prosze o sprawdzenie loga

[edo_90]

Logfile of HijackThis v1.99.1
Scan saved at 19:14:10, on 2007-11-29
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
f:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\system32\rundll32.exe
F:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe
C:\Program Files\Hewlett-Packard\OrderReminder\OrderReminder.exe
C:\WINDOWS\system32\RunDll32.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
F:\Program Files\Razer\Habu\razerhid.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
F:\Program Files\AutoConnect\AutoConnect.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
F:\Program Files\E-Color\Common\IconMgr.exe
f:\Program Files\E-Color\Colorific\hgcctl95.exe
f:\Program Files\E-Color\E-Color Indicator\TICIcon.exe
F:\Program Files\Razer\Habu\razertra.exe
F:\Program Files\Razer\Habu\razerofa.exe
F:\Program Files\Valve\Steam\Steam.exe
C:\Documents and Settings\User\Pulpit\gamma.exe
C:\PROGRA~1\Mozilla Firefox\firefox.exe
F:\Program Files\BitComet\BitComet.exe
C:\Documents and Settings\User\Pulpit\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.neostrada.pl
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://codecs.r8.org/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Winamp Toolbar BHO - {25CEE8EC-5730-41bc-8B58-22DDC8AB8C20} - C:\Program Files\Winamp Toolbar\winamptb.dll
O2 - BHO: flashget urlcatch - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - f:\Program Files\FlashGet\jccatch.dll
O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - F:\Program Files\BitComet\tools\BitCometBHO_1.1.7.4.dll
O2 - BHO: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL
O2 - BHO: FlashGet GetFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - f:\Program Files\FlashGet\getflash.dll
O3 - Toolbar: Winamp Toolbar - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - C:\Program Files\Winamp Toolbar\winamptb.dll
O3 - Toolbar: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL
O4 - HKLM\..\Run: [JMB36X IDE Setup] C:\WINDOWS\JM\JMInsIDE.exe
O4 - HKLM\..\Run: [36X Raid Configurer] C:\WINDOWS\system32\JMRaidSetup.exe boot
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [AdslTaskBar] rundll32.exe stmctrl.dll,TaskBar
O4 - HKLM\..\Run: [AVP] "f:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe"
O4 - HKLM\..\Run: [WhenUSearchWHSE] "C:\Program Files\DAEMON Tools SearchBar\whse.exe"
O4 - HKLM\..\Run: [OrderReminder] C:\Program Files\Hewlett-Packard\OrderReminder\OrderReminder.exe
O4 - HKLM\..\Run: [CmUsbSound] RunDll32 cmcnfgu.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [Habu] f:\Program Files\Razer\Habu\razerhid.exe
O4 - HKLM\..\Run: [Flashget] F:\Program Files\FlashGet\flashget.exe /min
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [AutoConnect] f:\Program Files\AutoConnect\AutoConnect.exe
O4 - HKCU\..\Run: [Komunikator] F:\Program Files\Tlen.pl\tlen.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
O4 - Global Startup: Adobe Reader Synchronizer.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe
O4 - Global Startup: E-Color.lnk = F:\Program Files\E-Color\Common\IconMgr.exe
O8 - Extra context menu item: &D&ownload &with BitComet - res://F:\Program Files\BitComet\BitComet.exe/AddLink.htm
O8 - Extra context menu item: &D&ownload all video with BitComet - res://F:\Program Files\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: &D&ownload all with BitComet - res://F:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
O8 - Extra context menu item: &Winamp Toolbar Search - C:\Documents and Settings\All Users\Dane aplikacji\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html
O8 - Extra context menu item: &Ściągnij przy pomocy FlashGet'a - F:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: &Ściągnij wszystko przy pomocy FlashGet'a - F:\Program Files\FlashGet\jc_all.htm
O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Statystyki ochrony WWW - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - f:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\scieplugin.dll
O9 - Extra button: BitComet Search - {461CC20B-FB6E-4f16-8FE8-C29359DB100E} - F:\Program Files\BitComet\tools\BitCometBHO_1.1.7.4.dll
O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - f:\Program Files\FlashGet\FlashGet.exe
O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - f:\Program Files\FlashGet\FlashGet.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1193560628390
O17 - HKLM\System\CCS\Services\Tcpip\..\{09ED3568-2BCF-4335-B7DD-2DFE6BD67EC3}: NameServer = 194.204.159.1 217.98.63.164
O17 - HKLM\System\CS1\Services\Tcpip\..\{09ED3568-2BCF-4335-B7DD-2DFE6BD67EC3}: NameServer = 194.204.159.1 217.98.63.164
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: klogon - C:\WINDOWS\system32\klogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Kaspersky Anti-Virus 6.0 (AVP) - Unknown owner - f:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe" -r (file missing)
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

komp mi zamula. ostatnio sporo sciagalem z emule i soulseek. przeskanowalem kompa ad aware kasperskim zrobilem defragmentacje i caly czas muli

[Dzi@dek]

wklej całego loga z nagłówkiem

[edo_90]

JUZ!

[Dzi@dek]

Nie piszemy na forum DUŻĄ czcionką

O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [WhenUSearchWHSE] "C:\Program Files\DAEMON Tools SearchBar\whse.exe"

Kasuj w awaryjnym po wyłączeniu przywracania systemu - pogrubione ręcznie usuwasz po kasacji w hijackthis.

Daj loga z Combofix. http://www.programosy.pl/program,combofix.html

[edo_90]

jak usunąć to ręcznie? wiem tylko jak przez program. bo jest to opisane!



a jezeli chodzi o ten drugi program to mi jakies poziomy skanuje

[Dzi@dek]

jak usunąć to ręcznie?

Najpierw usuwasz podane wpisy w hijackthis później szukasz plików/folderów na dysku i usuwasz je.

a jezeli chodzi o ten drugi program to mi jakies poziomy skanuje

Tak ma być.

[edo_90]

ok dzieki. wiec przeskanowal mi sie komputer i nagle zwieche zlapal. bylo widac tylko ten program. wiec po 5 minutach zresetowalem komputer i pojawila sie informacja o jakims sprawdzaniu dyskow. bylo 5 procesow sprawdzania.

[Dzi@dek]

Daj loga z Combofix

[edo_90]

ComboFix 07-11-19.4C - User 2007-11-30 14:03:44.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.1507 [GMT 1:00]
Running from: C:\Documents and Settings\User\Pulpit\ComboFix.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
---- Previous Run -------
.
C:\WINDOWS\icon.ico

.
((((((((((((((((((((((((( Files Created from 2007-10-28 to 2007-11-30 )))))))))))))))))))))))))))))))
.

2007-11-24 13:17 <DIR> d-a------ C:\Documents and Settings\All Users\Dane aplikacji\TEMP
2007-11-23 15:27 <DIR> d-------- C:\Program Files\AviSynth 2.5
2007-11-23 15:27 502,784 --a------ C:\WINDOWS\x2.64.exe
2007-11-23 15:27 471,552 --a------ C:\WINDOWS\system32\Smab.dll
2007-11-23 15:27 217,073 --a------ C:\WINDOWS\meta4.exe
2007-11-23 15:27 66,560 --a------ C:\WINDOWS\MOTA113.exe
2007-11-23 15:26 227,328 -r-hs---- C:\WINDOWS\system32\ac3DX.ax
2007-11-23 15:26 186,880 -r-hs---- C:\WINDOWS\system32\RLOgg.ax
2007-11-23 15:26 161,792 -r-hs---- C:\WINDOWS\system32\RealMediaDX.ax
2007-11-23 15:26 92,672 -r-hs---- C:\WINDOWS\system32\RLVorbisDec.ax
2007-11-23 15:26 67,584 -r-hs---- C:\WINDOWS\system32\RLTheoraDec.ax
2007-11-23 15:26 54,784 -r-hs---- C:\WINDOWS\system32\RLAPEDec.ax
2007-11-23 15:26 51,712 -r-hs---- C:\WINDOWS\system32\RLSpeexDec.ax
2007-11-23 15:26 37,888 -r-hs---- C:\WINDOWS\system32\RLMPCDec.ax
2007-11-19 19:31 <DIR> d-------- C:\WINDOWS\NV14441524.TMP
2007-11-19 19:30 111,171 --a------ C:\WINDOWS\system32\nvapps.xml
2007-11-19 19:20 17,254 --a------ C:\WINDOWS\system32\nvwsapps.nvb
2007-11-18 20:50 <DIR> d-------- C:\Program Files\MegauploadToolbar
2007-11-18 20:50 <DIR> d-------- C:\Documents and Settings\User\Dane aplikacji\MegauploadToolbar
2007-11-04 12:54 <DIR> dr-h----- C:\Documents and Settings\User\Dane aplikacji\SecuROM
2007-11-04 12:42 <DIR> d-------- C:\Program Files\AGEIA Technologies
2007-11-02 23:25 <DIR> d-------- C:\Program Files\MSXML 6.0
2007-11-02 23:21 <DIR> d-------- C:\Program Files\MSXML 4.0
2007-11-01 20:25 <DIR> d-------- C:\Documents and Settings\User\Dane aplikacji\Media Player Classic
2007-11-01 12:45 <DIR> d-------- C:\Program Files\Winamp Toolbar
2007-11-01 12:45 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Winamp Toolbar
2007-10-25 06:52 21,840 --a----t- C:\WINDOWS\system32\SIntfNT.dll
2007-10-25 06:52 17,212 --a----t- C:\WINDOWS\system32\SIntf32.dll
2007-10-25 06:52 12,067 --a----t- C:\WINDOWS\system32\SIntf16.dll
2007-10-23 19:50 <DIR> d-------- C:\Program Files\Rainbow Technologies
2007-10-23 19:30 708,669 --a------ C:\WINDOWS\system32\python21.dll
2007-10-23 19:30 299,073 --a------ C:\WINDOWS\system32\PythonCOM21.dll
2007-10-23 19:30 65,536 --a------ C:\WINDOWS\system32\PyWinTypes21.dll
2007-10-23 19:29 <DIR> d-------- C:\Documents and Settings\User\Dane aplikacji\ESRI
2007-10-23 19:27 <DIR> d-------- C:\Program Files\Leica Geosystems
2007-10-23 19:27 <DIR> d-------- C:\Program Files\Common Files\ESRI
2007-10-21 19:25 3,596,288 --a------ C:\WINDOWS\system32\qt-dx331.dll
2007-10-05 21:30 <DIR> d-------- C:\Documents and Settings\User\Dane aplikacji\Autodesk
2007-10-05 21:30 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Autodesk

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-11-30 13:00 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab
2007-11-30 06:54 78,973,472 --sha-w C:\WINDOWS\system32\drivers\fidbox.dat
2007-11-30 06:54 186,440 --sha-w C:\WINDOWS\system32\drivers\fidbox2.idx
2007-11-30 06:54 1,968,160 --sha-w C:\WINDOWS\system32\drivers\fidbox2.dat
2007-11-30 06:54 1,061,228 --sha-w C:\WINDOWS\system32\drivers\fidbox.idx
2007-11-29 21:32 --------- d-----w C:\Documents and Settings\User\Dane aplikacji\Tlen.pl
2007-11-28 21:14 --------- d-----w C:\Documents and Settings\User\Dane aplikacji\Skype
2007-11-20 17:37 --------- d-----w C:\Program Files\Mozilla Thunderbird
2007-11-04 11:42 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard
2007-10-30 20:41 --------- d-----w C:\Program Files\neostrada tp
2007-10-11 20:24 685,816 ----a-w C:\WINDOWS\system32\drivers\sptd.sys
2007-09-30 15:53 --------- d-----w C:\Program Files\Real Alternative
2007-09-04 16:56 164,352 ----a-w C:\WINDOWS\system32\unrar.dll
2007-08-24 05:38 108,144 ----a-w C:\WINDOWS\system32\CmdLineExt.dll
2007-08-21 06:18 683,520 ----a-w C:\WINDOWS\system32\inetcomm.dll
2007-07-28 11:37 23 --sha-w C:\WINDOWS\system32\dddbad7_r.dll
2006-05-03 10:06 163,328 --sh--r C:\WINDOWS\system32\flvDX.dll
2007-02-21 11:47 31,744 --sh--r C:\WINDOWS\system32\msfDX.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{25CEE8EC-5730-41bc-8B58-22DDC8AB8C20}]
2007-10-04 21:06 1135968 --a------ C:\Program Files\Winamp Toolbar\winamptb.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{EBF2BA02-9094-4C5A-858B-BB198F3D8DE2}"= C:\Program Files\Winamp Toolbar\winamptb.dll [2007-10-04 21:06 1135968]

[HKEY_CLASSES_ROOT\clsid\{ebf2ba02-9094-4c5a-858b-bb198f3d8de2}]
[HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand.1]
[HKEY_CLASSES_ROOT\TypeLib\{538CD77C-BFDD-49b0-9562-77419CAB89D1}]
[HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser]
"{EBF2BA02-9094-4C5A-858B-BB198F3D8DE2}"= C:\Program Files\Winamp Toolbar\winamptb.dll [2007-10-04 21:06 1135968]

[HKEY_CLASSES_ROOT\clsid\{ebf2ba02-9094-4c5a-858b-bb198f3d8de2}]
[HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand.1]
[HKEY_CLASSES_ROOT\TypeLib\{538CD77C-BFDD-49b0-9562-77419CAB89D1}]
[HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-03 23:44]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2006-11-16 18:04]
"AutoConnect"="f:\Program Files\AutoConnect\AutoConnect.exe" [2004-08-28 19:27]
"Komunikator"="F:\Program Files\Tlen.pl\tlen.exe" [2007-02-12 11:01]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"JMB36X IDE Setup"="C:\WINDOWS\JM\JMInsIDE.exe" [2006-10-31 05:44]
"36X Raid Configurer"="C:\WINDOWS\system32\JMRaidSetup.exe" [2006-11-17 02:05]
"RTHDCPL"="RTHDCPL.EXE" [2006-11-14 10:21 C:\WINDOWS\RTHDCPL.exe]
"SkyTel"="SkyTel.EXE" [2006-05-16 11:04 C:\WINDOWS\SkyTel.exe]
"NeroFilterCheck"="C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-12 14:40]
"AdslTaskBar"="stmctrl.dll" [2006-06-02 10:01 C:\WINDOWS\system32\stmctrl.dll]
"AVP"="f:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe" [2007-01-29 22:02]
"OrderReminder"="C:\Program Files\Hewlett-Packard\OrderReminder\OrderReminder.exe" [2004-12-14 18:28]
"CmUsbSound"="RunDll32 cmcnfgu.cpl" []
"ISUSPM Startup"="C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-06-16 05:03]
"ISUSScheduler"="C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [2004-06-16 05:03]
"Habu"="f:\Program Files\Razer\Habu\razerhid.exe" [2006-08-23 10:20]
"Flashget"="F:\Program Files\FlashGet\flashget.exe" [2007-09-25 09:10]
"NvCplDaemon"="RUNDLL32.exe" [2004-08-03 23:44 C:\WINDOWS\system32\rundll32.exe]
"nwiz"="nwiz.exe" [2007-03-22 03:50 C:\WINDOWS\system32\nwiz.exe]
"NvMediaCenter"="RUNDLL32.exe" [2004-08-03 23:44 C:\WINDOWS\system32\rundll32.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-03 23:44]

C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\
Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe [2006-10-23 01:48:00]
Adobe Reader Synchronizer.lnk - C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe [2006-10-23 00:01:00]
E-Color.lnk - F:\Program Files\E-Color\Common\IconMgr.exe [2007-08-11 18:15:22]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoSMConfigurePrograms"= 1 (0x1)
"NoRecentDocsMenu"= 1 (0x1)
"NoSharedDocuments"= 1 (0x1)
"ForceClassicControlPanel"= 1 (0x1)
"NoChangeKeyboardNavigationIndicators"= 0 (0x0)
C:\WINDOWS\system32\klogon.dll 2007-01-29 22:04 200768 C:\WINDOWS\system32\klogon.dll

R3 HabuFltr;Habu Mouse;C:\WINDOWS\system32\drivers\habu.sys
R3 Stmatm;ATM/ADSL miniport;C:\WINDOWS\system32\DRIVERS\stmatm.sys
R3 TaurusUsb;ADSL Modem USB Service;C:\WINDOWS\system32\DRIVERS\torususb.sys
S3 cmudau;C-Media USB Sound Interface;C:\WINDOWS\system32\drivers\cmudau.sys
S3 gdrv;gdrv;\??\C:\WINDOWS\gdrv.sys
S3 USBSTOR;Sterownik magazynu masowego USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{8fec8bf8-98fb-11dc-9b08-001a4d74c6de}]
\Shell\Auto\command - H:\UFO.exe
\Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL UFO.exe

.
**************************************************************************

catchme 0.3.1262 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-11-30 14:06:07
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-11-30 14:06:27
.
--- E O F ---

[ Dodano: Dzisiaj o 14:36 ]
dziwna sprawa bo tych logow ktore podales mi aby usunac nie ma juz w hjacku.


natomiast tego

O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE

nie wiem gdzie szukac

[Dzi@dek]

Otwórz notatnik i wklej:

Kod: Zaznacz wszystko

Windows Registry Editor Version 5.00

[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{8fec8bf8-98fb-11dc-9b08-001a4d74c6de}]

Plik zapisz jako -> zmień na wszystkie pliki - pod nazwą FIX.REG
Powstały plik uruchom i potwierdź dodanie do rejestru.

ALCMTR.EXE

Start-wyszukaj pliki lub foldery. Wcześniej w opcjach folderów przestaw na - pokaż chronione pliki systemu, pokaż ukryte pliki.

[edo_90]

Notatnik z logiem?

[dawido_0]

Nie, musisz otworzyć nowy notatnik