proszę o sprawdzenie loga

**Posty:** 4644 · przez **Wariat** 30 Sty 2007, 20:15

Witam...

Przy szukaniu linków złapałem jakiś syf

co chwila wykrywa mi nowy zainfekowany obiekt

kaspersky tego nie wytrzymał...

Kod: Zaznacz wszystko: Logfile of HijackThis v1.99.1 Scan saved at 19:06:04, on 2007-01-30 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\csrss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Internet Explorer\iexplore.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\kav.exe C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe C:\Program Files\Winamp\winampa.exe C:\WINDOWS\Samsung\ComSMMgr\ssmmgr.exe C:\WINDOWS\system32\kernels1118.exe C:\WINDOWS\system32\spoolsvv.exe C:\SpeedX.exe C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe C:\Program Files\Messenger\msmsgs.exe C:\Windows\xpupdate.exe C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe C:\WINDOWS\system32\maxd641.exe C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\kavsvc.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\wuauclt.exe C:\Documents and Settings\KROKU\Pulpit\hijackthis_199\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.onet.pl/ R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll O3 - Toolbar: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL O4 - HKLM\..\Run: [DU Meter] C:\Program Files\DU Meter\DUMeter.exe O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd O4 - HKLM\..\Run: [KAVPersonal50] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\kav.exe" /minimize O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe" O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe O4 - HKLM\..\Run: [Samsung Common SM] "C:\WINDOWS\Samsung\ComSMMgr\ssmmgr.exe" /autorun O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k O4 - HKLM\..\Run: [System] C:\WINDOWS\system32\kernels1118.exe O4 - HKLM\..\Run: [spoolsvv] C:\WINDOWS\system32\spoolsvv.exe O4 - HKLM\..\RunServices: [SystemTools] C:\WINDOWS\system32\kernels1118.exe O4 - HKCU\..\Run: [SpeedX] C:\SpeedX.exe O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" O4 - HKCU\..\Run: [µTorrent] "C:\Program Files\uTorrent\uTorrent.exe" O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [Windows update loader] C:\Windows\xpupdate.exe O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O20 - Winlogon Notify: winsys2freg - C:\Documents and Settings\All Users\Dokumenty\Settings\winsys2f.dll O21 - SSODL: DCOM Server 60787 - {2C1CD3D7-86AC-4068-93BC-A02304B60787} - C:\WINDOWS\system32\wqmzqv.dll O21 - SSODL: DCOM Server 37389 - {2C1CD3D7-86AC-4068-93BC-A02304B37389} - C:\WINDOWS\system32\ezhipxp.dll O23 - Service: kavsvc - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\kavsvc.exe O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe

**Posty:** 18165 · przez **wojtas** 30 Sty 2007, 20:19

usuwasz z wylaczonym przywracaniem systemu w awaryjnym

C:\WINDOWS\system32\maxd641.exe
O4 - HKLM\..\Run: [System] C:\WINDOWS\system32\kernels1118.exe
O4 - HKLM\..\Run: [spoolsvv] C:\WINDOWS\system32\spoolsvv.exe
O4 - HKLM\..\RunServices: [SystemTools] C:\WINDOWS\system32\kernels1118.exe
O4 - HKCU\..\Run: [Windows update loader] C:\Windows\xpupdate.exe
O20 - Winlogon Notify: winsys2freg - C:\Documents and Settings\All Users\Dokumenty\Settings\winsys2f.dll
O21 - SSODL: DCOM Server 60787 - {2C1CD3D7-86AC-4068-93BC-A02304B60787} - C:\WINDOWS\system32\wqmzqv.dll
O21 - SSODL: DCOM Server 37389 - {2C1CD3D7-86AC-4068-93BC-A02304B37389} - C:\WINDOWS\system32\ezhipxp.dll

najpierw wpiy potem pogrubione do kosza po zabiegach 2 nowe logi

Autor postu otrzymał pochwałę

**Posty:** 4644 · przez **Wariat** 30 Sty 2007, 20:59

dalej coś siedzi bo co chwila komp mi sie resetuje

Kod: Zaznacz wszystko: Logfile of HijackThis v1.99.1 Scan saved at 19:36:37, on 2007-01-30 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\csrss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Internet Explorer\iexplore.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\kav.exe C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe C:\Program Files\Winamp\winampa.exe C:\WINDOWS\Samsung\ComSMMgr\ssmmgr.exe C:\SpeedX.exe C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe C:\Program Files\Messenger\msmsgs.exe C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\kavsvc.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\wuauclt.exe C:\Documents and Settings\KROKU\Pulpit\hijackthis_199\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.onet.pl/ R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll O3 - Toolbar: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL O4 - HKLM\..\Run: [DU Meter] C:\Program Files\DU Meter\DUMeter.exe O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd O4 - HKLM\..\Run: [KAVPersonal50] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\kav.exe" /minimize O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe" O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe O4 - HKLM\..\Run: [Samsung Common SM] "C:\WINDOWS\Samsung\ComSMMgr\ssmmgr.exe" /autorun O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k O4 - HKCU\..\Run: [SpeedX] C:\SpeedX.exe O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" O4 - HKCU\..\Run: [µTorrent] "C:\Program Files\uTorrent\uTorrent.exe" O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [Windows update loader] C:\Windows\xpupdate.exe O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O20 - Winlogon Notify: winsys2freg - C:\Documents and Settings\All Users\Dokumenty\Settings\winsys2f.dll O23 - Service: kavsvc - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\kavsvc.exe O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe

Kod: Zaznacz wszystko: "Silent Runners.vbs", revision R50, http://www.silentrunners.org/ Operating System: Windows XP SP2 Output limited to non-default values, except where indicated by "{++}" Startup items buried in registry: --------------------------------- HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ "zbznjvvc" = ""C:\DOCUME~1\KROKU\USTAWI~1\Temp\zbznjvvc.exe " " [null data] HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ {++} "SpeedX" = "C:\SpeedX.exe" ["MyPortal.pl"] "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}" = ""C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"" ["Nero AG"] "µTorrent" = ""C:\Program Files\uTorrent\uTorrent.exe"" [null data] "MSMSGS" = ""C:\Program Files\Messenger\msmsgs.exe" /background" [MS] "Windows update loader" = "C:\Windows\xpupdate.exe" [file not found] HKLM\Software\Microsoft\Windows\CurrentVersion\Run\ {++} "DU Meter" = "C:\Program Files\DU Meter\DUMeter.exe" ["Hagel Technologies"] "Cmaudio" = "RunDll32 cmicnfg.cpl,CMICtrlWnd" [MS] "KAVPersonal50" = ""C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\kav.exe" /minimize" ["Kaspersky Lab"] "SunJavaUpdateSched" = ""C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe"" ["Sun Microsystems, Inc."] "WinampAgent" = "C:\Program Files\Winamp\winampa.exe" [null data] "NeroFilterCheck" = "C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" ["Nero AG"] "Samsung Common SM" = ""C:\WINDOWS\Samsung\ComSMMgr\ssmmgr.exe" /autorun" ["Samsung Electronics."] "KernelFaultCheck" = "C:\WINDOWS\system32\dumprep 0 -k" HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C}\(Default) = (no title provided) -> {HKLM...CLSID} = "Megaupload Toolbar" \InProcServer32\(Default) = "C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL" ["MegaUpload"] {761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\(Default) = (no title provided) -> {HKLM...CLSID} = "SSVHelper Class" \InProcServer32\(Default) = "C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll" ["Sun Microsystems, Inc."] HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\ "{42071714-76d4-11d1-8b24-00a0c9068ff3}" = "Rozszerzenie CPL kadrowania wyświetlania" -> {HKLM...CLSID} = "Rozszerzenie CPL kadrowania wyświetlania" \InProcServer32\(Default) = "deskpan.dll" [file not found] "{88895560-9AA2-1069-930E-00AA0030EBC8}" = "Rozszerzenie ikony HyperTerminalu" -> {HKLM...CLSID} = "HyperTerminal Icon Ext" \InProcServer32\(Default) = "C:\WINDOWS\system32\hticons.dll" ["Hilgraeve, Inc."] "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" = "WinRAR shell extension" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] "{F0CB00CD-5A07-4D91-97F5-A8C92CDA93E4}" = "Shell Extensions for RealOne Player" -> {HKLM...CLSID} = "RealOne Player Context Menu Class" \InProcServer32\(Default) = "C:\Program Files\Real\RealPlayer\rpshell.dll" ["RealNetworks, Inc."] "{23170F69-40C1-278A-1000-000100020000}" = "7-Zip Shell Extension" -> {HKLM...CLSID} = "7-Zip Shell Extension" \InProcServer32\(Default) = "C:\Program Files\7-Zip\7-zip.dll" ["Igor Pavlov"] HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ <<!>> winsys2freg\DLLName = "C:\Documents and Settings\All Users\Dokumenty\Settings\winsys2f.dll" [null data] HKLM\Software\Classes\*\shellex\ContextMenuHandlers\ 7-Zip\(Default) = "{23170F69-40C1-278A-1000-000100020000}" -> {HKLM...CLSID} = "7-Zip Shell Extension" \InProcServer32\(Default) = "C:\Program Files\7-Zip\7-zip.dll" ["Igor Pavlov"] Kaspersky Anti-Virus\(Default) = "{dd230880-495a-11d1-b064-008048ec2fc5}" -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\shellex.dll" ["Kaspersky Lab"] WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\ 7-Zip\(Default) = "{23170F69-40C1-278A-1000-000100020000}" -> {HKLM...CLSID} = "7-Zip Shell Extension" \InProcServer32\(Default) = "C:\Program Files\7-Zip\7-zip.dll" ["Igor Pavlov"] WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\ Kaspersky Anti-Virus\(Default) = "{dd230880-495a-11d1-b064-008048ec2fc5}" -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\shellex.dll" ["Kaspersky Lab"] WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] Group Policies {GPedit.msc branch and setting}: ----------------------------------------------- Note: detected settings may not have any effect. HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\ "NoActiveDesktop" = (REG_DWORD) hex:0x00000000 {User Configuration|Administrative Templates|Desktop|Desktop / Active Desktop| Disable Active Desktop} "ClassicShell" = (REG_DWORD) hex:0x00000000 {User Configuration|Administrative Templates|Windows Components|Windows Explorer| Enable Classic Shell / Turn on Classic Shell} "ForceActiveDesktopOn" = (REG_DWORD) hex:0x00000001 {User Configuration|Administrative Templates|Desktop|Desktop / Active Desktop| Enable Active Desktop} HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System\ "DisableTaskMgr" = (REG_DWORD) hex:0x00000001 {User Configuration|Administrative Templates|System|Ctrl+Alt+Del Options| Remove Task Manager} "Wallpaper" = (REG_SZ) C:\WINDOWS\desktop.html {User Configuration|Administrative Templates|Desktop|Desktop / Active Desktop| Active Desktop Wallpaper|Wallpaper Name:} HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\ "shutdownwithoutlogon" = (REG_DWORD) hex:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| Shutdown: Allow system to be shut down without having to log on} "undockwithoutlogon" = (REG_DWORD) hex:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| Devices: Allow undock without having to log on} Active Desktop and Wallpaper: ----------------------------- Active Desktop may be disabled at this entry: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState Displayed if Active Desktop enabled and wallpaper not set by Group Policy: HKCU\Software\Microsoft\Internet Explorer\Desktop\General\ "Wallpaper" = "C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp" Displayed if Active Desktop disabled and wallpaper not set by Group Policy: HKCU\Control Panel\Desktop\ "Wallpaper" = "C:\Documents and Settings\KROKU\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp" Enabled Screen Saver: --------------------- HKCU\Control Panel\Desktop\ "SCRNSAVE.EXE" = "C:\WINDOWS\System32\logon.scr" [MS] Winsock2 Service Provider DLLs: ------------------------------- Namespace Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++} 000000000001\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS] 000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS] 000000000003\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS] Transport Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++} 0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range: %SystemRoot%\system32\mswsock.dll [MS], 01 - 04, 07 - 14 %SystemRoot%\system32\rsvpsp.dll [MS], 05 - 06 Toolbars, Explorer Bars, Extensions: ------------------------------------ Toolbars HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\ "{4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C}" -> {HKLM...CLSID} = "Megaupload Toolbar" \InProcServer32\(Default) = "C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL" ["MegaUpload"] HKLM\Software\Microsoft\Internet Explorer\Toolbar\ "{4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C}" = (no title provided) -> {HKLM...CLSID} = "Megaupload Toolbar" \InProcServer32\(Default) = "C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL" ["MegaUpload"] Extensions (Tools menu items, main toolbar menu buttons) HKLM\Software\Microsoft\Internet Explorer\Extensions\ {08B0E5C0-4FCB-11CF-AAA5-00401C608501}\ "MenuText" = "Sun Java Console" "CLSIDExtension" = "{CAFEEFAC-0015-0000-0010-ABCDEFFEDCBC}" -> {HKCU...CLSID} = "Java Plug-in 1.5.0_10" \InProcServer32\(Default) = "C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll" ["Sun Microsystems, Inc."] -> {HKLM...CLSID} = "Java Plug-in 1.5.0_10" \InProcServer32\(Default) = "C:\Program Files\Java\jre1.5.0_10\bin\npjpi150_10.dll" ["Sun Microsystems, Inc."] {FB5F1910-F110-11D2-BB9E-00C04F795683}\ "ButtonText" = "Messenger" "MenuText" = "Windows Messenger" "Exec" = "C:\Program Files\Messenger\msmsgs.exe" [MS] Running Services (Display Name, Service Name, Path {Service DLL}): ------------------------------------------------------------------ kavsvc, kavsvc, ""C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\kavsvc.exe"" ["Kaspersky Lab"] Print Monitors: --------------- HKLM\System\CurrentControlSet\Control\Print\Monitors\ SUGS2 Langmon\Driver = "SUGS2LMK.DLL" ["Samsung Electronics."] ---------- <<!>>: Suspicious data at a malware launch point. + This report excludes default entries except where indicated. + To see *everywhere* the script checks and *everything* it finds, launch it from a command prompt or a shortcut with the -all parameter. + To search all directories of local fixed drives for DESKTOP.INI DLL launch points, use the -supp parameter or answer "No" at the first message box and "Yes" at the second message box. ---------- (total run time: 99 seconds, including 4 seconds for message boxes)

**Posty:** 18165 · przez **wojtas** 30 Sty 2007, 21:03

skasuj:

O20 - Winlogon Notify: winsys2freg - C:\Documents and Settings\All Users\Dokumenty\Settings\winsys2f.dll
O4 - HKCU\..\Run: [Windows update loader] C:\Windows\xpupdate.exe

potem
sciagnij killbox`a:
http://www.wiruskill.pl/forum/viewtopic.php?t=58

Odpalasz Killboxa zaznacz opcję Delete on Reboot następnie w polu Full Path of File to Delete wklej ścieżkę :

C:\Windows\xpupdate.exe

i nacisnij x
Program będzie pytał o restart (oczywiście zgadzasz się)

potem to samo robisz z :

C:\Documents and Settings\All Users\Dokumenty\Settings\winsys2f.dll

potem 2 logi :wink:

**Posty:** 4644 · przez **Wariat** 30 Sty 2007, 22:59

dalej nic

Kod: Zaznacz wszystko: Logfile of HijackThis v1.99.1 Scan saved at 21:40:34, on 2007-01-30 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\csrss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\kav.exe C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe C:\Program Files\Winamp\winampa.exe C:\WINDOWS\Samsung\ComSMMgr\ssmmgr.exe C:\SpeedX.exe C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe C:\Program Files\Messenger\msmsgs.exe C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\kavsvc.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\services.exe C:\Documents and Settings\KROKU\Pulpit\hijackthis_199\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.onet.pl/ R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll O3 - Toolbar: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL O4 - HKLM\..\Run: [DU Meter] C:\Program Files\DU Meter\DUMeter.exe O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd O4 - HKLM\..\Run: [KAVPersonal50] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\kav.exe" /minimize O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe" O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe O4 - HKLM\..\Run: [Samsung Common SM] "C:\WINDOWS\Samsung\ComSMMgr\ssmmgr.exe" /autorun O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k O4 - HKCU\..\Run: [SpeedX] C:\SpeedX.exe O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" O4 - HKCU\..\Run: [µTorrent] "C:\Program Files\uTorrent\uTorrent.exe" O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [Windows update loader] C:\Windows\xpupdate.exe O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O20 - Winlogon Notify: winsys2freg - C:\Documents and Settings\All Users\Dokumenty\Settings\winsys2f.dll (file missing) O23 - Service: kavsvc - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\kavsvc.exe O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe

Kod: Zaznacz wszystko: "Silent Runners.vbs", revision R50, http://www.silentrunners.org/ Operating System: Windows XP SP2 Output limited to non-default values, except where indicated by "{++}" Startup items buried in registry: --------------------------------- HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ "zbznjvvc" = ""C:\DOCUME~1\KROKU\USTAWI~1\Temp\zbznjvvc.exe " " [null data] HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ {++} "SpeedX" = "C:\SpeedX.exe" ["MyPortal.pl"] "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}" = ""C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"" ["Nero AG"] "µTorrent" = ""C:\Program Files\uTorrent\uTorrent.exe"" [null data] "MSMSGS" = ""C:\Program Files\Messenger\msmsgs.exe" /background" [MS] "Windows update loader" = "C:\Windows\xpupdate.exe" [file not found] HKLM\Software\Microsoft\Windows\CurrentVersion\Run\ {++} "DU Meter" = "C:\Program Files\DU Meter\DUMeter.exe" ["Hagel Technologies"] "Cmaudio" = "RunDll32 cmicnfg.cpl,CMICtrlWnd" [MS] "KAVPersonal50" = ""C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\kav.exe" /minimize" ["Kaspersky Lab"] "SunJavaUpdateSched" = ""C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe"" ["Sun Microsystems, Inc."] "WinampAgent" = "C:\Program Files\Winamp\winampa.exe" [null data] "NeroFilterCheck" = "C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" ["Nero AG"] "Samsung Common SM" = ""C:\WINDOWS\Samsung\ComSMMgr\ssmmgr.exe" /autorun" ["Samsung Electronics."] "KernelFaultCheck" = "C:\WINDOWS\system32\dumprep 0 -k" HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C}\(Default) = (no title provided) -> {HKLM...CLSID} = "Megaupload Toolbar" \InProcServer32\(Default) = "C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL" ["MegaUpload"] {761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\(Default) = (no title provided) -> {HKLM...CLSID} = "SSVHelper Class" \InProcServer32\(Default) = "C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll" ["Sun Microsystems, Inc."] HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\ "{42071714-76d4-11d1-8b24-00a0c9068ff3}" = "Rozszerzenie CPL kadrowania wyświetlania" -> {HKLM...CLSID} = "Rozszerzenie CPL kadrowania wyświetlania" \InProcServer32\(Default) = "deskpan.dll" [file not found] "{88895560-9AA2-1069-930E-00AA0030EBC8}" = "Rozszerzenie ikony HyperTerminalu" -> {HKLM...CLSID} = "HyperTerminal Icon Ext" \InProcServer32\(Default) = "C:\WINDOWS\system32\hticons.dll" ["Hilgraeve, Inc."] "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" = "WinRAR shell extension" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] "{F0CB00CD-5A07-4D91-97F5-A8C92CDA93E4}" = "Shell Extensions for RealOne Player" -> {HKLM...CLSID} = "RealOne Player Context Menu Class" \InProcServer32\(Default) = "C:\Program Files\Real\RealPlayer\rpshell.dll" ["RealNetworks, Inc."] "{23170F69-40C1-278A-1000-000100020000}" = "7-Zip Shell Extension" -> {HKLM...CLSID} = "7-Zip Shell Extension" \InProcServer32\(Default) = "C:\Program Files\7-Zip\7-zip.dll" ["Igor Pavlov"] HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ <<!>> winsys2freg\DLLName = "C:\Documents and Settings\All Users\Dokumenty\Settings\winsys2f.dll" [file not found] HKLM\Software\Classes\*\shellex\ContextMenuHandlers\ 7-Zip\(Default) = "{23170F69-40C1-278A-1000-000100020000}" -> {HKLM...CLSID} = "7-Zip Shell Extension" \InProcServer32\(Default) = "C:\Program Files\7-Zip\7-zip.dll" ["Igor Pavlov"] Kaspersky Anti-Virus\(Default) = "{dd230880-495a-11d1-b064-008048ec2fc5}" -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\shellex.dll" ["Kaspersky Lab"] WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\ 7-Zip\(Default) = "{23170F69-40C1-278A-1000-000100020000}" -> {HKLM...CLSID} = "7-Zip Shell Extension" \InProcServer32\(Default) = "C:\Program Files\7-Zip\7-zip.dll" ["Igor Pavlov"] WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\ Kaspersky Anti-Virus\(Default) = "{dd230880-495a-11d1-b064-008048ec2fc5}" -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\shellex.dll" ["Kaspersky Lab"] WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] Group Policies {GPedit.msc branch and setting}: ----------------------------------------------- Note: detected settings may not have any effect. HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\ "NoActiveDesktop" = (REG_DWORD) hex:0x00000000 {User Configuration|Administrative Templates|Desktop|Desktop / Active Desktop| Disable Active Desktop} "ClassicShell" = (REG_DWORD) hex:0x00000000 {User Configuration|Administrative Templates|Windows Components|Windows Explorer| Enable Classic Shell / Turn on Classic Shell} "ForceActiveDesktopOn" = (REG_DWORD) hex:0x00000001 {User Configuration|Administrative Templates|Desktop|Desktop / Active Desktop| Enable Active Desktop} HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System\ "DisableTaskMgr" = (REG_DWORD) hex:0x00000001 {User Configuration|Administrative Templates|System|Ctrl+Alt+Del Options| Remove Task Manager} "Wallpaper" = (REG_SZ) C:\WINDOWS\desktop.html {User Configuration|Administrative Templates|Desktop|Desktop / Active Desktop| Active Desktop Wallpaper|Wallpaper Name:} HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\ "shutdownwithoutlogon" = (REG_DWORD) hex:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| Shutdown: Allow system to be shut down without having to log on} "undockwithoutlogon" = (REG_DWORD) hex:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| Devices: Allow undock without having to log on} Active Desktop and Wallpaper: ----------------------------- Active Desktop may be disabled at this entry: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState Displayed if Active Desktop enabled and wallpaper not set by Group Policy: HKCU\Software\Microsoft\Internet Explorer\Desktop\General\ "Wallpaper" = "C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp" Displayed if Active Desktop disabled and wallpaper not set by Group Policy: HKCU\Control Panel\Desktop\ "Wallpaper" = "C:\Documents and Settings\KROKU\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp" Enabled Screen Saver: --------------------- HKCU\Control Panel\Desktop\ "SCRNSAVE.EXE" = "C:\WINDOWS\System32\logon.scr" [MS] Winsock2 Service Provider DLLs: ------------------------------- Namespace Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++} 000000000001\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS] 000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS] 000000000003\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS] Transport Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++} 0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range: %SystemRoot%\system32\mswsock.dll [MS], 01 - 04, 07 - 14 %SystemRoot%\system32\rsvpsp.dll [MS], 05 - 06 Toolbars, Explorer Bars, Extensions: ------------------------------------ Toolbars HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\ "{4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C}" -> {HKLM...CLSID} = "Megaupload Toolbar" \InProcServer32\(Default) = "C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL" ["MegaUpload"] HKLM\Software\Microsoft\Internet Explorer\Toolbar\ "{4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C}" = (no title provided) -> {HKLM...CLSID} = "Megaupload Toolbar" \InProcServer32\(Default) = "C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL" ["MegaUpload"] Extensions (Tools menu items, main toolbar menu buttons) HKLM\Software\Microsoft\Internet Explorer\Extensions\ {08B0E5C0-4FCB-11CF-AAA5-00401C608501}\ "MenuText" = "Sun Java Console" "CLSIDExtension" = "{CAFEEFAC-0015-0000-0010-ABCDEFFEDCBC}" -> {HKCU...CLSID} = "Java Plug-in 1.5.0_10" \InProcServer32\(Default) = "C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll" ["Sun Microsystems, Inc."] -> {HKLM...CLSID} = "Java Plug-in 1.5.0_10" \InProcServer32\(Default) = "C:\Program Files\Java\jre1.5.0_10\bin\npjpi150_10.dll" ["Sun Microsystems, Inc."] {FB5F1910-F110-11D2-BB9E-00C04F795683}\ "ButtonText" = "Messenger" "MenuText" = "Windows Messenger" "Exec" = "C:\Program Files\Messenger\msmsgs.exe" [MS] Running Services (Display Name, Service Name, Path {Service DLL}): ------------------------------------------------------------------ kavsvc, kavsvc, ""C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\kavsvc.exe"" ["Kaspersky Lab"] Print Monitors: --------------- HKLM\System\CurrentControlSet\Control\Print\Monitors\ SUGS2 Langmon\Driver = "SUGS2LMK.DLL" ["Samsung Electronics."] ---------- <<!>>: Suspicious data at a malware launch point. + This report excludes default entries except where indicated. + To see *everywhere* the script checks and *everything* it finds, launch it from a command prompt or a shortcut with the -all parameter. + To search all directories of local fixed drives for DESKTOP.INI DLL launch points, use the -supp parameter or answer "No" at the first message box and "Yes" at the second message box. ---------- (total run time: 78 seconds, including 2 seconds for message boxes)

C:\Documents and Settings\All Users\Dokumenty\Settings\winsys2f.dll

nie mam takiego pliku :idea:

nawet folderu Dokumenty nie mam

**Posty:** 1134 · przez **MISTEJK** 30 Sty 2007, 23:25

Użyj WWDC :
http://www.firewallleaktester.com/wwdc.htm
Zmień opcje z disable na enable. Uruchom ponownie komputer.
Tak powinny wyglądać porty (NetBIOS może być żółty) :
http://www.firewallleaktester.com/images_site/wwdc.jpg

Pobierz i uruchom narzędzie : The Avenger
Zaznacz opcję Input script manually i kliknij na Lupkę z prawej strony. W okienku, które się otworzy wklejasz:

Files to delete:

C:\Windows\xpupdate.exe
C:\Documents and Settings\All Users\Dokumenty\Settings\winsys2f.dll
C:\DOCUME~1\KROKU\USTAWI~1\Temp\zbznjvvc.exe

Klikasz Done, a następnie zielone światełko i zgadzasz się na restart klikając OK.
Po restarcie w HijackThis usuwasz wpis/wpisy:

O4 - HKCU\..\Run: [Windows update loader] C:\Windows\xpupdate.exe
O20 - Winlogon Notify: winsys2freg - C:\Documents and Settings\All Users\Dokumenty\Settings\winsys2f.dll (file missing)

Otwórz Notatnik i wklej w nim to:

Windows Registry Editor Version 5.00

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run]
"zbznjvvc"=-

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Windows update loader"=-

Plik >>> Zapisz jako >>> Zmień rozszerzenie z TXT na Wszystkie pliki >>> Zapisz pod nazwą FIX.REG i uruchom go w trybie awaryjnym.

Kasujesz ręcznie z dysku plik: C:\Avenger\backup.zip i wklejasz na forum raport: C:\avenger.txt + log z HijackThis + log z Silent Runners.

Po akcji nowe logi...

Autor postu otrzymał pochwałę

**Posty:** 4644 · przez **Wariat** 31 Sty 2007, 01:02

zrobiłem tak jak kazał anders na gg i zamieszczam nowe logi

Kod: Zaznacz wszystko: Logfile of HijackThis v1.99.1 Scan saved at 22:57:28, on 2007-01-30 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\savedump.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\kav.exe C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe C:\Program Files\Winamp\winampa.exe C:\WINDOWS\Samsung\ComSMMgr\ssmmgr.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe C:\SpeedX.exe C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe C:\Program Files\Messenger\msmsgs.exe C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\kavsvc.exe C:\WINDOWS\system32\svchost.exe C:\Documents and Settings\KROKU\Pulpit\hijackthis_199\HijackThis.exe C:\WINDOWS\system32\imapi.exe C:\WINDOWS\TEMP\wuauclt.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.onet.pl/ R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll O3 - Toolbar: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL O4 - HKLM\..\Run: [DU Meter] C:\Program Files\DU Meter\DUMeter.exe O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd O4 - HKLM\..\Run: [KAVPersonal50] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\kav.exe" /minimize O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe" O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe O4 - HKLM\..\Run: [Samsung Common SM] "C:\WINDOWS\Samsung\ComSMMgr\ssmmgr.exe" /autorun O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized O4 - HKCU\..\Run: [SpeedX] C:\SpeedX.exe O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" O4 - HKCU\..\Run: [µTorrent] "C:\Program Files\uTorrent\uTorrent.exe" O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [Windows update loader] C:\Windows\xpupdate.exe O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O20 - Winlogon Notify: winsys2freg - C:\Documents and Settings\All Users\Dokumenty\Settings\winsys2f.dll (file missing) O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe O23 - Service: kavsvc - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\kavsvc.exe O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe

Kod: Zaznacz wszystko: "Silent Runners.vbs", revision R50, http://www.silentrunners.org/ Operating System: Windows XP SP2 Output limited to non-default values, except where indicated by "{++}" Startup items buried in registry: --------------------------------- HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ {++} "CTFMON.EXE" = "C:\WINDOWS\system32\CTFMON.EXE" [MS] HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce\ {++} "NeroHomeFirstStart" = "C:\Program Files\Common Files\Ahead\Lib\NMFirstStart.exe" ["Nero AG"] HKLM\Software\Microsoft\Windows\CurrentVersion\Run\ {++} "DU Meter" = "C:\Program Files\DU Meter\DUMeter.exe" ["Hagel Technologies"] "Cmaudio" = "RunDll32 cmicnfg.cpl,CMICtrlWnd" [MS] "KAVPersonal50" = ""C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\kav.exe" /minimize" ["Kaspersky Lab"] "SunJavaUpdateSched" = ""C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe"" ["Sun Microsystems, Inc."] "WinampAgent" = "C:\Program Files\Winamp\winampa.exe" [null data] "NeroFilterCheck" = "C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" ["Nero AG"] "Samsung Common SM" = ""C:\WINDOWS\Samsung\ComSMMgr\ssmmgr.exe" /autorun" ["Samsung Electronics."] "KernelFaultCheck" = "C:\WINDOWS\system32\dumprep 0 -k" "!AVG Anti-Spyware" = ""C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized" ["Anti-Malware Development a.s."] HKLM\Software\Microsoft\Active Setup\Installed Components\ >{26923b43-4d38-484f-9b9e-de460746276c}\(Default) = "Internet Explorer" \StubPath = "C:\WINDOWS\system32\shmgrate.exe OCInstallUserConfigIE" [MS] >{60B49E34-C7CC-11D0-8953-00A0C90347FF}MICROS\(Default) = "Dostosowywanie przeglądarki" \StubPath = "RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP" [MS] >{881dd1c5-3dcf-431b-b061-f3f88e8be88a}\(Default) = "Outlook Express" \StubPath = "C:\WINDOWS\system32\shmgrate.exe OCInstallUserConfigOE" [MS] {2C7339CF-2B09-4501-B3F3-F3508C9228ED}\(Default) = "Themes Setup" \StubPath = "C:\WINDOWS\system32\regsvr32.exe /s /n /i:/UserInstall C:\WINDOWS\system32\themeui.dll" [MS] {44BBA840-CC51-11CF-AAFA-00AA00B6015C}\(Default) = "Microsoft Outlook Express 6" \StubPath = ""C:\Program Files\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install" [MS] {5945c046-1e7d-11d1-bc44-00c04fd912be}\(Default) = "Windows Messenger 4.7" \StubPath = "rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msmsgs.inf,BLC.QuietInstall.PerUser" [MS] {7790769C-0471-11d2-AF11-00C04FA35D02}\(Default) = "Książka adresowa 6" \StubPath = ""C:\Program Files\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install" [MS] {89820200-ECBD-11cf-8B85-00AA005B4340}\(Default) = "Aktualizacja pulpitu Windows" \StubPath = "regsvr32.exe /s /n /i:U shell32.dll" [MS] {89820200-ECBD-11cf-8B85-00AA005B4383}\(Default) = "Internet Explorer 6" \StubPath = "C:\WINDOWS\system32\ie4uinit.exe" [MS] HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C}\(Default) = (no title provided) -> {HKLM...CLSID} = "Megaupload Toolbar" \InProcServer32\(Default) = "C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL" ["MegaUpload"] {761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\(Default) = (no title provided) -> {HKLM...CLSID} = "SSVHelper Class" \InProcServer32\(Default) = "C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll" ["Sun Microsystems, Inc."] HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\ "{42071714-76d4-11d1-8b24-00a0c9068ff3}" = "Rozszerzenie CPL kadrowania wyświetlania" -> {HKLM...CLSID} = "Rozszerzenie CPL kadrowania wyświetlania" \InProcServer32\(Default) = "deskpan.dll" [file not found] "{88895560-9AA2-1069-930E-00AA0030EBC8}" = "Rozszerzenie ikony HyperTerminalu" -> {HKLM...CLSID} = "HyperTerminal Icon Ext" \InProcServer32\(Default) = "C:\WINDOWS\system32\hticons.dll" ["Hilgraeve, Inc."] "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" = "WinRAR shell extension" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] "{F0CB00CD-5A07-4D91-97F5-A8C92CDA93E4}" = "Shell Extensions for RealOne Player" -> {HKLM...CLSID} = "RealOne Player Context Menu Class" \InProcServer32\(Default) = "C:\Program Files\Real\RealPlayer\rpshell.dll" ["RealNetworks, Inc."] "{23170F69-40C1-278A-1000-000100020000}" = "7-Zip Shell Extension" -> {HKLM...CLSID} = "7-Zip Shell Extension" \InProcServer32\(Default) = "C:\Program Files\7-Zip\7-zip.dll" ["Igor Pavlov"] HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\ <<!>> "{57B86673-276A-48B2-BAE7-C6DBB3020EB8}" = "AVG Anti-Spyware 7.5" -> {HKLM...CLSID} = "CShellExecuteHookImpl Object" \InProcServer32\(Default) = "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\shellexecutehook.dll" ["Anti-Malware Development a.s."] HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ <<!>> winsys2freg\DLLName = "C:\Documents and Settings\All Users\Dokumenty\Settings\winsys2f.dll" [file not found] HKLM\Software\Classes\*\shellex\ContextMenuHandlers\ 7-Zip\(Default) = "{23170F69-40C1-278A-1000-000100020000}" -> {HKLM...CLSID} = "7-Zip Shell Extension" \InProcServer32\(Default) = "C:\Program Files\7-Zip\7-zip.dll" ["Igor Pavlov"] AVG Anti-Spyware\(Default) = "{8934FCEF-F5B8-468f-951F-78A921CD3920}" -> {HKLM...CLSID} = "CContextScan Object" \InProcServer32\(Default) = "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\context.dll" ["Anti-Malware Development a.s."] Kaspersky Anti-Virus\(Default) = "{dd230880-495a-11d1-b064-008048ec2fc5}" -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\shellex.dll" ["Kaspersky Lab"] WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\ 7-Zip\(Default) = "{23170F69-40C1-278A-1000-000100020000}" -> {HKLM...CLSID} = "7-Zip Shell Extension" \InProcServer32\(Default) = "C:\Program Files\7-Zip\7-zip.dll" ["Igor Pavlov"] AVG Anti-Spyware\(Default) = "{8934FCEF-F5B8-468f-951F-78A921CD3920}" -> {HKLM...CLSID} = "CContextScan Object" \InProcServer32\(Default) = "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\context.dll" ["Anti-Malware Development a.s."] WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\ Kaspersky Anti-Virus\(Default) = "{dd230880-495a-11d1-b064-008048ec2fc5}" -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\shellex.dll" ["Kaspersky Lab"] WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] Group Policies {GPedit.msc branch and setting}: ----------------------------------------------- Note: detected settings may not have any effect. HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System\ "DisableRegistryTools" = (REG_DWORD) hex:0x00000000 {User Configuration|Administrative Templates|System| Prevent access to registry editing tools} HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\ "shutdownwithoutlogon" = (REG_DWORD) hex:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| Shutdown: Allow system to be shut down without having to log on} "undockwithoutlogon" = (REG_DWORD) hex:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| Devices: Allow undock without having to log on} Active Desktop and Wallpaper: ----------------------------- Active Desktop may be disabled at this entry: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState Displayed if Active Desktop disabled and wallpaper not set by Group Policy: HKCU\Control Panel\Desktop\ "Wallpaper" = "(Brak)" Enabled Screen Saver: --------------------- HKCU\Control Panel\Desktop\ "SCRNSAVE.EXE" = "%SystemRoot%\System32\logon.scr" [MS] Winsock2 Service Provider DLLs: ------------------------------- Namespace Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++} 000000000001\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS] 000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS] 000000000003\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS] Transport Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++} 0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range: %SystemRoot%\system32\mswsock.dll [MS], 01 - 04, 07 - 14 %SystemRoot%\system32\rsvpsp.dll [MS], 05 - 06 Toolbars, Explorer Bars, Extensions: ------------------------------------ Toolbars HKLM\Software\Microsoft\Internet Explorer\Toolbar\ "{4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C}" = (no title provided) -> {HKLM...CLSID} = "Megaupload Toolbar" \InProcServer32\(Default) = "C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL" ["MegaUpload"] Extensions (Tools menu items, main toolbar menu buttons) HKLM\Software\Microsoft\Internet Explorer\Extensions\ {08B0E5C0-4FCB-11CF-AAA5-00401C608501}\ "MenuText" = "Sun Java Console" "CLSIDExtension" = "{CAFEEFAC-0015-0000-0010-ABCDEFFEDCBC}" -> {HKLM...CLSID} = "Java Plug-in 1.5.0_10" \InProcServer32\(Default) = "C:\Program Files\Java\jre1.5.0_10\bin\npjpi150_10.dll" ["Sun Microsystems, Inc."] {FB5F1910-F110-11D2-BB9E-00C04F795683}\ "ButtonText" = "Messenger" "MenuText" = "Windows Messenger" "Exec" = "C:\Program Files\Messenger\msmsgs.exe" [MS] All Non-Disabled Services (Display Name, Service Name, Path {Service DLL}): --------------------------------------------------------------------------- AVG Anti-Spyware Guard, AVG Anti-Spyware Guard, "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe" ["Anti-Malware Development a.s."] Karta wydajności WMI, WmiApSrv, "C:\WINDOWS\system32\wbem\wmiapsrv.exe" [MS] kavsvc, kavsvc, ""C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\kavsvc.exe"" ["Kaspersky Lab"] NBService, NBService, "C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe" ["Nero AG"] Usługa administracyjna Menedżera dysków logicznych, dmadmin, "C:\WINDOWS\System32\dmadmin.exe /com" ["Microsoft Corp., Veritas Software"] Usługa dostarczania sieci, xmlprov, "C:\WINDOWS\System32\svchost.exe -k netsvcs" {"C:\WINDOWS\System32\xmlprov.dll" [MS]} Usługa numeru seryjnego multimediów przenośnych, WmdmPmSN, "C:\WINDOWS\System32\svchost.exe -k netsvcs" {"C:\WINDOWS\system32\mspmsnsv.dll" [MS]} Print Monitors: --------------- HKLM\System\CurrentControlSet\Control\Print\Monitors\ SUGS2 Langmon\Driver = "SUGS2LMK.DLL" ["Samsung Electronics."] ---------- <<!>>: Suspicious data at a malware launch point. + This report excludes default entries except where indicated. + To see *everywhere* the script checks and *everything* it finds, launch it from a command prompt or a shortcut with the -all parameter. + To search all directories of local fixed drives for DESKTOP.INI DLL launch points, use the -supp parameter or answer "No" at the first message box and "Yes" at the second message box. ---------- (total run time: 83 seconds, including 2 seconds for message boxes)

doszła nowość... przy włanczaniu kompa wyskakuje coś takiego

failed to boot several times before. Enter SETUP to recofigure your system... load default and continue to boot after i odliczanie

**Posty:** 18165 · przez **wojtas** 31 Sty 2007, 16:15

pokaz log z Avengera

skasuj:

O20 - Winlogon Notify: winsys2freg - C:\Documents and Settings\All Users\Dokumenty\Settings\winsys2f.dll (file missing)
O4 - HKCU\..\Run: [Windows update loader] C:\Windows\xpupdate.exe

**Posty:** 1134 · przez **MISTEJK** 31 Sty 2007, 17:35

Wariat napisał(a):zrobiłem tak jak kazał anders na gg i zamieszczam nowe logi

co to ma znaczyć ?

wojtas19162 napisał(a):pokaz log z Avengera

Zrób to co napisałem ....

++++++

Użyj WWDC :
http://www.firewallleaktester.com/wwdc.htm
Zmień opcje z disable na enable. Uruchom ponownie komputer.
Tak powinny wyglądać porty (NetBIOS może być żółty) :
http://www.firewallleaktester.com/images_site/wwdc.jpg

Autor postu otrzymał pochwałę

**Posty:** 4644 · przez **Wariat** 31 Sty 2007, 19:57

zrobiłem tak jak pisaliście i dalej siedzi

Kod: Zaznacz wszystko: Logfile of The Avenger version 1, by Swandog46 Running from registry key: \Registry\Machine\System\CurrentControlSet\Services\dxovdflk ******************* Script file located at: \??\C:\WINDOWS\system32\ddtenxls.txt Script file opened successfully. Script file read successfully Backups directory opened successfully at C:\Avenger ******************* Beginning to process script file: File C:\Windows\xpupdate.exe not found! Deletion of file C:\Windows\xpupdate.exe failed! Could not process line: C:\Windows\xpupdate.exe Status: 0xc0000034 File C:\Documents and Settings\All Users\Dokumenty\Settings\winsys2f.dll not found! Deletion of file C:\Documents and Settings\All Users\Dokumenty\Settings\winsys2f.dll failed! Could not process line: C:\Documents and Settings\All Users\Dokumenty\Settings\winsys2f.dll Status: 0xc0000034 File C:\DOCUME~1\KROKU\USTAWI~1\Temp\zbznjvvc.exe deleted successfully. Completed script processing. ******************* Finished! Terminate.

Kod: Zaznacz wszystko: Logfile of HijackThis v1.99.1 Scan saved at 18:35:51, on 2007-01-31 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\csrss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\kav.exe C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe C:\Program Files\Winamp\winampa.exe C:\WINDOWS\Samsung\ComSMMgr\ssmmgr.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe C:\SpeedX.exe C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe C:\Program Files\Messenger\msmsgs.exe C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe C:\WINDOWS\system32\notepad.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\kavsvc.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\wuauclt.exe C:\WINDOWS\system32\NOTEPAD.EXE C:\Documents and Settings\KROKU\Pulpit\hijackthis_199\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.onet.pl/ R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll O3 - Toolbar: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL O4 - HKLM\..\Run: [DU Meter] C:\Program Files\DU Meter\DUMeter.exe O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd O4 - HKLM\..\Run: [KAVPersonal50] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\kav.exe" /minimize O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe" O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe O4 - HKLM\..\Run: [Samsung Common SM] "C:\WINDOWS\Samsung\ComSMMgr\ssmmgr.exe" /autorun O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized O4 - HKCU\..\Run: [SpeedX] C:\SpeedX.exe O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" O4 - HKCU\..\Run: [µTorrent] "C:\Program Files\uTorrent\uTorrent.exe" O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe O23 - Service: kavsvc - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\kavsvc.exe O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe

Kod: Zaznacz wszystko: "Silent Runners.vbs", revision R50, http://www.silentrunners.org/ Operating System: Windows XP SP2 Output limited to non-default values, except where indicated by "{++}" Startup items buried in registry: --------------------------------- HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ "zbznjvvc" = ""C:\DOCUME~1\KROKU\USTAWI~1\Temp\zbznjvvc.exe " " [file not found] HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ {++} "SpeedX" = "C:\SpeedX.exe" ["MyPortal.pl"] "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}" = ""C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"" ["Nero AG"] "µTorrent" = ""C:\Program Files\uTorrent\uTorrent.exe"" [null data] "MSMSGS" = ""C:\Program Files\Messenger\msmsgs.exe" /background" [MS] HKLM\Software\Microsoft\Windows\CurrentVersion\Run\ {++} "DU Meter" = "C:\Program Files\DU Meter\DUMeter.exe" ["Hagel Technologies"] "Cmaudio" = "RunDll32 cmicnfg.cpl,CMICtrlWnd" [MS] "KAVPersonal50" = ""C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\kav.exe" /minimize" ["Kaspersky Lab"] "SunJavaUpdateSched" = ""C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe"" ["Sun Microsystems, Inc."] "WinampAgent" = "C:\Program Files\Winamp\winampa.exe" [null data] "NeroFilterCheck" = "C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" ["Nero AG"] "Samsung Common SM" = ""C:\WINDOWS\Samsung\ComSMMgr\ssmmgr.exe" /autorun" ["Samsung Electronics."] "KernelFaultCheck" = "C:\WINDOWS\system32\dumprep 0 -k" "!AVG Anti-Spyware" = ""C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized" ["Anti-Malware Development a.s."] HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C}\(Default) = (no title provided) -> {HKLM...CLSID} = "Megaupload Toolbar" \InProcServer32\(Default) = "C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL" ["MegaUpload"] {761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\(Default) = (no title provided) -> {HKLM...CLSID} = "SSVHelper Class" \InProcServer32\(Default) = "C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll" ["Sun Microsystems, Inc."] HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\ "{42071714-76d4-11d1-8b24-00a0c9068ff3}" = "Rozszerzenie CPL kadrowania wyświetlania" -> {HKLM...CLSID} = "Rozszerzenie CPL kadrowania wyświetlania" \InProcServer32\(Default) = "deskpan.dll" [file not found] "{88895560-9AA2-1069-930E-00AA0030EBC8}" = "Rozszerzenie ikony HyperTerminalu" -> {HKLM...CLSID} = "HyperTerminal Icon Ext" \InProcServer32\(Default) = "C:\WINDOWS\system32\hticons.dll" ["Hilgraeve, Inc."] "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" = "WinRAR shell extension" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] "{F0CB00CD-5A07-4D91-97F5-A8C92CDA93E4}" = "Shell Extensions for RealOne Player" -> {HKLM...CLSID} = "RealOne Player Context Menu Class" \InProcServer32\(Default) = "C:\Program Files\Real\RealPlayer\rpshell.dll" ["RealNetworks, Inc."] "{23170F69-40C1-278A-1000-000100020000}" = "7-Zip Shell Extension" -> {HKLM...CLSID} = "7-Zip Shell Extension" \InProcServer32\(Default) = "C:\Program Files\7-Zip\7-zip.dll" ["Igor Pavlov"] HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\ <<!>> "{57B86673-276A-48B2-BAE7-C6DBB3020EB8}" = "AVG Anti-Spyware 7.5" -> {HKLM...CLSID} = "CShellExecuteHookImpl Object" \InProcServer32\(Default) = "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\shellexecutehook.dll" ["Anti-Malware Development a.s."] HKLM\Software\Classes\*\shellex\ContextMenuHandlers\ 7-Zip\(Default) = "{23170F69-40C1-278A-1000-000100020000}" -> {HKLM...CLSID} = "7-Zip Shell Extension" \InProcServer32\(Default) = "C:\Program Files\7-Zip\7-zip.dll" ["Igor Pavlov"] AVG Anti-Spyware\(Default) = "{8934FCEF-F5B8-468f-951F-78A921CD3920}" -> {HKLM...CLSID} = "CContextScan Object" \InProcServer32\(Default) = "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\context.dll" ["Anti-Malware Development a.s."] Kaspersky Anti-Virus\(Default) = "{dd230880-495a-11d1-b064-008048ec2fc5}" -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\shellex.dll" ["Kaspersky Lab"] WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\ 7-Zip\(Default) = "{23170F69-40C1-278A-1000-000100020000}" -> {HKLM...CLSID} = "7-Zip Shell Extension" \InProcServer32\(Default) = "C:\Program Files\7-Zip\7-zip.dll" ["Igor Pavlov"] AVG Anti-Spyware\(Default) = "{8934FCEF-F5B8-468f-951F-78A921CD3920}" -> {HKLM...CLSID} = "CContextScan Object" \InProcServer32\(Default) = "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\context.dll" ["Anti-Malware Development a.s."] WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\ Kaspersky Anti-Virus\(Default) = "{dd230880-495a-11d1-b064-008048ec2fc5}" -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\shellex.dll" ["Kaspersky Lab"] WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] Group Policies {GPedit.msc branch and setting}: ----------------------------------------------- Note: detected settings may not have any effect. HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\ "NoActiveDesktop" = (REG_DWORD) hex:0x00000000 {User Configuration|Administrative Templates|Desktop|Desktop / Active Desktop| Disable Active Desktop} "ClassicShell" = (REG_DWORD) hex:0x00000000 {User Configuration|Administrative Templates|Windows Components|Windows Explorer| Enable Classic Shell / Turn on Classic Shell} "ForceActiveDesktopOn" = (REG_DWORD) hex:0x00000001 {User Configuration|Administrative Templates|Desktop|Desktop / Active Desktop| Enable Active Desktop} HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System\ "DisableTaskMgr" = (REG_DWORD) hex:0x00000001 {User Configuration|Administrative Templates|System|Ctrl+Alt+Del Options| Remove Task Manager} "Wallpaper" = (REG_SZ) C:\WINDOWS\desktop.html {User Configuration|Administrative Templates|Desktop|Desktop / Active Desktop| Active Desktop Wallpaper|Wallpaper Name:} "DisableRegistryTools" = (REG_DWORD) hex:0x00000000 {User Configuration|Administrative Templates|System| Prevent access to registry editing tools} HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\ "shutdownwithoutlogon" = (REG_DWORD) hex:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| Shutdown: Allow system to be shut down without having to log on} "undockwithoutlogon" = (REG_DWORD) hex:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| Devices: Allow undock without having to log on} Active Desktop and Wallpaper: ----------------------------- Active Desktop may be disabled at this entry: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState Displayed if Active Desktop enabled and wallpaper not set by Group Policy: HKCU\Software\Microsoft\Internet Explorer\Desktop\General\ "Wallpaper" = "C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp" Displayed if Active Desktop disabled and wallpaper not set by Group Policy: HKCU\Control Panel\Desktop\ "Wallpaper" = "C:\Documents and Settings\KROKU\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp" Enabled Screen Saver: --------------------- HKCU\Control Panel\Desktop\ "SCRNSAVE.EXE" = "C:\WINDOWS\System32\logon.scr" [MS] Winsock2 Service Provider DLLs: ------------------------------- Namespace Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++} 000000000001\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS] 000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS] 000000000003\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS] Transport Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++} 0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range: %SystemRoot%\system32\mswsock.dll [MS], 01 - 04, 07 - 14 %SystemRoot%\system32\rsvpsp.dll [MS], 05 - 06 Toolbars, Explorer Bars, Extensions: ------------------------------------ Toolbars HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\ "{4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C}" -> {HKLM...CLSID} = "Megaupload Toolbar" \InProcServer32\(Default) = "C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL" ["MegaUpload"] HKLM\Software\Microsoft\Internet Explorer\Toolbar\ "{4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C}" = (no title provided) -> {HKLM...CLSID} = "Megaupload Toolbar" \InProcServer32\(Default) = "C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL" ["MegaUpload"] Extensions (Tools menu items, main toolbar menu buttons) HKLM\Software\Microsoft\Internet Explorer\Extensions\ {08B0E5C0-4FCB-11CF-AAA5-00401C608501}\ "MenuText" = "Sun Java Console" "CLSIDExtension" = "{CAFEEFAC-0015-0000-0010-ABCDEFFEDCBC}" -> {HKCU...CLSID} = "Java Plug-in 1.5.0_10" \InProcServer32\(Default) = "C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll" ["Sun Microsystems, Inc."] -> {HKLM...CLSID} = "Java Plug-in 1.5.0_10" \InProcServer32\(Default) = "C:\Program Files\Java\jre1.5.0_10\bin\npjpi150_10.dll" ["Sun Microsystems, Inc."] {FB5F1910-F110-11D2-BB9E-00C04F795683}\ "ButtonText" = "Messenger" "MenuText" = "Windows Messenger" "Exec" = "C:\Program Files\Messenger\msmsgs.exe" [MS] Running Services (Display Name, Service Name, Path {Service DLL}): ------------------------------------------------------------------ AVG Anti-Spyware Guard, AVG Anti-Spyware Guard, "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe" ["Anti-Malware Development a.s."] kavsvc, kavsvc, ""C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\kavsvc.exe"" ["Kaspersky Lab"] Print Monitors: --------------- HKLM\System\CurrentControlSet\Control\Print\Monitors\ SUGS2 Langmon\Driver = "SUGS2LMK.DLL" ["Samsung Electronics."] ---------- <<!>>: Suspicious data at a malware launch point. + This report excludes default entries except where indicated. + To see *everywhere* the script checks and *everything* it finds, launch it from a command prompt or a shortcut with the -all parameter. + To search all directories of local fixed drives for DESKTOP.INI DLL launch points, use the -supp parameter or answer "No" at the first message box and "Yes" at the second message box. ---------- (total run time: 96 seconds, including 2 seconds for message boxes)

i dalej kasprzak wykrywa mi wira

c:\windows\system32\wsys.dll

i po wykryciu go reset... nawet na forum nie zdąrzę wejść

**Posty:** 18165 · przez **wojtas** 31 Sty 2007, 20:08

Odpalasz Killboxa zaznacz opcję Delete on Reboot następnie w polu Full Path of File to Delete wklej ścieżkę :

c:\windows\system32\wsys.dll

i nacisnij x
Program będzie pytał o restart (oczywiście zgadzasz się)

odpal SmitfraudFix z opcji 2

http://siri.urz.free.fr/Fix/SmitfraudFix.zip

pokaz raport; c; rapport

masz na dysku??:

C:\Windows\xpupdate.exe
C:\Documents and Settings\All Users\Dokumenty\Settings\winsys2f.dll

**Posty:** 4644 · przez **Wariat** 31 Sty 2007, 20:14

wojtas19162 napisał(a):Program będzie pytał o restart (oczywiście zgadzasz się)

nie pyta się... tylko
wyskakuje PendingFIleRenameOperations Registry Data has been Removed by External Process!

C:\Documents and Settings\All Users\Dokumenty\Settings\winsys2f.dll

nie mam na dysku nawety folderu Dokumenty

C:\Windows\xpupdate.exe

a tego juz nie mam

**Posty:** 18165 · przez **wojtas** 31 Sty 2007, 20:17

Wariat napisał(a):nie mam na dysku nawety folderu Dokumenty

a masz ustwaione zeby pokazywalu ukryte pliki i foldery?

C:\Windows\xpupdate.exe
C:\Documents and Settings\All Users\Dokumenty\Settings\winsys2f.dll
c:\windows\system32\wsys.dll

powiedz które są jeszcze na dysku :wink:

**Posty:** 4644 · przez **Wariat** 31 Sty 2007, 20:27

tak, mam zaznaczone aby pokazywał wszystkie pliki....

wojtas19162 napisał(a):C:\Windows\xpupdate.exe
C:\Documents and Settings\All Users\Dokumenty\Settings\winsys2f.dll
c:\windows\system32\wsys.dll

1 i 3 nie mam... 2 nie wiem bo folderu normalnie nie widać... a gdy wkleje do pasku adresu to pusto

może to ma znaczenia ale cały czas na awaryjnym siedze bo inaczej nic nie zrobie

**Posty:** 18165 · przez **wojtas** 31 Sty 2007, 20:29

uzyj SmitfraudFix z opcji 1 i daj loga z programu oraz z combofixa

**Posty:** 4644 · przez **Wariat** 31 Sty 2007, 20:49

narazie daje z tego pierwszego log... bo combofix jeszcze scanuje

Kod: Zaznacz wszystko: SmitFraudFix v2.137 Scan done at 19:25:56,59, 2007-01-31 Run from C:\Documents and Settings\Administrator\Pulpit\SmitfraudFix\SmitfraudFix OS: Microsoft Windows XP [Wersja 5.1.2600] - Windows_NT The filesystem type is NTFS Fix run in safe mode »»»»»»»»»»»»»»»»»»»»»»»» C:\ »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32 »»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Administrator »»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Administrator\Application Data »»»»»»»»»»»»»»»»»»»»»»»» Start Menu »»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\ADMINI~1\Ulubione »»»»»»»»»»»»»»»»»»»»»»»» Desktop »»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files C:\Program Files\BraveSentry\ FOUND ! »»»»»»»»»»»»»»»»»»»»»»»» Corrupted keys »»»»»»»»»»»»»»»»»»»»»»»» Desktop Components [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0] "Source"="About:Home" "SubscribedURL"="About:Home" "FriendlyName"="Moja bieľĄca strona gˆ˘wna" »»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler !!!Attention, following keys are not inevitably infected!!! SrchSTS.exe by S!Ri Search SharedTaskScheduler's .dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler] "{2C1CD3D7-86AC-4068-93BC-A02304B60787}"="DCOM Server 60787" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler] "{2C1CD3D7-86AC-4068-93BC-A02304B37389}"="DCOM Server 37389" »»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs !!!Attention, following keys are not inevitably infected!!! [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] "AppInit_DLLs"="" »»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System !!!Attention, following keys are not inevitably infected!!! [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] "System"="" »»»»»»»»»»»»»»»»»»»»»»»» pe386-msguard-lzx32-huy32 »»»»»»»»»»»»»»»»»»»»»»»» Scanning wininet.dll infection »»»»»»»»»»»»»»»»»»»»»»»» End

**Posty:** 18165 · przez **wojtas** 31 Sty 2007, 20:53

usun:

C:\Program Files\BraveSentry

**Posty:** 4644 · przez **Wariat** 31 Sty 2007, 20:58

wojtas19162 napisał(a):usun:
Cytat:
C:\Program Files\BraveSentry

nie mam czegoś takiego

ścieżka niepoprawna :|

Kod: Zaznacz wszystko: "Administrator" - 07-01-31 19:29:11 Dodatek Service Pack 2 ComboFix 07.01.31 - Running from: "C:\Program Files\Mozilla Firefox" (((((((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) C:\WINDOWS\system32\dlh9jkd1q1.exe C:\WINDOWS\system32\dlh9jkd1q2.exe C:\WINDOWS\system32\dlh9jkd1q5.exe C:\WINDOWS\system32\dlh9jkd1q6.exe C:\WINDOWS\system32\dlh9jkd1q7.exe C:\WINDOWS\system32\dlh9jkd1q8.exe C:\WINDOWS\system32\kernels88.exe C:\WINDOWS\system32\vxg3am1et3.exe C:\WINDOWS\system32\vxg4am1et2.exe C:\WINDOWS\system32\vxga1me4t1.exe C:\WINDOWS\system32\vxga4m1et4.exe C:\WINDOWS\system32\vxga4me1.exe C:\WINDOWS\system32\vxga4me1.exe C:\WINDOWS\system32\maxd641.exe C:\WINDOWS\system32\vx.tll C:\WINDOWS\comdlj32.dll C:\Program Files\BraveSentry ((((((((((((((((((((((((((((((( Files Created from 2006-12-31 to 2007-01-31 )))))))))))))))))))))))))))))))))) 2007-01-31 19:25 1,930 --a------ C:\WINDOWS\system32\tmp.reg 2007-01-31 19:24 79,360 --a------ C:\WINDOWS\system32\swxcacls.exe 2007-01-31 19:24 53,248 --a------ C:\WINDOWS\system32\Process.exe 2007-01-31 19:24 51,200 --a------ C:\WINDOWS\system32\dumphive.exe 2007-01-31 19:24 40,960 --a------ C:\WINDOWS\system32\swsc.exe 2007-01-31 19:24 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe 2007-01-31 19:24 135,168 --a------ C:\WINDOWS\system32\swreg.exe 2007-01-31 18:32 <DIR> d-------- C:\avenger 2007-01-31 18:23 60,416 --a------ C:\WINDOWS\system32\drivers\ghnum^vh.sys 2007-01-31 09:09 33,920 --a------ C:\WINDOWS\system32\main.sys 2007-01-30 22:11 3,968 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys 2007-01-30 22:11 <DIR> d-------- C:\Program Files\Grisoft 2007-01-30 22:00 <DIR> d-------- C:\DOCUME~1\ADMINI~1\Dane aplikacji\stamina 2007-01-30 18:58 2,816 --a------ C:\WINDOWS\system32\reg.sys 2007-01-30 18:56 169,984 --a------ C:\WINDOWS\system32\oajuj.dll 2007-01-30 18:56 169,984 --a------ C:\WINDOWS\system32\ezhipxp.dll 2007-01-30 18:55 169,984 --a------ C:\WINDOWS\system32\wqmzqv.dll 2007-01-30 17:53 8,138 --a------ C:\syst.exe 2007-01-30 17:53 8,138 --a------ C:\3456346345643.exe 2007-01-28 22:18 <DIR> d-------- C:\!KillBox 2007-01-28 20:04 <DIR> dr-h----- C:\DOCUME~1\ADMINI~1\Dane aplikacji 2007-01-28 20:04 <DIR> dr------- C:\DOCUME~1\ADMINI~1\Menu Start 2007-01-28 20:04 <DIR> d--hs---- C:\WINDOWS\CSC 2007-01-28 20:04 <DIR> d--h----- C:\DOCUME~1\ADMINI~1\Ustawienia lokalne 2007-01-28 20:04 <DIR> d--h----- C:\DOCUME~1\ADMINI~1\Szablony 2007-01-28 20:04 <DIR> d-------- C:\DOCUME~1\ADMINI~1\Ulubione 2007-01-28 20:04 <DIR> d-------- C:\DOCUME~1\ADMINI~1\Pulpit 2007-01-28 20:04 <DIR> d-------- C:\DOCUME~1\ADMINI~1\Moje dokumenty 2007-01-27 15:57 <DIR> d-------- C:\Program Files\DFX 2007-01-27 15:56 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard 2007-01-25 15:45 <DIR> d-------- C:\Program Files\uTorrent 2007-01-25 15:45 <DIR> d-------- C:\DOCUME~1\KROKU\Dane aplikacji\uTorrent 2007-01-20 21:17 <DIR> d-------- C:\Program Files\eMule 2007-01-19 09:19 5,632 --a------ C:\WINDOWS\system32\ptpusb.dll 2007-01-19 09:19 159,232 --a------ C:\WINDOWS\system32\ptpusd.dll 2007-01-19 09:19 15,104 --a------ C:\WINDOWS\system32\drivers\usbscan.sys 2007-01-13 17:48 <DIR> d-------- C:\Program Files\MegauploadToolbar 2007-01-13 17:48 <DIR> d-------- C:\DOCUME~1\KROKU\Dane aplikacji\MegauploadToolbar 2007-01-10 20:39 48,128 --a------ C:\WINDOWS\system32\srshostu.exe 2007-01-10 16:48 <DIR> d-------- C:\DOCUME~1\KROKU\Dane aplikacji\DivX 2007-01-10 16:39 <DIR> d-------- C:\Program Files\StrongDC++ 2007-01-09 19:57 <DIR> d-------- C:\Program Files\Samsung ML-2010 Series 2007-01-09 19:55 57,344 --a------ C:\WINDOWS\system32\SSCoInst.dll 2007-01-09 19:55 41,984 --------- C:\WINDOWS\system32\drivers\DGIVECP.SYS 2007-01-09 19:55 208,896 --------- C:\WINDOWS\system32\SSRemove.exe 2007-01-09 19:55 20,622 --a------ C:\WINDOWS\system32\SUGS2LMK.DLL 2007-01-09 19:55 151,552 --a------ C:\WINDOWS\system32\SSCoInst.exe 2007-01-09 19:55 <DIR> d-------- C:\WINDOWS\Samsung 2007-01-09 19:54 25,856 --a------ C:\WINDOWS\system32\drivers\usbprint.sys 2007-01-09 19:22 1,060,864 --a------ C:\WINDOWS\system32\mfc71.dll 2007-01-09 18:44 <DIR> d-------- C:\Program Files\7-Zip 2007-01-09 18:12 <DIR> d-------- C:\Program Files\IrfanView 2007-01-08 23:53 <DIR> d-------- C:\Program Files\Switch Off 2007-01-07 23:47 <DIR> d-------- C:\Program Files\Ontrack 2007-01-03 00:23 <DIR> d-------- C:\Program Files\Common Files\xing shared 2007-01-03 00:22 <DIR> d-------- C:\Program Files\Real 2007-01-03 00:22 <DIR> d-------- C:\Program Files\Common Files\Real 2007-01-03 00:21 <DIR> d-------- C:\DOCUME~1\KROKU\Dane aplikacji\Real 2007-01-03 00:18 <DIR> d-------- C:\My Downloads 2007-01-03 00:15 <DIR> d-------- C:\Program Files\Super Internet TV 2007-01-03 00:05 <DIR> d-------- C:\Program Files\Fma 2007-01-03 00:05 <DIR> d-------- C:\DOCUME~1\KROKU\Dane aplikacji\FMA 2007-01-02 23:52 <DIR> d-------- C:\DOCUME~1\KROKU\Dane aplikacji\Ahead 2007-01-02 23:49 <DIR> d-------- C:\Program Files\Nero 2007-01-02 23:49 <DIR> d-------- C:\Program Files\Common Files\Ahead 2007-01-02 23:49 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\Dane aplikacji\Nero 2007-01-02 22:44 32,782 -ra------ C:\WINDOWS\system32\drivers\ser120.sys 2007-01-02 22:34 <DIR> d-------- C:\Program Files\Usb to Serial Driver 1.12.25 2006-12-31 10:21 <DIR> d-------- C:\Program Files\ToneGen (((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))) 2007-01-31 19:29 -------- d-------- C:\Program Files\mozilla firefox 2007-01-31 18:37 508416 --a------ C:\WINDOWS\system32\winlogon.exe 2007-01-31 00:21 -------- d-------- C:\DOCUME~1\ADMINI~1\Dane aplikacji\macromedia 2007-01-30 19:21 -------- d---s---- C:\DOCUME~1\ADMINI~1\Dane aplikacji\microsoft 2007-01-28 20:05 -------- d-------- C:\DOCUME~1\ADMINI~1\Dane aplikacji\mozilla 2007-01-09 19:57 -------- d--h----- C:\Program Files\installshield installation information 2007-01-09 19:57 -------- d-------- C:\Program Files\Common Files\installshield 2007-01-09 18:54 -------- d-------- C:\Program Files\subedit-player 2007-01-03 00:22 -------- d-------- C:\Program Files\google 2006-12-30 22:40 -------- d-------- C:\Program Files\skype 2006-12-30 22:40 -------- d-------- C:\Program Files\Common Files\skype 2006-12-22 16:35 -------- d-------- C:\Program Files\winamp 2006-12-20 21:48 -------- d-------- C:\Program Files\java 2006-12-20 21:44 -------- d-------- C:\Program Files\Common Files\java 2006-12-19 19:02 -------- d-------- C:\Program Files\kaspersky lab 2006-12-19 17:10 -------- d-------- C:\Program Files\c-media 3d audio 2006-12-19 17:08 -------- d-------- C:\Program Files\Common Files\speechengines 2006-12-19 17:08 -------- d-------- C:\Program Files\Common Files\odbc 2006-12-19 17:07 62 --ahs---- C:\DOCUME~1\ADMINI~1\Dane aplikacji\desktop.ini 2006-12-19 16:52 -------- d-------- C:\Program Files\konnekt 2006-12-19 16:22 -------- d-------- C:\Program Files\microsoft frontpage 2006-12-19 16:21 0 -rahs---- C:\MSDOS.SYS 2006-12-19 16:21 0 -rahs---- C:\IO.SYS 2006-12-19 16:21 0 --a------ C:\CONFIG.SYS 2006-12-19 16:21 0 --a------ C:\AUTOEXEC.BAT 2006-12-19 16:19 -------- d--h----- C:\Program Files\windowsupdate 2006-12-19 16:19 -------- d-------- C:\Program Files\usˆugi online 2006-12-19 16:18 -------- d-------- C:\Program Files\movie maker 2006-12-19 16:18 -------- d-------- C:\Program Files\Common Files\mssoap 2006-12-19 16:16 -------- d-------- C:\Program Files\windows nt 2006-12-19 16:16 -------- d-------- C:\Program Files\msn gaming zone 2006-12-19 16:16 -------- d-------- C:\Program Files\messenger (((((((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries & legit default entries are not shown [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run] "CTFMON.EXE"="C:\\WINDOWS\\system32\\CTFMON.EXE" [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\runonce] "NeroHomeFirstStart"="C:\\Program Files\\Common Files\\Ahead\\Lib\\NMFirstStart.exe" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run] "DU Meter"="C:\\Program Files\\DU Meter\\DUMeter.exe" "Cmaudio"="RunDll32 cmicnfg.cpl,CMICtrlWnd" "KAVPersonal50"=""C:\\Program Files\\Kaspersky Lab\\Kaspersky Anti-Virus Personal Pro\\kav.exe" /minimize" "SunJavaUpdateSched"=""C:\\Program Files\\Java\\jre1.5.0_10\\bin\\jusched.exe"" "WinampAgent"="C:\\Program Files\\Winamp\\winampa.exe" "NeroFilterCheck"="C:\\Program Files\\Common Files\\Ahead\\Lib\\NeroCheck.exe" "Samsung Common SM"=""C:\\WINDOWS\\Samsung\\ComSMMgr\\ssmmgr.exe" /autorun" "KernelFaultCheck"=hex(2):25,73,79,73,74,65,6d,72,6f,6f,74,25,5c,73,79,73,74,\ 65,6d,33,32,5c,64,75,6d,70,72,65,70,20,30,20,2d,6b,00 "!AVG Anti-Spyware"=""C:\\Program Files\\Grisoft\\AVG Anti-Spyware 7.5\\avgas.exe" /minimized" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\sharedtaskscheduler] "{2C1CD3D7-86AC-4068-93BC-A02304B60787}"="DCOM Server 60787" "{2C1CD3D7-86AC-4068-93BC-A02304B37389}"="DCOM Server 37389" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks] "{57B86673-276A-48B2-BAE7-C6DBB3020EB8}"="AVG Anti-Spyware 7.5" [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders] "SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll" [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Svchost] HTTPFilter REG_MULTI_SZ HTTPFilter\0\0 LocalService REG_MULTI_SZ Alerter\0WebClient\0LmHosts\0RemoteRegistry\0upnphost\0SSDPSRV\0\0 NetworkService REG_MULTI_SZ DnsCache\0\0 DcomLaunch REG_MULTI_SZ DcomLaunch\0TermService\0\0 rpcss REG_MULTI_SZ RpcSs\0\0 imgsvc REG_MULTI_SZ StiSvc\0\0 termsvcs REG_MULTI_SZ TermService\0\0 [HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\D] Shell\AutoRun\command D:\SETUP.EXE Completion time: 07-01-31 19:47:11

**Posty:** 18165 · przez **wojtas** 31 Sty 2007, 21:05

SmitfraudFix z opcji 2

Przeskanuj system tym programem i usun wszystko co znajdzie: www.ewido.net i wklej raport na forum.

Uzyj: http://www.superantispyware.com/downloads/SUPERAntiSpyware.exe

http://www.komputery.boo.pl/viewtopic.php?t=48
uzyj programu: Smitrem

i nowy log z combofixa

**Posty:** 4644 · przez **Wariat** 31 Sty 2007, 21:25

Kod: Zaznacz wszystko: SmitFraudFix v2.137 Scan done at 19:57:46,40, 2007-01-31 Run from C:\Documents and Settings\Administrator\Pulpit\SmitfraudFix\SmitfraudFix OS: Microsoft Windows XP [Wersja 5.1.2600] - Windows_NT The filesystem type is NTFS Fix run in safe mode »»»»»»»»»»»»»»»»»»»»»»»» Before SmitFraudFix !!!Attention, following keys are not inevitably infected!!! SrchSTS.exe by S!Ri Search SharedTaskScheduler's .dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler] "{2C1CD3D7-86AC-4068-93BC-A02304B60787}"="DCOM Server 60787" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler] "{2C1CD3D7-86AC-4068-93BC-A02304B37389}"="DCOM Server 37389" »»»»»»»»»»»»»»»»»»»»»»»» Killing process »»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix GenericRenosFix by S!Ri »»»»»»»»»»»»»»»»»»»»»»»» Deleting infected files »»»»»»»»»»»»»»»»»»»»»»»» Deleting Temp Files »»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System !!!Attention, following keys are not inevitably infected!!! [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] "System"="" »»»»»»»»»»»»»»»»»»»»»»»» Registry Cleaning Registry Cleaning done. »»»»»»»»»»»»»»»»»»»»»»»» After SmitFraudFix !!!Attention, following keys are not inevitably infected!!! SrchSTS.exe by S!Ri Search SharedTaskScheduler's .dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler] "{2C1CD3D7-86AC-4068-93BC-A02304B60787}"="DCOM Server 60787" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler] "{2C1CD3D7-86AC-4068-93BC-A02304B37389}"="DCOM Server 37389" »»»»»»»»»»»»»»»»»»»»»»»» End

Kod: Zaznacz wszystko: "Administrator" - 07-01-31 20:00:51 Dodatek Service Pack 2 ComboFix 07.01.31 - Running from: "C:\Documents and Settings\Administrator\Pulpit" ((((((((((((((((((((((((((((((( Files Created from 2006-12-31 to 2007-01-31 )))))))))))))))))))))))))))))))))) 2007-01-31 19:25 1,930 --a------ C:\WINDOWS\system32\tmp.reg 2007-01-31 19:24 79,360 --a------ C:\WINDOWS\system32\swxcacls.exe 2007-01-31 19:24 53,248 --a------ C:\WINDOWS\system32\Process.exe 2007-01-31 19:24 51,200 --a------ C:\WINDOWS\system32\dumphive.exe 2007-01-31 19:24 40,960 --a------ C:\WINDOWS\system32\swsc.exe 2007-01-31 19:24 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe 2007-01-31 19:24 135,168 --a------ C:\WINDOWS\system32\swreg.exe 2007-01-31 18:32 <DIR> d-------- C:\avenger 2007-01-31 18:23 60,416 --a------ C:\WINDOWS\system32\drivers\ghnum^vh.sys 2007-01-31 09:09 33,920 --a------ C:\WINDOWS\system32\main.sys 2007-01-30 22:11 3,968 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys 2007-01-30 22:11 <DIR> d-------- C:\Program Files\Grisoft 2007-01-30 22:00 <DIR> d-------- C:\DOCUME~1\ADMINI~1\Dane aplikacji\stamina 2007-01-30 18:58 2,816 --a------ C:\WINDOWS\system32\reg.sys 2007-01-30 18:56 169,984 --a------ C:\WINDOWS\system32\oajuj.dll 2007-01-30 18:56 169,984 --a------ C:\WINDOWS\system32\ezhipxp.dll 2007-01-30 18:55 169,984 --a------ C:\WINDOWS\system32\wqmzqv.dll 2007-01-30 17:53 8,138 --a------ C:\syst.exe 2007-01-30 17:53 8,138 --a------ C:\3456346345643.exe 2007-01-28 22:18 <DIR> d-------- C:\!KillBox 2007-01-28 20:04 <DIR> dr-h----- C:\DOCUME~1\ADMINI~1\Dane aplikacji 2007-01-28 20:04 <DIR> dr------- C:\DOCUME~1\ADMINI~1\Menu Start 2007-01-28 20:04 <DIR> d--hs---- C:\WINDOWS\CSC 2007-01-28 20:04 <DIR> d--h----- C:\DOCUME~1\ADMINI~1\Ustawienia lokalne 2007-01-28 20:04 <DIR> d--h----- C:\DOCUME~1\ADMINI~1\Szablony 2007-01-28 20:04 <DIR> d-------- C:\DOCUME~1\ADMINI~1\Ulubione 2007-01-28 20:04 <DIR> d-------- C:\DOCUME~1\ADMINI~1\Pulpit 2007-01-28 20:04 <DIR> d-------- C:\DOCUME~1\ADMINI~1\Moje dokumenty 2007-01-27 15:57 <DIR> d-------- C:\Program Files\DFX 2007-01-27 15:56 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard 2007-01-25 15:45 <DIR> d-------- C:\Program Files\uTorrent 2007-01-25 15:45 <DIR> d-------- C:\DOCUME~1\KROKU\Dane aplikacji\uTorrent 2007-01-20 21:17 <DIR> d-------- C:\Program Files\eMule 2007-01-19 09:19 5,632 --a------ C:\WINDOWS\system32\ptpusb.dll 2007-01-19 09:19 159,232 --a------ C:\WINDOWS\system32\ptpusd.dll 2007-01-19 09:19 15,104 --a------ C:\WINDOWS\system32\drivers\usbscan.sys 2007-01-13 17:48 <DIR> d-------- C:\Program Files\MegauploadToolbar 2007-01-13 17:48 <DIR> d-------- C:\DOCUME~1\KROKU\Dane aplikacji\MegauploadToolbar 2007-01-10 20:39 48,128 --a------ C:\WINDOWS\system32\srshostu.exe 2007-01-10 16:48 <DIR> d-------- C:\DOCUME~1\KROKU\Dane aplikacji\DivX 2007-01-10 16:39 <DIR> d-------- C:\Program Files\StrongDC++ 2007-01-09 19:57 <DIR> d-------- C:\Program Files\Samsung ML-2010 Series 2007-01-09 19:55 57,344 --a------ C:\WINDOWS\system32\SSCoInst.dll 2007-01-09 19:55 41,984 --------- C:\WINDOWS\system32\drivers\DGIVECP.SYS 2007-01-09 19:55 208,896 --------- C:\WINDOWS\system32\SSRemove.exe 2007-01-09 19:55 20,622 --a------ C:\WINDOWS\system32\SUGS2LMK.DLL 2007-01-09 19:55 151,552 --a------ C:\WINDOWS\system32\SSCoInst.exe 2007-01-09 19:55 <DIR> d-------- C:\WINDOWS\Samsung 2007-01-09 19:54 25,856 --a------ C:\WINDOWS\system32\drivers\usbprint.sys 2007-01-09 19:22 1,060,864 --a------ C:\WINDOWS\system32\mfc71.dll 2007-01-09 18:44 <DIR> d-------- C:\Program Files\7-Zip 2007-01-09 18:12 <DIR> d-------- C:\Program Files\IrfanView 2007-01-08 23:53 <DIR> d-------- C:\Program Files\Switch Off 2007-01-07 23:47 <DIR> d-------- C:\Program Files\Ontrack 2007-01-03 00:23 <DIR> d-------- C:\Program Files\Common Files\xing shared 2007-01-03 00:22 <DIR> d-------- C:\Program Files\Real 2007-01-03 00:22 <DIR> d-------- C:\Program Files\Common Files\Real 2007-01-03 00:21 <DIR> d-------- C:\DOCUME~1\KROKU\Dane aplikacji\Real 2007-01-03 00:18 <DIR> d-------- C:\My Downloads 2007-01-03 00:15 <DIR> d-------- C:\Program Files\Super Internet TV 2007-01-03 00:05 <DIR> d-------- C:\Program Files\Fma 2007-01-03 00:05 <DIR> d-------- C:\DOCUME~1\KROKU\Dane aplikacji\FMA 2007-01-02 23:52 <DIR> d-------- C:\DOCUME~1\KROKU\Dane aplikacji\Ahead 2007-01-02 23:49 <DIR> d-------- C:\Program Files\Nero 2007-01-02 23:49 <DIR> d-------- C:\Program Files\Common Files\Ahead 2007-01-02 23:49 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\Dane aplikacji\Nero 2007-01-02 22:44 32,782 -ra------ C:\WINDOWS\system32\drivers\ser120.sys 2007-01-02 22:34 <DIR> d-------- C:\Program Files\Usb to Serial Driver 1.12.25 2006-12-31 10:21 <DIR> d-------- C:\Program Files\ToneGen (((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))) 2007-01-31 19:29 -------- d-------- C:\Program Files\mozilla firefox 2007-01-31 18:37 508416 --a------ C:\WINDOWS\system32\winlogon.exe 2007-01-31 00:21 -------- d-------- C:\DOCUME~1\ADMINI~1\Dane aplikacji\macromedia 2007-01-30 19:21 -------- d---s---- C:\DOCUME~1\ADMINI~1\Dane aplikacji\microsoft 2007-01-28 20:05 -------- d-------- C:\DOCUME~1\ADMINI~1\Dane aplikacji\mozilla 2007-01-09 19:57 -------- d--h----- C:\Program Files\installshield installation information 2007-01-09 19:57 -------- d-------- C:\Program Files\Common Files\installshield 2007-01-09 18:54 -------- d-------- C:\Program Files\subedit-player 2007-01-03 00:22 -------- d-------- C:\Program Files\google 2006-12-30 22:40 -------- d-------- C:\Program Files\skype 2006-12-30 22:40 -------- d-------- C:\Program Files\Common Files\skype 2006-12-22 16:35 -------- d-------- C:\Program Files\winamp 2006-12-20 21:48 -------- d-------- C:\Program Files\java 2006-12-20 21:44 -------- d-------- C:\Program Files\Common Files\java 2006-12-19 19:02 -------- d-------- C:\Program Files\kaspersky lab 2006-12-19 17:10 -------- d-------- C:\Program Files\c-media 3d audio 2006-12-19 17:08 -------- d-------- C:\Program Files\Common Files\speechengines 2006-12-19 17:08 -------- d-------- C:\Program Files\Common Files\odbc 2006-12-19 17:07 62 --ahs---- C:\DOCUME~1\ADMINI~1\Dane aplikacji\desktop.ini 2006-12-19 16:52 -------- d-------- C:\Program Files\konnekt 2006-12-19 16:22 -------- d-------- C:\Program Files\microsoft frontpage 2006-12-19 16:21 0 -rahs---- C:\MSDOS.SYS 2006-12-19 16:21 0 -rahs---- C:\IO.SYS 2006-12-19 16:21 0 --a------ C:\CONFIG.SYS 2006-12-19 16:21 0 --a------ C:\AUTOEXEC.BAT 2006-12-19 16:19 -------- d--h----- C:\Program Files\windowsupdate 2006-12-19 16:19 -------- d-------- C:\Program Files\usˆugi online 2006-12-19 16:18 -------- d-------- C:\Program Files\movie maker 2006-12-19 16:18 -------- d-------- C:\Program Files\Common Files\mssoap 2006-12-19 16:16 -------- d-------- C:\Program Files\windows nt 2006-12-19 16:16 -------- d-------- C:\Program Files\msn gaming zone 2006-12-19 16:16 -------- d-------- C:\Program Files\messenger (((((((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries & legit default entries are not shown [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run] "CTFMON.EXE"="C:\\WINDOWS\\system32\\CTFMON.EXE" [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\runonce] "NeroHomeFirstStart"="C:\\Program Files\\Common Files\\Ahead\\Lib\\NMFirstStart.exe" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run] "DU Meter"="C:\\Program Files\\DU Meter\\DUMeter.exe" "Cmaudio"="RunDll32 cmicnfg.cpl,CMICtrlWnd" "KAVPersonal50"="\"C:\\Program Files\\Kaspersky Lab\\Kaspersky Anti-Virus Personal Pro\\kav.exe\" /minimize" "SunJavaUpdateSched"="\"C:\\Program Files\\Java\\jre1.5.0_10\\bin\\jusched.exe\"" "WinampAgent"="C:\\Program Files\\Winamp\\winampa.exe" "NeroFilterCheck"="C:\\Program Files\\Common Files\\Ahead\\Lib\\NeroCheck.exe" "Samsung Common SM"="\"C:\\WINDOWS\\Samsung\\ComSMMgr\\ssmmgr.exe\" /autorun" "KernelFaultCheck"=hex(2):25,73,79,73,74,65,6d,72,6f,6f,74,25,5c,73,79,73,74,\ 65,6d,33,32,5c,64,75,6d,70,72,65,70,20,30,20,2d,6b,00 "!AVG Anti-Spyware"="\"C:\\Program Files\\Grisoft\\AVG Anti-Spyware 7.5\\avgas.exe\" /minimized" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\sharedtaskscheduler] "{2C1CD3D7-86AC-4068-93BC-A02304B60787}"="DCOM Server 60787" "{2C1CD3D7-86AC-4068-93BC-A02304B37389}"="DCOM Server 37389" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks] "{57B86673-276A-48B2-BAE7-C6DBB3020EB8}"="AVG Anti-Spyware 7.5" [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders] "SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll" [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Svchost] HTTPFilter REG_MULTI_SZ HTTPFilter\0\0 LocalService REG_MULTI_SZ Alerter\0WebClient\0LmHosts\0RemoteRegistry\0upnphost\0SSDPSRV\0\0 NetworkService REG_MULTI_SZ DnsCache\0\0 DcomLaunch REG_MULTI_SZ DcomLaunch\0TermService\0\0 rpcss REG_MULTI_SZ RpcSs\0\0 imgsvc REG_MULTI_SZ StiSvc\0\0 termsvcs REG_MULTI_SZ TermService\0\0 [HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\D] Shell\AutoRun\command D:\SETUP.EXE Completion time: 07-01-31 20:14:28 C:\ComboFix2.txt ... 07-01-31 19:47

[ Dodano: Dzisiaj o 20:26 ]
co do ewido to wczoraj scanowałem bude

proszę o sprawdzenie loga

proszę o sprawdzenie loga

Kto jest na forum