mswindtc.exe

[nuggle]

witam.
problem z tym syfem co w temacie. usuwam go ciagle a on przez caly czas sie pojawia. nie wiem czemu. wywalilem go z rejestru, z dysku plik usunalem, hijackiem tez usuwalem wpisy. ciagle jest.

to jest log z hijacha:

Logfile of HijackThis v1.99.1
Scan saved at 22:22:34, on 2006-12-29
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\cmd.exe
C:\WINDOWS\system32\ftp.exe
E:\Programy\Konnekt\konnekt.exe
D:\Programs\firefox\firefox.exe
C:\Documents and Settings\Adrian\Moje dokumenty\hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.pl/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [win msdt service] mswindtc.exe
O4 - HKLM\..\RunServices: [win msdt service] mswindtc.exe
O8 - Extra context menu item: Download All by FlashGet - D:\Programs\FlashGet\jc_all.htm
O8 - Extra context menu item: Download using FlashGet - D:\Programs\FlashGet\jc_link.htm
O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://E:\Programy\office\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll
O17 - HKLM\System\CCS\Services\Tcpip\..\{3FA3CBE0-92A7-42A1-A81D-48A126D31D6F}: NameServer = 10.0.1.1
O17 - HKLM\System\CS1\Services\Tcpip\..\{3FA3CBE0-92A7-42A1-A81D-48A126D31D6F}: NameServer = 10.0.1.1
O17 - HKLM\System\CS2\Services\Tcpip\..\{3FA3CBE0-92A7-42A1-A81D-48A126D31D6F}: NameServer = 10.0.1.1
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe

czy wiecie czemu uruchomil mi sie proces cmd.exe oraz ftp.exe ??

[MISTEJK]

Zrobimy tak, że nie wróci.


Zaczynamy od:


Użyj WWDC :

http://www.firewallleaktester.com/wwdc.htm

Zmień opcje z disable na enable. Zresetuj komputer.

Foto przedtawia prawidłowe ustawienie portów :

http://www.firewallleaktester.com/images_site/wwdc.jpg

Wyłącz przywracanie systemu i wejdź w tryb awaryjny.
Najpierw usuwasz wpisy w Hijackthis, następnie pogrubione pliki ręcznie z dysku:

O4 - HKLM\..\Run: [win msdt service] mswindtc.exe
O4 - HKLM\..\RunServices: [win msdt service] mswindtc.exe

Twój dns ?

O17 - HKLM\System\CCS\Services\Tcpip\..\{3FA3CBE0-92A7-42A1-A81D-48A126D31D6F}: NameServer = 10.0.1.1

i wklej nowe logi z Hijackthis + Silent Runners

[nuggle]

zrobilem tak jak poleciles. to log z hijacka:

Logfile of HijackThis v1.99.1
Scan saved at 13:12:06, on 2006-12-30
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\svchost.exe
D:\Programs\firefox\firefox.exe
E:\Programy\Konnekt\konnekt.exe
C:\Documents and Settings\Adrian\Moje dokumenty\hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.pl/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O8 - Extra context menu item: Download All by FlashGet - D:\Programs\FlashGet\jc_all.htm
O8 - Extra context menu item: Download using FlashGet - D:\Programs\FlashGet\jc_link.htm
O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://E:\Programy\office\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll
O17 - HKLM\System\CCS\Services\Tcpip\..\{3FA3CBE0-92A7-42A1-A81D-48A126D31D6F}: NameServer = 10.0.1.1
O17 - HKLM\System\CS1\Services\Tcpip\..\{3FA3CBE0-92A7-42A1-A81D-48A126D31D6F}: NameServer = 10.0.1.1
O17 - HKLM\System\CS2\Services\Tcpip\..\{3FA3CBE0-92A7-42A1-A81D-48A126D31D6F}: NameServer = 10.0.1.1
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe

natomiast silent runners... podczas pierwszego uruchomienia tego progsa wyskoczyl mi taki blad:
blad1.JPG
a oto log ktory sie po chwili utworzyl:

"Silent Runners.vbs", revision 49, http://www.silentrunners.org/
Operating System: Windows XP
Output limited to non-default values, except where indicated by "{++}"

FATAL ERROR!
------------

"Silent Runners" cannot use WMI to identify the operating system.
This is caused by corruption of the WMI installation.

WMI is complex and it is recommended that you use a Microsoft
tool, "WMIDiag.vbs," to diagnose WMI on your system.

It can be downloaded here:

http://go.microsoft.com/fwlink/?LinkId=62562

gdy uruchomilem go po uzyciu trybu awaryjnego (czyli kiedy usuwalem tego backdoora) zaczal robic loga, ktory wyglada tak:

"Silent Runners.vbs", revision 49, http://www.silentrunners.org/
Operating System: Windows XP
Output limited to non-default values, except where indicated by "{++}"


Startup items buried in registry:
---------------------------------

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\
"{1C84F391-07D4-1045-0609-030309160030}" = ""C:\Program Files\Common Files\{1C84F391-07D4-1045-0609-030309160030}\Update.exe" mc-110-12-0000272" [file not found]

HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\
"{42071714-76d4-11d1-8b24-00a0c9068ff3}" = "Rozszerzenie CPL kadrowania wyświetlania"
-> {HKLM...CLSID} = "Rozszerzenie CPL kadrowania wyświetlania"
\InProcServer32\(Default) = "deskpan.dll" [file not found]
"{88895560-9AA2-1069-930E-00AA0030EBC8}" = "Rozszerzenie ikony HyperTerminalu"
-> {HKLM...CLSID} = "HyperTerminal Icon Ext"
\InProcServer32\(Default) = "C:\WINDOWS\System32\hticons.dll" ["Hilgraeve, Inc."]
"{42042206-2D85-11D3-8CFF-005004838597}" = "Microsoft Office HTML Icon Handler"
-> {HKLM...CLSID} = (no title provided)
\InProcServer32\(Default) = "E:\Programy\office\OFFICE11\msohev.dll" [MS]
"{B41DB860-8EE4-11D2-9906-E49FADC173CA}" = "WinRAR shell extension"
-> {HKLM...CLSID} = "WinRAR"
\InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]
"{00020000-0000-1011-8004-0000C06B5161}" = "WIBU-SYSTEMS Shell Extension"
-> {HKLM...CLSID} = "WIBU-SYSTEMS Shell Extension"
\InProcServer32\(Default) = "C:\Program Files\WIBU-SYSTEMS\System\WibuShellExt.dll" ["WIBU-SYSTEMS AG"]

HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\
<<!>> "{57B86673-276A-48B2-BAE7-C6DBB3020EB8}" = "AVG Anti-Spyware 7.5"
-> {HKLM...CLSID} = "CShellExecuteHookImpl Object"
\InProcServer32\(Default) = "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\shellexecutehook.dll" ["Anti-Malware Development a.s."]

HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\
<<!>> AtiExtEvent\DLLName = "Ati2evxx.dll" ["ATI Technologies Inc."]

HKLM\Software\Classes\PROTOCOLS\Filter\
<<!>> text/xml\CLSID = "{807553E5-5146-11D5-A672-00B0D022E945}"
-> {HKLM...CLSID} = (no title provided)
\InProcServer32\(Default) = "C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL" [MS]

HKLM\Software\Classes\Folder\shellex\ColumnHandlers\
{00020000-0000-1011-8004-0000C06B5161}\(Default) = (no title provided)
-> {HKLM...CLSID} = "WIBU-SYSTEMS Shell Extension"
\InProcServer32\(Default) = "C:\Program Files\WIBU-SYSTEMS\System\WibuShellExt.dll" ["WIBU-SYSTEMS AG"]

HKLM\Software\Classes\*\shellex\ContextMenuHandlers\
AVG Anti-Spyware\(Default) = "{8934FCEF-F5B8-468f-951F-78A921CD3920}"
-> {HKLM...CLSID} = "CContextScan Object"
\InProcServer32\(Default) = "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\context.dll" ["Anti-Malware Development a.s."]
WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
-> {HKLM...CLSID} = "WinRAR"
\InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]

HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\
AVG Anti-Spyware\(Default) = "{8934FCEF-F5B8-468f-951F-78A921CD3920}"
-> {HKLM...CLSID} = "CContextScan Object"
\InProcServer32\(Default) = "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\context.dll" ["Anti-Malware Development a.s."]
WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
-> {HKLM...CLSID} = "WinRAR"
\InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]

HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\
WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
-> {HKLM...CLSID} = "WinRAR"
\InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]


Group Policies {GPedit.msc branch and setting}:
-----------------------------------------------

Note: detected settings may not have any effect.

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\

"NoLowDiskSpaceChecks" = (REG_DWORD) hex:0x00000001
{unrecognized setting}

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System\

"DisableRegistryTools" = (REG_DWORD) hex:0x00000000
{User Configuration|Administrative Templates|System|
Prevent access to registry editing tools}

HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\

"shutdownwithoutlogon" = (REG_DWORD) hex:0x00000001
{Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options|
Shutdown: Allow system to be shut down without having to log on}

"undockwithoutlogon" = (REG_DWORD) hex:0x00000001
{Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options|
Devices: Allow undock without having to log on}


Active Desktop and Wallpaper:
-----------------------------

Active Desktop may be disabled at this entry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState

Displayed if Active Desktop enabled and wallpaper not set by Group Policy:
HKCU\Software\Microsoft\Internet Explorer\Desktop\General\
"Wallpaper" = "%APPDATA%\IrfanView\IrfanView_Wallpaper.bmp"

Displayed if Active Desktop disabled and wallpaper not set by Group Policy:
HKCU\Control Panel\Desktop\
"Wallpaper" = "C:\Documents and Settings\Adrian\Dane aplikacji\IrfanView\IrfanView_Wallpaper.bmp"

a po chwili pojawil sie taki oto blad:
blad.JPG
co z tym zrobic?
aa, jeszcze jeden problem. mswindtc.exe powoduje, iz jezeli sie wyloguje z mojego profilu to pojawia sie do niego haslo, ponowne uruchomienie komputera niweluje haslo i moge sie normalnie dostac na moje konto. jak pozbyc sie tego hasla ktorego oczywiscie nie powinno byc?

[MISTEJK]

Twój dns ?
Cytat:
O17 - HKLM\System\CCS\Services\Tcpip\..\{3FA3CBE0-92A7-42A1-A81D-48A126D31D6F}: NameServer = 10.0.1.1

tu masz błędy silenta:
http://www.searchengines.pl/phpbb203/lofiversion/index.php/t15989.html

przeczytaj to i spróbuj dać silenta. (hijackthis czysty)

[nuggle]

tak, to moj dns. ok, sprawdze i zobacze co sie dzieje. a co z tymi procesami ftp.exe i cmd.exe? ftp.exe juz mi sie nie uruchamia ale cmd.exe wraz ze startem systemu? nigdy tak jeszcze nie mialem

[MISTEJK]

to pewnie wirusy. ale nic nie poradze jak nie mam loga z silent runnners. Czekam na niego...

dodatkowo rzeskanuj system tym programem i usuń wszystko co znajdzie: www.ewido.net i również wklej z niego raport.

[nuggle]

wiec tak, przeczytalem co to za blad, pobralem odpowiednie narzedzia, powstal nowy log ktory jest bardzo dlugi a ja nie mam pojecia jak go zanalizowac, wkleje link do pliku z tym logiem, przeczytaj, moze bedziesz wiedzial co zrobic. silenta nadal nie uruchomie, wlasnie skanuje ewido full system scan, zaraz wkleje loga. a oto link do pliku z logiem (1.64 MB), ktory powstal po uzyciu narzedzia wmi diagnostic utility:
WMIDIAG-V1.10_XP__.CLI.RTM.32_X-CLT12VZC50KZ8_2006.12.30_13.46.00.LOG
czy ktos sie na tym zna??

[MISTEJK]

mój sposób:
ściagasz: http://www.namreh.boo.pl/silentrunnersfix.rar

wypakowujesz, instalujesz, uruchamiasz ponownie system i próbujesz na nowo loga z silenta zrobić.

[nuggle]

to tez nie pomoglo, znow taki blad jak w linku o nazwie "blad.jpg". a to jest raport z ewido:

---------------------------------------------------------
AVG Anti-Spyware - Scan Report
---------------------------------------------------------

+ Created at: 14:37:38 2006-12-30

+ Scan result:



C:\Documents and Settings\Adrian\Moje dokumenty\hijackthis\backups\backup-20061022-122231-634.dll -> Adware.PrintView : Ignored.
:mozilla.235:C:\Documents and Settings\Przemek\Dane aplikacji\Mozilla\Firefox\Profiles\ibd7qoad.default\cookies.txt -> TrackingCookie.2o7 : Ignored.
:mozilla.236:C:\Documents and Settings\Przemek\Dane aplikacji\Mozilla\Firefox\Profiles\ibd7qoad.default\cookies.txt -> TrackingCookie.2o7 : Ignored.
:mozilla.293:C:\Documents and Settings\Przemek\Dane aplikacji\Mozilla\Firefox\Profiles\ibd7qoad.default\cookies.txt -> TrackingCookie.2o7 : Ignored.
:mozilla.40:C:\Documents and Settings\Przemek\Dane aplikacji\Mozilla\Firefox\Profiles\ibd7qoad.default\cookies.txt -> TrackingCookie.Adbrite : Ignored.
:mozilla.41:C:\Documents and Settings\Przemek\Dane aplikacji\Mozilla\Firefox\Profiles\ibd7qoad.default\cookies.txt -> TrackingCookie.Adbrite : Ignored.
:mozilla.42:C:\Documents and Settings\Przemek\Dane aplikacji\Mozilla\Firefox\Profiles\ibd7qoad.default\cookies.txt -> TrackingCookie.Adbrite : Ignored.
C:\Documents and Settings\Przemek\Cookies\przemek@adbrite[2].txt -> TrackingCookie.Adbrite : Ignored.
:mozilla.133:C:\Documents and Settings\Przemek\Dane aplikacji\Mozilla\Firefox\Profiles\ibd7qoad.default\cookies.txt -> TrackingCookie.Adocean : Ignored.
:mozilla.134:C:\Documents and Settings\Przemek\Dane aplikacji\Mozilla\Firefox\Profiles\ibd7qoad.default\cookies.txt -> TrackingCookie.Adocean : Ignored.
:mozilla.150:C:\Documents and Settings\Przemek\Dane aplikacji\Mozilla\Firefox\Profiles\ibd7qoad.default\cookies.txt -> TrackingCookie.Adocean : Ignored.
:mozilla.151:C:\Documents and Settings\Przemek\Dane aplikacji\Mozilla\Firefox\Profiles\ibd7qoad.default\cookies.txt -> TrackingCookie.Adocean : Ignored.
:mozilla.397:C:\Documents and Settings\Przemek\Dane aplikacji\Mozilla\Firefox\Profiles\ibd7qoad.default\cookies.txt -> TrackingCookie.Adocean : Ignored.
:mozilla.398:C:\Documents and Settings\Przemek\Dane aplikacji\Mozilla\Firefox\Profiles\ibd7qoad.default\cookies.txt -> TrackingCookie.Adocean : Ignored.
:mozilla.67:C:\Documents and Settings\Przemek\Dane aplikacji\Mozilla\Firefox\Profiles\ibd7qoad.default\cookies.txt -> TrackingCookie.Adocean : Ignored.
:mozilla.68:C:\Documents and Settings\Przemek\Dane aplikacji\Mozilla\Firefox\Profiles\ibd7qoad.default\cookies.txt -> TrackingCookie.Adocean : Ignored.
:mozilla.81:C:\Documents and Settings\Przemek\Dane aplikacji\Mozilla\Firefox\Profiles\ibd7qoad.default\cookies.txt -> TrackingCookie.Adocean : Ignored.
:mozilla.82:C:\Documents and Settings\Przemek\Dane aplikacji\Mozilla\Firefox\Profiles\ibd7qoad.default\cookies.txt -> TrackingCookie.Adocean : Ignored.
:mozilla.100:C:\Documents and Settings\Przemek\Dane aplikacji\Mozilla\Firefox\Profiles\ibd7qoad.default\cookies.txt -> TrackingCookie.Adrevolver : Ignored.
:mozilla.101:C:\Documents and Settings\Przemek\Dane aplikacji\Mozilla\Firefox\Profiles\ibd7qoad.default\cookies.txt -> TrackingCookie.Adrevolver : Ignored.
:mozilla.109:C:\Documents and Settings\Przemek\Dane aplikacji\Mozilla\Firefox\Profiles\ibd7qoad.default\cookies.txt -> TrackingCookie.Advertising : Ignored.
:mozilla.111:C:\Documents and Settings\Przemek\Dane aplikacji\Mozilla\Firefox\Profiles\ibd7qoad.default\cookies.txt -> TrackingCookie.Advertising : Ignored.
:mozilla.115:C:\Documents and Settings\Przemek\Dane aplikacji\Mozilla\Firefox\Profiles\ibd7qoad.default\cookies.txt -> TrackingCookie.Advertising : Ignored.
:mozilla.116:C:\Documents and Settings\Przemek\Dane aplikacji\Mozilla\Firefox\Profiles\ibd7qoad.default\cookies.txt -> TrackingCookie.Atdmt : Ignored.
:mozilla.289:C:\Documents and Settings\Przemek\Dane aplikacji\Mozilla\Firefox\Profiles\ibd7qoad.default\cookies.txt -> TrackingCookie.Bluestreak : Ignored.
:mozilla.110:C:\Documents and Settings\Przemek\Dane aplikacji\Mozilla\Firefox\Profiles\ibd7qoad.default\cookies.txt -> TrackingCookie.Burstnet : Ignored.
:mozilla.112:C:\Documents and Settings\Przemek\Dane aplikacji\Mozilla\Firefox\Profiles\ibd7qoad.default\cookies.txt -> TrackingCookie.Burstnet : Ignored.
:mozilla.113:C:\Documents and Settings\Przemek\Dane aplikacji\Mozilla\Firefox\Profiles\ibd7qoad.default\cookies.txt -> TrackingCookie.Burstnet : Ignored.
:mozilla.70:C:\Documents and Settings\Przemek\Dane aplikacji\Mozilla\Firefox\Profiles\ibd7qoad.default\cookies.txt -> TrackingCookie.Casalemedia : Ignored.
:mozilla.71:C:\Documents and Settings\Przemek\Dane aplikacji\Mozilla\Firefox\Profiles\ibd7qoad.default\cookies.txt -> TrackingCookie.Casalemedia : Ignored.
:mozilla.72:C:\Documents and Settings\Przemek\Dane aplikacji\Mozilla\Firefox\Profiles\ibd7qoad.default\cookies.txt -> TrackingCookie.Casalemedia : Ignored.
:mozilla.73:C:\Documents and Settings\Przemek\Dane aplikacji\Mozilla\Firefox\Profiles\ibd7qoad.default\cookies.txt -> TrackingCookie.Casalemedia : Ignored.
:mozilla.274:C:\Documents and Settings\Przemek\Dane aplikacji\Mozilla\Firefox\Profiles\ibd7qoad.default\cookies.txt -> TrackingCookie.Coremetrics : Ignored.
:mozilla.129:C:\Documents and Settings\Przemek\Dane aplikacji\Mozilla\Firefox\Profiles\ibd7qoad.default\cookies.txt -> TrackingCookie.Doubleclick : Ignored.
:mozilla.107:C:\Documents and Settings\Przemek\Dane aplikacji\Mozilla\Firefox\Profiles\ibd7qoad.default\cookies.txt -> TrackingCookie.Fastclick : Ignored.
:mozilla.114:C:\Documents and Settings\Przemek\Dane aplikacji\Mozilla\Firefox\Profiles\ibd7qoad.default\cookies.txt -> TrackingCookie.Fastclick : Ignored.
:mozilla.443:C:\Documents and Settings\Przemek\Dane aplikacji\Mozilla\Firefox\Profiles\ibd7qoad.default\cookies.txt -> TrackingCookie.Goclick : Ignored.
:mozilla.444:C:\Documents and Settings\Przemek\Dane aplikacji\Mozilla\Firefox\Profiles\ibd7qoad.default\cookies.txt -> TrackingCookie.Goclick : Ignored.
:mozilla.201:C:\Documents and Settings\Przemek\Dane aplikacji\Mozilla\Firefox\Profiles\ibd7qoad.default\cookies.txt -> TrackingCookie.Googleadservices : Ignored.
:mozilla.345:C:\Documents and Settings\Przemek\Dane aplikacji\Mozilla\Firefox\Profiles\ibd7qoad.default\cookies.txt -> TrackingCookie.Googleadservices : Ignored.
:mozilla.48:C:\Documents and Settings\Przemek\Dane aplikacji\Mozilla\Firefox\Profiles\ibd7qoad.default\cookies.txt -> TrackingCookie.Itrack : Ignored.
:mozilla.99:C:\Documents and Settings\Przemek\Dane aplikacji\Mozilla\Firefox\Profiles\ibd7qoad.default\cookies.txt -> TrackingCookie.Overture : Ignored.
:mozilla.280:C:\Documents and Settings\Przemek\Dane aplikacji\Mozilla\Firefox\Profiles\ibd7qoad.default\cookies.txt -> TrackingCookie.Pointroll : Ignored.
:mozilla.281:C:\Documents and Settings\Przemek\Dane aplikacji\Mozilla\Firefox\Profiles\ibd7qoad.default\cookies.txt -> TrackingCookie.Pointroll : Ignored.
:mozilla.282:C:\Documents and Settings\Przemek\Dane aplikacji\Mozilla\Firefox\Profiles\ibd7qoad.default\cookies.txt -> TrackingCookie.Pointroll : Ignored.
:mozilla.283:C:\Documents and Settings\Przemek\Dane aplikacji\Mozilla\Firefox\Profiles\ibd7qoad.default\cookies.txt -> TrackingCookie.Pointroll : Ignored.
:mozilla.313:C:\Documents and Settings\Przemek\Dane aplikacji\Mozilla\Firefox\Profiles\ibd7qoad.default\cookies.txt -> TrackingCookie.Questionmarket : Ignored.
:mozilla.314:C:\Documents and Settings\Przemek\Dane aplikacji\Mozilla\Firefox\Profiles\ibd7qoad.default\cookies.txt -> TrackingCookie.Questionmarket : Ignored.
:mozilla.315:C:\Documents and Settings\Przemek\Dane aplikacji\Mozilla\Firefox\Profiles\ibd7qoad.default\cookies.txt -> TrackingCookie.Questionmarket : Ignored.
:mozilla.439:C:\Documents and Settings\Przemek\Dane aplikacji\Mozilla\Firefox\Profiles\ibd7qoad.default\cookies.txt -> TrackingCookie.Revenue : Ignored.
:mozilla.284:C:\Documents and Settings\Przemek\Dane aplikacji\Mozilla\Firefox\Profiles\ibd7qoad.default\cookies.txt -> TrackingCookie.Ru4 : Ignored.
:mozilla.285:C:\Documents and Settings\Przemek\Dane aplikacji\Mozilla\Firefox\Profiles\ibd7qoad.default\cookies.txt -> TrackingCookie.Ru4 : Ignored.
:mozilla.286:C:\Documents and Settings\Przemek\Dane aplikacji\Mozilla\Firefox\Profiles\ibd7qoad.default\cookies.txt -> TrackingCookie.Ru4 : Ignored.
:mozilla.287:C:\Documents and Settings\Przemek\Dane aplikacji\Mozilla\Firefox\Profiles\ibd7qoad.default\cookies.txt -> TrackingCookie.Ru4 : Ignored.
:mozilla.261:C:\Documents and Settings\Przemek\Dane aplikacji\Mozilla\Firefox\Profiles\ibd7qoad.default\cookies.txt -> TrackingCookie.cenzura-spam : Ignored.
:mozilla.262:C:\Documents and Settings\Przemek\Dane aplikacji\Mozilla\Firefox\Profiles\ibd7qoad.default\cookies.txt -> TrackingCookie.cenzura-spam : Ignored.
:mozilla.263:C:\Documents and Settings\Przemek\Dane aplikacji\Mozilla\Firefox\Profiles\ibd7qoad.default\cookies.txt -> TrackingCookie.cenzura-spam : Ignored.
:mozilla.264:C:\Documents and Settings\Przemek\Dane aplikacji\Mozilla\Firefox\Profiles\ibd7qoad.default\cookies.txt -> TrackingCookie.cenzura-spam : Ignored.
:mozilla.269:C:\Documents and Settings\Przemek\Dane aplikacji\Mozilla\Firefox\Profiles\ibd7qoad.default\cookies.txt -> TrackingCookie.cenzura-spam : Ignored.
:mozilla.381:C:\Documents and Settings\Przemek\Dane aplikacji\Mozilla\Firefox\Profiles\ibd7qoad.default\cookies.txt -> TrackingCookie.Smartadserver : Ignored.
:mozilla.122:C:\Documents and Settings\Przemek\Dane aplikacji\Mozilla\Firefox\Profiles\ibd7qoad.default\cookies.txt -> TrackingCookie.Statcounter : Ignored.
:mozilla.123:C:\Documents and Settings\Przemek\Dane aplikacji\Mozilla\Firefox\Profiles\ibd7qoad.default\cookies.txt -> TrackingCookie.Statcounter : Ignored.
:mozilla.126:C:\Documents and Settings\Przemek\Dane aplikacji\Mozilla\Firefox\Profiles\ibd7qoad.default\cookies.txt -> TrackingCookie.Statcounter : Ignored.
:mozilla.127:C:\Documents and Settings\Przemek\Dane aplikacji\Mozilla\Firefox\Profiles\ibd7qoad.default\cookies.txt -> TrackingCookie.Statcounter : Ignored.
:mozilla.167:C:\Documents and Settings\Przemek\Dane aplikacji\Mozilla\Firefox\Profiles\ibd7qoad.default\cookies.txt -> TrackingCookie.Tacoda : Ignored.
:mozilla.168:C:\Documents and Settings\Przemek\Dane aplikacji\Mozilla\Firefox\Profiles\ibd7qoad.default\cookies.txt -> TrackingCookie.Tacoda : Ignored.
:mozilla.169:C:\Documents and Settings\Przemek\Dane aplikacji\Mozilla\Firefox\Profiles\ibd7qoad.default\cookies.txt -> TrackingCookie.Tacoda : Ignored.
:mozilla.221:C:\Documents and Settings\Przemek\Dane aplikacji\Mozilla\Firefox\Profiles\ibd7qoad.default\cookies.txt -> TrackingCookie.Targetnet : Ignored.
:mozilla.45:C:\Documents and Settings\Przemek\Dane aplikacji\Mozilla\Firefox\Profiles\ibd7qoad.default\cookies.txt -> TrackingCookie.Tradedoubler : Ignored.
:mozilla.46:C:\Documents and Settings\Przemek\Dane aplikacji\Mozilla\Firefox\Profiles\ibd7qoad.default\cookies.txt -> TrackingCookie.Tradedoubler : Ignored.
:mozilla.47:C:\Documents and Settings\Przemek\Dane aplikacji\Mozilla\Firefox\Profiles\ibd7qoad.default\cookies.txt -> TrackingCookie.Tradedoubler : Ignored.
:mozilla.165:C:\Documents and Settings\Przemek\Dane aplikacji\Mozilla\Firefox\Profiles\ibd7qoad.default\cookies.txt -> TrackingCookie.Trafic : Ignored.
:mozilla.102:C:\Documents and Settings\Przemek\Dane aplikacji\Mozilla\Firefox\Profiles\ibd7qoad.default\cookies.txt -> TrackingCookie.Tribalfusion : Ignored.
:mozilla.163:C:\Documents and Settings\Przemek\Dane aplikacji\Mozilla\Firefox\Profiles\ibd7qoad.default\cookies.txt -> TrackingCookie.Valuead : Ignored.
:mozilla.164:C:\Documents and Settings\Przemek\Dane aplikacji\Mozilla\Firefox\Profiles\ibd7qoad.default\cookies.txt -> TrackingCookie.Valuead : Ignored.
:mozilla.166:C:\Documents and Settings\Przemek\Dane aplikacji\Mozilla\Firefox\Profiles\ibd7qoad.default\cookies.txt -> TrackingCookie.Valuead : Ignored.
:mozilla.200:C:\Documents and Settings\Przemek\Dane aplikacji\Mozilla\Firefox\Profiles\ibd7qoad.default\cookies.txt -> TrackingCookie.Webtrendslive : Ignored.
:mozilla.103:C:\Documents and Settings\Przemek\Dane aplikacji\Mozilla\Firefox\Profiles\ibd7qoad.default\cookies.txt -> TrackingCookie.Yieldmanager : Ignored.
:mozilla.104:C:\Documents and Settings\Przemek\Dane aplikacji\Mozilla\Firefox\Profiles\ibd7qoad.default\cookies.txt -> TrackingCookie.Yieldmanager : Ignored.
:mozilla.105:C:\Documents and Settings\Przemek\Dane aplikacji\Mozilla\Firefox\Profiles\ibd7qoad.default\cookies.txt -> TrackingCookie.Yieldmanager : Ignored.
:mozilla.106:C:\Documents and Settings\Przemek\Dane aplikacji\Mozilla\Firefox\Profiles\ibd7qoad.default\cookies.txt -> TrackingCookie.Yieldmanager : Ignored.
C:\WINDOWS\system32\wcpsvsu.exe -> Trojan.Small : Ignored.


::Report end

[MISTEJK]

Ściągnij ComboFix: http://download.bleepingcomputer.com/sUBs/combofix.exe uruchom w trybie normalnym, wpisz Y i kliknij enter.
Uwaga! Podczas pracy nie klikaj w okno combofixa, może to sprawić,że się zawiesi.
Finalnie wklej loga C:\combofix.txt

[nuggle]

oto log z combofix:

ComboFix 06.11.27 - Running from: "C:\Documents and Settings\Adrian\Pulpit"

(((((((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))


C:\Program Files\PrintView
C:\Program Files\Common Files\{1C84F391-07D4-1045-0609-030309160030}

~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ Purity ~ ~ ~ ~ ~ ~ ~ ~~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~

Folders Quarantined:

C:\QooBox\Purity\WINDOWS\SKS~1


((((((((((((((((((((((((((((((( Files Created from 2006-11-30 to 2006-12-30 ))))))))))))))))))))))))))))))))))


2006-12-29 00:03 3,968 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
2006-12-29 00:03 <DIR> d-------- C:\Program Files\Grisoft
2006-12-28 20:13 <DIR> d-------- C:\!KillBox
2006-12-27 14:12 <DIR> d-------- C:\Program Files\Canon
2006-12-26 18:06 <DIR> d-------- C:\Program Files\nLite
2006-12-25 22:33 <DIR> d-------- C:\Adobe Photoshop CS2
2006-12-25 18:39 <DIR> d-------- C:\Program Files\Grupa IMAGE
2006-12-23 13:47 <DIR> d--h----- C:\WINDOWS\system32\GroupPolicy
2006-12-22 20:26 <DIR> d-------- C:\Program Files\Common Files\Vbox
2006-12-22 20:24 368,912 --a------ C:\WINDOWS\system32\vbar332.dll
2006-12-22 20:24 252,176 --a------ C:\WINDOWS\system32\msrd2x35.dll
2006-12-22 20:24 24,848 --a------ C:\WINDOWS\system32\msjter35.dll
2006-12-22 20:24 123,664 --a------ C:\WINDOWS\system32\Msjint35.dll
2006-12-22 20:24 1,046,288 --a------ C:\WINDOWS\system32\msjet35.dll
2006-12-22 20:23 5,600 --a------ C:\WINDOWS\system\WINASPI.DLL
2006-12-22 20:23 45,056 --a------ C:\WINDOWS\system32\WNASPI32.DLL
2006-12-22 20:23 4,672 --a------ C:\WINDOWS\system\WOWPOST.EXE
2006-12-22 20:23 17,005 --a------ C:\WINDOWS\system32\drivers\ASPI32.SYS
2006-12-22 20:21 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Symantec
2006-12-22 20:21 <DIR> d-------- C:\Documents and Settings\Adrian\Dane aplikacji\Symantec
2006-12-20 19:05 <DIR> d-------- C:\Program Files\Elaborate Bytes
2006-12-20 18:43 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Elaborate Bytes
2006-12-14 00:41 15,440 --a------ C:\WINDOWS\system32\drivers\ElbyCDIO.sys
2006-12-14 00:41 11,984 --a------ C:\WINDOWS\system32\drivers\ElbyDelay.sys
2006-12-13 21:24 89,296 --a------ C:\WINDOWS\system32\ElbyCDIO.dll
2006-12-05 13:26 <DIR> d-------- C:\Downloads


(((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))))


2006-12-30 14:57 -------- d-------- C:\Program Files\Common Files
2006-12-09 01:16 -------- d---s---- C:\Documents and Settings\Adrian\Dane aplikacji\Microsoft
2006-12-03 15:11 -------- d--h----- C:\Program Files\InstallShield Installation Information
2006-11-27 17:24 98304 --a------ C:\WINDOWS\system32\CmdLineExt.dll
2006-11-27 17:11 -------- d-------- C:\Program Files\Internet Explorer
2006-11-24 21:18 -------- d-------- C:\Program Files\Microsoft Office
2006-11-12 00:33 -------- d-------- C:\Program Files\DIFX
2006-11-08 07:17 -------- d-------- C:\Program Files\WIBUKEY
2006-11-08 07:17 -------- d-------- C:\Program Files\WIBU-SYSTEMS
2006-11-08 07:17 -------- d-------- C:\Program Files\Motorola
2006-11-08 06:55 -------- d--h----- C:\Program Files\WindowsUpdate
2006-11-02 22:11 -------- d-------- C:\Documents and Settings\Adrian\Dane aplikacji\Media Player Classic
2006-11-02 18:59 -------- d-------- C:\Program Files\K-Lite Codec Pack
2006-11-01 20:06 -------- d-------- C:\Documents and Settings\Adrian\Dane aplikacji\Skype
2006-10-21 20:40 2 --a--c--- C:\WINDOWS\system32\wcpsvsu.exe
2006-10-20 18:05 62 --ahs---- C:\Documents and Settings\Adrian\Dane aplikacji\desktop.ini
2006-10-20 17:18 0 -rahs---- C:\MSDOS.SYS
2006-10-20 17:18 0 -rahs---- C:\IO.SYS
2006-10-20 17:18 0 --a------ C:\CONFIG.SYS
2006-10-20 17:18 0 --a------ C:\AUTOEXEC.BAT


(((((((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries are not shown

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\IMAIL]
"Installed"="1"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MAPI]
"Installed"="1"
"NoChange"="1"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MSFS]
"Installed"="1"

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components]
"DeskHtmlVersion"=dword:00000110
"DeskHtmlMinorVersion"=dword:00000005
"Settings"=dword:00000001
"GeneralFlags"=dword:00000001

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\0]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="Moja bieżąca strona główna"
"Flags"=dword:00000002
"Position"=hex:2c,00,00,00,e6,00,00,00,00,00,00,00,9a,03,00,00,44,03,00,00,00,\
00,00,00,01,00,00,00,01,00,00,00,01,00,00,00,00,00,00,00,00,00,00,00
"CurrentState"=hex:04,00,00,40
"OriginalStateInfo"=hex:18,00,00,00,ff,ff,00,00,ff,ff,00,00,ff,ff,ff,ff,ff,ff,\
ff,ff,04,00,00,00
"RestoredStateInfo"=hex:18,00,00,00,6a,02,00,00,23,00,00,00,a4,00,00,00,9a,00,\
00,00,01,00,00,00

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"CTFMON.EXE"="C:\\WINDOWS\\System32\\CTFMON.EXE"

[HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\run]
"CTFMON.EXE"="C:\\WINDOWS\\System32\\CTFMON.EXE"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\sharedtaskscheduler]
"{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Moduł wstępnego ładowania interfejsu Browseui"
"{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Demon buforu kategorii składników"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{AEB6717E-7E19-11d0-97EE-00C04FD91972}"=""
"{57B86673-276A-48B2-BAE7-C6DBB3020EB8}"="AVG Anti-Spyware 7.5"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091
"NoLowDiskSpaceChecks"=dword:00000001

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\Run]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"dontdisplaylastusername"=dword:00000000
"legalnoticecaption"=""
"legalnoticetext"=""
"shutdownwithoutlogon"=dword:00000001
"undockwithoutlogon"=dword:00000001

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091

[HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\shellserviceobjectdelayload]
"PostBootReminder"="{7849596a-48ea-486e-8937-a2a3009f31a9}"
"CDBurn"="{fbeb8a05-beee-4442-804e-409d6c4515e9}"
"WebCheck"="{E6FB5E20-DE35-11CF-9C87-00AA005127ED}"
"SysTray"="{35CEC8A3-2BE6-11D2-8773-92E220524153}"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll"

Completion time: 06-12-30 14:57:38.16
C:\ComboFix.txt ... 06-12-30 14:57

[BZIKU]

Do usuniecia masz

C:\WINDOWS\system32\wcpsvsu.exe

usuniesz killboxem i dasz raz jeszcze logi do kontroli,wszystkie

[nuggle]

ok, usunalem, oto logi:

Logfile of HijackThis v1.99.1
Scan saved at 15:58:35, on 2006-12-30
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
E:\Programy\Konnekt\konnekt.exe
E:\Programy\Winamp\winamp.exe
D:\Programs\firefox\firefox.exe
C:\Documents and Settings\Adrian\Moje dokumenty\hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.pl/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O8 - Extra context menu item: Download All by FlashGet - D:\Programs\FlashGet\jc_all.htm
O8 - Extra context menu item: Download using FlashGet - D:\Programs\FlashGet\jc_link.htm
O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://E:\Programy\office\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll
O17 - HKLM\System\CCS\Services\Tcpip\..\{3FA3CBE0-92A7-42A1-A81D-48A126D31D6F}: NameServer = 10.0.1.1
O17 - HKLM\System\CS1\Services\Tcpip\..\{3FA3CBE0-92A7-42A1-A81D-48A126D31D6F}: NameServer = 10.0.1.1
O17 - HKLM\System\CS2\Services\Tcpip\..\{3FA3CBE0-92A7-42A1-A81D-48A126D31D6F}: NameServer = 10.0.1.1
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe

ComboFix 06.11.27 - Running from: "C:\Documents and Settings\Adrian\Pulpit"

(((((((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))



~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ Purity ~ ~ ~ ~ ~ ~ ~ ~~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~

Folders Quarantined:

C:\QooBox\Purity\WINDOWS\SKS~1


((((((((((((((((((((((((((((((( Files Created from 2006-11-30 to 2006-12-30 ))))))))))))))))))))))))))))))))))


2006-12-29 00:03 3,968 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
2006-12-29 00:03 <DIR> d-------- C:\Program Files\Grisoft
2006-12-28 20:13 <DIR> d-------- C:\!KillBox
2006-12-27 14:12 <DIR> d-------- C:\Program Files\Canon
2006-12-26 18:06 <DIR> d-------- C:\Program Files\nLite
2006-12-25 22:33 <DIR> d-------- C:\Adobe Photoshop CS2
2006-12-25 18:39 <DIR> d-------- C:\Program Files\Grupa IMAGE
2006-12-23 13:47 <DIR> d--h----- C:\WINDOWS\system32\GroupPolicy
2006-12-22 20:26 <DIR> d-------- C:\Program Files\Common Files\Vbox
2006-12-22 20:24 368,912 --a------ C:\WINDOWS\system32\vbar332.dll
2006-12-22 20:24 252,176 --a------ C:\WINDOWS\system32\msrd2x35.dll
2006-12-22 20:24 24,848 --a------ C:\WINDOWS\system32\msjter35.dll
2006-12-22 20:24 123,664 --a------ C:\WINDOWS\system32\Msjint35.dll
2006-12-22 20:24 1,046,288 --a------ C:\WINDOWS\system32\msjet35.dll
2006-12-22 20:23 5,600 --a------ C:\WINDOWS\system\WINASPI.DLL
2006-12-22 20:23 45,056 --a------ C:\WINDOWS\system32\WNASPI32.DLL
2006-12-22 20:23 4,672 --a------ C:\WINDOWS\system\WOWPOST.EXE
2006-12-22 20:23 17,005 --a------ C:\WINDOWS\system32\drivers\ASPI32.SYS
2006-12-22 20:21 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Symantec
2006-12-22 20:21 <DIR> d-------- C:\Documents and Settings\Adrian\Dane aplikacji\Symantec
2006-12-20 19:05 <DIR> d-------- C:\Program Files\Elaborate Bytes
2006-12-20 18:43 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Elaborate Bytes
2006-12-14 00:41 15,440 --a------ C:\WINDOWS\system32\drivers\ElbyCDIO.sys
2006-12-14 00:41 11,984 --a------ C:\WINDOWS\system32\drivers\ElbyDelay.sys
2006-12-13 21:24 89,296 --a------ C:\WINDOWS\system32\ElbyCDIO.dll
2006-12-05 13:26 <DIR> d-------- C:\Downloads


(((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))))


2006-12-30 14:57 -------- d-------- C:\Program Files\Common Files
2006-12-09 01:16 -------- d---s---- C:\Documents and Settings\Adrian\Dane aplikacji\Microsoft
2006-12-03 15:11 -------- d--h----- C:\Program Files\InstallShield Installation Information
2006-11-27 17:24 98304 --a------ C:\WINDOWS\system32\CmdLineExt.dll
2006-11-27 17:11 -------- d-------- C:\Program Files\Internet Explorer
2006-11-24 21:18 -------- d-------- C:\Program Files\Microsoft Office
2006-11-12 00:33 -------- d-------- C:\Program Files\DIFX
2006-11-08 07:17 -------- d-------- C:\Program Files\WIBUKEY
2006-11-08 07:17 -------- d-------- C:\Program Files\WIBU-SYSTEMS
2006-11-08 07:17 -------- d-------- C:\Program Files\Motorola
2006-11-08 06:55 -------- d--h----- C:\Program Files\WindowsUpdate
2006-11-02 22:11 -------- d-------- C:\Documents and Settings\Adrian\Dane aplikacji\Media Player Classic
2006-11-02 18:59 -------- d-------- C:\Program Files\K-Lite Codec Pack
2006-11-01 20:06 -------- d-------- C:\Documents and Settings\Adrian\Dane aplikacji\Skype
2006-10-20 18:05 62 --ahs---- C:\Documents and Settings\Adrian\Dane aplikacji\desktop.ini
2006-10-20 17:18 0 -rahs---- C:\MSDOS.SYS
2006-10-20 17:18 0 -rahs---- C:\IO.SYS
2006-10-20 17:18 0 --a------ C:\CONFIG.SYS
2006-10-20 17:18 0 --a------ C:\AUTOEXEC.BAT


(((((((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries are not shown

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\IMAIL]
"Installed"="1"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MAPI]
"Installed"="1"
"NoChange"="1"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MSFS]
"Installed"="1"

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components]
"DeskHtmlVersion"=dword:00000110
"DeskHtmlMinorVersion"=dword:00000005
"Settings"=dword:00000001
"GeneralFlags"=dword:00000001

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\0]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="Moja bieżąca strona główna"
"Flags"=dword:00000002
"Position"=hex:2c,00,00,00,e6,00,00,00,00,00,00,00,9a,03,00,00,44,03,00,00,00,\
00,00,00,01,00,00,00,01,00,00,00,01,00,00,00,00,00,00,00,00,00,00,00
"CurrentState"=hex:04,00,00,40
"OriginalStateInfo"=hex:18,00,00,00,ff,ff,00,00,ff,ff,00,00,ff,ff,ff,ff,ff,ff,\
ff,ff,04,00,00,00
"RestoredStateInfo"=hex:18,00,00,00,6a,02,00,00,23,00,00,00,a4,00,00,00,9a,00,\
00,00,01,00,00,00

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"CTFMON.EXE"="C:\\WINDOWS\\System32\\CTFMON.EXE"

[HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\run]
"CTFMON.EXE"="C:\\WINDOWS\\System32\\CTFMON.EXE"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\sharedtaskscheduler]
"{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Moduł wstępnego ładowania interfejsu Browseui"
"{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Demon buforu kategorii składników"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{AEB6717E-7E19-11d0-97EE-00C04FD91972}"=""
"{57B86673-276A-48B2-BAE7-C6DBB3020EB8}"="AVG Anti-Spyware 7.5"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091
"NoLowDiskSpaceChecks"=dword:00000001

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\Run]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"dontdisplaylastusername"=dword:00000000
"legalnoticecaption"=""
"legalnoticetext"=""
"shutdownwithoutlogon"=dword:00000001
"undockwithoutlogon"=dword:00000001

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091

[HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\shellserviceobjectdelayload]
"PostBootReminder"="{7849596a-48ea-486e-8937-a2a3009f31a9}"
"CDBurn"="{fbeb8a05-beee-4442-804e-409d6c4515e9}"
"WebCheck"="{E6FB5E20-DE35-11CF-9C87-00AA005127ED}"
"SysTray"="{35CEC8A3-2BE6-11D2-8773-92E220524153}"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll"

Completion time: 06-12-30 15:59:21.10
C:\ComboFix.txt ... 06-12-30 15:59
C:\ComboFix2.txt ... 06-12-30 14:57

silent runners jak juz mowilem, nie dziala
skanowalem dysk ewido, nic nie znalazlo.

[BZIKU]

teraz jest juz czysto,a combo zastepuje czasem sijlenta wiec wystarczy log z niego

[nuggle]

ok, ale jest jeszcze jeden problem. kiedy chce sie przelaczyc na drugi profil, to po wylogowaniu/przelaczeniu uzytkownika na profil naklada sie haslo, musze kompa zrestartowac i wtedy dopiero moge sie zalogowac. co jest grane?

[BZIKU]

zakladales to hasło,napisz cos wiecej

[nuggle]

nie, nie zakladalem. oba profile byly bez hasla. od niedawna jednak zaczelo sie samo zakladac. objawy takie jakbym nadal mial mswindtc.exe, lecz jak wskazuja logi juz jest usuniety. kiedys mialem tak samo ale po susnieciu tego pliku haslo juz sie nie nakladalo. rejestr jest czysty. moze trzeba jakas wartosc dodac?

[BZIKU]

to sprawdz w rejestrze kolejno takie sciezki

O4 - HKLM\..\Run:>>>> [win msdt service]

04 - HKLM\..\RunServices: [win msdt service]
O4 - HKCU\..\RunServices: [win msdt service]

mam nadzieje ze umiesz te skroty rozszyfrowac........zobacz czy są te klucze i wartosci przy nich

[nuggle]

umiem rozszyfrowac. nie ma tam nic zwiazanego z mswindtc
moze jest jakis inny problem?

[BZIKU]

jesli nie ma nic ,to trzeba szukac w ustawieniach windy,bo smiecia juz nie widac


zastosuj jeszcze:
http://www.firewallleaktester.com/tools/wwdc.exe

zamknij wszystkie porty tym programem

Ktos napisał tez ze zastosowanie skanowania antywirem >>ArcaVir pomoglo.Sprawdz.