Nie działa menedżer urządzeń

**Posty:** 84 · przez **barto0o** 17 Maj 2009, 23:12

nie działa menedżer urządzeń, jak tez cześć aplikacji, wywala ze wirus albo bad sektory ale obstawiam to pierwsze...

log hjt

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 22:55:28, on 2009-05-17 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\svchost.exe C:\Program Files\D-Tools\daemon.exe C:\WINDOWS\system32\wuauclt.exe C:\WINDOWS\system32\cmd.execf D:\HiJackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza F2 - REG:system.ini: UserInit=userinit.exe, O2 - BHO: ActivationManager module - {86A44EF7-78FC-4e18-A564-B18F806F7F56} - C:\Program Files\ActivationManager\ActivationManager.dll (file missing) O3 - Toolbar: (no name) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - (no file) O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033 O4 - HKLM\..\Run: [Ad-Watch] C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O20 - Winlogon Notify: fsmgmt - C:\WINDOWS\SYSTEM32\fsmgmt.dll O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe -- End of file - 1817 bytes

nie wiem jak wrzucić combo bo za dużo znaków:/ więc:

http://odsiebie.com/pokaz/2908902---653d.html

**Posty:** 18165 · przez **wojtas** 18 Maj 2009, 08:10

jakis blad wyskakuje ??

poczytaj:

viewtopic.php?f=13&t=109661&p=833290#p833290

Pobierz OTListIt2 i daj z niego loga

**Posty:** 84 · przez **barto0o** 18 Maj 2009, 08:20

tak, wywala błąd że menadzer urządzeń został odinstalowany przez admina, a gdy klikam na ikonę aplikacji, wywala mi błąd w stylu na dysku są badsektory lub komputer jest zainfekowany wuirusem

**Posty:** 18165 · przez **wojtas** 18 Maj 2009, 11:57

daj screena z bledu. oraz loga tego co prosiłem

**Posty:** 84 · przez **barto0o** 18 Maj 2009, 12:17

ok, tylko teraz jestem w pracy wiec nie moge teraz tego wrzucić, a mozesz cos powiedzieć patrzac po logu z combo ???

**Posty:** 18165 · przez **wojtas** 18 Maj 2009, 12:21

cos tam pousuwał troche.. czekamy na poprawny log ;D)

**Posty:** 84 · przez **barto0o** 18 Maj 2009, 12:28

martwie sie bo wyczytałem że to jakiś złośliwy wirus o nazwie sality który jest niemal niemożliwy do wytępienia, możesz coś powiedzieć na ten temat???

**Posty:** 18165 · przez **wojtas** 18 Maj 2009, 14:01

tu mozesz sobie poczytac troche :

http://www.searchengines.pl/Infekcje-plikow-wykonywalnych-exe-dll-scr-t122692.html

Wykonaj to co jest podane w tym temacie

Zastosuj SDFix . Po pobraniu uruchom go a rozpakuje się do C:\SDFix. Uruchom komputer w trybie awaryjnym (F8 przy stracie systemu). Będąc w awaryjnym uruchom plik RunThis.bat z folderu SDFixa. Zatwierdź czyszczenie przez Y. Poczekaj aż ukończy i komputer zresetuje

Potem wejdz do folderu C:\SDFix wrzuc zawartość pliku Report.txt + log z OTListIt2

**Posty:** 84 · przez **barto0o** 18 Maj 2009, 14:04

pierwszy link sie nie otwiera:/

**Posty:** 18165 · przez **wojtas** 18 Maj 2009, 14:26

wszystko działa.

**Posty:** 84 · przez **barto0o** 18 Maj 2009, 14:50

sorry u mnie nie działało ale odpaliłem na innym kompie i już przeczytałem, widze że naprawde moge mieć problem, aż mnie krew zalewa, bo często robiłem dla ludzi komputery po wirusach a teraz sam złapałem i to jeszcze taka odmiane.... a nie moge pozwolić sobie na format bo mam ważne pliki których odzyskanie i ustawienie jak trzeba zajmie mi sporo czasu.

Posty z linków są dość stare, czy może od tamtej pory wyszła jakas dobra metoda na wirus Sality?? coś w necie czytałem że jest jakiś removall tool

Dodano 18.05.2009 15:29:21:

Kod: Zaznacz wszystko: OTListIt logfile created on: 2009-05-18 16:27:16 - Run 1 OTListIt2 by OldTimer - Version 2.0.15.8 Folder = D:\ Windows XP Professional Edition Dodatek Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation Internet Explorer (Version = 6.0.2900.2180) Locale: 00000415 | Country: Polska | Language: PLK | Date Format: yyyy-MM-dd 1023,48 Mb Total Physical Memory | 734,16 Mb Available Physical Memory | 71,73% Memory free 2,41 Gb Paging File | 2,21 Gb Available in Paging File | 91,83% Paging File free Paging file location(s): C:\pagefile.sys 1536 3072 [binary data] %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files Drive C: | 6,35 Gb Total Space | 0,56 Gb Free Space | 8,85% Space Free | Partition Type: NTFS Drive D: | 68,17 Gb Total Space | 37,30 Gb Free Space | 54,71% Space Free | Partition Type: NTFS E: Drive not present or media not loaded Drive F: | 3,66 Gb Total Space | 0,00 Gb Free Space | 0,00% Space Free | Partition Type: UDF G: Drive not present or media not loaded H: Drive not present or media not loaded I: Drive not present or media not loaded Computer Name: BARTEK Current User Name: Bart Logged in as Administrator. Current Boot Mode: Normal Scan Mode: Current user Output = Standard File Age = 30 Days Company Name Whitelist: On [color=orange]========== Processes (SafeList) ==========[/color] PRC - [2004-08-04 00:44:20 | 01,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\Explorer.EXE PRC - [2009-05-17 22:49:30 | 01,026,896 | ---- | M] (Lavasoft) -- C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe PRC - [2001-10-26 19:30:04 | 00,016,896 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\wbem\unsecapp.exe PRC - [2004-08-22 17:05:02 | 00,081,920 | ---- | M] (DAEMON'S HOME) -- C:\Program Files\D-Tools\daemon.exe PRC - [2009-05-17 22:49:31 | 00,598,360 | ---- | M] (Lavasoft) -- C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe PRC - [2004-08-04 00:44:30 | 00,218,112 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\wbem\wmiprvse.exe PRC - [2009-05-10 20:57:00 | 07,748,200 | ---- | M] (Mozilla Corporation) -- C:\Program Files\Mozilla Firefox\firefox.exe PRC - [2009-05-18 16:26:53 | 00,501,248 | ---- | M] (OldTimer Tools) -- D:\OTListIt2(2).exe [color=orange]========== Win32 Services (SafeList) ==========[/color] SRV - [2005-09-23 08:28:32 | 00,029,896 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe -- (aspnet_state [On_Demand | Stopped]) SRV - [2005-09-23 08:28:56 | 00,066,240 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32 [On_Demand | Stopped]) SRV - [2004-08-04 00:44:08 | 00,038,912 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\PCHealth\HelpCtr\Binaries\pchsvc.dll -- (helpsvc [Auto | Running]) SRV - [2009-05-17 22:49:30 | 01,026,896 | ---- | M] (Lavasoft) -- C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe -- (Lavasoft Ad-Aware Service [Auto | Running]) SRV - [2006-10-22 12:22:00 | 00,159,810 | ---- | M] (NVIDIA Corporation) -- C:\WINDOWS\system32\nvsvc32.exe -- (NVSvc [Disabled | Stopped]) SRV - [2003-07-28 20:28:22 | 00,162,864 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE -- (ose [On_Demand | Stopped]) SRV - [2007-04-26 10:21:28 | 01,308,208 | ---- | M] (Sunbelt Software) -- C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe -- (SPF4 [Disabled | Stopped]) [color=orange]========== Driver Services (SafeList) ==========[/color] DRV - File not found -- -- (abp470n5 [On_Demand | Running]) DRV - [2009-04-10 21:35:37 | 00,021,361 | ---- | M] (Cisco Systems, Inc.) -- C:\WINDOWS\system32\DRIVERS\AegisP.sys -- (AegisP [Auto | Running]) DRV - [2004-01-08 06:37:02 | 00,812,416 | ---- | M] (C-Media Inc) -- C:\WINDOWS\system32\drivers\cmuda.sys -- (cmuda [On_Demand | Running]) DRV - [2005-01-10 18:15:24 | 00,138,752 | ---- | M] (Creative Technology Ltd) -- C:\WINDOWS\system32\DRIVERS\ctsfm2k.sys -- (ctsfm2k [On_Demand | Stopped]) DRV - [2004-08-22 16:31:10 | 00,155,136 | ---- | M] ( ) -- C:\WINDOWS\system32\DRIVERS\d347bus.sys -- (d347bus [Boot | Running]) DRV - [2004-08-22 16:31:48 | 00,005,248 | ---- | M] ( ) -- C:\WINDOWS\System32\Drivers\d347prt.sys -- (d347prt [Boot | Running]) DRV - [2001-08-17 22:13:08 | 00,027,165 | ---- | M] (VIA Technologies, Inc. ) -- C:\WINDOWS\system32\DRIVERS\fetnd5.sys -- (FETNDIS [On_Demand | Running]) DRV - [2007-04-26 10:21:30 | 00,302,000 | ---- | M] (Sunbelt Software) -- C:\WINDOWS\system32\drivers\fwdrv.sys -- (fwdrv [System | Running]) DRV - [2004-08-04 01:08:22 | 00,010,624 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\DRIVERS\gameenum.sys -- (gameenum [On_Demand | Running]) DRV - [2007-04-26 10:21:34 | 00,072,624 | ---- | M] (Sunbelt Software) -- C:\WINDOWS\system32\drivers\khips.sys -- (khips [System | Running]) DRV - [2007-04-04 14:58:26 | 00,024,344 | ---- | M] (Kaspersky Lab) -- C:\WINDOWS\system32\DRIVERS\klim5.sys -- (klim5 [On_Demand | Running]) DRV - [2009-05-17 22:50:08 | 00,064,160 | ---- | M] (Lavasoft AB) -- C:\WINDOWS\system32\DRIVERS\Lbd.sys -- (Lbd [Boot | Running]) DRV - [2001-08-17 22:02:40 | 00,035,200 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\DRIVERS\msgame.sys -- (msgame [On_Demand | Stopped]) DRV - [2006-10-22 12:22:00 | 03,994,624 | ---- | M] (NVIDIA Corporation) -- C:\WINDOWS\system32\DRIVERS\nv4_mini.sys -- (nv [On_Demand | Running]) DRV - [2005-01-10 18:15:30 | 00,106,496 | ---- | M] (Creative Technology Ltd.) -- C:\WINDOWS\system32\DRIVERS\ctoss2k.sys -- (ossrv [On_Demand | Stopped]) DRV - [2007-06-15 10:47:26 | 01,127,936 | ---- | M] (Creative Technology Ltd.) -- C:\WINDOWS\system32\drivers\P17.sys -- (P17 [On_Demand | Stopped]) DRV - [2001-08-17 23:49:56 | 00,017,792 | ---- | M] (Parallel Technologies, Inc.) -- C:\WINDOWS\system32\DRIVERS\ptilink.sys -- (Ptilink [On_Demand | Running]) DRV - [2008-01-15 21:50:50 | 00,459,520 | ---- | M] (Ralink Technology, Corp.) -- C:\WINDOWS\system32\DRIVERS\rt73.sys -- (RT73 [On_Demand | Running]) DRV - [2004-08-03 22:31:34 | 00,020,992 | ---- | M] (Realtek Semiconductor Corporation) -- C:\WINDOWS\system32\DRIVERS\RTL8139.SYS -- (rtl8139 [On_Demand | Stopped]) DRV - [2004-07-17 11:36:38 | 00,027,440 | ---- | M] () -- C:\WINDOWS\system32\DRIVERS\secdrv.sys -- (Secdrv [On_Demand | Stopped]) DRV - [2004-10-13 11:56:10 | 00,462,212 | ---- | M] (B2C2, Inc.) -- C:\WINDOWS\system32\DRIVERS\SkyNET.SYS -- (SKYNET [On_Demand | Running]) DRV - [2001-08-17 21:56:16 | 00,007,552 | ---- | M] (Sony Corporation) -- C:\WINDOWS\system32\DRIVERS\SONYPVU1.SYS -- (SONYPVU1 [On_Demand | Stopped]) [color=orange]========== Standard Registry (SafeList) ==========[/color] [color=orange]========== Internet Explorer ==========[/color] IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.microsoft.com/isapi/redir.dll?prd={SUB_PRD}&clcid={SUB_CLSID}&pver={SUB_PVER}&ar=home IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomizeSearch = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\system32\blank.htm IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 [color=orange]========== FireFox ==========[/color] FF - prefs.js..browser.search.update: false FF - prefs.js..browser.startup.homepage: "www.onet.pl" FF - HKLM\software\mozilla\Mozilla Firefox 2.0.0.20\extensions\\Components: C:\PROGRAM FILES\MOZILLA FIREFOX\COMPONENTS [2009-05-10 20:57:03 | 00,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Firefox 2.0.0.20\extensions\\Plugins: C:\PROGRAM FILES\MOZILLA FIREFOX\PLUGINS [2009-05-10 20:57:03 | 00,000,000 | ---D | M] [2007-12-23 19:13:46 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Bart\Dane aplikacji\mozilla\Firefox\Profiles\i7jqad9x.default\extensions [2008-06-27 16:54:42 | 00,000,000 | ---D | M] -- C:\Program Files\mozilla firefox\extensions [2009-05-10 20:56:57 | 00,000,000 | ---D | M] -- C:\Program Files\mozilla firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd} [2007-07-18 19:04:05 | 00,000,000 | ---D | M] -- C:\Program Files\mozilla firefox\extensions\{BEE3E87E-E1C6-4bfe-BE9D-48E84271AB34} [2009-05-10 20:56:57 | 00,000,000 | ---D | M] -- C:\Program Files\mozilla firefox\extensions\talkback@mozilla.org [2009-05-10 20:56:51 | 00,067,688 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\jar50.dll [2009-05-10 20:56:51 | 00,054,368 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\jsd3250.dll [2009-05-10 20:56:51 | 00,034,944 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\myspell.dll [2009-05-10 20:56:52 | 00,046,712 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\spellchk.dll [2009-05-10 20:56:52 | 00,172,136 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\xpinstal.dll [2009-05-10 20:57:02 | 00,000,904 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\allegro-pl.xml [2009-05-10 20:57:02 | 00,001,419 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\fbc-pl.xml [2009-05-10 20:57:02 | 00,002,368 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\google.xml [2009-05-10 20:57:02 | 00,000,926 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\merlin-pl.xml [2009-05-10 20:57:02 | 00,000,866 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\pwn-pl.xml [2009-05-10 20:57:02 | 00,001,198 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-pl.xml [2009-05-10 20:57:02 | 00,001,693 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wp-pl.xml O1 HOSTS File: (27 bytes) - C:\WINDOWS\System32\drivers\etc\Hosts O1 - Hosts: 127.0.0.1 localhost O3 - HKLM\..\Toolbar: (no name) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - Reg Error: Key error. File not found O4 - HKLM..\Run: [Ad-Watch] C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe (Lavasoft) O4 - HKLM..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033 (DAEMON'S HOME) O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: dontdisplaylastusername = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticecaption = O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticetext = O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: shutdownwithoutlogon = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: undockwithoutlogon = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableRegistryTools = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0 O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableTaskMgr = 1 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableRegistryTools = 1 O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 (Microsoft Corporation) O15 - HKLM\..Trusted Domains: 1 domain(s) and sub-domain(s) not assigned to a zone. O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\Program Files\Common Files\Microsoft Shared\Web Components\10\OWC10.DLL (Microsoft Corporation) O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\Program Files\Common Files\Microsoft Shared\Web Components\11\OWC11.DLL (Microsoft Corporation) O18 - Protocol\Filter: - text/xml - C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\Explorer.exe (Microsoft Corporation) O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found. O24 - Desktop Components:0 (Moja bieżąca strona główna) - About:Home O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2007-07-18 16:28:57 | 00,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ] O32 - AutoRun File - [2007-08-13 18:30:58 | 00,402,696 | R--- | M] (Electronic Arts) - F:\AutoRun.exe -- [ UDF ] O32 - AutoRun File - [2007-09-02 02:30:29 | 00,000,000 | R--D | M] - F:\Autorun -- [ UDF ] O32 - AutoRun File - [2007-09-02 02:31:16 | 05,085,696 | R--- | M] () - F:\autorun.dat -- [ UDF ] O32 - AutoRun File - [2007-09-02 02:23:25 | 00,000,136 | R--- | M] () - F:\autorun.inf -- [ UDF ] O34 - HKLM BootExecute: (autocheck) - File not found O34 - HKLM BootExecute: (autochk) - C:\WINDOWS\System32\autochk.exe (Microsoft Corporation) O34 - HKLM BootExecute: (*) - * [2009-05-18 16:26:31 | 00,000,000 | ---D | M] O34 - HKLM BootExecute: (lsdelete) - C:\WINDOWS\System32\lsdelete.exe () [color=orange]========== Files/Folders - Created Within 30 Days ==========[/color] [4 C:\WINDOWS\*.tmp files] [2009-05-18 16:20:45 | 00,000,000 | ---D | C] -- C:\SDFix [2009-05-18 16:20:14 | 00,000,000 | -HSD | C] -- C:\RECYCLER [2009-05-17 23:06:31 | 00,000,000 | ---D | C] -- C:\WINDOWS\temp [2009-05-17 23:06:31 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Bart\Ustawienia lokalne\temp [2009-05-17 22:55:52 | 00,212,480 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWXCACLS.exe [2009-05-17 22:55:52 | 00,161,792 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWREG.exe [2009-05-17 22:55:52 | 00,136,704 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWSC.exe [2009-05-17 22:55:52 | 00,117,248 | ---- | C] () -- C:\WINDOWS\vFind.exe [2009-05-17 22:55:52 | 00,098,816 | ---- | C] () -- C:\WINDOWS\sed.exe [2009-05-17 22:55:52 | 00,080,412 | ---- | C] () -- C:\WINDOWS\grep.exe [2009-05-17 22:55:52 | 00,068,096 | ---- | C] () -- C:\WINDOWS\zip.exe [2009-05-17 22:55:37 | 00,000,000 | ---D | C] -- C:\ComboFix [2009-05-17 22:55:16 | 00,000,000 | ---D | C] -- C:\Qoobox [2009-05-17 22:54:53 | 00,015,688 | ---- | C] () -- C:\WINDOWS\System32\lsdelete.exe [2009-05-17 22:50:51 | 00,000,472 | ---- | C] () -- C:\WINDOWS\tasks\Ad-Aware Update (Weekly).job [2009-05-17 22:50:48 | 00,064,160 | ---- | C] (Lavasoft AB) -- C:\WINDOWS\System32\drivers\Lbd.sys [2009-05-17 22:47:13 | 00,000,000 | -H-D | C] -- C:\Documents and Settings\All Users\Dane aplikacji\{83C91755-2546-441D-AC40-9A6B4B860800} [2009-05-17 22:47:09 | 00,000,867 | ---- | C] () -- C:\Documents and Settings\All Users\Pulpit\Ad-Aware.lnk [2009-05-17 22:47:02 | 00,000,000 | ---D | C] -- C:\Program Files\Lavasoft [2009-05-17 22:47:02 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Dane aplikacji\Lavasoft [2009-05-17 22:42:20 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Bart\Dane aplikacji\Lavasoft [2009-05-17 22:35:15 | 00,000,000 | ---- | C] () -- C:\WINDOWS\win.ini [2009-05-17 17:37:34 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Bart\Pulpit\Nowy folder [2009-05-09 09:31:41 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Dane aplikacji\NVIDIA [2009-05-08 19:37:24 | 00,807,332 | ---- | C] () -- C:\Documents and Settings\Bart\Pulpit\P7240348.JPG [2009-05-06 21:46:04 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Bart\Dane aplikacji\Help [2009-05-06 21:42:59 | 00,076,595 | ---- | C] () -- C:\Documents and Settings\Bart\Pulpit\DSC03291a.JPG [2009-05-01 09:04:23 | 00,503,114 | ---- | C] () -- C:\Documents and Settings\Bart\Pulpit\polityka bezpieczenstwa.zip [2009-04-13 21:18:09 | 00,155,136 | ---- | C] ( ) -- C:\WINDOWS\System32\drivers\d347bus.sys [2009-04-13 21:18:09 | 00,005,248 | ---- | C] ( ) -- C:\WINDOWS\System32\drivers\d347prt.sys [2007-11-02 18:04:58 | 00,000,325 | ---- | C] () -- C:\WINDOWS\wincmd.ini [2007-10-02 21:55:29 | 00,000,034 | ---- | C] () -- C:\WINDOWS\Powerplayer.ini [2007-10-02 21:55:24 | 00,000,540 | ---- | C] () -- C:\WINDOWS\psnetwork.ini [2007-09-30 13:32:29 | 00,000,421 | ---- | C] () -- C:\WINDOWS\ODBC.INI [2007-08-23 18:00:26 | 00,017,852 | ---- | C] () -- C:\WINDOWS\irunin.ini [2007-08-11 18:34:29 | 00,237,568 | ---- | C] () -- C:\WINDOWS\System32\lame_enc.dll [2007-08-04 14:14:02 | 00,007,680 | ---- | C] () -- C:\WINDOWS\System32\ff_vfw.dll [2007-08-04 14:14:02 | 00,000,547 | ---- | C] () -- C:\WINDOWS\System32\ff_vfw.dll.manifest [2007-08-03 20:47:28 | 00,005,663 | ---- | C] () -- C:\WINDOWS\System32\ludap17.ini [2007-08-03 20:47:28 | 00,000,075 | ---- | C] () -- C:\WINDOWS\System32\ctzapxx.ini [2007-07-27 19:46:52 | 00,000,116 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini [2007-07-18 19:32:11 | 00,000,095 | ---- | C] () -- C:\WINDOWS\winamp.ini [2007-07-18 19:06:27 | 00,000,092 | ---- | C] () -- C:\WINDOWS\CMISETUP.INI [2007-07-18 19:06:27 | 00,000,026 | ---- | C] () -- C:\WINDOWS\CMCDPLAY.INI [2007-07-18 19:06:26 | 00,000,000 | ---- | C] () -- C:\WINDOWS\Wininit.ini [2007-07-18 19:06:25 | 00,028,672 | ---- | C] () -- C:\WINDOWS\System32\cmirmdrv.dll [2007-07-18 19:06:23 | 00,116,930 | ---- | C] () -- C:\WINDOWS\Cmuda.ini [2007-07-18 19:06:21 | 00,028,672 | ---- | C] () -- C:\WINDOWS\CMIRmDriver.dll [2007-07-18 19:06:03 | 00,002,598 | ---- | C] () -- C:\WINDOWS\Ascd_tmp.ini [2007-07-18 19:06:02 | 00,005,824 | ---- | C] () -- C:\WINDOWS\System32\drivers\ASUSHWIO.SYS [2006-10-22 12:22:00 | 01,662,976 | ---- | C] () -- C:\WINDOWS\System32\nvwdmcpl.dll [2006-10-22 12:22:00 | 01,470,464 | ---- | C] () -- C:\WINDOWS\System32\nview.dll [2006-10-22 12:22:00 | 01,019,904 | ---- | C] () -- C:\WINDOWS\System32\nvwimg.dll [2006-10-22 12:22:00 | 00,581,632 | ---- | C] () -- C:\WINDOWS\System32\nvhwvid.dll [2006-10-22 12:22:00 | 00,466,944 | ---- | C] () -- C:\WINDOWS\System32\nvshell.dll [2006-10-22 12:22:00 | 00,286,720 | ---- | C] () -- C:\WINDOWS\System32\nvnt4cpl.dll [2006-10-22 12:22:00 | 00,212,992 | ---- | C] () -- C:\WINDOWS\System32\nvapi.dll [2005-05-03 19:38:42 | 00,064,512 | ---- | C] () -- C:\WINDOWS\System32\P17.dll [2004-08-22 17:04:56 | 00,069,120 | ---- | C] () -- C:\WINDOWS\daemon.dll [2004-08-04 00:44:00 | 00,081,920 | ---- | C] () -- C:\WINDOWS\System32\ieencode.dll [2004-07-17 11:36:38 | 00,027,440 | ---- | C] () -- C:\WINDOWS\System32\drivers\secdrv.sys [2003-10-02 18:48:18 | 00,053,248 | ---- | C] () -- C:\WINDOWS\System32\P17CPI.dll [2002-05-04 12:04:45 | 00,094,636 | ---- | C] () -- C:\WINDOWS\dropcpyr.dll [2002-04-11 09:41:06 | 00,065,536 | ---- | C] ( ) -- C:\WINDOWS\System32\A3d.dll [2001-07-22 00:15:52 | 00,000,362 | ---- | C] () -- C:\WINDOWS\system.ini [color=orange]========== Files - Modified Within 30 Days ==========[/color] [2 C:\WINDOWS\System32\*.tmp files] [4 C:\WINDOWS\*.tmp files] [2009-05-18 16:25:05 | 00,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT [2009-05-18 16:25:03 | 00,000,062 | -HS- | M] () -- C:\Documents and Settings\Bart\Ustawienia lokalne\desktop.ini [2009-05-18 16:25:01 | 00,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat [2009-05-17 23:03:14 | 00,000,362 | ---- | M] () -- C:\WINDOWS\system.ini [2009-05-17 22:56:09 | 00,000,095 | ---- | M] () -- C:\WINDOWS\winamp.ini [2009-05-17 22:50:52 | 00,000,472 | ---- | M] () -- C:\WINDOWS\tasks\Ad-Aware Update (Weekly).job [2009-05-17 22:50:31 | 00,015,688 | ---- | M] () -- C:\WINDOWS\System32\lsdelete.exe [2009-05-17 22:50:08 | 00,064,160 | ---- | M] (Lavasoft AB) -- C:\WINDOWS\System32\drivers\Lbd.sys [2009-05-17 22:47:09 | 00,000,867 | ---- | M] () -- C:\Documents and Settings\All Users\Pulpit\Ad-Aware.lnk [2009-05-17 22:35:16 | 00,000,211 | -HS- | M] () -- C:\boot.ini [2009-05-17 22:35:16 | 00,000,000 | ---- | M] () -- C:\WINDOWS\win.ini [2009-05-14 17:50:08 | 00,117,248 | ---- | M] () -- C:\WINDOWS\vFind.exe [2009-05-10 18:20:09 | 00,000,116 | ---- | M] () -- C:\WINDOWS\NeroDigital.ini [2009-05-10 09:11:25 | 10,732,99456 | ---- | M] () -- C:\WINDOWS\MEMORY.DMP [2009-05-10 09:09:11 | 00,000,497 | ---- | M] () -- C:\WINDOWS\System32\drivers\fwdrv.err [2009-05-10 07:59:26 | 00,863,860 | ---- | M] () -- C:\WINDOWS\System32\PerfStringBackup.INI [2009-05-10 07:59:26 | 00,392,296 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat [2009-05-10 07:59:26 | 00,328,018 | ---- | M] () -- C:\WINDOWS\System32\perfh015.dat [2009-05-10 07:59:26 | 00,074,230 | ---- | M] () -- C:\WINDOWS\System32\perfc015.dat [2009-05-10 07:59:26 | 00,058,596 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat [2009-05-09 09:37:23 | 00,088,566 | ---- | M] () -- C:\WINDOWS\System32\nvapps.xml [2009-05-06 21:46:56 | 00,000,845 | ---- | M] () -- C:\Documents and Settings\All Users\Pulpit\CWK.lnk [2009-05-06 21:43:00 | 00,076,595 | ---- | M] () -- C:\Documents and Settings\Bart\Pulpit\DSC03291a.JPG [2009-05-05 22:16:43 | 00,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl [2009-05-01 09:04:22 | 00,503,114 | ---- | M] () -- C:\Documents and Settings\Bart\Pulpit\polityka bezpieczenstwa.zip [2009-04-20 12:56:28 | 00,031,232 | ---- | M] (NirSoft) -- C:\WINDOWS\NirCmd.exe < End of report >

awaryjny nie działa:/

**Posty:** 18165 · przez **wojtas** 18 Maj 2009, 17:01

Uruchom OTListIt2 i w oknie Custom Scans/Fixes wklej :

:OTLI
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O3 - HKLM\..\Toolbar: (no name) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - Reg Error: Key error. File not found
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableTaskMgr = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableRegistryTools = 1
O32 - AutoRun File - [2007-09-02 02:30:29 | 00,000,000 | R--D | M] - F:\Autorun -- [ UDF ]
O32 - AutoRun File - [2007-09-02 02:31:16 | 05,085,696 | R--- | M] () - F:\autorun.dat -- [ UDF ]
O32 - AutoRun File - [2007-09-02 02:23:25 | 00,000,136 | R--- | M] () - F:\autorun.inf -- [ UDF ]

:Files
C:\RECYCLER
D:\RECYCLER
C:\WINDOWS\SWXCACLS.exe
C:\WINDOWS\SWREG.exe
C:\WINDOWS\SWSC.exe
C:\WINDOWS\vFind.exe
C:\WINDOWS\sed.exe
C:\WINDOWS\grep.exe
C:\WINDOWS\zip.exe
C:\ComboFix
C:\Qoobox

:Commands
[emptytemp]
[start explorer]
[Reboot]

Kliknij w Run Fix. I potwierdz reset kompa .

1. Ściągnij OTMoveIt i go włacz i odpal go z opcji CleanUp
2. wykonaj optymalizację windowsa
3.sciagnij ATF_Cleaner
zaznacz
Windows Temp
All users Temp
Temporary internet files
Recycle Bin
i wcisnij EMPTY SELECTED
4.Wyłącz przywracanie systemu ( właściwości mój komputer-zakładka przywracanie - wyłącz przywracanie na wszystkich dyskach). Po chwili włącz je powrotem
5. Wykonaj skan Dr. Web CureIt
6. Przeskanuj obszar mojego komputera http://www.kaspersky.pl/virusscanner.html (uruchom przez IE) Daj raport z niego na forum.

i tym:

FixIEDef.

Jeśli masz Adobe Reader to zaaktualizuj go do najnowszej wersji

**Posty:** 84 · przez **barto0o** 18 Maj 2009, 17:34

Kod: Zaznacz wszystko: ========== OTLISTIT ========== Process explorer.exe killed successfully! Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{E0E899AB-F487-11D5-8D29-0050BA6940E3} deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E0E899AB-F487-11D5-8D29-0050BA6940E3}\ not found. Registry value HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\DisableTaskMgr deleted successfully. Registry value HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\DisableRegistryTools deleted successfully. File not found. File move failed. F:\autorun.dat scheduled to be moved on reboot. File move failed. F:\autorun.inf scheduled to be moved on reboot. ========== FILES ========== C:\RECYCLER\S-1-5-21-329068152-484061587-725345543-1006\Dc1 moved successfully. C:\RECYCLER\S-1-5-21-329068152-484061587-725345543-1006 moved successfully. C:\RECYCLER moved successfully. D:\RECYCLER\S-1-5-21-329068152-484061587-725345543-1006 moved successfully. D:\RECYCLER moved successfully. C:\WINDOWS\SWXCACLS.exe moved successfully. C:\WINDOWS\SWREG.exe moved successfully. C:\WINDOWS\SWSC.exe moved successfully. C:\WINDOWS\vFind.exe moved successfully. C:\WINDOWS\sed.exe moved successfully. C:\WINDOWS\grep.exe moved successfully. C:\WINDOWS\zip.exe moved successfully. C:\ComboFix moved successfully. C:\Qoobox\Quarantine\Registry_backups moved successfully. C:\Qoobox\Quarantine\D\RECYCLER\S-1-5-21-1482476501-746137067-725345543-1003\Dd2 moved successfully. C:\Qoobox\Quarantine\D\RECYCLER\S-1-5-21-1482476501-746137067-725345543-1003\Dd1 moved successfully. C:\Qoobox\Quarantine\D\RECYCLER\S-1-5-21-1482476501-746137067-725345543-1003 moved successfully. C:\Qoobox\Quarantine\D\RECYCLER moved successfully. C:\Qoobox\Quarantine\D moved successfully. C:\Qoobox\Quarantine\C\WINDOWS\system32 moved successfully. C:\Qoobox\Quarantine\C\WINDOWS moved successfully. C:\Qoobox\Quarantine\C\Program Files\ActivationManager moved successfully. C:\Qoobox\Quarantine\C\Program Files moved successfully. C:\Qoobox\Quarantine\C moved successfully. C:\Qoobox\Quarantine moved successfully. C:\Qoobox\BackEnv moved successfully. C:\Qoobox moved successfully. ========== COMMANDS ========== User's Temp folder emptied. User's Internet Explorer cache folder emptied. Windows Temp folder emptied. Temp folders emptied. Explorer started successfully OTListIt2 by OldTimer - Version 2.0.15.8 log created on 05182009_173053 Files moved on Reboot... File move failed. F:\autorun.dat scheduled to be moved on reboot.

Dodano 18.05.2009 16:46:54:

Kod: Zaznacz wszystko: ******************************************************************************** * * * FixIEDef Log * * Version 1.7.22.7514 * * * ******************************************************************************** Created at 17:46:25 on Monday, May 18, 2009 Time Zone : Logged On User : Bart Operating System : Microsoft Windows XP Professional Dodatek Service Pack 2 OS Architecture : X86 System Langauge : Polish Keyboard Layout : Polish Processor : X86 AMD Sempron(tm) 2200+ System Drive : C:\ Windows Directory : C:\WINDOWS System Directory : C:\WINDOWS\system32 System Drive Type : Fixed System Drive Status : READY System Drive Label : System Drive Size : 6.5 GB System Drive Free : 1.44 GB Total Physical Memory: 1023 MB Free Physical Memory : 674 MB Total Page File : 1023 MB Free Page File : 2300 MB Total Virtual Memory : 2048 MB Free Virtual Memory : 1970 MB Boot State : Normal boot -------------------------------------------------------------------------------- !!! userinit.exe is Clean !!! -------------------------------------------------------------------------------- !!! Files that have been deleted !!! No malicious files found -------------------------------------------------------------------------------- !!! Directories that have been removed !!! No malicious directories to be removed -------------------------------------------------------------------------------- !!! Registry entries that have been removed !!! No malicious Registry entries found ================================================================================ All Done :) ShadowPuterDude Safe Surfing!!!

Dodano 18.05.2009 16:49:29:
zanim podałeś mi jeszcze swoją odpowiedź, poczytałem trochę i znalazłem narzędzie avg do usuwania tego syfu i po restarcie tak jak by w trybie awaryjnym przez ponad godzinę usuwał mi duuuużo śmietnika z dysku i wygląda że jest ok tylko jeszcze kasperskim przejade

Dodano 18.05.2009 18:28:05:
strona kaspra się coś wiesza, już było raz około 20% przeskanowanego i zawisło, w tym czasie znalazło sality jeszcze w 3 miejscach i wszystko wyje... ręcznie z całym folderem, teraz pobieranie programu wisi na 25% i nie chce zbytnio ruszyć dalej:/

**Posty:** 18165 · przez **wojtas** 18 Maj 2009, 20:26

zastosuj jeszcze :

kaspersky-virus-removal-tool-i-system-repair-engineer-vt100058.html

kaspersky virus removal tool

**Posty:** 84 · przez **barto0o** 18 Maj 2009, 22:05

już wcześniej starałem się to odpalić ale strasznie długo skanuje:/

**Posty:** 18165 · przez **wojtas** 18 Maj 2009, 22:08

skanuj bo masz wirusa... a dr.web nic nie znalazl?? daj raport z niego

**Posty:** 84 · przez **barto0o** 18 Maj 2009, 22:14

dr web czysto ale było szybkie skanowanie

Dodano 18.05.2009 21:17:01:
i kvrt działa o wiele szybciej a ściągnąłem najnowsze avg i znalazł tylko jakieś pojedyncze cookie

**Posty:** 18165 · przez **wojtas** 18 Maj 2009, 22:18

a daj normalne i zobacz tu:

http://www.searchengines.pl/Naprawianie-szkod-systemowych-t79791.html

moze Ci cos to pomoze.

**Posty:** 84 · przez **barto0o** 18 Maj 2009, 22:21

http://wklej.org/id/92498/

Dodano 19.05.2009 07:33:27:
chciał bym też przeskanować komputer jakimś antywirem z płyty ale nie moge zassać dr web live cd nawet ze strony producenta:/ ma ktoś może jakiś inny adres

**Posty:** 18165 · przez **wojtas** 19 Maj 2009, 08:41

daj loga z http://download.bleepingcomputer.com/sUBs/ComboFix.exe