wyskakujace okienka reklam ie

**Posty:** 205 · przez **M@zi** 25 Paź 2007, 14:45

Mam taki problem korzystam z przeglądarki Opera ale od pewnego czasu samoczynnie wyskakują reklamy które włączają sie prze IE sa najczęściej związane z tematyka ... nie wiem skąd to sie bierze proszę o pomoc.

I czy blokować takie reklamy.

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 14:39:46, on 2007-10-25 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.5730.0011) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Creative\SB Live! 24-bit\Surround Mixer\CTSysVol.exe C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe C:\Program Files\Eset\nod32kui.exe C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Common Files\Teleca Shared\CapabilityManager.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\Program Files\D-Link AirPlus\AirPlus.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\WINDOWS\system32\CTsvcCDA.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe C:\Program Files\Eset\nod32krn.exe C:\Program Files\CyberLink\Shared files\RichVideo.exe C:\Program Files\SolidDocuments\SolidConverterPDF\SCPDF\SolidPdfService.exe C:\WINDOWS\system32\MsPMSPSv.exe C:\WINDOWS\system32\wscntfy.exe C:\Program Files\Common Files\Teleca Shared\Generic.exe C:\Program Files\Sony Ericsson\Mobile2\Mobile Phone Monitor\epmworker.exe C:\Program Files\Opera\Opera.exe C:\Program Files\Gadu-Gadu\gg.exe c:\My Downloads\rapid\Generatory\Generatory\Vomistar.exe C:\totalcmd\totalcmd_.exe C:\Program Files\Winamp\winamp.exe c:\My Downloads\hijackthis.com R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.bearshare.com/pl/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: Solid Converter PDF - {259F616C-A300-44F5-B04A-ED001A26C85C} - C:\Program Files\SolidDocuments\SolidConverterPDF\SCPDF\ExploreExtPDF.dll O2 - BHO: My Global Search Bar BHO - {37B85A21-692B-4205-9CAD-2626E4993404} - C:\Program Files\MyGlobalSearch\bar\1.bin\MGSBAR.DLL O2 - BHO: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL O2 - BHO: ConnectionServices module - {6D7B211A-88EA-490c-BAB9-3600D8D7C503} - C:\Program Files\ConnectionServices\ConnectionServices.dll (file missing) O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O2 - BHO: BitAccelerator module - {92860A02-4D69-48c1-82D7-EF6B2C609502} - C:\Program Files\BitAccelerator\BitAccelerator.dll O3 - Toolbar: My Global Search Bar - {37B85A29-692B-4205-9CAD-2626E4993404} - C:\Program Files\MyGlobalSearch\bar\1.bin\MGSBAR.DLL O3 - Toolbar: &Tłumaczenie - {0D704FAD-66E9-4F0A-BFED-4F665770DDB3} - C:\Program Files\Techland\Common\InternetTranslator\InternetTranslator.dll O3 - Toolbar: Solid Converter PDF - {259F616C-A300-44F5-B04A-ED001A26C85C} - C:\Program Files\SolidDocuments\SolidConverterPDF\SCPDF\ExploreExtPDF.dll O3 - Toolbar: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\SB Live! 24-bit\Surround Mixer\CTSysVol.exe /r O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" O4 - HKLM\..\Run: [Sony Ericsson PC Suite] "C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions O4 - HKLM\..\Run: [64 inter flaw hold] C:\Documents and Settings\All Users\Dane aplikacji\Mode Rule 64 Inter\REMOTE STUPID.exe O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [bags less] C:\DOCUME~1\Rafaello\DANEAP~1\CREATI~1\sixth trust.exe O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: D-Link AirPlus.lnk = ? O8 - Extra context menu item: E&ksportuj do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra button: Wyślij do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra 'Tools' menuitem: Wyślij &do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL O9 - Extra button: (no name) - {B46B0919-62BA-4D99-A5C4-916B57A6805C} - C:\Program Files\Techland\Common\InternetTranslator\InternetTranslator.dll O9 - Extra 'Tools' menuitem: @C:\Program Files\Techland\Common\InternetTranslator\InternetTranslator.dll,-103 - {B46B0919-62BA-4D99-A5C4-916B57A6805C} - C:\Program Files\Techland\Common\InternetTranslator\InternetTranslator.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra button: (no name) - SolidConverterPDF - (no file) (HKCU) O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {83AFB5CA-ED35-11D4-A452-0080C8D85045} (GameDesire Poker Games) - http://67.15.101.3/g_bin/pl/poker_2_0_0_47.cab O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{3A8603AA-0D38-4239-B401-FA7FDEA45737}: NameServer = 80.51.159.7 80.51.159.7 O17 - HKLM\System\CS1\Services\Tcpip\..\{3A8603AA-0D38-4239-B401-FA7FDEA45737}: NameServer = 80.51.159.7 80.51.159.7 O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: Ares Chatroom server (AresChatServer) - Ares Development Group - C:\Program Files\Ares\chatServer.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared files\RichVideo.exe O23 - Service: SolidPDFConverterReadSpool (ScReadSpool) - VoyagerSoft, LLC - C:\Program Files\SolidDocuments\SolidConverterPDF\SCPDF\SolidPdfService.exe -- End of file - 8709 bytes

**Posty:** 237 · przez **Kuba1** 25 Paź 2007, 15:20

Zastosuj:

Usuwanie Adware LOP

No Lop

Wyglad narzędzia:

Klikamy na Search and Destroy

Po pracy narzędzie utworzy log w lokalizacji C:\NoLop.log

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.bearshare.com/pl/
O2 - BHO: My Global Search Bar BHO - {37B85A21-692B-4205-9CAD-2626E4993404} - C:\Program Files\MyGlobalSearch\bar\1.bin\MGSBAR.DLL
O2 - BHO: ConnectionServices module - {6D7B211A-88EA-490c-BAB9-3600D8D7C503} - C:\Program Files\ConnectionServices\ConnectionServices.dll (file missing)
O2 - BHO: BitAccelerator module - {92860A02-4D69-48c1-82D7-EF6B2C609502} - C:\Program Files\BitAccelerator\BitAccelerator.dll
O3 - Toolbar: My Global Search Bar - {37B85A29-692B-4205-9CAD-2626E4993404} - C:\Program Files\MyGlobalSearch\bar\1.bin\MGSBAR.DLL
O4 - HKLM\..\Run: [64 inter flaw hold] C:\Documents and Settings\All Users\Dane aplikacji\Mode Rule 64 Inter\REMOTE STUPID.exe
O4 - HKCU\..\Run: [bags less] C:\DOCUME~1\Rafaello\DANEAP~1\CREATI~1\sixth trust.exe
O9 - Extra button: (no name) - SolidConverterPDF - (no file) (HKCU)

Uruchom Hijackthis> Opcja Do a system scan>>Zaznacz powyższe wpisy, zanaczone foldery usun recznei w trybie awaryjnym.

Zastosuj:

Pobierz narzędzie SDFix

*Klikamy 2 krotknie na ikonę SDFix.exe,program wypakuje się domyślnie do lokalizacji C:\SDFix

*Wchodzimy do trybu awaryjnego z obsługą sieci:
>>>>>>Jak wejść do trybu awaryjnego z obsługą sieci?

*F8 podczas bootowania systemu.
*Używamy narzędzia BootSafe.exe zaznaczamy opcje Safe Mode- Networking i klikamy reboot

*Gdy już jesteśmy w trybie awaryjnym,wchodzimy do folderu SDFix i uruchamiamy narzędzie klikająć
2-krotnie na plik RunThis.bat lewym przyciskiem myszy.

*Wciskamy Y co uruchomi proces usuwania

*Kiedy proces usuwania się zakończy wciskamy dowolny klawisz>>nastąpi restart.

*Po restarcie SDFix dokończy proces usuwania,kiedy w oknie narzędzia SDFix pojawi się napis Finished
klikamy dowolny klawisz,narzędzie zakończy swoją pracę,na pulpicie załadują się ikony.

*Wchodzimy do folderu SDFix i kopiujemy zawartość pliku tekstowego Report.txt i wklejamy go na forum

Następnie daj log z ComboFix, raport z No Lop >>C:\NoLop.log i raport z SDFix >>Report.txt

**Posty:** 205 · przez **M@zi** 25 Paź 2007, 16:45

Kod: Zaznacz wszystko: ComboFix 07-10-23.1 - Rafaello 2007-10-25 16:39:15.1 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.415 [GMT 2:00] Running from: c:\My Downloads\Bezpieczenstwo\ComboFix.exe * Created a new restore point . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\Documents and Settings\Rafaello\Dane aplikacji\inst.exe C:\Program Files\myglobalsearch C:\Program Files\myglobalsearch\bar\1.bin\M9FFXTBR.JAR C:\Program Files\myglobalsearch\bar\1.bin\M9FFXTBR.MANIFEST C:\Program Files\myglobalsearch\bar\1.bin\M9NTSTBR.JAR C:\Program Files\myglobalsearch\bar\1.bin\M9NTSTBR.MANIFEST C:\Program Files\myglobalsearch\bar\1.bin\M9PLUGIN.DLL C:\Program Files\myglobalsearch\bar\1.bin\NPMYGLSH.DLL C:\Program Files\myglobalsearch\bar\Cache\[u]0[/u]01505D6 C:\Program Files\myglobalsearch\bar\Cache\[u]0[/u]0151259 C:\Program Files\myglobalsearch\bar\Cache\[u]0[/u]0152043.bin C:\Program Files\myglobalsearch\bar\Cache\[u]0[/u]0152583.bin C:\Program Files\myglobalsearch\bar\Cache\[u]0[/u]0154D00.bin C:\Program Files\myglobalsearch\bar\Cache\files.ini C:\Program Files\myglobalsearch\bar\History\search C:\Program Files\myglobalsearch\bar\Settings\prevcfg.htm . ((((((((((((((((((((((((( Files Created from 2007-09-25 to 2007-10-25 ))))))))))))))))))))))))))))))) . 2007-10-25 16:38 51,200 --a------ C:\WINDOWS\NirCmd.exe 2007-10-25 16:30 <DIR> d-------- C:\WINDOWS\ERUNT 2007-10-25 16:25 <DIR> d-------- C:\NoLopBackups 2007-10-25 16:24 132 --a------ C:\delete.bat 2007-10-24 12:29 <DIR> d-------- C:\Program Files\Lamboo v0.9.6 2007-10-21 20:36 <DIR> d-------- C:\Program Files\MIKSOFT 2007-10-16 16:48 <DIR> dr-h----- C:\Documents and Settings\Rafaello\Dane aplikacji\SecuROM 2007-10-16 16:48 107,888 --a------ C:\WINDOWS\system32\CmdLineExt.dll 2007-10-08 10:39 <DIR> d-------- C:\Program Files\creative wait bike 2007-10-04 11:12 2,297,552 --a------ C:\WINDOWS\system32\d3dx9_26.dll 2007-09-30 01:16 <DIR> d-------- C:\Documents and Settings\Rafaello\Dane aplikacji\creative wait bike 2007-09-26 22:13 <DIR> d-------- C:\Program Files\ConnectionServices 2007-09-26 22:13 <DIR> d-------- C:\Program Files\BitAccelerator . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2007-10-25 13:21 --------- d-----w C:\Program Files\eMule 2007-10-25 12:48 --------- d-----w C:\Documents and Settings\Rafaello\Dane aplikacji\SolidDocuments 2007-10-25 10:35 --------- d-----w C:\Documents and Settings\Rafaello\Dane aplikacji\MegauploadToolbar 2007-10-24 12:52 --------- d-----w C:\WINDOWS\system32\config\systemprofile\Dane aplikacji\SolidDocuments 2007-10-22 10:40 --------- d-----w C:\Program Files\Java 2007-10-13 08:29 --------- d-----w C:\Program Files\NAPI-PROJEKT 2007-10-04 09:36 --------- d--h--w C:\Program Files\InstallShield Installation Information 2007-10-01 13:53 --------- d-----w C:\Documents and Settings\Rafaello\Dane aplikacji\Vso 2007-09-20 20:59 --------- d-----w C:\Program Files\Common Files\Adobe 2007-09-20 19:43 --------- d-----w C:\Program Files\Common Files\Adobe Systems Shared 2007-09-20 19:31 --------- d-----w C:\Program Files\AliveMedia 2007-09-20 12:28 --------- d-----w C:\Program Files\K-Lite Codec Pack 2007-09-20 12:26 737,280 ----a-w C:\WINDOWS\iun6002.exe 2007-09-20 12:26 --------- d-----w C:\Program Files\Codec Pack - All In 1 2007-09-15 16:00 --------- d-----w C:\Program Files\Gadu-Gadu 2007-09-11 10:51 --------- d-----w C:\Documents and Settings\Rafaello\Dane aplikacji\MyPhoneExplorer 2007-09-11 10:50 --------- d-----w C:\Program Files\MyPhoneExplorer 2007-09-11 07:03 --------- d-----w C:\Program Files\123 DVD Clone 2007-09-09 11:02 47,360 ----a-w C:\WINDOWS\system32\drivers\pcouffin.sys 2007-09-09 11:02 47,360 ----a-w C:\Documents and Settings\Rafaello\Dane aplikacji\pcouffin.sys 2007-09-09 11:02 --------- d-----w C:\Program Files\VSO 2007-09-08 08:59 --------- d-----w C:\Program Files\MegauploadToolbar 2007-09-07 11:49 --------- d-----w C:\Program Files\Common Files\Ahead 2007-09-07 11:49 --------- d-----w C:\Program Files\Ahead 2007-09-05 13:35 --------- d-----w C:\Program Files\SolidDocuments 2007-09-05 11:24 --------- d-----w C:\Program Files\Imagenomic 2007-08-31 16:33 --------- d-----w C:\Program Files\Sony Ericsson 2007-08-31 15:25 --------- d-----w C:\Documents and Settings\Rafaello\Dane aplikacji\Teleca 2007-08-31 15:15 --------- d-----w C:\Program Files\Common Files\Teleca Shared 2007-08-31 15:11 6,144 ----a-w C:\WINDOWS\system32\drivers\k750cm.sys 2007-08-31 15:11 5,744 ----a-w C:\WINDOWS\system32\drivers\k750wh.sys 2007-08-29 14:47 --------- d-----w C:\Documents and Settings\Rafaello\Dane aplikacji\dvdcss 2007-08-29 14:46 --------- d-----w C:\Documents and Settings\Rafaello\Dane aplikacji\CyberLink 2007-08-29 14:43 --------- d-----w C:\Program Files\CyberLink 2007-08-29 13:18 --------- d-----w C:\Program Files\Elaborate Bytes 2007-08-26 13:01 --------- d-----w C:\Program Files\Emapa 2007-08-20 12:13 94,208 ----a-w C:\WINDOWS\ScUnin.exe . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{6D7B211A-88EA-490c-BAB9-3600D8D7C503}] C:\Program Files\ConnectionServices\ConnectionServices.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTSysVol"="C:\Program Files\Creative\SB Live! 24-bit\Surround Mixer\CTSysVol.exe" [2003-09-17 10:43] "UpdReg"="C:\WINDOWS\UpdReg.EXE" [2000-05-11 01:00] "ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-09-14 21:05] "nod32kui"="C:\Program Files\Eset\nod32kui.exe" [2007-07-14 13:50] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11] "Sony Ericsson PC Suite"="C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" [2005-10-26 16:17] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:44] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Adobe Reader Speed Launch.lnk] path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Adobe Reader Speed Launch.lnk backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Adobe Reader Synchronizer.lnk] path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Adobe Reader Synchronizer.lnk backup=C:\WINDOWS\pss\Adobe Reader Synchronizer.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CloneCDTray] "C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe" /s [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033 [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LanguageShortcut] "C:\Program Files\CyberLink\PowerDVD\Language\Language.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent] C:\Program Files\Winamp\winampa.exe R2 {95808DC4-FA4A-4c74-92FE-5B863F82066B};{95808DC4-FA4A-4c74-92FE-5B863F82066B};\??\C:\Program Files\CyberLink\PowerDVD\[u]0[/u]00.fcl R3 AIRPLUS;D-Link AirPlus Wireless Adapter;C:\WINDOWS\system32\DRIVERS\airplus.sys R3 axsaki;axsaki;C:\WINDOWS\system32\DRIVERS\axsaki.sys R3 axskbus;axskbus;C:\WINDOWS\system32\DRIVERS\axskbus.sys R3 P17;Sound Blaster Live! 24-bit;C:\WINDOWS\system32\drivers\P17.sys S3 SetupNTGLM7X;SetupNTGLM7X;\??\H:\NTGLM7X.sys . ************************************************************************** catchme 0.3.1232 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-10-25 16:41:47 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2007-10-25 16:42:23 - machine was rebooted . --- E O F ---

Kod: Zaznacz wszystko: NoLop! Log by Skate_Punk_21 Fix running from: c:\My Downloads\Bezpieczenstwo [2007-10-25] [16:24:39] ---Infection Files Found/Removed--- C:\WINDOWS\tasks\A776D9B9910157E9.job Beginning Removal... Rebooting...

Kod: Zaznacz wszystko: SDFix: Version 1.112 Run by Rafaello on 2007-10-25 at 16:30 Microsoft Windows XP [Wersja 5.1.2600] Running From: c:\SDFix Safe Mode: Checking Services: Restoring Windows Registry Values Restoring Windows Default Hosts File Rebooting... Normal Mode: Checking Files: No Trojan Files Found Removing Temp Files... ADS Check: C:\WINDOWS No streams found. C:\WINDOWS\system32 No streams found. C:\WINDOWS\system32\svchost.exe No streams found. C:\WINDOWS\system32\ntoskrnl.exe No streams found. Final Check: Remaining Services: ------------------ Authorized Application Key Export: [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "C:\\Program Files\\BearShare\\BearShare.exe"="C:\\Program Files\\BearShare\\BearShare.exe:*:Enabled:BearShare" "C:\\Program Files\\Ares\\Ares.exe"="C:\\Program Files\\Ares\\Ares.exe:*:Enabled:Ares p2p for windows" "C:\\Program Files\\eMule\\emule.exe"="C:\\Program Files\\eMule\\emule.exe:*:Enabled:eMule" "C:\\Program Files\\Gadu-Gadu\\gg.exe"="C:\\Program Files\\Gadu-Gadu\\gg.exe:*:Enabled:Gadu-Gadu - program g˘wny" "C:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"="C:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE:*:Enabled:Microsoft Office Groove" "C:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"="C:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE:*:Enabled:Microsoft Office OneNote" "C:\\Program Files\\Mozilla Firefox\\firefox.exe"="C:\\Program Files\\Mozilla Firefox\\firefox.exe:*:Enabled:Firefox" "D:\\3DUCPool\\coolpool.exe"="D:\\3DUCPool\\coolpool.exe:*:Disabled:Cool Pool." "C:\\Program Files\\Opera\\Opera.exe"="C:\\Program Files\\Opera\\Opera.exe:*:Enabled:Opera Internet Browser" "D:\\UnrealTournament\\System\\UnrealTournament.exe"="D:\\UnrealTournament\\System\\UnrealTournament.exe:*:Enabled:UnrealTournament" "C:\\Program Files\\CyberLink\\PowerDVD\\PowerDVD.exe"="C:\\Program Files\\CyberLink\\PowerDVD\\PowerDVD.exe:*:Enabled:CyberLink PowerDVD" "C:\\Program Files\\NAPI-PROJEKT\\napisy.exe"="C:\\Program Files\\NAPI-PROJEKT\\napisy.exe:*:Enabled:www.napiprojekt.pl" "D:\\Age Of Empires III\\age3x.exe"="D:\\Age Of Empires III\\age3x.exe:*:Enabled:Age of Empires III - The WarChiefs" "D:\\Counter-Strike\\hltv.exe"="D:\\Counter-Strike\\hltv.exe:*:Enabled:HLTV Launcher" "D:\\Counter-Strike\\hl.exe"="D:\\Counter-Strike\\hl.exe:*:Enabled:Half-Life Launcher" "C:\\Program Files\\Lamboo v0.9.6\\Lamboo.exe"="C:\\Program Files\\Lamboo v0.9.6\\Lamboo.exe:*:Enabled:Lamboo" [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list] "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" Remaining Files: --------------- Files with Hidden Attributes: Wed 29 Aug 2007 48 ..SH. --- "C:\WINDOWS\SEE937411.tmp" Finished!

**Posty:** 18165 · przez **wojtas** 25 Paź 2007, 18:49

sciagnij killbox’a

Odpalasz Killboxa zaznacz opcję Delete on Reboot następnie w polu Full Path of File to Delete wklej ścieżkę

C:\WINDOWS\SEE937411.tmp

i nacisnij x
Program będzie pytał o restart (oczywiście zgadzasz się

potem log z hijacka i combofixa

**Posty:** 205 · przez **M@zi** 25 Paź 2007, 21:56

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 21:52:36, on 2007-10-25 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.5730.0011) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\CTsvcCDA.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe C:\Program Files\Eset\nod32krn.exe C:\Program Files\CyberLink\Shared files\RichVideo.exe C:\Program Files\SolidDocuments\SolidConverterPDF\SCPDF\SolidPdfService.exe C:\WINDOWS\system32\MsPMSPSv.exe C:\WINDOWS\system32\wscntfy.exe C:\Program Files\Creative\SB Live! 24-bit\Surround Mixer\CTSysVol.exe C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe C:\Program Files\Eset\nod32kui.exe C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Common Files\Teleca Shared\CapabilityManager.exe C:\Program Files\D-Link AirPlus\AirPlus.exe C:\Program Files\Common Files\Teleca Shared\Generic.exe C:\Program Files\Sony Ericsson\Mobile2\Mobile Phone Monitor\epmworker.exe C:\Program Files\Opera\Opera.exe C:\totalcmd\totalcmd_.exe C:\WINDOWS\system32\wuauclt.exe c:\My Downloads\Bezpieczenstwo\hijackthis.com R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: Solid Converter PDF - {259F616C-A300-44F5-B04A-ED001A26C85C} - C:\Program Files\SolidDocuments\SolidConverterPDF\SCPDF\ExploreExtPDF.dll O2 - BHO: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL O2 - BHO: ConnectionServices module - {6D7B211A-88EA-490c-BAB9-3600D8D7C503} - C:\Program Files\ConnectionServices\ConnectionServices.dll (file missing) O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O3 - Toolbar: &Tłumaczenie - {0D704FAD-66E9-4F0A-BFED-4F665770DDB3} - C:\Program Files\Techland\Common\InternetTranslator\InternetTranslator.dll O3 - Toolbar: Solid Converter PDF - {259F616C-A300-44F5-B04A-ED001A26C85C} - C:\Program Files\SolidDocuments\SolidConverterPDF\SCPDF\ExploreExtPDF.dll O3 - Toolbar: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\SB Live! 24-bit\Surround Mixer\CTSysVol.exe /r O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" O4 - HKLM\..\Run: [Sony Ericsson PC Suite] "C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: D-Link AirPlus.lnk = ? O8 - Extra context menu item: E&ksportuj do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra button: Wyślij do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra 'Tools' menuitem: Wyślij &do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL O9 - Extra button: (no name) - {B46B0919-62BA-4D99-A5C4-916B57A6805C} - C:\Program Files\Techland\Common\InternetTranslator\InternetTranslator.dll O9 - Extra 'Tools' menuitem: @C:\Program Files\Techland\Common\InternetTranslator\InternetTranslator.dll,-103 - {B46B0919-62BA-4D99-A5C4-916B57A6805C} - C:\Program Files\Techland\Common\InternetTranslator\InternetTranslator.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {83AFB5CA-ED35-11D4-A452-0080C8D85045} (GameDesire Poker Games) - http://67.15.101.3/g_bin/pl/poker_2_0_0_47.cab O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{3A8603AA-0D38-4239-B401-FA7FDEA45737}: NameServer = 80.51.159.7 80.51.159.7 O17 - HKLM\System\CS1\Services\Tcpip\..\{3A8603AA-0D38-4239-B401-FA7FDEA45737}: NameServer = 80.51.159.7 80.51.159.7 O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: Ares Chatroom server (AresChatServer) - Ares Development Group - C:\Program Files\Ares\chatServer.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared files\RichVideo.exe O23 - Service: SolidPDFConverterReadSpool (ScReadSpool) - VoyagerSoft, LLC - C:\Program Files\SolidDocuments\SolidConverterPDF\SCPDF\SolidPdfService.exe -- End of file - 7758 bytes

Kod: Zaznacz wszystko: ComboFix 07-10-23.1 - Rafaello 2007-10-25 21:53:57.2 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.429 [GMT 2:00] Running from: c:\My Downloads\Bezpieczenstwo\ComboFix.exe . ((((((((((((((((((((((((( Files Created from 2007-09-25 to 2007-10-25 ))))))))))))))))))))))))))))))) . 2007-10-25 16:38 51,200 --a------ C:\WINDOWS\NirCmd.exe 2007-10-25 16:30 <DIR> d-------- C:\WINDOWS\ERUNT 2007-10-25 16:25 <DIR> d-------- C:\NoLopBackups 2007-10-25 16:24 132 --a------ C:\delete.bat 2007-10-21 20:36 <DIR> d-------- C:\Program Files\MIKSOFT 2007-10-16 16:48 <DIR> dr-h----- C:\Documents and Settings\Rafaello\Dane aplikacji\SecuROM 2007-10-16 16:48 107,888 --a------ C:\WINDOWS\system32\CmdLineExt.dll 2007-10-08 10:39 <DIR> d-------- C:\Program Files\creative wait bike 2007-10-04 11:12 2,297,552 --a------ C:\WINDOWS\system32\d3dx9_26.dll 2007-09-30 01:16 <DIR> d-------- C:\Documents and Settings\Rafaello\Dane aplikacji\creative wait bike 2007-09-26 22:13 <DIR> d-------- C:\Program Files\ConnectionServices 2007-09-26 22:13 <DIR> d-------- C:\Program Files\BitAccelerator . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2007-10-25 18:57 --------- d-----w C:\Program Files\Gadu-Gadu 2007-10-25 18:50 --------- d-----w C:\Documents and Settings\Rafaello\Dane aplikacji\SolidDocuments 2007-10-25 13:21 --------- d-----w C:\Program Files\eMule 2007-10-25 10:35 --------- d-----w C:\Documents and Settings\Rafaello\Dane aplikacji\MegauploadToolbar 2007-10-24 12:52 --------- d-----w C:\WINDOWS\system32\config\systemprofile\Dane aplikacji\SolidDocuments 2007-10-22 10:40 --------- d-----w C:\Program Files\Java 2007-10-13 08:29 --------- d-----w C:\Program Files\NAPI-PROJEKT 2007-10-04 09:36 --------- d--h--w C:\Program Files\InstallShield Installation Information 2007-10-01 13:53 --------- d-----w C:\Documents and Settings\Rafaello\Dane aplikacji\Vso 2007-09-20 20:59 --------- d-----w C:\Program Files\Common Files\Adobe 2007-09-20 19:43 --------- d-----w C:\Program Files\Common Files\Adobe Systems Shared 2007-09-20 19:31 --------- d-----w C:\Program Files\AliveMedia 2007-09-20 12:28 --------- d-----w C:\Program Files\K-Lite Codec Pack 2007-09-20 12:26 737,280 ----a-w C:\WINDOWS\iun6002.exe 2007-09-20 12:26 --------- d-----w C:\Program Files\Codec Pack - All In 1 2007-09-11 10:51 --------- d-----w C:\Documents and Settings\Rafaello\Dane aplikacji\MyPhoneExplorer 2007-09-11 10:50 --------- d-----w C:\Program Files\MyPhoneExplorer 2007-09-11 07:03 --------- d-----w C:\Program Files\123 DVD Clone 2007-09-09 11:02 47,360 ----a-w C:\WINDOWS\system32\drivers\pcouffin.sys 2007-09-09 11:02 47,360 ----a-w C:\Documents and Settings\Rafaello\Dane aplikacji\pcouffin.sys 2007-09-09 11:02 --------- d-----w C:\Program Files\VSO 2007-09-08 08:59 --------- d-----w C:\Program Files\MegauploadToolbar 2007-09-07 11:49 --------- d-----w C:\Program Files\Common Files\Ahead 2007-09-07 11:49 --------- d-----w C:\Program Files\Ahead 2007-09-05 13:35 --------- d-----w C:\Program Files\SolidDocuments 2007-09-05 11:24 --------- d-----w C:\Program Files\Imagenomic 2007-08-31 16:33 --------- d-----w C:\Program Files\Sony Ericsson 2007-08-31 15:25 --------- d-----w C:\Documents and Settings\Rafaello\Dane aplikacji\Teleca 2007-08-31 15:15 --------- d-----w C:\Program Files\Common Files\Teleca Shared 2007-08-31 15:11 6,144 ----a-w C:\WINDOWS\system32\drivers\k750cm.sys 2007-08-31 15:11 5,744 ----a-w C:\WINDOWS\system32\drivers\k750wh.sys 2007-08-29 14:47 --------- d-----w C:\Documents and Settings\Rafaello\Dane aplikacji\dvdcss 2007-08-29 14:46 --------- d-----w C:\Documents and Settings\Rafaello\Dane aplikacji\CyberLink 2007-08-29 14:43 --------- d-----w C:\Program Files\CyberLink 2007-08-29 14:42 505,392 ----a-w C:\WINDOWS\system32\msvcp71.dll 2007-08-29 13:18 --------- d-----w C:\Program Files\Elaborate Bytes 2007-08-26 13:01 --------- d-----w C:\Program Files\Emapa 2007-08-26 10:33 245,760 ----a-w C:\WINDOWS\system32\mplvpx.dll 2007-08-26 10:32 9,216 ----a-w C:\WINDOWS\system32\cpuinf32.dll 2007-08-20 12:13 94,208 ----a-w C:\WINDOWS\ScUnin.exe 2007-08-10 19:56 93,128 ----a-w C:\WINDOWS\system32\ElbyCDIO.dll . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{6D7B211A-88EA-490c-BAB9-3600D8D7C503}] C:\Program Files\ConnectionServices\ConnectionServices.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTSysVol"="C:\Program Files\Creative\SB Live! 24-bit\Surround Mixer\CTSysVol.exe" [2003-09-17 10:43] "UpdReg"="C:\WINDOWS\UpdReg.EXE" [2000-05-11 01:00] "ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-09-14 21:05] "nod32kui"="C:\Program Files\Eset\nod32kui.exe" [2007-07-14 13:50] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11] "Sony Ericsson PC Suite"="C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" [2005-10-26 16:17] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:44] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Adobe Reader Speed Launch.lnk] path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Adobe Reader Speed Launch.lnk backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Adobe Reader Synchronizer.lnk] path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Adobe Reader Synchronizer.lnk backup=C:\WINDOWS\pss\Adobe Reader Synchronizer.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CloneCDTray] "C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe" /s [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033 [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LanguageShortcut] "C:\Program Files\CyberLink\PowerDVD\Language\Language.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent] C:\Program Files\Winamp\winampa.exe R2 {95808DC4-FA4A-4c74-92FE-5B863F82066B};{95808DC4-FA4A-4c74-92FE-5B863F82066B};\??\C:\Program Files\CyberLink\PowerDVD\[u]0[/u]00.fcl R3 AIRPLUS;D-Link AirPlus Wireless Adapter;C:\WINDOWS\system32\DRIVERS\airplus.sys R3 axsaki;axsaki;C:\WINDOWS\system32\DRIVERS\axsaki.sys R3 axskbus;axskbus;C:\WINDOWS\system32\DRIVERS\axskbus.sys R3 P17;Sound Blaster Live! 24-bit;C:\WINDOWS\system32\drivers\P17.sys S3 SetupNTGLM7X;SetupNTGLM7X;\??\H:\NTGLM7X.sys . ************************************************************************** catchme 0.3.1232 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-10-25 21:55:19 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2007-10-25 21:55:49 C:\ComboFix2.txt ... 2007-10-25 16:42 . --- E O F ---

**Posty:** 18165 · przez **wojtas** 25 Paź 2007, 22:17

skasuj wpis;

O2 - BHO: ConnectionServices module - {6D7B211A-88EA-490c-BAB9-3600D8D7C503} - C:\Program Files\ConnectionServices\ConnectionServices.dll (file missing)

C:\Program Files\ConnectionServices
C:\Program Files\BitAccelerator

te dwa foldery do kosza

znasz to:

C:\Program Files\creative wait bike

jesli nie to usuwasz ten pogrubione tez do kosza:

C:\Program Files\creative wait bike
C:\Documents and Settings\Rafaello\Dane aplikacji\creative wait bike

wyskakujace okienka reklam ie

Wyskakujace okienka reklam IE

Kto jest na forum