M3plugin.dll błąd

**Posty:** 7 · przez **aaab** 08 Wrz 2008, 19:49

Po usunięciu zawirusowanego pliku przy uruchamianiu komputera zaczął wyskakiwać komunikat "Wystąpił błąd podczas ładowania C:\PROGRA~1\MYWEBS~1\bar\2.bin\M3PLUGIN.DLL
Nie można odnaleźć określonego modułu." Poniżej wklejam loga z HijackThis. Proszę o pomoc, o można z tym zrobić ?

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 17:47:00, on 2008-09-08 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16705) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\Ati2evxx.exe D:\aawservice.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe C:\Program Files\HP\HP Software Update\HPWuSchd2.exe C:\WINDOWS\SOUNDMAN.EXE C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe D:\MM for psp\qttask.exe C:\WINDOWS\system32\rundll32.exe C:\Program Files\Winamp\winampa.exe C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\DAEMON Tools Lite\daemon.exe D:\UniSpiker-2.6\uni_spiker-2.6.exe C:\WINDOWS\system32\wuauclt.exe D:\Mozilla\firefox.exe C:\Program Files\Java\jre1.6.0_05\bin\jucheck.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.onet.pl/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - D:\Internet Download Manager\IDMIECC.dll O2 - BHO: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files\HP\Smart Web Printing\hpswp_printenhancer.dll O2 - BHO: HP Print Clips - {053F9267-DC04-4294-A72C-58F732D338C0} - C:\Program Files\HP\Smart Web Printing\hpswp_framework.dll O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll O2 - BHO: IEVkbdBHO - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\ievkbd.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O3 - Toolbar: DAEMON Tools Toolbar - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [Onet.pl AutoUpdate] C:\Program Files\Common Files\Onet.pl\AutoUpdate.exe /tsr O4 - HKLM\..\Run: [NBKeyScan] "D:\nero\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup O4 - HKLM\..\Run: [QuickTime Task] "D:\MM for psp\qttask.exe" -atboottime O4 - HKLM\..\Run: [Metin2] C:\Metin2.exe O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "D:\Adobe Reader\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [MyWebSearch Plugin] rundll32 C:\PROGRA~1\MYWEBS~1\bar\2.bin\M3PLUGIN.DLL,UPF O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe" O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe" O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" ASO-616B5711-6DAE-4795-A05F-39A1E5104020 O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun O4 - HKCU\..\Run: [Livestation] D:\Livestation\AppStart.exe -systemstartup O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Startup: Registration Prince of Persia T2T.LNK = D:\Prince of Persia Dwa Trony\Support\Register\RegistrationReminder.exe O4 - Startup: UniSpiker-2.6.lnk = ? O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra button: Statystyki ochrony WWW - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\SCIEPlgn.dll O9 - Extra button: Kolekcja wycinków HP - {58ECB495-38F0-49cb-A538-10282ABF65E7} - C:\Program Files\HP\Smart Web Printing\hpswp_extensions.dll O9 - Extra button: Zaznaczanie HP Smart - {700259D7-1666-479a-93B1-3250410481E8} - C:\Program Files\HP\Smart Web Printing\hpswp_extensions.dll O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {92ECE6FA-AC2E-4042-BFAE-0C8608E52A43} (SignActivX Control) - https://www.bph.pl/pi/components/SignActivX.cab O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O20 - AppInit_DLLs: C:\program,files\permissionresearch\prai.dll,C:\program,files\permissionresearch\prai.dll,C:\program,files\permissionresearch\prai.dll,C:\program,files\permissionresearch\prai.dll,C:\program files\permissionresearch\prai.dll,C:\PROGRA~1\KASPER~1\KASPER~1\mzvkbd.dll O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - D:\aawservice.exe O23 - Service: Ares Chatroom server (AresChatServer) - Unknown owner - D:\Dysk Mateusza\Nowy folder\Ares\chatServer.exe (file missing) O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: Kaspersky Anti-Virus (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe O23 - Service: ForceWare Intelligent Application Manager (IAM) - Unknown owner - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe O23 - Service: Forceware Web Interface (ForcewareWebInterface) - Apache Software Foundation - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe O23 - Service: GoogleDesktopManager - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: ForceWare IP service (nSvcIp) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe O23 - Service: ForceWare user log service (nSvcLog) - NVIDIA - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe -- End of file - 9050 bytes

**Posty:** 684 · przez **djarta** 08 Wrz 2008, 20:03

O4 - HKLM\..\Run: [MyWebSearch Plugin] rundll32 C:\PROGRA~1\MYWEBS~1\bar\2.bin\M3PLUGIN.DLL,UPF

>>Hijack>>scan(Do a system scan only)>>zaznacz>>Fix checked

Ściągnij -----> ComboFixa,przeskanuj daj log.

=========================================
K.

**Posty:** 7 · przez **aaab** 11 Wrz 2008, 18:49

Proszę, poniżej log z ComboFixa

Kod: Zaznacz wszystko: ComboFix 08-09-10.04 - mati 2008-09-11 16:47:53.2 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.593 [GMT 2:00] Uruchomiony z: D:\Download z IDM\ComboFix2.exe * Utworzono nowy punkt przywracania [color=red][b]UWAGA - TEN KOMPUTER NIE MA ZAINSTALOWANEJ KONSOLI ODZYSKIWANIA !![/b][/color] . ((((((((((((((((((((((((( Pliki utworzone od 2008-08-11 do 2008-09-11 ))))))))))))))))))))))))))))))) . 2008-09-10 17:14 . 2008-09-10 17:14 <DIR> d-------- C:\Program Files\Pocket Tanks 2008-09-10 17:08 . 2008-09-10 17:08 <DIR> d-------- C:\Program Files\ivo 2008-09-10 16:26 . 2008-09-10 16:27 <DIR> d-------- C:\ComboFix 2008-09-09 13:01 . 2008-09-10 16:23 23 --a------ C:\WINDOWS\BlendSettings.ini 2008-09-07 18:25 . 2008-09-07 18:25 <DIR> d-------- C:\Program Files\Trend Micro 2008-09-04 14:10 . 2008-09-04 14:10 54,156 --ah----- C:\WINDOWS\QTFont.qfn 2008-09-04 14:10 . 2008-09-04 14:10 1,409 --a------ C:\WINDOWS\QTFont.for 2008-09-04 12:29 . 2008-09-04 12:29 <DIR> d-------- C:\Documents and Settings\mati\Dane aplikacji\Songbird2 2008-09-04 12:29 . 2008-09-04 12:31 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\SongbirdVLC 2008-09-04 12:24 . 2008-09-04 12:25 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Lavasoft 2008-09-04 12:23 . 2008-09-04 12:23 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard 2008-09-01 09:56 . 2008-09-01 09:56 <DIR> d-------- C:\WINDOWS\system32\NtmsData 2008-08-29 13:00 . 2008-08-29 13:05 817 --a------ C:\WINDOWS\unins000.dat 2008-08-28 19:35 . 2008-08-28 19:35 <DIR> d-------- C:\Documents and Settings\mati\Dane aplikacji\SuperMemo World 2008-08-28 19:34 . 2008-08-28 19:35 <DIR> d-------- C:\Program Files\SuperMemo UX 2008-08-28 13:05 . 2008-08-28 15:50 <DIR> d-------- C:\Downloads 2008-08-28 12:37 . 2008-08-31 14:21 <DIR> d-------- C:\Program Files\Software Informer 2008-08-27 13:36 . 2008-09-08 17:39 <DIR> d-------- C:\Program Files\TotalGaming 2008-08-26 08:22 . 2008-08-31 14:18 <DIR> d-------- C:\Program Files\Pekka Kana 2 2008-08-26 07:55 . 2008-08-26 07:55 <DIR> d-------- C:\Program Files\SystemRequirementsLab 2008-08-26 07:55 . 2008-08-26 07:55 <DIR> d-------- C:\Documents and Settings\mati\SystemRequirementsLab 2008-08-26 07:52 . 2008-09-04 12:21 <DIR> d-------- C:\Program Files\Gish demo 2008-08-24 17:39 . 2008-08-24 17:39 <DIR> d-------- C:\Program Files\Pivot Stickfigure Animator 2008-08-24 15:53 . 2008-08-24 15:53 <DIR> d-------- C:\Program Files\QuickTime 2008-08-24 15:53 . 1998-07-30 14:54 2,123,776 --a------ C:\WINDOWS\system32\QuickTimeMusicalInstruments.qtx 2008-08-24 15:53 . 1998-03-20 12:00 969,216 --a------ C:\WINDOWS\system32\qd3d.dll 2008-08-24 15:53 . 1998-03-26 16:00 747,008 --a------ C:\WINDOWS\system32\Indeo4.qtx 2008-08-24 15:53 . 1998-03-20 12:00 596,992 --a------ C:\WINDOWS\system32\rave.dll 2008-08-24 15:53 . 1998-03-20 13:01 299,008 --a------ C:\WINDOWS\uninst.exe 2008-08-24 15:53 . 1998-03-20 12:00 253,952 --a------ C:\WINDOWS\system32\QD3D_IR2.q3x 2008-08-24 15:53 . 1998-07-30 14:54 202,240 --a------ C:\WINDOWS\system32\QuickTime.cpl 2008-08-24 15:53 . 1998-03-20 12:00 126,976 --a------ C:\WINDOWS\system32\3DViewer.dll 2008-08-24 15:53 . 1998-03-20 12:00 44,032 --a------ C:\WINDOWS\system32\QD3DCustomElements.q3x 2008-08-24 15:53 . 1998-07-30 14:53 27,136 --a------ C:\WINDOWS\system32\QTUninst.dll 2008-08-24 15:52 . 2008-08-24 15:52 <DIR> d-------- C:\Documents and Settings\mati\WINDOWS 2008-08-24 15:51 . 2008-08-24 15:53 <DIR> d-------- C:\Program Files\Virtual Look Twoje Nowe Oblicze 2008-08-24 12:02 . 2008-08-31 12:34 <DIR> d-------- C:\Documents and Settings\mati\Dane aplikacji\SPORE Creature Creator 2008-08-24 12:00 . 2008-08-29 13:24 1,892 --a------ C:\WINDOWS\system32\ealregsnapshot1.reg 2008-08-24 11:59 . 2008-08-29 13:24 <DIR> d-------- C:\Program Files\Electronic Arts 2008-08-23 16:40 . 2008-08-23 16:51 96,976 --a------ C:\WINDOWS\system32\drivers\klin.dat 2008-08-23 16:40 . 2008-08-23 16:51 87,855 --a------ C:\WINDOWS\system32\drivers\klick.dat 2008-08-23 16:39 . 2008-08-23 16:39 <DIR> d-------- C:\Program Files\Kaspersky Lab 2008-08-23 16:39 . 2008-08-30 14:55 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab 2008-08-23 16:39 . 2008-09-10 17:21 1,720,352 --ahs---- C:\WINDOWS\system32\drivers\fidbox.dat 2008-08-23 16:39 . 2008-09-10 17:21 368,672 --ahs---- C:\WINDOWS\system32\drivers\fidbox2.dat 2008-08-23 16:39 . 2008-09-10 17:21 15,568 --ahs---- C:\WINDOWS\system32\drivers\fidbox.idx 2008-08-23 16:39 . 2008-09-10 17:21 3,388 --ahs---- C:\WINDOWS\system32\drivers\fidbox2.idx 2008-08-23 16:34 . 2008-08-23 16:34 <DIR> d-------- C:\Documents and Settings\mati\Dane aplikacji\Ashampoo 2008-08-23 16:29 . 2008-08-23 16:29 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\ashampoo 2008-08-23 16:28 . 2008-08-23 16:28 <DIR> d-------- C:\Tapety 2008-08-23 16:25 . 2008-08-23 16:25 <DIR> d-------- C:\Program Files\DAEMON Tools Toolbar 2008-08-23 16:25 . 2008-08-23 16:25 <DIR> d-------- C:\Program Files\DAEMON Tools Lite 2008-08-23 16:23 . 2008-08-23 16:23 <DIR> d-------- C:\Documents and Settings\mati\Dane aplikacji\DAEMON Tools 2008-08-23 16:23 . 2008-08-23 16:23 717,296 --a------ C:\WINDOWS\system32\drivers\sptd.sys 2008-08-23 08:18 . 2008-08-23 08:18 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\PassMark 2008-08-23 07:37 . 2008-08-23 07:37 <DIR> d-------- C:\Program Files\Common Files\NSV 2008-08-23 07:13 . 2008-08-23 07:13 <DIR> d-------- C:\Program Files\Winamp 2008-08-23 07:13 . 2008-08-28 12:57 <DIR> d-------- C:\Documents and Settings\mati\Dane aplikacji\Winamp 2008-08-23 07:10 . 2008-08-23 07:10 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab Setup Files . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-09-09 10:49 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-09-09 10:46 --------- d-----w C:\Documents and Settings\mati\Dane aplikacji\DMCache 2008-09-05 04:25 --------- d-----w C:\Documents and Settings\mati\Dane aplikacji\uTorrent 2008-08-29 11:49 --------- d-----w C:\Documents and Settings\mati\Dane aplikacji\IDM 2008-08-29 11:05 72,748 ----a-w C:\WINDOWS\unins000.exe 2008-08-24 10:02 107,888 ----a-w C:\WINDOWS\system32\CmdLineExt.dll 2008-08-23 05:04 --------- d---a-w C:\Documents and Settings\All Users\Dane aplikacji\TEMP 2008-08-01 16:57 --------- d-----w C:\Documents and Settings\mati\Dane aplikacji\Moyea 2008-08-01 08:15 23 ----a-w C:\Documents and Settings\mati\jagex_runescape_preferences.dat 2008-07-28 14:22 --------- d-----w C:\Program Files\Sony 2008-07-28 14:22 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Sony Corporation 2008-07-27 12:31 --------- d-----w C:\Program Files\Google 2008-07-27 11:53 --------- d-----w C:\Documents and Settings\mati\Dane aplikacji\Skype 2008-07-27 11:34 --------- d-----w C:\Documents and Settings\mati\Dane aplikacji\skypePM 2008-07-26 18:32 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Sony 2008-07-26 18:25 --------- d-----w C:\Program Files\Common Files\Nero 2008-07-26 18:25 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Nero 2008-07-26 18:11 --------- d-----w C:\Documents and Settings\mati\Dane aplikacji\Flock 2008-07-25 07:29 --------- d-----w C:\Documents and Settings\mati\Dane aplikacji\SecondLife 2008-07-24 18:08 0 ----a-w C:\bootfnot.dat 2008-07-24 13:52 --------- d-----w C:\Program Files\uTorrent 2008-07-21 12:48 --------- d--h--r C:\Documents and Settings\mati\Dane aplikacji\SecuROM 2008-07-21 12:21 --------- d-----w C:\Program Files\EA SPORTS 2008-07-18 20:10 94,920 ----a-w C:\WINDOWS\system32\cdm.dll 2008-07-18 20:10 53,448 ----a-w C:\WINDOWS\system32\wuauclt.exe 2008-07-18 20:10 45,768 ----a-w C:\WINDOWS\system32\wups2.dll 2008-07-18 20:10 36,552 ----a-w C:\WINDOWS\system32\wups.dll 2008-07-18 20:09 563,912 ----a-w C:\WINDOWS\system32\wuapi.dll 2008-07-18 20:09 325,832 ----a-w C:\WINDOWS\system32\wucltui.dll 2008-07-18 20:09 205,000 ----a-w C:\WINDOWS\system32\wuweb.dll 2008-07-18 20:09 1,811,656 ----a-w C:\WINDOWS\system32\wuaueng.dll 2008-07-13 12:33 --------- d-----w C:\Program Files\Peter 2008-07-09 14:34 206,256 ----a-w C:\WINDOWS\system32\idmmbc.dll 2008-07-07 20:33 253,952 ----a-w C:\WINDOWS\system32\es.dll 2008-06-24 16:24 74,240 ----a-w C:\WINDOWS\system32\mscms.dll 2008-06-23 16:42 826,368 ----a-w C:\WINDOWS\system32\wininet.dll 2008-06-20 17:42 246,784 ----a-w C:\WINDOWS\system32\mswsock.dll 2008-02-16 18:02 32 ----a-w C:\Documents and Settings\All Users\Dane aplikacji\ezsid.dat . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 15360] "DAEMON Tools Lite"="C:\Program Files\DAEMON Tools Lite\daemon.exe" [2008-07-24 490952] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2007-03-11 49152] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 144784] "Google Desktop Search"="C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" [2008-04-13 1838592] "QuickTime Task"="D:\MM for psp\qttask.exe" [2008-06-21 282624] "Adobe Reader Speed Launcher"="D:\Adobe Reader\Reader\Reader_sl.exe" [2008-01-11 39792] "WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2008-07-09 36352] "SoundMan"="SOUNDMAN.EXE" [2004-12-01 C:\WINDOWS\SOUNDMAN.EXE] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 15360] "Nokia.PCSync"="D:\Nokia\Nokia PC Suite 6\PcSync2.exe" [2007-11-07 1294336] C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\ Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office\OSA9.EXE [1999-02-17 65588] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "VIDC.YV12"= yv12vfw.dll "msacm.dvacm"= C:\PROGRA~1\COMMON~1\ULEADS~1\Vio\Dvacm.acm [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^HP Digital Imaging Monitor.lnk] path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\HP Digital Imaging Monitor.lnk backup=C:\WINDOWS\pss\HP Digital Imaging Monitor.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nTrayFw] --a------ 2005-12-21 12:52 270336 C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nTrayFw.exe [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusOverride"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) "DisableNotifications"= 1 (0x1) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "C:\\Program Files\\NVIDIA Corporation\\NetworkAccessManager\\Apache Group\\Apache2\\bin\\Apache.exe"= "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"= "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"= "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"= "C:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"= "C:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"= "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"= "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"= "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"= "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"= "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"= "D:\\gry\\Dysk Mateusza\\Metin\\metin2.bin"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "C:\\Program Files\\Gadu-Gadu\\gg.exe"= "C:\\Program Files\\Mozilla Firefox\\firefox.exe"= "C:\\Program Files\\Skype\\Phone\\Skype.exe"= "D:\\gry\\Dysk Mateusza\\Metin\\metin2.exe"= "C:\\Program Files\\uTorrent\\uTorrent.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009 R0 klbg;Kaspersky Lab Boot Guard Driver;C:\WINDOWS\system32\drivers\klbg.sys [2008-01-29 32784] R0 sfdrv01a;StarForce Protection Environment Driver (version 1.x.a);C:\WINDOWS\system32\drivers\sfdrv01a.sys [2006-07-05 63352] R3 klim5;Kaspersky Anti-Virus NDIS Filter;C:\WINDOWS\system32\DRIVERS\klim5.sys [2008-03-25 24592] S3 SetupNTGLM7X;SetupNTGLM7X;E:\NTGLM7X.sys [ ] S3 Tihid;Tihid;C:\WINDOWS\system32\drivers\Tihid.sys [2005-09-06 4505] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12 hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{fcd484ac-e499-11dc-9d4c-001109d3c9cf}] \Shell\AutoRun\command - F:\DTE_Privacy_launcher.exe . . ------- Skan uzupełniający ------- . FireFox -: Profile - C:\Documents and Settings\mati\Dane aplikacji\Mozilla\Firefox\Profiles\r9sc2706.default\ FF -: plugin - D:\Adobe Reader\Reader\browser\nppdf32.dll FF -: plugin - D:\MM for psp\Plugins\npqtplugin.dll FF -: plugin - D:\MM for psp\Plugins\npqtplugin2.dll FF -: plugin - D:\MM for psp\Plugins\npqtplugin3.dll FF -: plugin - D:\MM for psp\Plugins\npqtplugin4.dll FF -: plugin - D:\MM for psp\Plugins\npqtplugin5.dll FF -: plugin - D:\MM for psp\Plugins\npqtplugin6.dll FF -: plugin - D:\MM for psp\Plugins\npqtplugin7.dll FF -: plugin - D:\Mozilla\plugins\npnul32.dll FF -: plugin - D:\Mozilla\plugins\nppdf32.dll . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-09-11 16:48:58 Windows 5.1.2600 Dodatek Service Pack 2 NTFS skanowanie ukrytych procesów ... skanowanie ukrytych wpisów autostartu ... skanowanie ukrytych plików ... skanowanie pomyślnie ukończone ukryte pliki: 0 ************************************************************************** . Czas ukończenia: 2008-09-11 16:50:08 ComboFix-quarantined-files.txt 2008-09-11 14:50:00 ComboFix2.txt 2008-09-10 14:36:11 Przed: 9,185,169,408 bajt˘w wolnych Po: 9,318,912,000 bajt˘w wolnych 209 --- E O F --- 2008-09-10 09:05:44

**Posty:** 684 · przez **djarta** 12 Wrz 2008, 17:37

Log jest chyba czysty. Napisałem "chyba" bo nie wiem co to jest :

S3 Tihid;Tihid;C:\WINDOWS\system32\drivers\Tihid.sys

.

Wykonaj to co jest podane w tym temacie (jeśli wykonałeś/łaś to wcześniej to nie rób tego).

Usuń ręcznie folder C:\Qoobox,

Usuń instalkę ComboFix z dysku.

Wykonaj optymalizację autostartu

Przeczyść komputer ATF-Cleaner

Wyłącz i włącz przywracanie systemu na wszystkich dyskach.Instrukcja

Przeskanuj obszar mojego komputera http://www.kaspersky.pl/virusscanner.html (uruchom przez IE) Daj raport z niego na forum.

i tym:

FixIEDef.

=============================
K.

Autor postu otrzymał pochwałę

**Posty:** 7 · przez **aaab** 15 Wrz 2008, 08:15

Dzięki djarta nie mam już błędów ode mnie masz pochwałę

**Posty:** 7 · przez **aaab** 05 Gru 2008, 18:24

Cześć to znowu ja... mam ten sam problem tylko że zamiast m3plugin.dll wyskakuje ftlib.dll. Poniżej log z hijack this:

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 16:21:48, on 2008-12-05 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16735) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe D:\aawservice.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\Program Files\HP\HP Software Update\HPWuSchd2.exe C:\WINDOWS\SOUNDMAN.EXE C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe D:\MM for psp\qttask.exe D:\Adobe Reader\Reader\Reader_sl.exe C:\Program Files\Winamp\winampa.exe C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\WINDOWS\system32\RUNDLL32.EXE C:\WINDOWS\system32\ctfmon.exe C:\Program Files\DAEMON Tools Lite\daemon.exe C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe D:\ipla\ipla.exe C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe C:\Program Files\uTorrent\uTorrent.exe D:\cryptload i usd\USDownloader.exe D:\yodm3d\Yodm3D.exe D:\Mozilla\firefox.exe C:\Documents and Settings\mati\Ustawienia lokalne\Dane aplikacji\Google\Update\GoogleUpdate.exe D:\UniSpiker-2.6\uni_spiker-2.6.exe C:\WINDOWS\system32\wuauclt.exe C:\Program Files\PC Connectivity Solution\ServiceLayer.exe C:\Program Files\PC Connectivity Solution\Transports\NclUSBSrv.exe C:\Program Files\PC Connectivity Solution\Transports\NclRSSrv.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.onet.pl/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file) O2 - BHO: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files\HP\Smart Web Printing\hpswp_printenhancer.dll O2 - BHO: HP Print Clips - {053F9267-DC04-4294-A72C-58F732D338C0} - C:\Program Files\HP\Smart Web Printing\hpswp_framework.dll O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: IEVkbdBHO Class - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\ievkbd.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O2 - BHO: WinAVI FLVSense - {E8DF67A1-B618-4F3F-9E7C-CBE175ADEF5B} - C:\Program Files\WinAVI FLV Converter\FLVTune.dll O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup O4 - HKLM\..\Run: [QuickTime Task] "D:\MM for psp\qttask.exe" -atboottime O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "D:\Adobe Reader\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe" O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe" O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe O4 - HKCU\..\Run: [IPLA!] D:\ipla\ipla.exe /autorun O4 - HKCU\..\Run: [uTorrent] "C:\Program Files\uTorrent\uTorrent.exe" O4 - HKCU\..\Run: [USDownloader] "D:\cryptload i usd\USDownloader.exe" O4 - HKCU\..\Run: [Yodm3D] D:\yodm3d\Yodm3D.exe O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\mati\Ustawienia lokalne\Dane aplikacji\Google\Update\GoogleUpdate.exe" /c O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Startup: Registration Prince of Persia T2T.LNK = D:\Prince of Persia Dwa Trony\Support\Register\RegistrationReminder.exe O4 - Startup: UniSpiker-2.6.lnk = ? O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE O8 - Extra context menu item: &Clean Traces - D:\DAP\DAP\Privacy Package\dapcleanerie.htm O8 - Extra context menu item: &Download FLV by WinAVI... - C:\Program Files\WinAVI FLV Converter\flv_link.htm O8 - Extra context menu item: &Download with &DAP - D:\DAP\DAP\dapextie.htm O8 - Extra context menu item: Download &all with DAP - D:\DAP\DAP\dapextie2.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra button: Statystyki ochrony WWW - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\SCIEPlgn.dll O9 - Extra button: Kolekcja wycinków HP - {58ECB495-38F0-49cb-A538-10282ABF65E7} - C:\Program Files\HP\Smart Web Printing\hpswp_extensions.dll O9 - Extra button: Zaznaczanie HP Smart - {700259D7-1666-479a-93B1-3250410481E8} - C:\Program Files\HP\Smart Web Printing\hpswp_extensions.dll O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll O9 - Extra button: WinAVI FLV Manager - {DE365254-2F9B-4908-9E3A-7AAA6EC90BCC} - C:\Program Files\WinAVI FLV Converter\FLVTune.dll O9 - Extra 'Tools' menuitem: WinAVI FLV Manager - {DE365254-2F9B-4908-9E3A-7AAA6EC90BCC} - C:\Program Files\WinAVI FLV Converter\FLVTune.dll O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll O16 - DPF: {92ECE6FA-AC2E-4042-BFAE-0C8608E52A43} (SignActivX Control) - https://www.bph.pl/pi/components/SignActivX.cab O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - D:\aawservice.exe O23 - Service: Ares Chatroom server (AresChatServer) - Unknown owner - D:\Dysk Mateusza\Nowy folder\Ares\chatServer.exe (file missing) O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe O23 - Service: Kaspersky Anti-Virus (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe O23 - Service: ForceWare Intelligent Application Manager (IAM) - Unknown owner - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe O23 - Service: Forceware Web Interface (ForcewareWebInterface) - Apache Software Foundation - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe O23 - Service: Google Desktop Manager 5.7.806.10245 (GoogleDesktopManager-061008-081103) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: ForceWare IP service (nSvcIp) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe O23 - Service: ForceWare user log service (nSvcLog) - NVIDIA - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe -- End of file - 11122 bytes

**Posty:** 684 · przez **djarta** 05 Gru 2008, 18:29

W tym logu nie widać żadnej infekcji.

Podeślij loga z ComboFixa.

=====================
K.

**Posty:** 7 · przez **aaab** 05 Gru 2008, 20:02

oto log:

Kod: Zaznacz wszystko: ComboFix 08-12-05.01 - mati 2008-12-05 17:51:34.3 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.513 [GMT 1:00] Uruchomiony z: d:\download z idm\ComboFix2.exe . ((((((((((((((((((((((((((((((((((((((( Usunięto ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\windows\system32\vxblock.dll . ((((((((((((((((((((((((( Pliki utworzone od 2008-11-05 do 2008-12-05 ))))))))))))))))))))))))))))))) . 2008-12-05 16:40 . 2008-12-05 16:40 <DIR> d-------- c:\documents and settings\mati\Dane aplikacji\Ubisoft 2008-12-05 16:39 . 2008-12-05 16:39 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\Ubisoft 2008-12-05 16:26 . 2008-12-05 16:26 <DIR> d-------- c:\documents and settings\mati\Dane aplikacji\InstallShield 2008-12-04 18:11 . 2008-12-04 18:34 <DIR> d-------- c:\windows\system32\pl 2008-12-04 18:11 . 2008-12-04 18:34 <DIR> d-------- c:\windows\system32\bits 2008-12-04 18:11 . 2008-12-04 18:34 <DIR> d-------- c:\windows\l2schemas 2008-12-04 18:05 . 2007-10-25 17:44 8,488,960 --a------ c:\windows\system32\dllcache\shell32.dll 2008-12-04 17:47 . 2008-12-04 17:47 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\nView_Profiles 2008-12-04 15:06 . 2008-12-05 17:56 186,097 --a------ c:\windows\system32\nvapps.xml 2008-12-04 15:05 . 2008-12-04 15:05 <DIR> d-------- c:\windows\nview 2008-12-04 15:05 . 2008-05-16 19:31 446,464 --a------ c:\windows\system32\nvudisp.exe 2008-12-04 15:05 . 2008-05-16 19:31 18,070 --a------ c:\windows\system32\nvdisp.nvu 2008-12-04 15:03 . 2008-12-04 15:03 664 --a------ c:\windows\system32\d3d9caps.dat 2008-12-04 14:43 . 2008-12-04 14:43 10 --a------ c:\windows\WININIT.INI 2008-12-02 17:27 . 2008-08-08 07:04 545 --a------ c:\windows\UC.PIF 2008-12-02 17:27 . 2008-08-08 07:04 545 --a------ c:\windows\RAR.PIF 2008-12-02 17:27 . 2008-08-08 07:04 545 --a------ c:\windows\PKZIP.PIF 2008-12-02 17:27 . 2008-08-08 07:04 545 --a------ c:\windows\PKUNZIP.PIF 2008-12-02 17:27 . 2008-08-08 07:04 545 --a------ c:\windows\NOCLOSE.PIF 2008-12-02 17:27 . 2008-08-08 07:04 545 --a------ c:\windows\LHA.PIF 2008-12-02 17:27 . 2008-08-08 07:04 545 --a------ c:\windows\ARJ.PIF 2008-12-02 17:27 . 2008-12-05 17:12 501 --a------ c:\windows\wincmd.ini 2008-11-29 10:24 . 2008-12-02 16:58 <DIR> d-------- c:\documents and settings\mati\Dane aplikacji\GetRight 2008-11-19 15:51 . 2008-11-19 15:51 <DIR> d-------- c:\program files\VS Revo Group 2008-11-18 13:19 . 2008-12-05 17:41 168 --a------ c:\windows\usdthank.ini 2008-11-18 13:19 . 2008-11-18 13:19 31 --a------ c:\windows\idc.ini 2008-11-13 14:19 . 2008-10-24 12:10 453,632 --a------ c:\windows\system32\drivers\mrxsmb.sys 2008-11-08 18:40 . 2008-11-08 18:40 <DIR> d-------- c:\program files\Alwil Software . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-12-05 16:57 --------- d-----w c:\documents and settings\mati\Dane aplikacji\uTorrent 2008-12-05 16:55 507,936 --sha-w c:\windows\system32\drivers\fidbox2.dat 2008-12-05 16:55 3,864 --sha-w c:\windows\system32\drivers\fidbox2.idx 2008-12-05 16:55 15,568 --sha-w c:\windows\system32\drivers\fidbox.idx 2008-12-05 16:55 1,720,352 --sha-w c:\windows\system32\drivers\fidbox.dat 2008-12-05 15:27 --------- d--h--w c:\program files\InstallShield Installation Information 2008-12-05 14:33 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\ipla 2008-12-04 17:22 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\Kaspersky Lab 2008-12-04 08:42 --------- d-----w c:\documents and settings\mati\Dane aplikacji\ipla 2008-11-18 12:04 --------- d-----w c:\program files\Common Files\DVDVideoSoft 2008-11-16 18:14 30 ----a-w c:\documents and settings\mati\jagex_runescape_preferences.dat 2008-11-11 08:30 --------- d---a-w c:\documents and settings\All Users\Dane aplikacji\TEMP 2008-11-07 16:44 --------- d-----w c:\program files\Java 2008-11-03 06:16 --------- d-----w c:\program files\WinAVI FLV Converter 2008-10-30 15:03 --------- d-----w c:\program files\Cucusoft 2008-10-30 14:58 --------- d-----w c:\documents and settings\mati\Dane aplikacji\Moyea 2008-10-30 14:50 --------- d-----w c:\documents and settings\mati\Dane aplikacji\WinAVI 2008-10-27 18:30 --------- d-----w c:\program files\Wru 2008-10-27 18:30 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\Wru 2008-10-24 14:12 --------- d-----w c:\documents and settings\mati\Dane aplikacji\gtk-2.0 2008-10-16 13:13 202,776 ----a-w c:\windows\system32\wuweb.dll 2008-10-16 13:13 1,809,944 ----a-w c:\windows\system32\wuaueng.dll 2008-10-16 13:12 561,688 ----a-w c:\windows\system32\wuapi.dll 2008-10-16 13:12 323,608 ----a-w c:\windows\system32\wucltui.dll 2008-10-16 13:09 92,696 ----a-w c:\windows\system32\cdm.dll 2008-10-16 13:09 51,224 ----a-w c:\windows\system32\wuauclt.exe 2008-10-16 13:09 43,544 ----a-w c:\windows\system32\wups2.dll 2008-10-16 13:08 34,328 ----a-w c:\windows\system32\wups.dll 2008-10-02 23:46 81,920 ----a-w c:\windows\system32\frapsvid.dll 2008-09-30 15:43 1,286,152 ----a-w c:\windows\system32\msxml4.dll 2008-09-25 12:13 50,688 ----a-w c:\windows\system32\wbhelp2.dll 2008-09-15 15:40 1,846,272 ----a-w c:\windows\system32\win32k.sys 2008-09-12 10:44 206,256 ----a-w c:\windows\system32\idmmbc.dll 2008-02-16 18:02 32 ----a-w c:\documents and settings\All Users\Dane aplikacji\ezsid.dat . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360] "DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\daemon.exe" [2008-07-24 490952] "SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2008-08-18 1832272] "IPLA!"="d:\ipla\ipla.exe" [2008-12-05 2732280] "uTorrent"="c:\program files\uTorrent\uTorrent.exe" [2008-10-27 270128] "USDownloader"="d:\cryptload i usd\USDownloader.exe" [2008-09-16 529920] "Yodm3D"="d:\yodm3d\Yodm3D.exe" [2007-04-21 2343936] "Google Update"="c:\documents and settings\mati\Ustawienia lokalne\Dane aplikacji\Google\Update\GoogleUpdate.exe" [2008-12-01 133104] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2007-03-11 49152] "SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784] "Google Desktop Search"="c:\program files\Google\Google Desktop Search\GoogleDesktop.exe" [2008-09-11 29744] "QuickTime Task"="d:\mm for psp\qttask.exe" [2008-06-21 282624] "Adobe Reader Speed Launcher"="d:\adobe reader\Reader\Reader_sl.exe" [2008-01-11 39792] "WinampAgent"="c:\program files\Winamp\winampa.exe" [2008-08-04 36352] "avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2008-07-19 78008] "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-05-16 86016] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-05-16 13529088] "SoundMan"="SOUNDMAN.EXE" [2004-12-01 c:\windows\SOUNDMAN.EXE] "nwiz"="nwiz.exe" [2008-05-16 c:\windows\system32\nwiz.exe] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-04 15360] "Nokia.PCSync"="d:\nokia\Nokia PC Suite 6\PcSync2.exe" [2007-11-07 1294336] c:\documents and settings\mati\Menu Start\Programy\Autostart\ Registration Assassin's Creed.LNK - d:\assassins\Register\RegistrationReminder.exe [2008-12-05 967304] c:\documents and settings\All Users\Menu Start\Programy\Autostart\ Microsoft Office.lnk - c:\program files\Microsoft Office\Office\OSA9.EXE [1999-02-17 65588] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "msacm.dvacm"= c:\progra~1\COMMON~1\ULEADS~1\Vio\Dvacm.acm [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^HP Digital Imaging Monitor.lnk] path=c:\documents and settings\All Users\Menu Start\Programy\Autostart\HP Digital Imaging Monitor.lnk backup=c:\windows\pss\HP Digital Imaging Monitor.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nTrayFw] --a------ 2005-12-21 11:52 270336 c:\program files\NVIDIA Corporation\NetworkAccessManager\bin\nTrayFw.exe [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusOverride"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "DisableNotifications"= 1 (0x1) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\NVIDIA Corporation\\NetworkAccessManager\\Apache Group\\Apache2\\bin\\Apache.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"= "d:\\gry\\Dysk Mateusza\\Metin\\metin2.bin"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "c:\\Program Files\\Gadu-Gadu\\gg.exe"= "c:\\Program Files\\Mozilla Firefox\\firefox.exe"= "c:\\Program Files\\Skype\\Phone\\Skype.exe"= "d:\\gry\\Dysk Mateusza\\Metin\\metin2.exe"= "c:\\Program Files\\uTorrent\\uTorrent.exe"= "d:\\assassins\\AssassinsCreed_Dx9.exe"= "d:\\assassins\\AssassinsCreed_Dx10.exe"= "d:\\assassins\\AssassinsCreed_Launcher.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009 R0 klbg;Kaspersky Lab Boot Guard Driver;c:\windows\system32\drivers\klbg.sys [2008-01-29 32784] R0 sfdrv01a;StarForce Protection Environment Driver (version 1.x.a);c:\windows\system32\drivers\sfdrv01a.sys [2006-07-05 63352] R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2008-11-09 78416] R2 aswFsBlk;aswFsBlk;c:\windows\system32\DRIVERS\aswFsBlk.sys [2008-11-09 20560] R3 klim5;Kaspersky Anti-Virus NDIS Filter;c:\windows\system32\DRIVERS\klim5.sys [2008-03-25 24592] S3 GoogleDesktopManager-061008-081103;Google Desktop Manager 5.7.806.10245;"c:\program files\Google\Google Desktop Search\GoogleDesktop.exe" [2008-04-13 29744] S3 SetupNTGLM7X;SetupNTGLM7X;\??\E:\NTGLM7X.sys [] S3 Tihid;Tihid;c:\windows\system32\drivers\Tihid.sys [2008-01-10 4505] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12 hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{fcd484ac-e499-11dc-9d4c-001109d3c9cf}] \Shell\AutoRun\command - F:\DTE_Privacy_launcher.exe . Zawartość folderu 'Zaplanowane zadania' 2008-12-04 c:\windows\Tasks\GoogleUpdateTaskUser.job - c:\documents and settings\mati\Ustawienia lokalne\Dane aplikacji\Google\Update\GoogleUpdate.exe [2008-12-01 16:21] . - - - - USUNIĘTO PUSTE WPISY - - - - Notify-AtiExtEvent - (no file) Notify-dimsntfy - (no file) . ------- Skan uzupełniający ------- . uStart Page = hxxp://www.onet.pl/ uSearchURL,(Default) = hxxp://www.google.com/keyword/%s IE: &Clean Traces - d:\dap\DAP\Privacy Package\dapcleanerie.htm IE: &Download FLV by WinAVI... - c:\program files\WinAVI FLV Converter\flv_link.htm IE: &Download with &DAP - d:\dap\DAP\dapextie.htm IE: Download &all with DAP - d:\dap\DAP\dapextie2.htm IE: {DE365254-2F9B-4908-9E3A-7AAA6EC90BCC} - {EC83A912-7EF4-410D-9CC7-3BDAA709CA71} - c:\program files\WinAVI FLV Converter\FLVTune.dll LSP: %SYSTEMROOT%\system32\nvappfilter.dll Name-Space Handler: ftp\ZDA - {5BFA1DAF-5EDC-11D2-959E-00C00C02DA5E} - d:\dap\DAP\dapie.dll Name-Space Handler: http\ZDA - {5BFA1DAF-5EDC-11D2-959E-00C00C02DA5E} - d:\dap\DAP\dapie.dll c:\windows\Downloaded Program Files\SignActivX.ocx - O16 -: {92ECE6FA-AC2E-4042-BFAE-0C8608E52A43} hxxps://www.bph.pl/pi/components/SignActivX.cab FireFox -: Profile - c:\documents and settings\mati\Dane aplikacji\Mozilla\Firefox\Profiles\r9sc2706.default\ FireFox -: prefs.js - SEARCH.DEFAULTURL - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q= FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://www.google.pl/ig FF -: plugin - c:\documents and settings\All Users\Dane aplikacji\Zylom\ZylomGamesPlayer\npzylomgamesplayer.dll FF -: plugin - c:\documents and settings\mati\Ustawienia lokalne\Dane aplikacji\Google\Update\1.2.131.27\npGoogleOneClick6.dll FF -: plugin - c:\program files\Yahoo!\Common\npyaxmpb.dll FF -: plugin - d:\adobe reader\Reader\browser\nppdf32.dll FF -: plugin - d:\mm for psp\Plugins\npqtplugin.dll FF -: plugin - d:\mm for psp\Plugins\npqtplugin2.dll FF -: plugin - d:\mm for psp\Plugins\npqtplugin3.dll FF -: plugin - d:\mm for psp\Plugins\npqtplugin4.dll FF -: plugin - d:\mm for psp\Plugins\npqtplugin5.dll FF -: plugin - d:\mm for psp\Plugins\npqtplugin6.dll FF -: plugin - d:\mm for psp\Plugins\npqtplugin7.dll FF -: plugin - d:\mozilla\plugins\np-mswmp.dll FF -: plugin - d:\mozilla\plugins\npnul32.dll FF -: plugin - d:\mozilla\plugins\nppdf32.dll FF -: plugin - d:\opera\program\plugins\npdsplay.dll FF -: plugin - d:\opera\program\plugins\NPSWF32.dll FF -: plugin - d:\opera\program\plugins\npwmsdrm.dll . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-12-05 17:56:11 Windows 5.1.2600 Dodatek Service Pack 2 NTFS skanowanie ukrytych procesów ... skanowanie ukrytych wpisów autostartu ... skanowanie ukrytych plików ... c:\windows\TEMP\_avast4_\unp236324635.tmp 3031040 bytes executable skanowanie pomyślnie ukończone ukryte pliki: 1 ************************************************************************** . --------------------- Pliki DLL ładowane pod uruchomionymi procesami --------------------- - - - - - - - > 'winlogon.exe'(1460) c:\windows\system32\klogon.dll - - - - - - - > 'lsass.exe'(1516) c:\windows\system32\nvappfilter.dll . ------------------------ Pozostałe uruchomione procesy ------------------------ . D:\aawservice.exe c:\program files\Alwil Software\Avast4\aswUpdSv.exe c:\program files\Alwil Software\Avast4\ashServ.exe c:\program files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\Apache.exe c:\program files\Alwil Software\Avast4\ashDisp.exe c:\program files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe c:\program files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe c:\windows\system32\nvsvc32.exe c:\program files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\Apache.exe c:\program files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe c:\windows\system32\wdfmgr.exe c:\program files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe d:\unispiker-2.6\uni_spiker-2.6.exe c:\program files\Alwil Software\Avast4\ashMaiSv.exe c:\program files\Alwil Software\Avast4\ashWebSv.exe . ************************************************************************** . Czas ukończenia: 2008-12-05 17:59:56 - komputer został uruchomiony ponownie [mati] ComboFix-quarantined-files.txt 2008-12-05 16:59:48 ComboFix2.txt 2008-09-11 14:50:09 Przed: 5,703,262,208 bajtów wolnych Po: 6,011,813,888 bajtów wolnych 247 --- E O F --- 2008-12-05 06:36:32

**Posty:** 18165 · przez **wojtas** 05 Gru 2008, 20:33

Czysto, wykonaj:

1. Ściągnij OTMoveIt i go włacz i odpal go z opcji CleanUp

oraz skasuj folder C:\Qoobox
2. wykonaj optymalizację windowsa
3.sciagnij ATF_Cleaner
zaznacz
Windows Temp
All users Temp
Temporary internet files
Recycle Bin
i wcisnij EMPTY SELECTED
4.Wyłącz przywracanie systemu ( właściwości mój komputer-zakładka przywracanie - wyłącz przywracanie na wszystkich dyskach). Po chwili włącz je powrotem
5.Przeskanuj obszar mojego komputera http://www.kaspersky.pl/virusscanner.html (uruchom przez IE) Daj raport z niego na forum.

i tym:

FixIEDef.

**Posty:** 7 · przez **aaab** 06 Gru 2008, 14:51

Hmmm... to z kasperskiego nie dziala bo wyskakuje bląd ze mam zainstalowany na kompie kaspersky wersja 8. costam . probowalem odinstalowac i błąd : "Dezinstalacja zakończyła się przedwcześnie z powodu błędu. Ponieważ, dezinstalacja aplikacji nie została zakończona, zalecane jest ponowne uruchomienie komputera i uruchomienie programu instalacyjnego w celu przywrócenia działania aplikacji." zrobiłem to wszystko co pisało i sie nie odinstaluje wiec nie wkleje raportu. mam tylko loga z FixIEDef:

Kod: Zaznacz wszystko: ******************************************************************************** * * * FixIEDef Log * * Version 1.7.20.6860 * * * ******************************************************************************** Created at 12:25:48 on Saturday, December 06, 2008 Time Zone : Logged On User : [cenzura] Operating System : Microsoft Windows XP Professional Dodatek Service Pack 2 OS Version : 5.1.2600 System Langauge : Polish Keyboard Layout : Polish Processor : X86 AMD Athlon(tm) 64 Processor 3000+ System Drive : C:\ Windows Directory : C:\WINDOWS System Directory : C:\WINDOWS\system32 System Drive Type : Fixed System Drive Status : READY System Drive Label : System Drive Size : 20 GB System Drive Free : 7.51 GB Total Physical Memory: 1023 MB Free Physical Memory : 548 MB Total Page File : 1023 MB Free Page File : 2050 MB Total Virtual Memory : 2048 MB Free Virtual Memory : 1970 MB Boot State : Normal boot -------------------------------------------------------------------------------- !!! userinit.exe is Clean !!! -------------------------------------------------------------------------------- !!! Files that have been deleted !!! C:\WINDOWS\system32\_nvidia_xxx_.log C:\WINDOWS\system32\Help.ico C:\WINDOWS\system32\nmp.log C:\WINDOWS\system32\pavas.ico C:\WINDOWS\system32\Uninstall.ico -------------------------------------------------------------------------------- !!! Directories that have been removed !!! No malicious directories to be removed -------------------------------------------------------------------------------- !!! Registry entries that have been removed !!! No malicious Registry entries found ================================================================================ All Done :) ShadowPuterDude Safe Surfing!!!

**Posty:** 18165 · przez **wojtas** 06 Gru 2008, 18:29

nic wiecej nie widać złego