proszę o sprawdzenie loga-dziwne problemy z pc

**Posty:** 395 · przez **Funny_Killer** 04 Paź 2007, 15:14

Witam otóż mam takie problemy z pc:
Gdy wkładam płyte do mojego dvd wczytuje sie i zaraz restart kompa :roll:

Po drugie kompa muszę włączac kilka razy bo ciągle albo sie monitor nie włącza albo się scina w ekranie logowania, lub przy połączeniu z neo.
Daje logi jeśli jednak to nic nie da to oddaje do serwisu.
Z gory dziękuję Wam za pomoc

Kod: Zaznacz wszystko: Logfile of HijackThis v1.99.1 Scan saved at 15:03:19, on 2007-10-04 Platform: Windows XP Dodatek SP. 1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\systemza32.exe C:\WINDOWS\System32\FTRTSVC.exe C:\WINDOWS\System32\dllcache\vvvhost.exe C:\WINDOWS\System32\nvsvc32.exe C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe C:\WINDOWS\System32\RUNDLL32.EXE C:\Program Files\A4Tech\Mouse\Amoumain.exe C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\WINDOWS\System32\rundll32.exe C:\PROGRA~1\NEOSTR~1\TaskBarIcon.exe C:\WINDOWS\System32\ctfmon.exe C:\WINDOWS\System32\wintema32.exe C:\Program Files\Gadu-Gadu\gg.exe C:\WINDOWS\System32\nvsvc86.exe C:\PROGRA~1\NEOSTR~1\neostradatp.exe C:\PROGRA~1\NEOSTR~1\ComComp.exe C:\PROGRA~1\NEOSTR~1\Toaster.exe C:\PROGRA~1\NEOSTR~1\Inactivity.exe C:\PROGRA~1\NEOSTR~1\PollingModule.exe C:\WINDOWS\System32\ALERTM~1\ALERTM~1.EXE C:\PROGRA~1\NEOSTR~1\Watch.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\WINDOWS\system32\utilman.exe C:\Program Files\Lineage II - PTS_PTS\LineageII.exe C:\Program Files\Windows NT\Accessories\wordpad.exe C:\Documents and Settings\Martyn\Pulpit\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.hotinfolink.com R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = neostrada tp R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\NEOSTR~1\SEARCH~1.DLL O1 - Hosts: 89.149.200.219 l2authd.lineage2.com O1 - Hosts: 89.149.200.219 l2testauthd.lineage2.com O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.1.8.30.dll O2 - BHO: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O3 - Toolbar: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\NEOSTR~1\Watch.exe O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\NEOSTR~1\GestMaj.exe TaskBarIcon.exe O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [WheelMouse] C:\Program Files\A4Tech\Mouse\Amoumain.exe O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [Network Security XP] C:\WINDOWS\System32\nvsvc86.exe O4 - HKLM\..\Run: [WinDLL (sslms.exe)] rundll32.exe C:\WINDOWS\System32\sslms.exe,start O4 - HKLM\..\Run: [Windows Secure Service] wintema32.exe O4 - HKLM\..\RunServices: [Notepad] C:\WINDOWS\System32\notepad.exe O4 - HKLM\..\RunServices: [Windows Secure Service] wintema32.exe O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - HKCU\..\Run: [Network Security XP] C:\WINDOWS\System32\nvsvc86.exe O4 - HKCU\..\Run: [Windows Secure Service] wintema32.exe O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm O9 - Extra button: BitComet Search - {461CC20B-FB6E-4f16-8FE8-C29359DB100E} - C:\Program Files\BitComet\tools\BitCometBHO_1.1.8.30.dll O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm O17 - HKLM\System\CCS\Services\Tcpip\..\{306BD9CA-56F5-464E-8745-0FBB964AFF5E}: NameServer = 194.204.159.1 217.98.63.164 O23 - Service: Background Intelligent Transfer Service mircosoft 32 - Unknown owner - C:\WINDOWS\systemza32.exe O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exe O23 - Service: Nicrosoft f11nt - Unknown owner - C:\WINDOWS\System32\dllcache\vvvhost.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe

**Posty:** 8694 · przez **Red** 04 Paź 2007, 15:20

do usunięcia masz:

C:\WINDOWS\systemza32.exe
C:\WINDOWS\System32\dllcache\vvvhost.exe
C:\WINDOWS\System32\wintema32.exe
O4 - HKLM\..\Run: [WinDLL (sslms.exe)] rundll32.exe C:\WINDOWS\System32\sslms.exe,start
O4 - HKLM\..\RunServices: [Notepad] C:\WINDOWS\System32\notepad.exe
O23 - Service: Background Intelligent Transfer Service mircosoft 32 - Unknown owner - C:\WINDOWS\systemza32.exe
O23 - Service: Nicrosoft f11nt - Unknown owner - C:\WINDOWS\System32\dllcache\vvvhost.exe

**Posty:** 395 · przez **Funny_Killer** 06 Paź 2007, 10:16

Nie zadziałało...
1. Nie mogłem w hijacku znaleźć tego:

Kod: Zaznacz wszystko: C:\WINDOWS\systemza32.exe C:\WINDOWS\System32\dllcache\vvvhost.exe C:\WINDOWS\System32\wintema32.exe

2.po usunięciu reszty logów komp działał przez godzinkę może więcej tak jak powinien, ale potem znowu wróciły ściny i nie poprawne działanie dvd.

Co mam teraz zrobić? :roll:

oddawać do serwisu czy jest jeszcze jakaś opcja która by mi pomogła?

Pozdrawiam

**Posty:** 18165 · przez **wojtas** 06 Paź 2007, 10:37

Funny_Killer napisał(a):Co mam teraz zrobić?

daj nowy log z hijacka oraz z combofixa

**Posty:** 395 · przez **Funny_Killer** 06 Paź 2007, 11:33

Hijack:

Kod: Zaznacz wszystko: Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\System32\FTRTSVC.exe C:\WINDOWS\System32\nvsvc32.exe C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe C:\WINDOWS\System32\RUNDLL32.EXE C:\Program Files\A4Tech\Mouse\Amoumain.exe C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\PROGRA~1\NEOSTR~1\TaskBarIcon.exe C:\WINDOWS\System32\ctfmon.exe C:\Program Files\Gadu-Gadu\gg.exe C:\WINDOWS\System32\wintema32.exe C:\WINDOWS\System32\nvsvc86.exe C:\PROGRA~1\NEOSTR~1\neostradatp.exe C:\PROGRA~1\NEOSTR~1\ComComp.exe C:\PROGRA~1\NEOSTR~1\Toaster.exe C:\PROGRA~1\NEOSTR~1\Inactivity.exe C:\PROGRA~1\NEOSTR~1\PollingModule.exe C:\WINDOWS\System32\ALERTM~1\ALERTM~1.EXE C:\PROGRA~1\NEOSTR~1\Watch.exe C:\Program Files\Windows NT\Accessories\WORDPAD.EXE C:\Documents and Settings\Martyn\Pulpit\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.hotinfolink.com R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\NEOSTR~1\SEARCH~1.DLL O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.1.8.30.dll O2 - BHO: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O3 - Toolbar: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\NEOSTR~1\Watch.exe O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\NEOSTR~1\GestMaj.exe TaskBarIcon.exe O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [WheelMouse] C:\Program Files\A4Tech\Mouse\Amoumain.exe O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [Network Security XP] C:\WINDOWS\System32\nvsvc86.exe O4 - HKLM\..\Run: [Windows Secure Service] wintema32.exe O4 - HKLM\..\RunServices: [Windows Secure Service] wintema32.exe O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - HKCU\..\Run: [Network Security XP] C:\WINDOWS\System32\nvsvc86.exe O4 - HKCU\..\Run: [Windows Secure Service] wintema32.exe O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm O9 - Extra button: BitComet Search - {461CC20B-FB6E-4f16-8FE8-C29359DB100E} - C:\Program Files\BitComet\tools\BitCometBHO_1.1.8.30.dll O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm O17 - HKLM\System\CCS\Services\Tcpip\..\{306BD9CA-56F5-464E-8745-0FBB964AFF5E}: NameServer = 194.204.159.1 217.98.63.164 O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe

Combofix:

Kod: Zaznacz wszystko: ComboFix 07-10-06.3 - Martyn 2007-10-06 11:30:50.3 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.1.1250.1.1045.18.666 [GMT 2:00] Running from: C:\Documents and Settings\Martyn\Pulpit\ComboFix.exe . ((((((((((((((((((((((((( Files Created from 2007-09-06 to 2007-10-06 ))))))))))))))))))))))))))))))) . 2007-10-06 11:26 53,760 ---hs---- C:\inf.exe 2007-10-06 11:22 51,200 --a------ C:\WINDOWS\NirCmd.exe 2007-10-05 21:06 664 --a------ C:\WINDOWS\system32\d3d9caps.dat 2007-10-04 14:24 <DIR> dr-h----- C:\Documents and Settings\Administrator\Dane aplikacji 2007-10-04 14:24 <DIR> dr------- C:\Documents and Settings\Administrator\Menu Start 2007-10-04 14:24 <DIR> d--h----- C:\Documents and Settings\Administrator\Ustawienia lokalne 2007-10-04 14:24 <DIR> d--h----- C:\Documents and Settings\Administrator\Szablony 2007-10-04 14:24 <DIR> d-------- C:\Documents and Settings\Administrator\Ulubione 2007-10-04 14:24 <DIR> d-------- C:\Documents and Settings\Administrator\Pulpit 2007-10-04 14:24 <DIR> d-------- C:\Documents and Settings\Administrator\Moje dokumenty 2007-10-04 14:11 <DIR> d-------- C:\WINDOWS\pss 2007-10-03 20:36 139,776 -r-hs---- C:\WINDOWS\systemza32.exe 2007-10-02 17:11 <DIR> d-------- C:\WINDOWS\system32\QuickTime 2007-10-01 19:22 2,560 --a------ C:\WINDOWS\system32\bitcometres.dll 2007-10-01 19:21 <DIR> d-------- C:\Program Files\BitComet 2007-09-30 22:56 129,546 --a------ C:\Documents and Settings\Martyn\bili.exe 2007-09-30 12:26 107,888 --a------ C:\WINDOWS\system32\CmdLineExt.dll 2007-09-30 12:26 <DIR> dr-h----- C:\Documents and Settings\Martyn\Dane aplikacji\SecuROM 2007-09-30 03:39 145,920 -r-hsc--- C:\WINDOWS\system32\dllcache\vvvhost.exe 2007-09-28 16:46 <DIR> d-------- C:\Program Files\Gothic III 2007-09-26 19:35 26,585 --ahs---- C:\WINDOWS\system32\rigdun.com 2007-09-26 19:35 211 --ahs---- C:\WINDOWS\system32\hrt.cmd 2007-09-26 19:35 20,061 --ahs---- C:\WINDOWS\system32\fecs.com 2007-09-26 19:35 189 --a------ C:\WINDOWS\system32\vbdir.com 2007-09-26 19:35 181 --ahs---- C:\WINDOWS\system32\vbdir.exe 2007-09-26 19:35 16,388 --ahs---- C:\WINDOWS\system32\hitro.pif 2007-09-26 19:35 120,832 --ahs---- C:\WINDOWS\system32\secuser.exe 2007-09-26 19:35 <DIR> d-------- C:\WINDOWS\system32\sounds 2007-09-26 19:35 <DIR> d-------- C:\WINDOWS\system32\logs 2007-09-23 22:59 <DIR> d--h----- C:\WINDOWS\PIF 2007-09-23 14:18 129,546 --a------ C:\Documents and Settings\Martyn\bilix.exe 2007-09-23 14:14 27 --a------ C:\Documents and Settings\Martyn\tamer.exe 2007-09-22 11:59 81,920 --------- C:\WINDOWS\nope.dll 2007-09-22 11:42 81,920 ---hs---- C:\WINDOWS\system32\sslms.exe 2007-09-22 11:42 27 --a------ C:\WINDOWS\tamer.bat 2007-09-18 15:02 <DIR> d-------- C:\WINDOWS\LogFiles 2007-09-16 21:32 24,960 --a--c--- C:\WINDOWS\system32\dllcache\usbprint.sys 2007-09-16 21:32 24,960 --a------ C:\WINDOWS\system32\drivers\usbprint.sys 2007-09-16 21:32 <DIR> d-------- C:\WUTemp 2007-09-15 11:23 <DIR> d-------- C:\Program Files\QuickTime 2007-09-15 11:23 <DIR> d-------- C:\Program Files\Apple Software Update 2007-09-15 11:23 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Apple 2007-09-15 11:21 <DIR> d-------- C:\Program Files\WinAVI MP4 Converter 2007-09-14 23:51 <DIR> d-------- C:\Program Files\Arial Sound Recorder 2007-09-14 17:16 34,816 --a------ C:\WINDOWS\system32\nvsvc86.exe 2007-09-08 19:18 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\nView_Profiles 2007-09-07 13:34 <DIR> d-------- C:\Program Files\XviD 2007-09-07 13:33 <DIR> d-------- C:\Program Files\DivXCodec 2007-09-07 13:33 <DIR> d-------- C:\Program Files\DivX . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2007-10-06 11:25 --------- d-------- C:\Program Files\neostrada tp 2007-10-05 23:17 --------- d-------- C:\Program Files\Lineage II - PTS_PTS 2007-10-02 17:11 --------- d-------- C:\Program Files\MarBit 2007-10-02 17:11 --------- d-------- C:\Program Files\D-Tools 2007-09-30 12:43 --------- d-------- C:\Documents and Settings\Martyn\Dane aplikacji\MegauploadToolbar 2007-09-29 19:08 --------- d-------- C:\Program Files\mIRC 2007-09-28 16:47 --------- d--h----- C:\Program Files\InstallShield Installation Information 2007-09-19 13:36 --------- d-------- C:\Program Files\MegauploadToolbar 2007-09-18 05:03 570880 --a------ C:\WINDOWS\system32\notepad.exe 2007-09-11 21:19 --------- d-------- C:\Documents and Settings\Martyn\Dane aplikacji\Real 2007-09-08 21:09 --------- d-------- C:\Program Files\Gadu-Gadu 2007-08-26 14:24 --------- d-------- C:\Program Files\Winamp 2007-08-23 15:10 --------- d-------- C:\Documents and Settings\Martyn\Dane aplikacji\Media Player Classic 2007-08-23 15:00 --------- d-------- C:\Program Files\K-Lite Codec Pack 2007-08-23 15:00 --------- d-------- C:\Documents and Settings\All Users\Dane aplikacji\Real 2007-08-22 14:17 --------- d-------- C:\Documents and Settings\Martyn\Dane aplikacji\Help 2007-08-22 11:43 --------- d-------- C:\Documents and Settings\Martyn\Dane aplikacji\InstallShield 2007-08-19 20:46 --------- d-------- C:\Program Files\ivo 2007-08-14 10:50 --------- d-------- C:\Program Files\Teamspeak2_RC2 2007-08-14 10:50 --------- d-------- C:\Documents and Settings\Martyn\Dane aplikacji\teamspeak2 2007-08-08 13:18 --------- d-------- C:\Documents and Settings\Martyn\Dane aplikacji\Gadu-Gadu 2007-08-08 00:10 --------- d-------- C:\Program Files\Alwil Software 2007-08-07 23:50 --------- d-------- C:\Program Files\A4Tech 2007-08-07 23:49 --------- d-------- C:\Program Files\Common Files\Ahead 2007-08-07 23:49 --------- d-------- C:\Program Files\Ahead 2007-08-07 23:48 --------- d-------- C:\Program Files\AVIcodec 2007-08-07 23:44 --------- d-------- C:\Program Files\VIA 2007-08-07 23:41 --------- d-------- C:\Program Files\VIA Technologies, Inc 2007-08-07 23:38 --------- d-------- C:\Program Files\Common Files\InstallShield 2007-08-07 23:09 --------- d-------- C:\Program Files\Thomson 2007-08-07 23:02 --------- d-------- C:\Program Files\microsoft frontpage 2007-07-29 17:51 7680 --a------ C:\WINDOWS\system32\ff_vfw.dll 2007-07-28 00:07 783224 --a------ C:\WINDOWS\system32\aswBoot.exe 2007-07-27 23:57 95608 --a------ C:\WINDOWS\system32\AvastSS.scr 2007-07-25 15:24 1559040 --a------ C:\WINDOWS\system32\xvidcore.dll --------- C:\Program Files\Usługi online 2002-09-28 22:00:00 204,288 --sh--r C:\WINDOWS\system32\nuidoeokf.exe 2006-09-19 05:21:00 26,585 --sha-w C:\WINDOWS\system32\rigdun.com 2003-02-08 09:31:12 120,832 --sha-w C:\WINDOWS\system32\secuser.exe 2007-06-17 10:55:13 81,920 --sh--w C:\WINDOWS\system32\sslms.exe 2002-09-28 22:00:00 297,472 --sh--r C:\WINDOWS\system32\wintema32.exe . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SpeedTouch USB Diagnostics"="C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" [2004-01-26 11:38] "WOOWATCH"="C:\PROGRA~1\NEOSTR~1\Watch.exe" [2004-08-23 14:49] "WOOTASKBARICON"="C:\PROGRA~1\NEOSTR~1\GestMaj.exe" [2004-10-14 16:55] "NvCplDaemon"="C:\WINDOWS\System32\NvCpl.dll" [2005-04-01 16:16] "NvMediaCenter"="C:\WINDOWS\System32\NvMcTray.dll" [2005-04-01 16:16] "WheelMouse"="C:\Program Files\A4Tech\Mouse\Amoumain.exe" [2006-03-14 10:49] "avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-07-28 00:03] "Network Security XP"="C:\WINDOWS\System32\nvsvc86.exe" [2007-09-14 17:16] "Windows Secure Service"="wintema32.exe" [2002-09-29 00:00 C:\WINDOWS\system32\wintema32.exe] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\System32\ctfmon.exe" [2002-09-29 00:00] "Gadu-Gadu"="C:\Program Files\Gadu-Gadu\gg.exe" [2007-07-09 09:39] "Network Security XP"="C:\WINDOWS\System32\nvsvc86.exe" [2007-09-14 17:16] "Windows Secure Service"="wintema32.exe" [2002-09-29 00:00 C:\WINDOWS\system32\wintema32.exe] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\runservices] "Windows Secure Service"=wintema32.exe [HKEY_USERS\.default\software\microsoft\windows\currentversion\run] "Network Security XP"=C:\WINDOWS\System32\nvsvc86.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^VIA RAID TOOL.lnk] path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\VIA RAID TOOL.lnk backup=C:\WINDOWS\pss\VIA RAID TOOL.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Martyn^Menu Start^Programy^Autostart^UniSpiker-2.6.lnk] path=C:\Documents and Settings\Martyn\Menu Start\Programy\Autostart\UniSpiker-2.6.lnk backup=C:\WINDOWS\pss\UniSpiker-2.6.lnkStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Notepad] C:\WINDOWS\System32\notepad.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz] nwiz.exe /install [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows Secure Service] wintema32.exe R0 viasraid;viasraid;C:\WINDOWS\System32\DRIVERS\viasraid.sys S0 d346bus;d346bus;C:\WINDOWS\System32\DRIVERS\d346bus.sys S0 d346prt;d346prt;C:\WINDOWS\System32\Drivers\d346prt.sys S4 Background Intelligent Transfer Service mircosoft 32;Background Intelligent Transfer Service mircosoft 32;"C:\WINDOWS\systemza32.exe" S4 Nicrosoft f11nt;Nicrosoft f11nt;"C:\WINDOWS\System32\dllcache\vvvhost.exe" . Contents of the 'Scheduled Tasks' folder "2007-09-21 14:58:02 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job" - C:\Program Files\Apple Software Update\SoftwareUpdate.exe . ************************************************************************** catchme 0.3.1169 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-10-06 11:31:21 Windows 5.1.2600 Dodatek Service Pack. 1 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2007-10-06 11:31:55 C:\ComboFix-quarantined-files.txt ... 2007-10-06 11:31 . --- E O F ---

**Posty:** 18165 · przez **wojtas** 06 Paź 2007, 11:47

skasuj te wpisy:

O4 - HKLM\..\Run: [Network Security XP] C:\WINDOWS\System32\nvsvc86.exe
O4 - HKLM\..\Run: [Windows Secure Service] wintema32.exe
O4 - HKLM\..\RunServices: [Windows Secure Service] wintema32.exe
O4 - HKCU\..\Run: [Network Security XP] C:\WINDOWS\System32\nvsvc86.exe
O4 - HKCU\..\Run: [Windows Secure Service] wintema32.exe
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm

Otworz notatnik i wklej w nim to:

File::
C:\WINDOWS\system32\dllcache\vvvhost.exe
C:\inf.exe
C:\WINDOWS\systemza32.exe
C:\WINDOWS\System32\wintema32.exe
C:\WINDOWS\System32\nvsvc86.exe
C:\WINDOWS\web\related.htm
C:\WINDOWS\system32\rigdun.com
C:\WINDOWS\system32\hrt.cmd
C:\WINDOWS\system32\fecs.com
C:\WINDOWS\system32\vbdir.com
C:\WINDOWS\system32\vbdir.exe
C:\WINDOWS\system32\hitro.pif
C:\WINDOWS\system32\secuser.exe
C:\Documents and Settings\Martyn\bilix.exe
C:\Documents and Settings\Martyn\tamer.exe
C:\WINDOWS\nope.dll
C:\WINDOWS\system32\sslms.exe
C:\WINDOWS\tamer.bat
C:\WINDOWS\system32\nuidoeokf.exe

Driver::

Background Intelligent Transfer Service mircosoft 32
Nicrosoft f11nt

Plik >>> zapisz jako CFScript.txt .Plik przeciągnij i upuść na ikonę ComboFixa (tak jak tu ) . Potwierdz >>> zresetuje sie komputer

(jeśli pojawi się pytanie "1 or 2" - to wpisz 1 i naciśnij ENTER). Rozpocznie się proces usuwania

Zastosuj SDFix . Po pobraniu uruchom go a rozpakuje się do C:\SDFix. Uruchom komputer w trybie awaryjnym (F8 przy stracie systemu). Będąc w awaryjnym uruchom plik RunThis.bat z folderu SDFixa. Zatwierdź czyszczenie przez Y. Poczekaj aż ukończy i komputer zresetuje

Potem wejdz do folderu SDFix wrzuc zawartość pliku Report.txt
oraz nowy log z hijacka oraz combofixa

**Posty:** 395 · przez **Funny_Killer** 06 Paź 2007, 15:30

Podczas stosowania SDFixa wyskoczyła mi taka tabliczka:

Kod: Zaznacz wszystko: SDFix NTU DN CPU: napotkano niedozwoloną instrukcje CS:8e01 IP: 28e0 OP: ff

Hijack:

Kod: Zaznacz wszystko: Logfile of HijackThis v1.99.1 Scan saved at 15:26, on 2007-10-06 Platform: Windows XP Dodatek SP. 1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\System32\FTRTSVC.exe C:\WINDOWS\System32\nvsvc32.exe C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe C:\WINDOWS\System32\RUNDLL32.EXE C:\Program Files\A4Tech\Mouse\Amoumain.exe C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\WINDOWS\System32\ctfmon.exe C:\Program Files\Gadu-Gadu\gg.exe C:\PROGRA~1\NEOSTR~1\TaskBarIcon.exe C:\PROGRA~1\NEOSTR~1\neostradatp.exe C:\PROGRA~1\NEOSTR~1\ComComp.exe C:\PROGRA~1\NEOSTR~1\Toaster.exe C:\PROGRA~1\NEOSTR~1\Inactivity.exe C:\PROGRA~1\NEOSTR~1\PollingModule.exe C:\WINDOWS\System32\ALERTM~1\ALERTM~1.EXE C:\PROGRA~1\NEOSTR~1\Watch.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Documents and Settings\Martyn\Pulpit\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.hotinfolink.com R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\NEOSTR~1\SEARCH~1.DLL O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.1.8.30.dll O2 - BHO: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O3 - Toolbar: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\NEOSTR~1\Watch.exe O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\NEOSTR~1\GestMaj.exe TaskBarIcon.exe O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [WheelMouse] C:\Program Files\A4Tech\Mouse\Amoumain.exe O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm O9 - Extra button: BitComet Search - {461CC20B-FB6E-4f16-8FE8-C29359DB100E} - C:\Program Files\BitComet\tools\BitCometBHO_1.1.8.30.dll O17 - HKLM\System\CCS\Services\Tcpip\..\{306BD9CA-56F5-464E-8745-0FBB964AFF5E}: NameServer = 194.204.159.1 217.98.63.164 O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe

ComboFix:

Kod: Zaznacz wszystko: ComboFix 07-10-06.3 - Martyn 2007-10-06 15:27:33.6 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.1.1250.1.1045.18.736 [GMT 2:00] Running from: C:\Documents and Settings\Martyn\Pulpit\ComboFix.exe . ((((((((((((((((((((((((( Files Created from 2007-09-06 to 2007-10-06 ))))))))))))))))))))))))))))))) . 2007-10-06 15:23 <DIR> d-------- C:\WINDOWS\system32\download 2007-10-06 15:13 <DIR> d-------- C:\WINDOWS\ERUNT 2007-10-06 11:22 51,200 --a------ C:\WINDOWS\NirCmd.exe 2007-10-05 21:06 664 --a------ C:\WINDOWS\system32\d3d9caps.dat 2007-10-04 14:24 <DIR> dr-h----- C:\Documents and Settings\Administrator\Dane aplikacji 2007-10-04 14:24 <DIR> dr------- C:\Documents and Settings\Administrator\Menu Start 2007-10-04 14:24 <DIR> d--h----- C:\Documents and Settings\Administrator\Ustawienia lokalne 2007-10-04 14:24 <DIR> d--h----- C:\Documents and Settings\Administrator\Szablony 2007-10-04 14:24 <DIR> d-------- C:\Documents and Settings\Administrator\Ulubione 2007-10-04 14:24 <DIR> d-------- C:\Documents and Settings\Administrator\Pulpit 2007-10-04 14:24 <DIR> d-------- C:\Documents and Settings\Administrator\Moje dokumenty 2007-10-04 14:11 <DIR> d-------- C:\WINDOWS\pss 2007-10-02 17:11 <DIR> d-------- C:\WINDOWS\system32\QuickTime 2007-10-01 19:22 2,560 --a------ C:\WINDOWS\system32\bitcometres.dll 2007-10-01 19:21 <DIR> d-------- C:\Program Files\BitComet 2007-09-30 22:56 129,546 --a------ C:\Documents and Settings\Martyn\bili.exe 2007-09-30 12:26 107,888 --a------ C:\WINDOWS\system32\CmdLineExt.dll 2007-09-30 12:26 <DIR> dr-h----- C:\Documents and Settings\Martyn\Dane aplikacji\SecuROM 2007-09-28 16:46 <DIR> d-------- C:\Program Files\Gothic III 2007-09-26 19:35 <DIR> d-------- C:\WINDOWS\system32\sounds 2007-09-26 19:35 <DIR> d-------- C:\WINDOWS\system32\logs 2007-09-23 22:59 <DIR> d--h----- C:\WINDOWS\PIF 2007-09-18 15:02 <DIR> d-------- C:\WINDOWS\LogFiles 2007-09-16 21:32 24,960 --a--c--- C:\WINDOWS\system32\dllcache\usbprint.sys 2007-09-16 21:32 24,960 --a------ C:\WINDOWS\system32\drivers\usbprint.sys 2007-09-16 21:32 <DIR> d-------- C:\WUTemp 2007-09-15 11:23 <DIR> d-------- C:\Program Files\QuickTime 2007-09-15 11:23 <DIR> d-------- C:\Program Files\Apple Software Update 2007-09-15 11:23 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Apple 2007-09-15 11:21 <DIR> d-------- C:\Program Files\WinAVI MP4 Converter 2007-09-14 23:51 <DIR> d-------- C:\Program Files\Arial Sound Recorder 2007-09-08 19:18 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\nView_Profiles 2007-09-07 13:34 <DIR> d-------- C:\Program Files\XviD 2007-09-07 13:33 <DIR> d-------- C:\Program Files\DivXCodec 2007-09-07 13:33 <DIR> d-------- C:\Program Files\DivX . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2007-10-06 15:22 --------- d-------- C:\Program Files\neostrada tp 2007-10-06 12:58 --------- d-------- C:\Program Files\Lineage II - PTS_PTS 2007-10-06 11:36 --------- d-------- C:\Documents and Settings\Martyn\Dane aplikacji\MegauploadToolbar 2007-10-02 17:11 --------- d-------- C:\Program Files\MarBit 2007-10-02 17:11 --------- d-------- C:\Program Files\D-Tools 2007-09-29 19:08 --------- d-------- C:\Program Files\mIRC 2007-09-28 16:47 --------- d--h----- C:\Program Files\InstallShield Installation Information 2007-09-19 13:36 --------- d-------- C:\Program Files\MegauploadToolbar 2007-09-18 05:03 570880 --a------ C:\WINDOWS\system32\notepad.exe 2007-09-11 21:19 --------- d-------- C:\Documents and Settings\Martyn\Dane aplikacji\Real 2007-09-08 21:09 --------- d-------- C:\Program Files\Gadu-Gadu 2007-08-26 14:24 --------- d-------- C:\Program Files\Winamp 2007-08-23 15:10 --------- d-------- C:\Documents and Settings\Martyn\Dane aplikacji\Media Player Classic 2007-08-23 15:00 --------- d-------- C:\Program Files\K-Lite Codec Pack 2007-08-23 15:00 --------- d-------- C:\Documents and Settings\All Users\Dane aplikacji\Real 2007-08-22 14:17 --------- d-------- C:\Documents and Settings\Martyn\Dane aplikacji\Help 2007-08-22 11:43 --------- d-------- C:\Documents and Settings\Martyn\Dane aplikacji\InstallShield 2007-08-19 20:46 --------- d-------- C:\Program Files\ivo 2007-08-14 10:50 --------- d-------- C:\Program Files\Teamspeak2_RC2 2007-08-14 10:50 --------- d-------- C:\Documents and Settings\Martyn\Dane aplikacji\teamspeak2 2007-08-08 13:18 --------- d-------- C:\Documents and Settings\Martyn\Dane aplikacji\Gadu-Gadu 2007-08-08 00:10 --------- d-------- C:\Program Files\Alwil Software 2007-08-07 23:50 --------- d-------- C:\Program Files\A4Tech 2007-08-07 23:49 --------- d-------- C:\Program Files\Common Files\Ahead 2007-08-07 23:49 --------- d-------- C:\Program Files\Ahead 2007-08-07 23:48 --------- d-------- C:\Program Files\AVIcodec 2007-08-07 23:44 --------- d-------- C:\Program Files\VIA 2007-08-07 23:41 --------- d-------- C:\Program Files\VIA Technologies, Inc 2007-08-07 23:38 --------- d-------- C:\Program Files\Common Files\InstallShield 2007-08-07 23:09 --------- d-------- C:\Program Files\Thomson 2007-08-07 23:02 --------- d-------- C:\Program Files\microsoft frontpage 2007-07-29 17:51 7680 --a------ C:\WINDOWS\system32\ff_vfw.dll 2007-07-28 00:07 783224 --a------ C:\WINDOWS\system32\aswBoot.exe 2007-07-27 23:57 95608 --a------ C:\WINDOWS\system32\AvastSS.scr 2007-07-25 15:24 1559040 --a------ C:\WINDOWS\system32\xvidcore.dll --------- C:\Program Files\Usługi online . ((((((((((((((((((((((((((((( snapshot@2007-10-06_11.25.21.04 ))))))))))))))))))))))))))))))))))))))))) . ----a-w 163,328 2007-09-27 20:03:23 C:\WINDOWS\ERUNT\SDFIX\ERDNT.EXE ----a-w 3,817,472 2007-10-06 13:16:20 C:\WINDOWS\ERUNT\SDFIX\Users\00000001\NTUSER.DAT ----a-w 8,192 2007-10-06 13:16:20 C:\WINDOWS\ERUNT\SDFIX\Users\00000002\UsrClass.dat ----a-w 163,328 2007-09-27 20:03:23 C:\WINDOWS\ERUNT\SDFIX_First_Run\ERDNT.EXE ----a-w 3,817,472 2007-10-06 13:13:12 C:\WINDOWS\ERUNT\SDFIX_First_Run\Users\00000001\NTUSER.DAT ----a-w 8,192 2007-10-06 13:13:12 C:\WINDOWS\ERUNT\SDFIX_First_Run\Users\00000002\UsrClass.dat . . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SpeedTouch USB Diagnostics"="C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" [2004-01-26 11:38] "WOOWATCH"="C:\PROGRA~1\NEOSTR~1\Watch.exe" [2004-08-23 14:49] "WOOTASKBARICON"="C:\PROGRA~1\NEOSTR~1\GestMaj.exe" [2004-10-14 16:55] "NvCplDaemon"="C:\WINDOWS\System32\NvCpl.dll" [2005-04-01 16:16] "NvMediaCenter"="C:\WINDOWS\System32\NvMcTray.dll" [2005-04-01 16:16] "WheelMouse"="C:\Program Files\A4Tech\Mouse\Amoumain.exe" [2006-03-14 10:49] "avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-07-28 00:03] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\System32\ctfmon.exe" [2002-09-29 00:00] "Gadu-Gadu"="C:\Program Files\Gadu-Gadu\gg.exe" [2007-07-09 09:39] [HKEY_USERS\.default\software\microsoft\windows\currentversion\run] "Network Security XP"=C:\WINDOWS\System32\nvsvc86.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^VIA RAID TOOL.lnk] path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\VIA RAID TOOL.lnk backup=C:\WINDOWS\pss\VIA RAID TOOL.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Martyn^Menu Start^Programy^Autostart^UniSpiker-2.6.lnk] path=C:\Documents and Settings\Martyn\Menu Start\Programy\Autostart\UniSpiker-2.6.lnk backup=C:\WINDOWS\pss\UniSpiker-2.6.lnkStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Notepad] C:\WINDOWS\System32\notepad.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz] nwiz.exe /install [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows Secure Service] wintema32.exe R0 viasraid;viasraid;C:\WINDOWS\System32\DRIVERS\viasraid.sys S0 d346bus;d346bus;C:\WINDOWS\System32\DRIVERS\d346bus.sys S0 d346prt;d346prt;C:\WINDOWS\System32\Drivers\d346prt.sys S4 Background Intelligent Transfer Service mircosoft 32;Background Intelligent Transfer Service mircosoft 32;"C:\WINDOWS\systemza32.exe" S4 Nicrosoft f11nt;Nicrosoft f11nt;"C:\WINDOWS\System32\dllcache\vvvhost.exe" . Contents of the 'Scheduled Tasks' folder "2007-09-21 14:58:02 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job" - C:\Program Files\Apple Software Update\SoftwareUpdate.exe . ************************************************************************** catchme 0.3.1169 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-10-06 15:28:10 Windows 5.1.2600 Dodatek Service Pack. 1 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2007-10-06 15:28:39 C:\ComboFix-quarantined-files.txt ... 2007-10-06 15:28 . --- E O F ---

Report:

Kod: Zaznacz wszystko: Microsoft Windows XP [Wersja 5.1.2600] Running From: C:\SDFix Safe Mode: Checking Services: Restoring Windows Registry Values Restoring Windows Default Hosts File

**Posty:** 18165 · przez **wojtas** 06 Paź 2007, 22:52

start>uruchom>cmd>wpisz:

sc stop Background Intelligent Transfer Service mircosoft 32

enter

sc delete Background Intelligent Transfer Service mircosoft 32

enter

sc stop Nicrosoft f11nt

enter

sc delete Nicrosoft f11nt

enter

sciagnij killbox’a

Odpalasz Killboxa zaznacz opcję Delete on Reboot następnie w polu Full Path of File to Delete wklej ścieżkę

C:\Documents and Settings\Martyn\bili.exe

i nacisnij x
Program będzie pytał o restart (oczywiście zgadzasz się)

wklej do notatnika

Windows Registry Editor Version 5.00

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"Network Security XP"=-

[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows Secure Service]

w notatniku u góry>>>plik zapisz jako>>>Zmien rozszerzenie z TXT na Wszystkie pliki *.* >>> Zapisz pod nazwą FIX.REG

Klikasz dwa razy na powstały plik fix i dodajesz go do rejestru....

potem nowe logi

**Posty:** 395 · przez **Funny_Killer** 07 Paź 2007, 16:28

Zrobiłem wszystko jak kazałeś tylko...
przy wprowadzaniu do rejestru wyskoczył taki błąd

Hijack

Kod: Zaznacz wszystko: Logfile of HijackThis v1.99.1 Scan saved at 16:27:54, on 2007-10-07 Platform: Windows XP Dodatek SP. 1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe C:\WINDOWS\System32\RUNDLL32.EXE C:\Program Files\A4Tech\Mouse\Amoumain.exe C:\Program Files\Common Files\Symantec Shared\ccApp.exe C:\PROGRA~1\NEOSTR~1\TaskBarIcon.exe C:\WINDOWS\System32\ctfmon.exe C:\Program Files\Gadu-Gadu\gg.exe C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe C:\WINDOWS\System32\FTRTSVC.exe C:\WINDOWS\System32\nvsvc32.exe C:\PROGRA~1\NEOSTR~1\neostradatp.exe C:\PROGRA~1\NEOSTR~1\ComComp.exe C:\PROGRA~1\NEOSTR~1\Toaster.exe C:\PROGRA~1\NEOSTR~1\Inactivity.exe C:\PROGRA~1\NEOSTR~1\PollingModule.exe C:\WINDOWS\System32\ALERTM~1\ALERTM~1.EXE C:\PROGRA~1\NEOSTR~1\Watch.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\WINDOWS\System32\svchost.exe C:\Documents and Settings\Martyn\Pulpit\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.hotinfolink.com R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\NEOSTR~1\SEARCH~1.DLL O1 - Hosts: 89.149.200.219 l2authd.lineage2.com O1 - Hosts: 89.149.200.219 l2testauthd.lineage2.com O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.1.8.30.dll O2 - BHO: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O3 - Toolbar: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\NEOSTR~1\Watch.exe O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\NEOSTR~1\GestMaj.exe TaskBarIcon.exe O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [WheelMouse] C:\Program Files\A4Tech\Mouse\Amoumain.exe O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton AntiVirus\osCheck.exe" O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll" O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm O9 - Extra button: BitComet Search - {461CC20B-FB6E-4f16-8FE8-C29359DB100E} - C:\Program Files\BitComet\tools\BitCometBHO_1.1.8.30.dll O17 - HKLM\System\CCS\Services\Tcpip\..\{306BD9CA-56F5-464E-8745-0FBB964AFF5E}: NameServer = 194.204.159.1 217.98.63.164 O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe O23 - Service: Symantec Event Manager (ccEvtMgr) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing) O23 - Service: Symantec Settings Manager (ccSetMgr) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing) O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing) O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exe O23 - Service: Symantec IS Password Validation (ISPwdSvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\isPwdSvc.exe O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing) O23 - Service: LiveUpdate Notice Service - Unknown owner - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PifEng.dll (file missing) O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe

Combo

Kod: Zaznacz wszystko: ComboFix 07-10-06.3 - Martyn 2007-10-06 15:27:33.6 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.1.1250.1.1045.18.736 [GMT 2:00] Running from: C:\Documents and Settings\Martyn\Pulpit\ComboFix.exe . ((((((((((((((((((((((((( Files Created from 2007-09-06 to 2007-10-06 ))))))))))))))))))))))))))))))) . 2007-10-06 15:23 <DIR> d-------- C:\WINDOWS\system32\download 2007-10-06 15:13 <DIR> d-------- C:\WINDOWS\ERUNT 2007-10-06 11:22 51,200 --a------ C:\WINDOWS\NirCmd.exe 2007-10-05 21:06 664 --a------ C:\WINDOWS\system32\d3d9caps.dat 2007-10-04 14:24 <DIR> dr-h----- C:\Documents and Settings\Administrator\Dane aplikacji 2007-10-04 14:24 <DIR> dr------- C:\Documents and Settings\Administrator\Menu Start 2007-10-04 14:24 <DIR> d--h----- C:\Documents and Settings\Administrator\Ustawienia lokalne 2007-10-04 14:24 <DIR> d--h----- C:\Documents and Settings\Administrator\Szablony 2007-10-04 14:24 <DIR> d-------- C:\Documents and Settings\Administrator\Ulubione 2007-10-04 14:24 <DIR> d-------- C:\Documents and Settings\Administrator\Pulpit 2007-10-04 14:24 <DIR> d-------- C:\Documents and Settings\Administrator\Moje dokumenty 2007-10-04 14:11 <DIR> d-------- C:\WINDOWS\pss 2007-10-02 17:11 <DIR> d-------- C:\WINDOWS\system32\QuickTime 2007-10-01 19:22 2,560 --a------ C:\WINDOWS\system32\bitcometres.dll 2007-10-01 19:21 <DIR> d-------- C:\Program Files\BitComet 2007-09-30 22:56 129,546 --a------ C:\Documents and Settings\Martyn\bili.exe 2007-09-30 12:26 107,888 --a------ C:\WINDOWS\system32\CmdLineExt.dll 2007-09-30 12:26 <DIR> dr-h----- C:\Documents and Settings\Martyn\Dane aplikacji\SecuROM 2007-09-28 16:46 <DIR> d-------- C:\Program Files\Gothic III 2007-09-26 19:35 <DIR> d-------- C:\WINDOWS\system32\sounds 2007-09-26 19:35 <DIR> d-------- C:\WINDOWS\system32\logs 2007-09-23 22:59 <DIR> d--h----- C:\WINDOWS\PIF 2007-09-18 15:02 <DIR> d-------- C:\WINDOWS\LogFiles 2007-09-16 21:32 24,960 --a--c--- C:\WINDOWS\system32\dllcache\usbprint.sys 2007-09-16 21:32 24,960 --a------ C:\WINDOWS\system32\drivers\usbprint.sys 2007-09-16 21:32 <DIR> d-------- C:\WUTemp 2007-09-15 11:23 <DIR> d-------- C:\Program Files\QuickTime 2007-09-15 11:23 <DIR> d-------- C:\Program Files\Apple Software Update 2007-09-15 11:23 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Apple 2007-09-15 11:21 <DIR> d-------- C:\Program Files\WinAVI MP4 Converter 2007-09-14 23:51 <DIR> d-------- C:\Program Files\Arial Sound Recorder 2007-09-08 19:18 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\nView_Profiles 2007-09-07 13:34 <DIR> d-------- C:\Program Files\XviD 2007-09-07 13:33 <DIR> d-------- C:\Program Files\DivXCodec 2007-09-07 13:33 <DIR> d-------- C:\Program Files\DivX . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2007-10-06 15:22 --------- d-------- C:\Program Files\neostrada tp 2007-10-06 12:58 --------- d-------- C:\Program Files\Lineage II - PTS_PTS 2007-10-06 11:36 --------- d-------- C:\Documents and Settings\Martyn\Dane aplikacji\MegauploadToolbar 2007-10-02 17:11 --------- d-------- C:\Program Files\MarBit 2007-10-02 17:11 --------- d-------- C:\Program Files\D-Tools 2007-09-29 19:08 --------- d-------- C:\Program Files\mIRC 2007-09-28 16:47 --------- d--h----- C:\Program Files\InstallShield Installation Information 2007-09-19 13:36 --------- d-------- C:\Program Files\MegauploadToolbar 2007-09-18 05:03 570880 --a------ C:\WINDOWS\system32\notepad.exe 2007-09-11 21:19 --------- d-------- C:\Documents and Settings\Martyn\Dane aplikacji\Real 2007-09-08 21:09 --------- d-------- C:\Program Files\Gadu-Gadu 2007-08-26 14:24 --------- d-------- C:\Program Files\Winamp 2007-08-23 15:10 --------- d-------- C:\Documents and Settings\Martyn\Dane aplikacji\Media Player Classic 2007-08-23 15:00 --------- d-------- C:\Program Files\K-Lite Codec Pack 2007-08-23 15:00 --------- d-------- C:\Documents and Settings\All Users\Dane aplikacji\Real 2007-08-22 14:17 --------- d-------- C:\Documents and Settings\Martyn\Dane aplikacji\Help 2007-08-22 11:43 --------- d-------- C:\Documents and Settings\Martyn\Dane aplikacji\InstallShield 2007-08-19 20:46 --------- d-------- C:\Program Files\ivo 2007-08-14 10:50 --------- d-------- C:\Program Files\Teamspeak2_RC2 2007-08-14 10:50 --------- d-------- C:\Documents and Settings\Martyn\Dane aplikacji\teamspeak2 2007-08-08 13:18 --------- d-------- C:\Documents and Settings\Martyn\Dane aplikacji\Gadu-Gadu 2007-08-08 00:10 --------- d-------- C:\Program Files\Alwil Software 2007-08-07 23:50 --------- d-------- C:\Program Files\A4Tech 2007-08-07 23:49 --------- d-------- C:\Program Files\Common Files\Ahead 2007-08-07 23:49 --------- d-------- C:\Program Files\Ahead 2007-08-07 23:48 --------- d-------- C:\Program Files\AVIcodec 2007-08-07 23:44 --------- d-------- C:\Program Files\VIA 2007-08-07 23:41 --------- d-------- C:\Program Files\VIA Technologies, Inc 2007-08-07 23:38 --------- d-------- C:\Program Files\Common Files\InstallShield 2007-08-07 23:09 --------- d-------- C:\Program Files\Thomson 2007-08-07 23:02 --------- d-------- C:\Program Files\microsoft frontpage 2007-07-29 17:51 7680 --a------ C:\WINDOWS\system32\ff_vfw.dll 2007-07-28 00:07 783224 --a------ C:\WINDOWS\system32\aswBoot.exe 2007-07-27 23:57 95608 --a------ C:\WINDOWS\system32\AvastSS.scr 2007-07-25 15:24 1559040 --a------ C:\WINDOWS\system32\xvidcore.dll --------- C:\Program Files\Usługi online . ((((((((((((((((((((((((((((( snapshot@2007-10-06_11.25.21.04 ))))))))))))))))))))))))))))))))))))))))) . ----a-w 163,328 2007-09-27 20:03:23 C:\WINDOWS\ERUNT\SDFIX\ERDNT.EXE ----a-w 3,817,472 2007-10-06 13:16:20 C:\WINDOWS\ERUNT\SDFIX\Users\00000001\NTUSER.DAT ----a-w 8,192 2007-10-06 13:16:20 C:\WINDOWS\ERUNT\SDFIX\Users\00000002\UsrClass.dat ----a-w 163,328 2007-09-27 20:03:23 C:\WINDOWS\ERUNT\SDFIX_First_Run\ERDNT.EXE ----a-w 3,817,472 2007-10-06 13:13:12 C:\WINDOWS\ERUNT\SDFIX_First_Run\Users\00000001\NTUSER.DAT ----a-w 8,192 2007-10-06 13:13:12 C:\WINDOWS\ERUNT\SDFIX_First_Run\Users\00000002\UsrClass.dat . . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SpeedTouch USB Diagnostics"="C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" [2004-01-26 11:38] "WOOWATCH"="C:\PROGRA~1\NEOSTR~1\Watch.exe" [2004-08-23 14:49] "WOOTASKBARICON"="C:\PROGRA~1\NEOSTR~1\GestMaj.exe" [2004-10-14 16:55] "NvCplDaemon"="C:\WINDOWS\System32\NvCpl.dll" [2005-04-01 16:16] "NvMediaCenter"="C:\WINDOWS\System32\NvMcTray.dll" [2005-04-01 16:16] "WheelMouse"="C:\Program Files\A4Tech\Mouse\Amoumain.exe" [2006-03-14 10:49] "avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-07-28 00:03] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\System32\ctfmon.exe" [2002-09-29 00:00] "Gadu-Gadu"="C:\Program Files\Gadu-Gadu\gg.exe" [2007-07-09 09:39] [HKEY_USERS\.default\software\microsoft\windows\currentversion\run] "Network Security XP"=C:\WINDOWS\System32\nvsvc86.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^VIA RAID TOOL.lnk] path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\VIA RAID TOOL.lnk backup=C:\WINDOWS\pss\VIA RAID TOOL.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Martyn^Menu Start^Programy^Autostart^UniSpiker-2.6.lnk] path=C:\Documents and Settings\Martyn\Menu Start\Programy\Autostart\UniSpiker-2.6.lnk backup=C:\WINDOWS\pss\UniSpiker-2.6.lnkStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Notepad] C:\WINDOWS\System32\notepad.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz] nwiz.exe /install [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows Secure Service] wintema32.exe R0 viasraid;viasraid;C:\WINDOWS\System32\DRIVERS\viasraid.sys S0 d346bus;d346bus;C:\WINDOWS\System32\DRIVERS\d346bus.sys S0 d346prt;d346prt;C:\WINDOWS\System32\Drivers\d346prt.sys S4 Background Intelligent Transfer Service mircosoft 32;Background Intelligent Transfer Service mircosoft 32;"C:\WINDOWS\systemza32.exe" S4 Nicrosoft f11nt;Nicrosoft f11nt;"C:\WINDOWS\System32\dllcache\vvvhost.exe" . Contents of the 'Scheduled Tasks' folder "2007-09-21 14:58:02 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job" - C:\Program Files\Apple Software Update\SoftwareUpdate.exe . ************************************************************************** catchme 0.3.1169 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-10-06 15:28:10 Windows 5.1.2600 Dodatek Service Pack. 1 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2007-10-06 15:28:39 C:\ComboFix-quarantined-files.txt ... 2007-10-06 15:28 . --- E O F ---

**Posty:** 18165 · przez **wojtas** 07 Paź 2007, 17:04

nie ma naglowka do loga z hijacka i nie ma loga z combofixa

**Posty:** 395 · przez **Funny_Killer** 07 Paź 2007, 17:16

Z edytowane.

**Posty:** 18165 · przez **wojtas** 07 Paź 2007, 17:19

start>uruchom>regedit>przejdz do klucza:

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]

i skasuj Network Security XP

potem skasuj:

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows Secure Service]

**Posty:** 395 · przez **Funny_Killer** 13 Paź 2007, 14:28

Bez zmian

**Posty:** 18165 · przez **wojtas** 13 Paź 2007, 14:56

daj nowego loga z hijacka oraz combofixa

**Posty:** 395 · przez **Funny_Killer** 14 Paź 2007, 13:37

Hijack

Kod: Zaznacz wszystko: Logfile of HijackThis v1.99.1 Scan saved at 11:49:19, on 2007-10-14 Platform: Windows XP Dodatek SP. 1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe C:\WINDOWS\System32\RUNDLL32.EXE C:\WINDOWS\system32\spoolsv.exe C:\PROGRA~1\NEOSTR~1\TaskBarIcon.exe C:\Program Files\A4Tech\Mouse\Amoumain.exe C:\Program Files\Common Files\Symantec Shared\ccApp.exe C:\WINDOWS\System32\ctfmon.exe C:\Program Files\Gadu-Gadu\gg.exe C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe C:\WINDOWS\System32\FTRTSVC.exe C:\WINDOWS\System32\nvsvc32.exe C:\PROGRA~1\NEOSTR~1\neostradatp.exe C:\PROGRA~1\NEOSTR~1\ComComp.exe C:\PROGRA~1\NEOSTR~1\Toaster.exe C:\PROGRA~1\NEOSTR~1\Inactivity.exe C:\PROGRA~1\NEOSTR~1\PollingModule.exe C:\WINDOWS\System32\ALERTM~1\ALERTM~1.EXE C:\PROGRA~1\NEOSTR~1\Watch.exe C:\WINDOWS\System32\wuauclt.exe D:\Program Files\foobar2000\foobar2000.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\WINDOWS\System32\svchost.exe C:\Documents and Settings\Martyn\Pulpit\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.hotinfolink.com R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\NEOSTR~1\SEARCH~1.DLL O1 - Hosts: 89.149.200.219 L2authd.lineage2.com O1 - Hosts: 89.149.200.219 L2testauthd.lineage2.com O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.1.8.30.dll O2 - BHO: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O3 - Toolbar: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\NEOSTR~1\Watch.exe O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\NEOSTR~1\GestMaj.exe TaskBarIcon.exe O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [WheelMouse] C:\Program Files\A4Tech\Mouse\Amoumain.exe O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton AntiVirus\osCheck.exe" O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll" O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm O9 - Extra button: BitComet Search - {461CC20B-FB6E-4f16-8FE8-C29359DB100E} - C:\Program Files\BitComet\tools\BitCometBHO_1.1.8.30.dll O17 - HKLM\System\CCS\Services\Tcpip\..\{306BD9CA-56F5-464E-8745-0FBB964AFF5E}: NameServer = 194.204.159.1 217.98.63.164 O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe O23 - Service: Symantec Event Manager (ccEvtMgr) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing) O23 - Service: Symantec Settings Manager (ccSetMgr) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing) O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing) O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exe O23 - Service: Symantec IS Password Validation (ISPwdSvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\isPwdSvc.exe O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing) O23 - Service: LiveUpdate Notice Service - Unknown owner - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PifEng.dll (file missing) O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe

Combo

Kod: Zaznacz wszystko: ComboFix 07-10-06.3 - Martyn 2007-10-14 11:50:08.8 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.1.1250.1.1045.18.642 [GMT 2:00] Running from: C:\Documents and Settings\Martyn\Pulpit\ComboFix.exe . ((((((((((((((((((((((((( Files Created from 2007-09-14 to 2007-10-14 ))))))))))))))))))))))))))))))) . 2007-10-13 11:32 549,720 --a------ C:\WINDOWS\system32\wuapi.dll 2007-10-13 11:32 33,624 --a------ C:\WINDOWS\system32\wups.dll 2007-10-13 11:32 325,976 --a------ C:\WINDOWS\system32\wucltui.dll 2007-10-13 11:32 203,096 --a------ C:\WINDOWS\system32\wuweb.dll 2007-10-13 11:32 187,160 --a------ C:\WINDOWS\system32\wuaueng1.dll 2007-10-13 11:32 170,264 --a------ C:\WINDOWS\system32\wuauclt1.exe 2007-10-08 10:12 <DIR> d-------- C:\Program Files\Audacity 2007-10-08 09:15 <DIR> d-------- C:\Program Files\coolpro2 2007-10-07 15:59 <DIR> d-------- C:\!KillBox 2007-10-07 15:57 <DIR> d-------- C:\Program Files\Norton AntiVirus 2007-10-07 15:56 60,800 --a------ C:\WINDOWS\system32\S32EVNT1.DLL 2007-10-07 15:56 123,952 --a------ C:\WINDOWS\system32\drivers\SYMEVENT.SYS 2007-10-07 15:56 <DIR> d-------- C:\Program Files\Symantec 2007-10-07 15:56 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Symantec 2007-10-07 15:55 <DIR> d-------- C:\Program Files\Common Files\Symantec Shared 2007-10-06 17:27 <DIR> d-------- C:\Program Files\SopCast 2007-10-06 17:27 <DIR> d-------- C:\Documents and Settings\Martyn\Dane aplikacji\SopCast 2007-10-06 15:23 <DIR> d-------- C:\WINDOWS\system32\download 2007-10-06 15:13 <DIR> d-------- C:\WINDOWS\ERUNT 2007-10-06 11:22 51,200 --a------ C:\WINDOWS\NirCmd.exe 2007-10-05 21:06 664 --a------ C:\WINDOWS\system32\d3d9caps.dat 2007-10-04 14:24 <DIR> dr-h----- C:\Documents and Settings\Administrator\Dane aplikacji 2007-10-04 14:24 <DIR> dr------- C:\Documents and Settings\Administrator\Menu Start 2007-10-04 14:24 <DIR> d--h----- C:\Documents and Settings\Administrator\Ustawienia lokalne 2007-10-04 14:24 <DIR> d--h----- C:\Documents and Settings\Administrator\Szablony 2007-10-04 14:24 <DIR> d-------- C:\Documents and Settings\Administrator\Ulubione 2007-10-04 14:24 <DIR> d-------- C:\Documents and Settings\Administrator\Pulpit 2007-10-04 14:24 <DIR> d-------- C:\Documents and Settings\Administrator\Moje dokumenty 2007-10-04 14:11 <DIR> d-------- C:\WINDOWS\pss 2007-10-02 17:11 <DIR> d-------- C:\WINDOWS\system32\QuickTime 2007-10-01 19:22 2,560 --a------ C:\WINDOWS\system32\bitcometres.dll 2007-10-01 19:21 <DIR> d-------- C:\Program Files\BitComet 2007-09-30 12:26 107,888 --a------ C:\WINDOWS\system32\CmdLineExt.dll 2007-09-30 12:26 <DIR> dr-h----- C:\Documents and Settings\Martyn\Dane aplikacji\SecuROM 2007-09-28 16:46 <DIR> d-------- C:\Program Files\Gothic III 2007-09-26 19:35 <DIR> d-------- C:\WINDOWS\system32\sounds 2007-09-26 19:35 <DIR> d-------- C:\WINDOWS\system32\logs 2007-09-23 22:59 <DIR> d--h----- C:\WINDOWS\PIF 2007-09-18 15:02 <DIR> d-------- C:\WINDOWS\LogFiles 2007-09-18 14:43 43,696 --a------ C:\WINDOWS\system32\drivers\srtspx.sys 2007-09-18 14:43 317,616 --a------ C:\WINDOWS\system32\drivers\srtspl.sys 2007-09-18 14:43 278,576 --a------ C:\WINDOWS\system32\drivers\srtsp.sys 2007-09-16 21:32 24,960 --a--c--- C:\WINDOWS\system32\dllcache\usbprint.sys 2007-09-16 21:32 24,960 --a------ C:\WINDOWS\system32\drivers\usbprint.sys 2007-09-16 21:32 <DIR> d-------- C:\WUTemp 2007-09-15 11:23 <DIR> d-------- C:\Program Files\QuickTime 2007-09-15 11:23 <DIR> d-------- C:\Program Files\Apple Software Update 2007-09-15 11:23 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Apple 2007-09-15 11:21 <DIR> d-------- C:\Program Files\WinAVI MP4 Converter 2007-09-14 23:51 <DIR> d-------- C:\Program Files\Arial Sound Recorder . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2007-10-14 10:36 --------- d-------- C:\Program Files\neostrada tp 2007-10-12 10:29 --------- d-------- C:\Program Files\mIRC 2007-10-11 16:23 --------- d-------- C:\Program Files\Gadu-Gadu 2007-10-11 15:41 --------- d-------- C:\Documents and Settings\Martyn\Dane aplikacji\MegauploadToolbar 2007-10-11 14:49 --------- d-------- C:\Program Files\Lineage II - PTS_PTS 2007-10-07 16:09 805 --a------ C:\WINDOWS\system32\drivers\SYMEVENT.INF 2007-10-07 16:09 10740 --a------ C:\WINDOWS\system32\drivers\SYMEVENT.CAT 2007-10-02 17:11 --------- d-------- C:\Program Files\MarBit 2007-10-02 17:11 --------- d-------- C:\Program Files\D-Tools 2007-09-28 16:47 --------- d--h----- C:\Program Files\InstallShield Installation Information 2007-09-19 13:36 --------- d-------- C:\Program Files\MegauploadToolbar 2007-09-18 14:44 1430 --a------ C:\WINDOWS\system32\drivers\srtspl.inf 2007-09-18 14:44 1421 --a------ C:\WINDOWS\system32\drivers\srtspx.inf 2007-09-18 14:44 1415 --a------ C:\WINDOWS\system32\drivers\srtsp.inf 2007-09-18 14:44 10662 --a------ C:\WINDOWS\system32\drivers\srtspx.cat 2007-09-18 14:44 10662 --a------ C:\WINDOWS\system32\drivers\srtspl.cat 2007-09-18 14:44 10658 --a------ C:\WINDOWS\system32\drivers\srtsp.cat 2007-09-18 05:03 570880 --a------ C:\WINDOWS\system32\notepad.exe 2007-09-11 21:19 --------- d-------- C:\Documents and Settings\Martyn\Dane aplikacji\Real 2007-09-08 19:18 --------- d-------- C:\Documents and Settings\All Users\Dane aplikacji\nView_Profiles 2007-09-07 13:34 --------- d-------- C:\Program Files\XviD 2007-09-07 13:33 --------- d-------- C:\Program Files\DivXCodec 2007-09-07 13:33 --------- d-------- C:\Program Files\DivX 2007-08-26 14:24 --------- d-------- C:\Program Files\Winamp 2007-08-23 15:10 --------- d-------- C:\Documents and Settings\Martyn\Dane aplikacji\Media Player Classic 2007-08-23 15:00 --------- d-------- C:\Program Files\K-Lite Codec Pack 2007-08-23 15:00 --------- d-------- C:\Documents and Settings\All Users\Dane aplikacji\Real 2007-08-22 14:17 --------- d-------- C:\Documents and Settings\Martyn\Dane aplikacji\Help 2007-08-22 11:43 --------- d-------- C:\Documents and Settings\Martyn\Dane aplikacji\InstallShield 2007-08-19 20:46 --------- d-------- C:\Program Files\ivo 2007-08-14 10:50 --------- d-------- C:\Program Files\Teamspeak2_RC2 2007-08-14 10:50 --------- d-------- C:\Documents and Settings\Martyn\Dane aplikacji\teamspeak2 2007-07-30 19:19 92504 --a------ C:\WINDOWS\system32\cdm.dll 2007-07-30 19:19 53080 --a------ C:\WINDOWS\system32\wuauclt.exe 2007-07-30 19:19 43352 --a------ C:\WINDOWS\system32\wups2.dll 2007-07-30 19:19 1712984 --a------ C:\WINDOWS\system32\wuaueng.dll 2007-07-29 17:51 7680 --a------ C:\WINDOWS\system32\ff_vfw.dll 2007-07-25 15:24 1559040 --a------ C:\WINDOWS\system32\xvidcore.dll . ((((((((((((((((((((((((((((( snapshot@2007-10-06_11.25.21.04 ))))))))))))))))))))))))))))))))))))))))) . -c----w 2,086,400 2002-09-28 22:00:00 C:\WINDOWS\$MSI31Uninstall_KB893803v2$\msi.dll -c----w 64,512 2002-09-28 22:00:00 C:\WINDOWS\$MSI31Uninstall_KB893803v2$\msiexec.exe -c----w 305,664 2002-09-28 22:00:00 C:\WINDOWS\$MSI31Uninstall_KB893803v2$\msihnd.dll -c----w 847,872 2002-09-28 22:00:00 C:\WINDOWS\$MSI31Uninstall_KB893803v2$\msimsg.dll -c----w 39,936 2002-09-28 22:00:00 C:\WINDOWS\$MSI31Uninstall_KB893803v2$\msisip.dll -c----w 212,704 2005-05-03 10:58:30 C:\WINDOWS\$MSI31Uninstall_KB893803v2$\spuninst\spuninst.exe -c----w 387,296 2005-05-03 10:58:30 C:\WINDOWS\$MSI31Uninstall_KB893803v2$\spuninst\updspapi.dll ----a-w 163,328 2007-09-27 20:03:23 C:\WINDOWS\ERUNT\SDFIX\ERDNT.EXE ----a-w 3,817,472 2007-10-06 13:16:20 C:\WINDOWS\ERUNT\SDFIX\Users\00000001\NTUSER.DAT ----a-w 8,192 2007-10-06 13:16:20 C:\WINDOWS\ERUNT\SDFIX\Users\00000002\UsrClass.dat ----a-w 163,328 2007-09-27 20:03:23 C:\WINDOWS\ERUNT\SDFIX_First_Run\ERDNT.EXE ----a-w 3,817,472 2007-10-06 13:13:12 C:\WINDOWS\ERUNT\SDFIX_First_Run\Users\00000001\NTUSER.DAT ----a-w 8,192 2007-10-06 13:13:12 C:\WINDOWS\ERUNT\SDFIX_First_Run\Users\00000002\UsrClass.dat ----a-w 8,704 2004-05-14 22:12:29 C:\WINDOWS\SoftwareDistribution\Download\2db7e7534350a55e0137c797f8124ecb\spmsg.dll ----a-w 159,232 2004-05-17 22:38:50 C:\WINDOWS\SoftwareDistribution\Download\2db7e7534350a55e0137c797f8124ecb\spuninst.exe ----a-w 27,136 2004-07-30 23:44:05 C:\WINDOWS\SoftwareDistribution\Download\2db7e7534350a55e0137c797f8124ecb\sp1qfe\bitsinst.exe ----a-w 7,680 2004-07-01 22:10:39 C:\WINDOWS\SoftwareDistribution\Download\2db7e7534350a55e0137c797f8124ecb\sp1qfe\bitsprx2.dll ----a-w 7,168 2004-07-01 22:10:39 C:\WINDOWS\SoftwareDistribution\Download\2db7e7534350a55e0137c797f8124ecb\sp1qfe\bitsprx3.dll ----a-w 175,616 2004-06-30 15:00:26 C:\WINDOWS\SoftwareDistribution\Download\2db7e7534350a55e0137c797f8124ecb\sp1qfe\obrs0415.dll ----a-w 360,448 2004-07-01 22:10:39 C:\WINDOWS\SoftwareDistribution\Download\2db7e7534350a55e0137c797f8124ecb\sp1qfe\qmgr.dll ----a-w 17,408 2004-07-01 22:10:39 C:\WINDOWS\SoftwareDistribution\Download\2db7e7534350a55e0137c797f8124ecb\sp1qfe\qmgrprxy.dll ----a-w 331,776 2004-07-01 22:10:39 C:\WINDOWS\SoftwareDistribution\Download\2db7e7534350a55e0137c797f8124ecb\sp1qfe\winhttp.dll ----a-w 22,016 2004-05-17 22:38:49 C:\WINDOWS\SoftwareDistribution\Download\2db7e7534350a55e0137c797f8124ecb\update\spcustom.dll ----a-w 623,616 2004-05-14 22:12:29 C:\WINDOWS\SoftwareDistribution\Download\2db7e7534350a55e0137c797f8124ecb\update\update.exe ----a-w 16,096 2005-02-25 03:36:06 C:\WINDOWS\SoftwareDistribution\Download\33b429ed39bc5e95ff7042a3b46c0314\spmsg.dll ----a-w 212,704 2005-02-25 03:36:06 C:\WINDOWS\SoftwareDistribution\Download\33b429ed39bc5e95ff7042a3b46c0314\spuninst.exe ----a-w 53,248 2005-06-10 23:55:46 C:\WINDOWS\SoftwareDistribution\Download\33b429ed39bc5e95ff7042a3b46c0314\sp1qfe\spoolsv.exe ----a-w 102,912 2005-06-11 02:43:06 C:\WINDOWS\SoftwareDistribution\Download\33b429ed39bc5e95ff7042a3b46c0314\sp1qfe\win32spl.dll ----a-w 57,856 2005-06-10 23:53:32 C:\WINDOWS\SoftwareDistribution\Download\33b429ed39bc5e95ff7042a3b46c0314\sp2gdr\spoolsv.exe ----a-w 57,856 2005-06-11 00:17:13 C:\WINDOWS\SoftwareDistribution\Download\33b429ed39bc5e95ff7042a3b46c0314\sp2qfe\spoolsv.exe ----a-w 30,720 2005-06-29 23:54:30 C:\WINDOWS\SoftwareDistribution\Download\33b429ed39bc5e95ff7042a3b46c0314\update\arpidfix.exe ----a-w 22,240 2005-02-25 03:36:06 C:\WINDOWS\SoftwareDistribution\Download\33b429ed39bc5e95ff7042a3b46c0314\update\spcustom.dll ----a-w 725,728 2005-02-25 03:36:06 C:\WINDOWS\SoftwareDistribution\Download\33b429ed39bc5e95ff7042a3b46c0314\update\update.exe ----a-w 387,296 2005-02-25 03:36:07 C:\WINDOWS\SoftwareDistribution\Download\33b429ed39bc5e95ff7042a3b46c0314\update\updspapi.dll ----a-w 16,096 2005-10-12 23:21:28 C:\WINDOWS\SoftwareDistribution\Download\75fbd241c542f5a01412c2129075992e\spmsg.dll ----a-w 216,288 2005-10-12 23:21:30 C:\WINDOWS\SoftwareDistribution\Download\75fbd241c542f5a01412c2129075992e\spuninst.exe ----a-w 368,640 2006-03-01 19:45:49 C:\WINDOWS\SoftwareDistribution\Download\75fbd241c542f5a01412c2129075992e\SP1QFE\msdtcprx.dll ----a-w 974,336 2006-03-01 19:45:49 C:\WINDOWS\SoftwareDistribution\Download\75fbd241c542f5a01412c2129075992e\SP1QFE\msdtctm.dll ----a-w 150,528 2006-03-01 19:45:49 C:\WINDOWS\SoftwareDistribution\Download\75fbd241c542f5a01412c2129075992e\SP1QFE\msdtcuiu.dll ----a-w 64,512 2006-03-01 19:45:49 C:\WINDOWS\SoftwareDistribution\Download\75fbd241c542f5a01412c2129075992e\SP1QFE\mtxclu.dll ----a-w 83,456 2006-03-01 19:45:49 C:\WINDOWS\SoftwareDistribution\Download\75fbd241c542f5a01412c2129075992e\SP1QFE\mtxoci.dll ----a-w 11,776 2006-03-01 19:45:49 C:\WINDOWS\SoftwareDistribution\Download\75fbd241c542f5a01412c2129075992e\SP1QFE\xolehlp.dll ----a-w 426,496 2006-03-01 19:44:19 C:\WINDOWS\SoftwareDistribution\Download\75fbd241c542f5a01412c2129075992e\SP2GDR\msdtcprx.dll ----a-w 956,416 2006-03-01 19:44:19 C:\WINDOWS\SoftwareDistribution\Download\75fbd241c542f5a01412c2129075992e\SP2GDR\msdtctm.dll ----a-w 161,280 2006-03-01 19:44:19 C:\WINDOWS\SoftwareDistribution\Download\75fbd241c542f5a01412c2129075992e\SP2GDR\msdtcuiu.dll ----a-w 66,560 2006-03-01 19:44:19 C:\WINDOWS\SoftwareDistribution\Download\75fbd241c542f5a01412c2129075992e\SP2GDR\mtxclu.dll ----a-w 91,136 2006-03-01 19:44:19 C:\WINDOWS\SoftwareDistribution\Download\75fbd241c542f5a01412c2129075992e\SP2GDR\mtxoci.dll ----a-w 11,776 2006-03-01 19:44:19 C:\WINDOWS\SoftwareDistribution\Download\75fbd241c542f5a01412c2129075992e\SP2GDR\xolehlp.dll ----a-w 426,496 2006-03-01 19:42:43 C:\WINDOWS\SoftwareDistribution\Download\75fbd241c542f5a01412c2129075992e\SP2QFE\msdtcprx.dll ----a-w 956,416 2006-03-01 19:42:43 C:\WINDOWS\SoftwareDistribution\Download\75fbd241c542f5a01412c2129075992e\SP2QFE\msdtctm.dll ----a-w 161,280 2006-03-01 19:42:43 C:\WINDOWS\SoftwareDistribution\Download\75fbd241c542f5a01412c2129075992e\SP2QFE\msdtcuiu.dll ----a-w 66,560 2006-03-01 19:42:43 C:\WINDOWS\SoftwareDistribution\Download\75fbd241c542f5a01412c2129075992e\SP2QFE\mtxclu.dll ----a-w 91,136 2006-03-01 19:42:43 C:\WINDOWS\SoftwareDistribution\Download\75fbd241c542f5a01412c2129075992e\SP2QFE\mtxoci.dll ----a-w 11,776 2006-03-01 19:42:43 C:\WINDOWS\SoftwareDistribution\Download\75fbd241c542f5a01412c2129075992e\SP2QFE\xolehlp.dll ----a-w 22,752 2005-10-12 23:21:27 C:\WINDOWS\SoftwareDistribution\Download\75fbd241c542f5a01412c2129075992e\update\spcustom.dll ----a-w 723,680 2005-10-12 23:21:34 C:\WINDOWS\SoftwareDistribution\Download\75fbd241c542f5a01412c2129075992e\update\update.exe ----a-w 386,784 2005-10-12 23:21:41 C:\WINDOWS\SoftwareDistribution\Download\75fbd241c542f5a01412c2129075992e\update\updspapi.dll ----a-w 16,096 2005-02-25 03:36:06 C:\WINDOWS\SoftwareDistribution\Download\b6686f23b231330eed046158efe568a4\spmsg.dll ----a-w 212,704 2005-02-25 03:36:06 C:\WINDOWS\SoftwareDistribution\Download\b6686f23b231330eed046158efe568a4\spuninst.exe ----a-w 22,752 2005-02-25 03:36:06 C:\WINDOWS\SoftwareDistribution\Download\b6686f23b231330eed046158efe568a4\spupdsvc.exe ----a-w 22,240 2005-02-25 03:36:06 C:\WINDOWS\SoftwareDistribution\Download\b6686f23b231330eed046158efe568a4\update\spcustom.dll ----a-w 725,728 2005-02-25 03:36:06 C:\WINDOWS\SoftwareDistribution\Download\b6686f23b231330eed046158efe568a4\update\update.exe ----a-w 387,296 2005-02-25 03:36:07 C:\WINDOWS\SoftwareDistribution\Download\b6686f23b231330eed046158efe568a4\update\updspapi.dll ----a-w 36,864 2005-04-19 12:56:40 C:\WINDOWS\SoftwareDistribution\Download\b69fca0ff65ffc440c9b1062ec4479e2\iecustom.dll ----a-w 16,096 2005-06-28 08:21:24 C:\WINDOWS\SoftwareDistribution\Download\b69fca0ff65ffc440c9b1062ec4479e2\spmsg.dll ----a-w 216,288 2005-06-28 08:23:38 C:\WINDOWS\SoftwareDistribution\Download\b69fca0ff65ffc440c9b1062ec4479e2\spuninst.exe ----a-w 851,456 2006-09-18 12:20:10 C:\WINDOWS\SoftwareDistribution\Download\b69fca0ff65ffc440c9b1062ec4479e2\vgx.dll ----a-w 36,864 2005-04-19 12:56:40 C:\WINDOWS\SoftwareDistribution\Download\b69fca0ff65ffc440c9b1062ec4479e2\update\iecustom.dll ----a-w 723,680 2005-06-28 08:25:02 C:\WINDOWS\SoftwareDistribution\Download\b69fca0ff65ffc440c9b1062ec4479e2\update\update.exe ----a-w 386,784 2005-06-28 08:24:04 C:\WINDOWS\SoftwareDistribution\Download\b69fca0ff65ffc440c9b1062ec4479e2\update\updspapi.dll ----a-w 89,088 2003-03-18 21:05:50 C:\WINDOWS\system32\atl71.dll ----a-w 466,944 2006-09-02 18:36:33 C:\WINDOWS\system32\capicom.dll ----a-w 185,624 2004-08-03 11:59:28 C:\WINDOWS\system32\iuengine.dll ----a-w 1,047,552 2003-03-18 23:12:12 C:\WINDOWS\system32\mfc71u.dll ----a-w 2,890,240 2005-05-03 10:58:36 C:\WINDOWS\system32\msi.dll ----a-w 78,848 2005-05-03 10:58:36 C:\WINDOWS\system32\msiexec.exe ----a-w 271,360 2005-05-03 10:58:36 C:\WINDOWS\system32\msihnd.dll ----a-w 884,736 2005-05-03 10:58:36 C:\WINDOWS\system32\msimsg.dll ----a-w 15,360 2005-05-03 10:58:36 C:\WINDOWS\system32\msisip.dll ------w 15,584 2005-05-03 10:58:30 C:\WINDOWS\system32\spmsg.dll ----a-w 613,056 2006-09-02 14:35:16 C:\WINDOWS\system32\SymNeti.dll ----a-w 239,808 2006-09-02 14:35:10 C:\WINDOWS\system32\SymRedir.dll ----a-w 262,144 2007-10-14 09:50:04 C:\WINDOWS\system32\config\systemprofile\NtUser.dat ----a-w 16,384 2007-10-14 08:36:03 C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat ----a-w 32,768 2007-10-14 08:36:03 C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Historia\History.IE5\index.dat ----a-w 32,768 2007-10-14 08:36:03 C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Temporary Internet Files\Content.IE5\index.dat -c--a-w 92,504 2007-07-30 17:19:20 C:\WINDOWS\system32\dllcache\cdm.dll -c--a-w 185,624 2004-08-03 11:59:28 C:\WINDOWS\system32\dllcache\iuengine.dll -c--a-w 2,890,240 2005-05-03 10:58:36 C:\WINDOWS\system32\dllcache\msi.dll -c--a-w 78,848 2005-05-03 10:58:36 C:\WINDOWS\system32\dllcache\msiexec.exe -c--a-w 271,360 2005-05-03 10:58:36 C:\WINDOWS\system32\dllcache\msihnd.dll -c--a-w 884,736 2005-05-03 10:58:36 C:\WINDOWS\system32\dllcache\msimsg.dll -c--a-w 15,360 2005-05-03 10:58:36 C:\WINDOWS\system32\dllcache\msisip.dll -c--a-w 53,080 2007-07-30 17:19:16 C:\WINDOWS\system32\dllcache\wuauclt.exe -c--a-w 1,712,984 2007-07-30 17:19:42 C:\WINDOWS\system32\dllcache\wuaueng.dll ----a-w 11,968 2006-09-02 14:34:34 C:\WINDOWS\system32\drivers\symdns.sys ----a-w 144,832 2006-09-02 14:34:42 C:\WINDOWS\system32\drivers\symfw.sys ----a-w 39,104 2006-09-02 14:34:50 C:\WINDOWS\system32\drivers\symids.sys ----a-w 33,216 2006-09-02 14:34:46 C:\WINDOWS\system32\drivers\symndis.sys ----a-w 36,032 2006-09-02 14:35:06 C:\WINDOWS\system32\drivers\symndisv.sys ----a-w 26,432 2006-09-02 14:34:56 C:\WINDOWS\system32\drivers\symredrv.sys ----a-w 186,048 2006-09-02 14:35:00 C:\WINDOWS\system32\drivers\symtdi.sys ----a-w 33,624 2007-07-30 17:18:40 C:\WINDOWS\system32\SoftwareDistribution\Setup\ServiceStartup\wups.dll\7.0.6000.381\wups.dll . ----a-w 182,880 2003-08-25 16:06:50 C:\WINDOWS\system32\iuengine.dll ----a-w 2,086,400 2002-09-28 22:00:00 C:\WINDOWS\system32\msi.dll ----a-w 64,512 2002-09-28 22:00:00 C:\WINDOWS\system32\msiexec.exe ----a-w 305,664 2002-09-28 22:00:00 C:\WINDOWS\system32\msihnd.dll ----a-w 847,872 2002-09-28 22:00:00 C:\WINDOWS\system32\msimsg.dll ----a-w 39,936 2002-09-28 22:00:00 C:\WINDOWS\system32\msisip.dll ----a-w 16,384 2007-10-05 17:46:21 C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat ----a-w 32,768 2007-10-05 17:46:21 C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Historia\History.IE5\index.dat ----a-w 32,768 2007-10-05 17:46:21 C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Temporary Internet Files\Content.IE5\index.dat -c--a-w 14,848 2002-09-28 22:00:00 C:\WINDOWS\system32\dllcache\cdm.dll -c--a-w 182,880 2003-08-25 16:06:50 C:\WINDOWS\system32\dllcache\iuengine.dll -c--a-w 2,086,400 2002-09-28 22:00:00 C:\WINDOWS\system32\dllcache\msi.dll -c--a-w 64,512 2002-09-28 22:00:00 C:\WINDOWS\system32\dllcache\msiexec.exe -c--a-w 305,664 2002-09-28 22:00:00 C:\WINDOWS\system32\dllcache\msihnd.dll -c--a-w 847,872 2002-09-28 22:00:00 C:\WINDOWS\system32\dllcache\msimsg.dll -c--a-w 39,936 2002-09-28 22:00:00 C:\WINDOWS\system32\dllcache\msisip.dll -c--a-w 142,336 2002-09-28 22:00:00 C:\WINDOWS\system32\dllcache\wuauclt.exe -c--a-w 189,440 2002-09-28 22:00:00 C:\WINDOWS\system32\dllcache\wuaueng.dll . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SpeedTouch USB Diagnostics"="C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" [2004-01-26 11:38] "WOOWATCH"="C:\PROGRA~1\NEOSTR~1\Watch.exe" [2004-08-23 14:49] "WOOTASKBARICON"="C:\PROGRA~1\NEOSTR~1\GestMaj.exe" [2004-10-14 16:55] "NvCplDaemon"="C:\WINDOWS\System32\NvCpl.dll" [2005-04-01 16:16] "NvMediaCenter"="C:\WINDOWS\System32\NvMcTray.dll" [2005-04-01 16:16] "WheelMouse"="C:\Program Files\A4Tech\Mouse\Amoumain.exe" [2006-03-14 10:49] "ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2006-09-03 04:04] "osCheck"="C:\Program Files\Norton AntiVirus\osCheck.exe" [2006-09-05 22:22] "Symantec PIF AlertEng"="C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [2007-03-12 18:30] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\System32\ctfmon.exe" [2002-09-29 00:00] "Gadu-Gadu"="C:\Program Files\Gadu-Gadu\gg.exe" [2007-07-09 09:39] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^VIA RAID TOOL.lnk] path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\VIA RAID TOOL.lnk backup=C:\WINDOWS\pss\VIA RAID TOOL.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Martyn^Menu Start^Programy^Autostart^UniSpiker-2.6.lnk] path=C:\Documents and Settings\Martyn\Menu Start\Programy\Autostart\UniSpiker-2.6.lnk backup=C:\WINDOWS\pss\UniSpiker-2.6.lnkStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Notepad] C:\WINDOWS\System32\notepad.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz] nwiz.exe /install R0 viasraid;viasraid;C:\WINDOWS\System32\DRIVERS\viasraid.sys S0 d346bus;d346bus;C:\WINDOWS\System32\DRIVERS\d346bus.sys S0 d346prt;d346prt;C:\WINDOWS\System32\Drivers\d346prt.sys S4 Background Intelligent Transfer Service mircosoft 32;Background Intelligent Transfer Service mircosoft 32;"C:\WINDOWS\systemza32.exe" S4 Nicrosoft f11nt;Nicrosoft f11nt;"C:\WINDOWS\System32\dllcache\vvvhost.exe" . Contents of the 'Scheduled Tasks' folder "2007-10-12 14:58:05 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job" "2007-10-12 19:19:57 C:\WINDOWS\Tasks\Norton AntiVirus - Run Full System Scan - Martyn.job" . ************************************************************************** catchme 0.3.1169 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-10-14 11:51:32 Windows 5.1.2600 Dodatek Service Pack. 1 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2007-10-14 11:52:12 C:\ComboFix-quarantined-files.txt ... 2007-10-14 11:52 . --- E O F ---

**Posty:** 18165 · przez **wojtas** 14 Paź 2007, 17:23

wklej do notatnika:

Windows Registry Editor Version 5.00

[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Notepad]

w notatniku u góry>>>plik zapisz jako>>>Zmien rozszerzenie z TXT na Wszystkie pliki *.* >>> Zapisz pod nazwą FIX.REG

Klikasz dwa razy na powstały plik fix i dodajesz go do rejestru....

start -> uruchom -> services.msc -> zatrzymaj i wyłącz usługi Background Intelligent Transfer Service mircosoft 32 oraz Nicrosoft f11nt

proszę o sprawdzenie loga-dziwne problemy z pc

Proszę o sprawdzenie loga-dziwne problemy z pc

Kto jest na forum