błagam o sprawdzenie loga

**Posty:** 11 · przez **vokus** 01 Maj 2007, 17:59

mam taki problem od wczoraj...mianowicie procek działa mi na 100% czego bym nie robił ....jest poprostu każdą akcją masakrycznie obciążony i nie jestem w stanie na nim pracować... nizej zamieszczam loga

Logfile of HijackThis v1.99.1
Scan saved at 17:40:43, on 2007-05-01
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Kod: Zaznacz wszystko: Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\PROGRA~1\F-Secure\BackWeb\7681197\Program\SERVIC~1.EXE C:\Program Files\cFosSpeed\spd.exe C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe C:\Program Files\F-Secure\BackWeb\7681197\program\fsbwsys.exe C:\Program Files\F-Secure\Anti-Virus\FSGK32.EXE C:\Program Files\F-Secure\Common\FSMA32.EXE C:\WINDOWS\System32\svchost.exe C:\Program Files\F-Secure\Anti-Virus\fssm32.exe C:\Program Files\F-Secure\Common\FSMB32.EXE C:\WINDOWS\system32\libusbd-nt.exe C:\WINDOWS\system32\nvsvc32.exe F:\Programy\Raxco\PerfectDisk\PDAgent.exe C:\Program Files\F-Secure\Common\FCH32.EXE C:\Program Files\F-Secure\Common\FAMEH32.EXE C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.EXE C:\Program Files\F-Secure\Common\FNRB32.EXE C:\Program Files\F-Secure\FWES\Program\fsdfwd.exe C:\Program Files\F-Secure\Common\FIH32.EXE F:\Programy\Java\jre1.5.0_04\bin\jusched.exe C:\Program Files\F-Secure\Anti-Virus\fsav32.exe C:\Program Files\F-Secure\Common\FSM32.EXE F:\Programy\DAEMON Tools\daemon.exe C:\WINDOWS\system32\LVCOMSX.EXE F:\Programy\Logitech\Video\LogiTray.exe C:\PROGRA~1\NEOSTR~1\CnxMon.exe C:\Program Files\F-Secure\FSGUI\fsguiexe.exe C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe C:\Program Files\cFosSpeed\cFosSpeed.exe C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe C:\Program Files\Windows Media Player\WMPNSCFG.exe C:\Program Files\F-Secure\BackWeb\7681197\program\F-Secure Automatic Update.exe F:\Programy\Logitech\Video\FxSvr2.exe C:\Program Files\SAGEM WiFi manager\WLANUTL.exe C:\WINDOWS\system32\wuauclt.exe F:\Programy\Pointstone\MemOptimizer 3\MemOptimizer.exe C:\WINDOWS\system32\taskmgr.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Documents and Settings\uzytkownik\Pulpit\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://szukaj.wp.pl R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.neostrada.pl/ R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Neostrada TP R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\NEOSTR~1\SEARCH~1.DLL O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0 CE\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: IeCatch2 Class - {A5366673-E8CA-11D3-9CD9-0090271D075B} - C:\PROGRA~1\FlashGet\jccatch.dll O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\fgiebar.dll O4 - HKLM\..\Run: [SunJavaUpdateSched] F:\Programy\Java\jre1.5.0_04\bin\jusched.exe O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\F-Secure\Common\FSM32.EXE" /splash O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\F-Secure\TNB\TNBUtil.exe" /CHECKALL /WAITFORSW O4 - HKLM\..\Run: [NvCplDaemon] "RUNDLL32.EXE" C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [DAEMON Tools] "F:\Programy\DAEMON Tools\daemon.exe" -lang 1033 O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE O4 - HKLM\..\Run: [LogitechVideoRepair] "F:\Programy\Logitech\Video\ISStart.exe" O4 - HKLM\..\Run: [LogitechVideoTray] F:\Programy\Logitech\Video\LogiTray.exe O4 - HKLM\..\Run: [nwiz] "nwiz.exe" /install O4 - HKLM\..\Run: [MagicRotation] "C:\Program Files\Magic Rotation\MagicRotation\MagicPvt.exe" O4 - HKLM\..\Run: [WooCnxMon] C:\PROGRA~1\NEOSTR~1\CnxMon.exe O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\NEOSTR~1\Watch.exe O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe O4 - HKLM\..\Run: [cFosSpeed] "C:\Program Files\cFosSpeed\cFosSpeed.exe" O4 - HKLM\..\Run: [NvMediaCenter] "RUNDLL32.EXE" C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe O4 - HKCU\..\Run: [LogitechSoftwareUpdate] "F:\Programy\Logitech\Video\ManifestEngine.exe" boot O4 - HKCU\..\Run: [Steam] "D:\Valve\Steam\Steam.exe" -silent O4 - HKCU\..\Run: [NBJ] "C:\Program Files\Ahead\Nero BackItUp\NBJ.exe" O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe O4 - Global Startup: Color Calibration.lnk = ? O4 - Global Startup: F-Secure Automatic Update.lnk = C:\Program Files\F-Secure\BackWeb\7681197\program\F-Secure Automatic Update.exe O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe O4 - Global Startup: MagicTune3.6.lnk = ? O4 - Global Startup: NaturalColorLoad.lnk = ? O4 - Global Startup: Program sieciowy dla SAGEM Wi-Fi 11g USB adapter.lnk = ? O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000 O8 - Extra context menu item: Ściągnij przy pomocy FlashGet'a - C:\Program Files\FlashGet\jc_link.htm O8 - Extra context menu item: Ściągnij wszystko przy pomocy FlashGet'a - C:\Program Files\FlashGet\jc_all.htm O9 - Extra button: Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - F:\Programy\Java\jre1.5.0_04\bin\npjpi150_04.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - F:\Programy\Java\jre1.5.0_04\bin\npjpi150_04.dll O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/default/kavwebscan_unicode.cab O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab O16 - DPF: {594ECDD4-A991-4208-A7B7-00DDAD9BE328} (Photosynth Class) - http://media.labs.live.com/all/ps/_code_/Photosynth.cab O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1123517616362 O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{8C968174-302A-4C7E-9923-BA05E108F176}: NameServer = 194.204.159.1,194.204.152.34 O20 - Winlogon Notify: WRNotifier - WRLogonNTF.dll (file missing) O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll O23 - Service: F-Secure Automatic Update (BackWeb Plug-in - 7681197) - BackWeb Technologies Inc. - C:\PROGRA~1\F-Secure\BackWeb\7681197\Program\SERVIC~1.EXE O23 - Service: cFosSpeed System Service (cFosSpeedS) - Unknown owner - C:\Program Files\cFosSpeed\spd.exe" -service (file missing) O23 - Service: F-Secure Gatekeeper Handler Starter - F-Secure Corp. - C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe O23 - Service: F-Secure Network Request Broker - F-Secure Corporation - C:\Program Files\F-Secure\Common\FNRB32.EXE O23 - Service: fsbwsys - F-Secure Corp. - C:\Program Files\F-Secure\BackWeb\7681197\program\fsbwsys.exe O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\F-Secure\FWES\Program\fsdfwd.exe O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\F-Secure\Common\FSMA32.EXE O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: LibUsb-Win32 - Daemon, Version 0.1.10.1 (libusbd) - http://libusb-win32.sourceforge.net - C:\WINDOWS\system32\libusbd-nt.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: PDAgent - Raxco Software, Inc. - F:\Programy\Raxco\PerfectDisk\PDAgent.exe O23 - Service: PDEngine - Raxco Software, Inc. - F:\Programy\Raxco\PerfectDisk\PDEngine.exe

**Posty:** 18165 · przez **wojtas** 01 Maj 2007, 20:46

O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cab
O20 - Winlogon Notify: WRNotifier - WRLogonNTF.dll (file missing)

skasuj i daj loga z silent runners oraz comboscan

**Posty:** 11 · przez **vokus** 02 Maj 2007, 18:20

Kod: Zaznacz wszystko: "Silent Runners.vbs", revision R50, http://www.silentrunners.org/ Operating System: Windows XP SP2 Output limited to non-default values, except where indicated by "{++}" Startup items buried in registry: --------------------------------- HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ {++} "LDM" = "C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe" ["Logitech"] "LogitechSoftwareUpdate" = ""F:\Programy\Logitech\Video\ManifestEngine.exe" boot" ["Logitech Inc."] "Steam" = ""D:\Valve\Steam\Steam.exe" -silent" ["Valve Corporation"] "NBJ" = ""C:\Program Files\Ahead\Nero BackItUp\NBJ.exe"" ["Ahead Software AG"] "WMPNSCFG" = "C:\Program Files\Windows Media Player\WMPNSCFG.exe" [MS] HKLM\Software\Microsoft\Windows\CurrentVersion\Run\ {++} "SunJavaUpdateSched" = "F:\Programy\Java\jre1.5.0_04\bin\jusched.exe" ["Sun Microsystems, Inc."] "F-Secure Manager" = ""C:\Program Files\F-Secure\Common\FSM32.EXE" /splash" ["F-Secure Corporation"] "F-Secure TNB" = ""C:\Program Files\F-Secure\TNB\TNBUtil.exe" /CHECKALL /WAITFORSW" ["F-Secure Corporation"] "NvCplDaemon" = ""RUNDLL32.EXE" C:\WINDOWS\system32\NvCpl.dll,NvStartup" [MS] "NeroFilterCheck" = "C:\WINDOWS\system32\NeroCheck.exe" ["Ahead Software Gmbh"] "DAEMON Tools" = ""F:\Programy\DAEMON Tools\daemon.exe" -lang 1033" ["DT Soft Ltd."] "LVCOMSX" = "C:\WINDOWS\system32\LVCOMSX.EXE" ["Logitech Inc."] "LogitechVideoRepair" = ""F:\Programy\Logitech\Video\ISStart.exe" " ["Logitech Inc."] "LogitechVideoTray" = "F:\Programy\Logitech\Video\LogiTray.exe" ["Logitech Inc."] "nwiz" = ""nwiz.exe" /install" ["NVIDIA Corporation"] "MagicRotation" = ""C:\Program Files\Magic Rotation\MagicRotation\MagicPvt.exe"" ["Samsung Electronics, Inc."] "RegistryMechanic" = "(empty string)" [file not found] "WooCnxMon" = "C:\PROGRA~1\NEOSTR~1\CnxMon.exe" [empty string] "SpeedTouch USB Diagnostics" = ""C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon" ["THOMSON Telecom Belgium"] "WOOWATCH" = "C:\PROGRA~1\NEOSTR~1\Watch.exe" ["France Télécom R&D"] "WOOTASKBARICON" = "C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe" ["France Télécom R&D"] "cFosSpeed" = ""C:\Program Files\cFosSpeed\cFosSpeed.exe"" ["cFos Software GmbH"] "NvMediaCenter" = ""RUNDLL32.EXE" C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit" [MS] HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\(Default) = (no title provided) -> {HKLM...CLSID} = "AcroIEHlprObj Class" \InProcServer32\(Default) = "C:\Program Files\Adobe\Acrobat 6.0 CE\Reader\ActiveX\AcroIEHelper.dll" ["Adobe Systems Incorporated"] {A5366673-E8CA-11D3-9CD9-0090271D075B}\(Default) = (no title provided) -> {HKLM...CLSID} = "IeCatch2 Class" \InProcServer32\(Default) = "C:\PROGRA~1\FlashGet\jccatch.dll" ["Amaze Soft"] HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\ "{42071714-76d4-11d1-8b24-00a0c9068ff3}" = "Rozszerzenie CPL kadrowania wyświetlania" -> {HKLM...CLSID} = "Rozszerzenie CPL kadrowania wyświetlania" \InProcServer32\(Default) = "deskpan.dll" [file not found] "{88895560-9AA2-1069-930E-00AA0030EBC8}" = "Rozszerzenie ikony HyperTerminalu" -> {HKLM...CLSID} = "HyperTerminal Icon Ext" \InProcServer32\(Default) = "C:\WINDOWS\System32\hticons.dll" ["Hilgraeve, Inc."] "{A70C977A-BF00-412C-90B7-034C51DA2439}" = "NvCpl DesktopContext Class" -> {HKLM...CLSID} = "DesktopContext Class" \InProcServer32\(Default) = "C:\WINDOWS\system32\nvcpl.dll" ["NVIDIA Corporation"] "{1CDB2949-8F65-4355-8456-263E7C208A5D}" = "Desktop Explorer" -> {HKLM...CLSID} = "Desktop Explorer" \InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"] "{1E9B04FB-F9E5-4718-997B-B8DA88302A47}" = "Desktop Explorer Menu" -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"] "{1E9B04FB-F9E5-4718-997B-B8DA88302A48}" = "nView Desktop Context Menu" -> {HKLM...CLSID} = "nView Desktop Context Menu" \InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"] "{52B87208-9CCF-42C9-B88E-069281105805}" = "Trojan Remover Shell Extension" -> {HKLM...CLSID} = "Trojan Remover Shell Extension" \InProcServer32\(Default) = "blank" [file not found] "{00020000-0000-1011-8004-0000C06B5161}" = "WIBU-SYSTEMS Shell Extension" -> {HKLM...CLSID} = "WIBU-SYSTEMS Shell Extension" \InProcServer32\(Default) = "C:\Program Files\WIBU-SYSTEMS\System\WibuShellExt.dll" ["WIBU-SYSTEMS AG"] "{00020D75-0000-0000-C000-000000000046}" = "Microsoft Office Outlook Desktop Icon Handler" -> {HKLM...CLSID} = "Microsoft Office Outlook" \InProcServer32\(Default) = "C:\PROGRA~1\MICROS~3\OFFICE11\MLSHEXT.DLL" [MS] "{0006F045-0000-0000-C000-000000000046}" = "Microsoft Office Outlook Custom Icon Handler" -> {HKLM...CLSID} = "Rozszerzenie ikon plików programu Outlook" \InProcServer32\(Default) = "C:\PROGRA~1\MICROS~3\OFFICE11\OLKFSTUB.DLL" [MS] "{42042206-2D85-11D3-8CFF-005004838597}" = "Microsoft Office HTML Icon Handler" -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "C:\Program Files\Microsoft Office\OFFICE11\msohev.dll" [MS] "{4CCEFB41-18FA-11D3-9EF3-00A0C9E897FD}" = "CorelDRAW Shell Extension Component" -> {HKLM...CLSID} = "CorelDRAW Shell Extension Component" \InProcServer32\(Default) = "C:\Program Files\Corel\Corel Graphics 11\DRAW\CDRVIEWER\CrlShell110.dll" ["Corel Corporation"] "{7C5E74A0-D5E0-11D0-A9BF-E886A83B9BE5}" = "Context Menu Shell Extension" -> {HKLM...CLSID} = "Context Menu Shell Extension" \InProcServer32\(Default) = "C:\PROGRA~1\TAGREN~1\TRshell.dll" ["Softpointer LTD"] "{400CFEE2-39D0-46DC-96DF-E0BB5A4324B3}" = "My Logitech Pictures" -> {HKLM...CLSID} = "My Logitech Pictures" \InProcServer32\(Default) = "F:\Programy\Logitech\Video\Namespc2.dll" ["Logitech Inc."] "{FFB699E0-306A-11d3-8BD1-00104B6F7516}" = "Play on my TV helper" -> {HKLM...CLSID} = "NVIDIA CPL Extension" \InProcServer32\(Default) = "C:\WINDOWS\system32\nvcpl.dll" ["NVIDIA Corporation"] "{9E5E1445-6CEA-4761-8E45-AA19F654571E}" = "MagicRotation Shell Extension" -> {HKLM...CLSID} = "BkgndCtxMenuExt Class" \InProcServer32\(Default) = "C:\WINDOWS\system32\mpvthook.dll" ["Samsung Electronics, Inc."] HKLM\Software\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\ "WPDShServiceObj" = "{AAA288BA-9A4C-45B0-95D7-94D524869DB5}" -> {HKLM...CLSID} = "WPDShServiceObj Class" \InProcServer32\(Default) = "C:\WINDOWS\system32\WPDShServiceObj.dll" [MS] HKLM\System\CurrentControlSet\Control\Session Manager\ <<!>> "BootExecute" = "PDBoot.exe" ["Raxco Software, Inc."]|"autocheck autochk *" HKLM\Software\Classes\PROTOCOLS\Filter\ <<!>> text/xml\CLSID = "{807553E5-5146-11D5-A672-00B0D022E945}" -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL" [MS] HKLM\Software\Classes\Folder\shellex\ColumnHandlers\ {00020000-0000-1011-8004-0000C06B5161}\(Default) = (no title provided) -> {HKLM...CLSID} = "WIBU-SYSTEMS Shell Extension" \InProcServer32\(Default) = "C:\Program Files\WIBU-SYSTEMS\System\WibuShellExt.dll" ["WIBU-SYSTEMS AG"] HKLM\Software\Classes\*\shellex\ContextMenuHandlers\ PowerArchiver\(Default) = "{d03d3e68-0c44-3d45-b15f-bcfd8a8b4c7e}" -> {HKLM...CLSID} = "PowerArchiver Shell Extensions" \InProcServer32\(Default) = "F:\Programy\PowerArchiver\PASHLEXT.DLL" ["ConeXware, Inc."] TagRename_ContextMenu\(Default) = "{7C5E74A0-D5E0-11D0-A9BF-E886A83B9BE5}" -> {HKLM...CLSID} = "Context Menu Shell Extension" \InProcServer32\(Default) = "C:\PROGRA~1\TAGREN~1\TRshell.dll" ["Softpointer LTD"] Trojan Remover\(Default) = "{52B87208-9CCF-42C9-B88E-069281105805}" -> {HKLM...CLSID} = "Trojan Remover Shell Extension" \InProcServer32\(Default) = "blank" [file not found] HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\ PowerArchiver\(Default) = "{d03d3e68-0c44-3d45-b15f-bcfd8a8b4c7e}" -> {HKLM...CLSID} = "PowerArchiver Shell Extensions" \InProcServer32\(Default) = "F:\Programy\PowerArchiver\PASHLEXT.DLL" ["ConeXware, Inc."] TagRename_ContextMenu\(Default) = "{7C5E74A0-D5E0-11D0-A9BF-E886A83B9BE5}" -> {HKLM...CLSID} = "Context Menu Shell Extension" \InProcServer32\(Default) = "C:\PROGRA~1\TAGREN~1\TRshell.dll" ["Softpointer LTD"] Trojan Remover\(Default) = "{52B87208-9CCF-42C9-B88E-069281105805}" -> {HKLM...CLSID} = "Trojan Remover Shell Extension" \InProcServer32\(Default) = "blank" [file not found] Group Policies {GPedit.msc branch and setting}: ----------------------------------------------- Note: detected settings may not have any effect. HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\ "NoLowDiskSpaceChecks" = (REG_DWORD) hex:0x00000000 {unrecognized setting} HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\ "shutdownwithoutlogon" = (REG_DWORD) hex:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| Shutdown: Allow system to be shut down without having to log on} "undockwithoutlogon" = (REG_DWORD) hex:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| Devices: Allow undock without having to log on} Active Desktop and Wallpaper: ----------------------------- Active Desktop may be disabled at this entry: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState Displayed if Active Desktop enabled and wallpaper not set by Group Policy: HKCU\Software\Microsoft\Internet Explorer\Desktop\General\ "Wallpaper" = "C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp" Displayed if Active Desktop disabled and wallpaper not set by Group Policy: HKCU\Control Panel\Desktop\ "Wallpaper" = "C:\Documents and Settings\uzytkownik\Dane aplikacji\Microsoft\Internet Explorer\Tapeta programu Internet Explorer.bmp" Enabled Screen Saver: --------------------- HKCU\Control Panel\Desktop\ "SCRNSAVE.EXE" = "C:\WINDOWS\System32\sspipes.scr" [MS] Startup items in "uzytkownik" & "All Users" startup folders: ------------------------------------------------------------ C:\Documents and Settings\All Users\Menu Start\Programy\Autostart "Color Calibration" -> shortcut to: "C:\Program Files\SEC\MagicTune3.6_Client_pivot\GammaTray.exe" [empty string] "F-Secure Automatic Update" -> shortcut to: "C:\Program Files\F-Secure\BackWeb\7681197\program\F-Secure Automatic Update.exe -startup" ["BackWeb Technologies Inc. "] "Logitech Desktop Messenger" -> shortcut to: "C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe /start" ["Logitech"] "MagicTune3.6" -> shortcut to: "C:\Program Files\SEC\MagicTune3.6_Client_pivot\MagicTuneTray.exe" [empty string] "NaturalColorLoad" -> shortcut to: "C:\Program Files\SEC\Natural Color\NaturalColorLoad.exe" [empty string] "Program sieciowy dla SAGEM Wi-Fi 11g USB adapter" -> shortcut to: "C:\Program Files\SAGEM WiFi manager\WLANUTL.exe" [" "] Winsock2 Service Provider DLLs: ------------------------------- Namespace Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++} 000000000001\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS] 000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS] 000000000003\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS] Transport Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++} 0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range: %SystemRoot%\system32\mswsock.dll [MS], 01 - 03, 06 - 23 %SystemRoot%\system32\rsvpsp.dll [MS], 04 - 05 Toolbars, Explorer Bars, Extensions: ------------------------------------ Toolbars HKLM\Software\Microsoft\Internet Explorer\Toolbar\ "{E0E899AB-F487-11D5-8D29-0050BA6940E3}" = "FlashGet Bar" -> {HKLM...CLSID} = "FlashGet Bar" \InProcServer32\(Default) = "C:\PROGRA~1\FlashGet\fgiebar.dll" ["Amaze Soft"] Explorer Bars HKLM\Software\Microsoft\Internet Explorer\Explorer Bars\ HKLM\Software\Classes\CLSID\{01002DB2-8170-4D9B-A8B1-DDC9DD114E03}\(Default) = "Volet Wanadoo" Implemented Categories\{00021494-0000-0000-C000-000000000046}\ [horizontal bar] InProcServer32\(Default) = "C:\PROGRA~1\NEOSTR~1\audience\audience.dll" [empty string] HKLM\Software\Classes\CLSID\{3BAF4A27-C764-4E1A-A6F4-62F7A7E5E51C}\(Default) = "ToolBand Class" Implemented Categories\{00021494-0000-0000-C000-000000000046}\ [horizontal bar] InProcServer32\(Default) = "C:\PROGRA~1\NEOSTR~1\audience\audience.dll" [empty string] HKLM\Software\Classes\CLSID\{5BF498C0-931E-4A4F-B33F-456D07137EAA}\(Default) = "Volet Wanadoo" Implemented Categories\{00021494-0000-0000-C000-000000000046}\ [horizontal bar] InProcServer32\(Default) = "C:\PROGRA~1\NEOSTR~1\audience\audience.dll" [empty string] HKLM\Software\Classes\CLSID\{FF059E31-CC5A-4E2E-BF3B-96E929D65503}\(Default) = "&Badanie" Implemented Categories\{00021493-0000-0000-C000-000000000046}\ [vertical bar] InProcServer32\(Default) = "C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL" [MS] Extensions (Tools menu items, main toolbar menu buttons) HKLM\Software\Microsoft\Internet Explorer\Extensions\ {08B0E5C0-4FCB-11CF-AAA5-00401C608501}\ "MenuText" = "Sun Java Console" "CLSIDExtension" = "{CAFEEFAC-0015-0000-0004-ABCDEFFEDCBC}" -> {HKLM...CLSID} = "Java Plug-in 1.5.0_04" \InProcServer32\(Default) = "F:\Programy\Java\jre1.5.0_04\bin\npjpi150_04.dll" ["Sun Microsystems, Inc."] {92780B25-18CC-41C8-B9BE-3C9C571A8263}\ "ButtonText" = "Badanie" {D6E814A0-E0C5-11D4-8D29-0050BA6940E3}\ "ButtonText" = "FlashGet" "MenuText" = "&FlashGet" "Exec" = "C:\PROGRA~1\FlashGet\flashget.exe" ["Amaze Soft"] Miscellaneous IE Hijack Points ------------------------------ HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks\ <<H>> "{08C06D61-F1F3-4799-86F8-BE1A89362C85}" = (no title provided) -> {HKLM...CLSID} = "Search Class" \InProcServer32\(Default) = "C:\PROGRA~1\NEOSTR~1\SEARCH~1.DLL" [empty string] Running Services (Display Name, Service Name, Path {Service DLL}): ------------------------------------------------------------------ cFosSpeed System Service, cFosSpeedS, ""C:\Program Files\cFosSpeed\spd.exe" -service" ["cFos Software GmbH"] F-Secure Anti-Virus Firewall Daemon, FSDFWD, ""C:\Program Files\F-Secure\FWES\Program\fsdfwd.exe"" ["F-Secure Corporation"] F-Secure Automatic Update, BackWeb Plug-in - 7681197, "C:\PROGRA~1\F-Secure\BackWeb\7681197\Program\SERVIC~1.EXE" ["BackWeb Technologies Inc. "] F-Secure Gatekeeper Handler Starter, F-Secure Gatekeeper Handler Starter, ""C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe"" ["F-Secure Corp."] F-Secure Management Agent, FSMA, ""C:\Program Files\F-Secure\Common\FSMA32.EXE"" ["F-Secure Corporation"] F-Secure Network Request Broker, F-Secure Network Request Broker, ""C:\Program Files\F-Secure\Common\FNRB32.EXE"" ["F-Secure Corporation"] fsbwsys, fsbwsys, ""C:\Program Files\F-Secure\BackWeb\7681197\program\fsbwsys.exe"" ["F-Secure Corp."] LibUsb-Win32 - Daemon, Version 0.1.10.1, libusbd, "system32\libusbd-nt.exe" ["http://libusb-win32.sourceforge.net"] NVIDIA Display Driver Service, NVSvc, "C:\WINDOWS\system32\nvsvc32.exe" ["NVIDIA Corporation"] PDAgent, PDAgent, "F:\Programy\Raxco\PerfectDisk\PDAgent.exe" ["Raxco Software, Inc."] PDEngine, PDEngine, "F:\Programy\Raxco\PerfectDisk\PDEngine.exe" ["Raxco Software, Inc."] Usługa udostępniania sieci programu Windows Media Player, WMPNetworkSvc, "C:\Program Files\Windows Media Player\WMPNetwk.exe" [MS] Print Monitors: --------------- HKLM\System\CurrentControlSet\Control\Print\Monitors\ Microsoft Document Imaging Writer Monitor\Driver = "mdimon.dll" [MS] PDF995 Monitor\Driver = "pdf995mon.dll" [null data] ---------- <<!>>: Suspicious data at a malware launch point. <<H>>: Suspicious data at a browser hijack point. + This report excludes default entries except where indicated. + To see *everywhere* the script checks and *everything* it finds, launch it from a command prompt or a shortcut with the -all parameter. + To search all directories of local fixed drives for DESKTOP.INI DLL launch points, use the -supp parameter or answer "No" at the first message box and "Yes" at the second message box. ---------- (total run time: 155 seconds, including 18 seconds for message boxes)

[ Dodano: Dzisiaj o 17:32 ]
ComboScan

Kod: Zaznacz wszystko: ComboScan v20070306.20 run by uzytkownik on 2007-05-02 at 18:10:42 Computer is in Normal Mode. -------------------------------------------------------------------------------- -- System Restore -------------------------------------------------------------- Successfully created ComboScan Restore Point. -- Last 3 Restore Point(s) -- 3: 2007-05-02 16:10:50 UTC - RP499 - ComboScan Restore Point 2: 2007-05-01 15:42:20 UTC - RP498 - Software Distribution Service 2.0 1: 2007-04-30 16:01:43 UTC - RP497 - Punkt kontrolny systemu Performed disk cleanup. -- HijackThis (run as uzytkownik.exe) ------------------------------------------ Logfile of HijackThis v1.99.1 Scan saved at 18:11:15, on 2007-05-02 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\PROGRA~1\F-Secure\BackWeb\7681197\Program\SERVIC~1.EXE C:\Program Files\cFosSpeed\spd.exe C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe C:\Program Files\F-Secure\BackWeb\7681197\program\fsbwsys.exe C:\Program Files\F-Secure\Anti-Virus\FSGK32.EXE C:\Program Files\F-Secure\Common\FSMA32.EXE C:\Program Files\F-Secure\Anti-Virus\fssm32.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\F-Secure\Common\FSMB32.EXE C:\WINDOWS\system32\libusbd-nt.exe C:\WINDOWS\system32\nvsvc32.exe F:\Programy\Raxco\PerfectDisk\PDAgent.exe C:\Program Files\F-Secure\Common\FCH32.EXE C:\Program Files\F-Secure\Common\FAMEH32.EXE C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.EXE C:\Program Files\F-Secure\Common\FNRB32.EXE C:\Program Files\F-Secure\FWES\Program\fsdfwd.exe C:\Program Files\F-Secure\Common\FIH32.EXE F:\Programy\Raxco\PerfectDisk\PDEngine.exe F:\Programy\Java\jre1.5.0_04\bin\jusched.exe C:\Program Files\F-Secure\Common\FSM32.EXE C:\Program Files\F-Secure\Anti-Virus\fsav32.exe F:\Programy\DAEMON Tools\daemon.exe C:\WINDOWS\system32\LVCOMSX.EXE F:\Programy\Logitech\Video\LogiTray.exe C:\Program Files\Magic Rotation\MagicRotation\MagicPvt.exe C:\PROGRA~1\NEOSTR~1\CnxMon.exe F:\Programy\BitComet\BitComet.exe C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe C:\Program Files\cFosSpeed\cFosSpeed.exe C:\Program Files\F-Secure\FSGUI\fsguiexe.exe C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe C:\Program Files\Windows Media Player\WMPNSCFG.exe C:\Program Files\SEC\MagicTune3.6_Client_pivot\GammaTray.exe C:\Program Files\F-Secure\BackWeb\7681197\program\F-Secure Automatic Update.exe F:\Programy\Logitech\Video\FxSvr2.exe C:\Program Files\SEC\Natural Color\NaturalColorLoad.exe C:\Program Files\SAGEM WiFi manager\WLANUTL.exe C:\WINDOWS\system32\taskmgr.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\FlashGet\flashget.exe C:\Documents and Settings\uzytkownik\Pulpit\comboscan.exe C:\DOCUME~1\UZYTKO~1\Pulpit\uzytkownik.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://szukaj.wp.pl R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.neostrada.pl/ R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Neostrada TP R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\NEOSTR~1\SEARCH~1.DLL O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0 CE\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: IeCatch2 Class - {A5366673-E8CA-11D3-9CD9-0090271D075B} - C:\PROGRA~1\FlashGet\jccatch.dll O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\fgiebar.dll O4 - HKLM\..\Run: [SunJavaUpdateSched] F:\Programy\Java\jre1.5.0_04\bin\jusched.exe O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\F-Secure\Common\FSM32.EXE" /splash O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\F-Secure\TNB\TNBUtil.exe" /CHECKALL /WAITFORSW O4 - HKLM\..\Run: [NvCplDaemon] "RUNDLL32.EXE" C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [DAEMON Tools] "F:\Programy\DAEMON Tools\daemon.exe" -lang 1033 O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE O4 - HKLM\..\Run: [LogitechVideoRepair] "F:\Programy\Logitech\Video\ISStart.exe" O4 - HKLM\..\Run: [LogitechVideoTray] F:\Programy\Logitech\Video\LogiTray.exe O4 - HKLM\..\Run: [nwiz] "nwiz.exe" /install O4 - HKLM\..\Run: [MagicRotation] "C:\Program Files\Magic Rotation\MagicRotation\MagicPvt.exe" O4 - HKLM\..\Run: [WooCnxMon] C:\PROGRA~1\NEOSTR~1\CnxMon.exe O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\NEOSTR~1\Watch.exe O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe O4 - HKLM\..\Run: [cFosSpeed] "C:\Program Files\cFosSpeed\cFosSpeed.exe" O4 - HKLM\..\Run: [NvMediaCenter] "RUNDLL32.EXE" C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe O4 - HKCU\..\Run: [LogitechSoftwareUpdate] "F:\Programy\Logitech\Video\ManifestEngine.exe" boot O4 - HKCU\..\Run: [Steam] "D:\Valve\Steam\Steam.exe" -silent O4 - HKCU\..\Run: [NBJ] "C:\Program Files\Ahead\Nero BackItUp\NBJ.exe" O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe O4 - Global Startup: Color Calibration.lnk = ? O4 - Global Startup: F-Secure Automatic Update.lnk = C:\Program Files\F-Secure\BackWeb\7681197\program\F-Secure Automatic Update.exe O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe O4 - Global Startup: MagicTune3.6.lnk = ? O4 - Global Startup: NaturalColorLoad.lnk = ? O4 - Global Startup: Program sieciowy dla SAGEM Wi-Fi 11g USB adapter.lnk = ? O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000 O8 - Extra context menu item: Ściągnij przy pomocy FlashGet'a - C:\Program Files\FlashGet\jc_link.htm O8 - Extra context menu item: Ściągnij wszystko przy pomocy FlashGet'a - C:\Program Files\FlashGet\jc_all.htm O9 - Extra button: Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - F:\Programy\Java\jre1.5.0_04\bin\npjpi150_04.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - F:\Programy\Java\jre1.5.0_04\bin\npjpi150_04.dll O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/default/kavwebscan_unicode.cab O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab O16 - DPF: {594ECDD4-A991-4208-A7B7-00DDAD9BE328} (Photosynth Class) - http://media.labs.live.com/all/ps/_code_/Photosynth.cab O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1123517616362 O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{8C968174-302A-4C7E-9923-BA05E108F176}: NameServer = 194.204.159.1,194.204.152.34 O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\ O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll O23 - Service: F-Secure Automatic Update (BackWeb Plug-in - 7681197) - BackWeb Technologies Inc. - C:\PROGRA~1\F-Secure\BackWeb\7681197\Program\SERVIC~1.EXE O23 - Service: cFosSpeed System Service (cFosSpeedS) - Unknown owner - C:\Program Files\cFosSpeed\spd.exe" -service (file missing) O23 - Service: F-Secure Gatekeeper Handler Starter - F-Secure Corp. - C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe O23 - Service: F-Secure Network Request Broker - F-Secure Corporation - C:\Program Files\F-Secure\Common\FNRB32.EXE O23 - Service: fsbwsys - F-Secure Corp. - C:\Program Files\F-Secure\BackWeb\7681197\program\fsbwsys.exe O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\F-Secure\FWES\Program\fsdfwd.exe O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\F-Secure\Common\FSMA32.EXE O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: LibUsb-Win32 - Daemon, Version 0.1.10.1 (libusbd) - http://libusb-win32.sourceforge.net - C:\WINDOWS\system32\libusbd-nt.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: PDAgent - Raxco Software, Inc. - F:\Programy\Raxco\PerfectDisk\PDAgent.exe O23 - Service: PDEngine - Raxco Software, Inc. - F:\Programy\Raxco\PerfectDisk\PDEngine.exe -- HijackThis Fixed Entries (C:\DOCUME~1\UZYTKO~1\Pulpit\backups\) ------------- backup-20070502-002221-155 O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cab backup-20070502-002222-562 O20 - Winlogon Notify: WRNotifier - WRLogonNTF.dll (file missing) -- File Associations ----------------------------------------------------------- .bat - batfile - "%1" %* .chm - chm.file - "C:\WINDOWS\hh.exe" %1 .cmd - cmdfile - "%1" %* .com - comfile - "%1" %* .exe - exefile - "%1" %* .hlp - hlpfile - %SystemRoot%\System32\winhlp32.exe %1 .inf - inffile - %SystemRoot%\System32\NOTEPAD.EXE %1 .ini - inifile - %SystemRoot%\System32\NOTEPAD.EXE %1 .js - jsfile - %SystemRoot%\System32\WScript.exe "%1" %* .lnk - lnkfile - {00021401-0000-0000-C000-000000000046} .pif - piffile - "%1" %* .reg - regfile - regedit.exe "%1" .scr - scrfile - "%1" /S .txt - txtfile - %SystemRoot%\system32\NOTEPAD.EXE %1 .vbs - VBSFile - %SystemRoot%\System32\WScript.exe "%1" %* -- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------- 3S alcan5wn (SpeedTouch USB ADSL PPP Networking Driver (NDISWAN)) - C:\WINDOWS\system32\drivers\alcan5wn.sys 3S alcaudsl (SpeedTouch ADSL Modem ATM Transport) - C:\WINDOWS\system32\drivers\alcaudsl.sys 3S ALCXWDM (Service for Realtek AC97 Audio (WDM)) - C:\WINDOWS\system32\drivers\ALCXWDM.SYS (not found) 1R AmdK7 (Sterownik procesora AMD K7) - C:\WINDOWS\system32\drivers\amdk7.sys 3S ATE_PROCMON - C:\Program Files\Anti Trojan Elite\ATEPMon.sys (not found) 3S CCDECODE (Dekoder napisów) - C:\WINDOWS\system32\drivers\ccdecode.sys 3R cFosSpeed (cFosSpeed Miniport) - C:\WINDOWS\system32\drivers\cfosspeed.sys 3S CO_Mon - C:\WINDOWS\system32\drivers\CO_Mon.sys 0R DefragFS - C:\WINDOWS\system32\drivers\DefragFs.sys 3S dot4 (Sterownik MS IEEE-1284.4) - C:\WINDOWS\system32\drivers\Dot4.sys 3S Dot4Print (Sterownik klasy drukowania dla IEEE-1284.4) - C:\WINDOWS\system32\drivers\Dot4Prt.sys 3S Dot4Scan (Sterownik klasy skanowania dla IEEE-1284.4) - C:\WINDOWS\system32\drivers\Dot4scan.sys 3S dot4usb (Filtr Dot4USB Dot4USB Filter) - C:\WINDOWS\system32\drivers\Dot4usb.sys 3R dtscsi - C:\WINDOWS\system32\drivers\dtscsi.sys 3S ENTECH - C:\WINDOWS\system32\drivers\Entech.sys 2R F-Secure Filter (F-Secure File System Filter) - C:\Program Files\F-Secure\Anti-Virus\win2k\fsfilter.sys 2R F-Secure Gatekeeper - C:\Program Files\F-Secure\Anti-Virus\win2k\fsgk.sys 2R F-Secure Recognizer (F-Secure File System Recognizer) - C:\Program Files\F-Secure\Anti-Virus\win2k\FSrec.sys 0R FSFW (F-Secure Firewall Driver) - C:\WINDOWS\system32\drivers\fsdfw.sys 3S GMSIPCI - H:\INSTALL\GMSIPCI.SYS (not found) 3S hamachi (Hamachi Network Interface) - C:\WINDOWS\system32\drivers\hamachi.sys 3R HCF_MSFT - C:\WINDOWS\system32\drivers\HCF_MSFT.sys 3R HidUsb (Sterownik Microsoft klasy HID) - C:\WINDOWS\system32\drivers\hidusb.sys 3R libusb0 (LibUsb-Win32 - Kernel Driver, Version 0.1.10.1) - C:\WINDOWS\system32\drivers\libusb0.sys 3S LVUSBSta (Logitech USB Monitor Filter) - C:\WINDOWS\system32\drivers\LVUSBSta.sys 1R magicpvt - C:\WINDOWS\system32\drivers\magicpvt.sys 1R MagicTune - C:\WINDOWS\system32\drivers\MTiCtwl.sys 3R mouhid (Sterownik myszy HID) - C:\WINDOWS\system32\drivers\mouhid.sys 3S msloop (Sterownik karty Microsoft Loopback) - C:\WINDOWS\system32\drivers\loop.sys 3S MSTEE (Konwerter strumieni Tee/Sink-to-Sink Microsoft Streaming) - C:\WINDOWS\system32\drivers\mstee.sys 3S NABTSFEC (Koder-dekoder NABTS/FEC VBI) - C:\WINDOWS\system32\drivers\nabtsfec.sys 3S NdisIP (Połączenie TV/wideo firmy Microsoft) - C:\WINDOWS\system32\drivers\ndisip.sys 3S NTACCESS - H:\NTACCESS.sys (not found) 3R nv - C:\WINDOWS\system32\drivers\nv4_mini.sys 1S nvport (NVIDIA PORT IO Control Driver) - C:\WINDOWS\system32\Drivers\nvport.sys (not found) 1R oreans32 - C:\WINDOWS\system32\drivers\oreans32.sys 3S P2k (Motorola USB Device) - C:\WINDOWS\system32\drivers\P2k.sys 3S PCANDIS5 (PCANDIS5 Protocol Driver) - C:\WINDOWS\system32\PCANDIS5.SYS (not found) 3R pfc (Padus ASPI Shell) - C:\WINDOWS\system32\drivers\pfc.sys 3S PID_0928 (Logitech QuickCam Express(PID_0928)) - C:\WINDOWS\system32\drivers\LV561AV.SYS 0R PxHelp20 - C:\WINDOWS\system32\drivers\PxHelp20.sys 3S RivaTuner32 - F:\Programy\RivaTuner v2.0 RC 16.1\RivaTuner32.sys 3S SetupNTGLM7X - H:\NTGLM7X.sys (not found) 3R SG762_XP (SAGEM 802.11g XG762 1211B Driver) - C:\WINDOWS\system32\drivers\WlanBZXP.sys 3S SLIP (BDA Slip De-Framer) - C:\WINDOWS\system32\drivers\slip.sys 3S SONYPVU1 (Sterownik filtru USB Sony (SONYPVU1)) - C:\WINDOWS\system32\drivers\SONYPVU1.SYS 0R sptd - C:\WINDOWS\system32\drivers\sptd.sys 3S streamip (BDA IPSink) - C:\WINDOWS\system32\drivers\streamip.sys 3S usbccgp (Rodzajowy sterownik nadrzędny USB Microsoft) - C:\WINDOWS\system32\drivers\usbccgp.sys 3R usbehci (Sterownik Miniport rozszerzonego kontrolera hosta USB 2.0 Microsoft) - C:\WINDOWS\system32\drivers\usbehci.sys 3S usbser (Motorola USB Modem Driver) - C:\WINDOWS\system32\drivers\usbser.sys 3S USBSTOR (Sterownik magazynu masowego USB) - C:\WINDOWS\system32\drivers\usbstor.sys 3S USB_RNDIS (ADI Remote NDIS Network Device Driver) - C:\WINDOWS\system32\drivers\usb8023.sys 3S vaxscsi - C:\WINDOWS\system32\drivers\vaxscsi.sys 0R viaagp (Filtr magistrali AGP VIA) - C:\WINDOWS\system32\drivers\viaagp.sys 0R viaagp1 (VIA AGP Filter) - C:\WINDOWS\system32\drivers\VIAAGP1.SYS 2R WIBUKEY (WIBU-KEY Kernel Driver) - C:\WINDOWS\system32\drivers\Wibukey.sys 3S WSTCODEC (Kodery-dekodery teletekstu w standardzie światowym) - C:\WINDOWS\system32\drivers\wstcodec.sys 3S WudfPf (Windows Driver Foundation - User-mode Driver Framework Platform Driver) - C:\WINDOWS\system32\drivers\WudfPf.sys 3S WudfRd (Windows Driver Foundation - User-mode Driver Framework Reflector) - C:\WINDOWS\system32\drivers\WudfRd.sys 3S ZDCndis5 (ZDCndis5 Protocol Driver) - C:\WINDOWS\system32\ZDCndis5.SYS (not found) 3R ZDPSp50 (ZDPSp50 NDIS Protocol Driver) - C:\WINDOWS\system32\drivers\ZDPSp50.sys 3S ZDPNDIS5 (ZDPNDIS5 NDIS Protocol Driver) - C:\WINDOWS\system32\ZDPNDIS5.SYS (not found) -- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled -------------------- 3S aspnet_state (ASP.NET State Service) - C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe 2R BackWeb Plug-in - 7681197 (F-Secure Automatic Update) - C:\PROGRA~1\F-Secure\BackWeb\7681197\Program\SERVIC~1.EXE 2R cFosSpeedS (cFosSpeed System Service) - "C:\Program Files\cFosSpeed\spd.exe" -service 3S clr_optimization_v2.0.50727_32 (.NET Runtime Optimization Service v2.0.50727_X86) - C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe 2R F-Secure Gatekeeper Handler Starter - "C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe" 3R F-Secure Network Request Broker - "C:\Program Files\F-Secure\Common\FNRB32.EXE" 2R fsbwsys - "C:\Program Files\F-Secure\BackWeb\7681197\program\fsbwsys.exe" 3R FSDFWD (F-Secure Anti-Virus Firewall Daemon) - "C:\Program Files\F-Secure\FWES\Program\fsdfwd.exe" 2R FSMA (F-Secure Management Agent) - "C:\Program Files\F-Secure\Common\FSMA32.EXE" 3S IDriverT (InstallDriver Table Manager) - "C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe" 2R libusbd (LibUsb-Win32 - Daemon, Version 0.1.10.1) - system32\libusbd-nt.exe 2R NVSvc (NVIDIA Display Driver Service) - C:\WINDOWS\system32\nvsvc32.exe 3S ose (Office Source Engine) - "C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE" 2R PDAgent - F:\Programy\Raxco\PerfectDisk\PDAgent.exe 3R PDEngine - F:\Programy\Raxco\PerfectDisk\PDEngine.exe -- Files created between 2007-04-02 and 2007-05-02 ----------------------------- 2007-04-29 20:18:51 98304 --a------ C:\WINDOWS\system32CmdLineExt.dll<SYSTEM~1.DLL> 2007-04-29 20:17:55 3426072 --a------ C:\WINDOWS\system32\d3dx9_32.dll 2007-04-25 18:12:20 217088 --a------ C:\WINDOWS\system32\yv12vfw.dll 2007-04-25 18:12:20 217088 --a------ C:\WINDOWS\system32\i420vfw.dll 2007-04-25 18:12:20 39936 --a------ C:\WINDOWS\system32\huffyuv.dll 2007-04-25 18:12:19 654848 --a------ C:\WINDOWS\system32\x264vfw.dll 2007-04-25 18:12:19 630784 --a------ C:\WINDOWS\system32\vp7vfw.dll 2007-04-25 18:12:19 438272 --a------ C:\WINDOWS\system32\vp6vfw.dll 2007-04-25 18:12:17 200704 --a------ C:\WINDOWS\system32\ssldivx.dll 2007-04-25 18:12:17 3596288 --a------ C:\WINDOWS\system32\qt-dx331.dll 2007-04-25 18:12:17 1044480 --a------ C:\WINDOWS\system32\libdivx.dll 2007-04-25 18:12:17 196608 --a------ C:\WINDOWS\system32\dtu100.dll 2007-04-25 18:12:17 73728 --a------ C:\WINDOWS\system32\dpl100.dll 2007-04-25 18:12:15 10752 --a------ C:\WINDOWS\system32\ff_vfw.dll 2007-04-25 18:12:12 0 d-------- C:\Program Files\K-Lite Codec Pack<K-LITE~1> 2007-04-19 14:22:41 0 d-------- C:\Program Files\VideoLAN 2007-04-07 23:43:29 0 d-------- C:\Program Files\Common Files\Real -- Find3M Report --------------------------------------------------------------- 2007-05-02 18:05:10 0 d-------- C:\Program Files\cFosSpeed<CFOSSP~1> 2007-05-02 17:53:12 16 --a------ C:\WINDOWS\system32\magicpvt.dat 2007-05-02 17:52:10 32 --a------ C:\WINDOWS\system32\driver.dat 2007-05-01 16:53:29 0 d-------- C:\Program Files\FlashGet 2007-05-01 16:19:16 0 d-------- C:\Program Files\HighGrow 2007-05-01 00:13:16 0 d-------- C:\Documents and Settings\uzytkownik\Dane aplikacji\Command & Conquer 3 Tiberium Wars<COMMAN~1> 2007-04-30 12:37:08 0 d-------- C:\Program Files\Common Files\Blizzard Entertainment<BLIZZA~1> 2007-04-29 20:18:52 0 dr-h----- C:\Documents and Settings\uzytkownik\Dane aplikacji\SecuROM 2007-04-27 16:51:12 0 d-------- C:\Documents and Settings\uzytkownik\Dane aplikacji\dvdcss 2007-04-26 19:52:32 0 d-------- C:\Documents and Settings\uzytkownik\Dane aplikacji\Real 2007-04-25 18:12:12 0 d-------- C:\Documents and Settings\uzytkownik\Dane aplikacji\Apple Computer<APPLEC~1> 2007-04-19 17:29:49 0 d-------- C:\Documents and Settings\uzytkownik\Dane aplikacji\AdobeUM 2007-04-19 14:24:34 0 d-------- C:\Documents and Settings\uzytkownik\Dane aplikacji\vlc 2007-04-10 21:56:42 0 d-------- C:\Program Files\QuickTime<QUICKT~1> 2007-04-03 21:33:01 0 d-------- C:\Documents and Settings\uzytkownik\Dane aplikacji\Skype 2007-03-30 11:39:00 32922 --a------ C:\WINDOWS\system32\perfh015.dat 2007-03-30 11:39:00 18236 --a------ C:\WINDOWS\system32\perfc015.dat 2007-03-23 14:42:40 0 d-------- C:\Documents and Settings\uzytkownik\Dane aplikacji\foobar2000<FOOBAR~1> 2007-03-17 15:45:36 293376 --a------ C:\WINDOWS\system32\winsrv.dll 2007-03-17 11:43:29 0 d--h----- C:\Program Files\InstallShield Installation Information<INSTAL~1> 2007-03-15 17:54:28 0 d-------- C:\Program Files\Common Files\DAZ 2007-03-10 21:25:44 0 d-------- C:\Program Files\Neostrada TP<NEOSTR~1> 2007-03-08 17:38:47 579072 --a------ C:\WINDOWS\system32\user32.dll 2007-03-08 17:38:47 40960 --a------ C:\WINDOWS\system32\mf3216.dll 2007-03-08 17:38:47 281600 --a------ C:\WINDOWS\system32\gdi32.dll 2007-03-08 17:37:33 1843840 --a------ C:\WINDOWS\system32\win32k.sys 2007-03-07 15:38:29 0 d-------- C:\Program Files\Windows Media Connect 2<WI4DF6~1> 2007-03-07 15:35:29 0 d-------- C:\Program Files\Windows Media Connect<WINDOW~4> 2007-02-05 22:19:48 185856 --a------ C:\WINDOWS\system32\upnphost.dll 2007-02-03 19:29:46 6097 --a----c- C:\WINDOWS\mozver.dat -- Registry Dump --------------------------------------------------------------- [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run] "LDM"="C:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\BackWeb-8876480.exe" "LogitechSoftwareUpdate"="\"F:\\Programy\\Logitech\\Video\\ManifestEngine.exe\" boot" "Steam"="\"D:\\Valve\\Steam\\Steam.exe\" -silent" "NBJ"="\"C:\\Program Files\\Ahead\\Nero BackItUp\\NBJ.exe\"" "WMPNSCFG"="C:\\Program Files\\Windows Media Player\\WMPNSCFG.exe" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run] "SunJavaUpdateSched"="F:\\Programy\\Java\\jre1.5.0_04\\bin\\jusched.exe" "F-Secure Manager"="\"C:\\Program Files\\F-Secure\\Common\\FSM32.EXE\" /splash" "F-Secure TNB"="\"C:\\Program Files\\F-Secure\\TNB\\TNBUtil.exe\" /CHECKALL /WAITFORSW" "NvCplDaemon"="\"RUNDLL32.EXE\" C:\\WINDOWS\\system32\\NvCpl.dll,NvStartup" "NeroFilterCheck"="C:\\WINDOWS\\system32\\NeroCheck.exe" "DAEMON Tools"="\"F:\\Programy\\DAEMON Tools\\daemon.exe\" -lang 1033" "LVCOMSX"="C:\\WINDOWS\\system32\\LVCOMSX.EXE" "LogitechVideoRepair"="\"F:\\Programy\\Logitech\\Video\\ISStart.exe\" " "LogitechVideoTray"="F:\\Programy\\Logitech\\Video\\LogiTray.exe" "nwiz"="\"nwiz.exe\" /install" "MagicRotation"="\"C:\\Program Files\\Magic Rotation\\MagicRotation\\MagicPvt.exe\"" "RegistryMechanic"="" "WooCnxMon"="C:\\PROGRA~1\\NEOSTR~1\\CnxMon.exe" "SpeedTouch USB Diagnostics"="\"C:\\Program Files\\Thomson\\SpeedTouch USB\\Dragdiag.exe\" /icon" "WOOWATCH"="C:\\PROGRA~1\\NEOSTR~1\\Watch.exe" "WOOTASKBARICON"="C:\\PROGRA~1\\NEOSTR~1\\TaskbarIcon.exe" "cFosSpeed"="\"C:\\Program Files\\cFosSpeed\\cFosSpeed.exe\"" "NvMediaCenter"="\"RUNDLL32.EXE\" C:\\WINDOWS\\system32\\NvMcTray.dll,NvTaskbarInit" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\IMAIL] "Installed"="1" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MAPI] "Installed"="1" "NoChange"="1" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MSFS] "Installed"="1" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\shellserviceobjectdelayload] "WPDShServiceObj"="{AAA288BA-9A4C-45B0-95D7-94D524869DB5}" [HKEY_USERS\.default\software\microsoft\windows\currentversion\run] "CTFMON.EXE"="C:\\WINDOWS\\System32\\CTFMON.EXE" [HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\run] "CTFMON.EXE"="C:\\WINDOWS\\System32\\CTFMON.EXE" [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] "NoLowDiskSpaceChecks"=dword:00000000 [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders] "SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll" [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Svchost] LocalService REG_MULTI_SZ Alerter\0WebClient\0LmHosts\0RemoteRegistry\0upnphost\0SSDPSRV\0\0 NetworkService REG_MULTI_SZ DnsCache\0\0 rpcss REG_MULTI_SZ RpcSs\0\0 imgsvc REG_MULTI_SZ StiSvc\0\0 termsvcs REG_MULTI_SZ TermService\0\0 HTTPFilter REG_MULTI_SZ HTTPFilter\0\0 DcomLaunch REG_MULTI_SZ DcomLaunch\0TermService\0\0 WudfServiceGroup REG_MULTI_SZ WUDFSvc\0\0 -- End of ComboScan: finished at 2007-05-02 at 18:12:11 ------------------------

**Posty:** 18165 · przez **wojtas** 02 Maj 2007, 19:03

nic w logach nie ma

**Posty:** 11 · przez **vokus** 02 Maj 2007, 22:43

dzięki...

błagam o sprawdzenie loga

Błagam o sprawdzenie loga

Kto jest na forum