proszę o sprawdzenie loga (wieszanie się pc)

[eSpEY]

To mój log:
Problem polega na tym że komputer wiesza się i to bardzo często przy korzystaniu z gg, tlen i IE
np. pisy na gg wiadomość i nagle zero kontaktu z komputerem ani ctr+alt+delete ani przycisk sytemowy.
Proszę o pomoc!

Kod: Zaznacz wszystko

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:18:40, on 2007-09-09
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\drivers\CDAC11BA.EXE
C:\WINDOWS\system32\crypserv.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\snmp.exe
C:\Program Files\DrWeb\SpiderNT.exe
e:\Program Files\Alcohol Soft\Alcohol 52\StarWind\StarWindService.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Windows\system32\GaduGadu.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Lexmark 1200 Series\lxczbmgr.exe
C:\Program Files\Lexmark 1200 Series\lxczbmon.exe
C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\RTHDCPL.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.pl/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O2 - BHO: Flashget Catch Url Class - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\PROGRA~1\FlashGet\jccatch.dll
O2 - BHO: Alcohol Toolbar Helper - {52D06F97-5511-43FA-8FDA-C481864FD26E} - C:\Program Files\Alcohol Toolbar\v3.2.0.0\Alcohol_Toolbar.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O2 - BHO: gFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\Program Files\FlashGet\getflash.dll
O3 - Toolbar: FlashGet - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\Program Files\FlashGet\fgiebar.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O3 - Toolbar: Alcohol Toolbar - {4C4E7CDB-5BFC-4D74-83E2-8AE659B7EDA2} - C:\Program Files\Alcohol Toolbar\v3.2.0.0\Alcohol_Toolbar.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [Taskmgr32] C:\Windows\system32\GaduGadu.exe
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [Lexmark 1200 Series] "C:\Program Files\Lexmark 1200 Series\lxczbmgr.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
O4 - HKLM\..\Run: [startdrv] C:\WINDOWS\Temp\startdrv.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [NBJ] "C:\Program Files\Ahead\Nero BackItUp\NBJ.exe"
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.908.8472\GoogleToolbarNotifier.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: Ratlerek.lnk = C:\WINDOWS\RTHDCPL.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: &Ściągnij przy pomocy FlashGet'a - C:\PROGRA~1\FlashGet\jc_link.htm
O8 - Extra context menu item: &Ściągnij wszystko przy pomocy FlashGet'a - C:\PROGRA~1\FlashGet\jc_all.htm
O8 - Extra context menu item: Add to AMV Convert Tool... - E:\Program Files\MP3 Player Utilities 4.00\AMVConverter\grab.html
O8 - Extra context menu item: Add to AMV Converter... - E:\Program Files\MP3 Player Utilities 4.09\AMVConverter\grab.html
O8 - Extra context menu item: Blokuj wszystkie obrazy z tego serwera - E:\Program Files\Avant Browser\AddAllToADBlackList.htm
O8 - Extra context menu item: Dodaj do listy blokowanych reklam - E:\Program Files\Avant Browser\AddToADBlackList.htm
O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: MediaManager tool grab multimedia file - E:\Program Files\MP3 Player Utilities 4.00\MediaManager\grab.html
O8 - Extra context menu item: Otwórz w nowym Avant Browser - E:\Program Files\Avant Browser\OpenInNewBrowser.htm
O8 - Extra context menu item: Otwórz wszystkie adresy z tej strony... - E:\Program Files\Avant Browser\OpenAllLinks.htm
O8 - Extra context menu item: Podświetl - E:\Program Files\Avant Browser\Highlight.htm
O8 - Extra context menu item: Szukaj - E:\Program Files\Avant Browser\Search.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe
O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {4B4513E2-4E57-43DF-9496-FCD37E9DFA64} (GameDesire Sea Battle) - http://67.15.101.3/g_bin/pl/navy_2_0_0_29.cab
O16 - DPF: {65D72393-E210-4A2A-B8E0-10AC45986770} (GWebInstallControl Object) - http://megapanel.gem.pl/WebInstaller.dll
O16 - DPF: {68282C51-9459-467B-95BF-3C0E89627E55} (MksSkanerOnline Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab
O16 - DPF: {83AFB5CA-ED35-11D4-A452-0080C8D85045} (GameDesire Poker Games) - http://67.15.101.3/g_bin/pl/poker_2_0_0_48.cab
O16 - DPF: {AB8638BB-79E8-4E9D-ABF2-8F33054E3941} (Guesser Class) - http://czat.onet.pl/client/kalambury/NetPunGame1.dll
O16 - DPF: {BFA1F11D-3121-AFE1-4112-894323212DAC} (GameDesire Word Games) - http://67.15.101.3/g_bin/pl/words_2_0_0_51.cab
O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C1} (GameDesire Pool 8) - http://67.15.101.3/g_bin/pl/billard8_2_0_0_35.cab
O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C5} (GameDesire Snooker) - http://67.15.101.3/g_bin/pl/snooker_2_0_0_29.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: C-DillaCdaC11BA - C-Dilla Ltd - C:\WINDOWS\system32\drivers\CDAC11BA.EXE
O23 - Service: Crypkey License - Kenonic Controls Ltd. - C:\WINDOWS\SYSTEM32\crypserv.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: MySql - Unknown owner - e:\usr/MYSQL/bin/mysqld.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: SpIDer Guard for Windows NT (spidernt) - ID Anti-Virus Lab - C:\Program Files\DrWeb\SpiderNT.exe
O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - e:\Program Files\Alcohol Soft\Alcohol 52\StarWind\StarWindService.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
O24 - Desktop Component 0: (no name) - file:///E:/Szablom2/img/jhk432afdad11.gif
O24 - Desktop Component 1: (no name) - file:///E:/Moje%20Doki/Kom%F3rka/Darth%20Homer_wallpaper2.gif
O24 - Desktop Component 2: (no name) - file:///E:/___MSTAWICI/img/filetype_video.gif

--
End of file - 8362 bytes

[Red]

Proszę objąć log w tagi i dokładnie opisać problem,inaczej zamknę temat.

[eSpEY]

dlaczego inne logi kazdy sprawdza a mojego nie?!
POMOCY?!

[wojtas]

Wyłącz przywracanie systemu ( właściwości mój komputer-zakładka przywracanie - wyłącz przywracanie na wszystkich dyskach)
Start do awaryjnego ( F8 ) przy starcie komputera.

Użyj WWDC :
http://www.firewallleaktester.com/wwdc.htm
Zmień opcje z disable na enable. Uruchom ponownie komputer.
Tak powinny wyglądać porty (NetBIOS może być żółty) :
http://www.firewallleaktester.com/images_site/wwdc.jpg

O4 - HKLM\..\Run: [Taskmgr32] C:\Windows\system32\GaduGadu.exe
O4 - HKLM\..\Run: [startdrv] C:\WINDOWS\Temp\startdrv.exe

Odpalasz hijackthis i zaznaczasz ptaszkami powyższe wpisy i dajesz Fix checked.
Pogrubione pliki usuwasz ręcznie z dysku (zwroc na lokalizacje plikow)

sciagnij: ATF_Cleaner

http://www.atribune.org/ccount/click.php?id=1
zaznacz
Windows Temp
Temporary internet files
i wcisnij EMPTY SELECTED


potem nowy log z hijacka oraz combofixa

[eSpEY]

mam problem z właściwościami "mój koputer" nie odpala sie
komputer myśli przez dłuższą chwilę i laguje, i w końcu nic... tak jagby coś blokowało to?!

[ Dodano: Dzisiaj o 16:51 ]
ok już nie ctrl+alt+delete kilka nieznanych procesów pousuwanych i wbiło

[ Dodano: Dzisiaj o 17:27 ]
1.

Zmień opcje z disable na enable. Uruchom ponownie komputer.

nic takieg nie było
2.
3. Fix checked obydwa
4.

Pogrubione pliki usuwasz ręcznie z dysku (zwroc na lokalizacje plikow)

GG usunięte lecz tego drugiego nie było?!

5. ATF_Cleaner zrobione
LOGI:

Kod: Zaznacz wszystko

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:05:34, on 2007-09-10
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\drivers\CDAC11BA.EXE
C:\WINDOWS\system32\crypserv.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\snmp.exe
C:\Program Files\DrWeb\SpiderNT.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
e:\Program Files\Alcohol Soft\Alcohol 52\StarWind\StarWindService.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Lexmark 1200 Series\lxczbmgr.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
C:\Program Files\Lexmark 1200 Series\lxczbmon.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\RTHDCPL.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.pl/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O2 - BHO: Flashget Catch Url Class - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\PROGRA~1\FlashGet\jccatch.dll
O2 - BHO: Alcohol Toolbar Helper - {52D06F97-5511-43FA-8FDA-C481864FD26E} - C:\Program Files\Alcohol Toolbar\v3.2.0.0\Alcohol_Toolbar.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O2 - BHO: gFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\Program Files\FlashGet\getflash.dll
O3 - Toolbar: FlashGet - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\Program Files\FlashGet\fgiebar.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O3 - Toolbar: Alcohol Toolbar - {4C4E7CDB-5BFC-4D74-83E2-8AE659B7EDA2} - C:\Program Files\Alcohol Toolbar\v3.2.0.0\Alcohol_Toolbar.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [Lexmark 1200 Series] "C:\Program Files\Lexmark 1200 Series\lxczbmgr.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [NBJ] "C:\Program Files\Ahead\Nero BackItUp\NBJ.exe"
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.908.8472\GoogleToolbarNotifier.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: Ratlerek.lnk = C:\WINDOWS\RTHDCPL.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: &Ściągnij przy pomocy FlashGet'a - C:\PROGRA~1\FlashGet\jc_link.htm
O8 - Extra context menu item: &Ściągnij wszystko przy pomocy FlashGet'a - C:\PROGRA~1\FlashGet\jc_all.htm
O8 - Extra context menu item: Add to AMV Convert Tool... - E:\Program Files\MP3 Player Utilities 4.00\AMVConverter\grab.html
O8 - Extra context menu item: Add to AMV Converter... - E:\Program Files\MP3 Player Utilities 4.09\AMVConverter\grab.html
O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: MediaManager tool grab multimedia file - E:\Program Files\MP3 Player Utilities 4.00\MediaManager\grab.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe
O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {4B4513E2-4E57-43DF-9496-FCD37E9DFA64} (GameDesire Sea Battle) - http://67.15.101.3/g_bin/pl/navy_2_0_0_29.cab
O16 - DPF: {65D72393-E210-4A2A-B8E0-10AC45986770} (GWebInstallControl Object) - http://megapanel.gem.pl/WebInstaller.dll
O16 - DPF: {68282C51-9459-467B-95BF-3C0E89627E55} (MksSkanerOnline Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab
O16 - DPF: {83AFB5CA-ED35-11D4-A452-0080C8D85045} (GameDesire Poker Games) - http://67.15.101.3/g_bin/pl/poker_2_0_0_48.cab
O16 - DPF: {AB8638BB-79E8-4E9D-ABF2-8F33054E3941} (Guesser Class) - http://czat.onet.pl/client/kalambury/NetPunGame1.dll
O16 - DPF: {BFA1F11D-3121-AFE1-4112-894323212DAC} (GameDesire Word Games) - http://67.15.101.3/g_bin/pl/words_2_0_0_51.cab
O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C1} (GameDesire Pool 8) - http://67.15.101.3/g_bin/pl/billard8_2_0_0_35.cab
O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C5} (GameDesire Snooker) - http://67.15.101.3/g_bin/pl/snooker_2_0_0_29.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: C-DillaCdaC11BA - C-Dilla Ltd - C:\WINDOWS\system32\drivers\CDAC11BA.EXE
O23 - Service: Crypkey License - Kenonic Controls Ltd. - C:\WINDOWS\SYSTEM32\crypserv.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: MySql - Unknown owner - e:\usr/MYSQL/bin/mysqld.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: SpIDer Guard for Windows NT (spidernt) - ID Anti-Virus Lab - C:\Program Files\DrWeb\SpiderNT.exe
O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - e:\Program Files\Alcohol Soft\Alcohol 52\StarWind\StarWindService.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
O24 - Desktop Component 0: (no name) - file:///E:/Szablom2/img/jhk432afdad11.gif
O24 - Desktop Component 1: (no name) - file:///E:/Moje%20Doki/Kom%F3rka/Darth%20Homer_wallpaper2.gif
O24 - Desktop Component 2: (no name) - file:///E:/___MSTAWICI/img/filetype_video.gif

--
End of file - 7587 bytes


1.

Zmień opcje z disable na enable. Uruchom ponownie komputer.

nic takieg nie było
2.
3. Fix checked obydwa
4.

Pogrubione pliki usuwasz ręcznie z dysku (zwroc na lokalizacje plikow)

GG usunięte lecz tego drugiego nie było?!

5. ATF_Cleaner zrobione
LOGI:

Kod: Zaznacz wszystko

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:05:34, on 2007-09-10
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\drivers\CDAC11BA.EXE
C:\WINDOWS\system32\crypserv.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\snmp.exe
C:\Program Files\DrWeb\SpiderNT.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
e:\Program Files\Alcohol Soft\Alcohol 52\StarWind\StarWindService.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Lexmark 1200 Series\lxczbmgr.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
C:\Program Files\Lexmark 1200 Series\lxczbmon.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\RTHDCPL.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.pl/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O2 - BHO: Flashget Catch Url Class - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\PROGRA~1\FlashGet\jccatch.dll
O2 - BHO: Alcohol Toolbar Helper - {52D06F97-5511-43FA-8FDA-C481864FD26E} - C:\Program Files\Alcohol Toolbar\v3.2.0.0\Alcohol_Toolbar.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O2 - BHO: gFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\Program Files\FlashGet\getflash.dll
O3 - Toolbar: FlashGet - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\Program Files\FlashGet\fgiebar.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O3 - Toolbar: Alcohol Toolbar - {4C4E7CDB-5BFC-4D74-83E2-8AE659B7EDA2} - C:\Program Files\Alcohol Toolbar\v3.2.0.0\Alcohol_Toolbar.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [Lexmark 1200 Series] "C:\Program Files\Lexmark 1200 Series\lxczbmgr.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [NBJ] "C:\Program Files\Ahead\Nero BackItUp\NBJ.exe"
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.908.8472\GoogleToolbarNotifier.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: Ratlerek.lnk = C:\WINDOWS\RTHDCPL.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: &Ściągnij przy pomocy FlashGet'a - C:\PROGRA~1\FlashGet\jc_link.htm
O8 - Extra context menu item: &Ściągnij wszystko przy pomocy FlashGet'a - C:\PROGRA~1\FlashGet\jc_all.htm
O8 - Extra context menu item: Add to AMV Convert Tool... - E:\Program Files\MP3 Player Utilities 4.00\AMVConverter\grab.html
O8 - Extra context menu item: Add to AMV Converter... - E:\Program Files\MP3 Player Utilities 4.09\AMVConverter\grab.html
O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: MediaManager tool grab multimedia file - E:\Program Files\MP3 Player Utilities 4.00\MediaManager\grab.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe
O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {4B4513E2-4E57-43DF-9496-FCD37E9DFA64} (GameDesire Sea Battle) - http://67.15.101.3/g_bin/pl/navy_2_0_0_29.cab
O16 - DPF: {65D72393-E210-4A2A-B8E0-10AC45986770} (GWebInstallControl Object) - http://megapanel.gem.pl/WebInstaller.dll
O16 - DPF: {68282C51-9459-467B-95BF-3C0E89627E55} (MksSkanerOnline Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab
O16 - DPF: {83AFB5CA-ED35-11D4-A452-0080C8D85045} (GameDesire Poker Games) - http://67.15.101.3/g_bin/pl/poker_2_0_0_48.cab
O16 - DPF: {AB8638BB-79E8-4E9D-ABF2-8F33054E3941} (Guesser Class) - http://czat.onet.pl/client/kalambury/NetPunGame1.dll
O16 - DPF: {BFA1F11D-3121-AFE1-4112-894323212DAC} (GameDesire Word Games) - http://67.15.101.3/g_bin/pl/words_2_0_0_51.cab
O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C1} (GameDesire Pool 8) - http://67.15.101.3/g_bin/pl/billard8_2_0_0_35.cab
O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C5} (GameDesire Snooker) - http://67.15.101.3/g_bin/pl/snooker_2_0_0_29.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: C-DillaCdaC11BA - C-Dilla Ltd - C:\WINDOWS\system32\drivers\CDAC11BA.EXE
O23 - Service: Crypkey License - Kenonic Controls Ltd. - C:\WINDOWS\SYSTEM32\crypserv.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: MySql - Unknown owner - e:\usr/MYSQL/bin/mysqld.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: SpIDer Guard for Windows NT (spidernt) - ID Anti-Virus Lab - C:\Program Files\DrWeb\SpiderNT.exe
O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - e:\Program Files\Alcohol Soft\Alcohol 52\StarWind\StarWindService.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
O24 - Desktop Component 0: (no name) - file:///E:/Szablom2/img/jhk432afdad11.gif
O24 - Desktop Component 1: (no name) - file:///E:/Moje%20Doki/Kom%F3rka/Darth%20Homer_wallpaper2.gif
O24 - Desktop Component 2: (no name) - file:///E:/___MSTAWICI/img/filetype_video.gif

--
End of file - 7587 bytes


Kod: Zaznacz wszystko

ComboFix 07-09-10.6 - "Admin" 2007-09-10 18:13:14.1 - NTFSx86
Microsoft Windows XP Professional  5.1.2600.2.1250.1.1045.18.168 [GMT 2:00]
* Created a new restore point
.

(((((((((((((((((((((((((((((((((((((((   Other Deletions   )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\DOCUME~1\Admin\Pulpit\internet.lnk
C:\F.tmp
C:\WINDOWS\hosts
C:\WINDOWS\system32\8_exception.nls
C:\WINDOWS\system32\drivers\ip6fw.sys
C:\WINDOWS\system32\drivers\smtpdrv.sys
C:\WINDOWS\system32\svch4ju.dll
C:\WINDOWS\system32\systnc4.dll
C:\WINDOWS\system32\tmp_c4.exe
C:\WINDOWS\system32\win_4.exe
C:\WINDOWS\system32\win_wyi.exe
C:\WINDOWS\system32\win_y.exe


(((((((((((((((((((((((((((((((((((((((   Drivers/Services   )))))))))))))))))))))))))))))))))))))))))))))))))


-------\LEGACY_RUNTIME
-------\LEGACY_RUNTIME2
-------\LEGACY_SMTPDRV
-------\smtpdrv


(((((((((((((((((((((((((   Files Created from 2007-08-10 to 2007-09-10  )))))))))))))))))))))))))))))))
.

2007-09-10 17:46   51,200   --a------   C:\WINDOWS\NirCmd.exe
2007-09-09 16:17   <DIR>   d--------   C:\DOCUME~1\Admin\DANEAP~1\Tlen.pl
2007-09-07 14:59   <DIR>   d--------   C:\Program Files\SkanerOnline
2007-09-07 14:58   <DIR>   d--------   C:\Program Files\Trend Micro
2007-09-07 14:13   5,200   --a------   C:\WINDOWS\system32\drivers\drwebnet.sys
2007-09-07 14:13   <DIR>   d--------   C:\Program Files\DrWeb
2007-09-07 14:07   4,096   -rah-----   C:\WINDOWS\system32\svchbs.dll
2007-09-07 14:04   4,096   -rah-----   C:\WINDOWS\system32\svch1.dll
2007-09-06 20:19   16,954   -r-h-----   C:\WINDOWS\system32\svch73w.exe
2007-09-06 20:00   4,096   -rah-----   C:\WINDOWS\system32\svchn5.dll
2007-09-06 19:55   <DIR>   d--------   C:\DOCUME~1\LOCALS~1\Pulpit
2007-08-14 19:17   <DIR>   d--------   C:\Program Files\sXe Injected
2007-08-14 11:54   <DIR>   d--------   C:\Program Files\Microsoft Games
2007-08-11 22:56   4   --a------   C:\Program Files\2007-08-11 22_55.gps.bin
2007-08-11 22:54   <DIR>   d--------   C:\Program Files\AutoMapa EU

.
((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-09-10 18:16   ---------   d--------   C:\Program Files\FlashGet
2007-09-10 11:10   ---------   d--------   C:\Program Files\eMule
2007-09-07 19:31   ---------   d--------   C:\DOCUME~1\Admin\DANEAP~1\Draco Organizer
2007-09-07 14:12   ---------   d--------   C:\Program Files\kswiat
2007-09-01 10:00   ---------   d--------   C:\Program Files\EACOM
2007-08-13 20:20   43520   --a------   C:\WINDOWS\system32\CmdLineExt03.dll
2007-08-11 22:56   0   --a------   C:\Program Files\2007-08-11 22_55.gps
2007-08-11 21:14   ---------   d--------   C:\Program Files\Gadu-Gadu
2007-08-10 12:10   ---------   d--h-----   C:\Program Files\InstallShield Installation Information
2007-08-07 18:04   ---------   d--------   C:\DOCUME~1\Admin\DANEAP~1\GanymedeNet
2007-08-06 21:27   ---------   d--------   C:\Program Files\Common Files\NSV
2007-08-06 14:49   ---------   d--------   C:\Program Files\Lexmark 1200 Series
2007-08-06 14:43   8864   --a------   C:\WINDOWS\system32\drivers\CDAC15BA.SYS
2007-08-06 14:41   39936   --a------   C:\WINDOWS\system32\drivers\CDAC11BA.EXE
2007-08-06 14:41   ---------   d--------   C:\Program Files\ABBYY FineReader 6.0
2007-08-06 14:41   ---------   d--------   C:\DOCUME~1\Admin\DANEAP~1\ABBYY
2007-08-06 14:29   ---------   d--------   C:\Program Files\ABBYY FineReader 5.0 Sprint
2007-08-06 14:28   ---------   d--------   C:\Program Files\FaxTools
2007-08-06 14:28   ---------   d--------   C:\DOCUME~1\ALLUSE~1\DANEAP~1\BVRP Software
2007-08-05 20:17   ---------   d--------   C:\Program Files\Maxis
2007-08-04 16:57   ---------   d--------   C:\Program Files\Autobus
2007-07-18 09:20   ---------   d--------   C:\Program Files\Opera
2007-07-17 19:44   ---------   d--------   C:\DOCUME~1\Admin\DANEAP~1\Avant Profiles
.

(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
.

*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2005-06-15 11:20]
"nwiz"="nwiz.exe" [2005-06-15 11:20 C:\WINDOWS\system32\nwiz.exe]
"ZoneAlarm Client"="C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [2007-03-09 00:02]
"Lexmark 1200 Series"="C:\Program Files\Lexmark 1200 Series\lxczbmgr.exe" [2006-07-13 07:33]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe" [2007-03-14 03:43]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:44]
"NBJ"="C:\Program Files\Ahead\Nero BackItUp\NBJ.exe" [2005-08-09 14:28]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\1.2.908.8472\GoogleToolbarNotifier.exe" []

C:\DOCUME~1\ALLUSE~1\MENUST~1\Programy\AUTOST~1\
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 11:01:04]

C:\DOCUME~1\Admin\MENUST~1\Programy\AUTOST~1\
Ratlerek.lnk - C:\WINDOWS\RTHDCPL.exe [2006-11-08 23:51:22]

R1 drwebnet;SpIDer Guard boot hook driver for Windows NT;C:\WINDOWS\system32\drivers\drwebnet.sys
R2 SPIDER;SpIDer FS Monitor for Windows NT;\??\C:\Program Files\DrWeb\spider.sys
R2 spidernt;SpIDer Guard for Windows NT;C:\Program Files\DrWeb\SpiderNT.exe
R2 Vcs;Vcs support;\??\C:\WINDOWS\system32\Drivers\Vcs.sys
S3 ddsxeiservice;ddsxeiservice;\??\C:\Program Files\sXe Injected\ddsxei.sys
S3 GVCplDrv;GVCplDrv;C:\WINDOWS\system32\drivers\GVCplDrv.sys
S3 MSIRCOMM;Microsoft IR Communications Driver;C:\WINDOWS\system32\DRIVERS\MSIRCOMM.sys
S3 PID_0920;Logitech QuickCam Express(PID_0920);C:\WINDOWS\system32\DRIVERS\LV532AV.SYS
S3 RivaTuner32;RivaTuner32;\??\e:\Program Files\RivaTuner v2.01\RivaTuner32.sys

.
**************************************************************************

catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-09-10 18:19:45
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-09-10 18:21:35 - machine was rebooted
C:\ComboFix-quarantined-files.txt ... 2007-09-10 18:21
.
   --- E O F ---



[wojtas]

nic takieg nie było

kliknij na czerwone i zolty raz myszka i zrob reset powinno byc na zielono wszystko

sciagnij killbox’a

Odpalasz Killboxa zaznacz opcję Delete on Reboot następnie w polu Full Path of File to Delete wklej ścieżki

C:\WINDOWS\system32\svchbs.dll
C:\WINDOWS\system32\svch1.dll
C:\WINDOWS\system32\svch73w.exe
C:\WINDOWS\system32\svchn5.dll

i nacisnij x
Program będzie pytał o restart (oczywiście zgadzasz się)

[eSpEY]

następnie w polu Full Path of File to Delete wklej ścieżki

można tylko jedną!?
to pojedyńczo?

[ Dodano: Dzisiaj o 18:09 ]
aha
'x' nic nie daje

[wojtas]

Pobierz i uruchom narzędzie
The Avenger
Zaznacz opcję Input script manually i kliknij na Lupkę z prawej strony. W okienku, które się otworzy wklejasz:

Files to delete:

C:\WINDOWS\system32\svchbs.dll
C:\WINDOWS\system32\svch1.dll
C:\WINDOWS\system32\svch73w.exe
C:\WINDOWS\system32\svchn5.dll

Klikasz Done, a następnie zielone światełko i zgadzasz się na restart klikając OK.

Kasujesz ręcznie z dysku plik: C:\Avenger\backup.zip i wklejasz na forum raport: C:\avenger.txt + log z combofixa

[eSpEY]

error: Selected files does not appear to be vaild script
?

[ Dodano: Dzisiaj o 19:08 ]
a czy moge zrobić plik txt i zaladować go jako sktypt (opcja pierwsza)?!

[wojtas]

sciagnij gmera:

http://gmer.net/gmer.zip

Wklej do notatnika

gmer -del file C:\WINDOWS\system32\svchn5.dll
gmer -del file C:\WINDOWS\system32\svch73w.exe
gmer -del file C:\WINDOWS\system32\svch1.dll
gmer -del file C:\WINDOWS\system32\svchbs.dll
gmer –reboot

Plik >>> zapisz jako >>> zmien rozszerzenie z TXT na wszystkie typy plików >>> zapisz pod nazwa FIX.BAT


Uruchamiasz Gmera, w zakładce Procesy wybierasz opcje Gmer Awaryjny. Komputer się zresetuje i uruchomi się Gmer. Wybierasz znów zakładke Procesy i na dole w poleceniu przez trzy kropki wskaz plik FIX.BAT i go uruchom.

potem nowy log

[eSpEY]

Błąd przy kasowaniu się pojawia

[ Dodano: Dzisiaj o 15:15 ]
wiem w czym problem był w Avangerze:

Kod: Zaznacz wszystko

Files to delete: // dwukropka brak!!!

C:\WINDOWS\system32\svchbs.dll
C:\WINDOWS\system32\svch1.dll
C:\WINDOWS\system32\svch73w.exe
C:\WINDOWS\system32\svchn5.dll

thx juzr robue logi zaraz wysle

[ Dodano: Dzisiaj o 15:22 ]
AWANGER:

Kod: Zaznacz wszystko

Logfile of The Avenger version 1, by Swandog46
Running from registry key:
\Registry\Machine\System\CurrentControlSet\Services\vxahddxv

*******************

Script file located at: \??\C:\WINDOWS\system32\ajoprhfn.txt
Script file opened successfully.

Script file read successfully

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:



File C:\WINDOWS\system32\svchbs.dll not found!
Deletion of file C:\WINDOWS\system32\svchbs.dll failed!

Could not process line:
C:\WINDOWS\system32\svchbs.dll
Status: 0xc0000034



File C:\WINDOWS\system32\svch1.dll not found!
Deletion of file C:\WINDOWS\system32\svch1.dll failed!

Could not process line:
C:\WINDOWS\system32\svch1.dll
Status: 0xc0000034



File C:\WINDOWS\system32\svch73w.exe not found!
Deletion of file C:\WINDOWS\system32\svch73w.exe failed!

Could not process line:
C:\WINDOWS\system32\svch73w.exe
Status: 0xc0000034



File C:\WINDOWS\system32\svchn5.dll not found!
Deletion of file C:\WINDOWS\system32\svchn5.dll failed!

Could not process line:
C:\WINDOWS\system32\svchn5.dll
Status: 0xc0000034


Completed script processing.

*******************

Finished!  Terminate.

Hjt:

Kod: Zaznacz wszystko

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 16:14:19, on 2007-09-11
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\Explorer.EXE
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Lexmark 1200 Series\lxczbmgr.exe
C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
C:\Program Files\Lexmark 1200 Series\lxczbmon.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\drivers\CDAC11BA.EXE
C:\WINDOWS\system32\crypserv.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\RTHDCPL.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\snmp.exe
C:\Program Files\DrWeb\SpiderNT.exe
e:\Program Files\Alcohol Soft\Alcohol 52\StarWind\StarWindService.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
E:\Program Files\Avant Browser\avant.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.pl/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O2 - BHO: Flashget Catch Url Class - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\PROGRA~1\FlashGet\jccatch.dll
O2 - BHO: Alcohol Toolbar Helper - {52D06F97-5511-43FA-8FDA-C481864FD26E} - C:\Program Files\Alcohol Toolbar\v3.2.0.0\Alcohol_Toolbar.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O2 - BHO: gFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\Program Files\FlashGet\getflash.dll
O3 - Toolbar: FlashGet - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\Program Files\FlashGet\fgiebar.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O3 - Toolbar: Alcohol Toolbar - {4C4E7CDB-5BFC-4D74-83E2-8AE659B7EDA2} - C:\Program Files\Alcohol Toolbar\v3.2.0.0\Alcohol_Toolbar.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [Lexmark 1200 Series] "C:\Program Files\Lexmark 1200 Series\lxczbmgr.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [NBJ] "C:\Program Files\Ahead\Nero BackItUp\NBJ.exe"
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.908.8472\GoogleToolbarNotifier.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: Ratlerek.lnk = C:\WINDOWS\RTHDCPL.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: &Ściągnij przy pomocy FlashGet'a - C:\PROGRA~1\FlashGet\jc_link.htm
O8 - Extra context menu item: &Ściągnij wszystko przy pomocy FlashGet'a - C:\PROGRA~1\FlashGet\jc_all.htm
O8 - Extra context menu item: Add to AMV Convert Tool... - E:\Program Files\MP3 Player Utilities 4.00\AMVConverter\grab.html
O8 - Extra context menu item: Add to AMV Converter... - E:\Program Files\MP3 Player Utilities 4.09\AMVConverter\grab.html
O8 - Extra context menu item: Blokuj wszystkie obrazy z tego serwera - E:\Program Files\Avant Browser\AddAllToADBlackList.htm
O8 - Extra context menu item: Dodaj do listy blokowanych reklam - E:\Program Files\Avant Browser\AddToADBlackList.htm
O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: MediaManager tool grab multimedia file - E:\Program Files\MP3 Player Utilities 4.00\MediaManager\grab.html
O8 - Extra context menu item: Otwórz w nowym Avant Browser - E:\Program Files\Avant Browser\OpenInNewBrowser.htm
O8 - Extra context menu item: Otwórz wszystkie adresy z tej strony... - E:\Program Files\Avant Browser\OpenAllLinks.htm
O8 - Extra context menu item: Podświetl - E:\Program Files\Avant Browser\Highlight.htm
O8 - Extra context menu item: Szukaj - E:\Program Files\Avant Browser\Search.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe
O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {4B4513E2-4E57-43DF-9496-FCD37E9DFA64} (GameDesire Sea Battle) - http://67.15.101.3/g_bin/pl/navy_2_0_0_29.cab
O16 - DPF: {65D72393-E210-4A2A-B8E0-10AC45986770} (GWebInstallControl Object) - http://megapanel.gem.pl/WebInstaller.dll
O16 - DPF: {68282C51-9459-467B-95BF-3C0E89627E55} (MksSkanerOnline Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab
O16 - DPF: {83AFB5CA-ED35-11D4-A452-0080C8D85045} (GameDesire Poker Games) - http://67.15.101.3/g_bin/pl/poker_2_0_0_48.cab
O16 - DPF: {AB8638BB-79E8-4E9D-ABF2-8F33054E3941} (Guesser Class) - http://czat.onet.pl/client/kalambury/NetPunGame1.dll
O16 - DPF: {BFA1F11D-3121-AFE1-4112-894323212DAC} (GameDesire Word Games) - http://67.15.101.3/g_bin/pl/words_2_0_0_51.cab
O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C1} (GameDesire Pool 8) - http://67.15.101.3/g_bin/pl/billard8_2_0_0_35.cab
O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C5} (GameDesire Snooker) - http://67.15.101.3/g_bin/pl/snooker_2_0_0_29.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: C-DillaCdaC11BA - C-Dilla Ltd - C:\WINDOWS\system32\drivers\CDAC11BA.EXE
O23 - Service: Crypkey License - Kenonic Controls Ltd. - C:\WINDOWS\SYSTEM32\crypserv.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: MySql - Unknown owner - e:\usr/MYSQL/bin/mysqld.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: SpIDer Guard for Windows NT (spidernt) - ID Anti-Virus Lab - C:\Program Files\DrWeb\SpiderNT.exe
O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - e:\Program Files\Alcohol Soft\Alcohol 52\StarWind\StarWindService.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
O24 - Desktop Component 0: (no name) - file:///E:/Szablom2/img/jhk432afdad11.gif
O24 - Desktop Component 1: (no name) - file:///E:/Moje%20Doki/Kom%F3rka/Darth%20Homer_wallpaper2.gif
O24 - Desktop Component 2: (no name) - file:///E:/___MSTAWICI/img/filetype_video.gif

--
End of file - 8474 bytes


combofix:

Kod: Zaznacz wszystko

ComboFix 07-09-10.6 - "Admin" 2007-09-11 16:15:42.2 - NTFSx86
Microsoft Windows XP Professional  5.1.2600.2.1250.1.1045.18.223 [GMT 2:00]
.

(((((((((((((((((((((((((   Files Created from 2007-08-11 to 2007-09-11  )))))))))))))))))))))))))))))))
.

2007-09-11 15:34   <DIR>   d--------   C:\Program Files\Common Files\Macrovision Shared
2007-09-10 19:03   <DIR>   d--------   C:\!KillBox
2007-09-10 17:46   51,200   --a------   C:\WINDOWS\NirCmd.exe
2007-09-09 16:17   <DIR>   d--------   C:\DOCUME~1\Admin\DANEAP~1\Tlen.pl
2007-09-07 14:59   <DIR>   d--------   C:\Program Files\SkanerOnline
2007-09-07 14:58   <DIR>   d--------   C:\Program Files\Trend Micro
2007-09-07 14:13   5,200   --a------   C:\WINDOWS\system32\drivers\drwebnet.sys
2007-09-07 14:13   <DIR>   d--------   C:\Program Files\DrWeb
2007-09-06 19:55   <DIR>   d--------   C:\DOCUME~1\LOCALS~1\Pulpit
2007-08-14 19:17   <DIR>   d--------   C:\Program Files\sXe Injected
2007-08-14 11:54   <DIR>   d--------   C:\Program Files\Microsoft Games
2007-08-11 22:56   4   --a------   C:\Program Files\2007-08-11 22_55.gps.bin
2007-08-11 22:54   <DIR>   d--------   C:\Program Files\AutoMapa EU

.
((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-09-11 16:08   ---------   d--------   C:\Program Files\FlashGet
2007-09-11 15:49   ---------   d--------   C:\DOCUME~1\Admin\DANEAP~1\Draco Organizer
2007-09-10 11:10   ---------   d--------   C:\Program Files\eMule
2007-09-07 14:12   ---------   d--------   C:\Program Files\kswiat
2007-09-01 10:00   ---------   d--------   C:\Program Files\EACOM
2007-08-13 20:20   43520   --a------   C:\WINDOWS\system32\CmdLineExt03.dll
2007-08-11 22:56   0   --a------   C:\Program Files\2007-08-11 22_55.gps
2007-08-11 21:14   ---------   d--------   C:\Program Files\Gadu-Gadu
2007-08-10 12:10   ---------   d--h-----   C:\Program Files\InstallShield Installation Information
2007-08-07 18:04   ---------   d--------   C:\DOCUME~1\Admin\DANEAP~1\GanymedeNet
2007-08-06 21:27   ---------   d--------   C:\Program Files\Common Files\NSV
2007-08-06 14:49   ---------   d--------   C:\Program Files\Lexmark 1200 Series
2007-08-06 14:43   8864   --a------   C:\WINDOWS\system32\drivers\CDAC15BA.SYS
2007-08-06 14:41   39936   --a------   C:\WINDOWS\system32\drivers\CDAC11BA.EXE
2007-08-06 14:41   ---------   d--------   C:\Program Files\ABBYY FineReader 6.0
2007-08-06 14:41   ---------   d--------   C:\DOCUME~1\Admin\DANEAP~1\ABBYY
2007-08-06 14:29   ---------   d--------   C:\Program Files\ABBYY FineReader 5.0 Sprint
2007-08-06 14:28   ---------   d--------   C:\Program Files\FaxTools
2007-08-06 14:28   ---------   d--------   C:\DOCUME~1\ALLUSE~1\DANEAP~1\BVRP Software
2007-08-05 20:17   ---------   d--------   C:\Program Files\Maxis
2007-08-04 16:57   ---------   d--------   C:\Program Files\Autobus
2007-07-18 09:20   ---------   d--------   C:\Program Files\Opera
2007-07-17 19:44   ---------   d--------   C:\DOCUME~1\Admin\DANEAP~1\Avant Profiles
.

(((((((((((((((((((((((((((((   snapshot_2007-09-10_182104.75   )))))))))))))))))))))))))))))))))))))))))
.
----a-w           585,791 2007-09-11 13:51:17  C:\WINDOWS\gmer.dll
----a-r           581,632 2007-06-29 07:38:18  C:\WINDOWS\gmer.exe
-c----w         2,804,224 2004-08-03 22:44:06  C:\WINDOWS\$MSI31Uninstall_KB893803v2$\msi.dll
-c----w            77,312 2004-08-03 22:44:24  C:\WINDOWS\$MSI31Uninstall_KB893803v2$\msiexec.exe
-c----w           331,264 2004-08-03 22:44:06  C:\WINDOWS\$MSI31Uninstall_KB893803v2$\msihnd.dll
-c----w           884,736 2004-08-03 22:43:08  C:\WINDOWS\$MSI31Uninstall_KB893803v2$\msimsg.dll
-c----w            44,032 2004-08-03 22:44:06  C:\WINDOWS\$MSI31Uninstall_KB893803v2$\msisip.dll
-c----w           212,704 2005-05-04 12:45:28  C:\WINDOWS\$MSI31Uninstall_KB893803v2$\spuninst\spuninst.exe
-c----w           387,296 2005-05-04 12:45:28  C:\WINDOWS\$MSI31Uninstall_KB893803v2$\spuninst\updspapi.dll
----a-w         2,890,240 2005-05-04 12:45:32  C:\WINDOWS\system32\msi.dll
----a-w            78,848 2005-05-04 12:45:36  C:\WINDOWS\system32\msiexec.exe
----a-w           271,360 2005-05-04 12:45:36  C:\WINDOWS\system32\msihnd.dll
----a-w           884,736 2005-05-04 12:45:36  C:\WINDOWS\system32\msimsg.dll
----a-w            15,360 2005-05-04 12:45:36  C:\WINDOWS\system32\msisip.dll
------w            15,584 2005-05-04 12:45:28  C:\WINDOWS\system32\spmsg.dll
---h--w             4,212 2007-09-11 14:11:21  C:\WINDOWS\system32\zllictbl.dat
-c--a-w         2,890,240 2005-05-04 12:45:32  C:\WINDOWS\system32\dllcache\msi.dll
-c--a-w            78,848 2005-05-04 12:45:36  C:\WINDOWS\system32\dllcache\msiexec.exe
-c--a-w           271,360 2005-05-04 12:45:36  C:\WINDOWS\system32\dllcache\msihnd.dll
-c--a-w           884,736 2005-05-04 12:45:36  C:\WINDOWS\system32\dllcache\msimsg.dll
-c--a-w            15,360 2005-05-04 12:45:36  C:\WINDOWS\system32\dllcache\msisip.dll
----a-w            70,001 2007-09-11 13:51:17  C:\WINDOWS\system32\drivers\gmer.sys
----atw            16,384 2007-09-10 16:37:34  C:\WINDOWS\Temp\Perflib_Perfdata_3f4.dat
----atw            16,384 2007-09-11 14:02:30  C:\WINDOWS\Temp\Perflib_Perfdata_5ec.dat
----atw            16,384 2007-09-11 04:53:31  C:\WINDOWS\Temp\Perflib_Perfdata_6f0.dat
----atw            16,384 2007-09-11 13:14:34  C:\WINDOWS\Temp\Perflib_Perfdata_70c.dat
----atw            16,384 2007-09-11 13:47:06  C:\WINDOWS\Temp\Perflib_Perfdata_7b4.dat
----a-w            40,960 2007-09-11 14:10:51  C:\WINDOWS\Temp\rtdrvmon.exe
----a-w           479,232 2006-06-05 12:14:28  C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.163_x-ww_681e29fb\msvcm80.dll
----a-w           548,864 2006-06-05 12:14:28  C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.163_x-ww_681e29fb\msvcp80.dll
----a-w           626,688 2006-06-05 12:14:28  C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.163_x-ww_681e29fb\msvcr80.dll
.
----a-w         2,804,224 2004-08-03 22:44:06  C:\WINDOWS\system32\msi.dll
----a-w            77,312 2004-08-03 22:44:24  C:\WINDOWS\system32\msiexec.exe
----a-w           331,264 2004-08-03 22:44:06  C:\WINDOWS\system32\msihnd.dll
----a-w           884,736 2004-08-03 22:43:08  C:\WINDOWS\system32\msimsg.dll
----a-w            44,032 2004-08-03 22:44:06  C:\WINDOWS\system32\msisip.dll
---h--w             4,212 2007-09-10 16:19:13  C:\WINDOWS\system32\zllictbl.dat
-c--a-w         2,804,224 2004-08-03 22:44:06  C:\WINDOWS\system32\dllcache\msi.dll
-c--a-w            77,312 2004-08-03 22:44:24  C:\WINDOWS\system32\dllcache\msiexec.exe
-c--a-w           331,264 2004-08-03 22:44:06  C:\WINDOWS\system32\dllcache\msihnd.dll
-c--a-w           884,736 2004-08-03 22:43:08  C:\WINDOWS\system32\dllcache\msimsg.dll
-c--a-w            44,032 2004-08-03 22:44:06  C:\WINDOWS\system32\dllcache\msisip.dll
----atw            16,384 2006-12-22 10:22:27  C:\WINDOWS\Temp\Perflib_Perfdata_5ec.dat
----atw            16,384 2007-04-25 06:32:16  C:\WINDOWS\Temp\Perflib_Perfdata_70c.dat
----atw            16,384 2006-12-28 16:13:46  C:\WINDOWS\Temp\Perflib_Perfdata_7b4.dat
----a-w            40,960 2007-09-10 16:19:01  C:\WINDOWS\Temp\rtdrvmon.exe
.
(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
.

*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2005-06-15 11:20]
"nwiz"="nwiz.exe" [2005-06-15 11:20 C:\WINDOWS\system32\nwiz.exe]
"ZoneAlarm Client"="C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [2007-03-09 00:02]
"Lexmark 1200 Series"="C:\Program Files\Lexmark 1200 Series\lxczbmgr.exe" [2006-07-13 07:33]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe" [2007-03-14 03:43]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:44]
"NBJ"="C:\Program Files\Ahead\Nero BackItUp\NBJ.exe" [2005-08-09 14:28]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\1.2.908.8472\GoogleToolbarNotifier.exe" []

C:\DOCUME~1\ALLUSE~1\MENUST~1\Programy\AUTOST~1\
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 11:01:04]

C:\DOCUME~1\Admin\MENUST~1\Programy\AUTOST~1\
Ratlerek.lnk - C:\WINDOWS\RTHDCPL.exe [2006-11-08 23:51:22]

R1 drwebnet;SpIDer Guard boot hook driver for Windows NT;C:\WINDOWS\system32\drivers\drwebnet.sys
R2 SPIDER;SpIDer FS Monitor for Windows NT;\??\C:\Program Files\DrWeb\spider.sys
R2 spidernt;SpIDer Guard for Windows NT;C:\Program Files\DrWeb\SpiderNT.exe
R2 Vcs;Vcs support;\??\C:\WINDOWS\system32\Drivers\Vcs.sys
S3 GVCplDrv;GVCplDrv;C:\WINDOWS\system32\drivers\GVCplDrv.sys
S3 MSIRCOMM;Microsoft IR Communications Driver;C:\WINDOWS\system32\DRIVERS\MSIRCOMM.sys
S3 PID_0920;Logitech QuickCam Express(PID_0920);C:\WINDOWS\system32\DRIVERS\LV532AV.SYS
S3 RivaTuner32;RivaTuner32;\??\e:\Program Files\RivaTuner v2.01\RivaTuner32.sys

.
**************************************************************************

catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-09-11 16:18:38
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-09-11 16:19:49
C:\ComboFix-quarantined-files.txt ... 2007-09-11 16:19
C:\ComboFix2.txt ... 2007-09-10 18:21
.
   --- E O F ---


[wojtas]

sciagnij: ATF_Cleaner

http://www.atribune.org/ccount/click.php?id=1
zaznacz
Windows Temp
Temporary internet files
i wcisnij EMPTY SELECTED

[eSpEY]

sciagnij: ATF_Cleaner

http://www.atribune.org/ccount/click.php?id=1
zaznacz
Windows Temp
Temporary internet files
i wcisnij EMPTY SELECTED

Już to pisałeś więc mam ATF CLEANER'a

uisunięte
...

[wojtas]

no to powinno byc ok ...

Autor postu otrzymał pochwałę

[eSpEY]

dziękx widze różnicę.... mogę kożystac gg bez zawiechy thx...