Ntos.exe

[Mumin]

Witam. zlapalem po raz kolejny to co w temacie. wyczytalem ze trojan itd itp, znalazlem kilka sposobow na usuniecie. problem polega na tym, ze usuniecie tego syfu wiaze sie z niemozliwoscia zalogowania do windowsa. po kliknieciu w obrazek uzytkownika nastepuje automatyczne wylogowanie (i tak mozna sobie klikac i klikac i nic). mam noda32, spybota (ktory problem wykrywa, ale w pelni nie potrafi rozwiazac - po reboocie problem jest dalej). nie wiem jak to dziadostwo usunac, a kolejnej reinstalki systemu nie mam sily dzis robic..

 

na PPC nic w tym temacie nie znalazlem. szukajac via google mozna znalezc kilka sposobow (np SDFIX), ale wszystkie powoduja niemoznosc zalogowania sie do systemu.

 

dziekuje za pomoc i pozdrawiam.

 

edit:

 

» Naciśnij, żeby pokazać/ukryć tekst oznaczony jako spoiler... «

Hijackthis log

SilentRunners Log

 

edit: Moja Recepta:

 

po 2 godzinach prob udalo mi sie wyrwac chwasta. sposob nastepujacy:

 

1. niezbedne programy: HijackThis oraz SDFix.

2. wylaczamy przywracanie systemu.

3. w trybie awaryjnym odpalamy SDFixa ktory robi porzadek, po nim (po restarcie i wejsciu rowniez do trybu awaryjnego) HijackThis i "Fixem" naprawiamy linijke w ktorej jest zapis "ntos.exe" (zaczyna sie od F2 i dotyczy winlogon).

4. sprawdzamy jeszcze raz scanem HijackThis czy ntos.exe pojawia sie w logu. jesli brak, syf usuniety.

 

nie mam juz teraz reklam na stronie glownej google, nie zamula. jesli ktos zechce rzucic okiem to moge wrzucic logi po calej sprawie. pozdrawiam.

Edytowane 31 Grudnia 2007 przez Mumin

[Kolobos]

Daj log z combofix oraz nowy z hijackthis.

[Mumin]

ComboFix 07-12-31.4 - user 2008-01-01 15:06:15.1 - NTFSx86Microsoft Windows XP Professional  5.1.2600.2.1250.1.1045.18.2474 [GMT 1:00]Running from: F:\instale\ComboFix.exe * Created a new restore point.(((((((((((((((((((((((((   Files Created from 2007-12-01 to 2008-01-01  ))))))))))))))))))))))))))))))).2008-01-01 15:05 . 2000-08-31 08:00	51,200	--a------	C:\WINDOWS\NirCmd.exe2007-12-31 18:31 . 2007-12-31 18:31	<DIR>	d--------	C:\WINDOWS\ERUNT2007-12-31 18:30 . 2007-12-21 21:46	<DIR>	d--h-----	C:\Documents and Settings\Administrator.USER-5F4754A146\Ustawienia lokalne2007-12-31 18:30 . 2007-12-21 21:46	<DIR>	d--------	C:\Documents and Settings\Administrator.USER-5F4754A146\Ulubione2007-12-31 18:30 . 2007-12-21 20:50	<DIR>	d--h-----	C:\Documents and Settings\Administrator.USER-5F4754A146\Szablony2007-12-31 18:30 . 2007-12-31 18:32	<DIR>	d--------	C:\Documents and Settings\Administrator.USER-5F4754A146\Pulpit2007-12-31 18:30 . 2007-12-21 21:46	<DIR>	d--------	C:\Documents and Settings\Administrator.USER-5F4754A146\Moje dokumenty2007-12-31 18:30 . 2007-12-21 21:46	<DIR>	dr-------	C:\Documents and Settings\Administrator.USER-5F4754A146\Menu Start2007-12-31 18:30 . 2007-12-21 21:46	<DIR>	dr-h-----	C:\Documents and Settings\Administrator.USER-5F4754A146\Dane aplikacji2007-12-31 18:11 . 2007-12-21 21:46	<DIR>	d--h-----	C:\Documents and Settings\Administrator\Ustawienia lokalne2007-12-31 18:11 . 2007-12-21 21:46	<DIR>	d--------	C:\Documents and Settings\Administrator\Ulubione2007-12-31 18:11 . 2007-12-21 20:50	<DIR>	d--h-----	C:\Documents and Settings\Administrator\Szablony2007-12-31 18:11 . 2007-12-21 21:46	<DIR>	d--------	C:\Documents and Settings\Administrator\Pulpit2007-12-31 18:11 . 2007-12-21 21:46	<DIR>	d--------	C:\Documents and Settings\Administrator\Moje dokumenty2007-12-31 18:11 . 2007-12-21 21:46	<DIR>	dr-------	C:\Documents and Settings\Administrator\Menu Start2007-12-31 18:11 . 2007-12-21 21:46	<DIR>	dr-h-----	C:\Documents and Settings\Administrator\Dane aplikacji2007-12-31 17:17 . 2007-12-31 17:17	96	--a------	C:\WINDOWS\wininit.ini2007-12-31 17:00 . 2007-12-31 17:00	<DIR>	d--------	C:\Program Files\Trend Micro2007-12-31 16:38 . 2007-12-31 16:38	41,984	--a------	C:\winbxfe.exe2007-12-31 15:45 . 2008-01-01 02:46	69	--a------	C:\WINDOWS\NeroDigital.ini2007-12-30 21:59 . 2007-12-17 13:53	159,458	--a------	C:\WINDOWS\system32\nvapps.nvb2007-12-30 21:58 . 2007-12-30 21:58	<DIR>	d--------	C:\NVIDIA2007-12-29 15:21 . 2007-12-29 15:21	<DIR>	d--------	C:\Program Files\Common Files\LightScribe2007-12-29 15:20 . 2004-07-26 17:16	1,568,768	---------	C:\WINDOWS\system32\ImagX7.dll2007-12-29 15:20 . 2004-07-26 17:16	476,320	---------	C:\WINDOWS\system32\ImagXpr7.dll2007-12-29 15:20 . 2004-07-26 17:16	471,040	---------	C:\WINDOWS\system32\ImagXRA7.dll2007-12-29 15:20 . 2004-07-26 17:16	262,144	---------	C:\WINDOWS\system32\ImagXR7.dll2007-12-29 15:20 . 2001-07-09 11:50	155,648	--a------	C:\WINDOWS\system32\NeroCheck.exe2007-12-29 15:20 . 2000-06-26 11:45	106,496	--a------	C:\WINDOWS\system32\TwnLib20.dll2007-12-29 15:19 . 2007-12-29 15:19	<DIR>	d--------	C:\Program Files\Common Files\Ahead2007-12-29 15:19 . 2007-12-29 15:20	<DIR>	d--------	C:\Program Files\Ahead2007-12-28 09:32 . 2007-12-28 09:32	<DIR>	d--------	C:\Documents and Settings\user\Dane aplikacji\Media Player Classic2007-12-27 18:54 . 2007-12-27 21:24	<DIR>	d--------	C:\Documents and Settings\All Users\Dane aplikacji\Test Drive Unlimited2007-12-27 18:53 . 2007-12-27 18:53	<DIR>	dr-h-----	C:\Documents and Settings\user\Dane aplikacji\SecuROM2007-12-27 18:53 . 2007-12-27 18:53	107,888	--a------	C:\WINDOWS\system32\CmdLineExt.dll2007-12-26 13:26 . 2007-12-29 17:12	<DIR>	d--------	C:\Program Files\uTorrent2007-12-26 13:26 . 2008-01-01 15:06	<DIR>	d--------	C:\Documents and Settings\user\Dane aplikacji\uTorrent2007-12-25 20:06 . 2007-12-25 20:06	<DIR>	d--------	C:\Program Files\Teamspeak2_RC22007-12-25 20:06 . 2007-12-30 22:42	<DIR>	d--------	C:\Documents and Settings\user\Dane aplikacji\teamspeak22007-12-25 20:06 . 2007-12-25 20:06	34,064	--a------	C:\WINDOWS\system32\lhacm.acm2007-12-24 18:00 . 2004-08-04 00:44	159,232	--a------	C:\WINDOWS\system32\ptpusd.dll2007-12-24 18:00 . 2004-08-03 22:58	15,104	--a------	C:\WINDOWS\system32\drivers\usbscan.sys2007-12-24 18:00 . 2004-08-03 22:58	15,104	--a--c---	C:\WINDOWS\system32\dllcache\usbscan.sys2007-12-24 18:00 . 2001-10-26 17:29	5,632	--a------	C:\WINDOWS\system32\ptpusb.dll2007-12-24 13:42 . 2007-12-24 13:42	<DIR>	d--------	C:\Documents and Settings\user\Dane aplikacji\Gadu-Gadu2007-12-24 09:22 . 2004-08-03 23:08	26,496	--a--c---	C:\WINDOWS\system32\dllcache\usbstor.sys2007-12-23 19:14 . 2007-12-23 19:14	<DIR>	d--------	C:\Program Files\SopCast2007-12-23 17:42 . 2007-12-23 17:42	<DIR>	d--------	C:\WINDOWS\system32\LogFiles2007-12-23 17:24 . 2007-12-23 17:24	<DIR>	d--------	C:\Program Files\Marvell2007-12-23 17:24 . 2007-12-23 17:24	<DIR>	d--------	C:\Documents and Settings\user\Dane aplikacji\TMP2007-12-23 13:32 . 2007-12-23 13:32	298	--a------	C:\WINDOWS\game.ini2007-12-23 11:30 . 2008-01-01 11:41	<DIR>	d--------	C:\Program Files\DC++2007-12-23 02:37 . 2007-12-23 02:37	<DIR>	d--------	C:\Program Files\Headshot Player2007-12-22 14:01 . 2007-12-31 00:27	<DIR>	d--------	C:\Fraps2007-12-22 14:01 . 2007-12-31 19:45	<DIR>	d-a------	C:\Documents and Settings\All Users\Dane aplikacji\TEMP2007-12-22 13:57 . 2007-12-22 13:57	<DIR>	d--------	C:\Documents and Settings\user\Dane aplikacji\AdobeUM2007-12-22 13:56 . 2007-12-22 13:56	<DIR>	d--------	C:\WINDOWS\Cache2007-12-22 13:56 . 2007-12-22 13:57	<DIR>	d--------	C:\Program Files\Common Files\Adobe2007-12-22 11:19 . 2007-12-22 11:21	<DIR>	d--------	C:\Documents and Settings\All Users\Dane aplikacji\DAEMON Tools Pro2007-12-22 11:18 . 2007-12-22 11:19	<DIR>	d--------	C:\Documents and Settings\user\Dane aplikacji\DAEMON Tools Pro2007-12-22 11:16 . 2007-12-22 11:23	<DIR>	d--------	C:\Program Files\DAEMON Tools Pro2007-12-22 11:08 . 2007-12-22 11:08	685,816	--a------	C:\WINDOWS\system32\drivers\sptd.sys2007-12-21 23:03 . 2007-12-22 11:09	<DIR>	d--------	C:\Program Files\Google2007-12-21 22:59 . 2007-12-31 18:49	<DIR>	d--------	C:\Documents and Settings\All Users\Dane aplikacji\Spybot - Search & Destroy2007-12-21 22:55 . 2007-12-21 22:55	<DIR>	d--------	C:\Documents and Settings\user\Dane aplikacji\Creative2007-12-21 22:55 . 2007-12-21 22:55	584	--a------	C:\WINDOWS\system32\settingsbkup.sfm2007-12-21 22:55 . 2007-12-21 22:55	584	--a------	C:\WINDOWS\system32\settings.sfm2007-12-21 22:53 . 2007-12-21 22:53	<DIR>	d--------	C:\Program Files\Thomson2007-12-21 22:53 . 2003-12-08 11:53	70,688	--a------	C:\WINDOWS\system32\drivers\alcaudsl.sys2007-12-21 22:53 . 2003-12-08 11:53	53,600	--a------	C:\WINDOWS\system32\drivers\alcan5wn.sys2007-12-21 22:53 . 2003-12-08 11:53	5,606	--a------	C:\WINDOWS\system32\stci.dll2007-12-21 22:53 . 2003-12-08 11:53	5,280	--a------	C:\WINDOWS\system32\drivers\alcawh.sys2007-12-21 22:53 . 2003-12-08 11:53	3,968	--a------	C:\WINDOWS\system32\drivers\alcacr.sys2007-12-21 22:44 . 2007-12-21 22:44	<DIR>	d--hs----	C:\WINDOWS\ftpcache2007-12-21 22:33 . 2000-05-22 09:58	647,872	---------	C:\WINDOWS\system32\Mscomct2.ocx2007-12-21 22:33 . 1999-10-11 02:00	41,984	---------	C:\WINDOWS\Ctregrun.exe2007-12-21 22:30 . 1999-12-13 02:01	44,032	---------	C:\WINDOWS\system32\CTSVCCDA.EXE2007-12-21 22:30 . 1999-11-18 02:00	25,088	---------	C:\WINDOWS\system32\CTSVCCTL.EXE2007-12-21 22:29 . 2007-12-21 22:29	<DIR>	d--------	C:\Program Files\K-Lite Codec Pack2007-12-21 22:26 . 2007-12-21 22:26	<DIR>	d--------	C:\WINDOWS\system32\Data2007-12-21 22:25 . 2000-12-13 11:21	7,572,224	---------	C:\WINDOWS\system32\CT8MGM.SF22007-12-21 22:25 . 2000-12-05 02:11	4,174,814	---------	C:\WINDOWS\system32\CT4MGM.SF22007-12-21 22:25 . 1999-09-22 08:18	2,167,684	-ra------	C:\WINDOWS\system32\ct2mgm.sf22007-12-21 22:23 . 2007-12-21 22:33	<DIR>	d--------	C:\Program Files\Creative.((((((((((((((((((((((((((((((((((((((((   Find3M Report   )))))))))))))))))))))))))))))))))))))))))))))))))))).2007-12-27 17:59	---------	d-----w	C:\Program Files\Gadu-Gadu2007-12-27 17:31	---------	d-----w	C:\Program Files\Common Files\InstallShield2007-12-23 12:32	---------	d--h--w	C:\Program Files\InstallShield Installation Information2007-12-22 12:49	---------	d-----w	C:\Program Files\RivaTuner v2.062007-12-22 10:32	278,984	----a-w	C:\WINDOWS\system32\drivers\atksgt.sys2007-12-22 10:32	25,416	----a-w	C:\WINDOWS\system32\drivers\lirsgt.sys2007-12-22 07:48	---------	d-----w	C:\Program Files\SubEdit-Player2007-12-22 07:41	---------	d-----w	C:\Program Files\Winamp2007-12-21 20:39	512,096	----a-w	C:\WINDOWS\system32\drivers\amon.sys2007-12-21 20:39	298,104	----a-w	C:\WINDOWS\system32\imon.dll2007-12-21 20:39	15,424	----a-w	C:\WINDOWS\system32\drivers\nod32drv.sys2007-12-21 20:24	86,016	----a-w	C:\WINDOWS\system32\OpenAL32.dll2007-12-21 20:24	262,144	----a-w	C:\WINDOWS\system32\wrap_oal.dll2007-12-21 20:23	---------	d-----w	C:\Program Files\Futuremark2007-12-21 19:53	---------	d-----w	C:\Program Files\microsoft frontpage2007-12-21 19:52	---------	d-----w	C:\Program Files\Usługi online2007-12-05 00:41	81,920	----a-w	C:\WINDOWS\system32\nvwddi.dll2007-12-05 00:41	81,920	----a-w	C:\WINDOWS\system32\nvmctray.dll2007-12-05 00:41	8,523,776	----a-w	C:\WINDOWS\system32\nvcpl.dll2007-12-05 00:41	7,435,392	----a-w	C:\WINDOWS\system32\drivers\nv4_mini.sys2007-12-05 00:41	6,901,760	----a-w	C:\WINDOWS\system32\nvoglnt.dll2007-12-05 00:41	6,549,504	----a-w	C:\WINDOWS\system32\nvdisps.dll2007-12-05 00:41	5,773,568	----a-w	C:\WINDOWS\system32\nv4_disp.dll2007-12-05 00:41	5,611,520	----a-w	C:\WINDOWS\system32\nvdispsr.dll2007-12-05 00:41	466,944	----a-w	C:\WINDOWS\system32\nvshell.dll2007-12-05 00:41	458,752	----a-w	C:\WINDOWS\system32\nvmccssr.dll2007-12-05 00:41	45,056	----a-w	C:\WINDOWS\system32\nvmccsrs.dll2007-12-05 00:41	442,368	----a-w	C:\WINDOWS\system32\nvappbar.exe2007-12-05 00:41	425,984	----a-w	C:\WINDOWS\system32\keystone.exe2007-12-05 00:41	385,024	----a-w	C:\WINDOWS\system32\nvapi.dll2007-12-05 00:41	35,328	----a-w	C:\WINDOWS\system32\nvcodins.dll2007-12-05 00:41	35,328	----a-w	C:\WINDOWS\system32\nvcod.dll2007-12-05 00:41	335,872	----a-w	C:\WINDOWS\system32\nvwrses.dll2007-12-05 00:41	335,872	----a-w	C:\WINDOWS\system32\nvwrsel.dll2007-12-05 00:41	327,680	----a-w	C:\WINDOWS\system32\nvwrsfr.dll2007-12-05 00:41	327,680	----a-w	C:\WINDOWS\system32\nvwrsesm.dll2007-12-05 00:41	327,680	----a-w	C:\WINDOWS\system32\nvrshe.dll2007-12-05 00:41	327,680	----a-w	C:\WINDOWS\system32\nvrsar.dll2007-12-05 00:41	323,584	----a-w	C:\WINDOWS\system32\nvwrspt.dll2007-12-05 00:41	323,584	----a-w	C:\WINDOWS\system32\nvwrsit.dll2007-12-05 00:41	319,488	----a-w	C:\WINDOWS\system32\nvwrsptb.dll2007-12-05 00:41	319,488	----a-w	C:\WINDOWS\system32\nvwrsnl.dll2007-12-05 00:41	315,392	----a-w	C:\WINDOWS\system32\nvwrsru.dll2007-12-05 00:41	315,392	----a-w	C:\WINDOWS\system32\nvwrshu.dll2007-12-05 00:41	311,296	----a-w	C:\WINDOWS\system32\nvwrsde.dll2007-12-05 00:41	303,104	----a-w	C:\WINDOWS\system32\nvwrstr.dll2007-12-05 00:41	303,104	----a-w	C:\WINDOWS\system32\nvwrssl.dll2007-12-05 00:41	303,104	----a-w	C:\WINDOWS\system32\nvwrsfi.dll2007-12-05 00:41	3,715,072	----a-w	C:\WINDOWS\system32\nvvitvsr.dll2007-12-05 00:41	3,710,976	----a-w	C:\WINDOWS\system32\nvvitvs.dll2007-12-05 00:41	3,420,160	----a-w	C:\WINDOWS\system32\nvgames.dll2007-12-05 00:41	3,334,144	----a-w	C:\WINDOWS\system32\nvgamesr.dll2007-12-05 00:41	299,008	----a-w	C:\WINDOWS\system32\nvwrssk.dll2007-12-05 00:41	299,008	----a-w	C:\WINDOWS\system32\nvwrsno.dll2007-12-05 00:41	294,912	----a-w	C:\WINDOWS\system32\nvwrssv.dll2007-12-05 00:41	294,912	----a-w	C:\WINDOWS\system32\nvwrspl.dll2007-12-05 00:41	294,912	----a-w	C:\WINDOWS\system32\nvwrsda.dll2007-12-05 00:41	290,816	----a-w	C:\WINDOWS\system32\nvwrsth.dll2007-12-05 00:41	286,720	----a-w	C:\WINDOWS\system32\nvwrseng.dll2007-12-05 00:41	286,720	----a-w	C:\WINDOWS\system32\nvwrscs.dll2007-12-05 00:41	286,720	----a-w	C:\WINDOWS\system32\nvnt4cpl.dll2007-12-05 00:41	282,624	----a-w	C:\WINDOWS\system32\nvwrsar.dll2007-12-05 00:41	282,624	----a-w	C:\WINDOWS\system32\nvrsfr.dll2007-12-05 00:41	282,624	----a-w	C:\WINDOWS\system32\nvrses.dll2007-12-05 00:41	282,624	----a-w	C:\WINDOWS\system32\nvrsel.dll2007-12-05 00:41	278,528	----a-w	C:\WINDOWS\system32\nvwrshe.dll2007-12-05 00:41	278,528	----a-w	C:\WINDOWS\system32\nvrsit.dll2007-12-05 00:41	278,528	----a-w	C:\WINDOWS\system32\nvrsde.dll2007-12-05 00:41	274,432	----a-w	C:\WINDOWS\system32\nvrspt.dll2007-12-05 00:41	274,432	----a-w	C:\WINDOWS\system32\nvrsnl.dll2007-12-05 00:41	274,432	----a-w	C:\WINDOWS\system32\nvrsesm.dll2007-12-05 00:41	270,336	----a-w	C:\WINDOWS\system32\nvrsru.dll2007-12-05 00:41	266,240	----a-w	C:\WINDOWS\system32\nvrsptb.dll2007-12-05 00:41	266,240	----a-w	C:\WINDOWS\system32\nvrsja.dll2007-12-05 00:41	258,048	----a-w	C:\WINDOWS\system32\nvrstr.dll2007-12-05 00:41	258,048	----a-w	C:\WINDOWS\system32\nvrssl.dll2007-12-05 00:41	258,048	----a-w	C:\WINDOWS\system32\nvrssk.dll2007-12-05 00:41	258,048	----a-w	C:\WINDOWS\system32\nvrsko.dll2007-12-05 00:41	258,048	----a-w	C:\WINDOWS\system32\nvrshu.dll2007-12-05 00:41	253,952	----a-w	C:\WINDOWS\system32\nvrsth.dll2007-12-05 00:41	253,952	----a-w	C:\WINDOWS\system32\nvrssv.dll2007-12-05 00:41	253,952	----a-w	C:\WINDOWS\system32\nvrspl.dll2007-12-05 00:41	253,952	----a-w	C:\WINDOWS\system32\nvrsno.dll2007-12-05 00:41	253,952	----a-w	C:\WINDOWS\system32\nvrsda.dll2007-12-05 00:41	249,856	----a-w	C:\WINDOWS\system32\nvrsfi.dll2007-12-05 00:41	249,856	----a-w	C:\WINDOWS\system32\nvrscs.dll2007-12-05 00:41	245,760	----a-w	C:\WINDOWS\system32\nvrseng.dll2007-12-05 00:41	229,376	----a-w	C:\WINDOWS\system32\nvmccs.dll2007-12-05 00:41	225,280	----a-w	C:\WINDOWS\system32\nvrszhc.dll2007-12-05 00:41	212,992	----a-w	C:\WINDOWS\system32\nvwrsja.dll2007-12-05 00:41	2,854,912	----a-w	C:\WINDOWS\system32\nvmoblsr.dll2007-12-05 00:41	2,519,040	----a-w	C:\WINDOWS\system32\nvwssr.dll2007-12-05 00:41	2,498,560	----a-w	C:\WINDOWS\system32\nvwss.dll2007-12-05 00:41	196,608	----a-w	C:\WINDOWS\system32\nvwrsko.dll2007-12-05 00:41	188,416	----a-w	C:\WINDOWS\system32\nvmccss.dll2007-12-05 00:41	167,936	----a-w	C:\WINDOWS\system32\nvwrszht.dll2007-12-05 00:41	163,840	----a-w	C:\WINDOWS\system32\nvwrszhc.dll2007-12-05 00:41	155,716	----a-w	C:\WINDOWS\system32\nvsvc32.exe2007-12-05 00:41	147,456	----a-w	C:\WINDOWS\system32\nvcolor.exe2007-12-05 00:41	126,976	----a-w	C:\WINDOWS\system32\nvrszht.dll.(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))..*Note* empty entries & legit default entries are not shown REGEDIT4[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-03 23:44 15360]"Creative Detector"="C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe" [2004-12-02 18:23 102400]"DAEMON Tools Pro Agent"="C:\Program Files\DAEMON Tools Pro\DTProAgent.exe" [2007-09-06 14:08 136136]"Gadu-Gadu"="C:\Program Files\Gadu-Gadu\gg.exe" [2007-11-14 11:54 2131392]"SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2007-08-31 16:46 1460560][HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-12-05 01:41 8523776]"nwiz"="nwiz.exe" [2007-12-05 01:41 1626112 C:\WINDOWS\system32\nwiz.exe]"RivaTunerStartupDaemon"="C:\Program Files\RivaTuner v2.06\RivaTuner.exe" [2007-10-30 19:05 2650112]"nod32kui"="C:\Program Files\Eset\nod32kui.exe" [2007-12-21 21:39 949376]"CTSysVol"="C:\Program Files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe" [2005-02-15 16:10 57344]"P17Helper"="P17.dll" [2005-05-03 12:38 64512 C:\WINDOWS\system32\P17.dll]"UpdReg"="C:\WINDOWS\UpdReg.EXE" [2000-05-11 01:00 90112]"SpeedTouch USB Diagnostics"="C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" [2004-01-26 11:38 866816]"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 11:50 155648]"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-12-05 01:41 81920][HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-03 23:44 15360]*Newly Created Service* - PROCEXP90 .**************************************************************************catchme 0.3.1333 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.netRootkit scan 2008-01-01 15:06:41Windows 5.1.2600 Dodatek Service Pack 2 NTFSscanning hidden processes ... scanning hidden autostart entries ...scanning hidden files ... scan completed successfully hidden files: 0 **************************************************************************.--------------------- DLLs Loaded Under Running Processes --------------------- PROCESS: C:\WINDOWS\system32\lsass.exe [5.01.2600.2180]-> C:\Program Files\Eset\pr_imon.dll.Completion time: 2008-01-01 15:06:50

Logfile of Trend Micro HijackThis v2.0.2Scan saved at 15:09:37, on 2008-01-01Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)Boot mode: NormalRunning processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32\spoolsv.exeC:\WINDOWS\system32\CTsvcCDA.EXEC:\Program Files\Common Files\LightScribe\LSSrvc.exeC:\Program Files\Eset\nod32krn.exeC:\WINDOWS\system32\nvsvc32.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32\wscntfy.exeC:\Program Files\Eset\nod32kui.exeC:\Program Files\Creative\SBAudigy\Surround Mixer\CTSysVol.exeC:\WINDOWS\system32\Rundll32.exeC:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exeC:\WINDOWS\system32\RUNDLL32.EXEC:\WINDOWS\system32\ctfmon.exeC:\Program Files\Creative\MediaSource\Detector\CTDetect.exeC:\Program Files\DAEMON Tools Pro\DTProAgent.exeC:\Program Files\Gadu-Gadu\gg.exeC:\Program Files\uTorrent\uTorrent.exeC:\Program Files\Internet Explorer\iexplore.exeC:\Program Files\Creative\SBAudigy\Surround Mixer\SurMixer.exeC:\WINDOWS\explorer.exeC:\Program Files\Internet Explorer\IEXPLORE.EXEC:\Program Files\Trend Micro\HijackThis\HijackThis.exeR0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.pl/R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = ŁączaO2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0 CE\Reader\ActiveX\AcroIEHelper.dllO2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dllO3 - Toolbar: (no name) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - (no file)O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartupO4 - HKLM\..\Run: [nwiz] nwiz.exe /installO4 - HKLM\..\Run: [RivaTunerStartupDaemon] "C:\Program Files\RivaTuner v2.06\RivaTuner.exe" /SO4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICEO4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe /rO4 - HKLM\..\Run: [P17Helper] Rundll32 P17.dll,P17HelperO4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXEO4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /iconO4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exeO4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInitO4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exeO4 - HKCU\..\Run: [Creative Detector] C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe /RO4 - HKCU\..\Run: [DAEMON Tools Pro Agent] "C:\Program Files\DAEMON Tools Pro\DTProAgent.exe"O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /trayO4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exeO4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA')O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA')O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dllO9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dllO9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exeO9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exeO17 - HKLM\System\CCS\Services\Tcpip\..\{AEDBF2FA-5387-46F2-9680-5E6C6A73088B}: NameServer = 194.204.152.34 217.98.63.164O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXEO23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exeO23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exeO23 - Service: NOD32 Kernel Service (NOD32krn) - Eset  - C:\Program Files\Eset\nod32krn.exeO23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe--End of file - 4772 bytes

edit: nie wiem czy dobrze zrobilem. jesli jest cos nie tak prosze o zwrocenie uwagi - poprawie sie 8O

Edytowane 1 Stycznia 2008 przez Mumin

[Kolobos]

Logi sa ok. W hijackthis usun tylko:

O3 - Toolbar: (no name) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - (no file)

[Mumin]

zrobione 8O. dzieki wielkie 8O proponuje pozostawic gdzies temat (inaczej: nie usuwac) bo z tego co widzialem to nie ma po poszukiwaniach w googlach jasnego i prostego sposobu pozbycia sie tego "syfa". rozwiazania sa, ale koncza sie w wiekszosci przypadkow niemoznoscia zalogowania do windowsa. jeszcze raz uklony i pozdrawiam.