Jak usunac spyLocked?

Loczek_16 · 14 Kwiecień 2007 10:28

razem z jakimis kodekami zainstalowalo sie cos o nazwie spyLocked,usunalem wszyskie pliki a program nadal dziala,chcialem przywrócic system ale ciagle mi sie wyswietla ze przywracanie niekompletne i ten programik nadal jest .

znalazlem program który usuwa takie rzeczy ale jest platny

jest tez drugo opcja ,manual" ale niewiem jak ja zastosowac??

prosilbym o program jakis do usuniecia tego idarmowy zeby byl

z góry dziekuje za pomoc

adam9870 · 14 Kwiecień 2007 10:34

SpyLocked w całości powinno usunąć narzędzie SmitFraudFix użyte z opcji numer 2 w trybie awaryjnym.

Po wykonaniu pokaż log z HijackThis, SilentRunners oraz zawartość pliku c:\rapport.txt

Loczek_16 · 14 Kwiecień 2007 11:14

narzędzie SmitFraudFix usunelo ten program,czy mimo to mam pokazac log z HijackThis(niewiem jak to zrobic)

raport:

SmitFraudFix v2.167 Scan done at 13:06:18,62, 2007-04-14 Run from C:\Documents and Settings\Rodzina\Pulpit\SmitfraudFix OS: Microsoft Windows XP [Wersja 5.1.2600] - Windows_NT The filesystem type is NTFS Fix run in safe mode »»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Before SmitFraudFix !Attention, following keys are not inevitably infected! SrchSTS.exe by S!Ri Search SharedTaskScheduler’s .dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler] “{abef791f-947e-4cdf-83c3-e72a240afb67}”=“frisbee” [HKEY_CLASSES_ROOT\CLSID{abef791f-947e-4cdf-83c3-e72a240afb67}\InProcServer32] @=“C:\WINDOWS\system32\ygjun.dll” [HKEY_LOCAL_MACHINE\Software\Classes\CLSID{abef791f-947e-4cdf-83c3-e72a240afb67}\InProcServer32] @=“C:\WINDOWS\system32\ygjun.dll” »»»»»»»»»»»»»»»»»»»»»»»» Killing process »»»»»»»»»»»»»»»»»»»»»»»» hosts 127.0.0.1 localhost »»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix GenericRenosFix by S!Ri »»»»»»»»»»»»»»»»»»»»»»»» Deleting infected files C:\WINDOWS\system32\ygjun.dll Deleted C:\DOCUME~1\Rodzina\Ulubione\Online Security Test.url Deleted »»»»»»»»»»»»»»»»»»»»»»»» DNS Your computer may be victim of a DNS Hijack: 85.255.x.x detected ! Description: Marvell Yukon Gigabit Ethernet 10/100/1000Base-T Adapter, Copper RJ-45 - Sterownik miniport Harmonogramu pakietów DNS Server Search Order: 85.255.116.110 DNS Server Search Order: 85.255.112.113 HKLM\SYSTEM\CCS\Services\Tcpip…{13C1021D-7EB1-49F8-B4D3-F779CB7EE631}: DhcpNameServer=85.255.116.110,85.255.112.113 HKLM\SYSTEM\CCS\Services\Tcpip…{13C1021D-7EB1-49F8-B4D3-F779CB7EE631}: NameServer=85.255.116.110,85.255.112.113 HKLM\SYSTEM\CCS\Services\Tcpip…{8ECBCF27-CD05-48B4-9A99-1FD8A98BC335}: DhcpNameServer=85.255.116.110,85.255.112.113 HKLM\SYSTEM\CCS\Services\Tcpip…{C2E403F5-E984-4BA4-AFF8-4BCEB7B96161}: DhcpNameServer=85.255.116.110,85.255.112.113 HKLM\SYSTEM\CCS\Services\Tcpip…{C2E403F5-E984-4BA4-AFF8-4BCEB7B96161}: NameServer=85.255.116.110,85.255.112.113 HKLM\SYSTEM\CS1\Services\Tcpip…{13C1021D-7EB1-49F8-B4D3-F779CB7EE631}: DhcpNameServer=85.255.116.110,85.255.112.113 HKLM\SYSTEM\CS1\Services\Tcpip…{13C1021D-7EB1-49F8-B4D3-F779CB7EE631}: NameServer=85.255.116.110,85.255.112.113 HKLM\SYSTEM\CS1\Services\Tcpip…{8ECBCF27-CD05-48B4-9A99-1FD8A98BC335}: DhcpNameServer=85.255.116.110,85.255.112.113 HKLM\SYSTEM\CS1\Services\Tcpip…{C2E403F5-E984-4BA4-AFF8-4BCEB7B96161}: DhcpNameServer=85.255.116.110,85.255.112.113 HKLM\SYSTEM\CS1\Services\Tcpip…{C2E403F5-E984-4BA4-AFF8-4BCEB7B96161}: NameServer=85.255.116.110,85.255.112.113 HKLM\SYSTEM\CS2\Services\Tcpip…{13C1021D-7EB1-49F8-B4D3-F779CB7EE631}: DhcpNameServer=85.255.116.110,85.255.112.113 HKLM\SYSTEM\CS2\Services\Tcpip…{13C1021D-7EB1-49F8-B4D3-F779CB7EE631}: NameServer=85.255.116.110,85.255.112.113 HKLM\SYSTEM\CS2\Services\Tcpip…{8CDD4513-11B4-435E-A601-B64F1140649D}: NameServer=194.204.159.1 217.98.63.164 HKLM\SYSTEM\CS2\Services\Tcpip…{8ECBCF27-CD05-48B4-9A99-1FD8A98BC335}: DhcpNameServer=85.255.116.110,85.255.112.113 HKLM\SYSTEM\CS2\Services\Tcpip…{C2E403F5-E984-4BA4-AFF8-4BCEB7B96161}: DhcpNameServer=85.255.116.110,85.255.112.113 HKLM\SYSTEM\CS2\Services\Tcpip…{C2E403F5-E984-4BA4-AFF8-4BCEB7B96161}: NameServer=85.255.116.110,85.255.112.113 HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: NameServer=85.255.116.110 85.255.112.113 HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: NameServer=85.255.116.110 85.255.112.113 HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: NameServer=85.255.116.110 85.255.112.113 »»»»»»»»»»»»»»»»»»»»»»»» Deleting Temp Files »»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System !Attention, following keys are not inevitably infected! [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] “System”=“kdape.exe” »»»»»»»»»»»»»»»»»»»»»»»» Registry Cleaning Registry Cleaning done. »»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler After SmitFraudFix !Attention, following keys are not inevitably infected! SrchSTS.exe by S!Ri Search SharedTaskScheduler’s .dll »»»»»»»»»»»»»»»»»»»»»»»» Reboot C:\WINDOWS\system32\kdape.exe Deleted [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] “System”="" »»»»»»»»»»»»»»»»»»»»»»»» End

adam9870 · 14 Kwiecień 2007 11:40

Użyj jeszcze narzędzia FixWareOut.

Opis wykonania logów HijackThis i SilentRunners znajduje się w tym temacie:

http://forum.dobreprogramy.pl/viewtopic.php?t=36654

Dodatkowo pokaż zawartość pliku c:\fixwareout\report.txt

Loczek_16 · 14 Kwiecień 2007 11:41

tego narzedzia tez mam uzyc w trybie awaryjnym??czy normalnym??

Złączono Posta : 14.04.2007 (Sob) 13:46

log z programu HijackThis:

Logfile of HijackThis v1.99.1 Scan saved at 13:44:39, on 2007-04-14 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16414) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\ATI Technologies\ATI.ACE\cli.exe C:\WINDOWS\SOUNDMAN.EXE C:\Program Files\ZTE Corporation\ZXDSL852\CnxDslTb.exe C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe C:\Program Files\Java\jre1.5.0\bin\jusched.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\Program Files\QuickTime\qttask.exe C:\Program Files\PC Connectivity Solution\ServiceLayer.exe D:\Program Files\DAEMON Tools\daemon.exe C:\WINDOWS\vsnpstd.exe C:\Program Files\Common Files\Symantec Shared\ccApp.exe C:\Program Files\HP\HP Software Update\HPWuSchd2.exe C:\WINDOWS\system32\ctfmon.exe D:\Program Files\Gadu-Gadu\gg.exe C:\Program Files\Skype\Phone\Skype.exe C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe C:\Program Files\Skype\Plugin Manager\skypePM.exe C:\Documents and Settings\All Users\Dane aplikacji\Skype\Plugins\Plugins\E12C95FCBD1240FEAE314D89676CA6F8\LieDetector.exe C:\Documents and Settings\All Users\Dane aplikacji\Skype\Plugins\Plugins\DF206D97847745E7983C822C45EE3038\ringjack.exe C:\PROGRA~1\NEOSTR~1\NeostradaTP.exe C:\PROGRA~1\NEOSTR~1\ComComp.exe C:\PROGRA~1\NEOSTR~1\Watch.exe D:\Program Files\Winamp\winamp.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\DOCUME~1\Rodzina\USTAWI~1\Temp\Rar$EX00.469\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Neostrada TP R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\NEOSTR~1\SEARCH~1.DLL O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx O4 - HKLM…\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe O4 - HKLM…\Run: [ATICCC] “C:\Program Files\ATI Technologies\ATI.ACE\cli.exe” runtime O4 - HKLM…\Run: [soundMan] SOUNDMAN.EXE O4 - HKLM…\Run: [CnxDslTaskBar] “C:\Program Files\ZTE Corporation\ZXDSL852\CnxDslTb.exe” “ZTE Corporation\ZXDSL852” O4 - HKLM…\Run: [WOOWATCH] C:\PROGRA~1\NEOSTR~1\Watch.exe O4 - HKLM…\Run: [WOOTASKBARICON] C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe O4 - HKLM…\Run: [PCSuiteTrayApplication] C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -startup O4 - HKLM…\Run: [RemoteControl] “C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe” O4 - HKLM…\Run: [sunJavaUpdateSched] C:\Program Files\Java\jre1.5.0\bin\jusched.exe O4 - HKLM…\Run: [TkBellExe] “C:\Program Files\Common Files\Real\Update_OB\realsched.exe” -osboot O4 - HKLM…\Run: [QuickTime Task] “C:\Program Files\QuickTime\qttask.exe” -atboottime O4 - HKLM…\Run: [DAEMON Tools] “D:\Program Files\DAEMON Tools\daemon.exe” -lang 1033 O4 - HKLM…\Run: [snpstd] C:\WINDOWS\vsnpstd.exe O4 - HKLM…\Run: [ccApp] “C:\Program Files\Common Files\Symantec Shared\ccApp.exe” O4 - HKLM…\Run: [osCheck] “C:\Program Files\Norton AntiVirus\osCheck.exe” O4 - HKLM…\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe O4 - HKLM…\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe O4 - HKLM…\Run: [unlockerAssistant] “D:\Program Files\Unlocker\UnlockerAssistant.exe” O4 - HKCU…\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU…\Run: [Gadu-Gadu] “D:\Program Files\Gadu-Gadu\gg.exe” /tray O4 - HKCU…\Run: [skype] “C:\Program Files\Skype\Phone\Skype.exe” /nosplash /minimized O4 - HKCU…\Run: [bgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] “C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe” O4 - Startup: Yahoo! Widget Engine.lnk = D:\Program Files\Yahoo!\Yahoo! Widget Engine\YahooWidgetEngine.exe O4 - Global Startup: ATI CATALYST System Tray.lnk = C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe O9 - Extra button: Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra ‘Tools’ menuitem: Windows Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0\bin\npjpi150.dll O9 - Extra ‘Tools’ menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0\bin\npjpi150.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra ‘Tools’ menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O11 - Options group: [iNTERNATIONAL] International* O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {31B7EB4E-8B4B-11D1-A789-00A0CC6651A8} (Cult3D ActiveX Player) - http://host.cycore.net/plugins/windows/ … .0.228.cab O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.5.0) - http://javadl-esd.sun.com/update/1.5.0/ … s-i586.cab O16 - DPF: {A7196C8E-35A5-4FF0-9E46-E28918B5CAF6} (GameDesire Domino) - http://67.15.101.3/g_bin/pl/domino_2_0_0_31.cab O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C1} (GameDesire Pool 8) - http://67.15.101.3/g_bin/pl/billard8_2_0_0_30.cab O17 - HKLM\System\CCS\Services\Tcpip…{13C1021D-7EB1-49F8-B4D3-F779CB7EE631}: NameServer = 85.255.116.110,85.255.112.113 O17 - HKLM\System\CCS\Services\Tcpip…{8CDD4513-11B4-435E-A601-B64F1140649D}: NameServer = 194.204.159.1 217.98.63.164 O17 - HKLM\System\CCS\Services\Tcpip…{C2E403F5-E984-4BA4-AFF8-4BCEB7B96161}: NameServer = 85.255.116.110,85.255.112.113 O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.116.110 85.255.112.113 O17 - HKLM\System\CS1\Services\Tcpip…{13C1021D-7EB1-49F8-B4D3-F779CB7EE631}: NameServer = 85.255.116.110,85.255.112.113 O17 - HKLM\System\CS2\Services\Tcpip\Parameters: NameServer = 85.255.116.110 85.255.112.113 O17 - HKLM\System\CS2\Services\Tcpip…{13C1021D-7EB1-49F8-B4D3-F779CB7EE631}: NameServer = 85.255.116.110,85.255.112.113 O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.116.110 85.255.112.113 O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll O23 - Service: Ares Chatroom server (AresChatServer) - Ares Development Group - D:\Program Files\Ares\chatServer.exe O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: Symantec Event Manager (ccEvtMgr) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing) O23 - Service: Symantec Settings Manager (ccSetMgr) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing) O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing) O23 - Service: Harmonogram automatycznej usługi LiveUpdate - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe O23 - Service: Symantec IS Password Validation (ISPwdSvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\isPwdSvc.exe O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe

Złączono Posta : 14.04.2007 (Sob) 13:55

a tu jest log z SilentRunners:

“Silent Runners.vbs”, revision R50, http://www.silentrunners.org/ Operating System: Windows XP SP2 Output limited to non-default values, except where indicated by “{++}” Startup items buried in registry: --------------------------------- HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ {++} “CTFMON.EXE” = “C:\WINDOWS\system32\ctfmon.exe” [MS] “Gadu-Gadu” = ““D:\Program Files\Gadu-Gadu\gg.exe” /tray” [“Gadu-Gadu Sp. z oo”] “Skype” = ““C:\Program Files\Skype\Phone\Skype.exe” /nosplash /minimized” [“Skype Technologies S.A.”] “BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}” = ““C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe”” [“Nero AG”] HKLM\Software\Microsoft\Windows\CurrentVersion\Run\ {++} “ATIPTA” = “C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe” [“ATI Technologies, Inc.”] “(Default)” = “(empty string)” [file not found] “ATICCC” = ““C:\Program Files\ATI Technologies\ATI.ACE\cli.exe” runtime” [null data] “SoundMan” = “SOUNDMAN.EXE” [“Realtek Semiconductor Corp.”] “CnxDslTaskBar” = "“C:\Program Files\ZTE Corporation\ZXDSL852\CnxDslTb.exe” “ZTE Corporation\ZXDSL852"” [“Conexant Systems, Inc.”] “WOOWATCH” = “C:\PROGRA~1\NEOSTR~1\Watch.exe” [“France Télécom R&D”] “WOOTASKBARICON” = “C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe” [“France Télécom R&D”] “PCSuiteTrayApplication” = “C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -startup” [“Nokia”] “RemoteControl” = ““C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe”” [“Cyberlink Corp.”] “SunJavaUpdateSched” = “C:\Program Files\Java\jre1.5.0\bin\jusched.exe” [“Sun Microsystems, Inc.”] “TkBellExe” = ““C:\Program Files\Common Files\Real\Update_OB\realsched.exe” -osboot” [“RealNetworks, Inc.”] “QuickTime Task” = ““C:\Program Files\QuickTime\qttask.exe” -atboottime” [“Apple Computer, Inc.”] “DAEMON Tools” = ““D:\Program Files\DAEMON Tools\daemon.exe” -lang 1033” [“DT Soft Ltd.”] “snpstd” = “C:\WINDOWS\vsnpstd.exe” [empty string] “ccApp” = ““C:\Program Files\Common Files\Symantec Shared\ccApp.exe”” [“Symantec Corporation”] “osCheck” = ““C:\Program Files\Norton AntiVirus\osCheck.exe”” [“Symantec Corporation”] “HP Software Update” = “C:\Program Files\HP\HP Software Update\HPWuSchd2.exe” [“Hewlett-Packard Co.”] “NeroFilterCheck” = “C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe” [“Nero AG”] “UnlockerAssistant” = ““D:\Program Files\Unlocker\UnlockerAssistant.exe”” [file not found] HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}(Default) = (no title provided) -> {HKLM…CLSID} = “AcroIEHlprObj Class” \InProcServer32(Default) = “C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx” [empty string] HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\ “{42071714-76d4-11d1-8b24-00a0c9068ff3}” = “Rozszerzenie CPL kadrowania wyświetlania” -> {HKLM…CLSID} = “Rozszerzenie CPL kadrowania wyświetlania” \InProcServer32(Default) = “deskpan.dll” [file not found] “{88895560-9AA2-1069-930E-00AA0030EBC8}” = “Rozszerzenie ikony HyperTerminalu” -> {HKLM…CLSID} = “HyperTerminal Icon Ext” \InProcServer32(Default) = “C:\WINDOWS\system32\hticons.dll” [“Hilgraeve, Inc.”] “{5E2121EE-0300-11D4-8D3B-444553540000}” = “Catalyst Context Menu extension” -> {HKLM…CLSID} = “SimpleShlExt Class” \InProcServer32(Default) = “C:\Program Files\ATI Technologies\ATI.ACE\atiacmxx.dll” [empty string] “{416651E4-9C3C-11D9-8BDE-F66BAD1E3F3A}” = “PhoneBrowser” -> {HKLM…CLSID} = “Nokia Phone Browser” \InProcServer32(Default) = “C:\Program Files\Nokia\Nokia PC Suite 6\PhoneBrowser.dll” [“Nokia”] “{F0CB00CD-5A07-4D91-97F5-A8C92CDA93E4}” = “Shell Extensions for RealOne Player” -> {HKLM…CLSID} = “RealOne Player Context Menu Class” \InProcServer32(Default) = “D:\Program Files\Real\RealPlayer\rpshell.dll” [“RealNetworks, Inc.”] “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” = “WinRAR shell extension” -> {HKLM…CLSID} = “WinRAR” \InProcServer32(Default) = “D:\Program Files\WinRAR\rarext.dll” [null data] “{97F68CE3-7146-45FF-BE24-D9A7DD7CB8A2}” = “NeroCoverEd Live Icons” -> {HKLM…CLSID} = “NeroCoverEdLiveIcons Class” \InProcServer32(Default) = “C:\Program Files\Nero\Nero 7\Nero CoverDesigner\CoverEdExtension.dll” [“Nero AG”] “{B327765E-D724-4347-8B16-78AE18552FC3}” = “NeroDigitalIconHandler” -> {HKLM…CLSID} = “NeroDigitalIconHandler Class” \InProcServer32(Default) = “C:\Program Files\Common Files\Ahead\Lib\NeroDigitalExt.dll” [“Nero AG”] “{7F1CF152-04F8-453A-B34C-E609530A9DC8}” = “NeroDigitalPropSheetHandler” -> {HKLM…CLSID} = “NeroDigitalPropSheetHandler Class” \InProcServer32(Default) = “C:\Program Files\Common Files\Ahead\Lib\NeroDigitalExt.dll” [“Nero AG”] HKLM\Software\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\ “WPDShServiceObj” = “{AAA288BA-9A4C-45B0-95D7-94D524869DB5}” -> {HKLM…CLSID} = “WPDShServiceObj Class” \InProcServer32(Default) = “C:\WINDOWS\system32\WPDShServiceObj.dll” [MS] HKLM\System\CurrentControlSet\Control\SecurityProviders\ <> (“msapsspc.dll” [MS]) “SecurityProviders” = “msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll” HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ <> AtiExtEvent\DLLName = “Ati2evxx.dll” [“ATI Technologies Inc.”] HKLM\Software\Classes\Folder\shellex\ColumnHandlers\ {7D4D6379-F301-4311-BEBA-E26EB0561882}(Default) = “NeroDigitalExt.NeroDigitalColumnHandler” -> {HKLM…CLSID} = “NeroDigitalColumnHandler Class” \InProcServer32(Default) = “C:\Program Files\Common Files\Ahead\Lib\NeroDigitalExt.dll” [“Nero AG”] HKLM\Software\Classes*\shellex\ContextMenuHandlers\ Cover Designer(Default) = “{73FCA462-9BD5-4065-A73F-A8E5F6904EF7}” -> {HKLM…CLSID} = “NeroCoverEdContextMenu Class” \InProcServer32(Default) = “C:\Program Files\Nero\Nero 7\Nero CoverDesigner\CoverEdExtension.dll” [“Nero AG”] Symantec.Norton.Antivirus.IEContextMenu(Default) = “{FAD61B3D-699D-49B2-BE16-7F82CB4C59CA}” -> {HKLM…CLSID} = “IEContextMenu Class” \InProcServer32(Default) = “C:\PROGRA~1\NORTON~1\NavShExt.dll” [“Symantec Corporation”] WinRAR(Default) = “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” -> {HKLM…CLSID} = “WinRAR” \InProcServer32(Default) = “D:\Program Files\WinRAR\rarext.dll” [null data] HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\ WinRAR(Default) = “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” -> {HKLM…CLSID} = “WinRAR” \InProcServer32(Default) = “D:\Program Files\WinRAR\rarext.dll” [null data] HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\ Symantec.Norton.Antivirus.IEContextMenu(Default) = “{FAD61B3D-699D-49B2-BE16-7F82CB4C59CA}” -> {HKLM…CLSID} = “IEContextMenu Class” \InProcServer32(Default) = “C:\PROGRA~1\NORTON~1\NavShExt.dll” [“Symantec Corporation”] WinRAR(Default) = “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” -> {HKLM…CLSID} = “WinRAR” \InProcServer32(Default) = “D:\Program Files\WinRAR\rarext.dll” [null data] Group Policies {policy setting}: -------------------------------- Note: detected settings may not have any effect. HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\ “shutdownwithoutlogon” = (REG_DWORD) hex:0x00000001 {Shutdown: Allow system to be shut down without having to log on} “undockwithoutlogon” = (REG_DWORD) hex:0x00000001 {Devices: Allow undock without having to log on} Active Desktop and Wallpaper: ----------------------------- Active Desktop may be disabled at this entry: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState Displayed if Active Desktop enabled and wallpaper not set by Group Policy: HKCU\Software\Microsoft\Internet Explorer\Desktop\General\ “Wallpaper” = “C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp” Displayed if Active Desktop disabled and wallpaper not set by Group Policy: HKCU\Control Panel\Desktop\ “Wallpaper” = “C:\Documents and Settings\Rodzina\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp” Enabled Screen Saver: --------------------- HKCU\Control Panel\Desktop\ “SCRNSAVE.EXE” = “C:\WINDOWS\system32\logon.scr” [MS] Startup items in “Rodzina” & “All Users” startup folders: --------------------------------------------------------- C:\Documents and Settings\Rodzina\Menu Start\Programy\Autostart “Yahoo! Widget Engine” -> shortcut to: “D:\Program Files\Yahoo!\Yahoo! Widget Engine\YahooWidgetEngine.exe” [file not found] C:\Documents and Settings\All Users\Menu Start\Programy\Autostart “ATI CATALYST System Tray” -> shortcut to: “C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe SystemTray” [null data] “HP Digital Imaging Monitor” -> shortcut to: “C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe” [“Hewlett-Packard Co.”] Enabled Scheduled Tasks: ------------------------ “Norton AntiVirus - Uruchom pełne skanowanie systemu - Rodzina” -> launches: “C:\PROGRA~1\NORTON~1\Navw32.exe /TASK:“C:\Documents and Settings\All Users\Dane aplikacji\Symantec\Norton AntiVirus\Tasks\mycomp.sca”” [“Symantec Corporation”] Winsock2 Service Provider DLLs: ------------------------------- Namespace Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++} 000000000001\LibraryPath = “%SystemRoot%\System32\mswsock.dll” [MS] 000000000002\LibraryPath = “%SystemRoot%\System32\winrnr.dll” [MS] 000000000003\LibraryPath = “%SystemRoot%\System32\mswsock.dll” [MS] Transport Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++} 0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range: %SystemRoot%\system32\mswsock.dll [MS], 01 - 03, 06 - 17 %SystemRoot%\system32\rsvpsp.dll [MS], 04 - 05 Toolbars, Explorer Bars, Extensions: ------------------------------------ Toolbars HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\ “{F2CF5485-4E02-4F68-819C-B92DE9277049}” -> {HKLM…CLSID} = “&Links” \InProcServer32(Default) = “C:\WINDOWS\system32\ieframe.dll” [MS] Extensions (Tools menu items, main toolbar menu buttons) HKLM\Software\Microsoft\Internet Explorer\Extensions\ {08B0E5C0-4FCB-11CF-AAA5-00401C608501}\ “MenuText” = “Sun Java Console” “CLSIDExtension” = “{CAFEEFAC-0015-0000-0000-ABCDEFFEDCBC}” -> {HKLM…CLSID} = “Java Plug-in 1.5.0” \InProcServer32(Default) = “C:\Program Files\Java\jre1.5.0\bin\npjpi150.dll” [“Sun Microsystems, Inc.”] {E2E2DD38-D088-4134-82B7-F2BA38496583}\ “MenuText” = “@xpsp3res.dll,-20001” “Exec” = “%windir%\Network Diagnostic\xpnetdiag.exe” [null data] Miscellaneous IE Hijack Points ------------------------------ HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks\ <> “{08C06D61-F1F3-4799-86F8-BE1A89362C85}” = (no title provided) -> {HKLM…CLSID} = “Search Class” \InProcServer32(Default) = “C:\PROGRA~1\NEOSTR~1\SEARCH~1.DLL” [empty string] Running Services (Display Name, Service Name, Path {Service DLL}): ------------------------------------------------------------------ Ati HotKey Poller, Ati HotKey Poller, “C:\WINDOWS\system32\Ati2evxx.exe” [“ATI Technologies Inc.”] Harmonogram automatycznej usługi LiveUpdate, Harmonogram automatycznej usługi LiveUpdate, ““C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe”” [“Symantec Corporation”] Logowanie pomocnicze, seclogon, “C:\WINDOWS\System32\svchost.exe -k netsvcs” {“C:\WINDOWS\System32\seclogon.dll” [null data]} NMIndexingService, NMIndexingService, ““C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe”” [“Nero AG”] ServiceLayer, ServiceLayer, ““C:\Program Files\PC Connectivity Solution\ServiceLayer.exe”” [“Nokia.”] Symantec AppCore Service, SymAppCore, ““C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe”” [“Symantec Corporation”] Symantec Event Manager, ccEvtMgr, ““C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe” /h ccCommon” [“Symantec Corporation”] Symantec Lic NetConnect service, CLTNetCnService, ““C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe” /h ccCommon” [“Symantec Corporation”] Symantec Settings Manager, ccSetMgr, ““C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe” /h ccCommon” [“Symantec Corporation”] Windows Driver Foundation - User-mode Driver Framework, WudfSvc, “C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup” {“C:\WINDOWS\System32\WUDFSvc.dll” [MS]} Print Monitors: --------------- HKLM\System\CurrentControlSet\Control\Print\Monitors\ HP Standard TCP/IP Port\Driver = “HpTcpMon.dll” [“Hewlett Packard”] hpzlnt12\Driver = “hpzlnt12.dll” [“HP”] ---------- <>: Suspicious data at a malware launch point. <>: Suspicious data at a browser hijack point. + This report excludes default entries except where indicated. + To see *everywhere* the script checks and *everything* it finds, launch it from a command prompt or a shortcut with the -all parameter. + To search all directories of local fixed drives for DESKTOP.INI DLL launch points, use the -supp parameter or answer “No” at the first message box and “Yes” at the second message box. ---------- (total run time: 286 seconds, including 18 seconds for message boxes)

Złączono Posta : 14.04.2007 (Sob) 14:05

a tu jest raport z FixWareOut. :

Fixwareout Last edited 4/5/2007 Post this report in the forums please … »»»»»Prerun check »»»»» System restarted »»»»» Postrun check HKLM\SOFTWARE~\Winlogon\ “System”="" … … »»»»» Misc files. … »»»»» Checking for older varients. … Search five digit cs, dm, kd, jb, other, files. The following files NEED TO BE SUBMITTED to one of the following URL’S for further inspection. Click browse, find the file then click submit. http://www.virustotal.com/flash/index_en.html Or http://virusscan.jotti.org/ »»»»» Other »»»»» Current runs [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “ATIPTA”=“C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe” @="" “ATICCC”="“C:\Program Files\ATI Technologies\ATI.ACE\cli.exe” runtime" “SoundMan”=“SOUNDMAN.EXE” “CnxDslTaskBar”="“C:\Program Files\ZTE Corporation\ZXDSL852\CnxDslTb.exe” “ZTE Corporation\ZXDSL852"” “WOOWATCH”=“C:\PROGRA~1\NEOSTR~1\Watch.exe” “WOOTASKBARICON”=“C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe” “PCSuiteTrayApplication”=“C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -startup” “RemoteControl”="“C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe”" “SunJavaUpdateSched”=“C:\Program Files\Java\jre1.5.0\bin\jusched.exe” “TkBellExe”="“C:\Program Files\Common Files\Real\Update_OB\realsched.exe” -osboot" “QuickTime Task”="“C:\Program Files\QuickTime\qttask.exe” -atboottime" “DAEMON Tools”="“D:\Program Files\DAEMON Tools\daemon.exe” -lang 1033" “snpstd”=“C:\WINDOWS\vsnpstd.exe” “ccApp”="“C:\Program Files\Common Files\Symantec Shared\ccApp.exe”" “osCheck”="“C:\Program Files\Norton AntiVirus\osCheck.exe”" “HP Software Update”=“C:\Program Files\HP\HP Software Update\HPWuSchd2.exe” “NeroFilterCheck”=“C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe” “UnlockerAssistant”="“D:\Program Files\Unlocker\UnlockerAssistant.exe”" [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “CTFMON.EXE”=“C:\WINDOWS\system32\ctfmon.exe” “Gadu-Gadu”="“D:\Program Files\Gadu-Gadu\gg.exe” /tray" “Skype”="“C:\Program Files\Skype\Phone\Skype.exe” /nosplash /minimized" “BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}”="“C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe”" … Hosts file was reset, If you use a custom hosts file please replace it »»»»» End report »»»»»

adam9870 · 14 Kwiecień 2007 12:10

Narzędzia Fixwareourt należy użyć będąc w trybie awaryjnym.

Usuń wpisy HJT.

Otwórz Notatnik i wklej w nim to:

Plik >>> Zapisz jako >>> Zmień rozszerzenie z TXT na Wszystkie pliki >>> Zapisz pod nazwą FIX.REG >>> kliknij dwa razy na utworzony plik FIX.REG i potwierdź dodanie do rejestru >>> restart.

Po wykonaniu wklej nowe logi plus raport z fixwareout -> c:\fixwareout\report.txt

Loczek_16 · 14 Kwiecień 2007 12:13

a tu jest raport z FixWareOut. :

Fixwareout Last edited 4/5/2007 Post this report in the forums please … »»»»»Prerun check »»»»» System restarted »»»»» Postrun check HKLM\SOFTWARE~\Winlogon\ “System”="" … … »»»»» Misc files. … »»»»» Checking for older varients. … Search five digit cs, dm, kd, jb, other, files. The following files NEED TO BE SUBMITTED to one of the following URL’S for further inspection. Click browse, find the file then click submit. http://www.virustotal.com/flash/index_en.html Or http://virusscan.jotti.org/ »»»»» Other »»»»» Current runs [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “ATIPTA”=“C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe” @="" “ATICCC”="“C:\Program Files\ATI Technologies\ATI.ACE\cli.exe” runtime" “SoundMan”=“SOUNDMAN.EXE” “CnxDslTaskBar”="“C:\Program Files\ZTE Corporation\ZXDSL852\CnxDslTb.exe” “ZTE Corporation\ZXDSL852"” “WOOWATCH”=“C:\PROGRA~1\NEOSTR~1\Watch.exe” “WOOTASKBARICON”=“C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe” “PCSuiteTrayApplication”=“C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -startup” “RemoteControl”="“C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe”" “SunJavaUpdateSched”=“C:\Program Files\Java\jre1.5.0\bin\jusched.exe” “TkBellExe”="“C:\Program Files\Common Files\Real\Update_OB\realsched.exe” -osboot" “QuickTime Task”="“C:\Program Files\QuickTime\qttask.exe” -atboottime" “DAEMON Tools”="“D:\Program Files\DAEMON Tools\daemon.exe” -lang 1033" “snpstd”=“C:\WINDOWS\vsnpstd.exe” “ccApp”="“C:\Program Files\Common Files\Symantec Shared\ccApp.exe”" “osCheck”="“C:\Program Files\Norton AntiVirus\osCheck.exe”" “HP Software Update”=“C:\Program Files\HP\HP Software Update\HPWuSchd2.exe” “NeroFilterCheck”=“C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe” “UnlockerAssistant”="“D:\Program Files\Unlocker\UnlockerAssistant.exe”" [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “CTFMON.EXE”=“C:\WINDOWS\system32\ctfmon.exe” “Gadu-Gadu”="“D:\Program Files\Gadu-Gadu\gg.exe” /tray" “Skype”="“C:\Program Files\Skype\Phone\Skype.exe” /nosplash /minimized" “BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}”="“C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe”" … Hosts file was reset, If you use a custom hosts file please replace it »»»»» End report »»»»»

Złączono Posta : 14.04.2007 (Sob) 14:16

uzylem tego w normalnym trybie ale zaraz powtorze w awaryjnym

Złączono Posta : 14.04.2007 (Sob) 14:40

uruchomilem program w trybie awaryjnym i wyszlo mi cos takiego:

Fixwareout Last edited 4/5/2007 Post this report in the forums please … »»»»»Prerun check »»»»» System restarted »»»»» Postrun check HKLM\SOFTWARE~\Winlogon\ “System”="" … … »»»»» Misc files. … »»»»» Checking for older varients. … Search five digit cs, dm, kd, jb, other, files. The following files NEED TO BE SUBMITTED to one of the following URL’S for further inspection. Click browse, find the file then click submit. http://www.virustotal.com/flash/index_en.html Or http://virusscan.jotti.org/ »»»»» Other »»»»» Current runs [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “ATIPTA”=“C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe” @="" “ATICCC”="“C:\Program Files\ATI Technologies\ATI.ACE\cli.exe” runtime" “SoundMan”=“SOUNDMAN.EXE” “CnxDslTaskBar”="“C:\Program Files\ZTE Corporation\ZXDSL852\CnxDslTb.exe” “ZTE Corporation\ZXDSL852"” “WOOWATCH”=“C:\PROGRA~1\NEOSTR~1\Watch.exe” “WOOTASKBARICON”=“C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe” “PCSuiteTrayApplication”=“C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -startup” “RemoteControl”="“C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe”" “SunJavaUpdateSched”=“C:\Program Files\Java\jre1.5.0\bin\jusched.exe” “TkBellExe”="“C:\Program Files\Common Files\Real\Update_OB\realsched.exe” -osboot" “QuickTime Task”="“C:\Program Files\QuickTime\qttask.exe” -atboottime" “DAEMON Tools”="“D:\Program Files\DAEMON Tools\daemon.exe” -lang 1033" “snpstd”=“C:\WINDOWS\vsnpstd.exe” “ccApp”="“C:\Program Files\Common Files\Symantec Shared\ccApp.exe”" “osCheck”="“C:\Program Files\Norton AntiVirus\osCheck.exe”" “HP Software Update”=“C:\Program Files\HP\HP Software Update\HPWuSchd2.exe” “NeroFilterCheck”=“C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe” “UnlockerAssistant”="“D:\Program Files\Unlocker\UnlockerAssistant.exe”" [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “CTFMON.EXE”=“C:\WINDOWS\system32\ctfmon.exe” “Gadu-Gadu”="“D:\Program Files\Gadu-Gadu\gg.exe” /tray" “Skype”="“C:\Program Files\Skype\Phone\Skype.exe” /nosplash /minimized" “BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}”="“C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe”" … Hosts file was reset, If you use a custom hosts file please replace it »»»»» End report »»»»»

ale niewiem co mam dalej zrobic??

adam9870 · 14 Kwiecień 2007 14:15

Jest Ok, na koniec możesz dla pewności pokazać nowy log z HijackThis.

Loczek_16 · 25 Kwiecień 2007 17:23

czy moglbys mi powiedziec o co chodzi w tym w pisie:

# # An unexpected error has been detected by HotSpot Virtual Machine: # # EXCEPTION_ACCESS_VIOLATION (0xc0000005) at pc=0x6d704c9b, pid=2404, tid=2684 # # Java VM: Java HotSpot Client VM (1.5.0-b64 mixed mode) # Problematic frame: # V [jvm.dll+0xc4c9b] # --------------- T H R E A D --------------- Current thread (0x045856e8): VMThread [id=2684] siginfo: ExceptionCode=0xc0000005, reading address 0x00000008 Registers: EAX=0x00000000, EBX=0x00000000, ECX=0x00000008, EDX=0x00000000 ESP=0x0ae8f9f0, EBP=0x0ae8fa28, ESI=0x07e2efa4, EDI=0x6d7ac320 EIP=0x6d704c9b, EFLAGS=0x00010203 Top of Stack: (sp=0x0ae8f9f0) 0x0ae8f9f0: 07e2efa4 6d7a6780 6d704f01 6d7ac320 0x0ae8fa00: 6d756d29 6d7ac320 6d7a6780 045a2e40 0x0ae8fa10: 6d6aca58 6d7a6780 00000000 00000001 0x0ae8fa20: 045a2e40 00000000 0ae8fa90 6d6adbb5 0x0ae8fa30: 00000001 00000000 00000001 00000002 0x0ae8fa40: 6d7a6780 6d7a6780 00000001 045a2e40 0x0ae8fa50: 00000000 00000000 00000001 00000001 0x0ae8fa60: 0ae8fae8 00000000 00000000 00003630 Instructions: (pc=0x6d704c9b) 0x6d704c8b: 74 14 56 e8 aa 02 00 00 8b 46 04 59 56 8d 48 08 0x6d704c9b: 8b 40 08 ff 50 58 e8 1c 00 00 00 5e c3 e9 00 00 Stack: [0x0ad90000,0x0ae90000), sp=0x0ae8f9f0, free space=1022k Native frames: (J=compiled Java code, j=interpreted, Vv=VM code, C=native code) V [jvm.dll+0xc4c9b] V [jvm.dll+0x6dbb5] V [jvm.dll+0x6d94c] V [jvm.dll+0x70f41] V [jvm.dll+0xfcfbb] V [jvm.dll+0x6c7b0] V [jvm.dll+0x5037f] V [jvm.dll+0x6c92d] V [jvm.dll+0x11768c] V [jvm.dll+0x117163] V [jvm.dll+0x117303] V [jvm.dll+0x117068] C [msvcrt.dll+0x2a3b0] C [kernel32.dll+0xb683] VM_Operation (0x0f74f99c): generation collection for allocation, mode: safepoint, requested by thread 0x0456faf0 --------------- P R O C E S S --------------- Java Threads: ( => current thread ) 0x04544d28 JavaThread “Thread-226” [_thread_blocked, id=2416] 0x08d5ddb8 JavaThread “Thread-225” [_thread_blocked, id=2624] 0x0039f670 JavaThread “Image Fetcher 0” daemon [_thread_blocked, id=2424] 0x044f4af0 JavaThread “Thread-224” [_thread_blocked, id=2184] 0x0456fc70 JavaThread “Thread-223” [_thread_blocked, id=2712] 0x0456faf0 JavaThread “Thread-222” [_thread_blocked, id=380] 0x0455abe0 JavaThread “keepAlive” [_thread_blocked, id=3864] 0x0bf80ae8 JavaThread “AWT-EventQueue-4” [_thread_blocked, id=1776] 0x0455be70 JavaThread “Keep-Alive-Timer” daemon [_thread_blocked, id=1932] 0x0455bcf0 JavaThread “thread applet-com.zylom.game.goldrush.Goldrush.class” [_thread_blocked, id=2096] 0x0c0831a8 JavaThread “AWT-EventQueue-0” [_thread_blocked, id=2200] 0x08d5f408 JavaThread “AWT-Shutdown” [_thread_blocked, id=2388] 0x08c612c8 JavaThread “Thread-218” [_thread_in_native, id=1956] 0x08cd1408 JavaThread “Java Sound Event Dispatcher” daemon [_thread_blocked, id=2852] 0x08cdb8a0 JavaThread “TimerQueue” daemon [_thread_blocked, id=872] 0x08c769b8 JavaThread “traceMsgQueueThread” [_thread_blocked, id=3520] 0x08c616b0 JavaThread “AWT-Windows” daemon [_thread_in_native, id=1396] 0x08c5a4d0 JavaThread “Java2D Disposer” daemon [_thread_blocked, id=3152] 0x045e8a60 JavaThread “Low Memory Detector” daemon [_thread_blocked, id=2928] 0x04505788 JavaThread “CompilerThread0” daemon [_thread_blocked, id=2800] 0x045e6c08 JavaThread “Signal Dispatcher” daemon [_thread_blocked, id=2820] 0x0451fd28 JavaThread “Finalizer” daemon [_thread_blocked, id=2740] 0x04596fd0 JavaThread “Reference Handler” daemon [_thread_blocked, id=2868] Other Threads: =>0x045856e8 VMThread [id=2684] 0x0459e170 WatcherThread [id=2932] VM state:at safepoint (normal execution) VM Mutex/Monitor currently owned by a thread: ([mutex/lock_event]) [0x044f7948/0x00000c68] Threads_lock - owner thread: 0x045856e8 [0x044f7ac8/0x00000c98] Heap_lock - owner thread: 0x0456faf0 Heap def new generation total 1664K, used 0K [0x202e0000, 0x204a0000, 0x20a40000) eden space 1536K, 0% used [0x202e0000, 0x202e0000, 0x20460000) from space 128K, 0% used [0x20480000, 0x20480058, 0x204a0000) to space 128K, 0% used [0x20460000, 0x20460000, 0x20480000) tenured generation total 21100K, used 20805K [0x20a40000, 0x21edb000, 0x262e0000) the space 21100K, 98% used [0x20a40000, 0x21e91550, 0x21e91600, 0x21edb000) compacting perm gen total 8192K, used 7477K [0x262e0000, 0x26ae0000, 0x2a2e0000) the space 8192K, 91% used [0x262e0000, 0x26a2d458, 0x26a2d600, 0x26ae0000) No shared spaces configured. Dynamic libraries: 0x00400000 - 0x0049a000 C:\Program Files\Internet Explorer\IEXPLORE.EXE 0x7c900000 - 0x7c9b2000 C:\WINDOWS\system32\ntdll.dll 0x7c800000 - 0x7c8fb000 C:\WINDOWS\system32\kernel32.dll 0x77dc0000 - 0x77e6c000 C:\WINDOWS\system32\ADVAPI32.dll 0x77e70000 - 0x77f01000 C:\WINDOWS\system32\RPCRT4.dll 0x77f10000 - 0x77f57000 C:\WINDOWS\system32\GDI32.dll 0x7e360000 - 0x7e3f0000 C:\WINDOWS\system32\USER32.dll 0x77c00000 - 0x77c58000 C:\WINDOWS\system32\msvcrt.dll 0x77f60000 - 0x77fd6000 C:\WINDOWS\system32\SHLWAPI.dll 0x7c9c0000 - 0x7d1dc000 C:\WINDOWS\system32\SHELL32.dll 0x774d0000 - 0x7760d000 C:\WINDOWS\system32\ole32.dll 0x61410000 - 0x61534000 C:\WINDOWS\system32\urlmon.dll 0x77110000 - 0x7719c000 C:\WINDOWS\system32\OLEAUT32.dll 0x6e850000 - 0x6e895000 C:\WINDOWS\system32\iertutil.dll 0x77bf0000 - 0x77bf8000 C:\WINDOWS\system32\VERSION.dll 0x76360000 - 0x7637d000 C:\WINDOWS\system32\IMM32.DLL 0x773c0000 - 0x774c3000 C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03\comctl32.dll 0x5d520000 - 0x5d5ba000 C:\WINDOWS\system32\comctl32.dll 0x009a0000 - 0x00f6a000 C:\WINDOWS\system32\IEFRAME.dll 0x76be0000 - 0x76beb000 C:\WINDOWS\system32\PSAPI.DLL 0x5b1d0000 - 0x5b208000 C:\WINDOWS\system32\UxTheme.dll 0x746d0000 - 0x7471b000 C:\WINDOWS\system32\MSCTF.dll 0x10000000 - 0x10004000 D:\Program Files\Unlocker\UnlockerHook.dll 0x20000000 - 0x202d2000 C:\WINDOWS\system32\xpsp2res.dll 0x75180000 - 0x751ae000 C:\WINDOWS\system32\msctfime.ime 0x5dff0000 - 0x5e01f000 C:\WINDOWS\system32\IEUI.dll 0x76350000 - 0x76355000 C:\WINDOWS\system32\MSIMG32.dll 0x4ebc0000 - 0x4ed63000 C:\WINDOWS\WinSxS\x86_Microsoft.Windows.GdiPlus_6595b64144ccf1df_1.0.2600.2180_x-ww_522f9f82\gdiplus.dll 0x47060000 - 0x47081000 C:\WINDOWS\system32\xmllite.dll 0x77b30000 - 0x77b52000 C:\WINDOWS\system32\apphelp.dll 0x76fc0000 - 0x7703f000 C:\WINDOWS\system32\CLBCATQ.DLL 0x77040000 - 0x7710d000 C:\WINDOWS\system32\COMRes.dll 0x746a0000 - 0x746ca000 C:\WINDOWS\system32\msimtf.dll 0x77fe0000 - 0x77ff1000 C:\WINDOWS\system32\Secur32.dll 0x661c0000 - 0x663dd000 C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL 0x68ef0000 - 0x68fe1000 C:\PROGRA~1\MICROS~2\Office12\GrooveUtil.DLL 0x771b0000 - 0x7727f000 C:\WINDOWS\system32\WININET.dll 0x01950000 - 0x01959000 C:\WINDOWS\system32\Normaliz.dll 0x77a70000 - 0x77b05000 C:\WINDOWS\system32\CRYPT32.dll 0x77b10000 - 0x77b22000 C:\WINDOWS\system32\MSASN1.dll 0x78130000 - 0x781cb000 C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.163_x-ww_681e29fb\MSVCR80.dll 0x68ff0000 - 0x68ff7000 C:\PROGRA~1\MICROS~2\Office12\GrooveNew.DLL 0x7c630000 - 0x7c64b000 C:\WINDOWS\WinSxS\x86_Microsoft.VC80.ATL_1fc8b3b9a1e18e3b_8.0.50727.163_x-ww_c8be176f\ATL80.DLL 0x0ffd0000 - 0x0fff8000 C:\WINDOWS\system32\rsaenh.dll 0x77a10000 - 0x77a65000 C:\WINDOWS\System32\cscui.dll 0x765d0000 - 0x765ed000 C:\WINDOWS\System32\CSCDLL.dll 0x77910000 - 0x77a06000 C:\WINDOWS\system32\SETUPAPI.dll 0x6bd10000 - 0x6bd20000 C:\Program Files\Microsoft Office\Office12\msohevi.dll 0x61930000 - 0x6197a000 C:\Program Files\Internet Explorer\ieproxy.dll 0x01f60000 - 0x02226000 C:\WINDOWS\system32\msi.dll 0x75e60000 - 0x75f10000 C:\WINDOWS\system32\SXS.DLL 0x75d70000 - 0x75e01000 C:\WINDOWS\system32\MLANG.dll 0x71a50000 - 0x71a67000 C:\WINDOWS\system32\ws2_32.dll 0x71a40000 - 0x71a48000 C:\WINDOWS\system32\WS2HELP.dll 0x02db0000 - 0x02db8000 C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx 0x02ea0000 - 0x03045000 C:\Program Files\Microsoft Office\Office12\1045\GrooveIntlResource.dll 0x4b440000 - 0x4b4c6000 C:\WINDOWS\system32\MSFTEDIT.DLL 0x65e30000 - 0x65e67000 C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL 0x66b40000 - 0x66cbd000 C:\PROGRA~1\MICROS~2\Office12\GR326C~1.DLL 0x74930000 - 0x74a3e000 C:\WINDOWS\system32\msxml3.dll 0x719f0000 - 0x71a30000 C:\WINDOWS\system32\mswsock.dll 0x66780000 - 0x667d8000 C:\WINDOWS\system32\hnetcfg.dll 0x71a30000 - 0x71a38000 C:\WINDOWS\System32\wshtcpip.dll 0x76ed0000 - 0x76f0c000 C:\WINDOWS\system32\RASAPI32.dll 0x76e80000 - 0x76e92000 C:\WINDOWS\system32\rasman.dll 0x6ff40000 - 0x6ff94000 C:\WINDOWS\system32\NETAPI32.dll 0x76ea0000 - 0x76ecf000 C:\WINDOWS\system32\TAPI32.dll 0x76e70000 - 0x76e7e000 C:\WINDOWS\system32\rtutils.dll 0x76b20000 - 0x76b4e000 C:\WINDOWS\system32\WINMM.dll 0x77c60000 - 0x77c83000 C:\WINDOWS\system32\msv1_0.dll 0x76d50000 - 0x76d69000 C:\WINDOWS\system32\iphlpapi.dll 0x71cf0000 - 0x71d0c000 C:\WINDOWS\system32\actxprxy.dll 0x769a0000 - 0x76a54000 C:\WINDOWS\system32\USERENV.dll 0x76fb0000 - 0x76fb6000 C:\WINDOWS\system32\rasadhlp.dll 0x76f10000 - 0x76f37000 C:\WINDOWS\system32\DNSAPI.dll 0x7e830000 - 0x7eb9f000 C:\WINDOWS\system32\mshtml.dll 0x03ee0000 - 0x03f09000 C:\WINDOWS\system32\msls31.dll 0x63380000 - 0x633f8000 c:\windows\system32\jscript.dll 0x30000000 - 0x302ee000 C:\WINDOWS\system32\Macromed\Flash\Flash9b.ocx 0x76380000 - 0x763c9000 C:\WINDOWS\system32\comdlg32.dll 0x71a70000 - 0x71a7a000 C:\WINDOWS\system32\WSOCK32.dll 0x76c20000 - 0x76c4e000 C:\WINDOWS\system32\WINTRUST.dll 0x76c80000 - 0x76ca8000 C:\WINDOWS\system32\IMAGEHLP.dll 0x72cb0000 - 0x72cb9000 C:\WINDOWS\system32\wdmaud.drv 0x72ca0000 - 0x72ca8000 C:\WINDOWS\system32\msacm32.drv 0x77bd0000 - 0x77be5000 C:\WINDOWS\system32\MSACM32.dll 0x77bc0000 - 0x77bc7000 C:\WINDOWS\system32\midimap.dll 0x767d0000 - 0x767f7000 C:\WINDOWS\system32\schannel.dll 0x6d970000 - 0x6d97a000 C:\WINDOWS\system32\ddrawex.dll 0x736f0000 - 0x73739000 C:\WINDOWS\system32\DDRAW.dll 0x73b50000 - 0x73b56000 C:\WINDOWS\system32\DCIMAN32.dll 0x62460000 - 0x6248b000 C:\WINDOWS\system32\rmoc3260.dll 0x60a20000 - 0x60a68000 C:\WINDOWS\system32\PNCRT.dll 0x13470000 - 0x134c0000 C:\WINDOWS\system32\wmpdxm.dll 0x71ac0000 - 0x71ad2000 C:\WINDOWS\system32\MPR.dll 0x12950000 - 0x133b4000 C:\WINDOWS\system32\wmp.dll 0x75b80000 - 0x75ba1000 C:\WINDOWS\system32\MSVFW32.dll 0x59bc0000 - 0x59c61000 C:\WINDOWS\system32\dbghelp.dll 0x13740000 - 0x13f26000 C:\WINDOWS\system32\wmploc.dll 0x73300000 - 0x73365000 c:\windows\system32\vbscript.dll 0x38a70000 - 0x38a7c000 C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL 0x35c50000 - 0x35c89000 C:\WINDOWS\system32\Dxtrans.dll 0x76b00000 - 0x76b11000 C:\WINDOWS\system32\ATL.DLL 0x35cb0000 - 0x35d07000 C:\WINDOWS\system32\Dxtmsft.dll 0x1b000000 - 0x1b00c000 C:\WINDOWS\system32\IMGUTIL.DLL 0x1b060000 - 0x1b06e000 C:\WINDOWS\system32\pngfilt.dll 0x76200000 - 0x76277000 C:\WINDOWS\system32\mshtmled.dll 0x77680000 - 0x776a1000 C:\WINDOWS\system32\NTMARTA.DLL 0x76f50000 - 0x76f7d000 C:\WINDOWS\system32\WLDAP32.dll 0x71ba0000 - 0x71bb3000 C:\WINDOWS\system32\SAMLIB.dll 0x6d590000 - 0x6d5a1000 C:\Program Files\Java\jre1.5.0\bin\npjpi150.dll 0x5f260000 - 0x5f277000 C:\WINDOWS\system32\OLEPRO32.DLL 0x6d400000 - 0x6d417000 C:\Program Files\Java\jre1.5.0\bin\jpiexp32.dll 0x76fa0000 - 0x76fa8000 C:\WINDOWS\System32\winrnr.dll 0x6d450000 - 0x6d468000 C:\Program Files\Java\jre1.5.0\bin\jpishare.dll 0x6d640000 - 0x6d7c5000 C:\PROGRA~1\Java\JRE15~1.0\bin\client\jvm.dll 0x6d280000 - 0x6d288000 C:\PROGRA~1\Java\JRE15~1.0\bin\hpi.dll 0x6d610000 - 0x6d61c000 C:\PROGRA~1\Java\JRE15~1.0\bin\verify.dll 0x6d300000 - 0x6d31d000 C:\PROGRA~1\Java\JRE15~1.0\bin\java.dll 0x6d630000 - 0x6d63f000 C:\PROGRA~1\Java\JRE15~1.0\bin\zip.dll 0x6d000000 - 0x6d166000 C:\Program Files\Java\jre1.5.0\bin\awt.dll 0x72f90000 - 0x72fb6000 C:\WINDOWS\system32\WINSPOOL.DRV 0x738d0000 - 0x739a0000 C:\WINDOWS\system32\D3DIM700.DLL 0x6d240000 - 0x6d27d000 C:\Program Files\Java\jre1.5.0\bin\fontmanager.dll 0x6d1f0000 - 0x6d203000 C:\Program Files\Java\jre1.5.0\bin\deploy.dll 0x6d5d0000 - 0x6d5ed000 C:\Program Files\Java\jre1.5.0\bin\RegUtils.dll 0x6d3e0000 - 0x6d3f4000 C:\Program Files\Java\jre1.5.0\bin\jpicom32.dll 0x6d4c0000 - 0x6d4d3000 C:\Program Files\Java\jre1.5.0\bin\net.dll VM Arguments: jvm_args: -Xbootclasspath/a:C:\PROGRA~1\Java\JRE15~1.0\lib\deploy.jar;C:\PROGRA~1\Java\JRE15~1.0\lib\plugin.jar -Xmx96m -Djavaplugin.maxHeapSize=96m -Xverify:remote -Djavaplugin.version=1.5.0 -Djavaplugin.nodotversion=150 -Dbrowser=sun.plugin -DtrustProxy=true -Dapplication.home=C:\PROGRA~1\Java\JRE15~1.0 -Djava.protocol.handler.pkgs=sun.plugin.net.protocol -Djavaplugin.vm.options=-Djava.class.path=C:\PROGRA~1\Java\JRE15~1.0\classes -Xbootclasspath/a:C:\PROGRA~1\Java\JRE15~1.0\lib\deploy.jar;C:\PROGRA~1\Java\JRE15~1.0\lib\plugin.jar -Xmx96m -Djavaplugin.maxHeapSize=96m -Xverify:remote -Djavaplugin.version=1.5.0 -Djavaplugin.nodotversion=150 -Dbrowser=sun.plugin -DtrustProxy=true -Dapplication.home=C:\PROGRA~1\Java\JRE15~1.0 -Djava.protocol.handler.pkgs=sun.plugin.net.protocol vfprintf java_command: Environment Variables: CLASSPATH=C:\Program Files\Java\jre1.5.0\lib\ext\QTJava.zip PATH=C:\PROGRA~1\Java\JRE15~1.0\bin;C:\Program Files\PC Connectivity Solution;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\Program Files\ATI Technologies\ATI Control Panel;C:\Program Files\QuickTime\QTSystem;. USERNAME=Rodzina OS=Windows_NT PROCESSOR_IDENTIFIER=x86 Family 15 Model 4 Stepping 1, GenuineIntel --------------- S Y S T E M --------------- OS: Windows XP Build 2600 Dodatek Service Pack 2 CPU:total 1 family 15, cmov, cx8, fxsr, mmx, sse, sse2, ht Memory: 4k page, physical 523760k(99012k free), swap 1276256k(817236k free) vm_info: Java HotSpot Client VM (1.5.0-b64) for windows-x86, built on Sep 15 2004 03:00:31 by “java_re” with MS VC++ 6.0