proszę o sprawdzenie loga

**Posty:** 67 · przez **sroka20** 05 Lip 2007, 07:29

System
świezo zainstalowany i już wydaje mi się że mam smieci.Jestem 100% pewien ze domownicy wchodzili na potencialne zagrożone strony.Syestem tnie i mam wrażenie ze w tle chodzą jakies programy.NOD wyłapuje czesc trojanow ale chyba nie daje 100% efektu.Proszę o pomoc

Kod: Zaznacz wszystko: Logfile of HijackThis v1.99.1 Scan saved at 06:58:50, on 2007-07-05 Platform: Windows XP (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 (6.00.2600.0000) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Eset\nod32kui.exe C:\WINDOWS\System32\ildewo\york.exe C:\WINDOWS\System32\selzaoyjjf.exe C:\Program Files\Messenger\msmsgs.exe C:\Program Files\Eset\nod32krn.exe C:\WINDOWS\System32\wuauclt.exe C:\Program Files\Internet Explorer\iexplore.exe C:\WINDOWS\System32\wuauclt.exe C:\Documents and Settings\aaaa\Ustawienia lokalne\Temp\Katalog tymczasowy 2 dla hijackthis_199.zip\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE O4 - HKLM\..\Run: [msennger] C:\WINDOWS\System32\ildewo\york.exe O4 - HKLM\..\Run: [Windows Servces Agent] selzaoyjjf.exe O4 - HKLM\..\RunServices: [Systam13] f1r5st83.exe O4 - HKLM\..\RunServices: [Wind0ws Ser7ice Agent] colwindos.exe O4 - HKLM\..\RunServices: [Windows Servces Agent] selzaoyjjf.exe O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [Windows Servces Agent] selzaoyjjf.exe O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://downloads.ewido.net/ewidoOnlineScan.cab O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1183499584035 O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe

**Posty:** 18165 · przez **wojtas** 05 Lip 2007, 12:04

Wyłącz przywracanie systemu ( właściwości mój komputer-zakładka przywracanie - wyłącz przywracanie na wszystkich dyskach)
Start do awaryjnego ( F8 ) przy starcie komputera.

O4 - HKLM\..\Run: [msennger] C:\WINDOWS\System32\ildewo\york.exe
O4 - HKLM\..\Run: [Windows Servces Agent] selzaoyjjf.exe
O4 - HKLM\..\RunServices: [Systam13] f1r5st83.exe
O4 - HKLM\..\RunServices: [Wind0ws Ser7ice Agent] colwindos.exe
O4 - HKLM\..\RunServices: [Windows Servces Agent] selzaoyjjf.exe
O4 - HKCU\..\Run: [Windows Servces Agent] selzaoyjjf.exe

Odpalasz hijackthis i zaznaczasz ptaszkami powyższe wpisy i dajesz Fix checked.
Pogrubione pliki usuwasz ręcznie z dysku
potem nowe logi z Hijack This oraz Silent runners

**Posty:** 67 · przez **sroka20** 05 Lip 2007, 23:22

Witam ,

Tak jak mówiłeś pokasowałem wszystko .
To są logi o których mówiłeś:

Kod: Zaznacz wszystko: Logfile of HijackThis v1.99.1 Scan saved at 22:52:51, on 2007-07-05 Platform: Windows XP (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 (6.00.2600.0000) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Eset\nod32kui.exe C:\WINDOWS\System32\winsys32.exe C:\Program Files\Messenger\msmsgs.exe C:\Program Files\Eset\nod32krn.exe C:\WINDOWS\System32\wuauclt.exe C:\WINDOWS\System32\wuauclt.exe C:\Program Files\Internet Explorer\iexplore.exe C:\WINDOWS\SoftwareDistribution\Download\43ab4310d3c682d7f669ad4db86a272d\update\update.exe C:\Program Files\Gadu-Gadu\gg.exe C:\WINDOWS\system32\NOTEPAD.EXE C:\Documents and Settings\aaaa\Ustawienia lokalne\Temp\Katalog tymczasowy 5 dla hijackthis_199.zip\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE O4 - HKLM\..\Run: [Windows Service Agent] winsys32.exe O4 - HKLM\..\RunServices: [Windows Servces Agent] selzaoyjjf.exe O4 - HKLM\..\RunServices: [Windows Service Agent] winsys32.exe O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [Windows Service Agent] winsys32.exe O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://downloads.ewido.net/ewidoOnlineScan.cab O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1183499584035 O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe

Kod: Zaznacz wszystko: "Silent Runners.vbs", revision R50, http://www.silentrunners.org/ Operating System: Windows XP Output limited to non-default values, except where indicated by "{++}" Startup items buried in registry: --------------------------------- HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ {++} "MSMSGS" = ""C:\Program Files\Messenger\msmsgs.exe" /background" [MS] "Windows Service Agent" = "winsys32.exe" [null data] HKLM\Software\Microsoft\Windows\CurrentVersion\Run\ {++} "nod32kui" = ""C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE" ["Eset "] "Windows Service Agent" = "winsys32.exe" [null data] HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\ "{42071714-76d4-11d1-8b24-00a0c9068ff3}" = "Rozszerzenie CPL kadrowania wyświetlania" -> {HKLM...CLSID} = "Rozszerzenie CPL kadrowania wyświetlania" \InProcServer32\(Default) = "deskpan.dll" [file not found] "{88895560-9AA2-1069-930E-00AA0030EBC8}" = "Rozszerzenie ikony HyperTerminalu" -> {HKLM...CLSID} = "HyperTerminal Icon Ext" \InProcServer32\(Default) = "C:\WINDOWS\System32\hticons.dll" ["Hilgraeve, Inc."] "{B089FE88-FB52-11D3-BDF1-0050DA34150D}" = "NOD32 Context Menu Shell Extension" -> {HKLM...CLSID} = "NOD32 Context Menu Shell Extension" \InProcServer32\(Default) = "C:\Program Files\Eset\nodshex.dll" [null data] HKLM\Software\Classes\*\shellex\ContextMenuHandlers\ NOD32 Context Menu Shell Extension\(Default) = "{B089FE88-FB52-11D3-BDF1-0050DA34150D}" -> {HKLM...CLSID} = "NOD32 Context Menu Shell Extension" \InProcServer32\(Default) = "C:\Program Files\Eset\nodshex.dll" [null data] HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\ NOD32 Context Menu Shell Extension\(Default) = "{B089FE88-FB52-11D3-BDF1-0050DA34150D}" -> {HKLM...CLSID} = "NOD32 Context Menu Shell Extension" \InProcServer32\(Default) = "C:\Program Files\Eset\nodshex.dll" [null data] Group Policies {GPedit.msc branch and setting}: ----------------------------------------------- Note: detected settings may not have any effect. HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\ "shutdownwithoutlogon" = (REG_DWORD) hex:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| Shutdown: Allow system to be shut down without having to log on} "undockwithoutlogon" = (REG_DWORD) hex:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| Devices: Allow undock without having to log on} Active Desktop and Wallpaper: ----------------------------- Active Desktop may be disabled at this entry: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState Enabled Screen Saver: --------------------- HKCU\Control Panel\Desktop\ "SCRNSAVE.EXE" = "C:\WINDOWS\System32\logon.scr" [MS] Winsock2 Service Provider DLLs: ------------------------------- Namespace Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++} 000000000001\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS] 000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS] 000000000003\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS] Transport Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++} 0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range: C:\WINDOWS\System32\imon.dll ["Eset "], 01 - 05, 18 %SystemRoot%\system32\mswsock.dll [MS], 06 - 09, 12 - 17 %SystemRoot%\system32\rsvpsp.dll [MS], 10 - 11 Running Services (Display Name, Service Name, Path {Service DLL}): ------------------------------------------------------------------ NOD32 Kernel Service, NOD32krn, ""C:\Program Files\Eset\nod32krn.exe"" ["Eset "] ---------- + This report excludes default entries except where indicated. + To see *everywhere* the script checks and *everything* it finds, launch it from a command prompt or a shortcut with the -all parameter. + The search for DESKTOP.INI DLL launch points on all local fixed drives took 39 seconds. ---------- (total run time: 213 seconds)

Pozdrawiam i proszę o sprawdzenie czy to już wszystko:)

**Posty:** 55 · przez **First** 06 Lip 2007, 00:45

szkodliwe wpisy w Hijackthis:

C:\WINDOWS\System32\winsys32.exe
O4 - HKLM\..\Run: [Windows Service Agent] winsys32.exe
O4 - HKLM\..\RunServices: [Windows Servces Agent] selzaoyjjf.exe
O4 - HKLM\..\RunServices: [Windows Service Agent] winsys32.exe
O4 - HKCU\..\Run: [Windows Service Agent] winsys32.exe

+
szkodliwe wpisy w Silentrunners:

HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ {++}
"Windows Service Agent" = "winsys32.exe" [null data]
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\ {++}
"Windows Service Agent" = "winsys32.exe" [null data]

Na początek użyj WWDC + Seconfig XP.

Następnie zastosuj ComboFix

Wracasz z logami z HijackThis, SilentRuners, ComboFix.

**Posty:** 67 · przez **sroka20** 06 Lip 2007, 22:37

Mam tylko pytanie jak skorzystać z seconfigXP i jak z SilentRuners wykasować błędne wpisy??

**Posty:** 18165 · przez **wojtas** 06 Lip 2007, 22:49

sroka20 napisał(a):ak z SilentRuners wykasować błędne wpisy??

jak skasujesz w hijacku to znikna z silenta

sroka20 napisał(a):Mam tylko pytanie jak skorzystać z seconfigXP

wlaczasz dajesz Tak potem apply reset kompa i juz

**Posty:** 55 · przez **First** 06 Lip 2007, 22:52

TUTAJ masz instrukcje Seconfig XP

**Posty:** 67 · przez **sroka20** 07 Lip 2007, 02:28

Kod: Zaznacz wszystko: Logfile of HijackThis v1.99.1 Scan saved at 01:45:25, on 2007-07-07 Platform: Windows XP (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 (6.00.2600.0000) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Eset\nod32kui.exe C:\Program Files\Eset\nod32krn.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Gadu-Gadu\gg.exe D:\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://downloads.ewido.net/ewidoOnlineScan.cab O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1183499584035 O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1183671366240 O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe

Kod: Zaznacz wszystko: "aaaa" - 2007-07-07 1:47:36 - ComboFix 07-07-04.4 [color=red][b]FAT32 [/b][/color] ((((((((((((((((((((((((( Files Created from 2007-06-06 to 2007-07-06 ))))))))))))))))))))))))))))))) 2007-07-06 23:10 271,224 --a------ C:\WINDOWS\system32\mucltui.dll 2007-07-06 22:10 51,200 --a------ C:\WINDOWS\nircmd.exe 2007-07-06 20:45 <DIR> d--hs---- C:\FOUND.001 2007-07-06 20:32 <DIR> d--hs---- C:\FOUND.000 2007-07-06 20:20 545 --a------ C:\WINDOWS\UC.PIF 2007-07-06 20:20 545 --a------ C:\WINDOWS\RAR.PIF 2007-07-06 20:20 545 --a------ C:\WINDOWS\PKZIP.PIF 2007-07-06 20:20 545 --a------ C:\WINDOWS\PKUNZIP.PIF 2007-07-06 20:20 545 --a------ C:\WINDOWS\NOCLOSE.PIF 2007-07-06 20:20 545 --a------ C:\WINDOWS\LHA.PIF 2007-07-06 20:20 545 --a------ C:\WINDOWS\ARJ.PIF 2007-07-06 20:20 <DIR> d-------- C:\totalcmd 2007-07-06 20:19 <DIR> d-------- C:\Program Files\DivX Subtitle Displayer 2007-07-06 20:18 <DIR> d-------- C:\Program Files\The Playa 2007-07-06 20:18 <DIR> d-------- C:\Program Files\DivXCodec 2007-07-06 20:17 <DIR> d-------- C:\Program Files\ffdshow 2007-07-05 23:38 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\Windows Genuine Advantage 2007-07-05 23:10 975 --a------ C:\WINDOWS\mozver.dat 2007-07-05 23:10 4 --a------ C:\WINDOWS\system32\proc97.bin 2007-07-05 23:10 <DIR> d-------- C:\DOCUME~1\aaaa\DANEAP~1\GanymedeNet 2007-07-05 23:04 0 --a------ C:\WINDOWS\nsreg.dat 2007-07-05 20:14 977,920 --a------ C:\WINDOWS\system32\msdtctm.dll 2007-07-05 20:14 64,512 --a------ C:\WINDOWS\system32\mtxclu.dll 2007-07-05 20:14 64,512 --a------ C:\WINDOWS\system32\colbact.dll 2007-07-05 20:14 499,200 --a------ C:\WINDOWS\system32\comuid.dll 2007-07-05 20:14 365,568 --a------ C:\WINDOWS\system32\msdtcprx.dll 2007-07-05 20:14 226,816 --a------ C:\WINDOWS\system32\es.dll 2007-07-05 20:14 150,528 --a------ C:\WINDOWS\system32\msdtcuiu.dll 2007-07-05 20:14 110,080 --a------ C:\WINDOWS\system32\clbcatex.dll 2007-07-05 20:13 97,280 --a------ C:\WINDOWS\system32\txflog.dll 2007-07-05 20:13 82,432 --a------ C:\WINDOWS\system32\mtxoci.dll 2007-07-05 20:13 596,480 --a------ C:\WINDOWS\system32\catsrvut.dll 2007-07-05 20:13 593,408 --a------ C:\WINDOWS\system32\h323msp.dll 2007-07-05 20:13 552,448 --a------ C:\WINDOWS\system32\rtcdll.dll 2007-07-05 20:13 48,640 --a------ C:\WINDOWS\system32\browser.dll 2007-07-05 20:13 454,144 --a------ C:\WINDOWS\system32\ipnathlp.dll 2007-07-05 20:13 442,880 --a------ C:\WINDOWS\system32\rpcrt4.dll 2007-07-05 20:13 36,864 --a------ C:\WINDOWS\system32\mf3216.dll 2007-07-05 20:13 225,280 --a------ C:\WINDOWS\system32\catsrv.dll 2007-07-05 20:13 214,528 --a------ C:\WINDOWS\system32\rpcss.dll 2007-07-05 20:13 1,177,088 --a------ C:\WINDOWS\system32\comsvcs.dll 2007-07-05 20:13 1,105,408 --a------ C:\WINDOWS\system32\ole32.dll 2007-07-05 19:47 442,368 -r-hs---- C:\WINDOWS\system32\winsys32.exe 2007-07-05 19:47 219,648 --a------ C:\WINDOWS\system32\srrstr.dll 2007-07-05 18:43 524,288 --ah----- C:\DOCUME~1\ADMINI~1\NTUSER.DAT 2007-07-05 18:43 <DIR> dr-h----- C:\DOCUME~1\ADMINI~1\Dane aplikacji 2007-07-05 18:43 <DIR> dr------- C:\DOCUME~1\ADMINI~1\Menu Start 2007-07-05 18:43 <DIR> d--h----- C:\DOCUME~1\ADMINI~1\Ustawienia lokalne 2007-07-05 18:43 <DIR> d--h----- C:\DOCUME~1\ADMINI~1\Szablony 2007-07-05 18:43 <DIR> d-------- C:\DOCUME~1\ADMINI~1\Ulubione 2007-07-05 18:43 <DIR> d-------- C:\DOCUME~1\ADMINI~1\Pulpit 2007-07-05 18:43 <DIR> d-------- C:\DOCUME~1\ADMINI~1\Moje dokumenty 2007-07-05 10:52 509,952 --a------ C:\WINDOWS\system32\windsservc.exe 2007-07-05 06:55 7,680 --------- C:\WINDOWS\system32\bitsprx2.dll 2007-07-05 06:55 7,168 --------- C:\WINDOWS\system32\bitsprx3.dll 2007-07-05 06:55 331,776 --a------ C:\WINDOWS\system32\winhttp.dll 2007-07-05 06:55 17,408 --a------ C:\WINDOWS\system32\qmgrprxy.dll 2007-07-05 06:55 <DIR> d-------- C:\WINDOWS\system32\bits 2007-07-04 00:15 26,112 --a------ C:\WINDOWS\system32\xpsp1hfm.exe 2007-07-04 00:15 <DIR> d--h----- C:\WINDOWS\$xpsp1hfm$ 2007-07-04 00:07 <DIR> d-------- C:\WINDOWS\pss 2007-07-03 23:53 434,176 --a------ C:\WINDOWS\system32\olsq.exe 2007-07-03 22:55 43,352 --a------ C:\WINDOWS\system32\wups2.dll 2007-07-03 22:55 33,624 --a------ C:\WINDOWS\system32\wups.dll 2007-07-03 22:55 325,976 --a------ C:\WINDOWS\system32\wucltui.dll 2007-07-03 22:54 549,720 --a------ C:\WINDOWS\system32\wuapi.dll 2007-07-03 22:54 <DIR> d-------- C:\WINDOWS\SoftwareDistribution 2007-07-03 22:53 <DIR> d---s---- C:\DOCUME~1\aaaa\UserData 2007-07-03 21:31 <DIR> d-------- C:\WINDOWS\system32\ildewo 2007-07-03 21:30 857,007 --a------ C:\WINDOWS\system32\kjfdo.exe 2007-07-03 20:44 467,968 -ra------ C:\WINDOWS\system32\colwindos.exe 2007-07-03 18:28 20,016 --------- C:\WINDOWS\system32\drivers\pxhelp20.sys 2007-07-03 18:28 <DIR> d-------- C:\Program Files\Winamp 2007-07-03 10:49 435,200 -r-hs---- C:\WINDOWS\system32\f1r5st83.exe 2007-07-02 19:51 <DIR> d--hs---- C:\Recycled 2007-07-01 22:34 <DIR> d-------- C:\WINDOWS\system32\appmgmt 2007-07-01 21:38 <DIR> d-------- C:\DOCUME~1\aaaa\DANEAP~1\Help 2007-07-01 18:17 502,368 --a------ C:\WINDOWS\system32\drivers\amon.sys 2007-07-01 18:17 274,432 --a------ C:\WINDOWS\system32\imon.dll 2007-07-01 18:14 <DIR> d-------- C:\Program Files\Gadu-Gadu 2007-07-01 18:14 <DIR> d-------- C:\DOCUME~1\aaaa\Gadu-Gadu 2007-07-01 18:10 <DIR> d--hs---- C:\WINDOWS\Installer 2007-07-01 18:09 1,048,576 --ah----- C:\DOCUME~1\aaaa\NTUSER.DAT 2007-07-01 18:09 <DIR> dr-h----- C:\DOCUME~1\aaaa\Dane aplikacji 2007-07-01 18:09 <DIR> dr------- C:\DOCUME~1\aaaa\Ulubione 2007-07-01 18:09 <DIR> dr------- C:\DOCUME~1\aaaa\Moje dokumenty 2007-07-01 18:09 <DIR> dr------- C:\DOCUME~1\aaaa\Menu Start 2007-07-01 18:09 <DIR> d--h----- C:\DOCUME~1\aaaa\Ustawienia lokalne 2007-07-01 18:09 <DIR> d--h----- C:\DOCUME~1\aaaa\Szablony 2007-07-01 18:09 <DIR> d-------- C:\DOCUME~1\aaaa\Pulpit 2007-07-01 17:49 241,664 --ah----- C:\DOCUME~1\NETWOR~1\NTUSER.DAT 2007-07-01 17:49 241,664 --ah----- C:\DOCUME~1\LOCALS~1\NTUSER.DAT 2007-07-01 17:49 <DIR> d--hs---- C:\System Volume Information 2007-07-01 17:49 <DIR> d--h----- C:\DOCUME~1\NETWOR~1\Ustawienia lokalne 2007-07-01 17:49 <DIR> d--h----- C:\DOCUME~1\LOCALS~1\Ustawienia lokalne 2007-07-01 17:49 <DIR> d-------- C:\WINDOWS\Prefetch 2007-07-01 17:49 <DIR> d-------- C:\DOCUME~1\NETWOR~1\Dane aplikacji 2007-07-01 17:49 <DIR> d-------- C:\DOCUME~1\LOCALS~1\Dane aplikacji 2007-07-01 17:40 <DIR> d-------- C:\WINDOWS\system32\xircom 2007-07-01 17:40 <DIR> d-------- C:\Program Files\microsoft frontpage (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) 2007-07-06 23:39:06 49,492 ----a-w C:\WINDOWS\system32\perfc015.dat 2007-07-06 23:39:06 355,486 ----a-w C:\WINDOWS\system32\perfh015.dat 2007-07-01 15:31:32 -------- d-----w C:\Program Files\Usługi online 2007-04-16 20:45:28 92,504 ----a-w C:\WINDOWS\system32\cdm.dll 2007-04-16 20:43:44 203,096 ----a-w C:\WINDOWS\system32\wuweb.dll 2007-04-16 20:43:40 208,248 ----a-w C:\WINDOWS\system32\muweb.dll 2001-10-26 15:29:52 508,928 --sh--r C:\WINDOWS\system32\selzaoyjjf.exe ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "nod32kui"="C:\Program Files\Eset\nod32kui.exe" [2007-07-01 18:16] [HKEY_USERS\.default\software\microsoft\windows\currentversion\run] "Windows Service Agent"=winsys32.exe "Wind0ws Ser7ice Agent"=colwindos.exe "Windows Servces Agent"=selzaoyjjf.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msennger] C:\WINDOWS\System32\ildewo\york.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Systam13] f1r5st83.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Wind0ws Ser7ice Agent] colwindos.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows Service Agent] winsys32.exe HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{ACC563BC-4266-43f0-B6ED-9D38C4202C7E} rundll32 iesetup.dll,IEAccessUserInst ************************************************************************** catchme 0.3.915 W2K/XP/Vista - rootkit detector by Gmer, http://www.gmer.net Rootkit scan 2007-07-07 01:49:43 Windows 5.1.2600 FAT NTAPI scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** Completion time: 2007-07-07 1:50:42 C:\ComboFix2.txt ... 2007-07-06 22:13 --- E O F ---

co do SilentRuners wyskakuje mi error i nie mogę wyświetlić całego loga.
tyle co zostało z niego:

Kod: Zaznacz wszystko: "Silent Runners.vbs", revision R50, http://www.silentrunners.org/ Operating System: Windows XP Output limited to non-default values, except where indicated by "{++}" Startup items buried in registry: --------------------------------- HKLM\Software\Microsoft\Windows\CurrentVersion\Run\ {++} "nod32kui" = ""C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE" ["Eset "] HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\ "{42071714-76d4-11d1-8b24-00a0c9068ff3}" = "Rozszerzenie CPL kadrowania wyświetlania" -> {HKLM...CLSID} = "Rozszerzenie CPL kadrowania wyświetlania" \InProcServer32\(Default) = "deskpan.dll" [file not found] "{88895560-9AA2-1069-930E-00AA0030EBC8}" = "Rozszerzenie ikony HyperTerminalu" -> {HKLM...CLSID} = "HyperTerminal Icon Ext" \InProcServer32\(Default) = "C:\WINDOWS\System32\hticons.dll" ["Hilgraeve, Inc."] "{B089FE88-FB52-11D3-BDF1-0050DA34150D}" = "NOD32 Context Menu Shell Extension" -> {HKLM...CLSID} = "NOD32 Context Menu Shell Extension" \InProcServer32\(Default) = "C:\Program Files\Eset\nodshex.dll" [null data] HKLM\Software\Classes\*\shellex\ContextMenuHandlers\ NOD32 Context Menu Shell Extension\(Default) = "{B089FE88-FB52-11D3-BDF1-0050DA34150D}" -> {HKLM...CLSID} = "NOD32 Context Menu Shell Extension" \InProcServer32\(Default) = "C:\Program Files\Eset\nodshex.dll" [null data] HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\ NOD32 Context Menu Shell Extension\(Default) = "{B089FE88-FB52-11D3-BDF1-0050DA34150D}" -> {HKLM...CLSID} = "NOD32 Context Menu Shell Extension" \InProcServer32\(Default) = "C:\Program Files\Eset\nodshex.dll" [null data] Group Policies {GPedit.msc branch and setting}: ----------------------------------------------- Note: detected settings may not have any effect. HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\ "shutdownwithoutlogon" = (REG_DWORD) hex:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| Shutdown: Allow system to be shut down without having to log on} "undockwithoutlogon" = (REG_DWORD) hex:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| Devices: Allow undock without having to log on} Active Desktop and Wallpaper: ----------------------------- Active Desktop may be disabled at this entry: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState

**Posty:** 18165 · przez **wojtas** 07 Lip 2007, 09:35

Pobierz i uruchom narzędzie : The Avenger
http://swandog46.geekstogo.com/avenger.zip
Zaznacz opcję Input script manually i kliknij na Lupkę z prawej strony. W okienku, które się otworzy wklejasz:

Files to delete:

C:\WINDOWS\system32\winsys32.exe
C:\WINDOWS\system32\srrstr.dll
C:\WINDOWS\system32\windsservc.exe
C:\WINDOWS\system32\olsq.exe
C:\WINDOWS\system32\kjfdo.exe
C:\WINDOWS\system32\colwindos.exe
C:\WINDOWS\system32\f1r5st83.exe
C:\WINDOWS\system32\selzaoyjjf.exe

Klikasz Done, a następnie zielone światełko i zgadzasz się na restart klikając OK.

wklejasz do notatnika:

Windows Registry Editor Version 5.00

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"Windows Service Agent"=-
"Wind0ws Ser7ice Agent"=-
"Windows Servces Agent"=-

[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Systam13]

[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Wind0ws Ser7ice Agent]

[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows Service Agent]

w notatniku u góry>>>plik zapisz jako>>>Zmien rozszerzenie z TXT na Wszystkie pliki *.* >>> Zapisz pod nazwą FIX.REG

Klikasz dwa razy na powstały plik fix i dodajesz go do rejestru....

Kasujesz ręcznie z dysku plik: C:\Avenger\backup.zip i wklejasz na forum raport: C:\avenger.txt + log z combofixa

**Posty:** 67 · przez **sroka20** 11 Lip 2007, 00:09

Witam no i mam problem.Nie mogę uruchomic zmienionego FIX.REG bo:Określony plik nie jest skryptem rejestru.Można importować tylko binarne pliki rejestru z wewnątrz Edytora rejestru.

combofi mi się wiesza i komputer przestaje mi odpowiadać.

co dalej robic??

**Posty:** 18165 · przez **wojtas** 11 Lip 2007, 10:06

REGEDIT 4

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"Windows Service Agent"=-
"Wind0ws Ser7ice Agent"=-
"Windows Servces Agent"=-

[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Systam13]

[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Wind0ws Ser7ice Agent]

[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows Service Agent]

wklej to moze

**Posty:** 67 · przez **sroka20** 11 Lip 2007, 18:34

dalej ten sam komunikat.

**Posty:** 55 · przez **First** 11 Lip 2007, 18:49

Bop Ty najpradopodbniej wklejas ze słowem "Cytat" a masz wkleic tylko to:

Windows Registry Editor Version 5.00

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"Windows Service Agent"=-
"Wind0ws Ser7ice Agent"=-
"Windows Servces Agent"=-

[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Systam13]

[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Wind0ws Ser7ice Agent]

[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows Service Agent]

**Posty:** 67 · przez **sroka20** 11 Lip 2007, 20:05

wklejam bez słowa cytat .

**Posty:** 18165 · przez **wojtas** 11 Lip 2007, 20:11

start>uruchom>regedit przejdz do klucza:

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]

skasuj:

Kod: Zaznacz wszystko: Windows Service Agent Wind0ws Ser7ice Agent Windows Servces Agent

oraz przjedz i skasuj te pogrunione :

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Systam13]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Wind0ws Ser7ice Agent]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows Service Agent]

**Posty:** 67 · przez **sroka20** 11 Lip 2007, 22:31

wszystko to o czym pisałeś zostało zrobione.
Czy to wszystko czy dalej wysłać jakieś logi na sprawdzenie ?
pozdrawiam

**Posty:** 7838 · przez **Lukesh** 11 Lip 2007, 22:33

Wstaw jeszcze logi kontrolne :wink:

**Posty:** 67 · przez **sroka20** 11 Lip 2007, 23:11

Więc jak radzisz po koleji:

Logfile of HijackThis v1.99.1
Scan saved at 22:57, on 2007-07-11
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Eset\nod32kui.exe
C:\Program Files\Hewlett-Packard\OrderReminder\OrderReminder.exe
C:\Program Files\Eset\nod32krn.exe
C:\Program Files\Gadu-Gadu\gg.exe
C:\Program Files\internet explorer\iexplore.exe
D:\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = L1cza
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0 CE\Reader\ActiveX\AcroIEHelper.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [OrderReminder] C:\Program Files\Hewlett-Packard\OrderReminder\OrderReminder.exe
O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://downloads.ewido.net/ewidoOnlineScan.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1183499584035
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1183671366240
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe

"Silent Runners.vbs", revision R50, http://www.silentrunners.org/
Operating System: Windows XP
Output limited to non-default values, except where indicated by "{++}"

Startup items buried in registry:
---------------------------------

HKLM\Software\Microsoft\Windows\CurrentVersion\Run\ {++}
"nod32kui" = ""C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE" ["Eset "]
"OrderReminder" = "C:\Program Files\Hewlett-Packard\OrderReminder\OrderReminder.exe" ["Hewlett-Packard"]

HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\(Default) = (no title provided)
-> {HKLM...CLSID} = "AcroIEHlprObj Class"
\InProcServer32\(Default) = "C:\Program Files\Adobe\Acrobat 6.0 CE\Reader\ActiveX\AcroIEHelper.dll" ["Adobe Systems Incorporated"]

HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\
"{42071714-76d4-11d1-8b24-00a0c9068ff3}" = "Rozszerzenie CPL kadrowania wyświetlania"
-> {HKLM...CLSID} = "Rozszerzenie CPL kadrowania wyświetlania"
\InProcServer32\(Default) = "deskpan.dll" [file not found]
"{88895560-9AA2-1069-930E-00AA0030EBC8}" = "Rozszerzenie ikony HyperTerminalu"
-> {HKLM...CLSID} = "HyperTerminal Icon Ext"
\InProcServer32\(Default) = "C:\WINDOWS\System32\hticons.dll" ["Hilgraeve, Inc."]
"{B089FE88-FB52-11D3-BDF1-0050DA34150D}" = "NOD32 Context Menu Shell Extension"
-> {HKLM...CLSID} = "NOD32 Context Menu Shell Extension"
\InProcServer32\(Default) = "C:\Program Files\Eset\nodshex.dll" [null data]

HKLM\Software\Classes\*\shellex\ContextMenuHandlers\
NOD32 Context Menu Shell Extension\(Default) = "{B089FE88-FB52-11D3-BDF1-0050DA34150D}"
-> {HKLM...CLSID} = "NOD32 Context Menu Shell Extension"
\InProcServer32\(Default) = "C:\Program Files\Eset\nodshex.dll" [null data]

HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\
NOD32 Context Menu Shell Extension\(Default) = "{B089FE88-FB52-11D3-BDF1-0050DA34150D}"
-> {HKLM...CLSID} = "NOD32 Context Menu Shell Extension"
\InProcServer32\(Default) = "C:\Program Files\Eset\nodshex.dll" [null data]

Group Policies {GPedit.msc branch and setting}:
-----------------------------------------------

Note: detected settings may not have any effect.

HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\

"shutdownwithoutlogon" = (REG_DWORD) hex:0x00000001
{Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options|
Shutdown: Allow system to be shut down without having to log on}

"undockwithoutlogon" = (REG_DWORD) hex:0x00000001
{Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options|
Devices: Allow undock without having to log on}

Active Desktop and Wallpaper:
-----------------------------

Active Desktop may be disabled at this entry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState

do tego momentu doszedł mi silent runners a póniej wyskoczył błąd:

Overflow: "hVal"
kod:800A0006
źródło: microsoft VBScript rutine error

Combo fix sie wiesza

**Posty:** 18165 · przez **wojtas** 12 Lip 2007, 09:23

daj loga z:

http://www.techsupportforum.com/sectools/Deckard/dss.exe

**Posty:** 67 · przez **sroka20** 12 Lip 2007, 23:07

Deckard's System Scanner v20070711.54
Run by aaaa on 2007-07-12 at 23:00:07
Computer is in Normal Mode.
--------------------------------------------------------------------------------

-- System Restore --------------------------------------------------------------

System Restore is disabled; attempting to re-enable...success.

-- Last 1 Restore Point(s) --
1: 2007-07-12 21:00:16 UTC - RP1 - System Checkpoint

Backed up registry hives.

Performed disk cleanup.

-- HijackThis Clone ------------------------------------------------------------

Emulating logfile of HijackThis v1.99.1
Scan saved at 2007-07-12 23:01:20
Platform: Windows XP (5.01.2600)
MSIE: Internet Explorer (6.00.2600.0000)

Running processes:
C:\WINDOWS\system32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\explorer.exe
C:\Program Files\ESET\nod32kui.exe
C:\Program Files\Hewlett-Packard\OrderReminder\OrderReminder.exe
C:\Program Files\ESET\nod32krn.exe
C:\Program Files\Gadu-Gadu\gg.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Documents and Settings\aaaa\Ustawienia lokalne\Temporary Internet Files\Content.IE5\FG7QF4KR\dss[1].exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0 CE\Reader\ActiveX\AcroIEHelper.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\system32\msdxm.ocx
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [OrderReminder] C:\Program Files\Hewlett-Packard\OrderReminder\OrderReminder.exe
O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://downloads.ewido.net/ewidoOnlineScan.cab
O16 - DPF: {33564D57-9980-0010-8000-00AA00389B71} () - http://download.microsoft.com/download/D/0/D/D0DD87DA-994F-4334-8B55-AF2E4D98ED0C/wmv9dmo.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1183499584035
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1183671366240
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O18 - Protocol: lid - {5C135180-9973-46D9-ABF4-148267CBB8BF} - C:\WINDOWS\system32\msvidctl.dll
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - "C:\Program Files\Eset\nod32krn.exe"

-- HijackThis Fixed Entries (D:\\backups\) -------------------------------------

backup-20070707-013315-752 O4 - HKLM\..\Run: [Windows Service Agent] winsys32.exe
backup-20070707-013315-669 O4 - HKLM\..\RunServices: [Windows Servces Agent] selzaoyjjf.exe
backup-20070707-013315-448 O4 - HKLM\..\RunServices: [Windows Service Agent] winsys32.exe
backup-20070707-013315-792 O4 - HKCU\..\Run: [Windows Service Agent] winsys32.exe

-- File Associations -----------------------------------------------------------

.cpl - cplfile - shell\cplopen\command - rundll32.exe shell32.dll,Control_RunDLL "%1",%*

-- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled ---------------------

R2 AMON - c:\windows\system32\drivers\amon.sys <Not Verified; Eset; NOD32 Antivirus System>

S0 wfmtvbdq - c:\windows\system32\drivers\uqaadtgx.sys (file missing)
S3 catchme - c:\docume~1\aaaa\ustawi~1\temp\catchme.sys (file missing)

-- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------

All services whitelisted.

-- Files created between 2007-06-12 and 2007-07-12 -----------------------------

2007-07-12 18:50:22 0 d--hs---- C:\FOUND.002
2007-07-11 22:34:12 0 d-------- C:\Program Files\NAPI-PROJEKT
2007-07-11 12:57:50 143360 -ra------ C:\WINDOWS\apptune1020.exe <Not Verified; Zenographics; Zenographics apptune>
2007-07-11 12:57:44 1175552 -ra------ C:\WINDOWS\System32\zshp1020.exe
2007-07-11 12:57:42 0 d-------- C:\Program Files\Hewlett-Packard
2007-07-11 12:57:41 0 d--h----- C:\Program Files\Zenographics
2007-07-11 12:51:56 0 d-------- C:\Program Files\Common Files\Adobe
2007-07-11 12:49:37 0 d-------- C:\WINDOWS\Cache
2007-07-06 20:45:36 0 d--hs---- C:\FOUND.001
2007-07-06 20:32:54 0 d--hs---- C:\FOUND.000
2007-07-06 20:27:07 4096 -----n--- C:\Program Files\XviD
2007-07-06 20:20:16 545 --a------ C:\WINDOWS\UC.PIF
2007-07-06 20:20:16 545 --a------ C:\WINDOWS\RAR.PIF
2007-07-06 20:20:16 545 --a------ C:\WINDOWS\PKZIP.PIF
2007-07-06 20:20:16 545 --a------ C:\WINDOWS\PKUNZIP.PIF
2007-07-06 20:20:16 545 --a------ C:\WINDOWS\NOCLOSE.PIF
2007-07-06 20:20:16 545 --a------ C:\WINDOWS\LHA.PIF
2007-07-06 20:20:16 545 --a------ C:\WINDOWS\ARJ.PIF
2007-07-06 20:20:16 0 d-------- C:\totalcmd
2007-07-06 20:19:05 0 d-------- C:\Program Files\DivX Subtitle Displayer
2007-07-06 20:18:02 0 d-------- C:\Program Files\The Playa
2007-07-06 20:18:02 0 d-------- C:\Program Files\DivXCodec
2007-07-06 20:17:42 0 d-------- C:\Program Files\ffdshow
2007-07-05 23:10:41 4 --a------ C:\WINDOWS\System32\proc97.bin
2007-07-05 23:10:40 975 --a------ C:\WINDOWS\mozver.dat
2007-07-05 23:04:43 0 --a------ C:\WINDOWS\nsreg.dat
2007-07-05 06:55:59 0 d-------- C:\WINDOWS\System32\bits
2007-07-04 00:15:38 26112 --a------ C:\WINDOWS\System32\xpsp1hfm.exe <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
2007-07-04 00:15:38 0 d--h----- C:\WINDOWS\$xpsp1hfm$
2007-07-04 00:07:38 0 d-------- C:\WINDOWS\pss
2007-07-03 22:54:19 0 d-------- C:\WINDOWS\SoftwareDistribution
2007-07-03 21:31:05 0 d-------- C:\WINDOWS\System32\ildewo
2007-07-03 18:28:04 0 d-------- C:\Program Files\Winamp
2007-07-02 19:51:57 0 d--hs---- C:\Recycled
2007-07-01 22:34:09 0 d-------- C:\WINDOWS\System32\appmgmt
2007-07-01 19:35:06 64 --a------ C:\WINDOWS\System32\o
2007-07-01 18:17:18 274432 --a------ C:\WINDOWS\System32\imon.dll <Not Verified; Eset; NOD32 Antivirus System>
2007-07-01 18:17:18 502368 --a------ C:\WINDOWS\System32\drivers\amon.sys <Not Verified; Eset; NOD32 Antivirus System>
2007-07-01 18:14:15 0 d-------- C:\Program Files\Gadu-Gadu
2007-07-01 18:10:05 0 d--hs---- C:\WINDOWS\Installer
2007-07-01 17:49:43 0 d--hs---- C:\System Volume Information
2007-07-01 17:49:41 0 d-------- C:\WINDOWS\Prefetch
2007-07-01 17:40:39 0 d-------- C:\WINDOWS\System32\xircom
2007-07-01 17:40:39 0 d-------- C:\Program Files\microsoft frontpage
2007-07-01 17:39:30 0 -rahs---- C:\MSDOS.SYS
2007-07-01 17:39:30 0 -rahs---- C:\IO.SYS
2007-07-01 17:39:30 0 --a------ C:\CONFIG.SYS
2007-07-01 17:39:30 0 --a------ C:\AUTOEXEC.BAT
2007-07-01 17:36:50 0 dr------- C:\WINDOWS\Offline Web Pages
2007-07-01 17:36:50 0 d---s---- C:\WINDOWS\Downloaded Program Files
2007-07-01 17:36:02 0 d-------- C:\WINDOWS\srchasst
2007-07-01 17:35:39 0 d-------- C:\WINDOWS\System32\Macromed
2007-07-01 17:35:39 0 d-------- C:\WINDOWS\System32\DirectX
2007-07-01 17:35:15 0 d-------- C:\Program Files\Movie Maker
2007-07-01 17:34:18 0 d-------- C:\WINDOWS\System32\Restore
2007-07-01 17:34:08 0 d-------- C:\WINDOWS\PCHEALTH
2007-07-01 17:33:56 0 d---s---- C:\WINDOWS\Tasks
2007-07-01 17:33:49 0 d-------- C:\Program Files\Common Files\MSSoap
2007-07-01 17:31:51 21856 --a------ C:\WINDOWS\System32\emptyregdb.dat
2007-07-01 17:31:36 0 d-------- C:\WINDOWS\Registration
2007-07-01 17:31:30 0 d--h----- C:\Program Files\WindowsUpdate
2007-07-01 17:31:30 0 d-------- C:\Program Files\Usługi online
2007-07-01 17:31:14 0 d-------- C:\Program Files\Messenger
2007-07-01 17:30:57 0 d-------- C:\Program Files\MSN Gaming Zone
2007-07-01 17:30:31 0 d-------- C:\Program Files\Windows NT
2007-07-01 17:30:06 0 d-------- C:\WINDOWS\System32\MsDtc
2007-07-01 17:30:01 0 d-------- C:\WINDOWS\System32\Com
2007-07-01 16:47:18 0 d-------- C:\Program Files\Common Files\ODBC
2007-07-01 16:47:13 0 d-------- C:\Program Files\Common Files\SpeechEngines
2007-07-01 16:47:12 0 dr------- C:\Program Files
2007-07-01 16:46:08 0 d-------- C:\WINDOWS\System32\CatRoot2
2007-07-01 16:46:08 0 d-------- C:\WINDOWS\System32\CatRoot
2007-07-01 16:45:46 0 d-------- C:\Documents and Settings
2007-07-01 16:38:15 0 d-------- C:\WINDOWS
2007-07-01 16:38:15 0 d-------- C:\WINDOWS\WinSxS
2007-07-01 16:38:15 0 dr------- C:\WINDOWS\Web
2007-07-01 16:38:15 0 d-------- C:\WINDOWS\twain_32
2007-07-01 16:38:15 0 d-------- C:\WINDOWS\system32
2007-07-01 16:38:15 0 d-------- C:\WINDOWS\System32\wins
2007-07-01 16:38:15 0 d-------- C:\WINDOWS\System32\wbem
2007-07-01 16:38:15 0 d-------- C:\WINDOWS\System32\usmt
2007-07-01 16:38:15 0 d-------- C:\WINDOWS\System32\spool
2007-07-01 16:38:15 0 d-------- C:\WINDOWS\System32\ShellExt
2007-07-01 16:38:15 0 d-------- C:\WINDOWS\System32\Setup
2007-07-01 16:38:15 0 d-------- C:\WINDOWS\System32\ras
2007-07-01 16:38:15 0 d-------- C:\WINDOWS\System32\oobe
2007-07-01 16:38:15 0 d-------- C:\WINDOWS\System32\npp
2007-07-01 16:38:15 0 d-------- C:\WINDOWS\System32\mui
2007-07-01 16:38:15 0 d-------- C:\WINDOWS\System32\inetsrv
2007-07-01 16:38:15 0 d-------- C:\WINDOWS\System32\IME
2007-07-01 16:38:15 0 d-------- C:\WINDOWS\System32\icsxml
2007-07-01 16:38:15 0 d-------- C:\WINDOWS\System32\ias
2007-07-01 16:38:15 0 d-------- C:\WINDOWS\System32\export
2007-07-01 16:38:15 0 d-------- C:\WINDOWS\System32\drivers
2007-07-01 16:38:15 0 d-------- C:\WINDOWS\System32\drivers\etc
2007-07-01 16:38:15 0 d-------- C:\WINDOWS\System32\drivers\disdn
2007-07-01 16:38:15 0 dr-hs---- C:\WINDOWS\System32\dllcache
2007-07-01 16:38:15 0 d-------- C:\WINDOWS\System32\dhcp
2007-07-01 16:38:15 0 d-------- C:\WINDOWS\System32\config
2007-07-01 16:38:15 0 d-------- C:\WINDOWS\System32\3com_dmi
2007-07-01 16:38:15 0 d-------- C:\WINDOWS\System32\3076
2007-07-01 16:38:15 0 d-------- C:\WINDOWS\System32\2052
2007-07-01 16:38:15 0 d-------- C:\WINDOWS\System32\1054
2007-07-01 16:38:15 0 d-------- C:\WINDOWS\System32\1045
2007-07-01 16:38:15 0 d-------- C:\WINDOWS\System32\1042
2007-07-01 16:38:15 0 d-------- C:\WINDOWS\System32\1041
2007-07-01 16:38:15 0 d-------- C:\WINDOWS\System32\1037
2007-07-01 16:38:15 0 d-------- C:\WINDOWS\System32\1033
2007-07-01 16:38:15 0 d-------- C:\WINDOWS\System32\1031
2007-07-01 16:38:15 0 d-------- C:\WINDOWS\System32\1028
2007-07-01 16:38:15 0 d-------- C:\WINDOWS\System32\1025
2007-07-01 16:38:15 0 d-------- C:\WINDOWS\system
2007-07-01 16:38:15 0 d-------- C:\WINDOWS\security
2007-07-01 16:38:15 0 d-------- C:\WINDOWS\Resources
2007-07-01 16:38:15 0 d-------- C:\WINDOWS\repair
2007-07-01 16:38:15 0 d-------- C:\WINDOWS\mui
2007-07-01 16:38:15 0 d-------- C:\WINDOWS\msapps
2007-07-01 16:38:15 0 d-------- C:\WINDOWS\msagent
2007-07-01 16:38:15 0 d-------- C:\WINDOWS\Media
2007-07-01 16:38:15 0 d-------- C:\WINDOWS\java
2007-07-01 16:38:15 0 d--h----- C:\WINDOWS\inf
2007-07-01 16:38:15 0 d-------- C:\WINDOWS\ime
2007-07-01 16:38:15 0 d-------- C:\WINDOWS\Help
2007-07-01 16:38:15 0 dr--s---- C:\WINDOWS\Fonts
2007-07-01 16:38:15 0 d-------- C:\WINDOWS\Driver Cache
2007-07-01 16:38:15 0 d-------- C:\WINDOWS\Debug
2007-07-01 16:38:15 0 d-------- C:\WINDOWS\Cursors
2007-07-01 16:38:15 0 d-------- C:\WINDOWS\Connection Wizard
2007-07-01 16:38:15 0 d-------- C:\WINDOWS\Config
2007-07-01 16:38:15 0 d-------- C:\WINDOWS\AppPatch
2007-07-01 16:38:15 0 d-------- C:\WINDOWS\addins

-- Find3M Report ---------------------------------------------------------------

2007-07-11 12:55:26 0 d-------- C:\Documents and Settings\aaaa\Dane aplikacji\AdobeUM
2007-07-11 12:55:16 0 d-------- C:\Documents and Settings\aaaa\Dane aplikacji\Adobe
2007-07-07 01:39:06 355486 --a------ C:\WINDOWS\System32\perfh015.dat
2007-07-07 01:39:06 49492 --a------ C:\WINDOWS\System32\perfc015.dat
2007-07-05 23:10:42 0 d-------- C:\Documents and Settings\aaaa\Dane aplikacji\GanymedeNet
2007-07-05 23:04:36 0 d-------- C:\Documents and Settings\aaaa\Dane aplikacji\Mozilla
2007-07-01 22:31:50 0 d-------- C:\Documents and Settings\aaaa\Dane aplikacji\Macromedia
2007-07-01 21:38:28 0 d-------- C:\Documents and Settings\aaaa\Dane aplikacji\Help
2007-07-01 18:10:02 0 d-------- C:\Documents and Settings\aaaa\Dane aplikacji\Identities
2007-07-01 16:46:30 62 --ahs---- C:\Documents and Settings\aaaa\Dane aplikacji\desktop.ini

-- Registry Dump ---------------------------------------------------------------

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects]
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} C:\Program Files\Adobe\Acrobat 6.0 CE\Reader\ActiveX\AcroIEHelper.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run]
"nod32kui"="\"C:\\Program Files\\Eset\\nod32kui.exe\" /WAITSERVICE"
"OrderReminder"="C:\\Program Files\\Hewlett-Packard\\OrderReminder\\OrderReminder.exe"

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"CTFMON.EXE"="C:\\WINDOWS\\System32\\CTFMON.EXE"

HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa
Authentication Packages REG_MULTI_SZ msv1_0\0\0
Security Packages REG_MULTI_SZ kerberos\0msv1_0\0schannel\0wdigest\0\0
Notification Packages REG_MULTI_SZ scecli\0\0

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msennger]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="york"
"hkey"="HKLM"
"command"="C:\\WINDOWS\\System32\\ildewo\\york.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Svchost]
LocalService REG_MULTI_SZ Alerter\0WebClient\0LmHosts\0RemoteRegistry\0upnphost\0SSDPSRV\0\0
NetworkService REG_MULTI_SZ DnsCache\0\0
rpcss REG_MULTI_SZ RpcSs\0\0
imgsvc REG_MULTI_SZ StiSvc\0\0
termsvcs REG_MULTI_SZ TermService\0\0

-- End of Deckard's System Scanner: finished at 2007-07-12 at 23:05:49 ---------

[ Dodano: Dzisiaj o 22:12 ]
jeszcze wyskoczyło:

Deckard's System Scanner v20070711.54
Extra logfile - please post this as an attachment with your post.
--------------------------------------------------------------------------------

-- System Information ----------------------------------------------------------

Microsoft Windows XP Professional (build 2600)
Architecture: X86; Language: Polish

CPU 0: Procesor Intel Celeron
Percentage of Memory in Use: 61%
Physical Memory (total/avail): 319.55 MiB / 123.77 MiB
Pagefile Memory (total/avail): 775.27 MiB / 613.75 MiB
Virtual Memory (total/avail): 2047.88 MiB / 1965.82 MiB

A: is Removable (FAT)
C: is Fixed (FAT32) - 4.88 GiB total, 2.26 GiB free.
D: is Fixed (FAT32) - 22.98 GiB total, 6.02 GiB free.
E: is Fixed (FAT32) - 23.32 GiB total, 0.25 GiB free.
F: is Fixed (FAT32) - 23.31 GiB total, 5.89 GiB free.
G: is CDROM (CDFS)

-- Security Center -------------------------------------------------------------

AUOptions is set to notify before install.

-- Environment Variables -------------------------------------------------------

ALLUSERSPROFILE=C:\Documents and Settings\All Users
APPDATA=C:\Documents and Settings\aaaa\Dane aplikacji
CommonProgramFiles=C:\Program Files\Common Files
COMPUTERNAME=SROKA
ComSpec=C:\WINDOWS\system32\cmd.exe
HOMEDRIVE=C:
HOMEPATH=\
LOGONSERVER=\\SROKA
NUMBER_OF_PROCESSORS=1
OS=Windows_NT
Path=C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\system32\wbem;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\Program Files\Internet Explorer;
PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
PROCESSOR_ARCHITECTURE=x86
PROCESSOR_IDENTIFIER=x86 Family 6 Model 6 Stepping 5, GenuineIntel
PROCESSOR_LEVEL=6
PROCESSOR_REVISION=0605
ProgramFiles=C:\Program Files
PROMPT=$P$G
SESSIONNAME=Console
SystemDrive=C:
SystemRoot=C:\WINDOWS
TEMP=C:\DOCUME~1\aaaa\USTAWI~1\Temp
TMP=C:\DOCUME~1\aaaa\USTAWI~1\Temp
USERDOMAIN=SROKA
USERNAME=aaaa
USERPROFILE=C:\Documents and Settings\aaaa
windir=C:\WINDOWS

-- User Profiles ---------------------------------------------------------------

aaaa (admin)
Administrator (new local, admin)

-- Add/Remove Programs ---------------------------------------------------------

--> rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf
Adobe Flash Player 9 ActiveX --> C:\WINDOWS\System32\Macromed\Flash\FlashUtil9c.exe -uninstallUnlock
Adobe Reader 6.0 CE --> MsiExec.exe /I{AC76BA86-7AD7-1038-7646-CE0000000001}
DivX 4.0 Final Codec --> "C:\Program Files\DivXCodec\uninstall.exe"
DivX Subtitle Displayer 4.54 --> "C:\Program Files\DivX Subtitle Displayer\unins000.exe"
ffdshow (remove only) --> "C:\Program Files\ffdshow\uninstall.exe"
Gadu-Gadu 6.0 --> C:\Program Files\Gadu-Gadu\Setup.exe
HijackThis 1.99.1 --> C:\Documents and Settings\aaaa\Ustawienia lokalne\Temp\Katalog tymczasowy 1 dla hijackthis_199.zip\HijackThis.exe /uninstall
LaserJet 1020 series --> C:\Program Files\Zenographics\{97447636-A635-43D8-A084-E691BFCED441}\SETUP.EXE -u "HPLJInstaller.dll=Hplj1020.inf"
mIRC --> "C:\WINDOWS\System32\ildewo\york.exe" -uninstall
Mozilla Firefox (2.0.0.4) --> C:\Program Files\Mozilla Firefox\uninstall\helper.exe
NAPIPROJEKT 1.0.4.5 --> "C:\Program Files\NAPI-PROJEKT\unins000.exe"
NOD32 FiX v2.1 --> "C:\Program Files\Eset\unins000.exe"
OrderReminder HP LaserJet 1020 --> "C:\Program Files\Hewlett-Packard\OrderReminder\uninstall\hpuninstaller.exe" hp_LaserJet_1020
Pakiet poprawki systemu Windows XP [zobacz Q329115, aby uzyskać więcej informacji] --> C:\WINDOWS\$NtUninstallQ329115$\spuninst\spuninst.exe
Poprawka systemu Windows XP - KB823559 --> C:\WINDOWS\$NtUninstallKB823559$\spuninst\spuninst.exe
Poprawka systemu Windows XP - KB828741 --> C:\WINDOWS\$NtUninstallKB828741$\spuninst\spuninst.exe
Poprawka systemu Windows XP - KB835732 --> C:\WINDOWS\$NtUninstallKB835732$\spuninst\spuninst.exe
Poprawka systemu Windows XP - KB842773 --> C:\WINDOWS\$NtUninstallKB842773$\spuninst\spuninst.exe
System Antywirusowy NOD32 --> C:\Program Files\Eset\Setup\setup.exe /UNINSTALL
The Playa --> "C:\Program Files\The Playa\uninstall.exe"
Total Commander (Remove or Repair) --> c:\totalcmd\tcuninst.exe
Winamp (remove only) --> "C:\Program Files\Winamp\UninstWA.exe"
XviD MPEG-4 Video Codec --> "C:\Program Files\XviD\unins000.exe"

-- End of Deckard's System Scanner: finished at 2007-07-12 at 23:05:49 ---------
[code][/code]

proszę o sprawdzenie loga

Proszę o sprawdzenie loga

Kto jest na forum