proszę o spradzenie loga brak modułów run dll

**Posty:** 16 · przez **polimer43** 10 Lut 2008, 20:18

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:06:15, on 2008-02-10
Platform: Windows Vista (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16575)
Boot mode: Normal

Running processes:
C:\Windows\System32\smss.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\wininit.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\winlogon.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\agrsmsvc.exe
C:\Windows\system32\svchost.exe
C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
C:\Program Files\Eset\nod32krn.exe
C:\Windows\system32\svchost.exe
C:\Program Files\Spyware Doctor\pctsAuxs.exe
C:\Program Files\Spyware Doctor\pctsSvc.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\TODDSrv.exe
C:\Program Files\TOSHIBA\Power Saver\TosCoSrv.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe
C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Java\jre1.6.0\bin\jusched.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Windows\RtHDVCpl.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\TOSHIBA\ConfigFree\NDSTray.exe
C:\Windows\System32\hkcmd.exe
C:\Program Files\Synaptics\SynTP\SynToshiba.exe
C:\Windows\System32\igfxpers.exe
C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe
C:\Program Files\TOSHIBA\Power Saver\TPwrMain.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\Spyware Doctor\pctsTray.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\TOSHIBA\TOSCDSPD\TOSCDSPD.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Eset\nod32kui.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Program Files\TOSHIBA\ConfigFree\CFSwMgr.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHsp.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosAVRC.exe
C:\Program Files\Eset\nod32.exe
C:\Program Files\Eset\nod32.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\tosOBEX.exe
C:\Program Files\TOSHIBA\Bluetooth Toshiba Stack\TosBtProc.exe
C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe
C:\Program Files\Internet Explorer\IEUser.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
C:\Windows\system32\SearchFilterHost.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\Macromed\Flash\FlashUtil9e.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\lpremove.exe
C:\Windows\system32\lpksetup.exe
C:\Windows\servicing\TrustedInstaller.exe
E:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\Windows\system32\wbem\wmiprvse.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.pl/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O1 - Hosts: ::1 localhost
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0\bin\ssv.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0\bin\jusched.exe"
O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [NDSTray.exe] NDSTray.exe
O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe
O4 - HKLM\..\Run: [HSON] C:\Program Files\TOSHIBA\TBS\HSON.exe
O4 - HKLM\..\Run: [00TCrdMain] C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe
O4 - HKLM\..\Run: [TPwrMain] C:\Program Files\TOSHIBA\Power Saver\TPwrMain.EXE
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [Performance Center] C:\Program Files\Ascentive\Performance Center\ApcMain.exe -m
O4 - HKLM\..\Run: [MSConfig] "C:\Windows\system32\msconfig.exe" /auto
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [ISTray] "C:\Program Files\Spyware Doctor\pctsTray.exe"
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter
O4 - HKCU\..\Run: [TOSCDSPD] C:\Program Files\TOSHIBA\TOSCDSPD\TOSCDSPD.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [Performance Center] C:\Program Files\Ascentive\Performance Center\APCMain.exe -m
O4 - HKCU\..\Run: [AlcoholAutomount] "C:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe" /automount
O4 - HKCU\..\Run: [cmds] rundll32.exe C:\Users\agniesia\AppData\Local\Temp\iifec.dll,c
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'USŁUGA LOKALNA')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'USŁUGA LOKALNA')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'USŁUGA SIECIOWA')
O4 - HKUS\S-1-5-18\..\Run: [Nokia.PCSync] E:\PROGRAMY\Nokia PC Suite 6\PcSync2.exe /NoDialog (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [Nokia.PCSync] E:\PROGRAMY\Nokia PC Suite 6\PcSync2.exe /NoDialog (User 'Default user')
O4 - Global Startup: Bluetooth Manager.lnk = ?
O8 - Extra context menu item: E&ksportuj do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0\bin\npjpi160.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0\bin\npjpi160.dll
O9 - Extra button: Wyślij do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Wyślij &do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: eBay - {C08CAF1D-C0A3-40D5-9970-06D067EAC017} - http://www.webtip.ch/cgi-bin/toshiba/tracker_url.pl?PL (file missing)
O13 - Gopher Prefix:
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.pl/resources/virusscanner/kavwebscan_unicode.cab
O16 - DPF: {3D8700FB-86A4-4CB4-B738-6F0FC016AC7D} (MainControl Class) - http://slimak.onet.pl/_m/wirusy/ArcaOnline.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
O23 - Service: Agere Modem Call Progress Audio (AgereModemAudio) - Agere Systems - C:\Windows\system32\agrsmsvc.exe
O23 - Service: ConfigFree Service (CFSvcs) - TOSHIBA CORPORATION - C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
O23 - Service: TOSHIBA Optical Disc Drive Service (TODDSrv) - TOSHIBA Corporation - C:\Windows\system32\TODDSrv.exe
O23 - Service: TOSHIBA Power Saver (TosCoSrv) - TOSHIBA Corporation - C:\Program Files\TOSHIBA\Power Saver\TosCoSrv.exe
O23 - Service: TOSHIBA Bluetooth Service - TOSHIBA CORPORATION - C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe

--
End of file - 10905 bytes
[code][/code]

wyskakują nowe okna przeglądarki z napisem "Http 404 nie znleziono piku"

**Posty:** 18165 · przez **wojtas** 10 Lut 2008, 20:31

Wykonaj to co jest podane w tym temacie

Zastosuj SDFix . Po pobraniu uruchom go a rozpakuje się do C:\SDFix. Uruchom komputer w trybie awaryjnym (F8 przy stracie systemu). Będąc w awaryjnym uruchom plik RunThis.bat z folderu SDFixa. Zatwierdź czyszczenie przez Y. Poczekaj aż ukończy i komputer zresetuje

Potem wejdz do folderu C:\SDFix wrzuc zawartość pliku Report.txt + log z combofixa oraz z hijacka

przenosze do dzialu bezpeiczenstwo

**Posty:** 16 · przez **polimer43** 11 Lut 2008, 19:25

oto logii:
hijack

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 22:50:06, on 2008-02-10
Platform: Windows Vista (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16575)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Java\jre1.6.0\bin\jusched.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Windows\RtHDVCpl.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\TOSHIBA\ConfigFree\NDSTray.exe
C:\Program Files\Synaptics\SynTP\SynToshiba.exe
C:\Windows\System32\hkcmd.exe
C:\Windows\System32\igfxpers.exe
C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe
C:\Program Files\TOSHIBA\Power Saver\TPwrMain.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\Spyware Doctor\pctsTray.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\TOSHIBA\TOSCDSPD\TOSCDSPD.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe
C:\Program Files\Internet Explorer\ieuser.exe
C:\Program Files\TOSHIBA\ConfigFree\CFSwMgr.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHsp.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosAVRC.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\tosOBEX.exe
C:\Program Files\TOSHIBA\Bluetooth Toshiba Stack\TosBtProc.exe
E:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.pl/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O1 - Hosts: ::1 localhost
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0\bin\jusched.exe"
O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [NDSTray.exe] NDSTray.exe
O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe
O4 - HKLM\..\Run: [HSON] C:\Program Files\TOSHIBA\TBS\HSON.exe
O4 - HKLM\..\Run: [00TCrdMain] C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe
O4 - HKLM\..\Run: [TPwrMain] C:\Program Files\TOSHIBA\Power Saver\TPwrMain.EXE
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [Performance Center] C:\Program Files\Ascentive\Performance Center\ApcMain.exe -m
O4 - HKLM\..\Run: [MSConfig] "C:\Windows\system32\msconfig.exe" /auto
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [ISTray] "C:\Program Files\Spyware Doctor\pctsTray.exe"
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter
O4 - HKCU\..\Run: [TOSCDSPD] C:\Program Files\TOSHIBA\TOSCDSPD\TOSCDSPD.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [Performance Center] C:\Program Files\Ascentive\Performance Center\APCMain.exe -m
O4 - HKCU\..\Run: [AlcoholAutomount] "C:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe" /automount
O4 - HKCU\..\Run: [cmds] rundll32.exe C:\Users\agniesia\AppData\Local\Temp\iifec.dll,c
O4 - HKUS\S-1-5-18\..\Run: [Nokia.PCSync] E:\PROGRAMY\Nokia PC Suite 6\PcSync2.exe /NoDialog (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [Nokia.PCSync] E:\PROGRAMY\Nokia PC Suite 6\PcSync2.exe /NoDialog (User 'Default user')
O4 - Global Startup: Bluetooth Manager.lnk = ?
O8 - Extra context menu item: E&ksportuj do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0\bin\npjpi160.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0\bin\npjpi160.dll
O9 - Extra button: Wyślij do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Wyślij &do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: eBay - {C08CAF1D-C0A3-40D5-9970-06D067EAC017} - http://www.webtip.ch/cgi-bin/toshiba/tracker_url.pl?PL (file missing)
O13 - Gopher Prefix:
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.pl/resources/virusscanner/kavwebscan_unicode.cab
O16 - DPF: {3D8700FB-86A4-4CB4-B738-6F0FC016AC7D} (MainControl Class) - http://slimak.onet.pl/_m/wirusy/ArcaOnline.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
O23 - Service: Agere Modem Call Progress Audio (AgereModemAudio) - Agere Systems - C:\Windows\system32\agrsmsvc.exe
O23 - Service: ConfigFree Service (CFSvcs) - TOSHIBA CORPORATION - C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
O23 - Service: TOSHIBA Optical Disc Drive Service (TODDSrv) - TOSHIBA Corporation - C:\Windows\system32\TODDSrv.exe
O23 - Service: TOSHIBA Power Saver (TosCoSrv) - TOSHIBA Corporation - C:\Program Files\TOSHIBA\Power Saver\TosCoSrv.exe
O23 - Service: TOSHIBA Bluetooth Service - TOSHIBA CORPORATION - C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe

--
End of file - 8159 bytes
Kod: Zaznacz wszystko
silent runners

Kod: Zaznacz wszystko: catchme [quote] catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-02-10 22:39:48 Windows 6.0.6000 NTFS scanning hidden processes ... scanning hidden services & system hive ... [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\BTHPORT\Parameters\Keys\00037ae5dcfb] [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04] "h0"=dword:00000000 "ujdew"=hex:01,d3,b2,93,8a,71,ee,3b,8c,7b,c1,54,a3,dd,4a,64,81,97,7a,91,7a,.. "p0"="C:\Program Files\Alcohol Soft\Alcohol 120\" [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4] "h0"=dword:00000001 "khjeh"=hex:a4,a2,f9,bb,9d,1a,98,d8,71,f4,2f,32,18,0a,44,47,e5,40,98,7b,d4,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\BTHPORT\Parameters\Keys\00037ae5dcfb] [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04] "h0"=dword:00000000 "ujdew"=hex:01,d3,b2,93,8a,71,ee,3b,8c,7b,c1,54,a3,dd,4a,64,81,97,7a,91,7a,.. "p0"="C:\Program Files\Alcohol Soft\Alcohol 120\" [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4] "h0"=dword:00000001 "khjeh"=hex:a4,a2,f9,bb,9d,1a,98,d8,71,f4,2f,32,18,0a,44,47,e5,40,98,7b,d4,.. [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\00037ae5dcfb] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg] "s1"=dword:2df9c43f "s2"=dword:110480d0 "h0"=dword:00000002 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04] "h0"=dword:00000000 "ujdew"=hex:01,d3,b2,93,8a,71,ee,3b,8c,7b,c1,54,a3,dd,4a,64,81,97,7a,91,7a,.. "p0"="C:\Program Files\Alcohol Soft\Alcohol 120\" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4] "h0"=dword:00000001 "khjeh"=hex:a4,a2,f9,bb,9d,1a,98,d8,71,f4,2f,32,18,0a,44,47,e5,40,98,7b,d4,.. scanning hidden registry entries ... [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{A2D77BD3-17BB-0D62-4FA7-B9EEBF91D8FD}] "iaepaeoahdfgpjpflp"=hex:6a,61,70,6b,63,6f,65,6c,64,61,61,6f,69,6f,65,61,70,6e,62,6a,00,.. "haopgcipbpnamaoe"=hex:6a,61,70,6b,63,6f,65,6c,64,61,61,6f,69,6f,65,61,70,6e,62,6a,00,.. [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{D86CCD39-3690-D9D0-7C5C-9FA895BEED63}] "iajnchgppldcmibedf"=hex:6a,61,61,6e,6f,63,66,6e,64,70,6b,6d,66,6e,6f,62,64,6d,6a,67,00,.. "halnijjkhdldoidl"=hex:6a,61,61,6e,6f,63,66,6e,64,70,6b,6d,66,6e,6f,62,64,6d,6a,67,00,.. scanning hidden files ... scan completed successfully hidden processes: 0 hidden services: 0 hidden files: 0 [/quote]

**Posty:** 18165 · przez **wojtas** 11 Lut 2008, 19:35

skasuj te wpisy:

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O1 - Hosts: ::1 localhost
O13 - Gopher Prefix:

daj loga z combofixa lub z dss'a ale nie wiem czy zadzialaja bo masz chyba Viste

**Posty:** 16 · przez **polimer43** 11 Lut 2008, 19:40

log combofixa

ComboFix 08-02-11.2 - agniesia 2008-02-11 18:33:55.1 - NTFSx86
Microsoft® Windows Vista™ Home Basic 6.0.6000.0.1250.1.1045.18.181 [GMT 1:00]
Running from: E:\DOWLAND\ComboFix.exe
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\ProgramData\Microsoft\Network\Downloader\qmgr0.dat
C:\ProgramData\Microsoft\Network\Downloader\qmgr1.dat

----- BITS: Possible infected sites -----

hxxp://www.download.windowsupdate.com
.
((((((((((((((((((((((((( Files Created from 2008-01-11 to 2008-02-11 )))))))))))))))))))))))))))))))
.

2008-02-10 17:58 . 2008-02-10 17:58 <DIR> d-------- C:\Users\agniesia\AppData\Roaming\InstallShield
2008-02-08 20:00 . 2008-02-08 20:00 <DIR> d-------- C:\Windows\System32\Kaspersky Lab
2008-02-08 18:57 . 2008-02-11 18:20 <DIR> d-a------ C:\Users\All Users\TEMP
2008-02-08 18:57 . 2008-02-08 18:57 <DIR> d-------- C:\Users\agniesia\AppData\Roaming\PC Tools
2008-02-08 18:57 . 2008-02-11 18:20 <DIR> d-a------ C:\ProgramData\TEMP
2008-02-08 18:57 . 2008-02-11 18:21 <DIR> d-------- C:\Program Files\Spyware Doctor
2008-02-08 18:57 . 2007-12-10 14:53 81,288 --a------ C:\Windows\System32\drivers\iksyssec.sys
2008-02-08 18:57 . 2007-12-10 14:53 66,952 --a------ C:\Windows\System32\drivers\iksysflt.sys
2008-02-08 18:57 . 2007-12-10 14:53 41,864 --a------ C:\Windows\System32\drivers\ikfilesec.sys
2008-02-08 18:57 . 2007-12-10 14:53 29,576 --a------ C:\Windows\System32\drivers\kcom.sys
2008-02-05 23:20 . 2008-02-05 23:20 <DIR> d-------- C:\Program Files\Common Files\PX Storage Engine
2008-02-03 11:23 . 2008-02-03 11:25 <DIR> d-------- C:\Users\All Users\DVD Shrink
2008-02-03 11:23 . 2008-02-03 11:25 <DIR> d-------- C:\ProgramData\DVD Shrink
2008-02-02 22:44 . 2008-02-02 22:44 <DIR> d-------- C:\Users\agniesia\AppData\Roaming\Uniblue
2008-02-02 19:08 . 2008-02-02 19:08 <DIR> d-------- C:\CloneDVDTemp
2008-01-31 16:02 . 2008-01-31 16:02 <DIR> d-------- C:\Users\agniesia\AppData\Roaming\Ulead Systems
2008-01-26 21:05 . 2008-01-26 21:05 <DIR> d-------- C:\Users\All Users\Elaborate Bytes
2008-01-26 21:05 . 2008-01-26 21:05 <DIR> d-------- C:\ProgramData\Elaborate Bytes
2008-01-26 18:49 . 2008-01-26 21:05 48 ---hs---- C:\Windows\SF81F17C3.tmp
2008-01-26 18:34 . 2008-01-26 18:34 <DIR> d-------- C:\Program Files\Elaborate Bytes
2008-01-26 18:13 . 2008-01-26 18:13 <DIR> d-------- C:\Users\All Users\Ahead
2008-01-26 18:13 . 2008-01-26 18:13 <DIR> d-------- C:\ProgramData\Ahead
2008-01-26 14:43 . 2008-01-26 14:43 <DIR> d-------- C:\Program Files\Alcohol Soft
2008-01-26 14:30 . 2008-01-26 14:30 0 --a------ C:\Windows\Irremote.ini
2008-01-26 14:00 . 2008-01-26 14:00 <DIR> d-------- C:\Users\agniesia\AppData\Roaming\DAEMON Tools
2008-01-20 23:29 . 2008-01-26 14:35 <DIR> d-------- C:\Program Files\Common Files\Nero
2008-01-13 03:01 . 2008-01-13 03:01 802,816 --a------ C:\Windows\System32\drivers\tcpip.sys
2008-01-13 03:01 . 2008-01-13 03:01 216,760 --a------ C:\Windows\System32\drivers\netio.sys
2008-01-13 03:01 . 2008-01-13 03:01 167,424 --a------ C:\Windows\System32\tcpipcfg.dll
2008-01-13 03:01 . 2008-01-13 03:01 24,064 --a------ C:\Windows\System32\netcfg.exe
2008-01-13 03:01 . 2008-01-13 03:01 22,016 --a------ C:\Windows\System32\netiougc.exe
2008-01-12 19:14 . 2008-01-26 18:19 <DIR> d-------- C:\Users\agniesia\AppData\Roaming\Ahead
2008-01-12 19:08 . 2008-02-03 10:16 <DIR> d-------- C:\Program Files\Common Files\Ahead
2008-01-12 15:24 . 2008-01-12 15:24 4,247,552 --a------ C:\Windows\System32\GameUXLegacyGDFs.dll
2008-01-12 15:24 . 2008-01-12 15:24 1,686,016 --a------ C:\Windows\System32\gameux.dll
2008-01-12 15:24 . 2008-01-12 15:24 1,060,920 --a------ C:\Windows\System32\drivers\ntfs.sys
2008-01-12 15:24 . 2008-01-12 15:24 211,000 --a------ C:\Windows\System32\drivers\volsnap.sys
2008-01-12 15:24 . 2008-01-12 15:24 154,624 --a------ C:\Windows\System32\drivers\nwifi.sys
2008-01-12 15:24 . 2008-01-12 15:24 109,624 --a------ C:\Windows\System32\drivers\ataport.sys
2008-01-12 15:24 . 2008-01-12 15:24 45,112 --a------ C:\Windows\System32\drivers\pciidex.sys
2008-01-12 15:24 . 2008-01-12 15:24 21,560 --a------ C:\Windows\System32\drivers\atapi.sys
2008-01-12 15:24 . 2008-01-12 15:24 17,464 --a------ C:\Windows\System32\drivers\intelide.sys
2008-01-12 15:23 . 2008-01-12 15:23 11,776 --a------ C:\Windows\System32\sbunattend.exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-02-10 22:04 --------- d-----w C:\Users\agniesia\AppData\Roaming\Azureus
2008-02-10 16:57 --------- d-----w C:\Program Files\Ascentive
2008-02-08 21:50 --------- d-----w C:\Program Files\ESET
2008-02-03 09:45 --------- d-----w C:\Program Files\Nero
2008-02-03 09:12 --------- d-----w C:\ProgramData\Nero
2008-01-26 12:55 716,272 ----a-w C:\Windows\system32\drivers\sptd.sys
2008-01-24 20:07 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-01-13 02:08 --------- d-----w C:\Program Files\Windows Mail
2008-01-12 14:47 --------- d-----w C:\Program Files\Windows Sidebar
2008-01-12 14:24 537,600 ----a-w C:\Windows\AppPatch\AcLayers.dll
2008-01-12 14:24 449,024 ----a-w C:\Windows\AppPatch\AcSpecfc.dll
2008-01-12 14:24 2,143,744 ----a-w C:\Windows\AppPatch\AcGenral.dll
2008-01-12 14:24 173,056 ----a-w C:\Windows\AppPatch\AcXtrnal.dll
2008-01-04 21:59 524,288 ----a-w C:\Windows\System32\DivXsm.exe
2008-01-04 21:58 3,596,288 ----a-w C:\Windows\System32\qt-dx331.dll
2008-01-04 21:58 200,704 ----a-w C:\Windows\System32\ssldivx.dll
2008-01-04 21:58 1,044,480 ----a-w C:\Windows\System32\libdivx.dll
2008-01-04 21:57 823,296 ----a-w C:\Windows\System32\divx_xx0c.dll
2008-01-04 21:57 823,296 ----a-w C:\Windows\System32\divx_xx07.dll
2008-01-04 21:57 81,920 ----a-w C:\Windows\System32\dpl100.dll
2008-01-04 21:57 802,816 ----a-w C:\Windows\System32\divx_xx11.dll
2008-01-04 21:57 682,496 ----a-w C:\Windows\System32\DivX.dll
2008-01-04 21:57 593,920 ----a-w C:\Windows\System32\dpuGUI11.dll
2008-01-04 21:57 57,344 ----a-w C:\Windows\System32\dpv11.dll
2008-01-04 21:57 53,248 ----a-w C:\Windows\System32\dpuGUI10.dll
2008-01-04 21:57 344,064 ----a-w C:\Windows\System32\dpus11.dll
2008-01-04 21:57 294,912 ----a-w C:\Windows\System32\dpu11.dll
2008-01-04 21:57 294,912 ----a-w C:\Windows\System32\dpu10.dll
2008-01-04 21:57 196,608 ----a-w C:\Windows\System32\dtu100.dll
2008-01-04 21:56 156,992 ----a-w C:\Windows\System32\DivXCodecVersionChecker.exe
2008-01-04 21:56 12,288 ----a-w C:\Windows\System32\DivXWMPExtType.dll
2007-12-27 19:10 --------- d-----w C:\Users\agniesia\AppData\Roaming\uTorrent
2007-12-25 19:13 --------- d-----w C:\ProgramData\Symantec
2007-12-25 19:13 --------- d-----w C:\Program Files\Common Files\Symantec Shared
2007-12-15 19:33 43,520 ----a-w C:\Windows\System32\CmdLineExt03.dll
2007-12-15 02:06 9,728 ----a-w C:\Windows\System32\LAPRXY.DLL
2007-12-15 02:06 223,232 ----a-w C:\Windows\System32\WMASF.DLL
2007-12-15 02:06 1,327,104 ----a-w C:\Windows\System32\quartz.dll
2007-12-15 02:05 824,832 ----a-w C:\Windows\System32\wininet.dll
2007-12-15 02:05 56,320 ----a-w C:\Windows\System32\iesetup.dll
2007-12-15 02:05 52,736 ----a-w C:\Windows\AppPatch\iebrshim.dll
2007-12-15 02:05 26,624 ----a-w C:\Windows\System32\ieUnatt.exe
2007-12-15 02:04 84,992 ----a-w C:\Windows\system32\drivers\srvnet.sys
2007-12-15 02:04 58,368 ----a-w C:\Windows\system32\drivers\mrxsmb20.sys
2007-12-15 02:04 130,048 ----a-w C:\Windows\system32\drivers\srv2.sys
2007-12-15 02:04 101,888 ----a-w C:\Windows\system32\drivers\mrxsmb.sys
2007-12-15 02:02 3,504,824 ----a-w C:\Windows\System32\ntkrnlpa.exe
2007-12-15 02:02 3,470,520 ----a-w C:\Windows\System32\ntoskrnl.exe
2007-11-13 20:57 704,000 ----a-w C:\Windows\System32\PhotoScreensaver.scr
2007-11-13 20:57 67,584 ----a-w C:\Windows\System32\wlanhlp.dll
2007-11-13 20:57 542,720 ----a-w C:\Windows\System32\sysmain.dll
2007-11-13 20:57 502,784 ----a-w C:\Windows\System32\wlansvc.dll
2007-11-13 20:57 47,104 ----a-w C:\Windows\System32\wlanapi.dll
2007-11-13 20:57 297,984 ----a-w C:\Windows\System32\wlansec.dll
2007-11-13 20:57 290,816 ----a-w C:\Windows\System32\wlanmsm.dll
2007-11-13 20:57 24,064 ----a-w C:\Windows\System32\wtsapi32.dll
2007-11-13 20:57 2,923,520 ----a-w C:\Windows\explorer.exe
2007-11-13 20:57 2,027,008 ----a-w C:\Windows\System32\win32k.sys
2007-11-13 20:55 8,704 ----a-w C:\Windows\System32\hcrstco.dll
2007-11-13 20:55 8,704 ----a-w C:\Windows\System32\hccoin.dll
2007-08-30 20:11 174 --sha-w C:\Program Files\desktop.ini
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="C:\Program Files\Windows Sidebar\sidebar.exe" [2008-01-12 15:23 1232896]
"WindowsWelcomeCenter"="oobefldr.dll" [2006-11-02 13:34 2159104 C:\Windows\System32\oobefldr.dll]
"TOSCDSPD"="C:\Program Files\TOSHIBA\TOSCDSPD\TOSCDSPD.exe" [2006-11-13 15:49 413696]
"WMPNSCFG"="C:\Program Files\Windows Media Player\WMPNSCFG.exe" [2006-11-02 13:34 201728]
"Performance Center"="C:\Program Files\Ascentive\Performance Center\APCMain.exe" [ ]
"AlcoholAutomount"="C:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe" [2007-12-22 08:20 222080]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [2007-08-07 19:51 1006264]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0\bin\jusched.exe" [2007-01-04 07:18 77824]
"NvSvc"="C:\Windows\system32\nvsvc.dll" [2006-12-07 20:25 90191]
"NvCplDaemon"="C:\Windows\system32\NvCpl.dll" [2006-12-07 20:25 7766016]
"NvMediaCenter"="C:\Windows\system32\NvMcTray.dll" [2006-12-07 20:25 81920]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2006-10-27 13:50 815104]
"RtHDVCpl"="RtHDVCpl.exe" [2006-11-07 14:50 3772416 C:\Windows\RtHDVCpl.exe]
"NDSTray.exe"="NDSTray.exe" []
"IgfxTray"="C:\Windows\system32\igfxtray.exe" [2006-11-06 09:02 98304]
"HotKeysCmds"="C:\Windows\system32\hkcmd.exe" [2006-11-06 09:05 106496]
"Persistence"="C:\Windows\system32\igfxpers.exe" [2006-11-06 09:02 81920]
"HSON"="C:\Program Files\TOSHIBA\TBS\HSON.exe" [2006-12-07 16:49 55416]
"00TCrdMain"="C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe" [2006-12-11 17:27 530552]
"TPwrMain"="C:\Program Files\TOSHIBA\Power Saver\TPwrMain.EXE" [2006-12-02 12:14 409264]
"nod32kui"="C:\Program Files\Eset\nod32kui.exe" [2007-11-06 19:33 949376]
"GrooveMonitor"="C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-27 00:47 31016]
"NWEReboot"="" []
"Performance Center"="C:\Program Files\Ascentive\Performance Center\ApcMain.exe" [ ]
"MSConfig"="C:\Windows\system32\msconfig.exe" [2006-11-02 10:45 222208]
"NeroFilterCheck"="C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" [2007-03-01 15:57 153136]
"ISTray"="C:\Program Files\Spyware Doctor\pctsTray.exe" [2007-12-10 14:53 1103752]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"Nokia.PCSync"="E:\PROGRAMY\Nokia PC Suite 6\PcSync2.exe" [2007-06-19 09:17 1241088]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\72ee4caa]
--------- 2008-02-11 16:42 86080 C:\Users\agniesia\AppData\Local\Temp\hqxekjdj.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\cmds]
--a------ 2008-02-06 21:19 334336 C:\Users\agniesia\AppData\Local\Temp\iifec.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MS Juan]
--------- 2008-02-11 16:42 93248 C:\Users\agniesia\AppData\Local\Temp\kutqoxai.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSServer]
--a------ 2008-02-03 10:26 39936 C:\Users\agniesia\AppData\Local\Temp\urspo.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SmoothView]
--a------ 2007-01-02 16:02 493112 C:\Program Files\Toshiba\SmoothView\SmoothView.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\topi]
--a------ 2006-12-15 17:11 577536 C:\Program Files\TOSHIBA\Toshiba Online Product Information\topi.exe

R2 TOSHIBA Bluetooth Service;TOSHIBA Bluetooth Service;C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe [2007-02-25 20:55]
R3 FwLnk;FwLnk Driver;C:\Windows\system32\DRIVERS\FwLnk.sys [2006-11-19 22:11]
R3 igfx;igfx;C:\Windows\system32\DRIVERS\igdkmd32.sys [2006-11-06 10:29]
R3 NETw3v32;Sterownik karty Intel(R) PRO/Wireless 3945ABG dla systemu Windows Vista 32 Bit;C:\Windows\system32\DRIVERS\NETw3v32.sys [2006-10-30 09:42]
R3 tdcmdpst;TOSHIBA Writing Engine Filter Driver;C:\Windows\system32\DRIVERS\tdcmdpst.sys [2006-10-18 11:50]
R3 tosrfec;Bluetooth ACPI;C:\Windows\system32\DRIVERS\tosrfec.sys [2006-10-23 16:32]
S3 BTCAMDRV;Mobiola Web Camera driver;C:\Windows\system32\DRIVERS\BTCamDrv.sys [2006-11-01 18:45]
S4 KR10I;KR10I;C:\Windows\system32\drivers\kr10i.sys [2006-02-14 18:50]
S4 KR10N;KR10N;C:\Windows\system32\drivers\kr10n.sys [2006-02-14 18:41]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceNoNetwork REG_MULTI_SZ PLA DPS BFE mpssvc
bthsvcs REG_MULTI_SZ BthServ

.
Contents of the 'Scheduled Tasks' folder
"2008-02-11 17:11:14 C:\Windows\Tasks\User_Feed_Synchronization-{7EF5CC87-B7E2-45CF-82EB-C3E2E5868936}.job"
- C:\Windows\system32\msfeedssync.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-11 18:36:31
Windows 6.0.6000 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

HKCU\Software\Microsoft\Windows\CurrentVersion\Run
TOSCDSPD = C:\Program Files\TOSHIBA\TOSCDSPD\TOSCDSPD.exe?/i??????????s?????? ???X?????????

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-02-11 18:37:36
ComboFix-quarantined-files.txt 2008-02-11 17:37:32
.
2008-02-08 17:46:55 --- E O F ---

**Posty:** 18165 · przez **wojtas** 11 Lut 2008, 19:54

wydaje sie byc czysto

**Posty:** 3854 · przez **Dzi@dek** 11 Lut 2008, 20:02

Start-uruchom: wpisz -> msconfig [enter]
Zakładka uruchamianie - odznacz zbędne programy w autostarcie.

**Posty:** 16 · przez **polimer43** 11 Lut 2008, 20:07

z konfiguracji systemu przy uruchamianiu wyłączyłem

Kod: Zaznacz wszystko: rundll32.exe "C:\Users\agniesia\AppData\Local\Temp\hqxekjdj.dll",b rundll32.exe "C:\Users\agniesia\AppData\Local\Temp\iifec.dll,c rundll32.exe "C:\Users\agniesia\AppData\Local\Temp\kutqoxai.dll",run rundll32.exe "C:\Users\agniesia\AppData\Local\Temp\urspo.dll,#1

**Posty:** 3854 · przez **Dzi@dek** 11 Lut 2008, 20:11

[NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
[WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
[AlcoholAutomount] "C:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe" /automount
[Nokia.PCSync] E:\PROGRAMY\Nokia PC Suite 6\PcSync2.exe /NoDialog (User 'SYSTEM')
[Nokia.PCSync] E:\PROGRAMY\Nokia PC Suite 6\PcSync2.exe /NoDialog (User 'Default user')

To też możesz wyłączyć.

**Posty:** 16 · przez **polimer43** 11 Lut 2008, 22:30

nowy log

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 21:06:39, on 2008-02-11 Platform: Windows Vista (WinNT 6.00.1904) MSIE: Internet Explorer v7.00 (7.00.6000.16575) Boot mode: Normal Running processes: C:\Windows\system32\taskeng.exe C:\Windows\system32\Dwm.exe C:\Windows\Explorer.EXE C:\Program Files\Windows Defender\MSASCui.exe C:\Program Files\Java\jre1.6.0\bin\jusched.exe C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\Windows\RtHDVCpl.exe C:\Program Files\TOSHIBA\ConfigFree\NDSTray.exe C:\Windows\System32\hkcmd.exe C:\Windows\System32\igfxpers.exe C:\Program Files\Synaptics\SynTP\SynToshiba.exe C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe C:\Program Files\TOSHIBA\Power Saver\TPwrMain.exe C:\Windows\System32\rundll32.exe C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe C:\Program Files\Spyware Doctor\pctsTray.exe C:\Program Files\Windows Sidebar\sidebar.exe C:\Program Files\TOSHIBA\TOSCDSPD\TOSCDSPD.exe C:\Windows\System32\rundll32.exe C:\Windows\System32\rundll32.exe C:\Windows\System32\rundll32.exe C:\Windows\System32\rundll32.exe C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe E:\Program Files\Trend Micro\HijackThis\HijackThis.exe C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe C:\Program Files\TOSHIBA\ConfigFree\CFSwMgr.exe C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHsp.exe C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosAVRC.exe C:\Program Files\Toshiba\Bluetooth Toshiba Stack\tosOBEX.exe C:\Program Files\TOSHIBA\Bluetooth Toshiba Stack\TosBtProc.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.pl/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 O1 - Hosts: ::1 localhost O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0\bin\ssv.dll O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0\bin\jusched.exe" O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe O4 - HKLM\..\Run: [NDSTray.exe] NDSTray.exe O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe O4 - HKLM\..\Run: [HSON] C:\Program Files\TOSHIBA\TBS\HSON.exe O4 - HKLM\..\Run: [00TCrdMain] C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe O4 - HKLM\..\Run: [TPwrMain] C:\Program Files\TOSHIBA\Power Saver\TPwrMain.EXE O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" O4 - HKLM\..\Run: [Performance Center] C:\Program Files\Ascentive\Performance Center\ApcMain.exe -m O4 - HKLM\..\Run: [MSConfig] "C:\Windows\system32\msconfig.exe" /auto O4 - HKLM\..\Run: [ISTray] "C:\Program Files\Spyware Doctor\pctsTray.exe" O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun O4 - HKCU\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter O4 - HKCU\..\Run: [TOSCDSPD] C:\Program Files\TOSHIBA\TOSCDSPD\TOSCDSPD.exe O4 - HKCU\..\Run: [Performance Center] C:\Program Files\Ascentive\Performance Center\APCMain.exe -m O4 - HKCU\..\Run: [MSServer] rundll32.exe C:\Users\agniesia\AppData\Local\Temp\urspo.dll,#1 O4 - HKCU\..\Run: [MS Juan] rundll32 "C:\Users\agniesia\AppData\Local\Temp\kutqoxai.dll",run O4 - HKCU\..\Run: [cmds] rundll32.exe C:\Users\agniesia\AppData\Local\Temp\iifec.dll,c O4 - HKCU\..\Run: [72ee4caa] rundll32.exe "C:\Users\agniesia\AppData\Local\Temp\hqxekjdj.dll",b O4 - HKUS\S-1-5-18\..\Run: [Nokia.PCSync] E:\PROGRAMY\Nokia PC Suite 6\PcSync2.exe /NoDialog (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [Nokia.PCSync] E:\PROGRAMY\Nokia PC Suite 6\PcSync2.exe /NoDialog (User 'Default user') O4 - Global Startup: Bluetooth Manager.lnk = ? O8 - Extra context menu item: E&ksportuj do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0\bin\npjpi160.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0\bin\npjpi160.dll O9 - Extra button: Wyślij do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra 'Tools' menuitem: Wyślij &do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL O9 - Extra button: eBay - {C08CAF1D-C0A3-40D5-9970-06D067EAC017} - http://www.webtip.ch/cgi-bin/toshiba/tracker_url.pl?PL (file missing) O13 - Gopher Prefix: O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.pl/resources/virusscanner/kavwebscan_unicode.cab O16 - DPF: {3D8700FB-86A4-4CB4-B738-6F0FC016AC7D} (MainControl Class) - http://slimak.onet.pl/_m/wirusy/ArcaOnline.cab O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL O23 - Service: Agere Modem Call Progress Audio (AgereModemAudio) - Agere Systems - C:\Windows\system32\agrsmsvc.exe O23 - Service: ConfigFree Service (CFSvcs) - TOSHIBA CORPORATION - C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing) O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe O23 - Service: TOSHIBA Optical Disc Drive Service (TODDSrv) - TOSHIBA Corporation - C:\Windows\system32\TODDSrv.exe O23 - Service: TOSHIBA Power Saver (TosCoSrv) - TOSHIBA Corporation - C:\Program Files\TOSHIBA\Power Saver\TosCoSrv.exe O23 - Service: TOSHIBA Bluetooth Service - TOSHIBA CORPORATION - C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe -- End of file - 8117 bytes

**Posty:** 18165 · przez **wojtas** 11 Lut 2008, 22:54

skasuj :

O1 - Hosts: ::1 localhost

i bedzie ok

**Posty:** 16 · przez **polimer43** 11 Lut 2008, 23:47

skasowałem,system uruchomił się szybciej ale pojawiły się cztery okna z nagłówkiem RunDll :
1. wystąpił błąd podczas ładowania c:\users\agniesia\AppData\local\temp\hqxekjdj.dll
nie można odnależć określonego modułu
2. wystąpił błąd podczas ładowania c:\users\agniesia\AppData\local\temp\iifec.dll
nie można odnależć określonego modułu
3.wystąpił błąd podczas ładowania
c:\users\agniesia\AppData\local\temp\kutqoxai.dll
nie można odnależć określonego modułu
4.wystąpił błąd podczas ładowania
C:\Users\agniesia\AppData\Local\Temp\urspo.dll,#1
nie można odnależć określonego modułu

co oznaczają te komunikaty w/w są z czerwonym kółkiem i białym krzyżykiem

[code][/code][code]

**Posty:** 3854 · przez **Dzi@dek** 11 Lut 2008, 23:55

O4 - HKCU\..\Run: [MSServer] rundll32.exe C:\Users\agniesia\AppData\Local\Temp\urspo.dll,#1
O4 - HKCU\..\Run: [MS Juan] rundll32 "C:\Users\agniesia\AppData\Local\Temp\kutqoxai.dll",run
O4 - HKCU\..\Run: [cmds] rundll32.exe C:\Users\agniesia\AppData\Local\Temp\iifec.dll,c
O4 - HKCU\..\Run: [72ee4caa] rundll32.exe "C:\Users\agniesia\AppData\Local\Temp\hqxekjdj.dll",b

Usuń te wpisy w hijackthis i wyczyść folder temp:
C:\Users\agniesia\AppData\Local\Temp

**Posty:** 16 · przez **polimer43** 12 Lut 2008, 01:11

w/w wymieniony problem zostal rozwiązany. bardzo dziękuję.
pojawił się nowy komunikat
windows internet explorer:
nie można odnależć ,,::{2559A1F4-21D7-11D4-BDAF-00C04F60B9F0}".upewnij się, że lub adres internetowy jest poprawny.

**Posty:** 3854 · przez **Dzi@dek** 12 Lut 2008, 10:45

Pokaż log z hijackthis, [url=http://www.silentrunners.org/Silent%20Runners.vbs]Silent Runners (prawoklik na link -> Zapisz element docelowy jako .../Zapisz jako ...).
[/url] oraz z L2MFix wykonanego z opcji 1.

**Posty:** 16 · przez **polimer43** 12 Lut 2008, 17:57

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 16:37:39, on 2008-02-12 Platform: Windows Vista (WinNT 6.00.1904) MSIE: Internet Explorer v7.00 (7.00.6000.16575) Boot mode: Normal Running processes: C:\Windows\system32\taskeng.exe C:\Windows\system32\Dwm.exe C:\Windows\Explorer.EXE C:\Program Files\Windows Defender\MSASCui.exe C:\Program Files\Java\jre1.6.0\bin\jusched.exe C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\Windows\RtHDVCpl.exe C:\Windows\System32\rundll32.exe C:\Program Files\TOSHIBA\ConfigFree\NDSTray.exe C:\Windows\System32\hkcmd.exe C:\Windows\System32\igfxpers.exe C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe C:\Program Files\TOSHIBA\Power Saver\TPwrMain.exe C:\Program Files\Synaptics\SynTP\SynToshiba.exe C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe C:\Program Files\Spyware Doctor\pctsTray.exe C:\Program Files\Windows Sidebar\sidebar.exe C:\Program Files\TOSHIBA\TOSCDSPD\TOSCDSPD.exe C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe C:\Program Files\TOSHIBA\ConfigFree\CFSwMgr.exe C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe C:\Program Files\Internet Explorer\IEUser.exe C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHsp.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosAVRC.exe C:\Program Files\Toshiba\Bluetooth Toshiba Stack\tosOBEX.exe C:\Program Files\TOSHIBA\Bluetooth Toshiba Stack\TosBtProc.exe E:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.pl/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0\bin\ssv.dll O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0\bin\jusched.exe" O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe O4 - HKLM\..\Run: [NDSTray.exe] NDSTray.exe O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe O4 - HKLM\..\Run: [HSON] C:\Program Files\TOSHIBA\TBS\HSON.exe O4 - HKLM\..\Run: [00TCrdMain] C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe O4 - HKLM\..\Run: [TPwrMain] C:\Program Files\TOSHIBA\Power Saver\TPwrMain.EXE O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" O4 - HKLM\..\Run: [Performance Center] C:\Program Files\Ascentive\Performance Center\ApcMain.exe -m O4 - HKLM\..\Run: [MSConfig] "C:\Windows\system32\msconfig.exe" /auto O4 - HKLM\..\Run: [ISTray] "C:\Program Files\Spyware Doctor\pctsTray.exe" O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun O4 - HKCU\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter O4 - HKCU\..\Run: [TOSCDSPD] C:\Program Files\TOSHIBA\TOSCDSPD\TOSCDSPD.exe O4 - HKCU\..\Run: [Performance Center] C:\Program Files\Ascentive\Performance Center\APCMain.exe -m O4 - HKUS\S-1-5-18\..\Run: [Nokia.PCSync] E:\PROGRAMY\Nokia PC Suite 6\PcSync2.exe /NoDialog (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [Nokia.PCSync] E:\PROGRAMY\Nokia PC Suite 6\PcSync2.exe /NoDialog (User 'Default user') O4 - Global Startup: Bluetooth Manager.lnk = ? O8 - Extra context menu item: E&ksportuj do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0\bin\npjpi160.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0\bin\npjpi160.dll O9 - Extra button: Wyślij do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra 'Tools' menuitem: Wyślij &do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL O9 - Extra button: eBay - {C08CAF1D-C0A3-40D5-9970-06D067EAC017} - http://www.webtip.ch/cgi-bin/toshiba/tracker_url.pl?PL (file missing) O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.pl/resources/virusscanner/kavwebscan_unicode.cab O16 - DPF: {3D8700FB-86A4-4CB4-B738-6F0FC016AC7D} (MainControl Class) - http://slimak.onet.pl/_m/wirusy/ArcaOnline.cab O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL O23 - Service: Agere Modem Call Progress Audio (AgereModemAudio) - Agere Systems - C:\Windows\system32\agrsmsvc.exe O23 - Service: ConfigFree Service (CFSvcs) - TOSHIBA CORPORATION - C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing) O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe O23 - Service: TOSHIBA Optical Disc Drive Service (TODDSrv) - TOSHIBA Corporation - C:\Windows\system32\TODDSrv.exe O23 - Service: TOSHIBA Power Saver (TosCoSrv) - TOSHIBA Corporation - C:\Program Files\TOSHIBA\Power Saver\TosCoSrv.exe O23 - Service: TOSHIBA Bluetooth Service - TOSHIBA CORPORATION - C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe -- End of file - 7655 bytes

Kod: Zaznacz wszystko: "Silent Runners.vbs", revision 55, http://www.silentrunners.org/ Operating System: Windows Vista Output limited to non-default values, except where indicated by "{++}" Startup items buried in registry: --------------------------------- HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ {++} "Sidebar" = "C:\Program Files\Windows Sidebar\sidebar.exe /autoRun" [MS] "WindowsWelcomeCenter" = "rundll32.exe oobefldr.dll,ShowWelcomeCenter" [MS] "TOSCDSPD" = "C:\Program Files\TOSHIBA\TOSCDSPD\TOSCDSPD.exe" ["TOSHIBA"] "Performance Center" = "C:\Program Files\Ascentive\Performance Center\APCMain.exe -m" [file not found] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++} "Windows Defender" = "C:\Program Files\Windows Defender\MSASCui.exe -hide" "SunJavaUpdateSched" = ""C:\Program Files\Java\jre1.6.0\bin\jusched.exe"" ["Sun Microsystems, Inc."] "NvSvc" = "RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart" [MS] "NvCplDaemon" = "RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup" [MS] "NvMediaCenter" = "RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit" [MS] "SynTPEnh" = "C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" ["Synaptics, Inc."] "RtHDVCpl" = "RtHDVCpl.exe" ["Realtek Semiconductor"] "NDSTray.exe" = "NDSTray.exe" ["TOSHIBA CORPORATION"] "IgfxTray" = "C:\Windows\system32\igfxtray.exe" ["Intel Corporation"] "HotKeysCmds" = "C:\Windows\system32\hkcmd.exe" ["Intel Corporation"] "Persistence" = "C:\Windows\system32\igfxpers.exe" ["Intel Corporation"] "HSON" = "C:\Program Files\TOSHIBA\TBS\HSON.exe" ["TOSHIBA Corporation"] "00TCrdMain" = "C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe" [null data] "TPwrMain" = "C:\Program Files\TOSHIBA\Power Saver\TPwrMain.EXE" ["TOSHIBA Corporation"] "nod32kui" = ""C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE" ["Eset "] "GrooveMonitor" = ""C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"" [MS] "NWEReboot" = (empty string) [file not found] "Performance Center" = "C:\Program Files\Ascentive\Performance Center\ApcMain.exe -m" [file not found] "MSConfig" = ""C:\Windows\system32\msconfig.exe" /auto" [MS] "ISTray" = ""C:\Program Files\Spyware Doctor\pctsTray.exe"" ["PC Tools"] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\(Default) = (no title provided) -> {HKLM...CLSID} = "AcroIEHlprObj Class" \InProcServer32\(Default) = "C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll" ["Adobe Systems Incorporated"] {72853161-30C5-4D22-B7F9-0BBC1D38A37E}\(Default) = (no title provided) -> {HKLM...CLSID} = "Groove GFS Browser Helper" \InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL" [MS] {761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\(Default) = (no title provided) -> {HKLM...CLSID} = "SSVHelper Class" \InProcServer32\(Default) = "C:\Program Files\Java\jre1.6.0\bin\ssv.dll" ["Sun Microsystems, Inc."] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\ "{00020d75-0000-0000-c000-000000000046}" = "Microsoft Office Outlook Desktop Icon Handler" -> {HKLM...CLSID} = "Microsoft Office Outlook" \InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\Office12\MLSHEXT.DLL" [MS] "{A70C977A-BF00-412C-90B7-034C51DA2439}" = "NvCpl DesktopContext Class" -> {HKLM...CLSID} = "DesktopContext Class" \InProcServer32\(Default) = "C:\Windows\system32\nvcpl.dll" ["NVIDIA Corporation"] "{FFB699E0-306A-11d3-8BD1-00104B6F7516}" = "Play on my TV helper" -> {HKLM...CLSID} = "NVIDIA CPL Extension" \InProcServer32\(Default) = "C:\Windows\system32\nvcpl.dll" ["NVIDIA Corporation"] "{2F603045-309F-11CF-9774-0020AFD0CFF6}" = "Synaptics Control Panel" -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "C:\Program Files\Synaptics\SynTP\SynTPCpl.dll" ["Synaptics, Inc."] "{416651E4-9C3C-11D9-8BDE-F66BAD1E3F3A}" = "Nokia Phone Browser" -> {HKLM...CLSID} = "Nokia Phone Browser" \InProcServer32\(Default) = "E:\PROGRAMY\Nokia PC Suite 6\PhoneBrowser.dll" ["Nokia"] "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" = "WinRAR shell extension" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] "{AD392E40-428C-459F-961E-9B147782D099}" = "UltraISO" -> {HKLM...CLSID} = "UIContextMenu Class" \InProcServer32\(Default) = "E:\PROGRAMY\UltraISO\isoshell.dll" ["EZB Systems, Inc."] "{45C6AFA5-2C13-402f-BC5D-45CC8172EF6B}" = "Bluetooth" -> {HKCU...CLSID} = "Wymiana informacji - Bluetooth" \InProcServer32\(Default) = "C:\Windows\system32\TosBtExt.dll" ["TOSHIBA"] -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "C:\Windows\system32\TosBtExt.dll" ["TOSHIBA"] "{B089FE88-FB52-11D3-BDF1-0050DA34150D}" = "NOD32 Context Menu Shell Extension" -> {HKLM...CLSID} = "NOD32 Context Menu Shell Extension" \InProcServer32\(Default) = "C:\Program Files\Eset\nodshex.dll" [null data] "{72853161-30C5-4D22-B7F9-0BBC1D38A37E}" = "Groove GFS Browser Helper" -> {HKLM...CLSID} = "Groove GFS Browser Helper" \InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL" [MS] "{2A541AE1-5BF6-4665-A8A3-CFA9672E4291}" = "Groove GFS Explorer Bar" -> {HKLM...CLSID} = "Groove Folder Synchronization" \InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL" [MS] "{A449600E-1DC6-4232-B948-9BD794D62056}" = "Groove GFS Stub Icon Handler" -> {HKLM...CLSID} = "Groove GFS Stub Icon Handler" \InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL" [MS] "{B5A7F190-DDA6-4420-B3BA-52453494E6CD}" = "Groove GFS Stub Execution Hook" -> {HKLM...CLSID} = "Groove GFS Stub Execution Hook" \InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL" [MS] "{6C467336-8281-4E60-8204-430CED96822D}" = "Groove GFS Context Menu Handler" -> {HKLM...CLSID} = "Groove GFS Context Menu Handler" \InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL" [MS] "{387E725D-DC16-4D76-B310-2C93ED4752A0}" = "Groove XML Icon Handler" -> {HKLM...CLSID} = "Groove XML Icon Handler" \InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL" [MS] "{16F3DD56-1AF5-4347-846D-7C10C4192619}" = "Groove Explorer Icon Overlay 3 (GFS Folder)" -> {HKLM...CLSID} = "Groove Explorer Icon Overlay 3 (GFS Folder)" \InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL" [MS] "{AB5C5600-7E6E-4B06-9197-9ECEF74D31CC}" = "Groove Explorer Icon Overlay 2 (GFS Stub)" -> {HKLM...CLSID} = "Groove Explorer Icon Overlay 2 (GFS Stub)" \InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL" [MS] "{2916C86E-86A6-43FE-8112-43ABE6BF8DCC}" = "Groove Explorer Icon Overlay 4 (GFS Unread Mark)" -> {HKLM...CLSID} = "Groove Explorer Icon Overlay 4 (GFS Unread Mark)" \InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL" [MS] "{99FD978C-D287-4F50-827F-B2C658EDA8E7}" = "Groove Explorer Icon Overlay 1 (GFS Unread Stub)" -> {HKLM...CLSID} = "Groove Explorer Icon Overlay 1 (GFS Unread Stub)" \InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL" [MS] "{920E6DB1-9907-4370-B3A0-BAFC03D81399}" = "Groove Explorer Icon Overlay 2.5 (GFS Unread Folder)" -> {HKLM...CLSID} = "Groove Explorer Icon Overlay 2.5 (GFS Unread Folder)" \InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL" [MS] "{0006F045-0000-0000-C000-000000000046}" = "Microsoft Office Outlook Custom Icon Handler" -> {HKLM...CLSID} = "Outlook File Icon Extension" \InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\Office12\OLKFSTUB.DLL" [MS]

L2MFix nie chce działać

**Posty:** 18165 · przez **wojtas** 12 Lut 2008, 19:49

daj screena z bledu

oraz nowy log z combofixa

**Posty:** 16 · przez **polimer43** 12 Lut 2008, 22:27

nie potrafię wkleić screena

**Posty:** 18165 · przez **wojtas** 12 Lut 2008, 22:30

naciskasz print screen na klawiaturze(obok scroll lock'a) otwierasz paint i ctrl+v. zapisujesz najlepiej pod rozszerzeniem png lub jpeg i wrzucasz na www.up.programosy.pl . bierzesz linki z opcji miniaturka na forum

**Posty:** 16 · przez **polimer43** 12 Lut 2008, 23:14

Kod: Zaznacz wszystko: <a href='http://www.up.programosy.pl/foto/bez_tytulu_37.png'><img src='http://www.up.programosy.pl/foto/bez_tytulu_37_min.png'></a>

log z combofixa

Kod: Zaznacz wszystko: ComboFix 08-02-11.2 - agniesia 2008-02-12 21:37:04.2 - NTFSx86 Microsoft® Windows Vista™ Home Basic 6.0.6000.0.1250.1.1045.18.199 [GMT 1:00] Running from: E:\DOWLAND\ComboFix.exe . ((((((((((((((((((((((((( Files Created from 2008-01-12 to 2008-02-12 ))))))))))))))))))))))))))))))) . 2008-02-10 17:58 . 2008-02-10 17:58 <DIR> d-------- C:\Users\agniesia\AppData\Roaming\InstallShield 2008-02-08 20:00 . 2008-02-08 20:00 <DIR> d-------- C:\Windows\System32\Kaspersky Lab 2008-02-08 18:57 . 2008-02-12 17:26 <DIR> d-a------ C:\Users\All Users\TEMP 2008-02-08 18:57 . 2008-02-08 18:57 <DIR> d-------- C:\Users\agniesia\AppData\Roaming\PC Tools 2008-02-08 18:57 . 2008-02-12 17:26 <DIR> d-a------ C:\ProgramData\TEMP 2008-02-08 18:57 . 2008-02-11 18:21 <DIR> d-------- C:\Program Files\Spyware Doctor 2008-02-08 18:57 . 2007-12-10 14:53 81,288 --a------ C:\Windows\System32\drivers\iksyssec.sys 2008-02-08 18:57 . 2007-12-10 14:53 66,952 --a------ C:\Windows\System32\drivers\iksysflt.sys 2008-02-08 18:57 . 2007-12-10 14:53 41,864 --a------ C:\Windows\System32\drivers\ikfilesec.sys 2008-02-08 18:57 . 2007-12-10 14:53 29,576 --a------ C:\Windows\System32\drivers\kcom.sys 2008-02-05 23:20 . 2008-02-05 23:20 <DIR> d-------- C:\Program Files\Common Files\PX Storage Engine 2008-02-03 11:23 . 2008-02-03 11:25 <DIR> d-------- C:\Users\All Users\DVD Shrink 2008-02-03 11:23 . 2008-02-03 11:25 <DIR> d-------- C:\ProgramData\DVD Shrink 2008-02-02 22:44 . 2008-02-02 22:44 <DIR> d-------- C:\Users\agniesia\AppData\Roaming\Uniblue 2008-02-02 19:08 . 2008-02-02 19:08 <DIR> d-------- C:\CloneDVDTemp 2008-01-31 16:02 . 2008-01-31 16:02 <DIR> d-------- C:\Users\agniesia\AppData\Roaming\Ulead Systems 2008-01-26 21:05 . 2008-01-26 21:05 <DIR> d-------- C:\Users\All Users\Elaborate Bytes 2008-01-26 21:05 . 2008-01-26 21:05 <DIR> d-------- C:\ProgramData\Elaborate Bytes 2008-01-26 18:49 . 2008-01-26 21:05 48 ---hs---- C:\Windows\SF81F17C3.tmp 2008-01-26 18:34 . 2008-01-26 18:34 <DIR> d-------- C:\Program Files\Elaborate Bytes 2008-01-26 18:13 . 2008-01-26 18:13 <DIR> d-------- C:\Users\All Users\Ahead 2008-01-26 18:13 . 2008-01-26 18:13 <DIR> d-------- C:\ProgramData\Ahead 2008-01-26 14:43 . 2008-01-26 14:43 <DIR> d-------- C:\Program Files\Alcohol Soft 2008-01-26 14:30 . 2008-01-26 14:30 0 --a------ C:\Windows\Irremote.ini 2008-01-26 14:00 . 2008-01-26 14:00 <DIR> d-------- C:\Users\agniesia\AppData\Roaming\DAEMON Tools 2008-01-20 23:29 . 2008-01-26 14:35 <DIR> d-------- C:\Program Files\Common Files\Nero 2008-01-13 03:01 . 2008-01-13 03:01 802,816 --a------ C:\Windows\System32\drivers\tcpip.sys 2008-01-13 03:01 . 2008-01-13 03:01 216,760 --a------ C:\Windows\System32\drivers\netio.sys 2008-01-13 03:01 . 2008-01-13 03:01 167,424 --a------ C:\Windows\System32\tcpipcfg.dll 2008-01-13 03:01 . 2008-01-13 03:01 24,064 --a------ C:\Windows\System32\netcfg.exe 2008-01-13 03:01 . 2008-01-13 03:01 22,016 --a------ C:\Windows\System32\netiougc.exe 2008-01-12 19:14 . 2008-01-26 18:19 <DIR> d-------- C:\Users\agniesia\AppData\Roaming\Ahead 2008-01-12 19:08 . 2008-02-03 10:16 <DIR> d-------- C:\Program Files\Common Files\Ahead 2008-01-12 15:24 . 2008-01-12 15:24 4,247,552 --a------ C:\Windows\System32\GameUXLegacyGDFs.dll 2008-01-12 15:24 . 2008-01-12 15:24 1,686,016 --a------ C:\Windows\System32\gameux.dll 2008-01-12 15:24 . 2008-01-12 15:24 1,060,920 --a------ C:\Windows\System32\drivers\ntfs.sys 2008-01-12 15:24 . 2008-01-12 15:24 211,000 --a------ C:\Windows\System32\drivers\volsnap.sys 2008-01-12 15:24 . 2008-01-12 15:24 154,624 --a------ C:\Windows\System32\drivers\nwifi.sys 2008-01-12 15:24 . 2008-01-12 15:24 109,624 --a------ C:\Windows\System32\drivers\ataport.sys 2008-01-12 15:24 . 2008-01-12 15:24 45,112 --a------ C:\Windows\System32\drivers\pciidex.sys 2008-01-12 15:24 . 2008-01-12 15:24 21,560 --a------ C:\Windows\System32\drivers\atapi.sys 2008-01-12 15:24 . 2008-01-12 15:24 17,464 --a------ C:\Windows\System32\drivers\intelide.sys 2008-01-12 15:23 . 2008-01-12 15:23 11,776 --a------ C:\Windows\System32\sbunattend.exe . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-02-12 20:39 --------- d-----w C:\Users\agniesia\AppData\Roaming\Azureus 2008-02-10 16:57 --------- d-----w C:\Program Files\Ascentive 2008-02-08 21:50 --------- d-----w C:\Program Files\ESET 2008-02-03 09:45 --------- d-----w C:\Program Files\Nero 2008-02-03 09:12 --------- d-----w C:\ProgramData\Nero 2008-01-26 12:55 716,272 ----a-w C:\Windows\system32\drivers\sptd.sys 2008-01-24 20:07 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-01-13 02:08 --------- d-----w C:\Program Files\Windows Mail 2008-01-12 14:47 --------- d-----w C:\Program Files\Windows Sidebar 2008-01-12 14:24 537,600 ----a-w C:\Windows\AppPatch\AcLayers.dll 2008-01-12 14:24 449,024 ----a-w C:\Windows\AppPatch\AcSpecfc.dll 2008-01-12 14:24 2,143,744 ----a-w C:\Windows\AppPatch\AcGenral.dll 2008-01-12 14:24 173,056 ----a-w C:\Windows\AppPatch\AcXtrnal.dll 2008-01-04 21:59 524,288 ----a-w C:\Windows\System32\DivXsm.exe 2008-01-04 21:58 3,596,288 ----a-w C:\Windows\System32\qt-dx331.dll 2008-01-04 21:58 200,704 ----a-w C:\Windows\System32\ssldivx.dll 2008-01-04 21:58 1,044,480 ----a-w C:\Windows\System32\libdivx.dll 2008-01-04 21:57 823,296 ----a-w C:\Windows\System32\divx_xx0c.dll 2008-01-04 21:57 823,296 ----a-w C:\Windows\System32\divx_xx07.dll 2008-01-04 21:57 81,920 ----a-w C:\Windows\System32\dpl100.dll 2008-01-04 21:57 802,816 ----a-w C:\Windows\System32\divx_xx11.dll 2008-01-04 21:57 682,496 ----a-w C:\Windows\System32\DivX.dll 2008-01-04 21:57 593,920 ----a-w C:\Windows\System32\dpuGUI11.dll 2008-01-04 21:57 57,344 ----a-w C:\Windows\System32\dpv11.dll 2008-01-04 21:57 53,248 ----a-w C:\Windows\System32\dpuGUI10.dll 2008-01-04 21:57 344,064 ----a-w C:\Windows\System32\dpus11.dll 2008-01-04 21:57 294,912 ----a-w C:\Windows\System32\dpu11.dll 2008-01-04 21:57 294,912 ----a-w C:\Windows\System32\dpu10.dll 2008-01-04 21:57 196,608 ----a-w C:\Windows\System32\dtu100.dll 2008-01-04 21:56 156,992 ----a-w C:\Windows\System32\DivXCodecVersionChecker.exe 2008-01-04 21:56 12,288 ----a-w C:\Windows\System32\DivXWMPExtType.dll 2007-12-27 19:10 --------- d-----w C:\Users\agniesia\AppData\Roaming\uTorrent 2007-12-25 19:13 --------- d-----w C:\ProgramData\Symantec 2007-12-25 19:13 --------- d-----w C:\Program Files\Common Files\Symantec Shared 2007-12-15 19:33 43,520 ----a-w C:\Windows\System32\CmdLineExt03.dll 2007-12-15 02:06 9,728 ----a-w C:\Windows\System32\LAPRXY.DLL 2007-12-15 02:06 223,232 ----a-w C:\Windows\System32\WMASF.DLL 2007-12-15 02:06 1,327,104 ----a-w C:\Windows\System32\quartz.dll 2007-12-15 02:05 824,832 ----a-w C:\Windows\System32\wininet.dll 2007-12-15 02:05 56,320 ----a-w C:\Windows\System32\iesetup.dll 2007-12-15 02:05 52,736 ----a-w C:\Windows\AppPatch\iebrshim.dll 2007-12-15 02:05 26,624 ----a-w C:\Windows\System32\ieUnatt.exe 2007-12-15 02:04 84,992 ----a-w C:\Windows\system32\drivers\srvnet.sys 2007-12-15 02:04 58,368 ----a-w C:\Windows\system32\drivers\mrxsmb20.sys 2007-12-15 02:04 130,048 ----a-w C:\Windows\system32\drivers\srv2.sys 2007-12-15 02:04 101,888 ----a-w C:\Windows\system32\drivers\mrxsmb.sys 2007-12-15 02:02 3,504,824 ----a-w C:\Windows\System32\ntkrnlpa.exe 2007-12-15 02:02 3,470,520 ----a-w C:\Windows\System32\ntoskrnl.exe 2007-11-13 20:57 704,000 ----a-w C:\Windows\System32\PhotoScreensaver.scr 2007-11-13 20:57 67,584 ----a-w C:\Windows\System32\wlanhlp.dll 2007-11-13 20:57 542,720 ----a-w C:\Windows\System32\sysmain.dll 2007-11-13 20:57 502,784 ----a-w C:\Windows\System32\wlansvc.dll 2007-11-13 20:57 47,104 ----a-w C:\Windows\System32\wlanapi.dll 2007-11-13 20:57 297,984 ----a-w C:\Windows\System32\wlansec.dll 2007-11-13 20:57 290,816 ----a-w C:\Windows\System32\wlanmsm.dll 2007-11-13 20:57 24,064 ----a-w C:\Windows\System32\wtsapi32.dll 2007-11-13 20:57 2,923,520 ----a-w C:\Windows\explorer.exe 2007-11-13 20:57 2,027,008 ----a-w C:\Windows\System32\win32k.sys 2007-11-13 20:55 8,704 ----a-w C:\Windows\System32\hcrstco.dll 2007-11-13 20:55 8,704 ----a-w C:\Windows\System32\hccoin.dll 2007-08-30 20:11 174 --sha-w C:\Program Files\desktop.ini . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Sidebar"="C:\Program Files\Windows Sidebar\sidebar.exe" [2008-01-12 15:23 1232896] "WindowsWelcomeCenter"="oobefldr.dll" [2006-11-02 13:34 2159104 C:\Windows\System32\oobefldr.dll] "TOSCDSPD"="C:\Program Files\TOSHIBA\TOSCDSPD\TOSCDSPD.exe" [2006-11-13 15:49 413696] "Performance Center"="C:\Program Files\Ascentive\Performance Center\APCMain.exe" [ ] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [2007-08-07 19:51 1006264] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0\bin\jusched.exe" [2007-01-04 07:18 77824] "NvSvc"="C:\Windows\system32\nvsvc.dll" [2006-12-07 20:25 90191] "NvCplDaemon"="C:\Windows\system32\NvCpl.dll" [2006-12-07 20:25 7766016] "NvMediaCenter"="C:\Windows\system32\NvMcTray.dll" [2006-12-07 20:25 81920] "SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2006-10-27 13:50 815104] "RtHDVCpl"="RtHDVCpl.exe" [2006-11-07 14:50 3772416 C:\Windows\RtHDVCpl.exe] "NDSTray.exe"="NDSTray.exe" [] "IgfxTray"="C:\Windows\system32\igfxtray.exe" [2006-11-06 09:02 98304] "HotKeysCmds"="C:\Windows\system32\hkcmd.exe" [2006-11-06 09:05 106496] "Persistence"="C:\Windows\system32\igfxpers.exe" [2006-11-06 09:02 81920] "HSON"="C:\Program Files\TOSHIBA\TBS\HSON.exe" [2006-12-07 16:49 55416] "00TCrdMain"="C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe" [2006-12-11 17:27 530552] "TPwrMain"="C:\Program Files\TOSHIBA\Power Saver\TPwrMain.EXE" [2006-12-02 12:14 409264] "nod32kui"="C:\Program Files\Eset\nod32kui.exe" [2007-11-06 19:33 949376] "GrooveMonitor"="C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-27 00:47 31016] "NWEReboot"="" [] "Performance Center"="C:\Program Files\Ascentive\Performance Center\ApcMain.exe" [ ] "MSConfig"="C:\Windows\system32\msconfig.exe" [2006-11-02 10:45 222208] "ISTray"="C:\Program Files\Spyware Doctor\pctsTray.exe" [2007-12-10 14:53 1103752] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "Nokia.PCSync"="E:\PROGRAMY\Nokia PC Suite 6\PcSync2.exe" [2007-06-19 09:17 1241088] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AlcoholAutomount] --a------ 2007-12-22 08:20 222080 C:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] --a------ 2007-03-01 15:57 153136 C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SmoothView] --a------ 2007-01-02 16:02 493112 C:\Program Files\Toshiba\SmoothView\SmoothView.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\topi] --a------ 2006-12-15 17:11 577536 C:\Program Files\TOSHIBA\Toshiba Online Product Information\topi.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WMPNSCFG] --a------ 2006-11-02 13:34 201728 C:\Program Files\Windows Media Player\WMPNSCFG.exe R2 TOSHIBA Bluetooth Service;TOSHIBA Bluetooth Service;C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe [2007-02-25 20:55] R3 FwLnk;FwLnk Driver;C:\Windows\system32\DRIVERS\FwLnk.sys [2006-11-19 22:11] R3 igfx;igfx;C:\Windows\system32\DRIVERS\igdkmd32.sys [2006-11-06 10:29] R3 NETw3v32;Sterownik karty Intel(R) PRO/Wireless 3945ABG dla systemu Windows Vista 32 Bit;C:\Windows\system32\DRIVERS\NETw3v32.sys [2006-10-30 09:42] R3 tdcmdpst;TOSHIBA Writing Engine Filter Driver;C:\Windows\system32\DRIVERS\tdcmdpst.sys [2006-10-18 11:50] R3 tosrfec;Bluetooth ACPI;C:\Windows\system32\DRIVERS\tosrfec.sys [2006-10-23 16:32] S3 BTCAMDRV;Mobiola Web Camera driver;C:\Windows\system32\DRIVERS\BTCamDrv.sys [2006-11-01 18:45] S4 KR10I;KR10I;C:\Windows\system32\drivers\kr10i.sys [2006-02-14 18:50] S4 KR10N;KR10N;C:\Windows\system32\drivers\kr10n.sys [2006-02-14 18:41] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] LocalServiceNoNetwork REG_MULTI_SZ PLA DPS BFE mpssvc bthsvcs REG_MULTI_SZ BthServ . Contents of the 'Scheduled Tasks' folder "2008-02-12 16:27:23 C:\Windows\Tasks\User_Feed_Synchronization-{7EF5CC87-B7E2-45CF-82EB-C3E2E5868936}.job" - C:\Windows\system32\msfeedssync.exe . ************************************************************************** catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-02-12 21:39:42 Windows 6.0.6000 NTFS scanning hidden processes ... scanning hidden autostart entries ... HKCU\Software\Microsoft\Windows\CurrentVersion\Run TOSCDSPD = C:\Program Files\TOSHIBA\TOSCDSPD\TOSCDSPD.exe?/i??????????s?????? ???X????????? scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2008-02-12 21:40:59 ComboFix-quarantined-files.txt 2008-02-12 20:40:50 ComboFix2.txt 2008-02-11 17:37:37 . 2008-02-08 17:46:55 --- E O F ---

proszę o spradzenie loga brak modułów run dll

proszę o spradzenie loga brak modułów run dll

Kto jest na forum