Kontrolne sprawdzenie loga. Dzisiaj 2 zwiechy kompa.

przez **Jagla** » 21 Lip 2008, 17:36

Tak jak w temacie. Log z combofix

Kod: Zaznacz wszystko: ComboFix 08-07-20.A0 - maciekk 2008-07-21 17:31:25.2 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.1642 [GMT 2:00] Running from: C:\Documents and Settings\maciekk\Pulpit\ComboFix.exe * Created a new restore point [color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color] . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\Documents and Settings\maciekk\Ustawienia lokalne\Dane aplikacji\Microsoft\Windows Media\10.0\WMSDKNSD.XML . ((((((((((((((((((((((((( Files Created from 2008-06-21 to 2008-07-21 ))))))))))))))))))))))))))))))) . 2008-07-19 21:54 . 2008-07-19 21:54 <DIR> d-------- C:\Documents and Settings\maciekk\Dane aplikacji\Media Player Classic 2008-07-19 21:54 . 2008-05-23 00:22 3,596,288 --a------ C:\WINDOWS\system32\qt-dx331.dll 2008-07-19 21:54 . 2008-07-04 08:34 860,160 --a------ C:\WINDOWS\system32\lameACM.acm 2008-07-19 21:54 . 2008-01-10 14:15 755,027 --a------ C:\WINDOWS\system32\xvidcore.dll 2008-07-19 21:54 . 2004-01-25 18:18 217,088 --a------ C:\WINDOWS\system32\yv12vfw.dll 2008-07-19 21:54 . 2007-09-04 18:56 164,352 --a------ C:\WINDOWS\system32\unrar.dll 2008-07-19 21:54 . 2008-01-10 14:16 159,839 --a------ C:\WINDOWS\system32\xvidvfw.dll 2008-07-19 21:54 . 2007-09-21 02:52 118,784 --a------ C:\WINDOWS\system32\ac3acm.acm 2008-07-19 21:54 . 2008-05-23 00:19 81,920 --a------ C:\WINDOWS\system32\dpl100.dll 2008-07-19 21:54 . 2007-10-03 17:03 414 --a------ C:\WINDOWS\system32\lame_acm.xml 2008-07-19 21:53 . 2008-05-31 01:22 683,520 --a------ C:\WINDOWS\system32\divx.dll 2008-07-19 21:53 . 2008-06-12 20:36 7,680 --a------ C:\WINDOWS\system32\ff_vfw.dll 2008-07-19 21:53 . 2007-07-10 18:10 547 --a------ C:\WINDOWS\system32\ff_vfw.dll.manifest 2008-07-19 12:38 . 2008-07-19 12:42 <DIR> d-------- C:\Program Files\eMule 2008-07-16 11:13 . 2008-07-16 12:50 <DIR> d-------- C:\Documents and Settings\maciekk\Dane aplikacji\U3 2008-07-12 17:04 . 2004-08-18 03:34 442,368 --a------ C:\WINDOWS\system32\vp6vfw.dll 2008-07-10 16:20 . 2008-07-10 16:20 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\LightScribe 2008-07-07 14:22 . 2008-07-07 14:22 1 --a------ C:\WINDOWS\system32\SI.bin 2008-07-02 23:47 . 2008-07-07 02:25 <DIR> d-------- C:\Program Files\uTorrent 2008-07-02 23:47 . 2008-07-21 17:28 <DIR> d-------- C:\Documents and Settings\maciekk\Dane aplikacji\uTorrent 2008-07-02 17:40 . 2008-07-21 00:23 69 --a------ C:\WINDOWS\NeroDigital.ini 2008-07-02 17:37 . 2004-08-03 23:08 26,496 --a--c--- C:\WINDOWS\system32\dllcache\usbstor.sys 2008-07-02 13:41 . 2008-07-02 13:41 <DIR> d-------- C:\Program Files\Common Files\Adobe 2008-07-02 13:34 . 2008-07-02 13:34 <DIR> d-------- C:\Documents and Settings\maciekk\Dane aplikacji\Gadu-Gadu 2008-07-02 13:33 . 2008-07-09 14:50 <DIR> d-------- C:\Documents and Settings\maciekk\Gadu-Gadu 2008-07-02 13:27 . 2008-07-02 13:27 <DIR> d-------- C:\Documents and Settings\maciekk\Dane aplikacji\Talkback 2008-07-02 13:27 . 2008-07-02 13:27 0 --a------ C:\WINDOWS\nsreg.dat 2008-07-02 13:20 . 2008-07-02 13:20 <DIR> d-------- C:\Program Files\Ulead Systems 2008-07-02 13:20 . 2008-07-02 13:20 <DIR> d-------- C:\Program Files\Common Files\Ulead Systems 2008-07-02 13:19 . 2008-07-02 13:19 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Ulead Systems 2008-07-02 13:19 . 2001-12-19 15:47 49,152 --------- C:\WINDOWS\system32\TempDel.EXE 2008-07-02 13:19 . 2005-01-06 16:55 9,446 --a------ C:\WINDOWS\system32\drivers\WFIOCTL.sys 2008-07-02 13:19 . 2002-06-03 23:01 8,734 --a------ C:\WINDOWS\system32\WFSch.ICO 2008-07-02 13:17 . 2008-07-02 13:17 <DIR> d-------- C:\WINDOWS\system32\LogFiles 2008-07-02 13:15 . 2008-07-02 13:15 <DIR> d-------- C:\WINDOWS\system32\WinFox 2008-07-02 13:15 . 2008-07-02 13:15 <DIR> d-------- C:\WINDOWS\system32\WinFast 2008-07-02 13:15 . 2003-09-05 09:57 9,469 --a------ C:\WINDOWS\system32\drivers\WINFOXIO.sys 2008-07-02 13:11 . 2008-07-02 13:11 <DIR> d-------- C:\Program Files\Common Files\LightScribe 2008-07-02 13:10 . 2008-07-02 13:10 <DIR> d-------- C:\Documents and Settings\maciekk\Dane aplikacji\Ahead 2008-07-02 13:10 . 2008-07-02 13:10 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Ahead 2008-07-02 13:08 . 2008-07-02 13:10 <DIR> d-------- C:\Program Files\Common Files\Ahead 2008-07-02 13:08 . 2008-07-02 13:08 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Nero . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-07-19 18:24 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-07-02 11:15 --------- d-----w C:\Program Files\Common Files\InstallShield 2008-07-02 10:52 --------- d-----w C:\Program Files\Lexmark 3300 Series 2008-07-02 10:48 15,600 ----a-w C:\WINDOWS\gdrv.sys 2008-07-02 10:46 315,392 ----a-w C:\WINDOWS\HideWin.exe 2008-07-02 10:46 --------- d-----w C:\Program Files\Realtek 2008-07-02 10:46 --------- d-----w C:\Program Files\DIFX 2008-07-02 10:44 --------- d-----w C:\Documents and Settings\maciekk\Dane aplikacji\InstallShield 2008-07-02 10:37 --------- d-----w C:\Program Files\VDOTool 2008-07-02 10:21 --------- d-----w C:\Program Files\microsoft frontpage 2008-07-02 10:19 --------- d-----w C:\Program Files\Usługi online . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 02:44 15360] "Gadu-Gadu"="D:\Gadu-gadu\gg.exe" [2008-03-20 12:04 2127296] "MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-08-04 00:55 1667584] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Gainward"="C:\Program Files\VDOTool\TBPanel.exe" [2007-11-01 13:25 2165272] "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-09-16 19:07 8491008] "NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-09-16 19:07 81920] "avast!"="d:\Avast\ashDisp.exe" [2008-05-16 01:19 79224] "nwiz"="nwiz.exe" [2007-09-16 19:07 1626112 C:\WINDOWS\system32\nwiz.exe] "RTHDCPL"="RTHDCPL.EXE" [2007-07-05 10:08 16380416 C:\WINDOWS\RTHDCPL.exe] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 02:44 15360] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "VIDC.YV12"= yv12vfw.dll [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Adobe Reader Speed Launch.lnk] path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Adobe Reader Speed Launch.lnk backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Adobe Reader Synchronizer.lnk] path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Adobe Reader Synchronizer.lnk backup=C:\WINDOWS\pss\Adobe Reader Synchronizer.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] --a------ 2007-06-01 10:21 153136 C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LightScribe Control Panel] --a------ 2007-07-18 17:55 451872 C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] --a------ 2007-03-01 15:57 153136 C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinFast Schedule] --a------ 2005-03-02 13:21 278528 d:\TV\WFWIZ.exe [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "D:\\Maciek\\CS\\Counter-Strike 1.6 + Half-Life\\hl.exe"= "C:\\Program Files\\uTorrent\\uTorrent.exe"= "D:\\S.T.A.L.K.E.R\\bin\\XR_3DA.exe"= "D:\\S.T.A.L.K.E.R\\bin\\dedicated\\XR_3DA.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "4575:UDP"= 4575:UDP:Windows Media Format SDK (firefox.exe) "4574:UDP"= 4574:UDP:Windows Media Format SDK (firefox.exe) "4592:UDP"= 4592:UDP:Windows Media Format SDK (firefox.exe) "4593:UDP"= 4593:UDP:Windows Media Format SDK (firefox.exe) R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-05-16 01:20] R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-05-16 01:16] R2 WF23880;WinFast TV2000/DV2000 WDM Video Capture.;C:\WINDOWS\system32\drivers\wf88vcap.sys [2004-10-18 11:25] R2 WF88XBAR;WinFast TV2000/DV2000 WDM Crossbar.;C:\WINDOWS\system32\drivers\WF88XBAR.sys [2004-10-18 11:25] R2 WFTUNE;WinFast TV2000/DV2000 WDM Tuner.;C:\WINDOWS\system32\drivers\WF88TUNE.sys [2004-10-18 11:25] S3 ddsxeiservice;ddsxeiservice2;D:\Maciek\CS\sXe Injectedd\ddsxei.sys [] S3 WFIOCTL;WFIOCTL;d:\TV\WFIOCTL.SYS [2005-01-06 16:55] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\G] \Shell\AutoRun\command - G:\LaunchU3.exe -a [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{04c438fc-4e89-11dd-b2ae-001d7d257400}] \Shell\AutoRun\command - G:\LaunchU3.exe -a [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}] "C:\Program Files\Common Files\LightScribe\LSRunOnce.exe" . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-07-21 17:32:08 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2008-07-21 17:32:33 ComboFix-quarantined-files.txt 2008-07-21 15:32:30 Pre-Run: 18,885,689,344 bajtów wolnych Post-Run: 19,948,589,056 bajtów wolnych 143

przez **huber2t** » 21 Lip 2008, 18:15

otwórz notatnik i wklej

Windows Registry Editor Version 5.00

[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\G]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{04c438fc-4e89-11dd-b2ae-001d7d257400}]

Z menu Notatnika

Plik

Zapisz jako

Zmień rozszerzenie z .txt na wszystkie pliki

zapisz pod nazwą Fix.reg

Uruchom ten plik, uruchom ponownie komputer

to nie jest wina syfu, tylko sprzetu, podaj temperatury, moc i marke zasilacza

Kontrolne sprawdzenie loga. Dzisiaj 2 zwiechy kompa.

Kontrolne sprawdzenie loga. Dzisiaj 2 zwiechy kompa.

Kto jest na forum