Rozłączanie internetu

DGE · 21 Maj 2007 09:13

Witam,czasem bez przyczyny odłącza mi neta (mam neostrade , bez aplikacji neo tylko AutoConnect) być może to jakiś syf na kompie :

Logfile of HijackThis v1.99.1 Scan saved at 11:11:15, on 2007-05-21 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\windows\System32\smss.exe C:\windows\system32\csrss.exe C:\windows\system32\winlogon.exe C:\windows\system32\services.exe C:\windows\system32\lsass.exe C:\windows\system32\svchost.exe C:\windows\system32\svchost.exe C:\windows\System32\svchost.exe C:\windows\system32\svchost.exe C:\windows\system32\svchost.exe C:\windows\system32\spoolsv.exe C:\windows\system32\wscntfy.exe C:\windows\Explorer.EXE C:\windows\System32\alg.exe C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe C:\Program Files\Gadu-Gadu\gg.exe C:\Program Files\Winamp\winamp.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\p\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://9dragons.acclaim.com/ R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\NEOSTR~1\SEARCH~1.DLL (file missing) O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O2 - BHO: Kwyshell MidpX BHO - {EBE9E2B5-B526-48BC-AD46-687263EDCB0E} - C:\Program Files\Kwyshell\MidpX\JadInvoker\MidpInvoker.dll O3 - Toolbar: Kwyshell MidpX - {EBE9E2B5-B526-48BC-AD46-687263EDCB0E} - C:\Program Files\Kwyshell\MidpX\JadInvoker\MidpInvoker.dll O4 - HKLM…\Run: [skyTel] SkyTel.EXE O4 - HKLM…\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM…\Run: [nwiz] nwiz.exe /install O4 - HKLM…\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKCU…\Run: [AutoConnect] C:\Program Files\AutoConnect\AutoConnect.exe O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe O8 - Extra context menu item: Download all with Free Download Manager - file://C:\Program Files\Free Download Manager\dlall.htm O8 - Extra context menu item: Download selected with Free Download Manager - file://C:\Program Files\Free Download Manager\dlselected.htm O8 - Extra context menu item: Download with Free Download Manager - file://C:\Program Files\Free Download Manager\dllink.htm O8 - Extra context menu item: Link to &MidpX - C:\Program Files\Kwyshell\MidpX\JadInvoker\Extent\jad_wrap.htm O8 - Extra context menu item: Pobierz w Free Download Manager - file://C:\Program Files\Free Download Manager\dllink.htm O8 - Extra context menu item: Pobierz wszystkie pliki w Free Download Manager - file://C:\Program Files\Free Download Manager\dlall.htm O8 - Extra context menu item: Pobierz zaznaczone w Free Download Manager - file://C:\Program Files\Free Download Manager\dlselected.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra ‘Tools’ menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra ‘Tools’ menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {69EF49E5-FE46-4B92-B5FA-2193AB7A6B8A} (GameLauncher Control) - http://www.acclaim.com/cabs/acclaim_v4.cab O16 - DPF: {92ECE6FA-AC2E-4042-BFAE-0C8608E52A43} (SignActivX Control) - https://www.bph.pl/pi/components/SignActivX.cab O17 - HKLM\System\CCS\Services\Tcpip…{64995ABA-9881-4E1E-ACE7-9C182D1EAF87}: NameServer = 194.204.159.1 217.98.63.164 O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - “C:\PROGRA~1\MSNMES~1\msgrapp.dll” (file missing) O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\windows\system32\nvsvc32.exe

“Silent Runners.vbs”, revision 49, http://www.silentrunners.org/ Operating System: Windows XP SP2 Output limited to non-default values, except where indicated by “{++}” Startup items buried in registry: --------------------------------- HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ {++} “AutoConnect” = “C:\Program Files\AutoConnect\AutoConnect.exe” [“http://autoconnect.prv.pl”] HKLM\Software\Microsoft\Windows\CurrentVersion\Run\ {++} “SkyTel” = “SkyTel.EXE” [“Realtek Semiconductor Corp.”] “NvCplDaemon” = “RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup” [MS] “nwiz” = “nwiz.exe /install” [“NVIDIA Corporation”] “NeroFilterCheck” = “C:\WINDOWS\system32\NeroCheck.exe” [“Ahead Software Gmbh”] HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ {761497BB-D6F0-462C-B6EB-D4DAF1D92D43}(Default) = (no title provided) -> {HKLM…CLSID} = “SSVHelper Class” \InProcServer32(Default) = “C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll” [“Sun Microsystems, Inc.”] {EBE9E2B5-B526-48BC-AD46-687263EDCB0E}(Default) = “Kwyshell MidpX BHO” -> {HKLM…CLSID} = “Kwyshell MidpX” \InProcServer32(Default) = “C:\Program Files\Kwyshell\MidpX\JadInvoker\MidpInvoker.dll” [“Kwyshell G.Corp”] HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\ “{42071714-76d4-11d1-8b24-00a0c9068ff3}” = “Rozszerzenie CPL kadrowania wyświetlania” -> {HKLM…CLSID} = “Rozszerzenie CPL kadrowania wyświetlania” \InProcServer32(Default) = “deskpan.dll” [file not found] “{88895560-9AA2-1069-930E-00AA0030EBC8}” = “Rozszerzenie ikony HyperTerminalu” -> {HKLM…CLSID} = “HyperTerminal Icon Ext” \InProcServer32(Default) = “C:\WINDOWS\system32\hticons.dll” [“Hilgraeve, Inc.”] “{A70C977A-BF00-412C-90B7-034C51DA2439}” = “NvCpl DesktopContext Class” -> {HKLM…CLSID} = “DesktopContext Class” \InProcServer32(Default) = “C:\WINDOWS\system32\nvcpl.dll” [“NVIDIA Corporation”] “{FFB699E0-306A-11d3-8BD1-00104B6F7516}” = “Play on my TV helper” -> {HKLM…CLSID} = “NVIDIA CPL Extension” \InProcServer32(Default) = “C:\WINDOWS\system32\nvcpl.dll” [“NVIDIA Corporation”] “{1CDB2949-8F65-4355-8456-263E7C208A5D}” = “Desktop Explorer” -> {HKLM…CLSID} = “Desktop Explorer” \InProcServer32(Default) = “C:\WINDOWS\system32\nvshell.dll” [“NVIDIA Corporation”] “{1E9B04FB-F9E5-4718-997B-B8DA88302A47}” = “Desktop Explorer Menu” -> {HKLM…CLSID} = (no title provided) \InProcServer32(Default) = “C:\WINDOWS\system32\nvshell.dll” [“NVIDIA Corporation”] “{1E9B04FB-F9E5-4718-997B-B8DA88302A48}” = “nView Desktop Context Menu” -> {HKLM…CLSID} = “nView Desktop Context Menu” \InProcServer32(Default) = “C:\WINDOWS\system32\nvshell.dll” [“NVIDIA Corporation”] “{F0CB00CD-5A07-4D91-97F5-A8C92CDA93E4}” = “Shell Extensions for RealOne Player” -> {HKLM…CLSID} = “RealOne Player Context Menu Class” \InProcServer32(Default) = “C:\Program Files\Real\RealPlayer\rpshell.dll” [“RealNetworks, Inc.”] “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” = “WinRAR shell extension” -> {HKLM…CLSID} = “WinRAR” \InProcServer32(Default) = “C:\Program Files\WRaR\rarext.dll” [null data] “{B7056B8E-4F99-44f8-8CBD-282390FE5428}” = “VirtualCloneDrive” -> {HKLM…CLSID} = “VirtualCloneDrive Shell Extension” \InProcServer32(Default) = “C:\Program Files\Elaborate Bytes\VirtualCloneDrive\ElbyVCDShell.dll” [“Elaborate Bytes AG”] HKLM\Software\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\ “WPDShServiceObj” = “{AAA288BA-9A4C-45B0-95D7-94D524869DB5}” -> {HKLM…CLSID} = “WPDShServiceObj Class” \InProcServer32(Default) = “C:\WINDOWS\system32\WPDShServiceObj.dll” [MS] HKLM\Software\Classes*\shellex\ContextMenuHandlers\ WinRAR(Default) = “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” -> {HKLM…CLSID} = “WinRAR” \InProcServer32(Default) = “C:\Program Files\WRaR\rarext.dll” [null data] HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\ WinRAR(Default) = “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” -> {HKLM…CLSID} = “WinRAR” \InProcServer32(Default) = “C:\Program Files\WRaR\rarext.dll” [null data] HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\ WinRAR(Default) = “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” -> {HKLM…CLSID} = “WinRAR” \InProcServer32(Default) = “C:\Program Files\WRaR\rarext.dll” [null data] Group Policies {GPedit.msc branch and setting}: ----------------------------------------------- Note: detected settings may not have any effect. HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System\ “DisableRegistryTools” = (REG_DWORD) hex:0x00000000 {User Configuration|Administrative Templates|System| Prevent access to registry editing tools} HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\ “shutdownwithoutlogon” = (REG_DWORD) hex:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| Shutdown: Allow system to be shut down without having to log on} “undockwithoutlogon” = (REG_DWORD) hex:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| Devices: Allow undock without having to log on} Active Desktop and Wallpaper: ----------------------------- Active Desktop may be disabled at this entry: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState Displayed if Active Desktop enabled and wallpaper not set by Group Policy: HKCU\Software\Microsoft\Internet Explorer\Desktop\General\ “Wallpaper” = “%APPDATA%\Mozilla\Firefox\Tapeta pulpitu.bmp” Displayed if Active Desktop disabled and wallpaper not set by Group Policy: HKCU\Control Panel\Desktop\ “Wallpaper” = “C:\Documents and Settings\lukasz\Dane aplikacji\Mozilla\Firefox\Tapeta pulpitu.bmp” Startup items in “lukasz” & “All Users” startup folders: -------------------------------------------------------- C:\Documents and Settings\All Users\Menu Start\Programy\Autostart “DSLMON” -> shortcut to: “C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe /W” [empty string] Winsock2 Service Provider DLLs: ------------------------------- Namespace Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++} 000000000001\LibraryPath = “%SystemRoot%\System32\mswsock.dll” [MS] 000000000002\LibraryPath = “%SystemRoot%\System32\winrnr.dll” [MS] 000000000003\LibraryPath = “%SystemRoot%\System32\mswsock.dll” [MS] Transport Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++} 0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range: %SystemRoot%\system32\mswsock.dll [MS], 01 - 04, 07 - 18 %SystemRoot%\system32\rsvpsp.dll [MS], 05 - 06 Toolbars, Explorer Bars, Extensions: ------------------------------------ Toolbars HKCU\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ “{EBE9E2B5-B526-48BC-AD46-687263EDCB0E}” -> {HKLM…CLSID} = “Kwyshell MidpX” \InProcServer32(Default) = “C:\Program Files\Kwyshell\MidpX\JadInvoker\MidpInvoker.dll” [“Kwyshell G.Corp”] HKLM\Software\Microsoft\Internet Explorer\Toolbar\ “{EBE9E2B5-B526-48BC-AD46-687263EDCB0E}” = “Kwyshell MidpX” -> {HKLM…CLSID} = “Kwyshell MidpX” \InProcServer32(Default) = “C:\Program Files\Kwyshell\MidpX\JadInvoker\MidpInvoker.dll” [“Kwyshell G.Corp”] Extensions (Tools menu items, main toolbar menu buttons) HKLM\Software\Microsoft\Internet Explorer\Extensions\ {08B0E5C0-4FCB-11CF-AAA5-00401C608501}\ “MenuText” = “Sun Java Console” “CLSIDExtension” = “{CAFEEFAC-0015-0000-0006-ABCDEFFEDCBC}” -> {HKCU…CLSID} = “Java Plug-in” \InProcServer32(Default) = “C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll” [“Sun Microsystems, Inc.”] -> {HKLM…CLSID} = “Java Plug-in 1.5.0_06” \InProcServer32(Default) = “C:\Program Files\Java\jre1.5.0_06\bin\npjpi150_06.dll” [“Sun Microsystems, Inc.”] {FB5F1910-F110-11D2-BB9E-00C04F795683}\ “ButtonText” = “Messenger” “MenuText” = “Windows Messenger” “Exec” = “C:\Program Files\Messenger\msmsgs.exe” [MS] Miscellaneous IE Hijack Points ------------------------------ HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks\ <> “{08C06D61-F1F3-4799-86F8-BE1A89362C85}” = (no title provided) -> {HKLM…CLSID} = “Search Class” \InProcServer32(Default) = “C:\PROGRA~1\NEOSTR~1\SEARCH~1.DLL” [file not found] Print Monitors: --------------- HKLM\System\CurrentControlSet\Control\Print\Monitors\ EPSON V6 Monitor4SA\Driver = “EBPMON24.DLL” [“SEIKO EPSON CORPORATION”] ---------- <>: Suspicious data at a browser hijack point. + This report excludes default entries except where indicated. + To see *everywhere* the script checks and *everything* it finds, launch it from a command prompt or a shortcut with the -all parameter. + To search all directories of local fixed drives for DESKTOP.INI DLL launch points, use the -supp parameter or answer “No” at the first message box and “Yes” at the second message box. ---------- (total run time: 18 seconds, including 2 seconds for message boxes)

xeth · 21 Maj 2007 10:27

nie znam się za bardzo na logach ale widze że nie masz antyvira ani firewalla

DGE · 21 Maj 2007 10:40

firewalla mam systemowego i mi starczy :]

xeth · 21 Maj 2007 11:21

odpowiem ci tak jakiś miesiąc temu nudzilo mi się bardzo wiec zainstalowałem sobie vmware i odpaliłem na nim windowsa korzystałem z niego przez 4 dni bez żadnych zabezpieczeń i wyglądało ze wszystko jest w porządku dopuki nie spojrzałem na wykorzystanie łacza caly czas cos wysyłał i odbierał wrzuciłem mu antyvirka który wykrył 7 virusów potem atyspyware wykrył 5 zagrozen wnioski wyciagnij sam

Gutek · 21 Maj 2007 14:06

OT-y kosz

Logi czyste, daj jeszcze log z Combofix

DGE · 21 Maj 2007 14:55

gutek chlopie przez te twoje combofix to malo co zawalu nie dostalem , musialem przywrocic system zeby bylo tak jak wczoraj , net mi sie wylaczal 3 minuty po restarcie “windows host public generic 32” sie pojawialo , kiedys tez to mialem ale wlaczylem windowsowy firewall i pomagalo a teraz to nawet firewalla wlaczyc nie moglem m wogole kompozycja pulpitu padla tez , ale juz chyba ok jest po przywroceniu , a tu masz te cholerne logi

“lukasz” - 2007-05-21 16:25:31 Dodatek Service Pack 2 ComboFix 07-05.21.6.V - Running from: “C:\Documents and Settings\lukasz\Pulpit” (((((((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) C:\windows\NDNuninstall6_38.exe C:\windows\NDNuninstall7_22.exe C:\Program Files\DITel\dolnoslaskie2007\images\html\wg\laura_2273939_pliki_desktop.ini ((((((((((((((((((((((((((((((( Files Created from 2007-04-05 to 2007-05-21 )))))))))))))))))))))))))))))))))) 2007-05-21 11:50 3,972 --------- C:\WINDOWS\system32\drivers\PciBus.sys 2007-05-21 11:50 21,664 --a------ C:\WINDOWS\system32\drivers\Entech.sys 2007-05-21 11:50 2007-05-21 11:49 2007-05-20 00:00 2007-05-17 19:30 2007-05-17 19:27 94,208 --a------ C:\WINDOWS\system32\China.dll 2007-05-17 19:27 2007-05-15 08:03 86,016 --a------ C:\WINDOWS\system32\OpenAL32.dll 2007-05-15 08:03 413,696 --a------ C:\WINDOWS\system32\wrap_oal.dll 2007-05-15 08:03 2007-05-15 08:02 2007-05-12 06:35 2007-05-07 20:04 2007-05-06 16:02 2007-05-05 23:21 2007-05-05 14:19 2007-05-02 12:26 2007-04-30 17:57 73,216 --a------ C:\WINDOWS\ST6UNST.EXE 2007-04-30 17:57 249,856 --------- C:\WINDOWS\Setup1.exe 2007-04-28 00:34 2007-04-27 12:46 2007-04-27 12:43 106,496 --a------ C:\WINDOWS\system32\FPXS2Pro.dll 2007-04-27 12:43 2007-04-27 12:42 81,924 --------- C:\WINDOWS\system32\drivers\VC4CB104.SYS 2007-04-27 12:42 69,632 --------- C:\WINDOWS\system32\FREGSHEX.DLL 2007-04-27 12:42 65,536 --------- C:\WINDOWS\system32\FINFCHECK.dll 2007-04-27 12:42 45,056 --------- C:\WINDOWS\system32\FINFCOPY.dll 2007-04-27 12:42 45,056 --------- C:\WINDOWS\system32\FCLKBTN.DLL 2007-04-27 12:42 274,432 --a------ C:\WINDOWS\system32\FFTIFF16.dll 2007-04-27 12:42 155,648 --a------ C:\WINDOWS\system32\FFRAFLIB.DLL 2007-04-27 12:42 2007-04-27 12:42 2007-04-25 11:15 2007-04-25 11:14 2007-04-23 18:37 (((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))) 2007-05-21 13:28:46 -------- d-----w C:\Program Files\eMule 2007-05-21 11:18:57 -------- d-----w C:\Program Files\AutoConnect 2007-05-21 11:02:18 -------- d-----w C:\DOCUME~1\lukasz\DANEAP~1\Skype 2007-05-21 09:49:42 -------- d–h--w C:\Program Files\InstallShield Installation Information 2007-05-17 22:41:10 -------- d-----w C:\Program Files\SubEdit-Player 2007-05-17 20:59:27 -------- d-----w C:\Program Files\Techland 2007-05-16 17:55:12 -------- d-----w C:\DOCUME~1\lukasz\DANEAP~1\SopCast 2007-05-15 05:59:38 -------- d-----w C:\DOCUME~1\lukasz\DANEAP~1\Free Download Manager 2007-05-14 21:39:20 -------- d-----w C:\Program Files\Skispringen 2007 2007-05-12 13:34:36 -------- d-----w C:\Program Files\Empire Interactive 2007-05-09 10:23:52 -------- d-----w C:\Program Files\Silkroad 2007-05-07 18:26:37 -------- d-----w C:\Program Files\Mafia 2007-05-06 08:00:50 2,560 ----a-w C:\windows\system32\BitCometRes.dll 2007-04-28 21:05:06 -------- d-----w C:\Program Files\SopCast 2007-04-25 09:16:16 79,606 ----a-w C:\windows\system32\perfc015.dat 2007-04-25 09:16:16 457,574 ----a-w C:\windows\system32\perfh015.dat 2007-04-20 11:43:18 -------- d-----w C:\Program Files\Gadu-Gadu 2007-04-17 11:45:20 -------- d-----w C:\Program Files\Codemasters 2007-04-16 17:44:38 -------- d-----w C:\Program Files\Infogrames 2007-04-16 07:51:22 -------- d-----w C:\Program Files\Sega 2007-04-15 15:32:23 -------- d-----w C:\Program Files\MotoRacer3 2007-04-15 11:20:32 720,896 ----a-w C:\windows\iun6002.exe 2007-04-14 19:11:57 -------- d-----w C:\Program Files\WarRock 2007-04-14 16:00:34 -------- d-----w C:\Program Files\Electronic Arts 2007-04-08 17:40:44 -------- d-----w C:\DOCUME~1\lukasz\DANEAP~1\Command & Conquer 3 Tiberium Wars 2007-04-07 22:57:43 163,644 ----a-w C:\windows\system32\drivers\secdrv.sys 2007-04-04 18:18:18 -------- d-----w C:\Program Files\Auran 2007-03-30 14:42:33 -------- d-----w C:\Program Files\Elaborate Bytes 2007-03-28 08:41:40 -------- d-----w C:\Program Files\Creative 2007-03-28 07:30:57 -------- d-----w C:\Program Files\THQ 2007-03-27 09:58:20 108,144 ----a-w C:\windows\system32\CmdLineExt.dll 2007-03-19 09:07:52 -------- d-----w C:\Program Files\AGEIA Technologies 2007-03-19 09:07:29 -------- d-----w C:\Program Files\Common Files\Wise Installation Wizard 2007-03-16 12:36:22 -------- d–h--r C:\DOCUME~1\lukasz\DANEAP~1\SecuROM 2007-03-16 12:34:19 -------- d-----w C:\Program Files\DAEMON Tools 2007-03-16 12:07:22 -------- d-----w C:\Program Files\Atari 2007-03-15 22:39:19 -------- d-----w C:\DOCUME~1\lukasz\DANEAP~1\Media Player Classic 2007-03-15 21:47:36 -------- d-----w C:\Program Files\K-Lite Codec Pack 2007-03-13 08:10:13 -------- d-----w C:\Program Files\Ubisoft 2007-03-10 17:34:54 -------- d-----w C:\DOCUME~1\lukasz\DANEAP~1\SecondLife 2007-03-09 20:25:16 -------- d-----w C:\Program Files\EA GAMES 2007-03-08 16:44:31 -------- d-----w C:\DOCUME~1\lukasz\DANEAP~1\Real 2007-03-07 21:53:53 271,360 ----a-w C:\windows\system32\drivers\atksgt.sys 2007-03-07 21:53:53 18,048 ----a-w C:\windows\system32\drivers\lirsgt.sys 2007-03-07 19:05:21 1,831 ----a-w C:\windows\system32\sdbackup.reg 2007-02-21 20:00:28 10,752 ----a-w C:\windows\system32\ff_vfw.dll 2007-02-11 18:56:56 219,648 ----a-w C:\windows\system32\uxtheme.dll 2007-02-05 18:16:52 14,708 -c–a-w C:\windows\mozver.dat (((((((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects] {761497BB-D6F0-462C-B6EB-D4DAF1D92D43}=C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll [2005-11-10 13:22] {EBE9E2B5-B526-48BC-AD46-687263EDCB0E}=C:\Program Files\Kwyshell\MidpX\JadInvoker\MidpInvoker.dll [2004-12-03 05:14] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “SkyTel”=“SkyTel.EXE” [] “NvCplDaemon”=“C:\WINDOWS\system32\NvCpl.dll” [2006-08-11 21:43] “nwiz”=“nwiz.exe” [2006-08-11 21:43 C:\WINDOWS\system32\nwiz.exe] “NeroFilterCheck”=“C:\WINDOWS\system32\NeroCheck.exe” [2001-07-09 11:50] “NvMediaCenter”=“NvMCTray.dll” [2006-08-11 21:43 C:\WINDOWS\system32\nvmctray.dll] “MSConfig”=“C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe” [2004-08-04 00:44] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “AutoConnect”=“C:\Program Files\AutoConnect\AutoConnect.exe” [2004-08-28 20:27] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Exif Launcher.lnk] path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Exif Launcher.lnk backup=C:\WINDOWS\pss\Exif Launcher.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CloneDVDElbyDelay] “C:\Program Files\Elaborate Bytes\CloneDVD\ElbyCheck.exe” /L ElbyDelay [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools] “C:\Program Files\DAEMON Tools\daemon.exe” -lang 1033 [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EA Core] “C:\Program Files\Electronic Arts\EA Link\Core.exe” -silent [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EPSON Stylus C45 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I3T1.EXE /P23 “EPSON Stylus C45 Series” /O6 “USB001” /M “Stylus C45” [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Gadu-Gadu] “C:\program files\gadu-gadu\StrongGG.exe” /tray [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\I downloaded pirated Software from P2P] Tiger Woods PGA Tour Golf 2007 [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\REGSHAVE] C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RelevantKnowledge] C:\windows\system32\rlvknlg.exe -boot [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RTHDCPL] RTHDCPL.EXE [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe] “C:\Program Files\Common Files\Real\Update_OB\realsched.exe” -osboot [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VirtualCloneDrive] “C:\Program Files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe” /s [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VS Online] “C:\Program Files\VS Online\VSOnline.exe” /tray [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows Services] “C:\Program Files\svchosts.exe” [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2{73c8c68f-832a-11db-b4a1-4d6564696130}] AutoRun\command- F:\Autorun.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2{cc80fca0-d33e-11db-b4da-4d6564696130}] AutoRun\command- E:\start.exe *Newly Created Service* -PROCEXP90 ******************************************************************** catchme 0.3.660 W2K/XP/Vista - userland rootkit detector by Gmer, http://www.gmer.net Rootkit scan 2007-05-21 16:28:32 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes … scanning hidden autostart entries … scanning hidden files … scan completed successfully hidden files: 0 ******************************************************************** Completion time: 2007-05-21 16:28:47 C:\ComboFix-quarantined-files.txt … 2007-05-21 16:28 — E O F —

Gutek · 21 Maj 2007 15:24

Otwórz Notatnik i wklej w nim to:

Plik >>> Zapisz jako >>> Ustaw rozszerzenie z TXT na Wszystkie pliki >>> zapisz pod nazwą FIX.REG >>> kliknij podwójnie zrobiony plik i potwierdź >>> reset kompa

Gdyby nie Combo nie pozbylbyś sie syfu

DGE · 21 Maj 2007 15:32

ale ja chyba nie usunalem , jak zrobilem przywracanie systemu …

a to co mam wkleić to co to jest ?? znowu beda takie problemy jak przy combo ?

Gutek · 21 Maj 2007 16:56

Zobacz czy masz te pliki, jak są usuń

DGE · 21 Maj 2007 17:18

usunięte …

ponawiam pytanie

Gutek · 21 Maj 2007 17:21

Jeżeli usunięte o już Ok