Błąd podczas ładowania

**Posty:** 2 · przez **sgk19** 11 Sty 2009, 16:55

Witam!
Po usunięciu zainfekowanego pliku przy uruchamianiu windows pojawia mi się komunikat:
Rundll
Wystąpił błąd podczas ładowania
C:\PROGRA~1\MYWEBS~1\bar\1.bin\M3PLUGIN.DLL
Nie można odnaleźć określonego modułu
Log z Combofix

Kod: Zaznacz wszystko: ComboFix 09-01-10.03 - sgk 2009-01-11 14:53:03.1 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.2.1250.1.1045.18.1503.1001 [GMT 1:00] Uruchomiony z: c:\documents and settings\sgk\Pulpit\ComboFix.exe * Utworzono nowy punkt przywracania . ((((((((((((((((((((((((((((((((((((((( Usunięto ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\documents and settings\sgk\Dane aplikacji\inst.exe c:\windows\system32\systeminfo3.dll . ((((((((((((((((((((((((((((((((((((((( Sterowniki/Usługi ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Legacy_MYWEBSEARCHSERVICE -------\Service_MyWebSearchService ((((((((((((((((((((((((( Pliki utworzone od 2008-12-11 do 2009-01-11 ))))))))))))))))))))))))))))))) . 2009-01-11 14:42 . 2009-01-11 14:42 <DIR> d-------- c:\program files\Trend Micro 2009-01-10 17:30 . 2009-01-10 17:30 <DIR> d-------- c:\program files\uTorrent 2009-01-08 00:28 . 2009-01-08 00:28 <DIR> d-------- c:\program files\ZyDAS Technology Corporation 2009-01-08 00:28 . 2006-08-24 13:44 477,696 --a------ c:\windows\system32\drivers\ZD1211BU.sys 2009-01-08 00:12 . 2004-01-14 11:25 81,920 --a------ c:\windows\system32\ZDPN50.DLL 2009-01-08 00:12 . 2005-03-18 15:35 31,744 --a------ c:\windows\system32\drivers\ZDPSp50a64.sys 2009-01-08 00:12 . 2005-06-08 18:44 29,184 --a------ c:\windows\system32\drivers\BRGSp50a64.sys 2009-01-08 00:12 . 2004-03-23 16:38 28,672 --a------ c:\windows\system32\InsDrvZD.dll 2009-01-08 00:12 . 2003-03-14 12:24 24,576 --a------ c:\windows\system32\ZyDelReg.exe 2009-01-08 00:12 . 2005-06-08 18:44 20,608 --a------ c:\windows\system32\drivers\BRGSp50.sys 2009-01-08 00:12 . 2004-10-25 13:40 17,664 --a------ c:\windows\system32\drivers\ZDPSp50.sys 2009-01-08 00:12 . 2004-01-14 11:30 17,151 --a------ c:\windows\system32\ZDPNDIS5.SYS 2009-01-08 00:12 . 2005-07-12 14:44 15,872 --a------ c:\windows\system32\InsDrvZD64.DLL 2009-01-07 11:56 . 2009-01-07 11:56 <DIR> d-------- c:\documents and settings\sgk\Dane aplikacji\vlc 2009-01-07 10:47 . 2009-01-07 10:47 <DIR> d-------- c:\program files\VideoLAN 2009-01-06 17:22 . 2007-05-16 18:12 149,040 --a------ c:\windows\system32\ImageDrive.cpl 2009-01-05 09:06 . 2009-01-05 09:06 <DIR> d-------- c:\documents and settings\sgk\Dane aplikacji\OpenOffice.org 2009-01-01 16:53 . 2009-01-01 16:53 <DIR> d-------- c:\documents and settings\sgk\Dane aplikacji\Apple Computer 2009-01-01 16:49 . 2009-01-01 16:50 <DIR> d-------- c:\program files\QuickTime 2009-01-01 16:49 . 2009-01-01 16:49 <DIR> d-------- c:\program files\Common Files\Apple 2009-01-01 16:49 . 2009-01-01 16:49 <DIR> d-------- c:\program files\Apple Software Update 2009-01-01 16:49 . 2009-01-01 16:49 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\Apple Computer 2009-01-01 16:49 . 2009-01-01 16:49 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\Apple 2008-12-30 15:15 . 2009-01-10 15:42 23 --a------ c:\windows\DownloadStudio.INI 2008-12-30 15:10 . 2008-12-30 15:10 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\Conceiva 2008-12-30 14:59 . 2008-12-30 14:59 <DIR> d-------- c:\program files\WinPcap 2008-12-30 14:59 . 2008-12-30 14:59 <DIR> d-------- c:\program files\Conceiva 2008-12-30 14:59 . 2008-12-30 14:59 <DIR> d-------- c:\documents and settings\sgk\Dane aplikacji\Conceiva 2008-12-30 14:59 . 2009-01-11 14:57 33 --a------ c:\windows\DownloadStudioScheduleMonitor.INI 2008-12-30 14:58 . 2008-12-30 14:58 <DIR> d-------- c:\documents and settings\sgk\Dane aplikacji\InstallShield 2008-12-29 15:13 . 2008-12-29 15:13 <DIR> d-------- c:\program files\Systweak 2008-12-29 15:13 . 2009-01-06 00:31 <DIR> d-------- c:\documents and settings\sgk\Dane aplikacji\Systweak 2008-12-29 15:13 . 2008-12-29 15:13 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\Systweak 2008-12-29 15:13 . 2008-11-10 19:49 17,136 --a------ c:\windows\system32\sasnative32.exe 2008-12-28 19:14 . 2009-01-10 12:06 69 --a------ c:\windows\NeroDigital.ini 2008-12-27 22:20 . 2008-12-27 22:21 <DIR> d-------- c:\program files\OpenOffice.org 3 2008-12-27 19:18 . 2008-12-27 19:18 <DIR> d-------- c:\documents and settings\sgk\Dane aplikacji\GARMIN 2008-12-27 19:17 . 2008-12-27 19:17 <DIR> d-------- c:\program files\Garmin GPS Plugin 2008-12-27 19:17 . 2008-12-27 21:47 <DIR> d-------- C:\Garmin 2008-12-27 16:45 . 2008-12-27 16:44 410,984 --a------ c:\windows\system32\deploytk.dll 2008-12-25 20:39 . 2008-12-25 20:39 <DIR> d-------- c:\program files\MSXML 4.0 2008-12-25 13:14 . 2008-12-25 13:14 <DIR> d-------- c:\program files\Common Files\Adobe 2008-12-25 12:36 . 2009-01-06 17:32 <DIR> d-------- c:\documents and settings\sgk\Dane aplikacji\Ahead 2008-12-25 12:35 . 2008-12-25 12:35 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\Ahead 2008-12-25 12:34 . 2008-12-25 12:34 <DIR> d-------- c:\program files\Nero 2008-12-25 12:34 . 2008-12-25 12:35 <DIR> d-------- c:\program files\Common Files\Ahead 2008-12-25 12:34 . 2008-12-25 12:34 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\Nero 2008-12-25 12:02 . 2009-01-07 21:23 <DIR> d----c--- c:\windows\system32\DRVSTORE 2008-12-25 12:02 . 2008-12-29 20:46 20 --a------ c:\windows\RaUI.INI 2008-12-25 11:59 . 2009-01-07 21:23 <DIR> d-------- c:\program files\RALINK 2008-12-25 11:33 . 2008-12-28 23:25 <DIR> d-------- c:\documents and settings\sgk\Dane aplikacji\123 Free Solitaire 2008-12-25 00:52 . 2008-12-25 00:52 0 --a------ c:\windows\PROSet.INI 2008-12-21 19:24 . 2008-12-21 19:24 <DIR> d-------- c:\program files\K-Lite Codec Pack 2008-12-21 19:24 . 2007-09-04 17:56 164,352 --a------ c:\windows\system32\unrar.dll 2008-12-21 19:24 . 2008-07-30 20:09 38 --a------ c:\windows\avisplitter.ini 2008-12-21 19:23 . 2008-07-09 10:05 421,888 --a------ c:\windows\system32\ac3filter.acm 2008-12-21 19:22 . 2008-12-21 19:23 <DIR> d-------- c:\program files\XP Codec Pack 2008-12-21 12:23 . 2004-05-20 17:47 90,112 -ra------ c:\windows\snymsico.dll 2008-12-21 00:24 . 2008-12-30 17:30 <DIR> d-------- c:\documents and settings\sgk\Dane aplikacji\gtk-2.0 2008-12-21 00:24 . 2008-12-21 00:24 <DIR> d-------- c:\documents and settings\sgk\.thumbnails 2008-12-19 19:54 . 2008-12-22 01:14 <DIR> d-------- c:\windows\system32\CatRoot_bak 2008-12-19 19:17 . 2008-12-19 19:17 <DIR> d-------- c:\program files\GIMP-2.0 2008-12-19 19:17 . 2008-12-30 17:30 <DIR> d-------- c:\documents and settings\sgk\.gimp-2.6 2008-12-19 19:17 . 2008-12-19 19:17 <DIR> d-------- c:\documents and settings\sgk\.gegl-0.0 2008-12-17 20:16 . 2008-12-17 20:16 <DIR> d-------- c:\program files\CloneDVD 2008-12-17 20:16 . 2008-12-17 20:16 <DIR> d-------- c:\documents and settings\sgk\Dane aplikacji\Vso 2008-12-17 20:16 . 2008-12-17 20:16 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\DVDXStudio 2008-12-17 20:16 . 2008-12-17 20:16 47,360 --a------ c:\windows\system32\drivers\pcouffin.sys 2008-12-17 20:16 . 2008-12-17 20:16 47,360 --a------ c:\documents and settings\sgk\Dane aplikacji\pcouffin.sys 2008-12-17 16:58 . 2008-12-17 16:58 <DIR> d-------- c:\program files\Combined Community Codec Pack 2008-12-17 16:50 . 2008-12-17 16:51 <DIR> d-------- c:\program files\SubEdit-Player 2008-12-17 14:37 . 2008-12-17 14:37 <DIR> d-------- c:\windows\Freecorder Toolbar 2008-12-17 14:37 . 2008-12-17 14:37 <DIR> d-------- c:\program files\Freecorder Toolbar 2008-12-17 14:37 . 2008-12-17 15:58 <DIR> d-------- c:\program files\Freecorder 2008-12-17 14:37 . 2008-12-17 14:37 <DIR> d-------- c:\program files\Conduit 2008-12-17 14:35 . 2008-12-17 14:37 2,788,800 --a------ c:\program files\FLV PlayerFCSetup.exe 2008-12-17 14:34 . 2008-12-17 14:34 <DIR> d-------- c:\windows\Applian FLV Player 2008-12-17 14:34 . 2008-12-17 14:34 <DIR> d-------- c:\program files\FLV Player 2008-12-17 13:36 . 2008-12-17 13:37 <DIR> d-------- c:\program files\VirtualFem 2008-12-16 15:09 . 2008-10-16 21:33 6,066,176 -----c--- c:\windows\system32\dllcache\ieframe.dll 2008-12-16 15:09 . 2007-04-17 10:32 2,455,488 -----c--- c:\windows\system32\dllcache\ieapfltr.dat 2008-12-16 15:09 . 2007-03-08 06:11 1,036,288 -----c--- c:\windows\system32\dllcache\ieframe.dll.mui 2008-12-16 15:09 . 2008-10-16 21:33 459,264 -----c--- c:\windows\system32\dllcache\msfeeds.dll 2008-12-16 15:09 . 2008-10-16 21:33 383,488 -----c--- c:\windows\system32\dllcache\ieapfltr.dll 2008-12-16 15:09 . 2008-10-16 21:33 267,776 -----c--- c:\windows\system32\dllcache\iertutil.dll 2008-12-16 15:09 . 2008-10-16 21:33 63,488 -----c--- c:\windows\system32\dllcache\icardie.dll 2008-12-16 15:09 . 2008-10-16 21:33 52,224 -----c--- c:\windows\system32\dllcache\msfeedsbs.dll 2008-12-16 15:09 . 2008-10-16 14:11 13,824 -----c--- c:\windows\system32\dllcache\ieudinit.exe 2008-12-16 15:08 . 2008-12-16 15:09 <DIR> d-------- c:\windows\system32\pl-pl 2008-12-13 21:13 . 2004-08-03 23:08 26,496 --a--c--- c:\windows\system32\dllcache\usbstor.sys 2008-12-13 20:57 . 2008-12-13 20:57 <DIR> d-------- c:\windows\system32\NtmsData 2008-12-13 13:17 . 2004-08-04 00:44 21,504 --a------ c:\windows\system32\hidserv.dll 2008-12-13 13:17 . 2004-08-04 00:44 21,504 --a--c--- c:\windows\system32\dllcache\hidserv.dll 2008-12-13 09:44 . 2004-05-20 17:47 65,664 -ra------ c:\windows\system32\drivers\rmedia.sys 2008-12-12 18:49 . 2009-01-10 17:32 <DIR> d-------- c:\documents and settings\sgk\Dane aplikacji\uTorrent 2008-12-12 18:34 . 2008-12-12 18:34 <DIR> d-------- c:\program files\Alcohol Soft 2008-12-12 18:32 . 2008-12-12 18:32 717,296 --a------ c:\windows\system32\drivers\sptd.sys 2008-12-12 15:51 . 2009-01-08 00:41 <DIR> d-------- c:\documents and settings\sgk\dwhelper 2008-12-12 15:38 . 2008-12-12 15:38 <DIR> d-------- c:\program files\Dziobas Rar Player 2008-12-12 15:35 . 2008-12-12 15:35 <DIR> d-------- c:\program files\7-Zip 2008-12-12 15:34 . 2008-12-12 15:34 <DIR> d-------- c:\documents and settings\sgk\Dane aplikacji\Media Player Classic 2008-12-12 15:32 . 2008-12-21 18:21 <DIR> d-------- c:\documents and settings\sgk\Dane aplikacji\BESTplayer 2008-12-12 15:28 . 2009-01-07 12:21 <DIR> d-------- c:\documents and settings\sgk\Dane aplikacji\skypePM 2008-12-12 15:28 . 2008-12-12 15:28 56 --ah----- c:\windows\system32\ezsidmv.dat 2008-12-12 15:26 . 2008-12-12 15:26 <DIR> d-------- c:\program files\Skype 2008-12-12 15:26 . 2008-12-12 15:26 <DIR> d-------- c:\program files\Common Files\Skype 2008-12-12 15:26 . 2009-01-07 12:21 <DIR> d-------- c:\documents and settings\sgk\Dane aplikacji\Skype 2008-12-12 15:26 . 2008-12-12 15:26 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\Skype 2008-12-12 15:18 . 2008-12-12 15:18 <DIR> d-------- c:\documents and settings\sgk\Dane aplikacji\Gadu-Gadu 2008-12-12 15:17 . 2008-12-12 15:17 <DIR> d-------- c:\program files\Gadu-Gadu 2008-12-12 15:17 . 2008-12-16 16:11 <DIR> d-------- c:\documents and settings\sgk\Gadu-Gadu 2008-12-12 15:13 . 2008-12-12 15:13 0 --a------ c:\windows\nsreg.dat 2008-12-12 15:09 . 2004-07-14 15:25 167,936 -ra------ c:\windows\system32\igfxres.dll 2008-12-12 15:08 . 2008-12-12 15:08 <DIR> d--h----- c:\documents and settings\sgk\WLANProfiles 2008-12-12 15:08 . 2008-12-12 15:08 <DIR> d--h----- c:\documents and settings\All Users\WLANProfiles 2008-12-12 15:08 . 2008-12-25 12:16 21,275 --a------ c:\windows\system32\drivers\AegisP.sys 2008-12-12 15:07 . 2008-12-12 15:07 <DIR> d-------- c:\windows\system32\LogFiles 2008-12-12 15:07 . 2001-08-17 22:59 3,072 --a------ c:\windows\system32\drivers\audstub.sys 2008-12-12 15:06 . 2008-12-12 15:06 <DIR> d-------- c:\program files\CONEXANT 2008-12-12 15:05 . 2009-01-01 16:50 <DIR> d--hs---- c:\windows\Installer 2008-12-12 15:04 . 2009-01-11 14:53 <DIR> d-------- c:\windows\system32\CatRoot2 2008-12-12 15:04 . 2008-12-12 15:04 <DIR> dr-h----- c:\documents and settings\Default User\Ustawienia lokalne 2008-12-12 15:04 . 2008-12-12 15:04 <DIR> d-------- c:\documents and settings\Default User\Ulubione 2008-12-12 15:04 . 2008-12-12 14:10 <DIR> d--h----- c:\documents and settings\Default User\Szablony 2008-12-12 15:04 . 2008-12-12 15:04 <DIR> d-------- c:\documents and settings\Default User\Pulpit . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-01-07 23:28 --------- d--h--w c:\program files\InstallShield Installation Information 2009-01-07 20:23 --------- d-----w c:\program files\Common Files\InstallShield 2008-12-12 14:08 --------- d-----w c:\program files\Intel 2008-12-12 13:49 --------- d-----w c:\program files\Alwil Software 2008-12-12 13:15 --------- d-----w c:\program files\microsoft frontpage 2008-12-12 13:13 --------- d-----w c:\program files\Usługi online 2008-11-29 20:26 991,232 ----a-w c:\windows\system32\VSFilter.dll 2008-10-23 13:01 283,648 ----a-w c:\windows\system32\gdi32.dll 2008-10-16 20:33 826,368 ----a-w c:\windows\system32\wininet.dll 2008-10-16 13:13 202,776 ----a-w c:\windows\system32\wuweb.dll 2008-10-16 13:13 1,809,944 ----a-w c:\windows\system32\wuaueng.dll 2008-10-16 13:12 561,688 ----a-w c:\windows\system32\wuapi.dll 2008-10-16 13:12 323,608 ----a-w c:\windows\system32\wucltui.dll 2008-10-16 13:09 92,696 ----a-w c:\windows\system32\cdm.dll 2008-10-16 13:09 51,224 ----a-w c:\windows\system32\wuauclt.exe 2008-10-16 13:09 43,544 ----a-w c:\windows\system32\wups2.dll 2008-10-16 13:08 34,328 ----a-w c:\windows\system32\wups.dll . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks] "{1392b8d2-5c05-419f-a8f6-b9f15a596612}"= "c:\program files\Freecorder\tbFre1.dll" [2008-12-17 1784856] [HKEY_CLASSES_ROOT\clsid\{1392b8d2-5c05-419f-a8f6-b9f15a596612}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{1392b8d2-5c05-419f-a8f6-b9f15a596612}] 2008-12-17 15:59 1784856 --a------ c:\program files\Freecorder\tbFre1.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar] "{1392b8d2-5c05-419f-a8f6-b9f15a596612}"= "c:\program files\Freecorder\tbFre1.dll" [2008-12-17 1784856] [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser] "{1392B8D2-5C05-419F-A8F6-B9F15A596612}"= "c:\program files\Freecorder\tbFre1.dll" [2008-12-17 1784856] [HKEY_CLASSES_ROOT\clsid\{1392b8d2-5c05-419f-a8f6-b9f15a596612}] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360] "AlcoholAutomount"="c:\program files\Alcohol Soft\Alcohol 52\axcmd.exe" [2008-11-23 203208] "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2007-05-16 153136] "MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2004-10-13 1694208] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2008-11-26 81000] "HControl"="c:\windows\ATK0100\HControl.exe" [2005-05-12 102400] "IgfxTray"="c:\windows\system32\igfxtray.exe" [2004-07-14 155648] "HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2004-07-14 118784] "ZCfgSvc.exe"="c:\windows\system32\ZCfgSvc.exe" [2004-09-06 417856] "PRONoMgr.exe"="c:\program files\Intel\PROSetWireless\NCS\PROSet\PRONoMgr.exe" [2004-05-10 102469] "NeroFilterCheck"="c:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2007-03-01 153136] "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672] "DownloadStudio"="c:\program files\Conceiva\DownloadStudio\DownloadStudioScheduleMonitor.exe" [2008-12-10 156312] "QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2008-09-06 413696] "Advanced System Protector"="c:\program files\Systweak\Advanced System Protector\ASP.exe" [2009-01-03 15585512] "SoundMan"="SOUNDMAN.EXE" [2005-03-07 c:\windows\SOUNDMAN.EXE] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-04 15360] c:\documents and settings\All Users\Menu Start\Programy\Autostart\ ZDWLan Utility.lnk - c:\program files\ZyDAS Technology Corporation\ZyDAS_802.11g_Utility\ZDWlan.exe [2009-01-08 487424] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\Sebring] 2004-09-06 05:29 180290 c:\windows\system32\LgNotify.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "vidc.ffds"= ffdshow.ax "msacm.ac3filter"= ac3filter.acm [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager] BootExecute REG_MULTI_SZ autocheck autochk *\[u]0[/u]sasnative32 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "c:\\Program Files\\Skype\\Phone\\Skype.exe"= "c:\\Program Files\\uTorrent\\uTorrent.exe"= R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2008-12-12 111184] R4 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2008-12-12 20560] S3 BCASPROT;Advanced System Protector;c:\program files\Systweak\Advanced System Protector\sasprot32.sys [2008-12-29 6656] S3 BRGSp50;BRGSp50 NDIS Protocol Driver;c:\windows\system32\drivers\BRGSp50.sys [2009-01-08 20608] S3 NPF;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [2007-11-06 34064] . Zawartość folderu 'Zaplanowane zadania' 2009-01-06 c:\windows\Tasks\AppleSoftwareUpdate.job - c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 12:34] . - - - - USUNIĘTO PUSTE WPISY - - - - HKLM-Run-MyWebSearch Plugin - c:\progra~1\MYWEBS~1\bar\1.bin\M3PLUGIN.DLL HKLM-Run-My Web Search Bar Search Scope Monitor - c:\progra~1\MYWEBS~1\bar\1.bin\m3SrchMn.exe . ------- Skan uzupełniający ------- . uStart Page = hxxp://www.google.pl/ uInternet Connection Wizard,ShellNext = iexplore IE: Add Page To DownloadStudio Scrapbook... - c:\program files\Conceiva\DownloadStudio\ds_snap.htm IE: Download Image Using DownloadStudio... - c:\program files\Conceiva\DownloadStudio\ds_img.htm IE: Download Link Using DownloadStudio... - c:\program files\Conceiva\DownloadStudio\ds_file.htm IE: Download Page Using DownloadStudio... - c:\program files\Conceiva\DownloadStudio\ds_all.htm IE: Download Selection Using DownloadStudio... - c:\program files\Conceiva\DownloadStudio\ds_sel.htm IE: Download Video using DownloadStudio... - c:\program files\Conceiva\DownloadStudio\ds_video.htm IE: Show Page Links Using DownloadStudio... - c:\program files\Conceiva\DownloadStudio\ds_link.htm IE: Subscribe To RSS/Podcast Using DownloadStudio... - c:\program files\Conceiva\DownloadStudio\ds_rss.htm FF - ProfilePath - c:\documents and settings\sgk\Dane aplikacji\Mozilla\Firefox\Profiles\hfxl94j8.default\ FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT1060933&SearchSource=3&q= FF - prefs.js: browser.search.selectedEngine - Web Search FF - component: c:\documents and settings\sgk\Dane aplikacji\Mozilla\Firefox\Profiles\hfxl94j8.default\extensions\{0851d9cd-87db-4a0d-a792-097dc9071486}\components\DownloadStudioNativeWrapper.dll FF - component: c:\documents and settings\sgk\Dane aplikacji\Mozilla\Firefox\Profiles\hfxl94j8.default\extensions\{1392b8d2-5c05-419f-a8f6-b9f15a596612}\components\FFAlert.dll FF - component: c:\program files\Mozilla Firefox\extensions\{B13721C7-F507-4982-B2E5-502A71474FED}\components\NPComponent.dll FF - plugin: c:\program files\K-Lite Codec Pack\Real\browser\plugins\nppl3260.dll FF - plugin: c:\program files\K-Lite Codec Pack\Real\browser\plugins\nprpjplug.dll FF - plugin: c:\program files\Mozilla Firefox\plugins\NPMyWebS.dll . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-01-11 14:57:53 Windows 5.1.2600 Dodatek Service Pack 2 NTFS skanowanie ukrytych procesów ... skanowanie ukrytych wpisów autostartu ... skanowanie ukrytych plików ... skanowanie pomyślnie ukończone ukryte pliki: 0 ************************************************************************** . --------------------- Pliki DLL ładowane pod uruchomionymi procesami --------------------- - - - - - - - > 'winlogon.exe'(856) c:\windows\system32\LgNotify.dll . ------------------------ Pozostałe uruchomione procesy ------------------------ . c:\windows\system32\savedump.exe c:\windows\system32\S24EvMon.exe c:\program files\Alwil Software\Avast4\aswUpdSv.exe c:\program files\Alwil Software\Avast4\ashServ.exe c:\program files\Alcohol Soft\Alcohol 52\StarWind\StarWindServiceAE.exe c:\windows\system32\wdfmgr.exe c:\program files\Alwil Software\Avast4\ashMaiSv.exe c:\program files\Alwil Software\Avast4\ashWebSv.exe c:\program files\Common Files\Ahead\Lib\NMIndexingService.exe c:\program files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe c:\windows\system32\1XConfig.exe c:\windows\ATK0100\ATKOSD.exe . ************************************************************************** . Czas ukończenia: 2009-01-11 14:59:45 - komputer został uruchomiony ponownie [sgk] ComboFix-quarantined-files.txt 2009-01-11 13:59:42 Przed: 1,635,241,984 bajtów wolnych Po: 2,971,852,800 bajtów wolnych WindowsXP-KB310994-SP2-Home-BootDisk-PLK.exe [boot loader] timeout=2 default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS [operating systems] c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect 290 --- E O F --- 2008-12-25 19:41:21

Log z HijackThis

Kod: Zaznacz wszystko

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 14:44, on 2009-01-11
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16762)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\S24EvMon.exe
C:\WINDOWS\system32\ZCfgSvc.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\ATK0100\HControl.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\Program Files\Conceiva\DownloadStudio\DownloadStudioScheduleMonitor.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\Program Files\Alcohol Soft\Alcohol 52\StarWind\StarWindServiceAE.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
C:\WINDOWS\system32\1XConfig.exe
C:\WINDOWS\ATK0100\ATKOSD.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.pl/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
R3 - URLSearchHook: Freecorder Toolbar - {1392b8d2-5c05-419f-a8f6-b9f15a596612} - C:\Program Files\Freecorder\tbFre1.dll
O2 - BHO: Freecorder Toolbar - {1392b8d2-5c05-419f-a8f6-b9f15a596612} - C:\Program Files\Freecorder\tbFre1.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Download Studio Click Monitor - {8170D7DC-BDD6-461e-88EB-F047257898C9} - C:\Program Files\Conceiva\DownloadStudio\DLMonitr.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (file missing)
O3 - Toolbar: Freecorder Toolbar - {1392b8d2-5c05-419f-a8f6-b9f15a596612} - C:\Program Files\Freecorder\tbFre1.dll
O3 - Toolbar: DownloadStudio IE Toolbar - {CB789373-04D5-4ef4-9C16-871463FD0830} - C:\Program Files\Conceiva\DownloadStudio\WebDLBar.dll
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [HControl] C:\WINDOWS\ATK0100\HControl.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [ZCfgSvc.exe] C:\WINDOWS\system32\ZCfgSvc.exe
O4 - HKLM\..\Run: [PRONoMgr.exe] C:\Program Files\Intel\PROSetWireless\NCS\PROSet\PRONoMgr.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [DownloadStudio] C:\Program Files\Conceiva\DownloadStudio\DownloadStudioScheduleMonitor.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [MyWebSearch Plugin] rundll32 C:\PROGRA~1\MYWEBS~1\bar\1.bin\M3PLUGIN.DLL,UPF
O4 - HKLM\..\Run: [My Web Search Bar Search Scope Monitor] "C:\PROGRA~1\MYWEBS~1\bar\1.bin\m3SrchMn.exe" /m=2 /w
O4 - HKLM\..\Run: [Advanced System Protector] "C:\Program Files\Systweak\Advanced System Protector\ASP.exe" /autorun
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [AlcoholAutomount] "C:\Program Files\Alcohol Soft\Alcohol 52\axcmd.exe" /automount
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: ZDWLan Utility.lnk = C:\Program Files\ZyDAS Technology Corporation\ZyDAS_802.11g_Utility\ZDWlan.exe
O8 - Extra context menu item: Add Page To DownloadStudio Scrapbook... - C:\Program Files\Conceiva\DownloadStudio\ds_snap.htm
O8 - Extra context menu item: Download Image Using DownloadStudio... - C:\Program Files\Conceiva\DownloadStudio\ds_img.htm
O8 - Extra context menu item: Download Link Using DownloadStudio... - C:\Program Files\Conceiva\DownloadStudio\ds_file.htm
O8 - Extra context menu item: Download Page Using DownloadStudio... - C:\Program Files\Conceiva\DownloadStudio\ds_all.htm
O8 - Extra context menu item: Download Selection Using DownloadStudio... - C:\Program Files\Conceiva\DownloadStudio\ds_sel.htm
O8 - Extra context menu item: Download Video using DownloadStudio... - C:\Program Files\Conceiva\DownloadStudio\ds_video.htm
O8 - Extra context menu item: Show Page Links Using DownloadStudio... - C:\Program Files\Conceiva\DownloadStudio\ds_link.htm
O8 - Extra context menu item: Subscribe To RSS/Podcast Using DownloadStudio... - C:\Program Files\Conceiva\DownloadStudio\ds_rss.htm
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: My Web Search Service (MyWebSearchService) - Unknown owner - C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwssvc.exe (file missing)
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcap\rpcapd.exe
O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\WINDOWS\system32\S24EvMon.exe
O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 52\StarWind\StarWindServiceAE.exe

--
End of file - 7753 bytes
Proszę o pomoc.
Pozdrawiam serdecznie.

**Posty:** 18165 · przez **wojtas** 11 Sty 2009, 21:04

te plik/i :

c:\windows\system32\sasnative32.exe

przesaknuj tu

http://virusscan.jotti.org/
http://www.virustotal.com/

i daj raporty ze skanow

i daj log nowy z combofixa i hijacka w tagach code

**Posty:** 2 · przez **sgk19** 12 Sty 2009, 12:34

Witam!
Sorry

Skan z virusscan.jotti

Kod: Zaznacz wszystko: Jotti's malware scan 2.99-TRANSITION_TO_3.00-R1 File to upload & scan: Service Service load: 0% 100% File: sasnative32.exe Status: INCONCLUSIVE (scan still in progress) MD5: 0065e911f966a71a115d9a52ff3dfc99 Packers detected: Analyzing... Scanner results Scan taken on 12 Jan 2009 13:05:07 (GMT) A-Squared Scanning, please wait... AntiVir Scanning, please wait... ArcaVir Scanning, please wait... Avast Scanning, please wait... AVG Antivirus Scanning, please wait... BitDefender Scanning, please wait... ClamAV Scanning, please wait... CPsecure Scanning, please wait... Dr.Web Scanning, please wait... F-Prot Antivirus Scanning, please wait... F-Secure Anti-Virus Scanning, please wait... G DATA Scanning, please wait... Ikarus Scanning, please wait... Kaspersky Anti-Virus Scanning, please wait... NOD32 Scanning, please wait... Norman Virus Control Scanning, please wait... Panda Antivirus Scanning, please wait... Sophos Antivirus Scanning, please wait... VirusBuster Scanning, please wait... VBA32 Scanning, please wait... Powered by Disclaimer This service is by no means 100% safe. If this scanner says 'OK', it does not necessarily mean the file is clean. There could be a whole new virus on the loose. NEVER rely on one single product only, not even this service, even though it utilizes several products. Therefore, We cannot and will not be held responsible for any damage caused by results presented by this non-profit online service. Scanning can take a while, since several scanners are being used, plus the fact some scanners use very high levels of (time consuming) heuristics. Scanners used are Linux versions, differences with Windows scanners may or may not occur. Some scanners will only report one virus when scanning archives with multiple pieces of malware. Virus definitions are updated every hour. There is a 10Mb limit per file. Please refrain from uploading tons of hex-edited or repacked variants of the same sample. Please do not ask for viruses uploaded here, unless you work for an anti-virus vendor. They are not for trade. This is a legitimate service, not a VX site. Viruses uploaded here will be distributed to antivirus vendors without exception. Read more about this in our privacy policy. If you do not want your files to be distributed, please do not send them at all. Sponsored by HotelScraper.com. -------------------------------------------------------------------------------- Statistics Last file scanned at least one scanner reported something about: install.exe (MD5: d1ef17ff195b17a1e6ebb461bb72ee0e, size: 323772 bytes), detected by: Scanner Malware name A-Squared X AntiVir TR/Dropper.Gen ArcaVir X Avast X AVG Antivirus X BitDefender X ClamAV X CPsecure X Dr.Web X F-Prot Antivirus X F-Secure Anti-Virus X G DATA X Ikarus X Kaspersky Anti-Virus X NOD32 X Norman Virus Control X Panda Antivirus X Sophos Antivirus Troj/BadCab-A VirusBuster X VBA32 X You are free to (mis)interpret these automated, flawed statistics at your own discretion. For antivirus comparisons, visit AV comparatives We are not affiliated with any third parties that conduct tests using this service. Frequently asked questions - Privacy policy Page generated by JTPL © 2004-2009 Jotti <jotti@jotti.org>

Skan z virustotal

Kod: Zaznacz wszystko: [code][/code]Plik sasnative32.exe otrzymany 2008.12.31 12:25:41 (CET) Obecny status: zakończono Wynik: 0/38 (0.00%) Zwięzły Drukuj wyniki Antywirus Wersja Ostatnia aktualizacja Wynik a-squared 4.0.0.73 2008.12.31 - AhnLab-V3 2008.12.31.0 2008.12.31 - AntiVir 7.9.0.45 2008.12.31 - Authentium 5.1.0.4 2008.12.30 - Avast 4.8.1281.0 2008.12.30 - AVG 8.0.0.199 2008.12.31 - BitDefender 7.2 2008.12.31 - CAT-QuickHeal 10.00 2008.12.31 - ClamAV 0.94.1 2008.12.31 - Comodo 851 2008.12.31 - DrWeb 4.44.0.09170 2008.12.31 - eTrust-Vet 31.6.6284 2008.12.31 - Ewido 4.0 2008.12.31 - F-Prot 4.4.4.56 2008.12.30 - F-Secure 8.0.14470.0 2008.12.31 - Fortinet 3.117.0.0 2008.12.31 - GData 19 2008.12.31 - Ikarus T3.1.1.45.0 2008.12.31 - K7AntiVirus 7.10.572 2008.12.31 - Kaspersky 7.0.0.125 2008.12.31 - McAfee 5479 2008.12.30 - McAfee+Artemis 5479 2008.12.30 - Microsoft 1.4205 2008.12.31 - NOD32 3725 2008.12.31 - Norman 5.80.02 2008.12.30 - Panda 9.0.0.4 2008.12.31 - PCTools 4.4.2.0 2008.12.31 - Prevx1 V2 2008.12.31 - Rising 21.10.22.00 2008.12.31 - SecureWeb-Gateway 6.7.6 2008.12.31 - Sophos 4.37.0 2008.12.31 - Sunbelt 3.2.1809.2 2008.12.22 - Symantec 10 2008.12.31 - TheHacker 6.3.1.4.202 2008.12.30 - TrendMicro 8.700.0.1004 2008.12.31 - VBA32 3.12.8.10 2008.12.30 - ViRobot 2008.12.30.1540 2008.12.31 - VirusBuster 4.5.11.0 2008.12.30 - Dodatkowe informacje File size: 17136 bytes MD5...: 0065e911f966a71a115d9a52ff3dfc99 SHA1..: 7f29c65d27184e6c1e65253a19154568335d994c SHA256: bf28a8eb57684f7819ae1c76282d26356590559f827eddb576662bada1d2c9fc SHA512: b70e7f5ed00df42529ca9f5dcdd1f065435291f6d1730f3419fc0a1f17afb1a8 119192824ff0437f1f98df5195686ef7ceaf612493948be284a92ebccb245ce5 ssdeep: 384:hWwWbhwUM8PdAD2GRGxYWwRWCfUZUBXxYJLWtVba:hWwh8PdGVsYWB9Lsba PEiD..: - TrID..: File type identification Win64 Executable Generic (87.2%) Win32 Executable Generic (8.6%) Generic Win/DOS Executable (2.0%) DOS Executable Generic (2.0%) Autodesk FLIC Image File (extensions: flc, fli, cel) (0.0%) PEInfo: PE Structure information ( base data ) entrypointaddress.: 0x402890 timedatestamp.....: 0x49183995 (Mon Nov 10 13:39:33 2008) machinetype.......: 0x14c (I386) ( 5 sections ) name viradd virsiz rawdsiz ntrpy md5 .text 0x1000 0x1956 0x1a00 5.94 f7ae9844a6a186531301497463da3e90 .rdata 0x3000 0xb8a 0xc00 3.99 d9c3d4c5e3b641af8e0a7b096510c0aa .data 0x4000 0x4 0x0 0.00 d41d8cd98f00b204e9800998ecf8427e .rsrc 0x5000 0xb0 0x200 4.08 e75462be5446e4713a9bfd1160790c3e .reloc 0x6000 0x1b8 0x200 4.70 89619446203afa3f4be6c3ccd707b631 ( 1 imports ) > ntdll.dll: ZwCreateFile, wcsrchr, RtlNtStatusToDosError, RtlAdjustPrivilege, ZwClose, RtlAllocateHeap, ZwInitializeRegistry, ZwOpenFile, NtQueryValueKey, ZwTerminateProcess, ZwQueryInformationFile, ZwWriteFile, ZwDeleteKey, ZwDelayExecution, ZwRestoreKey, wcschr, ZwOpenKey, ZwDisplayString, ZwCreateKey, RtlCreateHeap, _wcsnicmp, ZwReadFile,

Skan z Combofix

Kod: Zaznacz wszystko: ComboFix 09-01-11.03 - sgk 2009-01-12 14:12:53.4 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.2.1250.1.1045.18.1503.864 [GMT 1:00] Uruchomiony z: c:\documents and settings\sgk\Pulpit\ComboFix.exe AV: avast! antivirus 4.8.1296 [VPS 090111-1] *On-access scanning disabled* (Outdated) * Utworzono nowy punkt przywracania . ((((((((((((((((((((((((( Pliki utworzone od 2008-12-12 do 2009-01-12 ))))))))))))))))))))))))))))))) . 2009-01-12 01:44 . 2009-01-12 01:44 <DIR> d-------- c:\program files\VirusTotalUploader 2009-01-11 22:58 . 2009-01-11 22:58 <DIR> d-------- c:\windows\Sun 2009-01-11 22:51 . 2009-01-12 02:00 <DIR> d-------- c:\program files\Java 2009-01-11 22:51 . 2008-11-10 03:39 73,728 --a------ c:\windows\system32\javacpl.cpl 2009-01-11 14:42 . 2009-01-11 14:42 <DIR> d-------- c:\program files\Trend Micro 2009-01-10 17:30 . 2009-01-10 17:30 <DIR> d-------- c:\program files\uTorrent 2009-01-08 00:28 . 2009-01-08 00:28 <DIR> d-------- c:\program files\ZyDAS Technology Corporation 2009-01-08 00:28 . 2006-08-24 13:44 477,696 --a------ c:\windows\system32\drivers\ZD1211BU.sys 2009-01-08 00:12 . 2004-01-14 11:25 81,920 --a------ c:\windows\system32\ZDPN50.DLL 2009-01-08 00:12 . 2005-03-18 15:35 31,744 --a------ c:\windows\system32\drivers\ZDPSp50a64.sys 2009-01-08 00:12 . 2005-06-08 18:44 29,184 --a------ c:\windows\system32\drivers\BRGSp50a64.sys 2009-01-08 00:12 . 2004-03-23 16:38 28,672 --a------ c:\windows\system32\InsDrvZD.dll 2009-01-08 00:12 . 2003-03-14 12:24 24,576 --a------ c:\windows\system32\ZyDelReg.exe 2009-01-08 00:12 . 2005-06-08 18:44 20,608 --a------ c:\windows\system32\drivers\BRGSp50.sys 2009-01-08 00:12 . 2004-10-25 13:40 17,664 --a------ c:\windows\system32\drivers\ZDPSp50.sys 2009-01-08 00:12 . 2004-01-14 11:30 17,151 --a------ c:\windows\system32\ZDPNDIS5.SYS 2009-01-08 00:12 . 2005-07-12 14:44 15,872 --a------ c:\windows\system32\InsDrvZD64.DLL 2009-01-07 11:56 . 2009-01-07 11:56 <DIR> d-------- c:\documents and settings\sgk\Dane aplikacji\vlc 2009-01-07 10:47 . 2009-01-07 10:47 <DIR> d-------- c:\program files\VideoLAN 2009-01-06 17:22 . 2007-05-16 18:12 149,040 --a------ c:\windows\system32\ImageDrive.cpl 2009-01-05 09:06 . 2009-01-05 09:06 <DIR> d-------- c:\documents and settings\sgk\Dane aplikacji\OpenOffice.org 2009-01-01 16:53 . 2009-01-01 16:53 <DIR> d-------- c:\documents and settings\sgk\Dane aplikacji\Apple Computer 2009-01-01 16:49 . 2009-01-01 16:50 <DIR> d-------- c:\program files\QuickTime 2009-01-01 16:49 . 2009-01-01 16:49 <DIR> d-------- c:\program files\Common Files\Apple 2009-01-01 16:49 . 2009-01-01 16:49 <DIR> d-------- c:\program files\Apple Software Update 2009-01-01 16:49 . 2009-01-01 16:49 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\Apple Computer 2009-01-01 16:49 . 2009-01-01 16:49 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\Apple 2008-12-30 15:15 . 2009-01-10 15:42 23 --a------ c:\windows\DownloadStudio.INI 2008-12-30 15:10 . 2008-12-30 15:10 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\Conceiva 2008-12-30 14:59 . 2008-12-30 14:59 <DIR> d-------- c:\program files\WinPcap 2008-12-30 14:59 . 2008-12-30 14:59 <DIR> d-------- c:\program files\Conceiva 2008-12-30 14:59 . 2008-12-30 14:59 <DIR> d-------- c:\documents and settings\sgk\Dane aplikacji\Conceiva 2008-12-30 14:59 . 2009-01-12 01:52 33 --a------ c:\windows\DownloadStudioScheduleMonitor.INI 2008-12-30 14:58 . 2008-12-30 14:58 <DIR> d-------- c:\documents and settings\sgk\Dane aplikacji\InstallShield 2008-12-29 15:13 . 2008-12-29 15:13 <DIR> d-------- c:\program files\Systweak 2008-12-29 15:13 . 2009-01-06 00:31 <DIR> d-------- c:\documents and settings\sgk\Dane aplikacji\Systweak 2008-12-29 15:13 . 2008-12-29 15:13 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\Systweak 2008-12-29 15:13 . 2008-11-10 19:49 17,136 --a------ c:\windows\system32\sasnative32.exe 2008-12-28 19:14 . 2009-01-12 10:58 69 --a------ c:\windows\NeroDigital.ini 2008-12-27 22:20 . 2008-12-27 22:21 <DIR> d-------- c:\program files\OpenOffice.org 3 2008-12-27 19:18 . 2008-12-27 19:18 <DIR> d-------- c:\documents and settings\sgk\Dane aplikacji\GARMIN 2008-12-27 19:17 . 2008-12-27 19:17 <DIR> d-------- c:\program files\Garmin GPS Plugin 2008-12-27 19:17 . 2008-12-27 21:47 <DIR> d-------- C:\Garmin 2008-12-27 16:45 . 2008-11-10 05:43 410,984 --a------ c:\windows\system32\deploytk.dll 2008-12-25 20:39 . 2008-12-25 20:39 <DIR> d-------- c:\program files\MSXML 4.0 2008-12-25 13:14 . 2008-12-25 13:14 <DIR> d-------- c:\program files\Common Files\Adobe 2008-12-25 12:36 . 2009-01-06 17:32 <DIR> d-------- c:\documents and settings\sgk\Dane aplikacji\Ahead 2008-12-25 12:35 . 2008-12-25 12:35 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\Ahead 2008-12-25 12:34 . 2008-12-25 12:34 <DIR> d-------- c:\program files\Nero 2008-12-25 12:34 . 2008-12-25 12:35 <DIR> d-------- c:\program files\Common Files\Ahead 2008-12-25 12:34 . 2008-12-25 12:34 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\Nero 2008-12-25 12:02 . 2009-01-07 21:23 <DIR> d----c--- c:\windows\system32\DRVSTORE 2008-12-25 12:02 . 2008-12-29 20:46 20 --a------ c:\windows\RaUI.INI 2008-12-25 11:59 . 2009-01-07 21:23 <DIR> d-------- c:\program files\RALINK 2008-12-25 11:33 . 2008-12-28 23:25 <DIR> d-------- c:\documents and settings\sgk\Dane aplikacji\123 Free Solitaire 2008-12-25 00:52 . 2008-12-25 00:52 0 --a------ c:\windows\PROSet.INI 2008-12-21 19:24 . 2008-12-21 19:24 <DIR> d-------- c:\program files\K-Lite Codec Pack 2008-12-21 19:24 . 2007-09-04 17:56 164,352 --a------ c:\windows\system32\unrar.dll 2008-12-21 19:24 . 2008-07-30 20:09 38 --a------ c:\windows\avisplitter.ini 2008-12-21 19:23 . 2008-07-09 10:05 421,888 --a------ c:\windows\system32\ac3filter.acm 2008-12-21 19:22 . 2008-12-21 19:23 <DIR> d-------- c:\program files\XP Codec Pack 2008-12-21 12:23 . 2004-05-20 17:47 90,112 -ra------ c:\windows\snymsico.dll 2008-12-21 00:24 . 2008-12-30 17:30 <DIR> d-------- c:\documents and settings\sgk\Dane aplikacji\gtk-2.0 2008-12-21 00:24 . 2008-12-21 00:24 <DIR> d-------- c:\documents and settings\sgk\.thumbnails 2008-12-19 19:54 . 2008-12-22 01:14 <DIR> d-------- c:\windows\system32\CatRoot_bak 2008-12-19 19:17 . 2008-12-19 19:17 <DIR> d-------- c:\program files\GIMP-2.0 2008-12-19 19:17 . 2008-12-30 17:30 <DIR> d-------- c:\documents and settings\sgk\.gimp-2.6 2008-12-19 19:17 . 2008-12-19 19:17 <DIR> d-------- c:\documents and settings\sgk\.gegl-0.0 2008-12-17 20:16 . 2008-12-17 20:16 <DIR> d-------- c:\program files\CloneDVD 2008-12-17 20:16 . 2008-12-17 20:16 <DIR> d-------- c:\documents and settings\sgk\Dane aplikacji\Vso 2008-12-17 20:16 . 2008-12-17 20:16 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\DVDXStudio 2008-12-17 20:16 . 2008-12-17 20:16 47,360 --a------ c:\windows\system32\drivers\pcouffin.sys 2008-12-17 20:16 . 2008-12-17 20:16 47,360 --a------ c:\documents and settings\sgk\Dane aplikacji\pcouffin.sys 2008-12-17 16:58 . 2008-12-17 16:58 <DIR> d-------- c:\program files\Combined Community Codec Pack 2008-12-17 16:50 . 2008-12-17 16:51 <DIR> d-------- c:\program files\SubEdit-Player 2008-12-17 14:37 . 2008-12-17 14:37 <DIR> d-------- c:\windows\Freecorder Toolbar 2008-12-17 14:37 . 2009-01-12 01:52 <DIR> d-------- c:\program files\Freecorder 2008-12-17 14:37 . 2008-12-17 14:37 <DIR> d-------- c:\program files\Conduit 2008-12-17 14:35 . 2008-12-17 14:37 2,788,800 --a------ c:\program files\FLV PlayerFCSetup.exe 2008-12-17 14:34 . 2008-12-17 14:34 <DIR> d-------- c:\windows\Applian FLV Player 2008-12-17 14:34 . 2008-12-17 14:34 <DIR> d-------- c:\program files\FLV Player 2008-12-17 13:36 . 2008-12-17 13:37 <DIR> d-------- c:\program files\VirtualFem 2008-12-16 15:09 . 2008-10-16 21:33 6,066,176 -----c--- c:\windows\system32\dllcache\ieframe.dll 2008-12-16 15:09 . 2007-04-17 10:32 2,455,488 -----c--- c:\windows\system32\dllcache\ieapfltr.dat 2008-12-16 15:09 . 2007-03-08 06:11 1,036,288 -----c--- c:\windows\system32\dllcache\ieframe.dll.mui 2008-12-16 15:09 . 2008-10-16 21:33 459,264 -----c--- c:\windows\system32\dllcache\msfeeds.dll 2008-12-16 15:09 . 2008-10-16 21:33 383,488 -----c--- c:\windows\system32\dllcache\ieapfltr.dll 2008-12-16 15:09 . 2008-10-16 21:33 267,776 -----c--- c:\windows\system32\dllcache\iertutil.dll 2008-12-16 15:09 . 2008-10-16 21:33 63,488 -----c--- c:\windows\system32\dllcache\icardie.dll 2008-12-16 15:09 . 2008-10-16 21:33 52,224 -----c--- c:\windows\system32\dllcache\msfeedsbs.dll 2008-12-16 15:09 . 2008-10-16 14:11 13,824 -----c--- c:\windows\system32\dllcache\ieudinit.exe 2008-12-16 15:08 . 2008-12-16 15:09 <DIR> d-------- c:\windows\system32\pl-pl 2008-12-13 21:13 . 2004-08-03 23:08 26,496 --a--c--- c:\windows\system32\dllcache\usbstor.sys 2008-12-13 20:57 . 2008-12-13 20:57 <DIR> d-------- c:\windows\system32\NtmsData 2008-12-13 13:17 . 2004-08-04 00:44 21,504 --a------ c:\windows\system32\hidserv.dll 2008-12-13 13:17 . 2004-08-04 00:44 21,504 --a--c--- c:\windows\system32\dllcache\hidserv.dll 2008-12-13 09:44 . 2004-05-20 17:47 65,664 -ra------ c:\windows\system32\drivers\rmedia.sys 2008-12-12 18:49 . 2009-01-12 14:03 <DIR> d-------- c:\documents and settings\sgk\Dane aplikacji\uTorrent 2008-12-12 18:34 . 2008-12-12 18:34 <DIR> d-------- c:\program files\Alcohol Soft 2008-12-12 18:32 . 2008-12-12 18:32 717,296 --a------ c:\windows\system32\drivers\sptd.sys 2008-12-12 15:51 . 2009-01-08 00:41 <DIR> d-------- c:\documents and settings\sgk\dwhelper 2008-12-12 15:38 . 2008-12-12 15:38 <DIR> d-------- c:\program files\Dziobas Rar Player 2008-12-12 15:35 . 2008-12-12 15:35 <DIR> d-------- c:\program files\7-Zip 2008-12-12 15:34 . 2008-12-12 15:34 <DIR> d-------- c:\documents and settings\sgk\Dane aplikacji\Media Player Classic 2008-12-12 15:32 . 2008-12-21 18:21 <DIR> d-------- c:\documents and settings\sgk\Dane aplikacji\BESTplayer 2008-12-12 15:28 . 2009-01-07 12:21 <DIR> d-------- c:\documents and settings\sgk\Dane aplikacji\skypePM 2008-12-12 15:28 . 2008-12-12 15:28 56 --ah----- c:\windows\system32\ezsidmv.dat 2008-12-12 15:26 . 2008-12-12 15:26 <DIR> d-------- c:\program files\Skype 2008-12-12 15:26 . 2008-12-12 15:26 <DIR> d-------- c:\program files\Common Files\Skype 2008-12-12 15:26 . 2009-01-07 12:21 <DIR> d-------- c:\documents and settings\sgk\Dane aplikacji\Skype 2008-12-12 15:26 . 2008-12-12 15:26 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\Skype 2008-12-12 15:18 . 2008-12-12 15:18 <DIR> d-------- c:\documents and settings\sgk\Dane aplikacji\Gadu-Gadu 2008-12-12 15:17 . 2008-12-12 15:17 <DIR> d-------- c:\program files\Gadu-Gadu 2008-12-12 15:17 . 2008-12-16 16:11 <DIR> d-------- c:\documents and settings\sgk\Gadu-Gadu 2008-12-12 15:13 . 2008-12-12 15:13 0 --a------ c:\windows\nsreg.dat 2008-12-12 15:09 . 2004-07-14 15:25 167,936 -ra------ c:\windows\system32\igfxres.dll 2008-12-12 15:08 . 2008-12-12 15:08 <DIR> d--h----- c:\documents and settings\sgk\WLANProfiles 2008-12-12 15:08 . 2008-12-12 15:08 <DIR> d--h----- c:\documents and settings\All Users\WLANProfiles 2008-12-12 15:08 . 2008-12-25 12:16 21,275 --a------ c:\windows\system32\drivers\AegisP.sys 2008-12-12 15:07 . 2008-12-12 15:07 <DIR> d-------- c:\windows\system32\LogFiles 2008-12-12 15:07 . 2001-08-17 22:59 3,072 --a------ c:\windows\system32\drivers\audstub.sys 2008-12-12 15:06 . 2008-12-12 15:06 <DIR> d-------- c:\program files\CONEXANT 2008-12-12 15:05 . 2009-01-12 02:01 <DIR> d--hs---- c:\windows\Installer 2008-12-12 15:04 . 2009-01-12 02:11 <DIR> d-------- c:\windows\system32\CatRoot2 2008-12-12 15:04 . 2008-12-12 15:04 <DIR> dr-h----- c:\documents and settings\Default User\Ustawienia lokalne . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-01-07 23:28 --------- d--h--w c:\program files\InstallShield Installation Information 2009-01-07 20:23 --------- d-----w c:\program files\Common Files\InstallShield 2008-12-12 14:08 --------- d-----w c:\program files\Intel 2008-12-12 13:49 --------- d-----w c:\program files\Alwil Software 2008-12-12 13:15 --------- d-----w c:\program files\microsoft frontpage 2008-12-12 13:13 --------- d-----w c:\program files\Usługi online 2008-11-29 20:26 991,232 ----a-w c:\windows\system32\VSFilter.dll 2008-10-23 13:01 283,648 ----a-w c:\windows\system32\gdi32.dll 2008-10-16 20:33 826,368 ----a-w c:\windows\system32\wininet.dll 2008-10-16 13:13 202,776 ----a-w c:\windows\system32\wuweb.dll 2008-10-16 13:13 1,809,944 ----a-w c:\windows\system32\wuaueng.dll 2008-10-16 13:12 561,688 ----a-w c:\windows\system32\wuapi.dll 2008-10-16 13:12 323,608 ----a-w c:\windows\system32\wucltui.dll 2008-10-16 13:09 92,696 ----a-w c:\windows\system32\cdm.dll 2008-10-16 13:09 51,224 ----a-w c:\windows\system32\wuauclt.exe 2008-10-16 13:09 43,544 ----a-w c:\windows\system32\wups2.dll 2008-10-16 13:08 34,328 ----a-w c:\windows\system32\wups.dll . ((((((((((((((((((((((((((((( snapshot@2009-01-11_14.59.07.31 ))))))))))))))))))))))))))))))))))))))))) . - 2000-08-31 07:00:00 28,672 ----a-w c:\windows\NIRCMD.exe + 2000-08-31 07:00:00 29,696 ----a-w c:\windows\NIRCMD.exe + 2008-11-10 04:43:37 144,792 ----a-w c:\windows\system32\java.exe + 2008-11-10 04:43:38 144,792 ----a-w c:\windows\system32\javaw.exe + 2008-11-10 04:43:39 148,888 ----a-w c:\windows\system32\javaws.exe + 2009-01-12 01:01:00 16,384 ----atw c:\windows\Temp\Perflib_Perfdata_700.dat + 2009-01-12 00:52:17 16,384 ----atw c:\windows\Temp\Perflib_Perfdata_790.dat . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360] "AlcoholAutomount"="c:\program files\Alcohol Soft\Alcohol 52\axcmd.exe" [2008-11-23 203208] "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2007-05-16 153136] "MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2004-10-13 1694208] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2008-11-26 81000] "HControl"="c:\windows\ATK0100\HControl.exe" [2005-05-12 102400] "IgfxTray"="c:\windows\system32\igfxtray.exe" [2004-07-14 155648] "HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2004-07-14 118784] "ZCfgSvc.exe"="c:\windows\system32\ZCfgSvc.exe" [2004-09-06 417856] "PRONoMgr.exe"="c:\program files\Intel\PROSetWireless\NCS\PROSet\PRONoMgr.exe" [2004-05-10 102469] "NeroFilterCheck"="c:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2007-03-01 153136] "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672] "DownloadStudio"="c:\program files\Conceiva\DownloadStudio\DownloadStudioScheduleMonitor.exe" [2008-12-10 156312] "QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2008-09-06 413696] "Advanced System Protector"="c:\program files\Systweak\Advanced System Protector\ASP.exe" [2009-01-03 15585512] "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2008-11-10 136600] "SoundMan"="SOUNDMAN.EXE" [2005-03-07 c:\windows\SOUNDMAN.EXE] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-04 15360] c:\documents and settings\All Users\Menu Start\Programy\Autostart\ ZDWLan Utility.lnk - c:\program files\ZyDAS Technology Corporation\ZyDAS_802.11g_Utility\ZDWlan.exe [2009-01-08 487424] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\Sebring] 2004-09-06 05:29 180290 c:\windows\system32\LgNotify.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "vidc.ffds"= ffdshow.ax "msacm.ac3filter"= ac3filter.acm [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager] BootExecute REG_MULTI_SZ autocheck autochk *\[u]0[/u]sasnative32 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "c:\\Program Files\\Skype\\Phone\\Skype.exe"= "c:\\Program Files\\uTorrent\\uTorrent.exe"= R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2008-12-12 111184] R3 BCASPROT;Advanced System Protector;c:\program files\Systweak\Advanced System Protector\sasprot32.sys [2008-12-29 6656] R4 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2008-12-12 20560] S3 BRGSp50;BRGSp50 NDIS Protocol Driver;c:\windows\system32\drivers\BRGSp50.sys [2009-01-08 20608] S3 NPF;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [2007-11-06 34064] --- Inne Uslugi/Sterowniki w Pamieci --- *NewlyCreated* - JAVAQUICKSTARTERSERVICE . Zawartość folderu 'Zaplanowane zadania' 2009-01-06 c:\windows\Tasks\AppleSoftwareUpdate.job - c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 12:34] . . ------- Skan uzupełniający ------- . uStart Page = hxxp://www.google.pl/ uInternet Connection Wizard,ShellNext = iexplore IE: Add Page To DownloadStudio Scrapbook... - c:\program files\Conceiva\DownloadStudio\ds_snap.htm IE: Download Image Using DownloadStudio... - c:\program files\Conceiva\DownloadStudio\ds_img.htm IE: Download Link Using DownloadStudio... - c:\program files\Conceiva\DownloadStudio\ds_file.htm IE: Download Page Using DownloadStudio... - c:\program files\Conceiva\DownloadStudio\ds_all.htm IE: Download Selection Using DownloadStudio... - c:\program files\Conceiva\DownloadStudio\ds_sel.htm IE: Download Video using DownloadStudio... - c:\program files\Conceiva\DownloadStudio\ds_video.htm IE: Show Page Links Using DownloadStudio... - c:\program files\Conceiva\DownloadStudio\ds_link.htm IE: Subscribe To RSS/Podcast Using DownloadStudio... - c:\program files\Conceiva\DownloadStudio\ds_rss.htm FF - ProfilePath - c:\documents and settings\sgk\Dane aplikacji\Mozilla\Firefox\Profiles\hfxl94j8.default\ FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT1060933&SearchSource=3&q= FF - prefs.js: browser.search.selectedEngine - Web Search FF - component: c:\documents and settings\sgk\Dane aplikacji\Mozilla\Firefox\Profiles\hfxl94j8.default\extensions\{0851d9cd-87db-4a0d-a792-097dc9071486}\components\DownloadStudioNativeWrapper.dll FF - component: c:\documents and settings\sgk\Dane aplikacji\Mozilla\Firefox\Profiles\hfxl94j8.default\extensions\{1392b8d2-5c05-419f-a8f6-b9f15a596612}\components\FFAlert.dll FF - component: c:\program files\Mozilla Firefox\extensions\{B13721C7-F507-4982-B2E5-502A71474FED}\components\NPComponent.dll FF - plugin: c:\program files\K-Lite Codec Pack\Real\browser\plugins\nppl3260.dll FF - plugin: c:\program files\K-Lite Codec Pack\Real\browser\plugins\nprpjplug.dll FF - plugin: c:\program files\Mozilla Firefox\plugins\NPMyWebS.dll . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-01-12 14:13:59 Windows 5.1.2600 Dodatek Service Pack 2 NTFS skanowanie ukrytych procesów ... skanowanie ukrytych wpisów autostartu ... skanowanie ukrytych plików ... skanowanie pomyślnie ukończone ukryte pliki: 0 ************************************************************************** . --------------------- Pliki DLL ładowane pod uruchomionymi procesami --------------------- - - - - - - - > 'winlogon.exe'(860) c:\windows\system32\LgNotify.dll . Czas ukończenia: 2009-01-12 14:15:07 ComboFix-quarantined-files.txt 2009-01-12 13:15:03 ComboFix2.txt 2009-01-12 10:16:31 ComboFix3.txt 2009-01-12 01:13:27 ComboFix4.txt 2009-01-11 13:59:48 Przed: 1 269 776 384 bajtów wolnych Po: 1,261,608,960 bajtów wolnych 261 --- E O F --- 2008-12-25 19:41:21

Skan z HijackThis

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 14:21:00, on 2009-01-12 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16762) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\S24EvMon.exe C:\WINDOWS\system32\ZCfgSvc.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\system32\spoolsv.exe C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\WINDOWS\ATK0100\HControl.exe C:\WINDOWS\system32\igfxtray.exe C:\WINDOWS\system32\hkcmd.exe C:\Program Files\Conceiva\DownloadStudio\DownloadStudioScheduleMonitor.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe C:\Program Files\Alcohol Soft\Alcohol 52\StarWind\StarWindServiceAE.exe C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe C:\WINDOWS\system32\1XConfig.exe C:\WINDOWS\ATK0100\ATKOSD.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\WINDOWS\system32\wbem\wmiapsrv.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\WINDOWS\explorer.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.pl/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll O2 - BHO: Download Studio Click Monitor - {8170D7DC-BDD6-461e-88EB-F047257898C9} - C:\Program Files\Conceiva\DownloadStudio\DLMonitr.dll O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll O3 - Toolbar: DownloadStudio IE Toolbar - {CB789373-04D5-4ef4-9C16-871463FD0830} - C:\Program Files\Conceiva\DownloadStudio\WebDLBar.dll O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [HControl] C:\WINDOWS\ATK0100\HControl.exe O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [ZCfgSvc.exe] C:\WINDOWS\system32\ZCfgSvc.exe O4 - HKLM\..\Run: [PRONoMgr.exe] C:\Program Files\Intel\PROSetWireless\NCS\PROSet\PRONoMgr.exe O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [DownloadStudio] C:\Program Files\Conceiva\DownloadStudio\DownloadStudioScheduleMonitor.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime O4 - HKLM\..\Run: [Advanced System Protector] "C:\Program Files\Systweak\Advanced System Protector\ASP.exe" /autorun O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe" O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [AlcoholAutomount] "C:\Program Files\Alcohol Soft\Alcohol 52\axcmd.exe" /automount O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Global Startup: ZDWLan Utility.lnk = C:\Program Files\ZyDAS Technology Corporation\ZyDAS_802.11g_Utility\ZDWlan.exe O8 - Extra context menu item: Add Page To DownloadStudio Scrapbook... - C:\Program Files\Conceiva\DownloadStudio\ds_snap.htm O8 - Extra context menu item: Download Image Using DownloadStudio... - C:\Program Files\Conceiva\DownloadStudio\ds_img.htm O8 - Extra context menu item: Download Link Using DownloadStudio... - C:\Program Files\Conceiva\DownloadStudio\ds_file.htm O8 - Extra context menu item: Download Page Using DownloadStudio... - C:\Program Files\Conceiva\DownloadStudio\ds_all.htm O8 - Extra context menu item: Download Selection Using DownloadStudio... - C:\Program Files\Conceiva\DownloadStudio\ds_sel.htm O8 - Extra context menu item: Download Video using DownloadStudio... - C:\Program Files\Conceiva\DownloadStudio\ds_video.htm O8 - Extra context menu item: Show Page Links Using DownloadStudio... - C:\Program Files\Conceiva\DownloadStudio\ds_link.htm O8 - Extra context menu item: Subscribe To RSS/Podcast Using DownloadStudio... - C:\Program Files\Conceiva\DownloadStudio\ds_rss.htm O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcap\rpcapd.exe O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\WINDOWS\system32\S24EvMon.exe O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 52\StarWind\StarWindServiceAE.exe -- End of file - 7482 bytes

Pozdrawiam serdecznie.

**Posty:** 18165 · przez **wojtas** 12 Sty 2009, 13:28

prosze objąć log w tagi