prosba o sprawdzenie loga

**Posty:** 84 · przez **zooo** 27 Cze 2007, 15:01

Witam!!! Problem polega na tym ze moj komp sie strasznie dlugo odpala.
I w zwiazku z tym mam pytanko czy system jest czysty?
Z gory wiekie dzieki za pomoc.

Oto logi:

1.HijackThis

Kod: Zaznacz wszystko: Logfile of HijackThis v1.99.1 Scan saved at 14:23:43, on 2007-06-27 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\CTsvcCDA.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\MsPMSPSv.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\CTHELPER.EXE C:\WINDOWS\system32\RunDLL32.exe C:\WINDOWS\system32\rundll32.exe C:\Program Files\Common Files\Symantec Shared\ccApp.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\DAEMON Tools\daemon.exe C:\Program Files\Logitech\SetPoint\SetPoint.exe C:\Program Files\SAGEM WiFi manager\WLANUTL.exe C:\Program Files\Common Files\Logitech\khalshared\KHALMNPR.EXE C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe C:\Program Files\Internet Explorer\iexplore.exe C:\WINDOWS\System32\WScript.exe E:\dodatki\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.onet.pl/ R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.onet.pl/ R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O1 - Hosts: 69.80.225.31 nprotect.ryl.com.my O1 - Hosts: 72.52.163.100 nprotect.battlelands.net O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O2 - BHO: BHOAd - {85589B5D-D53D-4237-A677-46B82EA275F3} - C:\WINDOWS\xmlhelper2.dll O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll O4 - HKLM\..\Run: [WINDVDPatch] CTHELPER.EXE O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [NAV Agent] C:\PROGRA~1\NORTON~1\navapw32.exe O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" O4 - HKLM\..\Run: [CloneCDTray] "C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe" /s O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton AntiVirus\osCheck.exe" O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll" O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033 O4 - Global Startup: Logitech SetPoint.lnk = ? O4 - Global Startup: Program sieciowy dla SAGEM Wi-Fi 11g USB adapter.lnk = ? O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} - http://go.microsoft.com/fwlink/?linkid=58813 O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.pl/resources/virusscanner/kavwebscan_unicode.cab O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1173383578687 O16 - DPF: {68282C51-9459-467B-95BF-3C0E89627E55} (MainControl Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: Symantec Event Manager (ccEvtMgr) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing) O23 - Service: Symantec Settings Manager (ccSetMgr) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing) O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing) O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe O23 - Service: Harmonogram automatycznej usługi LiveUpdate - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe O23 - Service: Symantec IS Password Validation (ISPwdSvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\isPwdSvc.exe O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing) O23 - Service: LiveUpdate Notice Service - Unknown owner - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PifEng.dll (file missing) O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe

2.Silent Runners

Kod: Zaznacz wszystko: "Silent Runners.vbs", revision 46, http://www.silentrunners.org/ Operating System: Windows XP SP2 Output limited to non-default values, except where indicated by "{++}" Startup items buried in registry: --------------------------------- HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++} "CTFMON.EXE" = "C:\WINDOWS\system32\ctfmon.exe" [MS] "DAEMON Tools" = ""C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033" ["DT Soft Ltd."] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++} "WINDVDPatch" = "CTHELPER.EXE" ["Creative Technology Ltd"] "NvCplDaemon" = "RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup" [MS] "nwiz" = "nwiz.exe /install" ["NVIDIA Corporation"] "NvMediaCenter" = "RunDLL32.exe NvMCTray.dll,NvTaskbarInit" [MS] "NAV Agent" = "C:\PROGRA~1\NORTON~1\navapw32.exe" [file not found] "RemoteControl" = ""C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"" [file not found] "CloneCDTray" = ""C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe" /s" [file not found] "NWEReboot" = (empty string) "Kernel and Hardware Abstraction Layer" = "KHALMNPR.EXE" ["Logitech Inc."] "Logitech Hardware Abstraction Layer" = "KHALMNPR.EXE" ["Logitech Inc."] "ccApp" = ""C:\Program Files\Common Files\Symantec Shared\ccApp.exe"" ["Symantec Corporation"] "osCheck" = ""C:\Program Files\Norton AntiVirus\osCheck.exe"" ["Symantec Corporation"] "Symantec PIF AlertEng" = ""C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"" ["Symantec Corporation"] HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\(Default) = (no title provided) -> {HKLM...CLSID} = "Adobe PDF Reader Link Helper" \InProcServer32\(Default) = "C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll" ["Adobe Systems Incorporated"] {53707962-6F74-2D53-2644-206D7942484F}\(Default) = (no title provided) -> {HKLM...CLSID} = "Spybot-S&D IE Protection" \InProcServer32\(Default) = "C:\PROGRA~1\SPYBOT~1\SDHelper.dll" ["Safer Networking Limited"] {761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\(Default) = (no title provided) -> {HKLM...CLSID} = "SSVHelper Class" \InProcServer32\(Default) = "C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll" ["Sun Microsystems, Inc."] {85589B5D-D53D-4237-A677-46B82EA275F3}\(Default) = "BHOAd" -> {HKLM...CLSID} = "XML Helper" \InProcServer32\(Default) = "C:\WINDOWS\xmlhelper2.dll" [null data] {9030D464-4C02-4ABF-8ECC-5164760863C6}\(Default) = (no title provided) -> {HKLM...CLSID} = "Windows Live Sign-in Helper" \InProcServer32\(Default) = "C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll" [MS] {BDF3E430-B101-42AD-A544-FADC6B084872}\(Default) = "NAV Helper" -> {HKLM...CLSID} = "CNavExtBho Class" \InProcServer32\(Default) = "C:\Program Files\Norton AntiVirus\NavShExt.dll" ["Symantec Corporation"] HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\ "{42071714-76d4-11d1-8b24-00a0c9068ff3}" = "Rozszerzenie CPL kadrowania wyświetlania" -> {HKLM...CLSID} = "Rozszerzenie CPL kadrowania wyświetlania" \InProcServer32\(Default) = "deskpan.dll" [file not found] "{88895560-9AA2-1069-930E-00AA0030EBC8}" = "Rozszerzenie ikony HyperTerminalu" -> {HKLM...CLSID} = "HyperTerminal Icon Ext" \InProcServer32\(Default) = "C:\WINDOWS\system32\hticons.dll" ["Hilgraeve, Inc."] "{A70C977A-BF00-412C-90B7-034C51DA2439}" = "NvCpl DesktopContext Class" -> {HKLM...CLSID} = "DesktopContext Class" \InProcServer32\(Default) = "C:\WINDOWS\system32\nvcpl.dll" ["NVIDIA Corporation"] "{FFB699E0-306A-11d3-8BD1-00104B6F7516}" = "Play on my TV helper" -> {HKLM...CLSID} = "NVIDIA CPL Extension" \InProcServer32\(Default) = "C:\WINDOWS\system32\nvcpl.dll" ["NVIDIA Corporation"] "{1CDB2949-8F65-4355-8456-263E7C208A5D}" = "Desktop Explorer" -> {HKLM...CLSID} = "Desktop Explorer" \InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"] "{1E9B04FB-F9E5-4718-997B-B8DA88302A47}" = "Desktop Explorer Menu" -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"] "{1E9B04FB-F9E5-4718-997B-B8DA88302A48}" = "nView Desktop Context Menu" -> {HKLM...CLSID} = "nView Desktop Context Menu" \InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"] "{E0D79304-84BE-11CE-9641-444553540000}" = "WinZip" -> {HKLM...CLSID} = "WinZip" \InProcServer32\(Default) = "C:\PROGRA~1\WINZIP\WZSHLSTB.DLL" ["WinZip Computing LP"] "{E0D79305-84BE-11CE-9641-444553540000}" = "WinZip" -> {HKLM...CLSID} = "WinZip" \InProcServer32\(Default) = "C:\PROGRA~1\WINZIP\WZSHLSTB.DLL" ["WinZip Computing LP"] "{E0D79306-84BE-11CE-9641-444553540000}" = "WinZip" -> {HKLM...CLSID} = "WinZip" \InProcServer32\(Default) = "C:\PROGRA~1\WINZIP\WZSHLSTB.DLL" ["WinZip Computing LP"] "{E0D79307-84BE-11CE-9641-444553540000}" = "WinZip" -> {HKLM...CLSID} = "WinZip" \InProcServer32\(Default) = "C:\PROGRA~1\WINZIP\WZSHLSTB.DLL" ["WinZip Computing LP"] "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" = "WinRAR shell extension" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] "{721A1B24-EC8B-4eda-9CCE-39720B9FA747}" = "WipeExt" -> {HKLM...CLSID} = "WipeExt" \InProcServer32\(Default) = "C:\Program Files\Ace Utilities\wipext.dll" [null data] "{73B24247-042E-4EF5-ADC2-42F62E6FD654}" = "ICQ Lite Shell Extension" -> {HKLM...CLSID} = "MCLiteShellExt Class" \InProcServer32\(Default) = "C:\Program Files\ICQLite\ICQLiteShell.dll" [empty string] "{e82a2d71-5b2f-43a0-97b8-81be15854de8}" = "ShellLink for Application References" -> {HKLM...CLSID} = "ShellLink for Application References" \InProcServer32\(Default) = "C:\WINDOWS\system32\dfshim.dll" [MS] "{E37E2028-CE1A-4f42-AF05-6CEABC4E5D75}" = "Shell Icon Handler for Application References" -> {HKLM...CLSID} = "Shell Icon Handler for Application References" \InProcServer32\(Default) = "C:\WINDOWS\system32\dfshim.dll" [MS] "{45670FA8-ED97-4F44-BC93-305082590BFB}" = "Microsoft.XPS.Shell.Metadata.1" -> {HKLM...CLSID} = "Windows XPS Document Metadata Handler" \InProcServer32\(Default) = "C:\WINDOWS\System32\XPSSHHDR.DLL" [MS] "{44121072-A222-48f2-A58A-6D9AD51EBBE9}" = "Microsoft.XPS.Shell.Thumbnail.1" -> {HKLM...CLSID} = "Windows XPS Document Thumbnail Handler" \InProcServer32\(Default) = "C:\WINDOWS\System32\XPSSHHDR.DLL" [MS] "{63AFBDFB-5EF8-4791-AF79-9A3C0DE48974}" = "EditPlus Context Menu Handler" -> {HKLM...CLSID} = "EditPlus Context Menu Handler" \InProcServer32\(Default) = "C:\Program Files\EditPlus 2\eppshell.dll" [null data] "{B95713CD-06FF-4D35-A9DA-4DBDFE5FD7F4}" = "Hex Editor Shell Extension" -> {HKLM...CLSID} = "ShellExt Class" \InProcServer32\(Default) = "C:\Program Files\HHD Software\Hex Editor 3.x\heshell.dll" ["HHD Software"] "{FC9FB64A-1EB2-4CCF-AF5E-1A497A9B5C2D}" = "Messenger Sharing Folders" -> {HKLM...CLSID} = "Moje foldery udostępniania" \InProcServer32\(Default) = "C:\Program Files\MSN Messenger\fsshext.8.1.0178.00.dll" [MS] "{00020D75-0000-0000-C000-000000000046}" = "Microsoft Office Outlook Desktop Icon Handler" -> {HKLM...CLSID} = "Microsoft Office Outlook" \InProcServer32\(Default) = "C:\PROGRA~1\MICROS~3\OFFICE11\MLSHEXT.DLL" [MS] "{0006F045-0000-0000-C000-000000000046}" = "Microsoft Office Outlook Custom Icon Handler" -> {HKLM...CLSID} = "Rozszerzenie ikon plików programu Outlook" \InProcServer32\(Default) = "C:\PROGRA~1\MICROS~3\OFFICE11\OLKFSTUB.DLL" [MS] "{42042206-2D85-11D3-8CFF-005004838597}" = "Microsoft Office HTML Icon Handler" -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "C:\Program Files\Microsoft Office\OFFICE11\msohev.dll" [MS] "{993BE281-6695-4BA5-8A2A-7AACBFAAB69E}" = "Microsoft Office Metadata Handler" -> {HKLM...CLSID} = "Microsoft Office Metadata Handler" \InProcServer32\(Default) = "C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\msoshext.dll" [MS] "{C41662BB-1FA0-4CE0-8DC5-9B7F8279FF97}" = "Microsoft Office Thumbnail Handler" -> {HKLM...CLSID} = "Microsoft Office Thumbnail Handler" \InProcServer32\(Default) = "C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\msoshext.dll" [MS] "{640167b4-59b0-47a6-b335-a6b3c0695aea}" = "Portable Media Devices" -> {HKLM...CLSID} = "Portable Media Devices" \InProcServer32\(Default) = "C:\WINDOWS\system32\Audiodev.dll" [MS] "{cc86590a-b60a-48e6-996b-41d25ed39a1e}" = "Portable Media Devices Menu" -> {HKLM...CLSID} = "Portable Media Devices Menu" \InProcServer32\(Default) = "C:\WINDOWS\system32\Audiodev.dll" [MS] "{DC70C4A5-2044-4c59-B806-DEFB9AE0DF7C}" = "Logitech Setpoint Extension" -> {HKLM...CLSID} = "KbLogiExt Class" \InProcServer32\(Default) = "C:\Program Files\Logitech\SetPoint\kbcplext.dll" ["Logitech Inc."] "{B9B9F083-2B04-452A-8691-83694AC1037B}" = "Logitech Setpoint Extension" -> {HKLM...CLSID} = "LogiExt Class" \InProcServer32\(Default) = "C:\Program Files\Logitech\SetPoint\mcplext.dll" ["Logitech Inc."] HKLM\Software\Classes\PROTOCOLS\Filter\ INFECTION WARNING! text/xml\CLSID = "{807553E5-5146-11D5-A672-00B0D022E945}" -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL" [MS] HKLM\Software\Classes\Folder\shellex\ColumnHandlers\ {F9DB5320-233E-11D1-9F84-707F02C10627}\(Default) = "PDF Column Info" -> {HKLM...CLSID} = "PDF Shell Extension" \InProcServer32\(Default) = "C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\PDFShell.dll" ["Adobe Systems, Inc."] HKLM\Software\Classes\*\shellex\ContextMenuHandlers\ EditPlus\(Default) = "{63AFBDFB-5EF8-4791-AF79-9A3C0DE48974}" -> {HKLM...CLSID} = "EditPlus Context Menu Handler" \InProcServer32\(Default) = "C:\Program Files\EditPlus 2\eppshell.dll" [null data] Hex Editor 3\(Default) = "{B95713CD-06FF-4D35-A9DA-4DBDFE5FD7F4}" -> {HKLM...CLSID} = "ShellExt Class" \InProcServer32\(Default) = "C:\Program Files\HHD Software\Hex Editor 3.x\heshell.dll" ["HHD Software"] ICQLiteMenu\(Default) = "{73B24247-042E-4EF5-ADC2-42F62E6FD654}" -> {HKLM...CLSID} = "MCLiteShellExt Class" \InProcServer32\(Default) = "C:\Program Files\ICQLite\ICQLiteShell.dll" [empty string] Symantec.Norton.Antivirus.IEContextMenu\(Default) = "{FAD61B3D-699D-49B2-BE16-7F82CB4C59CA}" -> {HKLM...CLSID} = "IEContextMenu Class" \InProcServer32\(Default) = "C:\PROGRA~1\NORTON~1\NavShExt.dll" ["Symantec Corporation"] WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] WinZip\(Default) = "{E0D79304-84BE-11CE-9641-444553540000}" -> {HKLM...CLSID} = "WinZip" \InProcServer32\(Default) = "C:\PROGRA~1\WINZIP\WZSHLSTB.DLL" ["WinZip Computing LP"] WipeExt\(Default) = "{721A1B24-EC8B-4eda-9CCE-39720B9FA747}" -> {HKLM...CLSID} = "WipeExt" \InProcServer32\(Default) = "C:\Program Files\Ace Utilities\wipext.dll" [null data] HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\ ICQLiteMenu\(Default) = "{73B24247-042E-4EF5-ADC2-42F62E6FD654}" -> {HKLM...CLSID} = "MCLiteShellExt Class" \InProcServer32\(Default) = "C:\Program Files\ICQLite\ICQLiteShell.dll" [empty string] WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] WinZip\(Default) = "{E0D79304-84BE-11CE-9641-444553540000}" -> {HKLM...CLSID} = "WinZip" \InProcServer32\(Default) = "C:\PROGRA~1\WINZIP\WZSHLSTB.DLL" ["WinZip Computing LP"] HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\ Symantec.Norton.Antivirus.IEContextMenu\(Default) = "{FAD61B3D-699D-49B2-BE16-7F82CB4C59CA}" -> {HKLM...CLSID} = "IEContextMenu Class" \InProcServer32\(Default) = "C:\PROGRA~1\NORTON~1\NavShExt.dll" ["Symantec Corporation"] WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] WinZip\(Default) = "{E0D79304-84BE-11CE-9641-444553540000}" -> {HKLM...CLSID} = "WinZip" \InProcServer32\(Default) = "C:\PROGRA~1\WINZIP\WZSHLSTB.DLL" ["WinZip Computing LP"] WipeExt\(Default) = "{721A1B24-EC8B-4eda-9CCE-39720B9FA747}" -> {HKLM...CLSID} = "WipeExt" \InProcServer32\(Default) = "C:\Program Files\Ace Utilities\wipext.dll" [null data] Active Desktop and Wallpaper: ----------------------------- Active Desktop is disabled at this entry: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState HKCU\Control Panel\Desktop\ "Wallpaper" = "C:\Documents and Settings\SZEWCO\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp" Startup items in "SZEWCO" & "All Users" startup folders: -------------------------------------------------------- C:\Documents and Settings\All Users\Menu Start\Programy\Autostart "Logitech SetPoint" -> shortcut to: "C:\Program Files\Logitech\SetPoint\SetPoint.exe" ["Logitech Inc."] "Program sieciowy dla SAGEM Wi-Fi 11g USB adapter" -> shortcut to: "C:\Program Files\SAGEM WiFi manager\WLANUTL.exe" [" "] Enabled Scheduled Tasks: ------------------------ "Norton AntiVirus - Uruchom pełne skanowanie systemu - SZEWCO" -> launches: "C:\PROGRA~1\NORTON~1\Navw32.exe /TASK:"C:\Documents and Settings\All Users\Dane aplikacji\Symantec\Norton AntiVirus\Tasks\mycomp.sca"" ["Symantec Corporation"] Winsock2 Service Provider DLLs: ------------------------------- Namespace Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++} 000000000001\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS] 000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS] 000000000003\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS] Transport Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++} 0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range: %SystemRoot%\system32\mswsock.dll [MS], 01 - 03, 06 - 13 %SystemRoot%\system32\rsvpsp.dll [MS], 04 - 05 Toolbars, Explorer Bars, Extensions: ------------------------------------ Toolbars HKCU\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ "{42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6}" -> {HKLM...CLSID} = "Norton AntiVirus" \InProcServer32\(Default) = "C:\Program Files\Norton AntiVirus\NavShExt.dll" ["Symantec Corporation"] HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\ "{42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6}" -> {HKLM...CLSID} = "Norton AntiVirus" \InProcServer32\(Default) = "C:\Program Files\Norton AntiVirus\NavShExt.dll" ["Symantec Corporation"] HKLM\Software\Microsoft\Internet Explorer\Toolbar\ "{42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6}" = "Norton AntiVirus" -> {HKLM...CLSID} = "Norton AntiVirus" \InProcServer32\(Default) = "C:\Program Files\Norton AntiVirus\NavShExt.dll" ["Symantec Corporation"] Extensions (Tools menu items, main toolbar menu buttons) HKLM\Software\Microsoft\Internet Explorer\Extensions\ {08B0E5C0-4FCB-11CF-AAA5-00401C608501}\ "MenuText" = "Sun Java Console" "CLSIDExtension" = "{CAFEEFAC-0015-0000-0011-ABCDEFFEDCBC}" -> {HKCU...CLSID} = "Java Plug-in 1.5.0_11" \InProcServer32\(Default) = "C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll" ["Sun Microsystems, Inc."] -> {HKLM...CLSID} = "Java Plug-in 1.5.0_11" \InProcServer32\(Default) = "C:\Program Files\Java\jre1.5.0_11\bin\npjpi150_11.dll" ["Sun Microsystems, Inc."] {92780B25-18CC-41C8-B9BE-3C9C571A8263}\ "ButtonText" = "Badanie" {B863453A-26C3-4E1F-A54D-A2CD196348E9}\ "ButtonText" = "ICQ Lite" "MenuText" = "ICQ Lite" "Exec" = "C:\Program Files\ICQLite\ICQLite.exe" ["ICQ Ltd."] {DFB852A3-47F8-48C4-A200-58CAB36FD2A2}\ "MenuText" = "Spybot - Search & Destroy Configuration" "CLSIDExtension" = "{53707962-6F74-2D53-2644-206D7942484F}" -> {HKLM...CLSID} = "Spybot-S&D IE Protection" \InProcServer32\(Default) = "C:\PROGRA~1\SPYBOT~1\SDHelper.dll" ["Safer Networking Limited"] {FB5F1910-F110-11D2-BB9E-00C04F795683}\ "ButtonText" = "Messenger" "MenuText" = "Windows Messenger" "Exec" = "C:\Program Files\Messenger\msmsgs.exe" [MS] HOSTS file ---------- C:\WINDOWS\System32\drivers\etc\HOSTS maps: 3 domain names to IP addresses, 2 of the IP addresses are *not* localhost! Running Services (Display Name, Service Name, Path {Service DLL}): ------------------------------------------------------------------ Creative Service for CDROM Access, Creative Service for CDROM Access, "C:\WINDOWS\system32\CTsvcCDA.exe" ["Creative Technology Ltd"] gb, gb, "C:\WINDOWS\System32\svchost.exe -k netsvcs" {"C:\Program Files\Common Files\Microsoft Shared\Web Folders\ibm00001.dll" [null data]} Harmonogram automatycznej usługi LiveUpdate, Harmonogram automatycznej usługi LiveUpdate, ""C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe"" ["Symantec Corporation"] LiveUpdate Notice Service Ex, LiveUpdate Notice Ex, ""C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon" ["Symantec Corporation"] Machine Debug Manager, MDM, ""C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE"" [MS] NVIDIA Display Driver Service, NVSvc, "C:\WINDOWS\system32\nvsvc32.exe" ["NVIDIA Corporation"] Symantec AppCore Service, SymAppCore, ""C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe"" ["Symantec Corporation"] Symantec Event Manager, ccEvtMgr, ""C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon" ["Symantec Corporation"] Symantec Lic NetConnect service, CLTNetCnService, ""C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon" ["Symantec Corporation"] Symantec Settings Manager, ccSetMgr, ""C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon" ["Symantec Corporation"] Windows User Mode Driver Framework, UMWdf, "C:\WINDOWS\system32\wdfmgr.exe" [MS] WMDM PMSP Service, WMDM PMSP Service, "C:\WINDOWS\system32\MsPMSPSv.exe" [MS] Print Monitors: --------------- HKLM\System\CurrentControlSet\Control\Print\Monitors\ Microsoft Document Imaging Writer Monitor\Driver = "mdimon.dll" [MS] ---------- + This report excludes default entries except where indicated. + To see *everywhere* the script checks and *everything* it finds, launch it from a command prompt or a shortcut with the -all parameter. + To search all directories of local fixed drives for DESKTOP.INI DLL launch points and all Registry CLSIDs for dormant Explorer Bars, use the -supp parameter or answer "No" at the first message box. ---------- (total run time: 45 seconds, including 7 seconds for message boxes)

[ Dodano: Dzisiaj o 14:07 ]
A i tu jeszcze log z ComboScana:

Kod: Zaznacz wszystko: ComboScan v20070306.20 run by SZEWCO on 2007-06-27 at 14:41:01 Computer is in Normal Mode. -------------------------------------------------------------------------------- -- HijackThis (run as SZEWCO.exe) ---------------------------------------------- Logfile of HijackThis v1.99.1 Scan saved at 14:41:05, on 2007-06-27 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\CTsvcCDA.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\MsPMSPSv.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\CTHELPER.EXE C:\WINDOWS\system32\RunDLL32.exe C:\WINDOWS\system32\rundll32.exe C:\Program Files\Common Files\Symantec Shared\ccApp.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\DAEMON Tools\daemon.exe C:\Program Files\Logitech\SetPoint\SetPoint.exe C:\Program Files\SAGEM WiFi manager\WLANUTL.exe C:\Program Files\Common Files\Logitech\khalshared\KHALMNPR.EXE C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe C:\Program Files\Internet Explorer\iexplore.exe E:\dodatki\comboscan.exe E:\dodatki\SZEWCO.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.onet.pl/ R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.onet.pl/ R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O1 - Hosts: 69.80.225.31 nprotect.ryl.com.my O1 - Hosts: 72.52.163.100 nprotect.battlelands.net O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O2 - BHO: BHOAd - {85589B5D-D53D-4237-A677-46B82EA275F3} - C:\WINDOWS\xmlhelper2.dll O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll O4 - HKLM\..\Run: [WINDVDPatch] CTHELPER.EXE O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [NAV Agent] C:\PROGRA~1\NORTON~1\navapw32.exe O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" O4 - HKLM\..\Run: [CloneCDTray] "C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe" /s O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton AntiVirus\osCheck.exe" O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll" O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033 O4 - Global Startup: Logitech SetPoint.lnk = ? O4 - Global Startup: Program sieciowy dla SAGEM Wi-Fi 11g USB adapter.lnk = ? O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} - http://go.microsoft.com/fwlink/?linkid=58813 O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.pl/resources/virusscanner/kavwebscan_unicode.cab O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1173383578687 O16 - DPF: {68282C51-9459-467B-95BF-3C0E89627E55} (MainControl Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: Symantec Event Manager (ccEvtMgr) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing) O23 - Service: Symantec Settings Manager (ccSetMgr) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing) O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing) O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe O23 - Service: Harmonogram automatycznej usługi LiveUpdate - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe O23 - Service: Symantec IS Password Validation (ISPwdSvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\isPwdSvc.exe O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing) O23 - Service: LiveUpdate Notice Service - Unknown owner - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PifEng.dll (file missing) O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe -- Files created between 2007-05-27 and 2007-06-27 ----------------------------- 2007-06-26 12:21:58 22112 -ra------ C:\WINDOWS\system32\drivers\COH_Mon.sys 2007-06-26 08:19:06 0 d-------- C:\Program Files\Strip Poker Exclusive 2<STRIPP~1> 2007-06-26 07:48:50 0 d-------- C:\Strip Poker Exclusive 2<STRIPP~1> 2007-06-26 07:17:45 48776 --a------ C:\WINDOWS\system32\S32EVNT1.DLL 2007-06-26 07:17:45 115000 --a------ C:\WINDOWS\system32\drivers\SYMEVENT.SYS 2007-06-26 07:09:26 0 d-------- C:\WINDOWS\system32\appmgmt 2007-06-21 19:28:14 122880 --a------ C:\WINDOWS\xmlhelper2.dll<XMLHEL~2.DLL> 2007-06-19 20:43:05 453632 --a------ C:\WINDOWS\system32\stdvcl40.dll 2007-06-19 20:43:05 382464 --a------ C:\WINDOWS\system32\PurePage.exe 2007-06-19 20:43:05 1013760 --a------ C:\WINDOWS\system32\PPEngine.dll 2007-06-19 20:43:05 217088 --a------ C:\WINDOWS\system32\LPng.dll 2007-06-19 20:43:04 0 d-------- C:\Program Files\ClickToConvert<CLICKT~1> 2007-06-19 20:38:13 135168 --a------ C:\WINDOWS\system32\expat.dll 2007-06-19 15:06:55 0 d-------- C:\Program Files\Common Files\Adobe 2007-06-18 00:42:45 122880 --a------ C:\WINDOWS\xmlhelper.dll<XMLHEL~1.DLL> 2007-06-12 20:08:47 0 d-------- C:\Program Files\Minefield<MINEFI~1> 2007-06-12 20:03:40 0 d-------- C:\Program Files\Microsoft Office Outlook Connector<MICROS~2> 2007-06-07 02:36:30 266088 --a------ C:\WINDOWS\system32\xactengine2_8.dll<XA3866~1.DLL> 2007-06-07 02:36:30 18280 --a------ C:\WINDOWS\system32\x3daudio1_2.dll<X3DAUD~3.DLL> 2007-06-07 02:36:29 3497832 --a------ C:\WINDOWS\system32\d3dx9_34.dll 2007-06-07 02:36:29 443752 --a------ C:\WINDOWS\system32\d3dx10_34.dll<D3DX10~2.DLL> 2007-06-07 02:36:29 1124720 --a------ C:\WINDOWS\system32\D3DCompiler_34.dll<D3DCOM~2.DLL> 2007-06-07 02:36:27 261480 --a------ C:\WINDOWS\system32\xactengine2_7.dll<XA3466~1.DLL> 2007-06-07 02:36:26 443752 --a------ C:\WINDOWS\system32\d3dx10_33.dll<D3DX10~1.DLL> 2007-06-07 02:36:25 1123696 --a------ C:\WINDOWS\system32\D3DCompiler_33.dll<D3DCOM~1.DLL> 2007-06-07 02:36:23 3495784 --a------ C:\WINDOWS\system32\d3dx9_33.dll 2007-06-06 23:36:36 0 d-------- C:\Program Files\RhinoSoft.com<RHINOS~1.COM> 2007-06-05 20:34:17 0 d-------- C:\Program Files\Teamspeak2_RC2 serv<TEAMSP~2> 2007-06-04 13:57:18 0 d-------- C:\WINDOWS\Downloaded Installations<DOWNLO~2> 2007-05-31 08:45:07 524288 --a------ C:\WINDOWS\system32\DivXsm.exe 2007-05-31 08:44:55 823296 --a------ C:\WINDOWS\system32\divx_xx07.dll<DIVX_X~2.DLL> 2007-05-31 08:44:54 802816 --a------ C:\WINDOWS\system32\divx_xx11.dll<DIVX_X~3.DLL> 2007-05-31 08:44:54 823296 --a------ C:\WINDOWS\system32\divx_xx0c.dll<DIVX_X~1.DLL> 2007-05-31 08:44:54 740442 --a------ C:\WINDOWS\system32\DivX.dll 2007-05-30 21:44:15 206 --a------ C:\WINDOWS\g7701125.exe 2007-05-27 03:33:29 0 d-------- C:\Program Files\FDRLab -- Find3M Report --------------------------------------------------------------- 2007-06-27 14:10:13 24 --a------ C:\WINDOWS\system32\DVCStateBkp-{00000001-00000000-00000008-00001102-00000002-80651102}.dat<DVCSTA~2.DAT> 2007-06-27 14:10:13 24 --a------ C:\WINDOWS\system32\DVCState-{00000001-00000000-00000008-00001102-00000002-80651102}.dat<DVCSTA~1.DAT> 2007-06-26 20:50:41 16270336 --a------ C:\Documents and Settings\SZEWCO\Dane aplikacji\Outlook.pst 2007-06-26 20:50:40 271360 --a------ C:\Documents and Settings\SZEWCO\Dane aplikacji\archive.pst 2007-06-26 15:32:29 0 d-------- C:\Program Files\Common Files\Symantec Shared<SYMANT~1> 2007-06-26 11:53:40 0 d-------- C:\Program Files\DAEMON Tools<DAEMON~1> 2007-06-26 09:26:28 0 d-------- C:\Program Files\QuickTime<QUICKT~1> 2007-06-26 08:41:07 0 d-------- C:\Program Files\Norton AntiVirus<NORTON~1> 2007-06-26 08:38:39 0 d-------- C:\Program Files\Symantec 2007-06-21 19:41:51 0 d-------- C:\Program Files\mIRC 2007-06-19 22:35:31 0 d-------- C:\Documents and Settings\SZEWCO\Dane aplikacji\Skype 2007-06-19 21:16:57 0 d-------- C:\Documents and Settings\SZEWCO\Dane aplikacji\Tomahawk 2007-06-19 20:38:03 0 d--h----- C:\Program Files\InstallShield Installation Information<INSTAL~1> 2007-06-19 20:38:01 0 d-------- C:\Program Files\Global Graphics<GLOBAL~1> 2007-06-19 15:09:02 0 d-------- C:\Documents and Settings\SZEWCO\Dane aplikacji\Adobe 2007-06-17 23:53:36 0 d-------- C:\Program Files\ffdshow 2007-06-17 20:21:16 10752 --a------ C:\WINDOWS\system32\ff_vfw.dll 2007-06-12 20:14:15 0 d-------- C:\Program Files\Mozilla Firefox 2 Beta 1<MOZILL~1> 2007-06-12 20:03:41 0 d-------- C:\Program Files\Common Files\?ystem 2007-06-12 20:03:23 0 d-------- C:\Program Files\MSECache 2007-06-09 20:35:36 0 d-------- C:\Program Files\AC3Filter<AC3FIL~1> 2007-06-06 23:24:52 0 d-------- C:\Documents and Settings\SZEWCO\Dane aplikacji\SmartFTP 2007-06-06 21:16:40 0 d-------- C:\Documents and Settings\SZEWCO\Dane aplikacji\teamspeak2<TEAMSP~1> 2007-06-03 09:58:55 0 d---s---- C:\Documents and Settings\SZEWCO\Dane aplikacji\Microsoft<MICROS~1> 2007-06-01 15:00:45 0 d-------- C:\Documents and Settings\SZEWCO\Dane aplikacji\DivX 2007-06-01 14:56:21 0 d-------- C:\Program Files\DivX 2007-05-31 23:09:30 0 d-------- C:\Documents and Settings\SZEWCO\Dane aplikacji\Azureus 2007-05-31 23:08:20 0 d-------- C:\Program Files\Azureus 2007-05-24 23:54:01 0 d-------- C:\Program Files\MSN Messenger<MSNMES~1> 2007-05-24 23:54:01 0 d-------- C:\Program Files\Messenger Plus! Live<MESSEN~2> 2007-05-24 23:52:47 0 d-------- C:\Program Files\Common Files\Skype 2007-05-20 14:34:54 0 d-------- C:\Program Files\Winamp 2007-05-09 20:57:26 0 d-------- C:\Program Files\Gadu-Gadu<GADU-G~1> 2007-05-07 17:55:56 10 --ah----- C:\WINDOWS\popcinfo.dat 2007-05-04 12:56:30 0 d-------- C:\Program Files\Common Files\Logitech 2007-05-04 12:56:19 0 d-------- C:\Program Files\Logitech 2007-05-02 14:14:11 0 d-------- C:\Documents and Settings\SZEWCO\Dane aplikacji\Logitech 2007-04-27 10:36:00 0 d-------- C:\Program Files\Windows Media Components<WI15DA~1> 2007-04-27 10:35:28 0 d-------- C:\Program Files\Windows Media Bonus Pack for Windows XP<WI12E0~1> 2007-04-27 10:28:36 0 d-------- C:\Program Files\Windows Media Connect 2<WINDOW~4> 2007-04-24 07:15:22 60273 --a------ C:\WINDOWS\system32\pthreadGC2.dll<PTHREA~1.DLL> 2007-04-23 02:15:29 3596288 --a------ C:\WINDOWS\system32\qt-dx331.dll 2007-04-23 02:15:18 200704 --a------ C:\WINDOWS\system32\ssldivx.dll 2007-04-23 02:15:18 1044480 --a------ C:\WINDOWS\system32\libdivx.dll 2007-04-23 02:02:34 196608 --a------ C:\WINDOWS\system32\dtu100.dll 2007-04-23 02:02:34 73728 --a------ C:\WINDOWS\system32\dpl100.dll 2007-04-23 02:02:33 53248 --a------ C:\WINDOWS\system32\dpuGUI10.dll 2007-04-23 02:02:31 57344 --a------ C:\WINDOWS\system32\dpv11.dll 2007-04-23 02:02:31 344064 --a------ C:\WINDOWS\system32\dpus11.dll 2007-04-23 02:02:31 593920 --a------ C:\WINDOWS\system32\dpuGUI11.dll 2007-04-23 02:02:31 294912 --a------ C:\WINDOWS\system32\dpu11.dll 2007-04-23 02:02:31 294912 --a------ C:\WINDOWS\system32\dpu10.dll 2007-04-23 02:01:47 12288 --a------ C:\WINDOWS\system32\DivXWMPExtType.dll<DIVXWM~1.DLL> 2007-04-23 02:01:46 124472 --a------ C:\WINDOWS\system32\DivXCodecUpdateChecker.exe<DIVXCO~1.EXE> 2007-04-22 08:16:53 74752 --a------ C:\WINDOWS\cadkasdeinst01e.exe<CADKAS~1.EXE> 2007-04-11 21:48:35 497524 --a------ C:\WINDOWS\system32\perfh015.dat 2007-04-11 21:48:35 88224 --a------ C:\WINDOWS\system32\perfc015.dat 2007-04-04 18:53:42 81768 --a------ C:\WINDOWS\system32\xinput1_3.dll<XINPUT~4.DLL> -- Registry Dump --------------------------------------------------------------- [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run] "CTFMON.EXE"="C:\\WINDOWS\\system32\\ctfmon.exe" "DAEMON Tools"="\"C:\\Program Files\\DAEMON Tools\\daemon.exe\" -lang 1033" [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\runonce] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\runonce\CTStartup] "CTStartup"="\"C:\\Program Files\\Creative\\Splash Screen\\CTEaxSpl.EXE\" /play" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run] "WINDVDPatch"="CTHELPER.EXE" "NvCplDaemon"="RUNDLL32.EXE C:\\WINDOWS\\system32\\NvCpl.dll,NvStartup" "nwiz"="nwiz.exe /install" "NvMediaCenter"="RunDLL32.exe NvMCTray.dll,NvTaskbarInit" "NAV Agent"="C:\\PROGRA~1\\NORTON~1\\navapw32.exe" "RemoteControl"="\"C:\\Program Files\\CyberLink\\PowerDVD\\PDVDServ.exe\"" "CloneCDTray"="\"C:\\Program Files\\SlySoft\\CloneCD\\CloneCDTray.exe\" /s" "NWEReboot"="" "Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" "Logitech Hardware Abstraction Layer"="KHALMNPR.EXE" "ccApp"="\"C:\\Program Files\\Common Files\\Symantec Shared\\ccApp.exe\"" "osCheck"="\"C:\\Program Files\\Norton AntiVirus\\osCheck.exe\"" "Symantec PIF AlertEng"="\"C:\\Program Files\\Common Files\\Symantec Shared\\PIF\\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\\PIFSvc.exe\" /a /m \"C:\\Program Files\\Common Files\\Symantec Shared\\PIF\\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\\AlertEng.dll\"" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\IMAIL] "Installed"="1" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MAPI] "Installed"="1" "NoChange"="1" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MSFS] "Installed"="1" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpybotSD TeaTimer] "item"="TeaTimer" "hkey"="HKCU" "command"="C:\\Program Files\\Spybot - Search & Destroy\\TeaTimer.exe" "inimapping"="0" [HKEY_USERS\.default\software\microsoft\windows\currentversion\run] "CTFMON.EXE"="C:\\WINDOWS\\system32\\CTFMON.EXE" [HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\run] "CTFMON.EXE"="C:\\WINDOWS\\system32\\CTFMON.EXE" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer] @="" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer\run] [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders] "SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll" HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\WdfLoadGroup [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Svchost] HTTPFilter REG_MULTI_SZ HTTPFilter\0\0 LocalService REG_MULTI_SZ Alerter\0WebClient\0LmHosts\0RemoteRegistry\0upnphost\0SSDPSRV\0\0 NetworkService REG_MULTI_SZ DnsCache\0\0 DcomLaunch REG_MULTI_SZ DcomLaunch\0TermService\0\0 rpcss REG_MULTI_SZ RpcSs\0\0 imgsvc REG_MULTI_SZ StiSvc\0\0 termsvcs REG_MULTI_SZ TermService\0\0 WudfServiceGroup REG_MULTI_SZ WUDFSvc\0\0 HKLM\software\Microsoft\Windows NT\CurrentVersion\Svchost *netsvcs* gb [HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{00d18c3a-c931-11db-83b3-0060b342dc4c}] Shell\AutoRun\command G:\SETUP.EXE [HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{bbde3380-c97a-11db-83b4-0060b342dc4c}] Shell\AutoRun\command H:\SETUP.EXE [HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{bbde3381-c97a-11db-83b4-0060b342dc4c}] Shell\AutoRun\command I:\PlayD2.EXE [HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{bbde3382-c97a-11db-83b4-0060b342dc4c}] Shell\AutoRun\command J:\SETUP.EXE -- End of ComboScan: finished at 2007-06-27 at 14:41:30 ------------------------

**Posty:** 18165 · przez **wojtas** 27 Cze 2007, 15:25

daj loga z combofixa:

http://download.bleepingcomputer.com/sUBs/ComboFix.exe

Start>uruchom>msconfig>zakladka uruchamianie> wylacz progsy które nie chcesz żeby startowaly z systemem przyspieszy Ci to wlaczanie kompa

**Posty:** 84 · przez **zooo** 27 Cze 2007, 17:03

Log z ComboFixa

Kod: Zaznacz wszystko: "SZEWCO" - 2007-06-27 15:41:27 - ComboFix 07-06-27.7 - Dodatek Service Pack 2 NTFS ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) C:\Program Files\Common Files\{D823B~1 C:\Program Files\Common Files\{D823B~2 C:\Program Files\Common Files\microsoft shared\web folders\ibm00001.dll C:\Program Files\Common Files\microsoft shared\web folders\ibm00002.dll C:\Program Files\Common Files\ystem~1 C:\Program Files\icroso~1.net C:\WINDOWS\pppatc~1 C:\WINDOWS\system32\icroso~1 C:\WINDOWS\system32\wapicc.exe C:\WINDOWS\xmlhelper.dll C:\WINDOWS\xmlhelper2.dll ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) -------\LEGACY_COM+_MESSAGES -------\LEGACY_GB -------\gb ((((((((((((((((((((((((( Files Created from 2007-05-27 to 2007-06-27 ))))))))))))))))))))))))))))))) 2007-06-27 15:40 49,152 --a------ C:\WINDOWS\nircmd.exe 2007-06-26 12:21 22,112 -ra------ C:\WINDOWS\system32\drivers\COH_Mon.sys 2007-06-26 08:19 <DIR> d-------- C:\Program Files\Strip Poker Exclusive 2 2007-06-26 07:48 <DIR> d-------- C:\Strip Poker Exclusive 2 2007-06-26 07:17 48,776 --a------ C:\WINDOWS\system32\S32EVNT1.DLL 2007-06-26 07:17 115,000 --a------ C:\WINDOWS\system32\drivers\SYMEVENT.SYS 2007-06-26 07:09 <DIR> d-------- C:\WINDOWS\system32\appmgmt 2007-06-19 21:16 <DIR> d-------- C:\DOCUME~1\SZEWCO\DANEAP~1\Tomahawk 2007-06-19 20:43 453,632 --a------ C:\WINDOWS\system32\stdvcl40.dll 2007-06-19 20:43 382,464 --a------ C:\WINDOWS\system32\PurePage.exe 2007-06-19 20:43 217,088 --a------ C:\WINDOWS\system32\LPng.dll 2007-06-19 20:43 1,013,760 --a------ C:\WINDOWS\system32\PPEngine.dll 2007-06-19 20:43 <DIR> d-------- C:\Program Files\ClickToConvert 2007-06-19 20:38 135,168 --a------ C:\WINDOWS\system32\expat.dll 2007-06-12 20:08 <DIR> d-------- C:\Program Files\Minefield 2007-06-12 20:03 <DIR> d-------- C:\Program Files\Microsoft Office Outlook Connector 2007-06-07 02:36 443,752 --a------ C:\WINDOWS\system32\d3dx10_34.dll 2007-06-07 02:36 443,752 --a------ C:\WINDOWS\system32\d3dx10_33.dll 2007-06-07 02:36 3,497,832 --a------ C:\WINDOWS\system32\d3dx9_34.dll 2007-06-07 02:36 3,495,784 --a------ C:\WINDOWS\system32\d3dx9_33.dll 2007-06-07 02:36 266,088 --a------ C:\WINDOWS\system32\xactengine2_8.dll 2007-06-07 02:36 261,480 --a------ C:\WINDOWS\system32\xactengine2_7.dll 2007-06-07 02:36 18,280 --a------ C:\WINDOWS\system32\x3daudio1_2.dll 2007-06-07 02:36 1,124,720 --a------ C:\WINDOWS\system32\D3DCompiler_34.dll 2007-06-07 02:36 1,123,696 --a------ C:\WINDOWS\system32\D3DCompiler_33.dll 2007-06-06 23:36 <DIR> d-------- C:\Program Files\RhinoSoft.com 2007-06-06 23:24 <DIR> d-------- C:\DOCUME~1\SZEWCO\DANEAP~1\SmartFTP 2007-06-05 20:34 <DIR> d-------- C:\Program Files\Teamspeak2_RC2 serv 2007-06-04 13:57 <DIR> d-------- C:\WINDOWS\Downloaded Installations 2007-05-31 08:45 524,288 --a------ C:\WINDOWS\system32\DivXsm.exe 2007-05-31 08:44 823,296 --a------ C:\WINDOWS\system32\divx_xx0c.dll 2007-05-31 08:44 823,296 --a------ C:\WINDOWS\system32\divx_xx07.dll 2007-05-31 08:44 802,816 --a------ C:\WINDOWS\system32\divx_xx11.dll 2007-05-31 08:44 740,442 --a------ C:\WINDOWS\system32\DivX.dll 2007-05-30 21:44 206 --a------ C:\WINDOWS\g7701125.exe 2007-05-30 21:42 <DIR> d-a------ C:\DOCUME~1\ALLUSE~1\DANEAP~1\TEMP 2007-05-27 03:33 <DIR> d-------- C:\Program Files\FDRLab 2007-05-27 01:32 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\Messenger Plus! (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) 2007-06-27 13:44:13 24 ----a-w C:\WINDOWS\system32\DVCStateBkp-{00000001-00000000-00000008-00001102-00000002-80651102}.dat 2007-06-27 13:44:13 24 ----a-w C:\WINDOWS\system32\DVCState-{00000001-00000000-00000008-00001102-00000002-80651102}.dat 2007-06-26 13:32:29 -------- d-----w C:\Program Files\Common Files\Symantec Shared 2007-06-26 09:53:40 -------- d-----w C:\Program Files\DAEMON Tools 2007-06-26 07:26:28 -------- d-----w C:\Program Files\QuickTime 2007-06-26 06:41:07 -------- d-----w C:\Program Files\Norton AntiVirus 2007-06-26 06:38:39 -------- d-----w C:\Program Files\Symantec 2007-06-21 17:41:51 -------- d-----w C:\Program Files\mIRC 2007-06-19 20:35:31 -------- d-----w C:\DOCUME~1\SZEWCO\DANEAP~1\Skype 2007-06-19 18:38:03 -------- d--h--w C:\Program Files\InstallShield Installation Information 2007-06-19 18:38:01 -------- d-----w C:\Program Files\Global Graphics 2007-06-17 21:53:36 -------- d-----w C:\Program Files\ffdshow 2007-06-17 18:21:16 10,752 ----a-w C:\WINDOWS\system32\ff_vfw.dll 2007-06-12 18:14:15 -------- d-----w C:\Program Files\Mozilla Firefox 2 Beta 1 2007-06-12 18:03:23 -------- d-----w C:\Program Files\MSECache 2007-06-09 18:35:36 -------- d-----w C:\Program Files\AC3Filter 2007-06-06 19:16:40 -------- d-----w C:\DOCUME~1\SZEWCO\DANEAP~1\teamspeak2 2007-06-01 13:00:45 -------- d-----w C:\DOCUME~1\SZEWCO\DANEAP~1\DivX 2007-06-01 12:56:21 -------- d-----w C:\Program Files\DivX 2007-05-31 21:09:30 -------- d-----w C:\DOCUME~1\SZEWCO\DANEAP~1\Azureus 2007-05-31 21:08:20 -------- d-----w C:\Program Files\Azureus 2007-05-24 21:54:01 -------- d-----w C:\Program Files\MSN Messenger 2007-05-24 21:54:01 -------- d-----w C:\Program Files\Messenger Plus! Live 2007-05-24 21:52:47 -------- d-----w C:\Program Files\Common Files\Skype 2007-05-20 12:34:54 -------- d-----w C:\Program Files\Winamp 2007-05-09 18:57:26 -------- d-----w C:\Program Files\Gadu-Gadu 2007-05-07 15:55:56 10 ---ha-w C:\WINDOWS\popcinfo.dat 2007-05-04 10:56:30 -------- d-----w C:\Program Files\Common Files\Logitech 2007-05-04 10:56:19 -------- d-----w C:\Program Files\Logitech 2007-05-02 12:14:11 -------- d-----w C:\DOCUME~1\SZEWCO\DANEAP~1\Logitech 2007-04-27 08:36:00 -------- d-----w C:\Program Files\Windows Media Components 2007-04-27 08:35:28 -------- d-----w C:\Program Files\Windows Media Bonus Pack for Windows XP 2007-04-27 08:28:36 -------- d-----w C:\Program Files\Windows Media Connect 2 2007-04-24 05:15:22 60,273 ----a-w C:\WINDOWS\system32\pthreadGC2.dll 2007-04-23 00:15:29 3,596,288 ----a-w C:\WINDOWS\system32\qt-dx331.dll 2007-04-23 00:15:18 200,704 ----a-w C:\WINDOWS\system32\ssldivx.dll 2007-04-23 00:15:18 1,044,480 ----a-w C:\WINDOWS\system32\libdivx.dll 2007-04-23 00:02:34 73,728 ----a-w C:\WINDOWS\system32\dpl100.dll 2007-04-23 00:02:34 196,608 ----a-w C:\WINDOWS\system32\dtu100.dll 2007-04-23 00:02:33 53,248 ----a-w C:\WINDOWS\system32\dpuGUI10.dll 2007-04-23 00:02:31 593,920 ----a-w C:\WINDOWS\system32\dpuGUI11.dll 2007-04-23 00:02:31 57,344 ----a-w C:\WINDOWS\system32\dpv11.dll 2007-04-23 00:02:31 344,064 ----a-w C:\WINDOWS\system32\dpus11.dll 2007-04-23 00:02:31 294,912 ----a-w C:\WINDOWS\system32\dpu11.dll 2007-04-23 00:02:31 294,912 ----a-w C:\WINDOWS\system32\dpu10.dll 2007-04-23 00:01:47 12,288 ----a-w C:\WINDOWS\system32\DivXWMPExtType.dll 2007-04-23 00:01:46 124,472 ----a-w C:\WINDOWS\system32\DivXCodecUpdateChecker.exe 2007-04-22 06:16:53 74,752 ----a-w C:\WINDOWS\cadkasdeinst01e.exe 2007-04-11 19:48:35 88,224 ----a-w C:\WINDOWS\system32\perfc015.dat 2007-04-11 19:48:35 497,524 ----a-w C:\WINDOWS\system32\perfh015.dat 2007-04-04 16:53:42 81,768 ----a-w C:\WINDOWS\system32\xinput1_3.dll 2005-07-14 19:31:20 27,648 --sha-w C:\WINDOWS\system32\AVSredirect.dll ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects] {53707962-6F74-2D53-2644-206D7942484F}=C:\PROGRA~1\SPYBOT~1\SDHelper.dll [2007-06-15 10:41] {761497BB-D6F0-462C-B6EB-D4DAF1D92D43}=C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll [2007-01-12 04:08] {85589B5D-D53D-4237-A677-46B82EA275F3}=C:\WINDOWS\xmlhelper2.dll [] {9030D464-4C02-4ABF-8ECC-5164760863C6}=C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2006-08-31 21:33] {BDF3E430-B101-42AD-A544-FADC6B084872}=C:\Program Files\Norton AntiVirus\NavShExt.dll [2006-09-07 00:38] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "WINDVDPatch"="CTHELPER.EXE" [2002-07-02 11:56 C:\WINDOWS\system32\CTHELPER.EXE] "nwiz"="nwiz.exe" [2006-11-17 18:29 C:\WINDOWS\system32\nwiz.exe] "NvMediaCenter"="NvMCTray.dll" [2006-11-17 18:29 C:\WINDOWS\system32\nvmctray.dll] "NAV Agent"="C:\PROGRA~1\NORTON~1\navapw32.exe" [] "RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [] "CloneCDTray"="C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe" [] "NWEReboot"="" [] "Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2007-01-23 15:44 C:\WINDOWS\KHALMNPR.Exe] "Logitech Hardware Abstraction Layer"="KHALMNPR.EXE" [2007-01-23 15:44 C:\WINDOWS\KHALMNPR.Exe] "ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2007-01-09 22:59] "osCheck"="C:\Program Files\Norton AntiVirus\osCheck.exe" [2006-09-05 20:22] "Symantec PIF AlertEng"="C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [2007-03-12 11:22] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 01:44] "DAEMON Tools"="C:\Program Files\DAEMON Tools\daemon.exe" [2007-04-04 00:29] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer] @= [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\WdfLoadGroup] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{00d18c3a-c931-11db-83b3-0060b342dc4c}] AutoRun\command- G:\SETUP.EXE [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{bbde3380-c97a-11db-83b4-0060b342dc4c}] AutoRun\command- H:\SETUP.EXE [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{bbde3381-c97a-11db-83b4-0060b342dc4c}] AutoRun\command- I:\PlayD2.EXE [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{bbde3382-c97a-11db-83b4-0060b342dc4c}] AutoRun\command- J:\SETUP.EXE Contents of the 'Scheduled Tasks' folder 2007-06-26 06:42:26 C:\WINDOWS\tasks\Norton AntiVirus - Uruchom pełne skanowanie systemu - SZEWCO.job ************************************************************************** catchme 0.3.721 W2K/XP/Vista - userland rootkit detector by Gmer, http://www.gmer.net Rootkit scan 2007-06-27 16:34:33 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\ha10kx2k] "ImagePath"="system32\drivers\ha10kx2k.sys" [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\H a r m o n o g r a m a u t o m a t y c z n e j u s Bu g i L i v e U p d a t e ] "ImagePath"="\"C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe\"" [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\helpsvc] "ServiceDll"="%WINDIR%\PCHealth\HelpCtr\Binaries\pchsvc.dll" [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\HidServ] "ServiceDll"="%SystemRoot%\System32\hidserv.dll" [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\hidusb] "ImagePath"="system32\DRIVERS\hidusb.sys" [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\hpn] [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\HTTP] "ImagePath"="System32\Drivers\HTTP.sys" [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\HTTPFilter] "ServiceDll"="%SystemRoot%\System32\w3ssl.dll" Completion time: 2007-06-27 16:36:23 - machine was rebooted C:\ComboFix-quarantined-files.txt ... 2007-06-27 16:36 --- E O F ---

**Posty:** 18165 · przez **wojtas** 27 Cze 2007, 19:08

juz jest ok wirusy co miales zostaly usuniete

Autor postu otrzymał pochwałę

**Posty:** 84 · przez **zooo** 27 Cze 2007, 22:11

wojtas19162--> a jeszcze mam pytanko co moge jeszcze ze tak sie wyraze ubic przy odpalaniu??? takie procesy mi jeszcze zostaly:
http://img407.imageshack.us/img407/5055/procesysytemowewx4.jpg

**Posty:** 18165 · przez **wojtas** 27 Cze 2007, 22:14

1,2,5,6,7,10,11 mozesz spokojenie odznaczyc

(licz od gory)

prosba o sprawdzenie loga

Prosba o sprawdzenie loga

Kto jest na forum