Nie mogę uruchomić msconfig'a, ani w ogóle go znaleźć i zastanawiam się, czy to "sprawka" jakiegoś robaka.
» Naciśnij aby pokazać/ukryć tekst oznaczony jako spoiler « - "hijack"
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 01:19:03, on 2009-05-10
Platform: Windows XP Dodatek SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0013)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Program Files\VIA\VIAudioi\HDADeck\HDeck.exe
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\Program Files\Razer\DeathAdder\razerhid.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\Program Files\Razer\DeathAdder\razerofa.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\SysOp\Pulpit\HiJackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.pl/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.microsoft.com/fwlink/?LinkId=74005
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O4 - HKLM\..\Run: [startCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [HDAudDeck] C:\Program Files\VIA\VIAudioi\HDADeck\HDeck.exe 1
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKLM\..\Run: [DeathAdder] C:\Program Files\Razer\DeathAdder\razerhid.exe
O4 - HKUS\S-1-5-18\..\RunOnce: [_nltide_2] regsvr32 /s /n /i:U shell32 (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [_nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [_nltide_2] regsvr32 /s /n /i:U shell32 (User 'Default user')
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O23 - Service: Usługa bramy warstwy aplikacji (ALG) - Unknown owner - C:\WINDOWS\System32\alg.exe (file missing)
O23 - Service: Avira AntiVir Scheduler (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
O23 - Service: cisvc - Unknown owner - C:\WINDOWS\system32\cisvc.exe (file missing)
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
--
End of file - 3418 bytes
» Naciśnij aby pokazać/ukryć tekst oznaczony jako spoiler « - "combofix"
ComboFix 09-05-08.03 - SysOp 2009-05-10 1:14.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1250.48.1045.18.1791.1194 [GMT 2:00]
Uruchomiony z: c:\documents and settings\SysOp\Pulpit\ComboFix.exe
UWAGA - TEN KOMPUTER NIE MA ZAINSTALOWANEJ KONSOLI ODZYSKIWANIA !!
.
((((((((((((((((((((((((( Pliki utworzone od 2009-04-09 do 2009-05-09 )))))))))))))))))))))))))))))))
.
2009-05-09 22:59 . 2009-05-09 22:59 -------- d-----w c:\program files\Avira GmbH
2009-05-09 20:11 . 2009-05-09 20:11 -------- d-----w c:\documents and settings\SysOp\Dane aplikacji\Media Player Classic
2009-05-09 18:22 . 2009-05-09 18:22 -------- d-----w c:\program files\XP Codec Pack
2009-05-09 10:14 . 2008-04-14 18:35 1845888 ----a-w c:\windows\system32\dllcache\win32k.sys
2009-04-30 17:57 . 2009-04-30 17:57 -------- d-----w c:\program files\Razer
2009-04-29 17:18 . 2009-04-29 17:58 -------- d-----w c:\program files\EditCFG
2009-04-29 14:03 . 2009-04-29 14:03 -------- d-----w c:\documents and settings\SysOp\Dane aplikacji\Gadu-Gadu
2009-04-29 14:00 . 2009-04-29 14:03 -------- d-----w c:\documents and settings\SysOp\Gadu-Gadu
2009-04-29 14:00 . 2009-04-29 14:00 -------- d-----w c:\program files\Gadu-Gadu
2009-04-28 23:09 . 2001-08-17 20:59 3072 ----a-w c:\windows\system32\drivers\audstub.sys
2009-04-28 23:07 . 2008-04-14 20:35 58880 ----a-w c:\windows\system32\drivers\redbook.sys
2009-04-28 23:07 . 2001-08-17 20:51 19584 ----a-w c:\windows\system32\drivers\rasirda.sys
2009-04-28 23:07 . 2008-04-14 21:51 8192 ----a-w c:\windows\system32\wshirda.dll
2009-04-28 23:07 . 2008-04-14 21:50 28672 ----a-w c:\windows\system32\irmon.dll
2009-04-28 23:07 . 2008-04-14 21:51 152064 ----a-w c:\windows\system32\irftp.exe
2009-04-28 23:07 . 2008-04-13 23:24 88192 ----a-w c:\windows\system32\drivers\irda.sys
2009-04-28 23:07 . 2001-08-17 20:51 18688 ----a-w c:\windows\system32\drivers\irsir.sys
2009-04-28 23:07 . 2008-04-14 21:50 77312 ----a-w c:\windows\system32\usbui.dll
2009-04-28 23:06 . 2008-04-13 23:06 8832 ----a-w c:\windows\system32\drivers\wmiacpi.sys
2009-04-28 23:06 . 2009-05-03 21:16 -------- d-sh--w c:\windows\Installer
2009-04-28 23:03 . 2009-04-28 21:19 -------- d-----w c:\windows\system32\CatRoot
2009-04-28 23:03 . 2009-05-09 23:13 -------- d-----w c:\windows\system32\CatRoot2
2009-04-28 23:03 . 2009-04-28 23:05 -------- d--h--r c:\documents and settings\Default User\Dane aplikacji
2009-04-28 23:02 . 2009-04-28 22:00 -------- d--h--r c:\documents and settings\All Users\Dane aplikacji
2009-04-28 23:02 . 2009-04-28 21:14 -------- d-----w c:\documents and settings\All Users
2009-04-28 23:02 . 2009-04-28 21:16 -------- d--h--w c:\documents and settings\Default User
2009-04-28 23:02 . 2009-04-28 21:17 -------- d-----w C:\Documents and Settings
.
(((((((((((((((((((((((((((((((((((((((( Sekcja Find3M ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-05-09 23:03 . 2009-04-28 21:22 -------- d--h--w c:\program files\InstallShield Installation Information
2009-05-09 22:47 . 2001-10-26 17:15 72840 ----a-w c:\windows\system32\perfc015.dat
2009-05-09 22:47 . 2001-10-26 17:15 445618 ----a-w c:\windows\system32\perfh015.dat
2009-05-09 22:08 . 2009-04-28 21:45 138944 ----a-w c:\windows\system32\drivers\PnkBstrK.sys
2009-05-09 22:08 . 2009-04-28 21:45 189784 ----a-w c:\windows\system32\PnkBstrB.exe
2009-05-03 21:16 . 2009-04-28 21:31 -------- d-----w c:\program files\Common Files\Adobe
2009-04-28 23:31 . 2009-04-28 21:45 75064 ----a-w c:\windows\system32\PnkBstrA.exe
2009-04-28 22:18 . 2009-04-28 22:17 -------- d-----w c:\program files\Winamp
2009-04-28 22:06 . 2009-04-28 21:47 55640 ----a-w c:\windows\system32\drivers\avgntflt.sys
2009-04-28 22:00 . 2009-04-28 22:00 12784 ----a-w c:\documents and settings\SysOp\Ustawienia lokalne\Dane aplikacji\GDIPFONTCACHEV1.DAT
2009-04-28 21:59 . 2009-04-28 21:59 0 ----a-w c:\windows\ativpsrm.bin
2009-04-28 21:47 . 2009-04-28 21:47 -------- d-----w c:\program files\Avira
2009-04-28 21:45 . 2009-04-28 21:45 22328 ----a-w c:\documents and settings\SysOp\Dane aplikacji\PnkBstrK.sys
2009-04-28 21:45 . 2009-04-28 21:45 2246144 ----a-w c:\windows\system32\pbsvc.exe
2009-04-28 21:41 . 2009-04-28 21:41 0 ----a-w c:\windows\nsreg.dat
2009-04-28 21:38 . 2009-04-28 21:38 -------- d-----w c:\program files\DIFX
2009-04-28 21:30 . 2009-04-28 21:30 -------- d-----w c:\program files\AMD
2009-04-28 21:29 . 2009-04-28 21:29 -------- d-----w c:\program files\Realtek
2009-04-28 21:28 . 2009-04-28 21:27 -------- d-----w c:\program files\VIA
2009-04-28 21:27 . 2009-04-28 21:22 -------- d-----w c:\program files\Common Files\InstallShield
2009-04-28 21:27 . 2009-04-28 21:22 -------- d-----w c:\program files\ATI Technologies
2009-04-28 21:14 . 2001-07-21 23:36 67 --sha-w c:\windows\Fonts\desktop.ini
2009-04-28 21:11 . 2009-04-28 21:11 21856 ----a-w c:\windows\system32\emptyregdb.dat
2009-04-28 21:11 . 2009-04-28 21:11 -------- d-----w c:\program files\Windows Media Connect 2
.
------- Sigcheck -------
[-] 2007-07-11 04:06 642560 CE594E18FE0D0AF804F1F3694921CE62 c:\windows\system32\user32.dll
[-] 2008-12-03 17:16 920064 88348F8C92C28BA99FE49BD392100CE0 c:\windows\system32\wininet.dll
[-] 2008-12-03 16:39 361344 030DC4D48CC2B894FEE2F390D8E66AD5 c:\windows\system32\drivers\tcpip.sys
[-] 2008-12-03 17:15 549888 335813EACD16E84F3047A3326F6E5473 c:\windows\system32\winlogon.exe
[-] 2008-12-03 17:26 2027520 F95FE6AB1581F3CB95FB2F1A2A38EE86 c:\windows\system32\ntkrnlpa.exe
[-] 2008-12-03 16:13 2148864 4D753509A2856CCCEB1A6DAB994BCB6D c:\windows\system32\ntoskrnl.exe
[-] 2008-12-03 17:14 1553408 BDA7A4169BF5E1F3EE76B017396E4F47 c:\windows\explorer.exe
[-] 2008-12-03 17:15 112128 37ED43F3DEC4400586554D61C3129478 c:\windows\system32\wuauclt.exe
.
((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane
REGEDIT4
