"zwiecha" kompa Windows XP

merlin_mag · 17 Kwiecień 2007 16:59

problem jest następujący: komputer zawiesza się, w momencie wyboru użytkownika (nie zawsze), podczas użytku na wybranym profilu.

Windows XP dodatek 2, aktualizowane na bieżąco, podłączenie do internetu- livebox TP siecią bezprzewodową, temperatura komputera (wszystkie elementy) w normie, NOD 32 nie wykrył nic, Spybot Search and Distroy również nic nie znalazł.

proszę o pomoc

z góry dzięki

log z HiJacka

Logfile of HijackThis v1.99.1 Scan saved at 18:59:56, on 17-04-2007 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16414) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\inetsrv\inetinfo.exe C:\Program Files\Common Files\LightScribe\LSSrvc.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\Program Files\Eset\nod32krn.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\UAService7.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\SOUNDMAN.EXE C:\Program Files\Eset\nod32kui.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe E:\Bolek\programy\foobar\foobar2000.exe C:\Program Files\Konnekt\konnekt.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\WINDOWS\Explorer.EXE E:\Bolek\programy\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://szukaj.wp.pl R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://szukaj.wp.pl R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Neostrada TP R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\NEOSTR~1\SEARCH~1.DLL (file missing) O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O4 - HKLM…\Run: [soundMan] SOUNDMAN.EXE O4 - HKLM…\Run: [nod32kui] “C:\Program Files\Eset\nod32kui.exe” /WAITSERVICE O4 - HKLM…\Run: [gcasServ] “C:\Program Files\Microsoft AntiSpyware\gcasServ.exe” O4 - HKLM…\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM…\Run: [nwiz] nwiz.exe /install O4 - HKLM…\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit O4 - HKCU…\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\msjava.dll O9 - Extra ‘Tools’ menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\msjava.dll O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra ‘Tools’ menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O11 - Options group: [iNTERNATIONAL] International* O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v … 0265671499 O16 - DPF: {7584C670-2274-4EFB-B00B-D6AABA6D3850} (Microsoft RDP Client Control (redist)) - http://213.25.51.31/tsweb/msrdp.cab O16 - DPF: {92ECE6FA-AC2E-4042-BFAE-0C8608E52A43} (SignActivX Control) - https://www.bph.pl/pi/components/SignActivX.cab O16 - DPF: {E7544C6C-CFD6-43EA-B4E9-360CEE20BDF7} (MainControl Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab O17 - HKLM\System\CCS\Services\Tcpip…{84287749-97C9-45F3-B503-8C19E019BC18}: NameServer = 194.204.159.1,0.0.0.0 O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll O18 - Protocol: vskype - (no CLSID) - (no file) O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Unknown owner - C:\Program Files\Common Files\LightScribe\LSSrvc.exe O23 - Service: SQL Server (SQLEXPRESS) (MSSQL$SQLEXPRESS) - Unknown owner - c:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe" -sSQLEXPRESS (file missing) O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: SecuROM User Access Service (V7) (UserAccess7) - Sony DADC Austria AG. - C:\WINDOWS\system32\UAService7.exe

Assasinos · 17 Kwiecień 2007 17:42

C:\WINDOWS\Explorer.EXE

Nię podwaja, któryś to fake, sam tak miałem to wiem co się dzieje. Trudno wykryć który jest który…

Gutek · 17 Kwiecień 2007 18:35

nie wypowiadaj się na temat logów. W tym logu nic nie widac, daj log z Combofix - http://download.bleepingcomputer.com/sUBs/ComboFix.exe

st_szer · 17 Kwiecień 2007 22:44

czy to zostaje :?:

Joan · 17 Kwiecień 2007 22:57

st_szer a można ciachnąć ale to kosmetyka jest a Gutek i tak poprosił o loga z Combo

merlin_mag · 18 Kwiecień 2007 05:15

log z combofixa ( nie wiem czy to oto chodzi)

Liczba skopiowanych plik˘w: 1. Error: Key: software\microsoft\windows\currentversion\policies\system does not exist! C:\DOCUME~1\NETWOR~1\DANEAP~1 Aktywna strona kodowa: 437 Aktywna strona kodowa: 852 SteelWerX Registry Console Tool 2.0 Written by Bobbi Flekman 2006 © Error: Key: software\microsoft\windows\currentversion\uninstall\webnexus does not exist! FINDSTR: wiersz 4098 jest za dugi. FINDSTR: wiersz 4981 jest za dugi. FINDSTR: wiersz 4981 jest za dugi. FINDSTR: wiersz 4981 jest za dugi. FINDSTR: wiersz 5072 jest za dugi. FINDSTR: wiersz 5072 jest za dugi. FINDSTR: wiersz 5072 jest za dugi. FINDSTR: wiersz 8735 jest za dugi. FINDSTR: wiersz 8735 jest za dugi. FINDSTR: wiersz 8735 jest za dugi. SteelWerX Registry Console Tool 2.0 Written by Bobbi Flekman 2006 © Error: Key: software\winpcap does not exist! FINDSTR: Nie moľna otworzy† C:\WINDOWS\system32\drivers\sptd2941.sys C:\WINDOWS\system32\packet.dll C:\WINDOWS\system32\wpcap.dll “C:\DOCUME~1\Bolek\Pulpit.\internet explorer.lnk” “C:\WINDOWS\system32\drivers\npf.sys” Nie moľna odnale«† C:\DOCUME~1\ALLUSE~1\MENUST~1-d743~1.lnk. Nie moľna odnale«† C:\DOCUME~1\ALLUSE~1\MENUST~1\4bb6~1.lnk. Nie moľna odnale«† C:\Documents and Settings-83f1~1.url. “C:\WINDOWS\system32\packet.dll” “C:\WINDOWS\system32\wpcap.dll” “C:\DOCUME~1\Bolek\Pulpit.\internet explorer.lnk” “C:\WINDOWS\system32\drivers\npf.sys” C:\qoobox\Quarantine C:\qoobox\Quarantine\C C:\qoobox\Quarantine\Registry_backups C:\qoobox\Quarantine\C\DOCUME~1 C:\qoobox\Quarantine\C\WINDOWS C:\qoobox\Quarantine\C\DOCUME~1\Bolek C:\qoobox\Quarantine\C\DOCUME~1\Bolek\Pulpit C:\qoobox\Quarantine\C\DOCUME~1\Bolek\Pulpit\Internet Explorer.lnk.vir C:\qoobox\Quarantine\C\WINDOWS\system32 C:\qoobox\Quarantine\C\WINDOWS\system32\drivers C:\qoobox\Quarantine\C\WINDOWS\system32\packet.dll.vir C:\qoobox\Quarantine\C\WINDOWS\system32\wpcap.dll.vir C:\qoobox\Quarantine\C\WINDOWS\system32\drivers\npf.sys.vir C:\qoobox\Quarantine\Registry_backups\LEGACY_NPF.reg.cf C:\qoobox\Quarantine\Registry_backups\services_nm.reg.cf C:\qoobox\Quarantine\Registry_backups\services_NPF.reg.cf Nie moľna odnale«† okrelonego pliku. Nie moľna odnale«† pliku.

qrczak13 · 18 Kwiecień 2007 08:19

http://cybertrash.pl/images/tata/ComboFix.html

merlin_mag · 18 Kwiecień 2007 16:30

“ssss” - 07-04-18 18:23:30 Dodatek Service Pack 2 ComboFix 07-04-18.V - Running from: C:\Documents and Settings\sssss\Pulpit\ ((((((((((((((((((((((((((((((( Files Created from 2007-03-18 to 2007-04-18 )))))))))))))))))))))))))))))))))) 2007-04-02 23:00 122,880 --a------ C:\WINDOWS\system32\UAService7.exe 2007-04-02 23:00 2007-03-22 22:01 (((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))) 2007-04-18 18:23 -------- d-------- C:\Program Files\microsoft antispyware 2007-04-08 08:39 603032 --a------ C:\WINDOWS\system32\perfh015.dat 2007-04-08 08:39 138842 --a------ C:\WINDOWS\system32\perfc015.dat 2007-04-06 11:25 85 --a------ C:\WINDOWS\popcinfo.dat 2007-03-31 15:21 -------- d-------- C:\DOCUME~1\Bolek\DANEAP~1\skype 2007-03-29 20:08 304182 --a------ C:\StiImg.dat 2007-03-20 12:29 -------- d-------- C:\Program Files\driver cleaner 2007-03-17 15:45 293376 --a------ C:\WINDOWS\system32\winsrv.dll 2007-03-15 21:17 -------- d-------- C:\Program Files\snikers 2007-03-09 22:19 17480 --a------ C:\WINDOWS\system32\drivers\hamachi.sys 2007-03-09 22:19 -------- d-------- C:\Program Files\hamachi 2007-03-08 17:38 579072 --a------ C:\WINDOWS\system32\user32.dll 2007-03-08 17:38 40960 --a------ C:\WINDOWS\system32\mf3216.dll 2007-03-08 17:38 281600 --a------ C:\WINDOWS\system32\gdi32.dll 2007-03-08 17:37 1843840 --a------ C:\WINDOWS\system32\win32k.sys 2007-02-27 22:50 -------- d-------- C:\Program Files\testy gimnazjalne 2006 2007-02-27 21:21 -------- d-------- C:\DOCUME~1\Bolek\DANEAP~1\utorrent 2007-02-26 23:16 -------- d–h----- C:\Program Files\installshield installation information 2007-02-26 23:16 -------- d-------- C:\Program Files\sagem wifi manager 2007-02-26 23:15 -------- d-------- C:\Program Files\sagem 2007-02-26 23:08 -------- d-------- C:\Program Files\neostrada tp 2007-02-24 13:42 -------- d-------- C:\Program Files\tlen.pl 2007-02-24 13:38 -------- d-------- C:\DOCUME~1\Bolek\DANEAP~1\tlen.pl 2007-02-24 13:19 -------- d-------- C:\Program Files\konnekt 2007-02-24 10:21 -------- d-------- C:\DOCUME~1\Bolek\DANEAP~1\tc powerpack 2007-02-09 15:39 737280 --a------ C:\WINDOWS\iun6002.exe 2007-02-05 22:19 185856 --a------ C:\WINDOWS\system32\upnphost.dll (((((((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects] {53707962-6F74-2D53-2644-206D7942484F} C:\PROGRA~1\SPYBOT~1\SDHelper.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run] “SoundMan”=“SOUNDMAN.EXE” “nod32kui”="“C:\Program Files\Eset\nod32kui.exe” /WAITSERVICE" “gcasServ”="“C:\Program Files\Microsoft AntiSpyware\gcasServ.exe”" “NvCplDaemon”=“RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup” “nwiz”=“nwiz.exe /install” “NvMediaCenter”=“RunDLL32.exe NvMCTray.dll,NvTaskbarInit” [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run] “CTFMON.EXE”=“C:\WINDOWS\system32\ctfmon.exe” “odk_mcd”="" “Steam”="" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer] “NoCDBurning”=dword:00000000 “NoRemoteRecursiveEvents”=dword:00000001 “ClearRecentDocsOnExit”=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer\run] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] “NoSaveSettings”=dword:00000000 “ClearRecentDocsOnExit”=dword:00000001 [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\run] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\sharedtaskscheduler] “bestreak”="{874443fe-aa33-4ebf-a6ac-73208787e62d}" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks] “{9EF34FF2-3396-4527-9D27-04C8C1C67806}”=“Microsoft AntiSpyware Service Hook” [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\shellserviceobjectdelayload] “UPnPMonitor”="{e57ce738-33e8-4c51-8354-bb4de9d215d1}" HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa Authentication Packages REG_MULTI_SZ msv1_0\0\0 Security Packages REG_MULTI_SZ kerberos\0msv1_0\0schannel\0wdigest\0\0 Notification Packages REG_MULTI_SZ scecli\0\0 [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Bolek^Menu Start^Programy^Autostart^UniSpiker-2.6.lnk] “backup”=“C:\WINDOWS\pss\UniSpiker-2.6.lnkStartup” “location”=“Startup” “command”=“E:\Bolek\programy\UNISPI~1.6\UNI_SP~1.EXE " “item”=“UniSpiker-2.6” [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ASUS SmartDoctor] “key”=“SOFTWARE\Microsoft\Windows\CurrentVersion\Run” “item”=“SmartDoctor” “hkey”=“HKCU” “command”=“C:\Program Files\ASUS\SmartDoctor\SmartDoctor.exe /start” “inimapping”=“0” [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DVDBitSet] “key”=“SOFTWARE\Microsoft\Windows\CurrentVersion\Run” “item”=“DVDBitSet” “hkey”=“HKLM” “command”=”“C:\Program Files\HP DVD\Umbrella\DVDBitSet.exe” /NOUI" “inimapping”=“0” [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DVDTray] “key”=“SOFTWARE\Microsoft\Windows\CurrentVersion\Run” “item”=“DVDTray” “hkey”=“HKLM” “command”="“C:\Program Files\HP DVD\Umbrella\DVDTray.exe”" “inimapping”=“0” [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Component Manager] “key”=“SOFTWARE\Microsoft\Windows\CurrentVersion\Run” “item”=“hpcmpmgr” “hkey”=“HKLM” “command”="“C:\Program Files\HP\hpcoretech\hpcmpmgr.exe”" “inimapping”=“0” [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update] “key”=“SOFTWARE\Microsoft\Windows\CurrentVersion\Run” “item”=“HPWuSchd2” “hkey”=“HKLM” “command”=“C:\Program Files\HP\HP Software Update\HPWuSchd2.exe” “inimapping”=“0” [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\InstantTray] “key”=“SOFTWARE\Microsoft\Windows\CurrentVersion\Run” “item”=“PCLETray” “hkey”=“HKCU” “command”=“C:\Program Files\Pinnacle\Shared Files\InstantCDDVD\PCLETray.exe” “inimapping”=“0” [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IW_Drop_Icon] “key”=“SOFTWARE\Microsoft\Windows\CurrentVersion\Run” “item”=“iwctrl” “hkey”=“HKCU” “command”=“C:\Program Files\Pinnacle\InstantCDDVD\InstantWrite\iwctrl.exe /DropDisc” “inimapping”=“0” [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCSuiteTrayApplication] “key”=“SOFTWARE\Microsoft\Windows\CurrentVersion\Run” “item”=“LAUNCH~1” “hkey”=“HKLM” “inimapping”=“0” [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PinnacleDriverCheck] “key”=“SOFTWARE\Microsoft\Windows\CurrentVersion\Run” “item”=“PSDrvCheck” “hkey”=“HKLM” “command”=“C:\WINDOWS\system32\PSDrvCheck.exe” “inimapping”=“0” [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] “key”=“SOFTWARE\Microsoft\Windows\CurrentVersion\Run” “item”=“qttask” “hkey”=“HKLM” “inimapping”=“0” [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpeedTouch USB Diagnostics] “key”=“SOFTWARE\Microsoft\Windows\CurrentVersion\Run” “item”=“Dragdiag” “hkey”=“HKLM” “command”="“C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe” /icon" “inimapping”=“0” [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UpdateManager] “key”=“SOFTWARE\Microsoft\Windows\CurrentVersion\Run” “item”=“sgtray” “hkey”=“HKLM” “command”="“C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe” /r" “inimapping”=“0” [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WooCnxMon] “key”=“SOFTWARE\Microsoft\Windows\CurrentVersion\Run” “item”=“CnxMon” “hkey”=“HKLM” “command”=“C:\PROGRA~1\NEOSTR~1\CnxMon.exe” “inimapping”=“0” [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WOOTASKBARICON] “key”=“SOFTWARE\Microsoft\Windows\CurrentVersion\Run” “item”=“TaskbarIcon” “hkey”=“HKLM” “command”=“C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe” “inimapping”=“0” [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WOOWATCH] “key”=“SOFTWARE\Microsoft\Windows\CurrentVersion\Run” “item”=“Watch” “hkey”=“HKLM” “command”=“C:\PROGRA~1\NEOSTR~1\Watch.exe” “inimapping”=“0” [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Svchost] LocalService REG_MULTI_SZ Alerter\0WebClient\0LmHosts\0RemoteRegistry\0upnphost\0SSDPSRV\0\0 NetworkService REG_MULTI_SZ DnsCache\0\0 rpcss REG_MULTI_SZ RpcSs\0\0 imgsvc REG_MULTI_SZ StiSvc\0\0 termsvcs REG_MULTI_SZ TermService\0\0 HTTPFilter REG_MULTI_SZ HTTPFilter\0\0 DcomLaunch REG_MULTI_SZ DcomLaunch\0TermService\0\0 [HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2{814df890-3698-11db-9f26-000e501b339f}] Shell\AutoRun\command G:\setupSNK.exe ******************************************************************** catchme 0.2 W2K/XP/Vista - userland rootkit detector by Gmer, 17 October 2006 http://www.gmer.net scanning hidden processes … scanning hidden services … scanning hidden autostart entries … scanning hidden files … scan completed successfully hidden processes: 0 hidden services: 0 hidden files: 0 ******************************************************************** Completion time: 07-04-18 18:29:51 C:\ComboFix-quarantined-files.txt … 07-04-18 18:29 C:\ComboFix2.txt … 07-04-18 07:14

Joan · 18 Kwiecień 2007 20:29

na moje oko ok