Komunikat "Nie można znaleźć pliku C:\MS32DLL.dll.vbs&q

AndrewKR · 6 Maj 2007 20:58

Witam,

na początku chciałbym się przywitać!

Podepne sie pod temat kolegi “azwierzyn” bo niestety ale mam podobny problem. Przyniosłem na kompa coś na pendrivie. Norton tylko znajdował zarażone pliki, nie dawal rady naprawić i aplikowal kwarantanne. Zainstalowałem więc NOD32, który usunął zarażone pliki. Teraz system jest czysty ale pozostał problem z wejście na każdy dysk. Klikając 2 razy wyskakuje komunikat “Nie można znaleźć pliku skryptu C:\MS32DLL.dll.vbs”.

Poniżej logi z Hijack This:

Logfile of HijackThis v1.99.1 Scan saved at 20:32:36, on 2007-05-06 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Intel\Wireless\Bin\EvtEng.exe C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe c:\program files\common files\logitech\lvmvfm\LVPrcSrv.exe C:\WINDOWS\system32\ntvdm.exe C:\WINDOWS\RTHDCPL.EXE C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\Program Files\Acer\Acer Arcade\PCMService.exe C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe C:\Acer\Empowering Technology\admtray.exe C:\WINDOWS\system32\RUNDLL32.EXE C:\WINDOWS\system32\rundll32.exe C:\Acer\Empowering Technology\ePower\ePower_DMC.exe C:\PROGRA~1\LAUNCH~1\LManager.exe C:\Acer\Empowering Technology\eRecovery\Monitor.exe C:\WINDOWS\system32\LVCOMSX.EXE C:\Program Files\Acer\OrbiCam\CameraAssistant.exe C:\WINDOWS\system32\ElkCtrl.exe C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe C:\Program Files\Common Files\PCSuite\DataLayer\DataLayer.exe C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe C:\Program Files\Eset\nod32kui.exe C:\WINDOWS\system32\ctfmon.exe C:\DOCUME~1\AndrewKR\USTAWI~1\Temp\RtkBtMnt.exe C:\Program Files\Gadu-Gadu\gg.exe C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe C:\Acer\Empowering Technology\admServ.exe C:\PROGRA~1\COMMON~1\PCSuite\Services\SERVIC~1.EXE C:\PROGRA~1\COMMON~1\Nokia\MPAPI\MPAPI3s.exe c:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe C:\Program Files\Acer\Acer Arcade\Kernel\TV\CLCapSvc.exe C:\Program Files\Acer\Acer Arcade\Kernel\CLML_NTService\CLMLServer.exe C:\Program Files\Acer\Acer Arcade\Kernel\CLML_NTService\CLMLService.exe C:\Program Files\Common Files\LightScribe\LSSrvc.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\Program Files\Eset\nod32krn.exe C:\WINDOWS\system32\nvsvc32.exe C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe C:\Program Files\CyberLink\Shared Files\RichVideo.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Acer\Acer Arcade\Kernel\TV\CLSched.exe C:\WINDOWS\system32\wbem\unsecapp.exe C:\WINDOWS\system32\wuauclt.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Kazaa Lite K++\KazaaLite.kpp C:\Documents and Settings\AndrewKR\Moje dokumenty\Programy\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.pl/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://global.acer.com R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Hacked by Godzilla R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza F3 - REG:win.ini: load=C:\YDPDict\watch.exe O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - c:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\WINDOWS\system32\eDStoolbar.dll O4 - HKLM…\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM…\Run: [Alcmtr] ALCMTR.EXE O4 - HKLM…\Run: [AzMixerSel] C:\Program Files\Realtek\InstallShield\AzMixerSel.exe O4 - HKLM…\Run: [synTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe O4 - HKLM…\Run: [iMJPMIG8.1] “C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE” /Spoil /RemAdvDef /Migration32 O4 - HKLM…\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC O4 - HKLM…\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC O4 - HKLM…\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName O4 - HKLM…\Run: [PCMService] “C:\Program Files\Acer\Acer Arcade\PCMService.exe” O4 - HKLM…\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe O4 - HKLM…\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe O4 - HKLM…\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe O4 - HKLM…\Run: [eDataSecurity Loader] C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe O4 - HKLM…\Run: [ADMTray.exe] “C:\Acer\Empowering Technology\admtray.exe” O4 - HKLM…\Run: [ntiMUI] C:\Program Files\NewTech Infosystems\NTI CD & DVD-Maker 7\ntiMUI.exe O4 - HKLM…\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM…\Run: [nwiz] nwiz.exe /install O4 - HKLM…\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM…\Run: [bluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,BluetoothAuthenticationAgent O4 - HKLM…\Run: [ePower_DMC] C:\Acer\Empowering Technology\ePower\ePower_DMC.exe O4 - HKLM…\Run: [Acer ePower Management] C:\Acer\Empowering Technology\ePower\Acer ePower Management.exe boot O4 - HKLM…\Run: [LManager] C:\PROGRA~1\LAUNCH~1\LManager.exe O4 - HKLM…\Run: [eRecoveryService] C:\Acer\Empowering Technology\eRecovery\Monitor.exe O4 - HKLM…\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE O4 - HKLM…\Run: [LogitechCameraAssistant] C:\Program Files\Acer\OrbiCam\CameraAssistant.exe O4 - HKLM…\Run: [LogitechVideo[inspector]] C:\Program Files\Acer\OrbiCam\InstallHelper.exe /inspect O4 - HKLM…\Run: [LogitechCameraService(E)] C:\WINDOWS\system32\ElkCtrl.exe /automation O4 - HKLM…\Run: [PCSuiteTrayApplication] C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -onlytray O4 - HKLM…\Run: [DataLayer] C:\Program Files\Common Files\PCSuite\DataLayer\DataLayer.exe O4 - HKLM…\Run: [sunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe O4 - HKLM…\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k O4 - HKLM…\Run: [nod32kui] “C:\Program Files\Eset\nod32kui.exe” /WAITSERVICE O4 - HKCU…\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU…\Run: [Gadu-Gadu] “C:\Program Files\Gadu-Gadu\gg.exe” /tray O4 - HKCU…\Run: [PcSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog O4 - Startup: PowerReg SchedulerV2.exe O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O8 - Extra context menu item: Wyślij do urządzenia &Bluetooth… - c:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra ‘Tools’ menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra ‘Tools’ menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe O23 - Service: AdminWorks Agent X6 (AWService) - Avocent Inc. - C:\Acer\Empowering Technology\admServ.exe O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - c:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - C:\Program Files\Acer\Acer Arcade\Kernel\TV\CLCapSvc.exe O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - C:\Program Files\Acer\Acer Arcade\Kernel\TV\CLSched.exe O23 - Service: CyberLink Media Library Service - Cyberlink - C:\Program Files\Acer\Acer Arcade\Kernel\CLML_NTService\CLMLServer.exe O23 - Service: Intel® PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE O23 - Service: Logitech Process Monitor (LVPrcSrv) - Logitech - c:\program files\common files\logitech\lvmvfm\LVPrcSrv.exe O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: Intel® PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing) O23 - Service: Intel® PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe

oraz z silent runners:

“Silent Runners.vbs”, revision R50, http://www.silentrunners.org/ Operating System: Windows XP SP2 Output limited to non-default values, except where indicated by “{++}” Startup items buried in registry: --------------------------------- HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ {++} “CTFMON.EXE” = “C:\WINDOWS\system32\ctfmon.exe” [MS] “Gadu-Gadu” = ““C:\Program Files\Gadu-Gadu\gg.exe” /tray” [“Gadu-Gadu S.A.”] “PcSync” = “C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog” [“Time Information Services Ltd.”] HKLM\Software\Microsoft\Windows\CurrentVersion\Run\ {++} “RTHDCPL” = “RTHDCPL.EXE” [“Realtek Semiconductor Corp.”] “Alcmtr” = “ALCMTR.EXE” [“Realtek Semiconductor Corp.”] “AzMixerSel” = “C:\Program Files\Realtek\InstallShield\AzMixerSel.exe” [“Realtek Semiconductor Corp.”] “SynTPEnh” = “C:\Program Files\Synaptics\SynTP\SynTPEnh.exe” [“Synaptics, Inc.”] “IMJPMIG8.1” = ““C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE” /Spoil /RemAdvDef /Migration32” [MS] “MSPY2002” = “C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC” [null data] “PHIME2002ASync” = “C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC” [MS] “PHIME2002A” = “C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName” [MS] “PCMService” = ““C:\Program Files\Acer\Acer Arcade\PCMService.exe”” [“CyberLink Corp.”] “igfxtray” = “C:\WINDOWS\system32\igfxtray.exe” [“Intel Corporation”] “igfxhkcmd” = “C:\WINDOWS\system32\hkcmd.exe” [“Intel Corporation”] “igfxpers” = “C:\WINDOWS\system32\igfxpers.exe” [“Intel Corporation”] “eDataSecurity Loader” = “C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe” [“HiTRUST”] “ADMTray.exe” = ““C:\Acer\Empowering Technology\admtray.exe”” [“Avocent Inc.”] “ntiMUI” = “C:\Program Files\NewTech Infosystems\NTI CD & DVD-Maker 7\ntiMUI.exe” [null data] “(Default)” = “(empty string)” [file not found] “NvCplDaemon” = “RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup” [MS] “nwiz” = “nwiz.exe /install” [“NVIDIA Corporation”] “NvMediaCenter” = “RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit” [MS] “BluetoothAuthenticationAgent” = “rundll32.exe bthprops.cpl,BluetoothAuthenticationAgent” [MS] “ePower_DMC” = “C:\Acer\Empowering Technology\ePower\ePower_DMC.exe” [“Acer Incorporated”] “Acer ePower Management” = “C:\Acer\Empowering Technology\ePower\Acer ePower Management.exe boot” [“Acer Value Labs, Taiwan”] “LManager” = “C:\PROGRA~1\LAUNCH~1\LManager.exe” [“Dritek System Inc.”] “eRecoveryService” = “C:\Acer\Empowering Technology\eRecovery\Monitor.exe” [“acer Inc.”] “LVCOMSX” = “C:\WINDOWS\system32\LVCOMSX.EXE” [“Logitech”] “LogitechCameraAssistant” = “C:\Program Files\Acer\OrbiCam\CameraAssistant.exe” [“Acer”] “LogitechVideo[inspector]” = “C:\Program Files\Acer\OrbiCam\InstallHelper.exe /inspect” [“Acer”] “LogitechCameraService(E)” = “C:\WINDOWS\system32\ElkCtrl.exe /automation” [“Logitech Inc.”] “PCSuiteTrayApplication” = “C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -onlytray” [“Nokia”] “DataLayer” = “C:\Program Files\Common Files\PCSuite\DataLayer\DataLayer.exe” [“Nokia Mobile Phones Ltd.”] “SunJavaUpdateSched” = “C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe” [“Sun Microsystems, Inc.”] “KernelFaultCheck” = “C:\WINDOWS\system32\dumprep 0 -k” “nod32kui” = ““C:\Program Files\Eset\nod32kui.exe” /WAITSERVICE” ["Eset "] HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}(Default) = (no title provided) -> {HKLM…CLSID} = “AcroIEHlprObj Class” \InProcServer32(Default) = “c:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll” [“Adobe Systems Incorporated”] {761497BB-D6F0-462C-B6EB-D4DAF1D92D43}(Default) = (no title provided) -> {HKLM…CLSID} = “SSVHelper Class” \InProcServer32(Default) = “C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll” [“Sun Microsystems, Inc.”] HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\ “{42071714-76d4-11d1-8b24-00a0c9068ff3}” = “Rozszerzenie CPL kadrowania wyświetlania” -> {HKLM…CLSID} = “Rozszerzenie CPL kadrowania wyświetlania” \InProcServer32(Default) = “deskpan.dll” [file not found] “{88895560-9AA2-1069-930E-00AA0030EBC8}” = “Rozszerzenie ikony HyperTerminalu” -> {HKLM…CLSID} = “HyperTerminal Icon Ext” \InProcServer32(Default) = “C:\WINDOWS\system32\hticons.dll” [“Hilgraeve, Inc.”] “{2F603045-309F-11CF-9774-0020AFD0CFF6}” = “Synaptics Control Panel” -> {HKLM…CLSID} = (no title provided) \InProcServer32(Default) = “C:\Program Files\Synaptics\SynTP\SynTPCpl.dll” [“Synaptics, Inc.”] “{A70C977A-BF00-412C-90B7-034C51DA2439}” = “NvCpl DesktopContext Class” -> {HKLM…CLSID} = “DesktopContext Class” \InProcServer32(Default) = “C:\WINDOWS\system32\nvcpl.dll” [“NVIDIA Corporation”] “{1CDB2949-8F65-4355-8456-263E7C208A5D}” = “Desktop Explorer” -> {HKLM…CLSID} = “Desktop Explorer” \InProcServer32(Default) = “C:\WINDOWS\system32\nvshell.dll” [“NVIDIA Corporation”] “{1E9B04FB-F9E5-4718-997B-B8DA88302A47}” = “Desktop Explorer Menu” -> {HKLM…CLSID} = (no title provided) \InProcServer32(Default) = “C:\WINDOWS\system32\nvshell.dll” [“NVIDIA Corporation”] “{1E9B04FB-F9E5-4718-997B-B8DA88302A48}” = “nView Desktop Context Menu” -> {HKLM…CLSID} = “nView Desktop Context Menu” \InProcServer32(Default) = “C:\WINDOWS\system32\nvshell.dll” [“NVIDIA Corporation”] “{FFB699E0-306A-11d3-8BD1-00104B6F7516}” = “Play on my TV helper” -> {HKLM…CLSID} = “NVIDIA CPL Extension” \InProcServer32(Default) = “C:\WINDOWS\system32\nvcpl.dll” [“NVIDIA Corporation”] “{6af09ec9-b429-11d4-a1fb-0090960218cb}” = “My Bluetooth Places” -> {HKLM…CLSID} = “Moje miejsca interfejsu Bluetooth” \InProcServer32(Default) = “C:\WINDOWS\system32\btneighborhood.dll” [“Broadcom Corporation.”] “{2b45bd21-71f8-4c8c-a87a-7eeb25a1a3e0}” = “EPM-PO Shell Extension” -> {HKLM…CLSID} = “EPM-PO Shell Extensions” \InProcServer32(Default) = “epm-po.dll” [“Acer Labs USA”] “{40950107-FEA6-4d53-A65F-B2DCBA57DD58}” = “Nokia Phone Browser” -> {HKLM…CLSID} = “Nokia Phone Browser” \InProcServer32(Default) = “C:\Program Files\Nokia\Nokia PC Suite 6\PhoneBrowser.dll” [“Nokia”] “{FBFE7864-D495-41f0-B7DC-4BB601CC295E}” = “Contact View” -> {HKLM…CLSID} = “Contact View” \InProcServer32(Default) = “C:\Program Files\Nokia\Nokia PC Suite 6\ContactView.dll” [“Nokia”] “{C0C4375A-5B72-4efe-929D-3B848C3A1E91}” = “Message View” -> {HKLM…CLSID} = “Message View” \InProcServer32(Default) = “C:\Program Files\Nokia\Nokia PC Suite 6\MessageView.dll” [“Nokia”] “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” = “WinRAR shell extension” -> {HKLM…CLSID} = “WinRAR” \InProcServer32(Default) = “C:\Program Files\WinRAR\rarext.dll” [null data] “{00020D75-0000-0000-C000-000000000046}” = “Microsoft Office Outlook Desktop Icon Handler” -> {HKLM…CLSID} = “Microsoft Office Outlook” \InProcServer32(Default) = “C:\PROGRA~1\MICROS~2\OFFICE11\MLSHEXT.DLL” [MS] “{0006F045-0000-0000-C000-000000000046}” = “Microsoft Office Outlook Custom Icon Handler” -> {HKLM…CLSID} = “Rozszerzenie ikon plików programu Outlook” \InProcServer32(Default) = “C:\PROGRA~1\MICROS~2\OFFICE11\OLKFSTUB.DLL” [MS] “{42042206-2D85-11D3-8CFF-005004838597}” = “Microsoft Office HTML Icon Handler” -> {HKLM…CLSID} = (no title provided) \InProcServer32(Default) = “C:\Program Files\Microsoft Office\OFFICE11\msohev.dll” [MS] “{B089FE88-FB52-11D3-BDF1-0050DA34150D}” = “NOD32 Context Menu Shell Extension” -> {HKLM…CLSID} = “NOD32 Context Menu Shell Extension” \InProcServer32(Default) = “C:\Program Files\Eset\nodshex.dll” [null data] HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows\ <> “load” = “C:\YDPDict\watch.exe” [null data] HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ <> igfxcui\DLLName = “igfxdev.dll” [“Intel Corporation”] HKLM\Software\Classes\PROTOCOLS\Filter\ <> text/xml\CLSID = “{807553E5-5146-11D5-A672-00B0D022E945}” -> {HKLM…CLSID} = (no title provided) \InProcServer32(Default) = “C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL” [MS] HKLM\Software\Classes\Folder\shellex\ColumnHandlers\ {F9DB5320-233E-11D1-9F84-707F02C10627}(Default) = “PDF Column Info” -> {HKLM…CLSID} = “PDF Shell Extension” \InProcServer32(Default) = “c:\Program Files\Adobe\Acrobat 7.0\ActiveX\PDFShell.dll” [“Adobe Systems, Inc.”] HKLM\Software\Classes*\shellex\ContextMenuHandlers\ EDSshellExt(Default) = “{29FF7AB0-BE34-4992-A30B-53A9D86EE239}” -> {HKLM…CLSID} = “eDSshlExt Class” \InProcServer32(Default) = “C:\WINDOWS\system32\eDSshellExt.dll” [“HiTRUST”] NOD32 Context Menu Shell Extension(Default) = “{B089FE88-FB52-11D3-BDF1-0050DA34150D}” -> {HKLM…CLSID} = “NOD32 Context Menu Shell Extension” \InProcServer32(Default) = “C:\Program Files\Eset\nodshex.dll” [null data] WinRAR(Default) = “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” -> {HKLM…CLSID} = “WinRAR” \InProcServer32(Default) = “C:\Program Files\WinRAR\rarext.dll” [null data] HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\ EDSshellExt(Default) = “{29FF7AB0-BE34-4992-A30B-53A9D86EE239}” -> {HKLM…CLSID} = “eDSshlExt Class” \InProcServer32(Default) = “C:\WINDOWS\system32\eDSshellExt.dll” [“HiTRUST”] WinRAR(Default) = “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” -> {HKLM…CLSID} = “WinRAR” \InProcServer32(Default) = “C:\Program Files\WinRAR\rarext.dll” [null data] HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\ NOD32 Context Menu Shell Extension(Default) = “{B089FE88-FB52-11D3-BDF1-0050DA34150D}” -> {HKLM…CLSID} = “NOD32 Context Menu Shell Extension” \InProcServer32(Default) = “C:\Program Files\Eset\nodshex.dll” [null data] WinRAR(Default) = “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” -> {HKLM…CLSID} = “WinRAR” \InProcServer32(Default) = “C:\Program Files\WinRAR\rarext.dll” [null data] Group Policies {policy setting}: -------------------------------- Note: detected settings may not have any effect. HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\ “shutdownwithoutlogon” = (REG_DWORD) hex:0x00000001 {Shutdown: Allow system to be shut down without having to log on} “undockwithoutlogon” = (REG_DWORD) hex:0x00000001 {Devices: Allow undock without having to log on} Active Desktop and Wallpaper: ----------------------------- Active Desktop may be disabled at this entry: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState Displayed if Active Desktop enabled and wallpaper not set by Group Policy: HKCU\Software\Microsoft\Internet Explorer\Desktop\General\ “Wallpaper” = “C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp” Displayed if Active Desktop disabled and wallpaper not set by Group Policy: HKCU\Control Panel\Desktop\ “Wallpaper” = “C:\Documents and Settings\AndrewKR\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp” Enabled Screen Saver: --------------------- HKCU\Control Panel\Desktop\ “SCRNSAVE.EXE” = “C:\WINDOWS\system32\ALFARO~1.SCR” (Alfa Romeo GT.scr) [“Axialis Software”] Startup items in “AndrewKR” & “All Users” startup folders: ---------------------------------------------------------- C:\Documents and Settings\AndrewKR\Menu Start\Programy\Autostart <> “PowerReg SchedulerV2.exe” [empty string] C:\Documents and Settings\All Users\Menu Start\Programy\Autostart “Adobe Reader Speed Launch” -> shortcut to: “C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe” [“Adobe Systems Incorporated”] Winsock2 Service Provider DLLs: ------------------------------- Namespace Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++} 000000000001\LibraryPath = “%SystemRoot%\System32\mswsock.dll” [MS] 000000000002\LibraryPath = “%SystemRoot%\System32\winrnr.dll” [MS] 000000000003\LibraryPath = “%SystemRoot%\System32\mswsock.dll” [MS] 000000000004\LibraryPath = “%SystemRoot%\system32\wshbth.dll” [MS] Transport Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++} 0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range: C:\WINDOWS\system32\imon.dll ["Eset "], 01 - 05, 27 %SystemRoot%\system32\mswsock.dll [MS], 06 - 08, 11 - 26 %SystemRoot%\system32\rsvpsp.dll [MS], 09 - 10 Toolbars, Explorer Bars, Extensions: ------------------------------------ Toolbars HKLM\Software\Microsoft\Internet Explorer\Toolbar\ “{5CBE3B7C-1E47-477E-A7DD-396DB0476E29}” = (no title provided) -> {HKLM…CLSID} = “Acer eDataSecurity Management” \InProcServer32(Default) = “C:\WINDOWS\system32\eDStoolbar.dll” [“HiTRUST”] Explorer Bars HKLM\Software\Microsoft\Internet Explorer\Explorer Bars\ HKLM\Software\Classes\CLSID{FF059E31-CC5A-4E2E-BF3B-96E929D65503}(Default) = “&Badanie” Implemented Categories{00021493-0000-0000-C000-000000000046}\ [vertical bar] InProcServer32(Default) = “C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL” [MS] Extensions (Tools menu items, main toolbar menu buttons) HKLM\Software\Microsoft\Internet Explorer\Extensions\ {08B0E5C0-4FCB-11CF-AAA5-00401C608501}\ “MenuText” = “Sun Java Console” “CLSIDExtension” = “{CAFEEFAC-0015-0000-0006-ABCDEFFEDCBC}” -> {HKCU…CLSID} = “Java Plug-in” \InProcServer32(Default) = “C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll” [“Sun Microsystems, Inc.”] -> {HKLM…CLSID} = “Java Plug-in 1.5.0_06” \InProcServer32(Default) = “C:\Program Files\Java\jre1.5.0_06\bin\npjpi150_06.dll” [“Sun Microsystems, Inc.”] {92780B25-18CC-41C8-B9BE-3C9C571A8263}\ “ButtonText” = “Badanie” {FB5F1910-F110-11D2-BB9E-00C04F795683}\ “ButtonText” = “Messenger” “MenuText” = “Windows Messenger” “Exec” = “C:\Program Files\Messenger\msmsgs.exe” [MS] Running Services (Display Name, Service Name, Path {Service DLL}): ------------------------------------------------------------------ AdminWorks Agent X6, AWService, ““C:\Acer\Empowering Technology\admServ.exe”” [“Avocent Inc.”] Automatic LiveUpdate Scheduler, Automatic LiveUpdate Scheduler, ““C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe”” [“Symantec Corporation”] Bluetooth Service, btwdins, “c:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe” [“Broadcom Corporation.”] Bluetooth Support Service, BthServ, “C:\WINDOWS\system32\svchost.exe -k bthsvcs” {“C:\WINDOWS\System32\bthserv.dll” [MS]} CyberLink Background Capture Service (CBCS), CLCapSvc, ““C:\Program Files\Acer\Acer Arcade\Kernel\TV\CLCapSvc.exe”” [empty string] CyberLink Media Library Service, CyberLink Media Library Service, ““C:\Program Files\Acer\Acer Arcade\Kernel\CLML_NTService\CLMLServer.exe”” [“Cyberlink”] Cyberlink RichVideo Service(CRVS), RichVideo, ““C:\Program Files\CyberLink\Shared Files\RichVideo.exe”” [empty string] CyberLink Task Scheduler (CTS), CLSched, ““C:\Program Files\Acer\Acer Arcade\Kernel\TV\CLSched.exe”” [empty string] Intel® PROSet/Wireless Event Log, EvtEng, “C:\Program Files\Intel\Wireless\Bin\EvtEng.exe” [“Intel Corporation”] Intel® PROSet/Wireless Registry Service, RegSrvc, “C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe” [“Intel Corporation”] Intel® PROSet/Wireless Service, S24EventMonitor, “C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe” ["Intel Corporation "] LightScribeService Direct Disc Labeling Service, LightScribeService, ““C:\Program Files\Common Files\LightScribe\LSSrvc.exe”” [“Hewlett-Packard Company”] Logitech Process Monitor, LVPrcSrv, “c:\program files\common files\logitech\lvmvfm\LVPrcSrv.exe” [“Logitech”] Machine Debug Manager, MDM, ““C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE”” [MS] NOD32 Kernel Service, NOD32krn, ““C:\Program Files\Eset\nod32krn.exe”” ["Eset "] NVIDIA Display Driver Service, NVSvc, “C:\WINDOWS\system32\nvsvc32.exe” [“NVIDIA Corporation”] Print Monitors: --------------- HKLM\System\CurrentControlSet\Control\Print\Monitors\ hpzsnt07\Driver = “hpzsnt07.dll” [“HP”] Microsoft Document Imaging Writer Monitor\Driver = “mdimon.dll” [MS] Microsoft Shared Fax Monitor\Driver = “FXSMON.DLL” [MS] Port drukarki interfejsu Bluetooth\Driver = “bthcrp.dll” [“Broadcom Corporation.”] ---------- <>: Suspicious data at a malware launch point. + This report excludes default entries except where indicated. + To see *everywhere* the script checks and *everything* it finds, launch it from a command prompt or a shortcut with the -all parameter. + To search all directories of local fixed drives for DESKTOP.INI DLL launch points, use the -supp parameter or answer “No” at the first message box and “Yes” at the second message box. ---------- (total run time: 33 seconds, including 10 seconds for message boxes)

Czy ktoreś wpisy są nie tak?? co mozna z tym zrobić. Z góry dziękuje za pomoc!

Joan · 6 Maj 2007 23:04

AndrewKR witaj na Forum

Nie podpinaj się więcej pod czyjeś tematy, załóż swój.

usun to co na czerwono ręcznie z dysku, a wpisy w HJT

Skan AVG AntySpyware 7.5 po update, wklej raport.

AndrewKR · 7 Maj 2007 08:56

Dziękuje za umiejscowienie tematu na swoim miejsu oraz za odpowiedź. Zrobiłem jak radziłeś. Ręczni usunąłem to co zaznaczone a potem wykasowalem pierwszy wpis w HJT bo drugiego juz nie było. Poniżej raport po update’cie z AVG

AVG Anti-Spyware - Scan Report --------------------------------------------------------- + Created at: 10:54:12 2007-05-07 + Scan result: C:\Documents and Settings\AndrewKR\Moje dokumenty\Programy\kodeki i odtwarzacze\Kodeki\ECLiPSE DivX Pack\DivXPack_5_02-006.exe -> Adware.Gator : Ignored. :mozilla.142:C:\Documents and Settings\AndrewKR\Dane aplikacji\Mozilla\Firefox\Profiles\p2rlw39n.default\cookies.txt -> TrackingCookie.2o7 : Ignored. :mozilla.63:C:\Documents and Settings\AndrewKR\Dane aplikacji\Mozilla\Firefox\Profiles\p2rlw39n.default\cookies.txt -> TrackingCookie.Adbrite : Ignored. :mozilla.64:C:\Documents and Settings\AndrewKR\Dane aplikacji\Mozilla\Firefox\Profiles\p2rlw39n.default\cookies.txt -> TrackingCookie.Adbrite : Ignored. :mozilla.65:C:\Documents and Settings\AndrewKR\Dane aplikacji\Mozilla\Firefox\Profiles\p2rlw39n.default\cookies.txt -> TrackingCookie.Adbrite : Ignored. :mozilla.67:C:\Documents and Settings\AndrewKR\Dane aplikacji\Mozilla\Firefox\Profiles\p2rlw39n.default\cookies.txt -> TrackingCookie.Adbrite : Ignored. :mozilla.151:C:\Documents and Settings\AndrewKR\Dane aplikacji\Mozilla\Firefox\Profiles\p2rlw39n.default\cookies.txt -> TrackingCookie.Adocean : Ignored. :mozilla.152:C:\Documents and Settings\AndrewKR\Dane aplikacji\Mozilla\Firefox\Profiles\p2rlw39n.default\cookies.txt -> TrackingCookie.Adocean : Ignored. :mozilla.71:C:\Documents and Settings\AndrewKR\Dane aplikacji\Mozilla\Firefox\Profiles\p2rlw39n.default\cookies.txt -> TrackingCookie.Adocean : Ignored. :mozilla.74:C:\Documents and Settings\AndrewKR\Dane aplikacji\Mozilla\Firefox\Profiles\p2rlw39n.default\cookies.txt -> TrackingCookie.Adocean : Ignored. :mozilla.92:C:\Documents and Settings\AndrewKR\Dane aplikacji\Mozilla\Firefox\Profiles\p2rlw39n.default\cookies.txt -> TrackingCookie.Adocean : Ignored. :mozilla.93:C:\Documents and Settings\AndrewKR\Dane aplikacji\Mozilla\Firefox\Profiles\p2rlw39n.default\cookies.txt -> TrackingCookie.Adocean : Ignored. C:\Documents and Settings\AndrewKR\Cookies\andrewkr@gde.adocean[1].txt -> TrackingCookie.Adocean : Ignored. :mozilla.28:C:\Documents and Settings\AndrewKR\Dane aplikacji\Mozilla\Firefox\Profiles\p2rlw39n.default\cookies.txt -> TrackingCookie.Atdmt : Ignored. C:\Documents and Settings\AndrewKR\Cookies\andrewkr@doubleclick[1].txt -> TrackingCookie.Doubleclick : Ignored. :mozilla.120:C:\Documents and Settings\AndrewKR\Dane aplikacji\Mozilla\Firefox\Profiles\p2rlw39n.default\cookies.txt -> TrackingCookie.Etracker : Ignored. :mozilla.10:C:\Documents and Settings\AndrewKR\Dane aplikacji\Mozilla\Firefox\Profiles\p2rlw39n.default\cookies.txt -> TrackingCookie.Gemius : Ignored. :mozilla.11:C:\Documents and Settings\AndrewKR\Dane aplikacji\Mozilla\Firefox\Profiles\p2rlw39n.default\cookies.txt -> TrackingCookie.Gemius : Ignored. C:\Documents and Settings\AndrewKR\Cookies\andrewkr@hit.gemius[1].txt -> TrackingCookie.Gemius : Ignored. C:\Documents and Settings\AndrewKR\Cookies\andrewkr@ivwbox[2].txt -> TrackingCookie.Ivwbox : Ignored. :mozilla.72:C:\Documents and Settings\AndrewKR\Dane aplikacji\Mozilla\Firefox\Profiles\p2rlw39n.default\cookies.txt -> TrackingCookie.Tradedoubler : Ignored. :mozilla.73:C:\Documents and Settings\AndrewKR\Dane aplikacji\Mozilla\Firefox\Profiles\p2rlw39n.default\cookies.txt -> TrackingCookie.Tradedoubler : Ignored. C:\Documents and Settings\AndrewKR\Cookies\andrewkr@tradedoubler[2].txt -> TrackingCookie.Tradedoubler : Ignored. :mozilla.154:C:\Documents and Settings\AndrewKR\Dane aplikacji\Mozilla\Firefox\Profiles\p2rlw39n.default\cookies.txt -> TrackingCookie.Webtrends : Ignored. :mozilla.128:C:\Documents and Settings\AndrewKR\Dane aplikacji\Mozilla\Firefox\Profiles\p2rlw39n.default\cookies.txt -> TrackingCookie.Webtrendslive : Ignored. :mozilla.66:C:\Documents and Settings\AndrewKR\Dane aplikacji\Mozilla\Firefox\Profiles\p2rlw39n.default\cookies.txt -> TrackingCookie.Yieldmanager : Ignored. :mozilla.68:C:\Documents and Settings\AndrewKR\Dane aplikacji\Mozilla\Firefox\Profiles\p2rlw39n.default\cookies.txt -> TrackingCookie.Yieldmanager : Ignored. ::Report end

Joan · 7 Maj 2007 08:59

Nic groźnego nie ma, usuń wszystko, co znalazł.

AndrewKR · 7 Maj 2007 09:22

Skasowane! Nie ma nic groznego bo trojan w postaci: MS32DLL.dll.vbs został załatwiony juz wcześniej przed NODa. Ale to nie zmienia faktu ze nadal nie moge otworzyc żadnego dysku przez podwójne kliknięcie! Jedyna opcja to prawy myszy–>otwórz. Po podwójnym kliknięciu nadal pojawia się komunikat jak w temacie… jakies pomysły jak sobie z tym poradzic??

Joan · 7 Maj 2007 10:03

OK więc zrób skan narzędziem ComboFix, powinien usunąć pliki autofun.inf, które ten skrypt utworzył. I wklej z niego loga

system · 7 Maj 2007 10:22

ComboFix - ten link działa.

AndrewKR · 7 Maj 2007 10:25

Dzięki! Właśnie szukałem poprawnego linku! Zaraz zainstaluje i wkleje log’a! :mrgreen:

Złączono Posta : 07.05.2007 (Pon) 12:41

Oto log z comboFIXa:

“AndrewKR” - 07-05-07 12:27:16 Dodatek Service Pack 2 ComboFix 07-04-25.4V - Running from: “C:\Documents and Settings\AndrewKR\Moje dokumenty\Programy” (((((((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) c:\autorun.inf d:\autorun.inf C:\WINDOWS\system32\packet.dll C:\WINDOWS\system32\pthreadVC.dll C:\WINDOWS\system32\WanPacket.dll C:\WINDOWS\system32\wpcap.dll C:\WINDOWS\system32\drivers\npf.sys ((((((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) -------\NPF ((((((((((((((((((((((((((((((( Files Created from 2007-04-07 to 2007-05-07 )))))))))))))))))))))))))))))))))) 2007-05-07 10:29 3,968 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys 2007-04-25 19:34 2007-04-25 19:34 2007-04-25 19:34 2007-04-25 13:41 512,096 --a------ C:\WINDOWS\system32\drivers\amon.sys 2007-04-25 13:41 298,104 --a------ C:\WINDOWS\system32\imon.dll 2007-04-25 13:41 15,424 --a------ C:\WINDOWS\system32\drivers\nod32drv.sys 2007-04-24 22:34 2007-04-24 20:58 2007-04-24 20:34 2007-04-18 13:22 1,916,868 --a------ C:\WINDOWS\system32\Alfa Romeo GT.scr 2007-04-18 13:22 2007-04-16 19:13 (((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))) 2007-05-07 11:01 12 --a------ C:\WINDOWS\bthservsdp.dat 2007-03-21 21:21 69498 --a------ C:\WINDOWS\system32\perfc015.dat 2007-03-21 21:21 441272 --a------ C:\WINDOWS\system32\perfh015.dat 2007-03-21 17:24 163644 --a------ C:\WINDOWS\system32\drivers\secdrv.sys 2007-03-17 15:45 293376 --a------ C:\WINDOWS\system32\winsrv.dll 2007-03-08 17:38 579072 --a------ C:\WINDOWS\system32\user32.dll 2007-03-08 17:38 40960 --a------ C:\WINDOWS\system32\mf3216.dll 2007-03-08 17:38 281600 --a------ C:\WINDOWS\system32\gdi32.dll 2007-03-08 17:37 1843840 --a------ C:\WINDOWS\system32\win32k.sys (((((((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects] {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} c:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run] “RTHDCPL”=“RTHDCPL.EXE” “AzMixerSel”=“C:\Program Files\Realtek\InstallShield\AzMixerSel.exe” “SynTPEnh”=“C:\Program Files\Synaptics\SynTP\SynTPEnh.exe” “IMJPMIG8.1”="“C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE” /Spoil /RemAdvDef /Migration32" “MSPY2002”=“C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC” “PHIME2002ASync”=“C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC” “PHIME2002A”=“C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName” “PCMService”="“C:\Program Files\Acer\Acer Arcade\PCMService.exe”" “igfxtray”=“C:\WINDOWS\system32\igfxtray.exe” “igfxhkcmd”=“C:\WINDOWS\system32\hkcmd.exe” “igfxpers”=“C:\WINDOWS\system32\igfxpers.exe” “eDataSecurity Loader”=“C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe” “ADMTray.exe”="“C:\Acer\Empowering Technology\admtray.exe”" “ntiMUI”=“C:\Program Files\NewTech Infosystems\NTI CD & DVD-Maker 7\ntiMUI.exe” “NvCplDaemon”=“RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup” “nwiz”=“nwiz.exe /install” “NvMediaCenter”=“RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit” “BluetoothAuthenticationAgent”=“rundll32.exe bthprops.cpl,BluetoothAuthenticationAgent” “ePower_DMC”=“C:\Acer\Empowering Technology\ePower\ePower_DMC.exe” “Acer ePower Management”=“C:\Acer\Empowering Technology\ePower\Acer ePower Management.exe boot” “LManager”=“C:\PROGRA~1\LAUNCH~1\LManager.exe” “eRecoveryService”=“C:\Acer\Empowering Technology\eRecovery\Monitor.exe” “LVCOMSX”=“C:\WINDOWS\system32\LVCOMSX.EXE” “LogitechCameraAssistant”=“C:\Program Files\Acer\OrbiCam\CameraAssistant.exe” “LogitechVideo[inspector]”=“C:\Program Files\Acer\OrbiCam\InstallHelper.exe /inspect” “LogitechCameraService(E)”=“C:\WINDOWS\system32\ElkCtrl.exe /automation” “PCSuiteTrayApplication”=“C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -onlytray” “DataLayer”=“C:\Program Files\Common Files\PCSuite\DataLayer\DataLayer.exe” “SunJavaUpdateSched”=“C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe” “nod32kui”="“C:\Program Files\Eset\nod32kui.exe” /WAITSERVICE" “!AVG Anti-Spyware”="“C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe” /minimized" [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run] “CTFMON.EXE”=“C:\WINDOWS\system32\ctfmon.exe” “Gadu-Gadu”="“C:\Program Files\Gadu-Gadu\gg.exe” /tray" “PcSync”=“C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog” [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks] “{57B86673-276A-48B2-BAE7-C6DBB3020EB8}”=“AVG Anti-Spyware 7.5” HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa Authentication Packages REG_MULTI_SZ msv1_0\0\0 Security Packages REG_MULTI_SZ kerberos\0msv1_0\0schannel\0wdigest\0\0 Notification Packages REG_MULTI_SZ scecli\0\0 [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MS32DLL] “key”=“SOFTWARE\Microsoft\Windows\CurrentVersion\Run” “item”=“MS32DLL” “hkey”=“HKLM” “command”=“C:\WINDOWS\MS32DLL.dll.vbs” “inimapping”=“0” [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Svchost] HTTPFilter REG_MULTI_SZ HTTPFilter\0\0 LocalService REG_MULTI_SZ Alerter\0WebClient\0LmHosts\0RemoteRegistry\0upnphost\0SSDPSRV\0\0 NetworkService REG_MULTI_SZ DnsCache\0\0 DcomLaunch REG_MULTI_SZ DcomLaunch\0TermService\0\0 rpcss REG_MULTI_SZ RpcSs\0\0 imgsvc REG_MULTI_SZ StiSvc\0\0 termsvcs REG_MULTI_SZ TermService\0\0 bthsvcs REG_MULTI_SZ BthServ\0\0 [HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2{5ed04338-d098-11db-a098-0016d41a55b2}] Shell\AutoRun\command F:\setup.exe [HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2{61cc313e-ccbd-11db-a092-0016d41a55b2}] Shell\AutoRun\command C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL wscript.exe MS32DLL.dll.vbs [HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2{7be2e168-50ac-11db-9f7f-806d6172696f}] Shell\AutoRun\command C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL wscript.exe MS32DLL.dll.vbs [HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2{7be2e169-50ac-11db-9f7f-806d6172696f}] Shell\AutoRun\command C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL wscript.exe MS32DLL.dll.vbs [HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2{86523450-ee45-11db-a0c8-0016d41a55b2}] [HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2{86523452-ee45-11db-a0c8-0016d41a55b2}] [HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2{a089286e-a792-11db-a056-0016d41a55b2}] [HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2{de25b7b4-aab7-11db-a05d-0016d41a55b2}] [HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2{eab510da-ee4e-11db-a0ca-0016d41a55b2}] *newlycreated* - HKEY_LOCAL_MACHINE\system\currentcontrolset\enum\root\LEGACY_AVGASCLN *newlycreated* - HKEY_LOCAL_MACHINE\system\currentcontrolset\enum\root\LEGACY_INT15.SYS ******************************************************************** catchme 0.3.660 W2K/XP/Vista - userland rootkit detector by Gmer, http://www.gmer.net Rootkit scan 2007-05-07 12:28:46 Windows 5.1.2600 Dodatek Service Pack 2 FAT scanning hidden processes … scanning hidden services … scanning hidden autostart entries … scanning hidden files … scan completed successfully hidden processes: 0 hidden services: 0 hidden files: 0 ******************************************************************** Completion time: 07-05-07 12:28:50 C:\ComboFix-quarantined-files.txt … 07-05-07 12:28

Gutek · 7 Maj 2007 14:49

Otwórz Notatnik i wklej w nim to:

Windows Registry Editor Version 5.00 [-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MS32DLL] [-HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2{5ed04338-d098-11db-a098-0016d41a55b2}\Shell\AutoRun\command] [-HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2{61cc313e-ccbd-11db-a092-0016d41a55b2}\Shell\AutoRun\command] [-HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2{7be2e168-50ac-11db-9f7f-806d6172696f}\Shell\AutoRun\command] [-HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2{7be2e169-50ac-11db-9f7f-806d6172696f}\Shell\AutoRun\command] [-HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2{86523450-ee45-11db-a0c8-0016d41a55b2}] [-HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2{86523452-ee45-11db-a0c8-0016d41a55b2}] [-HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2{a089286e-a792-11db-a056-0016d41a55b2}] [-HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2{de25b7b4-aab7-11db-a05d-0016d41a55b2}] [-HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2{eab510da-ee4e-11db-a0ca-0016d41a55b2}]

Plik >>> Zapisz jako >>> Ustaw rozszerzenie z TXT na Wszystkie pliki >>> zapisz pod nazwą FIX.REG >>> kliknij podwójnie zrobiony plik i potwierdź >>> reset kompa

AndrewKR · 7 Maj 2007 17:00

No i zrobilem jak radziłeś. Teraz, po dwukrotnym kliknięciu w ikone dysku wyskakuje okno “wyniki wyszukiwania”. Nie ma już tamtego komunikatu ale dalej cos nie gra i na dysk mozna wejść tylko poprzez klikniecie prawym myszy itd.

qrczak13 · 7 Maj 2007 17:24

Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Drive] @=“Dysk” “EditFlags”=dword:000001d2 “BrowserFlags”=dword:00000008 [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Drive\DefaultIcon] @=hex(2):25,53,79,73,74,65,6d,52,6f,6f,74,25,5c,53,79,73,74,65,6d,33,32,5c,73,\ 68,65,6c,6c,33,32,2e,64,6c,6c,2c,38,00 [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Drive\shell] @="" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Drive\shell\find] “SuppressionPolicy”=dword:00000080 [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Drive\shell\find\command] @=hex(2):25,53,79,73,74,65,6d,52,6f,6f,74,25,5c,45,78,70,6c,6f,72,65,72,2e,65,\ 78,65,00 [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Drive\shell\find\ddeexec] @="[FindFolder("%l", %I)]" “NoActivateHandler”="" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Drive\shell\find\ddeexec\application] @=“Folders” [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Drive\shell\find\ddeexec\topic] @=“AppProperties” [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Drive\shellex] [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Drive\shellex\ContextMenuHandlers] [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Drive\shellex\ContextMenuHandlers\Offline Files] @="{750fdf0e-2a26-11d1-a3ea-080036587f03}" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Drive\shellex\ContextMenuHandlers\Sharing] @="{f81e9010-6ea4-11ce-a7ff-00aa003ca9f6}" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Drive\shellex\ContextMenuHandlers{59099400-57FF-11CE-BD94-0020AF85B590}] [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Drive\shellex\ContextMenuHandlers{fbeb8a05-beee-4442-804e-409d6c4515e9}] @="" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Drive\shellex\FolderExtensions] [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Drive\shellex\FolderExtensions{fbeb8a05-beee-4442-804e-409d6c4515e9}] @="" “DriveMask”=dword:00000020 [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Drive\shellex\PropertySheetHandlers] [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Drive\shellex\PropertySheetHandlers\Sharing] @="{f81e9010-6ea4-11ce-a7ff-00aa003ca9f6}" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Drive\shellex\PropertySheetHandlers{1F2E5C40-9550-11CE-99D2-00AA006E086C}] [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Drive\shellex\PropertySheetHandlers{596AB062-B4D2-4215-9F74-E9109B0A8153}] @="" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Drive\shellex\PropertySheetHandlers{7988B573-EC89-11cf-9C00-00AA00A14F56}] @="" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Drive\shellex\PropertySheetHandlers{ECCDF543-45CC-11CE-B9BF-0080C87CDBA6}] [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Drive\shellex\PropertySheetHandlers{fbeb8a05-beee-4442-804e-409d6c4515e9}] @="" Windows Registry Editor Version 5.00 [HKEY_CLASSES_ROOT\Drive] @=“Dysk” “EditFlags”=hex:d2,01,00,00 [HKEY_CLASSES_ROOT\Drive\DefaultIcon] @=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,74,00,25,\ 00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,00,68,00,\ 65,00,6c,00,6c,00,33,00,32,00,2e,00,64,00,6c,00,6c,00,2c,00,38,00,00,00 [HKEY_CLASSES_ROOT\Drive\shell] @=“none” [HKEY_CLASSES_ROOT\Drive\shell\find] “SuppressionPolicy”=dword:00000080 [HKEY_CLASSES_ROOT\Drive\shell\find\command] @=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,74,00,25,\ 00,5c,00,45,00,78,00,70,00,6c,00,6f,00,72,00,65,00,72,00,2e,00,65,00,78,00,\ 65,00,00,00 [HKEY_CLASSES_ROOT\Drive\shell\find\ddeexec] @="[FindFolder("%l", %I)]" “NoActivateHandler”="" [HKEY_CLASSES_ROOT\Drive\shell\find\ddeexec\application] @=“Folders” [HKEY_CLASSES_ROOT\Drive\shell\find\ddeexec\topic] @=“AppProperties”

Wklej do notatnika > plik -> zapisz jako -> zmień rozszerzenie na wszystkie pliki -> zapisz pod nazwą FIX.REG

W trybie awaryjnym odpal plik FIX.REG i potwierdź dodanie do rejestru i reset kompa.

AndrewKR · 7 Maj 2007 18:56

POMOGłO! Dziekuje bardzo wszystkim którzy pomogli. wirtualne :piwko: dla wszystkich! :mrgreen: