Proszę o sprawdzenie loga, mnóstwo błędów,trojan itd.

**Posty:** 185 · przez **ykes** 02 Gru 2008, 18:20

Proszę o sprawdzenie loga, komputer zwolnił, Microsoft Word przestał działać, Avira AntiVir wykrył Trojana a przy uruchamianiu komputera przez ułamek sekundy widać panel wyboru Systemu operacyjnego(mimo, że mam jedna partycje z jednym Windowsem). Mam też uszkodzoną kartę graficzną ale to chyba nie ma tutaj znaczenia.

ComboFix :

Kod: Zaznacz wszystko: ComboFix 08-12-01.03 - user 2008-12-02 17:07:37.4 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.3.1250.1.1045.18.1614 [GMT 1:00] Uruchomiony z: c:\documents and settings\user\Pulpit\ComboFix.exe * Utworzono nowy punkt przywracania . ((((((((((((((((((((((((( Pliki utworzone od 2008-11-02 do 2008-12-02 ))))))))))))))))))))))))))))))) . 2008-11-30 17:42 . 2008-11-30 17:42 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\CanonIJPLM 2008-11-26 18:58 . 2008-11-26 18:58 <DIR> d-------- c:\documents and settings\user\Dane aplikacji\Red Alert 3 Demo 2008-11-25 22:52 . 2008-11-25 22:52 <DIR> d-------- c:\program files\LitexMedia 2008-11-25 22:42 . 2008-11-25 22:42 <DIR> d-------- c:\program files\Deskshare 2008-11-25 22:42 . 2008-11-25 22:42 356,352 --a------ c:\windows\eSellerateEngine.dll 2008-11-25 22:42 . 2004-12-07 10:11 258,352 --a------ c:\windows\system32\Unicows.dll 2008-11-16 15:37 . 2008-11-16 15:37 <DIR> d-------- c:\program files\NAMCO BANDAI Games 2008-11-15 10:28 . 2008-11-15 10:28 <DIR> d-------- c:\program files\Paradox Entertainment 2008-11-13 21:57 . 2008-11-13 21:57 1,393 --a------ c:\windows\imsins.BAK 2008-11-13 16:23 . 2008-11-17 21:10 <DIR> d-------- c:\program files\Firefly Studios 2008-11-13 09:40 . 2008-10-24 12:21 455,296 -----c--- c:\windows\system32\dllcache\mrxsmb.sys 2008-11-09 19:02 . 2003-03-16 00:15 90,112 --a------ c:\windows\unvise32.exe 2008-11-09 18:55 . 2008-11-09 18:55 <DIR> d-------- c:\program files\DreamCatcher 2008-11-09 10:53 . 2008-12-02 16:50 3,375,740 --a------ c:\windows\{00000001-00000000-00000007-00001102-00000002-80651102}.BAK 2008-11-08 17:46 . 2008-11-08 17:46 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\Fallout3 2008-11-08 17:45 . 2008-11-08 17:45 <DIR> d-------- c:\program files\Bethesda Softworks 2008-11-07 17:53 . 2008-11-07 17:53 <DIR> d-------- c:\program files\THQ 2008-11-07 17:47 . 2008-11-07 17:47 <DIR> d--hs---- c:\windows\ftpcache 2008-11-07 17:23 . 2007-10-02 10:00 8,311,365,632 --a------ C:\CoH_OF.iso 2008-11-04 19:11 . 2008-11-04 19:11 <DIR> d-------- c:\program files\K-Lite Codec Pack 2008-11-03 21:31 . 2008-11-03 21:31 <DIR> d-------- c:\program files\MSBuild 2008-11-03 21:28 . 2008-11-08 17:44 <DIR> d-------- c:\windows\system32\XPSViewer 2008-11-03 21:28 . 2008-11-03 21:28 <DIR> d-------- c:\program files\Reference Assemblies 2008-11-03 21:27 . 2006-06-29 13:07 14,048 --------- c:\windows\system32\spmsg2.dll 2008-11-03 21:26 . 2008-11-03 21:26 <DIR> d-------- c:\windows\system32\xlive 2008-11-02 12:57 . 2008-11-02 12:57 <DIR> d-------- c:\program files\Activision . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-12-02 15:48 --------- d-----w c:\documents and settings\user\Dane aplikacji\Canon 2008-12-01 16:41 --------- d-----w c:\program files\Red Orchestra 2008-12-01 15:32 --------- d-----w c:\program files\Paradox Interactive 2008-11-30 16:42 --------- d-----w c:\program files\Canon 2008-11-30 16:14 --------- d-----w c:\documents and settings\user\Dane aplikacji\gtk-2.0 2008-11-30 11:23 --------- d-----w c:\documents and settings\user\Dane aplikacji\uTorrent 2008-11-26 17:47 --------- d-----w c:\program files\Electronic Arts 2008-11-22 22:01 --------- d-----w c:\documents and settings\user\Dane aplikacji\Hamachi 2008-11-21 19:51 --------- d--h--w c:\program files\InstallShield Installation Information 2008-11-16 00:39 --------- d-----w c:\program files\Warcraft III 2008-11-10 18:58 138,464 ----a-w c:\windows\system32\drivers\PnkBstrK.sys 2008-11-10 18:58 111,928 ----a-w c:\windows\system32\PnkBstrB.exe 2008-11-07 16:50 --------- d-----w c:\program files\Ubisoft 2008-11-04 18:08 --------- d-----w c:\program files\DivX 2008-11-02 11:59 682,280 ----a-w c:\windows\system32\pbsvc.exe 2008-11-02 11:59 22,328 ----a-w c:\documents and settings\user\Dane aplikacji\PnkBstrK.sys 2008-11-02 10:41 66,872 ----a-w c:\windows\system32\PnkBstrA.exe 2008-11-01 16:21 --------- d-----w c:\program files\EA GAMES 2008-10-30 21:33 57,592 ----a-w c:\documents and settings\user\Dane aplikacji\GDIPFONTCACHEV1.DAT 2008-10-30 08:24 --------- d-----w c:\program files\AnswerWorks 4.0 2008-10-30 08:22 --------- d-----w c:\program files\ZSoft 2008-10-29 21:32 --------- d-----w c:\program files\Gadu-Gadu 2008-10-29 17:41 --------- d-----w c:\documents and settings\user\Dane aplikacji\Touchstone 2008-10-29 17:40 --------- d-----w c:\program files\SEGA 2008-10-29 15:16 --------- d-----w c:\program files\free-downloads.net 2008-10-29 15:16 --------- d-----w c:\program files\Conduit 2008-10-29 15:16 --------- d-----w c:\program files\Alcohol Soft 2008-10-28 20:13 --------- d-----w c:\program files\Supaplex 3000 2008-10-26 11:01 --------- d-----w c:\documents and settings\user\Dane aplikacji\Winamp 2008-10-25 11:23 --------- d-----w c:\program files\Graphisoft 2008-10-25 11:21 --------- d-----w c:\program files\Java 2008-10-25 07:56 --------- d-----w c:\program files\Mount&Blade 2008-10-24 19:59 --------- d-----w c:\documents and settings\user\Dane aplikacji\Abvent_Artlantis2 2008-10-24 19:59 --------- d-----w c:\documents and settings\user\Dane aplikacji\Abvent 2008-10-24 19:59 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\Abvent 2008-10-24 19:58 --------- d-----w c:\program files\Artlantis Render 2 2008-10-24 11:21 455,296 ----a-w c:\windows\system32\drivers\mrxsmb.sys 2008-10-23 20:07 107,888 ----a-w c:\windows\system32\CmdLineExt.dll 2008-10-20 13:41 --------- d-----w c:\documents and settings\user\Dane aplikacji\Apple Computer 2008-10-19 21:14 --------- d-----w c:\program files\QuickTime 2008-10-19 21:13 --------- d-----w c:\program files\Apple Software Update 2008-10-19 21:13 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\Apple Computer 2008-10-19 21:13 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\Apple 2008-10-19 17:24 --------- d-----w c:\program files\uTorrent 2008-10-19 13:35 --------- d-----w c:\program files\Victoria 2008-10-16 13:13 202,776 ----a-w c:\windows\system32\wuweb.dll 2008-10-16 13:13 1,809,944 ----a-w c:\windows\system32\wuaueng.dll 2008-10-16 13:12 561,688 ----a-w c:\windows\system32\wuapi.dll 2008-10-16 13:12 323,608 ----a-w c:\windows\system32\wucltui.dll 2008-10-16 13:09 92,696 ----a-w c:\windows\system32\cdm.dll 2008-10-16 13:09 51,224 ----a-w c:\windows\system32\wuauclt.exe 2008-10-16 13:09 43,544 ----a-w c:\windows\system32\wups2.dll 2008-10-16 13:08 34,328 ----a-w c:\windows\system32\wups.dll 2008-10-14 20:14 --------- d-----w c:\program files\Total War 2008-10-08 19:43 --------- d-----w c:\program files\Guitar Pro 5 2008-09-30 15:43 1,286,152 ----a-w c:\windows\system32\msxml4.dll 2008-09-15 15:54 304,528 ----a-w c:\windows\system32\appdrvrem01.exe 2008-09-15 15:27 1,846,656 ----a-w c:\windows\system32\win32k.sys 2008-09-10 13:22 674,634 ----a-w c:\windows\unins000.exe 2008-09-10 01:15 1,307,648 ----a-w c:\windows\system32\msxml6.dll 2008-09-04 17:17 1,106,944 ----a-w c:\windows\system32\msxml3.dll . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks] "{57BCA5FA-5DBB-45a2-B558-1755C3F6253B}"= "c:\program files\Winamp Toolbar\winamptb.dll" [2008-03-19 1267040] "{ecdee021-0d17-467f-a1ff-c7a115230949}"= "c:\program files\free-downloads.net\tbfree.dll" [2008-02-14 1555480] [HKEY_CLASSES_ROOT\clsid\{57bca5fa-5dbb-45a2-b558-1755c3f6253b}] [HKEY_CLASSES_ROOT\WINAMPTB.AOLTBSearch.1] [HKEY_CLASSES_ROOT\TypeLib\{538CD77C-BFDD-49b0-9562-77419CAB89D1}] [HKEY_CLASSES_ROOT\WINAMPTB.AOLTBSearch] [HKEY_CLASSES_ROOT\clsid\{ecdee021-0d17-467f-a1ff-c7a115230949}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{ecdee021-0d17-467f-a1ff-c7a115230949}] 2008-02-14 14:54 1555480 --a------ c:\program files\free-downloads.net\tbfree.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar] "{ecdee021-0d17-467f-a1ff-c7a115230949}"= "c:\program files\free-downloads.net\tbfree.dll" [2008-02-14 1555480] [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser] "{ECDEE021-0D17-467F-A1FF-C7A115230949}"= "c:\program files\free-downloads.net\tbfree.dll" [2008-02-14 1555480] [HKEY_CLASSES_ROOT\clsid\{ecdee021-0d17-467f-a1ff-c7a115230949}] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2008-04-15 15360] "Gadu-Gadu"="c:\program files\Gadu-Gadu\gg.exe" [2008-03-20 2127296] "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2006-11-16 139264] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "UpdReg"="c:\windows\UpdReg.EXE" [2000-05-11 90112] "Jet Detection"="c:\program files\Creative\SBLive\PROGRAM\ADGJDet.exe" [2001-11-29 28672] "CTStartup"="c:\program files\Creative\Splash Screen\CTEaxSpl.EXE" [2001-12-20 28672] "avgnt"="c:\program files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-07-19 266497] "PivotSoftware"="c:\program files\Portrait Displays\Pivot Software\wpctrl.exe" [2007-02-09 694008] "DT HPW"="c:\program files\Common Files\Portrait Displays\Shared\DT_startup.exe" [2008-06-24 81920] "SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 132496] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-05-16 13529088] "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-05-16 86016] "CanonSolutionMenu"="c:\program files\Canon\SolutionMenu\CNSLMAIN.exe" [2007-05-14 644696] "CanonMyPrinter"="c:\program files\Canon\MyPrinter\BJMyPrt.exe" [2007-04-03 1603152] "WINDVDPatch"="CTHELPER.EXE" [2002-07-02 c:\windows\system32\CTHELPER.EXE] "nwiz"="nwiz.exe" [2008-05-16 c:\windows\system32\nwiz.exe] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-15 15360] c:\documents and settings\All Users\Menu Start\Programy\Autostart\ Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-02-13 83360] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "msacm.ctmp3"= c:\windows\system32\ctmp3.acm "vidc.DIVF"= DivX412.dll "vidc.vp31"= vp31vfw.dll "vidc.mjpg"= pvmjpg30.dll [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^LUMIX Simple Viewer.lnk] path=c:\documents and settings\All Users\Menu Start\Programy\Autostart\LUMIX Simple Viewer.lnk backup=c:\windows\pss\LUMIX Simple Viewer.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CanonMyPrinter] --a------ 2007-04-03 17:50 1603152 c:\program files\Canon\MyPrinter\BJMYPRT.EXE [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CanonSolutionMenu] --a------ 2007-05-14 17:01 644696 c:\program files\Canon\SolutionMenu\CNSLMAIN.EXE [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Comrade.exe] --a------ 2007-06-29 14:03 36864 c:\program files\GameSpy\Comrade\Comrade.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite] --a------ 2008-07-04 16:01 486856 c:\program files\DAEMON Tools Lite\daemon.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] --a------ 2006-01-12 14:40 155648 c:\program files\Common Files\Ahead\Lib\NeroCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] --a------ 2008-05-27 09:50 413696 c:\program files\QuickTime\QTTask.exe [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusOverride"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\EA GAMES\\Battlefield 2\\BF2.exe"= "c:\\Program Files\\Red Orchestra\\steamapps\\ykes\\source sdk base\\hl2.exe"= "c:\\Program Files\\Hamachi\\hamachi.exe"= "c:\\Program Files\\THQ\\Company of Heroes\\RelicCOH.exe"= "c:\\Program Files\\Red Orchestra\\steamapps\\common\\red orchestra\\System\\RedOrchestra.exe"= "c:\\Program Files\\Warcraft III\\Warcraft III.exe"= "c:\\Program Files\\Warcraft III\\War3.exe"= "c:\\Program Files\\Electronic Arts\\Crytek\\Crysis\\Bin32\\Crysis.exe"= "c:\\Program Files\\Electronic Arts\\Crytek\\Crysis\\Bin32\\CrysisDedicatedServer.exe"= "c:\\WINDOWS\\system32\\PnkBstrA.exe"= "c:\\WINDOWS\\system32\\PnkBstrB.exe"= "c:\\Program Files\\Pinnacle\\VideoSpin\\Programs\\RM.exe"= "c:\\Program Files\\Pinnacle\\VideoSpin\\Programs\\PMSRegisterFile.exe"= "c:\\Program Files\\Pinnacle\\VideoSpin\\Programs\\umi.exe"= "c:\\Program Files\\Pinnacle\\VideoSpin\\Programs\\VideoSpin.exe"= "c:\\Program Files\\Doomsday\\Doomsday\\HoI2.exe"= "c:\\WINDOWS\\system32\\dplaysvr.exe"= "c:\\Program Files\\Paradox Interactive\\Europa Universalis III\\eu3game.exe"= "c:\\Program Files\\uTorrent\\uTorrent.exe"= "c:\\Documents and Settings\\user\\Pulpit\\Torrent\\utorrent.exe"= "c:\\Program Files\\Graphisoft\\ArchiCAD 12\\ArchiCAD.exe"= "c:\\Program Files\\Electronic Arts\\Dead Space\\Dead Space.exe"= "c:\\Program Files\\Activision\\Call of Duty - World at War Beta\\CoDWaWbeta.exe"= "c:\\Program Files\\Firefly Studios\\Stronghold Crusader\\Stronghold Crusader.exe"= "c:\\Program Files\\Paradox Entertainment\\Europa Universalis 2\\EU2.exe"= "c:\\Program Files\\NAMCO BANDAI Games\\Warhammer® Mark of Chaos\\Warhammer.exe"= "c:\\Program Files\\Firefly Studios\\Stronghold 2\\Stronghold2.exe"= R1 appdrv01;Application Driver (01);c:\windows\system32\Drivers\appdrv01.sys [2008-09-15 2915944] S2 appdrvrem01;Application Driver Auto Removal Service (01);c:\windows\System32\appdrvrem01.exe svc [] S3 VNUSB;VN Series Device;c:\windows\system32\DRIVERS\VNUSB.sys [2008-08-22 38496] . Zawartość folderu 'Zaplanowane zadania' 2008-11-28 c:\windows\Tasks\AppleSoftwareUpdate.job - c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-04-11 16:57] . . ------- Skan uzupełniający ------- . FireFox -: Profile - c:\documents and settings\user\Dane aplikacji\Mozilla\Firefox\Profiles\zud551rc.default\ FF -: plugin - c:\program files\Adobe\Acrobat 5.0\Reader\browser\nppdf32.dll FF -: plugin - c:\program files\Mozilla Firefox\plugins\npqtplugin8.dll FF -: plugin - c:\program files\QuickTime\Plugins\npqtplugin8.dll . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-12-02 17:15:12 Windows 5.1.2600 Dodatek Service Pack 3 NTFS skanowanie ukrytych procesów ... skanowanie ukrytych wpisów autostartu ... HKLM\Software\Microsoft\Windows\CurrentVersion\Run CTStartup = c:\program files\Creative\Splash Screen\CTEaxSpl.EXE /run???h??????s?????\?w? ?w???????w???w4???????.??w4???????4???TA?s4???0????&8?????\??? ??? ???\???\???????????5?7~e?7~\???\????????~`??????C@?\???\??????s0???\??????s\????&8?A??s?&8??C@?x???`|?w\?????@ skanowanie ukrytych plików ... skanowanie pomyślnie ukończone ukryte pliki: 0 ************************************************************************** . Czas ukończenia: 2008-12-02 17:16:11 ComboFix-quarantined-files.txt 2008-12-02 16:15:59 ComboFix2.txt 2008-07-16 15:49:49 Przed: 12 756 029 440 bajtów wolnych Po: 12,743,344,128 bajtów wolnych 232 --- E O F --- 2008-11-13 20:57:29

Hijack:

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 17:17:36, on 2008-12-02 Platform: Windows XP Dodatek SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe C:\Program Files\Portrait Displays\Pivot Software\wpctrl.exe C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe C:\WINDOWS\system32\RUNDLL32.EXE C:\Program Files\Canon\MyPrinter\BJMyPrt.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Portrait Displays\HP My Display\DTHtml.exe C:\Program Files\Gadu-Gadu\gg.exe C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe C:\Program Files\Common Files\Portrait Displays\Shared\HookManager.exe C:\Program Files\Portrait Displays\Pivot Software\floater.exe C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe C:\Program Files\a-squared Free\a2service.exe C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe C:\WINDOWS\system32\CTsvcCDA.exe C:\Program Files\Common Files\Portrait Displays\Shared\DTSRVC.exe C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\PnkBstrA.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\MsPMSPSv.exe C:\WINDOWS\system32\wuauclt.exe C:\WINDOWS\explorer.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://search.conduit.com?SearchSource=10&ctid=CT1098640 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza R3 - URLSearchHook: Winamp Search Class - {57BCA5FA-5DBB-45a2-B558-1755C3F6253B} - C:\Program Files\Winamp Toolbar\winamptb.dll R3 - URLSearchHook: free-downloads.net Toolbar - {ecdee021-0d17-467f-a1ff-c7a115230949} - C:\Program Files\free-downloads.net\tbfree.dll O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_6_2_0.dll O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx O2 - BHO: Winamp Toolbar Loader - {25CEE8EC-5730-41bc-8B58-22DDC8AB8C20} - C:\Program Files\Winamp Toolbar\winamptb.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O2 - BHO: free-downloads.net Toolbar - {ecdee021-0d17-467f-a1ff-c7a115230949} - C:\Program Files\free-downloads.net\tbfree.dll O3 - Toolbar: &Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_6_2_0.dll O3 - Toolbar: Winamp Toolbar - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - C:\Program Files\Winamp Toolbar\winamptb.dll O3 - Toolbar: free-downloads.net Toolbar - {ecdee021-0d17-467f-a1ff-c7a115230949} - C:\Program Files\free-downloads.net\tbfree.dll O4 - HKLM\..\Run: [WINDVDPatch] CTHELPER.EXE O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE O4 - HKLM\..\Run: [Jet Detection] "C:\Program Files\Creative\SBLive\PROGRAM\ADGJDet.exe" O4 - HKLM\..\Run: [CTStartup] C:\Program Files\Creative\Splash Screen\CTEaxSpl.EXE /run O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min O4 - HKLM\..\Run: [PivotSoftware] "C:\Program Files\Portrait Displays\Pivot Software\wpctrl.exe" O4 - HKLM\..\Run: [DT HPW] C:\Program Files\Common Files\Portrait Displays\Shared\DT_startup.exe -HPW O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [CanonSolutionMenu] C:\Program Files\Canon\SolutionMenu\CNSLMAIN.exe /logon O4 - HKLM\..\Run: [CanonMyPrinter] C:\Program Files\Canon\MyPrinter\BJMyPrt.exe /logon O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - C:\Program Files\a-squared Free\a2service.exe O23 - Service: Avira AntiVir Personal – Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe O23 - Service: Avira AntiVir Personal – Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe O23 - Service: Application Driver Auto Removal Service (01) (appdrvrem01) - Protection Technology - C:\WINDOWS\System32\appdrvrem01.exe O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe O23 - Service: Portrait Displays Display Tune Service (DTSRVC) - Unknown owner - C:\Program Files\Common Files\Portrait Displays\Shared\DTSRVC.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe O23 - Service: PIXMA Extended Survey Program (IJPLMSVC) - Unknown owner - C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: PACSPTISVR - Unknown owner - C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe -- End of file - 8066 bytes

**Posty:** 18165 · przez **wojtas** 02 Gru 2008, 18:46

Wykonaj to co jest podane w tym temacie

Zastosuj SDFix . Po pobraniu uruchom go a rozpakuje się do C:\SDFix. Uruchom komputer w trybie awaryjnym (F8 przy stracie systemu). Będąc w awaryjnym uruchom plik RunThis.bat z folderu SDFixa. Zatwierdź czyszczenie przez Y. Poczekaj aż ukończy i komputer zresetuje

Potem wejdz do folderu C:\SDFix wrzuc zawartość pliku Report.txt + log z combofixa oraz daj loga z hijacka

**Posty:** 185 · przez **ykes** 03 Gru 2008, 13:53

SDFix:

Kod: Zaznacz wszystko: [b]SDFix: Version 1.240 [/b] Run by Administrator on 2008-12-02 at 20:19 Microsoft Windows XP [Wersja 5.1.2600] Running From: C:\SDFix [b]Checking Services [/b]: Restoring Default Security Values Restoring Default Hosts File Rebooting [b]Checking Files [/b]: No Trojan Files Found Removing Temp Files [b]ADS Check [/b]: [b]Final Check [/b]: catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-12-02 21:43:30 Windows 5.1.2600 Dodatek Service Pack 3 NTFS scanning hidden processes ... scanning hidden services & system hive ... [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg] "s1"=dword:2df9c43f "s2"=dword:110480d0 "h0"=dword:00000002 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04] "p0"="C:\Program Files\Alcohol Soft\Alcohol 120\" "h0"=dword:00000001 "ujdew"=hex:80,39,8d,b5,44,33,5a,17,f3,02,7e,c2,e4,fb,a3,de,35,5c,e9,98,15,.. [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4] "p0"="C:\Program Files\DAEMON Tools Lite\" "h0"=dword:00000000 "khjeh"=hex:59,2c,ce,f8,f8,a5,e4,9d,1d,63,1a,b5,a5,6e,43,98,6f,d4,49,b2,5c,.. [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001] "a0"=hex:20,01,00,00,58,e4,d4,1b,18,c1,98,2b,58,03,bc,ac,dc,a9,23,54,7e,.. "khjeh"=hex:c7,6e,b8,15,96,1f,35,d4,3c,e5,1f,6e,a8,d3,8c,81,bf,75,e9,6f,1c,.. [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40] "khjeh"=hex:f3,e1,44,e7,2b,91,24,8e,74,4d,f5,3d,3b,68,f7,8b,a6,44,71,42,7b,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04] "p0"="C:\Program Files\Alcohol Soft\Alcohol 120\" "h0"=dword:00000001 "ujdew"=hex:80,39,8d,b5,44,33,5a,17,f3,02,7e,c2,e4,fb,a3,de,35,5c,e9,98,15,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4] "p0"="C:\Program Files\DAEMON Tools Lite\" "h0"=dword:00000000 "khjeh"=hex:59,2c,ce,f8,f8,a5,e4,9d,1d,63,1a,b5,a5,6e,43,98,6f,d4,49,b2,5c,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001] "a0"=hex:20,01,00,00,58,e4,d4,1b,18,c1,98,2b,58,03,bc,ac,dc,a9,23,54,7e,.. "khjeh"=hex:c7,6e,b8,15,96,1f,35,d4,3c,e5,1f,6e,a8,d3,8c,81,bf,75,e9,6f,1c,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40] "khjeh"=hex:f3,e1,44,e7,2b,91,24,8e,74,4d,f5,3d,3b,68,f7,8b,a6,44,71,42,7b,.. scanning hidden registry entries ... scanning hidden files ... scan completed successfully hidden processes: 0 hidden services: 0 hidden files: 0 [b]Remaining Services [/b]: Authorized Application Key Export: [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] "%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000" "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "C:\\Program Files\\EA GAMES\\Battlefield 2\\BF2.exe"="C:\\Program Files\\EA GAMES\\Battlefield 2\\BF2.exe:*:Enabled:Battlefield 2" "C:\\Program Files\\Red Orchestra\\steamapps\\ykes\\source sdk base\\hl2.exe"="C:\\Program Files\\Red Orchestra\\steamapps\\ykes\\source sdk base\\hl2.exe:*:Enabled:hl2" "C:\\Program Files\\Hamachi\\hamachi.exe"="C:\\Program Files\\Hamachi\\hamachi.exe:*:Enabled:Hamachi" "C:\\Program Files\\THQ\\Company of Heroes\\RelicCOH.exe"="C:\\Program Files\\THQ\\Company of Heroes\\RelicCOH.exe:*:Enabled:RelicCOH" "C:\\Program Files\\Red Orchestra\\steamapps\\common\\red orchestra\\System\\RedOrchestra.exe"="C:\\Program Files\\Red Orchestra\\steamapps\\common\\red orchestra\\System\\RedOrchestra.exe:*:Enabled:RedOrchestra" "C:\\Program Files\\Warcraft III\\Warcraft III.exe"="C:\\Program Files\\Warcraft III\\Warcraft III.exe:*:Enabled:Warcraft III" "C:\\Program Files\\Warcraft III\\War3.exe"="C:\\Program Files\\Warcraft III\\War3.exe:*:Enabled:Warcraft III" "C:\\Program Files\\Electronic Arts\\Crytek\\Crysis\\Bin32\\Crysis.exe"="C:\\Program Files\\Electronic Arts\\Crytek\\Crysis\\Bin32\\Crysis.exe:*:Enabled:Crysis_32" "C:\\Program Files\\Electronic Arts\\Crytek\\Crysis\\Bin32\\CrysisDedicatedServer.exe"="C:\\Program Files\\Electronic Arts\\Crytek\\Crysis\\Bin32\\CrysisDedicatedServer.exe:*:Enabled:CrysisDedicatedServer_32" "C:\\WINDOWS\\system32\\PnkBstrA.exe"="C:\\WINDOWS\\system32\\PnkBstrA.exe:*:Enabled:PnkBstrA" "C:\\WINDOWS\\system32\\PnkBstrB.exe"="C:\\WINDOWS\\system32\\PnkBstrB.exe:*:Enabled:PnkBstrB" "C:\\Program Files\\Pinnacle\\VideoSpin\\Programs\\RM.exe"="C:\\Program Files\\Pinnacle\\VideoSpin\\Programs\\RM.exe:*:Enabled:Render Manager" "C:\\Program Files\\Pinnacle\\VideoSpin\\Programs\\PMSRegisterFile.exe"="C:\\Program Files\\Pinnacle\\VideoSpin\\Programs\\PMSRegisterFile.exe:*:Enabled:PMSRegisterFile" "C:\\Program Files\\Pinnacle\\VideoSpin\\Programs\\umi.exe"="C:\\Program Files\\Pinnacle\\VideoSpin\\Programs\\umi.exe:*:Enabled:umi" "C:\\Program Files\\Pinnacle\\VideoSpin\\Programs\\VideoSpin.exe"="C:\\Program Files\\Pinnacle\\VideoSpin\\Programs\\VideoSpin.exe:*:Enabled:Pinnacle VideoSpin" "C:\\Program Files\\Doomsday\\Doomsday\\HoI2.exe"="C:\\Program Files\\Doomsday\\Doomsday\\HoI2.exe:*:Disabled:Hearts of Iron 2" "C:\\WINDOWS\\system32\\dplaysvr.exe"="C:\\WINDOWS\\system32\\dplaysvr.exe:*:Disabled:Microsoft DirectPlay Helper" "C:\\Program Files\\Paradox Interactive\\Europa Universalis III\\eu3game.exe"="C:\\Program Files\\Paradox Interactive\\Europa Universalis III\\eu3game.exe:*:Enabled:Europa Universalis III" "C:\\Program Files\\uTorrent\\uTorrent.exe"="C:\\Program Files\\uTorrent\\uTorrent.exe:*:Enabled:uTorrent" "C:\\Documents and Settings\\user\\Pulpit\\Torrent\\utorrent.exe"="C:\\Documents and Settings\\user\\Pulpit\\Torrent\\utorrent.exe:*:Enabled:uTorrent" "C:\\Program Files\\Graphisoft\\ArchiCAD 12\\ArchiCAD.exe"="C:\\Program Files\\Graphisoft\\ArchiCAD 12\\ArchiCAD.exe:*:Enabled:ArchiCAD 12.0.0 Component" "C:\\Program Files\\Electronic Arts\\Dead Space\\Dead Space.exe"="C:\\Program Files\\Electronic Arts\\Dead Space\\Dead Space.exe:*:Enabled:Dead Space t" "C:\\Program Files\\Activision\\Call of Duty - World at War Beta\\CoDWaWbeta.exe"="C:\\Program Files\\Activision\\Call of Duty - World at War Beta\\CoDWaWbeta.exe:*:Enabled:Call of Duty(R): World at War Multiplayer" "C:\\Program Files\\Firefly Studios\\Stronghold Crusader\\Stronghold Crusader.exe"="C:\\Program Files\\Firefly Studios\\Stronghold Crusader\\Stronghold Crusader.exe:*:Enabled:Stronghold Crusader" "C:\\Program Files\\Paradox Entertainment\\Europa Universalis 2\\EU2.exe"="C:\\Program Files\\Paradox Entertainment\\Europa Universalis 2\\EU2.exe:*:Enabled:Europa Universalis II" "C:\\Program Files\\NAMCO BANDAI Games\\WarhammerR Mark of Chaos\\Warhammer.exe"="C:\\Program Files\\NAMCO BANDAI Games\\WarhammerR Mark of Chaos\\Warhammer.exe:*:Enabled:WarhammerR: Mark of Chaost" "C:\\Program Files\\Firefly Studios\\Stronghold 2\\Stronghold2.exe"="C:\\Program Files\\Firefly Studios\\Stronghold 2\\Stronghold2.exe:*:Enabled:Stronghold 2" [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list] "%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000" "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" [b]Remaining Files [/b]: [b]Files with Hidden Attributes [/b]: Thu 15 Feb 2007 308,832 A..H. --- "C:\Program Files\Canon\MP Navigator EX 1.0\Maint.exe" Mon 28 Feb 2005 61,440 A..H. --- "C:\Program Files\Canon\MP Navigator EX 1.0\uinstrsc.dll" Tue 8 Jul 2008 13,584 A..H. --- "C:\Swsetup\Monitors\SP39949\HPx64DRV.exe" [b]Finished![/b]

CoboFix:

Kod: Zaznacz wszystko: ComboFix 08-12-01.03 - user 2008-12-03 12:42:50.5 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.3.1250.48.1045.18.1610 [GMT 1:00] Uruchomiony z: c:\documents and settings\user\Pulpit\ComboFix.exe [COLOR=RED][B]UWAGA - TEN KOMPUTER NIE MA ZAINSTALOWANEJ KONSOLI ODZYSKIWANIA !![/B][/COLOR] . ((((((((((((((((((((((((( Pliki utworzone od 2008-11-03 do 2008-12-03 ))))))))))))))))))))))))))))))) . 2008-11-30 17:42 . 2008-11-30 17:42 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\CanonIJPLM 2008-11-26 18:58 . 2008-11-26 18:58 <DIR> d-------- c:\documents and settings\user\Dane aplikacji\Red Alert 3 Demo 2008-11-25 22:52 . 2008-11-25 22:52 <DIR> d-------- c:\program files\LitexMedia 2008-11-25 22:42 . 2008-11-25 22:42 <DIR> d-------- c:\program files\Deskshare 2008-11-25 22:42 . 2008-11-25 22:42 356,352 --a------ c:\windows\eSellerateEngine.dll 2008-11-25 22:42 . 2004-12-07 10:11 258,352 --a------ c:\windows\system32\Unicows.dll 2008-11-16 15:37 . 2008-11-16 15:37 <DIR> d-------- c:\program files\NAMCO BANDAI Games 2008-11-15 10:28 . 2008-11-15 10:28 <DIR> d-------- c:\program files\Paradox Entertainment 2008-11-13 21:57 . 2008-11-13 21:57 1,393 --a------ c:\windows\imsins.BAK 2008-11-13 16:23 . 2008-11-17 21:10 <DIR> d-------- c:\program files\Firefly Studios 2008-11-13 09:40 . 2008-10-24 12:21 455,296 -----c--- c:\windows\system32\dllcache\mrxsmb.sys 2008-11-09 19:02 . 2003-03-16 00:15 90,112 --a------ c:\windows\unvise32.exe 2008-11-09 18:55 . 2008-11-09 18:55 <DIR> d-------- c:\program files\DreamCatcher 2008-11-09 10:53 . 2008-12-03 12:40 3,375,740 --a------ c:\windows\{00000001-00000000-00000007-00001102-00000002-80651102}.BAK 2008-11-08 17:46 . 2008-11-08 17:46 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\Fallout3 2008-11-08 17:45 . 2008-11-08 17:45 <DIR> d-------- c:\program files\Bethesda Softworks 2008-11-07 17:53 . 2008-11-07 17:53 <DIR> d-------- c:\program files\THQ 2008-11-07 17:47 . 2008-11-07 17:47 <DIR> d--hs---- c:\windows\ftpcache 2008-11-07 17:23 . 2007-10-02 10:00 8,311,365,632 --a------ C:\CoH_OF.iso 2008-11-04 19:11 . 2008-11-04 19:11 <DIR> d-------- c:\program files\K-Lite Codec Pack 2008-11-03 21:31 . 2008-11-03 21:31 <DIR> d-------- c:\program files\MSBuild 2008-11-03 21:28 . 2008-11-08 17:44 <DIR> d-------- c:\windows\system32\XPSViewer 2008-11-03 21:28 . 2008-11-03 21:28 <DIR> d-------- c:\program files\Reference Assemblies 2008-11-03 21:27 . 2006-06-29 13:07 14,048 --------- c:\windows\system32\spmsg2.dll 2008-11-03 21:26 . 2008-11-03 21:26 <DIR> d-------- c:\windows\system32\xlive . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-12-02 17:13 --------- d-----w c:\program files\Red Orchestra 2008-12-02 15:48 --------- d-----w c:\documents and settings\user\Dane aplikacji\Canon 2008-12-01 15:32 --------- d-----w c:\program files\Paradox Interactive 2008-11-30 16:42 --------- d-----w c:\program files\Canon 2008-11-30 16:14 --------- d-----w c:\documents and settings\user\Dane aplikacji\gtk-2.0 2008-11-30 11:23 --------- d-----w c:\documents and settings\user\Dane aplikacji\uTorrent 2008-11-26 17:47 --------- d-----w c:\program files\Electronic Arts 2008-11-22 22:01 --------- d-----w c:\documents and settings\user\Dane aplikacji\Hamachi 2008-11-21 19:51 --------- d--h--w c:\program files\InstallShield Installation Information 2008-11-16 00:39 --------- d-----w c:\program files\Warcraft III 2008-11-10 18:58 138,464 ----a-w c:\windows\system32\drivers\PnkBstrK.sys 2008-11-10 18:58 111,928 ----a-w c:\windows\system32\PnkBstrB.exe 2008-11-07 16:50 --------- d-----w c:\program files\Ubisoft 2008-11-04 18:08 --------- d-----w c:\program files\DivX 2008-11-02 11:59 682,280 ----a-w c:\windows\system32\pbsvc.exe 2008-11-02 11:59 22,328 ----a-w c:\documents and settings\user\Dane aplikacji\PnkBstrK.sys 2008-11-02 11:57 --------- d-----w c:\program files\Activision 2008-11-02 10:41 66,872 ----a-w c:\windows\system32\PnkBstrA.exe 2008-11-01 16:21 --------- d-----w c:\program files\EA GAMES 2008-10-30 21:33 57,592 ----a-w c:\documents and settings\user\Dane aplikacji\GDIPFONTCACHEV1.DAT 2008-10-30 08:24 --------- d-----w c:\program files\AnswerWorks 4.0 2008-10-30 08:22 --------- d-----w c:\program files\ZSoft 2008-10-29 21:32 --------- d-----w c:\program files\Gadu-Gadu 2008-10-29 17:41 --------- d-----w c:\documents and settings\user\Dane aplikacji\Touchstone 2008-10-29 17:40 --------- d-----w c:\program files\SEGA 2008-10-29 15:16 --------- d-----w c:\program files\free-downloads.net 2008-10-29 15:16 --------- d-----w c:\program files\Conduit 2008-10-29 15:16 --------- d-----w c:\program files\Alcohol Soft 2008-10-28 20:13 --------- d-----w c:\program files\Supaplex 3000 2008-10-26 11:01 --------- d-----w c:\documents and settings\user\Dane aplikacji\Winamp 2008-10-25 11:23 --------- d-----w c:\program files\Graphisoft 2008-10-25 11:21 --------- d-----w c:\program files\Java 2008-10-25 07:56 --------- d-----w c:\program files\Mount&Blade 2008-10-24 19:59 --------- d-----w c:\documents and settings\user\Dane aplikacji\Abvent_Artlantis2 2008-10-24 19:59 --------- d-----w c:\documents and settings\user\Dane aplikacji\Abvent 2008-10-24 19:59 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\Abvent 2008-10-24 19:58 --------- d-----w c:\program files\Artlantis Render 2 2008-10-24 11:21 455,296 ----a-w c:\windows\system32\drivers\mrxsmb.sys 2008-10-23 20:07 107,888 ----a-w c:\windows\system32\CmdLineExt.dll 2008-10-20 13:41 --------- d-----w c:\documents and settings\user\Dane aplikacji\Apple Computer 2008-10-19 21:14 --------- d-----w c:\program files\QuickTime 2008-10-19 21:13 --------- d-----w c:\program files\Apple Software Update 2008-10-19 21:13 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\Apple Computer 2008-10-19 21:13 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\Apple 2008-10-19 17:24 --------- d-----w c:\program files\uTorrent 2008-10-19 13:35 --------- d-----w c:\program files\Victoria 2008-10-16 13:13 202,776 ----a-w c:\windows\system32\wuweb.dll 2008-10-16 13:13 1,809,944 ----a-w c:\windows\system32\wuaueng.dll 2008-10-16 13:12 561,688 ----a-w c:\windows\system32\wuapi.dll 2008-10-16 13:12 323,608 ----a-w c:\windows\system32\wucltui.dll 2008-10-16 13:09 92,696 ----a-w c:\windows\system32\cdm.dll 2008-10-16 13:09 51,224 ----a-w c:\windows\system32\wuauclt.exe 2008-10-16 13:09 43,544 ----a-w c:\windows\system32\wups2.dll 2008-10-16 13:08 34,328 ----a-w c:\windows\system32\wups.dll 2008-10-14 20:14 --------- d-----w c:\program files\Total War 2008-10-08 19:43 --------- d-----w c:\program files\Guitar Pro 5 2008-09-30 15:43 1,286,152 ----a-w c:\windows\system32\msxml4.dll 2008-09-15 15:54 304,528 ----a-w c:\windows\system32\appdrvrem01.exe 2008-09-15 15:27 1,846,656 ----a-w c:\windows\system32\win32k.sys 2008-09-10 13:22 674,634 ----a-w c:\windows\unins000.exe 2008-09-10 01:15 1,307,648 ----a-w c:\windows\system32\msxml6.dll 2008-09-04 17:17 1,106,944 ----a-w c:\windows\system32\msxml3.dll . ((((((((((((((((((((((((((((( snapshot_2008-11-30_18.42.42,19 ))))))))))))))))))))))))))))))))))))))))) . - 2008-05-13 00:55:56 163,328 ----a-w c:\windows\ERUNT\SDFIX\ERDNT.EXE + 2008-08-07 14:27:04 163,328 ----a-w c:\windows\ERUNT\SDFIX\ERDNT.EXE - 2008-07-16 15:54:35 577,536 ----a-w c:\windows\ERUNT\SDFIX\Users\[u]0[/u]0000001\NTUSER.DAT + 2008-12-02 19:14:30 577,536 ----a-w c:\windows\ERUNT\SDFIX\Users\[u]0[/u]0000001\NTUSER.DAT - 2008-07-16 15:54:35 8,192 ----a-w c:\windows\ERUNT\SDFIX\Users\[u]0[/u]0000002\UsrClass.dat + 2008-12-02 19:14:30 8,192 ----a-w c:\windows\ERUNT\SDFIX\Users\[u]0[/u]0000002\UsrClass.dat . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks] "{57BCA5FA-5DBB-45a2-B558-1755C3F6253B}"= "c:\program files\Winamp Toolbar\winamptb.dll" [2008-03-19 1267040] "{ecdee021-0d17-467f-a1ff-c7a115230949}"= "c:\program files\free-downloads.net\tbfree.dll" [2008-02-14 1555480] [HKEY_CLASSES_ROOT\clsid\{57bca5fa-5dbb-45a2-b558-1755c3f6253b}] [HKEY_CLASSES_ROOT\WINAMPTB.AOLTBSearch.1] [HKEY_CLASSES_ROOT\TypeLib\{538CD77C-BFDD-49b0-9562-77419CAB89D1}] [HKEY_CLASSES_ROOT\WINAMPTB.AOLTBSearch] [HKEY_CLASSES_ROOT\clsid\{ecdee021-0d17-467f-a1ff-c7a115230949}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{ecdee021-0d17-467f-a1ff-c7a115230949}] 2008-02-14 14:54 1555480 --a------ c:\program files\free-downloads.net\tbfree.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar] "{ecdee021-0d17-467f-a1ff-c7a115230949}"= "c:\program files\free-downloads.net\tbfree.dll" [2008-02-14 1555480] [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser] "{ECDEE021-0D17-467F-A1FF-C7A115230949}"= "c:\program files\free-downloads.net\tbfree.dll" [2008-02-14 1555480] [HKEY_CLASSES_ROOT\clsid\{ecdee021-0d17-467f-a1ff-c7a115230949}] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Gadu-Gadu"="c:\program files\Gadu-Gadu\gg.exe" [2008-03-20 2127296] "CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2008-04-15 15360] "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2006-11-16 139264] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTStartup"="c:\program files\Creative\Splash Screen\CTEaxSpl.EXE" [2001-12-20 28672] "UpdReg"="c:\windows\UpdReg.EXE" [2000-05-11 90112] "SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 132496] "PivotSoftware"="c:\program files\Portrait Displays\Pivot Software\wpctrl.exe" [2007-02-09 694008] "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-05-16 86016] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-05-16 13529088] "NeroFilterCheck"="c:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-12 155648] "Jet Detection"="c:\program files\Creative\SBLive\PROGRAM\ADGJDet.exe" [2001-11-29 28672] "DT HPW"="c:\program files\Common Files\Portrait Displays\Shared\DT_startup.exe" [2008-06-24 81920] "CanonSolutionMenu"="c:\program files\Canon\SolutionMenu\CNSLMAIN.exe" [2007-05-14 644696] "CanonMyPrinter"="c:\program files\Canon\MyPrinter\BJMyPrt.exe" [2007-04-03 1603152] "avgnt"="c:\program files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-07-19 266497] "WINDVDPatch"="CTHELPER.EXE" [2002-07-02 c:\windows\system32\CTHELPER.EXE] "nwiz"="nwiz.exe" [2008-05-16 c:\windows\system32\nwiz.exe] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-15 15360] c:\documents and settings\All Users\Menu Start\Programy\Autostart\ Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-02-13 83360] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "msacm.ctmp3"= c:\windows\system32\ctmp3.acm "vidc.DIVF"= DivX412.dll "vidc.vp31"= vp31vfw.dll "vidc.mjpg"= pvmjpg30.dll [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^LUMIX Simple Viewer.lnk] path=c:\documents and settings\All Users\Menu Start\Programy\Autostart\LUMIX Simple Viewer.lnk backup=c:\windows\pss\LUMIX Simple Viewer.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Comrade.exe] --a------ 2007-06-29 14:03 36864 c:\program files\GameSpy\Comrade\Comrade.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite] --a------ 2008-07-04 16:01 486856 c:\program files\DAEMON Tools Lite\daemon.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] --a------ 2008-05-27 09:50 413696 c:\program files\QuickTime\QTTask.exe [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\EA GAMES\\Battlefield 2\\BF2.exe"= "c:\\Program Files\\Red Orchestra\\steamapps\\ykes\\source sdk base\\hl2.exe"= "c:\\Program Files\\Hamachi\\hamachi.exe"= "c:\\Program Files\\THQ\\Company of Heroes\\RelicCOH.exe"= "c:\\Program Files\\Red Orchestra\\steamapps\\common\\red orchestra\\System\\RedOrchestra.exe"= "c:\\Program Files\\Warcraft III\\Warcraft III.exe"= "c:\\Program Files\\Warcraft III\\War3.exe"= "c:\\Program Files\\Electronic Arts\\Crytek\\Crysis\\Bin32\\Crysis.exe"= "c:\\Program Files\\Electronic Arts\\Crytek\\Crysis\\Bin32\\CrysisDedicatedServer.exe"= "c:\\WINDOWS\\system32\\PnkBstrA.exe"= "c:\\WINDOWS\\system32\\PnkBstrB.exe"= "c:\\Program Files\\Pinnacle\\VideoSpin\\Programs\\RM.exe"= "c:\\Program Files\\Pinnacle\\VideoSpin\\Programs\\PMSRegisterFile.exe"= "c:\\Program Files\\Pinnacle\\VideoSpin\\Programs\\umi.exe"= "c:\\Program Files\\Pinnacle\\VideoSpin\\Programs\\VideoSpin.exe"= "c:\\Program Files\\Doomsday\\Doomsday\\HoI2.exe"= "c:\\WINDOWS\\system32\\dplaysvr.exe"= "c:\\Program Files\\Paradox Interactive\\Europa Universalis III\\eu3game.exe"= "c:\\Program Files\\uTorrent\\uTorrent.exe"= "c:\\Documents and Settings\\user\\Pulpit\\Torrent\\utorrent.exe"= "c:\\Program Files\\Graphisoft\\ArchiCAD 12\\ArchiCAD.exe"= "c:\\Program Files\\Electronic Arts\\Dead Space\\Dead Space.exe"= "c:\\Program Files\\Activision\\Call of Duty - World at War Beta\\CoDWaWbeta.exe"= "c:\\Program Files\\Firefly Studios\\Stronghold Crusader\\Stronghold Crusader.exe"= "c:\\Program Files\\Paradox Entertainment\\Europa Universalis 2\\EU2.exe"= "c:\\Program Files\\NAMCO BANDAI Games\\Warhammer® Mark of Chaos\\Warhammer.exe"= "c:\\Program Files\\Firefly Studios\\Stronghold 2\\Stronghold2.exe"= R1 appdrv01;Application Driver (01);c:\windows\system32\Drivers\appdrv01.sys [2008-09-15 2915944] S2 appdrvrem01;Application Driver Auto Removal Service (01);c:\windows\System32\appdrvrem01.exe svc [] S3 VNUSB;VN Series Device;c:\windows\system32\DRIVERS\VNUSB.sys [2008-08-22 38496] . Zawartość folderu 'Zaplanowane zadania' 2008-11-28 c:\windows\Tasks\AppleSoftwareUpdate.job - c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-04-11 16:57] . . ------- Skan uzupełniający ------- . FireFox -: Profile - c:\documents and settings\user\Dane aplikacji\Mozilla\Firefox\Profiles\zud551rc.default\ FF -: plugin - c:\program files\Adobe\Acrobat 5.0\Reader\browser\nppdf32.dll FF -: plugin - c:\program files\Mozilla Firefox\plugins\npqtplugin8.dll FF -: plugin - c:\program files\QuickTime\Plugins\npqtplugin8.dll . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-12-03 12:47:33 Windows 5.1.2600 Dodatek Service Pack 3 NTFS skanowanie ukrytych procesów ... skanowanie ukrytych wpisów autostartu ... HKLM\Software\Microsoft\Windows\CurrentVersion\Run CTStartup = c:\program files\Creative\Splash Screen\CTEaxSpl.EXE /run???h??????s?????\?w? ?w???????w???w4???????.??w4???????4???TA?s4???8????&8?????\??? ??? ???\???\???????????5?7~e?7~\???\???????h?_??????C@?\???\??????s8???\??????s\????&8?A??s?&8??C@?x???`|?w\?????@ skanowanie ukrytych plików ... skanowanie pomyślnie ukończone ukryte pliki: 0 ************************************************************************** . Czas ukończenia: 2008-12-03 12:50:29 ComboFix-quarantined-files.txt 2008-12-03 11:50:27 ComboFix2.txt 2008-12-02 16:16:12 ComboFix3.txt 2008-07-16 15:49:49 Przed: 17 189 388 288 bajtów wolnych Po: 17,176,137,728 bajtów wolnych 235 --- E O F --- 2008-11-13 20:57:29

Hijack:

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 12:51:02, on 2008-12-03 Platform: Windows XP Dodatek SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe C:\Program Files\Portrait Displays\Pivot Software\wpctrl.exe C:\WINDOWS\system32\RUNDLL32.EXE C:\Program Files\Canon\MyPrinter\BJMyPrt.exe C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe C:\Program Files\Gadu-Gadu\gg.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe C:\Program Files\Portrait Displays\Pivot Software\floater.exe C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe C:\Program Files\Portrait Displays\HP My Display\DTHtml.exe C:\Program Files\Common Files\Portrait Displays\Shared\HookManager.exe C:\Program Files\a-squared Free\a2service.exe C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe C:\WINDOWS\system32\CTsvcCDA.exe C:\Program Files\Common Files\Portrait Displays\Shared\DTSRVC.exe C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\PnkBstrA.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\MsPMSPSv.exe C:\WINDOWS\system32\wuauclt.exe C:\WINDOWS\explorer.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://search.conduit.com?SearchSource=10&ctid=CT1098640 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza R3 - URLSearchHook: Winamp Search Class - {57BCA5FA-5DBB-45a2-B558-1755C3F6253B} - C:\Program Files\Winamp Toolbar\winamptb.dll R3 - URLSearchHook: free-downloads.net Toolbar - {ecdee021-0d17-467f-a1ff-c7a115230949} - C:\Program Files\free-downloads.net\tbfree.dll O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_6_2_0.dll O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx O2 - BHO: Winamp Toolbar Loader - {25CEE8EC-5730-41bc-8B58-22DDC8AB8C20} - C:\Program Files\Winamp Toolbar\winamptb.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O2 - BHO: free-downloads.net Toolbar - {ecdee021-0d17-467f-a1ff-c7a115230949} - C:\Program Files\free-downloads.net\tbfree.dll O3 - Toolbar: &Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_6_2_0.dll O3 - Toolbar: Winamp Toolbar - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - C:\Program Files\Winamp Toolbar\winamptb.dll O3 - Toolbar: free-downloads.net Toolbar - {ecdee021-0d17-467f-a1ff-c7a115230949} - C:\Program Files\free-downloads.net\tbfree.dll O4 - HKLM\..\Run: [CTStartup] C:\Program Files\Creative\Splash Screen\CTEaxSpl.EXE /run O4 - HKLM\..\Run: [WINDVDPatch] CTHELPER.EXE O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" O4 - HKLM\..\Run: [PivotSoftware] "C:\Program Files\Portrait Displays\Pivot Software\wpctrl.exe" O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe O4 - HKLM\..\Run: [Jet Detection] "C:\Program Files\Creative\SBLive\PROGRAM\ADGJDet.exe" O4 - HKLM\..\Run: [DT HPW] C:\Program Files\Common Files\Portrait Displays\Shared\DT_startup.exe -HPW O4 - HKLM\..\Run: [CanonSolutionMenu] C:\Program Files\Canon\SolutionMenu\CNSLMAIN.exe /logon O4 - HKLM\..\Run: [CanonMyPrinter] C:\Program Files\Canon\MyPrinter\BJMyPrt.exe /logon O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - C:\Program Files\a-squared Free\a2service.exe O23 - Service: Avira AntiVir Personal – Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe O23 - Service: Avira AntiVir Personal – Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe O23 - Service: Application Driver Auto Removal Service (01) (appdrvrem01) - Protection Technology - C:\WINDOWS\System32\appdrvrem01.exe O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe O23 - Service: Portrait Displays Display Tune Service (DTSRVC) - Unknown owner - C:\Program Files\Common Files\Portrait Displays\Shared\DTSRVC.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe O23 - Service: PIXMA Extended Survey Program (IJPLMSVC) - Unknown owner - C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: PACSPTISVR - Unknown owner - C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe -- End of file - 8111 bytes

**Posty:** 18165 · przez **wojtas** 03 Gru 2008, 17:16

odinstaluj w dodaj usun programy:

free-downloads.net

1. Ściągnij OTMoveIt i go włacz i odpal go z opcji CleanUp

oraz skasuj folder C:\Qoobox
2. wykonaj optymalizację windowsa
3.sciagnij ATF_Cleaner
zaznacz
Windows Temp
All users Temp
Temporary internet files
Recycle Bin
i wcisnij EMPTY SELECTED
4.Wyłącz przywracanie systemu ( właściwości mój komputer-zakładka przywracanie - wyłącz przywracanie na wszystkich dyskach). Po chwili włącz je powrotem
5.Przeskanuj obszar mojego komputera http://www.kaspersky.pl/virusscanner.html (uruchom przez IE) Daj raport z niego na forum.

i tym:

FixIEDef.