przez mac10 30 Gru 2006, 02:29
nie probowalem a mozesz podac jakis link
[ Dodano: Dzisiaj o 1:38 ]
Logfile of HijackThis v1.99.1
Scan saved at 01:17:15, on 2006-12-30
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\logonui.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\System32\RUNDLL32.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\D-Tools\daemon.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Gadu-Gadu\gg.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\Winamp\winamp.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\mac10\Pulpit\hijackthis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.pl/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [BearShare] "C:\Program Files\BearShare\BearShare.exe" /pause
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray
O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://downloads.ewido.net/ewidoOnlineScan.cab
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
[ Dodano: Dzisiaj o 1:42 ]
silent runner i combofix
"Silent Runners.vbs", revision 49, http://www.silentrunners.org/
Operating System: Windows XP
Output limited to non-default values, except where indicated by "{++}"
Startup items buried in registry:
---------------------------------
HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ {++}
"CTFMON.EXE" = "C:\WINDOWS\System32\ctfmon.exe" [MS]
"MSMSGS" = ""C:\Program Files\Messenger\msmsgs.exe" /background" [MS]
"Gadu-Gadu" = ""C:\Program Files\Gadu-Gadu\gg.exe" /tray" ["Gadu-Gadu S.A."]
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\ {++}
"KernelFaultCheck" = "C:\WINDOWS\system32\dumprep 0 -k"
"NvCplDaemon" = "RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup" [MS]
"nwiz" = "nwiz.exe /install" ["NVIDIA Corporation"]
"avast!" = "C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [null data]
"NvMediaCenter" = "RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit" [MS]
"SoundMan" = "SOUNDMAN.EXE" ["Realtek Semiconductor Corp."]
"BearShare" = ""C:\Program Files\BearShare\BearShare.exe" /pause" ["Free Peers, Inc."]
"DAEMON Tools-1033" = ""C:\Program Files\D-Tools\daemon.exe" -lang 1033" ["DAEMON'S HOME"]
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\
{02478D38-C3F9-4EFB-9B51-7695ECA05670}\(Default) = (no title provided)
-> {HKLM...CLSID} = "Yahoo! Toolbar Helper"
\InProcServer32\(Default) = "C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll" ["Yahoo! Inc."]
HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\
"{42071714-76d4-11d1-8b24-00a0c9068ff3}" = "Rozszerzenie CPL kadrowania wyświetlania"
-> {HKLM...CLSID} = "Rozszerzenie CPL kadrowania wyświetlania"
\InProcServer32\(Default) = "deskpan.dll" [file not found]
"{88895560-9AA2-1069-930E-00AA0030EBC8}" = "Rozszerzenie ikony HyperTerminalu"
-> {HKLM...CLSID} = "HyperTerminal Icon Ext"
\InProcServer32\(Default) = "C:\WINDOWS\System32\hticons.dll" ["Hilgraeve, Inc."]
"{A70C977A-BF00-412C-90B7-034C51DA2439}" = "NvCpl DesktopContext Class"
-> {HKLM...CLSID} = "DesktopContext Class"
\InProcServer32\(Default) = "C:\WINDOWS\System32\nvcpl.dll" ["NVIDIA Corporation"]
"{1CDB2949-8F65-4355-8456-263E7C208A5D}" = "Desktop Explorer"
-> {HKLM...CLSID} = "Desktop Explorer"
\InProcServer32\(Default) = "C:\WINDOWS\System32\nvshell.dll" ["NVIDIA Corporation"]
"{1E9B04FB-F9E5-4718-997B-B8DA88302A47}" = "Desktop Explorer Menu"
-> {HKLM...CLSID} = (no title provided)
\InProcServer32\(Default) = "C:\WINDOWS\System32\nvshell.dll" ["NVIDIA Corporation"]
"{1E9B04FB-F9E5-4718-997B-B8DA88302A48}" = "nView Desktop Context Menu"
-> {HKLM...CLSID} = "nView Desktop Context Menu"
\InProcServer32\(Default) = "C:\WINDOWS\System32\nvshell.dll" ["NVIDIA Corporation"]
"{472083B0-C522-11CF-8763-00608CC02F24}" = "avast"
-> {HKLM...CLSID} = "avast"
\InProcServer32\(Default) = "C:\Program Files\Alwil Software\Avast4\ashShell.dll" ["ALWIL Software"]
"{FFB699E0-306A-11d3-8BD1-00104B6F7516}" = "Play on my TV helper"
-> {HKLM...CLSID} = "NVIDIA CPL Extension"
\InProcServer32\(Default) = "C:\WINDOWS\System32\nvcpl.dll" ["NVIDIA Corporation"]
HKLM\Software\Classes\*\shellex\ContextMenuHandlers\
avast\(Default) = "{472083B0-C522-11CF-8763-00608CC02F24}"
-> {HKLM...CLSID} = "avast"
\InProcServer32\(Default) = "C:\Program Files\Alwil Software\Avast4\ashShell.dll" ["ALWIL Software"]
HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\
avast\(Default) = "{472083B0-C522-11CF-8763-00608CC02F24}"
-> {HKLM...CLSID} = "avast"
\InProcServer32\(Default) = "C:\Program Files\Alwil Software\Avast4\ashShell.dll" ["ALWIL Software"]
Group Policies {GPedit.msc branch and setting}:
-----------------------------------------------
Note: detected settings may not have any effect.
HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\
"shutdownwithoutlogon" = (REG_DWORD) hex:0x00000001
{Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options|
Shutdown: Allow system to be shut down without having to log on}
"undockwithoutlogon" = (REG_DWORD) hex:0x00000001
{Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options|
Devices: Allow undock without having to log on}
Active Desktop and Wallpaper:
-----------------------------
Active Desktop may be disabled at this entry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState
Displayed if Active Desktop enabled and wallpaper not set by Group Policy:
HKCU\Software\Microsoft\Internet Explorer\Desktop\General\
"Wallpaper" = "C:\WINDOWS\web\wallpaper\Idylla.bmp"
Displayed if Active Desktop disabled and wallpaper not set by Group Policy:
HKCU\Control Panel\Desktop\
"Wallpaper" = "C:\WINDOWS\web\wallpaper\Idylla.bmp"
Enabled Screen Saver:
---------------------
HKCU\Control Panel\Desktop\
"SCRNSAVE.EXE" = "C:\WINDOWS\System32\logon.scr" [MS]
Winsock2 Service Provider DLLs:
-------------------------------
Namespace Service Providers
HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++}
000000000001\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]
000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS]
000000000003\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]
Transport Service Providers
HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++}
0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range:
%SystemRoot%\system32\mswsock.dll [MS], 01 - 03, 06 - 15
%SystemRoot%\system32\rsvpsp.dll [MS], 04 - 05
Toolbars, Explorer Bars, Extensions:
------------------------------------
Toolbars
HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\
"{EF99BD32-C1FB-11D2-892F-0090271D4F88}"
-> {HKLM...CLSID} = "Yahoo! Toolbar"
\InProcServer32\(Default) = "C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll" ["Yahoo! Inc."]
HKLM\Software\Microsoft\Internet Explorer\Toolbar\
"{EF99BD32-C1FB-11D2-892F-0090271D4F88}" = (no title provided)
-> {HKLM...CLSID} = "Yahoo! Toolbar"
\InProcServer32\(Default) = "C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll" ["Yahoo! Inc."]
Running Services (Display Name, Service Name, Path {Service DLL}):
------------------------------------------------------------------
avast! Antivirus, avast! Antivirus, ""C:\Program Files\Alwil Software\Avast4\ashServ.exe"" [null data]
avast! iAVS4 Control Service, aswUpdSv, ""C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe"" [null data]
avast! Mail Scanner, avast! Mail Scanner, ""C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service" ["ALWIL Software"]
avast! Web Scanner, avast! Web Scanner, ""C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service" ["ALWIL Software"]
NVIDIA Display Driver Service, NVSvc, "C:\WINDOWS\System32\nvsvc32.exe" ["NVIDIA Corporation"]
----------
+ This report excludes default entries except where indicated.
+ To see *everywhere* the script checks and *everything* it finds,
launch it from a command prompt or a shortcut with the -all parameter.
+ The search for DESKTOP.INI DLL launch points on all local fixed drives
took 214 seconds.
---------- (total run time: 294 seconds)
Path MotUsbDriverInst is running from is D:\Windows XP detectedMotorola USB Driver Removal Utility
Program Launched: Thursday, December 28, 2006 at 02:08:21
Operating System is Microsoft Windows XP
Removal Process Started at: Thursday, December 28, 2006 at 02:08:35
...Removing Driver .sys file
......Removing: C:\WINDOWS\system32\drivers\rndismpk.sys
......rndismpk.sys File Not Found
......Removing: C:\WINDOWS\system32\drivers\usb8023k.sys
......usb8023k.sys File Not Found
......Removing: C:\WINDOWS\Inf\Drvidx.bin
......Drvidx.bin File Not Found
......Removing: C:\WINDOWS\Inf\sb4220.inf
......sb4220.inf File Not Found
......Removing: C:\WINDOWS\Inf\sb4220.pnf
......sb4220.pnf File Not Found
......Removing: C:\WINDOWS\Inf\catalog\sb4220.cat
......sb4220.cat File Not Found
......Removing: C:\WINDOWS\system32\drivers\NetMotCM.sys
......NetMotCM.sys Successfully Removed
......Removing: C:\WINDOWS\system32\drivers\Net4100.sys
......Net4100.sys File Not Found
......Removing: C:\WINDOWS\system32\drivers\NetMotCG.sys
......NetMotCG.sys File Not Found
......Windows 2000 Registry Search Started: Thursday, December 28, 2006 at 02:08:35
.........Get the Registrey key value from:
......... HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002BE10318}\
.........There are 15 Keys to check.
.........Key 00 is 0000
.........Key 01 is 0001
......... Checking entry 01.05 KeyName is ComponentId Value pci\ven_10ec&dev_8139.
......... Checking entry 01.08 KeyName is InfPath Value netrtsnt.inf.
.........Key 02 is 0002
......... Checking entry 02.01 KeyName is ComponentId Value sw\{eeab7790-c514-11d1-b42b-00805fc1270e}.
......... Checking entry 02.02 KeyName is InfPath Value netrasa.inf.
.........Key 03 is 0003
......... Checking entry 03.01 KeyName is ComponentId Value ms_pschedmp.
......... Checking entry 03.02 KeyName is InfPath Value netpsa.inf.
.........Key 04 is 0004
......... Checking entry 04.05 KeyName is ComponentId Value ms_l2tpminiport.
......... Checking entry 04.06 KeyName is InfPath Value netrasa.inf.
.........Key 05 is 0005
......... Checking entry 05.12 KeyName is ComponentId Value ms_pptpminiport.
......... Checking entry 05.13 KeyName is InfPath Value netrasa.inf.
.........Key 06 is 0006
......... Checking entry 06.05 KeyName is ComponentId Value ms_pppoeminiport.
......... Checking entry 06.06 KeyName is InfPath Value netrasa.inf.
.........Key 07 is 0007
......... Checking entry 07.04 KeyName is ComponentId Value ms_ptiminiport.
......... Checking entry 07.05 KeyName is InfPath Value netrasa.inf.
.........Key 08 is 0008
......... Checking entry 08.01 KeyName is ComponentId Value ms_ndiswanip.
......... Checking entry 08.02 KeyName is InfPath Value netrasa.inf.
.........Key 09 is 0009
......... Checking entry 09.01 KeyName is ComponentId Value ms_pschedmp.
......... Checking entry 09.02 KeyName is InfPath Value netpsa.inf.
.........Key 10 is 0010
......... Checking entry 10.03 KeyName is ComponentId Value sw\{48926476-2cae-4ded-a86e-73ddebed6779}.
......... Checking entry 10.04 KeyName is InfPath Value ndisip.inf.
.........Key 11 is 0011
......... Checking entry 11.06 KeyName is ComponentId Value ms_irdaminiport.
......... Checking entry 11.07 KeyName is InfPath Value netrasa.inf.
.........Key 12 is 0012
......... Checking entry 12.02 KeyName is ComponentId Value usb\vid_07b2&pid_4200.
Found matching Vendor ID and Product ID at 12.2 KeyName is ComponentId Value usb\vid_07b2&pid_4200.
......... Checking entry 12.04 KeyName is InfPath Value oem14.inf.
Key Found at 12.4:
SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002BE10318}\0012
......Removing: C:\WINDOWS\inf\oem14.inf
......oem14.inf Successfully Removed
......Removing: C:\WINDOWS\inf\oem14.PNF
......oem14.PNF Successfully Removed
...Removing Registry Entry: SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002BE10318}\0012
......Registry Entries Removed
......Windows 2000 Registry Search Started: Thursday, December 28, 2006 at 02:08:35
.........Get the Registrey key value from:
......... HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002BE10318}\
.........There are 14 Keys to check.
.........Key 00 is 0000
.........Key 01 is 0001
......... Checking entry 01.05 KeyName is ComponentId Value pci\ven_10ec&dev_8139.
......... Checking entry 01.08 KeyName is InfPath Value netrtsnt.inf.
.........Key 02 is 0002
......... Checking entry 02.01 KeyName is ComponentId Value sw\{eeab7790-c514-11d1-b42b-00805fc1270e}.
......... Checking entry 02.02 KeyName is InfPath Value netrasa.inf.
.........Key 03 is 0003
......... Checking entry 03.01 KeyName is ComponentId Value ms_pschedmp.
......... Checking entry 03.02 KeyName is InfPath Value netpsa.inf.
.........Key 04 is 0004
......... Checking entry 04.05 KeyName is ComponentId Value ms_l2tpminiport.
......... Checking entry 04.06 KeyName is InfPath Value netrasa.inf.
.........Key 05 is 0005
......... Checking entry 05.12 KeyName is ComponentId Value ms_pptpminiport.
......... Checking entry 05.13 KeyName is InfPath Value netrasa.inf.
.........Key 06 is 0006
......... Checking entry 06.05 KeyName is ComponentId Value ms_pppoeminiport.
......... Checking entry 06.06 KeyName is InfPath Value netrasa.inf.
.........Key 07 is 0007
......... Checking entry 07.04 KeyName is ComponentId Value ms_ptiminiport.
......... Checking entry 07.05 KeyName is InfPath Value netrasa.inf.
.........Key 08 is 0008
......... Checking entry 08.01 KeyName is ComponentId Value ms_ndiswanip.
......... Checking entry 08.02 KeyName is InfPath Value netrasa.inf.
.........Key 09 is 0009
......... Checking entry 09.01 KeyName is ComponentId Value ms_pschedmp.
......... Checking entry 09.02 KeyName is InfPath Value netpsa.inf.
.........Key 10 is 0010
......... Checking entry 10.03 KeyName is ComponentId Value sw\{48926476-2cae-4ded-a86e-73ddebed6779}.
......... Checking entry 10.04 KeyName is InfPath Value ndisip.inf.
.........Key 11 is 0011
......... Checking entry 11.06 KeyName is ComponentId Value ms_irdaminiport.
......... Checking entry 11.07 KeyName is InfPath Value netrasa.inf.
.........Key 12 is 0013
......... Checking entry 12.01 KeyName is ComponentId Value ms_pschedmp.
......... Checking entry 12.02 KeyName is InfPath Value netpsa.inf.
.........Key 13 is 0014
......... Checking entry 13.03 KeyName is ComponentId Value hamachi.
......... Checking entry 13.04 KeyName is InfPath Value oem18.inf.
......Removing residual .inf/.pnf files
.........inf and pnf files for SB4220 Not Found
.........inf and pnf files for SB4100/SB4101 Not Found
.........inf and pnf files for SB4200 Not Found
.........inf and pnf files for CG4500 Not Found
.........inf and pnf files for CG4500b Not Found
.........inf and pnf files for CG4500e Not Found
.........inf and pnf files for CG5500 Not Found
Motorola USB driver removal completed.
Program Terminated at: Thursday, December 28, 2006 at 02:08:38
