proszę o sprawdzenie loga.

**Posty:** 4 · przez **bestar** 13 Paź 2007, 12:15

Częste samoczynne resety systemu.

Kod: Zaznacz wszystko: Logfile of HijackThis v1.99.1 Scan saved at 11:50:32, on 2007-10-13 Platform: Unknown Windows (WinNT 6.00.1904) MSIE: Internet Explorer v7.00 (7.00.6000.16546) Running processes: C:\Windows\system32\Dwm.exe C:\Windows\system32\taskeng.exe C:\Windows\Explorer.EXE C:\Program Files\Windows Defender\MSASCui.exe C:\Windows\RtHDVCpl.exe C:\Program Files\Common Files\Symantec Shared\ccApp.exe C:\Windows\System32\rundll32.exe C:\Program Files\SiteAdvisor\6172\SiteAdv.exe C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe D:\Program files\Norton Ghost\Agent\VProTray.exe C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe C:\Program Files\cFosSpeed\cfosspeed.exe C:\Program Files\Windows Sidebar\sidebar.exe C:\Program Files\Siber Systems\AI RoboForm\robotaskbaricon.exe C:\Program Files\Skype\Phone\Skype.exe C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe C:\Program Files\Plustek\OpticSlim 2420+\AM32.exe C:\Windows\System32\rundll32.exe C:\Program Files\Common Files\Nokia\MPAPI\MPAPI3s.exe C:\Program Files\Skype\Plugin Manager\skypePM.exe L:\CHIP\Narzedzia\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.ogame.pl/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = O1 - Hosts: ::1 localhost O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {089FD14D-132B-48FC-8861-0048AE113215} - C:\Program Files\SiteAdvisor\6172\SiteAdv.dll O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.5\NppBho.dll O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll O2 - BHO: (no name) - {724d43a9-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O2 - BHO: Ask Toolbar BHO - {FE063DB1-4EC0-403e-8DD8-394C54984B2C} - C:\Program Files\AskTBar\bar\2.bin\ASKTBAR.DLL O3 - Toolbar: Show Norton Toolbar - {90222687-F593-4738-B738-FBEE9C7B26DF} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.5\UIBHO.dll O3 - Toolbar: &RoboForm - {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll O3 - Toolbar: McAfee SiteAdvisor - {0BF43445-2F28-4351-9252-17FE6E806AA0} - C:\Program Files\SiteAdvisor\6172\SiteAdv.dll O3 - Toolbar: Ask Toolbar - {FE063DB9-4EC0-403e-8DD8-394C54984B2C} - C:\Program Files\AskTBar\bar\2.bin\ASKTBAR.DLL O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe O4 - HKLM\..\Run: [Skytel] Skytel.exe O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll" O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [SiteAdvisor] C:\Program Files\SiteAdvisor\6172\SiteAdv.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" O4 - HKLM\..\Run: [Norton Ghost 12.0] "D:\Program Files\Norton Ghost\Agent\VProTray.exe" O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE -startup O4 - HKLM\..\Run: [cFosSpeed] C:\Program Files\cFosSpeed\cFosSpeed.exe O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun O4 - HKCU\..\Run: [RoboForm] "C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe" O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized O4 - HKCU\..\Run: [PcSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe O4 - Global Startup: Adobe Reader Synchronizer.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe O4 - Global Startup: Plustek OpticSlim 2420+.lnk = C:\Program Files\Plustek\OpticSlim 2420+\AM32.exe O8 - Extra context menu item: E&ksportuj do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000 O8 - Extra context menu item: Pasek Narzędzi RoboForm - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html O8 - Extra context menu item: Personalizuj Menu - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html O8 - Extra context menu item: Wypełnij Pola - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html O8 - Extra context menu item: Zapisz Pola - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra button: Wyślij do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra 'Tools' menuitem: Wyślij &do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra button: Wypełnij pola - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html O9 - Extra 'Tools' menuitem: Wypełnij Pola - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html O9 - Extra button: Zapisz - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html O9 - Extra 'Tools' menuitem: Zapisz Pola - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html O9 - Extra button: RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html O9 - Extra 'Tools' menuitem: Pasek Narzędzi RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL O10 - Unknown file in Winsock LSP: c:\windows\system32\nlaapi.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\napinsp.dll O11 - Options group: [INTERNATIONAL] International* O13 - Gopher Prefix: O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://javadl-esd.sun.com/update/1.6.0/jinstall-6u3-windows-i586-jc.cab O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll O18 - Protocol: siteadvisor - {3A5DC592-7723-4EAA-9EE6-AF4222BCF879} - C:\Program Files\SiteAdvisor\6172\SiteAdv.dll O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL O23 - Service: Symantec Event Manager (ccEvtMgr) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing) O23 - Service: Symantec Settings Manager (ccSetMgr) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing) O23 - Service: cFosSpeed System Service (cFosSpeedS) - Unknown owner - C:\Program Files\cFosSpeed\spd.exe" -service (file missing) O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h cltCommon (file missing) O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe O23 - Service: @%SystemRoot%\ehome\ehstart.dll,-101 (ehstart) - Unknown owner - %windir%\system32\svchost.exe (file missing) O23 - Service: Harmonogram automatycznej usługi LiveUpdate - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe O23 - Service: Symantec IS Password Validation (ISPwdSvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\isPwdSvc.exe O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing) O23 - Service: LiveUpdate Notice Service - Unknown owner - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PifEng.dll (file missing) O23 - Service: LVCOMSer - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\SrvLnch\SrvLnch.exe O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe O23 - Service: Norton Ghost - Symantec Corporation - D:\Program Files\Norton Ghost\Agent\VProSvc.exe O23 - Service: @%SystemRoot%\system32\qwave.dll,-1 (QWAVE) - Unknown owner - %windir%\system32\svchost.exe (file missing) O23 - Service: @%SystemRoot%\system32\seclogon.dll,-7001 (seclogon) - Unknown owner - %windir%\system32\svchost.exe (file missing) O23 - Service: ServiceLayer - Nokia. - C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe O23 - Service: Usługa SiteAdvisor (SiteAdvisor Service) - Unknown owner - C:\Program Files\SiteAdvisor\6172\SAService.exe O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe O23 - Service: @%ProgramFiles%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - %ProgramFiles%\Windows Media Player\wmpnetwk.exe (file missing)

**Posty:** 18165 · przez **wojtas** 13 Paź 2007, 12:35

zastosuj:

smitfraudfix z opcji 2:

http://siri.urz.free.fr/Fix/SmitfraudFix.exe

potem nowy log z combofixa oraz hijacka

**Posty:** 4 · przez **bestar** 13 Paź 2007, 13:26

Kod: Zaznacz wszystko: Logfile of HijackThis v1.99.1 Scan saved at 13:16:53, on 2007-10-13 Platform: Unknown Windows (WinNT 6.00.1904) MSIE: Internet Explorer v7.00 (7.00.6000.16546) Running processes: C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe C:\Windows\system32\taskeng.exe C:\Windows\system32\Dwm.exe C:\Program Files\Windows Defender\MSASCui.exe C:\Windows\RtHDVCpl.exe C:\Program Files\Common Files\Symantec Shared\ccApp.exe C:\Program Files\SiteAdvisor\6172\SiteAdv.exe C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe D:\Program files\Norton Ghost\Agent\VProTray.exe C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe C:\Program Files\cFosSpeed\cfosspeed.exe C:\Program Files\Windows Sidebar\sidebar.exe C:\Program Files\Siber Systems\AI RoboForm\robotaskbaricon.exe C:\Program Files\Skype\Phone\Skype.exe C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe C:\Program Files\Plustek\OpticSlim 2420+\AM32.exe C:\Program Files\Common Files\Nokia\MPAPI\MPAPI3s.exe C:\Program Files\Skype\Plugin Manager\skypePM.exe C:\Program Files\Internet Explorer\ieuser.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Windows\system32\conime.exe C:\Windows\explorer.exe C:\Program Files\Windows Media Player\wmpnscfg.exe C:\Windows\system32\SearchProtocolHost.exe C:\Windows\system32\SearchFilterHost.exe L:\CHIP\Narzedzia\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.ogame.pl/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = O1 - Hosts: ::1 localhost O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {089FD14D-132B-48FC-8861-0048AE113215} - C:\Program Files\SiteAdvisor\6172\SiteAdv.dll O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.5\NppBho.dll O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll O2 - BHO: (no name) - {724d43a9-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O3 - Toolbar: Show Norton Toolbar - {90222687-F593-4738-B738-FBEE9C7B26DF} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.5\UIBHO.dll O3 - Toolbar: &RoboForm - {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll O3 - Toolbar: McAfee SiteAdvisor - {0BF43445-2F28-4351-9252-17FE6E806AA0} - C:\Program Files\SiteAdvisor\6172\SiteAdv.dll O3 - Toolbar: (no name) - {FE063DB9-4EC0-403e-8DD8-394C54984B2C} - (no file) O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe O4 - HKLM\..\Run: [Skytel] Skytel.exe O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll" O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [SiteAdvisor] C:\Program Files\SiteAdvisor\6172\SiteAdv.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" O4 - HKLM\..\Run: [Norton Ghost 12.0] "D:\Program Files\Norton Ghost\Agent\VProTray.exe" O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE -startup O4 - HKLM\..\Run: [cFosSpeed] C:\Program Files\cFosSpeed\cFosSpeed.exe O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun O4 - HKCU\..\Run: [RoboForm] "C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe" O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized O4 - HKCU\..\Run: [PcSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe O4 - Global Startup: Adobe Reader Synchronizer.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe O4 - Global Startup: Plustek OpticSlim 2420+.lnk = C:\Program Files\Plustek\OpticSlim 2420+\AM32.exe O8 - Extra context menu item: E&ksportuj do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000 O8 - Extra context menu item: Pasek Narzędzi RoboForm - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html O8 - Extra context menu item: Personalizuj Menu - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html O8 - Extra context menu item: Wypełnij Pola - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html O8 - Extra context menu item: Zapisz Pola - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra button: Wyślij do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra 'Tools' menuitem: Wyślij &do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra button: Wypełnij pola - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html O9 - Extra 'Tools' menuitem: Wypełnij Pola - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html O9 - Extra button: Zapisz - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html O9 - Extra 'Tools' menuitem: Zapisz Pola - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html O9 - Extra button: RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html O9 - Extra 'Tools' menuitem: Pasek Narzędzi RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL O10 - Unknown file in Winsock LSP: c:\windows\system32\nlaapi.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\napinsp.dll O11 - Options group: [INTERNATIONAL] International* O13 - Gopher Prefix: O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://javadl-esd.sun.com/update/1.6.0/jinstall-6u3-windows-i586-jc.cab O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll O18 - Protocol: siteadvisor - {3A5DC592-7723-4EAA-9EE6-AF4222BCF879} - C:\Program Files\SiteAdvisor\6172\SiteAdv.dll O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL O23 - Service: Symantec Event Manager (ccEvtMgr) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing) O23 - Service: Symantec Settings Manager (ccSetMgr) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing) O23 - Service: cFosSpeed System Service (cFosSpeedS) - Unknown owner - C:\Program Files\cFosSpeed\spd.exe" -service (file missing) O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h cltCommon (file missing) O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe O23 - Service: @%SystemRoot%\ehome\ehstart.dll,-101 (ehstart) - Unknown owner - %windir%\system32\svchost.exe (file missing) O23 - Service: Harmonogram automatycznej usługi LiveUpdate - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe O23 - Service: Symantec IS Password Validation (ISPwdSvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\isPwdSvc.exe O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing) O23 - Service: LiveUpdate Notice Service - Unknown owner - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PifEng.dll (file missing) O23 - Service: LVCOMSer - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\SrvLnch\SrvLnch.exe O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe O23 - Service: Norton Ghost - Symantec Corporation - D:\Program Files\Norton Ghost\Agent\VProSvc.exe O23 - Service: @%SystemRoot%\system32\qwave.dll,-1 (QWAVE) - Unknown owner - %windir%\system32\svchost.exe (file missing) O23 - Service: @%SystemRoot%\system32\seclogon.dll,-7001 (seclogon) - Unknown owner - %windir%\system32\svchost.exe (file missing) O23 - Service: ServiceLayer - Nokia. - C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe O23 - Service: Usługa SiteAdvisor (SiteAdvisor Service) - Unknown owner - C:\Program Files\SiteAdvisor\6172\SAService.exe O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe O23 - Service: @%ProgramFiles%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - %ProgramFiles%\Windows Media Player\wmpnetwk.exe (file missing) [code] [/code] [code][code]ComboFix 07-10-12.4 - Artur 2007-10-13 13:13:18.1 - NTFSx86 MicrosoftR Windows Vistat Ultimate 6.0.6000.0.1250.1.1045.18.1828 [GMT 2:00] Running from: C:\Users\Artur\Downloads\ComboFix.exe * Created a new restore point . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\Users\Artur\Desktop\internet.lnk . ((((((((((((((((((((((((( Files Created from 2007-09-13 to 2007-10-13 ))))))))))))))))))))))))))))))) . 2007-10-13 13:12 51,200 --a------ C:\Windows\NirCmd.exe 2007-10-13 12:59 289,144 --a------ C:\Windows\System32\VCCLSID.exe 2007-10-13 12:59 288,417 --a------ C:\Windows\System32\SrchSTS.exe 2007-10-13 12:59 53,248 --a------ C:\Windows\System32\Process.exe 2007-10-13 12:59 51,200 --a------ C:\Windows\System32\dumphive.exe 2007-10-13 12:59 25,600 --a------ C:\Windows\System32\WS2Fix.exe 2007-10-13 12:59 2,854 --a------ C:\Windows\System32\tmp.reg 2007-10-12 22:24 683,984 -ra------ C:\Windows\System32\drivers\cfosspeed.sys 2007-10-12 22:23 <DIR> d-------- C:\Program Files\cFosSpeed 2007-10-12 22:23 281,552 --a------ C:\Windows\System32\cfosspeed.dll 2007-10-10 07:02 8,147,968 --a------ C:\Windows\System32\wmploc.DLL 2007-10-10 07:02 356,864 --a------ C:\Windows\System32\MediaMetadataHandler.dll 2007-10-10 07:02 7,680 --a------ C:\Windows\System32\spwmp.dll 2007-10-10 07:02 4,096 --a------ C:\Windows\System32\dxmasf.dll 2007-10-08 16:44 <DIR> d-------- C:\Program Files\LightScribe 2007-10-07 22:30 <DIR> d-------- C:\Users\Artur\AppData\Roaming\Nokia Multimedia Player 2007-10-07 22:29 <DIR> d-------- C:\Users\Artur\Phone Browser 2007-10-07 22:29 <DIR> d-------- C:\Users\Artur\AppData\Roaming\Datalayer 2007-10-07 22:28 <DIR> d-------- C:\Users\Artur\AppData\Roaming\Nokia 2007-10-07 22:05 <DIR> d-------- C:\Windows\Downloaded Installations 2007-10-07 22:04 <DIR> d-------- C:\Users\Artur\AppData\Roaming\PC Suite 2007-10-07 22:04 <DIR> d-------- C:\Users\All Users\PC Suite 2007-10-07 22:04 <DIR> d-------- C:\ProgramData\PC Suite 2007-10-07 22:04 <DIR> d-------- C:\Program Files\Common Files\PCSuite 2007-10-07 22:04 <DIR> d-------- C:\Program Files\Common Files\Nokia 2007-10-07 22:04 50,688 --a------ C:\Windows\System32\nmwcdcls.dll 2007-10-07 22:03 <DIR> d-------- C:\Users\All Users\Downloaded Installations 2007-10-07 22:03 <DIR> d-------- C:\ProgramData\Downloaded Installations 2007-10-07 22:03 <DIR> d-------- C:\Program Files\Nokia 2007-10-07 09:56 <DIR> d-------- C:\Program Files\MSXML 4.0 2007-10-06 17:16 <DIR> d-------- C:\Users\All Users\Nero 2007-10-06 17:16 <DIR> d-------- C:\ProgramData\Nero 2007-10-06 16:54 40,136 --a------ C:\Windows\System32\drivers\ET5Drv.sys 2007-10-06 16:44 <DIR> d-------- C:\Program Files\AskTBar 2007-10-06 16:41 327,168 --a------ C:\Windows\IsUninst.exe 2007-10-06 16:40 <DIR> d-------- C:\Windows\System32\Lang 2007-10-06 16:40 <DIR> d-------- C:\Program Files\Intel Desktop Board 2007-10-06 16:40 920,344 --a------ C:\Windows\System32\heciudlg.exe 2007-10-06 16:40 319,456 --a------ C:\Windows\System32\difxapi.dll 2007-10-06 16:30 <DIR> d-------- C:\Users\All Users\Adobe 2007-10-06 16:30 <DIR> d-------- C:\Program Files\Common Files\Adobe 2007-10-06 16:09 <DIR> d-------- C:\Users\All Users\Logitech 2007-10-06 16:09 <DIR> d-------- C:\Users\All Users\Logishrd 2007-10-06 16:09 <DIR> d-------- C:\ProgramData\Logitech 2007-10-06 16:09 <DIR> d-------- C:\ProgramData\Logishrd 2007-10-06 16:09 <DIR> d-------- C:\Program Files\Logitech 2007-10-06 16:09 <DIR> d-------- C:\Program Files\Common Files\LogiShrd 2007-10-06 13:40 <DIR> d-------- C:\VProRecovery 2007-10-06 13:11 <DIR> d-------- C:\Users\Artur\AppData\Roaming\InstallShield 2007-10-05 20:44 109,360 --a------ C:\Windows\System32\GEARAspi.dll 2007-10-05 20:44 15,664 --a------ C:\Windows\System32\drivers\GEARAspiWDM.sys 2007-10-05 20:42 215,144 -ra------ C:\Windows\patchw32.dll 2007-10-05 20:41 215,144 -ra------ C:\Windows\pw32a.dll 2007-10-05 20:16 <DIR> d-------- C:\Users\Artur\AppData\Roaming\Symantec 2007-10-05 20:03 <DIR> d----c--- C:\Windows\System32\DRVSTORE 2007-10-05 20:03 131,808 --a------ C:\Windows\System32\drivers\symsnap.sys 2007-10-05 20:03 128,104 --a------ C:\Windows\System32\drivers\WimFltr.sys 2007-10-05 20:03 37,864 --a------ C:\Windows\System32\drivers\v2imount.sys 2007-10-05 20:03 14,072 --a------ C:\Windows\System32\drivers\vproeventmonitor.sys 2007-10-04 23:08 <DIR> d-------- C:\Program Files\Java 2007-10-04 22:54 <DIR> d-------- C:\Program Files\Common Files\Java 2007-10-04 12:48 <DIR> d-------- C:\Program Files\SiteAdvisor 2007-10-04 12:47 <DIR> d-------- C:\Users\Artur\AppData\Roaming\SiteAdvisor 2007-10-04 12:47 <DIR> d-------- C:\Users\All Users\SiteAdvisor 2007-10-04 12:47 <DIR> d-------- C:\Users\All Users\McAfee 2007-10-04 12:47 <DIR> d-------- C:\ProgramData\SiteAdvisor 2007-10-04 12:47 <DIR> d-------- C:\ProgramData\McAfee 2007-10-03 20:54 22,112 -ra------ C:\Windows\System32\drivers\COH_Mon.sys 2007-10-03 07:50 <DIR> d-------- C:\Program Files\Plustek 2007-10-03 07:50 565,760 --a------ C:\Windows\System32\MSVCP50.DLL 2007-10-03 07:50 311,808 --a------ C:\Windows\System32\CAMSDKR.DLL 2007-10-03 07:50 65,024 --a------ C:\Windows\System32\DECODER.DLL 2007-10-03 07:50 45,056 --a------ C:\Windows\System32\Midrv71K.dll 2007-10-03 07:50 14,848 --a------ C:\Windows\System32\GetInst32.dll 2007-10-03 07:50 8,944 -ra------ C:\Windows\system\Usbscan.sys 2007-10-02 15:02 <DIR> d-------- C:\Program Files\Microsoft CAPICOM 2.1.0.2 2007-10-02 02:08 <DIR> d-------- C:\Users\Artur\AppData\Roaming\Tlen.pl 2007-10-02 02:08 <DIR> d-------- C:\Program Files\Tlen.pl 2007-10-02 02:01 <DIR> d-------- C:\Users\Artur\AppData\Roaming\Skype 2007-10-02 02:01 <DIR> d-------- C:\Users\All Users\Skype 2007-10-02 02:01 <DIR> d-------- C:\ProgramData\Skype 2007-10-02 02:01 <DIR> d-------- C:\Program Files\Skype 2007-10-02 02:01 <DIR> d-------- C:\Program Files\Common Files\Skype 2007-10-02 01:15 <DIR> d-------- C:\Users\Artur\AppData\Roaming\Media Player Classic 2007-10-02 01:10 <DIR> d-------- C:\Users\All Users\Real 2007-10-02 01:10 <DIR> d-------- C:\Program Files\K-Lite Codec Pack 2007-10-02 00:55 <DIR> d-------- C:\Program Files\Common Files\LightScribe 2007-10-02 00:50 <DIR> d-------- C:\Users\Artur\AppData\Roaming\Ahead 2007-10-02 00:47 <DIR> d-------- C:\Program Files\Nero 2007-10-02 00:47 <DIR> d-------- C:\Program Files\Common Files\Ahead 2007-10-02 00:04 <DIR> d-------- C:\Users\All Users\RoboForm 2007-10-02 00:04 <DIR> d-------- C:\ProgramData\RoboForm 2007-10-02 00:04 <DIR> d-------- C:\Program Files\Siber Systems 2007-10-02 00:02 <DIR> d-------- C:\Windows\System32\Macromed 2007-10-01 23:48 32,592 --a------ C:\Windows\System32\msonpmon.dll 2007-10-01 23:47 <DIR> d-------- C:\Windows\PCHEALTH 2007-10-01 23:47 <DIR> d-------- C:\Program Files\Microsoft.NET 2007-10-01 23:47 <DIR> d-------- C:\Program Files\Microsoft Works 2007-10-01 23:44 <DIR> d-------- C:\Users\All Users\Microsoft Help 2007-10-01 23:44 <DIR> d-------- C:\ProgramData\Microsoft Help . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2007-10-10 14:02 --------- d-----w C:\Program Files\Windows Mail 2007-10-10 05:00 84,480 ----a-w C:\Windows\System32\INETRES.dll 2007-10-10 05:00 788,992 ----a-w C:\Windows\System32\rpcrt4.dll 2007-10-10 05:00 737,792 ----a-w C:\Windows\System32\inetcomm.dll 2007-10-10 05:00 56,320 ----a-w C:\Windows\System32\iesetup.dll 2007-10-10 05:00 52,736 ----a-w C:\Windows\AppPatch\iebrshim.dll 2007-10-10 05:00 26,624 ----a-w C:\Windows\System32\ieUnatt.exe 2007-10-03 18:54 805 ----a-w C:\Windows\system32\drivers\SYMEVENT.INF 2007-10-03 18:54 10,740 ----a-w C:\Windows\system32\drivers\SYMEVENT.CAT 2007-10-01 21:12 --------- d-----w C:\Program Files\Microsoft Games 2007-10-01 20:56 174 --sha-w C:\Program Files\desktop.ini 2007-10-01 20:52 --------- d-----w C:\Program Files\Windows Defender 2007-10-01 20:52 --------- d-----w C:\Program Files\Windows Calendar 2007-10-01 20:51 8,192 ----a-w C:\Windows\System32\riched32.dll 2007-10-01 20:51 77,824 ----a-w C:\Windows\System32\rascfg.dll 2007-10-01 20:51 70,144 ----a-w C:\Windows\system32\drivers\pacer.sys 2007-10-01 20:51 694,784 ----a-w C:\Windows\System32\localspl.dll 2007-10-01 20:51 619,008 ----a-w C:\Windows\system32\drivers\dxgkrnl.sys 2007-10-01 20:51 61,952 ----a-w C:\Windows\system32\drivers\wanarp.sys 2007-10-01 20:51 52,736 ----a-w C:\Windows\System32\rasdiag.dll 2007-10-01 20:51 48,640 ----a-w C:\Windows\system32\drivers\ndproxy.sys 2007-10-01 20:51 384,000 ----a-w C:\Windows\System32\netcfgx.dll 2007-10-01 20:51 36,864 ----a-w C:\Windows\System32\cdd.dll 2007-10-01 20:51 33,280 ----a-w C:\Windows\System32\traffic.dll 2007-10-01 20:51 32,768 ----a-w C:\Windows\System32\rasmxs.dll 2007-10-01 20:51 286,208 ----a-w C:\Windows\System32\ipnathlp.dll 2007-10-01 20:51 22,016 ----a-w C:\Windows\System32\rasser.dll 2007-10-01 20:51 20,480 ----a-w C:\Windows\system32\drivers\ndistapi.sys 2007-10-01 20:51 15,360 ----a-w C:\Windows\System32\pacerprf.dll 2007-10-01 20:51 134,656 ----a-w C:\Windows\System32\dps.dll 2007-10-01 20:51 13,824 ----a-w C:\Windows\System32\wshqos.dll 2007-10-01 20:51 13,824 ----a-w C:\Windows\System32\icsunattend.exe 2007-10-01 20:47 86,016 ----a-w C:\Windows\System32\icfupgd.dll 2007-10-01 20:47 63,488 ----a-w C:\Windows\system32\drivers\mpsdrv.sys 2007-10-01 20:47 61,952 ----a-w C:\Windows\System32\cmifw.dll 2007-10-01 20:47 414,208 ----a-w C:\Windows\System32\msscp.dll 2007-10-01 20:47 396,800 ----a-w C:\Windows\System32\MPSSVC.dll 2007-10-01 20:47 392,192 ----a-w C:\Windows\System32\FirewallAPI.dll 2007-10-01 20:47 374,456 ----a-w C:\Windows\System32\mcupdate_GenuineIntel.dll 2007-10-01 20:47 23,040 ----a-w C:\Windows\system32\drivers\tunnel.sys 2007-10-01 20:47 178,688 ----a-w C:\Windows\System32\iphlpsvc.dll 2007-10-01 20:47 16,896 ----a-w C:\Windows\System32\wfapigp.dll 2007-10-01 20:47 15,360 ----a-w C:\Windows\system32\drivers\TUNMP.SYS 2007-10-01 20:45 537,600 ----a-w C:\Windows\AppPatch\AcLayers.dll 2007-10-01 20:45 449,536 ----a-w C:\Windows\AppPatch\AcSpecfc.dll 2007-10-01 20:45 2,144,256 ----a-w C:\Windows\AppPatch\AcGenral.dll 2007-10-01 20:45 173,056 ----a-w C:\Windows\AppPatch\AcXtrnal.dll 2007-10-01 20:42 88,576 ----a-w C:\Windows\System32\avifil32.dll 2007-10-01 20:42 82,944 ----a-w C:\Windows\System32\mciavi32.dll 2007-10-01 20:42 8,138,240 ----a-w C:\Windows\System32\ssBranded.scr 2007-10-01 20:42 712,192 ----a-w C:\Windows\System32\WindowsCodecs.dll 2007-10-01 20:42 704,000 ----a-w C:\Windows\System32\PhotoScreensaver.scr 2007-10-01 20:42 69,632 ----a-w C:\Windows\System32\sendmail.dll 2007-10-01 20:42 65,024 ----a-w C:\Windows\System32\avicap32.dll 2007-10-01 20:42 61,440 ----a-w C:\Windows\System32\ntprint.exe 2007-10-01 20:42 53,760 ----a-w C:\Windows\system32\drivers\hdaudbus.sys 2007-10-01 20:42 320,000 ----a-w C:\Windows\system32\drivers\csc.sys 2007-10-01 20:42 31,232 ----a-w C:\Windows\System32\msvidc32.dll 2007-10-01 20:42 3,504,824 ----a-w C:\Windows\System32\ntkrnlpa.exe 2007-10-01 20:42 3,470,008 ----a-w C:\Windows\System32\ntoskrnl.exe 2007-10-01 20:42 269,824 ----a-w C:\Windows\System32\schannel.dll 2007-10-01 20:42 220,160 ----a-w C:\Windows\System32\ntprint.dll 2007-10-01 20:42 123,904 ----a-w C:\Windows\System32\msvfw32.dll 2007-10-01 20:42 120,320 ----a-w C:\Windows\System32\dhcpcsvc6.dll 2007-10-01 20:42 12,800 ----a-w C:\Windows\System32\msrle32.dll 2007-10-01 20:42 105,984 ----a-w C:\Windows\System32\CscMig.dll 2007-10-01 20:42 10,240 ----a-w C:\Windows\System32\dhcpcmonitor.dll 2007-10-01 20:42 1,984,512 ----a-w C:\Windows\System32\authui.dll 2007-10-01 20:09 319,456 ----a-w C:\Windows\DIFxAPI.dll 2007-10-01 17:21 --------- d-sh--w C:\ProgramData\Ulubione 2007-10-01 17:21 --------- d-sh--w C:\ProgramData\Szablony 2007-10-01 17:21 --------- d-sh--w C:\ProgramData\Pulpit 2007-10-01 17:21 --------- d-sh--w C:\ProgramData\Menu Start 2007-10-01 17:21 --------- d-sh--w C:\ProgramData\Dokumenty 2007-10-01 17:21 --------- d-sh--w C:\ProgramData\Dane aplikacji 2007-09-18 12:44 10,662 ----a-w C:\Windows\system32\drivers\srtspx.cat 2007-09-18 12:44 10,662 ----a-w C:\Windows\system32\drivers\srtspl.cat 2007-09-18 12:44 10,658 ----a-w C:\Windows\system32\drivers\srtsp.cat 2007-09-18 12:44 1,430 ----a-w C:\Windows\system32\drivers\srtspl.inf 2007-09-18 12:44 1,421 ----a-w C:\Windows\system32\drivers\srtspx.inf 2007-09-18 12:44 1,415 ----a-w C:\Windows\system32\drivers\srtsp.inf 2007-08-24 16:08 1,275,392 ----a-w C:\Windows\System32\msxml4.dll 2007-07-29 15:51 7,680 ----a-w C:\Windows\System32\ff_vfw.dll 2007-07-25 13:24 1,559,040 ----a-w C:\Windows\System32\xvidcore.dll . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [2007-10-01 22:49] "RtHDVCpl"="RtHDVCpl.exe" [2007-04-23 09:51 C:\Windows\RtHDVCpl.exe] "Skytel"="Skytel.exe" [2007-04-13 09:36 C:\Windows\SkyTel.exe] "ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2007-01-09 23:59] "Symantec PIF AlertEng"="C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [2007-03-12 11:22] "NvSvc"="C:\Windows\system32\nvsvc.dll" [2007-07-06 20:15] "NvCplDaemon"="C:\Windows\system32\NvCpl.dll" [2007-07-06 20:15] "NvMediaCenter"="C:\Windows\system32\NvMcTray.dll" [2007-07-06 20:15] "SiteAdvisor"="C:\Program Files\SiteAdvisor\6172\SiteAdv.exe" [2007-08-13 20:05] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11] "Norton Ghost 12.0"="D:\Program Files\Norton Ghost\Agent\VProTray.exe" [2007-07-31 17:36] "PCSuiteTrayApplication"="C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.exe" [2006-06-15 12:36] "cFosSpeed"="C:\Program Files\cFosSpeed\cFosSpeed.exe" [2007-07-09 17:10] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Sidebar"="C:\Program Files\Windows Sidebar\sidebar.exe" [2006-11-02 14:33] "RoboForm"="C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe" [2007-10-02 00:04] "Skype"="C:\Program Files\Skype\Phone\Skype.exe" [2007-09-13 13:31] "PcSync"="C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2006-06-27 16:21] C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\ Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe [2006-10-23 02:48:00] Adobe Reader Synchronizer.lnk - C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe [2006-10-23 01:01:00] Plustek OpticSlim 2420+.lnk - C:\Program Files\Plustek\OpticSlim 2420+\AM32.exe [2007-10-03 07:50:53] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EasyTuneV] C:\Program Files\Gigabyte\ET5\ETcall.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechCommunicationsManager] "C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechQuickCamRibbon] "C:\Program Files\Logitech\QuickCam\Quickcam.exe" /hide [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe R1 IDSvix86;Symantec Intrusion Prevention Driver;\??\C:\PROGRA~2\Symantec\DEFINI~1\SymcData\idsdefs\20071011.001\IDSvix86.sys R2 Harmonogram automatycznej usługi LiveUpdate;Harmonogram automatycznej usługi LiveUpdate;"C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe" R2 v2imount;Symantec V2i Mount Driver;C:\Windows\system32\DRIVERS\v2imount.sys R3 nvlddmkm;nvlddmkm;C:\Windows\system32\DRIVERS\nvlddmkm.sys R3 RTL8169;Sterownik kart Realtek 8169 dla systemu NT;C:\Windows\system32\DRIVERS\Rtlh86.sys R3 SYMNDISV;SYMNDISV;C:\Windows\system32\Drivers\SYMNDISV.SYS S3 gdrv;gdrv;\??\C:\Windows\gdrv.sys S3 WimFltr;WimFltr;C:\Windows\system32\DRIVERS\wimfltr.sys AutoRun\command - E:\AutoRun.exe AutoRun\command - L:\CHIP\PakietyUSB.exe *Newly Created Service* - CATCHME *Newly Created Service* - COMHOST . Contents of the 'Scheduled Tasks' folder "2007-10-13 01:00:16 C:\Windows\Tasks\User_Feed_Synchronization-{27A631D5-E482-4470-850A-06258C1574E5}.job" . ************************************************************************** catchme 0.3.1169 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-10-13 13:14:50 Windows 6.0.6000 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2007-10-13 13:15:37 . --- E O F ---[/code][/code]

**Posty:** 18165 · przez **wojtas** 13 Paź 2007, 14:55

O1 - Hosts: ::1 localhost
O3 - Toolbar: (no name) - {FE063DB9-4EC0-403e-8DD8-394C54984B2C} - (no file)
O13 - Gopher Prefix:

skasuj te wpisy w hijacku

oraz ten pogrubiony do kosza:

C:\Program Files\AskTBar

nie wiem czy w viscie to bedzie ale sprobuj:

Prawym na ,,Mój komputer">właściwości>Zakładka "Zaawansowane" -> Uruchamianie i odzyskiwanie i klikamy "ustawienia">
w części "Awaria systemu" odznaczamy pole "Automatycznie uruchom ponownie"

teraz zamiast resetu pojawi sie bluescreen przepisz kod bledu z dolu strony bluescreena

**Posty:** 4 · przez **bestar** 13 Paź 2007, 15:19

nie mogę zfixsować tych wpisów w Hijack-u.

**Posty:** 18165 · przez **wojtas** 13 Paź 2007, 16:01

czemu? jesli jakis blad to zostaw

Uruchamiasz HijackThis => klikasz Do a system scan only => pokaże się lista wpisów => stawiasz ptaszek przy wpisach, które wymieniłem => klikasz Fix checked i potwierdzasz usunięcie.

wazne jest zebys podal kod z bluescreena

**Posty:** 4 · przez **bestar** 13 Paź 2007, 16:14

Tak robiłem, ale po restarcie kompa wpisy pokazują się znowu.
co do restartów, narazie wydaje, że jest już wporządku. Problem znikł. Wyłączenie funkcji auto startu w Viście jest identycznie jak w XP.
Dzięki za porady.
Pzdrawiam Bestar.

[ Dodano: Dzisiaj o 22:15 ]
Kody błędów z blauscern-a Stop: 0x000000D1 (0x00000002, 0x00000001, 0x806F4A9E)
* ndis.sys - Adres 806F4A9E

[ Dodano: Dzisiaj o 22:19 ]
Dopiero traz miałem bluescreena. Wcześniej co godzina.

**Posty:** 3854 · przez **Dzi@dek** 15 Paź 2007, 12:34

bestar
popatrz tutaj:
http://support.microsoft.com/kb/818326/pl

btw

ndis.sys >>> problem leży w modemie, karcie sieciowej, jednym z zainstalowanych protokołów sieciowych, sofcie który monitoruje połączenie

proszę o sprawdzenie loga.

Proszę o sprawdzenie loga.

Kto jest na forum