Problem z wyskakującym oknem ms-dos

**Posty:** 2 · przez **rybosom15** 26 Sty 2009, 14:13

Mam problem z ciągle wyskakującym oknem o treści na górnym pasku C/DOCUME~/HWDP/Exredr2.ex i po tym oknie wyskakuje następne okno o treści na pasku u góry 16-bitowy podsystem MS-DOS i w oknie na dole treść C/DOCUME~1/HWDP/Exredr2.exe NTVDM CPU:napotkano niedozwoloną instrukcję CS:0585 IP:0249 OP:65 63 74 66
Nie wiem o co chodzi. Pewnie to jakiś wirus.Prosze o pomoc.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:09:20, on 2009-01-26
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqSRMon.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\oodag.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Opera\opera.exe
C:\Documents and Settings\HWDP\Pulpit\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.bearshare.com/pl/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O2 - BHO: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files\Hewlett-Packard\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: My Global Search Bar BHO - {37B85A21-692B-4205-9CAD-2626E4993404} - C:\Program Files\MyGlobalSearch\bar\1.bin\MGSBAR.DLL (file missing)
O2 - BHO: IEVkbdBHO - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\ievkbd.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files\Hewlett-Packard\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
O3 - Toolbar: My Global Search Bar - {37B85A29-692B-4205-9CAD-2626E4993404} - C:\Program Files\MyGlobalSearch\bar\1.bin\MGSBAR.DLL (file missing)
O3 - Toolbar: BearShare MediaBar - {D3DEE18F-DB64-4BEB-9FF1-E1F0A5033E4A} - C:\Program Files\BearShare Applications\BearShare MediaBar\BSMediaBar.dll (file missing)
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [DeviceDiscovery] C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
O4 - HKLM\..\Run: [hpqSRMon] C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqSRMon.exe
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Windows Explorer] C:\RECYCLE\D-0-060-0000000000-1111111-2222222\fix.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: nettt.lnk = ?
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Statystyki ochrony WWW - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\SCIEPlgn.dll
O9 - Extra button: Zaznaczanie HP Smart - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - C:\Program Files\Hewlett-Packard\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{DA5528F2-5B8F-4C8A-A901-7EDFA207A33F}: NameServer = 62.233.128.18
O23 - Service: Ares Chatroom server (AresChatServer) - Ares Development Group - C:\Program Files\Ares\chatServer.exe
O23 - Service: Kaspersky Anti-Virus (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: O&O Defrag - O&O Software GmbH - C:\WINDOWS\system32\oodag.exe

--
End of file - 5172 bytes

**Posty:** 300 · przez **sgsman** 26 Sty 2009, 18:05

1. Wsadź logi w tagi code.
2. Wrzuć loga z combofixa.

**Posty:** 2 · przez **rybosom15** 26 Sty 2009, 19:10

Kod: Zaznacz wszystko: ComboFix 09-01-21.04 - HWDP 2009-01-26 11:46:59.1 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.511.245 [GMT 1:00] Uruchomiony z: c:\documents and settings\HWDP\Pulpit\ComboFix.exe AV: Kaspersky Anti-Virus *On-access scanning disabled* (Updated) * Utworzono nowy punkt przywracania . ((((((((((((((((((((((((((((((((((((((( Usunięto ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\program files\myglobalsearch c:\program files\myglobalsearch\bar\1.bin\M9FFXTBR.JAR c:\program files\myglobalsearch\bar\1.bin\M9FFXTBR.MANIFEST c:\program files\myglobalsearch\bar\1.bin\M9NTSTBR.JAR c:\program files\myglobalsearch\bar\1.bin\M9NTSTBR.MANIFEST c:\program files\myglobalsearch\bar\1.bin\M9PLUGIN.DLL c:\program files\myglobalsearch\bar\1.bin\MGSBAR.DLL c:\program files\myglobalsearch\bar\Cache\[u]0[/u]05DBE79 c:\program files\myglobalsearch\bar\Cache\[u]0[/u]09E3CF8.bin c:\program files\myglobalsearch\bar\Cache\[u]0[/u]09E47E5.bin c:\program files\myglobalsearch\bar\Cache\[u]0[/u]09E4BFC.bin c:\program files\myglobalsearch\bar\Cache\files.ini c:\program files\myglobalsearch\bar\History\search c:\program files\myglobalsearch\bar\Settings\prevcfg.htm G:\autorun.inf . ((((((((((((((((((((((((( Pliki utworzone od 2008-12-26 do 2009-01-26 ))))))))))))))))))))))))))))))) . 2009-01-25 21:22 . 2009-01-26 11:44 4,981 --a------ c:\documents and settings\HWDP\Exredr2.exe 2009-01-25 21:21 . 2009-01-25 21:21 2,534 --a------ c:\documents and settings\HWDP\sdsdshd.exe 2009-01-23 09:23 . 2009-01-26 11:43 4,981 --a------ c:\documents and settings\HWDP\sdsdsd.exe 2009-01-20 12:34 . 2009-01-22 20:44 2,534 --a------ c:\documents and settings\HWDP\Exredr.exe 2009-01-19 17:32 . 2009-01-19 17:51 96,976 --a------ c:\windows\system32\drivers\klin.dat 2009-01-19 17:32 . 2009-01-19 17:51 87,855 --a------ c:\windows\system32\drivers\klick.dat 2009-01-19 17:31 . 2009-01-26 11:50 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\Kaspersky Lab 2009-01-19 17:31 . 2009-01-26 11:49 1,766,944 --ahs---- c:\windows\system32\drivers\fidbox.dat 2009-01-19 17:31 . 2009-01-26 11:51 311,328 --ahs---- c:\windows\system32\drivers\fidbox2.dat 2009-01-19 17:31 . 2009-01-26 11:49 16,980 --ahs---- c:\windows\system32\drivers\fidbox.idx 2009-01-19 17:31 . 2009-01-26 11:49 4,212 --ahs---- c:\windows\system32\drivers\fidbox2.idx 2009-01-19 15:52 . 2009-01-19 20:03 2,541 --a------ c:\documents and settings\HWDP\jsjsjs.exe 2009-01-19 07:13 . 2009-01-19 23:49 2,541 --a------ c:\documents and settings\HWDP\Exploredr.exe 2009-01-19 07:13 . 2009-01-22 14:26 2,534 --a------ c:\documents and settings\HWDP\Exxxplorer.exe 2009-01-18 18:09 . 2009-01-18 22:33 2,477 --a------ c:\documents and settings\HWDP\Explor.exe 2009-01-18 16:35 . 2009-01-19 16:17 2,539 --a------ c:\windows\system32\%LocalXml% 2009-01-18 14:43 . 2009-01-19 17:31 <DIR> d-------- c:\program files\Kaspersky Lab 2009-01-18 14:35 . 2009-01-19 17:23 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\Kaspersky Lab Setup Files 2009-01-18 14:31 . 2009-01-19 02:51 2,485 --a------ c:\documents and settings\HWDP\Explorer.exe 2009-01-18 01:16 . 2009-01-18 11:37 <DIR> d-------- c:\documents and settings\HWDP\DoctorWeb 2009-01-18 01:15 . 2009-01-18 01:15 77,824 --a----t- c:\windows\system32\DRWEBSP.DLL 2009-01-18 01:09 . 2009-01-18 13:10 62,976 --a------ c:\documents and settings\HWDP\asdsdsd.exe 2009-01-17 15:01 . 2009-01-17 15:01 <DIR> dr-hs---- C:\RECYCLE 2009-01-14 22:00 . 2009-01-14 22:00 <DIR> dr-hs---- C:\CONFIG 2009-01-14 13:30 . 2009-01-14 13:30 0 --a------ c:\windows\system32\Y=Y= . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-01-26 10:06 --------- d-----w c:\documents and settings\HWDP\Dane aplikacji\OpenOffice.org2 2009-01-25 11:10 --------- d-----w c:\documents and settings\HWDP\Dane aplikacji\Hamachi 2009-01-19 19:58 --------- d-----w c:\program files\AMT 2009-01-18 12:23 --------- d-----w c:\documents and settings\HWDP\Dane aplikacji\HPAppData 2009-01-18 00:14 --------- d--h--w c:\program files\InstallShield Installation Information 2009-01-08 20:03 512 ---ha-w C:\os582744.bin 2008-12-11 23:24 312 ---ha-w c:\documents and settings\HWDP\hpothb07.dat 2008-12-11 23:23 167 ---ha-w c:\documents and settings\LocalService\hpothb07.dat 2008-12-11 23:21 --------- d-----w c:\program files\Hewlett-Packard 2008-12-11 22:53 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\WEBREG 2008-12-11 22:52 --------- d-----w c:\documents and settings\HWDP\Dane aplikacji\HP 2008-12-11 22:45 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\Hewlett-Packard 2008-12-11 22:39 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\HP Product Assistant 2008-12-11 22:39 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\HP 2008-12-11 22:38 --------- d-----w c:\program files\HP 2008-12-11 22:38 --------- d-----w c:\program files\Common Files\Hewlett-Packard 2008-12-11 22:37 --------- d-----w c:\program files\Common Files\HP 2008-12-03 15:48 --------- d-----w c:\program files\directx 2008-12-02 22:09 --------- d-----w c:\program files\Graph 2008-12-01 13:03 --------- d-----w c:\program files\Matematyka 2008-11-23 13:15 538 ---ha-w C:\os282379.bin 2008-10-26 12:01 1,606 -c--a-w c:\windows\system32\PerfStringBackup.TMP 2008-05-15 09:36 17,346,048 -c--a-w c:\program files\eav_nt32_plk.msi . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2004-08-03 15360] "Windows Explorer"="c:\recycle\D-0-060-0000000000-1111111-2222222\fix.exe" [2009-01-17 62976] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-10-22 7700480] "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2006-10-22 86016] "DeviceDiscovery"="c:\program files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe" [2003-05-21 229437] "hpqSRMon"="c:\program files\Hewlett-Packard\Digital Imaging\bin\hpqSRMon.exe" [2007-08-22 80896] "AVP"="c:\program files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe" [2008-04-25 201992] "SoundMan"="SOUNDMAN.EXE" [2003-03-27 c:\windows\SOUNDMAN.EXE] "nwiz"="nwiz.exe" [2006-10-22 c:\windows\system32\nwiz.exe] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-03 15360] [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager] BootExecute REG_MULTI_SZ autocheck autochk *\[u]0[/u]OODBS [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Adobe Reader Speed Launch.lnk] path=c:\documents and settings\All Users\Menu Start\Programy\Autostart\Adobe Reader Speed Launch.lnk backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Adobe Reader Synchronizer.lnk] path=c:\documents and settings\All Users\Menu Start\Programy\Autostart\Adobe Reader Synchronizer.lnk backup=c:\windows\pss\Adobe Reader Synchronizer.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^HP Digital Imaging Monitor.lnk] path=c:\documents and settings\All Users\Menu Start\Programy\Autostart\HP Digital Imaging Monitor.lnk backup=c:\windows\pss\HP Digital Imaging Monitor.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher] --a--c--- 2008-01-11 21:16 39792 c:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ares] --a------ 2007-05-04 01:32 961024 c:\program files\Ares\Ares.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] --a--c--- 2001-07-09 11:50 155648 c:\windows\system32\NeroCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OODefragTray] --a--c--- 2007-05-11 02:08 2512392 c:\windows\system32\oodtray.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched] --a--c--- 2007-09-25 01:11 132496 c:\program files\Java\jre1.6.0_03\bin\jusched.exe [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\Gadu-Gadu\\gg.exe"= "e:\\GRY\\Quake III Arena\\Kopia quake3.exe"= "e:\\GRY\\Quake III Arena\\QUAKE3.EXE"= "e:\\GRY\\gierki\\siatkówka\\volley.exe"= "c:\\Program Files\\BearShare\\BearShare.exe"= "c:\\Program Files\\Opera\\Opera.exe"= "c:\\WINDOWS\\system32\\mshta.exe"= "c:\\Program Files\\Ares\\Ares.exe"= "c:\\Program Files\\SopCast\\SopCast.exe"= "c:\\q3test-1.08\\quake3.exe"= "e:\\UnrealTournament\\System\\UnrealTournament.exe"= "c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hpqtra08.exe"= "c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hpqste08.exe"= "c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hpofxm08.exe"= "c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hposfx08.exe"= "c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hposid01.exe"= "c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hpzwiz01.exe"= "c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hpoews01.exe"= "c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hpiscnapp.exe"= "c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hpqkygrp.exe"= "c:\\Documents and Settings\\All Users\\Dane aplikacji\\Kaspersky Lab Setup Files\\Kaspersky Anti-Virus 2009\\Polish\\setup.exe"= "c:\\Program Files\\SopCast\\adv\\SopAdver.exe"= R0 klbg;Kaspersky Lab Boot Guard Driver;c:\windows\system32\drivers\klbg.sys [2008-01-29 32784] R0 xmasbus;xmasbus;c:\windows\system32\drivers\xmasbus.sys [2008-07-22 140800] R0 xmasscsi;xmasscsi;c:\windows\system32\drivers\xmasscsi.sys [2008-07-22 5504] R3 klim5;Kaspersky Anti-Virus NDIS Filter;c:\windows\system32\drivers\klim5.sys [2008-03-25 24592] S3 KS-959;Kingsun KS-959 USB Infrared Adapter;c:\windows\system32\drivers\KS-959.sys [2008-07-08 19034] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12 hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{2cfad298-e27e-11dd-bb20-000d61b54adc}] \Shell\AutoRun\command - g:\config\S-1-5-21-1482476501-1644491937-682003330-1013\Cfg.exe \Shell\open\command - g:\config\S-1-5-21-1482476501-1644491937-682003330-1013\Cfg.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a13d2c33-9168-11dd-9cdd-000d61b54adc}] \Shell\AutoRun\command - g:\recycle\D-0-060-0000000000-1111111-2222222\fix.exe \Shell\open\command - g:\recycle\D-0-060-0000000000-1111111-2222222\fix.exe [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{28ABC5C0-4FCB-11CF-AAX5-34CX1C987132}] c:\recycle\D-0-060-0000000000-1111111-2222222\fix.exe . - - - - USUNIĘTO PUSTE WPISY - - - - BHO-{6D023EBF-70B8-45A6-9ED5-556515FA0FE4} - c:\program files\BearShare Applications\BearShare MediaBar\BearShareIEHelper.dll HKCU-Run-Windows Security Service - c:\config\S-1-5-21-1482476501-1644491937-682003330-1013\Cfg.exe MSConfigStartUp-Onet - c:\program files\Common Files\Onet.pl\AutoUpdate.exe MSConfigStartUp-WinampAgent - c:\program files\Winamp\winampa.exe . ------- Skan uzupełniający ------- . uStart Page = hxxp://google.bearshare.com/pl/ TCP: {DA5528F2-5B8F-4C8A-A901-7EDFA207A33F} = 62.233.128.18 . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-01-26 11:51:54 Windows 5.1.2600 Dodatek Service Pack 2 NTFS skanowanie ukrytych procesów ... skanowanie ukrytych wpisów autostartu ... skanowanie ukrytych plików ... skanowanie pomyślnie ukończone ukryte pliki: 0 ************************************************************************** . --------------------- ZABLOKOWANE KLUCZE REJESTRU --------------------- [HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\System*] "OODEFRAG10.00.00.01WORKSTATION"="9F2C2814A1040380FDA3162B40774FE2CB0051A45FBC3EE7233623C5D6DBFCAC3A063BAEB8C94CAAFE0A89D0F6D69B50D493A629AE78476857D9D3D56A5B50D1B470037288C8340D8F9A6E4D275B4F8A75E046E2217F4CE06C066933A0CFA938013BB4DCB733CB1BF030D4131551200CE07137DA3FDC4B6FA412061BE02171C09127A9012EEB849EE91B6EA94CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CA6A0AC4980AC7933A2D97226D213B555C038D530D6EB3452BA7FD869164D6794595B80B0983E25D966462ED4B78C4807CF0CD67B45BF013C9C4C6E426F2CAC45384D8B363015F2DB57CAEE339A437B972A5D59DFF42F64E6E1663731AA3F9D2407981A05800E03AF1A097C41A8C74F1E8BCB60139C14D97B803133AE4610AC93627F062882D8DD554A49985CE92643BF2FCC3463EC7378DC6EEA4C9843BE23D720A87FB2A4CCA01439BBD7E6D88B6C5F01B66C2390736532D633425397095FF7C69A89B649E47FF26AF1A2C4E3CC6FAAA2C4F72AA3E1DE66988E2948ABD551BF11C3FDCEC5BCBFC097E3B4E1EFDF898DEA161852342C3529C4E46460DB2EFE4270770716E3183C8D2DE9A1AAD1DF093AE02FE27AC7E8CBEC2302B10EF9BD8150076825AE63DB632ECA434B90D50CD1A7C5F6C10557CD9AE92D181FC24B560683AC312C3D7491363E4693EB8AB945DA1008397258CBB8AF1B133C8E76086C4D386D504369BD68CB97A6DE9010B215AEF04EA486DF8728A9BEB56337A55E19AE8D08A567DE59B1CEDDA99198A066A66D0DF1CDE4095EC03D582D6C2450EE1990E9EF7666D154637DF43F793A3D70464B6A802AC64818C9322F4217B4784D4D7272CD6DE5F2B317A9068C497D6BDE688CD1BB16B993F02FE6CE75879AA604BA63157C17DCFDE98A39FEE8153FB4B5A310D319519EE41881C885F6C75C67100B0C020B6516ADE2202711615A3127EAB34341C27FACBBB174DEE6AF42D548E18922ACBC2D33437CDD82303776D5556AF5293014276E99575F3FCA384835DFDE28F54E0B28288309ECEA965EAB88D293EDD9FAA0B4BE06933E964BDF8DFD43607CE6629F733A37CC1C99C00020743BB743003F2EF5528B67B1A6C7A92C868EB23DEA295B9087AA835DD7F0F75E1BAA20C05BE03420AD39C4FDC164CA1E786217C90AA5D0E4FE2EDBC503AB56D551C386D3BE04E14A2A211609D186AFC5D462432263A2473A6418750F0E396057BF2B1A91929318EEF55A37E0525BF4E66C355FEA27A8BA3ECE3F68987F278E99620CFD2F503E6DEC93FD76B3534FEE2AE60708EB1B0B5B01AC803E6371480D388A93488888F52A89D7AD1957F819A21B3E07501498DC8B783A3DF394922FBC305D72861B5DEF4C6B6C09D742FC2DCB2BC2E93A738C76637F8D" . --------------------- Pliki DLL ładowane pod uruchomionymi procesami --------------------- - - - - - - - > 'winlogon.exe'(844) c:\windows\system32\klogon.dll - - - - - - - > 'explorer.exe'(1620) c:\windows\system32\shdoclc.dll . ------------------------ Pozostałe uruchomione procesy ------------------------ . c:\windows\system32\nvsvc32.exe c:\windows\system32\oodag.exe c:\windows\system32\wscntfy.exe . ************************************************************************** . Czas ukończenia: 2009-01-26 11:54:17 - komputer został uruchomiony ponownie ComboFix-quarantined-files.txt 2009-01-26 10:53:57 Przed: 5 080 875 008 bajtów wolnych Po: 5,081,243,648 bajtów wolnych WindowsXP-KB310994-SP2-Pro-BootDisk-PLK.exe [boot loader] timeout=2 default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS [operating systems] c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect 211 --- E O F --- 2008-06-27 06:58:34 [code][/code]

Problem z wyskakującym oknem ms-dos

Problem z wyskakującym oknem ms-dos

Problem z wyskakującym oknem ms-dos

Re: problem z wyskakującym oknem ms-dos

Kto jest na forum