komputer sie zawiesza i wolniej chodzi

**Posty:** 16 · przez **pawelek13** 06 Lip 2008, 15:45

Witam mam 13 lat i kompa który jest nowy, ma około 8 miesięcy. Wczoraj ściągnąłem podejrzany plik .exe uruchomiłem go i wtedy sie zaczęło. Mój antywirus Avast Home Edition i Nod32 zaczął wykrywać Reklamiarzy (wirusy/robaki) dawałem "Usuń" lecz wyskakiwał komunikat że nie można odnaleść tego pliku który jest zawirusowany. Wiec uruchomiłem ponownie komputer i wszystko było dobrze zeskanowalem Dysk C Avastem i odnalazł kilka wirusów które usunąłem. Zauważyłem także ze komputer zaczął wolniej pracować przeglądarka wolniej sie włacza. Kolega polecił mi żebym sciągnalł program Ashampoo AntiSpyWare 2. Sciągnąłem ten program przeskanowalem komputer i wykryło 91 infekcji także sciągnąłem program Comodo Firewall Pro i Spybot S&D. Komputer zaczał sie zawieszać np. przy włączeniu filmu. Wyskakuje jeszcze błąd RUNDLL przy włączaniu komputera czego wcześniej nie było. Nie mam pojęcia co jest nie tak z moim komputerem i nie bardzo znam sie na tym, wiec proszę o odpowiedz i pomoc z góry Dzięki

Tutaj Log:

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 13:43:22, on 2008-07-06 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16674) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\csrss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe E:\Program Files\Alwil Software\Avast4\aswUpdSv.exe E:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Ashampoo\Ashampoo AntiSpyWare 2\AntiSpyWareService.exe C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\WINDOWS\ATKKBService.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\WINDOWS\system32\cisvc.exe C:\Program Files\COMODO\Firewall\cmdagent.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\Program Files\Eset\nod32krn.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\PnkBstrA.exe C:\WINDOWS\wanmpsvc.exe E:\Program Files\Alwil Software\Avast4\ashMaiSv.exe E:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\WINDOWS\System32\alg.exe C:\Program Files\ASUS\GamerOSD\GamerOSD.exe C:\Program Files\Eset\nod32kui.exe C:\WINDOWS\RTHDCPL.EXE C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\system32\RunDLL32.exe E:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe C:\WINDOWS\system32\RUNDLL32.EXE C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\Common Files\AOL\1213127928\ee\AOLSoftware.exe C:\WINDOWS\system32\ctfmon.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Creative\Shared Files\CamTray.exe C:\Program Files\DAEMON Tools\daemon.exe C:\Program Files\DNA\btdna.exe D:\Program Files\Spybot - Search & Destroy\TeaTimer.exe C:\Program Files\America Online 9.0\aoltray.exe C:\Program Files\AOL Companion\companion.exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\Gadu-Gadu\gg.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\WINDOWS\system32\cidaemon.exe C:\Program Files\Winamp\winamp.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe C:\WINDOWS\system32\wbem\wmiprvse.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.comodo.com/search/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza R3 - URLSearchHook: (no name) - {00A6FAF6-072E-44cf-8957-5838F569A31D} - (no file) O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll (file missing) O4 - HKLM\..\Run: [JMB36X IDE Setup] C:\WINDOWS\RaidTool\xInsIDE.exe O4 - HKLM\..\Run: [36X Raid Configurer] C:\WINDOWS\system32\xRaidSetup.exe boot O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [ASUSGamerOSD] C:\Program Files\ASUS\GamerOSD\GamerOSD.exe O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE O4 - HKLM\..\Run: [GamerOSD] C:\Program Files\ASUS\GamerOSD\GamerOSD.exe O4 - HKLM\..\Run: [PD0620 STISvc] RunDLL32.exe P0620Pin.dll,RunDLL32EP 513 O4 - HKLM\..\Run: [avast!] E:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" O4 - HKLM\..\Run: [BearShare] "D:\Program Files\BearShare\BearShare.exe" /pause O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime Alternative\QTTask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1213127928\ee\AOLSoftware.exe O4 - HKLM\..\Run: ['Ashampoo AntiSpyWare 2 Guard'] C:\Program Files\Ashampoo\Ashampoo AntiSpyWare 2\AntiSpyWare2Guard.exe O4 - HKLM\..\Run: [5ccd7e74] rundll32.exe "C:\WINDOWS\system32\kdxuxkhx.dll",b O4 - HKLM\..\RunOnce: [SpybotSnD] "D:\Program Files\Spybot - Search & Destroy\SpybotSD.exe" /autocheck O4 - HKLM\..\RunOnce: [Spybot - Search & Destroy] "D:\Program Files\Spybot - Search & Destroy\SpybotSD.exe" /autocheck O4 - HKLM\..\RunOnce: [SpybotDeletingA9536] command /c del "C:\WINDOWS\system32\xxywVmMe.dll_old" O4 - HKLM\..\RunOnce: [SpybotDeletingC3199] cmd /c del "C:\WINDOWS\system32\xxywVmMe.dll_old" O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized O4 - HKCU\..\Run: [Creative WebCam Tray] "C:\Program Files\Creative\Shared Files\CamTray.exe" O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe O4 - HKCU\..\Run: [ares] "C:\Program Files\Ares\Ares.exe" -h O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033 O4 - HKCU\..\Run: [Uniblue RegistryBooster 2] C:\Program Files\Uniblue\RegistryBooster 2\RegistryBooster.exe /S O4 - HKCU\..\Run: [BitTorrent DNA] "C:\Program Files\DNA\btdna.exe" O4 - HKCU\..\Run: [ProxyWay] D:\Program Files\ProxyWay\proxyway.exe O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background O4 - HKCU\..\Run: [SpybotSD TeaTimer] d:\Program Files\Spybot - Search & Destroy\TeaTimer.exe O4 - HKCU\..\RunOnce: [SpybotDeletingB6365] command /c del "C:\WINDOWS\system32\xxywVmMe.dll_old" O4 - HKCU\..\RunOnce: [SpybotDeletingD6527] cmd /c del "C:\WINDOWS\system32\xxywVmMe.dll_old" O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Startup: OneNote 2007 Screen Clipper and Launcher.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE O4 - Startup: Microsoft Office Groove.lnk = C:\Program Files\Microsoft Office\Office12\GROOVE.EXE O4 - Global Startup: America Online 9.0 Tray Icon.lnk = C:\Program Files\America Online 9.0\aoltray.exe O4 - Global Startup: AOL Companion.lnk = C:\Program Files\AOL Companion\companion.exe O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra button: Wpis w blogu - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll (file missing) O9 - Extra 'Tools' menuitem: &Wpis w blogu w Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll (file missing) O9 - Extra button: Wyślij do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra 'Tools' menuitem: Wyślij &do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - d:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - d:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - http://www.nvidia.com/content/DriverDownload/srl/2.0.0.1/sysreqlab2.cab O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O20 - AppInit_DLLs: C:\WINDOWS\system32\guard32.dll C:\WINDOWS\system32\cssdll32.dll O23 - Service: Ashampoo AntiSpyWare 2 Service (AASW2_Service) - Unknown owner - C:\Program Files\Ashampoo\Ashampoo AntiSpyWare 2\AntiSpyWareService.exe O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe O23 - Service: Urządzenie mobilne Apple (Apple Mobile Device) - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - E:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: ATK Keyboard Service (ATKKeyboardService) - ASUSTeK COMPUTER INC. - C:\WINDOWS\ATKKBService.exe O23 - Service: avast! Antivirus - ALWIL Software - E:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - E:\Program Files\Alwil Software\Avast4\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - E:\Program Files\Alwil Software\Avast4\ashWebSv.exe O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: COMODO Firewall Pro Helper Service (cmdAgent) - Unknown owner - C:\Program Files\COMODO\Firewall\cmdagent.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: Usługa iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe O23 - Service: DiRT Drivers Auto Removal (pr2ah4nb) (pr2ah4nb) - CODEMASTERS - C:\WINDOWS\system32\pr2ah4nb.exe O23 - Service: FrontLine Drivers Auto Removal (v2) (sfrem02) - Protection Technology (StarForce) - C:\WINDOWS\system32\sfrem02.exe O23 - Service: Usługa Messenger Sharing Folders USN Journal Reader (usnjsvc) - Unknown owner - C:\Program Files\Windows Live\Messenger\usnsvc.exe (file missing) O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe O23 - Service: Windows Live Setup Service (WLSetupSvc) - Unknown owner - C:\Program Files\Windows Live\installer\WLSetupSvc.exe (file missing) -- End of file - 12691 bytes

**Posty:** 8001 · przez **Okocza** 06 Lip 2008, 15:54

po 1 skoro masz noda to po co Ci avast?

po 2 to na fix w hj

Kod: Zaznacz wszystko: R3 - URLSearchHook: (no name) - {00A6FAF6-072E-44cf-8957-5838F569A31D} - (no file) O4 - HKLM\..\Run: [PD0620 STISvc] RunDLL32.exe P0620Pin.dll,RunDLL32EP 513 O4 - HKLM\..\Run: [5ccd7e74] rundll32.exe "C:\WINDOWS\system32\kdxuxkhx.dll",b O4 - HKLM\..\RunOnce: [SpybotDeletingA9536] command /c del "C:\WINDOWS\system32\xxywVmMe.dll_old" O4 - HKLM\..\RunOnce: [SpybotDeletingC3199] cmd /c del "C:\WINDOWS\system32\xxywVmMe.dll_old" O4 - HKCU\..\RunOnce: [SpybotDeletingB6365] command /c del "C:\WINDOWS\system32\xxywVmMe.dll_old" O4 - HKCU\..\RunOnce: [SpybotDeletingD6527] cmd /c del "C:\WINDOWS\system32\xxywVmMe.dll_old"

po 3 log z combofixa poproszę.

po 4 zrob screen z

Kod: Zaznacz wszystko: Wyskakuje jeszcze błąd RUNDLL

i wstaw na forum

**Posty:** 16 · przez **pawelek13** 06 Lip 2008, 16:51

Ad.1 To usune Noda32 poniewaz avast jest po Polsku

Ad.2 Nie wiem o co ci chodzi "po 2 to na fix w hj " jestem nowy i mlody i niewiem poprostu co to znaczy

Ad.3

Prosze oto log z ComboFixa

Kod: Zaznacz wszystko: ComboFix 08-07-05.1 - K01 2008-07-06 16:17:45.2 - [color=red][b]FAT32[/b][/color]x86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.2670 [GMT 2:00] Running from: C:\Documents and Settings\K01\Pulpit\ComboFix.exe * Resident AV is active [color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color] . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\Documents and Settings\K01\Dane aplikacji\urlredir.cfg C:\WINDOWS\system32\gquolsus.ini C:\WINDOWS\system32\NUELmnpo.ini C:\WINDOWS\system32\NUELmnpo.ini2 C:\WINDOWS\system32\opnmLEUN.dll . ---- Previous Run ------- . C:\Documents and Settings\K01\Dane aplikacji\urlredir.cfg C:\Program Files\Adssite Games Collection C:\Program Files\Adssite Games Collection\BattlesOfHelicopters.exe C:\Program Files\Adssite Games Collection\BobAndBill.exe C:\Program Files\Adssite Games Collection\CrazyBlocks.exe C:\Program Files\Adssite Games Collection\Lines.exe C:\Program Files\Adssite Games Collection\uninstall.exe C:\Program Files\Adssite Games Collection\VideoPool.exe C:\Program Files\MyWebSearch C:\Program Files\MyWebSearch\bar\3.bin\F3DTACTL.V00DLL C:\Program Files\MyWebSearch\bar\3.bin\F3DTACTL.V01DLL C:\Program Files\MyWebSearch\bar\3.bin\F3DTACTL.V02DLL C:\Program Files\MyWebSearch\bar\3.bin\F3DTACTL.V03DLL C:\Program Files\MyWebSearch\bar\3.bin\F3DTACTL.V04DLL C:\Program Files\MyWebSearch\bar\3.bin\F3DTACTL.V05DLL C:\Program Files\MyWebSearch\bar\3.bin\F3DTACTL.V06DLL C:\Program Files\MyWebSearch\bar\3.bin\F3DTACTL.V07DLL C:\Program Files\MyWebSearch\bar\3.bin\F3DTACTL.V08DLL C:\Program Files\MyWebSearch\bar\3.bin\F3DTACTL.V09DLL C:\Program Files\MyWebSearch\bar\3.bin\F3DTACTL.VDLL C:\Program Files\MyWebSearch\bar\Settings\s_pid.dat C:\Program Files\PCHealthCenter C:\Program Files\PCHealthCenter\0.exe C:\Program Files\PCHealthCenter\0.gif C:\Program Files\PCHealthCenter\1.exe C:\Program Files\PCHealthCenter\1.gif C:\Program Files\PCHealthCenter\2.gif C:\Program Files\PCHealthCenter\3.exe C:\Program Files\PCHealthCenter\3.gif C:\Program Files\PCHealthCenter\4.exe C:\Program Files\PCHealthCenter\5.exe C:\Program Files\PCHealthCenter\Thumbs.db C:\WINDOWS\Downloaded Program Files\setup.inf C:\WINDOWS\system32\adssite-remove.exe C:\WINDOWS\system32\adssite_sidebar.dll C:\WINDOWS\system32\ddcCVpMF.dll C:\WINDOWS\system32\eMmVwyxx.ini C:\WINDOWS\system32\eMmVwyxx.ini2 C:\WINDOWS\system32\FMpVCcdd.ini C:\WINDOWS\system32\FMpVCcdd.ini2 C:\WINDOWS\system32\htgscxvg.ini C:\WINDOWS\system32\mysidesearch_sidebar_uninstall.exe C:\WINDOWS\system32\myss_sb_uninstall.exe C:\WINDOWS\system32\qlkuurul.ini C:\WINDOWS\system32\rightonadz-uninst.exe C:\WINDOWS\system32\winio.vxd C:\WINDOWS\system32\xhkxuxdk.ini C:\WINDOWS\system32\zlib.dll . ((((((((((((((((((((((((( Files Created from 2008-06-06 to 2008-07-06 ))))))))))))))))))))))))))))))) . 2008-07-06 16:13 . 2008-07-06 16:13 89,088 --a------ C:\WINDOWS\system32\suslouqg.dll 2008-07-06 13:42 . 2008-07-06 13:42 <DIR> d-------- C:\Program Files\Trend Micro 2008-07-06 11:50 . 2008-07-06 11:50 89,088 --a------ C:\WINDOWS\system32\luruuklq.dll 2008-07-06 11:03 . 2008-07-06 11:16 693 --a------ C:\WINDOWS\wininit.ini 2008-07-06 00:45 . 2008-07-06 00:45 88,576 --a------ C:\WINDOWS\system32\gvxcsgth.dll 2008-07-05 22:11 . 2008-07-05 22:11 <DIR> d-------- C:\Program Files\AskSBar 2008-07-05 22:11 . 2008-07-05 22:11 <DIR> d-------- C:\Documents and Settings\K01\Dane aplikacji\Comodo 2008-07-05 22:11 . 2008-07-05 22:11 249,592 --a------ C:\WINDOWS\system32\cssdll32.dll 2008-07-05 22:10 . 2008-07-05 22:11 <DIR> d-------- C:\Program Files\COMODO 2008-07-05 22:10 . 2008-07-05 22:11 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\comodo 2008-07-05 22:10 . 2008-07-05 22:10 143,104 --a------ C:\WINDOWS\system32\guard32.dll 2008-07-05 22:10 . 2008-07-05 22:10 87,056 --a------ C:\WINDOWS\system32\drivers\cmdguard.sys 2008-07-05 22:10 . 2008-07-05 22:10 24,208 --a------ C:\WINDOWS\system32\drivers\cmdhlp.sys 2008-07-05 21:59 . 2008-07-05 22:00 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Spybot - Search & Destroy 2008-07-05 21:48 . 2008-07-05 21:48 <DIR> d-------- C:\Program Files\Ashampoo 2008-07-05 21:01 . 2008-07-05 21:01 <DIR> d--hs---- C:\FOUND.012 2008-07-05 18:33 . 2008-07-05 18:33 28,288 --a------ C:\WINDOWS\system32\iifgGWMD.dll 2008-07-05 18:33 . 2008-07-05 18:33 28,288 --a------ C:\WINDOWS\system32\hgGwtQIB.dll 2008-07-05 18:33 . 2008-07-05 18:33 28,288 --a------ C:\WINDOWS\system32\cbXnKabA.dll 2008-07-04 12:34 . 2008-07-04 12:34 <DIR> dr-h----- C:\Documents and Settings\K01\Dane aplikacji\SecuROM 2008-06-21 18:34 . 2008-06-21 18:34 <DIR> d-------- C:\Documents and Settings\K01\Dane aplikacji\Tibia 2008-06-13 13:03 . 2008-06-13 13:03 <DIR> d--hs---- C:\FOUND.011 2008-06-11 21:39 . 2008-06-11 21:39 <DIR> d-------- C:\Documents and Settings\K01\Dane aplikacji\Draco Organizer 2008-06-11 13:00 . 2008-06-14 20:01 273,024 --------- C:\WINDOWS\system32\drivers\bthport.sys 2008-06-11 13:00 . 2008-06-14 20:01 273,024 --------- C:\WINDOWS\system32\dllcache\bthport.sys 2008-06-10 21:58 . 2008-06-10 21:58 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\AOL Downloads 2008-06-09 20:51 . 2008-06-09 20:51 10,920 --a------ C:\aolconnfix.exe 2008-06-09 18:18 . 2008-06-09 18:18 <DIR> d-------- C:\WINDOWS\occache 2008-06-09 18:18 . 2008-06-09 18:18 <DIR> d-------- C:\Program Files\Viewpoint 2008-06-09 18:18 . 2008-06-09 18:18 <DIR> d-------- C:\Program Files\Learn2.com 2008-06-09 18:18 . 2008-06-09 18:18 <DIR> d-------- C:\Program Files\Common Files\Nullsoft 2008-06-09 18:18 . 2008-06-09 18:18 <DIR> d-------- C:\Program Files\AOL Companion 2008-06-09 18:18 . 2008-06-09 18:18 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Viewpoint 2008-06-09 18:18 . 2007-10-11 07:14 1,494,528 --a------ C:\WINDOWS\system32\shdocvw.bak 2008-06-09 18:17 . 2003-08-15 15:17 1,044,480 --a------ C:\WINDOWS\system32\roboex32.dll 2008-06-09 18:17 . 2003-08-15 15:17 153,088 --a------ C:\WINDOWS\system32\jgdwmie.dll 2008-06-09 18:17 . 2003-08-15 15:17 54,784 --a------ C:\WINDOWS\system32\Inetwh32.dll 2008-06-09 18:17 . 2003-08-15 15:17 29,184 --a------ C:\WINDOWS\system32\popup.ocx 2008-06-09 18:17 . 2003-08-15 15:16 24,659 --a------ C:\WINDOWS\system32\aolddial.dll 2008-06-09 18:16 . 2008-06-09 18:16 <DIR> d-------- C:\Program Files\Common Files\aolshare 2008-06-09 18:16 . 2008-06-09 18:16 <DIR> d-------- C:\Program Files\America Online 9.0 2008-06-09 18:16 . 2008-06-09 18:16 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\AOL 2008-06-09 18:16 . 2003-05-30 13:46 1,706,800 --a------ C:\WINDOWS\system32\gdiplus.dll 2008-06-09 18:16 . 2003-01-10 17:13 65,536 --a------ C:\WINDOWS\wanmpsvc.exe 2008-06-09 18:16 . 2003-01-10 17:13 33,588 --a------ C:\WINDOWS\system32\drivers\wanatw4.sys 2008-06-09 16:39 . 2008-06-09 16:39 <DIR> d-------- C:\Program Files\Common Files\AOL . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-07-05 22:46 196,608 ----a-w C:\WINDOWS\system32\drivers\nStandard.bin 2008-07-05 15:15 22,328 ----a-w C:\WINDOWS\system32\drivers\PnkBstrK.sys 2008-07-05 15:15 103,736 ----a-w C:\WINDOWS\system32\PnkBstrB.exe 2008-05-31 17:41 --------- d-----w C:\Program Files\Apple Software Update 2008-05-26 21:03 --------- d-----w C:\Program Files\Speed Gear 5 2008-05-25 09:49 15,872 ------w C:\WINDOWS\system32\winskfr.dll 2008-05-25 09:49 119,568 ------w C:\WINDOWS\system32\vb6fr.dll 2008-05-25 09:49 --------- d-----w C:\Program Files\Eurobarre 2008-05-22 17:19 --------- d-----w C:\Documents and Settings\K01\Dane aplikacji\Apple Computer 2008-05-22 17:18 --------- d-----w C:\Program Files\iTunes 2008-05-22 17:18 --------- d-----w C:\Program Files\iPod 2008-05-22 17:18 --------- d-----w C:\Program Files\Common Files\Apple 2008-05-22 17:18 --------- d-----w C:\Program Files\Bonjour 2008-05-22 17:18 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Apple 2008-05-08 12:28 202,752 ----a-w C:\WINDOWS\system32\drivers\RMCast.sys 2008-05-08 12:28 202,752 ----a-w C:\WINDOWS\system32\dllcache\rmcast.sys 2008-05-07 05:16 1,291,264 ----a-w C:\WINDOWS\system32\quartz.dll 2008-05-07 05:16 1,291,264 ----a-w C:\WINDOWS\system32\dllcache\quartz.dll 2008-04-23 23:20 3,591,680 ----a-w C:\WINDOWS\system32\dllcache\mshtml.dll 2008-04-22 10:08 107,888 ----a-w C:\WINDOWS\system32\CmdLineExt.dll 2008-04-22 07:43 70,656 ----a-w C:\WINDOWS\system32\dllcache\ie4uinit.exe 2008-04-22 07:43 625,664 ----a-w C:\WINDOWS\system32\dllcache\iexplore.exe 2008-04-22 07:39 13,824 ------w C:\WINDOWS\system32\dllcache\ieudinit.exe 2008-04-20 05:07 161,792 ----a-w C:\WINDOWS\system32\dllcache\ieakui.dll 2008-04-12 07:04 1,386,496 ----a-w C:\WINDOWS\system32\msvbvm60.dll 2008-03-13 11:14 22,328 ----a-w C:\Documents and Settings\K01\Dane aplikacji\PnkBstrK.sys 2007-11-27 15:42 32 ----a-w C:\Documents and Settings\All Users\Dane aplikacji\ezsid.dat 2006-06-23 22:48 32,768 ----a-r C:\WINDOWS\inf\UpdateUSB.exe .

Ad.4 Proszę oto link do screena z błędem RUNDLL

**Posty:** 7956 · przez **Magik** 06 Lip 2008, 17:20

pawelek13 napisał(a):Ad.1 To usune Noda32 poniewaz avast jest po Polsku

heh, brawo i zycze powodzenia zamieniajac mercedesa na fiacika :wink:

czyli usuwajac NoD'a zostawiac Avast'a :arrow:

blad :arrow: :!:

pawelek13 napisał(a):Ad.2 Nie wiem o co ci chodzi "po 2 to na fix w hj " jestem nowy i mlody i niewiem poprostu co to znaczy

podpunkt-->usuwanie
http://forum.programosy.pl/hijackthis-amp-silent-runners-gtobsuga-i-umieszczanie-vt9452.html

wklej do notatnika

Kod: Zaznacz wszystko: FILE:: C:\Program Files\MyWebSearch\bar\3.bin\F3DTACTL.V00DLL C:\Program Files\MyWebSearch\bar\3.bin\F3DTACTL.V01DLL C:\Program Files\MyWebSearch\bar\3.bin\F3DTACTL.V02DLL C:\Program Files\MyWebSearch\bar\3.bin\F3DTACTL.V03DLL C:\Program Files\MyWebSearch\bar\3.bin\F3DTACTL.V04DLL C:\Program Files\MyWebSearch\bar\3.bin\F3DTACTL.V05DLL C:\Program Files\MyWebSearch\bar\3.bin\F3DTACTL.V06DLL C:\Program Files\MyWebSearch\bar\3.bin\F3DTACTL.V07DLL C:\Program Files\MyWebSearch\bar\3.bin\F3DTACTL.V08DLL C:\Program Files\MyWebSearch\bar\3.bin\F3DTACTL.V09DLL C:\Program Files\MyWebSearch\bar\3.bin\F3DTACTL.VDLL C:\Program Files\MyWebSearch\bar\Settings\s_pid.dat C:\Program Files\Adssite Games Collection C:\Program Files\Adssite Games Collection\BattlesOfHelicopters.exe C:\Program Files\Adssite Games Collection\BobAndBill.exe C:\Program Files\Adssite Games Collection\CrazyBlocks.exe C:\Program Files\Adssite Games Collection\Lines.exe C:\Program Files\Adssite Games Collection\uninstall.exe C:\Program Files\Adssite Games Collection\VideoPool.exe C:\Program Files\PCHealthCenter\0.exe C:\Program Files\PCHealthCenter\0.gif C:\Program Files\PCHealthCenter\1.exe C:\Program Files\PCHealthCenter\1.gif C:\Program Files\PCHealthCenter\2.gif C:\Program Files\PCHealthCenter\3.exe C:\Program Files\PCHealthCenter\3.gif C:\Program Files\PCHealthCenter\4.exe C:\Program Files\PCHealthCenter\5.exe C:\Program Files\PCHealthCenter\Thumbs.db C:\WINDOWS\Downloaded Program Files\setup.inf C:\WINDOWS\system32\adssite-remove.exe C:\WINDOWS\system32\adssite_sidebar.dll C:\WINDOWS\system32\ddcCVpMF.dll C:\WINDOWS\system32\eMmVwyxx.ini C:\WINDOWS\system32\eMmVwyxx.ini2 C:\WINDOWS\system32\FMpVCcdd.ini C:\WINDOWS\system32\FMpVCcdd.ini2 C:\WINDOWS\system32\htgscxvg.ini C:\WINDOWS\system32\mysidesearch_sidebar_uninstall.exe C:\WINDOWS\system32\myss_sb_uninstall.exe C:\WINDOWS\system32\qlkuurul.ini C:\WINDOWS\system32\rightonadz-uninst.exe C:\WINDOWS\system32\winio.vxd C:\WINDOWS\system32\xhkxuxdk.ini C:\WINDOWS\system32\zlib.dll

Zapisz plik jako CFScript.txt, przeciągnij i upuść plik CFScript.txt na ikonkę ComboFix.exe

BTW, ten log ktory wkleiles jest urwany.....

+
by Mario

Zastosuj SDFix . Po pobraniu uruchom go a rozpakuje się do C:\SDFix. Uruchom komputer w trybie awaryjnym (F8 przy stracie systemu). Będąc w awaryjnym uruchom plik RunThis.bat z folderu SDFixa. Zatwierdź czyszczenie przez Y. Poczekaj aż ukończy i komputer zresetuje

Potem wejdz do folderu C:\SDFix wrzuc zawartość pliku Report.txt + log z combofixa oraz daj loga z hijacka

**Posty:** 16 · przez **pawelek13** 06 Lip 2008, 20:11

ok usune Avasta

usunalem w hj ale nie bylo wszystkich ktore podal okocza byl tylko jeden

zrobilem jak kazales wkleilem do notatnika zapisalem jak trzeba i przeciaglem ComboxFix sie uruchomil i zrestartowal mi sie komputer (chyba tak byc powionno)

jezeli log z ComboFix jest urwaany to moge zrobic nowy chyba ze nie trzeba ??

SDFix-em zrobilem co trzeba bylo w trybie awaryjnym lecz pozniej niewiem gdzie jest plik Report.txt do folderu C:\SDFix wrzucilem log z HJ i combofix tylko niewiem gdzie ten Report.txt

a komputer dalej jest zmulony

**Posty:** 8001 · przez **Okocza** 06 Lip 2008, 20:12

pawelek13

zrób ten log. bo nie wiemy co siedzi w rejestrze

**Posty:** 16 · przez **pawelek13** 06 Lip 2008, 20:41

Zrobiłem nowego loga w ComboFix

Kod: Zaznacz wszystko: ComboFix 08-07-05.1 - K01 2008-07-06 20:20:11.3 - [color=red][b]FAT32[/b][/color]x86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.2684 [GMT 2:00] Running from: C:\Documents and Settings\K01\Pulpit\ComboFix.exe * Resident AV is active [color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color] . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\Documents and Settings\K01\Dane aplikacji\urlredir.cfg C:\WINDOWS\system32\awtttRlM.dll C:\WINDOWS\system32\mcrh.tmp C:\WINDOWS\system32\MlRtttwa.ini C:\WINDOWS\system32\MlRtttwa.ini2 C:\WINDOWS\system32\pvlwpvwt.ini . ---- Previous Run ------- . C:\Documents and Settings\K01\Dane aplikacji\urlredir.cfg C:\Program Files\Adssite Games Collection C:\Program Files\Adssite Games Collection\BattlesOfHelicopters.exe C:\Program Files\Adssite Games Collection\BobAndBill.exe C:\Program Files\Adssite Games Collection\CrazyBlocks.exe C:\Program Files\Adssite Games Collection\Lines.exe C:\Program Files\Adssite Games Collection\uninstall.exe C:\Program Files\Adssite Games Collection\VideoPool.exe C:\Program Files\MyWebSearch C:\Program Files\MyWebSearch\bar\3.bin\F3DTACTL.V00DLL C:\Program Files\MyWebSearch\bar\3.bin\F3DTACTL.V01DLL C:\Program Files\MyWebSearch\bar\3.bin\F3DTACTL.V02DLL C:\Program Files\MyWebSearch\bar\3.bin\F3DTACTL.V03DLL C:\Program Files\MyWebSearch\bar\3.bin\F3DTACTL.V04DLL C:\Program Files\MyWebSearch\bar\3.bin\F3DTACTL.V05DLL C:\Program Files\MyWebSearch\bar\3.bin\F3DTACTL.V06DLL C:\Program Files\MyWebSearch\bar\3.bin\F3DTACTL.V07DLL C:\Program Files\MyWebSearch\bar\3.bin\F3DTACTL.V08DLL C:\Program Files\MyWebSearch\bar\3.bin\F3DTACTL.V09DLL C:\Program Files\MyWebSearch\bar\3.bin\F3DTACTL.VDLL C:\Program Files\MyWebSearch\bar\Settings\s_pid.dat C:\Program Files\PCHealthCenter C:\Program Files\PCHealthCenter\0.exe C:\Program Files\PCHealthCenter\0.gif C:\Program Files\PCHealthCenter\1.exe C:\Program Files\PCHealthCenter\1.gif C:\Program Files\PCHealthCenter\2.gif C:\Program Files\PCHealthCenter\3.exe C:\Program Files\PCHealthCenter\3.gif C:\Program Files\PCHealthCenter\4.exe C:\Program Files\PCHealthCenter\5.exe C:\Program Files\PCHealthCenter\Thumbs.db C:\WINDOWS\Downloaded Program Files\setup.inf C:\WINDOWS\system32\adssite-remove.exe C:\WINDOWS\system32\adssite_sidebar.dll C:\WINDOWS\system32\ddcCVpMF.dll C:\WINDOWS\system32\eMmVwyxx.ini C:\WINDOWS\system32\eMmVwyxx.ini2 C:\WINDOWS\system32\FMpVCcdd.ini C:\WINDOWS\system32\FMpVCcdd.ini2 C:\WINDOWS\system32\gquolsus.ini C:\WINDOWS\system32\htgscxvg.ini C:\WINDOWS\system32\mysidesearch_sidebar_uninstall.exe C:\WINDOWS\system32\myss_sb_uninstall.exe C:\WINDOWS\system32\NUELmnpo.ini C:\WINDOWS\system32\NUELmnpo.ini2 C:\WINDOWS\system32\opnmLEUN.dll C:\WINDOWS\system32\qlkuurul.ini C:\WINDOWS\system32\ratelnog.ini C:\WINDOWS\system32\rightonadz-uninst.exe C:\WINDOWS\system32\winio.vxd C:\WINDOWS\system32\xhkxuxdk.ini C:\WINDOWS\system32\zlib.dll . ((((((((((((((((((((((((( Files Created from 2008-06-06 to 2008-07-06 ))))))))))))))))))))))))))))))) . 2008-07-06 18:18 . 2008-07-06 18:18 <DIR> d-------- C:\WINDOWS\ERUNT 2008-07-06 18:10 . 2008-07-06 18:10 89,088 --a------ C:\WINDOWS\system32\twvpwlvp.dll 2008-07-06 18:00 . 2008-07-06 15:20 <DIR> d-------- C:\SDFix 2008-07-06 18:00 . 2008-07-06 18:00 89,088 --a------ C:\WINDOWS\system32\ifrganod.dll 2008-07-06 18:00 . 2008-07-06 17:55 294 --ahs---- C:\WINDOWS\system32\donagrfi.ini 2008-07-06 17:55 . 2008-07-06 17:55 294 ---hs---- C:\WINDOWS\system32\ratelnog.ini 2008-07-06 17:31 . 2008-07-06 17:31 <DIR> d---s---- C:\Documents and Settings\Administrator 2008-07-06 16:14 . 2008-07-06 16:14 <DIR> d-------- C:\ComboFix(2) 2008-07-06 13:42 . 2008-07-06 13:42 <DIR> d-------- C:\Program Files\Trend Micro 2008-07-06 11:50 . 2008-07-06 11:50 89,088 --a------ C:\WINDOWS\system32\luruuklq.dll 2008-07-06 11:03 . 2008-07-06 11:16 693 --a------ C:\WINDOWS\wininit.ini 2008-07-06 00:45 . 2008-07-06 00:45 88,576 --a------ C:\WINDOWS\system32\gvxcsgth.dll 2008-07-05 22:11 . 2008-07-05 22:11 <DIR> d-------- C:\Program Files\AskSBar 2008-07-05 22:11 . 2008-07-05 22:11 <DIR> d-------- C:\Documents and Settings\K01\Dane aplikacji\Comodo 2008-07-05 22:11 . 2008-07-05 22:11 249,592 --a------ C:\WINDOWS\system32\cssdll32.dll 2008-07-05 22:10 . 2008-07-05 22:11 <DIR> d-------- C:\Program Files\COMODO 2008-07-05 22:10 . 2008-07-05 22:11 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\comodo 2008-07-05 22:10 . 2008-07-05 22:10 143,104 --a------ C:\WINDOWS\system32\guard32.dll 2008-07-05 22:10 . 2008-07-05 22:10 87,056 --a------ C:\WINDOWS\system32\drivers\cmdguard.sys 2008-07-05 22:10 . 2008-07-05 22:10 24,208 --a------ C:\WINDOWS\system32\drivers\cmdhlp.sys 2008-07-05 21:59 . 2008-07-05 22:00 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Spybot - Search & Destroy 2008-07-05 21:48 . 2008-07-05 21:48 <DIR> d-------- C:\Program Files\Ashampoo 2008-07-05 21:01 . 2008-07-05 21:01 <DIR> d--hs---- C:\FOUND.012 2008-07-05 18:33 . 2008-07-05 18:33 28,288 --a------ C:\WINDOWS\system32\iifgGWMD.dll 2008-07-05 18:33 . 2008-07-05 18:33 28,288 --a------ C:\WINDOWS\system32\hgGwtQIB.dll 2008-07-04 12:34 . 2008-07-04 12:34 <DIR> dr-h----- C:\Documents and Settings\K01\Dane aplikacji\SecuROM 2008-06-21 18:34 . 2008-06-21 18:34 <DIR> d-------- C:\Documents and Settings\K01\Dane aplikacji\Tibia 2008-06-13 13:03 . 2008-06-13 13:03 <DIR> d--hs---- C:\FOUND.011 2008-06-11 21:39 . 2008-06-11 21:39 <DIR> d-------- C:\Documents and Settings\K01\Dane aplikacji\Draco Organizer 2008-06-11 13:00 . 2008-06-14 20:01 273,024 --------- C:\WINDOWS\system32\drivers\bthport.sys 2008-06-11 13:00 . 2008-06-14 20:01 273,024 --------- C:\WINDOWS\system32\dllcache\bthport.sys 2008-06-10 21:58 . 2008-06-10 21:58 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\AOL Downloads 2008-06-09 20:51 . 2008-06-09 20:51 10,920 --a------ C:\aolconnfix.exe 2008-06-09 18:18 . 2008-06-09 18:18 <DIR> d-------- C:\WINDOWS\occache 2008-06-09 18:18 . 2008-06-09 18:18 <DIR> d-------- C:\Program Files\Viewpoint 2008-06-09 18:18 . 2008-06-09 18:18 <DIR> d-------- C:\Program Files\Learn2.com 2008-06-09 18:18 . 2008-06-09 18:18 <DIR> d-------- C:\Program Files\Common Files\Nullsoft 2008-06-09 18:18 . 2008-06-09 18:18 <DIR> d-------- C:\Program Files\AOL Companion 2008-06-09 18:18 . 2008-06-09 18:18 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Viewpoint 2008-06-09 18:18 . 2007-10-11 07:14 1,494,528 --a------ C:\WINDOWS\system32\shdocvw.bak 2008-06-09 18:17 . 2003-08-15 15:17 1,044,480 --a------ C:\WINDOWS\system32\roboex32.dll 2008-06-09 18:17 . 2003-08-15 15:17 153,088 --a------ C:\WINDOWS\system32\jgdwmie.dll 2008-06-09 18:17 . 2003-08-15 15:17 54,784 --a------ C:\WINDOWS\system32\Inetwh32.dll 2008-06-09 18:17 . 2003-08-15 15:17 29,184 --a------ C:\WINDOWS\system32\popup.ocx 2008-06-09 18:17 . 2003-08-15 15:16 24,659 --a------ C:\WINDOWS\system32\aolddial.dll 2008-06-09 18:16 . 2008-06-09 18:16 <DIR> d-------- C:\Program Files\Common Files\aolshare 2008-06-09 18:16 . 2008-06-09 18:16 <DIR> d-------- C:\Program Files\America Online 9.0 2008-06-09 18:16 . 2008-06-09 18:16 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\AOL 2008-06-09 18:16 . 2003-05-30 13:46 1,706,800 --a------ C:\WINDOWS\system32\gdiplus.dll 2008-06-09 18:16 . 2003-01-10 17:13 65,536 --a------ C:\WINDOWS\wanmpsvc.exe 2008-06-09 18:16 . 2003-01-10 17:13 33,588 --a------ C:\WINDOWS\system32\drivers\wanatw4.sys 2008-06-09 16:39 . 2008-06-09 16:39 <DIR> d-------- C:\Program Files\Common Files\AOL . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-07-05 22:46 196,608 ----a-w C:\WINDOWS\system32\drivers\nStandard.bin 2008-07-05 15:15 22,328 ----a-w C:\WINDOWS\system32\drivers\PnkBstrK.sys 2008-07-05 15:15 103,736 ----a-w C:\WINDOWS\system32\PnkBstrB.exe 2008-05-31 17:41 --------- d-----w C:\Program Files\Apple Software Update 2008-05-26 21:03 --------- d-----w C:\Program Files\Speed Gear 5 2008-05-25 09:49 15,872 ------w C:\WINDOWS\system32\winskfr.dll 2008-05-25 09:49 119,568 ------w C:\WINDOWS\system32\vb6fr.dll 2008-05-25 09:49 --------- d-----w C:\Program Files\Eurobarre 2008-05-22 17:19 --------- d-----w C:\Documents and Settings\K01\Dane aplikacji\Apple Computer 2008-05-22 17:18 --------- d-----w C:\Program Files\iTunes 2008-05-22 17:18 --------- d-----w C:\Program Files\iPod 2008-05-22 17:18 --------- d-----w C:\Program Files\Common Files\Apple 2008-05-22 17:18 --------- d-----w C:\Program Files\Bonjour 2008-05-22 17:18 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Apple 2008-05-08 12:28 202,752 ----a-w C:\WINDOWS\system32\drivers\RMCast.sys 2008-05-08 12:28 202,752 ----a-w C:\WINDOWS\system32\dllcache\rmcast.sys 2008-05-07 05:16 1,291,264 ----a-w C:\WINDOWS\system32\quartz.dll 2008-05-07 05:16 1,291,264 ----a-w C:\WINDOWS\system32\dllcache\quartz.dll 2008-04-23 23:20 3,591,680 ----a-w C:\WINDOWS\system32\dllcache\mshtml.dll 2008-04-22 10:08 107,888 ----a-w C:\WINDOWS\system32\CmdLineExt.dll 2008-04-22 07:43 70,656 ----a-w C:\WINDOWS\system32\dllcache\ie4uinit.exe 2008-04-22 07:43 625,664 ----a-w C:\WINDOWS\system32\dllcache\iexplore.exe 2008-04-22 07:39 13,824 ------w C:\WINDOWS\system32\dllcache\ieudinit.exe 2008-04-20 05:07 161,792 ----a-w C:\WINDOWS\system32\dllcache\ieakui.dll 2008-04-12 07:04 1,386,496 ----a-w C:\WINDOWS\system32\msvbvm60.dll 2008-03-13 11:14 22,328 ----a-w C:\Documents and Settings\K01\Dane aplikacji\PnkBstrK.sys 2007-11-27 15:42 32 ----a-w C:\Documents and Settings\All Users\Dane aplikacji\ezsid.dat 2006-06-23 22:48 32,768 ----a-r C:\WINDOWS\inf\UpdateUSB.exe . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-03 21:44 15360] "Gadu-Gadu"="C:\Program Files\Gadu-Gadu\gg.exe" [2007-11-14 11:54 2131392] "Skype"="C:\Program Files\Skype\Phone\Skype.exe" [2008-02-01 17:22 21898024] "Creative WebCam Tray"="C:\Program Files\Creative\Shared Files\CamTray.exe" [2005-03-29 07:13 258048] "swg"="C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe" [2007-12-02 16:27 171448] "DAEMON Tools"="C:\Program Files\DAEMON Tools\daemon.exe" [2007-08-16 12:24 167368] "BitTorrent DNA"="C:\Program Files\DNA\btdna.exe" [2008-05-08 13:07 289088] "SpybotSD TeaTimer"="d:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2008-07-03 11:45 2155856] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "JMB36X IDE Setup"="C:\WINDOWS\RaidTool\xInsIDE.exe" [2007-03-20 16:36 36864] "36X Raid Configurer"="C:\WINDOWS\system32\xRaidSetup.exe" [2007-03-21 18:23 1953792] "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-12-05 01:41 8523776] "ASUSGamerOSD"="C:\Program Files\ASUS\GamerOSD\GamerOSD.exe" [2007-06-01 09:37 380928] "nod32kui"="C:\Program Files\Eset\nod32kui.exe" [2007-10-11 21:16 921600] "GamerOSD"="C:\Program Files\ASUS\GamerOSD\GamerOSD.exe" [2007-06-01 09:37 380928] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 04:25 144784] "GrooveMonitor"="C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-27 00:47 31016] "NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-12-05 01:41 81920] "QuickTime Task"="C:\Program Files\QuickTime Alternative\QTTask.exe" [2008-03-28 23:37 413696] "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-03-30 10:36 267048] "HostManager"="C:\Program Files\Common Files\AOL\1213127928\ee\AOLSoftware.exe" [2006-09-26 02:52 50736] "'Ashampoo AntiSpyWare 2 Guard'"="C:\Program Files\Ashampoo\Ashampoo AntiSpyWare 2\AntiSpyWare2Guard.exe" [2008-05-28 10:01 2316632] "5ccd7e74"="C:\WINDOWS\system32\twvpwlvp.dll" [2008-07-06 18:10 89088] "nwiz"="nwiz.exe" [2007-12-05 01:41 1626112 C:\WINDOWS\system32\nwiz.exe] "RTHDCPL"="RTHDCPL.EXE" [2007-03-21 16:49 16126464 C:\WINDOWS\RTHDCPL.exe] "PD0620 STISvc"="P0620Pin.dll" [2005-05-10 18:03 36864 C:\WINDOWS\system32\P0620Pin.dll] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-03 21:44 15360] C:\Documents and Settings\K01\Menu Start\Programy\Autostart\ OneNote 2007 Screen Clipper and Launcher.lnk - C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE [2006-10-26 20:24:54 98632] Microsoft Office Groove.lnk - C:\Program Files\Microsoft Office\Office12\GROOVE.EXE [2006-10-27 15:37:44 338216] C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\ America Online 9.0 Tray Icon.lnk - C:\Program Files\America Online 9.0\aoltray.exe [2008-06-09 18:17:02 36953] AOL Companion.lnk - C:\Program Files\AOL Companion\companion.exe [2008-06-09 18:18:19 229450] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "AppInit_DLLs"= C:\WINDOWS\system32\guard32.dll C:\WINDOWS\system32\cssdll32.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "VIDC.ACDV"= ACDV.dll

**Posty:** 8001 · przez **Okocza** 06 Lip 2008, 20:59

otwórz notatnik i wklej:

Kod: Zaznacz wszystko: File:: C:\WINDOWS\system32\twvpwlvp.dll C:\WINDOWS\system32\ifrganod.dll C:\WINDOWS\system32\luruuklq.dll C:\WINDOWS\system32\gvxcsgth.dll C:\WINDOWS\system32\iifgGWMD.dll C:\WINDOWS\system32\hgGwtQIB.dll C:\WINDOWS\system32\shdocvw.bak C:\WINDOWS\system32\roboex32.dll C:\WINDOWS\system32\jgdwmie.dll C:\WINDOWS\system32\Inetwh32.dll C:\WINDOWS\system32\popup.ocx Registry:: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "5ccd7e74"=-

Plik >>> zapisz jako CFScript.txt .Plik przeciągnij i upuść na ikonę ComboFixa (tak jak tu ) . odczekaj az wygeneruje sie nowy log i go daj na forum

przeskanuj na www.virustotal.com

C:\aolconnfix.exe

log jest urwany...

**Posty:** 16 · przez **pawelek13** 06 Lip 2008, 21:43

przeskanowalem ten plik i znalazl trojana

Kod: Zaznacz wszystko: Plik aolconnfix.exe otrzymany 2008.07.04 22:31:48 (CET) Obecny status: zakończono Wynik: 1/33 (3.03%) Zwięzły Zwięzły Drukuj wyniki Drukuj wyniki Antywirus Wersja Ostatnia aktualizacja Wynik AhnLab-V3 - - - AntiVir - - - Authentium - - - Avast - - - AVG - - - BitDefender - - - CAT-QuickHeal - - - ClamAV - - - DrWeb - - Trojan.PWS.Gamania.origin eSafe - - - eTrust-Vet - - - Ewido - - - F-Prot - - - F-Secure - - - Fortinet - - - GData - - - Ikarus - - - Kaspersky - - - McAfee - - - Microsoft - - - NOD32v2 - - - Norman - - - Panda - - - Prevx1 - - - Rising - - - Sophos - - - Sunbelt - - - Symantec - - - TheHacker - - - TrendMicro - - - VBA32 - - - VirusBuster - - - Webwasher-Gateway - - - Dodatkowe informacje MD5: 9ac90a2ebe7c1c0af0c122c39caa6766 SHA1: 10819ef5ced2f9440f259a092de7000fcea4ef62 SHA256: a4072725e252a5d88941679671078afa3a587363bbf62efe71ffe49c194c1eaa SHA512: 2215e8d1c6eb75cbf9f21bea57090205a8d9957c17b2ce98d3ff854b34cef9c858fb0265a871d70ec42934a0df1491d59efd248c16f05658ec3fa7dfab22e92e UWAGA UWAGA: VirusTotal jest darmową usługą utrzymywaną przez Hispasec Sistemas. Nie ma żadnych gwarancji co do dostępności lub ciągłości tej usługi. Pomimo, że wykrywalność złośliwego oprogramowania w przypadku kilku skanerów antywirusowych jest o wiele większa, niż tylko jednego, raporty nie mogą być 100% miernikiem szkodliwości lub nieszkodliwości danego pliku. Obecnie nie istnieje rozwiązanie gwarantujące 100% wykrywalność złośliwego oprogramowania.

zrobilem jak kazales z tym notatnikiem i przeciaganiem ale znowu log jest urwany

Kod: Zaznacz wszystko: ComboFix 08-07-05.1 - K01 2008-07-06 21:16:44.4 - [color=red][b]FAT32[/b][/color]x86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.2652 [GMT 2:00] Running from: C:\Documents and Settings\K01\Pulpit\ComboFix.exe Command switches used :: C:\Documents and Settings\K01\Pulpit\CFScript.txt * Created a new restore point * Resident AV is active [color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color] FILE :: C:\WINDOWS\system32\gvxcsgth.dll C:\WINDOWS\system32\hgGwtQIB.dll C:\WINDOWS\system32\ifrganod.dll C:\WINDOWS\system32\iifgGWMD.dll C:\WINDOWS\system32\Inetwh32.dll C:\WINDOWS\system32\jgdwmie.dll C:\WINDOWS\system32\luruuklq.dll C:\WINDOWS\system32\popup.ocx C:\WINDOWS\system32\roboex32.dll C:\WINDOWS\system32\shdocvw.bak C:\WINDOWS\system32\twvpwlvp.dll . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\Documents and Settings\K01\Dane aplikacji\urlredir.cfg C:\WINDOWS\system32\gvxcsgth.dll C:\WINDOWS\system32\hgGwtQIB.dll C:\WINDOWS\system32\ifrganod.dll C:\WINDOWS\system32\iifgGWMD.dll C:\WINDOWS\system32\Inetwh32.dll C:\WINDOWS\system32\jgdwmie.dll C:\WINDOWS\system32\luruuklq.dll C:\WINDOWS\system32\popup.ocx C:\WINDOWS\system32\roboex32.dll C:\WINDOWS\system32\shdocvw.bak C:\WINDOWS\system32\twvpwlvp.dll . ---- Previous Run ------- . C:\Documents and Settings\K01\Dane aplikacji\urlredir.cfg C:\Program Files\Adssite Games Collection C:\Program Files\Adssite Games Collection\BattlesOfHelicopters.exe C:\Program Files\Adssite Games Collection\BobAndBill.exe C:\Program Files\Adssite Games Collection\CrazyBlocks.exe C:\Program Files\Adssite Games Collection\Lines.exe C:\Program Files\Adssite Games Collection\uninstall.exe C:\Program Files\Adssite Games Collection\VideoPool.exe C:\Program Files\MyWebSearch C:\Program Files\MyWebSearch\bar\3.bin\F3DTACTL.V00DLL C:\Program Files\MyWebSearch\bar\3.bin\F3DTACTL.V01DLL C:\Program Files\MyWebSearch\bar\3.bin\F3DTACTL.V02DLL C:\Program Files\MyWebSearch\bar\3.bin\F3DTACTL.V03DLL C:\Program Files\MyWebSearch\bar\3.bin\F3DTACTL.V04DLL C:\Program Files\MyWebSearch\bar\3.bin\F3DTACTL.V05DLL C:\Program Files\MyWebSearch\bar\3.bin\F3DTACTL.V06DLL C:\Program Files\MyWebSearch\bar\3.bin\F3DTACTL.V07DLL C:\Program Files\MyWebSearch\bar\3.bin\F3DTACTL.V08DLL C:\Program Files\MyWebSearch\bar\3.bin\F3DTACTL.V09DLL C:\Program Files\MyWebSearch\bar\3.bin\F3DTACTL.VDLL C:\Program Files\MyWebSearch\bar\Settings\s_pid.dat C:\Program Files\PCHealthCenter C:\Program Files\PCHealthCenter\0.exe C:\Program Files\PCHealthCenter\0.gif C:\Program Files\PCHealthCenter\1.exe C:\Program Files\PCHealthCenter\1.gif C:\Program Files\PCHealthCenter\2.gif C:\Program Files\PCHealthCenter\3.exe C:\Program Files\PCHealthCenter\3.gif C:\Program Files\PCHealthCenter\4.exe C:\Program Files\PCHealthCenter\5.exe C:\Program Files\PCHealthCenter\Thumbs.db C:\WINDOWS\Downloaded Program Files\setup.inf C:\WINDOWS\system32\adssite-remove.exe C:\WINDOWS\system32\adssite_sidebar.dll C:\WINDOWS\system32\awtttRlM.dll C:\WINDOWS\system32\ddcCVpMF.dll C:\WINDOWS\system32\eMmVwyxx.ini C:\WINDOWS\system32\eMmVwyxx.ini2 C:\WINDOWS\system32\FMpVCcdd.ini C:\WINDOWS\system32\FMpVCcdd.ini2 C:\WINDOWS\system32\gquolsus.ini C:\WINDOWS\system32\htgscxvg.ini C:\WINDOWS\system32\mcrh.tmp C:\WINDOWS\system32\MlRtttwa.ini C:\WINDOWS\system32\MlRtttwa.ini2 C:\WINDOWS\system32\mysidesearch_sidebar_uninstall.exe C:\WINDOWS\system32\myss_sb_uninstall.exe C:\WINDOWS\system32\NUELmnpo.ini C:\WINDOWS\system32\NUELmnpo.ini2 C:\WINDOWS\system32\opnmLEUN.dll C:\WINDOWS\system32\pvlwpvwt.ini C:\WINDOWS\system32\qlkuurul.ini C:\WINDOWS\system32\ratelnog.ini C:\WINDOWS\system32\rightonadz-uninst.exe C:\WINDOWS\system32\winio.vxd C:\WINDOWS\system32\xhkxuxdk.ini C:\WINDOWS\system32\zlib.dll . ((((((((((((((((((((((((( Files Created from 2008-06-06 to 2008-07-06 ))))))))))))))))))))))))))))))) . 2008-07-06 20:38 . 2008-07-06 20:38 294 ---hs---- C:\WINDOWS\system32\pvlwpvwt.ini 2008-07-06 18:18 . 2008-07-06 18:18 <DIR> d-------- C:\WINDOWS\ERUNT 2008-07-06 18:00 . 2008-07-06 15:20 <DIR> d-------- C:\SDFix 2008-07-06 18:00 . 2008-07-06 17:55 294 --ahs---- C:\WINDOWS\system32\donagrfi.ini 2008-07-06 17:55 . 2008-07-06 17:55 294 ---hs---- C:\WINDOWS\system32\ratelnog.ini 2008-07-06 17:31 . 2008-07-06 17:31 <DIR> d---s---- C:\Documents and Settings\Administrator 2008-07-06 16:14 . 2008-07-06 16:14 <DIR> d-------- C:\ComboFix(2) 2008-07-06 13:42 . 2008-07-06 13:42 <DIR> d-------- C:\Program Files\Trend Micro 2008-07-06 11:03 . 2008-07-06 11:16 693 --a------ C:\WINDOWS\wininit.ini 2008-07-05 22:11 . 2008-07-05 22:11 <DIR> d-------- C:\Program Files\AskSBar 2008-07-05 22:11 . 2008-07-05 22:11 <DIR> d-------- C:\Documents and Settings\K01\Dane aplikacji\Comodo 2008-07-05 22:11 . 2008-07-05 22:11 249,592 --a------ C:\WINDOWS\system32\cssdll32.dll 2008-07-05 22:10 . 2008-07-05 22:11 <DIR> d-------- C:\Program Files\COMODO 2008-07-05 22:10 . 2008-07-05 22:11 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\comodo 2008-07-05 22:10 . 2008-07-05 22:10 143,104 --a------ C:\WINDOWS\system32\guard32.dll 2008-07-05 22:10 . 2008-07-05 22:10 87,056 --a------ C:\WINDOWS\system32\drivers\cmdguard.sys 2008-07-05 22:10 . 2008-07-05 22:10 24,208 --a------ C:\WINDOWS\system32\drivers\cmdhlp.sys 2008-07-05 21:59 . 2008-07-05 22:00 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Spybot - Search & Destroy 2008-07-05 21:48 . 2008-07-05 21:48 <DIR> d-------- C:\Program Files\Ashampoo 2008-07-05 21:01 . 2008-07-05 21:01 <DIR> d--hs---- C:\FOUND.012 2008-07-04 12:34 . 2008-07-04 12:34 <DIR> dr-h----- C:\Documents and Settings\K01\Dane aplikacji\SecuROM 2008-06-21 18:34 . 2008-06-21 18:34 <DIR> d-------- C:\Documents and Settings\K01\Dane aplikacji\Tibia 2008-06-13 13:03 . 2008-06-13 13:03 <DIR> d--hs---- C:\FOUND.011 2008-06-11 21:39 . 2008-06-11 21:39 <DIR> d-------- C:\Documents and Settings\K01\Dane aplikacji\Draco Organizer 2008-06-11 13:00 . 2008-06-14 20:01 273,024 --------- C:\WINDOWS\system32\drivers\bthport.sys 2008-06-11 13:00 . 2008-06-14 20:01 273,024 --------- C:\WINDOWS\system32\dllcache\bthport.sys 2008-06-10 21:58 . 2008-06-10 21:58 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\AOL Downloads 2008-06-09 20:51 . 2008-06-09 20:51 10,920 --a------ C:\aolconnfix.exe 2008-06-09 18:18 . 2008-06-09 18:18 <DIR> d-------- C:\WINDOWS\occache 2008-06-09 18:18 . 2008-06-09 18:18 <DIR> d-------- C:\Program Files\Viewpoint 2008-06-09 18:18 . 2008-06-09 18:18 <DIR> d-------- C:\Program Files\Learn2.com 2008-06-09 18:18 . 2008-06-09 18:18 <DIR> d-------- C:\Program Files\Common Files\Nullsoft 2008-06-09 18:18 . 2008-06-09 18:18 <DIR> d-------- C:\Program Files\AOL Companion 2008-06-09 18:18 . 2008-06-09 18:18 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Viewpoint 2008-06-09 18:17 . 2003-08-15 15:16 24,659 --a------ C:\WINDOWS\system32\aolddial.dll 2008-06-09 18:16 . 2008-06-09 18:16 <DIR> d-------- C:\Program Files\Common Files\aolshare 2008-06-09 18:16 . 2008-06-09 18:16 <DIR> d-------- C:\Program Files\America Online 9.0 2008-06-09 18:16 . 2008-06-09 18:16 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\AOL 2008-06-09 18:16 . 2003-05-30 13:46 1,706,800 --a------ C:\WINDOWS\system32\gdiplus.dll 2008-06-09 18:16 . 2003-01-10 17:13 65,536 --a------ C:\WINDOWS\wanmpsvc.exe 2008-06-09 18:16 . 2003-01-10 17:13 33,588 --a------ C:\WINDOWS\system32\drivers\wanatw4.sys 2008-06-09 16:39 . 2008-06-09 16:39 <DIR> d-------- C:\Program Files\Common Files\AOL . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-07-05 22:46 196,608 ----a-w C:\WINDOWS\system32\drivers\nStandard.bin 2008-07-05 15:15 22,328 ----a-w C:\WINDOWS\system32\drivers\PnkBstrK.sys 2008-07-05 15:15 103,736 ----a-w C:\WINDOWS\system32\PnkBstrB.exe 2008-05-31 17:41 --------- d-----w C:\Program Files\Apple Software Update 2008-05-26 21:03 --------- d-----w C:\Program Files\Speed Gear 5 2008-05-25 09:49 15,872 ------w C:\WINDOWS\system32\winskfr.dll 2008-05-25 09:49 119,568 ------w C:\WINDOWS\system32\vb6fr.dll 2008-05-25 09:49 --------- d-----w C:\Program Files\Eurobarre 2008-05-22 17:19 --------- d-----w C:\Documents and Settings\K01\Dane aplikacji\Apple Computer 2008-05-22 17:18 --------- d-----w C:\Program Files\iTunes 2008-05-22 17:18 --------- d-----w C:\Program Files\iPod 2008-05-22 17:18 --------- d-----w C:\Program Files\Common Files\Apple 2008-05-22 17:18 --------- d-----w C:\Program Files\Bonjour 2008-05-22 17:18 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Apple 2008-05-08 12:28 202,752 ----a-w C:\WINDOWS\system32\drivers\RMCast.sys 2008-05-08 12:28 202,752 ----a-w C:\WINDOWS\system32\dllcache\rmcast.sys 2008-05-07 05:16 1,291,264 ----a-w C:\WINDOWS\system32\quartz.dll 2008-05-07 05:16 1,291,264 ----a-w C:\WINDOWS\system32\dllcache\quartz.dll 2008-04-23 23:20 3,591,680 ----a-w C:\WINDOWS\system32\dllcache\mshtml.dll 2008-04-22 10:08 107,888 ----a-w C:\WINDOWS\system32\CmdLineExt.dll 2008-04-22 07:43 70,656 ----a-w C:\WINDOWS\system32\dllcache\ie4uinit.exe 2008-04-22 07:43 625,664 ----a-w C:\WINDOWS\system32\dllcache\iexplore.exe 2008-04-22 07:39 13,824 ------w C:\WINDOWS\system32\dllcache\ieudinit.exe 2008-04-20 05:07 161,792 ----a-w C:\WINDOWS\system32\dllcache\ieakui.dll 2008-04-12 07:04 1,386,496 ----a-w C:\WINDOWS\system32\msvbvm60.dll 2008-03-13 11:14 22,328 ----a-w C:\Documents and Settings\K01\Dane aplikacji\PnkBstrK.sys 2007-11-27 15:42 32 ----a-w C:\Documents and Settings\All Users\Dane aplikacji\ezsid.dat 2006-06-23 22:48 32,768 ----a-r C:\WINDOWS\inf\UpdateUSB.exe .

**Posty:** 8001 · przez **Okocza** 06 Lip 2008, 21:45

pawelek13

trojanem zajmiemy się na koniec.

daj log z dss'a - opis jest w tym samym co combofix

**Posty:** 16 · przez **pawelek13** 06 Lip 2008, 22:14

Wszystko robie dobrze i naprawi sie komputer ??

a oto log z DSS'a

Kod: Zaznacz wszystko: Deckard's System Scanner v20071014.68 Run by K01 on 2008-07-06 22:07:47 Computer is in Normal Mode. -------------------------------------------------------------------------------- -- System Restore -------------------------------------------------------------- Successfully created a Deckard's System Scanner Restore Point. -- Last 5 Restore Point(s) -- 8: 2008-07-06 20:07:50 UTC - RP8 - Deckard's System Scanner Restore Point 7: 2008-07-06 19:16:26 UTC - RP7 - ComboFix created restore point 6: 2008-07-06 15:59:57 UTC - RP6 - Last known good configuration 5: 2008-07-06 15:59:54 UTC - RP5 - ComboFix created restore point 4: 2008-07-06 15:59:54 UTC - RP4 - Operacja przywracania -- First Restore Point -- 1: 2008-07-06 15:59:54 UTC - RP1 - Punkt kontrolny systemu Backed up registry hives. Performed disk cleanup. -- HijackThis (run as K01.exe) ------------------------------------------------- Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 22:09, on 2008-07-06 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16674) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\csrss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe E:\Program Files\Alwil Software\Avast4\aswUpdSv.exe E:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Ashampoo\Ashampoo AntiSpyWare 2\AntiSpyWareService.exe C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\WINDOWS\ATKKBService.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\Program Files\COMODO\Firewall\cmdagent.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\Program Files\Eset\nod32krn.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\PnkBstrA.exe C:\WINDOWS\wanmpsvc.exe E:\Program Files\Alwil Software\Avast4\ashMaiSv.exe E:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\WINDOWS\System32\alg.exe C:\WINDOWS\Explorer.EXE C:\Program Files\ASUS\GamerOSD\GamerOSD.exe C:\WINDOWS\system32\rundll32.exe C:\Program Files\Eset\nod32kui.exe C:\WINDOWS\RTHDCPL.EXE C:\WINDOWS\system32\RunDLL32.exe C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe C:\WINDOWS\system32\RUNDLL32.EXE C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\Common Files\AOL\1213127928\ee\AOLSoftware.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Gadu-Gadu\gg.exe C:\Program Files\Skype\Phone\Skype.exe C:\Program Files\Creative\Shared Files\CamTray.exe C:\Program Files\DAEMON Tools\daemon.exe C:\Program Files\DNA\btdna.exe D:\Program Files\Spybot - Search & Destroy\TeaTimer.exe C:\Program Files\America Online 9.0\aoltray.exe C:\Program Files\AOL Companion\companion.exe C:\Program Files\Skype\Plugin Manager\skypePM.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\iPod\bin\iPodService.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\wuauclt.exe C:\Documents and Settings\K01\Pulpit\dss.exe C:\WINDOWS\system32\wbem\wmiprvse.exe C:\PROGRA~1\TRENDM~1\HIJACK~1\K01.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.comodo.com/search/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: (no name) - {1648E328-3E5A-4EA5-A9C6-E5F09EE272DA} - (no file) O2 - BHO: (no name) - {1FE4BFC2-60DB-461C-B734-1D40F120299A} - (no file) O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll O2 - BHO: (no name) - {34B713CA-2F9B-4D29-9AE5-1FD09536DB22} - C:\WINDOWS\system32\ddcCVpMF.dll (file missing) O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - D:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) O2 - BHO: Pomocnik rejestracji usługi Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll (file missing) O2 - BHO: (no name) - {C3B43F55-972B-4851-A2B8-986FB2B5C883} - (no file) O2 - BHO: (no name) - {D3602440-8034-47B9-9E6E-DDB6FD690815} - C:\WINDOWS\system32\xxywVmMe.dll (file missing) O2 - BHO: (no name) - {E76F9E67-B370-490C-BFB1-5607FF8FBEBB} - (no file) O2 - BHO: (no name) - {FD2FB745-D827-4AF2-AFA9-5450374110DE} - (no file) O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll (file missing) O4 - HKLM\..\Run: [JMB36X IDE Setup] C:\WINDOWS\RaidTool\xInsIDE.exe O4 - HKLM\..\Run: [36X Raid Configurer] C:\WINDOWS\system32\xRaidSetup.exe boot O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [ASUSGamerOSD] C:\Program Files\ASUS\GamerOSD\GamerOSD.exe O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [GamerOSD] C:\Program Files\ASUS\GamerOSD\GamerOSD.exe O4 - HKLM\..\Run: [PD0620 STISvc] RunDLL32.exe P0620Pin.dll,RunDLL32EP 513 O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" O4 - HKLM\..\Run: [BearShare] "D:\Program Files\BearShare\BearShare.exe" /pause O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime Alternative\QTTask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1213127928\ee\AOLSoftware.exe O4 - HKLM\..\Run: ['Ashampoo AntiSpyWare 2 Guard'] C:\Program Files\Ashampoo\Ashampoo AntiSpyWare 2\AntiSpyWare2Guard.exe O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized O4 - HKCU\..\Run: [Creative WebCam Tray] "C:\Program Files\Creative\Shared Files\CamTray.exe" O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe O4 - HKCU\..\Run: [ares] "C:\Program Files\Ares\Ares.exe" -h O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033 O4 - HKCU\..\Run: [Uniblue RegistryBooster 2] C:\Program Files\Uniblue\RegistryBooster 2\RegistryBooster.exe /S O4 - HKCU\..\Run: [BitTorrent DNA] "C:\Program Files\DNA\btdna.exe" O4 - HKCU\..\Run: [ProxyWay] D:\Program Files\ProxyWay\proxyway.exe O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background O4 - HKCU\..\Run: [SpybotSD TeaTimer] d:\Program Files\Spybot - Search & Destroy\TeaTimer.exe O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Startup: OneNote 2007 Screen Clipper and Launcher.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE O4 - Startup: Microsoft Office Groove.lnk = C:\Program Files\Microsoft Office\Office12\GROOVE.EXE O4 - Global Startup: America Online 9.0 Tray Icon.lnk = C:\Program Files\America Online 9.0\aoltray.exe O4 - Global Startup: AOL Companion.lnk = C:\Program Files\AOL Companion\companion.exe O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra button: Wpis w blogu - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll (file missing) O9 - Extra 'Tools' menuitem: &Wpis w blogu w Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll (file missing) O9 - Extra button: Wyślij do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra 'Tools' menuitem: Wyślij &do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - D:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - D:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - http://www.nvidia.com/content/DriverDownload/srl/2.0.0.1/sysreqlab2.cab O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O20 - Winlogon Notify: cbXnKabA - C:\WINDOWS\ O23 - Service: Ashampoo AntiSpyWare 2 Service (AASW2_Service) - Unknown owner - C:\Program Files\Ashampoo\Ashampoo AntiSpyWare 2\AntiSpyWareService.exe O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe O23 - Service: Urządzenie mobilne Apple (Apple Mobile Device) - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - E:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: ATK Keyboard Service (ATKKeyboardService) - ASUSTeK COMPUTER INC. - C:\WINDOWS\ATKKBService.exe O23 - Service: avast! Antivirus - ALWIL Software - E:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - E:\Program Files\Alwil Software\Avast4\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - E:\Program Files\Alwil Software\Avast4\ashWebSv.exe O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: COMODO Firewall Pro Helper Service (cmdAgent) - Unknown owner - C:\Program Files\COMODO\Firewall\cmdagent.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: Usługa iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe O23 - Service: DiRT Drivers Auto Removal (pr2ah4nb) (pr2ah4nb) - CODEMASTERS - C:\WINDOWS\system32\pr2ah4nb.exe O23 - Service: FrontLine Drivers Auto Removal (v2) (sfrem02) - Protection Technology (StarForce) - C:\WINDOWS\system32\sfrem02.exe O23 - Service: Usługa Messenger Sharing Folders USN Journal Reader (usnjsvc) - Unknown owner - C:\Program Files\Windows Live\Messenger\usnsvc.exe (file missing) O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe O23 - Service: Windows Live Setup Service (WLSetupSvc) - Unknown owner - C:\Program Files\Windows Live\installer\WLSetupSvc.exe (file missing) -- End of file - 13384 bytes -- HijackThis Fixed Entries (C:\PROGRA~1\TRENDM~1\HIJACK~1\backups\) ----------- backup-20080706-181733-812 O4 - HKCU\..\RunOnce: [SpybotDeletingB6365] command /c del "C:\WINDOWS\system32\xxywVmMe.dll_old" -- File Associations ----------------------------------------------------------- [COLOR=red].cpl - cplfile - shell\cplopen\command - rundll32.exe shell32.dll,Control_RunDLL "%1",%*[/COLOR] [COLOR=red].cpl - cplfile - shell\runas\command - rundll32.exe shell32.dll,Control_RunDLLAsUser "%1",%*[/COLOR] -- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------- R0 sfdrv01 (StarForce Protection Environment Driver (version 1.x)) - c:\windows\system32\drivers\sfdrv01.sys <Not Verified; Protection Technology; StarForce Protection System> R0 sfhlp02 (StarForce Protection Helper Driver (version 2.x)) - c:\windows\system32\drivers\sfhlp02.sys <Not Verified; Protection Technology; StarForce Protection System> R0 sfsync02 (StarForce Protection Synchronization Driver (version 2.x)) - c:\windows\system32\drivers\sfsync02.sys <Not Verified; Protection Technology; StarForce Protection System> R1 asuskbnt (Enhanced Display Driver Helper Service) - c:\windows\system32\drivers\atkkbnt.sys <Not Verified; ASUSTeK COMPUTER INC.; ASUS Help driver For Keyboard Service.> R1 EIO - c:\windows\system32\drivers\eio.sys <Not Verified; ASUSTeK Computer Inc.; ASUS Kernel Mode Driver for NT> R2 AMON - c:\windows\system32\drivers\amon.sys <Not Verified; Eset; NOD32 Antivirus System> R3 asusgsb (ASUS Virtual Video Capture Device Driver) - c:\windows\system32\drivers\asusgsb.sys <Not Verified; ASUSTeK Computer Inc.; ASUS Virtual Video Capture Device Driver> R3 pfc (Padus ASPI Shell) - c:\windows\system32\drivers\pfc.sys <Not Verified; Padus, Inc.; Padus(R) ASPI Shell> R3 Video3D (ASUS Video3D Service) - c:\windows\system32\drivers\video3d32.sys <Not Verified; ASUSTeK COMPUTER INC.; ASUS Video3D driver> S2 zntport (NTPort Library Driver) - c:\windows\system32\zntport.sys (file missing) S3 catchme - c:\combofix\catchme.sys (file missing) -- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled -------------------- R2 Apple Mobile Device (Urządzenie mobilne Apple) - "c:\program files\common files\apple\mobile device support\bin\applemobiledeviceservice.exe" <Not Verified; Apple, Inc.; Apple Mobile Device Service> R2 ATKKeyboardService (ATK Keyboard Service) - c:\windows\atkkbservice.exe <Not Verified; ASUSTeK COMPUTER INC.; ASUS Keyboard Service> R2 Bonjour Service - "c:\program files\bonjour\mdnsresponder.exe" <Not Verified; Apple Inc.; Bonjour> S3 usnjsvc (Usługa Messenger Sharing Folders USN Journal Reader) - "c:\program files\windows live\messenger\usnsvc.exe" (file missing) S3 WLSetupSvc (Windows Live Setup Service) - "c:\program files\windows live\installer\wlsetupsvc.exe" (file missing) -- Device Manager: Disabled ---------------------------------------------------- No disabled devices found. -- Scheduled Tasks ------------------------------------------------------------- 2008-07-06 21:36:02 250 --a------ C:\WINDOWS\Tasks\Sprawdź aktualizacje paska narzędzi Windows Live Toolbar.job 2008-06-25 15:02:02 284 --a------ C:\WINDOWS\Tasks\AppleSoftwareUpdate.job -- Files created between 2008-06-06 and 2008-07-06 ----------------------------- 2008-07-06 18:18:31 0 d-------- C:\WINDOWS\ERUNT 2008-07-06 17:51:38 53248 --a------ C:\WINDOWS\PSEXESVC.EXE <Not Verified; Sysinternals; Sysinternals PsExec> 2008-07-06 17:28:12 0 d-------- C:\WINDOWS\pss 2008-07-06 16:13:16 11165696 --a------ C:\Documents and Settings\K01\ntuser.dat 2008-07-06 15:57:12 68096 --a------ C:\WINDOWS\zip.exe 2008-07-06 15:57:12 49152 --a------ C:\WINDOWS\VFind.exe 2008-07-06 15:57:12 212480 --a------ C:\WINDOWS\swxcacls.exe <Not Verified; SteelWerX; SteelWerX Extended Configurator ACLists> 2008-07-06 15:57:12 136704 --a------ C:\WINDOWS\swsc.exe <Not Verified; SteelWerX; SteelWerX Service Controller> 2008-07-06 15:57:12 161792 --a------ C:\WINDOWS\swreg.exe <Not Verified; SteelWerX; SteelWerX Registry Editor> 2008-07-06 15:57:12 98816 --a------ C:\WINDOWS\sed.exe 2008-07-06 15:57:12 80412 --a------ C:\WINDOWS\grep.exe 2008-07-06 15:57:12 89504 --a------ C:\WINDOWS\fdsv.exe <Not Verified; Smallfrogs Studio; > 2008-07-06 13:42:41 0 d-------- C:\Program Files\Trend Micro 2008-07-05 22:11:17 0 d-------- C:\Program Files\AskSBar 2008-07-05 22:10:58 0 d-------- C:\Program Files\COMODO 2008-07-05 21:48:31 0 d-------- C:\Program Files\Ashampoo 2008-07-05 21:01:14 0 d--hs---- C:\FOUND.012 2008-06-13 13:03:00 0 d--hs---- C:\FOUND.011 2008-06-09 18:18:19 0 d-------- C:\Program Files\AOL Companion 2008-06-09 18:18:18 0 d-------- C:\WINDOWS\occache 2008-06-09 18:18:18 0 d-------- C:\Program Files\Learn2.com 2008-06-09 18:18:15 0 d-------- C:\Program Files\Viewpoint 2008-06-09 18:18:11 0 d-------- C:\Program Files\Common Files\Nullsoft 2008-06-09 18:17:06 24659 --a------ C:\WINDOWS\system32\aolddial.dll <Not Verified; America Online, Inc.; America Online> 2008-06-09 18:16:55 65536 --a------ C:\WINDOWS\wanmpsvc.exe <Not Verified; America Online, Inc.; America Online> 2008-06-09 18:16:42 0 d-------- C:\Program Files\Common Files\aolshare 2008-06-09 18:16:38 0 d-------- C:\Program Files\America Online 9.0 2008-06-09 16:39:02 0 d-------- C:\Program Files\Common Files\AOL -- Find3M Report --------------------------------------------------------------- 2008-07-06 21:37:22 256 --a------ C:\Documents and Settings\K01\Dane aplikacji\urlredir.cfg 2008-07-05 22:11:02 0 d-------- C:\Documents and Settings\K01\Dane aplikacji\Comodo 2008-07-04 12:34:20 0 dr-h----- C:\Documents and Settings\K01\Dane aplikacji\SecuROM 2008-06-21 18:34:18 0 d-------- C:\Documents and Settings\K01\Dane aplikacji\Tibia 2008-06-11 21:39:36 0 d-------- C:\Documents and Settings\K01\Dane aplikacji\Draco Organizer 2008-06-09 16:39:02 335 --a------ C:\WINDOWS\nsreg.dat 2008-05-31 19:41:44 0 d-------- C:\Program Files\Apple Software Update 2008-05-26 23:03:34 0 d-------- C:\Program Files\Speed Gear 5 2008-05-25 11:49:54 15872 -----n--- C:\WINDOWS\system32\winskfr.dll <Not Verified; Microsoft Corporation; Contrôle Microsoft Winsock> 2008-05-25 11:49:54 119568 -----n--- C:\WINDOWS\system32\vb6fr.dll <Not Verified; Microsoft Corporation; Environnement Visual Basic> 2008-05-25 11:49:54 0 d-------- C:\Program Files\Eurobarre 2008-05-22 19:19:08 0 d-------- C:\Documents and Settings\K01\Dane aplikacji\Apple Computer 2008-05-22 19:18:58 0 d-------- C:\Program Files\iTunes 2008-05-22 19:18:58 0 d-------- C:\Program Files\iPod 2008-05-22 19:18:52 0 d-------- C:\Program Files\Bonjour 2008-05-22 19:18:02 0 d-------- C:\Program Files\Common Files\Apple 2008-04-12 17:20:54 503282 --a------ C:\WINDOWS\system32\perfh015.dat 2008-04-12 17:20:54 90208 --a------ C:\WINDOWS\system32\perfc015.dat -- Registry Dump --------------------------------------------------------------- *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{1648E328-3E5A-4EA5-A9C6-E5F09EE272DA}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{1FE4BFC2-60DB-461C-B734-1D40F120299A}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{34B713CA-2F9B-4D29-9AE5-1FD09536DB22}] C:\WINDOWS\system32\ddcCVpMF.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{C3B43F55-972B-4851-A2B8-986FB2B5C883}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D3602440-8034-47B9-9E6E-DDB6FD690815}] C:\WINDOWS\system32\xxywVmMe.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{E76F9E67-B370-490C-BFB1-5607FF8FBEBB}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{FD2FB745-D827-4AF2-AFA9-5450374110DE}] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "JMB36X IDE Setup"="C:\WINDOWS\RaidTool\xInsIDE.exe" [2007-03-20 16:36] "36X Raid Configurer"="C:\WINDOWS\system32\xRaidSetup.exe" [2007-03-21 18:23] "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-12-05 01:41] "nwiz"="nwiz.exe" [2007-12-05 01:41 C:\WINDOWS\system32\nwiz.exe] "ASUSGamerOSD"="C:\Program Files\ASUS\GamerOSD\GamerOSD.exe" [2007-06-01 09:37] "nod32kui"="C:\Program Files\Eset\nod32kui.exe" [2007-10-11 21:16] "RTHDCPL"="RTHDCPL.EXE" [2007-03-21 16:49 C:\WINDOWS\RTHDCPL.exe] "GamerOSD"="C:\Program Files\ASUS\GamerOSD\GamerOSD.exe" [2007-06-01 09:37] "PD0620 STISvc"="P0620Pin.dll" [2005-05-10 18:03 C:\WINDOWS\system32\P0620Pin.dll] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 04:25] "BearShare"="D:\Program Files\BearShare\BearShare.exe" [] "GrooveMonitor"="C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-27 00:47] "NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-12-05 01:41] "QuickTime Task"="C:\Program Files\QuickTime Alternative\QTTask.exe" [2008-03-28 23:37] "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-03-30 10:36] "HostManager"="C:\Program Files\Common Files\AOL\1213127928\ee\AOLSoftware.exe" [2006-09-26 02:52] "'Ashampoo AntiSpyWare 2 Guard'"="C:\Program Files\Ashampoo\Ashampoo AntiSpyWare 2\AntiSpyWare2Guard.exe" [2008-05-28 10:01] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-03 21:44] "Gadu-Gadu"="C:\Program Files\Gadu-Gadu\gg.exe" [2007-11-14 11:54] "Skype"="C:\Program Files\Skype\Phone\Skype.exe" [2008-02-01 17:22] "Creative WebCam Tray"="C:\Program Files\Creative\Shared Files\CamTray.exe" [2005-03-29 07:13] "swg"="C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe" [2007-12-02 16:27] "ares"="C:\Program Files\Ares\Ares.exe" [] "DAEMON Tools"="C:\Program Files\DAEMON Tools\daemon.exe" [2007-08-16 12:24] "Uniblue RegistryBooster 2"="C:\Program Files\Uniblue\RegistryBooster 2\RegistryBooster.exe" [] "Start WingMan Profiler"="" [] "BitTorrent DNA"="C:\Program Files\DNA\btdna.exe" [2008-05-08 13:07] "ProxyWay"="D:\Program Files\ProxyWay\proxyway.exe" [] "MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.exe" [] "SpybotSD TeaTimer"="d:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2008-07-03 11:45] C:\Documents and Settings\K01\Menu Start\Programy\Autostart\ OneNote 2007 Screen Clipper and Launcher.lnk - C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE [2006-10-26 20:24:54] Microsoft Office Groove.lnk - C:\Program Files\Microsoft Office\Office12\GROOVE.EXE [2006-10-27 15:37:44] C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\ America Online 9.0 Tray Icon.lnk - C:\Program Files\America Online 9.0\aoltray.exe [2008-06-09 18:17:02] AOL Companion.lnk - C:\Program Files\AOL Companion\companion.exe [2008-06-09 18:18:19] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "HideLegacyLogonScripts"=0 (0x0) "HideLogoffScripts"=0 (0x0) "RunLogonScriptSync"=1 (0x1) "RunStartupScriptSync"=0 (0x0) "HideStartupScripts"=0 (0x0) "DisableRegistryTools"=0 (0x0) [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system] "HideLegacyLogonScripts"=0 (0x0) "HideLogoffScripts"=0 (0x0) "RunLogonScriptSync"=1 (0x1) "RunStartupScriptSync"=0 (0x0) "HideStartupScripts"=0 (0x0) [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\cbXnKabA] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\PSEXESVC] @="Service" [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{aebe9133-7837-11dc-8573-806d6172696f}] AutoRun\command- D:\.\Bin\Assetup.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{f5bf102e-9cfa-11dc-9430-00304f4ef018}] AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Recycled\ctfmon.exe Open(&0)\command- Recycled\ctfmon.exe -- End of Deckard's System Scanner: finished at 2008-07-06 22:11:34 ------------

**Posty:** 8001 · przez **Okocza** 06 Lip 2008, 22:21

to na fix w hj

Kod: Zaznacz wszystko: 02 - BHO: (no name) - {1648E328-3E5A-4EA5-A9C6-E5F09EE272DA} - (no file) O2 - BHO: (no name) - {1FE4BFC2-60DB-461C-B734-1D40F120299A} - (no file) O2 - BHO: (no name) - {34B713CA-2F9B-4D29-9AE5-1FD09536DB22} - C:\WINDOWS\system32\ddcCVpMF.dll (file missing) O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) O2 - BHO: (no name) - {C3B43F55-972B-4851-A2B8-986FB2B5C883} - (no file) O2 - BHO: (no name) - {D3602440-8034-47B9-9E6E-DDB6FD690815} - C:\WINDOWS\system32\xxywVmMe.dll (file missing) O2 - BHO: (no name) - {E76F9E67-B370-490C-BFB1-5607FF8FBEBB} - (no file) O2 - BHO: (no name) - {FD2FB745-D827-4AF2-AFA9-5450374110DE} - (no file) O4 - HKLM\..\Run: [PD0620 STISvc] RunDLL32.exe P0620Pin.dll,RunDLL32EP 513

wklej do notatnika

Kod: Zaznacz wszystko: Windows Registry Editor Version 5.00 [-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{1648E328-3E5A-4EA5-A9C6-E5F09EE272DA}] [-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{1FE4BFC2-60DB-461C-B734-1D40F120299A}] [-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{34B713CA-2F9B-4D29-9AE5-1FD09536DB22}] [-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{C3B43F55-972B-4851-A2B8-986FB2B5C883}] [-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D3602440-8034-47B9-9E6E-DDB6FD690815}] [-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{E76F9E67-B370-490C-BFB1-5607FF8FBEBB}] [-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{FD2FB745-D827-4AF2-AFA9-5450374110DE}] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "PD0620 STISvc"=- [-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\cbXnKabA] [-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{aebe9133-7837-11dc-8573-806d6172696f}] [-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{f5bf102e-9cfa-11dc-9430-00304f4ef018}]

w notatniku u góry>>>plik zapisz jako>>>Zmien rozszerzenie z TXT na Wszystkie pliki *.* >>> Zapisz pod nazwą FIX.REG

Klikasz dwa razy na powstały plik fix i dodajesz go do rejestru....

pawelek13 napisał(a):Wszystko robie dobrze i naprawi sie komputer ??

zrobimy wszystko co w naszej mocy

**Posty:** 16 · przez **pawelek13** 06 Lip 2008, 22:32

Usunalem wszystko w hj co kazales stworzylem rejestr i dodalem go co dalej ??

**Posty:** 8001 · przez **Okocza** 06 Lip 2008, 22:33

log z DSS'a daj.

**Posty:** 16 · przez **pawelek13** 06 Lip 2008, 22:40

ok oto i nowy log z DSS'a

Kod: Zaznacz wszystko: Deckard's System Scanner v20071014.68 Run by K01 on 2008-07-06 22:34:17 Computer is in Normal Mode. -------------------------------------------------------------------------------- -- HijackThis (run as K01.exe) ------------------------------------------------- Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 22:34, on 2008-07-06 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16674) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\csrss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe E:\Program Files\Alwil Software\Avast4\aswUpdSv.exe E:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Ashampoo\Ashampoo AntiSpyWare 2\AntiSpyWareService.exe C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\WINDOWS\ATKKBService.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\Program Files\COMODO\Firewall\cmdagent.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\Program Files\Eset\nod32krn.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\PnkBstrA.exe C:\WINDOWS\wanmpsvc.exe E:\Program Files\Alwil Software\Avast4\ashMaiSv.exe E:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\WINDOWS\System32\alg.exe C:\WINDOWS\Explorer.EXE C:\Program Files\ASUS\GamerOSD\GamerOSD.exe C:\WINDOWS\system32\rundll32.exe C:\Program Files\Eset\nod32kui.exe C:\WINDOWS\RTHDCPL.EXE C:\WINDOWS\system32\RunDLL32.exe C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe C:\WINDOWS\system32\RUNDLL32.EXE C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\Common Files\AOL\1213127928\ee\AOLSoftware.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Creative\Shared Files\CamTray.exe C:\Program Files\DAEMON Tools\daemon.exe C:\Program Files\DNA\btdna.exe D:\Program Files\Spybot - Search & Destroy\TeaTimer.exe C:\Program Files\America Online 9.0\aoltray.exe C:\Program Files\AOL Companion\companion.exe C:\Program Files\iPod\bin\iPodService.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Documents and Settings\K01\Pulpit\dss.exe C:\PROGRA~1\TRENDM~1\HIJACK~1\K01.exe C:\WINDOWS\system32\wbem\wmiprvse.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.comodo.com/search/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - D:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O2 - BHO: Pomocnik rejestracji usługi Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll (file missing) O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll (file missing) O4 - HKLM\..\Run: [JMB36X IDE Setup] C:\WINDOWS\RaidTool\xInsIDE.exe O4 - HKLM\..\Run: [36X Raid Configurer] C:\WINDOWS\system32\xRaidSetup.exe boot O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [ASUSGamerOSD] C:\Program Files\ASUS\GamerOSD\GamerOSD.exe O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [GamerOSD] C:\Program Files\ASUS\GamerOSD\GamerOSD.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" O4 - HKLM\..\Run: [BearShare] "D:\Program Files\BearShare\BearShare.exe" /pause O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime Alternative\QTTask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1213127928\ee\AOLSoftware.exe O4 - HKLM\..\Run: ['Ashampoo AntiSpyWare 2 Guard'] C:\Program Files\Ashampoo\Ashampoo AntiSpyWare 2\AntiSpyWare2Guard.exe O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized O4 - HKCU\..\Run: [Creative WebCam Tray] "C:\Program Files\Creative\Shared Files\CamTray.exe" O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe O4 - HKCU\..\Run: [ares] "C:\Program Files\Ares\Ares.exe" -h O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033 O4 - HKCU\..\Run: [Uniblue RegistryBooster 2] C:\Program Files\Uniblue\RegistryBooster 2\RegistryBooster.exe /S O4 - HKCU\..\Run: [BitTorrent DNA] "C:\Program Files\DNA\btdna.exe" O4 - HKCU\..\Run: [ProxyWay] D:\Program Files\ProxyWay\proxyway.exe O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background O4 - HKCU\..\Run: [SpybotSD TeaTimer] d:\Program Files\Spybot - Search & Destroy\TeaTimer.exe O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Startup: OneNote 2007 Screen Clipper and Launcher.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE O4 - Startup: Microsoft Office Groove.lnk = C:\Program Files\Microsoft Office\Office12\GROOVE.EXE O4 - Global Startup: America Online 9.0 Tray Icon.lnk = C:\Program Files\America Online 9.0\aoltray.exe O4 - Global Startup: AOL Companion.lnk = C:\Program Files\AOL Companion\companion.exe O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra button: Wpis w blogu - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll (file missing) O9 - Extra 'Tools' menuitem: &Wpis w blogu w Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll (file missing) O9 - Extra button: Wyślij do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra 'Tools' menuitem: Wyślij &do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - D:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - D:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - http://www.nvidia.com/content/DriverDownload/srl/2.0.0.1/sysreqlab2.cab O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: Ashampoo AntiSpyWare 2 Service (AASW2_Service) - Unknown owner - C:\Program Files\Ashampoo\Ashampoo AntiSpyWare 2\AntiSpyWareService.exe O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe O23 - Service: Urządzenie mobilne Apple (Apple Mobile Device) - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - E:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: ATK Keyboard Service (ATKKeyboardService) - ASUSTeK COMPUTER INC. - C:\WINDOWS\ATKKBService.exe O23 - Service: avast! Antivirus - ALWIL Software - E:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - E:\Program Files\Alwil Software\Avast4\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - E:\Program Files\Alwil Software\Avast4\ashWebSv.exe O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: COMODO Firewall Pro Helper Service (cmdAgent) - Unknown owner - C:\Program Files\COMODO\Firewall\cmdagent.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: Usługa iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe O23 - Service: DiRT Drivers Auto Removal (pr2ah4nb) (pr2ah4nb) - CODEMASTERS - C:\WINDOWS\system32\pr2ah4nb.exe O23 - Service: FrontLine Drivers Auto Removal (v2) (sfrem02) - Protection Technology (StarForce) - C:\WINDOWS\system32\sfrem02.exe O23 - Service: Usługa Messenger Sharing Folders USN Journal Reader (usnjsvc) - Unknown owner - C:\Program Files\Windows Live\Messenger\usnsvc.exe (file missing) O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe O23 - Service: Windows Live Setup Service (WLSetupSvc) - Unknown owner - C:\Program Files\Windows Live\installer\WLSetupSvc.exe (file missing) -- End of file - 12434 bytes -- Files created between 2008-06-06 and 2008-07-06 ----------------------------- 2008-07-06 18:18:31 0 d-------- C:\WINDOWS\ERUNT 2008-07-06 17:51:38 53248 --a------ C:\WINDOWS\PSEXESVC.EXE <Not Verified; Sysinternals; Sysinternals PsExec> 2008-07-06 17:28:12 0 d-------- C:\WINDOWS\pss 2008-07-06 16:13:16 11165696 --a------ C:\Documents and Settings\K01\ntuser.dat 2008-07-06 15:57:12 68096 --a------ C:\WINDOWS\zip.exe 2008-07-06 15:57:12 49152 --a------ C:\WINDOWS\VFind.exe 2008-07-06 15:57:12 212480 --a------ C:\WINDOWS\swxcacls.exe <Not Verified; SteelWerX; SteelWerX Extended Configurator ACLists> 2008-07-06 15:57:12 136704 --a------ C:\WINDOWS\swsc.exe <Not Verified; SteelWerX; SteelWerX Service Controller> 2008-07-06 15:57:12 161792 --a------ C:\WINDOWS\swreg.exe <Not Verified; SteelWerX; SteelWerX Registry Editor> 2008-07-06 15:57:12 98816 --a------ C:\WINDOWS\sed.exe 2008-07-06 15:57:12 80412 --a------ C:\WINDOWS\grep.exe 2008-07-06 15:57:12 89504 --a------ C:\WINDOWS\fdsv.exe <Not Verified; Smallfrogs Studio; > 2008-07-06 13:42:41 0 d-------- C:\Program Files\Trend Micro 2008-07-05 22:11:17 0 d-------- C:\Program Files\AskSBar 2008-07-05 22:10:58 0 d-------- C:\Program Files\COMODO 2008-07-05 21:48:31 0 d-------- C:\Program Files\Ashampoo 2008-07-05 21:01:14 0 d--hs---- C:\FOUND.012 2008-06-13 13:03:00 0 d--hs---- C:\FOUND.011 2008-06-09 18:18:19 0 d-------- C:\Program Files\AOL Companion 2008-06-09 18:18:18 0 d-------- C:\WINDOWS\occache 2008-06-09 18:18:18 0 d-------- C:\Program Files\Learn2.com 2008-06-09 18:18:15 0 d-------- C:\Program Files\Viewpoint 2008-06-09 18:18:11 0 d-------- C:\Program Files\Common Files\Nullsoft 2008-06-09 18:17:06 24659 --a------ C:\WINDOWS\system32\aolddial.dll <Not Verified; America Online, Inc.; America Online> 2008-06-09 18:16:55 65536 --a------ C:\WINDOWS\wanmpsvc.exe <Not Verified; America Online, Inc.; America Online> 2008-06-09 18:16:42 0 d-------- C:\Program Files\Common Files\aolshare 2008-06-09 18:16:38 0 d-------- C:\Program Files\America Online 9.0 2008-06-09 16:39:02 0 d-------- C:\Program Files\Common Files\AOL -- Find3M Report --------------------------------------------------------------- 2008-07-06 21:37:22 256 --a------ C:\Documents and Settings\K01\Dane aplikacji\urlredir.cfg 2008-07-05 22:11:02 0 d-------- C:\Documents and Settings\K01\Dane aplikacji\Comodo 2008-07-04 12:34:20 0 dr-h----- C:\Documents and Settings\K01\Dane aplikacji\SecuROM 2008-06-21 18:34:18 0 d-------- C:\Documents and Settings\K01\Dane aplikacji\Tibia 2008-06-11 21:39:36 0 d-------- C:\Documents and Settings\K01\Dane aplikacji\Draco Organizer 2008-06-09 16:39:02 335 --a------ C:\WINDOWS\nsreg.dat 2008-05-31 19:41:44 0 d-------- C:\Program Files\Apple Software Update 2008-05-26 23:03:34 0 d-------- C:\Program Files\Speed Gear 5 2008-05-25 11:49:54 15872 -----n--- C:\WINDOWS\system32\winskfr.dll <Not Verified; Microsoft Corporation; Contrôle Microsoft Winsock> 2008-05-25 11:49:54 119568 -----n--- C:\WINDOWS\system32\vb6fr.dll <Not Verified; Microsoft Corporation; Environnement Visual Basic> 2008-05-25 11:49:54 0 d-------- C:\Program Files\Eurobarre 2008-05-22 19:19:08 0 d-------- C:\Documents and Settings\K01\Dane aplikacji\Apple Computer 2008-05-22 19:18:58 0 d-------- C:\Program Files\iTunes 2008-05-22 19:18:58 0 d-------- C:\Program Files\iPod 2008-05-22 19:18:52 0 d-------- C:\Program Files\Bonjour 2008-05-22 19:18:02 0 d-------- C:\Program Files\Common Files\Apple 2008-04-12 17:20:54 503282 --a------ C:\WINDOWS\system32\perfh015.dat 2008-04-12 17:20:54 90208 --a------ C:\WINDOWS\system32\perfc015.dat -- Registry Dump --------------------------------------------------------------- *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "JMB36X IDE Setup"="C:\WINDOWS\RaidTool\xInsIDE.exe" [2007-03-20 16:36] "36X Raid Configurer"="C:\WINDOWS\system32\xRaidSetup.exe" [2007-03-21 18:23] "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-12-05 01:41] "nwiz"="nwiz.exe" [2007-12-05 01:41 C:\WINDOWS\system32\nwiz.exe] "ASUSGamerOSD"="C:\Program Files\ASUS\GamerOSD\GamerOSD.exe" [2007-06-01 09:37] "nod32kui"="C:\Program Files\Eset\nod32kui.exe" [2007-10-11 21:16] "RTHDCPL"="RTHDCPL.EXE" [2007-03-21 16:49 C:\WINDOWS\RTHDCPL.exe] "GamerOSD"="C:\Program Files\ASUS\GamerOSD\GamerOSD.exe" [2007-06-01 09:37] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 04:25] "BearShare"="D:\Program Files\BearShare\BearShare.exe" [] "GrooveMonitor"="C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-27 00:47] "NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-12-05 01:41] "QuickTime Task"="C:\Program Files\QuickTime Alternative\QTTask.exe" [2008-03-28 23:37] "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-03-30 10:36] "HostManager"="C:\Program Files\Common Files\AOL\1213127928\ee\AOLSoftware.exe" [2006-09-26 02:52] "'Ashampoo AntiSpyWare 2 Guard'"="C:\Program Files\Ashampoo\Ashampoo AntiSpyWare 2\AntiSpyWare2Guard.exe" [2008-05-28 10:01] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-03 21:44] "Gadu-Gadu"="C:\Program Files\Gadu-Gadu\gg.exe" [2007-11-14 11:54] "Skype"="C:\Program Files\Skype\Phone\Skype.exe" [2008-02-01 17:22] "Creative WebCam Tray"="C:\Program Files\Creative\Shared Files\CamTray.exe" [2005-03-29 07:13] "swg"="C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe" [2007-12-02 16:27] "ares"="C:\Program Files\Ares\Ares.exe" [] "DAEMON Tools"="C:\Program Files\DAEMON Tools\daemon.exe" [2007-08-16 12:24] "Uniblue RegistryBooster 2"="C:\Program Files\Uniblue\RegistryBooster 2\RegistryBooster.exe" [] "Start WingMan Profiler"="" [] "BitTorrent DNA"="C:\Program Files\DNA\btdna.exe" [2008-05-08 13:07] "ProxyWay"="D:\Program Files\ProxyWay\proxyway.exe" [] "MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.exe" [] "SpybotSD TeaTimer"="d:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2008-07-03 11:45] C:\Documents and Settings\K01\Menu Start\Programy\Autostart\ OneNote 2007 Screen Clipper and Launcher.lnk - C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE [2006-10-26 20:24:54] Microsoft Office Groove.lnk - C:\Program Files\Microsoft Office\Office12\GROOVE.EXE [2006-10-27 15:37:44] C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\ America Online 9.0 Tray Icon.lnk - C:\Program Files\America Online 9.0\aoltray.exe [2008-06-09 18:17:02] AOL Companion.lnk - C:\Program Files\AOL Companion\companion.exe [2008-06-09 18:18:19] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "HideLegacyLogonScripts"=0 (0x0) "HideLogoffScripts"=0 (0x0) "RunLogonScriptSync"=1 (0x1) "RunStartupScriptSync"=0 (0x0) "HideStartupScripts"=0 (0x0) "DisableRegistryTools"=0 (0x0) [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system] "HideLegacyLogonScripts"=0 (0x0) "HideLogoffScripts"=0 (0x0) "RunLogonScriptSync"=1 (0x1) "RunStartupScriptSync"=0 (0x0) "HideStartupScripts"=0 (0x0) [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\PSEXESVC] @="Service" -- End of Deckard's System Scanner: finished at 2008-07-06 22:37:04 ------------

**Posty:** 8001 · przez **Okocza** 06 Lip 2008, 22:45

Wykonaj to co jest podane w tym temacie

1. Ściągnij OTMoveIt i go włacz i odpal go z opcji CleanUp

2. wykonaj optymalizację windowsa
3.sciagnij ATF_Cleaner
zaznacz
Windows Temp
All users Temp
Temporary internet files
Recycle Bin
i wcisnij EMPTY SELECTED
4.Wyłącz przywracanie systemu ( właściwości mój komputer-zakładka przywracanie - wyłącz przywracanie na wszystkich dyskach). Po chwili włącz je powrotem
5. Przeskanuj komputer pod względem Trojanów tym programem

**Posty:** 16 · przez **pawelek13** 06 Lip 2008, 23:24

z tymi portami wszystko ok tylko srodkowy jest z zoltym trojkatem i wykrzyknikiem w srodku i jak klikam to uruchamia ponownie komputer i jest tak samo

ten program OTMoveIt nie dziala u mnie wlaczam go klikam CleanUp i zawiesza program i pisze brak odpowiedzi

zawiesilem kilka programow przy wlaczaniu komputera i teraz wlacza sie szybciej

ATF_Cleaner dziala zrobilem wszysko jak kazales

z przywracaniem systemu tez sobie poradzilem

tutaj na wszelki wypadek wklejam Log z tego programu ktory usuwa trojany

Kod: Zaznacz wszystko: ******************************************************************************** * * * FixIEDef Log * * Version 1.4.20.5916 * * * ******************************************************************************** Created at 23:23:53 on Sunday, July 06, 2008 Time Zone : Logged On User : K01 Operating System : Microsoft Windows XP Professional Dodatek Service Pack 2 OS Version : 5.1.2600 System Langauge : Polish Keyboard Layout : Polish Processor : X86 Intel(R) Core(TM)2 Duo CPU E4500 @ 2.20GHz System Drive : C:\ Windows Directory : C:\WINDOWS System Directory : C:\WINDOWS\system32 Total Physical Memory : 3488649216 bytes Free Physical Memory : 2592256 bytes Total Virtual Memory : 2097024 bytes Free Virtual Memory : 2051432 bytes Boot State : Normal boot -------------------------------------------------------------------------------- !!! Files that have been deleted !!! C:\WINDOWS\WLXPGSS.SCR -------------------------------------------------------------------------------- !!! Directories that have been removed !!! No malicious directories to be removed -------------------------------------------------------------------------------- !!! Registry entries that have been removed !!! No malicious Registry entries found ================================================================================ All Done :) ShadowPuterDude Safe Surfing!!!

**Posty:** 18165 · przez **wojtas** 07 Lip 2008, 00:55

jest jakis problem jeszcze ?

**Posty:** 16 · przez **pawelek13** 07 Lip 2008, 09:50

jakiegos duzego problemu nie ma tylko jak wlaczam przegladarke to wyskakuje komunikat

Tutaj screen:

i jeszcze jakby mi ktos podal caly zestaw zabezpieczajacy komputer aby uniknac tego rodzaju "wypadkow"

**Posty:** 8001 · przez **Okocza** 07 Lip 2008, 09:52

wyczysc wszystko w przegladarce.

nod32 + zdrowy rozsadek

komputer sie zawiesza i wolniej chodzi

Komputer sie zawiesza i wolniej chodzi

Kto jest na forum