Witam wszystkich.Po instalacji drukarki wyskoczyły informacje że mam Trojany:/ Mam Symantec Anty vir. i się zacina. I pojawia się że system Windows jest niechronioony. No i mam loga z Hiajkthi :

Logfile of HijackThis v1.99.1

Scan saved at 15:38:29, on 2007-08-28

Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)


Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe

C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe

C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Symantec AntiVirus\DefWatch.exe

C:\Program Files\Internet Explorer\IEXPLORE.EXE

C:\WINDOWS\system32\nvsvc32.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\wscntfy.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\RTHDCPL.EXE

C:\WINDOWS\system32\RUNDLL32.EXE

C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe

C:\Program Files\Common Files\Symantec Shared\ccApp.exe

C:\PROGRA~1\SYMANT~1\VPTray.exe

C:\Program Files\HP\HP Software Update\HPWuSchd2.exe

D:\Program Files\Gadu-Gadu\gg.exe

C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe

C:\Program Files\Symantec AntiVirus\DoScan.exe

C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe

C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe

C:\Program Files\Symantec AntiVirus\Rtvscan.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\DOCUME~1\admin\USTAWI~1\Temp\help.exe

C:\DOCUME~1\admin\USTAWI~1\Temp\help.exe

C:\DOCUME~1\admin\USTAWI~1\Temp\help.exe

C:\DOCUME~1\admin\USTAWI~1\Temp\help.exe

C:\DOCUME~1\admin\USTAWI~1\Temp\help.exe

C:\DOCUME~1\admin\USTAWI~1\Temp\help.exe

C:\DOCUME~1\admin\USTAWI~1\Temp\help.exe

C:\DOCUME~1\admin\USTAWI~1\Temp\help.exe

C:\DOCUME~1\admin\USTAWI~1\Temp\help.exe

C:\DOCUME~1\admin\USTAWI~1\Temp\help.exe

C:\Program Files\WinRAR\WinRAR.exe

C:\DOCUME~1\admin\USTAWI~1\Temp\Rar$EX00.328\HijackThis.exe


R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.pl/

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza

O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll

O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll

O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll

O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE

O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [nwiz] nwiz.exe /install

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit

O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe

O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"

O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"

O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe

O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe

O4 - HKCU\..\Run: [Gadu-Gadu] "D:\Program Files\Gadu-Gadu\gg.exe" /tray

O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

O4 - HKCU\..\Run: [avpa] C:\WINDOWS\system32\avpo.exe

O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe

O4 - Global Startup: HP Photosmart Premier - Szybkie uruchomienie.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe

O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O20 - Winlogon Notify: NavLogon - C:\WINDOWS\system32\NavLogon.dll

O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe

O23 - Service: ASP State Services (aspnet) - Unknown owner - C:\WINDOWS\windows\tosclldlw

O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe

O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe

O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe

O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe

O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe

O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe

O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe

Jest coś nietak??

Start >>> Uruchom >>> services.msc >>> zatrzymaj i wyłącz ASP State Services , a wpsiy usuń HJT

Oczyść TEMP - użyj ATF-Cleaner - http://www.atribune.org/ccount/click.php?id=1

Pobierz program SDFix

Zaznaczyć wskazane wpisy w Hijacku i kliknąć Fix checked. - opis - http://forum.dobreprogramy.pl/viewtopic.php?t=36654

Ok zrobilem to co mówiłęś użyłem tego programu i mam Loga po sunięci u virsuów :

SDFix: Version 1.100


Run by admin on 2007-08-28 at 17:05


Microsoft Windows XP [Wersja 5.1.2600]


Running From: C:\SDFix


Safe Mode:

Checking Services: 



Restoring Windows Registry Values

Restoring Windows Default Hosts File


Rebooting...



Normal Mode:

Checking Files: 


No Trojan Files Found





Removing Temp Files...


ADS Check:


C:\WINDOWS

No streams found. 


C:\WINDOWS\system32

No streams found. 


C:\WINDOWS\system32\svchost.exe

No streams found.


C:\WINDOWS\system32\ntoskrnl.exe

No streams found.




                                 Final Check:


Remaining Services:

------------------




Authorized Application Key Export:


[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe:*:Enabled:hpqtra08.exe"

"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe:*:Enabled:hpqste08.exe"

"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe:*:Enabled:hpofxm08.exe"

"C:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe:*:Enabled:hposfx08.exe"

"C:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe:*:Enabled:hposid01.exe"

"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe:*:Enabled:hpqscnvw.exe"

"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe:*:Enabled:hpqkygrp.exe"

"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe:*:Enabled:hpqcopy.exe"

"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe:*:Enabled:hpfccopy.exe"

"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe:*:Enabled:hpzwiz01.exe"

"C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"="C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe:*:Enabled:hpqphunl.exe"

"C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"="C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe:*:Enabled:hpqdia.exe"

"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe:*:Enabled:hpoews01.exe"

"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe:*:Enabled:hpqnrs08.exe"

"D:\\Program Files\\Gadu-Gadu\\gg.exe"="D:\\Program Files\\Gadu-Gadu\\gg.exe:*:Enabled:Gadu-Gadu - program g˘wny"


[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"


Remaining Files:

---------------



Files with Hidden Attributes:


C:\ntde1ect.com

C:\WINDOWS\system32\avpo0.dll

C:\WINDOWS\system32\avpo1.dll

C:\WINDOWS\system32\avpo2.dll

C:\WINDOWS\system32\avpo.exe


                                 Finished

I co??

Ściągnij i użyj - http://aknow.prevx.com/zeroL/112EETA.exe - wciśnij Scan

Pisało “rootkit not found” a skończyło sie natym :

Scanning: C:\Program Files\Common Files

Scanning Windows Directory...

Scanning Temporary files...

Trojan.Gromozon does not exist on the system.


Scan finished normally

For a detailed log, please refer to \gromozon_removal.log

I Nadusiłem exit. A Alert nadal szalejej. pisze że anty vir wyłaczony a jest włączony…

Daj jeszcze raz log z SDFix - zobaczymy czy usunięte zostały

Oto log

SDFix: Version 1.100


Run by admin on 2007-08-28 at 18:42


Microsoft Windows XP [Wersja 5.1.2600]


Running From: C:\SDFix


Safe Mode:

Checking Services: 



Restoring Windows Registry Values

Restoring Windows Default Hosts File


Rebooting...



Normal Mode:

Checking Files: 


No Trojan Files Found





Removing Temp Files...


ADS Check:


C:\WINDOWS

No streams found. 


C:\WINDOWS\system32

No streams found. 


C:\WINDOWS\system32\svchost.exe

No streams found.


C:\WINDOWS\system32\ntoskrnl.exe

No streams found.




                                 Final Check:


Remaining Services:

------------------




Authorized Application Key Export:


[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe:*:Enabled:hpqtra08.exe"

"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe:*:Enabled:hpqste08.exe"

"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe:*:Enabled:hpofxm08.exe"

"C:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe:*:Enabled:hposfx08.exe"

"C:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe:*:Enabled:hposid01.exe"

"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe:*:Enabled:hpqscnvw.exe"

"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe:*:Enabled:hpqkygrp.exe"

"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe:*:Enabled:hpqcopy.exe"

"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe:*:Enabled:hpfccopy.exe"

"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe:*:Enabled:hpzwiz01.exe"

"C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"="C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe:*:Enabled:hpqphunl.exe"

"C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"="C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe:*:Enabled:hpqdia.exe"

"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe:*:Enabled:hpoews01.exe"

"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe:*:Enabled:hpqnrs08.exe"

"D:\\Program Files\\Gadu-Gadu\\gg.exe"="D:\\Program Files\\Gadu-Gadu\\gg.exe:*:Enabled:Gadu-Gadu - program g˘wny"


[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"


Remaining Files:

---------------



Files with Hidden Attributes:


C:\ntde1ect.com

C:\WINDOWS\system32\avpo0.dll

C:\WINDOWS\system32\avpo1.dll

C:\WINDOWS\system32\avpo2.dll

C:\WINDOWS\system32\avpo.exe


                                 Finished

Tutaj zdjęcie z mojego programu Symentec Anty vir… (auto protect)… Przy włączeniu komputera to wychodzi

Pobierz The Avenger. Wypakuj => uruchom => zaznacz opcję Input script manually => kliknij w taką lupkę => w okienku, które się otworzy wklej:

kliknij klawisz Done => teraz kliknij na zielone światełko => powinna pojawić się pewna informacja i kliknij OK (teraz restart).

Pobierz Gmer

1. Rootkit=>szukaj=>bez zaznaczania pokaż wszystko=> Ctrl + V do posta wklej

2. Rootkit => zaznaczone tylko Pokazuj wszystko + Usługi => Szukaj => Kopiuj => Ctrl + V do posta wklej

Oto :

log 1 :

Logfile of The Avenger version 1, by Swandog46

Running from registry key:

\Registry\Machine\System\CurrentControlSet\Services\ocaceaxd


*******************


Script file located at: \??\C:\tkscissj.txt

Script file opened successfully.


Script file read successfully


Backups directory opened successfully at C:\Avenger


*******************


Beginning to process script file:


File C:\ntde1ect.com deleted successfully.

File C:\WINDOWS\system32\avpo0.dll deleted successfully.

File C:\WINDOWS\system32\avpo1.dll deleted successfully.

File C:\WINDOWS\system32\avpo2.dll deleted successfully.

File C:\WINDOWS\system32\avpo.exe deleted successfully.


Completed script processing.


*******************


Finished! Terminate.

GMER 1.0.13.12551 - http://www.gmer.net

Rootkit scan 2007-08-28 20:34:33

Windows 5.1.2600 Dodatek Service Pack 2



---- System - GMER 1.0.13 ----


SSDT 86173D18 ZwAlertResumeThread

SSDT 86173E90 ZwAlertThread

SSDT 860F7368 ZwAllocateVirtualMemory

SSDT 8636BDC0 ZwConnectPort

SSDT 862FDE58 ZwCreateMutant

SSDT 860ED528 ZwCreateThread

SSDT \??\C:\Program Files\Symantec\SYMEVENT.SYS ZwDeleteValueKey

SSDT 861790F8 ZwFreeVirtualMemory

SSDT 86382C80 ZwImpersonateAnonymousToken

SSDT 86173BA0 ZwImpersonateThread

SSDT 8619C0C0 ZwMapViewOfSection

SSDT 8636B6B8 ZwOpenEvent

SSDT 86179C48 ZwOpenProcessToken

SSDT 8619E038 ZwOpenThreadToken

SSDT 861376F0 ZwQueryValueKey

SSDT 8618BAF0 ZwResumeThread

SSDT 86177220 ZwSetContextThread

SSDT 861772F8 ZwSetInformationProcess

SSDT 86174868 ZwSetInformationThread

SSDT \??\C:\Program Files\Symantec\SYMEVENT.SYS ZwSetValueKey

SSDT 861FC078 ZwSuspendProcess

SSDT 861740B8 ZwSuspendThread

SSDT 8617CA10 ZwTerminateProcess

SSDT 861743B8 ZwTerminateThread

SSDT 86178B48 ZwUnmapViewOfSection

SSDT 86129600 ZwWriteVirtualMemory


---- Kernel code sections - GMER 1.0.13 ----


? fpuwhwlo.sys Nie można odnaleźć określonego pliku.


AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_CREATE [F72D9F70] fltMgr.sys

AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_CREATE_NAMED_PIPE [F72D9F70] fltMgr.sys

AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_CLOSE [F72CDF08] fltMgr.sys

AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_READ [F72CDF08] fltMgr.sys

AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_WRITE [F72CDF08] fltMgr.sys

AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_QUERY_INFORMATION [F72CDF08] fltMgr.sys

AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_SET_INFORMATION [F72CDF08] fltMgr.sys

AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_QUERY_EA [F72CDF08] fltMgr.sys

AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_SET_EA [F72CDF08] fltMgr.sys

AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_FLUSH_BUFFERS [F72CDF08] fltMgr.sys

AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_QUERY_VOLUME_INFORMATION [F72CDF08] fltMgr.sys

AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_SET_VOLUME_INFORMATION [F72CDF08] fltMgr.sys

AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_DIRECTORY_CONTROL [F72CDF08] fltMgr.sys

AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_FILE_SYSTEM_CONTROL [F72DA160] fltMgr.sys

AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_DEVICE_CONTROL [F72CDF08] fltMgr.sys

AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_INTERNAL_DEVICE_CONTROL [F72CDF08] fltMgr.sys

AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_SHUTDOWN [F72CDF08] fltMgr.sys

AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_LOCK_CONTROL [F72CDF08] fltMgr.sys

AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_CLEANUP [F72CDF08] fltMgr.sys

AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_CREATE_MAILSLOT [F72D9F70] fltMgr.sys

AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_QUERY_SECURITY [F72CDF08] fltMgr.sys

AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_SET_SECURITY [F72CDF08] fltMgr.sys

AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_POWER [F72CDF08] fltMgr.sys

AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_SYSTEM_CONTROL [F72CDF08] fltMgr.sys

AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_DEVICE_CHANGE [F72CDF08] fltMgr.sys

AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_QUERY_QUOTA [F72CDF08] fltMgr.sys

AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_SET_QUOTA [F72CDF08] fltMgr.sys

AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_CREATE [F2E74810] SYMEVENT.SYS

AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_CREATE_NAMED_PIPE [F2E74810] SYMEVENT.SYS

AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_CLOSE [F2E74810] SYMEVENT.SYS

AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_READ [F2E748A0] SYMEVENT.SYS

AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_WRITE [F2E74900] SYMEVENT.SYS

AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_QUERY_INFORMATION [F2E74810] SYMEVENT.SYS

AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_SET_INFORMATION [F2E74810] SYMEVENT.SYS

AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_QUERY_EA [F2E74810] SYMEVENT.SYS

AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_SET_EA [F2E74810] SYMEVENT.SYS

AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_FLUSH_BUFFERS [F2E74810] SYMEVENT.SYS

AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_QUERY_VOLUME_INFORMATION [F2E74810] SYMEVENT.SYS

AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_SET_VOLUME_INFORMATION [F2E74810] SYMEVENT.SYS

AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_DIRECTORY_CONTROL [F2E74810] SYMEVENT.SYS

AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_FILE_SYSTEM_CONTROL [F2E74810] SYMEVENT.SYS

AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_DEVICE_CONTROL [F2E74810] SYMEVENT.SYS

AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_INTERNAL_DEVICE_CONTROL [F2E74810] SYMEVENT.SYS

AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_SHUTDOWN [F2E74810] SYMEVENT.SYS

AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_LOCK_CONTROL [F2E74810] SYMEVENT.SYS

AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_CLEANUP [F2E74810] SYMEVENT.SYS

AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_CREATE_MAILSLOT [F2E74810] SYMEVENT.SYS

AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_QUERY_SECURITY [F2E74810] SYMEVENT.SYS

AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_SET_SECURITY [F2E74810] SYMEVENT.SYS

AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_POWER [F2E74810] SYMEVENT.SYS

AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_SYSTEM_CONTROL [F2E74810] SYMEVENT.SYS

AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_DEVICE_CHANGE [F2E74810] SYMEVENT.SYS

AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_QUERY_QUOTA [F2E74810] SYMEVENT.SYS

AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_SET_QUOTA [F2E74810] SYMEVENT.SYS

AttachedDevice \Driver\Tcpip \Device\Ip IRP_MJ_CREATE [F2CC48C0] SYMTDI.SYS

AttachedDevice \Driver\Tcpip \Device\Ip IRP_MJ_CREATE_NAMED_PIPE [F2CC48C0] SYMTDI.SYS

AttachedDevice \Driver\Tcpip \Device\Ip IRP_MJ_CLOSE [F2CC48C0] SYMTDI.SYS

AttachedDevice \Driver\Tcpip \Device\Ip IRP_MJ_READ [F2CC48C0] SYMTDI.SYS

AttachedDevice \Driver\Tcpip \Device\Ip IRP_MJ_WRITE [F2CC48C0] SYMTDI.SYS

AttachedDevice \Driver\Tcpip \Device\Ip IRP_MJ_QUERY_INFORMATION [F2CC48C0] SYMTDI.SYS

AttachedDevice \Driver\Tcpip \Device\Ip IRP_MJ_SET_INFORMATION [F2CC48C0] SYMTDI.SYS

AttachedDevice \Driver\Tcpip \Device\Ip IRP_MJ_QUERY_EA [F2CC48C0] SYMTDI.SYS

AttachedDevice \Driver\Tcpip \Device\Ip IRP_MJ_SET_EA [F2CC48C0] SYMTDI.SYS

AttachedDevice \Driver\Tcpip \Device\Ip IRP_MJ_FLUSH_BUFFERS [F2CC48C0] SYMTDI.SYS

AttachedDevice \Driver\Tcpip \Device\Ip IRP_MJ_QUERY_VOLUME_INFORMATION [F2CC48C0] SYMTDI.SYS

AttachedDevice \Driver\Tcpip \Device\Ip IRP_MJ_SET_VOLUME_INFORMATION [F2CC48C0] SYMTDI.SYS

AttachedDevice \Driver\Tcpip \Device\Ip IRP_MJ_DIRECTORY_CONTROL [F2CC48C0] SYMTDI.SYS

AttachedDevice \Driver\Tcpip \Device\Ip IRP_MJ_FILE_SYSTEM_CONTROL [F2CC48C0] SYMTDI.SYS

AttachedDevice \Driver\Tcpip \Device\Ip IRP_MJ_DEVICE_CONTROL [F2CC48C0] SYMTDI.SYS

AttachedDevice \Driver\Tcpip \Device\Ip IRP_MJ_INTERNAL_DEVICE_CONTROL [F2CC48C0] SYMTDI.SYS

AttachedDevice \Driver\Tcpip \Device\Ip IRP_MJ_SHUTDOWN [F2CC48C0] SYMTDI.SYS

AttachedDevice \Driver\Tcpip \Device\Ip IRP_MJ_LOCK_CONTROL [F2CC48C0] SYMTDI.SYS

AttachedDevice \Driver\Tcpip \Device\Ip IRP_MJ_CLEANUP [F2CC48C0] SYMTDI.SYS

AttachedDevice \Driver\Tcpip \Device\Ip IRP_MJ_CREATE_MAILSLOT [F2CC48C0] SYMTDI.SYS

AttachedDevice \Driver\Tcpip \Device\Ip IRP_MJ_QUERY_SECURITY [F2CC48C0] SYMTDI.SYS

AttachedDevice \Driver\Tcpip \Device\Ip IRP_MJ_SET_SECURITY [F2CC48C0] SYMTDI.SYS

AttachedDevice \Driver\Tcpip \Device\Ip IRP_MJ_POWER [F2CC48C0] SYMTDI.SYS

AttachedDevice \Driver\Tcpip \Device\Ip IRP_MJ_SYSTEM_CONTROL [F2CC48C0] SYMTDI.SYS

AttachedDevice \Driver\Tcpip \Device\Ip IRP_MJ_DEVICE_CHANGE [F2CC48C0] SYMTDI.SYS

AttachedDevice \Driver\Tcpip \Device\Ip IRP_MJ_QUERY_QUOTA [F2CC48C0] SYMTDI.SYS

AttachedDevice \Driver\Tcpip \Device\Ip IRP_MJ_SET_QUOTA [F2CC48C0] SYMTDI.SYS

AttachedDevice \Driver\Tcpip \Device\Tcp IRP_MJ_CREATE [F2CC48C0] SYMTDI.SYS

AttachedDevice \Driver\Tcpip \Device\Tcp IRP_MJ_CREATE_NAMED_PIPE [F2CC48C0] SYMTDI.SYS

AttachedDevice \Driver\Tcpip \Device\Tcp IRP_MJ_CLOSE [F2CC48C0] SYMTDI.SYS

AttachedDevice \Driver\Tcpip \Device\Tcp IRP_MJ_READ [F2CC48C0] SYMTDI.SYS

AttachedDevice \Driver\Tcpip \Device\Tcp IRP_MJ_WRITE [F2CC48C0] SYMTDI.SYS

AttachedDevice \Driver\Tcpip \Device\Tcp IRP_MJ_QUERY_INFORMATION [F2CC48C0] SYMTDI.SYS

AttachedDevice \Driver\Tcpip \Device\Tcp IRP_MJ_SET_INFORMATION [F2CC48C0] SYMTDI.SYS

AttachedDevice \Driver\Tcpip \Device\Tcp IRP_MJ_QUERY_EA [F2CC48C0] SYMTDI.SYS

AttachedDevice \Driver\Tcpip \Device\Tcp IRP_MJ_SET_EA [F2CC48C0] SYMTDI.SYS

AttachedDevice \Driver\Tcpip \Device\Tcp IRP_MJ_FLUSH_BUFFERS [F2CC48C0] SYMTDI.SYS

AttachedDevice \Driver\Tcpip \Device\Tcp IRP_MJ_QUERY_VOLUME_INFORMATION [F2CC48C0] SYMTDI.SYS

AttachedDevice \Driver\Tcpip \Device\Tcp IRP_MJ_SET_VOLUME_INFORMATION [F2CC48C0] SYMTDI.SYS

AttachedDevice \Driver\Tcpip \Device\Tcp IRP_MJ_DIRECTORY_CONTROL [F2CC48C0] SYMTDI.SYS

AttachedDevice \Driver\Tcpip \Device\Tcp IRP_MJ_FILE_SYSTEM_CONTROL [F2CC48C0] SYMTDI.SYS

AttachedDevice \Driver\Tcpip \Device\Tcp IRP_MJ_DEVICE_CONTROL [F2CC48C0] SYMTDI.SYS

AttachedDevice \Driver\Tcpip \Device\Tcp IRP_MJ_INTERNAL_DEVICE_CONTROL [F2CC48C0] SYMTDI.SYS

AttachedDevice \Driver\Tcpip \Device\Tcp IRP_MJ_SHUTDOWN [F2CC48C0] SYMTDI.SYS

AttachedDevice \Driver\Tcpip \Device\Tcp IRP_MJ_LOCK_CONTROL [F2CC48C0] SYMTDI.SYS

AttachedDevice \Driver\Tcpip \Device\Tcp IRP_MJ_CLEANUP [F2CC48C0] SYMTDI.SYS

AttachedDevice \Driver\Tcpip \Device\Tcp IRP_MJ_CREATE_MAILSLOT [F2CC48C0] SYMTDI.SYS

AttachedDevice \Driver\Tcpip \Device\Tcp IRP_MJ_QUERY_SECURITY [F2CC48C0] SYMTDI.SYS

AttachedDevice \Driver\Tcpip \Device\Tcp IRP_MJ_SET_SECURITY [F2CC48C0] SYMTDI.SYS

AttachedDevice \Driver\Tcpip \Device\Tcp IRP_MJ_POWER [F2CC48C0] SYMTDI.SYS

AttachedDevice \Driver\Tcpip \Device\Tcp IRP_MJ_SYSTEM_CONTROL [F2CC48C0] SYMTDI.SYS

AttachedDevice \Driver\Tcpip \Device\Tcp IRP_MJ_DEVICE_CHANGE [F2CC48C0] SYMTDI.SYS

AttachedDevice \Driver\Tcpip \Device\Tcp IRP_MJ_QUERY_QUOTA [F2CC48C0] SYMTDI.SYS

AttachedDevice \Driver\Tcpip \Device\Tcp IRP_MJ_SET_QUOTA [F2CC48C0] SYMTDI.SYS

AttachedDevice \Driver\Tcpip \Device\Udp IRP_MJ_CREATE [F2CC48C0] SYMTDI.SYS

AttachedDevice \Driver\Tcpip \Device\Udp IRP_MJ_CREATE_NAMED_PIPE [F2CC48C0] SYMTDI.SYS

AttachedDevice \Driver\Tcpip \Device\Udp IRP_MJ_CLOSE [F2CC48C0] SYMTDI.SYS

AttachedDevice \Driver\Tcpip \Device\Udp IRP_MJ_READ [F2CC48C0] SYMTDI.SYS

AttachedDevice \Driver\Tcpip \Device\Udp IRP_MJ_WRITE [F2CC48C0] SYMTDI.SYS

AttachedDevice \Driver\Tcpip \Device\Udp IRP_MJ_QUERY_INFORMATION [F2CC48C0] SYMTDI.SYS

AttachedDevice \Driver\Tcpip \Device\Udp IRP_MJ_SET_INFORMATION [F2CC48C0] SYMTDI.SYS

AttachedDevice \Driver\Tcpip \Device\Udp IRP_MJ_QUERY_EA [F2CC48C0] SYMTDI.SYS

AttachedDevice \Driver\Tcpip \Device\Udp IRP_MJ_SET_EA [F2CC48C0] SYMTDI.SYS

AttachedDevice \Driver\Tcpip \Device\Udp IRP_MJ_FLUSH_BUFFERS [F2CC48C0] SYMTDI.SYS

AttachedDevice \Driver\Tcpip \Device\Udp IRP_MJ_QUERY_VOLUME_INFORMATION [F2CC48C0] SYMTDI.SYS

AttachedDevice \Driver\Tcpip \Device\Udp IRP_MJ_SET_VOLUME_INFORMATION [F2CC48C0] SYMTDI.SYS

AttachedDevice \Driver\Tcpip \Device\Udp IRP_MJ_DIRECTORY_CONTROL [F2CC48C0] SYMTDI.SYS

AttachedDevice \Driver\Tcpip \Device\Udp IRP_MJ_FILE_SYSTEM_CONTROL [F2CC48C0] SYMTDI.SYS

AttachedDevice \Driver\Tcpip \Device\Udp IRP_MJ_DEVICE_CONTROL [F2CC48C0] SYMTDI.SYS

AttachedDevice \Driver\Tcpip \Device\Udp IRP_MJ_INTERNAL_DEVICE_CONTROL [F2CC48C0] SYMTDI.SYS

AttachedDevice \Driver\Tcpip \Device\Udp IRP_MJ_SHUTDOWN [F2CC48C0] SYMTDI.SYS

AttachedDevice \Driver\Tcpip \Device\Udp IRP_MJ_LOCK_CONTROL [F2CC48C0] SYMTDI.SYS

AttachedDevice \Driver\Tcpip \Device\Udp IRP_MJ_CLEANUP [F2CC48C0] SYMTDI.SYS

AttachedDevice \Driver\Tcpip \Device\Udp IRP_MJ_CREATE_MAILSLOT [F2CC48C0] SYMTDI.SYS

AttachedDevice \Driver\Tcpip \Device\Udp IRP_MJ_QUERY_SECURITY [F2CC48C0] SYMTDI.SYS

AttachedDevice \Driver\Tcpip \Device\Udp IRP_MJ_SET_SECURITY [F2CC48C0] SYMTDI.SYS

AttachedDevice \Driver\Tcpip \Device\Udp IRP_MJ_POWER [F2CC48C0] SYMTDI.SYS

AttachedDevice \Driver\Tcpip \Device\Udp IRP_MJ_SYSTEM_CONTROL [F2CC48C0] SYMTDI.SYS

AttachedDevice \Driver\Tcpip \Device\Udp IRP_MJ_DEVICE_CHANGE [F2CC48C0] SYMTDI.SYS

AttachedDevice \Driver\Tcpip \Device\Udp IRP_MJ_QUERY_QUOTA [F2CC48C0] SYMTDI.SYS

AttachedDevice \Driver\Tcpip \Device\Udp IRP_MJ_SET_QUOTA [F2CC48C0] SYMTDI.SYS

AttachedDevice \Driver\Tcpip \Device\RawIp IRP_MJ_CREATE [F2CC48C0] SYMTDI.SYS

AttachedDevice \Driver\Tcpip \Device\RawIp IRP_MJ_CREATE_NAMED_PIPE [F2CC48C0] SYMTDI.SYS

AttachedDevice \Driver\Tcpip \Device\RawIp IRP_MJ_CLOSE [F2CC48C0] SYMTDI.SYS

AttachedDevice \Driver\Tcpip \Device\RawIp IRP_MJ_READ [F2CC48C0] SYMTDI.SYS

AttachedDevice \Driver\Tcpip \Device\RawIp IRP_MJ_WRITE [F2CC48C0] SYMTDI.SYS

AttachedDevice \Driver\Tcpip \Device\RawIp IRP_MJ_QUERY_INFORMATION [F2CC48C0] SYMTDI.SYS

AttachedDevice \Driver\Tcpip \Device\RawIp IRP_MJ_SET_INFORMATION [F2CC48C0] SYMTDI.SYS

AttachedDevice \Driver\Tcpip \Device\RawIp IRP_MJ_QUERY_EA [F2CC48C0] SYMTDI.SYS

AttachedDevice \Driver\Tcpip \Device\RawIp IRP_MJ_SET_EA [F2CC48C0] SYMTDI.SYS

AttachedDevice \Driver\Tcpip \Device\RawIp IRP_MJ_FLUSH_BUFFERS [F2CC48C0] SYMTDI.SYS

AttachedDevice \Driver\Tcpip \Device\RawIp IRP_MJ_QUERY_VOLUME_INFORMATION [F2CC48C0] SYMTDI.SYS

AttachedDevice \Driver\Tcpip \Device\RawIp IRP_MJ_SET_VOLUME_INFORMATION [F2CC48C0] SYMTDI.SYS

AttachedDevice \Driver\Tcpip \Device\RawIp IRP_MJ_DIRECTORY_CONTROL [F2CC48C0] SYMTDI.SYS

AttachedDevice \Driver\Tcpip \Device\RawIp IRP_MJ_FILE_SYSTEM_CONTROL [F2CC48C0] SYMTDI.SYS

AttachedDevice \Driver\Tcpip \Device\RawIp IRP_MJ_DEVICE_CONTROL [F2CC48C0] SYMTDI.SYS

AttachedDevice \Driver\Tcpip \Device\RawIp IRP_MJ_INTERNAL_DEVICE_CONTROL [F2CC48C0] SYMTDI.SYS

AttachedDevice \Driver\Tcpip \Device\RawIp IRP_MJ_SHUTDOWN [F2CC48C0] SYMTDI.SYS

AttachedDevice \Driver\Tcpip \Device\RawIp IRP_MJ_LOCK_CONTROL [F2CC48C0] SYMTDI.SYS

AttachedDevice \Driver\Tcpip \Device\RawIp IRP_MJ_CLEANUP [F2CC48C0] SYMTDI.SYS

AttachedDevice \Driver\Tcpip \Device\RawIp IRP_MJ_CREATE_MAILSLOT [F2CC48C0] SYMTDI.SYS

AttachedDevice \Driver\Tcpip \Device\RawIp IRP_MJ_QUERY_SECURITY [F2CC48C0] SYMTDI.SYS

AttachedDevice \Driver\Tcpip \Device\RawIp IRP_MJ_SET_SECURITY [F2CC48C0] SYMTDI.SYS

AttachedDevice \Driver\Tcpip \Device\RawIp IRP_MJ_POWER [F2CC48C0] SYMTDI.SYS

AttachedDevice \Driver\Tcpip \Device\RawIp IRP_MJ_SYSTEM_CONTROL [F2CC48C0] SYMTDI.SYS

AttachedDevice \Driver\Tcpip \Device\RawIp IRP_MJ_DEVICE_CHANGE [F2CC48C0] SYMTDI.SYS

AttachedDevice \Driver\Tcpip \Device\RawIp IRP_MJ_QUERY_QUOTA [F2CC48C0] SYMTDI.SYS

AttachedDevice \Driver\Tcpip \Device\RawIp IRP_MJ_SET_QUOTA [F2CC48C0] SYMTDI.SYS


---- EOF - GMER 1.0.13 ----

3 niewiem jak zrobić:P

Najpierw zaznacz tylko usługi reszte odhacz a potem pokaż wszystko powinno być OKI

Log z “usługi” + “pokaż wszystko”

http://wklej.org/id/00c1730e48

Prosze.

Hm nic nie widzę, daj log z DSS - do pobrania plik na dole - http://forum.dobreprogramy.pl/viewtopic.php?t=36654 oraz

Pobierz program SDFix

Oto

DSS (extra) :

http://wklej.org/id/fd37fa910c

DSS (main) :

http://wklej.org/id/3dd9a153ab

Apropo wyskkuje mi teraz błąd z Help.exe. Plik nie jest do “written” …

Jest już późna pora, więc pewnie już nie wszystko dostrzegam, ale widzę, że nic z usuwania się nie udało.

A więc powtórka z rozrywki:

Ten w/w wpis sfiksuj w Hijacku:

>>Hijack>>scan(Do a system scan only)>>zaznacz go >> Fix checked.

>>Start >>> Uruchom >>> wybierz (lub wpisz) cmd >> zastosować te komendy (po każdej wciśnij “ENTER”):

Potem nowy log z DSS.

jessi

Hmm robie tak jak mówisz. Dusze Fixed… I znika lista. Wiec skanuje jeszcze raz a to tam jest… potem przeszedłem do “cmd” i jak pisze komendy wychodzi to :

Pobierz The Avenger. Wypakuj => uruchom => zaznacz opcję Input script manually => kliknij w taką lupkę => w okienku, które się otworzy wklej:

kliknij klawisz Done => teraz kliknij na zielone światełko => powinna pojawić się pewna informacja i kliknij OK (teraz restart).

Ok zrobie tak, ostatnio zaczół ppojawiać się błąd “Help.exe” Wspomniałem o nim w poprzednim poście Oto zdjęcie :

Nowy log z DSS + raport z The Avenger