nie otwiera się 70% stron w przeglądarce.reszta sieci działa

**Posty:** 244 · przez **L_Devil** 05 Lis 2006, 20:22

Nie otwiera mi się 70% stron w przeglądarce, także tych znanych (np. www.deviantart.com ). Podejrzewam wirusa, lub inne malware. Oto log HiJackThis:

Kod: Zaznacz wszystko: Logfile of HijackThis v1.99.1 Scan saved at 18:46:24, on 2006-11-05 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: G:\WINDOWS\System32\smss.exe G:\WINDOWS\system32\winlogon.exe G:\WINDOWS\system32\services.exe G:\WINDOWS\system32\lsass.exe G:\WINDOWS\system32\svchost.exe G:\WINDOWS\System32\svchost.exe G:\WINDOWS\system32\spoolsv.exe G:\WINDOWS\Explorer.EXE G:\Program Files\Common Files\Symantec Shared\ccApp.exe F:\iTunes\iTunesHelper.exe G:\Program Files\QuickTime\qttask.exe G:\Program Files\Java\jre1.5.0_06\bin\jusched.exe G:\WINDOWS\system32\RUNDLL32.EXE G:\WINDOWS\RTHDCPL.EXE G:\Program Files\Common Files\InstallShield\UpdateService\issch.exe G:\Program Files\Messenger\msmsgs.exe G:\WINDOWS\system32\ctfmon.exe F:\InterVideo\Common\Bin\WinCinemaMgr.exe J:\Program Files\Apache Group\Apache2\bin\ApacheMonitor.exe G:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe G:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe G:\Program Files\Common Files\Symantec Shared\ccProxy.exe G:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe F:\Norton Internet Security\ISSVC.exe G:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE F:\3dsMax8\mentalray\satellite\raysat_3dsmax8server.exe J:\mysql\bin\mysqld-nt.exe F:\Norton Internet Security\Norton AntiVirus\navapsvc.exe G:\WINDOWS\System32\nvsvc32.exe G:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe G:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe G:\WINDOWS\System32\svchost.exe F:\VMware\VMware Workstation\vmware-authd.exe G:\WINDOWS\system32\vmnat.exe G:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe G:\WINDOWS\system32\vmnetdhcp.exe G:\Program Files\iPod\bin\iPodService.exe G:\WINDOWS\system32\wscntfy.exe F:\Norton Internet Security\Norton AntiVirus\SAVScan.exe G:\WINDOWS\System32\svchost.exe F:\Gadu-Gadu\gg.exe G:\Program Files\Windows Media Player\wmplayer.exe F:\FIREFOX\firefox.exe J:\Piotrek\Programy\HiJackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - G:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O2 - BHO: Norton Internet Security - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - G:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - F:\Norton Internet Security\Norton AntiVirus\NavShExt.dll O3 - Toolbar: Norton Internet Security - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - G:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - F:\Norton Internet Security\Norton AntiVirus\NavShExt.dll O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE G:\WINDOWS\System32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [ccApp] "G:\Program Files\Common Files\Symantec Shared\ccApp.exe" O4 - HKLM\..\Run: [NeroFilterCheck] G:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [Symantec NetDriver Monitor] G:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE O4 - HKLM\..\Run: [iTunesHelper] "F:\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [QuickTime Task] "G:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [SunJavaUpdateSched] G:\Program Files\Java\jre1.5.0_06\bin\jusched.exe O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE G:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE O4 - HKLM\..\Run: [ISUSPM Startup] G:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup O4 - HKLM\..\Run: [ISUSScheduler] "G:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k O4 - HKCU\..\Run: [MSMSGS] "G:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [ctfmon.exe] G:\WINDOWS\system32\ctfmon.exe O4 - Startup: WinMySQLadmin.lnk = J:\mysql\bin\winmysqladmin.exe O4 - Global Startup: Adobe Gamma Loader.lnk = G:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: InterVideo WinCinema Manager.lnk = F:\InterVideo\Common\Bin\WinCinemaMgr.exe O4 - Global Startup: Monitor Apache Servers.lnk = J:\Program Files\Apache Group\Apache2\bin\ApacheMonitor.exe O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://F:\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - G:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - G:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - F:\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - G:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - G:\Program Files\Messenger\msmsgs.exe O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - G:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll O23 - Service: Adobe LM Service - Adobe Systems - G:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: Apache2 - Unknown owner - J:\Program Files\Apache Group\Apache2\bin\Apache.exe" -k runservice (file missing) O23 - Service: Autodesk Licensing Service - Autodesk - G:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - G:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - G:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - G:\Program Files\Common Files\Symantec Shared\ccProxy.exe O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - G:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - G:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe O23 - Service: COM+ Alerter Service - Unknown owner - G:\WINDOWS\system32\altsvc.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - G:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPodService - Apple Computer, Inc. - G:\Program Files\iPod\bin\iPodService.exe O23 - Service: ISSvc (ISSVC) - Symantec Corporation - F:\Norton Internet Security\ISSVC.exe O23 - Service: LiveUpdate - Symantec Corporation - G:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE O23 - Service: Macromedia Licensing Service - Unknown owner - G:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe O23 - Service: RaySat_3dsmax8 Server (mi-raysat_3dsmax8) - Unknown owner - F:\3dsMax8\mentalray\satellite\raysat_3dsmax8server.exe O23 - Service: MySql - Unknown owner - J:/mysql/bin/mysqld-nt.exe O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - F:\Norton Internet Security\Norton AntiVirus\navapsvc.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - G:\WINDOWS\System32\nvsvc32.exe O23 - Service: SAVScan - Symantec Corporation - F:\Norton Internet Security\Norton AntiVirus\SAVScan.exe O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - G:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - G:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - G:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe O23 - Service: VMware Authorization Service (VMAuthdService) - VMware, Inc. - F:\VMware\VMware Workstation\vmware-authd.exe O23 - Service: VMware DHCP Service (VMnetDHCP) - VMware, Inc. - G:\WINDOWS\system32\vmnetdhcp.exe O23 - Service: VMware NAT Service - VMware, Inc. - G:\WINDOWS\system32\vmnat.exe

Edit
Dorzucam jeszcze logi z SB:

Kod: Zaznacz wszystko: "Silent Runners.vbs", revision 48, http://www.silentrunners.org/ Operating System: Windows XP SP2 Output limited to non-default values, except where indicated by "{++}" Startup items buried in registry: --------------------------------- HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++} "MSMSGS" = ""G:\Program Files\Messenger\msmsgs.exe" /background" [MS] "ctfmon.exe" = "G:\WINDOWS\system32\ctfmon.exe" [MS] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++} "NvCplDaemon" = "RUNDLL32.EXE G:\WINDOWS\System32\NvCpl.dll,NvStartup" [MS] "nwiz" = "nwiz.exe /install" ["NVIDIA Corporation"] "ccApp" = ""G:\Program Files\Common Files\Symantec Shared\ccApp.exe"" ["Symantec Corporation"] "NeroFilterCheck" = "G:\WINDOWS\system32\NeroCheck.exe" ["Ahead Software Gmbh"] "Symantec NetDriver Monitor" = "G:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer" ["Symantec Corporation"] "SkyTel" = "SkyTel.EXE" ["Realtek Semiconductor Corp."] "iTunesHelper" = ""F:\iTunes\iTunesHelper.exe"" ["Apple Computer, Inc."] "QuickTime Task" = ""G:\Program Files\QuickTime\qttask.exe" -atboottime" ["Apple Computer, Inc."] "SunJavaUpdateSched" = "G:\Program Files\Java\jre1.5.0_06\bin\jusched.exe" ["Sun Microsystems, Inc."] "NvMediaCenter" = "RUNDLL32.EXE G:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit" [MS] "RTHDCPL" = "RTHDCPL.EXE" ["Realtek Semiconductor Corp."] "Alcmtr" = "ALCMTR.EXE" ["Realtek Semiconductor Corp."] "ISUSPM Startup" = "G:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup" ["InstallShield Software Corporation"] "ISUSScheduler" = ""G:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start" ["InstallShield Software Corporation"] "KernelFaultCheck" = "%systemroot%\system32\dumprep 0 -k" [MS] HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ {761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\(Default) = (no title provided) -> {HKLM...CLSID} = "SSVHelper Class" \InProcServer32\(Default) = "G:\Program Files\Java\jre1.5.0_06\bin\ssv.dll" ["Sun Microsystems, Inc."] {9ECB9560-04F9-4bbc-943D-298DDF1699E1}\(Default) = "Norton Internet Security" -> {HKLM...CLSID} = "CNisExtBho Class" \InProcServer32\(Default) = "G:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll" ["Symantec Corporation"] {BDF3E430-B101-42AD-A544-FADC6B084872}\(Default) = "NAV Helper" -> {HKLM...CLSID} = "CNavExtBho Class" \InProcServer32\(Default) = "F:\Norton Internet Security\Norton AntiVirus\NavShExt.dll" ["Symantec Corporation"] HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\ "{42071714-76d4-11d1-8b24-00a0c9068ff3}" = "Rozszerzenie CPL kadrowania wyświetlania" -> {HKLM...CLSID} = "Rozszerzenie CPL kadrowania wyświetlania" \InProcServer32\(Default) = "deskpan.dll" [file not found] "{88895560-9AA2-1069-930E-00AA0030EBC8}" = "Rozszerzenie ikony HyperTerminalu" -> {HKLM...CLSID} = "HyperTerminal Icon Ext" \InProcServer32\(Default) = "G:\WINDOWS\System32\hticons.dll" ["Hilgraeve, Inc."] "{A70C977A-BF00-412C-90B7-034C51DA2439}" = "NvCpl DesktopContext Class" -> {HKLM...CLSID} = "DesktopContext Class" \InProcServer32\(Default) = "G:\WINDOWS\System32\nvcpl.dll" ["NVIDIA Corporation"] "{1CDB2949-8F65-4355-8456-263E7C208A5D}" = "Desktop Explorer" -> {HKLM...CLSID} = "Desktop Explorer" \InProcServer32\(Default) = "G:\WINDOWS\System32\nvshell.dll" ["NVIDIA Corporation"] "{1E9B04FB-F9E5-4718-997B-B8DA88302A47}" = "Desktop Explorer Menu" -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "G:\WINDOWS\System32\nvshell.dll" ["NVIDIA Corporation"] "{1E9B04FB-F9E5-4718-997B-B8DA88302A48}" = "nView Desktop Context Menu" -> {HKLM...CLSID} = "nView Desktop Context Menu" \InProcServer32\(Default) = "G:\WINDOWS\System32\nvshell.dll" ["NVIDIA Corporation"] "{00020D75-0000-0000-C000-000000000046}" = "Microsoft Office Outlook Desktop Icon Handler" -> {HKLM...CLSID} = "Microsoft Office Outlook" \InProcServer32\(Default) = "F:\MICROS~2\OFFICE11\MLSHEXT.DLL" [MS] "{0006F045-0000-0000-C000-000000000046}" = "Microsoft Office Outlook Custom Icon Handler" -> {HKLM...CLSID} = "Rozszerzenie ikon plików programu Outlook" \InProcServer32\(Default) = "F:\MICROS~2\OFFICE11\OLKFSTUB.DLL" [MS] "{42042206-2D85-11D3-8CFF-005004838597}" = "Microsoft Office HTML Icon Handler" -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "F:\Microsoft Office\OFFICE11\msohev.dll" [MS] "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" = "WinRAR shell extension" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "F:\WinRAR\rarext.dll" [null data] "{32020A01-506E-484D-A2A8-BE3CF17601C3}" = "AlcoholShellEx" -> {HKLM...CLSID} = "AlcoholShellEx" \InProcServer32\(Default) = "F:\ALCOHO~1\ALCOHO~1\AXShlEx.dll" ["Alcohol Soft Development Team"] "{6B19FEC2-A45B-11CF-9045-00A0C9039735}" = "Registered ActiveX Controls" -> {HKLM...CLSID} = "Registered ActiveX Controls" \InProcServer32\(Default) = "F:\Microsoft Visual Studio\Common\MSDev98\Bin\IDE\DEVXPGL.DLL" [MS] "{D545EBD1-BD92-11CF-8772-00A0C9039735}" = "Developer Studio Components" -> {HKLM...CLSID} = "Developer Studio Components" \InProcServer32\(Default) = "F:\Microsoft Visual Studio\Common\MSDev98\Bin\IDE\DEVXPGL.DLL" [MS] "{B9E1D2CB-CCFF-4AA6-9579-D7A4754030EF}" = "iTunes" -> {HKLM...CLSID} = "iTunes" \InProcServer32\(Default) = "F:\iTunes\iTunesMiniPlayer.dll" ["Apple Computer, Inc."] "{e82a2d71-5b2f-43a0-97b8-81be15854de8}" = "ShellLink for Application References" -> {HKLM...CLSID} = "ShellLink for Application References" \InProcServer32\(Default) = "G:\WINDOWS\system32\dfshim.dll" [MS] "{E37E2028-CE1A-4f42-AF05-6CEABC4E5D75}" = "Shell Icon Handler for Application References" -> {HKLM...CLSID} = "Shell Icon Handler for Application References" \InProcServer32\(Default) = "G:\WINDOWS\system32\dfshim.dll" [MS] "{FFB699E0-306A-11d3-8BD1-00104B6F7516}" = "Play on my TV helper" -> {HKLM...CLSID} = "NVIDIA CPL Extension" \InProcServer32\(Default) = "G:\WINDOWS\System32\nvcpl.dll" ["NVIDIA Corporation"] "{640167b4-59b0-47a6-b335-a6b3c0695aea}" = "Portable Media Devices" -> {HKLM...CLSID} = "Portable Media Devices" \InProcServer32\(Default) = "G:\WINDOWS\system32\Audiodev.dll" [MS] "{cc86590a-b60a-48e6-996b-41d25ed39a1e}" = "Portable Media Devices Menu" -> {HKLM...CLSID} = "Portable Media Devices Menu" \InProcServer32\(Default) = "G:\WINDOWS\system32\Audiodev.dll" [MS] "{6DEA92E9-8682-4b6a-97DE-354772FE5727}" = "Autodesk DWF Preview" -> {HKLM...CLSID} = "ACDWFTHMBPRXY" \InProcServer32\(Default) = "G:\Program Files\Common Files\Autodesk Shared\AcDwfThmbPrxy16.dll" ["Autodesk"] HKLM\Software\Classes\PROTOCOLS\Filter\ INFECTION WARNING! text/xml\CLSID = "{807553E5-5146-11D5-A672-00B0D022E945}" -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "G:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL" [MS] HKLM\Software\Classes\Folder\shellex\ColumnHandlers\ {F9DB5320-233E-11D1-9F84-707F02C10627}\(Default) = "PDF Column Info" -> {HKLM...CLSID} = "PDF Shell Extension" \InProcServer32\(Default) = "F:\Adobe Reader 7.0\ActiveX\PDFShell.dll" ["Adobe Systems, Inc."] HKLM\Software\Classes\*\shellex\ContextMenuHandlers\ Symantec.Norton.Antivirus.IEContextMenu\(Default) = "{5345A4D5-41EB-4A2F-9616-CE1D4F6C35B2}" -> {HKLM...CLSID} = "IEContextMenu Class" \InProcServer32\(Default) = "F:\Norton Internet Security\Norton AntiVirus\NavShExt.dll" ["Symantec Corporation"] WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "F:\WinRAR\rarext.dll" [null data] HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\ Convert\(Default) = "{9f95ca1a-e80e-4c0f-acd1-4c9b7900b982}" -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "F:\Microsoft DirectX 9.0 SDK (Summer 2004)\Utilities\txview.dll" [null data] WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "F:\WinRAR\rarext.dll" [null data] HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\ Symantec.Norton.Antivirus.IEContextMenu\(Default) = "{5345A4D5-41EB-4A2F-9616-CE1D4F6C35B2}" -> {HKLM...CLSID} = "IEContextMenu Class" \InProcServer32\(Default) = "F:\Norton Internet Security\Norton AntiVirus\NavShExt.dll" ["Symantec Corporation"] WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "F:\WinRAR\rarext.dll" [null data] Active Desktop and Wallpaper: ----------------------------- Active Desktop is disabled at this entry: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState HKCU\Control Panel\Desktop\ "Wallpaper" = "G:\Documents and Settings\Piotrek\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp" Startup items in "Piotrek" & "All Users" startup folders: --------------------------------------------------------- G:\Documents and Settings\Piotrek\Menu Start\Programy\Autostart "WinMySQLadmin" -> shortcut to: "J:\mysql\bin\winmysqladmin.exe" ["MySQL AB"] G:\Documents and Settings\All Users\Menu Start\Programy\Autostart "Adobe Gamma Loader" -> shortcut to: "G:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe" ["Adobe Systems, Inc."] "InterVideo WinCinema Manager" -> shortcut to: "F:\InterVideo\Common\Bin\WinCinemaMgr.exe" ["InterVideo Inc."] "Monitor Apache Servers" -> shortcut to: "J:\Program Files\Apache Group\Apache2\bin\ApacheMonitor.exe" ["Apache Software Foundation"] Enabled Scheduled Tasks: ------------------------ "Norton AntiVirus - Scan my computer - Piotrek" -> launches: "F:\NORTON~1\NORTON~1\Navw32.exe /task:"G:\Documents and Settings\All Users\Dane aplikacji\Symantec\Norton AntiVirus\Tasks\mycomp.sca"" ["Symantec Corporation"] "Symantec NetDetect" -> launches: "G:\Program Files\Symantec\LiveUpdate\NDetect.exe" [file not found] Winsock2 Service Provider DLLs: ------------------------------- Namespace Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++} 000000000001\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS] 000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS] 000000000003\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS] Transport Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++} 0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range: %SystemRoot%\system32\mswsock.dll [MS], 01 - 03, 06 - 19 %SystemRoot%\system32\rsvpsp.dll [MS], 04 - 05 Toolbars, Explorer Bars, Extensions: ------------------------------------ Toolbars HKCU\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ "{42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6}" -> {HKLM...CLSID} = "Norton AntiVirus" \InProcServer32\(Default) = "F:\Norton Internet Security\Norton AntiVirus\NavShExt.dll" ["Symantec Corporation"] HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\ "{0B53EAC3-8D69-4B9E-9B19-A37C9A5676A7}" -> {HKLM...CLSID} = "Norton Internet Security" \InProcServer32\(Default) = "G:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll" ["Symantec Corporation"] HKLM\Software\Microsoft\Internet Explorer\Toolbar\ "{0B53EAC3-8D69-4B9E-9B19-A37C9A5676A7}" = "Norton Internet Security" -> {HKLM...CLSID} = "Norton Internet Security" \InProcServer32\(Default) = "G:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll" ["Symantec Corporation"] "{42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6}" = "Norton AntiVirus" -> {HKLM...CLSID} = "Norton AntiVirus" \InProcServer32\(Default) = "F:\Norton Internet Security\Norton AntiVirus\NavShExt.dll" ["Symantec Corporation"] Explorer Bars Dormant Explorer Bars in "View, Explorer Bar" menu HKLM\Software\Classes\CLSID\{FF059E31-CC5A-4E2E-BF3B-96E929D65503}\(Default) = "&Badanie" Implemented Categories\{00021493-0000-0000-C000-000000000046}\ [vertical bar] InProcServer32\(Default) = "F:\MICROS~2\OFFICE11\REFIEBAR.DLL" [MS] Extensions (Tools menu items, main toolbar menu buttons) HKLM\Software\Microsoft\Internet Explorer\Extensions\ {08B0E5C0-4FCB-11CF-AAA5-00401C608501}\ "MenuText" = "Sun Java Console" "CLSIDExtension" = "{CAFEEFAC-0015-0000-0006-ABCDEFFEDCBC}" -> {HKCU...CLSID} = "Java Plug-in" \InProcServer32\(Default) = "G:\Program Files\Java\jre1.5.0_06\bin\ssv.dll" ["Sun Microsystems, Inc."] -> {HKLM...CLSID} = "Java Plug-in 1.5.0_06" \InProcServer32\(Default) = "G:\Program Files\Java\jre1.5.0_06\bin\npjpi150_06.dll" ["Sun Microsystems, Inc."] {92780B25-18CC-41C8-B9BE-3C9C571A8263}\ "ButtonText" = "Badanie" {FB5F1910-F110-11D2-BB9E-00C04F795683}\ "ButtonText" = "Messenger" "MenuText" = "Windows Messenger" "Exec" = "G:\Program Files\Messenger\msmsgs.exe" [MS] Running Services (Display Name, Service Name, Path {Service DLL}): ------------------------------------------------------------------ Autodesk Licensing Service, Autodesk Licensing Service, ""G:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe"" ["Autodesk"] Automatic LiveUpdate Scheduler, Automatic LiveUpdate Scheduler, ""G:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe"" ["Symantec Corporation"] HTTP SSL, HTTPFilter, "G:\WINDOWS\System32\svchost.exe -k HTTPFilter" {"G:\WINDOWS\System32\w3ssl.dll" [MS]} iPodService, iPodService, "G:\Program Files\iPod\bin\iPodService.exe" ["Apple Computer, Inc."] ISSvc, ISSVC, "F:\Norton Internet Security\ISSVC.exe" ["Symantec Corporation"] Machine Debug Manager, MDM, ""G:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE"" [MS] MySql, MySql, "J:/mysql/bin/mysqld-nt.exe" [null data] Norton AntiVirus Auto-Protect Service, navapsvc, ""F:\Norton Internet Security\Norton AntiVirus\navapsvc.exe"" ["Symantec Corporation"] NVIDIA Display Driver Service, NVSvc, "G:\WINDOWS\System32\nvsvc32.exe" ["NVIDIA Corporation"] RaySat_3dsmax8 Server, mi-raysat_3dsmax8, "F:\3dsMax8\mentalray\satellite\raysat_3dsmax8server.exe" [null data] SAVScan, SAVScan, "F:\Norton Internet Security\Norton AntiVirus\SAVScan.exe" ["Symantec Corporation"] Symantec Event Manager, ccEvtMgr, ""G:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe"" ["Symantec Corporation"] Symantec Network Drivers Service, SNDSrvc, "G:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe" ["Symantec Corporation"] Symantec Network Proxy, ccProxy, ""G:\Program Files\Common Files\Symantec Shared\ccProxy.exe"" ["Symantec Corporation"] Symantec Settings Manager, ccSetMgr, ""G:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe"" ["Symantec Corporation"] Symantec SPBBCSvc, SPBBCSvc, "G:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe" ["Symantec Corporation"] VMware Authorization Service, VMAuthdService, "F:\VMware\VMware Workstation\vmware-authd.exe" ["VMware, Inc."] VMware DHCP Service, VMnetDHCP, "G:\WINDOWS\system32\vmnetdhcp.exe" ["VMware, Inc."] VMware NAT Service, VMware NAT Service, "G:\WINDOWS\system32\vmnat.exe" ["VMware, Inc."] Print Monitors: --------------- HKLM\System\CurrentControlSet\Control\Print\Monitors\ Microsoft Document Imaging Writer Monitor\Driver = "mdimon.dll" [MS] ---------- + This report excludes default entries except where indicated. + To see *everywhere* the script checks and *everything* it finds, launch it from a command prompt or a shortcut with the -all parameter. + The search for DESKTOP.INI DLL launch points on all local fixed drives took 699 seconds. + The search for all Registry CLSIDs containing dormant Explorer Bars took 13 seconds. ---------- (total run time: 748 seconds)

**Posty:** 7838 · przez **Lukesh** 05 Lis 2006, 20:25

Log z HJ wydaje sie byc czysty :roll:

**Posty:** 935 · przez **Aqui** 05 Lis 2006, 22:17

Usuwasz z wyłączonym przywracaniem systemu iw trybie awaryjnym
Start==>uruchom==>cmd i wklep

sc stop "COM+ Alerter Service"
sc delete "COM+ Alerter Service"

O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O23 - Service: COM+ Alerter Service - Unknown owner - G:\WINDOWS\system32\altsvc.exe

Pliki fixujesz w hijacku,pogrubione pliki usuwasz ręcznie z dysku
Po zabiegach nowe logi

Autor postu otrzymał pochwałę

**Posty:** 244 · przez **L_Devil** 05 Lis 2006, 22:41

W trybie awaryjnym nie miałem żadnych, najmniejszych problemów z przeglądarką - wszystkie strony działały. Po usunięciu wskazanych plików i uruchomieniu kompa normalnie nadal są problemy. Firefox już nie wyświetla żadnej strony, IE też ma problemy. Nowe logi:

Kod: Zaznacz wszystko: Logfile of HijackThis v1.99.1 Scan saved at 21:04:41, on 2006-11-05 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: G:\WINDOWS\System32\smss.exe G:\WINDOWS\system32\winlogon.exe G:\WINDOWS\system32\services.exe G:\WINDOWS\system32\lsass.exe G:\WINDOWS\system32\svchost.exe G:\WINDOWS\System32\svchost.exe G:\WINDOWS\system32\spoolsv.exe G:\WINDOWS\Explorer.EXE G:\Program Files\Common Files\Symantec Shared\ccApp.exe F:\iTunes\iTunesHelper.exe G:\Program Files\QuickTime\qttask.exe G:\Program Files\Java\jre1.5.0_06\bin\jusched.exe G:\WINDOWS\system32\RUNDLL32.EXE G:\WINDOWS\RTHDCPL.EXE G:\Program Files\Common Files\InstallShield\UpdateService\issch.exe F:\ewido anti-spyware 4.0\ewido.exe G:\Program Files\Messenger\msmsgs.exe G:\WINDOWS\system32\ctfmon.exe F:\InterVideo\Common\Bin\WinCinemaMgr.exe J:\Program Files\Apache Group\Apache2\bin\ApacheMonitor.exe G:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe G:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe G:\Program Files\Common Files\Symantec Shared\ccProxy.exe G:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe F:\ewido anti-spyware 4.0\guard.exe F:\Norton Internet Security\ISSVC.exe G:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE F:\3dsMax8\mentalray\satellite\raysat_3dsmax8server.exe J:\mysql\bin\mysqld-nt.exe F:\Norton Internet Security\Norton AntiVirus\navapsvc.exe G:\WINDOWS\System32\nvsvc32.exe G:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe G:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe G:\WINDOWS\System32\svchost.exe F:\VMware\VMware Workstation\vmware-authd.exe G:\WINDOWS\system32\vmnat.exe G:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe G:\WINDOWS\system32\vmnetdhcp.exe G:\Program Files\iPod\bin\iPodService.exe G:\WINDOWS\system32\wscntfy.exe F:\Norton Internet Security\Norton AntiVirus\SAVScan.exe G:\WINDOWS\System32\svchost.exe G:\Program Files\Internet Explorer\iexplore.exe G:\Program Files\Common Files\Symantec Shared\AdBlocking\NSMdtr.exe J:\Piotrek\Programy\HiJackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - G:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O2 - BHO: Norton Internet Security - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - G:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - F:\Norton Internet Security\Norton AntiVirus\NavShExt.dll O3 - Toolbar: Norton Internet Security - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - G:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - F:\Norton Internet Security\Norton AntiVirus\NavShExt.dll O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE G:\WINDOWS\System32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [ccApp] "G:\Program Files\Common Files\Symantec Shared\ccApp.exe" O4 - HKLM\..\Run: [NeroFilterCheck] G:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [Symantec NetDriver Monitor] G:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE O4 - HKLM\..\Run: [iTunesHelper] "F:\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [QuickTime Task] "G:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [SunJavaUpdateSched] G:\Program Files\Java\jre1.5.0_06\bin\jusched.exe O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE G:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [ISUSPM Startup] G:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup O4 - HKLM\..\Run: [ISUSScheduler] "G:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k O4 - HKLM\..\Run: [!ewido] "F:\ewido anti-spyware 4.0\ewido.exe" /minimized O4 - HKCU\..\Run: [MSMSGS] "G:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [ctfmon.exe] G:\WINDOWS\system32\ctfmon.exe O4 - Startup: WinMySQLadmin.lnk = J:\mysql\bin\winmysqladmin.exe O4 - Global Startup: Adobe Gamma Loader.lnk = G:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: InterVideo WinCinema Manager.lnk = F:\InterVideo\Common\Bin\WinCinemaMgr.exe O4 - Global Startup: Monitor Apache Servers.lnk = J:\Program Files\Apache Group\Apache2\bin\ApacheMonitor.exe O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://F:\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - G:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - G:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - F:\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - G:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - G:\Program Files\Messenger\msmsgs.exe O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.pl/resources/virusscanner/kavwebscan_unicode.cab O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - G:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll O23 - Service: Adobe LM Service - Adobe Systems - G:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: Apache2 - Unknown owner - J:\Program Files\Apache Group\Apache2\bin\Apache.exe" -k runservice (file missing) O23 - Service: Autodesk Licensing Service - Autodesk - G:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - G:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - G:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - G:\Program Files\Common Files\Symantec Shared\ccProxy.exe O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - G:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - G:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - F:\ewido anti-spyware 4.0\guard.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - G:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPodService - Apple Computer, Inc. - G:\Program Files\iPod\bin\iPodService.exe O23 - Service: ISSvc (ISSVC) - Symantec Corporation - F:\Norton Internet Security\ISSVC.exe O23 - Service: LiveUpdate - Symantec Corporation - G:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE O23 - Service: Macromedia Licensing Service - Unknown owner - G:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe O23 - Service: RaySat_3dsmax8 Server (mi-raysat_3dsmax8) - Unknown owner - F:\3dsMax8\mentalray\satellite\raysat_3dsmax8server.exe O23 - Service: MySql - Unknown owner - J:/mysql/bin/mysqld-nt.exe O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - F:\Norton Internet Security\Norton AntiVirus\navapsvc.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - G:\WINDOWS\System32\nvsvc32.exe O23 - Service: SAVScan - Symantec Corporation - F:\Norton Internet Security\Norton AntiVirus\SAVScan.exe O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - G:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - G:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - G:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe O23 - Service: VMware Authorization Service (VMAuthdService) - VMware, Inc. - F:\VMware\VMware Workstation\vmware-authd.exe O23 - Service: VMware DHCP Service (VMnetDHCP) - VMware, Inc. - G:\WINDOWS\system32\vmnetdhcp.exe O23 - Service: VMware NAT Service - VMware, Inc. - G:\WINDOWS\system32\vmnat.exe

SB:

Kod: Zaznacz wszystko: "Silent Runners.vbs", revision 48, http://www.silentrunners.org/ Operating System: Windows XP SP2 Output limited to non-default values, except where indicated by "{++}" Startup items buried in registry: --------------------------------- HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++} "MSMSGS" = ""G:\Program Files\Messenger\msmsgs.exe" /background" [MS] "ctfmon.exe" = "G:\WINDOWS\system32\ctfmon.exe" [MS] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++} "NvCplDaemon" = "RUNDLL32.EXE G:\WINDOWS\System32\NvCpl.dll,NvStartup" [MS] "nwiz" = "nwiz.exe /install" ["NVIDIA Corporation"] "ccApp" = ""G:\Program Files\Common Files\Symantec Shared\ccApp.exe"" ["Symantec Corporation"] "NeroFilterCheck" = "G:\WINDOWS\system32\NeroCheck.exe" ["Ahead Software Gmbh"] "Symantec NetDriver Monitor" = "G:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer" ["Symantec Corporation"] "SkyTel" = "SkyTel.EXE" ["Realtek Semiconductor Corp."] "iTunesHelper" = ""F:\iTunes\iTunesHelper.exe"" ["Apple Computer, Inc."] "QuickTime Task" = ""G:\Program Files\QuickTime\qttask.exe" -atboottime" ["Apple Computer, Inc."] "SunJavaUpdateSched" = "G:\Program Files\Java\jre1.5.0_06\bin\jusched.exe" ["Sun Microsystems, Inc."] "NvMediaCenter" = "RUNDLL32.EXE G:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit" [MS] "RTHDCPL" = "RTHDCPL.EXE" ["Realtek Semiconductor Corp."] "ISUSPM Startup" = "G:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup" ["InstallShield Software Corporation"] "ISUSScheduler" = ""G:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start" ["InstallShield Software Corporation"] "KernelFaultCheck" = "%systemroot%\system32\dumprep 0 -k" [MS] "!ewido" = ""F:\ewido anti-spyware 4.0\ewido.exe" /minimized" ["Anti-Malware Development a.s."] HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ {761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\(Default) = (no title provided) -> {HKLM...CLSID} = "SSVHelper Class" \InProcServer32\(Default) = "G:\Program Files\Java\jre1.5.0_06\bin\ssv.dll" ["Sun Microsystems, Inc."] {9ECB9560-04F9-4bbc-943D-298DDF1699E1}\(Default) = "Norton Internet Security" -> {HKLM...CLSID} = "CNisExtBho Class" \InProcServer32\(Default) = "G:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll" ["Symantec Corporation"] {BDF3E430-B101-42AD-A544-FADC6B084872}\(Default) = "NAV Helper" -> {HKLM...CLSID} = "CNavExtBho Class" \InProcServer32\(Default) = "F:\Norton Internet Security\Norton AntiVirus\NavShExt.dll" ["Symantec Corporation"] HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\ "{42071714-76d4-11d1-8b24-00a0c9068ff3}" = "Rozszerzenie CPL kadrowania wyświetlania" -> {HKLM...CLSID} = "Rozszerzenie CPL kadrowania wyświetlania" \InProcServer32\(Default) = "deskpan.dll" [file not found] "{88895560-9AA2-1069-930E-00AA0030EBC8}" = "Rozszerzenie ikony HyperTerminalu" -> {HKLM...CLSID} = "HyperTerminal Icon Ext" \InProcServer32\(Default) = "G:\WINDOWS\System32\hticons.dll" ["Hilgraeve, Inc."] "{A70C977A-BF00-412C-90B7-034C51DA2439}" = "NvCpl DesktopContext Class" -> {HKLM...CLSID} = "DesktopContext Class" \InProcServer32\(Default) = "G:\WINDOWS\System32\nvcpl.dll" ["NVIDIA Corporation"] "{1CDB2949-8F65-4355-8456-263E7C208A5D}" = "Desktop Explorer" -> {HKLM...CLSID} = "Desktop Explorer" \InProcServer32\(Default) = "G:\WINDOWS\System32\nvshell.dll" ["NVIDIA Corporation"] "{1E9B04FB-F9E5-4718-997B-B8DA88302A47}" = "Desktop Explorer Menu" -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "G:\WINDOWS\System32\nvshell.dll" ["NVIDIA Corporation"] "{1E9B04FB-F9E5-4718-997B-B8DA88302A48}" = "nView Desktop Context Menu" -> {HKLM...CLSID} = "nView Desktop Context Menu" \InProcServer32\(Default) = "G:\WINDOWS\System32\nvshell.dll" ["NVIDIA Corporation"] "{00020D75-0000-0000-C000-000000000046}" = "Microsoft Office Outlook Desktop Icon Handler" -> {HKLM...CLSID} = "Microsoft Office Outlook" \InProcServer32\(Default) = "F:\MICROS~2\OFFICE11\MLSHEXT.DLL" [MS] "{0006F045-0000-0000-C000-000000000046}" = "Microsoft Office Outlook Custom Icon Handler" -> {HKLM...CLSID} = "Rozszerzenie ikon plików programu Outlook" \InProcServer32\(Default) = "F:\MICROS~2\OFFICE11\OLKFSTUB.DLL" [MS] "{42042206-2D85-11D3-8CFF-005004838597}" = "Microsoft Office HTML Icon Handler" -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "F:\Microsoft Office\OFFICE11\msohev.dll" [MS] "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" = "WinRAR shell extension" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "F:\WinRAR\rarext.dll" [null data] "{32020A01-506E-484D-A2A8-BE3CF17601C3}" = "AlcoholShellEx" -> {HKLM...CLSID} = "AlcoholShellEx" \InProcServer32\(Default) = "F:\ALCOHO~1\ALCOHO~1\AXShlEx.dll" ["Alcohol Soft Development Team"] "{6B19FEC2-A45B-11CF-9045-00A0C9039735}" = "Registered ActiveX Controls" -> {HKLM...CLSID} = "Registered ActiveX Controls" \InProcServer32\(Default) = "F:\Microsoft Visual Studio\Common\MSDev98\Bin\IDE\DEVXPGL.DLL" [MS] "{D545EBD1-BD92-11CF-8772-00A0C9039735}" = "Developer Studio Components" -> {HKLM...CLSID} = "Developer Studio Components" \InProcServer32\(Default) = "F:\Microsoft Visual Studio\Common\MSDev98\Bin\IDE\DEVXPGL.DLL" [MS] "{B9E1D2CB-CCFF-4AA6-9579-D7A4754030EF}" = "iTunes" -> {HKLM...CLSID} = "iTunes" \InProcServer32\(Default) = "F:\iTunes\iTunesMiniPlayer.dll" ["Apple Computer, Inc."] "{e82a2d71-5b2f-43a0-97b8-81be15854de8}" = "ShellLink for Application References" -> {HKLM...CLSID} = "ShellLink for Application References" \InProcServer32\(Default) = "G:\WINDOWS\system32\dfshim.dll" [MS] "{E37E2028-CE1A-4f42-AF05-6CEABC4E5D75}" = "Shell Icon Handler for Application References" -> {HKLM...CLSID} = "Shell Icon Handler for Application References" \InProcServer32\(Default) = "G:\WINDOWS\system32\dfshim.dll" [MS] "{FFB699E0-306A-11d3-8BD1-00104B6F7516}" = "Play on my TV helper" -> {HKLM...CLSID} = "NVIDIA CPL Extension" \InProcServer32\(Default) = "G:\WINDOWS\System32\nvcpl.dll" ["NVIDIA Corporation"] "{640167b4-59b0-47a6-b335-a6b3c0695aea}" = "Portable Media Devices" -> {HKLM...CLSID} = "Portable Media Devices" \InProcServer32\(Default) = "G:\WINDOWS\system32\Audiodev.dll" [MS] "{cc86590a-b60a-48e6-996b-41d25ed39a1e}" = "Portable Media Devices Menu" -> {HKLM...CLSID} = "Portable Media Devices Menu" \InProcServer32\(Default) = "G:\WINDOWS\system32\Audiodev.dll" [MS] "{6DEA92E9-8682-4b6a-97DE-354772FE5727}" = "Autodesk DWF Preview" -> {HKLM...CLSID} = "ACDWFTHMBPRXY" \InProcServer32\(Default) = "G:\Program Files\Common Files\Autodesk Shared\AcDwfThmbPrxy16.dll" ["Autodesk"] HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\ INFECTION WARNING! "{57B86673-276A-48B2-BAE7-C6DBB3020EB8}" = "ewido anti-spyware 4.0" -> {HKLM...CLSID} = "CShellExecuteHookImpl Object" \InProcServer32\(Default) = "F:\ewido anti-spyware 4.0\shellexecutehook.dll" ["Anti-Malware Development a.s."] HKLM\Software\Classes\PROTOCOLS\Filter\ INFECTION WARNING! text/xml\CLSID = "{807553E5-5146-11D5-A672-00B0D022E945}" -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "G:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL" [MS] HKLM\Software\Classes\Folder\shellex\ColumnHandlers\ {F9DB5320-233E-11D1-9F84-707F02C10627}\(Default) = "PDF Column Info" -> {HKLM...CLSID} = "PDF Shell Extension" \InProcServer32\(Default) = "F:\Adobe Reader 7.0\ActiveX\PDFShell.dll" ["Adobe Systems, Inc."] HKLM\Software\Classes\*\shellex\ContextMenuHandlers\ ewido anti-spyware\(Default) = "{8934FCEF-F5B8-468f-951F-78A921CD3920}" -> {HKLM...CLSID} = "CContextScan Object" \InProcServer32\(Default) = "F:\ewido anti-spyware 4.0\context.dll" ["Anti-Malware Development a.s."] Symantec.Norton.Antivirus.IEContextMenu\(Default) = "{5345A4D5-41EB-4A2F-9616-CE1D4F6C35B2}" -> {HKLM...CLSID} = "IEContextMenu Class" \InProcServer32\(Default) = "F:\Norton Internet Security\Norton AntiVirus\NavShExt.dll" ["Symantec Corporation"] WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "F:\WinRAR\rarext.dll" [null data] HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\ Convert\(Default) = "{9f95ca1a-e80e-4c0f-acd1-4c9b7900b982}" -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "F:\Microsoft DirectX 9.0 SDK (Summer 2004)\Utilities\txview.dll" [null data] ewido anti-spyware\(Default) = "{8934FCEF-F5B8-468f-951F-78A921CD3920}" -> {HKLM...CLSID} = "CContextScan Object" \InProcServer32\(Default) = "F:\ewido anti-spyware 4.0\context.dll" ["Anti-Malware Development a.s."] WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "F:\WinRAR\rarext.dll" [null data] HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\ Symantec.Norton.Antivirus.IEContextMenu\(Default) = "{5345A4D5-41EB-4A2F-9616-CE1D4F6C35B2}" -> {HKLM...CLSID} = "IEContextMenu Class" \InProcServer32\(Default) = "F:\Norton Internet Security\Norton AntiVirus\NavShExt.dll" ["Symantec Corporation"] WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "F:\WinRAR\rarext.dll" [null data] Active Desktop and Wallpaper: ----------------------------- Active Desktop is disabled at this entry: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState HKCU\Control Panel\Desktop\ "Wallpaper" = "G:\Documents and Settings\Piotrek\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp" Startup items in "Piotrek" & "All Users" startup folders: --------------------------------------------------------- G:\Documents and Settings\Piotrek\Menu Start\Programy\Autostart "WinMySQLadmin" -> shortcut to: "J:\mysql\bin\winmysqladmin.exe" ["MySQL AB"] G:\Documents and Settings\All Users\Menu Start\Programy\Autostart "Adobe Gamma Loader" -> shortcut to: "G:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe" ["Adobe Systems, Inc."] "InterVideo WinCinema Manager" -> shortcut to: "F:\InterVideo\Common\Bin\WinCinemaMgr.exe" ["InterVideo Inc."] "Monitor Apache Servers" -> shortcut to: "J:\Program Files\Apache Group\Apache2\bin\ApacheMonitor.exe" ["Apache Software Foundation"] Enabled Scheduled Tasks: ------------------------ "Norton AntiVirus - Scan my computer - Piotrek" -> launches: "F:\NORTON~1\NORTON~1\Navw32.exe /task:"G:\Documents and Settings\All Users\Dane aplikacji\Symantec\Norton AntiVirus\Tasks\mycomp.sca"" ["Symantec Corporation"] "Symantec NetDetect" -> launches: "G:\Program Files\Symantec\LiveUpdate\NDetect.exe" [file not found] Winsock2 Service Provider DLLs: ------------------------------- Namespace Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++} 000000000001\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS] 000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS] 000000000003\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS] Transport Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++} 0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range: %SystemRoot%\system32\mswsock.dll [MS], 01 - 03, 06 - 19 %SystemRoot%\system32\rsvpsp.dll [MS], 04 - 05 Toolbars, Explorer Bars, Extensions: ------------------------------------ Toolbars HKCU\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ "{42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6}" -> {HKLM...CLSID} = "Norton AntiVirus" \InProcServer32\(Default) = "F:\Norton Internet Security\Norton AntiVirus\NavShExt.dll" ["Symantec Corporation"] HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\ "{0B53EAC3-8D69-4B9E-9B19-A37C9A5676A7}" -> {HKLM...CLSID} = "Norton Internet Security" \InProcServer32\(Default) = "G:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll" ["Symantec Corporation"] HKLM\Software\Microsoft\Internet Explorer\Toolbar\ "{0B53EAC3-8D69-4B9E-9B19-A37C9A5676A7}" = "Norton Internet Security" -> {HKLM...CLSID} = "Norton Internet Security" \InProcServer32\(Default) = "G:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll" ["Symantec Corporation"] "{42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6}" = "Norton AntiVirus" -> {HKLM...CLSID} = "Norton AntiVirus" \InProcServer32\(Default) = "F:\Norton Internet Security\Norton AntiVirus\NavShExt.dll" ["Symantec Corporation"] Explorer Bars Dormant Explorer Bars in "View, Explorer Bar" menu HKLM\Software\Classes\CLSID\{FF059E31-CC5A-4E2E-BF3B-96E929D65503}\(Default) = "&Badanie" Implemented Categories\{00021493-0000-0000-C000-000000000046}\ [vertical bar] InProcServer32\(Default) = "F:\MICROS~2\OFFICE11\REFIEBAR.DLL" [MS] Extensions (Tools menu items, main toolbar menu buttons) HKLM\Software\Microsoft\Internet Explorer\Extensions\ {08B0E5C0-4FCB-11CF-AAA5-00401C608501}\ "MenuText" = "Sun Java Console" "CLSIDExtension" = "{CAFEEFAC-0015-0000-0006-ABCDEFFEDCBC}" -> {HKCU...CLSID} = "Java Plug-in" \InProcServer32\(Default) = "G:\Program Files\Java\jre1.5.0_06\bin\ssv.dll" ["Sun Microsystems, Inc."] -> {HKLM...CLSID} = "Java Plug-in 1.5.0_06" \InProcServer32\(Default) = "G:\Program Files\Java\jre1.5.0_06\bin\npjpi150_06.dll" ["Sun Microsystems, Inc."] {92780B25-18CC-41C8-B9BE-3C9C571A8263}\ "ButtonText" = "Badanie" {FB5F1910-F110-11D2-BB9E-00C04F795683}\ "ButtonText" = "Messenger" "MenuText" = "Windows Messenger" "Exec" = "G:\Program Files\Messenger\msmsgs.exe" [MS] Running Services (Display Name, Service Name, Path {Service DLL}): ------------------------------------------------------------------ Autodesk Licensing Service, Autodesk Licensing Service, ""G:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe"" ["Autodesk"] Automatic LiveUpdate Scheduler, Automatic LiveUpdate Scheduler, ""G:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe"" ["Symantec Corporation"] ewido anti-spyware 4.0 guard, ewido anti-spyware 4.0 guard, "F:\ewido anti-spyware 4.0\guard.exe" ["Anti-Malware Development a.s."] HTTP SSL, HTTPFilter, "G:\WINDOWS\System32\svchost.exe -k HTTPFilter" {"G:\WINDOWS\System32\w3ssl.dll" [MS]} iPodService, iPodService, "G:\Program Files\iPod\bin\iPodService.exe" ["Apple Computer, Inc."] ISSvc, ISSVC, "F:\Norton Internet Security\ISSVC.exe" ["Symantec Corporation"] Machine Debug Manager, MDM, ""G:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE"" [MS] MySql, MySql, "J:/mysql/bin/mysqld-nt.exe" [null data] Norton AntiVirus Auto-Protect Service, navapsvc, ""F:\Norton Internet Security\Norton AntiVirus\navapsvc.exe"" ["Symantec Corporation"] NVIDIA Display Driver Service, NVSvc, "G:\WINDOWS\System32\nvsvc32.exe" ["NVIDIA Corporation"] RaySat_3dsmax8 Server, mi-raysat_3dsmax8, "F:\3dsMax8\mentalray\satellite\raysat_3dsmax8server.exe" [null data] SAVScan, SAVScan, "F:\Norton Internet Security\Norton AntiVirus\SAVScan.exe" ["Symantec Corporation"] Symantec Event Manager, ccEvtMgr, ""G:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe"" ["Symantec Corporation"] Symantec Network Drivers Service, SNDSrvc, "G:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe" ["Symantec Corporation"] Symantec Network Proxy, ccProxy, ""G:\Program Files\Common Files\Symantec Shared\ccProxy.exe"" ["Symantec Corporation"] Symantec Settings Manager, ccSetMgr, ""G:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe"" ["Symantec Corporation"] Symantec SPBBCSvc, SPBBCSvc, "G:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe" ["Symantec Corporation"] VMware Authorization Service, VMAuthdService, "F:\VMware\VMware Workstation\vmware-authd.exe" ["VMware, Inc."] VMware DHCP Service, VMnetDHCP, "G:\WINDOWS\system32\vmnetdhcp.exe" ["VMware, Inc."] VMware NAT Service, VMware NAT Service, "G:\WINDOWS\system32\vmnat.exe" ["VMware, Inc."] Print Monitors: --------------- HKLM\System\CurrentControlSet\Control\Print\Monitors\ Microsoft Document Imaging Writer Monitor\Driver = "mdimon.dll" [MS] ---------- + This report excludes default entries except where indicated. + To see *everywhere* the script checks and *everything* it finds, launch it from a command prompt or a shortcut with the -all parameter. + The search for DESKTOP.INI DLL launch points on all local fixed drives took 728 seconds. + The search for all Registry CLSIDs containing dormant Explorer Bars took 13 seconds. ---------- (total run time: 776 seconds)

**Posty:** 935 · przez **Aqui** 05 Lis 2006, 22:49

Czysto

Sprobuj przienstalowac przegladarke...
Skontaktuj sie z providerem neta,moze cos jest nie tak..
Przeskanuj www.ewido.net i wklej raport

**Posty:** 244 · przez **L_Devil** 05 Lis 2006, 23:13

Fast Scan Ewido pokazał mi tylko Tracking Cookies...

Provider to Multimedia, ma wszystkie linie pomocy technicznej obecnie zajęte - spróbuję zadzwonić do nich jutro

Nie mogę nawet wejść na stronę internetową Firefoxa, bo przekierowywuje mnie na MSN Search, a potem to już w ogóle pokazuje, że takiej strony nie ma...

Idę robić jeszcze Ewido Full Scan

**Posty:** 935 · przez **Aqui** 05 Lis 2006, 23:16

http://download.bleepingcomputer.com/sUBs/combofix.exe

Sciagnij programik ,kliknij dwa razy na niego ,wybierz "Y" i enter.Czekasz na działanie i loga ktory sie wygeneruje,wklejasz go tu na forum do sprawdzenia ...

**Posty:** 244 · przez **L_Devil** 05 Lis 2006, 23:20

Na liście procesów pojawił mi się kilka razy proces systemowy

Kod: Zaznacz wszystko: LuCOMM~

Znikał niemal natychmiast za każdym razem - czasami pojawiała się więcej niż jedna instancja

Programiku nie mogę ściągąć - pisze że nie ma takiej strony

**Posty:** 540 · przez **will7** 05 Lis 2006, 23:26

L_Devil napisał(a):Provider to Multimedia

Też mam z multimedi i też coś mi świruje (też nie mogę wejść na niektóre strony) np. co mnie najbardziej wkurza nie mogę wejść na megaupload, więc to zapewne wina MM.
Niedługo powinni naprawić

EDIT

P.S.
Tak jak ty nie mogę ściągnąć tgo pliku który podał Aqui :wink:

P.S.2
Jesli potrzebujesz pilnie wejść na jakąś stronkę która przez multimedię się nie ładuje :evil:

to możesz wejść przez proxy. TU jest opisane jak ustawić przeglądarkę(jak widze korzystasz z IE to tą podałem). Tam też lista serwerów proxy - prawie wszystkie mają jakies pierdoły w stylu wpisywania co jakiś czas hasełka żeby przeładować stronę itp ale jesli będziesz koniecznie potrzebował na coś wejśc to możesz skorzystać.

**Posty:** 935 · przez **Aqui** 05 Lis 2006, 23:50

L_devil jesli will7 tez ma problemy to poczekajcie az naprawia i wtedy wrzuc combofixa :wink:

**Posty:** 244 · przez **L_Devil** 07 Lis 2006, 20:17

Udało mi się wejść tutaj przez Internet Exploler - Firefox nadal nie działa

Log z combofixa:

Kod: Zaznacz wszystko: Piotrek - 06-11-07 18:49:44,60 Dodatek Service Pack 2 ComboFix 06.10.19 - Running from: "J:\Piotrek\Programy\ComboFix" ((((((((((((((((((((((((((((((( Files Created from 2006-10-07 to 2006-11-07 )))))))))))))))))))))))))))))))))) 2006-10-27 18:02 921,600 --a------ G:\WINDOWS\system32\vorbisenc.dll 2006-10-27 18:02 45,056 --a------ G:\WINDOWS\system32\ogg.dll 2006-10-27 18:02 237,568 --a------ G:\WINDOWS\system32\OggDS.dll 2006-10-27 18:02 188,416 --a------ G:\WINDOWS\system32\vorbis.dll 2006-10-27 18:02 1,415,680 --a------ G:\WINDOWS\system32\WMV9VCM.dll 2006-10-27 18:01 9,216 --a------ G:\WINDOWS\system32\cpuinf32.dll 2006-10-27 18:01 245,760 --a------ G:\WINDOWS\system32\mplvpx.dll 2006-10-27 18:01 155,648 --a------ G:\WINDOWS\system32\xvidvfw.dll 2006-10-27 18:00 679,936 --a------ G:\WINDOWS\system32\xvidcore.dll 2006-10-27 18:00 626,688 --a------ G:\WINDOWS\system32\xvid.dll 2006-10-19 15:26 16,384 --a------ G:\WINDOWS\system32\FileOps.exe 2006-10-08 19:47 15,104 --a------ G:\WINDOWS\system32\drivers\usbscan.sys 2006-10-08 19:31 749,568 --a------ G:\WINDOWS\system32\CNQA2405.dll 2006-10-08 19:31 40,960 --a------ G:\WINDOWS\system32\CNQU72.DLL 2006-10-08 19:31 389,180 --a------ G:\WINDOWS\system32\UCS32P.DLL 2006-10-08 19:31 192,512 --a------ G:\WINDOWS\system32\CNQL2405.dll (((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))) 2006-11-07 18:32 -------- d-------- G:\Program Files\Common Files 2006-11-05 21:13 -------- d-------- G:\Program Files\Common Files\Symantec Shared 2006-11-05 13:18 -------- d-------- G:\Documents and Settings\Piotrek\Dane aplikacji\.bittorrent 2006-10-31 22:21 -------- d-------- G:\Documents and Settings\Piotrek\Dane aplikacji\Canon 2006-10-28 20:48 -------- d-------- G:\Program Files\Common Files\Microsoft Shared 2006-10-28 20:46 -------- d-------- G:\Program Files\MSBuild 2006-10-28 20:46 -------- d-------- G:\Program Files\HTML Help Workshop 2006-10-28 20:45 -------- d-------- G:\Program Files\Common Files\Merge Modules 2006-10-28 20:31 -------- d-------- G:\Program Files\Microsoft Office 2006-10-28 20:31 -------- d-------- G:\Program Files\Common Files\DESIGNER 2006-10-28 20:09 -------- d-------- G:\Program Files\Internet Explorer 2006-10-28 20:07 -------- d--h----- G:\Program Files\InstallShield Installation Information 2006-10-22 20:50 -------- d-------- G:\Documents and Settings\Piotrek\Dane aplikacji\Winamp 2006-10-19 15:27 -------- d-------- G:\Documents and Settings\Piotrek\Dane aplikacji\Adobe 2006-10-19 15:26 -------- d-------- G:\Program Files\Common Files\Adobe 2006-10-18 14:19 29392 --a------ G:\WINDOWS\system32\drivers\secdrv.sys 2006-10-08 19:32 -------- d-------- G:\Program Files\Canon 2006-10-04 18:51 -------- d-------- G:\Documents and Settings\Piotrek\Dane aplikacji\vlc 2006-10-04 18:51 -------- d-------- G:\Documents and Settings\Piotrek\Dane aplikacji\dvdcss 2006-10-04 18:29 286720 --a------ G:\WINDOWS\iun507.exe 2006-10-01 14:08 -------- d-------- G:\Program Files\Common Files\Digidesign 2006-10-01 14:06 -------- d-------- G:\Program Files\SafeNet Sentinel 2006-10-01 14:06 -------- d-------- G:\Program Files\Common Files\SafeNet Sentinel 2006-09-28 09:18 -------- d-------- G:\Documents and Settings\Piotrek\Dane aplikacji\VMware 2006-09-23 18:18 -------- d-------- G:\Documents and Settings\Piotrek\Dane aplikacji\Help 2006-09-21 19:17 -------- d-------- G:\Program Files\Adobe 2006-09-14 12:14 -------- d-------- G:\Program Files\Mplayer 2006-09-05 16:16 86016 --a------ G:\WINDOWS\system32\OpenAL32.dll 2006-09-05 16:16 262144 --a------ G:\WINDOWS\system32\wrap_oal.dll (((((((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries are not shown [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run] "MSMSGS"="\"G:\\Program Files\\Messenger\\msmsgs.exe\" /background" "ctfmon.exe"="G:\\WINDOWS\\system32\\ctfmon.exe" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run] "NvCplDaemon"="RUNDLL32.EXE G:\\WINDOWS\\System32\\NvCpl.dll,NvStartup" "nwiz"="nwiz.exe /install" "ccApp"="\"G:\\Program Files\\Common Files\\Symantec Shared\\ccApp.exe\"" "NeroFilterCheck"="G:\\WINDOWS\\system32\\NeroCheck.exe" "Symantec NetDriver Monitor"="G:\\PROGRA~1\\SYMNET~1\\SNDMon.exe /Consumer" "SkyTel"="SkyTel.EXE" "iTunesHelper"="\"F:\\iTunes\\iTunesHelper.exe\"" "QuickTime Task"="\"G:\\Program Files\\QuickTime\\qttask.exe\" -atboottime" "SunJavaUpdateSched"="G:\\Program Files\\Java\\jre1.5.0_06\\bin\\jusched.exe" "NvMediaCenter"="RUNDLL32.EXE G:\\WINDOWS\\System32\\NvMcTray.dll,NvTaskbarInit" "RTHDCPL"="RTHDCPL.EXE" "ISUSPM Startup"="G:\\PROGRA~1\\COMMON~1\\INSTAL~1\\UPDATE~1\\ISUSPM.exe -startup" "ISUSScheduler"="\"G:\\Program Files\\Common Files\\InstallShield\\UpdateService\\issch.exe\" -start" "KernelFaultCheck"="%systemroot%\\system32\\dumprep 0 -k" "!ewido"="\"F:\\ewido anti-spyware 4.0\\ewido.exe\" /minimized" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\IMAIL] "Installed"="1" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MAPI] "Installed"="1" "NoChange"="1" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MSFS] "Installed"="1" [HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components] "DeskHtmlVersion"=dword:00000110 "DeskHtmlMinorVersion"=dword:00000005 "Settings"=dword:00000001 "GeneralFlags"=dword:00000001 [HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\0] "Source"="About:Home" "SubscribedURL"="About:Home" "FriendlyName"="Moja bieżąca strona główna" "Flags"=dword:00000002 "Position"=hex:2c,00,00,00,cc,00,00,00,00,00,00,00,34,03,00,00,e2,02,00,00,00,\ 00,00,00,01,00,00,00,01,00,00,00,01,00,00,00,00,00,00,00,00,00,00,00 "CurrentState"=hex:04,00,00,40 "OriginalStateInfo"=hex:18,00,00,00,ff,ff,00,00,ff,ff,00,00,ff,ff,ff,ff,ff,ff,\ ff,ff,04,00,00,00 "RestoredStateInfo"=hex:18,00,00,00,6a,02,00,00,23,00,00,00,a4,00,00,00,9a,00,\ 00,00,01,00,00,00 [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\sharedtaskscheduler] "{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Moduł wstępnego ładowania interfejsu Browseui" "{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Demon buforu kategorii składników" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks] "{AEB6717E-7E19-11d0-97EE-00C04FD91972}"="" "{57B86673-276A-48B2-BAE7-C6DBB3020EB8}"="ewido anti-spyware 4.0" [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] "NoDriveTypeAutoRun"=dword:00000091 [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\Run] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "dontdisplaylastusername"=dword:00000000 "legalnoticecaption"="" "legalnoticetext"="" "shutdownwithoutlogon"=dword:00000001 "undockwithoutlogon"=dword:00000001 [HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer] "NoDriveTypeAutoRun"=dword:00000091 [HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\policies\explorer] "NoDriveTypeAutoRun"=dword:00000091 [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\shellserviceobjectdelayload] "PostBootReminder"="{7849596a-48ea-486e-8937-a2a3009f31a9}" "CDBurn"="{fbeb8a05-beee-4442-804e-409d6c4515e9}" "WebCheck"="{E6FB5E20-DE35-11CF-9C87-00AA005127ED}" "SysTray"="{35CEC8A3-2BE6-11D2-8773-92E220524153}" [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders] "SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll" ~ ~ ~ ~ ~ ~ ~ ~ Hijackthis Backups ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ backup-20061105-205810-418 O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE Contents of the 'Scheduled Tasks' folder G:\WINDOWS\tasks\Norton AntiVirus - Scan my computer - Piotrek.job G:\WINDOWS\tasks\Symantec NetDetect.job Completion time: 06-11-07 18:51:58.01 G:\ComboFix.txt ... 06-11-07 18:51

**Posty:** 935 · przez **Aqui** 07 Lis 2006, 20:43

Czysto

Autor postu otrzymał pochwałę

**Posty:** 8694 · przez **Red** 07 Lis 2006, 20:45

mozesz przeinstalowac ff?Całkowicie wyczyscic wszystko po ff i zainstalować raz jeszcze......umiesz całkowicie zdeinstalować ff??

**Posty:** 244 · przez **L_Devil** 07 Lis 2006, 20:55

Nie, próbowałem reinstala klasycznego (dodaj/usuń programy -> usuń i zainstaluj ponownie)

**Posty:** 8694 · przez **Red** 07 Lis 2006, 21:01

L_Devil mało,to za mało

Usuwanie:

kasujesz w panelu dodaj usun programy
wchodzisz w program files i usuwasz folder ff
wchodzisz w start>wyszukaj>pliki i foldery>wpisujesz firefox i usuwasz wszystko
wchodzisz w start> uruchom >wpisujesz regedit>ok
u góry w oknie znajdziesz opcje wyszukaj>wpisujesz >firefox i usuwasz wszystkie klucze ff

Sciagasz program ccleaner>>znajdziesz w google >>bedzie okno problemy po lewej stronie,odpalisz znajdzie wpisy>>napraw czyli usuń,restartujesz kompa i zaczynasz instalowanie na nowo...

Autor postu otrzymał pochwałę

**Posty:** 244 · przez **L_Devil** 07 Lis 2006, 21:30

mhmm, dobrze, ale maili przez outlooka też sprawdzić nie mogę ("Nie znaleziono hosta"). I wszystkie osoby które mają ze mną internet (mój komp switch'uje [cenzor się dowalił, więc dodałem apostrof

] sygnał to dwóch pozostałych w moim domu

) mówią o tych samych problemach. Awarię do Multimedii już zgłosiłem, nie otrzymałem jeszcze żadnej odpowiedzi (mieli się skontaktować)

**Posty:** 8694 · przez **Red** 07 Lis 2006, 21:33

musisz poczekać na kontakt :roll:

**Posty:** 935 · przez **Aqui** 07 Lis 2006, 21:34

Wydaje mi sie ze to ich wina

L_Devil napisał(a):mieli się skontaktować)

To poczekaj az sie skontaktuja,albo dzwon do nich jeszcze raz....
Zapitaj sie Willego7 czy juz mu awaria przeszla....

**Posty:** 244 · przez **L_Devil** 07 Lis 2006, 23:01

hmm.... coś sobie przypomniałem - dostałem od znajomego (mam go na liście, sąsiad) następujący link, który zawierał obrazek z dwoma gośćmi na imprezie... ponieważ słyszę coraz więcej, że w bardzo podobnym wydarzeniu ludzie dostają wirusy (też jest zdjęcie do imprezy, też dwóch gości), dlatego chciałbym się spytać o radę - cóż można zrobić w takiej sytuacji?

Kod: Zaznacz wszystko: XXX (4-11-2006 18:04) zdjúcie z imprezy www[dot]yojane[dot]com/img18362[dot]jpg

Ostrzeżenie dla innych: Proszę nie wchodzić na stronę, podejrzewam, że jest to wirus

**Posty:** 935 · przez **Aqui** 07 Lis 2006, 23:04

Twoje logi nic nie pokazuja...
Ale przeskanuj jeszcze:
http://kaspersky.pl/virusscanner.html i wklej raport
Nie wchodzimy nigdy na takie linki :wink:

nie otwiera się 70% stron w przeglądarce.reszta sieci działa

nie otwiera się 70% stron w przeglądarce.reszta sieci działa

Kto jest na forum