zlob.dnschanger

**Posty:** 6 · przez **kornik911** 08 Lip 2007, 02:26

witam. ostatnio zauwazylem pewne problemy z dzialaniem niektorych aplikacji np. nie loguje mi sie automatycznie poczta tak jak to bylo do niedawna. przeskanowalem kompa avastem i nic. spybot znalazl "zlob.DNSchanger" wiec usunalem spybot'em to cos ale kazde przeszukiwanie spybotem znowu znajduje "zlob.DNSchanger".Mam pytania: co to jest ale najwazniejsze jak sie go pozbyc?juz troche popracowalem z Fixwareout'em itroche zmian z log ale spybot nadal wyszukuje zlob.DNSchanger. prosze o sprawdzenie loga i pomoc z usunieciem problemu.oto moj aktualny log:

Kod: Zaznacz wszystko: Logfile of HijackThis v1.99.1 Scan saved at 01:58:19, on 2007-07-08 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16473) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe C:\Program Files\Microsoft SQL Server\MSSQL$MPSYSTEM\Binn\sqlservr.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Hewlett-Packard\Shared\hpqWmiEx.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\WINDOWS\system32\RUNDLL32.EXE C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe C:\Program Files\Google\Gmail Notifier\gnotify.exe C:\WINDOWS\system32\rundll32.exe C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe C:\PROGRA~1\WIDCOMM\BLUETO~1\BTSTAC~1.EXE C:\PROGRA~1\HEWLET~1\Shared\HPQTOA~1.EXE C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Gadu-Gadu\gg.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Documents and Settings\Właściciel\Pulpit\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.interia.pl/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet /nodetect O4 - HKLM\..\Run: [hpWirelessAssistant] %ProgramFiles%\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe O4 - HKLM\..\Run: [QlbCtrl] %ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] CHDAudPropShortcut.exe O4 - HKLM\..\Run: [StmRst] C:\WINDOWS\StmClean.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe" O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [{0228e555-4f9c-4e35-a3ec-b109a192b4c2}] C:\Program Files\Google\Gmail Notifier\gnotify.exe O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe O4 - Startup: Tworzenie wycinków ekranu i uruchamianie programu OneNote 2007.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE O4 - Global Startup: BTTray.lnk = ? O4 - Global Startup: Service Manager.lnk = C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe O8 - Extra context menu item: E&ksportuj do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000 O8 - Extra context menu item: Wyślij do interfejsu &Bluetooth - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra button: Wyślij do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll O9 - Extra 'Tools' menuitem: Wyślij &do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm O9 - Extra 'Tools' menuitem: @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O11 - Options group: [INTERNATIONAL] International* O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 208.67.220.220,208.67.222.222 O17 - HKLM\System\CS2\Services\Tcpip\Parameters: NameServer = 208.67.220.220,208.67.222.222 O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 208.67.220.220,208.67.222.222 O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll O23 - Service: AddFiltr - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\AddFiltr.exe O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing) O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing) O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqWmiEx.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

**Posty:** 3854 · przez **Dzi@dek** 08 Lip 2007, 07:39

Wyłącz przywracanie systemu i uruchom komputer w trybie awaryjnym F8 .

Odpal hijackthis i kasujesz wpis:

O4 - HKLM\..\Run: [StmRst] C:\WINDOWS\StmClean.exe

Plik pogrubiony ręcznie usuwasz z dysku.

Dodatkowo:
Ściągnij http://downloads.subratam.org/Fixwareout.exe i zastosuj go. Na pytanie o restart - zgadzasz się.

Wróć z nowym logiem po tych zabiegach.

**Posty:** 6 · przez **kornik911** 08 Lip 2007, 14:40

oto nowy log:

Logfile of HijackThis v1.99.1
Scan saved at 14:12:33, on 2007-07-08
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16473)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
C:\Program Files\Microsoft SQL Server\MSSQL$MPSYSTEM\Binn\sqlservr.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Hewlett-Packard\Shared\hpqWmiEx.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe
C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe
C:\Program Files\Google\Gmail Notifier\gnotify.exe
C:\WINDOWS\system32\rundll32.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
C:\PROGRA~1\WIDCOMM\BLUETO~1\BTSTAC~1.EXE
C:\PROGRA~1\HEWLET~1\Shared\HPQTOA~1.EXE
C:\Documents and Settings\Właściciel\Pulpit\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.interia.pl/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet /nodetect
O4 - HKLM\..\Run: [hpWirelessAssistant] %ProgramFiles%\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [QlbCtrl] %ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] CHDAudPropShortcut.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [{0228e555-4f9c-4e35-a3ec-b109a192b4c2}] C:\Program Files\Google\Gmail Notifier\gnotify.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - Startup: Tworzenie wycinków ekranu i uruchamianie programu OneNote 2007.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
O4 - Global Startup: BTTray.lnk = ?
O4 - Global Startup: Service Manager.lnk = C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
O8 - Extra context menu item: E&ksportuj do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Wyślij do interfejsu &Bluetooth - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: Wyślij do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Wyślij &do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 208.67.220.220,208.67.222.222
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: NameServer = 208.67.220.220,208.67.222.222
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 208.67.220.220,208.67.222.222
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: AddFiltr - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\AddFiltr.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqWmiEx.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

**Posty:** 55 · przez **First** 08 Lip 2007, 14:54

Log musi być w tagach

**Posty:** 6 · przez **kornik911** 08 Lip 2007, 14:58

a co to znaczy?

**Posty:** 55 · przez **First** 08 Lip 2007, 15:16

To co zrobiłes w 1 poście :wink:

czyli tekst ma wygldac

tak

**Posty:** 3854 · przez **Dzi@dek** 08 Lip 2007, 15:28

Zaznacz cały tekst ( log ) i kliknij Code .

**Posty:** 6 · przez **kornik911** 08 Lip 2007, 15:32

Kod: Zaznacz wszystko: Logfile of HijackThis v1.99.1 Scan saved at 14:12:33, on 2007-07-08 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16473) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe C:\Program Files\Microsoft SQL Server\MSSQL$MPSYSTEM\Binn\sqlservr.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Hewlett-Packard\Shared\hpqWmiEx.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\wuauclt.exe C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe C:\Program Files\Google\Gmail Notifier\gnotify.exe C:\WINDOWS\system32\rundll32.exe C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe C:\PROGRA~1\WIDCOMM\BLUETO~1\BTSTAC~1.EXE C:\PROGRA~1\HEWLET~1\Shared\HPQTOA~1.EXE C:\Documents and Settings\Właściciel\Pulpit\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.interia.pl/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet /nodetect O4 - HKLM\..\Run: [hpWirelessAssistant] %ProgramFiles%\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe O4 - HKLM\..\Run: [QlbCtrl] %ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] CHDAudPropShortcut.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe" O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [{0228e555-4f9c-4e35-a3ec-b109a192b4c2}] C:\Program Files\Google\Gmail Notifier\gnotify.exe O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe O4 - Startup: Tworzenie wycinków ekranu i uruchamianie programu OneNote 2007.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE O4 - Global Startup: BTTray.lnk = ? O4 - Global Startup: Service Manager.lnk = C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe O8 - Extra context menu item: E&ksportuj do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000 O8 - Extra context menu item: Wyślij do interfejsu &Bluetooth - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra button: Wyślij do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll O9 - Extra 'Tools' menuitem: Wyślij &do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm O9 - Extra 'Tools' menuitem: @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O11 - Options group: [INTERNATIONAL] International* O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 208.67.220.220,208.67.222.222 O17 - HKLM\System\CS2\Services\Tcpip\Parameters: NameServer = 208.67.220.220,208.67.222.222 O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 208.67.220.220,208.67.222.222 O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll O23 - Service: AddFiltr - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\AddFiltr.exe O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing) O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing) O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqWmiEx.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

**Posty:** 3854 · przez **Dzi@dek** 08 Lip 2007, 15:37

Kod: Zaznacz wszystko: O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 208.67.220.220,208.67.222.222

Czy to sa Twoje DNS-y :?:

Ustawiałeś je :?:

**Posty:** 18165 · przez **wojtas** 08 Lip 2007, 15:37

daj loga z:

http://download.bleepingcomputer.com/sUBs/ComboFix.exe

**Posty:** 6 · przez **kornik911** 08 Lip 2007, 15:50

DNS ustawia mi sie automatycznie a te nie wiem skad sa ale usuwalem juz niektore podobno zmienione np. zaczynajace sie 85.155 itp

[ Dodano: Dzisiaj o 15:52 ]
log z combofix

Kod: Zaznacz wszystko: "Waciciel" - 2007-07-08 13:42:53 - ComboFix 07-07-07.3 - Dodatek Service Pack 2 ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) C:\DOCUME~1\WACICI~1\Pulpit.\internet explorer.lnk ((((((((((((((((((((((((( Files Created from 2007-06-08 to 2007-07-08 ))))))))))))))))))))))))))))))) 2007-07-08 13:42 51,200 --a------ C:\WINDOWS\nircmd.exe 2007-07-07 22:26 9,763 --a------ C:\dnsbak.reg 2007-07-07 03:11 <DIR> d-------- C:\Program Files\Prima Games 2007-07-07 03:11 <DIR> d-------- C:\Program Files\Alcohol Soft 2007-07-01 22:33 4,194,304 --a------ C:\DOCUME~1\WACICI~1\ntuser.dat 2007-07-01 13:43 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\Trymedia 2007-06-29 16:19 <DIR> d-------- C:\DOCUME~1\WACICI~1\DANEAP~1\gtk-2.0 2007-06-29 16:19 <DIR> d-------- C:\DOCUME~1\WACICI~1\.thumbnails 2007-06-29 16:10 <DIR> d-------- C:\DOCUME~1\WACICI~1\.gimp-2.2 2007-06-29 16:09 <DIR> d-------- C:\Program Files\GIMP-2.0 2007-06-29 16:07 <DIR> d-------- C:\Program Files\Common Files\GTK 2007-06-29 16:06 <DIR> d-------- C:\Program Files\InfraRecorder 2007-06-29 16:06 <DIR> d-------- C:\DOCUME~1\WACICI~1\DANEAP~1\InfraRecorder 2007-06-29 14:33 95,872 --a------ C:\WINDOWS\system32\AVASTSS.scr 2007-06-29 14:33 94,552 --a------ C:\WINDOWS\system32\drivers\aswmon2.sys 2007-06-29 14:33 85,952 --a------ C:\WINDOWS\system32\drivers\aswmon.sys 2007-06-29 14:33 745,600 --a------ C:\WINDOWS\system32\aswBoot.exe 2007-06-29 14:33 43,176 --a------ C:\WINDOWS\system32\drivers\aswTdi.sys 2007-06-29 14:33 26,888 --a------ C:\WINDOWS\system32\drivers\aavmker4.sys 2007-06-29 14:33 23,416 --a------ C:\WINDOWS\system32\drivers\aswRdr.sys 2007-06-29 14:33 1,060,864 --a------ C:\WINDOWS\system32\MFC71.dll 2007-06-29 14:32 <DIR> d-------- C:\Program Files\Alwil Software 2007-06-21 02:09 <DIR> d-------- C:\DOCUME~1\WACICI~1\DANEAP~1\INTERIAPL 2007-06-19 23:11 420,240 --a------ C:\WINDOWS\system32\mpg4c32.dll 2007-06-19 23:11 309,616 --a------ C:\WINDOWS\system32\wmv8dmod.dll 2007-06-19 23:01 <DIR> d-------- C:\Program Files\Codemasters 2007-06-19 20:21 271,224 --a------ C:\WINDOWS\system32\mucltui.dll 2007-06-19 20:21 208,248 --a------ C:\WINDOWS\system32\muweb.dll 2007-06-19 12:15 32,592 --a------ C:\WINDOWS\system32\msonpmon.dll 2007-06-19 12:15 30,512 --a------ C:\WINDOWS\system32\mdimon.dll 2007-06-19 12:14 <DIR> d-------- C:\Program Files\Microsoft Works 2007-06-19 12:13 <DIR> d-------- C:\Program Files\Microsoft.NET 2007-06-19 12:11 <DIR> dr-h----- C:\MSOCache 2007-06-19 12:11 <DIR> d-------- C:\WINDOWS\SHELLNEW 2007-06-19 12:11 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\Microsoft Help 2007-06-15 18:04 <DIR> d-------- C:\DOCUME~1\WACICI~1\DANEAP~1\OpenOffice.org2 2007-06-15 18:03 <DIR> d-------- C:\Program Files\OpenOffice.org 2.2 2007-06-15 14:33 685,816 --a------ C:\WINDOWS\system32\drivers\sptd.sys 2007-06-12 14:51 9,464 --------- C:\WINDOWS\system32\drivers\cdralw2k.sys 2007-06-12 14:51 9,336 --------- C:\WINDOWS\system32\drivers\cdr4_xp.sys 2007-06-12 14:51 43,528 --------- C:\WINDOWS\system32\drivers\PxHelp20.sys 2007-06-12 14:51 129,784 --------- C:\WINDOWS\system32\pxafs.dll 2007-06-12 14:51 <DIR> d-------- C:\Program Files\Winamp 2007-06-10 00:25 <DIR> d-------- C:\WINDOWS\SxsCaPendDel 2007-06-09 23:35 <DIR> d-------- C:\DOCUME~1\WACICI~1\DANEAP~1\Media Player Classic 2007-06-09 22:48 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\Apple Computer 2007-06-09 22:47 5,120 --a------ C:\WINDOWS\system32\ff_vfw.dll 2007-06-09 22:47 1,415,680 --a------ C:\WINDOWS\system32\WMV9VCM.dll 2007-06-09 22:47 <DIR> d-------- C:\Program Files\K-Lite Codec Pack 2007-06-09 22:47 <DIR> d-------- C:\DOCUME~1\WACICI~1\DANEAP~1\Real 2007-06-09 22:47 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\Real 2007-06-09 18:00 2,933 --a------ C:\WINDOWS\mozver.dat 2007-06-09 18:00 0 --a------ C:\WINDOWS\nsreg.dat 2007-06-09 17:57 <DIR> d-------- C:\Program Files\DivX 2007-06-09 17:37 <DIR> d-------- C:\DOCUME~1\WACICI~1\DANEAP~1\TransRender 2007-06-09 17:37 <DIR> d-------- C:\DOCUME~1\WACICI~1\DANEAP~1\Temporary 2007-06-09 17:37 <DIR> d-------- C:\DOCUME~1\WACICI~1\DANEAP~1\Samsung 2007-06-09 17:37 <DIR> d-------- C:\DOCUME~1\WACICI~1\DANEAP~1\ConvertTemp 2007-06-09 12:25 <DIR> d-------- C:\Program Files\MSXML 4.0 2007-06-09 12:24 174,592 --a------ C:\WINDOWS\system32\framedyn.dll 2007-06-09 12:23 94,000 --a------ C:\WINDOWS\system32\drivers\ss_mdm.sys 2007-06-09 12:23 8,304 --a------ C:\WINDOWS\system32\drivers\ss_mdfl.sys 2007-06-09 12:23 6,144 --a------ C:\WINDOWS\system32\drivers\ss_cmnt.sys 2007-06-09 12:23 6,144 --a------ C:\WINDOWS\system32\drivers\ss_cm.sys 2007-06-09 12:23 58,320 --a------ C:\WINDOWS\system32\drivers\ss_bus.sys 2007-06-09 12:23 5,808 --a------ C:\WINDOWS\system32\drivers\ss_whnt.sys 2007-06-09 12:23 5,808 --a------ C:\WINDOWS\system32\drivers\ss_wh.sys 2007-06-09 12:23 5,632 --a------ C:\WINDOWS\system32\drivers\StarOpen.sys 2007-06-09 12:23 <DIR> d-------- C:\WINDOWS\system32\Samsung_USB_Drivers 2007-06-09 12:11 <DIR> d-------- C:\WINDOWS\system32\Samsung 2007-06-09 12:10 <DIR> d-------- C:\WINDOWS\system32\Samsung PC Studio Codecs 2007-06-09 12:10 <DIR> d-------- C:\Program Files\Samsung 2007-06-09 01:01 5,248 --a------ C:\WINDOWS\system32\drivers\d347prt.sys 2007-06-09 01:01 155,136 --a------ C:\WINDOWS\system32\drivers\d347bus.sys 2007-06-09 01:01 <DIR> d-------- C:\WINDOWS\Downloaded Installations 2007-06-09 01:01 <DIR> d-------- C:\Program Files\D-Tools 2007-06-09 00:34 <DIR> d-------- C:\Program Files\Interna 2007-06-09 00:34 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\Interna 2007-06-09 00:30 90,112 --------- C:\WINDOWS\system32\s2sqlprs.dll 2007-06-09 00:30 765,952 --a------ C:\WINDOWS\system32\xvidcore.dll 2007-06-09 00:30 509,328 --------- C:\WINDOWS\system32\crviewer.dll 2007-06-09 00:30 5,550,080 --------- C:\WINDOWS\system32\craxdrt.dll 2007-06-09 00:30 270,336 --------- C:\WINDOWS\system32\p2sodbc.dll 2007-06-09 00:30 180,224 --a------ C:\WINDOWS\system32\xvidvfw.dll 2007-06-09 00:30 <DIR> d-------- C:\Program Files\MPsystem 2007-06-09 00:26 33,340 --------- C:\WINDOWS\system32\dbmsqlgc.dll 2007-06-09 00:26 306,688 --a------ C:\WINDOWS\IsUninst.exe 2007-06-09 00:26 24,576 --------- C:\WINDOWS\system32\dbmsgnet.dll 2007-06-09 00:26 <DIR> d-------- C:\Program Files\Microsoft SQL Server 2007-06-09 00:24 274,432 --a------ C:\WINDOWS\system32\IscDbc.dll 2007-06-09 00:24 262,144 --a------ C:\WINDOWS\system32\OdbcJdbcMT.dll 2007-06-09 00:24 253,952 --a------ C:\WINDOWS\system32\OdbcJdbc.dll 2007-06-09 00:24 155,648 --a------ C:\WINDOWS\system32\OdbcJdbcSetup.dll 2007-06-08 14:51 <DIR> d-------- C:\DOCUME~1\WACICI~1\DANEAP~1\Azureus 2007-06-08 14:51 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\Azureus 2007-06-08 14:50 <DIR> d-------- C:\Program Files\Azureus 2007-06-08 14:35 <DIR> d-------- C:\DOCUME~1\WACICI~1\DANEAP~1\Gadu-Gadu 2007-06-08 14:30 <DIR> d-------- C:\Program Files\Gadu-Gadu 2007-06-08 14:30 <DIR> d-------- C:\DOCUME~1\WACICI~1\Gadu-Gadu 2007-06-08 13:13 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\Spybot - Search & Destroy (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) 2007-07-08 11:29:39 94,900 ----a-w C:\WINDOWS\system32\perfc015.dat 2007-07-08 11:29:39 512,720 ----a-w C:\WINDOWS\system32\perfh015.dat 2007-07-08 01:53:22 -------- d-----w C:\Program Files\Windows Media Connect 2 2007-06-19 21:01:15 -------- d--h--w C:\Program Files\InstallShield Installation Information 2007-06-07 11:27:05 -------- d-----w C:\Program Files\totalcmd 2007-06-06 20:47:23 -------- d-----w C:\DOCUME~1\WACICI~1\DANEAP~1\Help 2007-05-31 15:19:18 -------- d-----w C:\Program Files\MSBuild 2007-05-31 15:15:55 -------- d-----w C:\Program Files\Reference Assemblies 2007-05-31 12:32:54 -------- d-----w C:\Program Files\Messenger 2007-05-31 11:57:56 -------- d-----w C:\Program Files\CONEXANT 2007-05-31 11:43:44 -------- d-----w C:\Program Files\NetWaiting 2007-05-31 11:22:17 -------- d-----w C:\Program Files\WIDCOMM 2007-05-31 10:56:30 -------- d-----w C:\Program Files\Hewlett-Packard 2007-05-31 10:55:32 -------- d-----w C:\Program Files\Synaptics 2007-05-31 10:55:26 -------- d-----w C:\Program Files\Common Files\InstallShield 2007-05-31 10:38:31 -------- d-----w C:\Program Files\Intel 2007-05-31 10:29:13 -------- d-----w C:\Program Files\DIFX 2007-05-31 10:28:45 -------- d-----w C:\Program Files\HP 1.3MP Webcam 2007-05-31 00:58:29 -------- d-----w C:\Program Files\Common Files\ODBC 2007-05-31 00:58:26 -------- d-----w C:\Program Files\Common Files\SpeechEngines 2007-05-30 16:07:41 -------- d-----w C:\Program Files\microsoft frontpage 2007-05-30 16:07:25 0 --sha-r C:\MSDOS.SYS 2007-05-30 16:07:25 0 --sha-r C:\IO.SYS 2007-05-30 16:07:25 0 ----a-w C:\CONFIG.SYS 2007-05-30 16:07:25 0 ----a-w C:\AUTOEXEC.BAT 2007-05-30 16:06:30 -------- d--h--w C:\Program Files\WindowsUpdate 2007-05-30 16:06:29 -------- d-----w C:\Program Files\Usługi online 2007-05-30 16:05:40 -------- d-----w C:\Program Files\Common Files\MSSoap 2007-05-30 16:05:29 -------- d-----w C:\Program Files\Movie Maker 2007-05-30 16:05:00 21,856 ----a-w C:\WINDOWS\system32\emptyregdb.dat 2007-05-30 16:04:32 -------- d-----w C:\Program Files\MSN Gaming Zone 2007-05-30 16:04:23 -------- d-----w C:\Program Files\Windows NT 2007-05-30 15:32:33 1,548,288 ----a-w C:\WINDOWS\system32\sfcfiles.dll 2007-05-30 15:32:09 277,784 ----a-w C:\WINDOWS\system32\drivers\iaStor.sys 2007-05-30 15:32:06 991,744 ----a-w C:\WINDOWS\system32\syssetup.dll 2007-05-16 15:18:58 683,520 ----a-w C:\WINDOWS\system32\inetcomm.dll 2007-04-25 14:23:30 144,896 ----a-w C:\WINDOWS\system32\schannel.dll 2007-04-18 16:14:32 2,854,400 ----a-w C:\WINDOWS\system32\msi.dll 2007-04-16 20:47:36 33,624 ----a-w C:\WINDOWS\system32\wups.dll 2007-04-16 20:45:54 1,710,936 ----a-w C:\WINDOWS\system32\wuaueng.dll 2007-04-16 20:45:48 549,720 ----a-w C:\WINDOWS\system32\wuapi.dll 2007-04-16 20:45:42 325,976 ----a-w C:\WINDOWS\system32\wucltui.dll 2007-04-16 20:45:36 203,096 ----a-w C:\WINDOWS\system32\wuweb.dll 2007-04-16 20:45:28 92,504 ----a-w C:\WINDOWS\system32\cdm.dll 2007-04-16 20:45:20 53,080 ----a-w C:\WINDOWS\system32\wuauclt.exe 2007-04-16 20:45:20 43,352 ----a-w C:\WINDOWS\system32\wups2.dll ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}] 2006-10-22 23:08 62080 --a------ C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{22BF413B-C6D2-4d91-82A9-A0F997BA588C}] 2007-05-28 14:52 722472 --a------ C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{53707962-6F74-2D53-2644-206D7942484F}] 2005-05-31 01:04 853672 --a------ C:\Program Files\Spybot - Search & Destroy\SDHelper.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}] 2007-03-14 03:43 501400 --a------ C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{AA58ED58-01DD-4d91-8333-CF10577473F7}] 2007-06-08 00:09 2403392 -ra------ c:\program files\google\googletoolbar1.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}] 2007-07-01 22:15 325048 --a------ C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "nwiz"="nwiz.exe" [2006-09-27 17:10 C:\WINDOWS\system32\nwiz.exe] "hpWirelessAssistant"="%ProgramFiles%\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe" [] "SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2007-01-12 14:36] "QlbCtrl"="%ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [] "High Definition Audio Property Page Shortcut"="CHDAudPropShortcut.exe" [2006-07-26 22:44 C:\WINDOWS\system32\CHDAudPropShortcut.exe] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe" [2007-03-14 03:43] "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-05-11 03:06] "{0228e555-4f9c-4e35-a3ec-b109a192b4c2}"="C:\Program Files\Google\Gmail Notifier\gnotify.exe" [2005-07-15 23:48] "avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-04-30 17:42] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2006-03-02 14:00] "swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-07-01 22:15] ************************************************************************** catchme 0.3.915 W2K/XP/Vista - rootkit detector by Gmer, http://www.gmer.net Rootkit scan 2007-07-08 13:44:43 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** Completion time: 2007-07-08 13:45:10 C:\ComboFix-quarantined-files.txt ... 2007-07-08 13:45 --- E O F ---

**Posty:** 18165 · przez **wojtas** 08 Lip 2007, 15:58

skasuj plik:

C:\dnsbak.reg

oraz:

Użyj WWDC :
http://www.firewallleaktester.com/wwdc.htm
Zmień opcje z disable na enable. Uruchom ponownie komputer.
Tak powinny wyglądać porty (NetBIOS może być żółty) :
http://www.firewallleaktester.com/images_site/wwdc.jpg

**Posty:** 6 · przez **kornik911** 08 Lip 2007, 16:25

dziekuje wszystkim za pomoc wyglada na to ze sie udalo.mam nadzieje ze uda mi sie Wam kiedys jakos odwdzieczyc.pozdrawiam

zlob.dnschanger

zlob.dnschanger

Kto jest na forum