prosze o sprawdzenie loga

**Posty:** 8079 · przez **kajtekjr** 10 Wrz 2007, 22:05

Witam

Dawno nie pisałem w tym dziale ale przyszedł na to czas..

Ale przejdzmy do sedna..

nie moge odpalic painta, w autostarcie pojawiły sie programy "1.exe" oraz "2.exe", w msconfigu zobaczyłem ze z systemem startuja programy takie jak: spoolsv2.exe i wsusupd.exe ktorych nie było wczesniej!
Ponizej daje logi moze to cos mało powaznego ale eMule mi nie chodzi tak jak poinien i musi zostac to naprawione takze prosze was o pomoc

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 21:50:15, on 2007-09-10 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\csrss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe C:\WINDOWS\Explorer.EXE C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\wdfmgr.exe C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe C:\WINDOWS\system32\nvraidservice.exe C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe C:\Program Files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe C:\WINDOWS\system32\Rundll32.exe C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe C:\WINDOWS\System32\wbem\wmiprvse.exe C:\Program Files\A4Tech\Mouse\Amoumain.exe C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb08.exe C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe C:\WINDOWS\system32\RUNDLL32.EXE C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Messenger\msmsgs.exe C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe C:\WINDOWS\System32\wbem\unsecapp.exe C:\WINDOWS\System32\alg.exe C:\WINDOWS\system32\wscntfy.exe D:\Tlen.pl\tlen.exe C:\WINDOWS\system32\wuauclt.exe C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe C:\Program Files\Opera\Opera.exe C:\WINDOWS\retadpu.exe c:\fawcci.exe c:\wsusupd.exe C:\WINDOWS\system32\svchost.exe c:\windows\system32\spoolsv2.exe C:\WINDOWS\retadpu1000106.exe C:\Program Files\Network Monitor\netmon.exe C:\WINDOWS\RmlsaXBpYWs\command.exe C:\Documents and Settings\Admin\Pulpit\HiJackThis.exe C:\WINDOWS\System32\wbem\wmiprvse.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: 0 - {25DBDCC4-F293-4619-F689-BD29146FC85C} - C:\Program Files\MSN\lawunegi.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll O4 - HKLM\..\Run: [NVRaidService] C:\WINDOWS\system32\nvraidservice.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe" O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe /r O4 - HKLM\..\Run: [P17Helper] Rundll32 P17.dll,P17Helper O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [WheelMouse] C:\Program Files\A4Tech\Mouse\Amoumain.exe O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb08.exe O4 - HKLM\..\Run: [DeviceDiscovery] C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe O4 - HKLM\..\Run: [ShareSearcher] c:\wsusupd.exe O4 - HKLM\..\Run: [runner1] C:\WINDOWS\retadpu1000106.exe 61A847B5BBF72813329B385772FF01F0B3E35B6638993F4661AA4EBD86D67C56389B284534F310 O4 - HKLM\..\Run: [hosy] C:\Program Files\Windows NT\hosy22011.exe O4 - HKLM\..\Run: [SvcManager] spoolsv2.exe O4 - HKLM\..\Run: [startdrv] C:\WINDOWS\Temp\startdrv.exe O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user') O4 - Global Startup: 1.exe O4 - Global Startup: 2.exe O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O8 - Extra context menu item: Pobierz z &BitSpirit - E:\BitSpirit\bsurl.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O17 - HKLM\System\CCS\Services\Tcpip\..\{731CA0E3-F3E2-4F8E-97D4-AB024B7E358F}: NameServer = 194.204.159.1 217.98.63.164 O20 - Winlogon Notify: rpcc - C:\WINDOWS\system32\rpcc.dll O23 - Service: Command Service (cmdService) - Unknown owner - C:\WINDOWS\RmlsaXBpYWs\command.exe O23 - Service: ForceWare Intelligent Application Manager (IAM) - Unknown owner - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe O23 - Service: Forceware Web Interface (ForcewareWebInterface) - Apache Software Foundation - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe O23 - Service: hpdj - HP - C:\DOCUME~1\Admin\USTAWI~1\Temp\hpdj.exe O23 - Service: Network Monitor - Unknown owner - C:\Program Files\Network Monitor\netmon.exe O23 - Service: ForceWare IP service (nSvcIp) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe O23 - Service: ForceWare user log service (nSvcLog) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O24 - Desktop Component 0: (no name) - C:\Program Files\MSN\progycazy.html -- End of file - 7255 bytes

Kod: Zaznacz wszystko: "Silent Runners.vbs", revision 52, http://www.silentrunners.org/ Operating System: Windows XP SP2 Output limited to non-default values, except where indicated by "{++}" Startup items buried in registry: --------------------------------- HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ {++} "CTFMON.EXE" = "C:\WINDOWS\system32\ctfmon.exe" [MS] "MSMSGS" = ""C:\Program Files\Messenger\msmsgs.exe" /background" [MS] "Gadu-Gadu" = ""C:\Program Files\Gadu-Gadu\gg.exe" /tray" ["Gadu-Gadu S.A."] HKLM\Software\Microsoft\Windows\CurrentVersion\Run\ {++} "NVRaidService" = "C:\WINDOWS\system32\nvraidservice.exe" ["NVIDIA Corporation"] "SunJavaUpdateSched" = ""C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe"" ["Sun Microsystems, Inc."] "CTSysVol" = "C:\Program Files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe /r" ["Creative Technology Ltd"] "P17Helper" = "Rundll32 P17.dll,P17Helper" [MS] "UpdReg" = "C:\WINDOWS\UpdReg.EXE" ["Creative Technology Ltd."] "SpeedTouch USB Diagnostics" = ""C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon" ["THOMSON Telecom Belgium"] "NeroFilterCheck" = "C:\WINDOWS\system32\NeroCheck.exe" ["Ahead Software Gmbh"] "WheelMouse" = "C:\Program Files\A4Tech\Mouse\Amoumain.exe" ["A4Tech Co., Ltd."] "RemoteControl" = ""C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"" ["Cyberlink Corp."] "Share-to-Web Namespace Daemon" = "C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe" ["Hewlett-Packard"] "HP Software Update" = "C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe" [file not found] "HPDJ Taskbar Utility" = "C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb08.exe" ["HP"] "DeviceDiscovery" = "C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe" ["Hewlett-Packard"] "NvCplDaemon" = "RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup" [MS] "nwiz" = "nwiz.exe /install" ["NVIDIA Corporation"] "NvMediaCenter" = "RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit" [MS] "WinampAgent" = "C:\Program Files\Winamp\winampa.exe" [null data] "ShareSearcher" = "c:\wsusupd.exe" [null data] "runner1" = "C:\WINDOWS\retadpu1000106.exe 61A847B5BBF72813329B385772FF01F0B3E35B6638993F4661AA4EBD86D67C56389B284534F310" [empty string] "hosy" = "C:\Program Files\Windows NT\hosy22011.exe" [null data] "SvcManager" = "spoolsv2.exe" [null data] "startdrv" = "C:\WINDOWS\Temp\startdrv.exe" [null data] HKLM\Software\Microsoft\Active Setup\Installed Components\ {89B4C1CD-B018-4511-B0A1-5476DBF70820}\(Default) = (no title provided) \StubPath = "C:\WINDOWS\system32\Rundll32.exe C:\WINDOWS\system32\mscories.dll,Install" [MS] HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\(Default) = (no title provided) -> {HKLM...CLSID} = "AcroIEHlprObj Class" \InProcServer32\(Default) = "C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll" ["Adobe Systems Incorporated"] {25DBDCC4-F293-4619-F689-BD29146FC85C}\(Default) = "0" -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "C:\Program Files\MSN\lawunegi.dll" [null data] {761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\(Default) = (no title provided) -> {HKLM...CLSID} = "SSVHelper Class" \InProcServer32\(Default) = "C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll" ["Sun Microsystems, Inc."] HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\ "{42071714-76d4-11d1-8b24-00a0c9068ff3}" = "Rozszerzenie CPL kadrowania wyświetlania" -> {HKLM...CLSID} = "Rozszerzenie CPL kadrowania wyświetlania" \InProcServer32\(Default) = "deskpan.dll" [file not found] "{88895560-9AA2-1069-930E-00AA0030EBC8}" = "Rozszerzenie ikony HyperTerminalu" -> {HKLM...CLSID} = "HyperTerminal Icon Ext" \InProcServer32\(Default) = "C:\WINDOWS\System32\hticons.dll" ["Hilgraeve, Inc."] "{cc86590a-b60a-48e6-996b-41d25ed39a1e}" = "Portable Media Devices Menu" -> {HKLM...CLSID} = "Portable Media Devices Menu" \InProcServer32\(Default) = "C:\WINDOWS\system32\Audiodev.dll" [MS] "{A4DF5659-0801-4A60-9607-1C48695EFDA9}" = "Folder przesyłania Share-to-Web" -> {HKLM...CLSID} = "Folder przesyłania Share-to-Web" \InProcServer32\(Default) = "C:\Program Files\Hewlett-Packard\HP Share-to-Web\HPGS2WNS.DLL" ["Hewlett-Packard"] "{A70C977A-BF00-412C-90B7-034C51DA2439}" = "NvCpl DesktopContext Class" -> {HKLM...CLSID} = "DesktopContext Class" \InProcServer32\(Default) = "C:\WINDOWS\system32\nvcpl.dll" ["NVIDIA Corporation"] "{FFB699E0-306A-11d3-8BD1-00104B6F7516}" = "Play on my TV helper" -> {HKLM...CLSID} = "NVIDIA CPL Extension" \InProcServer32\(Default) = "C:\WINDOWS\system32\nvcpl.dll" ["NVIDIA Corporation"] "{1CDB2949-8F65-4355-8456-263E7C208A5D}" = "Desktop Explorer" -> {HKLM...CLSID} = "Desktop Explorer" \InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"] "{1E9B04FB-F9E5-4718-997B-B8DA88302A47}" = "Desktop Explorer Menu" -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"] "{1E9B04FB-F9E5-4718-997B-B8DA88302A48}" = "nView Desktop Context Menu" -> {HKLM...CLSID} = "nView Desktop Context Menu" \InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"] "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" = "WinRAR shell extension" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ <<!>> rpcc\DLLName = "C:\WINDOWS\system32\rpcc.dll" [null data] HKLM\Software\Classes\Folder\shellex\ColumnHandlers\ {F9DB5320-233E-11D1-9F84-707F02C10627}\(Default) = "PDF Column Info" -> {HKLM...CLSID} = "PDF Shell Extension" \InProcServer32\(Default) = "C:\Program Files\Adobe\Acrobat 7.0\ActiveX\PDFShell.dll" ["Adobe Systems, Inc."] HKLM\Software\Classes\*\shellex\ContextMenuHandlers\ WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\ WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\ WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] Group Policies {GPedit.msc branch and setting}: ----------------------------------------------- Note: detected settings may not have any effect. HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\ "shutdownwithoutlogon" = (REG_DWORD) hex:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| Shutdown: Allow system to be shut down without having to log on} "undockwithoutlogon" = (REG_DWORD) hex:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| Devices: Allow undock without having to log on} Active Desktop and Wallpaper: ----------------------------- Active Desktop may be enabled at this entry: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState Displayed if Active Desktop enabled and wallpaper not set by Group Policy: HKCU\Software\Microsoft\Internet Explorer\Desktop\General\ "Wallpaper" = "C:\WINDOWS\web\wallpaper\Idylla.bmp" Displayed if Active Desktop disabled and wallpaper not set by Group Policy: HKCU\Control Panel\Desktop\ "Wallpaper" = "C:\WINDOWS\web\wallpaper\Idylla.bmp" Active Desktop web content (hidden if disabled): HKCU\Software\Microsoft\Internet Explorer\Desktop\Components\0\ "FriendlyName" = "" "Source" = "C:\Program Files\MSN\progycazy.html" "SubscribedURL" = "" Enabled Screen Saver: --------------------- HKCU\Control Panel\Desktop\ "SCRNSAVE.EXE" = "C:\WINDOWS\System32\logon.scr" [MS] Startup items in "Admin" & "All Users" startup folders: ------------------------------------------------------- C:\Documents and Settings\All Users\Menu Start\Programy\Autostart <<!>> "1.exe" [empty string] <<!>> "2.exe" [null data] "Adobe Reader Speed Launch" -> shortcut to: "C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe" ["Adobe Systems Incorporated"] Winsock2 Service Provider DLLs: ------------------------------- Namespace Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++} 000000000001\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS] 000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS] 000000000003\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS] Transport Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++} 0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range: %SYSTEMROOT%\system32\nvappfilter.dll ["NVIDIA"], 01 - 03, 09 %SystemRoot%\system32\mswsock.dll [MS], 04 - 06, 10 - 21 %SystemRoot%\system32\rsvpsp.dll [MS], 07 - 08 Toolbars, Explorer Bars, Extensions: ------------------------------------ Extensions (Tools menu items, main toolbar menu buttons) HKLM\Software\Microsoft\Internet Explorer\Extensions\ {08B0E5C0-4FCB-11CF-AAA5-00401C608501}\ "MenuText" = "Sun Java Console" "CLSIDExtension" = "{CAFEEFAC-0015-0000-0009-ABCDEFFEDCBC}" -> {HKCU...CLSID} = "Java Plug-in 1.5.0_09" \InProcServer32\(Default) = "C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll" ["Sun Microsystems, Inc."] -> {HKLM...CLSID} = "Java Plug-in 1.5.0_09" \InProcServer32\(Default) = "C:\Program Files\Java\jre1.5.0_09\bin\npjpi150_09.dll" ["Sun Microsystems, Inc."] {FB5F1910-F110-11D2-BB9E-00C04F795683}\ "ButtonText" = "Messenger" "MenuText" = "Windows Messenger" "Exec" = "C:\Program Files\Messenger\msmsgs.exe" [MS] Running Services (Display Name, Service Name, Path {Service DLL}): ------------------------------------------------------------------ .NET Runtime Optimization Service v2.0.50727_X86, clr_optimization_v2.0.50727_32, "C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe" [MS] Command Service, cmdService, "C:\WINDOWS\RmlsaXBpYWs\command.exe" [null data] ForceWare Intelligent Application Manager (IAM), ForceWare Intelligent Application Manager (IAM), "C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe" [empty string] ForceWare IP service, nSvcIp, "C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe" ["NVIDIA Corporation"] ForceWare user log service, nSvcLog, "C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe" ["NVIDIA Corporation"] Forceware Web Interface, ForcewareWebInterface, ""C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe" -k runservice" ["Apache Software Foundation"] Network Monitor, Network Monitor, "C:\Program Files\Network Monitor\netmon.exe service" [null data] NVIDIA Display Driver Service, NVSvc, "C:\WINDOWS\system32\nvsvc32.exe" ["NVIDIA Corporation"] Windows User Mode Driver Framework, UMWdf, "C:\WINDOWS\system32\wdfmgr.exe" [MS] Print Monitors: --------------- HKLM\System\CurrentControlSet\Control\Print\Monitors\ hpzsnt08\Driver = "hpzsnt08.dll" ["HP"] ---------- (launch time: 2007-09-10 21:59:56) <<!>>: Suspicious data at a malware launch point. + This report excludes default entries except where indicated. + To see *everywhere* the script checks and *everything* it finds, launch it from a command prompt or a shortcut with the -all parameter. + To search all directories of local fixed drives for DESKTOP.INI DLL launch points, use the -supp parameter or answer "No" at the first message box and "Yes" at the second message box. ---------- (total run time: 111 seconds, including 89 seconds for message boxes)

**Posty:** 18165 · przez **wojtas** 10 Wrz 2007, 22:49

w awaryjnym z wylaczonym przywracaniem:

start -> uruchom -> services.msc -> zatrzymaj i wyłącz usługe Network Monitor oraz Command Service
Otwórz hijackthis -> open misc tools section -> delete a NT service -> wpisz cmdService i ok

C:\WINDOWS\retadpu.exe
c:\fawcci.exe
O4 - HKLM\..\Run: [ShareSearcher] c:\wsusupd.exe
O4 - HKLM\..\Run: [runner1] C:\WINDOWS\retadpu1000106.exe 61A847B5BBF72813329B385772FF01F0B3E35B6638993F4661AA4EBD86D67C56389B284534F310
O4 - HKLM\..\Run: [hosy] C:\Program Files\Windows NT\hosy22011.exe
O4 - HKLM\..\Run: [SvcManager] spoolsv2.exe
O4 - HKLM\..\Run: [startdrv] C:\WINDOWS\Temp\startdrv.exe
O4 - Global Startup: 1.exe
O4 - Global Startup: 2.exe
O20 - Winlogon Notify: rpcc - C:\WINDOWS\system32\rpcc.dll
O23 - Service: Command Service (cmdService) - Unknown owner - C:\WINDOWS\RmlsaXBpYWs\command.exe
O23 - Service: hpdj - HP - C:\DOCUME~1\Admin\USTAWI~1\Temp\hpdj.exe
O23 - Service: Network Monitor - Unknown owner - C:\Program Files\Network Monitor\netmon.exe

najpierw wpisy + pogrubione do kosza potem nowy log z hijacka oraz combofixa

**Posty:** 237 · przez **Kuba1** 10 Wrz 2007, 23:44

Oba poniższe narzędzia zastosuj w trybie awaryjnym.

Zastosuj dodatkowo SmitFraudFix z opcji nr 2, oraz:

Pobierz narzędzie SDFix

*Klikamy 2 krotknie na ikonę SDFix.exe,program wypakuje się domyślnie do lokalizacji C:\SDFix

*Wchodzimy do trybu awaryjnego z obsługą sieci:
>>>>>>Jak wejść do trybu awaryjnego z obsługą sieci?

*F8 podczas bootowania systemu.
*Używamy narzędzia BootSafe.exe zaznaczamy opcje Safe Mode- Networking i klikamy reboot

*Gdy już jesteśmy w trybie awaryjnym,wchodzimy do folderu SDFix i uruchamiamy narzędzie klikająć
2-krotnie na plik RunThis.bat lewym przyciskiem myszy.

*Wciskamy Y co uruchomi proces usuwania

*Kiedy proces usuwania się zakończy wciskamy dowolny klawisz>>nastąpi restart.

*Po restarcie SDFix dokończy proces usuwania,kiedy w oknie narzędzia SDFix pojawi się napis Finished
klikamy dowolny klawisz,narzędzie zakończy swoją pracę,na pulpicie załadują się ikony.

*Wchodzimy do folderu SDFix i kopiujemy zawartość pliku tekstowego Report.txt i wklejamy go na forum

**Posty:** 8079 · przez **kajtekjr** 11 Wrz 2007, 20:05

skonczyło sie formatem..

..nie mogłem uruchomic trybu awaryjnego

EOT

**Posty:** 3854 · przez **Dzi@dek** 11 Wrz 2007, 20:38

kajtekjr napisał(a):nie mogłem uruchomic trybu awaryjnego

Twoja sprawa-ale uruchomienie trybu awaryjnego nie kończy się na F8

[ Dodano: Dzisiaj o 22:28 ]
Zapodaj logi.

**Posty:** 8079 · przez **kajtekjr** 11 Wrz 2007, 22:34

Znalezione pliki przez anty wira byly zarazone czyms takim W32/Virut.R i byly to mniedzy innymi exeki od eMule oraz kilku gier...

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 22:27:44, on 2007-09-11 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\System32\nvsvc32.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\RUNDLL32.EXE C:\WINDOWS\System32\nvraidservice.exe C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe C:\Program Files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe C:\WINDOWS\system32\Rundll32.exe C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb08.exe C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe C:\WINDOWS\system32\ctfmon.exe C:\WINDOWS\System32\wbem\unsecapp.exe C:\Program Files\Opera\Opera.exe C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe D:\Tlen.pl\tlen.exe C:\Program Files\Avira\AntiVir PersonalEdition Classic\avcenter.exe C:\Documents and Settings\Administrator\Pulpit\HiJackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [NVRaidService] C:\WINDOWS\System32\nvraidservice.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe /r O4 - HKLM\..\Run: [P17Helper] Rundll32 P17.dll,P17Helper O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb08.exe O4 - HKLM\..\Run: [DeviceDiscovery] C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user') O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\npjpi160_02.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\npjpi160_02.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O17 - HKLM\System\CCS\Services\Tcpip\..\{EE1561A6-E697-45F2-8A6A-80D3D9C7BA41}: NameServer = 194.204.159.1 217.98.63.164 O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe O23 - Service: hpdj - HP - C:\DOCUME~1\ADMINI~1\USTAWI~1\Temp\hpdj.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe -- End of file - 5211 bytes

Kod: Zaznacz wszystko: "Silent Runners.vbs", revision 52, http://www.silentrunners.org/ Operating System: Windows XP SP2 Output limited to non-default values, except where indicated by "{++}" Startup items buried in registry: --------------------------------- HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ {++} "CTFMON.EXE" = "C:\WINDOWS\system32\ctfmon.exe" [MS] "MSMSGS" = ""C:\Program Files\Messenger\msmsgs.exe" /background" [MS] "Gadu-Gadu" = ""C:\Program Files\Gadu-Gadu\gg.exe" /tray" ["Gadu-Gadu S.A."] HKLM\Software\Microsoft\Windows\CurrentVersion\Run\ {++} "NvCplDaemon" = "RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup" [MS] "nwiz" = "nwiz.exe /install" ["NVIDIA Corporation"] "NvMediaCenter" = "RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit" [MS] "NVRaidService" = "C:\WINDOWS\System32\nvraidservice.exe" ["NVIDIA Corporation"] "SunJavaUpdateSched" = ""C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"" ["Sun Microsystems, Inc."] "NeroFilterCheck" = "C:\WINDOWS\system32\NeroCheck.exe" ["Ahead Software Gmbh"] "CTSysVol" = "C:\Program Files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe /r" ["Creative Technology Ltd"] "P17Helper" = "Rundll32 P17.dll,P17Helper" [MS] "UpdReg" = "C:\WINDOWS\UpdReg.EXE" ["Creative Technology Ltd."] "Share-to-Web Namespace Daemon" = "C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe" ["Hewlett-Packard"] "HP Software Update" = "C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe" [null data] "HPDJ Taskbar Utility" = "C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb08.exe" ["HP"] "DeviceDiscovery" = "C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe" ["Hewlett-Packard"] "RemoteControl" = ""C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"" ["Cyberlink Corp."] "SpeedTouch USB Diagnostics" = ""C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon" ["THOMSON Telecom Belgium"] "avgnt" = ""C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min" ["Avira GmbH"] HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\(Default) = (no title provided) -> {HKLM...CLSID} = "AcroIEHlprObj Class" \InProcServer32\(Default) = "C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll" ["Adobe Systems Incorporated"] {761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\(Default) = (no title provided) -> {HKLM...CLSID} = "SSVHelper Class" \InProcServer32\(Default) = "C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll" ["Sun Microsystems, Inc."] HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\ "{42071714-76d4-11d1-8b24-00a0c9068ff3}" = "Rozszerzenie CPL kadrowania wyświetlania" -> {HKLM...CLSID} = "Rozszerzenie CPL kadrowania wyświetlania" \InProcServer32\(Default) = "deskpan.dll" [file not found] "{88895560-9AA2-1069-930E-00AA0030EBC8}" = "Rozszerzenie ikony HyperTerminalu" -> {HKLM...CLSID} = "HyperTerminal Icon Ext" \InProcServer32\(Default) = "C:\WINDOWS\System32\hticons.dll" ["Hilgraeve, Inc."] "{A70C977A-BF00-412C-90B7-034C51DA2439}" = "NvCpl DesktopContext Class" -> {HKLM...CLSID} = "DesktopContext Class" \InProcServer32\(Default) = "C:\WINDOWS\System32\nvcpl.dll" ["NVIDIA Corporation"] "{FFB699E0-306A-11d3-8BD1-00104B6F7516}" = "Play on my TV helper" -> {HKLM...CLSID} = "NVIDIA CPL Extension" \InProcServer32\(Default) = "C:\WINDOWS\System32\nvcpl.dll" ["NVIDIA Corporation"] "{1CDB2949-8F65-4355-8456-263E7C208A5D}" = "Desktop Explorer" -> {HKLM...CLSID} = "Desktop Explorer" \InProcServer32\(Default) = "C:\WINDOWS\System32\nvshell.dll" ["NVIDIA Corporation"] "{1E9B04FB-F9E5-4718-997B-B8DA88302A47}" = "Desktop Explorer Menu" -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "C:\WINDOWS\System32\nvshell.dll" ["NVIDIA Corporation"] "{1E9B04FB-F9E5-4718-997B-B8DA88302A48}" = "nView Desktop Context Menu" -> {HKLM...CLSID} = "nView Desktop Context Menu" \InProcServer32\(Default) = "C:\WINDOWS\System32\nvshell.dll" ["NVIDIA Corporation"] "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" = "WinRAR shell extension" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] "{cc86590a-b60a-48e6-996b-41d25ed39a1e}" = "Portable Media Devices Menu" -> {HKLM...CLSID} = "Portable Media Devices Menu" \InProcServer32\(Default) = "C:\WINDOWS\system32\Audiodev.dll" [MS] "{A4DF5659-0801-4A60-9607-1C48695EFDA9}" = "Folder przesyłania Share-to-Web" -> {HKLM...CLSID} = "Folder przesyłania Share-to-Web" \InProcServer32\(Default) = "C:\Program Files\Hewlett-Packard\HP Share-to-Web\HPGS2WNS.DLL" ["Hewlett-Packard"] "{45AC2688-0253-4ED8-97DE-B5370FA7D48A}" = "Shell Extension for Malware scanning" -> {HKLM...CLSID} = "Shell Extension for Malware scanning" \InProcServer32\(Default) = "C:\Program Files\Avira\AntiVir PersonalEdition Classic\shlext.dll" ["Avira GmbH"] HKLM\Software\Classes\Folder\shellex\ColumnHandlers\ {F9DB5320-233E-11D1-9F84-707F02C10627}\(Default) = "PDF Column Info" -> {HKLM...CLSID} = "PDF Shell Extension" \InProcServer32\(Default) = "C:\Program Files\Adobe\Acrobat 7.0\ActiveX\PDFShell.dll" ["Adobe Systems, Inc."] HKLM\Software\Classes\*\shellex\ContextMenuHandlers\ Shell Extension for Malware scanning\(Default) = "{45AC2688-0253-4ED8-97DE-B5370FA7D48A}" -> {HKLM...CLSID} = "Shell Extension for Malware scanning" \InProcServer32\(Default) = "C:\Program Files\Avira\AntiVir PersonalEdition Classic\shlext.dll" ["Avira GmbH"] WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\ WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\ Shell Extension for Malware scanning\(Default) = "{45AC2688-0253-4ED8-97DE-B5370FA7D48A}" -> {HKLM...CLSID} = "Shell Extension for Malware scanning" \InProcServer32\(Default) = "C:\Program Files\Avira\AntiVir PersonalEdition Classic\shlext.dll" ["Avira GmbH"] WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] Group Policies {GPedit.msc branch and setting}: ----------------------------------------------- Note: detected settings may not have any effect. HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\ "shutdownwithoutlogon" = (REG_DWORD) hex:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| Shutdown: Allow system to be shut down without having to log on} "undockwithoutlogon" = (REG_DWORD) hex:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| Devices: Allow undock without having to log on} Active Desktop and Wallpaper: ----------------------------- Active Desktop may be disabled at this entry: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState Displayed if Active Desktop enabled and wallpaper not set by Group Policy: HKCU\Software\Microsoft\Internet Explorer\Desktop\General\ "Wallpaper" = "C:\WINDOWS\web\wallpaper\Idylla.bmp" Displayed if Active Desktop disabled and wallpaper not set by Group Policy: HKCU\Control Panel\Desktop\ "Wallpaper" = "C:\WINDOWS\web\wallpaper\Idylla.bmp" Enabled Screen Saver: --------------------- HKCU\Control Panel\Desktop\ "SCRNSAVE.EXE" = "C:\WINDOWS\System32\logon.scr" [MS] Startup items in "Administrator" & "All Users" startup folders: --------------------------------------------------------------- C:\Documents and Settings\All Users\Menu Start\Programy\Autostart "Adobe Reader Speed Launch" -> shortcut to: "C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe" ["Adobe Systems Incorporated"] Winsock2 Service Provider DLLs: ------------------------------- Namespace Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++} 000000000001\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS] 000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS] 000000000003\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS] Transport Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++} 0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range: %SystemRoot%\system32\mswsock.dll [MS], 01 - 03, 06 - 17 %SystemRoot%\system32\rsvpsp.dll [MS], 04 - 05 Toolbars, Explorer Bars, Extensions: ------------------------------------ Extensions (Tools menu items, main toolbar menu buttons) HKLM\Software\Microsoft\Internet Explorer\Extensions\ {08B0E5C0-4FCB-11CF-AAA5-00401C608501}\ "MenuText" = "Sun Java Console" "CLSIDExtension" = "{CAFEEFAC-0016-0000-0002-ABCDEFFEDCBC}" -> {HKLM...CLSID} = "Java Plug-in 1.6.0_02" \InProcServer32\(Default) = "C:\Program Files\Java\jre1.6.0_02\bin\npjpi160_02.dll" ["Sun Microsystems, Inc."] {FB5F1910-F110-11D2-BB9E-00C04F795683}\ "ButtonText" = "Messenger" "MenuText" = "Windows Messenger" "Exec" = "C:\Program Files\Messenger\msmsgs.exe" [MS] Running Services (Display Name, Service Name, Path {Service DLL}): ------------------------------------------------------------------ AntiVir PersonalEdition Classic Guard, AntiVirService, ""C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe"" ["Avira GmbH"] AntiVir PersonalEdition Classic Scheduler, AntiVirScheduler, ""C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe"" ["Avira GmbH"] NVIDIA Display Driver Service, NVSvc, "C:\WINDOWS\System32\nvsvc32.exe" ["NVIDIA Corporation"] Windows User Mode Driver Framework, UMWdf, "C:\WINDOWS\system32\wdfmgr.exe" [MS] Print Monitors: --------------- HKLM\System\CurrentControlSet\Control\Print\Monitors\ hpzsnt08\Driver = "hpzsnt08.dll" ["HP"] ---------- (launch time: 2007-09-11 22:28:03) + This report excludes default entries except where indicated. + To see *everywhere* the script checks and *everything* it finds, launch it from a command prompt or a shortcut with the -all parameter. + To search all directories of local fixed drives for DESKTOP.INI DLL launch points, use the -supp parameter or answer "No" at the first message box and "Yes" at the second message box. ---------- (total run time: 23 seconds, including 4 seconds for message boxes)

Kod: Zaznacz wszystko: ComboFix 07-09-10.6 - "Administrator" 2007-09-11 22:29:58.1 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.1491 [GMT 2:00] * Created a new restore point . ((((((((((((((((((((((((( Files Created from 2007-08-11 to 2007-09-11 ))))))))))))))))))))))))))))))) . 2007-09-11 22:29 51,200 --a------ C:\WINDOWS\NirCmd.exe 2007-09-11 20:47 <DIR> d-------- C:\DOCUME~1\ADMINI~1\DANEAP~1\Avant Profiles 2007-09-11 20:37 <DIR> d-------- C:\WINDOWS\LastGood 2007-09-11 20:37 <DIR> d-------- C:\Program Files\xp-AntiSpy 2007-09-11 20:22 <DIR> d-------- C:\DOCUME~1\ADMINI~1\DANEAP~1\Tlen.pl 2007-09-11 20:12 <DIR> d-------- C:\Program Files\Avira 2007-09-11 20:12 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\Avira 2007-09-11 19:55 <DIR> d-------- C:\DOCUME~1\ADMINI~1\DANEAP~1\Opera 2007-09-11 19:48 70,688 --a------ C:\WINDOWS\system32\drivers\alcaudsl.sys 2007-09-11 19:48 53,600 --a------ C:\WINDOWS\system32\drivers\alcan5wn.sys 2007-09-11 19:48 5,606 --a------ C:\WINDOWS\system32\stci.dll 2007-09-11 19:48 5,280 --a------ C:\WINDOWS\system32\drivers\alcawh.sys 2007-09-11 19:48 3,968 --a------ C:\WINDOWS\system32\drivers\alcacr.sys 2007-09-11 19:48 <DIR> d-------- C:\Program Files\Thomson 2007-09-11 19:40 <DIR> d-------- C:\Program Files\CyberLink 2007-09-11 19:40 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\CyberLink 2007-09-11 19:38 327,168 --a------ C:\WINDOWS\IsUn0415.exe 2007-09-11 19:27 82,380 --a------ C:\WINDOWS\system32\drivers\AFS2K.SYS 2007-09-11 19:27 15,104 --a--c--- C:\WINDOWS\system32\dllcache\usbscan.sys 2007-09-11 19:27 15,104 --a------ C:\WINDOWS\system32\drivers\usbscan.sys 2007-09-11 19:27 <DIR> d-------- C:\UniScan 2007-09-11 19:27 <DIR> d-------- C:\Program Files\Opera 2007-09-11 19:27 <DIR> d-------- C:\DOCUME~1\ADMINI~1\DANEAP~1\Folder przesyania Share-to-Web 2007-09-11 19:26 <DIR> d-------- C:\Program Files\Hewlett-Packard 2007-09-11 19:26 <DIR> d-------- C:\Program Files\Common Files\Hewlett-Packard 2007-09-11 19:23 41,984 --------- C:\WINDOWS\Ctregrun.exe 2007-09-11 19:21 <DIR> d-------- C:\Program Files\Creative 2007-09-11 19:15 569,344 --a------ C:\WINDOWS\system32\imagr5.dll 2007-09-11 19:15 544,768 --a------ C:\WINDOWS\system32\imagx5.dll 2007-09-11 19:15 5,504 --a------ C:\WINDOWS\system32\drivers\imagedrv.sys 2007-09-11 19:15 38,912 --a------ C:\WINDOWS\system32\picn20.dll 2007-09-11 19:15 283,920 --a------ C:\WINDOWS\system32\ImagXpr5.dll 2007-09-11 19:15 155,648 --a------ C:\WINDOWS\system32\NeroCheck.exe 2007-09-11 19:15 125,184 --a------ C:\WINDOWS\system32\drivers\imagesrv.sys 2007-09-11 19:15 106,496 --a------ C:\WINDOWS\system32\TwnLib20.dll 2007-09-11 19:15 <DIR> d-------- C:\Program Files\Common Files\Ahead 2007-09-11 19:15 <DIR> d-------- C:\Program Files\Ahead 2007-09-11 19:12 <DIR> d-------- C:\Program Files\The Bat! 2007-09-11 19:12 <DIR> d-------- C:\DOCUME~1\ADMINI~1\DANEAP~1\The Bat! 2007-09-11 19:11 <DIR> d-------- C:\Program Files\Avant Browser 2007-09-11 19:10 <DIR> d-------- C:\Program Files\Gadu-Gadu 2007-09-11 19:10 <DIR> d-------- C:\DOCUME~1\ADMINI~1\Gadu-Gadu 2007-09-11 19:09 <DIR> d-------- C:\Program Files\UltraISO 2007-09-11 19:09 <DIR> d-------- C:\Program Files\Common Files\EZB Systems 2007-09-11 19:08 <DIR> d-------- C:\Program Files\Winamp 2007-09-11 19:07 <DIR> d-------- C:\Program Files\HyperSnap 6 2007-09-11 19:02 <DIR> d-------- C:\DOCUME~1\LOCALS~1\Menu Start 2007-09-11 16:01 <DIR> dr-h----- C:\DOCUME~1\DEFAUL~1\Ustawienia lokalne 2007-09-11 16:01 <DIR> dr-h----- C:\DOCUME~1\DEFAUL~1\Dane aplikacji 2007-09-11 16:01 <DIR> dr-h----- C:\DOCUME~1\ALLUSE~1\Dane aplikacji 2007-09-11 16:01 <DIR> dr------- C:\DOCUME~1\DEFAUL~1\Menu Start 2007-09-11 16:01 <DIR> dr------- C:\DOCUME~1\ALLUSE~1\Menu Start 2007-09-11 16:01 <DIR> dr------- C:\DOCUME~1\ALLUSE~1\Dokumenty 2007-09-11 16:01 <DIR> d--h----- C:\DOCUME~1\DEFAUL~1\Szablony 2007-09-11 16:01 <DIR> d--h----- C:\DOCUME~1\ALLUSE~1\Szablony 2007-09-11 16:01 <DIR> d-------- C:\DOCUME~1\DEFAUL~1\Ulubione 2007-09-11 16:01 <DIR> d-------- C:\DOCUME~1\DEFAUL~1\Pulpit 2007-09-11 16:01 <DIR> d-------- C:\DOCUME~1\DEFAUL~1\Moje dokumenty 2007-09-11 16:01 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\Ulubione 2007-09-11 16:01 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\Pulpit 2007-09-11 15:52 <DIR> d-------- C:\WINDOWS\pss 2007-09-11 15:48 <DIR> d-------- C:\WINDOWS\ServicePackFiles 2007-09-11 15:47 15,872 --a------ C:\WINDOWS\system32\spupdsvc.exe 2007-09-11 15:47 <DIR> d-------- C:\WINDOWS\EHome 2007-09-11 15:22 487,424 --a------ C:\WINDOWS\system32\msvcp70.dll 2007-09-11 15:22 344,064 --a------ C:\WINDOWS\system32\msvcr70.dll 2007-09-11 15:22 3,870,720 --a------ C:\WINDOWS\system32\qt-mt323.dll 2007-09-11 15:22 1,028 --a------ C:\WINDOWS\unins000.dat 2007-09-11 15:22 <DIR> d--h----- C:\Program Files\InstallShield Installation Information 2007-09-11 15:22 <DIR> d-------- C:\Program Files\Paragon Software 2007-09-11 15:16 356,352 --a------ C:\WINDOWS\system32\nvudisp.exe 2007-09-11 15:16 <DIR> d-------- C:\WINDOWS\nview 2007-09-11 15:14 356,352 --a------ C:\WINDOWS\system32\NVUNINST.EXE 2007-09-11 15:14 <DIR> d-------- C:\Program Files\Common Files\InstallShield 2007-09-11 15:14 <DIR> d-------- C:\NVIDIA 2007-09-11 15:12 <DIR> dr-h----- C:\DOCUME~1\ADMINI~1\Dane aplikacji 2007-09-11 15:12 <DIR> dr------- C:\DOCUME~1\ADMINI~1\Ulubione 2007-09-11 15:12 <DIR> dr------- C:\DOCUME~1\ADMINI~1\Moje dokumenty 2007-09-11 15:12 <DIR> dr------- C:\DOCUME~1\ADMINI~1\Menu Start 2007-09-11 15:12 <DIR> d--hs---- C:\WINDOWS\Installer 2007-09-11 15:12 <DIR> d--h----- C:\DOCUME~1\NETWOR~1\Ustawienia lokalne 2007-09-11 15:12 <DIR> d--h----- C:\DOCUME~1\LOCALS~1\Ustawienia lokalne 2007-09-11 15:12 <DIR> d--h----- C:\DOCUME~1\ADMINI~1\Ustawienia lokalne 2007-09-11 15:12 <DIR> d--h----- C:\DOCUME~1\ADMINI~1\Szablony 2007-09-11 15:12 <DIR> d-------- C:\DOCUME~1\NETWOR~1\Dane aplikacji 2007-09-11 15:12 <DIR> d-------- C:\DOCUME~1\LOCALS~1\Dane aplikacji 2007-09-11 15:12 <DIR> d-------- C:\DOCUME~1\ADMINI~1\Pulpit 2007-09-11 15:09 <DIR> d--hs---- C:\DOCUME~1\ALLUSE~1\DRM 2007-09-11 15:09 <DIR> d-------- C:\Program Files\microsoft frontpage 2007-09-11 15:07 <DIR> d-------- C:\Program Files\Usugi online . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2007-09-11 20:37 359040 --a------ C:\WINDOWS\system32\drivers\tcpip.sys 2007-06-29 00:43 8466432 --a------ C:\WINDOWS\system32\nvcpl.dll 2007-06-29 00:43 81920 --a------ C:\WINDOWS\system32\nvwddi.dll 2007-06-29 00:43 81920 --a------ C:\WINDOWS\system32\nvmctray.dll 2007-06-29 00:43 753664 --a------ C:\WINDOWS\system32\nvcplui.exe 2007-06-29 00:43 6729728 --a------ C:\WINDOWS\system32\nvoglnt.dll 2007-06-29 00:43 6234112 --a------ C:\WINDOWS\system32\nvdisps.dll 2007-06-29 00:43 5690624 --a------ C:\WINDOWS\system32\nv4_disp.dll 2007-06-29 00:43 5455872 --a------ C:\WINDOWS\system32\nvdispsr.dll 2007-06-29 00:43 466944 --a------ C:\WINDOWS\system32\nvshell.dll 2007-06-29 00:43 458752 --a------ C:\WINDOWS\system32\nvmccssr.dll 2007-06-29 00:43 45056 --a------ C:\WINDOWS\system32\nvmccsrs.dll 2007-06-29 00:43 442368 --a------ C:\WINDOWS\system32\nvappbar.exe 2007-06-29 00:43 425984 --a------ C:\WINDOWS\system32\keystone.exe 2007-06-29 00:43 37376 --a------ C:\WINDOWS\system32\nvcodins.dll 2007-06-29 00:43 37376 --a------ C:\WINDOWS\system32\nvcod.dll 2007-06-29 00:43 360448 --a------ C:\WINDOWS\system32\nvapi.dll 2007-06-29 00:43 3600384 --a------ C:\WINDOWS\system32\nvvitvsr.dll 2007-06-29 00:43 3518464 --a------ C:\WINDOWS\system32\nvvitvs.dll 2007-06-29 00:43 335872 --a------ C:\WINDOWS\system32\nvwrses.dll 2007-06-29 00:43 335872 --a------ C:\WINDOWS\system32\nvwrsel.dll 2007-06-29 00:43 3321856 --a------ C:\WINDOWS\system32\nvgames.dll 2007-06-29 00:43 327680 --a------ C:\WINDOWS\system32\nvwrsfr.dll 2007-06-29 00:43 327680 --a------ C:\WINDOWS\system32\nvwrsesm.dll 2007-06-29 00:43 327680 --a------ C:\WINDOWS\system32\nvrshe.dll 2007-06-29 00:43 327680 --a------ C:\WINDOWS\system32\nvrsar.dll 2007-06-29 00:43 323584 --a------ C:\WINDOWS\system32\nvwrspt.dll 2007-06-29 00:43 323584 --a------ C:\WINDOWS\system32\nvwrsit.dll 2007-06-29 00:43 319488 --a------ C:\WINDOWS\system32\nvwrsptb.dll 2007-06-29 00:43 319488 --a------ C:\WINDOWS\system32\nvwrsnl.dll 2007-06-29 00:43 315392 --a------ C:\WINDOWS\system32\nvwrsru.dll 2007-06-29 00:43 315392 --a------ C:\WINDOWS\system32\nvwrshu.dll 2007-06-29 00:43 311296 --a------ C:\WINDOWS\system32\nvwrsde.dll 2007-06-29 00:43 3072000 --a------ C:\WINDOWS\system32\nvgamesr.dll 2007-06-29 00:43 307200 --a------ C:\WINDOWS\system32\nvexpbar.dll 2007-06-29 00:43 303104 --a------ C:\WINDOWS\system32\nvwrstr.dll 2007-06-29 00:43 303104 --a------ C:\WINDOWS\system32\nvwrssl.dll 2007-06-29 00:43 303104 --a------ C:\WINDOWS\system32\nvwrsfi.dll 2007-06-29 00:43 299008 --a------ C:\WINDOWS\system32\nvwrssk.dll 2007-06-29 00:43 299008 --a------ C:\WINDOWS\system32\nvwrsno.dll 2007-06-29 00:43 294912 --a------ C:\WINDOWS\system32\nvwrssv.dll 2007-06-29 00:43 294912 --a------ C:\WINDOWS\system32\nvwrspl.dll 2007-06-29 00:43 294912 --a------ C:\WINDOWS\system32\nvwrsda.dll 2007-06-29 00:43 286720 --a------ C:\WINDOWS\system32\nvwrseng.dll 2007-06-29 00:43 286720 --a------ C:\WINDOWS\system32\nvwrscs.dll 2007-06-29 00:43 286720 --a------ C:\WINDOWS\system32\nvnt4cpl.dll 2007-06-29 00:43 2854912 --a------ C:\WINDOWS\system32\nvmoblsr.dll 2007-06-29 00:43 282624 --a------ C:\WINDOWS\system32\nvwrsar.dll 2007-06-29 00:43 282624 --a------ C:\WINDOWS\system32\nvrsfr.dll 2007-06-29 00:43 282624 --a------ C:\WINDOWS\system32\nvrses.dll 2007-06-29 00:43 282624 --a------ C:\WINDOWS\system32\nvrsel.dll 2007-06-29 00:43 278528 --a------ C:\WINDOWS\system32\nvwrshe.dll 2007-06-29 00:43 278528 --a------ C:\WINDOWS\system32\nvrsit.dll 2007-06-29 00:43 278528 --a------ C:\WINDOWS\system32\nvrsde.dll 2007-06-29 00:43 274432 --a------ C:\WINDOWS\system32\nvrspt.dll 2007-06-29 00:43 274432 --a------ C:\WINDOWS\system32\nvrsnl.dll 2007-06-29 00:43 274432 --a------ C:\WINDOWS\system32\nvrsesm.dll 2007-06-29 00:43 270336 --a------ C:\WINDOWS\system32\nvrsru.dll 2007-06-29 00:43 266240 --a------ C:\WINDOWS\system32\nvrsptb.dll 2007-06-29 00:43 266240 --a------ C:\WINDOWS\system32\nvrsja.dll 2007-06-29 00:43 262144 --a------ C:\WINDOWS\system32\nvrsko.dll 2007-06-29 00:43 258048 --a------ C:\WINDOWS\system32\nvrstr.dll 2007-06-29 00:43 258048 --a------ C:\WINDOWS\system32\nvrssl.dll 2007-06-29 00:43 258048 --a------ C:\WINDOWS\system32\nvrssk.dll 2007-06-29 00:43 258048 --a------ C:\WINDOWS\system32\nvrshu.dll 2007-06-29 00:43 253952 --a------ C:\WINDOWS\system32\nvrssv.dll 2007-06-29 00:43 253952 --a------ C:\WINDOWS\system32\nvrspl.dll 2007-06-29 00:43 253952 --a------ C:\WINDOWS\system32\nvrsno.dll 2007-06-29 00:43 253952 --a------ C:\WINDOWS\system32\nvrsda.dll 2007-06-29 00:43 249856 --a------ C:\WINDOWS\system32\nvrsfi.dll 2007-06-29 00:43 249856 --a------ C:\WINDOWS\system32\nvrscs.dll 2007-06-29 00:43 245760 --a------ C:\WINDOWS\system32\nvrseng.dll 2007-06-29 00:43 2416640 --a------ C:\WINDOWS\system32\nvwssr.dll 2007-06-29 00:43 2330624 --a------ C:\WINDOWS\system32\nvwss.dll 2007-06-29 00:43 229376 --a------ C:\WINDOWS\system32\nvmccs.dll 2007-06-29 00:43 225280 --a------ C:\WINDOWS\system32\nvrszhc.dll 2007-06-29 00:43 212992 --a------ C:\WINDOWS\system32\nvwrsja.dll 2007-06-29 00:43 196608 --a------ C:\WINDOWS\system32\nvwrsko.dll 2007-06-29 00:43 188416 --a------ C:\WINDOWS\system32\nvmccss.dll 2007-06-29 00:43 1703936 --a------ C:\WINDOWS\system32\nvwdmcpl.dll 2007-06-29 00:43 167936 --a------ C:\WINDOWS\system32\nvwrszht.dll 2007-06-29 00:43 163840 --a------ C:\WINDOWS\system32\nvwrszhc.dll 2007-06-29 00:43 1626112 --a------ C:\WINDOWS\system32\nwiz.exe 2007-06-29 00:43 155716 --a------ C:\WINDOWS\system32\nvsvc32.exe 2007-06-29 00:43 1474560 --a------ C:\WINDOWS\system32\nview.dll 2007-06-29 00:43 147456 --a------ C:\WINDOWS\system32\nvcolor.exe 2007-06-29 00:43 1339392 --a------ C:\WINDOWS\system32\nvdspsch.exe 2007-06-29 00:43 126976 --a------ C:\WINDOWS\system32\nvrszht.dll 2007-06-29 00:43 1142784 --a------ C:\WINDOWS\system32\nvmobls.dll 2007-06-29 00:43 1073152 --a------ C:\WINDOWS\system32\nvcpluir.dll 2007-06-29 00:43 1019904 --a------ C:\WINDOWS\system32\nvwimg.dll 2007-06-29 00:43 1018772 --a------ C:\WINDOWS\system32\nvucode.bin --------- C:\Program Files\Usługi online --------- C:\DOCUME~1\ADMINI~1\DANEAP~1\Folder przesyłania Share-to-Web . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NvCplDaemon"="C:\WINDOWS\System32\NvCpl.dll" [2007-06-29 00:43] "nwiz"="nwiz.exe" [2007-06-29 00:43 C:\WINDOWS\system32\nwiz.exe] "NvMediaCenter"="C:\WINDOWS\System32\NvMcTray.dll" [2007-06-29 00:43] "NVRaidService"="C:\WINDOWS\System32\nvraidservice.exe" [2006-07-10 22:10] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" [2007-07-12 04:00] "NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 11:50] "CTSysVol"="C:\Program Files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe" [2005-10-31 10:51] "P17Helper"="P17.dll" [2005-05-03 13:38 C:\WINDOWS\system32\P17.dll] "UpdReg"="C:\WINDOWS\UpdReg.EXE" [2000-05-11 01:00] "Share-to-Web Namespace Daemon"="C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe" [2002-04-17 10:42] "HP Software Update"="C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe" [2002-12-17 11:40] "HPDJ Taskbar Utility"="C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb08.exe" [2003-03-11 12:08] "DeviceDiscovery"="C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe" [2002-12-02 20:56] "RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [2003-10-31 19:42] "SpeedTouch USB Diagnostics"="C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" [2004-01-26 11:38] "avgnt"="C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2007-08-31 12:25] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:44] "MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-08-04 00:44] "Gadu-Gadu"="C:\Program Files\Gadu-Gadu\gg.exe" [2006-11-09 15:02] C:\DOCUME~1\ALLUSE~1\MENUST~1\Programy\AUTOST~1\ Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-24 07:05:26] R3 P17;Sound Blaster Audigy;C:\WINDOWS\system32\drivers\P17.sys *Newly Created Service* - ANTIVIRSCHEDULER *Newly Created Service* - ANTIVIRSERVICE *Newly Created Service* - AVGIO *Newly Created Service* - AVGNTFLT *Newly Created Service* - AVIPBB *Newly Created Service* - CATCHME . ************************************************************************** catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-09-11 22:30:22 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2007-09-11 22:30:41 . --- E O F ---

**Posty:** 3854 · przez **Dzi@dek** 12 Wrz 2007, 15:08

Logi czyste.
możesz to skasować:

C:\WINDOWS\NirCmd.exe

**Posty:** 8079 · przez **kajtekjr** 12 Wrz 2007, 16:01

Tom@szek napisał(a):Logi czyste.
możesz to skasować:

C:\WINDOWS\NirCmd.exe

OK skasuje a tutaj jeszce log z antywira:

Kod: Zaznacz wszystko: AntiVir PersonalEdition Classic Report file date: 11 września 2007 22:46 Scanning for 1058160 virus strains and unwanted programs. Licensed to: Avira AntiVir PersonalEdition Classic Serial number: 0000149996-ADJIE-0001 Platform: Windows XP Windows version: (Dodatek Service Pack 2) [5.1.2600] Username: SYSTEM Computer name: DOM-KAJTEK Version information: BUILD.DAT : 268 15604 Bytes 2007-08-31 13:04:00 AVSCAN.EXE : 7.0.6.1 290856 Bytes 2007-08-23 12:16:29 AVSCAN.DLL : 7.0.6.0 49192 Bytes 2007-08-16 11:23:51 LUKE.DLL : 7.0.5.3 147496 Bytes 2007-08-14 14:32:47 LUKERES.DLL : 7.0.6.1 10280 Bytes 2007-08-21 11:35:20 ANTIVIR0.VDF : 6.35.0.1 7371264 Bytes 2006-05-31 11:32:40 ANTIVIR1.VDF : 6.39.0.129 7251968 Bytes 2007-07-10 11:32:46 ANTIVIR2.VDF : 6.39.1.74 1637376 Bytes 2007-09-02 18:28:43 ANTIVIR3.VDF : 6.39.1.117 225280 Bytes 2007-09-11 18:28:43 AVEWIN32.DLL : 7.6.0.5 2789888 Bytes 2007-08-29 16:09:10 AVWINLL.DLL : 1.0.0.7 14376 Bytes 2007-02-26 09:36:26 AVPREF.DLL : 7.0.2.2 25640 Bytes 2007-07-18 06:39:17 AVREP.DLL : 7.0.0.1 155688 Bytes 2007-04-16 12:16:24 AVPACK32.DLL : 7.3.0.15 360488 Bytes 2007-08-03 07:46:00 AVREG.DLL : 7.0.1.6 30760 Bytes 2007-07-18 06:17:06 AVARKT.DLL : 1.0.0.20 278568 Bytes 2007-08-28 11:26:33 AVEVTLOG.DLL : 7.0.0.20 86056 Bytes 2007-07-18 06:10:18 NETNT.DLL : 7.0.0.0 7720 Bytes 2007-03-08 10:09:42 RCIMAGE.DLL : 7.0.1.30 2342952 Bytes 2007-08-07 11:38:13 RCTEXT.DLL : 7.0.62.0 86056 Bytes 2007-08-21 11:50:37 SQLITE3.DLL : 3.3.17.1 339968 Bytes 2007-07-23 08:37:21 Configuration settings for the scan: Jobname..........................: Complete system scan Configuration file...............: c:\program files\avira\antivir personaledition classic\sysscan.avp Logging..........................: low Primary action...................: interactive Secondary action.................: ignore Scan master boot sector..........: off Scan boot sector.................: on Boot sectors.....................: E:, Scan memory......................: on Process scan.....................: on Scan registry....................: on Search for rootkits..............: off Scan all files...................: Intelligent file selection Scan archives....................: on Recursion depth..................: 20 Smart extensions.................: on Macro heuristic..................: on File heuristic...................: medium Start of the scan: 11 września 2007 22:46 The scan of running processes will be started Scan process 'avscan.exe' - '1' Module(s) have been scanned Scan process 'explorer.exe' - '1' Module(s) have been scanned Scan process 'avcenter.exe' - '1' Module(s) have been scanned Scan process 'avcenter.exe' - '1' Module(s) have been scanned Scan process 'tlen.exe' - '1' Module(s) have been scanned Scan process 'avgnt.exe' - '1' Module(s) have been scanned Scan process 'avguard.exe' - '1' Module(s) have been scanned Scan process 'sched.exe' - '1' Module(s) have been scanned Scan process 'Opera.exe' - '1' Module(s) have been scanned Scan process 'unsecapp.exe' - '1' Module(s) have been scanned Scan process 'ctfmon.exe' - '1' Module(s) have been scanned Scan process 'dragdiag.exe' - '1' Module(s) have been scanned Scan process 'hpgs2wnf.exe' - '1' Module(s) have been scanned Scan process 'PDVDServ.exe' - '1' Module(s) have been scanned Scan process 'hpotdd01.exe' - '1' Module(s) have been scanned Scan process 'hpztsb08.exe' - '1' Module(s) have been scanned Scan process 'hpwuSchd.exe' - '1' Module(s) have been scanned Scan process 'hpgs2wnd.exe' - '1' Module(s) have been scanned Scan process 'rundll32.exe' - '1' Module(s) have been scanned Scan process 'CTSysVol.exe' - '1' Module(s) have been scanned Scan process 'wmiprvse.exe' - '1' Module(s) have been scanned Scan process 'jusched.exe' - '1' Module(s) have been scanned Scan process 'nvraidservice.exe' - '1' Module(s) have been scanned Scan process 'rundll32.exe' - '1' Module(s) have been scanned Scan process 'alg.exe' - '1' Module(s) have been scanned Scan process 'wdfmgr.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'nvsvc32.exe' - '1' Module(s) have been scanned Scan process 'spoolsv.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'lsass.exe' - '1' Module(s) have been scanned Scan process 'services.exe' - '1' Module(s) have been scanned Scan process 'winlogon.exe' - '1' Module(s) have been scanned Scan process 'csrss.exe' - '1' Module(s) have been scanned Scan process 'smss.exe' - '1' Module(s) have been scanned 39 processes with 39 modules were scanned Start scanning boot sectors: Boot sector 'C:\' [NOTE] No virus was found! Boot sector 'D:\' [NOTE] No virus was found! Boot sector 'E:\' [NOTE] No virus was found! Starting to scan the registry. The registry was scanned ( '34' files ). Starting the file scan: Begin scan in 'C:\' C:\pagefile.sys [WARNING] The file could not be opened! Begin scan in 'D:\' D:\Moje dokumenty\Łukasz\Lonely[1].Cat.Games.Jukebox.v2.14.SymbianOS.Incl Keygen-TSRh.rar [0] Archive type: RAR --> Lonely[1].Cat.Games.Jukebox.v2.14.SymbianOS.Incl Keygen-TSRh\Lonely.Cat.Games.Jukebox.v2.14.SymbianOS.Incl Keygen-TSRh\lcg.jukebox.2.14+.keygen-tsrh.zip [1] Archive type: ZIP --> kglcjtsrh.exe [DETECTION] Contains detection pattern of the worm WORM/Sdbot.21176.2 [INFO] The file was moved to '475501ce.qua'! D:\Moje dokumenty\Łukasz\N70\Lonely.Cat.Games.X-plore.v1.05.S60.SymbianOS.Incl.Keygen-TSRh\Lonely.Cat.Games.X-plore.v1.05.S60.SymbianOS.Incl.Keygen-TSRh\lcg.x-plore.keygen-tsrh.zip [0] Archive type: ZIP --> kgxpltsrh.exe [DETECTION] Contains detection pattern of the worm WORM/Sdbot.21176.1 [INFO] The file was deleted! D:\Moje dokumenty\Łukasz\N70\Lonely.Cat.Games.X-plore.v1.05.S60.SymbianOS.Incl.Keygen-TSRh\Lonely.Cat.Games.X-plore.v1.05.S60.SymbianOS.Incl.Keygen-TSRh\lcg.x-plore.keygen-tsrh\kgxpltsrh.exe [DETECTION] Contains detection pattern of the worm WORM/Sdbot.21176.1 [INFO] The file was deleted! D:\Obróbka video\WinAVI Video Converter\WinAVI.exe [DETECTION] Contains code of the Windows virus W32/Virut.R [INFO] The file was moved to '475501ea.qua'! D:\Obróbka video\WinAVI Video Converter\WinAVIcmd.exe [DETECTION] Contains code of the Windows virus W32/Virut.R [INFO] The file was moved to '475501ed.qua'! D:\SmartMovie Converter\IIUninst.exe [DETECTION] Contains code of the Windows virus W32/Virut.R [INFO] The file was moved to '473c01d2.qua'! D:\SmartMovie Converter\smartmovie.exe [DETECTION] Contains code of the Windows virus W32/Virut.R [INFO] The file was moved to '474801f7.qua'! D:\System Volume Information\_restore{07BE8D3D-2303-4B0B-85EA-1978E9C10A07}\RP22\A0005861.exe [DETECTION] Contains code of the Windows virus W32/Virut.R [INFO] The file was moved to '471701be.qua'! D:\System Volume Information\_restore{07BE8D3D-2303-4B0B-85EA-1978E9C10A07}\RP22\A0005895.exe [DETECTION] Contains code of the Windows virus W32/Virut.R [INFO] The file was moved to '471701c0.qua'! D:\System Volume Information\_restore{07BE8D3D-2303-4B0B-85EA-1978E9C10A07}\RP22\A0005896.exe [DETECTION] Contains code of the Windows virus W32/Virut.R [INFO] The file was moved to '471701c3.qua'! D:\System Volume Information\_restore{07BE8D3D-2303-4B0B-85EA-1978E9C10A07}\RP22\A0005897.exe [DETECTION] Contains code of the Windows virus W32/Virut.R [INFO] The file was moved to '471701c7.qua'! D:\System Volume Information\_restore{07BE8D3D-2303-4B0B-85EA-1978E9C10A07}\RP22\A0005898.exe [DETECTION] Contains code of the Windows virus W32/Virut.R [INFO] The file was moved to '471701ca.qua'! D:\System Volume Information\_restore{07BE8D3D-2303-4B0B-85EA-1978E9C10A07}\RP22\A0005899.exe [DETECTION] Contains code of the Windows virus W32/Virut.R [INFO] The file was moved to '471701cd.qua'! D:\System Volume Information\_restore{07BE8D3D-2303-4B0B-85EA-1978E9C10A07}\RP22\A0006087.exe [DETECTION] Contains code of the Windows virus W32/Virut.R [INFO] The file was moved to '471701d3.qua'! D:\System Volume Information\_restore{07BE8D3D-2303-4B0B-85EA-1978E9C10A07}\RP22\A0006094.exe [DETECTION] Contains code of the Windows virus W32/Virut.R [INFO] The file was moved to '471701d5.qua'! D:\System Volume Information\_restore{07BE8D3D-2303-4B0B-85EA-1978E9C10A07}\RP22\A0006394.exe [DETECTION] Contains code of the Windows virus W32/Virut.R [INFO] The file was moved to '471701d9.qua'! D:\System Volume Information\_restore{07BE8D3D-2303-4B0B-85EA-1978E9C10A07}\RP22\A0006397.exe [DETECTION] Contains code of the Windows virus W32/Virut.R [INFO] The file was moved to '471701e8.qua'! D:\System Volume Information\_restore{07BE8D3D-2303-4B0B-85EA-1978E9C10A07}\RP22\A0006412.exe [DETECTION] Contains code of the Windows virus W32/Virut.R [INFO] The file was moved to '471701ed.qua'! D:\System Volume Information\_restore{07BE8D3D-2303-4B0B-85EA-1978E9C10A07}\RP23\A0006531.exe [DETECTION] Contains code of the Windows virus W32/Virut.R [INFO] The file was moved to '47170203.qua'! D:\System Volume Information\_restore{07BE8D3D-2303-4B0B-85EA-1978E9C10A07}\RP23\A0007194.exe [DETECTION] Contains detection pattern of the worm WORM/Sdbot.21176.1 [INFO] The file was moved to '4717020e.qua'! D:\System Volume Information\_restore{07BE8D3D-2303-4B0B-85EA-1978E9C10A07}\RP23\A0007195.exe [DETECTION] Contains code of the Windows virus W32/Virut.R [INFO] The file was moved to '4717020f.qua'! D:\System Volume Information\_restore{07BE8D3D-2303-4B0B-85EA-1978E9C10A07}\RP23\A0007196.exe [DETECTION] Contains code of the Windows virus W32/Virut.R [INFO] The file was moved to '47170211.qua'! D:\System Volume Information\_restore{07BE8D3D-2303-4B0B-85EA-1978E9C10A07}\RP23\A0007197.exe [DETECTION] Contains code of the Windows virus W32/Virut.R [INFO] The file was moved to '47170213.qua'! D:\System Volume Information\_restore{07BE8D3D-2303-4B0B-85EA-1978E9C10A07}\RP23\A0007198.exe [DETECTION] Contains code of the Windows virus W32/Virut.R [INFO] The file was moved to '47170221.qua'! D:\System Volume Information\_restore{0A7C9DFE-8AA4-4A6C-96D6-CC20024C3C6B}\RP13\A0005233.exe [DETECTION] Contains code of the Windows virus W32/Virut.R [INFO] The file was moved to '47170223.qua'! D:\System Volume Information\_restore{0A7C9DFE-8AA4-4A6C-96D6-CC20024C3C6B}\RP13\A0005234.exe [DETECTION] Contains code of the Windows virus W32/Virut.R [INFO] The file was moved to '47170225.qua'! D:\System Volume Information\_restore{BBC7B41D-F672-4BF0-926C-C7915E277708}\RP75\A0029166.exe [DETECTION] Contains code of the Windows virus W32/Virut.R [INFO] The file was moved to '47170237.qua'! D:\System Volume Information\_restore{BBC7B41D-F672-4BF0-926C-C7915E277708}\RP75\A0029227.exe [DETECTION] Contains code of the Windows virus W32/Virut.R [INFO] The file was moved to '4717023a.qua'! D:\System Volume Information\_restore{BBC7B41D-F672-4BF0-926C-C7915E277708}\RP75\A0029228.exe [DETECTION] Contains code of the Windows virus W32/Virut.R [INFO] The file was moved to '4717023b.qua'! D:\System Volume Information\_restore{BBC7B41D-F672-4BF0-926C-C7915E277708}\RP75\A0029229.exe [DETECTION] Contains code of the Windows virus W32/Virut.R [INFO] The file was moved to '4717023d.qua'! D:\System Volume Information\_restore{BBC7B41D-F672-4BF0-926C-C7915E277708}\RP75\A0029309.exe [DETECTION] Contains code of the Windows virus W32/Virut.R [INFO] The file was moved to '4717023e.qua'! D:\System Volume Information\_restore{BBC7B41D-F672-4BF0-926C-C7915E277708}\RP76\A0029995.exe [DETECTION] Contains code of the Windows virus W32/Virut.R [INFO] The file was moved to '47170240.qua'! D:\System Volume Information\_restore{BBC7B41D-F672-4BF0-926C-C7915E277708}\RP76\A0029996.exe [DETECTION] Contains code of the Windows virus W32/Virut.R [INFO] The file was moved to '47170242.qua'! D:\System Volume Information\_restore{BBC7B41D-F672-4BF0-926C-C7915E277708}\RP76\A0029997.exe [DETECTION] Contains code of the Windows virus W32/Virut.R [INFO] The file was moved to '47170246.qua'! D:\System Volume Information\_restore{BBC7B41D-F672-4BF0-926C-C7915E277708}\RP77\A0030081.exe [DETECTION] Contains code of the Windows virus W32/Virut.R [INFO] The file was moved to '47170248.qua'! Begin scan in 'E:\' E:\BitSpirit\BetterSP2.exe [DETECTION] Contains code of the Windows virus W32/Virut.R [INFO] The file was moved to '475b02de.qua'! E:\BitSpirit\BitSpirit.exe [DETECTION] Contains code of the Windows virus W32/Virut.R [INFO] The file was moved to '475b02e5.qua'! E:\BitSpirit\Builder.exe [DETECTION] Contains code of the Windows virus W32/Virut.R [INFO] The file was moved to '475002f2.qua'! E:\LFS_S2_ALPHA_X\LFS_S2W_KeyGen.exe [DETECTION] Contains code of the Windows virus W32/Virut.R [INFO] The file was moved to '473a0328.qua'! E:\sm3.40_v2\SmartMovie Converter\SmartMovie Converter\Setup.exe [DETECTION] Contains code of the Windows virus W32/Virut.R [INFO] The file was moved to '475b03bb.qua'! E:\System Volume Information\_restore{07BE8D3D-2303-4B0B-85EA-1978E9C10A07}\RP22\A0005863.exe [DETECTION] Contains code of the Windows virus W32/Virut.R [INFO] The file was moved to '47170388.qua'! E:\System Volume Information\_restore{07BE8D3D-2303-4B0B-85EA-1978E9C10A07}\RP23\A0007208.exe [DETECTION] Contains code of the Windows virus W32/Virut.R [INFO] The file was moved to '4717038c.qua'! E:\System Volume Information\_restore{07BE8D3D-2303-4B0B-85EA-1978E9C10A07}\RP23\A0007209.exe [DETECTION] Contains code of the Windows virus W32/Virut.R [INFO] The file was moved to '4717038d.qua'! E:\System Volume Information\_restore{07BE8D3D-2303-4B0B-85EA-1978E9C10A07}\RP23\A0007210.exe [DETECTION] Contains code of the Windows virus W32/Virut.R [INFO] The file was moved to '4717038e.qua'! E:\System Volume Information\_restore{07BE8D3D-2303-4B0B-85EA-1978E9C10A07}\RP23\A0007211.exe [DETECTION] Contains code of the Windows virus W32/Virut.R [INFO] The file was moved to '47170391.qua'! E:\System Volume Information\_restore{07BE8D3D-2303-4B0B-85EA-1978E9C10A07}\RP23\A0007212.exe [DETECTION] Contains code of the Windows virus W32/Virut.R [INFO] The file was moved to '47170393.qua'! E:\System Volume Information\_restore{0A7C9DFE-8AA4-4A6C-96D6-CC20024C3C6B}\RP17\A0005393.exe [DETECTION] Contains code of the Windows virus W32/Virut.R [INFO] The file was moved to '4717039e.qua'! E:\System Volume Information\_restore{0A7C9DFE-8AA4-4A6C-96D6-CC20024C3C6B}\RP17\A0005395.exe [DETECTION] Contains code of the Windows virus W32/Virut.R [INFO] The file was moved to '471703a0.qua'! E:\System Volume Information\_restore{0A7C9DFE-8AA4-4A6C-96D6-CC20024C3C6B}\RP17\A0006053.exe [DETECTION] Contains code of the Windows virus W32/Virut.R [INFO] The file was moved to '471703a3.qua'! E:\System Volume Information\_restore{0A7C9DFE-8AA4-4A6C-96D6-CC20024C3C6B}\RP17\A0006124.exe [DETECTION] Contains code of the Windows virus W32/Virut.R [INFO] The file was moved to '471703a5.qua'! E:\System Volume Information\_restore{0A7C9DFE-8AA4-4A6C-96D6-CC20024C3C6B}\RP17\A0006125.exe [DETECTION] Contains code of the Windows virus W32/Virut.R [INFO] The file was moved to '471703a6.qua'! E:\System Volume Information\_restore{0A7C9DFE-8AA4-4A6C-96D6-CC20024C3C6B}\RP17\A0007053.exe [DETECTION] Contains code of the Windows virus W32/Virut.R [INFO] The file was moved to '471703a8.qua'! E:\System Volume Information\_restore{0A7C9DFE-8AA4-4A6C-96D6-CC20024C3C6B}\RP17\A0007106.exe [DETECTION] Contains code of the Windows virus W32/Virut.R [INFO] The file was moved to '471703aa.qua'! E:\System Volume Information\_restore{0A7C9DFE-8AA4-4A6C-96D6-CC20024C3C6B}\RP2\A0002843.exe [DETECTION] Contains code of the Windows virus W32/Virut.R [INFO] The file was moved to '471703ac.qua'! E:\System Volume Information\_restore{0A7C9DFE-8AA4-4A6C-96D6-CC20024C3C6B}\RP2\A0002844.exe [DETECTION] Contains code of the Windows virus W32/Virut.R [INFO] The file was moved to '471703ae.qua'! E:\System Volume Information\_restore{0A7C9DFE-8AA4-4A6C-96D6-CC20024C3C6B}\RP2\A0002848.exe [DETECTION] Contains code of the Windows virus W32/Virut.R [INFO] The file was moved to '471703b0.qua'! E:\System Volume Information\_restore{0A7C9DFE-8AA4-4A6C-96D6-CC20024C3C6B}\RP2\A0002849.exe [DETECTION] Contains code of the Windows virus W32/Virut.R [INFO] The file was moved to '471703b1.qua'! E:\System Volume Information\_restore{0A7C9DFE-8AA4-4A6C-96D6-CC20024C3C6B}\RP2\A0002862.exe [DETECTION] Contains code of the Windows virus W32/Virut.R [INFO] The file was moved to '471703b3.qua'! E:\System Volume Information\_restore{0A7C9DFE-8AA4-4A6C-96D6-CC20024C3C6B}\RP2\A0002905.exe [DETECTION] Contains code of the Windows virus W32/Virut.R [INFO] The file was moved to '471703b5.qua'! E:\System Volume Information\_restore{0A7C9DFE-8AA4-4A6C-96D6-CC20024C3C6B}\RP2\A0002906.exe [DETECTION] Contains code of the Windows virus W32/Virut.R [INFO] The file was moved to '471703b8.qua'! E:\System Volume Information\_restore{0A7C9DFE-8AA4-4A6C-96D6-CC20024C3C6B}\RP2\A0002907.exe [DETECTION] Contains code of the Windows virus W32/Virut.R [INFO] The file was moved to '471703bc.qua'! E:\System Volume Information\_restore{0A7C9DFE-8AA4-4A6C-96D6-CC20024C3C6B}\RP2\A0002909.exe [DETECTION] Contains code of the Windows virus W32/Virut.R [INFO] The file was moved to '471703be.qua'! E:\System Volume Information\_restore{0A7C9DFE-8AA4-4A6C-96D6-CC20024C3C6B}\RP2\A0002933.exe [DETECTION] Contains code of the Windows virus W32/Virut.R [INFO] The file was moved to '471703c0.qua'! E:\System Volume Information\_restore{0A7C9DFE-8AA4-4A6C-96D6-CC20024C3C6B}\RP2\A0002934.exe [DETECTION] Contains code of the Windows virus W32/Virut.R [INFO] The file was moved to '471703c1.qua'! E:\System Volume Information\_restore{0A7C9DFE-8AA4-4A6C-96D6-CC20024C3C6B}\RP2\A0002935.exe [DETECTION] Contains code of the Windows virus W32/Virut.R [INFO] The file was moved to '471703c3.qua'! E:\System Volume Information\_restore{0A7C9DFE-8AA4-4A6C-96D6-CC20024C3C6B}\RP2\A0002936.exe [DETECTION] Contains code of the Windows virus W32/Virut.R [INFO] The file was moved to '471703c4.qua'! E:\System Volume Information\_restore{0A7C9DFE-8AA4-4A6C-96D6-CC20024C3C6B}\RP2\A0002937.exe [DETECTION] Contains code of the Windows virus W32/Virut.R [INFO] The file was moved to '471703c6.qua'! E:\System Volume Information\_restore{0A7C9DFE-8AA4-4A6C-96D6-CC20024C3C6B}\RP2\A0002939.exe [DETECTION] Contains code of the Windows virus W32/Virut.R End of the scan: 11 września 2007 23:07 Used time: 21:22 min The scan has been canceled! 2714 Scanning directories 221115 Files were scanned 68 viruses and/or unwanted programs were found 0 Files were classified as suspicious: 2 files were deleted 0 files were repaired 65 files were moved to quarantine 0 files were renamed 1 Files cannot be scanned 221047 Files not concerned 3629 Archives were scanned 1 Warnings 3 Notes

**Posty:** 18165 · przez **wojtas** 12 Wrz 2007, 16:08

Wyłącz przywracanie systemu ( właściwości mój komputer-zakładka przywracanie - wyłącz przywracanie na wszystkich dyskach)

po chwili wlacz przywracanie

**Posty:** 8079 · przez **kajtekjr** 12 Wrz 2007, 16:17

wojtas19162 napisał(a):Wyłącz przywracanie systemu ( właściwości mój komputer-zakładka przywracanie - wyłącz przywracanie na wszystkich dyskach)

po chwili wlacz przywracanie

wojtas19162, jesli moge wiedziec, co to daje

? Bo ciekawi mnie to..

**Posty:** 18165 · przez **wojtas** 12 Wrz 2007, 16:20

kasuje wirusy tego typu:

E:\System Volume Information\_restore{0A7C9DFE-8AA4-4A6C-96D6-CC20024C3C6B}\RP2\A0002905.exe
[DETECTION] Contains code of the Windows virus W32/Virut.R

**Posty:** 8079 · przez **kajtekjr** 13 Wrz 2007, 20:29

Wyłącz przywracanie systemu ( właściwości mój komputer-zakładka przywracanie - wyłącz przywracanie na wszystkich dyskach)

po chwili wlacz przywracanie

To nic nie dało...

**Posty:** 3854 · przez **Dzi@dek** 13 Wrz 2007, 20:32

kajtekjr napisał(a):To nic nie dało...

Wyłącz - restart - włącz.

**Posty:** 5637 · przez **kahoona** 13 Wrz 2007, 20:47

kajtekjr - Równie dobrze można utworzyć nowy punkt przywracania, a później oczyścić dysk - z kasowaniem wszystkich punktów przywracania poza najnowszym.

To po pierwsze. Po drugie - zatrzymałeś skan. Po trzecie - jak jest ustawiona heurystyka ( opcjach zaawansowanych Avira - EXPERT ), także makrowirusów? Skanujesz tylko smart extensions/file extensions list. Daj "All Files". W ogolnych opcjach "Scan" - zaznacz wszystko w "Additional settings" - rootkity i master boot record nie skanowałeś. Masz włączone skanowanie archiwów (all archive types)? W opcjach General/Extended Threat Categories - zaznaczone wszystko?

W opcjach strażnika - włączona heurystyka na max? Nie musi być cały czas, ale na kilka uruchomień / skanów.

prosze o sprawdzenie loga

prosze o sprawdzenie loga

Kto jest na forum