proszę o sprawdzenie loga

**Posty:** 48 · przez **dawido_0** 27 Lis 2007, 20:04

Witam! Proszę o sprawdzenie loga, komp się muli explorer po włączeniu kompa nieodpowiada przez ok. 5 min. później też się zacina. Oto log:

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 18:53:36, on 2007-11-27 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: E:\WINDOWS\System32\smss.exe E:\WINDOWS\system32\winlogon.exe E:\WINDOWS\system32\services.exe E:\WINDOWS\system32\lsass.exe E:\WINDOWS\system32\svchost.exe E:\WINDOWS\System32\svchost.exe E:\WINDOWS\Explorer.EXE E:\WINDOWS\system32\spoolsv.exe E:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe E:\WINDOWS\system32\RUNDLL32.EXE E:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe E:\WINDOWS\system32\nvsvc32.exe E:\WINDOWS\system32\tcpsvcs.exe E:\WINDOWS\System32\snmp.exe E:\WINDOWS\system32\wuauclt.exe E:\WINDOWS\system32\wuauclt.exe E:\Program Files\Internet Explorer\IEXPLORE.EXE E:\WINDOWS\system32\wuauclt.exe E:\WINDOWS\SoftwareDistribution\Download\Install\Windows-KB890830-V1.35.exe E:\Documents and Settings\Dawid\Pulpit\HiJackThis.exe f:\51d0d8f8bb325d3059d8\mrtstub.exe E:\WINDOWS\system32\MRT.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.neostrada.pl/ R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: (no name) - {FA55900E-70D4-4EF7-85DE-6AB30BA2A11A} - E:\WINDOWS\system32\avifil.dll O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE E:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE E:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [SoundMAX] "E:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray O4 - HKLM\..\Run: [OSSelectorReinstall] E:\Program Files\Common Files\Acronis\Acronis Disk Director\oss_reinstall.exe O4 - HKLM\..\Run: [AVP] "E:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe" O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] E:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA') O9 - Extra button: Statystyki dla ochrony WWW - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - E:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\SCIEPlgn.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - E:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - E:\Program Files\Messenger\msmsgs.exe O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - http://www.systemrequirementslab.com/sysreqlab2.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{307998BC-1481-4CF9-8322-F1A1DF210F24}: NameServer = 194.204.159.1 217.98.63.164 O23 - Service: Kaspersky Anti-Virus 7.0 (AVP) - Kaspersky Lab - E:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe O23 - Service: Administrator programu IIS (IISADMIN) - Unknown owner - E:\WINDOWS\system32\inetsrv\inetinfo.exe (file missing) O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - E:\WINDOWS\system32\nvsvc32.exe O23 - Service: Simple Mail Transport Protocol (SMTP) (SMTPSVC) - Unknown owner - E:\WINDOWS\system32\inetsrv\inetinfo.exe (file missing) O23 - Service: Publikowanie w sieci World Wide Web (W3SVC) - Unknown owner - E:\WINDOWS\system32\inetsrv\inetinfo.exe (file missing) -- End of file - 3294 bytes

A to dziadowstwo to chyba do śmieci:

Kod: Zaznacz wszystko: O23 - Service: Publikowanie w sieci World Wide Web (W3SVC) - Unknown owner - E:\WINDOWS\system32\inetsrv\inetinfo.exe (file missing) O23 - Service: Simple Mail Transport Protocol (SMTP) (SMTPSVC) - Unknown owner - E:\WINDOWS\system32\inetsrv\inetinfo.exe (file missing) O23 - Service: Administrator programu IIS (IISADMIN) - Unknown owner - E:\WINDOWS\system32\inetsrv\inetinfo.exe (file missing)

**Posty:** 18165 · przez **wojtas** 28 Lis 2007, 20:03

O2 - BHO: (no name) - {FA55900E-70D4-4EF7-85DE-6AB30BA2A11A} - E:\WINDOWS\system32\avifil.dll

skasuj wpis]

sciagnij killbox’a

Odpalasz Killboxa zaznacz opcję Delete on Reboot następnie w polu Full Path of File to Delete wklej ścieżkę

E:\WINDOWS\system32\avifil.dll

i nacisnij x
Program będzie pytał o restart (oczywiście zgadzasz się)

**Posty:** 48 · przez **dawido_0** 29 Lis 2007, 00:24

Zrobiłem jak powiedziałeś i nic się nie dzieje(nie usunęło wirusa, komp się nie uruchomił ponownie)

!! W prawie każdym programie były pliki tego Worm.Blitzdung'a, usunąłem je, ale nic się nie zmieniło, chyba będę musiał zrobić formata

**Posty:** 3854 · przez **Dzi@dek** 29 Lis 2007, 10:20

Daj log-a z Combofix. http://www.programosy.pl/program,combofix.html
(tylko przed uzyciem combo zmien date w komputerze np. na 15.11.2007 zeby byla wczesniejsza niz dzisiejsza data)[/quote]

**Posty:** 48 · przez **dawido_0** 29 Lis 2007, 17:42

Proszę - log z Combofix'a:

Kod: Zaznacz wszystko: ComboFix 07-11-19.4C - Dawid 2007-11-15 16:35:08.4 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.710 [GMT 1:00] Running from: E:\Documents and Settings\Dawid\Pulpit\ComboFix.exe . ((((((((((((((((((((((((( Files Created from 2007-10-19 to 2007-11-19 ))))))))))))))))))))))))))))))) . 2007-11-28 10:11 <DIR> d-------- E:\Program Files\Google 2007-11-27 20:34 <DIR> d-------- E:\Deckard 2007-11-27 18:49 229,376 -ra------ E:\WINDOWS\system32\drivers\ADIHdAud.sys 2007-11-27 18:33 <DIR> d-------- E:\Program Files\Kaspersky Lab 2007-11-27 18:33 <DIR> d-------- E:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab 2007-11-27 18:30 <DIR> d-------- E:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab Setup Files 2007-11-27 17:56 <DIR> d-------- E:\Program Files\Trend Micro 2007-11-27 10:24 249,856 --------- E:\WINDOWS\Setup1.exe 2007-11-27 10:24 73,216 --a------ E:\WINDOWS\ST6UNST.EXE 2007-11-27 09:38 <DIR> d-------- E:\Program Files\Common Files\AVSMedia 2007-11-27 09:38 1,700,352 --a------ E:\WINDOWS\system32\GdiPlus.dll 2007-11-27 09:38 524,288 --a------ E:\WINDOWS\system32\xvidcore.dll 2007-11-27 09:38 139,264 --a------ E:\WINDOWS\system32\xvidvfw.dll 2007-11-27 09:38 82,944 --a------ E:\WINDOWS\system32\vct3216.acm 2007-11-26 21:52 <DIR> d-------- E:\Program Files\ffdshow 2007-11-26 21:52 7,680 --a------ E:\WINDOWS\system32\ff_vfw.dll 2007-11-26 21:52 6,144 --a------ E:\WINDOWS\system32\ff_acm.acm 2007-11-26 21:52 547 --a------ E:\WINDOWS\system32\ff_vfw.dll.manifest 2007-11-26 21:40 <DIR> d-------- E:\Program Files\SLD CODEC PACK 1.5.3 2007-11-26 20:57 <DIR> d-------- E:\Program Files\Common Files\Acronis 2007-11-26 20:57 <DIR> d-------- E:\Program Files\Acronis 2007-11-26 20:57 114,048 --a------ E:\WINDOWS\system32\drivers\snapman.sys 2007-11-26 20:24 <DIR> d-------- E:\Program Files\Analog Devices 2007-11-26 20:24 1,285,632 --------- E:\WINDOWS\system32\SMMedia.dll 2007-11-26 20:24 145,792 --a------ E:\WINDOWS\system32\drivers\portcls.sys 2007-11-26 20:24 142,464 --a------ E:\WINDOWS\system32\drivers\aec.sys 2007-11-26 20:24 130,048 --a------ E:\WINDOWS\system32\ksproxy.ax 2007-11-26 20:24 82,944 --a--c--- E:\WINDOWS\system32\dllcache\wdmaud.sys 2007-11-26 20:24 53,248 --------- E:\WINDOWS\system32\wdmioctl.dll 2007-11-26 20:24 6,400 --a------ E:\WINDOWS\system32\drivers\splitter.sys 2007-11-26 20:24 4,096 --a------ E:\WINDOWS\system32\ksuser.dll 2007-11-26 20:19 5,810 -ra------ E:\WINDOWS\system32\drivers\ASACPI.sys 2007-11-26 20:18 5,824 --a------ E:\WINDOWS\system32\drivers\ASUSHWIO.SYS 2007-11-26 18:35 <DIR> d-------- E:\Nowy folder 2007-11-26 18:34 26,496 --a--c--- E:\WINDOWS\system32\dllcache\usbstor.sys 2007-11-26 14:50 <DIR> d-------- E:\Documents and Settings\Dawid\Dane aplikacji\Gadu-Gadu 2007-11-26 14:46 <DIR> d-------- E:\Program Files\Gadu-Gadu 2007-11-26 14:46 <DIR> d-------- E:\Documents and Settings\Dawid\Gadu-Gadu 2007-11-26 13:17 6,738,432 --a------ E:\WINDOWS\system32\drivers\nv4_mini.sys 2007-11-26 13:17 5,421,312 --a------ E:\WINDOWS\system32\nv4_disp.dll 2007-11-26 13:17 352,256 --a------ E:\WINDOWS\system32\nvapi.dll 2007-11-26 12:06 <DIR> d-------- E:\Program Files\SystemRequirementsLab 2007-11-26 11:41 <DIR> d----c--- E:\WINDOWS\system32\DRVSTORE 2007-11-26 10:23 1,415,680 --a------ E:\WINDOWS\system32\wmv9vcm.dll 2007-11-26 10:23 423,424 --a------ E:\WINDOWS\system32\WMAVDS32.ax 2007-11-26 10:23 309,616 --a------ E:\WINDOWS\system32\wmv8dmod.dll 2007-11-26 00:14 580 --a------ E:\WINDOWS\system32\MAPISVC.BAK 2007-11-26 00:13 <DIR> d-------- E:\Program Files\Ontrack 2007-11-25 23:39 <DIR> d-a------ E:\Documents and Settings\All Users\Dane aplikacji\TEMP 2007-11-25 23:12 <DIR> d-------- E:\Documents and Settings\Dawid\Dane aplikacji\PC Tools 2007-11-25 22:13 <DIR> d--h----- E:\Documents and Settings\Administrator.KOMPUTER\Ustawienia lokalne 2007-11-25 22:13 <DIR> d-------- E:\Documents and Settings\Administrator.KOMPUTER\Ulubione 2007-11-25 22:13 <DIR> d--h----- E:\Documents and Settings\Administrator.KOMPUTER\Szablony 2007-11-25 22:13 <DIR> d-------- E:\Documents and Settings\Administrator.KOMPUTER\Pulpit 2007-11-25 22:13 <DIR> d-------- E:\Documents and Settings\Administrator.KOMPUTER\Moje dokumenty 2007-11-25 22:13 <DIR> dr------- E:\Documents and Settings\Administrator.KOMPUTER\Menu Start 2007-11-25 22:13 <DIR> dr-h----- E:\Documents and Settings\Administrator.KOMPUTER\Dane aplikacji 2007-11-25 22:06 221,184 --a------ E:\WINDOWS\system32\wmpns.dll 2007-11-25 21:26 19,200 E:\WINDOWS\system32\drivers\dambamsm.dat 2007-11-25 21:23 115,999 --a------ E:\WINDOWS\system32\nvapps.xml 2007-11-25 21:22 <DIR> d-------- E:\WINDOWS\nview 2007-11-25 19:45 29 --a------ E:\WINDOWS\system32\yredhpou.tmp 2007-11-25 19:43 <DIR> d--h----- E:\WINDOWS\$hf_mig$ 2007-11-25 19:43 22,752 --a------ E:\WINDOWS\system32\spupdsvc.exe 2007-11-25 17:13 <DIR> d---s---- E:\Documents and Settings\Dawid\UserData . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2007-11-29 05:32 55,688 --sha-w E:\WINDOWS\system32\drivers\fidbox.idx 2007-11-29 05:32 4,364 --sha-w E:\WINDOWS\system32\drivers\fidbox2.idx 2007-11-27 17:45 82,061 ----a-w E:\WINDOWS\system32\drivers\klick.dat 2007-11-27 17:45 81,549 ----a-w E:\WINDOWS\system32\drivers\klin.dat 2007-11-26 19:23 --------- d--h--w E:\Program Files\InstallShield Installation Information 2007-11-25 23:13 --------- d-----w E:\Program Files\Common Files\InstallShield 2007-11-25 20:40 --------- d-----w E:\Program Files\neostrada tp 2007-11-25 20:36 --------- d-----w E:\Program Files\microsoft frontpage 2007-11-25 15:52 33 ----a-w E:\WINDOWS\system32\drivers\adidsl.cfg 2007-11-25 15:51 --------- d-----w E:\Program Files\SAGEM 2007-11-19 15:36 3,965,728 --sha-w E:\WINDOWS\system32\drivers\fidbox.dat 2007-11-19 15:36 16,672 --sha-w E:\WINDOWS\system32\drivers\fidbox2.dat . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{FA55900E-70D4-4EF7-85DE-6AB30BA2A11A}] 2001-10-26 15:50 83456 --a------ E:\WINDOWS\system32\avifil.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NvCplDaemon"="RUNDLL32.exe" [2004-08-03 23:44 E:\WINDOWS\system32\rundll32.exe] "NvMediaCenter"="RUNDLL32.exe" [2004-08-03 23:44 E:\WINDOWS\system32\rundll32.exe] "SoundMAX"="E:\Program Files\Analog Devices\SoundMAX\Smax4.exe" [2006-04-10 09:19] "OSSelectorReinstall"="E:\Program Files\Common Files\Acronis\Acronis Disk Director\oss_reinstall.exe" [2007-02-26 14:03] "AVP"="E:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe" [2007-06-28 12:51] E:\WINDOWS\system32\klogon.dll 2007-06-28 12:51 206088 E:\WINDOWS\system32\klogon.dll [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS] E:\Program Files\Messenger\msmsgs.exe /background R0 rjhnokkt;rjhnokkt;E:\WINDOWS\system32\drivers\dambamsm.dat R0 snapman;Acronis Snapshots Manager;E:\WINDOWS\system32\DRIVERS\snapman.sys R3 e4usbaw;USB ADSL2 WAN Adapter;E:\WINDOWS\system32\DRIVERS\e4usbaw.sys R3 klim5;Kaspersky Anti-Virus NDIS Filter;E:\WINDOWS\system32\DRIVERS\klim5.sys S2 IKANLOADER2;General Purpose USB Driver (e4ldr.sys);E:\WINDOWS\system32\Drivers\e4ldr.sys S2 SMTPSVC;Simple Mail Transport Protocol (SMTP);E:\WINDOWS\system32\inetsrv\inetinfo.exe S3 EverestDriver;Lavalys EVEREST Kernel Driver;\??\E:\Program Files\Lavalys\EVEREST Home Edition\kerneld.wnt S3 p2pgasvc;Uwierzytelnianie grup sieci równorzędnej;E:\WINDOWS\system32\svchost.exe -k p2psvc S3 p2pimsvc;Menedżer tożsamości sieci równorzędnej;E:\WINDOWS\system32\svchost.exe -k p2psvc S3 p2psvc;Sieć równorzędna;E:\WINDOWS\system32\svchost.exe -k p2psvc S3 PNRPSvc;Protokół PNRP (Peer Name Resolution Protocol);E:\WINDOWS\system32\svchost.exe -k p2psvc [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] p2psvc p2psvc p2pimsvc p2pgasvc PNRPSvc . ************************************************************************** catchme 0.3.1262 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-11-19 16:36:42 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2007-11-19 16:37:22 . --- E O F ---

**Posty:** 18165 · przez **wojtas** 29 Lis 2007, 18:07

O2 - BHO: (no name) - {FA55900E-70D4-4EF7-85DE-6AB30BA2A11A} - E:\WINDOWS\system32\avifil.dll

skasuj ten wpis w hijacku

Otworz notatnik i wklej w nim to:

File::
E:\WINDOWS\system32\yredhpou.tmp
E:\WINDOWS\system32\drivers\dambamsm.dat

Driver::
rjhnokkt

Plik >>> zapisz jako CFScript.txt .Plik przeciągnij i upuść na ikonę ComboFixa (tak jak tu ) . Potwierdz >>> zresetuje sie komputer

(jeśli pojawi się pytanie "1 or 2" - to wpisz 1 i naciśnij ENTER). Rozpocznie się proces usuwania
Potem nowy log z hijacka oraz combofixa

**Posty:** 48 · przez **dawido_0** 29 Lis 2007, 18:32

log Hijack:

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 17:27:35, on 2007-11-19 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: E:\WINDOWS\System32\smss.exe E:\WINDOWS\system32\winlogon.exe E:\WINDOWS\system32\services.exe E:\WINDOWS\system32\lsass.exe E:\WINDOWS\system32\svchost.exe E:\WINDOWS\System32\svchost.exe E:\WINDOWS\Explorer.EXE E:\WINDOWS\system32\spoolsv.exe E:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe E:\WINDOWS\system32\nvsvc32.exe E:\WINDOWS\system32\tcpsvcs.exe E:\WINDOWS\System32\snmp.exe E:\WINDOWS\system32\wscntfy.exe E:\WINDOWS\system32\RUNDLL32.EXE E:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe E:\WINDOWS\system32\wuauclt.exe E:\Program Files\Internet Explorer\IEXPLORE.EXE E:\Documents and Settings\Dawid\Pulpit\HiJackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.neostrada.pl/ R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE E:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE E:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [SoundMAX] "E:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray O4 - HKLM\..\Run: [OSSelectorReinstall] E:\Program Files\Common Files\Acronis\Acronis Disk Director\oss_reinstall.exe O4 - HKLM\..\Run: [AVP] "E:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe" O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] E:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA') O9 - Extra button: Statystyki dla ochrony WWW - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - E:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\SCIEPlgn.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - E:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - E:\Program Files\Messenger\msmsgs.exe O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - http://www.systemrequirementslab.com/sysreqlab2.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{307998BC-1481-4CF9-8322-F1A1DF210F24}: NameServer = 194.204.159.1 217.98.63.164 O23 - Service: Kaspersky Anti-Virus 7.0 (AVP) - Kaspersky Lab - E:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe O23 - Service: Administrator programu IIS (IISADMIN) - Unknown owner - E:\WINDOWS\system32\inetsrv\inetinfo.exe (file missing) O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - E:\WINDOWS\system32\nvsvc32.exe O23 - Service: Simple Mail Transport Protocol (SMTP) (SMTPSVC) - Unknown owner - E:\WINDOWS\system32\inetsrv\inetinfo.exe (file missing) O23 - Service: Publikowanie w sieci World Wide Web (W3SVC) - Unknown owner - E:\WINDOWS\system32\inetsrv\inetinfo.exe (file missing) -- End of file - 2979 bytes

Log Combofix:

Kod: Zaznacz wszystko: ComboFix 07-11-19.4C - Dawid 2007-11-19 17:30:29.6 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.725 [GMT 1:00] Running from: E:\Documents and Settings\Dawid\Pulpit\ComboFix.exe . ((((((((((((((((((((((((( Files Created from 2007-10-19 to 2007-11-19 ))))))))))))))))))))))))))))))) . 2007-11-27 20:34 <DIR> d-------- E:\Deckard 2007-11-27 18:49 229,376 -ra------ E:\WINDOWS\system32\drivers\ADIHdAud.sys 2007-11-27 18:33 <DIR> d-------- E:\Program Files\Kaspersky Lab 2007-11-27 18:33 <DIR> d-------- E:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab 2007-11-27 18:30 <DIR> d-------- E:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab Setup Files 2007-11-27 17:56 <DIR> d-------- E:\Program Files\Trend Micro 2007-11-27 10:24 249,856 --------- E:\WINDOWS\Setup1.exe 2007-11-27 10:24 73,216 --a------ E:\WINDOWS\ST6UNST.EXE 2007-11-27 09:38 <DIR> d-------- E:\Program Files\Common Files\AVSMedia 2007-11-27 09:38 1,700,352 --a------ E:\WINDOWS\system32\GdiPlus.dll 2007-11-27 09:38 524,288 --a------ E:\WINDOWS\system32\xvidcore.dll 2007-11-27 09:38 139,264 --a------ E:\WINDOWS\system32\xvidvfw.dll 2007-11-27 09:38 82,944 --a------ E:\WINDOWS\system32\vct3216.acm 2007-11-26 21:52 <DIR> d-------- E:\Program Files\ffdshow 2007-11-26 21:52 7,680 --a------ E:\WINDOWS\system32\ff_vfw.dll 2007-11-26 21:52 6,144 --a------ E:\WINDOWS\system32\ff_acm.acm 2007-11-26 21:52 547 --a------ E:\WINDOWS\system32\ff_vfw.dll.manifest 2007-11-26 21:40 <DIR> d-------- E:\Program Files\SLD CODEC PACK 1.5.3 2007-11-26 20:57 <DIR> d-------- E:\Program Files\Common Files\Acronis 2007-11-26 20:57 <DIR> d-------- E:\Program Files\Acronis 2007-11-26 20:24 <DIR> d-------- E:\Program Files\Analog Devices 2007-11-26 20:24 1,285,632 --------- E:\WINDOWS\system32\SMMedia.dll 2007-11-26 20:24 142,464 --a------ E:\WINDOWS\system32\drivers\aec.sys 2007-11-26 20:24 130,048 --a------ E:\WINDOWS\system32\ksproxy.ax 2007-11-26 20:24 82,944 --a--c--- E:\WINDOWS\system32\dllcache\wdmaud.sys 2007-11-26 20:24 53,248 --------- E:\WINDOWS\system32\wdmioctl.dll 2007-11-26 20:24 49,152 --a------ E:\WINDOWS\system32\DSndUp.exe 2007-11-26 20:24 4,096 --a------ E:\WINDOWS\system32\ksuser.dll 2007-11-26 20:19 5,810 -ra------ E:\WINDOWS\system32\drivers\ASACPI.sys 2007-11-26 20:18 5,824 --a------ E:\WINDOWS\system32\drivers\ASUSHWIO.SYS 2007-11-26 18:35 <DIR> d-------- E:\Nowy folder 2007-11-26 18:34 26,496 --a--c--- E:\WINDOWS\system32\dllcache\usbstor.sys 2007-11-26 14:50 <DIR> d-------- E:\Documents and Settings\Dawid\Dane aplikacji\Gadu-Gadu 2007-11-26 14:46 <DIR> d-------- E:\Program Files\Gadu-Gadu 2007-11-26 14:46 <DIR> d-------- E:\Documents and Settings\Dawid\Gadu-Gadu 2007-11-26 13:17 6,738,432 --a------ E:\WINDOWS\system32\drivers\nv4_mini.sys 2007-11-26 13:17 5,421,312 --a------ E:\WINDOWS\system32\nv4_disp.dll 2007-11-26 13:17 352,256 --a------ E:\WINDOWS\system32\nvapi.dll 2007-11-26 12:06 <DIR> d-------- E:\Program Files\SystemRequirementsLab 2007-11-26 11:41 <DIR> d----c--- E:\WINDOWS\system32\DRVSTORE 2007-11-26 10:23 1,415,680 --a------ E:\WINDOWS\system32\wmv9vcm.dll 2007-11-26 10:23 423,424 --a------ E:\WINDOWS\system32\WMAVDS32.ax 2007-11-26 10:23 309,616 --a------ E:\WINDOWS\system32\wmv8dmod.dll 2007-11-26 00:14 580 --a------ E:\WINDOWS\system32\MAPISVC.BAK 2007-11-26 00:13 <DIR> d-------- E:\Program Files\Ontrack 2007-11-25 23:39 <DIR> d-a------ E:\Documents and Settings\All Users\Dane aplikacji\TEMP 2007-11-25 23:12 <DIR> d-------- E:\Documents and Settings\Dawid\Dane aplikacji\PC Tools 2007-11-25 22:13 <DIR> d--h----- E:\Documents and Settings\Administrator.KOMPUTER\Ustawienia lokalne 2007-11-25 22:13 <DIR> d-------- E:\Documents and Settings\Administrator.KOMPUTER\Ulubione 2007-11-25 22:13 <DIR> d--h----- E:\Documents and Settings\Administrator.KOMPUTER\Szablony 2007-11-25 22:13 <DIR> d-------- E:\Documents and Settings\Administrator.KOMPUTER\Pulpit 2007-11-25 22:13 <DIR> d-------- E:\Documents and Settings\Administrator.KOMPUTER\Moje dokumenty 2007-11-25 22:13 <DIR> dr------- E:\Documents and Settings\Administrator.KOMPUTER\Menu Start 2007-11-25 22:13 <DIR> dr-h----- E:\Documents and Settings\Administrator.KOMPUTER\Dane aplikacji 2007-11-25 22:06 221,184 --a------ E:\WINDOWS\system32\wmpns.dll 2007-11-25 21:23 115,999 --a------ E:\WINDOWS\system32\nvapps.xml 2007-11-25 21:22 <DIR> d-------- E:\WINDOWS\nview 2007-11-25 21:09 6,656 --a------ E:\WINDOWS\system32\create.exe 2007-11-25 19:43 <DIR> d--h----- E:\WINDOWS\$hf_mig$ 2007-11-25 19:43 22,752 --a------ E:\WINDOWS\system32\spupdsvc.exe 2007-11-25 17:13 <DIR> d---s---- E:\Documents and Settings\Dawid\UserData . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2007-11-27 17:45 82,061 ----a-w E:\WINDOWS\system32\drivers\klick.dat 2007-11-27 17:45 81,549 ----a-w E:\WINDOWS\system32\drivers\klin.dat 2007-11-26 19:57 114,048 ----a-w E:\WINDOWS\system32\drivers\snapman.sys 2007-11-26 19:23 --------- d--h--w E:\Program Files\InstallShield Installation Information 2007-11-25 23:13 --------- d-----w E:\Program Files\Common Files\InstallShield 2007-11-25 20:40 --------- d-----w E:\Program Files\neostrada tp 2007-11-25 20:36 --------- d-----w E:\Program Files\microsoft frontpage 2007-11-25 17:05 20,480 ----a-w E:\WINDOWS\system32\mmsslhulh.dll 2007-11-25 15:52 33 ----a-w E:\WINDOWS\system32\drivers\adidsl.cfg 2007-11-25 15:51 --------- d-----w E:\Program Files\SAGEM 2007-11-19 16:31 4,087,584 --sha-w E:\WINDOWS\system32\drivers\fidbox.dat 2007-11-19 16:31 20,512 --sha-w E:\WINDOWS\system32\drivers\fidbox2.dat 2007-11-19 16:19 58,640 --sha-w E:\WINDOWS\system32\drivers\fidbox.idx 2007-11-19 16:19 4,916 --sha-w E:\WINDOWS\system32\drivers\fidbox2.idx 2007-11-13 14:30 60,273 ----a-w E:\WINDOWS\system32\pthreadGC2.dll . ((((((((((((((((((((((((((((( snapshot@2007-11-19_16.36.53.07 ))))))))))))))))))))))))))))))))))))))))) . + 2007-11-19 16:24:25 16,384 ----atw E:\WINDOWS\Temp\Perflib_Perfdata_6c0.dat . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NvCplDaemon"="RUNDLL32.exe" [2004-08-03 23:44 E:\WINDOWS\system32\rundll32.exe] "NvMediaCenter"="RUNDLL32.exe" [2004-08-03 23:44 E:\WINDOWS\system32\rundll32.exe] "SoundMAX"="E:\Program Files\Analog Devices\SoundMAX\Smax4.exe" [2006-04-10 09:19] "OSSelectorReinstall"="E:\Program Files\Common Files\Acronis\Acronis Disk Director\oss_reinstall.exe" [2007-02-26 14:03] "AVP"="E:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe" [2007-06-28 12:51] E:\WINDOWS\system32\klogon.dll 2007-06-28 12:51 206088 E:\WINDOWS\system32\klogon.dll [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS] E:\Program Files\Messenger\msmsgs.exe /background R0 snapman;Acronis Snapshots Manager;E:\WINDOWS\system32\DRIVERS\snapman.sys R3 e4usbaw;USB ADSL2 WAN Adapter;E:\WINDOWS\system32\DRIVERS\e4usbaw.sys R3 klim5;Kaspersky Anti-Virus NDIS Filter;E:\WINDOWS\system32\DRIVERS\klim5.sys S2 IKANLOADER2;General Purpose USB Driver (e4ldr.sys);E:\WINDOWS\system32\Drivers\e4ldr.sys S2 SMTPSVC;Simple Mail Transport Protocol (SMTP);E:\WINDOWS\system32\inetsrv\inetinfo.exe S3 EverestDriver;Lavalys EVEREST Kernel Driver;\??\E:\Program Files\Lavalys\EVEREST Home Edition\kerneld.wnt S3 p2pgasvc;Uwierzytelnianie grup sieci równorzędnej;E:\WINDOWS\system32\svchost.exe -k p2psvc S3 p2pimsvc;Menedżer tożsamości sieci równorzędnej;E:\WINDOWS\system32\svchost.exe -k p2psvc S3 p2psvc;Sieć równorzędna;E:\WINDOWS\system32\svchost.exe -k p2psvc S3 PNRPSvc;Protokół PNRP (Peer Name Resolution Protocol);E:\WINDOWS\system32\svchost.exe -k p2psvc [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] p2psvc p2psvc p2pimsvc p2pgasvc PNRPSvc . ************************************************************************** catchme 0.3.1262 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-11-19 17:31:27 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2007-11-19 17:31:55 E:\ComboFix2.txt ... 2007-11-19 17:25 E:\ComboFix3.txt ... 2007-11-19 16:37 . --- E O F ---

**Posty:** 18165 · przez **wojtas** 29 Lis 2007, 18:45

Wykonaj to co jest podane w tym temacie

Otworz notatnik i wklej w nim to:

File::
E:\WINDOWS\system32\mmsslhulh.dll
E:\WINDOWS\system32\create.exe

Plik >>> zapisz jako CFScript.txt .Plik przeciągnij i upuść na ikonę ComboFixa (tak jak tu ) . Potwierdz >>> zresetuje sie komputer

(jeśli pojawi się pytanie "1 or 2" - to wpisz 1 i naciśnij ENTER). Rozpocznie się proces usuwania
Potem nowy log z hijacka oraz combofixa

Autor postu otrzymał pochwałę

**Posty:** 48 · przez **dawido_0** 29 Lis 2007, 23:21

Dzięki wojtas19162 chyba wszystko jest już wpożądku

, ale sprawdź, tu masz logi:

Kod: Zaznacz wszystko: ComboFix 07-11-19.4C - Dawid 2007-11-15 22:24:37.8 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.617 [GMT 1:00] Running from: E:\Documents and Settings\Dawid\Pulpit\ComboFix.exe . ((((((((((((((((((((((((( Files Created from 2007-10-19 to 2007-11-19 ))))))))))))))))))))))))))))))) . 2007-11-27 18:49 229,376 -ra------ E:\WINDOWS\system32\drivers\ADIHdAud.sys 2007-11-27 18:33 <DIR> d-------- E:\Program Files\Kaspersky Lab 2007-11-27 18:33 <DIR> d-------- E:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab 2007-11-27 18:30 <DIR> d-------- E:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab Setup Files 2007-11-27 10:24 249,856 --------- E:\WINDOWS\Setup1.exe 2007-11-27 10:24 73,216 --a------ E:\WINDOWS\ST6UNST.EXE 2007-11-27 09:38 524,288 --a------ E:\WINDOWS\system32\xvidcore.dll 2007-11-27 09:38 139,264 --a------ E:\WINDOWS\system32\xvidvfw.dll 2007-11-27 09:38 82,944 --a------ E:\WINDOWS\system32\vct3216.acm 2007-11-27 09:38 24,576 --a------ E:\WINDOWS\system32\msxml3a.dll 2007-11-26 21:52 <DIR> d-------- E:\Program Files\ffdshow 2007-11-26 21:52 7,680 --a------ E:\WINDOWS\system32\ff_vfw.dll 2007-11-26 21:52 6,144 --a------ E:\WINDOWS\system32\ff_acm.acm 2007-11-26 21:52 547 --a------ E:\WINDOWS\system32\ff_vfw.dll.manifest 2007-11-26 21:40 <DIR> d-------- E:\Program Files\SLD CODEC PACK 1.5.3 2007-11-26 20:57 <DIR> d-------- E:\Program Files\Common Files\Acronis 2007-11-26 20:57 <DIR> d-------- E:\Program Files\Acronis 2007-11-26 20:24 <DIR> d-------- E:\Program Files\Analog Devices 2007-11-26 20:24 1,285,632 --------- E:\WINDOWS\system32\SMMedia.dll 2007-11-26 20:24 142,464 --a------ E:\WINDOWS\system32\drivers\aec.sys 2007-11-26 20:24 82,944 --a--c--- E:\WINDOWS\system32\dllcache\wdmaud.sys 2007-11-26 20:24 53,248 --------- E:\WINDOWS\system32\wdmioctl.dll 2007-11-26 20:19 5,810 -ra------ E:\WINDOWS\system32\drivers\ASACPI.sys 2007-11-26 20:18 5,824 --a------ E:\WINDOWS\system32\drivers\ASUSHWIO.SYS 2007-11-26 18:35 <DIR> d-------- E:\Nowy folder 2007-11-26 18:34 26,496 --a--c--- E:\WINDOWS\system32\dllcache\usbstor.sys 2007-11-26 14:50 <DIR> d-------- E:\Documents and Settings\Dawid\Dane aplikacji\Gadu-Gadu 2007-11-26 14:46 <DIR> d-------- E:\Program Files\Gadu-Gadu 2007-11-26 14:46 <DIR> d-------- E:\Documents and Settings\Dawid\Gadu-Gadu 2007-11-26 13:17 6,738,432 --a------ E:\WINDOWS\system32\drivers\nv4_mini.sys 2007-11-26 13:17 5,421,312 --a------ E:\WINDOWS\system32\nv4_disp.dll 2007-11-26 13:17 352,256 --a------ E:\WINDOWS\system32\nvapi.dll 2007-11-26 12:06 <DIR> d-------- E:\Program Files\SystemRequirementsLab 2007-11-26 11:41 <DIR> d----c--- E:\WINDOWS\system32\DRVSTORE 2007-11-26 10:23 1,415,680 --a------ E:\WINDOWS\system32\wmv9vcm.dll 2007-11-26 10:23 423,424 --a------ E:\WINDOWS\system32\WMAVDS32.ax 2007-11-26 10:23 309,616 --a------ E:\WINDOWS\system32\wmv8dmod.dll 2007-11-26 00:13 <DIR> d-------- E:\Program Files\Ontrack 2007-11-25 23:39 <DIR> d-a------ E:\Documents and Settings\All Users\Dane aplikacji\TEMP 2007-11-25 23:39 626,688 --a------ E:\WINDOWS\system32\msvcr80.dll 2007-11-25 23:11 348,160 --a------ E:\WINDOWS\system32\msvcr71.dll 2007-11-25 22:13 <DIR> d--h----- E:\Documents and Settings\Administrator.KOMPUTER\Ustawienia lokalne 2007-11-25 22:13 <DIR> d-------- E:\Documents and Settings\Administrator.KOMPUTER\Ulubione 2007-11-25 22:13 <DIR> d--h----- E:\Documents and Settings\Administrator.KOMPUTER\Szablony 2007-11-25 22:13 <DIR> d-------- E:\Documents and Settings\Administrator.KOMPUTER\Pulpit 2007-11-25 22:13 <DIR> d-------- E:\Documents and Settings\Administrator.KOMPUTER\Moje dokumenty 2007-11-25 22:13 <DIR> dr------- E:\Documents and Settings\Administrator.KOMPUTER\Menu Start 2007-11-25 22:13 <DIR> dr-h----- E:\Documents and Settings\Administrator.KOMPUTER\Dane aplikacji 2007-11-25 22:06 221,184 --a------ E:\WINDOWS\system32\wmpns.dll 2007-11-25 21:23 115,999 --a------ E:\WINDOWS\system32\nvapps.xml 2007-11-25 21:22 <DIR> d-------- E:\WINDOWS\nview 2007-11-25 19:43 <DIR> d--h----- E:\WINDOWS\$hf_mig$ 2007-11-25 19:43 22,752 --a------ E:\WINDOWS\system32\spupdsvc.exe 2007-11-25 17:13 <DIR> d---s---- E:\Documents and Settings\Dawid\UserData . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2007-11-27 17:45 82,061 ----a-w E:\WINDOWS\system32\drivers\klick.dat 2007-11-27 17:45 81,549 ----a-w E:\WINDOWS\system32\drivers\klin.dat 2007-11-26 19:57 114,048 ----a-w E:\WINDOWS\system32\drivers\snapman.sys 2007-11-25 23:13 --------- d-----w E:\Program Files\Common Files\InstallShield 2007-11-25 20:36 --------- d-----w E:\Program Files\microsoft frontpage 2007-11-25 15:52 33 ----a-w E:\WINDOWS\system32\drivers\adidsl.cfg 2007-11-25 15:51 --------- d-----w E:\Program Files\SAGEM 2007-11-19 21:25 28,192 --sha-w E:\WINDOWS\system32\drivers\fidbox2.dat 2007-11-19 19:31 61,160 --sha-w E:\WINDOWS\system32\drivers\fidbox.idx 2007-11-19 19:31 5,468 --sha-w E:\WINDOWS\system32\drivers\fidbox2.idx 2007-11-15 21:24 4,614,432 --sha-w E:\WINDOWS\system32\drivers\fidbox.dat 2007-11-13 14:30 60,273 ----a-w E:\WINDOWS\system32\pthreadGC2.dll . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NvCplDaemon"="RUNDLL32.exe" [2004-08-03 23:44 E:\WINDOWS\system32\rundll32.exe] "NvMediaCenter"="RUNDLL32.exe" [2004-08-03 23:44 E:\WINDOWS\system32\rundll32.exe] "SoundMAX"="E:\Program Files\Analog Devices\SoundMAX\Smax4.exe" [2006-04-10 09:19] "OSSelectorReinstall"="E:\Program Files\Common Files\Acronis\Acronis Disk Director\oss_reinstall.exe" [2007-02-26 14:03] "AVP"="E:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe" [2007-06-28 12:51] E:\WINDOWS\system32\klogon.dll 2007-06-28 12:51 206088 E:\WINDOWS\system32\klogon.dll [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS] E:\Program Files\Messenger\msmsgs.exe /background R0 snapman;Acronis Snapshots Manager;E:\WINDOWS\system32\DRIVERS\snapman.sys R3 e4usbaw;USB ADSL2 WAN Adapter;E:\WINDOWS\system32\DRIVERS\e4usbaw.sys R3 klim5;Kaspersky Anti-Virus NDIS Filter;E:\WINDOWS\system32\DRIVERS\klim5.sys S2 IKANLOADER2;General Purpose USB Driver (e4ldr.sys);E:\WINDOWS\system32\Drivers\e4ldr.sys S2 SMTPSVC;Simple Mail Transport Protocol (SMTP);E:\WINDOWS\system32\inetsrv\inetinfo.exe S3 EverestDriver;Lavalys EVEREST Kernel Driver;\??\E:\Program Files\Lavalys\EVEREST Home Edition\kerneld.wnt S3 p2pgasvc;Uwierzytelnianie grup sieci równorzędnej;E:\WINDOWS\system32\svchost.exe -k p2psvc S3 p2pimsvc;Menedżer tożsamości sieci równorzędnej;E:\WINDOWS\system32\svchost.exe -k p2psvc S3 p2psvc;Sieć równorzędna;E:\WINDOWS\system32\svchost.exe -k p2psvc S3 PNRPSvc;Protokół PNRP (Peer Name Resolution Protocol);E:\WINDOWS\system32\svchost.exe -k p2psvc [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] p2psvc p2psvc p2pimsvc p2pgasvc PNRPSvc . ************************************************************************** catchme 0.3.1262 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-11-19 22:25:47 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2007-11-19 22:26:15 . --- E O F ---

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 22:30:28, on 2007-11-19 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: E:\WINDOWS\System32\smss.exe E:\WINDOWS\system32\winlogon.exe E:\WINDOWS\system32\services.exe E:\WINDOWS\system32\lsass.exe E:\WINDOWS\system32\svchost.exe E:\WINDOWS\System32\svchost.exe E:\WINDOWS\system32\spoolsv.exe E:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe E:\WINDOWS\system32\nvsvc32.exe E:\WINDOWS\system32\tcpsvcs.exe E:\WINDOWS\System32\snmp.exe E:\WINDOWS\system32\RUNDLL32.EXE E:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe E:\Program Files\Internet Explorer\IEXPLORE.EXE E:\WINDOWS\system32\wscntfy.exe E:\WINDOWS\explorer.exe E:\Documents and Settings\Dawid\Pulpit\HiJackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.neostrada.pl/ R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE E:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE E:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [SoundMAX] "E:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray O4 - HKLM\..\Run: [OSSelectorReinstall] E:\Program Files\Common Files\Acronis\Acronis Disk Director\oss_reinstall.exe O4 - HKLM\..\Run: [AVP] "E:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe" O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] E:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA') O9 - Extra button: Statystyki dla ochrony WWW - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - E:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\SCIEPlgn.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - E:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - E:\Program Files\Messenger\msmsgs.exe O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - http://www.systemrequirementslab.com/sysreqlab2.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{307998BC-1481-4CF9-8322-F1A1DF210F24}: NameServer = 194.204.159.1 217.98.63.164 O23 - Service: Kaspersky Anti-Virus 7.0 (AVP) - Kaspersky Lab - E:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe O23 - Service: Administrator programu IIS (IISADMIN) - Unknown owner - E:\WINDOWS\system32\inetsrv\inetinfo.exe (file missing) O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - E:\WINDOWS\system32\nvsvc32.exe O23 - Service: Simple Mail Transport Protocol (SMTP) (SMTPSVC) - Unknown owner - E:\WINDOWS\system32\inetsrv\inetinfo.exe (file missing) O23 - Service: Publikowanie w sieci World Wide Web (W3SVC) - Unknown owner - E:\WINDOWS\system32\inetsrv\inetinfo.exe (file missing) -- End of file - 2946 bytes

**Posty:** 3854 · przez **Dzi@dek** 30 Lis 2007, 14:41

O23 - Service: Simple Mail Transport Protocol (SMTP) (SMTPSVC) - Unknown owner - E:\WINDOWS\system32\inetsrv\inetinfo.exe (file missing)
O23 - Service: Publikowanie w sieci World Wide Web (W3SVC) - Unknown owner - E:\WINDOWS\system32\inetsrv\inetinfo.exe (file missing)

Te wpisy możesz usunąć - reszta OK.

Autor postu otrzymał pochwałę

**Posty:** 48 · przez **dawido_0** 30 Lis 2007, 15:59

Dzi@dek napisał(a):możesz usunąć

czym jeśli można wiedzieć bo hijackiem nie idzie tego skasować

**Posty:** 18165 · przez **wojtas** 30 Lis 2007, 18:35

zostaw te wpisy

proszę o sprawdzenie loga

Proszę o sprawdzenie loga

Kto jest na forum