sprawdzenie loga

**Posty:** 417 · przez **empty** 18 Lis 2007, 16:40

Jak klinke na dysku C: lub innym HDD prawym rpzyciskiem to w menu kontekstowym jest Auto, jak klikne 2x LPM to otwiera się w nowym oknie. Nie pokazuje ukrytych folderów (samo zmienia żeby te foldery były ukrtyte)

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 15:38:24, on 2007-11-18 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\RTHDCPL.EXE C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe C:\WINDOWS\system32\RUNDLL32.EXE C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\DAEMON Tools\daemon.exe C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe C:\WINDOWS\system32\algsrv.exe C:\Program Files\Logitech\SetPoint\SetPoint.exe C:\Program Files\Common Files\Logitech\KHAL\KHALMNPR.EXE C:\PROGRA~1\MOZILL~1\FIREFOX.EXE C:\WINDOWS\system32\wuauclt.exe C:\Documents and Settings\empty\Pulpit\HiJackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" O4 - HKLM\..\Run: [ASocksrv] SocksA.exe O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033 O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe O4 - HKCU\..\Run: [BSserver] FileKan.exe O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe O8 - Extra context menu item: E&ksportuj do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra button: Wyślij do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra 'Tools' menuitem: Wyślij &do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O17 - HKLM\System\CCS\Services\Tcpip\..\{30D2FDAE-9857-40A0-A490-174FCC899185}: NameServer = 194.204.159.1 217.98.63.164 O17 - HKLM\System\CS1\Services\Tcpip\..\{30D2FDAE-9857-40A0-A490-174FCC899185}: NameServer = 194.204.159.1 217.98.63.164 O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe -- End of file - 4798 bytes

**Posty:** 18165 · przez **wojtas** 18 Lis 2007, 16:48

Wykonaj to co jest podane w tym temacie

Zastosuj SDFix . Po pobraniu uruchom go a rozpakuje się do C:\SDFix. Uruchom komputer w trybie awaryjnym (F8 przy stracie systemu). Będąc w awaryjnym uruchom plik RunThis.bat z folderu SDFixa. Zatwierdź czyszczenie przez Y. Poczekaj aż ukończy i komputer zresetuje

Potem wejdz do folderu SDFix wrzuc zawartość pliku Report.txt + log z combofixa oraz z hijacka

Autor postu otrzymał pochwałę

**Posty:** 417 · przez **empty** 18 Lis 2007, 18:38

Kod: Zaznacz wszystko: SDFix: Version 1.114 Run by empty on 2007-11-18 at 17:29 Microsoft Windows XP [Wersja 5.1.2600] Running From: C:\SDFix\SDFix Safe Mode: Checking Services: Restoring Windows Registry Values Restoring Windows Default Hosts File Rebooting... Normal Mode: Checking Files: No Trojan Files Found Removing Temp Files... ADS Check: C:\WINDOWS No streams found. C:\WINDOWS\system32 No streams found. C:\WINDOWS\system32\svchost.exe No streams found. C:\WINDOWS\system32\ntoskrnl.exe No streams found. Final Check: catchme 0.3.1262.1 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-11-18 17:31:47 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... scanning hidden services & system hive ... [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg] "s1"=dword:2df9c43f "s2"=dword:110480d0 "h0"=dword:00000001 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4] "p0"="C:\Program Files\DAEMON Tools\" "h0"=dword:00000000 "khjeh"=hex:aa,ec,d4,9b,04,b3,c7,20,08,64,89,3f,8c,cc,7a,4d,bc,45,d2,e9,df,.. [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001] "a0"=hex:20,01,00,00,a4,95,62,1e,05,74,8e,d9,44,13,2e,2e,98,cc,17,73,6a,.. "khjeh"=hex:8a,d2,97,3e,ac,5c,47,20,7c,2b,e7,1b,bd,57,0c,01,92,bf,d6,43,a7,.. [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40] "khjeh"=hex:80,a5,d5,fb,83,3c,2b,39,e3,20,e1,dc,6c,cb,ce,5b,c3,e0,94,ea,fd,.. [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41] "khjeh"=hex:42,ea,8e,0d,57,96,cc,f8,78,fb,b9,e9,65,2e,dc,e1,45,ab,df,0f,9f,.. [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf42] "khjeh"=hex:04,7b,47,d3,49,af,86,6a,13,ad,10,6d,88,c4,ae,41,32,dd,6b,d4,9e,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4] "p0"="C:\Program Files\DAEMON Tools\" "h0"=dword:00000000 "khjeh"=hex:aa,ec,d4,9b,04,b3,c7,20,08,64,89,3f,8c,cc,7a,4d,bc,45,d2,e9,df,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001] "a0"=hex:20,01,00,00,a4,95,62,1e,05,74,8e,d9,44,13,2e,2e,98,cc,17,73,6a,.. "khjeh"=hex:8a,d2,97,3e,ac,5c,47,20,7c,2b,e7,1b,bd,57,0c,01,92,bf,d6,43,a7,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40] "khjeh"=hex:80,a5,d5,fb,83,3c,2b,39,e3,20,e1,dc,6c,cb,ce,5b,c3,e0,94,ea,fd,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41] "khjeh"=hex:42,ea,8e,0d,57,96,cc,f8,78,fb,b9,e9,65,2e,dc,e1,45,ab,df,0f,9f,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf42] "khjeh"=hex:04,7b,47,d3,49,af,86,6a,13,ad,10,6d,88,c4,ae,41,32,dd,6b,d4,9e,.. scanning hidden registry entries ... [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\A\1\5\1c] "Order"=hex:08,00,00,00,02,00,00,00,b8,01,00,00,01,00,00,00,04,00,00,00,8c,.. scanning hidden files ... scan completed successfully hidden processes: 0 hidden services: 0 hidden files: 0 Remaining Services: ------------------ Authorized Application Key Export: [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "D:\\Program Files\\Microsoft Games\\Gears of War\\Binaries\\WarGame-G4WLive.exe"="D:\\Program Files\\Microsoft Games\\Gears of War\\Binaries\\WarGame-G4WLive.exe:*:Enabled:Gears of War" "C:\\Program Files\\WapSter\\AQQ\\AQQ.exe"="C:\\Program Files\\WapSter\\AQQ\\AQQ.exe:*:Enabled:P2P AQQ" "D:\\Program Files\\Steam\\SteamApps\\cugaro\\counter-strike source\\hl2.exe"="D:\\Program Files\\Steam\\SteamApps\\cugaro\\counter-strike source\\hl2.exe:*:Enabled:hl2" "C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"="C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook" "C:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"="C:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE:*:Enabled:Microsoft Office Groove" "C:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"="C:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE:*:Enabled:Microsoft Office OneNote" "C:\\Program Files\\Skype\\Phone\\Skype.exe"="C:\\Program Files\\Skype\\Phone\\Skype.exe:*:Enabled:Onet.pl - Skype" "C:\\Program Files\\Activision Value\\Soldier of Fortune Payback\\sof3.exe"="C:\\Program Files\\Activision Value\\Soldier of Fortune Payback\\sof3.exe:*:Enabled:sof3" "C:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe"="C:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe:*:Enabled:Logitech Desktop Messenger" [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list] "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "C:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe"="C:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe:*:Enabled:Logitech Desktop Messenger" Remaining Files: --------------- Files with Hidden Attributes: Sat 17 Nov 2007 49,152 ..SH. --- "C:\tel.xls.exe" Finished!

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 17:36:55, on 2007-11-18 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\wuauclt.exe C:\WINDOWS\RTHDCPL.EXE C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe C:\WINDOWS\system32\RUNDLL32.EXE C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\DAEMON Tools\daemon.exe C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe C:\WINDOWS\system32\algsrv.exe C:\Program Files\Logitech\SetPoint\SetPoint.exe C:\Program Files\Common Files\Logitech\KHAL\KHALMNPR.EXE C:\Program Files\Mozilla Firefox\firefox.exe C:\Documents and Settings\empty\Pulpit\HiJackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" O4 - HKLM\..\Run: [ASocksrv] SocksA.exe O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033 O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe O4 - HKCU\..\Run: [BSserver] FileKan.exe O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe O8 - Extra context menu item: E&ksportuj do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra button: Wyślij do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra 'Tools' menuitem: Wyślij &do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O17 - HKLM\System\CCS\Services\Tcpip\..\{30D2FDAE-9857-40A0-A490-174FCC899185}: NameServer = 194.204.159.1 217.98.63.164 O17 - HKLM\System\CS1\Services\Tcpip\..\{30D2FDAE-9857-40A0-A490-174FCC899185}: NameServer = 194.204.159.1 217.98.63.164 O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe -- End of file - 4771 bytes

A ComboFixa nie daje sie utworzyc bo jest expire

[ Dodano: Dzisiaj o 17:41 ]
I nie moge znaleźć działającej wersji

**Posty:** 18165 · przez **wojtas** 18 Lis 2007, 18:59

O4 - HKCU\..\Run: [BSserver] FileKan.exe
O4 - HKLM\..\Run: [ASocksrv] SocksA.exe
C:\WINDOWS\system32\algsrv.exe

skasuj pliki pogrubione do kosza i daj loga z dss'a

**Posty:** 417 · przez **empty** 18 Lis 2007, 19:24

A gdzie znajduja sie te 2 pliki :?:

**Posty:** 18165 · przez **wojtas** 18 Lis 2007, 19:48

tez najprawdopodobniej w C:\WINDOWS\system32

**Posty:** 417 · przez **empty** 18 Lis 2007, 21:05

Kod: Zaznacz wszystko: Deckard's System Scanner v20071014.68 Run by empty on 2007-11-18 20:03:27 Computer is in Normal Mode. -------------------------------------------------------------------------------- -- System Restore -------------------------------------------------------------- Successfully created a Deckard's System Scanner Restore Point. -- Last 5 Restore Point(s) -- 10: 2007-11-18 19:03:30 UTC - RP33 - Deckard's System Scanner Restore Point 9: 2007-11-18 19:00:07 UTC - RP32 - Installed Gears of War 8: 2007-11-18 18:55:41 UTC - RP31 - Installed Gears of War 7: 2007-11-18 17:37:51 UTC - RP30 - Installed Gears of War 6: 2007-11-18 17:35:43 UTC - RP29 - Installed Gears of War -- First Restore Point -- 1: 2007-11-18 16:41:11 UTC - RP24 - Punkt kontrolny systemu Backed up registry hives. Performed disk cleanup. -- HijackThis (run as empty.exe) ----------------------------------------------- Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 20:03:57, on 2007-11-18 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\RTHDCPL.EXE C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe C:\WINDOWS\system32\RUNDLL32.EXE C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\DAEMON Tools\daemon.exe C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe C:\Program Files\Logitech\SetPoint\SetPoint.exe C:\Program Files\Common Files\Logitech\KHAL\KHALMNPR.EXE D:\Install\dss.exe C:\WINDOWS\system32\wuauclt.exe C:\DOCUME~1\empty\Pulpit\empty.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" O4 - HKLM\..\Run: [ASocksrv] SocksA.exe O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033 O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe O4 - HKCU\..\Run: [BSserver] FileKan.exe O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe O8 - Extra context menu item: E&ksportuj do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra button: Wyślij do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra 'Tools' menuitem: Wyślij &do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe -- End of file - 4450 bytes -- File Associations ----------------------------------------------------------- [COLOR=red].cpl - cplfile - shell\cplopen\command - rundll32.exe shell32.dll,Control_RunDLL "%1",%*[/COLOR] [COLOR=red].cpl - cplfile - shell\runas\command - rundll32.exe shell32.dll,Control_RunDLLAsUser "%1",%*[/COLOR] -- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------- S3 catchme - c:\docume~1\empty\ustawi~1\temp\catchme.sys (file missing) -- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled -------------------- All services whitelisted. -- Device Manager: Disabled ---------------------------------------------------- Class GUID: Description: Kontroler magistrali zarządzania systemem Device ID: PCI\VEN_10DE&DEV_0368&SUBSYS_0C111458&REV_A2\3&2411E6FE&0&09 Manufacturer: Name: Kontroler magistrali zarządzania systemem PNP Device ID: PCI\VEN_10DE&DEV_0368&SUBSYS_0C111458&REV_A2\3&2411E6FE&0&09 Service: Class GUID: Description: Inne urządzenia typu mostek PCI Device ID: PCI\VEN_10DE&DEV_0373&SUBSYS_E0001458&REV_A2\3&2411E6FE&0&40 Manufacturer: Name: Inne urządzenia typu mostek PCI PNP Device ID: PCI\VEN_10DE&DEV_0373&SUBSYS_E0001458&REV_A2\3&2411E6FE&0&40 Service: -- Files created between 2007-10-18 and 2007-11-18 ----------------------------- 2007-11-18 18:48:17 0 d-------- C:\Program Files\RegCleaner 2007-11-18 17:28:50 0 d-------- C:\WINDOWS\ERUNT 2007-11-16 08:58:50 0 d-------- C:\Program Files\Activision Value 2007-11-15 16:43:19 0 d-------- C:\Program Files\Skype 2007-11-15 16:43:18 0 d-------- C:\Program Files\Common Files\Skype 2007-11-15 16:18:30 0 d-------- C:\WINDOWS\Sun 2007-11-15 16:17:59 0 d-------- C:\Program Files\Java 2007-11-15 16:14:42 0 d-------- C:\Program Files\Common Files\Java 2007-11-15 14:15:30 0 d-------- C:\Program Files\Microsoft Works 2007-11-15 14:15:24 0 d-------- C:\Program Files\MSBuild 2007-11-15 14:12:42 0 d-------- C:\WINDOWS\SHELLNEW 2007-11-15 14:12:06 0 dr-h----- C:\MSOCache 2007-11-11 13:38:36 0 d-------- C:\Program Files\AutoConnect 2007-11-11 13:37:40 0 d-------- C:\Program Files\ABBYY FineReader 8.0 Professional Edition 2007-11-11 13:36:15 0 d-------- C:\USDownloader 2007-11-10 19:41:26 0 d-------- C:\Program Files\Common Files\Logitech 2007-11-10 19:41:23 0 d-------- C:\Program Files\Logitech 2007-11-10 16:32:26 0 d-------- C:\WINDOWS\nview 2007-11-10 16:31:55 0 d-------- C:\NVIDIA 2007-11-10 16:27:04 0 d-------- C:\Program Files\WapSter 2007-11-10 10:26:42 0 d-------- C:\Program Files\DAEMON Tools 2007-11-10 10:22:35 685816 --a------ C:\WINDOWS\system32\drivers\sptd.sys 2007-11-10 10:17:55 1395 --a------ C:\WINDOWS\mozver.dat 2007-11-10 10:16:49 0 --a------ C:\WINDOWS\nsreg.dat 2007-11-10 10:14:11 0 d-------- C:\Program Files\Thomson 2007-11-10 10:13:57 0 d-------- C:\Program Files\Neostrada TP 2007-11-10 10:11:57 0 d--hs---- C:\WINDOWS\ftpcache 2007-11-10 09:58:37 0 d-------- C:\WINDOWS\system32\Lang 2007-11-10 09:57:21 135168 -r------- C:\WINDOWS\system32\RtlCPAPI.dll <Not Verified; ; RtlCPAPI Module> 2007-11-10 09:57:21 40960 -r------- C:\WINDOWS\system32\ChCfg.exe 2007-11-10 09:57:10 0 d-------- C:\WINDOWS\system32\RTCOM 2007-11-10 09:57:03 86016 -r------- C:\WINDOWS\SoundMan.exe <Not Verified; Realtek Semiconductor Corp.; Realtek HD Sound Manager> 2007-11-10 09:57:02 2879488 -r------- C:\WINDOWS\SkyTel.exe <Not Verified; Realtek Semiconductor Corp.; Realtek Voice Manager> 2007-11-10 09:57:02 364544 -r------- C:\WINDOWS\RtlUpd.exe <Not Verified; Realtek Semiconductor Corp.; Realtek AC'97 Update and remove driver Tool> 2007-11-10 09:57:00 4279296 -r------- C:\WINDOWS\system32\drivers\RtkHDAud.Sys <Not Verified; Realtek Semiconductor Corp.; Realtek(r) High Definition Audio Function Driver (HRTF data Copyright 1994 by MIT Media Lab)> 2007-11-10 09:56:56 9709568 -r------- C:\WINDOWS\RTLCPL.exe <Not Verified; Realtek Semiconductor Corp.; Realtek Audio Sound Effect Manager> 2007-11-10 09:56:47 16208384 -r------- C:\WINDOWS\RTHDCPL.exe <Not Verified; Realtek Semiconductor Corp.; Realtek HD Audio Sound Effect Manager> 2007-11-10 09:56:46 2158592 -r------- C:\WINDOWS\MicCal.exe <Not Verified; Realtek Semiconductor Corp.; Realtek Audio Microphone Calibration> 2007-11-10 09:56:44 69632 -r------- C:\WINDOWS\Alcmtr.exe <Not Verified; Realtek Semiconductor Corp.; Realtek AC97 Audio - Event Monitor> 2007-11-10 09:56:42 2808832 -r------- C:\WINDOWS\alcwzrd.exe <Not Verified; RealTek Semicoductor Corp.; ALCWZRD> 2007-11-10 09:56:42 0 d-------- C:\Program Files\Realtek 2007-11-10 09:56:39 487424 -r------- C:\WINDOWS\RtlExUpd.dll <Not Verified; Realtek Semiconductor Corp.; RtlExUpd Dynamic Link Library> 2007-11-10 09:56:06 0 d-------- C:\WINDOWS\system32\ReinstallBackups 2007-11-10 09:56:05 0 d--h----- C:\Program Files\InstallShield Installation Information 2007-11-10 09:56:05 0 d-------- C:\Program Files\AMD 2007-11-10 09:55:42 0 d-------- C:\WINDOWS\NV460652.TMP 2007-11-10 09:55:33 0 d-------- C:\Program Files\Common Files\InstallShield 2007-11-09 22:50:58 0 d--hs---- C:\WINDOWS\Installer 2007-11-09 22:50:58 0 d-------- C:\Program Files\Common Files\ODBC 2007-11-09 22:50:55 0 dr------- C:\Program Files 2007-11-09 22:50:55 0 d-------- C:\Program Files\Common Files 2007-11-09 22:50:55 0 d-------- C:\Program Files\Common Files\SpeechEngines 2007-11-09 22:48:43 0 d-------- C:\WINDOWS\system32\CatRoot2 2007-11-09 22:48:43 0 d-------- C:\WINDOWS\system32\CatRoot 2007-11-09 22:48:19 0 d-------- C:\Documents and Settings 2007-11-09 22:48:18 0 d--hs---- C:\System Volume Information 2007-11-09 22:44:07 0 d-------- C:\WINDOWS 2007-11-09 22:44:07 0 d-------- C:\WINDOWS\WinSxS 2007-11-09 22:44:07 0 dr------- C:\WINDOWS\Web 2007-11-09 22:44:07 0 d-------- C:\WINDOWS\twain_32 2007-11-09 22:44:07 0 d-------- C:\WINDOWS\system32 2007-11-09 22:44:07 0 d-------- C:\WINDOWS\system32\wins 2007-11-09 22:44:07 0 d-------- C:\WINDOWS\system32\wbem 2007-11-09 22:44:07 0 d-------- C:\WINDOWS\system32\usmt 2007-11-09 22:44:07 0 d-------- C:\WINDOWS\system32\spool 2007-11-09 22:44:07 0 d-------- C:\WINDOWS\system32\ShellExt 2007-11-09 22:44:07 0 d-------- C:\WINDOWS\system32\Setup 2007-11-09 22:44:07 0 d-------- C:\WINDOWS\system32\ras 2007-11-09 22:44:07 0 d-------- C:\WINDOWS\system32\oobe 2007-11-09 22:44:07 0 d-------- C:\WINDOWS\system32\npp 2007-11-09 22:44:07 0 d-------- C:\WINDOWS\system32\mui 2007-11-09 22:44:07 0 d-------- C:\WINDOWS\system32\inetsrv 2007-11-09 22:44:07 0 d-------- C:\WINDOWS\system32\IME 2007-11-09 22:44:07 0 d-------- C:\WINDOWS\system32\icsxml 2007-11-09 22:44:07 0 d-------- C:\WINDOWS\system32\ias 2007-11-09 22:44:07 0 d-------- C:\WINDOWS\system32\export 2007-11-09 22:44:07 0 d-------- C:\WINDOWS\system32\drivers 2007-11-09 22:44:07 0 d-------- C:\WINDOWS\system32\drivers\etc 2007-11-09 22:44:07 0 d-------- C:\WINDOWS\system32\drivers\disdn 2007-11-09 22:44:07 0 dr-hs--c- C:\WINDOWS\system32\dllcache 2007-11-09 22:44:07 0 d-------- C:\WINDOWS\system32\dhcp 2007-11-09 22:44:07 0 d-------- C:\WINDOWS\system32\config 2007-11-09 22:44:07 0 d-------- C:\WINDOWS\system32\3com_dmi 2007-11-09 22:44:07 0 d-------- C:\WINDOWS\system32\3076 2007-11-09 22:44:07 0 d-------- C:\WINDOWS\system32\2052 2007-11-09 22:44:07 0 d-------- C:\WINDOWS\system32\1054 2007-11-09 22:44:07 0 d-------- C:\WINDOWS\system32\1045 2007-11-09 22:44:07 0 d-------- C:\WINDOWS\system32\1042 2007-11-09 22:44:07 0 d-------- C:\WINDOWS\system32\1041 2007-11-09 22:44:07 0 d-------- C:\WINDOWS\system32\1037 2007-11-09 22:44:07 0 d-------- C:\WINDOWS\system32\1033 2007-11-09 22:44:07 0 d-------- C:\WINDOWS\system32\1031 2007-11-09 22:44:07 0 d-------- C:\WINDOWS\system32\1028 2007-11-09 22:44:07 0 d-------- C:\WINDOWS\system32\1025 2007-11-09 22:44:07 0 d-------- C:\WINDOWS\system 2007-11-09 22:44:07 0 d-------- C:\WINDOWS\security 2007-11-09 22:44:07 0 d-------- C:\WINDOWS\Resources 2007-11-09 22:44:07 0 d-------- C:\WINDOWS\repair 2007-11-09 22:44:07 0 d-------- C:\WINDOWS\Provisioning 2007-11-09 22:44:07 0 d-------- C:\WINDOWS\PeerNet 2007-11-09 22:44:07 0 d-------- C:\WINDOWS\pchealth 2007-11-09 22:44:07 0 d-------- C:\WINDOWS\mui 2007-11-09 22:44:07 0 d-------- C:\WINDOWS\msapps 2007-11-09 22:44:07 0 d-------- C:\WINDOWS\msagent 2007-11-09 22:44:07 0 d-------- C:\WINDOWS\Media 2007-11-09 22:44:07 0 d-------- C:\WINDOWS\java 2007-11-09 22:44:07 0 d--h----- C:\WINDOWS\inf 2007-11-09 22:44:07 0 d-------- C:\WINDOWS\ime 2007-11-09 22:44:07 0 d-------- C:\WINDOWS\Help 2007-11-09 22:44:07 0 dr--s---- C:\WINDOWS\Fonts 2007-11-09 22:44:07 0 d-------- C:\WINDOWS\ehome 2007-11-09 22:44:07 0 d-------- C:\WINDOWS\Driver Cache 2007-11-09 22:44:07 0 d-------- C:\WINDOWS\Debug 2007-11-09 22:44:07 0 d-------- C:\WINDOWS\Cursors 2007-11-09 22:44:07 0 d-------- C:\WINDOWS\Connection Wizard 2007-11-09 22:44:07 0 d-------- C:\WINDOWS\Config 2007-11-09 22:44:07 0 d-------- C:\WINDOWS\AppPatch 2007-11-09 22:44:07 0 d-------- C:\WINDOWS\addins 2007-11-09 22:25:19 0 d-------- C:\WINDOWS\SoftwareDistribution 2007-11-09 22:25:18 0 d---s---- C:\WINDOWS\system32\Microsoft 2007-11-09 22:25:18 0 d-------- C:\WINDOWS\Prefetch 2007-11-09 21:59:14 0 d-------- C:\WINDOWS\system32\xircom 2007-11-09 21:59:14 0 d-------- C:\Program Files\microsoft frontpage 2007-11-09 21:58:56 0 -rahs---- C:\MSDOS.SYS 2007-11-09 21:58:56 0 -rahs---- C:\IO.SYS 2007-11-09 21:58:56 0 --a------ C:\CONFIG.SYS 2007-11-09 21:58:56 0 --a------ C:\AUTOEXEC.BAT 2007-11-09 21:58:06 0 dr------- C:\WINDOWS\Offline Web Pages 2007-11-09 21:58:06 0 d---s---- C:\WINDOWS\Downloaded Program Files 2007-11-09 21:57:58 0 d--h----- C:\Program Files\WindowsUpdate 2007-11-09 21:57:56 0 d-------- C:\Program Files\Usługi online 2007-11-09 21:57:44 0 d-------- C:\WINDOWS\system32\DirectX 2007-11-09 21:57:15 0 d---s---- C:\WINDOWS\Tasks 2007-11-09 21:57:14 0 d-------- C:\Program Files\Common Files\MSSoap 2007-11-09 21:57:10 0 d-------- C:\WINDOWS\system32\Macromed 2007-11-09 21:57:10 0 d-------- C:\WINDOWS\srchasst 2007-11-09 21:57:03 0 d-------- C:\Program Files\Movie Maker 2007-11-09 21:56:56 0 d-------- C:\WINDOWS\system32\Restore 2007-11-09 21:56:24 21856 --a------ C:\WINDOWS\system32\emptyregdb.dat 2007-11-09 21:56:13 0 d-------- C:\WINDOWS\Registration 2007-11-09 21:56:04 0 d-------- C:\Program Files\Messenger 2007-11-09 21:56:00 0 d-------- C:\Program Files\MSN Gaming Zone 2007-11-09 21:55:36 0 d-------- C:\Program Files\Windows NT 2007-11-09 21:55:33 0 d-------- C:\WINDOWS\system32\MsDtc 2007-11-09 21:55:32 0 d-------- C:\WINDOWS\system32\Com 2007-10-28 16:52:00 1626112 --a------ C:\WINDOWS\system32\nwiz.exe 2007-10-28 16:52:00 1019904 --a------ C:\WINDOWS\system32\nvwimg.dll 2007-10-28 16:52:00 1703936 --a------ C:\WINDOWS\system32\nvwdmcpl.dll 2007-10-28 16:52:00 466944 --a------ C:\WINDOWS\system32\nvshell.dll 2007-10-28 16:52:00 286720 --a------ C:\WINDOWS\system32\nvnt4cpl.dll 2007-10-28 16:52:00 1478656 --a------ C:\WINDOWS\system32\nview.dll 2007-10-28 16:52:00 1339392 --a------ C:\WINDOWS\system32\nvdspsch.exe 2007-10-28 16:52:00 442368 --a------ C:\WINDOWS\system32\nvappbar.exe 2007-10-28 16:52:00 425984 --a------ C:\WINDOWS\system32\keystone.exe -- Find3M Report --------------------------------------------------------------- 2007-11-18 19:52:38 355830 --a------ C:\WINDOWS\system32\perfh015.dat 2007-11-18 19:52:38 49712 --a------ C:\WINDOWS\system32\perfc015.dat 2007-11-15 17:06:17 0 d-------- C:\Documents and Settings\empty\Dane aplikacji\Skype 2007-11-15 16:44:12 0 d-------- C:\Documents and Settings\empty\Dane aplikacji\skypePM 2007-11-15 16:18:30 0 d-------- C:\Documents and Settings\empty\Dane aplikacji\Sun 2007-11-11 13:38:24 0 d-------- C:\Documents and Settings\empty\Dane aplikacji\ABBYY 2007-11-10 19:43:34 0 d-------- C:\Documents and Settings\empty\Dane aplikacji\Logitech 2007-11-10 11:29:38 0 d-------- C:\Documents and Settings\empty\Dane aplikacji\InstallShield 2007-11-10 11:07:59 0 d-------- C:\Documents and Settings\empty\Dane aplikacji\Microsoft Games 2007-11-10 10:18:47 0 d-------- C:\Documents and Settings\empty\Dane aplikacji\Macromedia 2007-11-10 10:16:48 0 d-------- C:\Documents and Settings\empty\Dane aplikacji\Mozilla 2007-11-09 22:50:31 62 --ahs---- C:\Documents and Settings\empty\Dane aplikacji\desktop.ini 2007-11-09 22:26:26 0 d-------- C:\Documents and Settings\empty\Dane aplikacji\Identities -- Registry Dump --------------------------------------------------------------- *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "RTHDCPL"="RTHDCPL.EXE" [2006-05-27 03:47 C:\WINDOWS\RTHDCPL.exe] "SkyTel"="SkyTel.EXE" [2006-05-16 11:04 C:\WINDOWS\SkyTel.exe] "SpeedTouch USB Diagnostics"="C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" [2004-01-26 11:38] "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-10-28 16:52] "nwiz"="nwiz.exe" [2007-10-28 16:52 C:\WINDOWS\system32\nwiz.exe] "NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-10-28 16:52] "Logitech Hardware Abstraction Layer"="KHALMNPR.EXE" [2005-07-22 23:25 C:\WINDOWS\KHALMNPR.Exe] "GrooveMonitor"="C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-27 00:47] "ASocksrv"="SocksA.exe" [] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-03 23:44] "DAEMON Tools"="C:\Program Files\DAEMON Tools\daemon.exe" [2007-08-22 13:06] "LDM"="C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe" [2007-11-17 13:51] "BSserver"="FileKan.exe" [] C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\ Logitech Desktop Messenger.lnk - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe [2007-11-17 13:51:10] Logitech SetPoint.lnk - C:\Program Files\Logitech\SetPoint\SetPoint.exe [2007-11-10 19:41:25] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\C] Auto\command- C:\tel.xls.exe AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL tel.xls.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\D] Auto\command- D:\tel.xls.exe AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL tel.xls.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{2f906789-9479-11dc-96af-000e50b3ca7f}] Auto\command- K:\tel.xls.exe AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL tel.xls.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{76a0da80-95d8-11dc-8c56-806d6172696f}] Auto\command- K:\tel.xls.exe AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL tel.xls.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{76a0da81-95d8-11dc-8c56-806d6172696f}] Auto\command- L:\tel.xls.exe AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL tel.xls.exe -- End of Deckard's System Scanner: finished at 2007-11-18 20:04:54 ------------

[ Dodano: Dzisiaj o 20:07 ]
Po tych czyszczeniach i instalowaniach nie chce mi sie zainstalować Gears of War
pokazuje się coś takiego

możliwe że to przez wwdc :?:

**Posty:** 18165 · przez **wojtas** 18 Lis 2007, 21:40

daj loga z combofixa tylko przed uzyciem zmien date w komputerze na np. 10.11.2007 ( zeby byla wczesniejsza niz dzisiejszy dzien)

**Posty:** 417 · przez **empty** 18 Lis 2007, 21:53

Kod: Zaznacz wszystko: ComboFix 07-11-08.1 - empty 2007-11-10 20:47:53.1 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.689 [GMT 1:00] Running from: D:\Install\ComboFix.exe * Created a new restore point . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\autorun.inf C:\tel.xls.exe C:\WINDOWS\ufdata2000.log D:\Autorun.inf D:\tel.xls.exe . ((((((((((((((((((((((((( Files Created from 2007-10-10 to 2007-11-10 ))))))))))))))))))))))))))))))) . 2007-11-18 20:06 <DIR> d-------- C:\WINDOWS\LastGood 2007-11-18 18:48 <DIR> d-------- C:\Program Files\RegCleaner 2007-11-18 17:34 51,200 --a------ C:\WINDOWS\NirCmd.exe 2007-11-18 17:28 <DIR> d-------- C:\WINDOWS\ERUNT 2007-11-17 13:51 127,034 -r------- C:\WINDOWS\bwUnin-8.1.1.50-8876480SL.exe 2007-11-16 08:58 <DIR> d-------- C:\Program Files\Activision Value 2007-11-15 19:15 26,496 --a--c--- C:\WINDOWS\system32\dllcache\usbstor.sys 2007-11-15 16:44 <DIR> d-------- C:\Documents and Settings\empty\Dane aplikacji\skypePM 2007-11-15 16:44 32 --a------ C:\Documents and Settings\All Users\Dane aplikacji\ezsid.dat 2007-11-15 16:43 <DIR> d-------- C:\Program Files\Skype 2007-11-15 16:43 <DIR> d-------- C:\Program Files\Common Files\Skype 2007-11-15 16:43 <DIR> d-------- C:\Documents and Settings\empty\Dane aplikacji\Skype 2007-11-15 16:43 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Skype 2007-11-15 16:18 <DIR> d-------- C:\WINDOWS\Sun 2007-11-15 16:17 <DIR> d-------- C:\Program Files\Java 2007-11-15 16:14 <DIR> d-------- C:\Program Files\Common Files\Java 2007-11-15 14:16 32,592 --a------ C:\WINDOWS\system32\msonpmon.dll 2007-11-15 14:15 <DIR> d-------- C:\Program Files\MSBuild 2007-11-15 14:15 <DIR> d-------- C:\Program Files\Microsoft Works 2007-11-15 14:12 <DIR> d-------- C:\WINDOWS\SHELLNEW 2007-11-15 14:12 <DIR> dr-h----- C:\MSOCache 2007-11-15 14:12 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Microsoft Help 2007-11-11 13:38 <DIR> d-------- C:\Program Files\AutoConnect 2007-11-11 13:38 <DIR> d-------- C:\Documents and Settings\empty\Dane aplikacji\ABBYY 2007-11-11 13:37 <DIR> d-------- C:\Program Files\ABBYY FineReader 8.0 Professional Edition 2007-11-11 13:36 <DIR> d-------- C:\USDownloader 2007-11-10 19:44 12,160 --a------ C:\WINDOWS\system32\drivers\mouhid.sys 2007-11-10 19:44 12,160 --a--c--- C:\WINDOWS\system32\dllcache\mouhid.sys 2007-11-10 19:43 <DIR> d-------- C:\Documents and Settings\empty\Dane aplikacji\Logitech 2007-11-10 19:42 118,784 -r------- C:\WINDOWS\bwUnin-7.2.0.137-8876480SL.exe 2007-11-10 19:41 <DIR> d-------- C:\Program Files\Logitech 2007-11-10 19:41 <DIR> d-------- C:\Program Files\Common Files\Logitech 2007-11-10 19:40 31,616 --a------ C:\WINDOWS\system32\drivers\usbccgp.sys 2007-11-10 19:40 31,616 --a--c--- C:\WINDOWS\system32\dllcache\usbccgp.sys 2007-11-10 16:32 <DIR> d-------- C:\WINDOWS\nview 2007-11-10 16:32 356,352 --a------ C:\WINDOWS\system32\NVUNINST.EXE 2007-11-10 16:32 356,352 --a------ C:\WINDOWS\system32\nvudisp.exe 2007-11-10 16:31 <DIR> d-------- C:\NVIDIA 2007-11-10 16:27 <DIR> d-------- C:\Program Files\WapSter 2007-11-10 16:27 <DIR> d-------- C:\Documents and Settings\empty\WapSter 2007-11-10 11:29 <DIR> d-------- C:\Documents and Settings\empty\Dane aplikacji\InstallShield 2007-11-10 11:07 <DIR> d-------- C:\Documents and Settings\empty\Dane aplikacji\Microsoft Games 2007-11-10 10:56 3,727,720 --a------ C:\WINDOWS\system32\d3dx9_35.dll 2007-11-10 10:56 3,495,784 --a------ C:\WINDOWS\system32\d3dx9_33.dll 2007-11-10 10:56 1,358,192 --a------ C:\WINDOWS\system32\D3DCompiler_35.dll 2007-11-10 10:56 1,123,696 --a------ C:\WINDOWS\system32\D3DCompiler_33.dll 2007-11-10 10:56 444,776 --a------ C:\WINDOWS\system32\d3dx10_35.dll 2007-11-10 10:56 443,752 --a------ C:\WINDOWS\system32\d3dx10_33.dll 2007-11-10 10:56 237,848 --a------ C:\WINDOWS\system32\xactengine2_4.dll 2007-11-10 10:56 81,768 --a------ C:\WINDOWS\system32\xinput1_3.dll 2007-11-10 10:56 15,128 --a------ C:\WINDOWS\system32\x3daudio1_1.dll 2007-11-10 10:26 <DIR> d-------- C:\Program Files\DAEMON Tools 2007-11-10 10:22 685,816 --a------ C:\WINDOWS\system32\drivers\sptd.sys 2007-11-10 10:17 1,395 --a------ C:\WINDOWS\mozver.dat 2007-11-10 10:16 0 --a------ C:\WINDOWS\nsreg.dat 2007-11-10 10:14 <DIR> d-------- C:\Program Files\Thomson 2007-11-10 10:14 70,688 --a------ C:\WINDOWS\system32\drivers\alcaudsl.sys 2007-11-10 10:14 53,600 --a------ C:\WINDOWS\system32\drivers\alcan5wn.sys 2007-11-10 10:14 5,606 --a------ C:\WINDOWS\system32\stci.dll 2007-11-10 10:14 5,280 --a------ C:\WINDOWS\system32\drivers\alcawh.sys 2007-11-10 10:14 3,968 --a------ C:\WINDOWS\system32\drivers\alcacr.sys 2007-11-10 10:13 <DIR> d-------- C:\Program Files\Neostrada TP 2007-11-10 10:11 <DIR> d--hs---- C:\WINDOWS\ftpcache 2007-11-10 09:58 <DIR> d-------- C:\WINDOWS\system32\Lang 2007-11-10 09:56 <DIR> d-------- C:\Program Files\Realtek 2007-11-10 09:56 <DIR> d--h----- C:\Program Files\InstallShield Installation Information 2007-11-10 09:56 <DIR> d-------- C:\Program Files\AMD 2007-11-10 09:55 <DIR> d-------- C:\Program Files\Common Files\InstallShield . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2007-11-09 20:59 --------- d-----w C:\Program Files\microsoft frontpage 2007-11-09 20:57 --------- d-----w C:\Program Files\Usługi online 2007-10-28 15:52 81,920 ----a-w C:\WINDOWS\system32\nvwddi.dll 2007-10-28 15:52 81,920 ----a-w C:\WINDOWS\system32\nvmctray.dll 2007-10-28 15:52 8,531,968 ----a-w C:\WINDOWS\system32\nvcpl.dll 2007-10-28 15:52 757,760 ----a-w C:\WINDOWS\system32\nvcplui.exe 2007-10-28 15:52 7,424,992 ----a-w C:\WINDOWS\system32\drivers\nv4_mini.sys 2007-10-28 15:52 6,901,760 ----a-w C:\WINDOWS\system32\nvoglnt.dll 2007-10-28 15:52 6,541,312 ----a-w C:\WINDOWS\system32\nvdisps.dll 2007-10-28 15:52 5,768,320 ----a-w C:\WINDOWS\system32\nv4_disp.dll 2007-10-28 15:52 466,944 ----a-w C:\WINDOWS\system32\nvshell.dll 2007-10-28 15:52 45,056 ----a-w C:\WINDOWS\system32\nvmccsrs.dll 2007-10-28 15:52 442,368 ----a-w C:\WINDOWS\system32\nvappbar.exe 2007-10-28 15:52 425,984 ----a-w C:\WINDOWS\system32\keystone.exe 2007-10-28 15:52 380,928 ----a-w C:\WINDOWS\system32\nvapi.dll 2007-10-28 15:52 35,328 ----a-w C:\WINDOWS\system32\nvcodins.dll 2007-10-28 15:52 35,328 ----a-w C:\WINDOWS\system32\nvcod.dll 2007-10-28 15:52 307,200 ----a-w C:\WINDOWS\system32\nvexpbar.dll 2007-10-28 15:52 3,698,688 ----a-w C:\WINDOWS\system32\nvvitvs.dll 2007-10-28 15:52 3,407,872 ----a-w C:\WINDOWS\system32\nvgames.dll 2007-10-28 15:52 286,720 ----a-w C:\WINDOWS\system32\nvnt4cpl.dll 2007-10-28 15:52 229,376 ----a-w C:\WINDOWS\system32\nvmccs.dll 2007-10-28 15:52 2,486,272 ----a-w C:\WINDOWS\system32\nvwss.dll 2007-10-28 15:52 188,416 ----a-w C:\WINDOWS\system32\nvmccss.dll 2007-10-28 15:52 155,716 ----a-w C:\WINDOWS\system32\nvsvc32.exe 2007-10-28 15:52 147,456 ----a-w C:\WINDOWS\system32\nvcolor.exe 2007-10-28 15:52 1,703,936 ----a-w C:\WINDOWS\system32\nvwdmcpl.dll 2007-10-28 15:52 1,626,112 ----a-w C:\WINDOWS\system32\nwiz.exe 2007-10-28 15:52 1,478,656 ----a-w C:\WINDOWS\system32\nview.dll 2007-10-28 15:52 1,339,392 ----a-w C:\WINDOWS\system32\nvdspsch.exe 2007-10-28 15:52 1,212,416 ----a-w C:\WINDOWS\system32\nvmobls.dll 2007-10-28 15:52 1,019,904 ----a-w C:\WINDOWS\system32\nvwimg.dll . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "RTHDCPL"="RTHDCPL.EXE" [2006-05-27 03:47 C:\WINDOWS\RTHDCPL.exe] "SpeedTouch USB Diagnostics"="C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" [2004-01-26 11:38] "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-10-28 16:52] "NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-10-28 16:52] "Logitech Hardware Abstraction Layer"="KHALMNPR.EXE" [2005-07-22 23:25 C:\WINDOWS\KHALMNPR.Exe] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-03 23:44] "DAEMON Tools"="C:\Program Files\DAEMON Tools\daemon.exe" [2007-08-22 13:06] "LDM"="C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe" [2007-11-17 13:51] C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\ Logitech Desktop Messenger.lnk - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe [2007-11-17 13:51:10] Logitech SetPoint.lnk - C:\Program Files\Logitech\SetPoint\SetPoint.exe [2007-11-10 19:41:25] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\C] \Shell\Auto\command - C:\tel.xls.exe \Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL tel.xls.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\D] \Shell\Auto\command - D:\tel.xls.exe \Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL tel.xls.exe . ************************************************************************** catchme 0.3.1250 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-11-10 20:48:28 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2007-11-10 20:48:39 . --- E O F ---

**Posty:** 18165 · przez **wojtas** 18 Lis 2007, 22:08

wklej do notatnika

Windows Registry Editor Version 5.00

[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\C]

[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\D]

w notatniku u góry>>>plik zapisz jako>>>Zmien rozszerzenie z TXT na Wszystkie pliki *.* >>> Zapisz pod nazwą FIX.REG

Klikasz dwa razy na powstały plik fix i dodajesz go do rejestru....

**Posty:** 417 · przez **empty** 19 Lis 2007, 10:39

Zrobione

Już chyba wszystko OK

**Posty:** 18165 · przez **wojtas** 19 Lis 2007, 18:30

tak powinno byc ok

**Posty:** 417 · przez **empty** 25 Lis 2007, 10:55

Po tym czyszczeniu zauważyłem ża jak zmieniam nazwę pliku (PPM i zmień nazwę) np jakiegoś pliku tekstowego txt to do nazwy po kropce muszę dopisać txt bo inaczej zmieni mi plik tekstowy na coś innego. Jak przywrócić aby windows sam sobie z tym radził :?:

**Posty:** 18165 · przez **wojtas** 25 Lis 2007, 14:52

narzedzia>opcje foldrow>widok>zaznacz opcje ukryj rozszerzenia znanych typow plikow...

sprawdzenie loga

Sprawdzenie loga

Kto jest na forum