proszę o sprawdzenie loga

[Rsta92]

Kod: Zaznacz wszystko

Logfile of HijackThis v1.99.1
Scan saved at 19:48:40, on 2007-04-24
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0011)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\KWORLD\MpegTV Station PCITV\RemoteCtl.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Downloads\hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = c:\secure32.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://search.bearshare.com/sidebar.html?src=ssb
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.searchgateway.net/search/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.searchgateway.net/search/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.pl/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.searchgateway.net/search/
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://www.searchgateway.net/search/%s
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = :
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
R3 - URLSearchHook: (no name) - {00A6FAF6-072E-44cf-8957-5838F569A31D} - (no file)
R3 - URLSearchHook: (no name) - {D3DEE18F-DB64-4BEB-9FF1-E1F0A5033E4A} - (no file)
O1 - Hosts: 217.96.35.130 auto.search.msn.com
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: flashget urlcatch - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\Program Files\FlashGet\jccatch.dll
O2 - BHO: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MegauploadToolbar\megauploadtoolbar.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O2 - BHO: FlashGet GetFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\Program Files\FlashGet\getflash.dll
O2 - BHO: XBTP02634 - {F97DA966-F09D-4cab-BF29-75A0026986EA} - (no file)
O3 - Toolbar: FlashGet - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\Program Files\FlashGet\fgiebar.dll
O3 - Toolbar: (no name) - {D3DEE18F-DB64-4BEB-9FF1-E1F0A5033E4A} - (no file)
O3 - Toolbar: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MegauploadToolbar\megauploadtoolbar.dll
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: MpegTV Station PCITV Remote Control.lnk = C:\Program Files\KWORLD\MpegTV Station PCITV\RemoteCtl.exe
O8 - Extra context menu item: &Ściągnij przy pomocy FlashGet'a - C:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: &Ściągnij wszystko przy pomocy FlashGet'a - C:\Program Files\FlashGet\jc_all.htm
O8 - Extra context menu item: Download with Rapget - D:\Programy\rapget128\rapget.htm
O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Open with &ZipScan - C:\PROGRA~1\ZipScan Evaluation\zs_ie.htm
O8 - Extra context menu item: Pobierz za pomocą Mega Manager... - C:\Program Files\Megaupload\Mega Manager\mm_file.htm
O8 - Extra context menu item: RapidShare-Download - res://C:\DOCUME~1\Piotr\USTAWI~1\Temp\ir_ext_temp_0\AutoPlay\Docs\more-rapid.exe/RsMenExt.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe
O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {83AFB5CA-ED35-11D4-A452-0080C8D85045} (GameDesire Poker Games) - http://67.15.101.3/g_bin/pl/poker_2_0_0_45.cab
O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C5} (GameDesire Snooker) - http://67.15.101.3/g_bin/pl/snooker_2_0_0_30.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{13176C0B-D86C-451C-9DEC-B55635BF78EE}: NameServer = 192.0.3.1
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\Skype4COM.dll
O20 - Winlogon Notify: winjrs32 - winjrs32.dll (file missing)
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe



[prog]

Jaki jest powód, że wstawiasz loga?

[Rsta92]

Poniewaz ostatnio mam jakieś dziwne problemy z łączem. Mam w domu 3 komputery i na tych 3 jest to samo łącze i tylko na moim kompterze występują błedy to znaczy interent czasami chodzi dobrze a czasami dzieje się tak że musze go wyłączyć i właczyć i działa przez 10- 15 min a potem lypa niedziała znów. Bład ten występuje zazwyczaj rano i wieczorem ale w środku dnia też mi się często zdarzał. Nigdy wcześniej niemiałem takie problemu próbowałem róznych metod wielkokrotnie skanowałem antywirem itp., lecz nic niepomagało, dlatego stwierdiłem że może warto sprawdić log może tu gdzieś tkwi problem. Jeżeli to nie log a wiecie może jak naprawic mój problem to porszę o pomoc.

Mam Radiówke 512 kb/s czasami sięga 700 kb/s i jest podzielona na 3 komutery, i zazwyczaj tamte nie używaja interentu i żadko w ciągu dnia są włączane.

[wojtas]

Wyłącz przywracanie systemu ( właściwości mój komputer-zakładka przywracanie - wyłącz przywracanie na wszystkich dyskach)
Start do awaryjnego ( F8 ) przy starcie komputera.

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = c:\secure32.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://search.bearshare.com/sidebar.html?src=ssb
R3 - URLSearchHook: (no name) - {00A6FAF6-072E-44cf-8957-5838F569A31D} - (no file)
R3 - URLSearchHook: (no name) - {D3DEE18F-DB64-4BEB-9FF1-E1F0A5033E4A} - (no file)
O2 - BHO: XBTP02634 - {F97DA966-F09D-4cab-BF29-75A0026986EA} - (no file)
O20 - Winlogon Notify: winjrs32 - winjrs32.dll (file missing)

Odpalasz hijackthis i zaznaczasz ptaszkami powyższe wpisy i dajesz Fix checked.

potem daj loga z comboscana:

http://www.techsupportforum.com/sectools/Deckard/comboscan.exe

[Rsta92]

Kod: Zaznacz wszystko

ComboScan v20070306.20 run by Piotr on 2007-04-24 at 21:57:30
Computer is in Normal Mode.
--------------------------------------------------------------------------------

-- System Restore --------------------------------------------------------------

System Restore is disabled; attempting to re-enable...success.


-- Last 1 Restore Point(s) --
1: 2007-04-24 19:57:36 UTC - RP584 - Punkt kontrolny systemu


Performed disk cleanup.


-- HijackThis (run as Piotr.exe) -----------------------------------------------

Logfile of HijackThis v1.99.1
Scan saved at 21:57:39, on 2007-04-24
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0011)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\KWORLD\MpegTV Station PCITV\RemoteCtl.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Downloads\comboscan.exe
C:\DOWNLO~1\hijackthis\Piotr.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.searchgateway.net/search/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.searchgateway.net/search/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.pl/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.searchgateway.net/search/
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://www.searchgateway.net/search/%s
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = :
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O1 - Hosts: 217.96.35.130 auto.search.msn.com
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: flashget urlcatch - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\Program Files\FlashGet\jccatch.dll
O2 - BHO: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MegauploadToolbar\megauploadtoolbar.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O2 - BHO: FlashGet GetFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\Program Files\FlashGet\getflash.dll
O3 - Toolbar: FlashGet - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\Program Files\FlashGet\fgiebar.dll
O3 - Toolbar: (no name) - {D3DEE18F-DB64-4BEB-9FF1-E1F0A5033E4A} - (no file)
O3 - Toolbar: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MegauploadToolbar\megauploadtoolbar.dll
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: MpegTV Station PCITV Remote Control.lnk = C:\Program Files\KWORLD\MpegTV Station PCITV\RemoteCtl.exe
O8 - Extra context menu item: &Ściągnij przy pomocy FlashGet'a - C:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: &Ściągnij wszystko przy pomocy FlashGet'a - C:\Program Files\FlashGet\jc_all.htm
O8 - Extra context menu item: Download with Rapget - D:\Programy\rapget128\rapget.htm
O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Open with &ZipScan - C:\PROGRA~1\ZipScan Evaluation\zs_ie.htm
O8 - Extra context menu item: Pobierz za pomocą Mega Manager... - C:\Program Files\Megaupload\Mega Manager\mm_file.htm
O8 - Extra context menu item: RapidShare-Download - res://C:\DOCUME~1\Piotr\USTAWI~1\Temp\ir_ext_temp_0\AutoPlay\Docs\more-rapid.exe/RsMenExt.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe
O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {83AFB5CA-ED35-11D4-A452-0080C8D85045} (GameDesire Poker Games) - http://67.15.101.3/g_bin/pl/poker_2_0_0_45.cab
O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C5} (GameDesire Snooker) - http://67.15.101.3/g_bin/pl/snooker_2_0_0_30.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{13176C0B-D86C-451C-9DEC-B55635BF78EE}: NameServer = 192.0.3.1
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\Skype4COM.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe


-- HijackThis Fixed Entries (C:\DOWNLO~1\hijackthis\backups\) ------------------

backup-20070424-215636-425 R1 - HKCU\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://search.bearshare.com/sidebar.html?src=ssb
backup-20070424-215636-508 R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = c:\secure32.html
backup-20070424-215636-674 R3 - URLSearchHook: (no name) - {00A6FAF6-072E-44cf-8957-5838F569A31D} - (no file)
backup-20070424-215636-706 O2 - BHO: XBTP02634 - {F97DA966-F09D-4cab-BF29-75A0026986EA} - (no file)
backup-20070424-215636-883 R3 - URLSearchHook: (no name) - {D3DEE18F-DB64-4BEB-9FF1-E1F0A5033E4A} - (no file)
backup-20070424-215636-973 O20 - Winlogon Notify: winjrs32 - winjrs32.dll (file missing)

-- File Associations -----------------------------------------------------------

.bat - batfile - "%1" %*
.chm - chm.file - "C:\WINDOWS\hh.exe" %1
.cmd - cmdfile - "%1" %*
.com - comfile - "%1" %*
.exe - exefile - "%1" %*
.hlp - hlpfile - %SystemRoot%\System32\winhlp32.exe %1
.inf - inffile - %SystemRoot%\System32\NOTEPAD.EXE %1
.ini - inifile - %SystemRoot%\System32\NOTEPAD.EXE %1
.js - JSFile - %SystemRoot%\System32\WScript.exe "%1" %*
.lnk - lnkfile - {00021401-0000-0000-C000-000000000046}
.pif - piffile - "%1" %*
.reg - regfile - regedit.exe "%1"
.scr - scrfile - "%1" /S
.txt - txtfile - %SystemRoot%\system32\NOTEPAD.EXE %1
.vbs - VBSFile - %SystemRoot%\System32\WScript.exe "%1" %*


-- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled ---------------------

1R Aavmker4 (avast! Asynchronous Virus Monitor) - C:\WINDOWS\system32\drivers\aavmker4.sys
2S ADILOADER (General Purpose USB Driver (adildr.sys)) - C:\WINDOWS\system32\Drivers\adildr.sys (not found)
3S adiusbaw (USB ADSL WAN Adapter) - C:\WINDOWS\system32\DRIVERS\adiusbaw.sys (not found)
1R AFS2K - C:\WINDOWS\system32\drivers\AFS2K.SYS
3R ALCXWDM (Service for Realtek AC97 Audio (WDM)) - C:\WINDOWS\system32\drivers\ALCXWDM.SYS
1R AmdK7 (Sterownik procesora AMD K7) - C:\WINDOWS\system32\drivers\amdk7.sys
2R aswMon2 (avast! Standard Shield Support) - C:\WINDOWS\system32\drivers\aswmon2.sys
3R aswRdr - C:\WINDOWS\system32\drivers\aswRdr.sys
1R aswTdi (avast! Network Shield Support) - C:\WINDOWS\system32\drivers\aswTdi.sys
3R Cap7134 (Philips Proteus (7134) WDM Video Capture) - C:\WINDOWS\system32\drivers\Cap7134.sys
3S CCDECODE (Dekoder napisów) - C:\WINDOWS\system32\drivers\CCDECODE.sys
1R cdrbsdrv - C:\WINDOWS\system32\drivers\CDRBSDRV.SYS
3R dtscsi - C:\WINDOWS\system32\drivers\dtscsi.sys
3R FETNDIS (Sterownik NT karty VIA PCI 10/100Mb Fast Ethernet) - C:\WINDOWS\system32\drivers\fetnd5.sys
3S GT680x (GrandTechICNameNT) - C:\WINDOWS\system32\drivers\gt680x.sys
3S hamachi (Hamachi Network Interface) - C:\WINDOWS\system32\drivers\hamachi.sys
3S hidgame (Włącznik Microsoft HID do portu joysticka) - C:\WINDOWS\system32\drivers\hidgame.sys
3R HidUsb (Sterownik Microsoft klasy HID) - C:\WINDOWS\system32\drivers\hidusb.sys
3R HSFHWBS2 - C:\WINDOWS\system32\drivers\HSFBS2S2.sys
3R HSF_DP - C:\WINDOWS\system32\drivers\HSFDPSP2.sys
2R mdmxsdk - C:\WINDOWS\system32\drivers\mdmxsdk.sys
3R MODEMCSA (Urządzenie filtru strumieniowego usługi Unimodem) - C:\WINDOWS\system32\drivers\MODEMCSA.sys
3R mouhid (Sterownik myszy HID) - C:\WINDOWS\system32\drivers\mouhid.sys
3S MSIRCOMM (Microsoft IR Communications Driver) - C:\WINDOWS\system32\drivers\MSIRCOMM.sys
3S MSTEE (Konwerter strumieni Tee/Sink-to-Sink Microsoft Streaming) - C:\WINDOWS\system32\drivers\MSTEE.sys
3R ms_mpu401 (Sterownik portu MIDI UART Microsoft MPU-401) - C:\WINDOWS\system32\drivers\msmpu401.sys
3S NABTSFEC (Koder-dekoder NABTS/FEC VBI) - C:\WINDOWS\system32\drivers\NABTSFEC.sys
3S NdisIP (Połączenie TV/wideo firmy Microsoft) - C:\WINDOWS\system32\drivers\NdisIP.sys
3R nv - C:\WINDOWS\system32\drivers\nv4_mini.sys
3R PhTVTune (Philips WDM TVTuner) - C:\WINDOWS\system32\drivers\PhTVTune.sys
1R prodrv06 (StarForce Protection Environment Driver v6) - C:\WINDOWS\system32\drivers\prodrv06.sys
0R prohlp02 (StarForce Protection Helper Driver v2) - C:\WINDOWS\system32\drivers\prohlp02.sys
0R prosync1 (StarForce Protection Synchronization Driver v1) - C:\WINDOWS\system32\drivers\prosync1.sys
0R PxHelp20 - C:\WINDOWS\system32\drivers\pxhelp20.sys
3R Rasirda (WAN Miniport (IrDA)) - C:\WINDOWS\system32\drivers\rasirda.sys
3R SER120 (OTI Serial port driver) - C:\WINDOWS\system32\drivers\ser120.sys
0R sfhlp01 (StarForce Protection Helper Driver) - C:\WINDOWS\system32\drivers\sfhlp01.sys
3S SLIP (BDA Slip De-Framer) - C:\WINDOWS\system32\drivers\SLIP.sys
3S SONYPVU1 (Sterownik filtru USB Sony (SONYPVU1)) - C:\WINDOWS\system32\drivers\SONYPVU1.SYS
0R sptd - C:\WINDOWS\system32\drivers\sptd.sys
3S STIrUsb (STIrUsb.sys SigmaTel USB-IrDA Adapter) - C:\WINDOWS\system32\drivers\irstusb.sys
3S streamip (BDA IPSink) - C:\WINDOWS\system32\drivers\StreamIP.sys
0R uagp35 (Filtr AGPv3.5 firmy Microsoft) - C:\WINDOWS\system32\drivers\UAGP35.SYS
3S usbccgp (Rodzajowy sterownik nadrzędny USB Microsoft) - C:\WINDOWS\system32\drivers\usbccgp.sys
3R usbehci (Sterownik Miniport rozszerzonego kontrolera hosta USB 2.0 Microsoft) - C:\WINDOWS\system32\drivers\usbehci.sys
3S usbprint (Klasa PRINTER USB Microsoft) - C:\WINDOWS\system32\drivers\usbprint.sys
3S usbscan (Sterownik skanera USB) - C:\WINDOWS\system32\drivers\usbscan.sys
3S USBSTOR (Sterownik magazynu masowego USB) - C:\WINDOWS\system32\drivers\USBSTOR.SYS
3R winachsf - C:\WINDOWS\system32\drivers\HSFCXTS2.sys
3S WSTCODEC (Kodery-dekodery teletekstu w standardzie światowym) - C:\WINDOWS\system32\drivers\WSTCODEC.SYS


-- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------

3S aspnet_state (ASP.NET State Service) - C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\aspnet_state.exe
2R aswUpdSv (avast! iAVS4 Control Service) - "C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe"
2R avast! Antivirus - "C:\Program Files\Alwil Software\Avast4\ashServ.exe"
3R avast! Mail Scanner - "C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service
3R avast! Web Scanner - "C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service
3S IDriverT (InstallDriver Table Manager) - "C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe"
2R NVSvc (NVIDIA Display Driver Service) - C:\WINDOWS\system32\nvsvc32.exe
3S ose (Office Source Engine) - "C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
2R UMWdf (Windows User Mode Driver Framework) - C:\WINDOWS\system32\wdfmgr.exe


-- Files created between 2007-03-24 and 2007-04-24 -----------------------------

2007-04-24 17:45:56         0 d-------- C:\Program Files\Techland
2007-04-24 14:05:03         0 d-------- C:\My Music
2007-04-23 18:28:40         0 d-------- C:\Program Files\KaraFun
2007-04-22 11:10:23         0 d-------- C:\Program Files\Muxe Inc
2007-04-21 08:15:19         0 d-------- C:\Program Files\MegauploadToolbar
2007-04-20 20:04:23         0 d-------- C:\Program Files\PITy
2007-04-20 11:34:01         0 d-------- C:\WINDOWS\WBEM
2007-04-20 11:34:00         0 d-------- C:\WINDOWS\system32\pl-pl
2007-04-20 11:32:48         0 d--h---c- C:\WINDOWS\ie7
2007-04-20 11:31:29    121856 -----n--- C:\WINDOWS\system32\xmllite.dll
2007-04-17 21:34:15     21840 --a-----t C:\WINDOWS\system32\SIntfNT.dll
2007-04-17 21:34:15     17212 --a-----t C:\WINDOWS\system32\SIntf32.dll
2007-04-17 21:34:15     12067 --a-----t C:\WINDOWS\system32\SIntf16.dll
2007-04-12 17:16:47         0 d-------- C:\Program Files\Activision
2007-04-12 16:50:31        64 --a-s---- C:\WINDOWS\ttyxa.sys
2007-04-09 23:17:41         0 d-------- C:\Program Files\Common Files\NSV
2007-04-07 16:48:06         0 d-------- C:\Program Files\Common Files\ReGet Shared
2007-04-07 14:16:39     26056 --a------ C:\WINDOWS\system32\drivers\hamachi.sys
2007-04-07 09:08:30    208896 --a------ C:\WINDOWS\system32\nvudisp.exe
2007-04-07 09:08:30         0 d-------- C:\WINDOWS\nview
2007-04-06 23:02:56    208896 --a------ C:\WINDOWS\system32\NVUNINST.EXE
2007-04-04 20:50:29         0 d-------- C:\Program Files\CCleaner
2007-04-02 17:32:52         0 d-------- C:\Program Files\Common Files\Skype
2007-04-02 17:32:24         0 d-------- C:\Program Files\Skype
2007-03-28 18:10:54         0 d-------- C:\Program Files\Powerbullet<POWERB~1>
2007-03-28 09:39:39      8576 --a------ C:\WINDOWS\system32\drivers\hidgame.sys
2007-03-27 20:45:59         0 d-------- C:\Program Files\Wolfenstein - Enemy Territory<WOLFEN~1>
2007-03-24 22:46:27         0 d-------- C:\Documents and Settings\Piotr\.thumbnails<THUMBN~1>
2007-03-24 14:21:03         0 d-------- C:\Program Files\City Interactive<CITYIN~1>


-- Find3M Report ---------------------------------------------------------------

2007-04-24 21:57:36         0 d-------- C:\Program Files\FlashGet
2007-04-23 17:37:29         0 d--h----- C:\Program Files\InstallShield Installation Information<INSTAL~1>
2007-04-23 15:45:31         0 d-------- C:\Documents and Settings\Piotr\Dane aplikacji\gtk-2.0
2007-04-21 13:29:05         0 d-------- C:\Documents and Settings\Piotr\Dane aplikacji\THQ
2007-04-21 12:54:13         0 d---s---- C:\Documents and Settings\Piotr\Dane aplikacji\Microsoft<MICROS~1>
2007-04-21 11:41:52         0 d-------- C:\Documents and Settings\Piotr\Dane aplikacji\Acclaim Entertainment
2007-04-21 08:18:12         0 d-------- C:\Documents and Settings\Piotr\Dane aplikacji\MegauploadToolbar
2007-04-20 19:52:08         0 d-------- C:\Documents and Settings\Piotr\Dane aplikacji\Megaupload
2007-04-20 19:03:03    724992 --a------ C:\WINDOWS\iun6002.exe
2007-04-20 12:31:14    439194 --a------ C:\WINDOWS\system32\perfh015.dat
2007-04-20 12:31:14     68334 --a------ C:\WINDOWS\system32\perfc015.dat
2007-04-19 21:13:04         0 d-------- C:\Documents and Settings\Piotr\Dane aplikacji\Gadu-Gadu
2007-04-19 21:12:55         0 d-------- C:\Program Files\Gadu-Gadu<GADU-G~1>
2007-04-19 17:17:54         0 d-------- C:\Documents and Settings\Piotr\Dane aplikacji\Macromedia<MACROM~1>
2007-04-18 18:16:59    733824 --a------ C:\WINDOWS\system32\aswBoot.exe
2007-04-18 18:06:59     90112 --a------ C:\WINDOWS\system32\AVASTSS.scr
2007-04-07 14:38:17         0 d-------- C:\Documents and Settings\Piotr\Dane aplikacji\WNR
2007-04-07 14:23:53         0 d-------- C:\Documents and Settings\Piotr\Dane aplikacji\Hamachi
2007-04-07 12:38:58         0 d-------- C:\Documents and Settings\Piotr\Dane aplikacji\RapidGet
2007-04-06 22:41:54         0 d-------- C:\Program Files\Winamp
2007-04-05 19:32:55         0 d-------- C:\Program Files\EA SPORTS<EASPOR~1>
2007-04-03 18:38:13         0 d-------- C:\Program Files\The All-Seeing Eye<THEALL~1>
2007-04-03 18:00:33         0 d-------- C:\Documents and Settings\Piotr\Dane aplikacji\Skype
2007-04-01 12:44:07         0 d-------- C:\Documents and Settings\Piotr\Dane aplikacji\teamspeak2<TEAMSP~1>
2007-03-24 21:51:32         0 d-------- C:\Documents and Settings\Piotr\Dane aplikacji\GanymedeNet<GANYME~1>
2007-03-22 11:34:54         0 d-------- C:\Program Files\Java
2007-03-21 20:27:39         0 d-------- C:\Documents and Settings\Piotr\Dane aplikacji\Sun
2007-03-21 20:24:18         0 d-------- C:\Program Files\Common Files\Java
2007-03-21 19:09:02         0 d-------- C:\Program Files\GIMP-2.0
2007-03-21 15:46:06       965 --a------ C:\Documents and Settings\Piotr\Dane aplikacji\FolderPilot.dat<FOLDER~1.DAT>
2007-03-08 19:07:56         0 d-------- C:\Program Files\Ganymede
2007-03-08 15:04:16         0 d-------- C:\Documents and Settings\Piotr\Dane aplikacji\Leadertech<LEADER~1>
2007-03-07 16:38:32         0 d-------- C:\Documents and Settings\Piotr\Dane aplikacji\Lavasoft
2007-03-07 16:38:23         0 d-------- C:\Program Files\Lavasoft
2007-03-07 16:38:02         0 d-------- C:\Program Files\Common Files\Wise Installation Wizard<WISEIN~1>
2007-03-05 21:06:18     32179 ---hs---- C:\Program Files\Common Files\Yazzle1162OinUninstaller.exe<YAZZLE~2.EXE>
2007-02-07 19:29:14      4096 --a------ C:\WINDOWS\d3dx.dat
2007-02-03 11:37:21      1150 --a------ C:\WINDOWS\eReg.dat
2007-01-29 18:25:35    164352 --a------ C:\WINDOWS\epuninstall.exe<EPUNIN~1.EXE>


-- Registry Dump ---------------------------------------------------------------


[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run]
"CTFMON.EXE"="C:\\WINDOWS\\system32\\ctfmon.exe"
   

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\shellserviceobjectdelayload]
"UPnPMonitor"="{e57ce738-33e8-4c51-8354-bb4de9d215d1}"

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"CTFMON.EXE"="C:\\WINDOWS\\system32\\CTFMON.EXE"

[HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\run]
"CTFMON.EXE"="C:\\WINDOWS\\system32\\CTFMON.EXE"

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\0]
   Source   REG_SZ            http://poczta.interia.pl/actions/getAttachment.html?fid=1&mid=3_1IvW$6&mpid=4&f=shrek%25202%2520%2C18.jpg

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll"

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Svchost]
HTTPFilter   REG_MULTI_SZ      HTTPFilter\0\0
LocalService   REG_MULTI_SZ      Alerter\0WebClient\0LmHosts\0RemoteRegistry\0upnphost\0SSDPSRV\0\0
NetworkService   REG_MULTI_SZ      DnsCache\0\0
DcomLaunch   REG_MULTI_SZ      DcomLaunch\0TermService\0\0
rpcss   REG_MULTI_SZ      RpcSs\0\0
imgsvc   REG_MULTI_SZ      StiSvc\0\0
termsvcs   REG_MULTI_SZ      TermService\0\0



-- Hosts -----------------------------------------------------------------------

217.96.35.130 auto.search.msn.com


-- End of ComboScan: finished at 2007-04-24 at 21:58:04 ------------------------



[wojtas]

O1 - Hosts: 217.96.35.130 auto.search.msn.com
O3 - Toolbar: (no name) - {D3DEE18F-DB64-4BEB-9FF1-E1F0A5033E4A} - (no file)

skasuj:

potem ten plik:

C:\WINDOWS\epuninstall.exe

przeskanuj:

http://virusscan.jotti.org/
http://www.virustotal.com/

i powiedz czy cos znalazly

[Rsta92]

a ja miałem skasować ten plik epuistal.exe czy go przeskanować?

[wojtas]

czy go przeskanować?

przeskanuj i powiedz czy skanery cos wykryly

a skasuj te wpisy podane wyzej

[Rsta92]

No to mamy problem bo źle zrozumiałem twoje intencje i go skasowałem a po jego skasowaniu dopiero zastanawiałem się co mam przeksanować

[wojtas]

a moze w koszu bedzie ?? jesli tak to wrzuc na skanery

[Rsta92]

Kosz tak jakby z przyzwyczajenia odruchowo opróżniłem

[wojtas]

ok po poszukiwaniach w sieci okazalo sie ze ten plik to trojan:

Covert.Sys.Exec

czyli ok

[Rsta92]

Po prostu odruch mojej ręki wie co dla komputera jest dobre

[ Dodano: Dzisiaj o 22:38 ]
Ale i tak dalej mam problemy z łączem co chwile przestaje działac musze go wyłaczać i włączać by na chwilek zadziałało.

[wojtas]

Rsta92 ale po za tym w logu nic nie ma