[2972] USER32.dll!DrawIconEx 77D3F38A 5 Bytes JMP 00E21120 E:\Programy\StyleXp\CurXP0.dll .text C:\WINDOWS\system32\dwwin.exe[3024] USER32.dll!GetCursor 77D3CECD 5 Bytes JMP 00E01080 E:\Programy\StyleXp\CurXP0.dll .text C:\WINDOWS\system32\dwwin.exe[3024] USER32.dll!GetIconInfo 77D3E9A1 5 Bytes JMP 00E01030 E:\Programy\StyleXp\CurXP0.dll .text C:\WINDOWS\system32\dwwin.exe[3024] USER32.dll!DrawIconEx 77D3F38A 5 Bytes JMP 00E01120 E:\Programy\StyleXp\CurXP0.dll .text C:\WINDOWS\explorer.exe[3512] USER32.dll!GetCursor 77D3CECD 5 Bytes JMP 01CB1080 E:\Programy\StyleXp\CurXP0.dll .text C:\WINDOWS\explorer.exe[3512] USER32.dll!GetIconInfo 77D3E9A1 5 Bytes JMP 01CB1030 E:\Programy\StyleXp\CurXP0.dll .text C:\WINDOWS\explorer.exe[3512] USER32.dll!DrawIconEx 77D3F38A 5 Bytes JMP 01CB1120 E:\Programy\StyleXp\CurXP0.dll .text E:\Programy\Gadu-Gadu\gg.exe[3672] USER32.dll!GetCursor 77D3CECD 5 Bytes JMP 02AB1080 E:\Programy\StyleXp\CurXP0.dll .text E:\Programy\Gadu-Gadu\gg.exe[3672] USER32.dll!GetIconInfo 77D3E9A1 5 Bytes JMP 02AB1030 E:\Programy\StyleXp\CurXP0.dll .text E:\Programy\Gadu-Gadu\gg.exe[3672] USER32.dll!DrawIconEx 77D3F38A 5 Bytes JMP 02AB1120 E:\Programy\StyleXp\CurXP0.dll .text C:\WINDOWS\system32\dwwin.exe[3848] USER32.dll!GetCursor 77D3CECD 5 Bytes JMP 00D71080 E:\Programy\StyleXp\CurXP0.dll .text C:\WINDOWS\system32\dwwin.exe[3848] USER32.dll!GetIconInfo 77D3E9A1 5 Bytes JMP 00D71030 E:\Programy\StyleXp\CurXP0.dll .text C:\WINDOWS\system32\dwwin.exe[3848] USER32.dll!DrawIconEx 77D3F38A 5 Bytes JMP 00D71120 E:\Programy\StyleXp\CurXP0.dll ---- Devices - GMER 1.0.12 ---- Device \FileSystem\Ntfs \Ntfs IRP_MJ_CREATE 8239D708 Device \FileSystem\Ntfs \Ntfs IRP_MJ_CLOSE 8239D708 Device \FileSystem\Ntfs \Ntfs IRP_MJ_READ 8239D708 Device \FileSystem\Ntfs \Ntfs IRP_MJ_WRITE 8239D708 Device \FileSystem\Ntfs \Ntfs IRP_MJ_QUERY_INFORMATION 8239D708 Device \FileSystem\Ntfs \Ntfs IRP_MJ_SET_INFORMATION 8239D708 Device \FileSystem\Ntfs \Ntfs IRP_MJ_QUERY_EA 8239D708 Device \FileSystem\Ntfs \Ntfs IRP_MJ_SET_EA 8239D708 Device \FileSystem\Ntfs \Ntfs IRP_MJ_FLUSH_BUFFERS 8239D708 Device \FileSystem\Ntfs \Ntfs IRP_MJ_QUERY_VOLUME_INFORMATION 8239D708 Device \FileSystem\Ntfs \Ntfs IRP_MJ_SET_VOLUME_INFORMATION 8239D708 Device \FileSystem\Ntfs \Ntfs IRP_MJ_DIRECTORY_CONTROL 8239D708 Device \FileSystem\Ntfs \Ntfs IRP_MJ_FILE_SYSTEM_CONTROL 8239D708 Device \FileSystem\Ntfs \Ntfs IRP_MJ_DEVICE_CONTROL 8239D708 Device \FileSystem\Ntfs \Ntfs IRP_MJ_SHUTDOWN 8239D708 Device \FileSystem\Ntfs \Ntfs IRP_MJ_LOCK_CONTROL 8239D708 Device \FileSystem\Ntfs \Ntfs IRP_MJ_CLEANUP 8239D708 Device \FileSystem\Ntfs \Ntfs IRP_MJ_QUERY_SECURITY 8239D708 Device \FileSystem\Ntfs \Ntfs IRP_MJ_SET_SECURITY 8239D708 Device \FileSystem\Ntfs \Ntfs IRP_MJ_QUERY_QUOTA 8239D708 Device \FileSystem\Ntfs \Ntfs IRP_MJ_SET_QUOTA 8239D708 Device \FileSystem\Ntfs \Ntfs IRP_MJ_PNP 8239D708 Device \FileSystem\Fastfat \FatCdrom IRP_MJ_CREATE 81F4E8D0 Device \FileSystem\Fastfat \FatCdrom IRP_MJ_CLOSE 81F4E8D0 Device \FileSystem\Fastfat \FatCdrom IRP_MJ_READ 81F4E8D0 Device \FileSystem\Fastfat \FatCdrom IRP_MJ_WRITE 81F4E8D0 Device \FileSystem\Fastfat \FatCdrom IRP_MJ_QUERY_INFORMATION 81F4E8D0 Device \FileSystem\Fastfat \FatCdrom IRP_MJ_SET_INFORMATION 81F4E8D0 Device \FileSystem\Fastfat \FatCdrom IRP_MJ_QUERY_EA 81F4E8D0 Device \FileSystem\Fastfat \FatCdrom IRP_MJ_SET_EA 81F4E8D0 Device \FileSystem\Fastfat \FatCdrom IRP_MJ_FLUSH_BUFFERS 81F4E8D0 Device \FileSystem\Fastfat \FatCdrom IRP_MJ_QUERY_VOLUME_INFORMATION 81F4E8D0 Device \FileSystem\Fastfat \FatCdrom IRP_MJ_SET_VOLUME_INFORMATION 81F4E8D0 Device \FileSystem\Fastfat \FatCdrom IRP_MJ_DIRECTORY_CONTROL 81F4E8D0 Device \FileSystem\Fastfat \FatCdrom IRP_MJ_FILE_SYSTEM_CONTROL 81F4E8D0 Device \FileSystem\Fastfat \FatCdrom IRP_MJ_DEVICE_CONTROL 81F4E8D0 Device \FileSystem\Fastfat \FatCdrom IRP_MJ_SHUTDOWN 81F4E8D0 Device \FileSystem\Fastfat \FatCdrom IRP_MJ_LOCK_CONTROL 81F4E8D0 Device \FileSystem\Fastfat \FatCdrom IRP_MJ_CLEANUP 81F4E8D0 Device \FileSystem\Fastfat \FatCdrom IRP_MJ_PNP 81F4E8D0 Device \Driver\Tcpip \Device\Ip IRP_MJ_CREATE 81F55370 Device \Driver\Tcpip \Device\Ip IRP_MJ_CREATE_NAMED_PIPE 81FC36A8 Device \Driver\Tcpip \Device\Ip IRP_MJ_CLOSE 81F4BB48 Device \Driver\Tcpip \Device\Ip IRP_MJ_READ 82213A20 Device \Driver\Tcpip \Device\Ip IRP_MJ_WRITE 8218BAF8 Device \Driver\Tcpip \Device\Ip IRP_MJ_QUERY_INFORMATION 82034190 Device \Driver\Tcpip \Device\Ip IRP_MJ_SET_INFORMATION 81F9BE50 Device \Driver\Tcpip \Device\Ip IRP_MJ_QUERY_EA 81F799E0 Device \Driver\Tcpip \Device\Ip IRP_MJ_SET_EA 81F7A3D8 Device \Driver\Tcpip \Device\Ip IRP_MJ_FLUSH_BUFFERS 81F46278 Device \Driver\Tcpip \Device\Ip IRP_MJ_QUERY_VOLUME_INFORMATION 822D4B00 Device \Driver\Tcpip \Device\Ip IRP_MJ_SET_VOLUME_INFORMATION 8217C9F0 Device \Driver\Tcpip \Device\Ip IRP_MJ_DIRECTORY_CONTROL 820075E8 Device \Driver\Tcpip \Device\Ip IRP_MJ_FILE_SYSTEM_CONTROL 820151F8 Device \Driver\Tcpip \Device\Ip IRP_MJ_DEVICE_CONTROL 81EF50C0 Device \Driver\Tcpip \Device\Ip IRP_MJ_INTERNAL_DEVICE_CONTROL 821AE238 Device \Driver\Tcpip \Device\Ip IRP_MJ_SHUTDOWN 82050CF8 Device \Driver\Tcpip \Device\Ip IRP_MJ_LOCK_CONTROL 8220B3A8 Device \Driver\Tcpip \Device\Ip IRP_MJ_CLEANUP 8212CCC8 Device \Driver\Tcpip \Device\Ip IRP_MJ_CREATE_MAILSLOT 81F27CB0 Device \Driver\Tcpip \Device\Ip IRP_MJ_QUERY_SECURITY 820A1A00 Device \Driver\Tcpip \Device\Ip IRP_MJ_SET_SECURITY 81F1F850 Device \Driver\Tcpip \Device\Ip IRP_MJ_POWER 81FE2768 Device \Driver\Tcpip \Device\Ip IRP_MJ_SYSTEM_CONTROL 81FE8E70 Device \Driver\Tcpip \Device\Ip IRP_MJ_DEVICE_CHANGE 82065798 Device \Driver\Tcpip \Device\Ip IRP_MJ_QUERY_QUOTA 81F236F8 Device \Driver\Tcpip \Device\Ip IRP_MJ_SET_QUOTA 82091528 Device \Driver\Tcpip \Device\Ip IRP_MJ_PNP 82055DC0 Device \Driver\dmio \Device\DmControl\DmIoDaemon IRP_MJ_CREATE 8239D0E8 Device \Driver\dmio \Device\DmControl\DmIoDaemon IRP_MJ_CLOSE 8239D0E8 Device \Driver\dmio \Device\DmControl\DmIoDaemon IRP_MJ_READ 8239D0E8 Device \Driver\dmio \Device\DmControl\DmIoDaemon IRP_MJ_WRITE 8239D0E8 Device \Driver\dmio \Device\DmControl\DmIoDaemon IRP_MJ_FLUSH_BUFFERS 8239D0E8 Device \Driver\dmio \Device\DmControl\DmIoDaemon IRP_MJ_DEVICE_CONTROL 8239D0E8 Device \Driver\dmio \Device\DmControl\DmIoDaemon IRP_MJ_INTERNAL_DEVICE_CONTROL 8239D0E8 Device \Driver\dmio \Device\DmControl\DmIoDaemon IRP_MJ_SHUTDOWN 8239D0E8 Device \Driver\dmio \Device\DmControl\DmIoDaemon IRP_MJ_POWER 8239D0E8 Device \Driver\dmio \Device\DmControl\DmIoDaemon IRP_MJ_SYSTEM_CONTROL 8239D0E8 Device \Driver\dmio \Device\DmControl\DmIoDaemon IRP_MJ_PNP 8239D0E8 Device \Driver\dmio \Device\DmControl\DmConfig IRP_MJ_CREATE 8239D0E8 Device \Driver\dmio \Device\DmControl\DmConfig IRP_MJ_CLOSE 8239D0E8 Device \Driver\dmio \Device\DmControl\DmConfig IRP_MJ_READ 8239D0E8 Device \Driver\dmio \Device\DmControl\DmConfig IRP_MJ_WRITE 8239D0E8 Device \Driver\dmio \Device\DmControl\DmConfig IRP_MJ_FLUSH_BUFFERS 8239D0E8 Device \Driver\dmio \Device\DmControl\DmConfig IRP_MJ_DEVICE_CONTROL 8239D0E8 Device \Driver\dmio \Device\DmControl\DmConfig IRP_MJ_INTERNAL_DEVICE_CONTROL 8239D0E8 Device \Driver\dmio \Device\DmControl\DmConfig IRP_MJ_SHUTDOWN 8239D0E8 Device \Driver\dmio \Device\DmControl\DmConfig IRP_MJ_POWER 8239D0E8 Device \Driver\dmio \Device\DmControl\DmConfig IRP_MJ_SYSTEM_CONTROL 8239D0E8 Device \Driver\dmio \Device\DmControl\DmConfig IRP_MJ_PNP 8239D0E8 Device \Driver\dmio \Device\DmControl\DmPnP IRP_MJ_CREATE 8239D0E8 Device \Driver\dmio \Device\DmControl\DmPnP IRP_MJ_CLOSE 8239D0E8 Device \Driver\dmio \Device\DmControl\DmPnP IRP_MJ_READ 8239D0E8 Device \Driver\dmio \Device\DmControl\DmPnP IRP_MJ_WRITE 8239D0E8 Device \Driver\dmio \Device\DmControl\DmPnP IRP_MJ_FLUSH_BUFFERS 8239D0E8 Device \Driver\dmio \Device\DmControl\DmPnP IRP_MJ_DEVICE_CONTROL 8239D0E8 Device \Driver\dmio \Device\DmControl\DmPnP IRP_MJ_INTERNAL_DEVICE_CONTROL 8239D0E8 Device \Driver\dmio \Device\DmControl\DmPnP IRP_MJ_SHUTDOWN 8239D0E8 Device \Driver\dmio \Device\DmControl\DmPnP IRP_MJ_POWER 8239D0E8 Device \Driver\dmio \Device\DmControl\DmPnP IRP_MJ_SYSTEM_CONTROL 8239D0E8 Device \Driver\dmio \Device\DmControl\DmPnP IRP_MJ_PNP 8239D0E8 Device \Driver\dmio \Device\DmControl\DmInfo IRP_MJ_CREATE 8239D0E8 Device \Driver\dmio \Device\DmControl\DmInfo IRP_MJ_CLOSE 8239D0E8 Device \Driver\dmio \Device\DmControl\DmInfo IRP_MJ_READ 8239D0E8 Device \Driver\dmio \Device\DmControl\DmInfo IRP_MJ_WRITE 8239D0E8 Device \Driver\dmio \Device\DmControl\DmInfo IRP_MJ_FLUSH_BUFFERS 8239D0E8 Device \Driver\dmio \Device\DmControl\DmInfo IRP_MJ_DEVICE_CONTROL 8239D0E8 Device \Driver\dmio \Device\DmControl\DmInfo IRP_MJ_INTERNAL_DEVICE_CONTROL 8239D0E8

Nie moge wkleić reszty loga

, ani w tym , ani w innym poście. Dlatego uploada zrobiłem. Oto link http://rapidshare.com/files/31068423/Logo.txt.html

**Posty:** 18165 · przez **wojtas** 13 Maj 2007, 20:54

zastosuj

smitfraudfix z opcji 2:

http://siri.urz.free.fr/Fix/SmitfraudFix_En.php

**Posty:** 93 · przez **andig** 13 Maj 2007, 23:54

No, nie powiedziałeś, ze jak wywali czy usnąć jakiś rejestr to czy zatwierdzić, czy nie, no ale wszystkiego wyczuć się nie da xD. Podczas działania wywalał błędy, że nie mógł czegoś tam odczytać itp. Na koniec ukazało się to:

Kod: Zaznacz wszystko: SmitFraudFix v2.181 Scan done at 22:06:55,03, 2007-05-13 Run from C:\Documents and Settings\ADMIN\Pulpit\SmitfraudFix OS: Microsoft Windows XP [Wersja 5.1.2600] - Windows_NT The filesystem type is NTFS Fix run in normal mode »»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Before SmitFraudFix !!!Attention, following keys are not inevitably infected!!! SrchSTS.exe by S!Ri Search SharedTaskScheduler's .dll »»»»»»»»»»»»»»»»»»»»»»»» Killing process »»»»»»»»»»»»»»»»»»»»»»»» hosts 127.0.0.1 localhost »»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix GenericRenosFix by S!Ri »»»»»»»»»»»»»»»»»»»»»»»» Deleting infected files »»»»»»»»»»»»»»»»»»»»»»»» DNS »»»»»»»»»»»»»»»»»»»»»»»» Deleting Temp Files »»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System !!!Attention, following keys are not inevitably infected!!! [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] "System"="" »»»»»»»»»»»»»»»»»»»»»»»» Registry Cleaning Registry Cleaning done. »»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler After SmitFraudFix !!!Attention, following keys are not inevitably infected!!! SrchSTS.exe by S!Ri Search SharedTaskScheduler's .dll »»»»»»»»»»»»»»»»»»»»»»»» End

Zniknął mi obrazek z pulpitu, ale na szczęście okazało się, ze przestawił się tylko na, a właściwie na jego brak :p. Na razie wszystko działa jak należy. Aż za dobrze xD, ale jeszcze poczekam, znając tego kompa, może schrzanić się za 5h, albo i dłużej

. A i mam pytanka 2. Ten programik wywalił jakiś folder ze swoimi plikami. Nie wiem dokładnie co on tam trzyma i nie chce mi sie w to wnikać na razie, więc prosze powiec czy moge go usunąć. Drugie pytanie: HijackThis zostawił folder z rejestrami, które w razie co moge przywrucić. Moge już go unsunąć, czy jeszcze nie, bo a nóż się przyda??

Edit:

No niestety...nadal się to pojawia. Może coś źle zrobiłem?? Nie mam pojęcia, ale zaczyna mnie to irytować ( ten głupi błąd ).

**Posty:** 18165 · przez **wojtas** 14 Maj 2007, 16:53

zrob screena z tego bledu

**Posty:** 93 · przez **andig** 14 Maj 2007, 18:42

http://img470.imageshack.us/my.php?image=screen1mp6.jpg

http://img470.imageshack.us/my.php?image=screen2ml9.jpg

**Posty:** 18165 · przez **wojtas** 14 Maj 2007, 19:29

sciagnij i zaisntaluj:

http://www.programosy.pl/program,kerio-personal-firewall.html

oraz czy WWDC masz wszystkie porty na zielono??

poczytaj temat o Naprawianie firewalla XP SP2

http://www.searchengines.pl/phpbb203/index.php?showtopic=79791&st=0&p=297177&#entry297177

**Posty:** 93 · przez **andig** 14 Maj 2007, 20:54

Ściągnołem i zainstalowałem. WWDC pokazuje all zielone, poza netbiosem, który, jak sam powiedziełś wcześniej, może być żółty no i tak u mnie jest xD. Na tej stronce znalazłem opis mojego problemu z zaporą, oraz jego likwidacją. No i tu już jest problem... U mnie jest to ta druga wersja z samego początku. Ściągam sobie ten plik do zmiany rejestru. Wchodzę na awaryjnym odpalam, klikam ,,tak" i zonk. Oto komunikat jaki mi wywala:

,,Nie można zaimprotować bla bla ( ścieżka do pliku ): błąd przy dostępie do rejestru."

No i jaki masz teraz pomysł ?? Jestem jak najbardziej otwarty na wszelkie propozycje ;P.

**Posty:** 18165 · przez **wojtas** 14 Maj 2007, 21:13

wklej do notatnika:

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"AntiVirusDisableNotify"=dword:00000000
"FirewallDisableNotify"=dword:00000000
"UpdatesDisableNotify"=dword:00000000
"AntiVirusOverride"=dword:00000000
"FirewallOverride"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SHAREDACCESS]
"NextInstance"=dword:00000001

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SHAREDACCESS\0000]
"Service"="SharedAccess"
"Legacy"=dword:00000001
"ConfigFlags"=dword:00000000
"Class"="LegacyDriver"
"ClassGUID"="{8ECC055D-047F-11D1-A537-0000F8753ED1}"
"DeviceDesc"="Zapora połšczenia internetowego / Udostępnianie połšczenia internetowego"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SHAREDACCESS\0000\Control]
"ActiveService"="SharedAccess"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess]
"Type"=dword:00000020
"Start"=dword:00000002
"ErrorControl"=dword:00000001
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00
"DisplayName"="Zapora systemu Windows/Udostępnianie połšczenia internetowego"
"DependOnService"=hex(7):4e,00,65,00,74,00,6d,00,61,00,6e,00,00,00,57,00,69,00,\
6e,00,4d,00,67,00,6d,00,74,00,00,00,00,00
"DependOnGroup"=hex(7):00,00
"ObjectName"="LocalSystem"
"Description"="Zapewnia usługi translacji adresów sieciowych, adresowania, rozpoznawania nazw i/lub blokowania dostępu intruzów wszystkim komputerom w sieci domowej lub biurowej."

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Epoch]
"Epoch"=dword:0000042e

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters]
"ServiceDll"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,\
00,74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,\
69,00,70,00,6e,00,61,00,74,00,68,00,6c,00,70,00,2e,00,64,00,6c,00,6c,00,00,\
00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
"139:TCP"="139:TCP:*:Enabled:@xpsp2res.dll,-22004"
"445:TCP"="445:TCP:*:Enabled:@xpsp2res.dll,-22005"
"137:UDP"="137:UDP:*:Enabled:@xpsp2res.dll,-22001"
"138:UDP"="138:UDP:*:Enabled:@xpsp2res.dll,-22002"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall"=dword:00000001

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"139:TCP"="139:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22004"
"445:TCP"="445:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22005"
"137:UDP"="137:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22001"
"138:UDP"="138:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22002"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Security]
"Security"=hex:01,00,14,80,90,00,00,00,9c,00,00,00,14,00,00,00,30,00,00,00,02,\
00,1c,00,01,00,00,00,02,80,14,00,ff,01,0f,00,01,01,00,00,00,00,00,01,00,00,\
00,00,02,00,60,00,04,00,00,00,00,00,14,00,fd,01,02,00,01,01,00,00,00,00,00,\
05,12,00,00,00,00,00,18,00,ff,01,0f,00,01,02,00,00,00,00,00,05,20,00,00,00,\
20,02,00,00,00,00,14,00,8d,01,02,00,01,01,00,00,00,00,00,05,0b,00,00,00,00,\
00,18,00,fd,01,02,00,01,02,00,00,00,00,00,05,20,00,00,00,23,02,00,00,01,01,\
00,00,00,00,00,05,12,00,00,00,01,01,00,00,00,00,00,05,12,00,00,00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Setup]
"ServiceUpgrade"=dword:00000001

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Setup\InterfacesUnfirewalledAtUpdate]
"All"=dword:00000001

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Enum]
"0"="Root\\LEGACY_SHAREDACCESS\\0000"
"Count"=dword:00000001
"NextInstance"=dword:00000001

Plik >>> Zapisz jako >>> Zmień rozszerzenie z TXT na Wszystkie pliki >>> Zapisz pod nazwą FIX.REG >>> Uruchom plik FIX.REG

**Posty:** 93 · przez **andig** 14 Maj 2007, 21:50

Wywala ten sam błąd. Nie da się jakąś ominąć tego błąd ?? Czyli po postu po chamie to zmienić.

**Posty:** 18165 · przez **wojtas** 15 Maj 2007, 12:18

REGEDIT 4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"AntiVirusDisableNotify"=dword:00000000
"FirewallDisableNotify"=dword:00000000
"UpdatesDisableNotify"=dword:00000000
"AntiVirusOverride"=dword:00000000
"FirewallOverride"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SHAREDACCESS]
"NextInstance"=dword:00000001

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SHAREDACCESS\0000]
"Service"="SharedAccess"
"Legacy"=dword:00000001
"ConfigFlags"=dword:00000000
"Class"="LegacyDriver"
"ClassGUID"="{8ECC055D-047F-11D1-A537-0000F8753ED1}"
"DeviceDesc"="Zapora połšczenia internetowego / Udostępnianie połšczenia internetowego"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SHAREDACCESS\0000\Control]
"ActiveService"="SharedAccess"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess]
"Type"=dword:00000020
"Start"=dword:00000002
"ErrorControl"=dword:00000001
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00
"DisplayName"="Zapora systemu Windows/Udostępnianie połšczenia internetowego"
"DependOnService"=hex(7):4e,00,65,00,74,00,6d,00,61,00,6e,00,00,00,57,00,69,00,\
6e,00,4d,00,67,00,6d,00,74,00,00,00,00,00
"DependOnGroup"=hex(7):00,00
"ObjectName"="LocalSystem"
"Description"="Zapewnia usługi translacji adresów sieciowych, adresowania, rozpoznawania nazw i/lub blokowania dostępu intruzów wszystkim komputerom w sieci domowej lub biurowej."

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Epoch]
"Epoch"=dword:0000042e

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters]
"ServiceDll"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,\
00,74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,\
69,00,70,00,6e,00,61,00,74,00,68,00,6c,00,70,00,2e,00,64,00,6c,00,6c,00,00,\
00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
"139:TCP"="139:TCP:*:Enabled:@xpsp2res.dll,-22004"
"445:TCP"="445:TCP:*:Enabled:@xpsp2res.dll,-22005"
"137:UDP"="137:UDP:*:Enabled:@xpsp2res.dll,-22001"
"138:UDP"="138:UDP:*:Enabled:@xpsp2res.dll,-22002"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall"=dword:00000001

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"139:TCP"="139:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22004"
"445:TCP"="445:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22005"
"137:UDP"="137:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22001"
"138:UDP"="138:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22002"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Security]
"Security"=hex:01,00,14,80,90,00,00,00,9c,00,00,00,14,00,00,00,30,00,00,00,02,\
00,1c,00,01,00,00,00,02,80,14,00,ff,01,0f,00,01,01,00,00,00,00,00,01,00,00,\
00,00,02,00,60,00,04,00,00,00,00,00,14,00,fd,01,02,00,01,01,00,00,00,00,00,\
05,12,00,00,00,00,00,18,00,ff,01,0f,00,01,02,00,00,00,00,00,05,20,00,00,00,\
20,02,00,00,00,00,14,00,8d,01,02,00,01,01,00,00,00,00,00,05,0b,00,00,00,00,\
00,18,00,fd,01,02,00,01,02,00,00,00,00,00,05,20,00,00,00,23,02,00,00,01,01,\
00,00,00,00,00,05,12,00,00,00,01,01,00,00,00,00,00,05,12,00,00,00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Setup]
"ServiceUpgrade"=dword:00000001

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Setup\InterfacesUnfirewalledAtUpdate]
"All"=dword:00000001

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Enum]
"0"="Root\\LEGACY_SHAREDACCESS\\0000"
"Count"=dword:00000001
"NextInstance"=dword:00000001

wklej to

i zobacz tu`:

http://www.searchengines.pl/phpbb203/index.php?showtopic=12532

**Posty:** 93 · przez **andig** 15 Maj 2007, 20:15

No więc tak:

Zainstalowałem to:
http://www.microsoft.com/downloads/details...1a-46b3eac7a305

Rejestr twój wreście zadziałał.
I teraz próbuje zaktualizować zapore, ale jakoś się nie udaje. I mam pytanie. Czy jest to konieczne?? O ile mi wiadomo same te aktualizacje nie są bezpieczne. Nie wiem jak z tej strony, ale na pewno z automatika.

Tam pisze o rejstalacji winda. Trzeba go robić ??

Jest też tam opisany ten błąd aplikacji, który mam i jest tam napisane, żeby przeskanować czym się da kompa. Pytanie brzmi. Czy skanować jeszcze raz spy sweeper, ad-aware, tym online ( www.ewido.com ) i avastem( nim nie skanowałem wcześniej ). Moim zdaniem to jałowa robota, ale jak napiszesz, żeby tak zrobić, to zrobie.

Dobra tyle jeżeli chodzi, o to co zrobiłem. Teraz reakcja kompa. No ogólnie się nie zmartwił i dalej sobie chula jak chce. Teraz, przynajmniej na razie, błędów mi nie wywala, ale zawieszka jest wszech obecna w kompie... Jestem już po x restarcie... dotychczas miałem tak, że jak się zawiesi, to, to co wcześniej odpaliłem działało jak należy, a reszta( uruchamienie aplikacji i takie tam ) po pewnym czasie się odlagowały, a net działał, dopuki tych błędów nie zatwierdziłem. A tu jakieś 2-3min. kaput all. Nic się nie dało zrobić. Programiki poza IE ( stanął, odmówił posłuszeństwa

), które miało aktualke robić działało również w zwolnionym tępie. Ogólnie masakrator. Co teraz robimy Master Yoda ?? Mówiąc szczerze ta sytuacja, tak mnie denerwuje, że aż śmieszy. Mam chęć wywalić przez okno kompa i na niego nie patrzeć, ech... ale tego nigdy nie zrobie xD.

PS. Sorka za błędy, ale właśnie Word mi padł ;P.

**Posty:** 18165 · przez **wojtas** 15 Maj 2007, 20:57

no wiec daj loga z :

http://deckard.geekstogo.com/dss.exe

andig napisał(a):Czy jest to konieczne?

ja nie uzywam zapory ani aktualizacji od MS i jakos zyje :mrgreen:

powiedz jeszcze jakie masz problemy? jakie bledy? czy co CIe meczy jeszcze

**Posty:** 93 · przez **andig** 15 Maj 2007, 23:08

No więc, svhost.exe zużywa mi za dużo procka --> 100% oraz zżera mi 66 164k pamięci. Zauważyłem też, że jak svhost de sobie siana, to proces bezczynności zabiera od 5 do 50% procka. Czy to jest normalne?? Poza tym jest ok.

Ten Kerio, to jest mi niezbędny, czy może mogę go nie mieć ??

No i te logo, o które prosiłeś:

Kod: Zaznacz wszystko: Deckard's System Scanner v20070426.43 Run by ADMIN on 2007-05-15 at 20:53:43 Computer is in Normal Mode. -------------------------------------------------------------------------------- -- System Restore -------------------------------------------------------------- Successfully created a Deckard's System Scanner Restore Point. -- Last 5 Restore Point(s) -- 30: 2007-05-15 18:54:12 UTC - RP212 - Deckard's System Scanner Restore Point 29: 2007-05-14 17:41:16 UTC - RP211 - Installed Sunbelt Kerio Personal Firewall 28: 2007-05-13 01:22:34 UTC - RP210 - Punkt kontrolny systemu 27: 2007-05-11 19:43:26 UTC - RP209 - Installed QuickTime 26: 2007-05-11 19:30:58 UTC - RP208 - Removed QuickTime -- First Restore Point -- 1: 2007-04-16 18:57:24 UTC - RP183 - Punkt kontrolny systemu Backed up registry hives. Performed disk cleanup. -- HijackThis (run as ADMIN.exe) ----------------------------------------------- Logfile of HijackThis v1.99.1 Scan saved at 20:58:45, on 2007-05-15 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe E:\Programy\InCD\InCDsrv.exe C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\VNICMon.exe C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe E:\Programy\Winamp\winampa.exe E:\Programy\MSI\bin\btwdins.exe C:\WINDOWS\system32\ctfmon.exe E:\Programy\Kerio\Personal Firewall 4\kpf4ss.exe E:\Programy\MSI\BTTray.exe C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe E:\Programy\A4Tech\Mouse\Amoumain.exe E:\Programy\A4Tech\Keyboard\Ikeymain.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\Program Files\Cyberlink\Shared Files\RichVideo.exe C:\WINDOWS\System32\svchost.exe E:\Programy\Spy Sweeper\SpySweeper.exe E:\Programy\Kerio\Personal Firewall 4\kpf4gui.exe E:\Programy\StyleXp\CursorXP.exe E:\Programy\Opera\Opera.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe E:\Programy\Kerio\Personal Firewall 4\kpf4gui.exe C:\WINDOWS\system32\wuauclt.exe C:\WINDOWS\system32\taskmgr.exe C:\WINDOWS\system32\taskmgr.exe C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE C:\Documents and Settings\ADMIN\Pulpit\dss.exe C:\DOCUME~1\ADMIN\Pulpit\Programy\Drużyna odsyfiania\HijackThis\ADMIN.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file) O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - E:\Programy\Adobe Reader\ActiveX\AcroIEHelper.dll O2 - BHO: flashget urlcatch - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - E:\Programy\FlashGet\jccatch.dll O2 - BHO: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MegauploadToolbar\megauploadtoolbar.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: CoTGT_BHO Class - {C333CF63-767F-4831-94AC-E683D962C63C} - C:\Program Files\TGTSoft\StyleXP\TGT_BHO.dll O2 - BHO: FlashGet GetFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - E:\Programy\FlashGet\getflash.dll O3 - Toolbar: FlashGet - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - E:\Programy\FlashGet\fgiebar.dll O3 - Toolbar: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MegauploadToolbar\megauploadtoolbar.dll O4 - HKLM\..\Run: [NIC Monitor] VNICMon.exe O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe" O4 - HKLM\..\Run: [Ad-watch] "E:\Programy\Ad-aware 6\Ad-watch.exe" O4 - HKLM\..\Run: [WinampAgent] E:\Programy\Winamp\winampa.exe O4 - HKLM\..\Run: [QuickTime Task] "E:\Programy\Quick Time\qttask.exe" -atboottime O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [Gadu-Gadu] "E:\Programy\Gadu-Gadu\gg.exe" /tray O4 - Startup: Amoumain.lnk = E:\Programy\A4Tech\Mouse\Amoumain.exe O4 - Startup: cursor.CurXPTheme O4 - Startup: Ikeymain.lnk = E:\Programy\A4Tech\Keyboard\Ikeymain.exe O4 - Global Startup: Adobe Reader Speed Launch.lnk = E:\Programy\Adobe Reader\Reader\reader_sl.exe O4 - Global Startup: BTTray.lnk = ? O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe O4 - Global Startup: Kalendarz XP.lnk = E:\Programy\Kalendarz XP\Kalendarz.exe O8 - Extra context menu item: &Ściągnij przy pomocy FlashGet'a - E:\Programy\FlashGet\jc_link.htm O8 - Extra context menu item: &Ściągnij wszystko przy pomocy FlashGet'a - E:\Programy\FlashGet\jc_all.htm O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O8 - Extra context menu item: Wyślij do interfejsu &Bluetooth - E:\Programy\MSI\btsendto_ie_ctx.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - E:\Programy\MSI\btsendto_ie.htm O9 - Extra 'Tools' menuitem: @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - E:\Programy\MSI\btsendto_ie.htm O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - E:\Programy\FlashGet\flashget.exe O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - E:\Programy\FlashGet\flashget.exe O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing) O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing) O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll O17 - HKLM\System\CCS\Services\Tcpip\..\{442584D8-2591-414A-8BC1-556222A46283}: NameServer = 85.255.116.130 85.255.112.20 O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\Skype4COM.dll O20 - Winlogon Notify: WRNotifier - C:\WINDOWS\SYSTEM32\WRLogonNTF.dll O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing) O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing) O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - E:\Programy\MSI\bin\btwdins.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: InCD Helper (InCDsrv) - Nero AG - E:\Programy\InCD\InCDsrv.exe O23 - Service: Sunbelt Kerio Personal Firewall 4 (KPF4) - Sunbelt Software - E:\Programy\Kerio\Personal Firewall 4\kpf4ss.exe O23 - Service: SQL Server (SQLEXPRESS) (MSSQL$SQLEXPRESS) - Unknown owner - c:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe" -sSQLEXPRESS (file missing) O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\Cyberlink\Shared Files\RichVideo.exe O23 - Service: StyleXPService - Unknown owner - C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe O23 - Service: Creative VF0010 RunApp Service (VF0010Srv) - Unknown owner - h:\drivers\english\V0010bSv.exe (file missing) O23 - Service: Visual Studio Analyzer RPC bridge - Unknown owner - E:\Nauka\Visual Basic 6.0\Tools\VS-Ent98\Vanalyzr\varpc.exe (file missing) O23 - Service: Webroot Spy Sweeper Engine (WebrootSpySweeperService) - Webroot Software, Inc. - E:\Programy\Spy Sweeper\SpySweeper.exe -- HijackThis Fixed Entries (C:\DOCUME~1\ADMIN\Pulpit\Programy\Drużyna odsyfiania\HijackThis\backups\) -------------------------------------------------------------------------------- backup-20070512-165723-502 O17 - HKLM\System\CCS\Services\Tcpip\..\{55622F82-5079-4398-9982-B250C053FB20}: NameServer = 85.255.116.130,85.255.112.20 backup-20070512-165723-534 O17 - HKLM\System\CCS\Services\Tcpip\..\{BE49397D-7848-443F-B98D-6B53A6F9B593}: NameServer = 85.255.116.130,85.255.112.20 backup-20070512-165723-711 O17 - HKLM\System\CCS\Services\Tcpip\..\{B95509AE-EF1A-4FF2-B02E-F051C6637EBC}: NameServer = 85.255.116.130,85.255.112.20 backup-20070512-165723-738 O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.116.130 85.255.112.20 backup-20070512-165723-784 O17 - HKLM\System\CCS\Services\Tcpip\..\{442584D8-2591-414A-8BC1-556222A46283}: NameServer = 85.255.116.130 85.255.112.20 backup-20070512-165723-867 O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) backup-20070512-165723-897 O17 - HKLM\System\CCS\Services\Tcpip\..\{8BB394BD-8832-4A5B-A0AE-3AD0F81CEEEB}: NameServer = 85.255.116.130,85.255.112.20 backup-20070512-165723-937 O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.116.130 85.255.112.20 -- File Associations ----------------------------------------------------------- [COLOR=red].js - jsfile - DefaultIcon - e:\programy\lol\Program\Netscape.exe ,1[/COLOR] [COLOR=red].js - jsfile - shell\open\command - e:\programy\lol\Program\Netscape.exe "%1"[/COLOR] -- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------- R0 giveio - c:\windows\system32\giveio.sys R0 speedfan - c:\windows\system32\speedfan.sys <Not Verified; Windows (R) 2000 DDK provider; Windows (R) 2000 DDK driver> R1 fwdrv (Firewall Driver) - c:\windows\system32\drivers\fwdrv.sys <Not Verified; Sunbelt Software; > R1 khips (Kerio HIPS Driver) - c:\windows\system32\drivers\khips.sys <Not Verified; ; HIPS> R1 StyleXPHelper - c:\program files\tgtsoft\stylexp\stylexphelper.exe <Not Verified; Windows (R) 2000 DDK provider; Windows (R) 2000 DDK driver> R2 BT848 (BtCap, WDM Video Capture) - c:\windows\system32\drivers\bt848.sys <Not Verified; Conexant Systems, Inc.; bt848.sys> R2 BTTUNER (BtTuner, WDM TV Tuner) - c:\windows\system32\drivers\bttuner.sys <Not Verified; Conexant Systems, Inc.; bttuner.sys> R2 BTXBAR (BtXBar, WDM Crossbar) - c:\windows\system32\drivers\btxbar.sys <Not Verified; Conexant Systems, Inc.; btxbar.sys> R3 Amps2prt (A4Tech PS/2 Port Mouse Driver) - c:\windows\system32\drivers\amps2prt.sys <Not Verified; A4Tech Co.,Ltd.; A4Tech iWheelWorks Mouse Driver> R3 pfc (Padus ASPI Shell) - c:\windows\system32\drivers\pfc.sys <Not Verified; Padus, Inc.; Padus(R) ASPI Shell> S2 BTSERIAL (Bluetooth Serial Driver) - c:\windows\system32\drivers\btserial.sys (file missing) S2 BTSLBCSP (Bluetooth Port Client Driver) - c:\windows\system32\drivers\btslbcsp.sys (file missing) S3 btwmodem (Modem Bluetooth) - c:\windows\system32\drivers\btwmodem.sys <Not Verified; Broadcom Corporation.; Bluetooth Software 4.0.1.2101> S3 DstAud - c:\windows\system32\drivers\dstaud.sys <Not Verified; Windows (R) 2000 DDK provider; Windows (R) 2000 DDK driver> S3 DstVid - c:\windows\system32\drivers\dstvid.sys <Not Verified; Windows (R) 2000 DDK provider; Windows (R) 2000 DDK driver> S3 GMSIPCI - g:\install\gmsipci.sys (file missing) S3 NTACCESS - g:\ntaccess.sys (file missing) S3 SetupNTGLM7X - g:\ntglm7x.sys (file missing) S3 VNICPKT5 (VNICPKT5 Protocol Driver) - c:\windows\system32\vnicpkt5.sys <Not Verified; ; NIC Diagnostic Tool> -- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled -------------------- R2 StyleXPService - "c:\program files\tgtsoft\stylexp\stylexpservice.exe" <Not Verified; ; StyleXPService Module> S3 VF0010Srv (Creative VF0010 RunApp Service) - h:\drivers\english\v0010bsv.exe (file missing) S3 Visual Studio Analyzer RPC bridge - e:\nauka\visual basic 6.0\tools\vs-ent98\vanalyzr\varpc.exe (file missing) -- Scheduled Tasks ------------------------------------------------------------- 2007-05-10 16:58:12 1382 --a------ C:\WINDOWS\Tasks\wrSpySweeperTrialSweep.job 2007-04-07 14:43:50 284 --a------ C:\WINDOWS\Tasks\AppleSoftwareUpdate.job -- Files created between 2007-04-15 and 2007-05-15 ----------------------------- 2007-05-13 22:08:12 1790 --a------ C:\WINDOWS\system32\tmp.reg 2007-05-02 13:12:52 122880 --a------ C:\WINDOWS\UnGins.exe 2007-04-24 23:30:50 0 d-------- C:\Program Files\Cyberlink 2007-04-24 23:25:00 0 d-------- C:\Program Files\Windows Media Connect 2 2007-04-24 23:22:45 0 d-------- C:\WINDOWS\system32\LogFiles 2007-04-24 23:22:45 0 d-------- C:\WINDOWS\system32\drivers\UMDF 2007-04-17 01:25:53 0 d-------- C:\Program Files\MegauploadToolbar 2007-04-15 15:31:18 223128 --a------ C:\WINDOWS\system32\drivers\dtscsi.sys 2007-04-15 15:27:23 96256 --a------ C:\WINDOWS\system32\drivers\sptd2365.sys 2007-04-15 15:27:23 643072 --a------ C:\WINDOWS\system32\drivers\sptd.sys -- Find3M Report --------------------------------------------------------------- 2007-05-03 11:24:22 0 d-------- C:\Program Files\Java 2007-04-28 10:28:43 0 d-------- C:\Documents and Settings\ADMIN\Dane aplikacji\Skype 2007-04-27 17:37:32 0 d-------- C:\Documents and Settings\ADMIN\Dane aplikacji\MusicIP 2007-04-22 20:52:27 0 d--h----- C:\Program Files\InstallShield Installation Information 2007-04-22 14:52:03 0 d-------- C:\Documents and Settings\ADMIN\Dane aplikacji\Gadu-Gadu 2007-04-21 13:01:07 0 d-------- C:\Documents and Settings\ADMIN\Dane aplikacji\MegauploadToolbar 2007-04-07 14:43:44 0 d-------- C:\Program Files\Apple Software Update 2007-04-06 16:43:44 0 d-------- C:\Program Files\DivX 2007-04-06 16:43:43 0 d-------- C:\Program Files\DivXCodec 2007-04-06 14:56:52 43520 --a------ C:\WINDOWS\system32\CmdLineExt03.dll 2007-03-25 14:14:38 0 d-------- C:\Program Files\Common Files\Skype 2007-03-25 12:16:45 497928 --a------ C:\WINDOWS\system32\perfh015.dat 2007-03-25 12:16:45 93128 --a------ C:\WINDOWS\system32\perfc015.dat 2007-03-19 18:08:44 0 d-------- C:\Program Files\Netia 2007-03-11 19:00:04 77824 --a------ C:\WINDOWS\system32\mmswitch.dll 2007-03-11 17:54:18 237568 --a------ C:\WINDOWS\system32\OggDS.dll <Not Verified; ; Ogg DirectShow(tm) Filter Collection> 2007-03-11 17:52:15 921600 --a------ C:\WINDOWS\system32\vorbisenc.dll 2007-03-11 17:44:12 188416 --a------ C:\WINDOWS\system32\vorbis.dll 2007-03-11 17:42:06 45056 --a------ C:\WINDOWS\system32\ogg.dll 2007-03-11 17:41:37 1415680 --a------ C:\WINDOWS\system32\WMV9VCM.dll <Not Verified; Microsoft Corporation; Windows Media Video 9 VCM> 2007-03-11 17:30:41 245760 --a------ C:\WINDOWS\system32\mplvpx.dll <Not Verified; Ligos Corporation; MPL Video Library> 2007-03-11 17:29:29 9216 --a------ C:\WINDOWS\system32\cpuinf32.dll 2007-03-11 17:28:25 755200 --a------ C:\WINDOWS\system32\ir50_32.dll <Not Verified; Intel Corporation; Intel Indeo® video 5.10> 2007-03-11 17:11:58 765952 --a------ C:\WINDOWS\system32\xvidcore.dll -- Registry Dump --------------------------------------------------------------- [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects] {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} E:\Programy\Adobe Reader\ActiveX\AcroIEHelper.dll {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} E:\Programy\FlashGet\jccatch.dll {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} C:\PROGRA~1\MegauploadToolbar\megauploadtoolbar.dll {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll {9030D464-4C02-4ABF-8ECC-5164760863C6} C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll {C333CF63-767F-4831-94AC-E683D962C63C} C:\Program Files\TGTSoft\StyleXP\TGT_BHO.dll {F156768E-81EF-470C-9057-481BA8380DBA} E:\Programy\FlashGet\getflash.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run] "NIC Monitor"="VNICMon.exe" "avast!"="C:\\PROGRA~1\\ALWILS~1\\Avast4\\ashDisp.exe" "SunJavaUpdateSched"="\"C:\\Program Files\\Java\\jre1.6.0_01\\bin\\jusched.exe\"" "Ad-watch"="\"E:\\Programy\\Ad-aware 6\\Ad-watch.exe\"" "WinampAgent"="E:\\Programy\\Winamp\\winampa.exe" "QuickTime Task"="\"E:\\Programy\\Quick Time\\qttask.exe\" -atboottime" [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run] "ctfmon.exe"="C:\\WINDOWS\\system32\\ctfmon.exe" "Gadu-Gadu"="\"E:\\Programy\\Gadu-Gadu\\gg.exe\" /tray" [HKEY_USERS\.default\software\microsoft\windows\currentversion\run] "CTFMON.EXE"="C:\\WINDOWS\\System32\\CTFMON.EXE" HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa Authentication Packages REG_MULTI_SZ msv1_0\0\0 Security Packages REG_MULTI_SZ kerberos\0msv1_0\0schannel\0wdigest\0\0 Notification Packages REG_MULTI_SZ scecli\0\0 HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\WebrootSpySweeperService [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Ad-watch] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="Ad-watch" "hkey"="HKLM" "command"="\"E:\\Programy\\Ad-aware 6\\Ad-watch.exe\"" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="msmsgs" "hkey"="HKCU" "command"="\"C:\\Program Files\\Messenger\\msmsgs.exe\" /background" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="qttask" "hkey"="HKLM" "command"="\"E:\\Programy\\Quick Time\\qttask.exe\" -atboottime" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Svchost] LocalService REG_MULTI_SZ Alerter\0WebClient\0LmHosts\0RemoteRegistry\0upnphost\0SSDPSRV\0\0 NetworkService REG_MULTI_SZ DnsCache\0\0 rpcss REG_MULTI_SZ RpcSs\0\0 imgsvc REG_MULTI_SZ StiSvc\0\0 termsvcs REG_MULTI_SZ TermService\0\0 HTTPFilter REG_MULTI_SZ HTTPFilter\0\0 DcomLaunch REG_MULTI_SZ DcomLaunch\0TermService\0\0 WudfServiceGroup REG_MULTI_SZ WUDFSvc\0\0 [HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{74ddef9c-a94a-11db-a019-806d6172696f}] Shell\AutoRun\command D:\SETUP.EXE -- End of Deckard's System Scanner: finished at 2007-05-15 at 21:02:50 ---------

**Posty:** 18165 · przez **wojtas** 16 Maj 2007, 12:24

andig napisał(a):Ten Kerio, to jest mi niezbędny, czy może mogę go nie mieć ??

jak chcesz jest to firewall ktory blokuje rozne smieci

skasuj:

R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O17 - HKLM\System\CCS\Services\Tcpip\..\{442584D8-2591-414A-8BC1-556222A46283}: NameServer = 85.255.116.130 85.255.112.20

oraz ten plik:

C:\WINDOWS\system32\tmp.reg

logo do sprawdzenia ( zawiesza się komp )

logo do sprawdzenia ( zawiesza się komp )

Kto jest na forum