Logi

[metyu]

Nie mogę uruchomić msconfig'a, ani w ogóle go znaleźć i zastanawiam się, czy to "sprawka" jakiegoś robaka.

 

» Naciśnij aby pokazać/ukryć tekst oznaczony jako spoiler « - "hijack"

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 01:19:03, on 2009-05-10

Platform: Windows XP Dodatek SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.5730.0013)

Boot mode: Normal

 

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Avira\AntiVir Desktop\sched.exe

C:\Program Files\Avira\AntiVir Desktop\avguard.exe

C:\WINDOWS\system32\PnkBstrA.exe

C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe

C:\Program Files\VIA\VIAudioi\HDADeck\HDeck.exe

C:\Program Files\Avira\AntiVir Desktop\avgnt.exe

C:\Program Files\Razer\DeathAdder\razerhid.exe

C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe

C:\Program Files\Razer\DeathAdder\razerofa.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\dllhost.exe

C:\WINDOWS\explorer.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\Documents and Settings\SysOp\Pulpit\HiJackThis.exe

 

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.pl/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.microsoft.com/fwlink/?LinkId=74005

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

O4 - HKLM\..\Run: [startCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun

O4 - HKLM\..\Run: [HDAudDeck] C:\Program Files\VIA\VIAudioi\HDADeck\HDeck.exe 1

O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min

O4 - HKLM\..\Run: [DeathAdder] C:\Program Files\Razer\DeathAdder\razerhid.exe

O4 - HKUS\S-1-5-18\..\RunOnce: [_nltide_2] regsvr32 /s /n /i:U shell32 (User 'SYSTEM')

O4 - HKUS\S-1-5-18\..\RunOnce: [_nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\RunOnce: [_nltide_2] regsvr32 /s /n /i:U shell32 (User 'Default user')

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O23 - Service: Usługa bramy warstwy aplikacji (ALG) - Unknown owner - C:\WINDOWS\System32\alg.exe (file missing)

O23 - Service: Avira AntiVir Scheduler (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe

O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe

O23 - Service: cisvc - Unknown owner - C:\WINDOWS\system32\cisvc.exe (file missing)

O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe

 

--

End of file - 3418 bytes

» Naciśnij aby pokazać/ukryć tekst oznaczony jako spoiler « - "combofix"

ComboFix 09-05-08.03 - SysOp 2009-05-10 1:14.1 - NTFSx86

Microsoft Windows XP Professional 5.1.2600.3.1250.48.1045.18.1791.1194 [GMT 2:00]

Uruchomiony z: c:\documents and settings\SysOp\Pulpit\ComboFix.exe

 

UWAGA - TEN KOMPUTER NIE MA ZAINSTALOWANEJ KONSOLI ODZYSKIWANIA !!

.

 

((((((((((((((((((((((((( Pliki utworzone od 2009-04-09 do 2009-05-09 )))))))))))))))))))))))))))))))

.

 

2009-05-09 22:59 . 2009-05-09 22:59 -------- d-----w c:\program files\Avira GmbH

2009-05-09 20:11 . 2009-05-09 20:11 -------- d-----w c:\documents and settings\SysOp\Dane aplikacji\Media Player Classic

2009-05-09 18:22 . 2009-05-09 18:22 -------- d-----w c:\program files\XP Codec Pack

2009-05-09 10:14 . 2008-04-14 18:35 1845888 ----a-w c:\windows\system32\dllcache\win32k.sys

2009-04-30 17:57 . 2009-04-30 17:57 -------- d-----w c:\program files\Razer

2009-04-29 17:18 . 2009-04-29 17:58 -------- d-----w c:\program files\EditCFG

2009-04-29 14:03 . 2009-04-29 14:03 -------- d-----w c:\documents and settings\SysOp\Dane aplikacji\Gadu-Gadu

2009-04-29 14:00 . 2009-04-29 14:03 -------- d-----w c:\documents and settings\SysOp\Gadu-Gadu

2009-04-29 14:00 . 2009-04-29 14:00 -------- d-----w c:\program files\Gadu-Gadu

2009-04-28 23:09 . 2001-08-17 20:59 3072 ----a-w c:\windows\system32\drivers\audstub.sys

2009-04-28 23:07 . 2008-04-14 20:35 58880 ----a-w c:\windows\system32\drivers\redbook.sys

2009-04-28 23:07 . 2001-08-17 20:51 19584 ----a-w c:\windows\system32\drivers\rasirda.sys

2009-04-28 23:07 . 2008-04-14 21:51 8192 ----a-w c:\windows\system32\wshirda.dll

2009-04-28 23:07 . 2008-04-14 21:50 28672 ----a-w c:\windows\system32\irmon.dll

2009-04-28 23:07 . 2008-04-14 21:51 152064 ----a-w c:\windows\system32\irftp.exe

2009-04-28 23:07 . 2008-04-13 23:24 88192 ----a-w c:\windows\system32\drivers\irda.sys

2009-04-28 23:07 . 2001-08-17 20:51 18688 ----a-w c:\windows\system32\drivers\irsir.sys

2009-04-28 23:07 . 2008-04-14 21:50 77312 ----a-w c:\windows\system32\usbui.dll

2009-04-28 23:06 . 2008-04-13 23:06 8832 ----a-w c:\windows\system32\drivers\wmiacpi.sys

2009-04-28 23:06 . 2009-05-03 21:16 -------- d-sh--w c:\windows\Installer

2009-04-28 23:03 . 2009-04-28 21:19 -------- d-----w c:\windows\system32\CatRoot

2009-04-28 23:03 . 2009-05-09 23:13 -------- d-----w c:\windows\system32\CatRoot2

2009-04-28 23:03 . 2009-04-28 23:05 -------- d--h--r c:\documents and settings\Default User\Dane aplikacji

2009-04-28 23:02 . 2009-04-28 22:00 -------- d--h--r c:\documents and settings\All Users\Dane aplikacji

2009-04-28 23:02 . 2009-04-28 21:14 -------- d-----w c:\documents and settings\All Users

2009-04-28 23:02 . 2009-04-28 21:16 -------- d--h--w c:\documents and settings\Default User

2009-04-28 23:02 . 2009-04-28 21:17 -------- d-----w C:\Documents and Settings

 

.

(((((((((((((((((((((((((((((((((((((((( Sekcja Find3M ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2009-05-09 23:03 . 2009-04-28 21:22 -------- d--h--w c:\program files\InstallShield Installation Information

2009-05-09 22:47 . 2001-10-26 17:15 72840 ----a-w c:\windows\system32\perfc015.dat

2009-05-09 22:47 . 2001-10-26 17:15 445618 ----a-w c:\windows\system32\perfh015.dat

2009-05-09 22:08 . 2009-04-28 21:45 138944 ----a-w c:\windows\system32\drivers\PnkBstrK.sys

2009-05-09 22:08 . 2009-04-28 21:45 189784 ----a-w c:\windows\system32\PnkBstrB.exe

2009-05-03 21:16 . 2009-04-28 21:31 -------- d-----w c:\program files\Common Files\Adobe

2009-04-28 23:31 . 2009-04-28 21:45 75064 ----a-w c:\windows\system32\PnkBstrA.exe

2009-04-28 22:18 . 2009-04-28 22:17 -------- d-----w c:\program files\Winamp

2009-04-28 22:06 . 2009-04-28 21:47 55640 ----a-w c:\windows\system32\drivers\avgntflt.sys

2009-04-28 22:00 . 2009-04-28 22:00 12784 ----a-w c:\documents and settings\SysOp\Ustawienia lokalne\Dane aplikacji\GDIPFONTCACHEV1.DAT

2009-04-28 21:59 . 2009-04-28 21:59 0 ----a-w c:\windows\ativpsrm.bin

2009-04-28 21:47 . 2009-04-28 21:47 -------- d-----w c:\program files\Avira

2009-04-28 21:45 . 2009-04-28 21:45 22328 ----a-w c:\documents and settings\SysOp\Dane aplikacji\PnkBstrK.sys

2009-04-28 21:45 . 2009-04-28 21:45 2246144 ----a-w c:\windows\system32\pbsvc.exe

2009-04-28 21:41 . 2009-04-28 21:41 0 ----a-w c:\windows\nsreg.dat

2009-04-28 21:38 . 2009-04-28 21:38 -------- d-----w c:\program files\DIFX

2009-04-28 21:30 . 2009-04-28 21:30 -------- d-----w c:\program files\AMD

2009-04-28 21:29 . 2009-04-28 21:29 -------- d-----w c:\program files\Realtek

2009-04-28 21:28 . 2009-04-28 21:27 -------- d-----w c:\program files\VIA

2009-04-28 21:27 . 2009-04-28 21:22 -------- d-----w c:\program files\Common Files\InstallShield

2009-04-28 21:27 . 2009-04-28 21:22 -------- d-----w c:\program files\ATI Technologies

2009-04-28 21:14 . 2001-07-21 23:36 67 --sha-w c:\windows\Fonts\desktop.ini

2009-04-28 21:11 . 2009-04-28 21:11 21856 ----a-w c:\windows\system32\emptyregdb.dat

2009-04-28 21:11 . 2009-04-28 21:11 -------- d-----w c:\program files\Windows Media Connect 2

.

 

------- Sigcheck -------

 

[-] 2007-07-11 04:06 642560 CE594E18FE0D0AF804F1F3694921CE62 c:\windows\system32\user32.dll

 

[-] 2008-12-03 17:16 920064 88348F8C92C28BA99FE49BD392100CE0 c:\windows\system32\wininet.dll

 

[-] 2008-12-03 16:39 361344 030DC4D48CC2B894FEE2F390D8E66AD5 c:\windows\system32\drivers\tcpip.sys

 

[-] 2008-12-03 17:15 549888 335813EACD16E84F3047A3326F6E5473 c:\windows\system32\winlogon.exe

 

[-] 2008-12-03 17:26 2027520 F95FE6AB1581F3CB95FB2F1A2A38EE86 c:\windows\system32\ntkrnlpa.exe

 

[-] 2008-12-03 16:13 2148864 4D753509A2856CCCEB1A6DAB994BCB6D c:\windows\system32\ntoskrnl.exe

 

[-] 2008-12-03 17:14 1553408 BDA7A4169BF5E1F3EE76B017396E4F47 c:\windows\explorer.exe

 

[-] 2008-12-03 17:15 112128 37ED43F3DEC4400586554D61C3129478 c:\windows\system32\wuauclt.exe

.

((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru ))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane

REGEDIT4

[Kolobos]

Jakis obciety ten log. Wypakuj msconfig z plyty lub nawet sciagnij z netu i przegraj do:

C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe

[metyu]

Nie skopiowałem całego, tutaj log