prosze o sprawdzenie loga

**Posty:** 131 · przez **OnLines** 01 Mar 2008, 16:38

po instalacji Divo codec włączające sie reklamy, obciążenie explorer.exe

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 15:36:49, on 2008-03-01 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\csrss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\Ati2evxx.exe C:\Program Files\Common Files\InterVideo\DeviceService\DevSvc.exe C:\Program Files\Eset\nod32krn.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\Mixer.exe C:\WINDOWS\system32\atiptaxx.exe C:\Program Files\Eset\nod32kui.exe C:\WINDOWS\explorer.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe C:\WINDOWS\system32\wbem\wmiprvse.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.finderg.com R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: flashget urlcatch - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\Program Files\FlashGet\jccatch.dll O2 - BHO: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll O2 - BHO: WhenUSearch Helper - {BA2325ED-F9EB-4830-8FCE-0BC35B16969B} - (no file) O2 - BHO: FlashGet GetFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\Program Files\FlashGet\getflash.dll O3 - Toolbar: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup O4 - HKLM\..\Run: [AtiPTA] atiptaxx.exe O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE O4 - HKLM\..\Run: [part chin math idol] C:\Documents and Settings\All Users\Dane aplikacji\That size part chin\delete soap.exe O4 - HKLM\..\Run: [ISTray] "C:\Program Files\Spyware Doctor\pctsTray.exe" O4 - HKCU\..\Run: [AQQ] C:\PROGRA~1\WapSter\AQQ\AQQ.exe O4 - HKCU\..\Run: [Glary Memory Optimizer] "C:\Program Files\Glary Utilities\memdefrag.exe" /autostart O4 - HKCU\..\Run: [memo software] C:\DOCUME~1\Dom\DANEAP~1\TRUSTL~1\32 Bend Dent.exe O8 - Extra context menu item: &Ściągnij przy pomocy FlashGet'a - C:\Program Files\FlashGet\jc_link.htm O8 - Extra context menu item: &Ściągnij wszystko przy pomocy FlashGet'a - C:\Program Files\FlashGet\jc_all.htm O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O8 - Extra context menu item: Sothink SWF Catcher - C:\Program Files\Common Files\SourceTec\SWF Catcher\InternetExplorer.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe O9 - Extra button: Sothink SWF Catcher - {E19ADC6E-3909-43E4-9A89-B7B676377EE3} - C:\Program Files\Common Files\SourceTec\SWF Catcher\InternetExplorer.htm O9 - Extra 'Tools' menuitem: Sothink SWF Catcher - {E19ADC6E-3909-43E4-9A89-B7B676377EE3} - C:\Program Files\Common Files\SourceTec\SWF Catcher\InternetExplorer.htm O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O17 - HKLM\System\CCS\Services\Tcpip\..\{9242FC97-3003-49EA-8B2D-AED81B497C03}: NameServer = 217.30.129.149 217.30.137.200 O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O20 - Winlogon Notify: Antiwpa - C:\WINDOWS\SYSTEM32\antiwpa.dll O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: Capture Device Service - InterVideo Inc. - C:\Program Files\Common Files\InterVideo\DeviceService\DevSvc.exe O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe -- End of file - 5262 bytes

**Posty:** 18165 · przez **wojtas** 01 Mar 2008, 16:41

Wykonaj to co jest podane w tym temacie

O2 - BHO: WhenUSearch Helper - {BA2325ED-F9EB-4830-8FCE-0BC35B16969B} - (no file)
O4 - HKLM\..\Run: [part chin math idol] C:\Documents and Settings\All Users\Dane aplikacji\That size part chin\delete soap.exe
O4 - HKCU\..\Run: [memo software] C:\DOCUME~1\Dom\DANEAP~1\TRUSTL~1\32 Bend Dent.exe

Uruchamiasz HijackThis => klikasz Do a system scan only => pokaże się lista wpisów => stawiasz ptaszek przy wpisach, które wymieniłem => klikasz Fix checked i potwierdzasz usunięcie.

potem dajesz loga z combofixa

**Posty:** 131 · przez **OnLines** 01 Mar 2008, 17:05

log z combofixa

Kod: Zaznacz wszystko: ComboFix 08-03-01.3 - Dom 2008-03-01 15:50:10.1 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.193 [GMT 1:00] Running from: C:\Documents and Settings\Dom\Pulpit\ComboFix.exe [color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color] . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\Documents and Settings\All Users\Dane aplikacji\Microsoft\Network\Downloader\qmgr0.dat C:\Documents and Settings\All Users\Dane aplikacji\Microsoft\Network\Downloader\qmgr1.dat C:\WINDOWS\system32\_000008_.tmp.dll ----- BITS: Possible infected sites ----- hxxp://www.digart.pl hxxp://digart.img.digart.pl . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\LEGACY_NPF ((((((((((((((((((((((((( Files Created from 2008-02-01 to 2008-03-01 ))))))))))))))))))))))))))))))) . 2008-03-01 15:36 . 2008-03-01 15:36 <DIR> d----c--- C:\Program Files\Trend Micro 2008-03-01 14:41 . 2008-02-26 22:29 734,728,192 --a--c--- C:\ranczo.wilkowyje.2007.dvdscr.xvid-ind.avi 2008-02-27 22:13 . 2008-02-27 22:13 <DIR> d----c--- C:\Program Files\Common Files\DirectX 2008-02-21 17:15 . 2007-12-10 14:53 81,288 --a--c--- C:\WINDOWS\system32\drivers\iksyssec.sys 2008-02-21 17:15 . 2007-12-10 14:53 66,952 --a--c--- C:\WINDOWS\system32\drivers\iksysflt.sys 2008-02-21 17:15 . 2007-12-10 14:53 41,864 --a--c--- C:\WINDOWS\system32\drivers\ikfilesec.sys 2008-02-21 17:15 . 2007-12-10 14:53 29,576 --a--c--- C:\WINDOWS\system32\drivers\kcom.sys 2008-02-21 17:14 . 2008-03-01 15:27 <DIR> d----c--- C:\Program Files\Spyware Doctor 2008-02-21 17:14 . 2008-02-21 17:14 <DIR> d----c--- C:\Documents and Settings\Dom\Dane aplikacji\PC Tools 2008-02-18 22:34 . 2008-02-18 22:34 <DIR> d----c--- C:\Program Files\TRUSTLOCKS 2008-02-18 22:34 . 2008-02-18 22:35 <DIR> d----c--- C:\Documents and Settings\Dom\Dane aplikacji\TRUSTLOCKS 2008-02-18 22:34 . 2008-02-18 22:34 <DIR> d----c--- C:\Documents and Settings\All Users\Dane aplikacji\That size part chin 2008-02-18 22:33 . 2008-02-18 22:33 <DIR> d----c--- C:\Program Files\DivoCodec 2008-02-18 22:24 . 2008-02-18 22:24 1,415,680 --a--c--- C:\WINDOWS\system32\WMV9VCM.dll 2008-02-18 22:24 . 2008-02-18 22:24 921,600 --a--c--- C:\WINDOWS\system32\vorbisenc.dll 2008-02-18 22:24 . 2008-02-18 22:24 892,928 --a--c--- C:\WINDOWS\system32\iconv.dll 2008-02-18 22:24 . 2008-02-18 22:24 577,536 --a--c--- C:\WINDOWS\system32\ac3filter.ax 2008-02-18 22:24 . 2008-02-18 22:24 237,568 --a--c--- C:\WINDOWS\system32\OggDS.dll 2008-02-18 22:24 . 2008-02-18 22:24 188,416 --a--c--- C:\WINDOWS\system32\vorbis.dll 2008-02-18 22:24 . 2008-02-18 22:24 106,496 --a--c--- C:\WINDOWS\system32\lmpgspl.ax 2008-02-18 22:24 . 2008-02-18 22:24 94,208 --a--c--- C:\WINDOWS\system32\lmpgvd.ax 2008-02-18 22:24 . 2008-02-18 22:24 45,056 --a--c--- C:\WINDOWS\system32\ogg.dll 2008-02-18 22:23 . 2008-02-18 22:23 630,784 --a--c--- C:\WINDOWS\system32\divxdec.ax 2008-02-18 22:23 . 2008-02-18 22:23 524,288 --a--c--- C:\WINDOWS\system32\DivXsm.exe 2008-02-18 22:23 . 2008-02-18 22:23 352,401 --a--c--- C:\WINDOWS\system32\DivXMedia.ax 2008-02-18 22:23 . 2008-02-18 22:23 245,760 --a--c--- C:\WINDOWS\system32\mplvpx.dll 2008-02-18 22:23 . 2008-02-18 22:23 86,528 --a--c--- C:\WINDOWS\system32\DVDVideo.ax 2008-02-18 22:23 . 2008-02-18 22:23 77,824 --a--c--- C:\WINDOWS\system32\xvid.ax 2008-02-18 22:23 . 2008-02-18 22:23 9,216 --a--c--- C:\WINDOWS\system32\cpuinf32.dll 2008-02-18 16:26 . 2008-02-21 17:46 <DIR> d----c--- C:\Perl 2008-02-12 22:47 . 2008-02-12 22:47 <DIR> d----c--- C:\Program Files\HD Tune 2008-02-10 17:18 . 1998-10-07 12:54 327,168 --a--c--- C:\WINDOWS\IsUn0415.exe 2008-02-09 11:46 . 2008-02-09 11:46 <DIR> d----c--- C:\Documents and Settings\All Users\Dane aplikacji\MumboJumbo 2008-02-07 22:24 . 2008-02-07 22:35 <DIR> d----c--- C:\Program Files\SHOUTcast 2008-02-02 10:57 . 2008-02-02 10:57 <DIR> d----c--- C:\Program Files\Kodak 2008-02-02 10:51 . 2008-02-02 11:45 <DIR> d----c--- C:\Documents and Settings\All Users\Dane aplikacji\Kodak . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-03-01 14:57 --------- dc--a-w C:\Documents and Settings\All Users\Dane aplikacji\TEMP 2008-02-29 19:39 --------- dc----w C:\Documents and Settings\Dom\Dane aplikacji\Azureus 2008-02-29 17:57 --------- dc----w C:\Documents and Settings\Dom\Dane aplikacji\MegauploadToolbar 2008-02-24 17:26 --------- dc----w C:\Documents and Settings\Dom\Dane aplikacji\Skype 2008-02-24 16:43 --------- dc----w C:\Documents and Settings\Dom\Dane aplikacji\skypePM 2008-02-22 17:45 --------- dc----w C:\Documents and Settings\Dom\Dane aplikacji\GanymedeNet 2008-02-18 21:23 1,559,040 -c--a-w C:\WINDOWS\system32\xvidcore.dll 2008-02-18 17:09 --------- dc----w C:\Program Files\NAPI-PROJEKT 2008-02-18 12:25 --------- dc----w C:\Program Files\Mozilla Thunderbird 2008-02-16 12:09 --------- dc-h--w C:\Program Files\InstallShield Installation Information 2008-02-12 08:29 --------- dc----w C:\Documents and Settings\Dom\Dane aplikacji\Thinstall 2008-02-08 01:56 --------- dc----w C:\Program Files\ESET 2008-02-07 21:24 --------- dc----w C:\Program Files\Winamp 2008-02-06 20:10 --------- dc----w C:\Program Files\Gadu-Gadu 2008-02-04 14:18 --------- dc----w C:\Program Files\AutoConnect 2008-01-30 17:55 --------- dc----w C:\Program Files\Glary Utilities 2008-01-30 17:55 --------- dc----w C:\Program Files\ChomikBox 2008-01-30 17:52 --------- dc----w C:\Program Files\JLC's Software 2008-01-30 17:51 --------- dc----w C:\Program Files\FlashFXP 2008-01-30 17:50 --------- dc----w C:\Program Files\Diino 2008-01-30 17:37 --------- dc----w C:\Program Files\Ganymede 2008-01-27 20:39 --------- dc----w C:\Documents and Settings\All Users\Dane aplikacji\HipSoft 2008-01-27 20:38 --------- dc----w C:\Program Files\ReflexiveArcade 2008-01-26 12:22 --------- dc----w C:\Documents and Settings\All Users\Dane aplikacji\ConeXware 2008-01-25 10:02 --------- dc----w C:\Program Files\FlashGet 2008-01-22 15:23 --------- dc----w C:\Program Files\MegauploadToolbar 2008-01-21 17:35 --------- dc----w C:\Program Files\PITy 2008-01-16 21:13 --------- dc----w C:\Program Files\Diskeeper Corporation 2008-01-15 19:50 --------- dc----w C:\Program Files\Download Direct 2008-01-13 13:41 --------- dc----w C:\Documents and Settings\Dom\Dane aplikacji\concept design 2008-01-13 13:39 --------- dc----w C:\Program Files\concept design 2008-01-13 13:24 --------- dc----w C:\Documents and Settings\Dom\Dane aplikacji\JLC's Software 2008-01-07 15:41 155,648 -c--a-w C:\WINDOWS\system32\libssl32.dll 2008-01-07 15:41 --------- dc----w C:\Program Files\OpenSSL 2008-01-06 12:48 --------- dc----w C:\Program Files\lame3.98b6_[www.programosy.pl] 2008-01-05 19:16 --------- dc----w C:\Documents and Settings\Dom\Dane aplikacji\gtk-2.0 2008-01-04 21:52 --------- dc----w C:\Documents and Settings\Dom\Dane aplikacji\mIRC 2008-01-04 10:05 --------- dc----w C:\Program Files\Azureus 2008-01-03 17:23 687,616 -c--a-w C:\WINDOWS\system32\StatkiGame.exe 2008-01-01 18:33 512,096 -c--a-w C:\WINDOWS\system32\drivers\amon.sys 2008-01-01 18:33 298,104 -c--a-w C:\WINDOWS\system32\imon.dll 2008-01-01 18:33 15,424 -c--a-w C:\WINDOWS\system32\drivers\nod32drv.sys 2008-01-01 17:01 --------- dc----w C:\Program Files\WapSter 2007-12-28 16:56 32 -c--a-w C:\Documents and Settings\All Users\Dane aplikacji\ezsid.dat 2007-12-09 19:20 219,648 -c--a-w C:\WINDOWS\system32\uxtheme.dll 2001-11-23 21:08 712,704 -c--a-w C:\WINDOWS\inf\OTHER\audio3d.dll . ------- Sigcheck ------- 6a603809f598332dbedd535bdbce313e C:\WINDOWS\system32\drivers\tcpip.sys -c--a-w 359,040 2004-08-04 12:00:00 C:\WINDOWS\system32\drivers\tcpip.sys . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "AQQ"="C:\PROGRA~1\WapSter\AQQ\AQQ.exe" [2007-02-28 13:18 2351864] "Glary Memory Optimizer"="C:\Program Files\Glary Utilities\memdefrag.exe" [ ] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "C-Media Mixer"="Mixer.exe" [2001-11-15 21:08 1216512 C:\WINDOWS\mixer.exe] "AtiPTA"="atiptaxx.exe" [2006-02-22 01:05 344064 C:\WINDOWS\system32\atiptaxx.exe] "nod32kui"="C:\Program Files\Eset\nod32kui.exe" [2008-01-01 19:33 949376] "ISTray"="C:\Program Files\Spyware Doctor\pctsTray.exe" [2007-12-10 14:53 1103752] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\Antiwpa] antiwpa.dll 2006-10-09 20:27 5376 C:\WINDOWS\system32\antiwpa.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\WBSrv] C:\Program Files\Stardock\Object Desktop\WindowBlinds\wbsrv.dll 2008-01-03 17:02 229376 C:\Program Files\Stardock\Object Desktop\WindowBlinds\WbSrv.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "AppInit_DLLs"=wbsys.dll [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Adobe Reader Speed Launch.lnk] backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^BlueSoleil.lnk] backup=C:\WINDOWS\pss\BlueSoleil.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^podXP.lnk] path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\podXP.lnk backup=C:\WINDOWS\pss\podXP.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^Dom^Menu Start^Programy^Autostart^HDDlife.lnk] backup=C:\WINDOWS\pss\HDDlife.lnkStartup [HKLM\~\startupfolder\C:^Documents and Settings^Dom^Menu Start^Programy^Autostart^MagicDisc.lnk] path=C:\Documents and Settings\Dom\Menu Start\Programy\Autostart\MagicDisc.lnk backup=C:\WINDOWS\pss\MagicDisc.lnkStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AQQ] --a--c--- 2007-02-28 13:18 2351864 C:\PROGRA~1\WapSter\AQQ\AQQ.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATICCC] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\C-Media Echo Control] --a--c--- 2001-12-05 15:47 147456 C:\Program Files\PCI Audio Applications\Bin\EchoCtrl.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ChomikBox] C:\Program Files\ChomikBox\ChomikBox.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools] --a--c--- 2007-08-16 12:24 167368 C:\Program Files\DAEMON Tools\daemon.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DLD.EXE] C:\Program Files\Download Direct\DLD.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Flashget] --a--c--- 2007-09-25 09:10 2007088 C:\Program Files\FlashGet\flashget.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\FLMMOUSE] --a--c--- 2007-08-10 22:36 356352 C:\Program Files\Browser mouse\1.0\mouse32a.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Gadu-Gadu] --a--c--- 2007-07-09 08:39 2119104 C:\Program Files\Gadu-Gadu\gg.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Glary Memory Optimizer] C:\Program Files\Glary Utilities\memdefrag.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Desktop Search] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Odkurzacz-MCD] C:\Program Files\Odkurzacz\odk_mcd.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OutpostFeedBack] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Rapget] C:\Documents and Settings\Dom\Pulpit\rapget140\rapget.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched] --a--c--- 2007-07-12 03:00 132496 C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\USB Storage Toolbox] --a--c--- 2005-09-14 19:44 65536 C:\Program Files\USB Disk Win98 Driver\Res.EXE [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UVS11 Preload] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WhenUSearch] C:\Program Files\DAEMON Tools SearchBar\Search.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Xbar] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-disabled] "Flashget"=C:\Program Files\FlashGet\flashget.exe /min [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "C:\\Documents and Settings\\Dom\\Dane aplikacji\\Thinstall\\APCS3E\\4000005700003i\\mDNSResponder.exe"= "C:\\Program Files\\WapSter\\AQQ\\AQQ.exe"= "C:\\PROGRA~1\\WapSter\\AQQ\\AQQ.exe"= "C:\\Program Files\\Azureus\\Azureus.exe"= "E:\\eMule\\emule.exe"= "C:\\Program Files\\Gadu-Gadu\\gg.exe"= "C:\\Program Files\\Windows Media Player\\wmplayer.exe"= "C:\\Program Files\\Mozilla Firefox\\firefox.exe"= "C:\\Documents and Settings\\Dom\\Dane aplikacji\\Thinstall\\Quick Screen Recorder 1.5\\400000ed00002h\\LastFM.exe"= "C:\\WINDOWS\\system32\\dpvsetup.exe"= "C:\\WINDOWS\\system32\\rundll32.exe"= "C:\\Program Files\\FlashGet\\flashget.exe"= "C:\\Program Files\\Winamp\\winamp.exe"= "C:\\Program Files\\NAPI-PROJEKT\\napisy.exe"= "C:\\WINDOWS\\system32\\StatkiGame.exe"= "E:\\Programy\\mIRC\\mirc.exe"= "C:\\Program Files\\SHOUTcast\\sc_serv.exe"= "C:\\Program Files\\Skype\\Phone\\Skype.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "55555:TCP"= 55555:TCP:as "55555:UDP"= 55555:UDP:as2 R1 atitray;atitray;C:\Program Files\Radeon Omega Drivers\v3.8.252\ATI Tray Tools\atitray.sys [2006-02-28 21:55] R1 eusk2par;EUTRON SmartKey Parallel Driver;C:\WINDOWS\system32\Drivers\eusk2par.sys [2004-11-18 11:49] S3 eusk3usb;SmartKey 3 USB;C:\WINDOWS\system32\Drivers\eusk3usb.sys [2004-11-18 11:49] S3 WRSWanDD;WinPoET PPPoE Adapter;C:\WINDOWS\system32\DRIVERS\WrKPoETNic2000.sys [2007-07-04 16:27] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{2dbb7d40-7b0d-11dc-9ebe-00e04c1c0d8b}] \Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Recycled\ctfmon.exe \Shell\Open(&0)\command - Recycled\ctfmon.exe . Contents of the 'Scheduled Tasks' folder "2008-03-01 15:00:05 C:\WINDOWS\Tasks\ACE65FAD939DD11D.job" - c:\docume~1\dom\daneap~1\trustl~1\owns noun log.exe . ************************************************************************** catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-03-01 15:57:54 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . --------------------- DLLs Loaded Under Running Processes --------------------- PROCESS: C:\WINDOWS\system32\lsass.exe [5.01.2600.2180] -> C:\Program Files\Eset\pr_imon.dll . ------------------------ Other Running Processes ------------------------ . C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\Ati2evxx.exe C:\Program Files\Common Files\InterVideo\DeviceService\DevSvc.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\Program Files\Eset\nod32krn.exe C:\Program Files\Spyware Doctor\pctsAuxs.exe C:\Program Files\Spyware Doctor\pctsSvc.exe C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\system32\imapi.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Internet Explorer\iexplore.exe . ************************************************************************** . Completion time: 2008-03-01 16:02:47 - machine was rebooted ComboFix-quarantined-files.txt 2008-03-01 15:02:37

**Posty:** 18165 · przez **wojtas** 01 Mar 2008, 17:13

Otworz notatnik i wklej w nim to:

File::
C:\WINDOWS\Tasks\ACE65FAD939DD11D.job

Folder::
C:\Program Files\DivoCodec
C:\Documents and Settings\All Users\Dane aplikacji\That size
C:\Documents and Settings\Dom\Dane aplikacji\TRUSTLOCKS
C:\Program Files\TRUSTLOCKS

Registry::
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WhenUSearch]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{2dbb7d40-7b0d-11dc-9ebe-00e04c1c0d8b}]

Plik >>> zapisz jako CFScript.txt .Plik przeciągnij i upuść na ikonę ComboFixa (tak jak tu ) . odczekaj az wygeneruje sie nowy log i go daj na forum

**Posty:** 131 · przez **OnLines** 01 Mar 2008, 17:16

Instalacja nie powiodła się

**Posty:** 18165 · przez **wojtas** 01 Mar 2008, 17:20

Ściągnij OTMoveIt W okienko po lewej Paste List of Files/Folders to be Moved wklej

C:\WINDOWS\Tasks\ACE65FAD939DD11D.job
C:\Program Files\DivoCodec
C:\Documents and Settings\All Users\Dane aplikacji\That size
C:\Documents and Settings\Dom\Dane aplikacji\TRUSTLOCKS
C:\Program Files\TRUSTLOCKS

Następnie naciskamy - MoveIt!. Pliki zostały przeniesione. Wynik operacji zobaczymy w prawym oknie Results.
Po całej operacji należy zresetować komputer

wklej do notatnika:

REGEDIT 4

[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WhenUSearch]

[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{2dbb7d40-7b0d-11dc-9ebe-00e04c1c0d8b}]

w notatniku u góry>>>plik zapisz jako>>>Zmien rozszerzenie z TXT na Wszystkie pliki *.* >>> Zapisz pod nazwą FIX.REG

Klikasz dwa razy na powstały plik fix i dodajesz go do rejestru....

potem dajesz nowy log z combofixa

**Posty:** 131 · przez **OnLines** 01 Mar 2008, 17:40

Kod: Zaznacz wszystko: ComboFix 08-03-01.3 - Dom 2008-03-01 16:35:07.2 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.160 [GMT 1:00] Running from: C:\Documents and Settings\Dom\Pulpit\ComboFix.exe [color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color] . ((((((((((((((((((((((((( Files Created from 2008-02-01 to 2008-03-01 ))))))))))))))))))))))))))))))) . 2008-03-01 16:24 . 2008-03-01 16:24 <DIR> d----c--- C:\_OTMoveIt 2008-03-01 15:36 . 2008-03-01 15:36 <DIR> d----c--- C:\Program Files\Trend Micro 2008-03-01 14:41 . 2008-02-26 22:29 734,728,192 --a--c--- C:\ranczo.wilkowyje.2007.dvdscr.xvid-ind.avi 2008-02-27 22:13 . 2008-02-27 22:13 <DIR> d----c--- C:\Program Files\Common Files\DirectX 2008-02-21 17:14 . 2008-03-01 16:30 <DIR> d----c--- C:\Program Files\Spyware Doctor 2008-02-18 22:34 . 2008-02-18 22:34 <DIR> d----c--- C:\Documents and Settings\All Users\Dane aplikacji\That size part chin 2008-02-18 22:24 . 2008-02-18 22:24 1,415,680 --a--c--- C:\WINDOWS\system32\WMV9VCM.dll 2008-02-18 22:24 . 2008-02-18 22:24 921,600 --a--c--- C:\WINDOWS\system32\vorbisenc.dll 2008-02-18 22:24 . 2008-02-18 22:24 892,928 --a--c--- C:\WINDOWS\system32\iconv.dll 2008-02-18 22:24 . 2008-02-18 22:24 577,536 --a--c--- C:\WINDOWS\system32\ac3filter.ax 2008-02-18 22:24 . 2008-02-18 22:24 237,568 --a--c--- C:\WINDOWS\system32\OggDS.dll 2008-02-18 22:24 . 2008-02-18 22:24 188,416 --a--c--- C:\WINDOWS\system32\vorbis.dll 2008-02-18 22:24 . 2008-02-18 22:24 106,496 --a--c--- C:\WINDOWS\system32\lmpgspl.ax 2008-02-18 22:24 . 2008-02-18 22:24 94,208 --a--c--- C:\WINDOWS\system32\lmpgvd.ax 2008-02-18 22:24 . 2008-02-18 22:24 45,056 --a--c--- C:\WINDOWS\system32\ogg.dll 2008-02-18 22:23 . 2008-02-18 22:23 630,784 --a--c--- C:\WINDOWS\system32\divxdec.ax 2008-02-18 22:23 . 2008-02-18 22:23 524,288 --a--c--- C:\WINDOWS\system32\DivXsm.exe 2008-02-18 22:23 . 2008-02-18 22:23 352,401 --a--c--- C:\WINDOWS\system32\DivXMedia.ax 2008-02-18 22:23 . 2008-02-18 22:23 245,760 --a--c--- C:\WINDOWS\system32\mplvpx.dll 2008-02-18 22:23 . 2008-02-18 22:23 86,528 --a--c--- C:\WINDOWS\system32\DVDVideo.ax 2008-02-18 22:23 . 2008-02-18 22:23 77,824 --a--c--- C:\WINDOWS\system32\xvid.ax 2008-02-18 22:23 . 2008-02-18 22:23 9,216 --a--c--- C:\WINDOWS\system32\cpuinf32.dll 2008-02-18 16:26 . 2008-02-21 17:46 <DIR> d----c--- C:\Perl 2008-02-12 22:47 . 2008-02-12 22:47 <DIR> d----c--- C:\Program Files\HD Tune 2008-02-10 17:18 . 1998-10-07 12:54 327,168 --a--c--- C:\WINDOWS\IsUn0415.exe 2008-02-09 11:46 . 2008-02-09 11:46 <DIR> d----c--- C:\Documents and Settings\All Users\Dane aplikacji\MumboJumbo 2008-02-07 22:24 . 2008-02-07 22:35 <DIR> d----c--- C:\Program Files\SHOUTcast 2008-02-02 10:57 . 2008-02-02 10:57 <DIR> d----c--- C:\Program Files\Kodak 2008-02-02 10:51 . 2008-02-02 11:45 <DIR> d----c--- C:\Documents and Settings\All Users\Dane aplikacji\Kodak . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-03-01 15:27 --------- dc--a-w C:\Documents and Settings\All Users\Dane aplikacji\TEMP 2008-03-01 15:17 --------- dc----w C:\Documents and Settings\Dom\Dane aplikacji\MegauploadToolbar 2008-02-29 19:39 --------- dc----w C:\Documents and Settings\Dom\Dane aplikacji\Azureus 2008-02-24 17:26 --------- dc----w C:\Documents and Settings\Dom\Dane aplikacji\Skype 2008-02-24 16:43 --------- dc----w C:\Documents and Settings\Dom\Dane aplikacji\skypePM 2008-02-22 17:45 --------- dc----w C:\Documents and Settings\Dom\Dane aplikacji\GanymedeNet 2008-02-18 21:23 1,559,040 -c--a-w C:\WINDOWS\system32\xvidcore.dll 2008-02-18 17:09 --------- dc----w C:\Program Files\NAPI-PROJEKT 2008-02-18 12:25 --------- dc----w C:\Program Files\Mozilla Thunderbird 2008-02-16 12:09 --------- dc-h--w C:\Program Files\InstallShield Installation Information 2008-02-12 08:29 --------- dc----w C:\Documents and Settings\Dom\Dane aplikacji\Thinstall 2008-02-08 01:56 --------- dc----w C:\Program Files\ESET 2008-02-07 21:24 --------- dc----w C:\Program Files\Winamp 2008-02-06 20:10 --------- dc----w C:\Program Files\Gadu-Gadu 2008-02-04 14:18 --------- dc----w C:\Program Files\AutoConnect 2008-01-30 17:55 --------- dc----w C:\Program Files\Glary Utilities 2008-01-30 17:55 --------- dc----w C:\Program Files\ChomikBox 2008-01-30 17:52 --------- dc----w C:\Program Files\JLC's Software 2008-01-30 17:51 --------- dc----w C:\Program Files\FlashFXP 2008-01-30 17:50 --------- dc----w C:\Program Files\Diino 2008-01-30 17:37 --------- dc----w C:\Program Files\Ganymede 2008-01-27 20:39 --------- dc----w C:\Documents and Settings\All Users\Dane aplikacji\HipSoft 2008-01-27 20:38 --------- dc----w C:\Program Files\ReflexiveArcade 2008-01-26 12:22 --------- dc----w C:\Documents and Settings\All Users\Dane aplikacji\ConeXware 2008-01-25 10:02 --------- dc----w C:\Program Files\FlashGet 2008-01-22 15:23 --------- dc----w C:\Program Files\MegauploadToolbar 2008-01-21 17:35 --------- dc----w C:\Program Files\PITy 2008-01-16 21:13 --------- dc----w C:\Program Files\Diskeeper Corporation 2008-01-15 19:50 --------- dc----w C:\Program Files\Download Direct 2008-01-13 13:41 --------- dc----w C:\Documents and Settings\Dom\Dane aplikacji\concept design 2008-01-13 13:39 --------- dc----w C:\Program Files\concept design 2008-01-13 13:24 --------- dc----w C:\Documents and Settings\Dom\Dane aplikacji\JLC's Software 2008-01-07 15:41 155,648 -c--a-w C:\WINDOWS\system32\libssl32.dll 2008-01-07 15:41 --------- dc----w C:\Program Files\OpenSSL 2008-01-06 12:48 --------- dc----w C:\Program Files\lame3.98b6_[www.programosy.pl] 2008-01-05 19:16 --------- dc----w C:\Documents and Settings\Dom\Dane aplikacji\gtk-2.0 2008-01-04 21:52 --------- dc----w C:\Documents and Settings\Dom\Dane aplikacji\mIRC 2008-01-04 10:05 --------- dc----w C:\Program Files\Azureus 2008-01-03 17:23 687,616 -c--a-w C:\WINDOWS\system32\StatkiGame.exe 2008-01-01 18:33 512,096 -c--a-w C:\WINDOWS\system32\drivers\amon.sys 2008-01-01 18:33 298,104 -c--a-w C:\WINDOWS\system32\imon.dll 2008-01-01 18:33 15,424 -c--a-w C:\WINDOWS\system32\drivers\nod32drv.sys 2008-01-01 17:01 --------- dc----w C:\Program Files\WapSter 2007-12-28 16:56 32 -c--a-w C:\Documents and Settings\All Users\Dane aplikacji\ezsid.dat 2007-12-09 19:20 219,648 -c--a-w C:\WINDOWS\system32\uxtheme.dll 2001-11-23 21:08 712,704 -c--a-w C:\WINDOWS\inf\OTHER\audio3d.dll . ------- Sigcheck ------- 6a603809f598332dbedd535bdbce313e C:\WINDOWS\system32\drivers\tcpip.sys -c--a-w 359,040 2004-08-04 12:00:00 C:\WINDOWS\system32\drivers\tcpip.sys . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "AQQ"="C:\PROGRA~1\WapSter\AQQ\AQQ.exe" [2007-02-28 13:18 2351864] "Glary Memory Optimizer"="C:\Program Files\Glary Utilities\memdefrag.exe" [ ] "memo software"="C:\DOCUME~1\Dom\DANEAP~1\TRUSTL~1\32 Bend Dent.exe" [ ] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "C-Media Mixer"="Mixer.exe" [2001-11-15 21:08 1216512 C:\WINDOWS\mixer.exe] "AtiPTA"="atiptaxx.exe" [2006-02-22 01:05 344064 C:\WINDOWS\system32\atiptaxx.exe] "nod32kui"="C:\Program Files\Eset\nod32kui.exe" [2008-01-01 19:33 949376] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\Antiwpa] antiwpa.dll 2006-10-09 20:27 5376 C:\WINDOWS\system32\antiwpa.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\WBSrv] C:\Program Files\Stardock\Object Desktop\WindowBlinds\wbsrv.dll 2008-01-03 17:02 229376 C:\Program Files\Stardock\Object Desktop\WindowBlinds\WbSrv.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "AppInit_DLLs"=wbsys.dll [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Adobe Reader Speed Launch.lnk] backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^BlueSoleil.lnk] backup=C:\WINDOWS\pss\BlueSoleil.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^podXP.lnk] path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\podXP.lnk backup=C:\WINDOWS\pss\podXP.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^Dom^Menu Start^Programy^Autostart^HDDlife.lnk] backup=C:\WINDOWS\pss\HDDlife.lnkStartup [HKLM\~\startupfolder\C:^Documents and Settings^Dom^Menu Start^Programy^Autostart^MagicDisc.lnk] path=C:\Documents and Settings\Dom\Menu Start\Programy\Autostart\MagicDisc.lnk backup=C:\WINDOWS\pss\MagicDisc.lnkStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AQQ] --a--c--- 2007-02-28 13:18 2351864 C:\PROGRA~1\WapSter\AQQ\AQQ.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATICCC] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\C-Media Echo Control] --a--c--- 2001-12-05 15:47 147456 C:\Program Files\PCI Audio Applications\Bin\EchoCtrl.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ChomikBox] C:\Program Files\ChomikBox\ChomikBox.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools] --a--c--- 2007-08-16 12:24 167368 C:\Program Files\DAEMON Tools\daemon.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DLD.EXE] C:\Program Files\Download Direct\DLD.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Flashget] --a--c--- 2007-09-25 09:10 2007088 C:\Program Files\FlashGet\flashget.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\FLMMOUSE] --a--c--- 2007-08-10 22:36 356352 C:\Program Files\Browser mouse\1.0\mouse32a.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Gadu-Gadu] --a--c--- 2007-07-09 08:39 2119104 C:\Program Files\Gadu-Gadu\gg.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Glary Memory Optimizer] C:\Program Files\Glary Utilities\memdefrag.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Desktop Search] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Odkurzacz-MCD] C:\Program Files\Odkurzacz\odk_mcd.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OutpostFeedBack] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Rapget] C:\Documents and Settings\Dom\Pulpit\rapget140\rapget.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched] --a--c--- 2007-07-12 03:00 132496 C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\USB Storage Toolbox] --a--c--- 2005-09-14 19:44 65536 C:\Program Files\USB Disk Win98 Driver\Res.EXE [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UVS11 Preload] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WhenUSearch] C:\Program Files\DAEMON Tools SearchBar\Search.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Xbar] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-disabled] "Flashget"=C:\Program Files\FlashGet\flashget.exe /min [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "C:\\Documents and Settings\\Dom\\Dane aplikacji\\Thinstall\\APCS3E\\4000005700003i\\mDNSResponder.exe"= "C:\\Program Files\\WapSter\\AQQ\\AQQ.exe"= "C:\\PROGRA~1\\WapSter\\AQQ\\AQQ.exe"= "C:\\Program Files\\Azureus\\Azureus.exe"= "E:\\eMule\\emule.exe"= "C:\\Program Files\\Gadu-Gadu\\gg.exe"= "C:\\Program Files\\Windows Media Player\\wmplayer.exe"= "C:\\Program Files\\Mozilla Firefox\\firefox.exe"= "C:\\Documents and Settings\\Dom\\Dane aplikacji\\Thinstall\\Quick Screen Recorder 1.5\\400000ed00002h\\LastFM.exe"= "C:\\WINDOWS\\system32\\dpvsetup.exe"= "C:\\WINDOWS\\system32\\rundll32.exe"= "C:\\Program Files\\FlashGet\\flashget.exe"= "C:\\Program Files\\Winamp\\winamp.exe"= "C:\\Program Files\\NAPI-PROJEKT\\napisy.exe"= "C:\\WINDOWS\\system32\\StatkiGame.exe"= "E:\\Programy\\mIRC\\mirc.exe"= "C:\\Program Files\\SHOUTcast\\sc_serv.exe"= "C:\\Program Files\\Skype\\Phone\\Skype.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "55555:TCP"= 55555:TCP:as "55555:UDP"= 55555:UDP:as2 R1 atitray;atitray;C:\Program Files\Radeon Omega Drivers\v3.8.252\ATI Tray Tools\atitray.sys [2006-02-28 21:55] R1 eusk2par;EUTRON SmartKey Parallel Driver;C:\WINDOWS\system32\Drivers\eusk2par.sys [2004-11-18 11:49] S3 eusk3usb;SmartKey 3 USB;C:\WINDOWS\system32\Drivers\eusk3usb.sys [2004-11-18 11:49] S3 WRSWanDD;WinPoET PPPoE Adapter;C:\WINDOWS\system32\DRIVERS\WrKPoETNic2000.sys [2007-07-04 16:27] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{2dbb7d40-7b0d-11dc-9ebe-00e04c1c0d8b}] \Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Recycled\ctfmon.exe \Shell\Open(&0)\command - Recycled\ctfmon.exe . ************************************************************************** catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-03-01 16:37:34 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . --------------------- DLLs Loaded Under Running Processes --------------------- PROCESS: C:\WINDOWS\system32\lsass.exe [5.01.2600.2180] -> C:\Program Files\Eset\pr_imon.dll . Completion time: 2008-03-01 16:39:03 ComboFix-quarantined-files.txt 2008-03-01 15:38:52 ComboFix2.txt 2008-03-01 15:02:49

**Posty:** 18165 · przez **wojtas** 01 Mar 2008, 17:53

C:\Documents and Settings\All Users\Dane aplikacji\That size

skasuj ten folder ^^

wklej do notatnika:

REGEDIT 4

[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WhenUSearch]

[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{2dbb7d40-7b0d-11dc-9ebe-00e04c1c0d8b}]

w notatniku u góry>>>plik zapisz jako>>>Zmien rozszerzenie z TXT na Wszystkie pliki *.* >>> Zapisz pod nazwą FIX.REG

Klikasz dwa razy na powstały plik fix i dodajesz go do rejestru....

potem dajesz nowy log z combofixa

**Posty:** 131 · przez **OnLines** 01 Mar 2008, 18:04

Kod: Zaznacz wszystko: ComboFix 08-03-01.3 - Dom 2008-03-01 16:57:58.3 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.109 [GMT 1:00]Running from: C:\Documents and Settings\Dom\Pulpit\ComboFix.exe [color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color] . ((((((((((((((((((((((((( Files Created from 2008-02-01 to 2008-03-01 ))))))))))))))))))))))))))))))) . 2008-03-01 16:24 . 2008-03-01 16:24 <DIR> d----c--- C:\_OTMoveIt 2008-03-01 15:36 . 2008-03-01 15:36 <DIR> d----c--- C:\Program Files\Trend Micro 2008-02-27 22:13 . 2008-02-27 22:13 <DIR> d----c--- C:\Program Files\Common Files\DirectX 2008-02-21 17:14 . 2008-03-01 16:30 <DIR> d----c--- C:\Program Files\Spyware Doctor 2008-02-18 22:24 . 2008-02-18 22:24 1,415,680 --a--c--- C:\WINDOWS\system32\WMV9VCM.dll 2008-02-18 22:24 . 2008-02-18 22:24 921,600 --a--c--- C:\WINDOWS\system32\vorbisenc.dll 2008-02-18 22:24 . 2008-02-18 22:24 892,928 --a--c--- C:\WINDOWS\system32\iconv.dll 2008-02-18 22:24 . 2008-02-18 22:24 577,536 --a--c--- C:\WINDOWS\system32\ac3filter.ax 2008-02-18 22:24 . 2008-02-18 22:24 237,568 --a--c--- C:\WINDOWS\system32\OggDS.dll 2008-02-18 22:24 . 2008-02-18 22:24 188,416 --a--c--- C:\WINDOWS\system32\vorbis.dll 2008-02-18 22:24 . 2008-02-18 22:24 106,496 --a--c--- C:\WINDOWS\system32\lmpgspl.ax 2008-02-18 22:24 . 2008-02-18 22:24 94,208 --a--c--- C:\WINDOWS\system32\lmpgvd.ax 2008-02-18 22:24 . 2008-02-18 22:24 45,056 --a--c--- C:\WINDOWS\system32\ogg.dll 2008-02-18 22:23 . 2008-02-18 22:23 630,784 --a--c--- C:\WINDOWS\system32\divxdec.ax 2008-02-18 22:23 . 2008-02-18 22:23 524,288 --a--c--- C:\WINDOWS\system32\DivXsm.exe 2008-02-18 22:23 . 2008-02-18 22:23 352,401 --a--c--- C:\WINDOWS\system32\DivXMedia.ax 2008-02-18 22:23 . 2008-02-18 22:23 245,760 --a--c--- C:\WINDOWS\system32\mplvpx.dll 2008-02-18 22:23 . 2008-02-18 22:23 86,528 --a--c--- C:\WINDOWS\system32\DVDVideo.ax 2008-02-18 22:23 . 2008-02-18 22:23 77,824 --a--c--- C:\WINDOWS\system32\xvid.ax 2008-02-18 22:23 . 2008-02-18 22:23 9,216 --a--c--- C:\WINDOWS\system32\cpuinf32.dll 2008-02-18 16:26 . 2008-02-21 17:46 <DIR> d----c--- C:\Perl 2008-02-12 22:47 . 2008-02-12 22:47 <DIR> d----c--- C:\Program Files\HD Tune 2008-02-10 17:18 . 1998-10-07 12:54 327,168 --a--c--- C:\WINDOWS\IsUn0415.exe 2008-02-09 11:46 . 2008-02-09 11:46 <DIR> d----c--- C:\Documents and Settings\All Users\Dane aplikacji\MumboJumbo 2008-02-07 22:24 . 2008-02-07 22:35 <DIR> d----c--- C:\Program Files\SHOUTcast 2008-02-02 10:57 . 2008-02-02 10:57 <DIR> d----c--- C:\Program Files\Kodak 2008-02-02 10:51 . 2008-02-02 11:45 <DIR> d----c--- C:\Documents and Settings\All Users\Dane aplikacji\Kodak . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-03-01 15:27 --------- dc--a-w C:\Documents and Settings\All Users\Dane aplikacji\TEMP 2008-03-01 15:17 --------- dc----w C:\Documents and Settings\Dom\Dane aplikacji\MegauploadToolbar 2008-02-29 19:39 --------- dc----w C:\Documents and Settings\Dom\Dane aplikacji\Azureus 2008-02-24 17:26 --------- dc----w C:\Documents and Settings\Dom\Dane aplikacji\Skype 2008-02-24 16:43 --------- dc----w C:\Documents and Settings\Dom\Dane aplikacji\skypePM 2008-02-22 17:45 --------- dc----w C:\Documents and Settings\Dom\Dane aplikacji\GanymedeNet 2008-02-18 21:23 1,559,040 -c--a-w C:\WINDOWS\system32\xvidcore.dll 2008-02-18 17:09 --------- dc----w C:\Program Files\NAPI-PROJEKT 2008-02-18 12:25 --------- dc----w C:\Program Files\Mozilla Thunderbird 2008-02-16 12:09 --------- dc-h--w C:\Program Files\InstallShield Installation Information 2008-02-12 08:29 --------- dc----w C:\Documents and Settings\Dom\Dane aplikacji\Thinstall 2008-02-08 01:56 --------- dc----w C:\Program Files\ESET 2008-02-07 21:24 --------- dc----w C:\Program Files\Winamp 2008-02-06 20:10 --------- dc----w C:\Program Files\Gadu-Gadu 2008-02-04 14:18 --------- dc----w C:\Program Files\AutoConnect 2008-01-30 17:55 --------- dc----w C:\Program Files\Glary Utilities 2008-01-30 17:55 --------- dc----w C:\Program Files\ChomikBox 2008-01-30 17:52 --------- dc----w C:\Program Files\JLC's Software 2008-01-30 17:51 --------- dc----w C:\Program Files\FlashFXP 2008-01-30 17:50 --------- dc----w C:\Program Files\Diino 2008-01-30 17:37 --------- dc----w C:\Program Files\Ganymede 2008-01-27 20:39 --------- dc----w C:\Documents and Settings\All Users\Dane aplikacji\HipSoft 2008-01-27 20:38 --------- dc----w C:\Program Files\ReflexiveArcade 2008-01-26 12:22 --------- dc----w C:\Documents and Settings\All Users\Dane aplikacji\ConeXware 2008-01-25 10:02 --------- dc----w C:\Program Files\FlashGet 2008-01-22 15:23 --------- dc----w C:\Program Files\MegauploadToolbar 2008-01-21 17:35 --------- dc----w C:\Program Files\PITy 2008-01-16 21:13 --------- dc----w C:\Program Files\Diskeeper Corporation 2008-01-15 19:50 --------- dc----w C:\Program Files\Download Direct 2008-01-13 13:41 --------- dc----w C:\Documents and Settings\Dom\Dane aplikacji\concept design 2008-01-13 13:39 --------- dc----w C:\Program Files\concept design 2008-01-13 13:24 --------- dc----w C:\Documents and Settings\Dom\Dane aplikacji\JLC's Software 2008-01-07 15:41 155,648 -c--a-w C:\WINDOWS\system32\libssl32.dll 2008-01-07 15:41 --------- dc----w C:\Program Files\OpenSSL 2008-01-06 12:48 --------- dc----w C:\Program Files\lame3.98b6_[www.programosy.pl] 2008-01-05 19:16 --------- dc----w C:\Documents and Settings\Dom\Dane aplikacji\gtk-2.0 2008-01-04 21:52 --------- dc----w C:\Documents and Settings\Dom\Dane aplikacji\mIRC 2008-01-04 10:05 --------- dc----w C:\Program Files\Azureus 2008-01-03 17:23 687,616 -c--a-w C:\WINDOWS\system32\StatkiGame.exe 2008-01-01 18:33 512,096 -c--a-w C:\WINDOWS\system32\drivers\amon.sys 2008-01-01 18:33 298,104 -c--a-w C:\WINDOWS\system32\imon.dll 2008-01-01 18:33 15,424 -c--a-w C:\WINDOWS\system32\drivers\nod32drv.sys 2008-01-01 17:01 --------- dc----w C:\Program Files\WapSter 2007-12-28 16:56 32 -c--a-w C:\Documents and Settings\All Users\Dane aplikacji\ezsid.dat 2007-12-09 19:20 219,648 -c--a-w C:\WINDOWS\system32\uxtheme.dll 2001-11-23 21:08 712,704 -c--a-w C:\WINDOWS\inf\OTHER\audio3d.dll . ------- Sigcheck ------- 6a603809f598332dbedd535bdbce313e C:\WINDOWS\system32\drivers\tcpip.sys -c--a-w 359,040 2004-08-04 12:00:00 C:\WINDOWS\system32\drivers\tcpip.sys . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "AQQ"="C:\PROGRA~1\WapSter\AQQ\AQQ.exe" [2007-02-28 13:18 2351864] "Glary Memory Optimizer"="C:\Program Files\Glary Utilities\memdefrag.exe" [ ] "memo software"="C:\DOCUME~1\Dom\DANEAP~1\TRUSTL~1\32 Bend Dent.exe" [ ] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "C-Media Mixer"="Mixer.exe" [2001-11-15 21:08 1216512 C:\WINDOWS\mixer.exe] "AtiPTA"="atiptaxx.exe" [2006-02-22 01:05 344064 C:\WINDOWS\system32\atiptaxx.exe] "nod32kui"="C:\Program Files\Eset\nod32kui.exe" [2008-01-01 19:33 949376] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\Antiwpa] antiwpa.dll 2006-10-09 20:27 5376 C:\WINDOWS\system32\antiwpa.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\WBSrv] C:\Program Files\Stardock\Object Desktop\WindowBlinds\wbsrv.dll 2008-01-03 17:02 229376 C:\Program Files\Stardock\Object Desktop\WindowBlinds\WbSrv.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "AppInit_DLLs"=wbsys.dll [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Adobe Reader Speed Launch.lnk] backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^BlueSoleil.lnk] backup=C:\WINDOWS\pss\BlueSoleil.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^podXP.lnk] path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\podXP.lnk backup=C:\WINDOWS\pss\podXP.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^Dom^Menu Start^Programy^Autostart^HDDlife.lnk] backup=C:\WINDOWS\pss\HDDlife.lnkStartup [HKLM\~\startupfolder\C:^Documents and Settings^Dom^Menu Start^Programy^Autostart^MagicDisc.lnk] path=C:\Documents and Settings\Dom\Menu Start\Programy\Autostart\MagicDisc.lnk backup=C:\WINDOWS\pss\MagicDisc.lnkStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AQQ] --a--c--- 2007-02-28 13:18 2351864 C:\PROGRA~1\WapSter\AQQ\AQQ.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATICCC] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\C-Media Echo Control] --a--c--- 2001-12-05 15:47 147456 C:\Program Files\PCI Audio Applications\Bin\EchoCtrl.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ChomikBox] C:\Program Files\ChomikBox\ChomikBox.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools] --a--c--- 2007-08-16 12:24 167368 C:\Program Files\DAEMON Tools\daemon.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DLD.EXE] C:\Program Files\Download Direct\DLD.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Flashget] --a--c--- 2007-09-25 09:10 2007088 C:\Program Files\FlashGet\flashget.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\FLMMOUSE] --a--c--- 2007-08-10 22:36 356352 C:\Program Files\Browser mouse\1.0\mouse32a.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Gadu-Gadu] --a--c--- 2007-07-09 08:39 2119104 C:\Program Files\Gadu-Gadu\gg.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Glary Memory Optimizer] C:\Program Files\Glary Utilities\memdefrag.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Desktop Search] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Odkurzacz-MCD] C:\Program Files\Odkurzacz\odk_mcd.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OutpostFeedBack] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Rapget] C:\Documents and Settings\Dom\Pulpit\rapget140\rapget.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched] --a--c--- 2007-07-12 03:00 132496 C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\USB Storage Toolbox] --a--c--- 2005-09-14 19:44 65536 C:\Program Files\USB Disk Win98 Driver\Res.EXE [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UVS11 Preload] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WhenUSearch] C:\Program Files\DAEMON Tools SearchBar\Search.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Xbar] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-disabled] "Flashget"=C:\Program Files\FlashGet\flashget.exe /min [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "C:\\Documents and Settings\\Dom\\Dane aplikacji\\Thinstall\\APCS3E\\4000005700003i\\mDNSResponder.exe"= "C:\\Program Files\\WapSter\\AQQ\\AQQ.exe"= "C:\\PROGRA~1\\WapSter\\AQQ\\AQQ.exe"= "C:\\Program Files\\Azureus\\Azureus.exe"= "E:\\eMule\\emule.exe"= "C:\\Program Files\\Gadu-Gadu\\gg.exe"= "C:\\Program Files\\Windows Media Player\\wmplayer.exe"= "C:\\Program Files\\Mozilla Firefox\\firefox.exe"= "C:\\Documents and Settings\\Dom\\Dane aplikacji\\Thinstall\\Quick Screen Recorder 1.5\\400000ed00002h\\LastFM.exe"= "C:\\WINDOWS\\system32\\dpvsetup.exe"= "C:\\WINDOWS\\system32\\rundll32.exe"= "C:\\Program Files\\FlashGet\\flashget.exe"= "C:\\Program Files\\Winamp\\winamp.exe"= "C:\\Program Files\\NAPI-PROJEKT\\napisy.exe"= "C:\\WINDOWS\\system32\\StatkiGame.exe"= "E:\\Programy\\mIRC\\mirc.exe"= "C:\\Program Files\\SHOUTcast\\sc_serv.exe"= "C:\\Program Files\\Skype\\Phone\\Skype.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "55555:TCP"= 55555:TCP:as "55555:UDP"= 55555:UDP:as2 R1 atitray;atitray;C:\Program Files\Radeon Omega Drivers\v3.8.252\ATI Tray Tools\atitray.sys [2006-02-28 21:55] R1 eusk2par;EUTRON SmartKey Parallel Driver;C:\WINDOWS\system32\Drivers\eusk2par.sys [2004-11-18 11:49] S3 eusk3usb;SmartKey 3 USB;C:\WINDOWS\system32\Drivers\eusk3usb.sys [2004-11-18 11:49] S3 WRSWanDD;WinPoET PPPoE Adapter;C:\WINDOWS\system32\DRIVERS\WrKPoETNic2000.sys [2007-07-04 16:27] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{2dbb7d40-7b0d-11dc-9ebe-00e04c1c0d8b}] \Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Recycled\ctfmon.exe \Shell\Open(&0)\command - Recycled\ctfmon.exe . ************************************************************************** catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-03-01 17:00:57 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . --------------------- DLLs Loaded Under Running Processes --------------------- PROCESS: C:\WINDOWS\system32\lsass.exe [5.01.2600.2180] -> C:\Program Files\Eset\pr_imon.dll . Completion time: 2008-03-01 17:02:55 ComboFix-quarantined-files.txt 2008-03-01 16:02:37 ComboFix2.txt 2008-03-01 15:39:04 ComboFix3.txt 2008-03-01 15:02:49

**Posty:** 18165 · przez **wojtas** 01 Mar 2008, 18:15

wklej do notatnika

Windows Registry Editor Version 5.00

[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WhenUSearch]

[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{2dbb7d40-7b0d-11dc-9ebe-00e04c1c0d8b}]

w notatniku u góry>>>plik zapisz jako>>>Zmien rozszerzenie z TXT na Wszystkie pliki *.* >>> Zapisz pod nazwą FIX.REG

Klikasz dwa razy na powstały plik fix i dodajesz go do rejestru....

i bedzie ok:) jak sytuacja z kompem?

**Posty:** 131 · przez **OnLines** 01 Mar 2008, 18:17

wojtas napisał(a):wklej do notatnika

Cytat:
Windows Registry Editor Version 5.00

[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WhenUSearch]

[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{2dbb7d40-7b0d-11dc-9ebe-00e04c1c0d8b}]

w notatniku u góry>>>plik zapisz jako>>>Zmien rozszerzenie z TXT na Wszystkie pliki *.* >>> Zapisz pod nazwą FIX.REG

Klikasz dwa razy na powstały plik fix i dodajesz go do rejestru....

mam glupie wrazenie ze ciagle to powtarzamy

a sytuacja nawet dobrze, reklamy sie nie wlaczaja ale martwi mnie znikniecie 100mb ram

**Posty:** 18165 · przez **wojtas** 01 Mar 2008, 18:22

powtarzamy bo cos nie chce sie naprawic

Autor postu otrzymał pochwałę

**Posty:** 131 · przez **OnLines** 01 Mar 2008, 18:23

juz jest ok ^^ firefox troche pamieci zabral

teraz zrobie restart i napisze czy jest OK

[ Dodano: Dzisiaj o 17:31 ]
OK wszystko dziala ^^ dzieki

prosze o sprawdzenie loga

prosze o sprawdzenie loga

Kto jest na forum