TrojanDownloader.XS, czarna tapeta, brak Menażdzera zadan

RMI · 17 Grudzień 2007 23:36

No i stalo sie bardzo dlugo mi komp smigal bez zarzutów az tu nagle … ;/

Objawy:

nie moge otworzyc Menazdera Zadan Windows
otwierająca sie co jakis czas strona z DioCleaner’em
“smieszne pliki” w C:\Windows oraz w C:\Windows\System32
odswiezający sie co chwile sam pulpit

Dodam tylko ze szuaklem sterowników do k dzwiekowej … i od tamtego czasu sie zjepsuło

Logfile of HijackThis v1.99.1 Scan saved at 00:29:35, on 2007-12-18 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\lpcywinp.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\RunDLL32.exe C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe C:\Program Files\HP\HP Software Update\HPWuSchd2.exe C:\Program Files\PWN\Definicje\Bin\Starter.exe C:\Program Files\NOD32\nod32kui.exe C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe C:\Program Files\NOD32\nod32krn.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe C:\WINDOWS\system32\wscntfy.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe C:\Documents and Settings\ok\Pulpit\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.pl/ R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\lpcywinp.exe,C:\WINDOWS\system32\userinit.exe O2 - BHO: (no name) - {00000000-d9e3-4bc6-a0bd-3d0ca4be5271} - (no file) O2 - BHO: (no name) - {00000012-890e-4aac-afd9-eff6954a34dd} - (no file) O2 - BHO: (no name) - {029e02f0-a0e5-4b19-b958-7bf2db29fb13} - (no file) O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {06dfedaa-6196-11d5-bfc8-00508b4a487d} - (no file) O2 - BHO: (no name) - {12F02779-6D88-4958-8AD3-83C12D86ADC7} - (no file) O2 - BHO: (no name) - {1adbcce8-cf84-441e-9b38-afc7a19c06a4} - (no file) O2 - BHO: (no name) - {2d7cb618-cc1c-4126-a7e3-f5b12d3bcf71} - (no file) O2 - BHO: (no name) - {477840F3-BA52-44D9-8E41-38D61CAA010F} - (no file) O2 - BHO: (no name) - {51641ef3-8a7a-4d84-8659-b0911e947cc8} - (no file) O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: (no name) - {53C330D6-A4AB-419B-B45D-FD4411C1FEF4} - (no file) O2 - BHO: (no name) - {54645654-2225-4455-44A1-9F4543D34546} - (no file) O2 - BHO: (no name) - {669695bc-a811-4a9d-8cdf-ba8c795f261e} - (no file) O2 - BHO: (no name) - {6abc861a-31e7-4d91-b43b-d3c98f22a5c0} - (no file) O2 - BHO: (no name) - {944864a5-3916-46e2-96a9-a2e84f3f1208} - (no file) O2 - BHO: (no name) - {a4a435cf-3583-11d4-91bd-0048546a1450} - (no file) O2 - BHO: (no name) - {b8875bfe-b021-11d4-bfa8-00508b8e9bd3} - (no file) O2 - BHO: (no name) - {bb936323-19fa-4521-ba29-eca6a121bc78} - (no file) O2 - BHO: (no name) - {c2680e10-1655-4a0e-87f8-4259325a84b7} - (no file) O2 - BHO: (no name) - {c4ca6559-2cf1-48b6-96b2-8340a06fd129} - (no file) O2 - BHO: (no name) - {c5af2622-8c75-4dfb-9693-23ab7686a456} - (no file) O2 - BHO: (no name) - {ca1d1b05-9c66-11d5-a009-000103c1e50b} - (no file) O2 - BHO: (no name) - {d8efadf1-9009-11d6-8c73-608c5dc19089} - (no file) O2 - BHO: (no name) - {e9147a0a-a866-4214-b47c-da821891240f} - (no file) O2 - BHO: (no name) - {e9306072-417e-43e3-81d5-369490beef7c} - (no file) O4 - HKLM…\Run: [High Definition Audio Property Page Shortcut] HDAShCut.exe O4 - HKLM…\Run: [soundMAX] “C:\Program Files\Analog Devices\SoundMAX\Smax4.exe” /tray O4 - HKLM…\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM…\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit O4 - HKLM…\Run: [RemoteControl] “C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe” O4 - HKLM…\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe O4 - HKLM…\Run: [nwiz] nwiz.exe /install O4 - HKLM…\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM…\Run: [DemonStarter] C:\Program Files\PWN\Definicje\Bin\Starter.exe O4 - HKLM…\Run: [nod32kui] “C:\Program Files\NOD32\nod32kui.exe” /WAITSERVICE O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra ‘Tools’ menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra ‘Tools’ menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\NOD32\nod32krn.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

HELP

// Poprawiłem Twój post - kolor zielony/czerwony jest zastrzeżony.

Kaka’

Ciuci · 18 Grudzień 2007 08:59

Usuń w HJT plik pogrobiony ręcznie lub killbox’em.

F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\lpcywinp.exe,C:\WINDOWS\system32\userinit.exe O2 - BHO: (no name) - {00000000-d9e3-4bc6-a0bd-3d0ca4be5271} - (no file) O2 - BHO: (no name) - {00000012-890e-4aac-afd9-eff6954a34dd} - (no file) O2 - BHO: (no name) - {029e02f0-a0e5-4b19-b958-7bf2db29fb13} - (no file) O2 - BHO: (no name) - {06dfedaa-6196-11d5-bfc8-00508b4a487d} - (no file) O2 - BHO: (no name) - {12F02779-6D88-4958-8AD3-83C12D86ADC7} - (no file) O2 - BHO: (no name) - {1adbcce8-cf84-441e-9b38-afc7a19c06a4} - (no file) O2 - BHO: (no name) - {2d7cb618-cc1c-4126-a7e3-f5b12d3bcf71} - (no file) O2 - BHO: (no name) - {477840F3-BA52-44D9-8E41-38D61CAA010F} - (no file) O2 - BHO: (no name) - {51641ef3-8a7a-4d84-8659-b0911e947cc8} - (no file) O2 - BHO: (no name) - {53C330D6-A4AB-419B-B45D-FD4411C1FEF4} - (no file) O2 - BHO: (no name) - {54645654-2225-4455-44A1-9F4543D34546} - (no file) O2 - BHO: (no name) - {669695bc-a811-4a9d-8cdf-ba8c795f261e} - (no file) O2 - BHO: (no name) - {6abc861a-31e7-4d91-b43b-d3c98f22a5c0} - (no file) O2 - BHO: (no name) - {944864a5-3916-46e2-96a9-a2e84f3f1208} - (no file) O2 - BHO: (no name) - {a4a435cf-3583-11d4-91bd-0048546a1450} - (no file) O2 - BHO: (no name) - {b8875bfe-b021-11d4-bfa8-00508b8e9bd3} - (no file) O2 - BHO: (no name) - {bb936323-19fa-4521-ba29-eca6a121bc78} - (no file) O2 - BHO: (no name) - {c2680e10-1655-4a0e-87f8-4259325a84b7} - (no file) O2 - BHO: (no name) - {c4ca6559-2cf1-48b6-96b2-8340a06fd129} - (no file) O2 - BHO: (no name) - {c5af2622-8c75-4dfb-9693-23ab7686a456} - (no file) O2 - BHO: (no name) - {ca1d1b05-9c66-11d5-a009-000103c1e50b} - (no file) O2 - BHO: (no name) - {d8efadf1-9009-11d6-8c73-608c5dc19089} - (no file) O2 - BHO: (no name) - {e9147a0a-a866-4214-b47c-da821891240f} - (no file) O2 - BHO: (no name) - {e9306072-417e-43e3-81d5-369490beef7c} - (no file)

Daj jeszcze loga z Combo Fix

RMI · 19 Grudzień 2007 16:53

Oto log z dss.exe pozniewaz ComboFix.exe nie zadziałał.

Tapeta juz sie nie zmienia, ale nadal nie moge dostac sie do Menadżera zadan to takie male info :]

Deckard’s System Scanner v20071014.68 Extra logfile - please post this as an attachment with your post. -------------------------------------------------------------------------------- – System Information ---------------------------------------------------------- Microsoft Windows XP Professional (build 2600) SP 2.0 Architecture: X86; Language: Polish CPU 0: Intel® Pentium® 4 CPU 3.20GHz CPU 1: Intel® Pentium® 4 CPU 3.20GHz Percentage of Memory in Use: 41% Physical Memory (total/avail): 511.17 MiB / 297.73 MiB Pagefile Memory (total/avail): 1249.17 MiB / 1064.23 MiB Virtual Memory (total/avail): 2047.88 MiB / 1925.46 MiB A: is Removable (No Media) C: is Fixed (NTFS) - 48.83 GiB total, 38.51 GiB free. D: is Fixed (NTFS) - 48.83 GiB total, 22.5 GiB free. E: is Fixed (NTFS) - 51.39 GiB total, 30.04 GiB free. F: is CDROM (No Media) G: is CDROM (No Media) \.\PHYSICALDRIVE0 - ST3160211AS - 149.05 GiB - 3 partitions \PARTITION0 (bootable) - Instalowalny system plików - 48.83 GiB - C: \PARTITION1 - Rozszerzona z rozszerzonym przerwaniem 13 - 100.21 GiB - D: - E: – Security Center ------------------------------------------------------------- AUOptions is disabled. – Environment Variables ------------------------------------------------------- ALLUSERSPROFILE=C:\Documents and Settings\All Users APPDATA=C:\Documents and Settings\ok\Dane aplikacji CLIENTNAME=Console CommonProgramFiles=C:\Program Files\Common Files COMPUTERNAME=OK-505AAB8BEDAD ComSpec=C:\WINDOWS\system32\cmd.exe FP_NO_HOST_CHECK=NO HOMEDRIVE=C: HOMEPATH=\Documents and Settings\ok LOGONSERVER=\OK-505AAB8BEDAD NUMBER_OF_PROCESSORS=2 OS=Windows_NT Path=C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH PROCESSOR_ARCHITECTURE=x86 PROCESSOR_IDENTIFIER=x86 Family 15 Model 4 Stepping 9, GenuineIntel PROCESSOR_LEVEL=15 PROCESSOR_REVISION=0409 ProgramFiles=C:\Program Files PROMPT=$P$G SESSIONNAME=Console SystemDrive=C: SystemRoot=C:\WINDOWS TEMP=C:\DOCUME~1\ok\USTAWI~1\Temp TMP=C:\DOCUME~1\ok\USTAWI~1\Temp USERDOMAIN=OK-505AAB8BEDAD USERNAME=ok USERPROFILE=C:\Documents and Settings\ok windir=C:\WINDOWS – User Profiles --------------------------------------------------------------- ok (admin) Administrator (new local, admin) – Add/Remove Programs --------------------------------------------------------- --> rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf Adobe Acrobat 5.0 --> C:\WINDOWS\ISUNINST.EXE -f"C:\Program Files\Common Files\Adobe\Acrobat 5.0\NT\Uninst.isu" -c"C:\Program Files\Common Files\Adobe\Acrobat 5.0\NT\Uninst.dll" Adobe Flash Player ActiveX --> C:\WINDOWS\system32\Macromed\Flash\uninstall_activeX.exe Adobe Reader 7.0.5 - Polish --> MsiExec.exe /I{AC76BA86-7AD7-1045-7B44-A70500000002} Archiwizator WinRAR --> C:\Program Files\WinRAR\uninstall.exe Atlas Świata --> “C:\Program Files\Atlas Świata\unins000.exe” µTorrent --> “C:\Program Files\uTorrent\uTorrent.exe” /UNINSTALL Bubble Bobble World --> C:\WINDOWS\UnGins.exe “D:\Gry\Bobble World\install.log” CounterStrike 1.6 from VSI (Version 1.02) --> E:\Gry\CSTRIK~1.6\UNWISE.EXE E:\Gry\CSTRIK~1.6\ins_cs16_vsi102.log Crazy Factory --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup “C:\Program Files\InstallShield Installation Information{A7C9EE52-B3AD-4A14-8EDB-DE3110AF9587}\setup.exe” -l0x15 Crazy Machines --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\00\Intel32\Ctor.dll,LaunchSetup “C:\Program Files\InstallShield Installation Information{09D4F215-8960-4E0E-A2CC-C5A062113503}\SETUP.exe” -l0x9 -removeonly Data Access Objects (DAO) 3.5 --> C:\WINDOWS\IsUninst.exe -f"C:\Program Files\Common Files\Microsoft Shared\DAO\Uninst.isu" Definicje PWN --> C:\WINDOWS\IsUn0415.exe -f"C:\Program Files\PWN\Definicje\Uninst.isu" DVD Solution --> “C:\Program Files\Uninstall_CDS.exe” Electronic Arts Game Updater --> C:\WINDOWS\IsUninst.exe -f"c:\Program Files\EACom\Update\Uninst.isu" FIFA 07 --> E:\Gry\FIFA 07\EAUninstall.exe FotoOgród, czyli Twój dom w wymarzonym ogrodzie --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup “C:\Program Files\InstallShield Installation Information{8E17C98D-C87F-4366-BBEE-F75A4480963F}\setup.exe” -l0x15 Gadu-Gadu 6.1 --> C:\Program Files\Gadu-Gadu\Setup.exe HaxFix 4.62 --> “C:\Program Files\HaxFix\unins000.exe” High Definition Audio Driver Package - KB888111 --> C:\WINDOWS$NtUninstallKB888111WXPSP2$\spuninst\spuninst.exe HijackThis 1.99.1 --> C:\Documents and Settings\ok\Pulpit\HijackThis.exe /uninstall HP Customer Participation Program 7.0 --> C:\Program Files\HP\Digital Imaging\ExtCapUninstall\hpzscr01.exe -datfile hpqhsc01.dat HP Imaging Device Functions 7.0 --> C:\Program Files\HP\Digital Imaging\DeviceManagement\hpzscr01.exe -datfile hpqbud01.dat HP Photosmart Essential --> MsiExec.exe /X{6994491D-D491-48F1-AE1F-E179C1FFFC2F} HP Photosmart, Officejet and Deskjet 7.0.A --> C:\Program Files\HP\Digital Imaging{BDBE2F3E-42DB-4d4a-8CB1-19BA765DBC6C}\setup\hpzscr01.exe -datfile hposcr11.dat HP Software Update --> MsiExec.exe /X{BB85ED9C-AFC9-43BD-B8DC-258C3C7DF72E} HP Solution Center 7.0 --> C:\Program Files\HP\Digital Imaging\eSupport\hpzscr01.exe -datfile hpqbud05.dat K-Lite Codec Pack 2.47 Full --> “C:\Program Files\K-Lite Codec\unins000.exe” Kaspersky Online Scanner --> C:\WINDOWS\system32\Kaspersky Lab\Kaspersky Online Scanner\kavuninstall.exe Kurs języka angielskiego --> C:\WINDOWS\IsUn0415.exe -f"C:\Program Files\Angielski\Uninst.isu" Lock On: Modern Air Combat --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup “C:\Program Files\InstallShield Installation Information{E90DCEE9-DC27-401B-A7AC-B0AFF5B34E4D}\setup.exe” -l0x9 Microsoft Office 2000 Premium --> MsiExec.exe /I{00000415-78E1-11D2-B60F-006097C998E7} Mjuice Components --> C:\Program Files\Mjuice Media PlayerMJUninst.exe Multimedia Launcher --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup “C:\Program Files\InstallShield Installation Information{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}\setup.exe” -uninstall Na Kłopoty - Pantera --> C:\WINDOWS\IsUn0415.exe -f"C:\Program Files\Pantera\Uninst.isu" Need For Speed - Porsche Unleashed --> C:\WINDOWS\IsUninst.exe -fd:\gry\NFSPOR~1\uninst.log Need for Speed™ Carbon --> E:\Gry\Need for Speed Carbon\EAUninstall.exe Need for Speed™ Most Wanted --> D:\Gry\NFS Most Wanted\EAUninstall.exe Nero OEM --> C:\Program Files\Ahead\nero\uninstall\UNNERO.exe /UNINSTALL NOD32 FiX --> “C:\Program Files\NOD32\unins000.exe” NVIDIA Drivers --> C:\WINDOWS\system32\nvudisp.exe UninstallGUI OCR Software by I.R.I.S 7.0 --> C:\Program Files\HP\Digital Imaging\OCR\hpzscr01.exe -datfile hpqbud11.dat Portal PWN --> C:\WINDOWS\IsUn0415.exe -f"C:\Program Files\PWN\Portal2005\Uninst.isu" Porusz Umysł - demo --> “D:\Gry\Porusz Umysł - demo\odinstaluj.exe” PowerDVD --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup “C:\Program Files\InstallShield Installation Information{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}\setup.exe” -uninstall Real Alternative 1.43 --> “C:\Program Files\Real Alternative\unins000.exe” REALTEK GbE & FE Ethernet PCI-E NIC Driver --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\00\Intel32\Ctor.dll,LaunchSetup “C:\Program Files\InstallShield Installation Information{C9BED750-1211-4480-B1A5-718A3BE15525}\Setup.exe” -l0x15 -removeonly Słownik angielsko-polski wersja 2.24 --> “C:\Ajt Soft\Słownik\unins000.exe” Sammy Suricate --> C:\PROGRA~1\SAMMYS~1\UNWISE.EXE C:\PROGRA~1\SAMMYS~1\INSTALL.LOG Shrek 2 --> C:\PROGRA~1\COMMON~1\INSTAL~1\Driver\7\INTEL3~1\IDriver.exe /M{7774A6A9-CE0D-4544-9A29-84351BAE184A} Skype™ 3.6 --> MsiExec.exe /X{5C82DAE5-6EB0-4374-9254-BE3319BA4E82} Spybot - Search & Destroy --> “C:\Program Files\Spybot - Search & Destroy\unins000.exe” System Antywirusowy NOD32 --> C:\Program Files\NOD32\Setup\setup.exe /UNINSTALL Szkoła podstawowa klasa 4 - Był sobie człowiek --> C:\WINDOWS\IsUn0415.exe -f"C:\Program Files\Szkola podstawowa klasa 4 - Historia B\Uninst.isu" -c"C:\Program Files\Szkola podstawowa klasa 4 - Historia B\UninstallProject.dll" Test Drive Unlimited --> MsiExec.exe /X{C37A0BC1-52EE-4F97-8223-5CA9FC0357B0} The Sims --> C:\WINDOWS\IsUn0415.exe -fd:\Gry\SIMS\Uninst.isu The Sims 2 --> D:\Gry\SIMS 2\EAUninstall.exe The Sims 2 Nocne życie --> D:\Gry\SIMS 2 NOCNE ZYCIE\EAUninstall.exe TrackMania Nations ESWC 1.7.9 --> “C:\Program Files\TrackMania Nations ESWC\unins000.exe” Winamp (remove only) --> “C:\Program Files\Winamp\UninstWA.exe” Woody Woodpecker --> C:\WINDOWS\IsUn0415.exe -f"C:\Program Files\Woody Woodpecker\Uninst.isu" Wymarzony Ogród --> C:\Program Files\InstallShield Installation Information{4397C397-FB0E-48C2-87CD-56324516496A}\setup.exe -runfromtemp -l0x0015 -removeonly – Application Event Log ------------------------------------------------------- Event Record #/Type2388 / Error Event Submitted/Written: 12/17/2007 11:30:00 PM Event ID/Source: 1000 / Application Error Event Description: Aplikacja powodująca błąd drwtsn32.exe, wersja 5.1.2600.0, moduł powodujący błąd dbghelp.dll, wersja 5.1.2600.2180, adres błędu 0x0001295d. Przetwarzanie zdarzenia określonego nośnika dla [drwtsn32.exe!ws!] Event Record #/Type2387 / Error Event Submitted/Written: 12/17/2007 11:29:52 PM Event ID/Source: 1000 / Application Error Event Description: Aplikacja powodująca błąd explorer.exe, wersja 6.0.2900.2180, moduł powodujący błąd unknown, wersja 0.0.0.0, adres błędu 0x0000009f. Przetwarzanie zdarzenia określonego nośnika dla [explorer.exe!ws!] Event Record #/Type2386 / Error Event Submitted/Written: 12/17/2007 11:28:23 PM Event ID/Source: 1002 / Application Hang Event Description: Aplikacja zawieszająca notepad.exe, wersja 5.1.2600.2180, moduł zawieszenia hungapp, wersja 0.0.0.0, adres zawieszenia 0x00000000. Event Record #/Type2379 / Error Event Submitted/Written: 12/17/2007 07:02:38 PM Event ID/Source: 1002 / Application Hang Event Description: Aplikacja zawieszająca SpybotSD.exe, wersja 1.5.1.15, moduł zawieszenia hungapp, wersja 0.0.0.0, adres zawieszenia 0x00000000. Event Record #/Type2378 / Error Event Submitted/Written: 12/17/2007 05:32:00 PM Event ID/Source: 1002 / Application Hang Event Description: Aplikacja zawieszająca SpybotSD.exe, wersja 1.5.1.15, moduł zawieszenia hungapp, wersja 0.0.0.0, adres zawieszenia 0x00000000. – Security Event Log ---------------------------------------------------------- No Errors/Warnings found. – System Event Log ------------------------------------------------------------ Event Record #/Type110335 / Error Event Submitted/Written: 12/16/2007 00:30:09 PM Event ID/Source: 32003 / ipnathlp Event Description: Translator adresów sieciowych (NAT) nie może zażądać wykonania operacji przez moduł tłumaczący, pracujący w trybie jądra. Może to wskazywać na błąd konfiguracji, niewystarczające zasoby lub na błąd wewnętrzny. Dane zawierają kod błędu. Event Record #/Type108361 / Warning Event Submitted/Written: 12/13/2007 06:33:27 PM Event ID/Source: 4226 / Tcpip Event Description: Protokół TCP/IP osiągnął limit zabezpieczeń ustalony dla liczby równoczesnych prób połączeń TCP. – End of Deckard’s System Scanner: finished at 2007-12-19 17:45:36 -----------

Gutek · 19 Grudzień 2007 21:39

INSTRUKCJA URUCHOMIENIA:

1) Trzeba zamknąć wszystkie otwarte okna i programy. 2) ComboFix uruchamia się przez dwuklik na ikonkę ComboFix.exe 3) pojawi się napis please wait - więc czekać 4) pojawi się napis the process cannot access the file because it is being users by another process - dalej czekać 5) pojawi się napis na dole okienka type 1 to continue, or 2 to abort. _ - trzeba wpisać 1 i nacisnąć ENTER 6) pojawi się napis: Scanning for infectes files… Shouldn,t take more than 10minutes - czekać 7) W czasie skanowania nie wolno nic robić, nawet poruszać myszką. 8) Po skończeniu skanowania pojawi się log. Jeśli się nie pojawi na ekranie, to można go znaleźć na C:\ComboFix.txt 9) Log może być długi, więc zapisz go sobie gdzieś, a potem wklej na http://wklej.org/, a w poście daj tylko link.

RMI · 20 Grudzień 2007 10:42

Wiem wiem czytalem instrukcje i robie dokladnie tak jak jest napisane ale wyskakuje mi jakis komunikat cos z “corrupted” dlatego dalem loga z innego proga bo czytajac dalej jest napisane ze jesli ComboFix nie zadziala to dajemy z innego. Pozatym poradzilem juz sobie z Menadżerem Zadan - lekka edycja rejestru :] i narazie wszystko smiga ok pozatym ze stracilem SoundMax nie wiem czy to sa sterowniki do muzycznej czy program ktory jest dodawany do sterowników (wole juz nie sciągac :P)… w kazdym razie mial swietny EQ. Pozdrawiam