powolna praca komputera.

**Posty:** 65 · przez **volfenstein** 12 Lut 2008, 21:00

Witam ! Zamiesszczam Log z HJt. Nie mozna normalnie pracowac na komputerze tak strasznie zwolnil ze nie da sie tego opisac.

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 19:57:37, on 2008-02-12 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16544) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe C:\WINDOWS\system32\crypserv.exe C:\WINDOWS\system32\IDispChg.exe C:\PROGRA~1\PANASO~1\REMOTE~1\kmentsrv.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\Program Files\Microsoft SQL Server\MSSQL\Binn\sqlservr.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\svchost.exe C:\Program Files\TOSHIBA\Program narzędziowy TOSHIBA Zooming Utility\SmoothView.exe C:\Program Files\SigmaTel\SigmaTel AC97 Audio Drivers\stacmon.exe C:\Program Files\Apoint2K\Apoint.exe C:\Program Files\TOSHIBA\PadTouch\PadExe.exe C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe C:\WINDOWS\system32\WiFiMon.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Apoint2K\Apntex.exe C:\PROGRA~1\MI3AA1~1\wcescomm.exe C:\Program Files\DAEMON Tools\daemon.exe C:\PROGRA~1\MI3AA1~1\rapimgr.exe C:\WINDOWS\system32\wscntfy.exe C:\Programy\RDS\PLDlnk.exe C:\Programy\RDS\PLTBar.exe C:\Program Files\RALINK\Common\RaUI.exe C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe C:\Program Files\RMClient\PMCTray.exe C:\WINDOWS\System32\svchost.exe C:\Programy\RDS\CaplioGateL.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.ramzes.pl/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = proxy.pkp.com.pl:8080 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\NEOSTR~1\SEARCH~1.DLL (file missing) O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL O2 - BHO: CNisExtBho Class - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll O3 - Toolbar: Web assistant - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll O3 - Toolbar: (no name) - {37B85A29-692B-4205-9CAD-2626E4993404} - (no file) O4 - HKLM\..\Run: [SmoothView] C:\Program Files\TOSHIBA\Program narzędziowy TOSHIBA Zooming Utility\SmoothView.exe O4 - HKLM\..\Run: [SigmaTel StacMon] C:\Program Files\SigmaTel\SigmaTel AC97 Audio Drivers\stacmon.exe O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint2K\Apoint.exe O4 - HKLM\..\Run: [PadTouch] "C:\Program Files\TOSHIBA\PadTouch\PadExe.exe O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" O4 - HKLM\..\Run: [HP OfficeJet Series 700] "C:\Program Files\Hewlett-Packard\HP OfficeJet Series 700\bin\ktchnsnk.exe" -reg "Software\Hewlett-Packard\OfficeJet Series 700\Install" O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" O4 - HKLM\..\Run: [WiFi Monitor] WiFiMon.exe O4 - HKLM\..\Run: [JobHisInit] C:\Program Files\RMClient\JobHisInit.exe O4 - HKLM\..\Run: [MplSetUp] C:\Program Files\RMClient\MplSetUp.exe O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\PROGRA~1\MI3AA1~1\wcescomm.exe" O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033 O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Startup: Tworzenie wycinków ekranu i uruchamianie programu OneNote 2007.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE O4 - Global Startup: Auto Document Link.lnk = C:\Programy\RDS\PLDlnk.exe O4 - Global Startup: Ekran Stanu.lnk = ? O4 - Global Startup: Function Palette.lnk = C:\Programy\RDS\PLTBar.exe O4 - Global Startup: Przyspieszenie uruchomienia programu AutoCAD.lnk = C:\Program Files\Common Files\Autodesk Shared\acstart16.exe O4 - Global Startup: Ralink Wireless Utility.lnk = C:\Program Files\RALINK\Common\RaUI.exe O4 - Global Startup: Service Manager.lnk = C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe O4 - Global Startup: SmartDeviceMonitor for Client.lnk = C:\Program Files\RMClient\PMClient.exe O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O8 - Extra context menu item: E&ksportuj do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_05\bin\npjpi142_05.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_05\bin\npjpi142_05.dll O9 - Extra button: Wyślij do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra 'Tools' menuitem: Wyślij &do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll O9 - Extra 'Tools' menuitem: Utwórz łącze Ulubione dla urządzenia przenośnego... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL O12 - Plugin for .pdf: C:\Program Files\Internet Explorer\PLUGINS\nppdf32.dll O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=36467&clcid=0x409 O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1135526557326 O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{9A4ABADA-F42E-4DF6-8DA0-0EFA3D9AE5CB}: NameServer = 172.17.1.1 O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe O23 - Service: ConfigFree Service (CFSvcs) - TOSHIBA CORPORATION - C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe O23 - Service: Crypkey License - CrypKey (Canada) Ltd. - C:\WINDOWS\SYSTEM32\crypserv.exe O23 - Service: IDispChg Service (IDispChgService) - Unknown owner - C:\WINDOWS\system32\IDispChg.exe O23 - Service: KME Remote Server - Unknown owner - C:\PROGRA~1\PANASO~1\REMOTE~1\kmentsrv.exe O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe -- End of file - 8852 bytes

**Posty:** 18165 · przez **wojtas** 12 Lut 2008, 21:26

Wykonaj to co jest podane w tym temacie

Zastosuj SDFix . Po pobraniu uruchom go a rozpakuje się do C:\SDFix. Uruchom komputer w trybie awaryjnym (F8 przy stracie systemu). Będąc w awaryjnym uruchom plik RunThis.bat z folderu SDFixa. Zatwierdź czyszczenie przez Y. Poczekaj aż ukończy i komputer zresetuje

Potem wejdz do folderu C:\SDFix wrzuc zawartość pliku Report.txt + log z combofixa oraz z hijacka

**Posty:** 65 · przez **volfenstein** 12 Lut 2008, 23:37

SDFix

Kod: Zaznacz wszystko: SDFix: Version 1.141 Run by Administrator on 2008-02-12 at 21:13 Microsoft Windows XP [Wersja 5.1.2600] Running From: C:\SDFix Safe Mode: Checking Services: Restoring Windows Registry Values Restoring Windows Default Hosts File Rebooting... Normal Mode: Checking Files: Trojan Files Found: C:\VDM5.TMP - Deleted C:\VDM6.TMP - Deleted Removing Temp Files... ADS Check: Final Check: catchme 0.3.1344.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-02-12 21:28:37 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... scanning hidden services & system hive ... [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg] "s1"=dword:2df9c43f "s2"=dword:110480d0 "h0"=dword:00000001 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4] "p0"="C:\Program Files\DAEMON Tools\" "h0"=dword:00000000 "khjeh"=hex:2c,de,40,6b,9d,ee,00,ac,e1,1a,2f,98,09,76,ca,aa,02,44,a5,bc,f3,.. [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001] "a0"=hex:20,01,00,00,aa,57,cd,51,f3,bb,68,59,fe,93,3d,95,da,22,bd,12,8c,.. "khjeh"=hex:2f,7d,b7,c4,45,65,88,ef,07,20,e0,79,b2,45,75,91,d6,c5,79,91,ac,.. [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40] "khjeh"=hex:f3,77,52,66,a1,f3,9f,6f,cd,ea,8e,d4,ae,73,03,40,14,27,0c,3e,f4,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4] "p0"="C:\Program Files\DAEMON Tools\" "h0"=dword:00000000 "khjeh"=hex:2c,de,40,6b,9d,ee,00,ac,e1,1a,2f,98,09,76,ca,aa,02,44,a5,bc,f3,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001] "a0"=hex:20,01,00,00,aa,57,cd,51,f3,bb,68,59,fe,93,3d,95,da,22,bd,12,8c,.. "khjeh"=hex:2f,7d,b7,c4,45,65,88,ef,07,20,e0,79,b2,45,75,91,d6,c5,79,91,ac,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40] "khjeh"=hex:f3,77,52,66,a1,f3,9f,6f,cd,ea,8e,d4,ae,73,03,40,14,27,0c,3e,f4,.. scanning hidden registry entries ... [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\A\1\5\1c] "Order"=hex:08,00,00,00,02,00,00,00,b8,01,00,00,01,00,00,00,04,00,00,00,8c,.. [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Start Menu2\Programs\TOSHIBA\C\1:\1H\1\xfc] "Order"=hex:08,00,00,00,02,00,00,00,64,02,00,00,01,00,00,00,04,00,00,00,7e,.. scanning hidden files ... scan completed successfully hidden processes: 0 hidden services: 0 hidden files: 0 Remaining Services: ------------------ Authorized Application Key Export: [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "C:\\Program Files\\Gadu-Gadu\\gg.exe"="C:\\Program Files\\Gadu-Gadu\\gg.exe:*:Enabled:Gadu-Gadu - program glowny" "C:\\totalcmd\\TOTALCMD.EXE"="C:\\totalcmd\\TOTALCMD.EXE:*:Enabled:Total Commander 32 bit international version, file manager replacement for Windows" "C:\\Program Files\\Wolfenstein - Enemy Territory\\ET.exe"="C:\\Program Files\\Wolfenstein - Enemy Territory\\ET.exe:*:Enabled:ET" "C:\\WINDOWS\\system32\\dplaysvr.exe"="C:\\WINDOWS\\system32\\dplaysvr.exe:*:Enabled:Microsoft DirectPlay Helper" "\\\\WOJTEK\\WARLORDS II\\Battlecry II.exe"="\\\\WOJTEK\\WARLORDS II\\Battlecry II.exe:*:Enabled:Battlecry II.exe" "\\\\WOJTEK\\Wolfenstein - Enemy Territory\\ET.exe"="\\\\WOJTEK\\Wolfenstein - Enemy Territory\\ET.exe:*:Enabled:ET.exe" "\\\\WOJTEK\\Counter-Strike\\cstrike.exe"="\\\\WOJTEK\\Counter-Strike\\cstrike.exe:*:Enabled:cstrike.exe" "\\\\WOJTEK\\MotoGP2\\motogp2.exe"="\\\\WOJTEK\\MotoGP2\\motogp2.exe:*:Enabled:motogp2.exe" "C:\\Program Files\\MotoGP2\\motogp2.exe"="C:\\Program Files\\MotoGP2\\motogp2.exe:*:Enabled:motogp2" "C:\\Program Files\\LimeWire\\LimeWire.exe"="C:\\Program Files\\LimeWire\\LimeWire.exe:*:Enabled:LimeWire" "C:\\Program Files\\LimeShop\\LimeShop.exe"="C:\\Program Files\\LimeShop\\LimeShop.exe:*:Enabled:LimeShop" "C:\\WINDOWS\\system32\\javaw.exe"="C:\\WINDOWS\\system32\\javaw.exe:*:Enabled:javaw" "C:\\Program Files\\Java\\j2re1.4.2_05\\bin\\javaw.exe"="C:\\Program Files\\Java\\j2re1.4.2_05\\bin\\javaw.exe:*:Enabled:javaw" "C:\\WINDOWS\\system32\\LEXPPS.EXE"="C:\\WINDOWS\\system32\\LEXPPS.EXE:*:Disabled:LEXPPS.EXE" "C:\\Program Files\\BitComet\\BitComet.exe"="C:\\Program Files\\BitComet\\BitComet.exe:*:Enabled:BitComet - a BitTorrent Client" "C:\\Program Files\\Firefly Studios\\Stronghold Crusader\\Stronghold Crusader.exe"="C:\\Program Files\\Firefly Studios\\Stronghold Crusader\\Stronghold Crusader.exe:*:Enabled:Stronghold Crusader" "C:\\StubInstaller.exe"="C:\\StubInstaller.exe:*:Enabled:LimeWire swarmed installer" "\\\\KOWALSKI-FF3021\\Half-LIfe_PLUS_CS1.5_PLus\\Half-Life\\Half-Life\\hl.exe"="\\\\KOWALSKI-FF3021\\Half-LIfe_PLUS_CS1.5_PLus\\Half-Life\\Half-Life\\hl.exe:*:Enabled:hl.exe" "C:\\KSKRAK01\\pomiar_s.exe"="C:\\KSKRAK01\\pomiar_s.exe:*:Enabled:pomiar_s" "C:\\Program Files\\Microsoft Office\\OFFICE11\\WINWORD.EXE"="C:\\Program Files\\Microsoft Office\\OFFICE11\\WINWORD.EXE:*:Enabled:Microsoft Office Word" "C:\\Program Files\\Skype\\Phone\\Skype.exe"="C:\\Program Files\\Skype\\Phone\\Skype.exe:*:Enabled:Skype" "C:\\Program Files\\Common Files\\Microsoft Shared\\MODI\\11.0\\MSPSCAN.EXE"="C:\\Program Files\\Common Files\\Microsoft Shared\\MODI\\11.0\\MSPSCAN.EXE:*:Enabled:Microsoft Office Document Scanning App" "C:\\Program Files\\Microsoft ActiveSync\\rapimgr.exe"="C:\\Program Files\\Microsoft ActiveSync\\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager" "C:\\Program Files\\Microsoft ActiveSync\\wcescomm.exe"="C:\\Program Files\\Microsoft ActiveSync\\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager" "C:\\Program Files\\Microsoft ActiveSync\\WCESMgr.exe"="C:\\Program Files\\Microsoft ActiveSync\\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application" "C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"="C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook" "C:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"="C:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE:*:Enabled:Microsoft Office Groove" "C:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"="C:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE:*:Enabled:Microsoft Office OneNote" "C:\\Programy\\RDS\\PLTBar.exe"="C:\\Programy\\RDS\\PLTBar.exe:*:Enabled:Ridoc Document System Ridoc Desk ToolLauncher Module" "C:\\Programy\\RDS\\PLDlnk.exe"="C:\\Programy\\RDS\\PLDlnk.exe:*:Enabled:Ridoc Document System Auto Document Link Software." "C:\\Programy\\RDS\\RView.exe"="C:\\Programy\\RDS\\RView.exe:*:Enabled:Ridoc Document System Document Viewer" "C:\\Program Files\\uTorrent\\uTorrent.exe"="C:\\Program Files\\uTorrent\\uTorrent.exe:*:Enabled:uTorrent" "C:\\Program Files\\NAPI-PROJEKT\\napisy.exe"="C:\\Program Files\\NAPI-PROJEKT\\napisy.exe:*:Enabled:www.napiprojekt.pl" [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list] "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "C:\\Program Files\\Microsoft ActiveSync\\rapimgr.exe"="C:\\Program Files\\Microsoft ActiveSync\\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager" "C:\\Program Files\\Microsoft ActiveSync\\wcescomm.exe"="C:\\Program Files\\Microsoft ActiveSync\\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager" "C:\\Program Files\\Microsoft ActiveSync\\WCESMgr.exe"="C:\\Program Files\\Microsoft ActiveSync\\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application" Remaining Files: --------------- File Backups: - C:\SDFix\backups\backups.zip Files with Hidden Attributes: Mon 12 Feb 2007 70,144 ...H. --- "C:\Documents and Settings\1\Pulpit\~WRL0003.tmp" Tue 13 Feb 2007 72,192 ...H. --- "C:\Documents and Settings\1\Pulpit\~WRL0146.tmp" Sat 20 Oct 2007 4,348 ..SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak" Wed 22 Dec 2004 76,568 ..SHR --- "C:\Program Files\Autodesk\Autodesk DWF Viewer\Setup.exe" Thu 13 Jan 2005 11,360 A.SHR --- "C:\Program Files\Autodesk\Autodesk DWF Viewer\_Setupx.dll" Wed 4 Oct 2006 3,072,000 A..H. --- "C:\Documents and Settings\1\Dane aplikacji\U3\temp\Launchpad Removal.exe" Sat 20 Oct 2007 4,348 ...H. --- "C:\Documents and Settings\1\Moje dokumenty\Moja muzyka\Kopia zapasowa licencji\drmv1key.bak" Mon 22 Oct 2007 20 A..H. --- "C:\Documents and Settings\1\Moje dokumenty\Moja muzyka\Kopia zapasowa licencji\drmv1lic.bak" Sat 20 Oct 2007 400 ...H. --- "C:\Documents and Settings\1\Moje dokumenty\Moja muzyka\Kopia zapasowa licencji\drmv2key.bak" Mon 22 Oct 2007 12,288 A..H. --- "C:\Documents and Settings\1\Moje dokumenty\Moja muzyka\Kopia zapasowa licencji\drmv2lic.bak" Finished!

ComboFix

Kod: Zaznacz wszystko: ComboFix 08-02-13.1 - 1 2008-02-12 21:59:01.1 - NTFSx86 Running from: C:\Documents and Settings\1\Pulpit\czystki\ComboFix.exe [color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color] . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\Program Files\myglobalsearch . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\nm ((((((((((((((((((((((((( Files Created from 2008-01-13 to 2008-02-13 ))))))))))))))))))))))))))))))) . 2008-02-12 21:10 . 2008-02-12 21:10 <DIR> d-------- C:\WINDOWS\ERUNT 2008-02-12 21:09 . 2004-09-17 08:39 <DIR> d-------- C:\Documents and Settings\Administrator.SERVIS5\WINDOWS 2008-02-12 21:09 . 2004-09-16 16:29 <DIR> d--h----- C:\Documents and Settings\Administrator.SERVIS5\Ustawienia lokalne 2008-02-12 21:09 . 2004-09-20 13:07 <DIR> dr------- C:\Documents and Settings\Administrator.SERVIS5\Ulubione 2008-02-12 21:09 . 2004-09-16 14:35 <DIR> d--h----- C:\Documents and Settings\Administrator.SERVIS5\Szablony 2008-02-12 21:09 . 2008-02-12 21:12 <DIR> d-------- C:\Documents and Settings\Administrator.SERVIS5\Pulpit 2008-02-12 21:09 . 2004-09-20 13:07 <DIR> dr------- C:\Documents and Settings\Administrator.SERVIS5\Moje dokumenty 2008-02-12 21:09 . 2004-09-16 16:29 <DIR> dr------- C:\Documents and Settings\Administrator.SERVIS5\Menu Start 2008-02-12 21:09 . 2004-09-17 08:57 <DIR> d-------- C:\Documents and Settings\Administrator.SERVIS5\Dane aplikacji\toshiba 2008-02-12 21:09 . 2004-09-17 10:07 <DIR> d-------- C:\Documents and Settings\Administrator.SERVIS5\Dane aplikacji\Symantec 2008-02-12 21:09 . 2004-09-20 13:07 <DIR> dr-h----- C:\Documents and Settings\Administrator.SERVIS5\Dane aplikacji 2008-02-12 21:07 . 2008-02-12 21:40 <DIR> d-------- C:\SDFix 2008-02-12 20:02 . 2004-09-17 08:39 <DIR> d-------- C:\Documents and Settings\Administrator\WINDOWS 2008-02-12 20:02 . 2004-09-16 16:29 <DIR> d--h----- C:\Documents and Settings\Administrator\Ustawienia lokalne 2008-02-12 20:02 . 2004-09-20 13:07 <DIR> dr------- C:\Documents and Settings\Administrator\Ulubione 2008-02-12 20:02 . 2004-09-16 14:35 <DIR> d--h----- C:\Documents and Settings\Administrator\Szablony 2008-02-12 20:02 . 2004-09-20 13:20 <DIR> d-------- C:\Documents and Settings\Administrator\Pulpit 2008-02-12 20:02 . 2004-09-20 13:07 <DIR> dr------- C:\Documents and Settings\Administrator\Moje dokumenty 2008-02-12 20:02 . 2004-09-16 16:29 <DIR> dr------- C:\Documents and Settings\Administrator\Menu Start 2008-02-12 20:02 . 2004-09-20 13:07 <DIR> dr-h----- C:\Documents and Settings\Administrator\Dane aplikacji 2008-02-12 19:55 . 2008-02-12 19:55 <DIR> d-------- C:\Program Files\Trend Micro 2008-02-12 13:55 . 2008-02-12 13:55 <DIR> d-------- C:\RDCab 2008-02-12 13:14 . 2008-02-12 13:14 <DIR> d-------- C:\WINDOWS\NAVITEMP 2008-02-12 13:14 . 2008-02-12 20:34 <DIR> d-------- C:\Program Files\RMClient 2008-02-12 13:12 . 2003-11-20 16:56 86,016 --a------ C:\WINDOWS\system32\IFXAPI32.DLL 2008-02-08 13:09 . 2001-10-26 17:29 99,328 --a------ C:\WINDOWS\system32\srusd.dll 2008-02-08 13:09 . 2001-10-26 17:29 99,328 --a--c--- C:\WINDOWS\system32\dllcache\srusd.dll 2008-02-08 13:09 . 2001-10-26 17:29 71,680 --a------ C:\WINDOWS\system32\fnfilter.dll 2008-02-08 13:09 . 2001-10-26 17:29 71,680 --a--c--- C:\WINDOWS\system32\dllcache\fnfilter.dll 2008-02-08 13:09 . 2001-10-26 17:05 6,912 --a------ C:\WINDOWS\system32\drivers\serscan.sys 2008-02-08 13:09 . 2001-10-26 17:05 6,912 --a--c--- C:\WINDOWS\system32\dllcache\serscan.sys 2008-02-08 12:36 . 2008-02-08 12:37 <DIR> d-------- C:\Program Files\Common Files\RDPrint 2008-02-03 20:16 . 2002-06-03 01:42 8,646,718 --a------ C:\WINDOWS\system32\craxddrt.dll 2008-01-15 18:21 . 2008-01-15 18:21 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\WorkshopData 2008-01-15 18:21 . 1999-06-18 22:49 165,888 --a------ C:\WINDOWS\Ckconfig.exe 2008-01-15 18:21 . 2006-02-16 14:29 102,592 --a------ C:\WINDOWS\system32\corojdk11.dll 2008-01-15 18:21 . 2006-09-22 00:33 69,632 --a------ C:\WINDOWS\system32\Crypserv.exe 2008-01-15 18:21 . 2006-01-10 03:47 31,846 --a------ C:\WINDOWS\system32\Ckldrv.sys 2008-01-15 18:21 . 1996-05-03 18:21 27,648 -ra------ C:\WINDOWS\Setup_ck.exe 2008-01-15 18:21 . 1996-05-03 16:36 18,432 --a------ C:\WINDOWS\Setup_ck.dll 2008-01-15 18:21 . 1995-07-04 19:33 11,776 --a------ C:\WINDOWS\Ckrfresh.exe 2008-01-15 18:21 . 2008-01-15 18:21 83 --a------ C:\WINDOWS\Crypkey.ini 2008-01-15 18:10 . 2008-01-15 18:10 <DIR> d--h----- C:\Program Files\Zero G Registry 2008-01-15 18:09 . 2008-01-15 18:09 <DIR> d--h----- C:\Documents and Settings\1\InstallAnywhere . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-02-12 17:33 --------- d-----w C:\Program Files\Spybot - Search & Destroy 2008-02-12 13:33 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-02-08 13:42 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Microsoft Help 2008-01-13 21:28 --------- d-----w C:\Program Files\Common Files\WA-Pro 2008-01-13 21:28 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\WA-PRO 2008-01-08 06:41 --------- d-----w C:\Documents and Settings\1\Dane aplikacji\U3 2008-01-03 23:23 --------- d-----w C:\Documents and Settings\1\Dane aplikacji\InstallShield 2007-12-29 14:39 --------- d-----w C:\Program Files\Samsung 2007-12-26 15:16 --------- d-----w C:\Program Files\Common Files\BricsCad 2006-05-23 08:02 284 ----a-w C:\Documents and Settings\1\Dane aplikacji\ViewerApp.dat 2005-05-16 09:10 53,072 ----a-w C:\Documents and Settings\1\Dane aplikacji\GDIPFONTCACHEV1.DAT . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 11:00 15360] "Gadu-Gadu"="C:\Program Files\Gadu-Gadu\gg.exe" [2006-02-17 14:03 2396160] "H/PC Connection Agent"="C:\PROGRA~1\MI3AA1~1\wcescomm.exe" [2005-11-15 20:02 1204224] "DAEMON Tools"="C:\Program Files\DAEMON Tools\daemon.exe" [2007-09-18 15:16 171464] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SmoothView"="C:\Program Files\TOSHIBA\Program narzędziowy TOSHIBA Zooming Utility\SmoothView.exe" [ ] "SigmaTel StacMon"="C:\Program Files\SigmaTel\SigmaTel AC97 Audio Drivers\stacmon.exe" [2003-08-03 15:01 86073] "Apoint"="C:\Program Files\Apoint2K\Apoint.exe" [2003-10-30 14:46 192512] "PadTouch"="C:\Program Files\TOSHIBA\PadTouch\PadExe.exe" [2004-02-12 10:47 1019904] "ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2005-03-10 13:40 71256] "HP OfficeJet Series 700"="C:\Program Files\Hewlett-Packard\HP OfficeJet Series 700\bin\ktchnsnk.exe" [ ] "GrooveMonitor"="C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-26 23:47 31016] "WiFi Monitor"="WiFiMon.exe" [2006-02-14 11:37 57344 C:\WINDOWS\system32\WiFiMon.exe] "JobHisInit"="C:\Program Files\RMClient\JobHisInit.exe" [2004-03-17 23:47 151552] "MplSetUp"="C:\Program Files\RMClient\MplSetUp.exe" [2000-11-03 11:09 40960] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 11:00 15360] C:\Documents and Settings\1\Menu Start\Programy\Autostart\ Tworzenie wycink˘w ekranu i uruchamianie programu OneNote 2007.lnk - C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE [2006-10-26 19:24:54 98632] C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\ Auto Document Link.lnk - C:\Programy\RDS\PLDlnk.exe [2008-02-08 12:36:48 434176] Ekran Stanu.lnk - C:\Program Files\Panasonic\Panasonic KX-P7105 i KX-P7110\Status display\stmndsp.exe [2006-01-04 13:09:51 122880] Function Palette.lnk - C:\Programy\RDS\PLTBar.exe [2008-02-08 12:36:48 131072] Przyspieszenie uruchomienia programu AutoCAD.lnk - C:\Program Files\Common Files\Autodesk Shared\acstart16.exe [2005-03-05 14:18:22 10872] Ralink Wireless Utility.lnk - C:\Program Files\RALINK\Common\RaUI.exe [2007-11-30 16:37:22 614400] Service Manager.lnk - C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe [2000-08-06 01:03:20 69632] SmartDeviceMonitor for Client.lnk - C:\Program Files\RMClient\PMClient.exe [2008-02-12 13:14:31 200704] [HKLM\~\startupfolder\C:^Documents and Settings^1^Menu Start^Programy^Autostart^Szybkie uruchamianie programu Microsoft Office OneNote 2003.lnk] path=C:\Documents and Settings\1\Menu Start\Programy\Autostart\Szybkie uruchamianie programu Microsoft Office OneNote 2003.lnk backup=C:\WINDOWS\pss\Szybkie uruchamianie programu Microsoft Office OneNote 2003.lnkStartup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^DSLMON.lnk] path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\DSLMON.lnk backup=C:\WINDOWS\pss\DSLMON.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Microsoft Office.lnk] path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Microsoft Office.lnk backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Picture Package Menu.lnk] path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Picture Package Menu.lnk backup=C:\WINDOWS\pss\Picture Package Menu.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Picture Package VCD Maker.lnk] path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Picture Package VCD Maker.lnk backup=C:\WINDOWS\pss\Picture Package VCD Maker.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\000StTHK] --a------ 2001-06-23 19:28 24576 C:\WINDOWS\system32\000StTHK.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\00THotkey] --a------ 2004-08-11 12:14 253952 C:\WINDOWS\system32\00THotkey.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AGRSMMSG] --a------ 2004-02-20 13:00 88363 C:\WINDOWS\agrsmmsg.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BearShare] C:\Program Files\BearShare\BearShare.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE] --a------ 2004-08-04 11:00 15360 C:\WINDOWS\system32\ctfmon.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DeviceDiscovery] --a------ 2002-12-02 19:56 40960 C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Gadu-Gadu] --a------ 2006-02-17 14:03 2396160 C:\Program Files\Gadu-Gadu\gg.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotKeysCmds] --a------ 2004-01-26 17:03 118784 C:\WINDOWS\system32\hkcmd.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update] -ra------ 2002-12-17 11:40 49152 C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HPDJ Taskbar Utility] --a------ 2003-03-11 11:08 172032 C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb08.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IgfxTray] --a------ 2004-01-26 17:03 155648 C:\WINDOWS\system32\igfxtray.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Lexmark X5100 Series] C:\Program Files\Lexmark X5100 Series\lxbabmgr.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Lexmark X6100 Series] C:\Program Files\Lexmark X6100 Series\lxbfbmgr.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LimeShop] javaw -cp C:\Program Files\LimeShop\System\Code Main lp: C:\Program Files\LimeShop [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Mouse Suite 98 Daemon] --a------ 2001-08-23 11:23 45056 C:\WINDOWS\system32\ico.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS] C:\Program Files\Messenger\msmsgs.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NDSTray.exe] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroCheck] --a------ 2001-07-09 11:50 155648 C:\WINDOWS\system32\\NeroCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\New.net Startup] C:\PROGRA~1\NEWDOT~1\NEWDOT~1.DLL [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Nokia Tray Application] C:\Program Files\Common Files\Nokia\NCLTools\NclTray.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PcSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\System32] --------- 2005-06-06 23:18 58883 C:\WINDOWS\user32.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TFncKy] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TFNF5] -ra------ 2003-12-02 12:15 73728 C:\WINDOWS\system32\TFNF5.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TPSMain] --a------ 2004-06-28 14:30 266240 C:\WINDOWS\system32\TPSMain.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\URLLSTCK.exe] C:\Program Files\Norton Internet Security\UrlLstCk.exe R2 CCNMMDRV;CCNMMDRV;C:\WINDOWS\system32\drivers\CCNMMDRV.sys [1995-09-11 12:42] R2 port_nt;port_nt;c:\windows\system32\drivers\port_nt.sys [2002-01-01 05:02] R3 VNICPKT5;VNICPKT5 Protocol Driver;C:\WINDOWS\system32\VNICPKT5.SYS [2006-10-18 14:17] S2 Kmm4xNT;Kmm4xNT;C:\WINDOWS\system32\drivers\Kmm4xNT.sys [2000-11-25 09:38] S3 ADM8511;Konwerter z USB na Fast Ethernet ADMtek ADM8511/AN986;C:\WINDOWS\system32\DRIVERS\ADM8511.SYS [2001-08-17 19:11] S3 DUBE100;D-Link DUB-E100 USB 2.0 to Fast Ethernet Adapter;C:\WINDOWS\system32\DRIVERS\DUBE100.sys [2004-01-08 07:16] S3 jswmidin;jswmidin;C:\DOCUME~1\1\USTAWI~1\Temp\jswmidin.sys [] S3 pelmouse;Cherry Power WheelMouse optical Driver;C:\WINDOWS\system32\DRIVERS\pelmouse.sys [2001-12-13 14:53] S3 pelusblf;Cherry Power WheelMouse optical Driver USB;C:\WINDOWS\system32\DRIVERS\pelusblf.sys [2002-02-06 14:31] S3 SF-620;Kingsun SF-620 USB Infrared Adapter;C:\WINDOWS\system32\DRIVERS\SF-620.sys [2004-08-12 03:18] S3 VNUWL5B;MWTTECH 802.11 Wireless LAN Adapter Driver Service;C:\WINDOWS\system32\DRIVERS\VNUWL5B.SYS [2006-09-19 13:34] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\G] \Shell\AutoRun\command - G:\LaunchU3.exe -a [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{3dca63a0-bdb4-11dc-be8b-000e7b34e92c}] \Shell\AutoRun\command - G:\LaunchU3.exe -a . Contents of the 'Scheduled Tasks' folder "2008-02-13 21:27:00 C:\WINDOWS\Tasks\Symantec NetDetect.job" - C:\Program Files\Symantec\LiveUpdate\NDetect.exe "2008-02-12 20:52:02 C:\WINDOWS\Tasks\WebReg 20051208215213.job" - C:\Program Files\Hewlett-Packard\webreg\bin\hpqwrg.exeC/TaskName 20051208215213 /N . ************************************************************************** catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-02-13 22:14:58 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . ------------------------ Other Running Processes ------------------------ . C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe C:\WINDOWS\system32\crypserv.exe C:\Program Files\TOSHIBA\Program narzC:\WINDOWS\system32\IDispChg.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\Program Files\Microsoft SQL Server\MSSQL\Binn\sqlservr.exe C:\PROGRA~1\MI3AA1~1\rapimgr.exe C:\Program Files\Apoint2K\Apntex.exe C:\Program Files\RMClient\PMCTray.exe C:\Programy\RDS\CaplioGateL.exe C:\WINDOWS\system32\wscntfy.exe . ************************************************************************** . Completion time: 2008-02-13 22:28:51 - machine was rebooted ComboFix-quarantined-files.txt 2008-02-13 21:28:38 . 2007-10-23 01:07:43 --- E O F ---

HiJack

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 22:37:21, on 2008-02-13 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16544) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\Program Files\TOSHIBA\Program narzędziowy TOSHIBA Zooming Utility\SmoothView.exe C:\Program Files\SigmaTel\SigmaTel AC97 Audio Drivers\stacmon.exe C:\Program Files\Apoint2K\Apoint.exe C:\Program Files\TOSHIBA\PadTouch\PadExe.exe C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe C:\WINDOWS\system32\WiFiMon.exe C:\WINDOWS\system32\ctfmon.exe C:\PROGRA~1\MI3AA1~1\wcescomm.exe C:\Program Files\DAEMON Tools\daemon.exe C:\PROGRA~1\MI3AA1~1\rapimgr.exe C:\Programy\RDS\PLDlnk.exe C:\Program Files\Apoint2K\Apntex.exe C:\Programy\RDS\PLTBar.exe C:\Program Files\RALINK\Common\RaUI.exe C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe C:\Program Files\RMClient\PMCTray.exe C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe C:\WINDOWS\system32\crypserv.exe C:\WINDOWS\system32\IDispChg.exe C:\PROGRA~1\PANASO~1\REMOTE~1\kmentsrv.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\Program Files\Microsoft SQL Server\MSSQL\Binn\sqlservr.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\wscntfy.exe C:\Programy\RDS\CaplioGateL.exe C:\WINDOWS\System32\svchost.exe C:\PROGRA~1\MOZILL~1\firefox.exe C:\WINDOWS\system32\wuauclt.exe C:\WINDOWS\system32\wuauclt.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.ramzes.pl/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = proxy.pkp.com.pl:8080 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\NEOSTR~1\SEARCH~1.DLL (file missing) O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL O2 - BHO: CNisExtBho Class - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll O3 - Toolbar: Web assistant - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll O3 - Toolbar: (no name) - {37B85A29-692B-4205-9CAD-2626E4993404} - (no file) O4 - HKLM\..\Run: [SmoothView] C:\Program Files\TOSHIBA\Program narzędziowy TOSHIBA Zooming Utility\SmoothView.exe O4 - HKLM\..\Run: [SigmaTel StacMon] C:\Program Files\SigmaTel\SigmaTel AC97 Audio Drivers\stacmon.exe O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint2K\Apoint.exe O4 - HKLM\..\Run: [PadTouch] "C:\Program Files\TOSHIBA\PadTouch\PadExe.exe O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" O4 - HKLM\..\Run: [HP OfficeJet Series 700] "C:\Program Files\Hewlett-Packard\HP OfficeJet Series 700\bin\ktchnsnk.exe" -reg "Software\Hewlett-Packard\OfficeJet Series 700\Install" O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" O4 - HKLM\..\Run: [WiFi Monitor] WiFiMon.exe O4 - HKLM\..\Run: [JobHisInit] C:\Program Files\RMClient\JobHisInit.exe O4 - HKLM\..\Run: [MplSetUp] C:\Program Files\RMClient\MplSetUp.exe O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\PROGRA~1\MI3AA1~1\wcescomm.exe" O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033 O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Startup: Tworzenie wycinków ekranu i uruchamianie programu OneNote 2007.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE O4 - Global Startup: Auto Document Link.lnk = C:\Programy\RDS\PLDlnk.exe O4 - Global Startup: Ekran Stanu.lnk = ? O4 - Global Startup: Function Palette.lnk = C:\Programy\RDS\PLTBar.exe O4 - Global Startup: Przyspieszenie uruchomienia programu AutoCAD.lnk = C:\Program Files\Common Files\Autodesk Shared\acstart16.exe O4 - Global Startup: Ralink Wireless Utility.lnk = C:\Program Files\RALINK\Common\RaUI.exe O4 - Global Startup: Service Manager.lnk = C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe O4 - Global Startup: SmartDeviceMonitor for Client.lnk = C:\Program Files\RMClient\PMClient.exe O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O8 - Extra context menu item: E&ksportuj do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_05\bin\npjpi142_05.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_05\bin\npjpi142_05.dll O9 - Extra button: Wyślij do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra 'Tools' menuitem: Wyślij &do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll O9 - Extra 'Tools' menuitem: Utwórz łącze Ulubione dla urządzenia przenośnego... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL O12 - Plugin for .pdf: C:\Program Files\Internet Explorer\PLUGINS\nppdf32.dll O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=36467&clcid=0x409 O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1135526557326 O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{9A4ABADA-F42E-4DF6-8DA0-0EFA3D9AE5CB}: NameServer = 172.17.1.1 O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe O23 - Service: ConfigFree Service (CFSvcs) - TOSHIBA CORPORATION - C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe O23 - Service: Crypkey License - CrypKey (Canada) Ltd. - C:\WINDOWS\SYSTEM32\crypserv.exe O23 - Service: IDispChg Service (IDispChgService) - Unknown owner - C:\WINDOWS\system32\IDispChg.exe O23 - Service: KME Remote Server - Unknown owner - C:\PROGRA~1\PANASO~1\REMOTE~1\kmentsrv.exe O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe -- End of file - 8879 bytes

**Posty:** 18165 · przez **wojtas** 13 Lut 2008, 17:34

sciagnij ATF_Cleaner
zaznacz
Windows Temp
Temporary internet files
i wcisnij EMPTY SELECTED

skasuj:

O3 - Toolbar: (no name) - {37B85A29-692B-4205-9CAD-2626E4993404} - (no file)

wklej do notatnika

Windows Registry Editor Version 5.00

[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\System32]

w notatniku u góry>>>plik zapisz jako>>>Zmien rozszerzenie z TXT na Wszystkie pliki *.* >>> Zapisz pod nazwą FIX.REG

Klikasz dwa razy na powstały plik fix i dodajesz go do rejestru....

powolna praca komputera.

Powolna praca komputera.

Kto jest na forum