Nie mogę otworzyć dysków twardych

**Posty:** 3 · przez **Jaro98220** 05 Lut 2009, 23:20

Witam,
Mam problemy z otworzeniem dysków C;D;E;F, wogule nie chcą mi sie otworzyć, a jak naciskam dysk C to wyskakuje mi komunikat: System Windows nie może odnaleźć pliku "RECYCLER\S-0-1-93-100028228-100001004-100004361-7356.com". Upewni się, że wpisana nazwa jest poprawna i spróbój ponownie. Aby odszukać plik, kliknij przycisk Start, a następnie kliknij polecenie Wyszukaj. Na dodatek wyskakuje mi czerwona ikona ze znakiem X i co chwile pojawia się komunikat " You have a secirity problem! " w prawym dolny rogu na pasku.
Oto Log:

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 21:24:01, on 2009-02-05 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\userinit.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE D:\Program Files\Pinnacle\MediaServer\Microsoft SQL Server\MSSQL$PINNACLESYS\Binn\sqlservr.exe C:\Program Files\Eset\nod32krn.exe C:\WINDOWS\system32\nvsvc32.exe D:\Program Files\Medal of Honor Airborne\UnrealEngine3\MOHAGame\pb\PnkBstrA.exe C:\WINDOWS\system32\PnkBstrB.exe C:\Program Files\CyberLink\Shared Files\RichVideo.exe C:\WINDOWS\Explorer.EXE F:\GRY\DAEMON Tools\daemon.exe C:\Program Files\Eset\nod32kui.exe C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe C:\Program Files\Analog Devices\Core\smax4pnp.exe C:\Program Files\Analog Devices\SoundMAX\Smax4.exe C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe C:\WINDOWS\system32\RunDLL32.exe C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe D:\Gadu-Gadu\gg.exe C:\Program Files\Skype\Phone\Skype.exe C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe C:\Program Files\Winamp Remote\bin\OrbTray.exe C:\Program Files\Messenger\msmsgs.exe C:\WINDOWS\system32\ctfmon.exe D:\Program Files\Syntezator Mowy\DEMO\UniSpiker-2.6\uni_spiker-2.6.exe D:\VolumeWatcher\SPUVolumeWatcher.exe C:\Program Files\Winamp Remote\bin\Orb.exe C:\Program Files\Skype\Plugin Manager\skypePM.exe C:\WINDOWS\system32\wuauclt.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Mozilla Firefox\firefox.exe D:\Winamp\winamp.exe C:\Program Files\Java\jre1.6.0_02\bin\jucheck.exe C:\DOCUME~1\aaa\USTAWI~1\Temp\perce.jpg.exe C:\WINDOWS\system32\1e3livDM.exe C:\Documents and Settings\aaa\Pulpit\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://search.bearshare.com/sidebar.html?src=ssb R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.pl/ R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza R3 - URLSearchHook: (no name) - {1BB22D38-A411-4B13-A746-C2A4F4EC7344} - (no file) R3 - URLSearchHook: Share Accelerator MM Toolbar - {4596013b-6c31-408b-a266-deae5c086dc2} - C:\Program Files\Share_Accelerator_MM\tbSha0.dll O1 - Hosts: 212.150.54.250 dv-networks.com O1 - Hosts: 212.150.54.250 dv-networks.com O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: ShoppingReport - {100EB1FD-D03E-47FD-81F3-EE91287F9465} - C:\Program Files\ShoppingReport\Bin\2.0.22\ShoppingReport.dll (file missing) O2 - BHO: Share Accelerator MM Toolbar - {4596013b-6c31-408b-a266-deae5c086dc2} - C:\Program Files\Share_Accelerator_MM\tbSha0.dll O2 - BHO: XML module - {500BCA15-57A7-4eaf-8143-8C619470B13D} - C:\WINDOWS\system32\msxml71.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.0.926.3450\swg.dll O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_219B3E1547538286.dll O3 - Toolbar: BearShare MediaBar - {D3DEE18F-DB64-4BEB-9FF1-E1F0A5033E4A} - C:\Program Files\BearShare applications\BearShare MediaBar\MediaBar.dll (file missing) O3 - Toolbar: Share Accelerator MM Toolbar - {4596013b-6c31-408b-a266-deae5c086dc2} - C:\Program Files\Share_Accelerator_MM\tbSha0.dll O3 - Toolbar: &Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [DAEMON Tools] "F:\GRY\DAEMON Tools\daemon.exe" -lang 1033 O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe O4 - HKLM\..\Run: [SoundMAX] "C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe" O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup O4 - HKCU\..\Run: [Gadu-Gadu] "D:\Gadu-Gadu\gg.exe" /tray O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe O4 - HKCU\..\Run: [Orb] "C:\Program Files\Winamp Remote\bin\OrbTray.exe" /background O4 - HKCU\..\Run: [NBJ] "C:\Program Files\Ahead\Nero BackItUp\NBJ.exe" O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [Expressivo] "C:\Program Files\ivo\Expressivo Demo\expressivo.exe" -t O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [Cognac] C:\DOCUME~1\aaa\USTAWI~1\Temp\perce.jpg.exe O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Startup: Picture Motion Browser Media Check Tool.lnk = D:\VolumeWatcher\SPUVolumeWatcher.exe O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe O4 - Global Startup: Adobe Reader Synchronizer.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe O4 - Global Startup: UniSpiker-2.6.lnk = ? O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O8 - Extra context menu item: E&ksportuj do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: ShopperReports - Compare product prices - {C5428486-50A0-4a02-9D20-520B59A9F9B2} - C:\Program Files\ShoppingReport\Bin\2.0.22\ShoppingReport.dll (file missing) O9 - Extra button: ShopperReports - Compare travel rates - {C5428486-50A0-4a02-9D20-520B59A9F9B3} - C:\Program Files\ShoppingReport\Bin\2.0.22\ShoppingReport.dll (file missing) O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O17 - HKLM\System\CCS\Services\Tcpip\..\{89EE5BD7-0561-4BEE-9F0B-3511E0A64CA6}: NameServer = 85.255.113.142,85.255.112.231 O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.113.142 85.255.112.231 O17 - HKLM\System\CS5\Services\Tcpip\Parameters: NameServer = 85.255.113.142 85.255.112.231 O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.113.142 85.255.112.231 O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: PunkBuster (PnkBstrA) - Unknown owner - D:\Program Files\Medal of Honor Airborne\UnrealEngine3\MOHAGame\pb\PnkBstrA.exe O23 - Service: PnkBstrB - Unknown owner - C:\WINDOWS\system32\PnkBstrB.exe O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe O24 - Desktop Component 0: (no name) - file:///C:/DOCUME~1/aaa/USTAWI~1/Temp/msohtml1/02/clip_image002.jpg O24 - Desktop Component 1: (no name) - file:///C:/DOCUME~1/aaa/USTAWI~1/Temp/msohtml1/01/clip_image002.jpg -- End of file - 9430 bytes

Proszę o pilną pomoc, bo uniemożliwia mi to prać na kompie !! :roll:

**Posty:** 18165 · przez **wojtas** 05 Lut 2009, 23:59

Wykonaj to co jest podane w tym temacie

Zastosuj SDFix . Po pobraniu uruchom go a rozpakuje się do C:\SDFix. Uruchom komputer w trybie awaryjnym (F8 przy stracie systemu). Będąc w awaryjnym uruchom plik RunThis.bat z folderu SDFixa. Zatwierdź czyszczenie przez Y. Poczekaj aż ukończy i komputer zresetuje

Potem wejdz do folderu C:\SDFix wrzuc zawartość pliku Report.txt + log z combofixa oraz daj loga z hijacka (tylko logi dajemy w tagach code!! )

**Posty:** 3 · przez **Jaro98220** 06 Lut 2009, 10:50

Jak uruchamiam kompa w trybie awaryjnym to i tak nie mogę otworzyć dysków :wow:

A jeśli mam HijackThis to muszę ściągać cmobofxa ??

**Posty:** 3620 · przez **MaTi** 06 Lut 2009, 10:58

Jaro98220 napisał(a):A jeśli mam HijackThis to muszę ściągać cmobofxa ??

Tak są to osobne aplikacje - combofix

**Posty:** 151 · przez **Arahis** 06 Lut 2009, 11:00

mam taki sam problem// otwieram dyski za pomocą total commandera.. bo nie chcę mi się modzic..

**Posty:** 300 · przez **sgsman** 06 Lut 2009, 12:35

Arahis, załóż swój temat i daj logi z combofixa i hijackthisa

.

**Posty:** 3 · przez **Jaro98220** 07 Lut 2009, 20:47

Log z combofixa

Kod: Zaznacz wszystko: ComboFix 09-02-06.04 - aaa 2009-02-07 19:29:06.1 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.2.1250.1.1045.18.510.233 [GMT 1:00] Uruchomiony z: c:\documents and settings\aaa\Pulpit\ComboFix.exe AV: avast! antivirus 4.7.1098 [VPS 090207-0] *On-access scanning enabled* (Updated) AV: AVG 7.5.476 *On-access scanning enabled* (Updated) . ((((((((((((((((((((((((((((((((((((((( Usunięto ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\Autorun.inf c:\docume~1\aaa\USTAWI~1\Temp\tmp1.tmp c:\docume~1\aaa\USTAWI~1\Temp\tmp2.tmp c:\documents and settings\aaa\Dane aplikacji\ShoppingReport c:\documents and settings\aaa\Dane aplikacji\ShoppingReport\cs\Config.xml c:\documents and settings\aaa\Dane aplikacji\ShoppingReport\cs\db\Aliases.dbs c:\documents and settings\aaa\Dane aplikacji\ShoppingReport\cs\db\Sites.dbs c:\documents and settings\aaa\Dane aplikacji\ShoppingReport\cs\dwld\WhiteList.xip c:\documents and settings\aaa\Dane aplikacji\ShoppingReport\cs\report\aggr_storage.xml c:\documents and settings\aaa\Dane aplikacji\ShoppingReport\cs\report\send_storage.xml c:\documents and settings\aaa\Dane aplikacji\ShoppingReport\cs\res1\WhiteList.dbs c:\program files\INSTALL.LOG c:\program files\Mozilla Firefox\components\iamfamous.dll c:\program files\ShoppingReport c:\program files\ShoppingReport\Uninst.exe c:\recycler\S-7-4-43-100013396-100025670-100019746-7760.com c:\windows\IE4 Error Log.txt c:\windows\system32\1e3livDM.exe.a_a c:\windows\system32\drivers\gaopdxfybwqqod.sys c:\windows\system32\drivers\gaopdxiufyxilr.sys c:\windows\system32\drivers\gaopdxktkadiun.sys c:\windows\system32\drivers\gaopdxoyvxeweg.sys c:\windows\system32\drivers\gaopdxserv.sys c:\windows\system32\drivers\gaopdxthemppyr.sys c:\windows\system32\drivers\gaopdxtkiqqpcb.sys c:\windows\system32\drivers\msliksurserv.sys c:\windows\system32\gaopdxcounter c:\windows\system32\gaopdxxmimppam.dll c:\windows\system32\msxml71.dll D:\Autorun.inf d:\recycler\S-0-1-93-100028228-100001004-100004361-7356.com d:\recycler\S-1-6-45-100022453-100020014-100030875-2633.com d:\recycler\S-1-9-86-100023641-100002383-100007641-7222.com d:\recycler\S-2-5-61-100006978-100008147-100027851-1486.com d:\recycler\S-3-5-71-100011109-100027856-100026146-5877.com d:\recycler\S-4-5-75-100016369-100005087-100021452-7548.com d:\recycler\S-4-7-61-100008775-100031098-100015738-7703.com d:\recycler\S-5-6-79-100029646-100014700-100029145-8295.com d:\recycler\S-5-9-36-100032175-100015059-100019739-4642.com d:\recycler\S-7-4-43-100013396-100025670-100019746-7760.com d:\recycler\S-7-7-70-100008949-100029654-100012729-5929.com d:\recycler\S-8-0-51-100019683-100027961-100029316-2150.com d:\recycler\S-9-1-65-100007821-100023420-100031999-7591.com E:\Autorun.inf e:\recycler\S-0-1-93-100028228-100001004-100004361-7356.com e:\recycler\S-1-6-45-100022453-100020014-100030875-2633.com e:\recycler\S-1-9-86-100023641-100002383-100007641-7222.com e:\recycler\S-2-5-61-100006978-100008147-100027851-1486.com e:\recycler\S-3-5-71-100011109-100027856-100026146-5877.com e:\recycler\S-4-5-75-100016369-100005087-100021452-7548.com e:\recycler\S-4-7-61-100008775-100031098-100015738-7703.com e:\recycler\S-5-6-79-100029646-100014700-100029145-8295.com e:\recycler\S-5-9-36-100032175-100015059-100019739-4642.com e:\recycler\S-7-4-43-100013396-100025670-100019746-7760.com e:\recycler\S-7-7-70-100008949-100029654-100012729-5929.com e:\recycler\S-8-0-51-100019683-100027961-100029316-2150.com e:\recycler\S-9-1-65-100007821-100023420-100031999-7591.com F:\Autorun.inf f:\recycler\S-0-1-93-100028228-100001004-100004361-7356.com f:\recycler\S-1-6-45-100022453-100020014-100030875-2633.com f:\recycler\S-1-9-86-100023641-100002383-100007641-7222.com f:\recycler\S-2-5-61-100006978-100008147-100027851-1486.com f:\recycler\S-3-5-71-100011109-100027856-100026146-5877.com f:\recycler\S-4-5-75-100016369-100005087-100021452-7548.com f:\recycler\S-4-7-61-100008775-100031098-100015738-7703.com f:\recycler\S-5-6-79-100029646-100014700-100029145-8295.com f:\recycler\S-5-9-36-100032175-100015059-100019739-4642.com f:\recycler\S-7-4-43-100013396-100025670-100019746-7760.com f:\recycler\S-7-7-70-100008949-100029654-100012729-5929.com f:\recycler\S-8-0-51-100019683-100027961-100029316-2150.com f:\recycler\S-9-1-65-100007821-100023420-100031999-7591.com [color=blue]Zainfekowana kopia została znaleziona. Problem naprawiono Plik odzyskano z - [/COLOR] . ((((((((((((((((((((((((((((((((((((((( Sterowniki/Usługi ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Service_gaopdxserv.sys -------\Service_msliksurserv ((((((((((((((((((((((((( Pliki utworzone od 2009-01-07 do 2009-02-07 ))))))))))))))))))))))))))))))) . 2009-02-06 09:41 . 2009-02-06 09:41 <DIR> d-------- c:\windows\ERUNT 2009-02-06 09:34 . 2008-11-06 02:03 <DIR> d-------- C:\SDFix 2009-02-05 21:37 . 2006-08-31 16:26 <DIR> d--h----- c:\documents and settings\Administrator\Ustawienia lokalne 2009-02-05 21:37 . 2006-08-31 16:26 <DIR> d-------- c:\documents and settings\Administrator\Ulubione 2009-02-05 21:37 . 2006-08-31 14:31 <DIR> d--h----- c:\documents and settings\Administrator\Szablony 2009-02-05 21:37 . 2006-08-31 16:26 <DIR> d-------- c:\documents and settings\Administrator\Pulpit 2009-02-05 21:37 . 2006-08-31 16:26 <DIR> d-------- c:\documents and settings\Administrator\Moje dokumenty 2009-02-05 21:37 . 2006-08-31 16:26 <DIR> dr------- c:\documents and settings\Administrator\Menu Start 2009-02-05 21:37 . 2006-08-31 16:26 <DIR> dr-h----- c:\documents and settings\Administrator\Dane aplikacji 2009-02-05 21:37 . 2009-02-05 21:37 <DIR> d-------- c:\documents and settings\Administrator 2009-02-05 19:00 . 2009-02-05 19:00 <DIR> dr------- c:\documents and settings\NetworkService\Ulubione 2009-01-25 11:05 . 2009-01-25 11:05 <DIR> d-------- c:\documents and settings\Gość\Dane aplikacji\CyberLink 2009-01-15 09:37 . 2009-01-15 09:37 42,320 --a------ c:\windows\system32\xfcodec.dll . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-02-07 18:34 --------- d-----w c:\documents and settings\aaa\Dane aplikacji\Skype 2009-02-07 17:50 --------- d-----w c:\documents and settings\aaa\Dane aplikacji\skypePM 2009-02-07 09:51 --------- d-----w c:\program files\Winamp Remote 2009-02-06 17:39 --------- d-----w c:\program files\Eset 2009-02-05 09:06 --------- d-----w c:\documents and settings\aaa\Dane aplikacji\Xfire 2009-01-25 10:58 --------- d-----w c:\program files\Google 2009-01-14 19:41 --------- d-----w c:\program files\Common Files\Adobe 2009-01-05 19:32 --------- d-----w c:\documents and settings\Gość\Dane aplikacji\Corel 2009-01-05 19:27 --------- d-----w c:\documents and settings\Gość\Dane aplikacji\Sony Corporation 2008-12-22 19:03 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\TEMP 2008-12-22 18:09 --------- d-----w c:\program files\Common Files\AVSMedia 2008-12-22 18:09 --------- d-----w c:\program files\AVS4YOU 2008-12-22 18:02 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\AVS4YOU 2008-05-05 19:55 81,920 ----a-w c:\documents and settings\aaa\Dane aplikacji\ezpinst.exe 2008-05-05 19:55 47,360 ----a-w c:\documents and settings\aaa\Dane aplikacji\pcouffin.sys 2008-02-11 12:37 32 ----a-w c:\documents and settings\All Users\Dane aplikacji\ezsid.dat 2007-11-02 10:29 32 ----a-w c:\documents and settings\aaa\config.dat 2007-09-22 21:08 12,909,755 ----a-w c:\program files\kmp.exe 2007-09-20 18:52 22,328 ----a-w c:\documents and settings\aaa\Dane aplikacji\PnkBstrK.sys 2007-09-18 16:35 1,049,255 ----a-w c:\program files\wrar362pl.exe 2007-08-03 08:50 19,751,208 ----a-w c:\program files\SkypeSetup.exe 2007-03-19 18:13 6,422,611 ----a-w c:\program files\frostwire-4.13.1.6.windows.exe 2006-11-13 17:45 25,600 ----a-w c:\documents and settings\aaa\usbsermptxp.sys 2006-11-13 17:45 22,768 ----a-w c:\documents and settings\aaa\usbsermpt.sys 2004-10-01 13:00 40,960 ----a-w c:\program files\Uninstall_CDS.exe 2008-12-20 15:49 67,688 ----a-w c:\program files\mozilla firefox\components\jar50.dll 2008-12-20 15:49 54,368 ----a-w c:\program files\mozilla firefox\components\jsd3250.dll 2008-12-20 15:49 34,944 ----a-w c:\program files\mozilla firefox\components\myspell.dll 2008-12-20 15:49 46,712 ----a-w c:\program files\mozilla firefox\components\spellchk.dll 2008-12-20 15:49 172,136 ----a-w c:\program files\mozilla firefox\components\xpinstal.dll 2007-12-12 15:21 2,516 --sha-w c:\windows\system32\KGyGaAvL.sys . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Gadu-Gadu"="d:\gadu-gadu\gg.exe" [2007-07-09 2119104] "swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-09-11 68856] "Orb"="c:\program files\Winamp Remote\bin\OrbTray.exe" [2008-01-07 495616] "NBJ"="c:\program files\Ahead\Nero BackItUp\NBJ.exe" [2005-10-11 1961984] "MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2004-10-13 1694208] "ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648] "DAEMON Tools"="f:\gry\DAEMON Tools\daemon.exe" [2005-11-08 128920] "SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_02\bin\jusched.exe" [2007-07-12 132496] "SoundMAXPnP"="c:\program files\Analog Devices\Core\smax4pnp.exe" [2006-05-01 843776] "RemoteControl"="c:\program files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe" [2004-11-02 32768] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-06-01 7618560] "ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2004-06-16 81920] "ISUSPM Startup"="c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-06-16 221184] "avast!"="d:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2007-12-04 79224] "nwiz"="nwiz.exe" [2006-06-01 c:\windows\system32\nwiz.exe] "NvMediaCenter"="NvMCTray.dll" [2006-06-01 c:\windows\system32\nvmctray.dll] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-04 15360] c:\documents and settings\aaa\Menu Start\Programy\Autostart\ Picture Motion Browser Media Check Tool.lnk - d:\volumewatcher\SPUVolumeWatcher.exe [2007-04-02 344064] c:\documents and settings\All Users\Menu Start\Programy\Autostart\ Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe [2006-10-23 40048] Adobe Reader Synchronizer.lnk - c:\program files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe [2006-10-23 734872] UniSpiker-2.6.lnk - d:\program files\Syntezator Mowy\DEMO\UniSpiker-2.6\uni_spiker-2.6.exe [2007-09-21 86016] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "vidc.ffds"= ffdshow.ax "VIDC.XFR1"= xfcodec.dll [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\Infogrames\\Line of Sight - Vietnam\\Vietnam.exe"= "d:\\Program Files\\BearShare Applications\\BearShare\\BearShare.exe"= "c:\\Program Files\\eMule\\emule.exe"= "d:\\Gadu-Gadu\\gg.exe"= "c:\\WINDOWS\\system32\\PnkBstrA.exe"= "c:\\WINDOWS\\system32\\PnkBstrB.exe"= "d:\\totalcmd\\TOTALCMD.EXE"= "d:\\Program Files\\Flash.exe"= "c:\\Program Files\\Winamp Remote\\bin\\Orb.exe"= "c:\\Program Files\\Winamp Remote\\bin\\OrbTray.exe"= "c:\\Program Files\\Winamp Remote\\bin\\OrbStreamerClient.exe"= "c:\\WINDOWS\\system32\\dplaysvr.exe"= "c:\\Documents and Settings\\aaa\\Pulpit\\siatkówka\\volley.exe"= "c:\\Program Files\\CyberLink\\PowerDirector\\PDR.exe"= "d:\\Program Files\\Call of Duty 5\\CoDWaWmp.exe"= "d:\\Program Files\\Call of Duty 5\\CoDWaW.exe"= "d:\\Program Files\\Soldier of Fortune II\\sof2mp.exe"= "d:\\Program Files\\XFire\\xfire.exe"= "d:\\Program Files\\Medal of Honor Airborne\\UnrealEngine3\\Binaries\\MOHA.exe"= "c:\\Program Files\\Skype\\Phone\\Skype.exe"= R2 Vcs;Vcs support;c:\windows\system32\drivers\Vcs.sys [2008-08-21 6852] S3 Asushwio;Asushwio;c:\windows\system32\drivers\ASUSHWIO.SYS [2006-08-31 5824] . - - - - USUNIĘTO PUSTE WPISY - - - - BHO-{100EB1FD-D03E-47FD-81F3-EE91287F9465} - c:\program files\ShoppingReport\Bin\2.0.22\ShoppingReport.dll BHO-{500BCA15-57A7-4eaf-8143-8C619470B13D} - c:\windows\system32\msxml71.dll HKCU-Run-Expressivo - c:\program files\ivo\Expressivo Demo\expressivo.exe HKCU-Run-PowerBar - (no file) . ------- Skan uzupełniający ------- . uStart Page = hxxp://google.pl/ uSearch Page = hxxp://www.google.com uSearch Bar = hxxp://www.google.com/ie mDefault_Search_URL = hxxp://www.google.com/ie uInternet Connection Wizard,ShellNext = iexplore uSearchAssistant = hxxp://www.google.com/ie uSearchURL,(Default) = hxxp://www.google.com/search?q=%s mSearchAssistant = hxxp://www.google.com/ie IE: E&ksport do programu Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 IE: E&ksportuj do programu Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000 IE: {{C5428486-50A0-4a02-9D20-520B59A9F9B2} - {C9CCBB35-D123-4a31-AFFC-9B2933132116} - c:\program files\ShoppingReport\Bin\2.0.22\ShoppingReport.dll IE: {{C5428486-50A0-4a02-9D20-520B59A9F9B3} - {A16AD1E9-F69A-45af-9462-B1C286708842} - c:\program files\ShoppingReport\Bin\2.0.22\ShoppingReport.dll FF - ProfilePath - c:\documents and settings\aaa\Dane aplikacji\Mozilla\Firefox\Profiles\7d7zwtf1.default\ FF - prefs.js: browser.startup.homepage - hxxp://www.zdunska-wola.yoyo.pl/index.php FF - component: c:\program files\Mozilla Firefox\components\xpinstal.dll . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-02-07 19:33:47 Windows 5.1.2600 Dodatek Service Pack 2 NTFS skanowanie ukrytych procesów ... skanowanie ukrytych wpisów autostartu ... skanowanie ukrytych plików ... skanowanie pomyślnie ukończone ukryte pliki: 0 ************************************************************************** . --------------------- ZABLOKOWANE KLUCZE REJESTRU --------------------- [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32*] "ThreadingModel"="Apartment" @="c:\\WINDOWS\\system32\\OLE32.DLL" "cd042efbbd7f7af1647644e76e06692b"=hex:e2,63,26,f1,3f,c8,ff,68,f6,56,51,c9,36, 94,90,9a,c8,28,51,af,b0,29,a3,98,ea,27,77,a2,65,9e,c1,90,e2,63,26,f1,3f,c8,\ [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{604BB98A-A94F-4a5c-A67C-D8D3582C741C}\InprocServer32*] "ThreadingModel"="Apartment" @="c:\\WINDOWS\\system32\\OLE32.DLL" "bca643cdc5c2726b20d2ecedcc62c59b"=hex:46,47,15,b0,92,4b,c7,ef,1f,57,1b,fc,7e, 75,6c,08,71,3b,04,66,8b,46,0d,96,ea,67,ca,4a,d9,85,a4,b3,6a,9c,d6,61,af,45,\ [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{684373FB-9CD8-4e47-B990-5A4466C16034}\InprocServer32*] "ThreadingModel"="Apartment" @="c:\\WINDOWS\\system32\\OLE32.DLL" "2c81e34222e8052573023a60d06dd016"=hex:25,da,ec,7e,55,20,c9,26,aa,01,82,f0,f9, 06,01,b9,25,da,ec,7e,55,20,c9,26,00,bf,59,72,35,66,21,ff,ff,7c,85,e0,43,d4,\ [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{74554CCD-F60F-4708-AD98-D0152D08C8B9}\InprocServer32*] "ThreadingModel"="Apartment" @="c:\\WINDOWS\\system32\\OLE32.DLL" "2582ae41fb52324423be06337561aa48"=hex:3e,1e,9e,e0,57,5a,93,61,51,48,84,44,e0, 8b,52,6f,3e,1e,9e,e0,57,5a,93,61,15,53,6a,43,03,5f,e5,8d,86,8c,21,01,be,91,\ [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{7EB537F9-A916-4339-B91B-DED8E83632C0}\InprocServer32*] "ThreadingModel"="Apartment" @="c:\\WINDOWS\\system32\\OLE32.DLL" "caaeda5fd7a9ed7697d9686d4b818472"=hex:cd,44,cd,b9,a6,33,6c,cd,47,5e,97,54,45, b9,1b,75,cd,44,cd,b9,a6,33,6c,cd,50,31,73,52,b8,0b,0e,fd,f5,1d,4d,73,a8,13,\ [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{948395E8-7A56-4fb1-843B-3E52D94DB145}\InprocServer32*] "ThreadingModel"="Apartment" @="c:\\WINDOWS\\system32\\OLE32.DLL" "a4a1bcf2cc2b8bc3716b74b2b4522f5d"=hex:50,93,e5,ab,ec,6a,4e,ab,a0,92,00,90,7d, ba,7d,e1,b0,18,ed,a7,3f,8d,37,a4,29,df,4e,31,d5,08,7d,95,df,20,58,62,78,6b,\ [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}\InprocServer32*] "ThreadingModel"="Apartment" @="c:\\WINDOWS\\system32\\OLE32.DLL" "4d370831d2c43cd13623e232fed27b7b"=hex:fb,a7,78,e6,12,2f,9a,ea,fc,dd,9e,d7,12, ad,f3,19,31,77,e1,ba,b1,f8,68,02,2c,ce,c3,dd,ef,9b,1c,aa,fb,a7,78,e6,12,2f,\ [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{DE5654CA-EB84-4df9-915B-37E957082D6D}\InprocServer32*] "ThreadingModel"="Apartment" @="c:\\WINDOWS\\system32\\OLE32.DLL" "1d68fe701cdea33e477eb204b76f993d"=hex:aa,52,c6,00,84,3c,26,64,16,41,51,b1,75, 21,93,aa,83,6c,56,8b,a0,85,96,ab,4f,a0,0b,08,2a,5c,4b,e8,01,3a,48,fc,e8,04,\ [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{E39C35E8-7488-4926-92B2-2F94619AC1A5}\InprocServer32*] "ThreadingModel"="Apartment" @="c:\\WINDOWS\\system32\\OLE32.DLL" "1fac81b91d8e3c5aa4b0a51804d844a3"=hex:f6,0f,4e,58,98,5b,89,c9,cc,97,f0,f6,9f, 49,8c,6a,51,fa,6e,91,28,9e,14,cc,4c,fa,97,e8,e1,90,e1,5e,f6,0f,4e,58,98,5b,\ [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}\InprocServer32*] "ThreadingModel"="Apartment" @="c:\\WINDOWS\\system32\\OLE32.DLL" "f5f62a6129303efb32fbe080bb27835b"=hex:b1,cd,45,5a,a8,c4,f8,b9,a9,3a,bb,6c,13, 6b,c4,51,b1,cd,45,5a,a8,c4,f8,b9,8e,dd,c4,37,75,55,b1,95,3d,ce,ea,26,2d,45,\ [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}\InprocServer32*] "ThreadingModel"="Apartment" @="c:\\WINDOWS\\system32\\OLE32.DLL" "fd4e2e1a3940b94dceb5a6a021f2e3c6"=hex:f8,31,0f,a9,5f,a0,ec,fb,ef,40,8c,fa,2d, 15,9d,ec,e3,0e,66,d5,eb,bc,2f,6b,a1,4a,f6,34,53,66,d9,6d,2a,b7,cc,b5,b9,7f,\ [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}\InprocServer32*] "ThreadingModel"="Apartment" @="c:\\WINDOWS\\system32\\OLE32.DLL" "8a8aec57dd6508a385616fbc86791ec2"=hex:6c,43,2d,1e,aa,22,2f,9c,53,9b,2c,f1,9b, af,56,8a,fa,ea,66,7f,d4,3b,6b,70,f6,30,32,7c,27,51,0d,83,6c,43,2d,1e,aa,22,\ . ------------------------ Pozostałe uruchomione procesy ------------------------ . d:\program files\Alwil Software\Avast4\aswUpdSv.exe d:\program files\Alwil Software\Avast4\ashServ.exe c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE d:\program files\Pinnacle\MediaServer\Microsoft SQL Server\MSSQL$PINNACLESYS\Binn\sqlservr.exe c:\windows\system32\nvsvc32.exe d:\program files\Medal of Honor Airborne\UnrealEngine3\MOHAGame\pb\PnkBstrA.exe c:\windows\system32\PnkBstrB.exe c:\program files\CyberLink\Shared Files\RichVideo.exe c:\windows\system32\rundll32.exe c:\program files\Skype\Phone\Skype.exe c:\program files\Winamp Remote\bin\Orb.exe . ************************************************************************** . Czas ukończenia: 2009-02-07 19:36:57 - komputer został uruchomiony ponownie [aaa] ComboFix-quarantined-files.txt 2009-02-07 18:36:43 Przed: 5,013,798,912 bajtów wolnych Po: 8,959,483,904 bajtów wolnych WindowsXP-KB310994-SP2-Home-BootDisk-PLK.exe [boot loader] timeout=2 default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS [operating systems] c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /fastdetect /NoExecute=OptIn Current=1 Default=1 Failed=0 LastKnownGood=5 Sets=1,2,3,4,5 321 --- E O F --- 2008-09-21 21:42:09

log z HijackThis

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 19:43:44, on 2009-02-07 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe D:\Program Files\Alwil Software\Avast4\aswUpdSv.exe D:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE D:\Program Files\Pinnacle\MediaServer\Microsoft SQL Server\MSSQL$PINNACLESYS\Binn\sqlservr.exe C:\WINDOWS\system32\nvsvc32.exe D:\Program Files\Medal of Honor Airborne\UnrealEngine3\MOHAGame\pb\PnkBstrA.exe C:\WINDOWS\system32\PnkBstrB.exe C:\Program Files\CyberLink\Shared Files\RichVideo.exe F:\GRY\DAEMON Tools\daemon.exe C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe C:\Program Files\Analog Devices\Core\smax4pnp.exe C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe D:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe D:\Gadu-Gadu\gg.exe C:\WINDOWS\system32\RUNDLL32.EXE C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe C:\Program Files\Winamp Remote\bin\OrbTray.exe C:\Program Files\Messenger\msmsgs.exe C:\WINDOWS\system32\ctfmon.exe D:\Program Files\Syntezator Mowy\DEMO\UniSpiker-2.6\uni_spiker-2.6.exe D:\VolumeWatcher\SPUVolumeWatcher.exe C:\Program Files\Winamp Remote\bin\Orb.exe C:\WINDOWS\system32\wuauclt.exe C:\WINDOWS\explorer.exe C:\Program Files\Mozilla Firefox\firefox.exe D:\Program Files\Alwil Software\Avast4\ashMaiSv.exe D:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\Documents and Settings\aaa\Pulpit\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.pl/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza R3 - URLSearchHook: (no name) - {1BB22D38-A411-4B13-A746-C2A4F4EC7344} - (no file) R3 - URLSearchHook: Share Accelerator MM Toolbar - {4596013b-6c31-408b-a266-deae5c086dc2} - C:\Program Files\Share_Accelerator_MM\tbSha0.dll O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: Share Accelerator MM Toolbar - {4596013b-6c31-408b-a266-deae5c086dc2} - C:\Program Files\Share_Accelerator_MM\tbSha0.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.0.926.3450\swg.dll O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_219B3E1547538286.dll O3 - Toolbar: BearShare MediaBar - {D3DEE18F-DB64-4BEB-9FF1-E1F0A5033E4A} - C:\Program Files\BearShare applications\BearShare MediaBar\MediaBar.dll (file missing) O3 - Toolbar: Share Accelerator MM Toolbar - {4596013b-6c31-408b-a266-deae5c086dc2} - C:\Program Files\Share_Accelerator_MM\tbSha0.dll O3 - Toolbar: &Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [DAEMON Tools] "F:\GRY\DAEMON Tools\daemon.exe" -lang 1033 O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe" O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup O4 - HKLM\..\Run: [avast!] D:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKCU\..\Run: [Gadu-Gadu] "D:\Gadu-Gadu\gg.exe" /tray O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe O4 - HKCU\..\Run: [Orb] "C:\Program Files\Winamp Remote\bin\OrbTray.exe" /background O4 - HKCU\..\Run: [NBJ] "C:\Program Files\Ahead\Nero BackItUp\NBJ.exe" O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Startup: Picture Motion Browser Media Check Tool.lnk = D:\VolumeWatcher\SPUVolumeWatcher.exe O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe O4 - Global Startup: Adobe Reader Synchronizer.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe O4 - Global Startup: UniSpiker-2.6.lnk = ? O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O8 - Extra context menu item: E&ksportuj do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: ShopperReports - Compare product prices - {C5428486-50A0-4a02-9D20-520B59A9F9B2} - C:\Program Files\ShoppingReport\Bin\2.0.22\ShoppingReport.dll (file missing) O9 - Extra button: ShopperReports - Compare travel rates - {C5428486-50A0-4a02-9D20-520B59A9F9B3} - C:\Program Files\ShoppingReport\Bin\2.0.22\ShoppingReport.dll (file missing) O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - D:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - ALWIL Software - D:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - D:\Program Files\Alwil Software\Avast4\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - D:\Program Files\Alwil Software\Avast4\ashWebSv.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: PunkBuster (PnkBstrA) - Unknown owner - D:\Program Files\Medal of Honor Airborne\UnrealEngine3\MOHAGame\pb\PnkBstrA.exe O23 - Service: PnkBstrB - Unknown owner - C:\WINDOWS\system32\PnkBstrB.exe O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe O24 - Desktop Component 0: (no name) - file:///C:/DOCUME~1/aaa/USTAWI~1/Temp/msohtml1/02/clip_image002.jpg O24 - Desktop Component 1: (no name) - file:///C:/DOCUME~1/aaa/USTAWI~1/Temp/msohtml1/01/clip_image002.jpg -- End of file - 8581 bytes

Dyski już mi działają oki, wielkie dzięki wszystkim :banan:

**Posty:** 18165 · przez **wojtas** 08 Lut 2009, 17:05

1. Ściągnij OTMoveIt i go włacz i odpal go z opcji CleanUp

oraz skasuj folder C:\Qoobox
2. wykonaj optymalizację windowsa
3.sciagnij ATF_Cleaner
zaznacz
Windows Temp
All users Temp
Temporary internet files
Recycle Bin
i wcisnij EMPTY SELECTED
4.Wyłącz przywracanie systemu ( właściwości mój komputer-zakładka przywracanie - wyłącz przywracanie na wszystkich dyskach). Po chwili włącz je powrotem
5. Wykonaj skan Dr. Web CureIt
6. Przeskanuj obszar mojego komputera http://www.kaspersky.pl/virusscanner.html (uruchom przez IE) Daj raport z niego na forum.

i tym:

FixIEDef.