błagam i proszę o sprawdzenie loga z hijack this

**Posty:** 15 · przez **funky11** 24 Kwi 2007, 21:57

Witam wszystkich bardzo serdecznie.

Miałem ogromne problemy z aplikacją error safe.

Przeskanowałem kompa 6 różnymi antywirami usuwając przy okazji kilka trojanów . Potem zrobiłem skan HiJackiem i bardzo vardzo proszę doświadczone osoby o sprawdzenie loga i wskazanie które wpisy mogę wyrzucić.

Dodam tylko że Wpis 02 tftsvr.dll oraz 020 antywiry wskazały jako trojana ale HiJack mimo że je zaznaczyłem fix this ich nie usunął - co mam zrobić w tej sytuacji :evil:

Będę bardzo wdzięczny za pomoc
:roll:

Logfile of HijackThis v1.99.1
Scan saved at 21:25:34, on 2007-04-24
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32\clcl6.exe
C:\WINDOWS\system32\devldr32.exe
C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
C:\Program Files\Gadu-Gadu\gg.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpoSTS08.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\explorer.exe
C:\DOCUME~1\MICHAŁ\USTAWI~1\Temp\Katalog tymczasowy 1 dla hijackthis.zip\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.onet.pl/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigURL = http://proxy.voltronik.pl/auto.pac
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {5cd6420e-2f2e-4b3f-896a-7d4fdd2327c1} - C:\WINDOWS\system32\tftsvr.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [clcl6] C:\WINDOWS\system32\clcl6.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: hpoddt01.exe.lnk = ?
O4 - Global Startup: hp psc 2000 Series.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe
O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O17 - HKLM\System\CCS\Services\Tcpip\..\{7CB68327-C4BF-4276-A179-DFDFB5E3CA28}: NameServer = 89.234.202.2,89.234.192.3
O20 - AppInit_DLLs:
O20 - Winlogon Notify: tftsvr - C:\WINDOWS\SYSTEM32\tftsvr.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Unknown owner - C:\Program Files\iPod\bin\iPodService.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

**Posty:** 18165 · przez **wojtas** 24 Kwi 2007, 21:59

na poczatek zaznacz caly log myszka i nacisnij quote lub code

**Posty:** 15 · przez **funky11** 24 Kwi 2007, 22:18

Po przeskanowaniu w Hijack'u jedyne Co mogę zrobić to:fixed check - niedziała na wszystkie wpisy skanu, save log - zapisuje raport ze skanu w notatniku i Info on selected Item - info o wpisach.

Czy ktoś znalazła jakieś nieprawidłowe wpisy w wynikach skanu do ewentualnego usunięcia i jak usunęć te których Hijack nie może???

Będę wdzięczny

**Posty:** 18165 · przez **wojtas** 24 Kwi 2007, 22:20

na forum wkleiles loga wiec teraz dla ulatwienia dla sprawdzajacych obejmij w tagi:)

czyli zaznacz myszka caly log zeby byl podswietlony i nacisnij quote lub code

tu masz instrukcję jak cos:

http://forum.programosy.pl/hijackthis-amp-silent-runners-gtobsuga-i-umieszczanie-vt9452.html

**Posty:** 15 · przez **funky11** 24 Kwi 2007, 22:28

Kod: Zaznacz wszystko: [quote]Logfile of HijackThis v1.99.1 Scan saved at 21:25:34, on 2007-04-24 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\system32\spoolsv.exe C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\WINDOWS\system32\clcl6.exe C:\WINDOWS\system32\devldr32.exe C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe C:\Program Files\Gadu-Gadu\gg.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpoSTS08.exe C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\explorer.exe C:\DOCUME~1\MICHAŁ\USTAWI~1\Temp\Katalog tymczasowy 1 dla hijackthis.zip\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.onet.pl/ R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigURL = http://proxy.voltronik.pl/auto.pac R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {5cd6420e-2f2e-4b3f-896a-7d4fdd2327c1} - C:\WINDOWS\system32\tftsvr.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [clcl6] C:\WINDOWS\system32\clcl6.exe O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE O4 - Global Startup: hpoddt01.exe.lnk = ? O4 - Global Startup: hp psc 2000 Series.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O17 - HKLM\System\CCS\Services\Tcpip\..\{7CB68327-C4BF-4276-A179-DFDFB5E3CA28}: NameServer = 89.234.202.2,89.234.192.3 O20 - AppInit_DLLs: O20 - Winlogon Notify: tftsvr - C:\WINDOWS\SYSTEM32\tftsvr.dll O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing) O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing) O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPod Service - Unknown owner - C:\Program Files\iPod\bin\iPodService.exe (file missing) O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe[/quote]

bardzo dzięki za info i instrukcje - jestem nowym i mało doświadczonym użytkownikiem - przepraszam

**Posty:** 18165 · przez **wojtas** 24 Kwi 2007, 22:34

Ściągnij program http://downloads.subratam.org/Fixwareout.exe i zastosuj go

Pobierz i uruchom narzędzie : The Avenger
http://swandog46.geekstogo.com/avenger.zip
Zaznacz opcję Input script manually i kliknij na Lupkę z prawej strony. W okienku, które się otworzy wklejasz:

Files to delete:

C:\WINDOWS\SYSTEM32\tftsvr.dll
C:\WINDOWS\system32\clcl6.exe

Klikasz Done, a następnie zielone światełko i zgadzasz się na restart klikając OK.
Po restarcie w HijackThis usuwasz wpis/y

O2 - BHO: (no name) - {5cd6420e-2f2e-4b3f-896a-7d4fdd2327c1} - C:\WINDOWS\system32\tftsvr.dll
O4 - HKLM\..\Run: [clcl6] C:\WINDOWS\system32\clcl6.exe
O20 - Winlogon Notify: tftsvr - C:\WINDOWS\SYSTEM32\tftsvr.dll
O20 - AppInit_DLLs:

Kasujesz ręcznie z dysku plik: C:\Avenger\backup.zip i wklejasz na forum raport: C:\avenger.txt + log z comboscana

comboscan:
http://www.techsupportforum.com/sectools/Deckard/comboscan.exe

**Posty:** 15 · przez **funky11** 24 Kwi 2007, 23:42

Już jestem

Otoraporty z Avangera

Kod: Zaznacz wszystko: [quote][code][quote]Logfile of The Avenger version 1, by Swandog46 Running from registry key: \Registry\Machine\System\CurrentControlSet\Services\mqxcdqxh ******************* Script file located at: \??\C:\Program Files\nrcmkpbv.txt Script file opened successfully. Script file read successfully Backups directory opened successfully at C:\Avenger ******************* Beginning to process script file: File C:\WINDOWS\SYSTEM32\tftsvr.dll not found! Deletion of file C:\WINDOWS\SYSTEM32\tftsvr.dll failed! Could not process line: C:\WINDOWS\SYSTEM32\tftsvr.dll Status: 0xc0000034 File C:\WINDOWS\system32\clcl6.exe deleted successfully. Completed script processing. ******************* Finished! Terminate. [/quote][/code] i z comboscana [code][quote]ComboScan v20070306.20 run by Michał on 2007-04-24 at 23:21:40 Computer is in Normal Mode. -------------------------------------------------------------------------------- -- System Restore -------------------------------------------------------------- Successfully created ComboScan Restore Point. -- Last 5 Restore Point(s) -- 6: 2007-04-24 21:21:46 UTC - RP106 - ComboScan Restore Point 5: 2007-04-23 23:16:50 UTC - RP105 - Punkt kontrolny systemu 4: 2007-04-22 16:10:07 UTC - RP104 - Punkt kontrolny systemu 3: 2007-04-21 00:39:44 UTC - RP103 - Punkt kontrolny systemu 2: 2007-04-19 14:01:15 UTC - RP102 - Punkt kontrolny systemu -- First Restore Point -- 1: 2007-04-18 10:06:28 UTC - RP101 - Punkt kontrolny systemu Performed disk cleanup. -- HijackThis (run as Michał.exe) ---------------------------------------------- Logfile of HijackThis v1.99.1 Scan saved at 23:24:14, on 2007-04-24 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\Explorer.EXE C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\WINDOWS\Avast vir\AVG\AVG Anti-Spyware 7.5\avgas.exe C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe C:\Program Files\Gadu-Gadu\gg.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe C:\WINDOWS\system32\devldr32.exe C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe C:\WINDOWS\Avast vir\AVG\AVG Anti-Spyware 7.5\guard.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\wscntfy.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpoSTS08.exe E:\fixing\comboscan.exe C:\PROGRA~1\HIJACK~1\Michał.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.onet.pl/ R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigURL = http://proxy.voltronik.pl/auto.pac R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {1557B435-8242-4686-9AA3-9265BF7525A4} - C:\WINDOWS\system32\tmpA.tmp.dll (file missing) O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [BootService] rundll32.exe "C:\WINDOWS\iiihee.dll",realset O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\WINDOWS\Avast vir\AVG\AVG Anti-Spyware 7.5\avgas.exe" /minimized O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE O4 - Global Startup: hpoddt01.exe.lnk = ? O4 - Global Startup: hp psc 2000 Series.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O17 - HKLM\System\CCS\Services\Tcpip\..\{7CB68327-C4BF-4276-A179-DFDFB5E3CA28}: NameServer = 89.234.202.2,89.234.192.3 O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing) O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing) O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\WINDOWS\Avast vir\AVG\AVG Anti-Spyware 7.5\guard.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPod Service - Unknown owner - C:\Program Files\iPod\bin\iPodService.exe (file missing) O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe -- File Associations ----------------------------------------------------------- .bat - batfile - "%1" %* .chm - chm.file - "C:\WINDOWS\hh.exe" %1 .cmd - cmdfile - "%1" %* .com - comfile - "%1" %* .exe - exefile - "%1" %* .hlp - hlpfile - %SystemRoot%\System32\winhlp32.exe %1 .inf - inffile - %SystemRoot%\System32\NOTEPAD.EXE %1 .ini - inifile - %SystemRoot%\System32\NOTEPAD.EXE %1 .js - JSFile - %SystemRoot%\System32\WScript.exe "%1" %* .lnk - lnkfile - {00021401-0000-0000-C000-000000000046} .pif - piffile - "%1" %* .reg - regfile - regedit.exe "%1" .scr - scrfile - "%1" /S .txt - txtfile - %SystemRoot%\system32\NOTEPAD.EXE %1 .vbs - VBSFile - %SystemRoot%\System32\WScript.exe "%1" %* -- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------- 1R Aavmker4 (avast! Asynchronous Virus Monitor) - C:\WINDOWS\system32\drivers\aavmker4.sys 2R aswMon2 (avast! Standard Shield Support) - C:\WINDOWS\system32\drivers\aswmon2.sys 3R aswRdr - C:\WINDOWS\system32\drivers\aswRdr.sys 1R aswTdi (avast! Network Shield Support) - C:\WINDOWS\system32\drivers\aswTdi.sys 1R AVG Anti-Spyware Driver - C:\WINDOWS\Avast vir\AVG\AVG Anti-Spyware 7.5\guard.sys 1R AvgAsCln (AVG Anti-Spyware Clean Driver) - C:\WINDOWS\system32\drivers\AvgAsCln.sys 3R ctljystk (Port gier dla karty Creative SB Live!) - C:\WINDOWS\system32\drivers\ctljystk.sys 3R emu10k (Creative SB Live! (WDM)) - C:\WINDOWS\system32\drivers\emu10k1m.sys 3R emu10k1 (Sterownik Creative Interface Manager (WDM)) - C:\WINDOWS\system32\drivers\ctlfacem.sys 3S HPZid412 (IEEE-1284.4 Driver HPZid412) - C:\WINDOWS\system32\drivers\hpzid412.sys 3S HPZipr12 (Print Class Driver for IEEE-1284.4 HPZipr12) - C:\WINDOWS\system32\drivers\HPZipr12.sys 3S HPZius12 (USB to IEEE-1284.4 Translation Driver HPZius12) - C:\WINDOWS\system32\drivers\HPZius12.sys 2S IcRecUsb (IC Recorder Driver) - C:\WINDOWS\system32\drivers\IcRecUsb.sys 3R nv - C:\WINDOWS\system32\drivers\nv4_mini.sys 0R PxHelp20 - C:\WINDOWS\system32\drivers\PxHelp20.sys 3R rtl8139 (Sterownik NT karty Realtek RTL8139(A/B/C)-based PCI Fast Ethernet) - C:\WINDOWS\system32\drivers\RTL8139.sys 3R sfman (Sterownik Creative SoundFont Manager (WDM)) - C:\WINDOWS\system32\drivers\sfmanm.sys 1R StarOpen - C:\WINDOWS\system32\drivers\StarOpen.sys 3S usbccgp (Rodzajowy sterownik nadrzędny USB Microsoft) - C:\WINDOWS\system32\drivers\usbccgp.sys 3S usbprint (Klasa PRINTER USB Microsoft) - C:\WINDOWS\system32\drivers\usbprint.sys 3S usbscan (Sterownik skanera USB) - C:\WINDOWS\system32\drivers\usbscan.sys 3S USBSTOR (Sterownik magazynu masowego USB) - C:\WINDOWS\system32\drivers\USBSTOR.SYS -- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled -------------------- 3S aspnet_state (ASP.NET State Service) - C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe 2R aswUpdSv (avast! iAVS4 Control Service) - "C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe" 2R avast! Antivirus - "C:\Program Files\Alwil Software\Avast4\ashServ.exe" 3R avast! Mail Scanner - "C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service 3R avast! Web Scanner - "C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service 2R AVG Anti-Spyware Guard - C:\WINDOWS\Avast vir\AVG\AVG Anti-Spyware 7.5\guard.exe 3S clr_optimization_v2.0.50727_32 (.NET Runtime Optimization Service v2.0.50727_X86) - C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe 3S gusvc (Google Updater Service) - "C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe" 3S IDriverT (InstallDriver Table Manager) - "C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe" 3S iPod Service - "C:\Program Files\iPod\bin\iPodService.exe" 2R NVSvc (NVIDIA Display Driver Service) - C:\WINDOWS\system32\nvsvc32.exe 3S Pml Driver HPZ12 - C:\WINDOWS\system32\HPZipm12.exe -- Scheduled Tasks ------------------------------------------------------------- 2007-05-28 17:07:12 392 --a------ C:\WINDOWS\Tasks\FRU Task #Hewlett-Packard#hp psc 2170 series#1167753967.job<FRUTAS~1.JOB> 2007-05-28 17:07:10 446 --a------ C:\WINDOWS\Tasks\WebReg 20070528170708.job<WEBREG~1.JOB> -- Files created between 2007-03-24 and 2007-04-24 ----------------------------- 2007-06-07 19:35:25 24 --a------ C:\WINDOWS\system32\sysmwwod.dll 2007-06-07 19:31:24 360448 --a------ C:\WINDOWS\system32\NCTWMAFile.dll<NCTWMA~1.DLL> 2007-06-07 19:31:23 1703936 --a------ C:\WINDOWS\system32\NCTAudioFile.dll<NCTAUD~1.DLL> 2007-06-07 19:31:21 233472 --a------ C:\WINDOWS\system32\lame_enc.dll 2007-05-31 18:31:56 0 d--h----- C:\WINDOWS\PIF 2007-05-30 07:02:12 5632 --a------ C:\WINDOWS\system32\drivers\StarOpen.sys 2007-05-30 06:51:50 0 d-------- C:\WINDOWS\system32\Samsung PC Studio Codecs<SAMSUN~2> 2007-05-30 06:51:26 684032 --a------ C:\WINDOWS\system32\fun_mp4_enc.dll<FUN_MP~2.DLL> 2007-05-30 06:51:26 77824 --a------ C:\WINDOWS\system32\fun_mp4_dec.dll<FUN_MP~1.DLL> 2007-05-30 06:51:25 2729472 --a------ C:\WINDOWS\system32\fun_avcodec.dll<FUN_AV~1.DLL> 2007-05-30 06:50:48 0 d-------- C:\WINDOWS\system32\Samsung_USB_Drivers<SAMSUN~1> 2007-04-24 22:38:50 0 d-------- C:\fixwareout<FIXWAR~1> 2007-04-24 22:22:54 3968 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys 2007-04-24 19:37:32 0 d-------- C:\WINDOWS\system32\Kaspersky Lab<KASPER~1> 2007-04-24 18:23:37 0 d-------- C:\Program Files\SkanerOnline<SKANER~1> 2007-04-24 17:51:41 0 d-------- C:\WINDOWS\system32\ActiveScan<ACTIVE~1> 2007-04-06 00:14:56 3624960 --a------ C:\WINDOWS\system32\mkgpmp.exe 2007-04-06 00:14:56 1700352 --a------ C:\WINDOWS\system32\gdiplus.dll 2007-04-06 00:14:56 61440 --a------ C:\WINDOWS\system32\cygz.dll 2007-04-06 00:14:56 1295582 --a------ C:\WINDOWS\system32\cygwin1.dll 2007-04-06 00:13:43 61 --a------ C:\WINDOWS\system32\buyurl0502.dat<BUYURL~1.DAT> 2007-04-01 12:52:36 50016 -ra------ C:\WINDOWS\system\IYVU9.DLL 2007-04-01 12:52:35 49616 -ra------ C:\WINDOWS\system\MSACM.DLL 2007-04-01 12:52:35 151056 -ra------ C:\WINDOWS\system\IR32.DLL 2007-04-01 12:52:35 77664 -ra------ C:\WINDOWS\system\IR21.DLL 2007-04-01 12:52:35 1116 -ra------ C:\WINDOWS\MPLAYER.REG 2007-04-01 12:52:35 117536 -ra------ C:\WINDOWS\MPLAYER.EXE 2007-04-01 12:52:35 12288 -ra------ C:\WINDOWS\MCIOLE.DLL 2007-04-01 12:52:34 153312 --a------ C:\WINDOWS\system\TYPELIB.DLL 2007-04-01 12:52:34 157184 --a------ C:\WINDOWS\system\STORAGE.DLL 2007-04-01 12:52:34 55808 --a------ C:\WINDOWS\system\OLE2PROX.DLL 2007-04-01 12:52:34 147440 --a------ C:\WINDOWS\system\OLE2NLS.DLL 2007-04-01 12:52:34 98336 --a------ C:\WINDOWS\system\OLE2DISP.DLL 2007-04-01 12:52:34 57328 --a------ C:\WINDOWS\system\OLE2CONV.DLL 2007-04-01 12:52:34 24606 -ra------ C:\WINDOWS\system\OLE2.REG 2007-04-01 12:52:33 188960 -ra------ C:\WINDOWS\system\WINGDE.DLL 2007-04-01 12:52:33 12800 -ra------ C:\WINDOWS\system\WING32.DLL 2007-04-01 12:52:33 92208 -ra------ C:\WINDOWS\system\WING.DLL 2007-04-01 12:52:33 313344 --a------ C:\WINDOWS\system\OLE2.DLL 2007-04-01 12:52:33 7168 --a------ C:\WINDOWS\system\DISPDIB.DLL 2007-04-01 12:52:33 14208 --a------ C:\WINDOWS\system\CTL3D.DLL 2007-04-01 12:52:33 102400 --a------ C:\WINDOWS\system\COMPOBJ.DLL 2007-04-01 12:52:33 87 --a------ C:\WINDOWS\system\CLEANUP.REG 2007-04-01 12:52:33 12800 --a------ C:\WINDOWS\system\ACMCMPRS.DLL 2007-04-01 12:52:32 0 d-------- C:\MMAPP 2007-03-29 09:54:12 0 d-------- C:\Program Files\Video Access ActiveX Object<VIDEOA~1> -- Find3M Report --------------------------------------------------------------- 2007-05-30 07:12:24 0 d-------- C:\Documents and Settings\Michał\Dane aplikacji\TransRender<TRANSR~1> 2007-05-30 07:12:24 0 d-------- C:\Documents and Settings\Michał\Dane aplikacji\Temporary<TEMPOR~1> 2007-05-30 07:12:24 0 d-------- C:\Documents and Settings\Michał\Dane aplikacji\ConvertTemp<CONVER~1> 2007-05-30 07:09:06 0 d-------- C:\Documents and Settings\Michał\Dane aplikacji\Samsung 2007-04-18 18:17:00 733824 --a------ C:\WINDOWS\system32\aswBoot.exe 2007-04-18 18:07:00 90112 --a------ C:\WINDOWS\system32\AVASTSS.scr 2007-03-18 21:43:22 0 d-------- C:\Program Files\Common Files\SWF Studio<SWFSTU~1> 2007-03-10 20:54:40 0 d-------- C:\Program Files\Winamp 2007-03-06 15:10:54 0 d-------- C:\Program Files\PANASONIC<PANASO~1> 2007-03-06 15:10:52 0 d--h----- C:\Program Files\InstallShield Installation Information<INSTAL~1> 2007-03-06 12:01:16 0 d-------- C:\Documents and Settings\Michał\Dane aplikacji\Apple Computer<APPLEC~1> 2007-03-06 11:58:58 0 d-------- C:\Program Files\QuickTime<QUICKT~1> -- Registry Dump --------------------------------------------------------------- [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run] "swg"="C:\\Program Files\\Google\\GoogleToolbarNotifier\\1.2.1128.5462\\GoogleToolbarNotifier.exe" "Gadu-Gadu"="\"C:\\Program Files\\Gadu-Gadu\\gg.exe\" /tray" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run] "NvCplDaemon"="RUNDLL32.EXE C:\\WINDOWS\\system32\\NvCpl.dll,NvStartup" "nwiz"="nwiz.exe /install" "NvMediaCenter"="RUNDLL32.EXE C:\\WINDOWS\\system32\\NvMcTray.dll,NvTaskbarInit" "avast!"="C:\\PROGRA~1\\ALWILS~1\\Avast4\\ashDisp.exe" "QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime" "BootService"="rundll32.exe \"C:\\WINDOWS\\iiihee.dll\",realset" "!AVG Anti-Spyware"="\"C:\\WINDOWS\\Avast vir\\AVG\\AVG Anti-Spyware 7.5\\avgas.exe\" /minimized" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\IMAIL] "Installed"="1" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MAPI] "Installed"="1" "NoChange"="1" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MSFS] "Installed"="1" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks] "{57B86673-276A-48B2-BAE7-C6DBB3020EB8}"="AVG Anti-Spyware 7.5" [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system] "DisableRegistryTools"=dword:00000000 [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] "NoLowDiskSpaceChecks"=dword:00000001 [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders] "SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll" [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Svchost] HTTPFilter REG_MULTI_SZ HTTPFilter\0\0 LocalService REG_MULTI_SZ Alerter\0WebClient\0LmHosts\0RemoteRegistry\0upnphost\0SSDPSRV\0\0 NetworkService REG_MULTI_SZ DnsCache\0\0 DcomLaunch REG_MULTI_SZ DcomLaunch\0TermService\0\0 rpcss REG_MULTI_SZ RpcSs\0\0 imgsvc REG_MULTI_SZ StiSvc\0\0 termsvcs REG_MULTI_SZ TermService\0\0 -- End of ComboScan: finished at 2007-04-24 at 23:25:00 ------------------------[/list][/quote][/code] [size=75][ [i][b][color=#B50158]Dodano:[/b] Dzisiaj o 23:59[/i] ][/size] [/color] [quote][quote]Logfile of The Avenger version 1, by Swandog46 Running from registry key: \Registry\Machine\System\CurrentControlSet\Services\mqxcdqxh ******************* Script file located at: \??\C:\Program Files\nrcmkpbv.txt Script file opened successfully. Script file read successfully Backups directory opened successfully at C:\Avenger ******************* Beginning to process script file: File C:\WINDOWS\SYSTEM32\tftsvr.dll not found! Deletion of file C:\WINDOWS\SYSTEM32\tftsvr.dll failed! Could not process line: C:\WINDOWS\SYSTEM32\tftsvr.dll Status: 0xc0000034 File C:\WINDOWS\system32\clcl6.exe deleted successfully. Completed script processing. ******************* Finished! Terminate.[/quote][code] comboscan ComboScan v20070306.20 run by Michał on 2007-04-24 at 23:21:40 Computer is in Normal Mode. -------------------------------------------------------------------------------- -- System Restore -------------------------------------------------------------- Successfully created ComboScan Restore Point. -- Last 5 Restore Point(s) -- 6: 2007-04-24 21:21:46 UTC - RP106 - ComboScan Restore Point 5: 2007-04-23 23:16:50 UTC - RP105 - Punkt kontrolny systemu 4: 2007-04-22 16:10:07 UTC - RP104 - Punkt kontrolny systemu 3: 2007-04-21 00:39:44 UTC - RP103 - Punkt kontrolny systemu 2: 2007-04-19 14:01:15 UTC - RP102 - Punkt kontrolny systemu -- First Restore Point -- 1: 2007-04-18 10:06:28 UTC - RP101 - Punkt kontrolny systemu Performed disk cleanup. -- HijackThis (run as Michał.exe) ---------------------------------------------- Logfile of HijackThis v1.99.1 Scan saved at 23:24:14, on 2007-04-24 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\Explorer.EXE C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\WINDOWS\Avast vir\AVG\AVG Anti-Spyware 7.5\avgas.exe C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe C:\Program Files\Gadu-Gadu\gg.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe C:\WINDOWS\system32\devldr32.exe C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe C:\WINDOWS\Avast vir\AVG\AVG Anti-Spyware 7.5\guard.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\wscntfy.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpoSTS08.exe E:\fixing\comboscan.exe C:\PROGRA~1\HIJACK~1\Michał.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.onet.pl/ R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigURL = http://proxy.voltronik.pl/auto.pac R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {1557B435-8242-4686-9AA3-9265BF7525A4} - C:\WINDOWS\system32\tmpA.tmp.dll (file missing) O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [BootService] rundll32.exe "C:\WINDOWS\iiihee.dll",realset O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\WINDOWS\Avast vir\AVG\AVG Anti-Spyware 7.5\avgas.exe" /minimized O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE O4 - Global Startup: hpoddt01.exe.lnk = ? O4 - Global Startup: hp psc 2000 Series.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O17 - HKLM\System\CCS\Services\Tcpip\..\{7CB68327-C4BF-4276-A179-DFDFB5E3CA28}: NameServer = 89.234.202.2,89.234.192.3 O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing) O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing) O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\WINDOWS\Avast vir\AVG\AVG Anti-Spyware 7.5\guard.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPod Service - Unknown owner - C:\Program Files\iPod\bin\iPodService.exe (file missing) O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe -- File Associations ----------------------------------------------------------- .bat - batfile - "%1" %* .chm - chm.file - "C:\WINDOWS\hh.exe" %1 .cmd - cmdfile - "%1" %* .com - comfile - "%1" %* .exe - exefile - "%1" %* .hlp - hlpfile - %SystemRoot%\System32\winhlp32.exe %1 .inf - inffile - %SystemRoot%\System32\NOTEPAD.EXE %1 .ini - inifile - %SystemRoot%\System32\NOTEPAD.EXE %1 .js - JSFile - %SystemRoot%\System32\WScript.exe "%1" %* .lnk - lnkfile - {00021401-0000-0000-C000-000000000046} .pif - piffile - "%1" %* .reg - regfile - regedit.exe "%1" .scr - scrfile - "%1" /S .txt - txtfile - %SystemRoot%\system32\NOTEPAD.EXE %1 .vbs - VBSFile - %SystemRoot%\System32\WScript.exe "%1" %* -- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------- 1R Aavmker4 (avast! Asynchronous Virus Monitor) - C:\WINDOWS\system32\drivers\aavmker4.sys 2R aswMon2 (avast! Standard Shield Support) - C:\WINDOWS\system32\drivers\aswmon2.sys 3R aswRdr - C:\WINDOWS\system32\drivers\aswRdr.sys 1R aswTdi (avast! Network Shield Support) - C:\WINDOWS\system32\drivers\aswTdi.sys 1R AVG Anti-Spyware Driver - C:\WINDOWS\Avast vir\AVG\AVG Anti-Spyware 7.5\guard.sys 1R AvgAsCln (AVG Anti-Spyware Clean Driver) - C:\WINDOWS\system32\drivers\AvgAsCln.sys 3R ctljystk (Port gier dla karty Creative SB Live!) - C:\WINDOWS\system32\drivers\ctljystk.sys 3R emu10k (Creative SB Live! (WDM)) - C:\WINDOWS\system32\drivers\emu10k1m.sys 3R emu10k1 (Sterownik Creative Interface Manager (WDM)) - C:\WINDOWS\system32\drivers\ctlfacem.sys 3S HPZid412 (IEEE-1284.4 Driver HPZid412) - C:\WINDOWS\system32\drivers\hpzid412.sys 3S HPZipr12 (Print Class Driver for IEEE-1284.4 HPZipr12) - C:\WINDOWS\system32\drivers\HPZipr12.sys 3S HPZius12 (USB to IEEE-1284.4 Translation Driver HPZius12) - C:\WINDOWS\system32\drivers\HPZius12.sys 2S IcRecUsb (IC Recorder Driver) - C:\WINDOWS\system32\drivers\IcRecUsb.sys 3R nv - C:\WINDOWS\system32\drivers\nv4_mini.sys 0R PxHelp20 - C:\WINDOWS\system32\drivers\PxHelp20.sys 3R rtl8139 (Sterownik NT karty Realtek RTL8139(A/B/C)-based PCI Fast Ethernet) - C:\WINDOWS\system32\drivers\RTL8139.sys 3R sfman (Sterownik Creative SoundFont Manager (WDM)) - C:\WINDOWS\system32\drivers\sfmanm.sys 1R StarOpen - C:\WINDOWS\system32\drivers\StarOpen.sys 3S usbccgp (Rodzajowy sterownik nadrzędny USB Microsoft) - C:\WINDOWS\system32\drivers\usbccgp.sys 3S usbprint (Klasa PRINTER USB Microsoft) - C:\WINDOWS\system32\drivers\usbprint.sys 3S usbscan (Sterownik skanera USB) - C:\WINDOWS\system32\drivers\usbscan.sys 3S USBSTOR (Sterownik magazynu masowego USB) - C:\WINDOWS\system32\drivers\USBSTOR.SYS -- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled -------------------- 3S aspnet_state (ASP.NET State Service) - C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe 2R aswUpdSv (avast! iAVS4 Control Service) - "C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe" 2R avast! Antivirus - "C:\Program Files\Alwil Software\Avast4\ashServ.exe" 3R avast! Mail Scanner - "C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service 3R avast! Web Scanner - "C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service 2R AVG Anti-Spyware Guard - C:\WINDOWS\Avast vir\AVG\AVG Anti-Spyware 7.5\guard.exe 3S clr_optimization_v2.0.50727_32 (.NET Runtime Optimization Service v2.0.50727_X86) - C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe 3S gusvc (Google Updater Service) - "C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe" 3S IDriverT (InstallDriver Table Manager) - "C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe" 3S iPod Service - "C:\Program Files\iPod\bin\iPodService.exe" 2R NVSvc (NVIDIA Display Driver Service) - C:\WINDOWS\system32\nvsvc32.exe 3S Pml Driver HPZ12 - C:\WINDOWS\system32\HPZipm12.exe -- Scheduled Tasks ------------------------------------------------------------- 2007-05-28 17:07:12 392 --a------ C:\WINDOWS\Tasks\FRU Task #Hewlett-Packard#hp psc 2170 series#1167753967.job<FRUTAS~1.JOB> 2007-05-28 17:07:10 446 --a------ C:\WINDOWS\Tasks\WebReg 20070528170708.job<WEBREG~1.JOB> -- Files created between 2007-03-24 and 2007-04-24 ----------------------------- 2007-06-07 19:35:25 24 --a------ C:\WINDOWS\system32\sysmwwod.dll 2007-06-07 19:31:24 360448 --a------ C:\WINDOWS\system32\NCTWMAFile.dll<NCTWMA~1.DLL> 2007-06-07 19:31:23 1703936 --a------ C:\WINDOWS\system32\NCTAudioFile.dll<NCTAUD~1.DLL> 2007-06-07 19:31:21 233472 --a------ C:\WINDOWS\system32\lame_enc.dll 2007-05-31 18:31:56 0 d--h----- C:\WINDOWS\PIF 2007-05-30 07:02:12 5632 --a------ C:\WINDOWS\system32\drivers\StarOpen.sys 2007-05-30 06:51:50 0 d-------- C:\WINDOWS\system32\Samsung PC Studio Codecs<SAMSUN~2> 2007-05-30 06:51:26 684032 --a------ C:\WINDOWS\system32\fun_mp4_enc.dll<FUN_MP~2.DLL> 2007-05-30 06:51:26 77824 --a------ C:\WINDOWS\system32\fun_mp4_dec.dll<FUN_MP~1.DLL> 2007-05-30 06:51:25 2729472 --a------ C:\WINDOWS\system32\fun_avcodec.dll<FUN_AV~1.DLL> 2007-05-30 06:50:48 0 d-------- C:\WINDOWS\system32\Samsung_USB_Drivers<SAMSUN~1> 2007-04-24 22:38:50 0 d-------- C:\fixwareout<FIXWAR~1> 2007-04-24 22:22:54 3968 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys 2007-04-24 19:37:32 0 d-------- C:\WINDOWS\system32\Kaspersky Lab<KASPER~1> 2007-04-24 18:23:37 0 d-------- C:\Program Files\SkanerOnline<SKANER~1> 2007-04-24 17:51:41 0 d-------- C:\WINDOWS\system32\ActiveScan<ACTIVE~1> 2007-04-06 00:14:56 3624960 --a------ C:\WINDOWS\system32\mkgpmp.exe 2007-04-06 00:14:56 1700352 --a------ C:\WINDOWS\system32\gdiplus.dll 2007-04-06 00:14:56 61440 --a------ C:\WINDOWS\system32\cygz.dll 2007-04-06 00:14:56 1295582 --a------ C:\WINDOWS\system32\cygwin1.dll 2007-04-06 00:13:43 61 --a------ C:\WINDOWS\system32\buyurl0502.dat<BUYURL~1.DAT> 2007-04-01 12:52:36 50016 -ra------ C:\WINDOWS\system\IYVU9.DLL 2007-04-01 12:52:35 49616 -ra------ C:\WINDOWS\system\MSACM.DLL 2007-04-01 12:52:35 151056 -ra------ C:\WINDOWS\system\IR32.DLL 2007-04-01 12:52:35 77664 -ra------ C:\WINDOWS\system\IR21.DLL 2007-04-01 12:52:35 1116 -ra------ C:\WINDOWS\MPLAYER.REG 2007-04-01 12:52:35 117536 -ra------ C:\WINDOWS\MPLAYER.EXE 2007-04-01 12:52:35 12288 -ra------ C:\WINDOWS\MCIOLE.DLL 2007-04-01 12:52:34 153312 --a------ C:\WINDOWS\system\TYPELIB.DLL 2007-04-01 12:52:34 157184 --a------ C:\WINDOWS\system\STORAGE.DLL 2007-04-01 12:52:34 55808 --a------ C:\WINDOWS\system\OLE2PROX.DLL 2007-04-01 12:52:34 147440 --a------ C:\WINDOWS\system\OLE2NLS.DLL 2007-04-01 12:52:34 98336 --a------ C:\WINDOWS\system\OLE2DISP.DLL 2007-04-01 12:52:34 57328 --a------ C:\WINDOWS\system\OLE2CONV.DLL 2007-04-01 12:52:34 24606 -ra------ C:\WINDOWS\system\OLE2.REG 2007-04-01 12:52:33 188960 -ra------ C:\WINDOWS\system\WINGDE.DLL 2007-04-01 12:52:33 12800 -ra------ C:\WINDOWS\system\WING32.DLL 2007-04-01 12:52:33 92208 -ra------ C:\WINDOWS\system\WING.DLL 2007-04-01 12:52:33 313344 --a------ C:\WINDOWS\system\OLE2.DLL 2007-04-01 12:52:33 7168 --a------ C:\WINDOWS\system\DISPDIB.DLL 2007-04-01 12:52:33 14208 --a------ C:\WINDOWS\system\CTL3D.DLL 2007-04-01 12:52:33 102400 --a------ C:\WINDOWS\system\COMPOBJ.DLL 2007-04-01 12:52:33 87 --a------ C:\WINDOWS\system\CLEANUP.REG 2007-04-01 12:52:33 12800 --a------ C:\WINDOWS\system\ACMCMPRS.DLL 2007-04-01 12:52:32 0 d-------- C:\MMAPP 2007-03-29 09:54:12 0 d-------- C:\Program Files\Video Access ActiveX Object<VIDEOA~1> -- Find3M Report --------------------------------------------------------------- 2007-05-30 07:12:24 0 d-------- C:\Documents and Settings\Michał\Dane aplikacji\TransRender<TRANSR~1> 2007-05-30 07:12:24 0 d-------- C:\Documents and Settings\Michał\Dane aplikacji\Temporary<TEMPOR~1> 2007-05-30 07:12:24 0 d-------- C:\Documents and Settings\Michał\Dane aplikacji\ConvertTemp<CONVER~1> 2007-05-30 07:09:06 0 d-------- C:\Documents and Settings\Michał\Dane aplikacji\Samsung 2007-04-18 18:17:00 733824 --a------ C:\WINDOWS\system32\aswBoot.exe 2007-04-18 18:07:00 90112 --a------ C:\WINDOWS\system32\AVASTSS.scr 2007-03-18 21:43:22 0 d-------- C:\Program Files\Common Files\SWF Studio<SWFSTU~1> 2007-03-10 20:54:40 0 d-------- C:\Program Files\Winamp 2007-03-06 15:10:54 0 d-------- C:\Program Files\PANASONIC<PANASO~1> 2007-03-06 15:10:52 0 d--h----- C:\Program Files\InstallShield Installation Information<INSTAL~1> 2007-03-06 12:01:16 0 d-------- C:\Documents and Settings\Michał\Dane aplikacji\Apple Computer<APPLEC~1> 2007-03-06 11:58:58 0 d-------- C:\Program Files\QuickTime<QUICKT~1> -- Registry Dump --------------------------------------------------------------- [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run] "swg"="C:\\Program Files\\Google\\GoogleToolbarNotifier\\1.2.1128.5462\\GoogleToolbarNotifier.exe" "Gadu-Gadu"="\"C:\\Program Files\\Gadu-Gadu\\gg.exe\" /tray" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run] "NvCplDaemon"="RUNDLL32.EXE C:\\WINDOWS\\system32\\NvCpl.dll,NvStartup" "nwiz"="nwiz.exe /install" "NvMediaCenter"="RUNDLL32.EXE C:\\WINDOWS\\system32\\NvMcTray.dll,NvTaskbarInit" "avast!"="C:\\PROGRA~1\\ALWILS~1\\Avast4\\ashDisp.exe" "QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime" "BootService"="rundll32.exe \"C:\\WINDOWS\\iiihee.dll\",realset" "!AVG Anti-Spyware"="\"C:\\WINDOWS\\Avast vir\\AVG\\AVG Anti-Spyware 7.5\\avgas.exe\" /minimized" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\IMAIL] "Installed"="1" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MAPI] "Installed"="1" "NoChange"="1" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MSFS] "Installed"="1" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks] "{57B86673-276A-48B2-BAE7-C6DBB3020EB8}"="AVG Anti-Spyware 7.5" [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system] "DisableRegistryTools"=dword:00000000 [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] "NoLowDiskSpaceChecks"=dword:00000001 [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders] "SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll" [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Svchost] HTTPFilter REG_MULTI_SZ HTTPFilter\0\0 LocalService REG_MULTI_SZ Alerter\0WebClient\0LmHosts\0RemoteRegistry\0upnphost\0SSDPSRV\0\0 NetworkService REG_MULTI_SZ DnsCache\0\0 DcomLaunch REG_MULTI_SZ DcomLaunch\0TermService\0\0 rpcss REG_MULTI_SZ RpcSs\0\0 imgsvc REG_MULTI_SZ StiSvc\0\0 termsvcs REG_MULTI_SZ TermService\0\0 -- End of ComboScan: finished at 2007-04-24 at 23:25:00 ------------------------[/quote][/quote]

czy teraz wszystko jest już ok??

**Posty:** 4043 · przez **prog** 25 Kwi 2007, 08:27

Mamy taki pliczek:
C:\WINDOWS\iiihee.dll

Ściągnij proszę Pocket Killbox.

Zaznaczasz opcje delete on reboot. W polu full path of file to delete wpisujesz podaną przezemnie ścieżkę do pliku i klikasz X (zgadzasz się na restart).

Potem w hijacku fiksujesz (fix checked) te wpisy:

O2 - BHO: (no name) - {1557B435-8242-4686-9AA3-9265BF7525A4} - C:\WINDOWS\system32\tmpA.tmp.dll (file missing)
O4 - HKLM\..\Run: [BootService] rundll32.exe "C:\WINDOWS\iiihee.dll",realset

**Posty:** 15 · przez **funky11** 25 Kwi 2007, 09:32

Ale niestety w killboxsie wyskoczyło mi: "Pending File Rename Operations Data has beedn Removed by external process" - wiec nie było restartu

W HJ wykonałem zalecaną operację a poniżej log z nigo

Czy teraz wszystko OK?

Logfile of HijackThis v1.99.1
Scan saved at 09:15:05, on 2007-04-25
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
C:\Program Files\Gadu-Gadu\gg.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\WINDOWS\system32\devldr32.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\Grisoft\AVG7\avgfwsrv.exe
C:\WINDOWS\system32\wscntfy.exe
E:\fixing\HijackThis\Michał.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.onet.pl/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigURL = http://proxy.voltronik.pl/auto.pac
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray
O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O10 - Unknown file in Winsock LSP: c:\windows\system32\avgfwafu.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\avgfwafu.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\avgfwafu.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\avgfwafu.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\avgfwafu.dll
O17 - HKLM\System\CCS\Services\Tcpip\..\{7CB68327-C4BF-4276-A179-DFDFB5E3CA28}: NameServer = 89.234.202.2,89.234.192.3
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: AVG Firewall (AVGFwSrv) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgfwsrv.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Unknown owner - C:\Program Files\iPod\bin\iPodService.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

**Posty:** 8694 · przez **Red** 25 Kwi 2007, 09:40

ok...ale daj jeszcze log z ComboScan

**Posty:** 15 · przez **funky11** 25 Kwi 2007, 10:33

Jeśli ten log z Combosa będzie poprawny i bez żadnych błędów chciałbym bardzo bardzo serdecznie podziękować wszystkim którzy mi pomogli. Nie sądziłem że będąc w sieci spotkam tylu życzliwych ludzi którzy ofiarują swoją bezinteresowną pomoc.

Wielki szasun dla admin, moderatora i wszystkich obsługujących stronę za wiedzę i fachowę porady dla takich laików ja ja

ComboScan v20070306.20 run by Michał on 2007-04-25 at 10:15:51
Computer is in Normal Mode.
--------------------------------------------------------------------------------

-- HijackThis (run as Michał.exe) ----------------------------------------------

Logfile of HijackThis v1.99.1
Scan saved at 10:15:52, on 2007-04-25
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
C:\Program Files\Gadu-Gadu\gg.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\WINDOWS\system32\devldr32.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\Grisoft\AVG7\avgfwsrv.exe
C:\WINDOWS\system32\wscntfy.exe
E:\fixing\comboscan.exe
E:\fixing\HIJACK~1\MICHAŁ.EXE

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.onet.pl/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigURL = http://proxy.voltronik.pl/auto.pac
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray
O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O10 - Unknown file in Winsock LSP: c:\windows\system32\avgfwafu.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\avgfwafu.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\avgfwafu.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\avgfwafu.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\avgfwafu.dll
O17 - HKLM\System\CCS\Services\Tcpip\..\{7CB68327-C4BF-4276-A179-DFDFB5E3CA28}: NameServer = 89.234.202.2,89.234.192.3
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: AVG Firewall (AVGFwSrv) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgfwsrv.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Unknown owner - C:\Program Files\iPod\bin\iPodService.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

-- Files created between 2007-03-25 and 2007-04-25 -----------------------------

2007-06-07 19:35:25 24 --a------ C:\WINDOWS\system32\sysmwwod.dll
2007-06-07 19:31:24 360448 --a------ C:\WINDOWS\system32\NCTWMAFile.dll<NCTWMA~1.DLL>
2007-06-07 19:31:23 1703936 --a------ C:\WINDOWS\system32\NCTAudioFile.dll<NCTAUD~1.DLL>
2007-06-07 19:31:21 233472 --a------ C:\WINDOWS\system32\lame_enc.dll
2007-05-31 18:31:56 0 d--h----- C:\WINDOWS\PIF
2007-05-30 07:02:12 5632 --a------ C:\WINDOWS\system32\drivers\StarOpen.sys
2007-05-30 06:51:26 684032 --a------ C:\WINDOWS\system32\fun_mp4_enc.dll<FUN_MP~2.DLL>
2007-05-30 06:51:26 77824 --a------ C:\WINDOWS\system32\fun_mp4_dec.dll<FUN_MP~1.DLL>
2007-05-30 06:51:25 2729472 --a------ C:\WINDOWS\system32\fun_avcodec.dll<FUN_AV~1.DLL>
2007-04-25 09:06:21 0 d-------- C:\!KillBox
2007-04-25 01:11:19 4960 --a------ C:\WINDOWS\system32\drivers\avgtdi.sys
2007-04-25 01:11:19 19840 --a------ C:\WINDOWS\system32\drivers\avgmfx86.sys
2007-04-25 01:11:19 3968 --a------ C:\WINDOWS\system32\drivers\avgclean.sys
2007-04-25 01:11:19 110592 --a------ C:\WINDOWS\system32\avgfwafu.dll
2007-04-25 01:11:18 27776 --a------ C:\WINDOWS\system32\drivers\avg7rsxp.sys
2007-04-25 01:11:18 4224 --a------ C:\WINDOWS\system32\drivers\avg7rsw.sys
2007-04-25 01:11:18 778432 --a------ C:\WINDOWS\system32\drivers\avg7core.sys
2007-04-25 01:11:02 0 d-------- C:\Program Files\Grisoft
2007-04-24 17:51:41 0 d-------- C:\WINDOWS\system32\ActiveScan<ACTIVE~1>
2007-04-06 00:14:56 3624960 --a------ C:\WINDOWS\system32\mkgpmp.exe
2007-04-06 00:14:56 1700352 --a------ C:\WINDOWS\system32\gdiplus.dll
2007-04-06 00:14:56 61440 --a------ C:\WINDOWS\system32\cygz.dll
2007-04-06 00:14:56 1295582 --a------ C:\WINDOWS\system32\cygwin1.dll
2007-04-06 00:13:43 61 --a------ C:\WINDOWS\system32\buyurl0502.dat<BUYURL~1.DAT>
2007-04-01 12:52:36 50016 -ra------ C:\WINDOWS\system\IYVU9.DLL
2007-04-01 12:52:35 49616 -ra------ C:\WINDOWS\system\MSACM.DLL
2007-04-01 12:52:35 151056 -ra------ C:\WINDOWS\system\IR32.DLL
2007-04-01 12:52:35 77664 -ra------ C:\WINDOWS\system\IR21.DLL
2007-04-01 12:52:35 1116 -ra------ C:\WINDOWS\MPLAYER.REG
2007-04-01 12:52:35 117536 -ra------ C:\WINDOWS\MPLAYER.EXE
2007-04-01 12:52:35 12288 -ra------ C:\WINDOWS\MCIOLE.DLL
2007-04-01 12:52:34 153312 --a------ C:\WINDOWS\system\TYPELIB.DLL
2007-04-01 12:52:34 157184 --a------ C:\WINDOWS\system\STORAGE.DLL
2007-04-01 12:52:34 55808 --a------ C:\WINDOWS\system\OLE2PROX.DLL
2007-04-01 12:52:34 147440 --a------ C:\WINDOWS\system\OLE2NLS.DLL
2007-04-01 12:52:34 98336 --a------ C:\WINDOWS\system\OLE2DISP.DLL
2007-04-01 12:52:34 57328 --a------ C:\WINDOWS\system\OLE2CONV.DLL
2007-04-01 12:52:34 24606 -ra------ C:\WINDOWS\system\OLE2.REG
2007-04-01 12:52:33 188960 -ra------ C:\WINDOWS\system\WINGDE.DLL
2007-04-01 12:52:33 12800 -ra------ C:\WINDOWS\system\WING32.DLL
2007-04-01 12:52:33 92208 -ra------ C:\WINDOWS\system\WING.DLL
2007-04-01 12:52:33 313344 --a------ C:\WINDOWS\system\OLE2.DLL
2007-04-01 12:52:33 7168 --a------ C:\WINDOWS\system\DISPDIB.DLL
2007-04-01 12:52:33 14208 --a------ C:\WINDOWS\system\CTL3D.DLL
2007-04-01 12:52:33 102400 --a------ C:\WINDOWS\system\COMPOBJ.DLL
2007-04-01 12:52:33 87 --a------ C:\WINDOWS\system\CLEANUP.REG
2007-04-01 12:52:33 12800 --a------ C:\WINDOWS\system\ACMCMPRS.DLL
2007-04-01 12:52:32 0 d-------- C:\MMAPP
2007-03-29 09:54:12 0 d-------- C:\Program Files\Video Access ActiveX Object<VIDEOA~1>

-- Find3M Report ---------------------------------------------------------------

2007-05-30 07:12:24 0 d-------- C:\Documents and Settings\Michał\Dane aplikacji\TransRender<TRANSR~1>
2007-05-30 07:12:24 0 d-------- C:\Documents and Settings\Michał\Dane aplikacji\Temporary<TEMPOR~1>
2007-05-30 07:12:24 0 d-------- C:\Documents and Settings\Michał\Dane aplikacji\ConvertTemp<CONVER~1>
2007-05-30 07:09:06 0 d-------- C:\Documents and Settings\Michał\Dane aplikacji\Samsung
2007-04-25 01:11:24 0 d-------- C:\Documents and Settings\Michał\Dane aplikacji\AVG7
2007-03-18 21:43:22 0 d-------- C:\Program Files\Common Files\SWF Studio<SWFSTU~1>
2007-03-10 20:54:40 0 d-------- C:\Program Files\Winamp
2007-03-06 15:10:52 0 d--h----- C:\Program Files\InstallShield Installation Information<INSTAL~1>
2007-03-06 12:01:16 0 d-------- C:\Documents and Settings\Michał\Dane aplikacji\Apple Computer<APPLEC~1>
2007-03-06 11:58:58 0 d-------- C:\Program Files\QuickTime<QUICKT~1>

-- Registry Dump ---------------------------------------------------------------

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run]
"swg"="C:\\Program Files\\Google\\GoogleToolbarNotifier\\1.2.1128.5462\\GoogleToolbarNotifier.exe"
"Gadu-Gadu"="\"C:\\Program Files\\Gadu-Gadu\\gg.exe\" /tray"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run]
"NvMediaCenter"="RUNDLL32.EXE C:\\WINDOWS\\system32\\NvMcTray.dll,NvTaskbarInit"
"AVG7_CC"="C:\\PROGRA~1\\Grisoft\\AVG7\\avgcc.exe /STARTUP"
"NvCplDaemon"="RUNDLL32.EXE C:\\WINDOWS\\system32\\NvCpl.dll,NvStartup"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\IMAIL]
"Installed"="1"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MAPI]
"Installed"="1"
"NoChange"="1"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MSFS]
"Installed"="1"

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"AVG7_Run"="C:\\PROGRA~1\\Grisoft\\AVG7\\avgw.exe /RUNONCE"

[HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\run]
"AVG7_Run"="C:\\PROGRA~1\\Grisoft\\AVG7\\avgw.exe /RUNONCE"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"DisableRegistryTools"=dword:00000000

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoLowDiskSpaceChecks"=dword:00000001

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll"

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Svchost]
HTTPFilter REG_MULTI_SZ HTTPFilter\0\0
LocalService REG_MULTI_SZ Alerter\0WebClient\0LmHosts\0RemoteRegistry\0upnphost\0SSDPSRV\0\0
NetworkService REG_MULTI_SZ DnsCache\0\0
DcomLaunch REG_MULTI_SZ DcomLaunch\0TermService\0\0
rpcss REG_MULTI_SZ RpcSs\0\0
imgsvc REG_MULTI_SZ StiSvc\0\0
termsvcs REG_MULTI_SZ TermService\0\0

-- End of ComboScan: finished at 2007-04-25 at 10:16:22 ------------------------

Pzdr

**Posty:** 4043 · przez **prog** 25 Kwi 2007, 10:53

Wygląda, że OK.
Sprawdzałem na szybko bo już musze wychodzić.
Poczekaj jeszcze na kogoś innego.

**Posty:** 15 · przez **funky11** 25 Kwi 2007, 10:59

Ok dzięki bardzo
.....i czekam na tego kogoś:)

**Posty:** 8694 · przez **Red** 25 Kwi 2007, 11:09

Zastosuj jeszcze koniecznie:

http://www.geekstogo.com/modules.php?modid=5&action=download&id=80

odpal go z opcji 2 i po restarcie daj raz jeszcze log do sprawdzenia> ComboScan

Musimy sie pozbyc:

C:\Program Files\Video Access ActiveX Object<VIDEOA~1>

**Posty:** 15 · przez **funky11** 25 Kwi 2007, 11:33

Sorki ale nie bardzo wiem co mam zainstalować

Prawdopodobnie nie mam uprawnień do zciagnięcia programu bo go nawet nie widzę.

Jest tylko forum podobne do tego co tu

**Posty:** 8694 · przez **Red** 25 Kwi 2007, 11:35

sorrry:

http://siri.urz.free.fr/Fix/SmitfraudFix_En.php

http://siri.urz.free.fr/Fix/SmitfraudFix.zip

odpalisz go z opcji 2

**Posty:** 15 · przez **funky11** 25 Kwi 2007, 12:24

załączam Log z Comboscana:

ComboScan v20070306.20 run by Michał on 2007-04-25 at 12:08:35
Computer is in Normal Mode.
--------------------------------------------------------------------------------

-- HijackThis (run as Michał.exe) ----------------------------------------------

Logfile of HijackThis v1.99.1
Scan saved at 12:08:41, on 2007-04-25
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
C:\Program Files\Gadu-Gadu\gg.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\WINDOWS\system32\devldr32.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\Grisoft\AVG7\avgfwsrv.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\wuauclt.exe
E:\fixing\comboscan.exe
E:\fixing\HIJACK~1\MICHAŁ.EXE

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigURL = http://proxy.voltronik.pl/auto.pac
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray
O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O10 - Unknown file in Winsock LSP: c:\windows\system32\avgfwafu.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\avgfwafu.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\avgfwafu.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\avgfwafu.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\avgfwafu.dll
O17 - HKLM\System\CCS\Services\Tcpip\..\{7CB68327-C4BF-4276-A179-DFDFB5E3CA28}: NameServer = 89.234.202.2,89.234.192.3
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: AVG Firewall (AVGFwSrv) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgfwsrv.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Unknown owner - C:\Program Files\iPod\bin\iPodService.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

-- Files created between 2007-03-25 and 2007-04-25 -----------------------------

2007-06-07 19:35:25 24 --a------ C:\WINDOWS\system32\sysmwwod.dll
2007-06-07 19:31:24 360448 --a------ C:\WINDOWS\system32\NCTWMAFile.dll<NCTWMA~1.DLL>
2007-06-07 19:31:23 1703936 --a------ C:\WINDOWS\system32\NCTAudioFile.dll<NCTAUD~1.DLL>
2007-06-07 19:31:21 233472 --a------ C:\WINDOWS\system32\lame_enc.dll
2007-05-31 18:31:56 0 d--h----- C:\WINDOWS\PIF
2007-05-30 07:02:12 5632 --a------ C:\WINDOWS\system32\drivers\StarOpen.sys
2007-05-30 06:51:26 684032 --a------ C:\WINDOWS\system32\fun_mp4_enc.dll<FUN_MP~2.DLL>
2007-05-30 06:51:26 77824 --a------ C:\WINDOWS\system32\fun_mp4_dec.dll<FUN_MP~1.DLL>
2007-05-30 06:51:25 2729472 --a------ C:\WINDOWS\system32\fun_avcodec.dll<FUN_AV~1.DLL>
2007-04-25 11:39:29 1524 --a------ C:\WINDOWS\system32\tmp.reg
2007-04-25 11:39:00 79360 --a------ C:\WINDOWS\system32\swxcacls.exe
2007-04-25 11:39:00 40960 --a------ C:\WINDOWS\system32\swsc.exe
2007-04-25 11:39:00 135168 --a------ C:\WINDOWS\system32\swreg.exe
2007-04-25 11:39:00 288417 --a------ C:\WINDOWS\system32\SrchSTS.exe
2007-04-25 11:39:00 53248 --a------ C:\WINDOWS\system32\Process.exe
2007-04-25 11:39:00 51200 --a------ C:\WINDOWS\system32\dumphive.exe
2007-04-25 09:06:21 0 d-------- C:\!KillBox
2007-04-25 01:11:19 4960 --a------ C:\WINDOWS\system32\drivers\avgtdi.sys
2007-04-25 01:11:19 19840 --a------ C:\WINDOWS\system32\drivers\avgmfx86.sys
2007-04-25 01:11:19 3968 --a------ C:\WINDOWS\system32\drivers\avgclean.sys
2007-04-25 01:11:19 110592 --a------ C:\WINDOWS\system32\avgfwafu.dll
2007-04-25 01:11:18 27776 --a------ C:\WINDOWS\system32\drivers\avg7rsxp.sys
2007-04-25 01:11:18 4224 --a------ C:\WINDOWS\system32\drivers\avg7rsw.sys
2007-04-25 01:11:18 778432 --a------ C:\WINDOWS\system32\drivers\avg7core.sys
2007-04-25 01:11:02 0 d-------- C:\Program Files\Grisoft
2007-04-24 17:51:41 0 d-------- C:\WINDOWS\system32\ActiveScan<ACTIVE~1>
2007-04-06 00:14:56 3624960 --a------ C:\WINDOWS\system32\mkgpmp.exe
2007-04-06 00:14:56 1700352 --a------ C:\WINDOWS\system32\gdiplus.dll
2007-04-06 00:14:56 61440 --a------ C:\WINDOWS\system32\cygz.dll
2007-04-06 00:14:56 1295582 --a------ C:\WINDOWS\system32\cygwin1.dll
2007-04-06 00:13:43 61 --a------ C:\WINDOWS\system32\buyurl0502.dat<BUYURL~1.DAT>
2007-04-01 12:52:36 50016 -ra------ C:\WINDOWS\system\IYVU9.DLL
2007-04-01 12:52:35 49616 -ra------ C:\WINDOWS\system\MSACM.DLL
2007-04-01 12:52:35 151056 -ra------ C:\WINDOWS\system\IR32.DLL
2007-04-01 12:52:35 77664 -ra------ C:\WINDOWS\system\IR21.DLL
2007-04-01 12:52:35 1116 -ra------ C:\WINDOWS\MPLAYER.REG
2007-04-01 12:52:35 117536 -ra------ C:\WINDOWS\MPLAYER.EXE
2007-04-01 12:52:35 12288 -ra------ C:\WINDOWS\MCIOLE.DLL
2007-04-01 12:52:34 153312 --a------ C:\WINDOWS\system\TYPELIB.DLL
2007-04-01 12:52:34 157184 --a------ C:\WINDOWS\system\STORAGE.DLL
2007-04-01 12:52:34 55808 --a------ C:\WINDOWS\system\OLE2PROX.DLL
2007-04-01 12:52:34 147440 --a------ C:\WINDOWS\system\OLE2NLS.DLL
2007-04-01 12:52:34 98336 --a------ C:\WINDOWS\system\OLE2DISP.DLL
2007-04-01 12:52:34 57328 --a------ C:\WINDOWS\system\OLE2CONV.DLL
2007-04-01 12:52:34 24606 -ra------ C:\WINDOWS\system\OLE2.REG
2007-04-01 12:52:33 188960 -ra------ C:\WINDOWS\system\WINGDE.DLL
2007-04-01 12:52:33 12800 -ra------ C:\WINDOWS\system\WING32.DLL
2007-04-01 12:52:33 92208 -ra------ C:\WINDOWS\system\WING.DLL
2007-04-01 12:52:33 313344 --a------ C:\WINDOWS\system\OLE2.DLL
2007-04-01 12:52:33 7168 --a------ C:\WINDOWS\system\DISPDIB.DLL
2007-04-01 12:52:33 14208 --a------ C:\WINDOWS\system\CTL3D.DLL
2007-04-01 12:52:33 102400 --a------ C:\WINDOWS\system\COMPOBJ.DLL
2007-04-01 12:52:33 87 --a------ C:\WINDOWS\system\CLEANUP.REG
2007-04-01 12:52:33 12800 --a------ C:\WINDOWS\system\ACMCMPRS.DLL
2007-04-01 12:52:32 0 d-------- C:\MMAPP

-- Find3M Report ---------------------------------------------------------------

2007-05-30 07:12:24 0 d-------- C:\Documents and Settings\Michał\Dane aplikacji\TransRender<TRANSR~1>
2007-05-30 07:12:24 0 d-------- C:\Documents and Settings\Michał\Dane aplikacji\Temporary<TEMPOR~1>
2007-05-30 07:12:24 0 d-------- C:\Documents and Settings\Michał\Dane aplikacji\ConvertTemp<CONVER~1>
2007-05-30 07:09:06 0 d-------- C:\Documents and Settings\Michał\Dane aplikacji\Samsung
2007-04-25 01:11:24 0 d-------- C:\Documents and Settings\Michał\Dane aplikacji\AVG7
2007-03-18 21:43:22 0 d-------- C:\Program Files\Common Files\SWF Studio<SWFSTU~1>
2007-03-10 20:54:40 0 d-------- C:\Program Files\Winamp
2007-03-06 15:10:52 0 d--h----- C:\Program Files\InstallShield Installation Information<INSTAL~1>
2007-03-06 12:01:16 0 d-------- C:\Documents and Settings\Michał\Dane aplikacji\Apple Computer<APPLEC~1>
2007-03-06 11:58:58 0 d-------- C:\Program Files\QuickTime<QUICKT~1>

-- Registry Dump ---------------------------------------------------------------

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run]
"swg"="C:\\Program Files\\Google\\GoogleToolbarNotifier\\1.2.1128.5462\\GoogleToolbarNotifier.exe"
"Gadu-Gadu"="\"C:\\Program Files\\Gadu-Gadu\\gg.exe\" /tray"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run]
"NvMediaCenter"="RUNDLL32.EXE C:\\WINDOWS\\system32\\NvMcTray.dll,NvTaskbarInit"
"AVG7_CC"="C:\\PROGRA~1\\Grisoft\\AVG7\\avgcc.exe /STARTUP"
"NvCplDaemon"="RUNDLL32.EXE C:\\WINDOWS\\system32\\NvCpl.dll,NvStartup"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\IMAIL]
"Installed"="1"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MAPI]
"Installed"="1"
"NoChange"="1"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MSFS]
"Installed"="1"

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"AVG7_Run"="C:\\PROGRA~1\\Grisoft\\AVG7\\avgw.exe /RUNONCE"

[HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\run]
"AVG7_Run"="C:\\PROGRA~1\\Grisoft\\AVG7\\avgw.exe /RUNONCE"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"DisableRegistryTools"=dword:00000000

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoLowDiskSpaceChecks"=dword:00000001

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll"

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Svchost]
HTTPFilter REG_MULTI_SZ HTTPFilter\0\0
LocalService REG_MULTI_SZ Alerter\0WebClient\0LmHosts\0RemoteRegistry\0upnphost\0SSDPSRV\0\0
NetworkService REG_MULTI_SZ DnsCache\0\0
DcomLaunch REG_MULTI_SZ DcomLaunch\0TermService\0\0
rpcss REG_MULTI_SZ RpcSs\0\0
imgsvc REG_MULTI_SZ StiSvc\0\0
termsvcs REG_MULTI_SZ TermService\0\0

-- End of ComboScan: finished at 2007-04-25 at 12:09:12 ------------------------

i raport z Smitfraudfix:

SmitFraudFix v2.171

Scan done at 11:39:18,89, 2007-04-25
Run from E:\fixing\SmitfraudFix
OS: Microsoft Windows XP [Wersja 5.1.2600] - Windows_NT
The filesystem type is FAT32
Fix run in normal mode

»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Before SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

»»»»»»»»»»»»»»»»»»»»»»»» Killing process

»»»»»»»»»»»»»»»»»»»»»»»» hosts

127.0.0.1 localhost

»»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix

GenericRenosFix by S!Ri

»»»»»»»»»»»»»»»»»»»»»»»» Deleting infected files

C:\Program Files\Video Access ActiveX Object\ Deleted

»»»»»»»»»»»»»»»»»»»»»»»» DNS

Description: Karta Realtek RTL8139 Family PCI Fast Ethernet NIC - Sterownik miniport Harmonogramu pakietów
DNS Server Search Order: 89.234.202.2
DNS Server Search Order: 89.234.192.3

HKLM\SYSTEM\CCS\Services\Tcpip\..\{7CB68327-C4BF-4276-A179-DFDFB5E3CA28}: NameServer=89.234.202.2,89.234.192.3
HKLM\SYSTEM\CS1\Services\Tcpip\..\{7CB68327-C4BF-4276-A179-DFDFB5E3CA28}: NameServer=89.234.202.2,89.234.192.3
HKLM\SYSTEM\CS2\Services\Tcpip\..\{7CB68327-C4BF-4276-A179-DFDFB5E3CA28}: NameServer=89.234.202.2,89.234.192.3

»»»»»»»»»»»»»»»»»»»»»»»» Deleting Temp Files

»»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
!!!Attention, following keys are not inevitably infected!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"System"=""

»»»»»»»»»»»»»»»»»»»»»»»» Registry Cleaning

Registry Cleaning done.

»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler After SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

»»»»»»»»»»»»»»»»»»»»»»»» End

**Posty:** 8694 · przez **Red** 25 Kwi 2007, 12:30

Jeszcze cos nie daje mi spokoju:

C:\WINDOWS\system32\sysmwwod.dll

mozesz to przeskanowac:

http://www.virustotal.com/flash/index_en.html
http://virusscan.jotti.org/de/

Czy jakis skaner okresli to jako wirus etc?Wklej wynik na forum.....

**Posty:** 15 · przez **funky11** 25 Kwi 2007, 12:45

WOW suuper programy. Obydwa jednak nic nie snalazły

Datei: sysmwwod.dll
Auslastung: 0% 100%

Status: OK
Entdeckte Packprogramme: -

A-Squared Keine Viren gefunden
AntiVir Keine Viren gefunden
ArcaVir Keine Viren gefunden
Avast Keine Viren gefunden
AVG Antivirus Keine Viren gefunden
BitDefender Keine Viren gefunden
ClamAV Keine Viren gefunden
Dr.Web Keine Viren gefunden
F-Prot Antivirus Keine Viren gefunden
F-Secure Anti-Virus Keine Viren gefunden
Fortinet Keine Viren gefunden
Kaspersky Anti-Virus Keine Viren gefunden
NOD32 Keine Viren gefunden
Norman Virus Control Keine Viren gefunden
Panda Antivirus Keine Viren gefunden
Rising Antivirus Keine Viren gefunden
VirusBuster Keine Viren gefunden
VBA32 Keine Viren gefunden

i ten drugi

STATUS: FINISHEDComplete scanning result of "sysmwwod.dll", received in VirusTotal at 04.25.2007, 12:23:32 (CET).

Antivirus Version Update Result
AhnLab-V3 2007.4.25.2 04.25.2007 no virus found
AntiVir 7.4.0.15 04.25.2007 no virus found
Authentium 4.93.8 04.24.2007 no virus found
Avast 4.7.981.0 04.23.2007 no virus found
AVG 7.5.0.464 04.24.2007 no virus found
BitDefender 7.2 04.25.2007 no virus found
CAT-QuickHeal 9.00 04.24.2007 no virus found
ClamAV devel-20070416 04.25.2007 no virus found
DrWeb 4.33 04.25.2007 no virus found
eSafe 7.0.15.0 04.23.2007 no virus found
eTrust-Vet 30.7.3594 04.25.2007 no virus found
Ewido 4.0 04.24.2007 no virus found
FileAdvisor 1 04.25.2007 no virus found
Fortinet 2.85.0.0 04.25.2007 no virus found
F-Prot 4.3.2.48 04.24.2007 no virus found
F-Secure 6.70.13030.0 04.25.2007 no virus found
Ikarus T3.1.1.5 04.25.2007 no virus found
Kaspersky 4.0.2.24 04.25.2007 no virus found
McAfee 5016 04.24.2007 no virus found
Microsoft 1.2405 04.25.2007 no virus found
NOD32v2 2217 04.25.2007 no virus found
Norman 5.80.02 04.24.2007 no virus found
Panda 9.0.0.4 04.25.2007 no virus found
Prevx1 V2 04.25.2007 no virus found
Sophos 4.16.0 04.23.2007 no virus found
Sunbelt 2.2.907.0 04.19.2007 no virus found
Symantec 10 04.25.2007 no virus found
TheHacker 6.1.6.095 04.15.2007 no virus found
VBA32 3.11.4 04.25.2007 no virus found
VirusBuster 4.3.7:9 04.24.2007 no virus found
Webwasher-Gateway 6.0.1 04.25.2007 no virus found

Aditional Information
File size: 24 bytes

chyba wszystko w porządku - co sądzicie??

**Posty:** 8694 · przez **Red** 25 Kwi 2007, 12:52

Wszystko ok.

błagam i proszę o sprawdzenie loga z hijack this

Błagam i Proszę o sprawdzenie Loga z HiJack This

Kto jest na forum