zużycie procesu "system" 100%

**Posty:** 127 · przez **bluejack** 21 Sie 2007, 19:36

Po kilkudziesieciu minutach normalnej pracy na kompie (winamp, firefox z kilkoma zakladkami, avast i gg) strasznie zamula mi komp, wowczas zuzycie procesora waha sie od 95 do 100% , i to tylko proces SYSTEM tyle zuzywa...

Oto logi: HJ
Logfile of HijackThis v1.99.1
Scan saved at 19:29:14, on 2007-08-21
Platform: Windows XP Dodatek SP. 1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Kod: Zaznacz wszystko: Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\Explorer.EXE C:\PROGRA~1\A4Tech\Mouse\Amoumain.exe C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe C:\WINDOWS\System32\devldr32.exe C:\WINDOWS\System32\RUNDLL32.EXE C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe C:\WINDOWS\System32\ctfmon.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\System32\nvsvc32.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\Program Files\Netia\Net\netianet.exe C:\Program Files\Mozilla Firefox\firefox.exe D:\Winamp\winamp.exe D:\Moje pliki\Jacek\Pulpit\hijackthis_199\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\NEOSTR~1\SEARCH~1.DLL (file missing) O2 - BHO: My Global Search Bar BHO - {37B85A21-692B-4205-9CAD-2626E4993404} - C:\Program Files\MyGlobalSearch\bar\1.bin\MGSBAR.DLL O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll O2 - BHO: WebAssist - {85589B5D-D53D-4237-A677-46B82EA275F3} - C:\WINDOWS\WebAssist.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O3 - Toolbar: My Global Search Bar - {37B85A29-692B-4205-9CAD-2626E4993404} - C:\Program Files\MyGlobalSearch\bar\1.bin\MGSBAR.DLL O4 - HKLM\..\Run: [SiSUSBRG] C:\WINDOWS\SiSUSBrg.exe O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\Updreg.exe O4 - HKLM\..\Run: [Program Access Service] xyahfzfaub.exe O4 - HKLM\..\Run: [Windows File Upgrader] winupgrd.exe O4 - HKLM\..\Run: [Microsoft Internet Explorer] C:\WINDOWS\System32\iexplore.exe O4 - HKLM\..\Run: [Advanced DHTML Enable] C:\WINDOWS\System32\cqrefhkj.exe O4 - HKLM\..\Run: [WheelMouse] C:\PROGRA~1\A4Tech\Mouse\Amoumain.exe O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon O4 - HKLM\..\Run: [wuaurpl] C:\WINDOWS\wuaurpl.exe O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" O4 - HKLM\..\RunServices: [Program Access Service] xyahfzfaub.exe O4 - HKLM\..\RunServices: [Windows File Upgrader] winupgrd.exe O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe O4 - HKCU\..\Run: [Komunikator] C:\Program Files\Tlen.pl\tlen.exe O4 - HKCU\..\RunServices: [WMI Standard Event Consumer - Scripting] C:\WINDOWS\System32\wbem\scrcons32.exe O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{32571811-FC9A-443F-AA53-51D0D8D59C8C}: NameServer = 213.241.79.37 83.238.255.76 O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing) O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing) O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe

[/code]

**Posty:** 3854 · przez **Dzi@dek** 21 Sie 2007, 19:42

Loga obejmij w tagi code lub quote - zaznacz tekst i kliknij.

**Posty:** 18165 · przez **wojtas** 21 Sie 2007, 20:27

Użyj WWDC :
http://www.firewallleaktester.com/wwdc.htm
Zmień opcje z disable na enable. Uruchom ponownie komputer.
Tak powinny wyglądać porty (NetBIOS może być żółty) :
http://www.firewallleaktester.com/images_site/wwdc.jpg

zastosuj:

smitfraudfix z opcji 2:

http://siri.urz.free.fr/Fix/SmitfraudFix_En.php

potem daj loga z combofixa oraz z hijacka

**Posty:** 127 · przez **bluejack** 21 Sie 2007, 23:03

COMBOFIX

Kod: Zaznacz wszystko: ComboFix 07-08-17.2 - "Pan Stawicki" 2007-08-21 22:50:50.1 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.1.1250.1.1045.18.60 [GMT 2:00] * Created a new restore point ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) C:\Program Files\myglobalsearch C:\Program Files\myglobalsearch\bar\1.bin\M9FFXTBR.JAR C:\Program Files\myglobalsearch\bar\1.bin\M9FFXTBR.MANIFEST C:\Program Files\myglobalsearch\bar\1.bin\M9NTSTBR.JAR C:\Program Files\myglobalsearch\bar\1.bin\M9NTSTBR.MANIFEST C:\Program Files\myglobalsearch\bar\1.bin\M9PLUGIN.DLL C:\Program Files\myglobalsearch\bar\1.bin\MGSBAR.DLL C:\Program Files\myglobalsearch\bar\1.bin\NPMYGLSH.DLL C:\Program Files\myglobalsearch\bar\Cache\0004CBA9.bin C:\Program Files\myglobalsearch\bar\Cache\0004CE29.bin C:\Program Files\myglobalsearch\bar\Cache\0004D01D.bin C:\Program Files\myglobalsearch\bar\Cache\008C1FB4 C:\Program Files\myglobalsearch\bar\Cache\files.ini C:\Program Files\myglobalsearch\bar\History\search C:\Program Files\myglobalsearch\bar\Settings\prevcfg.htm C:\WINDOWS\sisport.sys C:\WINDOWS\WebAssist.dll ((((((((((((((((((((((((( Files Created from 2007-07-21 to 2007-08-21 ))))))))))))))))))))))))))))))) 2007-08-21 22:50 51,200 --a------ C:\WINDOWS\nircmd.exe 2007-08-21 22:35 53,248 --a------ C:\WINDOWS\system32\Process.exe 2007-08-21 22:35 51,200 --a------ C:\WINDOWS\system32\dumphive.exe 2007-08-21 22:35 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe 2007-08-21 22:35 2,450 --a------ C:\WINDOWS\system32\tmp.reg 2007-08-21 18:48 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\nView_Profiles 2007-08-20 15:49 <DIR> d-------- C:\Program Files\MarBit 2007-08-16 19:17 98,816 --a------ C:\WINDOWS\system32\dmstyle.dll 2007-08-16 19:17 937,984 --a------ C:\WINDOWS\system32\dxdiag.exe 2007-08-16 19:17 83,968 --a------ C:\WINDOWS\system32\drivers\nabtsfec.sys 2007-08-16 19:17 80,896 --a------ C:\WINDOWS\system32\dpvsetup.exe 2007-08-16 19:17 8,192 --a------ C:\WINDOWS\system32\d3d8thk.dll 2007-08-16 19:17 797,184 --a------ C:\WINDOWS\system32\d3dim700.dll 2007-08-16 19:17 77,824 --a------ C:\WINDOWS\system32\dpmodemx.dll 2007-08-16 19:17 76,800 --a------ C:\WINDOWS\system32\dpwsockx.dll 2007-08-16 19:17 76,800 --a------ C:\WINDOWS\system32\dmscript.dll 2007-08-16 19:17 733,184 --a------ C:\WINDOWS\system32\qedwipes.dll 2007-08-16 19:17 723,968 --a------ C:\WINDOWS\system32\dpnet.dll 2007-08-16 19:17 7,424 --a------ C:\WINDOWS\system32\drivers\mskssrv.sys 2007-08-16 19:17 68,096 --a------ C:\WINDOWS\system32\dpnhupnp.dll 2007-08-16 19:17 64,512 --a------ C:\WINDOWS\system32\amstream.dll 2007-08-16 19:17 602,624 --a------ C:\WINDOWS\system32\dx7vb.dll 2007-08-16 19:17 58,368 --a------ C:\WINDOWS\system32\dmcompos.dll 2007-08-16 19:17 52,096 --a------ C:\WINDOWS\system32\drivers\msdv.sys 2007-08-16 19:17 5,504 --a------ C:\WINDOWS\system32\drivers\mstee.sys 2007-08-16 19:17 5,248 --a------ C:\WINDOWS\system32\drivers\mspclock.sys 2007-08-16 19:17 491,520 --a------ C:\WINDOWS\system32\dsdmoprp.dll 2007-08-16 19:17 47,104 --a------ C:\WINDOWS\system32\wstdecod.dll 2007-08-16 19:17 45,696 --a------ C:\WINDOWS\system32\drivers\stream.sys 2007-08-16 19:17 449,024 --a------ C:\WINDOWS\system32\qdvd.dll 2007-08-16 19:17 44,544 --a------ C:\WINDOWS\system32\dxdllreg.exe 2007-08-16 19:17 4,608 --a------ C:\WINDOWS\system32\drivers\mspqm.sys 2007-08-16 19:17 4,096 --a------ C:\WINDOWS\system32\ksuser.dll 2007-08-16 19:17 4,096 --a------ C:\WINDOWS\system32\drivers\swenum.sys 2007-08-16 19:17 381,952 --a------ C:\WINDOWS\system32\dpvoice.dll 2007-08-16 19:17 355,328 --a------ C:\WINDOWS\system32\dsound.dll 2007-08-16 19:17 354,816 --a------ C:\WINDOWS\system32\psisdecd.dll 2007-08-16 19:17 34,304 --a------ C:\WINDOWS\system32\mciqtz32.dll 2007-08-16 19:17 33,280 --a------ C:\WINDOWS\system32\dmloader.dll 2007-08-16 19:17 324,096 --a------ C:\WINDOWS\system32\mswebdvd.dll 2007-08-16 19:17 32,768 --a------ C:\WINDOWS\system32\dpnhpast.dll 2007-08-16 19:17 311,808 --a------ C:\WINDOWS\system32\qdv.dll 2007-08-16 19:17 3,072 --a------ C:\WINDOWS\system32\dpnlobby.dll 2007-08-16 19:17 3,072 --a------ C:\WINDOWS\system32\dpnaddr.dll 2007-08-16 19:17 284,160 --a------ C:\WINDOWS\system32\ddraw.dll 2007-08-16 19:17 28,160 --a------ C:\WINDOWS\system32\dplaysvr.exe 2007-08-16 19:17 27,136 --a------ C:\WINDOWS\system32\dmband.dll 2007-08-16 19:17 257,024 --a------ C:\WINDOWS\system32\qcap.dll 2007-08-16 19:17 24,064 --a------ C:\WINDOWS\system32\ddrawex.dll 2007-08-16 19:17 217,600 --a------ C:\WINDOWS\system32\dplayx.dll 2007-08-16 19:17 19,968 --a------ C:\WINDOWS\system32\dpvacm.dll 2007-08-16 19:17 186,880 --a------ C:\WINDOWS\system32\dsdmo.dll 2007-08-16 19:17 18,944 --a------ C:\WINDOWS\system32\encapi.dll 2007-08-16 19:17 18,688 --a------ C:\WINDOWS\system32\drivers\wstcodec.sys 2007-08-16 19:17 18,432 --a------ C:\WINDOWS\system32\dswave.dll 2007-08-16 19:17 171,520 --a------ C:\WINDOWS\system32\dmime.dll 2007-08-16 19:17 16,896 --a------ C:\WINDOWS\system32\msyuv.dll 2007-08-16 19:17 16,896 --a------ C:\WINDOWS\system32\dpnsvr.exe 2007-08-16 19:17 16,384 --a------ C:\WINDOWS\system32\drivers\ccdecode.sys 2007-08-16 19:17 15,104 --a------ C:\WINDOWS\system32\drivers\mpe.sys 2007-08-16 19:17 14,976 --a------ C:\WINDOWS\system32\drivers\streamip.sys 2007-08-16 19:17 132,608 --a------ C:\WINDOWS\system32\devenum.dll 2007-08-16 19:17 130,304 --a------ C:\WINDOWS\system32\drivers\ks.sys 2007-08-16 19:17 13,312 --a------ C:\WINDOWS\system32\msdmo.dll 2007-08-16 19:17 116,736 --a------ C:\WINDOWS\system32\dmusic.dll 2007-08-16 19:17 112,128 --a------ C:\WINDOWS\system32\dpvvox.dll 2007-08-16 19:17 11,392 --a------ C:\WINDOWS\system32\drivers\bdasup.sys 2007-08-16 19:17 100,864 --a------ C:\WINDOWS\system32\dmsynth.dll 2007-08-16 19:17 10,880 --a------ C:\WINDOWS\system32\drivers\slip.sys 2007-08-16 19:17 10,112 --a------ C:\WINDOWS\system32\drivers\ndisip.sys 2007-08-16 19:17 1,962,496 --a------ C:\WINDOWS\system32\quartz.dll 2007-08-16 19:17 1,798,144 --a------ C:\WINDOWS\system32\qedit.dll 2007-08-16 19:17 1,675,264 --a------ C:\WINDOWS\system32\dxdiagn.dll 2007-08-16 19:17 1,634,304 --a------ C:\WINDOWS\system32\d3d9.dll 2007-08-16 19:17 1,294,336 --a------ C:\WINDOWS\system32\dsound3d.dll 2007-08-16 19:17 1,230,336 --a------ C:\WINDOWS\system32\msvidctl.dll 2007-08-16 19:17 1,189,888 --a------ C:\WINDOWS\system32\dx8vb.dll 2007-08-16 19:17 1,177,600 --a------ C:\WINDOWS\system32\d3d8.dll 2007-08-14 17:49 <DIR> d-------- C:\DOCUME~1\PANSTA~1\DANEAP~1\XnView 2007-08-14 13:54 98,304 --a------ C:\WINDOWS\system32\wmpshell.dll 2007-08-14 13:54 7,680 --a------ C:\WINDOWS\system32\asferror.dll 2007-08-14 13:54 52,224 --a------ C:\WINDOWS\system32\mspmsnsv.dll 2007-08-14 13:54 384,512 --a------ C:\WINDOWS\system32\mp4sdmod.dll 2007-08-14 13:54 358,912 --a------ C:\WINDOWS\system32\msscp.dll 2007-08-14 13:54 316,040 --a------ C:\WINDOWS\system32\mp43dmod.dll 2007-08-14 13:54 27,136 --a------ C:\WINDOWS\system32\wmdmlog.dll 2007-08-14 13:54 245,760 --a------ C:\WINDOWS\system32\mswmdm.dll 2007-08-14 13:54 241,664 --a------ C:\WINDOWS\system32\mpg4dmod.dll 2007-08-14 13:54 23,552 --a------ C:\WINDOWS\system32\wmdmps.dll 2007-08-14 13:54 225,280 --a------ C:\WINDOWS\system32\wmpdxm.dll 2007-08-14 13:54 208,896 --a------ C:\WINDOWS\system32\wmpns.dll 2007-08-14 13:54 201,728 --a------ C:\WINDOWS\system32\mspmsp.dll 2007-08-14 13:54 20,480 --a------ C:\WINDOWS\system32\wmpui.dll 2007-08-14 13:54 20,480 --a------ C:\WINDOWS\system32\wmpcore.dll 2007-08-14 13:54 20,480 --a------ C:\WINDOWS\system32\wmpcd.dll 2007-08-14 13:54 2,940,928 --a------ C:\WINDOWS\system32\wmploc.dll 2007-08-14 13:54 167,936 --a------ C:\WINDOWS\system32\wmerror.dll 2007-08-14 13:54 159,232 --a------ C:\WINDOWS\system32\CEWMDM.dll 2007-08-14 13:54 106,496 --a------ C:\WINDOWS\system32\wmpasf.dll 2007-08-14 13:54 <DIR> d-------- C:\WINDOWS\RegisteredPackages (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) 2007-08-16 21:58 --------- d--h----- C:\Program Files\InstallShield Installation Information 2007-07-27 19:31 --------- d-------- C:\Program Files\Common Files\InstallShield 2007-07-27 17:11 --------- d-------- C:\Program Files\Neostrada TP 2007-07-20 13:01 --------- d-------- C:\Program Files\Netia 2007-07-20 12:52 --------- d--h----- C:\Program Files\WindowsUpdate 2007-07-19 20:05 --------- d-------- C:\Program Files\Creative 2007-07-19 19:16 2410 --a------ C:\WINDOWS\pchealth\HelpCtr\PackageStore\SkuStore.bin 2007-07-19 18:59 --------- d-------- C:\Program Files\Common Files\SpeechEngines 2007-07-19 18:59 --------- d-------- C:\Program Files\Common Files\ODBC 2007-07-19 18:08 --------- d-------- C:\Program Files\microsoft frontpage 2007-07-19 18:07 8738 --a------ C:\WINDOWS\pchealth\HelpCtr\Config\Cntstore.bin 2007-07-19 18:07 0 -rahs---- C:\MSDOS.SYS 2007-07-19 18:07 0 -rahs---- C:\IO.SYS 2007-07-19 18:07 0 --a------ C:\CONFIG.SYS 2007-07-19 18:07 0 --a------ C:\AUTOEXEC.BAT 2007-07-19 18:05 --------- d-------- C:\Program Files\Movie Maker 2007-07-19 18:05 --------- d-------- C:\Program Files\Common Files\MSSoap 2007-07-19 18:04 --------- d-------- C:\Program Files\Windows NT 2007-07-19 18:04 --------- d-------- C:\Program Files\MSN Gaming Zone 2007-07-19 18:04 --------- d-------- C:\Program Files\Messenger --------- C:\Program Files\Usługi online ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SiSUSBRG"="C:\WINDOWS\SiSUSBrg.exe" [2002-04-26 11:17] "UpdReg"="C:\WINDOWS\Updreg.exe" [2000-05-11 01:00] "Program Access Service"="xyahfzfaub.exe" [] "Windows File Upgrader"="winupgrd.exe" [] "Microsoft Internet Explorer"="C:\WINDOWS\System32\iexplore.exe" [] "Advanced DHTML Enable"="C:\WINDOWS\System32\cqrefhkj.exe" [] "WheelMouse"="C:\PROGRA~1\A4Tech\Mouse\Amoumain.exe" [2004-08-25 17:31] "SpeedTouch USB Diagnostics"="C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" [2004-01-26 11:38] "wuaurpl"="C:\WINDOWS\wuaurpl.exe" [2007-07-27 17:19] "NvCplDaemon"="C:\WINDOWS\System32\NvCpl.dll" [2005-04-01 16:16] "nwiz"="nwiz.exe" [2005-04-01 16:16 C:\WINDOWS\system32\nwiz.exe] "NvMediaCenter"="C:\WINDOWS\System32\NvMcTray.dll" [2005-04-01 16:16] "avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-07-28 00:03] "NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 11:50] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" [2007-07-12 04:00] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\System32\ctfmon.exe" [2002-09-29 00:00] "Komunikator"="C:\Program Files\Tlen.pl\tlen.exe" [] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\runservices] "WMI Standard Event Consumer - Scripting"=C:\WINDOWS\System32\wbem\scrcons32.exe [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\runservices] "Program Access Service"=xyahfzfaub.exe "Windows File Upgrader"=winupgrd.exe [HKEY_USERS\.default\software\microsoft\windows\currentversion\runservices] "WMI Standard Event Consumer - Scripting"=C:\WINDOWS\System32\wbem\scrcons32.exe [HKEY_USERS\.default\software\microsoft\windows\currentversion\run] "wuaurpl"=C:\WINDOWS\wuaurpl.exe [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa] "WMI Standard Event Consumer - Scripting"= C:\WINDOWS\System32\wbem\scrcons32.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Komunikator] C:\Program Files\Tlen.pl\tlen.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Winamp Agent] C:\WINDOWS\System32\winamp.exe R1 VIAPFD;VIAPFD;C:\WINDOWS\System32\Drivers\VIAPFD.SYS R2 Local Service;Local Service;"C:\WINDOWS\wuaurpl.exe" S3 USBSTOR;Sterownik magazynu masowego USB;C:\WINDOWS\System32\DRIVERS\USBSTOR.SYS *Newly Created Service* - ALG *Newly Created Service* - IPNAT ************************************************************************** catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-08-21 22:53:02 Windows 5.1.2600 Dodatek Service Pack. 1 NTFS scanning hidden processes ... C:\WINDOWS\wuaurpl.exe [1652] 0x81420630 scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** Completion time: 2007-08-21 22:53:45 - machine was rebooted C:\ComboFix-quarantined-files.txt ... 2007-08-21 22:53 --- E O F ---

HJ

Kod: Zaznacz wszystko: Logfile of HijackThis v1.99.1 Scan saved at 22:55:40, on 2007-08-21 Platform: Windows XP Dodatek SP. 1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\System32\devldr32.exe C:\WINDOWS\System32\nvsvc32.exe C:\PROGRA~1\A4Tech\Mouse\Amoumain.exe C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe C:\WINDOWS\System32\RUNDLL32.EXE C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe C:\WINDOWS\System32\ctfmon.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Netia\Net\netianet.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\WINDOWS\system\smss.exe D:\Moje pliki\Jacek\Pulpit\hijackthis_199\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\NEOSTR~1\SEARCH~1.DLL (file missing) O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O3 - Toolbar: My Global Search Bar - {37B85A29-692B-4205-9CAD-2626E4993404} - C:\Program Files\MyGlobalSearch\bar\1.bin\MGSBAR.DLL (file missing) O4 - HKLM\..\Run: [SiSUSBRG] C:\WINDOWS\SiSUSBrg.exe O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\Updreg.exe O4 - HKLM\..\Run: [Program Access Service] xyahfzfaub.exe O4 - HKLM\..\Run: [Windows File Upgrader] winupgrd.exe O4 - HKLM\..\Run: [Microsoft Internet Explorer] C:\WINDOWS\System32\iexplore.exe O4 - HKLM\..\Run: [Advanced DHTML Enable] C:\WINDOWS\System32\cqrefhkj.exe O4 - HKLM\..\Run: [WheelMouse] C:\PROGRA~1\A4Tech\Mouse\Amoumain.exe O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon O4 - HKLM\..\Run: [wuaurpl] C:\WINDOWS\wuaurpl.exe O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" O4 - HKLM\..\RunServices: [Program Access Service] xyahfzfaub.exe O4 - HKLM\..\RunServices: [Windows File Upgrader] winupgrd.exe O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe O4 - HKCU\..\Run: [Komunikator] C:\Program Files\Tlen.pl\tlen.exe O4 - HKCU\..\RunServices: [WMI Standard Event Consumer - Scripting] C:\WINDOWS\System32\wbem\scrcons32.exe O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{32571811-FC9A-443F-AA53-51D0D8D59C8C}: NameServer = 213.241.79.37 83.238.255.76 O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing) O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing) O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe O23 - Service: Windows NT Session Manager (WINNTSMSS) - Unknown owner - C:\WINDOWS\system\smss.exe

**Posty:** 18165 · przez **wojtas** 22 Sie 2007, 09:52

start>uruchom>cmd>wpisz

sc stop WINNTSMSS

enter

sc delete WINNTSMSS

enter

potem skasuj: (najpierw wpisy + pogrubione do kosza choc nie wiem czy beda po combo ich nie pokazuje

)

O3 - Toolbar: My Global Search Bar - {37B85A29-692B-4205-9CAD-2626E4993404} - C:\Program Files\MyGlobalSearch\bar\1.bin\MGSBAR.DLL (file missing)
O4 - HKLM\..\Run: [Program Access Service] xyahfzfaub.exe
O4 - HKLM\..\Run: [Windows File Upgrader] winupgrd.exe
O4 - HKLM\..\Run: [Microsoft Internet Explorer] C:\WINDOWS\System32\iexplore.exe
O4 - HKLM\..\Run: [Advanced DHTML Enable] C:\WINDOWS\System32\cqrefhkj.exe
O4 - HKLM\..\Run: [wuaurpl] C:\WINDOWS\wuaurpl.exe
O4 - HKLM\..\RunServices: [Program Access Service] xyahfzfaub.exe
O4 - HKLM\..\RunServices: [Windows File Upgrader] winupgrd.exe
O4 - HKCU\..\RunServices: [WMI Standard Event Consumer - Scripting] C:\WINDOWS\System32\wbem\scrcons32.exe
O23 - Service: Windows NT Session Manager (WINNTSMSS) - Unknown owner - C:\WINDOWS\system\smss.exe << uwazaj na lokalizacje pliku w C:\WINDOWS\system jest wirus

potem nowe logi

**Posty:** 127 · przez **bluejack** 22 Sie 2007, 12:26

wojtas19162 napisał(a): choc nie wiem czy beda po combo ich nie pokazuje

no właśnie ich nie ma

a avast mi nie wykazał żadnych wirów w C:\WINDOWS\system\

Oto logi :HJ

Kod: Zaznacz wszystko: Logfile of HijackThis v1.99.1 Scan saved at 12:14:57, on 2007-08-22 Platform: Windows XP Dodatek SP. 1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\PROGRA~1\A4Tech\Mouse\Amoumain.exe C:\WINDOWS\System32\devldr32.exe C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe C:\WINDOWS\System32\RUNDLL32.EXE C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe C:\WINDOWS\System32\ctfmon.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\System32\nvsvc32.exe C:\WINDOWS\system\smss.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Netia\Net\netianet.exe C:\Program Files\Mozilla Firefox\firefox.exe D:\Moje pliki\Jacek\Pulpit\hijackthis_199\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\NEOSTR~1\SEARCH~1.DLL (file missing) O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O4 - HKLM\..\Run: [SiSUSBRG] C:\WINDOWS\SiSUSBrg.exe O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\Updreg.exe O4 - HKLM\..\Run: [Windows File Upgrader] winupgrd.exe O4 - HKLM\..\Run: [WheelMouse] C:\PROGRA~1\A4Tech\Mouse\Amoumain.exe O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe O4 - HKCU\..\Run: [Komunikator] C:\Program Files\Tlen.pl\tlen.exe O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{32571811-FC9A-443F-AA53-51D0D8D59C8C}: NameServer = 213.241.79.37 83.238.255.76 O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing) O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing) O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe

Combofix

Kod: Zaznacz wszystko: ComboFix 07-08-17.2 - "Pan Stawicki" 2007-08-22 12:33:25.3 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.1.1250.1.1045.18.101 [GMT 2:00] ((((((((((((((((((((((((( Files Created from 2007-07-22 to 2007-08-22 ))))))))))))))))))))))))))))))) 2007-08-21 22:50 51,200 --a------ C:\WINDOWS\nircmd.exe 2007-08-21 22:35 53,248 --a------ C:\WINDOWS\system32\Process.exe 2007-08-21 22:35 51,200 --a------ C:\WINDOWS\system32\dumphive.exe 2007-08-21 22:35 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe 2007-08-21 22:35 2,450 --a------ C:\WINDOWS\system32\tmp.reg 2007-08-21 18:48 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\nView_Profiles 2007-08-20 15:49 <DIR> d-------- C:\Program Files\MarBit 2007-08-16 19:17 98,816 --a------ C:\WINDOWS\system32\dmstyle.dll 2007-08-16 19:17 937,984 --a------ C:\WINDOWS\system32\dxdiag.exe 2007-08-16 19:17 83,968 --a------ C:\WINDOWS\system32\drivers\nabtsfec.sys 2007-08-16 19:17 80,896 --a------ C:\WINDOWS\system32\dpvsetup.exe 2007-08-16 19:17 8,192 --a------ C:\WINDOWS\system32\d3d8thk.dll 2007-08-16 19:17 797,184 --a------ C:\WINDOWS\system32\d3dim700.dll 2007-08-16 19:17 77,824 --a------ C:\WINDOWS\system32\dpmodemx.dll 2007-08-16 19:17 76,800 --a------ C:\WINDOWS\system32\dpwsockx.dll 2007-08-16 19:17 76,800 --a------ C:\WINDOWS\system32\dmscript.dll 2007-08-16 19:17 733,184 --a------ C:\WINDOWS\system32\qedwipes.dll 2007-08-16 19:17 723,968 --a------ C:\WINDOWS\system32\dpnet.dll 2007-08-16 19:17 7,424 --a------ C:\WINDOWS\system32\drivers\mskssrv.sys 2007-08-16 19:17 68,096 --a------ C:\WINDOWS\system32\dpnhupnp.dll 2007-08-16 19:17 64,512 --a------ C:\WINDOWS\system32\amstream.dll 2007-08-16 19:17 602,624 --a------ C:\WINDOWS\system32\dx7vb.dll 2007-08-16 19:17 58,368 --a------ C:\WINDOWS\system32\dmcompos.dll 2007-08-16 19:17 52,096 --a------ C:\WINDOWS\system32\drivers\msdv.sys 2007-08-16 19:17 5,504 --a------ C:\WINDOWS\system32\drivers\mstee.sys 2007-08-16 19:17 5,248 --a------ C:\WINDOWS\system32\drivers\mspclock.sys 2007-08-16 19:17 491,520 --a------ C:\WINDOWS\system32\dsdmoprp.dll 2007-08-16 19:17 47,104 --a------ C:\WINDOWS\system32\wstdecod.dll 2007-08-16 19:17 45,696 --a------ C:\WINDOWS\system32\drivers\stream.sys 2007-08-16 19:17 449,024 --a------ C:\WINDOWS\system32\qdvd.dll 2007-08-16 19:17 44,544 --a------ C:\WINDOWS\system32\dxdllreg.exe 2007-08-16 19:17 4,608 --a------ C:\WINDOWS\system32\drivers\mspqm.sys 2007-08-16 19:17 4,096 --a------ C:\WINDOWS\system32\ksuser.dll 2007-08-16 19:17 4,096 --a------ C:\WINDOWS\system32\drivers\swenum.sys 2007-08-16 19:17 381,952 --a------ C:\WINDOWS\system32\dpvoice.dll 2007-08-16 19:17 355,328 --a------ C:\WINDOWS\system32\dsound.dll 2007-08-16 19:17 354,816 --a------ C:\WINDOWS\system32\psisdecd.dll 2007-08-16 19:17 34,304 --a------ C:\WINDOWS\system32\mciqtz32.dll 2007-08-16 19:17 33,280 --a------ C:\WINDOWS\system32\dmloader.dll 2007-08-16 19:17 324,096 --a------ C:\WINDOWS\system32\mswebdvd.dll 2007-08-16 19:17 32,768 --a------ C:\WINDOWS\system32\dpnhpast.dll 2007-08-16 19:17 311,808 --a------ C:\WINDOWS\system32\qdv.dll 2007-08-16 19:17 3,072 --a------ C:\WINDOWS\system32\dpnlobby.dll 2007-08-16 19:17 3,072 --a------ C:\WINDOWS\system32\dpnaddr.dll 2007-08-16 19:17 284,160 --a------ C:\WINDOWS\system32\ddraw.dll 2007-08-16 19:17 28,160 --a------ C:\WINDOWS\system32\dplaysvr.exe 2007-08-16 19:17 27,136 --a------ C:\WINDOWS\system32\dmband.dll 2007-08-16 19:17 257,024 --a------ C:\WINDOWS\system32\qcap.dll 2007-08-16 19:17 24,064 --a------ C:\WINDOWS\system32\ddrawex.dll 2007-08-16 19:17 217,600 --a------ C:\WINDOWS\system32\dplayx.dll 2007-08-16 19:17 19,968 --a------ C:\WINDOWS\system32\dpvacm.dll 2007-08-16 19:17 186,880 --a------ C:\WINDOWS\system32\dsdmo.dll 2007-08-16 19:17 18,944 --a------ C:\WINDOWS\system32\encapi.dll 2007-08-16 19:17 18,688 --a------ C:\WINDOWS\system32\drivers\wstcodec.sys 2007-08-16 19:17 18,432 --a------ C:\WINDOWS\system32\dswave.dll 2007-08-16 19:17 171,520 --a------ C:\WINDOWS\system32\dmime.dll 2007-08-16 19:17 16,896 --a------ C:\WINDOWS\system32\msyuv.dll 2007-08-16 19:17 16,896 --a------ C:\WINDOWS\system32\dpnsvr.exe 2007-08-16 19:17 16,384 --a------ C:\WINDOWS\system32\drivers\ccdecode.sys 2007-08-16 19:17 15,104 --a------ C:\WINDOWS\system32\drivers\mpe.sys 2007-08-16 19:17 14,976 --a------ C:\WINDOWS\system32\drivers\streamip.sys 2007-08-16 19:17 132,608 --a------ C:\WINDOWS\system32\devenum.dll 2007-08-16 19:17 130,304 --a------ C:\WINDOWS\system32\drivers\ks.sys 2007-08-16 19:17 13,312 --a------ C:\WINDOWS\system32\msdmo.dll 2007-08-16 19:17 116,736 --a------ C:\WINDOWS\system32\dmusic.dll 2007-08-16 19:17 112,128 --a------ C:\WINDOWS\system32\dpvvox.dll 2007-08-16 19:17 11,392 --a------ C:\WINDOWS\system32\drivers\bdasup.sys 2007-08-16 19:17 100,864 --a------ C:\WINDOWS\system32\dmsynth.dll 2007-08-16 19:17 10,880 --a------ C:\WINDOWS\system32\drivers\slip.sys 2007-08-16 19:17 10,112 --a------ C:\WINDOWS\system32\drivers\ndisip.sys 2007-08-16 19:17 1,962,496 --a------ C:\WINDOWS\system32\quartz.dll 2007-08-16 19:17 1,798,144 --a------ C:\WINDOWS\system32\qedit.dll 2007-08-16 19:17 1,675,264 --a------ C:\WINDOWS\system32\dxdiagn.dll 2007-08-16 19:17 1,634,304 --a------ C:\WINDOWS\system32\d3d9.dll 2007-08-16 19:17 1,294,336 --a------ C:\WINDOWS\system32\dsound3d.dll 2007-08-16 19:17 1,230,336 --a------ C:\WINDOWS\system32\msvidctl.dll 2007-08-16 19:17 1,189,888 --a------ C:\WINDOWS\system32\dx8vb.dll 2007-08-16 19:17 1,177,600 --a------ C:\WINDOWS\system32\d3d8.dll 2007-08-14 17:49 <DIR> d-------- C:\DOCUME~1\PANSTA~1\DANEAP~1\XnView 2007-08-14 13:54 98,304 --a------ C:\WINDOWS\system32\wmpshell.dll 2007-08-14 13:54 7,680 --a------ C:\WINDOWS\system32\asferror.dll 2007-08-14 13:54 52,224 --a------ C:\WINDOWS\system32\mspmsnsv.dll 2007-08-14 13:54 384,512 --a------ C:\WINDOWS\system32\mp4sdmod.dll 2007-08-14 13:54 358,912 --a------ C:\WINDOWS\system32\msscp.dll 2007-08-14 13:54 316,040 --a------ C:\WINDOWS\system32\mp43dmod.dll 2007-08-14 13:54 27,136 --a------ C:\WINDOWS\system32\wmdmlog.dll 2007-08-14 13:54 245,760 --a------ C:\WINDOWS\system32\mswmdm.dll 2007-08-14 13:54 241,664 --a------ C:\WINDOWS\system32\mpg4dmod.dll 2007-08-14 13:54 23,552 --a------ C:\WINDOWS\system32\wmdmps.dll 2007-08-14 13:54 225,280 --a------ C:\WINDOWS\system32\wmpdxm.dll 2007-08-14 13:54 208,896 --a------ C:\WINDOWS\system32\wmpns.dll 2007-08-14 13:54 201,728 --a------ C:\WINDOWS\system32\mspmsp.dll 2007-08-14 13:54 20,480 --a------ C:\WINDOWS\system32\wmpui.dll 2007-08-14 13:54 20,480 --a------ C:\WINDOWS\system32\wmpcore.dll 2007-08-14 13:54 20,480 --a------ C:\WINDOWS\system32\wmpcd.dll 2007-08-14 13:54 2,940,928 --a------ C:\WINDOWS\system32\wmploc.dll 2007-08-14 13:54 167,936 --a------ C:\WINDOWS\system32\wmerror.dll 2007-08-14 13:54 159,232 --a------ C:\WINDOWS\system32\CEWMDM.dll 2007-08-14 13:54 106,496 --a------ C:\WINDOWS\system32\wmpasf.dll 2007-08-14 13:54 <DIR> d-------- C:\WINDOWS\RegisteredPackages (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) 2007-08-16 21:58 --------- d--h----- C:\Program Files\InstallShield Installation Information 2007-07-27 19:31 --------- d-------- C:\Program Files\Common Files\InstallShield 2007-07-27 17:11 --------- d-------- C:\Program Files\Neostrada TP 2007-07-20 13:01 --------- d-------- C:\Program Files\Netia 2007-07-20 12:52 --------- d--h----- C:\Program Files\WindowsUpdate 2007-07-19 20:05 --------- d-------- C:\Program Files\Creative 2007-07-19 19:16 2410 --a------ C:\WINDOWS\pchealth\HelpCtr\PackageStore\SkuStore.bin 2007-07-19 18:59 --------- d-------- C:\Program Files\Common Files\SpeechEngines 2007-07-19 18:59 --------- d-------- C:\Program Files\Common Files\ODBC 2007-07-19 18:08 --------- d-------- C:\Program Files\microsoft frontpage 2007-07-19 18:07 8738 --a------ C:\WINDOWS\pchealth\HelpCtr\Config\Cntstore.bin 2007-07-19 18:07 0 -rahs---- C:\MSDOS.SYS 2007-07-19 18:07 0 -rahs---- C:\IO.SYS 2007-07-19 18:07 0 --a------ C:\CONFIG.SYS 2007-07-19 18:07 0 --a------ C:\AUTOEXEC.BAT 2007-07-19 18:05 --------- d-------- C:\Program Files\Movie Maker 2007-07-19 18:05 --------- d-------- C:\Program Files\Common Files\MSSoap 2007-07-19 18:04 --------- d-------- C:\Program Files\Windows NT 2007-07-19 18:04 --------- d-------- C:\Program Files\MSN Gaming Zone 2007-07-19 18:04 --------- d-------- C:\Program Files\Messenger --------- C:\Program Files\Usługi online ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SiSUSBRG"="C:\WINDOWS\SiSUSBrg.exe" [2002-04-26 11:17] "UpdReg"="C:\WINDOWS\Updreg.exe" [2000-05-11 01:00] "Windows File Upgrader"="winupgrd.exe" [] "WheelMouse"="C:\PROGRA~1\A4Tech\Mouse\Amoumain.exe" [2004-08-25 17:31] "SpeedTouch USB Diagnostics"="C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" [2004-01-26 11:38] "NvCplDaemon"="C:\WINDOWS\System32\NvCpl.dll" [2005-04-01 16:16] "nwiz"="nwiz.exe" [2005-04-01 16:16 C:\WINDOWS\system32\nwiz.exe] "NvMediaCenter"="C:\WINDOWS\System32\NvMcTray.dll" [2005-04-01 16:16] "avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-07-28 00:03] "NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 11:50] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" [2007-07-12 04:00] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\System32\ctfmon.exe" [2002-09-29 00:00] "Komunikator"="C:\Program Files\Tlen.pl\tlen.exe" [] [HKEY_USERS\.default\software\microsoft\windows\currentversion\runservices] "WMI Standard Event Consumer - Scripting"=C:\WINDOWS\System32\wbem\scrcons32.exe [HKEY_USERS\.default\software\microsoft\windows\currentversion\run] "wuaurpl"=C:\WINDOWS\wuaurpl.exe [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa] "WMI Standard Event Consumer - Scripting"= C:\WINDOWS\System32\wbem\scrcons32.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Komunikator] C:\Program Files\Tlen.pl\tlen.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Winamp Agent] C:\WINDOWS\System32\winamp.exe R1 VIAPFD;VIAPFD;C:\WINDOWS\System32\Drivers\VIAPFD.SYS R2 Local Service;Local Service;"C:\WINDOWS\wuaurpl.exe" S3 USBSTOR;Sterownik magazynu masowego USB;C:\WINDOWS\System32\DRIVERS\USBSTOR.SYS ************************************************************************** catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-08-22 12:33:59 Windows 5.1.2600 Dodatek Service Pack. 1 NTFS scanning hidden processes ... C:\WINDOWS\wuaurpl.exe [1612] 0x81411DA8 scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** Completion time: 2007-08-22 12:34:30 C:\ComboFix-quarantined-files.txt ... 2007-08-22 12:34 C:\ComboFix2.txt ... 2007-08-21 22:53 --- E O F ---

**Posty:** 18165 · przez **wojtas** 22 Sie 2007, 15:27

Pobierz i uruchom narzędzie
The Avenger
Zaznacz opcję Input script manually i kliknij na Lupkę z prawej strony. W okienku, które się otworzy wklejasz:

Drivers to unload:

Local Service

Files to delete:

C:\WINDOWS\system\smss.exe
C:\WINDOWS\wuaurpl.exe

Klikasz Done, a następnie zielone światełko i zgadzasz się na restart klikając OK.
Po restarcie w HijackThis usuwasz wpis/y

O4 - HKLM\..\Run: [Windows File Upgrader] winupgrd.exe

potem wklej do notatnika:

Windows Registry Editor Version 5.00

[HKEY_USERS\.default\software\microsoft\windows\currentversion\runservices]
"WMI Standard Event Consumer - Scripting"=-

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"wuaurpl"=-

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
"WMI Standard Event Consumer - Scripting"=-

w notatniku u góry>>>plik zapisz jako>>>Zmien rozszerzenie z TXT na Wszystkie pliki *.* >>> Zapisz pod nazwą FIX.REG

Klikasz dwa razy na powstały plik fix i dodajesz go do rejestru....

potem nowe logi

**Posty:** 127 · przez **bluejack** 22 Sie 2007, 18:17

Teraz zaczely mi wyskakiwac komunikaty z avasta o trojanach w folderze windows/system32 jak grzyby po deszczu i mam problem z wlaczeniem internetu, a jesli wlacze to jest bardzo mala szybkosc... ;\
LOGI
HJ

Kod: Zaznacz wszystko: Logfile of HijackThis v1.99.1 Scan saved at 18:08:18, on 2007-08-22 Platform: Windows XP Dodatek SP. 1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\PROGRA~1\A4Tech\Mouse\Amoumain.exe C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe C:\WINDOWS\System32\devldr32.exe C:\WINDOWS\System32\RUNDLL32.EXE C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe C:\WINDOWS\System32\spoolsvc.exe C:\WINDOWS\System32\ctfmon.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\System32\nvsvc32.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Netia\Net\netianet.exe C:\Program Files\Mozilla Firefox\firefox.exe D:\Moje pliki\Jacek\Pulpit\hijackthis_199\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\NEOSTR~1\SEARCH~1.DLL (file missing) O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O4 - HKLM\..\Run: [SiSUSBRG] C:\WINDOWS\SiSUSBrg.exe O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\Updreg.exe O4 - HKLM\..\Run: [WheelMouse] C:\PROGRA~1\A4Tech\Mouse\Amoumain.exe O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" O4 - HKLM\..\Run: [Spooler SubSystem App] C:\WINDOWS\System32\spoolsvc.exe O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe O4 - HKCU\..\Run: [Komunikator] C:\Program Files\Tlen.pl\tlen.exe O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{32571811-FC9A-443F-AA53-51D0D8D59C8C}: NameServer = 213.241.79.37 83.238.255.76 O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing) O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing) O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe O23 - Service: Windows NT Session Manager (WINNTSMSS) - Unknown owner - C:\WINDOWS\system\smss.exe (file missing)

combofix

Kod: Zaznacz wszystko: ComboFix 07-08-17.2 - "Pan Stawicki" 2007-08-22 18:09:39.4 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.1.1250.1.1045.18.32 [GMT 2:00] ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) C:\WINDOWS\system32\dgjlm.bak1 C:\WINDOWS\system32\dgjlm.ini C:\WINDOWS\system32\mljgd.dll ((((((((((((((((((((((((( Files Created from 2007-07-22 to 2007-08-22 ))))))))))))))))))))))))))))))) 2007-08-22 18:02 43,542 --a------ C:\WINDOWS\system32\yayvust.dll 2007-08-22 17:52 43,542 --a------ C:\WINDOWS\system32\hggdbay.dll 2007-08-22 17:05 43,542 --a------ C:\WINDOWS\system32\vtuspmm.dll 2007-08-22 16:29 43,542 --a------ C:\WINDOWS\system32\pmnnlij.dll 2007-08-22 13:41 43,542 --a------ C:\WINDOWS\system32\fccaxvv.dll 2007-08-22 13:27 43,542 --a------ C:\WINDOWS\system32\iifddcy.dll 2007-08-22 13:24 43,542 --a------ C:\WINDOWS\system32\urqnonn.dll 2007-08-22 13:24 15,785 --a------ C:\WINDOWS\system32\ierwyywa.exe 2007-08-22 13:24 11,148 --a------ C:\WINDOWS\system32\raomknn.exe 2007-08-22 12:45 43,542 --a------ C:\WINDOWS\system32\rqrpmjk.dll 2007-08-22 12:40 52,749 --a------ C:\WINDOWS\system32\dhtsfxrd.exe 2007-08-22 12:40 43,542 --a------ C:\WINDOWS\system32\tuvvtrp.dll 2007-08-22 12:40 15,785 --a------ C:\WINDOWS\system32\ycsftjt.exe 2007-08-22 12:40 11,148 --a------ C:\WINDOWS\system32\heup.exe 2007-08-21 22:50 51,200 --a------ C:\WINDOWS\nircmd.exe 2007-08-21 22:35 53,248 --a------ C:\WINDOWS\system32\Process.exe 2007-08-21 22:35 51,200 --a------ C:\WINDOWS\system32\dumphive.exe 2007-08-21 22:35 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe 2007-08-21 22:35 2,450 --a------ C:\WINDOWS\system32\tmp.reg 2007-08-21 18:48 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\nView_Profiles 2007-08-20 15:49 <DIR> d-------- C:\Program Files\MarBit 2007-08-16 19:17 98,816 --a------ C:\WINDOWS\system32\dmstyle.dll 2007-08-16 19:17 937,984 --a------ C:\WINDOWS\system32\dxdiag.exe 2007-08-16 19:17 83,968 --a------ C:\WINDOWS\system32\drivers\nabtsfec.sys 2007-08-16 19:17 80,896 --a------ C:\WINDOWS\system32\dpvsetup.exe 2007-08-16 19:17 8,192 --a------ C:\WINDOWS\system32\d3d8thk.dll 2007-08-16 19:17 797,184 --a------ C:\WINDOWS\system32\d3dim700.dll 2007-08-16 19:17 77,824 --a------ C:\WINDOWS\system32\dpmodemx.dll 2007-08-16 19:17 76,800 --a------ C:\WINDOWS\system32\dpwsockx.dll 2007-08-16 19:17 76,800 --a------ C:\WINDOWS\system32\dmscript.dll 2007-08-16 19:17 733,184 --a------ C:\WINDOWS\system32\qedwipes.dll 2007-08-16 19:17 723,968 --a------ C:\WINDOWS\system32\dpnet.dll 2007-08-16 19:17 7,424 --a------ C:\WINDOWS\system32\drivers\mskssrv.sys 2007-08-16 19:17 68,096 --a------ C:\WINDOWS\system32\dpnhupnp.dll 2007-08-16 19:17 64,512 --a------ C:\WINDOWS\system32\amstream.dll 2007-08-16 19:17 602,624 --a------ C:\WINDOWS\system32\dx7vb.dll 2007-08-16 19:17 58,368 --a------ C:\WINDOWS\system32\dmcompos.dll 2007-08-16 19:17 52,096 --a------ C:\WINDOWS\system32\drivers\msdv.sys 2007-08-16 19:17 5,504 --a------ C:\WINDOWS\system32\drivers\mstee.sys 2007-08-16 19:17 5,248 --a------ C:\WINDOWS\system32\drivers\mspclock.sys 2007-08-16 19:17 491,520 --a------ C:\WINDOWS\system32\dsdmoprp.dll 2007-08-16 19:17 47,104 --a------ C:\WINDOWS\system32\wstdecod.dll 2007-08-16 19:17 45,696 --a------ C:\WINDOWS\system32\drivers\stream.sys 2007-08-16 19:17 449,024 --a------ C:\WINDOWS\system32\qdvd.dll 2007-08-16 19:17 44,544 --a------ C:\WINDOWS\system32\dxdllreg.exe 2007-08-16 19:17 4,608 --a------ C:\WINDOWS\system32\drivers\mspqm.sys 2007-08-16 19:17 4,096 --a------ C:\WINDOWS\system32\ksuser.dll 2007-08-16 19:17 4,096 --a------ C:\WINDOWS\system32\drivers\swenum.sys 2007-08-16 19:17 381,952 --a------ C:\WINDOWS\system32\dpvoice.dll 2007-08-16 19:17 355,328 --a------ C:\WINDOWS\system32\dsound.dll 2007-08-16 19:17 354,816 --a------ C:\WINDOWS\system32\psisdecd.dll 2007-08-16 19:17 34,304 --a------ C:\WINDOWS\system32\mciqtz32.dll 2007-08-16 19:17 33,280 --a------ C:\WINDOWS\system32\dmloader.dll 2007-08-16 19:17 324,096 --a------ C:\WINDOWS\system32\mswebdvd.dll 2007-08-16 19:17 32,768 --a------ C:\WINDOWS\system32\dpnhpast.dll 2007-08-16 19:17 311,808 --a------ C:\WINDOWS\system32\qdv.dll 2007-08-16 19:17 3,072 --a------ C:\WINDOWS\system32\dpnlobby.dll 2007-08-16 19:17 3,072 --a------ C:\WINDOWS\system32\dpnaddr.dll 2007-08-16 19:17 284,160 --a------ C:\WINDOWS\system32\ddraw.dll 2007-08-16 19:17 28,160 --a------ C:\WINDOWS\system32\dplaysvr.exe 2007-08-16 19:17 27,136 --a------ C:\WINDOWS\system32\dmband.dll 2007-08-16 19:17 257,024 --a------ C:\WINDOWS\system32\qcap.dll 2007-08-16 19:17 24,064 --a------ C:\WINDOWS\system32\ddrawex.dll 2007-08-16 19:17 217,600 --a------ C:\WINDOWS\system32\dplayx.dll 2007-08-16 19:17 19,968 --a------ C:\WINDOWS\system32\dpvacm.dll 2007-08-16 19:17 186,880 --a------ C:\WINDOWS\system32\dsdmo.dll 2007-08-16 19:17 18,944 --a------ C:\WINDOWS\system32\encapi.dll 2007-08-16 19:17 18,688 --a------ C:\WINDOWS\system32\drivers\wstcodec.sys 2007-08-16 19:17 18,432 --a------ C:\WINDOWS\system32\dswave.dll 2007-08-16 19:17 171,520 --a------ C:\WINDOWS\system32\dmime.dll 2007-08-16 19:17 16,896 --a------ C:\WINDOWS\system32\msyuv.dll 2007-08-16 19:17 16,896 --a------ C:\WINDOWS\system32\dpnsvr.exe 2007-08-16 19:17 16,384 --a------ C:\WINDOWS\system32\drivers\ccdecode.sys 2007-08-16 19:17 15,104 --a------ C:\WINDOWS\system32\drivers\mpe.sys 2007-08-16 19:17 14,976 --a------ C:\WINDOWS\system32\drivers\streamip.sys 2007-08-16 19:17 132,608 --a------ C:\WINDOWS\system32\devenum.dll 2007-08-16 19:17 130,304 --a------ C:\WINDOWS\system32\drivers\ks.sys 2007-08-16 19:17 13,312 --a------ C:\WINDOWS\system32\msdmo.dll 2007-08-16 19:17 116,736 --a------ C:\WINDOWS\system32\dmusic.dll 2007-08-16 19:17 112,128 --a------ C:\WINDOWS\system32\dpvvox.dll 2007-08-16 19:17 11,392 --a------ C:\WINDOWS\system32\drivers\bdasup.sys 2007-08-16 19:17 100,864 --a------ C:\WINDOWS\system32\dmsynth.dll 2007-08-16 19:17 10,880 --a------ C:\WINDOWS\system32\drivers\slip.sys 2007-08-16 19:17 10,112 --a------ C:\WINDOWS\system32\drivers\ndisip.sys 2007-08-16 19:17 1,962,496 --a------ C:\WINDOWS\system32\quartz.dll 2007-08-16 19:17 1,798,144 --a------ C:\WINDOWS\system32\qedit.dll 2007-08-16 19:17 1,675,264 --a------ C:\WINDOWS\system32\dxdiagn.dll 2007-08-16 19:17 1,634,304 --a------ C:\WINDOWS\system32\d3d9.dll 2007-08-16 19:17 1,294,336 --a------ C:\WINDOWS\system32\dsound3d.dll 2007-08-16 19:17 1,230,336 --a------ C:\WINDOWS\system32\msvidctl.dll 2007-08-16 19:17 1,189,888 --a------ C:\WINDOWS\system32\dx8vb.dll 2007-08-16 19:17 1,177,600 --a------ C:\WINDOWS\system32\d3d8.dll 2007-08-14 17:49 <DIR> d-------- C:\DOCUME~1\PANSTA~1\DANEAP~1\XnView 2007-08-14 13:54 98,304 --a------ C:\WINDOWS\system32\wmpshell.dll 2007-08-14 13:54 7,680 --a------ C:\WINDOWS\system32\asferror.dll 2007-08-14 13:54 52,224 --a------ C:\WINDOWS\system32\mspmsnsv.dll 2007-08-14 13:54 384,512 --a------ C:\WINDOWS\system32\mp4sdmod.dll 2007-08-14 13:54 358,912 --a------ C:\WINDOWS\system32\msscp.dll 2007-08-14 13:54 316,040 --a------ C:\WINDOWS\system32\mp43dmod.dll 2007-08-14 13:54 27,136 --a------ C:\WINDOWS\system32\wmdmlog.dll (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) 2007-08-16 21:58 --------- d--h----- C:\Program Files\InstallShield Installation Information 2007-07-27 19:31 --------- d-------- C:\Program Files\Common Files\InstallShield 2007-07-27 17:11 --------- d-------- C:\Program Files\Neostrada TP 2007-07-20 13:01 --------- d-------- C:\Program Files\Netia 2007-07-20 12:52 --------- d--h----- C:\Program Files\WindowsUpdate 2007-07-19 20:05 --------- d-------- C:\Program Files\Creative 2007-07-19 19:16 2410 --a------ C:\WINDOWS\pchealth\HelpCtr\PackageStore\SkuStore.bin 2007-07-19 18:59 --------- d-------- C:\Program Files\Common Files\SpeechEngines 2007-07-19 18:59 --------- d-------- C:\Program Files\Common Files\ODBC 2007-07-19 18:08 --------- d-------- C:\Program Files\microsoft frontpage 2007-07-19 18:07 8738 --a------ C:\WINDOWS\pchealth\HelpCtr\Config\Cntstore.bin 2007-07-19 18:07 0 -rahs---- C:\MSDOS.SYS 2007-07-19 18:07 0 -rahs---- C:\IO.SYS 2007-07-19 18:07 0 --a------ C:\CONFIG.SYS 2007-07-19 18:07 0 --a------ C:\AUTOEXEC.BAT 2007-07-19 18:05 --------- d-------- C:\Program Files\Movie Maker 2007-07-19 18:05 --------- d-------- C:\Program Files\Common Files\MSSoap 2007-07-19 18:04 --------- d-------- C:\Program Files\Windows NT 2007-07-19 18:04 --------- d-------- C:\Program Files\MSN Gaming Zone 2007-07-19 18:04 --------- d-------- C:\Program Files\Messenger --------- C:\Program Files\Usługi online ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{C84D8A0A-E708-42B6-90CA-9C30956A87C6}] 2007-08-22 12:40 43542 --a------ C:\WINDOWS\System32\tuvvtrp.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SiSUSBRG"="C:\WINDOWS\SiSUSBrg.exe" [2002-04-26 11:17] "UpdReg"="C:\WINDOWS\Updreg.exe" [2000-05-11 01:00] "WheelMouse"="C:\PROGRA~1\A4Tech\Mouse\Amoumain.exe" [2004-08-25 17:31] "SpeedTouch USB Diagnostics"="C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" [2004-01-26 11:38] "NvCplDaemon"="C:\WINDOWS\System32\NvCpl.dll" [2005-04-01 16:16] "nwiz"="nwiz.exe" [2005-04-01 16:16 C:\WINDOWS\system32\nwiz.exe] "NvMediaCenter"="C:\WINDOWS\System32\NvMcTray.dll" [2005-04-01 16:16] "avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-07-28 00:03] "NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 11:50] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" [2007-07-12 04:00] "Spooler SubSystem App"="C:\WINDOWS\System32\spoolsvc.exe" [2002-09-29 00:00] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\System32\ctfmon.exe" [2002-09-29 00:00] "Komunikator"="C:\Program Files\Tlen.pl\tlen.exe" [] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks] "{C84D8A0A-E708-42B6-90CA-9C30956A87C6}"= C:\WINDOWS\System32\tuvvtrp.dll [2007-08-22 12:40 43542] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\tuvvtrp] tuvvtrp.dll 2007-08-22 12:40 43542 C:\WINDOWS\system32\tuvvtrp.dll [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Komunikator] C:\Program Files\Tlen.pl\tlen.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Winamp Agent] C:\WINDOWS\System32\winamp.exe R1 VIAPFD;VIAPFD;C:\WINDOWS\System32\Drivers\VIAPFD.SYS S2 WINNTSMSS;Windows NT Session Manager;"C:\WINDOWS\system\smss.exe" S3 USBSTOR;Sterownik magazynu masowego USB;C:\WINDOWS\System32\DRIVERS\USBSTOR.SYS ************************************************************************** catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-08-22 18:11:47 Windows 5.1.2600 Dodatek Service Pack. 1 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** Completion time: 2007-08-22 18:12:49 - machine was rebooted C:\ComboFix-quarantined-files.txt ... 2007-08-22 18:12 C:\ComboFix2.txt ... 2007-08-22 12:34 C:\ComboFix3.txt ... 2007-08-21 22:53 --- E O F ---

**Posty:** 18165 · przez **wojtas** 22 Sie 2007, 21:33

i uruchom narzędzie
The Avenger
Zaznacz opcję Input script manually i kliknij na Lupkę z prawej strony. W okienku, które się otworzy wklejasz:

Drivers to unload:

WINNTSMSS

Files to delete:

C:\WINDOWS\System32\spoolsvc.exe
C:\WINDOWS\system32\yayvust.dll
C:\WINDOWS\system32\hggdbay.dll
C:\WINDOWS\system32\vtuspmm.dll
C:\WINDOWS\system32\pmnnlij.dll
C:\WINDOWS\system32\fccaxvv.dll
C:\WINDOWS\system32\iifddcy.dll
C:\WINDOWS\system32\urqnonn.dll
C:\WINDOWS\system32\ierwyywa.exe
C:\WINDOWS\system32\raomknn.exe
C:\WINDOWS\system32\rqrpmjk.dll
C:\WINDOWS\system32\dhtsfxrd.exe
C:\WINDOWS\system32\tuvvtrp.dll
C:\WINDOWS\system32\ycsftjt.exe
C:\WINDOWS\system32\heup.exe
C:\WINDOWS\System32\winamp.exe

Klikasz Done, a następnie zielone światełko i zgadzasz się na restart klikając OK.

potem wklej do notatnika;

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{C84D8A0A-E708-42B6-90CA-9C30956A87C6}"=-

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Spooler SubSystem App"=-

[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Winamp Agent]

[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\tuvvtrp]

w notatniku u góry>>>plik zapisz jako>>>Zmien rozszerzenie z TXT na Wszystkie pliki *.* >>> Zapisz pod nazwą FIX.REG

Klikasz dwa razy na powstały plik fix i dodajesz go do rejestru....

Kasujesz ręcznie z dysku plik: C:\Avenger\backup.zip i wklejasz na forum raport: C:\avenger.txt + log z hijacka + log z combofixa

**Posty:** 127 · przez **bluejack** 22 Sie 2007, 22:56

C:\avenger.txt

Kod: Zaznacz wszystko: Logfile of The Avenger version 1, by Swandog46 Running from registry key: \Registry\Machine\System\CurrentControlSet\Services\runwuuqx ******************* Script file located at: \??\C:\WINDOWS\System32\kdevsqsj.txt Script file opened successfully. Script file read successfully Backups directory opened successfully at C:\Avenger ******************* Beginning to process script file: Driver WINNTSMSS unloaded successfully. File C:\WINDOWS\System32\spoolsvc.exe deleted successfully. File C:\WINDOWS\system32\yayvust.dll deleted successfully. File C:\WINDOWS\system32\hggdbay.dll deleted successfully. File C:\WINDOWS\system32\vtuspmm.dll deleted successfully. File C:\WINDOWS\system32\pmnnlij.dll deleted successfully. File C:\WINDOWS\system32\fccaxvv.dll deleted successfully. File C:\WINDOWS\system32\iifddcy.dll deleted successfully. File C:\WINDOWS\system32\urqnonn.dll deleted successfully. File C:\WINDOWS\system32\ierwyywa.exe deleted successfully. File C:\WINDOWS\system32\raomknn.exe deleted successfully. File C:\WINDOWS\system32\rqrpmjk.dll deleted successfully. File C:\WINDOWS\system32\dhtsfxrd.exe deleted successfully. File C:\WINDOWS\system32\tuvvtrp.dll deleted successfully. File C:\WINDOWS\system32\ycsftjt.exe deleted successfully. File C:\WINDOWS\system32\heup.exe deleted successfully. File C:\WINDOWS\System32\winamp.exe not found! Deletion of file C:\WINDOWS\System32\winamp.exe failed! Could not process line: C:\WINDOWS\System32\winamp.exe Status: 0xc0000034 Completed script processing. ******************* Finished! Terminate.

HJ

Kod: Zaznacz wszystko: Logfile of HijackThis v1.99.1 Scan saved at 22:48:31, on 2007-08-22 Platform: Windows XP Dodatek SP. 1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\Explorer.EXE C:\PROGRA~1\A4Tech\Mouse\Amoumain.exe C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe C:\WINDOWS\System32\RUNDLL32.EXE C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\WINDOWS\System32\devldr32.exe C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe C:\WINDOWS\System32\Isass.exe C:\WINDOWS\System32\ctfmon.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\System32\nvsvc32.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Mozilla Firefox\firefox.exe D:\Moje pliki\Jacek\Pulpit\hijackthis_199\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\NEOSTR~1\SEARCH~1.DLL (file missing) O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O4 - HKLM\..\Run: [SiSUSBRG] C:\WINDOWS\SiSUSBrg.exe O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\Updreg.exe O4 - HKLM\..\Run: [WheelMouse] C:\PROGRA~1\A4Tech\Mouse\Amoumain.exe O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" O4 - HKLM\..\Run: [Local Security Authority Service] C:\WINDOWS\System32\Isass.exe O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe O4 - HKCU\..\Run: [Komunikator] C:\Program Files\Tlen.pl\tlen.exe O4 - HKCU\..\Run: [NETIANET] C:\Program Files\Netia\Net\netianet.exe O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{32571811-FC9A-443F-AA53-51D0D8D59C8C}: NameServer = 213.241.79.37 83.238.255.76 O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing) O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing) O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe

COMBOFIX

Kod: Zaznacz wszystko: ComboFix 07-08-17.2 - "Pan Stawicki" 2007-08-22 22:52:26.6 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.1.1250.1.1045.18.96 [GMT 2:00] ((((((((((((((((((((((((( Files Created from 2007-07-22 to 2007-08-22 ))))))))))))))))))))))))))))))) 2007-08-22 21:40 43,542 --a------ C:\WINDOWS\system32\qomnnno.dll 2007-08-22 21:05 43,542 --a------ C:\WINDOWS\system32\urqqrom.dll 2007-08-22 20:27 43,542 --a------ C:\WINDOWS\system32\ddccaay.dll 2007-08-22 20:04 43,542 --a------ C:\WINDOWS\system32\tuvutss.dll 2007-08-22 19:53 43,542 --a------ C:\WINDOWS\system32\cbxwwvs.dll 2007-08-22 19:01 43,542 --a------ C:\WINDOWS\system32\awttsrs.dll 2007-08-21 22:50 51,200 --a------ C:\WINDOWS\nircmd.exe 2007-08-21 22:35 53,248 --a------ C:\WINDOWS\system32\Process.exe 2007-08-21 22:35 51,200 --a------ C:\WINDOWS\system32\dumphive.exe 2007-08-21 22:35 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe 2007-08-21 22:35 2,450 --a------ C:\WINDOWS\system32\tmp.reg 2007-08-21 18:48 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\nView_Profiles 2007-08-20 15:49 <DIR> d-------- C:\Program Files\MarBit 2007-08-16 19:17 98,816 --a------ C:\WINDOWS\system32\dmstyle.dll 2007-08-16 19:17 937,984 --a------ C:\WINDOWS\system32\dxdiag.exe 2007-08-16 19:17 83,968 --a------ C:\WINDOWS\system32\drivers\nabtsfec.sys 2007-08-16 19:17 80,896 --a------ C:\WINDOWS\system32\dpvsetup.exe 2007-08-16 19:17 8,192 --a------ C:\WINDOWS\system32\d3d8thk.dll 2007-08-16 19:17 797,184 --a------ C:\WINDOWS\system32\d3dim700.dll 2007-08-16 19:17 77,824 --a------ C:\WINDOWS\system32\dpmodemx.dll 2007-08-16 19:17 76,800 --a------ C:\WINDOWS\system32\dpwsockx.dll 2007-08-16 19:17 76,800 --a------ C:\WINDOWS\system32\dmscript.dll 2007-08-16 19:17 733,184 --a------ C:\WINDOWS\system32\qedwipes.dll 2007-08-16 19:17 723,968 --a------ C:\WINDOWS\system32\dpnet.dll 2007-08-16 19:17 7,424 --a------ C:\WINDOWS\system32\drivers\mskssrv.sys 2007-08-16 19:17 68,096 --a------ C:\WINDOWS\system32\dpnhupnp.dll 2007-08-16 19:17 64,512 --a------ C:\WINDOWS\system32\amstream.dll 2007-08-16 19:17 602,624 --a------ C:\WINDOWS\system32\dx7vb.dll 2007-08-16 19:17 58,368 --a------ C:\WINDOWS\system32\dmcompos.dll 2007-08-16 19:17 52,096 --a------ C:\WINDOWS\system32\drivers\msdv.sys 2007-08-16 19:17 5,504 --a------ C:\WINDOWS\system32\drivers\mstee.sys 2007-08-16 19:17 5,248 --a------ C:\WINDOWS\system32\drivers\mspclock.sys 2007-08-16 19:17 491,520 --a------ C:\WINDOWS\system32\dsdmoprp.dll 2007-08-16 19:17 47,104 --a------ C:\WINDOWS\system32\wstdecod.dll 2007-08-16 19:17 45,696 --a------ C:\WINDOWS\system32\drivers\stream.sys 2007-08-16 19:17 449,024 --a------ C:\WINDOWS\system32\qdvd.dll 2007-08-16 19:17 44,544 --a------ C:\WINDOWS\system32\dxdllreg.exe 2007-08-16 19:17 4,608 --a------ C:\WINDOWS\system32\drivers\mspqm.sys 2007-08-16 19:17 4,096 --a------ C:\WINDOWS\system32\ksuser.dll 2007-08-16 19:17 4,096 --a------ C:\WINDOWS\system32\drivers\swenum.sys 2007-08-16 19:17 381,952 --a------ C:\WINDOWS\system32\dpvoice.dll 2007-08-16 19:17 355,328 --a------ C:\WINDOWS\system32\dsound.dll 2007-08-16 19:17 354,816 --a------ C:\WINDOWS\system32\psisdecd.dll 2007-08-16 19:17 34,304 --a------ C:\WINDOWS\system32\mciqtz32.dll 2007-08-16 19:17 33,280 --a------ C:\WINDOWS\system32\dmloader.dll 2007-08-16 19:17 324,096 --a------ C:\WINDOWS\system32\mswebdvd.dll 2007-08-16 19:17 32,768 --a------ C:\WINDOWS\system32\dpnhpast.dll 2007-08-16 19:17 311,808 --a------ C:\WINDOWS\system32\qdv.dll 2007-08-16 19:17 3,072 --a------ C:\WINDOWS\system32\dpnlobby.dll 2007-08-16 19:17 3,072 --a------ C:\WINDOWS\system32\dpnaddr.dll 2007-08-16 19:17 284,160 --a------ C:\WINDOWS\system32\ddraw.dll 2007-08-16 19:17 28,160 --a------ C:\WINDOWS\system32\dplaysvr.exe 2007-08-16 19:17 27,136 --a------ C:\WINDOWS\system32\dmband.dll 2007-08-16 19:17 257,024 --a------ C:\WINDOWS\system32\qcap.dll 2007-08-16 19:17 24,064 --a------ C:\WINDOWS\system32\ddrawex.dll 2007-08-16 19:17 217,600 --a------ C:\WINDOWS\system32\dplayx.dll 2007-08-16 19:17 19,968 --a------ C:\WINDOWS\system32\dpvacm.dll 2007-08-16 19:17 186,880 --a------ C:\WINDOWS\system32\dsdmo.dll 2007-08-16 19:17 18,944 --a------ C:\WINDOWS\system32\encapi.dll 2007-08-16 19:17 18,688 --a------ C:\WINDOWS\system32\drivers\wstcodec.sys 2007-08-16 19:17 18,432 --a------ C:\WINDOWS\system32\dswave.dll 2007-08-16 19:17 171,520 --a------ C:\WINDOWS\system32\dmime.dll 2007-08-16 19:17 16,896 --a------ C:\WINDOWS\system32\msyuv.dll 2007-08-16 19:17 16,896 --a------ C:\WINDOWS\system32\dpnsvr.exe 2007-08-16 19:17 16,384 --a------ C:\WINDOWS\system32\drivers\ccdecode.sys 2007-08-16 19:17 15,104 --a------ C:\WINDOWS\system32\drivers\mpe.sys 2007-08-16 19:17 14,976 --a------ C:\WINDOWS\system32\drivers\streamip.sys 2007-08-16 19:17 132,608 --a------ C:\WINDOWS\system32\devenum.dll 2007-08-16 19:17 130,304 --a------ C:\WINDOWS\system32\drivers\ks.sys 2007-08-16 19:17 13,312 --a------ C:\WINDOWS\system32\msdmo.dll 2007-08-16 19:17 116,736 --a------ C:\WINDOWS\system32\dmusic.dll 2007-08-16 19:17 112,128 --a------ C:\WINDOWS\system32\dpvvox.dll 2007-08-16 19:17 11,392 --a------ C:\WINDOWS\system32\drivers\bdasup.sys 2007-08-16 19:17 100,864 --a------ C:\WINDOWS\system32\dmsynth.dll 2007-08-16 19:17 10,880 --a------ C:\WINDOWS\system32\drivers\slip.sys 2007-08-16 19:17 10,112 --a------ C:\WINDOWS\system32\drivers\ndisip.sys 2007-08-16 19:17 1,962,496 --a------ C:\WINDOWS\system32\quartz.dll 2007-08-16 19:17 1,798,144 --a------ C:\WINDOWS\system32\qedit.dll 2007-08-16 19:17 1,675,264 --a------ C:\WINDOWS\system32\dxdiagn.dll 2007-08-16 19:17 1,634,304 --a------ C:\WINDOWS\system32\d3d9.dll 2007-08-16 19:17 1,294,336 --a------ C:\WINDOWS\system32\dsound3d.dll 2007-08-16 19:17 1,230,336 --a------ C:\WINDOWS\system32\msvidctl.dll 2007-08-16 19:17 1,189,888 --a------ C:\WINDOWS\system32\dx8vb.dll 2007-08-16 19:17 1,177,600 --a------ C:\WINDOWS\system32\d3d8.dll 2007-08-14 17:49 <DIR> d-------- C:\DOCUME~1\PANSTA~1\DANEAP~1\XnView 2007-08-14 13:54 98,304 --a------ C:\WINDOWS\system32\wmpshell.dll 2007-08-14 13:54 7,680 --a------ C:\WINDOWS\system32\asferror.dll 2007-08-14 13:54 52,224 --a------ C:\WINDOWS\system32\mspmsnsv.dll 2007-08-14 13:54 384,512 --a------ C:\WINDOWS\system32\mp4sdmod.dll 2007-08-14 13:54 358,912 --a------ C:\WINDOWS\system32\msscp.dll 2007-08-14 13:54 316,040 --a------ C:\WINDOWS\system32\mp43dmod.dll 2007-08-14 13:54 27,136 --a------ C:\WINDOWS\system32\wmdmlog.dll 2007-08-14 13:54 245,760 --a------ C:\WINDOWS\system32\mswmdm.dll 2007-08-14 13:54 241,664 --a------ C:\WINDOWS\system32\mpg4dmod.dll 2007-08-14 13:54 23,552 --a------ C:\WINDOWS\system32\wmdmps.dll 2007-08-14 13:54 225,280 --a------ C:\WINDOWS\system32\wmpdxm.dll 2007-08-14 13:54 208,896 --a------ C:\WINDOWS\system32\wmpns.dll 2007-08-14 13:54 201,728 --a------ C:\WINDOWS\system32\mspmsp.dll 2007-08-14 13:54 20,480 --a------ C:\WINDOWS\system32\wmpui.dll 2007-08-14 13:54 20,480 --a------ C:\WINDOWS\system32\wmpcore.dll (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) 2007-08-16 21:58 --------- d--h----- C:\Program Files\InstallShield Installation Information 2007-07-27 19:31 --------- d-------- C:\Program Files\Common Files\InstallShield 2007-07-27 17:11 --------- d-------- C:\Program Files\Neostrada TP 2007-07-20 13:01 --------- d-------- C:\Program Files\Netia 2007-07-20 12:52 --------- d--h----- C:\Program Files\WindowsUpdate 2007-07-19 20:05 --------- d-------- C:\Program Files\Creative 2007-07-19 19:16 2410 --a------ C:\WINDOWS\pchealth\HelpCtr\PackageStore\SkuStore.bin 2007-07-19 18:59 --------- d-------- C:\Program Files\Common Files\SpeechEngines 2007-07-19 18:59 --------- d-------- C:\Program Files\Common Files\ODBC 2007-07-19 18:08 --------- d-------- C:\Program Files\microsoft frontpage 2007-07-19 18:07 8738 --a------ C:\WINDOWS\pchealth\HelpCtr\Config\Cntstore.bin 2007-07-19 18:07 0 -rahs---- C:\MSDOS.SYS 2007-07-19 18:07 0 -rahs---- C:\IO.SYS 2007-07-19 18:07 0 --a------ C:\CONFIG.SYS 2007-07-19 18:07 0 --a------ C:\AUTOEXEC.BAT 2007-07-19 18:05 --------- d-------- C:\Program Files\Movie Maker 2007-07-19 18:05 --------- d-------- C:\Program Files\Common Files\MSSoap 2007-07-19 18:04 --------- d-------- C:\Program Files\Windows NT 2007-07-19 18:04 --------- d-------- C:\Program Files\MSN Gaming Zone 2007-07-19 18:04 --------- d-------- C:\Program Files\Messenger --------- C:\Program Files\Usługi online ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{C84D8A0A-E708-42B6-90CA-9C30956A87C6}] C:\WINDOWS\System32\tuvvtrp.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SiSUSBRG"="C:\WINDOWS\SiSUSBrg.exe" [2002-04-26 11:17] "UpdReg"="C:\WINDOWS\Updreg.exe" [2000-05-11 01:00] "WheelMouse"="C:\PROGRA~1\A4Tech\Mouse\Amoumain.exe" [2004-08-25 17:31] "SpeedTouch USB Diagnostics"="C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" [2004-01-26 11:38] "NvCplDaemon"="C:\WINDOWS\System32\NvCpl.dll" [2005-04-01 16:16] "nwiz"="nwiz.exe" [2005-04-01 16:16 C:\WINDOWS\system32\nwiz.exe] "NvMediaCenter"="C:\WINDOWS\System32\NvMcTray.dll" [2005-04-01 16:16] "avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-07-28 00:03] "NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 11:50] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" [2007-07-12 04:00] "Local Security Authority Service"="C:\WINDOWS\System32\Isass.exe" [] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\System32\ctfmon.exe" [2002-09-29 00:00] "Komunikator"="C:\Program Files\Tlen.pl\tlen.exe" [] "NETIANET"="C:\Program Files\Netia\Net\netianet.exe" [2007-03-04 11:03] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Komunikator] C:\Program Files\Tlen.pl\tlen.exe R1 VIAPFD;VIAPFD;C:\WINDOWS\System32\Drivers\VIAPFD.SYS S3 USBSTOR;Sterownik magazynu masowego USB;C:\WINDOWS\System32\DRIVERS\USBSTOR.SYS ************************************************************************** catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-08-22 22:52:59 Windows 5.1.2600 Dodatek Service Pack. 1 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** Completion time: 2007-08-22 22:53:38 C:\ComboFix-quarantined-files.txt ... 2007-08-22 22:53 C:\ComboFix2.txt ... 2007-08-22 18:12 C:\ComboFix3.txt ... 2007-08-22 12:34 --- E O F ---

[/code]

**Posty:** 18165 · przez **wojtas** 22 Sie 2007, 23:06

zastosuj sie w calosci do tego tematu:

http://forum.programosy.pl/bad-generic-host-process-for-win32-services-vt79489.html

uruchom narzędzie
The Avenger
Zaznacz opcję Input script manually i kliknij na Lupkę z prawej strony. W okienku, które się otworzy wklejasz:

Files to delete:

C:\WINDOWS\System32\Isass.exe
C:\WINDOWS\system32\qomnnno.dll
C:\WINDOWS\system32\urqqrom.dll
C:\WINDOWS\system32\ddccaay.dll
C:\WINDOWS\system32\tuvutss.dll
C:\WINDOWS\system32\cbxwwvs.dll
C:\WINDOWS\system32\awttsrs.dll

potem skasuj:

Klikasz Done, a następnie zielone światełko i zgadzasz się na restart klikając OK.

O4 - HKLM\..\Run: [Local Security Authority Service] C:\WINDOWS\System32\Isass.exe

wklej do notatnika:

Windows Registry Editor Version 5.00

[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{C84D8A0A-E708-42B6-90CA-9C30956A87C6}]

w notatniku u góry>>>plik zapisz jako>>>Zmien rozszerzenie z TXT na Wszystkie pliki *.* >>> Zapisz pod nazwą FIX.REG

Klikasz dwa razy na powstały plik fix i dodajesz go do rejestru....

Kasujesz ręcznie z dysku plik: C:\Avenger\backup.zip i wklejasz na forum raport: C:\avenger.txt + log z combofixa + z gmera z opcji:

sciagnij gmera:

http://gmer.net/gmer.zip

2. Zakładka Rootkit >>> zaznaczone tylko Usługi i Pokazuj wszystko >>> kliknij Szukaj >>> czekaj cierpliwie aż skończy >>> Kopiuj >>> wklej do posta

**Posty:** 127 · przez **bluejack** 23 Sie 2007, 11:03

GMER

Kod: Zaznacz wszystko: GMER 1.0.12.12086 - http://www.gmer.net Rootkit scan 2007-08-23 10:54:28 Windows 5.1.2600 Dodatek Service Pack. 1 ---- Services - GMER 1.0.12 ---- Service [SYSTEM] Aavmker4 Service [DISABLED] Abiosdsk Service [DISABLED] abp480n5 Service C:\WINDOWS\System32\DRIVERS\ACPI.sys [BOOT] ACPI Service [DISABLED] ACPIEC Service [DISABLED] adpu160m Service C:\WINDOWS\system32\drivers\aec.sys [MANUAL] aec Service C:\WINDOWS\System32\drivers\afd.sys [AUTO] AFD Service [DISABLED] Aha154x Service [DISABLED] aic78u2 Service [DISABLED] aic78xx Service C:\WINDOWS\System32\DRIVERS\alcan5wn.sys [MANUAL] alcan5wn Service C:\WINDOWS\System32\DRIVERS\alcaudsl.sys [MANUAL] alcaudsl Service C:\WINDOWS\System32\svchost.exe [MANUAL] Alerter Service C:\WINDOWS\System32\alg.exe [MANUAL] ALG Service [DISABLED] AliIde Service C:\WINDOWS\System32\DRIVERS\Amfilter.sys [SYSTEM] Amfilter Service [DISABLED] amsint Service C:\WINDOWS\System32\DRIVERS\Amusbprt.sys [MANUAL] Amusbprt Service C:\WINDOWS\system32\svchost.exe [MANUAL] AppMgmt Service [DISABLED] asc Service [DISABLED] asc3350p Service [DISABLED] asc3550 Service [AUTO] aswMon2 Service [MANUAL] aswRdr Service [SYSTEM] aswTdi Service C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe [AUTO] aswUpdSv Service C:\WINDOWS\System32\DRIVERS\asyncmac.sys [MANUAL] AsyncMac Service C:\WINDOWS\System32\DRIVERS\atapi.sys [BOOT] atapi Service [DISABLED] Atdisk Service C:\WINDOWS\System32\DRIVERS\atmarpc.sys [MANUAL] Atmarpc Service C:\WINDOWS\System32\svchost.exe [AUTO] AudioSrv Service C:\WINDOWS\System32\DRIVERS\audstub.sys [MANUAL] audstub Service C:\Program Files\Alwil Software\Avast4\ashServ.exe [AUTO] avast! Antivirus Service C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe [MANUAL] avast! Mail Scanner Service C:\Program Files\Alwil Software\Avast4\ashWebSv.exe [MANUAL] avast! Web Scanner Service BattC Service [SYSTEM] Beep Service C:\WINDOWS\System32\svchost.exe [MANUAL] BITS Service C:\WINDOWS\System32\svchost.exe [AUTO] Browser Service C:\DOCUME~1\PANSTA~1\USTAWI~1\Temp\catchme.sys [MANUAL] catchme Service [DISABLED] cbidf2k Service [DISABLED] cd20xrnt Service [SYSTEM] Cdaudio Service [DISABLED] Cdfs Service C:\WINDOWS\System32\DRIVERS\cdrom.sys [SYSTEM] Cdrom Service [SYSTEM] Changer Service C:\WINDOWS\system32\cisvc.exe [MANUAL] CiSvc Service C:\WINDOWS\system32\clipsrv.exe [MANUAL] ClipSrv Service [DISABLED] CmdIde Service C:\WINDOWS\System32\dllhost.exe [MANUAL] COMSysApp Service ContentFilter Service ContentIndex Service [DISABLED] Cpqarray Service C:\WINDOWS\system32\svchost.exe [AUTO] CryptSvc Service C:\WINDOWS\System32\DRIVERS\ctljystk.sys [MANUAL] ctljystk Service ctlntsvc Service [DISABLED] dac2w2k Service [DISABLED] dac960nt Service C:\WINDOWS\System32\svchost.exe [AUTO] Dhcp Service C:\WINDOWS\System32\DRIVERS\disk.sys [BOOT] Disk Service C:\WINDOWS\System32\dmadmin.exe [MANUAL] dmadmin Service C:\WINDOWS\System32\drivers\dmboot.sys [DISABLED] dmboot Service C:\WINDOWS\System32\drivers\dmio.sys [BOOT] dmio Service C:\WINDOWS\System32\drivers\dmload.sys [BOOT] dmload Service C:\WINDOWS\System32\svchost.exe [AUTO] dmserver Service C:\WINDOWS\system32\drivers\DMusic.sys [MANUAL] DMusic Service C:\WINDOWS\System32\svchost.exe [AUTO] Dnscache Service [DISABLED] dpti2o Service C:\WINDOWS\system32\drivers\drmkaud.sys [MANUAL] drmkaud Service C:\WINDOWS\system32\drivers\emu10k1f.sys [MANUAL] emu10k Service C:\WINDOWS\system32\drivers\ctlface.sys [MANUAL] emu10k1 Service C:\WINDOWS\System32\svchost.exe [AUTO] ERSvc Service C:\WINDOWS\system32\services.exe [AUTO] Eventlog Service C:\WINDOWS\System32\svchost.exe [MANUAL] EventSystem Service [DISABLED] Fastfat Service C:\WINDOWS\System32\svchost.exe [MANUAL] FastUserSwitchingCompatibility Service C:\WINDOWS\System32\DRIVERS\fdc.sys [MANUAL] Fdc Service [SYSTEM] Fips Service C:\WINDOWS\System32\DRIVERS\flpydisk.sys [MANUAL] Flpydisk Service [SYSTEM] Fs_Rec Service C:\WINDOWS\System32\DRIVERS\ftdisk.sys [BOOT] Ftdisk Service C:\WINDOWS\System32\DRIVERS\gameenum.sys [MANUAL] gameenum Service C:\WINDOWS\System32\DRIVERS\gmer.sys [MANUAL] gmer Service C:\WINDOWS\System32\DRIVERS\msgpc.sys [MANUAL] Gpc Service C:\WINDOWS\System32\svchost.exe [AUTO] helpsvc Service C:\WINDOWS\System32\svchost.exe [DISABLED] HidServ Service C:\WINDOWS\System32\DRIVERS\hidusb.sys [MANUAL] HidUsb Service [DISABLED] hpn Service [SYSTEM] i2omgmt Service [DISABLED] i2omp Service C:\WINDOWS\System32\DRIVERS\i8042prt.sys [SYSTEM] i8042prt Service C:\WINDOWS\System32\DRIVERS\imapi.sys [SYSTEM] Imapi Service C:\WINDOWS\System32\imapi.exe [MANUAL] ImapiService Service inetaccs Service [DISABLED] ini910u Service Inport Service [DISABLED] IntelIde Service C:\WINDOWS\System32\DRIVERS\ipfltdrv.sys [MANUAL] IpFilterDriver Service C:\WINDOWS\System32\DRIVERS\ipinip.sys [MANUAL] IpInIp Service C:\WINDOWS\System32\DRIVERS\ipnat.sys [MANUAL] IpNat Service C:\WINDOWS\System32\DRIVERS\ipsec.sys [SYSTEM] IPSec Service C:\WINDOWS\System32\DRIVERS\irenum.sys [MANUAL] IRENUM Service ISAPISearch Service C:\WINDOWS\System32\DRIVERS\isapnp.sys [BOOT] isapnp Service C:\WINDOWS\System32\DRIVERS\kbdclass.sys [SYSTEM] Kbdclass Service C:\WINDOWS\system32\drivers\kmixer.sys [MANUAL] kmixer Service [BOOT] KSecDD Service C:\WINDOWS\System32\svchost.exe [AUTO] lanmanserver Service C:\WINDOWS\System32\svchost.exe [AUTO] lanmanworkstation Service [SYSTEM] lbrtfdc Service ldap Service LicenseService Service C:\WINDOWS\System32\svchost.exe [AUTO] LmHosts Service C:\WINDOWS\System32\svchost.exe [DISABLED] Messenger Service [SYSTEM] mnmdd Service C:\WINDOWS\System32\mnmsrvc.exe [MANUAL] mnmsrvc Service [MANUAL] Modem Service C:\WINDOWS\System32\DRIVERS\mouclass.sys [SYSTEM] Mouclass Service C:\WINDOWS\System32\DRIVERS\mouhid.sys [MANUAL] mouhid Service [BOOT] MountMgr Service [DISABLED] mraid35x Service C:\WINDOWS\System32\DRIVERS\mrxdav.sys [MANUAL] MRxDAV Service C:\WINDOWS\System32\DRIVERS\mrxsmb.sys [SYSTEM] MRxSmb Service C:\WINDOWS\System32\msdtc.exe [MANUAL] MSDTC Service [SYSTEM] Msfs Service C:\WINDOWS\System32\msiexec.exe [MANUAL] MSIServer Service C:\WINDOWS\system32\drivers\MSKSSRV.sys [MANUAL] MSKSSRV Service C:\WINDOWS\system32\drivers\MSPCLOCK.sys [MANUAL] MSPCLOCK Service C:\WINDOWS\system32\drivers\MSPQM.sys [MANUAL] MSPQM Service C:\WINDOWS\system32\drivers\msmpu401.sys [MANUAL] ms_mpu401 Service [BOOT] Mup Service [BOOT] NDIS Service C:\WINDOWS\System32\DRIVERS\ndistapi.sys [MANUAL] NdisTapi Service C:\WINDOWS\System32\DRIVERS\ndisuio.sys [MANUAL] Ndisuio Service C:\WINDOWS\System32\DRIVERS\ndiswan.sys [MANUAL] NdisWan Service [MANUAL] NDProxy Service C:\WINDOWS\System32\DRIVERS\netbios.sys [SYSTEM] NetBIOS Service C:\WINDOWS\System32\DRIVERS\netbt.sys [DISABLED] NetBT Service C:\WINDOWS\system32\netdde.exe [MANUAL] NetDDE Service C:\WINDOWS\system32\netdde.exe [MANUAL] NetDDEdsdm Service C:\WINDOWS\System32\lsass.exe [MANUAL] Netlogon Service C:\WINDOWS\System32\svchost.exe [MANUAL] Netman Service C:\WINDOWS\System32\svchost.exe [MANUAL] Nla Service [SYSTEM] Npfs Service [DISABLED] Ntfs Service C:\WINDOWS\System32\lsass.exe [MANUAL] NtLmSsp Service C:\WINDOWS\system32\svchost.exe [MANUAL] NtmsSvc Service [SYSTEM] Null Service C:\WINDOWS\System32\DRIVERS\nv4_mini.sys [MANUAL] nv Service nv4 Service C:\WINDOWS\System32\nvsvc32.exe [AUTO] NVSvc Service C:\WINDOWS\System32\DRIVERS\nwlnkflt.sys [MANUAL] NwlnkFlt Service C:\WINDOWS\System32\DRIVERS\nwlnkfwd.sys [MANUAL] NwlnkFwd Service C:\WINDOWS\System32\DRIVERS\parport.sys [MANUAL] Parport Service [BOOT] PartMgr Service [AUTO] ParVdm Service C:\WINDOWS\System32\DRIVERS\pci.sys [BOOT] PCI Service [SYSTEM] PCIDump Service C:\WINDOWS\System32\DRIVERS\pciide.sys [BOOT] PCIIde Service [DISABLED] Pcmcia Service [MANUAL] PDCOMP Service [MANUAL] PDFRAME Service [MANUAL] PDRELI Service [MANUAL] PDRFRAME Service [DISABLED] perc2 Service [DISABLED] perc2hib Service PerfDisk Service PerfNet Service PerfOS Service PerfProc Service C:\WINDOWS\System32\PfModNT.sys [AUTO] PfModNT Service C:\WINDOWS\system32\services.exe [AUTO] PlugPlay Service C:\WINDOWS\System32\lsass.exe [MANUAL] PolicyAgent Service C:\WINDOWS\System32\DRIVERS\raspptp.sys [MANUAL] PptpMiniport Service C:\WINDOWS\system32\lsass.exe [AUTO] ProtectedStorage Service C:\WINDOWS\System32\DRIVERS\psched.sys [MANUAL] PSched Service C:\WINDOWS\System32\DRIVERS\ptilink.sys [MANUAL] Ptilink Service C:\WINDOWS\System32\Drivers\PxHelp20.sys [BOOT] PxHelp20 Service [DISABLED] ql1080 Service [DISABLED] Ql10wnt Service [DISABLED] ql12160 Service [DISABLED] ql1240 Service [DISABLED] ql1280 Service C:\WINDOWS\System32\DRIVERS\rasacd.sys [SYSTEM] RasAcd Service C:\WINDOWS\System32\svchost.exe [MANUAL] RasAuto Service C:\WINDOWS\System32\DRIVERS\rasl2tp.sys [MANUAL] Rasl2tp Service C:\WINDOWS\System32\svchost.exe [MANUAL] RasMan Service C:\WINDOWS\System32\DRIVERS\raspppoe.sys [MANUAL] RasPppoe Service C:\WINDOWS\System32\DRIVERS\raspti.sys [MANUAL] Raspti Service C:\WINDOWS\System32\DRIVERS\rdbss.sys [SYSTEM] Rdbss Service C:\WINDOWS\System32\DRIVERS\RDPCDD.sys [SYSTEM] RDPCDD Service RDPDD Service C:\WINDOWS\System32\DRIVERS\rdpdr.sys [MANUAL] rdpdr Service RDPNP Service [MANUAL] RDPWD Service C:\WINDOWS\system32\sessmgr.exe [MANUAL] RDSessMgr Service C:\WINDOWS\System32\DRIVERS\redbook.sys [SYSTEM] redbook Service C:\WINDOWS\System32\svchost.exe [DISABLED] RemoteAccess Service C:\WINDOWS\system32\svchost.exe [DISABLED] RemoteRegistry Service C:\WINDOWS\System32\locator.exe [MANUAL] RpcLocator Service C:\WINDOWS\system32\svchost.exe [AUTO] RpcSs Service C:\WINDOWS\System32\rsvp.exe [MANUAL] RSVP Service C:\WINDOWS\system32\lsass.exe [AUTO] SamSs Service C:\WINDOWS\System32\SCardSvr.exe [MANUAL] SCardDrv Service C:\WINDOWS\System32\SCardSvr.exe [MANUAL] SCardSvr Service C:\WINDOWS\System32\svchost.exe [AUTO] Schedule Service C:\WINDOWS\System32\DRIVERS\secdrv.sys [MANUAL] Secdrv Service C:\WINDOWS\System32\svchost.exe [AUTO] seclogon Service C:\WINDOWS\system32\svchost.exe [AUTO] SENS Service C:\WINDOWS\System32\DRIVERS\serenum.sys [MANUAL] serenum Service C:\WINDOWS\System32\DRIVERS\serial.sys [SYSTEM] Serial Service [SYSTEM] Sfloppy Service C:\WINDOWS\system32\drivers\sfman.sys [MANUAL] sfman Service C:\WINDOWS\System32\svchost.exe [AUTO] SharedAccess Service C:\WINDOWS\System32\svchost.exe [AUTO] ShellHWDetection Service [DISABLED] Simbad Service C:\WINDOWS\System32\DRIVERS\sisagp.sys [BOOT] sisagp Service [DISABLED] Sparrow Service C:\WINDOWS\system32\drivers\splitter.sys [MANUAL] splitter Service C:\WINDOWS\system32\spoolsv.exe [AUTO] Spooler Service C:\WINDOWS\System32\DRIVERS\sr.sys [BOOT] sr Service C:\WINDOWS\System32\svchost.exe [AUTO] srservice Service C:\WINDOWS\System32\DRIVERS\srv.sys [MANUAL] Srv Service C:\WINDOWS\System32\svchost.exe [DISABLED] SSDPSRV Service C:\WINDOWS\System32\svchost.exe [MANUAL] stisvc Service C:\WINDOWS\System32\DRIVERS\swenum.sys [MANUAL] swenum Service C:\WINDOWS\system32\drivers\swmidi.sys [MANUAL] swmidi Service C:\WINDOWS\System32\dllhost.exe [MANUAL] SwPrv Service [DISABLED] symc810 Service [DISABLED] symc8xx Service [DISABLED] sym_hi Service [DISABLED] sym_u3 Service C:\WINDOWS\system32\drivers\sysaudio.sys [MANUAL] sysaudio Service C:\WINDOWS\system32\smlogsvc.exe [MANUAL] SysmonLog Service C:\WINDOWS\System32\svchost.exe [MANUAL] TapiSrv Service C:\WINDOWS\System32\DRIVERS\tcpip.sys [SYSTEM] Tcpip Service [MANUAL] TDPIPE Service [MANUAL] TDTCP Service C:\WINDOWS\System32\DRIVERS\termdd.sys [SYSTEM] TermDD Service C:\WINDOWS\System32\svchost.exe [MANUAL] TermService Service C:\WINDOWS\System32\svchost.exe [AUTO] Themes Service C:\WINDOWS\System32\tlntsvr.exe [DISABLED] TlntSvr Service [DISABLED] TosIde Service C:\WINDOWS\system32\svchost.exe [AUTO] TrkWks Service TSDDD Service [DISABLED] Udfs Service [DISABLED] ultra Service C:\WINDOWS\System32\DRIVERS\update.sys [MANUAL] Update Service C:\WINDOWS\System32\svchost.exe [AUTO] uploadmgr Service C:\WINDOWS\System32\svchost.exe [MANUAL] upnphost Service C:\WINDOWS\System32\ups.exe [MANUAL] UPS Service USB Service C:\WINDOWS\System32\DRIVERS\usbehci.sys [MANUAL] usbehci Service C:\WINDOWS\System32\DRIVERS\usbhub.sys [MANUAL] usbhub Service C:\WINDOWS\System32\DRIVERS\usbohci.sys [MANUAL] usbohci Service C:\WINDOWS\System32\DRIVERS\USBSTOR.SYS [MANUAL] USBSTOR Service C:\WINDOWS\System32\DRIVERS\usbuhci.sys [MANUAL] usbuhci Service C:\WINDOWS\System32\drivers\vga.sys [SYSTEM] VgaSave Service [DISABLED] ViaIde Service C:\WINDOWS\System32\Drivers\VIAPFD.SYS [SYSTEM] VIAPFD Service [BOOT] VolSnap Service C:\WINDOWS\System32\vssvc.exe [MANUAL] VSS Service C:\WINDOWS\System32\svchost.exe [AUTO] W32Time Service W3SVC Service C:\WINDOWS\System32\DRIVERS\wanarp.sys [MANUAL] Wanarp Service [MANUAL] WDICA Service C:\WINDOWS\system32\drivers\wdmaud.sys [MANUAL] wdmaud Service C:\WINDOWS\System32\svchost.exe [AUTO] WebClient Service C:\WINDOWS\system32\svchost.exe [AUTO] winmgmt Service C:\WINDOWS\system\smss.exe [AUTO] WINNTSMSS Service [MANUAL] Winsock Service WinSock2 Service WinTrust Service C:\WINDOWS\System32\svchost.exe [MANUAL] WmdmPmSN Service C:\WINDOWS\System32\svchost.exe [MANUAL] Wmi Service WmiApRpl Service C:\WINDOWS\System32\wbem\wmiapsrv.exe [MANUAL] WmiApSrv Service [DISABLED] wscsvc Service C:\WINDOWS\system32\svchost.exe [AUTO] wuauserv Service C:\WINDOWS\System32\svchost.exe [AUTO] WZCSVC ---- EOF - GMER 1.0.12 ----

AVANGER

Kod: Zaznacz wszystko: Logfile of The Avenger version 1, by Swandog46 Running from registry key: \Registry\Machine\System\CurrentControlSet\Services\akundkwn ******************* Script file located at: \??\C:\WINDOWS\nlvsiadj.txt Script file opened successfully. Script file read successfully Backups directory opened successfully at C:\Avenger ******************* Beginning to process script file: File C:\WINDOWS\System32\Isass.exe not found! Deletion of file C:\WINDOWS\System32\Isass.exe failed! Could not process line: C:\WINDOWS\System32\Isass.exe Status: 0xc0000034 File C:\WINDOWS\system32\qomnnno.dll deleted successfully. File C:\WINDOWS\system32\urqqrom.dll deleted successfully. File C:\WINDOWS\system32\ddccaay.dll deleted successfully. File C:\WINDOWS\system32\tuvutss.dll deleted successfully. File C:\WINDOWS\system32\cbxwwvs.dll deleted successfully. File C:\WINDOWS\system32\awttsrs.dll deleted successfully. Completed script processing. ******************* Finished! Terminate.

COMBOFIX

Kod: Zaznacz wszystko: ComboFix 07-08-17.2 - "Pan Stawicki" 2007-08-23 10:59:26.8 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.1.1250.1.1045.18.98 [GMT 2:00] ((((((((((((((((((((((((( Files Created from 2007-07-23 to 2007-08-23 ))))))))))))))))))))))))))))))) 2007-08-23 10:51 43,542 --a------ C:\WINDOWS\system32\jkkkkhi.dll 2007-08-23 10:20 43,542 --a------ C:\WINDOWS\system32\gebxwtq.dll 2007-08-23 10:10 43,542 --a------ C:\WINDOWS\system32\vtusspp.dll 2007-08-23 09:58 32,256 --a------ C:\bremover.exe 2007-08-23 09:53 69,120 --a------ C:\WINDOWS\system32\olecli32.dll 2007-08-23 09:53 535,552 --a------ C:\WINDOWS\system32\rpcrt4.dll 2007-08-23 09:53 275,456 --a------ C:\WINDOWS\system32\rpcss.dll 2007-08-23 09:53 1,190,400 --a------ C:\WINDOWS\system32\ole32.dll 2007-08-23 09:53 <DIR> d--h----- C:\WINDOWS\$hf_mig$ 2007-08-23 08:12 6,473 ---hs---- C:\WINDOWS\system32\orutv.bak1 2007-08-23 08:11 298,080 --a------ C:\WINDOWS\system32\vturo.dll 2007-08-23 08:06 43,542 --a------ C:\WINDOWS\system32\ljjgfcb.dll 2007-08-23 08:05 32,256 -r-hs---- C:\WINDOWS\system\usnsvc.exe 2007-08-21 22:50 51,200 --a------ C:\WINDOWS\nircmd.exe 2007-08-21 22:35 53,248 --a------ C:\WINDOWS\system32\Process.exe 2007-08-21 22:35 51,200 --a------ C:\WINDOWS\system32\dumphive.exe 2007-08-21 22:35 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe 2007-08-21 22:35 2,450 --a------ C:\WINDOWS\system32\tmp.reg 2007-08-21 18:48 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\nView_Profiles 2007-08-20 15:49 <DIR> d-------- C:\Program Files\MarBit 2007-08-16 19:17 98,816 --a------ C:\WINDOWS\system32\dmstyle.dll 2007-08-16 19:17 937,984 --a------ C:\WINDOWS\system32\dxdiag.exe 2007-08-16 19:17 83,968 --a------ C:\WINDOWS\system32\drivers\nabtsfec.sys 2007-08-16 19:17 80,896 --a------ C:\WINDOWS\system32\dpvsetup.exe 2007-08-16 19:17 8,192 --a------ C:\WINDOWS\system32\d3d8thk.dll 2007-08-16 19:17 797,184 --a------ C:\WINDOWS\system32\d3dim700.dll 2007-08-16 19:17 77,824 --a------ C:\WINDOWS\system32\dpmodemx.dll 2007-08-16 19:17 76,800 --a------ C:\WINDOWS\system32\dpwsockx.dll 2007-08-16 19:17 76,800 --a------ C:\WINDOWS\system32\dmscript.dll 2007-08-16 19:17 733,184 --a------ C:\WINDOWS\system32\qedwipes.dll 2007-08-16 19:17 723,968 --a------ C:\WINDOWS\system32\dpnet.dll 2007-08-16 19:17 7,424 --a------ C:\WINDOWS\system32\drivers\mskssrv.sys 2007-08-16 19:17 68,096 --a------ C:\WINDOWS\system32\dpnhupnp.dll 2007-08-16 19:17 64,512 --a------ C:\WINDOWS\system32\amstream.dll 2007-08-16 19:17 602,624 --a------ C:\WINDOWS\system32\dx7vb.dll 2007-08-16 19:17 58,368 --a------ C:\WINDOWS\system32\dmcompos.dll 2007-08-16 19:17 52,096 --a------ C:\WINDOWS\system32\drivers\msdv.sys 2007-08-16 19:17 5,504 --a------ C:\WINDOWS\system32\drivers\mstee.sys 2007-08-16 19:17 5,248 --a------ C:\WINDOWS\system32\drivers\mspclock.sys 2007-08-16 19:17 491,520 --a------ C:\WINDOWS\system32\dsdmoprp.dll 2007-08-16 19:17 47,104 --a------ C:\WINDOWS\system32\wstdecod.dll 2007-08-16 19:17 45,696 --a------ C:\WINDOWS\system32\drivers\stream.sys 2007-08-16 19:17 449,024 --a------ C:\WINDOWS\system32\qdvd.dll 2007-08-16 19:17 44,544 --a------ C:\WINDOWS\system32\dxdllreg.exe 2007-08-16 19:17 4,608 --a------ C:\WINDOWS\system32\drivers\mspqm.sys 2007-08-16 19:17 4,096 --a------ C:\WINDOWS\system32\ksuser.dll 2007-08-16 19:17 4,096 --a------ C:\WINDOWS\system32\drivers\swenum.sys 2007-08-16 19:17 381,952 --a------ C:\WINDOWS\system32\dpvoice.dll 2007-08-16 19:17 355,328 --a------ C:\WINDOWS\system32\dsound.dll 2007-08-16 19:17 354,816 --a------ C:\WINDOWS\system32\psisdecd.dll 2007-08-16 19:17 34,304 --a------ C:\WINDOWS\system32\mciqtz32.dll 2007-08-16 19:17 33,280 --a------ C:\WINDOWS\system32\dmloader.dll 2007-08-16 19:17 324,096 --a------ C:\WINDOWS\system32\mswebdvd.dll 2007-08-16 19:17 32,768 --a------ C:\WINDOWS\system32\dpnhpast.dll 2007-08-16 19:17 311,808 --a------ C:\WINDOWS\system32\qdv.dll 2007-08-16 19:17 3,072 --a------ C:\WINDOWS\system32\dpnlobby.dll 2007-08-16 19:17 3,072 --a------ C:\WINDOWS\system32\dpnaddr.dll 2007-08-16 19:17 284,160 --a------ C:\WINDOWS\system32\ddraw.dll 2007-08-16 19:17 28,160 --a------ C:\WINDOWS\system32\dplaysvr.exe 2007-08-16 19:17 27,136 --a------ C:\WINDOWS\system32\dmband.dll 2007-08-16 19:17 257,024 --a------ C:\WINDOWS\system32\qcap.dll 2007-08-16 19:17 24,064 --a------ C:\WINDOWS\system32\ddrawex.dll 2007-08-16 19:17 217,600 --a------ C:\WINDOWS\system32\dplayx.dll 2007-08-16 19:17 19,968 --a------ C:\WINDOWS\system32\dpvacm.dll 2007-08-16 19:17 186,880 --a------ C:\WINDOWS\system32\dsdmo.dll 2007-08-16 19:17 18,944 --a------ C:\WINDOWS\system32\encapi.dll 2007-08-16 19:17 18,688 --a------ C:\WINDOWS\system32\drivers\wstcodec.sys 2007-08-16 19:17 18,432 --a------ C:\WINDOWS\system32\dswave.dll 2007-08-16 19:17 171,520 --a------ C:\WINDOWS\system32\dmime.dll 2007-08-16 19:17 16,896 --a------ C:\WINDOWS\system32\msyuv.dll 2007-08-16 19:17 16,896 --a------ C:\WINDOWS\system32\dpnsvr.exe 2007-08-16 19:17 16,384 --a------ C:\WINDOWS\system32\drivers\ccdecode.sys 2007-08-16 19:17 15,104 --a------ C:\WINDOWS\system32\drivers\mpe.sys 2007-08-16 19:17 14,976 --a------ C:\WINDOWS\system32\drivers\streamip.sys 2007-08-16 19:17 132,608 --a------ C:\WINDOWS\system32\devenum.dll 2007-08-16 19:17 130,304 --a------ C:\WINDOWS\system32\drivers\ks.sys 2007-08-16 19:17 13,312 --a------ C:\WINDOWS\system32\msdmo.dll 2007-08-16 19:17 116,736 --a------ C:\WINDOWS\system32\dmusic.dll 2007-08-16 19:17 112,128 --a------ C:\WINDOWS\system32\dpvvox.dll 2007-08-16 19:17 11,392 --a------ C:\WINDOWS\system32\drivers\bdasup.sys 2007-08-16 19:17 100,864 --a------ C:\WINDOWS\system32\dmsynth.dll 2007-08-16 19:17 10,880 --a------ C:\WINDOWS\system32\drivers\slip.sys 2007-08-16 19:17 10,112 --a------ C:\WINDOWS\system32\drivers\ndisip.sys 2007-08-16 19:17 1,962,496 --a------ C:\WINDOWS\system32\quartz.dll 2007-08-16 19:17 1,798,144 --a------ C:\WINDOWS\system32\qedit.dll 2007-08-16 19:17 1,675,264 --a------ C:\WINDOWS\system32\dxdiagn.dll 2007-08-16 19:17 1,634,304 --a------ C:\WINDOWS\system32\d3d9.dll 2007-08-16 19:17 1,294,336 --a------ C:\WINDOWS\system32\dsound3d.dll 2007-08-16 19:17 1,230,336 --a------ C:\WINDOWS\system32\msvidctl.dll 2007-08-16 19:17 1,189,888 --a------ C:\WINDOWS\system32\dx8vb.dll 2007-08-16 19:17 1,177,600 --a------ C:\WINDOWS\system32\d3d8.dll 2007-08-14 17:49 <DIR> d-------- C:\DOCUME~1\PANSTA~1\DANEAP~1\XnView 2007-08-14 13:54 98,304 --a------ C:\WINDOWS\system32\wmpshell.dll 2007-08-14 13:54 7,680 --a------ C:\WINDOWS\system32\asferror.dll 2007-08-14 13:54 52,224 --a------ C:\WINDOWS\system32\mspmsnsv.dll 2007-08-14 13:54 384,512 --a------ C:\WINDOWS\system32\mp4sdmod.dll 2007-08-14 13:54 358,912 --a------ C:\WINDOWS\system32\msscp.dll 2007-08-14 13:54 316,040 --a------ C:\WINDOWS\system32\mp43dmod.dll 2007-08-14 13:54 27,136 --a------ C:\WINDOWS\system32\wmdmlog.dll 2007-08-14 13:54 245,760 --a------ C:\WINDOWS\system32\mswmdm.dll (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) 2007-08-16 21:58 --------- d--h----- C:\Program Files\InstallShield Installation Information 2007-07-27 19:31 --------- d-------- C:\Program Files\Common Files\InstallShield 2007-07-27 17:11 --------- d-------- C:\Program Files\Neostrada TP 2007-07-20 13:01 --------- d-------- C:\Program Files\Netia 2007-07-20 12:52 --------- d--h----- C:\Program Files\WindowsUpdate 2007-07-19 20:05 --------- d-------- C:\Program Files\Creative 2007-07-19 19:16 2410 --a------ C:\WINDOWS\pchealth\HelpCtr\PackageStore\SkuStore.bin 2007-07-19 18:59 --------- d-------- C:\Program Files\Common Files\SpeechEngines 2007-07-19 18:59 --------- d-------- C:\Program Files\Common Files\ODBC 2007-07-19 18:08 --------- d-------- C:\Program Files\microsoft frontpage 2007-07-19 18:07 8738 --a------ C:\WINDOWS\pchealth\HelpCtr\Config\Cntstore.bin 2007-07-19 18:07 0 -rahs---- C:\MSDOS.SYS 2007-07-19 18:07 0 -rahs---- C:\IO.SYS 2007-07-19 18:07 0 --a------ C:\CONFIG.SYS 2007-07-19 18:07 0 --a------ C:\AUTOEXEC.BAT 2007-07-19 18:05 --------- d-------- C:\Program Files\Movie Maker 2007-07-19 18:05 --------- d-------- C:\Program Files\Common Files\MSSoap 2007-07-19 18:04 --------- d-------- C:\Program Files\Windows NT 2007-07-19 18:04 --------- d-------- C:\Program Files\MSN Gaming Zone 2007-07-19 18:04 --------- d-------- C:\Program Files\Messenger --------- C:\Program Files\Usługi online ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{C84D8A0A-E708-42B6-90CA-9C30956A87C6}] 2007-08-23 08:06 43542 --a------ C:\WINDOWS\System32\ljjgfcb.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{DE1FBDF7-2632-4B78-B58C-F804CD92665E}] 2007-08-23 08:12 298080 --a------ C:\WINDOWS\System32\vturo.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SiSUSBRG"="C:\WINDOWS\SiSUSBrg.exe" [2002-04-26 11:17] "UpdReg"="C:\WINDOWS\Updreg.exe" [2000-05-11 01:00] "WheelMouse"="C:\PROGRA~1\A4Tech\Mouse\Amoumain.exe" [2004-08-25 17:31] "SpeedTouch USB Diagnostics"="C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" [2004-01-26 11:38] "NvCplDaemon"="C:\WINDOWS\System32\NvCpl.dll" [2005-04-01 16:16] "nwiz"="nwiz.exe" [2005-04-01 16:16 C:\WINDOWS\system32\nwiz.exe] "NvMediaCenter"="C:\WINDOWS\System32\NvMcTray.dll" [2005-04-01 16:16] "avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-07-28 00:03] "NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 11:50] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" [2007-07-12 04:00] "Application Layer Gateway Service"="C:\WINDOWS\System32\algs.exe" [2002-09-29 00:00] "Windows Logon Application"="C:\WINDOWS\System32\winIogon.exe" [2002-09-29 00:00] "Messenger Sharing USN"="C:\WINDOWS\system\usnsvc.exe" [2007-08-23 08:05] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\System32\ctfmon.exe" [2002-09-29 00:00] "Komunikator"="C:\Program Files\Tlen.pl\tlen.exe" [] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks] "{C84D8A0A-E708-42B6-90CA-9C30956A87C6}"= C:\WINDOWS\System32\ljjgfcb.dll [2007-08-23 08:06 43542] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ljjgfcb] ljjgfcb.dll 2007-08-23 08:06 43542 C:\WINDOWS\system32\ljjgfcb.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\vturo] C:\WINDOWS\System32\vturo.dll 2007-08-23 08:12 298080 C:\WINDOWS\system32\vturo.dll [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Komunikator] C:\Program Files\Tlen.pl\tlen.exe R1 VIAPFD;VIAPFD;C:\WINDOWS\System32\Drivers\VIAPFD.SYS R2 WINNTSMSS;Windows NT Session Manager;"C:\WINDOWS\system\smss.exe" S3 USBSTOR;Sterownik magazynu masowego USB;C:\WINDOWS\System32\DRIVERS\USBSTOR.SYS ************************************************************************** catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-08-23 11:00:03 Windows 5.1.2600 Dodatek Service Pack. 1 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** Completion time: 2007-08-23 11:00:52 C:\ComboFix-quarantined-files.txt ... 2007-08-23 11:00 --- E O F ---

**Posty:** 18165 · przez **wojtas** 23 Sie 2007, 12:04

sciagnij i zainstaluj:

http://www.programosy.pl/program,kerio-personal-firewall.html

W Gmerze w zakładce CMD z zaznaczoną opcją CMD.EXE wklej:

gmer -del service WINNTSMSS
gmer -del file C:\WINDOWS\system32\jkkkkhi.dll
gmer -del file C:\WINDOWS\system32\gebxwtq.dll
gmer -del file C:\WINDOWS\system32\vtusspp.dll
gmer -del file C:\bremover.exe
gmer -del file C:\WINDOWS\system\smss.exe
gmer -del file C:\WINDOWS\system32\orutv.bak1
gmer -del file C:\WINDOWS\system32\vturo.dll
gmer -del file C:\WINDOWS\system32\ljjgfcb.dll
gmer -del file C:\WINDOWS\system\usnsvc.exe
gmer –reboot

I kliknij z prawej strony na Uruchom.

potem wklejasz do notatnika:

Windows Registry Editor Version 5.00

[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{C84D8A0A-E708-42B6-90CA-9C30956A87C6}]

[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{DE1FBDF7-2632-4B78-B58C-F804CD92665E}]

[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ljjgfcb]

[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\vturo]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Messenger Sharing USN"=-
"Windows Logon Application"=-
"Application Layer Gateway Service"=-

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{C84D8A0A-E708-42B6-90CA-9C30956A87C6}"=-

w notatniku u góry>>>plik zapisz jako>>>Zmien rozszerzenie z TXT na Wszystkie pliki *.* >>> Zapisz pod nazwą FIX.REG

Klikasz dwa razy na powstały plik fix i dodajesz go do rejestru....

zastosuj:

smitfraudfix z opcji 2:

http://siri.urz.free.fr/Fix/SmitfraudFix_En.php

oraz te skanery po kilka razy

VundoFix
http://www.atribune.org/ccount/click.php?id=4

VirtumundoBeGone
http://secured2k.home.comcast.net/tools/VirtumundoBeGone.exe

FixVundo
http://securityresponse.symantec.com/avcenter/FixVundo.exe

potem wszystkie nowe logi

**Posty:** 127 · przez **bluejack** 29 Sie 2007, 16:19

HJ

Kod: Zaznacz wszystko: Logfile of HijackThis v1.99.1 Scan saved at 16:09:02, on 2007-08-29 Platform: Windows XP Dodatek SP. 1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\Explorer.EXE C:\PROGRA~1\A4Tech\Mouse\Amoumain.exe C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe C:\WINDOWS\System32\devldr32.exe C:\WINDOWS\System32\RUNDLL32.EXE C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe C:\WINDOWS\System32\ctfmon.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\System32\nvsvc32.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Mozilla Firefox\firefox.exe D:\Moje pliki\Jacek\Pulpit\hijackthis_199\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\NEOSTR~1\SEARCH~1.DLL (file missing) O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll O2 - BHO: (no name) - {85A61E95-7CC1-4F60-A02D-6C267562222A} - C:\WINDOWS\System32\vturo.dll (file missing) O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O4 - HKLM\..\Run: [SiSUSBRG] C:\WINDOWS\SiSUSBrg.exe O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\Updreg.exe O4 - HKLM\..\Run: [WheelMouse] C:\PROGRA~1\A4Tech\Mouse\Amoumain.exe O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe O4 - HKCU\..\Run: [Komunikator] C:\Program Files\Tlen.pl\tlen.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{32571811-FC9A-443F-AA53-51D0D8D59C8C}: NameServer = 213.241.79.37 83.238.255.76 O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing) O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing) O23 - Service: Sunbelt Kerio Personal Firewall 4 (KPF4) - Sunbelt Software - C:\Program Files\Sunbelt Software\Personal Firewall 4\kpf4ss.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe

GMER

Kod: Zaznacz wszystko: GMER 1.0.12.12086 - http://www.gmer.net Rootkit scan 2007-08-29 16:10:53 Windows 5.1.2600 Dodatek Service Pack. 1 ---- Services - GMER 1.0.12 ---- Service [SYSTEM] Aavmker4 Service [DISABLED] Abiosdsk Service [DISABLED] abp480n5 Service C:\WINDOWS\System32\DRIVERS\ACPI.sys [BOOT] ACPI Service [DISABLED] ACPIEC Service [DISABLED] adpu160m Service C:\WINDOWS\system32\drivers\aec.sys [MANUAL] aec Service C:\WINDOWS\System32\drivers\afd.sys [AUTO] AFD Service [DISABLED] Aha154x Service [DISABLED] aic78u2 Service [DISABLED] aic78xx Service C:\WINDOWS\System32\DRIVERS\alcan5wn.sys [MANUAL] alcan5wn Service C:\WINDOWS\System32\DRIVERS\alcaudsl.sys [MANUAL] alcaudsl Service C:\WINDOWS\System32\svchost.exe [MANUAL] Alerter Service C:\WINDOWS\System32\alg.exe [MANUAL] ALG Service [DISABLED] AliIde Service C:\WINDOWS\System32\DRIVERS\Amfilter.sys [SYSTEM] Amfilter Service [DISABLED] amsint Service C:\WINDOWS\System32\DRIVERS\Amusbprt.sys [MANUAL] Amusbprt Service C:\WINDOWS\system32\svchost.exe [MANUAL] AppMgmt Service [DISABLED] asc Service [DISABLED] asc3350p Service [DISABLED] asc3550 Service [AUTO] aswMon2 Service [MANUAL] aswRdr Service [SYSTEM] aswTdi Service C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe [AUTO] aswUpdSv Service C:\WINDOWS\System32\DRIVERS\asyncmac.sys [MANUAL] AsyncMac Service C:\WINDOWS\System32\DRIVERS\atapi.sys [BOOT] atapi Service [DISABLED] Atdisk Service C:\WINDOWS\System32\DRIVERS\atmarpc.sys [MANUAL] Atmarpc Service C:\WINDOWS\System32\svchost.exe [AUTO] AudioSrv Service C:\WINDOWS\System32\DRIVERS\audstub.sys [MANUAL] audstub Service C:\Program Files\Alwil Software\Avast4\ashServ.exe [AUTO] avast! Antivirus Service C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe [MANUAL] avast! Mail Scanner Service C:\Program Files\Alwil Software\Avast4\ashWebSv.exe [MANUAL] avast! Web Scanner Service BattC Service [SYSTEM] Beep Service C:\WINDOWS\System32\svchost.exe [MANUAL] BITS Service C:\WINDOWS\System32\svchost.exe [AUTO] Browser Service C:\DOCUME~1\PANSTA~1\USTAWI~1\Temp\catchme.sys [MANUAL] catchme Service [DISABLED] cbidf2k Service [DISABLED] cd20xrnt Service [SYSTEM] Cdaudio Service [DISABLED] Cdfs Service C:\WINDOWS\System32\DRIVERS\cdrom.sys [SYSTEM] Cdrom Service [SYSTEM] Changer Service C:\WINDOWS\system32\cisvc.exe [MANUAL] CiSvc Service C:\WINDOWS\system32\clipsrv.exe [MANUAL] ClipSrv Service [DISABLED] CmdIde Service C:\WINDOWS\System32\dllhost.exe [MANUAL] COMSysApp Service ContentFilter Service ContentIndex Service [DISABLED] Cpqarray Service C:\WINDOWS\system32\svchost.exe [AUTO] CryptSvc Service C:\WINDOWS\System32\DRIVERS\ctljystk.sys [MANUAL] ctljystk Service ctlntsvc Service [DISABLED] dac2w2k Service [DISABLED] dac960nt Service C:\WINDOWS\System32\svchost.exe [AUTO] Dhcp Service C:\WINDOWS\System32\DRIVERS\disk.sys [BOOT] Disk Service C:\WINDOWS\System32\dmadmin.exe [MANUAL] dmadmin Service C:\WINDOWS\System32\drivers\dmboot.sys [DISABLED] dmboot Service C:\WINDOWS\System32\drivers\dmio.sys [BOOT] dmio Service C:\WINDOWS\System32\drivers\dmload.sys [BOOT] dmload Service C:\WINDOWS\System32\svchost.exe [AUTO] dmserver Service C:\WINDOWS\system32\drivers\DMusic.sys [MANUAL] DMusic Service C:\WINDOWS\System32\svchost.exe [AUTO] Dnscache Service [DISABLED] dpti2o Service C:\WINDOWS\system32\drivers\drmkaud.sys [MANUAL] drmkaud Service C:\WINDOWS\system32\drivers\emu10k1f.sys [MANUAL] emu10k Service C:\WINDOWS\system32\drivers\ctlface.sys [MANUAL] emu10k1 Service C:\WINDOWS\System32\svchost.exe [AUTO] ERSvc Service C:\WINDOWS\system32\services.exe [AUTO] Eventlog Service C:\WINDOWS\System32\svchost.exe [MANUAL] EventSystem Service [DISABLED] Fastfat Service C:\WINDOWS\System32\svchost.exe [MANUAL] FastUserSwitchingCompatibility Service C:\WINDOWS\System32\DRIVERS\fdc.sys [MANUAL] Fdc Service [SYSTEM] Fips Service C:\WINDOWS\System32\DRIVERS\flpydisk.sys [MANUAL] Flpydisk Service [SYSTEM] Fs_Rec Service C:\WINDOWS\System32\DRIVERS\ftdisk.sys [BOOT] Ftdisk Service C:\WINDOWS\system32\drivers\fwdrv.sys [SYSTEM] fwdrv Service C:\WINDOWS\System32\DRIVERS\gameenum.sys [MANUAL] gameenum Service C:\WINDOWS\System32\DRIVERS\gmer.sys [MANUAL] gmer Service C:\WINDOWS\System32\DRIVERS\msgpc.sys [MANUAL] Gpc Service C:\WINDOWS\System32\svchost.exe [AUTO] helpsvc Service C:\WINDOWS\System32\svchost.exe [DISABLED] HidServ Service C:\WINDOWS\System32\DRIVERS\hidusb.sys [MANUAL] HidUsb Service [DISABLED] hpn Service [SYSTEM] i2omgmt Service [DISABLED] i2omp Service C:\WINDOWS\System32\DRIVERS\i8042prt.sys [SYSTEM] i8042prt Service C:\WINDOWS\System32\DRIVERS\imapi.sys [SYSTEM] Imapi Service C:\WINDOWS\System32\imapi.exe [MANUAL] ImapiService Service inetaccs Service [DISABLED] ini910u Service Inport Service [DISABLED] IntelIde Service C:\WINDOWS\System32\DRIVERS\ipfltdrv.sys [MANUAL] IpFilterDriver Service C:\WINDOWS\System32\DRIVERS\ipinip.sys [MANUAL] IpInIp Service C:\WINDOWS\System32\DRIVERS\ipnat.sys [MANUAL] IpNat Service C:\WINDOWS\System32\DRIVERS\ipsec.sys [SYSTEM] IPSec Service C:\WINDOWS\System32\DRIVERS\irenum.sys [MANUAL] IRENUM Service ISAPISearch Service C:\WINDOWS\System32\DRIVERS\isapnp.sys [BOOT] isapnp Service C:\WINDOWS\System32\DRIVERS\kbdclass.sys [SYSTEM] Kbdclass Service C:\WINDOWS\system32\drivers\khips.sys [SYSTEM] khips Service C:\WINDOWS\system32\drivers\kmixer.sys [MANUAL] kmixer Service C:\Program Files\Sunbelt Software\Personal Firewall 4\kpf4ss.exe [AUTO] KPF4 Service [BOOT] KSecDD Service C:\WINDOWS\System32\svchost.exe [AUTO] lanmanserver Service C:\WINDOWS\System32\svchost.exe [AUTO] lanmanworkstation Service [SYSTEM] lbrtfdc Service ldap Service LicenseService Service C:\WINDOWS\System32\svchost.exe [AUTO] LmHosts Service C:\WINDOWS\System32\svchost.exe [DISABLED] Messenger Service [SYSTEM] mnmdd Service C:\WINDOWS\System32\mnmsrvc.exe [MANUAL] mnmsrvc Service [MANUAL] Modem Service C:\WINDOWS\System32\DRIVERS\mouclass.sys [SYSTEM] Mouclass Service C:\WINDOWS\System32\DRIVERS\mouhid.sys [MANUAL] mouhid Service [BOOT] MountMgr Service [DISABLED] mraid35x Service C:\WINDOWS\System32\DRIVERS\mrxdav.sys [MANUAL] MRxDAV Service C:\WINDOWS\System32\DRIVERS\mrxsmb.sys [SYSTEM] MRxSmb Service C:\WINDOWS\System32\msdtc.exe [MANUAL] MSDTC Service [SYSTEM] Msfs Service C:\WINDOWS\System32\msiexec.exe [MANUAL] MSIServer Service C:\WINDOWS\system32\drivers\MSKSSRV.sys [MANUAL] MSKSSRV Service C:\WINDOWS\system32\drivers\MSPCLOCK.sys [MANUAL] MSPCLOCK Service C:\WINDOWS\system32\drivers\MSPQM.sys [MANUAL] MSPQM Service C:\WINDOWS\system32\drivers\msmpu401.sys [MANUAL] ms_mpu401 Service [BOOT] Mup Service [BOOT] NDIS Service C:\WINDOWS\System32\DRIVERS\ndistapi.sys [MANUAL] NdisTapi Service C:\WINDOWS\System32\DRIVERS\ndisuio.sys [MANUAL] Ndisuio Service C:\WINDOWS\System32\DRIVERS\ndiswan.sys [MANUAL] NdisWan Service [MANUAL] NDProxy Service C:\WINDOWS\System32\DRIVERS\netbios.sys [SYSTEM] NetBIOS Service C:\WINDOWS\System32\DRIVERS\netbt.sys [DISABLED] NetBT Service C:\WINDOWS\system32\netdde.exe [MANUAL] NetDDE Service C:\WINDOWS\system32\netdde.exe [MANUAL] NetDDEdsdm Service C:\WINDOWS\System32\lsass.exe [MANUAL] Netlogon Service C:\WINDOWS\System32\svchost.exe [MANUAL] Netman Service C:\WINDOWS\System32\svchost.exe [MANUAL] Nla Service [SYSTEM] Npfs Service [DISABLED] Ntfs Service C:\WINDOWS\System32\lsass.exe [MANUAL] NtLmSsp Service C:\WINDOWS\system32\svchost.exe [MANUAL] NtmsSvc Service [SYSTEM] Null Service C:\WINDOWS\System32\DRIVERS\nv4_mini.sys [MANUAL] nv Service nv4 Service C:\WINDOWS\System32\nvsvc32.exe [AUTO] NVSvc Service C:\WINDOWS\System32\DRIVERS\nwlnkflt.sys [MANUAL] NwlnkFlt Service C:\WINDOWS\System32\DRIVERS\nwlnkfwd.sys [MANUAL] NwlnkFwd Service C:\WINDOWS\System32\DRIVERS\parport.sys [MANUAL] Parport Service [BOOT] PartMgr Service [AUTO] ParVdm Service C:\WINDOWS\System32\DRIVERS\pci.sys [BOOT] PCI Service [SYSTEM] PCIDump Service C:\WINDOWS\System32\DRIVERS\pciide.sys [BOOT] PCIIde Service [DISABLED] Pcmcia Service [MANUAL] PDCOMP Service [MANUAL] PDFRAME Service [MANUAL] PDRELI Service [MANUAL] PDRFRAME Service [DISABLED] perc2 Service [DISABLED] perc2hib Service PerfDisk Service PerfNet Service PerfOS Service PerfProc Service C:\WINDOWS\System32\PfModNT.sys [AUTO] PfModNT Service C:\WINDOWS\system32\services.exe [AUTO] PlugPlay Service C:\WINDOWS\System32\lsass.exe [MANUAL] PolicyAgent Service C:\WINDOWS\System32\DRIVERS\raspptp.sys [MANUAL] PptpMiniport Service C:\WINDOWS\system32\lsass.exe [AUTO] ProtectedStorage Service C:\WINDOWS\System32\DRIVERS\psched.sys [MANUAL] PSched Service C:\WINDOWS\System32\DRIVERS\ptilink.sys [MANUAL] Ptilink Service C:\WINDOWS\System32\Drivers\PxHelp20.sys [BOOT] PxHelp20 Service [DISABLED] ql1080 Service [DISABLED] Ql10wnt Service [DISABLED] ql12160 Service [DISABLED] ql1240 Service [DISABLED] ql1280 Service C:\WINDOWS\System32\DRIVERS\rasacd.sys [SYSTEM] RasAcd Service C:\WINDOWS\System32\svchost.exe [MANUAL] RasAuto Service C:\WINDOWS\System32\DRIVERS\rasl2tp.sys [MANUAL] Rasl2tp Service C:\WINDOWS\System32\svchost.exe [MANUAL] RasMan Service C:\WINDOWS\System32\DRIVERS\raspppoe.sys [MANUAL] RasPppoe Service C:\WINDOWS\System32\DRIVERS\raspti.sys [MANUAL] Raspti Service C:\WINDOWS\System32\DRIVERS\rdbss.sys [SYSTEM] Rdbss Service C:\WINDOWS\System32\DRIVERS\RDPCDD.sys [SYSTEM] RDPCDD Service RDPDD Service C:\WINDOWS\System32\DRIVERS\rdpdr.sys [MANUAL] rdpdr Service RDPNP Service [MANUAL] RDPWD Service C:\WINDOWS\system32\sessmgr.exe [MANUAL] RDSessMgr Service C:\WINDOWS\System32\DRIVERS\redbook.sys [SYSTEM] redbook Service C:\WINDOWS\System32\svchost.exe [DISABLED] RemoteAccess Service C:\WINDOWS\system32\svchost.exe [DISABLED] RemoteRegistry Service C:\WINDOWS\System32\locator.exe [MANUAL] RpcLocator Service C:\WINDOWS\system32\svchost.exe [AUTO] RpcSs Service C:\WINDOWS\System32\rsvp.exe [MANUAL] RSVP Service C:\WINDOWS\system32\lsass.exe [AUTO] SamSs Service C:\WINDOWS\System32\SCardSvr.exe [MANUAL] SCardDrv Service C:\WINDOWS\System32\SCardSvr.exe [MANUAL] SCardSvr Service C:\WINDOWS\System32\svchost.exe [AUTO] Schedule Service C:\WINDOWS\System32\DRIVERS\secdrv.sys [MANUAL] Secdrv Service C:\WINDOWS\System32\svchost.exe [AUTO] seclogon Service C:\WINDOWS\system32\svchost.exe [AUTO] SENS Service C:\WINDOWS\System32\DRIVERS\serenum.sys [MANUAL] serenum Service C:\WINDOWS\System32\DRIVERS\serial.sys [SYSTEM] Serial Service [SYSTEM] Sfloppy Service C:\WINDOWS\system32\drivers\sfman.sys [MANUAL] sfman Service C:\WINDOWS\System32\svchost.exe [AUTO] SharedAccess Service C:\WINDOWS\System32\svchost.exe [AUTO] ShellHWDetection Service [DISABLED] Simbad Service C:\WINDOWS\System32\DRIVERS\sisagp.sys [BOOT] sisagp Service [DISABLED] Sparrow Service C:\WINDOWS\system32\drivers\splitter.sys [MANUAL] splitter Service C:\WINDOWS\system32\spoolsv.exe [AUTO] Spooler Service C:\WINDOWS\System32\DRIVERS\sr.sys [BOOT] sr Service C:\WINDOWS\System32\svchost.exe [AUTO] srservice Service C:\WINDOWS\System32\DRIVERS\srv.sys [MANUAL] Srv Service C:\WINDOWS\System32\svchost.exe [DISABLED] SSDPSRV Service C:\WINDOWS\System32\svchost.exe [MANUAL] stisvc Service C:\WINDOWS\System32\DRIVERS\swenum.sys [MANUAL] swenum Service C:\WINDOWS\system32\drivers\swmidi.sys [MANUAL] swmidi Service C:\WINDOWS\System32\dllhost.exe [MANUAL] SwPrv Service [DISABLED] symc810 Service [DISABLED] symc8xx Service [DISABLED] sym_hi Service [DISABLED] sym_u3 Service C:\WINDOWS\system32\drivers\sysaudio.sys [MANUAL] sysaudio Service C:\WINDOWS\system32\smlogsvc.exe [MANUAL] SysmonLog Service C:\WINDOWS\System32\svchost.exe [MANUAL] TapiSrv Service C:\WINDOWS\System32\DRIVERS\tcpip.sys [SYSTEM] Tcpip Service [MANUAL] TDPIPE Service [MANUAL] TDTCP Service C:\WINDOWS\System32\DRIVERS\termdd.sys [SYSTEM] TermDD Service C:\WINDOWS\System32\svchost.exe [MANUAL] TermService Service C:\WINDOWS\System32\svchost.exe [AUTO] Themes Service C:\WINDOWS\System32\tlntsvr.exe [DISABLED] TlntSvr Service [DISABLED] TosIde Service C:\WINDOWS\system32\svchost.exe [AUTO] TrkWks Service TSDDD Service [DISABLED] Udfs Service [DISABLED] ultra Service C:\WINDOWS\System32\DRIVERS\update.sys [MANUAL] Update Service C:\WINDOWS\System32\svchost.exe [AUTO] uploadmgr Service C:\WINDOWS\System32\svchost.exe [MANUAL] upnphost Service C:\WINDOWS\System32\ups.exe [MANUAL] UPS Service USB Service C:\WINDOWS\System32\DRIVERS\usbehci.sys [MANUAL] usbehci Service C:\WINDOWS\System32\DRIVERS\usbhub.sys [MANUAL] usbhub Service C:\WINDOWS\System32\DRIVERS\usbohci.sys [MANUAL] usbohci Service C:\WINDOWS\System32\DRIVERS\USBSTOR.SYS [MANUAL] USBSTOR Service C:\WINDOWS\System32\DRIVERS\usbuhci.sys [MANUAL] usbuhci Service C:\WINDOWS\System32\drivers\vga.sys [SYSTEM] VgaSave Service [DISABLED] ViaIde Service C:\WINDOWS\System32\Drivers\VIAPFD.SYS [SYSTEM] VIAPFD Service [BOOT] VolSnap Service C:\WINDOWS\System32\vssvc.exe [MANUAL] VSS Service C:\WINDOWS\System32\svchost.exe [AUTO] W32Time Service W3SVC Service C:\WINDOWS\System32\DRIVERS\wanarp.sys [MANUAL] Wanarp Service [MANUAL] WDICA Service C:\WINDOWS\system32\drivers\wdmaud.sys [MANUAL] wdmaud Service C:\WINDOWS\System32\svchost.exe [AUTO] WebClient Service C:\WINDOWS\system32\svchost.exe [AUTO] winmgmt Service [MANUAL] Winsock Service WinSock2 Service WinTrust Service C:\WINDOWS\System32\svchost.exe [MANUAL] WmdmPmSN Service C:\WINDOWS\System32\svchost.exe [MANUAL] Wmi Service WmiApRpl Service C:\WINDOWS\System32\wbem\wmiapsrv.exe [MANUAL] WmiApSrv Service [AUTO] wscsvc Service C:\WINDOWS\system32\svchost.exe [AUTO] wuauserv Service C:\WINDOWS\System32\svchost.exe [AUTO] WZCSVC ---- EOF - GMER 1.0.12 ----

COMBOFIX

Kod: Zaznacz wszystko: ComboFix 07-08-17.2 - "Pan Stawicki" 2007-08-29 16:12:02.9 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.1.1250.1.1045.18.68 [GMT 2:00] ((((((((((((((((((((((((( Files Created from 2007-07-28 to 2007-08-29 ))))))))))))))))))))))))))))))) 2007-08-29 15:49 <DIR> d--hs---- C:\found.000 2007-08-27 16:46 <DIR> d-------- C:\DOCUME~1\PANSTA~1\DANEAP~1\gtk-2.0 2007-08-27 16:45 <DIR> d-------- C:\DOCUME~1\PANSTA~1\.thumbnails 2007-08-27 16:43 <DIR> d-------- C:\DOCUME~1\PANSTA~1\.gimp-2.2 2007-08-26 17:41 <DIR> d-------- C:\WINDOWS\ShellNew 2007-08-23 18:06 <DIR> d-------- C:\VundoFix Backups 2007-08-23 17:33 43,542 --a------ C:\WINDOWS\system32\pmnnmlk.dll 2007-08-23 17:11 1,635 --a------ C:\WINDOWS\system32\vquykepx.exe 2007-08-23 14:51 43,542 --a------ C:\WINDOWS\system32\fccyxxx.dll 2007-08-23 14:43 <DIR> d-------- C:\Program Files\Sunbelt Software 2007-08-23 14:12 69,984 --a------ C:\WINDOWS\system32\zkuri.exe 2007-08-23 14:12 69,984 --a------ C:\WINDOWS\system32\wcac.exe 2007-08-23 09:53 69,120 --a------ C:\WINDOWS\system32\olecli32.dll 2007-08-23 09:53 535,552 --a------ C:\WINDOWS\system32\rpcrt4.dll 2007-08-23 09:53 275,456 --a------ C:\WINDOWS\system32\rpcss.dll 2007-08-23 09:53 1,190,400 --a------ C:\WINDOWS\system32\ole32.dll 2007-08-23 09:53 <DIR> d--h----- C:\WINDOWS\$hf_mig$ 2007-08-23 08:06 43,542 --a------ C:\WINDOWS\system32\ljjgfcb.dll.vir 2007-08-21 22:50 51,200 --a------ C:\WINDOWS\nircmd.exe 2007-08-21 22:35 53,248 --a------ C:\WINDOWS\system32\Process.exe 2007-08-21 22:35 51,200 --a------ C:\WINDOWS\system32\dumphive.exe 2007-08-21 22:35 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe 2007-08-21 22:35 1,944 --a------ C:\WINDOWS\system32\tmp.reg 2007-08-21 18:48 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\nView_Profiles 2007-08-20 15:49 <DIR> d-------- C:\Program Files\MarBit 2007-08-16 19:17 98,816 --a------ C:\WINDOWS\system32\dmstyle.dll 2007-08-16 19:17 937,984 --a------ C:\WINDOWS\system32\dxdiag.exe 2007-08-16 19:17 83,968 --a------ C:\WINDOWS\system32\drivers\nabtsfec.sys 2007-08-16 19:17 80,896 --a------ C:\WINDOWS\system32\dpvsetup.exe 2007-08-16 19:17 8,192 --a------ C:\WINDOWS\system32\d3d8thk.dll 2007-08-16 19:17 797,184 --a------ C:\WINDOWS\system32\d3dim700.dll 2007-08-16 19:17 77,824 --a------ C:\WINDOWS\system32\dpmodemx.dll 2007-08-16 19:17 76,800 --a------ C:\WINDOWS\system32\dpwsockx.dll 2007-08-16 19:17 76,800 --a------ C:\WINDOWS\system32\dmscript.dll 2007-08-16 19:17 733,184 --a------ C:\WINDOWS\system32\qedwipes.dll 2007-08-16 19:17 723,968 --a------ C:\WINDOWS\system32\dpnet.dll 2007-08-16 19:17 7,424 --a------ C:\WINDOWS\system32\drivers\mskssrv.sys 2007-08-16 19:17 68,096 --a------ C:\WINDOWS\system32\dpnhupnp.dll 2007-08-16 19:17 64,512 --a------ C:\WINDOWS\system32\amstream.dll 2007-08-16 19:17 602,624 --a------ C:\WINDOWS\system32\dx7vb.dll 2007-08-16 19:17 58,368 --a------ C:\WINDOWS\system32\dmcompos.dll 2007-08-16 19:17 52,096 --a------ C:\WINDOWS\system32\drivers\msdv.sys 2007-08-16 19:17 5,504 --a------ C:\WINDOWS\system32\drivers\mstee.sys 2007-08-16 19:17 5,248 --a------ C:\WINDOWS\system32\drivers\mspclock.sys 2007-08-16 19:17 491,520 --a------ C:\WINDOWS\system32\dsdmoprp.dll 2007-08-16 19:17 47,104 --a------ C:\WINDOWS\system32\wstdecod.dll 2007-08-16 19:17 45,696 --a------ C:\WINDOWS\system32\drivers\stream.sys 2007-08-16 19:17 449,024 --a------ C:\WINDOWS\system32\qdvd.dll 2007-08-16 19:17 44,544 --a------ C:\WINDOWS\system32\dxdllreg.exe 2007-08-16 19:17 4,608 --a------ C:\WINDOWS\system32\drivers\mspqm.sys 2007-08-16 19:17 4,096 --a------ C:\WINDOWS\system32\ksuser.dll 2007-08-16 19:17 4,096 --a------ C:\WINDOWS\system32\drivers\swenum.sys 2007-08-16 19:17 381,952 --a------ C:\WINDOWS\system32\dpvoice.dll 2007-08-16 19:17 355,328 --a------ C:\WINDOWS\system32\dsound.dll 2007-08-16 19:17 354,816 --a------ C:\WINDOWS\system32\psisdecd.dll 2007-08-16 19:17 34,304 --a------ C:\WINDOWS\system32\mciqtz32.dll 2007-08-16 19:17 33,280 --a------ C:\WINDOWS\system32\dmloader.dll 2007-08-16 19:17 324,096 --a------ C:\WINDOWS\system32\mswebdvd.dll 2007-08-16 19:17 32,768 --a------ C:\WINDOWS\system32\dpnhpast.dll 2007-08-16 19:17 311,808 --a------ C:\WINDOWS\system32\qdv.dll 2007-08-16 19:17 3,072 --a------ C:\WINDOWS\system32\dpnlobby.dll 2007-08-16 19:17 3,072 --a------ C:\WINDOWS\system32\dpnaddr.dll 2007-08-16 19:17 284,160 --a------ C:\WINDOWS\system32\ddraw.dll 2007-08-16 19:17 28,160 --a------ C:\WINDOWS\system32\dplaysvr.exe 2007-08-16 19:17 27,136 --a------ C:\WINDOWS\system32\dmband.dll 2007-08-16 19:17 257,024 --a------ C:\WINDOWS\system32\qcap.dll 2007-08-16 19:17 24,064 --a------ C:\WINDOWS\system32\ddrawex.dll 2007-08-16 19:17 217,600 --a------ C:\WINDOWS\system32\dplayx.dll 2007-08-16 19:17 19,968 --a------ C:\WINDOWS\system32\dpvacm.dll 2007-08-16 19:17 186,880 --a------ C:\WINDOWS\system32\dsdmo.dll 2007-08-16 19:17 18,944 --a------ C:\WINDOWS\system32\encapi.dll 2007-08-16 19:17 18,688 --a------ C:\WINDOWS\system32\drivers\wstcodec.sys 2007-08-16 19:17 18,432 --a------ C:\WINDOWS\system32\dswave.dll 2007-08-16 19:17 171,520 --a------ C:\WINDOWS\system32\dmime.dll 2007-08-16 19:17 16,896 --a------ C:\WINDOWS\system32\msyuv.dll 2007-08-16 19:17 16,896 --a------ C:\WINDOWS\system32\dpnsvr.exe 2007-08-16 19:17 16,384 --a------ C:\WINDOWS\system32\drivers\ccdecode.sys 2007-08-16 19:17 15,104 --a------ C:\WINDOWS\system32\drivers\mpe.sys 2007-08-16 19:17 14,976 --a------ C:\WINDOWS\system32\drivers\streamip.sys 2007-08-16 19:17 132,608 --a------ C:\WINDOWS\system32\devenum.dll 2007-08-16 19:17 130,304 --a------ C:\WINDOWS\system32\drivers\ks.sys 2007-08-16 19:17 13,312 --a------ C:\WINDOWS\system32\msdmo.dll 2007-08-16 19:17 116,736 --a------ C:\WINDOWS\system32\dmusic.dll 2007-08-16 19:17 112,128 --a------ C:\WINDOWS\system32\dpvvox.dll 2007-08-16 19:17 11,392 --a------ C:\WINDOWS\system32\drivers\bdasup.sys 2007-08-16 19:17 100,864 --a------ C:\WINDOWS\system32\dmsynth.dll 2007-08-16 19:17 10,880 --a------ C:\WINDOWS\system32\drivers\slip.sys 2007-08-16 19:17 10,112 --a------ C:\WINDOWS\system32\drivers\ndisip.sys 2007-08-16 19:17 1,962,496 --a------ C:\WINDOWS\system32\quartz.dll 2007-08-16 19:17 1,798,144 --a------ C:\WINDOWS\system32\qedit.dll 2007-08-16 19:17 1,675,264 --a------ C:\WINDOWS\system32\dxdiagn.dll 2007-08-16 19:17 1,634,304 --a------ C:\WINDOWS\system32\d3d9.dll 2007-08-16 19:17 1,294,336 --a------ C:\WINDOWS\system32\dsound3d.dll 2007-08-16 19:17 1,230,336 --a------ C:\WINDOWS\system32\msvidctl.dll 2007-08-16 19:17 1,189,888 --a------ C:\WINDOWS\system32\dx8vb.dll 2007-08-16 19:17 1,177,600 --a------ C:\WINDOWS\system32\d3d8.dll 2007-08-14 17:49 <DIR> d-------- C:\DOCUME~1\PANSTA~1\DANEAP~1\XnView 2007-08-14 13:54 98,304 --a------ C:\WINDOWS\system32\wmpshell.dll 2007-08-14 13:54 7,680 --a------ C:\WINDOWS\system32\asferror.dll 2007-08-14 13:54 52,224 --a------ C:\WINDOWS\system32\mspmsnsv.dll (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) 2007-08-29 15:57 495 --a------ C:\WINDOWS\system32\drivers\fwdrv.err 2007-08-16 21:58 --------- d--h----- C:\Program Files\InstallShield Installation Information 2007-07-29 21:18 --------- d-------- C:\Program Files\Tlen.pl 2007-07-29 13:22 --------- d-------- C:\DOCUME~1\PANSTA~1\DANEAP~1\Tlen.pl 2007-07-27 19:50 --------- d-------- C:\Program Files\INTERIAPL 2007-07-27 19:38 --------- d-------- C:\Program Files\Winamp 2007-07-27 19:31 --------- d-------- C:\Program Files\Common Files\InstallShield 2007-07-27 17:11 --------- d-------- C:\Program Files\Neostrada TP 2007-07-27 17:08 --------- d-------- C:\Program Files\Thomson 2007-07-24 15:26 --------- d-------- C:\Program Files\A4Tech 2007-07-24 11:18 --------- d-------- C:\DOCUME~1\PANSTA~1\DANEAP~1\Media Player Classic 2007-07-20 13:01 --------- d-------- C:\Program Files\Netia 2007-07-20 12:52 --------- d--h----- C:\Program Files\WindowsUpdate 2007-07-19 20:05 --------- d-------- C:\Program Files\Creative 2007-07-19 19:16 2410 --a------ C:\WINDOWS\pchealth\HelpCtr\PackageStore\SkuStore.bin 2007-07-19 18:59 --------- d-------- C:\Program Files\Common Files\SpeechEngines 2007-07-19 18:59 --------- d-------- C:\Program Files\Common Files\ODBC 2007-07-19 18:08 --------- d-------- C:\Program Files\microsoft frontpage 2007-07-19 18:07 8738 --a------ C:\WINDOWS\pchealth\HelpCtr\Config\Cntstore.bin 2007-07-19 18:07 0 -rahs---- C:\MSDOS.SYS 2007-07-19 18:07 0 -rahs---- C:\IO.SYS 2007-07-19 18:07 0 --a------ C:\CONFIG.SYS 2007-07-19 18:07 0 --a------ C:\AUTOEXEC.BAT 2007-07-19 18:05 --------- d-------- C:\Program Files\Movie Maker 2007-07-19 18:05 --------- d-------- C:\Program Files\Common Files\MSSoap 2007-07-19 18:04 --------- d-------- C:\Program Files\Windows NT 2007-07-19 18:04 --------- d-------- C:\Program Files\MSN Gaming Zone 2007-07-19 18:04 --------- d-------- C:\Program Files\Messenger --------- C:\Program Files\Usługi online ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{85A61E95-7CC1-4F60-A02D-6C267562222A}] C:\WINDOWS\System32\vturo.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SiSUSBRG"="C:\WINDOWS\SiSUSBrg.exe" [2002-04-26 11:17] "UpdReg"="C:\WINDOWS\Updreg.exe" [2000-05-11 01:00] "WheelMouse"="C:\PROGRA~1\A4Tech\Mouse\Amoumain.exe" [2004-08-25 17:31] "SpeedTouch USB Diagnostics"="C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" [2004-01-26 11:38] "NvCplDaemon"="C:\WINDOWS\System32\NvCpl.dll" [2005-04-01 16:16] "nwiz"="nwiz.exe" [2005-04-01 16:16 C:\WINDOWS\system32\nwiz.exe] "NvMediaCenter"="C:\WINDOWS\System32\NvMcTray.dll" [2005-04-01 16:16] "avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-07-28 00:03] "NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 11:50] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" [2007-07-12 04:00] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\System32\ctfmon.exe" [2002-09-29 00:00] "Komunikator"="C:\Program Files\Tlen.pl\tlen.exe" [] C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\ Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 10:01:04] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Komunikator] C:\Program Files\Tlen.pl\tlen.exe R1 fwdrv;Firewall Driver;C:\WINDOWS\System32\drivers\fwdrv.sys R1 khips;Kerio HIPS Driver;C:\WINDOWS\System32\drivers\khips.sys R1 VIAPFD;VIAPFD;C:\WINDOWS\System32\Drivers\VIAPFD.SYS S3 USBSTOR;Sterownik magazynu masowego USB;C:\WINDOWS\System32\DRIVERS\USBSTOR.SYS ************************************************************************** catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-08-29 16:14:16 Windows 5.1.2600 Dodatek Service Pack. 1 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** Completion time: 2007-08-29 16:16:14 C:\ComboFix-quarantined-files.txt ... 2007-08-29 16:16 C:\ComboFix2.txt ... 2007-08-23 11:00 --- E O F ---

**Posty:** 18165 · przez **wojtas** 29 Sie 2007, 22:00

Nie stosuj juz combofixa

skasuj te wpisy:

O2 - BHO: (no name) - {85A61E95-7CC1-4F60-A02D-6C267562222A} - C:\WINDOWS\System32\vturo.dll (file missing)
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k

oraz te pliki:

C:\WINDOWS\system32\ljjgfcb.dll.vir
C:\WINDOWS\system32\pmnnmlk.dll
C:\WINDOWS\system32\vquykepx.exe
C:\WINDOWS\system32\fccyxxx.dll
C:\WINDOWS\system32\zkuri.exe
C:\WINDOWS\system32\wcac.exe

potem daj loga z dss'a

**Posty:** 127 · przez **bluejack** 31 Sie 2007, 10:14

Nie mogłem znależć

O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k

LOG Z DSS'A - MAIN

Deckard's System Scanner v20070826.66
Run by Pan Stawicki on 2007-08-31 10:08:02
Computer is in Normal Mode.
--------------------------------------------------------------------------------

-- System Restore --------------------------------------------------------------

Successfully created a Deckard's System Scanner Restore Point.

-- Last 5 Restore Point(s) --
57: 2007-08-31 08:08:16 UTC - RP57 - Deckard's System Scanner Restore Point
56: 2007-08-29 16:42:27 UTC - RP56 - Removed Sunbelt Kerio Personal Firewall
55: 2007-08-26 15:41:21 UTC - RP55 - Zainstalowano: Microsoft Office XP Professional z programem FrontPage
54: 2007-08-23 12:43:56 UTC - RP54 - Installed Sunbelt Kerio Personal Firewall
53: 2007-08-23 07:53:34 UTC - RP53 - Zainstalowano Windows XP KB894391.

-- First Restore Point --
1: 2007-07-19 16:12:45 UTC - RP1 - Punkt kontrolny systemu

Backed up registry hives.
Performed disk cleanup.

Total Physical Memory: 256 MiB (512 MiB recommended).

-- HijackThis (run as Pan Stawicki.exe) ----------------------------------------

Unable to find log (file not found); running clone.
-- HijackThis Clone ------------------------------------------------------------

Emulating logfile of HijackThis v1.99.1
Scan saved at 2007-08-31 10:08:51
Platform: Windows XP Dodatek Service Pack. 1 (5.01.2600)
MSIE: Internet Explorer (6.00.2800.1106)

Running processes:
C:\WINDOWS\system32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\explorer.exe
C:\Program Files\A4Tech\Mouse\Amoumain.exe
C:\WINDOWS\system32\devldr32.exe
C:\Program Files\Thomson\SpeedTouch USB\dragdiag.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Alwil Software\Avast4\ashDisp.exe
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Pan Stawicki\Pulpit\dss.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://home.microsoft.com/access/autosearch.asp?p=%s
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
R1 - HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\NEOSTR~1\SEARCH~1.DLL (file missing)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\system32\msdxm.ocx
O4 - HKEY_LOCAL_MACHINE\..\Run: [SiSUSBRG] C:\WINDOWS\SiSUSBrg.exe
O4 - HKEY_LOCAL_MACHINE\..\Run: [UpdReg] C:\WINDOWS\Updreg.exe
O4 - HKEY_LOCAL_MACHINE\..\Run: [WheelMouse] C:\PROGRA~1\A4Tech\Mouse\Amoumain.exe
O4 - HKEY_LOCAL_MACHINE\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon
O4 - HKEY_LOCAL_MACHINE\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKEY_LOCAL_MACHINE\..\Run: [nwiz] nwiz.exe /install
O4 - HKEY_LOCAL_MACHINE\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKEY_LOCAL_MACHINE\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKEY_LOCAL_MACHINE\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKEY_LOCAL_MACHINE\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [Komunikator] C:\Program Files\Tlen.pl\tlen.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O17 - HKLM\SYSTEM\CCS\Services\Tcpip\..\{32571811-FC9A-443F-AA53-51D0D8D59C8C}: NameServer = 213.241.79.37 83.238.255.76
O18 - Protocol: cdo - {CD00020A-8B95-11D1-82DB-00C04FB1625D} - C:\Program Files\Common Files\Microsoft Shared\Web Folders\PKMCDO.DLL
O18 - Protocol: mso-offdap - {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\Program Files\Common Files\Microsoft Shared\Web Components\10\OWC10.DLL

-- HijackThis Fixed Entries (D:\MOJEPL~1\Jacek\Pulpit\HIJACK~1\backups\) -------

backup-20070317-180704-719 O4 - HKLM\..\Run: [2chkdsk] rundll32.exe "D:\WINDOWS\System32\hmiflxgr.dll",setvm
backup-20070317-213106-322 O2 - BHO: (no name) - {D38439EC-4A7F-42b4-90C2-D810D7778FDD} - D:\WINDOWS\System32\cptcrspr.dll (file missing)
backup-20070317-213106-542 O2 - BHO: (no name) - {921628CF-B8F1-413D-BBA5-7925E4CF56FF} - D:\WINDOWS\System32\jkkli.dll (file missing)
backup-20070317-213106-717 O2 - BHO: (no name) - {E21C3C0B-D4FC-48D2-88E9-F737029A3181} - D:\WINDOWS\System32\gebcd.dll (file missing)
backup-20070317-213106-907 O2 - BHO: (no name) - {4B50DEB2-891B-4CEE-A06C-144207F4015E} - D:\WINDOWS\System32\ssqqron.dll (file missing)
backup-20070318-130226-274 O4 - HKLM\..\Run: [2chkdsk] rundll32.exe "D:\WINDOWS\System32\wyyjlhrp.dll",setvm
backup-20070318-130226-494 O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
backup-20070318-130226-577 O2 - BHO: (no name) - {B797CBF2-48B7-49D2-905C-212DD8CE721e} - D:\WINDOWS\System32\pihbspmi.dll (file missing)
backup-20070318-130226-669 O20 - Winlogon Notify: gebcd - D:\WINDOWS\System32\gebcd.dll (file missing)
backup-20070822-112908-110 O4 - HKLM\..\Run: [Advanced DHTML Enable] C:\WINDOWS\System32\cqrefhkj.exe
backup-20070822-112908-213 O4 - HKLM\..\RunServices: [Windows File Upgrader] winupgrd.exe
backup-20070822-112908-652 O4 - HKLM\..\Run: [Microsoft Internet Explorer] C:\WINDOWS\System32\iexplore.exe
backup-20070822-112908-747 O4 - HKLM\..\RunServices: [Program Access Service] xyahfzfaub.exe
backup-20070822-112908-831 O3 - Toolbar: My Global Search Bar - {37B85A29-692B-4205-9CAD-2626E4993404} - C:\Program Files\MyGlobalSearch\bar\1.bin\MGSBAR.DLL (file missing)
backup-20070822-112908-872 O4 - HKLM\..\Run: [Program Access Service] xyahfzfaub.exe
backup-20070822-112908-881 O4 - HKCU\..\RunServices: [WMI Standard Event Consumer - Scripting] C:\WINDOWS\System32\wbem\scrcons32.exe
backup-20070822-112908-924 O4 - HKLM\..\Run: [wuaurpl] C:\WINDOWS\wuaurpl.exe
backup-20070822-180140-118 O4 - HKLM\..\Run: [Windows File Upgrader] winupgrd.exe
backup-20070823-100448-569 O4 - HKLM\..\Run: [Local Security Authority Service] C:\WINDOWS\System32\Isass.exe
backup-20070831-095400-251 O2 - BHO: (no name) - {85A61E95-7CC1-4F60-A02D-6C267562222A} - C:\WINDOWS\System32\vturo.dll (file missing)

-- File Associations -----------------------------------------------------------

.cpl - cplfile - shell\cplopen\command - rundll32.exe shell32.dll,Control_RunDLL "%1",%*

-- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled ---------------------

R1 Amfilter (A4Tech Mouse Filter Driver) - c:\windows\system32\drivers\amfilter.sys <Not Verified; A4Tech Co.,Ltd.; A4Tech iWheelWorks Mouse Driver>
R1 VIAPFD - c:\windows\system32\drivers\viapfd.sys <Not Verified; VIA Technologies. Inc.; VIA PFD driver>

S3 Amusbprt (A4Tech HID-compliant Mouse Driver) - c:\windows\system32\drivers\amusbprt.sys <Not Verified; A4Tech Co.,Ltd.; A4Tech iWheelWorks Mouse Driver>
S3 catchme - c:\docume~1\pansta~1\ustawi~1\temp\catchme.sys (file missing)

-- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------

All services whitelisted.

-- Device Manager: Disabled ----------------------------------------------------

Class GUID: {4D36E97E-E325-11CE-BFC1-08002BE10318}
Description: Kontroler multimediów audio
Device ID: PCI\VEN_1039&DEV_7012&SUBSYS_0A411019&REV_A0\3&61AAA01&0&17
Manufacturer:
Name: Kontroler multimediów audio
PNP Device ID: PCI\VEN_1039&DEV_7012&SUBSYS_0A411019&REV_A0\3&61AAA01&0&17
Service:

-- Files created between 2007-07-31 and 2007-08-31 -----------------------------

2007-08-29 18:43:15 0 d-------- C:\WINDOWS\System32\appmgmt
2007-08-29 18:03:28 0 d-------- C:\angielski_tmp
2007-08-29 15:49:32 0 d--hs---- C:\found.000
2007-08-26 17:41:58 0 d-------- C:\WINDOWS\ShellNew
2007-08-23 18:06:59 0 d-------- C:\VundoFix Backups
2007-08-23 14:43:57 0 d-------- C:\Program Files\Sunbelt Software
2007-08-23 09:53:19 0 d--h----- C:\WINDOWS\$hf_mig$
2007-08-21 22:35:56 1944 --a------ C:\WINDOWS\System32\tmp.reg
2007-08-21 22:35:36 288417 --a------ C:\WINDOWS\System32\SrchSTS.exe <Not Verified; S!Ri; SrchSTS>
2007-08-21 22:35:36 53248 --a------ C:\WINDOWS\System32\Process.exe <Not Verified; http://www.beyondlogic.org; Command Line Process Utility>
2007-08-21 22:35:36 51200 --a------ C:\WINDOWS\System32\dumphive.exe
2007-08-20 15:49:48 0 d-------- C:\Program Files\MarBit
2007-08-16 19:17:20 1634304 --a------ C:\WINDOWS\System32\d3d9.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2007-08-16 19:17:18 1675264 --a------ C:\WINDOWS\System32\dxdiagn.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2007-08-14 13:54:28 0 d-------- C:\WINDOWS\RegisteredPackages
2007-08-14 13:54:23 208896 --a------ C:\WINDOWS\System32\wmpns.dll <Not Verified; Microsoft Corporation; Microsoft(R) Windows Media Player>
2007-08-14 13:54:20 225280 --a------ C:\WINDOWS\System32\wmpdxm.dll <Not Verified; Microsoft Corporation; Microsoft(R) Windows Media Player>
2007-08-14 13:54:20 106496 --a------ C:\WINDOWS\System32\wmpasf.dll <Not Verified; Microsoft Corporation; Microsoft(R) Windows Media Player>
2007-08-14 13:54:05 52224 --a------ C:\WINDOWS\System32\mspmsnsv.dll <Not Verified; Microsoft Corporation; Windows Media Device Manager>
2007-08-14 13:53:58 997888 --a------ C:\WINDOWS\System32\wmvdmoe2.dll <Not Verified; Microsoft Corporation; Microsoft® Windows Media Services>
2007-08-14 13:53:58 892416 --a------ C:\WINDOWS\System32\wmspdmoe.dll <Not Verified; Microsoft Corporation; Microsoft® Windows Media Services>
2007-08-14 13:53:57 1111040 --a------ C:\WINDOWS\System32\wmsdmoe2.dll <Not Verified; Microsoft Corporation; Microsoft® Windows Media Services>
2007-08-05 15:52:43 0 d-------- C:\Program Files\SopCast
2007-08-03 21:48:48 0 d-------- C:\Program Files\Ganymede
2007-08-03 21:46:40 4 --a------ C:\WINDOWS\System32\proc-823240916.bin
2007-08-03 20:08:05 0 d-------- C:\WINDOWS\Sun
2007-08-03 20:06:47 0 d-------- C:\Program Files\Java
2007-08-03 20:05:23 0 d-------- C:\Program Files\Common Files\Java
2007-08-02 11:51:22 0 d-------- C:\Program Files\Media Player Classic
2007-08-02 11:51:21 0 d-------- C:\Program Files\Real Alternative

-- Find3M Report ---------------------------------------------------------------

2007-08-29 11:36:59 0 d-------- C:\Documents and Settings\Pan Stawicki\Dane aplikacji\gtk-2.0
2007-08-27 16:40:12 0 d-------- C:\Program Files\Common Files
2007-08-26 17:28:42 0 d-------- C:\Documents and Settings\Pan Stawicki\Dane aplikacji\XnView
2007-08-21 22:54:06 355486 --a------ C:\WINDOWS\System32\perfh015.dat
2007-08-21 22:54:06 49492 --a------ C:\WINDOWS\System32\perfc015.dat
2007-08-18 14:09:37 0 d-------- C:\Documents and Settings\Pan Stawicki\Dane aplikacji\GanymedeNet
2007-08-16 21:58:28 0 d--h----- C:\Program Files\InstallShield Installation Information
2007-08-05 16:10:45 0 d-------- C:\Documents and Settings\Pan Stawicki\Dane aplikacji\SopCast
2007-08-03 21:46:40 1730 --a------ C:\WINDOWS\mozver.dat
2007-08-03 20:08:05 0 d-------- C:\Documents and Settings\Pan Stawicki\Dane aplikacji\Sun
2007-08-02 11:51:21 0 d-------- C:\Documents and Settings\Pan Stawicki\Dane aplikacji\Real
2007-07-29 21:18:38 0 d-------- C:\Program Files\Tlen.pl
2007-07-29 21:12:17 0 d-------- C:\Documents and Settings\Pan Stawicki\Dane aplikacji\Ahead
2007-07-29 21:11:04 0 d-------- C:\Program Files\Ahead
2007-07-29 21:10:49 0 d-------- C:\Program Files\Common Files\Ahead
2007-07-29 18:06:15 0 d-------- C:\Documents and Settings\Pan Stawicki\Dane aplikacji\Gadu-Gadu
2007-07-29 16:00:13 0 d-------- C:\Program Files\BearShare
2007-07-29 13:22:18 0 d-------- C:\Documents and Settings\Pan Stawicki\Dane aplikacji\Tlen.pl
2007-07-29 09:38:06 0 d-------- C:\Program Files\Alwil Software
2007-07-27 19:50:59 0 d-------- C:\Program Files\INTERIAPL
2007-07-27 19:38:52 0 d-------- C:\Program Files\Winamp
2007-07-27 19:31:37 0 d-------- C:\Program Files\Common Files\InstallShield
2007-07-27 17:47:47 0 d-------- C:\Documents and Settings\Pan Stawicki\Dane aplikacji\Macromedia
2007-07-27 17:23:39 0 --a------ C:\WINDOWS\nsreg.dat
2007-07-27 17:23:38 0 d-------- C:\Documents and Settings\Pan Stawicki\Dane aplikacji\Mozilla
2007-07-27 17:11:13 0 d-------- C:\Program Files\Neostrada TP
2007-07-27 17:08:34 0 d-------- C:\Program Files\Thomson
2007-07-24 15:26:58 0 d-------- C:\Program Files\A4Tech
2007-07-24 11:18:57 0 d-------- C:\Documents and Settings\Pan Stawicki\Dane aplikacji\Media Player Classic
2007-07-20 13:29:28 0 -ra------ C:\WINDOWS\System32\TFTP3244
2007-07-20 13:01:59 0 d-------- C:\Program Files\Netia
2007-07-20 12:52:02 0 d--h----- C:\Program Files\WindowsUpdate
2007-07-19 20:05:31 0 d-------- C:\Program Files\Creative
2007-07-19 18:59:09 0 d-------- C:\Program Files\Common Files\ODBC
2007-07-19 18:59:06 0 d-------- C:\Program Files\Common Files\SpeechEngines
2007-07-19 18:57:45 62 --ahs---- C:\Documents and Settings\Pan Stawicki\Dane aplikacji\desktop.ini
2007-07-19 18:12:32 0 d-------- C:\Documents and Settings\Pan Stawicki\Dane aplikacji\Identities
2007-07-19 18:08:04 0 d-------- C:\Program Files\microsoft frontpage
2007-07-19 18:07:41 0 -rahs---- C:\MSDOS.SYS
2007-07-19 18:07:41 0 -rahs---- C:\IO.SYS
2007-07-19 18:07:41 0 --a------ C:\CONFIG.SYS
2007-07-19 18:07:41 0 --a------ C:\AUTOEXEC.BAT
2007-07-19 18:06:15 0 d-------- C:\Program Files\Usługi online
2007-07-19 18:05:51 0 d-------- C:\Program Files\Movie Maker
2007-07-19 18:05:25 0 d-------- C:\Program Files\Common Files\MSSoap
2007-07-19 18:04:35 21856 --a------ C:\WINDOWS\System32\emptyregdb.dat
2007-07-19 18:04:08 0 d-------- C:\Program Files\Messenger
2007-07-19 18:04:04 0 d-------- C:\Program Files\MSN Gaming Zone
2007-07-19 18:04:01 0 d-------- C:\Program Files\Windows NT

-- Registry Dump ---------------------------------------------------------------

*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SiSUSBRG"="C:\WINDOWS\SiSUSBrg.exe" [2002-04-26 11:17]
"UpdReg"="C:\WINDOWS\Updreg.exe" [2000-05-11 01:00]
"WheelMouse"="C:\PROGRA~1\A4Tech\Mouse\Amoumain.exe" [2004-08-25 17:31]
"SpeedTouch USB Diagnostics"="C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" [2004-01-26 11:38]
"NvCplDaemon"="C:\WINDOWS\System32\NvCpl.dll" [2005-04-01 16:16]
"nwiz"="nwiz.exe" [2005-04-01 16:16 C:\WINDOWS\system32\nwiz.exe]
"NvMediaCenter"="C:\WINDOWS\System32\NvMcTray.dll" [2005-04-01 16:16]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-07-28 00:03]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 11:50]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" [2007-07-12 04:00]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\ctfmon.exe" [2002-09-29 00:00]
"Komunikator"="C:\Program Files\Tlen.pl\tlen.exe" []

C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 10:01:04]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Komunikator]
C:\Program Files\Tlen.pl\tlen.exe

-- End of Deckard's System Scanner: finished at 2007-08-31 10:09:51 ------------

EXTRA.txt

Deckard's System Scanner v20070826.66
Extra logfile - please post this as an attachment with your post.
--------------------------------------------------------------------------------

-- System Information ----------------------------------------------------------

Microsoft Windows XP Professional (build 2600) SP 1.0
Architecture: X86; Language: Polish

CPU 0: AMD Athlon(tm) XP 1700+
Percentage of Memory in Use: 74%
Physical Memory (total/avail): 255.49 MiB / 65.89 MiB
Pagefile Memory (total/avail): 618.52 MiB / 411.68 MiB
Virtual Memory (total/avail): 2047.88 MiB / 1969.21 MiB

A: is Removable (Unformatted)
C: is Fixed (NTFS) - 8.01 GiB total, 2.37 GiB free.
D: is Fixed (NTFS) - 29.25 GiB total, 19.66 GiB free.
E: is CDROM (No Media)

\\.\PHYSICALDRIVE0 - ST340016A - 37.27 GiB - 2 partitions
\PARTITION0 (bootable) - Instalowalny system plików - 8.01 GiB - C:
\PARTITION1 - Instalowalny system plików - 29.25 GiB - D:

-- Security Center -------------------------------------------------------------

AUOptions is disabled.
AUState says computer has updates disabled.

-- Environment Variables -------------------------------------------------------

ALLUSERSPROFILE=C:\Documents and Settings\All Users
APPDATA=C:\Documents and Settings\Pan Stawicki\Dane aplikacji
CLIENTNAME=Console
CommonProgramFiles=C:\Program Files\Common Files
COMPUTERNAME=PANSTAWICKI
ComSpec=C:\WINDOWS\system32\cmd.exe
HOMEDRIVE=C:
HOMEPATH=\Documents and Settings\Pan Stawicki
LANG=pl
LOGONSERVER=\\PANSTAWICKI
NUMBER_OF_PROCESSORS=1
OS=Windows_NT
Path=C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\system32\wbem;D:\GTK\2.0\bin;C:\Program Files\Common Files\GTK\2.0\bin;C:\Program Files\Mozilla Firefox
PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
PROCESSOR_ARCHITECTURE=x86
PROCESSOR_IDENTIFIER=x86 Family 6 Model 6 Stepping 2, AuthenticAMD
PROCESSOR_LEVEL=6
PROCESSOR_REVISION=0602
ProgramFiles=C:\Program Files
PROMPT=$P$G
SESSIONNAME=Console
SystemDrive=C:
SystemRoot=C:\WINDOWS
TEMP=C:\DOCUME~1\PANSTA~1\USTAWI~1\Temp
TMP=C:\DOCUME~1\PANSTA~1\USTAWI~1\Temp
USERDOMAIN=PANSTAWICKI
USERNAME=Pan Stawicki
USERPROFILE=C:\Documents and Settings\Pan Stawicki
windir=C:\WINDOWS

-- User Profiles ---------------------------------------------------------------

Pan Stawicki (admin)

-- Add/Remove Programs ---------------------------------------------------------

--> C:\Program Files\Creative\SBLive\Program\Upddrv2k.EXE
--> C:\WINDOWS\IsUninst.exe -f"C:\Program Files\Creative\Uninstall\Installer.isu"
--> rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf
A4Tech iWheelWorks 7.64 --> C:\WINDOWS\System32\Amuninst.exe
Aktualizacja dla systemu Windows XP (KB894391) --> "C:\WINDOWS\$NtUninstallKB894391$\spuninst\spuninst.exe"
ALLPlayer V3.X --> "C:\Program Files\MarBit\ALLPlayer\unins000.exe"
Archiwizator WinRAR --> C:\Program Files\WinRAR\uninstall.exe
avast! Antivirus --> rundll32 C:\PROGRA~1\ALWILS~1\Avast4\Setup\setiface.dll,RunSetup
BearShare --> C:\PROGRA~1\BEARSH~1\UNWISE.EXE C:\PROGRA~1\BEARSH~1\INSTALL.LOG
Gadu-Gadu 7.7 --> d:\Gadu-Gadu\Setup.exe
GameDesire-Pool & Snooker --> C:\Program Files\Ganymede\uninstaller.exe
GTK+ 2.10.13 runtime environment --> "D:\GTK\2.0\setup\unins000.exe"
HijackThis 1.99.1 --> D:\Moje pliki\Jacek\Pulpit\hijackthis_199\HijackThis.exe /uninstall
Java(TM) 6 Update 2 --> MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160020}
K-Lite Codec Pack 3.01 Full --> "D:\K-Lite Codec Pack\unins000.exe"
Max Payne 2 --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{EFE1AB94-5466-4B6E-BE31-FF4C115FD25D}\Setup.exe" -l0x9
Microsoft Office XP Professional z programem FrontPage --> MsiExec.exe /I{90280415-6000-11D3-8CFE-0050048383C9}
Mozilla Firefox (2.0.0.6) --> C:\Program Files\Mozilla Firefox\uninstall\helper.exe
My Global Search Bar --> rundll32 C:\PROGRA~1\MYGLOB~1\bar\1.bin\mgsBar.dll,O
Nero OEM --> C:\Program Files\Ahead\nero\uninstall\UNNERO.exe /UNINSTALL
NETIANET --> C:\Program Files\Netia\Net\netianet.exe -uninstall
NVIDIA Drivers --> C:\WINDOWS\System32\nvudisp.exe UninstallGUI
Panda ActiveScan --> C:\WINDOWS\System32\ASUninst.exe Panda ActiveScan
Real Alternative 1.52 --> "C:\Program Files\Real Alternative\unins000.exe"
SopCast 1.1.1 --> C:\Program Files\SopCast\uninst.exe
Sound Blaster Live! --> C:\Program Files\Creative\Uninstall\CTUNINST.EXE /U:UNINST1.INI
SpeedTouch USB Software --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{D41FAAA9-8048-4906-86B2-9AADEA1FA0B7}\setup.exe" /l0009 -Control_Panel
The GIMP 2.2.17 --> "D:\GIMP-2.0\unins000.exe"
TVAnts 1.0 --> D:\TVAnts\UNWISE.EXE D:\TVAnts\INSTALL.LOG
Winamp (remove only) --> "D:\Winamp\UninstWA.exe"

-- Application Event Log -------------------------------------------------------

Event Record #/Type146 / Error
Event Submitted/Written: 08/30/2007 00:35:04 PM
Event ID/Source: 1002 / Application Hang
Event Description:
Aplikacja zawieszająca ALLPlayer.exe, wersja 3.0.5.0, moduł zawieszenia hungapp, wersja 0.0.0.0, adres zawieszenia 0x00000000.

Event Record #/Type142 / Error
Event Submitted/Written: 08/29/2007 06:35:38 PM
Event ID/Source: 1000 / Application Error
Event Description:
Aplikacja powodująca błąd explorer.exe, wersja 6.0.2800.1106, moduł powodujący błąd shell32.dll, wersja 6.0.2800.1106, adres błędu 0x0005205d.

Event Record #/Type141 / Error
Event Submitted/Written: 08/29/2007 06:35:32 PM
Event ID/Source: 1000 / Application Error
Event Description:
Aplikacja powodująca błąd explorer.exe, wersja 6.0.2800.1106, moduł powodujący błąd shell32.dll, wersja 6.0.2800.1106, adres błędu 0x0005205d.

Event Record #/Type140 / Error
Event Submitted/Written: 08/29/2007 06:35:09 PM
Event ID/Source: 1000 / Application Error
Event Description:
Aplikacja powodująca błąd explorer.exe, wersja 6.0.2800.1106, moduł powodujący błąd shell32.dll, wersja 6.0.2800.1106, adres błędu 0x0005205d.

Event Record #/Type138 / Error
Event Submitted/Written: 08/29/2007 06:34:54 PM
Event ID/Source: 1000 / Application Error
Event Description:
Aplikacja powodująca błąd explorer.exe, wersja 6.0.2800.1106, moduł powodujący błąd shell32.dll, wersja 6.0.2800.1106, adres błędu 0x000525ab.

-- Security Event Log ----------------------------------------------------------

No Errors/Warnings found.

-- System Event Log ------------------------------------------------------------

Event Record #/Type6530 / Error
Event Submitted/Written: 08/31/2007 09:39:50 AM
Event ID/Source: 7023 / Service Control Manager
Event Description:
Usługa Schedule zakończyła działanie; wystąpił następujący błąd:
%%87

Event Record #/Type6529 / Error
Event Submitted/Written: 08/31/2007 09:39:50 AM
Event ID/Source: 7001 / Service Control Manager
Event Description:
Usługa Pomoc TCP/IP NetBIOS zależy od usługi NetBios przez TCP/IP, której nie można uruchomić z powodu następującego błędu:
%%1058

Event Record #/Type6528 / Error
Event Submitted/Written: 08/31/2007 09:39:50 AM
Event ID/Source: 7001 / Service Control Manager
Event Description:
Usługa Klient DHCP zależy od usługi NetBios przez TCP/IP, której nie można uruchomić z powodu następującego błędu:
%%1058

Event Record #/Type6515 / Error
Event Submitted/Written: 08/31/2007 08:38:14 AM
Event ID/Source: 7023 / Service Control Manager
Event Description:
Usługa Schedule zakończyła działanie; wystąpił następujący błąd:
%%87

Event Record #/Type6514 / Error
Event Submitted/Written: 08/31/2007 08:38:14 AM
Event ID/Source: 7001 / Service Control Manager
Event Description:
Usługa Pomoc TCP/IP NetBIOS zależy od usługi NetBios przez TCP/IP, której nie można uruchomić z powodu następującego błędu:
%%1058

-- End of Deckard's System Scanner: finished at 2007-08-31 10:09:51 ------------

**Posty:** 18165 · przez **wojtas** 31 Sie 2007, 12:28

skasuj:

C:\VundoFix Backups

i bedzie ok

Autor postu otrzymał pochwałę

**Posty:** 127 · przez **bluejack** 01 Wrz 2007, 16:10

Dziekuje pieknie, wszystko smiga, procz ggadugadu

**Posty:** 18165 · przez **wojtas** 01 Wrz 2007, 17:32

bluejack napisał(a):procz ggadugadu

moze przeinstaluj gg

zużycie procesu "system" 100%

zużycie procesu "system" 100%

Kto jest na forum