Nie pokazuje plików ukrytych

**Posty:** 40 · przez **Niewierny** 16 Lis 2009, 16:14

Witam ostatnio zaatakowały mój komp jakieś wirusy

pousuwałem ich troszke Nodem ale dalej mam jakieś problemy min. nie pokazuje mi plików ukrytych

Dzięki za pomoc

Kod: Zaznacz wszystko
Logfile of HijackThis v1.99.1 Scan saved at 10:33:57, on 09-11-16 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\EXPLORER.EXE C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\Program Files\Common Files\Pure Networks Shared\Platform\nmctxth.exe C:\Program Files\Java\jre6\bin\jusched.exe C:\Program Files\Eset\nod32kui.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe C:\Program Files\Brother\Brmfcmon\BrMfcmon.exe C:\Program Files\Common Files\Autodata Limited Shared\Service\ADCDLicSvc.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\Program Files\Linksys\Linksys Updater\bin\LinksysUpdater.exe C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe C:\Program Files\Eset\nod32krn.exe C:\WINDOWS\System32\nvsvc32.exe C:\WINDOWS\system32\java.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\System32\wbem\wmiapsrv.exe C:\Program Files\Gadu-Gadu\gg.exe C:\Program Files\Eset\nod32.exe C:\Program Files\ACD Systems\ACDSee\ACDSee.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\WINDOWS\EXPLORER.EXE F:\download\cureit.exe C:\Program Files\WinRAR\WinRAR.exe C:\DOCUME~1\NIEWIE~1\USTAWI~1\Temp\RarSFX0\_start.exe C:\DOCUME~1\NIEWIE~1\USTAWI~1\Temp\Rar$EX00.000\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.interia.pl/ R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza F2 - REG:system.ini: UserInit=userinit.exe,EXPLORER.EXE O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.2.8.7.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [PPort11reminder] "C:\Program Files\ScanSoft\PaperPort\Ereg\Ereg.exe" -r "C:\Documents and Settings\All Users\Dane aplikacji\ScanSoft\PaperPort\11\Config\Ereg\Ereg.ini" O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [nmctxth] "C:\Program Files\Common Files\Pure Networks Shared\Platform\nmctxth.exe" O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe" O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O8 - Extra context menu item: Pobierz wszystkie VIdeo za pomocą BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm O8 - Extra context menu item: Pobierz wszystko za pomocą BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm O8 - Extra context menu item: Pobierz za pomocą BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre6\bin\jp2iexp.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre6\bin\jp2iexp.dll O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://C:\Program Files\BitComet\tools\BitCometBHO_1.2.8.7.dll/206 (file missing) O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {68282C51-9459-467B-95BF-3C0E89627E55} (MksSkanerOnline Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload.adobe.com/pub/shockwave/cabs/flash/swflash.cab O18 - Protocol: pure-go - {4746C79A-2042-4332-8650-48966E44ABA8} - C:\Program Files\Common Files\Pure Networks Shared\Platform\puresp4.dll O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: Autodata Limited License Service - Autodata Limited - C:\Program Files\Common Files\Autodata Limited Shared\Service\ADCDLicSvc.exe O23 - Service: Java Quick Starter (JavaQuickStarterService) - Unknown owner - C:\Program Files\Java\jre6\bin\jqs.exe" -service -config "C:\Program Files\Java\jre6\lib\deploy\jqs\jqs.conf (file missing) O23 - Service: Linksys Updater (LinksysUpdater) - Unknown owner - C:\Program Files\Linksys\Linksys Updater\bin\LinksysUpdater.exe" -s "C:\Program Files\Linksys\Linksys Updater\conf\wrapper.conf (file missing) O23 - Service: Pure Networks Platform Service (nmservice) - Cisco Systems, Inc. - C:\Program Files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe

**Posty:** 18165 · przez **wojtas** 16 Lis 2009, 17:26

Daj loga z OTL

**Posty:** 40 · przez **Niewierny** 17 Lis 2009, 16:11

Kod: Zaznacz wszystko
OTL Extras logfile created on: 09-11-17 15:03:46 - Run 1 OTL by OldTimer - Version 3.1.6.0 Folder = C:\Documents and Settings\Niewierny\Pulpit Windows XP Professional Edition Dodatek Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation Internet Explorer (Version = 6.0.2900.2180) Locale: 00000415 | Country: Polska | Language: PLK | Date Format: yy-MM-dd 511,53 Mb Total Physical Memory | 194,80 Mb Available Physical Memory | 38,08% Memory free 1,22 Gb Paging File | 0,92 Gb Available in Paging File | 75,06% Paging File free Paging file location(s): C:\pagefile.sys 768 1536 [binary data] %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files Drive C: | 9,77 Gb Total Space | 2,16 Gb Free Space | 22,12% Space Free | Partition Type: NTFS Drive D: | 31,49 Gb Total Space | 1,30 Gb Free Space | 4,11% Space Free | Partition Type: NTFS Drive E: | 37,26 Gb Total Space | 0,33 Gb Free Space | 0,89% Space Free | Partition Type: NTFS Drive F: | 19,53 Gb Total Space | 0,58 Gb Free Space | 2,95% Space Free | Partition Type: NTFS Drive G: | 19,53 Gb Total Space | 1,16 Gb Free Space | 5,94% Space Free | Partition Type: NTFS Drive H: | 7,06 Gb Total Space | 0,21 Gb Free Space | 2,93% Space Free | Partition Type: NTFS I: Drive not present or media not loaded Computer Name: DOM-UQH3MOUBAPS Current User Name: Niewierny Logged in as Administrator. Current Boot Mode: Normal Scan Mode: Current user Company Name Whitelist: Off Skip Microsoft Files: Off File Age = 30 Days Output = Standard [color=#E56717]========== Extra Registry (SafeList) ==========[/color] [color=#E56717]========== File Associations ==========[/color] [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>] .html [@ = htmlfile] -- C:\Program Files\SlimBrowser\sbrowser.exe (FlashPeak, Inc.) .scr [@ = AutoCADScript] -- C:\WINDOWS\NOTEPAD.EXE (Microsoft Corporation) [HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>] .html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation) [color=#E56717]========== Shell Spawning ==========[/color] [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command] batfile [open] -- "%1" %* File not found cmdfile [open] -- "%1" %* File not found comfile [open] -- "%1" %* File not found exefile [open] -- "%1" %* File not found htmlfile [edit] -- "C:\Program Files\Microsoft Office\Office10\msohtmed.exe" %1 (Microsoft Corporation) htmlfile [open] -- "C:\Program Files\SlimBrowser\sbrowser.exe" %1 (FlashPeak, Inc.) htmlfile [opennew] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation) htmlfile [print] -- "C:\Program Files\Microsoft Office\Office10\msohtmed.exe" /p %1 (Microsoft Corporation) http [open] -- "C:\Program Files\SlimBrowser\sbrowser.exe" %1 (FlashPeak, Inc.) https [open] -- "C:\Program Files\SlimBrowser\sbrowser.exe" %1 (FlashPeak, Inc.) piffile [open] -- "%1" %* File not found regfile [merge] -- Reg Error: Key error. scrfile [config] -- "%1" File not found scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation) scrfile [open] -- "%1" /S File not found txtfile [edit] -- Reg Error: Key error. Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1 File not found Directory [ACDBrowse] -- "C:\Program Files\ACD Systems\ACDSee\ACDSee.exe" "%1" (ACD Systems, Ltd.) Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) Directory [Winamp.Bookmark] -- "C:\Program Files\Winamp\winamp.exe" /BOOKMARK "%1" (Nullsoft) Directory [Winamp.Enqueue] -- "C:\Program Files\Winamp\winamp.exe" /ADD "%1" (Nullsoft) Directory [Winamp.Play] -- "C:\Program Files\Winamp\winamp.exe" "%1" (Nullsoft) Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation) Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation) Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) Applications\iexplore.exe [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation) CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] -- "C:\Program Files\Internet Explorer\iexplore.exe" (Microsoft Corporation) [color=#E56717]========== Security Center Settings ==========[/color] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center] "AntiVirusDisableNotify" = 0 "FirewallDisableNotify" = 0 "UpdatesDisableNotify" = 0 "AntiVirusOverride" = 0 "FirewallOverride" = 0 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List] "139:TCP" = 139:TCP:*:Enabled:@xpsp2res.dll,-22004 "445:TCP" = 445:TCP:*:Enabled:@xpsp2res.dll,-22005 "137:UDP" = 137:UDP:*:Enabled:@xpsp2res.dll,-22001 "138:UDP" = 138:UDP:*:Enabled:@xpsp2res.dll,-22002 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] "EnableFirewall" = 1 "DoNotAllowExceptions" = 1 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List] "25093:TCP" = 25093:TCP:*:Enabled:BitComet 25093 TCP "25093:UDP" = 25093:UDP:*:Enabled:BitComet 25093 UDP "1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007 "2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008 "139:TCP" = 139:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22004 "445:TCP" = 445:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22005 "137:UDP" = 137:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22001 "138:UDP" = 138:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22002 "67:UDP" = 67:UDP:*:Enabled:DHCP Discovery Service [color=#E56717]========== Authorized Applications List ==========[/color] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] "C:\Program Files\Gadu-Gadu\gg.exe" = C:\Program Files\Gadu-Gadu\gg.exe:*:Enabled:Gadu-Gadu - program glowny -- (sms-express.com) "C:\Program Files\BitComet\BitComet.exe" = C:\Program Files\BitComet\BitComet.exe:*:Enabled:BitComet - a BitTorrent Client -- (www.BitComet.com) "C:\Program Files\Skype\Phone\Skype.exe" = C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype -- (Skype Technologies S.A.) "C:\Program Files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe" = C:\Program Files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe:LocalSubNet:Enabled:Pure Networks Platform Service -- (Cisco Systems, Inc.) [color=#E56717]========== HKEY_LOCAL_MACHINE Uninstall List ==========[/color] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall] "{0A795E81-7E99-4574-923D-8A0AF1F11CA1}" = ScanSoft PaperPort 11 "{0D499481-22C6-4B25-8AC2-6D3F6C885FB9}" = OpenOffice.org Installer 1.0 "{15095BF3-A3D7-4DDF-B193-3A496881E003}" = Microsoft .NET Framework 3.0 "{24D753CA-6AE9-4E30-8F5F-EFC93E08BF3D}" = Skype™ 4.0 "{26A24AE4-039D-4CA4-87B4-2F83216011FF}" = Java(TM) 6 Update 11 "{2BC2781A-F7F6-452E-95EB-018A522F1B2C}" = PaperPort Image Printer "{350C9415-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP "{3A08B59E-A9F0-4F4D-B7E5-6875D7F13327}" = Brother MFL-Pro Suite DCP-145C "{491DD792-AD81-429C-9EB4-86DD3D22E333}" = Windows Communication Foundation "{64CB2553-C109-4132-AA51-1F421B515FD1}" = Microsoft .NET Framework 1.1 Polish Language Pack "{7131646D-CD3C-40F4-97B9-CD9E4E6262EF}" = Microsoft .NET Framework 2.0 "{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable "{7D1B85BD-AA07-48B8-808D-67A4067FC6BD}" = Windows Workflow Foundation "{7D1FA102-9B90-48B0-8DF8-735BBA5F4093}" = Driver Updater Pro "{900A92BA-19EF-4A34-86CF-7B6C85BDD971}" = VC_MergeModuleToMSI "{90110415-6000-11D3-8CFE-0050048383C9}" = Microsoft Office XP Professional "{90120000-0020-0415-0000-0000000FF1CE}" = Pakiet zgodności dla systemu Office 2007 "{92E64C51-5096-442F-9A44-61CB2941391D}" = ACDSee 4.0 PowerPack Suite "{AC76BA86-7AD7-1045-7B44-A90000000001}" = Adobe Reader 9 - Polish "{B7C076CA-126E-497C-8724-B589F54031AF}" = HDD Regenerator "{BAF78226-3200-4DB4-BE33-4D922A799840}" = Windows Presentation Foundation "{BF2A74BF-8D12-47F1-8B19-22B30AF6B0D1}" = Linksys EasyLink Advisor "{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1 "{F1A029E7-0C8C-4170-8308-D25F54FAB617}" = EuroPlus+ REWARD "{FBDBC490-089D-4476-BF72-1F7A6368200A}" = Pure Networks Platform "Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX "Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin "ASUS Probe V2.17.02" = ASUS Probe V2.17.02 "AsusUpdate" = AsusUpdate "Autodesk DWF Viewer" = Autodesk DWF Viewer "BitComet" = BitComet 1.06 "CDex" = CDex extraction audio "Driver Updater Pro" = Driver Updater Pro "ET3" = English Translator 3 "EVEREST Home Edition_is1" = EVEREST Home Edition v2.20 "Gadu-Gadu" = Gadu-Gadu 6.1 "HijackThis" = HijackThis 1.99.1 "IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs "KLiteCodecPack_is1" = K-Lite Mega Codec Pack 1.61 "Linksys EasyLink Advisor" = Linksys EasyLink Advisor "Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1 "Microsoft .NET Framework 2.0" = Microsoft .NET Framework 2.0 "Microsoft .NET Framework 3.0" = Microsoft .NET Framework 3.0 "Mozilla Firefox (3.0.15)" = Mozilla Firefox (3.0.15) "Nero - Burning Rom!UninstallKey" = Nero 6 Ultra Edition "NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs "NOD32" = System Antywirusowy NOD32 "NVIDIA" = NVIDIA Windows 2000/XP Display Drivers "PCI Audio Driver" = PCI Audio Driver "RealPlayer 6.0" = RealPlayer "SlimBrowser" = SlimBrowser (remove only) "Soulseek" = SoulSeek Client 156c "TomTom HOME" = TomTom HOME 2.5.2.60 "TomTom POI_is1" = TomTom POI [PL] "Ulead Photo Express 2.0 SE" = Ulead Photo Express 2.0 SE "Voice Editor" = Voice Editor "WIC" = Windows Imaging Component "Winamp" = Winamp "Windows Media Format Runtime" = Windows Media Format Runtime "Windows XP Service Pack" = Windows XP Service Pack 2 "WinRAR archiver" = Archiwizator WinRAR "XpsEPSC" = XML Paper Specification Shared Components Pack 1.0 [color=#E56717]========== Last 10 Event Log Errors ==========[/color] [ Application Events ] Error - 09-09-28 08:55:26 | Computer Name = DOM-UQH3MOUBAPS | Source = Application Error | ID = 1000 Description = Aplikacja powodująca błąd temp2.exe, wersja 0.0.0.0, moduł powodujący błąd temp2.exe, wersja 0.0.0.0, adres błędu 0x0000126e. Error - 09-10-05 09:16:31 | Computer Name = DOM-UQH3MOUBAPS | Source = Application Hang | ID = 1002 Description = Aplikacja zawieszająca WINWORD.EXE, wersja 10.0.2627.0, moduł zawieszenia hungapp, wersja 0.0.0.0, adres zawieszenia 0x00000000. Error - 09-10-15 18:32:13 | Computer Name = DOM-UQH3MOUBAPS | Source = crypt32 | ID = 131080 Description = Nie można automatycznie pobrać aktualizacji numeru sekwencji głównej listy innych firm z: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>, wystąpił błąd: Nie można określić nazwy serwera lub adresu Error - 09-10-20 08:01:26 | Computer Name = DOM-UQH3MOUBAPS | Source = Application Error | ID = 1000 Description = Aplikacja powodująca błąd gg.exe, wersja 6.1.0.158, moduł powodujący błąd ntdll.dll, wersja 5.1.2600.2180, adres błędu 0x00018fea. Error - 09-10-22 13:04:36 | Computer Name = DOM-UQH3MOUBAPS | Source = Application Hang | ID = 1002 Description = Aplikacja zawieszająca firefox.exe, wersja 1.9.0.3526, moduł zawieszenia hungapp, wersja 0.0.0.0, adres zawieszenia 0x00000000. Error - 09-11-06 09:37:53 | Computer Name = DOM-UQH3MOUBAPS | Source = Application Hang | ID = 1002 Description = Aplikacja zawieszająca OUTLOOK.EXE, wersja 10.0.2627.1, moduł zawieszenia hungapp, wersja 0.0.0.0, adres zawieszenia 0x00000000. Error - 09-11-15 09:00:15 | Computer Name = DOM-UQH3MOUBAPS | Source = Application Error | ID = 1000 Description = Aplikacja powodująca błąd acdsee.exe, wersja 4.0.0.526, moduł powodujący błąd acdsee.exe, wersja 4.0.0.526, adres błędu 0x00127a8d. Error - 09-11-15 10:51:00 | Computer Name = DOM-UQH3MOUBAPS | Source = Application Hang | ID = 1002 Description = Aplikacja zawieszająca AcroRd32.exe, wersja 9.0.0.332, moduł zawieszenia hungapp, wersja 0.0.0.0, adres zawieszenia 0x00000000. Error - 09-11-15 13:51:17 | Computer Name = DOM-UQH3MOUBAPS | Source = WmiAdapter | ID = 4099 Description = Otwarcie usługi nie powiodło się. Error - 09-11-15 19:31:40 | Computer Name = DOM-UQH3MOUBAPS | Source = Application Hang | ID = 1002 Description = Aplikacja zawieszająca sbrowser.exe, wersja 3.8.8.0, moduł zawieszenia hungapp, wersja 0.0.0.0, adres zawieszenia 0x00000000. [ System Events ] Error - 09-10-05 10:06:43 | Computer Name = DOM-UQH3MOUBAPS | Source = Server | ID = 2505 Description = Serwer nie mógł utworzyć powiązania do transportu \Device\NetBT_Tcpip_{E40AC295-ED81-411A-B60B-4A4D134DCC91}, ponieważ inny komputer w sieci ma tę samą nazwę. Nie można uruchomić serwera. Error - 09-11-07 10:15:10 | Computer Name = DOM-UQH3MOUBAPS | Source = Cdrom | ID = 262155 Description = Sterownik wykrył błąd kontrolera na \Device\CdRom0. Error - 09-11-07 10:15:16 | Computer Name = DOM-UQH3MOUBAPS | Source = Cdrom | ID = 262155 Description = Sterownik wykrył błąd kontrolera na \Device\CdRom0. Error - 09-11-07 10:15:23 | Computer Name = DOM-UQH3MOUBAPS | Source = Cdrom | ID = 262155 Description = Sterownik wykrył błąd kontrolera na \Device\CdRom0. Error - 09-11-07 10:15:29 | Computer Name = DOM-UQH3MOUBAPS | Source = Cdrom | ID = 262155 Description = Sterownik wykrył błąd kontrolera na \Device\CdRom0. Error - 09-11-07 10:15:35 | Computer Name = DOM-UQH3MOUBAPS | Source = Cdrom | ID = 262155 Description = Sterownik wykrył błąd kontrolera na \Device\CdRom0. Error - 09-11-15 13:51:17 | Computer Name = DOM-UQH3MOUBAPS | Source = Service Control Manager | ID = 7009 Description = Limit czasu (30000 milisekund) podczas oczekiwania na połączenie się z usługą Karta wydajności WMI. Error - 09-11-15 13:51:17 | Computer Name = DOM-UQH3MOUBAPS | Source = Service Control Manager | ID = 7000 Description = Nie można uruchomić usługi Karta wydajności WMI z powodu następującego błędu: %%1053 < End of report >

**Posty:** 2183 · przez **NieWiem** 17 Lis 2009, 16:14

1. To jest plik extras.txt, a potrzeby jest bardziej ten drugi: OTL.txt

2. Nie bierz logów w Quote, tylko w samo Code, bo się ich nie da czytać.

**Posty:** 40 · przez **Niewierny** 17 Lis 2009, 16:29

edit by wojtas.. wklej loga z OTL.txt

podzieliłem to na dwa bo na raz niedało się z tym ze jest na opak początek jest drugi

sorki za kłopot

**Posty:** 2183 · przez **NieWiem** 17 Lis 2009, 19:54

Może inaczej... pokasuj tamte logi i wklej je na www.wklej.org, a w postach daj tylko linki. Logów się nie dzieli i nie ucina!!

**Posty:** 40 · przez **Niewierny** 18 Lis 2009, 00:13

http://www.wklej.org/id/208703/ Logfile of HijackThis v1.99.1

http://www.wklej.org/id/208708/ OTL Extras logfile

teraz powinno być dobrze

**Posty:** 2183 · przez **NieWiem** 18 Lis 2009, 08:47

ale dalej nie dałeś tego właściwego loga, o którego prosimy

**Posty:** 40 · przez **Niewierny** 18 Lis 2009, 16:15

http://www.wklej.org/id/209211/ OTL logfile created on: 09-11-17 15:03:46

prosze

**Posty:** 18165 · przez **wojtas** 18 Lis 2009, 20:47

Uruchom OTL i w oknie Custom Scans/Fixes wklej :

:OTL
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: TaskMan - (C:\RECYCLER\S-1-5-21-6683272652-7424044346-898277519-9189\nissan.exe) - C:\RECYCLER\S-1-5-21-6683272652-7424044346-898277519-9189\nissan.exe ()
O33 - MountPoints2\{59d04776-8201-11de-b461-00e04c111413}\Shell\AutoRun\command - "" = J:\22yj2fy1.exe -- File not found
O33 - MountPoints2\{59d04776-8201-11de-b461-00e04c111413}\Shell\open\Command - "" = J:\22yj2fy1.exe -- File not found

:Files
C:\RECYCLER
c:\nds0q.exe
d:\nds0q.exe
e:\nds0q.exe
f:\nds0q.exe
g:\nds0q.exe
H:\nds0q.exe

:Reg
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{db1b3e60-05ac-11de-a5d3-00001cd72a97}]
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
"SuperHidden"=dword:00000001
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
"Hidden"=dword:00000001
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
"ShowSuperHidden"=dword:00000001
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL]
"CheckedValue"=dword:00000001
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\SuperHidden\Policy\DontShowSuperHidden]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\SuperHidden\Policy\DontShowSuperHidden]
@=""

:Commands
[emptytemp]
[start explorer]
[Reboot]

Kliknij w Run Fix. I potwierdz reset kompa .

Następnie uruchamiasz OTL z opcją Run Scan. Pokazujesz nowy log OTL.txt oraz raport z czyszczenia kompa

**Posty:** 40 · przez **Niewierny** 18 Lis 2009, 21:16

http://www.wklej.org/id/209501/ raport

http://www.wklej.org/id/209511/ OTL logfile created on: 09-11-18 20:09:48 - Run 2

pojawiły mi sie pilki ukryte i na kazdym dysku pojawiły sie takie pliki 1di1w.exe 2o1ajagt.exe ph.exe
przedtem miałem pełno innych plików tych samych na wszystkich dyskach jednak usunołem je nodem

Dodano 18.11.2009 20:26:31:
jeszcze takie foldery sie pojawiły na dyskach równiez jako ukryte RECYCLER z kluczami

S-1-5-21-117609710-2025429265-1801674531-1003
S-1-5-21-790525478-706699826-839522115-1003
S-1-5-21-1004336348-1715567821-839522115-500
S-1-5-21-1004336348-1715567821-839522115-1003
S-1-5-21-1645522239-1637723038-1417001333-1003
S-1-5-21-1659004503-2147184337-725345543-1003
S-1-5-21-1715567821-1409082233-839522115-1003

oraz folder o nazwie System Volume Information do którego nie mam dostępu

**Posty:** 18165 · przez **wojtas** 18 Lis 2009, 23:15

Daj loga z combofixa ale zainstaluj wraz z nim konsolę odzyskiwania ( instrukcja programu )

Kto jest na forum