zwywane połącznie z internetem/problem z uruchomienie kompa

**Posty:** 242 · przez **omnix** 22 Maj 2008, 15:57

Ostatnio mam duze problemy z internetem np: (gg traci polaczenie i sie zamyka po paru min, podobnie z grami w sieci niemoge utrzymac polaczenia)
Dzwoniłem do dostawcy(prywatny) mowi ze wszystko ok (sprawzdzalem u kolegi ktory ma ta sama siec i wszystko gra ok) Robilem dwa scany ArcaVir i NOD32 bez skutku.
Ostatnio niemoglem odpalic kompuetra bład(niemoze znalesc dysku twardego)
Prosze o sprawdzenie logow (jesli to niepome mam zamiar przeinstalować windowsa) Z gory dzieki.

HijackThis:

Kod: Zaznacz wszystko: Logfile of HijackThis v1.99.1 Scan saved at 15:56:08, on 2008-05-22 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\SOUNDMAN.EXE C:\Program Files\Eset\nod32kui.exe C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe C:\WINDOWS\system32\rundll32.exe C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe C:\Program Files\QuickTime\qttask.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe C:\Program Files\Samsung\Samsung Media Studio 5\SMSTray.exe C:\Program Files\MarkAny\ContentSafer\MAAgent.exe C:\PROGRA~1\HEWLET~1\HPSHAR~1\hpgs2wnf.exe C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe C:\Program Files\Winamp\winampa.exe D:\VMWARE PLAYER\hqtray.exe C:\Program Files\Search Settings\SearchSettings.exe C:\Program Files\DAP\DAP.EXE C:\Program Files\SpeedBit Video Accelerator\VideoAccelerator.exe D:\jaws\PDFClient.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Gadu-Gadu\gg.exe C:\Program Files\Messenger\msmsgs.exe C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe C:\Program Files\OLYMPUS\OLYMPUS Master\Monitor.exe C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe C:\Program Files\Hewlett-Packard\AiO\hp psc 900 series\Bin\hpobrt07.exe C:\Program Files\Hewlett-Packard\AiO\hp psc 900 series\Bin\hpobrt07.exe C:\Program Files\Hewlett-Packard\AiO\hp psc 900 series\Bin\hpobrt07.exe C:\Program Files\AVACS\MpegTV Station PCITV\RemoteCtl.exe C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe C:\PROGRA~1\HEWLET~1\AiO\Shared\Bin\hpoevm07.exe C:\WINDOWS\system32\hpoipm07.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\Program Files\WIDCOMM\Oprogramowanie interfejsu Bluetooth\bin\btwdins.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\Program Files\Eset\nod32krn.exe C:\WINDOWS\system32\PDFCreatorMessages.exe C:\WINDOWS\system32\PGPsdkServ.exe C:\WINDOWS\system32\PnkBstrA.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\UAService7.exe C:\Program Files\VentSrv\ventrilo_svc.exe C:\PROGRA~1\SPEEDB~1\VideoAcceleratorService.exe C:\Program Files\VentSrv\ventrilo_srv.exe C:\Program Files\Common Files\VMware\VMware Virtual Image Editing\vmount2.exe C:\PROGRA~1\SPEEDB~1\VideoAcceleratorEngine.exe C:\WINDOWS\system32\vmnat.exe C:\WINDOWS\system32\vmnetdhcp.exe D:\VMWARE PLAYER\vmware-authd.exe C:\Program Files\PC Connectivity Solution\ServiceLayer.exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\PC Connectivity Solution\NclBTHandler.exe C:\WINDOWS\system32\wuauclt.exe C:\WINDOWS\explorer.exe C:\WINDOWS\system32\notepad.exe C:\PROGRA~1\MOZILL~1\FIREFOX.EXE C:\Documents and Settings\Kamil\Pulpit\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.daemon-search.com/startpage R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 134.76.126.172:80 R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza R3 - URLSearchHook: SearchSettings Class - {E312764E-7706-43F1-8DAB-FCDD2B1E416D} - C:\Program Files\Search Settings\kb126\SearchSettings.dll R3 - URLSearchHook: SrchHook Class - {F4F10C1D-87C7-404A-B4B3-000000000000} - C:\PROGRA~1\DAP\SBSearch.dll O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (file missing) O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\PROGRA~1\Skype\Phone\IEPlugin\SKYPEI~1.DLL O2 - BHO: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.0.1225.9868\swg.dll O2 - BHO: SearchSettings Class - {E312764E-7706-43F1-8DAB-FCDD2B1E416D} - C:\Program Files\Search Settings\kb126\SearchSettings.dll O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (file missing) O3 - Toolbar: (no name) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - (no file) O3 - Toolbar: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [OM_Monitor] C:\Program Files\OLYMPUS\OLYMPUS Master\FirstStart.exe O4 - HKLM\..\Run: [gemstrmw] C:\WINDOWS\system32\gemstrmw.exe /r O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -startup O4 - HKLM\..\Run: [SMSTray] C:\Program Files\Samsung\Samsung Media Studio 5\SMSTray.exe O4 - HKLM\..\Run: [MAAgent] C:\Program Files\MarkAny\ContentSafer\MAAgent.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe" O4 - HKLM\..\Run: [VMware hqtray] "D:\VMWARE PLAYER\hqtray.exe" O4 - HKLM\..\Run: [SearchSettings] C:\Program Files\Search Settings\SearchSettings.exe O4 - HKLM\..\Run: [DownloadAccelerator] "C:\Program Files\DAP\DAP.EXE" /STARTUP O4 - HKLM\..\Run: [SpeedBitVideoAccelerator] "C:\Program Files\SpeedBit Video Accelerator\VideoAccelerator.exe" O4 - HKLM\..\Run: [PDFCreatorClient] D:\jaws\PDFClient.exe O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" O4 - HKCU\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe" O4 - HKCU\..\Run: [OM_Monitor] C:\Program Files\OLYMPUS\OLYMPUS Master\Monitor.exe O4 - HKCU\..\Run: [eMuleAutoStart] C:\Program Files\eMule\emule.exe -AutoStart O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O4 - Global Startup: BTTray.lnk = ? O4 - Global Startup: HPAiODevice(hp psc 900 series) - 1.lnk = C:\Program Files\Hewlett-Packard\AiO\hp psc 900 series\Bin\hpobrt07.exe O4 - Global Startup: HPAiODevice(hp psc 900 series) - 2.lnk = C:\Program Files\Hewlett-Packard\AiO\hp psc 900 series\Bin\hpobrt07.exe O4 - Global Startup: HPAiODevice(hp psc 900 series) - 3.lnk = C:\Program Files\Hewlett-Packard\AiO\hp psc 900 series\Bin\hpobrt07.exe O4 - Global Startup: MpegTV Station PCITV Remote Control.lnk = MpegTV Station PCITV\RemoteCtl.exe O4 - Global Startup: PGPtray.lnk = ? O4 - Global Startup: Service Manager.lnk = C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe O8 - Extra context menu item: &Clean Traces - C:\Program Files\DAP\Privacy Package\dapcleanerie.htm O8 - Extra context menu item: &Download with &DAP - C:\Program Files\DAP\dapextie.htm O8 - Extra context menu item: Download &all with DAP - C:\Program Files\DAP\dapextie2.htm O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O8 - Extra context menu item: Pobierz z &BitSpirit - C:\Program Files\BitSpirit\bsurl.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\PROGRA~1\Skype\Phone\IEPlugin\SKYPEI~1.DLL O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O10 - Unknown file in Winsock LSP: c:\program files\bonjour\mdnsnsp.dll O15 - Trusted Zone: http://www.mks.com.pl O15 - Trusted Zone: www.stalrzeszow.itl.pl O15 - Trusted Zone: http://bezpieczenstwo.onet.pl O16 - DPF: {18506D80-9B80-11D4-82C2-0080C8D7ED4A} (GameDesire Roulette) - http://67.15.101.3/g_bin/pl/roulette_2_0_0_17.cab O16 - DPF: {3D8700FB-86A4-4CB4-B738-6F0FC016AC7D} (MainControl Class) - http://bezpieczenstwo.onet.pl/skaner/ArcaOnline.cab O16 - DPF: {83AFB5CA-ED35-11D4-A452-0080C8D85045} (GameDesire Poker Games) - http://67.15.101.3/g_bin/pl/poker_2_0_0_45.cab O16 - DPF: {AB86CE53-AC9F-449F-9399-D8ABCA09EC09} (Get_ActiveX Control) - https://h17000.www1.hp.com/ewfrf-JAVA/Secure/HPGetDownloadManager.ocx O16 - DPF: {CD995117-98E5-4169-9920-6C12D4C0B548} (HGPlugin9USA Class) - http://gamedownload.ijjimax.com/gamedownload/dist/hgstart/HGPlugin9USA.cab O16 - DPF: {E7544C6C-CFD6-43EA-B4E9-360CEE20BDF7} (MainControl Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C1} (GameDesire Pool 8) - http://67.15.101.3/g_bin/pl/billard8_2_0_0_30.cab O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C5} (GameDesire Snooker) - http://67.15.101.3/g_bin/pl/snooker_2_0_0_24.cab O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: Bluetooth Service (btwdins) - WIDCOMM, Inc. - C:\Program Files\WIDCOMM\Oprogramowanie interfejsu Bluetooth\bin\btwdins.exe O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: MSSQL$JAN - Unknown owner - d:\MSSQL$~1\binn\sqlservr.exe (file missing) O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe O23 - Service: NOD32 Kernel Service (NOD32krn) - Unknown owner - C:\Program Files\Eset\nod32krn.exe O23 - Service: PDFCreatorMessages - Global Graphics Software Ltd. - C:\WINDOWS\system32\PDFCreatorMessages.exe O23 - Service: PGPsdkService (PGPsdkServ) - PGP Corporation - C:\WINDOWS\system32\PGPsdkServ.exe O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing) O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe O23 - Service: SQLAgent$JAN - Unknown owner - d:\MSSQL$~1\binn\sqlagent.exe (file missing) O23 - Service: SecuROM User Access Service (V7) (UserAccess7) - Sony DADC Austria AG. - C:\WINDOWS\system32\UAService7.exe O23 - Service: Ventrilo - Unknown owner - C:\Program Files\VentSrv\ventrilo_svc.exe O23 - Service: VideoAcceleratorService - Speedbit Ltd. - C:\PROGRA~1\SPEEDB~1\VideoAcceleratorService.exe O23 - Service: VMware Authorization Service (VMAuthdService) - VMware, Inc. - D:\VMWARE PLAYER\vmware-authd.exe O23 - Service: VMware DHCP Service (VMnetDHCP) - VMware, Inc. - C:\WINDOWS\system32\vmnetdhcp.exe O23 - Service: VMware Virtual Mount Manager Extended (vmount2) - VMware, Inc. - C:\Program Files\Common Files\VMware\VMware Virtual Image Editing\vmount2.exe O23 - Service: VMware NAT Service - VMware, Inc. - C:\WINDOWS\system32\vmnat.exe

ComboFix

Kod: Zaznacz wszystko: ComboFix 08-05-21.2 - Kamil 2008-05-22 15:35:45.1 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.597 [GMT 2:00] Running from: C:\Documents and Settings\Kamil\Moje dokumenty\My Completed Downloads\ComboFix.exe * Created a new restore point [color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color] . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\Documents and Settings\Kamil\Dane aplikacji\ShoppingReport C:\Documents and Settings\Kamil\Dane aplikacji\ShoppingReport\cs\Config.xml C:\Documents and Settings\Kamil\Dane aplikacji\ShoppingReport\cs\db\Aliases.dbs C:\Documents and Settings\Kamil\Dane aplikacji\ShoppingReport\cs\db\Sites.dbs C:\Documents and Settings\Kamil\Dane aplikacji\ShoppingReport\cs\dwld\WhiteList.xip C:\Documents and Settings\Kamil\Dane aplikacji\ShoppingReport\cs\report\aggr_storage.xml C:\Documents and Settings\Kamil\Dane aplikacji\ShoppingReport\cs\report\send_storage.xml C:\Documents and Settings\Kamil\Dane aplikacji\ShoppingReport\cs\res1\WhiteList.dbs C:\Program Files\ShoppingReport C:\Program Files\ShoppingReport\Uninst.exe C:\WINDOWS\hosts C:\WINDOWS\system32\_000109_.tmp.dll C:\WINDOWS\system32\_000111_.tmp.dll C:\WINDOWS\system32\_000112_.tmp.dll C:\WINDOWS\system32\_000113_.tmp.dll C:\WINDOWS\system32\_000114_.tmp.dll C:\WINDOWS\system32\_000115_.tmp.dll C:\WINDOWS\system32\plugin1.dat C:\WINDOWS\system32\SysPr.prx C:\WINDOWS\system32\testdll.dll D:\Autorun.inf . ((((((((((((((((((((((((( Files Created from 2008-04-22 to 2008-05-22 ))))))))))))))))))))))))))))))) . 2008-05-05 15:46 . 2008-05-05 16:16 69,120 --a------ C:\angielski-pr˘ba.doc 2008-05-04 17:15 . 2008-05-04 17:15 <DIR> d-------- C:\Program Files\GPLGS 2008-05-04 17:14 . 2008-05-04 17:14 <DIR> d-------- C:\Program Files\Acro Software 2008-05-04 17:14 . 2007-07-12 22:33 87,552 --a------ C:\WINDOWS\system32\cpwmon2k.dll 2008-05-04 11:29 . 2008-02-01 19:37 2,256,896 --a------ C:\WINDOWS\system32\PDFCreatorSV.exe 2008-05-04 11:29 . 2008-02-01 19:37 598,016 --a------ C:\WINDOWS\system32\PDFCreator.cpl 2008-05-04 11:29 . 2008-02-01 19:35 466,944 --a------ C:\WINDOWS\system32\EventConsumer.dll 2008-05-04 11:29 . 2008-02-01 19:37 319,488 --a------ C:\WINDOWS\system32\PDFCreator.dll 2008-05-04 11:29 . 2008-02-01 19:29 282,624 --a------ C:\WINDOWS\system32\niknakXML.dll 2008-05-04 11:29 . 2008-02-01 19:35 143,360 --a------ C:\WINDOWS\system32\PDFCreatorMessages.exe 2008-05-04 11:29 . 2007-07-06 05:37 135,168 --a------ C:\WINDOWS\system32\expat.dll 2008-05-04 11:29 . 2006-09-18 14:50 28,672 --a------ C:\WINDOWS\system32\JawsMacroUtils.dll 2008-05-04 11:13 . 2008-05-04 11:13 <DIR> d-------- C:\Documents and Settings\Kamil\Dane aplikacji\Bullzip 2008-05-04 11:08 . 2008-03-29 17:38 187,392 --a------ C:\WINDOWS\system32\bzpdf.dll 2008-05-04 11:08 . 2008-04-02 08:13 147,456 --a------ C:\WINDOWS\system32\bzpdfc.dll 2008-05-03 12:47 . 2008-05-03 12:54 <DIR> d-------- C:\Soldat 2008-05-03 11:34 . 2008-05-03 11:34 <DIR> d-------- C:\Documents and Settings\Kamil\Dane aplikacji\Soldat 2008-05-02 19:09 . 2008-05-02 19:09 0 -ra------ C:\logwmemory.bin 2008-04-26 18:48 . 2006-11-29 13:06 3,426,072 --a------ C:\WINDOWS\system32\d3dx9_32.dll 2008-04-26 18:48 . 2006-09-28 16:05 2,414,360 --a------ C:\WINDOWS\system32\d3dx9_31.dll 2008-04-26 18:48 . 2006-12-08 12:02 251,672 --a------ C:\WINDOWS\system32\xactengine2_5.dll 2008-04-26 18:48 . 2006-09-28 16:05 237,848 --a------ C:\WINDOWS\system32\xactengine2_4.dll 2008-04-26 18:46 . 2008-04-30 18:47 22,328 --a------ C:\Documents and Settings\Kamil\Dane aplikacji\PnkBstrK.sys 2008-04-26 18:46 . 2008-04-26 18:46 267 --a------ C:\WINDOWS\game.ini 2008-04-22 13:16 . 2008-04-30 14:40 <DIR> d-------- C:\Program Files\sXe Injected . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-05-22 13:43 --------- d---a-w C:\Documents and Settings\All Users\Dane aplikacji\TEMP 2008-05-22 11:41 22,328 ----a-w C:\WINDOWS\system32\drivers\PnkBstrK.sys 2008-05-22 09:04 --------- d-----w C:\Program Files\SpeedBit Video Accelerator 2008-05-22 09:03 114 ----a-w C:\sccfg.sys 2008-05-22 09:03 --------- d-----w C:\Documents and Settings\LocalService\Dane aplikacji\VMware 2008-05-22 09:03 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\VMware 2008-05-17 16:32 --------- d-----w C:\Documents and Settings\Kamil\Dane aplikacji\teamspeak2 2008-05-08 16:39 --------- d-----w C:\Documents and Settings\Kamil\Dane aplikacji\gtk-2.0 2008-05-04 09:29 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-04-30 12:41 --------- d-----w C:\Program Files\Valve 2008-04-26 13:20 --------- d-----w C:\Program Files\Windows Media Connect 2 2008-04-26 13:20 --------- d-----w C:\Program Files\Real Alternative 2008-04-26 13:20 --------- d-----w C:\Program Files\MegauploadToolbar 2008-04-17 20:22 --------- d-----w C:\Documents and Settings\Kamil\Dane aplikacji\PGP Corporation 2008-04-17 18:01 --------- d-----w C:\Program Files\PGP Corporation 2008-04-17 18:01 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\PGP Corporation 2008-04-14 04:27 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Panasonic 2008-04-13 17:08 --------- d-----w C:\Program Files\Sony Ericsson 2008-04-13 17:08 --------- d-----w C:\Program Files\Common Files\Teleca Shared 2008-04-13 17:08 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Sony Ericsson 2008-04-13 16:53 --------- d-----w C:\Documents and Settings\Kamil\Dane aplikacji\Skype 2008-04-12 18:02 --------- d-----w C:\Documents and Settings\Kamil\Dane aplikacji\OLYMPUS 2008-04-10 19:26 --------- d-----w C:\Program Files\San Andreas Mod Installer 2008-04-09 19:15 --------- d-----w C:\Program Files\iStar 2008-04-04 17:01 --------- d-----w C:\Program Files\DAEMON Tools Lite 2008-04-01 15:34 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\FLEXnet 2008-04-01 14:37 --------- d-----w C:\Program Files\Common Files\Adobe 2008-04-01 14:35 --------- d-----w C:\Program Files\Bonjour 2008-04-01 14:27 --------- d-----w C:\Program Files\Common Files\Macrovision Shared 2008-03-31 17:43 716,272 ----a-w C:\WINDOWS\system32\drivers\sptd.sys 2008-03-31 17:43 --------- d-----w C:\Documents and Settings\Kamil\Dane aplikacji\DAEMON Tools 2008-03-30 15:11 --------- d-----w C:\Program Files\GIMP-2.0 2008-03-23 18:24 --------- d-----w C:\Program Files\Common Files\Xara 2008-03-23 16:51 --------- d-----w C:\Documents and Settings\Kamil\Dane aplikacji\ArcaBit 2008-03-22 13:45 --------- d-----w C:\Program Files\DAP 2006-06-28 17:48 25,600 ----a-w C:\Documents and Settings\Kamil\usbsermptxp.sys 2006-06-28 17:48 22,768 ----a-w C:\Documents and Settings\Kamil\usbsermpt.sys 2008-03-22 13:41 251,392 ----a-w C:\Program Files\opera\program\plugins\dapop.dll 2001-10-26 17:45 94,832 -csh--w C:\WINDOWS\twain.dll 2004-08-03 22:44 50,688 --sh--w C:\WINDOWS\twain_32.dll 2007-10-23 10:50 5 --sha-w C:\WINDOWS\system32\aabbbecfe5_s.dll 2003-08-16 17:56 579,584 -csha-r C:\WINDOWS\system32\cd.exe 2004-08-03 22:44 1,028,096 --sh--w C:\WINDOWS\system32\mfc42.dll 2004-08-03 22:44 54,784 -csh--w C:\WINDOWS\system32\msvcirt.dll 2004-08-03 22:44 413,696 --sh--w C:\WINDOWS\system32\msvcp60.dll 2007-02-19 10:34 343,040 --sha-w C:\WINDOWS\system32\msvcrt(2).dll 2007-02-19 10:34 343,040 --sha-w C:\WINDOWS\system32\msvcrt.dll 2007-12-04 18:42 550,912 --sh--w C:\WINDOWS\system32\oleaut32.dll 2004-08-03 22:44 83,456 --sh--w C:\WINDOWS\system32\olepro32.dll 2005-12-04 19:24 185,634 -csha-r C:\WINDOWS\system32\patcher.exe 2004-08-03 22:44 12,288 -csh--w C:\WINDOWS\system32\regsvr32.exe . ------- Sigcheck ------- 2006-04-04 17:03 504832 381221f69d1248864861889a64f100b6 C:\WINDOWS\system32\winlogon.exe . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{E312764E-7706-43F1-8DAB-FCDD2B1E416D}] 2008-02-06 18:47 1160544 --a------ C:\Program Files\Search Settings\kb126\SearchSettings.dll [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:44 15360] "Gadu-Gadu"="C:\Program Files\Gadu-Gadu\gg.exe" [2006-02-17 15:03 2396160] "MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 18:24 1694208] "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2006-09-13 11:12 139264] "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2006-09-24 03:24 282624] "H/PC Connection Agent"="C:\Program Files\Microsoft ActiveSync\wcescomm.exe" [ ] "OM_Monitor"="C:\Program Files\OLYMPUS\OLYMPUS Master\Monitor.exe" [2006-05-16 18:51 57344] "swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-05-20 09:27 68856] "eMuleAutoStart"="C:\Program Files\eMule\emule.exe" [ ] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SoundMan"="SOUNDMAN.EXE" [2004-05-14 09:47 67072 C:\WINDOWS\SOUNDMAN.EXE] "nod32kui"="C:\Program Files\Eset\nod32kui.exe" [2006-11-10 13:18 847872] "ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-08-30 22:05 344064] "RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [2003-10-31 20:42 32768] "BluetoothAuthenticationAgent"="bthprops.cpl" [2004-08-04 00:44 110592 C:\WINDOWS\system32\bthprops.cpl] "Share-to-Web Namespace Daemon"="C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe" [2001-07-03 10:11 57344] "NeroFilterCheck"="C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-12 16:40 155648] "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2006-09-24 03:24 282624] "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2006-09-25 14:54 229952] "TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2007-01-19 22:27 180269] "OM_Monitor"="C:\Program Files\OLYMPUS\OLYMPUS Master\FirstStart.exe" [2006-05-16 18:50 40960] "gemstrmw"="C:\WINDOWS\system32\gemstrmw.exe" [2005-02-07 12:11 24576] "PCSuiteTrayApplication"="C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe" [2006-11-08 13:27 222208] "SMSTray"="C:\Program Files\Samsung\Samsung Media Studio 5\SMSTray.exe" [2007-09-20 08:23 132624] "MAAgent"="C:\Program Files\MarkAny\ContentSafer\MAAgent.exe" [2007-01-31 07:16 57344] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11 132496] "WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2007-10-10 07:28 36352] "VMware hqtray"="D:\VMWARE PLAYER\hqtray.exe" [2007-10-08 10:21 55856] "SearchSettings"="C:\Program Files\Search Settings\SearchSettings.exe" [2008-02-06 18:47 1036640] "DownloadAccelerator"="C:\Program Files\DAP\DAP.exe" [2008-03-22 15:41 3057152] "SpeedBitVideoAccelerator"="C:\Program Files\SpeedBit Video Accelerator\VideoAccelerator.exe" [2008-03-22 15:43 2283120] "PDFCreatorClient"="D:\jaws\PDFClient.exe" [2008-02-01 19:37 471040] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 00:44 15360] "PcSync"="C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2006-11-09 17:15 1634304] C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\ Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2004-12-14 15:44:06 29696] BTTray.lnk - C:\Program Files\WIDCOMM\Oprogramowanie interfejsu Bluetooth\BTTray.exe [2003-09-15 16:53:06 503869] HPAiODevice(hp psc 900 series) - 1.lnk - C:\Program Files\Hewlett-Packard\AiO\hp psc 900 series\Bin\hpobrt07.exe [2002-07-23 10:49:32 487484] HPAiODevice(hp psc 900 series) - 2.lnk - C:\Program Files\Hewlett-Packard\AiO\hp psc 900 series\Bin\hpobrt07.exe [2002-07-23 10:49:32 487484] HPAiODevice(hp psc 900 series) - 3.lnk - C:\Program Files\Hewlett-Packard\AiO\hp psc 900 series\Bin\hpobrt07.exe [2002-07-23 10:49:32 487484] MpegTV Station PCITV Remote Control.lnk - C:\Program Files\AVACS\MpegTV Station PCITV\RemoteCtl.exe [2007-07-09 20:34:23 118784] PGPtray.lnk - C:\Program Files\PGP Corporation\PGP for Windows XP\PGPtray.exe [2008-04-17 20:01:47 335872] Service Manager.lnk - C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe [2008-01-27 22:53:09 69632] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "VIDC.MJPG"= pvmjpg21.dll "vidc.ffds"= C:\PROGRA~1\COMBIN~1\Filters\FFDShow\ff_vfw.dll [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusOverride"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "C:\\totalcmd\\TOTALCMD.EXE"= "C:\\Program Files\\Gadu-Gadu\\gg.exe"= "C:\\WINDOWS\\system32\\dpvsetup.exe"= "C:\\WINDOWS\\system32\\dpnsvr.exe"= "D:\\Warcraft III\\Warcraft III.exe"= "\\\\JANEK\\Warcraft III\\Warcraft III.exe"= "C:\\Program Files\\Messenger\\msmsgs.exe"= "C:\\Program Files\\iTunes\\iTunes.exe"= "D:\\Warcraft III\\war3.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "D:\\fifa\\FIFA08.exe"= "D:\\linage 2\\system\\Lineage2Dex.EXE"= "D:\\linage 2\\system\\l2.exe"= "C:\\Program Files\\VentSrv\\ventrilo_srv.exe"= "C:\\Program Files\\Java\\jre1.6.0_03\\bin\\javaw.exe"= "C:\\Program Files\\Java\\jre1.6.0_03\\bin\\java.exe"= "C:\\Program Files\\Bonjour\\mDNSResponder.exe"= "C:\\Program Files\\DAP\\DAP.exe"= "C:\\Program Files\\Valve\\hl.exe"= "C:\\Program Files\\Skype\\Phone\\Skype.exe"= "C:\\WINDOWS\\system32\\PnkBstrA.exe"= "C:\\WINDOWS\\system32\\PnkBstrB.exe"= "D:\\cod4\\iw3mp.exe"= "C:\\Soldat\\Soldat.exe"= "C:\\Documents and Settings\\Kamil\\Pulpit\\Soldat\\Soldat.exe"= "C:\\Program Files\\SpeedBit Video Accelerator\\VideoAccelerator.exe"= "C:\\Program Files\\SpeedBit Video Accelerator\\VideoAcceleratorEngine.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "3389:TCP"= 3389:TCP:*:Disabled:@xpsp2res.dll,-22009 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings] "AllowInboundMaskRequest"= 1 (0x1) "AllowInboundRouterRequest"= 1 (0x1) R2 PGPdisk;PGPdisk;C:\WINDOWS\system32\drivers\PGPdisk.sys [2003-03-24 13:12] R2 PGPsdkDriver;PGPsdkDriver;C:\WINDOWS\system32\Drivers\PGPsdk.sys [2003-03-24 13:14] R2 PGPsdkServ;PGPsdkService;C:\WINDOWS\system32\PGPsdkServ.exe [2003-03-24 13:14] R2 sbbotdi;sbbotdi;C:\PROGRA~1\SPEEDB~1\sbbotdi.sys [2008-03-22 15:43] R2 VideoAcceleratorService;VideoAcceleratorService;C:\PROGRA~1\SPEEDB~1\VideoAcceleratorService.exe [2008-03-22 15:43] R3 Cap7134;Philips Proteus (7134) WDM Video Capture;C:\WINDOWS\system32\DRIVERS\Cap7134.sys [2002-06-04 13:52] R3 PhTVTune;Philips WDM TVTuner;C:\WINDOWS\system32\DRIVERS\PhTVTune.sys [2002-06-12 04:00] S2 MSSQL$JAN;MSSQL$JAN;d:\MSSQL$~1\binn\sqlservr.exe [] S3 31b1;RACING WHEEL;C:\WINDOWS\system32\DRIVERS\31b1.sys [2005-02-24 10:46] S3 AC2003;AC2003;C:\WINDOWS\system32\Drivers\AC2003.sys [2003-12-10 09:21] S3 FTLUND;Lundinova Filter Driver;C:\WINDOWS\system32\drivers\ftlund.sys [2005-12-22 16:23] S3 GPinPad;GPinPad;C:\WINDOWS\system32\Drivers\GPinPad.sys [2006-02-02 10:33] S3 NPF;NetGroup Packet Filter Driver;C:\WINDOWS\system32\drivers\npf.sys [2007-11-06 22:22] S3 RimSerPort;RIM Virtual Serial Port;C:\WINDOWS\system32\DRIVERS\RimSerial.sys [2004-08-06 08:50] S3 SQLAgent$JAN;SQLAgent$JAN;d:\MSSQL$~1\binn\sqlagent.exe [] S3 USBSTOR;Sterownik magazynu masowego USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-04 00:08] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{2b2f04d9-2c4f-11dc-b7ab-00508de59c3b}] \Shell\AutoRun\command - G:\LaunchU3.exe -a [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{41e81b46-ab67-11da-8aae-00508de59c3b}] \Shell\AutoRun\command - F:\Autorun\UbiAutorun.exe . Contents of the 'Scheduled Tasks' folder "2008-05-05 08:15:02 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job" - C:\Program Files\Apple Software Update\SoftwareUpdate.exe . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-05-22 15:43:32 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . --------------------- DLLs Loaded Under Running Processes --------------------- PROCESS: C:\WINDOWS\system32\lsass.exe -> C:\WINDOWS\system32\imon.dll -> C:\Program Files\Eset\pr_imon.dll PROCESS: C:\WINDOWS\explorer.exe -> ?:\WINDOWS\system32\SETUPAPI.dll -> C:\WINDOWS\system32\imon.dll -> C:\Program Files\Eset\pr_imon.dll -> ?:\WINDOWS\system32\PortableDeviceApi.dll -> ?:\WINDOWS\system32\PortableDeviceApi.dll . ------------------------ Other Running Processes ------------------------ . C:\WINDOWS\system32\ati2evxx.exe C:\WINDOWS\system32\scardsvr.exe C:\WINDOWS\system32\ati2evxx.exe C:\WINDOWS\system32\rundll32.exe C:\PROGRA~1\HEWLET~1\HPSHAR~1\hpgs2wnf.exe C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe C:\PROGRA~1\HEWLET~1\AiO\Shared\Bin\hpoevm07.exe C:\WINDOWS\system32\hpoipm07.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\Program Files\WIDCOMM\Oprogramowanie interfejsu Bluetooth\bin\btwdins.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\Program Files\ESET\nod32krn.exe C:\WINDOWS\system32\PDFCreatorMessages.exe C:\WINDOWS\system32\PnkBstrA.exe C:\WINDOWS\system32\UAService7.exe C:\Program Files\VentSrv\ventrilo_svc.exe C:\Program Files\VentSrv\ventrilo_srv.exe C:\Program Files\Common Files\VMware\VMware Virtual Image Editing\vmount2.exe C:\PROGRA~1\SPEEDB~1\VideoAcceleratorEngine.exe C:\WINDOWS\system32\vmnat.exe C:\WINDOWS\system32\vmnetdhcp.exe D:\VMWARE PLAYER\vmware-authd.exe C:\Program Files\PC Connectivity Solution\ServiceLayer.exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\PC Connectivity Solution\NclBTHandler.exe C:\WINDOWS\system32\wscntfy.exe . ************************************************************************** . Completion time: 2008-05-22 15:48:06 - machine was rebooted ComboFix-quarantined-files.txt 2008-05-22 13:47:47 Pre-Run: 573,825,024 bajtów wolnych Post-Run: 2,466,422,784 bajt˘w wolnych 288 --- E O F --- 2008-05-18 16:15:10

[/quote]

**Posty:** 8001 · przez **Okocza** 22 Maj 2008, 16:00

Wykonaj to co jest podane w tym temacie

Zastosuj SDFix . Po pobraniu uruchom go a rozpakuje się do C:\SDFix. Uruchom komputer w trybie awaryjnym (F8 przy stracie systemu). Będąc w awaryjnym uruchom plik RunThis.bat z folderu SDFixa. Zatwierdź czyszczenie przez Y. Poczekaj aż ukończy i komputer zresetuje

Potem wejdz do folderu C:\SDFix wrzuc zawartość pliku Report.txt + log z combofixa oraz daj loga z hijacka

**Posty:** 242 · przez **omnix** 23 Maj 2008, 19:25

Mam problem z wejsciem przez ten system awaryjny

W win xp jest to f8 ?
Mam jeszcze jedno pytanie Niemoge ukończyć zadnego pobierania zarowno przy uzyciu firefox czy tez programu wspomagajaceo(getrigt,free downloader manager) co moze byc tego przyczyna? ;(

**Posty:** 18165 · przez **wojtas** 23 Maj 2008, 19:38

start>uruchom>msconfig>zakladka boot.ini i zaznacz Safeboot i reset i bedziesz w awaryjnym wykonujesz co kazał Okocza

**Posty:** 242 · przez **omnix** 23 Maj 2008, 20:26

Kod: Zaznacz wszystko: [b]SDFix: Version 1.184 [/b] Run by Jan on 2008-05-23 at 19:55 Microsoft Windows XP [Wersja 5.1.2600] Running From: C:\SDFix [b]Checking Services [/b]: Restoring Windows Registry Values Restoring Windows Default Hosts File Rebooting [b]Checking Files [/b]: No Trojan Files Found Removing Temp Files [b]ADS Check [/b]: [b]Final Check [/b]: catchme 0.3.1359.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-05-23 20:08:21 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... scanning hidden services & system hive ... disk error: C:\WINDOWS\system32\config\system, 3 scanning hidden registry entries ... disk error: C:\WINDOWS\system32\config\software, 3 disk error: C:\Documents and Settings\Kamil\ntuser.dat, 3 scanning hidden files ... disk error: C:\WINDOWS\ please note that you need administrator rights to perform deep scan [b]Remaining Services [/b]: Authorized Application Key Export: [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "C:\\totalcmd\\TOTALCMD.EXE"="C:\\totalcmd\\TOTALCMD.EXE:*:Enabled:Total Commander 32 bit international version, file manager replacement for Windows" "C:\\Program Files\\Gadu-Gadu\\gg.exe"="C:\\Program Files\\Gadu-Gadu\\gg.exe:*:Enabled:Gadu-Gadu - program glowny" "C:\\WINDOWS\\system32\\dpvsetup.exe"="C:\\WINDOWS\\system32\\dpvsetup.exe:*:Enabled:Microsoft DirectPlay Voice Test" "C:\\WINDOWS\\system32\\dpnsvr.exe"="C:\\WINDOWS\\system32\\dpnsvr.exe:*:Enabled:Microsoft DirectPlay8 Server" "D:\\Warcraft III\\Warcraft III.exe"="D:\\Warcraft III\\Warcraft III.exe:*:Enabled:Warcraft III" "\\\\JANEK\\Warcraft III\\Warcraft III.exe"="\\\\JANEK\\Warcraft III\\Warcraft III.exe:*:Enabled:Warcraft III.exe" "C:\\Program Files\\Messenger\\msmsgs.exe"="C:\\Program Files\\Messenger\\msmsgs.exe:*:Enabled:Windows Messenger" "C:\\Program Files\\iTunes\\iTunes.exe"="C:\\Program Files\\iTunes\\iTunes.exe:*:Enabled:iTunes" "D:\\Warcraft III\\war3.exe"="D:\\Warcraft III\\war3.exe:*:Enabled:Warcraft III" "%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000" "D:\\fifa\\FIFA08.exe"="D:\\fifa\\FIFA08.exe:*:Enabled:FIFA08" "D:\\linage 2\\system\\Lineage2Dex.EXE"="D:\\linage 2\\system\\Lineage2Dex.EXE:*:Enabled:Lineage2Dex" "D:\\linage 2\\system\\l2.exe"="D:\\linage 2\\system\\l2.exe:*:Enabled:l2" "C:\\Program Files\\VentSrv\\ventrilo_srv.exe"="C:\\Program Files\\VentSrv\\ventrilo_srv.exe:*:Enabled:ventrilo_srv" "C:\\Program Files\\Java\\jre1.6.0_03\\bin\\javaw.exe"="C:\\Program Files\\Java\\jre1.6.0_03\\bin\\javaw.exe:*:Disabled:Java(TM) Platform SE binary" "C:\\Program Files\\Java\\jre1.6.0_03\\bin\\java.exe"="C:\\Program Files\\Java\\jre1.6.0_03\\bin\\java.exe:*:Enabled:Java(TM) Platform SE binary" "C:\\Program Files\\Bonjour\\mDNSResponder.exe"="C:\\Program Files\\Bonjour\\mDNSResponder.exe:*:Enabled:Bonjour" "C:\\Program Files\\DAP\\DAP.exe"="C:\\Program Files\\DAP\\DAP.exe:*:Enabled:Download Accelerator Plus (DAP)" "C:\\Program Files\\Valve\\hl.exe"="C:\\Program Files\\Valve\\hl.exe:*:Enabled:Half-Life Launcher" "C:\\Program Files\\Skype\\Phone\\Skype.exe"="C:\\Program Files\\Skype\\Phone\\Skype.exe:*:Enabled:Skype" "C:\\WINDOWS\\system32\\PnkBstrA.exe"="C:\\WINDOWS\\system32\\PnkBstrA.exe:*:Enabled:PnkBstrA" "C:\\WINDOWS\\system32\\PnkBstrB.exe"="C:\\WINDOWS\\system32\\PnkBstrB.exe:*:Enabled:PnkBstrB" "D:\\cod4\\iw3mp.exe"="D:\\cod4\\iw3mp.exe:*:Enabled:Call of Duty(R) 4 - Modern Warfare(TM)" "C:\\Soldat\\Soldat.exe"="C:\\Soldat\\Soldat.exe:*:Enabled:Soldat" "C:\\Documents and Settings\\Kamil\\Pulpit\\Soldat\\Soldat.exe"="C:\\Documents and Settings\\Kamil\\Pulpit\\Soldat\\Soldat.exe:*:Enabled:Soldat" "C:\\Program Files\\SpeedBit Video Accelerator\\VideoAcceleratorEngine.exe"="C:\\Program Files\\SpeedBit Video Accelerator\\VideoAcceleratorEngine.exe:*:Enabled:VideoAcceleratorService" "C:\\Program Files\\SpeedBit Video Accelerator\\VideoAccelerator.exe"="C:\\Program Files\\SpeedBit Video Accelerator\\VideoAccelerator.exe:*:Enabled:VideoAccelerator" "C:\\Documents and Settings\\Kamil\\Moje dokumenty\\My Completed Downloads\\CabalTemp\\ESTSetupLoader.exe"="C:\\Documents and Settings\\Kamil\\Moje dokumenty\\My Completed Downloads\\CabalTemp\\ESTSetupLoader.exe:*:Enabled:EST! download engine" "C:\\Program Files\\uTorrent\\uTorrent.exe"="C:\\Program Files\\uTorrent\\uTorrent.exe:*:Enabled:uTorrent" "C:\\Downloads\\Software\\CabalTemp\\ESTSetupLoader.exe"="C:\\Downloads\\Software\\CabalTemp\\ESTSetupLoader.exe:*:Enabled:EST! download engine" [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list] "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000" [b]Remaining Files [/b]: File Backups: - C:\SDFix\backups\backups.zip [b]Files with Hidden Attributes [/b]: Fri 26 Oct 2001 94,832 ..SH. --- "C:\WINDOWS\twain.dll" Wed 4 Aug 2004 50,688 ..SH. --- "C:\WINDOWS\twain_32.dll" Tue 23 Oct 2007 5 A.SH. --- "C:\WINDOWS\system32\aabbbecfe5_s.dll" Sat 16 Aug 2003 579,584 A.SHR --- "C:\WINDOWS\system32\cd.exe" Wed 4 Aug 2004 1,028,096 ..SH. --- "C:\WINDOWS\system32\mfc42.dll" Wed 4 Aug 2004 54,784 ..SH. --- "C:\WINDOWS\system32\msvcirt.dll" Wed 4 Aug 2004 413,696 ..SH. --- "C:\WINDOWS\system32\msvcp60.dll" Mon 19 Feb 2007 343,040 A.SH. --- "C:\WINDOWS\system32\msvcrt.dll" Mon 19 Feb 2007 343,040 A.SH. --- "C:\WINDOWS\system32\msvcrt(2).dll" Tue 4 Dec 2007 550,912 ..SH. --- "C:\WINDOWS\system32\oleaut32.dll" Wed 4 Aug 2004 83,456 ..SH. --- "C:\WINDOWS\system32\olepro32.dll" Sun 4 Dec 2005 185,634 A.SHR --- "C:\WINDOWS\system32\patcher.exe" Wed 4 Aug 2004 12,288 ..SH. --- "C:\WINDOWS\system32\regsvr32.exe" Wed 7 Dec 2005 4,348 ..SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak" Thu 8 May 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\05030212059e1b9876d47b8cf2fa5e95\BIT74.tmp" Wed 23 Jan 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\523d056929e13eacf8392044f602e53e\BIT24.tmp" Wed 23 Jan 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\afa5528a2269b5106016bdbc1ea3037f\BIT23.tmp" Mon 31 Mar 2008 1,332 ...HR --- "C:\Documents and Settings\Kamil\Dane aplikacji\SecuROM\UserData\securom_v7_01.bak" Wed 7 Dec 2005 4,348 A..H. --- "C:\Documents and Settings\Kamil\Moje dokumenty\Moja muzyka\Kopia zapasowa licencji\drmv1key.bak" Mon 3 Apr 2006 20 A..H. --- "C:\Documents and Settings\Kamil\Moje dokumenty\Moja muzyka\Kopia zapasowa licencji\drmv1lic.bak" Thu 15 Dec 2005 400 A.SH. --- "C:\Documents and Settings\Kamil\Moje dokumenty\Moja muzyka\Kopia zapasowa licencji\drmv2key.bak" [b]Finished![/b]

Kod: Zaznacz wszystko: ComboFix 08-05-21.3 - Kamil 2008-05-23 20:17:43.2 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.525 [GMT 2:00] Running from: C:\Downloads\Software\ComboFix.exe * Created a new restore point [color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color] . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\WINDOWS\system32\mdm.exe . ((((((((((((((((((((((((( Files Created from 2008-04-23 to 2008-05-23 ))))))))))))))))))))))))))))))) . 2008-05-23 19:50 . 2008-05-23 19:50 <DIR> d-------- C:\WINDOWS\ERUNT 2008-05-23 16:44 . 2008-05-23 16:44 <DIR> d-------- C:\Program Files\Free Download Manager 2008-05-23 16:44 . 2008-05-23 20:21 <DIR> d-------- C:\Documents and Settings\Kamil\Dane aplikacji\Free Download Manager 2008-05-23 16:44 . 2008-05-23 16:44 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\FreeDownloadManager.ORG 2008-05-23 16:40 . 2008-05-23 16:47 <DIR> d-------- C:\Program Files\GetRight 2008-05-23 13:59 . 2008-05-23 13:59 <DIR> d-------- C:\Program Files\uTorrent 2008-05-23 13:59 . 2008-05-23 15:50 <DIR> d-------- C:\Documents and Settings\Kamil\Dane aplikacji\uTorrent 2008-05-23 10:43 . 2008-05-23 16:49 <DIR> d-------- C:\Program Files\Odkurzacz 2008-05-22 19:24 . 2008-05-23 20:08 <DIR> d-------- C:\SDFix 2008-05-04 17:15 . 2008-05-04 17:15 <DIR> d-------- C:\Program Files\GPLGS 2008-05-04 17:14 . 2008-05-04 17:14 <DIR> d-------- C:\Program Files\Acro Software 2008-05-04 17:14 . 2007-07-12 22:33 87,552 --a------ C:\WINDOWS\system32\cpwmon2k.dll 2008-05-04 11:29 . 2008-02-01 19:37 2,256,896 --a------ C:\WINDOWS\system32\PDFCreatorSV.exe 2008-05-04 11:29 . 2008-02-01 19:37 598,016 --a------ C:\WINDOWS\system32\PDFCreator.cpl 2008-05-04 11:29 . 2008-02-01 19:35 466,944 --a------ C:\WINDOWS\system32\EventConsumer.dll 2008-05-04 11:29 . 2008-02-01 19:37 319,488 --a------ C:\WINDOWS\system32\PDFCreator.dll 2008-05-04 11:29 . 2008-02-01 19:29 282,624 --a------ C:\WINDOWS\system32\niknakXML.dll 2008-05-04 11:29 . 2008-02-01 19:35 143,360 --a------ C:\WINDOWS\system32\PDFCreatorMessages.exe 2008-05-04 11:29 . 2007-07-06 05:37 135,168 --a------ C:\WINDOWS\system32\expat.dll 2008-05-04 11:29 . 2006-09-18 14:50 28,672 --a------ C:\WINDOWS\system32\JawsMacroUtils.dll 2008-05-04 11:13 . 2008-05-04 11:13 <DIR> d-------- C:\Documents and Settings\Kamil\Dane aplikacji\Bullzip 2008-05-04 11:08 . 2008-03-29 17:38 187,392 --a------ C:\WINDOWS\system32\bzpdf.dll 2008-05-04 11:08 . 2008-04-02 08:13 147,456 --a------ C:\WINDOWS\system32\bzpdfc.dll 2008-05-03 11:34 . 2008-05-03 11:34 <DIR> d-------- C:\Documents and Settings\Kamil\Dane aplikacji\Soldat 2008-05-02 19:09 . 2008-05-02 19:09 0 -ra------ C:\logwmemory.bin 2008-04-26 18:48 . 2006-11-29 13:06 3,426,072 --a------ C:\WINDOWS\system32\d3dx9_32.dll 2008-04-26 18:48 . 2006-09-28 16:05 2,414,360 --a------ C:\WINDOWS\system32\d3dx9_31.dll 2008-04-26 18:48 . 2006-12-08 12:02 251,672 --a------ C:\WINDOWS\system32\xactengine2_5.dll 2008-04-26 18:48 . 2006-09-28 16:05 237,848 --a------ C:\WINDOWS\system32\xactengine2_4.dll 2008-04-26 18:46 . 2008-04-30 18:47 22,328 --a------ C:\Documents and Settings\Kamil\Dane aplikacji\PnkBstrK.sys 2008-04-26 18:46 . 2008-04-26 18:46 267 --a------ C:\WINDOWS\game.ini . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-05-23 18:06 --------- d-----w C:\Documents and Settings\LocalService\Dane aplikacji\VMware 2008-05-23 18:06 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\VMware 2008-05-23 14:49 --------- d-----w C:\Program Files\DAP 2008-05-23 14:37 --------- d---a-w C:\Documents and Settings\All Users\Dane aplikacji\TEMP 2008-05-23 13:08 22,328 ----a-w C:\WINDOWS\system32\drivers\PnkBstrK.sys 2008-05-23 13:08 107,832 ----a-w C:\WINDOWS\system32\PnkBstrB.exe 2008-05-23 09:02 --------- d-----w C:\Program Files\WC3Banlist 2008-05-23 09:01 --------- d-----w C:\Program Files\QuickTime 2008-05-23 09:01 --------- d-----w C:\Program Files\FlashGet 2008-05-23 09:01 --------- d-----w C:\Program Files\ESET 2008-05-22 17:47 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-05-17 16:32 --------- d-----w C:\Documents and Settings\Kamil\Dane aplikacji\teamspeak2 2008-05-08 16:39 --------- d-----w C:\Documents and Settings\Kamil\Dane aplikacji\gtk-2.0 2008-04-30 16:48 66,872 ----a-w C:\WINDOWS\system32\PnkBstrA.exe 2008-04-30 12:41 --------- d-----w C:\Program Files\Valve 2008-04-30 12:40 --------- d-----w C:\Program Files\sXe Injected 2008-04-26 13:20 --------- d-----w C:\Program Files\Windows Media Connect 2 2008-04-26 13:20 --------- d-----w C:\Program Files\Real Alternative 2008-04-26 13:20 --------- d-----w C:\Program Files\MegauploadToolbar 2008-04-17 20:22 --------- d-----w C:\Documents and Settings\Kamil\Dane aplikacji\PGP Corporation 2008-04-17 18:01 --------- d-----w C:\Program Files\PGP Corporation 2008-04-17 18:01 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\PGP Corporation 2008-04-14 04:27 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Panasonic 2008-04-13 17:08 --------- d-----w C:\Program Files\Sony Ericsson 2008-04-13 17:08 --------- d-----w C:\Program Files\Common Files\Teleca Shared 2008-04-13 17:08 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Sony Ericsson 2008-04-13 16:53 --------- d-----w C:\Documents and Settings\Kamil\Dane aplikacji\Skype 2008-04-12 18:02 --------- d-----w C:\Documents and Settings\Kamil\Dane aplikacji\OLYMPUS 2008-04-09 19:15 --------- d-----w C:\Program Files\iStar 2008-04-04 18:36 98,304 -c--a-w C:\WINDOWS\system32\CmdLineExt.dll 2008-04-04 17:01 --------- d-----w C:\Program Files\DAEMON Tools Lite 2008-04-01 15:34 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\FLEXnet 2008-04-01 14:37 --------- d-----w C:\Program Files\Common Files\Adobe 2008-04-01 14:35 --------- d-----w C:\Program Files\Bonjour 2008-04-01 14:27 --------- d-----w C:\Program Files\Common Files\Macrovision Shared 2008-03-31 17:43 716,272 ----a-w C:\WINDOWS\system32\drivers\sptd.sys 2008-03-31 17:43 --------- d-----w C:\Documents and Settings\Kamil\Dane aplikacji\DAEMON Tools 2008-03-30 15:11 --------- d-----w C:\Program Files\GIMP-2.0 2008-03-25 04:52 621,344 ----a-w C:\WINDOWS\system32\mswstr10.dll 2008-03-25 04:52 178,976 ----a-w C:\WINDOWS\system32\msjint40.dll 2008-03-23 18:24 --------- d-----w C:\Program Files\Common Files\Xara 2008-03-23 16:51 --------- d-----w C:\Documents and Settings\Kamil\Dane aplikacji\ArcaBit 2008-03-20 08:09 1,845,504 ----a-w C:\WINDOWS\system32\win32k.sys 2008-03-05 14:03 479,752 ----a-w C:\WINDOWS\system32\XAudio2_0.dll 2008-03-05 14:03 238,088 ----a-w C:\WINDOWS\system32\xactengine3_0.dll 2008-03-05 14:00 25,608 ----a-w C:\WINDOWS\system32\X3DAudio1_3.dll 2008-03-05 13:56 3,786,760 ----a-w C:\WINDOWS\system32\D3DX9_37.dll 2008-03-05 13:56 1,420,824 ----a-w C:\WINDOWS\system32\D3DCompiler_37.dll 2006-06-28 17:48 25,600 ----a-w C:\Documents and Settings\Kamil\usbsermptxp.sys 2006-06-28 17:48 22,768 ----a-w C:\Documents and Settings\Kamil\usbsermpt.sys 2008-03-22 13:41 251,392 ----a-w C:\Program Files\opera\program\plugins\dapop.dll 2001-10-26 17:45 94,832 -csh--w C:\WINDOWS\twain.dll 2004-08-03 22:44 50,688 --sh--w C:\WINDOWS\twain_32.dll 2007-10-23 10:50 5 --sha-w C:\WINDOWS\system32\aabbbecfe5_s.dll 2003-08-16 17:56 579,584 -csha-r C:\WINDOWS\system32\cd.exe 2004-08-03 22:44 1,028,096 --sh--w C:\WINDOWS\system32\mfc42.dll 2004-08-03 22:44 54,784 -csh--w C:\WINDOWS\system32\msvcirt.dll 2004-08-03 22:44 413,696 --sh--w C:\WINDOWS\system32\msvcp60.dll 2007-02-19 10:34 343,040 --sha-w C:\WINDOWS\system32\msvcrt(2).dll 2007-02-19 10:34 343,040 --sha-w C:\WINDOWS\system32\msvcrt.dll 2007-12-04 18:42 550,912 --sh--w C:\WINDOWS\system32\oleaut32.dll 2004-08-03 22:44 83,456 --sh--w C:\WINDOWS\system32\olepro32.dll 2005-12-04 19:24 185,634 -csha-r C:\WINDOWS\system32\patcher.exe 2004-08-03 22:44 12,288 -csh--w C:\WINDOWS\system32\regsvr32.exe . ------- Sigcheck ------- 2006-04-04 17:03 504832 381221f69d1248864861889a64f100b6 C:\WINDOWS\system32\winlogon.exe . ((((((((((((((((((((((((((((( snapshot@2008-05-22_15.47.23.39 ))))))))))))))))))))))))))))))))))))))))) . - 2008-05-22 13:43:03 2,048 --s-a-w C:\WINDOWS\bootstat.dat + 2008-05-23 18:05:32 2,048 --s-a-w C:\WINDOWS\bootstat.dat + 2008-05-20 11:30:08 163,328 ----a-w C:\WINDOWS\ERUNT\SDFIX\ERDNT.EXE + 2008-05-23 17:50:38 5,959,680 ----a-w C:\WINDOWS\ERUNT\SDFIX\Users\[u]0[/u]0000001\ntuser.dat + 2008-05-23 17:50:39 172,032 ----a-w C:\WINDOWS\ERUNT\SDFIX\Users\[u]0[/u]0000002\UsrClass.dat + 2008-05-20 11:30:08 163,328 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\ERDNT.EXE + 2008-05-23 17:50:24 5,959,680 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\Users\[u]0[/u]0000001\ntuser.dat + 2008-05-23 17:50:25 172,032 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\Users\[u]0[/u]0000002\UsrClass.dat + 2008-05-23 18:06:14 16,384 ----atw C:\WINDOWS\Temp\Perflib_Perfdata_6a0.dat + 2008-05-23 18:06:28 16,384 ----atw C:\WINDOWS\Temp\Perflib_Perfdata_84c.dat . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{E312764E-7706-43F1-8DAB-FCDD2B1E416D}] 2008-02-06 18:47 1160544 --a------ C:\Program Files\Search Settings\kb126\SearchSettings.dll [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:44 15360] "Gadu-Gadu"="C:\Program Files\Gadu-Gadu\gg.exe" [2006-02-17 15:03 2396160] "MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 18:24 1694208] "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2006-09-13 11:12 139264] "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2006-09-24 03:24 282624] "H/PC Connection Agent"="C:\Program Files\Microsoft ActiveSync\wcescomm.exe" [ ] "OM_Monitor"="C:\Program Files\OLYMPUS\OLYMPUS Master\Monitor.exe" [2006-05-16 18:51 57344] "eMuleAutoStart"="C:\Program Files\eMule\emule.exe" [ ] "Odkurzacz-MCD"="C:\Program Files\Odkurzacz\odk_mcd.exe" [2008-03-03 14:44 266240] "Free Download Manager"="C:\Program Files\Free Download Manager\fdm.exe" [2008-05-20 17:27 2474031] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SoundMan"="SOUNDMAN.EXE" [2004-05-14 09:47 67072 C:\WINDOWS\SOUNDMAN.EXE] "nod32kui"="C:\Program Files\Eset\nod32kui.exe" [2006-11-10 13:18 847872] "ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-08-30 22:05 344064] "RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [2003-10-31 20:42 32768] "BluetoothAuthenticationAgent"="bthprops.cpl" [2004-08-04 00:44 110592 C:\WINDOWS\system32\bthprops.cpl] "Share-to-Web Namespace Daemon"="C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe" [2001-07-03 10:11 57344] "NeroFilterCheck"="C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-12 16:40 155648] "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2006-09-24 03:24 282624] "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2006-09-25 14:54 229952] "TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2007-01-19 22:27 180269] "OM_Monitor"="C:\Program Files\OLYMPUS\OLYMPUS Master\FirstStart.exe" [2006-05-16 18:50 40960] "gemstrmw"="C:\WINDOWS\system32\gemstrmw.exe" [2005-02-07 12:11 24576] "PCSuiteTrayApplication"="C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe" [2006-11-08 13:27 222208] "SMSTray"="C:\Program Files\Samsung\Samsung Media Studio 5\SMSTray.exe" [2007-09-20 08:23 132624] "MAAgent"="C:\Program Files\MarkAny\ContentSafer\MAAgent.exe" [2007-01-31 07:16 57344] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11 132496] "WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2007-10-10 07:28 36352] "VMware hqtray"="D:\VMWARE PLAYER\hqtray.exe" [2007-10-08 10:21 55856] "SearchSettings"="C:\Program Files\Search Settings\SearchSettings.exe" [2008-02-06 18:47 1036640] "PDFCreatorClient"="D:\jaws\PDFClient.exe" [2008-02-01 19:37 471040] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 00:44 15360] "PcSync"="C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2006-11-09 17:15 1634304] C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\ Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2004-12-14 15:44:06 29696] BTTray.lnk - C:\Program Files\WIDCOMM\Oprogramowanie interfejsu Bluetooth\BTTray.exe [2003-09-15 16:53:06 503869] HPAiODevice(hp psc 900 series) - 1.lnk - C:\Program Files\Hewlett-Packard\AiO\hp psc 900 series\Bin\hpobrt07.exe [2002-07-23 10:49:32 487484] HPAiODevice(hp psc 900 series) - 2.lnk - C:\Program Files\Hewlett-Packard\AiO\hp psc 900 series\Bin\hpobrt07.exe [2002-07-23 10:49:32 487484] HPAiODevice(hp psc 900 series) - 3.lnk - C:\Program Files\Hewlett-Packard\AiO\hp psc 900 series\Bin\hpobrt07.exe [2002-07-23 10:49:32 487484] MpegTV Station PCITV Remote Control.lnk - C:\Program Files\AVACS\MpegTV Station PCITV\RemoteCtl.exe [2007-07-09 20:34:23 118784] PGPtray.lnk - C:\Program Files\PGP Corporation\PGP for Windows XP\PGPtray.exe [2008-04-17 20:01:47 335872] Service Manager.lnk - C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe [2008-01-27 22:53:09 69632] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "VIDC.MJPG"= pvmjpg21.dll "vidc.ffds"= C:\PROGRA~1\COMBIN~1\Filters\FFDShow\ff_vfw.dll [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "C:\\totalcmd\\TOTALCMD.EXE"= "C:\\Program Files\\Gadu-Gadu\\gg.exe"= "C:\\WINDOWS\\system32\\dpvsetup.exe"= "C:\\WINDOWS\\system32\\dpnsvr.exe"= "D:\\Warcraft III\\Warcraft III.exe"= "\\\\JANEK\\Warcraft III\\Warcraft III.exe"= "C:\\Program Files\\Messenger\\msmsgs.exe"= "C:\\Program Files\\iTunes\\iTunes.exe"= "D:\\Warcraft III\\war3.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "D:\\linage 2\\system\\Lineage2Dex.EXE"= "D:\\linage 2\\system\\l2.exe"= "C:\\Program Files\\VentSrv\\ventrilo_srv.exe"= "C:\\Program Files\\Java\\jre1.6.0_03\\bin\\javaw.exe"= "C:\\Program Files\\Java\\jre1.6.0_03\\bin\\java.exe"= "C:\\Program Files\\Bonjour\\mDNSResponder.exe"= "C:\\Program Files\\Valve\\hl.exe"= "C:\\Program Files\\Skype\\Phone\\Skype.exe"= "C:\\WINDOWS\\system32\\PnkBstrA.exe"= "C:\\WINDOWS\\system32\\PnkBstrB.exe"= "D:\\cod4\\iw3mp.exe"= "C:\\Documents and Settings\\Kamil\\Moje dokumenty\\My Completed Downloads\\CabalTemp\\ESTSetupLoader.exe"= "C:\\Program Files\\uTorrent\\uTorrent.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "3389:TCP"= 3389:TCP:*:Disabled:@xpsp2res.dll,-22009 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings] "AllowInboundMaskRequest"= 1 (0x1) "AllowInboundRouterRequest"= 1 (0x1) R2 PGPdisk;PGPdisk;C:\WINDOWS\system32\drivers\PGPdisk.sys [2003-03-24 13:12] R2 PGPsdkDriver;PGPsdkDriver;C:\WINDOWS\system32\Drivers\PGPsdk.sys [2003-03-24 13:14] R2 PGPsdkServ;PGPsdkService;C:\WINDOWS\system32\PGPsdkServ.exe [2003-03-24 13:14] R3 Cap7134;Philips Proteus (7134) WDM Video Capture;C:\WINDOWS\system32\DRIVERS\Cap7134.sys [2002-06-04 13:52] R3 PhTVTune;Philips WDM TVTuner;C:\WINDOWS\system32\DRIVERS\PhTVTune.sys [2002-06-12 04:00] S2 MSSQL$JAN;MSSQL$JAN;d:\MSSQL$~1\binn\sqlservr.exe [] S3 31b1;RACING WHEEL;C:\WINDOWS\system32\DRIVERS\31b1.sys [2005-02-24 10:46] S3 AC2003;AC2003;C:\WINDOWS\system32\Drivers\AC2003.sys [2003-12-10 09:21] S3 FTLUND;Lundinova Filter Driver;C:\WINDOWS\system32\drivers\ftlund.sys [2005-12-22 16:23] S3 GPinPad;GPinPad;C:\WINDOWS\system32\Drivers\GPinPad.sys [2006-02-02 10:33] S3 NPF;NetGroup Packet Filter Driver;C:\WINDOWS\system32\drivers\npf.sys [2007-11-06 22:22] S3 RimSerPort;RIM Virtual Serial Port;C:\WINDOWS\system32\DRIVERS\RimSerial.sys [2004-08-06 08:50] S3 SQLAgent$JAN;SQLAgent$JAN;d:\MSSQL$~1\binn\sqlagent.exe [] S3 USBSTOR;Sterownik magazynu masowego USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-04 00:08] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{2b2f04d9-2c4f-11dc-b7ab-00508de59c3b}] \Shell\AutoRun\command - G:\LaunchU3.exe -a [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{41e81b46-ab67-11da-8aae-00508de59c3b}] \Shell\AutoRun\command - F:\Autorun\UbiAutorun.exe . Contents of the 'Scheduled Tasks' folder "2008-05-05 08:15:02 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job" - C:\Program Files\Apple Software Update\SoftwareUpdate.exe . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-05-23 20:21:48 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... disk error: C:\WINDOWS\system32\drivers\ disk error: C:\DOCUME~1\Kamil\USTAWI~1\Temp\ disk error: C:\WINDOWS\TEMP\ disk error: C:\WINDOWS\ disk error: C:\WINDOWS\system32\wbem\ disk error: C:\Program Files\Common Files\ disk error: C:\Documents and Settings\Kamil\Dane aplikacji\ disk error: C:\ disk error: C:\Program Files\ disk error: C:\WINDOWS\system32\ disk error: C:\Documents and Settings\Kamil\Ustawienia lokalne\Dane aplikacji\ disk error: C:\WINDOWS\Fonts\ disk error: C:\WINDOWS\Downloaded Program Files\ disk error: C:\Documents and Settings\Kamil\Menu Start\Programy\Autostart\ disk error: C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\ scan completed successfully hidden files: ************************************************************************** . --------------------- DLLs Loaded Under Running Processes --------------------- PROCESS: C:\WINDOWS\system32\lsass.exe -> C:\WINDOWS\system32\imon.dll -> C:\Program Files\Eset\pr_imon.dll . Completion time: 2008-05-23 20:22:49 ComboFix-quarantined-files.txt 2008-05-23 18:22:41 Pre-Run: 2,900,332,544 bajtów wolnych Post-Run: 3,328,376,832 bajtów wolnych 269 --- E O F --- 2008-05-18 16:15:10

Kod: Zaznacz wszystko: Logfile of HijackThis v1.99.1 Scan saved at 20:24:34, on 2008-05-23 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\Ati2evxx.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\Program Files\WIDCOMM\Oprogramowanie interfejsu Bluetooth\bin\btwdins.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE d:\MSSQL\binn\sqlservr.exe C:\Program Files\Eset\nod32krn.exe C:\WINDOWS\system32\PDFCreatorMessages.exe C:\WINDOWS\system32\PGPsdkServ.exe C:\WINDOWS\system32\PnkBstrA.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\UAService7.exe C:\Program Files\Common Files\VMware\VMware Virtual Image Editing\vmount2.exe C:\WINDOWS\system32\vmnat.exe C:\WINDOWS\system32\vmnetdhcp.exe D:\VMWARE PLAYER\vmware-authd.exe C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\system32\notepad.exe C:\WINDOWS\system32\wuauclt.exe C:\WINDOWS\SOUNDMAN.EXE C:\Program Files\Eset\nod32kui.exe C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe C:\Program Files\QuickTime\qttask.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe C:\Program Files\Samsung\Samsung Media Studio 5\SMSTray.exe C:\Program Files\MarkAny\ContentSafer\MAAgent.exe C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe C:\Program Files\Winamp\winampa.exe D:\VMWARE PLAYER\hqtray.exe C:\Program Files\Search Settings\SearchSettings.exe D:\jaws\PDFClient.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Gadu-Gadu\gg.exe C:\Program Files\Messenger\msmsgs.exe C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe C:\Program Files\OLYMPUS\OLYMPUS Master\Monitor.exe C:\PROGRA~1\HEWLET~1\HPSHAR~1\hpgs2wnf.exe C:\Program Files\PC Connectivity Solution\ServiceLayer.exe C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe C:\Program Files\Free Download Manager\fdm.exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\WIDCOMM\Oprogramowanie interfejsu Bluetooth\BTTray.exe C:\Program Files\Hewlett-Packard\AiO\hp psc 900 series\Bin\hpobrt07.exe C:\Program Files\AVACS\MpegTV Station PCITV\RemoteCtl.exe C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe C:\Program Files\PC Connectivity Solution\NclBTHandler.exe C:\WINDOWS\system32\hpoipm07.exe C:\WINDOWS\system32\notepad.exe C:\WINDOWS\explorer.exe C:\Documents and Settings\Kamil\Pulpit\HijackThis.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.daemon-search.com/startpage R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 134.76.126.172:80 R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza R3 - URLSearchHook: SearchSettings Class - {E312764E-7706-43F1-8DAB-FCDD2B1E416D} - C:\Program Files\Search Settings\kb126\SearchSettings.dll R3 - URLSearchHook: SrchHook Class - {F4F10C1D-87C7-404A-B4B3-000000000000} - C:\PROGRA~1\DAP\SBSearch.dll (file missing) O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (file missing) O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\PROGRA~1\Skype\Phone\IEPlugin\SKYPEI~1.DLL O2 - BHO: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.0.1225.9868\swg.dll O2 - BHO: FDMIECookiesBHO Class - {CC59E0F9-7E43-44FA-9FAA-8377850BF205} - C:\Program Files\Free Download Manager\iefdm2.dll O2 - BHO: SearchSettings Class - {E312764E-7706-43F1-8DAB-FCDD2B1E416D} - C:\Program Files\Search Settings\kb126\SearchSettings.dll O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (file missing) O3 - Toolbar: (no name) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - (no file) O3 - Toolbar: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL O3 - Toolbar: (no name) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - (no file) O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [OM_Monitor] C:\Program Files\OLYMPUS\OLYMPUS Master\FirstStart.exe O4 - HKLM\..\Run: [gemstrmw] C:\WINDOWS\system32\gemstrmw.exe /r O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -startup O4 - HKLM\..\Run: [SMSTray] C:\Program Files\Samsung\Samsung Media Studio 5\SMSTray.exe O4 - HKLM\..\Run: [MAAgent] C:\Program Files\MarkAny\ContentSafer\MAAgent.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe" O4 - HKLM\..\Run: [VMware hqtray] "D:\VMWARE PLAYER\hqtray.exe" O4 - HKLM\..\Run: [SearchSettings] C:\Program Files\Search Settings\SearchSettings.exe O4 - HKLM\..\Run: [PDFCreatorClient] D:\jaws\PDFClient.exe O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" O4 - HKCU\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe" O4 - HKCU\..\Run: [OM_Monitor] C:\Program Files\OLYMPUS\OLYMPUS Master\Monitor.exe O4 - HKCU\..\Run: [eMuleAutoStart] C:\Program Files\eMule\emule.exe -AutoStart O4 - HKCU\..\Run: [Odkurzacz-MCD] C:\Program Files\Odkurzacz\odk_mcd.exe O4 - HKCU\..\Run: [Free Download Manager] "C:\Program Files\Free Download Manager\fdm.exe" -autorun O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O4 - Global Startup: BTTray.lnk = ? O4 - Global Startup: HPAiODevice(hp psc 900 series) - 1.lnk = C:\Program Files\Hewlett-Packard\AiO\hp psc 900 series\Bin\hpobrt07.exe O4 - Global Startup: HPAiODevice(hp psc 900 series) - 2.lnk = C:\Program Files\Hewlett-Packard\AiO\hp psc 900 series\Bin\hpobrt07.exe O4 - Global Startup: HPAiODevice(hp psc 900 series) - 3.lnk = C:\Program Files\Hewlett-Packard\AiO\hp psc 900 series\Bin\hpobrt07.exe O4 - Global Startup: MpegTV Station PCITV Remote Control.lnk = MpegTV Station PCITV\RemoteCtl.exe O4 - Global Startup: PGPtray.lnk = ? O4 - Global Startup: Service Manager.lnk = C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O8 - Extra context menu item: Pobierz plik wideo we Free Download Manager - file://C:\Program Files\Free Download Manager\dlfvideo.htm O8 - Extra context menu item: Pobierz w Free Download Manager - file://C:\Program Files\Free Download Manager\dllink.htm O8 - Extra context menu item: Pobierz wszystkie pliki w Free Download Manager - file://C:\Program Files\Free Download Manager\dlall.htm O8 - Extra context menu item: Pobierz z &BitSpirit - C:\Program Files\BitSpirit\bsurl.htm O8 - Extra context menu item: Pobierz zaznaczone w Free Download Manager - file://C:\Program Files\Free Download Manager\dlselected.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\PROGRA~1\Skype\Phone\IEPlugin\SKYPEI~1.DLL O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O10 - Unknown file in Winsock LSP: c:\program files\bonjour\mdnsnsp.dll O15 - Trusted Zone: http://www.mks.com.pl O15 - Trusted Zone: www.stalrzeszow.itl.pl O15 - Trusted Zone: http://bezpieczenstwo.onet.pl O16 - DPF: {18506D80-9B80-11D4-82C2-0080C8D7ED4A} (GameDesire Roulette) - http://67.15.101.3/g_bin/pl/roulette_2_0_0_17.cab O16 - DPF: {3D8700FB-86A4-4CB4-B738-6F0FC016AC7D} (MainControl Class) - http://bezpieczenstwo.onet.pl/skaner/ArcaOnline.cab O16 - DPF: {83AFB5CA-ED35-11D4-A452-0080C8D85045} (GameDesire Poker Games) - http://67.15.101.3/g_bin/pl/poker_2_0_0_45.cab O16 - DPF: {AB86CE53-AC9F-449F-9399-D8ABCA09EC09} (Get_ActiveX Control) - https://h17000.www1.hp.com/ewfrf-JAVA/Secure/HPGetDownloadManager.ocx O16 - DPF: {CD995117-98E5-4169-9920-6C12D4C0B548} (HGPlugin9USA Class) - http://gamedownload.ijjimax.com/gamedownload/dist/hgstart/HGPlugin9USA.cab O16 - DPF: {E7544C6C-CFD6-43EA-B4E9-360CEE20BDF7} (MainControl Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C1} (GameDesire Pool 8) - http://67.15.101.3/g_bin/pl/billard8_2_0_0_30.cab O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C5} (GameDesire Snooker) - http://67.15.101.3/g_bin/pl/snooker_2_0_0_24.cab O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: Bluetooth Service (btwdins) - WIDCOMM, Inc. - C:\Program Files\WIDCOMM\Oprogramowanie interfejsu Bluetooth\bin\btwdins.exe O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: MSSQL$JAN - Unknown owner - d:\MSSQL$~1\binn\sqlservr.exe (file missing) O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe O23 - Service: NOD32 Kernel Service (NOD32krn) - Unknown owner - C:\Program Files\Eset\nod32krn.exe O23 - Service: PDFCreatorMessages - Global Graphics Software Ltd. - C:\WINDOWS\system32\PDFCreatorMessages.exe O23 - Service: PGPsdkService (PGPsdkServ) - PGP Corporation - C:\WINDOWS\system32\PGPsdkServ.exe O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing) O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe O23 - Service: SQLAgent$JAN - Unknown owner - d:\MSSQL$~1\binn\sqlagent.exe (file missing) O23 - Service: SecuROM User Access Service (V7) (UserAccess7) - Sony DADC Austria AG. - C:\WINDOWS\system32\UAService7.exe O23 - Service: VMware Authorization Service (VMAuthdService) - VMware, Inc. - D:\VMWARE PLAYER\vmware-authd.exe O23 - Service: VMware DHCP Service (VMnetDHCP) - VMware, Inc. - C:\WINDOWS\system32\vmnetdhcp.exe O23 - Service: VMware Virtual Mount Manager Extended (vmount2) - VMware, Inc. - C:\Program Files\Common Files\VMware\VMware Virtual Image Editing\vmount2.exe O23 - Service: VMware NAT Service - VMware, Inc. - C:\WINDOWS\system32\vmnat.exe

Wszystkie 3 logi jakies pomysły?

**Posty:** 18165 · przez **wojtas** 24 Maj 2008, 10:29

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.daemon-search.com/startpage
R3 - URLSearchHook: SearchSettings Class - {E312764E-7706-43F1-8DAB-FCDD2B1E416D} - C:\Program Files\Search Settings\kb126\SearchSettings.dll
R3 - URLSearchHook: SrchHook Class - {F4F10C1D-87C7-404A-B4B3-000000000000} - C:\PROGRA~1\DAP\SBSearch.dll (file missing)
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (file missing)
O2 - BHO: SearchSettings Class - {E312764E-7706-43F1-8DAB-FCDD2B1E416D} - C:\Program Files\Search Settings\kb126\SearchSettings.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (file missing)
O3 - Toolbar: (no name) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - (no file)
O3 - Toolbar: (no name) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - (no file)
O4 - HKLM\..\Run: [SearchSettings] C:\Program Files\Search Settings\SearchSettings.exe

skasuj te wpisy + pogrubiony wywal do kosza

**Posty:** 242 · przez **omnix** 24 Maj 2008, 10:37

Zrobione lecz nierozwiązało to mojego problemu wciąż niemoge skonczyc pobierania plików (300mb+)

Ale i tak dzieki za pomoc.

zwywane połącznie z internetem/problem z uruchomienie kompa

zwywane połącznie z internetem/problem z uruchomienie kompa

Kto jest na forum