proszę o sprawdzenie loga

**Posty:** 4644 · przez **Wariat** 01 Lut 2007, 22:31

zrobione... tylko albo ja jestem taki ślepy, albo źle mi piszesz... gdzie w gmerze jest SZUKAJ po zaznaczeniu tych opcji o których piszesz :idea:

Aqui napisał(a):W ktorym systemie jestes??

nie rozumiem

**Posty:** 935 · przez **Aqui** 01 Lut 2007, 22:52

W awaryjnym jestes??
Daj nowe logi.
Jak komputer??

jest SZUKAJ

Jest

**Posty:** 4644 · przez **Wariat** 01 Lut 2007, 23:00

mówisz o Szukaj w zakładce Autostart ?

Kod: Zaznacz wszystko: Logfile of HijackThis v1.99.1 Scan saved at 21:49:54, on 2007-02-01 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Konnekt\konnekt.exe C:\Documents and Settings\Administrator\Pulpit\gmer\gmer.exe C:\Documents and Settings\KROKU\Pulpit\hijackthis_199\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = O2 - BHO: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll O3 - Toolbar: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL O4 - HKLM\..\Run: [DU Meter] C:\Program Files\DU Meter\DUMeter.exe O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd O4 - HKLM\..\Run: [KAVPersonal50] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\kav.exe" /minimize O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe" O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe O4 - HKLM\..\Run: [Samsung Common SM] "C:\WINDOWS\Samsung\ComSMMgr\ssmmgr.exe" /autorun O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE O4 - HKCU\..\RunOnce: [NeroHomeFirstStart] C:\Program Files\Common Files\Ahead\Lib\NMFirstStart.exe O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\npjpi150_10.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\npjpi150_10.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe O23 - Service: kavsvc - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\kavsvc.exe O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe

Kod: Zaznacz wszystko: "Silent Runners.vbs", revision R50, http://www.silentrunners.org/ Operating System: Windows XP SP2 Output limited to non-default values, except where indicated by "{++}" Startup items buried in registry: --------------------------------- HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ {++} "CTFMON.EXE" = "C:\WINDOWS\system32\CTFMON.EXE" [MS] HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce\ {++} "NeroHomeFirstStart" = "C:\Program Files\Common Files\Ahead\Lib\NMFirstStart.exe" ["Nero AG"] HKLM\Software\Microsoft\Windows\CurrentVersion\Run\ {++} "DU Meter" = "C:\Program Files\DU Meter\DUMeter.exe" ["Hagel Technologies"] "Cmaudio" = "RunDll32 cmicnfg.cpl,CMICtrlWnd" [MS] "KAVPersonal50" = ""C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\kav.exe" /minimize" ["Kaspersky Lab"] "SunJavaUpdateSched" = ""C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe"" ["Sun Microsystems, Inc."] "WinampAgent" = "C:\Program Files\Winamp\winampa.exe" [null data] "NeroFilterCheck" = "C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" ["Nero AG"] "Samsung Common SM" = ""C:\WINDOWS\Samsung\ComSMMgr\ssmmgr.exe" /autorun" ["Samsung Electronics."] "KernelFaultCheck" = "C:\WINDOWS\system32\dumprep 0 -k" "!AVG Anti-Spyware" = ""C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized" ["Anti-Malware Development a.s."] HKLM\Software\Microsoft\Active Setup\Installed Components\ >{26923b43-4d38-484f-9b9e-de460746276c}\(Default) = "Internet Explorer" \StubPath = "C:\WINDOWS\system32\shmgrate.exe OCInstallUserConfigIE" [MS] >{60B49E34-C7CC-11D0-8953-00A0C90347FF}MICROS\(Default) = "Dostosowywanie przeglądarki" \StubPath = "RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP" [MS] >{881dd1c5-3dcf-431b-b061-f3f88e8be88a}\(Default) = "Outlook Express" \StubPath = "C:\WINDOWS\system32\shmgrate.exe OCInstallUserConfigOE" [MS] {2C7339CF-2B09-4501-B3F3-F3508C9228ED}\(Default) = "Themes Setup" \StubPath = "C:\WINDOWS\system32\regsvr32.exe /s /n /i:/UserInstall C:\WINDOWS\system32\themeui.dll" [MS] {44BBA840-CC51-11CF-AAFA-00AA00B6015C}\(Default) = "Microsoft Outlook Express 6" \StubPath = ""C:\Program Files\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install" [MS] {5945c046-1e7d-11d1-bc44-00c04fd912be}\(Default) = "Windows Messenger 4.7" \StubPath = "rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msmsgs.inf,BLC.QuietInstall.PerUser" [MS] {7790769C-0471-11d2-AF11-00C04FA35D02}\(Default) = "Książka adresowa 6" \StubPath = ""C:\Program Files\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install" [MS] {89820200-ECBD-11cf-8B85-00AA005B4340}\(Default) = "Aktualizacja pulpitu Windows" \StubPath = "regsvr32.exe /s /n /i:U shell32.dll" [MS] {89820200-ECBD-11cf-8B85-00AA005B4383}\(Default) = "Internet Explorer 6" \StubPath = "C:\WINDOWS\system32\ie4uinit.exe" [MS] HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C}\(Default) = (no title provided) -> {HKLM...CLSID} = "Megaupload Toolbar" \InProcServer32\(Default) = "C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL" ["MegaUpload"] {761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\(Default) = (no title provided) -> {HKLM...CLSID} = "SSVHelper Class" \InProcServer32\(Default) = "C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll" ["Sun Microsystems, Inc."] HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\ "{42071714-76d4-11d1-8b24-00a0c9068ff3}" = "Rozszerzenie CPL kadrowania wyświetlania" -> {HKLM...CLSID} = "Rozszerzenie CPL kadrowania wyświetlania" \InProcServer32\(Default) = "deskpan.dll" [file not found] "{88895560-9AA2-1069-930E-00AA0030EBC8}" = "Rozszerzenie ikony HyperTerminalu" -> {HKLM...CLSID} = "HyperTerminal Icon Ext" \InProcServer32\(Default) = "C:\WINDOWS\system32\hticons.dll" ["Hilgraeve, Inc."] "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" = "WinRAR shell extension" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] "{F0CB00CD-5A07-4D91-97F5-A8C92CDA93E4}" = "Shell Extensions for RealOne Player" -> {HKLM...CLSID} = "RealOne Player Context Menu Class" \InProcServer32\(Default) = "C:\Program Files\Real\RealPlayer\rpshell.dll" ["RealNetworks, Inc."] "{23170F69-40C1-278A-1000-000100020000}" = "7-Zip Shell Extension" -> {HKLM...CLSID} = "7-Zip Shell Extension" \InProcServer32\(Default) = "C:\Program Files\7-Zip\7-zip.dll" ["Igor Pavlov"] HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\ <<!>> "{57B86673-276A-48B2-BAE7-C6DBB3020EB8}" = "AVG Anti-Spyware 7.5" -> {HKLM...CLSID} = "CShellExecuteHookImpl Object" \InProcServer32\(Default) = "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\shellexecutehook.dll" ["Anti-Malware Development a.s."] HKLM\Software\Classes\*\shellex\ContextMenuHandlers\ 7-Zip\(Default) = "{23170F69-40C1-278A-1000-000100020000}" -> {HKLM...CLSID} = "7-Zip Shell Extension" \InProcServer32\(Default) = "C:\Program Files\7-Zip\7-zip.dll" ["Igor Pavlov"] AVG Anti-Spyware\(Default) = "{8934FCEF-F5B8-468f-951F-78A921CD3920}" -> {HKLM...CLSID} = "CContextScan Object" \InProcServer32\(Default) = "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\context.dll" ["Anti-Malware Development a.s."] Kaspersky Anti-Virus\(Default) = "{dd230880-495a-11d1-b064-008048ec2fc5}" -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\shellex.dll" ["Kaspersky Lab"] WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\ 7-Zip\(Default) = "{23170F69-40C1-278A-1000-000100020000}" -> {HKLM...CLSID} = "7-Zip Shell Extension" \InProcServer32\(Default) = "C:\Program Files\7-Zip\7-zip.dll" ["Igor Pavlov"] AVG Anti-Spyware\(Default) = "{8934FCEF-F5B8-468f-951F-78A921CD3920}" -> {HKLM...CLSID} = "CContextScan Object" \InProcServer32\(Default) = "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\context.dll" ["Anti-Malware Development a.s."] WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\ Kaspersky Anti-Virus\(Default) = "{dd230880-495a-11d1-b064-008048ec2fc5}" -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\shellex.dll" ["Kaspersky Lab"] WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] Group Policies {GPedit.msc branch and setting}: ----------------------------------------------- Note: detected settings may not have any effect. HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\ "NoSaveSettings" = (REG_DWORD) hex:0x00000000 {User Configuration|Administrative Templates|Desktop| Don't save settings at exit} "ClassicShell" = (REG_DWORD) hex:0x00000000 {User Configuration|Administrative Templates|Windows Components|Windows Explorer| Enable Classic Shell / Turn on Classic Shell} "NoThemesTab" = (REG_DWORD) hex:0x00000000 {unrecognized setting} HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\ "NoActiveDesktopChanges" = (REG_DWORD) hex:0x00000000 {unrecognized setting} HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System\ "NoDispAppearancePage" = (REG_DWORD) hex:0x00000000 {unrecognized setting} "NoColorChoice" = (REG_DWORD) hex:0x00000000 {unrecognized setting} "NoSizeChoice" = (REG_DWORD) hex:0x00000000 {unrecognized setting} "NoDispBackgroundPage" = (REG_DWORD) hex:0x00000000 {User Configuration|Administrative Templates|Control Panel|Display| Hide Desktop tab} "NoDispScrSavPage" = (REG_DWORD) hex:0x00000000 {unrecognized setting} "NoDispCPL" = (REG_DWORD) hex:0x00000000 {User Configuration|Administrative Templates|Control Panel|Display| Remove Display in Control Panel} "NoVisualStyleChoice" = (REG_DWORD) hex:0x00000000 {unrecognized setting} "NoDispSettingsPage" = (REG_DWORD) hex:0x00000000 {unrecognized setting} HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\ "shutdownwithoutlogon" = (REG_DWORD) hex:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| Shutdown: Allow system to be shut down without having to log on} "undockwithoutlogon" = (REG_DWORD) hex:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| Devices: Allow undock without having to log on} "DisableTaskMgr" = (REG_DWORD) hex:0x00000000 {unrecognized setting} Active Desktop and Wallpaper: ----------------------------- Active Desktop may be disabled at this entry: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState Winsock2 Service Provider DLLs: ------------------------------- Namespace Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++} 000000000001\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS] 000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS] 000000000003\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS] Transport Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++} 0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range: %SystemRoot%\system32\mswsock.dll [MS], 01 - 04, 07 - 14 %SystemRoot%\system32\rsvpsp.dll [MS], 05 - 06 Toolbars, Explorer Bars, Extensions: ------------------------------------ Toolbars HKLM\Software\Microsoft\Internet Explorer\Toolbar\ "{4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C}" = (no title provided) -> {HKLM...CLSID} = "Megaupload Toolbar" \InProcServer32\(Default) = "C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL" ["MegaUpload"] Extensions (Tools menu items, main toolbar menu buttons) HKLM\Software\Microsoft\Internet Explorer\Extensions\ {08B0E5C0-4FCB-11CF-AAA5-00401C608501}\ "MenuText" = "Sun Java Console" "CLSIDExtension" = "{CAFEEFAC-0015-0000-0010-ABCDEFFEDCBC}" -> {HKLM...CLSID} = "Java Plug-in 1.5.0_10" \InProcServer32\(Default) = "C:\Program Files\Java\jre1.5.0_10\bin\npjpi150_10.dll" ["Sun Microsystems, Inc."] {FB5F1910-F110-11D2-BB9E-00C04F795683}\ "ButtonText" = "Messenger" "MenuText" = "Windows Messenger" "Exec" = "C:\Program Files\Messenger\msmsgs.exe" [MS] All Non-Disabled Services (Display Name, Service Name, Path {Service DLL}): --------------------------------------------------------------------------- AVG Anti-Spyware Guard, AVG Anti-Spyware Guard, "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe" ["Anti-Malware Development a.s."] Karta wydajności WMI, WmiApSrv, "C:\WINDOWS\system32\wbem\wmiapsrv.exe" [MS] kavsvc, kavsvc, ""C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\kavsvc.exe"" ["Kaspersky Lab"] NBService, NBService, "C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe" ["Nero AG"] Usługa administracyjna Menedżera dysków logicznych, dmadmin, "C:\WINDOWS\System32\dmadmin.exe /com" ["Microsoft Corp., Veritas Software"] Usługa dostarczania sieci, xmlprov, "C:\WINDOWS\System32\svchost.exe -k netsvcs" {"C:\WINDOWS\System32\xmlprov.dll" [MS]} Usługa numeru seryjnego multimediów przenośnych, WmdmPmSN, "C:\WINDOWS\System32\svchost.exe -k netsvcs" {"C:\WINDOWS\system32\mspmsnsv.dll" [MS]} Print Monitors: --------------- HKLM\System\CurrentControlSet\Control\Print\Monitors\ SUGS2 Langmon\Driver = "SUGS2LMK.DLL" ["Samsung Electronics."] ---------- <<!>>: Suspicious data at a malware launch point. + This report excludes default entries except where indicated. + To see *everywhere* the script checks and *everything* it finds, launch it from a command prompt or a shortcut with the -all parameter. + To search all directories of local fixed drives for DESKTOP.INI DLL launch points, use the -supp parameter or answer "No" at the first message box and "Yes" at the second message box. ---------- (total run time: 86 seconds, including 2 seconds for message boxes)

cały czas jestem na awaryjnym bo na zwykłym nic nie zrobię...

**Posty:** 935 · przez **Aqui** 01 Lut 2007, 23:13

Czysto

Co do Gmera poczytaj:
--> http://www.komputery.boo.pl/viewtopic.php?t=19

Daj logi z gmera,i combofix :wink:

Masz WWDC ??

**Posty:** 4644 · przez **Wariat** 02 Lut 2007, 00:06

Aqui napisał(a):Czysto

to było 4 dni temu... dalej siedzi

Kod: Zaznacz wszystko: "Administrator" - 07-02-01 22:14:29 Dodatek Service Pack 2 ComboFix 07.01.31 - Running from: "C:\Documents and Settings\Administrator\Pulpit" ((((((((((((((((((((((((((((((( Files Created from 2007-01-01 to 2007-02-01 )))))))))))))))))))))))))))))))))) 2007-02-01 18:38 <DIR> d-------- C:\!KillBox 2007-02-01 18:05 34,176 --a------ C:\WINDOWS\system32\main.sys 2007-02-01 11:54 80 --a------ C:\WINDOWS\gmer_uninstall.cmd 2007-01-31 23:11 <DIR> d-------- C:\avenger 2007-01-31 20:55 <DIR> d-------- C:\WINDOWS\Content.IE5 2007-01-31 19:25 1,930 --a------ C:\WINDOWS\system32\tmp.reg 2007-01-31 19:24 79,360 --a------ C:\WINDOWS\system32\swxcacls.exe 2007-01-31 19:24 53,248 --a------ C:\WINDOWS\system32\Process.exe 2007-01-31 19:24 51,200 --a------ C:\WINDOWS\system32\dumphive.exe 2007-01-31 19:24 40,960 --a------ C:\WINDOWS\system32\swsc.exe 2007-01-31 19:24 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe 2007-01-31 19:24 135,168 --a------ C:\WINDOWS\system32\swreg.exe 2007-01-31 18:23 60,416 --a------ C:\WINDOWS\system32\drivers\ghnum^vh.sys 2007-01-30 22:11 3,968 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys 2007-01-30 22:11 <DIR> d-------- C:\Program Files\Grisoft 2007-01-30 22:00 <DIR> d-------- C:\DOCUME~1\ADMINI~1\Dane aplikacji\stamina 2007-01-30 18:58 2,816 --a------ C:\WINDOWS\system32\reg.sys 2007-01-28 20:04 <DIR> dr-h----- C:\DOCUME~1\ADMINI~1\Dane aplikacji 2007-01-28 20:04 <DIR> dr------- C:\DOCUME~1\ADMINI~1\Menu Start 2007-01-28 20:04 <DIR> d--hs---- C:\WINDOWS\CSC 2007-01-28 20:04 <DIR> d--h----- C:\DOCUME~1\ADMINI~1\Ustawienia lokalne 2007-01-28 20:04 <DIR> d--h----- C:\DOCUME~1\ADMINI~1\Szablony 2007-01-28 20:04 <DIR> d-------- C:\DOCUME~1\ADMINI~1\Ulubione 2007-01-28 20:04 <DIR> d-------- C:\DOCUME~1\ADMINI~1\Pulpit 2007-01-28 20:04 <DIR> d-------- C:\DOCUME~1\ADMINI~1\Moje dokumenty 2007-01-27 15:57 <DIR> d-------- C:\Program Files\DFX 2007-01-27 15:56 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard 2007-01-25 15:45 <DIR> d-------- C:\Program Files\uTorrent 2007-01-25 15:45 <DIR> d-------- C:\DOCUME~1\KROKU\Dane aplikacji\uTorrent 2007-01-20 21:17 <DIR> d-------- C:\Program Files\eMule 2007-01-19 09:19 5,632 --a------ C:\WINDOWS\system32\ptpusb.dll 2007-01-19 09:19 159,232 --a------ C:\WINDOWS\system32\ptpusd.dll 2007-01-19 09:19 15,104 --a------ C:\WINDOWS\system32\drivers\usbscan.sys 2007-01-13 17:48 <DIR> d-------- C:\Program Files\MegauploadToolbar 2007-01-13 17:48 <DIR> d-------- C:\DOCUME~1\KROKU\Dane aplikacji\MegauploadToolbar 2007-01-10 16:48 <DIR> d-------- C:\DOCUME~1\KROKU\Dane aplikacji\DivX 2007-01-10 16:39 <DIR> d-------- C:\Program Files\StrongDC++ 2007-01-09 19:57 <DIR> d-------- C:\Program Files\Samsung ML-2010 Series 2007-01-09 19:55 57,344 --a------ C:\WINDOWS\system32\SSCoInst.dll 2007-01-09 19:55 41,984 --------- C:\WINDOWS\system32\drivers\DGIVECP.SYS 2007-01-09 19:55 208,896 --------- C:\WINDOWS\system32\SSRemove.exe 2007-01-09 19:55 20,622 --a------ C:\WINDOWS\system32\SUGS2LMK.DLL 2007-01-09 19:55 151,552 --a------ C:\WINDOWS\system32\SSCoInst.exe 2007-01-09 19:55 <DIR> d-------- C:\WINDOWS\Samsung 2007-01-09 19:54 25,856 --a------ C:\WINDOWS\system32\drivers\usbprint.sys 2007-01-09 19:22 1,060,864 --a------ C:\WINDOWS\system32\mfc71.dll 2007-01-09 18:44 <DIR> d-------- C:\Program Files\7-Zip 2007-01-09 18:12 <DIR> d-------- C:\Program Files\IrfanView 2007-01-08 23:53 <DIR> d-------- C:\Program Files\Switch Off 2007-01-07 23:47 <DIR> d-------- C:\Program Files\Ontrack 2007-01-03 00:23 <DIR> d-------- C:\Program Files\Common Files\xing shared 2007-01-03 00:22 <DIR> d-------- C:\Program Files\Real 2007-01-03 00:22 <DIR> d-------- C:\Program Files\Common Files\Real 2007-01-03 00:21 <DIR> d-------- C:\DOCUME~1\KROKU\Dane aplikacji\Real 2007-01-03 00:18 <DIR> d-------- C:\My Downloads 2007-01-03 00:15 <DIR> d-------- C:\Program Files\Super Internet TV 2007-01-03 00:05 <DIR> d-------- C:\Program Files\Fma 2007-01-03 00:05 <DIR> d-------- C:\DOCUME~1\KROKU\Dane aplikacji\FMA 2007-01-02 23:52 <DIR> d-------- C:\DOCUME~1\KROKU\Dane aplikacji\Ahead 2007-01-02 23:49 <DIR> d-------- C:\Program Files\Nero 2007-01-02 23:49 <DIR> d-------- C:\Program Files\Common Files\Ahead 2007-01-02 23:49 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\Dane aplikacji\Nero 2007-01-02 22:44 32,782 -ra------ C:\WINDOWS\system32\drivers\ser120.sys 2007-01-02 22:34 <DIR> d-------- C:\Program Files\Usb to Serial Driver 1.12.25 (((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))) 2007-02-01 22:11 -------- d-------- C:\Program Files\mozilla firefox 2007-02-01 22:06 510976 --a------ C:\WINDOWS\system32\winlogon.exe 2007-01-31 00:21 -------- d-------- C:\DOCUME~1\ADMINI~1\Dane aplikacji\macromedia 2007-01-30 19:21 -------- d---s---- C:\DOCUME~1\ADMINI~1\Dane aplikacji\microsoft 2007-01-28 20:05 -------- d-------- C:\DOCUME~1\ADMINI~1\Dane aplikacji\mozilla 2007-01-09 19:57 -------- d--h----- C:\Program Files\installshield installation information 2007-01-09 19:57 -------- d-------- C:\Program Files\Common Files\installshield 2007-01-09 18:54 -------- d-------- C:\Program Files\subedit-player 2007-01-03 00:22 -------- d-------- C:\Program Files\google 2006-12-31 10:21 -------- d-------- C:\Program Files\tonegen 2006-12-30 22:40 -------- d-------- C:\Program Files\skype 2006-12-30 22:40 -------- d-------- C:\Program Files\Common Files\skype 2006-12-22 16:35 -------- d-------- C:\Program Files\winamp 2006-12-20 21:48 -------- d-------- C:\Program Files\java 2006-12-20 21:44 -------- d-------- C:\Program Files\Common Files\java 2006-12-19 19:02 -------- d-------- C:\Program Files\kaspersky lab 2006-12-19 17:10 -------- d-------- C:\Program Files\c-media 3d audio 2006-12-19 17:08 -------- d-------- C:\Program Files\Common Files\speechengines 2006-12-19 17:08 -------- d-------- C:\Program Files\Common Files\odbc 2006-12-19 17:07 62 --ahs---- C:\DOCUME~1\ADMINI~1\Dane aplikacji\desktop.ini 2006-12-19 16:52 -------- d-------- C:\Program Files\konnekt 2006-12-19 16:22 -------- d-------- C:\Program Files\microsoft frontpage 2006-12-19 16:21 0 -rahs---- C:\MSDOS.SYS 2006-12-19 16:21 0 -rahs---- C:\IO.SYS 2006-12-19 16:21 0 --a------ C:\CONFIG.SYS 2006-12-19 16:21 0 --a------ C:\AUTOEXEC.BAT 2006-12-19 16:19 -------- d--h----- C:\Program Files\windowsupdate 2006-12-19 16:19 -------- d-------- C:\Program Files\usˆugi online 2006-12-19 16:18 -------- d-------- C:\Program Files\movie maker 2006-12-19 16:18 -------- d-------- C:\Program Files\Common Files\mssoap 2006-12-19 16:16 -------- d-------- C:\Program Files\windows nt 2006-12-19 16:16 -------- d-------- C:\Program Files\msn gaming zone 2006-12-19 16:16 -------- d-------- C:\Program Files\messenger (((((((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries & legit default entries are not shown [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run] "CTFMON.EXE"="C:\\WINDOWS\\system32\\CTFMON.EXE" [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\runonce] "NeroHomeFirstStart"="C:\\Program Files\\Common Files\\Ahead\\Lib\\NMFirstStart.exe" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run] "DU Meter"="C:\\Program Files\\DU Meter\\DUMeter.exe" "Cmaudio"="RunDll32 cmicnfg.cpl,CMICtrlWnd" "KAVPersonal50"=""C:\\Program Files\\Kaspersky Lab\\Kaspersky Anti-Virus Personal Pro\\kav.exe" /minimize" "SunJavaUpdateSched"=""C:\\Program Files\\Java\\jre1.5.0_10\\bin\\jusched.exe"" "WinampAgent"="C:\\Program Files\\Winamp\\winampa.exe" "NeroFilterCheck"="C:\\Program Files\\Common Files\\Ahead\\Lib\\NeroCheck.exe" "Samsung Common SM"=""C:\\WINDOWS\\Samsung\\ComSMMgr\\ssmmgr.exe" /autorun" "KernelFaultCheck"=hex(2):25,73,79,73,74,65,6d,72,6f,6f,74,25,5c,73,79,73,74,\ 65,6d,33,32,5c,64,75,6d,70,72,65,70,20,30,20,2d,6b,00 "!AVG Anti-Spyware"=""C:\\Program Files\\Grisoft\\AVG Anti-Spyware 7.5\\avgas.exe" /minimized" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\sharedtaskscheduler] "{2C1CD3D7-86AC-4068-93BC-A02304B60787}"="DCOM Server 60787" "{2C1CD3D7-86AC-4068-93BC-A02304B37389}"="DCOM Server 37389" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks] "{57B86673-276A-48B2-BAE7-C6DBB3020EB8}"="AVG Anti-Spyware 7.5" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "DisableTaskMgr"=dword:00000000 [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system] "NoDispAppearancePage"=dword:00000000 "NoColorChoice"=dword:00000000 "NoSizeChoice"=dword:00000000 "NoDispBackgroundPage"=dword:00000000 "NoDispScrSavPage"=dword:00000000 "NoDispCPL"=dword:00000000 "NoVisualStyleChoice"=dword:00000000 "NoDispSettingsPage"=dword:00000000 [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer] "NoActiveDesktopChanges"=dword:00000000 [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer\run] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] "NoSaveSettings"=dword:00000000 "NoThemesTab"=dword:00000000 [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\Run] [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders] "SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll" [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Svchost] HTTPFilter REG_MULTI_SZ HTTPFilter\0\0 LocalService REG_MULTI_SZ Alerter\0WebClient\0LmHosts\0RemoteRegistry\0upnphost\0SSDPSRV\0\0 NetworkService REG_MULTI_SZ DnsCache\0\0 DcomLaunch REG_MULTI_SZ DcomLaunch\0TermService\0\0 rpcss REG_MULTI_SZ RpcSs\0\0 imgsvc REG_MULTI_SZ StiSvc\0\0 termsvcs REG_MULTI_SZ TermService\0\0 [HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\D] Shell\AutoRun\command D:\SETUP.EXE Completion time: 07-02-01 22:15:40 C:\ComboFix2.txt ... 07-02-01 13:07 C:\ComboFix3.txt ... 07-02-01 12:36

Aqui napisał(a):poczytaj:

a możesz wkleić to na forum ? bo trzeba się rejestrować

Aqui napisał(a):Masz WWDC ??

mam...

co do tego Gmer'a... macie screena na dowód że w zakładce Rootkit nie mam opcji Szukaj

nie no wymiękam... już mam dość... i to by było chyba na tyle... tylko (?) format c: mi pozostał... ale jak ktoś ma jeszcze jakiś pomysł to niech napisze

Dziękuję wszystkim za pomoc i poświęcony czas

**Posty:** 935 · przez **Aqui** 02 Lut 2007, 00:35

Wez okno gmera do pelnych rozmiarow,szukaj sie pojawi....

**Posty:** 4644 · przez **Wariat** 02 Lut 2007, 00:39

Aqui napisał(a):Wez okno gmera do pelnych rozmiarow

ono jest w pełnych rozmiarach :wink:

większe już nie będzie

wszystko przez roździelczośc...

**Posty:** 8694 · przez **Red** 02 Lut 2007, 09:19

sciagnij starszą wersje,o numer mniejszą i sprawdz zakładkę

i nie wiem czy juz było,ale zastosuj rowniez:

http://www.f-secure.com/exclude/blacklight/index.shtml

moze cos znajdzie?

**Posty:** 4644 · przez **Wariat** 02 Lut 2007, 14:34

Red napisał(a):sciagnij starszą wersje,o numer mniejszą i sprawdz zakładkę

sorry... ale można prosić linka do niej ? bo net tak mi chodzi że na poniedziałek bym google może bym zdążył znaleźć

a co do

i nie wiem czy juz było,ale zastosuj rowniez:

http://www.f-secure.com/exclude/blacklight/index.shtml

Nie udało się nawiązać połączenia :roll:

**Posty:** 8694 · przez **Red** 02 Lut 2007, 14:37

http://www.gmer.net/files.php?lang=pl

na dole masz

**Posty:** 4644 · przez **Wariat** 02 Lut 2007, 14:46

Red napisał(a):http://www.gmer.net/files.php?lang=pl

na dole masz

no mam.. zassałem... zaznaczułem w rootkit usługi oraz pokaz wszystki i dałem szukaj... ale jak mam Wam to wkleić na forum? nie moge skopiować tego :roll:

i odrazu dodam że opcji Kopiuj tez nie widze... moze jest ale wychodzi po za ekran

**Posty:** 8694 · przez **Red** 02 Lut 2007, 15:17

nie mozesz sobie kupic nowego monitora <rotfl>

CTRL+V i wklej do posta

**Posty:** 4644 · przez **Wariat** 02 Lut 2007, 15:25

Red napisał(a):nie mozesz sobie kupic nowego monitora rotfl rotfl

nie

Red napisał(a):CTRL+V i wklej do posta

kurde Red nie rozumiesz mnie... patrz

i jak mam to zaznaczyć wszystko aby wkleić na forum :idea:

**Posty:** 8694 · przez **Red** 02 Lut 2007, 15:32

sciagnij obudowe monitora,powinno byc pod plastikiem :mrgreen:

masz to:

http://www.billsway.com/vbspage/vbsfiles/RegSrch.zip

sciagnij ,odpal i daj na wyszukiwanie:

wsys.dll

wklej to co znajdzie na forum

**Posty:** 4644 · przez **Wariat** 02 Lut 2007, 15:38

Red napisał(a):sciagnij obudowe monitora,powinno byc pod plastikiem

<rotfl>

Red napisał(a):wklej to co znajdzie na forum

Search comleted in 12 seconds.

No instantes of "wsys.dll" found

[ Dodano: Dzisiaj o 14:56 ]
pomogli mi na innym forum z Gmer'em

zachwilę dam log

[ Dodano: Dzisiaj o 15:03 ]

Kod: Zaznacz wszystko: GMER 1.0.11.11390 - http://www.gmer.net Rootkit 2007-02-02 14:51:41 Windows 5.1.2600 Dodatek Service Pack 2 ---- System - GMER 1.0.11 ---- SSDT kl1.sys ZwOpenFile ---- Threads - GMER 1.0.11 ---- Thread 4:108 8129D3E0 Thread 4:112 8129D3E0 Thread 4:116 81276820 Thread 4:120 81276820 Thread 4:124 81276820 Thread 4:396 8129D3E0 Thread 4:464 8129D3E0 ---- Files - GMER 1.0.11 ---- ADS C:\!KillBox\Logs\kb.log:KAVICHS ADS C:\avenger\backup.zip:KAVICHS ADS C:\avenger.txt:KAVICHS ADS C:\boot.ini:KAVICHS ADS C:\ComboFix2.txt:KAVICHS ADS C:\ComboFix3.txt:KAVICHS ADS C:\Documents and Settings\Administrator\Dane aplikacji\desktop.ini:KAVICHS ADS C:\Documents and Settings\Administrator\Dane aplikacji\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\settings.sol:KAVICHS ADS C:\Documents and Settings\Administrator\Dane aplikacji\Microsoft\37389.dat:KAVICHS ADS C:\Documents and Settings\Administrator\Dane aplikacji\Microsoft\60787.dat:KAVICHS ADS C:\Documents and Settings\Administrator\Dane aplikacji\Microsoft\Internet Explorer\brndlog.bak:KAVICHS ADS ... ADS C:\Documents and Settings\Administrator\NTUSER.DAT:KAVICHS ADS C:\Documents and Settings\Administrator\NTUSER.DAT.LOG:KAVICHS ADS C:\Documents and Settings\Administrator\Ustawienia lokalne\Dane aplikacji\Microsoft\Windows\UsrClass.dat:KAVICHS ADS C:\Documents and Settings\Administrator\Ustawienia lokalne\Dane aplikacji\Microsoft\Windows\UsrClass.dat.LOG:KAVICHS ---- EOF - GMER 1.0.11 ----

Kod: Zaznacz wszystko: GMER 1.0.11.11390 - http://www.gmer.net Rootkit 2007-02-02 14:52:46 Windows 5.1.2600 Dodatek Service Pack 2 ---- Services - GMER 1.0.11 ---- Service [DISABLED] Abiosdsk Service [DISABLED] abp480n5 Service C:\WINDOWS\system32\DRIVERS\ACPI.sys [BOOT] ACPI Service [DISABLED] ACPIEC Service [DISABLED] adpu160m Service C:\WINDOWS\system32\drivers\aec.sys [MANUAL] aec Service C:\WINDOWS\System32\drivers\afd.sys [SYSTEM] AFD Service C:\WINDOWS\system32\DRIVERS\agp440.sys [BOOT] agp440 Service [DISABLED] Aha154x Service [DISABLED] aic78u2 Service [DISABLED] aic78xx Service C:\WINDOWS\system32\svchost.exe [DISABLED] Alerter Service C:\WINDOWS\System32\alg.exe [MANUAL] ALG Service [DISABLED] AliIde Service [DISABLED] amsint Service C:\WINDOWS\system32\svchost.exe [MANUAL] AppMgmt Service [DISABLED] asc Service [DISABLED] asc3350p Service [DISABLED] asc3550 Service C:\WINDOWS\system32\DRIVERS\asyncmac.sys [MANUAL] AsyncMac Service C:\WINDOWS\system32\DRIVERS\atapi.sys [BOOT] atapi Service [DISABLED] Atdisk Service C:\WINDOWS\system32\DRIVERS\atmarpc.sys [MANUAL] Atmarpc Service C:\WINDOWS\System32\svchost.exe [AUTO] AudioSrv Service C:\WINDOWS\system32\DRIVERS\audstub.sys [MANUAL] audstub Service C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.sys [SYSTEM] AVG Anti-Spyware Driver Service C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe [AUTO] AVG Anti-Spyware Guard Service C:\WINDOWS\System32\DRIVERS\AvgAsCln.sys [SYSTEM] AvgAsCln Service BattC Service [SYSTEM] Beep Service C:\WINDOWS\system32\svchost.exe [AUTO] BITS Service C:\WINDOWS\system32\svchost.exe [AUTO] Browser Service [DISABLED] cbidf2k Service [DISABLED] cd20xrnt Service [SYSTEM] Cdaudio Service [DISABLED] Cdfs Service C:\WINDOWS\system32\DRIVERS\cdrom.sys [SYSTEM] Cdrom Service [SYSTEM] Changer Service C:\WINDOWS\system32\cisvc.exe [MANUAL] CiSvc Service C:\WINDOWS\system32\clipsrv.exe [DISABLED] ClipSrv Service [DISABLED] CmdIde Service C:\WINDOWS\system32\drivers\cmuda.sys [MANUAL] cmuda Service C:\WINDOWS\system32\dllhost.exe [MANUAL] COMSysApp Service ContentFilter Service ContentIndex Service [DISABLED] Cpqarray Service C:\WINDOWS\system32\svchost.exe [AUTO] CryptSvc Service [DISABLED] dac2w2k Service [DISABLED] dac960nt Service C:\WINDOWS\system32\svchost.exe [AUTO] DcomLaunch Service C:\WINDOWS\System32\Drivers\DgiVecp.sys [AUTO] DgiVecp Service C:\WINDOWS\system32\svchost.exe [AUTO] Dhcp Service C:\WINDOWS\system32\DRIVERS\disk.sys [BOOT] Disk Service C:\WINDOWS\System32\dmadmin.exe [MANUAL] dmadmin Service C:\WINDOWS\System32\drivers\dmboot.sys [DISABLED] dmboot Service C:\WINDOWS\System32\drivers\dmio.sys [BOOT] dmio Service C:\WINDOWS\System32\drivers\dmload.sys [BOOT] dmload Service C:\WINDOWS\System32\svchost.exe [AUTO] dmserver Service C:\WINDOWS\system32\drivers\DMusic.sys [MANUAL] DMusic Service C:\WINDOWS\system32\svchost.exe [AUTO] Dnscache Service [DISABLED] dpti2o Service C:\WINDOWS\system32\drivers\drmkaud.sys [MANUAL] drmkaud Service C:\WINDOWS\System32\svchost.exe [AUTO] ERSvc Service C:\WINDOWS\system32\services.exe [AUTO] Eventlog Service C:\WINDOWS\system32\svchost.exe [MANUAL] EventSystem Service C:\WINDOWS\system32\main.sys [SYSTEM] EXAMPLE Service [DISABLED] Fastfat Service C:\WINDOWS\System32\svchost.exe [MANUAL] FastUserSwitchingCompatibility Service C:\WINDOWS\system32\DRIVERS\fdc.sys [MANUAL] Fdc Service C:\WINDOWS\system32\DRIVERS\FETND5A.SYS [MANUAL] FETNDIS Service [SYSTEM] Fips Service C:\WINDOWS\system32\DRIVERS\flpydisk.sys [MANUAL] Flpydisk Service C:\WINDOWS\system32\DRIVERS\fltMgr.sys [BOOT] FltMgr Service [SYSTEM] Fs_Rec Service C:\WINDOWS\system32\DRIVERS\ftdisk.sys [BOOT] Ftdisk Service C:\WINDOWS\System32\DRIVERS\gmer.sys [MANUAL] gmer Service C:\WINDOWS\system32\DRIVERS\msgpc.sys [MANUAL] Gpc Service C:\WINDOWS\System32\svchost.exe [AUTO] helpsvc Service C:\WINDOWS\System32\svchost.exe [AUTO] HidServ Service C:\WINDOWS\system32\DRIVERS\hidusb.sys [MANUAL] hidusb Service [DISABLED] hpn Service C:\WINDOWS\System32\Drivers\HTTP.sys [MANUAL] HTTP Service C:\WINDOWS\System32\svchost.exe [MANUAL] HTTPFilter Service [SYSTEM] i2omgmt Service [DISABLED] i2omp Service C:\WINDOWS\system32\DRIVERS\i8042prt.sys [SYSTEM] i8042prt Service C:\WINDOWS\system32\DRIVERS\imapi.sys [SYSTEM] Imapi Service C:\WINDOWS\system32\imapi.exe [MANUAL] ImapiService Service C:\DOCUME~1\ADMINI~1\USTAWI~1\Temp\IN.exe [DISABLED] IN Service inetaccs Service [DISABLED] ini910u Service Inport Service C:\WINDOWS\system32\DRIVERS\intelide.sys [BOOT] IntelIde Service C:\WINDOWS\system32\DRIVERS\Ip6Fw.sys [MANUAL] Ip6Fw Service C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys [MANUAL] IpFilterDriver Service C:\WINDOWS\system32\DRIVERS\ipinip.sys [MANUAL] IpInIp Service C:\WINDOWS\system32\DRIVERS\ipnat.sys [MANUAL] IpNat Service C:\WINDOWS\system32\DRIVERS\ipsec.sys [SYSTEM] IPSec Service C:\WINDOWS\system32\DRIVERS\irda.sys [AUTO] irda Service C:\WINDOWS\system32\DRIVERS\irenum.sys [MANUAL] IRENUM Service C:\WINDOWS\system32\svchost.exe [AUTO] Irmon Service C:\WINDOWS\system32\DRIVERS\irsir.sys [MANUAL] irsir Service ISAPISearch Service C:\WINDOWS\system32\DRIVERS\isapnp.sys [BOOT] isapnp Service C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\kavsvc.exe [AUTO] kavsvc Service C:\WINDOWS\system32\DRIVERS\kbdclass.sys [SYSTEM] Kbdclass Service C:\WINDOWS\system32\DRIVERS\kbdhid.sys [SYSTEM] kbdhid Service C:\WINDOWS\System32\drivers\kl1.sys [BOOT] Kl1 Service C:\WINDOWS\System32\drivers\klif.sys [SYSTEM] Klif Service C:\WINDOWS\System32\drivers\klmc.sys [SYSTEM] Klmc Service C:\WINDOWS\system32\drivers\kmixer.sys [MANUAL] kmixer Service [BOOT] KSecDD Service C:\WINDOWS\system32\svchost.exe [AUTO] lanmanserver Service C:\WINDOWS\system32\svchost.exe [AUTO] lanmanworkstation Service [SYSTEM] lbrtfdc Service ldap Service ldaps Service LicenseService Service C:\WINDOWS\system32\svchost.exe [AUTO] LmHosts Service C:\WINDOWS\system32\svchost.exe [DISABLED] Messenger Service [SYSTEM] mnmdd Service C:\WINDOWS\system32\mnmsrvc.exe [MANUAL] mnmsrvc Service [MANUAL] Modem Service C:\WINDOWS\system32\DRIVERS\mouclass.sys [SYSTEM] Mouclass Service C:\WINDOWS\system32\DRIVERS\mouhid.sys [MANUAL] mouhid Service [BOOT] MountMgr Service [DISABLED] mraid35x Service C:\WINDOWS\system32\DRIVERS\mrxdav.sys [MANUAL] MRxDAV Service C:\WINDOWS\system32\DRIVERS\mrxsmb.sys [SYSTEM] MRxSmb Service C:\WINDOWS\system32\msdtc.exe [MANUAL] MSDTC Service [SYSTEM] Msfs Service C:\WINDOWS\system32\msiexec.exe [MANUAL] MSIServer Service C:\WINDOWS\system32\drivers\MSKSSRV.sys [MANUAL] MSKSSRV Service C:\WINDOWS\system32\drivers\MSPCLOCK.sys [MANUAL] MSPCLOCK Service C:\WINDOWS\system32\drivers\MSPQM.sys [MANUAL] MSPQM Service C:\WINDOWS\system32\DRIVERS\mssmbios.sys [MANUAL] mssmbios Service [BOOT] Mup Service C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe [MANUAL] NBService Service [BOOT] NDIS Service C:\WINDOWS\system32\DRIVERS\ndistapi.sys [MANUAL] NdisTapi Service C:\WINDOWS\system32\DRIVERS\ndisuio.sys [MANUAL] Ndisuio Service C:\WINDOWS\system32\DRIVERS\ndiswan.sys [MANUAL] NdisWan Service [MANUAL] NDProxy Service C:\WINDOWS\system32\DRIVERS\netbios.sys [SYSTEM] NetBIOS Service C:\WINDOWS\system32\DRIVERS\netbt.sys [MANUAL] NetBT Service C:\WINDOWS\system32\netdde.exe [DISABLED] NetDDE Service C:\WINDOWS\system32\netdde.exe [DISABLED] NetDDEdsdm Service C:\WINDOWS\system32\lsass.exe [MANUAL] Netlogon Service C:\WINDOWS\System32\svchost.exe [MANUAL] Netman Service C:\WINDOWS\system32\svchost.exe [MANUAL] Nla Service [SYSTEM] Npfs Service [DISABLED] Ntfs Service C:\WINDOWS\system32\lsass.exe [MANUAL] NtLmSsp Service C:\WINDOWS\system32\svchost.exe [MANUAL] NtmsSvc Service [SYSTEM] Null Service C:\WINDOWS\system32\DRIVERS\nv4_mini.sys [MANUAL] nv Service C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys [MANUAL] NwlnkFlt Service C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys [MANUAL] NwlnkFwd Service C:\WINDOWS\system32\DRIVERS\parport.sys [MANUAL] Parport Service [BOOT] PartMgr Service [AUTO] ParVdm Service C:\WINDOWS\system32\DRIVERS\pci.sys [BOOT] PCI Service [SYSTEM] PCIDump Service [BOOT] PCIIde Service [DISABLED] Pcmcia Service [MANUAL] PDCOMP Service [MANUAL] PDFRAME Service [MANUAL] PDRELI Service [MANUAL] PDRFRAME Service [DISABLED] perc2 Service [DISABLED] perc2hib Service PerfDisk Service PerfNet Service PerfOS Service PerfProc Service C:\WINDOWS\system32\services.exe [AUTO] PlugPlay Service C:\WINDOWS\system32\lsass.exe [AUTO] PolicyAgent Service C:\WINDOWS\system32\DRIVERS\raspptp.sys [MANUAL] PptpMiniport Service C:\WINDOWS\system32\DRIVERS\processr.sys [SYSTEM] Processor Service C:\WINDOWS\system32\lsass.exe [AUTO] ProtectedStorage Service C:\WINDOWS\system32\DRIVERS\psched.sys [MANUAL] PSched Service C:\WINDOWS\system32\DRIVERS\ptilink.sys [MANUAL] Ptilink Service C:\WINDOWS\System32\Drivers\PxHelp20.sys [BOOT] PxHelp20 Service [DISABLED] ql1080 Service [DISABLED] Ql10wnt Service [DISABLED] ql12160 Service [DISABLED] ql1240 Service [DISABLED] ql1280 Service C:\WINDOWS\system32\DRIVERS\rasacd.sys [SYSTEM] RasAcd Service C:\WINDOWS\system32\svchost.exe [MANUAL] RasAuto Service C:\WINDOWS\system32\DRIVERS\rasirda.sys [MANUAL] Rasirda Service C:\WINDOWS\system32\DRIVERS\rasl2tp.sys [MANUAL] Rasl2tp Service C:\WINDOWS\system32\svchost.exe [MANUAL] RasMan Service C:\WINDOWS\system32\DRIVERS\raspppoe.sys [MANUAL] RasPppoe Service C:\WINDOWS\system32\DRIVERS\raspti.sys [MANUAL] Raspti Service C:\WINDOWS\system32\DRIVERS\rdbss.sys [SYSTEM] Rdbss Service C:\WINDOWS\System32\DRIVERS\RDPCDD.sys [SYSTEM] RDPCDD Service RDPDD Service C:\WINDOWS\system32\DRIVERS\rdpdr.sys [MANUAL] rdpdr Service RDPNP Service [MANUAL] RDPWD Service C:\WINDOWS\system32\sessmgr.exe [MANUAL] RDSessMgr Service C:\WINDOWS\system32\DRIVERS\redbook.sys [SYSTEM] redbook Service C:\WINDOWS\system32\svchost.exe [DISABLED] RemoteAccess Service C:\WINDOWS\system32\svchost.exe [AUTO] RemoteRegistry Service C:\WINDOWS\system32\locator.exe [MANUAL] RpcLocator Service C:\WINDOWS\system32\svchost.exe [AUTO] RpcSs Service C:\WINDOWS\system32\rsvp.exe [MANUAL] RSVP Service C:\WINDOWS\system32\DRIVERS\RTL8139.SYS [MANUAL] rtl8139 Service C:\WINDOWS\system32\lsass.exe [AUTO] SamSs Service C:\WINDOWS\System32\SCardSvr.exe [MANUAL] SCardSvr Service C:\WINDOWS\System32\svchost.exe [AUTO] Schedule Service C:\WINDOWS\system32\DRIVERS\secdrv.sys [MANUAL] Secdrv Service C:\WINDOWS\System32\svchost.exe [AUTO] seclogon Service C:\WINDOWS\system32\svchost.exe [AUTO] SENS Service C:\WINDOWS\system32\DRIVERS\SER120.sys [MANUAL] SER120 Service C:\WINDOWS\system32\DRIVERS\serenum.sys [MANUAL] serenum Service C:\WINDOWS\system32\DRIVERS\serial.sys [SYSTEM] Serial Service [SYSTEM] Sfloppy Service SharedAccess Service C:\WINDOWS\System32\svchost.exe [AUTO] ShellHWDetection Service [DISABLED] Simbad Service [DISABLED] Sparrow Service C:\WINDOWS\system32\drivers\splitter.sys [MANUAL] splitter Service C:\WINDOWS\system32\spoolsv.exe [AUTO] Spooler Service C:\WINDOWS\system32\DRIVERS\sr.sys [DISABLED] sr Service C:\WINDOWS\system32\svchost.exe [AUTO] srservice Service C:\WINDOWS\system32\DRIVERS\srv.sys [MANUAL] Srv Service C:\WINDOWS\system32\svchost.exe [MANUAL] SSDPSRV Service C:\WINDOWS\system32\svchost.exe [AUTO] stisvc Service C:\WINDOWS\system32\DRIVERS\swenum.sys [MANUAL] swenum Service C:\WINDOWS\system32\drivers\swmidi.sys [MANUAL] swmidi Service C:\WINDOWS\system32\dllhost.exe [MANUAL] SwPrv Service [DISABLED] symc810 Service [DISABLED] symc8xx Service [DISABLED] sym_hi Service [DISABLED] sym_u3 Service C:\WINDOWS\system32\drivers\sysaudio.sys [MANUAL] sysaudio Service C:\WINDOWS\system32\smlogsvc.exe [MANUAL] SysmonLog Service C:\WINDOWS\System32\svchost.exe [MANUAL] TapiSrv Service C:\WINDOWS\system32\DRIVERS\tcpip.sys [SYSTEM] Tcpip Service [MANUAL] TDPIPE Service [MANUAL] TDTCP Service C:\WINDOWS\system32\DRIVERS\termdd.sys [SYSTEM] TermDD Service C:\WINDOWS\System32\svchost.exe [MANUAL] TermService Service C:\WINDOWS\System32\svchost.exe [AUTO] Themes Service C:\WINDOWS\system32\tlntsvr.exe [DISABLED] TlntSvr Service [DISABLED] TosIde Service C:\WINDOWS\system32\svchost.exe [AUTO] TrkWks Service TSDDD Service [DISABLED] Udfs Service [DISABLED] ultra Service C:\WINDOWS\system32\DRIVERS\update.sys [MANUAL] Update Service C:\WINDOWS\system32\svchost.exe [MANUAL] upnphost Service C:\WINDOWS\System32\ups.exe [MANUAL] UPS Service C:\WINDOWS\system32\DRIVERS\usbccgp.sys [MANUAL] usbccgp Service C:\WINDOWS\system32\DRIVERS\usbehci.sys [MANUAL] usbehci Service C:\WINDOWS\system32\DRIVERS\usbhub.sys [MANUAL] usbhub Service C:\WINDOWS\system32\DRIVERS\usbprint.sys [MANUAL] usbprint Service C:\WINDOWS\system32\DRIVERS\usbscan.sys [MANUAL] usbscan Service C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [MANUAL] USBSTOR Service C:\WINDOWS\system32\DRIVERS\usbuhci.sys [MANUAL] usbuhci Service C:\WINDOWS\System32\drivers\vga.sys [SYSTEM] VgaSave Service [DISABLED] ViaIde Service [BOOT] VolSnap Service C:\WINDOWS\System32\vssvc.exe [MANUAL] VSS Service C:\WINDOWS\System32\svchost.exe [AUTO] W32Time Service W3SVC Service C:\WINDOWS\system32\DRIVERS\wanarp.sys [MANUAL] Wanarp Service [MANUAL] WDICA Service C:\WINDOWS\system32\drivers\wdmaud.sys [MANUAL] wdmaud Service C:\WINDOWS\system32\svchost.exe [AUTO] WebClient Service C:\WINDOWS\system32\svchost.exe [AUTO] winmgmt Service [MANUAL] Winsock Service [MANUAL] Winsock - Google Desktop Search Backup Before First Install Service [MANUAL] Winsock - Google Desktop Search Backup Before Last Install Service WinSock2 Service Winsock2 - Google Desktop Search Backup Before First Install Service Winsock2 - Google Desktop Search Backup Before Last Install Service WinTrust Service C:\DOCUME~1\ADMINI~1\USTAWI~1\Temp\WKLTSPV.exe [DISABLED] WKLTSPV Service C:\WINDOWS\System32\svchost.exe [MANUAL] WmdmPmSN Service C:\WINDOWS\System32\svchost.exe [MANUAL] Wmi Service WmiApRpl Service C:\WINDOWS\system32\wbem\wmiapsrv.exe [MANUAL] WmiApSrv Service [SYSTEM] WS2IFSL Service C:\WINDOWS\system32\svchost.exe [AUTO] wuauserv Service C:\WINDOWS\System32\svchost.exe [AUTO] WZCSVC Service C:\WINDOWS\System32\svchost.exe [MANUAL] xmlprov Service {0B4FEF38-DFC2-4081-A2C3-8948144D25FD} Service {E482CB19-6E0C-4568-8E51-FB58B341FB85} ---- EOF - GMER 1.0.11 ----

**Posty:** 8694 · przez **Red** 02 Lut 2007, 16:16

nie widac wszystkiego,jesli juz mozesz odpalic gmera i widzisz wszystko,to moze lepiej bedzie zobaczyc log z najnowszej wersji

Autor postu otrzymał pochwałę

**Posty:** 4644 · przez **Wariat** 02 Lut 2007, 16:24

i tu pojawia się znowu problem... gdyż w wersji 1.0.12 nie moge tego zrobić :roll:

**Posty:** 8694 · przez **Red** 02 Lut 2007, 16:26

a tam gdzie jestes nie pomogą?Zapytaj

**Posty:** 4644 · przez **Wariat** 03 Lut 2007, 14:54

heh... i znów się udało

Kod: Zaznacz wszystko: GMER 1.0.12.12011 - http://www.gmer.net Rootkit scan 2007-02-02 15:29:55 Windows 5.1.2600 Dodatek Service Pack 2 ---- System - GMER 1.0.12 ---- SSDT kl1.sys ZwOpenFile ---- Threads - GMER 1.0.12 ---- Thread 4:108 8129D3E0 Thread 4:112 8129D3E0 Thread 4:116 81276820 Thread 4:120 81276820 Thread 4:124 81276820 Thread 4:396 8129D3E0 Thread 4:464 8129D3E0 ---- Files - GMER 1.0.12 ---- ADS C:\!KillBox\Logs\kb.log:KAVICHS ADS C:\avenger\backup.zip:KAVICHS ADS C:\avenger.txt:KAVICHS ADS C:\boot.ini:KAVICHS ADS C:\ComboFix2.txt:KAVICHS ADS C:\ComboFix3.txt:KAVICHS ADS C:\Documents and Settings\Administrator\Dane aplikacji\desktop.ini:KAVICHS ADS C:\Documents and Settings\Administrator\Dane aplikacji\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\settings.sol:KAVICHS ADS C:\Documents and Settings\Administrator\Dane aplikacji\Microsoft\37389.dat:KAVICHS ADS C:\Documents and Settings\Administrator\Dane aplikacji\Microsoft\60787.dat:KAVICHS ADS C:\Documents and Settings\Administrator\Dane aplikacji\Microsoft\Internet Explorer\brndlog.bak:KAVICHS ADS ... ADS C:\Documents and Settings\Administrator\NTUSER.DAT:KAVICHS ADS C:\Documents and Settings\Administrator\NTUSER.DAT.LOG:KAVICHS ADS C:\Documents and Settings\Administrator\Ustawienia lokalne\Dane aplikacji\Microsoft\Windows\UsrClass.dat:KAVICHS ADS C:\Documents and Settings\Administrator\Ustawienia lokalne\Dane aplikacji\Microsoft\Windows\UsrClass.dat.LOG:KAVICHS ---- EOF - GMER 1.0.12 ----

Kod: Zaznacz wszystko: GMER 1.0.12.12011 - http://www.gmer.net Rootkit scan 2007-02-02 15:30:09 Windows 5.1.2600 Dodatek Service Pack 2 ---- Services - GMER 1.0.12 ---- Service [DISABLED] Abiosdsk Service [DISABLED] abp480n5 Service C:\WINDOWS\system32\DRIVERS\ACPI.sys [BOOT] ACPI Service [DISABLED] ACPIEC Service [DISABLED] adpu160m Service C:\WINDOWS\system32\drivers\aec.sys [MANUAL] aec Service C:\WINDOWS\System32\drivers\afd.sys [SYSTEM] AFD Service C:\WINDOWS\system32\DRIVERS\agp440.sys [BOOT] agp440 Service [DISABLED] Aha154x Service [DISABLED] aic78u2 Service [DISABLED] aic78xx Service C:\WINDOWS\system32\svchost.exe [DISABLED] Alerter Service C:\WINDOWS\System32\alg.exe [MANUAL] ALG Service [DISABLED] AliIde Service [DISABLED] amsint Service C:\WINDOWS\system32\svchost.exe [MANUAL] AppMgmt Service [DISABLED] asc Service [DISABLED] asc3350p Service [DISABLED] asc3550 Service C:\WINDOWS\system32\DRIVERS\asyncmac.sys [MANUAL] AsyncMac Service C:\WINDOWS\system32\DRIVERS\atapi.sys [BOOT] atapi Service [DISABLED] Atdisk Service C:\WINDOWS\system32\DRIVERS\atmarpc.sys [MANUAL] Atmarpc Service C:\WINDOWS\System32\svchost.exe [AUTO] AudioSrv Service C:\WINDOWS\system32\DRIVERS\audstub.sys [MANUAL] audstub Service C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.sys [SYSTEM] AVG Anti-Spyware Driver Service C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe [AUTO] AVG Anti-Spyware Guard Service C:\WINDOWS\System32\DRIVERS\AvgAsCln.sys [SYSTEM] AvgAsCln Service BattC Service [SYSTEM] Beep Service C:\WINDOWS\system32\svchost.exe [AUTO] BITS Service C:\WINDOWS\system32\svchost.exe [AUTO] Browser Service [DISABLED] cbidf2k Service [DISABLED] cd20xrnt Service [SYSTEM] Cdaudio Service [DISABLED] Cdfs Service C:\WINDOWS\system32\DRIVERS\cdrom.sys [SYSTEM] Cdrom Service [SYSTEM] Changer Service C:\WINDOWS\system32\cisvc.exe [MANUAL] CiSvc Service C:\WINDOWS\system32\clipsrv.exe [DISABLED] ClipSrv Service [DISABLED] CmdIde Service C:\WINDOWS\system32\drivers\cmuda.sys [MANUAL] cmuda Service C:\WINDOWS\system32\dllhost.exe [MANUAL] COMSysApp Service ContentFilter Service ContentIndex Service [DISABLED] Cpqarray Service C:\WINDOWS\system32\svchost.exe [AUTO] CryptSvc Service [DISABLED] dac2w2k Service [DISABLED] dac960nt Service C:\WINDOWS\system32\svchost.exe [AUTO] DcomLaunch Service C:\WINDOWS\System32\Drivers\DgiVecp.sys [AUTO] DgiVecp Service C:\WINDOWS\system32\svchost.exe [AUTO] Dhcp Service C:\WINDOWS\system32\DRIVERS\disk.sys [BOOT] Disk Service C:\WINDOWS\System32\dmadmin.exe [MANUAL] dmadmin Service C:\WINDOWS\System32\drivers\dmboot.sys [DISABLED] dmboot Service C:\WINDOWS\System32\drivers\dmio.sys [BOOT] dmio Service C:\WINDOWS\System32\drivers\dmload.sys [BOOT] dmload Service C:\WINDOWS\System32\svchost.exe [AUTO] dmserver Service C:\WINDOWS\system32\drivers\DMusic.sys [MANUAL] DMusic Service C:\WINDOWS\system32\svchost.exe [AUTO] Dnscache Service [DISABLED] dpti2o Service C:\WINDOWS\system32\drivers\drmkaud.sys [MANUAL] drmkaud Service C:\WINDOWS\System32\svchost.exe [AUTO] ERSvc Service C:\WINDOWS\system32\services.exe [AUTO] Eventlog Service C:\WINDOWS\system32\svchost.exe [MANUAL] EventSystem Service C:\WINDOWS\system32\main.sys [SYSTEM] EXAMPLE Service [DISABLED] Fastfat Service C:\WINDOWS\System32\svchost.exe [MANUAL] FastUserSwitchingCompatibility Service C:\WINDOWS\system32\DRIVERS\fdc.sys [MANUAL] Fdc Service C:\WINDOWS\system32\DRIVERS\FETND5A.SYS [MANUAL] FETNDIS Service [SYSTEM] Fips Service C:\WINDOWS\system32\DRIVERS\flpydisk.sys [MANUAL] Flpydisk Service C:\WINDOWS\system32\DRIVERS\fltMgr.sys [BOOT] FltMgr Service [SYSTEM] Fs_Rec Service C:\WINDOWS\system32\DRIVERS\ftdisk.sys [BOOT] Ftdisk Service C:\WINDOWS\System32\DRIVERS\gmer.sys [MANUAL] gmer Service C:\WINDOWS\system32\DRIVERS\msgpc.sys [MANUAL] Gpc Service C:\WINDOWS\System32\svchost.exe [AUTO] helpsvc Service C:\WINDOWS\System32\svchost.exe [AUTO] HidServ Service C:\WINDOWS\system32\DRIVERS\hidusb.sys [MANUAL] hidusb Service [DISABLED] hpn Service C:\WINDOWS\System32\Drivers\HTTP.sys [MANUAL] HTTP Service C:\WINDOWS\System32\svchost.exe [MANUAL] HTTPFilter Service [SYSTEM] i2omgmt Service [DISABLED] i2omp Service C:\WINDOWS\system32\DRIVERS\i8042prt.sys [SYSTEM] i8042prt Service C:\WINDOWS\system32\DRIVERS\imapi.sys [SYSTEM] Imapi Service C:\WINDOWS\system32\imapi.exe [MANUAL] ImapiService Service C:\DOCUME~1\ADMINI~1\USTAWI~1\Temp\IN.exe [DISABLED] IN Service inetaccs Service [DISABLED] ini910u Service Inport Service C:\WINDOWS\system32\DRIVERS\intelide.sys [BOOT] IntelIde Service C:\WINDOWS\system32\DRIVERS\Ip6Fw.sys [MANUAL] Ip6Fw Service C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys [MANUAL] IpFilterDriver Service C:\WINDOWS\system32\DRIVERS\ipinip.sys [MANUAL] IpInIp Service C:\WINDOWS\system32\DRIVERS\ipnat.sys [MANUAL] IpNat Service C:\WINDOWS\system32\DRIVERS\ipsec.sys [SYSTEM] IPSec Service C:\WINDOWS\system32\DRIVERS\irda.sys [AUTO] irda Service C:\WINDOWS\system32\DRIVERS\irenum.sys [MANUAL] IRENUM Service C:\WINDOWS\system32\svchost.exe [AUTO] Irmon Service C:\WINDOWS\system32\DRIVERS\irsir.sys [MANUAL] irsir Service ISAPISearch Service C:\WINDOWS\system32\DRIVERS\isapnp.sys [BOOT] isapnp Service C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\kavsvc.exe [AUTO] kavsvc Service C:\WINDOWS\system32\DRIVERS\kbdclass.sys [SYSTEM] Kbdclass Service C:\WINDOWS\system32\DRIVERS\kbdhid.sys [SYSTEM] kbdhid Service C:\WINDOWS\System32\drivers\kl1.sys [BOOT] Kl1 Service C:\WINDOWS\System32\drivers\klif.sys [SYSTEM] Klif Service C:\WINDOWS\System32\drivers\klmc.sys [SYSTEM] Klmc Service C:\WINDOWS\system32\drivers\kmixer.sys [MANUAL] kmixer Service [BOOT] KSecDD Service C:\WINDOWS\system32\svchost.exe [AUTO] lanmanserver Service C:\WINDOWS\system32\svchost.exe [AUTO] lanmanworkstation Service [SYSTEM] lbrtfdc Service ldap Service ldaps Service LicenseService Service C:\WINDOWS\system32\svchost.exe [AUTO] LmHosts Service C:\WINDOWS\system32\svchost.exe [DISABLED] Messenger Service [SYSTEM] mnmdd Service C:\WINDOWS\system32\mnmsrvc.exe [MANUAL] mnmsrvc Service [MANUAL] Modem Service C:\WINDOWS\system32\DRIVERS\mouclass.sys [SYSTEM] Mouclass Service C:\WINDOWS\system32\DRIVERS\mouhid.sys [MANUAL] mouhid Service [BOOT] MountMgr Service [DISABLED] mraid35x Service C:\WINDOWS\system32\DRIVERS\mrxdav.sys [MANUAL] MRxDAV Service C:\WINDOWS\system32\DRIVERS\mrxsmb.sys [SYSTEM] MRxSmb Service C:\WINDOWS\system32\msdtc.exe [MANUAL] MSDTC Service [SYSTEM] Msfs Service C:\WINDOWS\system32\msiexec.exe [MANUAL] MSIServer Service C:\WINDOWS\system32\drivers\MSKSSRV.sys [MANUAL] MSKSSRV Service C:\WINDOWS\system32\drivers\MSPCLOCK.sys [MANUAL] MSPCLOCK Service C:\WINDOWS\system32\drivers\MSPQM.sys [MANUAL] MSPQM Service C:\WINDOWS\system32\DRIVERS\mssmbios.sys [MANUAL] mssmbios Service [BOOT] Mup Service C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe [MANUAL] NBService Service [BOOT] NDIS Service C:\WINDOWS\system32\DRIVERS\ndistapi.sys [MANUAL] NdisTapi Service C:\WINDOWS\system32\DRIVERS\ndisuio.sys [MANUAL] Ndisuio Service C:\WINDOWS\system32\DRIVERS\ndiswan.sys [MANUAL] NdisWan Service [MANUAL] NDProxy Service C:\WINDOWS\system32\DRIVERS\netbios.sys [SYSTEM] NetBIOS Service C:\WINDOWS\system32\DRIVERS\netbt.sys [MANUAL] NetBT Service C:\WINDOWS\system32\netdde.exe [DISABLED] NetDDE Service C:\WINDOWS\system32\netdde.exe [DISABLED] NetDDEdsdm Service C:\WINDOWS\system32\lsass.exe [MANUAL] Netlogon Service C:\WINDOWS\System32\svchost.exe [MANUAL] Netman Service C:\WINDOWS\system32\svchost.exe [MANUAL] Nla Service [SYSTEM] Npfs Service [DISABLED] Ntfs Service C:\WINDOWS\system32\lsass.exe [MANUAL] NtLmSsp Service C:\WINDOWS\system32\svchost.exe [MANUAL] NtmsSvc Service [SYSTEM] Null Service C:\WINDOWS\system32\DRIVERS\nv4_mini.sys [MANUAL] nv Service C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys [MANUAL] NwlnkFlt Service C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys [MANUAL] NwlnkFwd Service C:\WINDOWS\system32\DRIVERS\parport.sys [MANUAL] Parport Service [BOOT] PartMgr Service [AUTO] ParVdm Service C:\WINDOWS\system32\DRIVERS\pci.sys [BOOT] PCI Service [SYSTEM] PCIDump Service [BOOT] PCIIde Service [DISABLED] Pcmcia Service [MANUAL] PDCOMP Service [MANUAL] PDFRAME Service [MANUAL] PDRELI Service [MANUAL] PDRFRAME Service [DISABLED] perc2 Service [DISABLED] perc2hib Service PerfDisk Service PerfNet Service PerfOS Service PerfProc Service C:\WINDOWS\system32\services.exe [AUTO] PlugPlay Service C:\WINDOWS\system32\lsass.exe [AUTO] PolicyAgent Service C:\WINDOWS\system32\DRIVERS\raspptp.sys [MANUAL] PptpMiniport Service C:\WINDOWS\system32\DRIVERS\processr.sys [SYSTEM] Processor Service C:\WINDOWS\system32\lsass.exe [AUTO] ProtectedStorage Service C:\WINDOWS\system32\DRIVERS\psched.sys [MANUAL] PSched Service C:\WINDOWS\system32\DRIVERS\ptilink.sys [MANUAL] Ptilink Service C:\WINDOWS\System32\Drivers\PxHelp20.sys [BOOT] PxHelp20 Service [DISABLED] ql1080 Service [DISABLED] Ql10wnt Service [DISABLED] ql12160 Service [DISABLED] ql1240 Service [DISABLED] ql1280 Service C:\WINDOWS\system32\DRIVERS\rasacd.sys [SYSTEM] RasAcd Service C:\WINDOWS\system32\svchost.exe [MANUAL] RasAuto Service C:\WINDOWS\system32\DRIVERS\rasirda.sys [MANUAL] Rasirda Service C:\WINDOWS\system32\DRIVERS\rasl2tp.sys [MANUAL] Rasl2tp Service C:\WINDOWS\system32\svchost.exe [MANUAL] RasMan Service C:\WINDOWS\system32\DRIVERS\raspppoe.sys [MANUAL] RasPppoe Service C:\WINDOWS\system32\DRIVERS\raspti.sys [MANUAL] Raspti Service C:\WINDOWS\system32\DRIVERS\rdbss.sys [SYSTEM] Rdbss Service C:\WINDOWS\System32\DRIVERS\RDPCDD.sys [SYSTEM] RDPCDD Service RDPDD Service C:\WINDOWS\system32\DRIVERS\rdpdr.sys [MANUAL] rdpdr Service RDPNP Service [MANUAL] RDPWD Service C:\WINDOWS\system32\sessmgr.exe [MANUAL] RDSessMgr Service C:\WINDOWS\system32\DRIVERS\redbook.sys [SYSTEM] redbook Service C:\WINDOWS\system32\svchost.exe [DISABLED] RemoteAccess Service C:\WINDOWS\system32\svchost.exe [AUTO] RemoteRegistry Service C:\WINDOWS\system32\locator.exe [MANUAL] RpcLocator Service C:\WINDOWS\system32\svchost.exe [AUTO] RpcSs Service C:\WINDOWS\system32\rsvp.exe [MANUAL] RSVP Service C:\WINDOWS\system32\DRIVERS\RTL8139.SYS [MANUAL] rtl8139 Service C:\WINDOWS\system32\lsass.exe [AUTO] SamSs Service C:\WINDOWS\System32\SCardSvr.exe [MANUAL] SCardSvr Service C:\WINDOWS\System32\svchost.exe [AUTO] Schedule Service C:\WINDOWS\system32\DRIVERS\secdrv.sys [MANUAL] Secdrv Service C:\WINDOWS\System32\svchost.exe [AUTO] seclogon Service C:\WINDOWS\system32\svchost.exe [AUTO] SENS Service C:\WINDOWS\system32\DRIVERS\SER120.sys [MANUAL] SER120 Service C:\WINDOWS\system32\DRIVERS\serenum.sys [MANUAL] serenum Service C:\WINDOWS\system32\DRIVERS\serial.sys [SYSTEM] Serial Service [SYSTEM] Sfloppy Service SharedAccess Service C:\WINDOWS\System32\svchost.exe [AUTO] ShellHWDetection Service [DISABLED] Simbad Service [DISABLED] Sparrow Service C:\WINDOWS\system32\drivers\splitter.sys [MANUAL] splitter Service C:\WINDOWS\system32\spoolsv.exe [AUTO] Spooler Service C:\WINDOWS\system32\DRIVERS\sr.sys [DISABLED] sr Service C:\WINDOWS\system32\svchost.exe [AUTO] srservice Service C:\WINDOWS\system32\DRIVERS\srv.sys [MANUAL] Srv Service C:\WINDOWS\system32\svchost.exe [MANUAL] SSDPSRV Service C:\WINDOWS\system32\svchost.exe [AUTO] stisvc Service C:\WINDOWS\system32\DRIVERS\swenum.sys [MANUAL] swenum Service C:\WINDOWS\system32\drivers\swmidi.sys [MANUAL] swmidi Service C:\WINDOWS\system32\dllhost.exe [MANUAL] SwPrv Service [DISABLED] symc810 Service [DISABLED] symc8xx Service [DISABLED] sym_hi Service [DISABLED] sym_u3 Service C:\WINDOWS\system32\drivers\sysaudio.sys [MANUAL] sysaudio Service C:\WINDOWS\system32\smlogsvc.exe [MANUAL] SysmonLog Service C:\WINDOWS\System32\svchost.exe [MANUAL] TapiSrv Service C:\WINDOWS\system32\DRIVERS\tcpip.sys [SYSTEM] Tcpip Service [MANUAL] TDPIPE Service [MANUAL] TDTCP Service C:\WINDOWS\system32\DRIVERS\termdd.sys [SYSTEM] TermDD Service C:\WINDOWS\System32\svchost.exe [MANUAL] TermService Service C:\WINDOWS\System32\svchost.exe [AUTO] Themes Service C:\WINDOWS\system32\tlntsvr.exe [DISABLED] TlntSvr Service [DISABLED] TosIde Service C:\WINDOWS\system32\svchost.exe [AUTO] TrkWks Service TSDDD Service [DISABLED] Udfs Service [DISABLED] ultra Service C:\WINDOWS\system32\DRIVERS\update.sys [MANUAL] Update Service C:\WINDOWS\system32\svchost.exe [MANUAL] upnphost Service C:\WINDOWS\System32\ups.exe [MANUAL] UPS Service C:\WINDOWS\system32\DRIVERS\usbccgp.sys [MANUAL] usbccgp Service C:\WINDOWS\system32\DRIVERS\usbehci.sys [MANUAL] usbehci Service C:\WINDOWS\system32\DRIVERS\usbhub.sys [MANUAL] usbhub Service C:\WINDOWS\system32\DRIVERS\usbprint.sys [MANUAL] usbprint Service C:\WINDOWS\system32\DRIVERS\usbscan.sys [MANUAL] usbscan Service C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [MANUAL] USBSTOR Service C:\WINDOWS\system32\DRIVERS\usbuhci.sys [MANUAL] usbuhci Service C:\WINDOWS\System32\drivers\vga.sys [SYSTEM] VgaSave Service [DISABLED] ViaIde Service [BOOT] VolSnap Service C:\WINDOWS\System32\vssvc.exe [MANUAL] VSS Service C:\WINDOWS\System32\svchost.exe [AUTO] W32Time Service W3SVC Service C:\WINDOWS\system32\DRIVERS\wanarp.sys [MANUAL] Wanarp Service [MANUAL] WDICA Service C:\WINDOWS\system32\drivers\wdmaud.sys [MANUAL] wdmaud Service C:\WINDOWS\system32\svchost.exe [AUTO] WebClient Service C:\WINDOWS\system32\svchost.exe [AUTO] winmgmt Service [MANUAL] Winsock Service [MANUAL] Winsock - Google Desktop Search Backup Before First Install Service [MANUAL] Winsock - Google Desktop Search Backup Before Last Install Service WinSock2 Service Winsock2 - Google Desktop Search Backup Before First Install Service Winsock2 - Google Desktop Search Backup Before Last Install Service WinTrust Service C:\DOCUME~1\ADMINI~1\USTAWI~1\Temp\WKLTSPV.exe [DISABLED] WKLTSPV Service C:\WINDOWS\System32\svchost.exe [MANUAL] WmdmPmSN Service C:\WINDOWS\System32\svchost.exe [MANUAL] Wmi Service WmiApRpl Service C:\WINDOWS\system32\wbem\wmiapsrv.exe [MANUAL] WmiApSrv Service [SYSTEM] WS2IFSL Service C:\WINDOWS\system32\svchost.exe [AUTO] wuauserv Service C:\WINDOWS\System32\svchost.exe [AUTO] WZCSVC Service C:\WINDOWS\System32\svchost.exe [MANUAL] xmlprov Service {0B4FEF38-DFC2-4081-A2C3-8948144D25FD} Service {E482CB19-6E0C-4568-8E51-FB58B341FB85} ---- EOF - GMER 1.0.12 ----

panowie... heh... nie wierzę ale wszystko jest okej

trzeba było (z innego forum)

picasso napisał(a):Usuwamy = Otwierasz Gmera i przechodzisz do zakładki CMD z zaznaczoną opcją CMD. Do czarnego okna wklejasz:

SC STOP IN
SC DELETE IN
SC STOP WKLTSPV
SC DELETE WKLTSPV
SC STOP EXAMPLE
SC DELETE EXAMPLE
DEL C:\WINDOWS\system32\main.sys
gmer -killall
gmer -del file C:\WINDOWS\system32\reg.sys
gmer -del file C:\WINDOWS\system32\drivers\ghnum^vh.sys
gmer -reboot

[Kolejność komend nieprzypadkowa. Gmer może się zawiesić po killall stąd też najpierw daję pierwsze usuwanie sterownika, który da się zatrzymać w interfejsie "bez killall"]

Klik na Uruchom. Komp ma się samoczynnie zresetować. Jeśli tego nie zrobi natychmiast daj cynk i NOWY log z Gmera >>> Usługi bym ujrzała co on dał radę zrobić. Jeśli pójdzie gładko otwierasz ponownie Gmera ale tym razem w zakładce CMD przestawiasz na podopcję REGEDIT i tam wklejasz do okna:

Kod: Zaznacz wszystko
Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\sharedtaskscheduler] "{2C1CD3D7-86AC-4068-93BC-A02304B60787}"=- "{2C1CD3D7-86AC-4068-93BC-A02304B37389}"=-

Klik na Uruchom.

ale i tak wielkie dzięki dla Was za chęć i czas poświęcony przez te 4 dni

[ Dodano: Dzisiaj o 13:52 ]
i panowie dorbna uwaga ma przyszłość

Co do procedury na innym forum to zdecydowanie rozwleczone niepotrzebnie:

1. W pierwszym poście od razu mogli ci dać SmitfraudFix (sam by wszystko zczesał włącznie z xpupdate.exe) w połączeniu z Pocket Killbox. Czyli jesteśmy conajmniej dwa posty do przodu. A tam bezsensowne usuwanie po kawałku a Smitfraud dopiero po długim czasie przyszedł im do głowy.

2. Wspomniałeś o resetach - już wtedy powinni prosić o logi z Gmera. To jest alarm na rootkita.

3. Nie rozpoznali zbznjvvc.exe z Tempów. I nie skojarzyli wsys.dll = to występuje z rootkitem main.sys + reg.sys. No i właśnie > w zasadzie NIKT nie sprawdził porządnie loga z Combo Dwa rootkity jak byk ciągle omijane a się zajmują kasacją usługi Rootkit Revealer. Tu już dali absolutnie popalić.

Do porządnej analizy logów to tam brakuje. Nie rozpoznali ani jednej infekcji w całości. Szamotanie i chaos instrukcji. Z pewnością nikomu nie polecam takich "speców". Oni zapewne nie polecają mnie z oczywistych tu widocznych względów. Na ironię na moich opisach wychowała się połowa polskich for o wiruchach. Wszelkie instrukcje o "HijackThis" są wtórne

**Posty:** 8694 · przez **Red** 05 Lut 2007, 10:48

Po pierwsze wariat cieszę się że wszystko jest ok,gratuluje.Po drugie,to juz wiem
kto ci pomagał.Po trzecie,ataki picasso za chwile staną się tradycją na naszym forum.Chciałbym zaznaczyć jednak że również "babole" nie są obce naszej kolezance(wiele razy sie spotkałem).Nie widzę sensu podwazania tego co piszemy tutaj i w jaki sposob pomagamy.Najwazniejszy sa efekty,a te niewątpliwie sa.Reasumując,pomagajmy i nie zadzierajmy nosów.
p.s.
Więcej luzu dzieciaki.

proszę o sprawdzenie loga

Kto jest na forum