do sprawdzenia

**Posty:** 2647 · przez **Bambosz** 12 Mar 2007, 18:51

witam , jest to log kolegi zaczęły mu wyskakiwać jakieś ruskie strony itd
oto log:

Kod: Zaznacz wszystko: Logfile of HijackThis v1.99.1 Scan saved at 17:32:39, on 2007-03-12 Platform: Windows XP (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 (6.00.2600.0000) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\csrss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\System32\alg.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe C:\WINDOWS\System32\FTRTSVC.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\rundll32.exe C:\WINDOWS\vsnpstd3.exe C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe C:\Program Files\PViever\pviever.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe C:\WINDOWS\System32\ctfmon.exe C:\PROGRA~1\NEOSTR~1\TaskBarIcon.exe C:\Program Files\neostrada tp\neostradatp.exe C:\Program Files\neostrada tp\ComComp.exe C:\PROGRA~1\NEOSTR~1\Toaster.exe C:\PROGRA~1\NEOSTR~1\Inactivity.exe C:\PROGRA~1\NEOSTR~1\PollingModule.exe C:\WINDOWS\System32\ALERTM~1\ALERTM~1.EXE C:\Program Files\neostrada tp\Watch.exe C:\WINDOWS\System32\wuauclt.exe C:\Program Files\Gadu-Gadu\gg.exe C:\Program Files\Winamp\winamp.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Adobe\Acrobat 5.0 CE\Reader\AcroRd32.exe C:\Documents and Settings\Jaskulski.JASKULSK-VK4IL1\Pulpit\hijackthis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.neostrada.pl R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = neostrada tp R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\NEOSTR~1\SEARCH~1.DLL O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0 CE\Reader\ActiveX\AcroIEHelper.ocx O2 - BHO: (no name) - {FCADDC14-BD46-408A-9842-CDBE1C6D37E3} - C:\WINDOWS\system32\themes_2.dll O2 - BHO: (no name) - {FCADDC14-BD46-408A-9842-CDBE1C6D37EB} - C:\WINDOWS\system32\themes_2.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\NEOSTR~1\Watch.exe O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\NEOSTR~1\GestMaj.exe TaskBarIcon.exe O4 - HKLM\..\Run: [AdslTaskBar] rundll32.exe stmctrl.dll,TaskBar O4 - HKLM\..\Run: [snpstd3] C:\WINDOWS\vsnpstd3.exe O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" O4 - HKLM\..\Run: [PViever] "C:\Program Files\PViever\pviever.exe" hide O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe O4 - HKCU\..\Run: [beta] c:\DriverLoad\windrv0.exe O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O17 - HKLM\System\CCS\Services\Tcpip\..\{A4E0EDCA-D39D-437B-80E1-2F4F20CE5629}: NameServer = 194.204.159.1 217.98.63.164 O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.116.130 85.255.112.191 O17 - HKLM\System\CS2\Services\Tcpip\Parameters: NameServer = 85.255.116.130 85.255.112.191 O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.116.130 85.255.112.191 O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe O23 - Service: MS Software Shadow Download Provider (dnlsvc) - Unknown owner - C:\DOCUME~1\JASKUL~4.JAS\USTAWI~1\Temp\dnlsvc.exe (file missing) O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exe

**Posty:** 18165 · przez **wojtas** 12 Mar 2007, 19:58

najpierw uzyj tego:

Ściągnij program http://downloads.subratam.org/Fixwareout.exe i zastosuj go.

nastepnie:
http://www.programosy.pl/program,destroyer.html

pozniej dajesz log z hijacka silenta oraz z L2mfix z opcji 1

http://www.downloads.subratam.org/l2mfix.exe

Autor postu otrzymał pochwałę

**Posty:** 2647 · przez **Bambosz** 14 Mar 2007, 20:13

wojtas19162 napisał(a):najpierw uzyj tego:

Ściągnij program http://downloads.subratam.org/Fixwareout.exe i zastosuj go.

nastepnie:
http://www.programosy.pl/program,destroyer.html

pozniej dajesz log z hijacka silenta oraz z L2mfix z opcji 1

http://www.downloads.subratam.org/l2mfix.exe

przy odpaleniu każdego z programów komp zalicza restart :cry:

log z HJ:

Kod: Zaznacz wszystko: Logfile of HijackThis v1.99.1 Scan saved at 18:28:53, on 2007-03-14 Platform: Windows XP (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 (6.00.2600.0000) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\csrss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\System32\alg.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe C:\WINDOWS\System32\FTRTSVC.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\rundll32.exe C:\WINDOWS\vsnpstd3.exe C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe C:\Program Files\PViever\pviever.exe C:\PROGRA~1\NEOSTR~1\TaskBarIcon.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe C:\Program Files\neostrada tp\neostradatp.exe C:\Program Files\neostrada tp\ComComp.exe C:\PROGRA~1\NEOSTR~1\Toaster.exe C:\PROGRA~1\NEOSTR~1\Inactivity.exe C:\PROGRA~1\NEOSTR~1\PollingModule.exe C:\WINDOWS\System32\ALERTM~1\ALERTM~1.EXE C:\WINDOWS\System32\ctfmon.exe C:\Program Files\Gadu-Gadu\gg.exe C:\Program Files\neostrada tp\Watch.exe C:\Program Files\Winamp\winamp.exe C:\PROGRA~1\MOZILL~1\FIREFOX.EXE C:\WINDOWS\Explorer.EXE C:\Documents and Settings\Jaskulski.JASKULSK-VK4IL1\Pulpit\hijackthis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.pl/ R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = neostrada tp R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\NEOSTR~1\SEARCH~1.DLL O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0 CE\Reader\ActiveX\AcroIEHelper.ocx O2 - BHO: (no name) - {FCADDC14-BD46-408A-9842-CDBE1C6D37E3} - C:\WINDOWS\system32\themes_2.dll O2 - BHO: (no name) - {FCADDC14-BD46-408A-9842-CDBE1C6D37EB} - C:\WINDOWS\system32\themes_2.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\NEOSTR~1\Watch.exe O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\NEOSTR~1\GestMaj.exe TaskBarIcon.exe O4 - HKLM\..\Run: [AdslTaskBar] rundll32.exe stmctrl.dll,TaskBar O4 - HKLM\..\Run: [snpstd3] C:\WINDOWS\vsnpstd3.exe O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" O4 - HKLM\..\Run: [PViever] "C:\Program Files\PViever\pviever.exe" hide O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe O4 - HKCU\..\Run: [beta] c:\DriverLoad\windrv0.exe O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O17 - HKLM\System\CCS\Services\Tcpip\..\{A4E0EDCA-D39D-437B-80E1-2F4F20CE5629}: NameServer = 194.204.159.1 217.98.63.164 O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.116.130 85.255.112.191 O17 - HKLM\System\CS2\Services\Tcpip\Parameters: NameServer = 85.255.116.130 85.255.112.191 O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.116.130 85.255.112.191 O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe O23 - Service: MS Software Shadow Download Provider (dnlsvc) - Unknown owner - C:\DOCUME~1\JASKUL~4.JAS\USTAWI~1\Temp\dnlsvc.exe (file missing) O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exe

SR:
pojawi się jutro bo haskiego157 nie ma na GG, a log był ucięty :wink:

**Posty:** 18165 · przez **wojtas** 14 Mar 2007, 20:37

log z silenta jest uciety

**Posty:** 2647 · przez **Bambosz** 15 Mar 2007, 18:15

wojtas19162 napisał(a):log z silenta jest uciety

ten jest chyba dobry:

Kod: Zaznacz wszystko: "Silent Runners.vbs", revision R50, http://www.silentrunners.org/ Operating System: Windows XP Output limited to non-default values, except where indicated by "{++}" Startup items buried in registry: --------------------------------- HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ {++} "CTFMON.EXE" = "C:\WINDOWS\System32\ctfmon.exe" [MS] "DriverLoad" = "(empty string)" [file not found] "DriverCheck" = "(empty string)" [file not found] "SystemDriverLoad" = "(empty string)" [file not found] "SystemDriver" = "(empty string)" [file not found] "FDriver" = "(empty string)" [file not found] "ADriver" = "(empty string)" [file not found] "CDriver" = "(empty string)" [file not found] "DDriver" = "(empty string)" [file not found] "beta" = "c:\DriverLoad\windrv0.exe" [file not found] "Gadu-Gadu" = ""C:\Program Files\Gadu-Gadu\gg.exe" /tray" ["Gadu-Gadu S.A."] HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ {++} "DriverLoad" = "(empty string)" [file not found] "DriverCheck" = "(empty string)" [file not found] "SystemDriverLoad" = "(empty string)" [file not found] "Winhost" = "(empty string)" [file not found] "Winhost1" = "(empty string)" [file not found] "Winhost2" = "(empty string)" [file not found] "Winhost3" = "(empty string)" [file not found] "Winhost4" = "(empty string)" [file not found] "SystemDriver" = "(empty string)" [file not found] "FDriver" = "(empty string)" [file not found] "ADriver" = "(empty string)" [file not found] "CDriver" = "(empty string)" [file not found] "DDriver" = "(empty string)" [file not found] "alpha" = "c:\DriverLoad\windrv0.exe" [file not found] "beta" = "c:\DriverLoad\windrv0.exe" [file not found] "gamma" = "c:\DriverLoad\windrv0.exe" [file not found] HKLM\Software\Microsoft\Windows\CurrentVersion\Run\ {++} "WOOWATCH" = "C:\PROGRA~1\NEOSTR~1\Watch.exe" ["France Télécom R&D"] "WOOTASKBARICON" = "C:\PROGRA~1\NEOSTR~1\GestMaj.exe TaskBarIcon.exe" ["France Télécom R&D"] "AdslTaskBar" = "rundll32.exe stmctrl.dll,TaskBar" [MS] "snpstd3" = "C:\WINDOWS\vsnpstd3.exe" [empty string] "RemoteControl" = ""C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"" ["Cyberlink Corp."] "PViever" = ""C:\Program Files\PViever\pviever.exe" hide" [null data] "!AVG Anti-Spyware" = ""C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized" ["Anti-Malware Development a.s."] HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\(Default) = (no title provided) -> {HKLM...CLSID} = "AcroIEHlprObj Class" \InProcServer32\(Default) = "C:\Program Files\Adobe\Acrobat 5.0 CE\Reader\ActiveX\AcroIEHelper.ocx" [empty string] {FCADDC14-BD46-408A-9842-CDBE1C6D37E3}\(Default) = (no title provided) -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "C:\WINDOWS\system32\themes_2.dll" [null data] {FCADDC14-BD46-408A-9842-CDBE1C6D37EB}\(Default) = (no title provided) -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "C:\WINDOWS\system32\themes_2.dll" [null data] HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\ "{42071714-76d4-11d1-8b24-00a0c9068ff3}" = "Rozszerzenie CPL kadrowania wyświetlania" -> {HKLM...CLSID} = "Rozszerzenie CPL kadrowania wyświetlania" \InProcServer32\(Default) = "deskpan.dll" [file not found] "{88895560-9AA2-1069-930E-00AA0030EBC8}" = "Rozszerzenie ikony HyperTerminalu" -> {HKLM...CLSID} = "HyperTerminal Icon Ext" \InProcServer32\(Default) = "C:\WINDOWS\System32\hticons.dll" ["Hilgraeve, Inc."] "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" = "WinRAR shell extension" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] "{23170F69-40C1-278A-1000-000100020000}" = "7-Zip Shell Extension" -> {HKLM...CLSID} = "7-Zip Shell Extension" \InProcServer32\(Default) = "C:\Program Files\7-Zip\7-zip.dll" ["Igor Pavlov"] "{453D1B6D-BD6A-4FA1-B876-9E4DD848D434}" = "AQQ File Transfer Shell Extension" -> {HKLM...CLSID} = "AQQ File Transfer Shell Extension" \InProcServer32\(Default) = "C:\PROGRA~1\Wapster\AQQ\System\AQQSHE~1.DLL" [null data] HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\ <<!>> "{57B86673-276A-48B2-BAE7-C6DBB3020EB8}" = "AVG Anti-Spyware 7.5" -> {HKLM...CLSID} = "CShellExecuteHookImpl Object" \InProcServer32\(Default) = "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\shellexecutehook.dll" ["Anti-Malware Development a.s."] HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\ <<!>> "System" = "kdfnb.exe" [null data] HKLM\Software\Classes\*\shellex\ContextMenuHandlers\ 7-Zip\(Default) = "{23170F69-40C1-278A-1000-000100020000}" -> {HKLM...CLSID} = "7-Zip Shell Extension" \InProcServer32\(Default) = "C:\Program Files\7-Zip\7-zip.dll" ["Igor Pavlov"] AQQFileTransfer\(Default) = "{453D1B6D-BD6A-4FA1-B876-9E4DD848D434}" -> {HKLM...CLSID} = "AQQ File Transfer Shell Extension" \InProcServer32\(Default) = "C:\PROGRA~1\Wapster\AQQ\System\AQQSHE~1.DLL" [null data] AVG Anti-Spyware\(Default) = "{8934FCEF-F5B8-468f-951F-78A921CD3920}" -> {HKLM...CLSID} = "CContextScan Object" \InProcServer32\(Default) = "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\context.dll" ["Anti-Malware Development a.s."] WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\ 7-Zip\(Default) = "{23170F69-40C1-278A-1000-000100020000}" -> {HKLM...CLSID} = "7-Zip Shell Extension" \InProcServer32\(Default) = "C:\Program Files\7-Zip\7-zip.dll" ["Igor Pavlov"] AVG Anti-Spyware\(Default) = "{8934FCEF-F5B8-468f-951F-78A921CD3920}" -> {HKLM...CLSID} = "CContextScan Object" \InProcServer32\(Default) = "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\context.dll" ["Anti-Malware Development a.s."] WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\ WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] Group Policies {GPedit.msc branch and setting}: ----------------------------------------------- Note: detected settings may not have any effect. HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System\ "DisableRegistryTools" = (REG_DWORD) hex:0x00000000 {User Configuration|Administrative Templates|System| Prevent access to registry editing tools} HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\ "shutdownwithoutlogon" = (REG_DWORD) hex:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| Shutdown: Allow system to be shut down without having to log on} "undockwithoutlogon" = (REG_DWORD) hex:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| Devices: Allow undock without having to log on} Active Desktop and Wallpaper: ----------------------------- Active Desktop may be disabled at this entry: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState Displayed if Active Desktop enabled and wallpaper not set by Group Policy: HKCU\Software\Microsoft\Internet Explorer\Desktop\General\ "Wallpaper" = "C:\WINDOWS\web\wallpaper\Idylla.bmp" Displayed if Active Desktop disabled and wallpaper not set by Group Policy: HKCU\Control Panel\Desktop\ "Wallpaper" = "C:\WINDOWS\web\wallpaper\Idylla.bmp" Enabled Screen Saver: --------------------- HKCU\Control Panel\Desktop\ "SCRNSAVE.EXE" = "C:\WINDOWS\System32\logon.scr" [MS] Enabled Scheduled Tasks: ------------------------ "At1" -> launches: "C:\DOCUME~1\JASKUL~4.JAS\Pulpit\Look2Me-Destroyer.exe /task" ["Atribune.org"] Winsock2 Service Provider DLLs: ------------------------------- Namespace Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++} 000000000001\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS] 000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS] 000000000003\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS] Transport Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++} 0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range: %SystemRoot%\system32\mswsock.dll [MS], 01 - 03, 06 - 15 %SystemRoot%\system32\rsvpsp.dll [MS], 04 - 05 Miscellaneous IE Hijack Points ------------------------------ HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks\ <<H>> "{08C06D61-F1F3-4799-86F8-BE1A89362C85}" = (no title provided) -> {HKLM...CLSID} = "Search Class" \InProcServer32\(Default) = "C:\PROGRA~1\NEOSTR~1\SEARCH~1.DLL" [empty string] Running Services (Display Name, Service Name, Path {Service DLL}): ------------------------------------------------------------------ AVG Anti-Spyware Guard, AVG Anti-Spyware Guard, "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe" ["Anti-Malware Development a.s."] France Telecom Routing Table Service, FTRTSVC, "C:\WINDOWS\System32\FTRTSVC.exe" ["France Telecom"] ---------- <<!>>: Suspicious data at a malware launch point. <<H>>: Suspicious data at a browser hijack point. + This report excludes default entries except where indicated. + To see *everywhere* the script checks and *everything* it finds, launch it from a command prompt or a shortcut with the -all parameter. + To search all directories of local fixed drives for DESKTOP.INI DLL launch points, use the -supp parameter or answer "No" at the first message box and "Yes" at the second message box. ---------- (total run time: 457 seconds, including 6 seconds for message boxes)

**Posty:** 18165 · przez **wojtas** 15 Mar 2007, 19:26

Wyłącz przywracanie systemu ( właściwości mój komputer-zakładka przywracanie - wyłącz przywracanie na wszystkich dyskach)
Start do awaryjnego ( F8 ) przy starcie komputera.

Start -> uruchom -> services.msc -> zatrzymaj i wyłącz usługe MS Software Shadow Download Provider
Otwórz hijackthis -> open misc tools section -> delete a NT service -> wpisz dnlsvc i ok

sciagnij:

http://www.atribune.org/ccount/click.php?id=1
zaznacz
Windows Temp
Temporary internet files
i wcisnij EMPTY SELECTED

C:\WINDOWS\system32\kdfnb.exe
O2 - BHO: (no name) - {FCADDC14-BD46-408A-9842-CDBE1C6D37E3} - C:\WINDOWS\system32\themes_2.dll
O2 - BHO: (no name) - {FCADDC14-BD46-408A-9842-CDBE1C6D37EB} - C:\WINDOWS\system32\themes_2.dll
O4 - HKLM\..\Run: [PViever] "C:\Program Files\PViever\pviever.exe" hide
O4 - HKCU\..\Run: [beta] c:\DriverLoad\windrv0.exe
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.116.130 85.255.112.191
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: NameServer = 85.255.116.130 85.255.112.191
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.116.130 85.255.112.191
O23 - Service: MS Software Shadow Download Provider (dnlsvc) - Unknown owner - C:\DOCUME~1\JASKUL~4.JAS\USTAWI~1\Temp\dnlsvc.exe (file missing)

Odpalasz hijackthis i zaznaczasz ptaszkami powyższe wpisy i dajesz Fix checked.
Pogrubione pliki usuwasz ręcznie z dysku

potem wklejasz do notatnika:

Windows Registry Editor Version 5.00

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"DriverLoad"=-
"DriverCheck=-
"SystemDriverLoad"=-
"SystemDriver"=-
"FDriver"=-
"ADriver"=-
"CDriver"=-
"DDriver"=-

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run]
"DriverLoad"=-
"DriverCheck"=-
"SystemDriverLoad"=-
"Winhost"=-
"Winhost1"=-
"Winhost2"=-
"Winhost3"=-
"Winhost4"=-
"SystemDriver"=-
"FDriver"=-
"ADriver"=-
"CDriver"=-
"DDriver"=-
"alpha"=-
"beta"=-
"gamma"=-

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"PViever"=-

potem do notanika:

schtasks /delete /TN At1 /F

Z menu Notatnika >>> Plik >>> Zapisz jako >>> Ustaw rozszerzenie na Wszystkie pliki >>> Zapisz jako FIX.BAT >>> uruchom plik

potem nowe logi z HJ , silent runners oraz comboscan

http://www.techsupportforum.com/sectools/Deckard/comboscan.exe

**Posty:** 2647 · przez **Bambosz** 17 Mar 2007, 17:47

wojtas19162 napisał(a):potem nowe logi z HJ , silent runners oraz comboscan

HJ:

Kod: Zaznacz wszystko: Logfile of HijackThis v1.99.1 Scan saved at 15:12:24, on 2007-03-17 Platform: Windows XP (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 (6.00.2600.0000) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\csrss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\System32\alg.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\rundll32.exe C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe C:\WINDOWS\System32\ctfmon.exe C:\Program Files\Gadu-Gadu\gg.exe C:\PROGRA~1\NEOSTR~1\TaskBarIcon.exe C:\Program Files\neostrada tp\neostradatp.exe C:\Program Files\neostrada tp\ComComp.exe C:\PROGRA~1\NEOSTR~1\Toaster.exe C:\PROGRA~1\NEOSTR~1\Inactivity.exe C:\PROGRA~1\NEOSTR~1\PollingModule.exe C:\WINDOWS\System32\ALERTM~1\ALERTM~1.EXE C:\WINDOWS\System32\wuauclt.exe C:\Program Files\neostrada tp\Watch.exe C:\WINDOWS\System32\wuauclt.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Documents and Settings\Jaskulski.JASKULSK-VK4IL1\Pulpit\comboscan.exe C:\DOCUME~1\JASKUL~4.JAS\Pulpit\HIJACK~1\JASKUL~1.EXE R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.pl/ R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = neostrada tp R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\NEOSTR~1\SEARCH~1.DLL O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0 CE\Reader\ActiveX\AcroIEHelper.ocx O2 - BHO: (no name) - {FCADDC14-BD46-408A-9842-CDBE1C6D37E3} - C:\WINDOWS\system32\themes_2.dll (file missing) O2 - BHO: (no name) - {FCADDC14-BD46-408A-9842-CDBE1C6D37EB} - C:\WINDOWS\system32\themes_2.dll (file missing) O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\NEOSTR~1\Watch.exe O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\NEOSTR~1\GestMaj.exe TaskBarIcon.exe O4 - HKLM\..\Run: [AdslTaskBar] rundll32.exe stmctrl.dll,TaskBar O4 - HKLM\..\Run: [snpstd3] C:\WINDOWS\vsnpstd3.exe O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" O4 - HKLM\..\Run: [PViever] "C:\Program Files\PViever\pviever.exe" hide O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe O4 - HKCU\..\Run: [beta] c:\DriverLoad\windrv0.exe O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O17 - HKLM\System\CCS\Services\Tcpip\..\{A4E0EDCA-D39D-437B-80E1-2F4F20CE5629}: NameServer = 194.204.159.1 217.98.63.164 O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.116.130 85.255.112.191 O17 - HKLM\System\CS2\Services\Tcpip\Parameters: NameServer = 85.255.116.130 85.255.112.191 O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.116.130 85.255.112.191 O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe O23 - Service: MS Software Shadow Download Provider (dnlsvc) - Unknown owner - C:\DOCUME~1\JASKUL~4.JAS\USTAWI~1\Temp\dnlsvc.exe (file missing) O23 - Service: France Telecom Routing Table Service (FTRTSVC) - Unknown owner - C:\WINDOWS\System32\FTRTSVC.exe (file missing)

SR:

Kod: Zaznacz wszystko: "Silent Runners.vbs", revision R50, http://www.silentrunners.org/ Operating System: Windows XP Output limited to non-default values, except where indicated by "{++}" Startup items buried in registry: --------------------------------- HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ {++} "CTFMON.EXE" = "C:\WINDOWS\System32\ctfmon.exe" [MS] "DriverLoad" = "(empty string)" [file not found] "DriverCheck" = "(empty string)" [file not found] "SystemDriverLoad" = "(empty string)" [file not found] "SystemDriver" = "(empty string)" [file not found] "FDriver" = "(empty string)" [file not found] "ADriver" = "(empty string)" [file not found] "CDriver" = "(empty string)" [file not found] "DDriver" = "(empty string)" [file not found] "beta" = "c:\DriverLoad\windrv0.exe" [file not found] "Gadu-Gadu" = ""C:\Program Files\Gadu-Gadu\gg.exe" /tray" ["Gadu-Gadu S.A."] HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ {++} "DriverLoad" = "(empty string)" [file not found] "DriverCheck" = "(empty string)" [file not found] "SystemDriverLoad" = "(empty string)" [file not found] "Winhost" = "(empty string)" [file not found] "Winhost1" = "(empty string)" [file not found] "Winhost2" = "(empty string)" [file not found] "Winhost3" = "(empty string)" [file not found] "Winhost4" = "(empty string)" [file not found] "SystemDriver" = "(empty string)" [file not found] "FDriver" = "(empty string)" [file not found] "ADriver" = "(empty string)" [file not found] "CDriver" = "(empty string)" [file not found] "DDriver" = "(empty string)" [file not found] "alpha" = "c:\DriverLoad\windrv0.exe" [file not found] "beta" = "c:\DriverLoad\windrv0.exe" [file not found] "gamma" = "c:\DriverLoad\windrv0.exe" [file not found] HKLM\Software\Microsoft\Windows\CurrentVersion\Run\ {++} "WOOWATCH" = "C:\PROGRA~1\NEOSTR~1\Watch.exe" ["France Télécom R&D"] "WOOTASKBARICON" = "C:\PROGRA~1\NEOSTR~1\GestMaj.exe TaskBarIcon.exe" ["France Télécom R&D"] "AdslTaskBar" = "rundll32.exe stmctrl.dll,TaskBar" [MS] "snpstd3" = "C:\WINDOWS\vsnpstd3.exe" [file not found] "RemoteControl" = ""C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"" ["Cyberlink Corp."] "PViever" = ""C:\Program Files\PViever\pviever.exe" hide" [file not found] "!AVG Anti-Spyware" = ""C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized" ["Anti-Malware Development a.s."] HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\(Default) = (no title provided) -> {HKLM...CLSID} = "AcroIEHlprObj Class" \InProcServer32\(Default) = "C:\Program Files\Adobe\Acrobat 5.0 CE\Reader\ActiveX\AcroIEHelper.ocx" [empty string] {FCADDC14-BD46-408A-9842-CDBE1C6D37E3}\(Default) = (no title provided) -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "C:\WINDOWS\system32\themes_2.dll" [file not found] {FCADDC14-BD46-408A-9842-CDBE1C6D37EB}\(Default) = (no title provided) -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "C:\WINDOWS\system32\themes_2.dll" [file not found] HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\ "{42071714-76d4-11d1-8b24-00a0c9068ff3}" = "Rozszerzenie CPL kadrowania wyświetlania" -> {HKLM...CLSID} = "Rozszerzenie CPL kadrowania wyświetlania" \InProcServer32\(Default) = "deskpan.dll" [file not found] "{88895560-9AA2-1069-930E-00AA0030EBC8}" = "Rozszerzenie ikony HyperTerminalu" -> {HKLM...CLSID} = "HyperTerminal Icon Ext" \InProcServer32\(Default) = "C:\WINDOWS\System32\hticons.dll" ["Hilgraeve, Inc."] "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" = "WinRAR shell extension" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] "{23170F69-40C1-278A-1000-000100020000}" = "7-Zip Shell Extension" -> {HKLM...CLSID} = "7-Zip Shell Extension" \InProcServer32\(Default) = "C:\Program Files\7-Zip\7-zip.dll" ["Igor Pavlov"] "{453D1B6D-BD6A-4FA1-B876-9E4DD848D434}" = "AQQ File Transfer Shell Extension" -> {HKLM...CLSID} = "AQQ File Transfer Shell Extension" \InProcServer32\(Default) = "C:\PROGRA~1\Wapster\AQQ\System\AQQSHE~1.DLL" [null data] HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\ <<!>> "{57B86673-276A-48B2-BAE7-C6DBB3020EB8}" = "AVG Anti-Spyware 7.5" -> {HKLM...CLSID} = "CShellExecuteHookImpl Object" \InProcServer32\(Default) = "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\shellexecutehook.dll" ["Anti-Malware Development a.s."] HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\ <<!>> "System" = "kdfnb.exe" [null data] HKLM\Software\Classes\*\shellex\ContextMenuHandlers\ 7-Zip\(Default) = "{23170F69-40C1-278A-1000-000100020000}" -> {HKLM...CLSID} = "7-Zip Shell Extension" \InProcServer32\(Default) = "C:\Program Files\7-Zip\7-zip.dll" ["Igor Pavlov"] AQQFileTransfer\(Default) = "{453D1B6D-BD6A-4FA1-B876-9E4DD848D434}" -> {HKLM...CLSID} = "AQQ File Transfer Shell Extension" \InProcServer32\(Default) = "C:\PROGRA~1\Wapster\AQQ\System\AQQSHE~1.DLL" [null data] AVG Anti-Spyware\(Default) = "{8934FCEF-F5B8-468f-951F-78A921CD3920}" -> {HKLM...CLSID} = "CContextScan Object" \InProcServer32\(Default) = "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\context.dll" ["Anti-Malware Development a.s."] WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\ 7-Zip\(Default) = "{23170F69-40C1-278A-1000-000100020000}" -> {HKLM...CLSID} = "7-Zip Shell Extension" \InProcServer32\(Default) = "C:\Program Files\7-Zip\7-zip.dll" ["Igor Pavlov"] AVG Anti-Spyware\(Default) = "{8934FCEF-F5B8-468f-951F-78A921CD3920}" -> {HKLM...CLSID} = "CContextScan Object" \InProcServer32\(Default) = "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\context.dll" ["Anti-Malware Development a.s."] WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\ WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] Group Policies {GPedit.msc branch and setting}: ----------------------------------------------- Note: detected settings may not have any effect. HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System\ "DisableRegistryTools" = (REG_DWORD) hex:0x00000000 {User Configuration|Administrative Templates|System| Prevent access to registry editing tools} HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\ "shutdownwithoutlogon" = (REG_DWORD) hex:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| Shutdown: Allow system to be shut down without having to log on} "undockwithoutlogon" = (REG_DWORD) hex:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| Devices: Allow undock without having to log on} Active Desktop and Wallpaper: ----------------------------- Active Desktop may be disabled at this entry: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState Displayed if Active Desktop enabled and wallpaper not set by Group Policy: HKCU\Software\Microsoft\Internet Explorer\Desktop\General\ "Wallpaper" = "C:\WINDOWS\web\wallpaper\Idylla.bmp" Displayed if Active Desktop disabled and wallpaper not set by Group Policy: HKCU\Control Panel\Desktop\ "Wallpaper" = "C:\WINDOWS\web\wallpaper\Idylla.bmp" Enabled Screen Saver: --------------------- HKCU\Control Panel\Desktop\ "SCRNSAVE.EXE" = "C:\WINDOWS\System32\logon.scr" [MS] Winsock2 Service Provider DLLs: ------------------------------- Namespace Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++} 000000000001\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS] 000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS] 000000000003\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS] Transport Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++} 0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range: %SystemRoot%\system32\mswsock.dll [MS], 01 - 03, 06 - 15 %SystemRoot%\system32\rsvpsp.dll [MS], 04 - 05 Miscellaneous IE Hijack Points ------------------------------ HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks\ <<H>> "{08C06D61-F1F3-4799-86F8-BE1A89362C85}" = (no title provided) -> {HKLM...CLSID} = "Search Class" \InProcServer32\(Default) = "C:\PROGRA~1\NEOSTR~1\SEARCH~1.DLL" [empty string] Running Services (Display Name, Service Name, Path {Service DLL}): ------------------------------------------------------------------ AVG Anti-Spyware Guard, AVG Anti-Spyware Guard, "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe" ["Anti-Malware Development a.s."] ---------- <<!>>: Suspicious data at a malware launch point. <<H>>: Suspicious data at a browser hijack point. + This report excludes default entries except where indicated. + To see *everywhere* the script checks and *everything* it finds, launch it from a command prompt or a shortcut with the -all parameter. + To search all directories of local fixed drives for DESKTOP.INI DLL launch points, use the -supp parameter or answer "No" at the first message box and "Yes" at the second message box. ---------- (total run time: 258 seconds, including 18 seconds for message boxes)

CS:

Kod: Zaznacz wszystko: ComboScan v20070306.20 run by Jaskulski on 2007-03-17 at 15:12:19 Computer is in Normal Mode. -------------------------------------------------------------------------------- -- HijackThis (run as Jaskulski.exe) ------------------------------------------- Logfile of HijackThis v1.99.1 Scan saved at 15:12:24, on 2007-03-17 Platform: Windows XP (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 (6.00.2600.0000) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\csrss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\System32\alg.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\rundll32.exe C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe C:\WINDOWS\System32\ctfmon.exe C:\Program Files\Gadu-Gadu\gg.exe C:\PROGRA~1\NEOSTR~1\TaskBarIcon.exe C:\Program Files\neostrada tp\neostradatp.exe C:\Program Files\neostrada tp\ComComp.exe C:\PROGRA~1\NEOSTR~1\Toaster.exe C:\PROGRA~1\NEOSTR~1\Inactivity.exe C:\PROGRA~1\NEOSTR~1\PollingModule.exe C:\WINDOWS\System32\ALERTM~1\ALERTM~1.EXE C:\WINDOWS\System32\wuauclt.exe C:\Program Files\neostrada tp\Watch.exe C:\WINDOWS\System32\wuauclt.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Documents and Settings\Jaskulski.JASKULSK-VK4IL1\Pulpit\comboscan.exe C:\DOCUME~1\JASKUL~4.JAS\Pulpit\HIJACK~1\JASKUL~1.EXE R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.pl/ R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = neostrada tp R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\NEOSTR~1\SEARCH~1.DLL O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0 CE\Reader\ActiveX\AcroIEHelper.ocx O2 - BHO: (no name) - {FCADDC14-BD46-408A-9842-CDBE1C6D37E3} - C:\WINDOWS\system32\themes_2.dll (file missing) O2 - BHO: (no name) - {FCADDC14-BD46-408A-9842-CDBE1C6D37EB} - C:\WINDOWS\system32\themes_2.dll (file missing) O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\NEOSTR~1\Watch.exe O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\NEOSTR~1\GestMaj.exe TaskBarIcon.exe O4 - HKLM\..\Run: [AdslTaskBar] rundll32.exe stmctrl.dll,TaskBar O4 - HKLM\..\Run: [snpstd3] C:\WINDOWS\vsnpstd3.exe O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" O4 - HKLM\..\Run: [PViever] "C:\Program Files\PViever\pviever.exe" hide O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe O4 - HKCU\..\Run: [beta] c:\DriverLoad\windrv0.exe O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O17 - HKLM\System\CCS\Services\Tcpip\..\{A4E0EDCA-D39D-437B-80E1-2F4F20CE5629}: NameServer = 194.204.159.1 217.98.63.164 O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.116.130 85.255.112.191 O17 - HKLM\System\CS2\Services\Tcpip\Parameters: NameServer = 85.255.116.130 85.255.112.191 O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.116.130 85.255.112.191 O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe O23 - Service: MS Software Shadow Download Provider (dnlsvc) - Unknown owner - C:\DOCUME~1\JASKUL~4.JAS\USTAWI~1\Temp\dnlsvc.exe (file missing) O23 - Service: France Telecom Routing Table Service (FTRTSVC) - Unknown owner - C:\WINDOWS\System32\FTRTSVC.exe (file missing) -- Files created between 2007-02-17 and 2007-03-17 ----------------------------- 2007-03-16 16:36:05 0 d-------- C:\Program Files\Banner Maker Pro 6<BANNER~1> 2007-03-16 16:06:46 0 --a------ C:\WINDOWS\System32\dload.exe 2007-03-15 19:07:53 0 d-------- C:\WINDOWS\CSC 2007-03-15 16:29:41 0 d-------- C:\$WIN_NT$.~BT 2007-03-15 16:29:36 0 d-------- C:\WINDOWS\setup.pss 2007-03-14 17:39:51 0 d-------- C:\fixwareout<FIXWAR~1> 2007-03-13 21:07:01 0 d-------- C:\WINDOWS\System32\SoftwareDistribution<SOFTWA~1> 2007-03-13 21:04:35 0 d-------- C:\WINDOWS\SoftwareDistribution<SOFTWA~1> 2007-03-13 21:03:11 195352 --a------ C:\WINDOWS\System32\wuaueng1.dll 2007-03-13 21:03:09 173536 --a------ C:\WINDOWS\System32\wuweb.dll 2007-03-13 21:03:09 41240 --a------ C:\WINDOWS\System32\wups.dll 2007-03-13 21:03:09 128280 --a------ C:\WINDOWS\System32\wucltui.dll 2007-03-13 21:03:09 175384 --a------ C:\WINDOWS\System32\wuauclt1.exe 2007-03-13 21:03:09 466200 --a------ C:\WINDOWS\System32\wuapi.dll 2007-03-13 20:54:35 310272 --a------ C:\WINDOWS\System32\winhttp.dll 2007-03-12 17:18:40 1104 --a------ C:\WINDOWS\System32\tmp.reg 2007-03-12 17:15:17 79360 --a------ C:\WINDOWS\System32\swxcacls.exe 2007-03-12 17:15:17 40960 --a------ C:\WINDOWS\System32\swsc.exe 2007-03-12 17:15:17 135168 --a------ C:\WINDOWS\System32\swreg.exe 2007-03-12 17:15:17 288417 --a------ C:\WINDOWS\System32\SrchSTS.exe 2007-03-12 17:15:17 53248 --a------ C:\WINDOWS\System32\Process.exe 2007-03-12 17:15:17 51200 --a------ C:\WINDOWS\System32\dumphive.exe 2007-03-11 10:19:58 3968 --a------ C:\WINDOWS\System32\drivers\AvgAsCln.sys 2007-03-10 23:23:14 0 d-------- C:\WINDOWS\RegisteredPackages<REGIST~2> 2007-03-10 23:18:52 47104 --a------ C:\WINDOWS\System32\wstdecod.dll 2007-03-10 23:18:52 354816 --a------ C:\WINDOWS\System32\psisdecd.dll 2007-03-10 23:18:52 16896 --a------ C:\WINDOWS\System32\msyuv.dll 2007-03-10 23:18:52 1230336 --a------ C:\WINDOWS\System32\msvidctl.dll 2007-03-10 23:18:52 18688 --a------ C:\WINDOWS\System32\drivers\wstcodec.sys 2007-03-10 23:18:52 14976 --a------ C:\WINDOWS\System32\drivers\streamip.sys 2007-03-10 23:18:52 10880 --a------ C:\WINDOWS\System32\drivers\slip.sys 2007-03-10 23:18:52 10112 --a------ C:\WINDOWS\System32\drivers\ndisip.sys 2007-03-10 23:18:52 83968 --a------ C:\WINDOWS\System32\drivers\nabtsfec.sys 2007-03-10 23:18:52 52096 --a------ C:\WINDOWS\System32\drivers\msdv.sys 2007-03-10 23:18:52 15104 --a------ C:\WINDOWS\System32\drivers\mpe.sys 2007-03-10 23:18:52 16384 --a------ C:\WINDOWS\System32\drivers\ccdecode.sys 2007-03-10 23:18:52 11392 --a------ C:\WINDOWS\System32\drivers\bdasup.sys 2007-03-09 23:03:27 8192 --a------ C:\WINDOWS\System32\kbdkor.dll 2007-03-09 23:03:27 8704 --a------ C:\WINDOWS\System32\kbdjpn.dll 2007-03-09 23:03:26 6144 --a------ C:\WINDOWS\System32\kbd106.dll 2007-03-09 23:03:26 5632 --a------ C:\WINDOWS\System32\kbd103.dll 2007-03-09 23:03:26 6144 --a------ C:\WINDOWS\System32\kbd101c.dll 2007-03-09 23:03:23 6144 --a------ C:\WINDOWS\System32\kbd101b.dll 2007-03-09 22:25:47 0 d-------- C:\Program Files\Wapster 2007-03-09 20:35:59 50688 --a------ C:\WINDOWS\System32\vfwwdm32.dll 2007-03-09 20:34:45 94208 --a------ C:\WINDOWS\amcap.exe 2007-03-09 20:34:20 53248 --a------ C:\WINDOWS\System32\dsnpstd3.dll 2007-03-09 20:34:17 419200 --a------ C:\WINDOWS\System32\drivers\snpstd3.sys 2007-03-09 20:34:16 57344 --a------ C:\WINDOWS\System32\rsnpstd3.dll 2007-03-09 20:34:16 61440 --a------ C:\WINDOWS\System32\csnpstd3.dll 2007-03-09 20:34:15 36864 --a------ C:\WINDOWS\System32\vsnpstd3.dll 2007-03-09 20:34:14 20480 --a------ C:\WINDOWS\usnpstd3.exe 2007-03-09 12:33:12 0 d-------- C:\Program Files\AdultAccess<ADULTA~1> 2007-03-08 18:29:23 24832 --a------ C:\WINDOWS\System32\drivers\usbprint.sys 2007-03-08 18:00:44 0 d--h----- C:\WINDOWS\PIF 2007-03-08 17:36:31 0 d-------- C:\Program Files\7-Zip 2007-03-07 19:32:09 0 d-------- C:\Program Files\Migajek Software<MIGAJE~1> 2007-03-07 18:41:38 0 --a------ C:\WINDOWS\nsreg.dat 2007-03-06 17:53:56 0 d-------- C:\Program Files\Pokemon PC 2.0<POKEMO~1.0> 2007-03-05 21:06:51 1803 --a------ C:\WINDOWS\unins000.dat 2007-03-05 21:04:46 0 d-------- C:\WINDOWS\System32\InsFiles 2007-03-05 21:04:39 425984 -ra------ C:\WINDOWS\System32\stmcfg32.dll 2007-03-05 21:04:39 102400 -ra------ C:\WINDOWS\stmtrace.exe 2007-03-05 21:04:39 65536 -ra------ C:\WINDOWS\DSLTest.exe 2007-03-05 21:04:37 151552 -ra------ C:\WINDOWS\System32\stmctrl.dll 2007-03-05 21:04:37 36864 -ra------ C:\WINDOWS\System32\stmclean.exe 2007-03-05 21:04:36 684265 -ra------ C:\WINDOWS\System32\drivers\torususb.sys 2007-03-05 21:04:36 60255 -ra------ C:\WINDOWS\System32\drivers\stmatm.sys 2007-03-05 21:04:12 0 d-------- C:\Program Files\ZTE ZXDSL 852<ZTEZXD~1> 2007-03-05 21:00:33 0 d-------- C:\WINDOWS\LastGood 2007-03-05 20:53:00 0 d-------- C:\WINDOWS\System32\AlertModule<ALERTM~1> 2007-03-05 20:52:52 36864 --a------ C:\WINDOWS\System32\IfHelper.dll 2007-03-05 20:13:10 0 d-------- C:\WINDOWS\Profiles 2007-03-05 20:12:52 0 d-------- C:\WINDOWS\System32\Adobe 2007-03-05 20:12:39 327168 --a------ C:\WINDOWS\IsUn0415.exe 2007-03-05 19:57:38 0 d-------- C:\WINDOWS\LastGood.Tmp 2007-03-05 19:45:25 32768 --a------ C:\WINDOWS\System32\WooDial2000.dll<WOODIA~1.DLL> 2007-03-05 19:44:07 94208 --a------ C:\WINDOWS\System32\W32n50.dll 2007-03-05 19:44:07 16128 -----n--- C:\WINDOWS\System32\PCANDIS5.SYS 2007-03-05 19:43:38 0 d-------- C:\WINDOWS 2007-03-05 19:43:38 0 d-------- C:\WINDOWS\WinSxS 2007-03-05 19:43:38 0 dr------- C:\WINDOWS\Web 2007-03-05 19:43:38 0 d-------- C:\WINDOWS\twain_32 2007-03-05 19:43:38 0 d-------- C:\WINDOWS\system32 2007-03-05 19:43:38 0 d-------- C:\WINDOWS\System32\wins 2007-03-05 19:43:38 0 d-------- C:\WINDOWS\System32\wbem 2007-03-05 19:43:38 0 d-------- C:\WINDOWS\System32\usmt 2007-03-05 19:43:38 0 d-------- C:\WINDOWS\System32\spool 2007-03-05 19:43:38 0 d-------- C:\WINDOWS\System32\ShellExt 2007-03-05 19:43:38 0 d-------- C:\WINDOWS\System32\Setup 2007-03-05 19:43:38 0 d-------- C:\WINDOWS\System32\ras 2007-03-05 19:43:38 0 d-------- C:\WINDOWS\System32\oobe 2007-03-05 19:43:38 0 d-------- C:\WINDOWS\System32\npp 2007-03-05 19:43:38 0 d-------- C:\WINDOWS\System32\mui 2007-03-05 19:43:38 0 d-------- C:\WINDOWS\System32\inetsrv 2007-03-05 19:43:38 0 d-------- C:\WINDOWS\System32\IME 2007-03-05 19:43:38 0 d-------- C:\WINDOWS\System32\icsxml 2007-03-05 19:43:38 0 d-------- C:\WINDOWS\System32\ias 2007-03-05 19:43:38 0 d-------- C:\WINDOWS\System32\export 2007-03-05 19:43:38 0 d-------- C:\WINDOWS\System32\drivers 2007-03-05 19:43:38 0 d-------- C:\WINDOWS\System32\drivers\etc 2007-03-05 19:43:38 0 d-------- C:\WINDOWS\System32\drivers\disdn 2007-03-05 19:43:38 0 dr-hs--c- C:\WINDOWS\System32\dllcache 2007-03-05 19:43:38 0 d-------- C:\WINDOWS\System32\dhcp 2007-03-05 19:43:38 0 d-------- C:\WINDOWS\System32\config 2007-03-05 19:43:38 0 d-------- C:\WINDOWS\System32\3com_dmi 2007-03-05 19:43:38 0 d-------- C:\WINDOWS\System32\3076 2007-03-05 19:43:38 0 d-------- C:\WINDOWS\System32\2052 2007-03-05 19:43:38 0 d-------- C:\WINDOWS\System32\1054 2007-03-05 19:43:38 0 d-------- C:\WINDOWS\System32\1045 2007-03-05 19:43:38 0 d-------- C:\WINDOWS\System32\1042 2007-03-05 19:43:38 0 d-------- C:\WINDOWS\System32\1041 2007-03-05 19:43:38 0 d-------- C:\WINDOWS\System32\1037 2007-03-05 19:43:38 0 d-------- C:\WINDOWS\System32\1033 2007-03-05 19:43:38 0 d-------- C:\WINDOWS\System32\1031 2007-03-05 19:43:38 0 d-------- C:\WINDOWS\System32\1028 2007-03-05 19:43:38 0 d-------- C:\WINDOWS\System32\1025 2007-03-05 19:43:38 0 d-------- C:\WINDOWS\system 2007-03-05 19:43:38 0 d-------- C:\WINDOWS\security 2007-03-05 19:43:38 0 d-------- C:\WINDOWS\Resources<RESOUR~1> 2007-03-05 19:43:38 0 d-------- C:\WINDOWS\repair 2007-03-05 19:43:38 0 d-------- C:\WINDOWS\mui 2007-03-05 19:43:38 0 d-------- C:\WINDOWS\msapps 2007-03-05 19:43:38 0 d-------- C:\WINDOWS\msagent 2007-03-05 19:43:38 0 d-------- C:\WINDOWS\Media 2007-03-05 19:43:38 0 d-------- C:\WINDOWS\java 2007-03-05 19:43:38 0 d--h----- C:\WINDOWS\inf 2007-03-05 19:43:38 0 d-------- C:\WINDOWS\ime 2007-03-05 19:43:38 0 d-------- C:\WINDOWS\Help 2007-03-05 19:43:38 0 dr--s---- C:\WINDOWS\Fonts 2007-03-05 19:43:38 0 d-------- C:\WINDOWS\Driver Cache<DRIVER~1> 2007-03-05 19:43:38 0 d-------- C:\WINDOWS\Debug 2007-03-05 19:43:38 0 d-------- C:\WINDOWS\Cursors 2007-03-05 19:43:38 0 d-------- C:\WINDOWS\Connection Wizard<CONNEC~1> 2007-03-05 19:43:38 0 d-------- C:\WINDOWS\Config 2007-03-05 19:43:38 0 d-------- C:\WINDOWS\AppPatch 2007-03-05 19:43:38 0 d-------- C:\WINDOWS\addins 2007-03-05 19:42:19 41068 -----n--- C:\WINDOWS\System32\ActPanel.dll 2007-03-05 19:38:41 0 d--hs---- C:\WINDOWS\ftpcache 2007-03-05 19:36:13 0 d--hs---- C:\WINDOWS\Installer<INSTAL~1> 2007-03-05 19:34:10 0 d-------- C:\WINDOWS\Prefetch 2007-03-05 19:20:02 0 d-------- C:\WINDOWS\System32\xircom 2007-03-05 19:18:15 112128 --a------ C:\WINDOWS\System32\mapi32.dll 2007-03-05 19:15:11 0 dr------- C:\WINDOWS\Offline Web Pages<OFFLIN~1> 2007-03-05 19:15:11 0 d---s---- C:\WINDOWS\Downloaded Program Files<DOWNLO~1> 2007-03-05 19:13:57 0 d-------- C:\WINDOWS\srchasst 2007-03-05 19:13:42 0 d-------- C:\WINDOWS\System32\Macromed 2007-03-05 19:13:42 0 d-------- C:\WINDOWS\System32\DirectX 2007-03-05 19:13:30 17408 --a------ C:\WINDOWS\System32\qmgrprxy.dll 2007-03-05 19:13:30 179200 --a------ C:\WINDOWS\System32\qmgr.dll 2007-03-05 19:13:02 40960 --a------ C:\WINDOWS\System32\safrslv.dll 2007-03-05 19:13:02 26624 --a------ C:\WINDOWS\System32\safrdm.dll 2007-03-05 19:13:01 39424 --a------ C:\WINDOWS\System32\safrcdlg.dll 2007-03-05 19:13:01 33792 --a------ C:\WINDOWS\System32\racpldlg.dll 2007-03-05 19:13:01 11264 --a------ C:\WINDOWS\System32\atrace.dll 2007-03-05 19:12:47 155648 --a------ C:\WINDOWS\System32\srsvc.dll 2007-03-05 19:12:47 219136 --a------ C:\WINDOWS\System32\srrstr.dll 2007-03-05 19:12:47 61952 --a------ C:\WINDOWS\System32\srclient.dll 2007-03-05 19:12:47 0 d-------- C:\WINDOWS\System32\Restore 2007-03-05 19:12:47 70400 --a------ C:\WINDOWS\System32\drivers\sr.sys 2007-03-05 19:12:46 12288 --a------ C:\WINDOWS\System32\nmevtmsg.dll 2007-03-05 19:12:46 32384 --a------ C:\WINDOWS\System32\mnmdd.dll 2007-03-05 19:12:46 28672 --a------ C:\WINDOWS\System32\isrdbg32.dll 2007-03-05 19:12:46 73728 --a------ C:\WINDOWS\System32\ils.dll 2007-03-05 19:12:45 24576 --a------ C:\WINDOWS\System32\nmmkcert.dll 2007-03-05 19:12:45 65536 --a------ C:\WINDOWS\System32\msconf.dll 2007-03-05 19:12:45 32768 --a------ C:\WINDOWS\System32\mnmsrvc.exe 2007-03-05 19:12:44 90624 --a------ C:\WINDOWS\System32\msoert2.dll 2007-03-05 19:12:44 0 d-------- C:\WINDOWS\PCHEALTH 2007-03-05 19:12:43 228864 --a------ C:\WINDOWS\System32\msoeacct.dll 2007-03-05 19:12:43 49152 --a------ C:\WINDOWS\System32\inetres.dll 2007-03-05 19:12:43 67584 --a------ C:\WINDOWS\System32\acctres.dll 2007-03-05 19:12:42 0 d---s---- C:\WINDOWS\Tasks 2007-03-05 19:12:42 159744 --a------ C:\WINDOWS\System32\schedsvc.dll 2007-03-05 19:12:42 593920 --a------ C:\WINDOWS\System32\inetcomm.dll 2007-03-05 19:12:41 9728 --a------ C:\WINDOWS\System32\mstinit.exe 2007-03-05 19:12:41 253440 --a------ C:\WINDOWS\System32\mstask.dll 2007-03-05 19:12:41 61440 --a------ C:\WINDOWS\System32\icwphbk.dll 2007-03-05 19:12:41 69632 --a------ C:\WINDOWS\System32\icwdial.dll 2007-03-05 19:12:40 81920 --a------ C:\WINDOWS\System32\isign32.dll 2007-03-05 19:12:40 270336 --a------ C:\WINDOWS\System32\inetcfg.dll 2007-03-05 19:12:38 16384 --a------ C:\WINDOWS\System32\icfgnt5.dll 2007-03-05 19:11:07 21856 --a------ C:\WINDOWS\System32\emptyregdb.dat<EMPTYR~1.DAT> 2007-03-05 19:10:32 0 d-------- C:\WINDOWS\Registration<REGIST~1> 2007-03-05 19:09:54 5632 --a------ C:\WINDOWS\System32\write.exe 2007-03-05 19:09:45 183296 --a------ C:\WINDOWS\System32\accwiz.exe 2007-03-05 19:09:44 139264 --a------ C:\WINDOWS\System32\sndvol32.exe 2007-03-05 19:09:44 125440 --a------ C:\WINDOWS\System32\sndrec32.exe 2007-03-05 19:09:44 118272 --a------ C:\WINDOWS\System32\mplay32.exe 2007-03-05 19:09:44 494592 --a------ C:\WINDOWS\System32\hypertrm.dll 2007-03-05 19:09:44 44544 --a------ C:\WINDOWS\System32\hticons.dll 2007-03-05 19:09:43 73216 --a------ C:\WINDOWS\System32\avwav.dll 2007-03-05 19:09:43 231424 --a------ C:\WINDOWS\System32\avtapi.dll 2007-03-05 19:09:43 16384 --a------ C:\WINDOWS\System32\avmeter.dll 2007-03-05 19:09:42 35328 --a------ C:\WINDOWS\System32\winchat.exe 2007-03-05 19:09:41 342016 --a------ C:\WINDOWS\System32\mspaint.exe 2007-03-05 19:09:34 99328 --a------ C:\WINDOWS\System32\clipbrd.exe 2007-03-05 19:09:33 605696 --a------ C:\WINDOWS\System32\getuname.dll 2007-03-05 19:09:32 80896 --a------ C:\WINDOWS\System32\charmap.exe 2007-03-05 19:09:32 115200 --a------ C:\WINDOWS\System32\calc.exe 2007-03-05 19:09:31 119808 --a------ C:\WINDOWS\System32\winmine.exe 2007-03-05 19:09:31 534016 --a------ C:\WINDOWS\System32\spider.exe 2007-03-05 19:09:31 57344 --a------ C:\WINDOWS\System32\sol.exe 2007-03-05 19:09:30 1343768 --a------ C:\WINDOWS\System32\wuaueng.dll 2007-03-05 19:09:30 125208 --a------ C:\WINDOWS\System32\wuauclt.exe 2007-03-05 19:09:30 128000 --a------ C:\WINDOWS\System32\mshearts.exe 2007-03-05 19:09:30 55808 --a------ C:\WINDOWS\System32\freecell.exe 2007-03-05 19:09:29 4096 --a------ C:\WINDOWS\System32\wuauserv.dll 2007-03-05 19:09:29 89600 --a------ C:\WINDOWS\System32\tscfgwmi.dll 2007-03-05 19:09:29 20232 --a------ C:\WINDOWS\System32\drivers\tdtcp.sys 2007-03-05 19:09:29 11144 --a------ C:\WINDOWS\System32\drivers\tdpipe.sys 2007-03-05 19:09:29 107912 --a------ C:\WINDOWS\System32\drivers\rdpwd.sys 2007-03-05 19:09:28 9728 --a------ C:\WINDOWS\System32\reset.exe 2007-03-05 19:09:28 56832 --a------ C:\WINDOWS\System32\remotepg.dll 2007-03-05 19:09:28 12288 --a------ C:\WINDOWS\System32\rdsaddin.exe 2007-03-05 19:09:28 503296 --a------ C:\WINDOWS\System32\mstscax.dll 2007-03-05 19:09:28 387072 --a------ C:\WINDOWS\System32\mstsc.exe 2007-03-05 19:09:27 1225 --a------ C:\WINDOWS\System32\usrlogon.cmd 2007-03-05 19:09:27 16384 --a------ C:\WINDOWS\System32\tskill.exe 2007-03-05 19:09:27 40448 --a------ C:\WINDOWS\System32\tscupgrd.exe 2007-03-05 19:09:27 131072 --a------ C:\WINDOWS\System32\sessmgr.exe 2007-03-05 19:09:27 61952 --a------ C:\WINDOWS\System32\rdshost.exe 2007-03-05 19:09:27 134656 --a------ C:\WINDOWS\System32\rdchost.dll 2007-03-05 19:09:26 17920 --a------ C:\WINDOWS\System32\tsshutdn.exe 2007-03-05 19:09:26 15360 --a------ C:\WINDOWS\System32\tsdiscon.exe 2007-03-05 19:09:26 15360 --a------ C:\WINDOWS\System32\tscon.exe 2007-03-05 19:09:26 198656 --a------ C:\WINDOWS\System32\termsrv.dll 2007-03-05 19:09:26 15360 --a------ C:\WINDOWS\System32\shadow.exe 2007-03-05 19:09:26 16384 --a------ C:\WINDOWS\System32\rwinsta.exe 2007-03-05 19:09:26 33792 --a------ C:\WINDOWS\System32\regini.exe 2007-03-05 19:09:25 73864 --a------ C:\WINDOWS\System32\rdpwsx.dll 2007-03-05 19:09:25 14848 --a------ C:\WINDOWS\System32\rdpsnd.dll 2007-03-05 19:09:25 41984 --a------ C:\WINDOWS\System32\rdpclip.exe 2007-03-05 19:09:25 4608 --a------ C:\WINDOWS\System32\rdpcfgex.dll 2007-03-05 19:09:25 22528 --a------ C:\WINDOWS\System32\qwinsta.exe 2007-03-05 19:09:25 19456 --a------ C:\WINDOWS\System32\qprocess.exe 2007-03-05 19:09:25 17408 --a------ C:\WINDOWS\System32\qappsrv.exe 2007-03-05 19:09:25 22528 --a------ C:\WINDOWS\System32\msg.exe 2007-03-05 19:09:25 15872 --a------ C:\WINDOWS\System32\logoff.exe 2007-03-05 19:09:24 83968 --a------ C:\WINDOWS\System32\mtxoci.dll 2007-03-05 19:09:24 151040 --a------ C:\WINDOWS\System32\msdtcuiu.dll 2007-03-05 19:09:24 360960 --a------ C:\WINDOWS\System32\msdtcprx.dll 2007-03-05 19:09:24 0 d-------- C:\WINDOWS\System32\MsDtc 2007-03-05 19:09:24 8704 --a------ C:\WINDOWS\System32\icaapi.dll 2007-03-05 19:09:24 32768 --a------ C:\WINDOWS\System32\cfgbkend.dll 2007-03-05 19:09:24 15872 --a------ C:\WINDOWS\System32\cdmodem.dll 2007-03-05 19:09:23 9728 --a------ C:\WINDOWS\System32\xolehlp.dll 2007-03-05 19:09:23 869376 --a------ C:\WINDOWS\System32\msdtctm.dll 2007-03-05 19:09:22 54784 --a------ C:\WINDOWS\System32\msdtclog.dll 2007-03-05 19:09:22 6144 --a------ C:\WINDOWS\System32\msdtc.exe 2007-03-05 19:09:20 25088 --a------ C:\WINDOWS\System32\mtxlegih.dll 2007-03-05 19:09:20 4096 --a------ C:\WINDOWS\System32\mtxex.dll 2007-03-05 19:09:20 20480 --a------ C:\WINDOWS\System32\mtxdm.dll 2007-03-05 19:09:20 5120 --a------ C:\WINDOWS\System32\dcomcnfg.exe 2007-03-05 19:09:20 82432 --a------ C:\WINDOWS\System32\comrepl.dll 2007-03-05 19:09:20 25600 --a------ C:\WINDOWS\System32\comaddin.dll 2007-03-05 19:09:20 0 d-------- C:\WINDOWS\System32\Com 2007-03-05 19:09:20 56832 --a------ C:\WINDOWS\System32\colbact.dll 2007-03-05 19:09:19 54272 --a------ C:\WINDOWS\System32\stclient.dll 2007-03-05 19:09:19 100864 --a------ C:\WINDOWS\System32\clbcatex.dll 2007-03-05 19:09:19 583168 --a------ C:\WINDOWS\System32\catsrvut.dll 2007-03-05 19:09:19 85504 --a------ C:\WINDOWS\System32\catsrvps.dll 2007-03-05 19:09:19 215040 --a------ C:\WINDOWS\System32\catsrv.dll 2007-03-05 19:09:18 495616 --a------ C:\WINDOWS\System32\comuid.dll 2007-03-05 19:09:18 1139200 --a------ C:\WINDOWS\System32\comsvcs.dll 2007-03-05 19:09:18 147456 --a------ C:\WINDOWS\System32\comsnap.dll 2007-03-05 19:09:18 468480 --a------ C:\WINDOWS\System32\clbcatq.dll 2007-03-05 19:09:00 53248 --a------ C:\WINDOWS\System32\servdeps.dll 2007-03-05 19:09:00 16896 --a------ C:\WINDOWS\System32\mmfutil.dll 2007-03-05 19:09:00 57344 --a------ C:\WINDOWS\System32\licwmi.dll 2007-03-05 19:09:00 177152 --a------ C:\WINDOWS\System32\cmprops.dll 2007-03-05 19:08:57 37896 --a------ C:\WINDOWS\System32\drivers\termdd.sys 2007-03-05 19:08:56 181632 --a------ C:\WINDOWS\System32\drivers\rdpdr.sys 2007-03-05 19:04:16 5632 --a------ C:\WINDOWS\System32\drivers\splitter.sys 2007-03-05 19:04:13 2816 --a------ C:\WINDOWS\System32\drivers\drmkaud.sys 2007-03-05 19:04:10 122472 --a------ C:\WINDOWS\System32\drivers\aec.sys 2007-03-05 19:04:06 54272 --a------ C:\WINDOWS\System32\drivers\swmidi.sys 2007-03-05 19:04:00 79616 --a------ C:\WINDOWS\System32\drivers\wdmaud.sys 2007-03-05 19:03:57 50048 --a------ C:\WINDOWS\System32\drivers\DMusic.sys 2007-03-05 19:03:50 159232 --a------ C:\WINDOWS\System32\drivers\kmixer.sys 2007-03-05 19:03:43 57472 --a------ C:\WINDOWS\System32\drivers\sysaudio.sys 2007-03-05 19:03:32 3072 --a------ C:\WINDOWS\System32\drivers\audstub.sys 2007-03-05 19:03:05 9728 --a------ C:\WINDOWS\System32\drivers\gameenum.sys 2007-03-05 19:02:45 57088 --a------ C:\WINDOWS\System32\drivers\redbook.sys 2007-03-05 19:02:26 1738496 --a------ C:\WINDOWS\System32\nv4.dll 2007-03-05 19:02:26 731648 --a------ C:\WINDOWS\System32\drivers\nv4.sys 2007-03-05 19:01:59 27392 --a------ C:\WINDOWS\System32\drivers\VIAAGP.SYS 2007-03-05 19:01:47 135040 --a------ C:\WINDOWS\System32\drivers\portcls.sys 2007-03-05 19:01:47 57344 --a------ C:\WINDOWS\System32\drivers\drmk.sys 2007-03-05 19:01:47 35200 --a------ C:\WINDOWS\System32\drivers\ac97via.sys 2007-03-05 19:01:12 70144 --a------ C:\WINDOWS\System32\usbui.dll 2007-03-05 18:54:55 6144 -ra------ C:\WINDOWS\System32\kbdtuq.dll 2007-03-05 18:54:55 6144 -ra------ C:\WINDOWS\System32\kbdtuf.dll 2007-03-05 18:54:55 5632 -ra------ C:\WINDOWS\System32\kbdazel.dll 2007-03-05 18:54:53 5632 -ra------ C:\WINDOWS\System32\kbdmon.dll 2007-03-05 18:54:53 5632 -ra------ C:\WINDOWS\System32\kbdkyr.dll 2007-03-05 18:54:51 8192 -ra------ C:\WINDOWS\System32\kbdhept.dll 2007-03-05 18:54:51 6656 -ra------ C:\WINDOWS\System32\kbdhela3.dll 2007-03-05 18:54:51 6144 -ra------ C:\WINDOWS\System32\kbdhela2.dll 2007-03-05 18:54:51 5632 -ra------ C:\WINDOWS\System32\kbdhe319.dll 2007-03-05 18:54:51 5632 -ra------ C:\WINDOWS\System32\kbdhe220.dll 2007-03-05 18:54:51 5632 -ra------ C:\WINDOWS\System32\kbdhe.dll 2007-03-05 18:54:51 6144 -ra------ C:\WINDOWS\System32\kbdgkl.dll 2007-03-05 18:54:50 5632 -ra------ C:\WINDOWS\System32\kbdlt1.dll 2007-03-05 18:54:50 5632 -ra------ C:\WINDOWS\System32\kbdlt.dll 2007-03-05 18:54:49 6144 -ra------ C:\WINDOWS\System32\kbdlv1.dll 2007-03-05 18:54:49 6144 -ra------ C:\WINDOWS\System32\kbdlv.dll 2007-03-05 18:54:49 6144 -ra------ C:\WINDOWS\System32\kbdest.dll 2007-03-05 18:54:45 6656 --a------ C:\WINDOWS\System32\kbdycl.dll 2007-03-05 18:54:45 6656 --a------ C:\WINDOWS\System32\kbdsl1.dll 2007-03-05 18:54:45 6656 --a------ C:\WINDOWS\System32\kbdsl.dll 2007-03-05 18:54:45 5632 --a------ C:\WINDOWS\System32\kbdro.dll 2007-03-05 18:54:45 5632 --a------ C:\WINDOWS\System32\kbdhu1.dll 2007-03-05 18:54:45 6656 --a------ C:\WINDOWS\System32\kbdhu.dll 2007-03-05 18:54:45 6656 --a------ C:\WINDOWS\System32\kbdcz2.dll 2007-03-05 18:54:45 6656 --a------ C:\WINDOWS\System32\kbdcz1.dll 2007-03-05 18:54:45 7168 --a------ C:\WINDOWS\System32\kbdcz.dll 2007-03-05 18:54:45 6656 --a------ C:\WINDOWS\System32\kbdcr.dll 2007-03-05 18:54:45 6656 --a------ C:\WINDOWS\System32\KBDAL.DLL 2007-03-05 18:54:43 13312 --a------ C:\WINDOWS\System32\irclass.dll 2007-03-05 18:54:42 24661 --a------ C:\WINDOWS\System32\spxcoins.dll 2007-03-05 18:54:42 103424 --a------ C:\WINDOWS\System32\EqnClass.Dll 2007-03-05 18:54:42 10496 --a------ C:\WINDOWS\System32\drivers\irenum.sys 2007-03-05 18:54:42 85532 --a------ C:\WINDOWS\System32\dgsetup.dll 2007-03-05 18:54:42 176157 --a------ C:\WINDOWS\System32\dgrpsetu.dll 2007-03-05 18:54:42 6656 --a------ C:\WINDOWS\System32\batt.dll 2007-03-05 18:54:41 9168 --a------ C:\WINDOWS\system\VER.DLL 2007-03-05 18:54:41 19200 --a------ C:\WINDOWS\system\TAPI.DLL 2007-03-05 18:54:41 5120 --a------ C:\WINDOWS\system\SHELL.DLL 2007-03-05 18:54:41 24064 --a------ C:\WINDOWS\system\OLESVR.DLL 2007-03-05 18:54:41 83456 --a------ C:\WINDOWS\system\OLECLI.DLL 2007-03-05 18:54:41 127008 --a------ C:\WINDOWS\system\MSVIDEO.DLL 2007-03-05 18:54:40 69712 --a------ C:\WINDOWS\system\MMSYSTEM.DLL 2007-03-05 18:54:40 9936 --a------ C:\WINDOWS\system\LZEXPAND.DLL 2007-03-05 18:54:40 33376 --a------ C:\WINDOWS\system\COMMDLG.DLL 2007-03-05 18:54:40 109488 --a------ C:\WINDOWS\system\AVIFILE.DLL 2007-03-05 18:54:40 70096 --a------ C:\WINDOWS\system\AVICAP.DLL 2007-03-05 18:54:39 15360 --a------ C:\WINDOWS\TASKMAN.EXE 2007-03-05 18:54:39 71680 --a------ C:\WINDOWS\System32\storprop.dll 2007-03-05 18:54:39 67072 --a------ C:\WINDOWS\NOTEPAD.EXE 2007-03-05 18:53:53 0 d-------- C:\WINDOWS\System32\CatRoot2 2007-03-05 18:53:53 0 d-------- C:\WINDOWS\System32\CatRoot 2007-03-05 13:10:03 0 d-------- C:\Program Files\SuperMarioPac<SUPERM~1> 2007-03-04 17:02:37 0 d-------- C:\Program Files\Zemsta Kujona<ZEMSTA~1> 2007-03-01 19:14:41 0 d-------- C:\Program Files\Enterbrain<ENTERB~1> 2007-03-01 15:46:51 0 d-------- C:\Program Files\Hotkey 2007-03-01 15:46:04 0 d-------- C:\Program Files\USB Keyboard Driver<USBKEY~1> 2007-02-26 18:56:25 0 d-------- C:\Program Files\HT NETWORKS<HTNETW~1> 2007-02-22 20:40:48 0 d-------- C:\Program Files\Common Files\snpstd3 2007-02-22 19:06:57 0 d-------- C:\Program Files\Ulead Systems<ULEADS~1> 2007-02-22 19:04:43 0 d-------- C:\Program Files\Vimicro 2007-02-20 18:43:24 0 d-------- C:\Program Files\Mobile Video Converter<MOBILE~1> 2007-02-20 18:31:35 0 d-------- C:\Program Files\YouTube Video Downloader<YOUTUB~1> 2007-02-19 18:01:53 0 d-------- C:\Program Files\ivo -- Find3M Report --------------------------------------------------------------- 2007-03-17 15:08:09 0 d-------- C:\Program Files\neostrada tp<NEOSTR~1> 2007-03-17 14:20:42 0 d-------- C:\Program Files\Mozilla Firefox<MOZILL~1> 2007-03-13 21:04:02 0 d--h----- C:\Program Files\WindowsUpdate<WINDOW~3> 2007-03-10 23:47:45 0 d-------- C:\Documents and Settings\Jaskulski.JASKULSK-VK4IL1\Dane aplikacji\CyberLink<CYBERL~1> 2007-03-09 22:00:52 0 d-------- C:\Program Files\Gadu-Gadu<GADU-G~1> 2007-03-07 19:33:15 0 d-------- C:\Documents and Settings\Jaskulski.JASKULSK-VK4IL1\Dane aplikacji\HateML 2007-03-07 18:41:26 0 d-------- C:\Documents and Settings\Jaskulski.JASKULSK-VK4IL1\Dane aplikacji\Mozilla 2007-03-06 18:37:01 0 d---s---- C:\Documents and Settings\Jaskulski.JASKULSK-VK4IL1\Dane aplikacji\Microsoft<MICROS~1> 2007-03-05 21:06:40 355830 --a------ C:\WINDOWS\System32\perfh015.dat 2007-03-05 21:06:40 49712 --a------ C:\WINDOWS\System32\perfc015.dat 2007-03-05 20:12:52 0 d-------- C:\Documents and Settings\Jaskulski.JASKULSK-VK4IL1\Dane aplikacji\Adobe 2007-03-05 20:12:46 0 d-------- C:\Documents and Settings\Jaskulski.JASKULSK-VK4IL1\Dane aplikacji\InterTrust<INTERT~1> 2007-03-05 20:08:43 0 d-------- C:\Documents and Settings\Jaskulski.JASKULSK-VK4IL1\Dane aplikacji\Help 2007-03-05 19:38:43 0 d-------- C:\Documents and Settings\Jaskulski.JASKULSK-VK4IL1\Dane aplikacji\Macromedia<MACROM~1> 2007-03-05 19:36:08 0 d-------- C:\Program Files\Messenger<MESSEN~1> 2007-03-05 19:36:06 0 d-------- C:\Documents and Settings\Jaskulski.JASKULSK-VK4IL1\Dane aplikacji\Identities<IDENTI~1> 2007-03-05 18:54:16 62 --ahs---- C:\Documents and Settings\Jaskulski.JASKULSK-VK4IL1\Dane aplikacji\desktop.ini 2007-03-05 18:34:14 0 d-------- C:\Program Files\QuickTime<QUICKT~1> 2007-03-05 18:28:31 0 d-------- C:\Program Files\AntiVir PersonalEdition Classic<ANTIVI~1> 2007-03-05 18:22:29 0 d-------- C:\Program Files\Google 2007-03-01 15:46:02 0 d--h----- C:\Program Files\InstallShield Installation Information<INSTAL~1> 2007-02-21 21:23:58 0 d-------- C:\Program Files\Grupa33 2007-02-14 20:37:06 0 d-------- C:\Program Files\eSkiMoS R2<ESKIMO~1> 2007-02-13 19:06:05 0 d-------- C:\Program Files\Common Files\Symantec Shared<SYMANT~1> 2007-02-11 14:41:34 0 d-------- C:\Program Files\FlashGet 2007-02-11 14:39:57 0 d-------- C:\Program Files\ClearSkin<CLEARS~1> 2007-02-11 14:28:34 0 d-------- C:\Program Files\ColorCast<COLORC~1> 2007-02-11 12:09:29 0 d-------- C:\Program Files\Elaborate Bytes<ELABOR~1> 2007-02-10 19:30:10 0 d-------- C:\Program Files\Ortalion Entertainment<ORTALI~1> 2007-02-10 16:24:38 0 d-------- C:\Program Files\X-Men 2007-01-30 17:14:19 0 d-------- C:\Program Files\Symantec 2007-01-30 16:21:48 0 d-------- C:\Program Files\Opera 2007-01-30 16:20:49 0 d-------- C:\Program Files\Winamp 2007-01-30 16:19:48 0 d-------- C:\Program Files\Azureus 2007-01-30 10:00:24 0 d-------- C:\Program Files\Kaspersky Lab<KASPER~1> 2007-01-27 22:46:07 0 d-------- C:\Program Files\WinFast 2007-01-27 12:16:26 0 d-------- C:\Program Files\REAPER 2007-01-27 12:16:11 0 d-------- C:\Program Files\VirtualDJ<VIRTUA~1> 2007-01-27 12:12:26 0 d-------- C:\Program Files\Skype 2007-01-24 17:44:28 0 d-------- C:\Program Files\BearShare<BEARSH~2> 2007-01-22 15:51:47 0 d-------- C:\Program Files\Common Files\Onet.pl 2007-01-22 15:50:49 0 d-------- C:\Program Files\Onet 2007-01-20 20:20:59 0 d-------- C:\Program Files\eMule 2007-01-18 16:05:56 0 d-------- C:\Program Files\Screamer Radio<SCREAM~1> 2007-01-18 15:52:10 0 d-------- C:\Program Files\My Pass Generator<MYPASS~1> 2007-01-18 15:50:46 0 d-------- C:\Program Files\AtomixMP3<ATOMIX~1> 2007-01-06 12:51:16 8 --a------ C:\Program Files\Project64.cache<PROJEC~1.CAC> -- Registry Dump --------------------------------------------------------------- [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run] "CTFMON.EXE"="C:\\WINDOWS\\System32\\ctfmon.exe" "DriverLoad"="" "DriverCheck"="" "SystemDriverLoad"="" "SystemDriver"="" "FDriver"="" "ADriver"="" "CDriver"="" "DDriver"="" "beta"="c:\\DriverLoad\\windrv0.exe" "Gadu-Gadu"=""C:\\Program Files\\Gadu-Gadu\\gg.exe" /tray" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run] "WOOWATCH"="C:\\PROGRA~1\\NEOSTR~1\\Watch.exe" "WOOTASKBARICON"="C:\\PROGRA~1\\NEOSTR~1\\GestMaj.exe TaskBarIcon.exe" "AdslTaskBar"="rundll32.exe stmctrl.dll,TaskBar" "snpstd3"="C:\\WINDOWS\\vsnpstd3.exe" "RemoteControl"=""C:\\Program Files\\CyberLink\\PowerDVD\\PDVDServ.exe"" "PViever"=""C:\\Program Files\\PViever\\pviever.exe" hide" "!AVG Anti-Spyware"=""C:\\Program Files\\Grisoft\\AVG Anti-Spyware 7.5\\avgas.exe" /minimized" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] "system"="kdfnb.exe" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks] "{57B86673-276A-48B2-BAE7-C6DBB3020EB8}"="AVG Anti-Spyware 7.5" [HKEY_USERS\.default\software\microsoft\windows\currentversion\run] "CTFMON.EXE"="C:\\WINDOWS\\System32\\CTFMON.EXE" "DriverLoad"="" "DriverCheck"="" "SystemDriverLoad"="" "SystemDriver"="" "FDriver"="" "ADriver"="" "CDriver"="" "DDriver"="" "alpha"="c:\\DriverLoad\\windrv0.exe" "beta"="c:\\DriverLoad\\windrv0.exe" "gamma"="c:\\DriverLoad\\windrv0.exe" [HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\run] "CTFMON.EXE"="C:\\WINDOWS\\System32\\CTFMON.EXE" "DriverLoad"="" "DriverCheck"="" "SystemDriverLoad"="" "SystemDriver"="" "FDriver"="" "ADriver"="" "CDriver"="" "DDriver"="" "alpha"="c:\\DriverLoad\\windrv0.exe" "beta"="c:\\DriverLoad\\windrv0.exe" "gamma"="c:\\DriverLoad\\windrv0.exe" [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system] "DisableRegistryTools"=dword:00000000 [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer\Run] "DriverLoad"="" "DriverCheck"="" "SystemDriverLoad"="" "Winhost"="" "Winhost1"="" "Winhost2"="" "Winhost3"="" "Winhost4"="" "SystemDriver"="" "FDriver"="" "ADriver"="" "CDriver"="" "DDriver"="" "alpha"="c:\\DriverLoad\\windrv0.exe" "beta"="c:\\DriverLoad\\windrv0.exe" "gamma"="c:\\DriverLoad\\windrv0.exe" [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders] "SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll" [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Svchost] LocalService REG_MULTI_SZ Alerter\0WebClient\0LmHosts\0RemoteRegistry\0upnphost\0SSDPSRV\0\0 NetworkService REG_MULTI_SZ DnsCache\0\0 rpcss REG_MULTI_SZ RpcSs\0\0 imgsvc REG_MULTI_SZ StiSvc\0\0 termsvcs REG_MULTI_SZ TermService\0\0 -- End of ComboScan: finished at 2007-03-17 at 15:13:46 ------------------------

**Posty:** 18165 · przez **wojtas** 17 Mar 2007, 17:58

Wyłącz przywracanie systemu ( właściwości mój komputer-zakładka przywracanie - wyłącz przywracanie na wszystkich dyskach)
Start do awaryjnego ( F8 ) przy starcie komputera.

O2 - BHO: (no name) - {FCADDC14-BD46-408A-9842-CDBE1C6D37E3} - C:\WINDOWS\system32\themes_2.dll (file missing)
O2 - BHO: (no name) - {FCADDC14-BD46-408A-9842-CDBE1C6D37EB} - C:\WINDOWS\system32\themes_2.dll (file missing)
O4 - HKLM\..\Run: [PViever] "C:\Program Files\PViever\pviever.exe" hide
O4 - HKCU\..\Run: [beta] c:\DriverLoad\windrv0.exe
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.116.130 85.255.112.191
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: NameServer = 85.255.116.130 85.255.112.191
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.116.130 85.255.112.191

Odpalasz hijackthis i zaznaczasz ptaszkami powyższe wpisy i dajesz Fix checked.
Pogrubione pliki usuwasz ręcznie z dysku

pozniej niech wykona fix do notatnika ktory podalem wyzej potem nowe log z HJ, SR oraz combofix

do sprawdzenia

do sprawdzenia

Kto jest na forum