Pulpit - prosze o sprawdzenie loga

[CrossFire]

Otóż mam problem z pulpitem nie mogę nic na nim zaznaczyć i ikonki mi zniknęły znaczy są ale ich nie widać jedynie w moim komputerze wiec kazano mi dac loga do sprawdzenia dziękuje

Wstawiam to pierwszy raz i za bardzo nie wiem ocb z tymi logami ale ok

Kod: Zaznacz wszystko

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 01:04:19, on 2008-08-31
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\WINDOWS\system32\temp1.exe
C:\Program Files\Common Files\Teleca Shared\CapabilityManager.exe
C:\Program Files\DAEMON Tools Pro\DTProAgent.exe
C:\Program Files\RocketDock\RocketDock.exe
C:\Program Files\Stardock\CursorFX\CursorFX.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Hamachi\hamachi.exe
C:\Program Files\Xfire\xfire.exe
C:\Program Files\Common Files\Teleca Shared\Generic.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Sony Ericsson\Mobile2\Mobile Phone Monitor\epmworker.exe
C:\Program Files\NVIDIA Corporation\nTune\nTuneService.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Internet Download Manager\IEMonitor.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\WINDOWS\System32\svchost.exe
c:\program files\Mozilla Firefox\firefox.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Winamp\winamp.exe
C:\Program Files\Gadu-Gadu\gg.exe
C:\Program Files\Winamp\winamp.exe
C:\WINDOWS\system32\PnkBstrA.exe
E:\Nowy folder\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.pl/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = wmplayer.exe //ICWLaunch
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
F3 - REG:win.ini: load=C:\WINDOWS\svchost.exe
O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Program Files\Internet Download Manager\IDMIECC.dll
O2 - BHO: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files\HP\Smart Web Printing\hpswp_printenhancer.dll
O2 - BHO: HP Print Clips - {053F9267-DC04-4294-A72C-58F732D338C0} - C:\Program Files\HP\Smart Web Printing\hpswp_framework.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - D:\Program Files\BitComet\tools\BitCometBHO_1.2.2.28.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: Rmn plugin - {7FED228E-A6F7-49aa-A0BC-76E0A67C53BB} - drweb32.dll (file missing)
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [NVIDIA nTune] "C:\Program Files\NVIDIA Corporation\nTune\nTuneCmd.exe" clear
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [Gainward] C:\WINDOWS\TBPanel.exe /A
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
O4 - HKLM\..\Run: [AGEIA PhysX SysTray] C:\Program Files\AGEIA Technologies\TrayIcon.exe
O4 - HKLM\..\Run: [Sony Ericsson PC Suite] "C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [AlcWzrd] ALCWZRD.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKCU\..\Run: [DAEMON Tools Pro Agent] "C:\Program Files\DAEMON Tools Pro\DTProAgent.exe"
O4 - HKCU\..\Run: [RocketDock] "C:\Program Files\RocketDock\RocketDock.exe"
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [BitComet] "D:\Program Files\BitComet\BitComet.exe" /tray
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [IDMan] C:\Program Files\Internet Download Manager\IDMan.exe /onboot
O4 - HKCU\..\Run: [Konnekt_6b95416a_CrossFire] "C:\Program Files\Konnekt\konnekt.exe" /autostart -profile=?
O4 - HKCU\..\Run: [Komunikator] C:\Program Files\Tlen.pl\tlen.exe
O4 - HKCU\..\Run: [CursorFX] "C:\Program Files\Stardock\CursorFX\CursorFX.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [SIDEBAR] "C:\Program Files\Desktop Sidebar\dsidebar.exe"
O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Startup: hamachi.lnk = C:\Program Files\Hamachi\hamachi.exe
O4 - Startup: Xfire.lnk = C:\Program Files\Xfire\xfire.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O8 - Extra context menu item: &D&ownload &with BitComet - res://D:\Program Files\BitComet\BitComet.exe/AddLink.htm
O8 - Extra context menu item: &D&ownload all video with BitComet - res://D:\Program Files\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: &D&ownload all with BitComet - res://D:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
O8 - Extra context menu item: E&ksportuj do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Ściągnij przez IDM - C:\Program Files\Internet Download Manager\IEExt.htm
O8 - Extra context menu item: Ściągnij wszystkie linki przez IDM - C:\Program Files\Internet Download Manager\IEGetAll.htm
O8 - Extra context menu item: Ściągnij zawartość wideo FLV przez IDM - C:\Program Files\Internet Download Manager\IEGetVL.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Wyślij do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Wyślij &do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Kolekcja wycinków HP - {58ECB495-38F0-49cb-A538-10282ABF65E7} - C:\Program Files\HP\Smart Web Printing\hpswp_extensions.dll
O9 - Extra button: Zaznaczanie HP Smart - {700259D7-1666-479a-93B1-3250410481E8} - C:\Program Files\HP\Smart Web Printing\hpswp_extensions.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://D:\Program Files\BitComet\tools\BitCometBHO_1.2.2.28.dll/206 (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{EB844C08-EAC7-4403-8A39-83B8949B0C9D}: NameServer = 217.30.129.149,217.30.137.200
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: Microsoft security update service (msupdate) - Unknown owner - c:\windows\system32\mssrv32.exe
O23 - Service: nTune Service (nTuneService) - NVIDIA - C:\Program Files\NVIDIA Corporation\nTune\nTuneService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: PnkBstrB - Unknown owner - C:\WINDOWS\system32\PnkBstrB.exe
O23 - Service: StyleXPService - Unknown owner - C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe (file missing)

--
End of file - 9552 bytes

to chyba coś takiego

[Okocza]

Kod: Zaznacz wszystko

F3 - REG:win.ini: load=C:\WINDOWS\svchost.exe
O2 - BHO: Rmn plugin - {7FED228E-A6F7-49aa-A0BC-76E0A67C53BB} - drweb32.dll (file missing)

to sobie możesz sfixować, zastosuj combofixa jeszcze i daj z niego loga

[wojtas]

Wykonaj to co jest podane w tym temacie

Zastosuj SDFix . Po pobraniu uruchom go a rozpakuje się do C:\SDFix. Uruchom komputer w trybie awaryjnym (F8 przy stracie systemu). Będąc w awaryjnym uruchom plik RunThis.bat z folderu SDFixa. Zatwierdź czyszczenie przez Y. Poczekaj aż ukończy i komputer zresetuje

Potem wejdz do folderu C:\SDFix wrzuc zawartość pliku Report.txt + log z combofixa oraz daj loga z hijacka

Autor postu otrzymał pochwałę

[Emtec]

Pomoże ktoś ? Dziwny wygląd pulpitu .. jak to zmienić ?

[wojtas]

Emtec, załoz swoj temat i wstaw logi z combofixa i hijacka...

[Emtec]

to na nic , przy instalacji te same znaczki , nawet nie będe wiedział co i gdzie kliknać

[CrossFire]

No to tak o nie wiem czy dobrze zrobilem ale jest

SDFix :

Kod: Zaznacz wszystko

[b]SDFix: Version 1.220 [/b]
Run by Administrator on 2008-08-31 at 14:48

Microsoft Windows XP [Wersja 5.1.2600]
Running From: C:\SDFix

[b]Checking Services [/b]:

[b]Name [/b]:
msupdate

[b]Path [/b]:
c:\windows\system32\mssrv32.exe

msupdate - Deleted



Restoring Default Security Values
Restoring Default Hosts File

Rebooting


[b]Checking Files [/b]:

Trojan Files Found:

C:\WINDOWS\SYSTEM32\DRWEB32.DLL - Deleted
C:\WINDOWS\SYSTEM32\NOD32.DLL - Deleted
C:\WINDOWS\autorun.inf  - Deleted
C:\WINDOWS\svchost.exe  - Deleted
C:\WINDOWS\system32\alog.txt  - Deleted
C:\WINDOWS\system32\drweb32.dll  - Deleted
C:\WINDOWS\system32\mssrv32.exe  - Deleted
C:\WINDOWS\system32\nod32.dll  - Deleted
C:\WINDOWS\system32\ps1.dat  - Deleted
C:\WINDOWS\system32\rc.dat  - Deleted
C:\WINDOWS\system32\xd.txt  - Deleted



Folder C:\Documents and Settings\CrossFire\Dane aplikacji\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#w*w.redtube.com - Removed


Removing Temp Files

[b]ADS Check [/b]:



                                 [b]Final Check [/b]:

catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-08-31 14:52:51
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden services & system hive ...

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg]
"s1"=dword:2df9c43f
"s2"=dword:110480d0
"h0"=dword:00000001

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC]
"p0"="C:\Program Files\DAEMON Tools Pro\"
"h0"=dword:00000000
"hdf12"=hex:4c,9e,ea,b7,40,51,ce,8d,eb,9c,6f,97,6d,03,aa,a5,eb,06,8d,3c,73,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001]
"a0"=hex:20,01,00,00,ac,51,b8,ed,67,8d,0b,43,8c,c0,c7,88,70,fe,a5,20,e2,..
"hdf12"=hex:0d,28,ec,f7,15,a0,1e,fe,c1,28,52,79,b6,bf,14,be,28,fb,2b,8a,4b,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0]
"hdf12"=hex:f2,c4,54,b3,0a,e6,2c,41,07,15,e0,04,fe,40,74,85,82,06,94,ab,1e,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000002]
"a0"=hex:20,01,00,00,06,43,be,ed,4f,52,e4,e5,b2,93,5b,4e,d7,5a,e1,05,eb,..
"hdf12"=hex:66,74,aa,47,1f,a5,03,60,d2,23,16,57,7f,4b,3a,53,c7,0c,4b,7d,8f,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000002\gdq0]
"hdf12"=hex:e8,8b,6c,4d,30,ac,4a,e4,c8,34,48,70,37,29,ab,1c,fe,74,a1,07,42,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000002\gdq1]
"hdf12"=hex:f2,c4,54,b3,0a,e6,2c,41,07,15,e0,04,fe,40,74,85,82,06,94,ab,1e,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC]
"p0"="C:\Program Files\DAEMON Tools Pro\"
"h0"=dword:00000000
"hdf12"=hex:4c,9e,ea,b7,40,51,ce,8d,eb,9c,6f,97,6d,03,aa,a5,eb,06,8d,3c,73,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001]
"a0"=hex:20,01,00,00,ac,51,b8,ed,67,8d,0b,43,8c,c0,c7,88,70,fe,a5,20,e2,..
"hdf12"=hex:0d,28,ec,f7,15,a0,1e,fe,c1,28,52,79,b6,bf,14,be,28,fb,2b,8a,4b,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0]
"hdf12"=hex:f2,c4,54,b3,0a,e6,2c,41,07,15,e0,04,fe,40,74,85,82,06,94,ab,1e,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000002]
"a0"=hex:20,01,00,00,06,43,be,ed,4f,52,e4,e5,b2,93,5b,4e,d7,5a,e1,05,eb,..
"hdf12"=hex:66,74,aa,47,1f,a5,03,60,d2,23,16,57,7f,4b,3a,53,c7,0c,4b,7d,8f,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000002\gdq0]
"hdf12"=hex:e8,8b,6c,4d,30,ac,4a,e4,c8,34,48,70,37,29,ab,1c,fe,74,a1,07,42,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000002\gdq1]
"hdf12"=hex:f2,c4,54,b3,0a,e6,2c,41,07,15,e0,04,fe,40,74,85,82,06,94,ab,1e,..

scanning hidden registry entries ...

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0


[b]Remaining Services [/b]:




Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"="C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook"
"C:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"="C:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE:*:Enabled:Microsoft Office Groove"
"C:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"="C:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE:*:Enabled:Microsoft Office OneNote"
"D:\\Program Files\\KONAMI\\Pro Evolution Soccer 2008\\PES2008.exe"="D:\\Program Files\\KONAMI\\Pro Evolution Soccer 2008\\PES2008.exe:*:Enabled:Pro Evolution Soccer 2008"
"C:\\Program Files\\Skype\\Phone\\Skype.exe"="C:\\Program Files\\Skype\\Phone\\Skype.exe:*:Enabled:Skype"
"D:\\Program Files\\THQ\\S.T.A.L.K.E.R. - Shadow of Chernobyl\\bin\\XR_3DA.exe"="D:\\Program Files\\THQ\\S.T.A.L.K.E.R. - Shadow of Chernobyl\\bin\\XR_3DA.exe:*:Enabled:S.T.A.L.K.E.R. - Shadow of Chernobyl (CLI)"
"D:\\Program Files\\THQ\\S.T.A.L.K.E.R. - Shadow of Chernobyl\\bin\\dedicated\\XR_3DA.exe"="D:\\Program Files\\THQ\\S.T.A.L.K.E.R. - Shadow of Chernobyl\\bin\\dedicated\\XR_3DA.exe:*:Enabled:S.T.A.L.K.E.R. - Shadow of Chernobyl (SRV)"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

[b]Remaining Files [/b]:


File Backups: - C:\SDFix\backups\backups.zip

[b]Files with Hidden Attributes [/b]:

Thu 12 Oct 2006         1,211 A.SHR --- "C:\copy.exe"
Sat 20 May 2006        70,207 A.SHR --- "C:\host.exe"
Thu 12 Oct 2006         1,211 A.SHR --- "C:\WINDOWS\xcopy.exe"
Tue  5 Aug 2008         6,402 ...HR --- "C:\Documents and Settings\CrossFire\Dane aplikacji\SecuROM\UserData\securom_v7_01.bak"

[b]Finished![/b]


hijacka

Kod: Zaznacz wszystko

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 14:57:38, on 2008-08-31
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\NVIDIA Corporation\nTune\nTuneService.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\DAEMON Tools Pro\DTProAgent.exe
C:\Program Files\RocketDock\RocketDock.exe
C:\Program Files\Common Files\Teleca Shared\CapabilityManager.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Stardock\CursorFX\CursorFX.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Hamachi\hamachi.exe
C:\Program Files\Xfire\xfire.exe
C:\Program Files\Internet Download Manager\IEMonitor.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\Common Files\Teleca Shared\Generic.exe
C:\Program Files\Sony Ericsson\Mobile2\Mobile Phone Monitor\epmworker.exe
c:\program files\Mozilla Firefox\firefox.exe
E:\Nowy folder\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.pl/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = wmplayer.exe //ICWLaunch
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Program Files\Internet Download Manager\IDMIECC.dll
O2 - BHO: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files\HP\Smart Web Printing\hpswp_printenhancer.dll
O2 - BHO: HP Print Clips - {053F9267-DC04-4294-A72C-58F732D338C0} - C:\Program Files\HP\Smart Web Printing\hpswp_framework.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - D:\Program Files\BitComet\tools\BitCometBHO_1.2.2.28.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [NVIDIA nTune] "C:\Program Files\NVIDIA Corporation\nTune\nTuneCmd.exe" clear
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [Gainward] C:\WINDOWS\TBPanel.exe /A
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
O4 - HKLM\..\Run: [AGEIA PhysX SysTray] C:\Program Files\AGEIA Technologies\TrayIcon.exe
O4 - HKLM\..\Run: [Sony Ericsson PC Suite] "C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKCU\..\Run: [DAEMON Tools Pro Agent] "C:\Program Files\DAEMON Tools Pro\DTProAgent.exe"
O4 - HKCU\..\Run: [RocketDock] "C:\Program Files\RocketDock\RocketDock.exe"
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [BitComet] "D:\Program Files\BitComet\BitComet.exe" /tray
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [IDMan] C:\Program Files\Internet Download Manager\IDMan.exe /onboot
O4 - HKCU\..\Run: [Konnekt_6b95416a_CrossFire] "C:\Program Files\Konnekt\konnekt.exe" /autostart -profile=?
O4 - HKCU\..\Run: [Komunikator] C:\Program Files\Tlen.pl\tlen.exe
O4 - HKCU\..\Run: [CursorFX] "C:\Program Files\Stardock\CursorFX\CursorFX.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [SIDEBAR] "C:\Program Files\Desktop Sidebar\dsidebar.exe"
O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Startup: hamachi.lnk = C:\Program Files\Hamachi\hamachi.exe
O4 - Startup: Xfire.lnk = C:\Program Files\Xfire\xfire.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O8 - Extra context menu item: &D&ownload &with BitComet - res://D:\Program Files\BitComet\BitComet.exe/AddLink.htm
O8 - Extra context menu item: &D&ownload all video with BitComet - res://D:\Program Files\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: &D&ownload all with BitComet - res://D:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
O8 - Extra context menu item: E&ksportuj do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Ściągnij przez IDM - C:\Program Files\Internet Download Manager\IEExt.htm
O8 - Extra context menu item: Ściągnij wszystkie linki przez IDM - C:\Program Files\Internet Download Manager\IEGetAll.htm
O8 - Extra context menu item: Ściągnij zawartość wideo FLV przez IDM - C:\Program Files\Internet Download Manager\IEGetVL.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Wyślij do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Wyślij &do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Kolekcja wycinków HP - {58ECB495-38F0-49cb-A538-10282ABF65E7} - C:\Program Files\HP\Smart Web Printing\hpswp_extensions.dll
O9 - Extra button: Zaznaczanie HP Smart - {700259D7-1666-479a-93B1-3250410481E8} - C:\Program Files\HP\Smart Web Printing\hpswp_extensions.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://D:\Program Files\BitComet\tools\BitCometBHO_1.2.2.28.dll/206 (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{EB844C08-EAC7-4403-8A39-83B8949B0C9D}: NameServer = 217.30.129.149,217.30.137.200
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: nTune Service (nTuneService) - NVIDIA - C:\Program Files\NVIDIA Corporation\nTune\nTuneService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: StyleXPService - Unknown owner - C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe (file missing)

--
End of file - 9270 bytes


Wszedłem w tryb awaryjny zrobiłem tak jak napisałeś Wojtas ... później reset weszło mi do windowaa jeszcze raz pokazało się okienko Dos z ComboFixem napisane było ze raport zapisany i do widzenia to chyba tak ?

[djarta]

Gdzie ComboFix?


===========================
K.

[CrossFire]

Wyżej jest... chodziło o Raport.txt innego nie ma pliczku w SDFix ....

[djarta]

Nie ma ComboFixa, jest tylko HJT i SDFix.


==================
K.

[CrossFire]

hehe przepraszam nie zauwazylem tego

Combo Fix

Kod: Zaznacz wszystko

ComboFix 08-08-30.03 - CrossFire 2008-08-31 15:19:57.1 - NTFSx86
Microsoft Windows XP Professional  5.1.2600.2.1250.1.1045.18.1496 [GMT 2:00]
Running from: C:\ComboFix.exe
* Created a new restore point

[color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color]
.

(((((((((((((((((((((((((((((((((((((((   Other Deletions   )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Autorun.inf
C:\copy.exe
C:\host.exe
C:\WINDOWS\autorun.inf
C:\WINDOWS\svchost.exe
C:\WINDOWS\system32\AutoRun.inf
C:\WINDOWS\system32\temp1.exe
C:\WINDOWS\system32\temp2.exe
C:\WINDOWS\xcopy.exe
D:\Autorun.inf
D:\copy.exe
D:\host.exe
E:\Autorun.inf
E:\copy.exe
E:\host.exe

.
(((((((((((((((((((((((((   Files Created from 2008-07-28 to 2008-08-31  )))))))))))))))))))))))))))))))
.

2008-08-31 15:17 . 2008-08-31 15:18   2,840,693   -ra------   C:\ComboFix.exe
2008-08-31 14:48 . 2008-08-31 14:48   578,560   --a--c---   C:\WINDOWS\system32\dllcache\user32.dll
2008-08-31 14:46 . 2008-08-31 14:47   <DIR>   d--------   C:\WINDOWS\ERUNT
2008-08-31 14:46 . 2008-08-31 15:20   <DIR>   d--h-----   C:\Documents and Settings\Administrator\Ustawienia lokalne
2008-08-31 14:46 . 2008-06-12 00:59   <DIR>   d--------   C:\Documents and Settings\Administrator\Ulubione
2008-08-31 14:46 . 2008-06-11 23:03   <DIR>   d--h-----   C:\Documents and Settings\Administrator\Szablony
2008-08-31 14:46 . 2008-08-31 15:21   <DIR>   d--------   C:\Documents and Settings\Administrator\Pulpit
2008-08-31 14:46 . 2008-06-12 00:59   <DIR>   d--------   C:\Documents and Settings\Administrator\Moje dokumenty
2008-08-31 14:46 . 2008-06-12 00:59   <DIR>   dr-------   C:\Documents and Settings\Administrator\Menu Start
2008-08-31 14:46 . 2008-06-12 00:59   <DIR>   dr-h-----   C:\Documents and Settings\Administrator\Dane aplikacji
2008-08-31 14:46 . 2008-08-31 14:46   <DIR>   d--------   C:\Documents and Settings\Administrator
2008-08-31 14:43 . 2008-08-31 14:54   <DIR>   d--------   C:\SDFix
2008-08-31 14:39 . 2008-08-31 14:39   1,419,780   --a------   C:\SDFix.exe
2008-08-31 12:02 . 2005-05-03 18:43   69,632   --a------   C:\WINDOWS\Alcmtr.exe
2008-08-30 16:06 . 2008-08-30 16:12   <DIR>   d--------   C:\Program Files\Gadu-Gadu
2008-08-30 03:14 . 2008-08-30 03:31   <DIR>   d--------   C:\Documents and Settings\CrossFire\Dane aplikacji\Desktop Sidebar
2008-08-30 03:05 . 2008-08-30 03:05   <DIR>   d--h-----   C:\Documents and Settings\All Users\Dane aplikacji\{A850D4D9-871B-4234-908D-21C457767270}
2008-08-30 01:54 . 2008-08-30 01:54   <DIR>   d--------   C:\Program Files\Common Files\Stardock
2008-08-30 01:45 . 2008-08-30 01:45   0   --a------   C:\WINDOWS\WB.ini
2008-08-30 01:36 . 2008-08-30 03:04   <DIR>   d--------   C:\Program Files\Stardock
2008-08-30 01:36 . 2003-02-26 20:27   36,864   --a------   C:\WINDOWS\system32\wbsys.dll
2008-08-30 01:36 . 2005-01-22 18:05   20,480   --a------   C:\WINDOWS\system32\wbload.dll
2008-08-29 23:53 . 2008-08-31 15:06   136,888   --a------   C:\WINDOWS\system32\drivers\PnkBstrK.sys
2008-08-29 23:53 . 2008-08-31 15:06   111,928   --a------   C:\WINDOWS\system32\PnkBstrB.exe
2008-08-29 23:53 . 2008-08-30 23:57   22,328   --a------   C:\Documents and Settings\CrossFire\Dane aplikacji\PnkBstrK.sys
2008-08-29 23:52 . 2008-08-29 23:52   <DIR>   d--------   C:\WINDOWS\system32\LogFiles
2008-08-29 23:52 . 2008-08-31 01:55   66,872   --a------   C:\WINDOWS\system32\PnkBstrA.exe
2008-08-26 23:05 . 2006-09-05 20:06   90,800   -ra------   C:\WINDOWS\system32\drivers\se59unic.sys
2008-08-26 23:05 . 2006-09-05 20:08   88,624   -ra------   C:\WINDOWS\system32\drivers\se59mgmt.sys
2008-08-26 23:05 . 2006-09-05 20:06   18,704   -ra------   C:\WINDOWS\system32\drivers\se59nd5.sys
2008-08-26 23:05 . 2006-09-05 20:06   4,128   -ra------   C:\WINDOWS\system32\drivers\se59cr.sys
2008-08-26 23:04 . 2008-08-26 23:05   <DIR>   d--------   C:\Documents and Settings\CrossFire\Dane aplikacji\Teleca
2008-08-26 23:04 . 2006-09-05 20:07   97,088   -ra------   C:\WINDOWS\system32\drivers\se59mdm.sys
2008-08-26 23:04 . 2006-09-05 20:09   86,432   -ra------   C:\WINDOWS\system32\drivers\se59obex.sys
2008-08-26 23:04 . 2006-09-05 20:07   61,536   -ra------   C:\WINDOWS\system32\drivers\se59bus.sys
2008-08-26 23:04 . 2006-09-05 20:07   9,360   -ra------   C:\WINDOWS\system32\drivers\se59mdfl.sys
2008-08-26 23:04 . 2006-09-05 20:09   6,240   -ra------   C:\WINDOWS\system32\drivers\se59cmnt.sys
2008-08-26 23:04 . 2006-09-05 20:09   6,240   -ra------   C:\WINDOWS\system32\drivers\se59cm.sys
2008-08-26 23:04 . 2006-09-05 20:06   5,872   -ra------   C:\WINDOWS\system32\drivers\se59whnt.sys
2008-08-26 23:04 . 2006-09-05 20:06   5,872   -ra------   C:\WINDOWS\system32\drivers\se59wh.sys
2008-08-26 23:03 . 2008-08-26 23:03   <DIR>   d--------   C:\Documents and Settings\CrossFire\Dane aplikacji\Sony Ericsson
2008-08-26 23:02 . 2008-08-26 23:02   <DIR>   d--------   C:\Documents and Settings\All Users\Dane aplikacji\Sony Ericsson
2008-08-26 23:01 . 2008-08-26 23:01   <DIR>   d--------   C:\WINDOWS\Downloaded Installations
2008-08-26 23:01 . 2008-08-26 23:01   <DIR>   d--------   C:\Program Files\Sony Ericsson
2008-08-26 23:01 . 2008-08-26 23:02   <DIR>   d--------   C:\Program Files\Common Files\Teleca Shared
2008-08-26 23:01 . 2008-08-26 23:01   <DIR>   d--------   C:\Program Files\Common Files\Sony Ericsson Shared
2008-08-26 23:01 . 2008-08-26 23:02   <DIR>   d--------   C:\Documents and Settings\All Users\Dane aplikacji\Teleca
2008-08-25 09:05 . 2008-08-25 09:05   <DIR>   d--------   C:\Downloads
2008-08-24 15:09 . 2008-08-24 15:09   <DIR>   d--------   C:\Program Files\QuickTime Alternative
2008-08-24 15:09 . 2008-08-24 15:09   <DIR>   d--------   C:\Documents and Settings\All Users\Dane aplikacji\Apple Computer
2008-08-24 15:09 . 2008-05-27 10:50   90,112   --a------   C:\WINDOWS\system32\QuickTimeVR.qtx
2008-08-24 15:09 . 2008-05-27 10:50   57,344   --a------   C:\WINDOWS\system32\QuickTime.qts
2008-08-23 23:09 . 2008-08-23 23:09   <DIR>   d--------   C:\Program Files\Hamachi
2008-08-23 23:09 . 2008-08-31 15:03   <DIR>   d--------   C:\Documents and Settings\CrossFire\Dane aplikacji\Hamachi
2008-08-23 23:09 . 2008-08-23 23:09   25,280   --a------   C:\WINDOWS\system32\drivers\hamachi.sys
2008-08-22 21:32 . 2008-08-22 21:32   <DIR>   d--------   C:\Documents and Settings\All Users\Dane aplikacji\Age of Empires 3
2008-08-19 23:55 . 2008-08-19 23:55   <DIR>   d--------   C:\Program Files\directx
2008-08-19 18:29 . 2008-08-19 18:29   <DIR>   d--------   C:\Program Files\PWN
2008-08-19 18:29 . 1998-10-07 13:54   327,168   --a------   C:\WINDOWS\IsUn0415.exe
2008-08-19 18:29 . 2001-04-04 14:00   245,760   ---------   C:\WINDOWS\system32\DECO_32.DLL
2008-08-19 14:46 . 2008-08-20 09:41   <DIR>   d--------   C:\Documents and Settings\All Users\Dane aplikacji\stamina
2008-08-18 19:16 . 2008-08-18 19:16   6,656   --ahs----   C:\WINDOWS\system32\Thumbs.db
2008-08-18 18:08 . 2008-08-18 18:05   774,045   --a------   C:\WINDOWS\Blue_Energy_by_edgejr.jpg
2008-08-17 22:02 . 2008-08-17 22:02   <DIR>   d--------   C:\Program Files\Internet Download Manager
2008-08-17 22:02 . 2008-08-19 14:41   <DIR>   d--------   C:\Documents and Settings\CrossFire\Dane aplikacji\IDM
2008-08-17 22:02 . 2008-08-31 15:18   <DIR>   d--------   C:\Documents and Settings\CrossFire\Dane aplikacji\DMCache
2008-08-17 15:01 . 2008-08-17 15:01   <DIR>   d--------   C:\Program Files\AidemMedia
2008-08-13 00:08 . 2008-08-13 00:08   42,320   --a------   C:\WINDOWS\system32\xfcodec.dll
2008-08-05 12:16 . 2008-08-05 12:16   <DIR>   d--------   C:\Documents and Settings\CrossFire\Dane aplikacji\gnupg
2008-08-03 23:59 . 2008-08-03 23:59   <DIR>   d--------   C:\Documents and Settings\CrossFire\Dane aplikacji\DivX
2008-08-03 21:02 . 2008-08-03 21:06   <DIR>   d--------   C:\Program Files\DivX
2008-08-03 21:02 . 2008-06-11 02:07   120,056   ---------   C:\WINDOWS\system32\pxcpyi64.exe
2008-08-03 21:02 . 2008-06-11 02:07   118,520   ---------   C:\WINDOWS\system32\pxinsi64.exe
2008-08-03 02:29 . 2007-05-23 20:35   403,354   --a------   C:\WINDOWS\Xbox360-1.jpg
2008-07-29 16:03 . 2008-07-09 16:34   206,256   --a------   C:\WINDOWS\system32\idmmbc.dll
2008-07-27 00:07 . 2008-08-24 15:01   <DIR>   d--------   C:\Program Files\Real Alternative
2008-07-27 00:07 . 2008-07-27 00:07   <DIR>   d--------   C:\Documents and Settings\CrossFire\Dane aplikacji\Media Player Classic
2008-07-11 09:48 . 2008-07-11 10:04   45   --a------   C:\TEST.XML
2008-07-06 19:55 . 2004-08-18 10:34   442,368   -ra------   C:\WINDOWS\system32\vp6vfw.dll
2008-07-03 11:37 . 2008-07-03 15:16   <DIR>   d--------   C:\Program Files\PhotoScape
2008-07-02 19:35 . 2008-07-02 19:35   <DIR>   d--------   C:\Program Files\NovaTech Network
2008-07-01 10:30 . 2008-07-01 10:30   <DIR>   d--------   C:\Documents and Settings\LocalService\Dane aplikacji\HPAppData

.
((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-08-31 13:03   ---------   d-----w   C:\Documents and Settings\CrossFire\Dane aplikacji\Skype
2008-08-31 10:02   ---------   d-----w   C:\Program Files\Realtek
2008-08-31 00:37   ---------   d-----w   C:\Documents and Settings\CrossFire\Dane aplikacji\Xfire
2008-08-30 00:37   ---------   d-----w   C:\Program Files\RocketDock
2008-08-29 21:52   ---------   d--h--w   C:\Program Files\InstallShield Installation Information
2008-08-22 15:46   ---------   d-----w   C:\Documents and Settings\CrossFire\Dane aplikacji\skypePM
2008-08-22 15:45   ---------   d-----w   C:\Program Files\Skype
2008-08-21 06:44   ---------   d-----w   C:\Program Files\Xfire
2008-08-19 21:51   ---------   d-----w   C:\Program Files\Common Files\InstallShield
2008-08-19 17:16   ---------   d-----w   C:\Documents and Settings\All Users\Dane aplikacji\Microsoft Help
2008-08-18 15:47   ---------   d-----w   C:\Program Files\Java
2008-08-05 10:23   107,888   ----a-w   C:\WINDOWS\system32\CmdLineExt.dll
2008-07-10 23:43   ---------   d-----w   C:\Program Files\Winamp
2008-07-10 23:43   ---------   d-----w   C:\Documents and Settings\CrossFire\Dane aplikacji\Winamp
2008-07-09 16:48   ---------   d-----w   C:\Documents and Settings\CrossFire\Dane aplikacji\HP
2008-07-09 16:48   ---------   d-----w   C:\Documents and Settings\All Users\Dane aplikacji\HP
2008-07-02 19:56   ---------   d-----w   C:\Documents and Settings\CrossFire\Dane aplikacji\HPAppData
2008-07-01 15:57   ---------   d-----w   C:\Documents and Settings\All Users\Dane aplikacji\Codemasters
2008-06-30 16:12   ---------   d-----w   C:\Documents and Settings\CrossFire\Dane aplikacji\Bioshock
2008-06-18 17:52   161,096   ----a-w   C:\WINDOWS\system32\DivXCodecVersionChecker.exe
2008-06-18 14:29   444,952   ----a-w   C:\WINDOWS\system32\wrap_oal.dll
2008-06-18 14:29   109,080   ----a-w   C:\WINDOWS\system32\OpenAL32.dll
2008-06-13 23:13   2,560   ----a-w   C:\WINDOWS\system32\bitcometres.dll
2008-06-11 21:10   315,392   ----a-w   C:\WINDOWS\HideWin.exe
2008-06-11 00:07   524,288   ----a-w   C:\WINDOWS\system32\DivXsm.exe
2008-06-11 00:07   3,596,288   ----a-w   C:\WINDOWS\system32\qt-dx331.dll
2008-06-11 00:07   129,784   ------w   C:\WINDOWS\system32\pxafs.dll
2008-06-11 00:04   200,704   ----a-w   C:\WINDOWS\system32\ssldivx.dll
2008-06-11 00:04   1,044,480   ----a-w   C:\WINDOWS\system32\libdivx.dll
2008-05-22 22:18   12,288   ----a-w   C:\WINDOWS\system32\DivXWMPExtType.dll
.

(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DAEMON Tools Pro Agent"="C:\Program Files\DAEMON Tools Pro\DTProAgent.exe" [2007-09-06 15:08 136136]
"RocketDock"="C:\Program Files\RocketDock\RocketDock.exe" [2007-09-02 13:58 495616]
"Skype"="C:\Program Files\Skype\Phone\Skype.exe" [2008-08-11 18:04 21858088]
"BitComet"="D:\Program Files\BitComet\BitComet.exe" [2008-06-03 05:42 2596152]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:44 15360]
"IDMan"="C:\Program Files\Internet Download Manager\IDMan.exe" [2008-07-29 16:18 2610608]
"CursorFX"="C:\Program Files\Stardock\CursorFX\CursorFX.exe" [2008-02-20 00:59 418632]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-08-04 00:55 1667584]
"Gadu-Gadu"="C:\Program Files\Gadu-Gadu\gg.exe" [2008-03-20 12:04 2127296]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NVIDIA nTune"="C:\Program Files\NVIDIA Corporation\nTune\nTuneCmd.exe" [2007-01-22 17:22 81920]
"HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2007-03-11 21:34 49152]
"Gainward"="C:\WINDOWS\TBPanel.exe" [2007-11-01 07:24 2185768]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-10-25 11:17 8527872]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-10-25 11:17 81920]
"GrooveMonitor"="C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-27 00:47 31016]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 04:27 144784]
"AGEIA PhysX SysTray"="C:\Program Files\AGEIA Technologies\TrayIcon.exe" [2006-03-20 21:50 335872]
"Sony Ericsson PC Suite"="C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" [2007-03-28 01:07 593920]
"SkyTel"="SkyTel.EXE" [2006-05-16 18:04 2879488 C:\WINDOWS\SkyTel.exe]
"nwiz"="nwiz.exe" [2007-10-25 11:17 1626112 C:\WINDOWS\system32\nwiz.exe]
"RTHDCPL"="RTHDCPL.EXE" [2007-02-26 15:03 16125440 C:\WINDOWS\RTHDCPL.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 00:44 15360]

C:\Documents and Settings\CrossFire\Menu Start\Programy\Autostart\
Adobe Gamma.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-03-16 19:16:50 113664]
hamachi.lnk - C:\Program Files\Hamachi\hamachi.exe [2008-08-23 23:09:15 625952]
Xfire.lnk - C:\Program Files\Xfire\xfire.exe [2008-08-13 00:08:52 3065168]

C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\
Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 22:05:26 29696]
HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2007-03-11 21:26:24 210520]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\WBSrv]
2008-08-30 01:37 176128 C:\PROGRA~1\Stardock\OBJECT~1\WINDOW~1\WbSrv.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=wbsys.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.XFR1"= xfcodec.dll
"vidc.ffds"= ffdshow.ax
"msacm.ac3filter"= ac3filter.acm

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"C:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"C:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=
"C:\\Program Files\\Xfire\\xfire.exe"=
"D:\\Program Files\\Activision\\Call of Duty 2\\CoD2MP_s.exe"=
"D:\\Program Files\\Activision\\Call of Duty 4 - Modern Warfare\\iw3mp.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"8266:TCP"= 8266:TCP:BitComet 8266 TCP
"8266:UDP"= 8266:UDP:BitComet 8266 UDP

S3 se59bus;Sony Ericsson Device 089 driver (WDM);C:\WINDOWS\system32\DRIVERS\se59bus.sys [2006-09-05 20:07]
S3 se59mdfl;Sony Ericsson Device 089 USB WMC Modem Filter;C:\WINDOWS\system32\DRIVERS\se59mdfl.sys [2006-09-05 20:07]
S3 se59mdm;Sony Ericsson Device 089 USB WMC Modem Driver;C:\WINDOWS\system32\DRIVERS\se59mdm.sys [2006-09-05 20:07]
S3 se59mgmt;Sony Ericsson Device 089 USB WMC Device Management Drivers (WDM);C:\WINDOWS\system32\DRIVERS\se59mgmt.sys [2006-09-05 20:08]
S3 se59nd5;Sony Ericsson Device 089 USB Ethernet Emulation SEMC59 (NDIS);C:\WINDOWS\system32\DRIVERS\se59nd5.sys [2006-09-05 20:06]
S3 se59obex;Sony Ericsson Device 089 USB WMC OBEX Interface;C:\WINDOWS\system32\DRIVERS\se59obex.sys [2006-09-05 20:09]
S3 se59unic;Sony Ericsson Device 089 USB Ethernet Emulation SEMC59 (WDM);C:\WINDOWS\system32\DRIVERS\se59unic.sys [2006-09-05 20:06]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12   REG_MULTI_SZ      Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt   REG_MULTI_SZ      hpqcxs08 hpqddsvc

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\F]
\Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL copy.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\H]
\Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL copy.exe

*Newly Created Service* - PROCEXP90
.
- - - - ORPHANS REMOVED - - - -

HKCU-Run-Konnekt_6b95416a_CrossFire - C:\Program Files\Konnekt\konnekt.exe
HKCU-Run-Komunikator - C:\Program Files\Tlen.pl\tlen.exe
HKCU-Run-SIDEBAR - C:\Program Files\Desktop Sidebar\dsidebar.exe
HKLM-Run-WinampAgent - C:\Program Files\Winamp\winampa.exe


.
------- Supplementary Scan -------
.
FireFox -: Profile - C:\Documents and Settings\CrossFire\Dane aplikacji\Mozilla\Firefox\Profiles\tacdbr5c.default\
FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://forum.programosy.pl/index.php?sid=125a8afaba88eafe42fa75683096ac61
FF -: plugin - C:\Program Files\Adobe\Acrobat 7.0\Reader\browser\nppdf32.dll
.

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-08-31 15:21:05
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-08-31 15:21:34
ComboFix-quarantined-files.txt  2008-08-31 13:21:32

Pre-Run: 5,313,327,104 bajtów wolnych
Post-Run: 5,436,383,232 bajtów wolnych

245

Widziałem ze pousuwało mi również generici i temp2 to fajnie

[djarta]

Wklej do Notatnika taki tekst:

Kod: Zaznacz wszystko

Windows Registry Editor Version 5.00

[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\F]

[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\H]


Z menu Notatnika >>> Plik >>> Zapisz jako >>> Ustaw rozszerzenie na: "Wszystkie pliki" >>> Zapisz jako FIX.REG>>>
plik uruchom (dwuklik i OK- zgódź się na dodanie do Rejestru).
Zrestartuj komputer.

Wykonaj to co jest podane w tym temacie (jeśli wykonałeś/łaś to wcześniej to nie rób tego).

Usuń ręcznie folder C:\Qoobox,

Usuń instalkę ComboFix z dysku.

Wykonaj optymalizację autostartu

Przeczyść komputer ATF-Cleaner

Wyłącz i włącz przywracanie systemu na wszystkich dyskach.Instrukcja

Przeskanuj obszar mojego komputera http://www.kaspersky.pl/virusscanner.html (uruchom przez IE) Daj raport z niego na forum.

i tym:

FixIEDef.



=======================
K.

[CrossFire]

Przeczyść komputer ATF-Cleaner
wszystkie pliki zaznaczyć ?

[djarta]

Tak.


====================
K.

Autor postu otrzymał pochwałę

[CrossFire]

Przeskanuj obszar mojego komputera http://www.kaspersky.pl/virusscanner.html (uruchom przez IE) Daj raport z niego na forum.

Nie powiodło się bo do czegoś się pluje

FixIEDef.

Sprawdziłem i nic

Reszte zrobilem i sie teraz ładnie wszystko wczytuje szybko zadnych Generic'ów nie ma i temp. ani błędów plupitu dalej nie widzę ale jest już o wiele lepiej niż było choc jeden plus w tym ze kosza nie widać

[djarta]

To wszystko z mojej strony.


=====================
K.