sam zainstaluje sie program, nie da sie go wył :/

[Bialko0019]

Witam. Właśnie gdy wł. kompa to przy starcie systemu wyśw. się takie okienko HPH, ni ewiem co jest, gdy klikam CANCEJ/ANULUJ to wyl. sie i za polsekundy wl. sie ponownie i prosi zeby cos podac. Moz dlatego ze nie dawno robilem czyszczenie rejestru ??

Screen:

[eSpEY]

Logi z HiJackThis i combofix...
screen nic nie da :]

[Bialko0019]

z Hijack

Kod: Zaznacz wszystko

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 13:47:13, on 2007-12-13
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
D:\WINDOWS\System32\smss.exe
D:\WINDOWS\system32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\Program Files\Ahead\InCD\InCDsrv.exe
D:\WINDOWS\Explorer.EXE
D:\WINDOWS\system32\spoolsv.exe
D:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe
D:\Program Files\HP\HP Software Update\HPWuSchd2.exe
D:\Program Files\Winamp\winampa.exe
D:\Program Files\Ahead\InCD\InCD.exe
D:\WINDOWS\system32\ctfmon.exe
D:\Program Files\Messenger\msmsgs.exe
D:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
D:\WINDOWS\system32\HPZipm12.exe
D:\WINDOWS\system32\msiexec.exe
D:\WINDOWS\system32\wuauclt.exe
D:\Program Files\Gadu-Gadu\gg.exe
D:\Program Files\Winamp\winamp.exe
D:\Program Files\Opera\Opera.exe
D:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.onet.pl/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "D:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [HP Software Update] D:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [NeroFilterCheck] D:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [WinampAgent] "D:\Program Files\Winamp\winampa.exe"
O4 - HKLM\..\Run: [InCD] D:\Program Files\Ahead\InCD\InCD.exe
O4 - HKCU\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "D:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: HP Digital Imaging Monitor.lnk = D:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{5F367F02-8BC5-4C72-BB70-BD056C51CE97}: NameServer = 194.204.152.34,194.204.159.1
O23 - Service: InCD Helper (InCDsrv) - Nero AG - D:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: Pml Driver HPZ12 - HP - D:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Sandra Data Service (SandraDataSrv) - SiSoftware - D:\Program Files\SiSoftware\SiSoftware Sandra Lite 2007\Win32\RpcDataSrv.exe
O23 - Service: Sandra Service (SandraTheSrv) - SiSoftware - D:\Program Files\SiSoftware\SiSoftware Sandra Lite 2007\RpcSandraSrv.exe

--
End of file - 3578 bytes

i jeszcze z combofix combofix jak chciales:

Kod: Zaznacz wszystko




ComboFix 07-12-12.3 - Bialko 2007-12-13 13:49:19.1 - [color=red][b]FAT32[/b][/color]x86
Microsoft Windows XP Professional  5.1.2600.2.1250.1.1045.18.70 [GMT 1:00]
Running from: D:\Documents and Settings\Bialko\Pulpit\ComboFix.exe
* Created a new restore point
.

(((((((((((((((((((((((((((((((((((((((   Other Deletions   )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Autorun.inf
D:\Autorun.inf

.
(((((((((((((((((((((((((   Files Created from 2007-11-13 to 2007-12-13  )))))))))))))))))))))))))))))))
.

2007-12-13 13:46 . 2007-12-13 13:47   <DIR>   d--------   D:\Program Files\Trend Micro
2007-12-12 15:02 . 2007-12-12 15:02   <DIR>   d--------   D:\Program Files\jv16 PowerTools
2007-12-11 20:47 . 2007-12-11 20:47   <DIR>   d--------   D:\Documents and Settings\Bialko\Dane aplikacji\Media Player Classic
2007-12-11 20:46 . 2007-12-11 20:46   <DIR>   d--------   D:\Program Files\Real Alternative
2007-12-11 20:43 . 2007-12-11 20:43   <DIR>   d--------   D:\Program Files\MarBit
2007-12-08 12:13 . 2007-12-08 12:13   <DIR>   d--------   D:\Program Files\BBProject
2007-12-07 14:35 . 2007-12-07 14:35   <DIR>   d--------   D:\Rejestr
2007-12-07 13:08 . 2007-12-07 13:08   <DIR>   d--------   D:\100CAMEA
2007-12-06 20:45 . 2007-12-12 14:42   54,156   --ah-----   D:\WINDOWS\QTFont.qfn
2007-12-06 20:45 . 2007-12-06 20:45   1,409   --a------   D:\WINDOWS\QTFont.for
2007-12-06 19:34 . 2007-02-26 23:46   734,078,976   ---------   D:\Szalony weekend - Long Weekend, The (2005 Lektor).avi
2007-12-06 18:06 . 2007-12-06 18:06   <DIR>   d--------   D:\Documents and Settings\Bialko\Dane aplikacji\CyberLink
2007-12-06 18:06 . 2007-12-06 18:06   <DIR>   d--------   D:\Documents and Settings\All Users\Dane aplikacji\CyberLink
2007-12-06 18:05 . 2007-12-06 18:05   <DIR>   d--------   D:\WINDOWS\InCD
2007-12-06 18:05 . 2006-03-14 03:06   2,973,696   ---------   D:\WINDOWS\NuNinst.exe
2007-12-06 18:05 . 2005-07-08 16:17   99,584   ---------   D:\WINDOWS\system32\drivers\InCDfs.sys
2007-12-06 18:05 . 2006-03-14 03:06   59,041   ---------   D:\WINDOWS\NuNinst.cfg
2007-12-06 18:05 . 2005-07-08 16:17   29,696   ---------   D:\WINDOWS\system32\drivers\InCDpass.sys
2007-12-06 18:05 . 2006-03-14 03:06   28,672   ---------   D:\WINDOWS\system32\drivers\InCDrm.sys
2007-12-06 18:05 . 2005-07-08 16:17   8,704   ---------   D:\WINDOWS\system32\drivers\InCDrec.sys
2007-12-06 18:03 . 2007-12-06 18:03   <DIR>   d--------   D:\Program Files\CyberLink
2007-12-06 18:02 . 2007-12-06 18:02   <DIR>   d--------   D:\Program Files\CyberLink DVD Solution
2007-12-06 18:02 . 2004-10-01 15:00   40,960   --a------   D:\Program Files\Uninstall_CDS.exe
2007-12-04 20:28 . 2007-12-04 20:28   <DIR>   d--------   D:\Program Files\MIKSOFT
2007-12-01 15:45 . 2006-06-05 14:18   38,464   --a------   D:\WINDOWS\system32\SanCpl.cpl
2007-12-01 15:44 . 2007-12-01 15:45   <DIR>   d--------   D:\Program Files\SiSoftware
2007-12-01 13:14 . 2007-12-01 13:14   <DIR>   d--------   D:\WINDOWS\system32\Logfiles
2007-11-30 22:28 . 2007-11-30 22:28   <DIR>   d--------   D:\Program Files\CCleaner
2007-11-30 19:52 . 2007-11-30 19:52   <DIR>   d--------   D:\Program Files\Winamp
2007-11-30 19:52 . 2007-11-30 19:52   <DIR>   d--------   D:\Documents and Settings\Bialko\Dane aplikacji\Winamp
2007-11-30 19:09 . 2007-11-30 19:09   <DIR>   d--------   D:\Documents and Settings\Bialko\Gadu-Gadu
2007-11-23 14:08 . 2007-11-23 14:08   <DIR>   d--------   D:\Program Files\FLVPlayer
2007-11-22 16:37 . 2007-11-22 16:37   <DIR>   d--------   D:\Program Files\YouTubeRobot
2007-11-22 16:37 . 2007-02-06 15:06   1,044,480   --a------   D:\WINDOWS\system32\libdivx.dll
2007-11-22 16:37 . 2007-02-06 15:10   716,800   --a------   D:\WINDOWS\system32\lameACM.acm
2007-11-22 16:37 . 2007-02-06 15:06   593,920   --a------   D:\WINDOWS\system32\dpuGUI11.dll
2007-11-22 16:37 . 2007-02-06 15:06   294,912   --a------   D:\WINDOWS\system32\dpu11.dll
2007-11-22 16:37 . 2007-02-06 15:06   200,704   --a------   D:\WINDOWS\system32\ssldivx.dll
2007-11-22 16:37 . 2007-02-06 15:06   200,704   --a------   D:\WINDOWS\system32\dtu100.dll
2007-11-22 16:37 . 2007-02-06 15:20   180,224   --a------   D:\WINDOWS\system32\xvidvfw.dll
2007-11-22 16:37 . 2007-02-06 15:06   86,016   --a------   D:\WINDOWS\system32\dpl100.dll
2007-11-22 16:37 . 2007-02-06 15:06   57,344   --a------   D:\WINDOWS\system32\dpv11.dll
2007-11-22 16:37 . 2007-02-06 15:10   414   --a------   D:\WINDOWS\system32\lame_acm.xml
2007-11-19 20:29 . 2007-11-19 20:29   <DIR>   d--------   D:\Program Files\Gadu-Gadu
2007-11-19 18:59 . 2007-11-19 18:59   <DIR>   d--------   D:\Documents and Settings\Bialko\Dane aplikacji\MyPhoneExplorer
2007-11-17 17:48 . 2007-11-17 17:48   <DIR>   d--hs----   D:\FOUND.024
2007-11-13 17:39 . 2007-11-13 17:39   <DIR>   d--------   D:\Program Files\EditPlus 2
2007-11-13 17:39 . 2007-11-13 17:39   <DIR>   d--------   D:\Documents and Settings\Bialko\Dane aplikacji\EditPlus 2

.
((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-11-11 10:40   ---------   d-----w   D:\Program Files\Fma
2007-11-11 10:40   ---------   d-----w   D:\Documents and Settings\Bialko\Dane aplikacji\FMA
2007-11-08 15:11   ---------   d-----w   D:\Documents and Settings\Bialko\Dane aplikacji\Ahead
2007-11-08 15:09   ---------   d-----w   D:\Program Files\Common Files\Ahead
2007-11-08 15:09   ---------   d-----w   D:\Program Files\Ahead
2007-11-08 13:42   ---------   d-----w   D:\Program Files\Nokia
2007-11-06 07:22   ---------   d-----w   D:\Documents and Settings\Bialko\Dane aplikacji\FastStone
2007-11-03 16:19   ---------   d-----w   D:\Documents and Settings\All Users\Dane aplikacji\Apple Computer
2007-11-03 16:05   ---------   d-----w   D:\Program Files\Xilisoft
2007-11-03 16:05   ---------   d-----w   D:\Program Files\QuickTime
2007-11-02 14:52   ---------   d-----w   D:\Program Files\TC PowerPack
2007-10-08 15:26   737,280   ----a-w   D:\WINDOWS\iun6002.exe

.

(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\SmartFTP Drop]
@={EA5A76F7-8138-4B53-B0F5-ADCC730CAFBD}

[HKEY_CLASSES_ROOT\CLSID\{EA5A76F7-8138-4B53-B0F5-ADCC730CAFBD}]
2007-10-01 22:33   406840   --a------   D:\Program Files\SmartFTP Client\sfShellTools.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="D:\WINDOWS\system32\ctfmon.exe" [2004-08-03 22:44]
"MSMSGS"="D:\Program Files\Messenger\msmsgs.exe" [2004-08-04 00:55]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Adobe Reader Speed Launcher"="D:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-05-11 03:06]
"HP Software Update"="D:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2006-02-19 02:41]
"NeroFilterCheck"="D:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 10:50]
"WinampAgent"="D:\Program Files\Winamp\winampa.exe" [2007-10-10 06:28]
"InCD"="D:\Program Files\Ahead\InCD\InCD.exe" [2006-03-14 03:06]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="D:\WINDOWS\system32\CTFMON.EXE" [2004-08-03 22:44]

D:\Documents and Settings\All Users\Menu Start\Programy\Autostart\
HP Digital Imaging Monitor.lnk - D:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2006-02-19 04:21:22]

S2 BT848;BtCap, WDM Video Capture;D:\WINDOWS\system32\drivers\BT848.sys
S2 BTTUNER;BtTuner, WDM TvTuner;D:\WINDOWS\system32\drivers\BTTUNER.sys
S2 BTXBAR;BtXBar, WDM Crossbar;D:\WINDOWS\system32\drivers\BTXBAR.sys

[wojtas]

to chyba cos ze sterownikami od drukarki przeinstaluj je

Autor postu otrzymał pochwałę