neo strasznie wolno chodzi

**Posty:** 210 · przez **Komandor Brudne Gacie** 04 Lis 2007, 20:34

Witajcie.Od kilku dni neostrada chodzi mi bardzo wolno.Nie mogę połączyc sie z serwerem gadu gadu, prędkości ściągania są zamiast ok 50-60 to są 5-20kb/s.Przez co jest to spowodowane i czy u was też tak jest :?:

**Posty:** 7838 · przez **Lukesh** 04 Lis 2007, 20:36

Komandor Brudne Gacie napisał(a):Nie mogę połączyc sie z serwerem gadu gadu

Mnie tez sie zepsulo ;(.

Co do mulenia - profilaktycznie:
:arrow:

Zastosuj sie do wskazowek z tematu: http://forum.programosy.pl/bad-generic-host-process-for-win32-services-vt79489.html
:arrow:

Zrob skan on-line www.ewido.com
:arrow:

Pokaz log z ComboFix: http://www.programosy.pl/program,combofix.html
:arrow:

na sam koniec wstaw CALE logi wg opisu: http://forum.programosy.pl/hijackthis-amp-silent-runners-gtobsuga-i-umieszczanie-vt9452.html

no i do bezpieczenstwa przenosze

.

przez **jeff** 04 Lis 2007, 22:14

tepsa robi remont sieci

**Posty:** 210 · przez **Komandor Brudne Gacie** 04 Lis 2007, 22:16

Silent Runners:

Kod: Zaznacz wszystko: "Silent Runners.vbs", revision 52, http://www.silentrunners.org/ Operating System: Windows XP SP2 Output limited to non-default values, except where indicated by "{++}" Startup items buried in registry: --------------------------------- HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ {++} "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}" = ""C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"" [file not found] "Gadu-Gadu" = ""C:\Program Files\Gadu-Gadu\gg.exe" /tray" ["Gadu-Gadu S.A."] HKLM\Software\Microsoft\Windows\CurrentVersion\Run\ {++} "ATICCC" = ""C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe"" [null data] "SoundMan" = "SOUNDMAN.EXE" ["Realtek Semiconductor Corp."] "CnxDslTaskBar" = ""c:\program files\zte corporation\zxdsl852\CnxDslTb.exe" "ZTE Corporation\ZXDSL852"" ["Conexant Systems, Inc."] "WOOWATCH" = "C:\PROGRA~1\NEOSTR~1\Watch.exe" ["France Télécom R&D"] "WOOTASKBARICON" = "C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe" ["France Télécom R&D"] "Kalendarz XP" = ""D:\Program Files\Kalendarz XP\Kalendarz.exe"" [empty string] "SunJavaUpdateSched" = ""C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"" ["Sun Microsystems, Inc."] "PWRISOVM.EXE" = "C:\Program Files\PowerISO\PWRISOVM.EXE" [file not found] "ISUSPM Startup" = "C:\PROGRA~1\COMMON~1\INSTAL~1\UpdateService\ISUSPM.exe -startup" ["InstallShield Software Corporation"] "ISUSScheduler" = ""C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start" ["InstallShield Software Corporation"] "DAEMON Tools-1033" = ""C:\Program Files\D-Tools\daemon.exe" -lang 1033" ["DAEMON'S HOME"] "avast!" = "C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [null data] HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\(Default) = (no title provided) -> {HKLM...CLSID} = "AcroIEHlprObj Class" \InProcServer32\(Default) = "C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll" ["Adobe Systems Incorporated"] {22BF413B-C6D2-4d91-82A9-A0F997BA588C}\(Default) = (no title provided) -> {HKLM...CLSID} = "Skype add-on (mastermind)" \InProcServer32\(Default) = "C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll" ["Skype Technologies S.A."] {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C}\(Default) = (no title provided) -> {HKLM...CLSID} = "Megaupload Toolbar" \InProcServer32\(Default) = "C:\PROGRA~1\MegauploadToolbar\megauploadtoolbar.dll" ["MEGAUPLOAD "] {761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\(Default) = (no title provided) -> {HKLM...CLSID} = "SSVHelper Class" \InProcServer32\(Default) = "C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll" ["Sun Microsystems, Inc."] {AA58ED58-01DD-4d91-8333-CF10577473F7}\(Default) = (no title provided) -> {HKLM...CLSID} = "Google Toolbar Helper" \InProcServer32\(Default) = "c:\program files\google\googletoolbar1.dll" ["Google Inc."] {AF69DE43-7D58-4638-B6FA-CE66B5AD205D}\(Default) = (no title provided) -> {HKLM...CLSID} = "Google Toolbar Notifier BHO" \InProcServer32\(Default) = "C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll" ["Google Inc."] HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\ "{42071714-76d4-11d1-8b24-00a0c9068ff3}" = "Rozszerzenie CPL kadrowania wyświetlania" -> {HKLM...CLSID} = "Rozszerzenie CPL kadrowania wyświetlania" \InProcServer32\(Default) = "deskpan.dll" [file not found] "{5E2121EE-0300-11D4-8D3B-444553540000}" = "Catalyst Context Menu extension" -> {HKLM...CLSID} = "SimpleShlExt Class" \InProcServer32\(Default) = "C:\Program Files\ATI Technologies\ATI.ACE\atiacmxx.dll" [empty string] "{cc86590a-b60a-48e6-996b-41d25ed39a1e}" = "Portable Media Devices Menu" -> {HKLM...CLSID} = "Portable Media Devices Menu" \InProcServer32\(Default) = "C:\WINDOWS\system32\Audiodev.dll" [MS] "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" = "WinRAR shell extension" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] "{967B2D40-8B7D-4127-9049-61EA0C2C6DCE}" = "PowerISO" -> {HKLM...CLSID} = "PowerISO" \InProcServer32\(Default) = "C:\Program Files\PowerISO\PWRISOSH.DLL" ["PowerISO Computing, Inc."] "{42042206-2D85-11D3-8CFF-005004838597}" = "Microsoft Office HTML Icon Handler" -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "C:\PROGRA~1\Microsoft Office\OFFICE11\msohev.dll" [MS] "{AD392E40-428C-459F-961E-9B147782D099}" = "UltraISO" -> {HKLM...CLSID} = "UIContextMenu Class" \InProcServer32\(Default) = "C:\Program Files\UltraISO\isoshell.dll" ["EZB Systems, Inc."] "{B82D2E7F-B425-466A-B447-942771545628}" = "cm_Main" -> {HKLM...CLSID} = "FolderMarker menu extension" \InProcServer32\(Default) = "C:\PROGRA~1\Folder Marker\ShellExt.dll" ["ArcticLine Software"] "{B089FE88-FB52-11D3-BDF1-0050DA34150D}" = "NOD32 Context Menu Shell Extension" -> {HKLM...CLSID} = "NOD32 Context Menu Shell Extension" \InProcServer32\(Default) = "C:\Program Files\Eset\nodshex.dll" [null data] "{472083B0-C522-11CF-8763-00608CC02F24}" = "avast" -> {HKLM...CLSID} = "avast" \InProcServer32\(Default) = "C:\Program Files\Alwil Software\Avast4\ashShell.dll" ["ALWIL Software"] "{DDE4BEEB-DDE6-48fd-8EB5-035C09923F83}" = "UnlockerShellExtension" -> {HKLM...CLSID} = "UnlockerShellExtension" \InProcServer32\(Default) = "C:\Program Files\Unlocker\UnlockerCOM.dll" [null data] HKLM\Software\Microsoft\Windows NT\CurrentVersion\Windows\ "AppInit_DLLs" = (value not set) HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ <<!>> AtiExtEvent\DLLName = "Ati2evxx.dll" ["ATI Technologies Inc."] HKLM\Software\Classes\Folder\shellex\ColumnHandlers\ {F9DB5320-233E-11D1-9F84-707F02C10627}\(Default) = "PDF Column Info" -> {HKLM...CLSID} = "PDF Shell Extension" \InProcServer32\(Default) = "C:\Program Files\Adobe\Acrobat 7.0\ActiveX\PDFShell.dll" ["Adobe Systems, Inc."] HKLM\Software\Classes\*\shellex\ContextMenuHandlers\ avast\(Default) = "{472083B0-C522-11CF-8763-00608CC02F24}" -> {HKLM...CLSID} = "avast" \InProcServer32\(Default) = "C:\Program Files\Alwil Software\Avast4\ashShell.dll" ["ALWIL Software"] MagicISO\(Default) = "{DB85C504-C730-49DD-BEC1-7B39C6103B7A}" -> {HKLM...CLSID} = "MShellExtMenu Class" \InProcServer32\(Default) = "C:\Program Files\MagicISO\misosh.dll" ["MagicISO, Inc."] NOD32 Context Menu Shell Extension\(Default) = "{B089FE88-FB52-11D3-BDF1-0050DA34150D}" -> {HKLM...CLSID} = "NOD32 Context Menu Shell Extension" \InProcServer32\(Default) = "C:\Program Files\Eset\nodshex.dll" [null data] PowerISO\(Default) = "{967B2D40-8B7D-4127-9049-61EA0C2C6DCE}" -> {HKLM...CLSID} = "PowerISO" \InProcServer32\(Default) = "C:\Program Files\PowerISO\PWRISOSH.DLL" ["PowerISO Computing, Inc."] WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\ cm_Main\(Default) = "{B82D2E7F-B425-466A-B447-942771545628}" -> {HKLM...CLSID} = "FolderMarker menu extension" \InProcServer32\(Default) = "C:\PROGRA~1\Folder Marker\ShellExt.dll" ["ArcticLine Software"] MagicISO\(Default) = "{DB85C504-C730-49DD-BEC1-7B39C6103B7A}" -> {HKLM...CLSID} = "MShellExtMenu Class" \InProcServer32\(Default) = "C:\Program Files\MagicISO\misosh.dll" ["MagicISO, Inc."] PowerISO\(Default) = "{967B2D40-8B7D-4127-9049-61EA0C2C6DCE}" -> {HKLM...CLSID} = "PowerISO" \InProcServer32\(Default) = "C:\Program Files\PowerISO\PWRISOSH.DLL" ["PowerISO Computing, Inc."] UltraISO\(Default) = "{AD392E40-428C-459F-961E-9B147782D099}" -> {HKLM...CLSID} = "UIContextMenu Class" \InProcServer32\(Default) = "C:\Program Files\UltraISO\isoshell.dll" ["EZB Systems, Inc."] WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\ AAAAImageConvertContext\(Default) = "{C7E1EFC0-0C97-4F5C-81C4-790C9A299F8A}" -> {HKLM...CLSID} = "ConvertImageContext.clsContextMenu" \InProcServer32\(Default) = "C:\Program Files\Convert Image\ConvertImageContext.dll" ["SoftInterface, Inc. and Cypress Technology Solutions, Inc."] avast\(Default) = "{472083B0-C522-11CF-8763-00608CC02F24}" -> {HKLM...CLSID} = "avast" \InProcServer32\(Default) = "C:\Program Files\Alwil Software\Avast4\ashShell.dll" ["ALWIL Software"] MagicISO\(Default) = "{DB85C504-C730-49DD-BEC1-7B39C6103B7A}" -> {HKLM...CLSID} = "MShellExtMenu Class" \InProcServer32\(Default) = "C:\Program Files\MagicISO\misosh.dll" ["MagicISO, Inc."] NOD32 Context Menu Shell Extension\(Default) = "{B089FE88-FB52-11D3-BDF1-0050DA34150D}" -> {HKLM...CLSID} = "NOD32 Context Menu Shell Extension" \InProcServer32\(Default) = "C:\Program Files\Eset\nodshex.dll" [null data] PowerISO\(Default) = "{967B2D40-8B7D-4127-9049-61EA0C2C6DCE}" -> {HKLM...CLSID} = "PowerISO" \InProcServer32\(Default) = "C:\Program Files\PowerISO\PWRISOSH.DLL" ["PowerISO Computing, Inc."] UltraISO\(Default) = "{AD392E40-428C-459F-961E-9B147782D099}" -> {HKLM...CLSID} = "UIContextMenu Class" \InProcServer32\(Default) = "C:\Program Files\UltraISO\isoshell.dll" ["EZB Systems, Inc."] UnlockerShellExtension\(Default) = "{DDE4BEEB-DDE6-48fd-8EB5-035C09923F83}" -> {HKLM...CLSID} = "UnlockerShellExtension" \InProcServer32\(Default) = "C:\Program Files\Unlocker\UnlockerCOM.dll" [null data] WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] HKLM\Software\Classes\AllFilesystemObjects\shellex\ContextMenuHandlers\ AAAAImageConvertContext\(Default) = "{C7E1EFC0-0C97-4F5C-81C4-790C9A299F8A}" -> {HKLM...CLSID} = "ConvertImageContext.clsContextMenu" \InProcServer32\(Default) = "C:\Program Files\Convert Image\ConvertImageContext.dll" ["SoftInterface, Inc. and Cypress Technology Solutions, Inc."] UnlockerShellExtension\(Default) = "{DDE4BEEB-DDE6-48fd-8EB5-035C09923F83}" -> {HKLM...CLSID} = "UnlockerShellExtension" \InProcServer32\(Default) = "C:\Program Files\Unlocker\UnlockerCOM.dll" [null data] Group Policies {GPedit.msc branch and setting}: ----------------------------------------------- Note: detected settings may not have any effect. HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\ "MemCheckBoxInRunDlg" = (REG_DWORD) hex:0x00000000 {unrecognized setting} "NoStrCmpLogical" = (REG_DWORD) hex:0x00000000 {unrecognized setting} HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\ "NoChangeAnimation" = (REG_DWORD) hex:0x00000000 {unrecognized setting} "NoStrCmpLogical" = (REG_DWORD) hex:0x00000000 {unrecognized setting} HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\ "shutdownwithoutlogon" = (REG_DWORD) hex:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| Shutdown: Allow system to be shut down without having to log on} "undockwithoutlogon" = (REG_DWORD) hex:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| Devices: Allow undock without having to log on} "RunStartupScriptSync" = (REG_DWORD) hex:0x00000001 {unrecognized setting} Active Desktop and Wallpaper: ----------------------------- Active Desktop may be disabled at this entry: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState Displayed if Active Desktop enabled and wallpaper not set by Group Policy: HKCU\Software\Microsoft\Internet Explorer\Desktop\General\ "Wallpaper" = "C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp" Displayed if Active Desktop disabled and wallpaper not set by Group Policy: HKCU\Control Panel\Desktop\ "Wallpaper" = "C:\Documents and Settings\Rodzina\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp" Startup items in "Rodzina" & "All Users" startup folders: --------------------------------------------------------- C:\Documents and Settings\Rodzina\Menu Start\Programy\Autostart "ScreenHunter 4.0 Free" -> shortcut to: "C:\Program Files\Wisdom-soft ScreenHunter\ScreenHunter.exe" ["Wisdom Software Inc. "] Enabled Scheduled Tasks: ------------------------ "Rodzina backup" -> launches: "C:\Program Files\AMUST\Registry Cleaner\RegCleaner.exe -BACKUP" [file not found] "Rodzina scan and fix" -> launches: "C:\Program Files\AMUST\Registry Cleaner\RegCleaner.exe -SCANFIX" [file not found] Winsock2 Service Provider DLLs: ------------------------------- Namespace Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++} 000000000001\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS] 000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS] 000000000003\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS] 000000000004\LibraryPath = "C:\Program Files\Bonjour\mdnsNSP.dll" ["Apple Computer, Inc."] Transport Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++} 0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range: C:\WINDOWS\system32\imon.dll ["Eset "], 01 - 05, 24 %SystemRoot%\system32\mswsock.dll [MS], 06 - 08, 11 - 23 %SystemRoot%\system32\rsvpsp.dll [MS], 09 - 10 Toolbars, Explorer Bars, Extensions: ------------------------------------ Toolbars HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\ "{4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C}" -> {HKLM...CLSID} = "Megaupload Toolbar" \InProcServer32\(Default) = "C:\PROGRA~1\MegauploadToolbar\megauploadtoolbar.dll" ["MEGAUPLOAD "] "{2318C2B1-4965-11D4-9B18-009027A5CD4F}" -> {HKLM...CLSID} = "&Google" \InProcServer32\(Default) = "c:\program files\google\googletoolbar1.dll" ["Google Inc."] "{37B85A29-692B-4205-9CAD-2626E4993404}" -> {HKLM...CLSID} = "My Global Search Bar" \InProcServer32\(Default) = "C:\Program Files\MyGlobalSearch\bar\1.bin\MGSBAR.DLL" [file not found] HKLM\Software\Microsoft\Internet Explorer\Toolbar\ "{2318C2B1-4965-11D4-9B18-009027A5CD4F}" = (no title provided) -> {HKLM...CLSID} = "&Google" \InProcServer32\(Default) = "c:\program files\google\googletoolbar1.dll" ["Google Inc."] "{4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C}" = (no title provided) -> {HKLM...CLSID} = "Megaupload Toolbar" \InProcServer32\(Default) = "C:\PROGRA~1\MegauploadToolbar\megauploadtoolbar.dll" ["MEGAUPLOAD "] Extensions (Tools menu items, main toolbar menu buttons) HKLM\Software\Microsoft\Internet Explorer\Extensions\ {08B0E5C0-4FCB-11CF-AAA5-00401C608501}\ "MenuText" = "Sun Java Console" "CLSIDExtension" = "{CAFEEFAC-0016-0000-0002-ABCDEFFEDCBC}" -> {HKCU...CLSID} = "Java Plug-in 1.6.0_02" \InProcServer32\(Default) = "C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll" ["Sun Microsystems, Inc."] -> {HKLM...CLSID} = "Java Plug-in 1.6.0_02" \InProcServer32\(Default) = "C:\Program Files\Java\jre1.6.0_02\bin\npjpi160_02.dll" ["Sun Microsystems, Inc."] {0FD01980-CCCB-11D3-80D4-0000E80E2EDE}\ "ButtonText" = "Mass Downloader" "MenuText" = "&Mass Downloader" "Exec" = "C:\Program Files\Mass Downloader\massdown.exe" ["MetaProducts corp."] {77BF5300-1474-4EC7-9980-D32B190E9B07}\ "ButtonText" = "Skype" "CLSIDExtension" = "{77BF5300-1474-4EC7-9980-D32B190E9B07}" -> {HKLM...CLSID} = "Skype add-on (button)" \InProcServer32\(Default) = "C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll" ["Skype Technologies S.A."] Miscellaneous IE Hijack Points ------------------------------ HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks\ <<H>> "{08C06D61-F1F3-4799-86F8-BE1A89362C85}" = (no title provided) -> {HKLM...CLSID} = "Search Class" \InProcServer32\(Default) = "C:\PROGRA~1\NEOSTR~1\SEARCH~1.DLL" [empty string] HKLM\Software\Microsoft\Internet Explorer\AboutURLs\ <<H>> "Tabs" = "C:\Documents and Settings\Rodzina\Dane aplikacji\MEGAUPLOADTOOLBAR\tabwelcome.html" [null data] Running Services (Display Name, Service Name, Path {Service DLL}): ------------------------------------------------------------------ ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762##, Bonjour Service, ""C:\Program Files\Bonjour\mDNSResponder.exe"" ["Apple Computer, Inc."] avast! Antivirus, avast! Antivirus, ""C:\Program Files\Alwil Software\Avast4\ashServ.exe"" [null data] avast! iAVS4 Control Service, aswUpdSv, ""C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe"" [null data] avast! Mail Scanner, avast! Mail Scanner, ""C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service" ["ALWIL Software"] avast! Web Scanner, avast! Web Scanner, ""C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service" ["ALWIL Software"] C-DillaCdaC11BA, C-DillaCdaC11BA, "C:\WINDOWS\system32\drivers\CDAC11BA.EXE" ["Macrovision"] Windows User Mode Driver Framework, UMWdf, "C:\WINDOWS\system32\wdfmgr.exe" [MS] ---------- (launch time: 2007-11-04 21:07:10) <<!>>: Suspicious data at a malware launch point. <<H>>: Suspicious data at a browser hijack point. + This report excludes default entries except where indicated. + To see *everywhere* the script checks and *everything* it finds, launch it from a command prompt or a shortcut with the -all parameter. + The search for DESKTOP.INI DLL launch points on all local fixed drives took 205 seconds. ---------- (total run time: 259 seconds)

HijackThis:

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 21:04:29, on 2007-11-04 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\SOUNDMAN.EXE C:\program files\zte corporation\zxdsl852\CnxDslTb.exe C:\Program Files\ATI Technologies\ATI.ACE\CLI.EXE C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe D:\Program Files\Kalendarz XP\Kalendarz.exe C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\Program Files\Gadu-Gadu\gg.exe C:\Program Files\Wisdom-soft ScreenHunter\ScreenHunter.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\WINDOWS\system32\drivers\CDAC11BA.EXE C:\WINDOWS\system32\wscntfy.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\Program Files\ATI Technologies\ATI.ACE\cli.exe C:\Program Files\ATI Technologies\ATI.ACE\cli.exe C:\PROGRA~1\NEOSTR~1\NeostradaTP.exe C:\PROGRA~1\NEOSTR~1\ComComp.exe C:\PROGRA~1\NEOSTR~1\Watch.exe C:\WINDOWS\explorer.exe C:\WINDOWS\system32\notepad.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Documents and Settings\Rodzina\Pulpit\Gry i foty\HiJackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.wp.pl R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\NEOSTR~1\SEARCH~1.DLL O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll O2 - BHO: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MegauploadToolbar\megauploadtoolbar.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll O3 - Toolbar: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MegauploadToolbar\megauploadtoolbar.dll O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe" O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [CnxDslTaskBar] "c:\program files\zte corporation\zxdsl852\CnxDslTb.exe" "ZTE Corporation\ZXDSL852" O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\NEOSTR~1\Watch.exe O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe O4 - HKLM\..\Run: [Kalendarz XP] "D:\Program Files\Kalendarz XP\Kalendarz.exe" O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" O4 - HKLM\..\Run: [PWRISOVM.EXE] C:\Program Files\PowerISO\PWRISOVM.EXE O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UpdateService\ISUSPM.exe -startup O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033 O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-19\..\RunOnce: [nltide3] cmd.exe /C rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-20\..\RunOnce: [nltide3] cmd.exe /C rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\S-1-5-18\..\RunOnce: [nltide3] cmd.exe /C rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - HKUS\.DEFAULT\..\RunOnce: [nltide3] cmd.exe /C rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'Default user') O4 - Startup: ScreenHunter 4.0 Free.lnk = C:\Program Files\Wisdom-soft ScreenHunter\ScreenHunter.exe O8 - Extra context menu item: Pobierz &Wszystko używając Mass Downloader'a - C:\Program Files\Mass Downloader\Add_All.htm O8 - Extra context menu item: Pobierz używając &Mass Downloader'a - C:\Program Files\Mass Downloader\Add_Url.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll O9 - Extra button: Mass Downloader - {0FD01980-CCCB-11D3-80D4-0000E80E2EDE} - C:\Program Files\Mass Downloader\massdown.exe O9 - Extra 'Tools' menuitem: &Mass Downloader - {0FD01980-CCCB-11D3-80D4-0000E80E2EDE} - C:\Program Files\Mass Downloader\massdown.exe O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - http://www.systemrequirementslab.com/sysreqlab2.cab O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} (get_atlcom Class) - http://www.adobe.com/products/acrobat/nos/gp.cab O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C1} (GameDesire Pool 8) - http://67.15.101.33/g_bin/pl/billard8_2_0_0_35.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{6B88F40A-A07A-4048-8843-4D30009EDC13}: NameServer = 194.204.159.1 217.98.63.164 O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\system32\drivers\CDAC11BA.EXE O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe O23 - Service: IEAgentSvc - Unknown owner - C:\Documents and Settings\Rodzina\Pulpit\KaBOOM\IEAgentSvc.exe (file missing) O23 - Service: ipfw_helper (ipfw) - Unknown owner - C:\Program Files\MCS Studios\MCS Firewall 6\system\ipfw.exe (file missing) -- End of file - 8053 bytes

ComboFix:

Kod: Zaznacz wszystko: ComboFix 07-11-01.1 - Rodzina 2007-11-04 20:56:16.4 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.152 [GMT 1:00] Running from: C:\Documents and Settings\Rodzina\Pulpit\ComboFix.exe * Created a new restore point . ((((((((((((((((((((((((( Files Created from 2007-10-04 to 2007-11-04 ))))))))))))))))))))))))))))))) . 2007-10-29 19:59 <DIR> d-------- C:\Documents and Settings\Rodzina\Dane aplikacji\dvdcss 2007-10-27 14:17 <DIR> d-------- C:\Documents and Settings\Bracia\Dane aplikacji\vlc 2007-10-27 13:55 <DIR> d-------- C:\Documents and Settings\Bracia\Dane aplikacji\dvdcss 2007-10-26 12:45 98,304 --a------ C:\WINDOWS\system32\CmdLineExt.dll 2007-10-21 17:09 624,640 --a------ C:\WINDOWS\system32\aswBoot.exe 2007-10-21 17:09 90,112 --a------ C:\WINDOWS\system32\AVASTSS.scr 2007-10-21 17:09 87,424 --a------ C:\WINDOWS\system32\drivers\aswmon2.sys 2007-10-21 17:09 85,760 --a------ C:\WINDOWS\system32\drivers\aswmon.sys 2007-10-21 17:09 36,176 --a------ C:\WINDOWS\system32\drivers\aswTdi.sys 2007-10-21 17:09 24,304 --a------ C:\WINDOWS\system32\drivers\aavmker4.sys 2007-10-21 17:09 16,352 --a------ C:\WINDOWS\system32\drivers\aswRdr.sys 2007-10-21 16:48 512,096 --a------ C:\WINDOWS\system32\drivers\amon.sys 2007-10-21 16:48 298,104 --a------ C:\WINDOWS\system32\imon.dll 2007-10-21 16:48 15,424 --a------ C:\WINDOWS\system32\drivers\nod32drv.sys 2007-10-21 14:30 <DIR> d-------- C:\Documents and Settings\Bracia\Dane aplikacji\Ashampoo 2007-10-21 12:24 <DIR> d-------- C:\Documents and Settings\Bracia\Dane aplikacji\Media Player Classic 2007-10-17 16:19 <DIR> d-------- C:\Documents and Settings\Rodzina\Dane aplikacji\Ashampoo 2007-10-17 16:19 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\ashampoo 2007-10-17 16:18 <DIR> d-------- C:\WINDOWS\system32\ebay 2007-10-17 16:18 <DIR> d-------- C:\Program Files\Ashampoo 2007-10-15 22:19 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Eset 2007-10-15 22:13 <DIR> d-------- C:\WINDOWS\system32\xircom 2007-10-15 22:13 <DIR> d-------- C:\Program Files\microsoft frontpage 2007-10-15 22:02 <DIR> d-------- C:\WINDOWS\ERUNT 2007-10-15 20:24 51,200 --a------ C:\WINDOWS\NirCmd.exe 2007-10-15 17:19 <DIR> d-------- C:\Documents and Settings\Rodzina\Dane aplikacji\vlc 2007-10-15 17:16 <DIR> d-------- C:\Program Files\VideoLAN 2007-10-12 14:02 <DIR> d-------- C:\Documents and Settings\Rodzina\Dane aplikacji\Nero 2007-10-12 14:01 3,036,456 --a------ C:\WINDOWS\system32\BCGCBPRO860u80.dll 2007-10-12 14:01 1,757,184 --a------ C:\WINDOWS\system32\imagX7.dll 2007-10-12 14:01 802,816 --a------ C:\WINDOWS\system32\imagXRA7.dll 2007-10-12 14:01 497,296 --a------ C:\WINDOWS\system32\imagXpr7.dll 2007-10-12 14:01 368,640 --a------ C:\WINDOWS\system32\TwnLib4.dll 2007-10-12 14:01 258,048 --a------ C:\WINDOWS\system32\imagXR7.dll 2007-10-12 14:01 33,576 --a------ C:\WINDOWS\system32\BCGPOleAcc.dll 2007-10-10 16:44 <DIR> d-------- C:\Program Files\rFactor 2007-10-10 15:31 <DIR> d-------- C:\Program Files\Team17 2007-10-09 17:40 <DIR> d-------- C:\Program Files\Folder Marker 2007-10-08 18:53 <DIR> d-------- C:\Program Files\PAN Vision 2007-10-06 18:51 <DIR> d-------- C:\Documents and Settings\Bracia\Dane aplikacji\Corel 2007-10-06 09:22 <DIR> d-------- C:\Program Files\Gotham Games 2007-10-05 15:17 <DIR> d-------- C:\Documents and Settings\Rodzina\Dane aplikacji\Corel 2007-10-05 15:17 56 -r-hs---- C:\WINDOWS\system32\549F1AD54E.sys 2007-10-05 15:16 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\InstallShield 2007-10-05 15:15 <DIR> d-------- C:\Program Files\Common Files\Corel 2007-10-05 15:12 3,350 --ahs---- C:\WINDOWS\system32\KGyGaAvL.sys 2007-10-05 15:10 <DIR> d-------- C:\Program Files\Corel 2007-10-05 14:02 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\FLEXnet 2007-10-05 13:58 <DIR> d-------- C:\Program Files\Bonjour . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2007-11-04 18:54 --------- d-----w C:\Program Files\Neostrada TP 2007-11-03 21:06 --------- d-----w C:\Documents and Settings\Bracia\Dane aplikacji\Azureus 2007-11-03 15:48 --------- d-----w C:\Program Files\Counter-Strike 1.6 2007-11-01 08:51 --------- d-----w C:\Documents and Settings\Rodzina\Dane aplikacji\Azureus 2007-10-28 13:04 --------- d-----w C:\Program Files\TrackMania Nations ESWC 2007-10-26 11:46 --------- d-----w C:\Program Files\Rockstar Games 2007-10-26 11:37 --------- d--h--w C:\Program Files\InstallShield Installation Information 2007-10-25 16:37 --------- d-----w C:\Program Files\Gadu-Gadu 2007-10-16 08:59 --------- d-----w C:\Program Files\PowerISO 2007-10-12 19:43 --------- d-----w C:\Program Files\sXe Injected 2007-10-12 13:02 --------- d-----w C:\Program Files\Nero 2007-10-12 12:55 --------- d-----w C:\Program Files\Common Files\Ahead 2007-10-12 12:54 --------- d-----w C:\Documents and Settings\Rodzina\Dane aplikacji\Ahead 2007-10-11 15:17 --------- d-----w C:\Program Files\IsoBuster 2007-10-06 16:53 --------- d-----w C:\Program Files\Azureus 2007-10-05 14:15 --------- d-----w C:\Program Files\Common Files\InstallShield 2007-10-05 13:00 --------- d-----w C:\Program Files\Common Files\Adobe 2007-10-05 12:48 --------- d-----w C:\Program Files\Common Files\Macrovision Shared 2007-10-01 15:39 --------- d-----w C:\Documents and Settings\Bracia\Dane aplikacji\AdobeUM 2007-09-30 14:05 --------- d-----w C:\Program Files\DivX 2007-09-30 14:03 --------- d-----w C:\Documents and Settings\Rodzina\Dane aplikacji\DivX 2007-09-21 15:19 --------- d-----w C:\Program Files\Halflife Logo Creator 2007-09-19 06:12 --------- d-----w C:\Program Files\Grupa IMAGE 2007-09-18 07:10 --------- d-----w C:\Program Files\Pivot Stickfigure Animator 2007-09-16 10:59 --------- d-----w C:\Program Files\Sega Sonic Riders 2007-09-15 12:29 --------- d-----w C:\Documents and Settings\Bracia\Dane aplikacji\DivX 2007-09-15 12:10 --------- d-----w C:\Program Files\MarBit 2007-09-14 15:49 --------- d-----w C:\Program Files\AMD 2007-09-12 09:59 --------- d-----w C:\Documents and Settings\Bracia\Dane aplikacji\GanymedeNet 2007-09-10 15:33 --------- d-----w C:\Program Files\SubEdit-Player 2007-09-09 13:58 --------- d-----w C:\Program Files\MagicISO 2007-09-07 13:45 --------- d-----w C:\Documents and Settings\Rodzina\Dane aplikacji\MegauploadToolbar 2007-09-04 08:33 --------- d-----w C:\Program Files\City Interactive 2007-08-18 08:59 73,216 ----a-w C:\WINDOWS\ST6UNST.EXE 2007-08-18 08:59 249,856 ------w C:\WINDOWS\Setup1.exe 2007-08-08 10:13 77,824 ----a-w C:\WINDOWS\system32\IESHWIZ.EXE 2007-08-08 09:11 587,725 ----a-w C:\WINDOWS\bad_kitty.exe 2007-08-08 09:11 40,960 ----a-w C:\WINDOWS\bad_kitty.dll 2007-08-08 09:11 231,328 ----a-w C:\WINDOWS\bad_kitty.scr 2006-02-06 07:53:55 8 --sha-r C:\WINDOWS\neoqaz2.dll . ((((((((((((((((((((((((((((( snapshot@2007-10-15_21.32.16.93 ))))))))))))))))))))))))))))))))))))))))) . - 2007-09-28 07:06:08 135,168 ----a-w C:\WINDOWS\catchme.exe + 2007-10-29 17:56:19 136,192 ----a-w C:\WINDOWS\catchme.exe + 2007-10-15 17:33:08 163,328 ----a-w C:\WINDOWS\ERUNT\SDFIX\ERDNT.EXE + 2007-10-15 21:03:40 708,608 ----a-w C:\WINDOWS\ERUNT\SDFIX\Users\[u]0[/u]0000001\NTUSER.DAT + 2007-10-15 21:03:40 8,192 ----a-w C:\WINDOWS\ERUNT\SDFIX\Users\[u]0[/u]0000002\UsrClass.dat + 2007-10-15 17:33:08 163,328 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\ERDNT.EXE + 2007-10-15 21:03:14 708,608 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\Users\[u]0[/u]0000001\NTUSER.DAT + 2007-10-15 21:03:15 8,192 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\Users\[u]0[/u]0000002\UsrClass.dat + 2006-10-27 10:10:48 516,832 ----a-w C:\WINDOWS\system32\CapiCom.dll + 2007-11-01 16:12:16 16,384 ----atw C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\temp\Perflib_Perfdata_124.dat + 2007-11-01 17:58:33 16,384 ----atw C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\temp\Perflib_Perfdata_13c.dat + 2007-11-03 17:59:04 16,384 ----atw C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\temp\Perflib_Perfdata_140.dat + 2007-10-23 13:26:49 16,384 ----atw C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\temp\Perflib_Perfdata_604.dat + 2007-10-23 07:09:21 16,384 ----atw C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\temp\Perflib_Perfdata_608.dat + 2007-10-31 15:34:42 16,384 ----atw C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\temp\Perflib_Perfdata_610.dat + 2007-11-01 20:12:00 16,384 ----atw C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\temp\Perflib_Perfdata_614.dat + 2007-11-04 08:19:40 16,384 ----atw C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\temp\Perflib_Perfdata_6a4.dat + 2007-10-31 08:07:11 16,384 ----atw C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\temp\Perflib_Perfdata_700.dat + 2007-10-27 07:26:26 16,384 ----atw C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\temp\Perflib_Perfdata_704.dat + 2007-10-28 06:11:19 16,384 ----atw C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\temp\Perflib_Perfdata_70c.dat + 2007-11-01 06:48:29 16,384 ----atw C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\temp\Perflib_Perfdata_770.dat + 2007-11-04 18:53:50 16,384 ----atw C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\temp\Perflib_Perfdata_7ec.dat + 2007-10-24 06:37:00 16,384 ----atw C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\temp\Perflib_Perfdata_7f4.dat + 2007-10-25 17:16:12 16,384 ----atw C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\temp\Perflib_Perfdata_7f8.dat + 2007-10-25 13:07:19 16,384 ----atw C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\temp\Perflib_Perfdata_7fc.dat + 2007-11-04 18:43:18 16,384 ----atw C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\temp\Perflib_Perfdata_c0.dat + 2007-10-29 13:37:22 16,384 ----atw C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\temp\Perflib_Perfdata_c4.dat + 2007-07-11 23:22:00 135,168 ----a-w C:\WINDOWS\system32\java.exe + 2007-07-11 23:22:04 135,168 ----a-w C:\WINDOWS\system32\javaw.exe + 2007-07-12 00:22:38 139,264 ----a-w C:\WINDOWS\system32\javaws.exe - 2007-08-17 17:20:39 58,732 ----a-w C:\WINDOWS\system32\perfc009.dat + 2007-10-28 06:12:31 58,732 ----a-w C:\WINDOWS\system32\perfc009.dat - 2007-08-17 17:20:39 74,450 ----a-w C:\WINDOWS\system32\perfc015.dat + 2007-10-28 06:12:31 74,450 ----a-w C:\WINDOWS\system32\perfc015.dat - 2007-08-17 17:20:39 392,432 ----a-w C:\WINDOWS\system32\perfh009.dat + 2007-10-28 06:12:31 392,432 ----a-w C:\WINDOWS\system32\perfh009.dat - 2007-08-17 17:20:39 448,348 ----a-w C:\WINDOWS\system32\perfh015.dat + 2007-10-28 06:12:31 448,348 ----a-w C:\WINDOWS\system32\perfh015.dat - 2007-10-05 08:07:31 279,552 ----a-w C:\WINDOWS\system32\swreg.exe + 2007-07-22 17:39:27 279,552 ----a-w C:\WINDOWS\system32\swreg.exe + 2005-11-21 12:39:00 565,248 ------w C:\WINDOWS\Web\Wallpaper\Living Marine Aquarium 2.0 Animated Wallpaper\Direct3DComponent.dll . -- Snapshot reset to current date -- . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ATICCC"="C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe" [2006-05-10 10:12] "SoundMan"="SOUNDMAN.EXE" [2006-11-17 05:42 C:\WINDOWS\soundman.exe] "CnxDslTaskBar"="c:\program files\zte corporation\zxdsl852\CnxDslTb.exe" [2005-07-21 19:52] "WOOWATCH"="C:\PROGRA~1\NEOSTR~1\Watch.exe" [2005-07-21 07:33] "WOOTASKBARICON"="C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe" [2005-07-21 07:33] "Kalendarz XP"="D:\Program Files\Kalendarz XP\Kalendarz.exe" [2007-05-06 16:41] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" [2007-07-12 03:00] "PWRISOVM.EXE"="C:\Program Files\PowerISO\PWRISOVM.EXE" [] "ISUSPM Startup"="C:\PROGRA~1\COMMON~1\INSTAL~1\UpdateService\ISUSPM.exe" [2004-06-16 05:03] "ISUSScheduler"="C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [2004-06-16 05:03] "DAEMON Tools-1033"="C:\Program Files\D-Tools\daemon.exe" [2004-08-22 16:05] "avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2006-05-31 11:02] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" [] "Gadu-Gadu"="C:\Program Files\Gadu-Gadu\gg.exe" [2007-05-10 15:36] [HKEY_USERS\.default\software\microsoft\windows\currentversion\runonce] "nltide3"=cmd.exe /C rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N C:\Documents and Settings\Rodzina\Menu Start\Programy\Autostart\ ScreenHunter 4.0 Free.lnk - C:\Program Files\Wisdom-soft ScreenHunter\ScreenHunter.exe [2007-08-25 13:05:24] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "RunStartupScriptSync"=1 (0x1) [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer] "NoChangeAnimation"=0 (0x0) "NoStrCmpLogical"=0 (0x0) [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] "MemCheckBoxInRunDlg"=0 (0x0) "NoStrCmpLogical"=0 (0x0) [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MCS Firewall 6] C:\Program Files\MCS Studios\MCS Firewall 6\mcsfw.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCPerf] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\sXe Injected] C:\Program Files\sXe Injected\sXe Injected.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent] C:\Program Files\Winamp\winampa.exe R3 CnxEtP;ZTE ZXDSL852 Adapter Filter Driver;C:\WINDOWS\system32\DRIVERS\CnxEtP.sys R3 CnxEtU;ZTE ZXDSL852 Interface Device Driver;C:\WINDOWS\system32\DRIVERS\CnxEtU.sys R3 CnxTgNW;ZTE ZXDSL852 WAN PPPoA Adapter Driver;C:\WINDOWS\system32\DRIVERS\CnxTgNW.sys S2 IEAgentSvc;IEAgentSvc;C:\Documents and Settings\Rodzina\Pulpit\KaBOOM\IEAgentSvc.exe S2 ipfw;ipfw_helper;C:\Program Files\MCS Studios\MCS Firewall 6\system\ipfw.exe S3 ip_fw;ipfw kernel-mode driver;\??\C:\Program [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] LocalService WebClient LmHosts RemoteRegistry upnphost SSDPSRV . Contents of the 'Scheduled Tasks' folder "2007-09-14 23:00:00 C:\WINDOWS\Tasks\Rodzina backup.job" - C:\Program Files\AMUST\Registry Cleaner\RegCleaner.exe "2007-07-20 23:20:00 C:\WINDOWS\Tasks\Rodzina scan and fix.job" - C:\Program Files\AMUST\Registry Cleaner\RegCleaner.exe . ************************************************************************** catchme 0.3.1250 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-11-04 21:00:58 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2007-11-04 21:01:41 . --- E O F ---

**Posty:** 18165 · przez **wojtas** 05 Lis 2007, 17:04

czysto

neo strasznie wolno chodzi

neo strasznie wolno chodzi

Kto jest na forum