wylaczanie sie

**Posty:** 105 · przez **kristof200** 26 Cze 2008, 17:50

Siema mam problem.A wlasciwie to komputer mi sie resetuje przy duzej ilosci wlaczenia komputera i wlacza mi sie niebiecki ekran ze sa bledy.

Kod: Zaznacz wszystko: C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\WERed84.dir00\Mini051008-01.dmp C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\WERed84.dir00\sysdata.xml C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\WERe528.dir00\Mini062608-02.dmp C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\WERe528.dir00\sysdata.xml

co to jest ??Mam dac log z Hijack??

**Posty:** 18165 · przez **wojtas** 26 Cze 2008, 17:51

najpierw daj numer bledu z dolu niebieskiego ekranu

**Posty:** 105 · przez **kristof200** 26 Cze 2008, 19:44

nv4_mini.sys chyba to byl niejestem pewny

**Posty:** 84 · przez **gloni** 26 Cze 2008, 19:49

kristof200 napisał(a):nv4_mini.sys chyba to byl niejestem pewny

coś mi sie wydaje jakis błąd sterownika kary graficzenj , zainstaluj jeszcze raz sterowniki do grafy i pytania :

podkrecałes kompa , grafe , zmieniałes coś w biosie ??

Uruchom też "chkdsk /f"

daj logi z combofixa i z hijackthis

**Posty:** 105 · przez **kristof200** 26 Cze 2008, 21:56

Nic niepodkrecalem.

Log hijack

Kod: Zaznacz wszystko: Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\a-squared Free\a2service.exe C:\Program Files\ESET\ESET Smart Security\ekrn.exe C:\WINDOWS\System32\nvsvc32.exe C:\Program Files\Alcohol Soft\Alcohol 52\StarWind\StarWindService.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Microsoft IntelliType Pro\type32.exe C:\Program Files\Microsoft IntelliPoint\point32.exe I:\Program Files\Hpp\HP Software Update\HPWuSchd.exe C:\WINDOWS\system32\hphmon05.exe C:\Program Files\ESET\ESET Smart Security\egui.exe C:\WINDOWS\system32\ctfmon.exe I:\Program Files\GG\Gadu-Gadu\gg.exe C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe C:\Program Files\Messenger\msmsgs.exe C:\WINDOWS\system32\HPZipm12.exe C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\system.exe C:\Program Files\PC Connectivity Solution\ServiceLayer.exe C:\WINDOWS\system32\wuauclt.exe C:\Program Files\Windows Live\Messenger\usnsvc.exe I:\Program Files\foobar\foobar2000\foobar2000.exe I:\programy\bestplayer1.0_(www.programs.pl)\bestplayer1.0.exe I:\Program Files\mozilla\firefox.exe I:\programy\hijack i combo\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.lavasoft.de/help/aw/evhelp/0.htm R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: Winamp Toolbar BHO - {25CEE8EC-5730-41bc-8B58-22DDC8AB8C20} - C:\Program Files\Winamp Toolbar\winamptb.dll O2 - BHO: Alcohol Toolbar Helper - {52D06F97-5511-43FA-8FDA-C481864FD26E} - C:\Program Files\Alcohol Toolbar\v3.2.0.0\Alcohol_Toolbar.dll O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~4\Office12\GRA8E1~1.DLL O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O3 - Toolbar: Winamp Toolbar - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - C:\Program Files\Winamp Toolbar\winamptb.dll O3 - Toolbar: Alcohol Toolbar - {4C4E7CDB-5BFC-4D74-83E2-8AE659B7EDA2} - C:\Program Files\Alcohol Toolbar\v3.2.0.0\Alcohol_Toolbar.dll O4 - HKLM\..\Run: [type32] "C:\Program Files\Microsoft IntelliType Pro\type32.exe" O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\point32.exe" O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -startup O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [HPHUPD05] I:\Program Files\Hpp\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe O4 - HKLM\..\Run: [HP Software Update] "I:\Program Files\Hpp\HP Software Update\HPWuSchd.exe" O4 - HKLM\..\Run: [HPHmon05] C:\WINDOWS\system32\hphmon05.exe O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET Smart Security\egui.exe" /hide /waitservice O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [Gadu-Gadu] "I:\Program Files\GG\Gadu-Gadu\gg.exe" /tray O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - Startup: Blaero Start Orb.lnk = ? O4 - Global Startup: system.exe O8 - Extra context menu item: &Winamp Toolbar Search - C:\Documents and Settings\All Users\Application Data\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office12\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~4\Office12\ONBttnIE.dll O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~4\Office12\ONBttnIE.dll O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O17 - HKLM\System\CCS\Services\Tcpip\..\{E3BFAE6E-1FCB-4BE5-855F-3FBC62AD6A6F}: NameServer = 217.17.34.10,217.17.34.68 O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~4\Office12\GR99D3~1.DLL O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\Windows Live\MESSEN~1\MSGRAP~1.DLL O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Fichiers communs\Microsoft Shared\Help\hxds.dll O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\Windows Live\MESSEN~1\MSGRAP~1.DLL O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\Skype4COM.dll O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - C:\Program Files\a-squared Free\a2service.exe O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET Smart Security\ekrn.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 52\StarWind\StarWindService.exe

[ Dodano: Dzisiaj o 21:56 ]

Kod: Zaznacz wszystko: ComboFix 08-06-20.4 - Propriétaire 2008-06-26 21:48:37.4 - NTFSx86 Microsoft Windows XP Édition familiale 5.1.2600.3.1252.1.1036.18.198 [GMT 2:00] Endroit: I:\sciagane\ComboFix.exe * Création d'un nouveau point de restauration * Resident AV is active [color=red][b]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/b][/color] . (((((((((((((((((((((((((((((((((((( Autres suppressions )))))))))))))))))))))))))))))))))))))))))))))))) . C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\system.exe . ((((((((((((((((((((((((((((( Fichiers créés 2008-05-26 to 2008-06-26 )))))))))))))))))))))))))))))))))))) . 2008-06-26 21:42 . 2005-11-09 00:26 38,400 --a------ C:\WINDOWS\system32\moveex.exe 2008-06-26 17:45 . 2008-06-26 17:48 <REP> d-------- C:\Program Files\Wise Disk Cleaner 2008-06-15 13:08 . 2008-06-26 15:51 625 --a------ C:\WINDOWS\wcx_ftp.ini 2008-06-15 13:00 . 2008-06-15 13:00 <REP> d-------- C:\Program Files\SmartFTP Client 2008-06-15 13:00 . 2008-06-15 13:00 <REP> d-------- C:\Documents and Settings\Propriétaire\Application Data\SmartFTP 2008-06-15 12:54 . 2008-06-15 12:56 <REP> d-------- C:\totalcmd 2008-06-15 12:54 . 2008-06-26 16:23 3,870 --a------ C:\WINDOWS\wincmd.ini 2008-06-15 12:54 . 2007-09-14 07:02 545 --a------ C:\WINDOWS\UC.PIF 2008-06-15 12:54 . 2007-09-14 07:02 545 --a------ C:\WINDOWS\RAR.PIF 2008-06-15 12:54 . 2007-09-14 07:02 545 --a------ C:\WINDOWS\PKZIP.PIF 2008-06-15 12:54 . 2007-09-14 07:02 545 --a------ C:\WINDOWS\PKUNZIP.PIF 2008-06-15 12:54 . 2007-09-14 07:02 545 --a------ C:\WINDOWS\NOCLOSE.PIF 2008-06-15 12:54 . 2007-09-14 07:02 545 --a------ C:\WINDOWS\LHA.PIF 2008-06-15 12:54 . 2007-09-14 07:02 545 --a------ C:\WINDOWS\ARJ.PIF 2008-06-15 12:02 . 2008-06-15 13:16 <REP> d-------- C:\Program Files\JalbumWin 2008-06-15 11:51 . 2008-06-15 11:59 31 --a------ C:\WINDOWS\bluevoda.ini 2008-06-15 11:10 . 2008-06-15 11:09 737,280 --a------ C:\WINDOWS\iun6002.exe 2008-06-15 11:09 . 2008-06-15 13:15 <REP> d-------- C:\Program Files\BlueVoda Website Builder 2008-06-15 11:02 . 2008-06-15 11:06 <REP> d-------- C:\Program Files\Evrsoft First Page 2006 2008-06-15 11:02 . 2005-09-23 17:02 887,296 --a------ C:\WINDOWS\system32\KsDHTMLEDLib.ocx 2008-06-15 10:47 . 2008-06-15 10:56 <REP> d-------- C:\Documents and Settings\Propriétaire\amaya 2008-06-15 10:47 . 2008-06-15 10:56 <REP> d-------- C:\Documents and Settings\Propriétaire\amaya 2008-06-15 10:46 . 2008-06-15 11:02 <REP> d-------- C:\Program Files\Amaya 2008-06-14 21:15 . 2008-06-15 13:15 <REP> d-------- C:\Program Files\A4Desk 2008-06-14 15:52 . 2008-06-14 20:42 91 --a------ C:\WINDOWS\fpxpress.ini 2008-06-14 15:51 . 2008-06-14 15:52 <REP> d--h----- C:\WINDOWS\msdownld.tmp 2008-06-14 15:51 . 2008-06-14 20:42 <REP> d-------- C:\Program Files\Microsoft FrontPage Express 2008-06-11 12:01 . 2008-05-08 16:02 203,136 -----c--- C:\WINDOWS\system32\dllcache\rmcast.sys 2008-06-11 12:00 . 2008-06-14 19:33 272,768 -----c--- C:\WINDOWS\system32\dllcache\bthport.sys 2008-06-08 17:07 . 2008-06-08 17:07 <REP> d-------- C:\Documents and Settings\Propriétaire\Application Data\InstallShield 2008-05-29 16:56 . 2008-05-29 16:56 38 --a------ C:\WINDOWS\avisplitter.INI . (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M )))))))))))))))))))))))))))))))))))))))))))))))) . 2008-06-26 18:26 --------- d-----w C:\Documents and Settings\Propriétaire\Application Data\foobar2000 2008-06-24 17:10 --------- d-----w C:\Program Files\Mozilla Thunderbird 2008-06-15 15:08 --------- d-----w C:\Documents and Settings\Propriétaire\Application Data\AdobeUM 2008-06-14 17:33 272,768 ------w C:\WINDOWS\system32\drivers\bthport.sys 2008-06-08 15:08 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-06-07 14:04 --------- d-----w C:\Program Files\Winamp 2008-05-31 12:44 --------- d-----w C:\Documents and Settings\Propriétaire\Application Data\Skype 2008-05-24 20:49 --------- d-----w C:\Program Files\Google 2008-05-23 19:22 --------- d-----w C:\Program Files\ESET 2008-05-23 18:36 --------- d-----w C:\Program Files\Kaspersky Lab 2008-05-18 21:06 --------- d-----w C:\Program Files\Windows Live 2008-05-18 19:22 --------- d-----w C:\Documents and Settings\Propriétaire\Application Data\teamspeak2 2008-05-18 09:51 79,872 ----a-w C:\WINDOWS\system32\notepad.exe 2008-05-17 20:49 --------- d-----w C:\Documents and Settings\All Users\Application Data\WLInstaller 2008-05-16 19:18 --------- d-----w C:\Program Files\TGTSoft 2008-05-14 06:09 --------- d-----w C:\Documents and Settings\All Users\Application Data\Microsoft Help 2008-05-13 17:29 --------- d-----w C:\Program Files\Comodo 2008-05-13 17:28 --------- d-----w C:\Documents and Settings\All Users\Application Data\Kaspersky Lab Setup Files 2008-05-10 17:27 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP 2008-05-10 09:56 --------- d-----w C:\Documents and Settings\Propriétaire\Application Data\Web Page Maker 2008-05-08 14:02 203,136 ----a-w C:\WINDOWS\system32\drivers\rmcast.sys 2008-05-07 05:11 1,294,336 ----a-w C:\WINDOWS\system32\quartz.dll 2008-05-04 09:19 219,648 ----a-w C:\WINDOWS\system32\uxtheme.dll 2008-05-03 20:57 96,384 ----a-w C:\WINDOWS\system32\drivers\sptd0413.sys 2008-05-01 11:20 --------- d-----w C:\Program Files\a-squared Free 2008-04-30 10:15 107,888 ----a-w C:\WINDOWS\system32\CmdLineExt.dll 2008-04-30 10:15 --------- d--h--r C:\Documents and Settings\Propriétaire\Application Data\SecuROM 2008-04-21 06:43 670,208 ----a-w C:\WINDOWS\system32\wininet.dll 2008-04-13 17:50 1,804 ----a-w C:\WINDOWS\system32\dcache.bin 2008-04-13 17:33 989,696 ----a-w C:\WINDOWS\system32\netplwiz.dll 2008-04-13 17:32 61,471 ----a-w C:\WINDOWS\system32\odbcji32.dll 2008-04-13 17:32 5,632 ----a-w C:\WINDOWS\system32\wmi.dll 2008-04-13 17:32 3,962,880 ----a-w C:\WINDOWS\system32\winntbbu.dll 2008-04-13 17:07 2,406,912 ----a-w C:\WINDOWS\system32\ntoskrnl.exe 2008-04-13 17:07 2,285,568 ----a-w C:\WINDOWS\system32\ntkrnlpa.exe 2008-04-13 17:06 4,096 ----a-w C:\WINDOWS\system32\dsprpres.dll 2008-04-13 17:04 93,184 ------w C:\WINDOWS\system32\msxml6r.dll 2008-04-13 17:03 81,920 ------w C:\WINDOWS\system32\msshavmsg.dll 2008-04-13 17:02 99,840 ----a-w C:\WINDOWS\system32\inetres.dll 2008-04-13 17:02 4,067,328 ----a-w C:\WINDOWS\system32\wmploc.dll 2008-04-13 17:01 650,240 ----a-w C:\WINDOWS\system32\shdoclc.dll 2008-04-13 16:59 200,704 ------w C:\WINDOWS\system32\wmerror.dll 2008-04-13 16:59 10,240 ----a-w C:\WINDOWS\system32\gpkrsrc.dll 2008-04-13 16:58 2,957,312 ----a-w C:\WINDOWS\system32\winbrand.dll 2008-04-13 16:58 1,845,760 ----a-w C:\WINDOWS\system32\win32k.sys 2008-04-13 16:57 70,144 ----a-w C:\WINDOWS\system32\browselc.dll 2008-04-13 16:56 57,344 ----a-w C:\WINDOWS\system32\mshtmler.dll 2008-04-13 16:55 8,704 ----a-w C:\WINDOWS\system32\asferror.dll 2008-04-13 16:54 103,936 ----a-w C:\WINDOWS\system32\dpcdll.dll 2008-04-13 09:45 17,664 ----a-w C:\WINDOWS\system32\watchdog.sys 2008-04-13 09:40 445,440 ------w C:\WINDOWS\system32\xpob2res.dll 2008-04-13 09:36 3,579,392 ----a-w C:\WINDOWS\system32\xpsp2res.dll 2008-04-13 09:35 24,064 ----a-w C:\WINDOWS\system32\pidgen.dll 2008-04-13 09:35 229,376 ----a-w C:\WINDOWS\system32\xpsp1res.dll 2008-04-13 09:31 7,424 ----a-w C:\WINDOWS\system32\kd1394.dll 2008-04-13 09:30 61,440 ----a-w C:\WINDOWS\system32\msvcrt40.dll 2008-04-13 08:37 208,384 ----a-w C:\WINDOWS\system32\rsaenh.dll 2008-04-13 08:37 138,752 ----a-w C:\WINDOWS\system32\dssenh.dll 2008-04-13 08:26 12,288 ----a-w C:\WINDOWS\system32\odbcp32r.dll 2008-04-13 08:26 12,288 ----a-w C:\WINDOWS\system32\mscpx32r.dll 2008-04-13 08:21 733,696 ----a-w C:\WINDOWS\system32\qedwipes.dll 2008-04-13 07:45 497,152 ----a-w C:\WINDOWS\system32\moricons.dll 2008-04-13 07:23 48,128 ----a-w C:\WINDOWS\system32\msprivs.dll 2008-04-13 06:39 884,736 ----a-w C:\WINDOWS\system32\msimsg.dll 2007-08-28 11:54 237,568 ----a-w C:\Program Files\mozilla firefox\plugins\CrazyTalk4Native.dll 2006-05-25 16:43 204,895 ----a-w C:\Program Files\mozilla firefox\plugins\ctdomemhelper.dll 2005-09-29 12:41 77,824 ----a-w C:\Program Files\mozilla firefox\plugins\ctframeplayerobject.dll 2006-06-19 11:10 426,081 ----a-w C:\Program Files\mozilla firefox\plugins\ctplayerobject.dll 2005-02-02 10:19 458,752 ----a-w C:\Program Files\mozilla firefox\plugins\imagickrt.dll 2006-04-10 16:35 139,264 ----a-w C:\Program Files\mozilla firefox\plugins\rlcontentclass.dll 2005-11-09 09:10 204,800 ----a-w C:\Program Files\mozilla firefox\plugins\RLMusicPacker.dll 2005-11-09 09:42 106,496 ----a-w C:\Program Files\mozilla firefox\plugins\RLMusicUnpacker.dll 2006-01-04 09:22 212,992 ----a-w C:\Program Files\mozilla firefox\plugins\RLVoicePacker.dll 2006-01-04 09:21 167,936 ----a-w C:\Program Files\mozilla firefox\plugins\RLVoiceUnpacker.dll . ------- Sigcheck ------- 2008-04-13 19:34 551424 917c64008889003e6ea19cf0793cbd72 C:\WINDOWS\ServicePackFiles\i386\winlogon.exe 2008-04-13 19:34 551424 917c64008889003e6ea19cf0793cbd72 C:\WINDOWS\system32\winlogon.exe 2008-04-13 19:34 512000 dd73d6b9f6b4cb630cf35b438b540174 C:\WINDOWS\VistaMizer\old\winlogon.exe 2005-03-02 20:13 2059008 5311776074b6c13f983dc75baeac9c0c C:\WINDOWS\$hf_mig$\KB890859\SP2QFE\ntkrnlpa.exe 2007-02-28 18:08 2061440 7a56a64eb50399613587e90292dd2aab C:\WINDOWS\$hf_mig$\KB931784\SP2QFE\ntkrnlpa.exe 2008-04-13 19:07 2285568 0c62a5263d2630b568572e7d0335179f C:\WINDOWS\ServicePackFiles\i386\ntkrnlpa.exe 2008-04-13 19:07 2285568 0c62a5263d2630b568572e7d0335179f C:\WINDOWS\system32\ntkrnlpa.exe 2008-04-13 19:07 2025984 92e82482cdb39929cf7b541a9648afae C:\WINDOWS\VistaMizer\old\ntkrnlpa.exe 2005-03-02 20:13 2181632 3e2a0a4a0c0b19fc113618a9562a3b2a C:\WINDOWS\$hf_mig$\KB890859\SP2QFE\ntoskrnl.exe 2007-02-28 18:08 2184192 8e244108562e0e452eb68dff64cb08a9 C:\WINDOWS\$hf_mig$\KB931784\SP2QFE\ntoskrnl.exe 2008-04-13 19:07 2406912 c85a9a142bdd8d7a37de6374d2b60211 C:\WINDOWS\ServicePackFiles\i386\ntoskrnl.exe 2008-04-13 19:07 2406912 c85a9a142bdd8d7a37de6374d2b60211 C:\WINDOWS\system32\ntoskrnl.exe 2008-04-13 19:07 2147328 b10c36956eb7a8b1586dbe3b43875280 C:\WINDOWS\VistaMizer\old\ntoskrnl.exe 2008-04-13 19:34 1556480 74a07b313ca2490601c9b756ba0b7a17 C:\WINDOWS\explorer.exe 2007-06-13 15:10 1037312 b795475444d6d57a572c14b9e1a29839 C:\WINDOWS\$hf_mig$\KB938828\SP2QFE\explorer.exe 2008-04-13 19:34 1556480 74a07b313ca2490601c9b756ba0b7a17 C:\WINDOWS\ServicePackFiles\i386\explorer.exe 2008-04-13 19:34 1037824 f2317622d29f9ff0f88aeecd5f60f0dd C:\WINDOWS\VistaMizer\old\explorer.exe 2008-04-13 19:34 25088 6f88a39fd32bf0be9d0bc0fd4090e9eb C:\WINDOWS\ServicePackFiles\i386\ctfmon.exe 2008-04-13 19:34 25088 6f88a39fd32bf0be9d0bc0fd4090e9eb C:\WINDOWS\system32\ctfmon.exe 2008-04-13 19:34 15360 59dc5bb82e4c8e0b3eadcfdbc44ba6e4 C:\WINDOWS\VistaMizer\old\ctfmon.exe . ((((((((((((((((((((((((((((((((( Point de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))) . . REGEDIT4 *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{25CEE8EC-5730-41bc-8B58-22DDC8AB8C20}] 2007-10-04 22:06 1135968 --a------ C:\Program Files\Winamp Toolbar\winamptb.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar] "{EBF2BA02-9094-4C5A-858B-BB198F3D8DE2}"= "C:\Program Files\Winamp Toolbar\winamptb.dll" [2007-10-04 22:06 1135968] [HKEY_CLASSES_ROOT\clsid\{ebf2ba02-9094-4c5a-858b-bb198f3d8de2}] [HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand.1] [HKEY_CLASSES_ROOT\TypeLib\{538CD77C-BFDD-49b0-9562-77419CAB89D1}] [HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand] [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser] "{EBF2BA02-9094-4C5A-858B-BB198F3D8DE2}"= C:\Program Files\Winamp Toolbar\winamptb.dll [2007-10-04 22:06 1135968] [HKEY_CLASSES_ROOT\clsid\{ebf2ba02-9094-4c5a-858b-bb198f3d8de2}] [HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand.1] [HKEY_CLASSES_ROOT\TypeLib\{538CD77C-BFDD-49b0-9562-77419CAB89D1}] [HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2008-04-13 19:34 25088] "Gadu-Gadu"="I:\Program Files\GG\Gadu-Gadu\gg.exe" [2007-07-09 09:39 2119104] "MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 11:34 5724184] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "type32"="C:\Program Files\Microsoft IntelliType Pro\type32.exe" [2004-06-03 10:51 172032] "IntelliPoint"="C:\Program Files\Microsoft IntelliPoint\point32.exe" [2004-06-03 10:50 204800] "PCSuiteTrayApplication"="C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe" [2007-06-18 15:10 271360] "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2004-08-02 21:03 4493312] "HPHUPD05"="I:\Program Files\Hpp\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe" [2003-08-21 06:23 49152] "HP Software Update"="I:\Program Files\Hpp\HP Software Update\HPWuSchd.exe" [2003-06-25 12:24 49152] "HPHmon05"="C:\WINDOWS\system32\hphmon05.exe" [2003-08-21 06:16 483328] "egui"="C:\Program Files\ESET\ESET Smart Security\egui.exe" [2007-12-21 08:21 1443072] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2008-04-13 19:34 25088] "Nokia.PCSync"="C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2007-06-19 10:17 1241088] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "SynchronousMachineGroupPolicy"= 0 (0x0) "SynchronousUserGroupPolicy"= 0 (0x0) [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer] "NoStrCmpLogical"= 0 (0x0) "NoResolveSearch"= 1 (0x1) [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] "NoSMBalloonTip"= 1 (0x1) [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "msacm.l3acm"= l3codecp.acm "vidc.avrn"= AvidAVICodec.dll "VIDC.YV12"= yv12vfw.dll [HKLM\~\startupfolder\C:^Documents and Settings^Propriétaire^Menu Démarrer^Programmes^Démarrage^Adobe Gamma.lnk] path=C:\Documents and Settings\Propriétaire\Menu Démarrer\Programmes\Démarrage\Adobe Gamma.lnk backup=C:\WINDOWS\pss\Adobe Gamma.lnkStartup [HKLM\~\startupfolder\C:^Documents and Settings^Propriétaire^Menu Démarrer^Programmes^Démarrage^OneNote 2007 Screen Clipper and Launcher.lnk] path=C:\Documents and Settings\Propriétaire\Menu Démarrer\Programmes\Démarrage\OneNote 2007 Screen Clipper and Launcher.lnk backup=C:\WINDOWS\pss\OneNote 2007 Screen Clipper and Launcher.lnkStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AWMON] I:\PROGRA~1\Ad-Aware\AD-AWA~1\Ad-Watch.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BluetoothAuthenticationAgent] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BOC-425] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\cctray] I:\Program Files\Ca\cctray\cctray.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE] --a------ 2008-04-13 19:34 25088 C:\WINDOWS\system32\ctfmon.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools-1033] --a------ 2004-08-22 17:05 81920 I:\Program Files\Deamon\daemon.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Gadu-Gadu] --a------ 2007-07-09 09:39 2119104 I:\Program Files\GG\Gadu-Gadu\gg.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GrooveMonitor] --a------ 2006-10-27 00:47 31016 C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HPDJ Taskbar Utility] --a------ 2003-07-25 23:14 188416 C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Konnekt] C:\Program Files\Konnekt\konnekt.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon] -ra------ 2004-08-02 21:03 4493312 C:\WINDOWS\System32\NvCpl.dll [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter] -ra------ 2004-08-02 21:03 86016 C:\WINDOWS\System32\NvMcTray.dll [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz] -ra------ 2004-08-02 21:03 917504 C:\WINDOWS\system32\nwiz.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Orb] --a------ 2007-10-08 02:18 360448 C:\Program Files\Winamp Remote\bin\OrbTray.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype] -ra------ 2007-10-18 19:47 21147944 C:\Program Files\Skype\Phone\Skype.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched] --a------ 2007-10-01 14:45 32881 C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent] C:\Program Files\Winamp\winampa.exe [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"= "C:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"= "C:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"= "I:\\Program Files\\GG\\Gadu-Gadu\\gg.exe"= "I:\\Program Files\\NAPI-PROJEKT\\napisy.exe"= "C:\\Program Files\\Winamp Remote\\bin\\Orb.exe"= "C:\\Program Files\\Winamp Remote\\bin\\OrbTray.exe"= "C:\\Program Files\\Winamp Remote\\bin\\OrbStreamerClient.exe"= "C:\\WINDOWS\\system32\\dplaysvr.exe"= "I:\\Bartek\\Stronghold Crusader.exe"= "C:\\WINDOWS\\system32\\dpvsetup.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"= "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"= "C:\\Program Files\\Skype\\Phone\\Skype.exe"= "C:\\Program Files\\SmartFTP Client\\SmartFTP.exe"= S3 ATE_PROCMON;ATE_PROCMON;I:\Program Files\Anti Trojan Elite\ATEPMon.sys [] S3 CV2K1;CommView Network Monitor;C:\WINDOWS\system32\DRIVERS\cv2k1.sys [] S3 hitmanpro2;Hitman Pro 2 Driver;C:\Program Files\Hitman Pro\hitmanpro2.sys [] *Newly Created Service* - CATCHME [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{21A9A23D-5D94-45B3-B61A-89824E5F2525}] C:\WINDOWS\system32\host.exe [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{E4066320-E4AE-11CF-B1B0-00AA00BBAD66}] rundll32.exe advpack.dll,LaunchINFSection %SystemRoot%\INF\fpxpress.inf,PerUserstub . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-06-26 21:53:12 Windows 5.1.2600 Service Pack 3 NTFS Balayage processus cachés ... Balayage caché autostart entries ... Balayage des fichiers cachés ... Scan terminé avec succès Les fichiers cachés: 0 ************************************************************************** . Temps d'accomplissement: 2008-06-26 21:54:07 ComboFix-quarantined-files.txt 2008-06-26 19:54:03 Pre-Run: 1,379,033,088 octets libres Post-Run: 1,375,047,680 octets libres 277 --- E O F --- 2008-06-26 18:37:41

**Posty:** 8001 · przez **Okocza** 26 Cze 2008, 21:59

Kod: Zaznacz wszystko: O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) O4 - Startup: Blaero Start Orb.lnk = ? O4 - Global Startup: system.exe

na fix i do tego:

zastosuj smitfraudfix

http://forum.programosy.pl/specjalne-narzedzia-czyszczace-vt96631.html

potem nowe logi z CF i HJ

**Posty:** 105 · przez **kristof200** 26 Cze 2008, 22:03

o co ci chodzi "na fix " ??

**Posty:** 8001 · przez **Okocza** 26 Cze 2008, 22:04

ptaszkujesz te wpisy i klikasz "fix checked"

**Posty:** 105 · przez **kristof200** 26 Cze 2008, 22:18

Hijack

Kod: Zaznacz wszystko: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\a-squared Free\a2service.exe C:\WINDOWS\System32\nvsvc32.exe C:\Program Files\Alcohol Soft\Alcohol 52\StarWind\StarWindService.exe C:\Program Files\Microsoft IntelliType Pro\type32.exe C:\Program Files\Microsoft IntelliPoint\point32.exe I:\Program Files\Hpp\HP Software Update\HPWuSchd.exe C:\WINDOWS\system32\ctfmon.exe I:\Program Files\GG\Gadu-Gadu\gg.exe C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe C:\Program Files\Messenger\msmsgs.exe C:\Program Files\PC Connectivity Solution\ServiceLayer.exe C:\Program Files\Windows Live\Messenger\usnsvc.exe I:\Program Files\mozilla\firefox.exe C:\Program Files\ESET\ESET Smart Security\ekrn.exe C:\WINDOWS\system32\CF6834.exe I:\Program Files\foobar\foobar2000\foobar2000.exe C:\WINDOWS\system32\CF6834.exe C:\WINDOWS\explorer.exe I:\programy\hijack i combo\HijackThis.exe C:\ComboFix\pv.cfexe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.lavasoft.de/help/aw/evhelp/0.htm R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: Winamp Toolbar BHO - {25CEE8EC-5730-41bc-8B58-22DDC8AB8C20} - C:\Program Files\Winamp Toolbar\winamptb.dll O2 - BHO: Alcohol Toolbar Helper - {52D06F97-5511-43FA-8FDA-C481864FD26E} - C:\Program Files\Alcohol Toolbar\v3.2.0.0\Alcohol_Toolbar.dll O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~4\Office12\GRA8E1~1.DLL O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O3 - Toolbar: Winamp Toolbar - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - C:\Program Files\Winamp Toolbar\winamptb.dll O3 - Toolbar: Alcohol Toolbar - {4C4E7CDB-5BFC-4D74-83E2-8AE659B7EDA2} - C:\Program Files\Alcohol Toolbar\v3.2.0.0\Alcohol_Toolbar.dll O4 - HKLM\..\Run: [type32] "C:\Program Files\Microsoft IntelliType Pro\type32.exe" O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\point32.exe" O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -startup O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [HPHUPD05] I:\Program Files\Hpp\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe O4 - HKLM\..\Run: [HP Software Update] "I:\Program Files\Hpp\HP Software Update\HPWuSchd.exe" O4 - HKLM\..\Run: [HPHmon05] C:\WINDOWS\system32\hphmon05.exe O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET Smart Security\egui.exe" /hide /waitservice O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [Gadu-Gadu] "I:\Program Files\GG\Gadu-Gadu\gg.exe" /tray O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background O8 - Extra context menu item: &Winamp Toolbar Search - C:\Documents and Settings\All Users\Application Data\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office12\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~4\Office12\ONBttnIE.dll O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~4\Office12\ONBttnIE.dll O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O17 - HKLM\System\CCS\Services\Tcpip\..\{E3BFAE6E-1FCB-4BE5-855F-3FBC62AD6A6F}: NameServer = 217.17.34.10,217.17.34.68 O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~4\Office12\GR99D3~1.DLL O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\Windows Live\MESSEN~1\MSGRAP~1.DLL O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Fichiers communs\Microsoft Shared\Help\hxds.dll O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\Windows Live\MESSEN~1\MSGRAP~1.DLL O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\Skype4COM.dll O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - C:\Program Files\a-squared Free\a2service.exe O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET Smart Security\ekrn.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 52\StarWind\StarWindService.exe

[ Dodano: Dzisiaj o 22:18 ]
i combo

ComboFix 08-06-20.4 - Propriétaire 2008-06-26 22:10:12.5 - NTFSx86
Microsoft Windows XP Édition familiale 5.1.2600.3.1252.1.1036.18.131 [GMT 2:00]
Endroit: I:\sciagane\ComboFix.exe
* Resident AV is active

AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !!
.

((((((((((((((((((((((((((((( Fichiers créés 2008-05-26 to 2008-06-26 ))))))))))))))))))))))))))))))))))))
.

2008-06-26 21:42 . 2005-11-09 00:26 38,400 --a------ C:\WINDOWS\system32\moveex.exe
2008-06-26 17:45 . 2008-06-26 17:48 <REP> d-------- C:\Program Files\Wise Disk Cleaner
2008-06-15 13:08 . 2008-06-26 15:51 625 --a------ C:\WINDOWS\wcx_ftp.ini
2008-06-15 13:00 . 2008-06-15 13:00 <REP> d-------- C:\Program Files\SmartFTP Client
2008-06-15 13:00 . 2008-06-15 13:00 <REP> d-------- C:\Documents and Settings\Propriétaire\Application Data\SmartFTP
2008-06-15 12:54 . 2008-06-15 12:56 <REP> d-------- C:\totalcmd
2008-06-15 12:54 . 2008-06-26 16:23 3,870 --a------ C:\WINDOWS\wincmd.ini
2008-06-15 12:54 . 2007-09-14 07:02 545 --a------ C:\WINDOWS\UC.PIF
2008-06-15 12:54 . 2007-09-14 07:02 545 --a------ C:\WINDOWS\RAR.PIF
2008-06-15 12:54 . 2007-09-14 07:02 545 --a------ C:\WINDOWS\PKZIP.PIF
2008-06-15 12:54 . 2007-09-14 07:02 545 --a------ C:\WINDOWS\PKUNZIP.PIF
2008-06-15 12:54 . 2007-09-14 07:02 545 --a------ C:\WINDOWS\NOCLOSE.PIF
2008-06-15 12:54 . 2007-09-14 07:02 545 --a------ C:\WINDOWS\LHA.PIF
2008-06-15 12:54 . 2007-09-14 07:02 545 --a------ C:\WINDOWS\ARJ.PIF
2008-06-15 12:02 . 2008-06-15 13:16 <REP> d-------- C:\Program Files\JalbumWin
2008-06-15 11:51 . 2008-06-15 11:59 31 --a------ C:\WINDOWS\bluevoda.ini
2008-06-15 11:10 . 2008-06-15 11:09 737,280 --a------ C:\WINDOWS\iun6002.exe
2008-06-15 11:09 . 2008-06-15 13:15 <REP> d-------- C:\Program Files\BlueVoda Website Builder
2008-06-15 11:02 . 2008-06-15 11:06 <REP> d-------- C:\Program Files\Evrsoft First Page 2006
2008-06-15 11:02 . 2005-09-23 17:02 887,296 --a------ C:\WINDOWS\system32\KsDHTMLEDLib.ocx
2008-06-15 10:47 . 2008-06-15 10:56 <REP> d-------- C:\Documents and Settings\Propriétaire\amaya
2008-06-15 10:47 . 2008-06-15 10:56 <REP> d-------- C:\Documents and Settings\Propriétaire\amaya
2008-06-15 10:46 . 2008-06-15 11:02 <REP> d-------- C:\Program Files\Amaya
2008-06-14 21:15 . 2008-06-15 13:15 <REP> d-------- C:\Program Files\A4Desk
2008-06-14 15:52 . 2008-06-14 20:42 91 --a------ C:\WINDOWS\fpxpress.ini
2008-06-14 15:51 . 2008-06-14 15:52 <REP> d--h----- C:\WINDOWS\msdownld.tmp
2008-06-14 15:51 . 2008-06-14 20:42 <REP> d-------- C:\Program Files\Microsoft FrontPage Express
2008-06-11 12:01 . 2008-05-08 16:02 203,136 -----c--- C:\WINDOWS\system32\dllcache\rmcast.sys
2008-06-11 12:00 . 2008-06-14 19:33 272,768 -----c--- C:\WINDOWS\system32\dllcache\bthport.sys
2008-06-08 17:07 . 2008-06-08 17:07 <REP> d-------- C:\Documents and Settings\Propriétaire\Application Data\InstallShield
2008-05-29 16:56 . 2008-05-29 16:56 38 --a------ C:\WINDOWS\avisplitter.INI

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-06-26 20:09 --------- d-----w C:\Documents and Settings\Propriétaire\Application Data\foobar2000
2008-06-24 17:10 --------- d-----w C:\Program Files\Mozilla Thunderbird
2008-06-15 15:08 --------- d-----w C:\Documents and Settings\Propriétaire\Application Data\AdobeUM
2008-06-14 17:33 272,768 ------w C:\WINDOWS\system32\drivers\bthport.sys
2008-06-08 15:08 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-06-07 14:04 --------- d-----w C:\Program Files\Winamp
2008-05-31 12:44 --------- d-----w C:\Documents and Settings\Propriétaire\Application Data\Skype
2008-05-24 20:49 --------- d-----w C:\Program Files\Google
2008-05-23 19:22 --------- d-----w C:\Program Files\ESET
2008-05-23 18:36 --------- d-----w C:\Program Files\Kaspersky Lab
2008-05-18 21:06 --------- d-----w C:\Program Files\Windows Live
2008-05-18 19:22 --------- d-----w C:\Documents and Settings\Propriétaire\Application Data\teamspeak2
2008-05-18 09:51 79,872 ----a-w C:\WINDOWS\system32\notepad.exe
2008-05-17 20:49 --------- d-----w C:\Documents and Settings\All Users\Application Data\WLInstaller
2008-05-16 19:18 --------- d-----w C:\Program Files\TGTSoft
2008-05-14 06:09 --------- d-----w C:\Documents and Settings\All Users\Application Data\Microsoft Help
2008-05-13 17:29 --------- d-----w C:\Program Files\Comodo
2008-05-13 17:28 --------- d-----w C:\Documents and Settings\All Users\Application Data\Kaspersky Lab Setup Files
2008-05-10 17:27 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP
2008-05-10 09:56 --------- d-----w C:\Documents and Settings\Propriétaire\Application Data\Web Page Maker
2008-05-08 14:02 203,136 ----a-w C:\WINDOWS\system32\drivers\rmcast.sys
2008-05-07 05:11 1,294,336 ----a-w C:\WINDOWS\system32\quartz.dll
2008-05-04 09:19 219,648 ----a-w C:\WINDOWS\system32\uxtheme.dll
2008-05-03 20:57 96,384 ----a-w C:\WINDOWS\system32\drivers\sptd0413.sys
2008-05-01 11:20 --------- d-----w C:\Program Files\a-squared Free
2008-04-30 10:15 107,888 ----a-w C:\WINDOWS\system32\CmdLineExt.dll
2008-04-30 10:15 --------- d--h--r C:\Documents and Settings\Propriétaire\Application Data\SecuROM
2008-04-21 06:43 670,208 ----a-w C:\WINDOWS\system32\wininet.dll
2008-04-13 17:50 1,804 ----a-w C:\WINDOWS\system32\dcache.bin
2008-04-13 17:33 989,696 ----a-w C:\WINDOWS\system32\netplwiz.dll
2008-04-13 17:32 61,471 ----a-w C:\WINDOWS\system32\odbcji32.dll
2008-04-13 17:32 5,632 ----a-w C:\WINDOWS\system32\wmi.dll
2008-04-13 17:32 3,962,880 ----a-w C:\WINDOWS\system32\winntbbu.dll
2008-04-13 17:07 2,406,912 ----a-w C:\WINDOWS\system32\ntoskrnl.exe
2008-04-13 17:07 2,285,568 ----a-w C:\WINDOWS\system32\ntkrnlpa.exe
2008-04-13 17:06 4,096 ----a-w C:\WINDOWS\system32\dsprpres.dll
2008-04-13 17:04 93,184 ------w C:\WINDOWS\system32\msxml6r.dll
2008-04-13 17:03 81,920 ------w C:\WINDOWS\system32\msshavmsg.dll
2008-04-13 17:02 99,840 ----a-w C:\WINDOWS\system32\inetres.dll
2008-04-13 17:02 4,067,328 ----a-w C:\WINDOWS\system32\wmploc.dll
2008-04-13 17:01 650,240 ----a-w C:\WINDOWS\system32\shdoclc.dll
2008-04-13 16:59 200,704 ------w C:\WINDOWS\system32\wmerror.dll
2008-04-13 16:59 10,240 ----a-w C:\WINDOWS\system32\gpkrsrc.dll
2008-04-13 16:58 2,957,312 ----a-w C:\WINDOWS\system32\winbrand.dll
2008-04-13 16:58 1,845,760 ----a-w C:\WINDOWS\system32\win32k.sys
2008-04-13 16:57 70,144 ----a-w C:\WINDOWS\system32\browselc.dll
2008-04-13 16:56 57,344 ----a-w C:\WINDOWS\system32\mshtmler.dll
2008-04-13 16:55 8,704 ----a-w C:\WINDOWS\system32\asferror.dll
2008-04-13 16:54 103,936 ----a-w C:\WINDOWS\system32\dpcdll.dll
2008-04-13 09:45 17,664 ----a-w C:\WINDOWS\system32\watchdog.sys
2008-04-13 09:40 445,440 ------w C:\WINDOWS\system32\xpob2res.dll
2008-04-13 09:36 3,579,392 ----a-w C:\WINDOWS\system32\xpsp2res.dll
2008-04-13 09:35 24,064 ----a-w C:\WINDOWS\system32\pidgen.dll
2008-04-13 09:35 229,376 ----a-w C:\WINDOWS\system32\xpsp1res.dll
2008-04-13 09:31 7,424 ----a-w C:\WINDOWS\system32\kd1394.dll
2008-04-13 09:30 61,440 ----a-w C:\WINDOWS\system32\msvcrt40.dll
2008-04-13 08:37 208,384 ----a-w C:\WINDOWS\system32\rsaenh.dll
2008-04-13 08:37 138,752 ----a-w C:\WINDOWS\system32\dssenh.dll
2008-04-13 08:26 12,288 ----a-w C:\WINDOWS\system32\odbcp32r.dll
2008-04-13 08:26 12,288 ----a-w C:\WINDOWS\system32\mscpx32r.dll
2008-04-13 08:21 733,696 ----a-w C:\WINDOWS\system32\qedwipes.dll
2008-04-13 07:45 497,152 ----a-w C:\WINDOWS\system32\moricons.dll
2008-04-13 07:23 48,128 ----a-w C:\WINDOWS\system32\msprivs.dll
2008-04-13 06:39 884,736 ----a-w C:\WINDOWS\system32\msimsg.dll
2007-08-28 11:54 237,568 ----a-w C:\Program Files\mozilla firefox\plugins\CrazyTalk4Native.dll
2006-05-25 16:43 204,895 ----a-w C:\Program Files\mozilla firefox\plugins\ctdomemhelper.dll
2005-09-29 12:41 77,824 ----a-w C:\Program Files\mozilla firefox\plugins\ctframeplayerobject.dll
2006-06-19 11:10 426,081 ----a-w C:\Program Files\mozilla firefox\plugins\ctplayerobject.dll
2005-02-02 10:19 458,752 ----a-w C:\Program Files\mozilla firefox\plugins\imagickrt.dll
2006-04-10 16:35 139,264 ----a-w C:\Program Files\mozilla firefox\plugins\rlcontentclass.dll
2005-11-09 09:10 204,800 ----a-w C:\Program Files\mozilla firefox\plugins\RLMusicPacker.dll
2005-11-09 09:42 106,496 ----a-w C:\Program Files\mozilla firefox\plugins\RLMusicUnpacker.dll
2006-01-04 09:22 212,992 ----a-w C:\Program Files\mozilla firefox\plugins\RLVoicePacker.dll
2006-01-04 09:21 167,936 ----a-w C:\Program Files\mozilla firefox\plugins\RLVoiceUnpacker.dll
.

------- Sigcheck -------

2008-04-13 19:34 551424 917c64008889003e6ea19cf0793cbd72 C:\WINDOWS\ServicePackFiles\i386\winlogon.exe
2008-04-13 19:34 551424 917c64008889003e6ea19cf0793cbd72 C:\WINDOWS\system32\winlogon.exe
2008-04-13 19:34 512000 dd73d6b9f6b4cb630cf35b438b540174 C:\WINDOWS\VistaMizer\old\winlogon.exe

2005-03-02 20:13 2059008 5311776074b6c13f983dc75baeac9c0c C:\WINDOWS\$hf_mig$\KB890859\SP2QFE\ntkrnlpa.exe
2007-02-28 18:08 2061440 7a56a64eb50399613587e90292dd2aab C:\WINDOWS\$hf_mig$\KB931784\SP2QFE\ntkrnlpa.exe
2008-04-13 19:07 2285568 0c62a5263d2630b568572e7d0335179f C:\WINDOWS\ServicePackFiles\i386\ntkrnlpa.exe
2008-04-13 19:07 2285568 0c62a5263d2630b568572e7d0335179f C:\WINDOWS\system32\ntkrnlpa.exe
2008-04-13 19:07 2025984 92e82482cdb39929cf7b541a9648afae C:\WINDOWS\VistaMizer\old\ntkrnlpa.exe

2005-03-02 20:13 2181632 3e2a0a4a0c0b19fc113618a9562a3b2a C:\WINDOWS\$hf_mig$\KB890859\SP2QFE\ntoskrnl.exe
2007-02-28 18:08 2184192 8e244108562e0e452eb68dff64cb08a9 C:\WINDOWS\$hf_mig$\KB931784\SP2QFE\ntoskrnl.exe
2008-04-13 19:07 2406912 c85a9a142bdd8d7a37de6374d2b60211 C:\WINDOWS\ServicePackFiles\i386\ntoskrnl.exe
2008-04-13 19:07 2406912 c85a9a142bdd8d7a37de6374d2b60211 C:\WINDOWS\system32\ntoskrnl.exe
2008-04-13 19:07 2147328 b10c36956eb7a8b1586dbe3b43875280 C:\WINDOWS\VistaMizer\old\ntoskrnl.exe

2008-04-13 19:34 1556480 74a07b313ca2490601c9b756ba0b7a17 C:\WINDOWS\explorer.exe
2007-06-13 15:10 1037312 b795475444d6d57a572c14b9e1a29839 C:\WINDOWS\$hf_mig$\KB938828\SP2QFE\explorer.exe
2008-04-13 19:34 1556480 74a07b313ca2490601c9b756ba0b7a17 C:\WINDOWS\ServicePackFiles\i386\explorer.exe
2008-04-13 19:34 1037824 f2317622d29f9ff0f88aeecd5f60f0dd C:\WINDOWS\VistaMizer\old\explorer.exe

2008-04-13 19:34 25088 6f88a39fd32bf0be9d0bc0fd4090e9eb C:\WINDOWS\ServicePackFiles\i386\ctfmon.exe
2008-04-13 19:34 25088 6f88a39fd32bf0be9d0bc0fd4090e9eb C:\WINDOWS\system32\ctfmon.exe
2008-04-13 19:34 15360 59dc5bb82e4c8e0b3eadcfdbc44ba6e4 C:\WINDOWS\VistaMizer\old\ctfmon.exe
.
((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{25CEE8EC-5730-41bc-8B58-22DDC8AB8C20}]
2007-10-04 22:06 1135968 --a------ C:\Program Files\Winamp Toolbar\winamptb.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{EBF2BA02-9094-4C5A-858B-BB198F3D8DE2}"= "C:\Program Files\Winamp Toolbar\winamptb.dll" [2007-10-04 22:06 1135968]

[HKEY_CLASSES_ROOT\clsid\{ebf2ba02-9094-4c5a-858b-bb198f3d8de2}]
[HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand.1]
[HKEY_CLASSES_ROOT\TypeLib\{538CD77C-BFDD-49b0-9562-77419CAB89D1}]
[HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser]
"{EBF2BA02-9094-4C5A-858B-BB198F3D8DE2}"= C:\Program Files\Winamp Toolbar\winamptb.dll [2007-10-04 22:06 1135968]

[HKEY_CLASSES_ROOT\clsid\{ebf2ba02-9094-4c5a-858b-bb198f3d8de2}]
[HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand.1]
[HKEY_CLASSES_ROOT\TypeLib\{538CD77C-BFDD-49b0-9562-77419CAB89D1}]
[HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2008-04-13 19:34 25088]
"Gadu-Gadu"="I:\Program Files\GG\Gadu-Gadu\gg.exe" [2007-07-09 09:39 2119104]
"MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 11:34 5724184]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"type32"="C:\Program Files\Microsoft IntelliType Pro\type32.exe" [2004-06-03 10:51 172032]
"IntelliPoint"="C:\Program Files\Microsoft IntelliPoint\point32.exe" [2004-06-03 10:50 204800]
"PCSuiteTrayApplication"="C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe" [2007-06-18 15:10 271360]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2004-08-02 21:03 4493312]
"HPHUPD05"="I:\Program Files\Hpp\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe" [2003-08-21 06:23 49152]
"HP Software Update"="I:\Program Files\Hpp\HP Software Update\HPWuSchd.exe" [2003-06-25 12:24 49152]
"HPHmon05"="C:\WINDOWS\system32\hphmon05.exe" [2003-08-21 06:16 483328]
"egui"="C:\Program Files\ESET\ESET Smart Security\egui.exe" [2007-12-21 08:21 1443072]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2008-04-13 19:34 25088]
"Nokia.PCSync"="C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2007-06-19 10:17 1241088]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"SynchronousMachineGroupPolicy"= 0 (0x0)
"SynchronousUserGroupPolicy"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoStrCmpLogical"= 0 (0x0)
"NoResolveSearch"= 1 (0x1)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoSMBalloonTip"= 1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.l3acm"= l3codecp.acm
"vidc.avrn"= AvidAVICodec.dll
"VIDC.YV12"= yv12vfw.dll

[HKLM\~\startupfolder\C:^Documents and Settings^Propriétaire^Menu Démarrer^Programmes^Démarrage^Adobe Gamma.lnk]
path=C:\Documents and Settings\Propriétaire\Menu Démarrer\Programmes\Démarrage\Adobe Gamma.lnk
backup=C:\WINDOWS\pss\Adobe Gamma.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^Propriétaire^Menu Démarrer^Programmes^Démarrage^OneNote 2007 Screen Clipper and Launcher.lnk]
path=C:\Documents and Settings\Propriétaire\Menu Démarrer\Programmes\Démarrage\OneNote 2007 Screen Clipper and Launcher.lnk
backup=C:\WINDOWS\pss\OneNote 2007 Screen Clipper and Launcher.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AWMON]
I:\PROGRA~1\Ad-Aware\AD-AWA~1\Ad-Watch.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BluetoothAuthenticationAgent]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BOC-425]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\cctray]
I:\Program Files\Ca\cctray\cctray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE]
--a------ 2008-04-13 19:34 25088 C:\WINDOWS\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools-1033]
--a------ 2004-08-22 17:05 81920 I:\Program Files\Deamon\daemon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Gadu-Gadu]
--a------ 2007-07-09 09:39 2119104 I:\Program Files\GG\Gadu-Gadu\gg.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GrooveMonitor]
--a------ 2006-10-27 00:47 31016 C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HPDJ Taskbar Utility]
--a------ 2003-07-25 23:14 188416 C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Konnekt]
C:\Program Files\Konnekt\konnekt.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
-ra------ 2004-08-02 21:03 4493312 C:\WINDOWS\System32\NvCpl.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]
-ra------ 2004-08-02 21:03 86016 C:\WINDOWS\System32\NvMcTray.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
-ra------ 2004-08-02 21:03 917504 C:\WINDOWS\system32\nwiz.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Orb]
--a------ 2007-10-08 02:18 360448 C:\Program Files\Winamp Remote\bin\OrbTray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
-ra------ 2007-10-18 19:47 21147944 C:\Program Files\Skype\Phone\Skype.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
--a------ 2007-10-01 14:45 32881 C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent]
C:\Program Files\Winamp\winampa.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"C:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"C:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"I:\\Program Files\\GG\\Gadu-Gadu\\gg.exe"=
"I:\\Program Files\\NAPI-PROJEKT\\napisy.exe"=
"C:\\Program Files\\Winamp Remote\\bin\\Orb.exe"=
"C:\\Program Files\\Winamp Remote\\bin\\OrbTray.exe"=
"C:\\Program Files\\Winamp Remote\\bin\\OrbStreamerClient.exe"=
"C:\\WINDOWS\\system32\\dplaysvr.exe"=
"I:\\Bartek\\Stronghold Crusader.exe"=
"C:\\WINDOWS\\system32\\dpvsetup.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=
"C:\\Program Files\\SmartFTP Client\\SmartFTP.exe"=

S3 ATE_PROCMON;ATE_PROCMON;I:\Program Files\Anti Trojan Elite\ATEPMon.sys []
S3 CV2K1;CommView Network Monitor;C:\WINDOWS\system32\DRIVERS\cv2k1.sys []
S3 hitmanpro2;Hitman Pro 2 Driver;C:\Program Files\Hitman Pro\hitmanpro2.sys []

*Newly Created Service* - CATCHME

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{21A9A23D-5D94-45B3-B61A-89824E5F2525}]
C:\WINDOWS\system32\host.exe

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{E4066320-E4AE-11CF-B1B0-00AA00BBAD66}]
rundll32.exe advpack.dll,LaunchINFSection %SystemRoot%\INF\fpxpress.inf,PerUserstub
.
**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-06-26 22:17:30
Windows 5.1.2600 Service Pack 3 NTFS

Balayage processus cachés ...

Balayage caché autostart entries ...

Balayage des fichiers cachés ...

Scan terminé avec succès
Les fichiers cachés: 0

**************************************************************************
.
--------------------- DLLs a chargé sous des processus courants ---------------------

PROCESS: C:\WINDOWS\explorer.exe
-> ?:\WINDOWS\System32\msxml3.dll
.
Temps d'accomplissement: 2008-06-26 22:19:06
ComboFix-quarantined-files.txt 2008-06-26 20:18:56
ComboFix2.txt 2008-06-26 19:54:08

Pre-Run: 1,689,989,120 octets libres
Post-Run: 1,682,436,096 octets libres

277 --- E O F --- 2008-06-26 18:37:41

[ Dodano: Dzisiaj o 22:56 ]
Przed chwila znow to samo tylko ze po ponownym wlaczeniu wszystko sie normalnie wlaczylo pulpit itd i nagle paf na arabskie litery to co normalnie pisze i czarny ekran w czerwone paski ...

A blad to na 100% nv_4disp

**Posty:** 8001 · przez **Okocza** 26 Cze 2008, 23:38

A blad to na 100% nv_4disp

z tego co wyczytałem w necie to wina sterowników.

zrobiłeś:

okocza napisał(a):http://forum.programosy.pl/specjalne-narzedzia-czyszczace-vt96631.html

**Posty:** 10264 · przez **Mike** 26 Cze 2008, 23:44

kristof200 napisał(a):nv4_mini.sys

jaka masz kartę graficzną ?

**Posty:** 105 · przez **kristof200** 27 Cze 2008, 12:50

Tak czyscilem i nic niewykrylo.

NVIDIA GeForce FX 5500

Sprobuje jutro przeinstalowac sterowniki i zobacze

**Posty:** 10264 · przez **Mike** 27 Cze 2008, 13:05

Przeinstaluj stery od grafy, ale wg. podanych niżej kroków nie pomijając żadnego:

1. sciągnij sterownik - nVidia Omega Driver 1.5672a
2. zassaj i zainstaluj program Driver Cleaner
3. odinstaluj sterowniki od karty graficznej w menadżerze urządzeń
4. następnie uruchom kompa w trybie awaryjnym (F8 podczas startu kompa)
5. programem Driver Cleaner usuń (przycisk Czyść) pozostałości po sterownikach (wszystko co będzie w nazwie nvidia)
6. uruchom kompa normalnie
7. zainstaluj nowe stery (ściągnięte z punkcie 1)

**Posty:** 105 · przez **kristof200** 29 Cze 2008, 19:03

Jak narazie sie niwylacza po przeinstalowaniu sterownikow.
Mam dac nowe logi czy nie ??

Dzieki bardzo !!

**Posty:** 10264 · przez **Mike** 29 Cze 2008, 20:13

Mam dac nowe logi czy nie ??

nie

jeżeli komp pracuje jak należy, to ok

wylaczanie sie

Wylaczanie sie

Kto jest na forum