proszę o sprawdzenie - zawieszanie przy starcie

[Pawel_x18]

Problem polega na tym iż przy włączeniu i po ekranie ZAPRASZAMY następuje ładowanie wszystkich programów tray itd.. i nagle zawieszenie ... i tak ze 3 razy res.. i dopiero normalnie wczytuje...
proszę o sprawdzenie:

Kod: Zaznacz wszystko

Logfile of HijackThis v1.99.1
Scan saved at 11:10:11, on 2007-07-03
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16473)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Creative\Sound Blaster X-Fi\Volume Panel\VolPanlu.exe
C:\WINDOWS\system32\Rundll32.exe
C:\Program Files\Razer\Copperhead\razerhid.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe
C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
C:\Program Files\- Programy systemowe -\DU Meter\DUMeter.exe
C:\WINDOWS\system32\ctfmon.exe
E:\Programy\Speedx\SpeedX.exe
C:\PROGRA~1\-PROGR~1\AQQ\AQQ.exe
C:\Program Files\- Programy systemowe -\Internet Download Manager\IDMan.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\PSIService.exe
C:\Program Files\- Programy systemowe -\Alcohol 120\StarWind\StarWindService.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Razer\Copperhead\razertra.exe
C:\Program Files\Razer\Copperhead\razerofa.exe
C:\Program Files\- Programy systemowe -\Internet Download Manager\IEMonitor.exe
C:\Program Files\Winamp\winamp.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
D:\- Gry -\Steam\Steam.exe
C:\Program Files\- Programy systemowe -\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.onet.pl/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Program Files\- Programy systemowe -\Internet Download Manager\IDMIECC.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: FlashFXP Helper for Internet Explorer - {E5A1691B-D188-4419-AD02-90002030B8EE} - C:\PROGRA~1\-PROGR~1\FlashFXP\IEFlash.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O4 - HKLM\..\Run: [GBB36X Configure] C:\WINDOWS\system32\JMRaidTool.exe boot
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [VolPanel] "C:\Program Files\Creative\Sound Blaster X-Fi\Volume Panel\VolPanlu.exe" /r
O4 - HKLM\..\Run: [P17Helper] Rundll32 SPIRun.dll,RunDLLEntry
O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Copperhead] C:\Program Files\Razer\Copperhead\razerhid.exe
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [DU Meter] C:\Program Files\- Programy systemowe -\DU Meter\DUMeter.exe
O4 - HKLM\..\Run: [Sony Ericsson PC Suite] "C:\Program Files\- Programy systemowe -\Sony Ericsson PC\Application Launcher\Application Launcher.exe" /startoptions
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SpeedX] E:\Programy\Speedx\SpeedX.exe
O4 - HKCU\..\Run: [AQQ] C:\PROGRA~1\-PROGR~1\AQQ\AQQ.exe
O4 - HKCU\..\Run: [IDMan] C:\Program Files\- Programy systemowe -\Internet Download Manager\IDMan.exe /onboot
O8 - Extra context menu item: Download All Links with IDM - C:\Program Files\- Programy systemowe -\Internet Download Manager\IEGetAll.htm
O8 - Extra context menu item: Download with IDM - C:\Program Files\- Programy systemowe -\Internet Download Manager\IEExt.htm
O8 - Extra context menu item: E&ksportuj do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Easy-WebPrint Add To Print List - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint High Speed Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Preview - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
O8 - Extra context menu item: Easy-WebPrint Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: Statystyki ochrony WWW - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\scieplugin.dll
O9 - Extra button: Wyślij do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Wyślij &do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C1} (GameDesire Pool 8) - http://67.15.101.3/g_bin/pl/billard8_2_0_0_34.cab
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
O20 - Winlogon Notify: imjpcic - C:\WINDOWS\SYSTEM32\imjpcic5.dll
O20 - Winlogon Notify: klogon - C:\WINDOWS\system32\klogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Kaspersky Anti-Virus 6.0 (AVP) - Unknown owner - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe" -r (file missing)
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: ProtexisLicensing - Unknown owner - C:\WINDOWS\system32\PSIService.exe
O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\- Programy systemowe -\Alcohol 120\StarWind\StarWindService.exe



[wojtas]

skasuj wpis + pogrubiony:

O20 - Winlogon Notify: imjpcic - C:\WINDOWS\SYSTEM32\imjpcic5.dll

Start>uruchom>msconfig>zakladka uruchamianie> wylacz progsy które nie chcesz żeby startowaly z systemem przyspieszy Ci to wlaczanie kompa

potem nowy log z hijacka i combofixa:

http://download.bleepingcomputer.com/sUBs/ComboFix.exe

[Pawel_x18]

Kod: Zaznacz wszystko

Logfile of HijackThis v1.99.1
Scan saved at 12:14:44, on 2007-07-03
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16473)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Creative\Sound Blaster X-Fi\Volume Panel\VolPanlu.exe
C:\WINDOWS\system32\Rundll32.exe
C:\Program Files\Razer\Copperhead\razerhid.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe
C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
C:\Program Files\- Programy systemowe -\DU Meter\DUMeter.exe
C:\WINDOWS\system32\ctfmon.exe
E:\Programy\Speedx\SpeedX.exe
C:\PROGRA~1\-PROGR~1\AQQ\AQQ.exe
C:\Program Files\- Programy systemowe -\Internet Download Manager\IDMan.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\PSIService.exe
C:\Program Files\- Programy systemowe -\Alcohol 120\StarWind\StarWindService.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Razer\Copperhead\razertra.exe
C:\Program Files\Razer\Copperhead\razerofa.exe
C:\Program Files\- Programy systemowe -\Internet Download Manager\IEMonitor.exe
C:\Program Files\Winamp\winamp.exe
D:\- Gry -\Steam\Steam.exe
E:\Programy\Gamma control\gammacontrol.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\- Programy systemowe -\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.onet.pl/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Program Files\- Programy systemowe -\Internet Download Manager\IDMIECC.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: FlashFXP Helper for Internet Explorer - {E5A1691B-D188-4419-AD02-90002030B8EE} - C:\PROGRA~1\-PROGR~1\FlashFXP\IEFlash.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O4 - HKLM\..\Run: [GBB36X Configure] C:\WINDOWS\system32\JMRaidTool.exe boot
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [VolPanel] "C:\Program Files\Creative\Sound Blaster X-Fi\Volume Panel\VolPanlu.exe" /r
O4 - HKLM\..\Run: [P17Helper] Rundll32 SPIRun.dll,RunDLLEntry
O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Copperhead] C:\Program Files\Razer\Copperhead\razerhid.exe
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [DU Meter] C:\Program Files\- Programy systemowe -\DU Meter\DUMeter.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SpeedX] E:\Programy\Speedx\SpeedX.exe
O4 - HKCU\..\Run: [AQQ] C:\PROGRA~1\-PROGR~1\AQQ\AQQ.exe
O4 - HKCU\..\Run: [IDMan] C:\Program Files\- Programy systemowe -\Internet Download Manager\IDMan.exe /onboot
O8 - Extra context menu item: Download All Links with IDM - C:\Program Files\- Programy systemowe -\Internet Download Manager\IEGetAll.htm
O8 - Extra context menu item: Download with IDM - C:\Program Files\- Programy systemowe -\Internet Download Manager\IEExt.htm
O8 - Extra context menu item: E&ksportuj do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Easy-WebPrint Add To Print List - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint High Speed Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Preview - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
O8 - Extra context menu item: Easy-WebPrint Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: Statystyki ochrony WWW - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\scieplugin.dll
O9 - Extra button: Wyślij do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Wyślij &do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C1} (GameDesire Pool 8) - http://67.15.101.3/g_bin/pl/billard8_2_0_0_34.cab
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
O20 - Winlogon Notify: klogon - C:\WINDOWS\system32\klogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Kaspersky Anti-Virus 6.0 (AVP) - Unknown owner - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe" -r (file missing)
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: ProtexisLicensing - Unknown owner - C:\WINDOWS\system32\PSIService.exe
O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\- Programy systemowe -\Alcohol 120\StarWind\StarWindService.exe



"Paweˆ Jaworski" - 2007-07-03 12:16:28 - ComboFix 07-07-03.8 - Dodatek Service Pack 2


((((((((((((((((((((((((( Files Created from 2007-06-03 to 2007-07-03 )))))))))))))))))))))))))))))))


2007-07-03 12:16 51,200 --a------ C:\WINDOWS\nircmd.exe
2007-07-03 12:14 <DIR> d-------- C:\WINDOWS\pss
2007-06-29 13:59 4 --a------ C:\WINDOWS\system32\proc-1037709799.bin
2007-06-29 13:59 <DIR> d-------- C:\DOCUME~1\PAWEJA~1\DANEAP~1\GanymedeNet
2007-06-25 14:18 <DIR> d-------- C:\DOCUME~1\PAWEJA~1\DANEAP~1\eSkiMoS R2
2007-06-24 20:03 32,592 --a------ C:\WINDOWS\system32\msonpmon.dll
2007-06-24 20:02 <DIR> d--h----- C:\Program Files\Microsoft Works
2007-06-24 20:01 <DIR> d--h----- C:\Program Files\Microsoft.NET
2007-06-24 19:59 <DIR> d--h----- C:\Program Files\Microsoft Visual Studio 8
2007-06-24 19:58 <DIR> d-------- C:\WINDOWS\SHELLNEW
2007-06-24 19:58 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\Microsoft Help
2007-06-24 19:57 <DIR> dr-h----- C:\MSOCache
2007-06-22 15:38 <DIR> d-------- C:\Program Files\Common Files\Teleca Shared
2007-06-22 15:38 <DIR> d-------- C:\DOCUME~1\PAWEJA~1\DANEAP~1\Teleca
2007-06-22 15:38 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\Documents
2007-06-22 15:38 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\Teleca
2007-06-22 15:38 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\Sony Ericsson
2007-06-22 15:36 <DIR> d----c--- C:\WINDOWS\system32\DRVSTORE
2007-06-22 15:35 6,176 --a------ C:\WINDOWS\system32\drivers\w810cm.sys
2007-06-22 15:35 5,808 --a------ C:\WINDOWS\system32\drivers\w810wh.sys
2007-06-22 11:44 <DIR> d-------- C:\DOCUME~1\PAWEJA~1\DANEAP~1\Lavasoft
2007-06-22 11:40 <DIR> d-------- C:\WINDOWS\XP Codec Pack
2007-06-22 07:20 8 --a------ C:\WINDOWS\system32\b4b38fdb.dat
2007-06-21 21:25 <DIR> d--h----- C:\Program Files\AliveMedia
2007-06-21 10:43 <DIR> d--h----- C:\Program Files\MSBuild
2007-06-21 10:37 <DIR> d-------- C:\WINDOWS\system32\XPSViewer
2007-06-21 10:36 14,048 --------- C:\WINDOWS\system32\spmsg2.dll
2007-06-21 10:36 <DIR> d--h----- C:\Program Files\Reference Assemblies
2007-06-21 10:26 719,872 --a------ C:\WINDOWS\system32\devil.dll
2007-06-21 10:26 70,656 --a------ C:\WINDOWS\system32\yv12vfw.dll
2007-06-21 10:26 70,656 --a------ C:\WINDOWS\system32\i420vfw.dll
2007-06-21 10:26 66,560 --a------ C:\WINDOWS\MOTA113.exe
2007-06-21 10:26 502,784 --a------ C:\WINDOWS\x2.64.exe
2007-06-21 10:26 471,552 --a------ C:\WINDOWS\system32\Smab.dll
2007-06-21 10:26 306,688 --a------ C:\WINDOWS\system32\avisynth.dll
2007-06-21 10:26 27,648 --a------ C:\WINDOWS\system32\AVSredirect.dll
2007-06-21 10:26 240,128 --a------ C:\WINDOWS\system32\x.264.exe
2007-06-21 10:26 217,073 --a------ C:\WINDOWS\meta4.exe
2007-06-21 10:26 <DIR> d--h----- C:\Program Files\AviSynth 2.5
2007-06-21 10:12 159,744 --a------ C:\WINDOWS\system32\la-core.dll
2007-06-20 19:32 1,047,552 --a------ C:\WINDOWS\system32\mfc71u.dll
2007-06-20 16:24 <DIR> d-------- C:\DOCUME~1\PAWEJA~1\DANEAP~1\AntsSoft
2007-06-20 15:29 <DIR> d-------- C:\DOCUME~1\PAWEJA~1\DANEAP~1\Google
2007-06-20 13:07 4,682 --a------ C:\WINDOWS\system32\npptNT2.sys
2007-06-20 10:41 <DIR> d-------- C:\DOCUME~1\PAWEJA~1\DANEAP~1\teamspeak2
2007-06-20 09:05 <DIR> d-------- C:\Program Files\Common Files\Blizzard Entertainment
2007-06-19 19:31 <DIR> d-------- C:\DOCUME~1\PAWEJA~1\DANEAP~1\WinRAR
2007-06-19 18:57 <DIR> d--h----- C:\Program Files\MSXML 4.0
2007-06-19 16:27 <DIR> d-------- C:\WINDOWS\system32\PreInstall
2007-06-19 16:12 <DIR> d-------- C:\WINDOWS\system32\SoftwareDistribution
2007-06-19 16:08 <DIR> d-------- C:\DOCUME~1\PAWEJA~1\DANEAP~1\uTorrent
2007-06-19 15:58 <DIR> d-------- C:\WINDOWS\CS II
2007-06-19 15:58 <DIR> d-------- C:\Program Files\Common Files\SRS
2007-06-19 15:58 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\SRSLabs
2007-06-19 15:47 <DIR> d-------- C:\WINDOWS\system32\appmgmt
2007-06-19 15:34 <DIR> d-------- C:\WINDOWS\system32\LogFiles
2007-06-19 15:33 <DIR> d-------- C:\WINDOWS\system32\drivers\umdf
2007-06-19 14:46 <DIR> d--h----- C:\Program Files\Canon
2007-06-19 14:43 25,856 --a------ C:\WINDOWS\system32\drivers\usbprint.sys
2007-06-19 14:42 73,728 --------- C:\WINDOWS\system32\CNMCP5i.exe
2007-06-19 14:42 6,656 --a------ C:\WINDOWS\system32\CNMVS5i.DLL
2007-06-19 14:42 105,984 --a------ C:\WINDOWS\system32\CNMLM5i.DLL
2007-06-19 14:42 <DIR> d--h----- C:\BJPrinter
2007-06-19 14:42 <DIR> d-------- C:\WINDOWS\StartHtmico
2007-06-19 14:42 <DIR> d-------- C:\WINDOWS\I455
2007-06-19 13:45 <DIR> d-------- C:\DOCUME~1\PAWEJA~1\DANEAP~1\Canon
2007-06-19 13:44 15,104 --a------ C:\WINDOWS\system32\drivers\usbscan.sys
2007-06-19 13:41 389,180 --a------ C:\WINDOWS\system32\UCS32P.DLL
2007-06-19 13:41 36,864 --a------ C:\WINDOWS\system32\CNQU70.DLL
2007-06-19 13:41 339,968 --a------ C:\WINDOWS\system32\N067UFW.DLL
2007-06-19 13:41 <DIR> d--h----- C:\CanoScan
2007-06-19 12:23 <DIR> d-------- C:\DOCUME~1\PAWEJA~1\DANEAP~1\IDM
2007-06-19 12:23 <DIR> d-------- C:\DOCUME~1\PAWEJA~1\DANEAP~1\DMCache
2007-06-19 12:02 <DIR> d-------- C:\DOCUME~1\PAWEJA~1\DANEAP~1\Skype
2007-06-19 11:58 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\Skype
2007-06-19 11:56 <DIR> d-------- C:\DOCUME~1\PAWEJA~1\DANEAP~1\Gadu-Gadu
2007-06-19 11:56 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\Hagel Technologies
2007-06-19 11:55 <DIR> d-------- C:\DOCUME~1\PAWEJA~1\Gadu-Gadu
2007-06-19 11:47 <DIR> d-------- C:\WINDOWS\system32\pl-pl
2007-06-19 11:45 23,856 --a------ C:\WINDOWS\system32\spupdsvc.exe
2007-06-19 11:44 <DIR> d--h----- C:\WINDOWS\$hf_mig$
2007-06-19 11:44 <DIR> d-------- C:\DOCUME~1\PAWEJA~1\WapSter
2007-06-19 11:44 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\Windows Genuine Advantage
2007-06-19 11:42 <DIR> d--hs---- C:\DOCUME~1\PAWEJA~1\UserData
2007-06-19 07:42 <DIR> d-------- C:\WINDOWS\Real Alternative
2007-06-19 07:42 <DIR> d-------- C:\DOCUME~1\PAWEJA~1\DANEAP~1\Real
2007-06-19 07:42 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\Real
2007-06-19 07:38 <DIR> d-------- C:\DOCUME~1\PAWEJA~1\DANEAP~1\Corel
2007-06-19 07:38 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\Corel
2007-06-19 07:37 88 -r-hs---- C:\WINDOWS\system32\F44AA315AB.sys
2007-06-19 07:37 476,752 --a------ C:\DOCUME~1\ALLUSE~1\DANEAP~1\pswi_preloaded.exe
2007-06-19 07:37 2,516 --ahs---- C:\WINDOWS\system32\KGyGaAvL.sys
2007-06-19 07:37 <DIR> d-------- C:\Program Files\Common Files\Corel
2007-06-18 17:58 221,184 --a------ C:\WINDOWS\system32\wmpns.dll
2007-06-18 17:54 <DIR> d--h----- C:\Program Files\Nero
2007-06-18 17:54 <DIR> d-------- C:\Program Files\Common Files\Ahead
2007-06-18 17:54 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\Nero
2007-06-18 17:53 <DIR> d-------- C:\WINDOWS\RegisteredPackages
2007-06-18 17:48 <DIR> d-------- C:\WINDOWS\Programy
2007-06-18 17:39 <DIR> d-------- C:\Program Files\Common Files\ACD Systems


(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-07-03 09:09:59 -------- d-----w C:\Program Files\- Programy systemowe -
2007-06-25 13:12:09 83,438 ----a-w C:\WINDOWS\system32\perfc015.dat
2007-06-25 13:12:09 488,334 ----a-w C:\WINDOWS\system32\perfh015.dat
2007-06-17 18:41:26 -------- d--h--w C:\Program Files\Usługi online
2007-04-25 14:23:30 144,896 ----a-w C:\WINDOWS\system32\schannel.dll
2007-04-19 11:26:00 888,832 ----a-w C:\WINDOWS\system32\nvmobls.dll
2007-04-19 11:26:00 86,016 ----a-w C:\WINDOWS\system32\nvmctray.dll
2007-04-19 11:26:00 81,920 ----a-w C:\WINDOWS\system32\nvwddi.dll
2007-04-19 11:26:00 7,700,480 ----a-w C:\WINDOWS\system32\nvcpl.dll
2007-04-19 11:26:00 581,632 ----a-w C:\WINDOWS\system32\nvhwvid.dll
2007-04-19 11:26:00 5,644,288 ----a-w C:\WINDOWS\system32\nvoglnt.dll
2007-04-19 11:26:00 5,619,712 ----a-w C:\WINDOWS\system32\nvdisps.dll
2007-04-19 11:26:00 5,255,168 ----a-w C:\WINDOWS\system32\nvdispsr.dll
2007-04-19 11:26:00 466,944 ----a-w C:\WINDOWS\system32\nvshell.dll
2007-04-19 11:26:00 458,752 ----a-w C:\WINDOWS\system32\nvmccssr.dll
2007-04-19 11:26:00 45,056 ----a-w C:\WINDOWS\system32\nvmccsrs.dll
2007-04-19 11:26:00 442,368 ----a-w C:\WINDOWS\system32\nvappbar.exe
2007-04-19 11:26:00 425,984 ----a-w C:\WINDOWS\system32\keystone.exe
2007-04-19 11:26:00 4,543,616 ----a-w C:\WINDOWS\system32\nv4_disp.dll
2007-04-19 11:26:00 35,840 ----a-w C:\WINDOWS\system32\nvcodins.dll
2007-04-19 11:26:00 35,840 ----a-w C:\WINDOWS\system32\nvcod.dll
2007-04-19 11:26:00 335,872 ----a-w C:\WINDOWS\system32\nvwrses.dll
2007-04-19 11:26:00 335,872 ----a-w C:\WINDOWS\system32\nvwrsel.dll
2007-04-19 11:26:00 327,680 ----a-w C:\WINDOWS\system32\nvwrsfr.dll
2007-04-19 11:26:00 327,680 ----a-w C:\WINDOWS\system32\nvwrsesm.dll
2007-04-19 11:26:00 323,584 ----a-w C:\WINDOWS\system32\nvwrspt.dll
2007-04-19 11:26:00 323,584 ----a-w C:\WINDOWS\system32\nvwrsit.dll
2007-04-19 11:26:00 323,584 ----a-w C:\WINDOWS\system32\nvrshe.dll
2007-04-19 11:26:00 323,584 ----a-w C:\WINDOWS\system32\nvrsar.dll
2007-04-19 11:26:00 319,488 ----a-w C:\WINDOWS\system32\nvwrsptb.dll
2007-04-19 11:26:00 319,488 ----a-w C:\WINDOWS\system32\nvwrsnl.dll
2007-04-19 11:26:00 315,392 ----a-w C:\WINDOWS\system32\nvwrsru.dll
2007-04-19 11:26:00 315,392 ----a-w C:\WINDOWS\system32\nvwrshu.dll
2007-04-19 11:26:00 311,296 ----a-w C:\WINDOWS\system32\nvwrsde.dll
2007-04-19 11:26:00 303,104 ----a-w C:\WINDOWS\system32\nvwrstr.dll
2007-04-19 11:26:00 303,104 ----a-w C:\WINDOWS\system32\nvwrssl.dll
2007-04-19 11:26:00 303,104 ----a-w C:\WINDOWS\system32\nvwrsfi.dll
2007-04-19 11:26:00 3,203,072 ----a-w C:\WINDOWS\system32\nvgamesr.dll
2007-04-19 11:26:00 3,035,136 ----a-w C:\WINDOWS\system32\nvgames.dll
2007-04-19 11:26:00 299,008 ----a-w C:\WINDOWS\system32\nvwrssk.dll
2007-04-19 11:26:00 299,008 ----a-w C:\WINDOWS\system32\nvwrsno.dll
2007-04-19 11:26:00 294,912 ----a-w C:\WINDOWS\system32\nvwrssv.dll
2007-04-19 11:26:00 294,912 ----a-w C:\WINDOWS\system32\nvwrspl.dll
2007-04-19 11:26:00 294,912 ----a-w C:\WINDOWS\system32\nvwrsda.dll
2007-04-19 11:26:00 286,720 ----a-w C:\WINDOWS\system32\nvwrseng.dll
2007-04-19 11:26:00 286,720 ----a-w C:\WINDOWS\system32\nvwrscs.dll
2007-04-19 11:26:00 286,720 ----a-w C:\WINDOWS\system32\nvnt4cpl.dll
2007-04-19 11:26:00 282,624 ----a-w C:\WINDOWS\system32\nvwrsar.dll
2007-04-19 11:26:00 278,528 ----a-w C:\WINDOWS\system32\nvwrshe.dll
2007-04-19 11:26:00 278,528 ----a-w C:\WINDOWS\system32\nvrsfr.dll
2007-04-19 11:26:00 274,432 ----a-w C:\WINDOWS\system32\nvrsit.dll
2007-04-19 11:26:00 274,432 ----a-w C:\WINDOWS\system32\nvrses.dll
2007-04-19 11:26:00 274,432 ----a-w C:\WINDOWS\system32\nvrsel.dll
2007-04-19 11:26:00 270,336 ----a-w C:\WINDOWS\system32\nvrsde.dll
2007-04-19 11:26:00 266,240 ----a-w C:\WINDOWS\system32\nvrspt.dll
2007-04-19 11:26:00 266,240 ----a-w C:\WINDOWS\system32\nvrsnl.dll
2007-04-19 11:26:00 266,240 ----a-w C:\WINDOWS\system32\nvrsesm.dll
2007-04-19 11:26:00 262,144 ----a-w C:\WINDOWS\system32\nvrsru.dll
2007-04-19 11:26:00 262,144 ----a-w C:\WINDOWS\system32\nvrsptb.dll
2007-04-19 11:26:00 262,144 ----a-w C:\WINDOWS\system32\nvrsja.dll
2007-04-19 11:26:00 258,048 ----a-w C:\WINDOWS\system32\nvrsko.dll
2007-04-19 11:26:00 253,952 ----a-w C:\WINDOWS\system32\nvrshu.dll
2007-04-19 11:26:00 249,856 ----a-w C:\WINDOWS\system32\nvrstr.dll
2007-04-19 11:26:00 249,856 ----a-w C:\WINDOWS\system32\nvrssl.dll
2007-04-19 11:26:00 249,856 ----a-w C:\WINDOWS\system32\nvrssk.dll
2007-04-19 11:26:00 249,856 ----a-w C:\WINDOWS\system32\nvrspl.dll
2007-04-19 11:26:00 249,856 ----a-w C:\WINDOWS\system32\nvrsno.dll
2007-04-19 11:26:00 245,760 ----a-w C:\WINDOWS\system32\nvrssv.dll
2007-04-19 11:26:00 245,760 ----a-w C:\WINDOWS\system32\nvrsda.dll
2007-04-19 11:26:00 241,664 ----a-w C:\WINDOWS\system32\nvrsfi.dll
2007-04-19 11:26:00 241,664 ----a-w C:\WINDOWS\system32\nvrseng.dll
2007-04-19 11:26:00 241,664 ----a-w C:\WINDOWS\system32\nvrscs.dll
2007-04-19 11:26:00 229,376 ----a-w C:\WINDOWS\system32\nvmccs.dll
2007-04-19 11:26:00 221,184 ----a-w C:\WINDOWS\system32\nvrszhc.dll
2007-04-19 11:26:00 212,992 ----a-w C:\WINDOWS\system32\nvwrsja.dll
2007-04-19 11:26:00 212,992 ----a-w C:\WINDOWS\system32\nvapi.dll
2007-04-19 11:26:00 2,973,696 ----a-w C:\WINDOWS\system32\nvvitvsr.dll
2007-04-19 11:26:00 2,924,544 ----a-w C:\WINDOWS\system32\nvvitvs.dll
2007-04-19 11:26:00 2,859,008 ----a-w C:\WINDOWS\system32\nvmoblsr.dll
2007-04-19 11:26:00 196,608 ----a-w C:\WINDOWS\system32\nvwrsko.dll
2007-04-19 11:26:00 188,416 ----a-w C:\WINDOWS\system32\nvmccss.dll
2007-04-19 11:26:00 167,936 ----a-w C:\WINDOWS\system32\nvwrszht.dll
2007-04-19 11:26:00 163,840 ----a-w C:\WINDOWS\system32\nvwrszhc.dll
2007-04-19 11:26:00 159,810 ----a-w C:\WINDOWS\system32\nvsvc32.exe
2007-04-19 11:26:00 147,456 ----a-w C:\WINDOWS\system32\nvcolor.exe
2007-04-19 11:26:00 118,784 ----a-w C:\WINDOWS\system32\nvrszht.dll
2007-04-19 11:26:00 1,732,608 ----a-w C:\WINDOWS\system32\nvwssr.dll
2007-04-19 11:26:00 1,703,936 ----a-w C:\WINDOWS\system32\nvwdmcpl.dll
2007-04-19 11:26:00 1,626,112 ----a-w C:\WINDOWS\system32\nwiz.exe
2007-04-19 11:26:00 1,474,560 ----a-w C:\WINDOWS\system32\nview.dll
2007-04-19 11:26:00 1,339,392 ----a-w C:\WINDOWS\system32\nvdspsch.exe
2007-04-19 11:26:00 1,236,992 ----a-w C:\WINDOWS\system32\nvwss.dll
2007-04-19 11:26:00 1,019,904 ----a-w C:\WINDOWS\system32\nvwimg.dll
2007-04-18 16:14:32 2,854,400 ----a-w C:\WINDOWS\system32\msi.dll
2007-04-16 20:45:28 92,504 ----a-w C:\WINDOWS\system32\cdm.dll
2007-04-16 20:45:20 43,352 ----a-w C:\WINDOWS\system32\wups2.dll


((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))


*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}]
2007-01-23 12:40 79544 --a------ C:\Program Files\- Programy systemowe -\Internet Download Manager\IDMIECC.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
2006-10-23 00:08 62080 --a------ C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
2007-03-14 03:43 501400 --a------ C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{E5A1691B-D188-4419-AD02-90002030B8EE}]
2005-05-04 12:46 191096 --a------ C:\PROGRA~1\-PROGR~1\FlashFXP\IEFlash.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"nwiz"="nwiz.exe" [2007-04-19 13:26 C:\WINDOWS\system32\nwiz.exe]
"VolPanel"="C:\Program Files\Creative\Sound Blaster X-Fi\Volume Panel\VolPanlu.exe" [2006-07-28 09:56]
"P17Helper"="SPIRun.dll" [2006-07-03 06:43 C:\WINDOWS\system32\SPIRun.dll]
"NvMediaCenter"="NvMCTray.dll" [2007-04-19 13:26 C:\WINDOWS\system32\nvmctray.dll]
"Copperhead"="C:\Program Files\Razer\Copperhead\razerhid.exe" [2005-11-02 10:48]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe" [2007-03-14 03:43]
"NeroFilterCheck"="C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" [2007-03-09 18:53]
"DU Meter"="C:\Program Files\- Programy systemowe -\DU Meter\DUMeter.exe" [2004-08-25 10:26]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-09-16 02:00]
"SpeedX"="E:\Programy\Speedx\SpeedX.exe" [2007-06-11 04:23]
"AQQ"="C:\PROGRA~1\-PROGR~1\AQQ\AQQ.exe" [2007-02-28 14:18]
"IDMan"="C:\Program Files\- Programy systemowe -\Internet Download Manager\IDMan.exe" [2007-06-19 12:24]


**************************************************************************

catchme 0.3.914 W2K/XP/Vista - rootkit detector by Gmer, http://www.gmer.net
Rootkit scan 2007-07-03 12:28:19
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
P17Helper = Rundll32 SPIRun.dll,RunDLLEntry?

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

Completion time: 2007-07-03 12:28:50

--- E O F ---

[wojtas]

logi sa ok

Autor postu otrzymał pochwałę