proszę o sprawdzenie loga.

**Posty:** 19 · przez **FilleZill** 26 Lip 2007, 02:17

Witam

Od pewnego czasu mam problem z kompem a raczej z graniem na nim. Sprzęt spełnia wymogi gry na wysokich detalach a nawet jak daje na niski to sa przywieszki. Proszę o sprawdzenie loga:

Kod: Zaznacz wszystko: Logfile of HijackThis v1.99.1 Scan saved at 02:06:43, on 2007-07-26 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: D:\WINDOWS\System32\smss.exe D:\WINDOWS\system32\winlogon.exe D:\WINDOWS\system32\services.exe D:\WINDOWS\system32\lsass.exe D:\WINDOWS\system32\svchost.exe D:\WINDOWS\System32\svchost.exe D:\WINDOWS\Explorer.EXE D:\WINDOWS\system32\spoolsv.exe D:\WINDOWS\system32\Rundll32.exe D:\Program Files\Java\jre1.6.0_01\bin\jusched.exe D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe D:\WINDOWS\system32\ctfmon.exe D:\Program Files\Last.fm\LastFMHelper.exe D:\WINDOWS\system32\winlogin.exe D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe D:\WINDOWS\system32\nvsvc32.exe D:\WINDOWS\system32\wscntfy.exe D:\WINDOWS\System32\svchost.exe D:\WINDOWS\system32\winlogin.exe D:\WINDOWS\system32\winlogin.exe D:\Program Files\Mozilla Firefox\firefox.exe D:\WINDOWS\system32\winlogin.exe D:\WINDOWS\system32\winlogin.exe D:\Program Files\Internet Explorer\iexplore.exe D:\Program Files\Internet Explorer\iexplore.exe D:\Program Files\Internet Explorer\iexplore.exe D:\Program Files\Internet Explorer\iexplore.exe D:\Program Files\Internet Explorer\iexplore.exe C:\hijackthis_199\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.wp.pl/ R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = : R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - D:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - D:\Program Files\Internet Download Manager\IDMIECC.dll O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - D:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - D:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O3 - Toolbar: (no name) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - (no file) O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - D:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE D:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [P17Helper] Rundll32 P17.dll,P17Helper O4 - HKLM\..\Run: [SunJavaUpdateSched] "D:\Program Files\Java\jre1.6.0_01\bin\jusched.exe" O4 - HKLM\..\Run: [NeroFilterCheck] D:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE D:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [OutpostFeedBack] D:\Program Files\Agnitum\Outpost Firewall\feedback.exe /dump:os_startup O4 - HKLM\..\Run: [AVP] "D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe" O4 - HKCU\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [PowerBar] "D:\Program Files\CyberLink DVD Solution\Multimedia Launcher\PowerBar.exe" /AtBootTime O4 - HKCU\..\Run: [Skype] "D:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized O4 - HKCU\..\Run: [MSMSGS] "D:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [DAEMON Tools] "D:\Program Files\DAEMON Tools\daemon.exe" -lang 1033 O4 - HKCU\..\Run: [TorCP] D:\Program Files\TorCP\torcp.exe O4 - HKCU\..\Run: [ADS] C:\Windows\ADS.exe O4 - HKCU\..\Run: [BitTorrent] "D:\Program Files\BitTorrent\bittorrent.exe" --force_start_minimized O4 - HKCU\..\Run: [PeerGuardian] D:\Program Files\PeerGuardian2\pg2.exe O4 - Startup: RsGetPoints.lnk = C:\Rs.Get.Points\RsGetPts.exe O4 - Global Startup: Adobe Gamma Loader.lnk = D:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: Adobe Reader Speed Launch.lnk = D:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe O4 - Global Startup: Adobe Reader Synchronizer.lnk = D:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe O4 - Global Startup: Last.fm Helper.lnk = D:\Program Files\Last.fm\LastFMHelper.exe O4 - Global Startup: Privoxy.lnk = D:\Program Files\Privoxy\privoxy.exe O4 - Global Startup: winlogin.exe.lnk = D:\WINDOWS\system32\winlogin.exe O8 - Extra context menu item: Dodaj do blokowanych banerów - D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\ie_banner_deny.htm O8 - Extra context menu item: Download All Links with IDM - D:\Program Files\Internet Download Manager\IEGetAll.htm O8 - Extra context menu item: Download with IDM - D:\Program Files\Internet Download Manager\IEExt.htm O8 - Extra context menu item: RapidShare-Download - res://D:\DOCUME~1\ADMINI~1\USTAWI~1\Temp\ir_ext_temp_0\AutoPlay\Docs\more-rapid.exe/RsMenExt.html O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra button: Statystyki ochrony WWW - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\scieplugin.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - D:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O20 - AppInit_DLLs: D:\PROGRA~1\KASPER~1\KASPER~1.0\adialhk.dll O20 - Winlogon Notify: klogon - D:\WINDOWS\system32\klogon.dll O23 - Service: Ares Chatroom server (AresChatServer) - Ares Development Group - D:\Program Files\Ares\chatServer.exe O23 - Service: Kaspersky Internet Security 6.0 (AVP) - Unknown owner - D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe" -r (file missing) O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - D:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - D:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - D:\WINDOWS\system32\nvsvc32.exe O23 - Service: SF FrontLine Drivers Auto Removal (v1) (sfrem01) - Protection Technology (StarForce) - D:\WINDOWS\system32\sfrem01.exe

**Posty:** 18165 · przez **wojtas** 26 Lip 2007, 11:03

Pobierz i uruchom narzędzie
The Avenger
Zaznacz opcję Input script manually i kliknij na Lupkę z prawej strony. W okienku, które się otworzy wklejasz:

Files to delete:

C:\Windows\ADS.exe
D:\WINDOWS\system32\winlogin.exe

Klikasz Done, a następnie zielone światełko i zgadzasz się na restart klikając OK.
Po restarcie w HijackThis usuwasz wpis/y

O3 - Toolbar: (no name) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - (no file)
O4 - HKCU\..\Run: [ADS] C:\Windows\ADS.exe
O4 - Global Startup: winlogin.exe.lnk = D:\WINDOWS\system32\winlogin.exe

Kasujesz ręcznie z dysku plik: C:\Avenger\backup.zip i wklejasz na forum raport: C:\avenger.txt + log z loga z combofixa + hijacka

**Posty:** 19 · przez **FilleZill** 26 Lip 2007, 12:33

Avenger:

Kod: Zaznacz wszystko: Logfile of The Avenger version 1, by Swandog46 Running from registry key: \Registry\Machine\System\CurrentControlSet\Services\glkkpybh ******************* Script file located at: \??\D:\Documents and Settings\tcnrddpi.txt Script file opened successfully. Script file read successfully Backups directory opened successfully at D:\Avenger ******************* Beginning to process script file: File C:\Windows\ADS.exe deleted successfully. File D:\WINDOWS\system32\winlogin.exe deleted successfully. Completed script processing. ******************* Finished! Terminate.

Hijack:

Kod: Zaznacz wszystko: Logfile of HijackThis v1.99.1 Scan saved at 12:16:22, on 2007-07-26 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: D:\WINDOWS\System32\smss.exe D:\WINDOWS\system32\winlogon.exe D:\WINDOWS\system32\services.exe D:\WINDOWS\system32\lsass.exe D:\WINDOWS\system32\svchost.exe D:\WINDOWS\System32\svchost.exe D:\WINDOWS\Explorer.EXE D:\WINDOWS\system32\spoolsv.exe D:\WINDOWS\system32\Rundll32.exe D:\Program Files\Java\jre1.6.0_01\bin\jusched.exe D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe D:\WINDOWS\system32\ctfmon.exe D:\Program Files\Skype\Phone\Skype.exe D:\Program Files\DAEMON Tools\daemon.exe D:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe D:\Program Files\Last.fm\LastFMHelper.exe D:\WINDOWS\system32\notepad.exe D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe D:\WINDOWS\system32\nvsvc32.exe D:\WINDOWS\system32\wscntfy.exe D:\Program Files\Skype\Plugin Manager\SkypePM.exe D:\Program Files\Mozilla Firefox\firefox.exe D:\WINDOWS\system32\wuauclt.exe C:\hijackthis_199\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.wp.pl/ R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = : R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - D:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - D:\Program Files\Internet Download Manager\IDMIECC.dll O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - D:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - D:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - D:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE D:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [P17Helper] Rundll32 P17.dll,P17Helper O4 - HKLM\..\Run: [SunJavaUpdateSched] "D:\Program Files\Java\jre1.6.0_01\bin\jusched.exe" O4 - HKLM\..\Run: [NeroFilterCheck] D:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE D:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [OutpostFeedBack] D:\Program Files\Agnitum\Outpost Firewall\feedback.exe /dump:os_startup O4 - HKLM\..\Run: [AVP] "D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe" O4 - HKCU\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [PowerBar] "D:\Program Files\CyberLink DVD Solution\Multimedia Launcher\PowerBar.exe" /AtBootTime O4 - HKCU\..\Run: [Skype] "D:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized O4 - HKCU\..\Run: [MSMSGS] "D:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [DAEMON Tools] "D:\Program Files\DAEMON Tools\daemon.exe" -lang 1033 O4 - HKCU\..\Run: [TorCP] D:\Program Files\TorCP\torcp.exe O4 - HKCU\..\Run: [BitTorrent] "D:\Program Files\BitTorrent\bittorrent.exe" --force_start_minimized O4 - HKCU\..\Run: [PeerGuardian] D:\Program Files\PeerGuardian2\pg2.exe O4 - Startup: RsGetPoints.lnk = C:\Rs.Get.Points\RsGetPts.exe O4 - Global Startup: Adobe Gamma Loader.lnk = D:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: Adobe Reader Speed Launch.lnk = D:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe O4 - Global Startup: Adobe Reader Synchronizer.lnk = D:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe O4 - Global Startup: Last.fm Helper.lnk = D:\Program Files\Last.fm\LastFMHelper.exe O4 - Global Startup: Privoxy.lnk = D:\Program Files\Privoxy\privoxy.exe O8 - Extra context menu item: Dodaj do blokowanych banerów - D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\ie_banner_deny.htm O8 - Extra context menu item: Download All Links with IDM - D:\Program Files\Internet Download Manager\IEGetAll.htm O8 - Extra context menu item: Download with IDM - D:\Program Files\Internet Download Manager\IEExt.htm O8 - Extra context menu item: RapidShare-Download - res://D:\DOCUME~1\ADMINI~1\USTAWI~1\Temp\ir_ext_temp_0\AutoPlay\Docs\more-rapid.exe/RsMenExt.html O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra button: Statystyki ochrony WWW - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\scieplugin.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - D:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O20 - AppInit_DLLs: D:\PROGRA~1\KASPER~1\KASPER~1.0\adialhk.dll O20 - Winlogon Notify: klogon - D:\WINDOWS\system32\klogon.dll O23 - Service: Ares Chatroom server (AresChatServer) - Ares Development Group - D:\Program Files\Ares\chatServer.exe O23 - Service: Kaspersky Internet Security 6.0 (AVP) - Unknown owner - D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe" -r (file missing) O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - D:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - D:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - D:\WINDOWS\system32\nvsvc32.exe O23 - Service: SF FrontLine Drivers Auto Removal (v1) (sfrem01) - Protection Technology (StarForce) - D:\WINDOWS\system32\sfrem01.exe

Combofixa jak odpalam to mi sie robi reset kompa odrazu po uruchomieniu :evil:

**Posty:** 18165 · przez **wojtas** 26 Lip 2007, 15:14

daj loga z:

http://www.techsupportforum.com/sectools/Deckard/dss.exe

**Posty:** 19 · przez **FilleZill** 26 Lip 2007, 18:22

DSS:

Kod: Zaznacz wszystko: Deckard's System Scanner v20070711.54 Run by Administrator on 2007-07-26 at 18:15:07 Computer is in Normal Mode. -------------------------------------------------------------------------------- -- System Restore -------------------------------------------------------------- System Restore is disabled; attempting to re-enable...success. -- Last 1 Restore Point(s) -- 1: 2007-07-26 16:15:46 UTC - RP1 - Punkt kontrolny systemu Backed up registry hives. Performed disk cleanup. -- HijackThis (run as Administrator.exe) --------------------------------------- Logfile of HijackThis v1.99.1 Scan saved at 18:17, on 2007-07-26 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: D:\WINDOWS\System32\smss.exe D:\WINDOWS\system32\winlogon.exe D:\WINDOWS\system32\services.exe D:\WINDOWS\system32\lsass.exe D:\WINDOWS\system32\svchost.exe D:\WINDOWS\System32\svchost.exe D:\WINDOWS\system32\spoolsv.exe D:\WINDOWS\Explorer.EXE D:\WINDOWS\system32\Rundll32.exe D:\Program Files\Java\jre1.6.0_01\bin\jusched.exe D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe D:\WINDOWS\system32\ctfmon.exe D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe D:\Program Files\DAEMON Tools\daemon.exe D:\WINDOWS\system32\nvsvc32.exe D:\Program Files\Last.fm\LastFMHelper.exe D:\WINDOWS\system32\wscntfy.exe C:\dss.exe C:\HIJACK~1\Administrator.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.wp.pl/ R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = : R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - D:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - D:\Program Files\Internet Download Manager\IDMIECC.dll O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - D:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - D:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - D:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [P17Helper] Rundll32 P17.dll,P17Helper O4 - HKLM\..\Run: [SunJavaUpdateSched] "D:\Program Files\Java\jre1.6.0_01\bin\jusched.exe" O4 - HKLM\..\Run: [OutpostFeedBack] D:\Program Files\Agnitum\Outpost Firewall\feedback.exe /dump:os_startup O4 - HKLM\..\Run: [AVP] "D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe" O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE D:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k O4 - HKCU\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [PowerBar] "D:\Program Files\CyberLink DVD Solution\Multimedia Launcher\PowerBar.exe" /AtBootTime O4 - HKCU\..\Run: [Skype] "D:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized O4 - HKCU\..\Run: [MSMSGS] "D:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [DAEMON Tools] "D:\Program Files\DAEMON Tools\daemon.exe" -lang 1033 O4 - HKCU\..\Run: [TorCP] D:\Program Files\TorCP\torcp.exe O4 - HKCU\..\Run: [BitTorrent] "D:\Program Files\BitTorrent\bittorrent.exe" --force_start_minimized O4 - HKCU\..\Run: [PeerGuardian] D:\Program Files\PeerGuardian2\pg2.exe O4 - Startup: RsGetPoints.lnk = C:\Rs.Get.Points\RsGetPts.exe O4 - Global Startup: Adobe Gamma Loader.lnk = D:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: Adobe Reader Speed Launch.lnk = D:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe O4 - Global Startup: Adobe Reader Synchronizer.lnk = D:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe O4 - Global Startup: Last.fm Helper.lnk = D:\Program Files\Last.fm\LastFMHelper.exe O4 - Global Startup: Privoxy.lnk = D:\Program Files\Privoxy\privoxy.exe O8 - Extra context menu item: Dodaj do blokowanych banerów - D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\ie_banner_deny.htm O8 - Extra context menu item: Download All Links with IDM - D:\Program Files\Internet Download Manager\IEGetAll.htm O8 - Extra context menu item: Download with IDM - D:\Program Files\Internet Download Manager\IEExt.htm O8 - Extra context menu item: RapidShare-Download - res://D:\DOCUME~1\ADMINI~1\USTAWI~1\Temp\ir_ext_temp_0\AutoPlay\Docs\more-rapid.exe/RsMenExt.html O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra button: Statystyki ochrony WWW - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\scieplugin.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - D:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O20 - AppInit_DLLs: D:\PROGRA~1\KASPER~1\KASPER~1.0\adialhk.dll O20 - Winlogon Notify: klogon - D:\WINDOWS\system32\klogon.dll O23 - Service: Ares Chatroom server (AresChatServer) - Ares Development Group - D:\Program Files\Ares\chatServer.exe O23 - Service: Kaspersky Internet Security 6.0 (AVP) - Unknown owner - D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe" -r (file missing) O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - D:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - D:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - D:\WINDOWS\system32\nvsvc32.exe O23 - Service: SF FrontLine Drivers Auto Removal (v1) (sfrem01) - Protection Technology (StarForce) - D:\WINDOWS\system32\sfrem01.exe -- HijackThis Fixed Entries (C:\HIJACK~1\backups\) ----------------------------- backup-20070726-120903-523 O4 - Global Startup: winlogin.exe.lnk = D:\WINDOWS\system32\winlogin.exe backup-20070726-120903-680 O4 - HKCU\..\Run: [ADS] C:\Windows\ADS.exe backup-20070726-120903-950 O3 - Toolbar: (no name) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - (no file) -- File Associations ----------------------------------------------------------- [COLOR=red].cpl - cplfile - shell\cplopen\command - rundll32.exe shell32.dll,Control_RunDLL "%1",%*[/COLOR] [COLOR=red].cpl - cplfile - shell\runas\command - rundll32.exe shell32.dll,Control_RunDLLAsUser "%1",%*[/COLOR] -- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------- R0 prohlp02 (StarForce Protection Helper Driver v2) - d:\windows\system32\drivers\prohlp02.sys <Not Verified; Protection Technology; StarForce Protection System> R0 prosync1 (StarForce Protection Synchronization Driver v1) - d:\windows\system32\drivers\prosync1.sys <Not Verified; Protection Technology; StarForce Protection System> R0 sfdrv01 (StarForce Protection Environment Driver (version 1.x)) - d:\windows\system32\drivers\sfdrv01.sys <Not Verified; Protection Technology; StarForce Protection System> R0 sfhlp01 (StarForce Protection Helper Driver) - d:\windows\system32\drivers\sfhlp01.sys <Not Verified; Protection Technology; StarForce Protection System> R0 sfhlp02 (StarForce Protection Helper Driver (version 2.x)) - d:\windows\system32\drivers\sfhlp02.sys <Not Verified; Protection Technology; StarForce Protection System> R0 sfsync02 (StarForce Protection Synchronization Driver (version 2.x)) - d:\windows\system32\drivers\sfsync02.sys <Not Verified; Protection Technology; StarForce Protection System> R0 sfvfs02 (StarForce Protection VFS Driver (version 2.x)) - d:\windows\system32\drivers\sfvfs02.sys <Not Verified; Protection Technology; StarForce Protection System> R0 Vax347b - d:\windows\system32\drivers\vax347b.sys R0 Vax347s - d:\windows\system32\drivers\vax347s.sys R1 prodrv06 (StarForce Protection Environment Driver v6) - d:\windows\system32\drivers\prodrv06.sys <Not Verified; Protection Technology; StarForce Protection System> S0 jkjuqikl - d:\windows\system32\drivers\uylfrnye.sys (file missing) S3 cel90xbe - d:\docume~1\admini~1\ustawi~1\temp\cel90xbe.sys (file missing) S3 dump_wmimmc - c:\program files\games-masters.com\cabal online (europe)\gameguard\dump_wmimmc.sys (file missing) S3 GMSIPCI - e:\install\gmsipci.sys (file missing) S3 NPPTNT2 - d:\windows\system32\npptnt2.sys <Not Verified; INCA Internet Co., Ltd.; nProtect NPSC Kernel Mode Driver for NT> S3 NTACCESS - e:\ntaccess.sys (file missing) S3 SetupNTGLM7X - e:\ntglm7x.sys (file missing) S4 ARP.DLL (Outpost Firewall PlugIn (ARP.DLL)) - d:\program files\agnitum\outpost firewall\kernel\arp.dll (file missing) S4 SandBox (Outpost Firewall Sandbox Driver) - d:\program files\agnitum\outpost firewall\kernel\sandbox.sys (file missing) S4 SECRET.DLL (Outpost Firewall PlugIn (SECRET.DLL)) - d:\program files\agnitum\outpost firewall\kernel\secret.dll (file missing) -- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled -------------------- S3 AresChatServer (Ares Chatroom server) - d:\program files\ares\chatserver.exe <Not Verified; Ares Development Group; Ares Chat Server> S3 FLEXnet Licensing Service - "d:\program files\common files\macrovision shared\flexnet publisher\fnplicensingservice.exe" <Not Verified; Macrovision Europe Ltd.; FLEXnet Publisher (32 bit)> -- Files created between 2007-06-26 and 2007-07-26 ----------------------------- 2007-07-26 12:12:38 0 --------- D:\WINDOWS\system32\drivers\hbgnipj 2007-07-15 13:14:28 0 d-------- D:\Program Files\BitLord 2007-07-15 12:37:18 0 d-------- D:\Program Files\Azureus 2007-07-14 23:31:11 0 d-------- D:\Program Files\PeerGuardian2 2007-07-14 22:55:19 0 d-------- D:\eMule 2007-07-14 10:24:36 0 d-------- D:\Program Files\BitTorrent 2007-07-13 21:50:57 0 d-------- D:\Program Files\GameSpy Arcade 2007-07-13 08:38:27 0 d-------- D:\Program Files\Magic MP3 Tagger 2007-07-09 14:27:35 0 d-------- D:\Program Files\GoD 2007-07-07 22:48:28 0 d-------- D:\Program Files\Hamachi 2007-07-05 19:44:32 327168 --a------ D:\WINDOWS\IsUn0415.exe <Not Verified; InstallShield Software Corporation; InstallShield® unInstaller> 2007-06-30 15:07:05 0 d-------- D:\Program Files\Common Files\Macrovision Shared 2007-06-30 14:56:01 0 d-------- D:\Program Files\MagicISO 2007-06-29 22:54:43 0 d-------- D:\Program Files\Game Cam v1.4 2007-06-29 20:00:14 0 d-------- D:\Adobe_Premiere 2007-06-26 21:15:17 54313 --a------ D:\Program Files\tor-bundle-uninstall.exe <Not Verified; ; Tor-TorCP-Privoxy Bundle> 2007-06-26 20:50:13 0 d-------- D:\Program Files\Secure Surfing Engine 2007-06-26 20:50:09 0 d-------- D:\Program Files\Steganos Internet Anonym Pro 7 -- Find3M Report --------------------------------------------------------------- 2007-07-26 12:29:38 0 d-------- D:\Documents and Settings\Administrator\Dane aplikacji\Skype 2007-07-26 11:05:25 0 d-------- D:\Documents and Settings\Administrator\Dane aplikacji\Tibia 2007-07-26 01:13:59 0 d-------- D:\Documents and Settings\Administrator\Dane aplikacji\DMCache 2007-07-25 21:32:32 0 d-------- D:\Documents and Settings\Administrator\Dane aplikacji\Gadu-Gadu 2007-07-25 21:06:55 0 d-------- D:\Program Files\Gadu-Gadu 2007-07-25 15:52:11 0 d--h----- D:\Program Files\InstallShield Installation Information 2007-07-25 15:51:44 0 d-------- D:\Documents and Settings\Administrator\Dane aplikacji\InstallShield 2007-07-23 23:57:12 0 d-------- D:\Documents and Settings\Administrator\Dane aplikacji\Hamachi 2007-07-16 09:11:13 0 d-------- D:\Program Files\Java 2007-07-15 14:15:39 0 d-------- D:\Program Files\Torrent Master 2007-07-15 13:08:06 0 d-------- D:\Documents and Settings\Administrator\Dane aplikacji\Azureus 2007-07-14 10:29:41 0 d-------- D:\Documents and Settings\Administrator\Dane aplikacji\BitTorrent 2007-07-14 10:23:34 0 d-------- D:\Program Files\BitComet 2007-07-13 08:24:46 0 d-------- D:\Program Files\Last.fm 2007-06-30 23:08:55 0 d-------- D:\Documents and Settings\Administrator\Dane aplikacji\Dev-Cpp 2007-06-30 20:47:10 0 d-------- D:\Documents and Settings\Administrator\Dane aplikacji\GetRightToGo 2007-06-30 15:00:37 0 d-------- D:\Program Files\Common Files\Adobe 2007-06-30 11:51:54 0 d-------- D:\Program Files\RPG Tsukuru XP 2007-06-30 11:49:19 0 d-------- D:\Program Files\Common Files\Agnitum Shared 2007-06-29 23:47:40 0 d-------- D:\Documents and Settings\Administrator\Dane aplikacji\Tor 2007-06-29 22:51:26 0 d-------- D:\Program Files\Game Cam 2007-06-26 20:13:30 0 d-------- D:\Program Files\Winamp 2007-06-26 17:38:00 0 d-------- D:\Program Files\Belt Generator 2007-06-25 19:07:21 0 d-------- D:\Program Files\SystemRequirementsLab 2007-06-25 09:00:58 0 d-------- D:\Program Files\Asprate 2007-06-22 09:42:45 0 d-------- D:\Program Files\Agnitum 2007-06-19 18:06:22 0 d-------- D:\Program Files\No-IP 2007-06-18 11:55:10 0 d-------- D:\Documents and Settings\Administrator\Dane aplikacji\Help 2007-06-09 00:28:06 0 d-------- D:\Program Files\WinUHA 2007-06-07 07:41:34 0 d-------- D:\Program Files\Internet Download Manager 2007-06-07 00:50:08 0 d-------- D:\Program Files\WinAVIVideoConverter 2007-06-07 00:49:59 3082 --a------ D:\WINDOWS\system32\affv208325p1now.sys 2007-06-07 00:40:30 0 d-------- D:\Program Files\Real Alternative 2007-06-07 00:40:24 0 d-------- D:\Program Files\Media Player Classic 2007-06-07 00:40:22 0 d-------- D:\Documents and Settings\Administrator\Dane aplikacji\Real 2007-06-07 00:32:27 0 d-------- D:\Program Files\WinAVI Video Converter 2007-06-07 00:22:18 35 --a------ D:\WINDOWS\system32\winitn.dll 2007-06-07 00:22:16 196608 --a------ D:\WINDOWS\system32\maag.dll <Not Verified; NCT Company Ltd.; NCTWMAFile2 ActiveX DLL> 2007-06-07 00:22:16 1212416 --a------ D:\WINDOWS\system32\ckll.dll <Not Verified; NCT Company Ltd.; NCTAudioInformation2 ActiveX DLL> 2007-06-07 00:22:16 1245184 --a------ D:\WINDOWS\system32\bkll.dll <Not Verified; NCT Company Ltd.; NCTRMFile ActiveX DLL> 2007-06-07 00:22:15 1986560 --a------ D:\WINDOWS\system32\akll.dll <Not Verified; NCT Company Ltd.; NCTAudioFile2 ActiveX DLL> 2007-06-07 00:22:15 2535424 --a------ D:\WINDOWS\system32\agsaamj.dll <Not Verified; Online Media Technologies Ltd.; NCTAudioCompress3 Module> 2007-06-07 00:22:15 90112 --a------ D:\WINDOWS\system32\agsaami.dll <Not Verified; Online Media Technologies Ltd.; NCTAudioFormatSettings3 Module> 2007-06-07 00:22:15 610304 --a------ D:\WINDOWS\system32\agsaamg.dll <Not Verified; Online Media Technologies Ltd.; NCTAudioFile3 Module> 2007-06-07 00:22:15 372736 --a------ D:\WINDOWS\system32\agsaamc.dll <Not Verified; Online Media Technologies Ltd.; NCTAudioFileWMA3 Module> 2007-06-07 00:22:11 0 d-------- D:\Program Files\Alo RM Converter 2007-06-07 00:10:24 0 d-------- D:\Program Files\KGB Archiver 2 2007-06-07 00:09:26 448004 --a------ D:\WINDOWS\system32\perfh015.dat 2007-06-07 00:09:26 74230 --a------ D:\WINDOWS\system32\perfc015.dat 2007-06-06 23:40:52 0 d-------- D:\Program Files\7-Zip 2007-06-06 22:12:50 0 d-------- D:\Documents and Settings\Administrator\Dane aplikacji\WNR 2007-06-06 21:16:44 0 d-------- D:\Documents and Settings\Administrator\Dane aplikacji\CrystalSpace 2007-06-06 21:16:44 0 d-------- D:\Documents and Settings\Administrator\Dane aplikacji\CrystalApp 2007-06-06 14:30:29 0 d-------- D:\Documents and Settings\Administrator\Dane aplikacji\Media Player Classic 2007-06-05 21:41:08 0 d-------- D:\Documents and Settings\Administrator\Dane aplikacji\IDM -- Registry Dump --------------------------------------------------------------- [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects] {0055C089-8582-441B-A0BF-17B458C2A3A8} D:\Program Files\Internet Download Manager\IDMIECC.dll {02478D38-C3F9-4EFB-9B51-7695ECA05670} D:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} D:\Program Files\Java\jre1.6.0_01\bin\ssv.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run] "nwiz"="nwiz.exe /install" "P17Helper"="Rundll32 P17.dll,P17Helper" "SunJavaUpdateSched"="\"D:\\Program Files\\Java\\jre1.6.0_01\\bin\\jusched.exe\"" "OutpostFeedBack"="D:\\Program Files\\Agnitum\\Outpost Firewall\\feedback.exe /dump:os_startup" "AVP"="\"D:\\Program Files\\Kaspersky Lab\\Kaspersky Internet Security 6.0\\avp.exe\"" "NvCplDaemon"="RUNDLL32.EXE D:\\WINDOWS\\system32\\NvCpl.dll,NvStartup" "KernelFaultCheck"=hex(2):25,73,79,73,74,65,6d,72,6f,6f,74,25,5c,73,79,73,74,\ [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run] "CTFMON.EXE"="D:\\WINDOWS\\system32\\ctfmon.exe" "PowerBar"="\"D:\\Program Files\\CyberLink DVD Solution\\Multimedia Launcher\\PowerBar.exe\" /AtBootTime" "Skype"="\"D:\\Program Files\\Skype\\Phone\\Skype.exe\" /nosplash /minimized" "MSMSGS"="\"D:\\Program Files\\Messenger\\msmsgs.exe\" /background" "DAEMON Tools"="\"D:\\Program Files\\DAEMON Tools\\daemon.exe\" -lang 1033" "TorCP"="D:\\Program Files\\TorCP\\torcp.exe" "BitTorrent"="\"D:\\Program Files\\BitTorrent\\bittorrent.exe\" --force_start_minimized" "PeerGuardian"="D:\\Program Files\\PeerGuardian2\\pg2.exe" [HKEY_USERS\.default\software\microsoft\windows\currentversion\run] "CTFMON.EXE"="D:\\WINDOWS\\System32\\CTFMON.EXE" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] "appinit_dlls"="D:\PROGRA~1\KASPER~1\KASPER~1.0\adialhk.dll" HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa Authentication Packages REG_MULTI_SZ msv1_0\0\0 Security Packages REG_MULTI_SZ kerberos\0msv1_0\0schannel\0wdigest\0\0 Notification Packages REG_MULTI_SZ scecli\0\0 [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Svchost] HTTPFilter REG_MULTI_SZ HTTPFilter\0\0 LocalService REG_MULTI_SZ Alerter\0WebClient\0LmHosts\0RemoteRegistry\0upnphost\0SSDPSRV\0\0 NetworkService REG_MULTI_SZ DnsCache\0\0 DcomLaunch REG_MULTI_SZ DcomLaunch\0TermService\0\0 rpcss REG_MULTI_SZ RpcSs\0\0 imgsvc REG_MULTI_SZ StiSvc\0\0 termsvcs REG_MULTI_SZ TermService\0\0 [HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{7e2e2d56-a937-11db-a123-806d6172696f}] Shell\AutoRun\command F:\autorun.exe -- End of Deckard's System Scanner: finished at 2007-07-26 at 18:18:26 ---------

**Posty:** 18165 · przez **wojtas** 26 Lip 2007, 19:07

i uruchom narzędzie
The Avenger
Zaznacz opcję Input script manually i kliknij na Lupkę z prawej strony. W okienku, które się otworzy wklejasz:

Drivers to unload:

jkjuqikl
cel90xbe

Files to delete:

D:\WINDOWS\system32\drivers\hbgnipj
d:\docume~1\admini~1\ustawi~1\temp\cel90xbe.sys
d:\windows\system32\drivers\uylfrnye.sys

Klikasz Done, a następnie zielone światełko i zgadzasz się na restart klikając OK.

juz powinno byc ok po tej operacji

**Posty:** 19 · przez **FilleZill** 26 Lip 2007, 20:22

Kod: Zaznacz wszystko: Logfile of The Avenger version 1, by Swandog46 Running from registry key: \Registry\Machine\System\CurrentControlSet\Services\edboatw^ ******************* Script file located at: \??\D:\Documents and Settings\rockcfer.txt Script file opened successfully. Script file read successfully Backups directory opened successfully at D:\Avenger ******************* Beginning to process script file: Driver jkjuqikl unloaded successfully. Driver cel90xbe unloaded successfully. File D:\WINDOWS\system32\drivers\hbgnipj not found! Deletion of file D:\WINDOWS\system32\drivers\hbgnipj failed! Could not process line: D:\WINDOWS\system32\drivers\hbgnipj Status: 0xc0000034 File d:\docume~1\admini~1\ustawi~1\temp\cel90xbe.sys not found! Deletion of file d:\docume~1\admini~1\ustawi~1\temp\cel90xbe.sys failed! Could not process line: d:\docume~1\admini~1\ustawi~1\temp\cel90xbe.sys Status: 0xc0000034 File d:\windows\system32\drivers\uylfrnye.sys not found! Deletion of file d:\windows\system32\drivers\uylfrnye.sys failed! Could not process line: d:\windows\system32\drivers\uylfrnye.sys Status: 0xc0000034 Completed script processing. ******************* Finished! Terminate.////////////////////////////////////////// Logfile of The Avenger version 1, by Swandog46 Running from registry key: \Registry\Machine\System\CurrentControlSet\Services\edboatw^ ******************* Script file located at: \??\D:\Documents and Settings\rockcfer.txt Script file not found! Error Could not open script file! Status: 0xc0000034 Abort!

Nic to nie dało

**Posty:** 18165 · przez **wojtas** 26 Lip 2007, 21:12

uruchom avengera :

Zaznacz opcję Input script manually i kliknij na Lupkę z prawej strony. W okienku, które się otworzy wklejasz:

Folders to delete:

D:\WINDOWS\system32\drivers\hbgnipj

Klikasz Done, a następnie zielone światełko i zgadzasz się na restart klikając OK.

proszę o sprawdzenie loga.

Proszę o sprawdzenie loga.

Kto jest na forum