Problem z błędem winhlp32

**Posty:** 76 · przez **kerli** 12 Lut 2010, 20:11

Przy ładowaniu system na początku pojawia sie :

a tu jest proces co chyba za to odpowiada :

i jak to wyrzucić albo aby sie nie pojawiało bo pomoc i tak mi nie jest potrzebna tylko żeby nie pojawiajł sie ten komunikat .
W msconfig nie ma tego pliku w uruchomieniach . jak sie tego pozbyć ???

**Posty:** 8001 · przez **Okocza** 13 Lut 2010, 10:12

kerli, daj log z RSIT

**Posty:** 76 · przez **kerli** 13 Lut 2010, 14:36

Logi z RSITA

Kod: Zaznacz wszystko: Logfile of random's system information tool 1.06 (written by random/random) Run by Pitek at 2010-02-13 13:33:52 Microsoft Windows XP Professional Dodatek Service Pack 3 System drive C: has 28 GB (88%) free of 32 GB Total RAM: 1023 MB (68% free) HijackThis download failed ======Registry dump====== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}] Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2008-06-12 75128] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}] SSVHelper Class - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll [2008-06-10 509328] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run] "DriveSpace"=C:\Program Files\Drive Space Indicator\DrvSpace.exe [2008-07-20 395716] "SunJavaUpdateSched"=C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe [2008-06-10 144784] "OODefragTray"=C:\WINDOWS\system32\oodtray.exe [2007-05-11 2512392] "ATIPTA"=C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe [2006-11-16 344064] "egui"=C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe [2009-05-14 2029640] [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run] "VisualTaskTips"=C:\Program Files\Utilities\VisualTaskTips\VisualTaskTips.exe [2007-09-05 36352] "ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe [2008-07-22 40448] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent] C:\WINDOWS\system32\Ati2evxx.dll [2008-02-26 126976] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon] C:\WINDOWS\system32\WgaLogon.dll [2008-07-22 236928] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad] WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2008-07-22 133632] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System] "dontdisplaylastusername"=0 "legalnoticecaption"= "legalnoticetext"= "shutdownwithoutlogon"=1 "undockwithoutlogon"=1 "DisableCAD"=0 "DisableStatusMessages"=0 [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer] "NoDriveTypeAutoRun"=145 "NoSMHelp"=1 "NoSMConfigurePrograms"=1 "NoResolveTrack"=1 "NoResolveSearch"=1 [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] "%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000" "%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "C:\WINDOWS\system32\mmc.exe"="C:\WINDOWS\system32\mmc.exe:*:Enabled:Microsoft Management Console" [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list] "%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000" "%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" ======List of files/folders created in the last 1 months====== 2010-02-13 13:33:52 ----D---- C:\rsit 2010-02-13 13:33:52 ----D---- C:\Program Files\trend micro 2010-02-12 18:21:34 ----D---- C:\Documents and Settings\Pitek\Dane aplikacji\BESTplayer 2010-02-12 18:18:12 ----D---- C:\Documents and Settings\Pitek\Dane aplikacji\Mozilla 2010-02-12 18:14:04 ----A---- C:\WINDOWS\system32\h323log.txt 2010-02-12 18:11:47 ----A---- C:\WINDOWS\system32\rmoc3260.dll 2010-02-12 18:11:47 ----A---- C:\WINDOWS\system32\pndx5032.dll 2010-02-12 18:11:47 ----A---- C:\WINDOWS\system32\pndx5016.dll 2010-02-12 18:11:46 ----A---- C:\WINDOWS\system32\pncrt.dll 2010-02-12 18:11:43 ----A---- C:\WINDOWS\system32\unrar.dll 2010-02-12 18:11:42 ----A---- C:\WINDOWS\avisplitter.ini 2010-02-12 18:11:27 ----A---- C:\WINDOWS\system32\yv12vfw.dll 2010-02-12 18:11:27 ----A---- C:\WINDOWS\system32\xvidcore.dll 2010-02-12 18:11:26 ----A---- C:\WINDOWS\system32\xvidvfw.dll 2010-02-12 18:11:26 ----A---- C:\WINDOWS\system32\qt-dx331.dll 2010-02-12 18:11:26 ----A---- C:\WINDOWS\system32\dpl100.dll 2010-02-12 18:11:09 ----A---- C:\WINDOWS\system32\divx.dll 2010-02-12 18:11:04 ----A---- C:\WINDOWS\system32\pthreadGC2.dll 2010-02-12 18:11:04 ----A---- C:\WINDOWS\system32\ff_vfw.dll.manifest 2010-02-12 18:11:04 ----A---- C:\WINDOWS\system32\ff_vfw.dll 2010-02-12 18:10:59 ----D---- C:\Program Files\K-Lite Codec Pack 2010-02-12 18:10:02 ----D---- C:\Documents and Settings\Pitek\Dane aplikacji\Winamp 2010-02-12 18:06:28 ----D---- C:\Program Files\UlisesSoft 2010-02-12 18:05:56 ----SHD---- C:\RECYCLER 2010-02-12 18:05:17 ----A---- C:\WINDOWS\system32\usbui.dll 2010-02-12 18:05:13 ----A---- C:\WINDOWS\system32\ksuser.dll 2010-02-12 18:04:59 ----D---- C:\WINDOWS\LastGood 2010-02-12 18:04:31 ----D---- C:\Program Files\ESET 2010-02-12 18:04:31 ----D---- C:\Documents and Settings\All Users\Dane aplikacji\ESET 2010-02-12 18:03:07 ----D---- C:\Documents and Settings\Pitek\Dane aplikacji\Adobe 2010-02-12 18:02:34 ----SHD---- C:\WINDOWS\Installer 2010-02-12 18:02:34 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI 2010-02-12 18:02:33 ----D---- C:\Program Files\Common Files\ODBC 2010-02-12 18:02:33 ----A---- C:\WINDOWS\ODBCINST.INI 2010-02-12 18:02:32 ----D---- C:\Documents and Settings\Pitek\Dane aplikacji\Identities 2010-02-12 18:02:27 ----D---- C:\WINDOWS\LastGood.Tmp 2010-02-12 18:02:22 ----A---- C:\WINDOWS\system32\irclass.dll 2010-02-12 18:02:22 ----A---- C:\WINDOWS\system32\dgsetup.dll 2010-02-12 18:02:22 ----A---- C:\WINDOWS\system32\dgrpsetu.dll 2010-02-12 18:02:21 ----A---- C:\WINDOWS\system32\spxcoins.dll 2010-02-12 18:02:21 ----A---- C:\WINDOWS\system32\EqnClass.Dll 2010-02-12 18:02:19 ----SD---- C:\Documents and Settings\Pitek\Dane aplikacji\Microsoft 2010-02-12 18:02:19 ----N---- C:\WINDOWS\system32\CONFIG.TMP 2010-02-12 18:02:19 ----D---- C:\Documents and Settings\Pitek\Dane aplikacji\Xentient 2010-02-12 18:02:19 ----D---- C:\Documents and Settings\Pitek\Dane aplikacji\WinRAR 2010-02-12 18:02:19 ----D---- C:\Documents and Settings\Pitek\Dane aplikacji\uTorrent 2010-02-12 18:02:19 ----D---- C:\Documents and Settings\Pitek\Dane aplikacji\URSoft 2010-02-12 18:02:19 ----D---- C:\Documents and Settings\Pitek\Dane aplikacji\Sun 2010-02-12 18:02:19 ----D---- C:\Documents and Settings\Pitek\Dane aplikacji\Notepad++ 2010-02-12 18:02:19 ----ASH---- C:\Documents and Settings\Pitek\Dane aplikacji\desktop.ini 2010-02-12 18:02:19 ----A---- C:\WINDOWS\TASKMAN.EXE 2010-02-12 18:02:19 ----A---- C:\WINDOWS\system32\batt.dll 2010-02-12 18:02:18 ----A---- C:\WINDOWS\system32\storprop.dll 2010-02-12 18:02:18 ----A---- C:\WINDOWS\NOTEPAD.EXE 2010-02-12 18:02:09 ----ASH---- C:\Documents and Settings\All Users\Dane aplikacji\desktop.ini 2010-02-12 18:01:52 ----D---- C:\WINDOWS\system32\CatRoot2 2010-02-12 18:01:52 ----D---- C:\WINDOWS\system32\CatRoot 2010-02-12 18:01:46 ----SD---- C:\Documents and Settings\All Users\Dane aplikacji\Microsoft 2010-02-12 18:01:25 ----D---- C:\Program Files\Common Files 2010-02-12 18:01:25 ----D---- C:\Program Files 2010-02-12 18:01:22 ----A---- C:\WINDOWS\setuplog.txt 2010-02-12 17:57:07 ----HD---- C:\Program Files\Uninstall Information 2010-02-12 17:56:53 ----D---- C:\Program Files\ATI Technologies 2010-02-12 17:56:52 ----HD---- C:\Program Files\InstallShield Installation Information 2010-02-12 17:56:47 ----D---- C:\Program Files\Common Files\InstallShield 2010-02-12 17:56:30 ----D---- C:\Documents and Settings\All Users\Dane aplikacji\Windows Genuine Advantage 2010-02-12 17:54:22 ----A---- C:\WINDOWS\system32\Oemdspif.dll 2010-02-12 17:53:38 ----A---- C:\WINDOWS\system32\ativvaxx.dll 2010-02-12 17:53:38 ----A---- C:\WINDOWS\system32\ativcoxx.dll 2010-02-12 17:53:38 ----A---- C:\WINDOWS\system32\atitvo32.dll 2010-02-12 17:53:38 ----A---- C:\WINDOWS\system32\atipdlxx.dll 2010-02-12 17:53:38 ----A---- C:\WINDOWS\system32\atiok3x2.dll 2010-02-12 17:53:37 ----A---- C:\WINDOWS\system32\atioglxx.dll 2010-02-12 17:53:34 ----A---- C:\WINDOWS\system32\atioglx2.dll 2010-02-12 17:53:33 ----A---- C:\WINDOWS\system32\atikvmag.dll 2010-02-12 17:53:33 ----A---- C:\WINDOWS\system32\atiiiexx.dll 2010-02-12 17:53:33 ----A---- C:\WINDOWS\system32\ATIDEMGX.dll 2010-02-12 17:53:33 ----A---- C:\WINDOWS\system32\ATIDDC.DLL 2010-02-12 17:53:33 ----A---- C:\WINDOWS\system32\ati3duag.dll 2010-02-12 17:53:33 ----A---- C:\WINDOWS\system32\ati2evxx.dll 2010-02-12 17:53:33 ----A---- C:\WINDOWS\system32\ati2edxx.dll 2010-02-12 17:53:33 ----A---- C:\WINDOWS\system32\ati2dvag.dll 2010-02-12 17:53:33 ----A---- C:\WINDOWS\system32\ati2cqag.dll 2010-02-12 17:53:33 ----A---- C:\WINDOWS\system32\amdpcom32.dll 2010-02-12 17:53:17 ----A---- C:\WINDOWS\system32\Ati2mdxx.exe 2010-02-12 17:53:16 ----A---- C:\WINDOWS\system32\ati2evxx.exe 2010-02-12 17:52:12 ----D---- C:\Documents and Settings 2010-02-12 17:52:11 ----SHD---- C:\System Volume Information 2010-02-12 17:51:39 ----SH---- C:\boot.ini 2010-02-12 17:51:31 ----D---- C:\install 2010-02-12 17:47:42 ----SD---- C:\WINDOWS\Downloaded Program Files 2010-02-12 17:47:42 ----RSD---- C:\WINDOWS\Fonts 2010-02-12 17:47:42 ----RD---- C:\WINDOWS\Offline Web Pages 2010-02-12 17:47:42 ----D---- C:\WINDOWS\WinSxS 2010-02-12 17:47:42 ----D---- C:\WINDOWS\Web 2010-02-12 17:47:42 ----D---- C:\WINDOWS\WBEM 2010-02-12 17:47:42 ----D---- C:\WINDOWS\twain_32 2010-02-12 17:47:42 ----D---- C:\WINDOWS\Temp 2010-02-12 17:47:42 ----D---- C:\WINDOWS\system32\wins 2010-02-12 17:47:42 ----D---- C:\WINDOWS\system32\wbem 2010-02-12 17:47:42 ----D---- C:\WINDOWS\system32\usmt 2010-02-12 17:47:42 ----D---- C:\WINDOWS\system32\spool 2010-02-12 17:47:42 ----D---- C:\WINDOWS\system32\ShellExt 2010-02-12 17:47:42 ----D---- C:\WINDOWS\system32\Setup 2010-02-12 17:47:42 ----D---- C:\WINDOWS\system32\ras 2010-02-12 17:47:42 ----D---- C:\WINDOWS\system32\PreInstall 2010-02-12 17:47:42 ----D---- C:\WINDOWS\system32\pl-pl 2010-02-12 17:47:42 ----D---- C:\WINDOWS\system32\pl 2010-02-12 17:47:42 ----D---- C:\WINDOWS\system32\mui 2010-02-12 17:47:42 ----D---- C:\WINDOWS\system32\icsxml 2010-02-12 17:47:42 ----D---- C:\WINDOWS\system32\ias 2010-02-12 17:47:42 ----D---- C:\WINDOWS\system32\export 2010-02-12 17:47:42 ----D---- C:\WINDOWS\system32\drivers 2010-02-12 17:47:42 ----D---- C:\WINDOWS\system32\dhcp 2010-02-12 17:47:42 ----D---- C:\WINDOWS\system32\config 2010-02-12 17:47:42 ----D---- C:\WINDOWS\system32\3com_dmi 2010-02-12 17:47:42 ----D---- C:\WINDOWS\system32\3076 2010-02-12 17:47:42 ----D---- C:\WINDOWS\system32\2052 2010-02-12 17:47:42 ----D---- C:\WINDOWS\system32\1054 2010-02-12 17:47:42 ----D---- C:\WINDOWS\system32\1045 2010-02-12 17:47:42 ----D---- C:\WINDOWS\system32\1042 2010-02-12 17:47:42 ----D---- C:\WINDOWS\system32\1041 2010-02-12 17:47:42 ----D---- C:\WINDOWS\system32\1037 2010-02-12 17:47:42 ----D---- C:\WINDOWS\system32\1033 2010-02-12 17:47:42 ----D---- C:\WINDOWS\system32\1031 2010-02-12 17:47:42 ----D---- C:\WINDOWS\system32\1028 2010-02-12 17:47:42 ----D---- C:\WINDOWS\system32\1025 2010-02-12 17:47:42 ----D---- C:\WINDOWS\system32 2010-02-12 17:47:42 ----D---- C:\WINDOWS\system 2010-02-12 17:47:42 ----D---- C:\WINDOWS\security 2010-02-12 17:47:42 ----D---- C:\WINDOWS\Resources 2010-02-12 17:47:42 ----D---- C:\WINDOWS\repair 2010-02-12 17:47:42 ----D---- C:\WINDOWS\Provisioning 2010-02-12 17:47:42 ----D---- C:\WINDOWS\PeerNet 2010-02-12 17:47:42 ----D---- C:\WINDOWS\PCHealth 2010-02-12 17:47:42 ----D---- C:\WINDOWS\Network Diagnostic 2010-02-12 17:47:42 ----D---- C:\WINDOWS\mui 2010-02-12 17:47:42 ----D---- C:\WINDOWS\msapps 2010-02-12 17:47:42 ----D---- C:\WINDOWS\Media 2010-02-12 17:47:42 ----D---- C:\WINDOWS\L2Schemas 2010-02-12 17:47:42 ----D---- C:\WINDOWS\java 2010-02-12 17:47:42 ----D---- C:\WINDOWS\inf 2010-02-12 17:47:42 ----D---- C:\WINDOWS\ime 2010-02-12 17:47:42 ----D---- C:\WINDOWS\Help 2010-02-12 17:47:42 ----D---- C:\WINDOWS\Driver Cache 2010-02-12 17:47:42 ----D---- C:\WINDOWS\Debug 2010-02-12 17:47:42 ----D---- C:\WINDOWS\Cursors 2010-02-12 17:47:42 ----D---- C:\WINDOWS\Connection Wizard 2010-02-12 17:47:42 ----D---- C:\WINDOWS\Config 2010-02-12 17:47:42 ----D---- C:\WINDOWS\AppPatch 2010-02-12 17:47:42 ----D---- C:\WINDOWS\addins 2010-02-12 17:47:42 ----D---- C:\WINDOWS 2010-02-12 17:32:41 ----SD---- C:\WINDOWS\system32\Microsoft 2010-02-12 17:32:41 ----A---- C:\WINDOWS\SchedLgU.Txt 2010-02-12 17:30:52 ----AD---- C:\Documents and Settings\All Users\Dane aplikacji\TEMP 2010-02-12 17:30:49 ----D---- C:\Program Files\Your Uninstaller 2008 2010-02-12 17:30:44 ----D---- C:\Program Files\Mozilla Thunderbird 2010-02-12 17:30:29 ----D---- C:\Program Files\OO Software 2010-02-12 17:30:14 ----D---- C:\Program Files\Notepad++ 2010-02-12 17:30:13 ----D---- C:\Program Files\MozBackup 2010-02-12 17:30:10 ----A---- C:\WINDOWS\system32\javaws.exe 2010-02-12 17:30:10 ----A---- C:\WINDOWS\system32\javaw.exe 2010-02-12 17:30:10 ----A---- C:\WINDOWS\system32\java.exe 2010-02-12 17:29:43 ----D---- C:\Program Files\Java 2010-02-12 17:29:41 ----D---- C:\Program Files\Common Files\Java 2010-02-12 17:29:29 ----D---- C:\Program Files\Mozilla Firefox 2010-02-12 17:29:17 ----D---- C:\Program Files\FastStone Image Viewer 2010-02-12 17:29:12 ----A---- C:\WINDOWS\system32\XCEEDZIP.DLL 2010-02-12 17:29:12 ----A---- C:\WINDOWS\system32\XceedCry.dll 2010-02-12 17:29:11 ----D---- C:\Program Files\Driver Magician 2010-02-12 17:29:09 ----D---- C:\Program Files\PowerISO 2010-02-12 17:28:42 ----A---- C:\WINDOWS\system32\TwnLib4.dll 2010-02-12 17:28:41 ----A---- C:\WINDOWS\system32\imagXRA7.dll 2010-02-12 17:28:41 ----A---- C:\WINDOWS\system32\imagXR7.dll 2010-02-12 17:28:41 ----A---- C:\WINDOWS\system32\imagXpr7.dll 2010-02-12 17:28:41 ----A---- C:\WINDOWS\system32\imagX7.dll 2010-02-12 17:28:40 ----D---- C:\Program Files\Nero 2010-02-12 17:28:40 ----D---- C:\Documents and Settings\All Users\Dane aplikacji\Nero 2010-02-12 17:28:39 ----D---- C:\Program Files\Common Files\Nero 2010-02-12 17:27:57 ----D---- C:\Program Files\Common Files\Adobe 2010-02-12 17:27:57 ----D---- C:\Program Files\Adobe 2010-02-12 17:27:57 ----D---- C:\Documents and Settings\All Users\Dane aplikacji\Adobe 2010-02-12 17:27:24 ----D---- C:\Program Files\Unlocker 2010-02-12 17:27:18 ----D---- C:\Program Files\Microsoft Silverlight 2010-02-12 17:27:09 ----D---- C:\WINDOWS\system32\Adobe 2010-02-12 17:23:27 ----RSD---- C:\WINDOWS\assembly 2010-02-12 17:23:27 ----D---- C:\WINDOWS\Microsoft.NET 2010-02-12 17:23:25 ----D---- C:\WINDOWS\system32\URTTemp 2010-02-12 17:22:48 ----A---- C:\WINDOWS\control.ini 2010-02-12 17:22:48 ----A---- C:\AUTOEXEC.BAT 2010-02-12 17:21:51 ----A---- C:\WINDOWS\OEWABLog.txt 2010-02-12 17:21:47 ----A---- C:\WINDOWS\system32\mapi32.dll 2010-02-12 17:21:46 ----D---- C:\WINDOWS\system32\dllcache 2010-02-12 17:21:02 ----RAH---- C:\WINDOWS\system32\logonui.exe.manifest 2010-02-12 17:20:53 ----RAH---- C:\WINDOWS\system32\cdplayer.exe.manifest 2010-02-12 17:20:32 ----A---- C:\WINDOWS\system32\desktop.ini 2010-02-12 17:20:32 ----A---- C:\WINDOWS\desktop.ini 2010-02-12 17:20:31 ----D---- C:\Program Files\Common Files\Services 2010-02-12 17:20:31 ----A---- C:\WINDOWS\system32\acctres.dll 2010-02-12 17:20:28 ----SD---- C:\WINDOWS\Tasks 2010-02-12 17:20:28 ----A---- C:\WINDOWS\system32\icfgnt5.dll 2010-02-12 17:20:27 ----D---- C:\Program Files\Common Files\MSSoap 2010-02-12 17:20:26 ----D---- C:\WINDOWS\system32\Macromed 2010-02-12 17:20:24 ----A---- C:\WINDOWS\system32\qmgrprxy.dll 2010-02-12 17:20:24 ----A---- C:\WINDOWS\system32\bitsprx4.dll 2010-02-12 17:20:24 ----A---- C:\WINDOWS\system32\bitsprx3.dll 2010-02-12 17:20:24 ----A---- C:\WINDOWS\system32\bitsprx2.dll 2010-02-12 17:20:23 ----A---- C:\WINDOWS\system32\qmgr.dll 2010-02-12 17:20:23 ----A---- C:\WINDOWS\system32\fltMc.exe 2010-02-12 17:20:23 ----A---- C:\WINDOWS\system32\fltlib.dll 2010-02-12 17:20:22 ----D---- C:\WINDOWS\system32\Restore 2010-02-12 17:20:22 ----A---- C:\WINDOWS\system32\srsvc.dll 2010-02-12 17:20:22 ----A---- C:\WINDOWS\system32\srrstr.dll 2010-02-12 17:20:22 ----A---- C:\WINDOWS\system32\srclient.dll 2010-02-12 17:20:22 ----A---- C:\WINDOWS\system32\msoert2.dll 2010-02-12 17:20:21 ----A---- C:\WINDOWS\system32\msoeacct.dll 2010-02-12 17:20:20 ----A---- C:\WINDOWS\system32\inetres.dll 2010-02-12 17:20:20 ----A---- C:\WINDOWS\system32\inetcomm.dll 2010-02-12 17:20:18 ----D---- C:\Program Files\Outlook Express 2010-02-12 17:20:18 ----A---- C:\WINDOWS\system32\schedsvc.dll 2010-02-12 17:20:18 ----A---- C:\WINDOWS\system32\mstinit.exe 2010-02-12 17:20:18 ----A---- C:\WINDOWS\system32\mstask.dll 2010-02-12 17:20:18 ----A---- C:\WINDOWS\system32\icwphbk.dll 2010-02-12 17:20:17 ----A---- C:\WINDOWS\system32\isign32.dll 2010-02-12 17:20:17 ----A---- C:\WINDOWS\system32\inetcfg.dll 2010-02-12 17:20:17 ----A---- C:\WINDOWS\system32\icwdial.dll 2010-02-12 17:20:12 ----D---- C:\Program Files\Common Files\System 2010-02-12 17:19:58 ----D---- C:\Program Files\ComPlus Applications 2010-02-12 17:19:56 ----A---- C:\WINDOWS\vbaddin.ini 2010-02-12 17:19:56 ----A---- C:\WINDOWS\vb.ini 2010-02-12 17:19:51 ----D---- C:\WINDOWS\Registration 2010-02-12 17:19:02 ----D---- C:\Program Files\uTorrent 2010-02-12 17:18:38 ----A---- C:\WINDOWS\system32\vxblock.dll 2010-02-12 17:18:38 ----A---- C:\WINDOWS\system32\pxafs.dll 2010-02-12 17:18:38 ----A---- C:\WINDOWS\system32\px.dll 2010-02-12 17:18:37 ----A---- C:\WINDOWS\system32\pxwave.dll 2010-02-12 17:18:37 ----A---- C:\WINDOWS\system32\pxsfs.dll 2010-02-12 17:18:37 ----A---- C:\WINDOWS\system32\pxmas.dll 2010-02-12 17:18:37 ----A---- C:\WINDOWS\system32\pxinsa64.exe 2010-02-12 17:18:37 ----A---- C:\WINDOWS\system32\pxhpinst.exe 2010-02-12 17:18:37 ----A---- C:\WINDOWS\system32\pxdrv.dll 2010-02-12 17:18:37 ----A---- C:\WINDOWS\system32\pxcpya64.exe 2010-02-12 17:17:00 ----D---- C:\Program Files\winamp 2010-02-12 17:16:57 ----D---- C:\Program Files\Utilities 2010-02-12 17:16:51 ----D---- C:\Program Files\Windows Sidebar 2010-02-12 17:16:42 ----D---- C:\Program Files\WinRAR 2010-02-12 17:16:25 ----A---- C:\WINDOWS\system32\WC.com 2010-02-12 17:16:25 ----A---- C:\WINDOWS\system32\makeiso.cmd 2010-02-12 17:16:25 ----A---- C:\WINDOWS\system32\LCISOCreator.exe 2010-02-12 17:16:24 ----A---- C:\WINDOWS\system32\cdimage.exe 2010-02-12 17:16:22 ----A---- C:\WINDOWS\system32\wrap_oal.dll 2010-02-12 17:16:22 ----A---- C:\WINDOWS\system32\vb40032.dll 2010-02-12 17:16:21 ----A---- C:\WINDOWS\system32\ssleay32.dll 2010-02-12 17:16:21 ----A---- C:\WINDOWS\system32\openal32.dll 2010-02-12 17:16:20 ----A---- C:\WINDOWS\system32\msvcr71.dll 2010-02-12 17:16:20 ----A---- C:\WINDOWS\system32\msvcr70.dll 2010-02-12 17:16:20 ----A---- C:\WINDOWS\system32\msvcp71.dll 2010-02-12 17:16:20 ----A---- C:\WINDOWS\system32\msvcp70.dll 2010-02-12 17:16:20 ----A---- C:\WINDOWS\system32\msvci70.dll 2010-02-12 17:16:20 ----A---- C:\WINDOWS\system32\msstkprp.dll 2010-02-12 17:16:20 ----A---- C:\WINDOWS\system32\msstdfmt.dll 2010-02-12 17:16:18 ----A---- C:\WINDOWS\system32\mfc71u.dll 2010-02-12 17:16:18 ----A---- C:\WINDOWS\system32\mfc71.dll 2010-02-12 17:16:17 ----A---- C:\WINDOWS\system32\mfc70u.dll 2010-02-12 17:16:17 ----A---- C:\WINDOWS\system32\mfc70.dll 2010-02-12 17:16:17 ----A---- C:\WINDOWS\system32\libssl32.dll 2010-02-12 17:16:16 ----A---- C:\WINDOWS\system32\zlib1.dll 2010-02-12 17:16:16 ----A---- C:\WINDOWS\system32\libmmd.dll 2010-02-12 17:16:16 ----A---- C:\WINDOWS\system32\libintl3.dll 2010-02-12 17:16:16 ----A---- C:\WINDOWS\system32\libiconv2.dll 2010-02-12 17:16:16 ----A---- C:\WINDOWS\system32\libeay32.dll 2010-02-12 17:16:15 ----D---- C:\Program Files\Common Files\Microsoft Shared 2010-02-12 17:16:15 ----A---- C:\WINDOWS\system32\cygwinb19.dll 2010-02-12 17:16:15 ----A---- C:\WINDOWS\system32\cygwin1.dll 2010-02-12 17:16:14 ----A---- C:\WINDOWS\system32\autoitx3.dll 2010-02-12 17:16:14 ----A---- C:\WINDOWS\system32\atl71.dll 2010-02-12 17:16:14 ----A---- C:\WINDOWS\system32\atl70.dll 2010-02-12 17:16:09 ----D---- C:\Program Files\System 2010-02-12 17:16:08 ----A---- C:\WINDOWS\system32\CabTool.exe 2010-02-12 17:16:07 ----D---- C:\Program Files\FirmTools 2010-02-12 17:16:05 ----D---- C:\Program Files\Drive Space Indicator 2010-02-12 17:16:04 ----D---- C:\Program Files\Driver Sweeper 2010-02-12 17:16:01 ----D---- C:\Program Files\Windows Media Connect 2 2010-02-12 17:15:58 ----D---- C:\Program Files\Windows Media Player 2010-02-12 17:15:57 ----D---- C:\WINDOWS\SoftwareDistribution 2010-02-12 17:15:57 ----D---- C:\Program Files\Internet Explorer 2010-02-12 17:15:57 ----A---- C:\WINDOWS\system32\sndvol32.exe 2010-02-12 17:15:56 ----A---- C:\WINDOWS\system32\winmine.exe 2010-02-12 17:15:56 ----A---- C:\WINDOWS\system32\usrlogon.cmd 2010-02-12 17:15:56 ----A---- C:\WINDOWS\system32\sol.exe 2010-02-12 17:15:56 ----A---- C:\WINDOWS\system32\reset.exe 2010-02-12 17:15:56 ----A---- C:\WINDOWS\system32\mshearts.exe 2010-02-12 17:15:56 ----A---- C:\WINDOWS\system32\freecell.exe 2010-02-12 17:15:56 ----A---- C:\WINDOWS\system32\calc.exe 2010-02-12 17:15:55 ----A---- C:\WINDOWS\system32\tsshutdn.exe 2010-02-12 17:15:55 ----A---- C:\WINDOWS\system32\tslabels.ini 2010-02-12 17:15:55 ----A---- C:\WINDOWS\system32\tskill.exe 2010-02-12 17:15:55 ----A---- C:\WINDOWS\system32\tsdiscon.exe 2010-02-12 17:15:55 ----A---- C:\WINDOWS\system32\tscon.exe 2010-02-12 17:15:55 ----A---- C:\WINDOWS\system32\shadow.exe 2010-02-12 17:15:55 ----A---- C:\WINDOWS\system32\rwinsta.exe 2010-02-12 17:15:55 ----A---- C:\WINDOWS\system32\regini.exe 2010-02-12 17:15:55 ----A---- C:\WINDOWS\system32\rdpcfgex.dll 2010-02-12 17:15:55 ----A---- C:\WINDOWS\system32\qwinsta.exe 2010-02-12 17:15:55 ----A---- C:\WINDOWS\system32\qappsrv.exe 2010-02-12 17:15:55 ----A---- C:\WINDOWS\system32\msg.exe 2010-02-12 17:15:55 ----A---- C:\WINDOWS\system32\logoff.exe 2010-02-12 17:15:54 ----A---- C:\WINDOWS\system32\msdtcprf.ini 2010-02-12 17:15:54 ----A---- C:\WINDOWS\system32\cdmodem.dll 2010-02-12 17:15:49 ----A---- C:\WINDOWS\system32\wmimgmt.msc 2010-02-12 17:15:48 ----A---- C:\WINDOWS\system32\spider.exe 2010-02-12 17:15:48 ----A---- C:\WINDOWS\system32\mspaint.exe 2010-02-12 17:15:48 ----A---- C:\WINDOWS\system32\mplay32.exe 2010-02-12 17:15:47 ----A---- C:\WINDOWS\system32\tsgqec.dll 2010-02-12 17:15:47 ----A---- C:\WINDOWS\system32\tscfgwmi.dll 2010-02-12 17:15:47 ----A---- C:\WINDOWS\system32\rhttpaa.dll 2010-02-12 17:15:47 ----A---- C:\WINDOWS\system32\aaclient.dll 2010-02-12 17:15:46 ----A---- C:\WINDOWS\system32\mstscax.dll 2010-02-12 17:15:46 ----A---- C:\WINDOWS\system32\mstsc.exe 2010-02-12 17:15:45 ----A---- C:\WINDOWS\system32\termsrv.dll 2010-02-12 17:15:45 ----A---- C:\WINDOWS\system32\sessmgr.exe 2010-02-12 17:15:45 ----A---- C:\WINDOWS\system32\remotepg.dll 2010-02-12 17:15:45 ----A---- C:\WINDOWS\system32\rdshost.exe 2010-02-12 17:15:45 ----A---- C:\WINDOWS\system32\rdsaddin.exe 2010-02-12 17:15:45 ----A---- C:\WINDOWS\system32\rdpwsx.dll 2010-02-12 17:15:45 ----A---- C:\WINDOWS\system32\rdpsnd.dll 2010-02-12 17:15:45 ----A---- C:\WINDOWS\system32\rdpclip.exe 2010-02-12 17:15:45 ----A---- C:\WINDOWS\system32\rdchost.dll 2010-02-12 17:15:45 ----A---- C:\WINDOWS\system32\qprocess.exe 2010-02-12 17:15:44 ----D---- C:\WINDOWS\system32\MsDtc 2010-02-12 17:15:44 ----A---- C:\WINDOWS\system32\mtxoci.dll 2010-02-12 17:15:44 ----A---- C:\WINDOWS\system32\msdtcuiu.dll 2010-02-12 17:15:44 ----A---- C:\WINDOWS\system32\msdtctm.dll 2010-02-12 17:15:44 ----A---- C:\WINDOWS\system32\msdtcprx.dll 2010-02-12 17:15:44 ----A---- C:\WINDOWS\system32\icaapi.dll 2010-02-12 17:15:44 ----A---- C:\WINDOWS\system32\cfgbkend.dll 2010-02-12 17:15:43 ----D---- C:\WINDOWS\system32\Com 2010-02-12 17:15:43 ----A---- C:\WINDOWS\system32\xolehlp.dll 2010-02-12 17:15:43 ----A---- C:\WINDOWS\system32\mtxlegih.dll 2010-02-12 17:15:43 ----A---- C:\WINDOWS\system32\mtxex.dll 2010-02-12 17:15:43 ----A---- C:\WINDOWS\system32\mtxdm.dll 2010-02-12 17:15:43 ----A---- C:\WINDOWS\system32\msdtclog.dll 2010-02-12 17:15:43 ----A---- C:\WINDOWS\system32\msdtc.exe 2010-02-12 17:15:43 ----A---- C:\WINDOWS\system32\dcomcnfg.exe 2010-02-12 17:15:42 ----A---- C:\WINDOWS\system32\stclient.dll 2010-02-12 17:15:42 ----A---- C:\WINDOWS\system32\comrepl.dll 2010-02-12 17:15:42 ----A---- C:\WINDOWS\system32\comaddin.dll 2010-02-12 17:15:42 ----A---- C:\WINDOWS\system32\colbact.dll 2010-02-12 17:15:42 ----A---- C:\WINDOWS\system32\clbcatex.dll 2010-02-12 17:15:42 ----A---- C:\WINDOWS\system32\catsrvut.dll 2010-02-12 17:15:42 ----A---- C:\WINDOWS\system32\catsrvps.dll 2010-02-12 17:15:42 ----A---- C:\WINDOWS\system32\catsrv.dll 2010-02-12 17:15:41 ----A---- C:\WINDOWS\system32\comuid.dll 2010-02-12 17:15:41 ----A---- C:\WINDOWS\system32\comsvcs.dll 2010-02-12 17:15:41 ----A---- C:\WINDOWS\system32\comsnap.dll 2010-02-12 17:15:41 ----A---- C:\WINDOWS\system32\clbcatq.dll 2010-02-12 17:15:35 ----A---- C:\WINDOWS\system32\servdeps.dll 2010-02-12 17:15:34 ----A---- C:\WINDOWS\system32\mmfutil.dll 2010-02-12 17:15:34 ----A---- C:\WINDOWS\system32\licwmi.dll 2010-02-12 17:15:34 ----A---- C:\WINDOWS\system32\cmprops.dll ======List of files/folders modified in the last 1 months====== 2010-02-12 18:02:30 ----A---- C:\WINDOWS\system.ini 2010-02-12 17:22:34 ----A---- C:\WINDOWS\win.ini ======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)====== R1 ehdrv;ehdrv; C:\WINDOWS\system32\DRIVERS\ehdrv.sys [2009-05-14 107256] R1 epfwtdir;epfwtdir; C:\WINDOWS\system32\DRIVERS\epfwtdir.sys [2009-05-14 94360] R1 SCDEmu;SCDEmu; C:\WINDOWS\system32\drivers\SCDEmu.sys [2008-07-07 56108] R1 vcdrom;Virtual CD-ROM Device Driver; \??\C:\Program Files\System\CPL Bonus\Vcdrom.sys [] R2 eamon;eamon; C:\WINDOWS\system32\DRIVERS\eamon.sys [2009-05-14 114472] R3 ac97intc;Usługa instalacyjna sterownika audio Intel(r) 82801 (WDM); C:\WINDOWS\system32\drivers\ac97intc.sys [2008-07-22 96256] R3 ati2mtag;ati2mtag; C:\WINDOWS\system32\DRIVERS\ati2mtag.sys [2008-02-26 2863616] R3 hidusb;Sterownik Microsoft klasy HID; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-13 10368] R3 mouhid;Sterownik myszy HID; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2008-07-22 12160] R3 nvmpu401;Service for NVIDIA(R) nForce(TM) MIDI UART; C:\WINDOWS\system32\drivers\nvmpu401.sys [2006-02-26 10240] R3 RT2500;AsusTek RT2500 Wireless Driver; C:\WINDOWS\system32\DRIVERS\RT2500.sys [2006-06-01 236800] R3 RTL8023xp;Realtek 10/100/1000 PCI NIC Family NDIS XP Driver; C:\WINDOWS\system32\DRIVERS\Rtnicxp.sys [2007-11-21 104320] R3 usbehci;Sterownik Miniport rozszerzonego kontrolera hosta USB 2.0 Microsoft; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2008-04-13 30208] R3 usbhub;Koncentrator z obsługą USB2; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2008-04-13 59520] R3 USBSTOR;Sterownik magazynu masowego USB; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-07-22 26368] R3 usbuhci;Sterownik Miniport uniwersalnego kontrolera hosta USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2008-04-13 20608] ======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)====== R2 Ati HotKey Poller;Ati HotKey Poller; C:\WINDOWS\system32\Ati2evxx.exe [2008-02-26 520192] R2 ekrn;ESET Service; C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe [2009-05-14 731840] R2 O&O Defrag;O&O Defrag; C:\WINDOWS\system32\oodag.exe [2007-05-11 1050120] S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2007-04-13 33632] S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2007-04-13 68952] S3 EhttpSrv;ESET HTTP Server; C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe [2009-05-14 20680] S3 WMPNetworkSvc;Usługa udostępniania w sieci programu Windows Media Player; C:\Program Files\Windows Media Player\WMPNetwk.exe [2008-07-22 918016] -----------------EOF-----------------

**Posty:** 8001 · przez **Okocza** 13 Lut 2010, 21:22

daj log z combofixa

**Posty:** 76 · przez **kerli** 14 Lut 2010, 12:44

Kod: Zaznacz wszystko: ComboFix 10-02-12.01 - Pitek 2010-02-14 10:27:34.1.1 - x86 Microsoft Windows XP Professional 5.1.2600.3.1250.48.1045.18.1023.694 [GMT 1:00] Uruchomiony z: c:\documents and settings\Pitek\Pulpit\ComboFix.exe * Rezydentny antywirus jest aktywny UWAGA - TEN KOMPUTER NIE MA ZAINSTALOWANEJ KONSOLI ODZYSKIWANIA !! . ((((((((((((((((((((((((((((((((((((((( Usunięto ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\program files\Mozilla Firefox\plc4.dll c:\windows\system32\msconfig.exe . ((((((((((((((((((((((((( Pliki utworzone od 2010-01-14 do 2010-02-14 ))))))))))))))))))))))))))))))) . 2010-02-14 09:27 . 2010-02-14 09:27 -------- d-----w- c:\documents and settings\Pitek\Ustawienia lokalne\Dane aplikacji\ESET 2010-02-13 12:33 . 2010-02-13 12:33 -------- d-----w- C:\rsit 2010-02-13 12:33 . 2010-02-13 12:33 -------- d-----w- c:\program files\trend micro 2010-02-12 17:21 . 2010-02-12 17:21 -------- d-----w- c:\documents and settings\Pitek\Dane aplikacji\BESTplayer 2010-02-12 17:18 . 2010-02-12 17:18 0 ----a-w- c:\windows\nsreg.dat 2010-02-12 17:18 . 2010-02-12 17:18 -------- d-----w- c:\documents and settings\Pitek\Ustawienia lokalne\Dane aplikacji\Mozilla 2010-02-12 17:10 . 2010-02-12 17:10 -------- d-----w- c:\documents and settings\Pitek\Dane aplikacji\Winamp 2010-02-12 17:07 . 2008-07-22 11:39 6272 ----a-w- c:\windows\system32\drivers\splitter.sys 2010-02-12 17:07 . 2008-07-22 11:39 2944 ----a-w- c:\windows\system32\drivers\drmkaud.sys 2010-02-12 17:07 . 2008-07-22 11:39 4992 ----a-w- c:\windows\system32\drivers\MSPQM.sys 2010-02-12 17:07 . 2008-07-22 11:38 142592 ----a-w- c:\windows\system32\drivers\aec.sys 2010-02-12 17:07 . 2008-07-22 11:39 56576 ----a-w- c:\windows\system32\drivers\swmidi.sys 2010-02-12 17:07 . 2008-07-22 11:39 52864 ----a-w- c:\windows\system32\drivers\DMusic.sys 2010-02-12 17:07 . 2008-07-22 11:39 83072 ----a-w- c:\windows\system32\drivers\wdmaud.sys 2010-02-12 17:07 . 2008-07-22 11:39 7552 ----a-w- c:\windows\system32\drivers\MSKSSRV.sys 2010-02-12 17:07 . 2008-07-22 11:39 172416 ----a-w- c:\windows\system32\drivers\kmixer.sys 2010-02-12 17:07 . 2008-07-22 11:39 5376 ----a-w- c:\windows\system32\drivers\MSPCLOCK.sys 2010-02-12 17:07 . 2008-07-22 11:39 60800 ----a-w- c:\windows\system32\drivers\sysaudio.sys 2010-02-12 17:07 . 2008-07-22 11:38 3072 ----a-w- c:\windows\system32\drivers\audstub.sys 2010-02-12 17:03 . 2010-02-12 17:03 -------- d-----w- c:\documents and settings\Pitek\Ustawienia lokalne\Dane aplikacji\Adobe 2010-02-12 17:01 . 2010-02-14 09:27 -------- d-----w- c:\windows\system32\CatRoot2 2010-02-12 17:01 . 2010-02-12 17:01 -------- d-----w- c:\windows\system32\CatRoot 2010-02-12 17:01 . 2010-02-12 17:04 -------- d--h--r- c:\documents and settings\All Users\Dane aplikacji 2010-02-12 17:01 . 2010-02-12 16:30 -------- d--h--r- c:\documents and settings\Default User\Dane aplikacji 2010-02-12 17:01 . 2010-02-13 12:33 -------- d-----w- C:\Program Files 2010-02-12 17:01 . 2006-06-01 20:37 236800 ----a-w- c:\windows\system32\drivers\RT2500.sys . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2010-02-12 17:11 . 2010-02-12 17:10 -------- d-----w- c:\program files\K-Lite Codec Pack 2010-02-12 17:09 . 2010-02-12 16:30 -------- d-----w- c:\program files\Your Uninstaller 2008 2010-02-12 17:09 . 2010-02-12 16:30 -------- d---a-w- c:\documents and settings\All Users\Dane aplikacji\TEMP 2010-02-12 17:06 . 2010-02-12 17:06 -------- d-----w- c:\program files\UlisesSoft 2010-02-12 17:05 . 2010-02-12 17:05 0 ----a-w- c:\windows\ativpsrm.bin 2010-02-12 17:04 . 2010-02-12 17:04 -------- d-----w- c:\program files\ESET 2010-02-12 17:04 . 2010-02-12 17:04 -------- d-----w- c:\documents and settings\All Users\Dane aplikacji\ESET 2010-02-12 16:58 . 2001-08-23 12:00 71846 ----a-w- c:\windows\system32\perfc015.dat 2010-02-12 16:58 . 2001-08-23 12:00 438688 ----a-w- c:\windows\system32\perfh015.dat 2010-02-12 16:56 . 2010-02-12 16:56 -------- d-----w- c:\program files\ATI Technologies 2010-02-12 16:56 . 2010-02-12 16:56 -------- d--h--w- c:\program files\InstallShield Installation Information 2010-02-12 16:56 . 2010-02-12 16:56 -------- d-----w- c:\program files\Common Files\InstallShield 2010-02-12 16:30 . 2010-02-12 17:02 -------- d-----w- c:\documents and settings\Pitek\Dane aplikacji\URSoft 2010-02-12 16:30 . 2010-02-12 16:56 -------- d-----w- c:\documents and settings\Administrator\Dane aplikacji\URSoft 2010-02-12 16:30 . 2010-02-12 16:30 -------- d-----w- c:\documents and settings\Default User\Dane aplikacji\URSoft 2010-02-12 16:30 . 2010-02-12 16:30 -------- d-----w- c:\program files\Mozilla Thunderbird 2010-02-12 16:30 . 2010-02-12 16:30 -------- d-----w- c:\program files\OO Software 2010-02-12 16:30 . 2010-02-12 16:30 -------- d-----w- c:\program files\Notepad++ 2010-02-12 16:30 . 2010-02-12 17:02 -------- d-----w- c:\documents and settings\Pitek\Dane aplikacji\Notepad++ 2010-02-12 16:30 . 2010-02-12 16:56 -------- d-----w- c:\documents and settings\Administrator\Dane aplikacji\Notepad++ 2010-02-12 16:30 . 2010-02-12 16:30 -------- d-----w- c:\documents and settings\Default User\Dane aplikacji\Notepad++ 2010-02-12 16:30 . 2010-02-12 16:30 -------- d-----w- c:\program files\MozBackup 2010-02-12 16:30 . 2010-02-12 16:29 -------- d-----w- c:\program files\Java 2010-02-12 16:29 . 2010-02-12 16:29 -------- d-----w- c:\program files\Common Files\Java 2010-02-12 16:29 . 2010-02-12 16:29 -------- d-----w- c:\program files\FastStone Image Viewer 2010-02-12 16:29 . 2010-02-12 16:29 -------- d-----w- c:\program files\Driver Magician 2010-02-12 16:29 . 2010-02-12 16:29 -------- d-----w- c:\program files\PowerISO 2010-02-12 16:29 . 2010-02-12 16:28 -------- d-----w- c:\program files\Nero 2010-02-12 16:28 . 2010-02-12 16:28 -------- d-----w- c:\program files\Common Files\Nero 2010-02-12 16:28 . 2010-02-12 16:28 -------- d-----w- c:\documents and settings\All Users\Dane aplikacji\Nero 2010-02-12 16:27 . 2010-02-12 16:27 -------- d-----w- c:\program files\Common Files\Adobe 2010-02-12 16:27 . 2010-02-12 16:27 -------- d-----w- c:\program files\Unlocker 2010-02-12 16:27 . 2010-02-12 16:27 -------- d-----w- c:\program files\Microsoft Silverlight 2010-02-12 16:20 . 2010-02-12 16:20 21856 ----a-w- c:\windows\system32\emptyregdb.dat 2010-02-12 16:19 . 2010-02-12 16:19 -------- d-----w- c:\program files\uTorrent 2010-02-12 16:18 . 2010-02-12 17:02 -------- d-----w- c:\documents and settings\Pitek\Dane aplikacji\Xentient 2010-02-12 16:18 . 2010-02-12 16:56 -------- d-----w- c:\documents and settings\Administrator\Dane aplikacji\Xentient 2010-02-12 16:18 . 2010-02-12 16:18 -------- d-----w- c:\documents and settings\Default User\Dane aplikacji\Xentient 2010-02-12 16:18 . 2010-02-12 16:17 -------- d-----w- c:\program files\winamp 2010-02-12 16:16 . 2010-02-12 16:16 -------- d-----w- c:\program files\Utilities 2010-02-12 16:16 . 2010-02-12 17:02 -------- d-----w- c:\documents and settings\Pitek\Dane aplikacji\uTorrent 2010-02-12 16:16 . 2010-02-12 16:56 -------- d-----w- c:\documents and settings\Administrator\Dane aplikacji\uTorrent 2010-02-12 16:16 . 2010-02-12 16:16 -------- d-----w- c:\documents and settings\Default User\Dane aplikacji\uTorrent 2010-02-12 16:16 . 2010-02-12 16:16 -------- d-----w- c:\program files\Windows Sidebar 2010-02-12 16:16 . 2010-02-12 16:16 -------- d-----w- c:\program files\System 2010-02-12 16:16 . 2010-02-12 16:16 -------- d-----w- c:\program files\FirmTools 2010-02-12 16:16 . 2010-02-12 16:16 -------- d-----w- c:\program files\Drive Space Indicator 2010-02-12 16:16 . 2010-02-12 16:16 -------- d-----w- c:\program files\Driver Sweeper 2010-02-12 16:16 . 2010-02-12 16:16 -------- d-----w- c:\program files\Windows Media Connect 2 . ------- Sigcheck ------- [-] 2008-07-22 . E88631E21A9CACA06104802F9E915115 . 361600 . . [5.1.2600.5625] . . c:\windows\system32\drivers\tcpip.sys [-] 2008-07-22 . 8CD81261DA6BD4BCFBD857A25220A1FB . 689152 . . [5.82] . . c:\windows\system32\comctl32.dll [-] 2008-07-22 . 5FB59F2506787A7E036B7C2EFF1CCE24 . 2190208 . . [5.1.2600.5512] . . c:\windows\system32\ntoskrnl.exe [-] 2008-07-22 . 5F1CCDF37F28A88D0473B0C9EA1E0D58 . 487424 . . [5.1.2600.5512] . . c:\windows\system32\user32.dll [-] 2008-07-22 . 808DE3BFBABD3737BF331661D919E32B . 893952 . . [7.00.6000.20815] . . c:\windows\system32\wininet.dll [-] 2008-07-22 . B49A80A502FD86B2F05BC7BBD723DDAB . 1528832 . . [6.00.2900.5512] . . c:\windows\explorer.exe [-] 2008-07-22 . 0277E1A3E8B337555A45943808451981 . 40448 . . [5.1.2600.5512] . . c:\windows\system32\ctfmon.exe c:\windows\System32\wscntfy.exe ... - brak elementu !! c:\windows\System32\regsvc.dll ... - brak elementu !! . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "VisualTaskTips"="c:\program files\Utilities\VisualTaskTips\VisualTaskTips.exe" [2007-09-05 36352] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "DriveSpace"="c:\program files\Drive Space Indicator\DrvSpace.exe" [2008-07-20 395716] "SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784] "OODefragTray"="c:\windows\system32\oodtray.exe" [2007-05-11 2512392] "ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2006-11-16 344064] "egui"="c:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2009-05-14 2029640] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "VisualTaskTips"="c:\program files\Utilities\VisualTaskTips\VisualTaskTips.exe" [2007-09-05 36352] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce] "nltide_3"="advpack.dll" [2008-07-22 124928] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] "NoSMHelp"= 1 (0x1) "NoSMConfigurePrograms"= 1 (0x1) "NoResolveTrack"= 1 (0x1) [HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer] "NoSMHelp"= 1 (0x1) "NoSMConfigurePrograms"= 1 (0x1) "NoResolveTrack"= 1 (0x1) [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager] BootExecute REG_MULTI_SZ autocheck autochk *\0OODBS [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "DisableUnicastResponsesToMulticastBroadcast"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "%windir%\\system32\\sessmgr.exe"= "c:\\WINDOWS\\system32\\mmc.exe"= R1 ehdrv;ehdrv;c:\windows\system32\drivers\ehdrv.sys [2009-05-14 107256] R1 epfwtdir;epfwtdir;c:\windows\system32\drivers\epfwtdir.sys [2009-05-14 94360] R1 vcdrom;Virtual CD-ROM Device Driver;c:\program files\System\CPL Bonus\vcdrom.sys [2010-02-12 8576] R2 ekrn;ESET Service;c:\program files\ESET\ESET NOD32 Antivirus\ekrn.exe [2009-05-14 731840] --- Inne Usługi/Sterowniki w Pamięci --- *NewlyCreated* - VCDROM . . ------- Skan uzupełniający ------- . uStart Page = hxxp://www.google.com/ Trusted Zone: google.com\mail FF - ProfilePath - c:\documents and settings\Pitek\Dane aplikacji\Mozilla\Firefox\Profiles\sal09j4d.default\ FF - plugin: c:\program files\K-Lite Codec Pack\Real\browser\plugins\nppl3260.dll FF - plugin: c:\program files\K-Lite Codec Pack\Real\browser\plugins\nprpjplug.dll . - - - - USUNIĘTO PUSTE WPISY - - - - AddRemove-BugOff - c:\documents and settings\Pitek\Pulpit\BugOff.exe ************************************************************************** catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2010-02-14 10:32 Windows 5.1.2600 Dodatek Service Pack 3 NTFS skanowanie ukrytych procesów ... skanowanie ukrytych wpisów autostartu ... skanowanie ukrytych plików ... skanowanie pomyślnie ukończone ukryte pliki: 0 ************************************************************************** . --------------------- ZABLOKOWANE KLUCZE REJESTRU --------------------- [HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\System*] "OODEFRAG10.00.00.01WORKSTATION"="32DFD24292949FD1D6646997458E7D43275ADC90DE25A5C67686AE3A93BE5B2A933F7CDAAE0860D068A8C9993519877717C2D9698FE7D75136C29ACBCC0C3F6B184120E26C57D2699BB931CEC037240F184F5B61DA69231351F2A21C0CFE8FCDFE47BB81EE37FB2BE1E3D3350D1A61FB6DDB6F6D87F6BD06F89FCEB4D7224D6F0C25EDF41F0CC6FA30698CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CA6A0AC4980AC7933A6171C11EC38DE3D5D575E7D6A3B98085D575E7D6A3B980828CAA0767A76F0F9DBCAECE709918257CEF7B4E6AEB27F139E4456C73995A9F341E0FC3E620F14249690B8A483DB9CB9CB00E0CA9F8E3AD18A3BC9DB3F00183877A4C950105C032884880D6D69B1A710133DB7D9891C1AEFE04C5EC1B4FBB643C9324A861CB9CDFB5B320983971E208A2FAED6DDAAB8A7F921184FEADE56BA9B4E6FF31D7006F43FE2D2018C3DB17100BD990E069846DC9D6086082E59E14BE5AC03F1334A256BB0F9717B91DE047F6B720862E43BA928AEC3402B4810768370A057A3CE3E7F1CB6115B3481D2AA9F6892C68C6F51CD6C2487B40FD8C5EE75A97B9C9958320163D9AD1F9B2B47439B3B78667881E9200318FA163B620F2824A6A0459B1B611893C66912D445B96E32C8123DC659EA91B5C902D86E4C5707861E0808A3C7D939EF4E71CB376AFED0149963634D188C97C11C133899625BEF8A6D3F60E073FEDBB1E485A84D96BE9369DD01B69246DBADDC1639B363D32E4F0F93660EB595887B87A4FDC9582AF3634AE69557D3CC394E2C62140A2434B3926834B014390B7F978F494191CAEC70EFC5A9DFAB037959FE4B505745EAFAA5ADDE9766B8B495C23561B44EA8CC07D5EE5DC0B15CC28045C24AD1C92D760414962D2A6588A6D6865985EAB4FCB9059C9708E9F056EB775A23AAFE47CF3F8DDFC7857A1CD142D85091F8969BBB205A91A8AE07984A0C5848AFE413BD80ED3B3D400ABD10A66E887CEDAB023BDBC55B5361AF1EB6AFE1021578E16BB2D55E163702D3CAD8E0C4B43881839F62149EC155865CD86DBC64B61893820B3BA7A4862C946E9EA399149386635A8470DFDA2ADF60FC05F3F03A1DFE1B1A1B0496855FCC81D95830B0DFBBBD2F7B695A01D5960FBD4916148BC03F4A2C6D644B8278D19ED80B3DD1C85D2B8A05A82AABFAA5EC53EBEF9FAA92088B4F68B955E493ADF47C2CE8B2734977C1E989184980959075EE42145D2B4F5454B6752E03B7B206C59492CF470E5D4CC3AF62EFEA095C12DDFA974AAB1C4F9F51FB7D6BA2C08E952367A710A833F4AF5802BCD0D60C22DAB8E1CA1D0E1862159AF12E8A100D1AA7CF4A086D2C0841A88EDB4749FBE2784D79643A0BA8CB9F1531BB389548BF89B8F3E8D79FC9C4BB6ED48B" . --------------------- Pliki DLL ładowane pod uruchomionymi procesami --------------------- - - - - - - - > 'winlogon.exe'(604) c:\windows\system32\SETUPAPI.dll c:\windows\system32\sfc_os.dll c:\windows\system32\Ati2evxx.dll c:\windows\system32\COMRes.dll - - - - - - - > 'lsass.exe'(700) c:\windows\system32\setupapi.dll c:\windows\system32\scecli.dll . Czas ukończenia: 2010-02-14 10:33:40 ComboFix-quarantined-files.txt 2010-02-14 09:33 Przed: 29 601 869 824 bajtów wolnych Po: 29 579 722 752 bajtów wolnych - - End Of File - - BF4DFE6D9D70592FE3413B4407D35843

**Posty:** 18165 · przez **wojtas** 14 Lut 2010, 17:18

Uruchom SystemLook , w oknie wklej:

:filefind
regsvc.dll
wscntfy.exe

i dajesz look

pokazujesz raport

**Posty:** 76 · przez **kerli** 14 Lut 2010, 18:55

Kod: Zaznacz wszystko: SystemLook v1.0 by jpshortstuff (11.01.10) Log created at 17:53 on 14/02/2010 by Pitek (Administrator - Elevation successful) ========== filefind ========== Searching for "regsvc.dll" No files found. Searching for "wscntfy.exe" No files found. -=End Of File=-

Coś dalej ???

**Posty:** 18165 · przez **wojtas** 14 Lut 2010, 22:56

pobierz:http://www.sendspace.com/file/q4fhe0 . rozpakuj na dysk c

Otworz notatnik i wklej w nim to:

FCopy::
c:\wscntfy.exe | c:\windows\system32\wscntfy.exe
c:\regsvc.dll | c:\windows\system32\regsvc.dll

>>Plik>>Zapisz jako... >>> CFScript
Przeciągnij i upuść plik CFScript.txt na plik ComboFix.exe
-->

zrób skan Malwarebytes Anti-Malware (zaktualizuj, usuń co znajdzie ) i daj raport ze skanu

**Posty:** 76 · przez **kerli** 15 Lut 2010, 09:45

Logo z operacji :

Kod: Zaznacz wszystko: ComboFix 10-02-12.01 - Pitek 2010-02-15 8:26.2.1 - x86 Microsoft Windows XP Professional 5.1.2600.3.1250.48.1045.18.1023.683 [GMT 1:00] Uruchomiony z: c:\documents and settings\Pitek\Pulpit\ComboFix.exe Użyto następujących komend :: c:\documents and settings\Pitek\Pulpit\CFScript.txt * Rezydentny antywirus jest aktywny . ((((((((((((((((((((((((((((((((((((((( Usunięto ))))))))))))))))))))))))))))))))))))))))))))))))) . . --------------- FCopy --------------- c:\wscntfy.exe --> c:\windows\system32\wscntfy.exe c:\regsvc.dll --> c:\windows\system32\regsvc.dll . ((((((((((((((((((((((((( Pliki utworzone od 2010-01-15 do 2010-02-15 ))))))))))))))))))))))))))))))) . 2010-02-15 07:25 . 2008-04-14 20:50 59904 ----a-w- c:\windows\system32\regsvc.dll 2010-02-15 07:25 . 2008-04-14 20:51 13824 ----a-w- c:\windows\system32\wscntfy.exe 2010-02-15 07:21 . 2008-04-14 20:51 13824 ------w- C:\wscntfy.exe 2010-02-15 07:21 . 2008-04-14 20:50 59904 ------w- C:\regsvc.dll 2010-02-14 09:27 . 2010-02-14 09:27 -------- d-----w- c:\documents and settings\Pitek\Ustawienia lokalne\Dane aplikacji\ESET 2010-02-13 12:33 . 2010-02-13 12:33 -------- d-----w- C:\rsit 2010-02-13 12:33 . 2010-02-13 12:33 -------- d-----w- c:\program files\trend micro 2010-02-12 17:21 . 2010-02-12 17:21 -------- d-----w- c:\documents and settings\Pitek\Dane aplikacji\BESTplayer 2010-02-12 17:18 . 2010-02-12 17:18 0 ----a-w- c:\windows\nsreg.dat 2010-02-12 17:18 . 2010-02-12 17:18 -------- d-----w- c:\documents and settings\Pitek\Ustawienia lokalne\Dane aplikacji\Mozilla 2010-02-12 17:10 . 2010-02-12 17:10 -------- d-----w- c:\documents and settings\Pitek\Dane aplikacji\Winamp 2010-02-12 17:07 . 2008-07-22 11:39 6272 ----a-w- c:\windows\system32\drivers\splitter.sys 2010-02-12 17:07 . 2008-07-22 11:39 2944 ----a-w- c:\windows\system32\drivers\drmkaud.sys 2010-02-12 17:07 . 2008-07-22 11:39 4992 ----a-w- c:\windows\system32\drivers\MSPQM.sys 2010-02-12 17:07 . 2008-07-22 11:38 142592 ------w- c:\windows\system32\drivers\aec.sys 2010-02-12 17:07 . 2008-07-22 11:39 56576 ----a-w- c:\windows\system32\drivers\swmidi.sys 2010-02-12 17:07 . 2008-07-22 11:39 52864 ----a-w- c:\windows\system32\drivers\DMusic.sys 2010-02-12 17:07 . 2008-07-22 11:39 83072 ----a-w- c:\windows\system32\drivers\wdmaud.sys 2010-02-12 17:07 . 2008-07-22 11:39 7552 ----a-w- c:\windows\system32\drivers\MSKSSRV.sys 2010-02-12 17:07 . 2008-07-22 11:39 172416 ----a-w- c:\windows\system32\drivers\kmixer.sys 2010-02-12 17:07 . 2008-07-22 11:39 5376 ----a-w- c:\windows\system32\drivers\MSPCLOCK.sys 2010-02-12 17:07 . 2008-07-22 11:39 60800 ----a-w- c:\windows\system32\drivers\sysaudio.sys 2010-02-12 17:07 . 2008-07-22 11:38 3072 ----a-w- c:\windows\system32\drivers\audstub.sys 2010-02-12 17:03 . 2010-02-12 17:03 -------- d-----w- c:\documents and settings\Pitek\Ustawienia lokalne\Dane aplikacji\Adobe 2010-02-12 17:01 . 2010-02-15 07:25 -------- d-----w- c:\windows\system32\CatRoot2 2010-02-12 17:01 . 2010-02-12 17:01 -------- d-----w- c:\windows\system32\CatRoot 2010-02-12 17:01 . 2010-02-12 17:04 -------- d--h--r- c:\documents and settings\All Users\Dane aplikacji 2010-02-12 17:01 . 2010-02-12 16:30 -------- d--h--r- c:\documents and settings\Default User\Dane aplikacji 2010-02-12 17:01 . 2010-02-15 07:14 -------- d-----w- C:\Program Files 2010-02-12 17:01 . 2006-06-01 20:37 236800 ----a-w- c:\windows\system32\drivers\RT2500.sys . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2010-02-15 07:14 . 2010-02-15 07:14 -------- d-----w- c:\program files\microsoft frontpage 2010-02-12 17:11 . 2010-02-12 17:10 -------- d-----w- c:\program files\K-Lite Codec Pack 2010-02-12 17:09 . 2010-02-12 16:30 -------- d-----w- c:\program files\Your Uninstaller 2008 2010-02-12 17:09 . 2010-02-12 16:30 -------- d---a-w- c:\documents and settings\All Users\Dane aplikacji\TEMP 2010-02-12 17:06 . 2010-02-12 17:06 -------- d-----w- c:\program files\UlisesSoft 2010-02-12 17:05 . 2010-02-12 17:05 0 ----a-w- c:\windows\ativpsrm.bin 2010-02-12 17:04 . 2010-02-12 17:04 -------- d-----w- c:\program files\ESET 2010-02-12 17:04 . 2010-02-12 17:04 -------- d-----w- c:\documents and settings\All Users\Dane aplikacji\ESET 2010-02-12 16:58 . 2001-08-23 12:00 71846 ----a-w- c:\windows\system32\perfc015.dat 2010-02-12 16:58 . 2001-08-23 12:00 438688 ----a-w- c:\windows\system32\perfh015.dat 2010-02-12 16:56 . 2010-02-12 16:56 -------- d-----w- c:\program files\ATI Technologies 2010-02-12 16:56 . 2010-02-12 16:56 -------- d--h--w- c:\program files\InstallShield Installation Information 2010-02-12 16:56 . 2010-02-12 16:56 -------- d-----w- c:\program files\Common Files\InstallShield 2010-02-12 16:30 . 2010-02-12 17:02 -------- d-----w- c:\documents and settings\Pitek\Dane aplikacji\URSoft 2010-02-12 16:30 . 2010-02-12 16:56 -------- d-----w- c:\documents and settings\Administrator\Dane aplikacji\URSoft 2010-02-12 16:30 . 2010-02-12 16:30 -------- d-----w- c:\documents and settings\Default User\Dane aplikacji\URSoft 2010-02-12 16:30 . 2010-02-12 16:30 -------- d-----w- c:\program files\Mozilla Thunderbird 2010-02-12 16:30 . 2010-02-12 16:30 -------- d-----w- c:\program files\OO Software 2010-02-12 16:30 . 2010-02-12 16:30 -------- d-----w- c:\program files\Notepad++ 2010-02-12 16:30 . 2010-02-12 17:02 -------- d-----w- c:\documents and settings\Pitek\Dane aplikacji\Notepad++ 2010-02-12 16:30 . 2010-02-12 16:56 -------- d-----w- c:\documents and settings\Administrator\Dane aplikacji\Notepad++ 2010-02-12 16:30 . 2010-02-12 16:30 -------- d-----w- c:\documents and settings\Default User\Dane aplikacji\Notepad++ 2010-02-12 16:30 . 2010-02-12 16:30 -------- d-----w- c:\program files\MozBackup 2010-02-12 16:30 . 2010-02-12 16:29 -------- d-----w- c:\program files\Java 2010-02-12 16:29 . 2010-02-12 16:29 -------- d-----w- c:\program files\Common Files\Java 2010-02-12 16:29 . 2010-02-12 16:29 -------- d-----w- c:\program files\FastStone Image Viewer 2010-02-12 16:29 . 2010-02-12 16:29 -------- d-----w- c:\program files\Driver Magician 2010-02-12 16:29 . 2010-02-12 16:29 -------- d-----w- c:\program files\PowerISO 2010-02-12 16:29 . 2010-02-12 16:28 -------- d-----w- c:\program files\Nero 2010-02-12 16:28 . 2010-02-12 16:28 -------- d-----w- c:\program files\Common Files\Nero 2010-02-12 16:28 . 2010-02-12 16:28 -------- d-----w- c:\documents and settings\All Users\Dane aplikacji\Nero 2010-02-12 16:27 . 2010-02-12 16:27 -------- d-----w- c:\program files\Common Files\Adobe 2010-02-12 16:27 . 2010-02-12 16:27 -------- d-----w- c:\program files\Unlocker 2010-02-12 16:27 . 2010-02-12 16:27 -------- d-----w- c:\program files\Microsoft Silverlight 2010-02-12 16:20 . 2010-02-12 16:20 21856 ----a-w- c:\windows\system32\emptyregdb.dat 2010-02-12 16:19 . 2010-02-12 16:19 -------- d-----w- c:\program files\uTorrent 2010-02-12 16:18 . 2010-02-12 17:02 -------- d-----w- c:\documents and settings\Pitek\Dane aplikacji\Xentient 2010-02-12 16:18 . 2010-02-12 16:56 -------- d-----w- c:\documents and settings\Administrator\Dane aplikacji\Xentient 2010-02-12 16:18 . 2010-02-12 16:18 -------- d-----w- c:\documents and settings\Default User\Dane aplikacji\Xentient 2010-02-12 16:18 . 2010-02-12 16:17 -------- d-----w- c:\program files\winamp 2010-02-12 16:16 . 2010-02-12 16:16 -------- d-----w- c:\program files\Utilities 2010-02-12 16:16 . 2010-02-12 17:02 -------- d-----w- c:\documents and settings\Pitek\Dane aplikacji\uTorrent 2010-02-12 16:16 . 2010-02-12 16:56 -------- d-----w- c:\documents and settings\Administrator\Dane aplikacji\uTorrent 2010-02-12 16:16 . 2010-02-12 16:16 -------- d-----w- c:\documents and settings\Default User\Dane aplikacji\uTorrent 2010-02-12 16:16 . 2010-02-12 16:16 -------- d-----w- c:\program files\Windows Sidebar 2010-02-12 16:16 . 2010-02-12 16:16 -------- d-----w- c:\program files\System 2010-02-12 16:16 . 2010-02-12 16:16 -------- d-----w- c:\program files\FirmTools 2010-02-12 16:16 . 2010-02-12 16:16 -------- d-----w- c:\program files\Drive Space Indicator 2010-02-12 16:16 . 2010-02-12 16:16 -------- d-----w- c:\program files\Driver Sweeper 2010-02-12 16:16 . 2010-02-12 16:16 -------- d-----w- c:\program files\Windows Media Connect 2 . ------- Sigcheck ------- [-] 2008-07-22 . E88631E21A9CACA06104802F9E915115 . 361600 . . [5.1.2600.5625] . . c:\windows\system32\drivers\tcpip.sys [-] 2008-07-22 . 8CD81261DA6BD4BCFBD857A25220A1FB . 689152 . . [5.82] . . c:\windows\system32\comctl32.dll [-] 2008-07-22 . 5FB59F2506787A7E036B7C2EFF1CCE24 . 2190208 . . [5.1.2600.5512] . . c:\windows\system32\ntoskrnl.exe [-] 2008-07-22 . 5F1CCDF37F28A88D0473B0C9EA1E0D58 . 487424 . . [5.1.2600.5512] . . c:\windows\system32\user32.dll [-] 2008-07-22 . 808DE3BFBABD3737BF331661D919E32B . 893952 . . [7.00.6000.20815] . . c:\windows\system32\wininet.dll [-] 2008-07-22 . B49A80A502FD86B2F05BC7BBD723DDAB . 1528832 . . [6.00.2900.5512] . . c:\windows\explorer.exe [-] 2008-07-22 . 0277E1A3E8B337555A45943808451981 . 40448 . . [5.1.2600.5512] . . c:\windows\system32\ctfmon.exe . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "VisualTaskTips"="c:\program files\Utilities\VisualTaskTips\VisualTaskTips.exe" [2007-09-05 36352] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "DriveSpace"="c:\program files\Drive Space Indicator\DrvSpace.exe" [2008-07-20 395716] "SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784] "OODefragTray"="c:\windows\system32\oodtray.exe" [2007-05-11 2512392] "ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2006-11-16 344064] "egui"="c:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2009-05-14 2029640] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "VisualTaskTips"="c:\program files\Utilities\VisualTaskTips\VisualTaskTips.exe" [2007-09-05 36352] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce] "nltide_3"="advpack.dll" [2008-07-22 124928] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] "NoSMHelp"= 1 (0x1) "NoSMConfigurePrograms"= 1 (0x1) "NoResolveTrack"= 1 (0x1) [HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer] "NoSMHelp"= 1 (0x1) "NoSMConfigurePrograms"= 1 (0x1) "NoResolveTrack"= 1 (0x1) [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager] BootExecute REG_MULTI_SZ autocheck autochk *\0OODBS [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "DisableUnicastResponsesToMulticastBroadcast"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "%windir%\\system32\\sessmgr.exe"= "c:\\WINDOWS\\system32\\mmc.exe"= R1 ehdrv;ehdrv;c:\windows\system32\drivers\ehdrv.sys [2009-05-14 107256] R1 epfwtdir;epfwtdir;c:\windows\system32\drivers\epfwtdir.sys [2009-05-14 94360] R1 vcdrom;Virtual CD-ROM Device Driver;c:\program files\System\CPL Bonus\vcdrom.sys [2010-02-12 8576] R2 ekrn;ESET Service;c:\program files\ESET\ESET NOD32 Antivirus\ekrn.exe [2009-05-14 731840] --- Inne Usługi/Sterowniki w Pamięci --- *NewlyCreated* - HELPSVC *NewlyCreated* - VCDROM . . ------- Skan uzupełniający ------- . uStart Page = hxxp://www.google.com/ Trusted Zone: google.com\mail FF - ProfilePath - c:\documents and settings\Pitek\Dane aplikacji\Mozilla\Firefox\Profiles\sal09j4d.default\ FF - plugin: c:\program files\K-Lite Codec Pack\Real\browser\plugins\nppl3260.dll FF - plugin: c:\program files\K-Lite Codec Pack\Real\browser\plugins\nprpjplug.dll . ************************************************************************** catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2010-02-15 08:30 Windows 5.1.2600 Dodatek Service Pack 3 NTFS skanowanie ukrytych procesów ... skanowanie ukrytych wpisów autostartu ... skanowanie ukrytych plików ... skanowanie pomyślnie ukończone ukryte pliki: 0 ************************************************************************** . --------------------- ZABLOKOWANE KLUCZE REJESTRU --------------------- [HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\System*] "OODEFRAG10.00.00.01WORKSTATION"="32DFD24292949FD1D6646997458E7D43275ADC90DE25A5C67686AE3A93BE5B2A933F7CDAAE0860D068A8C9993519877717C2D9698FE7D75136C29ACBCC0C3F6B184120E26C57D2699BB931CEC037240F184F5B61DA69231351F2A21C0CFE8FCDFE47BB81EE37FB2BE1E3D3350D1A61FB6DDB6F6D87F6BD06F89FCEB4D7224D6F0C25EDF41F0CC6FA30698CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CA6A0AC4980AC7933A6171C11EC38DE3D5D575E7D6A3B98085D575E7D6A3B980828CAA0767A76F0F9DBCAECE709918257CEF7B4E6AEB27F139E4456C73995A9F341E0FC3E620F14249690B8A483DB9CB9CB00E0CA9F8E3AD18A3BC9DB3F00183877A4C950105C032884880D6D69B1A710133DB7D9891C1AEFE04C5EC1B4FBB643C9324A861CB9CDFB5B320983971E208A2FAED6DDAAB8A7F921184FEADE56BA9B4E6FF31D7006F43FE2D2018C3DB17100BD990E069846DC9D6086082E59E14BE5AC03F1334A256BB0F9717B91DE047F6B720862E43BA928AEC3402B4810768370A057A3CE3E7F1CB6115B3481D2AA9F6892C68C6F51CD6C2487B40FD8C5EE75A97B9C9958320163D9AD1F9B2B47439B3B78667881E9200318FA163B620F2824A6A0459B1B611893C66912D445B96E32C8123DC659EA91B5C902D86E4C5707861E0808A3C7D939EF4E71CB376AFED0149963634D188C97C11C133899625BEF8A6D3F60E073FEDBB1E485A84D96BE9369DD01B69246DBADDC1639B363D32E4F0F93660EB595887B87A4FDC9582AF3634AE69557D3CC394E2C62140A2434B3926834B014390B7F978F494191CAEC70EFC5A9DFAB037959FE4B505745EAFAA5ADDE9766B8B495C23561B44EA8CC07D5EE5DC0B15CC28045C24AD1C92D760414962D2A6588A6D6865985EAB4FCB9059C9708E9F056EB775A23AAFE47CF3F8DDFC7857A1CD142D85091F8969BBB205A91A8AE07984A0C5848AFE413BD80ED3B3D400ABD10A66E887CEDAB023BDBC55B5361AF1EB6AFE1021578E16BB2D55E163702D3CAD8E0C4B43881839F62149EC155865CD86DBC64B61893820B3BA7A4862C946E9EA399149386635A8470DFDA2ADF60FC05F3F03A1DFE1B1A1B0496855FCC81D95830B0DFBBBD2F7B695A01D5960FBD4916148BC03F4A2C6D644B8278D19ED80B3DD1C85D2B8A05A82AABFAA5EC53EBEF9FAA92088B4F68B955E493ADF47C2CE8B2734977C1E989184980959075EE42145D2B4F5454B6752E03B7B206C59492CF470E5D4CC3AF62EFEA095C12DDFA974AAB1C4F9F51FB7D6BA2C08E952367A710A833F4AF5802BCD0D60C22DAB8E1CA1D0E1862159AF12E8A100D1AA7CF4A086D2C0841A88EDB4749FBE2784D79643A0BA8CB9F1531BB389548BF89B8F3E8D79FC9C4BB6ED48B" . --------------------- Pliki DLL ładowane pod uruchomionymi procesami --------------------- - - - - - - - > 'winlogon.exe'(604) c:\windows\system32\SETUPAPI.dll c:\windows\system32\sfc_os.dll c:\windows\system32\Ati2evxx.dll c:\windows\system32\COMRes.dll - - - - - - - > 'lsass.exe'(700) c:\windows\system32\setupapi.dll c:\windows\system32\scecli.dll - - - - - - - > 'explorer.exe'(15872) c:\windows\system32\SHDOCVW.dll c:\program files\Utilities\VisualTaskTips\VttHooks.dll c:\windows\system32\COMRes.dll c:\windows\system32\ntshrui.dll c:\windows\system32\msi.dll c:\windows\system32\LINKINFO.dll c:\windows\system32\SETUPAPI.dll c:\windows\system32\WPDShServiceObj.dll c:\windows\system32\PortableDeviceTypes.dll c:\windows\system32\PortableDeviceApi.dll c:\windows\system32\NETSHELL.dll c:\windows\system32\credui.dll c:\windows\system32\MSVCP60.dll . Czas ukończenia: 2010-02-15 08:32:10 ComboFix-quarantined-files.txt 2010-02-15 07:32 ComboFix2.txt 2010-02-14 09:33 Przed: 29 566 017 536 bajtów wolnych Po: 29 543 686 144 bajtów wolnych WindowsXP-KB310994-SP2-Pro-BootDisk-PLK.exe [boot loader] timeout=2 default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS [operating systems] c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect /noexecute=alwaysoff - - End Of File - - 44C2C046A860944BA98D14BB5C3F454B

Z skana:

Kod: Zaznacz wszystko: Malwarebytes' Anti-Malware 1.44 Wersja bazy definicji: 3741 Windows 5.1.2600 Dodatek Service Pack 3 Internet Explorer 7.0.5730.13 2010-02-15 09:04:17 mbam-log-2010-02-15 (09-04-17).txt Typ skanowania: Szybkie skanowanie Przeskanowane obiekty: 114713 Upłynęło: 5 minute(s), 14 second(s) Zainfekowane procesy w pamięci: 0 Zainfekowane moduły pamięci: 0 Zainfekowane klucze rejestru: 0 Zainfekowane wartości rejestru: 0 Zainfekowane pliki rejestru: 1 Zainfekowane foldery: 0 Zainfekowane pliki: 0 Zainfekowane procesy w pamięci: (Nie wykryto groźnych plików) Zainfekowane moduły pamięci: (Nie wykryto groźnych plików) Zainfekowane klucze rejestru: (Nie wykryto groźnych plików) Zainfekowane wartości rejestru: (Nie wykryto groźnych plików) Zainfekowane pliki rejestru: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoSMHelp (Hijack.Help) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully. Zainfekowane foldery: (Nie wykryto groźnych plików) Zainfekowane pliki: (Nie wykryto groźnych plików)

**Posty:** 18165 · przez **wojtas** 15 Lut 2010, 17:44

w logach czysto

**Posty:** 76 · przez **kerli** 15 Lut 2010, 17:53

no w loga czysto ale nadal pojawia się ten komunikat błąd.
Da sie to jakiś wyłączyć ten winhlp32.exe z procesów ?? bo jak by sie dało to chyba było by po sprawie .

**Posty:** 18165 · przez **wojtas** 15 Lut 2010, 20:30

spróbuj go skasować (zrób kopie) i czy dalej będzie błąd..

**Posty:** 76 · przez **kerli** 15 Lut 2010, 22:32

Usunełem winhlp32.exe z C/windows/system32/winhlp32.exe . Zrobiłem restarta a w procesach nadal jest winhlp32.exe . Wyszukałem wyszukiwarką czy gdzieś jeszcze jest ale nic nie znalazło a w procesach jest. Może jest jakoś ukryty.
Jakiś program co znajdze albo coś ??? Pierwsze raz mi sie takie coś znażyło a i robiłem formata i na czystym systemi tez sie pojawia

**Posty:** 18165 · przez **wojtas** 15 Lut 2010, 23:13

Uruchom SystemLook , w oknie wklej:

:filefind
winhlp32.exe

i dajesz look

**Posty:** 76 · przez **kerli** 15 Lut 2010, 23:30

wywaliłem proces winhlp.exe . Usunełem z windowsa wszystkie winhlp32 , potem w rejestrze też usunełem reset i teraz już sie nie pokazuję, mam nadzieje ze nie bedzie to potrzebne

Jutro jeszcze logo dam z combofixa do sprawdzenia i by było po problemie

Kto jest na forum