niewidoczne dyski twarde

**Posty:** 3 · przez **Tee** 28 Lip 2008, 17:30

mam problem... nie widać mi dysków twardych w moim komputerze oraz przycisku "wyloguj". Dzięki z góry

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 17:16:36, on 2008-07-28 Platform: Windows XP Dodatek SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.5730.0013) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Netropa\Multimedia Keyboard\nhksrv.exe C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\PnkBstrA.exe C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\wscntfy.exe C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nTrayFw.exe C:\WINDOWS\SOUNDMAN.EXE C:\WINDOWS\system32\RUNDLL32.EXE C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe C:\Program Files\A4Tech\Mouse\Amoumain.exe C:\Program Files\Netropa\Multimedia Keyboard\MMKeybd.exe C:\program files\winamp\winampa.exe C:\WINDOWS\system32\rundll32.exe C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Netropa\Multimedia Keyboard\TrayMon.exe C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe C:\Program Files\Netropa\Onscreen Display\OSD.exe C:\Program Files\HighGrow\HighGrow.exe C:\Program Files\DAEMON Tools\daemon.exe C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe C:\Program Files\Winamp\winamp.exe D:\Codemasters\Colin McRae Rally 2\CMR2.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://media.warrock.net/inGameAds/index.html R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O3 - Toolbar: fdkowvbp - {DAFF005C-497A-4FD2-A9C9-5B8D1CE60806} - C:\WINDOWS\fdkowvbp.dll (file missing) O4 - HKLM\..\Run: [NVMixerTray] "C:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe" O4 - HKLM\..\Run: [nTrayFw] C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nTrayFw.exe O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" O4 - HKLM\..\Run: [WheelMouse] C:\Program Files\A4Tech\Mouse\Amoumain.exe O4 - HKLM\..\Run: [MULTIMEDIA KEYBOARD] C:\Program Files\Netropa\Multimedia Keyboard\MMKeybd.exe O4 - HKLM\..\Run: [WinampAgent] "c:\program files\winamp\winampa.exe" O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe" O4 - HKLM\..\Run: [b812a49a] rundll32.exe "C:\WINDOWS\system32\kbaaaqrg.dll",b O4 - HKLM\..\RunOnce: [SpybotDeletingA3446] command /c del "C:\WINDOWS\system32\iiffGWMG.dll" O4 - HKLM\..\RunOnce: [SpybotDeletingC4929] cmd /c del "C:\WINDOWS\system32\iiffGWMG.dll" O4 - HKLM\..\RunOnce: [SpybotSnD] "C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe" O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" O4 - HKCU\..\Run: [HighGrow] "C:\Program Files\HighGrow\HighGrow.exe" /A O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033 O4 - HKCU\..\RunOnce: [SpybotDeletingB1575] command /c del "C:\WINDOWS\system32\iiffGWMG.dll" O4 - HKUS\S-1-5-19\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'Default user') O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present O8 - Extra context menu item: Dodaj do blokowanych banerów - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\ie_banner_deny.htm O8 - Extra context menu item: E&ksportuj do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000 O9 - Extra button: Statystyki dla ochrony WWW - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\SCIEPlgn.dll O9 - Extra button: Wyślij do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra 'Tools' menuitem: Wyślij &do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O20 - AppInit_DLLs: C:\PROGRA~1\KASPER~1\KASPER~2.0\adialhk.dll O23 - Service: Kaspersky Internet Security 7.0 (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe O23 - Service: ForceWare Intelligent Application Manager (IAM) - Unknown owner - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe O23 - Service: Forceware Web Interface (ForcewareWebInterface) - Apache Software Foundation - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe O23 - Service: Netropa NHK Server (nhksrv) - Unknown owner - C:\Program Files\Netropa\Multimedia Keyboard\nhksrv.exe O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe O23 - Service: ForceWare IP service (nSvcIp) - NVIDIA - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe O23 - Service: ForceWare user log service (nSvcLog) - NVIDIA - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe -- End of file - 8289 bytes

**Posty:** 8001 · przez **Okocza** 28 Lip 2008, 17:31

Kod: Zaznacz wszystko: O3 - Toolbar: fdkowvbp - {DAFF005C-497A-4FD2-A9C9-5B8D1CE60806} - C:\WINDOWS\fdkowvbp.dll (file missing) O4 - HKLM\..\Run: [b812a49a] rundll32.exe "C:\WINDOWS\system32\kbaaaqrg.dll",b O4 - HKLM\..\RunOnce: [SpybotDeletingA3446] command /c del "C:\WINDOWS\system32\iiffGWMG.dll" O4 - HKLM\..\RunOnce: [SpybotDeletingC4929] cmd /c del "C:\WINDOWS\system32\iiffGWMG.dll"

to na fix w hj i wstaw log z combofixa

**Posty:** 7956 · przez **Magik** 28 Lip 2008, 17:33

Tee

http://forum.programosy.pl/przeczytaj-zanim-wstawisz-logi-na-forum-vt93842.html

i nie bede sie powtarzal :!: :!:

**Posty:** 3 · przez **Tee** 28 Lip 2008, 18:27

Kod: Zaznacz wszystko: ComboFix 08-07-27.6 - Marek 2008-07-28 18:06:33.1 - NTFSx86 NETWORK Microsoft Windows XP Professional 5.1.2600.3.1250.1.1045.18.355 [GMT 2:00] Running from: D:\Instalki i inne\ComboFix.exe [color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color] . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\WINDOWS\etpx.exe C:\WINDOWS\grswptdl.exe C:\WINDOWS\nfavxwdbwdx.dll C:\WINDOWS\privacy_danger C:\WINDOWS\privacy_danger\images\capt.gif C:\WINDOWS\privacy_danger\images\danger.jpg C:\WINDOWS\privacy_danger\images\down.gif C:\WINDOWS\privacy_danger\images\spacer.gif C:\WINDOWS\system32\geBSihIY.dll C:\WINDOWS\system32\grqaaabk.ini C:\WINDOWS\system32\iiffGWMG.dll C:\WINDOWS\system32\mcrh.tmp C:\WINDOWS\system32\YIhiSBeg.ini C:\WINDOWS\system32\YIhiSBeg.ini2 . ((((((((((((((((((((((((( Files Created from 2008-06-28 to 2008-07-28 ))))))))))))))))))))))))))))))) . 2008-07-28 17:16 . 2008-07-28 17:16 <DIR> d-------- C:\Program Files\Trend Micro 2008-07-28 04:27 . 2008-07-28 04:27 95,360 --a------ C:\WINDOWS\system32\kbaaaqrg.dll 2008-07-28 03:34 . 2008-07-28 03:38 <DIR> d-------- C:\fixwareout 2008-07-28 03:31 . 2008-07-28 03:31 <DIR> d-------- C:\Program Files\Spybot - Search & Destroy 2008-07-28 03:31 . 2008-07-28 03:49 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Spybot - Search & Destroy 2008-07-28 02:37 . 2008-07-28 02:37 21,840 --a------ C:\WINDOWS\system32\SIntfNT.dll 2008-07-28 02:37 . 2008-07-28 02:37 17,212 --a------ C:\WINDOWS\system32\SIntf32.dll 2008-07-28 02:37 . 2008-07-28 02:37 12,067 --a------ C:\WINDOWS\system32\SIntf16.dll 2008-07-28 02:33 . 1999-04-23 22:22 151,552 --a------ C:\WINDOWS\system32\MSOSS.DLL 2008-07-28 02:31 . 2008-07-28 02:31 <DIR> d-------- C:\Program Files\DAEMON Tools 2008-07-25 04:48 . 2008-07-25 04:48 606,848 --a------ C:\WINDOWS\flashax.exe 2008-07-25 04:48 . 2008-07-25 04:48 12,288 --a------ C:\WINDOWS\impborl.dll 2008-07-25 01:58 . 2008-07-25 01:58 <DIR> d-------- C:\Program Files\Real Alternative 2008-07-24 15:36 . 2008-07-24 15:37 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\NFS Underground 2008-07-24 15:35 . 2008-07-24 15:35 <DIR> d-------- C:\Program Files\Common Files\DirectX 2008-07-24 15:11 . 2008-07-25 04:39 <DIR> d-------- C:\Program Files\Yabause 2008-07-24 05:56 . 2008-07-25 13:21 <DIR> d-------- C:\Program Files\Google 2008-07-10 16:06 . 2008-07-10 16:35 <DIR> d-------- C:\Program Files\BearShare Acceleration Patch 2008-07-06 02:08 . 2008-07-25 12:38 682,232 --a------ C:\WINDOWS\system32\drivers\sptd.sys 2008-07-05 23:45 . 2008-07-06 02:06 <DIR> d-------- C:\Program Files\ePSXe InPCP 2008-07-05 02:18 . 2008-07-28 17:35 162,008 --a------ C:\WINDOWS\system32\drivers\PnkBstrK.sys 2008-07-05 02:18 . 2008-07-28 17:35 111,928 --a------ C:\WINDOWS\system32\PnkBstrB.exe 2008-07-05 02:17 . 2008-07-05 02:17 <DIR> d-------- C:\WINDOWS\system32\LogFiles 2008-07-05 02:17 . 2008-07-05 02:17 66,872 --a------ C:\WINDOWS\system32\PnkBstrA.exe 2008-07-05 01:57 . 2008-07-05 02:02 <DIR> d-------- C:\Program Files\HighGrow 2008-06-30 12:54 . 2008-07-28 02:45 69 --a------ C:\WINDOWS\NeroDigital.ini 2008-06-29 15:53 . 2008-06-29 15:53 <DIR> d-------- C:\Program Files\DivX . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-07-28 16:03 75,536 --sha-w C:\WINDOWS\system32\drivers\fidbox.idx 2008-07-28 16:03 5,169,952 --sha-w C:\WINDOWS\system32\drivers\fidbox.dat 2008-07-28 16:03 15,176 --sha-w C:\WINDOWS\system32\drivers\fidbox2.idx 2008-07-28 16:03 139,296 --sha-w C:\WINDOWS\system32\drivers\fidbox2.dat 2008-07-28 14:48 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab 2008-07-28 00:41 --------- d-----w C:\Documents and Settings\Marek\Dane aplikacji\Ahead 2008-07-28 00:33 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-07-24 03:46 96,559 ----a-w C:\WINDOWS\system32\drivers\klin.dat 2008-07-24 03:46 87,855 ----a-w C:\WINDOWS\system32\drivers\klick.dat 2008-07-11 08:43 --------- d-----w C:\Program Files\WinAce 2008-07-10 06:52 --------- d-----w C:\Program Files\Winamp 2008-07-10 06:52 --------- d-----w C:\Documents and Settings\Marek\Dane aplikacji\Winamp 2008-06-25 06:39 78,415 ----a-w C:\WINDOWS\system32\drivers\klif.cab 2008-06-25 06:39 --------- d-----w C:\Program Files\Kaspersky Lab 2008-06-25 06:38 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab Setup Files 2008-06-21 13:03 164,352 ----a-w C:\WINDOWS\epuninstall.exe 2008-06-20 23:29 --------- d-----w C:\Documents and Settings\Marek\Dane aplikacji\WoDBO 2008-06-20 11:51 361,600 ----a-w C:\WINDOWS\system32\drivers\tcpip.sys 2008-06-20 11:40 138,496 ----a-w C:\WINDOWS\system32\drivers\afd.sys 2008-06-20 11:08 225,856 ----a-w C:\WINDOWS\system32\drivers\tcpip6.sys 2008-06-19 19:50 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\nView_Profiles 2008-06-19 01:51 --------- d-----w C:\Program Files\Opera 2008-06-18 12:53 --------- d-----w C:\Documents and Settings\Marek\Dane aplikacji\ACD Systems 2008-06-17 08:36 --------- d-----w C:\Program Files\Netropa 2008-06-17 08:16 --------- d-----w C:\Documents and Settings\Marek\Dane aplikacji\Gadu-Gadu 2008-06-17 08:11 --------- d-----w C:\Program Files\Gadu-Gadu 2008-06-16 20:59 --------- d-----w C:\Program Files\A4Tech 2008-06-16 20:53 112,144 ----a-w C:\WINDOWS\system32\drivers\kl1.sys 2008-06-14 17:36 273,024 ----a-w C:\WINDOWS\system32\drivers\bthport.sys 2008-06-02 08:33 --------- d-----w C:\Program Files\QuickTime Alternative 2008-06-02 08:33 --------- d-----w C:\Program Files\Media Player Classic 2008-06-02 08:33 --------- d-----w C:\Program Files\Common Files\Adobe 2008-06-02 08:33 --------- d-----w C:\Documents and Settings\Marek\Dane aplikacji\InterTrust 2008-06-02 08:31 --------- d-----w C:\Program Files\MarBit 2008-06-02 08:31 --------- d-----w C:\Program Files\DivX PowerPack 2008-06-02 08:31 --------- d-----w C:\Program Files\Common Files\Internet Update 2008-06-02 08:30 --------- d-----w C:\Program Files\Common Files\ACD Systems 2008-06-02 08:30 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\ACD Systems 2008-06-02 08:29 --------- d-----w C:\Program Files\CyberLink 2008-06-02 08:29 --------- d-----w C:\Program Files\ACD Systems 2008-06-02 08:29 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\CyberLink 2008-06-02 08:26 --------- d-----w C:\Program Files\Nero 2008-06-02 08:26 --------- d-----w C:\Program Files\Common Files\Ahead 2008-06-02 08:26 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Nero 2008-06-02 08:19 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Microsoft Help 2008-06-02 08:18 --------- d-----w C:\Program Files\Microsoft Works 2008-06-02 08:15 --------- d-----w C:\Program Files\Everest Ultimate Edition 2006 v3.00.630 PL 2008-06-02 08:09 --------- d-----w C:\Program Files\Realtek AC97 2008-06-02 08:05 --------- d-----w C:\Program Files\NVIDIA Corporation 2008-06-02 08:04 --------- d-----w C:\Program Files\Common Files\NVIDIA Shared 2008-06-02 08:04 --------- d-----w C:\Program Files\Common Files\InstallShield 2008-06-02 07:49 --------- d-----w C:\Program Files\microsoft frontpage 2008-06-02 07:47 --------- d-----w C:\Program Files\Usługi online 2008-06-02 07:45 --------- d-----w C:\Program Files\Windows Media Connect 2 . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2008-04-15 14:00 15360] "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2007-03-12 13:49 153136] "HighGrow"="C:\Program Files\HighGrow\HighGrow.exe" [2005-04-19 16:26 1769472] "DAEMON Tools"="C:\Program Files\DAEMON Tools\daemon.exe" [2007-04-04 00:29 165784] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce] "SpybotDeletingB1575"="command" [X] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NVMixerTray"="C:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe" [2004-06-03 20:51 131072] "nTrayFw"="C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nTrayFw.exe" [2005-04-29 18:22 266240] "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-12-05 01:41 8523776] "NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-12-05 01:41 81920] "NeroFilterCheck"="C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" [2007-03-09 18:53 153136] "RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [2003-10-31 19:42 32768] "WheelMouse"="C:\Program Files\A4Tech\Mouse\Amoumain.exe" [2006-05-14 10:37 200704] "MULTIMEDIA KEYBOARD"="C:\Program Files\Netropa\Multimedia Keyboard\MMKeybd.exe" [2002-07-25 01:45 167936] "WinampAgent"="c:\program files\winamp\winampa.exe" [2008-07-09 23:33 36352] "b812a49a"="C:\WINDOWS\system32\kbaaaqrg.dll" [2008-07-28 04:27 95360] "SoundMan"="SOUNDMAN.EXE" [2007-04-16 15:28 577536 C:\WINDOWS\soundman.exe] "nwiz"="nwiz.exe" [2007-12-05 01:41 1626112 C:\WINDOWS\system32\nwiz.exe] "BluetoothAuthenticationAgent"="bthprops.cpl" [2008-04-15 14:00 110592 C:\WINDOWS\system32\bthprops.cpl] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce] "nltide_2"="shell32" [X] [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "%windir%\\system32\\sessmgr.exe"= "C:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"= "C:\\Program Files\\Gadu-Gadu\\gg.exe"= "D:\\BearShare\\BearShare.exe"= "D:\\Age of Empires II\\age2_x1.exe"= "D:\\EA Games\\Speed.exe"= R1 msikbd2k;Multimedia Keyboard Filter Driver;C:\WINDOWS\system32\DRIVERS\msikbd2k.sys [2001-12-20 09:02] R3 klim5;Kaspersky Anti-Virus NDIS Filter;C:\WINDOWS\system32\DRIVERS\klim5.sys [2007-04-04 14:58] S2 nhksrv;Netropa NHK Server;C:\Program Files\Netropa\Multimedia Keyboard\nhksrv.exe [2001-08-06 06:41] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\E] \Shell\AutoRun\command - E:\RunGame.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\F] \Shell\AutoRun\command - F:\Setup.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{da659d3e-307a-11dd-adda-806d6172696f}] \Shell\AutoRun\command - E:\RunGame.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{da659d3f-307a-11dd-adda-806d6172696f}] \Shell\AutoRun\command - F:\Setup.exe . - - - - ORPHANS REMOVED - - - - Toolbar-{DAFF005C-497A-4FD2-A9C9-5B8D1CE60806} - C:\WINDOWS\fdkowvbp.dll . ------- Supplementary Scan ------- . R0 -: HKCU-Main,Start Page = about:blank R1 -: HKCU-Internet Connection Wizard,ShellNext = hxxp://media.warrock.net/inGameAds/index.html O8 -: E&ksportuj do programu Microsoft Excel - C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000 ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-07-28 18:09:26 Windows 5.1.2600 Dodatek Service Pack 3 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . ------------------------ Other Running Processes ------------------------ . C:\WINDOWS\system32\rundll32.exe . ************************************************************************** . Completion time: 2008-07-28 18:11:25 - machine was rebooted [Marek] ComboFix-quarantined-files.txt 2008-07-28 16:11:23 Pre-Run: 33,294,401,536 bajtów wolnych Post-Run: 33,225,396,224 bajt˘w wolnych 188 --- E O F --- 2008-07-09 12:00:07

oto log z combofixa

**Posty:** 7956 · przez **Magik** 28 Lip 2008, 18:35

wklej do notatnika

Kod: Zaznacz wszystko: Windows Registry Editor Version 5.00 [-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\E] [-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\F] [-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{da659d3e-307a-11dd-adda-806d6172696f}] [-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{da659d3f-307a-11dd-adda-806d6172696f}]

zapisz jako fix.reg i odpal

przeskanuj kompa jeszcze tym
http://forum.programosy.pl/program-szukajacy-trojanow-i-malware-vt97108.html

i
http://www.programosy.pl/program,avg-anti-spyware.html

**Posty:** 3 · przez **Tee** 28 Lip 2008, 21:06

FixDef:

Kod: Zaznacz wszystko: ******************************************************************************** * * * FixIEDef Log * * Version 1.5.3.6038 * * * ******************************************************************************** Created at 18:42:37 on Monday, July 28, 2008 Time Zone : Logged On User : Marek Operating System : Microsoft Windows XP Professional Dodatek Service Pack 3 OS Version : 5.1.2600 System Langauge : Polish Keyboard Layout : Polish Processor : X86 AMD Athlon(tm) 64 Processor 3500+ System Drive : C:\ Windows Directory : C:\WINDOWS System Directory : C:\WINDOWS\system32 Total Physical Memory : 523748 KB Free Physical Memory : 205636 KB Total Virtual Memory : 2097024 KB Free Virtual Memory : 2018164 KB Boot State : Normal boot -------------------------------------------------------------------------------- !!! Files that have been deleted !!! C:\WINDOWS\system32\_nvidia_xxx_.log C:\WINDOWS\system32\nmp.log -------------------------------------------------------------------------------- !!! Directories that have been removed !!! No malicious directories to be removed -------------------------------------------------------------------------------- !!! Registry entries that have been removed !!! No malicious Registry entries found ================================================================================ All Done :) ShadowPuterDude Safe Surfing!!!

[ Dodano: Dzisiaj o 21:07 ]
AVG:

Kod: Zaznacz wszystko: --------------------------------------------------------- AVG Anti-Spyware - Scan Report --------------------------------------------------------- + Created at: 21:00:38 2008-07-28 + Scan result: D:\Instalki i inne\cFosSpeed_by_p1t3r3k.rar/cfosspeed_crack!.exe -> Backdoor.Pcclient : No action taken. D:\Instalki i inne\cfosspeed.exe -> Backdoor.Pcclient : No action taken. :mozilla.65:C:\Documents and Settings\Marek\Dane aplikacji\Mozilla\Firefox\Profiles\qgib6qbb.default\cookies.txt -> TrackingCookie.Advertising : No action taken. :mozilla.66:C:\Documents and Settings\Marek\Dane aplikacji\Mozilla\Firefox\Profiles\qgib6qbb.default\cookies.txt -> TrackingCookie.Advertising : No action taken. :mozilla.67:C:\Documents and Settings\Marek\Dane aplikacji\Mozilla\Firefox\Profiles\qgib6qbb.default\cookies.txt -> TrackingCookie.Advertising : No action taken. :mozilla.68:C:\Documents and Settings\Marek\Dane aplikacji\Mozilla\Firefox\Profiles\qgib6qbb.default\cookies.txt -> TrackingCookie.Advertising : No action taken. :mozilla.69:C:\Documents and Settings\Marek\Dane aplikacji\Mozilla\Firefox\Profiles\qgib6qbb.default\cookies.txt -> TrackingCookie.Advertising : No action taken. :mozilla.323:C:\Documents and Settings\Marek\Dane aplikacji\Mozilla\Firefox\Profiles\qgib6qbb.default\cookies.txt -> TrackingCookie.Googleadservices : No action taken. :mozilla.324:C:\Documents and Settings\Marek\Dane aplikacji\Mozilla\Firefox\Profiles\qgib6qbb.default\cookies.txt -> TrackingCookie.Googleadservices : No action taken. :mozilla.221:C:\Documents and Settings\Marek\Dane aplikacji\Mozilla\Firefox\Profiles\qgib6qbb.default\cookies.txt -> TrackingCookie.Tacoda : No action taken. :mozilla.222:C:\Documents and Settings\Marek\Dane aplikacji\Mozilla\Firefox\Profiles\qgib6qbb.default\cookies.txt -> TrackingCookie.Tacoda : No action taken. :mozilla.223:C:\Documents and Settings\Marek\Dane aplikacji\Mozilla\Firefox\Profiles\qgib6qbb.default\cookies.txt -> TrackingCookie.Tacoda : No action taken. :mozilla.224:C:\Documents and Settings\Marek\Dane aplikacji\Mozilla\Firefox\Profiles\qgib6qbb.default\cookies.txt -> TrackingCookie.Tacoda : No action taken. ::Report end

**Posty:** 7956 · przez **Magik** 28 Lip 2008, 21:08

Wklej teraz jeszcze raz oba logi z HJT i combofix'a :arrow:

niewidoczne dyski twarde

niewidoczne dyski twarde

Kto jest na forum