Mam problem z logami i z procesem SVCHOST.EXE

Pawlik901 · 14 Maj 2007 18:06

Od niedawna mam problem z komputerem . Ciągle się tnie , muli i itd. prawie 100% procesora zżera to : SVCHOST.EXE myślę że mam jakiegoś robala no ale jak w temacie proszę o sprawdzenie mojego loga ( od niedawna wiem o takim czymś także wszelkie pytania albo odpowiedzi proszę uprościć) :

Logfile of Trend Micro HijackThis v2.0.0 (BETA) Scan saved at 19:54:01, on 2007-05-14 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) Boot mode: Normal Running processes: C:\windows\System32\smss.exe C:\windows\system32\winlogon.exe C:\windows\system32\services.exe C:\windows\system32\lsass.exe C:\windows\system32\svchost.exe C:\Program Files\Sygate\SPF\smc.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\windows\system32\spoolsv.exe C:\windows\Explorer.EXE F:\Diskeeperlite\pliki destination\DKService.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\windows\system32\nvsvc32.exe C:\windows\System32\svchost.exe C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\WINDOWS\wt\updater\wcmdmgr.exe F:\Gadu-Gadu\gg.exe C:\WINDOWS\system32\RaConfig.exe F:\Corel\Graphics9\Register\Remind32.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\windows\system32\wuauclt.exe C:\windows\system32\wuauclt.exe C:\Documents and Settings\Paweł.MARCELA.000\Pulpit\HiJackThis_v2.exe C:\windows\System32\svchost.exe F:\Winamp\winamp.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.freemaxmovies.com/%20to%20ve … QUIRED!%20% 20%20%20%20%20%20%20%20%20%20%20%20%20%20WARNING!% 20Adult%20pictures%20are%20featured%20in%20this%20site.%20Only%20adults %20permitted%20beyond%20this%20point!%20%20%20%20%20%20%20%20% 20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20% 20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20Are%20 you%20at%20least%2018%20years%20old R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://195.95.218.172/index.php R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = http://195.95.218.172/index.php R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = wmplayer.exe //ICWLaunch R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza F2 - REG:system.ini: Shell= O1 - Hosts: 127.0.0.3 n-glx.s-redirect.com O1 - Hosts: 127.0.0.3 x.full-tgp.net O1 - Hosts: 127.0.0.3 counter.sexmaniack.com O1 - Hosts: 127.0.0.3 autoescrowpay.com O1 - Hosts: 127.0.0.3 http://www.autoescrowpay.com O1 - Hosts: 127.0.0.3 http://www.awmdabest.com O1 - Hosts: 127.0.0.3 http://www.sexfiles.nu O1 - Hosts: 127.0.0.3 awmdabest.com O1 - Hosts: 127.0.0.3 sexfiles.nu O1 - Hosts: 127.0.0.3 allforadult.com O1 - Hosts: 127.0.0.3 http://www.allforadult.com O1 - Hosts: 127.0.0.3 http://www.iframe.biz O1 - Hosts: 127.0.0.3 iframe.biz O1 - Hosts: 127.0.0.3 http://www.newiframe.biz O1 - Hosts: 127.0.0.3 newiframe.biz O1 - Hosts: 127.0.0.3 http://www.vesbiz.biz O1 - Hosts: 127.0.0.3 vesbiz.biz O1 - Hosts: 127.0.0.3 http://www.pizdato.biz O1 - Hosts: 127.0.0.3 pizdato.biz O1 - Hosts: 127.0.0.3 http://www.aaasexypics.com O1 - Hosts: 127.0.0.3 aaasexypics.com O1 - Hosts: 127.0.0.3 http://www.virgin-tgp.net O1 - Hosts: 127.0.0.3 virgin-tgp.net O1 - Hosts: 127.0.0.3 http://www.awmcash.biz O1 - Hosts: 127.0.0.3 awmcash.biz O1 - Hosts: 127.0.0.3 buldog-stats.com O1 - Hosts: 127.0.0.3 http://www.buldog-stats.com O1 - Hosts: 127.0.0.3 fregat.drocherway.com O1 - Hosts: 127.0.0.3 slutmania.biz O1 - Hosts: 127.0.0.3 http://www.slutmania.biz O1 - Hosts: 127.0.0.3 toolbarpartner.com O1 - Hosts: 127.0.0.3 http://www.toolbarpartner.com O1 - Hosts: 127.0.0.3 http://www.megapornix.com O1 - Hosts: 127.0.0.3 megapornix.com O1 - Hosts: 127.0.0.3 http://www.sp2fucked.biz O1 - Hosts: 127.0.0.3 sp2fucked.biz O1 - Hosts: 127.0.0.3 greg-tut.com O1 - Hosts: 127.0.0.3 http://www.greg-tut.com O1 - Hosts: 127.0.0.3 nylonsexy.com O1 - Hosts: 127.0.0.3 http://www.nylonsexy.com O1 - Hosts: 127.0.0.3 vparivalka.com O1 - Hosts: 127.0.0.3 http://www.vparivalka.com O1 - Hosts: 127.0.0.3 iframeprofit.com O1 - Hosts: 127.0.0.3 http://www.iframeprofit.com O1 - Hosts: 127.0.0.3 topsearch10.com O1 - Hosts: 127.0.0.3 http://www.topsearch10.com O1 - Hosts: 127.0.0.3 statscash.biz O1 - Hosts: 127.0.0.3 http://www.statscash.biz O1 - Hosts: 127.0.0.3 vxiframe.biz O1 - Hosts: 127.0.0.3 http://www.vxiframe.biz O1 - Hosts: 127.0.0.3 crazy-toolbar.com O1 - Hosts: 127.0.0.3 http://www.crazy-toolbar.com O1 - Hosts: 127.0.0.3 topcash.biz O1 - Hosts: 127.0.0.3 http://www.topcash.biz O1 - Hosts: 127.0.0.3 loadcash.biz O1 - Hosts: 127.0.0.3 http://www.loadcash.biz O1 - Hosts: 127.0.0.3 txiframe.biz O1 - Hosts: 127.0.0.3 http://www.txiframe.biz O1 - Hosts: 127.0.0.3 procounter.biz O1 - Hosts: 127.0.0.3 http://www.procounter.biz O1 - Hosts: 127.0.0.3 advadmin.biz O1 - Hosts: 127.0.0.3 http://www.advadmin.biz O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0 CE\Reader\ActiveX\AcroIEHelper.ocx O2 - BHO: My Global Search Bar BHO - {37B85A21-692B-4205-9CAD-2626E4993404} - C:\Program Files\MyGlobalSearch\bar\1.bin\MGSBAR.DLL O2 - BHO: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL (file missing) O3 - Toolbar: (no name) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - (no file) O3 - Toolbar: My Global Search Bar - {37B85A29-692B-4205-9CAD-2626E4993404} - C:\Program Files\MyGlobalSearch\bar\1.bin\MGSBAR.DLL O3 - Toolbar: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL (file missing) O4 - HKLM…\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM…\Run: [wcmdmgr] C:\WINDOWS\wt\updater\wcmdmgrl.exe -launch O4 - HKLM…\Run: [NvCplDaemon] RUNDLL32.EXE C:\windows\system32\NvCpl.dll,NvStartup O4 - HKLM…\Run: [smcService] C:\PROGRA~1\Sygate\SPF\smc.exe -startgui O4 - HKLM…\Run: [Runtime Environment32] C:\Documents and Settings\Paweł.MARCELA.000\Menu Start\Programy\Autostart\Runtime Environment32.exe O4 - HKCU…\Run: [skype] “C:\Program Files\Skype\Phone\Skype.exe” /nosplash /minimized O4 - HKCU…\Run: [Gadu-Gadu] “F:\Gadu-Gadu\gg.exe” /tray O4 - HKUS\S-1-5-19…\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User ‘USŁUGA LOKALNA’) O4 - HKUS\S-1-5-20…\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User ‘USŁUGA SIECIOWA’) O4 - HKUS\S-1-5-18…\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User ‘SYSTEM’) O4 - HKUS.DEFAULT…\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User ‘Default user’) O4 - Startup: Rejestrowanie produktów Corela.lnk = F:\Corel\Graphics9\Register\Remind32.exe O4 - Global Startup: RaConfig.lnk = C:\WINDOWS\system32\RaConfig.exe O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll O9 - Extra ‘Tools’ menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra ‘Tools’ menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O12 - Plugin for .mp3: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin3.dll O15 - Trusted Zone: *.blazefind.com (HKLM) O15 - Trusted Zone: *.clickspring.net (HKLM) O15 - Trusted Zone: *.flingstone.com (HKLM) O15 - Trusted Zone: *.mt-download.com (HKLM) O15 - Trusted Zone: *.my-internet.info (HKLM) O15 - Trusted Zone: *.searchbarcash.com (HKLM) O15 - Trusted Zone: *.searchmiracle.com (HKLM) O15 - Trusted Zone: *.skoobidoo.com (HKLM) O15 - Trusted Zone: *.slotch.com (HKLM) O15 - Trusted Zone: *.slotchbar.com (HKLM) O15 - Trusted Zone: *.windupdates.com (HKLM) O15 - Trusted Zone: *.xxxtoolbar.com (HKLM) O15 - Trusted Zone: *.ysbweb.com (HKLM) O15 - Trusted IP range: 195.95.218.173 (HKLM) O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O20 - Winlogon Notify: drct16 - drct16.dll (file missing) O21 - SSODL: System - {86E9B641-7B42-4848-9B66-402E4F89773B} - vr_sys.dll (file missing) O22 - SharedTaskScheduler: Moduł wstępnego ładowania interfejsu Browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\windows\System32\browseui.dll O22 - SharedTaskScheduler: Demon buforu kategorii składników - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\windows\System32\browseui.dll O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe O23 - Service: Diskeeper - Executive Software International, Inc. - F:\Diskeeperlite\pliki destination\DKService.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\windows\system32\nvsvc32.exe O23 - Service: Sygate Personal Firewall (SmcService) - Sygate Technologies, Inc. - C:\Program Files\Sygate\SPF\smc.exe

–

End of file - 9326 bytes

Gutek · 14 Maj 2007 18:14

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.freemaxmovies.com/%20to%20ve … your%20age, %20REQUIRED!%20%20% 20%20%20%20%20%20%20%20%20%20%20%20% 20WARNING!%20Adult%20pictures%20are%20featured%20in%20this% 20site.%20Only%20adults%20permitted%20beyond%20this%20 point!%20%20%20%20%20%20%20%20%20%20%20%20%20%20% 20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20% 20%20%20%20%20%20%20%20%20%20%20%20Are%20you%20at% 20least%2018%20years%20old R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://195.95.218.172/index.php R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = http://195.95.218.172/index.php F2 - REG:system.ini: Shell= O1 - Hosts: 127.0.0.3 n-glx.s-redirect.com O1 - Hosts: 127.0.0.3 x.full-tgp.net O1 - Hosts: 127.0.0.3 counter.sexmaniack.com O1 - Hosts: 127.0.0.3 autoescrowpay.com O1 - Hosts: 127.0.0.3 http://www.autoescrowpay.com O1 - Hosts: 127.0.0.3 http://www.awmdabest.com O1 - Hosts: 127.0.0.3 http://www.sexfiles.nu O1 - Hosts: 127.0.0.3 awmdabest.com O1 - Hosts: 127.0.0.3 sexfiles.nu O1 - Hosts: 127.0.0.3 allforadult.com O1 - Hosts: 127.0.0.3 http://www.allforadult.com O1 - Hosts: 127.0.0.3 http://www.iframe.biz O1 - Hosts: 127.0.0.3 iframe.biz O1 - Hosts: 127.0.0.3 http://www.newiframe.biz O1 - Hosts: 127.0.0.3 newiframe.biz O1 - Hosts: 127.0.0.3 http://www.vesbiz.biz O1 - Hosts: 127.0.0.3 vesbiz.biz O1 - Hosts: 127.0.0.3 http://www.pizdato.biz O1 - Hosts: 127.0.0.3 pizdato.biz O1 - Hosts: 127.0.0.3 http://www.aaasexypics.com O1 - Hosts: 127.0.0.3 aaasexypics.com O1 - Hosts: 127.0.0.3 http://www.virgin-tgp.net O1 - Hosts: 127.0.0.3 virgin-tgp.net O1 - Hosts: 127.0.0.3 http://www.awmcash.biz O1 - Hosts: 127.0.0.3 awmcash.biz O1 - Hosts: 127.0.0.3 buldog-stats.com O1 - Hosts: 127.0.0.3 http://www.buldog-stats.com O1 - Hosts: 127.0.0.3 fregat.drocherway.com O1 - Hosts: 127.0.0.3 slutmania.biz O1 - Hosts: 127.0.0.3 http://www.slutmania.biz O1 - Hosts: 127.0.0.3 toolbarpartner.com O1 - Hosts: 127.0.0.3 http://www.toolbarpartner.com O1 - Hosts: 127.0.0.3 http://www.megapornix.com O1 - Hosts: 127.0.0.3 megapornix.com O1 - Hosts: 127.0.0.3 http://www.sp2fucked.biz O1 - Hosts: 127.0.0.3 sp2fucked.biz O1 - Hosts: 127.0.0.3 greg-tut.com O1 - Hosts: 127.0.0.3 http://www.greg-tut.com O1 - Hosts: 127.0.0.3 nylonsexy.com O1 - Hosts: 127.0.0.3 http://www.nylonsexy.com O1 - Hosts: 127.0.0.3 vparivalka.com O1 - Hosts: 127.0.0.3 http://www.vparivalka.com O1 - Hosts: 127.0.0.3 iframeprofit.com O1 - Hosts: 127.0.0.3 http://www.iframeprofit.com O1 - Hosts: 127.0.0.3 topsearch10.com O1 - Hosts: 127.0.0.3 http://www.topsearch10.com O1 - Hosts: 127.0.0.3 statscash.biz O1 - Hosts: 127.0.0.3 http://www.statscash.biz O1 - Hosts: 127.0.0.3 vxiframe.biz O1 - Hosts: 127.0.0.3 http://www.vxiframe.biz O1 - Hosts: 127.0.0.3 crazy-toolbar.com O1 - Hosts: 127.0.0.3 http://www.crazy-toolbar.com O1 - Hosts: 127.0.0.3 topcash.biz O1 - Hosts: 127.0.0.3 http://www.topcash.biz O1 - Hosts: 127.0.0.3 loadcash.biz O1 - Hosts: 127.0.0.3 http://www.loadcash.biz O1 - Hosts: 127.0.0.3 txiframe.biz O1 - Hosts: 127.0.0.3 http://www.txiframe.biz O1 - Hosts: 127.0.0.3 procounter.biz O1 - Hosts: 127.0.0.3 http://www.procounter.biz O1 - Hosts: 127.0.0.3 advadmin.biz O1 - Hosts: 127.0.0.3 http://www.advadmin.biz O2 - BHO: My Global Search Bar BHO - {37B85A21-692B-4205-9CAD-2626E4993404} - C:\Program Files\MyGlobalSearch\bar\1.bin\MGSBAR.DLL O2 - BHO: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL (file missing) O3 - Toolbar: (no name) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - (no file) O3 - Toolbar: My Global Search Bar - {37B85A29-692B-4205-9CAD-2626E4993404} - C:\Program Files\MyGlobalSearch\bar\1.bin\MGSBAR.DLL O3 - Toolbar: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL (file missing) O15 - Trusted Zone: *.blazefind.com (HKLM) O15 - Trusted Zone: *.clickspring.net (HKLM) O15 - Trusted Zone: *.flingstone.com (HKLM) O15 - Trusted Zone: *.mt-download.com (HKLM) O15 - Trusted Zone: *.my-internet.info (HKLM) O15 - Trusted Zone: *.searchbarcash.com (HKLM) O15 - Trusted Zone: *.searchmiracle.com (HKLM) O15 - Trusted Zone: *.skoobidoo.com (HKLM) O15 - Trusted Zone: *.slotch.com (HKLM) O15 - Trusted Zone: *.slotchbar.com (HKLM) O15 - Trusted Zone: *.windupdates.com (HKLM) O15 - Trusted Zone: *.xxxtoolbar.com (HKLM) O15 - Trusted Zone: *.ysbweb.com (HKLM) O15 - Trusted IP range: 195.95.218.173 (HKLM) O20 - Winlogon Notify: drct16 - drct16.dll (file missing) O21 - SSODL: System - {86E9B641-7B42-4848-9B66-402E4F89773B} - vr_sys.dll (file missing)

usuń wpisy HJT, folder ręcznie i użyj RogueRemover oraz daj log z Combofix - http://download.bleepingcomputer.com/sUBs/ComboFix.exe

Pawlik901 · 14 Maj 2007 18:36

jak chcę sprawdzić log z Combofixu to pisze takie coś:

Scan times for badly infected machines may easily double a później jakiś raport i komputer się ściął i zaczął się ładować pasek Start na dole tak jakbym dopiero włączył kompa ale po chwili raport się wyświetlił i :

rapo"Pawe" - 2007-05-14 20:31:26 Dodatek Service Pack 2

ComboFix 07-05.13.V - Running from: “C:\Documents and Settings\Pawe.MARCELA.000\Pulpit”

((((((((((((((((((((((((((((((( Files Created from 2007-04-05 to 2007-05-14 ))))))))))))))))))))))))))))))))))

Gutek · 14 Maj 2007 18:57

Otwórz Notatnik i wklej w nim to:

Plik >>> Zapisz jako >>> Ustaw rozszerzenie z TXT na Wszystkie pliki >>> zapisz pod nazwą FIX.REG >>> kliknij podwójnie zrobiony plik i potwierdź >>> reset kompa

Użyj Pocket Killbox. Zaznaczasz opcję Delete on Reboot oraz All Files i w polu Full Path of File to Delete wklejasz ścieżki

C:\WINDOWS\SYSTEM32\drct16.dll

C:\WINDOWS\System32\symcsvc.exe

C:\WINDOWS\System32\vdmt16.sys

C:\WINDOWS\System32\winlow.sys

i naciskasz X czerwony. Program poprosi o reset kompa … czyli resetujesz.

Pawlik901 · 14 Maj 2007 19:11

ej dlaczego ktoś zmienił temat na: Nie mogę usunąć drct16.dll :shock: miałem taki : Proszę o sprawdzenie loga

Gutek · 14 Maj 2007 19:16

ponieważ nie zastosowałeś się do prośby: Zastosuj się do tego Tematu i zmień tytuł tematu na konkretny inaczej KOSZ

Pozdrawiam Gutek2222

Zmieniłem tytuł tematu

Pawlik901 · 14 Maj 2007 19:27

czytałem regulamin i tam pisze że ten kto ma powyżej 50 postów a ja mam zaledwie z 4 czy kilka

a i jeszcze jedno czy jest w tym jakaś różnica : robiłem te logi kiedy miałem zamknięty proces SVCHOST.exe ( mam ich kilka ale ten co zamula ) nie byłbym w stanie otworzyć niczego >>ewentualnie czekałbym na to jakieś 25 min. 8)

kiedy zrobiłem to w Pocket Killbox w każdym przypadku wyskakiwało takie coś: my.php?image=okienkolt2.png

Gutek · 14 Maj 2007 19:47

Daj nowe logi

Pawlik901 · 15 Maj 2007 16:16

tzn. że jak mam włączony ten proces SVCHOST.EXE to mam zrobić te logi i dać ??

Gutek · 15 Maj 2007 16:20

Tak daj nowe logi

Pawlik901 · 15 Maj 2007 16:28

o to nowe logi :

“Pawe” - 2007-05-15 18:24:41 Dodatek Service Pack 2 ComboFix 07-05.13.V - Running from: “C:\Documents and Settings\Pawe.MARCELA.000\Pulpit” ((((((((((((((((((((((((((((((( Files Created from 2007-04-05 to 2007-05-15 )))))))))))))))))))))))))))))))))) 2007-05-15 17:41 2007-05-15 16:52 2007-05-14 21:29 2007-05-14 20:33 49,152 --a------ C:\WINDOWS\nircmd.exe 2007-05-14 17:34 2007-05-14 16:49 2007-05-10 18:50 2007-05-10 14:07 2007-05-09 21:00 2007-05-05 23:42 2007-05-05 19:55 2,560 --a------ C:\WINDOWS_MSRSTRT.EXE 2007-05-05 18:51 2007-04-30 14:58 2007-04-29 08:50 2007-04-28 14:13 2007-04-28 14:01 2007-04-27 18:20 2007-04-24 18:46 2007-04-21 18:28 2007-04-21 14:31 745,600 --a------ C:\WINDOWS\system32\aswBoot.exe 2007-04-20 19:53 2007-04-20 19:16 607,744 --------- C:\WINDOWS\system32\Decslib.dll 2007-04-20 19:09 245,760 --------- C:\WINDOWS\system32\Sccomp91.dll 2007-04-20 19:09 225,280 --------- C:\WINDOWS\system32\Scint91.dll 2007-04-20 19:09 110,592 --------- C:\WINDOWS\system32\Sccres91.dll 2007-04-20 12:59 2007-04-15 11:45 (((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))) 2007-05-05 17:55:28 2,560 ----a-w C:\windows_MSRSTRT.EXE 2007-04-30 15:41:56 85,952 ----a-w C:\windows\system32\drivers\aswmon.sys 2007-04-30 15:41:42 94,552 ----a-w C:\windows\system32\drivers\aswmon2.sys 2007-04-30 15:39:42 23,416 ----a-w C:\windows\system32\drivers\aswRdr.sys 2007-04-30 15:38:52 43,176 ----a-w C:\windows\system32\drivers\aswTdi.sys 2007-04-30 15:37:24 26,888 ----a-w C:\windows\system32\drivers\aavmker4.sys 2007-04-30 15:35:28 95,872 ----a-w C:\windows\system32\AVASTSS.scr 2007-04-23 19:59:58 4,608 ----a-w C:\windows\system32\bbchlp.dll 2007-04-23 19:59:58 27,776 ----a-w C:\windows\system32\bbcap.dll 2007-04-23 19:59:58 2,944 ----a-w C:\windows\system32\drivers\bbcap.sys 2007-04-10 13:41:50 286,720 ------w C:\windows\Setup1.exe 2007-04-09 16:18:44 -------- d-----w C:\Program Files\BearShare 2007-03-31 16:03:38 -------- d-----w C:\Program Files\ACE Mega CoDecS Pack 2007-03-31 16:02:18 -------- d-----w C:\Program Files\SubEdit-Player 2007-03-31 16:02:02 -------- d-----w C:\Program Files\Skype 2007-03-31 16:01:56 -------- d-----w C:\Program Files\Paint.NET 2007-03-30 22:05:14 -------- d-----w C:\Program Files\Winamp 2007-03-30 22:05:04 -------- d-----w C:\Program Files\Windows Media Bonus Pack for Windows XP 2007-03-30 22:05:00 -------- d-----w C:\Program Files\Messenger 2007-03-30 22:05:00 -------- d-----w C:\Program Files\K-Lite Codec Pack 2007-03-30 22:05:00 -------- d-----w C:\Program Files\Dictionary 2007-03-30 22:04:58 -------- d-----w C:\Program Files\Usługi online 2007-03-30 22:04:58 -------- d-----w C:\Program Files\QuickTime 2007-03-30 22:04:58 -------- d-----w C:\Program Files\CDex_150 2007-03-30 22:04:56 -------- d-----w C:\Program Files\FlashGet 2007-03-30 22:04:26 -------- d-----w C:\Program Files\Ahead 2007-03-30 22:04:24 -------- d-----w C:\Program Files\Cyberlink PowerDVD Deluxe v6.0.0.2023 2007-03-28 16:47:54 80,444 ----a-w C:\windows\system32\perfc015.dat 2007-03-28 16:47:54 460,894 ----a-w C:\windows\system32\perfh015.dat 2007-03-18 14:03:50 8,927 ----a-w C:\windows\mozver.dat 2007-03-18 12:23:52 17,480 ----a-w C:\windows\system32\drivers\hamachi.sys 2007-03-17 15:18:38 -------- d-----w C:\Program Files\Common Files\GTK 2007-03-17 13:45:36 293,376 ----a-w C:\windows\system32\winsrv.dll 2007-03-09 21:09:38 -------- d-----w C:\Program Files\Audio Phonics, Inc 2007-03-08 15:38:48 579,072 ----a-w C:\windows\system32\user32.dll 2007-03-08 15:38:48 40,960 ----a-w C:\windows\system32\mf3216.dll 2007-03-08 15:38:48 281,600 ----a-w C:\windows\system32\gdi32.dll 2007-03-08 15:37:34 1,843,840 ----a-w C:\windows\system32\win32k.sys 2007-02-05 20:19:48 185,856 ----a-w C:\windows\system32\upnphost.dll (((((((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects] {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}=C:\Program Files\Adobe\Acrobat 5.0 CE\Reader\ActiveX\AcroIEHelper.ocx [2001-04-16 18:39] {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C}=C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL [] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run] “avast!”=“C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe” “wcmdmgr”=“C:\WINDOWS\wt\updater\wcmdmgrl.exe -launch” “NvCplDaemon”=“RUNDLL32.EXE C:\windows\system32\NvCpl.dll,NvStartup” “SmcService”=“C:\PROGRA~1\Sygate\SPF\smc.exe -startgui” “Runtime Environment32”=“C:\Documents and Settings\Paweł.MARCELA.000\Menu Start\Programy\Autostart\Runtime Environment32.exe” [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “avast!”=“C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe” [2007-04-30 17:42] “wcmdmgr”=“C:\WINDOWS\wt\updater\wcmdmgrl.exe” [2002-02-28 14:57] “NvCplDaemon”=“C:\windows\system32\NvCpl.dll” [2004-07-13 02:50] “SmcService”=“C:\PROGRA~1\Sygate\SPF\smc.exe” [2004-10-15 19:40] “Runtime Environment32”=“C:\Documents and Settings\Paweł.MARCELA.000\Menu Start\Programy\Autostart\Runtime Environment32.exe” [] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “Skype”=“C:\Program Files\Skype\Phone\Skype.exe” [2006-12-18 17:46] “Gadu-Gadu”=“F:\Gadu-Gadu\gg.exe” [2007-05-10 16:36] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run] “Skype”="“C:\Program Files\Skype\Phone\Skype.exe” /nosplash /minimized" “Gadu-Gadu”="“F:\Gadu-Gadu\gg.exe” /tray" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad] “{86E9B641-7B42-4848-9B66-402E4F89773B}”=“vr_sys.dll” [] HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa Authentication Packages msv1_0\0\0 Security Packages kerberos\0msv1_0\0schannel\0wdigest\0\0 Notification Packages scecli\0\0 HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\c:^documents and settings^all users^menu start^programy^autostart^adobe gamma loader.lnk C:\PROGRA~1\COMMON~1\Adobe\CALIBR~1\ADOBEG~1.EXE HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\c:^documents and settings^marcelina^menu start^programy^autostart^tahni deskmate.lnk HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\bearshare “C:\Program Files\BearShare\BearShare.exe” /pause HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\cursorxp C:\Program Files\CursorXP\CursorXP.exe HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\kernelfaultcheck %systemroot%\system32\dumprep 0 -k HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\load C:\YDPDict\watch.exe HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msmsgs “C:\Program Files\Messenger\msmsgs.exe” /background HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nerofiltercheck C:\WINDOWS\system32\NeroCheck.exe HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nod32kui “C:\Program Files\Eset\nod32kui.exe” /WAITSERVICE HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nvmediacenter RUNDLL32.EXE C:\windows\system32\NvMcTray.dll,NvTaskbarInit HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nvmixertray C:\Program Files\NVIDIA Corporation\NvMixer\NvMixerTray.exe HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz nwiz.exe /install HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\paytime HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\remotecontrol “C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe” HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\resume copy copyfstq.exe /startup HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\secboot C:\WINDOWS\system32\mszx23.exe HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\shell HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\sninstall HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\stylexp HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\sunjavaupdatesched C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\wcmdmgr C:\WINDOWS\wt\updater\wcmdmgrl.exe -launch HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\winamp agent F:\Winamp\winampa.exe HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\winampagent F:\Winamp\winampa.exe HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\windows installer HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\wupd C:\WINDOWS\system32\symcsvc.exe HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg_cat2 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Svchost] LocalService Alerter\0WebClient\0LmHosts\0RemoteRegistry\0upnphost\0SSDPSRV\0\0 NetworkService DnsCache\0\0 rpcss RpcSs\0\0 imgsvc StiSvc\0\0 termsvcs TermService\0\0 HTTPFilter HTTPFilter\0\0 DcomLaunch DcomLaunch\0TermService\0\0 HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost ******************************************************************** catchme 0.3.660 W2K/XP/Vista - userland rootkit detector by Gmer, http://www.gmer.net Rootkit scan 2007-05-15 18:27:06 Windows 5.1.2600 Dodatek Service Pack 2 FAT scanning hidden processes … scanning hidden services … scanning hidden autostart entries … scanning hidden files … scan completed successfully hidden processes: 0 hidden services: 0 hidden files: 0 ******************************************************************** Completion time: 2007-05-15 18:27:21 C:\ComboFix2.txt … 2007-05-14 20:34 C:\ComboFix-quarantined-files.txt … 2007-05-15 18:27

Gutek · 15 Maj 2007 16:41

Użyj Pocket Killbox. Zaznaczasz opcję Delete on Reboot oraz All Files i w polu Full Path of File to Delete wklejasz ścieżki

C:\WINDOWS\system32\symcsvc.exe

C:\WINDOWS\System32\mszx23.exe

i naciskasz X czerwony. Program poprosi o reset kompa … czyli resetujesz.

Otwórz Notatnik i wklej w nim to:

Plik >>> Zapisz jako >>> Ustaw rozszerzenie z TXT na Wszystkie pliki >>> zapisz pod nazwą FIX.REG >>> kliknij podwójnie zrobiony plik i potwierdź >>> reset kompa

Pawlik901 · 15 Maj 2007 16:56

wyskoczyło mi takie coś przy otwieraniu fix.reg : nie można zaimportować (podana ścieżka pliku) : określony plik nie jest skryptem rejestru . Można importować tylko binarne pliki rejestru z wewnątrz Edytora rejestru. A przy tym wcześniejszym wyskoczyło mi okienko jak już się wszystko zrobiło i program nie prosił o reset kompa . Okienko my.php?image=okienkolt2.png

Gutek · 15 Maj 2007 17:03

Daj nowy log

Pawlik901 · 15 Maj 2007 17:47

po co nowy skoro dałem ci już i zrobiłem to co mówiłeś … jeszcze podałem co mi wyskakuje po zrobieniu tych rzeczy

Gutek · 15 Maj 2007 18:25

Po to żeby zobaczyć czy pliki zostały

Pawlik901 · 16 Maj 2007 13:52

no ale wyskakiwały jakieś okienka (podałem jakie) i nie wiem czy te zmiany się przyjęły

i jeszcze po tym co mi podałeś …jak to już zrobiłem w pewnym momencie przestał mi dźwięk chodzić na kompie ( tylko systemowe np. błąd , logowanie itd.) a muza nie i dźwięki od programów różnych

Złączono Posta : 16.05.2007 (Sro) 16:18

może tu coś jest dlaczego przestał mi chodzić dźwięk a jak nie to może te zmiany które wprowadziłem “zablokowały” dźwięk

“Pawe” - 2007-05-16 16:13:42 Dodatek Service Pack 2 ComboFix 07-05.13.V - Running from: “C:\Documents and Settings\Pawe.MARCELA.000\Pulpit” ((((((((((((((((((((((((((((((( Files Created from 2007-04-05 to 2007-05-16 )))))))))))))))))))))))))))))))))) 2007-05-15 17:41 2007-05-15 16:52 2007-05-14 21:29 2007-05-14 20:33 49,152 --a------ C:\WINDOWS\nircmd.exe 2007-05-14 17:34 2007-05-14 16:49 2007-05-10 18:50 2007-05-10 14:07 2007-05-09 21:00 2007-05-05 23:42 2007-05-05 19:55 2,560 --a------ C:\WINDOWS_MSRSTRT.EXE 2007-05-05 18:51 2007-04-30 14:58 2007-04-29 08:50 2007-04-28 14:13 2007-04-28 14:01 2007-04-27 18:20 2007-04-24 18:46 2007-04-21 18:28 2007-04-21 14:31 745,600 --a------ C:\WINDOWS\system32\aswBoot.exe 2007-04-20 19:53 2007-04-20 19:16 607,744 --------- C:\WINDOWS\system32\Decslib.dll 2007-04-20 19:09 245,760 --------- C:\WINDOWS\system32\Sccomp91.dll 2007-04-20 19:09 225,280 --------- C:\WINDOWS\system32\Scint91.dll 2007-04-20 19:09 110,592 --------- C:\WINDOWS\system32\Sccres91.dll 2007-04-20 12:59 (((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))) 2007-05-05 17:55:28 2,560 ----a-w C:\windows_MSRSTRT.EXE 2007-04-30 15:41:56 85,952 ----a-w C:\windows\system32\drivers\aswmon.sys 2007-04-30 15:41:42 94,552 ----a-w C:\windows\system32\drivers\aswmon2.sys 2007-04-30 15:39:42 23,416 ----a-w C:\windows\system32\drivers\aswRdr.sys 2007-04-30 15:38:52 43,176 ----a-w C:\windows\system32\drivers\aswTdi.sys 2007-04-30 15:37:24 26,888 ----a-w C:\windows\system32\drivers\aavmker4.sys 2007-04-30 15:35:28 95,872 ----a-w C:\windows\system32\AVASTSS.scr 2007-04-23 19:59:58 4,608 ----a-w C:\windows\system32\bbchlp.dll 2007-04-23 19:59:58 27,776 ----a-w C:\windows\system32\bbcap.dll 2007-04-23 19:59:58 2,944 ----a-w C:\windows\system32\drivers\bbcap.sys 2007-04-10 13:41:50 286,720 ------w C:\windows\Setup1.exe 2007-04-09 16:18:44 -------- d-----w C:\Program Files\BearShare 2007-03-31 16:03:38 -------- d-----w C:\Program Files\ACE Mega CoDecS Pack 2007-03-31 16:02:18 -------- d-----w C:\Program Files\SubEdit-Player 2007-03-31 16:02:02 -------- d-----w C:\Program Files\Skype 2007-03-31 16:01:56 -------- d-----w C:\Program Files\Paint.NET 2007-03-30 22:05:14 -------- d-----w C:\Program Files\Winamp 2007-03-30 22:05:04 -------- d-----w C:\Program Files\Windows Media Bonus Pack for Windows XP 2007-03-30 22:05:00 -------- d-----w C:\Program Files\Messenger 2007-03-30 22:05:00 -------- d-----w C:\Program Files\K-Lite Codec Pack 2007-03-30 22:05:00 -------- d-----w C:\Program Files\Dictionary 2007-03-30 22:04:58 -------- d-----w C:\Program Files\Usługi online 2007-03-30 22:04:58 -------- d-----w C:\Program Files\QuickTime 2007-03-30 22:04:58 -------- d-----w C:\Program Files\CDex_150 2007-03-30 22:04:56 -------- d-----w C:\Program Files\FlashGet 2007-03-30 22:04:26 -------- d-----w C:\Program Files\Ahead 2007-03-30 22:04:24 -------- d-----w C:\Program Files\Cyberlink PowerDVD Deluxe v6.0.0.2023 2007-03-28 16:47:54 80,444 ----a-w C:\windows\system32\perfc015.dat 2007-03-28 16:47:54 460,894 ----a-w C:\windows\system32\perfh015.dat 2007-03-18 14:03:50 8,927 ----a-w C:\windows\mozver.dat 2007-03-18 12:23:52 17,480 ----a-w C:\windows\system32\drivers\hamachi.sys 2007-03-17 15:18:38 -------- d-----w C:\Program Files\Common Files\GTK 2007-03-17 13:45:36 293,376 ----a-w C:\windows\system32\winsrv.dll 2007-03-09 21:09:38 -------- d-----w C:\Program Files\Audio Phonics, Inc 2007-03-08 15:38:48 579,072 ----a-w C:\windows\system32\user32.dll 2007-03-08 15:38:48 40,960 ----a-w C:\windows\system32\mf3216.dll 2007-03-08 15:38:48 281,600 ----a-w C:\windows\system32\gdi32.dll 2007-03-08 15:37:34 1,843,840 ----a-w C:\windows\system32\win32k.sys 2007-03-07 23:51:00 43,528 ------w C:\windows\system32\drivers\pxhelp20.sys 2007-03-07 23:51:00 129,784 ----a-w C:\windows\system32\pxafs.dll 2007-02-05 20:19:48 185,856 ----a-w C:\windows\system32\upnphost.dll (((((((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects] {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}=C:\Program Files\Adobe\Acrobat 5.0 CE\Reader\ActiveX\AcroIEHelper.ocx [2001-04-16 18:39] {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C}=C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL [] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run] “avast!”=“C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe” “wcmdmgr”=“C:\WINDOWS\wt\updater\wcmdmgrl.exe -launch” “NvCplDaemon”=“RUNDLL32.EXE C:\windows\system32\NvCpl.dll,NvStartup” “SmcService”=“C:\PROGRA~1\Sygate\SPF\smc.exe -startgui” “Runtime Environment32”=“C:\Documents and Settings\Paweł.MARCELA.000\Menu Start\Programy\Autostart\Runtime Environment32.exe” “WinampAgent”=“F:\Winamp\winampa.exe” “nwiz”=“nwiz.exe /install” “NvMediaCenter”=“RUNDLL32.EXE C:\windows\system32\NvMcTray.dll,NvTaskbarInit” [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “avast!”=“C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe” [2007-04-30 17:42] “wcmdmgr”=“C:\WINDOWS\wt\updater\wcmdmgrl.exe” [2002-02-28 14:57] “NvCplDaemon”=“C:\windows\system32\NvCpl.dll” [2004-07-13 02:50] “SmcService”=“C:\PROGRA~1\Sygate\SPF\smc.exe” [2004-10-15 19:40] “Runtime Environment32”=“C:\Documents and Settings\Paweł.MARCELA.000\Menu Start\Programy\Autostart\Runtime Environment32.exe” [] “WinampAgent”=“F:\Winamp\winampa.exe” [2007-04-25 17:44] “nwiz”=“nwiz.exe” [2004-07-13 02:50 C:\WINDOWS\system32\nwiz.exe]) “NvMediaCenter”=“C:\windows\system32\NvMcTray.dll” [2004-07-13 02:50] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “Skype”=“C:\Program Files\Skype\Phone\Skype.exe” [2006-12-18 17:46] “Gadu-Gadu”=“F:\Gadu-Gadu\gg.exe” [2007-05-10 16:36] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run] “Skype”="“C:\Program Files\Skype\Phone\Skype.exe” /nosplash /minimized" “Gadu-Gadu”="“F:\Gadu-Gadu\gg.exe” /tray" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad] “{86E9B641-7B42-4848-9B66-402E4F89773B}”=“vr_sys.dll” [] HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa Authentication Packages msv1_0\0\0 Security Packages kerberos\0msv1_0\0schannel\0wdigest\0\0 Notification Packages scecli\0\0 HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\c:^documents and settings^all users^menu start^programy^autostart^adobe gamma loader.lnk C:\PROGRA~1\COMMON~1\Adobe\CALIBR~1\ADOBEG~1.EXE HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\c:^documents and settings^marcelina^menu start^programy^autostart^tahni deskmate.lnk HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\bearshare “C:\Program Files\BearShare\BearShare.exe” /pause HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\cursorxp C:\Program Files\CursorXP\CursorXP.exe HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\kernelfaultcheck %systemroot%\system32\dumprep 0 -k HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\load C:\YDPDict\watch.exe HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msmsgs “C:\Program Files\Messenger\msmsgs.exe” /background HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nerofiltercheck C:\WINDOWS\system32\NeroCheck.exe HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nod32kui “C:\Program Files\Eset\nod32kui.exe” /WAITSERVICE HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nvmediacenter RUNDLL32.EXE C:\windows\system32\NvMcTray.dll,NvTaskbarInit HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nvmixertray C:\Program Files\NVIDIA Corporation\NvMixer\NvMixerTray.exe HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz nwiz.exe /install HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\paytime HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\remotecontrol “C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe” HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\resume copy copyfstq.exe /startup HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\secboot C:\WINDOWS\system32\mszx23.exe HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\shell HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\sninstall HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\stylexp HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\sunjavaupdatesched C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\wcmdmgr C:\WINDOWS\wt\updater\wcmdmgrl.exe -launch HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\winamp agent F:\Winamp\winampa.exe HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\winampagent F:\Winamp\winampa.exe HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\windows installer HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\wupd C:\WINDOWS\system32\symcsvc.exe HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg_cat2 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Svchost] LocalService Alerter\0WebClient\0LmHosts\0RemoteRegistry\0upnphost\0SSDPSRV\0\0 NetworkService DnsCache\0\0 rpcss RpcSs\0\0 imgsvc StiSvc\0\0 termsvcs TermService\0\0 HTTPFilter HTTPFilter\0\0 DcomLaunch DcomLaunch\0TermService\0\0 HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost ******************************************************************** catchme 0.3.660 W2K/XP/Vista - userland rootkit detector by Gmer, http://www.gmer.net Rootkit scan 2007-05-16 16:16:12 Windows 5.1.2600 Dodatek Service Pack 2 FAT scanning hidden processes … scanning hidden services … scanning hidden autostart entries … scanning hidden files … scan completed successfully hidden processes: 0 hidden services: 0 hidden files: 0 ******************************************************************** Completion time: 2007-05-16 16:16:27 C:\ComboFix3.txt … 2007-05-14 20:34 C:\ComboFix-quarantined-files.txt … 2007-05-16 16:16 C:\ComboFix2.txt … 2007-05-15 18:27

Gutek · 16 Maj 2007 15:01

Zrób tak:

http://www.republika.pl/bercik64/FIX%20 … Player.reg ( prawym myszy; zapisz)
dwuklik i TAK, na końcu OK

Skan AVG Anti-Spyware 7.5 po update

Pawlik901 · 16 Maj 2007 15:06

a czy po tym będzie mi dźwięk chodził??

Gutek · 16 Maj 2007 15:09

Zrób to co masz zrobić i zobaczymy, powinno pomóc