Wykryto wyłączony javascript

Aktualnie masz wyłączony javascript. Kilka funkcji może nie działać. Włącz ponownie javascript, aby korzystać z pełnej funkcjonalności.

Logi - Powolna praca komputera

Rozpoczęty przez Killa , 28 10 2007 10:28

Temat jest zamknięty

3 odpowiedzi w tym temacie

#1 Killa

Początkujący

16 postów

Napisano 28 10 2007 - 10:28

Przetestowany Avastem, Ad-awarem, MKS nie chiał ruszyć a Panda Online nie usuwa.
Komputer strasznie wolno chodzi :/
Proszę

Logfile of HijackThis v1.99.1
Scan saved at 09:19:06, on 2007-10-28
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16544)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
C:\WINDOWS\system32\KMDEVMONSRV.exe
C:\WINDOWS\system32\KMdevmonx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\Program Files\D-Link\AirPlus G\AirGCFG.exe
C:\Program Files\ANI\ANIWZCS2 Service\WZCSLDR2.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Gadu-Gadu\gg.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleil.exe
C:\DOCUME~1\profil1\USTAWI~1\Temp\Rar$EX00.444\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.interia.pl/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: CSBrBHO - {96DA5BEE-4ACC-476C-B3EC-54C6730C4293} - C:\PROGRA~1\Comet\Install\Temp\brbho.dll (file missing)
O4 - HKLM\..\Run: [Synchronization Manager] %SystemRoot%\system32\mobsync.exe /logon
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [D-Link AirPlus G] C:\Program Files\D-Link\AirPlus G\AirGCFG.exe
O4 - HKLM\..\Run: [ANIWZCS2Service] C:\Program Files\ANI\ANIWZCS2 Service\WZCSLDR2.exe
O4 - HKLM\..\Run: [iPlusManager] C:\Program Files\iPlus\iPlusChecker.exe
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: D-Link AirPlus G+ Wireless Utility.lnk = ?
O4 - Global Startup: BlueSoleil.lnk = C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleil.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {745395C8-D0E1-4227-8586-624CA9A10A8D} - http://85.128.117.183/activex/AMC.cab
O16 - DPF: {92ECE6FA-AC2E-4042-BFAE-0C8608E52A43} (SignActivX Control) - https://www.bph.pl/pi/components/SignActivX.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C1} (GameDesire Pool 8) - http://67.15.101.3/g_bin/pl/billard8_2_0_0_28.cab
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: ANIWZCSd Service (ANIWZCSdService) - Alpha Networks Inc. - C:\Program Files\ANI\ANIWZCS2 Service\ANIWZCSdS.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: BlueSoleil Hid Service - Unknown owner - C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
O23 - Service: Multi-Function Station Device Monitor (KMDevmonSrv) - Unknown owner - C:\WINDOWS\system32\KMDEVMONSRV.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Unknown owner - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe (file missing)

0

Do góry

#2 wncvirus

Leń !

851 postów

Napisano 28 10 2007 - 11:42

Odpal Hjt.Wybierz opcje do a system scan only.Zrobi Ci się log i zaznacz kwadraciki obok poniższych wpisów i daj fix.

C:\WINDOWS\system32\KMDEVMONSRV.exe
C:\WINDOWS\system32\KMdevmonx.exe
O2 - BHO: CSBrBHO - {96DA5BEE-4ACC-476C-B3EC-54C6730C4293} - C:\PROGRA~1\Comet\Install\Temp\brbho.dll (file missing)

Natomiast ta poniższa usługę usuniesz w nastepujacy sposób:
O23 - Service: Multi-Function Station Device Monitor (KMDevmonSrv) - Unknown owner - C:\WINDOWS\system32\KMDEVMONSRV.exe

Najpierw spróbuj to usunąć ręcznie:
>>START>>> URUCHOM>>> cmd>> zastosować te trzy komendy (po każdej wciśnij "ENTER"):

SC STOP DNSCacheReader
SC DELETE DNSCacheReader
DEL C:\WINDOWS\system32\j9211430.exe

Potem zrób sobie kontrolnego loga z Hijacka i zobaczw nim, czy to zniknęło.

Jeśli nie zniknęło, to ściągnij GMER

Otwórz Notatnik i wklej do niego:

gmer -del Multi-Function Station Device Monitor (KMDevmonSrv)
gmer -del file C:\WINDOWS\system32\KMDEVMONSRV.exe
gmer -reboot

Plik >>> zapisz jako >>> zmień rozszerzenie z TXT na wszystkie typy plików >>> zapisz pod nazwą FIX.BAT ( np. na C:\ )

Uruchom Gmer, w >>>zakładce Procesy wybierz Gmer Awaryjny. Komputer się zresetuje i uruchomi się Gmer.
Wybierz znów >>>zakładkę Procesy i na dole w „Poleceniu” przez trzy kropki wskaż plik FIX.BAT, po czym go uruchom (dwuklik).

Potem daj logi:
1) z Hijacka
2) z ComboFix.

0

Do góry

#3 Killa

Początkujący

16 postów

Napisano 28 10 2007 - 21:03

Logfile of HijackThis v1.99.1
Scan saved at 20:05:32, on 2007-10-28
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16544)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\Program Files\D-Link\AirPlus G\AirGCFG.exe
C:\Program Files\ANI\ANIWZCS2 Service\WZCSLDR2.exe
C:\Program Files\iPlus\iPlusChecker.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Gadu-Gadu\gg.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleil.exe
C:\Program Files\WinRAR\WinRAR.exe
C:\DOCUME~1\profil1\USTAWI~1\Temp\Rar$EX06.895\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.interia.pl/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: CSBrBHO - {96DA5BEE-4ACC-476C-B3EC-54C6730C4293} - C:\PROGRA~1\Comet\Install\Temp\brbho.dll (file missing)
O4 - HKLM\..\Run: [Synchronization Manager] %SystemRoot%\system32\mobsync.exe /logon
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [D-Link AirPlus G] C:\Program Files\D-Link\AirPlus G\AirGCFG.exe
O4 - HKLM\..\Run: [ANIWZCS2Service] C:\Program Files\ANI\ANIWZCS2 Service\WZCSLDR2.exe
O4 - HKLM\..\Run: [iPlusManager] C:\Program Files\iPlus\iPlusChecker.exe
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: D-Link AirPlus G+ Wireless Utility.lnk = ?
O4 - Global Startup: BlueSoleil.lnk = C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleil.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {745395C8-D0E1-4227-8586-624CA9A10A8D} - http://85.128.117.183/activex/AMC.cab
O16 - DPF: {92ECE6FA-AC2E-4042-BFAE-0C8608E52A43} (SignActivX Control) - https://www.bph.pl/pi/components/SignActivX.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C1} (GameDesire Pool 8) - http://67.15.101.3/g_bin/pl/billard8_2_0_0_28.cab
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: ANIWZCSd Service (ANIWZCSdService) - Alpha Networks Inc. - C:\Program Files\ANI\ANIWZCS2 Service\ANIWZCSdS.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: BlueSoleil Hid Service - Unknown owner - C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
O23 - Service: Multi-Function Station Device Monitor (KMDevmonSrv) - Unknown owner - C:\WINDOWS\system32\KMDEVMONSRV.exe (file missing)
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Unknown owner - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe (file missing)

Procesów w HiJack'u nie było przy kwadracikach. Dopiero jak się jakoś do nich dogrzebałem, chciałem zrobić "kill process', jednak wyskakiwał błąd, bodajże że używane przez Winde albo coś w tym rodzaju.

Co do GMER'a postępowałem wg wskazówek, nie wiem jednak czy przyniosło to skutek.

Co do ComboFixa, logi się zrobiły ale w trakcie wyskakiwał też błąd, że brak pliku REGT.
Oto ten log:

ComboFix 07-10-28.2 - profil1 2007-10-28 20:14:21.1 - [color=red][b]FAT32[/b][/color]x86 
Microsoft Windows XP Home Edition  5.1.2600.2.1250.48.1045.18.93 [GMT 1:00]
Running from: C:\Documents and Settings\profil1\Pulpit\ComboFix.exe
 * Created a new restore point
.

(((((((((((((((((((((((((((((((((((((((   Other Deletions   )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\profil1\Ulubione\.url
C:\WINDOWS\inf\cc_43.inf

.
(((((((((((((((((((((((((   Files Created from 2007-09-28 to 2007-10-28  )))))))))))))))))))))))))))))))
.

2007-10-28 20:11	51,200	--a------	C:\WINDOWS\NirCmd.exe
2007-10-27 19:22	<DIR>	d--------	C:\Program Files\Lavasoft
2007-10-27 19:22	<DIR>	d--------	C:\Documents and Settings\All Users\Dane aplikacji\Lavasoft
2007-10-27 19:20	<DIR>	d--------	C:\Program Files\Common Files\Wise Installation Wizard
2007-10-25 22:04	<DIR>	d--------	C:\WINDOWS\system32\ActiveScan
2007-10-25 21:23	153,088	--a------	C:\WINDOWS\system32\irftp.exe
2007-10-25 21:23	153,088	--a------	C:\WINDOWS\system32\dllcache\irftp.exe
2007-10-25 21:23	27,648	--a------	C:\WINDOWS\system32\irmon.dll
2007-10-25 21:23	27,648	--a------	C:\WINDOWS\system32\dllcache\irmon.dll
2007-10-25 21:23	8,192	--a------	C:\WINDOWS\system32\wshirda.dll
2007-10-25 21:23	8,192	--a------	C:\WINDOWS\system32\dllcache\wshirda.dll
2007-10-25 21:19	12	--a------	C:\WINDOWS\bthservsdp.dat
2007-10-25 21:16	<DIR>	d--------	C:\Documents and Settings\All Users\Dane aplikacji\Bluetooth
2007-10-25 21:08	<DIR>	d--------	C:\Program Files\IVT Corporation
2007-10-25 21:08	54,784	--a------	C:\WINDOWS\system32\drivers\vfwwdm32.dll
2007-10-10 12:33	582,656	---------	C:\WINDOWS\system32\dllcache\rpcrt4.dll

.
((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-09-06 11:09	801,144	----a-w	C:\WINDOWS\system32\aswBoot.exe
2007-09-06 11:05	94,416	----a-w	C:\WINDOWS\system32\drivers\aswmon2.sys
2007-09-06 11:05	92,848	----a-w	C:\WINDOWS\system32\drivers\aswmon.sys
2007-09-06 11:03	23,152	----a-w	C:\WINDOWS\system32\drivers\aswRdr.sys
2007-09-06 11:02	42,912	----a-w	C:\WINDOWS\system32\drivers\aswTdi.sys
2007-09-06 11:00	95,608	----a-w	C:\WINDOWS\system32\AVASTSS.scr
2007-09-06 11:00	26,624	----a-w	C:\WINDOWS\system32\drivers\aavmker4.sys
2007-08-21 07:18	683,520	----a-w	C:\WINDOWS\system32\inetcomm.dll
2007-08-21 07:18	683,520	------w	C:\WINDOWS\system32\dllcache\inetcomm.dll
2007-08-20 11:01	824,832	----a-w	C:\WINDOWS\system32\dllcache\wininet.dll
2007-08-20 11:01	671,232	----a-w	C:\WINDOWS\system32\dllcache\mstime.dll
2007-08-20 11:01	63,488	------w	C:\WINDOWS\system32\dllcache\icardie.dll
2007-08-20 11:01	6,058,496	------w	C:\WINDOWS\system32\dllcache\ieframe.dll
2007-08-20 11:01	52,224	------w	C:\WINDOWS\system32\dllcache\msfeedsbs.dll
2007-08-20 11:01	477,696	----a-w	C:\WINDOWS\system32\dllcache\mshtmled.dll
2007-08-20 11:01	459,264	------w	C:\WINDOWS\system32\dllcache\msfeeds.dll
2007-08-20 11:01	44,544	------w	C:\WINDOWS\system32\dllcache\iernonce.dll
2007-08-20 11:01	384,512	------w	C:\WINDOWS\system32\dllcache\iedkcs32.dll
2007-08-20 11:01	383,488	------w	C:\WINDOWS\system32\dllcache\ieapfltr.dll
2007-08-20 11:01	3,584,512	----a-w	C:\WINDOWS\system32\dllcache\mshtml.dll
2007-08-20 11:01	27,648	----a-w	C:\WINDOWS\system32\dllcache\jsproxy.dll
2007-08-20 11:01	267,776	------w	C:\WINDOWS\system32\dllcache\iertutil.dll
2007-08-20 11:01	232,960	------w	C:\WINDOWS\system32\dllcache\webcheck.dll
2007-08-20 11:01	230,400	------w	C:\WINDOWS\system32\dllcache\ieaksie.dll
2007-08-20 11:01	214,528	----a-w	C:\WINDOWS\system32\dllcache\dxtrans.dll
2007-08-20 11:01	193,024	----a-w	C:\WINDOWS\system32\dllcache\msrating.dll
2007-08-20 11:01	153,088	------w	C:\WINDOWS\system32\dllcache\ieakeng.dll
2007-08-20 11:01	132,608	----a-w	C:\WINDOWS\system32\dllcache\extmgr.dll
2007-08-20 11:01	124,928	------w	C:\WINDOWS\system32\dllcache\advpack.dll
2007-08-20 11:01	105,984	------w	C:\WINDOWS\system32\dllcache\url.dll
2007-08-20 11:01	102,400	------w	C:\WINDOWS\system32\dllcache\occache.dll
2007-08-20 11:01	1,152,000	----a-w	C:\WINDOWS\system32\dllcache\urlmon.dll
2007-08-17 11:24	63,488	------w	C:\WINDOWS\system32\dllcache\ie4uinit.exe
2007-08-17 11:24	625,152	------w	C:\WINDOWS\system32\dllcache\iexplore.exe
2007-08-17 11:24	13,824	------w	C:\WINDOWS\system32\dllcache\ieudinit.exe
2007-08-17 08:34	161,792	------w	C:\WINDOWS\system32\dllcache\ieakui.dll
2007-07-30 18:19	92,504	----a-w	C:\WINDOWS\system32\dllcache\cdm.dll
2007-07-30 18:19	92,504	----a-w	C:\WINDOWS\system32\cdm.dll
2007-07-30 18:19	549,720	----a-w	C:\WINDOWS\system32\wuapi.dll
2007-07-30 18:19	549,720	----a-w	C:\WINDOWS\system32\dllcache\wuapi.dll
2007-07-30 18:19	53,080	----a-w	C:\WINDOWS\system32\wuauclt.exe
2007-07-30 18:19	53,080	----a-w	C:\WINDOWS\system32\dllcache\wuauclt.exe
2007-07-30 18:19	43,352	----a-w	C:\WINDOWS\system32\wups2.dll
2007-07-30 18:19	325,976	----a-w	C:\WINDOWS\system32\wucltui.dll
2007-07-30 18:19	325,976	----a-w	C:\WINDOWS\system32\dllcache\wucltui.dll
2007-07-30 18:19	203,096	----a-w	C:\WINDOWS\system32\wuweb.dll
2007-07-30 18:19	203,096	----a-w	C:\WINDOWS\system32\dllcache\wuweb.dll
2007-07-30 18:19	1,712,984	----a-w	C:\WINDOWS\system32\wuaueng.dll
2007-07-30 18:19	1,712,984	----a-w	C:\WINDOWS\system32\dllcache\wuaueng.dll
2007-07-30 18:18	33,624	----a-w	C:\WINDOWS\system32\wups.dll
2007-07-30 18:18	33,624	----a-w	C:\WINDOWS\system32\dllcache\wups.dll
.

(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown 

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{96DA5BEE-4ACC-476C-B3EC-54C6730C4293}]
			C:\PROGRA~1\Comet\Install\Temp\brbho.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Synchronization Manager"="C:\WINDOWS\system32\mobsync.exe" [2004-08-04 08:44]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-09-06 12:06]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2005-03-04 20:35]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" [2007-07-12 04:00]
"D-Link AirPlus G"="C:\Program Files\D-Link\AirPlus G\AirGCFG.exe" [2005-07-22 10:42]
"ANIWZCS2Service"="C:\Program Files\ANI\ANIWZCS2 Service\WZCSLDR2.exe" [2004-12-16 17:49]
"iPlusManager"="C:\Program Files\iPlus\iPlusChecker.exe" [2006-08-28 11:30]
"BluetoothAuthenticationAgent"="bthprops.cpl" [2004-08-04 08:44 C:\WINDOWS\system32\bthprops.cpl]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Gadu-Gadu"="C:\Program Files\Gadu-Gadu\gg.exe" [2004-07-07 15:00]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 17:24]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 08:44]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Microsoft Office.lnk]
path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Microsoft Office.lnk
backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Panasonic Monitor statusu.lnk]
backup=C:\WINDOWS\pss\Panasonic Monitor statusu.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\[u]0[/u]00StTHK]
000StTHK.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Apoint]
C:\Program Files\Apoint2K\Apoint.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\avast!]
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Gadu-Gadu]
"C:\Program Files\Gadu-Gadu\gg.exe" /tray

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LTSMMSG]
LTSMMSG.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
"C:\Program Files\Messenger\msmsgs.exe" /background

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NDSTray.exe]
"C:\Program Files\Toshiba\ConfigFree\NDSTray.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PmProxy]
C:\Program Files\Analog Devices\SoundMAX\PmProxy.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TFNF5]
TFNF5.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TouchED]
C:\Program Files\TOSHIBA\TouchED\TouchED.Exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Tpwrtray]
TPWRTRAY.EXE

R0 TVALG;Toshiba Value Added Logical and General Purpose Device Driver;C:\WINDOWS\system32\DRIVERS\TVALG.SYS
R2 KMsmfpi;KMSMFPI;\??\C:\WINDOWS\System32\Drivers\KMSMFPI.sys
R3 odysseyIM3;Odyssey Network Services Miniport;C:\WINDOWS\system32\DRIVERS\odysseyIM3.sys
R3 TOSHIBASoftModem;TOSHIBA Software Modem;C:\WINDOWS\system32\DRIVERS\LTSM.sys
S2 KMDevmonSrv;Multi-Function Station Device Monitor;C:\WINDOWS\system32\KMDEVMONSRV.exe
S2 VECP;VECP;\??\C:\WINDOWS\System32\Drivers\VECP.sys
S3 AIRPLUS;D-Link AirPlus Wireless Adapter;C:\WINDOWS\system32\DRIVERS\airplus.sys
S3 BTNetFilter;Bluetooth Network Filter;\??\C:\Program Files\IVT Corporation\BlueSoleil\Device\Win2k\BTNetFilter.sys
S3 hwdatacard;Huawei DataCard USB Modem and USB Serial;C:\WINDOWS\system32\DRIVERS\ewusbmdm.sys
S3 wlags48b;Wireless LAN PCCard Driver;C:\WINDOWS\system32\DRIVERS\wlags48b.sys

*Newly Created Service* - CATCHME
.
**************************************************************************

catchme 0.3.1239 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-10-28 20:16:25
Windows 5.1.2600 Dodatek Service Pack 2 FAT NTAPI

scanning hidden processes ... 

scanning hidden autostart entries ...

scanning hidden files ... 

scan completed successfully 
hidden files: 0 

**************************************************************************
.
Completion time: 2007-10-28 20:16:59
.
	--- E O F ---

WIELKIE DZIĘKI za pomoc. Wszystko idealnie wytłumaczone

Pozdrawiam

0

Do góry

#4 wncvirus

Leń !

851 postów

Napisano 29 10 2007 - 16:32

Widzę że nie wykonałeś tych punktów co pisałem w poście wcześniej.A wiec jeszcze raz

Odpalamy hjt.

1.Wybieramy opcje Do a system scan only( 2 kwadrat od góry)
2.Następnie robi Ci się log.Po wyborze tej opcji masz coś takiego.I stosujesz sie do poprzedniego posta mojego.

0

Do góry

Wróć do Bezpieczeństwo (wirusy i trojany)

Użytkownicy przeglądający ten temat: 0

0 użytkowników, 0 gości, 0 anonimowych