prosze o sprawdzenie loga, komputer znacznie zwolnil.

**Posty:** 112 · przez **ink4sent** 19 Gru 2007, 17:57

Prosze o sprawdzenie loga, znacznie zwolnil.. dziwne sie zachowuje..

Kod: Zaznacz wszystko: Logfile of HijackThis v1.99.1 Scan saved at 17:02:13, on 2007-12-19 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: F:\WINDOWS\System32\smss.exe F:\WINDOWS\system32\winlogon.exe F:\WINDOWS\system32\services.exe F:\WINDOWS\system32\lsass.exe F:\WINDOWS\system32\svchost.exe F:\WINDOWS\System32\svchost.exe F:\WINDOWS\system32\spoolsv.exe F:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe F:\Program Files\Eset\nod32krn.exe F:\WINDOWS\system32\nvsvc32.exe F:\WINDOWS\system32\svchost.exe F:\WINDOWS\Explorer.EXE F:\WINDOWS\system32\wscntfy.exe F:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe F:\Program Files\Eset\nod32kui.exe F:\Program Files\Java\jre1.6.0_03\bin\jusched.exe F:\WINDOWS\system32\RunDLL32.exe F:\Program Files\AutoConnect\AutoConnect.exe F:\Program Files\TaskSwitchXP\TaskSwitchXP.exe F:\Program Files\foobar2000\foobar2000.exe F:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe F:\Program Files\Logitech\SetPoint\SetPoint.exe F:\Program Files\SysInfoMyWork\SysInfoMyWork.exe F:\Program Files\Common Files\Logitech\khalshared\KHALMNPR.EXE E:\Program Files\Konnekt\konnekt.exe F:\Program Files\Opera\Opera.exe D:\ALL of FORMAT\PROGRAMS\hijackthis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.bearshare.com/pl R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://img509.imageshack.us/img509/8924/japieolegd6.jpg R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - F:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: flashget urlcatch - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - F:\Program Files\FlashGet\jccatch.dll O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - F:\Program Files\BitComet\tools\BitCometBHO_1.1.9.24.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - F:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O2 - BHO: FlashGet GetFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - F:\Program Files\FlashGet\getflash.dll O4 - HKLM\..\Run: [NVMixerTray] "F:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe" O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [nod32kui] "F:\Program Files\Eset\nod32kui.exe" /WAITSERVICE O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] "F:\Program Files\Common Files\Logitech\khalshared\KHALMNPR.EXE" O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE F:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [SunJavaUpdateSched] "F:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" O4 - HKLM\..\Run: [PD0620 STISvc] RunDLL32.exe P0620Pin.dll,RunDLL32EP 513 O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE O4 - HKCU\..\Run: [AutoConnect] F:\Program Files\AutoConnect\AutoConnect.exe O4 - HKCU\..\Run: [TaskSwitchXP] F:\Program Files\TaskSwitchXP\TaskSwitchXP.exe O4 - Startup: SysInfoMyWork.lnk = F:\Program Files\SysInfoMyWork\SysInfoMyWork.exe O4 - Global Startup: DSLMON.lnk = F:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe O4 - Global Startup: Logitech SetPoint.lnk = ? O8 - Extra context menu item: &D&ownload &with BitComet - res://F:\Program Files\BitComet\BitComet.exe/AddLink.htm O8 - Extra context menu item: &D&ownload all video with BitComet - res://F:\Program Files\BitComet\BitComet.exe/AddVideo.htm O8 - Extra context menu item: &D&ownload all with BitComet - res://F:\Program Files\BitComet\BitComet.exe/AddAllLink.htm O8 - Extra context menu item: &Ściągnij przy pomocy FlashGet'a - F:\Program Files\FlashGet\jc_link.htm O8 - Extra context menu item: &Ściągnij wszystko przy pomocy FlashGet'a - F:\Program Files\FlashGet\jc_all.htm O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://F:\PROGRA~1\Microsoft Office\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - F:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - F:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra button: BitComet Search - {461CC20B-FB6E-4f16-8FE8-C29359DB100E} - F:\Program Files\BitComet\tools\BitCometBHO_1.1.9.24.dll O9 - Extra button: Pop-Up Blocker - {84536FE2-ABCD-3586-DCAB-40E286323737} - F:\Program Files\WINnerTweak3De\PopUp Blocker.exe O9 - Extra 'Tools' menuitem: Pop-Up Blocker - {84536FE2-ABCD-3586-DCAB-40E286323737} - F:\Program Files\WINnerTweak3De\PopUp Blocker.exe O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - F:\PROGRA~1\Microsoft Office\OFFICE11\REFIEBAR.DLL O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - F:\Program Files\FlashGet\FlashGet.exe O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - F:\Program Files\FlashGet\FlashGet.exe O17 - HKLM\System\CCS\Services\Tcpip\..\{7833EAE8-5D06-4FE4-8D42-6997531229EF}: NameServer = 194.204.159.1 217.98.63.164 O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - F:\PROGRA~1\COMMON~1\Skype\Skype4COM.dll O23 - Service: Diskeeper - Diskeeper Corporation - F:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe O23 - Service: Google Updater Service (gusvc) - Unknown owner - F:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe (file missing) O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - F:\Program Files\Eset\nod32krn.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - F:\WINDOWS\system32\nvsvc32.exe

**Posty:** 18165 · przez **wojtas** 19 Gru 2007, 18:30

Zastosuj SDFix . Po pobraniu uruchom go a rozpakuje się do C:\SDFix. Uruchom komputer w trybie awaryjnym (F8 przy stracie systemu). Będąc w awaryjnym uruchom plik RunThis.bat z folderu SDFixa. Zatwierdź czyszczenie przez Y. Poczekaj aż ukończy i komputer zresetuje

Potem wejdz do folderu SDFix wrzuc zawartość pliku Report.txt + log z combofixa oraz z hijacka

**Posty:** 112 · przez **ink4sent** 19 Gru 2007, 20:25

Kod: Zaznacz wszystko: SDFix: Version 1.119 Run by ink4sent on 2007-12-19 at 18:59 Microsoft Windows XP [Wersja 5.1.2600] Running From: F:\SDFix Safe Mode: Checking Services: Restoring Windows Registry Values Restoring Windows Default Hosts File Rebooting... Normal Mode: Checking Files: No Trojan Files Found Removing Temp Files... ADS Check: F:\WINDOWS No streams found. F:\WINDOWS\system32 No streams found. F:\WINDOWS\system32\svchost.exe No streams found. F:\WINDOWS\system32\ntoskrnl.exe No streams found. Final Check: catchme 0.3.1333.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-12-19 19:22:37 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... scanning hidden services & system hive ... scanning hidden registry entries ... [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\A\1\5\1c] "Order"=hex:08,00,00,00,02,00,00,00,b8,01,00,00,01,00,00,00,04,00,00,00,8c,.. scanning hidden files ... scan completed successfully hidden processes: 0 hidden services: 0 hidden files: 0 Remaining Services: ------------------ Authorized Application Key Export: [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] "E:\\Program Files\\Konnekt\\konnekt.exe"="E:\\Program Files\\Konnekt\\konnekt.exe:*:Enabled:Konnekt - Core" "F:\\Program Files\\Gadu-Gadunowe\\gg.exe"="F:\\Program Files\\Gadu-Gadunowe\\gg.exe:*:Enabled:Gadu-Gadu - program główny" "C:\\totalcmd\\TOTALCMD.EXE"="C:\\totalcmd\\TOTALCMD.EXE:*:Enabled:Total Commander 32 bit international version, file manager replacement for Windows" "E:\\Valve\\Steam\\steamapps\\adamek2000\\counter-strike\\hl.exe"="E:\\Valve\\Steam\\steamapps\\adamek2000\\counter-strike\\hl.exe:*:Enabled:Half-Life Launcher" "F:\\Program Files\\NAPI-PROJEKT\\napisy.exe"="F:\\Program Files\\NAPI-PROJEKT\\napisy.exe:*:Enabled:www.napiprojekt.pl" "F:\\Program Files\\FlashGet\\flashget.exe"="F:\\Program Files\\FlashGet\\flashget.exe:*:Enabled:FlashGet" "F:\\Program Files\\BearShare\\BearShare.exe"="F:\\Program Files\\BearShare\\BearShare.exe:*:Enabled:BearShare" "F:\\Program Files\\Opera\\Opera.exe"="F:\\Program Files\\Opera\\Opera.exe:*:Enabled:Opera Internet Browser" "F:\\Program Files\\Miranda IM\\miranda32.exe"="F:\\Program Files\\Miranda IM\\miranda32.exe:*:Enabled:Miranda IM" "F:\\Program Files\\mIRC\\mirc.exe"="F:\\Program Files\\mIRC\\mirc.exe:*:Enabled:mIRC" [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list] Remaining Files: --------------- Files with Hidden Attributes: Tue 20 Nov 2007 6,219,320 A..H. --- "F:\Program Files\Picasa2\setup.exe" Finished!

Kod: Zaznacz wszystko: ComboFix 07-12-19.2 - ink4sent 2007-12-19 19:29:57.1 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.124 [GMT 1:00] Running from: F:\Documents and Settings\ink4sent\Pulpit\ComboFix.exe * Created a new restore point . ((((((((((((((((((((((((( Files Created from 2007-11-19 to 2007-12-19 ))))))))))))))))))))))))))))))) . 2007-12-19 19:08 . 2007-12-19 19:08 552 --a------ F:\WINDOWS\system32\d3d8caps.dat 2007-12-19 18:57 . 2004-08-03 23:44 149,504 --a------ F:\Documents and Settings\ink4sent\regedit.exe 2007-12-19 18:57 . 2004-08-03 23:44 28,160 --a------ F:\Documents and Settings\ink4sent\findstr.exe 2007-12-19 18:57 . 2001-10-26 20:29 11,264 --a------ F:\Documents and Settings\ink4sent\attrib.exe 2007-12-19 18:57 . 2001-10-26 20:29 9,216 --a------ F:\Documents and Settings\ink4sent\find.exe 2007-12-18 18:19 . 2007-12-18 18:20 <DIR> d-------- F:\Program Files\Trickshot 2007-12-15 21:22 . 2007-12-15 21:22 <DIR> d-------- F:\Program Files\TaskSwitchXP 2007-12-15 21:22 . 2004-08-03 23:44 1,501,696 --a------ F:\WINDOWS\system32\msgina.dll.xpize 2007-12-15 21:21 . 2004-08-03 23:43 3,485,696 --a------ F:\WINDOWS\system32\wmploc.dll.xpize 2007-12-15 21:21 . 2004-08-03 23:44 2,790,912 --a------ F:\WINDOWS\system32\XPize_Logon.exe 2007-12-15 21:21 . 2004-08-03 23:33 419,840 --a------ F:\WINDOWS\system32\mstsc.exe.xpize 2007-12-15 21:21 . 2007-09-24 22:31 180,224 --a------ F:\WINDOWS\system32\javacpl.cpl.xpize 2007-12-15 21:19 . 2004-08-03 23:35 1,069,082 --a------ F:\WINDOWS\system32\msdxm.ocx.xpize 2007-12-15 21:18 . 2004-08-03 23:44 1,368,064 --a------ F:\WINDOWS\system32\wiaacmgr.exe.xpize 2007-12-15 21:17 . 2004-08-03 23:44 1,695,744 --a------ F:\WINDOWS\explorer.exe.xpize 2007-12-15 21:16 . 2004-08-03 23:43 3,794,432 --a------ F:\WINDOWS\system32\xpsp2res.dll.xpize 2007-12-15 21:15 . 2007-12-15 21:22 <DIR> d--h----- F:\WINDOWS\XPize Darkside 2007-12-10 15:20 . 2007-12-10 15:27 <DIR> d-------- F:\Program Files\Rainlendar2 2007-12-10 15:20 . 2007-12-19 14:59 <DIR> d-------- F:\Documents and Settings\ink4sent\.rainlendar2 2007-12-08 15:21 . 2007-12-08 15:21 <DIR> d-------- F:\Program Files\Google Hacks 2007-12-02 22:22 . 2007-12-02 22:22 <DIR> d-------- F:\WINDOWS\BeInspired! Gramatyka 1 & 2 2007-12-01 19:41 . 2007-12-01 20:10 <DIR> d-------- F:\Documents and Settings\ink4sent\Dane aplikacji\Desktop Sidebar 2007-12-01 19:07 . 2007-12-01 19:07 2,560 --a------ F:\WINDOWS\system32\bitcometres.dll 2007-12-01 19:06 . 2007-12-01 20:29 <DIR> d-------- F:\Program Files\BitComet 2007-11-26 22:56 . 2007-12-01 19:07 862 --a------ F:\WINDOWS\WinInit.Ini 2007-11-24 19:17 . 2007-11-24 19:19 <DIR> d-------- F:\Program Files\File Renamer 2007-11-24 19:17 . 2007-11-24 19:17 120,510 --a------ F:\WINDOWS\File Renamer - Basic Uninstaller.exe 2007-11-23 18:07 . 2007-11-23 18:07 <DIR> d-------- F:\Program Files\Microsoft.NET 2007-11-20 20:21 . 2007-11-20 20:21 <DIR> d-------- F:\Program Files\Picasa2 2007-11-19 15:58 . 2007-11-19 16:32 <DIR> d-------- F:\Program Files\Miranda IM 2007-11-19 15:58 . 2007-11-19 15:58 <DIR> d-------- F:\Documents and Settings\ink4sent\Dane aplikacji\Miranda . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2007-12-19 18:26 --------- d-----w F:\Program Files\AutoConnect 2007-12-19 17:58 --------- d-----w F:\Documents and Settings\ink4sent\Dane aplikacji\foobar2000 2007-12-19 15:51 --------- d--h--w F:\Program Files\InstallShield Installation Information 2007-12-19 15:50 --------- d-----w F:\Program Files\Cossacks - Back To Warrrrrrrr 2007-12-18 22:49 --------- d-----w F:\Program Files\FlashGet 2007-12-18 19:57 --------- d-----w F:\Program Files\mIRC 2007-12-10 16:49 --------- d-----w F:\Documents and Settings\ink4sent\Dane aplikacji\Skype 2007-12-10 15:51 --------- d-----w F:\Program Files\boczny pasek 2007-12-02 19:08 --------- d-----w F:\Program Files\jv16 PowerTools 2007 2007-12-02 15:59 --------- d-----w F:\Documents and Settings\ink4sent\Dane aplikacji\Dev-Cpp 2007-11-29 18:42 --------- d-----w F:\Program Files\NAPI-PROJEKT 2007-11-24 17:25 --------- d-----w F:\Documents and Settings\All Users\Dane aplikacji\BVRP Software 2007-11-18 15:03 --------- d-----w F:\Program Files\TC PowerPack 2007-11-16 17:16 --------- d-----w F:\Program Files\Common Files\Logitech 2007-11-16 15:41 --------- d-----w F:\Program Files\Lavalys 2007-11-13 20:12 --------- d-----w F:\Program Files\Real Alternative 2007-11-13 20:09 9,216 ----a-w F:\WINDOWS\system32\cpuinf32.dll 2007-11-13 20:09 892,928 ----a-w F:\WINDOWS\system32\iconv.dll 2007-11-13 20:09 755,200 ----a-w F:\WINDOWS\system32\ir50_32.dll 2007-11-13 20:09 245,760 ----a-w F:\WINDOWS\system32\mplvpx.dll 2007-11-13 20:09 1,415,680 ----a-w F:\WINDOWS\system32\WMV9VCM.dll 2007-11-13 20:08 740,442 ----a-w F:\WINDOWS\system32\DivX.dll 2007-11-13 20:08 1,559,040 ----a-w F:\WINDOWS\system32\xvidcore.dll 2007-11-08 17:04 --------- d-----w F:\Program Files\Creative 2007-11-08 17:04 --------- d-----w F:\Program Files\Apple Software Update 2007-11-08 15:06 --------- d-----w F:\Documents and Settings\ink4sent\Dane aplikacji\Hamachi 2007-11-07 16:42 --------- d-----w F:\Program Files\DAEMON Tools Pro 2007-11-07 16:42 --------- d-----w F:\Documents and Settings\All Users\Dane aplikacji\DAEMON Tools Pro 2007-11-07 16:41 --------- d-----w F:\Documents and Settings\ink4sent\Dane aplikacji\DAEMON Tools Pro 2007-11-07 16:25 278,984 ----a-w F:\WINDOWS\system32\drivers\atksgt.sys 2007-11-07 16:25 25,416 ----a-w F:\WINDOWS\system32\drivers\lirsgt.sys 2007-11-04 22:38 --------- d-----w F:\Program Files\HLSW 2007-11-03 17:03 --------- d-----w F:\Program Files\Cossacks 2007-11-03 12:56 --------- d-----w F:\Program Files\Cossacks - The Art Of War 2007-11-03 12:34 25,280 ----a-w F:\WINDOWS\system32\drivers\hamachi.sys 2007-10-31 21:13 --------- d-----w F:\Documents and Settings\ink4sent\Dane aplikacji\teamspeak2 2007-10-27 16:23 --------- d-----w F:\Documents and Settings\ink4sent\Dane aplikacji\ViStart 2007-10-27 14:58 --------- d-----w F:\Program Files\SysInfoMyWork 2007-10-22 18:08 --------- d-----w F:\Documents and Settings\ink4sent\Dane aplikacji\Creative 2007-09-29 15:29 55,949 ----a-w F:\WINDOWS\system32\x264-uninstall.exe 2007-09-22 18:39 921,600 ----a-w F:\WINDOWS\system32\vorbisenc.dll 2007-09-22 18:39 45,056 ----a-w F:\WINDOWS\system32\ogg.dll 2007-09-22 18:39 237,568 ----a-w F:\WINDOWS\system32\OggDS.dll 2007-09-22 18:39 188,416 ----a-w F:\WINDOWS\system32\vorbis.dll 2007-03-24 21:36 17,832 ----a-w F:\Documents and Settings\ink4sent\Dane aplikacji\GDIPFONTCACHEV1.DAT . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "AutoConnect"="F:\Program Files\AutoConnect\AutoConnect.exe" [2004-08-28 19:27] "TaskSwitchXP"="F:\Program Files\TaskSwitchXP\TaskSwitchXP.exe" [2006-08-04 23:29] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NVMixerTray"="F:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe" [2004-06-03 19:51] "nwiz"="nwiz.exe" [2005-02-24 06:32 F:\WINDOWS\system32\nwiz.exe] "nod32kui"="F:\Program Files\Eset\nod32kui.exe" [2007-05-14 21:17] "Logitech Hardware Abstraction Layer"="F:\Program Files\Common Files\Logitech\khalshared\KHALMNPR.EXE" [2006-07-19 12:03] "NvCplDaemon"="RUNDLL32.exe" [2004-08-03 23:44 F:\WINDOWS\system32\rundll32.exe] "SunJavaUpdateSched"="F:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 00:11] "PD0620 STISvc"="RunDLL32.exe" [2004-08-03 23:44 F:\WINDOWS\system32\rundll32.exe] "Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2006-07-19 12:03 F:\WINDOWS\KHALMNPR.Exe] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="F:\WINDOWS\system32\CTFMON.EXE" [2004-08-03 23:44] F:\Documents and Settings\ink4sent\Menu Start\Programy\Autostart\ SysInfoMyWork.lnk - F:\Program Files\SysInfoMyWork\SysInfoMyWork.exe [2004-09-21 17:23:27] F:\Documents and Settings\All Users\Menu Start\Programy\Autostart\ DSLMON.lnk - F:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe [2007-05-14 21:18:43] Logitech SetPoint.lnk - F:\Program Files\Logitech\SetPoint\SetPoint.exe [2007-11-16 18:16:42] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] "NoRecentDocsHistory"= 01000000 [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\F:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Adobe Reader Speed Launch.lnk] backup=F:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\F:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Adobe Reader Synchronizer.lnk] backup=F:\WINDOWS\pss\Adobe Reader Synchronizer.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\F:^Documents and Settings^ink4sent^Menu Start^Programy^Autostart^Diskeeper 10 Professional Edition Registration.lnk] path=F:\Documents and Settings\ink4sent\Menu Start\Programy\Autostart\Diskeeper 10 Professional Edition Registration.lnk backup=F:\WINDOWS\pss\Diskeeper 10 Professional Edition Registration.lnkStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BearShare] F:\Program Files\BearShare\BearShare.exe /pause [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Pro Agent] 2007-09-06 14:08 136136 --a------ F:\Program Files\DAEMON Tools Pro\DTProAgent.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DiskeeperSystray] 2006-04-19 14:48 319488 --a------ F:\Program Files\Diskeeper Corporation\Diskeeper\DkIcon.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Flashget] F:\Program Files\FlashGet\flashget.exe /min [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IDMan] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] 2001-07-09 09:50 155648 --a------ F:\WINDOWS\system32\NeroCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\P2kAutostart] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Picasa Media Detector] 2007-10-23 22:18 443968 --a------ F:\Program Files\Picasa2\PicasaMediaDetector.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] F:\Program Files\QuickTime\qttask.exe -atboottime [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SkinClock] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ViOrb] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{8f8f8524-540f-11dc-8c36-806d6172696f}] \Shell\AutoRun\command - G:\RunGame.exe *Newly Created Service* - PROCEXP90 . ************************************************************************** catchme 0.3.1333 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-12-19 19:31:26 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2007-12-19 19:32:20 . 2007-07-06 12:15:33 --- E O F ---

Kod: Zaznacz wszystko: Logfile of HijackThis v1.99.1 Scan saved at 19:39:57, on 2007-12-19 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: F:\WINDOWS\System32\smss.exe F:\WINDOWS\system32\winlogon.exe F:\WINDOWS\system32\services.exe F:\WINDOWS\system32\lsass.exe F:\WINDOWS\system32\svchost.exe F:\WINDOWS\System32\svchost.exe F:\WINDOWS\system32\spoolsv.exe F:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe F:\Program Files\Eset\nod32krn.exe F:\WINDOWS\system32\nvsvc32.exe F:\WINDOWS\system32\svchost.exe F:\WINDOWS\system32\wscntfy.exe F:\WINDOWS\system32\notepad.exe F:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe F:\Program Files\Eset\nod32kui.exe F:\Program Files\Java\jre1.6.0_03\bin\jusched.exe F:\WINDOWS\system32\RunDLL32.exe F:\Program Files\AutoConnect\AutoConnect.exe F:\Program Files\TaskSwitchXP\TaskSwitchXP.exe F:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe F:\Program Files\SysInfoMyWork\SysInfoMyWork.exe F:\WINDOWS\explorer.exe F:\WINDOWS\system32\notepad.exe F:\Program Files\Opera\Opera.exe F:\Program Files\foobar2000\foobar2000.exe D:\ALL of FORMAT\PROGRAMS\hijackthis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.bearshare.com/pl R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://img509.imageshack.us/img509/8924/japieolegd6.jpg R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - F:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: flashget urlcatch - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - F:\Program Files\FlashGet\jccatch.dll O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - F:\Program Files\BitComet\tools\BitCometBHO_1.1.9.24.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - F:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O2 - BHO: FlashGet GetFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - F:\Program Files\FlashGet\getflash.dll O4 - HKLM\..\Run: [NVMixerTray] "F:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe" O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [nod32kui] "F:\Program Files\Eset\nod32kui.exe" /WAITSERVICE O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] "F:\Program Files\Common Files\Logitech\khalshared\KHALMNPR.EXE" O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE F:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [SunJavaUpdateSched] "F:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" O4 - HKLM\..\Run: [PD0620 STISvc] RunDLL32.exe P0620Pin.dll,RunDLL32EP 513 O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE O4 - HKCU\..\Run: [AutoConnect] F:\Program Files\AutoConnect\AutoConnect.exe O4 - HKCU\..\Run: [TaskSwitchXP] F:\Program Files\TaskSwitchXP\TaskSwitchXP.exe O4 - Startup: SysInfoMyWork.lnk = F:\Program Files\SysInfoMyWork\SysInfoMyWork.exe O4 - Global Startup: DSLMON.lnk = F:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe O4 - Global Startup: Logitech SetPoint.lnk = ? O8 - Extra context menu item: &D&ownload &with BitComet - res://F:\Program Files\BitComet\BitComet.exe/AddLink.htm O8 - Extra context menu item: &D&ownload all video with BitComet - res://F:\Program Files\BitComet\BitComet.exe/AddVideo.htm O8 - Extra context menu item: &D&ownload all with BitComet - res://F:\Program Files\BitComet\BitComet.exe/AddAllLink.htm O8 - Extra context menu item: &Ściągnij przy pomocy FlashGet'a - F:\Program Files\FlashGet\jc_link.htm O8 - Extra context menu item: &Ściągnij wszystko przy pomocy FlashGet'a - F:\Program Files\FlashGet\jc_all.htm O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://F:\PROGRA~1\Microsoft Office\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - F:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - F:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra button: BitComet Search - {461CC20B-FB6E-4f16-8FE8-C29359DB100E} - F:\Program Files\BitComet\tools\BitCometBHO_1.1.9.24.dll O9 - Extra button: Pop-Up Blocker - {84536FE2-ABCD-3586-DCAB-40E286323737} - F:\Program Files\WINnerTweak3De\PopUp Blocker.exe O9 - Extra 'Tools' menuitem: Pop-Up Blocker - {84536FE2-ABCD-3586-DCAB-40E286323737} - F:\Program Files\WINnerTweak3De\PopUp Blocker.exe O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - F:\PROGRA~1\Microsoft Office\OFFICE11\REFIEBAR.DLL O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - F:\Program Files\FlashGet\FlashGet.exe O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - F:\Program Files\FlashGet\FlashGet.exe O17 - HKLM\System\CCS\Services\Tcpip\..\{7833EAE8-5D06-4FE4-8D42-6997531229EF}: NameServer = 194.204.159.1 217.98.63.164 O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - F:\PROGRA~1\COMMON~1\Skype\Skype4COM.dll O23 - Service: Diskeeper - Diskeeper Corporation - F:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe O23 - Service: Google Updater Service (gusvc) - Unknown owner - F:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe (file missing) O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - F:\Program Files\Eset\nod32krn.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - F:\WINDOWS\system32\nvsvc32.exe

**Posty:** 18165 · przez **wojtas** 19 Gru 2007, 20:50

te pliki:

F:\Documents and Settings\ink4sent\find.exe
F:\WINDOWS\system32\mstsc.exe.xpize

tu i daj raporty:

http://virusscan.jotti.org/
http://www.virustotal.com/

**Posty:** 112 · przez **ink4sent** 20 Gru 2007, 00:02

Przypadkiem je usunolem.. no trudno. Nie chce mi sie ich odzyskiwac. Dzieki:)

**Posty:** 18165 · przez **wojtas** 20 Gru 2007, 18:20

F:\Documents and Settings\ink4sent\attrib.exe
F:\WINDOWS\system32\msgina.dll.xpize

to te przeskanuj

prosze o sprawdzenie loga, komputer znacznie zwolnil.

Prosze o sprawdzenie loga, komputer znacznie zwolnil.

Kto jest na forum