z ie i gg

**Posty:** 112 · przez **Fever** 18 Kwi 2008, 21:59

od pewnego czasu przy odpalaniu GG i IE wyskakuje mi cos takiego:
http://www.fotosik.pl/pokaz_obrazek/6f0ee927d7fc6b2b.html

pewnikiem ma to cos wspolnego z ostatnia aktualizacja windowsa, tylko jak sie tego pozbyc... IE przez to nie chodzi, gg czasem tez

**Posty:** 18165 · przez **wojtas** 19 Kwi 2008, 00:41

zmien nazwe tematu...

**Posty:** 112 · przez **Fever** 19 Kwi 2008, 11:41

nom...?

**Posty:** 18165 · przez **wojtas** 19 Kwi 2008, 15:57

poprawki do windy odinstalowyuje sie w dodaj usun programy...

**Posty:** 112 · przez **Fever** 20 Kwi 2008, 08:18

odinstalowalem wszystkie ostatnie poprawki i lipton, dalej to samo

**Posty:** 8001 · przez **Okocza** 20 Kwi 2008, 10:27

a czyściłeś rejestr po nich :?:

**Posty:** 112 · przez **Fever** 20 Kwi 2008, 12:17

okocza napisał(a):a czyściłeś rejestr po nich Question

jasne

moze to nie aktualka windy, tylko jakies inne badziewie, nie mam pomyslu co to i jak sie tego pozbyc

inna sprawa, ze jak teraz wylacze kompa, to te "poprawki" zaktualizuja sie automatycznie;]

**Posty:** 8001 · przez **Okocza** 20 Kwi 2008, 17:44

daj loga z hijack this i combofix, tylko ze najpierw zrob combofixa a potem hijack

**Posty:** 112 · przez **Fever** 21 Kwi 2008, 06:36

pierwsze co po skończeniu skana:
http://www.fotosik.pl/pokaz_obrazek/dbb96cd2997a3ea8.html

Combo:

ComboFix 08-04-20.2 - user 2008-04-21 6:23:38.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.196 [GMT 2:00]
Running from: D:\Zabezpieczenia\ComboFix.exe
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\system32\_000006_.tmp.dll

.
((((((((((((((((((((((((( Files Created from 2008-03-21 to 2008-04-21 )))))))))))))))))))))))))))))))
.

2008-04-21 06:12 . 2008-04-21 06:13 1,374 --a------ C:\WINDOWS\imsins.BAK
2008-04-21 06:11 . 2008-04-21 06:11 <DIR> d-------- C:\WINDOWS\LastGood
2008-04-13 18:52 . 2008-04-17 10:11 <DIR> d-------- C:\Documents and Settings\user\Dane aplikacji\gtk-2.0
2008-04-13 18:52 . 2008-04-13 18:52 <DIR> d-------- C:\Documents and Settings\user\.thumbnails
2008-04-13 18:49 . 2008-04-17 10:16 <DIR> d-------- C:\Documents and Settings\user\.gimp-2.4
2008-04-11 06:33 . 2008-04-11 06:34 4,350,416 --a------ C:\Program Files\gg77.exe
2008-04-09 22:59 . 2008-03-20 10:09 1,845,504 --a------ C:\WINDOWS\system32\win32k.sys
2008-04-02 14:35 . 2008-04-02 14:35 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Last.fm
2008-04-02 14:30 . 2008-04-08 16:06 <DIR> d-------- C:\Program Files\Last.fm
2008-04-02 14:30 . 2008-04-02 14:30 5,708,354 --a------ C:\Program Files\Last.fm-1.4.2.59470.exe
2008-04-02 14:24 . 2008-04-02 14:25 <DIR> d-------- C:\Program Files\Winamp
2008-04-02 14:24 . 2008-04-02 14:31 <DIR> d-------- C:\Documents and Settings\user\Dane aplikacji\Winamp
2008-04-02 14:20 . 2008-04-02 14:22 9,620,728 --a------ C:\Program Files\winamp553_full_emusic-7plus_pl-pl.exe
2008-03-21 18:50 . 2008-03-21 18:50 <DIR> d-------- C:\Documents and Settings\user\Dane aplikacji\WNR

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-04-16 21:58 --------- d-----w C:\Documents and Settings\user\Dane aplikacji\Skype
2008-04-13 19:56 --------- d-----w C:\Program Files\eMule
2008-04-12 20:46 --------- d-----w C:\Documents and Settings\user\Dane aplikacji\LimeWire
2008-04-04 16:44 --------- d-----w C:\Program Files\Java
2008-03-30 17:23 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-03-04 16:19 --------- d-----w C:\Documents and Settings\user\Dane aplikacji\BearShare
2008-03-01 13:02 826,368 ----a-w C:\WINDOWS\system32\wininet.dll
2008-02-20 06:51 282,624 ----a-w C:\WINDOWS\system32\SET22.tmp
2008-02-20 05:38 45,568 ----a-w C:\WINDOWS\system32\SET19.tmp
2008-02-20 05:38 148,992 ----a-w C:\WINDOWS\system32\SET1A.tmp
2007-11-09 15:45 162 -c--a-w C:\Documents and Settings\user\FIX.REG
2007-11-07 13:35 318,904 ----a-w C:\Program Files\wmpfirefoxplugin.exe
2006-12-26 11:27 0 -c--a-w C:\Documents and Settings\user\config.dat
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:44 15360]
"PSwitch"="d:\Programy\Proxy Switcher Standard\ProxySwitcher.exe" [2008-03-15 03:33 4422144]
"Gadu-Gadu"="D:\Programy\Gadu-Gadu\gg.exe" [2008-03-20 12:04 2127296]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="RUNDLL32.exe" [2004-08-04 00:44 33280 C:\WINDOWS\system32\rundll32.exe]
"nwiz"="nwiz.exe" [2006-01-24 19:15 1519616 C:\WINDOWS\system32\nwiz.exe]
"NvMediaCenter"="RUNDLL32.exe" [2004-08-04 00:44 33280 C:\WINDOWS\system32\rundll32.exe]
"RTHDCPL"="RTHDCPL.EXE" [2006-11-14 18:21 16270848 C:\WINDOWS\RTHDCPL.exe]
"SkyTel"="SkyTel.EXE" [2006-05-16 19:04 2879488 C:\WINDOWS\SkyTel.exe]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2008-03-29 19:37 79224]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 04:25 144784]
"WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2008-04-01 20:49 36352]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 00:44 15360]

C:\Documents and Settings\user\Menu Start\Programy\Autostart\
Last.fm Helper.lnk - C:\Program Files\Last.fm\LastFMHelper.exe [2008-04-02 14:30:30 106496]

C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\
Kalendarz XP.lnk - D:\Programy\Kalendarz XP\Kalendarz.exe [2007-11-19 00:48:12 882176]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"vidc.yv12"= yv12vfw.dll
"msacm.ac3acm"= ac3acm.acm
"VIDC.CSCD"= camcodec.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LanguageShortcut]
D:\Programy\Power DVD\Language\Language.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
--a--c--- 2001-07-09 11:50 155648 C:\WINDOWS\system32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Odkurzacz-MCD]
--a--c--- 2007-05-03 10:02 264704 C:\Program Files\Odkurzacz\odk_mcd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
--------- 2007-02-16 10:54 282624 D:\Programy\QuickTime\qttask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]
D:\Programy\Power DVD\PDVDServ.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Tweak UI]
--a------ 2004-08-04 00:44 33280 C:\WINDOWS\system32\rundll32.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
"FirewallOverride"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"D:\\Programy\\Gadu-Gadu\\gg.exe"=
"C:\\Program Files\\eMule\\emule.exe"=
"D:\\Programy\\BitComet\\BitComet.exe"=
"C:\\Program Files\\Last.fm\\LastFM.exe"=
"D:\\Gry\\q3\\q3\\quake3.exe"=
"D:\\Programy\\Sunbelt Software\\Personal Firewall 4\\kpf4ss.exe"=
"D:\\Programy\\Sunbelt Software\\Personal Firewall 4\\kpf4gui.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"D:\\Programy\\LimeWire\\LimeWire.exe"=
"D:\\Programy\\Skype\\Phone\\Skype.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"9710:TCP"= 9710:TCP:BitComet 9710 TCP
"9710:UDP"= 9710:UDP:BitComet 9710 UDP

R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-03-29 19:31]
R1 fwdrv;Firewall Driver;C:\WINDOWS\system32\drivers\fwdrv.sys [2005-12-15 18:13]
R1 khips;Kerio HIPS Driver;C:\WINDOWS\system32\drivers\khips.sys [2005-12-15 18:01]
R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-03-29 19:35]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{95b6eaaa-02f2-11dc-be69-001617872415}]
\Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL wscript.exe killVBS.vbs

*Newly Created Service* - CATCHME
.
**************************************************************************

catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-04-21 06:27:26
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

**************************************************************************
.
Completion time: 2008-04-21 6:30:13
ComboFix-quarantined-files.txt 2008-04-21 04:29:07

Pre-Run: 13,590,970,368 bajtów wolnych
Post-Run: 13,580,898,304 bajtów wolnych

131 --- E O F --- 2008-04-21 04:13:14

Hijack:

Logfile of HijackThis v1.99.1
Scan saved at 06:33:04, on 2008-04-21
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\RTHDCPL.EXE
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\Program Files\Winamp\winampa.exe
C:\WINDOWS\system32\ctfmon.exe
D:\Programy\Kalendarz XP\Kalendarz.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Last.fm\LastFMHelper.exe
D:\Programy\Sunbelt Software\Personal Firewall 4\kpf4ss.exe
C:\WINDOWS\system32\nvsvc32.exe
D:\Programy\Sunbelt Software\Personal Firewall 4\kpf4gui.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
D:\Programy\Sunbelt Software\Personal Firewall 4\kpf4gui.exe
D:\Programy\Gadu-Gadu\gg.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\svchost.exe
D:\Programy\Mozilla Firefox\firefox.exe
D:\Zabezpieczenia\hijackthis_199\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.pl/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://g.msn.co.uk/0SEENWW/SAOS01?FORM=TOOLBR
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 145.253.144.221:80
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Programy\Adobe\Acrobat 6.0 CE\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - D:\Programy\BitComet\tools\BitCometBHO.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O4 - HKLM\..\Run: [NvCplDaemon] "RUNDLL32.EXE" C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] "nwiz.exe" /install
O4 - HKLM\..\Run: [NvMediaCenter] "RUNDLL32.EXE" C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [PSwitch] d:\Programy\Proxy Switcher Standard\ProxySwitcher.exe
O4 - HKCU\..\Run: [Gadu-Gadu] "D:\Programy\Gadu-Gadu\gg.exe" /tray
O4 - Startup: Last.fm Helper.lnk = C:\Program Files\Last.fm\LastFMHelper.exe
O4 - Global Startup: Kalendarz XP.lnk = D:\Programy\Kalendarz XP\Kalendarz.exe
O8 - Extra context menu item: Download all links using BitComet - res://D:\Programy\BitComet\BitComet.exe/AddAllLink.htm
O8 - Extra context menu item: Download all videos using BitComet - res://D:\Programy\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: Download link using &BitComet - res://D:\Programy\BitComet\BitComet.exe/AddLink.htm
O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: E&ksportuj do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O11 - Options group: [INTERNATIONAL] International*
O17 - HKLM\System\CCS\Services\Tcpip\..\{E7E7A927-DDD4-4904-8C61-7B2D0A7636C2}: NameServer = 217.30.129.149,217.30.137.200
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: Sunbelt Kerio Personal Firewall 4 (KPF4) - Sunbelt Software - D:\Programy\Sunbelt Software\Personal Firewall 4\kpf4ss.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

**Posty:** 18165 · przez **wojtas** 21 Kwi 2008, 16:19

Otworz notatnik i wklej w nim to:

File::
C:\WINDOWS\system32\SET22.tmp
C:\WINDOWS\system32\SET19.tmp
C:\WINDOWS\system32\SET1A.tmp

Registry::
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{95b6eaaa-02f2-11dc-be69-001617872415}]

Plik >>> zapisz jako CFScript.txt .Plik przeciągnij i upuść na ikonę ComboFixa (tak jak tu ) . odczekaj az wygeneruje sie nowy log i go daj na forum

Autor postu otrzymał pochwałę

**Posty:** 112 · przez **Fever** 21 Kwi 2008, 18:58

ComboFix 08-04-20.2 - user 2008-04-21 18:49:13.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.134 [GMT 2:00]
Running from: D:\Zabezpieczenia\ComboFix.exe
Command switches used :: D:\Zabezpieczenia\CFScript.txt
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

FILE ::
C:\WINDOWS\system32\SET19.tmp
C:\WINDOWS\system32\SET1A.tmp
C:\WINDOWS\system32\SET22.tmp
.

((((((((((((((((((((((((( Files Created from 2008-03-21 to 2008-04-21 )))))))))))))))))))))))))))))))
.

2008-04-21 06:12 . 2008-04-21 06:13 1,374 --a------ C:\WINDOWS\imsins.BAK
2008-04-13 18:52 . 2008-04-17 10:11 <DIR> d-------- C:\Documents and Settings\user\Dane aplikacji\gtk-2.0
2008-04-13 18:52 . 2008-04-13 18:52 <DIR> d-------- C:\Documents and Settings\user\.thumbnails
2008-04-13 18:49 . 2008-04-17 10:16 <DIR> d-------- C:\Documents and Settings\user\.gimp-2.4
2008-04-11 06:33 . 2008-04-11 06:34 4,350,416 --a------ C:\Program Files\gg77.exe
2008-04-09 22:59 . 2008-03-20 10:09 1,845,504 --a------ C:\WINDOWS\system32\win32k.sys
2008-04-02 14:35 . 2008-04-02 14:35 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Last.fm
2008-04-02 14:30 . 2008-04-08 16:06 <DIR> d-------- C:\Program Files\Last.fm
2008-04-02 14:30 . 2008-04-02 14:30 5,708,354 --a------ C:\Program Files\Last.fm-1.4.2.59470.exe
2008-04-02 14:24 . 2008-04-02 14:25 <DIR> d-------- C:\Program Files\Winamp
2008-04-02 14:24 . 2008-04-02 14:31 <DIR> d-------- C:\Documents and Settings\user\Dane aplikacji\Winamp
2008-04-02 14:20 . 2008-04-02 14:22 9,620,728 --a------ C:\Program Files\winamp553_full_emusic-7plus_pl-pl.exe
2008-03-21 18:50 . 2008-03-21 18:50 <DIR> d-------- C:\Documents and Settings\user\Dane aplikacji\WNR

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-04-16 21:58 --------- d-----w C:\Documents and Settings\user\Dane aplikacji\Skype
2008-04-13 19:56 --------- d-----w C:\Program Files\eMule
2008-04-12 20:46 --------- d-----w C:\Documents and Settings\user\Dane aplikacji\LimeWire
2008-04-04 16:44 --------- d-----w C:\Program Files\Java
2008-03-30 17:23 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-03-04 16:19 --------- d-----w C:\Documents and Settings\user\Dane aplikacji\BearShare
2008-03-01 13:02 826,368 ----a-w C:\WINDOWS\system32\wininet.dll
2008-02-20 06:51 282,624 ----a-w C:\WINDOWS\system32\gdi32.dll
2008-02-20 05:38 45,568 ----a-w C:\WINDOWS\system32\dnsrslvr.dll
2007-11-09 15:45 162 -c--a-w C:\Documents and Settings\user\FIX.REG
2007-11-07 13:35 318,904 ----a-w C:\Program Files\wmpfirefoxplugin.exe
2006-12-26 11:27 0 -c--a-w C:\Documents and Settings\user\config.dat
.

((((((((((((((((((((((((((((( snapshot@2008-04-21_ 6.28.20,17 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-04-21 04:06:32 2,048 --s-a-w C:\WINDOWS\bootstat.dat
+ 2008-04-21 13:14:00 2,048 --s-a-w C:\WINDOWS\bootstat.dat
- 2006-06-26 17:45:40 148,480 ------w C:\WINDOWS\system32\dnsapi.dll
+ 2008-02-20 05:38:07 148,992 ----a-w C:\WINDOWS\system32\dnsapi.dll
- 2008-04-20 06:13:04 267,008 ----a-w C:\WINDOWS\system32\FNTCACHE.DAT
+ 2008-04-21 04:50:03 267,008 ----a-w C:\WINDOWS\system32\FNTCACHE.DAT
+ 2008-04-21 13:14:13 16,384 ----atw C:\WINDOWS\Temp\Perflib_Perfdata_544.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:44 15360]
"PSwitch"="d:\Programy\Proxy Switcher Standard\ProxySwitcher.exe" [2008-03-15 03:33 4422144]
"Gadu-Gadu"="D:\Programy\Gadu-Gadu\gg.exe" [2008-03-20 12:04 2127296]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="RUNDLL32.exe" [2004-08-04 00:44 33280 C:\WINDOWS\system32\rundll32.exe]
"nwiz"="nwiz.exe" [2006-01-24 19:15 1519616 C:\WINDOWS\system32\nwiz.exe]
"NvMediaCenter"="RUNDLL32.exe" [2004-08-04 00:44 33280 C:\WINDOWS\system32\rundll32.exe]
"RTHDCPL"="RTHDCPL.EXE" [2006-11-14 18:21 16270848 C:\WINDOWS\RTHDCPL.exe]
"SkyTel"="SkyTel.EXE" [2006-05-16 19:04 2879488 C:\WINDOWS\SkyTel.exe]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2008-03-29 19:37 79224]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 04:25 144784]
"WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2008-04-01 20:49 36352]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 00:44 15360]

C:\Documents and Settings\user\Menu Start\Programy\Autostart\
Last.fm Helper.lnk - C:\Program Files\Last.fm\LastFMHelper.exe [2008-04-02 14:30:30 106496]

C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\
Kalendarz XP.lnk - D:\Programy\Kalendarz XP\Kalendarz.exe [2007-11-19 00:48:12 882176]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"vidc.yv12"= yv12vfw.dll
"msacm.ac3acm"= ac3acm.acm
"VIDC.CSCD"= camcodec.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LanguageShortcut]
D:\Programy\Power DVD\Language\Language.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
--a--c--- 2001-07-09 11:50 155648 C:\WINDOWS\system32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Odkurzacz-MCD]
--a--c--- 2007-05-03 10:02 264704 C:\Program Files\Odkurzacz\odk_mcd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
--------- 2007-02-16 10:54 282624 D:\Programy\QuickTime\qttask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]
D:\Programy\Power DVD\PDVDServ.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Tweak UI]
--a------ 2004-08-04 00:44 33280 C:\WINDOWS\system32\rundll32.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
"FirewallOverride"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"D:\\Programy\\Gadu-Gadu\\gg.exe"=
"C:\\Program Files\\eMule\\emule.exe"=
"D:\\Programy\\BitComet\\BitComet.exe"=
"C:\\Program Files\\Last.fm\\LastFM.exe"=
"D:\\Gry\\q3\\q3\\quake3.exe"=
"D:\\Programy\\Sunbelt Software\\Personal Firewall 4\\kpf4ss.exe"=
"D:\\Programy\\Sunbelt Software\\Personal Firewall 4\\kpf4gui.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"D:\\Programy\\LimeWire\\LimeWire.exe"=
"D:\\Programy\\Skype\\Phone\\Skype.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"9710:TCP"= 9710:TCP:BitComet 9710 TCP
"9710:UDP"= 9710:UDP:BitComet 9710 UDP

R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-03-29 19:31]
R1 fwdrv;Firewall Driver;C:\WINDOWS\system32\drivers\fwdrv.sys [2005-12-15 18:13]
R1 khips;Kerio HIPS Driver;C:\WINDOWS\system32\drivers\khips.sys [2005-12-15 18:01]
R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-03-29 19:35]

.
**************************************************************************

catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-04-21 18:53:11
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

**************************************************************************
.
Completion time: 2008-04-21 18:56:11
ComboFix-quarantined-files.txt 2008-04-21 16:55:03
ComboFix2.txt 2008-04-21 04:30:15

Pre-Run: 13,581,672,448 bajtów wolnych
Post-Run: 13,588,819,968 bajtów wolnych

138 --- E O F --- 2008-04-21 04:13:14

**Posty:** 18165 · przez **wojtas** 21 Kwi 2008, 19:37

czysto

wyłacz zapore windowsa i zobacz czy dalej masz ten bład

**Posty:** 112 · przez **Fever** 21 Kwi 2008, 21:07

najciekawsze jest to, ze byla wylaczona, mimo ze myslalem ze jest inaczej
jest dalej to cos;]
trudno, moze sie przyzwyczaje.
a tak btw, to od czego to jest?

Fever napisał(a):R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

**Posty:** 8001 · przez **Okocza** 21 Kwi 2008, 21:30

to są wpisy IE. Nie masz się czym martwić. nie jest to szkodliwe na pewno

**Posty:** 112 · przez **Fever** 21 Kwi 2008, 21:36

okocza napisał(a):to są wpisy IE. Nie masz się czym martwić. nie jest to szkodliwe na pewno Wink

nie no, tyle to wiem, tylko ze wczesniej chyba ich nie bylo, wiec myslalem ze moga miec cos wspolnego;]

**Posty:** 8001 · przez **Okocza** 22 Kwi 2008, 15:39

nie, wszystko jest ok

Autor postu otrzymał pochwałę

**Posty:** 112 · przez **Fever** 22 Kwi 2008, 21:39

to dzieki za zaangazowanie panom

z ie i gg

z IE i GG

Kto jest na forum