prosba o sprawdzenie net spowloniony

**Posty:** 94 · przez **mike00** 05 Lip 2006, 16:55

mam neo 512 a kiedy gram w cs to mam takie lagi ze szok do tego wszystko mi wolno chodzi stronki i inne zeczy na necie gg itp.

Logfile of HijackThis v1.99.1
Scan saved at 16:50:43, on 2006-07-05
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\SYSTEM32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\SYSTEM32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe
C:\PROGRA~1\NEOSTR~1\CnxMon.exe
C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe
C:\Program Files\D-Tools\daemon.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRA~1\NEOSTR~1\NeostradaTP.exe
C:\PROGRA~1\NEOSTR~1\ComComp.exe
C:\PROGRA~1\NEOSTR~1\Watch.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Opera\Opera.exe
C:\Documents and Settings\michal@\Pulpit\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = c:\secure32.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://users.iptelecom.net.ua/~codecs/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = c:\secure32.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = c:\secure32.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = c:\secure32.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = c:\secure32.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Neostrada TP
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\NEOSTR~1\SEARCH~1.DLL
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon
O4 - HKLM\..\Run: [WooCnxMon] C:\PROGRA~1\NEOSTR~1\CnxMon.exe
O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\NEOSTR~1\Watch.exe
O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Uptime-Project] C:\Documents and Settings\michal@\Pulpit\client.exe
O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O9 - Extra button: Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O16 - DPF: {33331111-1111-1111-1111-611111193423} -
O16 - DPF: {33331111-1111-1111-1111-611111193429} -
O16 - DPF: {33331111-1111-1111-1111-615111193427} -
O16 - DPF: {41ACD49D-1974-791A-0981-AA9872721044} (Ganymede Board Games) - http://67.15.101.3/g_bin/pl/boards_2_0_0_24.cab
O16 - DPF: {A1FE3DE0-CF77-11D4-8340-0080C8D7ED4A} (GameDesire Pinball Demon) - http://67.15.101.3/g_bin/pl/demon_2_0_0_21.cab
O16 - DPF: {E95CF138-A587-4C54-8175-3AD80997CB14} (GameDesire Soccer) - http://67.15.101.3/g_bin/pl/soccer_2_0_0_10.cab
O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C1} (GameDesire Pool - http://67.15.101.3/g_bin/pl/billard8_2_0_0_24.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{68EBB959-DFE1-41CA-B3B8-2F0D6C6B4C59}: NameServer = 194.204.152.34 217.98.63.164
O20 - Winlogon Notify: msctl32.dll - msctl32.dll (file missing)
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)

**Posty:** 8694 · przez **Red** 05 Lip 2006, 16:59

usuwasz z wylaczonym przywracaniem systemu w xp i w trybie awaryjnym f8

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = c:\secure32.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = c:\secure32.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = c:\secure32.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = c:\secure32.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = c:\secure32.html
O16 - DPF: {33331111-1111-1111-1111-611111193423} -
O16 - DPF: {33331111-1111-1111-1111-611111193429} -
O16 - DPF: {33331111-1111-1111-1111-615111193427} -
O20 - Winlogon Notify: msctl32.dll - msctl32.dll (file missing)

zaznacz w hijacku i nacisnij fix

dodatkowo sciagnij:
http://www.ewido.net/en/download/
usun wszystko co znajdzie i daj log do kontroli, nowy

**Posty:** 94 · przez **mike00** 05 Lip 2006, 18:23

raport ewido

---------------------------------------------------------
ewido anti-spyware - Scan Report
---------------------------------------------------------

+ Created at: 18:17:11 2006-07-05

+ Scan result:

C:\Documents and Settings\michal@\Menu Start\Programy\WhenU -> Adware.SaveNow : No action taken.
C:\Documents and Settings\michal@\Menu Start\Programy\WhenU\Learn More About WhenU Save.url -> Adware.SaveNow : No action taken.
C:\Documents and Settings\michal@\Menu Start\Programy\WhenU\Learn More About WhenU SaveNow.url -> Adware.SaveNow : No action taken.
C:\Documents and Settings\michal@\Menu Start\Programy\WhenU\Uninstall.lnk -> Adware.SaveNow : No action taken.
C:\Documents and Settings\michal@\Menu Start\Programy\WhenU\WhenU.com Website.url -> Adware.SaveNow : No action taken.
C:\Program Files\Save -> Adware.SaveNow : No action taken.
C:\Program Files\Save\ACM.dll -> Adware.SaveNow : No action taken.
C:\Program Files\Save\Save.exe -> Adware.SaveNow : No action taken.
C:\Program Files\Save\SaveUninst.exe -> Adware.SaveNow : No action taken.
C:\Program Files\Save\save.db -> Adware.SaveNow : No action taken.
C:\Program Files\Save\save.htm -> Adware.SaveNow : No action taken.
C:\Program Files\Save\store.db -> Adware.SaveNow : No action taken.
HKLM\SOFTWARE\Classes\WUSN.1 -> Adware.SaveNow : No action taken.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WhenUSaveMsg -> Adware.SaveNow : No action taken.
HKLM\SOFTWARE\WhenUSave -> Adware.SaveNow : No action taken.
HKLM\SOFTWARE\WhenUSave\Partners -> Adware.SaveNow : No action taken.
HKLM\SOFTWARE\WhenUSave\Partners\EEPE -> Adware.SaveNow : No action taken.
C:\WINDOWS\sysxa7741_7.00.exe -> Heuristic.Win32.Dialer : No action taken.
C:\WINDOWS\system32\paytime.exe -> Hijacker.StartPage.agq : No action taken.
C:\WINDOWS\winmgrs.exe -> Logger.Agent.me : No action taken.
:mozilla.346:C:\Documents and Settings\michal@\Dane aplikacji\Mozilla\Firefox\Profiles\rd9koakt.default\cookies.txt -> TrackingCookie.247realmedia : No action taken.
:mozilla.513:C:\Documents and Settings\michal@\Dane aplikacji\Mozilla\Firefox\Profiles\rd9koakt.default\cookies.txt -> TrackingCookie.247realmedia : No action taken.
:mozilla.104:C:\Documents and Settings\michal@\Dane aplikacji\Mozilla\Firefox\Profiles\rd9koakt.default\cookies.txt -> TrackingCookie.2o7 : No action taken.
:mozilla.105:C:\Documents and Settings\michal@\Dane aplikacji\Mozilla\Firefox\Profiles\rd9koakt.default\cookies.txt -> TrackingCookie.2o7 : No action taken.
:mozilla.106:C:\Documents and Settings\michal@\Dane aplikacji\Mozilla\Firefox\Profiles\rd9koakt.default\cookies.txt -> TrackingCookie.2o7 : No action taken.
:mozilla.107:C:\Documents and Settings\michal@\Dane aplikacji\Mozilla\Firefox\Profiles\rd9koakt.default\cookies.txt -> TrackingCookie.2o7 : No action taken.
:mozilla.108:C:\Documents and Settings\michal@\Dane aplikacji\Mozilla\Firefox\Profiles\rd9koakt.default\cookies.txt -> TrackingCookie.2o7 : No action taken.
:mozilla.629:C:\Documents and Settings\michal@\Dane aplikacji\Mozilla\Firefox\Profiles\rd9koakt.default\cookies.txt -> TrackingCookie.2o7 : No action taken.
:mozilla.630:C:\Documents and Settings\michal@\Dane aplikacji\Mozilla\Firefox\Profiles\rd9koakt.default\cookies.txt -> TrackingCookie.2o7 : No action taken.
:mozilla.631:C:\Documents and Settings\michal@\Dane aplikacji\Mozilla\Firefox\Profiles\rd9koakt.default\cookies.txt -> TrackingCookie.2o7 : No action taken.
:mozilla.632:C:\Documents and Settings\michal@\Dane aplikacji\Mozilla\Firefox\Profiles\rd9koakt.default\cookies.txt -> TrackingCookie.2o7 : No action taken.
:mozilla.633:C:\Documents and Settings\michal@\Dane aplikacji\Mozilla\Firefox\Profiles\rd9koakt.default\cookies.txt -> TrackingCookie.2o7 : No action taken.
:mozilla.634:C:\Documents and Settings\michal@\Dane aplikacji\Mozilla\Firefox\Profiles\rd9koakt.default\cookies.txt -> TrackingCookie.2o7 : No action taken.
:mozilla.635:C:\Documents and Settings\michal@\Dane aplikacji\Mozilla\Firefox\Profiles\rd9koakt.default\cookies.txt -> TrackingCookie.2o7 : No action taken.
:mozilla.636:C:\Documents and Settings\michal@\Dane aplikacji\Mozilla\Firefox\Profiles\rd9koakt.default\cookies.txt -> TrackingCookie.2o7 : No action taken.
:mozilla.637:C:\Documents and Settings\michal@\Dane aplikacji\Mozilla\Firefox\Profiles\rd9koakt.default\cookies.txt -> TrackingCookie.2o7 : No action taken.
:mozilla.638:C:\Documents and Settings\michal@\Dane aplikacji\Mozilla\Firefox\Profiles\rd9koakt.default\cookies.txt -> TrackingCookie.2o7 : No action taken.
:mozilla.823:C:\Documents and Settings\michal@\Dane aplikacji\Mozilla\Firefox\Profiles\rd9koakt.default\cookies.txt -> TrackingCookie.2o7 : No action taken.
C:\Documents and Settings\michal@\Cookies\michal@@2o7[1].txt -> TrackingCookie.2o7 : No action taken.
:mozilla.115:C:\Documents and Settings\michal@\Dane aplikacji\Mozilla\Firefox\Profiles\rd9koakt.default\cookies.txt -> TrackingCookie.Adocean : No action taken.
:mozilla.116:C:\Documents and Settings\michal@\Dane aplikacji\Mozilla\Firefox\Profiles\rd9koakt.default\cookies.txt -> TrackingCookie.Adocean : No action taken.
:mozilla.117:C:\Documents and Settings\michal@\Dane aplikacji\Mozilla\Firefox\Profiles\rd9koakt.default\cookies.txt -> TrackingCookie.Adocean : No action taken.
:mozilla.118:C:\Documents and Settings\michal@\Dane aplikacji\Mozilla\Firefox\Profiles\rd9koakt.default\cookies.txt -> TrackingCookie.Adocean : No action taken.
:mozilla.280:C:\Documents and Settings\michal@\Dane aplikacji\Mozilla\Firefox\Profiles\rd9koakt.default\cookies.txt -> TrackingCookie.Adocean : No action taken.
:mozilla.281:C:\Documents and Settings\michal@\Dane aplikacji\Mozilla\Firefox\Profiles\rd9koakt.default\cookies.txt -> TrackingCookie.Adocean : No action taken.
:mozilla.664:C:\Documents and Settings\michal@\Dane aplikacji\Mozilla\Firefox\Profiles\rd9koakt.default\cookies.txt -> TrackingCookie.Adocean : No action taken.
:mozilla.665:C:\Documents and Settings\michal@\Dane aplikacji\Mozilla\Firefox\Profiles\rd9koakt.default\cookies.txt -> TrackingCookie.Adocean : No action taken.
:mozilla.697:C:\Documents and Settings\michal@\Dane aplikacji\Mozilla\Firefox\Profiles\rd9koakt.default\cookies.txt -> TrackingCookie.Adocean : No action taken.
:mozilla.698:C:\Documents and Settings\michal@\Dane aplikacji\Mozilla\Firefox\Profiles\rd9koakt.default\cookies.txt -> TrackingCookie.Adocean : No action taken.
:mozilla.743:C:\Documents and Settings\michal@\Dane aplikacji\Mozilla\Firefox\Profiles\rd9koakt.default\cookies.txt -> TrackingCookie.Adocean : No action taken.
:mozilla.744:C:\Documents and Settings\michal@\Dane aplikacji\Mozilla\Firefox\Profiles\rd9koakt.default\cookies.txt -> TrackingCookie.Adocean : No action taken.
:mozilla.847:C:\Documents and Settings\michal@\Dane aplikacji\Mozilla\Firefox\Profiles\rd9koakt.default\cookies.txt -> TrackingCookie.Adocean : No action taken.
:mozilla.848:C:\Documents and Settings\michal@\Dane aplikacji\Mozilla\Firefox\Profiles\rd9koakt.default\cookies.txt -> TrackingCookie.Adocean : No action taken.
C:\Documents and Settings\michal@\Cookies\michal@@ad.adocean[2].txt -> TrackingCookie.Adocean : No action taken.
C:\Documents and Settings\michal@\Cookies\michal@@ad.adocean[3].txt -> TrackingCookie.Adocean : No action taken.
C:\Documents and Settings\michal@\Cookies\michal@@gde.adocean[2].txt -> TrackingCookie.Adocean : No action taken.
C:\Documents and Settings\michal@\Cookies\michal@@gde.adocean[3].txt -> TrackingCookie.Adocean : No action taken.
C:\Documents and Settings\michal@\Cookies\michal@@idg.adocean[1].txt -> TrackingCookie.Adocean : No action taken.
C:\Documents and Settings\michal@\Cookies\michal@@my.adocean[2].txt -> TrackingCookie.Adocean : No action taken.
:mozilla.525:C:\Documents and Settings\michal@\Dane aplikacji\Mozilla\Firefox\Profiles\rd9koakt.default\cookies.txt -> TrackingCookie.Adtech : No action taken.
:mozilla.526:C:\Documents and Settings\michal@\Dane aplikacji\Mozilla\Firefox\Profiles\rd9koakt.default\cookies.txt -> TrackingCookie.Adtech : No action taken.
:mozilla.335:C:\Documents and Settings\michal@\Dane aplikacji\Mozilla\Firefox\Profiles\rd9koakt.default\cookies.txt -> TrackingCookie.Advertising : No action taken.
:mozilla.336:C:\Documents and Settings\michal@\Dane aplikacji\Mozilla\Firefox\Profiles\rd9koakt.default\cookies.txt -> TrackingCookie.Advertising : No action taken.
:mozilla.779:C:\Documents and Settings\michal@\Dane aplikacji\Mozilla\Firefox\Profiles\rd9koakt.default\cookies.txt -> TrackingCookie.Advertising : No action taken.
:mozilla.780:C:\Documents and Settings\michal@\Dane aplikacji\Mozilla\Firefox\Profiles\rd9koakt.default\cookies.txt -> TrackingCookie.Advertising : No action taken.
:mozilla.781:C:\Documents and Settings\michal@\Dane aplikacji\Mozilla\Firefox\Profiles\rd9koakt.default\cookies.txt -> TrackingCookie.Advertising : No action taken.
:mozilla.782:C:\Documents and Settings\michal@\Dane aplikacji\Mozilla\Firefox\Profiles\rd9koakt.default\cookies.txt -> TrackingCookie.Advertising : No action taken.
C:\Documents and Settings\michal@\Cookies\michal@@advertising[1].txt -> TrackingCookie.Advertising : No action taken.
:mozilla.174:C:\Documents and Settings\michal@\Dane aplikacji\Mozilla\Firefox\Profiles\rd9koakt.default\cookies.txt -> TrackingCookie.Atdmt : No action taken.
:mozilla.857:C:\Documents and Settings\michal@\Dane aplikacji\Mozilla\Firefox\Profiles\rd9koakt.default\cookies.txt -> TrackingCookie.Burstnet : No action taken.
:mozilla.858:C:\Documents and Settings\michal@\Dane aplikacji\Mozilla\Firefox\Profiles\rd9koakt.default\cookies.txt -> TrackingCookie.Burstnet : No action taken.
:mozilla.100:C:\Documents and Settings\michal@\Dane aplikacji\Mozilla\Firefox\Profiles\rd9koakt.default\cookies.txt -> TrackingCookie.Casalemedia : No action taken.
:mozilla.101:C:\Documents and Settings\michal@\Dane aplikacji\Mozilla\Firefox\Profiles\rd9koakt.default\cookies.txt -> TrackingCookie.Casalemedia : No action taken.
:mozilla.774:C:\Documents and Settings\michal@\Dane aplikacji\Mozilla\Firefox\Profiles\rd9koakt.default\cookies.txt -> TrackingCookie.Clickhype : No action taken.
:mozilla.750:C:\Documents and Settings\michal@\Dane aplikacji\Mozilla\Firefox\Profiles\rd9koakt.default\cookies.txt -> TrackingCookie.Clickzs : No action taken.
:mozilla.751:C:\Documents and Settings\michal@\Dane aplikacji\Mozilla\Firefox\Profiles\rd9koakt.default\cookies.txt -> TrackingCookie.Clickzs : No action taken.
:mozilla.740:C:\Documents and Settings\michal@\Dane aplikacji\Mozilla\Firefox\Profiles\rd9koakt.default\cookies.txt -> TrackingCookie.Com : No action taken.
:mozilla.741:C:\Documents and Settings\michal@\Dane aplikacji\Mozilla\Firefox\Profiles\rd9koakt.default\cookies.txt -> TrackingCookie.Com : No action taken.
:mozilla.212:C:\Documents and Settings\michal@\Dane aplikacji\Mozilla\Firefox\Profiles\rd9koakt.default\cookies.txt -> TrackingCookie.Coremetrics : No action taken.
:mozilla.187:C:\Documents and Settings\michal@\Dane aplikacji\Mozilla\Firefox\Profiles\rd9koakt.default\cookies.txt -> TrackingCookie.Doubleclick : No action taken.
C:\Documents and Settings\michal@\Cookies\michal@@doubleclick[1].txt -> TrackingCookie.Doubleclick : No action taken.
:mozilla.875:C:\Documents and Settings\michal@\Dane aplikacji\Mozilla\Firefox\Profiles\rd9koakt.default\cookies.txt -> TrackingCookie.Esomniture : No action taken.
:mozilla.735:C:\Documents and Settings\michal@\Dane aplikacji\Mozilla\Firefox\Profiles\rd9koakt.default\cookies.txt -> TrackingCookie.Estat : No action taken.
:mozilla.327:C:\Documents and Settings\michal@\Dane aplikacji\Mozilla\Firefox\Profiles\rd9koakt.default\cookies.txt -> TrackingCookie.Euroclick : No action taken.
:mozilla.328:C:\Documents and Settings\michal@\Dane aplikacji\Mozilla\Firefox\Profiles\rd9koakt.default\cookies.txt -> TrackingCookie.Euroclick : No action taken.
:mozilla.176:C:\Documents and Settings\michal@\Dane aplikacji\Mozilla\Firefox\Profiles\rd9koakt.default\cookies.txt -> TrackingCookie.Fastclick : No action taken.
:mozilla.177:C:\Documents and Settings\michal@\Dane aplikacji\Mozilla\Firefox\Profiles\rd9koakt.default\cookies.txt -> TrackingCookie.Fastclick : No action taken.
:mozilla.179:C:\Documents and Settings\michal@\Dane aplikacji\Mozilla\Firefox\Profiles\rd9koakt.default\cookies.txt -> TrackingCookie.Fastclick : No action taken.
:mozilla.924:C:\Documents and Settings\michal@\Dane aplikacji\Mozilla\Firefox\Profiles\rd9koakt.default\cookies.txt -> TrackingCookie.Fastclick : No action taken.
C:\Documents and Settings\michal@\Cookies\michal@@fastclick[1].txt -> TrackingCookie.Fastclick : No action taken.
C:\Documents and Settings\michal@\Cookies\michal@@fastclick[2].txt -> TrackingCookie.Fastclick : No action taken.
C:\Documents and Settings\michal@\Cookies\michal@@media.fastclick[1].txt -> TrackingCookie.Fastclick : No action taken.
C:\Documents and Settings\michal@\Cookies\michal@@media.fastclick[2].txt -> TrackingCookie.Fastclick : No action taken.
:mozilla.235:C:\Documents and Settings\michal@\Dane aplikacji\Mozilla\Firefox\Profiles\rd9koakt.default\cookies.txt -> TrackingCookie.Hitbox : No action taken.
C:\Documents and Settings\michal@\Cookies\michal@@ehg-acdsystems.hitbox[1].txt -> TrackingCookie.Hitbox : No action taken.
C:\Documents and Settings\michal@\Cookies\michal@@ehg-dig.hitbox[1].txt -> TrackingCookie.Hitbox : No action taken.
C:\Documents and Settings\michal@\Cookies\michal@@hitbox[1].txt -> TrackingCookie.Hitbox : No action taken.
C:\Documents and Settings\michal@\Cookies\michal@@hitbox[3].txt -> TrackingCookie.Hitbox : No action taken.
:mozilla.321:C:\Documents and Settings\michal@\Dane aplikacji\Mozilla\Firefox\Profiles\rd9koakt.default\cookies.txt -> TrackingCookie.Hitslink : No action taken.
:mozilla.322:C:\Documents and Settings\michal@\Dane aplikacji\Mozilla\Firefox\Profiles\rd9koakt.default\cookies.txt -> TrackingCookie.Hitslink : No action taken.
:mozilla.323:C:\Documents and Settings\michal@\Dane aplikacji\Mozilla\Firefox\Profiles\rd9koakt.default\cookies.txt -> TrackingCookie.Hitslink : No action taken.
:mozilla.324:C:\Documents and Settings\michal@\Dane aplikacji\Mozilla\Firefox\Profiles\rd9koakt.default\cookies.txt -> TrackingCookie.Hitslink : No action taken.
:mozilla.169:C:\Documents and Settings\michal@\Dane aplikacji\Mozilla\Firefox\Profiles\rd9koakt.default\cookies.txt -> TrackingCookie.Hotlog : No action taken.
:mozilla.435:C:\Documents and Settings\michal@\Dane aplikacji\Mozilla\Firefox\Profiles\rd9koakt.default\cookies.txt -> TrackingCookie.Hotlog : No action taken.
C:\Documents and Settings\michal@\Cookies\michal@@ilead.itrack[2].txt -> TrackingCookie.Itrack : No action taken.
:mozilla.17:C:\Documents and Settings\michal@\Dane aplikacji\Mozilla\Firefox\Profiles\rd9koakt.default\cookies.txt -> TrackingCookie.Ivwbox : No action taken.
:mozilla.527:C:\Documents and Settings\michal@\Dane aplikacji\Mozilla\Firefox\Profiles\rd9koakt.default\cookies.txt -> TrackingCookie.Ivwbox : No action taken.
:mozilla.880:C:\Documents and Settings\michal@\Dane aplikacji\Mozilla\Firefox\Profiles\rd9koakt.default\cookies.txt -> TrackingCookie.Ivwbox : No action taken.
:mozilla.181:C:\Documents and Settings\michal@\Dane aplikacji\Mozilla\Firefox\Profiles\rd9koakt.default\cookies.txt -> TrackingCookie.Masterstats : No action taken.
:mozilla.579:C:\Documents and Settings\michal@\Dane aplikacji\Mozilla\Firefox\Profiles\rd9koakt.default\cookies.txt -> TrackingCookie.Mediaplex : No action taken.
C:\Documents and Settings\michal@\Cookies\michal@@mediaplex[1].txt -> TrackingCookie.Mediaplex : No action taken.
:mozilla.753:C:\Documents and Settings\michal@\Dane aplikacji\Mozilla\Firefox\Profiles\rd9koakt.default\cookies.txt -> TrackingCookie.Onestat : No action taken.
:mozilla.754:C:\Documents and Settings\michal@\Dane aplikacji\Mozilla\Firefox\Profiles\rd9koakt.default\cookies.txt -> TrackingCookie.Onestat : No action taken.
:mozilla.755:C:\Documents and Settings\michal@\Dane aplikacji\Mozilla\Firefox\Profiles\rd9koakt.default\cookies.txt -> TrackingCookie.Onestat : No action taken.
:mozilla.756:C:\Documents and Settings\michal@\Dane aplikacji\Mozilla\Firefox\Profiles\rd9koakt.default\cookies.txt -> TrackingCookie.Onestat : No action taken.
:mozilla.757:C:\Documents and Settings\michal@\Dane aplikacji\Mozilla\Firefox\Profiles\rd9koakt.default\cookies.txt -> TrackingCookie.Onestat : No action taken.
:mozilla.758:C:\Documents and Settings\michal@\Dane aplikacji\Mozilla\Firefox\Profiles\rd9koakt.default\cookies.txt -> TrackingCookie.Onestat : No action taken.
:mozilla.759:C:\Documents and Settings\michal@\Dane aplikacji\Mozilla\Firefox\Profiles\rd9koakt.default\cookies.txt -> TrackingCookie.Onestat : No action taken.
:mozilla.787:C:\Documents and Settings\michal@\Dane aplikacji\Mozilla\Firefox\Profiles\rd9koakt.default\cookies.txt -> TrackingCookie.Overture : No action taken.
:mozilla.788:C:\Documents and Settings\michal@\Dane aplikacji\Mozilla\Firefox\Profiles\rd9koakt.default\cookies.txt -> TrackingCookie.Overture : No action taken.
:mozilla.224:C:\Documents and Settings\michal@\Dane aplikacji\Mozilla\Firefox\Profiles\rd9koakt.default\cookies.txt -> TrackingCookie.Paycounter : No action taken.
:mozilla.338:C:\Documents and Settings\michal@\Dane aplikacji\Mozilla\Firefox\Profiles\rd9koakt.default\cookies.txt -> TrackingCookie.Pointroll : No action taken.
:mozilla.339:C:\Documents and Settings\michal@\Dane aplikacji\Mozilla\Firefox\Profiles\rd9koakt.default\cookies.txt -> TrackingCookie.Pointroll : No action taken.
:mozilla.340:C:\Documents and Settings\michal@\Dane aplikacji\Mozilla\Firefox\Profiles\rd9koakt.default\cookies.txt -> TrackingCookie.Pointroll : No action taken.
:mozilla.341:C:\Documents and Settings\michal@\Dane aplikacji\Mozilla\Firefox\Profiles\rd9koakt.default\cookies.txt -> TrackingCookie.Pointroll : No action taken.
:mozilla.342:C:\Documents and Settings\michal@\Dane aplikacji\Mozilla\Firefox\Profiles\rd9koakt.default\cookies.txt -> TrackingCookie.Pointroll : No action taken.
:mozilla.343:C:\Documents and Settings\michal@\Dane aplikacji\Mozilla\Firefox\Profiles\rd9koakt.default\cookies.txt -> TrackingCookie.Pointroll : No action taken.
:mozilla.173:C:\Documents and Settings\michal@\Dane aplikacji\Mozilla\Firefox\Profiles\rd9koakt.default\cookies.txt -> TrackingCookie.Questionmarket : No action taken.
:mozilla.175:C:\Documents and Settings\michal@\Dane aplikacji\Mozilla\Firefox\Profiles\rd9koakt.default\cookies.txt -> TrackingCookie.Questionmarket : No action taken.
C:\Documents and Settings\michal@\Cookies\michal@@questionmarket[1].txt -> TrackingCookie.Questionmarket : No action taken.
:mozilla.371:C:\Documents and Settings\michal@\Dane aplikacji\Mozilla\Firefox\Profiles\rd9koakt.default\cookies.txt -> TrackingCookie.Revenue : No action taken.
:mozilla.310:C:\Documents and Settings\michal@\Dane aplikacji\Mozilla\Firefox\Profiles\rd9koakt.default\cookies.txt -> TrackingCookie.Ru4 : No action taken.
:mozilla.311:C:\Documents and Settings\michal@\Dane aplikacji\Mozilla\Firefox\Profiles\rd9koakt.default\cookies.txt -> TrackingCookie.Ru4 : No action taken.
:mozilla.288:C:\Documents and Settings\michal@\Dane aplikacji\Mozilla\Firefox\Profiles\rd9koakt.default\cookies.txt -> TrackingCookie.Serving-sys : No action taken.
:mozilla.289:C:\Documents and Settings\michal@\Dane aplikacji\Mozilla\Firefox\Profiles\rd9koakt.default\cookies.txt -> TrackingCookie.Serving-sys : No action taken.
:mozilla.290:C:\Documents and Settings\michal@\Dane aplikacji\Mozilla\Firefox\Profiles\rd9koakt.default\cookies.txt -> TrackingCookie.Serving-sys : No action taken.
:mozilla.291:C:\Documents and Settings\michal@\Dane aplikacji\Mozilla\Firefox\Profiles\rd9koakt.default\cookies.txt -> TrackingCookie.Serving-sys : No action taken.
:mozilla.881:C:\Documents and Settings\michal@\Dane aplikacji\Mozilla\Firefox\Profiles\rd9koakt.default\cookies.txt -> TrackingCookie.Serving-sys : No action taken.
:mozilla.882:C:\Documents and Settings\michal@\Dane aplikacji\Mozilla\Firefox\Profiles\rd9koakt.default\cookies.txt -> TrackingCookie.Serving-sys : No action taken.
:mozilla.883:C:\Documents and Settings\michal@\Dane aplikacji\Mozilla\Firefox\Profiles\rd9koakt.default\cookies.txt -> TrackingCookie.Serving-sys : No action taken.
:mozilla.884:C:\Documents and Settings\michal@\Dane aplikacji\Mozilla\Firefox\Profiles\rd9koakt.default\cookies.txt -> TrackingCookie.Serving-sys : No action taken.
:mozilla.680:C:\Documents and Settings\michal@\Dane aplikacji\Mozilla\Firefox\Profiles\rd9koakt.default\cookies.txt -> TrackingCookie.cenzura-spam : No action taken.
:mozilla.681:C:\Documents and Settings\michal@\Dane aplikacji\Mozilla\Firefox\Profiles\rd9koakt.default\cookies.txt -> TrackingCookie.cenzura-spam : No action taken.
:mozilla.682:C:\Documents and Settings\michal@\Dane aplikacji\Mozilla\Firefox\Profiles\rd9koakt.default\cookies.txt -> TrackingCookie.cenzura-spam : No action taken.
:mozilla.163:C:\Documents and Settings\michal@\Dane aplikacji\Mozilla\Firefox\Profiles\rd9koakt.default\cookies.txt -> TrackingCookie.Spylog : No action taken.
:mozilla.502:C:\Documents and Settings\michal@\Dane aplikacji\Mozilla\Firefox\Profiles\rd9koakt.default\cookies.txt -> TrackingCookie.Spylog : No action taken.
:mozilla.205:C:\Documents and Settings\michal@\Dane aplikacji\Mozilla\Firefox\Profiles\rd9koakt.default\cookies.txt -> TrackingCookie.Statcounter : No action taken.
:mozilla.593:C:\Documents and Settings\michal@\Dane aplikacji\Mozilla\Firefox\Profiles\rd9koakt.default\cookies.txt -> TrackingCookie.Statcounter : No action taken.
:mozilla.594:C:\Documents and Settings\michal@\Dane aplikacji\Mozilla\Firefox\Profiles\rd9koakt.default\cookies.txt -> TrackingCookie.Statcounter : No action taken.
:mozilla.595:C:\Documents and Settings\michal@\Dane aplikacji\Mozilla\Firefox\Profiles\rd9koakt.default\cookies.txt -> TrackingCookie.Statcounter : No action taken.
:mozilla.596:C:\Documents and Settings\michal@\Dane aplikacji\Mozilla\Firefox\Profiles\rd9koakt.default\cookies.txt -> TrackingCookie.Statcounter : No action taken.
:mozilla.597:C:\Documents and Settings\michal@\Dane aplikacji\Mozilla\Firefox\Profiles\rd9koakt.default\cookies.txt -> TrackingCookie.Statcounter : No action taken.
:mozilla.598:C:\Documents and Settings\michal@\Dane aplikacji\Mozilla\Firefox\Profiles\rd9koakt.default\cookies.txt -> TrackingCookie.Statcounter : No action taken.
:mozilla.599:C:\Documents and Settings\michal@\Dane aplikacji\Mozilla\Firefox\Profiles\rd9koakt.default\cookies.txt -> TrackingCookie.Statcounter : No action taken.
:mozilla.600:C:\Documents and Settings\michal@\Dane aplikacji\Mozilla\Firefox\Profiles\rd9koakt.default\cookies.txt -> TrackingCookie.Statcounter : No action taken.
:mozilla.601:C:\Documents and Settings\michal@\Dane aplikacji\Mozilla\Firefox\Profiles\rd9koakt.default\cookies.txt -> TrackingCookie.Statcounter : No action taken.
:mozilla.602:C:\Documents and Settings\michal@\Dane aplikacji\Mozilla\Firefox\Profiles\rd9koakt.default\cookies.txt -> TrackingCookie.Statcounter : No action taken.
:mozilla.603:C:\Documents and Settings\michal@\Dane aplikacji\Mozilla\Firefox\Profiles\rd9koakt.default\cookies.txt -> TrackingCookie.Statcounter : No action taken.
:mozilla.604:C:\Documents and Settings\michal@\Dane aplikacji\Mozilla\Firefox\Profiles\rd9koakt.default\cookies.txt -> TrackingCookie.Statcounter : No action taken.
:mozilla.605:C:\Documents and Settings\michal@\Dane aplikacji\Mozilla\Firefox\Profiles\rd9koakt.default\cookies.txt -> TrackingCookie.Statcounter : No action taken.
:mozilla.606:C:\Documents and Settings\michal@\Dane aplikacji\Mozilla\Firefox\Profiles\rd9koakt.default\cookies.txt -> TrackingCookie.Statcounter : No action taken.
:mozilla.607:C:\Documents and Settings\michal@\Dane aplikacji\Mozilla\Firefox\Profiles\rd9koakt.default\cookies.txt -> TrackingCookie.Statcounter : No action taken.
:mozilla.608:C:\Documents and Settings\michal@\Dane aplikacji\Mozilla\Firefox\Profiles\rd9koakt.default\cookies.txt -> TrackingCookie.Statcounter : No action taken.
C:\Documents and Settings\michal@\Cookies\michal@@statcounter[1].txt -> TrackingCookie.Statcounter : No action taken.
C:\Documents and Settings\michal@\Cookies\michal@@statcounter[2].txt -> TrackingCookie.Statcounter : No action taken.
:mozilla.350:C:\Documents and Settings\michal@\Dane aplikacji\Mozilla\Firefox\Profiles\rd9koakt.default\cookies.txt -> TrackingCookie.Targetnet : No action taken.
:mozilla.351:C:\Documents and Settings\michal@\Dane aplikacji\Mozilla\Firefox\Profiles\rd9koakt.default\cookies.txt -> TrackingCookie.Targetnet : No action taken.
:mozilla.897:C:\Documents and Settings\michal@\Dane aplikacji\Mozilla\Firefox\Profiles\rd9koakt.default\cookies.txt -> TrackingCookie.Targetnet : No action taken.
:mozilla.54:C:\Documents and Settings\michal@\Dane aplikacji\Mozilla\Firefox\Profiles\rd9koakt.default\cookies.txt -> TrackingCookie.Tradedoubler : No action taken.
:mozilla.55:C:\Documents and Settings\michal@\Dane aplikacji\Mozilla\Firefox\Profiles\rd9koakt.default\cookies.txt -> TrackingCookie.Tradedoubler : No action taken.
:mozilla.56:C:\Documents and Settings\michal@\Dane aplikacji\Mozilla\Firefox\Profiles\rd9koakt.default\cookies.txt -> TrackingCookie.Tradedoubler : No action taken.
:mozilla.57:C:\Documents and Settings\michal@\Dane aplikacji\Mozilla\Firefox\Profiles\rd9koakt.default\cookies.txt -> TrackingCookie.Tradedoubler : No action taken.
:mozilla.58:C:\Documents and Settings\michal@\Dane aplikacji\Mozilla\Firefox\Profiles\rd9koakt.default\cookies.txt -> TrackingCookie.Tradedoubler : No action taken.
C:\Documents and Settings\michal@\Cookies\michal@@tradedoubler[1].txt -> TrackingCookie.Tradedoubler : No action taken.
C:\Documents and Settings\michal@\Cookies\michal@@tradedoubler[3].txt -> TrackingCookie.Tradedoubler : No action taken.
:mozilla.102:C:\Documents and Settings\michal@\Dane aplikacji\Mozilla\Firefox\Profiles\rd9koakt.default\cookies.txt -> TrackingCookie.Tribalfusion : No action taken.
C:\Documents and Settings\michal@\Cookies\michal@@tribalfusion[1].txt -> TrackingCookie.Tribalfusion : No action taken.
:mozilla.618:C:\Documents and Settings\michal@\Dane aplikacji\Mozilla\Firefox\Profiles\rd9koakt.default\cookies.txt -> TrackingCookie.Valueclick : No action taken.
:mozilla.495:C:\Documents and Settings\michal@\Dane aplikacji\Mozilla\Firefox\Profiles\rd9koakt.default\cookies.txt -> TrackingCookie.Vegasred : No action taken.
:mozilla.496:C:\Documents and Settings\michal@\Dane aplikacji\Mozilla\Firefox\Profiles\rd9koakt.default\cookies.txt -> TrackingCookie.Vegasred : No action taken.
:mozilla.789:C:\Documents and Settings\michal@\Dane aplikacji\Mozilla\Firefox\Profiles\rd9koakt.default\cookies.txt -> TrackingCookie.Webtrendslive : No action taken.
:mozilla.790:C:\Documents and Settings\michal@\Dane aplikacji\Mozilla\Firefox\Profiles\rd9koakt.default\cookies.txt -> TrackingCookie.Webtrendslive : No action taken.
:mozilla.166:C:\Documents and Settings\michal@\Dane aplikacji\Mozilla\Firefox\Profiles\rd9koakt.default\cookies.txt -> TrackingCookie.Yadro : No action taken.
:mozilla.168:C:\Documents and Settings\michal@\Dane aplikacji\Mozilla\Firefox\Profiles\rd9koakt.default\cookies.txt -> TrackingCookie.Yadro : No action taken.
:mozilla.481:C:\Documents and Settings\michal@\Dane aplikacji\Mozilla\Firefox\Profiles\rd9koakt.default\cookies.txt -> TrackingCookie.Yadro : No action taken.
:mozilla.150:C:\Documents and Settings\michal@\Dane aplikacji\Mozilla\Firefox\Profiles\rd9koakt.default\cookies.txt -> TrackingCookie.Yieldmanager : No action taken.
:mozilla.151:C:\Documents and Settings\michal@\Dane aplikacji\Mozilla\Firefox\Profiles\rd9koakt.default\cookies.txt -> TrackingCookie.Yieldmanager : No action taken.
:mozilla.373:C:\Documents and Settings\michal@\Dane aplikacji\Mozilla\Firefox\Profiles\rd9koakt.default\cookies.txt -> TrackingCookie.Zedo : No action taken.
:mozilla.374:C:\Documents and Settings\michal@\Dane aplikacji\Mozilla\Firefox\Profiles\rd9koakt.default\cookies.txt -> TrackingCookie.Zedo : No action taken.
C:\WINDOWS\internt.exe -> Trojan.LipGame.n : No action taken.
C:\WINDOWS\hosts -> Trojan.Qhost.el : No action taken.
D:\BitComet\Downloads\Ship.Simulator.2006-RiTUEL\r-shis01.zip/cracktro.exe -> Worm.Mytob.bt : No action taken.
D:\GRY\ship\cracktro.exe -> Worm.Mytob.bt : No action taken.

::Report end

log hijack

Logfile of HijackThis v1.99.1
Scan saved at 18:19:58, on 2006-07-05
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\SYSTEM32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\SYSTEM32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe
C:\PROGRA~1\NEOSTR~1\CnxMon.exe
C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe
C:\Program Files\D-Tools\daemon.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\ewido anti-spyware 4.0\guard.exe
C:\PROGRA~1\NEOSTR~1\NeostradaTP.exe
C:\PROGRA~1\NEOSTR~1\ComComp.exe
C:\PROGRA~1\NEOSTR~1\Watch.exe
C:\Program Files\Opera\Opera.exe
C:\Documents and Settings\michal@\Pulpit\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://users.iptelecom.net.ua/~codecs/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Neostrada TP
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\NEOSTR~1\SEARCH~1.DLL
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon
O4 - HKLM\..\Run: [WooCnxMon] C:\PROGRA~1\NEOSTR~1\CnxMon.exe
O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\NEOSTR~1\Watch.exe
O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [!ewido] "C:\Program Files\ewido anti-spyware 4.0\ewido.exe" /minimized
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Uptime-Project] C:\Documents and Settings\michal@\Pulpit\client.exe
O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O9 - Extra button: Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O16 - DPF: {41ACD49D-1974-791A-0981-AA9872721044} (Ganymede Board Games) - http://67.15.101.3/g_bin/pl/boards_2_0_0_24.cab
O16 - DPF: {A1FE3DE0-CF77-11D4-8340-0080C8D7ED4A} (GameDesire Pinball Demon) - http://67.15.101.3/g_bin/pl/demon_2_0_0_21.cab
O16 - DPF: {E95CF138-A587-4C54-8175-3AD80997CB14} (GameDesire Soccer) - http://67.15.101.3/g_bin/pl/soccer_2_0_0_10.cab
O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C1} (GameDesire Pool - http://67.15.101.3/g_bin/pl/billard8_2_0_0_24.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{68EBB959-DFE1-41CA-B3B8-2F0D6C6B4C59}: NameServer = 194.204.152.34 217.98.63.164
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe

**Posty:** 18165 · przez **wojtas** 05 Lip 2006, 18:28

log z hijacka czysty

daj jeszcze z sillenta log

otwierasz link>> http://www.silentrunners.org/Silent%20Runners.vbs >>zapisujesz jako na pulpicie>>klikasz dwa razy >>masz wybor i wybierasz no>>i czekasz troszke az wygeneruje sie cały log do konca
wrzucasz na forum

**Posty:** 94 · przez **mike00** 05 Lip 2006, 18:31

log czysty ale jak robie test to mi smieszna predkosc wychodzi co radzicie :cry:

///edit
log silent runers

"Silent Runners.vbs", revision 46, http://www.silentrunners.org/
Operating System: Windows XP SP2
Output limited to non-default values, except where indicated by "{++}"

Startup items buried in registry:
---------------------------------

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++}
"CTFMON.EXE" = "C:\WINDOWS\system32\ctfmon.exe" [MS]
"Uptime-Project" = "C:\Documents and Settings\michal@\Pulpit\client.exe" [file not found]
"Gadu-Gadu" = ""C:\Program Files\Gadu-Gadu\gg.exe" /tray" ["Gadu-Gadu Sp. z oo"]

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++}
"SoundMan" = "SOUNDMAN.EXE" ["Realtek Semiconductor Corp."]
"SpeedTouch USB Diagnostics" = ""C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon" ["THOMSON Telecom Belgium"]
"WooCnxMon" = "C:\PROGRA~1\NEOSTR~1\CnxMon.exe" [empty string]
"WOOWATCH" = "C:\PROGRA~1\NEOSTR~1\Watch.exe" ["France Télécom R&D"]
"WOOTASKBARICON" = "C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe" ["France Télécom R&D"]
"DAEMON Tools-1033" = ""C:\Program Files\D-Tools\daemon.exe" -lang 1033" ["DAEMON'S HOME"]
"NeroCheck" = "C:\WINDOWS\system32\NeroCheck.exe" ["Ahead Software Gmbh"]
"SunJavaUpdateSched" = "C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe" ["Sun Microsystems, Inc."]
"avast!" = "C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [null data]
"WinampAgent" = "C:\Program Files\Winamp\winampa.exe" [null data]
"TkBellExe" = ""C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot" ["RealNetworks, Inc."]
"!ewido" = ""C:\Program Files\ewido anti-spyware 4.0\ewido.exe" /minimized" ["Anti-Malware Development a.s."]

HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\(Default) = (no title provided)
-> {HKLM...CLSID} = "AcroIEHlprObj Class"
\InProcServer32\(Default) = "C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll" ["Adobe Systems Incorporated"]
{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\(Default) = (no title provided)
-> {HKLM...CLSID} = "SSVHelper Class"
\InProcServer32\(Default) = "C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll" ["Sun Microsystems, Inc."]

HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\
"{42071714-76d4-11d1-8b24-00a0c9068ff3}" = "Rozszerzenie CPL kadrowania wyświetlania"
-> {HKLM...CLSID} = "Rozszerzenie CPL kadrowania wyświetlania"
\InProcServer32\(Default) = "deskpan.dll" [file not found]
"{88895560-9AA2-1069-930E-00AA0030EBC8}" = "Rozszerzenie ikony HyperTerminalu"
-> {HKLM...CLSID} = "HyperTerminal Icon Ext"
\InProcServer32\(Default) = "C:\WINDOWS\system32\hticons.dll" ["Hilgraeve, Inc."]
"{B41DB860-8EE4-11D2-9906-E49FADC173CA}" = "WinRAR shell extension"
-> {HKLM...CLSID} = "WinRAR"
\InProcServer32\(Default) = "D:\programy\rar\rarext.dll" [null data]
"{640167b4-59b0-47a6-b335-a6b3c0695aea}" = "Portable Media Devices"
-> {HKLM...CLSID} = "Portable Media Devices"
\InProcServer32\(Default) = "C:\WINDOWS\system32\Audiodev.dll" [MS]
"{cc86590a-b60a-48e6-996b-41d25ed39a1e}" = "Portable Media Devices Menu"
-> {HKLM...CLSID} = "Portable Media Devices Menu"
\InProcServer32\(Default) = "C:\WINDOWS\system32\Audiodev.dll" [MS]
"{472083B0-C522-11CF-8763-00608CC02F24}" = "avast"
-> {HKLM...CLSID} = "avast"
\InProcServer32\(Default) = "C:\Program Files\Alwil Software\Avast4\ashShell.dll" ["ALWIL Software"]
"{F0CB00CD-5A07-4D91-97F5-A8C92CDA93E4}" = "Shell Extensions for RealOne Player"
-> {HKLM...CLSID} = "RealOne Player Context Menu Class"
\InProcServer32\(Default) = "C:\Program Files\Real\RealPlayer\rpshell.dll" ["RealNetworks, Inc."]

HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\
INFECTION WARNING! "{57B86673-276A-48B2-BAE7-C6DBB3020EB8}" = "ewido anti-spyware 4.0"
-> {HKLM...CLSID} = "CShellExecuteHookImpl Object"
\InProcServer32\(Default) = "C:\Program Files\ewido anti-spyware 4.0\shellexecutehook.dll" ["Anti-Malware Development a.s."]

HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\
INFECTION WARNING! AtiExtEvent\DLLName = "Ati2evxx.dll" ["ATI Technologies Inc."]

HKLM\Software\Classes\Folder\shellex\ColumnHandlers\
{F9DB5320-233E-11D1-9F84-707F02C10627}\(Default) = "PDF Column Info"
-> {HKLM...CLSID} = "PDF Shell Extension"
\InProcServer32\(Default) = "C:\Program Files\Adobe\Acrobat 7.0\ActiveX\PDFShell.dll" ["Adobe Systems, Inc."]

HKLM\Software\Classes\*\shellex\ContextMenuHandlers\
avast\(Default) = "{472083B0-C522-11CF-8763-00608CC02F24}"
-> {HKLM...CLSID} = "avast"
\InProcServer32\(Default) = "C:\Program Files\Alwil Software\Avast4\ashShell.dll" ["ALWIL Software"]
ewido anti-spyware\(Default) = "{8934FCEF-F5B8-468f-951F-78A921CD3920}"
-> {HKLM...CLSID} = "CContextScan Object"
\InProcServer32\(Default) = "C:\Program Files\ewido anti-spyware 4.0\context.dll" ["Anti-Malware Development a.s."]
WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
-> {HKLM...CLSID} = "WinRAR"
\InProcServer32\(Default) = "D:\programy\rar\rarext.dll" [null data]

HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\
ewido anti-spyware\(Default) = "{8934FCEF-F5B8-468f-951F-78A921CD3920}"
-> {HKLM...CLSID} = "CContextScan Object"
\InProcServer32\(Default) = "C:\Program Files\ewido anti-spyware 4.0\context.dll" ["Anti-Malware Development a.s."]
WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
-> {HKLM...CLSID} = "WinRAR"
\InProcServer32\(Default) = "D:\programy\rar\rarext.dll" [null data]

HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\
avast\(Default) = "{472083B0-C522-11CF-8763-00608CC02F24}"
-> {HKLM...CLSID} = "avast"
\InProcServer32\(Default) = "C:\Program Files\Alwil Software\Avast4\ashShell.dll" ["ALWIL Software"]
WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
-> {HKLM...CLSID} = "WinRAR"
\InProcServer32\(Default) = "D:\programy\rar\rarext.dll" [null data]

Active Desktop and Wallpaper:
-----------------------------

Active Desktop is disabled at this entry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState

HKCU\Control Panel\Desktop\
"Wallpaper" = "C:\Documents and Settings\michal@\Dane aplikacji\Opera\Opera\profile\Skin\tapeta4_1024.bmp"

Startup items in "michal@" & "All Users" startup folders:
---------------------------------------------------------

C:\Documents and Settings\michal@\Menu Start\Programy\Autostart
"Adobe Gamma" -> shortcut to: "C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe" ["Adobe Systems, Inc."]

Winsock2 Service Provider DLLs:
-------------------------------

Namespace Service Providers

HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++}
000000000001\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]
000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS]
000000000003\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]

Transport Service Providers

HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++}
0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range:
%SystemRoot%\system32\mswsock.dll [MS], 01 - 03, 06 - 15
%SystemRoot%\system32\rsvpsp.dll [MS], 04 - 05

Toolbars, Explorer Bars, Extensions:
------------------------------------

Explorer Bars

Dormant Explorer Bars in "View, Explorer Bar" menu

HKLM\Software\Classes\CLSID\{01002DB2-8170-4D9B-A8B1-DDC9DD114E03}\(Default) = "Volet Wanadoo"
Implemented Categories\{00021494-0000-0000-C000-000000000046}\ [horizontal bar]
InProcServer32\(Default) = "C:\PROGRA~1\NEOSTR~1\audience\audience.dll" [empty string]

HKLM\Software\Classes\CLSID\{3BAF4A27-C764-4E1A-A6F4-62F7A7E5E51C}\(Default) = "ToolBand Class"
Implemented Categories\{00021494-0000-0000-C000-000000000046}\ [horizontal bar]
InProcServer32\(Default) = "C:\PROGRA~1\NEOSTR~1\audience\audience.dll" [empty string]

HKLM\Software\Classes\CLSID\{5BF498C0-931E-4A4F-B33F-456D07137EAA}\(Default) = "Volet Wanadoo"
Implemented Categories\{00021494-0000-0000-C000-000000000046}\ [horizontal bar]
InProcServer32\(Default) = "C:\PROGRA~1\NEOSTR~1\audience\audience.dll" [empty string]

Extensions (Tools menu items, main toolbar menu buttons)

HKLM\Software\Microsoft\Internet Explorer\Extensions\
{08B0E5C0-4FCB-11CF-AAA5-00401C608501}\
"MenuText" = "Sun Java Console"
"CLSIDExtension" = "{CAFEEFAC-0015-0000-0006-ABCDEFFEDCBC}"
-> {HKCU...CLSID} = "Java Plug-in"
\InProcServer32\(Default) = "C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll" ["Sun Microsystems, Inc."]
-> {HKLM...CLSID} = "Java Plug-in 1.5.0_06"
\InProcServer32\(Default) = "C:\Program Files\Java\jre1.5.0_06\bin\npjpi150_06.dll" ["Sun Microsystems, Inc."]

Miscellaneous IE Hijack Points
------------------------------

HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks\

Missing lines (compared with English-language version):
"{08C06D61-F1F3-4799-86F8-BE1A89362C85}" = (no title provided)
-> {HKLM...CLSID} = "Search Class"
\InProcServer32\(Default) = "C:\PROGRA~1\NEOSTR~1\SEARCH~1.DLL" [empty string]

Running Services (Display Name, Service Name, Path {Service DLL}):
------------------------------------------------------------------

Ati HotKey Poller, Ati HotKey Poller, "C:\WINDOWS\system32\Ati2evxx.exe" ["ATI Technologies Inc."]
avast! Antivirus, avast! Antivirus, ""C:\Program Files\Alwil Software\Avast4\ashServ.exe"" [null data]
avast! iAVS4 Control Service, aswUpdSv, ""C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe"" [null data]
avast! Web Scanner, avast! Web Scanner, ""C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service" ["ALWIL Software"]
ewido anti-spyware 4.0 guard, ewido anti-spyware 4.0 guard, "C:\Program Files\ewido anti-spyware 4.0\guard.exe" ["Anti-Malware Development a.s."]
Windows User Mode Driver Framework, UMWdf, "C:\WINDOWS\system32\wdfmgr.exe" [MS]

----------
+ This report excludes default entries except where indicated.
+ To see *everywhere* the script checks and *everything* it finds,
launch it from a command prompt or a shortcut with the -all parameter.
+ The search for DESKTOP.INI DLL launch points on all local fixed drives
took 37 seconds.
+ The search for all Registry CLSIDs containing dormant Explorer Bars
took 9 seconds.
---------- (total run time: 68 seconds)

**Posty:** 8694 · przez **Red** 05 Lip 2006, 19:13

no i są zamulacze:

C:\Program Files\Save
C:\WINDOWS\system32\paytime.exe
HKLM\SOFTWARE\WhenUSave
C:\WINDOWS\sysxa7741_7.00.exe
C:\WINDOWS\winmgrs.exe

prosze odnalesc i usunac recznie z dysku

**Posty:** 94 · przez **mike00** 05 Lip 2006, 21:24

C:\WINDOWS\sysxa7741_7.00.exe
C:\Program Files\Save
to usunelem reszty nie moglem znaleźc ale daje logi do kontroli
hijack

Logfile of HijackThis v1.99.1
Scan saved at 21:18:45, on 2006-07-05
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\SYSTEM32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Program Files\ewido anti-spyware 4.0\guard.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\SYSTEM32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe
C:\PROGRA~1\NEOSTR~1\CnxMon.exe
C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe
C:\Program Files\D-Tools\daemon.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\ewido anti-spyware 4.0\ewido.exe
C:\PROGRA~1\NEOSTR~1\NeostradaTP.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Gadu-Gadu\gg.exe
C:\PROGRA~1\NEOSTR~1\ComComp.exe
C:\PROGRA~1\NEOSTR~1\Watch.exe
C:\Program Files\Opera\Opera.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\michal@\Pulpit\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://users.iptelecom.net.ua/~codecs/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Neostrada TP
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\NEOSTR~1\SEARCH~1.DLL
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon
O4 - HKLM\..\Run: [WooCnxMon] C:\PROGRA~1\NEOSTR~1\CnxMon.exe
O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\NEOSTR~1\Watch.exe
O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [!ewido] "C:\Program Files\ewido anti-spyware 4.0\ewido.exe" /minimized
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Uptime-Project] C:\Documents and Settings\michal@\Pulpit\client.exe
O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O9 - Extra button: Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O16 - DPF: {41ACD49D-1974-791A-0981-AA9872721044} (Ganymede Board Games) - http://67.15.101.3/g_bin/pl/boards_2_0_0_24.cab
O16 - DPF: {A1FE3DE0-CF77-11D4-8340-0080C8D7ED4A} (GameDesire Pinball Demon) - http://67.15.101.3/g_bin/pl/demon_2_0_0_21.cab
O16 - DPF: {E95CF138-A587-4C54-8175-3AD80997CB14} (GameDesire Soccer) - http://67.15.101.3/g_bin/pl/soccer_2_0_0_10.cab
O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C1} (GameDesire Pool - http://67.15.101.3/g_bin/pl/billard8_2_0_0_24.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{68EBB959-DFE1-41CA-B3B8-2F0D6C6B4C59}: NameServer = 194.204.152.34 217.98.63.164
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe

SL

"Silent Runners.vbs", revision 46, http://www.silentrunners.org/
Operating System: Windows XP SP2
Output limited to non-default values, except where indicated by "{++}"

Startup items buried in registry:
---------------------------------

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++}
"CTFMON.EXE" = "C:\WINDOWS\system32\ctfmon.exe" [MS]
"Uptime-Project" = "C:\Documents and Settings\michal@\Pulpit\client.exe" [file not found]
"Gadu-Gadu" = ""C:\Program Files\Gadu-Gadu\gg.exe" /tray" ["Gadu-Gadu Sp. z oo"]

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++}
"SoundMan" = "SOUNDMAN.EXE" ["Realtek Semiconductor Corp."]
"SpeedTouch USB Diagnostics" = ""C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon" ["THOMSON Telecom Belgium"]
"WooCnxMon" = "C:\PROGRA~1\NEOSTR~1\CnxMon.exe" [empty string]
"WOOWATCH" = "C:\PROGRA~1\NEOSTR~1\Watch.exe" ["France Télécom R&D"]
"WOOTASKBARICON" = "C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe" ["France Télécom R&D"]
"DAEMON Tools-1033" = ""C:\Program Files\D-Tools\daemon.exe" -lang 1033" ["DAEMON'S HOME"]
"NeroCheck" = "C:\WINDOWS\system32\NeroCheck.exe" ["Ahead Software Gmbh"]
"SunJavaUpdateSched" = "C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe" ["Sun Microsystems, Inc."]
"avast!" = "C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [null data]
"WinampAgent" = "C:\Program Files\Winamp\winampa.exe" [null data]
"TkBellExe" = ""C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot" ["RealNetworks, Inc."]
"!ewido" = ""C:\Program Files\ewido anti-spyware 4.0\ewido.exe" /minimized" ["Anti-Malware Development a.s."]

HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\(Default) = (no title provided)
-> {HKLM...CLSID} = "AcroIEHlprObj Class"
\InProcServer32\(Default) = "C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll" ["Adobe Systems Incorporated"]
{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\(Default) = (no title provided)
-> {HKLM...CLSID} = "SSVHelper Class"
\InProcServer32\(Default) = "C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll" ["Sun Microsystems, Inc."]

HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\
"{42071714-76d4-11d1-8b24-00a0c9068ff3}" = "Rozszerzenie CPL kadrowania wyświetlania"
-> {HKLM...CLSID} = "Rozszerzenie CPL kadrowania wyświetlania"
\InProcServer32\(Default) = "deskpan.dll" [file not found]
"{88895560-9AA2-1069-930E-00AA0030EBC8}" = "Rozszerzenie ikony HyperTerminalu"
-> {HKLM...CLSID} = "HyperTerminal Icon Ext"
\InProcServer32\(Default) = "C:\WINDOWS\system32\hticons.dll" ["Hilgraeve, Inc."]
"{B41DB860-8EE4-11D2-9906-E49FADC173CA}" = "WinRAR shell extension"
-> {HKLM...CLSID} = "WinRAR"
\InProcServer32\(Default) = "D:\programy\rar\rarext.dll" [null data]
"{640167b4-59b0-47a6-b335-a6b3c0695aea}" = "Portable Media Devices"
-> {HKLM...CLSID} = "Portable Media Devices"
\InProcServer32\(Default) = "C:\WINDOWS\system32\Audiodev.dll" [MS]
"{cc86590a-b60a-48e6-996b-41d25ed39a1e}" = "Portable Media Devices Menu"
-> {HKLM...CLSID} = "Portable Media Devices Menu"
\InProcServer32\(Default) = "C:\WINDOWS\system32\Audiodev.dll" [MS]
"{472083B0-C522-11CF-8763-00608CC02F24}" = "avast"
-> {HKLM...CLSID} = "avast"
\InProcServer32\(Default) = "C:\Program Files\Alwil Software\Avast4\ashShell.dll" ["ALWIL Software"]
"{F0CB00CD-5A07-4D91-97F5-A8C92CDA93E4}" = "Shell Extensions for RealOne Player"
-> {HKLM...CLSID} = "RealOne Player Context Menu Class"
\InProcServer32\(Default) = "C:\Program Files\Real\RealPlayer\rpshell.dll" ["RealNetworks, Inc."]

HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\
INFECTION WARNING! "{57B86673-276A-48B2-BAE7-C6DBB3020EB8}" = "ewido anti-spyware 4.0"
-> {HKLM...CLSID} = "CShellExecuteHookImpl Object"
\InProcServer32\(Default) = "C:\Program Files\ewido anti-spyware 4.0\shellexecutehook.dll" ["Anti-Malware Development a.s."]

HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\
INFECTION WARNING! AtiExtEvent\DLLName = "Ati2evxx.dll" ["ATI Technologies Inc."]

HKLM\Software\Classes\Folder\shellex\ColumnHandlers\
{F9DB5320-233E-11D1-9F84-707F02C10627}\(Default) = "PDF Column Info"
-> {HKLM...CLSID} = "PDF Shell Extension"
\InProcServer32\(Default) = "C:\Program Files\Adobe\Acrobat 7.0\ActiveX\PDFShell.dll" ["Adobe Systems, Inc."]

HKLM\Software\Classes\*\shellex\ContextMenuHandlers\
avast\(Default) = "{472083B0-C522-11CF-8763-00608CC02F24}"
-> {HKLM...CLSID} = "avast"
\InProcServer32\(Default) = "C:\Program Files\Alwil Software\Avast4\ashShell.dll" ["ALWIL Software"]
ewido anti-spyware\(Default) = "{8934FCEF-F5B8-468f-951F-78A921CD3920}"
-> {HKLM...CLSID} = "CContextScan Object"
\InProcServer32\(Default) = "C:\Program Files\ewido anti-spyware 4.0\context.dll" ["Anti-Malware Development a.s."]
WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
-> {HKLM...CLSID} = "WinRAR"
\InProcServer32\(Default) = "D:\programy\rar\rarext.dll" [null data]

HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\
ewido anti-spyware\(Default) = "{8934FCEF-F5B8-468f-951F-78A921CD3920}"
-> {HKLM...CLSID} = "CContextScan Object"
\InProcServer32\(Default) = "C:\Program Files\ewido anti-spyware 4.0\context.dll" ["Anti-Malware Development a.s."]
WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
-> {HKLM...CLSID} = "WinRAR"
\InProcServer32\(Default) = "D:\programy\rar\rarext.dll" [null data]

HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\
avast\(Default) = "{472083B0-C522-11CF-8763-00608CC02F24}"
-> {HKLM...CLSID} = "avast"
\InProcServer32\(Default) = "C:\Program Files\Alwil Software\Avast4\ashShell.dll" ["ALWIL Software"]
WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
-> {HKLM...CLSID} = "WinRAR"
\InProcServer32\(Default) = "D:\programy\rar\rarext.dll" [null data]

Active Desktop and Wallpaper:
-----------------------------

Active Desktop is disabled at this entry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState

HKCU\Control Panel\Desktop\
"Wallpaper" = "C:\Documents and Settings\michal@\Dane aplikacji\Opera\Opera\profile\Skin\tapeta4_1024.bmp"

Startup items in "michal@" & "All Users" startup folders:
---------------------------------------------------------

C:\Documents and Settings\michal@\Menu Start\Programy\Autostart
"Adobe Gamma" -> shortcut to: "C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe" ["Adobe Systems, Inc."]

Winsock2 Service Provider DLLs:
-------------------------------

Namespace Service Providers

HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++}
000000000001\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]
000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS]
000000000003\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]

Transport Service Providers

HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++}
0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range:
%SystemRoot%\system32\mswsock.dll [MS], 01 - 03, 06 - 15
%SystemRoot%\system32\rsvpsp.dll [MS], 04 - 05

Toolbars, Explorer Bars, Extensions:
------------------------------------

Explorer Bars

Dormant Explorer Bars in "View, Explorer Bar" menu

HKLM\Software\Classes\CLSID\{01002DB2-8170-4D9B-A8B1-DDC9DD114E03}\(Default) = "Volet Wanadoo"
Implemented Categories\{00021494-0000-0000-C000-000000000046}\ [horizontal bar]
InProcServer32\(Default) = "C:\PROGRA~1\NEOSTR~1\audience\audience.dll" [empty string]

HKLM\Software\Classes\CLSID\{3BAF4A27-C764-4E1A-A6F4-62F7A7E5E51C}\(Default) = "ToolBand Class"
Implemented Categories\{00021494-0000-0000-C000-000000000046}\ [horizontal bar]
InProcServer32\(Default) = "C:\PROGRA~1\NEOSTR~1\audience\audience.dll" [empty string]

HKLM\Software\Classes\CLSID\{5BF498C0-931E-4A4F-B33F-456D07137EAA}\(Default) = "Volet Wanadoo"
Implemented Categories\{00021494-0000-0000-C000-000000000046}\ [horizontal bar]
InProcServer32\(Default) = "C:\PROGRA~1\NEOSTR~1\audience\audience.dll" [empty string]

Extensions (Tools menu items, main toolbar menu buttons)

HKLM\Software\Microsoft\Internet Explorer\Extensions\
{08B0E5C0-4FCB-11CF-AAA5-00401C608501}\
"MenuText" = "Sun Java Console"
"CLSIDExtension" = "{CAFEEFAC-0015-0000-0006-ABCDEFFEDCBC}"
-> {HKCU...CLSID} = "Java Plug-in"
\InProcServer32\(Default) = "C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll" ["Sun Microsystems, Inc."]
-> {HKLM...CLSID} = "Java Plug-in 1.5.0_06"
\InProcServer32\(Default) = "C:\Program Files\Java\jre1.5.0_06\bin\npjpi150_06.dll" ["Sun Microsystems, Inc."]

Miscellaneous IE Hijack Points
------------------------------

HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks\

Missing lines (compared with English-language version):
"{08C06D61-F1F3-4799-86F8-BE1A89362C85}" = (no title provided)
-> {HKLM...CLSID} = "Search Class"
\InProcServer32\(Default) = "C:\PROGRA~1\NEOSTR~1\SEARCH~1.DLL" [empty string]

Running Services (Display Name, Service Name, Path {Service DLL}):
------------------------------------------------------------------

Ati HotKey Poller, Ati HotKey Poller, "C:\WINDOWS\system32\Ati2evxx.exe" ["ATI Technologies Inc."]
avast! Antivirus, avast! Antivirus, ""C:\Program Files\Alwil Software\Avast4\ashServ.exe"" [null data]
avast! iAVS4 Control Service, aswUpdSv, ""C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe"" [null data]
avast! Web Scanner, avast! Web Scanner, ""C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service" ["ALWIL Software"]
ewido anti-spyware 4.0 guard, ewido anti-spyware 4.0 guard, "C:\Program Files\ewido anti-spyware 4.0\guard.exe" ["Anti-Malware Development a.s."]
Windows User Mode Driver Framework, UMWdf, "C:\WINDOWS\system32\wdfmgr.exe" [MS]

----------
+ This report excludes default entries except where indicated.
+ To see *everywhere* the script checks and *everything* it finds,
launch it from a command prompt or a shortcut with the -all parameter.
+ The search for DESKTOP.INI DLL launch points on all local fixed drives
took 53 seconds.
+ The search for all Registry CLSIDs containing dormant Explorer Bars
took 10 seconds.
---------- (total run time: 91 seconds)

**Posty:** 8694 · przez **Red** 05 Lip 2006, 21:55

Logi są ok

Autor postu otrzymał pochwałę

**Posty:** 94 · przez **mike00** 05 Lip 2006, 22:09

w kompie też wszystko spoko
bez was bym zginoł :mrgreen:

dzięki za pomoc :mrgreen:

/edit w twarz myslalem ze wszystko dobrze ale jak zrobilem netstat to mi sie wyswietlilo cala lista polączen i tu daje screen

**Posty:** 8694 · przez **Red** 05 Lip 2006, 23:01

zastosuj:
http://www.firewallleaktester.com/tools/wwdc.exe
pozamykaj porty na enable>>jak tutaj na screni ei restart kompa\\

http://forum.programosy.pl/-vp206299.html#206299

**Posty:** 94 · przez **mike00** 05 Lip 2006, 23:16

red to samo co bylo ja juz niewiem co mam robic :roll:

/edit
zainstalowalem StatBar i caly czas mi wyswietla przy wyłączonych programach ze zżera up 24kb/s dw 8kb/s

**Posty:** 8694 · przez **Red** 06 Lip 2006, 18:19

prosze sciagnac:

http://www.europe.f-secure.com/exclude/blacklight/blbeta.exe

przeskanuj system i wklej wynik na forum

**Posty:** 94 · przez **mike00** 06 Lip 2006, 20:31

red ten link nie dziala masz moze jakis inny mirror??

**Posty:** 8694 · przez **Red** 06 Lip 2006, 20:40

musimy poczekac.....chwilowe trudnosci

,dziwne

sciagnij:
http://www.sysinternals.com/Files/RootkitRevealer.zip
wylacz wszystkie zbedne aplikacje ,skan ,wklej wynik na forum

**Posty:** 94 · przez **mike00** 06 Lip 2006, 20:59

raport

SOFTWARE 1601-01-01 02:00 0 bytes Error dumping hive: Nie można odnaleźć określonego pliku
HKLM\SYSTEM\ControlSet001\Services\d347prt\Cfg\0Jf40 2006-07-06 17:46 0 bytes Hidden from Windows API.
HKLM\SYSTEM\ControlSet001\Services\d347prt\Cfg\0Jf41 2006-07-06 17:46 0 bytes Hidden from Windows API.
HKLM\SYSTEM\ControlSet001\Services\sptd\Cfg\s0 2006-07-05 17:09 4 bytes Hidden from Windows API.
HKLM\SYSTEM\ControlSet001\Services\sptd\Cfg\s1 2006-07-05 17:09 4 bytes Hidden from Windows API.
HKLM\SYSTEM\ControlSet001\Services\sptd\Cfg\s2 2006-07-05 17:09 4 bytes Hidden from Windows API.
HKLM\SYSTEM\ControlSet001\Services\sptd\Cfg\g0 2006-07-05 17:09 32 bytes Hidden from Windows API.

**Posty:** 8694 · przez **Red** 06 Lip 2006, 21:03

Ten log jest czysty ,nie ma tego czego szukamy

Pozostaje zainstalowanie firewalla

**Posty:** 94 · przez **mike00** 06 Lip 2006, 21:09

ale jaki polecasz bo jak zainstalowalem outposta to sie pogubilem i niemoglem nic połączyc z netem ani ptrzeglądarki ani gg...

prosba o sprawdzenie net spowloniony

prosba o sprawdzenie net spowloniony

Kto jest na forum