prosze o sprawdzenie loga problem z folderem moje dokumenty

przez **pampix** » 04 Sty 2008, 00:10

Witam serdecznie!

Mój problem polega na tym, że wraz z uruchomieniem kompa odpalają sie moje dokumenty. Trochę to kłopotliwe, dlatego prosiłbym o pomoc,

z góry dziekuje.

Oto log:

Kod: Zaznacz wszystko: ComboFix 08-01-03.5 - Pablo 2008-01-03 22:43:03.1 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.260 [GMT 1:00] Running from: C:\Documents and Settings\Pablo\Pulpit\ComboFix.exe * Created a new restore point . ((((((((((((((((((((((((( Files Created from 2007-12-03 to 2008-01-03 ))))))))))))))))))))))))))))))) . 2008-01-03 22:42 . 2000-08-31 08:00 51,200 --a------ C:\WINDOWS\NirCmd.exe 2007-12-29 16:53 . 2007-12-04 14:04 837,496 --a------ C:\WINDOWS\system32\aswBoot.exe 2007-12-29 16:53 . 2004-01-09 10:13 380,928 --a------ C:\WINDOWS\system32\actskin4.ocx 2007-12-29 16:53 . 2007-12-04 13:54 95,608 --a------ C:\WINDOWS\system32\AvastSS.scr 2007-12-29 16:53 . 2007-12-04 15:55 94,544 --a------ C:\WINDOWS\system32\drivers\aswmon2.sys 2007-12-29 16:53 . 2007-12-04 15:56 93,264 --a------ C:\WINDOWS\system32\drivers\aswmon.sys 2007-12-29 16:53 . 2007-12-04 15:51 42,912 --a------ C:\WINDOWS\system32\drivers\aswTdi.sys 2007-12-29 16:53 . 2007-12-04 15:49 26,624 --a------ C:\WINDOWS\system32\drivers\aavmker4.sys 2007-12-29 16:53 . 2007-12-04 15:53 23,152 --a------ C:\WINDOWS\system32\drivers\aswRdr.sys 2007-12-26 21:51 . 2007-12-26 21:51 <DIR> d-------- C:\WINDOWS\Sun 2007-12-25 12:44 . 2007-11-29 23:30 3,596,288 --a------ C:\WINDOWS\system32\qt-dx331.dll 2007-12-25 12:44 . 2007-12-04 02:33 682,496 --a------ C:\WINDOWS\system32\divx.dll 2007-12-25 12:44 . 2007-03-10 12:51 282,624 --a------ C:\WINDOWS\system32\xvidvfw.dll 2007-12-25 12:44 . 2004-01-25 17:18 217,088 --a------ C:\WINDOWS\system32\yv12vfw.dll 2007-12-25 12:44 . 2007-11-29 23:28 81,920 --a------ C:\WINDOWS\system32\dpl100.dll 2007-12-25 12:44 . 2007-12-07 18:28 7,680 --a------ C:\WINDOWS\system32\ff_vfw.dll 2007-12-25 12:44 . 2007-07-10 17:10 547 --a------ C:\WINDOWS\system32\ff_vfw.dll.manifest 2007-12-25 11:07 . 2007-12-25 11:07 <DIR> d-------- C:\Program Files\Media Key 2007-12-25 11:02 . 2006-09-13 18:18 31,616 --a------ C:\WINDOWS\system32\drivers\usbccgp.sys 2007-12-25 11:02 . 2006-09-13 18:19 21,504 --a------ C:\WINDOWS\system32\hidserv.dll 2007-12-25 11:02 . 2006-09-13 18:18 14,848 --a------ C:\WINDOWS\system32\drivers\kbdhid.sys 2007-12-24 17:56 . 2007-12-25 12:40 <DIR> d-------- C:\Program Files\Winamp Remote 2007-12-24 17:53 . 2007-12-30 18:43 <DIR> d-------- C:\Documents and Settings\Pablo\Dane aplikacji\WinAmp 2007-12-24 16:15 . 2007-12-24 16:40 <DIR> d-------- C:\TEMP 2007-12-24 16:14 . 2007-12-24 16:14 <DIR> d-------- C:\Program Files\Alwil Software 2007-12-16 19:27 . 2007-12-16 19:27 <DIR> d-------- C:\Documents and Settings\Pablo\Dane aplikacji\Gadu-Gadu 2007-12-15 20:43 . 2007-12-24 16:05 <DIR> d-------- C:\Program Files\BearShare 2007-12-15 20:40 . 2007-12-15 20:40 <DIR> d-------- C:\Program Files\BearShare Applications 2007-12-15 20:40 . 2006-11-12 11:39 483,328 --a------ C:\WINDOWS\system32\actskn45.ocx 2007-12-15 20:38 . 2007-12-15 20:53 <DIR> d-------- C:\Program Files\BitLord 2007-12-15 19:55 . 2007-12-15 19:55 1,158 --a------ C:\WINDOWS\mozver.dat 2007-12-15 19:53 . 2007-12-15 19:53 0 --a------ C:\WINDOWS\nsreg.dat 2007-12-15 19:51 . 2007-12-15 20:58 <DIR> d-------- C:\Program Files\Google 2007-12-15 19:41 . 2007-12-15 19:41 <DIR> d---s---- C:\Documents and Settings\Pablo\UserData 2007-12-14 10:06 . 1999-12-17 10:13 86,016 --a------ C:\WINDOWS\unvise32.exe . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2007-12-25 10:07 --------- d--h--w C:\Program Files\InstallShield Installation Information 2007-11-27 21:38 --------- d-----w C:\Program Files\WexTech 2007-11-27 21:38 --------- d-----w C:\Program Files\Common Files\Wextech Shared 2007-11-27 21:38 --------- d-----w C:\Program Files\Common Files\LHSPF 2007-11-27 21:38 --------- d-----w C:\Program Files\Common Files\Autodesk Shared 2007-11-27 21:36 --------- d-----w C:\Program Files\Volo View Express 2007-07-14 10:44 1,049,719 ----a-w C:\Program Files\wrar361pl.exe 2004-03-11 12:27 40,960 ----a-w C:\Program Files\Uninstall_CDS.exe . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 01:44 15360] "MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2006-09-13 18:20 1694208] "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe" [2005-10-28 16:25 94208] "wsctf.exe"="wsctf.exe" [] "EXPLORER.EXE"="EXPLORER.EXE" [2004-08-04 01:44 1033728 C:\WINDOWS\explorer.exe] "swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-12-17 17:42 68856] "ares"="D:\PROGRAMY\Ares\Ares.exe" [ ] "Gadu-Gadu"="C:\Program Files\Gadu-Gadu\gg.exe" [ ] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NVRTCLK"="C:\WINDOWS\System32\NVRTCLK\NVRTClk.exe" [2003-12-30 10:44 24576] "PathNvidiaTV"="C:\Program Files\Gigabyte\Nvidia\patchnvidiaTVout.exe" [ ] "NvCplDaemon"="C:\WINDOWS\System32\NvCpl.dll" [2005-01-10 08:32 5513216] "nwiz"="nwiz.exe" [2005-01-10 08:32 1490944 C:\WINDOWS\system32\nwiz.exe] "SunJavaUpdateSched"="C:\Program Files\Java\j2re1.4.2_02\bin\jusched.exe" [2003-09-16 19:01 32881] "DAEMON Tools-1033"="C:\Program Files\D-Tools\daemon.exe" [2004-03-12 22:43 81920] "NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 10:50 155648] "GrooveMonitor"="C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-27 00:47 31016] "SoundMan"="SOUNDMAN.EXE" [2004-06-18 09:31 67584 C:\WINDOWS\soundman.exe] "NvMediaCenter"="C:\WINDOWS\System32\NvMcTray.dll" [2005-01-10 08:32 86016] "Anti-Blaxx Manager"="D:\PROGRAMY\Anti-Blaxx\Anti-Blaxx.exe" [2005-05-18 15:08 208896] "BearShare"="C:\Program Files\BearShare\BearShare.exe" [ ] "WinampAgent"="D:\PROGRAMY\WinAmp\winampa.exe" [2007-12-20 16:16 37376] "MagicKey"="C:\PROGRA~1\MEDIAK~1\MagicKey.exe" [2004-03-15 13:27 45056] "Ashampoo FireWall"="D:\PROGRAMY\ashampoo_firewall120_sm\Ashampoo FireWall\FireWall.exe" [2007-04-05 14:57 3251800] "avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-12-04 14:00 79224] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-08-04 01:44 15360] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce] "nlpo_01"="cmd.exe" [2004-08-04 01:44 395776 C:\WINDOWS\system32\cmd.exe] "nlpo_02"="advpack.dll" [2004-08-04 01:43 100864 C:\WINDOWS\system32\advpack.dll] "nlpo_03"="cmd.exe" [2004-08-04 01:44 395776 C:\WINDOWS\system32\cmd.exe] "nlpo_04"="cmd.exe" [2004-08-04 01:44 395776 C:\WINDOWS\system32\cmd.exe] "nlpo_05"="advpack.dll" [2004-08-04 01:43 100864 C:\WINDOWS\system32\advpack.dll] "nlpo_06"="advpack.dll" [2004-08-04 01:43 100864 C:\WINDOWS\system32\advpack.dll] "tscuninstall"="C:\WINDOWS\system32\tscupgrd.exe" [2004-08-04 01:33 44544] R0 d346bus;d346bus;C:\WINDOWS\system32\DRIVERS\d346bus.sys [2004-03-12 22:41] R0 d346prt;d346prt;C:\WINDOWS\system32\Drivers\d346prt.sys [2004-03-12 22:41] R3 GVCplDrv;GVCplDrv;C:\WINDOWS\system32\drivers\GVCplDrv.sys [2004-05-02 09:47] S3 usbscan;Sterownik skanera USB;C:\WINDOWS\system32\DRIVERS\usbscan.sys [2006-09-13 18:19] S3 USBSTOR;Sterownik magazynu masowego USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-04 00:08] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{47fbc164-80bf-11dc-a063-0011d8861c33}] \Shell\AutoRun\command - H:\EXPLORER.EXE \Shell\explore\Command - H:\EXPLORER.EXE \Shell\open\Command - H:\EXPLORER.EXE [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{e6b4c67b-685e-11dc-a033-0011d8861c33}] \Shell\AutoRun\command - I:\EXPLORER.EXE \Shell\explore\Command - I:\EXPLORER.EXE \Shell\open\Command - I:\EXPLORER.EXE *Newly Created Service* - PROCEXP90 . ************************************************************************** catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-01-03 22:43:59 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . --------------------- DLLs Loaded Under Running Processes --------------------- PROCESS: C:\WINDOWS\system32\lsass.exe [5.01.2600.2180] -> D:\PROGRAMY\ashampoo_firewall120_sm\Ashampoo FireWall\spi.dll . Completion time: 2008-01-03 22:44:21

przez **Leon$** » 04 Sty 2008, 00:59

Otwórz notatnik i wklej

Kod: Zaznacz wszystko: File:: C:\Autorun.inf C:\WINDOWS\system32\EXPLORER.EXE C:\WINDOWS\system32\wsctf.exe Registry:: [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "wsctf.exe"=- "EXPLORER.EXE"=- [-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] "Userinit"=- "Shell"="Explorer.exe" "Userinit"="C:\\WINDOWS\\system32\\userinit.exe,"

zapisz jako CFScript (zapisz by ikonka CFScript.txt była obok ikonki ComboFix.exe) >> Przeciągnij i upuść ikonkę CFScript.txt na ikonkę ComboFix.exe
[strona nie jest już dostępna]
na pytanie "1 or 2" - to wpisz 1 i naciśnij ENTER
Powinno rozpocząć się usuwanie

Potem log Combofixa zaraz po usuwaniu

Pobierz HijackThisa i daj log

Na koniec usuń ręcznie folder C: \Qoobox

przez **pampix** » 09 Sty 2008, 19:30

Dzięki kolego za rade. Zrobiłem tak jak mówiłeś. Oto log z HijackThisa. Jak byś mógł to go sprawdź.

Dzięki!

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:23:51, on 2008-01-09
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Java\j2re1.4.2_02\bin\jusched.exe
C:\Program Files\D-Tools\daemon.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\WINDOWS\SOUNDMAN.EXE
D:\PROGRAMY\Anti-Blaxx\Anti-Blaxx.exe
C:\WINDOWS\System32\nvsvc32.exe
D:\PROGRAMY\WinAmp\winampa.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\MEDIAK~1\MagicKey.exe
C:\PROGRA~1\MEDIAK~1\OSD.exe
D:\PROGRAMY\ashampoo_firewall120_sm\Ashampoo FireWall\FireWall.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
D:\PROGRAMY\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe
D:\PROGRAMY\Nokia\Nokia PC Suite 6\PCSuite.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
C:\Program Files\PC Connectivity Solution\Transports\NclUSBSrv.exe
C:\Program Files\PC Connectivity Solution\Transports\NclRSSrv.exe
C:\WINDOWS\explorer.exe
D:\PROGRAMY\HJT\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.pl/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [NVRTCLK] C:\WINDOWS\System32\NVRTCLK\NVRTClk.exe
O4 - HKLM\..\Run: [PathNvidiaTV] C:\Program Files\Gigabyte\Nvidia\patchnvidiaTVout.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_02\bin\jusched.exe
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Anti-Blaxx Manager] D:\PROGRAMY\Anti-Blaxx\Anti-Blaxx.exe
O4 - HKLM\..\Run: [BearShare] "C:\Program Files\BearShare\BearShare.exe" /pause
O4 - HKLM\..\Run: [WinampAgent] D:\PROGRAMY\WinAmp\winampa.exe
O4 - HKLM\..\Run: [MagicKey] C:\PROGRA~1\MEDIAK~1\MagicKey.exe
O4 - HKLM\..\Run: [Ashampoo FireWall] "D:\PROGRAMY\ashampoo_firewall120_sm\Ashampoo FireWall\FireWall.exe" -TRAY
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [Adobe Photo Downloader] "D:\PROGRAMY\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [ares] "D:\PROGRAMY\Ares\Ares.exe" -h
O4 - HKCU\..\Run: [PC Suite Tray] "D:\PROGRAMY\Nokia\Nokia PC Suite 6\PCSuite.exe" -onlytray
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'USŁUGA LOKALNA')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'USŁUGA SIECIOWA')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [nlpo_01] cmd.exe /c md "%USERPROFILE%\Ustawienia lokalne\Temp" (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [nlpo_05] rundll32 advpack.dll,LaunchINFSection nlite.inf,nLiteReg (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [nlpo_06] rundll32 advpack.dll,LaunchINFSection nlite.inf,S (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [nlpo_01] cmd.exe /c md "%USERPROFILE%\Ustawienia lokalne\Temp" (User 'Default user')
O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: E&ksportuj do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_02\bin\npjpi142_02.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_02\bin\npjpi142_02.dll
O9 - Extra button: Wyślij do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Wyślij &do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {78AF2F24-A9C3-11D3-BF8C-0060B0FCC122} (AcDcToday Control) - file://D:\PROGRAMY\AutoCad 2002\AcDcToday.ocx
O16 - DPF: {AE563720-B4F5-11D4-A415-00108302FDFD} (NOXLATE-BANR) - file://D:\PROGRAMY\AutoCad 2002\InstBanr.ocx
O16 - DPF: {C6637286-300D-11D4-AE0A-0010830243BD} (InstaFred) - file://D:\PROGRAMY\AutoCad 2002\InstFred.ocx
O16 - DPF: {F281A59C-7B65-11D3-8617-0010830243BD} (AcPreview Control) - file://D:\PROGRAMY\AutoCad 2002\AcPreview.ocx
O17 - HKLM\System\CCS\Services\Tcpip\..\{6C728249-1362-40BB-A897-D5ABA80BF1CE}: NameServer = 195.74.91.4 195.74.91.4
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe

--
End of file - 7863 bytes

przez **Leon$** » 09 Sty 2008, 21:37

wpisy

Kod: Zaznacz wszystko: O4 - HKUS\S-1-5-18\..\RunOnce: [nlpo_01] cmd.exe /c md "%USERPROFILE%\Ustawienia lokalne\Temp" (User 'SYSTEM') O4 - HKUS\S-1-5-18\..\RunOnce: [nlpo_05] rundll32 advpack.dll,LaunchINFSection nlite.inf,nLiteReg (User 'SYSTEM') O4 - HKUS\S-1-5-18\..\RunOnce: [nlpo_06] rundll32 advpack.dll,LaunchINFSection nlite.inf,S (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\RunOnce: [nlpo_01] cmd.exe /c md "%USERPROFILE%\Ustawienia lokalne\Temp" (User 'Default user')

usuń HijackThisem >> Fix checked

Potem log Combofixa zaraz po usuwaniu

przez **pampix** » 10 Sty 2008, 21:02

Ok. Zrobione. to jest ten log:

Kod: Zaznacz wszystko: ComboFix 08-01-10.2 - Pablo 2008-01-10 19:57:08.3 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.254 [GMT 1:00] Running from: C:\Documents and Settings\Pablo\Pulpit\ComboFix.exe * Created a new restore point . ((((((((((((((((((((((((( Files Created from 2007-12-10 to 2008-01-10 ))))))))))))))))))))))))))))))) . 2008-01-08 19:34 . 2008-01-08 19:34 <DIR> d--hs---- C:\Documents and Settings\Pablo\Phone Browser 2008-01-08 19:04 . 2008-01-08 19:04 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\PC Suite 2008-01-08 19:03 . 2008-01-08 19:03 <DIR> d-------- C:\Program Files\DIFX 2008-01-08 19:03 . 2008-01-08 19:03 <DIR> d-------- C:\Program Files\Common Files\PCSuite 2008-01-08 19:03 . 2008-01-08 19:03 <DIR> d-------- C:\Program Files\Common Files\Nokia 2008-01-08 19:03 . 2008-01-08 19:05 <DIR> d-------- C:\Documents and Settings\Pablo\Dane aplikacji\Nokia 2008-01-08 18:56 . 2008-01-08 19:03 <DIR> d----c--- C:\WINDOWS\system32\DRVSTORE 2008-01-08 18:56 . 2008-01-08 18:56 <DIR> d-------- C:\Program Files\PC Connectivity Solution 2008-01-08 18:56 . 2008-01-08 19:05 <DIR> d-------- C:\Documents and Settings\Pablo\Dane aplikacji\PC Suite 2008-01-08 18:56 . 2007-02-22 10:15 137,216 --a------ C:\WINDOWS\system32\drivers\nmwcd.sys 2008-01-08 18:56 . 2007-02-22 10:15 90,624 --a------ C:\WINDOWS\system32\nmwcdcls.dll 2008-01-08 18:56 . 2007-02-22 10:15 65,536 --a------ C:\WINDOWS\system32\nmwcdcocls.dll 2008-01-08 18:56 . 2007-02-22 10:15 12,288 --a------ C:\WINDOWS\system32\drivers\nmwcdcm.sys 2008-01-08 18:56 . 2007-02-22 10:15 12,288 --a------ C:\WINDOWS\system32\drivers\nmwcdcj.sys 2008-01-08 18:56 . 2007-02-22 10:15 8,320 --a------ C:\WINDOWS\system32\drivers\nmwcdc.sys 2008-01-08 18:45 . 2008-01-08 18:51 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Installations 2008-01-03 22:42 . 2000-08-31 08:00 51,200 --a------ C:\WINDOWS\NirCmd.exe 2007-12-29 16:53 . 2007-12-04 14:04 837,496 --a------ C:\WINDOWS\system32\aswBoot.exe 2007-12-29 16:53 . 2004-01-09 10:13 380,928 --a------ C:\WINDOWS\system32\actskin4.ocx 2007-12-29 16:53 . 2007-12-04 13:54 95,608 --a------ C:\WINDOWS\system32\AvastSS.scr 2007-12-29 16:53 . 2007-12-04 15:55 94,544 --a------ C:\WINDOWS\system32\drivers\aswmon2.sys 2007-12-29 16:53 . 2007-12-04 15:56 93,264 --a------ C:\WINDOWS\system32\drivers\aswmon.sys 2007-12-29 16:53 . 2007-12-04 15:51 42,912 --a------ C:\WINDOWS\system32\drivers\aswTdi.sys 2007-12-29 16:53 . 2007-12-04 15:49 26,624 --a------ C:\WINDOWS\system32\drivers\aavmker4.sys 2007-12-29 16:53 . 2007-12-04 15:53 23,152 --a------ C:\WINDOWS\system32\drivers\aswRdr.sys 2007-12-26 21:51 . 2007-12-26 21:51 <DIR> d-------- C:\WINDOWS\Sun 2007-12-25 12:44 . 2007-11-29 23:30 3,596,288 --a------ C:\WINDOWS\system32\qt-dx331.dll 2007-12-25 12:44 . 2007-12-04 02:33 682,496 --a------ C:\WINDOWS\system32\divx.dll 2007-12-25 12:44 . 2007-03-10 12:51 282,624 --a------ C:\WINDOWS\system32\xvidvfw.dll 2007-12-25 12:44 . 2004-01-25 17:18 217,088 --a------ C:\WINDOWS\system32\yv12vfw.dll 2007-12-25 12:44 . 2007-11-29 23:28 81,920 --a------ C:\WINDOWS\system32\dpl100.dll 2007-12-25 12:44 . 2007-12-07 18:28 7,680 --a------ C:\WINDOWS\system32\ff_vfw.dll 2007-12-25 12:44 . 2007-07-10 17:10 547 --a------ C:\WINDOWS\system32\ff_vfw.dll.manifest 2007-12-25 11:07 . 2007-12-25 11:07 <DIR> d-------- C:\Program Files\Media Key 2007-12-25 11:02 . 2006-09-13 18:18 31,616 --a------ C:\WINDOWS\system32\drivers\usbccgp.sys 2007-12-25 11:02 . 2006-09-13 18:19 21,504 --a------ C:\WINDOWS\system32\hidserv.dll 2007-12-25 11:02 . 2006-09-13 18:18 14,848 --a------ C:\WINDOWS\system32\drivers\kbdhid.sys 2007-12-24 17:56 . 2007-12-25 12:40 <DIR> d-------- C:\Program Files\Winamp Remote 2007-12-24 17:53 . 2007-12-30 18:43 <DIR> d-------- C:\Documents and Settings\Pablo\Dane aplikacji\WinAmp 2007-12-24 16:15 . 2007-12-24 16:40 <DIR> d-------- C:\TEMP 2007-12-24 16:14 . 2007-12-24 16:14 <DIR> d-------- C:\Program Files\Alwil Software 2007-12-16 19:27 . 2007-12-16 19:27 <DIR> d-------- C:\Documents and Settings\Pablo\Dane aplikacji\Gadu-Gadu 2007-12-15 20:43 . 2007-12-24 16:05 <DIR> d-------- C:\Program Files\BearShare 2007-12-15 20:40 . 2007-12-15 20:40 <DIR> d-------- C:\Program Files\BearShare Applications 2007-12-15 20:40 . 2006-11-12 11:39 483,328 --a------ C:\WINDOWS\system32\actskn45.ocx 2007-12-15 20:38 . 2007-12-15 20:53 <DIR> d-------- C:\Program Files\BitLord 2007-12-15 19:55 . 2007-12-15 19:55 1,158 --a------ C:\WINDOWS\mozver.dat 2007-12-15 19:53 . 2007-12-15 19:53 0 --a------ C:\WINDOWS\nsreg.dat 2007-12-15 19:51 . 2007-12-15 20:58 <DIR> d-------- C:\Program Files\Google 2007-12-15 19:41 . 2007-12-15 19:41 <DIR> d---s---- C:\Documents and Settings\Pablo\UserData 2007-12-14 10:06 . 1999-12-17 10:13 86,016 --a------ C:\WINDOWS\unvise32.exe . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2007-12-25 10:07 --------- d--h--w C:\Program Files\InstallShield Installation Information 2007-11-27 21:38 --------- d-----w C:\Program Files\WexTech 2007-11-27 21:38 --------- d-----w C:\Program Files\Common Files\Wextech Shared 2007-11-27 21:38 --------- d-----w C:\Program Files\Common Files\LHSPF 2007-11-27 21:38 --------- d-----w C:\Program Files\Common Files\Autodesk Shared 2007-11-27 21:36 --------- d-----w C:\Program Files\Volo View Express 2007-07-14 10:44 1,049,719 ----a-w C:\Program Files\wrar361pl.exe 2004-03-11 12:27 40,960 ----a-w C:\Program Files\Uninstall_CDS.exe . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 01:44 15360] "MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2006-09-13 18:20 1694208] "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe" [2005-10-28 16:25 94208] "ares"="D:\PROGRAMY\Ares\Ares.exe" [ ] "PC Suite Tray"="D:\PROGRAMY\Nokia\Nokia PC Suite 6\PCSuite.exe" [2007-12-10 10:12 695808] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NVRTCLK"="C:\WINDOWS\System32\NVRTCLK\NVRTClk.exe" [2003-12-30 10:44 24576] "PathNvidiaTV"="C:\Program Files\Gigabyte\Nvidia\patchnvidiaTVout.exe" [ ] "NvCplDaemon"="C:\WINDOWS\System32\NvCpl.dll" [2005-01-10 08:32 5513216] "nwiz"="nwiz.exe" [2005-01-10 08:32 1490944 C:\WINDOWS\system32\nwiz.exe] "SunJavaUpdateSched"="C:\Program Files\Java\j2re1.4.2_02\bin\jusched.exe" [2003-09-16 19:01 32881] "DAEMON Tools-1033"="C:\Program Files\D-Tools\daemon.exe" [2004-03-12 22:43 81920] "NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 10:50 155648] "GrooveMonitor"="C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-27 00:47 31016] "SoundMan"="SOUNDMAN.EXE" [2004-06-18 09:31 67584 C:\WINDOWS\soundman.exe] "NvMediaCenter"="C:\WINDOWS\System32\NvMcTray.dll" [2005-01-10 08:32 86016] "Anti-Blaxx Manager"="D:\PROGRAMY\Anti-Blaxx\Anti-Blaxx.exe" [2005-05-18 15:08 208896] "BearShare"="C:\Program Files\BearShare\BearShare.exe" [ ] "WinampAgent"="D:\PROGRAMY\WinAmp\winampa.exe" [2007-12-20 16:16 37376] "MagicKey"="C:\PROGRA~1\MEDIAK~1\MagicKey.exe" [2004-03-15 13:27 45056] "Ashampoo FireWall"="D:\PROGRAMY\ashampoo_firewall120_sm\Ashampoo FireWall\FireWall.exe" [2007-04-05 14:57 3251800] "avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-12-04 14:00 79224] "Adobe Photo Downloader"="D:\PROGRAMY\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe" [2005-06-06 23:46 57344] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-08-04 01:44 15360] "Nokia.PCSync"="D:\PROGRAMY\Nokia\Nokia PC Suite 6\PcSync2.exe" [2007-11-07 17:35 1294336] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce] "nlpo_02"="advpack.dll" [2004-08-04 01:43 100864 C:\WINDOWS\system32\advpack.dll] "nlpo_03"="cmd.exe" [2004-08-04 01:44 395776 C:\WINDOWS\system32\cmd.exe] "nlpo_04"="cmd.exe" [2004-08-04 01:44 395776 C:\WINDOWS\system32\cmd.exe] "tscuninstall"="C:\WINDOWS\system32\tscupgrd.exe" [2004-08-04 01:33 44544] R0 d346bus;d346bus;C:\WINDOWS\system32\DRIVERS\d346bus.sys [2004-03-12 22:41] R0 d346prt;d346prt;C:\WINDOWS\system32\Drivers\d346prt.sys [2004-03-12 22:41] R3 GVCplDrv;GVCplDrv;C:\WINDOWS\system32\drivers\GVCplDrv.sys [2004-05-02 09:47] S3 usbscan;Sterownik skanera USB;C:\WINDOWS\system32\DRIVERS\usbscan.sys [2006-09-13 18:19] S3 USBSTOR;Sterownik magazynu masowego USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-04 00:08] . ************************************************************************** catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-01-10 19:57:56 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . --------------------- DLLs Loaded Under Running Processes --------------------- PROCESS: C:\WINDOWS\system32\lsass.exe [5.01.2600.2180] -> D:\PROGRAMY\ashampoo_firewall120_sm\Ashampoo FireWall\spi.dll . Completion time: 2008-01-10 19:58:18 ComboFix2.txt 2008-01-09 16:59:09

przez **Leon$** » 10 Sty 2008, 21:25

Powinno być już dobrze

przeprowdź sobie optymalizację startu bo masz tego za dużo przy uruchamianiu
[strona nie jest już dostępna] tu jest lista co możesz spokojnie wyłączyć

prosze o sprawdzenie loga problem z folderem moje dokumenty

prosze o sprawdzenie loga problem z folderem moje dokumenty

Kto jest na forum