"svchost.exe - błąd aplikacji"

[Semtox]

Witam!!!
Mój problem wygląda tak: Gdy łącze się z internetem (NEO) wszystko jest ok po chwili jednak wyskakuje mi takie okienko:
http://img106.imageshack.us/img106/8214/beztytuufk1.png
gdy nacisnę ok pada totalnie net. Podczas poszukiwań rozwiązania znalazłem podobny problem jednak tam chodziło o wirusa zwanego Sterownikiem Modemu (WINDOWS\autoclk.exe) jednak u mnie on nie występuje. Za to zastanowiły mnie trzy wpisy w logu

Kod: Zaznacz wszystko

O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE

Zwłaszcza ten ostatni mi się nie podoba
dołączam całego Loga i proszę o pomoc

Kod: Zaznacz wszystko

Logfile of HijackThis v1.99.1
Scan saved at 11:52:52, on 2007-07-02
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
D:\Serwer\Apache\bin\httpd.exe
C:\WINDOWS\system32\CTsvcCDA.exe
C:\WINDOWS\system32\crypserv.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
D:\Serwer\Apache\bin\httpd.exe
D:\Serwer\MySQL\bin\mysqld-nt.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\CyberLink\Shared files\RichVideo.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\PS Tray Factory\PSTrayFactory.EXE
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nTrayFw.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\Winamp\winampa.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\AutoConnect\AutoConnect.exe
C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe
C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
D:\Serwer\Apache\bin\ApacheMonitor.exe
C:\Program Files\4t Tray Minimizer\4t-min.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\ZoomText 8.1\Zt8.exe
C:\Program Files\Migajek Software\HateML\HateML.exe
C:\Program Files\eMule\emule.exe
C:\Program Files\Winamp\winamp.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\WinRAR\WinRAR.exe
C:\DOCUME~1\xxx\USTAWI~1\Temp\Rar$EX00.453\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O2 - BHO: AH IE BHO - {10384d0e-2bc1-48b6-844b-ad0e9e6d2511} - C:\Program Files\ZoomText 8.1\AHOI\ah_ie_bho.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O4 - HKLM\..\Run: [nTrayFw] C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nTrayFw.exe
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [JMB36X Configure] C:\WINDOWS\system32\JMRaidTool.exe boot
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [TrayFactory] C:\Program Files\PS Tray Factory\PSTrayFactory.EXE /start
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [LanguageShortcut] "C:\Program Files\CyberLink\PowerDVD\Language\Language.exe"
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\RunOnce: [TrayFactory] C:\Program Files\PS Tray Factory\PSTrayFactory.EXE /start
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [AutoConnect] C:\Program Files\AutoConnect\AutoConnect.exe
O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray
O4 - HKCU\..\Run: [CTSyncU.exe] "C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe"
O4 - Startup: 4t Tray Minimizer.lnk = C:\Program Files\4t Tray Minimizer\4t-min.exe
O4 - Startup: OpenOffice.org 2.0.lnk = C:\Program Files\OpenOffice.org 2.0\program\quickstart.exe
O4 - Startup: Watch.lnk = C:\WINDOWS\twain_32\A4CIS\WATCH.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
O4 - Global Startup: Adobe Reader Synchronizer.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe
O4 - Global Startup: DSLMON.lnk = ?
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Monitor Apache Servers.lnk = D:\Serwer\Apache\bin\ApacheMonitor.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O17 - HKLM\System\CCS\Services\Tcpip\..\{2ADB12E8-930D-4204-A8EC-67907C79833C}: NameServer = 194.204.159.1 217.98.63.164
O17 - HKLM\System\CS1\Services\Tcpip\..\{2ADB12E8-930D-4204-A8EC-67907C79833C}: NameServer = 194.204.159.1 217.98.63.164
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Apache2 - Unknown owner - D:\Serwer\Apache\bin\httpd.exe" -k runservice (file missing)
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: Crypkey License - Kenonic Controls Ltd. - C:\WINDOWS\SYSTEM32\crypserv.exe
O23 - Service: ForceWare Intelligent Application Manager (IAM) - Unknown owner - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe
O23 - Service: Forceware Web Interface (ForcewareWebInterface) - Unknown owner - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe" -k runservice (file missing)
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: SQL Server (SQLEXPRESS) (MSSQL$SQLEXPRESS) - Unknown owner - C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe" -sSQLEXPRESS (file missing)
O23 - Service: MySQL - Unknown owner - D:\Serwer\MySQL\bin\mysqld-nt".exe (file missing)
O23 - Service: ForceWare IP service (nSvcIp) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe
O23 - Service: ForceWare user log service (nSvcLog) - NVIDIA - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared files\RichVideo.exe
O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe


[Dzi@dek]

Zafixuj ten wpis.

O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE

Możesz ale nie musisz usuwać tego - To są pliki od Realteka.
Reszta czysta.

[Semtox]

Tom@szek usunąłem ten wpis i plik z nim powiązany ale problem nie zniknął. Dodaje Nowy Log

Kod: Zaznacz wszystko

Logfile of HijackThis v1.99.1
Scan saved at 12:45:11, on 2007-07-02
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
D:\Serwer\Apache\bin\httpd.exe
C:\WINDOWS\system32\CTsvcCDA.exe
C:\WINDOWS\system32\crypserv.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
D:\Serwer\Apache\bin\httpd.exe
D:\Serwer\MySQL\bin\mysqld-nt.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\CyberLink\Shared files\RichVideo.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe
C:\Program Files\PS Tray Factory\PSTrayFactory.EXE
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nTrayFw.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\Winamp\winampa.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\AutoConnect\AutoConnect.exe
C:\Program Files\Gadu-Gadu\gg.exe
C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
D:\Serwer\Apache\bin\ApacheMonitor.exe
C:\Program Files\4t Tray Minimizer\4t-min.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\ZoomText 8.1\Zt8.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Winamp\winamp.exe
C:\Program Files\WinRAR\WinRAR.exe
C:\DOCUME~1\xxx\USTAWI~1\Temp\Rar$EX00.937\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O2 - BHO: AH IE BHO - {10384d0e-2bc1-48b6-844b-ad0e9e6d2511} - C:\Program Files\ZoomText 8.1\AHOI\ah_ie_bho.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O4 - HKLM\..\Run: [nTrayFw] C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nTrayFw.exe
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [JMB36X Configure] C:\WINDOWS\system32\JMRaidTool.exe boot
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [TrayFactory] C:\Program Files\PS Tray Factory\PSTrayFactory.EXE /start
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [LanguageShortcut] "C:\Program Files\CyberLink\PowerDVD\Language\Language.exe"
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\RunOnce: [TrayFactory] C:\Program Files\PS Tray Factory\PSTrayFactory.EXE /start
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [AutoConnect] C:\Program Files\AutoConnect\AutoConnect.exe
O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray
O4 - HKCU\..\Run: [CTSyncU.exe] "C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe"
O4 - Startup: 4t Tray Minimizer.lnk = C:\Program Files\4t Tray Minimizer\4t-min.exe
O4 - Startup: OpenOffice.org 2.0.lnk = C:\Program Files\OpenOffice.org 2.0\program\quickstart.exe
O4 - Startup: Watch.lnk = C:\WINDOWS\twain_32\A4CIS\WATCH.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
O4 - Global Startup: Adobe Reader Synchronizer.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe
O4 - Global Startup: DSLMON.lnk = ?
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Monitor Apache Servers.lnk = D:\Serwer\Apache\bin\ApacheMonitor.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O17 - HKLM\System\CCS\Services\Tcpip\..\{2ADB12E8-930D-4204-A8EC-67907C79833C}: NameServer = 194.204.159.1 217.98.63.164
O17 - HKLM\System\CS1\Services\Tcpip\..\{2ADB12E8-930D-4204-A8EC-67907C79833C}: NameServer = 194.204.159.1 217.98.63.164
O17 - HKLM\System\CS2\Services\Tcpip\..\{2ADB12E8-930D-4204-A8EC-67907C79833C}: NameServer = 194.204.159.1 217.98.63.164
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Apache2 - Unknown owner - D:\Serwer\Apache\bin\httpd.exe" -k runservice (file missing)
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: Crypkey License - Kenonic Controls Ltd. - C:\WINDOWS\SYSTEM32\crypserv.exe
O23 - Service: ForceWare Intelligent Application Manager (IAM) - Unknown owner - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe
O23 - Service: Forceware Web Interface (ForcewareWebInterface) - Unknown owner - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe" -k runservice (file missing)
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: SQL Server (SQLEXPRESS) (MSSQL$SQLEXPRESS) - Unknown owner - C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe" -sSQLEXPRESS (file missing)
O23 - Service: MySQL - Unknown owner - D:\Serwer\MySQL\bin\mysqld-nt".exe (file missing)
O23 - Service: ForceWare IP service (nSvcIp) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe
O23 - Service: ForceWare user log service (nSvcLog) - NVIDIA - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared files\RichVideo.exe
O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe


[wojtas]

daj loga z :

http://download.bleepingcomputer.com/sUBs/ComboFix.exe

[Semtox]

Log z programu ComboFiX

Kod: Zaznacz wszystko

"xxx" - 2007-07-02 13:33:42 - ComboFix 07-06-27.7 - Dodatek Service Pack 2  NTFS 


(((((((((((((((((((((((((   Files Created from 2007-06-02 to 2007-07-02  )))))))))))))))))))))))))))))))


2007-06-27 22:29   <DIR>   d--------   C:\Program Files\jv16 PowerTools
2007-06-27 22:27   <DIR>   d--------   C:\Program Files\Windows Installer Clean Up
2007-06-27 22:27   <DIR>   d--------   C:\Program Files\MSECACHE
2007-06-23 13:11   90,112   --a------   C:\WINDOWS\system32\fribidi.dll
2007-06-23 13:11   90,112   --a------   C:\WINDOWS\fribidi.dll
2007-06-23 13:11   57,410   --a------   C:\WINDOWS\system32\php5apache_hooks.dll
2007-06-23 13:11   57,410   --a------   C:\WINDOWS\php5apache_hooks.dll
2007-06-23 13:11   57,344   --a------   C:\WINDOWS\system32\msql.dll
2007-06-23 13:11   57,344   --a------   C:\WINDOWS\msql.dll
2007-06-23 13:11   417,792   --a------   C:\WINDOWS\system32\fdftk.dll
2007-06-23 13:11   417,792   --a------   C:\WINDOWS\fdftk.dll
2007-06-23 13:11   4,775,992   --a------   C:\WINDOWS\php5ts.dll
2007-06-23 13:11   385,024   --a------   C:\WINDOWS\system32\libswish-e.dll
2007-06-23 13:11   385,024   --a------   C:\WINDOWS\libswish-e.dll
2007-06-23 13:11   36,934   --a------   C:\WINDOWS\system32\php5apache2_2_filter.dll
2007-06-23 13:11   36,934   --a------   C:\WINDOWS\php5apache2_2_filter.dll
2007-06-23 13:11   36,932   --a------   C:\WINDOWS\system32\php5apache2_filter.dll
2007-06-23 13:11   36,932   --a------   C:\WINDOWS\php5apache2_filter.dll
2007-06-23 13:11   36,927   --a------   C:\WINDOWS\system32\php5apache2_2.dll
2007-06-23 13:11   36,927   --a------   C:\WINDOWS\php5apache2_2.dll
2007-06-23 13:11   36,925   --a------   C:\WINDOWS\system32\php5apache2.dll
2007-06-23 13:11   36,925   --a------   C:\WINDOWS\php5apache2.dll
2007-06-23 13:11   36,924   --a------   C:\WINDOWS\system32\php5apache.dll
2007-06-23 13:11   36,924   --a------   C:\WINDOWS\php5apache.dll
2007-06-23 13:11   346,624   --a------   C:\WINDOWS\system32\gds32.dll
2007-06-23 13:11   346,624   --a------   C:\WINDOWS\gds32.dll
2007-06-23 13:11   28,731   --a------   C:\WINDOWS\system32\php5nsapi.dll
2007-06-23 13:11   28,731   --a------   C:\WINDOWS\system32\php5isapi.dll
2007-06-23 13:11   28,731   --a------   C:\WINDOWS\php5nsapi.dll
2007-06-23 13:11   28,731   --a------   C:\WINDOWS\php5isapi.dll
2007-06-23 13:11   278,800   --a------   C:\WINDOWS\ntwdblib.dll
2007-06-23 13:11   200,704   --a------   C:\WINDOWS\system32\ssleay32.dll
2007-06-23 13:11   166,912   --a------   C:\WINDOWS\system32\libmcrypt.dll
2007-06-23 13:11   166,912   --a------   C:\WINDOWS\libmcrypt.dll
2007-06-23 13:11   165,643   --a------   C:\WINDOWS\system32\libmhash.dll
2007-06-23 13:11   165,643   --a------   C:\WINDOWS\libmhash.dll
2007-06-23 13:11   1,531,904   --a------   C:\WINDOWS\libmysql.dll
2007-06-23 13:11   1,097,728   --a------   C:\WINDOWS\system32\libeay32.dll
2007-06-22 22:53   4,775,992   --a------   C:\WINDOWS\system32\php5ts.dll
2007-06-22 22:53   278,800   --a------   C:\WINDOWS\system32\ntwdblib.dll
2007-06-22 22:37   <DIR>   d--------   C:\Program Files\Apache Software Foundation
2007-06-22 20:49   1,531,904   --a------   C:\WINDOWS\system32\libmySQL.dll
2007-06-22 16:42   <DIR>   d--------   C:\Program Files\EasyPHP 2.0b1
2007-06-20 19:08   41,984   ---------   C:\WINDOWS\Ctregrun.exe
2007-06-20 19:08   <DIR>   d--------   C:\DOCUME~1\xxx\DANEAP~1\Creative
2007-06-20 19:03   <DIR>   d--------   C:\Program Files\Audible
2007-06-20 19:00   44,032   ---------   C:\WINDOWS\system32\CTSVCCDA.EXE
2007-06-20 19:00   25,088   ---------   C:\WINDOWS\system32\CTSVCCTL.EXE
2007-06-20 18:59   221,184   --a------   C:\WINDOWS\system32\wmpns.dll
2007-06-20 18:59   <DIR>   d--h-----   C:\Program Files\Creative Installation Information
2007-06-20 18:59   <DIR>   d--------   C:\Program Files\Common Files\Creative
2007-06-20 18:57   <DIR>   d--------   C:\Program Files\Creative
2007-06-20 18:57   <DIR>   d--------   C:\DOCUME~1\ALLUSE~1\DANEAP~1\Creative
2007-06-16 23:52   <DIR>   d--------   C:\WINDOWS\system32\LogFiles
2007-06-16 23:16   <DIR>   d--------   C:\Program Files\UltraISO
2007-06-16 23:16   <DIR>   d--------   C:\Program Files\Common Files\EZB Systems
2007-06-16 21:48   64,000   --a------   C:\WINDOWS\system32\drivers\e4ldr.sys
2007-06-16 21:48   50,007   --a------   C:\WINDOWS\system32\drivers\adildr.sys
2007-06-16 21:48   46,892   --a------   C:\WINDOWS\system32\ADADIX16.DLL
2007-06-16 21:48   4,981   --a------   C:\WINDOWS\system32\ADADIX2K.DLL
2007-06-16 21:48   24,576   --a------   C:\WINDOWS\enddisk32.exe
2007-06-16 21:48   22,395   --a------   C:\WINDOWS\system32\drivers\fpga.bin
2007-06-16 21:48   176,128   --a------   C:\WINDOWS\autoclk.exe
2007-06-16 21:48   155,648   --a------   C:\WINDOWS\system32\adadix32.dll
2007-06-16 21:48   152,220   --a------   C:\WINDOWS\system32\drivers\L1E4I2.BIN
2007-06-16 21:48   152,220   --a------   C:\WINDOWS\system32\drivers\L1E4I1.BIN
2007-06-16 21:48   152,220   --a------   C:\WINDOWS\system32\drivers\L1E4I0.BIN
2007-06-16 21:48   152,132   --a------   C:\WINDOWS\system32\drivers\L1E4P2.BIN
2007-06-16 21:48   152,132   --a------   C:\WINDOWS\system32\drivers\L1E4P1.BIN
2007-06-16 21:48   152,132   --a------   C:\WINDOWS\system32\drivers\L1E4P0.BIN
2007-06-16 21:48   152,126   --a------   C:\WINDOWS\system32\drivers\L1E9P2.BIN
2007-06-16 21:48   152,126   --a------   C:\WINDOWS\system32\drivers\L1E9P1.BIN
2007-06-16 21:48   152,126   --a------   C:\WINDOWS\system32\drivers\L1E9P0.BIN
2007-06-16 21:48   152,126   --a------   C:\WINDOWS\system32\drivers\L1E9I2.BIN
2007-06-16 21:48   152,126   --a------   C:\WINDOWS\system32\drivers\L1E9I1.BIN
2007-06-16 21:48   152,126   --a------   C:\WINDOWS\system32\drivers\L1E9I0.BIN
2007-06-16 21:48   152,036   --a------   C:\WINDOWS\system32\drivers\L1E4D2.BIN
2007-06-16 21:48   152,034   --a------   C:\WINDOWS\system32\drivers\L1E4D1.BIN
2007-06-16 21:48   152,034   --a------   C:\WINDOWS\system32\drivers\L1E4D0.BIN
2007-06-16 21:48   143,360   --a------   C:\WINDOWS\adiras.exe
2007-06-16 21:48   135,168   --a------   C:\WINDOWS\system32\unaddrv.exe
2007-06-16 21:48   127,456   --a------   C:\WINDOWS\system32\IPDETECT.EXE
2007-06-16 21:48   126,976   --a------   C:\WINDOWS\system32\coclassfast.dll
2007-06-16 21:48   126,489   --a------   C:\WINDOWS\system32\drivers\adiusbaw.sys
2007-06-16 21:48   116,992   --a------   C:\WINDOWS\system32\drivers\e4usbaw.sys
2007-06-09 23:46   306,688   --a------   C:\WINDOWS\IsUninst.exe
2007-06-04 16:10   212,480   --a------   C:\WINDOWS\PCDLIB32.DLL
2007-06-04 16:10   11,264   --a------   C:\WINDOWS\Ulead iPhoto Plus 4.SCR
2007-06-04 16:09   <DIR>   d--------   C:\WINDOWS\ULEAD.DAT
2007-06-04 16:09   <DIR>   d--------   C:\Program Files\iPhoto Plus 4
2007-06-04 16:08   26,112   --a------   C:\WINDOWS\system32\PIXTHK32.DLL
2007-06-04 16:08   24,624   --a------   C:\WINDOWS\system32\PIXTHK16.DLL
2007-06-04 16:08   24,064   --a------   C:\WINDOWS\system32\PIXPERM.DLL
2007-06-04 16:08   174,080   --a------   C:\WINDOWS\system32\PIXDFLTN.DLL
2007-06-04 16:08   17,920   --a------   C:\WINDOWS\system32\PIXPERMN.DLL
2007-06-04 16:08   152,576   --a------   C:\WINDOWS\system32\PIXDFLT.DLL
2007-06-04 16:08   12,126   --a------   C:\WINDOWS\system32\PIXPCZ.DLL
2007-06-04 16:08   11,934   --a------   C:\WINDOWS\system32\PIXPNR.DLL
2007-06-04 16:08   <DIR>   d--------   C:\WINDOWS\pixtran
2007-06-04 16:08   <DIR>   d--------   C:\Program Files\TextBridge Classic


((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-07-02 11:34:27   --------   d-----w   C:\Program Files\ZoomText 8.1
2007-07-02 11:32:06   --------   d-----w   C:\Program Files\AutoConnect
2007-07-02 10:01:43   --------   d-----w   C:\Program Files\eMule
2007-06-27 20:43:11   --------   d--h--w   C:\Program Files\InstallShield Installation Information
2007-06-26 11:48:19   --------   d-----w   C:\DOCUME~1\xxx\DANEAP~1\FileZilla
2007-06-24 14:49:21   --------   d-----w   C:\DOCUME~1\xxx\DANEAP~1\Skype
2007-06-24 10:00:07   --------   d-----w   C:\DOCUME~1\xxx\DANEAP~1\OpenOffice.org2
2007-06-24 09:27:12   --------   d-----w   C:\Program Files\Winamp
2007-06-04 09:50:52   --------   d-----w   C:\Program Files\4t Tray Minimizer
2007-06-03 13:26:52   --------   d-----w   C:\Program Files\HP
2007-05-31 22:30:36   --------   d-----w   C:\Program Files\Restorator 2007
2007-05-28 21:02:31   --------   d-----w   C:\DOCUME~1\xxx\DANEAP~1\Design Science
2007-05-28 21:02:25   --------   d-----w   C:\Program Files\MathType
2007-05-25 14:35:48   --------   d-----w   C:\Program Files\Skype
2007-05-25 14:35:46   --------   d-----w   C:\Program Files\Common Files\Skype
2007-05-23 16:39:40   1,891   ----a-w   C:\WINDOWS\mozver.dat
2007-05-23 14:37:27   --------   d-----w   C:\Program Files\Common Files\Borland Shared
2007-05-23 14:36:30   --------   d-----w   C:\Program Files\Borland
2007-05-20 18:44:57   --------   d-----w   C:\Program Files\DC++
2007-05-18 17:46:38   --------   d-----w   C:\Program Files\SmartTRAK
2007-05-18 17:43:33   --------   d-----w   C:\DOCUME~1\xxx\DANEAP~1\Uwatec
2007-05-16 16:06:59   --------   d-----w   C:\Program Files\Microsoft SQL Server
2007-05-16 16:06:52   91,872   ----a-w   C:\WINDOWS\system32\perfc015.dat
2007-05-16 16:06:52   494,712   ----a-w   C:\WINDOWS\system32\perfh015.dat
2007-05-16 16:03:11   --------   d-----w   C:\Program Files\Microsoft Visual Studio 8
2007-05-16 14:46:53   --------   d-----w   C:\Program Files\CodeBlocks
2007-05-15 14:50:27   --------   d-----w   C:\Program Files\IconXP
2007-05-15 05:44:25   --------   d-----w   C:\Program Files\FileZilla Client
2007-05-11 16:23:41   --------   d-----w   C:\Program Files\PS Tray Factory
2007-05-10 20:20:32   --------   d-----w   C:\Program Files\Realtek
2007-05-10 17:40:39   --------   d-----w   C:\Program Files\XP TCPIP Repair
2007-05-09 15:46:16   --------   d-----w   C:\Program Files\Asus
2007-05-06 11:05:23   --------   d-----w   C:\Program Files\Longman
2007-05-05 20:30:43   --------   d-----w   C:\Program Files\Common Files\Merge Modules
2007-05-05 20:29:45   --------   d-----w   C:\Program Files\Microsoft.NET
2007-05-05 19:33:33   --------   d-----w   C:\Program Files\OpenOffice.org 2.2
2007-05-05 19:33:13   --------   d-----w   C:\Program Files\OpenOffice.org 2.0
2007-05-02 06:11:59   79,630   ----a-w   C:\WINDOWS\hpfins05.dat
2007-05-02 06:11:15   --------   d-----w   C:\Program Files\Hewlett-Packard
2007-05-02 06:04:02   --------   d-----w   C:\DOCUME~1\xxx\DANEAP~1\HP
2007-04-30 15:46:10   745,600   ----a-w   C:\WINDOWS\system32\aswBoot.exe
2007-04-30 15:35:28   95,872   ----a-w   C:\WINDOWS\system32\AVASTSS.scr
2007-04-29 21:40:43   0   ----a-w   C:\WINDOWS\nsreg.dat
2007-04-29 20:11:25   0   --sha-r   C:\MSDOS.SYS
2007-04-29 20:11:25   0   --sha-r   C:\IO.SYS
2007-04-29 20:11:25   0   ----a-w   C:\CONFIG.SYS
2007-04-29 20:11:25   0   ----a-w   C:\AUTOEXEC.BAT
2007-04-29 20:08:54   21,856   ----a-w   C:\WINDOWS\system32\emptyregdb.dat


(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))


*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects]
{10384d0e-2bc1-48b6-844b-ad0e9e6d2511}=C:\Program Files\ZoomText 8.1\AHOI\ah_ie_bho.dll [2005-03-29 10:08]
{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}=C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll [2007-03-14 03:43]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"nTrayFw"="C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nTrayFw.exe" [2006-02-17 10:40]
"SkyTel"="SkyTel.EXE" [2006-05-16 12:04 C:\WINDOWS\SkyTel.exe]
"nwiz"="nwiz.exe" [2006-08-11 15:43 C:\WINDOWS\system32\nwiz.exe]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-04-30 17:42]
"HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2005-05-11 23:12]
"RTHDCPL"="RTHDCPL.EXE" [2006-10-11 12:36 C:\WINDOWS\RTHDCPL.exe]
"TrayFactory"="C:\Program Files\PS Tray Factory\PSTrayFactory.exe" [2007-04-04 22:50]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe" [2007-03-14 03:43]
"RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [2007-02-07 16:24]
"LanguageShortcut"="C:\Program Files\CyberLink\PowerDVD\Language\Language.exe" [2007-02-07 16:21]
"WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2006-05-25 19:35]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 14:00]
"AutoConnect"="C:\Program Files\AutoConnect\AutoConnect.exe" [2004-08-28 20:27]
"Gadu-Gadu"="C:\Program Files\Gadu-Gadu\gg.exe" [2004-12-28 19:02]
"CTSyncU.exe"="C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe" [2006-08-07 10:06]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\runonce]
"TrayFactory"=C:\Program Files\PS Tray Factory\PSTrayFactory.EXE /start

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"LinkResolveIgnoreLinkInfo"=0 (0x0)
"NoResolveSearch"=1 (0x1)


Contents of the 'Scheduled Tasks' folder
2007-05-02 06:12:39  C:\WINDOWS\tasks\WebReg Deskjet 3900 series.job

**************************************************************************

catchme 0.3.721 W2K/XP/Vista - userland rootkit detector by Gmer, http://www.gmer.net
Rootkit scan 2007-07-02 13:35:07
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\MySQL]
"ImagePath"="\"D:\Serwer\MySQL\bin\mysqld-nt\" --defaults-file=\"D:\Serwer\MySQL\my.ini\" MySQL"

Completion time: 2007-07-02 13:35:25
C:\ComboFix-quarantined-files.txt ... 2007-05-10 19:38
C:\ComboFix2.txt ... 2007-05-10 19:38

   --- E O F ---


[wojtas]

Użyj WWDC :
http://www.firewallleaktester.com/wwdc.htm
Zmień opcje z disable na enable. Uruchom ponownie komputer.
Tak powinny wyglądać porty (NetBIOS może być żółty) :
http://www.firewallleaktester.com/images_site/wwdc.jpg

Autor postu otrzymał pochwałę

[Semtox]

Na początku wszystkie były "Close" Teraz jest tak jak na rysunku ale NetBIOS jest żółt. Nie bardzo rozumiem o to dało

[wojtas]

to moglo zlikwidowac ten Twoj blad i zablokowalo porty przez ktore wchodza wirusy

[Semtox]

Tak przypuszczałem ale raz jeszze wyskoczył ten błąd ale teraz chyba jest ok