gadu-gadu

**Posty:** 47 · przez **beto** 12 Mar 2008, 17:28

Wczoraj ściągnęłem jakiś plik - okazało się, że to trojan. Usunęłem go Kasperskym i myślałem, że po problemie.

Włączam gg, chce napisać do kolegi a tu gg się wyłącza, obojetnie do kogo chce napisać, wystarczy, że klikne 2x na imię, otworzy się okno i gg się wyłącza.

Jak to naprawić?

**Posty:** 8079 · przez **kajtekjr** 12 Mar 2008, 17:30

Probowałes przeinstalowac program gadu-gadu ?

**Posty:** 47 · przez **beto** 12 Mar 2008, 17:33

Tak, nic to nie dało...

**Posty:** 10264 · przez **Mike** 12 Mar 2008, 18:27

Wstaw loga z Combofix'a => http://forum.programosy.pl/dodatkowe-narzedzia-do-usuwania-i-ochrony-vt42021.html

oraz hijackthis, silent runners => http://forum.programosy.pl/hijackthis-amp-silent-runners-gtobsuga-i-umieszczanie-vt9452.html

**Posty:** 47 · przez **beto** 12 Mar 2008, 19:27

Hijackthis

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 18:14:07, on 2008-03-12 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe C:\WINDOWS\System32\nvsvc32.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\RUNDLL32.EXE C:\WINDOWS\RTHDCPL.EXE C:\Program Files\Common Files\Symantec Shared\ccApp.exe C:\Program Files\HP\HP Software Update\HPWuSchd2.exe C:\Program Files\QuickTime\qttask.exe C:\Program Files\DAEMON Tools\daemon.exe C:\Program Files\PowerISO\PWRISOVM.EXE C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Messenger\msmsgs.exe C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleil.exe C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe C:\Program Files\WinZip\WZQKPICK.EXE C:\Program Files\HP\Digital Imaging\Product Assistant\bin\hprblog.exe C:\WINDOWS\system32\wuauclt.exe C:\Program Files\WapSter\AQQ\AQQ.exe D:\Opera\Opera.exe C:\WINDOWS\system32\CF14860.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe C:\ComboFix\nircmd.cfexe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.onet.pl/ R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0 CE\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: MEGAUPLOADTOOLBAR - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton SystemWorks\Norton Antivirus\NavShExt.dll (file missing) O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton SystemWorks\Norton Antivirus\NavShExt.dll (file missing) O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O3 - Toolbar: MEGAUPLOADTOOLBAR - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAShCut.exe O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" O4 - HKLM\..\Run: [NAV CfgWiz] C:\Program Files\Common Files\Symantec Shared\CfgWiz.exe /GUID NAV /CMDLINE "REBOOT" O4 - HKLM\..\Run: [BootWarn] C:\Program Files\Norton SystemWorks\Norton Antivirus\BootWarn.exe /a O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033 O4 - HKLM\..\Run: [PWRISOVM.EXE] C:\Program Files\PowerISO\PWRISOVM.EXE O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton AntiVirus\osCheck.exe" O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe" O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Gadu-Gadu\gg.exe" /tray O4 - HKCU\..\Run: [AQQ] C:\PROGRA~1\WapSter\AQQ\AQQ.exe O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user') O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: BlueSoleil.lnk = ? O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra button: Web Anti-Virus statistics - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\SCIEPlgn.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C5} (GameDesire Snooker) - http://67.15.101.3/g_bin/pl/snooker_2_0_0_28.cab O16 - DPF: {FE0BD779-44EE-4A4B-AA2E-743C63F2E5E6} (IWinAmpActiveX Class) - http://pdl.stream.aol.com/downloads/aol/unagi/ampx_en_dl.cab O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: Kaspersky Anti-Virus 7.0 (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe O23 - Service: BlueSoleil Hid Service - Unknown owner - C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: Symantec IS Password Validation (ISPwdSvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\isPwdSvc.exe O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe O23 - Service: Usługa Auto Protect programu Norton AntiVirus (navapsvc) - Unknown owner - C:\Program Files\Norton SystemWorks\Norton Antivirus\navapsvc.exe (file missing) O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe O23 - Service: SAVScan - Unknown owner - C:\Program Files\Norton SystemWorks\Norton Antivirus\SAVScan.exe (file missing) O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe -- End of file - 8722 bytes

Combofix sie zawiesza...

**Posty:** 18165 · przez **wojtas** 12 Mar 2008, 19:50

to daj loga z dss'a

**Posty:** 47 · przez **beto** 12 Mar 2008, 19:55

Kod: Zaznacz wszystko: Deckard's System Scanner v20071014.68 Run by luki on 2008-03-12 18:52:33 Computer is in Normal Mode. -------------------------------------------------------------------------------- -- System Restore -------------------------------------------------------------- Successfully created a Deckard's System Scanner Restore Point. -- Last 5 Restore Point(s) -- 38: 2008-03-12 17:52:39 UTC - RP565 - Deckard's System Scanner Restore Point 37: 2008-03-12 17:15:19 UTC - RP564 - ComboFix created restore point 36: 2008-03-12 17:09:08 UTC - RP563 - Deckard's System Scanner Restore Point 35: 2008-03-11 14:37:31 UTC - RP562 - Installed Kaspersky Anti-Virus 7.0. 34: 2008-03-09 09:52:46 UTC - RP561 - Installed Fireworks -- First Restore Point -- 1: 2008-02-12 19:02:50 UTC - RP528 - Usunięte Pro Evolution Soccer 6 Backed up registry hives. Performed disk cleanup. -- HijackThis (run as luki.exe) ------------------------------------------------ Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 18:53, on 2008-03-12 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe C:\WINDOWS\System32\nvsvc32.exe C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\RUNDLL32.EXE C:\WINDOWS\RTHDCPL.EXE C:\Program Files\Common Files\Symantec Shared\ccApp.exe C:\Program Files\HP\HP Software Update\HPWuSchd2.exe C:\Program Files\QuickTime\qttask.exe C:\Program Files\DAEMON Tools\daemon.exe C:\Program Files\PowerISO\PWRISOVM.EXE C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Messenger\msmsgs.exe C:\PROGRA~1\WapSter\AQQ\AQQ.exe C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleil.exe C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe C:\Program Files\WinZip\WZQKPICK.EXE C:\Program Files\HP\Digital Imaging\Product Assistant\bin\hprblog.exe C:\WINDOWS\system32\wuauclt.exe D:\Opera\Opera.exe C:\Documents and Settings\luki\Pulpit\dss.exe C:\PROGRA~1\TRENDM~1\HIJACK~1\luki.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.onet.pl/ R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0 CE\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: MEGAUPLOADTOOLBAR - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton SystemWorks\Norton Antivirus\NavShExt.dll (file missing) O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton SystemWorks\Norton Antivirus\NavShExt.dll (file missing) O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O3 - Toolbar: MEGAUPLOADTOOLBAR - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAShCut.exe O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" O4 - HKLM\..\Run: [NAV CfgWiz] C:\Program Files\Common Files\Symantec Shared\CfgWiz.exe /GUID NAV /CMDLINE "REBOOT" O4 - HKLM\..\Run: [BootWarn] C:\Program Files\Norton SystemWorks\Norton Antivirus\BootWarn.exe /a O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033 O4 - HKLM\..\Run: [PWRISOVM.EXE] C:\Program Files\PowerISO\PWRISOVM.EXE O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton AntiVirus\osCheck.exe" O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe" O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Gadu-Gadu\gg.exe" /tray O4 - HKCU\..\Run: [AQQ] C:\PROGRA~1\WapSter\AQQ\AQQ.exe O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user') O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: BlueSoleil.lnk = ? O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra button: Web Anti-Virus statistics - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\SCIEPlgn.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C5} (GameDesire Snooker) - http://67.15.101.3/g_bin/pl/snooker_2_0_0_28.cab O16 - DPF: {FE0BD779-44EE-4A4B-AA2E-743C63F2E5E6} (IWinAmpActiveX Class) - http://pdl.stream.aol.com/downloads/aol/unagi/ampx_en_dl.cab O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: Kaspersky Anti-Virus 7.0 (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe O23 - Service: BlueSoleil Hid Service - Unknown owner - C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: Symantec IS Password Validation (ISPwdSvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\isPwdSvc.exe O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe O23 - Service: Usługa Auto Protect programu Norton AntiVirus (navapsvc) - Unknown owner - C:\Program Files\Norton SystemWorks\Norton Antivirus\navapsvc.exe (file missing) O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe O23 - Service: SAVScan - Unknown owner - C:\Program Files\Norton SystemWorks\Norton Antivirus\SAVScan.exe (file missing) O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe -- End of file - 8686 bytes -- File Associations ----------------------------------------------------------- [COLOR=red].cpl - cplfile - shell\cplopen\command - rundll32.exe shell32.dll,Control_RunDLL "%1",%*[/COLOR] [COLOR=red].cpl - cplfile - shell\runas\command - rundll32.exe shell32.dll,Control_RunDLLAsUser "%1",%*[/COLOR] [COLOR=red].js - JSFile - DefaultIcon - "D:\Macromedia\Dreamweaver 8\dreamweaver.exe",2[/COLOR] [COLOR=red].reg - regfile - shell\open\command - "regedit.exe" "%1"[/COLOR] -- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------- R0 BTHidMgr (Bluetooth HID Manager Service) - c:\windows\system32\drivers\bthidmgr.sys <Not Verified; IVT Corporation; BlueSoleil(c)> R1 PCLEPCI - c:\windows\system32\drivers\pclepci.sys <Not Verified; Pinnacle Systems GmbH; PCLEPCI> R1 SCDEmu - c:\windows\system32\drivers\scdemu.sys <Not Verified; PowerISO Computing, Inc.; scdemu> R1 StarOpen - c:\windows\system32\drivers\staropen.sys R3 BlueletAudio (Bluetooth Audio Service) - c:\windows\system32\drivers\blueletaudio.sys <Not Verified; IVT Corporation; Windows (R) 2000 DDK driver> R3 BTHidEnum (Bluetooth HID Enumerator) - c:\windows\system32\drivers\vbtenum.sys R3 pcouffin (VSO Software pcouffin) - c:\windows\system32\drivers\pcouffin.sys <Not Verified; VSO Software; Patin couffin engine> R3 VComm (Virtual Serial port driver) - c:\windows\system32\drivers\vcomm.sys <Not Verified; IVT Corporation; BlueSoleil> R3 VcommMgr (Bluetooth VComm Manager Service) - c:\windows\system32\drivers\vcommmgr.sys <Not Verified; IVT Corporation; BlueSoleil> S2 npkcrypt - d:\gry\maplestory\npkcrypt.sys (file missing) S2 SAVRTPEL - c:\program files\norton systemworks\norton antivirus\savrtpel.sys (file missing) S3 aeqhloader - c:\docume~1\luki\ustawi~1\temp\rar$ex04.953\aequihack\aeqhloader.sys (file missing) S3 ĄŐĄŘ°ę¤¤ĄÍ1 - d:\gods_hack_pack\nvid999.sys (file missing) S3 BT (Bluetooth PAN Network Adapter) - c:\windows\system32\drivers\btnetdrv.sys <Not Verified; IVT Corporation; BlueSoleil> S3 Btcsrusb (Bluetooth USB For Bluetooth Service) - c:\windows\system32\drivers\btcusb.sys <Not Verified; IVT Corporation; Bluetooth USB Device Driver> S3 BTNetFilter (Bluetooth Network Filter) - c:\windows\system32\drivers\btnetfilter.sys S3 ENTECH - c:\windows\system32\drivers\entech.sys <Not Verified; EnTech Taiwan; PowerStrip> S3 IlvMoneyDRIVER53 - c:\documents and settings\luki\pulpit\ms\ilvmoney1105.sys (file missing) S3 SAVRT - c:\program files\norton systemworks\norton antivirus\savrt.sys (file missing) -- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled -------------------- R2 BlueSoleil Hid Service - c:\program files\ivt corporation\bluesoleil\btntservice.exe R2 StarWindServiceAE (StarWind AE Service) - c:\program files\alcohol soft\alcohol 120\starwind\starwindserviceae.exe <Not Verified; Rocket Division Software; StarWind Alcohol Edition> S2 navapsvc (Usługa Auto Protect programu Norton AntiVirus) - "c:\program files\norton systemworks\norton antivirus\navapsvc.exe" (file missing) S3 SAVScan - c:\program files\norton systemworks\norton antivirus\savscan.exe (file missing) -- Device Manager: Disabled ---------------------------------------------------- Class GUID: {4D36E972-E325-11CE-BFC1-08002BE10318} Description: NVIDIA nForce Networking Controller Device ID: {1A3E09BE-1E45-494B-9174-D7385B45BBF5}\NVNET_DEV0269\4&32BEF161&0&01 Manufacturer: NVIDIA Name: NVIDIA nForce Networking Controller PNP Device ID: {1A3E09BE-1E45-494B-9174-D7385B45BBF5}\NVNET_DEV0269\4&32BEF161&0&01 Service: NVENETFD Class GUID: {4D36E972-E325-11CE-BFC1-08002BE10318} Description: Bluetooth PAN Network Adapter Device ID: ROOT\NET\0001 Manufacturer: IVT Corporation Name: Bluetooth PAN Network Adapter PNP Device ID: ROOT\NET\0001 Service: BT -- Scheduled Tasks ------------------------------------------------------------- 2008-03-11 19:50:01 284 --a------ C:\WINDOWS\Tasks\AppleSoftwareUpdate.job -- Files created between 2008-02-12 and 2008-03-12 ----------------------------- 2008-03-12 18:37:41 0 d-------- C:\WINDOWS\LastGood 2008-03-12 18:14:36 68096 --a------ C:\WINDOWS\system32\zip.exe 2008-03-12 18:14:36 98816 --a------ C:\WINDOWS\system32\sed.exe 2008-03-12 18:14:36 80412 --a------ C:\WINDOWS\system32\grep.exe 2008-03-12 18:14:36 73728 --a------ C:\WINDOWS\system32\fdsv.exe <Not Verified; Smallfrogs Studio; > 2008-03-12 18:13:43 0 d-------- C:\Program Files\Trend Micro 2008-03-12 15:35:43 0 d-------- C:\Program Files\WapSter 2008-03-12 15:32:49 0 d-------- C:\Gadu-Gadu 2008-03-11 15:38:08 91700 --a------ C:\WINDOWS\system32\drivers\klin.dat 2008-03-11 15:38:08 85860 --a------ C:\WINDOWS\system32\drivers\klick.dat 2008-03-11 15:37:38 27168 --ahs---- C:\WINDOWS\system32\drivers\fidbox2.dat 2008-03-11 15:37:38 3462176 --ahs---- C:\WINDOWS\system32\drivers\fidbox.dat 2008-03-11 15:37:38 0 d-------- C:\Program Files\Kaspersky Lab 2008-03-11 15:34:11 0 d-------- C:\kav 2008-03-10 18:31:13 0 d-------- C:\Program Files\RapidLeecher 2008-03-09 10:53:02 0 d-------- C:\Program Files\Common Files\Macromedia Shared 2008-03-09 10:52:46 0 d-------- C:\Program Files\Macromedia 2008-03-07 14:21:03 38912 --a------ C:\WINDOWS\system32\picn20.dll <Not Verified; Pegasus Imaging Corp.; PEGASUS> 2008-03-07 14:21:03 544768 --a------ C:\WINDOWS\system32\imagx5.dll <Not Verified; Pegasus Software, LLC; ImagXpress> 2008-03-07 14:21:03 569344 --a------ C:\WINDOWS\system32\imagr5.dll <Not Verified; Pegasus Software,LLC; ImagXpress> 2008-03-06 19:45:31 0 d-------- C:\Program Files\CDDVDDataRecovery 2008-03-06 19:38:07 106496 --a------ C:\WINDOWS\system32\TwnLib20.dll <Not Verified; Pegasus Software; TWNLIB20> 2008-03-06 19:38:06 155648 --a------ C:\WINDOWS\system32\NeroCheck.exe <Not Verified; Ahead Software Gmbh; Ahead Software Gmbh NeroCheck> 2008-03-06 19:38:06 471040 -----n--- C:\WINDOWS\system32\ImagXRA7.dll <Not Verified; Pegasus Imaging Corp.; ImagXpress7> 2008-03-06 19:38:06 262144 -----n--- C:\WINDOWS\system32\ImagXR7.dll <Not Verified; Pegasus Imaging Corp.; ImagXpress7> 2008-03-06 19:38:06 1568768 -----n--- C:\WINDOWS\system32\ImagX7.dll <Not Verified; Pegasus Imaging Corp.; ImagXpress7> 2008-03-06 19:38:06 0 d-------- C:\Program Files\Common Files\Ahead 2008-03-06 19:38:02 0 d-------- C:\Program Files\Ahead 2008-02-19 07:46:52 0 d-------- C:\Program Files\DirectX -- Find3M Report --------------------------------------------------------------- 2008-03-12 18:34:52 737280 --a------ C:\WINDOWS\iun6002.exe <Not Verified; Indigo Rose Corporation; Setup Factory 6.0 Runtime Module> 2008-03-09 11:15:39 0 d-------- C:\Documents and Settings\luki\Dane aplikacji\Macromedia 2008-03-09 10:53:02 0 d-------- C:\Program Files\Common Files 2008-03-09 10:52:59 0 d-------- C:\Program Files\Common Files\Macromedia 2008-03-09 10:52:46 0 d--h----- C:\Program Files\InstallShield Installation Information 2008-03-06 19:40:24 0 d-------- C:\Documents and Settings\luki\Dane aplikacji\Ahead 2008-03-05 13:48:56 0 d-------- C:\Documents and Settings\luki\Dane aplikacji\MegauploadToolbar 2008-03-04 20:51:26 0 d-------- C:\Documents and Settings\luki\Dane aplikacji\ppStream 2008-03-04 09:42:52 0 d-------- C:\Documents and Settings\luki\Dane aplikacji\foobar2000 2008-03-03 18:03:13 0 d-------- C:\Documents and Settings\luki\Dane aplikacji\uTorrent 2008-02-25 17:41:04 0 d-------- C:\Documents and Settings\luki\Dane aplikacji\Adobe 2008-02-17 14:07:29 0 d-------- C:\Program Files\SopCast 2008-02-12 20:04:17 0 d-------- C:\Documents and Settings\luki\Dane aplikacji\Microsoft Games 2008-02-12 12:28:36 458022 --a------ C:\WINDOWS\system32\perfh015.dat 2008-02-12 12:28:36 79408 --a------ C:\WINDOWS\system32\perfc015.dat 2008-02-11 22:44:35 0 d-------- C:\Program Files\Messenger 2008-02-11 22:40:33 0 d-------- C:\Program Files\MSXML 4.0 2008-02-11 18:13:22 0 d-------- C:\Program Files\Common Files\Symantec Shared 2008-02-11 18:13:20 0 d-------- C:\Program Files\Symantec 2008-02-11 13:53:33 0 d-------- C:\Program Files\Norton AntiVirus 2008-02-10 20:54:17 0 d-------- C:\Program Files\Movie Maker 2008-02-10 20:52:12 0 d-------- C:\Program Files\Windows NT 2008-02-10 17:37:22 0 d--h----- C:\Program Files\WindowsUpdate 2008-02-10 16:40:08 0 d-------- C:\Program Files\Microsoft Games 2008-02-07 10:49:49 0 d-------- C:\Program Files\Lavalys 2008-02-06 10:38:53 0 d-------- C:\Program Files\NAPI-PROJEKT 2008-02-04 11:33:30 1685 --a------ C:\WINDOWS\BricoPackFoldersDelete.cmd 2008-02-04 11:33:29 47880 --a------ C:\WINDOWS\BricoPackUninst.cmd 2007-12-19 16:13:25 20480 --a------ C:\WINDOWS\system32\H@tKeysH@@k.DLL 2007-12-12 11:22:19 5846 --a------ C:\WINDOWS\mozver.dat -- Registry Dump --------------------------------------------------------------- *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NvCplDaemon"="C:\WINDOWS\System32\NvCpl.dll" [2005-08-02 09:35] "nwiz"="nwiz.exe" [2005-08-02 09:35 C:\WINDOWS\system32\nwiz.exe] "NvMediaCenter"="C:\WINDOWS\System32\NvMcTray.dll" [2005-08-02 09:35] "High Definition Audio Property Page Shortcut"="HDAShCut.exe" [2005-01-07 16:07 C:\WINDOWS\system32\HdAShCut.exe] "RTHDCPL"="RTHDCPL.EXE" [2005-07-13 03:37 C:\WINDOWS\RTHDCPL.EXE] "Alcmtr"="ALCMTR.EXE" [2005-05-03 11:43 C:\WINDOWS\ALCMTR.EXE] "ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2006-09-03 00:04] "NAV CfgWiz"="C:\Program Files\Common Files\Symantec Shared\CfgWiz.exe" [2003-11-20 19:20] "BootWarn"="C:\Program Files\Norton SystemWorks\Norton Antivirus\BootWarn.exe" [] "HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2005-05-11 22:12] "Google Desktop Search"="C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" [2006-09-06 13:56] "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-02-16 09:54] "DAEMON Tools"="C:\Program Files\DAEMON Tools\daemon.exe" [2006-11-12 11:48] "PWRISOVM.EXE"="C:\Program Files\PowerISO\PWRISOVM.EXE" [2007-08-07 01:05] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11] "osCheck"="C:\Program Files\Norton AntiVirus\osCheck.exe" [2006-09-05 18:22] "NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 10:50] "AVP"="C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe" [2008-02-08 18:36] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:44] "MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 17:24] "Gadu-Gadu"="C:\Gadu-Gadu\gg.exe" [2007-11-14 11:54] "AQQ"="C:\PROGRA~1\WapSter\AQQ\AQQ.exe" [2007-02-28 13:18] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "appinit_dlls"=C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\PSEXESVC] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\vds] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{533C5B84-EC70-11D2-9505-00C04F79DEAF}] @="Volume shadow copy" -- End of Deckard's System Scanner: finished at 2008-03-12 18:54:33 ------------

[ Dodano: Dzisiaj o 15:02 ]
Log z Combofix'a

Kod: Zaznacz wszystko: ComboFix 08-03-10.1 - luki 2008-03-13 14:56:07.2 - NTFSx86 Running from: C:\Documents and Settings\luki\Pulpit\ComboFix.exe [color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color] . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . . ---- Previous Run ------- . C:\Documents and Settings\luki\Dane aplikacji\macromedia\Flash Player\#SharedObjects\W4S9GZC6\www.broadcaster.com C:\Documents and Settings\luki\Dane aplikacji\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.broadcaster.com C:\Documents and Settings\luki\Dane aplikacji\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.broadcaster.com\settings.sol . ((((((((((((((((((((((((( Files Created from 2008-02-13 to 2008-03-13 ))))))))))))))))))))))))))))))) . 2008-03-12 18:13 . 2008-03-12 18:13 <DIR> d-------- C:\Program Files\Trend Micro 2008-03-12 18:08 . 2008-03-12 18:08 <DIR> d-------- C:\Deckard 2008-03-12 15:35 . 2008-03-12 15:35 <DIR> d-------- C:\Program Files\WapSter 2008-03-12 15:35 . 2008-03-12 15:35 <DIR> d-------- C:\Documents and Settings\luki\WapSter 2008-03-12 15:32 . 2008-03-12 15:32 <DIR> d-------- C:\Gadu-Gadu 2008-03-12 14:13 . 2008-03-13 14:54 <DIR> d-------- C:\Documents and Settings\luki\Pulpit 2008-03-11 15:38 . 2008-03-11 15:38 91,700 --a------ C:\WINDOWS\system32\drivers\klin.dat 2008-03-11 15:38 . 2008-03-11 15:38 85,860 --a------ C:\WINDOWS\system32\drivers\klick.dat 2008-03-11 15:37 . 2008-03-11 15:37 <DIR> d-------- C:\Program Files\Kaspersky Lab 2008-03-11 15:37 . 2008-03-13 14:45 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab 2008-03-11 15:37 . 2008-03-12 20:55 3,462,176 --ahs---- C:\WINDOWS\system32\drivers\fidbox.dat 2008-03-11 15:37 . 2008-03-12 20:55 27,168 --ahs---- C:\WINDOWS\system32\drivers\fidbox2.dat 2008-03-11 15:37 . 2008-03-12 20:55 22,484 --ahs---- C:\WINDOWS\system32\drivers\fidbox.idx 2008-03-11 15:37 . 2008-03-12 20:55 3,440 --ahs---- C:\WINDOWS\system32\drivers\fidbox2.idx 2008-03-11 15:34 . 2008-03-11 15:34 <DIR> d-------- C:\kav 2008-03-10 18:31 . 2008-03-10 18:31 <DIR> d-------- C:\Program Files\RapidLeecher 2008-03-09 11:15 . 2008-03-09 11:15 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Macrovision 2008-03-09 10:53 . 2008-03-09 10:53 <DIR> d-------- C:\Program Files\Common Files\Macromedia Shared 2008-03-09 10:53 . 2002-01-05 07:10 57,344 --------- C:\WINDOWS\system32\mfc70enu.dll 2008-03-09 10:52 . 2008-03-09 10:52 <DIR> d-------- C:\Program Files\Macromedia 2008-03-07 14:23 . 2004-04-19 04:37 1,814,528 --------- C:\WINDOWS\UNNeroVision.exe 2008-03-07 14:23 . 2004-04-21 07:10 96,891 --------- C:\WINDOWS\UNNeroVision.cfg 2008-03-07 14:21 . 2001-07-06 14:41 569,344 --a------ C:\WINDOWS\system32\imagr5.dll 2008-03-07 14:21 . 2001-07-06 12:44 544,768 --a------ C:\WINDOWS\system32\imagx5.dll 2008-03-07 14:21 . 2001-07-06 18:24 283,920 --a------ C:\WINDOWS\system32\ImagXpr5.dll 2008-03-07 14:21 . 2001-06-26 08:15 38,912 --a------ C:\WINDOWS\system32\picn20.dll 2008-03-06 19:45 . 2008-03-06 19:45 <DIR> d-------- C:\Program Files\CDDVDDataRecovery 2008-03-06 19:38 . 2008-03-06 19:38 <DIR> d-------- C:\Program Files\Common Files\Ahead 2008-03-06 19:38 . 2008-03-07 14:23 <DIR> d-------- C:\Program Files\Ahead 2008-03-06 19:38 . 2004-07-26 16:16 1,568,768 --------- C:\WINDOWS\system32\ImagX7.dll 2008-03-06 19:38 . 2004-07-26 16:16 476,320 --------- C:\WINDOWS\system32\ImagXpr7.dll 2008-03-06 19:38 . 2004-07-26 16:16 471,040 --------- C:\WINDOWS\system32\ImagXRA7.dll 2008-03-06 19:38 . 2004-07-26 16:16 262,144 --------- C:\WINDOWS\system32\ImagXR7.dll 2008-03-06 19:38 . 2001-07-09 10:50 155,648 --a------ C:\WINDOWS\system32\NeroCheck.exe 2008-03-06 19:38 . 2004-03-02 16:37 125,184 --------- C:\WINDOWS\system32\drivers\imagesrv.sys 2008-03-06 19:38 . 2000-06-26 11:45 106,496 --a------ C:\WINDOWS\system32\TwnLib20.dll 2008-03-06 19:38 . 2004-03-02 16:37 5,504 --------- C:\WINDOWS\system32\drivers\imagedrv.sys 2008-03-04 09:42 . 2008-03-04 09:42 <DIR> d-------- C:\Documents and Settings\luki\Dane aplikacji\foobar2000 2008-02-21 12:35 . 2008-02-21 18:52 54,156 --ah----- C:\WINDOWS\QTFont.qfn 2008-02-21 12:35 . 2008-02-21 12:35 1,409 --a------ C:\WINDOWS\QTFont.for 2008-02-19 07:46 . 2008-02-19 07:47 <DIR> d-------- C:\Program Files\DirectX . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-03-12 17:34 737,280 ----a-w C:\WINDOWS\iun6002.exe 2008-03-09 09:52 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-03-09 09:52 --------- d-----w C:\Program Files\Common Files\Macromedia 2008-03-06 18:40 --------- d-----w C:\Documents and Settings\luki\Dane aplikacji\Ahead 2008-03-05 12:48 --------- d-----w C:\Documents and Settings\luki\Dane aplikacji\MegauploadToolbar 2008-03-04 19:51 --------- d-----w C:\Documents and Settings\luki\Dane aplikacji\ppStream 2008-03-04 11:44 107,888 ----a-w C:\WINDOWS\system32\CmdLineExt.dll 2008-03-03 17:03 --------- d-----w C:\Documents and Settings\luki\Dane aplikacji\uTorrent 2008-02-21 16:31 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Symantec 2008-02-17 13:07 --------- d-----w C:\Program Files\SopCast 2008-02-12 19:04 --------- d-----w C:\Documents and Settings\luki\Dane aplikacji\Microsoft Games 2008-02-11 21:40 --------- d-----w C:\Program Files\MSXML 4.0 2008-02-11 17:13 805 ----a-w C:\WINDOWS\system32\drivers\SYMEVENT.INF 2008-02-11 17:13 60,800 ----a-w C:\WINDOWS\system32\S32EVNT1.DLL 2008-02-11 17:13 123,952 ----a-w C:\WINDOWS\system32\drivers\SYMEVENT.SYS 2008-02-11 17:13 10,740 ----a-w C:\WINDOWS\system32\drivers\SYMEVENT.CAT 2008-02-11 17:13 --------- d-----w C:\Program Files\Symantec 2008-02-11 17:13 --------- d-----w C:\Program Files\Common Files\Symantec Shared 2008-02-11 12:59 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab Setup Files 2008-02-11 12:53 --------- d-----w C:\Program Files\Norton AntiVirus 2008-02-10 15:40 --------- d-----w C:\Program Files\Microsoft Games 2008-02-08 17:37 219,664 ----a-w C:\WINDOWS\system32\klogon.dll 2008-02-08 17:35 23,604 ----a-w C:\WINDOWS\system32\drivers\klopp.dat 2008-02-07 09:49 --------- d-----w C:\Program Files\Lavalys 2008-02-06 09:38 --------- d-----w C:\Program Files\NAPI-PROJEKT 2008-02-04 10:33 47,880 ----a-w C:\WINDOWS\BricoPackUninst.cmd 2007-12-19 15:13 20,480 ----a-w C:\WINDOWS\system32\H@tKeysH@@k.DLL 2007-11-20 13:27 81,920 ----a-w C:\Documents and Settings\luki\Dane aplikacji\ezpinst.exe 2007-11-20 13:27 47,360 ----a-w C:\Documents and Settings\luki\Dane aplikacji\pcouffin.sys 2007-11-19 15:40 560 ----a-w C:\Program Files\Global.sw 2004-05-27 09:15 116,314 ----a-w C:\WINDOWS\Fonts\disneyt1.zip 2006-05-03 10:06 163,328 --sh--r C:\WINDOWS\system32\flvDX.dll 2007-02-21 11:47 31,744 --sh--r C:\WINDOWS\system32\msfDX.dll . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:44 15360] "MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 17:24 1694208] "Gadu-Gadu"="C:\Gadu-Gadu\gg.exe" [2007-11-14 11:54 2131392] "AQQ"="C:\PROGRA~1\WapSter\AQQ\AQQ.exe" [2007-02-28 13:18 2351864] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NvCplDaemon"="C:\WINDOWS\System32\NvCpl.dll" [2005-08-02 09:35 7110656] "nwiz"="nwiz.exe" [2005-08-02 09:35 1519616 C:\WINDOWS\system32\nwiz.exe] "NvMediaCenter"="C:\WINDOWS\System32\NvMcTray.dll" [2005-08-02 09:35 86016] "High Definition Audio Property Page Shortcut"="HDAShCut.exe" [2005-01-07 16:07 61952 C:\WINDOWS\system32\HdAShCut.exe] "RTHDCPL"="RTHDCPL.EXE" [2005-07-13 03:37 14679552 C:\WINDOWS\RTHDCPL.EXE] "ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2006-09-03 00:04 84640] "NAV CfgWiz"="C:\Program Files\Common Files\Symantec Shared\CfgWiz.exe" [2003-11-20 19:20 123824] "BootWarn"="C:\Program Files\Norton SystemWorks\Norton Antivirus\BootWarn.exe" [ ] "HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2005-05-11 22:12 49152] "Google Desktop Search"="C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" [2006-09-06 13:56 157696] "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-02-16 09:54 282624] "DAEMON Tools"="C:\Program Files\DAEMON Tools\daemon.exe" [2006-11-12 11:48 157592] "PWRISOVM.EXE"="C:\Program Files\PowerISO\PWRISOVM.EXE" [2007-08-07 01:05 200704] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11 132496] "osCheck"="C:\Program Files\Norton AntiVirus\osCheck.exe" [2006-09-05 18:22 26248] "NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 10:50 155648] "AVP"="C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe" [2008-02-08 18:36 227856] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-08-04 00:44 15360] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "AppInit_DLLs"=C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusDisableNotify"=dword:00000001 "UpdatesDisableNotify"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "D:\\PPStream\\PPStream.exe"= "%windir%\\system32\\sessmgr.exe"= "C:\\Program Files\\IVT Corporation\\BlueSoleil\\BlueSoleil.exe"= "C:\\Program Files\\uTorrent\\uTorrent.exe"= "D:\\PES2008\\PES2008.exe"= "D:\\Program Files\\Gadu-Gadu\\gg.exe"= "C:\\Program Files\\SopCast\\adv\\SopAdver.exe"= "C:\\Program Files\\SopCast\\SopCast.exe"= "D:\\Opera\\Opera.exe"= "D:\\eMule\\emule.exe"= "D:\\gry\\Fifa 08\\FIFA08.exe"= "C:\\kav\\kav7.0\\english\\setup.exe"= "C:\\Program Files\\Kaspersky Lab\\Kaspersky Anti-Virus 7.0\\avp.exe"= "C:\\Program Files\\WapSter\\AQQ\\AQQ.exe"= "C:\\Gadu-Gadu\\gg.exe"= "C:\\PROGRA~1\\WapSter\\AQQ\\AQQ.exe"= . Contents of the 'Scheduled Tasks' folder "2008-03-11 18:50:01 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job" - C:\Program Files\Apple Software Update\SoftwareUpdate.exe . ************************************************************************** catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-03-13 15:00:38 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\PX° ¤ ¤ Í 1 ] "ImagePath"="\??\D:\Gods_hack_Pack\nvid999.sys" .

gadu-gadu

Gadu-gadu

Kto jest na forum