Kursor szaleje,komputer przestaje reagować.

**Posty:** 53 · przez **IceCooLL** 26 Gru 2008, 00:06

Problem wygląda tak - czasami kursor lata po całym pulpicie,nie reagując na ruchy myszką,otwiera okienka itp. Czasami komputer po prostu zaczyna myśleć .. i już nie kończy. Okienka otwierają się wieczność,do tego stopnia ,że potrzebny jest reset. (Szczególnie przy uruchomianiu programów).
Wrzucam logi,jeśli ktoś mógłby mi z tym pomóc,to byłbym wdzięczny.
Pozdrawiam.

Kod: Zaznacz wszystko: ComboFix 08-12-24.01 - Ice 2008-12-25 22:45:43.1 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.3.1250.1.1045.18.2046.1423 [GMT 1:00] Uruchomiony z: e:\mozilla pobrane\ComboFix.exe * Utworzono nowy punkt przywracania * Resident AV is active [COLOR=RED][B]UWAGA - TEN KOMPUTER NIE MA ZAINSTALOWANEJ KONSOLI ODZYSKIWANIA !![/B][/COLOR] . ((((((((((((((((((((((((( Pliki utworzone od 2008-11-25 do 2008-12-25 ))))))))))))))))))))))))))))))) . 2008-12-25 12:01 . 2008-12-25 12:01 <DIR> d-------- c:\windows\nview 2008-12-25 12:01 . 2008-12-02 23:11 453,152 --a------ c:\windows\system32\nvudisp.exe 2008-12-25 12:01 . 2008-12-25 22:23 205,151 --a------ c:\windows\system32\nvapps.xml 2008-12-25 12:01 . 2008-12-02 23:11 18,696 --a------ c:\windows\system32\nvdisp.nvu 2008-12-25 12:00 . 2008-12-02 10:13 453,152 --a------ c:\windows\system32\NVUNINST.EXE 2008-12-25 04:54 . 2008-12-02 23:11 1,560,576 --a------ c:\windows\system32\nvcuda.dll 2008-12-25 04:53 . 2001-01-09 19:09 12,285 --a------ c:\windows\Cadx3.ini 2008-12-25 04:53 . 2003-02-14 03:20 6,942 --a------ c:\windows\cadx2.ini 2008-12-25 04:25 . 2008-12-25 04:25 <DIR> d-------- c:\windows\system32\AGEIA 2008-12-25 04:25 . 2008-12-25 04:25 <DIR> d-------- c:\program files\Common Files\Wise Installation Wizard 2008-12-25 04:25 . 2008-12-25 04:25 <DIR> d-------- c:\program files\AGEIA Technologies 2008-12-25 04:24 . 2008-12-25 04:24 <DIR> d-------- C:\NVIDIA 2008-12-25 04:05 . 2008-12-25 22:47 <DIR> d--h----- c:\documents and settings\Administrator.DANIELLO-5DCFE9\Ustawienia lokalne 2008-12-25 04:05 . 2008-10-15 04:15 <DIR> d-------- c:\documents and settings\Administrator.DANIELLO-5DCFE9\Ulubione 2008-12-25 04:05 . 2008-10-14 20:26 <DIR> d--h----- c:\documents and settings\Administrator.DANIELLO-5DCFE9\Szablony 2008-12-25 04:05 . 2008-10-15 04:15 <DIR> d-------- c:\documents and settings\Administrator.DANIELLO-5DCFE9\Pulpit 2008-12-25 04:05 . 2008-10-15 04:15 <DIR> d-------- c:\documents and settings\Administrator.DANIELLO-5DCFE9\Moje dokumenty 2008-12-25 04:05 . 2008-10-15 04:15 <DIR> dr------- c:\documents and settings\Administrator.DANIELLO-5DCFE9\Menu Start 2008-12-25 04:05 . 2008-10-15 04:15 <DIR> dr-h----- c:\documents and settings\Administrator.DANIELLO-5DCFE9\Dane aplikacji 2008-12-25 04:05 . 2008-12-25 04:05 <DIR> d-------- c:\documents and settings\Administrator.DANIELLO-5DCFE9 2008-12-25 03:45 . 2008-12-25 03:45 552 --a------ c:\windows\system32\d3d8caps.dat 2008-12-25 03:44 . 2008-12-25 03:45 <DIR> d-------- c:\program files\SystemRequirementsLab 2008-12-25 02:43 . 2008-12-25 12:14 1,324 --a------ c:\windows\system32\d3d9caps.dat 2008-12-25 02:42 . 2008-12-25 02:56 <DIR> d-------- c:\documents and settings\Administrator\Ustawienia lokalne 2008-12-25 02:42 . 2008-12-25 02:56 <DIR> d-------- c:\documents and settings\Administrator\Szablony 2008-12-25 02:42 . 2008-12-25 02:56 <DIR> d-------- c:\documents and settings\Administrator\Dane aplikacji 2008-12-25 02:42 . 2008-12-25 02:56 <DIR> d---s---- c:\documents and settings\Administrator 2008-12-25 01:46 . 2008-04-14 22:51 221,184 --a------ c:\windows\system32\wmpns.dll 2008-12-25 01:36 . 2008-04-14 22:51 294,912 -----c--- c:\windows\system32\dllcache\dlimport.exe 2008-12-25 01:33 . 2008-04-14 00:10 10,240 --------- c:\windows\system32\drivers\sffp_mmc.sys 2008-12-25 01:31 . 2006-12-29 00:31 19,569 --a------ c:\windows\[u]0[/u]03103_.tmp 2008-12-24 23:54 . 2008-12-24 23:54 <DIR> dr-h----- c:\documents and settings\Ice\Dane aplikacji\SecuROM 2008-12-24 23:39 . 2008-12-24 23:39 107,888 --a------ c:\windows\system32\CmdLineExt.dll 2008-12-24 23:37 . 2008-12-24 23:37 <DIR> d-------- c:\windows\system32\drivers\umdf 2008-12-24 23:35 . 2008-12-24 23:35 <DIR> d-------- c:\windows\system32\xlive 2008-12-24 23:35 . 2008-12-25 10:35 <DIR> d-------- c:\program files\Microsoft Games for Windows - LIVE 2008-12-24 22:43 . 2008-12-24 22:43 <DIR> d-------- c:\program files\MSBuild 2008-12-24 22:40 . 2008-12-24 22:40 <DIR> d-------- c:\windows\system32\XPSViewer 2008-12-24 22:39 . 2008-12-24 22:39 <DIR> d-------- c:\program files\Reference Assemblies 2008-12-24 22:39 . 2006-06-29 13:07 14,048 --------- c:\windows\system32\spmsg2.dll 2008-12-24 22:21 . 2008-12-24 22:21 <DIR> d-------- c:\program files\Common Files\Adobe 2008-12-24 22:20 . 2008-12-24 22:20 <DIR> d-------- c:\windows\Cache 2008-12-24 20:36 . 2008-12-24 20:36 <DIR> d-------- c:\documents and settings\Ice\Dane aplikacji\DisplayTune 2008-12-24 20:33 . 2008-12-24 20:33 <DIR> d-------- c:\program files\Portrait Displays 2008-12-24 20:33 . 2008-12-24 20:33 <DIR> d-------- c:\program files\Common Files\Portrait Displays 2008-12-24 20:32 . 2008-12-24 20:32 <DIR> d-------- c:\program files\Acer Display 2008-12-24 16:37 . 2008-12-24 16:37 <DIR> d-------- c:\documents and settings\Ice\Dane aplikacji\Datalayer 2008-12-20 00:00 . 2008-12-20 00:00 <DIR> d-------- c:\documents and settings\Ice\Dane aplikacji\Apple Computer 2008-12-10 20:24 . 2008-12-10 20:24 <DIR> d-------- c:\program files\THQ 2008-12-02 23:11 . 2008-12-02 23:11 13,680,640 --a------ c:\windows\system32\nvcpl.dll 2008-12-01 20:40 . 2008-12-01 20:40 410,976 --a------ c:\windows\system32\deploytk.dll . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-12-25 21:47 16,608 ----a-w c:\windows\gdrv.sys 2008-12-25 21:46 --------- d-----w c:\program files\PeerGuardian2 2008-12-25 21:45 --------- d-----w c:\program files\Eset 2008-12-24 21:47 --------- d--h--w c:\program files\InstallShield Installation Information 2008-12-24 15:37 --------- d-----w c:\documents and settings\Ice\Dane aplikacji\PC Suite 2008-12-07 18:55 202,000 ----a-w c:\windows\system32\PnkBstrB.exe 2008-12-07 18:55 139,280 ----a-w c:\windows\system32\drivers\PnkBstrK.sys 2008-12-01 19:40 --------- d-----w c:\program files\Java 2008-11-25 21:42 --------- d-----w c:\documents and settings\Ice\Dane aplikacji\Skype 2008-11-25 21:24 --------- d-----w c:\documents and settings\Ice\Dane aplikacji\skypePM 2008-11-21 14:18 --------- d-----w c:\program files\7-Zip 2008-11-20 23:31 --------- d-----w c:\documents and settings\Ice\Dane aplikacji\com.raptr.Raptr.848BBC53270CAC248E8FA0F339176201CDEB525F.1 2008-11-20 23:30 --------- d-----w c:\documents and settings\Ice\Dane aplikacji\Raptr 2008-11-20 23:29 --------- d-----w c:\program files\Common Files\Adobe AIR 2008-11-20 22:20 22,328 ----a-w c:\documents and settings\Ice\Dane aplikacji\PnkBstrK.sys 2008-11-20 22:19 682,280 ----a-w c:\windows\system32\pbsvc.exe 2008-11-20 22:19 66,872 ----a-w c:\windows\system32\PnkBstrA.exe 2008-11-20 18:44 --------- d-----w c:\documents and settings\Ice\Dane aplikacji\GanymedeNet 2008-11-16 10:00 --------- d-----w c:\program files\USB Vibration 2008-11-16 08:38 --------- d-----w c:\program files\VID_0E8F&PID_0003 2008-11-11 17:26 --------- d-----w c:\program files\Common Files\Apple 2008-11-11 17:26 --------- d-----w c:\program files\Apple Software Update 2008-11-11 17:26 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\Apple Computer 2008-11-11 17:26 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\Apple 2008-11-11 17:25 --------- d-----w c:\documents and settings\Ice\Dane aplikacji\Ahead 2008-11-11 12:01 --------- d-----w c:\documents and settings\Ice\Dane aplikacji\Azureus 2008-11-08 20:07 --------- d-----w c:\program files\Panda Security 2008-11-07 21:14 --------- d-----w c:\program files\Vuze 2008-11-05 22:07 --------- d-----w c:\program files\Common Files\COWON 2008-10-28 16:41 14,303,392 ----a-w c:\windows\system32\xlive.dll 2008-10-28 16:41 13,643,936 ----a-w c:\windows\system32\xlivefnt.dll 2008-10-25 09:56 --------- d-----w c:\documents and settings\Ice\Dane aplikacji\SPORE 2008-10-25 08:58 --------- d-----w c:\program files\DAEMON Tools Toolbar 2008-10-25 08:50 717,296 ----a-w c:\windows\system32\drivers\sptd.sys 2008-10-25 08:50 --------- d-----w c:\documents and settings\Ice\Dane aplikacji\DAEMON Tools 2008-10-16 17:16 270,336 ----a-w c:\windows\system32\imon.dll 2008-10-16 13:13 202,776 ----a-w c:\windows\system32\wuweb.dll 2008-10-16 13:13 1,809,944 ----a-w c:\windows\system32\wuaueng.dll 2008-10-16 13:12 561,688 ----a-w c:\windows\system32\wuapi.dll 2008-10-16 13:12 323,608 ----a-w c:\windows\system32\wucltui.dll 2008-10-16 13:09 92,696 ----a-w c:\windows\system32\cdm.dll 2008-10-16 13:09 51,224 ----a-w c:\windows\system32\wuauclt.exe 2008-10-16 13:09 43,544 ----a-w c:\windows\system32\wups2.dll 2008-10-16 13:08 34,328 ----a-w c:\windows\system32\wups.dll 2008-10-14 19:43 315,392 ----a-w c:\windows\HideWin.exe 2008-10-13 08:56 70,936 ----a-w c:\windows\system32\PhysXLoader.dll . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{201f27d4-3704-41d6-89c1-aa35e39143ed}] 2008-10-02 15:44 325000 --a------ c:\program files\AskBarDis\bar\bin\askBar.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar] "{3041d03e-fd4b-44e0-b742-2d9b88305f98}"= "c:\program files\AskBarDis\bar\bin\askBar.dll" [2008-10-02 325000] [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser] "{3041D03E-FD4B-44E0-B742-2D9B88305F98}"= "c:\program files\AskBarDis\bar\bin\askBar.dll" [2008-10-02 325000] [HKEY_CLASSES_ROOT\clsid\{3041d03e-fd4b-44e0-b742-2d9b88305f98}] [HKEY_CLASSES_ROOT\TypeLib\{4b1c1e16-6b34-430e-b074-5928eca4c150}] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360] "Gadu-Gadu"="e:\programy\Gadu-Gadu\gg.exe" [2007-05-10 2111176] "MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-14 1695232] "PeerGuardian"="c:\program files\PeerGuardian2\pg2.exe" [2005-09-18 1421824] "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2007-03-12 153136] "DAEMON Tools Lite"="e:\programy\Demon\DAEMON Tools Lite\daemon.exe" [2008-07-24 490952] "RGSC"="f:\giery\GTA IV\Rockstar Games Social Club\RGSCLauncher.exe" [2008-12-25 306088] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "GEST"="c:\program files\GIGABYTE\GEST\RUN.exe" [2007-12-14 236040] "Gainward"="c:\windows\TBPanel.exe" [2008-01-29 2177576] "nod32kui"="c:\program files\Eset\nod32kui.exe" [2008-10-16 917504] "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2008-12-01 136600] "PCSuiteTrayApplication"="e:\programy\Nokia Pc Suite\Nokia PC Suite 6\LaunchApplication.exe" [2006-11-28 222720] "NeroFilterCheck"="c:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2007-03-09 153136] "QuickTime Task"="e:\programy\quick time\QTTask.exe" [2008-09-06 413696] "PivotSoftware"="c:\program files\Portrait Displays\Pivot Software\wpctrl.exe" [2007-02-09 694008] "DT ACR"="c:\program files\Common Files\Portrait Displays\Shared\DT_startup.exe" [2008-06-06 81920] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-12-02 13680640] "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-12-02 86016] "RTHDCPL"="RTHDCPL.EXE" [2008-02-13 c:\windows\RTHDCPL.exe] "nwiz"="nwiz.exe" [2008-12-02 c:\windows\system32\nwiz.exe] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360] "PcSync"="e:\programy\Nokia Pc Suite\Nokia PC Suite 6\PcSync2.exe" [2006-11-09 1634304] c:\documents and settings\All Users\Menu Start\Programy\Autostart\ NOD32 FiX.lnk - c:\windows\system32\regedt32.exe [2001-10-26 3584] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "msacm.divxa32"= divxa32.acm [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\WINDOWS\\system32\\usmt\\migwiz.exe"= "c:\\Program Files\\Eset\\nod32.exe"= "c:\\Program Files\\PeerGuardian2\\pg2.exe"= "c:\\Program Files\\Vuze\\Azureus.exe"= "e:\\Programy\\Gadu-Gadu\\gg.exe"= "f:\\giery\\Collin Dirt\\DiRT.exe"= "c:\\WINDOWS\\system32\\PnkBstrA.exe"= "c:\\WINDOWS\\system32\\PnkBstrB.exe"= "f:\\Gry\\cod5\\CoDWaW.exe"= "f:\\Gry\\cod5\\CoDWaWmp.exe"= "c:\\Program Files\\Skype\\Phone\\Skype.exe"= "c:\\Program Files\\THQ\\Company of Heroes\\RelicCOH.exe"= "f:\\giery\\GTA IV\\Rockstar Games Social Club\\RGSCLauncher.exe"= "f:\\giery\\GTA IV\\Grand Theft Auto IV\\LaunchGTAIV.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "f:\\giery\\GTA IV\\Grand Theft Auto IV\\GTAIV.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "59500:UDP"= 59500:UDP:Azureus "59500:TCP"= 59500:TCP:Azureus R0 pavboot;pavboot;c:\windows\system32\drivers\pavboot.sys [2008-11-08 28544] R2 ASKService;ASKService;c:\program files\AskBarDis\bar\bin\AskService.exe [2008-10-18 460168] R2 PdiService;Portrait Displays SDK Service;c:\program files\Common Files\Portrait Displays\Drivers\pdisrvc.exe [2008-12-24 90112] R3 GEST Service;GEST Service for program management.;"c:\program files\GIGABYTE\GEST\GSvr.exe" [2008-10-14 47624] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{2bc38982-c16e-11dd-a3ef-001fd05ce29a}] \Shell\AutoRun\command - H:\ncyrf.bat \Shell\explore\Command - H:\ncyrf.bat \Shell\open\Command - H:\ncyrf.bat [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a2d73a29-a06e-11dd-a3bd-001fd05ce29a}] \Shell\AutoRun\command - H:\setup.exe *Newly Created Service* - PROCEXP90 . . ------- Skan uzupełniający ------- . uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms} uStart Page = hxxp://home.pol.chello.pl/ssi/welcome/welcome.php?url=home uInternet Settings,ProxyOverride = ;<local> uSearchURL,(Default) = hxxp://toolbar.ask.com/toolbarv/askRedirect?o=10615&gct=&gc=1&q=%s LSP: imon.dll FF - ProfilePath - c:\documents and settings\Ice\Dane aplikacji\Mozilla\Firefox\Profiles\h2pbf7q2.default\ FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q= FF - prefs.js: browser.search.selectedEngine - DAEMON Search FF - prefs.js: browser.startup.homepage - hxxp://home.pol.chello.pl/ssi/welcome/welcome.php?url=home FF - prefs.js: keyword.URL - hxxp://toolbar.ask.com/toolbarv/askRedirect?o=10615&gct=&gc=1&q= FF - plugin: c:\program files\Mozilla Firefox\plugins\npganymedenet.dll FF - plugin: e:\programy\quick time\Plugins\npqtplugin.dll FF - plugin: e:\programy\quick time\Plugins\npqtplugin2.dll FF - plugin: e:\programy\quick time\Plugins\npqtplugin3.dll FF - plugin: e:\programy\quick time\Plugins\npqtplugin4.dll FF - plugin: e:\programy\quick time\Plugins\npqtplugin5.dll FF - plugin: e:\programy\quick time\Plugins\npqtplugin6.dll FF - plugin: e:\programy\quick time\Plugins\npqtplugin7.dll . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-12-25 22:47:11 Windows 5.1.2600 Dodatek Service Pack 3 NTFS skanowanie ukrytych procesów ... skanowanie ukrytych wpisów autostartu ... skanowanie ukrytych plików ... skanowanie pomyślnie ukończone ukryte pliki: 0 ************************************************************************** . --------------------- Pliki DLL ładowane pod uruchomionymi procesami --------------------- - - - - - - - > 'winlogon.exe'(768) c:\windows\system32\CLBCATQ.DLL - - - - - - - > 'lsass.exe'(824) c:\windows\system32\imon.dll c:\program files\Eset\pr_imon.dll . Czas ukończenia: 2008-12-25 22:47:48 ComboFix-quarantined-files.txt 2008-12-25 21:47:45 Przed: 27 461 685 248 bajtów wolnych Po: 28,306,575,360 bajtów wolnych 229

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 23:06:01, on 2008-12-25 Platform: Windows XP Dodatek SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\RTHDCPL.EXE C:\WINDOWS\TBPanel.exe C:\Program Files\Eset\nod32kui.exe C:\Program Files\Java\jre6\bin\jusched.exe E:\Programy\Nokia Pc Suite\Nokia PC Suite 6\LaunchApplication.exe C:\Program Files\Portrait Displays\Pivot Software\wpctrl.exe C:\Program Files\Acer Display\eDisplay Management\DTHtml.exe C:\Program Files\Portrait Displays\Pivot Software\floater.exe C:\WINDOWS\system32\RUNDLL32.EXE C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Common Files\Portrait Displays\Shared\HookManager.exe E:\Programy\Gadu-Gadu\gg.exe C:\Program Files\PeerGuardian2\pg2.exe C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe E:\Programy\Demon\DAEMON Tools Lite\daemon.exe C:\Program Files\AskBarDis\bar\bin\AskService.exe C:\Program Files\Common Files\Portrait Displays\Shared\dtsrvc.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\Program Files\Eset\nod32krn.exe C:\WINDOWS\system32\nvsvc32.exe C:\Program Files\Common Files\Portrait Displays\Drivers\pdisrvc.exe C:\WINDOWS\system32\PnkBstrA.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe C:\Program Files\PC Connectivity Solution\ServiceLayer.exe C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe C:\WINDOWS\system32\wbem\wmiapsrv.exe C:\Program Files\GIGABYTE\GEST\GSvr.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\wuauclt.exe C:\WINDOWS\system32\notepad.exe C:\WINDOWS\explorer.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\WINDOWS\system32\mshta.exe C:\WINDOWS\system32\mshta.exe C:\WINDOWS\system32\mshta.exe E:\Programy\hijackthis\HiJackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://home.pol.chello.pl/ssi/welcome/welcome.php?url=home R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Search_URL = http://toolbar.ask.com/toolbarv/askRedirect?o=10615&gct=&gc=1&q= R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://toolbar.ask.com/toolbarv/askRedirect?o=10615&gct=&gc=1&q=%s R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = ;<local> R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0 CE\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: AskBar BHO - {201f27d4-3704-41d6-89c1-aa35e39143ed} - C:\Program Files\AskBarDis\bar\bin\askBar.dll O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll O3 - Toolbar: Ask Toolbar - {3041d03e-fd4b-44e0-b742-2d9b88305f98} - C:\Program Files\AskBarDis\bar\bin\askBar.dll O4 - HKLM\..\Run: [GEST] C:\Program Files\GIGABYTE\GEST\RUN.exe O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [Gainward] C:\WINDOWS\TBPanel.exe /A O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe" O4 - HKLM\..\Run: [PCSuiteTrayApplication] E:\Programy\Nokia Pc Suite\Nokia PC Suite 6\LaunchApplication.exe -startup O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe O4 - HKLM\..\Run: [QuickTime Task] "E:\Programy\quick time\QTTask.exe" -atboottime O4 - HKLM\..\Run: [PivotSoftware] "C:\Program Files\Portrait Displays\Pivot Software\wpctrl.exe" O4 - HKLM\..\Run: [DT ACR] C:\Program Files\Common Files\Portrait Displays\Shared\DT_startup.exe -ACR O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [Gadu-Gadu] "E:\Programy\Gadu-Gadu\gg.exe" /tray O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [PeerGuardian] C:\Program Files\PeerGuardian2\pg2.exe O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" O4 - HKCU\..\Run: [DAEMON Tools Lite] "E:\Programy\Demon\DAEMON Tools Lite\daemon.exe" -autorun O4 - HKCU\..\Run: [RGSC] F:\giery\GTA IV\Rockstar Games Social Club\RGSCLauncher.exe /silent O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\S-1-5-18\..\Run: [PcSync] E:\Programy\Nokia Pc Suite\Nokia PC Suite 6\PcSync2.exe /NoDialog (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Global Startup: NOD32 FiX.lnk = C:\WINDOWS\system32\regedt32.exe O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O14 - IERESET.INF: START_PAGE_URL=http://home.pol.chello.pl/ssi/welcome/welcome.php?url=home O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: ASKService - Unknown owner - C:\Program Files\AskBarDis\bar\bin\AskService.exe O23 - Service: Portrait Displays Display Tune Service (DTSRVC) - Unknown owner - C:\Program Files\Common Files\Portrait Displays\Shared\dtsrvc.exe O23 - Service: GEST Service for program management. (GEST Service) - Unknown owner - C:\Program Files\GIGABYTE\GEST\GSvr.exe O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe O23 - Service: NBService - Nero AG - E:\Programy\Burning Rom\Nero 7\Nero BackItUp\NBService.exe O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: Portrait Displays SDK Service (PdiService) - Portrait Displays, Inc. - C:\Program Files\Common Files\Portrait Displays\Drivers\pdisrvc.exe O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe -- End of file - 7747 bytes

**Posty:** 300 · przez **sgsman** 26 Gru 2008, 13:38

1. Zamknij porty przy pomocy programu WWDC.
2. Zastosuj SDFix w trybie awaryjnym. Rozpakowujesz program, klikasz F8 podczas restartu systemu (wejście w tryb awaryjny), uruchamiasz c:\sdfix\RunThis.bat i zatwierdzasz czyszczenie klawiszem Y. Czekasz na restart komputera i wrzucasz z niego log

3. Wrzuć po tym nowy log z ComboFixa.

...i czekaj, aż ktoś sprawdzi Ci wszystkie logi

**Posty:** 53 · przez **IceCooLL** 26 Gru 2008, 18:41

Kod: Zaznacz wszystko: SmitFraudFix v2.387 Scan done at 17:20:44,51, 2008-12-26 Run from E:\Programy\SmitfraudFix\SmitfraudFix OS: Microsoft Windows XP [Wersja 5.1.2600] - Windows_NT The filesystem type is NTFS Fix run in safe mode »»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Before SmitFraudFix !!!Attention, following keys are not inevitably infected!!! SrchSTS.exe by S!Ri Search SharedTaskScheduler's .dll »»»»»»»»»»»»»»»»»»»»»»»» Killing process »»»»»»»»»»»»»»»»»»»»»»»» hosts 127.0.0.1 localhost »»»»»»»»»»»»»»»»»»»»»»»» VACFix VACFix Credits: Malware Analysis & Diagnostic Code: S!Ri »»»»»»»»»»»»»»»»»»»»»»»» Winsock2 Fix S!Ri's WS2Fix: LSP not Found. »»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix GenericRenosFix by S!Ri »»»»»»»»»»»»»»»»»»»»»»»» Deleting infected files »»»»»»»»»»»»»»»»»»»»»»»» IEDFix IEDFix Credits: Malware Analysis & Diagnostic Code: S!Ri »»»»»»»»»»»»»»»»»»»»»»»» Agent.OMZ.Fix Agent.OMZ.Fix Credits: Malware Analysis & Diagnostic Code: S!Ri »»»»»»»»»»»»»»»»»»»»»»»» 404Fix 404Fix Credits: Malware Analysis & Diagnostic Code: S!Ri »»»»»»»»»»»»»»»»»»»»»»»» RK »»»»»»»»»»»»»»»»»»»»»»»» DNS HKLM\SYSTEM\CCS\Services\Tcpip\..\{CA4BD2BC-DA48-49C3-BFA5-59105982AF9B}: DhcpNameServer=10.0.0.1 HKLM\SYSTEM\CS1\Services\Tcpip\..\{CA4BD2BC-DA48-49C3-BFA5-59105982AF9B}: DhcpNameServer=10.0.0.1 HKLM\SYSTEM\CS2\Services\Tcpip\..\{CA4BD2BC-DA48-49C3-BFA5-59105982AF9B}: DhcpNameServer=10.0.0.1 HKLM\SYSTEM\CS3\Services\Tcpip\..\{CA4BD2BC-DA48-49C3-BFA5-59105982AF9B}: DhcpNameServer=10.0.0.1 HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=10.0.0.1 HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=10.0.0.1 HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=10.0.0.1 HKLM\SYSTEM\CS3\Services\Tcpip\Parameters: DhcpNameServer=10.0.0.1 »»»»»»»»»»»»»»»»»»»»»»»» Deleting Temp Files »»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System !!!Attention, following keys are not inevitably infected!!! [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] "System"="" »»»»»»»»»»»»»»»»»»»»»»»» Registry Cleaning Registry Cleaning done. »»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler After SmitFraudFix !!!Attention, following keys are not inevitably infected!!! SrchSTS.exe by S!Ri Search SharedTaskScheduler's .dll »»»»»»»»»»»»»»»»»»»»»»»» End

Kod: Zaznacz wszystko: ComboFix 08-12-26.01 - Ice 2008-12-26 17:37:04.2 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.3.1250.1.1045.18.2046.1428 [GMT 1:00] Uruchomiony z: e:\programy\ComboFix.exe AV: System Antywirusowy NOD32 2.50 *On-access scanning disabled* (Outdated) * Utworzono nowy punkt przywracania * Resident AV is active [COLOR=RED][B]UWAGA - TEN KOMPUTER NIE MA ZAINSTALOWANEJ KONSOLI ODZYSKIWANIA !![/B][/COLOR] . ((((((((((((((((((((((((((((((((((((((( Usunięto ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\windows\system32\404Fix.exe c:\windows\system32\dumphive.exe c:\windows\system32\IEDFix.C.exe c:\windows\system32\IEDFix.exe c:\windows\system32\o4Patch.exe c:\windows\system32\Process.exe c:\windows\system32\SrchSTS.exe c:\windows\system32\tmp.reg c:\windows\system32\VACFix.exe c:\windows\system32\VCCLSID.exe c:\windows\system32\WS2Fix.exe . ((((((((((((((((((((((((( Pliki utworzone od 2008-11-26 do 2008-12-26 ))))))))))))))))))))))))))))))) . 2008-12-26 17:20 . 2008-12-12 00:57 78,336 --a------ c:\windows\system32\Agent.OMZ.Fix.exe 2008-12-26 10:00 . 2008-12-26 10:00 4,526 --a------ c:\windows\system32\PerfStringBackup.TMP 2008-12-26 09:39 . 2008-12-26 09:39 <DIR> d-------- c:\windows\ERUNT 2008-12-26 09:39 . 2008-12-26 09:39 <DIR> d-------- C:\ERDNT 2008-12-26 09:39 . 2008-12-26 09:39 <DIR> d-------- C:\!FixIEDef 2008-12-25 23:49 . 2008-12-25 23:49 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\nView_Profiles 2008-12-25 12:01 . 2008-12-25 12:01 <DIR> d-------- c:\windows\nview 2008-12-25 12:01 . 2008-12-02 23:11 453,152 --a------ c:\windows\system32\nvudisp.exe 2008-12-25 12:01 . 2008-12-26 17:26 205,151 --a------ c:\windows\system32\nvapps.xml 2008-12-25 12:01 . 2008-12-02 23:11 18,696 --a------ c:\windows\system32\nvdisp.nvu 2008-12-25 12:00 . 2008-12-02 10:13 453,152 --a------ c:\windows\system32\NVUNINST.EXE 2008-12-25 04:54 . 2008-12-02 23:11 1,560,576 --a------ c:\windows\system32\nvcuda.dll 2008-12-25 04:53 . 2001-01-09 19:09 12,285 --a------ c:\windows\Cadx3.ini 2008-12-25 04:53 . 2003-02-14 03:20 6,942 --a------ c:\windows\cadx2.ini 2008-12-25 04:25 . 2008-12-25 04:25 <DIR> d-------- c:\windows\system32\AGEIA 2008-12-25 04:25 . 2008-12-25 04:25 <DIR> d-------- c:\program files\Common Files\Wise Installation Wizard 2008-12-25 04:25 . 2008-12-25 23:47 <DIR> d-------- c:\program files\AGEIA Technologies 2008-12-25 04:24 . 2008-12-25 04:24 <DIR> d-------- C:\NVIDIA 2008-12-25 04:05 . 2008-12-26 17:38 <DIR> d--h----- c:\documents and settings\Administrator.DANIELLO-5DCFE9\Ustawienia lokalne 2008-12-25 04:05 . 2008-10-15 04:15 <DIR> d-------- c:\documents and settings\Administrator.DANIELLO-5DCFE9\Ulubione 2008-12-25 04:05 . 2008-10-14 20:26 <DIR> d--h----- c:\documents and settings\Administrator.DANIELLO-5DCFE9\Szablony 2008-12-25 04:05 . 2008-10-15 04:15 <DIR> d-------- c:\documents and settings\Administrator.DANIELLO-5DCFE9\Pulpit 2008-12-25 04:05 . 2008-10-15 04:15 <DIR> d-------- c:\documents and settings\Administrator.DANIELLO-5DCFE9\Moje dokumenty 2008-12-25 04:05 . 2008-10-15 04:15 <DIR> dr------- c:\documents and settings\Administrator.DANIELLO-5DCFE9\Menu Start 2008-12-25 04:05 . 2008-10-15 04:15 <DIR> dr-h----- c:\documents and settings\Administrator.DANIELLO-5DCFE9\Dane aplikacji 2008-12-25 04:05 . 2008-12-25 04:05 <DIR> d-------- c:\documents and settings\Administrator.DANIELLO-5DCFE9 2008-12-25 03:45 . 2008-12-25 03:45 552 --a------ c:\windows\system32\d3d8caps.dat 2008-12-25 03:44 . 2008-12-25 03:45 <DIR> d-------- c:\program files\SystemRequirementsLab 2008-12-25 02:43 . 2008-12-25 12:14 1,324 --a------ c:\windows\system32\d3d9caps.dat 2008-12-25 02:42 . 2008-12-26 17:38 <DIR> d-------- c:\documents and settings\Administrator\Ustawienia lokalne 2008-12-25 02:42 . 2008-12-25 02:56 <DIR> d-------- c:\documents and settings\Administrator\Szablony 2008-12-25 02:42 . 2008-12-25 02:56 <DIR> d-------- c:\documents and settings\Administrator\Dane aplikacji 2008-12-25 02:42 . 2008-12-25 02:56 <DIR> d---s---- c:\documents and settings\Administrator 2008-12-25 01:46 . 2008-04-14 22:51 221,184 --a------ c:\windows\system32\wmpns.dll 2008-12-25 01:36 . 2008-04-14 22:51 294,912 -----c--- c:\windows\system32\dllcache\dlimport.exe 2008-12-25 01:33 . 2008-04-14 00:10 10,240 --------- c:\windows\system32\drivers\sffp_mmc.sys 2008-12-25 01:31 . 2006-12-29 00:31 19,569 --a------ c:\windows\[u]0[/u]03103_.tmp 2008-12-24 23:54 . 2008-12-24 23:54 <DIR> dr-h----- c:\documents and settings\Ice\Dane aplikacji\SecuROM 2008-12-24 23:39 . 2008-12-24 23:39 107,888 --a------ c:\windows\system32\CmdLineExt.dll 2008-12-24 23:37 . 2008-12-24 23:37 <DIR> d-------- c:\windows\system32\drivers\umdf 2008-12-24 23:35 . 2008-12-24 23:35 <DIR> d-------- c:\windows\system32\xlive 2008-12-24 23:35 . 2008-12-25 10:35 <DIR> d-------- c:\program files\Microsoft Games for Windows - LIVE 2008-12-24 22:43 . 2008-12-24 22:43 <DIR> d-------- c:\program files\MSBuild 2008-12-24 22:40 . 2008-12-24 22:40 <DIR> d-------- c:\windows\system32\XPSViewer 2008-12-24 22:39 . 2008-12-24 22:39 <DIR> d-------- c:\program files\Reference Assemblies 2008-12-24 22:39 . 2006-06-29 13:07 14,048 --------- c:\windows\system32\spmsg2.dll 2008-12-24 22:21 . 2008-12-24 22:21 <DIR> d-------- c:\program files\Common Files\Adobe 2008-12-24 22:20 . 2008-12-24 22:20 <DIR> d-------- c:\windows\Cache 2008-12-24 20:36 . 2008-12-24 20:36 <DIR> d-------- c:\documents and settings\Ice\Dane aplikacji\DisplayTune 2008-12-24 20:33 . 2008-12-24 20:33 <DIR> d-------- c:\program files\Portrait Displays 2008-12-24 20:33 . 2008-12-24 20:33 <DIR> d-------- c:\program files\Common Files\Portrait Displays 2008-12-24 20:32 . 2008-12-24 20:32 <DIR> d-------- c:\program files\Acer Display 2008-12-24 16:37 . 2008-12-24 16:37 <DIR> d-------- c:\documents and settings\Ice\Dane aplikacji\Datalayer 2008-12-20 00:00 . 2008-12-20 00:00 <DIR> d-------- c:\documents and settings\Ice\Dane aplikacji\Apple Computer 2008-12-10 20:24 . 2008-12-10 20:24 <DIR> d-------- c:\program files\THQ 2008-12-02 23:11 . 2008-12-02 23:11 13,680,640 --a------ c:\windows\system32\nvcpl.dll 2008-12-01 20:40 . 2008-11-10 05:43 410,984 --a------ c:\windows\system32\deploytk.dll . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-12-26 16:38 16,608 ----a-w c:\windows\gdrv.sys 2008-12-26 16:36 --------- d-----w c:\program files\PeerGuardian2 2008-12-26 09:00 --------- d-----w c:\program files\Java 2008-12-25 21:45 --------- d-----w c:\program files\Eset 2008-12-24 21:47 --------- d--h--w c:\program files\InstallShield Installation Information 2008-12-24 15:37 --------- d-----w c:\documents and settings\Ice\Dane aplikacji\PC Suite 2008-12-07 18:55 202,000 ----a-w c:\windows\system32\PnkBstrB.exe 2008-12-07 18:55 139,280 ----a-w c:\windows\system32\drivers\PnkBstrK.sys 2008-11-25 21:42 --------- d-----w c:\documents and settings\Ice\Dane aplikacji\Skype 2008-11-25 21:24 --------- d-----w c:\documents and settings\Ice\Dane aplikacji\skypePM 2008-11-21 14:18 --------- d-----w c:\program files\7-Zip 2008-11-20 23:31 --------- d-----w c:\documents and settings\Ice\Dane aplikacji\com.raptr.Raptr.848BBC53270CAC248E8FA0F339176201CDEB525F.1 2008-11-20 23:30 --------- d-----w c:\documents and settings\Ice\Dane aplikacji\Raptr 2008-11-20 23:29 --------- d-----w c:\program files\Common Files\Adobe AIR 2008-11-20 22:20 22,328 ----a-w c:\documents and settings\Ice\Dane aplikacji\PnkBstrK.sys 2008-11-20 22:19 682,280 ----a-w c:\windows\system32\pbsvc.exe 2008-11-20 22:19 66,872 ----a-w c:\windows\system32\PnkBstrA.exe 2008-11-20 18:44 --------- d-----w c:\documents and settings\Ice\Dane aplikacji\GanymedeNet 2008-11-16 10:00 --------- d-----w c:\program files\USB Vibration 2008-11-16 08:38 --------- d-----w c:\program files\VID_0E8F&PID_0003 2008-11-11 17:26 --------- d-----w c:\program files\Common Files\Apple 2008-11-11 17:26 --------- d-----w c:\program files\Apple Software Update 2008-11-11 17:26 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\Apple Computer 2008-11-11 17:26 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\Apple 2008-11-11 17:25 --------- d-----w c:\documents and settings\Ice\Dane aplikacji\Ahead 2008-11-11 12:01 --------- d-----w c:\documents and settings\Ice\Dane aplikacji\Azureus 2008-11-08 20:07 --------- d-----w c:\program files\Panda Security 2008-11-07 21:14 --------- d-----w c:\program files\Vuze 2008-11-05 22:07 --------- d-----w c:\program files\Common Files\COWON 2008-10-28 16:41 14,303,392 ----a-w c:\windows\system32\xlive.dll 2008-10-28 16:41 13,643,936 ----a-w c:\windows\system32\xlivefnt.dll 2008-10-16 17:16 270,336 ----a-w c:\windows\system32\imon.dll 2008-10-16 13:13 202,776 ----a-w c:\windows\system32\wuweb.dll 2008-10-16 13:13 1,809,944 ----a-w c:\windows\system32\wuaueng.dll 2008-10-16 13:12 561,688 ----a-w c:\windows\system32\wuapi.dll 2008-10-16 13:12 323,608 ----a-w c:\windows\system32\wucltui.dll 2008-10-16 13:09 92,696 ----a-w c:\windows\system32\cdm.dll 2008-10-16 13:09 51,224 ----a-w c:\windows\system32\wuauclt.exe 2008-10-16 13:09 43,544 ----a-w c:\windows\system32\wups2.dll 2008-10-16 13:08 34,328 ----a-w c:\windows\system32\wups.dll 2008-10-14 19:43 315,392 ----a-w c:\windows\HideWin.exe 2008-10-13 08:56 70,936 ----a-w c:\windows\system32\PhysXLoader.dll . ((((((((((((((((((((((((((((( snapshot@2008-12-25_22.47.25,00 ))))))))))))))))))))))))))))))))))))))))) . + 2005-10-20 16:00:28 157,696 ----a-w c:\windows\ERUNT\ERUNT.EXE - 2008-12-01 19:40:39 144,792 ----a-w c:\windows\system32\java.exe + 2008-11-10 04:43:37 144,792 ----a-w c:\windows\system32\java.exe - 2008-12-01 19:40:39 144,792 ----a-w c:\windows\system32\javaw.exe + 2008-11-10 04:43:38 144,792 ----a-w c:\windows\system32\javaw.exe - 2008-12-01 19:40:39 148,888 ----a-w c:\windows\system32\javaws.exe + 2008-11-10 04:43:39 148,888 ----a-w c:\windows\system32\javaws.exe - 2008-12-25 01:47:06 66,376 ----a-w c:\windows\system32\perfc009.dat + 2008-12-26 09:00:19 66,492 ----a-w c:\windows\system32\perfc009.dat - 2008-12-25 01:47:06 82,010 ----a-w c:\windows\system32\perfc015.dat + 2008-12-26 09:00:19 82,126 ----a-w c:\windows\system32\perfc015.dat - 2008-12-25 01:47:06 427,592 ----a-w c:\windows\system32\perfh009.dat + 2008-12-26 09:00:19 427,900 ----a-w c:\windows\system32\perfh009.dat - 2008-12-25 01:47:06 484,634 ----a-w c:\windows\system32\perfh015.dat + 2008-12-26 09:00:19 484,968 ----a-w c:\windows\system32\perfh015.dat + 2006-01-09 08:36:06 40,960 ----a-w c:\windows\system32\swsc.exe + 2008-12-26 16:26:05 16,384 ----atw c:\windows\Temp\Perflib_Perfdata_404.dat - 2008-12-25 21:24:09 1,500 ----a-w c:\windows\UI\BIOSCTL.DAT + 2008-12-26 16:26:34 1,500 ----a-w c:\windows\UI\BIOSCTL.DAT . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{201f27d4-3704-41d6-89c1-aa35e39143ed}] 2008-10-02 15:44 325000 --a------ c:\program files\AskBarDis\bar\bin\askBar.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar] "{3041d03e-fd4b-44e0-b742-2d9b88305f98}"= "c:\program files\AskBarDis\bar\bin\askBar.dll" [2008-10-02 325000] [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser] "{3041D03E-FD4B-44E0-B742-2D9B88305F98}"= "c:\program files\AskBarDis\bar\bin\askBar.dll" [2008-10-02 325000] [HKEY_CLASSES_ROOT\clsid\{3041d03e-fd4b-44e0-b742-2d9b88305f98}] [HKEY_CLASSES_ROOT\TypeLib\{4b1c1e16-6b34-430e-b074-5928eca4c150}] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360] "Gadu-Gadu"="e:\programy\Gadu-Gadu\gg.exe" [2007-05-10 2111176] "MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-14 1695232] "PeerGuardian"="c:\program files\PeerGuardian2\pg2.exe" [2005-09-18 1421824] "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2007-03-12 153136] "DAEMON Tools Lite"="e:\programy\Demon\DAEMON Tools Lite\daemon.exe" [2008-07-24 490952] "RGSC"="f:\giery\GTA IV\Rockstar Games Social Club\RGSCLauncher.exe" [2008-12-25 306088] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "GEST"="c:\program files\GIGABYTE\GEST\RUN.exe" [2007-12-14 236040] "Gainward"="c:\windows\TBPanel.exe" [2008-01-29 2177576] "nod32kui"="c:\program files\Eset\nod32kui.exe" [2008-10-16 917504] "PCSuiteTrayApplication"="e:\programy\Nokia Pc Suite\Nokia PC Suite 6\LaunchApplication.exe" [2006-11-28 222720] "NeroFilterCheck"="c:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2007-03-09 153136] "QuickTime Task"="e:\programy\quick time\QTTask.exe" [2008-09-06 413696] "PivotSoftware"="c:\program files\Portrait Displays\Pivot Software\wpctrl.exe" [2007-02-09 694008] "DT ACR"="c:\program files\Common Files\Portrait Displays\Shared\DT_startup.exe" [2008-06-06 81920] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-12-02 13680640] "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-12-02 86016] "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2008-11-10 136600] "RTHDCPL"="RTHDCPL.EXE" [2008-02-13 c:\windows\RTHDCPL.exe] "nwiz"="nwiz.exe" [2008-12-02 c:\windows\system32\nwiz.exe] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360] "PcSync"="e:\programy\Nokia Pc Suite\Nokia PC Suite 6\PcSync2.exe" [2006-11-09 1634304] c:\documents and settings\All Users\Menu Start\Programy\Autostart\ NOD32 FiX.lnk - c:\windows\system32\regedt32.exe [2001-10-26 3584] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "msacm.divxa32"= divxa32.acm [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\WINDOWS\\system32\\usmt\\migwiz.exe"= "c:\\Program Files\\Eset\\nod32.exe"= "c:\\Program Files\\PeerGuardian2\\pg2.exe"= "c:\\Program Files\\Vuze\\Azureus.exe"= "e:\\Programy\\Gadu-Gadu\\gg.exe"= "f:\\giery\\Collin Dirt\\DiRT.exe"= "c:\\WINDOWS\\system32\\PnkBstrA.exe"= "c:\\WINDOWS\\system32\\PnkBstrB.exe"= "f:\\Gry\\cod5\\CoDWaW.exe"= "f:\\Gry\\cod5\\CoDWaWmp.exe"= "c:\\Program Files\\Skype\\Phone\\Skype.exe"= "c:\\Program Files\\THQ\\Company of Heroes\\RelicCOH.exe"= "f:\\giery\\GTA IV\\Rockstar Games Social Club\\RGSCLauncher.exe"= "f:\\giery\\GTA IV\\Grand Theft Auto IV\\LaunchGTAIV.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "f:\\giery\\GTA IV\\Grand Theft Auto IV\\GTAIV.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "59500:UDP"= 59500:UDP:Azureus "59500:TCP"= 59500:TCP:Azureus R0 pavboot;pavboot;c:\windows\system32\drivers\pavboot.sys [2008-11-08 28544] R2 ASKService;ASKService;c:\program files\AskBarDis\bar\bin\AskService.exe [2008-10-18 460168] R2 PdiService;Portrait Displays SDK Service;c:\program files\Common Files\Portrait Displays\Drivers\pdisrvc.exe [2008-12-24 90112] R3 GEST Service;GEST Service for program management.;"c:\program files\GIGABYTE\GEST\GSvr.exe" [2008-10-14 47624] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{2bc38982-c16e-11dd-a3ef-001fd05ce29a}] \Shell\AutoRun\command - H:\ncyrf.bat \Shell\explore\Command - H:\ncyrf.bat \Shell\open\Command - H:\ncyrf.bat [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a2d73a29-a06e-11dd-a3bd-001fd05ce29a}] \Shell\AutoRun\command - H:\setup.exe *Newly Created Service* - PGFILTER . . ------- Skan uzupełniający ------- . uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms} uStart Page = hxxp://home.pol.chello.pl/ssi/welcome/welcome.php?url=home uInternet Settings,ProxyOverride = ;<local> uSearchURL,(Default) = hxxp://toolbar.ask.com/toolbarv/askRedirect?o=10615&gct=&gc=1&q=%s LSP: imon.dll FF - ProfilePath - c:\documents and settings\Ice\Dane aplikacji\Mozilla\Firefox\Profiles\h2pbf7q2.default\ FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q= FF - prefs.js: browser.search.selectedEngine - DAEMON Search FF - prefs.js: browser.startup.homepage - hxxp://home.pol.chello.pl/ssi/welcome/welcome.php?url=home FF - prefs.js: keyword.URL - hxxp://toolbar.ask.com/toolbarv/askRedirect?o=10615&gct=&gc=1&q= FF - plugin: c:\program files\Mozilla Firefox\plugins\npganymedenet.dll FF - plugin: e:\programy\quick time\Plugins\npqtplugin.dll FF - plugin: e:\programy\quick time\Plugins\npqtplugin2.dll FF - plugin: e:\programy\quick time\Plugins\npqtplugin3.dll FF - plugin: e:\programy\quick time\Plugins\npqtplugin4.dll FF - plugin: e:\programy\quick time\Plugins\npqtplugin5.dll FF - plugin: e:\programy\quick time\Plugins\npqtplugin6.dll FF - plugin: e:\programy\quick time\Plugins\npqtplugin7.dll . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-12-26 17:38:42 Windows 5.1.2600 Dodatek Service Pack 3 NTFS skanowanie ukrytych procesów ... skanowanie ukrytych wpisów autostartu ... skanowanie ukrytych plików ... skanowanie pomyślnie ukończone ukryte pliki: 0 ************************************************************************** . --------------------- Pliki DLL ładowane pod uruchomionymi procesami --------------------- - - - - - - - > 'lsass.exe'(824) c:\windows\system32\imon.dll c:\program files\Eset\pr_imon.dll . Czas ukończenia: 2008-12-26 17:39:16 ComboFix-quarantined-files.txt 2008-12-26 16:39:14 ComboFix2.txt 2008-12-25 21:47:49 Przed: 28 099 276 800 bajtów wolnych Po: 28,106,420,224 bajtów wolnych 267

**Posty:** 300 · przez **sgsman** 26 Gru 2008, 19:09

Wrzuć loga z SDFixa, nie SmitFraudFixa

i czekaj na pomoc.

**Posty:** 8001 · przez **Okocza** 26 Gru 2008, 19:43

przeskanuj na www.virustotal.com i daj raporty

Kod: Zaznacz wszystko: c:\windows\system32\Agent.OMZ.Fix.exe c:\windows\system32\PerfStringBackup.TMP

wklej w notatnik

Kod: Zaznacz wszystko: Windows Registry Editor Version 5.00 [-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{2bc38982-c16e-11dd-a3ef-001fd05ce29a}]

zapisz jako fix.reg i odpal

wracasz z logiem z CF i SDFixa

**Posty:** 53 · przez **IceCooLL** 26 Gru 2008, 23:58

Kod: Zaznacz wszystko: Plik Agent.OMZ.Fix.exe otrzymany 2008.12.26 12:58:04 (CET) Antywirus Wersja Ostatnia aktualizacja Wynik a-squared 4.0.0.73 2008.12.26 - AhnLab-V3 2008.12.25.0 2008.12.26 - AntiVir 7.9.0.45 2008.12.25 - Authentium 5.1.0.4 2008.12.25 - Avast 4.8.1281.0 2008.12.26 - AVG 8.0.0.199 2008.12.25 - BitDefender 7.2 2008.12.26 - CAT-QuickHeal 10.00 2008.12.26 - ClamAV 0.94.1 2008.12.26 - Comodo 819 2008.12.26 - DrWeb 4.44.0.09170 2008.12.26 - eSafe 7.0.17.0 2008.12.24 Suspicious File eTrust-Vet 31.6.6276 2008.12.24 - Ewido 4.0 2008.12.26 - F-Prot 4.4.4.56 2008.12.24 - F-Secure 8.0.14332.0 2008.12.26 W32/Zlob.gen123 Fortinet 3.117.0.0 2008.12.26 - GData 19 2008.12.26 - Ikarus T3.1.1.45.0 2008.12.26 - K7AntiVirus 7.10.566 2008.12.25 - Kaspersky 7.0.0.125 2008.12.26 - McAfee 5474 2008.12.24 - McAfee+Artemis 5474 2008.12.24 - Microsoft 1.4205 2008.12.26 - NOD32 3718 2008.12.26 - Norman 5.80.02 2008.12.24 W32/Zlob.gen123 Panda 9.0.0.4 2008.12.26 - PCTools 4.4.2.0 2008.12.26 - Prevx1 V2 2008.12.26 - Rising 21.09.42.00 2008.12.26 - SecureWeb-Gateway 6.7.6 2008.12.25 - Sophos 4.37.0 2008.12.26 - Sunbelt 3.2.1809.2 2008.12.22 - Symantec 10 2008.12.26 - TheHacker 6.3.1.4.199 2008.12.23 - TrendMicro 8.700.0.1004 2008.12.26 - VBA32 3.12.8.10 2008.12.25 - ViRobot 2008.12.26.1536 2008.12.26 - VirusBuster 4.5.11.0 2008.12.25 - Dodatkowe informacje File size: 78336 bytes MD5...: c02562a732f0223082d4ccfc7d4f23df SHA1..: f02f4a27823772c2ca04c01f5c390887a109d277 SHA256: 4d40d3826750344c4c6080d20f20ad47f694c972923a024edaae998ef23a6ae0 SHA512: 65c10e96058af25046ef4526b77cffd76cabb804830987bf20482913518640e9 5db1c327dd2b87c48521d56e9901df897d1c92eaa7f88d0e94ec615789fa83c0 ssdeep: 1536:xtQ1IK3cY2Q/CAZIXKPPumZGkF57RtuIHd7b/pOVVH:xi9l/XPPFJHdIIHd 7FQVH PEiD..: - TrID..: File type identification UPX compressed Win32 Executable (39.5%) Win32 EXE Yoda's Crypter (34.3%) Win32 Executable Generic (11.0%) Win32 Dynamic Link Library (generic) (9.8%) Generic Win/DOS Executable (2.5%) PEInfo: PE Structure information ( base data ) entrypointaddress.: 0x44c690 timedatestamp.....: 0x4941a8f7 (Thu Dec 11 23:57:43 2008) machinetype.......: 0x14c (I386) ( 3 sections ) name viradd virsiz rawdsiz ntrpy md5 UPX0 0x1000 0x39000 0x0 0.00 d41d8cd98f00b204e9800998ecf8427e UPX1 0x3a000 0x13000 0x12a00 7.90 5bf4d8410d3c5848231e58a9108ced2f .rsrc 0x4d000 0x1000 0x600 2.87 aeb2f4c788c343e5ccc1f080f1f65e5f ( 4 imports ) > KERNEL32.DLL: LoadLibraryA, GetProcAddress, VirtualProtect, VirtualAlloc, VirtualFree, ExitProcess > ADVAPI32.DLL: RegOpenKeyExA > msvcrt.dll: _iob > SHELL32.DLL: ShellExecuteA ( 0 exports ) CWSandbox info: <a href="http://research.sunbelt-software.com/partnerresource/MD5.aspx?md5=c02562a732f0223082d4ccfc7d4f23df" target="_blank">http://research.sunbelt-software.com/partnerresource/MD5.aspx?md5=c02562a732f0223082d4ccfc7d4f23df</a> packers (Kaspersky): PE_Patch.UPX, UPX packers (F-Prot): UPX

Kod: Zaznacz wszystko: Plik PerfStringBackup.TMP otrzymany 2008.12.26 22:55:07 (CET) Antywirus Wersja Ostatnia aktualizacja Wynik a-squared 4.0.0.73 2008.12.26 - AhnLab-V3 2008.12.25.0 2008.12.26 - AntiVir 7.9.0.45 2008.12.26 - Authentium 5.1.0.4 2008.12.26 - Avast 4.8.1281.0 2008.12.26 - AVG 8.0.0.199 2008.12.26 - BitDefender 7.2 2008.12.26 - CAT-QuickHeal 10.00 2008.12.26 - ClamAV 0.94.1 2008.12.26 - Comodo 819 2008.12.26 - DrWeb 4.44.0.09170 2008.12.26 - eSafe 7.0.17.0 2008.12.24 - eTrust-Vet 31.6.6276 2008.12.24 - Ewido 4.0 2008.12.26 - F-Prot 4.4.4.56 2008.12.26 - F-Secure 8.0.14332.0 2008.12.26 - Fortinet 3.117.0.0 2008.12.26 - GData 19 2008.12.26 - Ikarus T3.1.1.45.0 2008.12.26 - K7AntiVirus 7.10.567 2008.12.26 - Kaspersky 7.0.0.125 2008.12.26 - McAfee 5475 2008.12.26 - McAfee+Artemis 5475 2008.12.26 - Microsoft 1.4205 2008.12.26 - NOD32 3718 2008.12.26 - Norman 5.80.02 2008.12.26 - Panda 9.0.0.4 2008.12.26 - PCTools 4.4.2.0 2008.12.26 - Prevx1 V2 2008.12.26 - Rising 21.09.42.00 2008.12.26 - SecureWeb-Gateway 6.7.6 2008.12.26 - Sophos 4.37.0 2008.12.26 - Sunbelt 3.2.1809.2 2008.12.22 - Symantec 10 2008.12.26 - TheHacker 6.3.1.4.200 2008.12.26 - TrendMicro 8.700.0.1004 2008.12.26 - VBA32 3.12.8.10 2008.12.26 - ViRobot 2008.12.26.1536 2008.12.26 - VirusBuster 4.5.11.0 2008.12.26 - Dodatkowe informacje File size: 4526 bytes MD5...: 1400b607f045e18c4c5d34c28f2d6575 SHA1..: af6293977f478d0d5106256d27b8e29bf53c5d2f SHA256: c8552536f81025c90f84cf201b663cb8265ddd99cff0976b404c514ff2728f9b SHA512: 977a34d10bc5ce93e4d404ddc0ea700e2e84addd364085725bf6d12128d871be 369809dad2b0cd004f7281e5657969b0275bd59bd00fd17efb448117488d336d ssdeep: 48:rsM/3S5YN33KgSCyv7vLAaDle7z0AwtUiZk/QML/TMxgraGZx+qQU:vdK0yv7 vLD50ziMLLMxOLj PEiD..: - TrID..: File type identification Lumena CEL bitmap (60.5%) Corel Photo Paint (39.4%) PEInfo: -

To raporty z virustotal

Dodano 26.12.2008 23:08:09:

Kod: Zaznacz wszystko: ComboFix 08-12-26.01 - Ice 2008-12-26 23:03:11.3 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.3.1250.1.1045.18.2046.1403 [GMT 1:00] Uruchomiony z: e:\programy\ComboFix.exe AV: System Antywirusowy NOD32 2.50 *On-access scanning disabled* (Outdated) * Resident AV is active [COLOR=RED][B]UWAGA - TEN KOMPUTER NIE MA ZAINSTALOWANEJ KONSOLI ODZYSKIWANIA !![/B][/COLOR] . ((((((((((((((((((((((((( Pliki utworzone od 2008-11-26 do 2008-12-26 ))))))))))))))))))))))))))))))) . 2008-12-26 22:28 . 2008-12-26 22:28 580,096 --a--c--- c:\windows\system32\dllcache\user32.dll 2008-12-26 22:18 . 2008-12-26 22:18 <DIR> d-------- C:\sdfix 2008-12-26 17:20 . 2008-12-12 00:57 78,336 --a------ c:\windows\system32\Agent.OMZ.Fix.exe 2008-12-26 10:00 . 2008-12-26 10:00 4,526 --a------ c:\windows\system32\PerfStringBackup.TMP 2008-12-26 09:39 . 2008-12-26 22:27 <DIR> d-------- c:\windows\ERUNT 2008-12-26 09:39 . 2008-12-26 09:39 <DIR> d-------- C:\ERDNT 2008-12-26 09:39 . 2008-12-26 09:39 <DIR> d-------- C:\!FixIEDef 2008-12-25 23:49 . 2008-12-25 23:49 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\nView_Profiles 2008-12-25 12:01 . 2008-12-25 12:01 <DIR> d-------- c:\windows\nview 2008-12-25 12:01 . 2008-12-02 23:11 453,152 --a------ c:\windows\system32\nvudisp.exe 2008-12-25 12:01 . 2008-12-26 22:36 205,151 --a------ c:\windows\system32\nvapps.xml 2008-12-25 12:01 . 2008-12-02 23:11 18,696 --a------ c:\windows\system32\nvdisp.nvu 2008-12-25 12:00 . 2008-12-02 10:13 453,152 --a------ c:\windows\system32\NVUNINST.EXE 2008-12-25 04:54 . 2008-12-02 23:11 1,560,576 --a------ c:\windows\system32\nvcuda.dll 2008-12-25 04:53 . 2001-01-09 19:09 12,285 --a------ c:\windows\Cadx3.ini 2008-12-25 04:53 . 2003-02-14 03:20 6,942 --a------ c:\windows\cadx2.ini 2008-12-25 04:25 . 2008-12-25 04:25 <DIR> d-------- c:\windows\system32\AGEIA 2008-12-25 04:25 . 2008-12-25 04:25 <DIR> d-------- c:\program files\Common Files\Wise Installation Wizard 2008-12-25 04:25 . 2008-12-25 23:47 <DIR> d-------- c:\program files\AGEIA Technologies 2008-12-25 04:24 . 2008-12-25 04:24 <DIR> d-------- C:\NVIDIA 2008-12-25 04:05 . 2008-12-26 23:04 <DIR> d--h----- c:\documents and settings\Administrator.DANIELLO-5DCFE9\Ustawienia lokalne 2008-12-25 04:05 . 2008-10-15 04:15 <DIR> d-------- c:\documents and settings\Administrator.DANIELLO-5DCFE9\Ulubione 2008-12-25 04:05 . 2008-10-14 20:26 <DIR> d--h----- c:\documents and settings\Administrator.DANIELLO-5DCFE9\Szablony 2008-12-25 04:05 . 2008-12-26 22:28 <DIR> d-------- c:\documents and settings\Administrator.DANIELLO-5DCFE9\Pulpit 2008-12-25 04:05 . 2008-10-15 04:15 <DIR> d-------- c:\documents and settings\Administrator.DANIELLO-5DCFE9\Moje dokumenty 2008-12-25 04:05 . 2008-10-15 04:15 <DIR> dr------- c:\documents and settings\Administrator.DANIELLO-5DCFE9\Menu Start 2008-12-25 04:05 . 2008-10-15 04:15 <DIR> dr-h----- c:\documents and settings\Administrator.DANIELLO-5DCFE9\Dane aplikacji 2008-12-25 04:05 . 2008-12-25 04:05 <DIR> d-------- c:\documents and settings\Administrator.DANIELLO-5DCFE9 2008-12-25 03:45 . 2008-12-25 03:45 552 --a------ c:\windows\system32\d3d8caps.dat 2008-12-25 03:44 . 2008-12-25 03:45 <DIR> d-------- c:\program files\SystemRequirementsLab 2008-12-25 02:43 . 2008-12-25 12:14 1,324 --a------ c:\windows\system32\d3d9caps.dat 2008-12-25 02:42 . 2008-12-26 23:04 <DIR> d-------- c:\documents and settings\Administrator\Ustawienia lokalne 2008-12-25 02:42 . 2008-12-25 02:56 <DIR> d-------- c:\documents and settings\Administrator\Szablony 2008-12-25 02:42 . 2008-12-25 02:56 <DIR> d-------- c:\documents and settings\Administrator\Dane aplikacji 2008-12-25 02:42 . 2008-12-25 02:56 <DIR> d---s---- c:\documents and settings\Administrator 2008-12-25 01:46 . 2008-04-14 22:51 221,184 --a------ c:\windows\system32\wmpns.dll 2008-12-25 01:36 . 2008-04-14 22:51 294,912 -----c--- c:\windows\system32\dllcache\dlimport.exe 2008-12-25 01:33 . 2008-04-14 00:10 10,240 --------- c:\windows\system32\drivers\sffp_mmc.sys 2008-12-25 01:31 . 2006-12-29 00:31 19,569 --a------ c:\windows\[u]0[/u]03103_.tmp 2008-12-24 23:54 . 2008-12-24 23:54 <DIR> dr-h----- c:\documents and settings\Ice\Dane aplikacji\SecuROM 2008-12-24 23:39 . 2008-12-24 23:39 107,888 --a------ c:\windows\system32\CmdLineExt.dll 2008-12-24 23:37 . 2008-12-24 23:37 <DIR> d-------- c:\windows\system32\drivers\umdf 2008-12-24 23:35 . 2008-12-24 23:35 <DIR> d-------- c:\windows\system32\xlive 2008-12-24 23:35 . 2008-12-25 10:35 <DIR> d-------- c:\program files\Microsoft Games for Windows - LIVE 2008-12-24 22:43 . 2008-12-24 22:43 <DIR> d-------- c:\program files\MSBuild 2008-12-24 22:40 . 2008-12-24 22:40 <DIR> d-------- c:\windows\system32\XPSViewer 2008-12-24 22:39 . 2008-12-24 22:39 <DIR> d-------- c:\program files\Reference Assemblies 2008-12-24 22:39 . 2006-06-29 13:07 14,048 --------- c:\windows\system32\spmsg2.dll 2008-12-24 22:21 . 2008-12-24 22:21 <DIR> d-------- c:\program files\Common Files\Adobe 2008-12-24 22:20 . 2008-12-24 22:20 <DIR> d-------- c:\windows\Cache 2008-12-24 20:36 . 2008-12-24 20:36 <DIR> d-------- c:\documents and settings\Ice\Dane aplikacji\DisplayTune 2008-12-24 20:33 . 2008-12-24 20:33 <DIR> d-------- c:\program files\Portrait Displays 2008-12-24 20:33 . 2008-12-24 20:33 <DIR> d-------- c:\program files\Common Files\Portrait Displays 2008-12-24 20:32 . 2008-12-24 20:32 <DIR> d-------- c:\program files\Acer Display 2008-12-24 16:37 . 2008-12-24 16:37 <DIR> d-------- c:\documents and settings\Ice\Dane aplikacji\Datalayer 2008-12-20 00:00 . 2008-12-20 00:00 <DIR> d-------- c:\documents and settings\Ice\Dane aplikacji\Apple Computer 2008-12-10 20:24 . 2008-12-10 20:24 <DIR> d-------- c:\program files\THQ 2008-12-02 23:11 . 2008-12-02 23:11 13,680,640 --a------ c:\windows\system32\nvcpl.dll 2008-12-01 20:40 . 2008-11-10 05:43 410,984 --a------ c:\windows\system32\deploytk.dll . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-12-26 22:04 16,608 ----a-w c:\windows\gdrv.sys 2008-12-26 22:03 --------- d-----w c:\program files\PeerGuardian2 2008-12-26 09:00 --------- d-----w c:\program files\Java 2008-12-25 21:45 --------- d-----w c:\program files\Eset 2008-12-24 21:47 --------- d--h--w c:\program files\InstallShield Installation Information 2008-12-24 15:37 --------- d-----w c:\documents and settings\Ice\Dane aplikacji\PC Suite 2008-12-07 18:55 202,000 ----a-w c:\windows\system32\PnkBstrB.exe 2008-12-07 18:55 139,280 ----a-w c:\windows\system32\drivers\PnkBstrK.sys 2008-11-25 21:42 --------- d-----w c:\documents and settings\Ice\Dane aplikacji\Skype 2008-11-25 21:24 --------- d-----w c:\documents and settings\Ice\Dane aplikacji\skypePM 2008-11-21 14:18 --------- d-----w c:\program files\7-Zip 2008-11-20 23:31 --------- d-----w c:\documents and settings\Ice\Dane aplikacji\com.raptr.Raptr.848BBC53270CAC248E8FA0F339176201CDEB525F.1 2008-11-20 23:30 --------- d-----w c:\documents and settings\Ice\Dane aplikacji\Raptr 2008-11-20 23:29 --------- d-----w c:\program files\Common Files\Adobe AIR 2008-11-20 22:20 22,328 ----a-w c:\documents and settings\Ice\Dane aplikacji\PnkBstrK.sys 2008-11-20 22:19 682,280 ----a-w c:\windows\system32\pbsvc.exe 2008-11-20 22:19 66,872 ----a-w c:\windows\system32\PnkBstrA.exe 2008-11-20 18:44 --------- d-----w c:\documents and settings\Ice\Dane aplikacji\GanymedeNet 2008-11-16 10:00 --------- d-----w c:\program files\USB Vibration 2008-11-16 08:38 --------- d-----w c:\program files\VID_0E8F&PID_0003 2008-11-11 17:26 --------- d-----w c:\program files\Common Files\Apple 2008-11-11 17:26 --------- d-----w c:\program files\Apple Software Update 2008-11-11 17:26 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\Apple Computer 2008-11-11 17:26 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\Apple 2008-11-11 17:25 --------- d-----w c:\documents and settings\Ice\Dane aplikacji\Ahead 2008-11-11 12:01 --------- d-----w c:\documents and settings\Ice\Dane aplikacji\Azureus 2008-11-08 20:07 --------- d-----w c:\program files\Panda Security 2008-11-07 21:14 --------- d-----w c:\program files\Vuze 2008-11-05 22:07 --------- d-----w c:\program files\Common Files\COWON 2008-10-28 16:41 14,303,392 ----a-w c:\windows\system32\xlive.dll 2008-10-28 16:41 13,643,936 ----a-w c:\windows\system32\xlivefnt.dll 2008-10-16 17:16 270,336 ----a-w c:\windows\system32\imon.dll 2008-10-16 13:13 202,776 ----a-w c:\windows\system32\wuweb.dll 2008-10-16 13:13 1,809,944 ----a-w c:\windows\system32\wuaueng.dll 2008-10-16 13:12 561,688 ----a-w c:\windows\system32\wuapi.dll 2008-10-16 13:12 323,608 ----a-w c:\windows\system32\wucltui.dll 2008-10-16 13:09 92,696 ----a-w c:\windows\system32\cdm.dll 2008-10-16 13:09 51,224 ----a-w c:\windows\system32\wuauclt.exe 2008-10-16 13:09 43,544 ----a-w c:\windows\system32\wups2.dll 2008-10-16 13:08 34,328 ----a-w c:\windows\system32\wups.dll 2008-10-14 19:43 315,392 ----a-w c:\windows\HideWin.exe 2008-10-13 08:56 70,936 ----a-w c:\windows\system32\PhysXLoader.dll . ((((((((((((((((((((((((((((( snapshot@2008-12-25_22.47.25,00 ))))))))))))))))))))))))))))))))))))))))) . + 2005-10-20 16:00:28 157,696 ----a-w c:\windows\ERUNT\ERUNT.EXE + 2008-08-07 14:27:04 163,328 ----a-w c:\windows\ERUNT\SDFIX\ERDNT.EXE + 2008-12-26 21:27:46 483,328 ----a-w c:\windows\ERUNT\SDFIX\Users\[u]0[/u]0000001\NTUSER.DAT + 2008-12-26 21:27:46 8,192 ----a-w c:\windows\ERUNT\SDFIX\Users\[u]0[/u]0000002\UsrClass.dat + 2008-08-07 14:27:04 163,328 ----a-w c:\windows\ERUNT\SDFIX_First_Run\ERDNT.EXE + 2008-12-26 21:27:37 483,328 ----a-w c:\windows\ERUNT\SDFIX_First_Run\Users\[u]0[/u]0000001\NTUSER.DAT + 2008-12-26 21:27:37 8,192 ----a-w c:\windows\ERUNT\SDFIX_First_Run\Users\[u]0[/u]0000002\UsrClass.dat - 2008-12-01 19:40:39 144,792 ----a-w c:\windows\system32\java.exe + 2008-11-10 04:43:37 144,792 ----a-w c:\windows\system32\java.exe - 2008-12-01 19:40:39 144,792 ----a-w c:\windows\system32\javaw.exe + 2008-11-10 04:43:38 144,792 ----a-w c:\windows\system32\javaw.exe - 2008-12-01 19:40:39 148,888 ----a-w c:\windows\system32\javaws.exe + 2008-11-10 04:43:39 148,888 ----a-w c:\windows\system32\javaws.exe - 2008-12-25 01:47:06 66,376 ----a-w c:\windows\system32\perfc009.dat + 2008-12-26 09:00:19 66,492 ----a-w c:\windows\system32\perfc009.dat - 2008-12-25 01:47:06 82,010 ----a-w c:\windows\system32\perfc015.dat + 2008-12-26 09:00:19 82,126 ----a-w c:\windows\system32\perfc015.dat - 2008-12-25 01:47:06 427,592 ----a-w c:\windows\system32\perfh009.dat + 2008-12-26 09:00:19 427,900 ----a-w c:\windows\system32\perfh009.dat - 2008-12-25 01:47:06 484,634 ----a-w c:\windows\system32\perfh015.dat + 2008-12-26 09:00:19 484,968 ----a-w c:\windows\system32\perfh015.dat + 2008-12-26 21:33:00 16,384 ----atw c:\windows\Temp\Perflib_Perfdata_79c.dat - 2008-12-25 21:24:09 1,500 ----a-w c:\windows\UI\BIOSCTL.DAT + 2008-12-26 21:35:56 1,500 ----a-w c:\windows\UI\BIOSCTL.DAT . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{201f27d4-3704-41d6-89c1-aa35e39143ed}] 2008-10-02 15:44 325000 --a------ c:\program files\AskBarDis\bar\bin\askBar.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar] "{3041d03e-fd4b-44e0-b742-2d9b88305f98}"= "c:\program files\AskBarDis\bar\bin\askBar.dll" [2008-10-02 325000] [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser] "{3041D03E-FD4B-44E0-B742-2D9B88305F98}"= "c:\program files\AskBarDis\bar\bin\askBar.dll" [2008-10-02 325000] [HKEY_CLASSES_ROOT\clsid\{3041d03e-fd4b-44e0-b742-2d9b88305f98}] [HKEY_CLASSES_ROOT\TypeLib\{4b1c1e16-6b34-430e-b074-5928eca4c150}] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360] "Gadu-Gadu"="e:\programy\Gadu-Gadu\gg.exe" [2007-05-10 2111176] "MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-14 1695232] "PeerGuardian"="c:\program files\PeerGuardian2\pg2.exe" [2005-09-18 1421824] "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2007-03-12 153136] "DAEMON Tools Lite"="e:\programy\Demon\DAEMON Tools Lite\daemon.exe" [2008-07-24 490952] "RGSC"="f:\giery\GTA IV\Rockstar Games Social Club\RGSCLauncher.exe" [2008-12-25 306088] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "GEST"="c:\program files\GIGABYTE\GEST\RUN.exe" [2007-12-14 236040] "Gainward"="c:\windows\TBPanel.exe" [2008-01-29 2177576] "nod32kui"="c:\program files\Eset\nod32kui.exe" [2008-10-16 917504] "PCSuiteTrayApplication"="e:\programy\Nokia Pc Suite\Nokia PC Suite 6\LaunchApplication.exe" [2006-11-28 222720] "NeroFilterCheck"="c:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2007-03-09 153136] "QuickTime Task"="e:\programy\quick time\QTTask.exe" [2008-09-06 413696] "PivotSoftware"="c:\program files\Portrait Displays\Pivot Software\wpctrl.exe" [2007-02-09 694008] "DT ACR"="c:\program files\Common Files\Portrait Displays\Shared\DT_startup.exe" [2008-06-06 81920] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-12-02 13680640] "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-12-02 86016] "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2008-11-10 136600] "RTHDCPL"="RTHDCPL.EXE" [2008-02-13 c:\windows\RTHDCPL.exe] "nwiz"="nwiz.exe" [2008-12-02 c:\windows\system32\nwiz.exe] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360] "PcSync"="e:\programy\Nokia Pc Suite\Nokia PC Suite 6\PcSync2.exe" [2006-11-09 1634304] c:\documents and settings\All Users\Menu Start\Programy\Autostart\ NOD32 FiX.lnk - c:\windows\system32\regedt32.exe [2001-10-26 3584] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "msacm.divxa32"= divxa32.acm [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\WINDOWS\\system32\\usmt\\migwiz.exe"= "c:\\Program Files\\Eset\\nod32.exe"= "c:\\Program Files\\PeerGuardian2\\pg2.exe"= "c:\\Program Files\\Vuze\\Azureus.exe"= "e:\\Programy\\Gadu-Gadu\\gg.exe"= "f:\\giery\\Collin Dirt\\DiRT.exe"= "c:\\WINDOWS\\system32\\PnkBstrA.exe"= "c:\\WINDOWS\\system32\\PnkBstrB.exe"= "f:\\Gry\\cod5\\CoDWaW.exe"= "f:\\Gry\\cod5\\CoDWaWmp.exe"= "c:\\Program Files\\Skype\\Phone\\Skype.exe"= "c:\\Program Files\\THQ\\Company of Heroes\\RelicCOH.exe"= "f:\\giery\\GTA IV\\Rockstar Games Social Club\\RGSCLauncher.exe"= "f:\\giery\\GTA IV\\Grand Theft Auto IV\\LaunchGTAIV.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "f:\\giery\\GTA IV\\Grand Theft Auto IV\\GTAIV.exe"= "c:\\Program Files\\GIGABYTE\\GEST\\run.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "59500:UDP"= 59500:UDP:Azureus "59500:TCP"= 59500:TCP:Azureus R0 pavboot;pavboot;c:\windows\system32\drivers\pavboot.sys [2008-11-08 28544] R2 ASKService;ASKService;c:\program files\AskBarDis\bar\bin\AskService.exe [2008-10-18 460168] R2 PdiService;Portrait Displays SDK Service;c:\program files\Common Files\Portrait Displays\Drivers\pdisrvc.exe [2008-12-24 90112] R3 GEST Service;GEST Service for program management.;"c:\program files\GIGABYTE\GEST\GSvr.exe" [2008-10-14 47624] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a2d73a29-a06e-11dd-a3bd-001fd05ce29a}] \Shell\AutoRun\command - H:\setup.exe . . ------- Skan uzupełniający ------- . uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms} uStart Page = hxxp://home.pol.chello.pl/ssi/welcome/welcome.php?url=home uInternet Settings,ProxyOverride = ;<local> uSearchURL,(Default) = hxxp://toolbar.ask.com/toolbarv/askRedirect?o=10615&gct=&gc=1&q=%s LSP: imon.dll FF - ProfilePath - c:\documents and settings\Ice\Dane aplikacji\Mozilla\Firefox\Profiles\h2pbf7q2.default\ FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q= FF - prefs.js: browser.search.selectedEngine - DAEMON Search FF - prefs.js: browser.startup.homepage - hxxp://home.pol.chello.pl/ssi/welcome/welcome.php?url=home FF - prefs.js: keyword.URL - hxxp://toolbar.ask.com/toolbarv/askRedirect?o=10615&gct=&gc=1&q= FF - plugin: c:\program files\Mozilla Firefox\plugins\npganymedenet.dll FF - plugin: e:\programy\quick time\Plugins\npqtplugin.dll FF - plugin: e:\programy\quick time\Plugins\npqtplugin2.dll FF - plugin: e:\programy\quick time\Plugins\npqtplugin3.dll FF - plugin: e:\programy\quick time\Plugins\npqtplugin4.dll FF - plugin: e:\programy\quick time\Plugins\npqtplugin5.dll FF - plugin: e:\programy\quick time\Plugins\npqtplugin6.dll FF - plugin: e:\programy\quick time\Plugins\npqtplugin7.dll . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-12-26 23:04:27 Windows 5.1.2600 Dodatek Service Pack 3 NTFS skanowanie ukrytych procesów ... skanowanie ukrytych wpisów autostartu ... skanowanie ukrytych plików ... skanowanie pomyślnie ukończone ukryte pliki: 0 ************************************************************************** . --------------------- Pliki DLL ładowane pod uruchomionymi procesami --------------------- - - - - - - - > 'lsass.exe'(824) c:\windows\system32\imon.dll c:\program files\Eset\pr_imon.dll . Czas ukończenia: 2008-12-26 23:05:04 ComboFix-quarantined-files.txt 2008-12-26 22:05:02 ComboFix2.txt 2008-12-26 16:39:17 ComboFix3.txt 2008-12-25 21:47:49 Przed: 28 026 028 032 bajtów wolnych Po: 28,038,262,784 bajtów wolnych 256

raport CF

Dodano 26.12.2008 23:23:50:

Kod: Zaznacz wszystko: [b]SDFix: Version 1.240 [/b] Run by Administrator on 2008-12-26 at 23:15 Microsoft Windows XP [Wersja 5.1.2600] Running From: C:\sdfix\SDFix [b]Checking Services [/b]: Restoring Default Security Values Restoring Default Hosts File Rebooting [b]Checking Files [/b]: No Trojan Files Found Removing Temp Files [b]ADS Check [/b]: [b]Final Check [/b]: catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-12-26 23:18:55 Windows 5.1.2600 Dodatek Service Pack 3 NTFS scanning hidden processes ... scanning hidden services & system hive ... [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\ACPI\PNP0F13\4&2d88fb92&0\LogConf] "BasicConfigVector"=hex(a):48,00,00,00,0f,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,.. "BootConfig"=hex(8):01,00,00,00,0f,00,00,00,00,00,00,00,01,00,01,00,01,00,00,00,02,.. [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg] "s1"=dword:2df9c43f "s2"=dword:110480d0 "h0"=dword:00000001 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4] "p0"="E:\Programy\Demon\DAEMON Tools Lite\" "h0"=dword:00000000 "khjeh"=hex:a9,40,29,54,07,79,20,10,41,97,82,f4,fd,f9,f3,2b,47,70,f2,a5,c6,.. [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001] "a0"=hex:20,01,00,00,55,e1,09,24,63,77,d0,71,95,56,fb,cb,f3,c8,1c,8a,2b,.. "khjeh"=hex:60,0d,9e,92,bb,f9,ab,cc,e4,dd,e8,a6,aa,a6,a3,23,88,64,86,a3,43,.. [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40] "khjeh"=hex:54,3a,2f,6a,bc,c3,4c,20,cd,b5,8c,df,0c,ec,8f,0e,9f,1e,62,eb,d1,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\ACPI\PNP0F13\4&2d88fb92&0\LogConf] "BasicConfigVector"=hex(a):48,00,00,00,0f,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,.. "BootConfig"=hex(8):01,00,00,00,0f,00,00,00,00,00,00,00,01,00,01,00,01,00,00,00,02,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4] "p0"="E:\Programy\Demon\DAEMON Tools Lite\" "h0"=dword:00000000 "khjeh"=hex:a9,40,29,54,07,79,20,10,41,97,82,f4,fd,f9,f3,2b,47,70,f2,a5,c6,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001] "a0"=hex:20,01,00,00,55,e1,09,24,63,77,d0,71,95,56,fb,cb,f3,c8,1c,8a,2b,.. "khjeh"=hex:60,0d,9e,92,bb,f9,ab,cc,e4,dd,e8,a6,aa,a6,a3,23,88,64,86,a3,43,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40] "khjeh"=hex:54,3a,2f,6a,bc,c3,4c,20,cd,b5,8c,df,0c,ec,8f,0e,9f,1e,62,eb,d1,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Enum\ACPI\PNP0F13\4&2d88fb92&0\LogConf] "BasicConfigVector"=hex(a):48,00,00,00,0f,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,.. "BootConfig"=hex(8):01,00,00,00,0f,00,00,00,00,00,00,00,01,00,01,00,01,00,00,00,02,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4] "p0"="E:\Programy\Demon\DAEMON Tools Lite\" "h0"=dword:00000000 "khjeh"=hex:a9,40,29,54,07,79,20,10,41,97,82,f4,fd,f9,f3,2b,47,70,f2,a5,c6,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001] "a0"=hex:20,01,00,00,55,e1,09,24,63,77,d0,71,95,56,fb,cb,f3,c8,1c,8a,2b,.. "khjeh"=hex:60,0d,9e,92,bb,f9,ab,cc,e4,dd,e8,a6,aa,a6,a3,23,88,64,86,a3,43,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40] "khjeh"=hex:54,3a,2f,6a,bc,c3,4c,20,cd,b5,8c,df,0c,ec,8f,0e,9f,1e,62,eb,d1,.. scanning hidden registry entries ... [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update] "OfflineDetectionPending"=dword:00000001 scanning hidden files ... scan completed successfully hidden processes: 0 hidden services: 0 hidden files: 0 [b]Remaining Services [/b]: Authorized Application Key Export: [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "C:\\WINDOWS\\system32\\usmt\\migwiz.exe"="C:\\WINDOWS\\system32\\usmt\\migwiz.exe:*:Enabled:Kreator transferu plik˘w i ustawieä" "C:\\Program Files\\Eset\\nod32.exe"="C:\\Program Files\\Eset\\nod32.exe:*:Enabled:NOD32" "C:\\Program Files\\PeerGuardian2\\pg2.exe"="C:\\Program Files\\PeerGuardian2\\pg2.exe:*:Enabled:PeerGuardian" "C:\\Program Files\\Vuze\\Azureus.exe"="C:\\Program Files\\Vuze\\Azureus.exe:*:Enabled:Azureus" "E:\\Programy\\Gadu-Gadu\\gg.exe"="E:\\Programy\\Gadu-Gadu\\gg.exe:*:Enabled:Gadu-Gadu - program g˘wny" "F:\\giery\\Collin Dirt\\DiRT.exe"="F:\\giery\\Collin Dirt\\DiRT.exe:*:Disabled:DiRT Executable" "C:\\WINDOWS\\system32\\PnkBstrA.exe"="C:\\WINDOWS\\system32\\PnkBstrA.exe:*:Enabled:PnkBstrA" "C:\\WINDOWS\\system32\\PnkBstrB.exe"="C:\\WINDOWS\\system32\\PnkBstrB.exe:*:Enabled:PnkBstrB" "F:\\Gry\\cod5\\CoDWaW.exe"="F:\\Gry\\cod5\\CoDWaW.exe:*:Enabled:Call of Duty(R) - World at War(TM) " "F:\\Gry\\cod5\\CoDWaWmp.exe"="F:\\Gry\\cod5\\CoDWaWmp.exe:*:Enabled:Call of Duty(R) - World at War(TM) " "C:\\Program Files\\Skype\\Phone\\Skype.exe"="C:\\Program Files\\Skype\\Phone\\Skype.exe:*:Enabled:Skype" "C:\\Program Files\\THQ\\Company of Heroes\\RelicCOH.exe"="C:\\Program Files\\THQ\\Company of Heroes\\RelicCOH.exe:*:Enabled:Company of Heroes - Opposing Fronts" "F:\\giery\\GTA IV\\Rockstar Games Social Club\\RGSCLauncher.exe"="F:\\giery\\GTA IV\\Rockstar Games Social Club\\RGSCLauncher.exe:*:Enabled:Rockstar Games Social Club" "F:\\giery\\GTA IV\\Grand Theft Auto IV\\LaunchGTAIV.exe"="F:\\giery\\GTA IV\\Grand Theft Auto IV\\LaunchGTAIV.exe:*:Enabled:Grand Theft Auto IV" "%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000" "F:\\giery\\GTA IV\\Grand Theft Auto IV\\GTAIV.exe"="F:\\giery\\GTA IV\\Grand Theft Auto IV\\GTAIV.exe:*:Enabled:Grand Theft Auto IV" "C:\\Program Files\\GIGABYTE\\GEST\\run.exe"="C:\\Program Files\\GIGABYTE\\GEST\\run.exe:*:Disabled:update" [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list] "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000" [b]Remaining Files [/b]: [b]Files with Hidden Attributes [/b]: Sun 19 Oct 2008 4,348 ..SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak" Thu 25 Dec 2008 1,977 ...HR --- "C:\Documents and Settings\Ice\Dane aplikacji\SecuROM\UserData\securom_v7_01.bak" Sun 31 Dec 2006 4,348 ...H. --- "C:\Documents and Settings\Ice\Moje dokumenty\Moja muzyka\Kopia zapasowa licencji\drmv1key.bak" Fri 25 May 2007 20 ...H. --- "C:\Documents and Settings\Ice\Moje dokumenty\Moja muzyka\Kopia zapasowa licencji\drmv1lic.bak" Fri 25 May 2007 9,856 ..SH. --- "C:\Documents and Settings\Ice\Moje dokumenty\Moja muzyka\Kopia zapasowa licencji\drmv2key.bak" [b]Finished![/b]

**Posty:** 18165 · przez **wojtas** 27 Gru 2008, 16:30

wklej do notatnika

Windows Registry Editor Version 5.00

[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{201f27d4-3704-41d6-89c1-aa35e39143ed}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{3041d03e-fd4b-44e0-b742-2d9b88305f98}"=-

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{3041D03E-FD4B-44E0-B742-2D9B88305F98}"=-

w notatniku u góry>>>plik zapisz jako>>>Zmien rozszerzenie z TXT na Wszystkie pliki *.* >>> Zapisz pod nazwą FIX.REG

Klikasz dwa razy na powstały plik fix i dodajesz go do rejestru....

skasuj:

c:\program files\AskBarDis

go z opcji CleanUp

oraz skasuj folder C:\Qoobox
2. wykonaj optymalizację windowsa
3.sciagnij ATF_Cleaner
zaznacz
Windows Temp
All users Temp
Temporary internet files
Recycle Bin
i wcisnij EMPTY SELECTED
4.Wyłącz przywracanie systemu ( właściwości mój komputer-zakładka przywracanie - wyłącz przywracanie na wszystkich dyskach). Po chwili włącz je powrotem
5.Przeskanuj obszar mojego komputera http://www.kaspersky.pl/virusscanner.html (uruchom przez IE) Daj raport z niego na forum.

i tym:

FixIEDef.