Proszę o sprawdzenie logów (czarny ekran,reaktywacja windows

**Posty:** 47 · przez **MmarcinekK** 10 Gru 2008, 18:32

Witam
Proszę o sprawdzenie logów. Problem zaczął się od tego że przy włączeniu windowsa automatycznie otwierały się dwa okna z Moimi Dokumentami oraz wyskakiwał komunikat z deamon tools "Virtual SCSI driver not detected". Potem doszło do tego ze przy włączaniu kompa prawie odrazu ekran stawał sie czarny i trzeba restartować kompa żeby obraz wrócił. Nastepny problme który sie pojawił to komunikat "od czasu pierwszej aktywacji systemu Windows na tym komputerze,sprzet komputera został w znaczącym stopniu zmieniony ... windows musi byc reaktywowany w ciągu 3 dni" z tym ze żednaego sprzętu nie zmieniałem. Wrzucam logi z comboxa i hijacka

Combofix: http://wklej.org/hash/173982d5e1/

Hijack

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 17:31:33, on 2008-12-10 Platform: Windows XP Dodatek SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16735) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Common Files\LightScribe\LSSrvc.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe C:\WINDOWS\SOUNDMAN.EXE C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe D:\Program Files\Nokia6300\Nokia PC Suite 6\LaunchApplication.exe C:\WINDOWS\system32\ctfmon.exe C:\Documents and Settings\Marcin\Ustawienia lokalne\Dane aplikacji\Google\Update\GoogleUpdate.exe C:\Program Files\PC Connectivity Solution\ServiceLayer.exe C:\Program Files\Creative\Creative Live! Cam\Live! Cam Manager\CTLCMgr.exe D:\Program Files\AVerTV\QuickTV.exe C:\WINDOWS\system32\wpabaln.exe C:\WINDOWS\explorer.exe C:\WINDOWS\system32\wscntfy.exe C:\Program Files\Opera\opera.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: IEVkbdBHO - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - D:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\ievkbd.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) O2 - BHO: Pomocnik rejestracji usługi Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll O4 - HKLM\..\Run: [WinFast2KLoadDefault] rundll32.exe wf2kcpl.dll,DllLoadDefaultSettings O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033 O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" O4 - HKLM\..\Run: [AVP] "D:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe" O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [PCSuiteTrayApplication] D:\Program Files\Nokia6300\Nokia PC Suite 6\LaunchApplication.exe -startup O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_9 -reboot 1 O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Marcin\Ustawienia lokalne\Dane aplikacji\Google\Update\GoogleUpdate.exe" /c O4 - HKCU\..\Run: [EXPLORER.EXE] EXPLORER.EXE O4 - HKCU\..\Run: [Creative Live! Cam Manager] "C:\Program Files\Creative\Creative Live! Cam\Live! Cam Manager\CTLCMgr.exe" O4 - HKCU\..\Run: [CTRegRun] C:\WINDOWS\CTRegRun.EXE O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\S-1-5-18\..\Run: [Nokia.PCSync] D:\Program Files\Nokia6300\Nokia PC Suite 6\PcSync2.exe /NoDialog (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O4 - Global Startup: Microsoft Office.lnk = D:\Program Files\Microsoft Office\Office10\OSA.EXE O4 - Global Startup: QuickTV.lnk = D:\Program Files\AVerTV\QuickTV.exe O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://D:\PROGRA~1\MICROS~1\Office10\EXCEL.EXE/3000 O8 - Extra context menu item: Easy-WebPrint Add To Print List - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html O8 - Extra context menu item: Easy-WebPrint High Speed Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html O8 - Extra context menu item: Easy-WebPrint Preview - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html O8 - Extra context menu item: Easy-WebPrint Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra button: Statystyki ochrony WWW - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - D:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\SCIEPlgn.dll O9 - Extra button: Wpis w blogu - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll O9 - Extra 'Tools' menuitem: &Wpis w blogu w Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {1E53EA77-34F2-474E-9046-B2B0C86F1821} (OggX Control) - http://www.eska.pl/streamplayers/OggX.ocx O16 - DPF: {68282C51-9459-467B-95BF-3C0E89627E55} (MksSkanerOnline Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/softwareupdate/su2/ocx/15106/CTPID.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{A1B97CD2-010F-4172-B328-0F9996089E6D}: NameServer = 217.153.14.131,192.168.4.1 O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.116.46 85.255.112.93 O17 - HKLM\System\CS3\Services\Tcpip\Parameters: NameServer = 217.153.14.131 192.168.4.1 O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: Kaspersky Anti-Virus (AVP) - Kaspersky Lab - D:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe O23 - Service: KFWV - Unknown owner - C:\DOCUME~1\Marcin\USTAWI~1\Temp\KFWV.exe (file missing) O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe O23 - Service: WinFast(R) Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe O23 - Service: Z - Unknown owner - C:\DOCUME~1\Marcin\USTAWI~1\Temp\Z.exe (file missing) -- End of file - 8330 bytes

**Posty:** 18165 · przez **wojtas** 10 Gru 2008, 18:42

skasuj w hijacku:

O4 - HKCU\..\Run: [EXPLORER.EXE] EXPLORER.EXE
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.116.46 85.255.112.93
O23 - Service: KFWV - Unknown owner - C:\DOCUME~1\Marcin\USTAWI~1\Temp\KFWV.exe (file missing)
O23 - Service: Z - Unknown owner - C:\DOCUME~1\Marcin\USTAWI~1\Temp\Z.exe (file missing)

Ściągnij program Fixwareout i zastosuj go

Otworz notatnik i wklej w nim to:

Registry::
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{2f11acc8-2983-11dd-a012-0015f20062ad}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{7f617eb2-76ac-11dd-a0c6-0015f20062ad}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{829d9026-6c65-11dd-a0a2-0015f20062ad}]

Driver::
Z
KFWV

>>Plik>>Zapisz jako... >>> CFScript
Przeciągnij i upuść plik CFScript.txt na plik ComboFix.exe
-->

Ma się rozpocząć usuwanie. (i powstanie log).Daj ten log, który powstanie w trakcie usuwania.

**Posty:** 47 · przez **MmarcinekK** 10 Gru 2008, 20:24

Kod: Zaznacz wszystko: ComboFix 08-12-09.03 - Marcin 2008-12-10 19:18:14.4 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.3.1250.1.1045.18.1107 [GMT 1:00] Uruchomiony z: d:\instalki\ComboFix.exe Użyto następujących komend :: d:\instalki\CFScript.txt * Utworzono nowy punkt przywracania [COLOR=RED][B]UWAGA - TEN KOMPUTER NIE MA ZAINSTALOWANEJ KONSOLI ODZYSKIWANIA !![/B][/COLOR] . ((((((((((((((((((((((((((((((((((((((( Usunięto ))))))))))))))))))))))))))))))))))))))))))))))))) . . ((((((((((((((((((((((((((((((((((((((( Sterowniki/Usługi ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Legacy_KFWV -------\Legacy_Z -------\Service_KFWV -------\Service_Z ((((((((((((((((((((((((( Pliki utworzone od 2008-11-10 do 2008-12-10 ))))))))))))))))))))))))))))))) . 2008-12-10 19:07 . 2008-12-10 19:12 <DIR> d-------- C:\fixwareout 2008-12-09 18:28 . 2008-12-09 18:28 <DIR> d-------- c:\program files\Trend Micro 2008-12-08 18:40 . 2008-12-08 18:40 <DIR> d-------- c:\program files\directx 2008-12-01 14:29 . 2008-12-01 14:29 <DIR> d-------- c:\program files\Ashampoo 2008-11-22 10:39 . 2008-11-22 10:39 <DIR> d-------- c:\program files\Common Files\Skype 2008-11-22 10:39 . 2008-11-22 10:39 56 --ah----- c:\windows\system32\ezsidmv.dat 2008-11-13 10:25 . 2008-10-24 12:21 455,296 -----c--- c:\windows\system32\dllcache\mrxsmb.sys 2008-11-13 10:24 . 2008-09-04 18:17 1,106,944 -----c--- c:\windows\system32\dllcache\msxml3.dll . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-12-10 18:21 614,432 --sha-w c:\windows\system32\drivers\fidbox2.dat 2008-12-10 18:21 5,276 --sha-w c:\windows\system32\drivers\fidbox2.idx 2008-12-10 18:21 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\Kaspersky Lab 2008-12-10 18:19 3,275,808 --sha-w c:\windows\system32\drivers\fidbox.dat 2008-12-10 18:19 28,768 --sha-w c:\windows\system32\drivers\fidbox.idx 2008-12-09 20:30 --------- d-----w c:\program files\DC++ 2008-12-09 20:07 --------- d-----w c:\documents and settings\Marcin\Dane aplikacji\Skype 2008-12-09 18:16 --------- d-----w c:\documents and settings\Marcin\Dane aplikacji\uTorrent 2008-12-09 17:12 --------- d-----w c:\documents and settings\Marcin\Dane aplikacji\skypePM 2008-12-08 17:40 --------- d--h--w c:\program files\InstallShield Installation Information 2008-12-03 19:01 --------- d-----w c:\program files\Gadu-Gadu 2008-11-28 13:58 --------- d-----w c:\documents and settings\Marcin\Dane aplikacji\PC Suite 2008-11-17 22:28 35,792 ----a-w c:\documents and settings\Marcin\Dane aplikacji\GDIPFONTCACHEV1.DAT 2008-11-08 19:41 --------- d-----w c:\documents and settings\Marcin\Dane aplikacji\Nokia 2008-11-02 14:04 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\nView_Profiles 2008-11-01 14:45 96,384 ----a-w c:\windows\system32\drivers\sptd3997.sys 2008-10-29 22:15 --------- d---a-w c:\documents and settings\All Users\Dane aplikacji\TEMP 2008-10-29 22:01 --------- d-----w c:\documents and settings\Marcin\Dane aplikacji\Simply Super Software 2008-10-29 22:01 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\Simply Super Software 2008-10-24 11:21 455,296 ----a-w c:\windows\system32\drivers\mrxsmb.sys 2008-10-22 16:42 --------- d-----w c:\program files\Clean MemXP 2008-10-18 11:06 --------- d-----w c:\documents and settings\Marcin\Dane aplikacji\Creative 2008-10-18 10:59 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\Creative 2008-10-18 10:54 --------- d-----w c:\program files\Creative 2008-10-18 10:50 --------- d-----w c:\program files\muvee Technologies 2008-10-18 10:50 --------- d-----w c:\program files\Common Files\muvee Technologies 2008-10-18 10:49 --------- d-----w c:\documents and settings\Marcin\Dane aplikacji\InstallShield 2008-10-18 10:49 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\muvee Technologies 2008-10-18 10:48 --------- d-----w c:\program files\SightSpeed 2008-10-17 22:47 --------- d-----w c:\program files\OpenAL 2008-10-13 20:26 --------- d-----w c:\program files\Gems 3D 2008-10-12 11:08 --------- d-----w c:\program files\Common Files\Imagine 2008-09-12 16:18 73,216 ----a-w c:\windows\ST6UNST.EXE 2008-03-03 20:46 32 ----a-w c:\documents and settings\All Users\Dane aplikacji\ezsid.dat . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Gadu-Gadu"="c:\program files\Gadu-Gadu\gg.exe" [2007-05-10 2111176] "updateMgr"="c:\program files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2006-03-30 313472] "ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360] "Google Update"="c:\documents and settings\Marcin\Ustawienia lokalne\Dane aplikacji\Google\Update\GoogleUpdate.exe" [2008-09-04 133104] "Creative Live! Cam Manager"="c:\program files\Creative\Creative Live! Cam\Live! Cam Manager\CTLCMgr.exe" [2007-06-07 155648] "CTRegRun"="c:\windows\CTRegRun.EXE" [2006-10-06 53248] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "DAEMON Tools"="c:\program files\DAEMON Tools\daemon.exe" [2005-12-10 133016] "NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648] "SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2005-05-25 6746112] "PCSuiteTrayApplication"="d:\program files\Nokia6300\Nokia PC Suite 6\LaunchApplication.exe" [2007-03-23 227328] "AVP"="d:\program files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe" [2008-04-25 201992] "WinFast2KLoadDefault"="wf2kcpl.dll" [2005-04-14 c:\windows\system32\WF2KCPL.dll] "SoundMan"="SOUNDMAN.EXE" [2004-11-15 c:\windows\SOUNDMAN.EXE] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360] "Nokia.PCSync"="d:\program files\Nokia6300\Nokia PC Suite 6\PcSync2.exe" [2007-03-27 1744896] c:\documents and settings\All Users\Menu Start\Programy\Autostart\ Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 29696] Microsoft Office.lnk - d:\program files\Microsoft Office\Office10\OSA.EXE [2001-02-13 83360] QuickTV.lnk - d:\program files\AVerTV\QuickTV.exe [2005-02-16 401408] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "msacm.dvacm"= c:\progra~1\COMMON~1\ULEADS~1\Vio\Dvacm.acm "msacm.MPEGacm"= c:\progra~1\COMMON~1\ULEADS~1\MPEG\MPEGacm.acm "msacm.ulmp3acm"= c:\progra~1\COMMON~1\ULEADS~1\MPEG\ulmp3acm.acm [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Easy-PrintToolBox] --a------ 2004-01-14 12:10 409600 c:\program files\Canon\Easy-PrintToolBox\BJPSMAIN.EXE [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GG Tools] --a------ 2008-07-16 13:10 2242560 d:\program files\kRk Software\GG Tools\GGT.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr] --a------ 2007-10-18 10:34 5724184 c:\progra~1\WI1F86~1\MESSEN~1\msnmsgr.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon] --a------ 2005-05-25 22:02 6746112 c:\windows\system32\nvcpl.dll [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NVIDIA nTune] --a------ 2004-12-06 12:06 532480 c:\program files\NVIDIA Corporation\nTune\nTune.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter] --a------ 2005-05-25 22:02 86016 c:\windows\system32\nvmctray.dll [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCSuiteTrayApplication] --a------ 2007-03-23 12:20 227328 d:\program files\Nokia6300\Nokia PC Suite 6\LaunchApplication.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TrojanScanner] --a------ 2008-10-25 16:47 968072 d:\program files\Trojan Remover\Trjscan.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UVS10 Preload] --------- 2006-08-09 14:27 36864 c:\program files\Ulead Systems\Ulead VideoStudio SE\uvPL.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\V0420Mon.exe] -ra------ 2007-04-30 02:00 32768 c:\windows\V0420Mon.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinFoxV2] --a------ 2005-07-22 10:43 1310720 c:\windows\system32\Wf2k.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz] --a------ 2005-05-25 22:02 1519616 c:\windows\system32\nwiz.exe [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\Gadu-Gadu\\gg.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "c:\\Program Files\\DC++\\DCPlusPlus.exe"= "c:\\Program Files\\uTorrent\\uTorrent.exe"= "c:\\Program Files\\Opera\\Opera.exe"= "c:\\Documents and Settings\\All Users\\Dane aplikacji\\Kaspersky Lab Setup Files\\Kaspersky Anti-Virus 2009\\Polish\\setup.exe"= "c:\\Program Files\\Messenger\\msmsgs.exe"= "c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"= "c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"= "d:\\Program Files\\Rockstar Games\\GTA2\\gta2.exe"= "c:\\WINDOWS\\system32\\dplaysvr.exe"= "c:\\Program Files\\Skype\\Phone\\Skype.exe"= R0 klbg;Kaspersky Lab Boot Guard Driver;c:\windows\system32\drivers\klbg.sys [2008-01-29 32784] R2 ACEDRV09;ACEDRV09;\??\c:\windows\system32\drivers\ACEDRV09.sys [2008-10-08 110304] R3 klim5;Kaspersky Anti-Virus NDIS Filter;c:\windows\system32\DRIVERS\klim5.sys [2008-03-25 24592] R3 PhTVTune;Cap7134 TVTuner;c:\windows\system32\DRIVERS\PhTVTune.sys [2008-01-25 54304] R3 V0420VID;Live! Cam Vista IM (VF0420);c:\windows\system32\DRIVERS\V0420Vid.sys [2008-10-18 99648] R4 WINFOXIO;WINFOXIO;\??\c:\windows\system32\Drivers\WINFOXIO.SYS [2008-01-19 9600] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{43926691-c67a-11dc-97d5-806d6172696f}] \Shell\AutoRun\command - F:\ASUSACPI.exe . Zawartość folderu 'Zaplanowane zadania' 2008-12-10 c:\windows\Tasks\GoogleUpdateTaskUser.job - c:\documents and settings\Marcin\Ustawienia lokalne\Dane aplikacji\Google\Update\GoogleUpdate.exe [2008-09-04 14:23] . . ------- Skan uzupełniający ------- . IE: E&ksport do programu Microsoft Excel - d:\progra~1\MICROS~1\Office10\EXCEL.EXE/3000 IE: Easy-WebPrint Add To Print List - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html IE: Easy-WebPrint High Speed Print - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html IE: Easy-WebPrint Preview - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html IE: Easy-WebPrint Print - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html c:\windows\Downloaded Program Files\OggX.ocx - O16 -: {1E53EA77-34F2-474E-9046-B2B0C86F1821} hxxp://www.eska.pl/streamplayers/OggX.ocx c:\windows\system32\SkanerOnlineUninstall.exe - c:\windows\system32\SkanerOnline.dll O16 -: {68282C51-9459-467B-95BF-3C0E89627E55} hxxp://www.mks.com.pl/skaner/SkanerOnline.cab c:\windows\Downloaded Program Files\SkanerOnline.inf FireFox -: Profile - c:\documents and settings\Marcin\Dane aplikacji\Mozilla\Firefox\Profiles\td26742e.default\ FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://www.onet.pl . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-12-10 19:21:04 Windows 5.1.2600 Dodatek Service Pack 3 NTFS skanowanie ukrytych procesów ... skanowanie ukrytych wpisów autostartu ... skanowanie ukrytych plików ... skanowanie pomyślnie ukończone ukryte pliki: 0 ************************************************************************** . --------------------- Pliki DLL ładowane pod uruchomionymi procesami --------------------- - - - - - - - > 'winlogon.exe'(1108) c:\windows\system32\klogon.dll . ------------------------ Pozostałe uruchomione procesy ------------------------ . c:\program files\Common Files\LightScribe\LSSrvc.exe c:\windows\system32\nvsvc32.exe c:\program files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe c:\program files\PC Connectivity Solution\ServiceLayer.exe c:\windows\system32\wscntfy.exe c:\windows\system32\wpabaln.exe . ************************************************************************** . Czas ukończenia: 2008-12-10 19:23:28 - komputer został uruchomiony ponownie ComboFix-quarantined-files.txt 2008-12-10 18:23:14 ComboFix2.txt 2008-12-10 16:20:23 ComboFix3.txt 2008-04-13 20:06:08 Przed: 2 389 569 536 bajtów wolnych Po: 2,376,093,696 bajtów wolnych 198 --- E O F --- 2008-11-13 21:09:54

**Posty:** 18165 · przez **wojtas** 10 Gru 2008, 22:28

1. Ściągnij OTMoveIt i go włacz i odpal go z opcji CleanUp

oraz skasuj folder C:\Qoobox
2. wykonaj optymalizację windowsa
3.sciagnij ATF_Cleaner
zaznacz
Windows Temp
All users Temp
Temporary internet files
Recycle Bin
i wcisnij EMPTY SELECTED
4.Wyłącz przywracanie systemu ( właściwości mój komputer-zakładka przywracanie - wyłącz przywracanie na wszystkich dyskach). Po chwili włącz je powrotem
5.Przeskanuj obszar mojego komputera http://www.kaspersky.pl/virusscanner.html (uruchom przez IE) Daj raport z niego na forum.

i tym:

FixIEDef.

**Posty:** 47 · przez **MmarcinekK** 16 Gru 2008, 16:41

Wszystko wykonałem opórcz skanowania kasperskym online ponieważ mam zainstalowanego na komputerze a wtedy wyskakuje mi błąd że nie da rady przeskanowac online. W każdy razie mój kaspersky wykrywa wirusa Virus.Win32.VB.bu w folderze C;\windows\system32\explorer.exe (dodam ze kilka razy już usuwałem go przez kasperskiego ale nie daje skutku)
W miedzyczase reaktywowałem system windows i zainstalowałem deamona od nowa wiec te problemy mam za sobą.
Przez pewien czas po twoich operacjach nie wyskakiwały juz moje dokumenty jednak znowu to robia po załadowaniu windowsa oraz jeśli chodzi o czrny ekran to eraz musze juz conajmiej 5 razy zresetować kompa żeby normalnie było widac jak sie ładuje windows i zeby cokolwiek zobaczyć

**Posty:** 8001 · przez **Okocza** 16 Gru 2008, 16:43

MmarcinekK, daj log z rsit'a

**Posty:** 47 · przez **MmarcinekK** 16 Gru 2008, 18:58

Kod: Zaznacz wszystko: Logfile of random's system information tool 1.04 (written by random/random) Run by Marcin at 2008-12-16 17:57:33 Microsoft Windows XP Professional Dodatek Service Pack 3 System drive C: has 2 GB (16%) free of 10 GB Total RAM: 1535 MB (74% free) Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 17:57:39, on 2008-12-16 Platform: Windows XP Dodatek SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16762) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\EXPLORER.EXE C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\SOUNDMAN.EXE C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Creative\Creative Live! Cam\Live! Cam Manager\CTLCMgr.exe C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe C:\Program Files\Common Files\LightScribe\LSSrvc.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe D:\Program Files\AVerTV\QuickTV.exe C:\Program Files\PC Connectivity Solution\ServiceLayer.exe C:\WINDOWS\system32\wscntfy.exe C:\Documents and Settings\Marcin\Ustawienia lokalne\Dane aplikacji\Google\Update\GoogleUpdate.exe C:\Program Files\Gadu-Gadu\gg.exe C:\Program Files\Opera\opera.exe D:\instalki\RSIT.exe C:\Program Files\Trend Micro\HijackThis\Marcin.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza F2 - REG:system.ini: UserInit=userinit.exe,EXPLORER.EXE O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: IEVkbdBHO - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - D:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\ievkbd.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) O2 - BHO: Pomocnik rejestracji usługi Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll O3 - Toolbar: DAEMON Tools Toolbar - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll O4 - HKLM\..\Run: [WinFast2KLoadDefault] rundll32.exe wf2kcpl.dll,DllLoadDefaultSettings O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [PCSuiteTrayApplication] D:\Program Files\Nokia6300\Nokia PC Suite 6\LaunchApplication.exe -startup O4 - HKLM\..\Run: [AVP] "D:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe" O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_9 -reboot 1 O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [Creative Live! Cam Manager] "C:\Program Files\Creative\Creative Live! Cam\Live! Cam Manager\CTLCMgr.exe" O4 - HKCU\..\Run: [CTRegRun] C:\WINDOWS\CTRegRun.EXE O4 - HKCU\..\Run: [wsctf.exe] wsctf.exe O4 - HKCU\..\Run: [EXPLORER.EXE] EXPLORER.EXE O4 - HKCU\..\Run: [LightScribe Control Panel] C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe -hidden O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\S-1-5-18\..\Run: [Nokia.PCSync] D:\Program Files\Nokia6300\Nokia PC Suite 6\PcSync2.exe /NoDialog (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O4 - Global Startup: Microsoft Office.lnk = D:\Program Files\Microsoft Office\Office10\OSA.EXE O4 - Global Startup: QuickTV.lnk = D:\Program Files\AVerTV\QuickTV.exe O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://D:\PROGRA~1\MICROS~1\Office10\EXCEL.EXE/3000 O8 - Extra context menu item: Easy-WebPrint Add To Print List - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html O8 - Extra context menu item: Easy-WebPrint High Speed Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html O8 - Extra context menu item: Easy-WebPrint Preview - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html O8 - Extra context menu item: Easy-WebPrint Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra button: Statystyki ochrony WWW - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - D:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\SCIEPlgn.dll O9 - Extra button: Wpis w blogu - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll O9 - Extra 'Tools' menuitem: &Wpis w blogu w Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {1E53EA77-34F2-474E-9046-B2B0C86F1821} (OggX Control) - http://www.eska.pl/streamplayers/OggX.ocx O16 - DPF: {68282C51-9459-467B-95BF-3C0E89627E55} (MksSkanerOnline Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/softwareupdate/su2/ocx/15106/CTPID.cab O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.116.46 85.255.112.93 O17 - HKLM\System\CS3\Services\Tcpip\Parameters: NameServer = 217.153.14.131 192.168.4.1 O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: Kaspersky Anti-Virus (AVP) - Kaspersky Lab - D:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe O23 - Service: WinFast(R) Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe -- End of file - 8271 bytes ======Scheduled tasks folder====== C:\WINDOWS\tasks\GoogleUpdateTaskUser.job ======Registry dump====== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}] Adobe PDF Reader Link Helper - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll [2006-12-18 59032] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C}] IEVkbdBHO Class - D:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\ievkbd.dll [2008-09-18 62728] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}] SSVHelper Class - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll [2008-06-10 509328] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7E853D72-626A-48EC-A868-BA8D5E23E045}] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}] Pomocnik rejestracji usługi Windows Live - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2007-09-20 328752] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar] {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - Easy-WebPrint - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll [2004-08-26 405504] {32099AAC-C132-4136-9E9A-4E364A424E17} - DAEMON Tools Toolbar - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll [2008-12-10 929224] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run] "WinFast2KLoadDefault"=C:\WINDOWS\system32\wf2kcpl.dll [2005-04-14 612352] "SoundMan"=C:\WINDOWS\SOUNDMAN.EXE [2004-11-15 77824] "NeroFilterCheck"=C:\WINDOWS\system32\NeroCheck.exe [2001-07-09 155648] "SunJavaUpdateSched"=C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe [2008-06-10 144784] "NvCplDaemon"=C:\WINDOWS\system32\NvCpl.dll [2005-05-25 6746112] "PCSuiteTrayApplication"=D:\Program Files\Nokia6300\Nokia PC Suite 6\LaunchApplication.exe [2007-03-23 227328] "AVP"=D:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe [2008-04-25 201992] [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run] "Gadu-Gadu"=C:\Program Files\Gadu-Gadu\gg.exe [2007-05-10 2111176] "updateMgr"=C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe [2006-03-30 313472] "ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe [2008-04-14 15360] "Creative Live! Cam Manager"=C:\Program Files\Creative\Creative Live! Cam\Live! Cam Manager\CTLCMgr.exe [2007-06-07 155648] "CTRegRun"=C:\WINDOWS\CTRegRun.EXE [2006-10-06 53248] "wsctf.exe"=wsctf.exe [] "EXPLORER.EXE"=C:\WINDOWS\EXPLORER.EXE [2008-04-14 1035264] "LightScribe Control Panel"=C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe [2008-08-22 2363392] "DAEMON Tools Lite"=C:\Program Files\DAEMON Tools Lite\daemon.exe [2008-12-10 216520] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Easy-PrintToolBox] C:\Program Files\Canon\Easy-PrintToolBox\BJPSMAIN.EXE [2004-01-14 409600] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GG Tools] d:\Program Files\kRk Software\GG Tools\GGT.exe [2008-07-16 2242560] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Update] C:\Documents and Settings\Marcin\Ustawienia lokalne\Dane aplikacji\Google\Update\GoogleUpdate.exe [2008-09-04 133104] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr] C:\PROGRA~1\WI1F86~1\MESSEN~1\msnmsgr.exe [2007-10-18 5724184] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon] C:\WINDOWS\system32\NvCpl.dll [2005-05-25 6746112] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NVIDIA nTune] C:\Program Files\NVIDIA Corporation\nTune\\nTune.exe [2004-12-06 532480] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter] C:\WINDOWS\system32\NvMcTray.dll [2005-05-25 86016] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz] nwiz.exe /install [] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCSuiteTrayApplication] D:\Program Files\Nokia6300\Nokia PC Suite 6\LaunchApplication.exe [2007-03-23 227328] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TrojanScanner] d:\Program Files\Trojan Remover\Trjscan.exe [2008-10-25 968072] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UVS10 Preload] C:\Program Files\Ulead Systems\Ulead VideoStudio SE\uvPL.exe [2006-08-09 36864] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\V0420Mon.exe] C:\WINDOWS\V0420Mon.exe [2007-04-30 32768] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinFoxV2] C:\WINDOWS\system32\WF2K.EXE [2005-07-22 1310720] C:\Documents and Settings\All Users\Menu Start\Programy\Autostart Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe Microsoft Office.lnk - D:\Program Files\Microsoft Office\Office10\OSA.EXE QuickTV.lnk - D:\Program Files\AVerTV\QuickTV.exe [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\klogon] C:\WINDOWS\system32\klogon.dll [2008-04-25 206088] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad] WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{1a3e09be-1e45-494b-9174-d7385b45bbf5}] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System] "dontdisplaylastusername"=0 "legalnoticecaption"= "legalnoticetext"= "shutdownwithoutlogon"=1 "undockwithoutlogon"=1 [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer] "NoDriveTypeAutoRun"=323 "NoDrives"=0 "NoDriveAutoRun"=67108863 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer] "NoDriveAutoRun"= "NoDriveTypeAutoRun"= "NoDrives"= [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] "%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "C:\Program Files\Gadu-Gadu\gg.exe"="C:\Program Files\Gadu-Gadu\gg.exe:*:Enabled:Gadu-Gadu - program główny" "%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000" "C:\Program Files\DC++\DCPlusPlus.exe"="C:\Program Files\DC++\DCPlusPlus.exe:*:Enabled:DC++" "C:\Program Files\uTorrent\uTorrent.exe"="C:\Program Files\uTorrent\uTorrent.exe:*:Enabled:µTorrent" "C:\Program Files\Opera\Opera.exe"="C:\Program Files\Opera\Opera.exe:*:Enabled:Opera Internet Browser" "C:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab Setup Files\Kaspersky Anti-Virus 2009\Polish\setup.exe"="C:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab Setup Files\Kaspersky Anti-Virus 2009\Polish\setup.exe:*:Enabled:Kaspersky Anti-Virus 2009 Setup" "C:\Program Files\Messenger\msmsgs.exe"="C:\Program Files\Messenger\msmsgs.exe:*:Enabled:Windows Messenger" "C:\Program Files\Windows Live\Messenger\msnmsgr.exe"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger" "C:\Program Files\Windows Live\Messenger\livecall.exe"="C:\Program Files\Windows Live\Messenger\livecall.exe:*:Enabled:Windows Live Messenger (Phone)" "D:\Program Files\Rockstar Games\GTA2\gta2.exe"="D:\Program Files\Rockstar Games\GTA2\gta2.exe:*:Enabled:GTA2 main executable" "C:\WINDOWS\system32\dplaysvr.exe"="C:\WINDOWS\system32\dplaysvr.exe:*:Enabled:Microsoft DirectPlay Helper" "D:\X.Plane.9-AVENGED\X-Plane 9\X-Plane.exe"="D:\X.Plane.9-AVENGED\X-Plane 9\X-Plane.exe:*:Enabled:X-Plane" "C:\Program Files\Skype\Phone\Skype.exe"="C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype. Take a deep breath " [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list] "%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000" "C:\Program Files\Windows Live\Messenger\msnmsgr.exe"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger" "C:\Program Files\Windows Live\Messenger\livecall.exe"="C:\Program Files\Windows Live\Messenger\livecall.exe:*:Enabled:Windows Live Messenger (Phone)" [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{43926691-c67a-11dc-97d5-806d6172696f}] shell\AutoRun\command - F:\ASUSACPI.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{7f617eb2-76ac-11dd-a0c6-0015f20062ad}] shell\AutoRun\command - H:\EXPLORER.EXE shell\explore\command - H:\EXPLORER.EXE shell\open\command - H:\EXPLORER.EXE ======List of files/folders created in the last 1 months====== 2008-12-16 17:57:33 ----D---- C:\rsit 2008-12-14 15:43:26 ----D---- C:\Documents and Settings\Marcin\Dane aplikacji\DAEMON Tools Pro 2008-12-14 15:43:26 ----D---- C:\Documents and Settings\Marcin\Dane aplikacji\DAEMON Tools 2008-12-14 15:40:24 ----D---- C:\Documents and Settings\All Users\Dane aplikacji\DAEMON Tools Lite 2008-12-14 15:40:17 ----D---- C:\Program Files\DAEMON Tools Toolbar 2008-12-14 15:40:12 ----D---- C:\Program Files\DAEMON Tools Lite 2008-12-14 15:37:03 ----D---- C:\Documents and Settings\Marcin\Dane aplikacji\DAEMON Tools Lite 2008-12-13 15:03:30 ----D---- C:\ERDNT 2008-12-13 15:03:29 ----D---- C:\WINDOWS\ERUNT 2008-12-13 15:03:24 ----D---- C:\!FixIEDef 2008-12-13 15:00:23 ----D---- C:\WINDOWS\Sun 2008-12-13 14:44:21 ----D---- C:\Documents and Settings\All Users\Dane aplikacji\LightScribe 2008-12-13 14:37:47 ----SHD---- C:\Config.Msi 2008-12-13 12:59:19 ----SHD---- C:\found.000 2008-12-12 11:46:42 ----D---- C:\WINDOWS\CSC 2008-12-11 23:06:55 ----HDC---- C:\WINDOWS\$NtUninstallKB955839$ 2008-12-11 23:05:12 ----HDC---- C:\WINDOWS\$NtUninstallKB952069_WM9$ 2008-12-11 23:04:52 ----HDC---- C:\WINDOWS\$NtUninstallKB954600$ 2008-12-11 23:04:45 ----HDC---- C:\WINDOWS\$NtUninstallKB956802$ 2008-12-10 21:54:22 ----SHD---- C:\RECYCLER 2008-12-10 19:23:31 ----D---- C:\WINDOWS\temp 2008-12-09 18:28:54 ----D---- C:\Program Files\Trend Micro 2008-12-08 18:40:59 ----D---- C:\Program Files\directx 2008-12-01 14:29:06 ----D---- C:\Program Files\Ashampoo 2008-11-22 10:39:44 ----D---- C:\Program Files\Common Files\Skype ======List of files/folders modified in the last 1 months====== 2008-12-16 17:57:23 ----D---- C:\WINDOWS\Prefetch 2008-12-16 15:27:17 ----D---- C:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab 2008-12-16 15:26:58 ----A---- C:\WINDOWS\AVerTV.ini 2008-12-16 15:26:38 ----D---- C:\WINDOWS 2008-12-16 15:24:30 ----A---- C:\WINDOWS\SchedLgU.Txt 2008-12-16 15:23:25 ----D---- C:\WINDOWS\system32 2008-12-16 15:20:24 ----D---- C:\WINDOWS\system32\CatRoot2 2008-12-16 14:31:04 ----D---- C:\Program Files\DC++ 2008-12-16 12:05:32 ----D---- C:\Program Files\Mozilla Firefox 2008-12-15 23:01:43 ----D---- C:\Documents and Settings\Marcin\Dane aplikacji\Skype 2008-12-15 19:01:18 ----SHD---- C:\WINDOWS\Installer 2008-12-15 18:33:06 ----D---- C:\Documents and Settings\Marcin\Dane aplikacji\skypePM 2008-12-14 22:18:25 ----A---- C:\WINDOWS\NeroDigital.ini 2008-12-14 16:31:25 ----SD---- C:\Documents and Settings\Marcin\Dane aplikacji\Microsoft 2008-12-14 15:43:21 ----HD---- C:\WINDOWS\inf 2008-12-14 15:40:17 ----RD---- C:\Program Files 2008-12-14 15:37:12 ----D---- C:\WINDOWS\system32\drivers 2008-12-14 15:10:02 ----D---- C:\Documents and Settings\Marcin\Dane aplikacji\uTorrent 2008-12-13 15:03:29 ----D---- C:\WINDOWS\erdnt 2008-12-13 14:59:50 ----SHD---- C:\System Volume Information 2008-12-13 14:59:50 ----D---- C:\WINDOWS\system32\Restore 2008-12-13 14:37:51 ----D---- C:\Program Files\Common Files\LightScribe 2008-12-12 11:52:22 ----A---- C:\WINDOWS\setuplog.txt 2008-12-12 11:52:12 ----A---- C:\WINDOWS\system32\wpa.bak 2008-12-12 11:46:51 ----A---- C:\WINDOWS\ntbtlog.txt 2008-12-11 23:06:52 ----A---- C:\WINDOWS\imsins.BAK 2008-12-11 23:06:49 ----RSHDC---- C:\WINDOWS\system32\dllcache 2008-12-11 23:06:48 ----D---- C:\Program Files\Internet Explorer 2008-12-11 23:06:41 ----HD---- C:\WINDOWS\$hf_mig$ 2008-12-10 21:57:16 ----SH---- C:\boot.ini 2008-12-10 21:57:16 ----A---- C:\WINDOWS\win.ini 2008-12-10 21:57:16 ----A---- C:\WINDOWS\system.ini 2008-12-10 19:19:26 ----D---- C:\WINDOWS\system32\config 2008-12-10 19:18:52 ----D---- C:\WINDOWS\AppPatch 2008-12-10 19:18:52 ----D---- C:\Program Files\Common Files 2008-12-10 00:24:37 ----A---- C:\WINDOWS\system32\MRT.exe 2008-12-08 18:40:35 ----HD---- C:\Program Files\InstallShield Installation Information 2008-12-03 20:01:09 ----D---- C:\Program Files\Gadu-Gadu 2008-12-02 11:12:07 ----D---- C:\WINDOWS\Help 2008-12-01 14:32:03 ----D---- C:\WINDOWS\IP1500 2008-11-28 14:58:59 ----D---- C:\Documents and Settings\Marcin\Dane aplikacji\PC Suite 2008-11-24 17:23:19 ----SD---- C:\WINDOWS\Downloaded Program Files 2008-11-20 23:05:55 ----A---- C:\WINDOWS\PhotoSnapViewer.INI 2008-11-17 21:48:12 ----SD---- C:\WINDOWS\Tasks ======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)====== R1 KLIF;Kaspersky Lab Driver; C:\WINDOWS\system32\DRIVERS\klif.sys [2008-09-18 213008] R1 StarOpen;StarOpen; C:\WINDOWS\system32\drivers\StarOpen.sys [2006-07-24 5632] R2 ACEDRV09;ACEDRV09; \??\C:\WINDOWS\system32\drivers\ACEDRV09.sys [] R3 ALCXWDM;Service for Realtek AC97 Audio (WDM); C:\WINDOWS\system32\drivers\ALCXWDM.SYS [2004-11-17 2297664] R3 Arp1394;Protokół klienta 1394 ARP; C:\WINDOWS\system32\DRIVERS\arp1394.sys [2008-04-13 60800] R3 Cap7134;AVerMedia, AVerTV WDM Video Capture (Silicon); C:\WINDOWS\system32\DRIVERS\Cap7134.sys [2008-01-25 346304] R3 GEARAspiWDM;GEARAspiWDM; C:\WINDOWS\System32\Drivers\GEARAspiWDM.sys [2006-09-19 15664] R3 HidUsb;Sterownik Microsoft klasy HID; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-13 10368] R3 klim5;Kaspersky Anti-Virus NDIS Filter; C:\WINDOWS\system32\DRIVERS\klim5.sys [2008-03-25 24592] R3 mouhid;Sterownik myszy HID; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2001-10-26 12160] R3 ms_mpu401;Sterownik portu MIDI UART Microsoft MPU-401; C:\WINDOWS\system32\drivers\msmpu401.sys [2001-08-17 2944] R3 MTsensor;ATK0110 ACPI UTILITY; C:\WINDOWS\system32\DRIVERS\ASACPI.sys [2004-08-13 5810] R3 NIC1394;Sterownik sieci 1394; C:\WINDOWS\system32\DRIVERS\nic1394.sys [2008-04-13 61824] R3 npkcrypt;npkcrypt; \??\E:\Program Files\iNTERLUDE\system\npkcrypt.sys [] R3 nv;nv; C:\WINDOWS\system32\DRIVERS\nv4_mini.sys [2005-05-25 3193536] R3 NVENETFD;NVIDIA nForce Networking Controller Driver; C:\WINDOWS\system32\DRIVERS\NVENETFD.sys [2005-04-05 33536] R3 nvnetbus;NVIDIA Network Bus Enumerator; C:\WINDOWS\system32\DRIVERS\nvnetbus.sys [2005-04-05 12928] R3 PhTVTune;Cap7134 TVTuner; C:\WINDOWS\system32\DRIVERS\PhTVTune.sys [2008-01-25 54304] R3 usbaudio;Sterownik audio USB (WDM); C:\WINDOWS\system32\drivers\usbaudio.sys [2008-04-13 60032] R3 usbccgp;Rodzajowy sterownik nadrzędny USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-13 32128] R3 usbehci;Sterownik Miniport rozszerzonego kontrolera hosta USB 2.0 Microsoft; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2008-04-13 30208] R3 usbhub;Koncentrator z obsługą USB2; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2008-04-13 59520] R3 usbohci;Sterownik Miniport otwartego kontrolera hosta USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbohci.sys [2008-04-13 17152] R3 V0420VID;Live! Cam Vista IM (VF0420); C:\WINDOWS\system32\DRIVERS\V0420Vid.sys [2007-05-31 99648] R4 WINFOXIO;WINFOXIO; \??\C:\WINDOWS\system32\Drivers\WINFOXIO.SYS [] S3 61883;Urządzenie jednostkowe 61883; C:\WINDOWS\system32\DRIVERS\61883.sys [2008-04-13 48128] S3 aq6yis8v;aq6yis8v; C:\WINDOWS\system32\drivers\aq6yis8v.sys [] S3 Avc;Urządzenie AVC; C:\WINDOWS\system32\DRIVERS\avc.sys [2008-04-13 38912] S3 catchme;catchme; \??\C:\ComboFix\catchme.sys [] S3 CCDECODE;Dekoder napisów; C:\WINDOWS\system32\DRIVERS\CCDECODE.sys [2008-04-13 17024] S3 dtscsi;dtscsi; C:\WINDOWS\system32\drivers\dtscsi.sys [] S3 MSDV;Microsoft DV Camera and VCR; C:\WINDOWS\system32\DRIVERS\msdv.sys [2008-04-13 51200] S3 MSTEE;Konwerter strumieni Tee/Sink-to-Sink Microsoft Streaming; C:\WINDOWS\system32\drivers\MSTEE.sys [2008-04-13 5504] S3 NABTSFEC;Koder-dekoder NABTS/FEC VBI; C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys [2008-04-13 85248] S3 NdisIP;Połączenie TV/wideo firmy Microsoft; C:\WINDOWS\system32\DRIVERS\NdisIP.sys [2008-04-13 10880] S3 nmwcd;Nokia USB Phone Parent; C:\WINDOWS\system32\drivers\nmwcd.sys [2007-02-22 137216] S3 nmwcdc;Nokia USB Generic; C:\WINDOWS\system32\drivers\nmwcdc.sys [2007-02-22 8320] S3 nmwcdcj;Nokia USB Port; C:\WINDOWS\system32\drivers\nmwcdcj.sys [2007-02-22 12288] S3 nmwcdcm;Nokia USB Modem; C:\WINDOWS\system32\drivers\nmwcdcm.sys [2007-02-22 12288] S3 SLIP;BDA Slip De-Framer; C:\WINDOWS\system32\DRIVERS\SLIP.sys [2008-04-13 11136] S3 streamip;BDA IPSink; C:\WINDOWS\system32\DRIVERS\StreamIP.sys [2008-04-13 15232] S3 usbprint;Klasa PRINTER USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2008-04-13 25856] S3 USBSTOR;Sterownik magazynu masowego USB; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-13 26368] S3 w800bus;Sony Ericsson W800 driver (WDM); C:\WINDOWS\system32\DRIVERS\w800bus.sys [2005-06-13 60768] S3 WpdUsb;WpdUsb; C:\WINDOWS\system32\DRIVERS\wpdusb.sys [2006-10-18 38528] S3 WSTCODEC;Kodery-dekodery teletekstu w standardzie światowym; C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS [2008-04-13 19200] S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2006-09-15 82688] S4 IntelIde;IntelIde; C:\WINDOWS\system32\drivers\IntelIde.sys [] ======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)====== R2 LightScribeService;LightScribeService Direct Disc Labeling Service; C:\Program Files\Common Files\LightScribe\LSSrvc.exe [2008-08-22 73728] R2 NVSvc;WinFast(R) Display Driver Service; C:\WINDOWS\system32\nvsvc32.exe [2005-05-25 127042] R2 UleadBurningHelper;Ulead Burning Helper; C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe [2006-09-28 49152] R2 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2008-04-14 14336] R3 ServiceLayer;ServiceLayer; C:\Program Files\PC Connectivity Solution\ServiceLayer.exe [2007-03-26 292864] S2 AVP;Kaspersky Anti-Virus; D:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe [2008-04-25 201992] S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2005-09-23 29896] S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2005-09-23 66240] S3 IDriverT;InstallDriver Table Manager; C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe [2004-10-22 73728] S3 usnjsvc;Usługa Messenger Sharing Folders USN Journal Reader; C:\Program Files\Windows Live\Messenger\usnsvc.exe [2007-10-18 98328] S3 WLSetupSvc;Windows Live Setup Service; C:\Program Files\Windows Live\installer\WLSetupSvc.exe [2007-10-25 266240] S3 WMPNetworkSvc;Usługa udostępniania w sieci programu Windows Media Player; C:\Program Files\Windows Media Player\WMPNetwk.exe [2006-12-01 918016] -----------------EOF-----------------

**Posty:** 8001 · przez **Okocza** 16 Gru 2008, 19:04

Kod: Zaznacz wszystko: F2 - REG:system.ini: UserInit=userinit.exe,EXPLORER.EXE O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) O4 - HKCU\..\Run: [wsctf.exe] wsctf.exe

fix w hj potem wróć z nowym RSITem

**Posty:** 47 · przez **MmarcinekK** 16 Gru 2008, 20:04

Kod: Zaznacz wszystko: Logfile of random's system information tool 1.04 (written by random/random) Run by Marcin at 2008-12-16 19:03:58 Microsoft Windows XP Professional Dodatek Service Pack 3 System drive C: has 2 GB (16%) free of 10 GB Total RAM: 1535 MB (71% free) Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 19:04:01, on 2008-12-16 Platform: Windows XP Dodatek SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16762) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\SOUNDMAN.EXE C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe D:\Program Files\Nokia6300\Nokia PC Suite 6\LaunchApplication.exe D:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe C:\Program Files\Gadu-Gadu\gg.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Creative\Creative Live! Cam\Live! Cam Manager\CTLCMgr.exe C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe C:\Program Files\DAEMON Tools Lite\daemon.exe C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe D:\Program Files\AVerTV\QuickTV.exe D:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe C:\Program Files\Common Files\LightScribe\LSSrvc.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe C:\Program Files\PC Connectivity Solution\ServiceLayer.exe C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\system32\wuauclt.exe D:\instalki\RSIT.exe C:\Program Files\Trend Micro\HijackThis\Marcin.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: IEVkbdBHO - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - D:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\ievkbd.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O2 - BHO: Pomocnik rejestracji usługi Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll O3 - Toolbar: DAEMON Tools Toolbar - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll O4 - HKLM\..\Run: [WinFast2KLoadDefault] rundll32.exe wf2kcpl.dll,DllLoadDefaultSettings O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [PCSuiteTrayApplication] D:\Program Files\Nokia6300\Nokia PC Suite 6\LaunchApplication.exe -startup O4 - HKLM\..\Run: [AVP] "D:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe" O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_9 -reboot 1 O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [Creative Live! Cam Manager] "C:\Program Files\Creative\Creative Live! Cam\Live! Cam Manager\CTLCMgr.exe" O4 - HKCU\..\Run: [CTRegRun] C:\WINDOWS\CTRegRun.EXE O4 - HKCU\..\Run: [EXPLORER.EXE] EXPLORER.EXE O4 - HKCU\..\Run: [LightScribe Control Panel] C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe -hidden O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\S-1-5-18\..\Run: [Nokia.PCSync] D:\Program Files\Nokia6300\Nokia PC Suite 6\PcSync2.exe /NoDialog (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O4 - Global Startup: Microsoft Office.lnk = D:\Program Files\Microsoft Office\Office10\OSA.EXE O4 - Global Startup: QuickTV.lnk = D:\Program Files\AVerTV\QuickTV.exe O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://D:\PROGRA~1\MICROS~1\Office10\EXCEL.EXE/3000 O8 - Extra context menu item: Easy-WebPrint Add To Print List - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html O8 - Extra context menu item: Easy-WebPrint High Speed Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html O8 - Extra context menu item: Easy-WebPrint Preview - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html O8 - Extra context menu item: Easy-WebPrint Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra button: Statystyki ochrony WWW - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - D:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\SCIEPlgn.dll O9 - Extra button: Wpis w blogu - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll O9 - Extra 'Tools' menuitem: &Wpis w blogu w Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {1E53EA77-34F2-474E-9046-B2B0C86F1821} (OggX Control) - http://www.eska.pl/streamplayers/OggX.ocx O16 - DPF: {68282C51-9459-467B-95BF-3C0E89627E55} (MksSkanerOnline Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/softwareupdate/su2/ocx/15106/CTPID.cab O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.116.46 85.255.112.93 O17 - HKLM\System\CS3\Services\Tcpip\Parameters: NameServer = 217.153.14.131 192.168.4.1 O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: Kaspersky Anti-Virus (AVP) - Kaspersky Lab - D:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe O23 - Service: WinFast(R) Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe -- End of file - 8302 bytes ======Scheduled tasks folder====== C:\WINDOWS\tasks\GoogleUpdateTaskUser.job ======Registry dump====== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}] Adobe PDF Reader Link Helper - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll [2006-12-18 59032] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C}] IEVkbdBHO Class - D:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\ievkbd.dll [2008-09-18 62728] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}] SSVHelper Class - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll [2008-06-10 509328] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}] Pomocnik rejestracji usługi Windows Live - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2007-09-20 328752] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar] {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - Easy-WebPrint - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll [2004-08-26 405504] {32099AAC-C132-4136-9E9A-4E364A424E17} - DAEMON Tools Toolbar - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll [2008-12-10 929224] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run] "WinFast2KLoadDefault"=C:\WINDOWS\system32\wf2kcpl.dll [2005-04-14 612352] "SoundMan"=C:\WINDOWS\SOUNDMAN.EXE [2004-11-15 77824] "NeroFilterCheck"=C:\WINDOWS\system32\NeroCheck.exe [2001-07-09 155648] "SunJavaUpdateSched"=C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe [2008-06-10 144784] "NvCplDaemon"=C:\WINDOWS\system32\NvCpl.dll [2005-05-25 6746112] "PCSuiteTrayApplication"=D:\Program Files\Nokia6300\Nokia PC Suite 6\LaunchApplication.exe [2007-03-23 227328] "AVP"=D:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe [2008-04-25 201992] [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run] "Gadu-Gadu"=C:\Program Files\Gadu-Gadu\gg.exe [2007-05-10 2111176] "updateMgr"=C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe [2006-03-30 313472] "ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe [2008-04-14 15360] "Creative Live! Cam Manager"=C:\Program Files\Creative\Creative Live! Cam\Live! Cam Manager\CTLCMgr.exe [2007-06-07 155648] "CTRegRun"=C:\WINDOWS\CTRegRun.EXE [2006-10-06 53248] "EXPLORER.EXE"=C:\WINDOWS\EXPLORER.EXE [2008-04-14 1035264] "LightScribe Control Panel"=C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe [2008-08-22 2363392] "DAEMON Tools Lite"=C:\Program Files\DAEMON Tools Lite\daemon.exe [2008-12-10 216520] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Easy-PrintToolBox] C:\Program Files\Canon\Easy-PrintToolBox\BJPSMAIN.EXE [2004-01-14 409600] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GG Tools] d:\Program Files\kRk Software\GG Tools\GGT.exe [2008-07-16 2242560] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Update] C:\Documents and Settings\Marcin\Ustawienia lokalne\Dane aplikacji\Google\Update\GoogleUpdate.exe [2008-09-04 133104] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr] C:\PROGRA~1\WI1F86~1\MESSEN~1\msnmsgr.exe [2007-10-18 5724184] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon] C:\WINDOWS\system32\NvCpl.dll [2005-05-25 6746112] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NVIDIA nTune] C:\Program Files\NVIDIA Corporation\nTune\\nTune.exe [2004-12-06 532480] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter] C:\WINDOWS\system32\NvMcTray.dll [2005-05-25 86016] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz] nwiz.exe /install [] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCSuiteTrayApplication] D:\Program Files\Nokia6300\Nokia PC Suite 6\LaunchApplication.exe [2007-03-23 227328] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TrojanScanner] d:\Program Files\Trojan Remover\Trjscan.exe [2008-10-25 968072] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UVS10 Preload] C:\Program Files\Ulead Systems\Ulead VideoStudio SE\uvPL.exe [2006-08-09 36864] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\V0420Mon.exe] C:\WINDOWS\V0420Mon.exe [2007-04-30 32768] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinFoxV2] C:\WINDOWS\system32\WF2K.EXE [2005-07-22 1310720] C:\Documents and Settings\All Users\Menu Start\Programy\Autostart Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe Microsoft Office.lnk - D:\Program Files\Microsoft Office\Office10\OSA.EXE QuickTV.lnk - D:\Program Files\AVerTV\QuickTV.exe [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\klogon] C:\WINDOWS\system32\klogon.dll [2008-04-25 206088] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad] WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{1a3e09be-1e45-494b-9174-d7385b45bbf5}] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System] "dontdisplaylastusername"=0 "legalnoticecaption"= "legalnoticetext"= "shutdownwithoutlogon"=1 "undockwithoutlogon"=1 [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer] "NoDriveTypeAutoRun"=323 "NoDrives"=0 "NoDriveAutoRun"=67108863 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer] "NoDriveAutoRun"= "NoDriveTypeAutoRun"= "NoDrives"= [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] "%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "C:\Program Files\Gadu-Gadu\gg.exe"="C:\Program Files\Gadu-Gadu\gg.exe:*:Enabled:Gadu-Gadu - program główny" "%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000" "C:\Program Files\DC++\DCPlusPlus.exe"="C:\Program Files\DC++\DCPlusPlus.exe:*:Enabled:DC++" "C:\Program Files\uTorrent\uTorrent.exe"="C:\Program Files\uTorrent\uTorrent.exe:*:Enabled:µTorrent" "C:\Program Files\Opera\Opera.exe"="C:\Program Files\Opera\Opera.exe:*:Enabled:Opera Internet Browser" "C:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab Setup Files\Kaspersky Anti-Virus 2009\Polish\setup.exe"="C:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab Setup Files\Kaspersky Anti-Virus 2009\Polish\setup.exe:*:Enabled:Kaspersky Anti-Virus 2009 Setup" "C:\Program Files\Messenger\msmsgs.exe"="C:\Program Files\Messenger\msmsgs.exe:*:Enabled:Windows Messenger" "C:\Program Files\Windows Live\Messenger\msnmsgr.exe"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger" "C:\Program Files\Windows Live\Messenger\livecall.exe"="C:\Program Files\Windows Live\Messenger\livecall.exe:*:Enabled:Windows Live Messenger (Phone)" "D:\Program Files\Rockstar Games\GTA2\gta2.exe"="D:\Program Files\Rockstar Games\GTA2\gta2.exe:*:Enabled:GTA2 main executable" "C:\WINDOWS\system32\dplaysvr.exe"="C:\WINDOWS\system32\dplaysvr.exe:*:Enabled:Microsoft DirectPlay Helper" "D:\X.Plane.9-AVENGED\X-Plane 9\X-Plane.exe"="D:\X.Plane.9-AVENGED\X-Plane 9\X-Plane.exe:*:Enabled:X-Plane" "C:\Program Files\Skype\Phone\Skype.exe"="C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype. Take a deep breath " [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list] "%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000" "C:\Program Files\Windows Live\Messenger\msnmsgr.exe"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger" "C:\Program Files\Windows Live\Messenger\livecall.exe"="C:\Program Files\Windows Live\Messenger\livecall.exe:*:Enabled:Windows Live Messenger (Phone)" [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{43926691-c67a-11dc-97d5-806d6172696f}] shell\AutoRun\command - F:\ASUSACPI.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{7f617eb2-76ac-11dd-a0c6-0015f20062ad}] shell\AutoRun\command - H:\EXPLORER.EXE shell\explore\command - H:\EXPLORER.EXE shell\open\command - H:\EXPLORER.EXE ======List of files/folders created in the last 1 months====== 2008-12-16 17:57:33 ----D---- C:\rsit 2008-12-14 15:43:26 ----D---- C:\Documents and Settings\Marcin\Dane aplikacji\DAEMON Tools Pro 2008-12-14 15:43:26 ----D---- C:\Documents and Settings\Marcin\Dane aplikacji\DAEMON Tools 2008-12-14 15:40:24 ----D---- C:\Documents and Settings\All Users\Dane aplikacji\DAEMON Tools Lite 2008-12-14 15:40:17 ----D---- C:\Program Files\DAEMON Tools Toolbar 2008-12-14 15:40:12 ----D---- C:\Program Files\DAEMON Tools Lite 2008-12-14 15:37:03 ----D---- C:\Documents and Settings\Marcin\Dane aplikacji\DAEMON Tools Lite 2008-12-13 15:03:30 ----D---- C:\ERDNT 2008-12-13 15:03:29 ----D---- C:\WINDOWS\ERUNT 2008-12-13 15:03:24 ----D---- C:\!FixIEDef 2008-12-13 15:00:23 ----D---- C:\WINDOWS\Sun 2008-12-13 14:44:21 ----D---- C:\Documents and Settings\All Users\Dane aplikacji\LightScribe 2008-12-13 14:37:47 ----SHD---- C:\Config.Msi 2008-12-13 12:59:19 ----SHD---- C:\found.000 2008-12-12 11:46:42 ----D---- C:\WINDOWS\CSC 2008-12-11 23:06:55 ----HDC---- C:\WINDOWS\$NtUninstallKB955839$ 2008-12-11 23:05:12 ----HDC---- C:\WINDOWS\$NtUninstallKB952069_WM9$ 2008-12-11 23:04:52 ----HDC---- C:\WINDOWS\$NtUninstallKB954600$ 2008-12-11 23:04:45 ----HDC---- C:\WINDOWS\$NtUninstallKB956802$ 2008-12-10 21:54:22 ----SHD---- C:\RECYCLER 2008-12-10 19:23:31 ----D---- C:\WINDOWS\temp 2008-12-09 18:28:54 ----D---- C:\Program Files\Trend Micro 2008-12-08 18:40:59 ----D---- C:\Program Files\directx 2008-12-01 14:29:06 ----D---- C:\Program Files\Ashampoo 2008-11-22 10:39:44 ----D---- C:\Program Files\Common Files\Skype ======List of files/folders modified in the last 1 months====== 2008-12-16 19:03:12 ----D---- C:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab 2008-12-16 19:02:52 ----A---- C:\WINDOWS\AVerTV.ini 2008-12-16 19:00:30 ----A---- C:\WINDOWS\SchedLgU.Txt 2008-12-16 18:59:12 ----D---- C:\WINDOWS\Prefetch 2008-12-16 18:21:36 ----D---- C:\WINDOWS\system32\CatRoot2 2008-12-16 15:26:38 ----D---- C:\WINDOWS 2008-12-16 15:23:25 ----D---- C:\WINDOWS\system32 2008-12-16 14:31:04 ----D---- C:\Program Files\DC++ 2008-12-16 12:05:32 ----D---- C:\Program Files\Mozilla Firefox 2008-12-15 23:01:43 ----D---- C:\Documents and Settings\Marcin\Dane aplikacji\Skype 2008-12-15 19:01:18 ----SHD---- C:\WINDOWS\Installer 2008-12-15 18:33:06 ----D---- C:\Documents and Settings\Marcin\Dane aplikacji\skypePM 2008-12-14 22:18:25 ----A---- C:\WINDOWS\NeroDigital.ini 2008-12-14 16:31:25 ----SD---- C:\Documents and Settings\Marcin\Dane aplikacji\Microsoft 2008-12-14 15:43:21 ----HD---- C:\WINDOWS\inf 2008-12-14 15:40:17 ----RD---- C:\Program Files 2008-12-14 15:37:12 ----D---- C:\WINDOWS\system32\drivers 2008-12-14 15:10:02 ----D---- C:\Documents and Settings\Marcin\Dane aplikacji\uTorrent 2008-12-13 15:03:29 ----D---- C:\WINDOWS\erdnt 2008-12-13 14:59:50 ----SHD---- C:\System Volume Information 2008-12-13 14:59:50 ----D---- C:\WINDOWS\system32\Restore 2008-12-13 14:37:51 ----D---- C:\Program Files\Common Files\LightScribe 2008-12-12 11:52:22 ----A---- C:\WINDOWS\setuplog.txt 2008-12-12 11:52:12 ----A---- C:\WINDOWS\system32\wpa.bak 2008-12-12 11:46:51 ----A---- C:\WINDOWS\ntbtlog.txt 2008-12-11 23:06:52 ----A---- C:\WINDOWS\imsins.BAK 2008-12-11 23:06:49 ----RSHDC---- C:\WINDOWS\system32\dllcache 2008-12-11 23:06:48 ----D---- C:\Program Files\Internet Explorer 2008-12-11 23:06:41 ----HD---- C:\WINDOWS\$hf_mig$ 2008-12-10 21:57:16 ----SH---- C:\boot.ini 2008-12-10 21:57:16 ----A---- C:\WINDOWS\win.ini 2008-12-10 21:57:16 ----A---- C:\WINDOWS\system.ini 2008-12-10 19:19:26 ----D---- C:\WINDOWS\system32\config 2008-12-10 19:18:52 ----D---- C:\WINDOWS\AppPatch 2008-12-10 19:18:52 ----D---- C:\Program Files\Common Files 2008-12-10 00:24:37 ----A---- C:\WINDOWS\system32\MRT.exe 2008-12-08 18:40:35 ----HD---- C:\Program Files\InstallShield Installation Information 2008-12-03 20:01:09 ----D---- C:\Program Files\Gadu-Gadu 2008-12-02 11:12:07 ----D---- C:\WINDOWS\Help 2008-12-01 14:32:03 ----D---- C:\WINDOWS\IP1500 2008-11-28 14:58:59 ----D---- C:\Documents and Settings\Marcin\Dane aplikacji\PC Suite 2008-11-24 17:23:19 ----SD---- C:\WINDOWS\Downloaded Program Files 2008-11-20 23:05:55 ----A---- C:\WINDOWS\PhotoSnapViewer.INI 2008-11-17 21:48:12 ----SD---- C:\WINDOWS\Tasks ======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)====== R1 KLIF;Kaspersky Lab Driver; C:\WINDOWS\system32\DRIVERS\klif.sys [2008-09-18 213008] R1 StarOpen;StarOpen; C:\WINDOWS\system32\drivers\StarOpen.sys [2006-07-24 5632] R2 ACEDRV09;ACEDRV09; \??\C:\WINDOWS\system32\drivers\ACEDRV09.sys [] R3 ALCXWDM;Service for Realtek AC97 Audio (WDM); C:\WINDOWS\system32\drivers\ALCXWDM.SYS [2004-11-17 2297664] R3 Arp1394;Protokół klienta 1394 ARP; C:\WINDOWS\system32\DRIVERS\arp1394.sys [2008-04-13 60800] R3 Cap7134;AVerMedia, AVerTV WDM Video Capture (Silicon); C:\WINDOWS\system32\DRIVERS\Cap7134.sys [2008-01-25 346304] R3 GEARAspiWDM;GEARAspiWDM; C:\WINDOWS\System32\Drivers\GEARAspiWDM.sys [2006-09-19 15664] R3 HidUsb;Sterownik Microsoft klasy HID; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-13 10368] R3 klim5;Kaspersky Anti-Virus NDIS Filter; C:\WINDOWS\system32\DRIVERS\klim5.sys [2008-03-25 24592] R3 mouhid;Sterownik myszy HID; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2001-10-26 12160] R3 ms_mpu401;Sterownik portu MIDI UART Microsoft MPU-401; C:\WINDOWS\system32\drivers\msmpu401.sys [2001-08-17 2944] R3 MTsensor;ATK0110 ACPI UTILITY; C:\WINDOWS\system32\DRIVERS\ASACPI.sys [2004-08-13 5810] R3 NIC1394;Sterownik sieci 1394; C:\WINDOWS\system32\DRIVERS\nic1394.sys [2008-04-13 61824] R3 nv;nv; C:\WINDOWS\system32\DRIVERS\nv4_mini.sys [2005-05-25 3193536] R3 NVENETFD;NVIDIA nForce Networking Controller Driver; C:\WINDOWS\system32\DRIVERS\NVENETFD.sys [2005-04-05 33536] R3 nvnetbus;NVIDIA Network Bus Enumerator; C:\WINDOWS\system32\DRIVERS\nvnetbus.sys [2005-04-05 12928] R3 PhTVTune;Cap7134 TVTuner; C:\WINDOWS\system32\DRIVERS\PhTVTune.sys [2008-01-25 54304] R3 usbaudio;Sterownik audio USB (WDM); C:\WINDOWS\system32\drivers\usbaudio.sys [2008-04-13 60032] R3 usbccgp;Rodzajowy sterownik nadrzędny USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-13 32128] R3 usbehci;Sterownik Miniport rozszerzonego kontrolera hosta USB 2.0 Microsoft; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2008-04-13 30208] R3 usbhub;Koncentrator z obsługą USB2; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2008-04-13 59520] R3 usbohci;Sterownik Miniport otwartego kontrolera hosta USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbohci.sys [2008-04-13 17152] R3 usbprint;Klasa PRINTER USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2008-04-13 25856] R3 USBSTOR;Sterownik magazynu masowego USB; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-13 26368] R3 V0420VID;Live! Cam Vista IM (VF0420); C:\WINDOWS\system32\DRIVERS\V0420Vid.sys [2007-05-31 99648] R3 w800bus;Sony Ericsson W800 driver (WDM); C:\WINDOWS\system32\DRIVERS\w800bus.sys [2005-06-13 60768] R4 WINFOXIO;WINFOXIO; \??\C:\WINDOWS\system32\Drivers\WINFOXIO.SYS [] S3 61883;Urządzenie jednostkowe 61883; C:\WINDOWS\system32\DRIVERS\61883.sys [2008-04-13 48128] S3 arbjxgin;arbjxgin; C:\WINDOWS\system32\drivers\arbjxgin.sys [] S3 Avc;Urządzenie AVC; C:\WINDOWS\system32\DRIVERS\avc.sys [2008-04-13 38912] S3 catchme;catchme; \??\C:\ComboFix\catchme.sys [] S3 CCDECODE;Dekoder napisów; C:\WINDOWS\system32\DRIVERS\CCDECODE.sys [2008-04-13 17024] S3 dtscsi;dtscsi; C:\WINDOWS\system32\drivers\dtscsi.sys [] S3 MSDV;Microsoft DV Camera and VCR; C:\WINDOWS\system32\DRIVERS\msdv.sys [2008-04-13 51200] S3 MSTEE;Konwerter strumieni Tee/Sink-to-Sink Microsoft Streaming; C:\WINDOWS\system32\drivers\MSTEE.sys [2008-04-13 5504] S3 NABTSFEC;Koder-dekoder NABTS/FEC VBI; C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys [2008-04-13 85248] S3 NdisIP;Połączenie TV/wideo firmy Microsoft; C:\WINDOWS\system32\DRIVERS\NdisIP.sys [2008-04-13 10880] S3 nmwcd;Nokia USB Phone Parent; C:\WINDOWS\system32\drivers\nmwcd.sys [2007-02-22 137216] S3 nmwcdc;Nokia USB Generic; C:\WINDOWS\system32\drivers\nmwcdc.sys [2007-02-22 8320] S3 nmwcdcj;Nokia USB Port; C:\WINDOWS\system32\drivers\nmwcdcj.sys [2007-02-22 12288] S3 nmwcdcm;Nokia USB Modem; C:\WINDOWS\system32\drivers\nmwcdcm.sys [2007-02-22 12288] S3 npkcrypt;npkcrypt; \??\E:\Program Files\iNTERLUDE\system\npkcrypt.sys [] S3 SLIP;BDA Slip De-Framer; C:\WINDOWS\system32\DRIVERS\SLIP.sys [2008-04-13 11136] S3 streamip;BDA IPSink; C:\WINDOWS\system32\DRIVERS\StreamIP.sys [2008-04-13 15232] S3 WpdUsb;WpdUsb; C:\WINDOWS\system32\DRIVERS\wpdusb.sys [2006-10-18 38528] S3 WSTCODEC;Kodery-dekodery teletekstu w standardzie światowym; C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS [2008-04-13 19200] S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2006-09-15 82688] S4 IntelIde;IntelIde; C:\WINDOWS\system32\drivers\IntelIde.sys [] ======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)====== R2 AVP;Kaspersky Anti-Virus; D:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe [2008-04-25 201992] R2 LightScribeService;LightScribeService Direct Disc Labeling Service; C:\Program Files\Common Files\LightScribe\LSSrvc.exe [2008-08-22 73728] R2 NVSvc;WinFast(R) Display Driver Service; C:\WINDOWS\system32\nvsvc32.exe [2005-05-25 127042] R2 UleadBurningHelper;Ulead Burning Helper; C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe [2006-09-28 49152] R2 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2008-04-14 14336] R3 ServiceLayer;ServiceLayer; C:\Program Files\PC Connectivity Solution\ServiceLayer.exe [2007-03-26 292864] S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2005-09-23 29896] S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2005-09-23 66240] S3 IDriverT;InstallDriver Table Manager; C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe [2004-10-22 73728] S3 usnjsvc;Usługa Messenger Sharing Folders USN Journal Reader; C:\Program Files\Windows Live\Messenger\usnsvc.exe [2007-10-18 98328] S3 WLSetupSvc;Windows Live Setup Service; C:\Program Files\Windows Live\installer\WLSetupSvc.exe [2007-10-25 266240] S3 WMPNetworkSvc;Usługa udostępniania w sieci programu Windows Media Player; C:\Program Files\Windows Media Player\WMPNetwk.exe [2006-12-01 918016] -----------------EOF-----------------

**Posty:** 18165 · przez **wojtas** 16 Gru 2008, 20:19

skasuj to w hijacku:

O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.116.46 85.255.112.93

wklej do notatnika

Windows Registry Editor Version 5.00

[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{7f617eb2-76ac-11dd-a0c6-0015f20062ad}]

w notatniku u góry>>>plik zapisz jako>>>Zmien rozszerzenie z TXT na Wszystkie pliki *.* >>> Zapisz pod nazwą FIX.REG

Klikasz dwa razy na powstały plik fix i dodajesz go do rejestru....

**Posty:** 47 · przez **MmarcinekK** 19 Gru 2008, 20:08

Wykonałem to co napisałeś i dalej wyskakuje jedno okno moich dokumentów a ekran dalej staje sie czarny tuż po włączeniu, dodam też że jeśli monitor przejdzie w stan czuwania to potem także nie da rady go wybudzić tj, światełko pokazuje że monitor jest wlączony ale obraz jest czarny. Gdy wyłącze i wyłącze monitor to na 0,5 s pokazuje sie obraz i odrazu znika.

**Posty:** 8001 · przez **Okocza** 19 Gru 2008, 23:35

MmarcinekK, jaki masz komputer, razem z marką i mocą zasilacza.

**Posty:** 47 · przez **MmarcinekK** 22 Gru 2008, 16:26

Dziś wogóle klapa. W czasie łądowania windowsa wyskakiwał na 0,5s niebieski ekran i komp sioe restartował. Po różnych próbach odpalenia go stwerdziłęm ze spróbuje reinstalacje windowsa jednak partycja c w instalatorze pisze że nie ma na dysku C żadnego systemu plików więc chciałem go sformatować i wyskoczył komunikat " nstalator nie mogl sformatowac partycji. Dysk moze być uszkodzony. Upewnij się, że stacja jest włączona i właściwie podłączona do komputera. Jeśli jest to dysk SCSI, sprawdź, czy do urządzeń SCSI prawidłowo podłączono terminator. Dodatkowe informacje na ten temat mozna znaleść w dolumentacji komputera lub karty SCSI."

Czyzbym teraz musiał poszukać pomocy w dziale Hardware??

**Posty:** 18165 · przez **wojtas** 22 Gru 2008, 21:40

raczej cos ze sprzetem..

**Posty:** 8001 · przez **Okocza** 22 Gru 2008, 21:48

MmarcinekK, próbowałeś odpinać i podpinać taśmy IDE?