komputer muli, prosze o spr. loga

**Posty:** 170 · przez **dawidryba** 17 Mar 2008, 19:28

Witam!
Komputer strasznie wolno chodzi.
Chyba chodzi o proces "spools.exe" ale nie moge go znaleźć na dysku a jak usuwam w hijackthis to powraca.
W trybie awaryjnym też pokazuje się proces: IEXPLORE.EXE, którego też nie można wyłączyć a przez co komputer wolno chodzi.
Log:

Kod: Zaznacz wszystko: Logfile of HijackThis v1.99.1 Scan saved at 18:20:25, on 2008-03-17 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\system32\drivers\spools.exe C:\Program Files\Common Files\LightScribe\LSSrvc.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\WINDOWS\Explorer.EXE C:\WINDOWS\System32\nvsvc32.exe C:\Program Files\Agnitum\Outpost Firewall\outpost.exe C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\WINDOWS\SOUNDMAN.EXE C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\WINDOWS\winlogon.exe C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe C:\Program Files\Customer\Wireless USB utility V1.02\Wireless USB utility V1.02.exe E:\E\Programy\gamma\gamma.exe C:\Program Files\Gadu-Gadu\gg.exe C:\WINDOWS\system32\taskmgr.exe C:\WINDOWS\system32\drivers\spools.exe E:\E\Programy\hijackthis\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://szukaj.wp.pl R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.neostrada.pl R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Neostrada TP R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [VaCtrl] C:\Program Files\VoiceAge\Common\VaCtrl.exe O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [Outpost Firewall] "C:\Program Files\Agnitum\Outpost Firewall\outpost.exe" /waitservice O4 - HKLM\..\Run: [OutpostFeedBack] C:\Program Files\Agnitum\Outpost Firewall\feedback.exe /dump:os_startup O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [autoload] C:\Documents and Settings\LocalService\Local Settings\Application Data\cftmon.exe O4 - HKLM\..\Run: [runwinlogon] C:\WINDOWS\winlogon.exe O4 - HKLM\..\Run: [ntuser] C:\WINDOWS\system32\drivers\spools.exe O4 - Startup: Skrót do gamma.lnk = E:\E\Programy\gamma\gamma.exe O4 - Global Startup: BTTray.lnk = ? O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe O4 - Global Startup: Wireless USB utility V1.02.exe.lnk = ? O8 - Extra context menu item: Ściągnij przy pomocy FlashGet'a - C:\Program Files\FlashGet\jc_link.htm O8 - Extra context menu item: Ściągnij wszystko przy pomocy FlashGet'a - C:\Program Files\FlashGet\jc_all.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra button: Szybkie dostosowywanie programu Outpost Firewall Pro - {44627E97-789B-40d4-B5C2-58BD171129A1} - C:\Program Files\Agnitum\Outpost Firewall\Plugins\BrowserBar\ie_bar.dll O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O12 - Plugin for .pdf: C:\Program Files\Internet Explorer\PLUGINS\nppdf32.dll O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O20 - Winlogon Notify: partnershipreg - C:\Documents and Settings\All Users\Dokumenty\Settings\partnership.dll O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\ O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll O23 - Service: ASP.NET State Service (aspnet_state) - Unknown owner - C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe O23 - Service: aswUpdSv - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - Unknown owner - c:\syshmia.exe (file missing) O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing) O23 - Service: clr_optimization_v2.0.50727_32 - Unknown owner - C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (file missing) O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe O23 - Service: Outpost Firewall Service (OutpostFirewall) - Agnitum Ltd. - C:\Program Files\Agnitum\Outpost Firewall\outpost.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe O23 - Service: Harmonogram zadań (Schedule) - Unknown owner - C:\WINDOWS\system32\drivers\spools.exe O23 - Service: Bufor wydruku (Spooler) - Unknown owner - C:\WINDOWS\system32\spoolsv.exe (file missing) O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe

**Posty:** 3854 · przez **Dzi@dek** 17 Mar 2008, 20:07

Zastosuj sie do tego tematu:
http://forum.programosy.pl/bad-generic-host-process-for-win32-services-vt79489.html

Skasuj te wpisy w Hijackthis.

O4 - HKLM\..\Run: [runwinlogon] C:\WINDOWS\winlogon.exe
O20 - Winlogon Notify: partnershipreg - C:\Documents and Settings\All Users\Dokumenty\Settings\partnership.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\
O23 - Service: avast! Mail Scanner - Unknown owner - c:\syshmia.exe (file missing)

Daj nowe logi z Combofix oraz Hijackthis.

**Posty:** 170 · przez **dawidryba** 17 Mar 2008, 20:48

To chyba faktycznie pomogło.
Logi:

Kod: Zaznacz wszystko: ComboFix 08-03-14.4 - Ryba 2008-03-17 19:21:39.1 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.478 [GMT 1:00] Running from: C:\Documents and Settings\Ryba\Pulpit\ComboFix.exe Command switches used :: C:\Documents and Settings\Ryba\Pulpit\CFScript.txt [color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color] FILE :: C:\Documents and Settings\All Users\Dokumenty\Settings\partnership.dll C:\Documents and Settings\LocalService\Local Settings\Application Data\cftmon.exe c:\syshmia.exe C:\WINDOWS\system32\drivers\spools.exe C:\WINDOWS\winlogon.exe . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\Documents and Settings\All Users\Dokumenty\Settings\partnership.dll C:\Documents and Settings\Ryba\Dane aplikacji\ShoppingReport C:\Documents and Settings\Ryba\Dane aplikacji\ShoppingReport\cs\Config.xml C:\Program Files\ShoppingReport C:\Program Files\ShoppingReport\Bin\2.0.26\ShoppingReport.dll C:\Program Files\ShoppingReport\Uninst.exe C:\WINDOWS\system32\CcEvtSvc.exe C:\WINDOWS\system32\cssrss.exe C:\WINDOWS\system32\drivers\spools.exe C:\WINDOWS\winlogon.exe . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\LEGACY_AVAST!_MAIL_SCANNER -------\LEGACY_CCEVTSVC -------\LEGACY_FCI -------\LEGACY_SCHEDULE -------\avast! Mail Scanner -------\CcEvtSvc -------\Driver -------\FCI -------\Schedule ((((((((((((((((((((((((( Files Created from 2008-02-17 to 2008-03-17 ))))))))))))))))))))))))))))))) . 2008-03-17 17:20 . 2007-07-30 19:19 271,224 --a------ C:\WINDOWS\system32\mucltui.dll 2008-03-17 17:20 . 2007-07-30 19:18 30,072 --a------ C:\WINDOWS\system32\mucltui.dll.mui 2008-03-17 16:38 . 2006-10-04 15:06 1,197,294 -----c--- C:\WINDOWS\system32\dllcache\sysmain.sdb 2008-03-17 16:38 . 2006-10-04 15:06 764,868 -----c--- C:\WINDOWS\system32\dllcache\apph_sp.sdb 2008-03-17 16:38 . 2006-10-04 15:06 217,118 -----c--- C:\WINDOWS\system32\dllcache\apphelp.sdb 2008-03-17 16:36 . 2008-03-17 16:36 <DIR> d-------- C:\Program Files\Windows Media Connect 2 2008-03-17 16:30 . 2008-03-17 16:30 <DIR> d-------- C:\WINDOWS\system32\LogFiles 2008-03-17 16:30 . 2008-03-17 16:32 <DIR> d-------- C:\WINDOWS\system32\drivers\UMDF 2008-03-17 16:20 . 2008-03-17 16:20 <DIR> d-------- C:\Documents and Settings\LocalService\Menu Start 2008-03-17 16:06 . 2004-08-04 00:44 221,184 --a------ C:\WINDOWS\system32\wmpns.dll 2008-03-17 16:02 . 2008-03-17 16:02 <DIR> d-------- C:\WINDOWS\provisioning 2008-03-17 15:54 . 2008-03-17 15:54 <DIR> d-------- C:\WINDOWS\ServicePackFiles 2008-03-17 15:48 . 2004-07-17 11:40 19,528 --a------ C:\WINDOWS\[u]0[/u]02474_.tmp 2008-03-17 15:39 . 2008-03-17 16:03 <DIR> d-------- C:\WINDOWS\EHome 2008-03-17 15:05 . 2001-10-26 18:29 94,208 --a--c--- C:\WINDOWS\system32\dllcache\ieinfo5.ocx 2008-03-17 13:29 . 2008-03-17 13:29 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Office Genuine Advantage 2008-03-17 13:28 . 2008-03-17 13:28 592 --a------ C:\WINDOWS\chgkey.vbs 2008-03-17 13:06 . 2006-06-19 15:19 253,744 --a------ C:\WINDOWS\system32\wgatray.exe.old 2008-03-16 22:57 . 2006-09-25 17:58 23,856 --a------ C:\WINDOWS\system32\spupdsvc.exe 2008-03-16 22:56 . 2008-03-16 22:56 <DIR> d-------- C:\WINDOWS\system32\bits 2008-03-16 22:56 . 2004-08-04 00:44 351,232 --a------ C:\WINDOWS\system32\winhttp.dll 2008-03-16 22:56 . 2004-08-04 00:44 18,944 --a------ C:\WINDOWS\system32\qmgrprxy.dll 2008-03-16 22:56 . 2004-08-04 00:43 8,192 --------- C:\WINDOWS\system32\bitsprx2.dll 2008-03-16 22:56 . 2004-08-04 00:43 7,168 --------- C:\WINDOWS\system32\bitsprx3.dll 2008-03-16 22:53 . 2007-07-30 19:19 549,720 --a------ C:\WINDOWS\system32\wuapi.dll 2008-03-16 22:53 . 2007-07-30 19:19 325,976 --a------ C:\WINDOWS\system32\wucltui.dll 2008-03-16 22:53 . 2007-07-30 19:19 216,408 --a------ C:\WINDOWS\system32\wuaucpl.cpl 2008-03-16 22:53 . 2007-07-30 19:19 43,352 --a------ C:\WINDOWS\system32\wups2.dll 2008-03-16 22:53 . 2007-07-30 19:19 38,232 --a------ C:\WINDOWS\system32\wucltui.dll.mui 2008-03-16 22:53 . 2007-07-30 19:18 33,624 --a------ C:\WINDOWS\system32\wups.dll 2008-03-16 22:53 . 2007-07-30 19:20 30,040 --a------ C:\WINDOWS\system32\wuaucpl.cpl.mui 2008-03-16 22:53 . 2007-07-30 19:20 30,040 --a------ C:\WINDOWS\system32\wuapi.dll.mui 2008-03-16 22:53 . 2007-07-30 19:18 21,336 --a------ C:\WINDOWS\system32\wuaueng.dll.mui 2008-03-15 17:32 . 2008-03-15 17:32 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Yahoo! 2008-03-15 17:27 . 2008-03-15 17:27 <DIR> d-------- C:\Program Files\Yahoo! 2008-03-09 17:49 . 2002-09-20 18:04 150,528 --a------ C:\WINDOWS\system32\ptpusd.dll 2008-03-09 17:49 . 2001-10-26 17:29 5,632 --a------ C:\WINDOWS\system32\ptpusb.dll 2008-03-09 12:28 . 2005-07-25 10:04 48,640 --------- C:\WINDOWS\system32\drivers\ser2pl.sys 2008-03-04 15:10 . 2008-03-14 16:00 <DIR> d-------- C:\Documents and Settings\Ryba\Dane aplikacji\skypePM 2008-03-04 15:10 . 2008-03-04 15:10 32 --a------ C:\Documents and Settings\All Users\Dane aplikacji\ezsid.dat 2008-03-04 15:08 . 2008-03-04 15:08 <DIR> d-------- C:\Program Files\Common Files\Skype 2008-02-23 14:36 . 2008-02-23 14:36 <DIR> d-------- C:\Documents and Settings\Ryba\Dane aplikacji\Media Player Classic 2008-02-23 14:34 . 2007-11-29 23:30 3,596,288 --a------ C:\WINDOWS\system32\qt-dx331.dll 2008-02-23 14:34 . 2008-01-10 13:15 755,027 --a------ C:\WINDOWS\system32\xvidcore.dll 2008-02-23 14:34 . 2006-09-24 16:11 389,120 --a------ C:\WINDOWS\system32\lameACM.acm 2008-02-23 14:34 . 2004-01-25 17:18 217,088 --a------ C:\WINDOWS\system32\yv12vfw.dll 2008-02-23 14:34 . 2008-01-10 13:16 159,839 --a------ C:\WINDOWS\system32\xvidvfw.dll 2008-02-23 14:34 . 2007-09-21 01:52 118,784 --a------ C:\WINDOWS\system32\ac3acm.acm 2008-02-23 14:34 . 2007-11-29 23:28 81,920 --a------ C:\WINDOWS\system32\dpl100.dll 2008-02-23 14:34 . 2007-10-03 16:03 414 --a------ C:\WINDOWS\system32\lame_acm.xml 2008-02-23 14:33 . 2008-02-23 14:34 <DIR> d-------- C:\Program Files\K-Lite Codec Pack 2008-02-23 14:33 . 2007-12-04 02:33 682,496 --a------ C:\WINDOWS\system32\divx.dll 2008-02-23 14:33 . 2007-12-24 13:49 7,680 --a------ C:\WINDOWS\system32\ff_vfw.dll 2008-02-23 14:33 . 2007-07-10 17:10 547 --a------ C:\WINDOWS\system32\ff_vfw.dll.manifest 2008-02-21 18:50 . 2008-02-22 20:18 <DIR> d-------- C:\Program Files\TVTool . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-03-17 15:16 96,256 ----a-w C:\WINDOWS\system32\drivers\sptd7677.sys 2008-03-17 12:06 --------- d-----w C:\Documents and Settings\Ryba\Dane aplikacji\uTorrent 2008-03-16 23:44 --------- d-----w C:\Program Files\FlashGet 2008-03-16 22:48 --------- d-----w C:\Documents and Settings\Ryba\Dane aplikacji\MegauploadToolbar 2008-03-16 14:51 --------- d-----w C:\Documents and Settings\Ryba\Dane aplikacji\Hamachi 2008-03-14 15:30 --------- d-----w C:\Documents and Settings\Ryba\Dane aplikacji\Skype 2008-03-09 11:27 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-03-08 13:50 --------- d-----w C:\Program Files\Avant Browser 2008-03-07 19:25 --------- d-----w C:\Documents and Settings\Ryba\Dane aplikacji\GanymedeNet 2008-03-04 16:55 --------- d-----w C:\Program Files\Gadu-Gadu 2008-02-14 17:26 --------- d-----w C:\Program Files\MSXML 4.0 2008-02-14 17:24 --------- d-----w C:\Documents and Settings\Ryba\Dane aplikacji\InstallShield 2008-02-08 23:58 --------- d-----w C:\Program Files\MegauploadToolbar 2008-02-01 17:01 --------- d-----w C:\Program Files\Ganymede 2008-01-20 22:17 --------- d-----w C:\Documents and Settings\Ryba\Dane aplikacji\TVU Networks 2008-01-20 22:17 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\TVU Networks 2007-03-20 22:03 46,969 --sh--r C:\WINDOWS\system\msnntlp.exe . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SoundMan"="SOUNDMAN.EXE" [2004-11-15 11:20 77824 C:\WINDOWS\SOUNDMAN.EXE] "VaCtrl"="C:\Program Files\VoiceAge\Common\VaCtrl.exe" [2003-08-28 08:08 90112] "avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-12-04 14:00 79224] "Outpost Firewall"="C:\Program Files\Agnitum\Outpost Firewall\outpost.exe" [2007-04-05 16:56 94720] "OutpostFeedBack"="C:\Program Files\Agnitum\Outpost Firewall\feedback.exe" [2007-06-28 13:18 335872] "NvCplDaemon"="C:\WINDOWS\System32\NvCpl.dll" [2004-09-13 17:34 4554752] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-08-04 00:44 15360] C:\Documents and Settings\Ryba\Menu Start\Programy\Autostart\ Skr˘t do gamma.lnk - E:\E\Programy\gamma\gamma.exe [2006-06-30 23:50:16 53248] C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\ BTTray.lnk - C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe [2005-08-29 15:19:14 610365] DSLMON.lnk - C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe [2007-10-14 13:47:55 962661] Wireless USB utility V1.02.exe.lnk - C:\Program Files\Customer\Wireless USB utility V1.02\Wireless USB utility V1.02.exe [2008-01-09 21:51:03 913408] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon] "UIHost"="logonui.exe" [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa] Authentication Packages REG_MULTI_SZ msv1_0 nwprovau [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Adobe Gamma Loader.lnk] path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Adobe Gamma Loader.lnk backup=C:\WINDOWS\pss\Adobe Gamma Loader.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Adobe Reader Speed Launch.lnk] path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Adobe Reader Speed Launch.lnk backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^BTTray.lnk] path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\BTTray.lnk backup=C:\WINDOWS\pss\BTTray.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^HP Digital Imaging Monitor.lnk] path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\HP Digital Imaging Monitor.lnk backup=C:\WINDOWS\pss\HP Digital Imaging Monitor.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^VIA RAID TOOL.lnk] path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\VIA RAID TOOL.lnk backup=C:\WINDOWS\pss\VIA RAID TOOL.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^Ryba^Menu Start^Programy^Autostart^Papla.lnk] path=C:\Documents and Settings\Ryba\Menu Start\Programy\Autostart\Papla.lnk backup=C:\WINDOWS\pss\Papla.lnkStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Advanced DHTML Enable] C:\WINDOWS\System32\evqjmby.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\avast!] --a------ 2007-12-04 14:00 79224 C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] --a------ 2006-11-16 19:04 139264 C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE] --a------ 2004-08-04 00:44 15360 C:\WINDOWS\System32\ctfmon.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Component Manager] --a------ 2004-05-12 15:18 241664 C:\Program Files\HP\hpcoretech\hpcmpmgr.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update] --a------ 2004-02-12 13:38 49152 C:\Program Files\HP\HP Software Update\HPWuSchd2.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS] --a------ 2004-08-04 00:44 1667584 C:\Program Files\Messenger\MSMSGS.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NETIANET] --a------ 2007-09-30 12:33 493568 C:\Program Files\Netia\Net\netianet.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ntuser] C:\WINDOWS\system32\drivers\spools.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype] -ra------ 2008-02-06 18:24 21898024 C:\Program Files\Skype\Phone\Skype.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SmartSync - ScheduleSync] --a------ 2006-03-30 15:49 45056 C:\PROGRA~1\MOBILE~1\SMARTS~1\SCHEDU~1.EXE [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Sony Ericsson PC Suite] -ra--c--- 2005-10-26 15:17 159744 C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TotalRecorderScheduler] --a--c--- 2005-05-18 21:51 81920 C:\Program Files\HighCriteria\TotalRecorder\TotRecSched.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent] --a------ 2007-10-10 06:28 36352 C:\Program Files\Winamp\winampa.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WooCnxMon] --a------ 2003-10-16 19:07 24576 C:\PROGRA~1\NEOSTR~1\CnxMon.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WOOTASKBARICON] --------- 2003-10-16 19:07 53248 C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WOOWATCH] --------- 2003-10-16 19:07 20480 C:\PROGRA~1\NEOSTR~1\Watch.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yahoo! Pager] --a------ 2007-12-17 17:13 3810544 C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe [HKEY_LOCAL_MACHINE\software\microsoft\security center] "UpdatesDisableNotify"=dword:00000001 "AntiVirusDisableNotify"=dword:00000001 "AntiVirusOverride"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "1723:TCP"= 1723:TCP:@xpsp2res.dll,-22015 "1701:UDP"= 1701:UDP:@xpsp2res.dll,-22016 "500:UDP"= 500:UDP:@xpsp2res.dll,-22017 R1 VFILT;Outpost Firewall Kernel Driver;C:\Program Files\Agnitum\Outpost Firewall\kernel\FILTNT.SYS [2007-04-05 16:56] R3 ADBLOCK.DLL;Outpost Firewall PlugIn (ADBLOCK.DLL);C:\Program Files\Agnitum\Outpost Firewall\kernel\ADBLOCK.DLL [2007-04-05 16:57] R3 ARP.DLL;Outpost Firewall PlugIn (ARP.DLL);C:\Program Files\Agnitum\Outpost Firewall\kernel\ARP.DLL [2007-04-05 16:57] R3 CONTENT.DLL;Outpost Firewall PlugIn (CONTENT.DLL);C:\Program Files\Agnitum\Outpost Firewall\kernel\CONTENT.DLL [2007-04-05 16:57] R3 DNSCACHE.DLL;Outpost Firewall PlugIn (DNSCACHE.DLL);C:\Program Files\Agnitum\Outpost Firewall\kernel\DNSCACHE.DLL [2007-04-05 16:57] R3 FTPFILT.DLL;Outpost Firewall PlugIn (FTPFILT.DLL);C:\Program Files\Agnitum\Outpost Firewall\kernel\FTPFILT.DLL [2007-04-05 16:57] R3 HTMLFILT.DLL;Outpost Firewall PlugIn (HTMLFILT.DLL);C:\Program Files\Agnitum\Outpost Firewall\kernel\HTMLFILT.DLL [2007-04-05 16:57] R3 HTTPFILT.DLL;Outpost Firewall PlugIn (HTTPFILT.DLL);C:\Program Files\Agnitum\Outpost Firewall\kernel\HTTPFILT.DLL [2007-04-05 16:57] R3 IMAPFILT.DLL;Outpost Firewall PlugIn (IMAPFILT.DLL);C:\Program Files\Agnitum\Outpost Firewall\kernel\IMAPFILT.DLL [2007-04-05 16:57] R3 MAILFILT.DLL;Outpost Firewall PlugIn (MAILFILT.DLL);C:\Program Files\Agnitum\Outpost Firewall\kernel\MAILFILT.DLL [2007-04-05 16:57] R3 NNTPFILT.DLL;Outpost Firewall PlugIn (NNTPFILT.DLL);C:\Program Files\Agnitum\Outpost Firewall\kernel\NNTPFILT.DLL [2007-04-05 16:57] R3 POP3FILT.DLL;Outpost Firewall PlugIn (POP3FILT.DLL);C:\Program Files\Agnitum\Outpost Firewall\kernel\POP3FILT.DLL [2007-04-05 16:57] R3 PROTECT.DLL;Outpost Firewall PlugIn (PROTECT.DLL);C:\Program Files\Agnitum\Outpost Firewall\kernel\PROTECT.DLL [2007-04-05 16:57] R3 SECRET.DLL;Outpost Firewall PlugIn (SECRET.DLL);C:\Program Files\Agnitum\Outpost Firewall\kernel\SECRET.DLL [2007-04-05 16:57] S1 SandBox;Outpost Firewall Sandbox Driver;C:\Program Files\Agnitum\Outpost Firewall\kernel\Sandbox.SYS [2007-06-26 19:01] S3 k510bus;Sony Ericsson K510 Driver driver (WDM);C:\WINDOWS\system32\DRIVERS\k510bus.sys [2007-05-15 17:13] S3 k510mdfl;Sony Ericsson K510 USB WMC Modem Filter;C:\WINDOWS\system32\DRIVERS\k510mdfl.sys [2007-05-15 17:13] S3 k510mdm;Sony Ericsson K510 USB WMC Modem Driver;C:\WINDOWS\system32\DRIVERS\k510mdm.sys [2007-05-15 17:13] S3 k510mgmt;Sony Ericsson K510 USB WMC Device Management Drivers (WDM);C:\WINDOWS\system32\DRIVERS\k510mgmt.sys [2007-05-15 17:13] S3 k510obex;Sony Ericsson K510 USB WMC OBEX Interface;C:\WINDOWS\system32\DRIVERS\k510obex.sys [2007-05-15 17:13] S3 KS-959;MA-620 USB Infrared Adapter;C:\WINDOWS\system32\DRIVERS\KS-959.sys [2007-07-23 17:46] S3 MRVW225;802.11g/b Wireless LAN Dirver for Windows XP;C:\WINDOWS\system32\DRIVERS\MRVW225.sys [2005-12-21 12:44] S3 o1394bul;o1394bul;C:\DOCUME~1\Ryba\USTAWI~1\Temp\o1394bul.sys [] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\H] \Shell\AutoRun\command - H:\start.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\K] \Shell\AutoRun\command - K:\Autoplay.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\L] \Shell\AutoRun\command - L:\autorun.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\M] \Shell\AutoRun\command - M:\Setup.exe . ************************************************************************** catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-03-17 19:30:23 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... C:\WINDOWS\system32\drivers\ndisaluo.sys 10880 bytes executable C:\WINDOWS\system32\drivers\ntio922.sys 34688 bytes executable scan completed successfully hidden files: 2 ************************************************************************** [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\NDIS] [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\ndisaluo] "ImagePath"="\??\C:\WINDOWS\System32\Drivers\ndisaluo.sys" -- [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\ntio922] "ImagePath"="System32\Drivers\ntio922.sys" [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\btwdins] "ImagePath"="c:\25.tmp" . ------------------------ Other Running Processes ------------------------ . C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\Program Files\Common Files\LightScribe\LSSrvc.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\WINDOWS\System32\nvsvc32.exe C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe . ************************************************************************** . Completion time: 2008-03-17 19:34:07 - machine was rebooted ComboFix-quarantined-files.txt 2008-03-17 18:33:59

Kod: Zaznacz wszystko: Logfile of HijackThis v1.99.1 Scan saved at 19:47:03, on 2008-03-17 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\Program Files\Common Files\LightScribe\LSSrvc.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\WINDOWS\System32\nvsvc32.exe C:\Program Files\Agnitum\Outpost Firewall\outpost.exe C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\SOUNDMAN.EXE C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe C:\Program Files\Customer\Wireless USB utility V1.02\Wireless USB utility V1.02.exe E:\E\Programy\gamma\gamma.exe C:\PROGRA~1\WIDCOMM\BLUETO~1\BTSTAC~1.EXE C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\Program Files\Avant Browser\avant.exe C:\WINDOWS\system32\NOTEPAD.EXE E:\E\Programy\hijackthis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.neostrada.pl R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [VaCtrl] C:\Program Files\VoiceAge\Common\VaCtrl.exe O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [Outpost Firewall] C:\Program Files\Agnitum\Outpost Firewall\outpost.exe /waitservice O4 - HKLM\..\Run: [OutpostFeedBack] C:\Program Files\Agnitum\Outpost Firewall\feedback.exe /dump:os_startup O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup O4 - Startup: Skrót do gamma.lnk = E:\E\Programy\gamma\gamma.exe O4 - Global Startup: BTTray.lnk = ? O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe O4 - Global Startup: Wireless USB utility V1.02.exe.lnk = ? O8 - Extra context menu item: Ściągnij przy pomocy FlashGet'a - C:\Program Files\FlashGet\jc_link.htm O8 - Extra context menu item: Ściągnij wszystko przy pomocy FlashGet'a - C:\Program Files\FlashGet\jc_all.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra button: Szybkie dostosowywanie programu Outpost Firewall Pro - {44627E97-789B-40d4-B5C2-58BD171129A1} - C:\Program Files\Agnitum\Outpost Firewall\Plugins\BrowserBar\ie_bar.dll O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O12 - Plugin for .pdf: C:\Program Files\Internet Explorer\PLUGINS\nppdf32.dll O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\ O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll O23 - Service: ASP.NET State Service (aspnet_state) - Unknown owner - C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe O23 - Service: aswUpdSv - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing) O23 - Service: clr_optimization_v2.0.50727_32 - Unknown owner - C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (file missing) O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe O23 - Service: Outpost Firewall Service (OutpostFirewall) - Agnitum Ltd. - C:\Program Files\Agnitum\Outpost Firewall\outpost.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe O23 - Service: Bufor wydruku (Spooler) - Unknown owner - C:\WINDOWS\system32\spoolsv.exe (file missing) O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe

**Posty:** 18165 · przez **wojtas** 17 Mar 2008, 22:00

Otworz notatnik i wklej w nim to:

File::
C:\WINDOWS\002474_.tmp
C:\WINDOWS\system\msnntlp.exe
C:\DOCUME~1\Ryba\USTAWI~1\Temp\o1394bul.sys

Registry::
[-HKEY_LOCAL_MACHINE\system\ControlSet001\Services\ntio922]
[-HKEY_LOCAL_MACHINE\system\ControlSet001\Services\btwdins]

Driver::
o1394bul

Plik >>> zapisz jako CFScript.txt .Plik przeciągnij i upuść na ikonę ComboFixa (tak jak tu ) . odczekaj az wygeneruje sie nowy log i go daj na forum

**Posty:** 170 · przez **dawidryba** 18 Mar 2008, 20:38

Kod: Zaznacz wszystko: ComboFix 08-03-14.4 - Ryba 2008-03-18 19:19:58.3 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.416 [GMT 1:00] Running from: C:\Documents and Settings\Ryba\Pulpit\ComboFix.exe Command switches used :: C:\Documents and Settings\Ryba\Pulpit\CFScript.txt * Created a new restore point [color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color] FILE :: C:\DOCUME~1\Ryba\USTAWI~1\Temp\o1394bul.sys C:\WINDOWS\[u]0[/u]02474_.tmp C:\WINDOWS\system\msnntlp.exe . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\WINDOWS\[u]0[/u]02474_.tmp C:\WINDOWS\system\msnntlp.exe . ((((((((((((((((((((((((( Files Created from 2008-02-18 to 2008-03-18 ))))))))))))))))))))))))))))))) . 2008-03-17 22:29 . 2007-07-30 19:19 207,736 --a------ C:\WINDOWS\system32\muweb.dll 2008-03-17 22:29 . 2007-07-30 19:19 203,096 --a------ C:\WINDOWS\system32\wuweb.dll 2008-03-17 22:29 . 2007-07-30 19:19 203,096 --a--c--- C:\WINDOWS\system32\dllcache\wuweb.dll 2008-03-17 17:20 . 2007-07-30 19:19 271,224 --a------ C:\WINDOWS\system32\mucltui.dll 2008-03-17 17:20 . 2007-07-30 19:18 30,072 --a------ C:\WINDOWS\system32\mucltui.dll.mui 2008-03-17 16:38 . 2006-10-04 15:06 1,197,294 -----c--- C:\WINDOWS\system32\dllcache\sysmain.sdb 2008-03-17 16:38 . 2006-10-04 15:06 764,868 -----c--- C:\WINDOWS\system32\dllcache\apph_sp.sdb 2008-03-17 16:38 . 2006-10-04 15:06 217,118 -----c--- C:\WINDOWS\system32\dllcache\apphelp.sdb 2008-03-17 16:36 . 2008-03-17 16:36 <DIR> d-------- C:\Program Files\Windows Media Connect 2 2008-03-17 16:30 . 2008-03-17 16:30 <DIR> d-------- C:\WINDOWS\system32\LogFiles 2008-03-17 16:30 . 2008-03-17 16:32 <DIR> d-------- C:\WINDOWS\system32\drivers\UMDF 2008-03-17 16:20 . 2008-03-17 16:20 <DIR> d-------- C:\Documents and Settings\LocalService\Menu Start 2008-03-17 16:06 . 2004-08-04 00:44 221,184 --a------ C:\WINDOWS\system32\wmpns.dll 2008-03-17 16:02 . 2008-03-17 16:02 <DIR> d-------- C:\WINDOWS\provisioning 2008-03-17 15:54 . 2008-03-17 15:54 <DIR> d-------- C:\WINDOWS\ServicePackFiles 2008-03-17 15:39 . 2008-03-17 16:03 <DIR> d-------- C:\WINDOWS\EHome 2008-03-17 15:05 . 2001-10-26 18:29 94,208 --a--c--- C:\WINDOWS\system32\dllcache\ieinfo5.ocx 2008-03-17 13:29 . 2008-03-17 13:29 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Office Genuine Advantage 2008-03-17 13:28 . 2008-03-17 13:28 592 --a------ C:\WINDOWS\chgkey.vbs 2008-03-17 13:06 . 2006-06-19 15:19 253,744 --a------ C:\WINDOWS\system32\wgatray.exe.old 2008-03-16 22:57 . 2006-09-25 17:58 23,856 --a------ C:\WINDOWS\system32\spupdsvc.exe 2008-03-16 22:56 . 2008-03-16 22:56 <DIR> d-------- C:\WINDOWS\system32\bits 2008-03-16 22:56 . 2004-08-04 00:44 351,232 --a------ C:\WINDOWS\system32\winhttp.dll 2008-03-16 22:56 . 2004-08-04 00:44 18,944 --a------ C:\WINDOWS\system32\qmgrprxy.dll 2008-03-16 22:56 . 2004-08-04 00:43 8,192 --------- C:\WINDOWS\system32\bitsprx2.dll 2008-03-16 22:56 . 2004-08-04 00:43 7,168 --------- C:\WINDOWS\system32\bitsprx3.dll 2008-03-16 22:53 . 2007-07-30 19:19 549,720 --a------ C:\WINDOWS\system32\wuapi.dll 2008-03-16 22:53 . 2007-07-30 19:19 325,976 --a------ C:\WINDOWS\system32\wucltui.dll 2008-03-16 22:53 . 2007-07-30 19:19 216,408 --a------ C:\WINDOWS\system32\wuaucpl.cpl 2008-03-16 22:53 . 2007-07-30 19:19 43,352 --a------ C:\WINDOWS\system32\wups2.dll 2008-03-16 22:53 . 2007-07-30 19:19 38,232 --a------ C:\WINDOWS\system32\wucltui.dll.mui 2008-03-16 22:53 . 2007-07-30 19:18 33,624 --a------ C:\WINDOWS\system32\wups.dll 2008-03-16 22:53 . 2007-07-30 19:20 30,040 --a------ C:\WINDOWS\system32\wuaucpl.cpl.mui 2008-03-16 22:53 . 2007-07-30 19:20 30,040 --a------ C:\WINDOWS\system32\wuapi.dll.mui 2008-03-16 22:53 . 2007-07-30 19:18 21,336 --a------ C:\WINDOWS\system32\wuaueng.dll.mui 2008-03-15 17:32 . 2008-03-15 17:32 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Yahoo! 2008-03-15 17:27 . 2008-03-15 17:27 <DIR> d-------- C:\Program Files\Yahoo! 2008-03-09 17:49 . 2002-09-20 18:04 150,528 --a------ C:\WINDOWS\system32\ptpusd.dll 2008-03-09 17:49 . 2001-10-26 17:29 5,632 --a------ C:\WINDOWS\system32\ptpusb.dll 2008-03-09 12:28 . 2005-07-25 10:04 48,640 --------- C:\WINDOWS\system32\drivers\ser2pl.sys 2008-03-04 15:10 . 2008-03-14 16:00 <DIR> d-------- C:\Documents and Settings\Ryba\Dane aplikacji\skypePM 2008-03-04 15:10 . 2008-03-04 15:10 32 --a------ C:\Documents and Settings\All Users\Dane aplikacji\ezsid.dat 2008-03-04 15:08 . 2008-03-04 15:08 <DIR> d-------- C:\Program Files\Common Files\Skype 2008-02-23 14:36 . 2008-02-23 14:36 <DIR> d-------- C:\Documents and Settings\Ryba\Dane aplikacji\Media Player Classic 2008-02-23 14:34 . 2007-11-29 23:30 3,596,288 --a------ C:\WINDOWS\system32\qt-dx331.dll 2008-02-23 14:34 . 2008-01-10 13:15 755,027 --a------ C:\WINDOWS\system32\xvidcore.dll 2008-02-23 14:34 . 2006-09-24 16:11 389,120 --a------ C:\WINDOWS\system32\lameACM.acm 2008-02-23 14:34 . 2004-01-25 17:18 217,088 --a------ C:\WINDOWS\system32\yv12vfw.dll 2008-02-23 14:34 . 2008-01-10 13:16 159,839 --a------ C:\WINDOWS\system32\xvidvfw.dll 2008-02-23 14:34 . 2007-09-21 01:52 118,784 --a------ C:\WINDOWS\system32\ac3acm.acm 2008-02-23 14:34 . 2007-11-29 23:28 81,920 --a------ C:\WINDOWS\system32\dpl100.dll 2008-02-23 14:34 . 2007-10-03 16:03 414 --a------ C:\WINDOWS\system32\lame_acm.xml 2008-02-23 14:33 . 2008-02-23 14:34 <DIR> d-------- C:\Program Files\K-Lite Codec Pack 2008-02-23 14:33 . 2007-12-04 02:33 682,496 --a------ C:\WINDOWS\system32\divx.dll 2008-02-23 14:33 . 2007-12-24 13:49 7,680 --a------ C:\WINDOWS\system32\ff_vfw.dll 2008-02-23 14:33 . 2007-07-10 17:10 547 --a------ C:\WINDOWS\system32\ff_vfw.dll.manifest 2008-02-21 18:50 . 2008-02-22 20:18 <DIR> d-------- C:\Program Files\TVTool . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-03-18 17:51 --------- d-----w C:\Documents and Settings\Ryba\Dane aplikacji\Hamachi 2008-03-17 15:16 96,256 ----a-w C:\WINDOWS\system32\drivers\sptd7677.sys 2008-03-17 12:06 --------- d-----w C:\Documents and Settings\Ryba\Dane aplikacji\uTorrent 2008-03-16 23:44 --------- d-----w C:\Program Files\FlashGet 2008-03-16 22:48 --------- d-----w C:\Documents and Settings\Ryba\Dane aplikacji\MegauploadToolbar 2008-03-14 15:30 --------- d-----w C:\Documents and Settings\Ryba\Dane aplikacji\Skype 2008-03-09 11:27 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-03-08 13:50 --------- d-----w C:\Program Files\Avant Browser 2008-03-07 19:25 --------- d-----w C:\Documents and Settings\Ryba\Dane aplikacji\GanymedeNet 2008-03-04 16:55 --------- d-----w C:\Program Files\Gadu-Gadu 2008-02-14 17:26 --------- d-----w C:\Program Files\MSXML 4.0 2008-02-14 17:24 --------- d-----w C:\Documents and Settings\Ryba\Dane aplikacji\InstallShield 2008-02-08 23:58 --------- d-----w C:\Program Files\MegauploadToolbar 2008-02-01 17:01 --------- d-----w C:\Program Files\Ganymede 2008-01-20 22:17 --------- d-----w C:\Documents and Settings\Ryba\Dane aplikacji\TVU Networks 2008-01-20 22:17 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\TVU Networks . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SoundMan"="SOUNDMAN.EXE" [2004-11-15 11:20 77824 C:\WINDOWS\SOUNDMAN.EXE] "VaCtrl"="C:\Program Files\VoiceAge\Common\VaCtrl.exe" [2003-08-28 08:08 90112] "avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-12-04 14:00 79224] "Outpost Firewall"="C:\Program Files\Agnitum\Outpost Firewall\outpost.exe" [2007-04-05 16:56 94720] "OutpostFeedBack"="C:\Program Files\Agnitum\Outpost Firewall\feedback.exe" [2007-06-28 13:18 335872] "NvCplDaemon"="C:\WINDOWS\System32\NvCpl.dll" [2004-09-13 17:34 4554752] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-08-04 00:44 15360] C:\Documents and Settings\Ryba\Menu Start\Programy\Autostart\ Skr˘t do gamma.lnk - E:\E\Programy\gamma\gamma.exe [2006-06-30 23:50:16 53248] C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\ BTTray.lnk - C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe [2005-08-29 15:19:14 610365] DSLMON.lnk - C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe [2007-10-14 13:47:55 962661] Wireless USB utility V1.02.exe.lnk - C:\Program Files\Customer\Wireless USB utility V1.02\Wireless USB utility V1.02.exe [2008-01-09 21:51:03 913408] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon] "UIHost"="logonui.exe" [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa] Authentication Packages REG_MULTI_SZ msv1_0 nwprovau [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Adobe Gamma Loader.lnk] path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Adobe Gamma Loader.lnk backup=C:\WINDOWS\pss\Adobe Gamma Loader.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Adobe Reader Speed Launch.lnk] path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Adobe Reader Speed Launch.lnk backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^BTTray.lnk] path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\BTTray.lnk backup=C:\WINDOWS\pss\BTTray.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^HP Digital Imaging Monitor.lnk] path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\HP Digital Imaging Monitor.lnk backup=C:\WINDOWS\pss\HP Digital Imaging Monitor.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^VIA RAID TOOL.lnk] path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\VIA RAID TOOL.lnk backup=C:\WINDOWS\pss\VIA RAID TOOL.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^Ryba^Menu Start^Programy^Autostart^Papla.lnk] path=C:\Documents and Settings\Ryba\Menu Start\Programy\Autostart\Papla.lnk backup=C:\WINDOWS\pss\Papla.lnkStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\avast!] --a------ 2007-12-04 14:00 79224 C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] --a------ 2006-11-16 19:04 139264 C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE] --a------ 2004-08-04 00:44 15360 C:\WINDOWS\System32\ctfmon.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Component Manager] --a------ 2004-05-12 15:18 241664 C:\Program Files\HP\hpcoretech\hpcmpmgr.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update] --a------ 2004-02-12 13:38 49152 C:\Program Files\HP\HP Software Update\HPWuSchd2.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS] --a------ 2004-08-04 00:44 1667584 C:\Program Files\Messenger\MSMSGS.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NETIANET] --a------ 2007-09-30 12:33 493568 C:\Program Files\Netia\Net\netianet.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype] -ra------ 2008-02-06 18:24 21898024 C:\Program Files\Skype\Phone\Skype.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SmartSync - ScheduleSync] --a------ 2006-03-30 15:49 45056 C:\PROGRA~1\MOBILE~1\SMARTS~1\SCHEDU~1.EXE [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Sony Ericsson PC Suite] -ra--c--- 2005-10-26 15:17 159744 C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TotalRecorderScheduler] --a--c--- 2005-05-18 21:51 81920 C:\Program Files\HighCriteria\TotalRecorder\TotRecSched.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent] --a------ 2007-10-10 06:28 36352 C:\Program Files\Winamp\winampa.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WooCnxMon] --a------ 2003-10-16 19:07 24576 C:\PROGRA~1\NEOSTR~1\CnxMon.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WOOTASKBARICON] --------- 2003-10-16 19:07 53248 C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WOOWATCH] --------- 2003-10-16 19:07 20480 C:\PROGRA~1\NEOSTR~1\Watch.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yahoo! Pager] --a------ 2007-12-17 17:13 3810544 C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe [HKEY_LOCAL_MACHINE\software\microsoft\security center] "UpdatesDisableNotify"=dword:00000001 "AntiVirusDisableNotify"=dword:00000001 "AntiVirusOverride"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "1723:TCP"= 1723:TCP:@xpsp2res.dll,-22015 "1701:UDP"= 1701:UDP:@xpsp2res.dll,-22016 "500:UDP"= 500:UDP:@xpsp2res.dll,-22017 R1 VFILT;Outpost Firewall Kernel Driver;C:\Program Files\Agnitum\Outpost Firewall\kernel\FILTNT.SYS [2007-04-05 16:56] R3 ADBLOCK.DLL;Outpost Firewall PlugIn (ADBLOCK.DLL);C:\Program Files\Agnitum\Outpost Firewall\kernel\ADBLOCK.DLL [2007-04-05 16:57] R3 ARP.DLL;Outpost Firewall PlugIn (ARP.DLL);C:\Program Files\Agnitum\Outpost Firewall\kernel\ARP.DLL [2007-04-05 16:57] R3 CONTENT.DLL;Outpost Firewall PlugIn (CONTENT.DLL);C:\Program Files\Agnitum\Outpost Firewall\kernel\CONTENT.DLL [2007-04-05 16:57] R3 DNSCACHE.DLL;Outpost Firewall PlugIn (DNSCACHE.DLL);C:\Program Files\Agnitum\Outpost Firewall\kernel\DNSCACHE.DLL [2007-04-05 16:57] R3 FTPFILT.DLL;Outpost Firewall PlugIn (FTPFILT.DLL);C:\Program Files\Agnitum\Outpost Firewall\kernel\FTPFILT.DLL [2007-04-05 16:57] R3 HTMLFILT.DLL;Outpost Firewall PlugIn (HTMLFILT.DLL);C:\Program Files\Agnitum\Outpost Firewall\kernel\HTMLFILT.DLL [2007-04-05 16:57] R3 HTTPFILT.DLL;Outpost Firewall PlugIn (HTTPFILT.DLL);C:\Program Files\Agnitum\Outpost Firewall\kernel\HTTPFILT.DLL [2007-04-05 16:57] R3 IMAPFILT.DLL;Outpost Firewall PlugIn (IMAPFILT.DLL);C:\Program Files\Agnitum\Outpost Firewall\kernel\IMAPFILT.DLL [2007-04-05 16:57] R3 MAILFILT.DLL;Outpost Firewall PlugIn (MAILFILT.DLL);C:\Program Files\Agnitum\Outpost Firewall\kernel\MAILFILT.DLL [2007-04-05 16:57] R3 MRVW225;802.11g/b Wireless LAN Dirver for Windows XP;C:\WINDOWS\system32\DRIVERS\MRVW225.sys [2005-12-21 12:44] R3 NNTPFILT.DLL;Outpost Firewall PlugIn (NNTPFILT.DLL);C:\Program Files\Agnitum\Outpost Firewall\kernel\NNTPFILT.DLL [2007-04-05 16:57] R3 POP3FILT.DLL;Outpost Firewall PlugIn (POP3FILT.DLL);C:\Program Files\Agnitum\Outpost Firewall\kernel\POP3FILT.DLL [2007-04-05 16:57] R3 PROTECT.DLL;Outpost Firewall PlugIn (PROTECT.DLL);C:\Program Files\Agnitum\Outpost Firewall\kernel\PROTECT.DLL [2007-04-05 16:57] R3 SECRET.DLL;Outpost Firewall PlugIn (SECRET.DLL);C:\Program Files\Agnitum\Outpost Firewall\kernel\SECRET.DLL [2007-04-05 16:57] S1 SandBox;Outpost Firewall Sandbox Driver;C:\Program Files\Agnitum\Outpost Firewall\kernel\Sandbox.SYS [2007-06-26 19:01] S3 k510bus;Sony Ericsson K510 Driver driver (WDM);C:\WINDOWS\system32\DRIVERS\k510bus.sys [2007-05-15 17:13] S3 k510mdfl;Sony Ericsson K510 USB WMC Modem Filter;C:\WINDOWS\system32\DRIVERS\k510mdfl.sys [2007-05-15 17:13] S3 k510mdm;Sony Ericsson K510 USB WMC Modem Driver;C:\WINDOWS\system32\DRIVERS\k510mdm.sys [2007-05-15 17:13] S3 k510mgmt;Sony Ericsson K510 USB WMC Device Management Drivers (WDM);C:\WINDOWS\system32\DRIVERS\k510mgmt.sys [2007-05-15 17:13] S3 k510obex;Sony Ericsson K510 USB WMC OBEX Interface;C:\WINDOWS\system32\DRIVERS\k510obex.sys [2007-05-15 17:13] S3 KS-959;MA-620 USB Infrared Adapter;C:\WINDOWS\system32\DRIVERS\KS-959.sys [2007-07-23 17:46] . ************************************************************************** catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-03-18 19:27:40 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... C:\WINDOWS\system32\drivers\ndisaluo.sys 10880 bytes executable C:\WINDOWS\system32\drivers\ntio922.sys 34688 bytes executable scan completed successfully hidden files: 2 ************************************************************************** [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\NDIS] [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\ndisaluo] "ImagePath"="\??\C:\WINDOWS\System32\Drivers\ndisaluo.sys" -- [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\ntio922] "ImagePath"="System32\Drivers\ntio922.sys" . ------------------------ Other Running Processes ------------------------ . C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\Program Files\Common Files\LightScribe\LSSrvc.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\WINDOWS\System32\nvsvc32.exe C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\WINDOWS\System32\imapi.exe . ************************************************************************** . Completion time: 2008-03-18 19:31:36 - machine was rebooted ComboFix-quarantined-files.txt 2008-03-18 18:31:28 ComboFix2.txt 2008-03-18 18:14:16

**Posty:** 18165 · przez **wojtas** 18 Mar 2008, 20:43

czysto

komputer muli, prosze o spr. loga

komputer muli, prosze o spr. loga

Kto jest na forum