Problem z wirusami w linkach na gg

michas1 · 19 Listopad 2006 14:10

czesc mam problem który jak widze nie przydażył sie tylko mnie, kliknąłem na link który ktos mi wyslał no i zonk, moje wiadomosci do nikogo nie dochodzą , czy ktoś mógłbym mi pomóc i sprawdzić log i ewentualnie udzielic innej porady ?

oto log

Logfile of HijackThis v1.99.1 Scan saved at 15:11:01, on 2006-11-19 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\Program Files\cFosSpeed\spd.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\WINDOWS\system32\svchost.exe C:\WINDOWS\SOUNDMAN.EXE C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe C:\Program Files\Winamp\winampa.exe C:\WINDOWS\autoclk.exe C:\PROGRA~1\Wanadoo\TaskbarIcon.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\Program Files\DAEMON Tools\daemon.exe C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe C:\Program Files\SlySoft\AnyDVD\AnyDVD.exe C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\Program Files\QuickTime\qttask.exe C:\Program Files\cFosSpeed\cFosSpeed.exe C:\WINDOWS\system32\winalert.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe C:\Program Files\VIA\RAID\raid_tool.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\Program Files\Wanadoo\EspaceWanadoo.exe C:\Program Files\Wanadoo\ComComp.exe C:\Program Files\Wanadoo\Watch.exe C:\Program Files\BitComet\BitComet.exe C:\Program Files\Gadu-Gadu\gg.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE D:\Michał\programy\antywirusy\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.neostrada.pl R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Neostrada Plus wita Cie w Internecie R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza R3 - URLSearchHook: (no name) - {8F5863AA-0A2B-CB8E-05BF-9FFE010A4918} - srbho.dll (file missing) O1 - Hosts: localhost 127.0.0.1 O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar.dll O4 - HKLM…\Run: [soundMan] SOUNDMAN.EXE O4 - HKLM…\Run: [ATIPTA] “C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe” O4 - HKLM…\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM…\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe O4 - HKLM…\Run: [autoclk] autoclk.exe O4 - HKLM…\Run: [WOOWATCH] C:\PROGRA~1\Wanadoo\Watch.exe O4 - HKLM…\Run: [WOOTASKBARICON] C:\PROGRA~1\Wanadoo\TaskbarIcon.exe O4 - HKLM…\Run: [TkBellExe] “C:\Program Files\Common Files\Real\Update_OB\realsched.exe” -osboot O4 - HKLM…\Run: [DAEMON Tools] “C:\Program Files\DAEMON Tools\daemon.exe” -lang 1033 O4 - HKLM…\Run: [REGSHAVE] C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN O4 - HKLM…\Run: [sunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe O4 - HKLM…\Run: [Anti Trojan Elite] C:\Program Files\Anti Trojan Elite\TJEnder.exe :NO O4 - HKLM…\Run: [AnyDVD] C:\Program Files\SlySoft\AnyDVD\AnyDVD.exe O4 - HKLM…\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM…\Run: [QuickTime Task] “C:\Program Files\QuickTime\qttask.exe” -atboottime O4 - HKLM…\Run: [cFosSpeed] C:\Program Files\cFosSpeed\cFosSpeed.exe O4 - HKLM…\Run: [Windows Update Notifier] “C:\WINDOWS\system32\winalert.exe” O4 - HKCU…\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU…\Run: [Warez] “C:\Program Files\Warez\Warez.exe” /minimized O4 - HKCU…\Run: [WinMedia] winntdll15190375.exe O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe O4 - Global Startup: VIA RAID TOOL.lnk = C:\Program Files\VIA\RAID\raid_tool.exe O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\googletoolbar.dll/cmsearch.html O8 - Extra context menu item: Backward &Links - res://C:\Program Files\Google\googletoolbar.dll/cmbacklinks.html O8 - Extra context menu item: Cac&hed Snapshot of Page - res://C:\Program Files\Google\googletoolbar.dll/cmcache.html O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O8 - Extra context menu item: Si&milar Pages - res://C:\Program Files\Google\googletoolbar.dll/cmsimilar.html O8 - Extra context menu item: Translate into English - res://C:\Program Files\Google\googletoolbar.dll/cmtrans.html O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra ‘Tools’ menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partne … nicode.cab O16 - DPF: {3D8700FB-86A4-4CB4-B738-6F0FC016AC7D} (MainControl Class) - http://arcaonline.arcabit.com/ArcaOnline.cab O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan … asinst.cab O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C1} (GameDesire Pool 8) - http://67.15.101.3/g_bin/pl/billard8_2_0_0_24.cab O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C6} (GameDesire Pool 8UK) - http://67.15.101.3/g_bin/pl/billard8UK_2_0_0_24.cab O17 - HKLM\System\CCS\Services\Tcpip…{0C97DFCF-EA39-44BF-91BA-F952BD7241F7}: NameServer = 85.255.115.59 O17 - HKLM\System\CCS\Services\Tcpip…{229E9AB3-39FA-4F08-A6FB-937CE8A81527}: NameServer = 85.255.115.59 O17 - HKLM\System\CCS\Services\Tcpip…{51FCE2C4-415A-49D9-9895-9D16E2071BBC}: NameServer = 194.204.152.34 217.98.63.164 O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.115.59 85.255.112.126 O17 - HKLM\System\CS1\Services\Tcpip…{0C97DFCF-EA39-44BF-91BA-F952BD7241F7}: NameServer = 85.255.115.59 O17 - HKLM\System\CS2\Services\Tcpip\Parameters: NameServer = 85.255.115.59 85.255.112.126 O17 - HKLM\System\CS2\Services\Tcpip…{0C97DFCF-EA39-44BF-91BA-F952BD7241F7}: NameServer = 85.255.115.59 O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.115.59 85.255.112.126 O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing) O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing) O23 - Service: cFosSpeed System Service (cFosSpeedS) - Unknown owner - C:\Program Files\cFosSpeed\spd.exe" -service (file missing) O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe

Bieniol · 19 Listopad 2006 17:44

Użyj narzędzia -> SmitFraudFix (w trybie awaryjnym z opcji 2 )

Użyj narzędzia FixWareOut

W trybie awaryjnym z wyłączonym przywracaniem systemu usuwasz (wpisy Hijackiem, pliki/foldery na czerwono ręcznie z dysku):

R3 - URLSearchHook: (no name) - {8F5863AA-0A2B-CB8E-05BF-9FFE010A4918} - srbho.dll (file missing) O1 - Hosts: localhost 127.0.0.1 O4 - HKLM…\Run: [Windows Update Notifier] “C:\WINDOWS\system32\winalert.exe” O4 - HKCU…\Run: [WinMedia] winntdll15190375.exe O17 - HKLM\System\CCS\Services\Tcpip…{0C97DFCF-EA39-44BF-91BA-F952BD7241F7}: NameServer = 85.255.115.59 O17 - HKLM\System\CCS\Services\Tcpip…{229E9AB3-39FA-4F08-A6FB-937CE8A81527}: NameServer = 85.255.115.59 O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.115.59 85.255.112.126 O17 - HKLM\System\CS1\Services\Tcpip…{0C97DFCF-EA39-44BF-91BA-F952BD7241F7}: NameServer = 85.255.115.59 O17 - HKLM\System\CS2\Services\Tcpip\Parameters: NameServer = 85.255.115.59 85.255.112.126 O17 - HKLM\System\CS2\Services\Tcpip…{0C97DFCF-EA39-44BF-91BA-F952BD7241F7}: NameServer = 85.255.115.59 O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.115.59 85.255.112.126

Co do tego wpisu:

Poczytaj tutaj -> http://www.searchengines.pl/phpbb203/in … hl=autoclk.exe

Po zabiegach nowy log z Hijacka + log z Silent Runners + raport ze SmitFraudFix + raport z FixWareOut

Gutek · 19 Listopad 2006 18:29

Zastosuj się do tego Tematu i zmień tytuł tematu na konkretny inaczej KOSZ

Pozdrawiam Gutek2222

michas1 · 19 Listopad 2006 18:37

mam gg 7.0[build 20]

usunąłem to co napisałeś i teraz wklejam logi

hijack

Logfile of HijackThis v1.99.1 Scan saved at 19:38:37, on 2006-11-19 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\Program Files\cFosSpeed\spd.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\WINDOWS\system32\svchost.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\WINDOWS\SOUNDMAN.EXE C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe C:\Program Files\Winamp\winampa.exe C:\PROGRA~1\Wanadoo\TaskbarIcon.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\Program Files\DAEMON Tools\daemon.exe C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe C:\Program Files\SlySoft\AnyDVD\AnyDVD.exe C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\Program Files\QuickTime\qttask.exe C:\Program Files\cFosSpeed\cFosSpeed.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe C:\Program Files\VIA\RAID\raid_tool.exe C:\Program Files\Wanadoo\EspaceWanadoo.exe C:\Program Files\Wanadoo\ComComp.exe C:\Program Files\Wanadoo\Watch.exe C:\Program Files\Gadu-Gadu\gg.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE D:\Michał\programy\antywirusy\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Neostrada Plus wita Cie w Internecie R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar.dll O4 - HKLM…\Run: [soundMan] SOUNDMAN.EXE O4 - HKLM…\Run: [ATIPTA] “C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe” O4 - HKLM…\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM…\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe O4 - HKLM…\Run: [WOOWATCH] C:\PROGRA~1\Wanadoo\Watch.exe O4 - HKLM…\Run: [WOOTASKBARICON] C:\PROGRA~1\Wanadoo\TaskbarIcon.exe O4 - HKLM…\Run: [TkBellExe] “C:\Program Files\Common Files\Real\Update_OB\realsched.exe” -osboot O4 - HKLM…\Run: [DAEMON Tools] “C:\Program Files\DAEMON Tools\daemon.exe” -lang 1033 O4 - HKLM…\Run: [REGSHAVE] C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN O4 - HKLM…\Run: [sunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe O4 - HKLM…\Run: [Anti Trojan Elite] C:\Program Files\Anti Trojan Elite\TJEnder.exe :NO O4 - HKLM…\Run: [AnyDVD] C:\Program Files\SlySoft\AnyDVD\AnyDVD.exe O4 - HKLM…\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM…\Run: [QuickTime Task] “C:\Program Files\QuickTime\qttask.exe” -atboottime O4 - HKLM…\Run: [cFosSpeed] C:\Program Files\cFosSpeed\cFosSpeed.exe O4 - HKLM…\Run: [Windows Update Notifier] “C:\WINDOWS\system32\winalert.exe” O4 - HKCU…\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU…\Run: [Warez] “C:\Program Files\Warez\Warez.exe” /minimized O4 - HKCU…\Run: [WinMedia] winntdll15190375.exe O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe O4 - Global Startup: VIA RAID TOOL.lnk = C:\Program Files\VIA\RAID\raid_tool.exe O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\googletoolbar.dll/cmsearch.html O8 - Extra context menu item: Backward &Links - res://C:\Program Files\Google\googletoolbar.dll/cmbacklinks.html O8 - Extra context menu item: Cac&hed Snapshot of Page - res://C:\Program Files\Google\googletoolbar.dll/cmcache.html O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O8 - Extra context menu item: Si&milar Pages - res://C:\Program Files\Google\googletoolbar.dll/cmsimilar.html O8 - Extra context menu item: Translate into English - res://C:\Program Files\Google\googletoolbar.dll/cmtrans.html O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra ‘Tools’ menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partne … nicode.cab O16 - DPF: {3D8700FB-86A4-4CB4-B738-6F0FC016AC7D} (MainControl Class) - http://arcaonline.arcabit.com/ArcaOnline.cab O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan … asinst.cab O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C1} (GameDesire Pool 8) - http://67.15.101.3/g_bin/pl/billard8_2_0_0_24.cab O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C6} (GameDesire Pool 8UK) - http://67.15.101.3/g_bin/pl/billard8UK_2_0_0_24.cab O17 - HKLM\System\CCS\Services\Tcpip…{51FCE2C4-415A-49D9-9895-9D16E2071BBC}: NameServer = 194.204.152.34 217.98.63.164 O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing) O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing) O23 - Service: cFosSpeed System Service (cFosSpeedS) - Unknown owner - C:\Program Files\cFosSpeed\spd.exe" -service (file missing) O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe

Silent runners

“Silent Runners.vbs”, revision 49, http://www.silentrunners.org/ Operating System: Windows XP SP2 Output limited to non-default values, except where indicated by “{++}” Startup items buried in registry: --------------------------------- HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ {++} “CTFMON.EXE” = “C:\WINDOWS\system32\ctfmon.exe” [MS] “Warez” = ““C:\Program Files\Warez\Warez.exe” /minimized” [file not found] “WinMedia” = “winntdll15190375.exe” [null data] HKLM\Software\Microsoft\Windows\CurrentVersion\Run\ {++} “SoundMan” = “SOUNDMAN.EXE” [“Realtek Semiconductor Corp.”] “ATIPTA” = ““C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe”” [“ATI Technologies, Inc.”] “NeroFilterCheck” = “C:\WINDOWS\system32\NeroCheck.exe” [“Ahead Software Gmbh”] “WinampAgent” = “C:\Program Files\Winamp\winampa.exe” [null data] “WOOWATCH” = “C:\PROGRA~1\Wanadoo\Watch.exe” [“France Télécom R&D”] “WOOTASKBARICON” = “C:\PROGRA~1\Wanadoo\TaskbarIcon.exe” [“France Télécom R&D”] “TkBellExe” = ““C:\Program Files\Common Files\Real\Update_OB\realsched.exe” -osboot” [“RealNetworks, Inc.”] “DAEMON Tools” = ““C:\Program Files\DAEMON Tools\daemon.exe” -lang 1033” [“DT Soft Ltd.”] “REGSHAVE” = “C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN” [“FUJI PHOTO FILM CO., LTD.”] “SunJavaUpdateSched” = “C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe” [“Sun Microsystems, Inc.”] “Anti Trojan Elite” = “C:\Program Files\Anti Trojan Elite\TJEnder.exe :NO” [file not found] “AnyDVD” = “C:\Program Files\SlySoft\AnyDVD\AnyDVD.exe” [“SlySoft, Inc.”] “avast!” = “C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe” [null data] “QuickTime Task” = ““C:\Program Files\QuickTime\qttask.exe” -atboottime” [“Apple Computer, Inc.”] “cFosSpeed” = “C:\Program Files\cFosSpeed\cFosSpeed.exe” [“cFos Software GmbH”] “Windows Update Notifier” = ““C:\WINDOWS\system32\winalert.exe”” [file not found] HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx\001\ {++} “bfurunonceex” = “||C:\fixwareout\SUB\BFU.exe C:\fixwareout\SUB\XP-2K2.bfu” [file not found] HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}(Default) = (no title provided) -> {HKLM…CLSID} = “AcroIEHlprObj Class” \InProcServer32(Default) = “C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx” [empty string] {761497BB-D6F0-462C-B6EB-D4DAF1D92D43}(Default) = (no title provided) -> {HKLM…CLSID} = “SSVHelper Class” \InProcServer32(Default) = “C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll” [“Sun Microsystems, Inc.”] {AA58ED58-01DD-4d91-8333-CF10577473F7}(Default) = (no title provided) -> {HKLM…CLSID} = “Google Toolbar Helper” \InProcServer32(Default) = “c:\program files\google\googletoolbar.dll” [“Google Inc.”] HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\ “{42071714-76d4-11d1-8b24-00a0c9068ff3}” = “Rozszerzenie CPL kadrowania wyświetlania” -> {HKLM…CLSID} = “Rozszerzenie CPL kadrowania wyświetlania” \InProcServer32(Default) = “deskpan.dll” [file not found] “{88895560-9AA2-1069-930E-00AA0030EBC8}” = “Rozszerzenie ikony HyperTerminalu” -> {HKLM…CLSID} = “HyperTerminal Icon Ext” \InProcServer32(Default) = “C:\WINDOWS\system32\hticons.dll” [“Hilgraeve, Inc.”] “{00020D75-0000-0000-C000-000000000046}” = “Microsoft Office Outlook Desktop Icon Handler” -> {HKLM…CLSID} = “Microsoft Office Outlook” \InProcServer32(Default) = “C:\PROGRA~1\MICROS~2\OFFICE11\MLSHEXT.DLL” [MS] “{0006F045-0000-0000-C000-000000000046}” = “Microsoft Office Outlook Custom Icon Handler” -> {HKLM…CLSID} = “Rozszerzenie ikon plików programu Outlook” \InProcServer32(Default) = “C:\PROGRA~1\MICROS~2\OFFICE11\OLKFSTUB.DLL” [MS] “{42042206-2D85-11D3-8CFF-005004838597}” = “Microsoft Office HTML Icon Handler” -> {HKLM…CLSID} = (no title provided) \InProcServer32(Default) = “C:\Program Files\Microsoft Office\OFFICE11\msohev.dll” [MS] “{F0CB00CD-5A07-4D91-97F5-A8C92CDA93E4}” = “Shell Extensions for RealOne Player” -> {HKLM…CLSID} = “RealOne Player Context Menu Class” \InProcServer32(Default) = “C:\Program Files\Real\RealPlayer\rpshell.dll” [“RealNetworks, Inc.”] “{A5110426-177D-4e08-AB3F-785F10B4439C}” = “My Phones” -> {HKLM…CLSID} = “My Phones” \InProcServer32(Default) = “C:\Program Files\Sony Ericsson\Mobile\File Manager\fmgrgui.dll” [“Sony Ericsson Mobile Communications AB”] “{472083B0-C522-11CF-8763-00608CC02F24}” = “avast” -> {HKLM…CLSID} = “avast” \InProcServer32(Default) = “C:\Program Files\Alwil Software\Avast4\ashShell.dll” [“ALWIL Software”] “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” = “WinRAR shell extension” -> {HKLM…CLSID} = “WinRAR” \InProcServer32(Default) = “C:\Program Files\WinRAR\rarext.dll” [null data] HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\ “System” = (value not set) HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ <> AtiExtEvent\DLLName = “Ati2evxx.dll” [“ATI Technologies Inc.”] HKLM\Software\Classes\PROTOCOLS\Filter\ <> text/xml\CLSID = “{807553E5-5146-11D5-A672-00B0D022E945}” -> {HKLM…CLSID} = (no title provided) \InProcServer32(Default) = “C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL” [MS] HKLM\Software\Classes\Folder\shellex\ColumnHandlers\ {F9DB5320-233E-11D1-9F84-707F02C10627}(Default) = “PDF Column Info” -> {HKLM…CLSID} = “PDF Shell Extension” \InProcServer32(Default) = “C:\Program Files\Adobe\Acrobat 7.0\ActiveX\PDFShell.dll” [“Adobe Systems, Inc.”] HKLM\Software\Classes*\shellex\ContextMenuHandlers\ avast(Default) = “{472083B0-C522-11CF-8763-00608CC02F24}” -> {HKLM…CLSID} = “avast” \InProcServer32(Default) = “C:\Program Files\Alwil Software\Avast4\ashShell.dll” [“ALWIL Software”] WinRAR(Default) = “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” -> {HKLM…CLSID} = “WinRAR” \InProcServer32(Default) = “C:\Program Files\WinRAR\rarext.dll” [null data] HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\ WinRAR(Default) = “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” -> {HKLM…CLSID} = “WinRAR” \InProcServer32(Default) = “C:\Program Files\WinRAR\rarext.dll” [null data] HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\ avast(Default) = “{472083B0-C522-11CF-8763-00608CC02F24}” -> {HKLM…CLSID} = “avast” \InProcServer32(Default) = “C:\Program Files\Alwil Software\Avast4\ashShell.dll” [“ALWIL Software”] WinRAR(Default) = “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” -> {HKLM…CLSID} = “WinRAR” \InProcServer32(Default) = “C:\Program Files\WinRAR\rarext.dll” [null data] Group Policies {GPedit.msc branch and setting}: ----------------------------------------------- Note: detected settings may not have any effect. HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\ “shutdownwithoutlogon” = (REG_DWORD) hex:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| Shutdown: Allow system to be shut down without having to log on} “undockwithoutlogon” = (REG_DWORD) hex:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| Devices: Allow undock without having to log on} Active Desktop and Wallpaper: ----------------------------- Active Desktop may be disabled at this entry: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState Displayed if Active Desktop enabled and wallpaper not set by Group Policy: HKCU\Software\Microsoft\Internet Explorer\Desktop\General\ “Wallpaper” = “C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp” Displayed if Active Desktop disabled and wallpaper not set by Group Policy: HKCU\Control Panel\Desktop\ “Wallpaper” = “C:\Documents and Settings\DOM\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp” Enabled Screen Saver: --------------------- HKCU\Control Panel\Desktop\ “SCRNSAVE.EXE” = “C:\WINDOWS\system32\ssstars.scr” [MS] Startup items in “DOM” & “All Users” startup folders: ----------------------------------------------------- C:\Documents and Settings\All Users\Menu Start\Programy\Autostart “Adobe Reader Speed Launch” -> shortcut to: “C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe” [“Adobe Systems Incorporated”] “DSLMON” -> shortcut to: “C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe /W” [empty string] “VIA RAID TOOL” -> shortcut to: “C:\Program Files\VIA\RAID\raid_tool.exe” [“VIA Technologies”] Winsock2 Service Provider DLLs: ------------------------------- Namespace Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++} 000000000001\LibraryPath = “%SystemRoot%\System32\mswsock.dll” [MS] 000000000002\LibraryPath = “%SystemRoot%\System32\winrnr.dll” [MS] 000000000003\LibraryPath = “%SystemRoot%\System32\mswsock.dll” [MS] Transport Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++} 0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range: %SystemRoot%\system32\mswsock.dll [MS], 01 - 03, 06 - 19 %SystemRoot%\system32\rsvpsp.dll [MS], 04 - 05 Toolbars, Explorer Bars, Extensions: ------------------------------------ Toolbars HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\ “{2318C2B1-4965-11D4-9B18-009027A5CD4F}” -> {HKLM…CLSID} = “&Google” \InProcServer32(Default) = “c:\program files\google\googletoolbar.dll” [“Google Inc.”] HKLM\Software\Microsoft\Internet Explorer\Toolbar\ “{2318C2B1-4965-11D4-9B18-009027A5CD4F}” = (no title provided) -> {HKLM…CLSID} = “&Google” \InProcServer32(Default) = “c:\program files\google\googletoolbar.dll” [“Google Inc.”] Explorer Bars HKLM\Software\Microsoft\Internet Explorer\Explorer Bars\ HKLM\Software\Classes\CLSID{FF059E31-CC5A-4E2E-BF3B-96E929D65503}(Default) = “&Badanie” Implemented Categories{00021493-0000-0000-C000-000000000046}\ [vertical bar] InProcServer32(Default) = “C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL” [MS] Extensions (Tools menu items, main toolbar menu buttons) HKLM\Software\Microsoft\Internet Explorer\Extensions\ {08B0E5C0-4FCB-11CF-AAA5-00401C608501}\ “MenuText” = “Sun Java Console” “CLSIDExtension” = “{CAFEEFAC-0015-0000-0006-ABCDEFFEDCBC}” -> {HKCU…CLSID} = “Java Plug-in” \InProcServer32(Default) = “C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll” [“Sun Microsystems, Inc.”] -> {HKLM…CLSID} = “Java Plug-in 1.5.0_06” \InProcServer32(Default) = “C:\Program Files\Java\jre1.5.0_06\bin\npjpi150_06.dll” [“Sun Microsystems, Inc.”] {92780B25-18CC-41C8-B9BE-3C9C571A8263}\ “ButtonText” = “Badanie” Running Services (Display Name, Service Name, Path {Service DLL}): ------------------------------------------------------------------ Ati HotKey Poller, Ati HotKey Poller, “C:\WINDOWS\system32\Ati2evxx.exe” [“ATI Technologies Inc.”] avast! Antivirus, avast! Antivirus, ““C:\Program Files\Alwil Software\Avast4\ashServ.exe”” [null data] avast! iAVS4 Control Service, aswUpdSv, ““C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe”” [null data] avast! Mail Scanner, avast! Mail Scanner, ““C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe” /service” [“ALWIL Software”] avast! Web Scanner, avast! Web Scanner, ““C:\Program Files\Alwil Software\Avast4\ashWebSv.exe” /service” [“ALWIL Software”] cFosSpeed System Service, cFosSpeedS, ““C:\Program Files\cFosSpeed\spd.exe” -service” [“cFos Software GmbH”] Machine Debug Manager, MDM, ““C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE”” [MS] Print Monitors: --------------- HKLM\System\CurrentControlSet\Control\Print\Monitors\ Microsoft Document Imaging Writer Monitor\Driver = “mdimon.dll” [MS] ---------- <>: Suspicious data at a malware launch point. + This report excludes default entries except where indicated. + To see *everywhere* the script checks and *everything* it finds, launch it from a command prompt or a shortcut with the -all parameter. + To search all directories of local fixed drives for DESKTOP.INI DLL launch points, use the -supp parameter or answer “No” at the first message box and “Yes” at the second message box. ---------- (total run time: 27 seconds, including 2 seconds for message boxes)

raport ze SmitFraudFix + raport z FixWareOut

tego nei zrobiłem bo coś sytem mi sie wolno ładował wiec sobie odpusciłem ale mam andzieje że i bez tego powiesz mi czy juz dobrze?

Bieniol · 19 Listopad 2006 18:58

Użyj obu narzędzie - KONIECZNIE

Po tym wrzuć nowe logi + raporty

michas1 · 19 Listopad 2006 19:39

ok

SmitFraudFix

SmitFraudFix v2.122 Scan done at 20:18:24,54, 2006-11-19 Run from C:\Documents and Settings\DOM\Pulpit\SmitfraudFix\SmitfraudFix OS: Microsoft Windows XP [Wersja 5.1.2600] - Windows_NT Fix run in normal mode »»»»»»»»»»»»»»»»»»»»»»»» C:\ »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32 »»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\DOM »»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\DOM\Application Data »»»»»»»»»»»»»»»»»»»»»»»» Start Menu »»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\DOM\Ulubione »»»»»»»»»»»»»»»»»»»»»»»» Desktop »»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files »»»»»»»»»»»»»»»»»»»»»»»» Corrupted keys »»»»»»»»»»»»»»»»»»»»»»»» Desktop Components [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0] “Source”=“About:Home” “SubscribedURL”=“About:Home” “FriendlyName”=“Moja bieľĄca strona g˘wna” »»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler !Attention, following keys are not inevitably infected! SrchSTS.exe by S!Ri Search SharedTaskScheduler’s .dll »»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs !Attention, following keys are not inevitably infected! [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] “AppInit_DLLs”="" »»»»»»»»»»»»»»»»»»»»»»»» pe386-msguard-lzx32 »»»»»»»»»»»»»»»»»»»»»»»» Scanning wininet.dll infection »»»»»»»»»»»»»»»»»»»»»»»» End Fixwareout Fixwareout ver 1.003 Last edited 8/11/2006 Post this report in the forums please Reg Entries that were deleted … Random Runs removed from HKLM … PLEASE NOTE, There WILL be LEGITIMATE FILES LISTED. IF YOU ARE UNSURE OF WHAT IT IS LEAVE THEM ALONE. »»»»» Searching by size/names… »»»»» Search five digit cs, dm and jb files. This WILL/CAN also list Legit Files, Submit them at Virustotal Other suspects. Directory of C:\WINDOWS\system32 {4312FB06-6D6A-4A08-ABE7-FDEB49D0FACF}.exe {47A8E47F-98EA-41B2-ACEA-9E869A53F363}.exe {04D377FA-CA15-4B74-801B-F498FFE110D6}.exe {3BEFA5F3-2C44-4014-A846-028D6CE7C13E}.exe {970B2378-AB63-4890-970A-F4685A3CCF0F}.exe {12FFBB18-F3D0-4D86-B747-0795B9EE8169}.exe {AFCE41B0-B8BF-44E4-A585-D5CB0D287B05}.exe {D681BAA9-CC9A-40D1-AD62-3AA4644DA476}.exe {0F167003-BE92-4693-A879-62BD06D98E96}.exe {E72CE1F8-4B00-4B6F-BDB0-19340355AA65}.exe {B9E012CA-7F67-4277-97F4-4AC2D05265AC}.exe {0AB89A2D-CCB1-44E0-88D0-AE5DC85EC663}.exe {3B06FE6C-92D3-4648-A7F7-8F7FFDB26870}.exe {BBFDB199-166C-41F0-81A0-76BC4867BC05}.exe {9467D5BE-BB07-4D72-A374-0205A6241DB0}.exe {53956083-D590-472F-AD74-5A33F337DA12}.exe {3FA65062-BEEF-49E7-9B24-7F1FF040F9FB}.exe {44F5CF8E-F2F6-400F-848C-94924B0C3D18}.exe {92A90759-F039-4BE7-A0B4-738563E6DF79}.exe {771D1087-A320-4231-B097-7777B3593439}.exe {D936F7FA-4908-4F60-B35D-F4406D13B979}.exe {7BA285F0-DA2B-4FB5-9865-5662F7B00B08}.exe {1B39ABA4-A2A5-4725-9EC2-CDB23FAF4FE2}.exe {0EFCD4A5-EBF0-43A8-86E2-05C43C928755}.exe {E65FDB4E-C19A-4A0A-A132-EA4A6BF0BFAD}.exe {7F7ED3CC-3698-4A69-919F-4E3523198CE2}.exe {8CBA1F0B-E58F-4B5D-9C81-525788D52115}.exe {2857351C-4B30-4F41-91F3-866C35284913}.exe {72A2EFC4-8153-43A3-96DC-7C45693511B8}.exe {3BF687D5-D98A-45E0-BAA9-408A81EE2961}.exe {B9756E34-A962-414A-9E12-DAB8263A9980}.exe {FA856135-6A0B-4F3E-BC37-3BF47EA61DE8}.exe {A0E44D42-9043-4ADA-8F86-B3E30E904C35}.exe {96C58166-6CD3-4DE1-BA16-49C7F24EEA9B}.exe {DAA82705-5CA4-499A-B7AD-B9DC7D7EE11C}.exe {DB81B860-6873-4514-BABA-56D8940BD18B}.exe {0661CB46-0A3F-4F7F-B9E0-C76C31D01849}.exe {080D6A1E-8CCC-4A01-A30F-1D199030FDC1}.exe {FB544E21-71E6-429A-B69C-D677A191872E}.exe {85B4B2A6-1618-456F-B66D-021AAD76BA17}.exe {16ABAB4D-D31D-4CA7-BD59-BA3A2594EC01}.exe {F5ECBE6C-8B09-4B77-BC9A-AB033BC45F44}.exe {F357020E-75C9-403F-BE3C-6861A32C1E46}.exe {990EF7CF-5E70-450D-A357-83BA6223957F}.exe {95B18F6F-9CBE-4665-91F6-6393CBD30E1C}.exe {C0B02363-7A4F-462E-AFEE-DD7E86FCB86E}.exe {BA25A835-1DB6-412D-BD61-C73F7D9F7CC6}.exe {790D9243-8769-47F9-AF78-C61583FC8425}.exe {ED436CC4-5C85-42D4-9B6B-A586B4033C3D}.exe {CAA9ED48-8EAA-4EC8-B4B3-3C4B5ECA24A5}.exe {34CB256F-2FAA-49D3-B362-CCDCCC813F38}.exe {89329193-2A72-4B7E-B73E-1281ECA0B279}.exe {68A5C44D-D9F8-4954-9FDE-24C90E4B1A42}.exe {468F4567-BA90-446D-A57C-E7777DCC9AA0}.exe {E8DE8B7C-A1CB-4F56-8A93-04E1AE267746}.exe {39FFFCE6-3C3D-48ED-B644-13279E463B07}.exe {CE5FEA70-00DF-468E-8013-B56F8022BAC9}.exe {9F5B6FCD-CB2B-48B1-B012-F2B9C28F6676}.exe {E692837E-E195-415A-8E90-25A5E2AE2407}.exe {176EF02A-575F-4E30-8CF7-4716827E96B7}.exe {A139F511-86A9-4A17-B6BB-2010E2C4CE81}.exe {BD869D91-9FD5-4C59-8E7E-09BCD0DD9EB0}.exe {E518879C-C290-4035-AF2E-41882B338402}.exe {052DED56-568B-4D4D-8EEF-65706E3E1906}.exe {B6EA00F5-7AB5-4D02-81DA-60085F429FDD}.exe {5839CDD9-3E48-4950-A4FA-5FF028BC70EB}.exe {AEB0F552-EBEF-4EEE-B9DD-F9DE76CF58FE}.exe {12751F34-2961-4F5D-82B6-B259B7799583}.exe {04FC86D0-77DC-4F33-9A20-6EBA935578C3}.exe {B3047AEA-4DF3-49E2-BC04-A17FDFD3EE0C}.exe {3C3969B9-2D11-401C-BBAB-BE31D288B99D}.exe {6FCA2829-C62F-457D-AD7E-F44F985A512C}.exe {49AFE71E-E51B-41AF-A147-E312FCAD433D}.exe {5354CC1D-D552-485F-BCC4-FDDEC0356C76}.exe {7D022CF9-8EA4-4FC7-86D1-54976A334960}.exe {BF82CAC9-FC41-475B-86B2-0CB598F18323}.exe {9EA5CA71-A3E2-4D5B-9583-6A0CBBC6E4F0}.exe {22682522-7CA8-4F4A-B2DD-94B7F36BBD72}.exe {25104077-3CF4-49CC-8CD0-1EE97E266ED3}.exe {6BCEC579-9F6A-4504-96CB-49E4D2FF2538}.exe {95A16C67-27F5-48FC-95E2-7F1737188917}.exe {34769765-B6B4-4449-AAC6-C7EBA1796ECD}.exe {BAEF2FBD-F84C-452A-87BD-747EE24110E5}.exe {DFF4098C-C6A5-4B2D-AD29-97EED5BFCB22}.exe {8088DAA3-6F0C-4875-A3B7-B71A8A5D87B3}.exe {22825DF3-B013-40EF-9AB9-90E24413BFB6}.exe {715AE62A-C691-4E96-9DB4-73808A70D464}.exe {A21B1DF9-07B2-4A23-84AE-7709546B0CCD}.exe {EC224042-9554-472E-9110-49CCF8826459}.exe {A2CF7AD9-EE04-4D22-B83A-EFE768EDC35B}.exe {37F3824A-EDC5-4DF1-AF34-D5E98EC2D5AA}.exe {4F31098B-3C03-482B-AB81-65C8CA6BD516}.exe {96F1C7A1-F74C-4502-84B5-0CB295954EAE}.exe {91DBDBAF-EA5E-4D6C-91A5-3DB195DB6A9F}.exe {A7A59334-0AE2-4C5B-B7D9-6D0A58F25626}.exe {FCE5210A-60E8-48BE-A843-3A1FA32546F3}.exe {58B1026A-5CC3-4F6E-B367-D586BFF14F43}.exe {83E980EC-5EBD-4D58-9889-5DDBA45B7796}.exe {EFA5C9FB-9B1E-4E32-82B4-34D67FDA405C}.exe {6DD7840C-42B3-46A9-B2EE-8941AB153784}.exe {E92D2DE5-594F-49C8-8FB0-CD325BA5F699}.exe {B1CE8E56-2237-4C94-A7F6-5CAD1ECB1DD7}.exe {1E9AD6D2-A961-4D2A-BD95-A2DBA5FBC61C}.exe {61A01BF9-C182-4AB4-A9FB-A2EC91AD59CF}.exe {7ABCC568-BF6D-474B-98AD-B73996358A63}.exe {FCD99958-0DDB-4C63-B556-B9F556BC4574}.exe {9245434C-8442-45D1-A4A0-9B5593D5A37A}.exe {9FEC770B-5391-4848-AB99-3AAB6EE2620E}.exe {20522B0A-BE27-4FC2-8BAA-3A96546A85D7}.exe {B4E70502-476E-47C9-BB2B-4743113061B1}.exe {07CE1EE9-96FC-471C-93CB-4982327EEA17}.exe {D0F34E3A-3BD0-4CBA-B9E0-ED1F138D5F0B}.exe {EFA46AB4-1A30-4F1D-9908-34DD6364834D}.exe {FEE3FABE-63CC-4D43-9521-D25D9230C78F}.exe {C8B9E3C6-75DE-482F-9DFB-FCF5DB64B8F8}.exe {42D4897B-2877-455B-8248-2FC938102BB0}.exe {102FD928-4D9B-454D-B05A-221BC540AF9C}.exe {28AC7A1A-81AC-47FC-8697-7835ADF0E423}.exe {C060FA9A-E168-4CC4-96D9-CE41DBC50E7E}.exe {7056224F-4A70-4B3B-B836-D7E87B9D5C00}.exe {229B8195-383E-4542-B067-577D49EDC2C8}.exe {C0623E16-5936-411A-961E-CC6AAB056130}.exe {A04C534B-E753-45B3-9241-250A81AF898B}.exe {4E8117B5-CEE9-480D-B930-827EB44302D3}.exe {D55D8B5A-5663-4840-B40A-BEE7397872FC}.exe {F73DEF8A-5F0C-4ACF-BFAA-18A7B5D01272}.exe {40D64AFF-256E-4E32-85C7-AD4EA400EC1E}.exe {C0C2162D-A7B7-4802-BAE7-28C27FF53BF0}.exe {B3787F5D-9646-4339-B320-0B7A269FF844}.exe {4C6DF764-041F-44A9-AE02-EC65300A051A}.exe {BA0F2B3B-098B-489D-9D9B-2B5E95178FA3}.exe {144FDB1E-0CCC-462D-AC2D-21D8B97316B3}.exe {517AB0F2-38BC-4FCD-82B9-0284F03C9EDB}.exe {7A6B840C-80EC-41ED-B142-760A7D341437}.exe {FE1B243E-E7F6-45EB-AE6D-A93CBE074D49}.exe {36D29AB9-7954-42A9-944F-0195BA8C9C4C}.exe {79219203-D38A-4D95-86E4-07A732E7D7B4}.exe {E2FCE9E9-264D-4DD3-8135-5E5BB6A7D4A6}.exe {933E8AFD-7423-4483-9FC4-C898530BCD4A}.exe {4D7DE33E-5A99-4B43-9E83-A5C0EC8223AF}.exe {5ED1B70F-C066-4002-B457-4FE8F1DC878B}.exe {366AB7A9-A4D5-4047-BBA9-B5EC1F721F8E}.exe {699E1575-E48D-4234-AD6A-5C1059F49951}.exe {0E412AA5-EDE7-45CB-AFC5-CAC9050738C2}.exe {40BF6F89-8B0E-46B3-A885-92792466A718}.exe {361F2DD1-49F9-4B3E-BF97-2DE09781D99B}.exe {59C10011-0CBC-4EBD-8930-73458571055C}.exe {E986E137-6C8F-434B-AF57-71964298312D}.exe {35AF6CC2-D21D-4782-88F7-B3F7D72A0624}.exe {70D84182-1A5F-4BDD-9564-927D16A5D3CF}.exe {B5FD7E2A-DD45-458A-A659-55EEA8535F4E}.exe »»»»» Misc files. »»»»» Checking for older varients covered by the Rem3 tool.

Gutek · 19 Listopad 2006 20:40

Wklej log z Silenta i HJT

michas1 · 20 Listopad 2006 11:03

są dwa posty wyżej

Bieniol · 20 Listopad 2006 13:41

Otwórz notatnik i wklej w nim to:

CD C:\WINDOWS\system32 DEL {4312FB06-6D6A-4A08-ABE7-FDEB49D0FACF}.exe DEL {47A8E47F-98EA-41B2-ACEA-9E869A53F363}.exe DEL {04D377FA-CA15-4B74-801B-F498FFE110D6}.exe DEL {3BEFA5F3-2C44-4014-A846-028D6CE7C13E}.exe DEL {970B2378-AB63-4890-970A-F4685A3CCF0F}.exe DEL {12FFBB18-F3D0-4D86-B747-0795B9EE8169}.exe DEL {AFCE41B0-B8BF-44E4-A585-D5CB0D287B05}.exe DEL {D681BAA9-CC9A-40D1-AD62-3AA4644DA476}.exe DEL {0F167003-BE92-4693-A879-62BD06D98E96}.exe DEL {E72CE1F8-4B00-4B6F-BDB0-19340355AA65}.exe DEL {B9E012CA-7F67-4277-97F4-4AC2D05265AC}.exe DEL {0AB89A2D-CCB1-44E0-88D0-AE5DC85EC663}.exe DEL {3B06FE6C-92D3-4648-A7F7-8F7FFDB26870}.exe DEL {BBFDB199-166C-41F0-81A0-76BC4867BC05}.exe DEL {9467D5BE-BB07-4D72-A374-0205A6241DB0}.exe DEL {53956083-D590-472F-AD74-5A33F337DA12}.exe DEL {3FA65062-BEEF-49E7-9B24-7F1FF040F9FB}.exe DEL {44F5CF8E-F2F6-400F-848C-94924B0C3D18}.exe DEL {92A90759-F039-4BE7-A0B4-738563E6DF79}.exe DEL {771D1087-A320-4231-B097-7777B3593439}.exe DEL {D936F7FA-4908-4F60-B35D-F4406D13B979}.exe DEL {7BA285F0-DA2B-4FB5-9865-5662F7B00B08}.exe DEL {1B39ABA4-A2A5-4725-9EC2-CDB23FAF4FE2}.exe DEL {0EFCD4A5-EBF0-43A8-86E2-05C43C928755}.exe DEL {E65FDB4E-C19A-4A0A-A132-EA4A6BF0BFAD}.exe DEL {7F7ED3CC-3698-4A69-919F-4E3523198CE2}.exe DEL {8CBA1F0B-E58F-4B5D-9C81-525788D52115}.exe DEL {2857351C-4B30-4F41-91F3-866C35284913}.exe DEL {72A2EFC4-8153-43A3-96DC-7C45693511B8}.exe DEL {3BF687D5-D98A-45E0-BAA9-408A81EE2961}.exe DEL {B9756E34-A962-414A-9E12-DAB8263A9980}.exe DEL {FA856135-6A0B-4F3E-BC37-3BF47EA61DE8}.exe DEL {A0E44D42-9043-4ADA-8F86-B3E30E904C35}.exe DEL {96C58166-6CD3-4DE1-BA16-49C7F24EEA9B}.exe DEL {DAA82705-5CA4-499A-B7AD-B9DC7D7EE11C}.exe DEL {DB81B860-6873-4514-BABA-56D8940BD18B}.exe DEL {0661CB46-0A3F-4F7F-B9E0-C76C31D01849}.exe DEL {080D6A1E-8CCC-4A01-A30F-1D199030FDC1}.exe DEL {FB544E21-71E6-429A-B69C-D677A191872E}.exe DEL {85B4B2A6-1618-456F-B66D-021AAD76BA17}.exe DEL {16ABAB4D-D31D-4CA7-BD59-BA3A2594EC01}.exe DEL {F5ECBE6C-8B09-4B77-BC9A-AB033BC45F44}.exe DEL {F357020E-75C9-403F-BE3C-6861A32C1E46}.exe DEL {990EF7CF-5E70-450D-A357-83BA6223957F}.exe DEL {95B18F6F-9CBE-4665-91F6-6393CBD30E1C}.exe DEL {C0B02363-7A4F-462E-AFEE-DD7E86FCB86E}.exe DEL {BA25A835-1DB6-412D-BD61-C73F7D9F7CC6}.exe DEL {790D9243-8769-47F9-AF78-C61583FC8425}.exe DEL {ED436CC4-5C85-42D4-9B6B-A586B4033C3D}.exe DEL {CAA9ED48-8EAA-4EC8-B4B3-3C4B5ECA24A5}.exe DEL {34CB256F-2FAA-49D3-B362-CCDCCC813F38}.exe DEL {89329193-2A72-4B7E-B73E-1281ECA0B279}.exe DEL {68A5C44D-D9F8-4954-9FDE-24C90E4B1A42}.exe DEL {468F4567-BA90-446D-A57C-E7777DCC9AA0}.exe DEL {E8DE8B7C-A1CB-4F56-8A93-04E1AE267746}.exe DEL {39FFFCE6-3C3D-48ED-B644-13279E463B07}.exe DEL {CE5FEA70-00DF-468E-8013-B56F8022BAC9}.exe DEL {9F5B6FCD-CB2B-48B1-B012-F2B9C28F6676}.exe DEL {E692837E-E195-415A-8E90-25A5E2AE2407}.exe DEL {176EF02A-575F-4E30-8CF7-4716827E96B7}.exe DEL {A139F511-86A9-4A17-B6BB-2010E2C4CE81}.exe DEL {BD869D91-9FD5-4C59-8E7E-09BCD0DD9EB0}.exe DEL {E518879C-C290-4035-AF2E-41882B338402}.exe DEL {052DED56-568B-4D4D-8EEF-65706E3E1906}.exe DEL {B6EA00F5-7AB5-4D02-81DA-60085F429FDD}.exe DEL {5839CDD9-3E48-4950-A4FA-5FF028BC70EB}.exe DEL {AEB0F552-EBEF-4EEE-B9DD-F9DE76CF58FE}.exe DEL {12751F34-2961-4F5D-82B6-B259B7799583}.exe DEL {04FC86D0-77DC-4F33-9A20-6EBA935578C3}.exe DEL {B3047AEA-4DF3-49E2-BC04-A17FDFD3EE0C}.exe DEL {3C3969B9-2D11-401C-BBAB-BE31D288B99D}.exe DEL {6FCA2829-C62F-457D-AD7E-F44F985A512C}.exe DEL {49AFE71E-E51B-41AF-A147-E312FCAD433D}.exe DEL {5354CC1D-D552-485F-BCC4-FDDEC0356C76}.exe DEL {7D022CF9-8EA4-4FC7-86D1-54976A334960}.exe DEL {BF82CAC9-FC41-475B-86B2-0CB598F18323}.exe DEL {9EA5CA71-A3E2-4D5B-9583-6A0CBBC6E4F0}.exe DEL {22682522-7CA8-4F4A-B2DD-94B7F36BBD72}.exe DEL {25104077-3CF4-49CC-8CD0-1EE97E266ED3}.exe DEL {6BCEC579-9F6A-4504-96CB-49E4D2FF2538}.exe DEL {95A16C67-27F5-48FC-95E2-7F1737188917}.exe DEL {34769765-B6B4-4449-AAC6-C7EBA1796ECD}.exe DEL {BAEF2FBD-F84C-452A-87BD-747EE24110E5}.exe DEL {DFF4098C-C6A5-4B2D-AD29-97EED5BFCB22}.exe DEL {8088DAA3-6F0C-4875-A3B7-B71A8A5D87B3}.exe DEL {22825DF3-B013-40EF-9AB9-90E24413BFB6}.exe DEL {715AE62A-C691-4E96-9DB4-73808A70D464}.exe DEL {A21B1DF9-07B2-4A23-84AE-7709546B0CCD}.exe DEL {EC224042-9554-472E-9110-49CCF8826459}.exe DEL {A2CF7AD9-EE04-4D22-B83A-EFE768EDC35B}.exe DEL {37F3824A-EDC5-4DF1-AF34-D5E98EC2D5AA}.exe DEL {4F31098B-3C03-482B-AB81-65C8CA6BD516}.exe DEL {96F1C7A1-F74C-4502-84B5-0CB295954EAE}.exe DEL {91DBDBAF-EA5E-4D6C-91A5-3DB195DB6A9F}.exe DEL {A7A59334-0AE2-4C5B-B7D9-6D0A58F25626}.exe DEL {FCE5210A-60E8-48BE-A843-3A1FA32546F3}.exe DEL {58B1026A-5CC3-4F6E-B367-D586BFF14F43}.exe DEL {83E980EC-5EBD-4D58-9889-5DDBA45B7796}.exe DEL {EFA5C9FB-9B1E-4E32-82B4-34D67FDA405C}.exe DEL {6DD7840C-42B3-46A9-B2EE-8941AB153784}.exe DEL {E92D2DE5-594F-49C8-8FB0-CD325BA5F699}.exe DEL {B1CE8E56-2237-4C94-A7F6-5CAD1ECB1DD7}.exe DEL {1E9AD6D2-A961-4D2A-BD95-A2DBA5FBC61C}.exe DEL {61A01BF9-C182-4AB4-A9FB-A2EC91AD59CF}.exe DEL {7ABCC568-BF6D-474B-98AD-B73996358A63}.exe DEL {FCD99958-0DDB-4C63-B556-B9F556BC4574}.exe DEL {9245434C-8442-45D1-A4A0-9B5593D5A37A}.exe DEL {9FEC770B-5391-4848-AB99-3AAB6EE2620E}.exe DEL {20522B0A-BE27-4FC2-8BAA-3A96546A85D7}.exe DEL {B4E70502-476E-47C9-BB2B-4743113061B1}.exe DEL {07CE1EE9-96FC-471C-93CB-4982327EEA17}.exe DEL {D0F34E3A-3BD0-4CBA-B9E0-ED1F138D5F0B}.exe DEL {EFA46AB4-1A30-4F1D-9908-34DD6364834D}.exe DEL {FEE3FABE-63CC-4D43-9521-D25D9230C78F}.exe DEL {C8B9E3C6-75DE-482F-9DFB-FCF5DB64B8F8}.exe DEL {42D4897B-2877-455B-8248-2FC938102BB0}.exe DEL {102FD928-4D9B-454D-B05A-221BC540AF9C}.exe DEL {28AC7A1A-81AC-47FC-8697-7835ADF0E423}.exe DEL {C060FA9A-E168-4CC4-96D9-CE41DBC50E7E}.exe DEL {7056224F-4A70-4B3B-B836-D7E87B9D5C00}.exe DEL {229B8195-383E-4542-B067-577D49EDC2C8}.exe DEL {C0623E16-5936-411A-961E-CC6AAB056130}.exe DEL {A04C534B-E753-45B3-9241-250A81AF898B}.exe DEL {4E8117B5-CEE9-480D-B930-827EB44302D3}.exe DEL {D55D8B5A-5663-4840-B40A-BEE7397872FC}.exe DEL {F73DEF8A-5F0C-4ACF-BFAA-18A7B5D01272}.exe DEL {40D64AFF-256E-4E32-85C7-AD4EA400EC1E}.exe DEL {C0C2162D-A7B7-4802-BAE7-28C27FF53BF0}.exe DEL {B3787F5D-9646-4339-B320-0B7A269FF844}.exe DEL {4C6DF764-041F-44A9-AE02-EC65300A051A}.exe DEL {BA0F2B3B-098B-489D-9D9B-2B5E95178FA3}.exe DEL {144FDB1E-0CCC-462D-AC2D-21D8B97316B3}.exe DEL {517AB0F2-38BC-4FCD-82B9-0284F03C9EDB}.exe DEL {7A6B840C-80EC-41ED-B142-760A7D341437}.exe DEL {FE1B243E-E7F6-45EB-AE6D-A93CBE074D49}.exe DEL {36D29AB9-7954-42A9-944F-0195BA8C9C4C}.exe DEL {79219203-D38A-4D95-86E4-07A732E7D7B4}.exe DEL {E2FCE9E9-264D-4DD3-8135-5E5BB6A7D4A6}.exe DEL {933E8AFD-7423-4483-9FC4-C898530BCD4A}.exe DEL {4D7DE33E-5A99-4B43-9E83-A5C0EC8223AF}.exe DEL {5ED1B70F-C066-4002-B457-4FE8F1DC878B}.exe DEL {366AB7A9-A4D5-4047-BBA9-B5EC1F721F8E}.exe DEL {699E1575-E48D-4234-AD6A-5C1059F49951}.exe DEL {0E412AA5-EDE7-45CB-AFC5-CAC9050738C2}.exe DEL {40BF6F89-8B0E-46B3-A885-92792466A718}.exe DEL {361F2DD1-49F9-4B3E-BF97-2DE09781D99B}.exe DEL {59C10011-0CBC-4EBD-8930-73458571055C}.exe DEL {E986E137-6C8F-434B-AF57-71964298312D}.exe DEL {35AF6CC2-D21D-4782-88F7-B3F7D72A0624}.exe DEL {70D84182-1A5F-4BDD-9564-927D16A5D3CF}.exe DEL {B5FD7E2A-DD45-458A-A659-55EEA8535F4E}.exe

Plik -> zapisz jako -> zmień rozszerzenie na wszystkie pliki -> zapisz pod nazwą FIX.BAT

W trybie awaryjnym odpal plik FIX.BAT i restart kompa

Po zabiegach wklejasz nowe logi