prosze o sprawdzenie loga

**Posty:** 861 · przez **jacekk04** 07 Gru 2007, 16:01

avast co wykryl

Kod: Zaznacz wszystko: Logfile of HijackThis v1.99.1 Scan saved at 14:53:21, on 2007-12-07 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINNT\System32\smss.exe C:\WINNT\system32\winlogon.exe C:\WINNT\system32\services.exe C:\WINNT\system32\lsass.exe C:\WINNT\system32\svchost.exe C:\WINNT\System32\svchost.exe C:\Program Files\Sygate\SPF\smc.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINNT\system32\ZCfgSvc.exe C:\WINNT\Explorer.EXE C:\WINNT\system32\spoolsv.exe C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\Program Files\Unlocker\UnlockerAssistant.exe C:\Program Files\Winamp\winampa.exe C:\WINNT\RTHDCPL.EXE C:\WINNT\system32\igfxtray.exe C:\WINNT\system32\hkcmd.exe C:\WINNT\system32\igfxpers.exe C:\Program Files\D-Tools\daemon.exe C:\WINNT\system32\igfxsrvc.exe C:\WINNT\system32\ctfmon.exe C:\Program Files\Gadu-Gadu\gg.exe C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe C:\WINNT\system32\agrsmsvc.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe F:\PROGRAMY\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\NEOSTR~1\SEARCH~1.DLL (file missing) O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINNT\system32\NeroCheck.exe O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [UnlockerAssistant] C:\Program Files\Unlocker\UnlockerAssistant.exe O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe O4 - HKLM\..\Run: [ZCfgSvc.exe] C:\WINNT\system32\ZCfgSvc.exe O4 - HKLM\..\Run: [PRONoMgr.exe] C:\Program Files\Intel\NCS\PROSet\PRONoMgr.exe O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE O4 - HKLM\..\Run: [IgfxTray] C:\WINNT\system32\igfxtray.exe O4 - HKLM\..\Run: [HotKeysCmds] C:\WINNT\system32\hkcmd.exe O4 - HKLM\..\Run: [Persistence] C:\WINNT\system32\igfxpers.exe O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033 O4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\Sygate\SPF\smc.exe -startgui O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINNT\system32\ctfmon.exe O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O20 - Winlogon Notify: igfxcui - C:\WINNT\SYSTEM32\igfxdev.dll O20 - Winlogon Notify: Sebring - C:\WINNT\system32\LgNotify.dll O23 - Service: Agere Modem Call Progress Audio (AgereModemAudio) - Agere Systems - C:\WINNT\system32\agrsmsvc.exe O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing) O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing) O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exe O23 - Service: Sygate Personal Firewall (SmcService) - Sygate Technologies, Inc. - C:\Program Files\Sygate\SPF\smc.exe

**Posty:** 3854 · przez **Dzi@dek** 07 Gru 2007, 16:04

Opisz dokładniej temat bo poleci do kosza.

**Posty:** 861 · przez **jacekk04** 07 Gru 2007, 19:35

wlozylem pendriva i zaraz potem avast wykryl wirusa gdy klikam na dysk przenosny dysk(pendrive) nie otwiera mi sie zawartosc pendriva tylko "moje dokumenty" pozniej nie wiem z jakiego powodu nagrywarka nie chciala nagrac plyty stawala na 50% na 3 plytach

**Posty:** 1340 · przez **eSpEY** 07 Gru 2007, 19:39

dla mnie log czysty prócz:

O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE

ale nie groźne to zostawiam komu innemu do oceny...
Log Combofix'a
A propo nagrywarki sterowniki może??

**Posty:** 861 · przez **jacekk04** 07 Gru 2007, 19:48

jak biore ppm na pendriva to jest takie menu co niby znaczy te znaki zapytania

**Posty:** 1340 · przez **eSpEY** 07 Gru 2007, 19:59

a masz inne urządzenie pod usb nap MP3, IrDA, Mp4 idt.?
Możeliwe że coś z samym PenDrive lub USB.. Próbowałeś podłączać pod inne wejście?! ( to bardziej hadware)

**Posty:** 3854 · przez **Dzi@dek** 07 Gru 2007, 20:06

Daj log z combofix. http://www.programosy.pl/program,combofix.html

**Posty:** 861 · przez **jacekk04** 07 Gru 2007, 20:07

w sumie to jest akurat mp3 a nie pendrive (tak to ujalem) wczesniej gdy podlaczalem go pod inne kompy nic takiego nie bylo dopiero dzis gdy podlaczylem pod latopa kolegi i skopiowalem zdjecia to sie tak zrobilo

Kod: Zaznacz wszystko: "Adm" - 2007-12-07 19:09:25 - ComboFix 07-07-14.6 - Dodatek Service Pack 2 NTFS ((((((((((((((((((((((((( Files Created from 2007-11-07 to 2007-12-07 ))))))))))))))))))))))))))))))) 2007-12-07 19:08 51,200 --a------ C:\WINNT\nircmd.exe 2007-12-05 17:31 <DIR> d---s---- C:\DOCUME~1\Adm\UserData 2007-12-04 19:04 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\Windows Genuine Advantage 2007-12-04 18:34 <DIR> dr------- C:\DOCUME~1\NETWOR~1\Ulubione 2007-12-04 13:16 221,184 --a------ C:\WINNT\system32\wmpns.dll 2007-12-04 11:47 <DIR> d-------- C:\Program Files\Grupa IMAGE 2007-12-03 22:08 <DIR> d-------- C:\DOCUME~1\Adm\DANEAP~1\Gadu-Gadu 2007-12-03 22:05 <DIR> d-------- C:\DOCUME~1\Adm\DANEAP~1\BitTorrent 2007-12-03 21:30 <DIR> d-------- C:\WINNT\system32\SoftwareDistribution 2007-12-03 16:28 15,360 -rah----- C:\WINNT\system32\drivers\NetMotCM.sys 2007-12-01 16:07 <DIR> d-------- C:\Program Files\ltmoh 2007-12-01 15:50 32,768 --a------ C:\WINNT\system32\WooDial2000.dll 2007-12-01 15:35 70,688 --a------ C:\WINNT\system32\drivers\alcaudsl.sys 2007-12-01 15:35 53,600 --a------ C:\WINNT\system32\drivers\alcan5wn.sys 2007-12-01 15:35 5,606 --a------ C:\WINNT\system32\stci.dll 2007-12-01 15:35 5,280 --a------ C:\WINNT\system32\drivers\alcawh.sys 2007-12-01 15:35 3,968 --a------ C:\WINNT\system32\drivers\alcacr.sys 2007-12-01 15:34 41,068 --------- C:\WINNT\system32\ActPanel.dll 2007-12-01 15:32 <DIR> d-------- C:\Program Files\Neostrada TP 2007-12-01 15:31 <DIR> d--hs---- C:\WINNT\ftpcache 2007-12-01 15:26 <DIR> d-------- C:\DOCUME~1\Adm\DANEAP~1\AdobeUM 2007-12-01 15:07 <DIR> d-------- C:\DOCUME~1\Adm\DANEAP~1\XCPCSync.OEM 2007-12-01 15:04 89,360 --a------ C:\WINNT\system32\VB5DB.DLL 2007-12-01 14:55 31,616 --a------ C:\WINNT\system32\drivers\usbccgp.sys 2007-12-01 14:52 <DIR> d-------- C:\Program Files\WMV9_VCM 2007-12-01 14:23 <DIR> d-------- C:\DOCUME~1\Adm\DANEAP~1\Sports Interactive 2007-12-01 14:22 107,888 --a------ C:\WINNT\system32\CmdLineExt.dll 2007-12-01 14:22 <DIR> dr-h----- C:\DOCUME~1\Adm\DANEAP~1\SecuROM 2007-12-01 14:21 <DIR> d--h----- C:\Program Files\Zero G Registry 2007-12-01 14:21 <DIR> d--h----- C:\DOCUME~1\Adm\InstallAnywhere 2007-12-01 14:10 83,096 --a------ C:\WINNT\system32\SSSensor.dll 2007-12-01 14:10 60,496 --a------ C:\WINNT\system32\drivers\Teefer.sys 2007-12-01 14:10 21,075 --a------ C:\WINNT\system32\drivers\wpsdrvnt.sys 2007-12-01 14:10 14,568 --a------ C:\WINNT\system32\drivers\wg6n.sys 2007-12-01 14:10 14,568 --a------ C:\WINNT\system32\drivers\wg5n.sys 2007-12-01 14:10 14,568 --a------ C:\WINNT\system32\drivers\wg4n.sys 2007-12-01 14:10 14,568 --a------ C:\WINNT\system32\drivers\wg3n.sys 2007-12-01 14:10 <DIR> d-------- C:\Program Files\Sygate 2007-12-01 14:10 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard 2007-12-01 14:09 <DIR> d-------- C:\Program Files\Lavasoft 2007-12-01 14:09 <DIR> d-------- C:\DOCUME~1\Adm\DANEAP~1\Lavasoft 2007-12-01 14:05 2,930 --a------ C:\WINNT\mozver.dat 2007-12-01 14:05 0 --a------ C:\WINNT\nsreg.dat 2007-12-01 14:05 <DIR> d-------- C:\Program Files\mozilla.org 2007-12-01 14:03 5,248 --a------ C:\WINNT\system32\drivers\d347prt.sys 2007-12-01 14:03 155,136 --a------ C:\WINNT\system32\drivers\d347bus.sys 2007-12-01 14:03 <DIR> d-------- C:\WINNT\Downloaded Installations 2007-12-01 14:03 <DIR> d-------- C:\Program Files\D-Tools 2007-12-01 14:02 <DIR> d-------- C:\Program Files\CDex_150 2007-12-01 14:01 <DIR> d-------- C:\Program Files\IrfanView 2007-11-30 17:05 <DIR> d-------- C:\Program Files\Gadu-Gadu 2007-11-30 17:05 <DIR> d-------- C:\DOCUME~1\Adm\Gadu-Gadu 2007-11-25 20:10 <DIR> d-------- C:\DOCUME~1\Adm\DANEAP~1\Help 2007-11-25 15:19 <DIR> d-------- C:\Program Files\PowerQuest 2007-11-25 15:12 <DIR> d--hs---- C:\RECYCLER 2007-11-25 15:05 <DIR> d-------- C:\DOCUME~1\Adm\DANEAP~1\Media Player Classic 2007-11-25 15:02 81,920 --a------ C:\WINNT\system32\dpl100.dll 2007-11-25 15:02 739,840 --a------ C:\WINNT\system32\divx.dll 2007-11-25 15:02 7,680 --a------ C:\WINNT\system32\ff_vfw.dll 2007-11-25 15:02 3,596,288 --a------ C:\WINNT\system32\qt-dx331.dll 2007-11-25 15:02 282,624 --a------ C:\WINNT\system32\xvidvfw.dll 2007-11-25 15:02 217,088 --a------ C:\WINNT\system32\yv12vfw.dll 2007-11-25 15:02 164,352 --a------ C:\WINNT\system32\unrar.dll 2007-11-25 15:02 1,559,040 --a------ C:\WINNT\system32\xvidcore.dll 2007-11-25 15:02 <DIR> d-------- C:\Program Files\K-Lite Codec Pack 2007-11-25 14:52 <DIR> d-------- C:\Program Files\TOSHIBA 2007-11-25 14:50 <DIR> d-------- C:\Program Files\Atheros 2007-11-25 14:50 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\Atheros 2007-11-25 14:49 82,944 --a------ C:\WINNT\system32\drivers\wdmaud.sys 2007-11-25 14:49 7,552 --a------ C:\WINNT\system32\drivers\MSKSSRV.sys 2007-11-25 14:49 60,800 --a------ C:\WINNT\system32\drivers\sysaudio.sys 2007-11-25 14:49 6,400 --a------ C:\WINNT\system32\drivers\splitter.sys 2007-11-25 14:49 54,272 --a------ C:\WINNT\system32\drivers\swmidi.sys 2007-11-25 14:49 52,864 --a------ C:\WINNT\system32\drivers\DMusic.sys 2007-11-25 14:49 5,376 --a------ C:\WINNT\system32\drivers\MSPCLOCK.sys 2007-11-25 14:49 49,152 --a------ C:\WINNT\system32\ChCfg.exe 2007-11-25 14:49 4,992 --a------ C:\WINNT\system32\drivers\MSPQM.sys 2007-11-25 14:49 2,944 --a------ C:\WINNT\system32\drivers\drmkaud.sys 2007-11-25 14:49 172,416 --a------ C:\WINNT\system32\drivers\kmixer.sys 2007-11-25 14:49 143,360 --a------ C:\WINNT\system32\RtlCPAPI.dll 2007-11-25 14:49 142,464 --a------ C:\WINNT\system32\drivers\aec.sys 2007-11-25 14:48 9,709,568 --a------ C:\WINNT\RTLCPL.exe 2007-11-25 14:48 86,016 --a------ C:\WINNT\SoundMan.exe 2007-11-25 14:48 69,632 --a------ C:\WINNT\Alcmtr.exe 2007-11-25 14:48 60,288 --a------ C:\WINNT\system32\drivers\drmk.sys 2007-11-25 14:48 487,424 --a------ C:\WINNT\RtlExUpd.dll 2007-11-25 14:48 4,377,600 --a------ C:\WINNT\system32\drivers\RtkHDAud.Sys 2007-11-25 14:48 4,096 --a------ C:\WINNT\system32\ksuser.dll 2007-11-25 14:48 364,544 --a------ C:\WINNT\RtlUpd.exe 2007-11-25 14:48 2,879,488 --a------ C:\WINNT\SkyTel.exe 2007-11-25 14:48 2,808,832 --a------ C:\WINNT\alcwzrd.exe 2007-11-25 14:48 2,158,592 --a------ C:\WINNT\MicCal.exe 2007-11-25 14:48 16,262,656 --a------ C:\WINNT\RTHDCPL.exe 2007-11-25 14:48 <DIR> d--h----- C:\Program Files\InstallShield Installation Information 2007-11-25 14:48 <DIR> d-------- C:\WINNT\system32\RTCOM 2007-11-25 14:48 <DIR> d-------- C:\Program Files\Realtek 2007-11-25 14:48 <DIR> d-------- C:\Program Files\Common Files\InstallShield 2007-11-25 14:48 <DIR> d-------- C:\Audio.temp 2007-11-25 14:07 <DIR> d-------- C:\WINNT\system32\LogFiles 2007-11-25 14:06 77,824 --a------ C:\WINNT\system32\tosmreg.exe (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) 2007-12-04 12:58:04 49,910 ----a-w C:\WINNT\system32\perfc015.dat 2007-12-04 12:58:04 356,068 ----a-w C:\WINNT\system32\perfh015.dat 2007-11-24 22:59:11 -------- d-----w C:\Program Files\Usługi online ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}] 2004-12-14 01:56 63136 --a------ C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-10-25 17:20] "UnlockerAssistant"="C:\Program Files\Unlocker\UnlockerAssistant.exe" [2006-03-03 09:39] "WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2006-03-10 18:45] "PRONoMgr.exe"="C:\Program Files\Intel\NCS\PROSet\PRONoMgr.exe" [2005-07-07 06:08] "RTHDCPL"="RTHDCPL.EXE" [2006-09-06 11:44 C:\WINNT\RTHDCPL.exe] "SkyTel"="SkyTel.EXE" [2006-05-16 18:04 C:\WINNT\SkyTel.exe] "Alcmtr"="ALCMTR.EXE" [2005-05-03 18:43 C:\WINNT\Alcmtr.exe] "DAEMON Tools-1033"="C:\Program Files\D-Tools\daemon.exe" [2004-08-22 17:05] "SmcService"="C:\PROGRA~1\Sygate\SPF\smc.exe" [2004-10-15 19:40] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINNT\system32\ctfmon.exe" [2004-08-04 00:44] "Gadu-Gadu"="C:\Program Files\Gadu-Gadu\gg.exe" [2007-04-19 16:43] [HKEY_USERS\.default\software\microsoft\windows\currentversion\runonce] "nlsf"=cmd.exe /C move /Y "%SystemRoot%\System32\syssetub.dll" "%SystemRoot%\System32\syssetup.dll" "tscuninstall"=%systemroot%\system32\tscupgrd.exe [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\Sebring] C:\WINNT\system32\LgNotify.dll --a------ 2006-08-03 03:20 188482 C:\WINNT\system32\LgNotify.dll [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{0f04eca4-a34d-11dc-8a7f-001d60f4a284}] AutoRun\command- H:\EXPLORER.EXE explore\Command- H:\EXPLORER.EXE open\Command- H:\EXPLORER.EXE [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{1e4e0917-a1bd-11dc-8a77-0018c0360ac5}] AutoRun\command- H:\EXPLORER.EXE explore\Command- H:\EXPLORER.EXE open\Command- H:\EXPLORER.EXE [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{88a14606-9b2e-11dc-a56d-001d60f4a284}] AutoRun\command- C:\WINNT\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL copy.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a5053b0e-a353-11dc-8a80-001d60f4a284}] AutoRun\command- EXPLORER.EXE explore\Command- EXPLORER.EXE open\Command- EXPLORER.EXE [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{ce554299-a4cc-11dc-8a83-0018c0360ac5}] Auto\command- fun.xls.exe AutoRun\command- C:\WINNT\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL fun.xls.exe ************************************************************************** catchme 0.3.915 W2K/XP/Vista - rootkit detector by Gmer, http://www.gmer.net Rootkit scan 2007-12-07 19:10:15 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** Completion time: 2007-12-07 19:10:39 --- E O F ---

**Posty:** 18165 · przez **wojtas** 07 Gru 2007, 20:10

daj loga z combofixa on pomoze usunac syf

**Posty:** 1340 · przez **eSpEY** 07 Gru 2007, 20:22

próbowałeś podłączyć do innego portu usb?? +combofix

**Posty:** 861 · przez **jacekk04** 07 Gru 2007, 20:29

w innym porcie to samo

**Posty:** 1340 · przez **eSpEY** 07 Gru 2007, 20:53

COMBOFIX'A!!!
TU!!!
A masz możliwość sprawdzenia na innym pc?

[ Dodano: Dzisiaj o 19:56 ]
aby ocenić czego to jest wina może złapałeś wirusa na mp3 ;] jak podpinałeś się do innych komputerów

**Posty:** 861 · przez **jacekk04** 07 Gru 2007, 20:57

raczej nie mam mozliwosci a log z combofixa jest powyzej jakbys nie zauwazyl

**Posty:** 1340 · przez **eSpEY** 07 Gru 2007, 21:04

jacekk04 sorki ;] nie odświerzyłem ;]

**Posty:** 3854 · przez **Dzi@dek** 07 Gru 2007, 21:19

Otwórz notatnik i wklej to:

Kod: Zaznacz wszystko: Windows Registry Editor Version 5.00 [-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{0f04eca4-a34d-11dc-8a7f-001d60f4a284}] [-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{1e4e0917-a1bd-11dc-8a77-0018c0360ac5}] [-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{88a14606-9b2e-11dc-a56d-001d60f4a284}] [-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a5053b0e-a353-11dc-8a80-001d60f4a284}] [-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{ce554299-a4cc-11dc-8a83-0018c0360ac5}]

Plik-zapisz jako-zamień na wszystkie pliki-pod nazwą FIX.REG
Klikasz dwukrotnie w ten plik i potwierdzasz dodanie do rejestru

**Posty:** 861 · przez **jacekk04** 07 Gru 2007, 21:29

i zapewne dac logi oto one

Kod: Zaznacz wszystko: Logfile of HijackThis v1.99.1 Scan saved at 20:27:48, on 2007-12-07 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINNT\System32\smss.exe C:\WINNT\system32\winlogon.exe C:\WINNT\system32\services.exe C:\WINNT\system32\lsass.exe C:\WINNT\system32\svchost.exe C:\WINNT\System32\svchost.exe C:\Program Files\Sygate\SPF\smc.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINNT\system32\ZCfgSvc.exe C:\WINNT\system32\spoolsv.exe C:\WINNT\system32\agrsmsvc.exe C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Unlocker\UnlockerAssistant.exe C:\Program Files\Winamp\winampa.exe C:\WINNT\RTHDCPL.EXE C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\Program Files\D-Tools\daemon.exe C:\WINNT\system32\ctfmon.exe C:\Program Files\Gadu-Gadu\gg.exe F:\BitTorrent\bittorrent.exe C:\WINNT\system32\wuauclt.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\WINNT\explorer.exe C:\Program Files\Winamp\Winamp.exe F:\PROGRAMY\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\NEOSTR~1\SEARCH~1.DLL (file missing) O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [UnlockerAssistant] C:\Program Files\Unlocker\UnlockerAssistant.exe O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe O4 - HKLM\..\Run: [PRONoMgr.exe] C:\Program Files\Intel\NCS\PROSet\PRONoMgr.exe O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033 O4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\Sygate\SPF\smc.exe -startgui O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINNT\system32\ctfmon.exe O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O20 - Winlogon Notify: igfxcui - C:\WINNT\SYSTEM32\igfxdev.dll O20 - Winlogon Notify: Sebring - C:\WINNT\system32\LgNotify.dll O23 - Service: Agere Modem Call Progress Audio (AgereModemAudio) - Agere Systems - C:\WINNT\system32\agrsmsvc.exe O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing) O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing) O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exe O23 - Service: Sygate Personal Firewall (SmcService) - Sygate Technologies, Inc. - C:\Program Files\Sygate\SPF\smc.exe

Kod: Zaznacz wszystko: "Silent Runners.vbs", revision 49, http://www.silentrunners.org/ Operating System: Windows XP SP2 Output limited to non-default values, except where indicated by "{++}" Startup items buried in registry: --------------------------------- HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ {++} "CTFMON.EXE" = "C:\WINNT\system32\ctfmon.exe" [MS] "Gadu-Gadu" = ""C:\Program Files\Gadu-Gadu\gg.exe" /tray" ["Gadu-Gadu S.A."] HKLM\Software\Microsoft\Windows\CurrentVersion\Run\ {++} "avast!" = "C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" ["ALWIL Software"] "UnlockerAssistant" = "C:\Program Files\Unlocker\UnlockerAssistant.exe" [null data] "WinampAgent" = "C:\Program Files\Winamp\winampa.exe" [null data] "PRONoMgr.exe" = "C:\Program Files\Intel\NCS\PROSet\PRONoMgr.exe" ["Intel(R) Corporation"] "RTHDCPL" = "RTHDCPL.EXE" ["Realtek Semiconductor Corp."] "SkyTel" = "SkyTel.EXE" ["Realtek Semiconductor Corp."] "Alcmtr" = "ALCMTR.EXE" ["Realtek Semiconductor Corp."] "DAEMON Tools-1033" = ""C:\Program Files\D-Tools\daemon.exe" -lang 1033" ["DAEMON'S HOME"] "SmcService" = "C:\PROGRA~1\Sygate\SPF\smc.exe -startgui" ["Sygate Technologies, Inc."] HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\(Default) = (no title provided) -> {HKLM...CLSID} = "AcroIEHlprObj Class" \InProcServer32\(Default) = "C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll" ["Adobe Systems Incorporated"] HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\ "{42071714-76d4-11d1-8b24-00a0c9068ff3}" = "Rozszerzenie CPL kadrowania wyświetlania" -> {HKLM...CLSID} = "Rozszerzenie CPL kadrowania wyświetlania" \InProcServer32\(Default) = "deskpan.dll" [file not found] "{88895560-9AA2-1069-930E-00AA0030EBC8}" = "Rozszerzenie ikony HyperTerminalu" -> {HKLM...CLSID} = "HyperTerminal Icon Ext" \InProcServer32\(Default) = "C:\WINNT\system32\hticons.dll" ["Hilgraeve, Inc."] "{3028902F-6374-48b2-8DC6-9725E775B926}" = "IE Microsoft AutoComplete" -> {HKLM...CLSID} = "IE Microsoft AutoComplete" \InProcServer32\(Default) = "C:\WINNT\system32\browseui.dll" [MS] "{EFA24E62-B078-11d0-89E4-00C04FC9E26E}" = "History Band" -> {HKLM...CLSID} = "History Band" \InProcServer32\(Default) = "C:\WINNT\system32\shdocvw.dll" [MS] "{0006F045-0000-0000-C000-000000000046}" = "Microsoft Outlook Custom Icon Handler" -> {HKLM...CLSID} = "Rozszerzenie ikon plików programu Outlook" \InProcServer32\(Default) = "C:\PROGRA~1\MICROS~1\Office\OLKFSTUB.DLL" [MS] "{472083B0-C522-11CF-8763-00608CC02F24}" = "avast" -> {HKLM...CLSID} = "avast" \InProcServer32\(Default) = "C:\Program Files\Alwil Software\Avast4\ashShell.dll" ["ALWIL Software"] "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" = "WinRAR shell extension" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] "{DDE4BEEB-DDE6-48fd-8EB5-035C09923F83}" = "UnlockerShellExtension" -> {HKLM...CLSID} = "UnlockerShellExtension" \InProcServer32\(Default) = "C:\Program Files\Unlocker\UnlockerCOM.dll" [null data] HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ <<!>> igfxcui\DLLName = "igfxdev.dll" ["Intel Corporation"] <<!>> Sebring\DLLName = "C:\WINNT\system32\LgNotify.dll" ["Intel Corporation"] HKLM\Software\Classes\Folder\shellex\ColumnHandlers\ {F9DB5320-233E-11D1-9F84-707F02C10627}\(Default) = "PDF Column Info" -> {HKLM...CLSID} = "PDF Shell Extension" \InProcServer32\(Default) = "C:\Program Files\Adobe\Acrobat 7.0\ActiveX\PDFShell.dll" ["Adobe Systems, Inc."] HKLM\Software\Classes\*\shellex\ContextMenuHandlers\ avast\(Default) = "{472083B0-C522-11CF-8763-00608CC02F24}" -> {HKLM...CLSID} = "avast" \InProcServer32\(Default) = "C:\Program Files\Alwil Software\Avast4\ashShell.dll" ["ALWIL Software"] WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\ WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\ avast\(Default) = "{472083B0-C522-11CF-8763-00608CC02F24}" -> {HKLM...CLSID} = "avast" \InProcServer32\(Default) = "C:\Program Files\Alwil Software\Avast4\ashShell.dll" ["ALWIL Software"] UnlockerShellExtension\(Default) = "{DDE4BEEB-DDE6-48fd-8EB5-035C09923F83}" -> {HKLM...CLSID} = "UnlockerShellExtension" \InProcServer32\(Default) = "C:\Program Files\Unlocker\UnlockerCOM.dll" [null data] WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] HKLM\Software\Classes\AllFilesystemObjects\shellex\ContextMenuHandlers\ UnlockerShellExtension\(Default) = "{DDE4BEEB-DDE6-48fd-8EB5-035C09923F83}" -> {HKLM...CLSID} = "UnlockerShellExtension" \InProcServer32\(Default) = "C:\Program Files\Unlocker\UnlockerCOM.dll" [null data] Group Policies {GPedit.msc branch and setting}: ----------------------------------------------- Note: detected settings may not have any effect. HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\ "shutdownwithoutlogon" = (REG_DWORD) hex:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| Shutdown: Allow system to be shut down without having to log on} "undockwithoutlogon" = (REG_DWORD) hex:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| Devices: Allow undock without having to log on} Active Desktop and Wallpaper: ----------------------------- Active Desktop may be disabled at this entry: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState Displayed if Active Desktop enabled and wallpaper not set by Group Policy: HKCU\Software\Microsoft\Internet Explorer\Desktop\General\ "Wallpaper" = "C:\WINNT\system32\config\systemprofile\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp" Displayed if Active Desktop disabled and wallpaper not set by Group Policy: HKCU\Control Panel\Desktop\ "Wallpaper" = "C:\Documents and Settings\Adm\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp" Startup items in "Adm" & "All Users" startup folders: ----------------------------------------------------- C:\Documents and Settings\All Users\Menu Start\Programy\Autostart "Adobe Reader Speed Launch" -> shortcut to: "C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe" ["Adobe Systems Incorporated"] "Microsoft Office" -> shortcut to: "C:\Program Files\Microsoft Office\Office\OSA9.EXE -b -l" [MS] Winsock2 Service Provider DLLs: ------------------------------- Namespace Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++} 000000000001\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS] 000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS] 000000000003\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS] Transport Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++} 0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range: %SystemRoot%\system32\mswsock.dll [MS], 01 - 03, 06 - 13 %SystemRoot%\system32\rsvpsp.dll [MS], 04 - 05 Toolbars, Explorer Bars, Extensions: ------------------------------------ Extensions (Tools menu items, main toolbar menu buttons) HKLM\Software\Microsoft\Internet Explorer\Extensions\ {FB5F1910-F110-11D2-BB9E-00C04F795683}\ "ButtonText" = "Messenger" "MenuText" = "Windows Messenger" "Exec" = "C:\Program Files\Messenger\msmsgs.exe" [MS] Miscellaneous IE Hijack Points ------------------------------ HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks\ <<H>> "{08C06D61-F1F3-4799-86F8-BE1A89362C85}" = (no title provided) -> {HKLM...CLSID} = "Search Class" \InProcServer32\(Default) = "C:\PROGRA~1\NEOSTR~1\SEARCH~1.DLL" [file not found] Running Services (Display Name, Service Name, Path {Service DLL}): ------------------------------------------------------------------ Agere Modem Call Progress Audio, AgereModemAudio, "C:\WINNT\system32\agrsmsvc.exe" ["Agere Systems"] avast! Antivirus, avast! Antivirus, ""C:\Program Files\Alwil Software\Avast4\ashServ.exe"" ["ALWIL Software"] avast! iAVS4 Control Service, aswUpdSv, ""C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe"" ["ALWIL Software"] avast! Mail Scanner, avast! Mail Scanner, ""C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service" ["ALWIL Software"] avast! Web Scanner, avast! Web Scanner, ""C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service" ["ALWIL Software"] Sygate Personal Firewall, SmcService, "C:\Program Files\Sygate\SPF\smc.exe" ["Sygate Technologies, Inc."] ---------- <<!>>: Suspicious data at a malware launch point. <<H>>: Suspicious data at a browser hijack point. + This report excludes default entries except where indicated. + To see *everywhere* the script checks and *everything* it finds, launch it from a command prompt or a shortcut with the -all parameter. + To search all directories of local fixed drives for DESKTOP.INI DLL launch points, use the -supp parameter or answer "No" at the first message box and "Yes" at the second message box. ---------- (total run time: 31 seconds, including 7 seconds for message boxes)

Kod: Zaznacz wszystko: "Adm" - 2007-12-07 20:30:25 - ComboFix 07-07-14.6 - Dodatek Service Pack 2 NTFS ((((((((((((((((((((((((( Files Created from 2007-11-07 to 2007-12-07 ))))))))))))))))))))))))))))))) 2007-12-07 19:08 51,200 --a------ C:\WINNT\nircmd.exe 2007-12-05 17:31 <DIR> d---s---- C:\DOCUME~1\Adm\UserData 2007-12-04 19:04 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\Windows Genuine Advantage 2007-12-04 18:34 <DIR> dr------- C:\DOCUME~1\NETWOR~1\Ulubione 2007-12-04 13:16 221,184 --a------ C:\WINNT\system32\wmpns.dll 2007-12-04 11:47 <DIR> d-------- C:\Program Files\Grupa IMAGE 2007-12-03 22:08 <DIR> d-------- C:\DOCUME~1\Adm\DANEAP~1\Gadu-Gadu 2007-12-03 22:05 <DIR> d-------- C:\DOCUME~1\Adm\DANEAP~1\BitTorrent 2007-12-03 21:30 <DIR> d-------- C:\WINNT\system32\SoftwareDistribution 2007-12-03 16:28 15,360 -rah----- C:\WINNT\system32\drivers\NetMotCM.sys 2007-12-01 16:07 <DIR> d-------- C:\Program Files\ltmoh 2007-12-01 15:50 32,768 --a------ C:\WINNT\system32\WooDial2000.dll 2007-12-01 15:35 70,688 --a------ C:\WINNT\system32\drivers\alcaudsl.sys 2007-12-01 15:35 53,600 --a------ C:\WINNT\system32\drivers\alcan5wn.sys 2007-12-01 15:35 5,606 --a------ C:\WINNT\system32\stci.dll 2007-12-01 15:35 5,280 --a------ C:\WINNT\system32\drivers\alcawh.sys 2007-12-01 15:35 3,968 --a------ C:\WINNT\system32\drivers\alcacr.sys 2007-12-01 15:34 41,068 --------- C:\WINNT\system32\ActPanel.dll 2007-12-01 15:32 <DIR> d-------- C:\Program Files\Neostrada TP 2007-12-01 15:31 <DIR> d--hs---- C:\WINNT\ftpcache 2007-12-01 15:26 <DIR> d-------- C:\DOCUME~1\Adm\DANEAP~1\AdobeUM 2007-12-01 15:07 <DIR> d-------- C:\DOCUME~1\Adm\DANEAP~1\XCPCSync.OEM 2007-12-01 15:04 89,360 --a------ C:\WINNT\system32\VB5DB.DLL 2007-12-01 14:55 31,616 --a------ C:\WINNT\system32\drivers\usbccgp.sys 2007-12-01 14:52 <DIR> d-------- C:\Program Files\WMV9_VCM 2007-12-01 14:23 <DIR> d-------- C:\DOCUME~1\Adm\DANEAP~1\Sports Interactive 2007-12-01 14:22 107,888 --a------ C:\WINNT\system32\CmdLineExt.dll 2007-12-01 14:22 <DIR> dr-h----- C:\DOCUME~1\Adm\DANEAP~1\SecuROM 2007-12-01 14:21 <DIR> d--h----- C:\Program Files\Zero G Registry 2007-12-01 14:21 <DIR> d--h----- C:\DOCUME~1\Adm\InstallAnywhere 2007-12-01 14:10 83,096 --a------ C:\WINNT\system32\SSSensor.dll 2007-12-01 14:10 60,496 --a------ C:\WINNT\system32\drivers\Teefer.sys 2007-12-01 14:10 21,075 --a------ C:\WINNT\system32\drivers\wpsdrvnt.sys 2007-12-01 14:10 14,568 --a------ C:\WINNT\system32\drivers\wg6n.sys 2007-12-01 14:10 14,568 --a------ C:\WINNT\system32\drivers\wg5n.sys 2007-12-01 14:10 14,568 --a------ C:\WINNT\system32\drivers\wg4n.sys 2007-12-01 14:10 14,568 --a------ C:\WINNT\system32\drivers\wg3n.sys 2007-12-01 14:10 <DIR> d-------- C:\Program Files\Sygate 2007-12-01 14:10 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard 2007-12-01 14:09 <DIR> d-------- C:\Program Files\Lavasoft 2007-12-01 14:09 <DIR> d-------- C:\DOCUME~1\Adm\DANEAP~1\Lavasoft 2007-12-01 14:05 2,930 --a------ C:\WINNT\mozver.dat 2007-12-01 14:05 0 --a------ C:\WINNT\nsreg.dat 2007-12-01 14:05 <DIR> d-------- C:\Program Files\mozilla.org 2007-12-01 14:03 5,248 --a------ C:\WINNT\system32\drivers\d347prt.sys 2007-12-01 14:03 155,136 --a------ C:\WINNT\system32\drivers\d347bus.sys 2007-12-01 14:03 <DIR> d-------- C:\WINNT\Downloaded Installations 2007-12-01 14:03 <DIR> d-------- C:\Program Files\D-Tools 2007-12-01 14:02 <DIR> d-------- C:\Program Files\CDex_150 2007-12-01 14:01 <DIR> d-------- C:\Program Files\IrfanView 2007-11-30 17:05 <DIR> d-------- C:\Program Files\Gadu-Gadu 2007-11-30 17:05 <DIR> d-------- C:\DOCUME~1\Adm\Gadu-Gadu 2007-11-25 20:10 <DIR> d-------- C:\DOCUME~1\Adm\DANEAP~1\Help 2007-11-25 15:19 <DIR> d-------- C:\Program Files\PowerQuest 2007-11-25 15:12 <DIR> d--hs---- C:\RECYCLER 2007-11-25 15:05 <DIR> d-------- C:\DOCUME~1\Adm\DANEAP~1\Media Player Classic 2007-11-25 15:02 81,920 --a------ C:\WINNT\system32\dpl100.dll 2007-11-25 15:02 739,840 --a------ C:\WINNT\system32\divx.dll 2007-11-25 15:02 7,680 --a------ C:\WINNT\system32\ff_vfw.dll 2007-11-25 15:02 3,596,288 --a------ C:\WINNT\system32\qt-dx331.dll 2007-11-25 15:02 282,624 --a------ C:\WINNT\system32\xvidvfw.dll 2007-11-25 15:02 217,088 --a------ C:\WINNT\system32\yv12vfw.dll 2007-11-25 15:02 164,352 --a------ C:\WINNT\system32\unrar.dll 2007-11-25 15:02 1,559,040 --a------ C:\WINNT\system32\xvidcore.dll 2007-11-25 15:02 <DIR> d-------- C:\Program Files\K-Lite Codec Pack 2007-11-25 14:52 <DIR> d-------- C:\Program Files\TOSHIBA 2007-11-25 14:50 <DIR> d-------- C:\Program Files\Atheros 2007-11-25 14:50 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\Atheros 2007-11-25 14:49 82,944 --a------ C:\WINNT\system32\drivers\wdmaud.sys 2007-11-25 14:49 7,552 --a------ C:\WINNT\system32\drivers\MSKSSRV.sys 2007-11-25 14:49 60,800 --a------ C:\WINNT\system32\drivers\sysaudio.sys 2007-11-25 14:49 6,400 --a------ C:\WINNT\system32\drivers\splitter.sys 2007-11-25 14:49 54,272 --a------ C:\WINNT\system32\drivers\swmidi.sys 2007-11-25 14:49 52,864 --a------ C:\WINNT\system32\drivers\DMusic.sys 2007-11-25 14:49 5,376 --a------ C:\WINNT\system32\drivers\MSPCLOCK.sys 2007-11-25 14:49 49,152 --a------ C:\WINNT\system32\ChCfg.exe 2007-11-25 14:49 4,992 --a------ C:\WINNT\system32\drivers\MSPQM.sys 2007-11-25 14:49 2,944 --a------ C:\WINNT\system32\drivers\drmkaud.sys 2007-11-25 14:49 172,416 --a------ C:\WINNT\system32\drivers\kmixer.sys 2007-11-25 14:49 143,360 --a------ C:\WINNT\system32\RtlCPAPI.dll 2007-11-25 14:49 142,464 --a------ C:\WINNT\system32\drivers\aec.sys 2007-11-25 14:48 9,709,568 --a------ C:\WINNT\RTLCPL.exe 2007-11-25 14:48 86,016 --a------ C:\WINNT\SoundMan.exe 2007-11-25 14:48 69,632 --a------ C:\WINNT\Alcmtr.exe 2007-11-25 14:48 60,288 --a------ C:\WINNT\system32\drivers\drmk.sys 2007-11-25 14:48 487,424 --a------ C:\WINNT\RtlExUpd.dll 2007-11-25 14:48 4,377,600 --a------ C:\WINNT\system32\drivers\RtkHDAud.Sys 2007-11-25 14:48 4,096 --a------ C:\WINNT\system32\ksuser.dll 2007-11-25 14:48 364,544 --a------ C:\WINNT\RtlUpd.exe 2007-11-25 14:48 2,879,488 --a------ C:\WINNT\SkyTel.exe 2007-11-25 14:48 2,808,832 --a------ C:\WINNT\alcwzrd.exe 2007-11-25 14:48 2,158,592 --a------ C:\WINNT\MicCal.exe 2007-11-25 14:48 16,262,656 --a------ C:\WINNT\RTHDCPL.exe 2007-11-25 14:48 <DIR> d--h----- C:\Program Files\InstallShield Installation Information 2007-11-25 14:48 <DIR> d-------- C:\WINNT\system32\RTCOM 2007-11-25 14:48 <DIR> d-------- C:\Program Files\Realtek 2007-11-25 14:48 <DIR> d-------- C:\Program Files\Common Files\InstallShield 2007-11-25 14:48 <DIR> d-------- C:\Audio.temp 2007-11-25 14:07 <DIR> d-------- C:\WINNT\system32\LogFiles 2007-11-25 14:06 77,824 --a------ C:\WINNT\system32\tosmreg.exe (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) 2007-12-04 12:58:04 49,910 ----a-w C:\WINNT\system32\perfc015.dat 2007-12-04 12:58:04 356,068 ----a-w C:\WINNT\system32\perfh015.dat 2007-11-24 22:59:11 -------- d-----w C:\Program Files\Usługi online ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}] 2004-12-14 01:56 63136 --a------ C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-10-25 17:20] "UnlockerAssistant"="C:\Program Files\Unlocker\UnlockerAssistant.exe" [2006-03-03 09:39] "WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2006-03-10 18:45] "PRONoMgr.exe"="C:\Program Files\Intel\NCS\PROSet\PRONoMgr.exe" [2005-07-07 06:08] "RTHDCPL"="RTHDCPL.EXE" [2006-09-06 11:44 C:\WINNT\RTHDCPL.exe] "SkyTel"="SkyTel.EXE" [2006-05-16 18:04 C:\WINNT\SkyTel.exe] "Alcmtr"="ALCMTR.EXE" [2005-05-03 18:43 C:\WINNT\Alcmtr.exe] "DAEMON Tools-1033"="C:\Program Files\D-Tools\daemon.exe" [2004-08-22 17:05] "SmcService"="C:\PROGRA~1\Sygate\SPF\smc.exe" [2004-10-15 19:40] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINNT\system32\ctfmon.exe" [2004-08-04 00:44] "Gadu-Gadu"="C:\Program Files\Gadu-Gadu\gg.exe" [2007-04-19 16:43] [HKEY_USERS\.default\software\microsoft\windows\currentversion\runonce] "nlsf"=cmd.exe /C move /Y "%SystemRoot%\System32\syssetub.dll" "%SystemRoot%\System32\syssetup.dll" "tscuninstall"=%systemroot%\system32\tscupgrd.exe [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\Sebring] C:\WINNT\system32\LgNotify.dll --a------ 2006-08-03 03:20 188482 C:\WINNT\system32\LgNotify.dll ************************************************************************** catchme 0.3.915 W2K/XP/Vista - rootkit detector by Gmer, http://www.gmer.net Rootkit scan 2007-12-07 20:30:52 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** Completion time: 2007-12-07 20:31:17 C:\ComboFix2.txt ... 2007-12-07 20:08 C:\ComboFix3.txt ... 2007-12-07 19:10 --- E O F ---

**Posty:** 1340 · przez **eSpEY** 07 Gru 2007, 21:47

ale problem nadal sie powtarza?!

**Posty:** 3854 · przez **Dzi@dek** 07 Gru 2007, 21:52

jacekk04 napisał(a):O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE

do usunięcia w hijackthis.

Z pendriva usuń ukryte pliki ( włącz pokazywanie ukrytych w opcjach folderów ) oraz jeśli jest autorun.inf

**Posty:** 861 · przez **jacekk04** 07 Gru 2007, 21:58

Kod: Zaznacz wszystko: Logfile of HijackThis v1.99.1 Scan saved at 20:57:37, on 2007-12-07 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINNT\System32\smss.exe C:\WINNT\system32\winlogon.exe C:\WINNT\system32\services.exe C:\WINNT\system32\lsass.exe C:\WINNT\system32\svchost.exe C:\WINNT\System32\svchost.exe C:\Program Files\Sygate\SPF\smc.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINNT\system32\ZCfgSvc.exe C:\WINNT\system32\spoolsv.exe C:\WINNT\system32\agrsmsvc.exe C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Unlocker\UnlockerAssistant.exe C:\Program Files\Winamp\winampa.exe C:\WINNT\RTHDCPL.EXE C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\Program Files\D-Tools\daemon.exe C:\WINNT\system32\ctfmon.exe C:\Program Files\Gadu-Gadu\gg.exe C:\WINNT\system32\wuauclt.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Winamp\Winamp.exe C:\WINNT\explorer.exe F:\BitTorrent\bittorrent.exe F:\PROGRAMY\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\NEOSTR~1\SEARCH~1.DLL (file missing) O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [UnlockerAssistant] C:\Program Files\Unlocker\UnlockerAssistant.exe O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe O4 - HKLM\..\Run: [PRONoMgr.exe] C:\Program Files\Intel\NCS\PROSet\PRONoMgr.exe O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033 O4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\Sygate\SPF\smc.exe -startgui O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINNT\system32\ctfmon.exe O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O20 - Winlogon Notify: igfxcui - C:\WINNT\SYSTEM32\igfxdev.dll O20 - Winlogon Notify: Sebring - C:\WINNT\system32\LgNotify.dll O23 - Service: Agere Modem Call Progress Audio (AgereModemAudio) - Agere Systems - C:\WINNT\system32\agrsmsvc.exe O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing) O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing) O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exe O23 - Service: Sygate Personal Firewall (SmcService) - Sygate Technologies, Inc. - C:\Program Files\Sygate\SPF\smc.exe

**Posty:** 3854 · przez **Dzi@dek** 07 Gru 2007, 22:03

Tu już czysto.

prosze o sprawdzenie loga

prosze o sprawdzenie loga

Kto jest na forum