na pulpicie zaczęło mi zmieniać ikony

**Posty:** 4 · przez **Ziazit** 08 Kwi 2008, 16:29

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 16:38:05, on 2008-04-08
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Firebird\Firebird_1_5\bin\fbguard.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\RealVNC\VNC4\WinVNC4.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Firebird\Firebird_1_5\bin\fbserver.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Gadu-Gadu\gg.exe
C:\PROGRA~1\MICROS~4\rapimgr.exe
C:\Program Files\Microsoft ActiveSync\wcescomm.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Winamp\winamp.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.pl/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: flashget urlcatch - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\Program Files\FlashGet\jccatch.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: FlashGet GetFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\Program Files\FlashGet\getflash.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Easy-PrintToolBox] C:\Program Files\Canon\Easy-PrintToolBox\BJPSMAIN.EXE /logon
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKLM\..\Run: [Flashget] C:\Program Files\FlashGet\flashget.exe /min
O4 - HKLM\..\Run: [PWRISOVM.EXE] C:\Program Files\PowerISO\PWRISOVM.EXE
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\PROGRA~1\MICROS~4\wcescomm.exe"
O4 - HKCU\..\Run: [Gadu-Gadu] "C:\PROGRA~1\GADU-G~1\gg.exe" /tray
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User '?')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User '?')
O4 - HKUS\S-1-5-21-1085031214-1303643608-839522115-1003\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe (User '?')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User '?')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: &Download All with FlashGet - C:\Program Files\FlashGet\jc_all.htm
O8 - Extra context menu item: &Download with FlashGet - C:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Easy-WebPrint Add To Print List - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint High Speed Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Preview - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
O8 - Extra context menu item: Easy-WebPrint Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe
O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O18 - Protocol: wpmsg - {2E0AC5A0-3597-11D6-B3ED-0001021DC1C3} - C:\Program Files\Spik\url_wpmsg.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Firebird Guardian - DefaultInstance (FirebirdGuardianDefaultInstance) - The Firebird Project - C:\Program Files\Firebird\Firebird_1_5\bin\fbguard.exe
O23 - Service: Firebird Server - DefaultInstance (FirebirdServerDefaultInstance) - The Firebird Project - C:\Program Files\Firebird\Firebird_1_5\bin\fbserver.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
O23 - Service: VNC Server Version 4 (WinVNC4) - RealVNC Ltd. - C:\Program Files\RealVNC\VNC4\WinVNC4.exe

--
End of file - 6959 bytes

Z góry przepraszam jeśli źle wkleiłem logo bo robiłem to 1 raz

Problem jest tego typu ze na pulpicie zaczęło mi zmieniać ikony np.
gre zamieniło mi na Mozillę
skrót do exela na jetaudio
pokaz pulpit na odtwarzacz audio
jak zarazie to tylko zamieniło ikony ale otwiera to co powinno otwierać

z góry dziękuję za jakąkolwiek pomoc

**Posty:** 8001 · przez **Okocza** 08 Kwi 2008, 16:33

http://www.forum.programosy.pl/dla-userow-wstawiajacych-logi-na-forum-vt93842.html

[ Dodano: Dzisiaj o 17:13 ]

Ziazit napisał(a):O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u

i daj loga z combofixa

**Posty:** 4 · przez **Ziazit** 09 Kwi 2008, 10:19

ComboFix 08-04-08.7 - dawid 2008-04-09 10:07:39.1 - NTFSx86

Running from: E:\POBIERANIE Z FIREFOX\ComboFix.exe

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\system32\AutoRun.inf

.
((((((((((((((((((((((((( Files Created from 2008-03-09 to 2008-04-09 )))))))))))))))))))))))))))))))
.

2008-04-08 16:18 . 2008-04-08 16:18 <DIR> d-------- C:\Program Files\Trend Micro
2008-04-08 14:42 . 2008-04-08 14:42 <DIR> d-------- C:\Documents and Settings\dawid\Dane aplikacji\Media Player Classic
2008-04-07 09:39 . 2008-03-29 19:31 75,856 --a------ C:\WINDOWS\system32\drivers\aswSP.sys
2008-04-07 09:39 . 2008-03-29 19:35 20,560 --a------ C:\WINDOWS\system32\drivers\aswFsBlk.sys
2008-04-04 14:23 . 2008-04-04 14:23 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\WEBREG
2008-04-04 14:01 . 2008-04-04 14:01 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Hewlett-Packard
2008-04-04 14:00 . 2007-03-30 17:11 267,864 -ra------ C:\WINDOWS\system32\SETA4.tmp
2008-04-04 14:00 . 2007-03-28 14:01 117,760 --a------ C:\WINDOWS\system32\hpzll5ha.dll
2008-04-04 09:01 . 2008-04-04 09:01 <DIR> d-------- C:\Program Files\PowerISO
2008-04-03 21:05 . 2008-04-03 21:05 <DIR> d-------- C:\Program Files\Alcohol Soft
2008-04-03 21:05 . 2005-07-08 14:44 159,616 --a------ C:\WINDOWS\system32\drivers\vax347b.sys
2008-04-03 21:05 . 2004-04-30 09:33 5,248 --a------ C:\WINDOWS\system32\drivers\vax347s.sys
2008-04-03 21:04 . 2008-04-03 21:04 704 --a------ C:\WINDOWS\unins000.dat
2008-04-03 09:57 . 2008-04-03 09:57 <DIR> d-------- C:\Program Files\Common Files\DirectX
2008-04-03 09:57 . 2008-04-03 09:57 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Trymedia
2008-04-03 09:38 . 2008-04-03 09:38 <DIR> d-------- C:\Program Files\Trymedia
2008-04-01 09:11 . 2004-08-03 22:58 15,104 --a------ C:\WINDOWS\system32\drivers\usbscan.sys
2008-04-01 09:11 . 2004-08-03 22:58 15,104 --a--c--- C:\WINDOWS\system32\dllcache\usbscan.sys
2008-04-01 09:02 . 2008-04-01 09:02 29 --a------ C:\WINDOWS\DEBUGSM.INI
2008-04-01 09:02 . 2008-04-01 09:02 0 --a------ C:\WINDOWS\PRESTOPM.INI
2008-04-01 09:01 . 2008-04-01 09:01 <DIR> d-------- C:\My PageManager
2008-04-01 09:00 . 2008-04-01 09:00 <DIR> d-------- C:\WINDOWS\system32\COLOR
2008-04-01 09:00 . 2008-04-01 09:00 <DIR> d-------- C:\Program Files\ScannerU
2008-04-01 09:00 . 2008-04-01 09:00 <DIR> d-------- C:\Program Files\NewSoft
2008-04-01 09:00 . 1996-11-06 12:07 302,080 --a------ C:\WINDOWS\unin0415.exe
2008-04-01 09:00 . 1996-11-05 16:13 299,008 --a------ C:\WINDOWS\uninst.exe
2008-04-01 09:00 . 1997-10-13 13:19 11,776 --a------ C:\WINDOWS\system32\pmsbfn32.dll
2008-04-01 09:00 . 1999-05-05 16:22 8,944 --a------ C:\WINDOWS\system32\USBSCAN.SYS
2008-04-01 09:00 . 2008-04-01 09:01 410 --a------ C:\WINDOWS\umxaddin.ini
2008-04-01 09:00 . 2008-04-01 09:00 243 --a------ C:\WINDOWS\SCNDRVU.INI
2008-03-31 15:27 . 2008-03-31 15:27 <DIR> d-------- C:\Documents and Settings\dawid\Dane aplikacji\Xerox
2008-03-31 15:27 . 2004-08-04 00:44 116,736 --a------ C:\WINDOWS\system32\xrxwiadr.dll
2008-03-31 15:27 . 2004-08-04 00:44 116,736 --a--c--- C:\WINDOWS\system32\dllcache\xrxwiadr.dll
2008-03-31 15:27 . 2001-10-26 17:30 27,648 --a--c--- C:\WINDOWS\system32\dllcache\xrxftplt.exe
2008-03-31 15:27 . 2001-10-26 17:29 23,040 --a------ C:\WINDOWS\system32\xrxwbtmp.dll
2008-03-31 15:27 . 2001-10-26 17:29 23,040 --a--c--- C:\WINDOWS\system32\dllcache\xrxwbtmp.dll
2008-03-31 15:27 . 2001-10-26 17:29 17,408 --a------ C:\WINDOWS\system32\xrxscnui.dll
2008-03-31 15:27 . 2001-10-26 17:29 17,408 --a--c--- C:\WINDOWS\system32\dllcache\xrxscnui.dll
2008-03-31 15:27 . 2001-10-26 17:05 6,912 --a------ C:\WINDOWS\system32\drivers\serscan.sys
2008-03-31 15:27 . 2001-10-26 17:05 6,912 --a--c--- C:\WINDOWS\system32\dllcache\serscan.sys
2008-03-31 15:27 . 2001-10-26 17:30 4,608 --a--c--- C:\WINDOWS\system32\dllcache\xrxflnch.exe
2008-03-31 15:19 . 2008-03-31 15:19 <DIR> d-------- C:\totalcmd
2008-03-31 15:19 . 2006-02-16 06:54 545 --a------ C:\WINDOWS\UC.PIF
2008-03-31 15:19 . 2006-02-16 06:54 545 --a------ C:\WINDOWS\RAR.PIF
2008-03-31 15:19 . 2006-02-16 06:54 545 --a------ C:\WINDOWS\PKZIP.PIF
2008-03-31 15:19 . 2006-02-16 06:54 545 --a------ C:\WINDOWS\PKUNZIP.PIF
2008-03-31 15:19 . 2006-02-16 06:54 545 --a------ C:\WINDOWS\NOCLOSE.PIF
2008-03-31 15:19 . 2006-02-16 06:54 545 --a------ C:\WINDOWS\LHA.PIF
2008-03-31 15:19 . 2006-02-16 06:54 545 --a------ C:\WINDOWS\ARJ.PIF
2008-03-31 15:19 . 2008-03-31 16:39 367 --a------ C:\WINDOWS\wincmd.ini
2008-03-31 15:01 . 2008-03-31 15:01 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\MSScanAppDataDir
2008-03-27 22:12 . 2008-03-27 22:12 <DIR> d-------- C:\Program Files\Smart Projects
2008-03-20 14:09 . 2008-04-09 09:39 <DIR> d-------- C:\Program Files\FlashGet
2008-03-14 08:04 . 2008-03-14 08:04 46,652 --a------ C:\WINDOWS\system32\drivers\scdemu.sys

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-04-08 11:03 --------- d-----w C:\Documents and Settings\dawid\Dane aplikacji\Hamachi
2008-04-03 07:28 --------- d-----w C:\Documents and Settings\dawid\Dane aplikacji\Azureus
2008-03-29 17:45 1,146,232 ----a-w C:\WINDOWS\system32\aswBoot.exe
2008-03-29 17:35 94,544 ----a-w C:\WINDOWS\system32\drivers\aswmon2.sys
2008-03-29 17:29 23,152 ----a-w C:\WINDOWS\system32\drivers\aswRdr.sys
2008-03-29 17:27 42,912 ----a-w C:\WINDOWS\system32\drivers\aswTdi.sys
2008-03-29 17:26 26,944 ----a-w C:\WINDOWS\system32\drivers\aavmker4.sys
2008-03-29 17:23 95,608 ----a-w C:\WINDOWS\system32\AVASTSS.scr
2008-03-27 14:17 --------- d-----w C:\Program Files\Azureus
2008-03-25 22:43 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-03-17 12:03 108,144 ----a-w C:\WINDOWS\system32\CmdLineExt.dll
2008-02-16 09:47 --------- d-----w C:\Program Files\JetAudio
2008-02-12 18:21 --------- d-----w C:\Documents and Settings\dawid\Dane aplikacji\Tlen.pl
2008-02-11 08:39 90,112 ----a-w C:\WINDOWS\DUMP44c9.tmp
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:44 15360]
"H/PC Connection Agent"="C:\PROGRA~1\MICROS~4\wcescomm.exe" [2005-11-15 19:44 1200128]
"Gadu-Gadu"="C:\PROGRA~1\GADU-G~1\gg.exe" [2007-07-09 09:39 2119104]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Cmaudio"="cmicnfg.cpl" []
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 02:11 132496]
"NeroCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 11:50 155648]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-06-29 00:43 8466432]
"nwiz"="nwiz.exe" [2007-06-29 00:43 1626112 C:\WINDOWS\system32\nwiz.exe]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-06-29 00:43 81920]
"Easy-PrintToolBox"="C:\Program Files\Canon\Easy-PrintToolBox\BJPSMAIN.exe" [2004-01-14 03:10 409600]
"UserFaultCheck"="C:\WINDOWS\system32\dumprep 0 -u" [ ]
"Flashget"="C:\Program Files\FlashGet\flashget.exe" [2007-09-25 10:10 2007088]
"PWRISOVM.EXE"="C:\Program Files\PowerISO\PWRISOVM.EXE" [2008-03-15 01:50 233472]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 00:44 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.lameacm"= lameACM.acm
"vidc.3ivx"=
"vidc.3iv2"= 3ivxVfWCodec.dll
"VIDC.HFYU"= huffyuv.dll
"VIDC.VP31"= vp31vfw.dll
"msacm.ac3acm"= ac3acm.acm

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Authentication Packages REG_MULTI_SZ msv1_0 nwprovau

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Spik\\Spik.exe"=
"C:\\Program Files\\RealVNC\\VNC4\\vncviewer.exe"=
"C:\\Program Files\\K-Lite Codec Pack\\tools\\3ivxConfig.exe"=
"C:\Program Files\Microsoft ActiveSync\rapimgr.exe"= C:\Program Files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager
"C:\Program Files\Microsoft ActiveSync\wcescomm.exe"= C:\Program Files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager
"C:\Program Files\Microsoft ActiveSync\WCESMgr.exe"= C:\Program Files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application
"C:\\Program Files\\RealVNC\\VNC4\\winvnc4.exe"=
"C:\\Program Files\\Gadu-Gadu\\gg.exe"=
"C:\\Program Files\\Winamp Remote\\bin\\Orb.exe"=
"C:\\Program Files\\Winamp Remote\\bin\\OrbTray.exe"=
"C:\\Program Files\\Winamp Remote\\bin\\OrbStreamerClient.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\VoipBuster.com\\VoipBuster\\VoipBuster.exe"=
"C:\\Program Files\\FlashGet\\flashget.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009
"26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service
"1883:UDP"= 1883:UDP:Windows Media Format SDK (firefox.exe)
"1882:UDP"= 1882:UDP:Windows Media Format SDK (firefox.exe)

.
Contents of the 'Scheduled Tasks' folder
"2008-03-27 16:21:04 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
.
**************************************************************************

catchme 0.3.1351 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-04-09 10:12:16
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

PROCESS: C:\WINDOWS\explorer.exe
-> C:\WINDOWS\system32\nview.dll
.
------------------------ Other Running Processes ------------------------
.
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Program Files\Firebird\Firebird_1_5\bin\fbguard.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe
C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\Program Files\RealVNC\VNC4\WinVNC4.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Firebird\Firebird_1_5\bin\fbserver.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\PROGRA~1\MICROS~4\rapimgr.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\imapi.exe
.
**************************************************************************
.
Completion time: 2008-04-09 10:16:07 - machine was rebooted
ComboFix-quarantined-files.txt 2008-04-09 08:15:56
Pre-Run: 3,172,704,256 bajtów wolnych
Post-Run: 3,110,109,184 bajt˘w wolnych
.
2008-03-25 22:45:57 --- E O F ---

**Posty:** 18165 · przez **wojtas** 09 Kwi 2008, 13:11

Wykonaj to co jest podane w tym temacie

te plik/i :

C:\WINDOWS\system32\SETA4.tmp
C:\WINDOWS\DUMP44c9.tmp

przesaknuj tu

http://virusscan.jotti.org/
http://www.virustotal.com/

i zapisz sobie raporty ze skanow

Zastosuj SDFix . Po pobraniu uruchom go a rozpakuje się do C:\SDFix. Uruchom komputer w trybie awaryjnym (F8 przy stracie systemu). Będąc w awaryjnym uruchom plik RunThis.bat z folderu SDFixa. Zatwierdź czyszczenie przez Y. Poczekaj aż ukończy i komputer zresetuje

Potem wejdz do folderu C:\SDFix wrzuc zawartość pliku Report.txt + raporty ze skanow i nowy log z combofixa

na pulpicie zaczęło mi zmieniać ikony

na pulpicie zaczęło mi zmieniać ikony

Log z comboFixa

Kto jest na forum