proszę o sprawdzenie loga delsim dialer

**Posty:** 40 · przez **Niewierny** 31 Maj 2007, 19:58

witam mam problem już kolejny raz z virusem Delsim Dialer możecie sprawdzić mojego loga
problem tkwi w tym ze po włączeniu neta uruchanmia mi się okienko które próbuje mnie przekierować na inne połączenie moge je jedynie zamknąć po jakims czasie odłancza mi neta czasem pojawia się zraz po włączeniu komputera komunikat o zamknięciu sestemu 1 min

takie są objawy prób owałem w trybie awaryjnym usuwać tego wirusa ale nic to nie dało
oto mój log

Kod: Zaznacz wszystko
Logfile of HijackThis v1.99.1 Scan saved at 19:33, on 07-05-31 Platform: Windows XP Dodatek SP. 1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\Program Files\HP\HP Software Update\HPWuSchd2.exe C:\Program Files\Eset\nod32kui.exe C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe C:\Program Files\Eset\nod32krn.exe C:\WINDOWS\System32\nvsvc32.exe C:\WINDOWS\System32\HPZipm12.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe C:\WINDOWS\wault.exe C:\WINDOWS\System32\ctfmon.exe C:\Program Files\SlimBrowser\sbrowser.exe C:\Documents and Settings\Niewierny\Pulpit\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.interia.pl/ R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [UVS10 Preload] C:\Program Files\Ulead Systems\Ulead VideoStudio 10\uvPL.exe O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O16 - DPF: ING Bank Online - https://ssl.bsk.com.pl/bskonl/component/INGOnl.cab O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://downloads.ewido.net/ewidoOnlineScan.cab O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe O23 - Service: Windows Auto Update Tool - Unknown owner - C:\WINDOWS\wault.exe

**Posty:** 18165 · przez **wojtas** 31 Maj 2007, 20:00

Wyłącz przywracanie systemu ( właściwości mój komputer-zakładka przywracanie - wyłącz przywracanie na wszystkich dyskach)
Start do awaryjnego ( F8 ) przy starcie komputera.

zastosuj:

smitfraudfix z opcji 2:

http://siri.urz.free.fr/Fix/SmitfraudFix_En.php

start -> uruchom -> services.msc -> zatrzymaj i wyłącz usługe Windows Auto Update Tool

O23 - Service: Windows Auto Update Tool - Unknown owner - C:\WINDOWS\wault.exe

Odpalasz hijackthis i zaznaczasz ptaszkami powyższe wpisy i dajesz Fix checked.
Pogrubione pliki usuwasz ręcznie z dysku
potem nowe logi z Hijack This oraz Silent runners

**Posty:** 40 · przez **Niewierny** 02 Cze 2007, 07:41

Kod: Zaznacz wszystko
Logfile of HijackThis v1.99.1 Scan saved at 07:18, on 07-06-02 Platform: Windows XP Dodatek SP. 1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\Program Files\HP\HP Software Update\HPWuSchd2.exe C:\Program Files\Eset\nod32kui.exe C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe C:\Program Files\Eset\nod32krn.exe C:\WINDOWS\System32\nvsvc32.exe C:\WINDOWS\System32\HPZipm12.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe C:\Documents and Settings\Niewierny\Pulpit\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.interia.pl/ R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [UVS10 Preload] C:\Program Files\Ulead Systems\Ulead VideoStudio 10\uvPL.exe O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O16 - DPF: ING Bank Online - https://ssl.bsk.com.pl/bskonl/component/INGOnl.cab O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://downloads.ewido.net/ewidoOnlineScan.cab O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe

[ Dodano: Dzisiaj o 7:43 ]

Kod: Zaznacz wszystko
SmitFraudFix v2.190 Scan done at 7:23:58,37, 07-06-02 Run from C:\Program Files\SlimBrowser\SmitfraudFix OS: Microsoft Windows XP [Wersja 5.1.2600] - Windows_NT The filesystem type is NTFS Fix run in normal mode »»»»»»»»»»»»»»»»»»»»»»»» Process C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\Program Files\HP\HP Software Update\HPWuSchd2.exe C:\Program Files\Eset\nod32kui.exe C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe C:\Program Files\Eset\nod32krn.exe C:\WINDOWS\System32\nvsvc32.exe C:\WINDOWS\System32\HPZipm12.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe C:\Program Files\SlimBrowser\sbrowser.exe C:\WINDOWS\system32\cmd.exe C:\PROGRA~1\MICROS~2\Office10\OUTLOOK.EXE C:\Program Files\Microsoft Office\Office10\WINWORD.EXE C:\WINDOWS\System32\ctfmon.exe »»»»»»»»»»»»»»»»»»»»»»»» hosts »»»»»»»»»»»»»»»»»»»»»»»» C:\ »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32 »»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Niewierny »»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Niewierny\Application Data »»»»»»»»»»»»»»»»»»»»»»»» Start Menu »»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\NIEWIE~1\Ulubione »»»»»»»»»»»»»»»»»»»»»»»» Desktop »»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files »»»»»»»»»»»»»»»»»»»»»»»» Corrupted keys »»»»»»»»»»»»»»»»»»»»»»»» Desktop Components [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0] "Source"="About:Home" "SubscribedURL"="About:Home" "FriendlyName"="Moja bieľĄca strona g˘wna" »»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler !!!Attention, following keys are not inevitably infected!!! SrchSTS.exe by S!Ri Search SharedTaskScheduler's .dll »»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs !!!Attention, following keys are not inevitably infected!!! [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] "AppInit_DLLs"="" »»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System !!!Attention, following keys are not inevitably infected!!! [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] "System"="" »»»»»»»»»»»»»»»»»»»»»»»» pe386-msguard-lzx32-huy32-xpdt »»»»»»»»»»»»»»»»»»»»»»»» DNS Description: Karta Realtek RTL8139 Family PCI Fast Ethernet NIC - Sterownik miniport Harmonogramu pakietów DNS Server Search Order: 88.156.96.2 DNS Server Search Order: 88.156.96.3 HKLM\SYSTEM\CCS\Services\Tcpip\..\{4F2F4D2A-49ED-4980-A98F-24D3C933C14A}: DhcpNameServer=88.156.96.2 88.156.96.3 HKLM\SYSTEM\CS1\Services\Tcpip\..\{4F2F4D2A-49ED-4980-A98F-24D3C933C14A}: DhcpNameServer=88.156.96.2 88.156.96.3 HKLM\SYSTEM\CS2\Services\Tcpip\..\{4F2F4D2A-49ED-4980-A98F-24D3C933C14A}: DhcpNameServer=88.156.96.2 88.156.96.3 HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=88.156.96.2 88.156.96.3 HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=88.156.96.2 88.156.96.3 HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=88.156.96.2 88.156.96.3 »»»»»»»»»»»»»»»»»»»»»»»» Scanning for wininet.dll infection »»»»»»»»»»»»»»»»»»»»»»»» End

**Posty:** 18165 · przez **wojtas** 02 Cze 2007, 15:38

daj loga z:

http://deckard.geekstogo.com/dss.exe

**Posty:** 40 · przez **Niewierny** 02 Cze 2007, 18:04

Kod: Zaznacz wszystko
Deckard's System Scanner v20070426.43 Run by Niewierny on 2007-06-02 at 17:31:59 Computer is in Normal Mode. -------------------------------------------------------------------------------- -- HijackThis (run as Niewierny.exe) ------------------------------------------- Logfile of HijackThis v1.99.1 Scan saved at 17:32, on 07-06-02 Platform: Windows XP Dodatek SP. 1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\Program Files\HP\HP Software Update\HPWuSchd2.exe C:\Program Files\Eset\nod32kui.exe C:\Program Files\Gadu-Gadu\gg.exe C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe C:\Program Files\Eset\nod32krn.exe C:\WINDOWS\System32\nvsvc32.exe C:\WINDOWS\System32\HPZipm12.exe C:\WINDOWS\VTTimer.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe C:\Program Files\SlimBrowser\sbrowser.exe C:\WINDOWS\System32\ctfmon.exe C:\Documents and Settings\Niewierny\Ustawienia lokalne\Temporary Internet Files\Content.IE5\IHSBAVE3\dss[1].exe C:\DOCUME~1\NIEWIE~1\Pulpit\Niewierny.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.interia.pl/ R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [UVS10 Preload] C:\Program Files\Ulead Systems\Ulead VideoStudio 10\uvPL.exe O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O16 - DPF: ING Bank Online - https://ssl.bsk.com.pl/bskonl/component/INGOnl.cab O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://downloads.ewido.net/ewidoOnlineScan.cab O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe O23 - Service: Copyright (C) 2001-2005 S3 Graphics, Inc. (S3 Graphics, Inc.) - Unknown owner - C:\WINDOWS\VTTimer.exe O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe -- Files created between 2007-05-02 and 2007-06-02 ----------------------------- 2007-06-02 17:16:32 45232 --a------ C:\1m3v52k2c1.exe 2007-06-02 15:00:52 499200 -r-hs---- C:\WINDOWS\VTTimer.exe 2007-06-02 07:24:00 1878 --a------ C:\WINDOWS\System32\tmp.reg 2007-06-02 07:23:17 51200 --a------ C:\WINDOWS\System32\dumphive.exe 2007-06-02 07:23:16 288417 --a------ C:\WINDOWS\System32\SrchSTS.exe <Not Verified; S!Ri; SrchSTS> 2007-06-02 07:23:16 53248 --a------ C:\WINDOWS\System32\Process.exe <Not Verified; http://www.beyondlogic.org; Command Line Process Utility> 2007-05-31 08:22:57 1236992 -r-hs---- C:\WINDOWS\wault.exe 2007-05-21 00:36:14 0 d-------- C:\SmartSound Software 2007-05-21 00:35:19 0 d-------- C:\Program Files\SmartSound Software 2007-05-21 00:33:52 0 d-------- C:\Program Files\Windows Media Components 2007-05-21 00:32:30 0 d-------- C:\Program Files\Common Files\Ulead Systems 2007-05-21 00:32:29 0 d-------- C:\Program Files\Ulead Systems 2007-05-21 00:32:28 0 d--h----- C:\Program Files\InstallShield Installation Information 2007-05-21 00:31:51 0 d-------- C:\Program Files\Common Files\InstallShield 2007-05-20 14:07:47 0 --a------ C:\WINDOWS\System32\ovn.exe 2007-05-09 16:41:35 0 d-------- C:\Program Files\ACD Systems 2007-05-08 18:02:30 0 d-------- C:\Program Files\ABBYY FineReader 7.0 Professional Edition 2007-05-08 17:51:22 0 d-------- C:\Program Files\English Translator 3 2007-05-08 17:29:29 0 --a------ C:\WINDOWS\System32\oth.exe 2007-05-08 17:18:11 89184 --a------ C:\WINDOWS\System32\drivers\imagedrv.sys <Not Verified; Ahead Software AG and its licensors; NERO IMAGEDRIVE> 2007-05-08 17:18:03 155648 --a------ C:\WINDOWS\System32\NeroCheck.exe <Not Verified; Ahead Software Gmbh; Ahead Software Gmbh NeroCheck> 2007-05-08 17:10:50 106496 --a------ C:\WINDOWS\System32\TwnLib20.dll <Not Verified; Pegasus Software; TWNLIB20> 2007-05-08 17:10:50 38912 --a------ C:\WINDOWS\System32\picn20.dll <Not Verified; Pegasus Imaging Corp.; PEGASUS> 2007-05-08 17:10:49 544768 --a------ C:\WINDOWS\System32\imagx5.dll <Not Verified; Pegasus Software, LLC; ImagXpress> 2007-05-08 17:10:49 569344 --a------ C:\WINDOWS\System32\imagr5.dll <Not Verified; Pegasus Software,LLC; ImagXpress> 2007-05-08 17:10:49 0 d-------- C:\Program Files\Common Files\Ahead 2007-05-08 17:10:46 0 d-------- C:\Program Files\Ahead 2007-05-08 17:08:33 997888 --a------ C:\WINDOWS\System32\wmvdmoe2.dll <Not Verified; Microsoft Corporation; Microsoft® Windows Media Services> 2007-05-08 17:08:33 892416 --a------ C:\WINDOWS\System32\wmspdmoe.dll <Not Verified; Microsoft Corporation; Microsoft® Windows Media Services> 2007-05-08 17:08:33 1111040 --a------ C:\WINDOWS\System32\wmsdmoe2.dll <Not Verified; Microsoft Corporation; Microsoft® Windows Media Services> 2007-05-08 17:07:53 0 d-------- C:\Program Files\3aLab 2007-05-08 17:07:21 122880 --a------ C:\WINDOWS\UnGins.exe 2007-05-08 17:07:20 0 d-------- C:\Program Files\Soulseek 2007-05-06 19:36:24 0 d-------- C:\WINDOWS 2007-05-06 19:36:24 0 d-------- C:\WINDOWS\WinSxS 2007-05-06 19:36:24 0 dr------- C:\WINDOWS\Web 2007-05-06 19:36:24 0 d-------- C:\WINDOWS\twain_32 2007-05-06 19:36:24 0 d-------- C:\WINDOWS\system32 2007-05-06 19:36:24 0 d-------- C:\WINDOWS\System32\wins 2007-05-06 19:36:24 0 d-------- C:\WINDOWS\System32\wbem 2007-05-06 19:36:24 0 d-------- C:\WINDOWS\System32\usmt 2007-05-06 19:36:24 0 d-------- C:\WINDOWS\System32\spool 2007-05-06 19:36:24 0 d-------- C:\WINDOWS\System32\ShellExt 2007-05-06 19:36:24 0 d-------- C:\WINDOWS\System32\Setup 2007-05-06 19:36:24 0 d-------- C:\WINDOWS\System32\ras 2007-05-06 19:36:24 0 d-------- C:\WINDOWS\System32\oobe 2007-05-06 19:36:24 0 d-------- C:\WINDOWS\System32\npp 2007-05-06 19:36:24 0 d-------- C:\WINDOWS\System32\mui 2007-05-06 19:36:24 0 d-------- C:\WINDOWS\System32\inetsrv 2007-05-06 19:36:24 0 d-------- C:\WINDOWS\System32\IME 2007-05-06 19:36:24 0 d-------- C:\WINDOWS\System32\icsxml 2007-05-06 19:36:24 0 d-------- C:\WINDOWS\System32\ias 2007-05-06 19:36:24 0 d-------- C:\WINDOWS\System32\export 2007-05-06 19:36:24 0 d-------- C:\WINDOWS\System32\drivers 2007-05-06 19:36:24 0 d-------- C:\WINDOWS\System32\drivers\etc 2007-05-06 19:36:24 0 d-------- C:\WINDOWS\System32\drivers\disdn 2007-05-06 19:36:24 0 dr-hs--c- C:\WINDOWS\System32\dllcache 2007-05-06 19:36:24 0 d-------- C:\WINDOWS\System32\dhcp 2007-05-06 19:36:24 0 d-------- C:\WINDOWS\System32\config 2007-05-06 19:36:24 0 d-------- C:\WINDOWS\System32\3com_dmi 2007-05-06 19:36:24 0 d-------- C:\WINDOWS\System32\3076 2007-05-06 19:36:24 0 d-------- C:\WINDOWS\System32\2052 2007-05-06 19:36:24 0 d-------- C:\WINDOWS\System32\1054 2007-05-06 19:36:24 0 d-------- C:\WINDOWS\System32\1045 2007-05-06 19:36:24 0 d-------- C:\WINDOWS\System32\1042 2007-05-06 19:36:24 0 d-------- C:\WINDOWS\System32\1041 2007-05-06 19:36:24 0 d-------- C:\WINDOWS\System32\1037 2007-05-06 19:36:24 0 d-------- C:\WINDOWS\System32\1033 2007-05-06 19:36:24 0 d-------- C:\WINDOWS\System32\1031 2007-05-06 19:36:24 0 d-------- C:\WINDOWS\System32\1028 2007-05-06 19:36:24 0 d-------- C:\WINDOWS\System32\1025 2007-05-06 19:36:24 0 d-------- C:\WINDOWS\system 2007-05-06 19:36:24 0 d-------- C:\WINDOWS\security 2007-05-06 19:36:24 0 d-------- C:\WINDOWS\Resources 2007-05-06 19:36:24 0 d-------- C:\WINDOWS\repair 2007-05-06 19:36:24 0 d-------- C:\WINDOWS\mui 2007-05-06 19:36:24 0 d-------- C:\WINDOWS\msapps 2007-05-06 19:36:24 0 d-------- C:\WINDOWS\msagent 2007-05-06 19:36:24 0 d-------- C:\WINDOWS\Media 2007-05-06 19:36:24 0 d-------- C:\WINDOWS\java 2007-05-06 19:36:24 0 d--h----- C:\WINDOWS\inf 2007-05-06 19:36:24 0 d-------- C:\WINDOWS\ime 2007-05-06 19:36:24 0 d-------- C:\WINDOWS\Help 2007-05-06 19:36:24 0 dr--s---- C:\WINDOWS\Fonts 2007-05-06 19:36:24 0 d-------- C:\WINDOWS\Driver Cache 2007-05-06 19:36:24 0 d-------- C:\WINDOWS\Debug 2007-05-06 19:36:24 0 d-------- C:\WINDOWS\Cursors 2007-05-06 19:36:24 0 d-------- C:\WINDOWS\Connection Wizard 2007-05-06 19:36:24 0 d-------- C:\WINDOWS\Config 2007-05-06 19:36:24 0 d-------- C:\WINDOWS\AppPatch 2007-05-06 19:36:24 0 d-------- C:\WINDOWS\addins 2007-05-06 18:54:52 0 d-------- C:\Program Files\MyWay 2007-05-06 18:52:02 77824 --a------ C:\WINDOWS\System32\mplaw7.dll <Not Verified; Ligos Corporation; MPL Audio Library> 2007-05-06 18:52:02 65536 --a------ C:\WINDOWS\System32\mplapx.dll <Not Verified; Ligos Corporation; MPL Audio Library> 2007-05-06 18:52:02 65536 --a------ C:\WINDOWS\System32\mplam6.dll <Not Verified; Ligos Corporation; MPL Audio Library> 2007-05-06 18:52:02 77824 --a------ C:\WINDOWS\System32\mplaa6.dll <Not Verified; Ligos Corporation; MPL Audio Library> 2007-05-06 18:51:59 1415680 --a------ C:\WINDOWS\System32\WMV9VCM.dll <Not Verified; Microsoft Corporation; Windows Media Video 9 VCM> 2007-05-06 18:51:58 217088 --a------ C:\WINDOWS\System32\xvidvfw.dll 2007-05-06 18:51:58 1138688 --a------ C:\WINDOWS\System32\xvidcore.dll 2007-05-06 18:51:58 200704 --a------ C:\WINDOWS\System32\ssldivx.dll <Not Verified; The OpenSSL Project, http://www.openssl.org/; The OpenSSL Toolkit> 2007-05-06 18:51:57 3596288 --a------ C:\WINDOWS\System32\qt-dx331.dll 2007-05-06 18:51:57 1044480 --a------ C:\WINDOWS\System32\libdivx.dll <Not Verified; The OpenSSL Project, http://www.openssl.org/; The OpenSSL Toolkit> 2007-05-06 18:51:57 196608 --a------ C:\WINDOWS\System32\dtu100.dll <Not Verified; DivX, Inc.; DivX, Inc. dtu100> 2007-05-06 18:51:57 73728 --a------ C:\WINDOWS\System32\dpl100.dll <Not Verified; DivX, Inc.; DivX, Inc. dpl100> 2007-05-06 18:51:57 635486 --a------ C:\WINDOWS\System32\divx.dll <Not Verified; DivX, Inc.; DivX®> 2007-05-06 18:51:56 5120 --a------ C:\WINDOWS\System32\ff_vfw.dll 2007-05-06 18:51:54 19968 --a------ C:\WINDOWS\System32\cpuinf32.dll 2007-05-06 18:51:53 0 d-------- C:\Program Files\K-Lite Codec Pack 2007-05-06 18:48:49 0 d-------- C:\Program Files\SlimBrowser 2007-05-06 18:46:37 0 d-------- C:\Program Files\Gadu-Gadu 2007-05-06 18:45:02 0 d-------- C:\Program Files\Winamp 2007-05-06 18:43:42 0 d-------- C:\WINDOWS\RegisteredPackages 2007-05-06 18:43:20 0 d-------- C:\Program Files\Common Files\ODBC 2007-05-06 18:43:14 0 d-------- C:\Program Files\Common Files\SpeechEngines 2007-05-06 18:43:13 0 dr------- C:\Program Files 2007-05-06 18:43:03 1769472 --a------ C:\WINDOWS\System32\dxdiagn.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System> 2007-05-06 18:43:03 1703936 --a------ C:\WINDOWS\System32\d3d9.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System> 2007-05-06 18:42:04 0 d-------- C:\Program Files\Common Files\Adobe 2007-05-06 18:41:34 0 d-------- C:\WINDOWS\System32\CatRoot2 2007-05-06 18:41:34 0 d-------- C:\WINDOWS\System32\CatRoot 2007-05-06 18:41:08 0 d-------- C:\Documents and Settings 2007-05-06 18:39:39 990 --a------ C:\WINDOWS\unins000.dat 2007-05-06 18:38:09 0 d-------- C:\WINDOWS\pss 2007-05-06 18:35:40 0 d---s---- C:\WINDOWS\System32\Microsoft 2007-05-06 18:34:53 0 d-------- C:\Program Files\Common Files\HP 2007-05-06 18:33:02 0 d-------- C:\Program Files\Hewlett-Packard 2007-05-06 18:31:45 0 d-------- C:\Program Files\Common Files\Hewlett-Packard 2007-05-06 18:29:01 57344 --a------ C:\WINDOWS\System32\HPZisn12.dll <Not Verified; HP; HP SNMP Windows> 2007-05-06 18:29:01 94208 --a------ C:\WINDOWS\System32\HPZipt12.dll <Not Verified; HP; HP SNMP Windows> 2007-05-06 18:29:01 204800 --a------ C:\WINDOWS\System32\HPZipr12.dll <Not Verified; HP; HP PmlRtl> 2007-05-06 18:29:01 69632 --a------ C:\WINDOWS\System32\HPZipm12.exe <Not Verified; HP; HP PML> 2007-05-06 18:29:01 61440 --a------ C:\WINDOWS\System32\HPZinw12.exe <Not Verified; HP; HP Dot4Net Windows> 2007-05-06 18:29:01 278584 --a------ C:\WINDOWS\System32\HPZidr12.dll <Not Verified; HP; HP Dot4Rtl> 2007-05-06 18:25:05 0 d-------- C:\Program Files\HP 2007-05-06 18:24:30 0 d-------- C:\WUTemp 2007-05-06 18:24:08 21124 -----n--- C:\WINDOWS\hpomdl07.dat 2007-05-06 18:24:08 113574 --a------ C:\WINDOWS\hpoins07.dat 2007-05-06 18:22:13 0 d-------- C:\WINDOWS\nview 2007-05-06 18:16:17 0 d-------- C:\WINDOWS\ShellNew 2007-05-06 18:12:05 458752 --a------ C:\WINDOWS\system\COMCTL32.DLL <Not Verified; Microsoft Corporation; Microsoft(R) Windows NT(R) Operating System> 2007-05-06 18:11:47 6272 --a------ C:\WINDOWS\System32\drivers\ASLM75.SYS 2007-05-06 18:11:36 0 d-------- C:\Program Files\ASUS 2007-05-06 18:09:36 7298 --a------ C:\WINDOWS\System32\drivers\WBHWDOCT.sys <Not Verified; Winbond Electronics Corp.; Winbond Hardware Doctor> 2007-05-06 18:09:18 0 d-------- C:\Program Files\Winbond 2007-05-06 18:09:13 299520 --a------ C:\WINDOWS\uninst.exe <Not Verified; InstallShield Corporation, Inc.; InstallShield unInstaller> 2007-05-06 18:08:06 38160 --a------ C:\WINDOWS\System32\LMRTREND.dll <Not Verified; Microsoft Corporation; Microsoft® Windows(TM) Operating System> 2007-05-06 18:08:05 181760 --a------ C:\WINDOWS\System32\ir50_qcx.dll <Not Verified; Intel Corporation.; Intel Indeo® video 5.03 Quick Compressor> 2007-05-06 18:08:05 198144 --a------ C:\WINDOWS\System32\ir50_qc.dll <Not Verified; Intel Corporation.; Intel Indeo® video 5.03 Quick Compressor> 2007-05-06 18:08:05 733696 --a------ C:\WINDOWS\System32\ir50_32.dll <Not Verified; Intel Corporation; Intel Indeo® video 5.04> 2007-05-06 18:08:05 338432 --a------ C:\WINDOWS\System32\ir41_qcx.dll <Not Verified; Intel Corporation.; Intel Indeo® Video Interactive Quick Compressor> 2007-05-06 18:08:05 120320 --a------ C:\WINDOWS\System32\ir41_qc.dll <Not Verified; Intel Corporation.; Intel Indeo® Video Interactive Quick Compressor> 2007-05-06 18:08:03 182032 --a------ C:\WINDOWS\System32\dxtmsft3.dll <Not Verified; Microsoft Corporation; Microsoft® Windows(TM) Operating System> 2007-05-06 18:08:01 63488 --a------ C:\WINDOWS\System32\unam4ie.exe <Not Verified; Microsoft Corporation; DirectShow> 2007-05-06 18:07:59 10240 --a------ C:\WINDOWS\System32\vidx16.dll 2007-05-06 18:07:59 194320 --a------ C:\WINDOWS\System32\qcut.dll <Not Verified; Microsoft Corporation; DirectShow> 2007-05-06 18:07:57 4608 --a------ C:\WINDOWS\System32\w95inf32.dll <Not Verified; Microsoft Corporation; Microsoft® Plus! for Windows® 95> 2007-05-06 18:07:57 2272 --a------ C:\WINDOWS\System32\w95inf16.dll <Not Verified; Microsoft Corporation; Microsoft® Plus! for Windows® 95> 2007-05-06 18:07:56 73728 -----n--- C:\WINDOWS\system\CMedia.dll 2007-05-06 18:07:45 0 d-------- C:\Program Files\PCI Audio Applications 2007-05-06 18:07:43 1540096 --a------ C:\WINDOWS\NewMixer.exe <Not Verified; C-Media Electronic Inc. (www.cmedia.com.tw); Mixer> 2007-05-06 18:07:26 0 d-------- C:\Program Files\C-Media 2007-05-06 18:07:09 0 d-------- C:\WINDOWS\SiSAGP 2007-05-06 18:07:04 304640 --a------ C:\WINDOWS\IsUn0415.exe <Not Verified; InstallShield Software Corporation; InstallShield(R) unInstaller> 2007-05-06 18:06:47 0 d-------- C:\WINDOWS\System32\ReinstallBackups 2007-05-06 18:06:37 306688 --a------ C:\WINDOWS\IsUninst.exe <Not Verified; InstallShield Software Corporation; InstallShield® unInstaller> 2007-05-06 18:06:18 5824 --a------ C:\WINDOWS\System32\drivers\ASUSHWIO.SYS 2007-05-06 18:02:17 0 d-------- C:\WINDOWS\System32\NtmsData 2007-05-06 18:01:49 0 d--hs---- C:\WINDOWS\Installer 2007-05-06 18:00:30 0 d--hs---- C:\System Volume Information 2007-05-06 18:00:22 0 d-------- C:\WINDOWS\Prefetch 2007-05-06 17:56:15 0 d-------- C:\WINDOWS\System32\xircom 2007-05-06 17:56:15 0 d-------- C:\Program Files\microsoft frontpage 2007-05-06 17:55:50 0 -rahs---- C:\MSDOS.SYS 2007-05-06 17:55:50 0 -rahs---- C:\IO.SYS 2007-05-06 17:55:50 0 --a------ C:\CONFIG.SYS 2007-05-06 17:55:50 0 --a------ C:\AUTOEXEC.BAT 2007-05-06 17:54:29 0 dr------- C:\WINDOWS\Offline Web Pages 2007-05-06 17:54:29 0 d---s---- C:\WINDOWS\Downloaded Program Files 2007-05-06 17:53:56 0 d-------- C:\WINDOWS\System32\DirectX 2007-05-06 17:53:20 0 d---s---- C:\WINDOWS\Tasks 2007-05-06 17:53:18 0 d-------- C:\Program Files\Common Files\MSSoap 2007-05-06 17:53:11 0 d-------- C:\WINDOWS\srchasst 2007-05-06 17:50:15 0 d-------- C:\WINDOWS\System32\Macromed 2007-05-06 17:50:14 0 d-------- C:\Program Files\Movie Maker 2007-05-06 17:50:10 0 d-------- C:\WINDOWS\System32\Restore 2007-05-06 17:50:10 0 d-------- C:\WINDOWS\PCHealth 2007-05-06 17:49:22 21856 --a------ C:\WINDOWS\System32\emptyregdb.dat 2007-05-06 17:49:07 0 d-------- C:\WINDOWS\Registration 2007-05-06 17:48:59 0 d--h----- C:\Program Files\WindowsUpdate 2007-05-06 17:48:59 0 d-------- C:\Program Files\Usługi online 2007-05-06 17:48:52 0 d-------- C:\Program Files\Messenger 2007-05-06 17:48:48 0 d-------- C:\Program Files\MSN Gaming Zone 2007-05-06 17:48:17 0 d-------- C:\Program Files\Windows NT 2007-05-06 17:48:14 0 d-------- C:\WINDOWS\System32\MsDtc 2007-05-06 17:48:14 0 d-------- C:\WINDOWS\System32\Com -- Find3M Report --------------------------------------------------------------- 2007-06-02 17:38:17 0 d-------- C:\Documents and Settings\Niewierny\Dane aplikacji\SlimBrowser 2007-06-02 17:15:17 16896 --a------ C:\WINDOWS\System32\tftp.exe 2007-06-02 17:15:17 42496 --a------ C:\WINDOWS\System32\ftp.exe 2007-06-01 19:47:33 0 d-------- C:\Documents and Settings\Niewierny\Dane aplikacji\AdobeUM 2007-05-22 21:54:13 30928 --a------ C:\Documents and Settings\Niewierny\Dane aplikacji\GDIPFONTCACHEV1.DAT 2007-05-21 00:39:41 0 d-------- C:\Documents and Settings\Niewierny\Dane aplikacji\Ulead Systems 2007-05-14 10:59:10 0 d-------- C:\Documents and Settings\Niewierny\Dane aplikacji\Ahead 2007-05-11 18:56:32 0 d-------- C:\Documents and Settings\Niewierny\Dane aplikacji\Adobe 2007-05-09 17:00:38 0 d-------- C:\Documents and Settings\Niewierny\Dane aplikacji\ACD Systems 2007-05-08 18:05:48 0 d-------- C:\Documents and Settings\Niewierny\Dane aplikacji\ABBYY 2007-05-08 17:24:40 0 d-------- C:\Documents and Settings\Niewierny\Dane aplikacji\Media Player Classic 2007-05-07 19:58:54 355830 --a------ C:\WINDOWS\System32\perfh015.dat 2007-05-07 19:58:54 49712 --a------ C:\WINDOWS\System32\perfc015.dat 2007-05-07 15:12:41 0 d-------- C:\Documents and Settings\Niewierny\Dane aplikacji\Real 2007-05-06 19:37:07 0 d-------- C:\Documents and Settings\Niewierny\Dane aplikacji\Macromedia 2007-05-06 18:53:23 133632 --a------ C:\WINDOWS\System32\sfc_os.dll <Not Verified; Microsoft Corporation; System operacyjny Microsoft® Windows®> 2007-05-06 18:41:50 62 --ahs---- C:\Documents and Settings\Niewierny\Dane aplikacji\desktop.ini 2007-05-06 18:39:02 0 d-------- C:\Documents and Settings\Niewierny\Dane aplikacji\HP 2007-05-06 18:01:45 0 d-------- C:\Documents and Settings\Niewierny\Dane aplikacji\Identities -- Registry Dump --------------------------------------------------------------- [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run] "NvCplDaemon"="RUNDLL32.EXE C:\\WINDOWS\\System32\\NvCpl.dll,NvStartup" "nwiz"="nwiz.exe /install" "HP Software Update"="C:\\Program Files\\HP\\HP Software Update\\HPWuSchd2.exe" "nod32kui"="\"C:\\Program Files\\Eset\\nod32kui.exe\" /WAITSERVICE" "NeroFilterCheck"="C:\\WINDOWS\\system32\\NeroCheck.exe" "UVS10 Preload"="C:\\Program Files\\Ulead Systems\\Ulead VideoStudio 10\\uvPL.exe" [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run] "Gadu-Gadu"="\"C:\\Program Files\\Gadu-Gadu\\gg.exe\" /tray" HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa Authentication Packages REG_MULTI_SZ msv1_0\0\0 Security Packages REG_MULTI_SZ kerberos\0msv1_0\0schannel\0wdigest\0\0 Notification Packages REG_MULTI_SZ scecli\0\0 [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Adobe Reader Speed Launch.lnk] "path"="C:\\Documents and Settings\\All Users\\Menu Start\\Programy\\Autostart\\Adobe Reader Speed Launch.lnk" "backup"="C:\\WINDOWS\\pss\\Adobe Reader Speed Launch.lnkCommon Startup" "location"="Common Startup" "command"="C:\\PROGRA~1\\Adobe\\ACROBA~1.0\\Reader\\READER~1.EXE " "item"="Adobe Reader Speed Launch" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^HP Digital Imaging Monitor.lnk] "path"="C:\\Documents and Settings\\All Users\\Menu Start\\Programy\\Autostart\\HP Digital Imaging Monitor.lnk" "backup"="C:\\WINDOWS\\pss\\HP Digital Imaging Monitor.lnkCommon Startup" "location"="Common Startup" "command"="C:\\PROGRA~1\\HP\\DIGITA~1\\bin\\hpqtra08.exe " "item"="HP Digital Imaging Monitor" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^ImageFox.lnk] "path"="C:\\Documents and Settings\\All Users\\Menu Start\\Programy\\Autostart\\ImageFox.lnk" "backup"="C:\\WINDOWS\\pss\\ImageFox.lnkCommon Startup" "location"="Common Startup" "command"="C:\\WINDOWS\\Installer\\{92E64C51-5096-442F-9A44-61CB2941391D}\\NewShortcut1.exe " "item"="ImageFox" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\C-Media Mixer] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="NewMixer" "hkey"="HKLM" "command"="C:\\WINDOWS\\NewMixer.exe /startup" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\FineReader7NewsReaderPro] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="AbbyyNewsReader" "hkey"="HKLM" "command"="C:\\Program Files\\ABBYY FineReader 7.0 Professional Edition\\AbbyyNewsReader.exe" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="msmsgs" "hkey"="HKCU" "command"="\"C:\\Program Files\\Messenger\\msmsgs.exe\" /background" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Svchost] LocalService REG_MULTI_SZ Alerter\0WebClient\0LmHosts\0RemoteRegistry\0upnphost\0SSDPSRV\0\0 NetworkService REG_MULTI_SZ DnsCache\0\0 rpcss REG_MULTI_SZ RpcSs\0\0 imgsvc REG_MULTI_SZ StiSvc\0\0 termsvcs REG_MULTI_SZ TermService\0\0 -- End of Deckard's System Scanner: finished at 2007-06-02 at 17:41:55 ---------

**Posty:** 18165 · przez **wojtas** 02 Cze 2007, 21:03

sciagnij gmera:

http://gmer.net/gmer.zip

Wklej do notatnika

gmer -del C:\1m3v52k2c1.exe
gmer -del C:\WINDOWS\System32\tmp.reg
gmer -del C:\WINDOWS\wault.exe
gmer -del C:\WINDOWS\System32\ovn.exe
gmer -del C:\WINDOWS\System32\oth.exe
gmer -del C:\WINDOWS\VTTimer.exe
gmer –reboot

Plik >>> zapisz jako >>> zmien rozszerzenie z TXT na wszystkie typy plików >>> zapisz pod nazwa FIX.BAT

Uruchamiasz Gmera, w zakładce Procesy wybierasz opcje Gmer Awaryjny. Komputer się zresetuje i uruchomi się Gmer. Wybierasz znów zakładke Procesy i na dole w poleceniu przez trzy kropki wskaz plik FIX.BAT i go uruchom.

**Posty:** 40 · przez **Niewierny** 06 Cze 2007, 00:23

Kod: Zaznacz wszystko
__________________________________________________ ewido anti-spyware online scanner http://www.ewido.net __________________________________________________ Name: TrackingCookie.Adocean Path: C:\Documents and Settings\Niewierny\Cookies\niewierny@ad.adocean[2].txt Risk: Medium Name: TrackingCookie.Doubleclick Path: C:\Documents and Settings\Niewierny\Cookies\niewierny@doubleclick[1].txt Risk: Medium Name: TrackingCookie.2o7 Path: C:\Documents and Settings\Niewierny\Cookies\niewierny@edsa.122.2o7[1].txt Risk: Medium Name: TrackingCookie.Adocean Path: C:\Documents and Settings\Niewierny\Cookies\niewierny@gde.adocean[1].txt Risk: Medium Name: TrackingCookie.Gemius Path: C:\Documents and Settings\Niewierny\Cookies\niewierny@hit.gemius[2].txt Risk: Medium Name: TrackingCookie.Tradedoubler Path: C:\Documents and Settings\Niewierny\Cookies\niewierny@tradedoubler[1].txt Risk: Medium Name: Dialer.Agent.b Path: C:\Documents and Settings\LocalService\Ustawienia lokalne\Temporary Internet Files\Content.IE5\S56N896N\installx[1].exe Risk: High Name: Dialer.Agent.b Path: C:\Documents and Settings\LocalService\Ustawienia lokalne\Temporary Internet Files\Content.IE5\S56N896N\installx[2].exe Risk: High Name: Dialer.Agent.b Path: C:\Documents and Settings\LocalService\Ustawienia lokalne\Temporary Internet Files\Content.IE5\S56N896N\installx[3].exe Risk: High Name: Dialer.Agent.b Path: C:\m3v52k2c1.exe Risk: High Name: Dialer.Agent.b Path: C:\Program Files\Common Files\delsim\del.exe Risk: High Name: Dialer.Agent.b Path: C:\System Volume Information\_restore{93664170-FCF1-49CE-BA42-0CA6FE76FF08}\RP20\A0012339.exe Risk: High Name: Dialer.Agent.b Path: C:\System Volume Information\_restore{93664170-FCF1-49CE-BA42-0CA6FE76FF08}\RP20\A0012381.exe Risk: High Name: Dialer.Agent.b Path: C:\System Volume Information\_restore{93664170-FCF1-49CE-BA42-0CA6FE76FF08}\RP20\A0012383.exe Risk: High Name: Dialer.Agent.b Path: C:\System Volume Information\_restore{93664170-FCF1-49CE-BA42-0CA6FE76FF08}\RP20\A0012406.exe Risk: High Name: Dialer.Agent.b Path: C:\System Volume Information\_restore{93664170-FCF1-49CE-BA42-0CA6FE76FF08}\RP20\A0012407.exe Risk: High Name: Dialer.Agent.b Path: C:\System Volume Information\_restore{93664170-FCF1-49CE-BA42-0CA6FE76FF08}\RP21\A0012428.exe Risk: High Name: Dialer.Agent.b Path: C:\System Volume Information\_restore{93664170-FCF1-49CE-BA42-0CA6FE76FF08}\RP21\A0012429.exe Risk: High Name: Dialer.Agent.b Path: C:\System Volume Information\_restore{93664170-FCF1-49CE-BA42-0CA6FE76FF08}\RP21\A0012439.exe Risk: High Name: Dialer.Agent.b Path: C:\System Volume Information\_restore{93664170-FCF1-49CE-BA42-0CA6FE76FF08}\RP21\A0012441.exe Risk: High Name: Dialer.Agent.b Path: C:\System Volume Information\_restore{93664170-FCF1-49CE-BA42-0CA6FE76FF08}\RP21\A0012450.exe Risk: High Name: Backdoor.SdBot.bic Path: C:\WINDOWS\wault.exe Risk: High

**Posty:** 18165 · przez **wojtas** 06 Cze 2007, 14:13

Wyłącz przywracanie systemu ( właściwości mój komputer-zakładka przywracanie - wyłącz przywracanie na wszystkich dyskach)
po chwli je wlącz

sciagnij: ATF_Cleaner

http://www.atribune.org/ccount/click.php?id=1
zaznacz
Windows Temp
Temporary internet files
i wcisnij EMPTY SELECTED

W Gmerze w zakładce CMD z zaznaczoną opcją CMD.EXE wklej:

gmer -del file C:\m3v52k2c1.exe
gmer -del file C:\WINDOWS\wault.exe
gmer –reboot

potem nowy log z Deckard's System Scanner (DSS)

**Posty:** 40 · przez **Niewierny** 08 Cze 2007, 00:32

Kod: Zaznacz wszystko
Deckard's System Scanner v20070603.47 Run by Niewierny on 2007-06-08 at 00:10:09 Computer is in Normal Mode. -------------------------------------------------------------------------------- -- System Restore -------------------------------------------------------------- Successfully created a Deckard's System Scanner Restore Point. -- Last 2 Restore Point(s) -- 2: 2007-06-07 22:10:12 UTC - RP25 - Deckard's System Scanner Restore Point 1: 2007-06-07 22:02:59 UTC - RP24 - Punkt kontrolny systemu Performed disk cleanup. -- HijackThis (run as Niewierny.exe) ------------------------------------------- Logfile of HijackThis v1.99.1 Scan saved at 00:10, on 07-06-08 Platform: Windows XP Dodatek SP. 1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\Program Files\HP\HP Software Update\HPWuSchd2.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe C:\Program Files\Eset\nod32krn.exe C:\WINDOWS\System32\nvsvc32.exe C:\WINDOWS\System32\HPZipm12.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe C:\Program Files\internet explorer\iexplore.exe C:\Program Files\internet explorer\iexplore.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\Documents and Settings\Niewierny\Ustawienia lokalne\Temporary Internet Files\Content.IE5\89MU04LC\dss[1].exe C:\DOCUME~1\NIEWIE~1\Pulpit\NIEWIE~1.EXE R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.interia.pl/ R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [UVS10 Preload] C:\Program Files\Ulead Systems\Ulead VideoStudio 10\uvPL.exe O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O16 - DPF: ING Bank Online - https://ssl.bsk.com.pl/bskonl/component/INGOnl.cab O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://downloads.ewido.net/ewidoOnlineScan.cab O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe O23 - Service: Copyright (C) 2001-2005 S3 Graphics, Inc. (S3 Graphics, Inc.) - Unknown owner - C:\WINDOWS\VTTimer.exe (file missing) O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe -- HijackThis Fixed Entries (C:\DOCUME~1\NIEWIE~1\Pulpit\backups\) ------------- backup-20070507-205828-567 O3 - Toolbar: My &Search Bar - {0494D0D9-F8E0-41ad-92A3-14154ECE70AC} - C:\Program Files\MyWay\myBar\1.bin\MYBAR.DLL (file missing) backup-20070507-205828-650 O2 - BHO: myBar BHO - {0494D0D1-F8E0-41ad-92A3-14154ECE70AC} - C:\Program Files\MyWay\myBar\1.bin\MYBAR.DLL (file missing) backup-20070531-184556-318 O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx backup-20070531-184556-870 O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll backup-20070607-191420-885 O23 - Service: Copyright (C) 2001-2005 S3 Graphics, Inc. (S3 Graphics, Inc.) - Unknown owner - C:\WINDOWS\VTTimer.exe (file missing) backup-20070607-191429-850 O23 - Service: Copyright (C) 2001-2005 S3 Graphics, Inc. (S3 Graphics, Inc.) - Unknown owner - C:\WINDOWS\VTTimer.exe (file missing) -- File Associations ----------------------------------------------------------- [COLOR=red].cpl - cplfile - shell\cplopen\command - rundll32.exe shell32.dll,Control_RunDLL "%1",%*[/COLOR] -- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------- R0 Imagedrv - c:\windows\system32\drivers\imagedrv.sys <Not Verified; Ahead Software AG and its licensors; NERO IMAGEDRIVE> R2 aslm75 - c:\windows\system32\drivers\aslm75.sys R4 AMON - c:\windows\system32\drivers\amon.sys (file missing) R4 nod32drv - c:\windows\system32\drivers\nod32drv.sys (file missing) -- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled -------------------- S2 S3 Graphics, Inc. (Copyright (C) 2001-2005 S3 Graphics, Inc.) - "c:\windows\vttimer.exe" (file missing) S4 Windows Auto Update Tool - "c:\windows\wault.exe" S4 Windows Tune service - "c:\windows\tune.exe" (file missing) -- Files created between 2007-05-08 and 2007-06-08 ----------------------------- 2007-06-07 19:24:19 1236992 --a------ C:\WINDOWS\System32\jzs.exe 2007-06-07 19:09:43 241664 --a------ C:\WINDOWS\System32\qhd.exe 2007-06-06 12:34:24 499200 --a------ C:\WINDOWS\System32\ftd.exe 2007-06-04 12:18:41 499200 --a------ C:\WINDOWS\System32\idj.exe 2007-06-02 07:23:17 51200 --a------ C:\WINDOWS\System32\dumphive.exe 2007-06-02 07:23:16 288417 --a------ C:\WINDOWS\System32\SrchSTS.exe <Not Verified; S!Ri; SrchSTS> 2007-05-31 08:22:57 1236992 -rahs---- C:\WINDOWS\wault.exe 2007-05-21 00:36:14 0 d-------- C:\SmartSound Software 2007-05-21 00:35:19 0 d-------- C:\Program Files\SmartSound Software 2007-05-21 00:33:52 0 d-------- C:\Program Files\Windows Media Components 2007-05-21 00:32:30 0 d-------- C:\Program Files\Common Files\Ulead Systems 2007-05-21 00:32:29 0 d-------- C:\Program Files\Ulead Systems 2007-05-21 00:32:28 0 d--h----- C:\Program Files\InstallShield Installation Information 2007-05-21 00:31:51 0 d-------- C:\Program Files\Common Files\InstallShield 2007-05-09 16:41:35 0 d-------- C:\Program Files\ACD Systems 2007-05-08 18:02:30 0 d-------- C:\Program Files\ABBYY FineReader 7.0 Professional Edition 2007-05-08 17:51:22 0 d-------- C:\Program Files\English Translator 3 2007-05-08 17:18:11 89184 --a------ C:\WINDOWS\System32\drivers\imagedrv.sys <Not Verified; Ahead Software AG and its licensors; NERO IMAGEDRIVE> 2007-05-08 17:18:03 155648 --a------ C:\WINDOWS\System32\NeroCheck.exe <Not Verified; Ahead Software Gmbh; Ahead Software Gmbh NeroCheck> 2007-05-08 17:10:50 106496 --a------ C:\WINDOWS\System32\TwnLib20.dll <Not Verified; Pegasus Software; TWNLIB20> 2007-05-08 17:10:50 38912 --a------ C:\WINDOWS\System32\picn20.dll <Not Verified; Pegasus Imaging Corp.; PEGASUS> 2007-05-08 17:10:49 544768 --a------ C:\WINDOWS\System32\imagx5.dll <Not Verified; Pegasus Software, LLC; ImagXpress> 2007-05-08 17:10:49 569344 --a------ C:\WINDOWS\System32\imagr5.dll <Not Verified; Pegasus Software,LLC; ImagXpress> 2007-05-08 17:10:49 0 d-------- C:\Program Files\Common Files\Ahead 2007-05-08 17:10:46 0 d-------- C:\Program Files\Ahead 2007-05-08 17:08:33 997888 --a------ C:\WINDOWS\System32\wmvdmoe2.dll <Not Verified; Microsoft Corporation; Microsoft® Windows Media Services> 2007-05-08 17:08:33 892416 --a------ C:\WINDOWS\System32\wmspdmoe.dll <Not Verified; Microsoft Corporation; Microsoft® Windows Media Services> 2007-05-08 17:08:33 1111040 --a------ C:\WINDOWS\System32\wmsdmoe2.dll <Not Verified; Microsoft Corporation; Microsoft® Windows Media Services> 2007-05-08 17:07:53 0 d-------- C:\Program Files\3aLab 2007-05-08 17:07:21 122880 --a------ C:\WINDOWS\UnGins.exe 2007-05-08 17:07:20 0 d-------- C:\Program Files\Soulseek -- Find3M Report --------------------------------------------------------------- 2007-06-08 00:04:38 0 d-------- C:\Documents and Settings\Niewierny\Dane aplikacji\SlimBrowser 2007-06-07 23:52:31 16896 --a------ C:\WINDOWS\System32\tftp.exe 2007-06-07 23:52:31 42496 --a------ C:\WINDOWS\System32\ftp.exe 2007-06-06 00:04:55 0 d-------- C:\Documents and Settings\Niewierny\Dane aplikacji\Grisoft 2007-06-02 07:23:11 0 d-------- C:\Program Files\SlimBrowser 2007-06-01 19:47:33 0 d-------- C:\Documents and Settings\Niewierny\Dane aplikacji\AdobeUM 2007-05-22 21:54:13 30928 --a------ C:\Documents and Settings\Niewierny\Dane aplikacji\GDIPFONTCACHEV1.DAT 2007-05-21 00:39:41 0 d-------- C:\Documents and Settings\Niewierny\Dane aplikacji\Ulead Systems 2007-05-14 10:59:10 0 d-------- C:\Documents and Settings\Niewierny\Dane aplikacji\Ahead 2007-05-11 18:56:32 0 d-------- C:\Documents and Settings\Niewierny\Dane aplikacji\Adobe 2007-05-09 17:00:38 0 d-------- C:\Documents and Settings\Niewierny\Dane aplikacji\ACD Systems 2007-05-08 18:05:48 0 d-------- C:\Documents and Settings\Niewierny\Dane aplikacji\ABBYY 2007-05-08 17:24:40 0 d-------- C:\Documents and Settings\Niewierny\Dane aplikacji\Media Player Classic 2007-05-07 19:58:54 355830 --a------ C:\WINDOWS\System32\perfh015.dat 2007-05-07 19:58:54 49712 --a------ C:\WINDOWS\System32\perfc015.dat 2007-05-07 15:12:41 0 d-------- C:\Documents and Settings\Niewierny\Dane aplikacji\Real 2007-05-06 19:37:07 0 d-------- C:\Documents and Settings\Niewierny\Dane aplikacji\Macromedia 2007-05-06 18:54:52 0 d-------- C:\Program Files\MyWay 2007-05-06 18:53:23 133632 --a------ C:\WINDOWS\System32\sfc_os.dll <Not Verified; Microsoft Corporation; System operacyjny Microsoft® Windows®> 2007-05-06 18:51:56 0 d-------- C:\Program Files\K-Lite Codec Pack 2007-05-06 18:46:40 0 d-------- C:\Program Files\Gadu-Gadu 2007-05-06 18:46:01 0 d-------- C:\Program Files\Winamp 2007-05-06 18:44:16 990 --a------ C:\WINDOWS\unins000.dat 2007-05-06 18:43:20 0 d-------- C:\Program Files\Common Files\ODBC 2007-05-06 18:43:14 0 d-------- C:\Program Files\Common Files\SpeechEngines 2007-05-06 18:42:04 0 d-------- C:\Program Files\Common Files\Adobe 2007-05-06 18:41:50 62 --ahs---- C:\Documents and Settings\Niewierny\Dane aplikacji\desktop.ini 2007-05-06 18:39:02 0 d-------- C:\Documents and Settings\Niewierny\Dane aplikacji\HP 2007-05-06 18:38:28 113574 --a------ C:\WINDOWS\hpoins07.dat 2007-05-06 18:34:55 0 d-------- C:\Program Files\Common Files\HP 2007-05-06 18:34:53 0 d-------- C:\Program Files\HP 2007-05-06 18:33:02 0 d-------- C:\Program Files\Hewlett-Packard 2007-05-06 18:31:45 0 d-------- C:\Program Files\Common Files\Hewlett-Packard 2007-05-06 18:24:18 0 d--h----- C:\Program Files\WindowsUpdate 2007-05-06 18:11:47 0 d-------- C:\Program Files\ASUS 2007-05-06 18:09:18 0 d-------- C:\Program Files\Winbond 2007-05-06 18:07:56 4608 --a------ C:\WINDOWS\System32\w95inf32.dll <Not Verified; Microsoft Corporation; Microsoft® Plus! for Windows® 95> 2007-05-06 18:07:56 2272 --a------ C:\WINDOWS\System32\w95inf16.dll <Not Verified; Microsoft Corporation; Microsoft® Plus! for Windows® 95> 2007-05-06 18:07:45 0 d-------- C:\Program Files\PCI Audio Applications 2007-05-06 18:07:26 0 d-------- C:\Program Files\C-Media 2007-05-06 18:01:45 0 d-------- C:\Documents and Settings\Niewierny\Dane aplikacji\Identities 2007-05-06 17:56:15 0 d-------- C:\Program Files\microsoft frontpage 2007-05-06 17:55:50 0 -rahs---- C:\MSDOS.SYS 2007-05-06 17:55:50 0 -rahs---- C:\IO.SYS 2007-05-06 17:55:50 0 --a------ C:\CONFIG.SYS 2007-05-06 17:55:50 0 --a------ C:\AUTOEXEC.BAT 2007-05-06 17:54:13 0 d-------- C:\Program Files\Usługi online 2007-05-06 17:53:47 0 d-------- C:\Program Files\Movie Maker 2007-05-06 17:53:18 0 d-------- C:\Program Files\Common Files\MSSoap 2007-05-06 17:49:22 21856 --a------ C:\WINDOWS\System32\emptyregdb.dat 2007-05-06 17:48:53 0 d-------- C:\Program Files\Messenger 2007-05-06 17:48:48 0 d-------- C:\Program Files\MSN Gaming Zone 2007-05-06 17:48:45 0 d-------- C:\Program Files\Windows NT -- Registry Dump --------------------------------------------------------------- [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run] "NvCplDaemon"="RUNDLL32.EXE C:\\WINDOWS\\System32\\NvCpl.dll,NvStartup" "nwiz"="nwiz.exe /install" "HP Software Update"="C:\\Program Files\\HP\\HP Software Update\\HPWuSchd2.exe" "NeroFilterCheck"="C:\\WINDOWS\\system32\\NeroCheck.exe" "UVS10 Preload"="C:\\Program Files\\Ulead Systems\\Ulead VideoStudio 10\\uvPL.exe" "!AVG Anti-Spyware"="\"C:\\Program Files\\Grisoft\\AVG Anti-Spyware 7.5\\avgas.exe\" /minimized" [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run] "Gadu-Gadu"="\"C:\\Program Files\\Gadu-Gadu\\gg.exe\" /tray" [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system] "DisableRegistryTools"=dword:00000000 [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks] "{57B86673-276A-48B2-BAE7-C6DBB3020EB8}"="AVG Anti-Spyware 7.5" HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa Authentication Packages REG_MULTI_SZ msv1_0\0\0 Security Packages REG_MULTI_SZ kerberos\0msv1_0\0schannel\0wdigest\0\0 Notification Packages REG_MULTI_SZ scecli\0\0 [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Adobe Reader Speed Launch.lnk] "path"="C:\\Documents and Settings\\All Users\\Menu Start\\Programy\\Autostart\\Adobe Reader Speed Launch.lnk" "backup"="C:\\WINDOWS\\pss\\Adobe Reader Speed Launch.lnkCommon Startup" "location"="Common Startup" "command"="C:\\PROGRA~1\\Adobe\\ACROBA~1.0\\Reader\\READER~1.EXE " "item"="Adobe Reader Speed Launch" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^HP Digital Imaging Monitor.lnk] "path"="C:\\Documents and Settings\\All Users\\Menu Start\\Programy\\Autostart\\HP Digital Imaging Monitor.lnk" "backup"="C:\\WINDOWS\\pss\\HP Digital Imaging Monitor.lnkCommon Startup" "location"="Common Startup" "command"="C:\\PROGRA~1\\HP\\DIGITA~1\\bin\\hpqtra08.exe " "item"="HP Digital Imaging Monitor" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^ImageFox.lnk] "path"="C:\\Documents and Settings\\All Users\\Menu Start\\Programy\\Autostart\\ImageFox.lnk" "backup"="C:\\WINDOWS\\pss\\ImageFox.lnkCommon Startup" "location"="Common Startup" "command"="C:\\WINDOWS\\Installer\\{92E64C51-5096-442F-9A44-61CB2941391D}\\NewShortcut1.exe " "item"="ImageFox" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\C-Media Mixer] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="NewMixer" "hkey"="HKLM" "command"="C:\\WINDOWS\\NewMixer.exe /startup" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\FineReader7NewsReaderPro] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="AbbyyNewsReader" "hkey"="HKLM" "command"="C:\\Program Files\\ABBYY FineReader 7.0 Professional Edition\\AbbyyNewsReader.exe" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="msmsgs" "hkey"="HKCU" "command"="\"C:\\Program Files\\Messenger\\msmsgs.exe\" /background" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Svchost] LocalService REG_MULTI_SZ Alerter\0WebClient\0LmHosts\0RemoteRegistry\0upnphost\0SSDPSRV\0\0 NetworkService REG_MULTI_SZ DnsCache\0\0 rpcss REG_MULTI_SZ RpcSs\0\0 imgsvc REG_MULTI_SZ StiSvc\0\0 termsvcs REG_MULTI_SZ TermService\0\0 -- End of Deckard's System Scanner: finished at 2007-06-08 at 00:11:01 ---------

[ Dodano: Dzisiaj o 0:34 ]
a moze mam coś z BIOSEM ??

**Posty:** 18165 · przez **wojtas** 08 Cze 2007, 11:23

Użyj WWDC :
http://www.firewallleaktester.com/wwdc.htm
Zmień opcje z disable na enable. Uruchom ponownie komputer.
Tak powinny wyglądać porty (NetBIOS może być żółty) :
http://www.firewallleaktester.com/images_site/wwdc.jpg

Otwórz notatnik i wklej w nim to:

sc stop Windows Auto Update Tool
sc delete Windows Auto Update Tool
CD C:\WINDOWS
ATTRIB -R-S-H wault.exe
DEL wault.exe
CD C:\WINDOWS\System32
ATTRIB -R-S-H jzs.exe
ATTRIB -R-S-H qhd.exe
ATTRIB -R-S-H ftd.exe
ATTRIB -R-S-H idj.exe
DEL jzs.exe
DEL qhd.exe
DEL ftd.exe
DEL idj.exe

Plik >>> Zapisz jako >>> Zmień rozszerzenie z TXT na Wszystkie pliki >>> Zapisz pod nazwą FIX.BAT i uruchom go w trybie awaryjnym.
potem nowy log

**Posty:** 40 · przez **Niewierny** 08 Cze 2007, 12:04

mam poprostu uruchomić go jak będe miał kompa w trybie awaryjnym??
cały czas wyskakuje mi komunikat ze zaraz zostanie zamknięty system odliczanie jest 1 min przy włączneiu kompa wyskakuje mi komunikat o VTtimer nawet jak go usuwałem to mi znowu wyskakiwał reset ??
o to log zrobiony podczas zamykania sysyemu

Kod: Zaznacz wszystko
Logfile of HijackThis v1.99.1 Scan saved at 11:24, on 07-06-08 Platform: Windows XP Dodatek SP. 1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\Program Files\HP\HP Software Update\HPWuSchd2.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe C:\WINDOWS\System32\nvsvc32.exe C:\WINDOWS\System32\HPZipm12.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\imapi.exe C:\Documents and Settings\Niewierny\Pulpit\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.interia.pl/ R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O16 - DPF: ING Bank Online - https://ssl.bsk.com.pl/bskonl/component/INGOnl.cab O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://downloads.ewido.net/ewidoOnlineScan.cab O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe O23 - Service: Copyright (C) 2001-2005 S3 Graphics, Inc. (S3 Graphics, Inc.) - Unknown owner - C:\WINDOWS\VTTimer.exe O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe

[ Dodano: Dzisiaj o 12:49 ]

Kod: Zaznacz wszystko
Deckard's System Scanner v20070603.47 Run by Niewierny on 2007-06-08 at 12:27:19 Computer is in Normal Mode. -------------------------------------------------------------------------------- -- HijackThis (run as Niewierny.exe) ------------------------------------------- Logfile of HijackThis v1.99.1 Scan saved at 12:27, on 07-06-08 Platform: Windows XP Dodatek SP. 1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\Program Files\HP\HP Software Update\HPWuSchd2.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe C:\Program Files\Eset\nod32kui.exe C:\Program Files\Gadu-Gadu\gg.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe C:\Program Files\Eset\nod32krn.exe C:\WINDOWS\System32\nvsvc32.exe C:\WINDOWS\System32\HPZipm12.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe C:\Program Files\SlimBrowser\sbrowser.exe E:\download\dss.exe C:\DOCUME~1\NIEWIE~1\Pulpit\NIEWIE~1.EXE R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.interia.pl/ R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O16 - DPF: ING Bank Online - https://ssl.bsk.com.pl/bskonl/component/INGOnl.cab O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://downloads.ewido.net/ewidoOnlineScan.cab O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe O23 - Service: Copyright (C) 2001-2005 S3 Graphics, Inc. (S3 Graphics, Inc.) - Unknown owner - C:\WINDOWS\VTTimer.exe (file missing) O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe -- Files created between 2007-05-08 and 2007-06-08 ----------------------------- 2007-06-08 09:41:58 499200 --a------ C:\WINDOWS\System32\mai.exe 2007-06-02 07:23:17 51200 --a------ C:\WINDOWS\System32\dumphive.exe 2007-06-02 07:23:16 288417 --a------ C:\WINDOWS\System32\SrchSTS.exe <Not Verified; S!Ri; SrchSTS> 2007-05-21 00:36:14 0 d-------- C:\SmartSound Software 2007-05-21 00:35:19 0 d-------- C:\Program Files\SmartSound Software 2007-05-21 00:33:52 0 d-------- C:\Program Files\Windows Media Components 2007-05-21 00:32:30 0 d-------- C:\Program Files\Common Files\Ulead Systems 2007-05-21 00:32:29 0 d-------- C:\Program Files\Ulead Systems 2007-05-21 00:32:28 0 d--h----- C:\Program Files\InstallShield Installation Information 2007-05-21 00:31:51 0 d-------- C:\Program Files\Common Files\InstallShield 2007-05-09 16:41:35 0 d-------- C:\Program Files\ACD Systems 2007-05-08 18:02:30 0 d-------- C:\Program Files\ABBYY FineReader 7.0 Professional Edition 2007-05-08 17:51:22 0 d-------- C:\Program Files\English Translator 3 2007-05-08 17:18:11 89184 --a------ C:\WINDOWS\System32\drivers\imagedrv.sys <Not Verified; Ahead Software AG and its licensors; NERO IMAGEDRIVE> 2007-05-08 17:18:03 155648 --a------ C:\WINDOWS\System32\NeroCheck.exe <Not Verified; Ahead Software Gmbh; Ahead Software Gmbh NeroCheck> 2007-05-08 17:10:50 106496 --a------ C:\WINDOWS\System32\TwnLib20.dll <Not Verified; Pegasus Software; TWNLIB20> 2007-05-08 17:10:50 38912 --a------ C:\WINDOWS\System32\picn20.dll <Not Verified; Pegasus Imaging Corp.; PEGASUS> 2007-05-08 17:10:49 544768 --a------ C:\WINDOWS\System32\imagx5.dll <Not Verified; Pegasus Software, LLC; ImagXpress> 2007-05-08 17:10:49 569344 --a------ C:\WINDOWS\System32\imagr5.dll <Not Verified; Pegasus Software,LLC; ImagXpress> 2007-05-08 17:10:49 0 d-------- C:\Program Files\Common Files\Ahead 2007-05-08 17:10:46 0 d-------- C:\Program Files\Ahead 2007-05-08 17:08:33 997888 --a------ C:\WINDOWS\System32\wmvdmoe2.dll <Not Verified; Microsoft Corporation; Microsoft® Windows Media Services> 2007-05-08 17:08:33 892416 --a------ C:\WINDOWS\System32\wmspdmoe.dll <Not Verified; Microsoft Corporation; Microsoft® Windows Media Services> 2007-05-08 17:08:33 1111040 --a------ C:\WINDOWS\System32\wmsdmoe2.dll <Not Verified; Microsoft Corporation; Microsoft® Windows Media Services> 2007-05-08 17:07:53 0 d-------- C:\Program Files\3aLab 2007-05-08 17:07:21 122880 --a------ C:\WINDOWS\UnGins.exe 2007-05-08 17:07:20 0 d-------- C:\Program Files\Soulseek -- Find3M Report --------------------------------------------------------------- 2007-06-08 12:04:24 0 d-------- C:\Documents and Settings\Niewierny\Dane aplikacji\SlimBrowser 2007-06-08 11:29:50 16896 --a------ C:\WINDOWS\System32\tftp.exe 2007-06-08 11:29:50 42496 --a------ C:\WINDOWS\System32\ftp.exe 2007-06-08 11:16:39 0 d-------- C:\Program Files\Windows NT 2007-06-06 00:04:55 0 d-------- C:\Documents and Settings\Niewierny\Dane aplikacji\Grisoft 2007-06-02 07:23:11 0 d-------- C:\Program Files\SlimBrowser 2007-06-01 19:47:33 0 d-------- C:\Documents and Settings\Niewierny\Dane aplikacji\AdobeUM 2007-05-22 21:54:13 30928 --a------ C:\Documents and Settings\Niewierny\Dane aplikacji\GDIPFONTCACHEV1.DAT 2007-05-21 00:39:41 0 d-------- C:\Documents and Settings\Niewierny\Dane aplikacji\Ulead Systems 2007-05-14 10:59:10 0 d-------- C:\Documents and Settings\Niewierny\Dane aplikacji\Ahead 2007-05-11 18:56:32 0 d-------- C:\Documents and Settings\Niewierny\Dane aplikacji\Adobe 2007-05-09 17:00:38 0 d-------- C:\Documents and Settings\Niewierny\Dane aplikacji\ACD Systems 2007-05-08 18:05:48 0 d-------- C:\Documents and Settings\Niewierny\Dane aplikacji\ABBYY 2007-05-08 17:24:40 0 d-------- C:\Documents and Settings\Niewierny\Dane aplikacji\Media Player Classic 2007-05-07 19:58:54 355830 --a------ C:\WINDOWS\System32\perfh015.dat 2007-05-07 19:58:54 49712 --a------ C:\WINDOWS\System32\perfc015.dat 2007-05-07 15:12:41 0 d-------- C:\Documents and Settings\Niewierny\Dane aplikacji\Real 2007-05-06 19:37:07 0 d-------- C:\Documents and Settings\Niewierny\Dane aplikacji\Macromedia 2007-05-06 18:54:52 0 d-------- C:\Program Files\MyWay 2007-05-06 18:53:23 133632 --a------ C:\WINDOWS\System32\sfc_os.dll <Not Verified; Microsoft Corporation; System operacyjny Microsoft® Windows®> 2007-05-06 18:51:56 0 d-------- C:\Program Files\K-Lite Codec Pack 2007-05-06 18:46:40 0 d-------- C:\Program Files\Gadu-Gadu 2007-05-06 18:46:01 0 d-------- C:\Program Files\Winamp 2007-05-06 18:44:16 990 --a------ C:\WINDOWS\unins000.dat 2007-05-06 18:43:20 0 d-------- C:\Program Files\Common Files\ODBC 2007-05-06 18:43:14 0 d-------- C:\Program Files\Common Files\SpeechEngines 2007-05-06 18:42:04 0 d-------- C:\Program Files\Common Files\Adobe 2007-05-06 18:41:50 62 --ahs---- C:\Documents and Settings\Niewierny\Dane aplikacji\desktop.ini 2007-05-06 18:39:02 0 d-------- C:\Documents and Settings\Niewierny\Dane aplikacji\HP 2007-05-06 18:38:28 113574 --a------ C:\WINDOWS\hpoins07.dat 2007-05-06 18:34:55 0 d-------- C:\Program Files\Common Files\HP 2007-05-06 18:34:53 0 d-------- C:\Program Files\HP 2007-05-06 18:33:02 0 d-------- C:\Program Files\Hewlett-Packard 2007-05-06 18:31:45 0 d-------- C:\Program Files\Common Files\Hewlett-Packard 2007-05-06 18:24:18 0 d--h----- C:\Program Files\WindowsUpdate 2007-05-06 18:11:47 0 d-------- C:\Program Files\ASUS 2007-05-06 18:09:18 0 d-------- C:\Program Files\Winbond 2007-05-06 18:07:56 4608 --a------ C:\WINDOWS\System32\w95inf32.dll <Not Verified; Microsoft Corporation; Microsoft® Plus! for Windows® 95> 2007-05-06 18:07:56 2272 --a------ C:\WINDOWS\System32\w95inf16.dll <Not Verified; Microsoft Corporation; Microsoft® Plus! for Windows® 95> 2007-05-06 18:07:45 0 d-------- C:\Program Files\PCI Audio Applications 2007-05-06 18:07:26 0 d-------- C:\Program Files\C-Media 2007-05-06 18:01:45 0 d-------- C:\Documents and Settings\Niewierny\Dane aplikacji\Identities 2007-05-06 17:56:15 0 d-------- C:\Program Files\microsoft frontpage 2007-05-06 17:55:50 0 -rahs---- C:\MSDOS.SYS 2007-05-06 17:55:50 0 -rahs---- C:\IO.SYS 2007-05-06 17:55:50 0 --a------ C:\CONFIG.SYS 2007-05-06 17:55:50 0 --a------ C:\AUTOEXEC.BAT 2007-05-06 17:54:13 0 d-------- C:\Program Files\Usługi online 2007-05-06 17:53:47 0 d-------- C:\Program Files\Movie Maker 2007-05-06 17:53:18 0 d-------- C:\Program Files\Common Files\MSSoap 2007-05-06 17:49:22 21856 --a------ C:\WINDOWS\System32\emptyregdb.dat 2007-05-06 17:48:53 0 d-------- C:\Program Files\Messenger 2007-05-06 17:48:48 0 d-------- C:\Program Files\MSN Gaming Zone -- Registry Dump --------------------------------------------------------------- [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run] "NvCplDaemon"="RUNDLL32.EXE C:\\WINDOWS\\System32\\NvCpl.dll,NvStartup" "nwiz"="nwiz.exe /install" "HP Software Update"="C:\\Program Files\\HP\\HP Software Update\\HPWuSchd2.exe" "NeroFilterCheck"="C:\\WINDOWS\\system32\\NeroCheck.exe" "!AVG Anti-Spyware"="\"C:\\Program Files\\Grisoft\\AVG Anti-Spyware 7.5\\avgas.exe\" /minimized" "nod32kui"="\"C:\\Program Files\\Eset\\nod32kui.exe\" /WAITSERVICE" [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run] "Gadu-Gadu"="\"C:\\Program Files\\Gadu-Gadu\\gg.exe\" /tray" [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system] "DisableRegistryTools"=dword:00000000 [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks] "{57B86673-276A-48B2-BAE7-C6DBB3020EB8}"="AVG Anti-Spyware 7.5" HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa Authentication Packages REG_MULTI_SZ msv1_0\0\0 Security Packages REG_MULTI_SZ kerberos\0msv1_0\0schannel\0wdigest\0\0 Notification Packages REG_MULTI_SZ scecli\0\0 [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Adobe Reader Speed Launch.lnk] "path"="C:\\Documents and Settings\\All Users\\Menu Start\\Programy\\Autostart\\Adobe Reader Speed Launch.lnk" "backup"="C:\\WINDOWS\\pss\\Adobe Reader Speed Launch.lnkCommon Startup" "location"="Common Startup" "command"="C:\\PROGRA~1\\Adobe\\ACROBA~1.0\\Reader\\READER~1.EXE " "item"="Adobe Reader Speed Launch" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^HP Digital Imaging Monitor.lnk] "path"="C:\\Documents and Settings\\All Users\\Menu Start\\Programy\\Autostart\\HP Digital Imaging Monitor.lnk" "backup"="C:\\WINDOWS\\pss\\HP Digital Imaging Monitor.lnkCommon Startup" "location"="Common Startup" "command"="C:\\PROGRA~1\\HP\\DIGITA~1\\bin\\hpqtra08.exe " "item"="HP Digital Imaging Monitor" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^ImageFox.lnk] "path"="C:\\Documents and Settings\\All Users\\Menu Start\\Programy\\Autostart\\ImageFox.lnk" "backup"="C:\\WINDOWS\\pss\\ImageFox.lnkCommon Startup" "location"="Common Startup" "command"="C:\\WINDOWS\\Installer\\{92E64C51-5096-442F-9A44-61CB2941391D}\\NewShortcut1.exe " "item"="ImageFox" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\C-Media Mixer] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="NewMixer" "hkey"="HKLM" "command"="C:\\WINDOWS\\NewMixer.exe /startup" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\FineReader7NewsReaderPro] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="AbbyyNewsReader" "hkey"="HKLM" "command"="C:\\Program Files\\ABBYY FineReader 7.0 Professional Edition\\AbbyyNewsReader.exe" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="msmsgs" "hkey"="HKCU" "command"="\"C:\\Program Files\\Messenger\\msmsgs.exe\" /background" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UVS10 Preload] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="uvPL" "hkey"="HKLM" "command"="C:\\Program Files\\Ulead Systems\\Ulead VideoStudio 10\\uvPL.exe" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Svchost] LocalService REG_MULTI_SZ Alerter\0WebClient\0LmHosts\0RemoteRegistry\0upnphost\0SSDPSRV\0\0 NetworkService REG_MULTI_SZ DnsCache\0\0 rpcss REG_MULTI_SZ RpcSs\0\0 imgsvc REG_MULTI_SZ StiSvc\0\0 termsvcs REG_MULTI_SZ TermService\0\0 -- End of Deckard's System Scanner: finished at 2007-06-08 at 12:28:01 ---------

**Posty:** 18165 · przez **wojtas** 08 Cze 2007, 13:05

uruchom narzędzie : The Avenger
http://swandog46.geekstogo.com/avenger.zip
Zaznacz opcję Input script manually i kliknij na Lupkę z prawej strony. W okienku, które się otworzy wklejasz:

Files to delete:

C:\WINDOWS\System32\mai.exe

Folders to delete:

C:\Program Files\Common Files\delsim

Klikasz Done, a następnie zielone światełko i zgadzasz się na restart klikając OK.

ten plik

C:\WINDOWS\VTTimer.exe

przeskanuj tutaj i daj raporty:

http://virusscan.jotti.org/
http://www.virustotal.com/

Kasujesz ręcznie z dysku plik: C:\Avenger\backup.zip i wklejasz na forum raport: C:\avenger.txt + log z dss + combofix:

http://download.bleepingcomputer.com/sUBs/ComboFix.exe

**Posty:** 40 · przez **Niewierny** 16 Cze 2007, 18:50

witam
sorki ze tak długo ale mnie nie było
szczeże powiedziawzy to odkąd użyłem WWDC to wydaje mi się ze problem zniknoł
niewiem czy przesyłac dalej logi
?????
pozdrawiam

**Posty:** 18165 · przez **wojtas** 16 Cze 2007, 20:13

przeslin wszystko o co prosilem w poprzednim moim poscie

**Posty:** 40 · przez **Niewierny** 17 Cze 2007, 19:05

Kod: Zaznacz wszystko
Logfile of The Avenger version 1, by Swandog46 Running from registry key: \Registry\Machine\System\CurrentControlSet\Services\ayvqlpte ******************* Script file located at: \??\C:\WINDOWS\System32\uxfpfukv.txt Script file opened successfully. Script file read successfully Backups directory opened successfully at C:\Avenger ******************* Beginning to process script file: File C:\WINDOWS\System32\mai.exe not found! Deletion of file C:\WINDOWS\System32\mai.exe failed! Could not process line: C:\WINDOWS\System32\mai.exe Status: 0xc0000034 Folder C:\Program Files\Common Files\delsim not found! Deletion of folder C:\Program Files\Common Files\delsim failed! Could not process line: C:\Program Files\Common Files\delsim Status: 0xc0000034 Completed script processing. ******************* Finished! Terminate.

[ Dodano: Dzisiaj o 19:09 ]

Kod: Zaznacz wszystko
Deckard's System Scanner v20070603.47 Run by Niewierny on 2007-06-17 at 18:45:26 Computer is in Normal Mode. -------------------------------------------------------------------------------- -- HijackThis (run as Niewierny.exe) ------------------------------------------- Logfile of HijackThis v1.99.1 Scan saved at 18:45, on 07-06-17 Platform: Windows XP Dodatek SP. 1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\Program Files\HP\HP Software Update\HPWuSchd2.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe C:\Program Files\Eset\nod32kui.exe C:\Program Files\Gadu-Gadu\gg.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe C:\Program Files\Eset\nod32krn.exe C:\WINDOWS\System32\nvsvc32.exe C:\WINDOWS\System32\HPZipm12.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe C:\PROGRA~1\MICROS~2\Office10\OUTLOOK.EXE C:\Program Files\SlimBrowser\sbrowser.exe C:\WINDOWS\msagent\AgentSvr.exe C:\Program Files\Microsoft Office\Office10\WINWORD.EXE C:\WINDOWS\System32\ctfmon.exe C:\Program Files\WinRAR\WinRAR.exe E:\download\dss.exe C:\DOCUME~1\NIEWIE~1\Pulpit\NIEWIE~1.EXE R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.interia.pl/ R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O16 - DPF: ING Bank Online - https://ssl.bsk.com.pl/bskonl/component/INGOnl.cab O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://downloads.ewido.net/ewidoOnlineScan.cab O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe O23 - Service: Copyright (C) 2001-2005 S3 Graphics, Inc. (S3 Graphics, Inc.) - Unknown owner - C:\WINDOWS\VTTimer.exe (file missing) O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe -- Files created between 2007-05-17 and 2007-06-17 ----------------------------- 2007-06-17 18:45:43 170 --a------ C:\combo.vbs 2007-06-08 12:09:32 298104 --a------ C:\WINDOWS\System32\imon.dll <Not Verified; Eset; NOD32 Antivirus System> 2007-06-02 07:23:17 51200 --a------ C:\WINDOWS\System32\dumphive.exe 2007-06-02 07:23:16 288417 --a------ C:\WINDOWS\System32\SrchSTS.exe <Not Verified; S!Ri; SrchSTS> 2007-05-21 00:36:14 0 d-------- C:\SmartSound Software 2007-05-21 00:35:19 0 d-------- C:\Program Files\SmartSound Software 2007-05-21 00:33:52 0 d-------- C:\Program Files\Windows Media Components 2007-05-21 00:32:30 0 d-------- C:\Program Files\Common Files\Ulead Systems 2007-05-21 00:32:29 0 d-------- C:\Program Files\Ulead Systems 2007-05-21 00:32:28 0 d--h----- C:\Program Files\InstallShield Installation Information 2007-05-21 00:31:51 0 d-------- C:\Program Files\Common Files\InstallShield -- Find3M Report --------------------------------------------------------------- 2007-06-17 18:45:58 0 d-------- C:\Documents and Settings\Niewierny\Dane aplikacji\SlimBrowser 2007-06-16 22:47:19 0 d-------- C:\Program Files\English Translator 3 2007-06-11 23:11:49 0 d-------- C:\Program Files\SlimBrowser 2007-06-08 11:29:50 16896 --a------ C:\WINDOWS\System32\tftp.exe 2007-06-08 11:29:50 42496 --a------ C:\WINDOWS\System32\ftp.exe 2007-06-08 11:16:39 0 d-------- C:\Program Files\Windows NT 2007-06-06 00:04:55 0 d-------- C:\Documents and Settings\Niewierny\Dane aplikacji\Grisoft 2007-06-01 19:47:33 0 d-------- C:\Documents and Settings\Niewierny\Dane aplikacji\AdobeUM 2007-05-22 21:54:13 30928 --a------ C:\Documents and Settings\Niewierny\Dane aplikacji\GDIPFONTCACHEV1.DAT 2007-05-21 00:39:41 0 d-------- C:\Documents and Settings\Niewierny\Dane aplikacji\Ulead Systems 2007-05-15 23:07:42 0 d-------- C:\Program Files\Soulseek 2007-05-14 10:59:10 0 d-------- C:\Documents and Settings\Niewierny\Dane aplikacji\Ahead 2007-05-11 18:56:32 0 d-------- C:\Documents and Settings\Niewierny\Dane aplikacji\Adobe 2007-05-09 17:00:38 0 d-------- C:\Documents and Settings\Niewierny\Dane aplikacji\ACD Systems 2007-05-09 16:42:33 0 d-------- C:\Program Files\ACD Systems 2007-05-08 18:05:48 0 d-------- C:\Documents and Settings\Niewierny\Dane aplikacji\ABBYY 2007-05-08 18:04:54 0 d-------- C:\Program Files\ABBYY FineReader 7.0 Professional Edition 2007-05-08 17:24:40 0 d-------- C:\Documents and Settings\Niewierny\Dane aplikacji\Media Player Classic 2007-05-08 17:18:04 0 d-------- C:\Program Files\Ahead 2007-05-08 17:10:50 0 d-------- C:\Program Files\Common Files\Ahead 2007-05-08 17:07:53 0 d-------- C:\Program Files\3aLab 2007-05-07 19:58:54 355830 --a------ C:\WINDOWS\System32\perfh015.dat 2007-05-07 19:58:54 49712 --a------ C:\WINDOWS\System32\perfc015.dat 2007-05-07 15:12:41 0 d-------- C:\Documents and Settings\Niewierny\Dane aplikacji\Real 2007-05-06 19:37:07 0 d-------- C:\Documents and Settings\Niewierny\Dane aplikacji\Macromedia 2007-05-06 18:54:52 0 d-------- C:\Program Files\MyWay 2007-05-06 18:53:23 133632 --a------ C:\WINDOWS\System32\sfc_os.dll <Not Verified; Microsoft Corporation; System operacyjny Microsoft® Windows®> 2007-05-06 18:51:56 0 d-------- C:\Program Files\K-Lite Codec Pack 2007-05-06 18:46:40 0 d-------- C:\Program Files\Gadu-Gadu 2007-05-06 18:46:01 0 d-------- C:\Program Files\Winamp 2007-05-06 18:44:16 990 --a------ C:\WINDOWS\unins000.dat 2007-05-06 18:43:20 0 d-------- C:\Program Files\Common Files\ODBC 2007-05-06 18:43:14 0 d-------- C:\Program Files\Common Files\SpeechEngines 2007-05-06 18:42:04 0 d-------- C:\Program Files\Common Files\Adobe 2007-05-06 18:41:50 62 --ahs---- C:\Documents and Settings\Niewierny\Dane aplikacji\desktop.ini 2007-05-06 18:39:02 0 d-------- C:\Documents and Settings\Niewierny\Dane aplikacji\HP 2007-05-06 18:38:28 113574 --a------ C:\WINDOWS\hpoins07.dat 2007-05-06 18:34:55 0 d-------- C:\Program Files\Common Files\HP 2007-05-06 18:34:53 0 d-------- C:\Program Files\HP 2007-05-06 18:33:02 0 d-------- C:\Program Files\Hewlett-Packard 2007-05-06 18:31:45 0 d-------- C:\Program Files\Common Files\Hewlett-Packard 2007-05-06 18:24:18 0 d--h----- C:\Program Files\WindowsUpdate 2007-05-06 18:11:47 0 d-------- C:\Program Files\ASUS 2007-05-06 18:09:18 0 d-------- C:\Program Files\Winbond 2007-05-06 18:07:56 4608 --a------ C:\WINDOWS\System32\w95inf32.dll <Not Verified; Microsoft Corporation; Microsoft® Plus! for Windows® 95> 2007-05-06 18:07:56 2272 --a------ C:\WINDOWS\System32\w95inf16.dll <Not Verified; Microsoft Corporation; Microsoft® Plus! for Windows® 95> 2007-05-06 18:07:45 0 d-------- C:\Program Files\PCI Audio Applications 2007-05-06 18:07:26 0 d-------- C:\Program Files\C-Media 2007-05-06 18:01:45 0 d-------- C:\Documents and Settings\Niewierny\Dane aplikacji\Identities 2007-05-06 17:56:15 0 d-------- C:\Program Files\microsoft frontpage 2007-05-06 17:55:50 0 -rahs---- C:\MSDOS.SYS 2007-05-06 17:55:50 0 -rahs---- C:\IO.SYS 2007-05-06 17:55:50 0 --a------ C:\CONFIG.SYS 2007-05-06 17:55:50 0 --a------ C:\AUTOEXEC.BAT 2007-05-06 17:54:13 0 d-------- C:\Program Files\Usługi online 2007-05-06 17:53:47 0 d-------- C:\Program Files\Movie Maker 2007-05-06 17:53:18 0 d-------- C:\Program Files\Common Files\MSSoap 2007-05-06 17:49:22 21856 --a------ C:\WINDOWS\System32\emptyregdb.dat 2007-05-06 17:48:53 0 d-------- C:\Program Files\Messenger 2007-05-06 17:48:48 0 d-------- C:\Program Files\MSN Gaming Zone -- Registry Dump --------------------------------------------------------------- [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run] "NvCplDaemon"="RUNDLL32.EXE C:\\WINDOWS\\System32\\NvCpl.dll,NvStartup" "nwiz"="nwiz.exe /install" "HP Software Update"="C:\\Program Files\\HP\\HP Software Update\\HPWuSchd2.exe" "NeroFilterCheck"="C:\\WINDOWS\\system32\\NeroCheck.exe" "!AVG Anti-Spyware"="\"C:\\Program Files\\Grisoft\\AVG Anti-Spyware 7.5\\avgas.exe\" /minimized" "nod32kui"="\"C:\\Program Files\\Eset\\nod32kui.exe\" /WAITSERVICE" [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run] "Gadu-Gadu"="\"C:\\Program Files\\Gadu-Gadu\\gg.exe\" /tray" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks] "{57B86673-276A-48B2-BAE7-C6DBB3020EB8}"="AVG Anti-Spyware 7.5" HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa Authentication Packages REG_MULTI_SZ msv1_0\0\0 Security Packages REG_MULTI_SZ kerberos\0msv1_0\0schannel\0wdigest\0\0 Notification Packages REG_MULTI_SZ scecli\0\0 HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\AVG Anti-Spyware Driver HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\AVG Anti-Spyware Guard [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Adobe Reader Speed Launch.lnk] "path"="C:\\Documents and Settings\\All Users\\Menu Start\\Programy\\Autostart\\Adobe Reader Speed Launch.lnk" "backup"="C:\\WINDOWS\\pss\\Adobe Reader Speed Launch.lnkCommon Startup" "location"="Common Startup" "command"="C:\\PROGRA~1\\Adobe\\ACROBA~1.0\\Reader\\READER~1.EXE " "item"="Adobe Reader Speed Launch" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^HP Digital Imaging Monitor.lnk] "path"="C:\\Documents and Settings\\All Users\\Menu Start\\Programy\\Autostart\\HP Digital Imaging Monitor.lnk" "backup"="C:\\WINDOWS\\pss\\HP Digital Imaging Monitor.lnkCommon Startup" "location"="Common Startup" "command"="C:\\PROGRA~1\\HP\\DIGITA~1\\bin\\hpqtra08.exe " "item"="HP Digital Imaging Monitor" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^ImageFox.lnk] "path"="C:\\Documents and Settings\\All Users\\Menu Start\\Programy\\Autostart\\ImageFox.lnk" "backup"="C:\\WINDOWS\\pss\\ImageFox.lnkCommon Startup" "location"="Common Startup" "command"="C:\\WINDOWS\\Installer\\{92E64C51-5096-442F-9A44-61CB2941391D}\\NewShortcut1.exe " "item"="ImageFox" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\C-Media Mixer] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="NewMixer" "hkey"="HKLM" "command"="C:\\WINDOWS\\NewMixer.exe /startup" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\FineReader7NewsReaderPro] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="AbbyyNewsReader" "hkey"="HKLM" "command"="C:\\Program Files\\ABBYY FineReader 7.0 Professional Edition\\AbbyyNewsReader.exe" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="msmsgs" "hkey"="HKCU" "command"="\"C:\\Program Files\\Messenger\\msmsgs.exe\" /background" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UVS10 Preload] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="uvPL" "hkey"="HKLM" "command"="C:\\Program Files\\Ulead Systems\\Ulead VideoStudio 10\\uvPL.exe" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Svchost] LocalService REG_MULTI_SZ Alerter\0WebClient\0LmHosts\0RemoteRegistry\0upnphost\0SSDPSRV\0\0 NetworkService REG_MULTI_SZ DnsCache\0\0 rpcss REG_MULTI_SZ RpcSs\0\0 imgsvc REG_MULTI_SZ StiSvc\0\0 termsvcs REG_MULTI_SZ TermService\0\0 -- End of Deckard's System Scanner: finished at 2007-06-17 at 18:46:32 ---------

[ Dodano: Dzisiaj o 19:12 ]

Kod: Zaznacz wszystko
ComboFix 07-06-17 "Niewierny" - 2007-06-17 18:46:22 - Dodatek Service Pack. 1 NTFS ((((((((((((((((((((((((( Files Created from 2007-05-17 to 2007-06-17 ))))))))))))))))))))))))))))))) 2007-06-08 12:09 512,096 --a------ C:\WINDOWS\system32\drivers\amon.sys 2007-06-08 12:09 298,104 --a------ C:\WINDOWS\system32\imon.dll 2007-06-08 12:09 15,424 --a------ C:\WINDOWS\system32\drivers\nod32drv.sys 2007-06-06 00:04 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys 2007-06-02 07:23 51,200 --a------ C:\WINDOWS\system32\dumphive.exe 2007-06-02 07:23 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe 2007-06-02 07:07 524,288 --ah----- C:\DOCUME~1\ADMINI~1\NTUSER.DAT 2007-06-02 07:07 <DIR> dr-h----- C:\DOCUME~1\ADMINI~1\Dane aplikacji 2007-06-02 07:07 <DIR> dr------- C:\DOCUME~1\ADMINI~1\Menu Start 2007-06-02 07:07 <DIR> d--h----- C:\DOCUME~1\ADMINI~1\Ustawienia lokalne 2007-06-02 07:07 <DIR> d--h----- C:\DOCUME~1\ADMINI~1\Szablony 2007-06-02 07:07 <DIR> d-------- C:\DOCUME~1\ADMINI~1\Ulubione 2007-06-02 07:07 <DIR> d-------- C:\DOCUME~1\ADMINI~1\Pulpit 2007-06-02 07:07 <DIR> d-------- C:\DOCUME~1\ADMINI~1\Moje dokumenty 2007-06-01 19:47 <DIR> d-------- C:\DOCUME~1\NIEWIE~1\DANEAP~1\AdobeUM 2007-05-31 08:25 <DIR> d-------- C:\DOCUME~1\LOCALS~1\DANEAP~1\SlimBrowser 2007-05-21 00:37 <DIR> d-------- C:\DOCUME~1\NIEWIE~1\DANEAP~1\Ulead Systems 2007-05-21 00:36 <DIR> d-------- C:\SmartSound Software 2007-05-21 00:35 <DIR> d-------- C:\Program Files\SmartSound Software 2007-05-21 00:35 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\SmartSound Software Inc 2007-05-21 00:33 <DIR> d-------- C:\Program Files\Windows Media Components 2007-05-21 00:33 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\InstallShield 2007-05-21 00:32 <DIR> d--h----- C:\Program Files\InstallShield Installation Information 2007-05-21 00:32 <DIR> d-------- C:\Program Files\Ulead Systems 2007-05-21 00:32 <DIR> d-------- C:\Program Files\Common Files\Ulead Systems 2007-05-21 00:32 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\Ulead Systems 2007-05-21 00:31 <DIR> d-------- C:\Program Files\Common Files\InstallShield 2007-05-20 19:29 30,928 --a------ C:\DOCUME~1\NIEWIE~1\DANEAP~1\GDIPFONTCACHEV1.DAT (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) 2007-06-17 16:45:58 -------- d-----w C:\DOCUME~1\NIEWIE~1\DANEAP~1\SlimBrowser 2007-06-16 20:47:19 -------- d-----w C:\Program Files\English Translator 3 2007-06-11 21:11:49 -------- d-----w C:\Program Files\SlimBrowser 2007-06-08 09:29:50 42,496 ----a-w C:\WINDOWS\system32\ftp.exe 2007-06-08 09:29:50 16,896 ----a-w C:\WINDOWS\system32\tftp.exe 2007-06-08 09:16:39 -------- d-----w C:\Program Files\Windows NT 2007-05-15 21:07:42 -------- d-----w C:\Program Files\Soulseek 2007-05-14 08:59:10 -------- d-----w C:\DOCUME~1\NIEWIE~1\DANEAP~1\Ahead 2007-05-09 15:00:38 -------- d-----w C:\DOCUME~1\NIEWIE~1\DANEAP~1\ACD Systems 2007-05-09 14:42:33 -------- d-----w C:\Program Files\ACD Systems 2007-05-08 16:05:48 -------- d-----w C:\DOCUME~1\NIEWIE~1\DANEAP~1\ABBYY 2007-05-08 16:04:54 -------- d-----w C:\Program Files\ABBYY FineReader 7.0 Professional Edition 2007-05-08 15:24:40 -------- d-----w C:\DOCUME~1\NIEWIE~1\DANEAP~1\Media Player Classic 2007-05-08 15:18:04 -------- d-----w C:\Program Files\Ahead 2007-05-08 15:10:50 -------- d-----w C:\Program Files\Common Files\Ahead 2007-05-08 15:07:53 -------- d-----w C:\Program Files\3aLab 2007-05-07 17:58:54 49,712 ----a-w C:\WINDOWS\system32\perfc015.dat 2007-05-07 17:58:54 355,830 ----a-w C:\WINDOWS\system32\perfh015.dat 2007-05-07 13:12:41 -------- d-----w C:\DOCUME~1\NIEWIE~1\DANEAP~1\Real 2007-05-06 16:54:52 -------- d-----w C:\Program Files\MyWay 2007-05-06 16:53:23 133,632 ----a-w C:\WINDOWS\system32\sfc_os.dll 2007-05-06 16:51:56 -------- d-----w C:\Program Files\K-Lite Codec Pack 2007-05-06 16:46:40 -------- d-----w C:\Program Files\Gadu-Gadu 2007-05-06 16:46:01 -------- d-----w C:\Program Files\Winamp 2007-05-06 16:44:16 990 ----a-w C:\WINDOWS\unins000.dat 2007-05-06 16:43:20 -------- d-----w C:\Program Files\Common Files\ODBC 2007-05-06 16:43:14 -------- d-----w C:\Program Files\Common Files\SpeechEngines 2007-05-06 16:39:02 -------- d-----w C:\DOCUME~1\NIEWIE~1\DANEAP~1\HP 2007-05-06 16:38:28 113,574 ----a-w C:\WINDOWS\hpoins07.dat 2007-05-06 16:34:55 -------- d-----w C:\Program Files\Common Files\HP 2007-05-06 16:34:53 -------- d-----w C:\Program Files\HP 2007-05-06 16:33:02 -------- d-----w C:\Program Files\Hewlett-Packard 2007-05-06 16:31:45 -------- d-----w C:\Program Files\Common Files\Hewlett-Packard 2007-05-06 16:24:18 -------- d--h--w C:\Program Files\WindowsUpdate 2007-05-06 16:11:47 -------- d-----w C:\Program Files\ASUS 2007-05-06 16:09:18 -------- d-----w C:\Program Files\Winbond 2007-05-06 16:07:56 4,608 ----a-w C:\WINDOWS\system32\w95inf32.dll 2007-05-06 16:07:56 2,272 ----a-w C:\WINDOWS\system32\w95inf16.dll 2007-05-06 16:07:45 -------- d-----w C:\Program Files\PCI Audio Applications 2007-05-06 16:07:26 -------- d-----w C:\Program Files\C-Media 2007-05-06 15:56:15 -------- d-----w C:\Program Files\microsoft frontpage 2007-05-06 15:55:50 0 --sha-r C:\MSDOS.SYS 2007-05-06 15:55:50 0 --sha-r C:\IO.SYS 2007-05-06 15:55:50 0 ----a-w C:\CONFIG.SYS 2007-05-06 15:55:50 0 ----a-w C:\AUTOEXEC.BAT 2007-05-06 15:54:13 -------- d-----w C:\Program Files\Usługi online 2007-05-06 15:53:47 -------- d-----w C:\Program Files\Movie Maker 2007-05-06 15:53:18 -------- d-----w C:\Program Files\Common Files\MSSoap 2007-05-06 15:49:22 21,856 ----a-w C:\WINDOWS\system32\emptyregdb.dat 2007-05-06 15:48:53 -------- d-----w C:\Program Files\Messenger 2007-05-06 15:48:48 -------- d-----w C:\Program Files\MSN Gaming Zone ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "nwiz"="nwiz.exe" [2003-01-10 10:47 C:\WINDOWS\system32\nwiz.exe] "HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2005-05-11 23:12] "!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-14 20:11] "nod32kui"="C:\Program Files\Eset\nod32kui.exe" [2007-06-08 12:08] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Gadu-Gadu"="C:\Program Files\Gadu-Gadu\gg.exe" [2005-08-30 20:51] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks] "{57B86673-276A-48B2-BAE7-C6DBB3020EB8}"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\shellexecutehook.dll" [2007-05-30 14:29] [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\AVG Anti-Spyware Driver] [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\AVG Anti-Spyware Guard] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Adobe Reader Speed Launch.lnk] path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Adobe Reader Speed Launch.lnk backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^HP Digital Imaging Monitor.lnk] path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\HP Digital Imaging Monitor.lnk backup=C:\WINDOWS\pss\HP Digital Imaging Monitor.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^ImageFox.lnk] path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\ImageFox.lnk backup=C:\WINDOWS\pss\ImageFox.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\C-Media Mixer] C:\WINDOWS\NewMixer.exe /startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\FineReader7NewsReaderPro] C:\Program Files\ABBYY FineReader 7.0 Professional Edition\AbbyyNewsReader.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UVS10 Preload] C:\Program Files\Ulead Systems\Ulead VideoStudio 10\uvPL.exe ************************************************************************** catchme 0.3.721 W2K/XP/Vista - userland rootkit detector by Gmer, http://www.gmer.net Rootkit scan 2007-06-17 18:48:15 Windows 5.1.2600 Dodatek Service Pack. 1 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** Completion time: 2007-06-17 18:49:18 --- E O F ---

**Posty:** 18165 · przez **wojtas** 18 Cze 2007, 00:11

jest ok

**Posty:** 40 · przez **Niewierny** 24 Cze 2007, 00:22

więc puki co to dziękuje
jeśli wystapią znowu jakies komplikacje to się odezwę
pozdrawiam

proszę o sprawdzenie loga delsim dialer

proszę o sprawdzenie loga Delsim Dialer

Kto jest na forum