Z dnia na dzien co raz bardziej zamula.

**Posty:** 105 · przez **kristof200** 22 Lis 2008, 23:11

Siema .A wiec komputer zamula coraz bardziej niewiem czego to przyczyna ale zaczyna to byc wkurzajace .
Byc moze to vista ,niewiem co mam myslec ludzie mowia ze ten system jest naprawde do du*** wiec daje logi.

Kod: Zaznacz wszystko: ******************************************************************************** * * * FixIEDef Log * * Version 1.7.20.6731 * * * ******************************************************************************** Created at 22:00:16 on Saturday, November 22, 2008 Time Zone : (GMT+01:00) Bruxelles, Copenhague, Madrid, Paris Logged On User : mlody Operating System : Microsoft® Windows Vista™ Édition Familiale Premium Service Pack 1 OS Version : 6.0.6001 System Langauge : French (Standard) Keyboard Layout : French (Standard) Processor : X86 Intel(R) Core(TM)2 Duo CPU T8300 @ 2.40GHz System Drive : C:\ Windows Directory : C:\Windows System Directory : C:\Windows\system32 System Drive Type : Fixed System Drive Status : READY System Drive Label : System Drive Size : 30 GB System Drive Free : 8.19 GB Total Physical Memory: 3061 MB Free Physical Memory : 2006 MB Total Page File : 3061 MB Free Page File : 5323 MB Total Virtual Memory : 2048 MB Free Virtual Memory : 1947 MB Boot State : Normal boot -------------------------------------------------------------------------------- !!! userinit.exe is Clean !!! -------------------------------------------------------------------------------- !!! Files that have been deleted !!! -------------------------------------------------------------------------------- !!! Directories that have been removed !!! No malicious directories to be removed -------------------------------------------------------------------------------- !!! Registry entries that have been removed !!! No malicious Registry entries found ================================================================================ All Done :) ShadowPuterDude Safe Surfing!!!

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 22:02:43, on 22/11/2008 Platform: Windows Vista SP1 (WinNT 6.00.1905) MSIE: Internet Explorer v7.00 (7.00.6001.18000) Boot mode: Normal Running processes: C:\Windows\system32\Dwm.exe C:\Windows\system32\taskeng.exe C:\Program Files\Windows Defender\MSASCui.exe C:\Program Files\ESET\ESET Smart Security\egui.exe C:\Windows\System32\WLTRAY.EXE C:\Windows\System32\igfxtray.exe C:\Windows\System32\hkcmd.exe C:\Windows\System32\igfxpers.exe C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe C:\Program Files\Gadu-Gadu\gg.exe C:\Program Files\Windows Media Player\wmpnscfg.exe C:\Windows\system32\igfxsrvc.exe C:\Program Files\foobar2000\foobar2000.exe C:\Windows\explorer.exe C:\Program Files\Opera\opera.exe C:\Windows\system32\SearchFilterHost.exe C:\Users\mlody\Desktop\HiJackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O1 - Hosts: ::1 localhost O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O3 - Toolbar: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O4 - HKLM\..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe -hide O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET Smart Security\egui.exe" /hide /waitservice O4 - HKLM\..\Run: [Broadcom Wireless Manager UI] C:\Windows\system32\WLTRAY.exe O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" O4 - HKCU\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL') O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL') O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU') O4 - Startup: lsass.exe O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000 O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\PROGRA~1\MICROS~1\OFFICE11\REFIEBAR.DLL O13 - Gopher Prefix: O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{8283D620-2F96-474F-B14F-7F9D0BD73D95}: NameServer = 208.67.222.222,206.67.222.220 O17 - HKLM\System\CCS\Services\Tcpip\..\{A19EE054-9EDA-48EE-893D-12609BCDE19B}: NameServer = 208.67.222.222,208.67.222.220 O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: CT Device Query service (CTDevice_Srv) - Creative Technology Ltd - C:\Program Files\Creative\Shared Files\CTDevSrv.exe O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET Smart Security\ekrn.exe O23 - Service: O&O Defrag - O&O Software GmbH - C:\Windows\system32\oodag.exe O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 52\StarWind\StarWindServiceAE.exe O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\Windows\System32\WLTRYSVC.EXE O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe -- End of file - 6421 bytes

Konieczne danie loga z combo fixa??

**Posty:** 8001 · przez **Okocza** 22 Lis 2008, 23:24

Kod: Zaznacz wszystko: O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

fix w hj

kristof200 napisał(a):Konieczne danie loga z combo fixa?

tak.

**Posty:** 105 · przez **kristof200** 23 Lis 2008, 16:06

Kod: Zaznacz wszystko: ComboFix 08-11-22.01 - mlody 2008-11-23 11:25:16.2 - NTFSx86 Microsoft® Windows Vista™ Édition Familiale Premium 6.0.6001.1.1252.1.1036.18.2112 [GMT 1:00] Lancé depuis: d:\programy\ComboFix.exe . (((((((((((((((((((((((((((((((((((( Autres suppressions )))))))))))))))))))))))))))))))))))))))))))))))) . . ---- Previous Run ------- . c:\users\mlody\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lsass.exe c:\windows\system32\BCMLogon.dll c:\windows\system32\bcmwlrmt.dll c:\windows\system32\x64 . ((((((((((((((((((((((((((((( Fichiers créés du 2008-10-23 au 2008-11-23 )))))))))))))))))))))))))))))))))))) . 2008-11-23 10:51 . 2008-11-23 11:22 873 --a------ c:\windows\System32\OODBS.lor 2008-11-22 22:20 . 2008-11-23 00:43 1,248 --a------ c:\windows\bestplayer.ini 2008-11-22 22:20 . 2008-11-23 00:43 41 --a------ c:\windows\bestplayer.bpp 2008-11-22 22:20 . 2008-11-23 00:43 0 --a------ c:\windows\bestplayer.bbt 2008-11-22 21:58 . 2008-11-22 21:58 <REP> d-------- c:\windows\ERUNT 2008-11-22 21:58 . 2008-11-22 21:58 <REP> d-------- C:\ERDNT 2008-11-22 21:58 . 2008-11-22 21:59 <REP> d-------- C:\!FixIEDef 2008-11-22 21:53 . 2008-11-22 21:53 2,560 --a------ c:\windows\_MSRSTRT.EXE 2008-11-22 11:17 . 2008-10-16 22:13 1,809,944 --a------ c:\windows\System32\wuaueng.dll 2008-11-22 11:17 . 2008-10-16 21:56 1,524,736 --a------ c:\windows\System32\wucltux.dll 2008-11-22 11:17 . 2008-10-16 22:09 51,224 --a------ c:\windows\System32\wuauclt.exe 2008-11-22 11:17 . 2008-10-16 22:09 43,544 --a------ c:\windows\System32\wups2.dll 2008-11-22 11:16 . 2008-10-16 22:12 561,688 --a------ c:\windows\System32\wuapi.dll 2008-11-22 11:16 . 2008-10-16 14:08 162,064 --a------ c:\windows\System32\wuwebv.dll 2008-11-22 11:16 . 2008-10-16 21:55 83,456 --a------ c:\windows\System32\wudriver.dll 2008-11-22 11:16 . 2008-10-16 22:08 34,328 --a------ c:\windows\System32\wups.dll 2008-11-22 11:16 . 2008-10-16 13:56 31,232 --a------ c:\windows\System32\wuapp.exe 2008-11-21 17:42 . 2008-11-21 17:44 <REP> d-------- c:\users\mlody\AppData\Roaming\Tibia 2008-11-21 17:41 . 2008-11-21 17:41 <REP> d-------- c:\program files\Tibia 2008-11-21 17:41 . 2008-11-21 17:41 <REP> d-------- c:\program files\Asprate 2008-11-19 21:14 . 2008-11-19 21:36 <REP> d-------- c:\users\mlody\AppData\Roaming\NCH Swift Sound 2008-11-19 21:14 . 2008-11-19 21:16 <REP> d-------- c:\programdata\NCH Swift Sound 2008-11-19 21:13 . 2008-11-19 21:37 <REP> d-------- c:\program files\NCH Swift Sound 2008-11-18 19:11 . 2008-11-22 21:47 <REP> d-a------ c:\programdata\TEMP 2008-11-16 18:54 . 2008-11-16 18:54 <REP> d-------- c:\users\mlody\AppData\Roaming\Ventrilo 2008-11-16 18:54 . 2008-11-16 18:54 266 --a------ c:\windows\{789289CA-F73A-4A16-A331-54D498CE069F}_WiseFW.ini 2008-11-16 18:53 . 2008-11-16 18:53 <REP> d-------- c:\program files\Common Files\Wise Installation Wizard 2008-11-12 11:50 . 2008-09-10 04:40 1,334,272 --a------ c:\windows\System32\msxml6.dll 2008-11-12 11:50 . 2008-09-05 06:14 1,191,936 --a------ c:\windows\System32\msxml3.dll 2008-11-12 11:50 . 2008-08-27 02:05 212,480 --a------ c:\windows\System32\drivers\mrxsmb10.sys 2008-11-11 16:54 . 2008-11-11 16:54 412 --a------ c:\windows\ODBC.INI 2008-11-11 13:56 . 2006-06-01 23:11 109,568 --------- c:\windows\System32\pxinsi64.exe 2008-11-11 13:56 . 2006-06-01 23:11 108,544 --------- c:\windows\System32\pxcpyi64.exe 2008-11-11 13:56 . 2006-06-01 23:11 20,640 --------- c:\windows\System32\drivers\PxHelp20.sys 2008-11-06 18:50 . 2008-11-06 18:50 <REP> d-------- c:\programdata\Yahoo! Companion 2008-11-03 21:16 . 2008-11-03 21:16 <REP> d-------- c:\users\mlody\AppData\Roaming\KC Softwares 2008-11-02 21:30 . 2008-11-02 21:30 <REP> d-------- c:\users\mlody\AppData\Roaming\teamspeak2 2008-11-02 21:29 . 2008-11-02 21:29 34,064 --a------ c:\windows\System32\lhacm.acm 2008-11-02 20:59 . 2008-11-02 20:59 0 --ah----- c:\windows\System32\drivers\Msft_User_PCCSWpdDriver_01_05_00.Wdf 2008-11-02 20:59 . 2008-11-02 20:59 0 --ah----- c:\windows\System32\drivers\Msft_Kernel_ccdcmb_01005.Wdf 2008-11-02 20:58 . 2008-11-02 20:59 <REP> d-------- c:\users\mlody\AppData\Roaming\PC Suite 2008-11-02 20:58 . 2008-11-02 20:59 <REP> d-------- c:\users\mlody\AppData\Roaming\Nokia 2008-11-02 20:58 . 2008-11-02 20:59 <REP> d-------- c:\programdata\PC Suite 2008-11-02 20:57 . 2008-11-02 20:57 <REP> d----c--- c:\windows\System32\DRVSTORE 2008-11-02 20:57 . 2008-11-02 20:57 <REP> d-------- c:\program files\PC Connectivity Solution 2008-11-02 20:57 . 2008-11-02 20:57 <REP> d-------- c:\program files\DIFX 2008-11-02 20:57 . 2008-11-02 20:57 <REP> d-------- c:\program files\Common Files\PCSuite 2008-11-02 20:57 . 2008-11-02 20:57 <REP> d-------- c:\program files\Common Files\Nokia 2008-11-02 20:57 . 2007-09-17 15:53 21,632 --a------ c:\windows\System32\drivers\pccsmcfd.sys 2008-11-02 20:56 . 2008-05-07 07:38 90,624 --a------ c:\windows\System32\nmwcdcls.dll 2008-11-02 20:55 . 2008-11-02 20:55 <REP> d-------- c:\programdata\Installations 2008-11-02 00:56 . 2008-05-08 02:03 453,632 --a------ c:\windows\System32\SetACL.ocx 2008-11-01 20:28 . 2008-11-01 20:28 <REP> d-------- c:\program files\Combined Community Codec Pack 2008-11-01 20:27 . 2008-11-01 20:27 <REP> d-------- c:\program files\XviD 2008-11-01 19:42 . 2008-11-01 19:42 <REP> d-------- c:\program files\VistaCodecPack 2008-11-01 18:06 . 2008-11-01 18:06 <REP> d-------- c:\users\mlody\AppData\Roaming\Thinstall 2008-11-01 09:59 . 2008-11-01 09:59 <REP> d-------- c:\programdata\{A19D0427-D1B9-4588-AEFE-4BB1DDC2B1A9} 2008-11-01 09:58 . 2008-11-01 11:39 <REP> d-------- c:\programdata\Creative 2008-11-01 09:58 . 2008-11-02 18:29 <REP> d-------- c:\program files\Creative 2008-11-01 09:58 . 2006-10-06 14:17 53,248 --------- c:\windows\Ctregrun.exe 2008-11-01 09:57 . 2008-11-01 09:57 <REP> d--h----- c:\program files\InstallShield Installation Information 2008-10-31 19:31 . 2008-10-31 19:31 <REP> d-------- c:\program files\Microsoft CAPICOM 2.1.0.2 2008-10-31 17:53 . 2008-10-31 17:58 <REP> d--hsc--- c:\program files\Common Files\WindowsLiveInstaller 2008-10-31 17:52 . 2008-10-31 17:52 <REP> d-------- c:\programdata\WLInstaller 2008-10-31 17:52 . 2008-10-31 17:59 <REP> d-------- c:\program files\Windows Live 2008-10-29 18:28 . 2008-11-17 18:00 <REP> d-------- c:\users\mlody\AppData\Roaming\skypePM 2008-10-29 18:28 . 2008-10-29 18:28 56 --ah----- c:\programdata\ezsidmv.dat 2008-10-29 18:23 . 2008-11-17 19:08 <REP> d-------- c:\users\mlody\AppData\Roaming\Skype 2008-10-29 16:48 . 2008-10-29 16:48 <REP> d-------- c:\programdata\Skype 2008-10-29 16:48 . 2008-10-29 16:48 <REP> d-------- c:\program files\Skype 2008-10-29 16:48 . 2008-10-29 16:48 <REP> d-------- c:\program files\Common Files\Skype 2008-10-29 15:51 . 2008-10-29 16:46 <REP> d-------- c:\users\mlody\AppData\Roaming\Dev-Cpp 2008-10-29 15:51 . 2008-10-29 15:51 <REP> d-------- C:\Dev-Cpp 2008-10-29 13:23 . 2008-10-29 13:38 131,072 --a------ c:\windows\SPInstall.etl 2008-10-29 12:57 . 2008-11-15 15:04 <REP> d-------- c:\windows\System32\oodag 2008-10-29 12:56 . 2008-10-29 12:56 <REP> d-------- c:\program files\OO Software 2008-10-28 22:59 . 2008-10-28 22:59 <REP> d--h----- c:\programdata\{A25FEDC1-F6D7-440C-BCE2-B71F595F6646} 2008-10-28 22:58 . 2008-10-29 21:12 <REP> d-------- c:\program files\Eraser 2008-10-28 20:39 . 2008-08-12 04:39 443,392 --a------ c:\windows\System32\win32spl.dll 2008-10-28 20:39 . 2008-09-18 05:56 147,456 --a------ c:\windows\System32\Faultrep.dll 2008-10-28 20:39 . 2008-09-18 05:56 125,952 --a------ c:\windows\System32\wersvc.dll 2008-10-27 18:40 . 2006-10-26 19:56 32,592 --a------ c:\windows\System32\msonpmon.dll 2008-10-27 18:39 . 2008-11-11 16:54 <REP> d-------- c:\program files\Microsoft Works 2008-10-27 18:38 . 2008-10-27 18:38 <REP> d-------- c:\windows\PCHEALTH 2008-10-27 18:38 . 2008-10-27 18:38 <REP> d-------- c:\program files\Microsoft.NET 2008-10-27 18:36 . 2008-10-27 18:36 <REP> d-------- c:\program files\Microsoft Visual Studio 8 2008-10-27 18:35 . 2008-11-12 21:38 <REP> d-------- c:\programdata\Microsoft Help 2008-10-27 18:34 . 2008-10-27 18:34 <REP> dr-h----- C:\MSOCache 2008-10-27 18:30 . 2008-10-27 18:30 <REP> d-------- c:\program files\Alcohol Soft 2008-10-27 18:27 . 2008-10-27 18:27 716,272 --a------ c:\windows\System32\drivers\sptd.sys 2008-10-27 17:39 . 2008-10-27 17:40 <REP> d-------- c:\users\mlody\{93617f74-ee16-4595-8ac3-fb477b733686} 2008-10-27 17:19 . 2003-05-14 20:21 266,296 --a------ c:\windows\System32\HPZidr12.dll 2008-10-27 17:19 . 2003-05-14 20:24 262,144 --a------ c:\windows\System32\HPZc3212.dll 2008-10-27 17:19 . 2003-05-14 20:23 196,608 --a------ c:\windows\System32\HPZipr12.dll 2008-10-27 17:19 . 2003-05-14 20:14 94,208 --a------ c:\windows\System32\HPZipt12.dll 2008-10-27 17:19 . 2003-05-14 20:45 65,795 --a------ c:\windows\System32\HPZipm12.exe 2008-10-27 17:19 . 2003-05-14 20:45 61,699 --a------ c:\windows\System32\HPZinw12.exe 2008-10-27 17:19 . 2003-05-14 20:14 57,344 --a------ c:\windows\System32\HPZisn12.dll 2008-10-27 17:19 . 2003-05-14 20:19 51,056 --a------ c:\windows\System32\drivers\hpzid412.sys 2008-10-27 17:19 . 2003-05-14 20:17 21,488 --a------ c:\windows\System32\drivers\HPZius12.sys 2008-10-27 17:19 . 2003-05-14 20:19 16,496 --a------ c:\windows\System32\drivers\HPZipr12.sys 2008-10-27 17:17 . 2008-10-27 17:17 <REP> d-------- c:\program files\Hewlett-Packard 2008-10-26 19:12 . 2008-11-23 11:21 <REP> d-------- c:\users\mlody\AppData\Roaming\foobar2000 2008-10-26 19:12 . 2008-10-26 19:12 <REP> d-------- c:\program files\foobar2000 . (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M )))))))))))))))))))))))))))))))))))))))))))))))) . 2008-11-22 22:34 --------- d-----w c:\program files\NAPI-PROJEKT 2008-11-02 19:02 --------- d-----w c:\program files\Opera 2008-11-01 08:57 --------- d-----w c:\program files\Common Files\InstallShield 2008-10-27 17:39 --------- d-----w c:\program files\MSBuild 2008-10-19 22:29 --------- d-----w c:\program files\Shut Down-O-Matic 2008-10-17 13:17 --------- d-----w c:\users\mlody\AppData\Roaming\Gadu-Gadu 2008-10-17 11:46 --------- d-----w c:\program files\Windows Mail 2008-10-17 09:34 --------- d-----w c:\program files\Gadu-Gadu 2008-10-16 13:57 --------- d-----w c:\program files\Intel 2008-10-16 13:53 --------- d-----w c:\program files\Marvell 2008-10-16 13:52 --------- d-----w c:\users\mlody\AppData\Roaming\TMP 2008-10-16 13:50 --------- d-----w c:\program files\CONEXANT 2008-10-15 13:06 --------- d-----w c:\programdata\VistaCodecs 2008-10-15 12:58 --------- d-----w c:\program files\Yahoo! 2008-10-15 12:44 --------- d-----w c:\users\mlody\AppData\Roaming\Media Player Classic 2008-10-14 21:23 --------- d-----w c:\users\mlody\AppData\Roaming\Wireshark 2008-10-14 19:40 --------- d-----w c:\program files\Windows Sidebar 2008-10-14 19:40 --------- d-----w c:\program files\Windows Photo Gallery 2008-10-14 19:40 --------- d-----w c:\program files\Windows Journal 2008-10-14 19:40 --------- d-----w c:\program files\Windows Defender 2008-10-14 19:40 --------- d-----w c:\program files\Windows Collaboration 2008-10-14 19:40 --------- d-----w c:\program files\Windows Calendar 2008-10-14 18:01 --------- d-----w c:\program files\Cisco 2008-10-14 18:00 --------- d-----w c:\users\mlody\AppData\Roaming\InstallShield 2008-10-14 18:00 --------- d-----w c:\program files\Dell 2008-10-14 17:54 --------- d-----w c:\users\mlody\AppData\Roaming\ESET 2008-10-14 17:54 --------- d-----w c:\programdata\ESET 2008-10-14 17:54 --------- d-----w c:\program files\ESET 2008-10-14 17:50 0 ---ha-w c:\windows\system32\drivers\Msft_User_WpdFs_01_00_00.Wdf 2008-10-14 09:58 --------- d-sh--w c:\programdata\Modèles 2008-10-14 09:58 --------- d-sh--w c:\programdata\Menu Démarrer 2008-10-14 09:58 --------- d-sh--w c:\programdata\Favoris 2008-10-14 09:58 --------- d-sh--w c:\programdata\Bureau 2008-10-14 09:58 --------- d-sh--w c:\program files\Fichiers communs 2008-10-02 03:49 827,392 ----a-w c:\windows\System32\wininet.dll 2008-09-18 05:09 3,601,464 ----a-w c:\windows\System32\ntkrnlpa.exe 2008-09-18 05:09 3,549,240 ----a-w c:\windows\System32\ntoskrnl.exe 2008-09-18 02:16 2,032,640 ----a-w c:\windows\System32\win32k.sys 2008-01-21 02:43 174 --sha-w c:\program files\desktop.ini . ((((((((((((((((((((((((((((( snapshot@2008-11-23_11.18.23.35 ))))))))))))))))))))))))))))))))))))))))) . - 2008-11-23 10:15:26 2,048 --sha-w c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat + 2008-11-23 10:22:43 2,048 --sha-w c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat - 2008-11-23 10:15:26 2,048 --sha-w c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat + 2008-11-23 10:22:43 2,048 --sha-w c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat - 2008-11-23 10:16:11 262,144 --sha-w c:\windows\ServiceProfiles\LocalService\NTUSER.DAT + 2008-11-23 10:24:30 262,144 --sha-w c:\windows\ServiceProfiles\LocalService\NTUSER.DAT - 2008-11-23 10:16:44 262,144 --sha-w c:\windows\ServiceProfiles\NetworkService\NTUSER.DAT + 2008-11-23 10:24:35 262,144 --sha-w c:\windows\ServiceProfiles\NetworkService\NTUSER.DAT + 2008-11-23 10:24:35 262,144 ---ha-w c:\windows\ServiceProfiles\NetworkService\ntuser.dat.LOG1 - 2008-11-23 10:11:47 262,144 ----a-w c:\windows\System32\config\systemprofile\ntuser.dat + 2008-11-23 10:25:03 262,144 ----a-w c:\windows\System32\config\systemprofile\ntuser.dat - 2008-11-23 09:58:52 101,250 ----a-w c:\windows\System32\perfc009.dat + 2008-11-23 10:22:01 101,250 ----a-w c:\windows\System32\perfc009.dat - 2008-11-23 09:58:52 123,556 ----a-w c:\windows\System32\perfc00C.dat + 2008-11-23 10:22:01 123,556 ----a-w c:\windows\System32\perfc00C.dat - 2008-11-23 09:58:52 587,178 ----a-w c:\windows\System32\perfh009.dat + 2008-11-23 10:22:01 587,178 ----a-w c:\windows\System32\perfh009.dat - 2008-11-23 09:58:52 669,566 ----a-w c:\windows\System32\perfh00C.dat + 2008-11-23 10:22:01 669,566 ----a-w c:\windows\System32\perfh00C.dat - 2008-11-23 09:53:53 7,212 ----a-w c:\windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-73132976-2136432694-1382151029-1000_UserData.bin + 2008-11-23 10:24:57 7,802 ----a-w c:\windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-73132976-2136432694-1382151029-1000_UserData.bin - 2008-11-23 09:53:52 69,000 ----a-w c:\windows\System32\WDI\BootPerformanceDiagnostics_SystemData.bin + 2008-11-23 10:24:57 69,218 ----a-w c:\windows\System32\WDI\BootPerformanceDiagnostics_SystemData.bin - 2008-11-23 09:53:51 33,786 ----a-w c:\windows\System32\WDI\ShutdownPerformanceDiagnostics_SystemData.bin + 2008-11-23 10:24:39 34,360 ----a-w c:\windows\System32\WDI\ShutdownPerformanceDiagnostics_SystemData.bin . ((((((((((((((((((((((((((((((((( Points de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Gadu-Gadu"="c:\program files\Gadu-Gadu\gg.exe" [2008-03-20 2127296] "WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-21 202240] "msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2007-10-18 5724184] "WindowsWelcomeCenter"="oobefldr.dll" [2008-01-21 c:\windows\System32\oobefldr.dll] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "egui"="c:\program files\ESET\ESET Smart Security\egui.exe" [2007-12-21 1443072] "Broadcom Wireless Manager UI"="c:\windows\system32\WLTRAY.exe" [2007-12-08 3444736] "IgfxTray"="c:\windows\system32\igfxtray.exe" [2008-02-11 141848] "HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2008-02-11 166424] "Persistence"="c:\windows\system32\igfxpers.exe" [2008-02-11 133656] "GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2007-08-24 33648] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "EnableUIADesktopToggle"= 0 (0x0) [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "msacm.divxa32"= divxa32.acm "VIDC.FFDS"= c:\progra~1\COMBIN~1\Filters\FFDShow\ff_vfw.dll [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AlcoholAutomount] --a------ 2008-02-22 12:22 216520 c:\program files\Alcohol Soft\Alcohol 52\AxCmd.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTZDetec.exe] --------- 2007-12-18 14:20 401408 c:\program files\Creative\Creative Media Lite\CTZDetec.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Eraser] --a------ 2007-12-23 00:03 916240 c:\program files\Eraser\Eraser.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Invisible Secrets 4] d:\progra~1\INVISI~1\invtray.exe [BU] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr] --a------ 2007-10-18 11:34 5724184 c:\program files\Windows Live\Messenger\msnmsgr.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Nokia.PCSync] --a------ 2008-06-17 16:00 1249280 d:\programes files\nokia\Nokia PC Suite 7\PcSync2.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OEM02Mon.exe] --a------ 2007-05-09 16:01 36864 c:\windows\OEM02Mon.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PC Suite Tray] --a------ 2008-10-02 07:00 1124352 d:\programes files\nokia\Nokia PC Suite 7\PCSuite.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Sidebar] --a------ 2008-01-21 03:23 1233920 c:\program files\Windows Sidebar\sidebar.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Speech Recognition] --a------ 2008-01-21 03:24 49664 c:\windows\Speech\Common\sapisvr.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-] "Skype"="c:\program files\Skype\Phone\Skype.exe" /nosplash /minimized "WMPNSCFG"=c:\program files\Windows Media Player\WMPNSCFG.exe [HKLM\~\services\sharedaccess\parameters\firewallpolicy\DomainProfile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules] "{7BC5B329-C59F-4A56-B561-A1D8643CEDA4}"= TCP:6004|c:\program files\Microsoft Office\Office12\outlook.exe:Microsoft Office Outlook "{2DB0D385-BB39-4892-8C12-8630F95302AB}"= UDP:c:\program files\Microsoft Office\Office12\GROOVE.EXE:Microsoft Office Groove "{893CC891-86C0-4D33-8AE0-81FDA2FF037C}"= TCP:c:\program files\Microsoft Office\Office12\GROOVE.EXE:Microsoft Office Groove "{2AC87E79-7417-44D1-AC34-D420BBF5B6D2}"= UDP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote "{60A5B479-72D6-40F1-BD00-6FA182E36B47}"= TCP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote "{9B3E6D24-4591-4A64-9DBC-CF99924FAFB2}"= c:\program files\Skype\Phone\Skype.exe:Skype "{AB89FB27-9B1B-465A-8ABE-2BF969FF5F98}"= c:\program files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone) "{135001E8-BAB2-45AD-BFE4-06B0394120E2}"= UDP:d:\programes files\ventrilo\a\Ventrilo.exe:Ventrilo.exe "{D06486FC-200E-4FC5-ADDD-D687C04F8CED}"= TCP:d:\programes files\ventrilo\a\Ventrilo.exe:Ventrilo.exe [HKLM\~\services\sharedaccess\parameters\firewallpolicy\PublicProfile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile] "EnableFirewall"= 0 (0x0) R3 OEM02Dev;Creative Camera OEM002 Driver;c:\windows\system32\DRIVERS\OEM02Dev.sys [2007-10-10 235648] R3 OEM02Vfx;Creative Camera OEM002 Video VFX Driver;c:\windows\system32\DRIVERS\OEM02Vfx.sys [2007-03-05 7424] S4 ErrDev;Microsoft Hardware Error Device Driver;c:\windows\system32\drivers\errdev.sys [2008-01-21 6656] S4 MegaSR;MegaSR;c:\windows\system32\drivers\megasr.sys [2008-01-21 386616] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] bthsvcs REG_MULTI_SZ BthServ [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{bb790939-a44c-11dd-b54e-001fe2de4a9e}] \shell\AutoRun\command - G:\SETUP.EXE \shell\configure\command - G:\SETUP.EXE \shell\install\command - G:\SETUP.EXE . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-11-23 11:27:48 Windows 6.0.6001 Service Pack 1 NTFS Recherche de processus cachés ... Recherche d'éléments en démarrage automatique cachés ... Recherche de fichiers cachés ... Scan terminé avec succès Fichiers cachés: 0 ************************************************************************** . Heure de fin: 2008-11-23 11:29:36 ComboFix-quarantined-files.txt 2008-11-23 10:29:25 Avant-CF: 7,120,031,744 octets libres Après-CF: 6,772,215,808 octets libres 278 --- E O F --- 2008-11-21 15:14:07

prosze o pomoc Combofix wykasowal jakies pliki i teraz internet niechodzi.

i windows niechce sie zamknac

**Posty:** 18165 · przez **wojtas** 23 Lis 2008, 17:01

z folderu C:\Qoobox wyciagnij plik BCMLogon.dll.vir .. skasuj mu koncowke .vir i wrzuc do c:\windows\system32

**Posty:** 105 · przez **kristof200** 23 Lis 2008, 17:08

Dalej niedziala.

Dodano 23.11.2008 17:16:17:
zainstalowalem jeszcze raz sterowniki itd i dalej niedziala od momentu skanowania combofix.

**Posty:** 18165 · przez **wojtas** 23 Lis 2008, 17:23

to jeszcze przywroc bcmwlrmt.dll.vir a jak nie to;

włóż płytkę windowsa - zbootuj ją. wejdź do konsoli odzyskiwania i w niej wpisz

chkdsk x: /r

gdzie x to litera partycji systemowej

**Posty:** 105 · przez **kristof200** 23 Lis 2008, 17:35

Ja mam viste a jak uruchamiam plyte to windows odrazu chce sie instalowac.

**Posty:** 8001 · przez **Okocza** 23 Lis 2008, 17:40

kristof200 napisał(a):Ja mam viste a jak uruchamiam plyte to windows odrazu chce sie instalowac.

masz tam opcję 'napraw mój komputer' wchodzisz w nią i wybierasz sobie linię komend, będzie coś takiego:

X:\>

wpisujesz C: (jesli masz system na C - jeśli nie to literkę tej partycji na której masz system)

i ma wyglądać to potem tak:

C:\>

wpisujesz chkdsk c: /p (jeśli na c masz system - jeśli nie to literkę tej partycji na której jest system)

**Posty:** 105 · przez **kristof200** 23 Lis 2008, 17:46

no wlasnie niema tego jest albo instalacja albo sprawdzenie czegos tak w sieci.

Dodano 23.11.2008 17:53:02:
a nie jest sora

Dodano 23.11.2008 18:03:20:

Kod: Zaznacz wszystko: chkdsk c: /p

wpisuje to i pisze ze zly parametr

Dodano 23.11.2008 18:13:18:
dobra wpisalem udalo sie i zamknolem okno .Zrestartowalem i nici dalej tak samo

**Posty:** 8001 · przez **Okocza** 24 Lis 2008, 09:49

kristof200 napisał(a):niewiem co mam myslec ludzie mowia ze ten system jest naprawde do du*** wiec daje logi.

Vista to bardzo dobry system, mam od dłuższego czasu i nie narzekam.

To jest laptop czy stacjonarny komputer?

**Posty:** 105 · przez **kristof200** 24 Lis 2008, 21:27

Laptop.
Ale juz po problemie .Przeinstalowalem sys i wszystko ok :p i tak i tak mialem troche syfu wiec sie przydalo ale dzieki za pomoc.!!!!

Kto jest na forum