prośba o pomoc z komputerem [log]

**Posty:** 14 · przez **tomilek** 15 Gru 2007, 21:33

Witam!

Komputer mi siadł: nie mam internetu, nie działają mi prawidłowo programy, nie mam drukarek, nie mogę przesuwać, kopiować plików itd.
A oto log:

Logfile of HijackThis v1.99.1
Scan saved at 18:24:06, on 2007-12-15
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\AntiVir PersonalEdition Premium\sched.exe
C:\Program Files\AntiVir PersonalEdition Premium\avguard.exe
C:\Program Files\AntiVir PersonalEdition Premium\avesvc.exe
C:\WINDOWS\system32\drivers\CDAC11BA.EXE
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\AntiVir PersonalEdition Premium\avmailc.exe
C:\Program Files\Analog Devices\SoundMAX\Smtray.exe
C:\Program Files\Hewlett-Packard\Toolbox2.0\Apache Tomcat 4.0\webapps\Toolbox\StatusClient\StatusClient.exe
C:\Program Files\AntiVir PersonalEdition Premium\avgnt.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\WINDOWS\system32\LXSUPMON.EXE
C:\Program Files\ATI Technologies\ATI HYDRAVISION\HydraDM.exe
C:\Program Files\ATI Technologies\ATI HYDRAVISION\HydraMD.exe
C:\Program Files\Nokia\Nokia Software Launcher\NSLauncher.exe
C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\Gadu-Gadu\gg.exe
C:\Program Files\Hewlett-Packard\Toolbox2.0\Javasoft\JRE\1.3.1\bin\javaw.exe
C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe
C:\Program Files\MagicDisc\MagicDisc.exe
C:\WINDOWS\system32\ntvdm.exe
C:\WINDOWS\explorer.exe
P:\Programy z antywirusami i inne\Procesy\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.onet.pl/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.1.9.24.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL
O4 - HKLM\..\Run: [Smapp] C:\Program Files\Analog Devices\SoundMAX\Smtray.exe
O4 - HKLM\..\Run: [StatusClient] C:\Program Files\Hewlett-Packard\Toolbox2.0\Apache Tomcat 4.0\webapps\Toolbox\StatusClient\StatusClient.exe /auto
O4 - HKLM\..\Run: [TomcatStartup] C:\Program Files\Hewlett-Packard\Toolbox2.0\hpbpsttp.exe
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\AntiVir PersonalEdition Premium\avgnt.exe" /min
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [LXSUPMON] C:\WINDOWS\system32\LXSUPMON.EXE RUN
O4 - HKLM\..\Run: [HydraVisionDesktopManager] C:\Program Files\ATI Technologies\ATI HYDRAVISION\HydraDM.exe
O4 - HKLM\..\Run: [HydraVisionViewport] C:\Program Files\ATI Technologies\ATI HYDRAVISION\HydraMD.exe
O4 - HKLM\..\Run: [NSLauncher] C:\Program Files\Nokia\Nokia Software Launcher\NSLauncher.exe /startup
O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -startup
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
O4 - HKLM\..\Run: [HPWO_MPM_Agent] C:\Program Files\HP\HP Officejet Pro K850 Series\Toolbox\mpm.exe
O4 - HKLM\..\Run: [HPWOTOOLBOX] C:\Program Files\HP\HP Officejet Pro K850 Series\Toolbox\HPWOTBX.exe "-i"
O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [PcSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: MagicDisc.lnk = C:\Program Files\MagicDisc\MagicDisc.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Works Calendar Reminders.lnk = ?
O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm
O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
O8 - Extra context menu item: E&ksportuj do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Otwórz klienta na monitorze &1 - C:\WINDOWS\web\AOpenClient.htm
O8 - Extra context menu item: Otwórz klienta na monitorze &2 - C:\WINDOWS\web\AOpenClient.htm
O9 - Extra button: Wyślij do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Wyślij &do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: BitComet Search - {461CC20B-FB6E-4f16-8FE8-C29359DB100E} - C:\Program Files\BitComet\tools\BitCometBHO_1.1.9.24.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: ING Bank Online - https://ssl.bsk.com.pl/bskonl/component/INGOnl.cab
O16 - DPF: {68282C51-9459-467B-95BF-3C0E89627E55} (MksSkanerOnline Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab
O16 - DPF: {92ECE6FA-AC2E-4042-BFAE-0C8608E52A43} (SignActivX Control) - https://www.bph.pl/pi/components/SignActivX.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: AntiVir PersonalEdition Premium MailGuard (AntiVirMailService) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Premium\avmailc.exe
O23 - Service: AntiVir PersonalEdition Premium Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Premium\sched.exe
O23 - Service: AntiVir PersonalEdition Premium Guard (AntiVirService) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Premium\avguard.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AntiVir PersonalEdition Premium MailGuard helper service (AVEService) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Premium\avesvc.exe
O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\system32\drivers\CDAC11BA.EXE
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe

Proszę o pomoc. Zaznaczam, że moja znajomość tzw. skrótów myślowych jest marna, więc aby później nie trzeba było odpowiadać na głupie pytania (z mojej strony) to proponuję kawę na ławę

Wielkie dzięki.

**Posty:** 3854 · przez **Dzi@dek** 15 Gru 2007, 21:48

tomilek napisał(a):to proponuję kawę na ławę

Zacznijmy od tego.
http://forum.programosy.pl/hijackthis-amp-silent-runners-gtobsuga-i-umieszczanie-vt9452.html

popraw log i umieść go w tagi.

**Posty:** 14 · przez **tomilek** 15 Gru 2007, 22:01

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 20:59:19, on 2007-12-15 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\Program Files\AntiVir PersonalEdition Premium\sched.exe C:\Program Files\AntiVir PersonalEdition Premium\avguard.exe C:\Program Files\AntiVir PersonalEdition Premium\avesvc.exe C:\WINDOWS\system32\drivers\CDAC11BA.EXE C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe C:\WINDOWS\system32\Ati2evxx.exe C:\Program Files\AntiVir PersonalEdition Premium\avmailc.exe C:\Program Files\Analog Devices\SoundMAX\Smtray.exe C:\Program Files\Hewlett-Packard\Toolbox2.0\Apache Tomcat 4.0\webapps\Toolbox\StatusClient\StatusClient.exe C:\Program Files\AntiVir PersonalEdition Premium\avgnt.exe C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe C:\WINDOWS\system32\LXSUPMON.EXE C:\Program Files\ATI Technologies\ATI HYDRAVISION\HydraDM.exe C:\Program Files\ATI Technologies\ATI HYDRAVISION\HydraMD.exe C:\Program Files\Nokia\Nokia Software Launcher\NSLauncher.exe C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe C:\Program Files\ATI Technologies\ATI.ACE\cli.exe C:\Program Files\Gadu-Gadu\gg.exe C:\Program Files\Hewlett-Packard\Toolbox2.0\Javasoft\JRE\1.3.1\bin\javaw.exe C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe C:\Program Files\MagicDisc\MagicDisc.exe C:\WINDOWS\explorer.exe M:\HiJackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.onet.pl/ R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.1.9.24.dll O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL O4 - HKLM\..\Run: [Smapp] C:\Program Files\Analog Devices\SoundMAX\Smtray.exe O4 - HKLM\..\Run: [StatusClient] C:\Program Files\Hewlett-Packard\Toolbox2.0\Apache Tomcat 4.0\webapps\Toolbox\StatusClient\StatusClient.exe /auto O4 - HKLM\..\Run: [TomcatStartup] C:\Program Files\Hewlett-Packard\Toolbox2.0\hpbpsttp.exe O4 - HKLM\..\Run: [avgnt] "C:\Program Files\AntiVir PersonalEdition Premium\avgnt.exe" /min O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [LXSUPMON] C:\WINDOWS\system32\LXSUPMON.EXE RUN O4 - HKLM\..\Run: [HydraVisionDesktopManager] C:\Program Files\ATI Technologies\ATI HYDRAVISION\HydraDM.exe O4 - HKLM\..\Run: [HydraVisionViewport] C:\Program Files\ATI Technologies\ATI HYDRAVISION\HydraMD.exe O4 - HKLM\..\Run: [NSLauncher] C:\Program Files\Nokia\Nokia Software Launcher\NSLauncher.exe /startup O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -startup O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay O4 - HKLM\..\Run: [HPWO_MPM_Agent] C:\Program Files\HP\HP Officejet Pro K850 Series\Toolbox\mpm.exe O4 - HKLM\..\Run: [HPWOTOOLBOX] C:\Program Files\HP\HP Officejet Pro K850 Series\Toolbox\HPWOTBX.exe "-i" O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized O4 - HKCU\..\Run: [PcSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKUS\S-1-5-21-1229272821-1957994488-725345543-1003\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray (User '?') O4 - HKUS\S-1-5-21-1229272821-1957994488-725345543-1003\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized (User '?') O4 - HKUS\S-1-5-21-1229272821-1957994488-725345543-1003\..\Run: [PcSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog (User '?') O4 - HKUS\S-1-5-21-1229272821-1957994488-725345543-1003\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe (User '?') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User '?') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user') O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O4 - Global Startup: Microsoft Works Calendar Reminders.lnk = ? O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm O8 - Extra context menu item: E&ksportuj do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000 O8 - Extra context menu item: Otwórz klienta na monitorze &1 - C:\WINDOWS\web\AOpenClient.htm O8 - Extra context menu item: Otwórz klienta na monitorze &2 - C:\WINDOWS\web\AOpenClient.htm O9 - Extra button: Wyślij do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra 'Tools' menuitem: Wyślij &do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra button: BitComet Search - {461CC20B-FB6E-4f16-8FE8-C29359DB100E} - C:\Program Files\BitComet\tools\BitCometBHO_1.1.9.24.dll O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: ING Bank Online - https://ssl.bsk.com.pl/bskonl/component/INGOnl.cab O16 - DPF: {68282C51-9459-467B-95BF-3C0E89627E55} (MksSkanerOnline Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab O16 - DPF: {92ECE6FA-AC2E-4042-BFAE-0C8608E52A43} (SignActivX Control) - https://www.bph.pl/pi/components/SignActivX.cab O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: AntiVir PersonalEdition Premium MailGuard (AntiVirMailService) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Premium\avmailc.exe O23 - Service: AntiVir PersonalEdition Premium Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Premium\sched.exe O23 - Service: AntiVir PersonalEdition Premium Guard (AntiVirService) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Premium\avguard.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: AntiVir PersonalEdition Premium MailGuard helper service (AVEService) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Premium\avesvc.exe O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\system32\drivers\CDAC11BA.EXE O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe -- End of file - 8476 bytes

**Posty:** 3854 · przez **Dzi@dek** 15 Gru 2007, 22:06

Log z HJ czysty - daj jeszcze log z combofix oraz zastosuj się do tego tematu:

http://forum.programosy.pl/bad-generic-host-process-for-win32-services-vt79489.html

**Posty:** 14 · przez **tomilek** 15 Gru 2007, 22:10

Zastosowałem się do instrukcji - wszystkie zapisy na zielono - niestety bez poprawy.

Kod: Zaznacz wszystko: ComboFix 07-12-15.5 - tomilek 2007-12-15 18:24:42.2 - [color=red][b]FAT32[/b][/color]x86 Running from: M:\ComboFix.exe . ((((((((((((((((((((((((( Files Created from 2007-11-15 to 2007-12-15 ))))))))))))))))))))))))))))))) . 2007-12-15 15:51 . 2007-06-16 19:25 <DIR> d--h----- C:\Documents and Settings\Administrator.JESIENNA\Ustawienia lokalne 2007-12-15 15:51 . 2007-06-16 19:25 <DIR> d-------- C:\Documents and Settings\Administrator.JESIENNA\Ulubione 2007-12-15 15:51 . 2007-06-16 19:25 <DIR> d--h----- C:\Documents and Settings\Administrator.JESIENNA\Szablony 2007-12-15 15:51 . 2007-06-16 19:25 <DIR> d-------- C:\Documents and Settings\Administrator.JESIENNA\Pulpit 2007-12-15 15:51 . 2007-06-16 19:25 <DIR> d-------- C:\Documents and Settings\Administrator.JESIENNA\Moje dokumenty 2007-12-15 15:51 . 2007-06-16 19:25 <DIR> dr------- C:\Documents and Settings\Administrator.JESIENNA\Menu Start 2007-12-15 15:51 . 2007-06-16 19:25 <DIR> dr-h----- C:\Documents and Settings\Administrator.JESIENNA\Dane aplikacji 2007-12-15 15:47 . 2007-06-16 19:25 <DIR> d--h----- C:\Documents and Settings\Administrator\Ustawienia lokalne 2007-12-15 15:47 . 2007-06-16 19:25 <DIR> d-------- C:\Documents and Settings\Administrator\Ulubione 2007-12-15 15:47 . 2007-06-16 19:25 <DIR> d--h----- C:\Documents and Settings\Administrator\Szablony 2007-12-15 15:47 . 2007-06-16 19:25 <DIR> d-------- C:\Documents and Settings\Administrator\Pulpit 2007-12-15 15:47 . 2007-06-16 19:25 <DIR> d-------- C:\Documents and Settings\Administrator\Moje dokumenty 2007-12-15 15:47 . 2007-06-16 19:25 <DIR> dr------- C:\Documents and Settings\Administrator\Menu Start 2007-12-15 15:47 . 2007-06-16 19:25 <DIR> dr-h----- C:\Documents and Settings\Administrator\Dane aplikacji 2007-12-15 12:37 . 2007-12-15 12:29 135,168 --a------ C:\WINDOWS\_install.exe 2007-12-15 12:34 . 2007-12-15 12:29 135,168 --a------ C:\WINDOWS\system32\_install.exe 2007-12-15 12:33 . 2007-12-15 12:29 135,168 --a------ C:\WINDOWS\system32\dllcache\_install.exe 2007-12-15 12:30 . 2007-12-15 15:25 40,971 --a------ C:\WINDOWS\ntfyapp.config 2007-12-15 12:29 . 2007-12-15 12:29 135,168 --a------ C:\WINDOWS\ntfyapp.exe 2007-12-15 12:27 . 2007-12-15 12:27 39,798 --a------ C:\WINDOWS\system32\dllgh8jkd1q2.exe 2007-12-15 12:27 . 2007-12-15 12:27 29,184 --a------ C:\lo506217296.exe 2007-12-15 12:27 . 2007-12-15 12:27 18,294 --a------ C:\WINDOWS\system32\dllgh8jkd1q7.exe 2007-12-15 12:27 . 2007-12-15 12:27 17,782 --a------ C:\WINDOWS\system32\dllgh8jkd1q6.exe 2007-12-15 12:27 . 2007-12-15 12:27 16,758 --a------ C:\WINDOWS\system32\dllgh8jkd1q5.exe 2007-12-15 12:27 . 2007-12-15 12:27 15,734 --a------ C:\WINDOWS\system32\dllgh8jkd1q1.exe 2007-12-15 12:27 . 2007-12-15 15:57 0 --a------ C:\WINDOWS\system32\dllgh8jkd1q8.exe 2007-12-12 08:26 . 2007-12-12 08:43 184 --a------ C:\WINDOWS\wcx_ftp.ini 2007-12-10 19:38 . 2007-12-10 19:38 <DIR> d-------- C:\Program Files\Witcobber 2007-12-08 15:12 . 2007-12-08 15:12 <DIR> d-------- C:\Documents and Settings\tomilek\Dane aplikacji\GARMIN 2007-12-08 09:44 . 2007-12-08 09:44 <DIR> d-------- C:\Garmin 2007-12-08 09:44 . 2007-01-17 09:07 17,536 --a------ C:\WINDOWS\system32\drivers\grmn0200.sys 2007-12-08 09:44 . 2007-01-17 09:07 17,024 --a------ C:\WINDOWS\system32\drivers\grmngen.sys 2007-12-08 09:44 . 2007-01-17 09:07 16,512 --a------ C:\WINDOWS\system32\drivers\grmn0400.sys 2007-12-08 09:44 . 2007-01-17 09:07 11,776 --a------ C:\WINDOWS\system32\drivers\grmn1200.sys 2007-12-08 09:44 . 2007-01-17 09:07 7,296 --a------ C:\WINDOWS\system32\drivers\grmnusb.sys 2007-12-05 19:59 . 2007-12-05 19:59 <DIR> d-------- C:\VIDEO_OUTPUT 2007-12-05 19:56 . 2007-12-05 19:56 <DIR> d-------- C:\Program Files\Allok AVI to DVD SVCD VCD Converter 2007-12-05 19:56 . 2005-08-31 14:12 401,408 --a------ C:\WINDOWS\system32\MPEGWriteFilter.dll 2007-12-05 19:56 . 2005-08-31 14:04 135,168 --a------ C:\WINDOWS\system32\DVDEncoder.dll 2007-12-05 19:56 . 2005-08-31 14:09 81,920 --a------ C:\WINDOWS\system32\MPEGFilter.dll 2007-12-01 14:37 . 2007-12-01 14:37 <DIR> d-------- C:\Program Files\Super DVD Ripper 2007-12-01 14:37 . 2007-12-05 10:10 4 --a------ C:\WINDOWS\system32\micr0st.dll 2007-12-01 14:26 . 2007-12-01 14:26 <DIR> d-------- C:\Program Files\Avi2Dvd 2007-12-01 14:20 . 2007-12-01 14:20 <DIR> d-------- C:\Program Files\RADVideo 2007-12-01 14:01 . 2007-12-01 14:01 <DIR> d-------- C:\Program Files\Gabest 2007-12-01 14:01 . 2007-12-01 14:01 <DIR> d-------- C:\Program Files\AviSynth 2.5 2007-12-01 12:16 . 2007-12-01 12:16 <DIR> d-------- C:\Program Files\GRETECH 2007-12-01 09:39 . 2007-12-01 09:40 113,296 --a------ C:\WINDOWS\system32\GDIPFONTCACHEV1.DAT 2007-11-30 18:35 . 2007-11-30 18:35 <DIR> d-------- C:\Program Files\RealMedia 2007-11-30 18:35 . 2007-11-30 18:35 <DIR> d-------- C:\Program Files\DScaler5 2007-11-30 18:35 . 2007-11-30 18:35 <DIR> d-------- C:\Program Files\CD Audio Reader Filter 2007-11-30 18:34 . 2007-11-30 18:34 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\SongbirdVLC 2007-11-30 18:33 . 2007-11-30 18:33 <DIR> d-------- C:\Program Files\ffdshow 2007-11-30 18:33 . 2007-11-30 18:33 <DIR> d-------- C:\Program Files\DS-MP3 Source 2007-11-30 18:33 . 2007-11-30 18:33 <DIR> d-------- C:\Documents and Settings\tomilek\Dane aplikacji\Songbird1 2007-11-30 18:32 . 2007-11-30 18:32 <DIR> d-------- C:\Program Files\DirectVobSub 2007-11-30 18:28 . 2007-11-30 18:28 67 --a------ C:\WINDOWS\VplayerINI.vpl 2007-11-30 18:27 . 2007-11-30 18:28 972 --a------ C:\WINDOWS\VPlayer.INI 2007-11-30 09:53 . 2007-11-30 09:53 <DIR> d-------- C:\Program Files\Common Files\AVSMedia 2007-11-30 09:53 . 2007-11-30 09:53 <DIR> d-------- C:\Program Files\AVSMedia 2007-11-30 09:53 . 2003-05-22 00:50 1,700,352 --a------ C:\WINDOWS\system32\GdiPlus.dll 2007-11-30 09:53 . 2002-01-05 16:48 974,848 --a------ C:\WINDOWS\system32\mfc70.dll 2007-11-30 09:53 . 2002-01-05 15:40 487,424 --a------ C:\WINDOWS\system32\msvcp70.dll 2007-11-30 09:53 . 2002-08-20 01:41 413,760 --a------ C:\WINDOWS\system32\mpg4c32.dll 2007-11-30 09:53 . 2003-05-22 00:50 261,632 --a------ C:\WINDOWS\system32\mcdvd_32.dll 2007-11-30 09:53 . 2003-05-22 00:50 156,910 --a------ C:\WINDOWS\WMSysPr8.prx 2007-11-30 09:53 . 2003-05-22 00:50 82,944 --a------ C:\WINDOWS\system32\vct3216.acm 2007-11-30 09:53 . 2003-05-22 00:50 38,912 --a------ C:\WINDOWS\system32\alf2cd.acm 2007-11-30 09:53 . 2003-05-21 13:50 24,576 --a------ C:\WINDOWS\system32\msxml3a.dll 2007-11-30 09:53 . 2000-03-14 21:55 13,239 --a------ C:\WINDOWS\system32\Scg726.acm 2007-11-30 09:21 . 2007-11-30 09:21 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\ESTsoft 2007-11-30 09:20 . 2007-11-30 09:20 <DIR> d-------- C:\Documents and Settings\tomilek\Dane aplikacji\ESTSoft 2007-11-28 22:16 . 2007-11-28 22:16 <DIR> d-------- C:\Program Files\vanBasco's Karaoke Player 2007-11-24 23:13 . 2007-11-24 23:13 892,928 --a------ C:\WINDOWS\system32\iconv.dll 2007-11-15 14:35 . 2007-11-15 14:35 <DIR> d-------- C:\Documents and Settings\tomilek\Dane aplikacji\Mikrotik . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2007-12-15 11:29 135,168 ----a-w C:\WINDOWS\PCHEALTH\UploadLB\Binaries\_install.exe 2007-12-15 11:29 135,168 ----a-w C:\WINDOWS\PCHEALTH\HELPCTR\Binaries\_install.exe 2007-12-15 11:29 135,168 ----a-w C:\WINDOWS\inf\_install.exe 2007-12-15 11:29 135,168 ----a-w C:\WINDOWS\Help\Tours\mmTour\_install.exe 2007-11-24 22:13 740,442 ----a-w C:\WINDOWS\system32\DivX.dll 2007-11-10 14:54 --------- d-----w C:\Program Files\MagicDisc 2007-11-05 13:23 --------- d-----w C:\Documents and Settings\tomilek\Dane aplikacji\Azureus 2007-11-05 13:23 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Azureus 2007-11-05 13:20 --------- d-----w C:\Program Files\Azureus 2007-10-29 18:56 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Nokia 2007-10-28 21:46 245,760 ----a-w C:\WINDOWS\system32\mplvpx.dll 2007-10-28 21:45 9,216 ----a-w C:\WINDOWS\system32\cpuinf32.dll 2007-10-16 19:27 --------- d-----w C:\Documents and Settings\tomilek\Dane aplikacji\Talkback 2007-10-08 10:04 729,088 ----a-w C:\WINDOWS\iun6002.exe 2007-06-19 07:16 84,418 ----a-w C:\Documents and Settings\All Users\Dane aplikacji\mainlsp.reg.dat 2007-06-17 11:04 84,418 ----a-w C:\Documents and Settings\All Users\Dane aplikacji\firstlsp.reg.dat . ((((((((((((((((((((((((((((( snapshot@2007-12-15_17.15.37.70 ))))))))))))))))))))))))))))))))))))))))) . + 2007-03-13 09:57:12 163,328 ----a-w C:\WINDOWS\erdnt\subs\F3M\ERDNT.EXE . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\AutoCAD Digital Signatures Icon Overlay Handler] @={36A21736-36C2-4C11-8ACB-D4136F2B57BD} [HKEY_CLASSES_ROOT\CLSID\{36A21736-36C2-4C11-8ACB-D4136F2B57BD}] 2003-02-14 11:31 136352 --a------ C:\WINDOWS\system32\AcSignIcon.dll [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Gadu-Gadu"="C:\Program Files\Gadu-Gadu\gg.exe" [2007-05-10 16:36] "Skype"="C:\Program Files\Skype\Phone\Skype.exe" [2007-09-13 13:31] "PcSync"="C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2007-06-19 10:17] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:44] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Smapp"="C:\Program Files\Analog Devices\SoundMAX\Smtray.exe" [2002-06-26 17:36] "StatusClient"="C:\Program Files\Hewlett-Packard\Toolbox2.0\Apache Tomcat 4.0\webapps\Toolbox\StatusClient\StatusClient.exe" [2002-12-16 16:51] "TomcatStartup"="C:\Program Files\Hewlett-Packard\Toolbox2.0\hpbpsttp.exe" [2003-03-31 19:28] "avgnt"="C:\Program Files\AntiVir PersonalEdition Premium\avgnt.exe" [2007-10-12 08:25] "GrooveMonitor"="C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-27 00:47] "NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 11:50] "LXSUPMON"="C:\WINDOWS\system32\LXSUPMON.exe" [2002-08-15 12:26] "HydraVisionDesktopManager"="C:\Program Files\ATI Technologies\ATI HYDRAVISION\HydraDM.exe" [2003-09-15 21:00] "HydraVisionViewport"="C:\Program Files\ATI Technologies\ATI HYDRAVISION\HydraMD.exe" [2003-09-15 21:00] "NSLauncher"="C:\Program Files\Nokia\Nokia Software Launcher\NSLauncher.exe" [2006-11-28 01:12] "PCSuiteTrayApplication"="C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe" [2007-06-18 15:10] "ATICCC"="C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" [2005-08-12 14:43] "HPWO_MPM_Agent"="C:\Program Files\HP\HP Officejet Pro K850 Series\Toolbox\mpm.exe" [2006-11-03 15:01] "HPWOTOOLBOX"="C:\Program Files\HP\HP Officejet Pro K850 Series\Toolbox\HPWOTBX.exe" [2006-11-03 15:01] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-08-04 00:44] "Nokia.PCSync"="C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2007-06-19 10:17] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\E] \Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL copy.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\F] \Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL copy.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\J] \Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL copy.exe . ************************************************************************** catchme 0.3.1333 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-12-15 18:25:50 Windows 5.1.2600 Dodatek Service Pack 2 FAT NTAPI scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2007-12-15 18:26:13 C:\ComboFix2.txt ... 2007-12-15 17:16

**Posty:** 3854 · przez **Dzi@dek** 15 Gru 2007, 22:24

Pobierz program SDFix

Dwuklik na SDFix.exe następnie program wypakuje się na dysk systemowy (standardowo C:\SDFix)
Zrestartuj komputer i wejdź do trybu awaryjnego (klawisz F8 przed bootem Windowsa)
Wejdź do folderu z SDFix kliknij dwa razy na plik RunThis.bat
Wciśnij Y nastąpi proces usuwania.
Kiedy usuwanie się ukończy wciśnij dowolny klawisz (Any Key). Nastąpi restart komputera.
Po restarcie SDFix uruchomi się ponownie, żeby dokończyć proces usuwania kiedy pojawi się w oknie programu Finished, wciśnij dowolny klawisz do zakończenia scryptu i załadowania ikon na pulpicie.
Pokaż Report.txt znajdujący się w folderze SDFix.

**Posty:** 14 · przez **tomilek** 15 Gru 2007, 22:40

Nie pomogło.

Kod: Zaznacz wszystko: SDFix: Version 1.118 Run by tomilek on 2007-12-15 at 21:32 Microsoft Windows XP [Wersja 5.1.2600] Running From: C:\SDFix Safe Mode: Checking Services: Restoring Windows Registry Values Restoring Windows Default Hosts File Rebooting... Normal Mode: Checking Files: Trojan Files Found: C:\WINDOWS\SYSTEM32\DLLGH8~1.EXE - Deleted C:\autorun.inf - Deleted C:\WINDOWS\ntfyapp.exe - Deleted Removing Temp Files... ADS Check: C:\WINDOWS No streams found. C:\WINDOWS\system32 No streams found. C:\WINDOWS\system32\svchost.exe No streams found. C:\WINDOWS\system32\ntoskrnl.exe No streams found. Final Check: catchme 0.3.1262.1 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-12-15 21:36:12 Windows 5.1.2600 Dodatek Service Pack 2 FAT NTAPI scanning hidden processes ... scanning hidden services ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden processes: 0 hidden services: 0 hidden files: 0 Remaining Services: ------------------ Authorized Application Key Export: [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list] Remaining Files: --------------- File Backups: - C:\SDFix\backups\backups.zip Files with Hidden Attributes: Wed 22 Dec 2004 76,568 ..SHR --- "C:\Program Files\Autodesk\Autodesk DWF Viewer\Setup.exe" Thu 13 Jan 2005 11,360 A.SHR --- "C:\Program Files\Autodesk\Autodesk DWF Viewer\_Setupx.dll" Thu 23 Jan 2003 65,952 ..SHR --- "C:\Program Files\Autodesk\Autodesk Express Viewer\Setup.exe" Finished!

**Posty:** 3854 · przez **Dzi@dek** 15 Gru 2007, 23:01

Czy to sie stało tak nagle - bez przyczyny :?:

Nic nie instalowałes ostatnio :?:

[ Dodano: Dzisiaj o 22:05 ]
To tak poza tematem:

Start -> uruchom-> cmd [enter]
wpisujesz:
convert litera_dysku: /fs:ntfs

Aby na przykład konwertować dysk C do systemu NTFS, wpisz następujące polecenie:
convert c: /fs:ntfs [enter]

**Posty:** 14 · przez **tomilek** 15 Gru 2007, 23:05

Przeglądałem strony www (anglojęzyczne) z crackami i w pewnym momencie mój antywirus zaczął wariować (mam Avira antyvir profesional edition) i stało się tak, że nie mam neta i w zasadzie to nic nie mam . . .

**Posty:** 18165 · przez **wojtas** 16 Gru 2007, 00:08

daj koniecznie nowy log z combofixa

**Posty:** 14 · przez **tomilek** 16 Gru 2007, 00:23

Kod: Zaznacz wszystko: ComboFix 07-12-15.5 - tomilek 2007-12-15 23:20:19.3 - [color=red][b]FAT32[/b][/color]x86 Running from: M:\ComboFix.exe . ((((((((((((((((((((((((( Files Created from 2007-11-15 to 2007-12-15 ))))))))))))))))))))))))))))))) . 2007-12-15 21:32 . 2007-12-15 21:32 <DIR> d-------- C:\WINDOWS\ERUNT 2007-12-15 19:57 . 2007-12-15 19:57 <DIR> d--h----- C:\WINDOWS\system32\GroupPolicy 2007-12-15 15:51 . 2007-06-16 19:25 <DIR> d--h----- C:\Documents and Settings\Administrator.JESIENNA\Ustawienia lokalne 2007-12-15 15:51 . 2007-06-16 19:25 <DIR> d-------- C:\Documents and Settings\Administrator.JESIENNA\Ulubione 2007-12-15 15:51 . 2007-06-16 19:25 <DIR> d--h----- C:\Documents and Settings\Administrator.JESIENNA\Szablony 2007-12-15 15:51 . 2007-06-16 19:25 <DIR> d-------- C:\Documents and Settings\Administrator.JESIENNA\Pulpit 2007-12-15 15:51 . 2007-06-16 19:25 <DIR> d-------- C:\Documents and Settings\Administrator.JESIENNA\Moje dokumenty 2007-12-15 15:51 . 2007-06-16 19:25 <DIR> dr------- C:\Documents and Settings\Administrator.JESIENNA\Menu Start 2007-12-15 15:51 . 2007-06-16 19:25 <DIR> dr-h----- C:\Documents and Settings\Administrator.JESIENNA\Dane aplikacji 2007-12-15 15:47 . 2007-06-16 19:25 <DIR> d--h----- C:\Documents and Settings\Administrator\Ustawienia lokalne 2007-12-15 15:47 . 2007-06-16 19:25 <DIR> d-------- C:\Documents and Settings\Administrator\Ulubione 2007-12-15 15:47 . 2007-06-16 19:25 <DIR> d--h----- C:\Documents and Settings\Administrator\Szablony 2007-12-15 15:47 . 2007-06-16 19:25 <DIR> d-------- C:\Documents and Settings\Administrator\Pulpit 2007-12-15 15:47 . 2007-06-16 19:25 <DIR> d-------- C:\Documents and Settings\Administrator\Moje dokumenty 2007-12-15 15:47 . 2007-06-16 19:25 <DIR> dr------- C:\Documents and Settings\Administrator\Menu Start 2007-12-15 15:47 . 2007-06-16 19:25 <DIR> dr-h----- C:\Documents and Settings\Administrator\Dane aplikacji 2007-12-15 12:37 . 2007-12-15 12:29 135,168 --a------ C:\WINDOWS\_install.exe 2007-12-15 12:34 . 2007-12-15 12:29 135,168 --a------ C:\WINDOWS\system32\_install.exe 2007-12-15 12:33 . 2007-12-15 12:29 135,168 --a------ C:\WINDOWS\system32\dllcache\_install.exe 2007-12-15 12:30 . 2007-12-15 15:25 40,971 --a------ C:\WINDOWS\ntfyapp.config 2007-12-15 12:27 . 2007-12-15 12:27 39,798 --a------ C:\WINDOWS\system32\dllgh8jkd1q2.exe 2007-12-15 12:27 . 2007-12-15 12:27 29,184 --a------ C:\lo506217296.exe 2007-12-15 12:27 . 2007-12-15 12:27 18,294 --a------ C:\WINDOWS\system32\dllgh8jkd1q7.exe 2007-12-15 12:27 . 2007-12-15 12:27 17,782 --a------ C:\WINDOWS\system32\dllgh8jkd1q6.exe 2007-12-15 12:27 . 2007-12-15 12:27 16,758 --a------ C:\WINDOWS\system32\dllgh8jkd1q5.exe 2007-12-15 12:27 . 2007-12-15 12:27 15,734 --a------ C:\WINDOWS\system32\dllgh8jkd1q1.exe 2007-12-12 08:26 . 2007-12-12 08:43 184 --a------ C:\WINDOWS\wcx_ftp.ini 2007-12-10 19:38 . 2007-12-10 19:38 <DIR> d-------- C:\Program Files\Witcobber 2007-12-08 15:12 . 2007-12-08 15:12 <DIR> d-------- C:\Documents and Settings\tomilek\Dane aplikacji\GARMIN 2007-12-08 09:44 . 2007-12-08 09:44 <DIR> d-------- C:\Garmin 2007-12-08 09:44 . 2007-01-17 09:07 17,536 --a------ C:\WINDOWS\system32\drivers\grmn0200.sys 2007-12-08 09:44 . 2007-01-17 09:07 17,024 --a------ C:\WINDOWS\system32\drivers\grmngen.sys 2007-12-08 09:44 . 2007-01-17 09:07 16,512 --a------ C:\WINDOWS\system32\drivers\grmn0400.sys 2007-12-08 09:44 . 2007-01-17 09:07 11,776 --a------ C:\WINDOWS\system32\drivers\grmn1200.sys 2007-12-08 09:44 . 2007-01-17 09:07 7,296 --a------ C:\WINDOWS\system32\drivers\grmnusb.sys 2007-12-05 19:59 . 2007-12-05 19:59 <DIR> d-------- C:\VIDEO_OUTPUT 2007-12-05 19:56 . 2007-12-05 19:56 <DIR> d-------- C:\Program Files\Allok AVI to DVD SVCD VCD Converter 2007-12-05 19:56 . 2005-08-31 14:12 401,408 --a------ C:\WINDOWS\system32\MPEGWriteFilter.dll 2007-12-05 19:56 . 2005-08-31 14:04 135,168 --a------ C:\WINDOWS\system32\DVDEncoder.dll 2007-12-05 19:56 . 2005-08-31 14:09 81,920 --a------ C:\WINDOWS\system32\MPEGFilter.dll 2007-12-01 14:37 . 2007-12-01 14:37 <DIR> d-------- C:\Program Files\Super DVD Ripper 2007-12-01 14:37 . 2007-12-05 10:10 4 --a------ C:\WINDOWS\system32\micr0st.dll 2007-12-01 14:26 . 2007-12-01 14:26 <DIR> d-------- C:\Program Files\Avi2Dvd 2007-12-01 14:20 . 2007-12-01 14:20 <DIR> d-------- C:\Program Files\RADVideo 2007-12-01 14:01 . 2007-12-01 14:01 <DIR> d-------- C:\Program Files\Gabest 2007-12-01 14:01 . 2007-12-01 14:01 <DIR> d-------- C:\Program Files\AviSynth 2.5 2007-12-01 12:16 . 2007-12-01 12:16 <DIR> d-------- C:\Program Files\GRETECH 2007-12-01 09:39 . 2007-12-01 09:40 113,296 --a------ C:\WINDOWS\system32\GDIPFONTCACHEV1.DAT 2007-11-30 18:35 . 2007-11-30 18:35 <DIR> d-------- C:\Program Files\RealMedia 2007-11-30 18:35 . 2007-11-30 18:35 <DIR> d-------- C:\Program Files\DScaler5 2007-11-30 18:35 . 2007-11-30 18:35 <DIR> d-------- C:\Program Files\CD Audio Reader Filter 2007-11-30 18:34 . 2007-11-30 18:34 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\SongbirdVLC 2007-11-30 18:33 . 2007-11-30 18:33 <DIR> d-------- C:\Program Files\ffdshow 2007-11-30 18:33 . 2007-11-30 18:33 <DIR> d-------- C:\Program Files\DS-MP3 Source 2007-11-30 18:33 . 2007-11-30 18:33 <DIR> d-------- C:\Documents and Settings\tomilek\Dane aplikacji\Songbird1 2007-11-30 18:32 . 2007-11-30 18:32 <DIR> d-------- C:\Program Files\DirectVobSub 2007-11-30 18:28 . 2007-11-30 18:28 67 --a------ C:\WINDOWS\VplayerINI.vpl 2007-11-30 18:27 . 2007-11-30 18:28 972 --a------ C:\WINDOWS\VPlayer.INI 2007-11-30 09:53 . 2007-11-30 09:53 <DIR> d-------- C:\Program Files\Common Files\AVSMedia 2007-11-30 09:53 . 2007-11-30 09:53 <DIR> d-------- C:\Program Files\AVSMedia 2007-11-30 09:53 . 2003-05-22 00:50 1,700,352 --a------ C:\WINDOWS\system32\GdiPlus.dll 2007-11-30 09:53 . 2002-01-05 16:48 974,848 --a------ C:\WINDOWS\system32\mfc70.dll 2007-11-30 09:53 . 2002-01-05 15:40 487,424 --a------ C:\WINDOWS\system32\msvcp70.dll 2007-11-30 09:53 . 2002-08-20 01:41 413,760 --a------ C:\WINDOWS\system32\mpg4c32.dll 2007-11-30 09:53 . 2003-05-22 00:50 261,632 --a------ C:\WINDOWS\system32\mcdvd_32.dll 2007-11-30 09:53 . 2003-05-22 00:50 156,910 --a------ C:\WINDOWS\WMSysPr8.prx 2007-11-30 09:53 . 2003-05-22 00:50 82,944 --a------ C:\WINDOWS\system32\vct3216.acm 2007-11-30 09:53 . 2003-05-22 00:50 38,912 --a------ C:\WINDOWS\system32\alf2cd.acm 2007-11-30 09:53 . 2003-05-21 13:50 24,576 --a------ C:\WINDOWS\system32\msxml3a.dll 2007-11-30 09:53 . 2000-03-14 21:55 13,239 --a------ C:\WINDOWS\system32\Scg726.acm 2007-11-30 09:21 . 2007-11-30 09:21 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\ESTsoft 2007-11-30 09:20 . 2007-11-30 09:20 <DIR> d-------- C:\Documents and Settings\tomilek\Dane aplikacji\ESTSoft 2007-11-28 22:16 . 2007-11-28 22:16 <DIR> d-------- C:\Program Files\vanBasco's Karaoke Player 2007-11-24 23:13 . 2007-11-24 23:13 892,928 --a------ C:\WINDOWS\system32\iconv.dll 2007-11-15 14:35 . 2007-11-15 14:35 <DIR> d-------- C:\Documents and Settings\tomilek\Dane aplikacji\Mikrotik . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2007-12-15 11:29 135,168 ----a-w C:\WINDOWS\PCHEALTH\UploadLB\Binaries\_install.exe 2007-12-15 11:29 135,168 ----a-w C:\WINDOWS\PCHEALTH\HELPCTR\Binaries\_install.exe 2007-12-15 11:29 135,168 ----a-w C:\WINDOWS\inf\_install.exe 2007-12-15 11:29 135,168 ----a-w C:\WINDOWS\Help\Tours\mmTour\_install.exe 2007-11-24 22:13 740,442 ----a-w C:\WINDOWS\system32\DivX.dll 2007-11-10 14:54 --------- d-----w C:\Program Files\MagicDisc 2007-11-05 13:23 --------- d-----w C:\Documents and Settings\tomilek\Dane aplikacji\Azureus 2007-11-05 13:23 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Azureus 2007-11-05 13:20 --------- d-----w C:\Program Files\Azureus 2007-10-29 18:56 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Nokia 2007-10-28 21:46 245,760 ----a-w C:\WINDOWS\system32\mplvpx.dll 2007-10-28 21:45 9,216 ----a-w C:\WINDOWS\system32\cpuinf32.dll 2007-10-16 19:27 --------- d-----w C:\Documents and Settings\tomilek\Dane aplikacji\Talkback 2007-10-08 10:04 729,088 ----a-w C:\WINDOWS\iun6002.exe 2007-06-19 07:16 84,418 ----a-w C:\Documents and Settings\All Users\Dane aplikacji\mainlsp.reg.dat 2007-06-17 11:04 84,418 ----a-w C:\Documents and Settings\All Users\Dane aplikacji\firstlsp.reg.dat . ((((((((((((((((((((((((((((( snapshot@2007-12-15_17.15.37.70 ))))))))))))))))))))))))))))))))))))))))) . + 2007-03-13 09:57:12 163,328 ----a-w C:\WINDOWS\erdnt\subs\F3M\ERDNT.EXE + 2007-12-13 12:23:36 163,328 ----a-w C:\WINDOWS\ERUNT\SDFIX\ERDNT.EXE + 2007-12-15 21:59:58 385,024 ----a-w C:\WINDOWS\ERUNT\SDFIX\Users\[u]0[/u]0000001\NTUSER.DAT + 2007-12-15 22:00:00 8,192 ----a-w C:\WINDOWS\ERUNT\SDFIX\Users\[u]0[/u]0000002\UsrClass.dat + 2007-12-13 12:23:36 163,328 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\ERDNT.EXE + 2007-12-15 20:32:12 7,749,632 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\Users\[u]0[/u]0000001\ntuser.dat + 2007-12-15 20:32:12 114,688 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\Users\[u]0[/u]0000002\UsrClass.dat . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\AutoCAD Digital Signatures Icon Overlay Handler] @={36A21736-36C2-4C11-8ACB-D4136F2B57BD} [HKEY_CLASSES_ROOT\CLSID\{36A21736-36C2-4C11-8ACB-D4136F2B57BD}] 2003-02-14 11:31 136352 --a------ C:\WINDOWS\system32\AcSignIcon.dll [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Gadu-Gadu"="C:\Program Files\Gadu-Gadu\gg.exe" [2007-05-10 16:36] "Skype"="C:\Program Files\Skype\Phone\Skype.exe" [2007-09-13 13:31] "PcSync"="C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2007-06-19 10:17] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:44] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Smapp"="C:\Program Files\Analog Devices\SoundMAX\Smtray.exe" [2002-06-26 17:36] "StatusClient"="C:\Program Files\Hewlett-Packard\Toolbox2.0\Apache Tomcat 4.0\webapps\Toolbox\StatusClient\StatusClient.exe" [2002-12-16 16:51] "TomcatStartup"="C:\Program Files\Hewlett-Packard\Toolbox2.0\hpbpsttp.exe" [2003-03-31 19:28] "avgnt"="C:\Program Files\AntiVir PersonalEdition Premium\avgnt.exe" [2007-10-12 08:25] "GrooveMonitor"="C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-27 00:47] "NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 11:50] "LXSUPMON"="C:\WINDOWS\system32\LXSUPMON.exe" [2002-08-15 12:26] "HydraVisionDesktopManager"="C:\Program Files\ATI Technologies\ATI HYDRAVISION\HydraDM.exe" [2003-09-15 21:00] "HydraVisionViewport"="C:\Program Files\ATI Technologies\ATI HYDRAVISION\HydraMD.exe" [2003-09-15 21:00] "NSLauncher"="C:\Program Files\Nokia\Nokia Software Launcher\NSLauncher.exe" [2006-11-28 01:12] "PCSuiteTrayApplication"="C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe" [2007-06-18 15:10] "ATICCC"="C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" [2005-08-12 14:43] "HPWO_MPM_Agent"="C:\Program Files\HP\HP Officejet Pro K850 Series\Toolbox\mpm.exe" [2006-11-03 15:01] "HPWOTOOLBOX"="C:\Program Files\HP\HP Officejet Pro K850 Series\Toolbox\HPWOTBX.exe" [2006-11-03 15:01] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-08-04 00:44] "Nokia.PCSync"="C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2007-06-19 10:17] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\E] \Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL copy.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\F] \Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL copy.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\J] \Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL copy.exe . ************************************************************************** catchme 0.3.1333 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-12-15 23:21:25 Windows 5.1.2600 Dodatek Service Pack 2 FAT NTAPI scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2007-12-15 23:21:48 C:\ComboFix3.txt ... 2007-12-15 17:16 C:\ComboFix2.txt ... 2007-12-15 18:26

**Posty:** 18165 · przez **wojtas** 16 Gru 2007, 00:33

Otworz notatnik i wklej w nim to:

File::
C:\WINDOWS\_install.exe
C:\WINDOWS\system32\_install.exe
C:\WINDOWS\system32\dllcache\_install.exe
C:\WINDOWS\ntfyapp.config
C:\WINDOWS\system32\dllgh8jkd1q2.exe
C:\lo506217296.exe
C:\WINDOWS\system32\dllgh8jkd1q7.exe
C:\WINDOWS\system32\dllgh8jkd1q6.exe
C:\WINDOWS\system32\dllgh8jkd1q5.exe
C:\WINDOWS\system32\dllgh8jkd1q1.exe
C:\WINDOWS\wcx_ftp.ini
C:\WINDOWS\PCHEALTH\UploadLB\Binaries\_install.exe
C:\WINDOWS\PCHEALTH\HELPCTR\Binaries\_install.exe
C:\WINDOWS\inf\_install.exe
C:\WINDOWS\Help\Tours\mmTour\_install.exe

Registry::
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\E]

[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\F]

[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\J]

Plik >>> zapisz jako CFScript.txt .Plik przeciągnij i upuść na ikonę ComboFixa (tak jak tu ) . Potwierdz >>> zresetuje sie komputer

(jeśli pojawi się pytanie "1 or 2" - to wpisz 1 i naciśnij ENTER). Rozpocznie się proces usuwania
Potem nowy log z hijacka oraz combofixa

**Posty:** 14 · przez **tomilek** 16 Gru 2007, 00:35

Nie mogę przeciągać

**Posty:** 18165 · przez **wojtas** 16 Gru 2007, 00:38

czemu?

Ściągnij OTMoveIt W okienko po lewej Paste List of Files/Folders to be Moved wklej

C:\WINDOWS\_install.exe
C:\WINDOWS\system32\_install.exe
C:\WINDOWS\system32\dllcache\_install.exe
C:\WINDOWS\ntfyapp.config
C:\WINDOWS\system32\dllgh8jkd1q2.exe
C:\lo506217296.exe
C:\WINDOWS\system32\dllgh8jkd1q7.exe
C:\WINDOWS\system32\dllgh8jkd1q6.exe
C:\WINDOWS\system32\dllgh8jkd1q5.exe
C:\WINDOWS\system32\dllgh8jkd1q1.exe
C:\WINDOWS\wcx_ftp.ini
C:\WINDOWS\PCHEALTH\UploadLB\Binaries\_install.exe
C:\WINDOWS\PCHEALTH\HELPCTR\Binaries\_install.exe
C:\WINDOWS\inf\_install.exe
C:\WINDOWS\Help\Tours\mmTour\_install.exe

Następnie naciskamy - MoveIt!. Pliki zostały przeniesione. Wynik operacji zobaczymy w prawym oknie Results.
Log po pracy programu zobaczymy w lokalizacji - C:\_OTMoveIt\MovedFiles
Po całej operacji należy zresetować komputer.

wklej do notatnika

Windows Registry Editor Version 5.00

[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\E]

[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\F]

[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\J]

w notatniku u góry>>>plik zapisz jako>>>Zmien rozszerzenie z TXT na Wszystkie pliki *.* >>> Zapisz pod nazwą FIX.REG

Klikasz dwa razy na powstały plik fix i dodajesz go do rejestru....

potem nowe logi

**Posty:** 14 · przez **tomilek** 16 Gru 2007, 00:57

Nie mogę przeciągnąć, bo nie przesuwa się plik po folderze - nie da się

Zrobione
Logi:

COMBOFIX:

Kod: Zaznacz wszystko: ComboFix 07-12-15.5 - tomilek 2007-12-15 23:52:13.5 - [color=red][b]FAT32[/b][/color]x86 Running from: M:\ComboFix.exe . ((((((((((((((((((((((((( Files Created from 2007-11-15 to 2007-12-15 ))))))))))))))))))))))))))))))) . 2007-12-15 21:32 . 2007-12-15 21:32 <DIR> d-------- C:\WINDOWS\ERUNT 2007-12-15 19:57 . 2007-12-15 19:57 <DIR> d--h----- C:\WINDOWS\system32\GroupPolicy 2007-12-15 15:51 . 2007-06-16 19:25 <DIR> d--h----- C:\Documents and Settings\Administrator.JESIENNA\Ustawienia lokalne 2007-12-15 15:51 . 2007-06-16 19:25 <DIR> d-------- C:\Documents and Settings\Administrator.JESIENNA\Ulubione 2007-12-15 15:51 . 2007-06-16 19:25 <DIR> d--h----- C:\Documents and Settings\Administrator.JESIENNA\Szablony 2007-12-15 15:51 . 2007-06-16 19:25 <DIR> d-------- C:\Documents and Settings\Administrator.JESIENNA\Pulpit 2007-12-15 15:51 . 2007-06-16 19:25 <DIR> d-------- C:\Documents and Settings\Administrator.JESIENNA\Moje dokumenty 2007-12-15 15:51 . 2007-06-16 19:25 <DIR> dr------- C:\Documents and Settings\Administrator.JESIENNA\Menu Start 2007-12-15 15:51 . 2007-06-16 19:25 <DIR> dr-h----- C:\Documents and Settings\Administrator.JESIENNA\Dane aplikacji 2007-12-15 15:47 . 2007-06-16 19:25 <DIR> d--h----- C:\Documents and Settings\Administrator\Ustawienia lokalne 2007-12-15 15:47 . 2007-06-16 19:25 <DIR> d-------- C:\Documents and Settings\Administrator\Ulubione 2007-12-15 15:47 . 2007-06-16 19:25 <DIR> d--h----- C:\Documents and Settings\Administrator\Szablony 2007-12-15 15:47 . 2007-06-16 19:25 <DIR> d-------- C:\Documents and Settings\Administrator\Pulpit 2007-12-15 15:47 . 2007-06-16 19:25 <DIR> d-------- C:\Documents and Settings\Administrator\Moje dokumenty 2007-12-15 15:47 . 2007-06-16 19:25 <DIR> dr------- C:\Documents and Settings\Administrator\Menu Start 2007-12-15 15:47 . 2007-06-16 19:25 <DIR> dr-h----- C:\Documents and Settings\Administrator\Dane aplikacji 2007-12-10 19:38 . 2007-12-10 19:38 <DIR> d-------- C:\Program Files\Witcobber 2007-12-08 15:12 . 2007-12-08 15:12 <DIR> d-------- C:\Documents and Settings\tomilek\Dane aplikacji\GARMIN 2007-12-08 09:44 . 2007-12-08 09:44 <DIR> d-------- C:\Garmin 2007-12-08 09:44 . 2007-01-17 09:07 17,536 --a------ C:\WINDOWS\system32\drivers\grmn0200.sys 2007-12-08 09:44 . 2007-01-17 09:07 17,024 --a------ C:\WINDOWS\system32\drivers\grmngen.sys 2007-12-08 09:44 . 2007-01-17 09:07 16,512 --a------ C:\WINDOWS\system32\drivers\grmn0400.sys 2007-12-08 09:44 . 2007-01-17 09:07 11,776 --a------ C:\WINDOWS\system32\drivers\grmn1200.sys 2007-12-08 09:44 . 2007-01-17 09:07 7,296 --a------ C:\WINDOWS\system32\drivers\grmnusb.sys 2007-12-05 19:59 . 2007-12-05 19:59 <DIR> d-------- C:\VIDEO_OUTPUT 2007-12-05 19:56 . 2007-12-05 19:56 <DIR> d-------- C:\Program Files\Allok AVI to DVD SVCD VCD Converter 2007-12-05 19:56 . 2005-08-31 14:12 401,408 --a------ C:\WINDOWS\system32\MPEGWriteFilter.dll 2007-12-05 19:56 . 2005-08-31 14:04 135,168 --a------ C:\WINDOWS\system32\DVDEncoder.dll 2007-12-05 19:56 . 2005-08-31 14:09 81,920 --a------ C:\WINDOWS\system32\MPEGFilter.dll 2007-12-01 14:37 . 2007-12-01 14:37 <DIR> d-------- C:\Program Files\Super DVD Ripper 2007-12-01 14:37 . 2007-12-05 10:10 4 --a------ C:\WINDOWS\system32\micr0st.dll 2007-12-01 14:26 . 2007-12-01 14:26 <DIR> d-------- C:\Program Files\Avi2Dvd 2007-12-01 14:20 . 2007-12-01 14:20 <DIR> d-------- C:\Program Files\RADVideo 2007-12-01 14:01 . 2007-12-01 14:01 <DIR> d-------- C:\Program Files\Gabest 2007-12-01 14:01 . 2007-12-01 14:01 <DIR> d-------- C:\Program Files\AviSynth 2.5 2007-12-01 12:16 . 2007-12-01 12:16 <DIR> d-------- C:\Program Files\GRETECH 2007-12-01 09:39 . 2007-12-01 09:40 113,296 --a------ C:\WINDOWS\system32\GDIPFONTCACHEV1.DAT 2007-11-30 18:35 . 2007-11-30 18:35 <DIR> d-------- C:\Program Files\RealMedia 2007-11-30 18:35 . 2007-11-30 18:35 <DIR> d-------- C:\Program Files\DScaler5 2007-11-30 18:35 . 2007-11-30 18:35 <DIR> d-------- C:\Program Files\CD Audio Reader Filter 2007-11-30 18:34 . 2007-11-30 18:34 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\SongbirdVLC 2007-11-30 18:33 . 2007-11-30 18:33 <DIR> d-------- C:\Program Files\ffdshow 2007-11-30 18:33 . 2007-11-30 18:33 <DIR> d-------- C:\Program Files\DS-MP3 Source 2007-11-30 18:33 . 2007-11-30 18:33 <DIR> d-------- C:\Documents and Settings\tomilek\Dane aplikacji\Songbird1 2007-11-30 18:32 . 2007-11-30 18:32 <DIR> d-------- C:\Program Files\DirectVobSub 2007-11-30 18:28 . 2007-11-30 18:28 67 --a------ C:\WINDOWS\VplayerINI.vpl 2007-11-30 18:27 . 2007-11-30 18:28 972 --a------ C:\WINDOWS\VPlayer.INI 2007-11-30 09:53 . 2007-11-30 09:53 <DIR> d-------- C:\Program Files\Common Files\AVSMedia 2007-11-30 09:53 . 2007-11-30 09:53 <DIR> d-------- C:\Program Files\AVSMedia 2007-11-30 09:53 . 2003-05-22 00:50 1,700,352 --a------ C:\WINDOWS\system32\GdiPlus.dll 2007-11-30 09:53 . 2002-01-05 16:48 974,848 --a------ C:\WINDOWS\system32\mfc70.dll 2007-11-30 09:53 . 2002-01-05 15:40 487,424 --a------ C:\WINDOWS\system32\msvcp70.dll 2007-11-30 09:53 . 2002-08-20 01:41 413,760 --a------ C:\WINDOWS\system32\mpg4c32.dll 2007-11-30 09:53 . 2003-05-22 00:50 261,632 --a------ C:\WINDOWS\system32\mcdvd_32.dll 2007-11-30 09:53 . 2003-05-22 00:50 156,910 --a------ C:\WINDOWS\WMSysPr8.prx 2007-11-30 09:53 . 2003-05-22 00:50 82,944 --a------ C:\WINDOWS\system32\vct3216.acm 2007-11-30 09:53 . 2003-05-22 00:50 38,912 --a------ C:\WINDOWS\system32\alf2cd.acm 2007-11-30 09:53 . 2003-05-21 13:50 24,576 --a------ C:\WINDOWS\system32\msxml3a.dll 2007-11-30 09:53 . 2000-03-14 21:55 13,239 --a------ C:\WINDOWS\system32\Scg726.acm 2007-11-30 09:21 . 2007-11-30 09:21 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\ESTsoft 2007-11-30 09:20 . 2007-11-30 09:20 <DIR> d-------- C:\Documents and Settings\tomilek\Dane aplikacji\ESTSoft 2007-11-28 22:16 . 2007-11-28 22:16 <DIR> d-------- C:\Program Files\vanBasco's Karaoke Player 2007-11-24 23:13 . 2007-11-24 23:13 892,928 --a------ C:\WINDOWS\system32\iconv.dll 2007-11-15 14:35 . 2007-11-15 14:35 <DIR> d-------- C:\Documents and Settings\tomilek\Dane aplikacji\Mikrotik . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2007-11-24 22:13 740,442 ----a-w C:\WINDOWS\system32\DivX.dll 2007-11-10 14:54 --------- d-----w C:\Program Files\MagicDisc 2007-11-05 13:23 --------- d-----w C:\Documents and Settings\tomilek\Dane aplikacji\Azureus 2007-11-05 13:23 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Azureus 2007-11-05 13:20 --------- d-----w C:\Program Files\Azureus 2007-10-29 18:56 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Nokia 2007-10-28 21:46 245,760 ----a-w C:\WINDOWS\system32\mplvpx.dll 2007-10-28 21:45 9,216 ----a-w C:\WINDOWS\system32\cpuinf32.dll 2007-10-16 19:27 --------- d-----w C:\Documents and Settings\tomilek\Dane aplikacji\Talkback 2007-10-08 10:04 729,088 ----a-w C:\WINDOWS\iun6002.exe 2007-06-19 07:16 84,418 ----a-w C:\Documents and Settings\All Users\Dane aplikacji\mainlsp.reg.dat 2007-06-17 11:04 84,418 ----a-w C:\Documents and Settings\All Users\Dane aplikacji\firstlsp.reg.dat . ((((((((((((((((((((((((((((( snapshot@2007-12-15_17.15.37.70 ))))))))))))))))))))))))))))))))))))))))) . + 2007-03-13 09:57:12 163,328 ----a-w C:\WINDOWS\erdnt\subs\F3M\ERDNT.EXE + 2007-12-13 12:23:36 163,328 ----a-w C:\WINDOWS\ERUNT\SDFIX\ERDNT.EXE + 2007-12-15 21:59:58 385,024 ----a-w C:\WINDOWS\ERUNT\SDFIX\Users\[u]0[/u]0000001\NTUSER.DAT + 2007-12-15 22:00:00 8,192 ----a-w C:\WINDOWS\ERUNT\SDFIX\Users\[u]0[/u]0000002\UsrClass.dat + 2007-12-13 12:23:36 163,328 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\ERDNT.EXE + 2007-12-15 20:32:12 7,749,632 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\Users\[u]0[/u]0000001\ntuser.dat + 2007-12-15 20:32:12 114,688 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\Users\[u]0[/u]0000002\UsrClass.dat . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\AutoCAD Digital Signatures Icon Overlay Handler] @={36A21736-36C2-4C11-8ACB-D4136F2B57BD} [HKEY_CLASSES_ROOT\CLSID\{36A21736-36C2-4C11-8ACB-D4136F2B57BD}] 2003-02-14 11:31 136352 --a------ C:\WINDOWS\system32\AcSignIcon.dll [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Gadu-Gadu"="C:\Program Files\Gadu-Gadu\gg.exe" [2007-05-10 16:36] "Skype"="C:\Program Files\Skype\Phone\Skype.exe" [2007-09-13 13:31] "PcSync"="C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2007-06-19 10:17] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:44] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Smapp"="C:\Program Files\Analog Devices\SoundMAX\Smtray.exe" [2002-06-26 17:36] "StatusClient"="C:\Program Files\Hewlett-Packard\Toolbox2.0\Apache Tomcat 4.0\webapps\Toolbox\StatusClient\StatusClient.exe" [2002-12-16 16:51] "TomcatStartup"="C:\Program Files\Hewlett-Packard\Toolbox2.0\hpbpsttp.exe" [2003-03-31 19:28] "avgnt"="C:\Program Files\AntiVir PersonalEdition Premium\avgnt.exe" [2007-10-12 08:25] "GrooveMonitor"="C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-27 00:47] "NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 11:50] "LXSUPMON"="C:\WINDOWS\system32\LXSUPMON.exe" [2002-08-15 12:26] "HydraVisionDesktopManager"="C:\Program Files\ATI Technologies\ATI HYDRAVISION\HydraDM.exe" [2003-09-15 21:00] "HydraVisionViewport"="C:\Program Files\ATI Technologies\ATI HYDRAVISION\HydraMD.exe" [2003-09-15 21:00] "NSLauncher"="C:\Program Files\Nokia\Nokia Software Launcher\NSLauncher.exe" [2006-11-28 01:12] "PCSuiteTrayApplication"="C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe" [2007-06-18 15:10] "ATICCC"="C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" [2005-08-12 14:43] "HPWO_MPM_Agent"="C:\Program Files\HP\HP Officejet Pro K850 Series\Toolbox\mpm.exe" [2006-11-03 15:01] "HPWOTOOLBOX"="C:\Program Files\HP\HP Officejet Pro K850 Series\Toolbox\HPWOTBX.exe" [2006-11-03 15:01] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-08-04 00:44] "Nokia.PCSync"="C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2007-06-19 10:17] . ************************************************************************** catchme 0.3.1333 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-12-15 23:53:18 Windows 5.1.2600 Dodatek Service Pack 2 FAT NTAPI scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2007-12-15 23:53:43 C:\ComboFix3.txt ... 2007-12-15 18:26 C:\ComboFix2.txt ... 2007-12-15 23:21

hijackthis:

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 23:49, on 2007-12-15 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\Program Files\AntiVir PersonalEdition Premium\sched.exe C:\Program Files\AntiVir PersonalEdition Premium\avguard.exe C:\Program Files\AntiVir PersonalEdition Premium\avesvc.exe C:\WINDOWS\system32\drivers\CDAC11BA.EXE C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe C:\WINDOWS\system32\Ati2evxx.exe C:\Program Files\Analog Devices\SoundMAX\Smtray.exe C:\Program Files\Hewlett-Packard\Toolbox2.0\Apache Tomcat 4.0\webapps\Toolbox\StatusClient\StatusClient.exe C:\Program Files\AntiVir PersonalEdition Premium\avgnt.exe C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe C:\WINDOWS\system32\LXSUPMON.EXE C:\Program Files\ATI Technologies\ATI HYDRAVISION\HydraDM.exe C:\Program Files\ATI Technologies\ATI HYDRAVISION\HydraMD.exe C:\Program Files\Nokia\Nokia Software Launcher\NSLauncher.exe C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe C:\Program Files\Hewlett-Packard\Toolbox2.0\Javasoft\JRE\1.3.1\bin\javaw.exe C:\Program Files\ATI Technologies\ATI.ACE\cli.exe C:\Program Files\Gadu-Gadu\gg.exe C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe C:\WINDOWS\system32\NOTEPAD.EXE M:\HiJackThis.exe C:\WINDOWS\explorer.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.onet.pl/ R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.1.9.24.dll O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL O4 - HKLM\..\Run: [Smapp] C:\Program Files\Analog Devices\SoundMAX\Smtray.exe O4 - HKLM\..\Run: [StatusClient] C:\Program Files\Hewlett-Packard\Toolbox2.0\Apache Tomcat 4.0\webapps\Toolbox\StatusClient\StatusClient.exe /auto O4 - HKLM\..\Run: [TomcatStartup] C:\Program Files\Hewlett-Packard\Toolbox2.0\hpbpsttp.exe O4 - HKLM\..\Run: [avgnt] "C:\Program Files\AntiVir PersonalEdition Premium\avgnt.exe" /min O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [LXSUPMON] C:\WINDOWS\system32\LXSUPMON.EXE RUN O4 - HKLM\..\Run: [HydraVisionDesktopManager] C:\Program Files\ATI Technologies\ATI HYDRAVISION\HydraDM.exe O4 - HKLM\..\Run: [HydraVisionViewport] C:\Program Files\ATI Technologies\ATI HYDRAVISION\HydraMD.exe O4 - HKLM\..\Run: [NSLauncher] C:\Program Files\Nokia\Nokia Software Launcher\NSLauncher.exe /startup O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -startup O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay O4 - HKLM\..\Run: [HPWO_MPM_Agent] C:\Program Files\HP\HP Officejet Pro K850 Series\Toolbox\mpm.exe O4 - HKLM\..\Run: [HPWOTOOLBOX] C:\Program Files\HP\HP Officejet Pro K850 Series\Toolbox\HPWOTBX.exe "-i" O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized O4 - HKCU\..\Run: [PcSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKUS\S-1-5-21-1229272821-1957994488-725345543-1003\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray (User '?') O4 - HKUS\S-1-5-21-1229272821-1957994488-725345543-1003\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized (User '?') O4 - HKUS\S-1-5-21-1229272821-1957994488-725345543-1003\..\Run: [PcSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog (User '?') O4 - HKUS\S-1-5-21-1229272821-1957994488-725345543-1003\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe (User '?') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User '?') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user') O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O4 - Global Startup: Microsoft Works Calendar Reminders.lnk = ? O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm O8 - Extra context menu item: E&ksportuj do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000 O8 - Extra context menu item: Otwórz klienta na monitorze &1 - C:\WINDOWS\web\AOpenClient.htm O8 - Extra context menu item: Otwórz klienta na monitorze &2 - C:\WINDOWS\web\AOpenClient.htm O9 - Extra button: Wyślij do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra 'Tools' menuitem: Wyślij &do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra button: BitComet Search - {461CC20B-FB6E-4f16-8FE8-C29359DB100E} - C:\Program Files\BitComet\tools\BitCometBHO_1.1.9.24.dll O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: ING Bank Online - https://ssl.bsk.com.pl/bskonl/component/INGOnl.cab O16 - DPF: {68282C51-9459-467B-95BF-3C0E89627E55} (MksSkanerOnline Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab O16 - DPF: {92ECE6FA-AC2E-4042-BFAE-0C8608E52A43} (SignActivX Control) - https://www.bph.pl/pi/components/SignActivX.cab O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: AntiVir PersonalEdition Premium MailGuard (AntiVirMailService) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Premium\avmailc.exe O23 - Service: AntiVir PersonalEdition Premium Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Premium\sched.exe O23 - Service: AntiVir PersonalEdition Premium Guard (AntiVirService) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Premium\avguard.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: AntiVir PersonalEdition Premium MailGuard helper service (AVEService) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Premium\avesvc.exe O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\system32\drivers\CDAC11BA.EXE O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe -- End of file - 8491 bytes

**Posty:** 18165 · przez **wojtas** 16 Gru 2007, 00:58

Start>uruchom>msconfig>zakladka uruchamianie> wylacz programy które nie chcesz żeby startowaly z systemem przyspieszy Ci to wlaczanie kompa

juz nie masz wirusow

**Posty:** 14 · przez **tomilek** 16 Gru 2007, 01:04

Niestety nie jest OK

Nie mam paska dolnego z menu, nie mogę dalej kopiować, nie mam neta, itp. Wygląd przeglądarek jest jak w win 98.

Pomocy

**Posty:** 1290 · przez **Xfire** 16 Gru 2007, 01:17

a jak wyłączysz avire to dalej nie masz neta :?:

**Posty:** 14 · przez **tomilek** 16 Gru 2007, 01:21

Nie mam neta, bo system nie może połączyć się z kartą sieciową (taki mam komunikat jak chcę dodać połączenie sieciowe, które mi wykasowało) więc to raczej nie jest wina programu antyvir

[ Dodano: Dzisiaj o 11:24 ]
Wrzucam nowe logi:

SDFIX:

Kod: Zaznacz wszystko: SDFix: Version 1.118 Run by Administrator on 2007-12-16 at 10:46 Microsoft Windows XP [Wersja 5.1.2600] Running From: C:\SDFix Safe Mode: Checking Services: Restoring Windows Registry Values Restoring Windows Default Hosts File Rebooting... Normal Mode: Checking Files: No Trojan Files Found Removing Temp Files... ADS Check: C:\WINDOWS No streams found. C:\WINDOWS\system32 No streams found. C:\WINDOWS\system32\svchost.exe No streams found. C:\WINDOWS\system32\ntoskrnl.exe No streams found. Final Check: catchme 0.3.1262.1 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-12-16 10:52:18 Windows 5.1.2600 Dodatek Service Pack 2 FAT NTAPI scanning hidden processes ... scanning hidden services ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden processes: 0 hidden services: 0 hidden files: 0 Remaining Services: ------------------ Authorized Application Key Export: [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list] Remaining Files: --------------- Files with Hidden Attributes: Wed 22 Dec 2004 76,568 ..SHR --- "C:\Program Files\Autodesk\Autodesk DWF Viewer\Setup.exe" Thu 13 Jan 2005 11,360 A.SHR --- "C:\Program Files\Autodesk\Autodesk DWF Viewer\_Setupx.dll" Thu 23 Jan 2003 65,952 ..SHR --- "C:\Program Files\Autodesk\Autodesk Express Viewer\Setup.exe" Finished!

COMBOFIX:

Kod: Zaznacz wszystko: ComboFix 07-12-15.5 - tomilek 2007-12-16 10:41:31.6 - [color=red][b]FAT32[/b][/color]x86 Running from: M:\ComboFix.exe . ((((((((((((((((((((((((( Files Created from 2007-11-16 to 2007-12-16 ))))))))))))))))))))))))))))))) . 2007-12-15 22:57 . 2007-06-16 19:25 <DIR> d--h----- C:\Documents and Settings\Administrator.JESIENNA.000\Ustawienia lokalne 2007-12-15 22:57 . 2007-06-16 19:25 <DIR> d-------- C:\Documents and Settings\Administrator.JESIENNA.000\Ulubione 2007-12-15 22:57 . 2007-06-16 19:25 <DIR> d--h----- C:\Documents and Settings\Administrator.JESIENNA.000\Szablony 2007-12-15 22:57 . 2007-06-16 19:25 <DIR> d-------- C:\Documents and Settings\Administrator.JESIENNA.000\Pulpit 2007-12-15 22:57 . 2007-06-16 19:25 <DIR> d-------- C:\Documents and Settings\Administrator.JESIENNA.000\Moje dokumenty 2007-12-15 22:57 . 2007-06-16 19:25 <DIR> dr------- C:\Documents and Settings\Administrator.JESIENNA.000\Menu Start 2007-12-15 22:57 . 2007-06-16 19:25 <DIR> dr-h----- C:\Documents and Settings\Administrator.JESIENNA.000\Dane aplikacji 2007-12-15 21:32 . 2007-12-15 21:32 <DIR> d-------- C:\WINDOWS\ERUNT 2007-12-15 19:57 . 2007-12-15 19:57 <DIR> d--h----- C:\WINDOWS\system32\GroupPolicy 2007-12-15 18:01 . 2000-06-18 14:03 106,544 --a------ C:\WINDOWS\system32\TWEAKUI.CPL 2007-12-15 15:51 . 2007-06-16 19:25 <DIR> d--h----- C:\Documents and Settings\Administrator.JESIENNA\Ustawienia lokalne 2007-12-15 15:51 . 2007-06-16 19:25 <DIR> d-------- C:\Documents and Settings\Administrator.JESIENNA\Ulubione 2007-12-15 15:51 . 2007-06-16 19:25 <DIR> d--h----- C:\Documents and Settings\Administrator.JESIENNA\Szablony 2007-12-15 15:51 . 2007-06-16 19:25 <DIR> d-------- C:\Documents and Settings\Administrator.JESIENNA\Pulpit 2007-12-15 15:51 . 2007-06-16 19:25 <DIR> d-------- C:\Documents and Settings\Administrator.JESIENNA\Moje dokumenty 2007-12-15 15:51 . 2007-06-16 19:25 <DIR> dr------- C:\Documents and Settings\Administrator.JESIENNA\Menu Start 2007-12-15 15:51 . 2007-06-16 19:25 <DIR> dr-h----- C:\Documents and Settings\Administrator.JESIENNA\Dane aplikacji 2007-12-15 15:47 . 2007-06-16 19:25 <DIR> d--h----- C:\Documents and Settings\Administrator\Ustawienia lokalne 2007-12-15 15:47 . 2007-06-16 19:25 <DIR> d-------- C:\Documents and Settings\Administrator\Ulubione 2007-12-15 15:47 . 2007-06-16 19:25 <DIR> d--h----- C:\Documents and Settings\Administrator\Szablony 2007-12-15 15:47 . 2007-06-16 19:25 <DIR> d-------- C:\Documents and Settings\Administrator\Pulpit 2007-12-15 15:47 . 2007-06-16 19:25 <DIR> d-------- C:\Documents and Settings\Administrator\Moje dokumenty 2007-12-15 15:47 . 2007-06-16 19:25 <DIR> dr------- C:\Documents and Settings\Administrator\Menu Start 2007-12-15 15:47 . 2007-06-16 19:25 <DIR> dr-h----- C:\Documents and Settings\Administrator\Dane aplikacji 2007-12-10 19:38 . 2007-12-10 19:38 <DIR> d-------- C:\Program Files\Witcobber 2007-12-08 15:12 . 2007-12-08 15:12 <DIR> d-------- C:\Documents and Settings\tomilek\Dane aplikacji\GARMIN 2007-12-08 09:44 . 2007-12-08 09:44 <DIR> d-------- C:\Garmin 2007-12-08 09:44 . 2007-01-17 09:07 17,536 --a------ C:\WINDOWS\system32\drivers\grmn0200.sys 2007-12-08 09:44 . 2007-01-17 09:07 17,024 --a------ C:\WINDOWS\system32\drivers\grmngen.sys 2007-12-08 09:44 . 2007-01-17 09:07 16,512 --a------ C:\WINDOWS\system32\drivers\grmn0400.sys 2007-12-08 09:44 . 2007-01-17 09:07 11,776 --a------ C:\WINDOWS\system32\drivers\grmn1200.sys 2007-12-08 09:44 . 2007-01-17 09:07 7,296 --a------ C:\WINDOWS\system32\drivers\grmnusb.sys 2007-12-05 19:59 . 2007-12-05 19:59 <DIR> d-------- C:\VIDEO_OUTPUT 2007-12-05 19:56 . 2007-12-05 19:56 <DIR> d-------- C:\Program Files\Allok AVI to DVD SVCD VCD Converter 2007-12-05 19:56 . 2005-08-31 14:12 401,408 --a------ C:\WINDOWS\system32\MPEGWriteFilter.dll 2007-12-05 19:56 . 2005-08-31 14:04 135,168 --a------ C:\WINDOWS\system32\DVDEncoder.dll 2007-12-05 19:56 . 2005-08-31 14:09 81,920 --a------ C:\WINDOWS\system32\MPEGFilter.dll 2007-12-01 14:37 . 2007-12-01 14:37 <DIR> d-------- C:\Program Files\Super DVD Ripper 2007-12-01 14:37 . 2007-12-05 10:10 4 --a------ C:\WINDOWS\system32\micr0st.dll 2007-12-01 14:26 . 2007-12-01 14:26 <DIR> d-------- C:\Program Files\Avi2Dvd 2007-12-01 14:20 . 2007-12-01 14:20 <DIR> d-------- C:\Program Files\RADVideo 2007-12-01 14:01 . 2007-12-01 14:01 <DIR> d-------- C:\Program Files\Gabest 2007-12-01 14:01 . 2007-12-01 14:01 <DIR> d-------- C:\Program Files\AviSynth 2.5 2007-12-01 12:16 . 2007-12-01 12:16 <DIR> d-------- C:\Program Files\GRETECH 2007-12-01 09:39 . 2007-12-01 09:40 113,296 --a------ C:\WINDOWS\system32\GDIPFONTCACHEV1.DAT 2007-11-30 18:35 . 2007-11-30 18:35 <DIR> d-------- C:\Program Files\RealMedia 2007-11-30 18:35 . 2007-11-30 18:35 <DIR> d-------- C:\Program Files\DScaler5 2007-11-30 18:35 . 2007-11-30 18:35 <DIR> d-------- C:\Program Files\CD Audio Reader Filter 2007-11-30 18:34 . 2007-11-30 18:34 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\SongbirdVLC 2007-11-30 18:33 . 2007-11-30 18:33 <DIR> d-------- C:\Program Files\ffdshow 2007-11-30 18:33 . 2007-11-30 18:33 <DIR> d-------- C:\Program Files\DS-MP3 Source 2007-11-30 18:33 . 2007-11-30 18:33 <DIR> d-------- C:\Documents and Settings\tomilek\Dane aplikacji\Songbird1 2007-11-30 18:32 . 2007-11-30 18:32 <DIR> d-------- C:\Program Files\DirectVobSub 2007-11-30 18:28 . 2007-11-30 18:28 67 --a------ C:\WINDOWS\VplayerINI.vpl 2007-11-30 18:27 . 2007-11-30 18:28 972 --a------ C:\WINDOWS\VPlayer.INI 2007-11-30 09:53 . 2007-11-30 09:53 <DIR> d-------- C:\Program Files\Common Files\AVSMedia 2007-11-30 09:53 . 2007-11-30 09:53 <DIR> d-------- C:\Program Files\AVSMedia 2007-11-30 09:53 . 2003-05-22 00:50 1,700,352 --a------ C:\WINDOWS\system32\GdiPlus.dll 2007-11-30 09:53 . 2002-01-05 16:48 974,848 --a------ C:\WINDOWS\system32\mfc70.dll 2007-11-30 09:53 . 2002-01-05 15:40 487,424 --a------ C:\WINDOWS\system32\msvcp70.dll 2007-11-30 09:53 . 2002-08-20 01:41 413,760 --a------ C:\WINDOWS\system32\mpg4c32.dll 2007-11-30 09:53 . 2003-05-22 00:50 261,632 --a------ C:\WINDOWS\system32\mcdvd_32.dll 2007-11-30 09:53 . 2003-05-22 00:50 156,910 --a------ C:\WINDOWS\WMSysPr8.prx 2007-11-30 09:53 . 2003-05-22 00:50 82,944 --a------ C:\WINDOWS\system32\vct3216.acm 2007-11-30 09:53 . 2003-05-22 00:50 38,912 --a------ C:\WINDOWS\system32\alf2cd.acm 2007-11-30 09:53 . 2003-05-21 13:50 24,576 --a------ C:\WINDOWS\system32\msxml3a.dll 2007-11-30 09:53 . 2000-03-14 21:55 13,239 --a------ C:\WINDOWS\system32\Scg726.acm 2007-11-30 09:21 . 2007-11-30 09:21 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\ESTsoft 2007-11-30 09:20 . 2007-11-30 09:20 <DIR> d-------- C:\Documents and Settings\tomilek\Dane aplikacji\ESTSoft 2007-11-28 22:16 . 2007-11-28 22:16 <DIR> d-------- C:\Program Files\vanBasco's Karaoke Player 2007-11-24 23:13 . 2007-11-24 23:13 892,928 --a------ C:\WINDOWS\system32\iconv.dll . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2007-11-24 22:13 740,442 ----a-w C:\WINDOWS\system32\DivX.dll 2007-11-15 13:35 --------- d-----w C:\Documents and Settings\tomilek\Dane aplikacji\Mikrotik 2007-11-10 14:54 --------- d-----w C:\Program Files\MagicDisc 2007-11-05 13:23 --------- d-----w C:\Documents and Settings\tomilek\Dane aplikacji\Azureus 2007-11-05 13:23 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Azureus 2007-11-05 13:20 --------- d-----w C:\Program Files\Azureus 2007-10-29 18:56 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Nokia 2007-10-28 21:46 245,760 ----a-w C:\WINDOWS\system32\mplvpx.dll 2007-10-28 21:45 9,216 ----a-w C:\WINDOWS\system32\cpuinf32.dll 2007-10-16 19:27 --------- d-----w C:\Documents and Settings\tomilek\Dane aplikacji\Talkback 2007-10-08 10:04 729,088 ----a-w C:\WINDOWS\iun6002.exe 2007-06-19 07:16 84,418 ----a-w C:\Documents and Settings\All Users\Dane aplikacji\mainlsp.reg.dat 2007-06-17 11:04 84,418 ----a-w C:\Documents and Settings\All Users\Dane aplikacji\firstlsp.reg.dat . ((((((((((((((((((((((((((((( snapshot@2007-12-15_17.15.37.70 ))))))))))))))))))))))))))))))))))))))))) . + 2007-03-13 09:57:12 163,328 ----a-w C:\WINDOWS\erdnt\subs\F3M\ERDNT.EXE + 2007-12-13 12:23:36 163,328 ----a-w C:\WINDOWS\ERUNT\SDFIX\ERDNT.EXE + 2007-12-15 21:59:58 385,024 ----a-w C:\WINDOWS\ERUNT\SDFIX\Users\[u]0[/u]0000001\NTUSER.DAT + 2007-12-15 22:00:00 8,192 ----a-w C:\WINDOWS\ERUNT\SDFIX\Users\[u]0[/u]0000002\UsrClass.dat + 2007-12-13 12:23:36 163,328 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\ERDNT.EXE + 2007-12-15 20:32:12 7,749,632 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\Users\[u]0[/u]0000001\ntuser.dat + 2007-12-15 20:32:12 114,688 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\Users\[u]0[/u]0000002\UsrClass.dat . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\AutoCAD Digital Signatures Icon Overlay Handler] @={36A21736-36C2-4C11-8ACB-D4136F2B57BD} [HKEY_CLASSES_ROOT\CLSID\{36A21736-36C2-4C11-8ACB-D4136F2B57BD}] 2003-02-14 11:31 136352 --a------ C:\WINDOWS\system32\AcSignIcon.dll [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Gadu-Gadu"="C:\Program Files\Gadu-Gadu\gg.exe" [2007-05-10 16:36] "Skype"="C:\Program Files\Skype\Phone\Skype.exe" [2007-09-13 13:31] "PcSync"="C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2007-06-19 10:17] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:44] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Smapp"="C:\Program Files\Analog Devices\SoundMAX\Smtray.exe" [2002-06-26 17:36] "StatusClient"="C:\Program Files\Hewlett-Packard\Toolbox2.0\Apache Tomcat 4.0\webapps\Toolbox\StatusClient\StatusClient.exe" [2002-12-16 16:51] "TomcatStartup"="C:\Program Files\Hewlett-Packard\Toolbox2.0\hpbpsttp.exe" [2003-03-31 19:28] "avgnt"="C:\Program Files\AntiVir PersonalEdition Premium\avgnt.exe" [2007-10-12 08:25] "GrooveMonitor"="C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-27 00:47] "NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 11:50] "LXSUPMON"="C:\WINDOWS\system32\LXSUPMON.exe" [2002-08-15 12:26] "HydraVisionDesktopManager"="C:\Program Files\ATI Technologies\ATI HYDRAVISION\HydraDM.exe" [2003-09-15 21:00] "HydraVisionViewport"="C:\Program Files\ATI Technologies\ATI HYDRAVISION\HydraMD.exe" [2003-09-15 21:00] "NSLauncher"="C:\Program Files\Nokia\Nokia Software Launcher\NSLauncher.exe" [2006-11-28 01:12] "PCSuiteTrayApplication"="C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe" [2007-06-18 15:10] "ATICCC"="C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" [2005-08-12 14:43] "HPWO_MPM_Agent"="C:\Program Files\HP\HP Officejet Pro K850 Series\Toolbox\mpm.exe" [2006-11-03 15:01] "HPWOTOOLBOX"="C:\Program Files\HP\HP Officejet Pro K850 Series\Toolbox\HPWOTBX.exe" [2006-11-03 15:01] "Tweak UI"="RUNDLL32.exe" [2004-08-04 00:44 C:\WINDOWS\system32\rundll32.exe] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-08-04 00:44] "Nokia.PCSync"="C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2007-06-19 10:17] . ************************************************************************** catchme 0.3.1333 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-12-16 10:42:57 Windows 5.1.2600 Dodatek Service Pack 2 FAT NTAPI scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2007-12-16 10:43:24 C:\ComboFix2.txt ... 2007-12-15 23:53 C:\ComboFix3.txt ... 2007-12-15 23:21

HIJACK:

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 10:40:48, on 2007-12-16 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\Program Files\AntiVir PersonalEdition Premium\sched.exe C:\Program Files\AntiVir PersonalEdition Premium\avguard.exe C:\Program Files\AntiVir PersonalEdition Premium\avesvc.exe C:\WINDOWS\system32\drivers\CDAC11BA.EXE C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Analog Devices\SoundMAX\Smtray.exe C:\Program Files\Hewlett-Packard\Toolbox2.0\Apache Tomcat 4.0\webapps\Toolbox\StatusClient\StatusClient.exe C:\Program Files\AntiVir PersonalEdition Premium\avgnt.exe C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe C:\WINDOWS\system32\LXSUPMON.EXE C:\Program Files\ATI Technologies\ATI HYDRAVISION\HydraDM.exe C:\Program Files\ATI Technologies\ATI HYDRAVISION\HydraMD.exe C:\Program Files\Nokia\Nokia Software Launcher\NSLauncher.exe C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe C:\Program Files\Hewlett-Packard\Toolbox2.0\Javasoft\JRE\1.3.1\bin\javaw.exe C:\Program Files\ATI Technologies\ATI.ACE\cli.exe C:\Program Files\Gadu-Gadu\gg.exe C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe C:\WINDOWS\system32\notepad.exe C:\WINDOWS\system32\NOTEPAD.EXE M:\HiJackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.onet.pl/ R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.1.9.24.dll O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL O4 - HKLM\..\Run: [Smapp] C:\Program Files\Analog Devices\SoundMAX\Smtray.exe O4 - HKLM\..\Run: [StatusClient] C:\Program Files\Hewlett-Packard\Toolbox2.0\Apache Tomcat 4.0\webapps\Toolbox\StatusClient\StatusClient.exe /auto O4 - HKLM\..\Run: [TomcatStartup] C:\Program Files\Hewlett-Packard\Toolbox2.0\hpbpsttp.exe O4 - HKLM\..\Run: [avgnt] "C:\Program Files\AntiVir PersonalEdition Premium\avgnt.exe" /min O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [LXSUPMON] C:\WINDOWS\system32\LXSUPMON.EXE RUN O4 - HKLM\..\Run: [HydraVisionDesktopManager] C:\Program Files\ATI Technologies\ATI HYDRAVISION\HydraDM.exe O4 - HKLM\..\Run: [HydraVisionViewport] C:\Program Files\ATI Technologies\ATI HYDRAVISION\HydraMD.exe O4 - HKLM\..\Run: [NSLauncher] C:\Program Files\Nokia\Nokia Software Launcher\NSLauncher.exe /startup O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -startup O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay O4 - HKLM\..\Run: [HPWO_MPM_Agent] C:\Program Files\HP\HP Officejet Pro K850 Series\Toolbox\mpm.exe O4 - HKLM\..\Run: [HPWOTOOLBOX] C:\Program Files\HP\HP Officejet Pro K850 Series\Toolbox\HPWOTBX.exe "-i" O4 - HKLM\..\Run: [Tweak UI] RUNDLL32.EXE TWEAKUI.CPL,TweakMeUp O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized O4 - HKCU\..\Run: [PcSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKUS\S-1-5-21-1229272821-1957994488-725345543-1003\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray (User '?') O4 - HKUS\S-1-5-21-1229272821-1957994488-725345543-1003\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized (User '?') O4 - HKUS\S-1-5-21-1229272821-1957994488-725345543-1003\..\Run: [PcSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog (User '?') O4 - HKUS\S-1-5-21-1229272821-1957994488-725345543-1003\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe (User '?') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User '?') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user') O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O4 - Global Startup: Microsoft Works Calendar Reminders.lnk = ? O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm O8 - Extra context menu item: E&ksportuj do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000 O8 - Extra context menu item: Otwórz klienta na monitorze &1 - C:\WINDOWS\web\AOpenClient.htm O8 - Extra context menu item: Otwórz klienta na monitorze &2 - C:\WINDOWS\web\AOpenClient.htm O9 - Extra button: Wyślij do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra 'Tools' menuitem: Wyślij &do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra button: BitComet Search - {461CC20B-FB6E-4f16-8FE8-C29359DB100E} - C:\Program Files\BitComet\tools\BitCometBHO_1.1.9.24.dll O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: ING Bank Online - https://ssl.bsk.com.pl/bskonl/component/INGOnl.cab O16 - DPF: {68282C51-9459-467B-95BF-3C0E89627E55} (MksSkanerOnline Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab O16 - DPF: {92ECE6FA-AC2E-4042-BFAE-0C8608E52A43} (SignActivX Control) - https://www.bph.pl/pi/components/SignActivX.cab O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: AntiVir PersonalEdition Premium MailGuard (AntiVirMailService) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Premium\avmailc.exe O23 - Service: AntiVir PersonalEdition Premium Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Premium\sched.exe O23 - Service: AntiVir PersonalEdition Premium Guard (AntiVirService) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Premium\avguard.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: AntiVir PersonalEdition Premium MailGuard helper service (AVEService) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Premium\avesvc.exe O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\system32\drivers\CDAC11BA.EXE O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe -- End of file - 8592 bytes

**Posty:** 3854 · przez **Dzi@dek** 16 Gru 2007, 12:35

Czy w menadżerze urządzeń nie masz jakiegoś znaku zapytania przy sieciówce :?:

prośba o pomoc z komputerem [log]

Prośba o pomoc z komputerem [log]

Kto jest na forum