zwieszający się system

**Posty:** 264 · przez **lamer** 17 Cze 2007, 23:52

Witam!Problem polega na tym że gdy przeglądam neta to nagle explorer(system) zawiesza się i muszę go wyłączyć (menadżer zadan) i włączyć ponownie.Oto logi:
:arrow:

HijackThis

Logfile of HijackThis v1.99.1
Scan saved at 23:25:17, on 2007-06-17
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Eset\nod32krn.exe
C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
C:\WINDOWS\explorer.exe
C:\Program Files\GG Lite\GG Lite.exe
C:\Program Files\K-Meleon\k-meleon.exe
C:\Documents and Settings\DiM\Pulpit\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.pl/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [j1231538] rundll32 C:\WINDOWS\system32\j1231538.dll sook
O4 - HKLM\..\Run: [GPLv3] rundll32.exe "C:\WINDOWS\system32\hpluqbse.dll",realset
O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\Microsoft Office\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\Microsoft Office\OFFICE11\REFIEBAR.DLL
O17 - HKLM\System\CCS\Services\Tcpip\..\{766785A5-0D01-4E4B-9EB5-C65D62160EBB}: NameServer = 194.204.152.34 217.98.63.164
O23 - Service: Client IP-IPX - Unknown owner - C:\WINDOWS\system32\svchosts.exe" -e mc-110-12-0001291 (file missing)
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe

SilentRunners

"Silent Runners.vbs", revision R50, http://www.silentrunners.org/
Operating System: Windows XP SP2
Output limited to non-default values, except where indicated by "{++}"

Startup items buried in registry:
---------------------------------

HKLM\Software\Microsoft\Windows\CurrentVersion\Run\ {++}
"nod32kui" = ""C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE" ["Eset "]
"j1231538" = "rundll32 C:\WINDOWS\system32\j1231538.dll sook" [MS]
"GPLv3" = "rundll32.exe "C:\WINDOWS\system32\hpluqbse.dll",realset" [MS]

HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\
{3E71DC86-4A5C-4C71-A185-EBE9AC2EB607}\(Default) = (no title provided)
-> {HKLM...CLSID} = (no title provided)
\InProcServer32\(Default) = "C:\WINDOWS\system32\ddcyywx.dll" [null data]
{BDFA9571-C8A8-4A33-816E-C8C3CE2381D3}\(Default) = (no title provided)
-> {HKLM...CLSID} = (no title provided)
\InProcServer32\(Default) = "C:\WINDOWS\system32\opnol.dll" [null data]
{CD3447D4-CA39-4377-8084-30E86331D74C}\(Default) = (no title provided)
-> {HKLM...CLSID} = (no title provided)
\InProcServer32\(Default) = "C:\WINDOWS\system32\nufwtvga.dll" [file not found]

HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\
"{42071714-76d4-11d1-8b24-00a0c9068ff3}" = "Rozszerzenie CPL kadrowania wyświetlania"
-> {HKLM...CLSID} = "Rozszerzenie CPL kadrowania wyświetlania"
\InProcServer32\(Default) = "deskpan.dll" [file not found]
"{88895560-9AA2-1069-930E-00AA0030EBC8}" = "Rozszerzenie ikony HyperTerminalu"
-> {HKLM...CLSID} = "HyperTerminal Icon Ext"
\InProcServer32\(Default) = "C:\WINDOWS\system32\hticons.dll" ["Hilgraeve, Inc."]

[/quote]

**Posty:** 18165 · przez **wojtas** 17 Cze 2007, 23:59

silent jest uciety daj po usuwaniu cale logi

zastosuj:

smitfraudfix z opcji 2:

http://siri.urz.free.fr/Fix/SmitfraudFix_En.php

oraz te skanery po kilka razy w awaryjnym

VundoFix
http://www.atribune.org/ccount/click.php?id=4

VirtumundoBeGone
http://secured2k.home.comcast.net/tools/VirtumundoBeGone.exe

FixVundo
http://securityresponse.symantec.com/avcenter/FixVundo.exe

**Posty:** 264 · przez **lamer** 18 Cze 2007, 14:10

racja uciąłem oto całość:

"Silent Runners.vbs", revision R50, http://www.silentrunners.org/
Operating System: Windows XP SP2
Output limited to non-default values, except where indicated by "{++}"

Startup items buried in registry:
---------------------------------

HKLM\Software\Microsoft\Windows\CurrentVersion\Run\ {++}
"nod32kui" = ""C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE" ["Eset "]
"j1231538" = "rundll32 C:\WINDOWS\system32\j1231538.dll sook" [MS]
"GPLv3" = "rundll32.exe "C:\WINDOWS\system32\hpluqbse.dll",realset" [MS]

HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\
{3E71DC86-4A5C-4C71-A185-EBE9AC2EB607}\(Default) = (no title provided)
-> {HKLM...CLSID} = (no title provided)
\InProcServer32\(Default) = "C:\WINDOWS\system32\ddcyywx.dll" [null data]
{CD3447D4-CA39-4377-8084-30E86331D74C}\(Default) = (no title provided)
-> {HKLM...CLSID} = (no title provided)
\InProcServer32\(Default) = "C:\WINDOWS\system32\nufwtvga.dll" [file not found]
{DAB15267-901D-40A2-AF97-224E67E1B68A}\(Default) = (no title provided)
-> {HKLM...CLSID} = (no title provided)
\InProcServer32\(Default) = "C:\WINDOWS\system32\opnol.dll" [null data]

HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\
"{42071714-76d4-11d1-8b24-00a0c9068ff3}" = "Rozszerzenie CPL kadrowania wyświetlania"
-> {HKLM...CLSID} = "Rozszerzenie CPL kadrowania wyświetlania"
\InProcServer32\(Default) = "deskpan.dll" [file not found]
"{88895560-9AA2-1069-930E-00AA0030EBC8}" = "Rozszerzenie ikony HyperTerminalu"
-> {HKLM...CLSID} = "HyperTerminal Icon Ext"
\InProcServer32\(Default) = "C:\WINDOWS\system32\hticons.dll" ["Hilgraeve, Inc."]
"{A70C977A-BF00-412C-90B7-034C51DA2439}" = "NvCpl DesktopContext Class"
-> {HKLM...CLSID} = "DesktopContext Class"
\InProcServer32\(Default) = "C:\WINDOWS\system32\nvcpl.dll" ["NVIDIA Corporation"]
"{FFB699E0-306A-11d3-8BD1-00104B6F7516}" = "Play on my TV helper"
-> {HKLM...CLSID} = "NVIDIA CPL Extension"
\InProcServer32\(Default) = "C:\WINDOWS\system32\nvcpl.dll" ["NVIDIA Corporation"]
"{1CDB2949-8F65-4355-8456-263E7C208A5D}" = "Desktop Explorer"
-> {HKLM...CLSID} = "Desktop Explorer"
\InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"]
"{1E9B04FB-F9E5-4718-997B-B8DA88302A47}" = "Desktop Explorer Menu"
-> {HKLM...CLSID} = (no title provided)
\InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"]
"{1E9B04FB-F9E5-4718-997B-B8DA88302A48}" = "nView Desktop Context Menu"
-> {HKLM...CLSID} = "nView Desktop Context Menu"
\InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"]
"{B089FE88-FB52-11D3-BDF1-0050DA34150D}" = "NOD32 Context Menu Shell Extension"
-> {HKLM...CLSID} = "NOD32 Context Menu Shell Extension"
\InProcServer32\(Default) = "C:\Program Files\Eset\nodshex.dll" [null data]
"{B41DB860-8EE4-11D2-9906-E49FADC173CA}" = "WinRAR shell extension"
-> {HKLM...CLSID} = "WinRAR"
\InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]
"{EE75AC21-B24F-11d3-BA80-00C0CA16AA37}" = "Siemens Device"
-> {HKLM...CLSID} = "Siemens Device"
\InProcServer32\(Default) = "C:\Program Files\Mobile Phone Manager\bin\PhoneExplorer.dll" ["BenQ Mobile GmbH & Co. OHG"]
"{EE75AC22-B24F-11d3-BA80-00C0CA16AA37}" = "Siemens Device ContextMenuHandler"
-> {HKLM...CLSID} = "Siemens Device ContextMenuHandler"
\InProcServer32\(Default) = "C:\Program Files\Mobile Phone Manager\bin\PhoneExplorer.dll" ["BenQ Mobile GmbH & Co. OHG"]
"{EE75AC23-B24F-11d3-BA80-00C0CA16AA37}" = "Siemens Device PropertySheetHandlers"
-> {HKLM...CLSID} = "Siemens Device PropertySheetHandler"
\InProcServer32\(Default) = "C:\Program Files\Mobile Phone Manager\bin\PhoneExplorer.dll" ["BenQ Mobile GmbH & Co. OHG"]
"{42042206-2D85-11D3-8CFF-005004838597}" = "Microsoft Office HTML Icon Handler"
-> {HKLM...CLSID} = (no title provided)
\InProcServer32\(Default) = "C:\Program Files\Microsoft Office\OFFICE11\msohev.dll" [MS]

HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\
<<!>> "{3E71DC86-4A5C-4C71-A185-EBE9AC2EB607}" = "*n" (unwritable string)
-> {HKLM...CLSID} = (no title provided)
\InProcServer32\(Default) = "C:\WINDOWS\system32\ddcyywx.dll" [null data]

HKLM\System\CurrentControlSet\Control\Session Manager\
<<!>> "BootExecute" = "autocheck autochk *"| [file not found]| [file not found]

HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\
<<!>> ddcyywx\DLLName = "ddcyywx.dll" [null data]
<<!>> opnol\DLLName = "C:\WINDOWS\system32\opnol.dll" [null data]

HKLM\Software\Classes\PROTOCOLS\Filter\
<<!>> text/xml\CLSID = "{807553E5-5146-11D5-A672-00B0D022E945}"
-> {HKLM...CLSID} = (no title provided)
\InProcServer32\(Default) = "C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL" [MS]

HKLM\Software\Classes\*\shellex\ContextMenuHandlers\
NOD32 Context Menu Shell Extension\(Default) = "{B089FE88-FB52-11D3-BDF1-0050DA34150D}"
-> {HKLM...CLSID} = "NOD32 Context Menu Shell Extension"
\InProcServer32\(Default) = "C:\Program Files\Eset\nodshex.dll" [null data]
WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
-> {HKLM...CLSID} = "WinRAR"
\InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]

HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\
WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
-> {HKLM...CLSID} = "WinRAR"
\InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]

HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\
NOD32 Context Menu Shell Extension\(Default) = "{B089FE88-FB52-11D3-BDF1-0050DA34150D}"
-> {HKLM...CLSID} = "NOD32 Context Menu Shell Extension"
\InProcServer32\(Default) = "C:\Program Files\Eset\nodshex.dll" [null data]
WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
-> {HKLM...CLSID} = "WinRAR"
\InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]

Group Policies {GPedit.msc branch and setting}:
-----------------------------------------------

Note: detected settings may not have any effect.

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\

"NoCDBurning" = (REG_DWORD) hex:0x00000001
{unrecognized setting}

"NoRemoteRecursiveEvents" = (REG_DWORD) hex:0x00000001
{unrecognized setting}

"NoSMBalloonTip" = (REG_DWORD) hex:0x00000001
{unrecognized setting}

"NoSaveSettings" = (REG_DWORD) hex:0x00000000
{User Configuration|Administrative Templates|Desktop|
Don't save settings at exit}

"NoRecentDocsHistory" = (REG_DWORD) hex:0x00000001
{unrecognized setting}

"CDRAutoRun" = (REG_DWORD) hex:0x00000000
{unrecognized setting}

"NoLowDiskSpaceChecks" = (REG_DWORD) hex:0x00000001
{unrecognized setting}

"MemCheckBoxInRunDlg" = (REG_DWORD) hex:0x00000000
{unrecognized setting}

"NoClose" = (REG_DWORD) hex:0x00000000
{unrecognized setting}

"NoAutoTrayNotify" = (REG_DWORD) hex:0x00000000
{unrecognized setting}

"NoResolveTrack" = (REG_DWORD) hex:0x00000000
{unrecognized setting}

"NoResolveSearch" = (REG_DWORD) hex:0x00000001
{unrecognized setting}

"LinkResolveIgnoreLinkInfo" = (REG_DWORD) hex:0x00000001
{unrecognized setting}

"NoStartBanner" = (REG_BINARY) hex:01 00 00 00
{Remove "Click here to begin" from Start button}

"NoWelcomeScreen" = (REG_DWORD) hex:0x00000001
{unrecognized setting}

"NoRecentDocsNetHood" = (REG_DWORD) hex:0x00000001
{unrecognized setting}

"NoDesktopCleanupWizard" = (REG_DWORD) hex:0x00000001
{unrecognized setting}

"NoSharedDocuments" = (REG_DWORD) hex:0x00000001
{User Configuration|Administrative Templates|Windows Components|Windows Explorer|
Remove Shared Documents from My Computer}

"NoThemesTab" = (REG_DWORD) hex:0x00000000
{unrecognized setting}

HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\

"NoAutoTrayNotify" = (REG_DWORD) hex:0x00000001
{unrecognized setting}

"NoCDBurning" = (REG_DWORD) hex:0x00000001
{unrecognized setting}

"MemCheckBoxInRunDlg" = (REG_DWORD) hex:0x00000000
{unrecognized setting}

"NoRemoteRecursiveEvents" = (REG_DWORD) hex:0x00000001
{unrecognized setting}

"NoStrCmpLogical" = (REG_DWORD) hex:0x00000001
{unrecognized setting}

"NoClose" = (REG_DWORD) hex:0x00000000
{unrecognized setting}

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System\

"NoDispAppearancePage" = (REG_DWORD) hex:0x00000000
{unrecognized setting}

"NoColorChoice" = (REG_DWORD) hex:0x00000000
{unrecognized setting}

"NoDispBackgroundPage" = (REG_DWORD) hex:0x00000000
{User Configuration|Administrative Templates|Control Panel|Display|
Hide Desktop tab}

"NoDispCPL" = (REG_DWORD) hex:0x00000000
{User Configuration|Administrative Templates|Control Panel|Display|
Remove Display in Control Panel}

"NoDispSettingsPage" = (REG_DWORD) hex:0x00000000
{unrecognized setting}

"NoDispScrSavPage" = (REG_DWORD) hex:0x00000000
{unrecognized setting}

"NoVisualStyleChoice" = (REG_DWORD) hex:0x00000000
{unrecognized setting}

"NoSizeChoice" = (REG_DWORD) hex:0x00000000
{unrecognized setting}

HKLM\Software\Policies\Microsoft\Internet Explorer\Infodelivery\Restrictions\

"NoUpdateCheck" = (REG_DWORD) hex:0x00000001
{unrecognized setting}

HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\

"shutdownwithoutlogon" = (REG_DWORD) hex:0x00000001
{Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options|
Shutdown: Allow system to be shut down without having to log on}

"undockwithoutlogon" = (REG_DWORD) hex:0x00000001
{Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options|
Devices: Allow undock without having to log on}

"RunStartupScriptSync" = (REG_DWORD) hex:0x00000001
{unrecognized setting}

"SynchronousMachineGroupPolicy" = (REG_DWORD) hex:0x00000001
{unrecognized setting}

"SynchronousUserGroupPolicy" = (REG_DWORD) hex:0x00000001
{unrecognized setting}

Active Desktop and Wallpaper:
-----------------------------

Active Desktop may be disabled at this entry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState

Displayed if Active Desktop enabled and wallpaper not set by Group Policy:
HKCU\Software\Microsoft\Internet Explorer\Desktop\General\
"Wallpaper" = "C:\WINDOWS\web\wallpaper\Idylla.bmp"

Displayed if Active Desktop disabled and wallpaper not set by Group Policy:
HKCU\Control Panel\Desktop\
"Wallpaper" = "C:\WINDOWS\web\wallpaper\Idylla.bmp"

Enabled Screen Saver:
---------------------

HKCU\Control Panel\Desktop\
"SCRNSAVE.EXE" = "C:\WINDOWS\System32\logon.scr" [MS]

Startup items in "DiM" & "All Users" startup folders:
-----------------------------------------------------

C:\Documents and Settings\All Users\Menu Start\Programy\Autostart
"DSLMON" -> shortcut to: "C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe" [empty string]

Winsock2 Service Provider DLLs:
-------------------------------

Namespace Service Providers

HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++}
000000000001\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]
000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS]
000000000003\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]

Transport Service Providers

HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++}
0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range:
C:\WINDOWS\system32\imon.dll ["Eset "], 01 - 05, 11
%SystemRoot%\system32\mswsock.dll [MS], 06 - 08, 12 - 21
%SystemRoot%\system32\rsvpsp.dll [MS], 09 - 10

Toolbars, Explorer Bars, Extensions:
------------------------------------

Explorer Bars

HKLM\Software\Microsoft\Internet Explorer\Explorer Bars\

HKLM\Software\Classes\CLSID\{FF059E31-CC5A-4E2E-BF3B-96E929D65503}\(Default) = "&Badanie"
Implemented Categories\{00021493-0000-0000-C000-000000000046}\ [vertical bar]
InProcServer32\(Default) = "C:\PROGRA~1\Microsoft Office\OFFICE11\REFIEBAR.DLL" [MS]

Extensions (Tools menu items, main toolbar menu buttons)

HKLM\Software\Microsoft\Internet Explorer\Extensions\
{92780B25-18CC-41C8-B9BE-3C9C571A8263}\
"ButtonText" = "Badanie"

Running Services (Display Name, Service Name, Path {Service DLL}):
------------------------------------------------------------------

LightScribeService Direct Disc Labeling Service, LightScribeService, ""C:\Program Files\Common Files\LightScribe\LSSrvc.exe"" ["Hewlett-Packard Company"]
NOD32 Kernel Service, NOD32krn, ""C:\Program Files\Eset\nod32krn.exe"" ["Eset "]

Print Monitors:
---------------

HKLM\System\CurrentControlSet\Control\Print\Monitors\
Microsoft Document Imaging Writer Monitor\Driver = "mdimon.dll" [MS]

----------
<<!>>: Suspicious data at a malware launch point.

+ This report excludes default entries except where indicated.
+ To see *everywhere* the script checks and *everything* it finds,
launch it from a command prompt or a shortcut with the -all parameter.
+ To search all directories of local fixed drives for DESKTOP.INI
DLL launch points, use the -supp parameter or answer "No" at the
first message box and "Yes" at the second message box.
---------- (total run time: 177 seconds, including 18 seconds for message boxes)

zaraz wrzuce nastepne

[ Dodano: Dzisiaj o 13:22 ]
...a nie już nic nie wrzuce tylko przeskanuje:D

**Posty:** 18165 · przez **wojtas** 18 Cze 2007, 16:57

po zastosowaniu tych skanerow co podalem wyzej daj 2 nowe logi

**Posty:** 264 · przez **lamer** 19 Cze 2007, 21:14

oto logi:

Logfile of HijackThis v1.99.1
Scan saved at 13:31:50, on 2007-06-19
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Eset\nod32krn.exe
C:\Program Files\Eset\nod32kui.exe
C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
C:\Documents and Settings\DiM\Pulpit\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [j1231538] rundll32 C:\WINDOWS\system32\j1231538.dll sook
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [GPLv3] rundll32.exe "C:\WINDOWS\system32\xsubiwsb.dll",realset
O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\Microsoft Office\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\Microsoft Office\OFFICE11\REFIEBAR.DLL
O23 - Service: Client IP-IPX - Unknown owner - C:\WINDOWS\system32\svchosts.exe" -e mc-110-12-0001291 (file missing)
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
O23 - Service: VundoFix Service (VundoFixSvc) - Atribune.org - C:\WINDOWS\SYSTEM32\VundoFixSVC.exe

i

"Silent Runners.vbs", revision R50, http://www.silentrunners.org/
Operating System: Windows XP SP2
Output limited to non-default values, except where indicated by "{++}"

Startup items buried in registry:
---------------------------------

HKLM\Software\Microsoft\Windows\CurrentVersion\Run\ {++}
"nod32kui" = ""C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE" ["Eset "]
"j1231538" = "rundll32 C:\WINDOWS\system32\j1231538.dll sook" [MS]
"KernelFaultCheck" = "C:\WINDOWS\system32\dumprep 0 -k"
"GPLv3" = "rundll32.exe "C:\WINDOWS\system32\xsubiwsb.dll",realset" [MS]

HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\
{3E71DC86-4A5C-4C71-A185-EBE9AC2EB607}\(Default) = (no title provided)
-> {HKLM...CLSID} = "MSEvents Object"
\InProcServer32\(Default) = "C:\WINDOWS\system32\ddcyywx.dll" [null data]
{7F5224FA-FD03-4AAD-A7FF-AF64498A899E}\(Default) = (no title provided)
-> {HKLM...CLSID} = (no title provided)
\InProcServer32\(Default) = "C:\WINDOWS\system32\opnol.dll" [null data]
{CD3447D4-CA39-4377-8084-30E86331D74C}\(Default) = (no title provided)
-> {HKLM...CLSID} = (no title provided)
\InProcServer32\(Default) = "C:\WINDOWS\system32\nufwtvga.dll" [file not found]

HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\
"{42071714-76d4-11d1-8b24-00a0c9068ff3}" = "Rozszerzenie CPL kadrowania wyświetlania"
-> {HKLM...CLSID} = "Rozszerzenie CPL kadrowania wyświetlania"
\InProcServer32\(Default) = "deskpan.dll" [file not found]
"{88895560-9AA2-1069-930E-00AA0030EBC8}" = "Rozszerzenie ikony HyperTerminalu"
-> {HKLM...CLSID} = "HyperTerminal Icon Ext"
\InProcServer32\(Default) = "C:\WINDOWS\system32\hticons.dll" ["Hilgraeve, Inc."]
"{A70C977A-BF00-412C-90B7-034C51DA2439}" = "NvCpl DesktopContext Class"
-> {HKLM...CLSID} = "DesktopContext Class"
\InProcServer32\(Default) = "C:\WINDOWS\system32\nvcpl.dll" ["NVIDIA Corporation"]
"{FFB699E0-306A-11d3-8BD1-00104B6F7516}" = "Play on my TV helper"
-> {HKLM...CLSID} = "NVIDIA CPL Extension"
\InProcServer32\(Default) = "C:\WINDOWS\system32\nvcpl.dll" ["NVIDIA Corporation"]
"{1CDB2949-8F65-4355-8456-263E7C208A5D}" = "Desktop Explorer"
-> {HKLM...CLSID} = "Desktop Explorer"
\InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"]
"{1E9B04FB-F9E5-4718-997B-B8DA88302A47}" = "Desktop Explorer Menu"
-> {HKLM...CLSID} = (no title provided)
\InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"]
"{1E9B04FB-F9E5-4718-997B-B8DA88302A48}" = "nView Desktop Context Menu"
-> {HKLM...CLSID} = "nView Desktop Context Menu"
\InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"]
"{B089FE88-FB52-11D3-BDF1-0050DA34150D}" = "NOD32 Context Menu Shell Extension"
-> {HKLM...CLSID} = "NOD32 Context Menu Shell Extension"
\InProcServer32\(Default) = "C:\Program Files\Eset\nodshex.dll" [null data]
"{B41DB860-8EE4-11D2-9906-E49FADC173CA}" = "WinRAR shell extension"
-> {HKLM...CLSID} = "WinRAR"
\InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]
"{EE75AC21-B24F-11d3-BA80-00C0CA16AA37}" = "Siemens Device"
-> {HKLM...CLSID} = "Siemens Device"
\InProcServer32\(Default) = "C:\Program Files\Mobile Phone Manager\bin\PhoneExplorer.dll" ["BenQ Mobile GmbH & Co. OHG"]
"{EE75AC22-B24F-11d3-BA80-00C0CA16AA37}" = "Siemens Device ContextMenuHandler"
-> {HKLM...CLSID} = "Siemens Device ContextMenuHandler"
\InProcServer32\(Default) = "C:\Program Files\Mobile Phone Manager\bin\PhoneExplorer.dll" ["BenQ Mobile GmbH & Co. OHG"]
"{EE75AC23-B24F-11d3-BA80-00C0CA16AA37}" = "Siemens Device PropertySheetHandlers"
-> {HKLM...CLSID} = "Siemens Device PropertySheetHandler"
\InProcServer32\(Default) = "C:\Program Files\Mobile Phone Manager\bin\PhoneExplorer.dll" ["BenQ Mobile GmbH & Co. OHG"]
"{42042206-2D85-11D3-8CFF-005004838597}" = "Microsoft Office HTML Icon Handler"
-> {HKLM...CLSID} = (no title provided)
\InProcServer32\(Default) = "C:\Program Files\Microsoft Office\OFFICE11\msohev.dll" [MS]

HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\
<<!>> "{3E71DC86-4A5C-4C71-A185-EBE9AC2EB607}" = "*g" (unwritable string)
-> {HKLM...CLSID} = "MSEvents Object"
\InProcServer32\(Default) = "C:\WINDOWS\system32\ddcyywx.dll" [null data]

HKLM\System\CurrentControlSet\Control\Session Manager\
<<!>> "BootExecute" = "autocheck autochk *"| [file not found]| [file not found]

HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\
<<!>> ddcyywx\DLLName = "ddcyywx.dll" [null data]
<<!>> opnol\DLLName = "C:\WINDOWS\system32\opnol.dll" [null data]

HKLM\Software\Classes\PROTOCOLS\Filter\
<<!>> text/xml\CLSID = "{807553E5-5146-11D5-A672-00B0D022E945}"
-> {HKLM...CLSID} = (no title provided)
\InProcServer32\(Default) = "C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL" [MS]

HKLM\Software\Classes\*\shellex\ContextMenuHandlers\
NOD32 Context Menu Shell Extension\(Default) = "{B089FE88-FB52-11D3-BDF1-0050DA34150D}"
-> {HKLM...CLSID} = "NOD32 Context Menu Shell Extension"
\InProcServer32\(Default) = "C:\Program Files\Eset\nodshex.dll" [null data]
WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
-> {HKLM...CLSID} = "WinRAR"
\InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]

HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\
WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
-> {HKLM...CLSID} = "WinRAR"
\InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]

HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\
NOD32 Context Menu Shell Extension\(Default) = "{B089FE88-FB52-11D3-BDF1-0050DA34150D}"
-> {HKLM...CLSID} = "NOD32 Context Menu Shell Extension"
\InProcServer32\(Default) = "C:\Program Files\Eset\nodshex.dll" [null data]
WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
-> {HKLM...CLSID} = "WinRAR"
\InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]

Group Policies {GPedit.msc branch and setting}:
-----------------------------------------------

Note: detected settings may not have any effect.

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\

"NoCDBurning" = (REG_DWORD) hex:0x00000001
{unrecognized setting}

"NoRemoteRecursiveEvents" = (REG_DWORD) hex:0x00000001
{unrecognized setting}

"NoSMBalloonTip" = (REG_DWORD) hex:0x00000001
{unrecognized setting}

"NoRecentDocsHistory" = (REG_DWORD) hex:0x00000001
{unrecognized setting}

"CDRAutoRun" = (REG_DWORD) hex:0x00000000
{unrecognized setting}

"NoLowDiskSpaceChecks" = (REG_DWORD) hex:0x00000001
{unrecognized setting}

"MemCheckBoxInRunDlg" = (REG_DWORD) hex:0x00000000
{unrecognized setting}

"NoClose" = (REG_DWORD) hex:0x00000000
{unrecognized setting}

"NoAutoTrayNotify" = (REG_DWORD) hex:0x00000000
{unrecognized setting}

"NoResolveTrack" = (REG_DWORD) hex:0x00000000
{unrecognized setting}

"NoResolveSearch" = (REG_DWORD) hex:0x00000001
{unrecognized setting}

"LinkResolveIgnoreLinkInfo" = (REG_DWORD) hex:0x00000001
{unrecognized setting}

"NoStartBanner" = (REG_BINARY) hex:01 00 00 00
{Remove "Click here to begin" from Start button}

"NoWelcomeScreen" = (REG_DWORD) hex:0x00000001
{unrecognized setting}

"NoRecentDocsNetHood" = (REG_DWORD) hex:0x00000001
{unrecognized setting}

"NoDesktopCleanupWizard" = (REG_DWORD) hex:0x00000001
{unrecognized setting}

"NoSharedDocuments" = (REG_DWORD) hex:0x00000001
{User Configuration|Administrative Templates|Windows Components|Windows Explorer|
Remove Shared Documents from My Computer}

HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\

"NoAutoTrayNotify" = (REG_DWORD) hex:0x00000001
{unrecognized setting}

"NoCDBurning" = (REG_DWORD) hex:0x00000001
{unrecognized setting}

"MemCheckBoxInRunDlg" = (REG_DWORD) hex:0x00000000
{unrecognized setting}

"NoRemoteRecursiveEvents" = (REG_DWORD) hex:0x00000001
{unrecognized setting}

"NoStrCmpLogical" = (REG_DWORD) hex:0x00000001
{unrecognized setting}

"NoClose" = (REG_DWORD) hex:0x00000000
{unrecognized setting}

HKLM\Software\Policies\Microsoft\Internet Explorer\Infodelivery\Restrictions\

"NoUpdateCheck" = (REG_DWORD) hex:0x00000001
{unrecognized setting}

HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\

"shutdownwithoutlogon" = (REG_DWORD) hex:0x00000001
{Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options|
Shutdown: Allow system to be shut down without having to log on}

"undockwithoutlogon" = (REG_DWORD) hex:0x00000001
{Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options|
Devices: Allow undock without having to log on}

"RunStartupScriptSync" = (REG_DWORD) hex:0x00000001
{unrecognized setting}

"SynchronousMachineGroupPolicy" = (REG_DWORD) hex:0x00000001
{unrecognized setting}

"SynchronousUserGroupPolicy" = (REG_DWORD) hex:0x00000001
{unrecognized setting}

Active Desktop and Wallpaper:
-----------------------------

Active Desktop may be disabled at this entry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState

Enabled Screen Saver:
---------------------

HKCU\Control Panel\Desktop\
"SCRNSAVE.EXE" = "C:\WINDOWS\System32\logon.scr" [MS]

Startup items in "DiM" & "All Users" startup folders:
-----------------------------------------------------

C:\Documents and Settings\All Users\Menu Start\Programy\Autostart
"DSLMON" -> shortcut to: "C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe" [empty string]

Winsock2 Service Provider DLLs:
-------------------------------

Namespace Service Providers

HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++}
000000000001\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]
000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS]
000000000003\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]

Transport Service Providers

HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++}
0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range:
C:\WINDOWS\system32\imon.dll ["Eset "], 01 - 05, 11
%SystemRoot%\system32\mswsock.dll [MS], 06 - 08, 12 - 21
%SystemRoot%\system32\rsvpsp.dll [MS], 09 - 10

Toolbars, Explorer Bars, Extensions:
------------------------------------

Explorer Bars

HKLM\Software\Microsoft\Internet Explorer\Explorer Bars\

HKLM\Software\Classes\CLSID\{FF059E31-CC5A-4E2E-BF3B-96E929D65503}\(Default) = "&Badanie"
Implemented Categories\{00021493-0000-0000-C000-000000000046}\ [vertical bar]
InProcServer32\(Default) = "C:\PROGRA~1\Microsoft Office\OFFICE11\REFIEBAR.DLL" [MS]

Extensions (Tools menu items, main toolbar menu buttons)

HKLM\Software\Microsoft\Internet Explorer\Extensions\
{92780B25-18CC-41C8-B9BE-3C9C571A8263}\
"ButtonText" = "Badanie"

Running Services (Display Name, Service Name, Path {Service DLL}):
------------------------------------------------------------------

LightScribeService Direct Disc Labeling Service, LightScribeService, ""C:\Program Files\Common Files\LightScribe\LSSrvc.exe"" ["Hewlett-Packard Company"]
NOD32 Kernel Service, NOD32krn, ""C:\Program Files\Eset\nod32krn.exe"" ["Eset "]

----------
<<!>>: Suspicious data at a malware launch point.

+ This report excludes default entries except where indicated.
+ To see *everywhere* the script checks and *everything* it finds,
launch it from a command prompt or a shortcut with the -all parameter.
+ The search for DESKTOP.INI DLL launch points on all local fixed drives
took 51 seconds.
---------- (total run time: 196 seconds)

**Posty:** 18165 · przez **wojtas** 19 Cze 2007, 21:25

skasnuj jeszcze :

VundoFix
http://www.atribune.org/ccount/click.php?id=4

VirtumundoBeGone
http://secured2k.home.comcast.net/tools/VirtumundoBeGone.exe

FixVundo
http://securityresponse.symantec.com/avcenter/FixVundo.exe

bo siedzi vundo... a normalnym kilkakrotnie jeszcze zapusc

**Posty:** 264 · przez **lamer** 19 Cze 2007, 21:37

tylko że jest taki problem że po przeskanowaniu "VundoFix " i "VirtumundoBeGone " wywala mi bluescreena i nic nie da się zrobić

Próbowałem wejść w awaryjny ale jeszcze do końca się nie włączy i restartuje mi kompa :oops:

**Posty:** 18165 · przez **wojtas** 19 Cze 2007, 21:39

hmm...

podrzuc loga z:

http://download.bleepingcomputer.com/sUBs/ComboFix.exe

i podaj kod bledu bs'a

**Posty:** 264 · przez **lamer** 19 Cze 2007, 23:07

Log z ComboFixa:

ComboFix 07-06-18.2 - C:\Documents and Settings\DiM\Pulpit\ComboFix.exe
"DiM" - 2007-06-19 22:23:46 - Dodatek Service Pack 2 NTFS

(((((((((((((((((((((((((((((((((((((((((((( V Log )))))))))))))))))))))))))))))))))))))))))))))))))))))))

C:\WINDOWS\system32\aqkfynbe.dll
C:\WINDOWS\system32\dmlulmju.dll
C:\WINDOWS\system32\hmpjnlgx.dll
C:\WINDOWS\system32\iwmgbctb.dll
C:\WINDOWS\system32\kkhonufn.dll
C:\WINDOWS\system32\lkbjdtyi.dll
C:\WINDOWS\system32\lpsekcef.dll
C:\WINDOWS\system32\lvusieeh.dll
C:\WINDOWS\system32\mymejmub.dll
C:\WINDOWS\system32\mymtfwmf.dll
C:\WINDOWS\system32\nofgigbs.dll
C:\WINDOWS\system32\nuntenlp.dll
C:\WINDOWS\system32\oxeswxpu.dll
C:\WINDOWS\system32\qwcpgeyl.dll
C:\WINDOWS\system32\uvexbndw.dll
C:\WINDOWS\system32\vklpngvy.dll
C:\WINDOWS\system32\xujpwfwn.dll
C:\WINDOWS\system32\ywqugwdv.dll
C:\WINDOWS\system32\ebnyfkqa.ini
C:\WINDOWS\system32\ujmlulmd.ini
C:\WINDOWS\system32\xglnjpmh.ini
C:\WINDOWS\system32\btcbgmwi.ini
C:\WINDOWS\system32\nfunohkk.ini
C:\WINDOWS\system32\iytdjbkl.ini
C:\WINDOWS\system32\feckespl.ini
C:\WINDOWS\system32\heeisuvl.ini
C:\WINDOWS\system32\bumjemym.ini
C:\WINDOWS\system32\fmwftmym.ini
C:\WINDOWS\system32\sbgigfon.ini
C:\WINDOWS\system32\plnetnun.ini
C:\WINDOWS\system32\lonpo.bak1
C:\WINDOWS\system32\lonpo.bak2
C:\WINDOWS\system32\lonpo.ini
C:\WINDOWS\system32\lonpo.tmp
C:\WINDOWS\system32\upxwsexo.ini
C:\WINDOWS\system32\lyegpcwq.ini
C:\WINDOWS\system32\wdnbxevu.ini
C:\WINDOWS\system32\yvgnplkv.ini
C:\WINDOWS\system32\vdwguqwy.ini
C:\WINDOWS\system32\lonpo.bak1
C:\WINDOWS\system32\lonpo.bak2
C:\WINDOWS\system32\lonpo.ini
C:\WINDOWS\system32\lonpo.ini2
C:\WINDOWS\system32\lonpo.tmp
C:\WINDOWS\system32\lonpo.bak1
C:\WINDOWS\system32\lonpo.bak2
C:\WINDOWS\system32\lonpo.ini
C:\WINDOWS\system32\lonpo.ini2
C:\WINDOWS\system32\lonpo.tmp
C:\WINDOWS\system32\ddcyywx.dll
C:\WINDOWS\system32\opnol.dll
C:\WINDOWS\system32\lonpo.ini2

* * * POST RUN FILES/FOLDERS * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

C:\Program Files\Common Files\{3C91E820-0321-1045-0707-990118000030}
C:\Program Files\Common Files\{EC91E820-0321-1045-0707-990118000030}
C:\Program Files\MyGlobalSearch
C:\Program Files\MyGlobalSearch\bar\1.bin\M9FFXTBR.JAR
C:\Program Files\MyGlobalSearch\bar\1.bin\M9FFXTBR.MANIFEST
C:\Program Files\MyGlobalSearch\bar\1.bin\M9NTSTBR.JAR
C:\Program Files\MyGlobalSearch\bar\1.bin\M9NTSTBR.MANIFEST
C:\Program Files\MyGlobalSearch\bar\1.bin\M9PLUGIN.DLL
C:\Program Files\MyGlobalSearch\bar\1.bin\MGSBAR.DLL
C:\Program Files\MyGlobalSearch\bar\1.bin\NPMYGLSH.DLL
C:\Program Files\MyGlobalSearch\bar\Cache\0002FD15
C:\Program Files\MyGlobalSearch\bar\Cache\000306A1
C:\Program Files\MyGlobalSearch\bar\Cache\00030877.bin
C:\Program Files\MyGlobalSearch\bar\Cache\00030BFD.bin
C:\Program Files\MyGlobalSearch\bar\Cache\00030E4B.bin
C:\Program Files\MyGlobalSearch\bar\Cache\files.ini
C:\Program Files\MyGlobalSearch\bar\History\search
C:\Program Files\MyGlobalSearch\bar\Settings\prevcfg.htm

((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

-------\LEGACY_CLIENT_IP-IPX
-------\Client IP-IPX

((((((((((((((((((((((((( Files Created from 2007-05-19 to 2007-06-19 )))))))))))))))))))))))))))))))

2007-06-19 22:20 49,152 --a------ C:\WINDOWS\nircmd.exe
2007-06-19 20:36 122,900 --a------ C:\WINDOWS\system32\xvljbkut.exe
2007-06-19 19:55 122,900 --a------ C:\WINDOWS\system32\lfawrrfh.exe
2007-06-19 19:50 <DIR> d-------- C:\DOCUME~1\DiM\DANEAP~1\foobar2000
2007-06-19 19:48 765,952 -ra------ C:\WINDOWS\system\crlds3d.dll
2007-06-19 19:48 712,704 -ra------ C:\WINDOWS\system32\Audio3D.dll
2007-06-19 19:48 712,704 -ra------ C:\WINDOWS\system32\a3d.dll
2007-06-19 19:48 370,382 -ra------ C:\WINDOWS\system32\drivers\cmaudio.sys
2007-06-19 19:48 32,768 -ra------ C:\WINDOWS\system32\cmnprop.dll
2007-06-19 19:48 135,168 -ra------ C:\WINDOWS\cmuninst.exe
2007-06-19 19:48 135,168 -ra------ C:\WINDOWS\cmuninst.dat
2007-06-19 19:48 1,228,800 -ra------ C:\WINDOWS\mixer.exe
2007-06-18 14:34 24,576 --a------ C:\WINDOWS\system32\VundoFixSVC.exe
2007-06-18 14:28 <DIR> d-------- C:\VundoFix Backups
2007-06-18 13:55 2,006 --a------ C:\WINDOWS\system32\tmp.reg
2007-06-18 13:54 53,248 --a------ C:\WINDOWS\system32\Process.exe
2007-06-18 13:54 51,200 --a------ C:\WINDOWS\system32\dumphive.exe
2007-06-18 13:54 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe
2007-06-17 22:08 221,184 --a------ C:\WINDOWS\system32\wmpns.dll
2007-06-05 18:41 <DIR> d-------- C:\DOCUME~1\DiM\DANEAP~1\K-Meleon
2007-06-05 18:38 <DIR> d-------- C:\Program Files\K-Meleon
2007-05-31 19:26 <DIR> d-------- C:\Program Files\Lavalys
2007-05-31 19:26 <DIR> d-------- C:\Program Files\Atomic Clock Sync
2007-05-29 17:31 <DIR> d-------- C:\DOCUME~1\DiM\DANEAP~1\vlc
2007-05-25 12:20 <DIR> d--hs---- C:\WINDOWS\CSC
2007-05-25 12:05 <DIR> d-------- C:\Program Files\Lavasoft
2007-05-25 12:05 <DIR> d-------- C:\DOCUME~1\DiM\DANEAP~1\Lavasoft
2007-05-25 12:04 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2007-05-24 19:35 25,992 --a------ C:\WINDOWS\system32\pgdfgsvc.exe
2007-05-24 19:35 <DIR> d-------- C:\Program Files\PageDefrag
2007-05-23 23:06 1,744 --a------ C:\WINDOWS\system32\d3d9caps.dat
2007-05-23 21:13 <DIR> d-------- C:\Program Files\Common Files\LightScribe
2007-05-23 21:03 364,544 --------- C:\WINDOWS\system32\TwnLib4.dll
2007-05-23 21:03 106,496 --a------ C:\WINDOWS\system32\TwnLib20.dll
2007-05-23 21:02 476,320 --------- C:\WINDOWS\system32\ImagXpr7.dll
2007-05-23 21:02 471,040 --------- C:\WINDOWS\system32\ImagXRA7.dll
2007-05-23 21:02 262,144 --------- C:\WINDOWS\system32\ImagXR7.dll
2007-05-23 21:02 155,648 --a------ C:\WINDOWS\system32\NeroCheck.exe
2007-05-23 21:02 1,568,768 --------- C:\WINDOWS\system32\ImagX7.dll
2007-05-23 20:59 <DIR> d-------- C:\Program Files\Common Files\Ahead
2007-05-23 20:59 <DIR> d-------- C:\Program Files\Ahead
2007-05-20 21:25 <DIR> d---s---- C:\DOCUME~1\DiM\UserData
2007-05-20 18:03 353 ---hs---- C:\WINDOWS\system32\vycdd.ini2
2007-05-20 15:14 <DIR> d-------- C:\DOCUME~1\DiM\DANEAP~1\Help
2007-05-20 15:13 <DIR> d-------- C:\Program Files\GoldWave
2007-05-20 14:55 18,800 --a------ C:\WINDOWS\system32\GDIPFONTCACHEV1.DAT
2007-05-20 13:44 17,920 --a------ C:\WINDOWS\system32\mdimon.dll
2007-05-20 13:00 <DIR> d-------- C:\WINDOWS\SHELLNEW

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-06-17 16:25:18 2,560 ----a-w C:\WINDOWS\system32\BitCometRes.dll
2007-06-06 17:24:16 -------- d-----w C:\DOCUME~1\DiM\DANEAP~1\Hamachi
2007-06-06 16:41:08 -------- d-----w C:\Program Files\BitComet
2007-05-20 11:59:13 -------- d-----w C:\Program Files\jv16 PowerTools 2006
2007-05-17 16:15:39 10,546 ----a-w C:\WINDOWS\system32\drivers\hamachi.sys
2007-05-17 16:15:38 -------- d-----w C:\Program Files\Hamachi
2007-05-16 18:13:28 -------- d-----w C:\Program Files\BearShare
2007-05-16 16:13:34 -------- d--h--w C:\Program Files\InstallShield Installation Information
2007-05-16 16:08:12 -------- d-----w C:\Program Files\Mobile Phone Manager
2007-05-16 15:57:09 -------- d-----w C:\Program Files\Common Files\InstallShield
2007-05-15 19:48:28 -------- d-----w C:\Program Files\Common Files\ODBC
2007-05-15 19:48:22 -------- d-----w C:\Program Files\Common Files\SpeechEngines
2007-05-15 19:44:33 -------- d-----w C:\Program Files\GG Lite
2007-05-15 19:28:56 -------- d-----w C:\Program Files\VideoLAN
2007-05-15 19:28:45 -------- d-----w C:\Program Files\K-Lite Codec Pack
2007-05-15 19:28:26 -------- d-----w C:\DOCUME~1\DiM\DANEAP~1\Real
2007-05-15 19:19:03 -------- d-----w C:\Program Files\Gadu-Gadu
2007-05-15 19:17:58 -------- d-----w C:\Program Files\foobar2000
2007-05-15 19:08:27 -------- d-----w C:\Program Files\Java Web Start
2007-05-15 18:52:28 -------- d-----w C:\Program Files\SAGEM
2007-05-15 18:46:51 298,104 ----a-w C:\WINDOWS\system32\imon.dll
2007-05-15 18:46:50 512,096 ----a-w C:\WINDOWS\system32\drivers\amon.sys
2007-05-15 18:46:48 15,424 ----a-w C:\WINDOWS\system32\drivers\nod32drv.sys
2007-05-15 18:45:50 1,632 ----a-w C:\WINDOWS\system32\d3d8caps.dat
2007-05-15 18:26:54 49,492 ----a-w C:\WINDOWS\system32\perfc015.dat
2007-05-15 18:26:54 355,486 ----a-w C:\WINDOWS\system32\perfh015.dat
2007-05-15 18:10:36 -------- d-----w C:\Program Files\microsoft frontpage
2007-05-15 18:09:05 0 --sha-r C:\MSDOS.SYS
2007-05-15 18:09:05 0 --sha-r C:\IO.SYS
2007-05-15 18:09:05 0 ----a-w C:\CONFIG.SYS
2007-05-15 18:09:05 0 ----a-w C:\AUTOEXEC.BAT
2007-05-15 18:04:33 -------- d--h--w C:\Program Files\WindowsUpdate
2007-05-15 18:04:24 -------- d-----w C:\Program Files\Usługi online
2007-05-15 18:02:50 -------- d-----w C:\Program Files\Common Files\MSSoap
2007-05-15 18:02:37 -------- d-----w C:\Program Files\Movie Maker
2007-05-15 18:00:04 21,856 ----a-w C:\WINDOWS\system32\emptyregdb.dat
2007-05-15 17:59:02 -------- d-----w C:\Program Files\Messenger
2007-05-15 17:58:55 -------- d-----w C:\Program Files\MSN Gaming Zone
2007-05-15 17:58:39 -------- d-----w C:\Program Files\Windows NT

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"nod32kui"="C:\Program Files\Eset\nod32kui.exe" [2007-05-15 20:46]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"RunStartupScriptSync"=1 (0x1)
"SynchronousMachineGroupPolicy"=1 (0x1)
"SynchronousUserGroupPolicy"=1 (0x1)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"NoDispAppearancePage"=0 (0x0)
"NoColorChoice"=0 (0x0)
"NoDispBackgroundPage"=0 (0x0)
"NoDispCPL"=0 (0x0)
"NoDispSettingsPage"=0 (0x0)
"NoDispScrSavPage"=0 (0x0)
"NoVisualStyleChoice"=0 (0x0)
"NoSizeChoice"=0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoAutoTrayNotify"=1 (0x1)
"MemCheckBoxInRunDlg"=0 (0x0)
"NoRemoteRecursiveEvents"=1 (0x1)
"NoStrCmpLogical"=1 (0x1)
"NoClose"=0 (0x0)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoRemoteRecursiveEvents"=1 (0x1)
"NoSMBalloonTip"=1 (0x1)
"NoSaveSettings"=0 (0x0)
"NoRecentDocsHistory"=1 (0x1)
"NoLowDiskSpaceChecks"=1 (0x1)
"MemCheckBoxInRunDlg"=0 (0x0)
"NoClose"=0 (0x0)
"NoAutoTrayNotify"=0 (0x0)
"NoResolveTrack"=0 (0x0)
"NoResolveSearch"=1 (0x1)
"LinkResolveIgnoreLinkInfo"=1 (0x1)
"NoStartBanner"=01000000
"NoWelcomeScreen"=1 (0x1)
"NoRecentDocsNetHood"=1 (0x1)
"NoDesktopCleanupWizard"=1 (0x1)
"NoSharedDocuments"=1 (0x1)
"NoThemesTab"=0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^DiM^Menu Start^Programy^Autostart^Yahoo! Widget Engine.lnk]
backup=C:\WINDOWS\pss\Yahoo! Widget Engine.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\C-Media Mixer]
Mixer.exe /startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GPLv3]
rundll32.exe "C:\WINDOWS\system32\mymtfwmf.dll",realset

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IpWins]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\j1231538]
rundll32 C:\WINDOWS\system32\j1231538.dll sook

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck]
%systemroot%\system32\dumprep 0 -k

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
C:\WINDOWS\system32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]
RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
nwiz.exe /install

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\setup]
rundll32.exe "C:\WINDOWS\system32\lsjcnduj.dll",realset

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WindowsUpdate]
rundll32.exe "C:\WINDOWS\system32\hmpjnlgx.dll",realset

**************************************************************************

catchme 0.3.721 W2K/XP/Vista - userland rootkit detector by Gmer, http://www.gmer.net
Rootkit scan 2007-06-19 22:35:03
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes ...

cmd.exe [1972]

scanning hidden autostart entries ...

scanning hidden files ...

**************************************************************************

Completion time: 2007-06-19 22:37:26 - machine was rebooted
C:\ComboFix-quarantined-files.txt ... 2007-06-19 22:36

--- E O F ---

zaraz podrzuce numer bluescreena :roll:

**Posty:** 18165 · przez **wojtas** 19 Cze 2007, 23:14

Użyj WWDC :
http://www.firewallleaktester.com/wwdc.htm
Zmień opcje z disable na enable. Uruchom ponownie komputer.
Tak powinny wyglądać porty (NetBIOS może być żółty) :
http://www.firewallleaktester.com/images_site/wwdc.jpg

Pobierz i uruchom narzędzie : The Avenger
http://swandog46.geekstogo.com/avenger.zip
Zaznacz opcję Input script manually i kliknij na Lupkę z prawej strony. W okienku, które się otworzy wklejasz:

Files to delete:

C:\WINDOWS\system32\xvljbkut.exe
C:\WINDOWS\system32\lfawrrfh.exe
C:\WINDOWS\system32\tmp.reg
C:\WINDOWS\system32\vycdd.ini2

Klikasz Done, a następnie zielone światełko i zgadzasz się na restart klikając OK.

wklejasz do notatnika:

Windows Registry Editor Version 5.00

[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GPLv3]

[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IpWins]

[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\j1231538]

[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\setup]

[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WindowsUpdate]

w notatniku u góry>>>plik zapisz jako>>>Zmien rozszerzenie z TXT na Wszystkie pliki *.* >>> Zapisz pod nazwą FIX.REG

Klikasz dwa razy na powstały plik fix i dodajesz go do rejestru....

Kasujesz ręcznie z dysku plik: C:\Avenger\backup.zip i wklejasz na forum raport: C:\avenger.txt + log z combofixa

Autor postu otrzymał pochwałę

**Posty:** 264 · przez **lamer** 19 Cze 2007, 23:19

bluescreena już mi nie wywala, a skanerki które podałeś wyżej nic nie wykrywaja :banan:

teraz zrobie jeszcze to co napisałeś na górze.Wielkie dzięki wojtas19162 masz u mnie piwo

**Posty:** 18165 · przez **wojtas** 19 Cze 2007, 23:22

lamer

pamietaj o nowych logach

**Posty:** 264 · przez **lamer** 19 Cze 2007, 23:30

log z avenger'a:

Logfile of The Avenger version 1, by Swandog46
Running from registry key:
\Registry\Machine\System\CurrentControlSet\Services\ltxttxcy

*******************

Script file located at: \??\C:\icecraaa.txt
Script file opened successfully.

Script file read successfully

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

File C:\WINDOWS\system32\xvljbkut.exe deleted successfully.
File C:\WINDOWS\system32\lfawrrfh.exe deleted successfully.
File C:\WINDOWS\system32\tmp.reg deleted successfully.
File C:\WINDOWS\system32\vycdd.ini2 deleted successfully.

Completed script processing.

*******************

Finished! Terminate.ote

zaraz dam z combofix'a

[ Dodano: Dzisiaj o 22:45 ]
no i z combofixa:

ComboFix 07-06-18.2 - C:\Documents and Settings\DiM\Pulpit\ComboFix.exe
"DiM" - 2007-06-19 23:18:05 - Dodatek Service Pack 2 NTFS

((((((((((((((((((((((((( Files Created from 2007-05-19 to 2007-06-19 )))))))))))))))))))))))))))))))

2007-06-19 22:20 49,152 --a------ C:\WINDOWS\nircmd.exe
2007-06-19 19:50 <DIR> d-------- C:\DOCUME~1\DiM\DANEAP~1\foobar2000
2007-06-19 19:48 765,952 -ra------ C:\WINDOWS\system\crlds3d.dll
2007-06-19 19:48 712,704 -ra------ C:\WINDOWS\system32\Audio3D.dll
2007-06-19 19:48 712,704 -ra------ C:\WINDOWS\system32\a3d.dll
2007-06-19 19:48 370,382 -ra------ C:\WINDOWS\system32\drivers\cmaudio.sys
2007-06-19 19:48 32,768 -ra------ C:\WINDOWS\system32\cmnprop.dll
2007-06-19 19:48 135,168 -ra------ C:\WINDOWS\cmuninst.exe
2007-06-19 19:48 135,168 -ra------ C:\WINDOWS\cmuninst.dat
2007-06-19 19:48 1,228,800 -ra------ C:\WINDOWS\mixer.exe
2007-06-18 14:34 24,576 --a------ C:\WINDOWS\system32\VundoFixSVC.exe
2007-06-18 13:54 53,248 --a------ C:\WINDOWS\system32\Process.exe
2007-06-18 13:54 51,200 --a------ C:\WINDOWS\system32\dumphive.exe
2007-06-18 13:54 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe
2007-06-17 22:08 221,184 --a------ C:\WINDOWS\system32\wmpns.dll
2007-06-05 18:41 <DIR> d-------- C:\DOCUME~1\DiM\DANEAP~1\K-Meleon
2007-06-05 18:38 <DIR> d-------- C:\Program Files\K-Meleon
2007-05-31 19:26 <DIR> d-------- C:\Program Files\Lavalys
2007-05-31 19:26 <DIR> d-------- C:\Program Files\Atomic Clock Sync
2007-05-29 17:31 <DIR> d-------- C:\DOCUME~1\DiM\DANEAP~1\vlc
2007-05-25 12:20 <DIR> d--hs---- C:\WINDOWS\CSC
2007-05-25 12:05 <DIR> d-------- C:\Program Files\Lavasoft
2007-05-25 12:05 <DIR> d-------- C:\DOCUME~1\DiM\DANEAP~1\Lavasoft
2007-05-25 12:04 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2007-05-24 19:35 25,992 --a------ C:\WINDOWS\system32\pgdfgsvc.exe
2007-05-24 19:35 <DIR> d-------- C:\Program Files\PageDefrag
2007-05-23 23:06 1,744 --a------ C:\WINDOWS\system32\d3d9caps.dat
2007-05-23 21:13 <DIR> d-------- C:\Program Files\Common Files\LightScribe
2007-05-23 21:03 364,544 --------- C:\WINDOWS\system32\TwnLib4.dll
2007-05-23 21:03 106,496 --a------ C:\WINDOWS\system32\TwnLib20.dll
2007-05-23 21:02 476,320 --------- C:\WINDOWS\system32\ImagXpr7.dll
2007-05-23 21:02 471,040 --------- C:\WINDOWS\system32\ImagXRA7.dll
2007-05-23 21:02 262,144 --------- C:\WINDOWS\system32\ImagXR7.dll
2007-05-23 21:02 155,648 --a------ C:\WINDOWS\system32\NeroCheck.exe
2007-05-23 21:02 1,568,768 --------- C:\WINDOWS\system32\ImagX7.dll
2007-05-23 20:59 <DIR> d-------- C:\Program Files\Common Files\Ahead
2007-05-23 20:59 <DIR> d-------- C:\Program Files\Ahead
2007-05-20 21:25 <DIR> d---s---- C:\DOCUME~1\DiM\UserData
2007-05-20 15:14 <DIR> d-------- C:\DOCUME~1\DiM\DANEAP~1\Help
2007-05-20 15:13 <DIR> d-------- C:\Program Files\GoldWave
2007-05-20 14:55 18,800 --a------ C:\WINDOWS\system32\GDIPFONTCACHEV1.DAT
2007-05-20 13:44 17,920 --a------ C:\WINDOWS\system32\mdimon.dll
2007-05-20 13:00 <DIR> d-------- C:\WINDOWS\SHELLNEW

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-06-17 16:25:18 2,560 ----a-w C:\WINDOWS\system32\BitCometRes.dll
2007-06-06 17:24:16 -------- d-----w C:\DOCUME~1\DiM\DANEAP~1\Hamachi
2007-06-06 16:41:08 -------- d-----w C:\Program Files\BitComet
2007-05-20 11:59:13 -------- d-----w C:\Program Files\jv16 PowerTools 2006
2007-05-17 16:15:39 10,546 ----a-w C:\WINDOWS\system32\drivers\hamachi.sys
2007-05-17 16:15:38 -------- d-----w C:\Program Files\Hamachi
2007-05-16 18:13:28 -------- d-----w C:\Program Files\BearShare
2007-05-16 16:13:34 -------- d--h--w C:\Program Files\InstallShield Installation Information
2007-05-16 16:08:12 -------- d-----w C:\Program Files\Mobile Phone Manager
2007-05-16 15:57:09 -------- d-----w C:\Program Files\Common Files\InstallShield
2007-05-15 19:48:28 -------- d-----w C:\Program Files\Common Files\ODBC
2007-05-15 19:48:22 -------- d-----w C:\Program Files\Common Files\SpeechEngines
2007-05-15 19:44:33 -------- d-----w C:\Program Files\GG Lite
2007-05-15 19:28:56 -------- d-----w C:\Program Files\VideoLAN
2007-05-15 19:28:45 -------- d-----w C:\Program Files\K-Lite Codec Pack
2007-05-15 19:28:26 -------- d-----w C:\DOCUME~1\DiM\DANEAP~1\Real
2007-05-15 19:19:03 -------- d-----w C:\Program Files\Gadu-Gadu
2007-05-15 19:17:58 -------- d-----w C:\Program Files\foobar2000
2007-05-15 19:08:27 -------- d-----w C:\Program Files\Java Web Start
2007-05-15 18:52:28 -------- d-----w C:\Program Files\SAGEM
2007-05-15 18:46:51 298,104 ----a-w C:\WINDOWS\system32\imon.dll
2007-05-15 18:46:50 512,096 ----a-w C:\WINDOWS\system32\drivers\amon.sys
2007-05-15 18:46:48 15,424 ----a-w C:\WINDOWS\system32\drivers\nod32drv.sys
2007-05-15 18:45:50 1,632 ----a-w C:\WINDOWS\system32\d3d8caps.dat
2007-05-15 18:26:54 49,492 ----a-w C:\WINDOWS\system32\perfc015.dat
2007-05-15 18:26:54 355,486 ----a-w C:\WINDOWS\system32\perfh015.dat
2007-05-15 18:10:36 -------- d-----w C:\Program Files\microsoft frontpage
2007-05-15 18:09:05 0 --sha-r C:\MSDOS.SYS
2007-05-15 18:09:05 0 --sha-r C:\IO.SYS
2007-05-15 18:09:05 0 ----a-w C:\CONFIG.SYS
2007-05-15 18:09:05 0 ----a-w C:\AUTOEXEC.BAT
2007-05-15 18:04:33 -------- d--h--w C:\Program Files\WindowsUpdate
2007-05-15 18:04:24 -------- d-----w C:\Program Files\Usługi online
2007-05-15 18:02:50 -------- d-----w C:\Program Files\Common Files\MSSoap
2007-05-15 18:02:37 -------- d-----w C:\Program Files\Movie Maker
2007-05-15 18:00:04 21,856 ----a-w C:\WINDOWS\system32\emptyregdb.dat
2007-05-15 17:59:02 -------- d-----w C:\Program Files\Messenger
2007-05-15 17:58:55 -------- d-----w C:\Program Files\MSN Gaming Zone
2007-05-15 17:58:39 -------- d-----w C:\Program Files\Windows NT

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"nod32kui"="C:\Program Files\Eset\nod32kui.exe" [2007-05-15 20:46]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"RunStartupScriptSync"=1 (0x1)
"SynchronousMachineGroupPolicy"=1 (0x1)
"SynchronousUserGroupPolicy"=1 (0x1)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"NoDispAppearancePage"=0 (0x0)
"NoColorChoice"=0 (0x0)
"NoDispBackgroundPage"=0 (0x0)
"NoDispCPL"=0 (0x0)
"NoDispSettingsPage"=0 (0x0)
"NoDispScrSavPage"=0 (0x0)
"NoVisualStyleChoice"=0 (0x0)
"NoSizeChoice"=0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoAutoTrayNotify"=1 (0x1)
"MemCheckBoxInRunDlg"=0 (0x0)
"NoRemoteRecursiveEvents"=1 (0x1)
"NoStrCmpLogical"=1 (0x1)
"NoClose"=0 (0x0)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoRemoteRecursiveEvents"=1 (0x1)
"NoSMBalloonTip"=1 (0x1)
"NoSaveSettings"=0 (0x0)
"NoRecentDocsHistory"=1 (0x1)
"NoLowDiskSpaceChecks"=1 (0x1)
"MemCheckBoxInRunDlg"=0 (0x0)
"NoClose"=0 (0x0)
"NoAutoTrayNotify"=0 (0x0)
"NoResolveTrack"=0 (0x0)
"NoResolveSearch"=1 (0x1)
"LinkResolveIgnoreLinkInfo"=1 (0x1)
"NoStartBanner"=01000000
"NoWelcomeScreen"=1 (0x1)
"NoRecentDocsNetHood"=1 (0x1)
"NoDesktopCleanupWizard"=1 (0x1)
"NoSharedDocuments"=1 (0x1)
"NoThemesTab"=0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^DiM^Menu Start^Programy^Autostart^Yahoo! Widget Engine.lnk]
backup=C:\WINDOWS\pss\Yahoo! Widget Engine.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\C-Media Mixer]
Mixer.exe /startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck]
%systemroot%\system32\dumprep 0 -k

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
C:\WINDOWS\system32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]
RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
nwiz.exe /install

**************************************************************************

catchme 0.3.721 W2K/XP/Vista - userland rootkit detector by Gmer, http://www.gmer.net
Rootkit scan 2007-06-19 23:20:04
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

**************************************************************************

Completion time: 2007-06-19 23:22:00

--- E O F ---

**Posty:** 18165 · przez **wojtas** 20 Cze 2007, 11:05

logi sa ok

zwieszający się system

zwieszający się system

Kto jest na forum