prosba o sprawdzenie loga...

**Posty:** 177 · przez **Zenek*Pereszczaka** 17 Maj 2007, 10:10

od paru dni nie za kazdym uruchomieniem komputera ale czesto wyskakuje mi taki komunikat:

a oto log:

Kod: Zaznacz wszystko: Logfile of HijackThis v1.99.1 Scan saved at 09:46:24, on 2007-05-17 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe C:\PROGRA~1\Grisoft\AVG7\avgemc.exe C:\WINDOWS\System32\nvsvc32.exe C:\WINDOWS\SOUNDMAN.EXE D:\Program Files\HP\HP Software Update\HPWuSchd2.exe C:\WINDOWS\system32\RUNDLL32.EXE C:\Program Files\GameDeviceDriver\RFPIcon.exe D:\PROGRA~1\A4Tech\Mouse\Amoumain.exe D:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe D:\Program Files\DAEMON Tools\daemon.exe C:\WINDOWS\System32\svchost.exe C:\PROGRA~1\Grisoft\AVG7\avgcc.exe C:\WINDOWS\system32\ctfmon.exe D:\Program Files\AutoConnect\AutoConnect.exe D:\Program Files\Gadu-Gadu\gg.exe C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe D:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe C:\WINDOWS\system32\WgaTray.exe D:\Program Files\ivo\UniSpiker-2.6\uni_spiker-2.6.exe C:\WINDOWS\system32\wscntfy.exe D:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe D:\Program Files\Mozilla Firefox\firefox.exe C:\Documents and Settings\Piotrek\Pulpit\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza R3 - URLSearchHook: (no name) - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - (no file) O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Program Files\Adobe\Acrobat 6.0 CE\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL O2 - BHO: (no name) - {5142FE17-20E6-4121-A925-A4C6385CDDAA} - (no file) O2 - BHO: (no name) - {89395594-0331-455D-AE2A-4B5A1EB33BD0} - C:\WINDOWS\system32\vtuvurs.dll O2 - BHO: IeCatch2 Class - {A5366673-E8CA-11D3-9CD9-0090271D075B} - D:\PROGRA~1\FlashGet\Jccatch.dll O2 - BHO: (no name) - {D651AFF4-9590-424d-BD1E-8E33E090DFB3} - C:\WINDOWS\system32\aoowyixb.dll O3 - Toolbar: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [HP Software Update] D:\Program Files\HP\HP Software Update\HPWuSchd2.exe O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [RTBatteryMeter] C:\Program Files\GameDeviceDriver\RFPIcon.exe O4 - HKLM\..\Run: [WheelMouse] D:\PROGRA~1\A4Tech\Mouse\Amoumain.exe O4 - HKLM\..\Run: [DAEMON Tools] "D:\Program Files\DAEMON Tools\daemon.exe" -lang 1033 O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [01234567890123456789] C:\Program Files\user32.exe O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [AutoConnect] D:\Program Files\AutoConnect\AutoConnect.exe O4 - HKCU\..\Run: [Gadu-Gadu] "D:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - Startup: UniSpiker-2.6.lnk = ? O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe O4 - Global Startup: HP Digital Imaging Monitor.lnk = D:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE O8 - Extra context menu item: Download All by FlashGet - D:\Program Files\FlashGet\jc_all.htm O8 - Extra context menu item: Download using FlashGet - D:\Program Files\FlashGet\jc_link.htm O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {92ECE6FA-AC2E-4042-BFAE-0C8608E52A43} (SignActivX Control) - https://www.bph.pl/sezam/components/SignActivX.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{F3BB85FB-0951-47E1-A9E5-8FD1919BDAC0}: NameServer = 194.204.152.34 217.98.63.164 O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O20 - Winlogon Notify: vtuvurs - C:\WINDOWS\SYSTEM32\vtuvurs.dll O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll O20 - Winlogon Notify: wintuh32 - wintuh32.dll (file missing) O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - D:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe

**Posty:** 8694 · przez **Red** 17 Maj 2007, 10:18

masz vundo...zastosuj koniecznie i kilka razy te fixy:

http://www.atribune.org/downloads/VundoFix.exe

http://securityresponse.symantec.com/avcenter/FixVundo.exe

http://secured2k.home.comcast.net/tools/VirtumundoBeGone.exe

http://www.f-secure.com/tools/f-vmonde.zip

i wklej raz jeszcze log

**Posty:** 177 · przez **Zenek*Pereszczaka** 17 Maj 2007, 17:09

Zrobiłem ja mowiłes oto log:

Kod: Zaznacz wszystko: Logfile of HijackThis v1.99.1 Scan saved at 16:52:26, on 2007-05-17 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe C:\PROGRA~1\Grisoft\AVG7\avgemc.exe C:\WINDOWS\System32\nvsvc32.exe D:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\system32\WgaTray.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\SOUNDMAN.EXE D:\Program Files\HP\HP Software Update\HPWuSchd2.exe C:\WINDOWS\system32\RUNDLL32.EXE C:\Program Files\GameDeviceDriver\RFPIcon.exe D:\PROGRA~1\A4Tech\Mouse\Amoumain.exe D:\Program Files\DAEMON Tools\daemon.exe C:\PROGRA~1\Grisoft\AVG7\avgcc.exe C:\WINDOWS\system32\ctfmon.exe D:\Program Files\AutoConnect\AutoConnect.exe D:\Program Files\Gadu-Gadu\gg.exe C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe D:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe D:\Program Files\ivo\UniSpiker-2.6\uni_spiker-2.6.exe D:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe D:\Program Files\Mozilla Firefox\firefox.exe C:\Documents and Settings\Piotrek\Pulpit\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.tlen.pl/ R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza R3 - URLSearchHook: (no name) - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - (no file) O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Program Files\Adobe\Acrobat 6.0 CE\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL O2 - BHO: (no name) - {5142FE17-20E6-4121-A925-A4C6385CDDAA} - (no file) O2 - BHO: IeCatch2 Class - {A5366673-E8CA-11D3-9CD9-0090271D075B} - D:\PROGRA~1\FlashGet\Jccatch.dll O2 - BHO: (no name) - {D651AFF4-9590-424d-BD1E-8E33E090DFB3} - C:\WINDOWS\system32\aoowyixb.dll O3 - Toolbar: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [HP Software Update] D:\Program Files\HP\HP Software Update\HPWuSchd2.exe O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [RTBatteryMeter] C:\Program Files\GameDeviceDriver\RFPIcon.exe O4 - HKLM\..\Run: [WheelMouse] D:\PROGRA~1\A4Tech\Mouse\Amoumain.exe O4 - HKLM\..\Run: [DAEMON Tools] "D:\Program Files\DAEMON Tools\daemon.exe" -lang 1033 O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678912345678] C:\Program Files\user32.exe O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [AutoConnect] D:\Program Files\AutoConnect\AutoConnect.exe O4 - HKCU\..\Run: [Gadu-Gadu] "D:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - Startup: UniSpiker-2.6.lnk = ? O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe O4 - Global Startup: HP Digital Imaging Monitor.lnk = D:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE O8 - Extra context menu item: Download All by FlashGet - D:\Program Files\FlashGet\jc_all.htm O8 - Extra context menu item: Download using FlashGet - D:\Program Files\FlashGet\jc_link.htm O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {92ECE6FA-AC2E-4042-BFAE-0C8608E52A43} (SignActivX Control) - https://www.bph.pl/sezam/components/SignActivX.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{F3BB85FB-0951-47E1-A9E5-8FD1919BDAC0}: NameServer = 194.204.152.34 217.98.63.164 O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll O20 - Winlogon Notify: wintuh32 - wintuh32.dll (file missing) O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - D:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe

**Posty:** 18165 · przez **wojtas** 17 Maj 2007, 18:06

Użyj WWDC :
http://www.firewallleaktester.com/wwdc.htm
Zmień opcje z disable na enable. Uruchom ponownie komputer.
Tak powinny wyglądać porty (NetBIOS może być żółty) :
http://www.firewallleaktester.com/images_site/wwdc.jpg

Wyłącz przywracanie systemu ( właściwości mój komputer-zakładka przywracanie - wyłącz przywracanie na wszystkich dyskach)
Start do awaryjnego ( F8 ) przy starcie komputera.

R3 - URLSearchHook: (no name) - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - (no file)
O2 - BHO: (no name) - {5142FE17-20E6-4121-A925-A4C6385CDDAA} - (no file)
O2 - BHO: (no name) - {D651AFF4-9590-424d-BD1E-8E33E090DFB3} - C:\WINDOWS\system32\aoowyixb.dll
O4 - HKLM\..\Run: [012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678912345678] C:\Program Files\user32.exe
O20 - Winlogon Notify: wintuh32 - wintuh32.dll (file missing)

Odpalasz hijackthis i zaznaczasz ptaszkami powyższe wpisy i dajesz Fix checked.
Pogrubione pliki usuwasz ręcznie z dysku
potem nowe logi z Hijack This oraz Silent runners

**Posty:** 177 · przez **Zenek*Pereszczaka** 17 Maj 2007, 21:38

oto logi po wykonaniu wszystkich czynnosci:

Kod: Zaznacz wszystko: Logfile of HijackThis v1.99.1 Scan saved at 21:18:01, on 2007-05-17 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\SOUNDMAN.EXE D:\Program Files\HP\HP Software Update\HPWuSchd2.exe C:\WINDOWS\system32\RUNDLL32.EXE C:\Program Files\GameDeviceDriver\RFPIcon.exe D:\PROGRA~1\A4Tech\Mouse\Amoumain.exe D:\Program Files\DAEMON Tools\daemon.exe C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe C:\PROGRA~1\Grisoft\AVG7\avgcc.exe C:\PROGRA~1\Grisoft\AVG7\avgemc.exe C:\WINDOWS\system32\ctfmon.exe D:\Program Files\AutoConnect\AutoConnect.exe C:\WINDOWS\System32\nvsvc32.exe C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe D:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe D:\Program Files\ivo\UniSpiker-2.6\uni_spiker-2.6.exe D:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\wscntfy.exe D:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe C:\WINDOWS\system32\WgaTray.exe C:\WINDOWS\system32\wuauclt.exe D:\Program Files\Mozilla Firefox\firefox.exe C:\Documents and Settings\Piotrek\Pulpit\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.tlen.pl/ R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Program Files\Adobe\Acrobat 6.0 CE\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL O2 - BHO: IeCatch2 Class - {A5366673-E8CA-11D3-9CD9-0090271D075B} - D:\PROGRA~1\FlashGet\Jccatch.dll O3 - Toolbar: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [HP Software Update] D:\Program Files\HP\HP Software Update\HPWuSchd2.exe O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [RTBatteryMeter] C:\Program Files\GameDeviceDriver\RFPIcon.exe O4 - HKLM\..\Run: [WheelMouse] D:\PROGRA~1\A4Tech\Mouse\Amoumain.exe O4 - HKLM\..\Run: [DAEMON Tools] "D:\Program Files\DAEMON Tools\daemon.exe" -lang 1033 O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [AutoConnect] D:\Program Files\AutoConnect\AutoConnect.exe O4 - HKCU\..\Run: [Gadu-Gadu] "D:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - Startup: UniSpiker-2.6.lnk = ? O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe O4 - Global Startup: HP Digital Imaging Monitor.lnk = D:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE O8 - Extra context menu item: Download All by FlashGet - D:\Program Files\FlashGet\jc_all.htm O8 - Extra context menu item: Download using FlashGet - D:\Program Files\FlashGet\jc_link.htm O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {92ECE6FA-AC2E-4042-BFAE-0C8608E52A43} (SignActivX Control) - https://www.bph.pl/sezam/components/SignActivX.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{F3BB85FB-0951-47E1-A9E5-8FD1919BDAC0}: NameServer = 194.204.152.34 217.98.63.164 O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - D:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe "Silent Runners.vbs", revision R50, http://www.silentrunners.org/ Operating System: Windows XP SP2 Output limited to non-default values, except where indicated by "{++}" Startup items buried in registry: --------------------------------- HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ {++} "CTFMON.EXE" = "C:\WINDOWS\system32\ctfmon.exe" [MS] "AutoConnect" = "D:\Program Files\AutoConnect\AutoConnect.exe" ["http://autoconnect.prv.pl"] "Gadu-Gadu" = ""D:\Program Files\Gadu-Gadu\gg.exe" /tray" ["Gadu-Gadu S.A."] HKLM\Software\Microsoft\Windows\CurrentVersion\Run\ {++} "NvCplDaemon" = "RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup" [MS] "nwiz" = "nwiz.exe /install" ["NVIDIA Corporation"] "SoundMan" = "SOUNDMAN.EXE" ["Realtek Semiconductor Corp."] "HP Software Update" = "D:\Program Files\HP\HP Software Update\HPWuSchd2.exe" ["Hewlett-Packard Development Company, L.P."] "NvMediaCenter" = "RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit" [MS] "RTBatteryMeter" = "C:\Program Files\GameDeviceDriver\RFPIcon.exe" ["Ruling Tec Pte Ltd"] "WheelMouse" = "D:\PROGRA~1\A4Tech\Mouse\Amoumain.exe" ["A4Tech Co., Ltd."] "DAEMON Tools" = ""D:\Program Files\DAEMON Tools\daemon.exe" -lang 1033" ["DT Soft Ltd."] "NeroFilterCheck" = "C:\WINDOWS\system32\NeroCheck.exe" ["Ahead Software Gmbh"] "AVG7_CC" = "C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP" ["GRISOFT, s.r.o."] HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\(Default) = (no title provided) -> {HKLM...CLSID} = "AcroIEHlprObj Class" \InProcServer32\(Default) = "D:\Program Files\Adobe\Acrobat 6.0 CE\Reader\ActiveX\AcroIEHelper.dll" ["Adobe Systems Incorporated"] {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C}\(Default) = (no title provided) -> {HKLM...CLSID} = "Megaupload Toolbar" \InProcServer32\(Default) = "C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL" ["MegaUpload"] {A5366673-E8CA-11D3-9CD9-0090271D075B}\(Default) = (no title provided) -> {HKLM...CLSID} = "IeCatch2 Class" \InProcServer32\(Default) = "D:\PROGRA~1\FlashGet\Jccatch.dll" ["Amaze Soft"] HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\ "{42071714-76d4-11d1-8b24-00a0c9068ff3}" = "Rozszerzenie CPL kadrowania wyświetlania" -> {HKLM...CLSID} = "Rozszerzenie CPL kadrowania wyświetlania" \InProcServer32\(Default) = "deskpan.dll" [file not found] "{88895560-9AA2-1069-930E-00AA0030EBC8}" = "Rozszerzenie ikony HyperTerminalu" -> {HKLM...CLSID} = "HyperTerminal Icon Ext" \InProcServer32\(Default) = "C:\WINDOWS\System32\hticons.dll" ["Hilgraeve, Inc."] "{A70C977A-BF00-412C-90B7-034C51DA2439}" = "NvCpl DesktopContext Class" -> {HKLM...CLSID} = "DesktopContext Class" \InProcServer32\(Default) = "C:\WINDOWS\System32\nvcpl.dll" ["NVIDIA Corporation"] "{1CDB2949-8F65-4355-8456-263E7C208A5D}" = "Desktop Explorer" -> {HKLM...CLSID} = "Desktop Explorer" \InProcServer32\(Default) = "C:\WINDOWS\System32\nvshell.dll" ["NVIDIA Corporation"] "{1E9B04FB-F9E5-4718-997B-B8DA88302A47}" = "Desktop Explorer Menu" -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "C:\WINDOWS\System32\nvshell.dll" ["NVIDIA Corporation"] "{1E9B04FB-F9E5-4718-997B-B8DA88302A48}" = "nView Desktop Context Menu" -> {HKLM...CLSID} = "nView Desktop Context Menu" \InProcServer32\(Default) = "C:\WINDOWS\System32\nvshell.dll" ["NVIDIA Corporation"] "{FFB699E0-306A-11d3-8BD1-00104B6F7516}" = "Play on my TV helper" -> {HKLM...CLSID} = "NVIDIA CPL Extension" \InProcServer32\(Default) = "C:\WINDOWS\System32\nvcpl.dll" ["NVIDIA Corporation"] "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" = "WinRAR shell extension" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "D:\Program Files\WinRAR\rarext.dll" [null data] "{0006F045-0000-0000-C000-000000000046}" = "Microsoft Outlook Custom Icon Handler" -> {HKLM...CLSID} = "Rozszerzenie ikon plików programu Outlook" \InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\Office\OLKFSTUB.DLL" [MS] "{9F97547E-4609-42C5-AE0C-81C61FFAEBC3}" = "AVG7 Shell Extension" -> {HKLM...CLSID} = "AVG7 Shell Extension Class" \InProcServer32\(Default) = "C:\Program Files\Grisoft\AVG7\avgse.dll" ["GRISOFT, s.r.o."] "{9F97547E-460A-42C5-AE0C-81C61FFAEBC3}" = "AVG7 Find Extension" -> {HKLM...CLSID} = "AVG7 Find Extension Class" \InProcServer32\(Default) = "C:\Program Files\Grisoft\AVG7\avgse.dll" ["GRISOFT, s.r.o."] HKLM\Software\Classes\*\shellex\ContextMenuHandlers\ AVG7 Shell Extension\(Default) = "{9F97547E-4609-42C5-AE0C-81C61FFAEBC3}" -> {HKLM...CLSID} = "AVG7 Shell Extension Class" \InProcServer32\(Default) = "C:\Program Files\Grisoft\AVG7\avgse.dll" ["GRISOFT, s.r.o."] WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "D:\Program Files\WinRAR\rarext.dll" [null data] HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\ WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "D:\Program Files\WinRAR\rarext.dll" [null data] HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\ AVG7 Shell Extension\(Default) = "{9F97547E-4609-42C5-AE0C-81C61FFAEBC3}" -> {HKLM...CLSID} = "AVG7 Shell Extension Class" \InProcServer32\(Default) = "C:\Program Files\Grisoft\AVG7\avgse.dll" ["GRISOFT, s.r.o."] FineReader8\(Default) = "{F7091C74-EBB1-49D7-94C7-FE4886CCC18D}" -> {HKLM...CLSID} = "FineReader8ExplorerContextMenuHandler" \InProcServer32\(Default) = "D:\Program Files\ABBYY FineReader 8.0 Professional Edition\FECMenu.dll" ["ABBYY Software"] WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "D:\Program Files\WinRAR\rarext.dll" [null data] Group Policies {GPedit.msc branch and setting}: ----------------------------------------------- Note: detected settings may not have any effect. HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\ "shutdownwithoutlogon" = (REG_DWORD) hex:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| Shutdown: Allow system to be shut down without having to log on} "undockwithoutlogon" = (REG_DWORD) hex:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| Devices: Allow undock without having to log on} Active Desktop and Wallpaper: ----------------------------- Active Desktop may be disabled at this entry: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState Displayed if Active Desktop enabled and wallpaper not set by Group Policy: HKCU\Software\Microsoft\Internet Explorer\Desktop\General\ "Wallpaper" = "C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp" Displayed if Active Desktop disabled and wallpaper not set by Group Policy: HKCU\Control Panel\Desktop\ "Wallpaper" = "C:\Documents and Settings\Piotrek\Dane aplikacji\Mozilla\Firefox\Tapeta pulpitu.bmp" Enabled Screen Saver: --------------------- HKCU\Control Panel\Desktop\ "SCRNSAVE.EXE" = "C:\WINDOWS\System32\logon.scr" [MS] Startup items in "Piotrek" & "All Users" startup folders: --------------------------------------------------------- C:\Documents and Settings\Piotrek\Menu Start\Programy\Autostart "UniSpiker-2.6" -> shortcut to: "D:\Program Files\ivo\UniSpiker-2.6\uni_spiker-2.6.exe" [null data] C:\Documents and Settings\All Users\Menu Start\Programy\Autostart "DSLMON" -> shortcut to: "C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe /W" [empty string] "HP Digital Imaging Monitor" -> shortcut to: "D:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe" ["Hewlett-Packard Development Company, L.P."] "Microsoft Office" -> shortcut to: "C:\Program Files\Microsoft Office\Office\OSA9.EXE -b -l" [MS] Enabled Scheduled Tasks: ------------------------ "At1" -> launches: "C:\WINDOWS\widupdate.exe" [file not found] "At10" -> launches: "C:\WINDOWS\user32.exe" [file not found] "At11" -> launches: "C:\WINDOWS\user32.exe" [file not found] "At12" -> launches: "C:\WINDOWS\dr.exe" [null data] "At2" -> launches: "C:\WINDOWS\user32.exe" [file not found] "At3" -> launches: "C:\WINDOWS\dr.exe" [null data] "At4" -> launches: "C:\WINDOWS\user32.exe" [file not found] "At5" -> launches: "C:\WINDOWS\patcher.exe" [file not found] "At6" -> launches: "C:\WINDOWS\dr.exe" [null data] "At7" -> launches: "C:\WINDOWS\patcher.exe" [file not found] "At8" -> launches: "C:\WINDOWS\widupdate.exe" [file not found] "At9" -> launches: "C:\WINDOWS\dr.exe" [null data] Winsock2 Service Provider DLLs: ------------------------------- Namespace Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++} 000000000001\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS] 000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS] 000000000003\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS] Transport Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++} 0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range: %SystemRoot%\system32\mswsock.dll [MS], 01 - 03, 06 - 17 %SystemRoot%\system32\rsvpsp.dll [MS], 04 - 05 Toolbars, Explorer Bars, Extensions: ------------------------------------ Toolbars HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\ "{4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C}" -> {HKLM...CLSID} = "Megaupload Toolbar" \InProcServer32\(Default) = "C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL" ["MegaUpload"] HKLM\Software\Microsoft\Internet Explorer\Toolbar\ "{4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C}" = (no title provided) -> {HKLM...CLSID} = "Megaupload Toolbar" \InProcServer32\(Default) = "C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL" ["MegaUpload"] Extensions (Tools menu items, main toolbar menu buttons) HKLM\Software\Microsoft\Internet Explorer\Extensions\ {FB5F1910-F110-11D2-BB9E-00C04F795683}\ "ButtonText" = "Messenger" "MenuText" = "Windows Messenger" "Exec" = "C:\Program Files\Messenger\msmsgs.exe" [MS] Running Services (Display Name, Service Name, Path {Service DLL}): ------------------------------------------------------------------ AVG E-mail Scanner, AVGEMS, "C:\PROGRA~1\Grisoft\AVG7\avgemc.exe" ["GRISOFT, s.r.o."] AVG7 Alert Manager Server, Avg7Alrt, "C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe" ["GRISOFT, s.r.o."] AVG7 Update Service, Avg7UpdSvc, "C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe" ["GRISOFT, s.r.o."] NVIDIA Display Driver Service, NVSvc, "C:\WINDOWS\System32\nvsvc32.exe" ["NVIDIA Corporation"] StarWind iSCSI Service, StarWindService, "D:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe" ["Rocket Division Software"] Print Monitors: --------------- HKLM\System\CurrentControlSet\Control\Print\Monitors\ HP Standard TCP/IP Port\Driver = "HpTcpMon.dll" ["Hewlett Packard"] LIDIL hpzll054\Driver = "hpzll054.dll" ["Hewlett-Packard Company"] ---------- + This report excludes default entries except where indicated. + To see *everywhere* the script checks and *everything* it finds, launch it from a command prompt or a shortcut with the -all parameter. + To search all directories of local fixed drives for DESKTOP.INI DLL launch points, use the -supp parameter or answer "No" at the first message box and "Yes" at the second message box. ---------- (total run time: 63 seconds, including 8 seconds for message boxes)

**Posty:** 18165 · przez **wojtas** 17 Maj 2007, 21:44

wklej do notatnika

schtasks /delete /TN At1 /F
schtasks /delete /TN At2 /F
schtasks /delete /TN At3 /F
schtasks /delete /TN At4 /F
schtasks /delete /TN At5 /F
schtasks /delete /TN At6 /F
schtasks /delete /TN At7 /F
schtasks /delete /TN At8 /F
schtasks /delete /TN At9 /F
schtasks /delete /TN At10 /F
schtasks /delete /TN At11 /F
schtasks /delete /TN At12 /F

Z menu Notatnika >>> Plik >>> Zapisz jako >>> Ustaw rozszerzenie na "Wszystkie pliki" >>> Zapisz jako FIX.BAT uruchom powstaly plik

potem usun plik:

C:\WINDOWS\dr.exe

i daj loga z silenta oraz z:

http://download.bleepingcomputer.com/sUBs/ComboFix.exe

**Posty:** 177 · przez **Zenek*Pereszczaka** 17 Maj 2007, 22:46

zrobiłem jak mowiłes oto logi:

Kod: Zaznacz wszystko: "Piotrek" - 2007-05-17 22:22:20 Dodatek Service Pack 2 ComboFix 07-05.17.6.V - Running from: "" (((((((((((((((((((((((((((((((((((((((((((((((((( V Log ))))))))))))))))))))))))))))))))))))))))))))))))))))))) C:\WINDOWS\system32\dqndvogq.dll C:\WINDOWS\system32\ghgnumci.dll C:\WINDOWS\system32\iproqhfv.dll C:\WINDOWS\system32\jkkhhhe.dll C:\WINDOWS\system32\jwhdbcjt.dll C:\WINDOWS\system32\khffcaa.dll C:\WINDOWS\system32\oshepqce.dll C:\WINDOWS\system32\qiykywwk.dll C:\WINDOWS\system32\qmnorubw.dll C:\WINDOWS\system32\rprlvpnw.dll C:\WINDOWS\system32\tuvuvvv.dll C:\WINDOWS\system32\uejntlut.dll C:\WINDOWS\system32\yayvwtq.dll C:\WINDOWS\system32\yjexnwfu.dll C:\WINDOWS\system32\wnpvlrpr.ini * * * POST RUN FILES/FOLDERS * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * (((((((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) C:\WINDOWS\system32\helper.sys ((((((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) -------\pe386 ((((((((((((((((((((((((((((((( Files Created from 2007-04-05 to 2007-05-17 )))))))))))))))))))))))))))))))))) 2007-05-16 10:45 <DIR> d-------- C:\DOCUME~1\Piotrek\DANEAP~1\ScreenSeven 2007-05-16 10:44 <DIR> d-------- C:\Program Files\BFG 2007-05-16 10:44 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\Trymedia 2007-05-15 16:10 1,040,384 --a------ C:\WINDOWS\system32\libeay32.dll 2007-05-15 16:08 196,608 --a------ C:\WINDOWS\system32\ssleay32.dll 2007-05-12 16:35 68,888 --a------ C:\WINDOWS\system32\xinput1_3.dll 2007-05-12 16:35 62,744 --a------ C:\WINDOWS\system32\xinput1_2.dll 2007-05-12 16:35 3,426,072 --a------ C:\WINDOWS\system32\d3dx9_32.dll 2007-05-12 16:35 251,672 --a------ C:\WINDOWS\system32\xactengine2_5.dll 2007-05-12 16:35 237,848 --a------ C:\WINDOWS\system32\xactengine2_4.dll 2007-05-12 16:35 236,824 --a------ C:\WINDOWS\system32\xactengine2_3.dll 2007-05-12 16:35 2,414,360 --a------ C:\WINDOWS\system32\d3dx9_31.dll 2007-05-12 16:35 15,128 --a------ C:\WINDOWS\system32\x3daudio1_1.dll 2007-05-10 14:48 <DIR> d-------- C:\Program Files\Common Files\Blizzard Entertainment 2007-05-10 14:14 409,600 --a------ C:\WINDOWS\system32\wrap_oal.dll 2007-05-10 14:14 114,688 --a------ C:\WINDOWS\system32\OpenAL32.dll 2007-05-10 14:14 <DIR> d-------- C:\Program Files\OpenAL 2007-05-10 11:18 <DIR> d-------- C:\Downloads 2007-05-09 14:49 5,632 --a------ C:\WINDOWS\system32\ptpusb.dll 2007-05-09 14:49 159,232 --a------ C:\WINDOWS\system32\ptpusd.dll 2007-05-04 21:37 <DIR> d-------- C:\DOCUME~1\Piotrek\DANEAP~1\Aston 2007-05-04 21:02 <DIR> d-------- C:\Program Files\Common Files\Stardock 2007-05-04 19:51 2,560 --a------ C:\WINDOWS\_MSRSTRT.EXE 2007-05-04 19:42 712 --a------ C:\WINDOWS\unins000.dat 2007-05-04 18:35 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\NVIDIA 2007-05-04 12:12 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\Test Drive Unlimited 2007-05-04 12:09 26,678 --a------ C:\WINDOWS\system32\vtuvurs.dll.vir 2007-05-04 12:09 <DIR> dr-h----- C:\DOCUME~1\Piotrek\DANEAP~1\SecuROM 2007-05-02 23:52 <DIR> d-------- C:\DOCUME~1\Piotrek\DANEAP~1\ABBYY 2007-05-02 09:51 108,144 --a------ C:\WINDOWS\system32\CmdLineExt.dll 2007-05-01 17:47 524,288 --a------ C:\DOCUME~1\ADMINI~1\NTUSER.DAT 2007-05-01 17:47 <DIR> dr-h----- C:\DOCUME~1\ADMINI~1\Dane aplikacji 2007-05-01 17:47 <DIR> dr------- C:\DOCUME~1\ADMINI~1\Menu Start 2007-05-01 17:47 <DIR> d--h----- C:\DOCUME~1\ADMINI~1\Ustawienia lokalne 2007-05-01 17:47 <DIR> d--h----- C:\DOCUME~1\ADMINI~1\Szablony 2007-05-01 17:47 <DIR> d-------- C:\DOCUME~1\ADMINI~1\Ulubione 2007-05-01 17:47 <DIR> d-------- C:\DOCUME~1\ADMINI~1\Pulpit 2007-05-01 17:47 <DIR> d-------- C:\DOCUME~1\ADMINI~1\Moje dokumenty 2007-05-01 17:36 2,460 --a------ C:\WINDOWS\system32\tmp.reg 2007-05-01 17:35 53,248 --a------ C:\WINDOWS\system32\Process.exe 2007-05-01 17:35 51,200 --a------ C:\WINDOWS\system32\dumphive.exe 2007-05-01 17:35 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe 2007-04-30 20:12 262,144 --a------ C:\DOCUME~1\ALLUSE~1\ntuser.dat 2007-04-30 20:10 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\Windows Genuine Advantage 2007-04-30 20:07 6,550 --a------ C:\WINDOWS\jautoexp.dat 2007-04-30 20:07 46,352 --a------ C:\WINDOWS\setdebug.exe 2007-04-30 20:07 139,536 --a------ C:\WINDOWS\system32\javaee.dll 2007-04-30 20:07 113 --a------ C:\WINDOWS\system32\zonedon.reg 2007-04-30 20:07 113 --a------ C:\WINDOWS\system32\zonedoff.reg 2007-04-30 20:05 <DIR> d-------- C:\Program Files\MSXML 4.0 2007-04-30 12:03 <DIR> d-------- C:\WINDOWS\system32\PreInstall 2007-04-28 13:27 <DIR> d-------- C:\DOCUME~1\Piotrek\DANEAP~1\Spik 2007-04-28 13:06 <DIR> d-------- C:\WINDOWS\speech 2007-04-28 13:01 <DIR> d-------- C:\DOCUME~1\Piotrek\.jpi_cache 2007-04-28 12:45 765,952 --a------ C:\WINDOWS\TMUninst.exe 2007-04-28 12:14 <DIR> d-------- C:\Program Files\GameSpy Arcade 2007-04-27 16:19 <DIR> d-------- C:\Program Files\Common Files\Skype 2007-04-27 16:19 <DIR> d-------- C:\DOCUME~1\Piotrek\DANEAP~1\Skype 2007-04-27 16:18 <DIR> d-------- C:\Program Files\Skype 2007-04-27 16:18 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\Skype 2007-04-25 15:31 <DIR> d-------- C:\DOCUME~1\Piotrek\DANEAP~1\CurveBall 2007-04-24 21:50 26,056 --a------ C:\WINDOWS\system32\drivers\hamachi.sys 2007-04-24 21:50 <DIR> d-------- C:\DOCUME~1\Piotrek\DANEAP~1\Hamachi 2007-04-20 19:58 <DIR> d-------- C:\Program Files\MegauploadToolbar 2007-04-20 19:58 <DIR> d-------- C:\DOCUME~1\Piotrek\DANEAP~1\MegauploadToolbar 2007-04-20 19:30 <DIR> d-------- C:\Program Files\Common Files\DirectX 2007-04-20 17:54 <DIR> d-------- C:\WINDOWS\ShellNew 2007-04-20 17:52 <DIR> d-------- C:\DOCUME~1\Piotrek\DANEAP~1\Microsoft Web Folders (((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))) [color=red][b] Rootkit driver pe386 is present. ... attempting disinfection [/b][/color] [color=blue] pe386 ...... driver unloaded successfully.[/color] [i] ADS removed - system32: deleted 79094 bytes in 1 streams. [/i] 2007-05-11 14:00:06 249,856 ------w C:\WINDOWS\Setup1.exe 2007-05-11 14:00:03 73,216 ----a-w C:\WINDOWS\ST6UNST.EXE 2007-05-07 20:28:12 -------- d--h--w C:\Program Files\InstallShield Installation Information 2007-05-04 17:51:01 2,560 ----a-w C:\WINDOWS\_MSRSTRT.EXE 2007-04-30 18:10:52 -------- d-----w C:\Program Files\Messenger 2007-04-30 18:05:58 49,492 ----a-w C:\WINDOWS\system32\perfc015.dat 2007-04-30 18:05:58 355,486 ----a-w C:\WINDOWS\system32\perfh015.dat 2007-04-27 09:45:43 584,803 --sh--w C:\WINDOWS\system32\mnnmp.bak2 2007-04-25 14:59:13 -------- d-----w C:\DOCUME~1\Piotrek\DANEAP~1\Image Zone Express 2007-04-20 15:52:38 -------- d-----w C:\Program Files\microsoft frontpage 2007-04-15 15:15:34 -------- d-----w C:\Program Files\PITy 2007-04-15 08:09:28 -------- d-----w C:\Program Files\Common Files\Ahead 2007-04-09 19:49:14 491,578 --sh--w C:\WINDOWS\system32\mnnmp.bak1 2007-04-08 21:19:43 -------- d-----w C:\DOCUME~1\Piotrek\DANEAP~1\GuiltyGearIsukaNA 2007-04-07 14:19:51 -------- d-----w C:\Program Files\Euro TEST 2004 2007-04-06 14:15:13 -------- d-----w C:\DOCUME~1\Piotrek\DANEAP~1\Media Player Classic 2007-04-06 14:00:34 -------- d-----w C:\DOCUME~1\Piotrek\DANEAP~1\Real 2007-04-04 10:39:02 -------- d-----w C:\Program Files\Movie Maker 2007-04-04 10:37:22 -------- d-----w C:\Program Files\Windows NT 2007-04-03 19:01:19 -------- d-----w C:\Program Files\MyGlobalSearch 2007-04-03 15:42:18 -------- d-----w C:\Program Files\GameDeviceDriver 2007-04-03 09:43:17 639,224 ----a-w C:\WINDOWS\system32\drivers\sptd.sys 2007-04-03 08:57:11 -------- d-----w C:\DOCUME~1\Piotrek\DANEAP~1\HP 2007-04-03 08:44:28 120,253 ----a-w C:\WINDOWS\hpoins11.dat 2007-04-03 08:41:52 -------- d-----w C:\Program Files\Common Files\HP 2007-04-03 08:40:22 -------- d-----w C:\Program Files\Hewlett-Packard 2007-04-03 08:40:03 -------- d-----w C:\Program Files\Common Files\Hewlett-Packard 2007-04-03 08:37:34 -------- d-----w C:\Program Files\HP 2007-04-03 08:28:55 -------- d--h--w C:\Program Files\WindowsUpdate 2007-04-02 18:43:07 1,168 ----a-w C:\WINDOWS\mozver.dat 2007-04-02 18:40:15 26,694 ----a-w C:\WINDOWS\system32\gebbxuu.dll.vir 2007-04-02 16:38:02 0 ----a-w C:\WINDOWS\nsreg.dat 2007-04-02 16:37:22 -------- d-----w C:\Program Files\Common Files\ODBC 2007-04-02 16:37:20 -------- d-----w C:\Program Files\Common Files\SpeechEngines 2007-04-02 16:22:55 -------- d-----w C:\Program Files\Neostrada TP 2007-04-02 16:14:15 -------- d-----w C:\Program Files\Realtek Sound Manager 2007-04-02 16:14:14 -------- d-----w C:\Program Files\AvRack 2007-04-02 16:13:19 -------- d-----w C:\Program Files\Marvell 2007-04-02 16:13:16 -------- d-----w C:\Program Files\Common Files\InstallShield 2007-04-02 16:11:41 -------- d-----w C:\Program Files\Intel 2007-04-02 15:56:07 -------- d-----w C:\Program Files\SAGEM 2007-04-02 15:55:55 -------- d-----w C:\Program Files\Java Web Start 2007-04-02 15:43:39 0 --sha-r C:\MSDOS.SYS 2007-04-02 15:43:39 0 --sha-r C:\IO.SYS 2007-04-02 15:42:09 -------- d-----w C:\Program Files\Common Files\MSSoap 2007-04-02 15:41:35 21,856 ----a-w C:\WINDOWS\system32\emptyregdb.dat 2007-04-02 15:41:29 -------- d-----w C:\Program Files\Usługi online 2007-04-02 15:41:24 -------- d-----w C:\Program Files\MSN Gaming Zone 2007-03-17 13:45:36 293,376 ----a-w C:\WINDOWS\system32\winsrv.dll 2007-03-08 15:38:47 579,072 ----a-w C:\WINDOWS\system32\user32.dll 2007-03-08 15:38:47 40,960 ----a-w C:\WINDOWS\system32\mf3216.dll 2007-03-08 15:38:47 281,600 ----a-w C:\WINDOWS\system32\gdi32.dll 2007-03-08 15:37:33 1,843,840 ----a-w C:\WINDOWS\system32\win32k.sys 2007-02-21 19:00:28 10,752 ----a-w C:\WINDOWS\system32\ff_vfw.dll 2007-02-05 20:19:48 185,856 ----a-w C:\WINDOWS\system32\upnphost.dll (((((((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects] {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}=D:\Program Files\Adobe\Acrobat 6.0 CE\Reader\ActiveX\AcroIEHelper.dll [2003-11-04 00:17] {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C}=C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL [2006-10-31 08:55] {A5366673-E8CA-11D3-9CD9-0090271D075B}=D:\PROGRA~1\FlashGet\Jccatch.dll [2001-02-06 12:20] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NvCplDaemon"="C:\WINDOWS\System32\NvCpl.dll" [2006-10-22 12:22] "nwiz"="nwiz.exe" [2006-10-22 12:22 C:\WINDOWS\system32\nwiz.exe] "SoundMan"="SOUNDMAN.EXE" [] "HP Software Update"="D:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2006-02-19 02:41] "NvMediaCenter"="C:\WINDOWS\System32\NvMcTray.dll" [2006-10-22 12:22] "RTBatteryMeter"="C:\Program Files\GameDeviceDriver\RFPIcon.exe" [2003-01-16 11:32] "WheelMouse"="D:\PROGRA~1\A4Tech\Mouse\Amoumain.exe" [2004-08-25 07:35] "DAEMON Tools"="D:\Program Files\DAEMON Tools\daemon.exe" [2006-11-12 12:48] "NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 11:50] "AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2007-05-16 08:55] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:44] "AutoConnect"="D:\Program Files\AutoConnect\AutoConnect.exe" [2004-08-28 20:27] "Gadu-Gadu"="D:\Program Files\Gadu-Gadu\gg.exe" [2007-01-30 16:58] [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa] Authentication Packages msv1_0 Security Packages kerberos msv1_0 schannel wdigest Notification Packages scecli [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] LocalService Alerter WebClient LmHosts RemoteRegistry upnphost SSDPSRV NetworkService DnsCache rpcss RpcSs imgsvc StiSvc termsvcs TermService HTTPFilter HTTPFilter DcomLaunch DcomLaunch TermService HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost *netsvcs* ******************************************************************** catchme 0.3.660 W2K/XP/Vista - userland rootkit detector by Gmer, http://www.gmer.net Rootkit scan 2007-05-17 22:25:47 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ******************************************************************** Completion time: 2007-05-17 22:26:55 - machine was rebooted C:\ComboFix-quarantined-files.txt ... 2007-05-17 22:26 --- E O F --- "Silent Runners.vbs", revision R50, http://www.silentrunners.org/ Operating System: Windows XP SP2 Output limited to non-default values, except where indicated by "{++}" Startup items buried in registry: --------------------------------- HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ {++} "CTFMON.EXE" = "C:\WINDOWS\system32\ctfmon.exe" [MS] "AutoConnect" = "D:\Program Files\AutoConnect\AutoConnect.exe" ["http://autoconnect.prv.pl"] "Gadu-Gadu" = ""D:\Program Files\Gadu-Gadu\gg.exe" /tray" ["Gadu-Gadu S.A."] HKLM\Software\Microsoft\Windows\CurrentVersion\Run\ {++} "NvCplDaemon" = "RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup" [MS] "nwiz" = "nwiz.exe /install" ["NVIDIA Corporation"] "SoundMan" = "SOUNDMAN.EXE" ["Realtek Semiconductor Corp."] "HP Software Update" = "D:\Program Files\HP\HP Software Update\HPWuSchd2.exe" ["Hewlett-Packard Development Company, L.P."] "NvMediaCenter" = "RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit" [MS] "RTBatteryMeter" = "C:\Program Files\GameDeviceDriver\RFPIcon.exe" ["Ruling Tec Pte Ltd"] "WheelMouse" = "D:\PROGRA~1\A4Tech\Mouse\Amoumain.exe" ["A4Tech Co., Ltd."] "DAEMON Tools" = ""D:\Program Files\DAEMON Tools\daemon.exe" -lang 1033" ["DT Soft Ltd."] "NeroFilterCheck" = "C:\WINDOWS\system32\NeroCheck.exe" ["Ahead Software Gmbh"] "AVG7_CC" = "C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP" ["GRISOFT, s.r.o."] HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\(Default) = (no title provided) -> {HKLM...CLSID} = "AcroIEHlprObj Class" \InProcServer32\(Default) = "D:\Program Files\Adobe\Acrobat 6.0 CE\Reader\ActiveX\AcroIEHelper.dll" ["Adobe Systems Incorporated"] {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C}\(Default) = (no title provided) -> {HKLM...CLSID} = "Megaupload Toolbar" \InProcServer32\(Default) = "C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL" ["MegaUpload"] {A5366673-E8CA-11D3-9CD9-0090271D075B}\(Default) = (no title provided) -> {HKLM...CLSID} = "IeCatch2 Class" \InProcServer32\(Default) = "D:\PROGRA~1\FlashGet\Jccatch.dll" ["Amaze Soft"] HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\ "{42071714-76d4-11d1-8b24-00a0c9068ff3}" = "Rozszerzenie CPL kadrowania wyświetlania" -> {HKLM...CLSID} = "Rozszerzenie CPL kadrowania wyświetlania" \InProcServer32\(Default) = "deskpan.dll" [file not found] "{88895560-9AA2-1069-930E-00AA0030EBC8}" = "Rozszerzenie ikony HyperTerminalu" -> {HKLM...CLSID} = "HyperTerminal Icon Ext" \InProcServer32\(Default) = "C:\WINDOWS\System32\hticons.dll" ["Hilgraeve, Inc."] "{A70C977A-BF00-412C-90B7-034C51DA2439}" = "NvCpl DesktopContext Class" -> {HKLM...CLSID} = "DesktopContext Class" \InProcServer32\(Default) = "C:\WINDOWS\System32\nvcpl.dll" ["NVIDIA Corporation"] "{1CDB2949-8F65-4355-8456-263E7C208A5D}" = "Desktop Explorer" -> {HKLM...CLSID} = "Desktop Explorer" \InProcServer32\(Default) = "C:\WINDOWS\System32\nvshell.dll" ["NVIDIA Corporation"] "{1E9B04FB-F9E5-4718-997B-B8DA88302A47}" = "Desktop Explorer Menu" -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "C:\WINDOWS\System32\nvshell.dll" ["NVIDIA Corporation"] "{1E9B04FB-F9E5-4718-997B-B8DA88302A48}" = "nView Desktop Context Menu" -> {HKLM...CLSID} = "nView Desktop Context Menu" \InProcServer32\(Default) = "C:\WINDOWS\System32\nvshell.dll" ["NVIDIA Corporation"] "{FFB699E0-306A-11d3-8BD1-00104B6F7516}" = "Play on my TV helper" -> {HKLM...CLSID} = "NVIDIA CPL Extension" \InProcServer32\(Default) = "C:\WINDOWS\System32\nvcpl.dll" ["NVIDIA Corporation"] "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" = "WinRAR shell extension" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "D:\Program Files\WinRAR\rarext.dll" [null data] "{0006F045-0000-0000-C000-000000000046}" = "Microsoft Outlook Custom Icon Handler" -> {HKLM...CLSID} = "Rozszerzenie ikon plików programu Outlook" \InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\Office\OLKFSTUB.DLL" [MS] "{9F97547E-4609-42C5-AE0C-81C61FFAEBC3}" = "AVG7 Shell Extension" -> {HKLM...CLSID} = "AVG7 Shell Extension Class" \InProcServer32\(Default) = "C:\Program Files\Grisoft\AVG7\avgse.dll" ["GRISOFT, s.r.o."] "{9F97547E-460A-42C5-AE0C-81C61FFAEBC3}" = "AVG7 Find Extension" -> {HKLM...CLSID} = "AVG7 Find Extension Class" \InProcServer32\(Default) = "C:\Program Files\Grisoft\AVG7\avgse.dll" ["GRISOFT, s.r.o."] HKLM\Software\Classes\*\shellex\ContextMenuHandlers\ AVG7 Shell Extension\(Default) = "{9F97547E-4609-42C5-AE0C-81C61FFAEBC3}" -> {HKLM...CLSID} = "AVG7 Shell Extension Class" \InProcServer32\(Default) = "C:\Program Files\Grisoft\AVG7\avgse.dll" ["GRISOFT, s.r.o."] WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "D:\Program Files\WinRAR\rarext.dll" [null data] HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\ WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "D:\Program Files\WinRAR\rarext.dll" [null data] HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\ AVG7 Shell Extension\(Default) = "{9F97547E-4609-42C5-AE0C-81C61FFAEBC3}" -> {HKLM...CLSID} = "AVG7 Shell Extension Class" \InProcServer32\(Default) = "C:\Program Files\Grisoft\AVG7\avgse.dll" ["GRISOFT, s.r.o."] FineReader8\(Default) = "{F7091C74-EBB1-49D7-94C7-FE4886CCC18D}" -> {HKLM...CLSID} = "FineReader8ExplorerContextMenuHandler" \InProcServer32\(Default) = "D:\Program Files\ABBYY FineReader 8.0 Professional Edition\FECMenu.dll" ["ABBYY Software"] WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "D:\Program Files\WinRAR\rarext.dll" [null data] Group Policies {GPedit.msc branch and setting}: ----------------------------------------------- Note: detected settings may not have any effect. HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\ "shutdownwithoutlogon" = (REG_DWORD) hex:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| Shutdown: Allow system to be shut down without having to log on} "undockwithoutlogon" = (REG_DWORD) hex:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| Devices: Allow undock without having to log on} Active Desktop and Wallpaper: ----------------------------- Active Desktop may be disabled at this entry: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState Displayed if Active Desktop enabled and wallpaper not set by Group Policy: HKCU\Software\Microsoft\Internet Explorer\Desktop\General\ "Wallpaper" = "C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp" Displayed if Active Desktop disabled and wallpaper not set by Group Policy: HKCU\Control Panel\Desktop\ "Wallpaper" = "C:\Documents and Settings\Piotrek\Dane aplikacji\Mozilla\Firefox\Tapeta pulpitu.bmp" Startup items in "Piotrek" & "All Users" startup folders: --------------------------------------------------------- C:\Documents and Settings\Piotrek\Menu Start\Programy\Autostart "UniSpiker-2.6" -> shortcut to: "D:\Program Files\ivo\UniSpiker-2.6\uni_spiker-2.6.exe" [null data] C:\Documents and Settings\All Users\Menu Start\Programy\Autostart "DSLMON" -> shortcut to: "C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe /W" [empty string] "HP Digital Imaging Monitor" -> shortcut to: "D:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe" ["Hewlett-Packard Development Company, L.P."] "Microsoft Office" -> shortcut to: "C:\Program Files\Microsoft Office\Office\OSA9.EXE -b -l" [MS] Winsock2 Service Provider DLLs: ------------------------------- Namespace Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++} 000000000001\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS] 000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS] 000000000003\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS] Transport Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++} 0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range: %SystemRoot%\system32\mswsock.dll [MS], 01 - 03, 06 - 17 %SystemRoot%\system32\rsvpsp.dll [MS], 04 - 05 Toolbars, Explorer Bars, Extensions: ------------------------------------ Toolbars HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\ "{4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C}" -> {HKLM...CLSID} = "Megaupload Toolbar" \InProcServer32\(Default) = "C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL" ["MegaUpload"] HKLM\Software\Microsoft\Internet Explorer\Toolbar\ "{4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C}" = (no title provided) -> {HKLM...CLSID} = "Megaupload Toolbar" \InProcServer32\(Default) = "C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL" ["MegaUpload"] Extensions (Tools menu items, main toolbar menu buttons) HKLM\Software\Microsoft\Internet Explorer\Extensions\ {FB5F1910-F110-11D2-BB9E-00C04F795683}\ "ButtonText" = "Messenger" "MenuText" = "Windows Messenger" "Exec" = "C:\Program Files\Messenger\msmsgs.exe" [MS] Running Services (Display Name, Service Name, Path {Service DLL}): ------------------------------------------------------------------ AVG E-mail Scanner, AVGEMS, "C:\PROGRA~1\Grisoft\AVG7\avgemc.exe" ["GRISOFT, s.r.o."] AVG7 Alert Manager Server, Avg7Alrt, "C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe" ["GRISOFT, s.r.o."] AVG7 Update Service, Avg7UpdSvc, "C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe" ["GRISOFT, s.r.o."] NVIDIA Display Driver Service, NVSvc, "C:\WINDOWS\System32\nvsvc32.exe" ["NVIDIA Corporation"] Pml Driver HPZ12, Pml Driver HPZ12, "C:\WINDOWS\system32\HPZipm12.exe" ["HP"] StarWind iSCSI Service, StarWindService, "D:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe" ["Rocket Division Software"] Print Monitors: --------------- HKLM\System\CurrentControlSet\Control\Print\Monitors\ HP Standard TCP/IP Port\Driver = "HpTcpMon.dll" ["Hewlett Packard"] LIDIL hpzll054\Driver = "hpzll054.dll" ["Hewlett-Packard Company"] ---------- + This report excludes default entries except where indicated. + To see *everywhere* the script checks and *everything* it finds, launch it from a command prompt or a shortcut with the -all parameter. + To search all directories of local fixed drives for DESKTOP.INI DLL launch points, use the -supp parameter or answer "No" at the first message box and "Yes" at the second message box. ---------- (total run time: 45 seconds, including 6 seconds for message boxes)

**Posty:** 18165 · przez **wojtas** 18 Maj 2007, 12:56

sciagnij gmera:

http://gmer.net/gmer.zip

Uruchom Gmera, w zakładce Procesy wybierz Gmer awaryjny co objawi się samoczynnym resetem kompa i startem Gmera. Wtedy:

>>> zakładka Procesy i przez opcję Pliki ręcznie skasuj:

C:\WINDOWS\system32\dqndvogq.dll
C:\WINDOWS\system32\ghgnumci.dll
C:\WINDOWS\system32\iproqhfv.dll
C:\WINDOWS\system32\jkkhhhe.dll
C:\WINDOWS\system32\jwhdbcjt.dll
C:\WINDOWS\system32\khffcaa.dll
C:\WINDOWS\system32\oshepqce.dll
C:\WINDOWS\system32\qiykywwk.dll
C:\WINDOWS\system32\qmnorubw.dll
C:\WINDOWS\system32\rprlvpnw.dll
C:\WINDOWS\system32\tuvuvvv.dll
C:\WINDOWS\system32\uejntlut.dll
C:\WINDOWS\system32\yayvwtq.dll
C:\WINDOWS\system32\yjexnwfu.dll
C:\WINDOWS\system32\wnpvlrpr.ini
C:\WINDOWS\system32\vtuvurs.dll.vir
C:\WINDOWS\system32\mnnmp.bak2
C:\WINDOWS\system32\gebbxuu.dll.vir

potem skasuj do kosza:

C:\Program Files\MyGlobalSearch

prosba o sprawdzenie loga...

prosba o sprawdzenie loga...

Kto jest na forum