Ukryte pliki i foldery w Win XP, problem

[blasster (Yaqoob 7)]

Windows nie reaguje, gdy zaznaczam opcję ’ Pokaż ukrtye pliki i foldery’. Mimo, że ustawiam tę opcję, nadal zostaje kropeczka w punkcie’ ulryj…’ xd co jst grane ?

[Franc (Joni987)]

Podaj logi z Combofix i HiJackThis

[blasster (Yaqoob 7)]

HIJACK

Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 15:05:45, on 2008-11-11 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\RUNDLL32.EXE C:\WINDOWS\system32\CTsvcCDA.EXE C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\HPZipm12.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\MsPMSPSv.exe C:\WINDOWS\system32\wuauclt.exe C:\Program Files\Last.fm\LastFM.exe C:\Program Files\Opera\opera.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.entretieneteds.vze.com R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O4 - HKLM…\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM…\Run: [nwiz] nwiz.exe /install O4 - HKLM…\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKCU…\Run: [AdobeUpdater] C:\Program Files\Common Files\Adobe\Updater5\AdobeUpdater.exe O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O8 - Extra context menu item: Pobierz z &BitSpirit - C:\Program Files\BitSpirit\bsurl.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra ‘Tools’ menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra ‘Tools’ menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.pl/resources/virus … nicode.cab O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/Shar … vSniff.cab O16 - DPF: {3D8700FB-86A4-4CB4-B738-6F0FC016AC7D} (MainControl Class) - http://slimak.onet.pl/_m/wirusy/ArcaOnline.cab O16 - DPF: {48DD0448-9209-4F81-9F6D-D83562940134} (MySpace Uploader Control) - http://lads.myspace.com/upload/MySpaceUploader1006.cab O16 - DPF: {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} (OnlineScanner Control) - http://www.eset.eu/buxus/docs/OnlineScanner.cab O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/Shar … /cabsa.cab O16 - DPF: {68282C51-9459-467B-95BF-3C0E89627E55} (MksSkanerOnline Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe O23 - Service: TuneUp WinStyler Theme Service (TUWinStylerThemeSvc) - TuneUp Software GmbH - D:\Program Files\TuneUp Utilities 2006\WinStylerThemeSvc.exe – End of file - 4085 bytes

COMBOFIX

ComboFix 08-11-10.01 - Konik’s 2008-11-11 15:10:06.1 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.2.1250.1.1045.18.453 [GMT 1:00] Uruchomiony z: c:\documents and settings\Konik’s\Pulpit\ComboFix.exe * Utworzono nowy punkt przywracania . ((((((((((((((((((((((((((((((((((((((( Usunięto ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\documents and settings\Konik’s\Menu Start\Programy\Download programs.url c:\documents and settings\Konik’s\Menu Start\Programy\Games.url c:\documents and settings\Konik’s\Menu Start\Programy\Translator.url c:\documents and settings\Konik’s\Menu Start\Programy\Videos.url c:\documents and settings\Konik’s\Ulubione\Download programs.url c:\documents and settings\Konik’s\Ulubione\Games.url c:\documents and settings\Konik’s\Ulubione\Translator.url c:\documents and settings\Konik’s\Ulubione\Videos.url c:\windows\backinf.tab . ((((((((((((((((((((((((( Pliki utworzone od 2008-10-11 do 2008-11-11 ))))))))))))))))))))))))))))))) . 2008-11-11 15:05 . 2008-11-11 15:05 2008-11-08 13:29 . 2008-11-08 13:29 2008-11-05 12:26 . 2008-11-05 12:26 2008-10-27 09:58 . 2008-11-04 12:33 834 --a------ c:\windows\wininit.ini . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-11-04 19:43 --------- d-----w c:\documents and settings\Konik’s\Dane aplikacji\SopCast 2008-10-16 13:13 202,776 ----a-w c:\windows\system32\wuweb.dll 2008-10-16 13:13 1,809,944 ----a-w c:\windows\system32\wuaueng.dll 2008-10-16 13:12 561,688 ----a-w c:\windows\system32\wuapi.dll 2008-10-16 13:12 323,608 ----a-w c:\windows\system32\wucltui.dll 2008-10-16 13:09 92,696 ----a-w c:\windows\system32\cdm.dll 2008-10-16 13:09 51,224 ----a-w c:\windows\system32\wuauclt.exe 2008-10-16 13:09 43,544 ----a-w c:\windows\system32\wups2.dll 2008-10-16 13:08 34,328 ----a-w c:\windows\system32\wups.dll 2008-10-16 08:49 --------- d-----w c:\documents and settings\Konik’s\Dane aplikacji\Skype 2008-10-15 16:07 --------- d-----w c:\documents and settings\Konik’s\Dane aplikacji\dvdcss 2008-10-10 21:12 --------- d-----w c:\program files\Opera 2008-09-28 16:08 --------- d-----w c:\program files\WinAVIVideoConverter 2008-09-28 16:08 --------- d-----w c:\program files\NAPI-PROJEKT 2008-09-28 16:08 --------- d-----w c:\documents and settings\Konik’s\Dane aplikacji\LimeWire 2008-09-28 16:08 --------- d-----w c:\documents and settings\Konik’s\Dane aplikacji\bekaper.pl 2008-09-28 15:59 737,280 ----a-w c:\windows\iun6002.exe 2008-09-28 15:57 --------- d-----w c:\documents and settings\Konik’s\Dane aplikacji\TuneUp Software 2008-09-28 15:56 --------- d-----w c:\program files\Common Files\Wise Installation Wizard 2008-09-28 15:56 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\TuneUp Software 2008-09-23 19:08 --------- d-----w c:\documents and settings\Konik’s\Dane aplikacji\Creative 2008-09-21 12:56 --------- d-----w c:\program files\SopCast 2008-09-17 13:12 --------- d-----w c:\program files\Java 2008-09-13 17:46 98,304 ----a-w c:\windows\system32\CmdLineExt.dll 2008-09-13 17:10 --------- d–h--w c:\program files\InstallShield Installation Information 2008-08-20 05:38 662,016 ----a-w c:\windows\system32\wininet.dll 2004-09-28 02:00 26,240 ----a-w c:\windows\inf\RAMDSK.SYS . ----a-w 416,256 2008-03-01 14:45:40 c:\documents and settings\Konik’s\Moje dokumenty\LG\lg3g uploded by The New .exe [/code] ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “AdobeUpdater”=“c:\program files\Common Files\Adobe\Updater5\AdobeUpdater.exe” [2007-03-01 2321600] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “NvCplDaemon”=“c:\windows\system32\NvCpl.dll” [2007-12-05 8523776] “NvMediaCenter”=“c:\windows\system32\NvMcTray.dll” [2007-12-05 81920] “nwiz”=“nwiz.exe” [2007-12-05 c:\windows\system32\nwiz.exe] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] “msacm.avis”= ff_acm.acm [HKEY_LOCAL_MACHINE\software\microsoft\security center] “AntiVirusOverride”=dword:00000001 “FirewallOverride”=dword:00000001 [HKLM~\services\sharedaccess\parameters\firewallpolicy\standardprofile] “EnableFirewall”= 0 (0x0) [HKLM~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] “%windir%\system32\sessmgr.exe”= “c:\Program Files\Gadu-Gadu\gg.exe”= “c:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe”= “c:\Program Files\HP\Digital Imaging\bin\hpqste08.exe”= “c:\Program Files\HP\Digital Imaging\bin\hpofxm08.exe”= “c:\Program Files\HP\Digital Imaging\bin\hposfx08.exe”= “c:\Program Files\HP\Digital Imaging\bin\hposid01.exe”= “c:\Program Files\HP\Digital Imaging\bin\hpqscnvw.exe”= “c:\Program Files\HP\Digital Imaging\bin\hpqkygrp.exe”= “c:\Program Files\HP\Digital Imaging\bin\hpqCopy.exe”= “c:\Program Files\HP\Digital Imaging\bin\hpfccopy.exe”= “c:\Program Files\HP\Digital Imaging\bin\hpzwiz01.exe”= “c:\Program Files\HP\Digital Imaging\Unload\HpqPhUnl.exe”= “c:\Program Files\HP\Digital Imaging\Unload\HpqDIA.exe”= “c:\Program Files\HP\Digital Imaging\bin\hpoews01.exe”= “c:\Program Files\Skype\Phone\Skype.exe”= S3 qcusbser;ZTE USB Device for Legacy Serial Communication;c:\windows\system32\DRIVERS\ZTEusbser.sys [] *Newly Created Service* - PROCEXP90 . Zawartość folderu ‘Zaplanowane zadania’ 2008-11-07 c:\windows\Tasks\1-Click Maintenance.job - d:\program files\TuneUp Utilities 2006\SystemOptimizer.exe [2005-09-21 21:35] . . ------- Skan uzupełniający ------- . FireFox -: Profile - c:\documents and settings\Konik’s\Dane aplikacji\Mozilla\Firefox\Profiles\lh07ce6m.default\ . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-11-11 15:12:01 Windows 5.1.2600 Dodatek Service Pack 2 NTFS skanowanie ukrytych procesów … skanowanie ukrytych wpisów autostartu … skanowanie ukrytych plików … skanowanie pomyślnie ukończone ukryte pliki: 0 ************************************************************************** . Czas ukończenia: 2008-11-11 15:13:44 ComboFix-quarantined-files.txt 2008-11-11 14:13:04 Przed: 3 181 469 696 bajtów wolnych Po: 3,227,443,200 bajtów wolnych WindowsXP-KB310994-SP2-Home-BootDisk-PLK.exe [boot loader] timeout=2 default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS [operating systems] c:\cmdcons\BOOTSECT.DAT=“Microsoft Windows Recovery Console” /cmdcons multi(0)disk(0)rdisk(0)partition(1)\WINDOWS=“Microsoft Windows XP Home Edition” /noexecute=optin /fastdetect 126 — E O F — 2008-10-18 15:35:02

[Franc (Joni987)]

W logach nic nie widzę. Myślałem że to oznaka zarażenia wirusem przez amvo.exe, jednak wygląda że to coś jakiś systemowy błąd, jednak niewiem jaki

Usuń instalkę Combofix

Usuń ręcznie C:\Qoobox

Wyłącz i włącz przywracanie systemu na wszystkich dyskach - Instrukcja

Przeczyść komputer CCleanerem

Zrób optymalizację systemu