proszę o sprawdzenie loga

**Posty:** 2 · przez **Bogusz16** 18 Paź 2007, 15:14

Od pewnego czasu nie chce mi sie właczyć program dmcr.exe[/b]

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 15:06:56, on 2007-10-18 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\ATKKBService.exe C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\HPZipm12.exe C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe C:\WINDOWS\system32\RUNDLL32.EXE C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Adobe\Acrobat 7.0\Distillr\AcroDist.exe C:\Program Files\Messenger\msmsgs.exe C:\DOCUME~1\user\USTAWI~1\Temp\Adobelm_Cleanup.0001 C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe C:\Program Files\Opera\Opera.exe C:\Program Files\Gadu-Gadu\gg.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {1FC80E00-41B0-4F74-BC16-2C83ED49CAC9} - (no file) O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe" O4 - HKLM\..\Run: [Acrobat Assistant 7.0] "C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe" O4 - HKLM\..\Run: [SmartDefrag] "C:\Program Files\IObit\IObit SmartDefrag\IObit SmartDefrag.exe" /startup O4 - HKLM\..\Run: [amd_dc_opt] C:\Program Files\AMD\Dual-Core Optimizer\amd_dc_opt.exe O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKLM\..\Policies\Explorer\Run: [user32.dll] C:\Program Files\Video AX Object\bpmon.exe O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Startup: Tworzenie wycinków ekranu i uruchamianie programu OneNote 2007.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE O4 - Global Startup: Adobe Acrobat Speed Launcher.lnk = ? O8 - Extra context menu item: E&ksportuj do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000 O8 - Extra context menu item: Konwertuj do Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html O8 - Extra context menu item: Konwertuj do istniejącego pliku PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html O8 - Extra context menu item: Konwertuj miejsce docelowe łącza do Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html O8 - Extra context menu item: Konwertuj miejsce docelowe łącza do istniejącego pliku PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html O8 - Extra context menu item: Konwertuj wybrane łącza do Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html O8 - Extra context menu item: Konwertuj wybrane łącza do istniejącego pliku PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html O8 - Extra context menu item: Konwertuj zaznaczenie do Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html O8 - Extra context menu item: Konwertuj zaznaczenie do istniejącego pliku PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll O9 - Extra button: Statystyki ochrony WWW - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\scieplugin.dll O9 - Extra button: Wyślij do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra 'Tools' menuitem: Wyślij &do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C5} (GameDesire Snooker) - http://67.15.101.3/g_bin/pl/snooker_2_0_0_31.cab O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL O22 - SharedTaskScheduler: depreciable - {716002db-288c-4bf0-80cd-a467e78d8b55} - (no file) O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: ATK Keyboard Service (ATKKeyboardService) - ASUSTeK COMPUTER INC. - C:\WINDOWS\ATKKBService.exe O23 - Service: Kaspersky Anti-Virus 6.0 (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe O23 - Service: Harmonogram automatycznej usługi LiveUpdate - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe O23 - Service: TuneUp WinStyler Theme Service (TUWinStylerThemeSvc) - TuneUp Software GmbH - C:\Program Files\TuneUp Utilities 2004\WinStylerThemeSvc.exe -- End of file - 8193 bytes

**Posty:** 3854 · przez **Dzi@dek** 18 Paź 2007, 15:46

Do usunięcia w awaryjnym po wyłączeniu przywracania systemu:

O2 - BHO: (no name) - {1FC80E00-41B0-4F74-BC16-2C83ED49CAC9} - (no file)
O4 - HKLM\..\Policies\Explorer\Run: [user32.dll] C:\Program Files\Video AX Object\bpmon.exe
O22 - SharedTaskScheduler: depreciable - {716002db-288c-4bf0-80cd-a467e78d8b55} - (no file)

Pogrubiony katalog usuwasz na końcu z dysku ręcznie.
Usuń zawartość folderu:

C:\DOCUME~1\user\USTAWI~1\Temp\Adobelm_Cleanup.0001

Masz Spybota a nie używasz-przeskanuj nim system.

**Posty:** 18165 · przez **wojtas** 18 Paź 2007, 17:07

zastosuj rowniez:

zastosuj:

smitfraudfix z opcji 2:

http://siri.urz.free.fr/Fix/SmitfraudFix.exe

potem daj loga z combofixa oraz hijacka

**Posty:** 2 · przez **Bogusz16** 18 Paź 2007, 19:54

Zastosowałem się do podanych zaleceń ale program nadal nie działa

oto moje nowe logi z hijacka i combofixa

Kod: Zaznacz wszystko: gfile of Trend Micro HijackThis v2.0.2 Scan saved at 19:44, on 2007-10-18 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\ATKKBService.exe C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\HPZipm12.exe C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe C:\WINDOWS\system32\RUNDLL32.EXE C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Adobe\Acrobat 7.0\Distillr\AcroDist.exe C:\Program Files\Messenger\msmsgs.exe C:\DOCUME~1\user\USTAWI~1\Temp\Adobelm_Cleanup.0001 C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe C:\WINDOWS\system32\wuauclt.exe C:\Program Files\Opera\Opera.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" O4 - HKLM\..\Run: [Acrobat Assistant 7.0] "C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe" O4 - HKLM\..\Run: [SmartDefrag] "C:\Program Files\IObit\IObit SmartDefrag\IObit SmartDefrag.exe" /startup O4 - HKLM\..\Run: [amd_dc_opt] C:\Program Files\AMD\Dual-Core Optimizer\amd_dc_opt.exe O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe" O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Startup: Tworzenie wycinków ekranu i uruchamianie programu OneNote 2007.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE O4 - Global Startup: Adobe Acrobat Speed Launcher.lnk = ? O8 - Extra context menu item: E&ksportuj do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000 O8 - Extra context menu item: Konwertuj do Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html O8 - Extra context menu item: Konwertuj do istniejącego pliku PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html O8 - Extra context menu item: Konwertuj miejsce docelowe łącza do Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html O8 - Extra context menu item: Konwertuj miejsce docelowe łącza do istniejącego pliku PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html O8 - Extra context menu item: Konwertuj wybrane łącza do Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html O8 - Extra context menu item: Konwertuj wybrane łącza do istniejącego pliku PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html O8 - Extra context menu item: Konwertuj zaznaczenie do Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html O8 - Extra context menu item: Konwertuj zaznaczenie do istniejącego pliku PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll O9 - Extra button: Statystyki ochrony WWW - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\scieplugin.dll O9 - Extra button: Wyślij do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra 'Tools' menuitem: Wyślij &do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C5} (GameDesire Snooker) - http://67.15.101.3/g_bin/pl/snooker_2_0_0_31.cab O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: ATK Keyboard Service (ATKKeyboardService) - ASUSTeK COMPUTER INC. - C:\WINDOWS\ATKKBService.exe O23 - Service: Kaspersky Anti-Virus 6.0 (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe O23 - Service: Harmonogram automatycznej usługi LiveUpdate - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe O23 - Service: TuneUp WinStyler Theme Service (TUWinStylerThemeSvc) - TuneUp Software GmbH - C:\Program Files\TuneUp Utilities 2004\WinStylerThemeSvc.exe -- End of file - 7928 bytes ComboFix 07-10-18.6 - user 2007-10-18 19:44:46.3 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.2.1250.1.1045.18.2629 [GMT 2:00] Running from: C:\Documents and Settings\user\Moje dokumenty\ComboFix.exe . ((((((((((((((((((((((((( Files Created from 2007-09-18 to 2007-10-18 ))))))))))))))))))))))))))))))) . 2007-10-18 19:00 51,200 --a------ C:\WINDOWS\NirCmd.exe 2007-10-18 18:49 2,282 --a------ C:\WINDOWS\system32\tmp.reg 2007-10-17 18:51 <DIR> d-------- C:\Program Files\Trend Micro 2007-10-08 15:50 <DIR> d-------- C:\Documents and Settings\user\Dane aplikacji\Tibia 2007-10-05 15:49 <DIR> d-------- C:\NVIDIA 2007-10-05 14:40 <DIR> d-------- C:\WINDOWS\Downloaded Installations 2007-10-05 14:40 33,280 --a------ C:\WINDOWS\system32\drivers\AmdLLD.sys 2007-10-05 14:31 <DIR> d-------- C:\Documents and Settings\user\SystemRequirementsLab 2007-10-01 15:59 <DIR> dr-h----- C:\Documents and Settings\user\Dane aplikacji\SecuROM 2007-10-01 15:59 <DIR> d-------- C:\Documents and Settings\user\Dane aplikacji\Bioshock 2007-10-01 15:59 107,888 --a------ C:\WINDOWS\system32\CmdLineExt.dll 2007-09-21 13:45 <DIR> d-------- C:\Program Files\GameSpy Arcade . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2007-10-18 17:47 18,755,104 --sha-w C:\WINDOWS\system32\drivers\fidbox.dat 2007-10-18 17:43 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab 2007-10-18 17:31 254,432 --sha-w C:\WINDOWS\system32\drivers\fidbox.idx 2007-10-18 17:31 114,356 --sha-w C:\WINDOWS\system32\drivers\fidbox2.idx 2007-10-18 17:31 1,193,248 --sha-w C:\WINDOWS\system32\drivers\fidbox2.dat 2007-10-18 16:46 --------- d-----w C:\Program Files\Windows Media Connect 2 2007-10-11 12:40 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Microsoft Help 2007-10-06 08:35 --------- d--h--w C:\Program Files\InstallShield Installation Information 2007-10-05 12:40 --------- d-----w C:\Program Files\AMD 2007-09-29 14:46 --------- d-----w C:\Program Files\totalcmd 2007-09-24 13:11 --------- d-----w C:\Program Files\Gadu-Gadu 2007-09-21 08:49 --------- d-----w C:\Program Files\Common Files\Adobe 2007-09-16 23:24 356,352 ----a-w C:\WINDOWS\system32\nvunrm.exe 2007-09-16 23:24 356,352 ----a-w C:\WINDOWS\system32\NVUNINST.EXE 2007-09-16 23:24 356,352 ----a-w C:\WINDOWS\system32\nvudisp.exe 2007-09-16 23:07 81,920 ----a-w C:\WINDOWS\system32\nvwddi.dll 2007-09-16 23:07 81,920 ----a-w C:\WINDOWS\system32\nvmctray.dll 2007-09-16 23:07 8,491,008 ----a-w C:\WINDOWS\system32\nvcpl.dll 2007-09-16 23:07 753,664 ----a-w C:\WINDOWS\system32\nvcplui.exe 2007-09-16 23:07 6,853,088 ----a-w C:\WINDOWS\system32\drivers\nv4_mini.sys 2007-09-16 23:07 6,746,112 ----a-w C:\WINDOWS\system32\nvoglnt.dll 2007-09-16 23:07 6,344,704 ----a-w C:\WINDOWS\system32\nvdisps.dll 2007-09-16 23:07 5,783,040 ----a-w C:\WINDOWS\system32\nv4_disp.dll 2007-09-16 23:07 5,509,120 ----a-w C:\WINDOWS\system32\nvdispsr.dll 2007-09-16 23:07 466,944 ----a-w C:\WINDOWS\system32\nvshell.dll 2007-09-16 23:07 458,752 ----a-w C:\WINDOWS\system32\nvmccssr.dll 2007-09-16 23:07 45,056 ----a-w C:\WINDOWS\system32\nvmccsrs.dll 2007-09-16 23:07 442,368 ----a-w C:\WINDOWS\system32\nvappbar.exe 2007-09-16 23:07 425,984 ----a-w C:\WINDOWS\system32\keystone.exe 2007-09-16 23:07 364,544 ----a-w C:\WINDOWS\system32\nvapi.dll 2007-09-16 23:07 36,864 ----a-w C:\WINDOWS\system32\nvcodins.dll 2007-09-16 23:07 36,864 ----a-w C:\WINDOWS\system32\nvcod.dll 2007-09-16 23:07 335,872 ----a-w C:\WINDOWS\system32\nvwrses.dll 2007-09-16 23:07 335,872 ----a-w C:\WINDOWS\system32\nvwrsel.dll 2007-09-16 23:07 327,680 ----a-w C:\WINDOWS\system32\nvwrsfr.dll 2007-09-16 23:07 327,680 ----a-w C:\WINDOWS\system32\nvwrsesm.dll 2007-09-16 23:07 327,680 ----a-w C:\WINDOWS\system32\nvrshe.dll 2007-09-16 23:07 327,680 ----a-w C:\WINDOWS\system32\nvrsar.dll 2007-09-16 23:07 323,584 ----a-w C:\WINDOWS\system32\nvwrspt.dll 2007-09-16 23:07 323,584 ----a-w C:\WINDOWS\system32\nvwrsit.dll 2007-09-16 23:07 319,488 ----a-w C:\WINDOWS\system32\nvwrsptb.dll 2007-09-16 23:07 319,488 ----a-w C:\WINDOWS\system32\nvwrsnl.dll 2007-09-16 23:07 315,392 ----a-w C:\WINDOWS\system32\nvwrsru.dll 2007-09-16 23:07 315,392 ----a-w C:\WINDOWS\system32\nvwrshu.dll 2007-09-16 23:07 311,296 ----a-w C:\WINDOWS\system32\nvwrsde.dll 2007-09-16 23:07 307,200 ----a-w C:\WINDOWS\system32\nvexpbar.dll 2007-09-16 23:07 303,104 ----a-w C:\WINDOWS\system32\nvwrstr.dll 2007-09-16 23:07 303,104 ----a-w C:\WINDOWS\system32\nvwrssl.dll 2007-09-16 23:07 303,104 ----a-w C:\WINDOWS\system32\nvwrsfi.dll 2007-09-16 23:07 3,629,056 ----a-w C:\WINDOWS\system32\nvvitvsr.dll 2007-09-16 23:07 3,551,232 ----a-w C:\WINDOWS\system32\nvvitvs.dll 2007-09-16 23:07 3,334,144 ----a-w C:\WINDOWS\system32\nvgames.dll 2007-09-16 23:07 3,166,208 ----a-w C:\WINDOWS\system32\nvgamesr.dll 2007-09-16 23:07 299,008 ----a-w C:\WINDOWS\system32\nvwrssk.dll 2007-09-16 23:07 299,008 ----a-w C:\WINDOWS\system32\nvwrsno.dll 2007-09-16 23:07 294,912 ----a-w C:\WINDOWS\system32\nvwrssv.dll 2007-09-16 23:07 294,912 ----a-w C:\WINDOWS\system32\nvwrspl.dll 2007-09-16 23:07 294,912 ----a-w C:\WINDOWS\system32\nvwrsda.dll 2007-09-16 23:07 290,816 ----a-w C:\WINDOWS\system32\nvwrsth.dll 2007-09-16 23:07 286,720 ----a-w C:\WINDOWS\system32\nvwrseng.dll 2007-09-16 23:07 286,720 ----a-w C:\WINDOWS\system32\nvwrscs.dll 2007-09-16 23:07 286,720 ----a-w C:\WINDOWS\system32\nvnt4cpl.dll 2007-09-16 23:07 282,624 ----a-w C:\WINDOWS\system32\nvwrsar.dll 2007-09-16 23:07 282,624 ----a-w C:\WINDOWS\system32\nvrsfr.dll 2007-09-16 23:07 282,624 ----a-w C:\WINDOWS\system32\nvrses.dll 2007-09-16 23:07 282,624 ----a-w C:\WINDOWS\system32\nvrsel.dll 2007-09-16 23:07 278,528 ----a-w C:\WINDOWS\system32\nvwrshe.dll 2007-09-16 23:07 278,528 ----a-w C:\WINDOWS\system32\nvrsit.dll 2007-09-16 23:07 278,528 ----a-w C:\WINDOWS\system32\nvrsde.dll 2007-09-16 23:07 274,432 ----a-w C:\WINDOWS\system32\nvrspt.dll 2007-09-16 23:07 274,432 ----a-w C:\WINDOWS\system32\nvrsnl.dll 2007-09-16 23:07 274,432 ----a-w C:\WINDOWS\system32\nvrsesm.dll 2007-09-16 23:07 270,336 ----a-w C:\WINDOWS\system32\nvrsru.dll 2007-09-16 23:07 266,240 ----a-w C:\WINDOWS\system32\nvrsptb.dll 2007-09-16 23:07 266,240 ----a-w C:\WINDOWS\system32\nvrsja.dll 2007-09-16 23:07 258,048 ----a-w C:\WINDOWS\system32\nvrstr.dll 2007-09-16 23:07 258,048 ----a-w C:\WINDOWS\system32\nvrssl.dll 2007-09-16 23:07 258,048 ----a-w C:\WINDOWS\system32\nvrssk.dll 2007-09-16 23:07 258,048 ----a-w C:\WINDOWS\system32\nvrsko.dll 2007-09-16 23:07 258,048 ----a-w C:\WINDOWS\system32\nvrshu.dll 2007-09-16 23:07 253,952 ----a-w C:\WINDOWS\system32\nvrsth.dll 2007-09-16 23:07 253,952 ----a-w C:\WINDOWS\system32\nvrssv.dll 2007-09-16 23:07 253,952 ----a-w C:\WINDOWS\system32\nvrspl.dll 2007-09-16 23:07 253,952 ----a-w C:\WINDOWS\system32\nvrsno.dll 2007-09-16 23:07 253,952 ----a-w C:\WINDOWS\system32\nvrsda.dll 2007-09-16 23:07 249,856 ----a-w C:\WINDOWS\system32\nvrsfi.dll 2007-09-16 23:07 249,856 ----a-w C:\WINDOWS\system32\nvrscs.dll 2007-09-16 23:07 245,760 ----a-w C:\WINDOWS\system32\nvrseng.dll 2007-09-16 23:07 229,376 ----a-w C:\WINDOWS\system32\nvmccs.dll 2007-09-16 23:07 225,280 ----a-w C:\WINDOWS\system32\nvrszhc.dll 2007-09-16 23:07 212,992 ----a-w C:\WINDOWS\system32\nvwrsja.dll 2007-09-16 23:07 2,854,912 ----a-w C:\WINDOWS\system32\nvmoblsr.dll 2007-09-16 23:07 2,441,216 ----a-w C:\WINDOWS\system32\nvwssr.dll 2007-09-16 23:07 2,371,584 ----a-w C:\WINDOWS\system32\nvwss.dll 2007-09-16 23:07 196,608 ----a-w C:\WINDOWS\system32\nvwrsko.dll 2007-09-16 23:07 188,416 ----a-w C:\WINDOWS\system32\nvmccss.dll 2007-09-16 23:07 167,936 ----a-w C:\WINDOWS\system32\nvwrszht.dll 2007-09-16 23:07 163,840 ----a-w C:\WINDOWS\system32\nvwrszhc.dll 2007-09-16 23:07 155,716 ----a-w C:\WINDOWS\system32\nvsvc32.exe 2007-09-16 23:07 147,456 ----a-w C:\WINDOWS\system32\nvcolor.exe . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 10:50] "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-09-17 01:07] "nwiz"="nwiz.exe" [2007-09-17 01:07 C:\WINDOWS\system32\nwiz.exe] "GrooveMonitor"="C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-27 00:47] "Acrobat Assistant 7.0"="C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe" [2004-12-14 11:12] "SmartDefrag"="C:\Program Files\IObit\IObit SmartDefrag\IObit SmartDefrag.exe" [2007-06-06 19:22] "amd_dc_opt"="C:\Program Files\AMD\Dual-Core Optimizer\amd_dc_opt.exe" [2006-11-17 16:49] "NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-09-17 01:07] "AVP"="C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe" [2007-03-09 20:50] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 14:00] "MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 18:24] C:\Documents and Settings\user\Menu Start\Programy\Autostart\ Tworzenie wycink˘w ekranu i uruchamianie programu OneNote 2007.lnk - C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE [2006-10-26 20:24:54] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Adobe Acrobat Speed Launcher.lnk] path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Adobe Acrobat Speed Launcher.lnk backup=C:\WINDOWS\pss\Adobe Acrobat Speed Launcher.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^user^Menu Start^Programy^Autostart^hamachi.lnk] path=C:\Documents and Settings\user\Menu Start\Programy\Autostart\hamachi.lnk backup=C:\WINDOWS\pss\hamachi.lnkStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Acrobat Assistant 7.0] "C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MalwareWiped 6.1] "C:\Program Files\MW\MalwareWiped 6.1\MalwareWiped 6.1.exe" /h [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SmartDefrag] "C:\Program Files\IObit\IObit SmartDefrag\IObit SmartDefrag.exe" /startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan] SOUNDMAN.EXE [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe" R2 Harmonogram automatycznej usługi LiveUpdate;Harmonogram automatycznej usługi LiveUpdate;"C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe" R3 AmdLLD;AMD Low Level Device Driver;C:\WINDOWS\system32\DRIVERS\AmdLLD.sys S3 Amsmpu4p;Amsmpu4p;\??\C:\DOCUME~1\user\USTAWI~1\Temp\Amsmpu4p.sys S3 ddsxeiservice;ddsxeiservice;\??\F:\Program Files\sXe Injected\ddsxei.sys S3 GVCplDrv;GVCplDrv;C:\WINDOWS\system32\drivers\GVCplDrv.sys S3 siusbmod;siusbmod;C:\WINDOWS\system32\DRIVERS\siusbmod.sys [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{8c4a579f-5604-11dc-a604-00080e8b5bff}] AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL copy.exe . Contents of the 'Scheduled Tasks' folder "2007-10-18 17:43:03 C:\WINDOWS\Tasks\SmartDefrag.job" - C:\Program Files\IObit\IObit SmartDefrag\schedule.exe . ************************************************************************** catchme 0.3.1169 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-10-18 19:47:45 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ...

proszę o sprawdzenie loga

proszę o sprawdzenie loga

Kto jest na forum