prośba o sprawdzenie loga

**Posty:** 14 · przez **ProQ** 19 Lut 2008, 23:59

Witam! Mam problem: samoczynnie rozłącza mi internet po kilku godzinach lub kilka minutach(Używam aplikacji dostępowej Neostrady). Dodam ze nie wyskakuje mi nic typu "Użytkownik został odłączony od usługi" nic mi nie wyskakuje po prostu nie moge wejść na żadną stronę ani nie mogę korzystać z Internetu

Z góry dziękuje Użytkownikom za pomoc

Logi:
ComboFix

Kod: Zaznacz wszystko: ComboFix 08-02-20.2 - Prowik 2008-02-19 22:32:38.1 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.399 [GMT 1:00] Running from: C:\Documents and Settings\Prowik\Pulpit\ComboFix.exe * Created a new restore point [color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color] . ((((((((((((((((((((((((( Files Created from 2008-01-20 to 2008-02-20 ))))))))))))))))))))))))))))))) . 2008-02-19 22:17 . 1998-10-29 16:45 306,688 --a------ C:\WINDOWS\IsUninst.exe 2008-02-19 22:16 . 2008-02-19 22:16 <DIR> d-------- C:\SB128CT5808WinXP 2008-02-19 19:49 . 2008-02-19 19:49 <DIR> d-------- C:\Documents and Settings\Prowik\Dane aplikacji\AdobeUM 2008-02-19 19:48 . 2008-02-19 19:48 <DIR> d-------- C:\Program Files\Common Files\Adobe 2008-02-19 14:17 . 2008-02-19 14:17 <DIR> d-------- C:\Program Files\Tasker 2008-02-19 12:01 . 2008-02-19 12:01 54,156 --ah----- C:\WINDOWS\QTFont.qfn 2008-02-19 12:01 . 2008-02-19 12:01 1,409 --a------ C:\WINDOWS\QTFont.for 2008-02-19 09:29 . 2005-07-21 08:33 32,768 --a------ C:\WINDOWS\system32\WooDial2000.dll 2008-02-19 09:25 . 2008-02-19 22:14 <DIR> d-------- C:\Program Files\Neostrada TP 2008-02-18 21:18 . 2008-02-18 21:18 <DIR> d--hs---- C:\WINDOWS\ftpcache 2008-02-18 21:09 . 2008-02-19 21:38 <DIR> d-------- C:\Downloads 2008-02-18 21:03 . 2008-02-18 21:03 <DIR> d-------- C:\Program Files\BearShare 2008-02-18 21:03 . 2008-02-19 11:57 <DIR> d-------- C:\My Downloads 2008-02-18 18:33 . 2008-02-18 18:33 <DIR> d-------- C:\Program Files\BearShare Applications 2008-02-18 18:33 . 2006-11-12 11:39 483,328 --a------ C:\WINDOWS\system32\actskn45.ocx 2008-02-18 15:29 . 2001-08-17 20:19 40,704 --a------ C:\WINDOWS\system32\drivers\es1371mp.sys 2008-02-18 15:29 . 2004-08-03 23:08 10,624 --a------ C:\WINDOWS\system32\drivers\gameenum.sys 2008-02-18 15:03 . 2008-02-19 12:30 512 --a------ C:\ScanSectorLog.dat 2008-02-18 14:57 . 2008-02-19 22:01 805 --a------ C:\rollback.ini 2008-02-18 14:34 . 2008-02-18 14:34 <DIR> d-------- C:\Documents and Settings\Prowik\Dane aplikacji\MailFrontier 2008-02-18 14:32 . 2008-02-19 22:09 5,279,264 --ahs---- C:\WINDOWS\system32\drivers\fidbox.dat 2008-02-18 14:32 . 2008-02-20 22:34 78,112 --ahs---- C:\WINDOWS\system32\drivers\fidbox2.dat 2008-02-18 14:32 . 2008-02-19 13:41 72,392 --ahs---- C:\WINDOWS\system32\drivers\fidbox.idx 2008-02-18 14:32 . 2008-02-19 13:41 9,980 --ahs---- C:\WINDOWS\system32\drivers\fidbox2.idx 2008-02-18 14:26 . 2007-05-16 16:45 3,497,832 --a------ C:\WINDOWS\system32\d3dx9_34.dll 2008-02-18 14:26 . 2007-05-16 16:45 3,497,832 --a------ C:\WINDOWS\system\d3dx9_34.dll 2008-02-18 13:48 . 2007-03-09 00:02 75,512 --a------ C:\WINDOWS\zllsputility.exe 2008-02-18 13:48 . 2008-02-19 22:14 4,212 ---h----- C:\WINDOWS\system32\zllictbl.dat 2008-02-18 13:47 . 2008-02-18 13:47 <DIR> d-------- C:\Program Files\Zone Labs 2008-02-18 13:47 . 2008-02-18 13:47 <DIR> d-------- C:\Program Files\Spybot - Search & Destroy 2008-02-18 13:47 . 2008-02-18 17:25 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Spybot - Search & Destroy 2008-02-18 12:07 . 2008-02-18 12:07 <DIR> d-------- C:\Program Files\Java 2008-02-18 12:07 . 2007-09-24 23:31 69,632 --a------ C:\WINDOWS\system32\javacpl.cpl 2008-02-18 12:03 . 2008-02-18 12:03 1,158 --a------ C:\WINDOWS\mozver.dat 2008-02-18 12:00 . 2008-02-18 12:00 <DIR> d-------- C:\Program Files\Common Files\Java 2008-02-18 11:24 . 2008-02-18 11:24 <DIR> d-------- C:\Documents and Settings\Prowik\Dane aplikacji\TuneUp Software 2008-02-18 11:23 . 2008-02-18 11:24 <DIR> d-------- C:\Program Files\TuneUp Utilities 2007 2008-02-18 11:23 . 2008-02-18 11:23 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\TuneUp Software 2008-02-18 11:23 . 2007-05-16 09:41 29,704 --a------ C:\WINDOWS\system32\uxtuneup.dll 2008-02-18 01:07 . 2008-02-18 01:07 <DIR> d-------- C:\WINDOWS\system32\XPSViewer 2008-02-18 01:07 . 2008-02-18 01:07 <DIR> d-------- C:\Program Files\Reference Assemblies 2008-02-18 01:07 . 2008-02-18 01:07 <DIR> d-------- C:\Program Files\MSBuild 2008-02-18 01:05 . 2006-06-29 13:07 14,048 --------- C:\WINDOWS\system32\spmsg2.dll 2008-02-18 01:00 . 2008-02-18 01:00 <DIR> d-------- C:\Program Files\MSXML 6.0 2008-02-18 01:00 . 2006-10-16 16:10 23,856 --a------ C:\WINDOWS\system32\spupdsvc.exe . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-02-19 21:25 --------- d-----w C:\Documents and Settings\Prowik\Dane aplikacji\The Bat! 2008-02-19 12:41 2,158,592 ----a-w C:\WINDOWS\Internet Logs\xDB2.tmp 2008-02-19 12:41 1,597,952 ----a-w C:\WINDOWS\Internet Logs\xDB1.tmp 2008-02-18 11:59 12,400 ----a-w C:\WINDOWS\system32\drivers\secdrv.sys 2008-02-18 11:28 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-02-18 11:09 --------- d-----w C:\Program Files\Common Files\InstallShield 2008-02-18 10:23 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard 2008-02-18 09:54 --------- d-----w C:\Documents and Settings\Prowik\Dane aplikacji\Winamp 2008-02-18 09:53 --------- d-----w C:\Program Files\ESET 2008-02-17 23:38 --------- d-----w C:\Program Files\AMD 2008-02-17 23:38 --------- d-----w C:\Documents and Settings\Prowik\Dane aplikacji\InstallShield 2008-02-17 23:32 --------- d-----w C:\Program Files\D-Tools 2008-02-17 23:30 720,896 ----a-w C:\WINDOWS\iun6002.exe 2008-02-17 23:30 --------- d-----w C:\Program Files\Lavasoft 2008-02-17 23:30 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Lavasoft 2008-02-17 23:28 98,304 ----a-w C:\WINDOWS\system32\qttask.exe 2008-02-17 23:28 512,096 ----a-w C:\WINDOWS\system32\drivers\amon.sys 2008-02-17 23:28 298,104 ----a-w C:\WINDOWS\system32\imon.dll 2008-02-17 23:28 15,424 ----a-w C:\WINDOWS\system32\drivers\nod32drv.sys 2008-02-17 23:27 --------- d-----w C:\Program Files\ACE Mega CoDecS Pack 2008-02-17 23:27 --------- d-----w C:\Documents and Settings\Prowik\Dane aplikacji\Gadu-Gadu 2008-02-17 23:26 --------- d-----w C:\Program Files\Winamp 2008-02-17 23:26 --------- d-----w C:\Program Files\Gadu-Gadu 2008-02-17 23:25 --------- d-----w C:\Program Files\The Bat! 2008-02-17 23:09 --------- d-----w C:\Program Files\ZTE Corporation 2008-02-17 23:05 315,392 ----a-w C:\WINDOWS\HideWin.exe 2008-02-17 23:05 --------- d-----w C:\Program Files\Realtek 2008-02-17 22:53 --------- d-----w C:\Program Files\Usługi online 2008-02-17 22:51 --------- d-----w C:\Program Files\Windows Media Connect 2 . ------- Sigcheck ------- "C:\WINDOWS\system32\user32.dll" ----a-w 642,560 2007-07-10 13:06:54 C:\WINDOWS\system32\user32.dll "C:\WINDOWS\system32\wininet.dll" ----a-w 814,592 2007-07-13 22:56:20 C:\WINDOWS\system32\wininet.dll "C:\WINDOWS\system32\drivers\tcpip.sys" ----a-w 360,576 2007-10-15 23:19:49 C:\WINDOWS\system32\drivers\tcpip.sys "C:\WINDOWS\system32\ntoskrnl.exe" ----a-w 2,145,280 2007-10-18 22:19:31 C:\WINDOWS\system32\ntoskrnl.exe "C:\WINDOWS\explorer.exe" ----a-w 974,848 2007-10-17 19:30:07 C:\WINDOWS\explorer.exe . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 03:44 15360] "Gadu-Gadu"="C:\Program Files\Gadu-Gadu\gg.exe" [2007-11-14 11:54 2131392] "SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2007-08-31 16:46 1460560] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "RTHDCPL"="RTHDCPL.EXE" [2007-08-10 08:21 16384000 C:\WINDOWS\RTHDCPL.exe] "CnxDslTaskBar"="C:\Program Files\ZTE Corporation\ZXDSL852\CnxDslTb.exe" [2005-07-21 21:52 278528] "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-05-10 23:03 8429568] "nwiz"="nwiz.exe" [2007-05-10 23:03 1626112 C:\WINDOWS\system32\nwiz.exe] "NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-05-10 23:03 81920] "nod32kui"="C:\Program Files\Eset\nod32kui.exe" [2008-02-18 00:28 949376] "Resume copy"="copyfstq.exe" [2002-03-24 12:54 46080 C:\WINDOWS\COPYFSTQ.EXE] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11 132496] "ZoneAlarm Client"="C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [2007-03-09 00:02 919280] "WOOWATCH"="C:\PROGRA~1\NEOSTR~1\Watch.exe" [2005-07-21 08:33 20480] "WOOTASKBARICON"="C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe" [2005-07-21 08:33 53248] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 03:44 15360] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce] "nltide_2"="regsvr32 /s /n /i:U shell32" [] "nltide_3"="advpack.dll" [2007-10-09 01:01 124928 C:\WINDOWS\system32\advpack.dll] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "DisableStatusMessages"= 1 (0x1) [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] "NoSMMyPictures"= 1 (0x1) "NoSMConfigurePrograms"= 1 (0x1) "NoSMHelp"= 1 (0x1) [HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer] "NoSMMyPictures"= 1 (0x1) "NoSMConfigurePrograms"= 1 (0x1) "NoSMHelp"= 1 (0x1) R2 UxTuneUp;TuneUp Theme Extension;C:\WINDOWS\System32\svchost.exe [2004-08-04 03:44] R3 CnxEtP;ZTE ZXDSL852 Adapter Filter Driver;C:\WINDOWS\system32\DRIVERS\CnxEtP.sys [2005-05-20 19:27] R3 CnxEtU;ZTE ZXDSL852 Interface Device Driver;C:\WINDOWS\system32\DRIVERS\CnxEtU.sys [2005-05-20 19:27] R3 CnxTgNW;ZTE ZXDSL852 WAN PPPoA Adapter Driver;C:\WINDOWS\system32\DRIVERS\CnxTgNW.sys [2005-05-20 19:28] HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs UxTuneUp . Contents of the 'Scheduled Tasks' folder "2008-02-18 10:24:06 C:\WINDOWS\Tasks\1-Click Maintenance.job" - C:\Program Files\TuneUp Utilities 2007\SystemOptimizer.exe . ************************************************************************** catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-02-20 22:34:22 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . --------------------- DLLs Loaded Under Running Processes --------------------- PROCESS: C:\WINDOWS\system32\lsass.exe [5.01.2600.2180] -> C:\Program Files\Eset\pr_imon.dll . Completion time: 2008-02-20 22:35:02

SillentRunner

Kod: Zaznacz wszystko: "Silent Runners.vbs", revision 55, http://www.silentrunners.org/ Operating System: Windows XP SP2 Output limited to non-default values, except where indicated by "{++}" Startup items buried in registry: --------------------------------- HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ {++} "CTFMON.EXE" = "C:\WINDOWS\system32\ctfmon.exe" [MS] "Gadu-Gadu" = ""C:\Program Files\Gadu-Gadu\gg.exe" /tray" ["Gadu-Gadu S.A."] "SpybotSD TeaTimer" = "C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" ["Safer Networking Limited"] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++} "RTHDCPL" = "RTHDCPL.EXE" ["Realtek Semiconductor Corp."] "Alcmtr" = "ALCMTR.EXE" ["Realtek Semiconductor Corp."] "CnxDslTaskBar" = ""C:\Program Files\ZTE Corporation\ZXDSL852\CnxDslTb.exe" "ZTE Corporation\ZXDSL852"" ["Conexant Systems, Inc."] "NvCplDaemon" = "RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup" [MS] "nwiz" = "nwiz.exe /install" ["NVIDIA Corporation"] "NvMediaCenter" = "RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit" [MS] "nod32kui" = ""C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE" ["Eset "] "Resume copy" = "copyfstq.exe /startup" [null data] "SunJavaUpdateSched" = ""C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"" ["Sun Microsystems, Inc."] "ZoneAlarm Client" = ""C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"" ["Zone Labs, LLC"] "WOOWATCH" = "C:\PROGRA~1\NEOSTR~1\Watch.exe" ["France Télécom R&D"] "WOOTASKBARICON" = "C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe" ["France Télécom R&D"] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\(Default) = (no title provided) -> {HKLM...CLSID} = "AcroIEHlprObj Class" \InProcServer32\(Default) = "C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll" ["Adobe Systems Incorporated"] {53707962-6F74-2D53-2644-206D7942484F}\(Default) = (no title provided) -> {HKLM...CLSID} = "Spybot-S&D IE Protection" \InProcServer32\(Default) = "C:\PROGRA~1\SPYBOT~1\SDHelper.dll" ["Safer Networking Limited"] {761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\(Default) = (no title provided) -> {HKLM...CLSID} = "SSVHelper Class" \InProcServer32\(Default) = "C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll" ["Sun Microsystems, Inc."] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\ "{42071714-76d4-11d1-8b24-00a0c9068ff3}" = "Rozszerzenie CPL kadrowania wyświetlania" -> {HKLM...CLSID} = "Rozszerzenie CPL kadrowania wyświetlania" \InProcServer32\(Default) = "deskpan.dll" [file not found] "{88895560-9AA2-1069-930E-00AA0030EBC8}" = "Rozszerzenie ikony HyperTerminalu" -> {HKLM...CLSID} = "HyperTerminal Icon Ext" \InProcServer32\(Default) = "C:\WINDOWS\system32\hticons.dll" ["Hilgraeve, Inc."] "{EFA24E62-B078-11d0-89E4-00C04FC9E26E}" = "History Band" -> {HKLM...CLSID} = "History Band" \InProcServer32\(Default) = "C:\WINDOWS\system32\shdocvw.dll" [MS] "{A70C977A-BF00-412C-90B7-034C51DA2439}" = "NvCpl DesktopContext Class" -> {HKLM...CLSID} = "DesktopContext Class" \InProcServer32\(Default) = "C:\WINDOWS\system32\nvcpl.dll" ["NVIDIA Corporation"] "{FFB699E0-306A-11d3-8BD1-00104B6F7516}" = "Play on my TV helper" -> {HKLM...CLSID} = "NVIDIA CPL Extension" \InProcServer32\(Default) = "C:\WINDOWS\system32\nvcpl.dll" ["NVIDIA Corporation"] "{1CDB2949-8F65-4355-8456-263E7C208A5D}" = "Desktop Explorer" -> {HKLM...CLSID} = "Desktop Explorer" \InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"] "{1E9B04FB-F9E5-4718-997B-B8DA88302A47}" = "Desktop Explorer Menu" -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"] "{1E9B04FB-F9E5-4718-997B-B8DA88302A48}" = "nView Desktop Context Menu" -> {HKLM...CLSID} = "nView Desktop Context Menu" \InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"] "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" = "WinRAR shell extension" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] "{F0CB00CD-5A07-4D91-97F5-A8C92CDA93E4}" = "Shell Extensions for RealOne Player" -> {HKLM...CLSID} = "RealOne Player Context Menu Class" \InProcServer32\(Default) = "C:\Program Files\ACE Mega CoDecS Pack\SystemS\RealMedia\rpshell.dll" ["RealNetworks, Inc."] "{B089FE88-FB52-11D3-BDF1-0050DA34150D}" = "NOD32 Context Menu Shell Extension" -> {HKLM...CLSID} = "NOD32 Context Menu Shell Extension" \InProcServer32\(Default) = "C:\Program Files\Eset\nodshex.dll" [null data] "{A4D78B20-6E05-1069-8758-4E73FD83DEAD}" = "QCopy" -> {HKLM...CLSID} = "QCopy" \InProcServer32\(Default) = "dropcpyr.dll" [null data] "{4858E7D9-8E12-45a3-B6A3-1CD128C9D403}" = "TuneUp Shredder Shell Extension" -> {HKLM...CLSID} = "TuneUp Shredder Shell Extension" \InProcServer32\(Default) = "C:\Program Files\TuneUp Utilities 2007\SDShelEx-win32.dll" ["TuneUp Software GmbH"] "{44440D00-FF19-4AFC-B765-9A0970567D97}" = "TuneUp Theme Extension" -> {HKLM...CLSID} = "TuneUp Theme Extension" \InProcServer32\(Default) = "C:\WINDOWS\System32\uxtuneup.dll" ["TuneUp Software GmbH"] "{D9872D13-7651-4471-9EEE-F0A00218BEBB}" = "Multiscan" -> {HKLM...CLSID} = "ZLAVShExt Class" \InProcServer32\(Default) = "C:\Program Files\Zone Labs\ZoneAlarm\zlavscan.dll" ["Zone Labs, LLC"] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\ "WPDShServiceObj" = "{AAA288BA-9A4C-45B0-95D7-94D524869DB5}" -> {HKLM...CLSID} = "WPDShServiceObj Class" \InProcServer32\(Default) = "C:\WINDOWS\system32\wpdshserviceobj.dll" [MS] HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\ <<!>> "BootExecute" = "autocheck autochk *"|"lsdelete" [null data] HKLM\SOFTWARE\Classes\Folder\shellex\ColumnHandlers\ {F9DB5320-233E-11D1-9F84-707F02C10627}\(Default) = "PDF Column Info" -> {HKLM...CLSID} = "PDF Shell Extension" \InProcServer32\(Default) = "C:\Program Files\Adobe\Acrobat 7.0\ActiveX\PDFShell.dll" ["Adobe Systems, Inc."] HKLM\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\ NOD32 Context Menu Shell Extension\(Default) = "{B089FE88-FB52-11D3-BDF1-0050DA34150D}" -> {HKLM...CLSID} = "NOD32 Context Menu Shell Extension" \InProcServer32\(Default) = "C:\Program Files\Eset\nodshex.dll" [null data] TuneUp Shredder Shell Extension\(Default) = "{4858E7D9-8E12-45a3-B6A3-1CD128C9D403}" -> {HKLM...CLSID} = "TuneUp Shredder Shell Extension" \InProcServer32\(Default) = "C:\Program Files\TuneUp Utilities 2007\SDShelEx-win32.dll" ["TuneUp Software GmbH"] WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] ZLAVShExt\(Default) = "{D9872D13-7651-4471-9EEE-F0A00218BEBB}" -> {HKLM...CLSID} = "ZLAVShExt Class" \InProcServer32\(Default) = "C:\Program Files\Zone Labs\ZoneAlarm\zlavscan.dll" ["Zone Labs, LLC"] HKLM\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\ TuneUp Shredder Shell Extension\(Default) = "{4858E7D9-8E12-45a3-B6A3-1CD128C9D403}" -> {HKLM...CLSID} = "TuneUp Shredder Shell Extension" \InProcServer32\(Default) = "C:\Program Files\TuneUp Utilities 2007\SDShelEx-win32.dll" ["TuneUp Software GmbH"] WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] HKLM\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\ NOD32 Context Menu Shell Extension\(Default) = "{B089FE88-FB52-11D3-BDF1-0050DA34150D}" -> {HKLM...CLSID} = "NOD32 Context Menu Shell Extension" \InProcServer32\(Default) = "C:\Program Files\Eset\nodshex.dll" [null data] WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] ZLAVShExt\(Default) = "{D9872D13-7651-4471-9EEE-F0A00218BEBB}" -> {HKLM...CLSID} = "ZLAVShExt Class" \InProcServer32\(Default) = "C:\Program Files\Zone Labs\ZoneAlarm\zlavscan.dll" ["Zone Labs, LLC"] Group Policies {GPedit.msc branch and setting}: ----------------------------------------------- Note: detected settings may not have any effect. HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\ "NoSMMyPictures" = (REG_DWORD) dword:0x00000001 {User Configuration|Administrative Templates|Start Menu and Taskbar| Remove My Pictures icon from Start Menu} "NoSMConfigurePrograms" = (REG_DWORD) dword:0x00000001 {unrecognized setting} "ClearRecentDocsOnExit" = (REG_DWORD) dword:0x00000001 {unrecognized setting} "NoRecentDocsMenu" = (REG_DWORD) dword:0x00000001 {unrecognized setting} "NoRecentDocsHistory" = (REG_DWORD) dword:0x00000001 {unrecognized setting} "NoStartBanner" = (REG_DWORD) dword:0x00000001 {Remove "Click here to begin" from Start button} "NoLowDiskSpaceChecks" = (REG_DWORD) dword:0x00000001 {unrecognized setting} "NoSMHelp" = (REG_DWORD) dword:0x00000001 {User Configuration|Administrative Templates|Start Menu and Taskbar| Remove Help menu from Start Menu} HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ "shutdownwithoutlogon" = (REG_DWORD) dword:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| Shutdown: Allow system to be shut down without having to log on} "undockwithoutlogon" = (REG_DWORD) dword:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| Devices: Allow undock without having to log on} "NoInternetOpenWith" = (REG_DWORD) dword:0x00000001 {unrecognized setting} "DisableStatusMessages" = (REG_DWORD) dword:0x00000001 {unrecognized setting} "VerboseStatus" = (REG_DWORD) dword:0x00000000 {unrecognized setting} Active Desktop and Wallpaper: ----------------------------- Active Desktop may be disabled at this entry: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState Displayed if Active Desktop enabled and wallpaper not set by Group Policy: HKCU\Software\Microsoft\Internet Explorer\Desktop\General\ "Wallpaper" = "C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp" Displayed if Active Desktop disabled and wallpaper not set by Group Policy: HKCU\Control Panel\Desktop\ "Wallpaper" = "C:\Documents and Settings\Prowik\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp" Enabled Screen Saver: --------------------- HKCU\Control Panel\Desktop\ "SCRNSAVE.EXE" = "C:\WINDOWS\system32\logon.scr" [MS] Startup items in "Prowik" & "All Users" startup folders: -------------------------------------------------------- C:\Documents and Settings\All Users\Menu Start\Programy\Autostart "Adobe Reader Speed Launch" -> shortcut to: "C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe" ["Adobe Systems Incorporated"] Enabled Scheduled Tasks: ------------------------ "1-Click Maintenance" -> launches: "C:\Program Files\TuneUp Utilities 2007\SystemOptimizer.exe /schedulestart" ["TuneUp Software GmbH"] Winsock2 Service Provider DLLs: ------------------------------- Namespace Service Providers HKLM\SYSTEM\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++} 000000000001\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS] 000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS] 000000000003\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS] Transport Service Providers HKLM\SYSTEM\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++} 0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range: C:\WINDOWS\system32\imon.dll ["Eset "], 01 - 05, 21 %SystemRoot%\system32\mswsock.dll [MS], 06 - 08, 11 - 20 %SystemRoot%\system32\rsvpsp.dll [MS], 09 - 10 Toolbars, Explorer Bars, Extensions: ------------------------------------ Extensions (Tools menu items, main toolbar menu buttons) HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\ {08B0E5C0-4FCB-11CF-AAA5-00401C608501}\ "MenuText" = "Sun Java Console" "CLSIDExtension" = "{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBC}" -> {HKCU...CLSID} = "Java Plug-in 1.6.0_03" \InProcServer32\(Default) = "C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll" ["Sun Microsystems, Inc."] -> {HKLM...CLSID} = "Java Plug-in 1.6.0_03" \InProcServer32\(Default) = "C:\Program Files\Java\jre1.6.0_03\bin\npjpi160_03.dll" ["Sun Microsystems, Inc."] {DFB852A3-47F8-48C4-A200-58CAB36FD2A2}\ "MenuText" = "Spybot - Search & Destroy Configuration" "CLSIDExtension" = "{53707962-6F74-2D53-2644-206D7942484F}" -> {HKLM...CLSID} = "Spybot-S&D IE Protection" \InProcServer32\(Default) = "C:\PROGRA~1\SPYBOT~1\SDHelper.dll" ["Safer Networking Limited"] {E2E2DD38-D088-4134-82B7-F2BA38496583}\ "MenuText" = "@xpsp3res.dll,-20001" "Exec" = "%windir%\Network Diagnostic\xpnetdiag.exe" [MS] Miscellaneous IE Hijack Points ------------------------------ HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks\ <<H>> "{08C06D61-F1F3-4799-86F8-BE1A89362C85}" = (no title provided) -> {HKLM...CLSID} = "Search Class" \InProcServer32\(Default) = "C:\PROGRA~1\NEOSTR~1\SEARCH~1.DLL" [empty string] Running Services (Display Name, Service Name, Path {Service DLL}): ------------------------------------------------------------------ Ad-Aware 2007 Service, aawservice, ""C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe"" ["Lavasoft AB"] NOD32 Kernel Service, NOD32krn, ""C:\Program Files\Eset\nod32krn.exe"" ["Eset "] NVIDIA Display Driver Service, NVSvc, "C:\WINDOWS\system32\nvsvc32.exe" ["NVIDIA Corporation"] TrueVector Internet Monitor, vsmon, "C:\WINDOWS\system32\ZoneLabs\vsmon.exe -service" ["Zone Labs, LLC"] TuneUp Theme Extension, UxTuneUp, "C:\WINDOWS\System32\svchost.exe -k netsvcs" {"C:\WINDOWS\System32\uxtuneup.dll" ["TuneUp Software GmbH"]} ---------- (launch time: 2008-02-19 22:30:09) <<!>>: Suspicious data at a malware launch point. <<H>>: Suspicious data at a browser hijack point. + This report excludes default entries except where indicated. + To see *everywhere* the script checks and *everything* it finds, launch it from a command prompt or a shortcut with the -all parameter. + To search all directories of local fixed drives for DESKTOP.INI DLL launch points, use the -supp parameter or answer "No" at the first message box and "Yes" at the second message box. ---------- (total run time: 46 seconds, including 18 seconds for message boxes)

HijackThis

Kod: Zaznacz wszystko: Logfile of HijackThis v1.99.1 Scan saved at 22:29:56, on 2008-02-19 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.20627) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\ZoneLabs\vsmon.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\ZoneLabs\avsys\ScanningProcess.exe C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe C:\Program Files\Eset\nod32krn.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\ZoneLabs\avsys\ScanningProcess.exe C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\RTHDCPL.EXE C:\Program Files\ZTE Corporation\ZXDSL852\CnxDslTb.exe C:\WINDOWS\system32\RUNDLL32.EXE C:\Program Files\Eset\nod32kui.exe C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe C:\PROGRA~1\ZONELA~1\ZONEAL~1\MAILFR~1\mantispm.exe C:\Program Files\Winamp\winamp.exe C:\PROGRA~1\NEOSTR~1\NeostradaTP.exe C:\PROGRA~1\NEOSTR~1\ComComp.exe C:\PROGRA~1\NEOSTR~1\Watch.exe C:\Program Files\Gadu-Gadu\gg.exe C:\Program Files\Mozilla Firefox\firefox.exe D:\DOMINIK DYSK!~!!!\backup\FlashGet\flashget.exe C:\DOCUME~1\Prowik\USTAWI~1\Temp\Rar$EX00.766\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.neostrada.pl R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Neostrada TP R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\NEOSTR~1\SEARCH~1.DLL O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - (no file) O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE O4 - HKLM\..\Run: [CnxDslTaskBar] "C:\Program Files\ZTE Corporation\ZXDSL852\CnxDslTb.exe" "ZTE Corporation\ZXDSL852" O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE O4 - HKLM\..\Run: [Resume copy] copyfstq.exe /startup O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\NEOSTR~1\Watch.exe O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O8 - Extra context menu item: Download All by FlashGet - D:\DOMINIK DYSK!~!!!\backup\FlashGet\jc_all.htm O8 - Extra context menu item: Download using FlashGet - D:\DOMINIK DYSK!~!!!\backup\FlashGet\jc_link.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O11 - Options group: [INTERNATIONAL] International* O11 - Options group: [TABS] Tabbed Browsing O17 - HKLM\System\CCS\Services\Tcpip\..\{259E6FF5-9054-4D49-8622-7D1B81F2C411}: NameServer = 194.204.159.1 217.98.63.164 O17 - HKLM\System\CS1\Services\Tcpip\..\{259E6FF5-9054-4D49-8622-7D1B81F2C411}: NameServer = 194.204.159.1 217.98.63.164 O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\wpdshserviceobj.dll O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

SDFix

Kod: Zaznacz wszystko: [b][u]SDFix: Version 1.143[/u][/b] Run by MasterAdmin on 2008-02-20 at 22:41 Microsoft Windows XP [Wersja 5.1.2600] Running From: C:\SDFix [b][u]Checking Services[/u][/b]: Restoring Windows Registry Values Restoring Windows Default Hosts File Rebooting... [b][u]Checking Files[/u][/b]: No Trojan Files Found Removing Temp Files... [b][u]ADS Check[/u][/b]: [b][u]Final Check[/u][/b]: catchme 0.3.1344.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-02-20 22:44:48 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... IPC error: 2 Nie można odnaleźć określonego pliku. scanning hidden services & system hive ... [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\d347prt\Cfg\0Jf40] scanning hidden registry entries ... scanning hidden files ... scan completed successfully hidden processes: 0 hidden services: 0 hidden files: 0 [b][u]Remaining Services[/u][/b]: Authorized Application Key Export: [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list] [b][u]Remaining Files[/u][/b]: [b][u]Files with Hidden Attributes[/u][/b]: Wed 17 Aug 2005 28,672 A..H. --- "C:\Documents and Settings\Prowik\Pulpit\3__in_1\3_ in_1\gg.dll" [b]Finished![/b]

**Posty:** 18165 · przez **wojtas** 20 Lut 2008, 00:09

O2 - BHO: (no name) - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - (no file)

skasuj ten ^^ wpis

oraz ten folder

C:\Program Files\BearShare Applications

**Posty:** 14 · przez **ProQ** 20 Lut 2008, 00:16

zrobione
i to wszystko?

**Posty:** 18165 · przez **wojtas** 20 Lut 2008, 11:13

**Posty:** 14 · przez **ProQ** 20 Lut 2008, 11:39

no niestety nic nie pomogło internet jak się rozłączał tak się dalej rozłącza. w nocy zostawiłem go aby mi ściagnął kilka plików pochodził 15:35 sec i sie zawiesił. Co robić ??

**Posty:** 18165 · przez **wojtas** 20 Lut 2008, 11:41

Wykonaj to co jest podane w tym temacie

moze to cos pomoze

do tego przeinstaluj sterowniki od modemu

prośba o sprawdzenie loga

prośba o sprawdzenie loga

Kto jest na forum