problem z usunięciem programu

**Posty:** 112 · przez **dziubek12** 19 Lut 2008, 13:02

Proszę o pomoc w usunięciu pozostałości po odinstalowanym programie. Z płyty instalacyjnej nie idzie; strona producenta..oczywiście niedostepna. Chodzi o program symantec antywirus ednpoint protection. Komputer chodzi fatalnie (mam nadzieję, że tylko z tego powodu).

Kod: Zaznacz wszystko: Logfile of HijackThis v1.99.1 Scan saved at 11:54:00, on 2008-02-19 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16608) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\System32\CTSvcCDA.EXE C:\Program Files\Firebird\Firebird_1_5\bin\fbguard.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\WINDOWS\System32\nvsvc32.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\MsPMSPSv.exe C:\Program Files\Firebird\Firebird_1_5\bin\fbserver.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\System32\Rscmpt.exe C:\WINDOWS\system32\Linksts.exe C:\Program Files\Hewlett-Packard\Toolbox\Apache Tomcat 4.0\webapps\Toolbox\StatusClient\StatusClient.exe C:\Program Files\Cobian Backup 7\CobBU.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Common Files\Vision\vservice.exe C:\PROGRA~1\COMMON~1\Vision\dbserv.exe C:\Program Files\Cobian Backup 7\cobui.exe C:\Program Files\Hewlett-Packard\Toolbox\jre\bin\javaw.exe C:\WINDOWS\System32\msiexec.exe C:\WINDOWS\system32\HPBPRO.EXE C:\DOCUME~1\root\USTAWI~1\Temp\Katalog tymczasowy 1 dla hijackthis_199.zip\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = file:///D:/Grzesiek/programy/index.htm R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigURL = http://www.krosno.lasy.gov.pl/proxy.pac R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = ftp=10.4.253.10:80;gopher=10.4.253.10:80;http=10.4.253.10:80 R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 83.13.79.58;18081;18082;18083;<local> R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O4 - HKLM\..\Run: [Rscmpt] C:\WINDOWS\System32\Rscmpt.exe O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize O4 - HKLM\..\Run: [ISDN Monitor] Linksts.exe W 1024 O4 - HKLM\..\Run: [RegisterDropHandler] C:\PROGRA~1\TEXTBR~1.0\Bin\REGIST~1.EXE O4 - HKLM\..\Run: [StatusClient 2.5] C:\Program Files\Hewlett-Packard\Toolbox\Apache Tomcat 4.0\webapps\Toolbox\StatusClient\StatusClient.exe /auto O4 - HKLM\..\Run: [TomcatStartup 2.5] C:\Program Files\Hewlett-Packard\Toolbox\hpbpsttp.exe O4 - HKLM\..\Run: [Cobian Backup 7] "C:\Program Files\Cobian Backup 7\CobBU.exe" O4 - HKLM\..\RunServices: [RegisterDropHandler] C:\PROGRA~1\TEXTBR~1.0\Bin\REGIST~1.EXE O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [Spamihilator] "C:\Program Files\Spamihilator\spamihilator.exe" O4 - Global Startup: Vision Services.lnk = C:\Program Files\Common Files\Vision\vservice.exe O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O8 - Extra context menu item: Konwertuj do Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html O8 - Extra context menu item: Konwertuj miejsce docelowe łącza do Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html O8 - Extra context menu item: Konwertuj miejsce docelowe łącza do istniejącego pliku PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html O8 - Extra context menu item: Konwertuj wybrane łącza do Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html O8 - Extra context menu item: Konwertuj zaznaczenie do Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html O8 - Extra context menu item: Konwertuj zaznaczenie do istniejącego pliku PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O11 - Options group: [INTERNATIONAL] International* O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://download.ewido.net/ewidoOnlineScan.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{15D3B045-1339-4D69-9A0E-ECF64A63B700}: NameServer = 194.204.159.1,194.204.152.34 O17 - HKLM\System\CCS\Services\Tcpip\..\{19FBDA18-CA25-4FBD-AEC4-B5F512F48877}: NameServer = 10.4.253.10,194.204.159.1 O20 - Winlogon Notify: NavLogon - C:\WINDOWS\ O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll O23 - Service: Symantec Event Manager (ccEvtMgr) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing) O23 - Service: Symantec Settings Manager (ccSetMgr) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing) O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTSvcCDA.EXE O23 - Service: Firebird Guardian - DefaultInstance (FirebirdGuardianDefaultInstance) - The Firebird Project - C:\Program Files\Firebird\Firebird_1_5\bin\fbguard.exe O23 - Service: Firebird Server - DefaultInstance (FirebirdServerDefaultInstance) - The Firebird Project - C:\Program Files\Firebird\Firebird_1_5\bin\fbserver.exe O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe O23 - Service: Symantec Management Client (SmcService) - Unknown owner - C:\Program Files\Symantec\Symantec Endpoint Protection\Smc.exe (file missing) O23 - Service: Symantec Network Access Control (SNAC) - Unknown owner - C:\Program Files\Symantec\Symantec Endpoint Protection\SNAC.EXE (file missing) O23 - Service: Symantec Endpoint Protection (Symantec AntiVirus) - Unknown owner - C:\Program Files\Symantec\Symantec Endpoint Protection\Rtvscan.exe (file missing)

**Posty:** 18165 · przez **wojtas** 19 Lut 2008, 13:31

uzyj :

http://pclab.pl/file1481.html

i skasuj:

O20 - Winlogon Notify: NavLogon - C:\WINDOWS\

**Posty:** 112 · przez **dziubek12** 19 Lut 2008, 13:53

Właśnie nie mogę dostać się na te strony od jakiegoś czasu - nie ma jakiejś innej lokalizacji, albo programu?

**Posty:** 3854 · przez **Dzi@dek** 19 Lut 2008, 14:55

http://norton-removal-tool.pl.malavida.com/d1223-sciaganie-gratis-windows
http://www.majorgeeks.com/Norton_Removal_Tool_SymNRT_d4749.html

**Posty:** 112 · przez **dziubek12** 20 Lut 2008, 09:03

Jak na złośc nie idzie z żadnej lokalizacji. Próbuję szukac przez google, ale też nic. Może ma ktoś z forumowiczów i w uprzejmości swej by przesłał..

**Posty:** 18165 · przez **wojtas** 20 Lut 2008, 11:19

sprobuj sciagnac z tad:

http://www.sendspace.pl/file/gCD3Y8YA/

**Posty:** 112 · przez **dziubek12** 20 Lut 2008, 12:22

Program nie poradził sobie...Po działaniach:

Kod: Zaznacz wszystko: Logfile of HijackThis v1.99.1 Scan saved at 11:22:40, on 2008-02-20 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16608) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\System32\CTSvcCDA.EXE C:\Program Files\Firebird\Firebird_1_5\bin\fbguard.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\WINDOWS\Explorer.EXE C:\WINDOWS\System32\nvsvc32.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\Rscmpt.exe C:\WINDOWS\system32\Linksts.exe C:\Program Files\Hewlett-Packard\Toolbox\Apache Tomcat 4.0\webapps\Toolbox\StatusClient\StatusClient.exe C:\Program Files\Cobian Backup 7\CobBU.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Common Files\Vision\vservice.exe C:\PROGRA~1\COMMON~1\Vision\dbserv.exe C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe C:\Program Files\Cobian Backup 7\cobui.exe C:\Program Files\Hewlett-Packard\Toolbox\jre\bin\javaw.exe C:\WINDOWS\System32\MsPMSPSv.exe C:\Program Files\Firebird\Firebird_1_5\bin\fbserver.exe C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\system32\wuauclt.exe C:\DOCUME~1\root\USTAWI~1\Temp\Katalog tymczasowy 2 dla hijackthis_199.zip\HijackThis.exe C:\WINDOWS\system32\HPBPRO.EXE R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = file:///D:/Grzesiek/programy/index.htm R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigURL = http://www.krosno.lasy.gov.pl/proxy.pac R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = ftp=10.4.253.10:80;gopher=10.4.253.10:80;http=10.4.253.10:80 R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 83.13.79.58;18081;18082;18083;<local> R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O4 - HKLM\..\Run: [Rscmpt] C:\WINDOWS\System32\Rscmpt.exe O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize O4 - HKLM\..\Run: [ISDN Monitor] Linksts.exe W 1024 O4 - HKLM\..\Run: [RegisterDropHandler] C:\PROGRA~1\TEXTBR~1.0\Bin\REGIST~1.EXE O4 - HKLM\..\Run: [StatusClient 2.5] C:\Program Files\Hewlett-Packard\Toolbox\Apache Tomcat 4.0\webapps\Toolbox\StatusClient\StatusClient.exe /auto O4 - HKLM\..\Run: [TomcatStartup 2.5] C:\Program Files\Hewlett-Packard\Toolbox\hpbpsttp.exe O4 - HKLM\..\Run: [Cobian Backup 7] "C:\Program Files\Cobian Backup 7\CobBU.exe" O4 - HKLM\..\RunServices: [RegisterDropHandler] C:\PROGRA~1\TEXTBR~1.0\Bin\REGIST~1.EXE O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [Spamihilator] "C:\Program Files\Spamihilator\spamihilator.exe" O4 - Global Startup: Vision Services.lnk = C:\Program Files\Common Files\Vision\vservice.exe O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O8 - Extra context menu item: Konwertuj do Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html O8 - Extra context menu item: Konwertuj miejsce docelowe łącza do Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html O8 - Extra context menu item: Konwertuj miejsce docelowe łącza do istniejącego pliku PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html O8 - Extra context menu item: Konwertuj wybrane łącza do Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html O8 - Extra context menu item: Konwertuj zaznaczenie do Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html O8 - Extra context menu item: Konwertuj zaznaczenie do istniejącego pliku PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O11 - Options group: [INTERNATIONAL] International* O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://download.ewido.net/ewidoOnlineScan.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{15D3B045-1339-4D69-9A0E-ECF64A63B700}: NameServer = 194.204.159.1,194.204.152.34 O17 - HKLM\System\CCS\Services\Tcpip\..\{19FBDA18-CA25-4FBD-AEC4-B5F512F48877}: NameServer = 10.4.253.10,194.204.159.1 O20 - Winlogon Notify: NavLogon - C:\WINDOWS\ O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTSvcCDA.EXE O23 - Service: Firebird Guardian - DefaultInstance (FirebirdGuardianDefaultInstance) - The Firebird Project - C:\Program Files\Firebird\Firebird_1_5\bin\fbguard.exe O23 - Service: Firebird Server - DefaultInstance (FirebirdServerDefaultInstance) - The Firebird Project - C:\Program Files\Firebird\Firebird_1_5\bin\fbserver.exe O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe O23 - Service: Symantec Management Client (SmcService) - Unknown owner - C:\Program Files\Symantec\Symantec Endpoint Protection\Smc.exe (file missing) O23 - Service: Symantec Network Access Control (SNAC) - Unknown owner - C:\Program Files\Symantec\Symantec Endpoint Protection\SNAC.EXE (file missing) O23 - Service: Symantec Endpoint Protection (Symantec AntiVirus) - Unknown owner - C:\Program Files\Symantec\Symantec Endpoint Protection\Rtvscan.exe (file missing)

**Posty:** 18165 · przez **wojtas** 20 Lut 2008, 13:17

O20 - Winlogon Notify: NavLogon - C:\WINDOWS\

Uruchamiasz HijackThis => klikasz Do a system scan only => pokaże się lista wpisów => stawiasz ptaszek przy wpisach, które wymieniłem => klikasz Fix checked i potwierdzasz usunięcie.

sciagnij:

combofixa

Otworz notatnik i wklej w nim to:

Folder::
C:\Program Files\Symantec

Driver::
SmcService
SNAC
Symantec AntiVirus

Plik >>> zapisz jako CFScript.txt .Plik przeciągnij i upuść na ikonę ComboFixa (tak jak tu ) . odczekaj az wygeneruje sie nowy log i go daj na forum

**Posty:** 112 · przez **dziubek12** 20 Lut 2008, 14:59

Po zabiegach

Kod: Zaznacz wszystko: ComboFix 08-02-20.2 - root 2008-02-20 13:47:55.2 - [color=red][b]FAT32[/b][/color]x86 Microsoft Windows XP Home Edition 5.1.2600.2.1250.1.1045.18.281 [GMT 1:00] Running from: C:\Documents and Settings\root\Pulpit\ComboFix.exe Command switches used :: C:\Documents and Settings\root\Pulpit\CFScript.txt * Created a new restore point [color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color] . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\Program Files\vision\admupdat.exe C:\Program Files\vision\dsexp.exe C:\Program Files\vision\Examples\bd\Bd2cust.dfm C:\Program Files\vision\Examples\bd\Bd2cust.pas C:\Program Files\vision\Examples\bd\Bd2demo.dpr C:\Program Files\vision\Examples\bd\Bd2demo.exe C:\Program Files\vision\Examples\bd\Bd2demo.res C:\Program Files\vision\Examples\bd\Bd2std.dfm C:\Program Files\vision\Examples\bd\Bd2std.pas C:\Program Files\vision\Examples\dropsco.sql C:\Program Files\vision\Examples\Excel\Profit.xls C:\Program Files\vision\Examples\Pb\pb5demo.exe C:\Program Files\vision\Examples\Pb\pb5demo.ico C:\Program Files\vision\Examples\Pb\pb5demo.pbl C:\Program Files\vision\Examples\sales.sql C:\Program Files\vision\Examples\scodemo.sql C:\Program Files\vision\Examples\Vb\Datacon.frm C:\Program Files\vision\Examples\Vb\Datacon.vbp C:\Program Files\vision\Examples\Vb\Grid32.ocx C:\Program Files\vision\Examples\Vb\Threed32.ocx C:\Program Files\vision\Examples\Vb\Vb4demo.exe C:\Program Files\vision\Examples\Vb\Vb4demo.frm C:\Program Files\vision\Examples\Vb\Vb4demo.vbp C:\Program Files\vision\gold32.exe C:\Program Files\vision\hostexp.exe C:\Program Files\vision\HostWiz.exe C:\Program Files\vision\MSGPAD.exe C:\Program Files\vision\ProxyWiz.exe C:\Program Files\vision\rps.exe C:\Program Files\vision\system\Admin.reg C:\Program Files\vision\system\appwiz.reg C:\Program Files\vision\system\Conmon.reg C:\Program Files\vision\system\Dao\dao2532.tlb C:\Program Files\vision\system\Dao\Dao3032.dll C:\Program Files\vision\system\English\Ats.cnt C:\Program Files\vision\system\English\Ats.hlp C:\Program Files\vision\system\English\Cnaccess.hlp C:\Program Files\vision\system\English\Cnodbc.hlp C:\Program Files\vision\system\English\Cnsq.hlp C:\Program Files\vision\system\English\Cnvca.hlp C:\Program Files\vision\system\English\Cnvisn.cnt C:\Program Files\vision\system\English\Cnvisn.hlp C:\Program Files\vision\system\English\Common.hlp C:\Program Files\vision\system\English\Conmon.cnt C:\Program Files\vision\system\English\Conmon.hlp C:\Program Files\vision\system\English\Hostexp.cnt C:\Program Files\vision\system\English\Hostexp.hlp C:\Program Files\vision\system\English\Licts.cnt C:\Program Files\vision\system\English\Licts.hlp C:\Program Files\vision\system\English\Msgpad.cnt C:\Program Files\vision\system\English\Msgpad.hlp C:\Program Files\vision\system\English\Netcheck.cnt C:\Program Files\vision\system\English\Netcheck.hlp C:\Program Files\vision\system\English\ODBCINST.CNT C:\Program Files\vision\system\English\ODBCINST.HLP C:\Program Files\vision\system\English\Ots.cnt C:\Program Files\vision\system\English\Ots.hlp C:\Program Files\vision\system\English\Rps.cnt C:\Program Files\vision\system\English\Rps.hlp C:\Program Files\vision\system\English\Sqlgold.cnt C:\Program Files\vision\system\English\Sqlgold.hlp C:\Program Files\vision\system\English\Userview.cnt C:\Program Files\vision\system\English\Userview.hlp C:\Program Files\vision\system\English\Vcats.cnt C:\Program Files\vision\system\English\Vcats.hlp C:\Program Files\vision\system\English\Vcnacces.cnt C:\Program Files\vision\system\English\Vcnodbc.cnt C:\Program Files\vision\system\English\Vcnusacc.cnt C:\Program Files\vision\system\English\Vcnusodb.cnt C:\Program Files\vision\system\English\Vcnusvca.cnt C:\Program Files\vision\system\English\Vcnvisn.cnt C:\Program Files\vision\system\English\Vconmon.cnt C:\Program Files\vision\system\English\Vhostexp.cnt C:\Program Files\vision\system\English\Vision.cnt C:\Program Files\vision\system\English\Vision.hlp C:\Program Files\vision\system\English\Visionts.cnt C:\Program Files\vision\system\English\Visionts.hlp C:\Program Files\vision\system\English\Vmsgpad.cnt C:\Program Files\vision\system\English\Vnetchec.cnt C:\Program Files\vision\system\English\Vrps.cnt C:\Program Files\vision\system\English\Vsqlgold.cnt C:\Program Files\vision\system\English\Vuserviw.cnt C:\Program Files\vision\system\English\Vwc32.cnt C:\Program Files\vision\system\English\Vwc32.hlp C:\Program Files\vision\system\English\Vwodbc.cnt C:\Program Files\vision\system\English\Vwodbc.hlp C:\Program Files\vision\system\General.reg C:\Program Files\vision\system\HOSTFCTL.dll C:\Program Files\vision\system\Hostview.reg C:\Program Files\vision\system\Infosrv.reg C:\Program Files\vision\system\Launch.reg C:\Program Files\vision\system\MSGPAD.REG C:\Program Files\vision\system\Netcheck.reg C:\Program Files\vision\system\PRTCTL.dll C:\Program Files\vision\system\restrict.reg C:\Program Files\vision\system\rifx.exe C:\Program Files\vision\system\rifxx.dll C:\Program Files\vision\system\Rifxx.reg C:\Program Files\vision\system\rps.reg C:\Program Files\vision\system\Rpsx.dll C:\Program Files\vision\system\Sqlr\dialogs.dll C:\Program Files\vision\system\Sqlr\mkscript.exe C:\Program Files\vision\system\Sqlr\Reboot.exe C:\Program Files\vision\system\Sqlr\script.ini C:\Program Files\vision\system\Sqlr\Upgrade.exe C:\Program Files\vision\system\Sqlrrel.reg C:\Program Files\vision\system\Sqlsetup.reg C:\Program Files\vision\system\Sqrelnot.txt C:\Program Files\vision\system\UPDTCTL.dll C:\Program Files\vision\system\USERVIEW.REG C:\Program Files\vision\system\vwarps.dll C:\Program Files\vision\system\VWARPS.REG C:\Program Files\vision\system\Vwc32.reg C:\Program Files\vision\system\Vwcntrl.reg C:\Program Files\vision\system\vwodbc.reg C:\Program Files\vision\system\vwxlt.reg C:\Program Files\vision\system\Workbsrv.reg C:\Program Files\vision\unixwizd.exe C:\Program Files\vision\User\Browser\Classes\Rprogram\Class C:\Program Files\vision\User\Browser\Classes\Rprogram\Open.rps C:\Program Files\vision\User\Config\Base.vcc C:\Program Files\vision\User\Config\Generic.vcc C:\Program Files\vision\User\Config\Hostfind.vcf C:\Program Files\vision\User\Config\Ipx.vcc C:\Program Files\vision\User\Config\Launch.vcf C:\Program Files\vision\User\Config\Modem.vct C:\Program Files\vision\User\Config\Ser-com1.vct C:\Program Files\vision\User\Config\Serial.vcc C:\Program Files\vision\User\Config\SPX-Unix.vct C:\Program Files\vision\User\Config\Tcp-unix.vct C:\Program Files\vision\User\Config\Tcp.vcc C:\Program Files\vision\User\Config\Update.vcf C:\Program Files\vision\User\Config\Usp-tcp.vct C:\Program Files\vision\userview.exe C:\Program Files\vision . ---- Previous Run ------- . C:\WINDOWS\system32\v97 . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\LEGACY_SMCSERVICE -------\LEGACY_SYMANTEC_ANTIVIRUS -------\nm -------\SmcService -------\SNAC -------\Symantec AntiVirus ((((((((((((((((((((((((( Files Created from 2008-01-20 to 2008-02-20 ))))))))))))))))))))))))))))))) . 2008-02-19 10:56 . 2008-02-19 10:56 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\CrystalIdea Software 2008-02-19 10:53 . 2008-02-19 10:53 <DIR> d-------- C:\Program Files\Uninstall Tool 2008-02-19 10:32 . 2008-02-19 10:32 <DIR> d-------- C:\Program Files\Smarty Uninstaller Pro 2008-02-19 10:32 . 2007-08-15 12:09 417,792 --a------ C:\WINDOWS\system32\vbalCmdBar6.ocx 2008-02-19 10:32 . 2007-08-15 12:09 262,144 --a------ C:\WINDOWS\system32\lst_v.ocx 2008-02-19 10:32 . 2007-08-15 12:09 159,744 --a------ C:\WINDOWS\system32\wt_menu.dll 2008-02-19 10:32 . 2007-08-15 12:09 94,208 --a------ C:\WINDOWS\system32\img_lst.ocx 2008-02-19 10:32 . 2007-08-15 12:09 40,960 --a------ C:\WINDOWS\system32\ssubtmr6.dll 2008-02-19 09:03 . 2008-02-19 09:03 <DIR> d--hs---- C:\FOUND.001 2008-02-18 12:04 . 2008-02-18 12:04 <DIR> d--hs---- C:\FOUND.000 2008-01-22 14:18 . 2008-02-19 11:00 10,652 --a------ C:\WINDOWS\system32\drivers\SYMEVENT.CAT 2008-01-22 14:18 . 2008-02-19 11:00 806 --a------ C:\WINDOWS\system32\drivers\SYMEVENT.INF 2008-01-22 14:09 . 2008-01-22 14:09 <DIR> d-------- C:\WINDOWS\SxsCaPendDel . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-01-11 05:41 44,544 ----a-w C:\WINDOWS\system32\dllcache\pngfilt.dll 2007-12-19 22:58 347,136 ----a-w C:\WINDOWS\system32\dllcache\dxtmsft.dll 2007-12-18 09:51 179,584 ------w C:\WINDOWS\system32\dllcache\mrxdav.sys 2007-12-08 05:14 3,592,192 ----a-w C:\WINDOWS\system32\dllcache\mshtml.dll 2007-12-06 11:06 625,664 ------w C:\WINDOWS\system32\dllcache\iexplore.exe 2007-12-06 11:05 70,656 ------w C:\WINDOWS\system32\dllcache\ie4uinit.exe 2007-12-06 11:00 13,824 ------w C:\WINDOWS\system32\dllcache\ieudinit.exe 2007-12-06 04:59 161,792 ----a-w C:\WINDOWS\system32\dllcache\ieakui.dll 2007-12-04 18:42 550,912 ------w C:\WINDOWS\system32\oleaut32.dll 2007-12-04 18:42 550,912 ------w C:\WINDOWS\system32\dllcache\oleaut32.dll 2007-03-08 06:50 102,264 ----a-w C:\Documents and Settings\root\Dane aplikacji\GDIPFONTCACHEV1.DAT 2003-07-08 07:04 722 ----a-w C:\Program Files\INSTALL.LOG . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 08:44 15360] "Spamihilator"="C:\Program Files\Spamihilator\spamihilator.exe" [ ] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Rscmpt"="C:\WINDOWS\System32\Rscmpt.exe" [2002-08-22 03:48 481792] "NvCplDaemon"="NvQTwk" [] "ISDN Monitor"="Linksts.exe" [2000-04-07 15:57 49152 C:\WINDOWS\system32\linksts.exe] "RegisterDropHandler"="C:\PROGRA~1\TEXTBR~1.0\Bin\REGIST~1.EXE" [ ] "StatusClient 2.5"="C:\Program Files\Hewlett-Packard\Toolbox\Apache Tomcat 4.0\webapps\Toolbox\StatusClient\StatusClient.exe" [2003-10-01 00:39 61440] "TomcatStartup 2.5"="C:\Program Files\Hewlett-Packard\Toolbox\hpbpsttp.exe" [2003-06-10 18:47 155648] "Cobian Backup 7"="C:\Program Files\Cobian Backup 7\CobBU.exe" [2005-10-18 15:10 127488] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices] "RegisterDropHandler"="C:\PROGRA~1\TEXTBR~1.0\Bin\REGIST~1.EXE" [ ] C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\ Vision Services.lnk - C:\Program Files\Common Files\Vision\vservice.exe [2004-06-04 14:51:07 626688] Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 22:05:26 29696] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-] "HP Component Manager"="C:\Program Files\HP\hpcoretech\hpcmpmgr.exe" "HP Software Update"="C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-disabled] "TomcatStartup 2.5"=C:\Program Files\Hewlett-Packard\Toolbox\hpbpsttp.exe "StatusClient 2.5"=C:\Program Files\Hewlett-Packard\Toolbox\Apache Tomcat 4.0\webapps\Toolbox\StatusClient\StatusClient.exe /auto "NeroFilterCheck"=C:\WINDOWS\system32\NeroCheck.exe "RegisterDropHandler"=C:\PROGRA~1\TEXTBR~1.0\Bin\REGIST~1.EXE "Share-to-Web Namespace Daemon"=C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe "CamMonitor"=C:\Program Files\Hewlett-Packard\Digital Imaging\\Unload\hpqcmon.exe "nwiz"=nwiz.exe /install R0 isdnlink;isdnlink;C:\WINDOWS\system32\DRIVERS\linkisdn.sys [2000-04-07 15:27] R2 FirebirdGuardianDefaultInstance;Firebird Guardian - DefaultInstance;C:\Program Files\Firebird\Firebird_1_5\bin\fbguard.exe [2006-01-17 01:05] R2 port_nt;port_nt;c:\windows\system32\drivers\port_nt.sys [1999-05-19 11:09] R3 FirebirdServerDefaultInstance;Firebird Server - DefaultInstance;C:\Program Files\Firebird\Firebird_1_5\bin\fbserver.exe [2006-01-17 01:05] R3 wanlink;wanlink;C:\WINDOWS\system32\DRIVERS\wanlink.sys [2000-04-07 15:28] S2 BT848;BtCap, WDM Video Capture;C:\WINDOWS\system32\drivers\BT848.SYS [2002-02-22 13:36] S2 BTTUNER;BtTuner, WDM TV Tuner;C:\WINDOWS\system32\drivers\BTTUNER.SYS [] S2 BTXBAR;BtXBar, WDM Crossbar;C:\WINDOWS\system32\drivers\BTXBAR.SYS [] S3 DualCamP202;Dual Mode Camera (8008 VGA);C:\WINDOWS\system32\DRIVERS\sndp202.sys [2002-10-09 09:15] S3 DW90USB;DW90USB Device;C:\WINDOWS\system32\DRIVERS\DW90USB.sys [] S3 S3U10Scanner;600 CU Still Image Device Service;C:\WINDOWS\system32\drivers\usbscan.sys [2004-08-04 06:58] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{8cf6ed13-dd08-11db-9a1a-0008540982a3}] \Shell\AutoRun\command - J:\USBNB.exe . ************************************************************************** catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-02-20 13:53:54 Windows 5.1.2600 Dodatek Service Pack 2 FAT NTAPI scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . ------------------------ Other Running Processes ------------------------ . C:\WINDOWS\System32\CTSvcCDA.EXE C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\WINDOWS\System32\nvsvc32.exe C:\WINDOWS\System32\wdfmgr.exe C:\WINDOWS\System32\MsPMSPSv.exe C:\WINDOWS\system32\wscntfy.exe C:\PROGRA~1\COMMON~1\Vision\dbserv.exe C:\Program Files\Cobian Backup 7\cobui.exe C:\Program Files\Hewlett-Packard\Toolbox\jre\bin\javaw.exe C:\WINDOWS\system32\HPBPRO.EXE . ************************************************************************** . Completion time: 2008-02-20 13:55:07 - machine was rebooted ComboFix-quarantined-files.txt 2008-02-20 12:55:04 . 2008-02-18 14:00:14 --- E O F ---

and

Kod: Zaznacz wszystko: Logfile of HijackThis v1.99.1 Scan saved at 13:59:52, on 2008-02-20 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16608) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\System32\CTSvcCDA.EXE C:\Program Files\Firebird\Firebird_1_5\bin\fbguard.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\WINDOWS\System32\nvsvc32.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\MsPMSPSv.exe C:\Program Files\Firebird\Firebird_1_5\bin\fbserver.exe C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\System32\Rscmpt.exe C:\WINDOWS\system32\Linksts.exe C:\Program Files\Hewlett-Packard\Toolbox\Apache Tomcat 4.0\webapps\Toolbox\StatusClient\StatusClient.exe C:\Program Files\Cobian Backup 7\CobBU.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Common Files\Vision\vservice.exe C:\PROGRA~1\COMMON~1\Vision\dbserv.exe C:\Program Files\Cobian Backup 7\cobui.exe C:\Program Files\Hewlett-Packard\Toolbox\jre\bin\javaw.exe C:\WINDOWS\explorer.exe C:\DOCUME~1\root\USTAWI~1\Temp\Katalog tymczasowy 1 dla hijackthis_199.zip\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = file:///D:/Grzesiek/programy/index.htm R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigURL = http://www.krosno.lasy.gov.pl/proxy.pac R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = ftp=10.4.253.10:80;gopher=10.4.253.10:80;http=10.4.253.10:80 R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 83.13.79.58;18081;18082;18083;<local> R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O4 - HKLM\..\Run: [Rscmpt] C:\WINDOWS\System32\Rscmpt.exe O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize O4 - HKLM\..\Run: [ISDN Monitor] Linksts.exe W 1024 O4 - HKLM\..\Run: [RegisterDropHandler] C:\PROGRA~1\TEXTBR~1.0\Bin\REGIST~1.EXE O4 - HKLM\..\Run: [StatusClient 2.5] C:\Program Files\Hewlett-Packard\Toolbox\Apache Tomcat 4.0\webapps\Toolbox\StatusClient\StatusClient.exe /auto O4 - HKLM\..\Run: [TomcatStartup 2.5] C:\Program Files\Hewlett-Packard\Toolbox\hpbpsttp.exe O4 - HKLM\..\Run: [Cobian Backup 7] "C:\Program Files\Cobian Backup 7\CobBU.exe" O4 - HKLM\..\RunServices: [RegisterDropHandler] C:\PROGRA~1\TEXTBR~1.0\Bin\REGIST~1.EXE O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [Spamihilator] "C:\Program Files\Spamihilator\spamihilator.exe" O4 - Global Startup: Vision Services.lnk = C:\Program Files\Common Files\Vision\vservice.exe O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O8 - Extra context menu item: Konwertuj do Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html O8 - Extra context menu item: Konwertuj miejsce docelowe łącza do Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html O8 - Extra context menu item: Konwertuj miejsce docelowe łącza do istniejącego pliku PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html O8 - Extra context menu item: Konwertuj wybrane łącza do Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html O8 - Extra context menu item: Konwertuj zaznaczenie do Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html O8 - Extra context menu item: Konwertuj zaznaczenie do istniejącego pliku PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O11 - Options group: [INTERNATIONAL] International* O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://download.ewido.net/ewidoOnlineScan.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{15D3B045-1339-4D69-9A0E-ECF64A63B700}: NameServer = 194.204.159.1,194.204.152.34 O17 - HKLM\System\CCS\Services\Tcpip\..\{19FBDA18-CA25-4FBD-AEC4-B5F512F48877}: NameServer = 10.4.253.10,194.204.159.1 O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTSvcCDA.EXE O23 - Service: Firebird Guardian - DefaultInstance (FirebirdGuardianDefaultInstance) - The Firebird Project - C:\Program Files\Firebird\Firebird_1_5\bin\fbguard.exe O23 - Service: Firebird Server - DefaultInstance (FirebirdServerDefaultInstance) - The Firebird Project - C:\Program Files\Firebird\Firebird_1_5\bin\fbserver.exe O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe

**Posty:** 18165 · przez **wojtas** 20 Lut 2008, 19:05

juz nic nie widac

**Posty:** 112 · przez **dziubek12** 22 Lut 2008, 13:39

dalej gdzieś siedzi - jesli chcę zainstalować wczesniejszą wersje programu (która nie robiła żadnych problemów), wyrzuca mnie z instalacji z informacją, że na komp zainstalowana jest wyższa wersja tego programu (czyli tego, który usiłujemy usunąc....)

**Posty:** 3854 · przez **Dzi@dek** 22 Lut 2008, 15:30

Wklej w notatnik:

File::

C:\WINDOWS\system32\drivers\SYMEVENT.CAT
C:\WINDOWS\system32\drivers\SYMEVENT.INF

Plik

Zapisz jako... :arrow:

CFScript - najlepiej jeśli zapiszesz w

takiej lokalizacji, by ikona CFScript.txt znalazła się obok ikony ComboFix.exe
Przeciągnij i upuść plik CFScript.txt na plik :arrow:

ComboFix.exe

Potwierdz

zrestartuje sie komputer.

Jeśli pojawi się pytanie "1 or 2" - to wpisz 1 i naciśnij ENTER. Rozpocznie się proces usuwania.

**Posty:** 112 · przez **dziubek12** 25 Lut 2008, 10:52

Bez zmian, logi po zabiegach:

Kod: Zaznacz wszystko: Logfile of HijackThis v1.99.1 Scan saved at 09:53:01, on 2008-02-25 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16608) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\System32\CTSvcCDA.EXE C:\Program Files\Firebird\Firebird_1_5\bin\fbguard.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\WINDOWS\System32\nvsvc32.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\MsPMSPSv.exe C:\WINDOWS\System32\Rscmpt.exe C:\WINDOWS\system32\Linksts.exe C:\Program Files\Hewlett-Packard\Toolbox\Apache Tomcat 4.0\webapps\Toolbox\StatusClient\StatusClient.exe C:\Program Files\Cobian Backup 7\CobBU.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Common Files\Vision\vservice.exe C:\PROGRA~1\COMMON~1\Vision\dbserv.exe C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe C:\Program Files\Cobian Backup 7\cobui.exe C:\Program Files\Hewlett-Packard\Toolbox\jre\bin\javaw.exe C:\Program Files\Firebird\Firebird_1_5\bin\fbserver.exe C:\WINDOWS\system32\msiexec.exe C:\WINDOWS\system32\wuauclt.exe C:\WINDOWS\system32\wscntfy.exe C:\DOCUME~1\root\USTAWI~1\Temp\Katalog tymczasowy 1 dla hijackthis_199.zip\HijackThis.exe C:\WINDOWS\system32\HPBPRO.EXE R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = file:///D:/Grzesiek/programy/index.htm R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigURL = http://www.krosno.lasy.gov.pl/proxy.pac R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = ftp=10.4.253.10:80;gopher=10.4.253.10:80;http=10.4.253.10:80 R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 83.13.79.58;18081;18082;18083;<local> R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O4 - HKLM\..\Run: [Rscmpt] C:\WINDOWS\System32\Rscmpt.exe O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize O4 - HKLM\..\Run: [ISDN Monitor] Linksts.exe W 1024 O4 - HKLM\..\Run: [RegisterDropHandler] C:\PROGRA~1\TEXTBR~1.0\Bin\REGIST~1.EXE O4 - HKLM\..\Run: [StatusClient 2.5] C:\Program Files\Hewlett-Packard\Toolbox\Apache Tomcat 4.0\webapps\Toolbox\StatusClient\StatusClient.exe /auto O4 - HKLM\..\Run: [TomcatStartup 2.5] C:\Program Files\Hewlett-Packard\Toolbox\hpbpsttp.exe O4 - HKLM\..\Run: [Cobian Backup 7] "C:\Program Files\Cobian Backup 7\CobBU.exe" O4 - HKLM\..\RunServices: [RegisterDropHandler] C:\PROGRA~1\TEXTBR~1.0\Bin\REGIST~1.EXE O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [Spamihilator] "C:\Program Files\Spamihilator\spamihilator.exe" O4 - Global Startup: Vision Services.lnk = C:\Program Files\Common Files\Vision\vservice.exe O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O8 - Extra context menu item: Konwertuj do Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html O8 - Extra context menu item: Konwertuj miejsce docelowe łącza do Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html O8 - Extra context menu item: Konwertuj miejsce docelowe łącza do istniejącego pliku PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html O8 - Extra context menu item: Konwertuj wybrane łącza do Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html O8 - Extra context menu item: Konwertuj zaznaczenie do Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html O8 - Extra context menu item: Konwertuj zaznaczenie do istniejącego pliku PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O11 - Options group: [INTERNATIONAL] International* O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://download.ewido.net/ewidoOnlineScan.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{15D3B045-1339-4D69-9A0E-ECF64A63B700}: NameServer = 194.204.159.1,194.204.152.34 O17 - HKLM\System\CCS\Services\Tcpip\..\{19FBDA18-CA25-4FBD-AEC4-B5F512F48877}: NameServer = 10.4.253.10,194.204.159.1 O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTSvcCDA.EXE O23 - Service: Firebird Guardian - DefaultInstance (FirebirdGuardianDefaultInstance) - The Firebird Project - C:\Program Files\Firebird\Firebird_1_5\bin\fbguard.exe O23 - Service: Firebird Server - DefaultInstance (FirebirdServerDefaultInstance) - The Firebird Project - C:\Program Files\Firebird\Firebird_1_5\bin\fbserver.exe O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe

Kod: Zaznacz wszystko: ComboFix 08-02-25.2 - Urszula 2008-02-25 9:39:31.2 - [color=red][b]FAT32[/b][/color]x86 Microsoft Windows XP Home Edition 5.1.2600.2.1250.1.1045.18.265 [GMT 1:00] Running from: C:\Documents and Settings\Urszula\Pulpit\ComboFix.exe Command switches used :: C:\Documents and Settings\Urszula\Pulpit\CFScript.txt * Created a new restore point [color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color] FILE :: C:\WINDOWS\system32\drivers\SYMEVENT.CAT C:\WINDOWS\system32\drivers\SYMEVENT.INF . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\WINDOWS\system32\drivers\SYMEVENT.CAT C:\WINDOWS\system32\drivers\SYMEVENT.INF . ((((((((((((((((((((((((( Files Created from 2008-01-25 to 2008-02-25 ))))))))))))))))))))))))))))))) . 2008-02-20 13:55 . 2008-02-20 13:55 <DIR> d-------- C:\Documents and Settings\GoťŠ\Ustawienia lokalne 2008-02-19 10:56 . 2008-02-19 10:56 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\CrystalIdea Software 2008-02-19 10:53 . 2008-02-19 10:53 <DIR> d-------- C:\Program Files\Uninstall Tool 2008-02-19 10:32 . 2008-02-19 10:32 <DIR> d-------- C:\Program Files\Smarty Uninstaller Pro 2008-02-19 10:32 . 2007-08-15 12:09 417,792 --a------ C:\WINDOWS\system32\vbalCmdBar6.ocx 2008-02-19 10:32 . 2007-08-15 12:09 262,144 --a------ C:\WINDOWS\system32\lst_v.ocx 2008-02-19 10:32 . 2007-08-15 12:09 159,744 --a------ C:\WINDOWS\system32\wt_menu.dll 2008-02-19 10:32 . 2007-08-15 12:09 94,208 --a------ C:\WINDOWS\system32\img_lst.ocx 2008-02-19 10:32 . 2007-08-15 12:09 40,960 --a------ C:\WINDOWS\system32\ssubtmr6.dll 2008-02-19 09:03 . 2008-02-19 09:03 <DIR> d--hs---- C:\FOUND.001 2008-02-18 12:04 . 2008-02-18 12:04 <DIR> d--hs---- C:\FOUND.000 . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-01-11 05:41 44,544 ----a-w C:\WINDOWS\system32\dllcache\pngfilt.dll 2007-12-19 22:58 347,136 ----a-w C:\WINDOWS\system32\dllcache\dxtmsft.dll 2007-12-18 09:51 179,584 ------w C:\WINDOWS\system32\dllcache\mrxdav.sys 2007-12-08 05:14 3,592,192 ----a-w C:\WINDOWS\system32\dllcache\mshtml.dll 2007-12-06 11:06 625,664 ------w C:\WINDOWS\system32\dllcache\iexplore.exe 2007-12-06 11:05 70,656 ------w C:\WINDOWS\system32\dllcache\ie4uinit.exe 2007-12-06 11:00 13,824 ------w C:\WINDOWS\system32\dllcache\ieudinit.exe 2007-12-06 04:59 161,792 ----a-w C:\WINDOWS\system32\dllcache\ieakui.dll 2007-12-04 18:42 550,912 ------w C:\WINDOWS\system32\oleaut32.dll 2007-12-04 18:42 550,912 ------w C:\WINDOWS\system32\dllcache\oleaut32.dll 2007-03-08 06:50 102,264 ----a-w C:\Documents and Settings\root\Dane aplikacji\GDIPFONTCACHEV1.DAT 2003-07-08 07:04 722 ----a-w C:\Program Files\INSTALL.LOG . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 08:44 15360] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Rscmpt"="C:\WINDOWS\System32\Rscmpt.exe" [2002-08-22 03:48 481792] "NvCplDaemon"="NvQTwk" [] "ISDN Monitor"="Linksts.exe" [2000-04-07 15:57 49152 C:\WINDOWS\system32\linksts.exe] "RegisterDropHandler"="C:\PROGRA~1\TEXTBR~1.0\Bin\REGIST~1.EXE" [ ] "StatusClient 2.5"="C:\Program Files\Hewlett-Packard\Toolbox\Apache Tomcat 4.0\webapps\Toolbox\StatusClient\StatusClient.exe" [2003-10-01 00:39 61440] "TomcatStartup 2.5"="C:\Program Files\Hewlett-Packard\Toolbox\hpbpsttp.exe" [2003-06-10 18:47 155648] "Cobian Backup 7"="C:\Program Files\Cobian Backup 7\CobBU.exe" [2005-10-18 15:10 127488] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices] "RegisterDropHandler"="C:\PROGRA~1\TEXTBR~1.0\Bin\REGIST~1.EXE" [ ] C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\ Vision Services.lnk - C:\Program Files\Common Files\Vision\vservice.exe [2004-06-04 14:51:07 626688] Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 22:05:26 29696] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-] "HP Component Manager"="C:\Program Files\HP\hpcoretech\hpcmpmgr.exe" "HP Software Update"="C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-disabled] "TomcatStartup 2.5"=C:\Program Files\Hewlett-Packard\Toolbox\hpbpsttp.exe "StatusClient 2.5"=C:\Program Files\Hewlett-Packard\Toolbox\Apache Tomcat 4.0\webapps\Toolbox\StatusClient\StatusClient.exe /auto "NeroFilterCheck"=C:\WINDOWS\system32\NeroCheck.exe "RegisterDropHandler"=C:\PROGRA~1\TEXTBR~1.0\Bin\REGIST~1.EXE "Share-to-Web Namespace Daemon"=C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe "CamMonitor"=C:\Program Files\Hewlett-Packard\Digital Imaging\\Unload\hpqcmon.exe "nwiz"=nwiz.exe /install [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) R0 isdnlink;isdnlink;C:\WINDOWS\system32\DRIVERS\linkisdn.sys [2000-04-07 15:27] R2 FirebirdGuardianDefaultInstance;Firebird Guardian - DefaultInstance;C:\Program Files\Firebird\Firebird_1_5\bin\fbguard.exe [2006-01-17 01:05] R2 port_nt;port_nt;c:\windows\system32\drivers\port_nt.sys [1999-05-19 11:09] R3 FirebirdServerDefaultInstance;Firebird Server - DefaultInstance;C:\Program Files\Firebird\Firebird_1_5\bin\fbserver.exe [2006-01-17 01:05] R3 wanlink;wanlink;C:\WINDOWS\system32\DRIVERS\wanlink.sys [2000-04-07 15:28] S2 BT848;BtCap, WDM Video Capture;C:\WINDOWS\system32\drivers\BT848.SYS [2002-02-22 13:36] S2 BTTUNER;BtTuner, WDM TV Tuner;C:\WINDOWS\system32\drivers\BTTUNER.SYS [] S2 BTXBAR;BtXBar, WDM Crossbar;C:\WINDOWS\system32\drivers\BTXBAR.SYS [] S3 DualCamP202;Dual Mode Camera (8008 VGA);C:\WINDOWS\system32\DRIVERS\sndp202.sys [2002-10-09 09:15] S3 DW90USB;DW90USB Device;C:\WINDOWS\system32\DRIVERS\DW90USB.sys [] S3 S3U10Scanner;600 CU Still Image Device Service;C:\WINDOWS\system32\drivers\usbscan.sys [2004-08-04 06:58] . ************************************************************************** catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-02-25 09:41:26 Windows 5.1.2600 Dodatek Service Pack 2 FAT NTAPI scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2008-02-25 9:41:54 ComboFix-quarantined-files.txt 2008-02-25 08:41:54 ComboFix2.txt 2008-02-20 12:55:08 . 2008-02-18 14:00:14 --- E O F ---

**Posty:** 3854 · przez **Dzi@dek** 25 Lut 2008, 11:19

Pozostaje tylko zrobić to ręcznie w rejestrze. Jeśli nie masz zainstalowanych innych aplikacji z Symanteca.

Start-uruchom-wpisz regedit - [enter]

Najpierw kopia rejestru.
Stajesz na Mój komputer- Plik exportuj-dajesz nazwę ( najlepiej data bieżąca - zapisz )

Teraz - Edycja - znajdź - wpisz symantec - [enter]
Wszystkie wpisy które znajdzie - [Del]
Klikasz F3 , aż przeszuka cały rejestr.

To samo z nazwą norton

Restart.

**Posty:** 112 · przez **dziubek12** 25 Lut 2008, 11:56

Symantec ok, ale mam inne programy z nazwą "norton" - wtedy intuicyjnie?

[ Dodano: Dzisiaj o 11:17 ]
Problem - przy usuwaniu symanteca wywaliło mi pliki windowsa (systemowy) i odsyła mnie do konsoli odzyskiwania....Jak po niej trzeba sie poruszać?

**Posty:** 18165 · przez **wojtas** 25 Lut 2008, 20:54

dziubek12 napisał(a):Problem - przy usuwaniu symanteca wywaliło mi pliki windowsa (systemowy) i odsyła mnie do konsoli odzyskiwania....Jak po niej trzeba sie poruszać?

mozesz dac wiecej info ? jakies screeny?

**Posty:** 112 · przez **dziubek12** 26 Lut 2008, 09:13

Po usunięciu w rejestrze plików związanych z symanteckiem system nie chciał sie uruchomić z informacja, że plik config (z system32) jest uszkodzony, albo usuniety. Poradziłem sobie przez naprawę z płyty instalacyjnej. I nadal temat z istenieniem wyższej wersji symanteca w komputerze. Plików związanych z "norton" nie ruszałem.

**Posty:** 3854 · przez **Dzi@dek** 27 Lut 2008, 15:24

dziubek12 napisał(a):Plików związanych z "norton" nie ruszałem.

To rusz.

**Posty:** 112 · przez **dziubek12** 27 Lut 2008, 20:22

A co z plikami "symanteca"?

**Posty:** 18165 · przez **wojtas** 27 Lut 2008, 22:57

sciagnij gmera i daj loga :

zrobiony na ustawieniu: Rootkit >>> zaznaczyć tylko Usługi >>> zaznaczyć Pokaż wszystko >>> Szukaj >>> Zapisz >> i wrzuc na forum

problem z usunięciem programu

problem z usunięciem programu

Kto jest na forum