komputer sprawia coraz wiecej problemów

**Posty:** 177 · przez **roonnii** 04 Lis 2007, 12:40

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:35:53, on 2007-11-04
Platform: Windows XP Dodatek SP. 1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\Program Files\Picasa2\PicasaMediaDetector.exe
C:\WINDOWS\System32\urdvxc.exe
C:\Program Files\WapSter\AQQ\AQQ.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Gadu-Gadu\gg.exe
C:\Program Files\Opera\Opera.exe
D:\hijackthis.com

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0 CE\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.1.9.24.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon
O4 - HKLM\..\Run: [Microsoft Network Services Controller] C:\WINDOWS\System32\mmsvc32.exe
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKCU\..\Run: [AQQ] C:\PROGRA~1\WapSter\AQQ\AQQ.exe
O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe
O4 - HKCU\..\Run: [Steam] "C:\Program Files\Steam\Steam.exe" -silent
O4 - HKCU\..\Run: [BitComet] "C:\Program Files\BitComet\BitComet.exe" /tray
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User '?')
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User '?')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User '?')
O4 - HKUS\S-1-5-21-1960408961-2077806209-725345543-1003\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe (User '?')
O4 - HKUS\S-1-5-21-1960408961-2077806209-725345543-1003\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized (User '?')
O4 - HKUS\S-1-5-21-1960408961-2077806209-725345543-1003\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe (User '?')
O4 - HKUS\S-1-5-21-1960408961-2077806209-725345543-1003\..\Run: [Steam] "C:\Program Files\Steam\Steam.exe" -silent (User '?')
O4 - HKUS\S-1-5-21-1960408961-2077806209-725345543-1003\..\Run: [BitComet] "C:\Program Files\BitComet\BitComet.exe" /tray (User '?')
O4 - HKUS\S-1-5-21-1960408961-2077806209-725345543-1003\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe (User '?')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User '?')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm
O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: BitComet Search - {461CC20B-FB6E-4f16-8FE8-C29359DB100E} - C:\Program Files\BitComet\tools\BitCometBHO_1.1.9.24.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O17 - HKLM\System\CCS\Services\Tcpip\..\{747C55DD-28BA-4D36-8254-AD822E1AC89E}: NameServer = 217.8.168.244 157.25.5.18
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: Network helper Service (MSDisk) - Unknown owner - C:\WINDOWS\System32\irdvxc.exe (file missing)
O23 - Service: Network Windows Service (MSWindows) - Unknown owner - C:\WINDOWS\System32\urdvxc.exe

--
End of file - 7178 bytes

a takie coś mi sie z sillent runers

"Silent Runners.vbs", revision 52, http://www.silentrunners.org/
Operating System: Windows XP
Output limited to non-default values, except where indicated by "{++}"

FATAL ERROR!
------------

"Silent Runners" cannot use WMI to identify the operating system.
This is caused by corruption of the WMI installation.

WMI is complex and it is recommended that you use a Microsoft
tool, "WMIDiag.vbs," to diagnose WMI on your system.

It can be downloaded here:

http://go.microsoft.com/fwlink/?LinkId=62562

komputer sie zawiesza w gg zmienił sie język na jakiś dziwny jest słaba predkość ściągania

[ Dodano: Dzisiaj o 11:44 ]
moim zdaniem jest to wina słabego wirusa jaki bedzie najlepszy w moim przypadku

**Posty:** 3854 · przez **Dzi@dek** 04 Lis 2007, 14:40

Start do awaryjnego po wyłączeniu przywracania systemu

Zatrzymać i skasować usługę:

Start-uruchom-cmd [enter]
wpisz:
sc stop MSWindows [enter]
sc delete MSWindows [enter]

Odpalić HJ i usunąć wpisy:

O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [Microsoft Network Services Controller] C:\WINDOWS\System32\mmsvc32.exe
O23 - Service: Network helper Service (MSDisk) - Unknown owner - C:\WINDOWS\System32\irdvxc.exe (file missing)
O23 - Service: Network Windows Service (MSWindows) - Unknown owner - C:\WINDOWS\System32\urdvxc.exe

Pliki pogrubione usuwasz ręcznie z dysku po wszystkim.
Zastosuj Combofix

Pokaż nowy log z HJ + Combofix

**Posty:** 177 · przez **roonnii** 04 Lis 2007, 17:37

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 16:36:41, on 2007-11-04
Platform: Windows XP Dodatek SP. 1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\Program Files\Picasa2\PicasaMediaDetector.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Opera\Opera.exe
D:\hijackthis.com

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0 CE\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.1.9.24.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Microsoft Network Services Controller] C:\WINDOWS\System32\mmsvc32.exe
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKCU\..\Run: [AQQ] C:\PROGRA~1\WapSter\AQQ\AQQ.exe
O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe
O4 - HKCU\..\Run: [Steam] "C:\Program Files\Steam\Steam.exe" -silent
O4 - HKCU\..\Run: [BitComet] "C:\Program Files\BitComet\BitComet.exe" /tray
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'USŁUGA LOKALNA')
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'USŁUGA LOKALNA')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'USŁUGA SIECIOWA')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm
O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: BitComet Search - {461CC20B-FB6E-4f16-8FE8-C29359DB100E} - C:\Program Files\BitComet\tools\BitCometBHO_1.1.9.24.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O17 - HKLM\System\CCS\Services\Tcpip\..\{747C55DD-28BA-4D36-8254-AD822E1AC89E}: NameServer = 217.8.168.244 157.25.5.18
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: NetMeeting Remote Desktop Sharing (mnmsrvc) - Unknown owner - C:\WINDOWS\System32\mnmsrvc.exe (file missing)
O23 - Service: Network helper Service (MSDisk) - Unknown owner - C:\WINDOWS\System32\irdvxc.exe (file missing)

--
End of file - 6368 bytes

ComboFix 07-11-01.1 - dziubus 2007-11-04 16:27:38.1 - NTFSx86 MINIMAL
Running from: D:\ComboFix.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Program Files\myglobalsearch
C:\WINDOWS\system32\.exe

.
((((((((((((((((((((((((( Files Created from 2007-10-04 to 2007-11-04 )))))))))))))))))))))))))))))))
.

2007-11-04 16:26 51,200 --a------ C:\WINDOWS\NirCmd.exe
2007-11-04 13:54 3,149 --a------ C:\WINDOWS\system32\sdbackup.reg
2007-11-04 13:32 <DIR> d-------- C:\Program Files\EA GAMES
2007-11-04 13:27 2,297,552 --a------ C:\WINDOWS\system32\d3dx9_26.dll
2007-11-04 13:21 <DIR> d-------- C:\Program Files\Common Files\EasyInfo
2007-11-03 15:03 <DIR> d-------- C:\Program Files\Lavalys
2007-11-03 14:29 229,376 --a------ C:\WINDOWS\system32\Tilecomgm.com
2007-11-02 14:57 <DIR> d-------- C:\Program Files\Wesola_Szkola_1
2007-11-02 08:32 <DIR> d-------- C:\Program Files\QuickTime
2007-11-02 08:32 <DIR> d-------- C:\Program Files\Apple Software Update
2007-11-02 08:32 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Apple Computer
2007-11-02 08:32 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Apple
2007-11-01 20:09 <DIR> d-------- C:\Program Files\MarBit
2007-11-01 20:06 <DIR> d-------- C:\Program Files\SubEdit-Player
2007-10-29 15:54 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Spybot - Search & Destroy
2007-10-29 15:21 <DIR> d-------- C:\Program Files\Includes
2007-10-28 19:55 <DIR> d-------- C:\Program Files\Monte Cristo
2007-10-22 13:38 <DIR> d-------- C:\Downloads
2007-10-22 13:38 2,560 --a------ C:\WINDOWS\system32\bitcometres.dll
2007-10-22 13:37 <DIR> d-------- C:\Program Files\BitComet
2007-10-22 06:38 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\ATI
2007-10-22 06:37 0 --a------ C:\WINDOWS\ativpsrm.bin
2007-10-21 23:02 <DIR> d-------- C:\Program Files\Steam
2007-10-21 22:56 593,920 --------- C:\WINDOWS\system32\ati2sgag.exe
2007-10-21 22:56 86,912 --a------ C:\WINDOWS\system32\drivers\atapi.sys
2007-10-21 22:56 86,912 --a--c--- C:\WINDOWS\system32\dllcache\atapi.sys
2007-10-21 22:56 23,680 --a------ C:\WINDOWS\system32\drivers\pciidex.sys
2007-10-21 22:56 23,680 --a--c--- C:\WINDOWS\system32\dllcache\pciidex.sys
2007-10-21 22:56 3,456 --a------ C:\WINDOWS\system32\drivers\pciide.sys
2007-10-21 22:56 3,456 --a--c--- C:\WINDOWS\system32\dllcache\pciide.sys
2007-10-21 22:55 <DIR> d-------- C:\ATI
2007-10-21 22:43 <DIR> d-------- C:\WINDOWS\Sun
2007-10-21 22:42 <DIR> d-------- C:\Program Files\SystemRequirementsLab
2007-10-21 22:42 <DIR> d-------- C:\Documents and Settings\dziubus\SystemRequirementsLab
2007-10-21 19:09 2,414,360 --a------ C:\WINDOWS\system32\d3dx9_31.dll
2007-10-21 19:09 68,888 --a------ C:\WINDOWS\system32\xinput1_3.dll
2007-10-21 19:06 <DIR> d-------- C:\WINDOWS\system32\AGEIA
2007-10-21 19:06 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2007-10-21 19:06 <DIR> d-------- C:\Program Files\AGEIA Technologies
2007-10-20 14:55 182,880 --a------ C:\WINDOWS\system32\iuengine.dll
2007-10-20 14:55 182,880 --a--c--- C:\WINDOWS\system32\dllcache\iuengine.dll
2007-10-20 14:54 <DIR> d-------- C:\Program Files\Lexmark 640 Series
2007-10-20 14:54 311,296 --a------ C:\WINDOWS\system32\LEXBCES.EXE
2007-10-20 14:54 298,496 --a------ C:\WINDOWS\unin0415.exe
2007-10-20 14:54 201,216 --a------ C:\WINDOWS\system32\LEXP2P32.DLL
2007-10-20 14:54 200,704 --a------ C:\WINDOWS\system32\lexlmpm.dll
2007-10-20 14:54 198,144 --a------ C:\WINDOWS\system32\LEX2KUSB.DLL
2007-10-20 14:54 174,592 --a------ C:\WINDOWS\system32\LEXPPS.EXE
2007-10-20 14:54 147,456 --a------ C:\WINDOWS\system32\LEXBCE.DLL
2007-10-20 14:54 73,728 --a------ C:\WINDOWS\system32\lxdapwr.dll
2007-10-20 14:53 <DIR> d-------- C:\Documents and Settings\dziubus\WINDOWS
2007-10-20 14:53 24,960 --a------ C:\WINDOWS\system32\drivers\usbprint.sys
2007-10-20 14:53 24,960 --a--c--- C:\WINDOWS\system32\dllcache\usbprint.sys
2007-10-20 13:12 101,995 --ahs---- C:\WINDOWS\system32\urdvxc.exe
2007-10-19 07:01 <DIR> d-------- C:\Program Files\Deutsch Translator 2
2007-10-18 17:03 <DIR> d-------- C:\WINDOWS\ERUNT
2007-10-18 16:57 <DIR> d-------- C:\Program Files\Java
2007-10-18 16:55 <DIR> d-------- C:\Program Files\Common Files\Java
2007-10-18 16:35 <DIR> d-------- C:\Documents and Settings\dziubus\Dane aplikacji\Grisoft
2007-10-18 16:34 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
2007-10-18 14:41 <DIR> d-------- C:\VundoFix Backups
2007-10-18 14:40 2,000 --a------ C:\WINDOWS\system32\tmp.reg
2007-10-18 14:39 289,144 --a------ C:\WINDOWS\system32\VCCLSID.exe
2007-10-18 14:39 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe
2007-10-18 14:39 53,248 --a------ C:\WINDOWS\system32\Process.exe
2007-10-18 14:39 51,200 --a------ C:\WINDOWS\system32\dumphive.exe
2007-10-18 14:39 25,600 --a------ C:\WINDOWS\system32\WS2Fix.exe
2007-10-17 23:31 20,002 --a------ C:\Documents and Settings\dziubus\lycoc.exe
2007-10-15 19:11 20,050 --a------ C:\Documents and Settings\dziubus\djd00000hg.exe
2007-10-14 11:26 <DIR> d----c--- C:\WINDOWS\system32\DRVSTORE
2007-10-14 11:25 97,056 -ra------ C:\WINDOWS\system32\drivers\w200mdm.sys
2007-10-14 11:25 28,160 --a------ C:\WINDOWS\system32\drivers\usbccgp.sys
2007-10-14 11:25 28,160 --a--c--- C:\WINDOWS\system32\dllcache\usbccgp.sys
2007-10-14 11:25 9,328 -ra------ C:\WINDOWS\system32\drivers\w200mdfl.sys
2007-10-14 11:25 6,208 -ra------ C:\WINDOWS\system32\drivers\w200cmnt.sys
2007-10-14 11:25 6,208 -ra------ C:\WINDOWS\system32\drivers\w200cm.sys
2007-10-14 11:24 <DIR> d-------- C:\WINDOWS\Downloaded Installations
2007-10-14 11:22 61,504 -ra------ C:\WINDOWS\system32\drivers\w200bus.sys
2007-10-14 11:22 5,840 -ra------ C:\WINDOWS\system32\drivers\w200whnt.sys
2007-10-14 11:22 5,840 -ra------ C:\WINDOWS\system32\drivers\w200wh.sys
2007-10-09 21:29 8,192 --a------ C:\WINDOWS\system32\psvc.exe
2007-10-08 12:20 <DIR> d-------- C:\Program Files\Picasa2
2007-10-08 12:20 <DIR> d-------- C:\Program Files\Google
2007-10-08 11:30 <DIR> d-------- C:\Program Files\mp3DirectCut
2007-10-07 18:06 <DIR> d-------- C:\Documents and Settings\dziubus\Dane aplikacji\Media Player Classic
2007-10-07 18:05 <DIR> d-------- C:\Program Files\BearShare
2007-10-07 18:05 <DIR> d-------- C:\My Downloads
2007-10-07 18:01 <DIR> d-------- C:\Program Files\BearShare Applications
2007-10-07 17:31 512 --ah----- C:\WINDOWS\system32\qrje.exe
2007-10-07 17:17 <DIR> d-------- C:\Program Files\Thomson
2007-10-07 17:17 5,606 --a------ C:\WINDOWS\system32\stci.dll
2007-10-07 16:32 <DIR> d-------- C:\Program Files\Opera
2007-10-07 16:31 125,184 --------- C:\WINDOWS\system32\drivers\imagesrv.sys
2007-10-07 16:31 5,504 --------- C:\WINDOWS\system32\drivers\imagedrv.sys
2007-10-07 16:30 <DIR> d-------- C:\Program Files\Common Files\Ahead
2007-10-07 16:30 <DIR> d-------- C:\Program Files\Ahead
2007-10-07 16:30 1,568,768 --------- C:\WINDOWS\system32\ImagX7.dll
2007-10-07 16:30 476,320 --------- C:\WINDOWS\system32\ImagXpr7.dll
2007-10-07 16:30 471,040 --------- C:\WINDOWS\system32\ImagXRA7.dll
2007-10-07 16:30 262,144 --------- C:\WINDOWS\system32\ImagXR7.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-11-04 07:00 --------- d-----w C:\Documents and Settings\dziubus\Dane aplikacji\AVG7
2007-10-11 19:44 83,964 ----a-w C:\WINDOWS\Web\wcxnjhhj.exe
2007-10-11 19:43 83,964 ----a-w C:\WINDOWS\PCHealth\HelpCtr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\ssenjzlj.exe
2007-10-11 19:43 83,964 ----a-w C:\WINDOWS\PCHealth\HelpCtr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\stlvetct.exe
2007-10-11 19:43 83,964 ----a-w C:\WINDOWS\PCHealth\HelpCtr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\hshlnlhk.exe
2007-10-11 19:43 83,964 ----a-w C:\WINDOWS\PCHealth\HelpCtr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\hnvcxhls.exe
2007-10-11 19:43 83,964 ----a-w C:\WINDOWS\PCHealth\HelpCtr\System\UpdateCtr\zccewkkb.exe
2007-10-11 19:43 83,964 ----a-w C:\WINDOWS\PCHealth\HelpCtr\System\UpdateCtr\zcbjntbt.exe
2007-10-11 19:43 83,964 ----a-w C:\WINDOWS\PCHealth\HelpCtr\System\UpdateCtr\cnvjlbvb.exe
2007-10-11 19:43 83,964 ----a-w C:\WINDOWS\PCHealth\HelpCtr\System\sysinfo\zkjckqle.exe
2007-10-11 19:43 83,964 ----a-w C:\WINDOWS\PCHealth\HelpCtr\System\sysinfo\wrsnrelv.exe
2007-10-11 19:43 83,964 ----a-w C:\WINDOWS\PCHealth\HelpCtr\System\sysinfo\rbjsrhhj.exe
2007-10-11 19:43 83,964 ----a-w C:\WINDOWS\PCHealth\HelpCtr\System\sysinfo\kqwlwbxw.exe
2007-10-11 19:43 83,964 ----a-w C:\WINDOWS\PCHealth\HelpCtr\System\sysinfo\jlcehbkq.exe
2007-10-11 19:43 83,964 ----a-w C:\WINDOWS\PCHealth\HelpCtr\System\sysinfo\bttlteqt.exe
2007-10-11 19:43 83,964 ----a-w C:\WINDOWS\PCHealth\HelpCtr\System\sysinfo\bbekwlrs.exe
2007-10-11 19:43 83,964 ----a-w C:\WINDOWS\PCHealth\HelpCtr\System\Remote Assistance\srljkjhs.exe
2007-10-11 19:37 83,964 ----a-w C:\WINDOWS\PCHealth\HelpCtr\System\Remote Assistance\Interaction\Server\wqqnvzet.exe
2007-10-11 19:37 83,964 ----a-w C:\WINDOWS\PCHealth\HelpCtr\System\Remote Assistance\Interaction\Server\sbsbzljh.exe
2007-10-11 19:37 83,964 ----a-w C:\WINDOWS\PCHealth\HelpCtr\System\Remote Assistance\Interaction\Server\llehtbzr.exe
2007-10-11 19:37 83,964 ----a-w C:\WINDOWS\PCHealth\HelpCtr\System\Remote Assistance\Interaction\Server\ehvhlqhw.exe
2007-10-11 19:37 83,964 ----a-w C:\WINDOWS\PCHealth\HelpCtr\System\Remote Assistance\Interaction\Common\rrjhbcnh.exe
2007-10-11 19:37 83,964 ----a-w C:\WINDOWS\PCHealth\HelpCtr\System\Remote Assistance\Interaction\Client\wxklxbbh.exe
2007-10-11 19:37 83,964 ----a-w C:\WINDOWS\PCHealth\HelpCtr\System\Remote Assistance\Interaction\Client\wnjeletk.exe
2007-10-11 19:37 83,964 ----a-w C:\WINDOWS\PCHealth\HelpCtr\System\Remote Assistance\Interaction\Client\nkbshxqh.exe
2007-10-11 19:37 83,964 ----a-w C:\WINDOWS\PCHealth\HelpCtr\System\Remote Assistance\Interaction\Client\jthchjjx.exe
2007-10-11 19:37 83,964 ----a-w C:\WINDOWS\PCHealth\HelpCtr\System\Remote Assistance\Interaction\Client\jrwbtbsl.exe
2007-10-11 19:37 83,964 ----a-w C:\WINDOWS\PCHealth\HelpCtr\System\Remote Assistance\bxtxjsbv.exe
2007-10-11 19:37 83,964 ----a-w C:\WINDOWS\PCHealth\HelpCtr\System\rc\khhtevqk.exe
2007-10-11 19:37 83,964 ----a-w C:\WINDOWS\PCHealth\HelpCtr\System\panels\ekjekxll.exe
2007-10-11 19:37 83,964 ----a-w C:\WINDOWS\PCHealth\HelpCtr\System\NetDiag\tlwqjnbh.exe
2007-10-11 19:37 83,964 ----a-w C:\WINDOWS\PCHealth\HelpCtr\System\NetDiag\tekstkzw.exe
2007-10-11 19:37 83,964 ----a-w C:\WINDOWS\PCHealth\HelpCtr\System\errors\brlkcjst.exe
2007-10-11 19:37 83,964 ----a-w C:\WINDOWS\PCHealth\HelpCtr\System\ErrMsg\xjlnrbel.exe
2007-10-11 19:37 83,964 ----a-w C:\WINDOWS\PCHealth\HelpCtr\System\DVDUpgrd\jkenjtvv.exe
2007-10-11 19:37 83,964 ----a-w C:\WINDOWS\PCHealth\HelpCtr\System\DFS\rllhnlsq.exe
2007-10-11 19:37 83,964 ----a-w C:\WINDOWS\PCHealth\HelpCtr\System\CompatCtr\ttnejjkl.exe
2007-10-11 19:37 83,964 ----a-w C:\WINDOWS\PCHealth\HelpCtr\System\CompatCtr\kshsbten.exe
2007-10-11 19:37 83,964 ----a-w C:\WINDOWS\PCHealth\HelpCtr\System\CompatCtr\csclcbtn.exe
2007-10-11 19:37 83,964 ----a-w C:\WINDOWS\PCHealth\HelpCtr\System\CompatCtr\chlrtebt.exe
2007-10-11 19:37 83,964 ----a-w C:\WINDOWS\Help\jjlenkbt.exe
2007-10-11 19:37 83,964 ----a-w C:\WINDOWS\Help\jbnshhqj.exe
2007-10-11 19:37 83,964 ----a-w C:\WINDOWS\Help\hwexrtne.exe
2007-10-11 19:37 83,964 ----a-w C:\WINDOWS\Help\bzehxvnz.exe
2007-10-07 14:53 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\avg7
2007-10-07 14:51 --------- d-----w C:\Documents and Settings\LocalService\Dane aplikacji\AVG7
2007-10-07 14:50 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Grisoft
2007-10-07 14:16 --------- d-----w C:\Program Files\DAEMON Tools
2007-10-07 14:14 --------- d-----w C:\Program Files\Microsoft.NET
2007-10-07 14:12 --------- d-----w C:\WINDOWS\system32\config\systemprofile\Dane aplikacji\ATI
2007-10-07 14:10 685,816 ----a-w C:\WINDOWS\system32\drivers\sptd.sys
2007-10-07 13:03 315,392 ----a-w C:\WINDOWS\HideWin.exe
2007-10-07 12:54 --------- d-----w C:\Program Files\Alwil Software
2007-10-07 12:45 --------- d-----w C:\Program Files\microsoft frontpage
2007-10-07 12:42 --------- d-----w C:\Program Files\Usługi online
2007-09-29 05:46 47,376 ----a-w C:\WINDOWS\system32\drivers\ativvpxx.vp
2007-09-29 03:21 9,854,976 ----a-w C:\WINDOWS\system32\atioglx2.dll
2007-09-29 03:07 356,352 ----a-w C:\WINDOWS\system32\ATIDEMGX.dll
2007-09-29 03:06 268,800 ----a-w C:\WINDOWS\system32\ati2dvag.dll
2007-09-29 03:05 2,456,064 ----a-w C:\WINDOWS\system32\drivers\ati2mtag.sys
2007-09-29 02:58 43,520 ----a-w C:\WINDOWS\system32\ati2edxx.dll
2007-09-29 02:58 26,112 ----a-w C:\WINDOWS\system32\Ati2mdxx.exe
2007-09-29 02:58 143,360 ----a-w C:\WINDOWS\system32\atipdlxx.dll
2007-09-29 02:58 122,880 ----a-w C:\WINDOWS\system32\Oemdspif.dll
2007-09-29 02:57 122,880 ----a-w C:\WINDOWS\system32\ati2evxx.dll
2007-09-29 02:56 483,328 ----a-w C:\WINDOWS\system32\ati2evxx.exe
2007-09-29 02:55 53,248 ----a-w C:\WINDOWS\system32\ATIDDC.DLL
2007-09-29 02:49 307,200 ----a-w C:\WINDOWS\system32\atiiiexx.dll
2007-09-29 02:47 3,130,720 ----a-w C:\WINDOWS\system32\ati3duag.dll
2007-09-29 02:47 172,032 ----a-w C:\WINDOWS\system32\atiok3x2.dll
2007-09-29 02:36 1,593,600 ----a-w C:\WINDOWS\system32\ativvaxx.dll
2007-09-29 02:23 5,435,392 ----a-w C:\WINDOWS\system32\atioglxx.dll
2007-09-29 02:22 376,832 ----a-w C:\WINDOWS\system32\atikvmag.dll
2007-09-29 02:20 17,408 ----a-w C:\WINDOWS\system32\atitvo32.dll
2007-09-29 02:19 49,152 ----a-w C:\WINDOWS\system32\drivers\ati2erec.dll
2007-09-29 02:14 499,712 ----a-w C:\WINDOWS\system32\ati2cqag.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2007-10-24 15:05]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 09:50]
"SpeedTouch USB Diagnostics"="C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" [2004-03-23 11:06]
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 10:25]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 00:11]
"StartCCC"="C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2006-11-10 11:35]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2007-06-29 06:24]
"RTHDCPL"="RTHDCPL.EXE" [2007-05-10 10:08 C:\WINDOWS\RTHDCPL.exe]
"Microsoft Network Services Controller"="C:\WINDOWS\System32\mmsvc32.exe" []

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\ctfmon.exe" [2002-09-20 17:05]
"DAEMON Tools"="C:\Program Files\DAEMON Tools\daemon.exe" [2007-08-16 12:24]
"AQQ"="C:\PROGRA~1\WapSter\AQQ\AQQ.exe" [2007-02-28 13:18]
"Gadu-Gadu"="C:\Program Files\Gadu-Gadu\gg.exe" [2007-07-09 08:39]
"Skype"="C:\Program Files\Skype\Phone\Skype.exe" [2007-09-13 12:31]
"Picasa Media Detector"="C:\Program Files\Picasa2\PicasaMediaDetector.exe" [2007-09-28 02:17]
"Steam"="C:\Program Files\Steam\Steam.exe" [2006-03-10 15:15]
"BitComet"="C:\Program Files\BitComet\BitComet.exe" [2007-10-08 09:54]
"SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2007-08-31 16:46]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"Windows Service Agccnt"=qqdahdl.exe

S2 MSDisk;Network helper Service;"C:\WINDOWS\System32\irdvxc.exe" /service
S3 gdrv;gdrv;\??\C:\WINDOWS\gdrv.sys
S3 RTHDMIAzAudService;Service for HDMI;C:\WINDOWS\System32\drivers\RtHDMI.sys
S3 w200bus;Sony Ericsson W200 driver (WDM);C:\WINDOWS\System32\DRIVERS\w200bus.sys
S3 w200mdfl;Sony Ericsson W200 USB WMC Modem Filter;C:\WINDOWS\System32\DRIVERS\w200mdfl.sys
S3 w200mdm;Sony Ericsson W200 USB WMC Modem Driver;C:\WINDOWS\System32\DRIVERS\w200mdm.sys

*Newly Created Service* - CATCHME
.
Contents of the 'Scheduled Tasks' folder
"2007-11-02 07:32:16 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
.
**************************************************************************

catchme 0.3.1250 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-11-04 16:29:49
Windows 5.1.2600 Dodatek Service Pack. 1 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

**************************************************************************
.
Completion time: 2007-11-04 16:30:46
.
--- E O F ---

**Posty:** 3854 · przez **Dzi@dek** 04 Lis 2007, 18:05

Otwórz notatnik i skopiuj:

Windows Registry Editor Version 5.00

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"Windows Service Agccnt"=-

Plik zapisz jako - wszystkie pliki - pod nazwą FIX.REG
utworzony plik FIX.REG i potwierdź dodanie do rejestru >>> restart.

w HJ:

O4 - HKLM\..\Run: [Microsoft Network Services Controller] C:\WINDOWS\System32\mmsvc32.exe
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O23 - Service: NetMeeting Remote Desktop Sharing (mnmsrvc) - Unknown owner - C:\WINDOWS\System32\mnmsrvc.exe (file missing)
O23 - Service: Network helper Service (MSDisk) - Unknown owner - C:\WINDOWS\System32\irdvxc.exe (file missing)

**Posty:** 18165 · przez **wojtas** 04 Lis 2007, 18:35

Wykonaj to co jest podane w tym temacie

Otworz notatnik i wklej w nim to:

Driver::
mnmsrvc
MSDisk

File::
C:\Documents and Settings\dziubus\djd00000hg.exe
C:\Documents and Settings\dziubus\lycoc.exe
C:\WINDOWS\system32\urdvxc.exe
C:\WINDOWS\System32\irdvxc.exe
C:\WINDOWS\system32\psvc.exe
C:\WINDOWS\system32\qrje.exe
C:\WINDOWS\Web\wcxnjhhj.exe
C:\WINDOWS\PCHealth\HelpCtr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\ssenjzlj.exe
C:\WINDOWS\PCHealth\HelpCtr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\stlvetct.exe
C:\WINDOWS\PCHealth\HelpCtr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\hshlnlhk.exe
C:\WINDOWS\PCHealth\HelpCtr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\hnvcxhls.exe
C:\WINDOWS\PCHealth\HelpCtr\System\UpdateCtr\zccewkkb.exe
C:\WINDOWS\PCHealth\HelpCtr\System\UpdateCtr\zcbjntbt.exe
C:\WINDOWS\PCHealth\HelpCtr\System\UpdateCtr\cnvjlbvb.exe
C:\WINDOWS\PCHealth\HelpCtr\System\sysinfo\zkjckqle.exe
C:\WINDOWS\PCHealth\HelpCtr\System\sysinfo\wrsnrelv.exe
C:\WINDOWS\PCHealth\HelpCtr\System\sysinfo\rbjsrhhj.exe
C:\WINDOWS\PCHealth\HelpCtr\System\sysinfo\kqwlwbxw.exe
C:\WINDOWS\PCHealth\HelpCtr\System\sysinfo\jlcehbkq.exe
C:\WINDOWS\PCHealth\HelpCtr\System\sysinfo\bttlteqt.exe
C:\WINDOWS\PCHealth\HelpCtr\System\sysinfo\bbekwlrs.exe
C:\WINDOWS\PCHealth\HelpCtr\System\Remote Assistance\srljkjhs.exe
C:\WINDOWS\PCHealth\HelpCtr\System\Remote Assistance\Interaction\Server\wqqnvzet.exe
C:\WINDOWS\PCHealth\HelpCtr\System\Remote Assistance\Interaction\Server\sbsbzljh.exe
C:\WINDOWS\PCHealth\HelpCtr\System\Remote Assistance\Interaction\Server\llehtbzr.exe
C:\WINDOWS\PCHealth\HelpCtr\System\Remote Assistance\Interaction\Server\ehvhlqhw.exe
C:\WINDOWS\PCHealth\HelpCtr\System\Remote Assistance\Interaction\Common\rrjhbcnh.exe
C:\WINDOWS\PCHealth\HelpCtr\System\Remote Assistance\Interaction\Client\wxklxbbh.exe
C:\WINDOWS\PCHealth\HelpCtr\System\Remote Assistance\Interaction\Client\wnjeletk.exe
C:\WINDOWS\PCHealth\HelpCtr\System\Remote Assistance\Interaction\Client\nkbshxqh.exe
C:\WINDOWS\PCHealth\HelpCtr\System\Remote Assistance\Interaction\Client\jthchjjx.exe
C:\WINDOWS\PCHealth\HelpCtr\System\Remote Assistance\Interaction\Client\jrwbtbsl.exe
C:\WINDOWS\System32\mmsvc32.exe
C:\WINDOWS\PCHealth\HelpCtr\System\Remote Assistance\bxtxjsbv.exe
C:\WINDOWS\PCHealth\HelpCtr\System\rc\khhtevqk.exe
C:\WINDOWS\PCHealth\HelpCtr\System\panels\ekjekxll.exe
C:\WINDOWS\PCHealth\HelpCtr\System\NetDiag\tlwqjnbh.exe
C:\WINDOWS\PCHealth\HelpCtr\System\NetDiag\tekstkzw.exe
C:\WINDOWS\PCHealth\HelpCtr\System\errors\brlkcjst.exe
C:\WINDOWS\PCHealth\HelpCtr\System\ErrMsg\xjlnrbel.exe
C:\WINDOWS\PCHealth\HelpCtr\System\DVDUpgrd\jkenjtvv.exe
C:\WINDOWS\PCHealth\HelpCtr\System\DFS\rllhnlsq.exe
C:\WINDOWS\PCHealth\HelpCtr\System\CompatCtr\ttnejjkl.exe
C:\WINDOWS\PCHealth\HelpCtr\System\CompatCtr\kshsbten.exe
C:\WINDOWS\PCHealth\HelpCtr\System\CompatCtr\csclcbtn.exe
C:\WINDOWS\PCHealth\HelpCtr\System\CompatCtr\chlrtebt.exe
C:\WINDOWS\Help\jjlenkbt.exe
C:\WINDOWS\Help\jbnshhqj.exe
C:\WINDOWS\Help\hwexrtne.exe
C:\WINDOWS\Help\bzehxvnz.exe

Folder::
C:\Program Files\BearShare Applications

Registry::
[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"Windows Service Agccnt"=-

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Microsoft Network Services Controller"=-

Plik >>> zapisz jako CFScript.txt .Plik przeciągnij i upuść na ikonę ComboFixa (tak jak tu ) . Potwierdz >>> zresetuje sie komputer

(jeśli pojawi się pytanie "1 or 2" - to wpisz 1 i naciśnij ENTER). Rozpocznie się proces usuwania
Potem nowy log z hijacka oraz combofixa

**Posty:** 177 · przez **roonnii** 05 Lis 2007, 00:44

zwracam sie o odblokowanie mi tematu wyżej ponieważ on dotyczy mojego drugiego komputera jak zreszta to mozna latwo zauwazyć a nie odrazu ostrzeżenia dawać

**Posty:** 3854 · przez **Dzi@dek** 05 Lis 2007, 01:58

zwracam sie o odblokowanie mi tematu wyżej ponieważ on dotyczy mojego drugiego komputera

Niestety - jeśli jest to Twój temat , powinieneś zaznaczyć , że dotyczy innych komputerów.
Nikt nie będzie się bawił w roztrzyganie , czy to ten log czy inny.
Na forum pomagamy osobom które maja problemy a nie ich "pociotkom"
Jeśli ktoś ma problem, powinien się zarejestrować i go przedstawić.

Szanuj czas osób które to robią.

komputer sprawia coraz wiecej problemów

komputer sprawia coraz wiecej problemów

Kto jest na forum