prosze o sprawdzenie loga.

**Posty:** 22 · przez **matrix__15** 30 Lip 2007, 20:56

Witam. Mam problem, a mianowicie moj komputer kiedy sie wlacza chwile pracuje normalnie, a po paru sekundach ekran zmienia sie na niebieski, wyskakuje blad windowsa i komputer sie resetuje. Nie mam pojecia co sie stalo. Prosze o pomoc. Oto log :

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 20:47:19, on 2007-07-30 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Safe mode Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.onet.pl/ R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 165.228.128.11:80 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O4 - HKLM\..\Run: [mkstray] C:\Program Files\mks_vir_2007\bin\mkstray.exe O4 - HKLM\..\Run: [mks_mail] C:\Program Files\mks_vir_2007\bin\mks_mail.exe O4 - HKLM\..\Run: [WINDVDPatch] CTHELPER.EXE O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE O4 - HKLM\..\Run: [DevconDefaultDB] C:\WINDOWS\READREG /PSCONV={NO} /NO_DEFPS O4 - HKLM\..\Run: [ISUSPM Startup] "C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -startup O4 - HKLM\..\Run: [startdrv] C:\WINDOWS\Temp\startdrv.exe O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\PROGRA~1\Skype\Phone\IEPlugin\SKYPEI~1.DLL (file missing) O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O10 - Unknown file in Winsock LSP: c:\program files\mks_vir_2007\bin\\mkslsp.dll O10 - Unknown file in Winsock LSP: c:\program files\mks_vir_2007\bin\\mkslsp.dll O10 - Unknown file in Winsock LSP: c:\program files\mks_vir_2007\bin\\mkslsp.dll O10 - Unknown file in Winsock LSP: c:\program files\mks_vir_2007\bin\\mkslsp.dll O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O17 - HKLM\System\CCS\Services\Tcpip\..\{89D2FB17-CD10-4064-B8D9-6826BD9937AD}: NameServer = 194.204.159.1,194.204.152.34 O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE O23 - Service: MksPC - Unknown owner - C:\Program Files\mks_vir_2007\bin\MksPC.exe O23 - Service: MksUpdate - MKS Sp. z o. o. - C:\Program Files\mks_vir_2007\bin\mksupdate.exe O23 - Service: mks_vir file monitor (MksVirMonSvc) - Unknown owner - C:\Program Files\mks_vir_2007\bin\mksvirmonsvc.exe O23 - Service: MkS_Scan - Unknown owner - C:\Program Files\mks_vir_2007\bin\mks_scan.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcap\rpcapd.exe O23 - Service: Sandra Data Service (SandraDataSrv) - SiSoftware - C:\Program Files\SiSoftware\SiSoftware Sandra Lite 2007\Win32\RpcDataSrv.exe O23 - Service: Sandra Service (SandraTheSrv) - SiSoftware - C:\Program Files\SiSoftware\SiSoftware Sandra Lite 2007\RpcSandraSrv.exe O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe O23 - Service: VNC Server Version 4 (WinVNC4) - RealVNC Ltd. - C:\Program Files\RealVNC\VNC4\WinVNC4.exe -- End of file - 4646 bytes

**Posty:** 18165 · przez **wojtas** 30 Lip 2007, 21:31

skasuj wpis + pogrubiony wywal do kosza :

O4 - HKLM\..\Run: [startdrv] C:\WINDOWS\Temp\startdrv.exe

matrix__15 napisał(a):a po paru sekundach ekran zmienia sie na niebieski, wyskakuje blad windowsa i

pokaz screena lub przepisz kod bledu

**Posty:** 22 · przez **matrix__15** 30 Lip 2007, 21:47

Ok. Usuniete.... screen troche ciezko bedzie mi dodac bo ledwo sie to pokazuje to komputer sie restartuje .... ale to jest ten klasyczny blad windowsa takie niebieskie tlo biale napisy .... zaraz zedytuje ten post i dodam loga po usunieciu .. jak sie pojawi jeszcze ten blad to sprobuje przepisac kawalek

Edit :
Narazie wszystko gra. Zostawie kompa wlaczonego jak cos to bede jeszcze raz edytowal ten post. Dzieki za pomoc pozdro

**Posty:** 18165 · przez **wojtas** 30 Lip 2007, 21:50

Prawym na ,,Mój komputer">właściwości>Zakładka "Zaawansowane" -> Uruchamianie i odzyskiwanie i klikamy "ustawienia">
w części "Awaria systemu" odznaczamy pole "Automatycznie uruchom ponownie"

teraz powinien wyskoczyc niebieski ekran... przepisz kod bledu na dole oraz daj loga z hijacka i z combofixa

**Posty:** 22 · przez **matrix__15** 30 Lip 2007, 22:03

No niestety blad znowuj wyskoczyl. Przepisuje sam blad : DRWIVER_IRQL_NOT_LESS_OR_EQUAL

loga z hijacka i combofixa zaraz dodam jak zedytuje ten post.

Log z hijacka :

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 22:03, on 2007-07-30 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Safe mode Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\cmd.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.onet.pl/ R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 165.228.128.11:80 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O4 - HKLM\..\Run: [mkstray] C:\Program Files\mks_vir_2007\bin\mkstray.exe O4 - HKLM\..\Run: [mks_mail] C:\Program Files\mks_vir_2007\bin\mks_mail.exe O4 - HKLM\..\Run: [WINDVDPatch] CTHELPER.EXE O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE O4 - HKLM\..\Run: [DevconDefaultDB] C:\WINDOWS\READREG /PSCONV={NO} /NO_DEFPS O4 - HKLM\..\Run: [ISUSPM Startup] "C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -startup O4 - HKLM\..\Run: [startdrv] C:\WINDOWS\Temp\startdrv.exe O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\PROGRA~1\Skype\Phone\IEPlugin\SKYPEI~1.DLL (file missing) O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O10 - Unknown file in Winsock LSP: c:\program files\mks_vir_2007\bin\\mkslsp.dll O10 - Unknown file in Winsock LSP: c:\program files\mks_vir_2007\bin\\mkslsp.dll O10 - Unknown file in Winsock LSP: c:\program files\mks_vir_2007\bin\\mkslsp.dll O10 - Unknown file in Winsock LSP: c:\program files\mks_vir_2007\bin\\mkslsp.dll O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O17 - HKLM\System\CCS\Services\Tcpip\..\{89D2FB17-CD10-4064-B8D9-6826BD9937AD}: NameServer = 194.204.159.1,194.204.152.34 O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE O23 - Service: MksPC - Unknown owner - C:\Program Files\mks_vir_2007\bin\MksPC.exe O23 - Service: MksUpdate - MKS Sp. z o. o. - C:\Program Files\mks_vir_2007\bin\mksupdate.exe O23 - Service: mks_vir file monitor (MksVirMonSvc) - Unknown owner - C:\Program Files\mks_vir_2007\bin\mksvirmonsvc.exe O23 - Service: MkS_Scan - Unknown owner - C:\Program Files\mks_vir_2007\bin\mks_scan.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcap\rpcapd.exe O23 - Service: Sandra Data Service (SandraDataSrv) - SiSoftware - C:\Program Files\SiSoftware\SiSoftware Sandra Lite 2007\Win32\RpcDataSrv.exe O23 - Service: Sandra Service (SandraTheSrv) - SiSoftware - C:\Program Files\SiSoftware\SiSoftware Sandra Lite 2007\RpcSandraSrv.exe O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe O23 - Service: VNC Server Version 4 (WinVNC4) - RealVNC Ltd. - C:\Program Files\RealVNC\VNC4\WinVNC4.exe -- End of file - 4750 bytes

log z combofixa

Kod: Zaznacz wszystko: ComboFix 07-07-30.2 - "Mathew" 2007-07-30 22:04:13.1 [GMT 2:00] - NTFS [SAFE MODE] Microsoft Windows XP Home Edition 5.1.2600.2.1250.1.1045.18.Prawda (((((((((((((((((((((((((((((((((((((((((((( V Log ))))))))))))))))))))))))))))))))))))))))))))))))))))))) C:\WINDOWS\system32\winjks32.dll C:\WINDOWS\system32\oqstv.bak1 C:\WINDOWS\system32\oqstv.ini C:\WINDOWS\system32\opnmlij.dll C:\WINDOWS\system32\vtsqo.dll * * * POST RUN FILES/FOLDERS * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * C:\WINDOWS\system32\opnmlij.dll C:\WINDOWS\system32\vtsqo.dll ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) C:\d.exe C:\DOCUME~1\Mathew\Pulpit.\internet explorer.lnk C:\Documents and Settings\Mateusz\Ustawienia lokalne\Temporary Internet Files\Content.IE5\8D2H09SH\cnsminex[1].htm C:\WINDOWS\system32\1_exception.nls C:\WINDOWS\system32\drivers\asc3550u.sys C:\WINDOWS\system32\drivers\ip6fw.sys C:\WINDOWS\system32\drivers\runtime2.sy_ C:\WINDOWS\system32\drivers\runtime2.sys C:\WINDOWS\system32\koos.exe C:\WINDOWS\system32\kprof C:\WINDOWS\system32\poof C:\WINDOWS\system32\xpdx.sys ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) -------\LEGACY_ASC3550U -------\LEGACY_POOF -------\LEGACY_RUNTIME -------\LEGACY_RUNTIME2 -------\asc3550u -------\kprof -------\poof -------\runtime ((((((((((((((((((((((((( Files Created from 2007-06-28 to 2007-07-30 ))))))))))))))))))))))))))))))) 2007-07-30 22:03 51,200 --a------ C:\WINDOWS\nircmd.exe 2007-07-30 20:47 <DIR> d-------- C:\Program Files\Trend Micro 2007-07-30 20:01 228,960 --------- C:\WINDOWS\system32\vtsqo.dll 2007-07-28 19:43 54,328 --a------ C:\xjbmuatt.exe 2007-07-28 19:43 31,254 --------- C:\WINDOWS\system32\opnmlij.dll 2007-07-28 19:43 20,992 --a------ C:\rnep.exe 2007-07-28 19:43 1,536 --a------ C:\isygaao.exe 2007-07-28 19:06 <DIR> d-------- C:\Program Files\Xilisoft 2007-07-28 19:06 <DIR> d-------- C:\Program Files\QuickTime 2007-07-27 16:10 <DIR> d-------- C:\Program Files\Softick 2007-07-27 15:52 <DIR> d-------- C:\DOCUME~1\Mathew\DANEAP~1\TransRender 2007-07-27 15:52 <DIR> d-------- C:\DOCUME~1\Mathew\DANEAP~1\Temporary 2007-07-27 15:52 <DIR> d-------- C:\DOCUME~1\Mathew\DANEAP~1\Samsung 2007-07-27 15:52 <DIR> d-------- C:\DOCUME~1\Mathew\DANEAP~1\ConvertTemp 2007-07-27 15:42 174,592 --a------ C:\WINDOWS\system32\framedyn.dll 2007-07-27 15:41 94,000 --a------ C:\WINDOWS\system32\drivers\ss_mdm.sys 2007-07-27 15:41 8,304 --a------ C:\WINDOWS\system32\drivers\ss_mdfl.sys 2007-07-27 15:41 6,144 --a------ C:\WINDOWS\system32\drivers\ss_cmnt.sys 2007-07-27 15:41 6,144 --a------ C:\WINDOWS\system32\drivers\ss_cm.sys 2007-07-27 15:41 58,320 --a------ C:\WINDOWS\system32\drivers\ss_bus.sys 2007-07-27 15:41 5,808 --a------ C:\WINDOWS\system32\drivers\ss_whnt.sys 2007-07-27 15:41 5,808 --a------ C:\WINDOWS\system32\drivers\ss_wh.sys 2007-07-27 15:41 5,632 --a------ C:\WINDOWS\system32\drivers\StarOpen.sys 2007-07-27 15:41 <DIR> d-------- C:\WINDOWS\system32\Samsung_USB_Drivers 2007-07-27 15:40 <DIR> d-------- C:\Program Files\Samsung 2007-07-26 23:55 <DIR> d-------- C:\Moje dokumenty 2007-07-26 22:47 <DIR> d--hs---- C:\DOCUME~1\Mathew\Phone Browser 2007-07-26 22:45 <DIR> d-------- C:\DOCUME~1\Mathew\DANEAP~1\Nokia 2007-07-26 22:45 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\PC Suite 2007-07-26 22:44 <DIR> d-------- C:\Program Files\Common Files\PCSuite 2007-07-26 22:44 <DIR> d-------- C:\Program Files\Common Files\Nokia 2007-07-26 22:43 <DIR> d-------- C:\Program Files\PC Connectivity Solution 2007-07-26 22:43 <DIR> d-------- C:\Program Files\DIFX 2007-07-26 22:43 <DIR> d-------- C:\DOCUME~1\Mathew\DANEAP~1\PC Suite 2007-07-26 22:42 9,216 --a------ C:\WINDOWS\system32\drivers\nmwcdc.sys 2007-07-26 22:42 4,608 --a------ C:\WINDOWS\system32\nmwcdlog.dll 2007-07-26 22:42 30,720 --a------ C:\WINDOWS\system32\nmwcdcocls.dll 2007-07-26 22:42 138,240 --a------ C:\WINDOWS\system32\drivers\nmwcd.sys 2007-07-26 22:42 12,800 --a------ C:\WINDOWS\system32\drivers\nmwcdcm.sys 2007-07-26 22:42 12,800 --a------ C:\WINDOWS\system32\drivers\nmwcdcj.sys 2007-07-26 22:42 <DIR> d----c--- C:\WINDOWS\system32\DRVSTORE 2007-07-26 22:42 <DIR> d-------- C:\Program Files\Nokia 2007-07-26 22:41 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\Downloaded Installations 2007-07-26 16:27 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard 2007-07-26 16:22 73 --a------ C:\WINDOWS\system32\ssprs.dll 2007-07-26 16:22 467 --a------ C:\WINDOWS\system32\lsprst7.dll 2007-07-26 16:22 1,025 --a------ C:\WINDOWS\system32\sysprs7.dll 2007-07-26 16:22 1,025 --a------ C:\WINDOWS\system32\clauth2.dll 2007-07-26 16:22 1,025 --a------ C:\WINDOWS\system32\clauth1.dll 2007-07-26 16:19 53,248 --a------ C:\WINDOWS\system32\pvmediacomlib.dll 2007-07-26 16:19 360,448 --a------ C:\WINDOWS\system32\pvaactvx_lic.dll 2007-07-26 16:19 32,768 --a------ C:\WINDOWS\system32\PVPropertiesFile.dll 2007-07-26 16:19 32,768 --a------ C:\WINDOWS\system32\osclpthread.dll 2007-07-26 16:19 315,392 --a------ C:\WINDOWS\system32\AuthorStreamingEng.dll 2007-07-26 16:19 282,624 --a------ C:\WINDOWS\system32\pvevrc.dll 2007-07-26 16:19 28,672 --a------ C:\WINDOWS\system32\CALAUNCH.EXE 2007-07-26 16:19 258,048 --a------ C:\WINDOWS\system32\Qpl.dll 2007-07-26 16:19 24,576 --a------ C:\WINDOWS\system32\logger.dll 2007-07-26 16:19 24,576 --a------ C:\WINDOWS\system32\CAITF32.DLL 2007-07-26 16:19 188,416 --a------ C:\WINDOWS\system32\libisomedia.dll 2007-07-26 16:19 180,224 --a------ C:\WINDOWS\system32\ijl11.dll 2007-07-26 16:19 172,032 --a------ C:\WINDOWS\system32\pvmediacom_lic.dll 2007-07-26 16:19 <DIR> d-------- C:\WINDOWS\Rainbow Technologies 2007-07-26 16:19 <DIR> d-------- C:\Program Files\PacketVideo 2007-06-29 21:20 <DIR> d-------- C:\DOCUME~1\Mathew\DANEAP~1\HP 2007-06-29 21:16 <DIR> d-------- C:\Program Files\Common Files\Sonic Shared 2007-06-29 21:16 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\Sonic 2007-06-29 21:11 <DIR> d-------- C:\WINDOWS\system32\URTTEMP 2007-06-29 20:57 48,128 --a------ C:\WINDOWS\system32\hpz3l4pi.dll 2007-06-29 20:53 14,916 --------- C:\WINDOWS\hphmdl12.dat 2007-06-29 20:53 127,243 --a------ C:\WINDOWS\HPHins12.dat 2007-06-28 23:03 68,664 --a------ C:\WINDOWS\system32\ympguninst.exe 2007-06-28 23:03 <DIR> d-------- C:\ympgsdk 2007-06-28 22:55 <DIR> d-------- C:\Program Files\Webteh 2007-06-28 22:55 <DIR> d-------- C:\DOCUME~1\Mathew\DANEAP~1\BSplayer Pro 2007-06-28 22:55 <DIR> d-------- C:\DOCUME~1\Mathew\DANEAP~1\BSplayer 2007-06-28 22:46 737,280 --a------ C:\WINDOWS\iun6002.exe 2007-06-28 22:46 <DIR> d-------- C:\Program Files\Codec Pack - All In 1 2007-06-24 19:26 <DIR> d-------- C:\Program Files\DAEMON Tools 2007-06-24 19:23 682,232 --a------ C:\WINDOWS\system32\drivers\sptd.sys 2007-06-22 11:22 <DIR> d-------- C:\Program Files\MoorHunt 2007-06-21 19:53 <DIR> d-------- C:\Program Files\Peer2Mail 2007-06-13 21:04 <DIR> d-------- C:\DOCUME~1\Emilia\DANEAP~1\Ahead 2007-06-10 18:37 <DIR> d-------- C:\Program Files\Common Files\HP 2007-06-10 18:32 <DIR> d-------- C:\Program Files\Hewlett-Packard 2007-06-10 18:29 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\HP 2007-06-10 18:26 49,920 --a------ C:\WINDOWS\system32\drivers\HPZid412.sys 2007-06-10 18:26 16,496 -ra------ C:\WINDOWS\system32\drivers\HPZipr12.sys 2007-06-10 18:25 37,376 --a------ C:\WINDOWS\system32\hpz3l3xu.dll 2007-06-10 18:24 94,208 --a------ C:\WINDOWS\system32\HPZipt12.dll 2007-06-10 18:24 69,632 --a------ C:\WINDOWS\system32\HPZipm12.exe 2007-06-10 18:24 65,536 --a------ C:\WINDOWS\system32\HPZinw12.exe 2007-06-10 18:24 57,344 --a------ C:\WINDOWS\system32\HPZisn12.dll 2007-06-10 18:24 282,680 --a------ C:\WINDOWS\system32\HPZidr12.dll 2007-06-10 18:24 204,800 --a------ C:\WINDOWS\system32\HPZipr12.dll 2007-06-10 18:23 <DIR> d-------- C:\Program Files\HP 2007-06-10 18:21 81,545 --a------ C:\WINDOWS\hpfins05.dat 2007-06-10 18:21 1,350 --------- C:\WINDOWS\hpfmdl05.dat 2007-06-10 18:20 <DIR> d-------- C:\DOCUME~1\Emilia\DANEAP~1\HP 2007-06-10 18:01 25,856 --a------ C:\WINDOWS\system32\drivers\usbprint.sys (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) 2007-07-27 15:40 --------- d--h----- C:\Program Files\InstallShield Installation Information 2007-07-10 23:17 80642 --a------ C:\WINDOWS\system32\perfc015.dat 2007-07-10 23:17 460446 --a------ C:\WINDOWS\system32\perfh015.dat 2007-06-19 15:45 --------- d-------- C:\Program Files\WinPcap 2007-06-18 22:35 --------- d-------- C:\Program Files\mks_vir_2007 2007-05-29 21:08 --------- d-------- C:\Program Files\Librus 2007-05-16 17:18 683520 --a------ C:\WINDOWS\system32\inetcomm.dll 2007-03-16 15:10:04 952 --sha-w C:\WINDOWS\system32\KGyGaAvL.sys ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{05D51201-1234-4836-A09F-008C97412780}] 2007-07-30 20:01 228960 --------- C:\WINDOWS\system32\vtsqo.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{5A4A2D56-931A-4733-9121-033A2D95A274}] 2007-07-28 19:43 31254 --------- C:\WINDOWS\system32\opnmlij.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "mkstray"="C:\Program Files\mks_vir_2007\bin\mkstray.exe" [2007-07-08 22:58] "mks_mail"="C:\Program Files\mks_vir_2007\bin\mks_mail.exe" [2007-03-13 17:57] "WINDVDPatch"="CTHELPER.EXE" [2002-07-02 18:56 C:\WINDOWS\system32\CTHELPER.EXE] "ISUSPM Startup"="C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" [2005-08-11 17:30] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Gadu-Gadu"="C:\Program Files\Gadu-Gadu\gg.exe" [2007-01-30 16:58] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 14:00] [HKEY_USERS\.default\software\microsoft\windows\currentversion\run] "PcSync"=C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks] "{5A4A2D56-931A-4733-9121-033A2D95A274}"= C:\WINDOWS\system32\opnmlij.dll [2007-07-28 19:43 31254] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\opnmlij] opnmlij.dll 2007-07-28 19:43 31254 C:\WINDOWS\system32\opnmlij.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\vtsqo] C:\WINDOWS\system32\vtsqo.dll 2007-07-30 20:01 228960 C:\WINDOWS\system32\vtsqo.dll [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MkS_Scan] @="service" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Adobe Reader Speed Launch.lnk] path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Adobe Reader Speed Launch.lnk backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^HP Digital Imaging Monitor.lnk] path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\HP Digital Imaging Monitor.lnk backup=C:\WINDOWS\pss\HP Digital Imaging Monitor.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^HP Photosmart Premier - Szybkie uruchomienie.lnk] path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\HP Photosmart Premier - Szybkie uruchomienie.lnk backup=C:\WINDOWS\pss\HP Photosmart Premier - Szybkie uruchomienie.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^QuickTV.lnk] path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\QuickTV.lnk backup=C:\WINDOWS\pss\QuickTV.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AudioHQ] C:\Program Files\Creative\SBLive2k\AudioHQ\AHQTB.EXE [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Creative Launcher] C:\Program Files\Creative\SBLive2k\Launcher\CTLauncher.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033 [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Jet Detection] "C:\Program Files\Creative\SBLive\PROGRAM\ADGJDet.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\kX Mixer] kxmixer --startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NewsUpd] C:\Program Files\Creative\News\NewsUpd.EXE /q [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCSuiteTrayApplication] C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoftickPPP] "C:\Program Files\Softick\PPP\Bin\PPPGate.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe" R0 viadsk;viadsk;C:\WINDOWS\system32\DRIVERS\viadsk.sys R1 StarOpen;StarOpen;C:\WINDOWS\system32\drivers\StarOpen.sys R2 MksPC;MksPC;"C:\Program Files\mks_vir_2007\bin\MksPC.exe" R2 MksUpdate;MksUpdate;"C:\Program Files\mks_vir_2007\bin\mksupdate.exe" R3 Cap7134;Cap7134 Capture;C:\WINDOWS\system32\DRIVERS\Cap7134.sys R3 MksMonEn;MksMonEn;\??\C:\Program Files\mks_vir_2007\bin\MksMonEn.sys R3 MksMonEv;MksMonEv;\??\C:\Program Files\mks_vir_2007\bin\MksMonEv.sys R3 MksMonFd;MksMonFd;\??\C:\Program Files\mks_vir_2007\bin\MksMonFd.sys R3 PhTVTune;Cap7134 TVTuner;C:\WINDOWS\system32\DRIVERS\PhTVTune.sys R3 USBSTOR;Sterownik magazynu masowego USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS S3 ctljystk;Port gier dla karty Creative SB Live!;C:\WINDOWS\system32\DRIVERS\ctljystk.sys S3 kxwdmdrv;kX WDM Driver Service;C:\WINDOWS\system32\drivers\kx.sys S3 nm;Sterownik monitora sieci;C:\WINDOWS\system32\DRIVERS\NMnt.sys S3 Nokia USB Generic;Nokia USB Generic;C:\WINDOWS\system32\drivers\nmwcdc.sys S3 Nokia USB Modem;Nokia USB Modem;C:\WINDOWS\system32\drivers\nmwcdcm.sys S3 Nokia USB Phone Parent;Nokia USB Phone Parent;C:\WINDOWS\system32\drivers\nmwcd.sys S3 Nokia USB Port;Nokia USB Port;C:\WINDOWS\system32\drivers\nmwcdcj.sys S3 SANDRA;SANDRA;\??\C:\Program Files\SiSoftware\SiSoftware Sandra Lite 2007\Sandra.sys S3 ss_bus;SAMSUNG Mobile USB Device 1.0 driver (WDM);C:\WINDOWS\system32\DRIVERS\ss_bus.sys S3 ss_mdfl;SAMSUNG Mobile USB Modem 1.0 Filter;C:\WINDOWS\system32\DRIVERS\ss_mdfl.sys S3 ss_mdm;SAMSUNG Mobile USB Modem 1.0 Drivers;C:\WINDOWS\system32\DRIVERS\ss_mdm.sys S3 usbscan;Sterownik skanera USB;C:\WINDOWS\system32\DRIVERS\usbscan.sys S3 WMIBIOS;%WMIBIOS.ServiceName%;C:\WINDOWS\system32\Drivers\wmibios.sys S3 WMIINFO;WMIINFO Driver;C:\WINDOWS\system32\Drivers\wmiinfo.sys S4 MksFwall;MksFwall;"C:\Program Files\mks_vir_2007\bin\MksFwall.exe" S4 mksfwallf;mksfwallf;\??\C:\WINDOWS\system32\mksfwallf.sys S4 mksfwallt;mksfwallt;\??\C:\WINDOWS\system32\mksfwallt.sys S4 mksidsa;mksidsa;C:\WINDOWS\system32\mksidsa.sys S4 mksidsf;mksidsf;\??\C:\WINDOWS\system32\mksidsf.sys Contents of the 'Scheduled Tasks' folder 2007-07-30 18:00:00 C:\WINDOWS\Tasks\HPpromotions journeysoftware.job - C:\Program Files\hp\digital imaging\bin\hp promotions\journeysoftware\HPpromo.exe ************************************************************************** catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-07-30 22:09:21 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... scanning hidden registry entries ... [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\A\1\5\1c] "Order"=hex:08,00,00,00,02,00,00,00,48,04,00,00,01,00,00,00,0a,00,00,00,7a,.. scanning hidden files ... ************************************************************************** Completion time: 2007-07-30 22:12:56 - machine was rebooted C:\ComboFix-quarantined-files.txt ... 2007-07-30 22:11 --- E O F ---

**Posty:** 18165 · przez **wojtas** 31 Lip 2007, 10:54

Pobierz i uruchom narzędzie
The Avenger
Zaznacz opcję Input script manually i kliknij na Lupkę z prawej strony. W okienku, które się otworzy wklejasz:

Files to delete:

C:\WINDOWS\system32\opnmlij.dll
C:\WINDOWS\Temp\startdrv.exe
C:\WINDOWS\system32\vtsqo.dll
C:\isygaao.exe
C:\WINDOWS\system32\framedyn.dll
C:\xjbmuatt.exe
C:\WINDOWS\system32\ympguninst.exe

Folders to delete:

C:\ympgsdk

Klikasz Done, a następnie zielone światełko i zgadzasz się na restart klikając OK.
Po restarcie w HijackThis usuwasz wpis/y

O4 - HKLM\..\Run: [startdrv] C:\WINDOWS\Temp\startdrv.exe

potem wklejasz do notatnika:

Windows Registry Editor Version 5.00

[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{05D51201-1234-4836-A09F-008C97412780}]

[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{5A4A2D56-931A-4733-9121-033A2D95A274}]

[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\opnmlij]

[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\vtsqo]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{5A4A2D56-931A-4733-9121-033A2D95A274}"=-

w notatniku u góry>>>plik zapisz jako>>>Zmien rozszerzenie z TXT na Wszystkie pliki *.* >>> Zapisz pod nazwą FIX.REG

Klikasz dwa razy na powstały plik fix i dodajesz go do rejestru....

potem nowe logi

prosze o sprawdzenie loga.

Prosze o sprawdzenie loga.

Kto jest na forum