wlasciwie to olac ten zegarek bojest wiekszy problem - po tych wszystkich zabiegach co jakis czas pada mi generic host for windows 32. da sie temujakos zaradzic?

probowalem ubijac wszystko ... i nic ;/

No to odpal menadżera zadań i zabijaj po kolei procesy - może wyłapiesz czy to któryś proces powoduje.

Wlasciwie sprawdzilem juz wszystko co sie tyczy ustawien w windowsie. We wlasciwosciach daty i godziny normalnie wpisana mam powiedzmy 23:05 a w trayu uparcie 11:05 ;/ zauwazylem tylko ze podczas dzialania combofixa czas zmienia mi sie na wlasciwy, po zakonczeniu jego dzialania powraca do stanu "z wysp"

Zostaje, zostaje - a nie da sie ręcznie ustawić by było 24h ?? Może inne aplikacje trzeba byłoby sprawdzić ??

pliczek skasowalem Po wylaczeniu aim'a zegarek zostaje jak byl wczesniej tez przed dostaniem tego smiecia chodzil ok moze to jakas blachostka do przelaczenia w systemie, bo komp chodzi juz powiedzmy normalnie gdybys na nic juz nie wpadl to i tak serdecznie dziekuje :-({|=

Tego C:\WINDOWS\system32\8DEB5BF730.sys stale widzę. Co do czasu - nie powoduje zmiany jakis program ? Np AIM bo widzę [quote]O4 - HKCU\..\Run: [Aim6] "C:\Program Files\AIM6\aim6.exe" /d [b]locale=en-US[/b] ee://aol/imApp[/quote] A locale en-US to chyba banglają na 12 godzinnym czasie o ile wiem. Ale to strzelectwo jest.

te pierwsze dwa pliki to drivery do karty muzycznej do obs;ugi gramofonow: Final Scratch 2 reszte usunalem wyglada ze jest troche lepiej choc pewnosci nie mam. explorer odpala sie wreszcie od startowej okienka z nikad wydaje sie ze nie wyskakuja tapeta z pulpitu wreszcie wrocila [u]Lecz jednak cos wydaje sie nie pasic z zegrem bo zamiast 23 pokazuje mi wciaz 11. Na czas wlacazania combofixa przekakuje na poprawny, aloe po zakonczeniu porawca do dziwnego stanu [/u] wrzucam jeszcze raz wszystkie logi i dziekuje za wczesniejsze porady [color=red][b]HIJACK[/b][/color] Logfile of HijackThis v1.99.1 Scan saved at 11:09:41 , on 2008-05-05 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\keyhook.exe C:\WINDOWS\system32\RunDll32.exe C:\Program Files\Stanton\FinalScratch\ScratchAmpControl.exe C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe C:\Program Files\skrzynka bogiego\skrzynka.exe C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe C:\Program Files\AIM6\aim6.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe C:\Program Files\AIM6\aolsoftware.exe C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Opera\Opera.exe C:\Program Files\DAP\DAP.EXE C:\WINDOWS\system32\wuauclt.exe C:\Documents and Settings\jotex\Moje dokumenty\My Completed Downloads\hijackthis_199\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.onet.pl/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = file://c:/windows/homepage.html O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.0.1225.9868\swg.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll O4 - HKLM\..\Run: [SiS Windows KeyHook] C:\WINDOWS\system32\keyhook.exe O4 - HKLM\..\Run: [SiSUSBRG] C:\WINDOWS\SiSUSBrg.exe O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd O4 - HKLM\..\Run: [ScratchAmp] C:\Program Files\Stanton\FinalScratch\ScratchAmpControl.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe" O4 - HKLM\..\Run: [Ad-Watch] C:\Program Files\Lavasoft\Ad-Aware 2007\Ad-Watch2007.exe O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - HKCU\..\Run: [skrzynka bogiego] C:\Program Files\skrzynka bogiego\skrzynka.exe O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe O4 - HKCU\..\Run: [NBJ] "C:\Program Files\Ahead\Nero BackItUp\NBJ.exe" O4 - HKCU\..\Run: [Aim6] "C:\Program Files\AIM6\aim6.exe" /d locale=en-US ee://aol/imApp O4 - HKCU\..\Run: [AlcoholAutomount] "C:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe" /automount O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O17 - HKLM\System\CCS\Services\Tcpip\..\{BBFF4851-6637-4ABD-9252-639040F00FBA}: NameServer = 217.30.129.149,217.30.137.200 O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe [color=red][b]SILENT RUNNERS[/b][/color] "Silent Runners.vbs", revision 56, http://www.silentrunners.org/ Operating System: Windows XP SP2 Output limited to non-default values, except where indicated by "{++}" Startup items buried in registry: --------------------------------- HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ {++} "Gadu-Gadu" = ""C:\Program Files\Gadu-Gadu\gg.exe" /tray" ["Gadu-Gadu Sp. z oo"] "skrzynka bogiego" = "C:\Program Files\skrzynka bogiego\skrzynka.exe" ["bogi"] "swg" = "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" ["Google Inc."] "NBJ" = ""C:\Program Files\Ahead\Nero BackItUp\NBJ.exe"" ["Ahead Software AG"] "Aim6" = ""C:\Program Files\AIM6\aim6.exe" /d locale=en-US ee://aol/imApp" ["AOL LLC"] "AlcoholAutomount" = ""C:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe" /automount" ["Alcohol Soft Development Team"] "ctfmon.exe" = "C:\WINDOWS\system32\ctfmon.exe" [MS] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++} "SiS Windows KeyHook" = "C:\WINDOWS\system32\keyhook.exe" ["Silicon Integrated Systems Corporation"] "SiSUSBRG" = "C:\WINDOWS\SiSUSBrg.exe" ["Silicon Integrated Systems Corp."] "Cmaudio" = "RunDll32 cmicnfg.cpl,CMICtrlWnd" [MS] "ScratchAmp" = "C:\Program Files\Stanton\FinalScratch\ScratchAmpControl.exe" ["Stanton"] "QuickTime Task" = ""C:\Program Files\QuickTime\qttask.exe" -atboottime" ["Apple Inc."] "RemoteControl" = ""C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe"" ["Cyberlink Corp."] "Ad-Watch" = "C:\Program Files\Lavasoft\Ad-Aware 2007\Ad-Watch2007.exe" ["Lavasoft AB"] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\(Default) = (no title provided) -> {HKLM...CLSID} = "AcroIEHlprObj Class" \InProcServer32\(Default) = "C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx" [empty string] {AA58ED58-01DD-4d91-8333-CF10577473F7}\(Default) = (no title provided) -> {HKLM...CLSID} = "Google Toolbar Helper" \InProcServer32\(Default) = "c:\program files\google\googletoolbar2.dll" ["Google Inc."] {AF69DE43-7D58-4638-B6FA-CE66B5AD205D}\(Default) = (no title provided) -> {HKLM...CLSID} = "Google Toolbar Notifier BHO" \InProcServer32\(Default) = "C:\Program Files\Google\GoogleToolbarNotifier\3.0.1225.9868\swg.dll" ["Google Inc."] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved"{42071714-76d4-11d1-8b24-00a0c9068ff3}" = "Rozszerzenie CPL kadrowania wyświetlania" -> {HKLM...CLSID} = "Rozszerzenie CPL kadrowania wyświetlania" \InProcServer32\(Default) = "deskpan.dll" [file not found] "{88895560-9AA2-1069-930E-00AA0030EBC8}" = "Rozszerzenie ikony HyperTerminalu" -> {HKLM...CLSID} = "HyperTerminal Icon Ext" \InProcServer32\(Default) = "C:\WINDOWS\system32\hticons.dll" ["Hilgraeve, Inc."] "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" = "WinRAR shell extension" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] "{0006F045-0000-0000-C000-000000000046}" = "Microsoft Outlook Custom Icon Handler" -> {HKLM...CLSID} = "Rozszerzenie ikon plików programu Outlook" \InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\Office\OLKFSTUB.DLL" [MS] "{32020A01-506E-484D-A2A8-BE3CF17601C3}" = "AlcoholShellEx" -> {HKLM...CLSID} = "AlcoholShellEx" \InProcServer32\(Default) = "C:\PROGRA~1\ALCOHO~1\ALCOHO~2\AxShlex.dll" ["Alcohol Soft Development Team"] HKLM\SYSTEM\CurrentControlSet\Control\Session Manager<> "BootExecute" = "autocheck autochk *"|"lsdelete" [null data] HKLM\SOFTWARE\Classes\*\shellex\ContextMenuHandlersDAP_ShredMenu\(Default) = "{BED4C38B-F765-45AC-8C56-613F76BBF43E}" -> {HKLM...CLSID} = "DAPMenuShellExt Class" \InProcServer32\(Default) = "C:\PROGRA~1\DAP\PRIVAC~1\DAPCTX~1.DLL" ["Speedbit Ltd."] WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] HKLM\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlersDAP_ShredMenu\(Default) = "{BED4C38B-F765-45AC-8C56-613F76BBF43E}" -> {HKLM...CLSID} = "DAPMenuShellExt Class" \InProcServer32\(Default) = "C:\PROGRA~1\DAP\PRIVAC~1\DAPCTX~1.DLL" ["Speedbit Ltd."] WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] HKLM\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlersWinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] Group Policies {GPedit.msc branch and setting}: ----------------------------------------------- Note: detected settings may not have any effect. HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System "HideLegacyLogonScripts" = (REG_DWORD) dword:0x00000000 {unrecognized setting} "HideLogoffScripts" = (REG_DWORD) dword:0x00000000 {unrecognized setting} "RunLogonScriptSync" = (REG_DWORD) dword:0x00000001 {unrecognized setting} "RunStartupScriptSync" = (REG_DWORD) dword:0x00000001 {unrecognized setting} "HideStartupScripts" = (REG_DWORD) dword:0x00000000 {unrecognized setting} HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System "shutdownwithoutlogon" = (REG_DWORD) dword:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| Shutdown: Allow system to be shut down without having to log on} "undockwithoutlogon" = (REG_DWORD) dword:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| Devices: Allow undock without having to log on} "DisableRegistryTools" = (REG_DWORD) dword:0x00000000 {unrecognized setting} "HideLegacyLogonScripts" = (REG_DWORD) dword:0x00000000 {unrecognized setting} "HideLogoffScripts" = (REG_DWORD) dword:0x00000000 {unrecognized setting} "RunLogonScriptSync" = (REG_DWORD) dword:0x00000001 {unrecognized setting} "RunStartupScriptSync" = (REG_DWORD) dword:0x00000001 {unrecognized setting} "HideStartupScripts" = (REG_DWORD) dword:0x00000000 {unrecognized setting} Active Desktop and Wallpaper: ----------------------------- Active Desktop may be disabled at this entry: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState Displayed if Active Desktop enabled and wallpaper not set by Group Policy: HKCU\Software\Microsoft\Internet Explorer\Desktop\General"Wallpaper" = "C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp" Displayed if Active Desktop disabled and wallpaper not set by Group Policy: HKCU\Control Panel\Desktop"Wallpaper" = "C:\Documents and Settings\jotex\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp" Enabled Screen Saver: --------------------- HKCU\Control Panel\Desktop"SCRNSAVE.EXE" = "C:\WINDOWS\System32\logon.scr" [MS] Enabled Scheduled Tasks: ------------------------ "AppleSoftwareUpdate" -> launches: "C:\Program Files\Apple Software Update\SoftwareUpdate.exe -task" ["Apple Inc."] Winsock2 Service Provider DLLs: ------------------------------- Namespace Service Providers HKLM\SYSTEM\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++} 000000000001\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS] 000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS] 000000000003\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS] Transport Service Providers HKLM\SYSTEM\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++} 0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range: %SystemRoot%\system32\mswsock.dll [MS], 01 - 03, 06 - 15 %SystemRoot%\system32\rsvpsp.dll [MS], 04 - 05 Toolbars, Explorer Bars, Extensions: ------------------------------------ Toolbars HKCU\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser"{2318C2B1-4965-11D4-9B18-009027A5CD4F}" -> {HKLM...CLSID} = "&Google" \InProcServer32\(Default) = "c:\program files\google\googletoolbar2.dll" ["Google Inc."] HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser"{2318C2B1-4965-11D4-9B18-009027A5CD4F}" -> {HKLM...CLSID} = "&Google" \InProcServer32\(Default) = "c:\program files\google\googletoolbar2.dll" ["Google Inc."] HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar"{2318C2B1-4965-11D4-9B18-009027A5CD4F}" = (no title provided) -> {HKLM...CLSID} = "&Google" \InProcServer32\(Default) = "c:\program files\google\googletoolbar2.dll" ["Google Inc."] Running Services (Display Name, Service Name, Path {Service DLL}): ------------------------------------------------------------------ Ad-Aware 2007 Service, aawservice, ""C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe"" ["Lavasoft AB"] StarWind AE Service, StarWindServiceAE, "C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe" ["Rocket Division Software"] Print Monitors: --------------- HKLM\SYSTEM\CurrentControlSet\Control\Print\MonitorsCanon BJ Language Monitor PIXMA iP1000\Driver = "CNMLM6e.DLL" ["CANON INC."] ---------- (launch time: 2008-05-05 23:09:57) <>: Suspicious data at a malware launch point. + This report excludes default entries except where indicated. + To see *everywhere* the script checks and *everything* it finds, launch it from a command prompt or a shortcut with the -all parameter. + The search for DESKTOP.INI DLL launch points on all local fixed drives took 33 seconds. ---------- (total run time: 82 seconds) [b][color=red]COMBOFIX[/color][/b] ComboFix 08-05-01.3 - jotex 2008-05-05 23:12:28.2 - [color=red][b]FAT32[/b][/color]x86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.608 [GMT 2:00] Running from: C:\Documents and Settings\jotex\Moje dokumenty\My Completed Downloads\ComboFix.exe [color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color] . ((((((((((((((((((((((((( Files Created from 2008-04-05 to 2008-05-05 ))))))))))))))))))))))))))))))) . 2008-05-03 15:38 . 2008-05-03 15:38 44,032 --ahs---- C:\WINDOWS\Thumbs.db 2008-05-03 15:38 . 2008-05-03 15:38 5,120 --ahs---- C:\WINDOWS\system32\Thumbs.db 2008-05-03 11:51 . 2008-05-03 11:51 d-------- C:\Program Files\Spyware Doctor 2008-05-03 11:51 . 2008-05-03 11:51 d-------- C:\Documents and Settings\jotex\Dane aplikacji\PC Tools 2008-05-03 11:51 . 2007-12-10 14:53 81,288 --a------ C:\WINDOWS\system32\drivers\iksyssec.sys 2008-05-03 11:51 . 2007-12-10 14:53 66,952 --a------ C:\WINDOWS\system32\drivers\iksysflt.sys 2008-05-03 11:51 . 2008-02-01 12:55 42,376 --a------ C:\WINDOWS\system32\drivers\ikfilesec.sys 2008-05-03 11:51 . 2007-12-10 14:53 29,576 --a------ C:\WINDOWS\system32\drivers\kcom.sys 2008-05-03 11:08 . 2007-08-01 09:35 d--h----- C:\Documents and Settings\Administrator\Ustawienia lokalne 2008-05-03 11:08 . 2007-08-01 09:35 d-------- C:\Documents and Settings\Administrator\Ulubione 2008-05-03 11:08 . 2007-08-01 09:35 d--h----- C:\Documents and Settings\Administrator\Szablony 2008-05-03 11:08 . 2007-08-01 09:35 d-------- C:\Documents and Settings\Administrator\Pulpit 2008-05-03 11:08 . 2007-08-01 09:35 d-------- C:\Documents and Settings\Administrator\Moje dokumenty 2008-05-03 11:08 . 2007-08-01 09:35 dr------- C:\Documents and Settings\Administrator\Menu Start 2008-05-03 11:08 . 2007-08-01 09:35 dr-h----- C:\Documents and Settings\Administrator\Dane aplikacji 2008-05-03 11:08 . 2008-05-03 11:08 d-------- C:\Documents and Settings\Administrator 2008-05-03 11:08 . 2008-05-05 22:29 1,024 --ah----- C:\Documents and Settings\Administrator\NtUser.dat.LOG 2008-04-22 22:07 . 2008-04-22 22:07 d-------- C:\Program Files\Common Files\Canon 2008-04-22 18:01 . 2008-04-22 18:01 d-------- C:\Rozliczenie Roczne 2007 . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-02-11 09:30 50,688 ----a-w C:\WINDOWS\system32\wbhelp2.dll 2008-01-08 18:39 32 ----a-w C:\Documents and Settings\All Users\Dane aplikacji\ezsid.dat 2004-10-01 13:00 40,960 ----a-w C:\Program Files\Uninstall_CDS.exe 2003-08-27 09:49 3,424 ----a-w C:\WINDOWS\inf\OTHER\cmiainfo.sys 2008-02-11 09:30 251,392 ----a-w C:\Program Files\opera\program\plugins\dapop.dll 2007-08-23 15:43 2,098 --sha-w C:\WINDOWS\system32\KGyGaAvL.sys 2007-08-23 15:43 56 --sh--r C:\WINDOWS\system32\8DEB5BF730.sys . ((((((((((((((((((((((((((((( snapshot@2008-05-05_22.30.54.78 ))))))))))))))))))))))))))))))))))))))))) . - 2008-05-05 20:23:22 2,048 --s-a-w C:\WINDOWS\bootstat.dat + 2008-05-05 21:03:50 2,048 --s-a-w C:\WINDOWS\bootstat.dat . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Gadu-Gadu"="C:\Program Files\Gadu-Gadu\gg.exe" [2006-02-17 15:03 2396160] "skrzynka bogiego"="C:\Program Files\skrzynka bogiego\skrzynka.exe" [2001-11-05 18:15 985088] "swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-08-19 17:44 68856] "NBJ"="C:\Program Files\Ahead\Nero BackItUp\NBJ.exe" [2005-10-11 18:25 1961984] "Aim6"="C:\Program Files\AIM6\aim6.exe" [2007-04-27 23:17 50736] "AlcoholAutomount"="C:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe" [2007-12-22 08:21 222080] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-03 22:44 15360] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SiS Windows KeyHook"="C:\WINDOWS\system32\keyhook.exe" [2003-10-30 14:09 249856] "SiSUSBRG"="C:\WINDOWS\SiSUSBrg.exe" [2002-07-12 12:15 106496] "Cmaudio"="cmicnfg.cpl" [] "ScratchAmp"="C:\Program Files\Stanton\FinalScratch\ScratchAmpControl.exe" [2004-11-18 12:51 1363968] "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-06-29 06:24 286720] "RemoteControl"="C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe" [2004-11-02 20:24 32768] "Ad-Watch"="C:\Program Files\Lavasoft\Ad-Aware 2007\Ad-Watch2007.exe" [2007-06-13 14:18 4177920] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-03 22:44 15360] [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Adobe Gamma Loader.lnk] path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Adobe Gamma Loader.lnk backup=C:\WINDOWS\pss\Adobe Gamma Loader.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Microsoft Office.lnk] path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Microsoft Office.lnk backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Aim6] --a------ 2007-04-27 23:17 50736 C:\Program Files\AIM6\aim6.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] --a------ 2001-07-09 10:50 155648 C:\WINDOWS\system32\NeroCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SiS Tray] --a------ 2003-10-30 14:10 667648 C:\WINDOWS\system32\sistray.EXE [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "C:\\Program Files\\Gadu-Gadu\\GG.EXE"= "C:\\totalcmd\\TOTALCMD.EXE"= "C:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"= "C:\\Program Files\\AIM6\\aim6.exe"= "C:\\Program Files\\DAP\\DAP.exe"= "C:\\xampp\\apache\\bin\\apache.exe"= "C:\\xampp\\mysql\\bin\\mysqld.exe"= R1 Asapi;Asapi;C:\WINDOWS\system32\drivers\Asapi.sys [2002-04-17 20:27] R3 fs2_1394;fs2_1394;C:\WINDOWS\system32\Drivers\fs2_1394.sys [2004-11-18 12:51] R3 fs2_avs;fs2_avs;C:\WINDOWS\system32\Drivers\fs2_avs.sys [2004-11-18 12:51] S3 usbscan;Sterownik skanera USB;C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-03 22:58] S3 USBSTOR;Sterownik magazynu masowego USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-03 23:08] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA844-CC51-11CF-AAFA-AABBCCDDEE02}] rundll32.exe advpack.dll,LaunchINFSection %SystemRoot%\INF\skrzynka.inf,profil.i.nt . Contents of the 'Scheduled Tasks' folder "2007-09-17 06:08:46 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job" - C:\Program Files\Apple Software Update\SoftwareUpdate.exe . ************************************************************************** catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-05-05 23:13:12 Windows 5.1.2600 Dodatek Service Pack 2 FAT NTAPI scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2008-05-05 23:13:35 ComboFix-quarantined-files.txt 2008-05-05 21:13:34 ComboFix2.txt 2008-05-05 20:31:08 Pre-Run: 2,819,301,376 bajtów wolnych Post-Run: 2,812,116,992 bajtów wolnych 116

Tych plików nie znam: C:\WINDOWS\system32\Drivers\fs2_1394.sys C:\WINDOWS\system32\Drivers\fs2_avs.sys Oglądnij ich właściwości - moze maja jakieś informacje przydatne. Może przeskanuj je na http://virusscan.jotti.org/ Usuń pliki C:\WINDOWS\system32\DWv6Jz.syz C:\WINDOWS\system32\eKqFiQ.syz C:\WINDOWS\system32\gstrtwgp.tmp C:\WINDOWS\system32\q0az1a.syz C:\WINDOWS\system32\8DEB5BF730.sys Pokaz sobie pliki i foldery ukryte oraz nakaz pokazywanie plików chronionych przez system w opcjach folderów -> widok - bo możesz ich nie zobaczyć. Pokaz potem raz jeszcze logi - Hijacka, Combofixa i SilentRunners

ok dziekuje za odzew. Wydaje mi sie ze wszystko zrobilem choc wciaz ne gra log z combofixa: ComboFix 08-05-01.3 - jotex 2008-05-05 22:29:42.1 - [color=red][b]FAT32[/b][/color]x86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.620 [GMT 2:00] Running from: C:\Documents and Settings\jotex\Moje dokumenty\My Completed Downloads\ComboFix.exe [color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color] . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\WINDOWS\system32\lt.res . ((((((((((((((((((((((((( Files Created from 2008-04-05 to 2008-05-05 ))))))))))))))))))))))))))))))) . 2008-05-03 15:38 . 2008-05-03 15:38 44,032 --ahs---- C:\WINDOWS\Thumbs.db 2008-05-03 15:38 . 2008-05-03 15:38 5,120 --ahs---- C:\WINDOWS\system32\Thumbs.db 2008-05-03 11:51 . 2008-05-03 11:51 d-------- C:\Program Files\Spyware Doctor 2008-05-03 11:51 . 2008-05-03 11:51 d-------- C:\Documents and Settings\jotex\Dane aplikacji\PC Tools 2008-05-03 11:51 . 2007-12-10 14:53 81,288 --a------ C:\WINDOWS\system32\drivers\iksyssec.sys 2008-05-03 11:51 . 2007-12-10 14:53 66,952 --a------ C:\WINDOWS\system32\drivers\iksysflt.sys 2008-05-03 11:51 . 2008-02-01 12:55 42,376 --a------ C:\WINDOWS\system32\drivers\ikfilesec.sys 2008-05-03 11:51 . 2007-12-10 14:53 29,576 --a------ C:\WINDOWS\system32\drivers\kcom.sys 2008-05-03 11:08 . 2007-08-01 09:35 d--h----- C:\Documents and Settings\Administrator\Ustawienia lokalne 2008-05-03 11:08 . 2007-08-01 09:35 d-------- C:\Documents and Settings\Administrator\Ulubione 2008-05-03 11:08 . 2007-08-01 09:35 d--h----- C:\Documents and Settings\Administrator\Szablony 2008-05-03 11:08 . 2007-08-01 09:35 d-------- C:\Documents and Settings\Administrator\Pulpit 2008-05-03 11:08 . 2007-08-01 09:35 d-------- C:\Documents and Settings\Administrator\Moje dokumenty 2008-05-03 11:08 . 2007-08-01 09:35 dr------- C:\Documents and Settings\Administrator\Menu Start 2008-05-03 11:08 . 2007-08-01 09:35 dr-h----- C:\Documents and Settings\Administrator\Dane aplikacji 2008-05-03 11:08 . 2008-05-03 11:08 d-------- C:\Documents and Settings\Administrator 2008-05-03 11:08 . 2008-05-05 22:29 1,024 --ah----- C:\Documents and Settings\Administrator\NtUser.dat.LOG 2008-05-03 10:58 . 2008-05-03 10:58 4,672 --a------ C:\WINDOWS\system32\DWv6Jz.syz 2008-05-03 10:26 . 2008-05-03 10:26 4,672 --a------ C:\WINDOWS\system32\eKqFiQ.syz 2008-05-03 09:09 . 2008-05-03 09:09 29 --a------ C:\WINDOWS\system32\gstrtwgp.tmp 2008-05-03 09:08 . 2008-05-03 09:08 4,672 --a------ C:\WINDOWS\system32\q0az1a.syz 2008-04-22 22:07 . 2008-04-22 22:07 d-------- C:\Program Files\Common Files\Canon 2008-04-22 18:01 . 2008-04-22 18:01 d-------- C:\Rozliczenie Roczne 2007 . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-02-11 09:30 50,688 ----a-w C:\WINDOWS\system32\wbhelp2.dll 2008-01-08 18:39 32 ----a-w C:\Documents and Settings\All Users\Dane aplikacji\ezsid.dat 2004-10-01 13:00 40,960 ----a-w C:\Program Files\Uninstall_CDS.exe 2003-08-27 09:49 3,424 ----a-w C:\WINDOWS\inf\OTHER\cmiainfo.sys 2008-02-11 09:30 251,392 ----a-w C:\Program Files\opera\program\plugins\dapop.dll 2007-08-23 15:43 2,098 --sha-w C:\WINDOWS\system32\KGyGaAvL.sys 2007-08-23 15:43 56 --sh--r C:\WINDOWS\system32\8DEB5BF730.sys . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Gadu-Gadu"="C:\Program Files\Gadu-Gadu\gg.exe" [2006-02-17 15:03 2396160] "skrzynka bogiego"="C:\Program Files\skrzynka bogiego\skrzynka.exe" [2001-11-05 18:15 985088] "swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-08-19 17:44 68856] "NBJ"="C:\Program Files\Ahead\Nero BackItUp\NBJ.exe" [2005-10-11 18:25 1961984] "Aim6"="C:\Program Files\AIM6\aim6.exe" [2007-04-27 23:17 50736] "AlcoholAutomount"="C:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe" [2007-12-22 08:21 222080] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-03 22:44 15360] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SiS Windows KeyHook"="C:\WINDOWS\system32\keyhook.exe" [2003-10-30 14:09 249856] "SiSUSBRG"="C:\WINDOWS\SiSUSBrg.exe" [2002-07-12 12:15 106496] "Cmaudio"="cmicnfg.cpl" [] "ScratchAmp"="C:\Program Files\Stanton\FinalScratch\ScratchAmpControl.exe" [2004-11-18 12:51 1363968] "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-06-29 06:24 286720] "RemoteControl"="C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe" [2004-11-02 20:24 32768] "Ad-Watch"="C:\Program Files\Lavasoft\Ad-Aware 2007\Ad-Watch2007.exe" [2007-06-13 14:18 4177920] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-03 22:44 15360] [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Adobe Gamma Loader.lnk] path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Adobe Gamma Loader.lnk backup=C:\WINDOWS\pss\Adobe Gamma Loader.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Microsoft Office.lnk] path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Microsoft Office.lnk backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Aim6] --a------ 2007-04-27 23:17 50736 C:\Program Files\AIM6\aim6.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] --a------ 2001-07-09 10:50 155648 C:\WINDOWS\system32\NeroCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SiS Tray] --a------ 2003-10-30 14:10 667648 C:\WINDOWS\system32\sistray.EXE [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "C:\\Program Files\\Gadu-Gadu\\GG.EXE"= "C:\\totalcmd\\TOTALCMD.EXE"= "C:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"= "C:\\Program Files\\AIM6\\aim6.exe"= "C:\\Program Files\\DAP\\DAP.exe"= "C:\\xampp\\apache\\bin\\apache.exe"= "C:\\xampp\\mysql\\bin\\mysqld.exe"= R1 Asapi;Asapi;C:\WINDOWS\system32\drivers\Asapi.sys [2002-04-17 20:27] R3 fs2_1394;fs2_1394;C:\WINDOWS\system32\Drivers\fs2_1394.sys [2004-11-18 12:51] R3 fs2_avs;fs2_avs;C:\WINDOWS\system32\Drivers\fs2_avs.sys [2004-11-18 12:51] S3 usbscan;Sterownik skanera USB;C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-03 22:58] S3 USBSTOR;Sterownik magazynu masowego USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-03 23:08] *Newly Created Service* - CATCHME [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA844-CC51-11CF-AAFA-AABBCCDDEE02}] rundll32.exe advpack.dll,LaunchINFSection %SystemRoot%\INF\skrzynka.inf,profil.i.nt . Contents of the 'Scheduled Tasks' folder "2007-09-17 06:08:46 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job" - C:\Program Files\Apple Software Update\SoftwareUpdate.exe . ************************************************************************** catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-05-05 22:30:44 Windows 5.1.2600 Dodatek Service Pack 2 FAT NTAPI scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2008-05-05 22:31:05 ComboFix-quarantined-files.txt 2008-05-05 20:31:04 Pre-Run: 1,956,806,656 bajtów wolnych Post-Run: 2,570,256,384 bajtów wolnych 119

[quote]HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components{66186F05-BBBB-4a39-864F-72D84615C679}\(Default) = "Systray component" \StubPath = "rundll32 sockins32.dll,InitModule" [MS][/quote] http://www.sophos.com/security/analyses/viruses-and-spyware/w32dwnldrhcp.html - More information - masz podane jakie pliki do usunięcia i klucze w rejestrze. Przed usuwaniem czegokolwiek wyrejestruj bibliotekę poleceniem regsvr32 /u sockins32.dll wklepanym w start -> uruchom Skasuj plik c:/windows/homepage.html dodatkowo jak nie jest Twój. Zrob i pokaz rowniez loga Combofixa.