proszę o spr. loga - komp muli

**Posty:** 62 · przez **Ailish** 04 Sie 2007, 12:35

Proszę o sprawdzenie logów. Komp muli, otwierają sie puste okienka w przegladarce albo reklamy antywirusów. Nie mogę uruchomic Photoshopa - zawiesza się cały komputer.

Kod: Zaznacz wszystko: Logfile of HijackThis v1.99.1 Scan saved at 12:21:50, on 2007-08-04 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\SOUNDMAN.EXE C:\Program Files\ATI Technologies\ATI.ACE\cli.exe C:\Program Files\D-Tools\daemon.exe C:\Program Files\HP\HP Software Update\HPWuSchd2.exe C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\Program Files\FlashGet\FlashGet.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Gadu-Gadu\gg.exe C:\Program Files\GetRight\getright.exe C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe C:\Program Files\GetRight\getright.exe C:\Program Files\Common Files\LightScribe\LSSrvc.exe C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Maxthon\Maxthon.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\WINDOWS\system32\wscntfy.exe C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe C:\Program Files\ATI Technologies\ATI.ACE\cli.exe C:\Program Files\ATI Technologies\ATI.ACE\cli.exe C:\WINDOWS\system32\NOTEPAD.EXE D:\Instal !!!!\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {2e1a2bba-d739-4edb-916a-613dc2cc5355} - C:\WINDOWS\system32\irct32.dll O2 - BHO: flashget urlcatch - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\Program Files\FlashGet\jccatch.dll O2 - BHO: bho2gr Class - {31FF080D-12A3-439A-A2EF-4BA95A3148E8} - C:\Program Files\GetRight\xx2gr.dll O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.1.7.4.dll O2 - BHO: (no name) - {724d43a9-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll O2 - BHO: (no name) - {C6039E6C-BDE9-4de5-BB40-768CAA584FDC} - C:\WINDOWS\system32\tmpC5.tmp.dll O2 - BHO: FlashGet GetFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\Program Files\FlashGet\getflash.dll O3 - Toolbar: &RoboForm - {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033 O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [Flashget] C:\Program Files\FlashGet\FlashGet.exe /min O4 - HKLM\..\Run: [SystemOptimizer] rundll32.exe "C:\WINDOWS\ssqnll.dll",forkonce O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - Global Startup: GetRight - Tray Icon.lnk = C:\Program Files\GetRight\getright.exe O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe O4 - Global Startup: HP Image Zone - szybkie uruchamianie.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm O8 - Extra context menu item: &Ściągnij przy pomocy FlashGet'a - C:\Program Files\FlashGet\jc_link.htm O8 - Extra context menu item: &Ściągnij wszystko przy pomocy FlashGet'a - C:\Program Files\FlashGet\jc_all.htm O8 - Extra context menu item: Download with GetRight - C:\Program Files\GetRight\GRdownload.htm O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O8 - Extra context menu item: Open with GetRight Browser - C:\Program Files\GetRight\GRbrowse.htm O8 - Extra context menu item: Pasek Narzędzi RoboForm - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html O8 - Extra context menu item: Personalizuj Menu - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html O8 - Extra context menu item: Wypełnij Pola - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html O8 - Extra context menu item: Zapisz Pola - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html O9 - Extra button: Wypełnij pola - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html O9 - Extra 'Tools' menuitem: Wypełnij Pola - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html O9 - Extra button: Zapisz - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html O9 - Extra 'Tools' menuitem: Zapisz Pola - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html O9 - Extra button: BitComet Search - {461CC20B-FB6E-4f16-8FE8-C29359DB100E} - C:\Program Files\BitComet\tools\BitCometBHO_1.1.7.4.dll O9 - Extra button: RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html O9 - Extra 'Tools' menuitem: Pasek Narzędzi RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O20 - AppInit_DLLs: c:\windows\system32\gebyxuv.dll O20 - Winlogon Notify: irct32 - C:\WINDOWS\SYSTEM32\irct32.dll O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing) O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing) O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

Kod: Zaznacz wszystko: "Silent Runners.vbs", revision R51, http://www.silentrunners.org/ Operating System: Windows XP SP2 Output limited to non-default values, except where indicated by "{++}" Startup items buried in registry: --------------------------------- HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ {++} "CTFMON.EXE" = "C:\WINDOWS\system32\ctfmon.exe" [MS] "Gadu-Gadu" = ""C:\Program Files\Gadu-Gadu\gg.exe" /tray" ["Gadu-Gadu S.A."] HKLM\Software\Microsoft\Windows\CurrentVersion\Run\ {++} "SoundMan" = "SOUNDMAN.EXE" ["Realtek Semiconductor Corp."] "ATICCC" = ""C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay" [null data] "DAEMON Tools-1033" = ""C:\Program Files\D-Tools\daemon.exe" -lang 1033" ["DAEMON'S HOME"] "HP Software Update" = "C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" ["Hewlett-Packard Co."] "avast!" = "C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" ["ALWIL Software"] "Flashget" = "C:\Program Files\FlashGet\FlashGet.exe /min" ["FlashGet.com"] "SystemOptimizer" = "rundll32.exe "C:\WINDOWS\ssqnll.dll",forkonce" [MS] HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\(Default) = (no title provided) -> {HKLM...CLSID} = "Adobe PDF Reader Link Helper" \InProcServer32\(Default) = "C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll" ["Adobe Systems Incorporated"] {2e1a2bba-d739-4edb-916a-613dc2cc5355}\(Default) = (no title provided) -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "C:\WINDOWS\system32\irct32.dll" [null data] {2F364306-AA45-47B5-9F9D-39A8B94E7EF7}\(Default) = "flashget urlcatch" -> {HKLM...CLSID} = "FGCatchUrl" \InProcServer32\(Default) = "C:\Program Files\FlashGet\jccatch.dll" ["www.flashget.com"] {31FF080D-12A3-439A-A2EF-4BA95A3148E8}\(Default) = (no title provided) -> {HKLM...CLSID} = "bho2gr Class" \InProcServer32\(Default) = "C:\Program Files\GetRight\xx2gr.dll" ["Headlight Software, Inc."] {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60}\(Default) = "BitComet ClickCapture" -> {HKLM...CLSID} = "BitComet Helper" \InProcServer32\(Default) = "C:\Program Files\BitComet\tools\BitCometBHO_1.1.7.4.dll" ["BitComet"] {724d43a9-0d85-11d4-9908-00400523e39a}\(Default) = (no title provided) -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "C:\Program Files\Siber Systems\AI RoboForm\roboform.dll" ["Siber Systems"] {C6039E6C-BDE9-4de5-BB40-768CAA584FDC}\(Default) = (no title provided) -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "C:\WINDOWS\system32\tmpC5.tmp.dll" [null data] {F156768E-81EF-470C-9057-481BA8380DBA}\(Default) = (no title provided) -> {HKLM...CLSID} = "FlashGet GetFlash Class" \InProcServer32\(Default) = "C:\Program Files\FlashGet\getflash.dll" ["www.flashget.com"] HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\ "{42071714-76d4-11d1-8b24-00a0c9068ff3}" = "Rozszerzenie CPL kadrowania wyświetlania" -> {HKLM...CLSID} = "Rozszerzenie CPL kadrowania wyświetlania" \InProcServer32\(Default) = "deskpan.dll" [file not found] "{88895560-9AA2-1069-930E-00AA0030EBC8}" = "Rozszerzenie ikony HyperTerminalu" -> {HKLM...CLSID} = "HyperTerminal Icon Ext" \InProcServer32\(Default) = "C:\WINDOWS\System32\hticons.dll" ["Hilgraeve, Inc."] "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" = "WinRAR shell extension" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] "{5E2121EE-0300-11D4-8D3B-444553540000}" = "Catalyst Context Menu extension" -> {HKLM...CLSID} = "SimpleShlExt Class" \InProcServer32\(Default) = "C:\Program Files\ATI Technologies\ATI.ACE\atiacmxx.dll" [empty string] "{00020D75-0000-0000-C000-000000000046}" = "Microsoft Office Outlook Desktop Icon Handler" -> {HKLM...CLSID} = "Microsoft Office Outlook" \InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\OFFICE11\MLSHEXT.DLL" [MS] "{0006F045-0000-0000-C000-000000000046}" = "Microsoft Office Outlook Custom Icon Handler" -> {HKLM...CLSID} = "Rozszerzenie ikon plików programu Outlook" \InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\OFFICE11\OLKFSTUB.DLL" [MS] "{42042206-2D85-11D3-8CFF-005004838597}" = "Microsoft Office HTML Icon Handler" -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "C:\Program Files\Microsoft Office\OFFICE11\msohev.dll" [MS] "{472083B0-C522-11CF-8763-00608CC02F24}" = "avast" -> {HKLM...CLSID} = "avast" \InProcServer32\(Default) = "C:\Program Files\Alwil Software\Avast4\ashShell.dll" ["ALWIL Software"] HKLM\Software\Microsoft\Windows NT\CurrentVersion\Windows\ <<!>> "AppInit_DLLs" = "c:\windows\system32\gebyxuv.dll" [null data] HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ <<!>> AtiExtEvent\DLLName = "Ati2evxx.dll" ["ATI Technologies Inc."] <<!>> irct32\DLLName = "irct32.dll" [null data] HKLM\Software\Classes\PROTOCOLS\Filter\ <<!>> text/xml\CLSID = "{807553E5-5146-11D5-A672-00B0D022E945}" -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL" [MS] HKLM\Software\Classes\Folder\shellex\ColumnHandlers\ {F9DB5320-233E-11D1-9F84-707F02C10627}\(Default) = "PDF Column Info" -> {HKLM...CLSID} = "PDF Shell Extension" \InProcServer32\(Default) = "C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\PDFShell.dll" ["Adobe Systems, Inc."] HKLM\Software\Classes\*\shellex\ContextMenuHandlers\ avast\(Default) = "{472083B0-C522-11CF-8763-00608CC02F24}" -> {HKLM...CLSID} = "avast" \InProcServer32\(Default) = "C:\Program Files\Alwil Software\Avast4\ashShell.dll" ["ALWIL Software"] WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\ WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\ avast\(Default) = "{472083B0-C522-11CF-8763-00608CC02F24}" -> {HKLM...CLSID} = "avast" \InProcServer32\(Default) = "C:\Program Files\Alwil Software\Avast4\ashShell.dll" ["ALWIL Software"] WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] Group Policies {GPedit.msc branch and setting}: ----------------------------------------------- Note: detected settings may not have any effect. HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\ "shutdownwithoutlogon" = (REG_DWORD) hex:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| Shutdown: Allow system to be shut down without having to log on} "undockwithoutlogon" = (REG_DWORD) hex:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| Devices: Allow undock without having to log on} Active Desktop and Wallpaper: ----------------------------- Active Desktop may be disabled at this entry: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState Displayed if Active Desktop enabled and wallpaper not set by Group Policy: HKCU\Software\Microsoft\Internet Explorer\Desktop\General\ "Wallpaper" = "C:\WINDOWS\web\wallpaper\Idylla.bmp" Displayed if Active Desktop disabled and wallpaper not set by Group Policy: HKCU\Control Panel\Desktop\ "Wallpaper" = "C:\WINDOWS\web\wallpaper\Idylla.bmp" Enabled Screen Saver: --------------------- HKCU\Control Panel\Desktop\ "SCRNSAVE.EXE" = "C:\WINDOWS\System32\logon.scr" [MS] Startup items in "Ailish" & "All Users" startup folders: -------------------------------------------------------- C:\Documents and Settings\All Users\Menu Start\Programy\Autostart "GetRight - Tray Icon" -> shortcut to: "C:\Program Files\GetRight\getright.exe" ["Headlight Software, Inc."] "HP Digital Imaging Monitor" -> shortcut to: "C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe" ["Hewlett-Packard Co."] "HP Image Zone - szybkie uruchamianie" -> shortcut to: "C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe -s" [null data] Enabled Scheduled Tasks: ------------------------ "At1" -> launches: "C:\WINDOWS\system32\EcPpnrBl.exe" [null data] "At10" -> launches: "C:\WINDOWS\system32\EcPpnrBl.exe" [null data] "At11" -> launches: "C:\WINDOWS\system32\EcPpnrBl.exe" [null data] "At12" -> launches: "C:\WINDOWS\system32\EcPpnrBl.exe" [null data] "At13" -> launches: "C:\WINDOWS\system32\EcPpnrBl.exe" [null data] "At14" -> launches: "C:\WINDOWS\system32\EcPpnrBl.exe" [null data] "At15" -> launches: "C:\WINDOWS\system32\EcPpnrBl.exe" [null data] "At16" -> launches: "C:\WINDOWS\system32\EcPpnrBl.exe" [null data] "At17" -> launches: "C:\WINDOWS\system32\EcPpnrBl.exe" [null data] "At18" -> launches: "C:\WINDOWS\system32\EcPpnrBl.exe" [null data] "At19" -> launches: "C:\WINDOWS\system32\EcPpnrBl.exe" [null data] "At2" -> launches: "C:\WINDOWS\system32\EcPpnrBl.exe" [null data] "At20" -> launches: "C:\WINDOWS\system32\EcPpnrBl.exe" [null data] "At21" -> launches: "C:\WINDOWS\system32\EcPpnrBl.exe" [null data] "At22" -> launches: "C:\WINDOWS\system32\EcPpnrBl.exe" [null data] "At23" -> launches: "C:\WINDOWS\system32\EcPpnrBl.exe" [null data] "At24" -> launches: "C:\WINDOWS\system32\EcPpnrBl.exe" [null data] "At3" -> launches: "C:\WINDOWS\system32\EcPpnrBl.exe" [null data] "At4" -> launches: "C:\WINDOWS\system32\EcPpnrBl.exe" [null data] "At5" -> launches: "C:\WINDOWS\system32\EcPpnrBl.exe" [null data] "At6" -> launches: "C:\WINDOWS\system32\EcPpnrBl.exe" [null data] "At7" -> launches: "C:\WINDOWS\system32\EcPpnrBl.exe" [null data] "At8" -> launches: "C:\WINDOWS\system32\EcPpnrBl.exe" [null data] "At9" -> launches: "C:\WINDOWS\system32\EcPpnrBl.exe" [null data] "HPpromotions journeysoftware" -> launches: "C:\Program Files\hp\digital imaging\bin\hp promotions\journeysoftware\HPpromo.exe /N "journeysoftware" -r" ["hp"] "WebReg Deskjet 5900 series" -> launches: "C:\Program Files\HP\Digital Imaging\bin\hpqwrg.exe "Deskjet 5900 series"" ["Hewlett-Packard Co."] Winsock2 Service Provider DLLs: ------------------------------- Namespace Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++} 000000000001\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS] 000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS] 000000000003\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS] Transport Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++} 0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range: %SystemRoot%\system32\mswsock.dll [MS], 01 - 03, 06 - 13 %SystemRoot%\system32\rsvpsp.dll [MS], 04 - 05 Toolbars, Explorer Bars, Extensions: ------------------------------------ Toolbars HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\ "{724D43A0-0D85-11D4-9908-00400523E39A}" -> {HKLM...CLSID} = "&RoboForm" \InProcServer32\(Default) = "C:\Program Files\Siber Systems\AI RoboForm\roboform.dll" ["Siber Systems"] HKLM\Software\Microsoft\Internet Explorer\Toolbar\ "{724D43A0-0D85-11D4-9908-00400523E39A}" = (no title provided) -> {HKLM...CLSID} = "&RoboForm" \InProcServer32\(Default) = "C:\Program Files\Siber Systems\AI RoboForm\roboform.dll" ["Siber Systems"] Explorer Bars HKLM\Software\Microsoft\Internet Explorer\Explorer Bars\ HKLM\Software\Classes\CLSID\{E7A829CC-671F-4C3D-B590-8C0AEA72E6B2}\(Default) = "BitComet Search" Implemented Categories\{00021493-0000-0000-C000-000000000046}\ [vertical bar] InProcServer32\(Default) = "C:\Program Files\BitComet\tools\BitCometBHO_1.1.7.4.dll" ["BitComet"] HKLM\Software\Classes\CLSID\{FF059E31-CC5A-4E2E-BF3B-96E929D65503}\(Default) = "&Badanie" Implemented Categories\{00021493-0000-0000-C000-000000000046}\ [vertical bar] InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL" [MS] Extensions (Tools menu items, main toolbar menu buttons) HKLM\Software\Microsoft\Internet Explorer\Extensions\ {320AF880-6646-11D3-ABEE-C5DBF3571F46}\ "ButtonText" = "Wypełnij pola" "MenuText" = "Wypełnij Pola" "Script" = "file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html" [file not found] {320AF880-6646-11D3-ABEE-C5DBF3571F49}\ "ButtonText" = "Zapisz" "MenuText" = "Zapisz Pola" "Script" = "file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html" [file not found] {461CC20B-FB6E-4F16-8FE8-C29359DB100E}\ "ButtonText" = "BitComet Search" {724D43AA-0D85-11D4-9908-00400523E39A}\ "ButtonText" = "RoboForm" "MenuText" = "Pasek Narzędzi RoboForm" "Script" = "file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html" [file not found] {92780B25-18CC-41C8-B9BE-3C9C571A8263}\ "ButtonText" = "Badanie" {D6E814A0-E0C5-11D4-8D29-0050BA6940E3}\ "ButtonText" = "FlashGet" "MenuText" = "FlashGet" "Exec" = "C:\Program Files\FlashGet\FlashGet.exe" ["FlashGet.com"] {FB5F1910-F110-11D2-BB9E-00C04F795683}\ "ButtonText" = "Messenger" "MenuText" = "Windows Messenger" "Exec" = "C:\Program Files\Messenger\msmsgs.exe" [MS] Running Services (Display Name, Service Name, Path {Service DLL}): ------------------------------------------------------------------ Ati HotKey Poller, Ati HotKey Poller, "C:\WINDOWS\system32\Ati2evxx.exe" ["ATI Technologies Inc."] avast! Antivirus, avast! Antivirus, ""C:\Program Files\Alwil Software\Avast4\ashServ.exe"" ["ALWIL Software"] avast! iAVS4 Control Service, aswUpdSv, ""C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe"" ["ALWIL Software"] avast! Mail Scanner, avast! Mail Scanner, ""C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service" ["ALWIL Software"] avast! Web Scanner, avast! Web Scanner, ""C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service" ["ALWIL Software"] LightScribeService Direct Disc Labeling Service, LightScribeService, ""C:\Program Files\Common Files\LightScribe\LSSrvc.exe"" ["Hewlett-Packard Company"] Print Monitors: --------------- HKLM\System\CurrentControlSet\Control\Print\Monitors\ Microsoft Document Imaging Writer Monitor\Driver = "mdimon.dll" [MS] PCL Language Monitor\Driver = "hpz3l3xu.dll" ["Hewlett-Packard Company"] ---------- (launch time: 2007-08-04 12:14:43) <<!>>: Suspicious data at a malware launch point. + This report excludes default entries except where indicated. + To see *everywhere* the script checks and *everything* it finds, launch it from a command prompt or a shortcut with the -all parameter. + The search for DESKTOP.INI DLL launch points on all local fixed drives took 162 seconds. ---------- (total run time: 238 seconds)

**Posty:** 18165 · przez **wojtas** 04 Sie 2007, 13:46

zastosuj:

smitfraudfix z opcji 2:

http://siri.urz.free.fr/Fix/SmitfraudFix_En.php

oraz te skanery po kilka razy
VundoFix
http://www.atribune.org/ccount/click.php?id=4

VirtumundoBeGone
http://secured2k.home.comcast.net/tools/VirtumundoBeGone.exe

FixVundo
http://securityresponse.symantec.com/avcenter/FixVundo.exe

potem 2 nowe logi

**Posty:** 62 · przez **Ailish** 04 Sie 2007, 23:01

Kod: Zaznacz wszystko: Logfile of HijackThis v1.99.1 Scan saved at 22:51:08, on 2007-08-04 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\WINDOWS\system32\qwerty12.exe C:\Program Files\Common Files\LightScribe\LSSrvc.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\SOUNDMAN.EXE C:\Program Files\ATI Technologies\ATI.ACE\cli.exe C:\Program Files\D-Tools\daemon.exe C:\Program Files\HP\HP Software Update\HPWuSchd2.exe C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Gadu-Gadu\gg.exe C:\Program Files\GetRight\getright.exe C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe C:\Program Files\GetRight\getright.exe C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe C:\WINDOWS\system32\wuauclt.exe C:\Program Files\ATI Technologies\ATI.ACE\cli.exe C:\Program Files\ATI Technologies\ATI.ACE\cli.exe C:\Program Files\Maxthon\Maxthon.exe D:\Instal !!!!\HijackThis.exe R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {2e1a2bba-d739-4edb-916a-613dc2cc5355} - C:\WINDOWS\system32\calpol.dll O2 - BHO: flashget urlcatch - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\Program Files\FlashGet\jccatch.dll O2 - BHO: bho2gr Class - {31FF080D-12A3-439A-A2EF-4BA95A3148E8} - C:\Program Files\GetRight\xx2gr.dll O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.1.7.4.dll O2 - BHO: (no name) - {724d43a9-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll O2 - BHO: (no name) - {C6039E6C-BDE9-4de5-BB40-768CAA584FDC} - C:\WINDOWS\system32\tmpD.tmp.dll O2 - BHO: FlashGet GetFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\Program Files\FlashGet\getflash.dll O3 - Toolbar: &RoboForm - {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033 O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [Flashget] C:\Program Files\FlashGet\FlashGet.exe /min O4 - HKLM\..\Run: [SystemOptimizer] rundll32.exe "C:\WINDOWS\opqqnn.dll",forkonce O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - Global Startup: GetRight - Tray Icon.lnk = C:\Program Files\GetRight\getright.exe O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe O4 - Global Startup: HP Image Zone - szybkie uruchamianie.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm O8 - Extra context menu item: &Ściągnij przy pomocy FlashGet'a - C:\Program Files\FlashGet\jc_link.htm O8 - Extra context menu item: &Ściągnij wszystko przy pomocy FlashGet'a - C:\Program Files\FlashGet\jc_all.htm O8 - Extra context menu item: Download with GetRight - C:\Program Files\GetRight\GRdownload.htm O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O8 - Extra context menu item: Open with GetRight Browser - C:\Program Files\GetRight\GRbrowse.htm O8 - Extra context menu item: Pasek Narzędzi RoboForm - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html O8 - Extra context menu item: Personalizuj Menu - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html O8 - Extra context menu item: Wypełnij Pola - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html O8 - Extra context menu item: Zapisz Pola - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html O9 - Extra button: Wypełnij pola - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html O9 - Extra 'Tools' menuitem: Wypełnij Pola - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html O9 - Extra button: Zapisz - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html O9 - Extra 'Tools' menuitem: Zapisz Pola - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html O9 - Extra button: BitComet Search - {461CC20B-FB6E-4f16-8FE8-C29359DB100E} - C:\Program Files\BitComet\tools\BitCometBHO_1.1.7.4.dll O9 - Extra button: RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html O9 - Extra 'Tools' menuitem: Pasek Narzędzi RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O10 - Unknown file in Winsock LSP: c:\program files\bonjour\mdnsnsp.dll O20 - AppInit_DLLs: c:\windows\system32\gebyxuv.dll O20 - Winlogon Notify: calpol - C:\WINDOWS\SYSTEM32\calpol.dll O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing) O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing) O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: DomainService - Unknown owner - C:\WINDOWS\system32\qwerty12.exe O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

Kod: Zaznacz wszystko: "Silent Runners.vbs", revision R51, http://www.silentrunners.org/ Operating System: Windows XP SP2 Output limited to non-default values, except where indicated by "{++}" Startup items buried in registry: --------------------------------- HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ {++} "CTFMON.EXE" = "C:\WINDOWS\system32\ctfmon.exe" [MS] "Gadu-Gadu" = ""C:\Program Files\Gadu-Gadu\gg.exe" /tray" ["Gadu-Gadu S.A."] HKLM\Software\Microsoft\Windows\CurrentVersion\Run\ {++} "SoundMan" = "SOUNDMAN.EXE" ["Realtek Semiconductor Corp."] "ATICCC" = ""C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay" [null data] "DAEMON Tools-1033" = ""C:\Program Files\D-Tools\daemon.exe" -lang 1033" ["DAEMON'S HOME"] "HP Software Update" = "C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" ["Hewlett-Packard Co."] "avast!" = "C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" ["ALWIL Software"] "Flashget" = "C:\Program Files\FlashGet\FlashGet.exe /min" ["FlashGet.com"] "SystemOptimizer" = "rundll32.exe "C:\WINDOWS\opqqnn.dll",forkonce" [MS] HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\(Default) = (no title provided) -> {HKLM...CLSID} = "Adobe PDF Reader Link Helper" \InProcServer32\(Default) = "C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll" ["Adobe Systems Incorporated"] {2e1a2bba-d739-4edb-916a-613dc2cc5355}\(Default) = (no title provided) -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "C:\WINDOWS\system32\calpol.dll" [null data] {2F364306-AA45-47B5-9F9D-39A8B94E7EF7}\(Default) = "flashget urlcatch" -> {HKLM...CLSID} = "FGCatchUrl" \InProcServer32\(Default) = "C:\Program Files\FlashGet\jccatch.dll" ["www.flashget.com"] {31FF080D-12A3-439A-A2EF-4BA95A3148E8}\(Default) = (no title provided) -> {HKLM...CLSID} = "bho2gr Class" \InProcServer32\(Default) = "C:\Program Files\GetRight\xx2gr.dll" ["Headlight Software, Inc."] {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60}\(Default) = "BitComet ClickCapture" -> {HKLM...CLSID} = "BitComet Helper" \InProcServer32\(Default) = "C:\Program Files\BitComet\tools\BitCometBHO_1.1.7.4.dll" ["BitComet"] {724d43a9-0d85-11d4-9908-00400523e39a}\(Default) = (no title provided) -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "C:\Program Files\Siber Systems\AI RoboForm\roboform.dll" ["Siber Systems"] {C6039E6C-BDE9-4de5-BB40-768CAA584FDC}\(Default) = (no title provided) -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "C:\WINDOWS\system32\tmpD.tmp.dll" [null data] {F156768E-81EF-470C-9057-481BA8380DBA}\(Default) = (no title provided) -> {HKLM...CLSID} = "FlashGet GetFlash Class" \InProcServer32\(Default) = "C:\Program Files\FlashGet\getflash.dll" ["www.flashget.com"] HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\ "{42071714-76d4-11d1-8b24-00a0c9068ff3}" = "Rozszerzenie CPL kadrowania wyświetlania" -> {HKLM...CLSID} = "Rozszerzenie CPL kadrowania wyświetlania" \InProcServer32\(Default) = "deskpan.dll" [file not found] "{88895560-9AA2-1069-930E-00AA0030EBC8}" = "Rozszerzenie ikony HyperTerminalu" -> {HKLM...CLSID} = "HyperTerminal Icon Ext" \InProcServer32\(Default) = "C:\WINDOWS\System32\hticons.dll" ["Hilgraeve, Inc."] "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" = "WinRAR shell extension" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] "{5E2121EE-0300-11D4-8D3B-444553540000}" = "Catalyst Context Menu extension" -> {HKLM...CLSID} = "SimpleShlExt Class" \InProcServer32\(Default) = "C:\Program Files\ATI Technologies\ATI.ACE\atiacmxx.dll" [empty string] "{00020D75-0000-0000-C000-000000000046}" = "Microsoft Office Outlook Desktop Icon Handler" -> {HKLM...CLSID} = "Microsoft Office Outlook" \InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\OFFICE11\MLSHEXT.DLL" [MS] "{0006F045-0000-0000-C000-000000000046}" = "Microsoft Office Outlook Custom Icon Handler" -> {HKLM...CLSID} = "Rozszerzenie ikon plików programu Outlook" \InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\OFFICE11\OLKFSTUB.DLL" [MS] "{42042206-2D85-11D3-8CFF-005004838597}" = "Microsoft Office HTML Icon Handler" -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "C:\Program Files\Microsoft Office\OFFICE11\msohev.dll" [MS] "{472083B0-C522-11CF-8763-00608CC02F24}" = "avast" -> {HKLM...CLSID} = "avast" \InProcServer32\(Default) = "C:\Program Files\Alwil Software\Avast4\ashShell.dll" ["ALWIL Software"] HKLM\Software\Microsoft\Windows NT\CurrentVersion\Windows\ <<!>> "AppInit_DLLs" = "c:\windows\system32\gebyxuv.dll" [null data] HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ <<!>> AtiExtEvent\DLLName = "Ati2evxx.dll" ["ATI Technologies Inc."] <<!>> calpol\DLLName = "calpol.dll" [null data] HKLM\Software\Classes\PROTOCOLS\Filter\ <<!>> text/xml\CLSID = "{807553E5-5146-11D5-A672-00B0D022E945}" -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL" [MS] HKLM\Software\Classes\Folder\shellex\ColumnHandlers\ {F9DB5320-233E-11D1-9F84-707F02C10627}\(Default) = "PDF Column Info" -> {HKLM...CLSID} = "PDF Shell Extension" \InProcServer32\(Default) = "C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\PDFShell.dll" ["Adobe Systems, Inc."] HKLM\Software\Classes\*\shellex\ContextMenuHandlers\ avast\(Default) = "{472083B0-C522-11CF-8763-00608CC02F24}" -> {HKLM...CLSID} = "avast" \InProcServer32\(Default) = "C:\Program Files\Alwil Software\Avast4\ashShell.dll" ["ALWIL Software"] WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\ WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\ avast\(Default) = "{472083B0-C522-11CF-8763-00608CC02F24}" -> {HKLM...CLSID} = "avast" \InProcServer32\(Default) = "C:\Program Files\Alwil Software\Avast4\ashShell.dll" ["ALWIL Software"] WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] Group Policies {GPedit.msc branch and setting}: ----------------------------------------------- Note: detected settings may not have any effect. HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\ "shutdownwithoutlogon" = (REG_DWORD) hex:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| Shutdown: Allow system to be shut down without having to log on} "undockwithoutlogon" = (REG_DWORD) hex:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| Devices: Allow undock without having to log on} Active Desktop and Wallpaper: ----------------------------- Active Desktop may be disabled at this entry: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState Displayed if Active Desktop enabled and wallpaper not set by Group Policy: HKCU\Software\Microsoft\Internet Explorer\Desktop\General\ "Wallpaper" = "C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp" Enabled Screen Saver: --------------------- HKCU\Control Panel\Desktop\ "SCRNSAVE.EXE" = "C:\WINDOWS\System32\logon.scr" [MS] Startup items in "Ailish" & "All Users" startup folders: -------------------------------------------------------- C:\Documents and Settings\All Users\Menu Start\Programy\Autostart "GetRight - Tray Icon" -> shortcut to: "C:\Program Files\GetRight\getright.exe" ["Headlight Software, Inc."] "HP Digital Imaging Monitor" -> shortcut to: "C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe" ["Hewlett-Packard Co."] "HP Image Zone - szybkie uruchamianie" -> shortcut to: "C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe -s" [null data] Enabled Scheduled Tasks: ------------------------ "HPpromotions journeysoftware" -> launches: "C:\Program Files\hp\digital imaging\bin\hp promotions\journeysoftware\HPpromo.exe /N "journeysoftware" -r" ["hp"] "WebReg Deskjet 5900 series" -> launches: "C:\Program Files\HP\Digital Imaging\bin\hpqwrg.exe "Deskjet 5900 series"" ["Hewlett-Packard Co."] Winsock2 Service Provider DLLs: ------------------------------- Namespace Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++} 000000000001\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS] 000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS] 000000000003\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS] 000000000004\LibraryPath = "C:\Program Files\Bonjour\mdnsNSP.dll" ["Apple Computer, Inc."] Transport Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++} 0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range: %SystemRoot%\system32\mswsock.dll [MS], 01 - 03, 06 - 13 %SystemRoot%\system32\rsvpsp.dll [MS], 04 - 05 Toolbars, Explorer Bars, Extensions: ------------------------------------ Toolbars HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\ "{724D43A0-0D85-11D4-9908-00400523E39A}" -> {HKLM...CLSID} = "&RoboForm" \InProcServer32\(Default) = "C:\Program Files\Siber Systems\AI RoboForm\roboform.dll" ["Siber Systems"] HKLM\Software\Microsoft\Internet Explorer\Toolbar\ "{724D43A0-0D85-11D4-9908-00400523E39A}" = (no title provided) -> {HKLM...CLSID} = "&RoboForm" \InProcServer32\(Default) = "C:\Program Files\Siber Systems\AI RoboForm\roboform.dll" ["Siber Systems"] Explorer Bars HKLM\Software\Microsoft\Internet Explorer\Explorer Bars\ HKLM\Software\Classes\CLSID\{E7A829CC-671F-4C3D-B590-8C0AEA72E6B2}\(Default) = "BitComet Search" Implemented Categories\{00021493-0000-0000-C000-000000000046}\ [vertical bar] InProcServer32\(Default) = "C:\Program Files\BitComet\tools\BitCometBHO_1.1.7.4.dll" ["BitComet"] HKLM\Software\Classes\CLSID\{FF059E31-CC5A-4E2E-BF3B-96E929D65503}\(Default) = "&Badanie" Implemented Categories\{00021493-0000-0000-C000-000000000046}\ [vertical bar] InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL" [MS] Extensions (Tools menu items, main toolbar menu buttons) HKLM\Software\Microsoft\Internet Explorer\Extensions\ {320AF880-6646-11D3-ABEE-C5DBF3571F46}\ "ButtonText" = "Wypełnij pola" "MenuText" = "Wypełnij Pola" "Script" = "file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html" [file not found] {320AF880-6646-11D3-ABEE-C5DBF3571F49}\ "ButtonText" = "Zapisz" "MenuText" = "Zapisz Pola" "Script" = "file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html" [file not found] {461CC20B-FB6E-4F16-8FE8-C29359DB100E}\ "ButtonText" = "BitComet Search" {724D43AA-0D85-11D4-9908-00400523E39A}\ "ButtonText" = "RoboForm" "MenuText" = "Pasek Narzędzi RoboForm" "Script" = "file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html" [file not found] {92780B25-18CC-41C8-B9BE-3C9C571A8263}\ "ButtonText" = "Badanie" {D6E814A0-E0C5-11D4-8D29-0050BA6940E3}\ "ButtonText" = "FlashGet" "MenuText" = "FlashGet" "Exec" = "C:\Program Files\FlashGet\FlashGet.exe" ["FlashGet.com"] {FB5F1910-F110-11D2-BB9E-00C04F795683}\ "ButtonText" = "Messenger" "MenuText" = "Windows Messenger" "Exec" = "C:\Program Files\Messenger\msmsgs.exe" [MS] Running Services (Display Name, Service Name, Path {Service DLL}): ------------------------------------------------------------------ ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762##, Bonjour Service, ""C:\Program Files\Bonjour\mDNSResponder.exe"" ["Apple Computer, Inc."] Ati HotKey Poller, Ati HotKey Poller, "C:\WINDOWS\system32\Ati2evxx.exe" ["ATI Technologies Inc."] avast! Antivirus, avast! Antivirus, ""C:\Program Files\Alwil Software\Avast4\ashServ.exe"" ["ALWIL Software"] avast! iAVS4 Control Service, aswUpdSv, ""C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe"" ["ALWIL Software"] avast! Mail Scanner, avast! Mail Scanner, ""C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service" ["ALWIL Software"] avast! Web Scanner, avast! Web Scanner, ""C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service" ["ALWIL Software"] DomainService, DomainService, "C:\WINDOWS\system32\qwerty12.exe /service" [null data] LightScribeService Direct Disc Labeling Service, LightScribeService, ""C:\Program Files\Common Files\LightScribe\LSSrvc.exe"" ["Hewlett-Packard Company"] Print Monitors: --------------- HKLM\System\CurrentControlSet\Control\Print\Monitors\ Microsoft Document Imaging Writer Monitor\Driver = "mdimon.dll" [MS] PCL Language Monitor\Driver = "hpz3l3xu.dll" ["Hewlett-Packard Company"] ---------- (launch time: 2007-08-04 22:51:37) <<!>>: Suspicious data at a malware launch point. + This report excludes default entries except where indicated. + To see *everywhere* the script checks and *everything* it finds, launch it from a command prompt or a shortcut with the -all parameter. + The search for DESKTOP.INI DLL launch points on all local fixed drives took 158 seconds. ---------- (total run time: 227 seconds)

**Posty:** 18165 · przez **wojtas** 04 Sie 2007, 23:10

Użyj WWDC :
http://www.firewallleaktester.com/wwdc.htm
Zmień opcje z disable na enable. Uruchom ponownie komputer.
Tak powinny wyglądać porty (NetBIOS może być żółty) :
http://www.firewallleaktester.com/images_site/wwdc.jpg

Pobierz i uruchom narzędzie
The Avenger
Zaznacz opcję Input script manually i kliknij na Lupkę z prawej strony. W okienku, które się otworzy wklejasz:

Drivers to unload:

DomainService

Files to delete:

C:\WINDOWS\system32\qwerty12.exe
C:\WINDOWS\SYSTEM32\calpol.dll
c:\windows\system32\gebyxuv.dll
C:\WINDOWS\system32\tmpD.tmp.dll
C:\WINDOWS\opqqnn.dll

Klikasz Done, a następnie zielone światełko i zgadzasz się na restart klikając OK.
Po restarcie w HijackThis usuwasz wpis/y

O2 - BHO: (no name) - {2e1a2bba-d739-4edb-916a-613dc2cc5355} - C:\WINDOWS\system32\calpol.dll
O2 - BHO: (no name) - {C6039E6C-BDE9-4de5-BB40-768CAA584FDC} - C:\WINDOWS\system32\tmpD.tmp.dll
O4 - HKLM\..\Run: [SystemOptimizer] rundll32.exe "C:\WINDOWS\opqqnn.dll",forkonce
O20 - AppInit_DLLs: c:\windows\system32\gebyxuv.dll
O20 - Winlogon Notify: calpol - C:\WINDOWS\SYSTEM32\calpol.dll
O23 - Service: DomainService - Unknown owner - C:\WINDOWS\system32\qwerty12.exe

Kasujesz ręcznie z dysku plik: C:\Avenger\backup.zip i wklejasz na forum raport: C:\avenger.txt + log z combofixa oraz hijack oraz silent runners

**Posty:** 62 · przez **Ailish** 04 Sie 2007, 23:49

Kod: Zaznacz wszystko: ComboFix 07-08-04.3 - "Ailish" 2007-08-04 23:28:48.1 [GMT 2:00] - NTFS Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.Prawda ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) C:\DOCUME~1\Ailish\DANEAP~1\tmp9.tmp.exe C:\DOCUME~1\Ailish\DANEAP~1\tmpA.tmp.exe C:\DOCUME~1\Ailish\DANEAP~1\tmpC3.tmp.exe C:\DOCUME~1\Ailish\DANEAP~1\tmpC4.tmp.exe C:\DOCUME~1\Ailish\DANEAP~1\tmpC5.tmp.exe C:\DOCUME~1\Ailish\DANEAP~1\tmpD.tmp.exe C:\WINDOWS\system32\dndcdd1fff.dat C:\WINDOWS\system32\ipv6mons.dll C:\WINDOWS\system32\mljge.exe C:\WINDOWS\system32\mllmm.exe C:\WINDOWS\system32\tmpC5.tmp.dll ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) -------\LEGACY_DOMAINSERVICE ((((((((((((((((((((((((( Files Created from 2007-07-04 to 2007-08-04 ))))))))))))))))))))))))))))))) 2007-08-04 23:28 51,200 --a------ C:\WINDOWS\nircmd.exe 2007-08-04 21:19 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\FLEXnet 2007-08-04 21:04 92,726 --a------ C:\WINDOWS\system32\dmscom.dll.vir 2007-08-04 20:59 <DIR> d-------- C:\VundoFix Backups 2007-08-04 20:53 53,248 --a------ C:\WINDOWS\system32\Process.exe 2007-08-04 20:53 51,200 --a------ C:\WINDOWS\system32\dumphive.exe 2007-08-04 20:53 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe 2007-08-04 20:53 2,058 --a------ C:\WINDOWS\system32\tmp.reg 2007-08-04 13:40 <DIR> d-------- C:\Program Files\Bonjour 2007-08-04 13:20 <DIR> d-------- C:\Program Files\Common Files\Macrovision Shared 2007-08-04 06:29 92,730 --a------ C:\WINDOWS\system32\irct32.dll.vir 2007-08-03 16:43 <DIR> d-------- C:\Program Files\PRO100 2007-08-03 14:54 <DIR> d-------- C:\Program Files\PRO100 Demo 2007-08-02 01:25 <DIR> d-------- C:\Mojdom3D 2007-08-01 23:49 <DIR> d-------- C:\Program Files\BitComet 2007-08-01 18:02 24,128 --a------ C:\WINDOWS\system32\EcPpnrBl.exe 2007-07-29 21:59 <DIR> d-------- C:\Program Files\Pro100 3.51 2007-07-27 14:59 <DIR> d-------- C:\Szybki kurs francuskiego 2007-07-27 14:58 <DIR> d-------- C:\DOCUME~1\Ailish\WINDOWS 2007-07-27 12:40 <DIR> d-------- C:\Program Files\FlashGet 2007-07-27 10:48 <DIR> d-------- C:\Program Files\Kodak 2007-07-27 06:34 <DIR> d-------- C:\Program Files\Matroska Pack 2007-07-26 13:48 95,872 --a------ C:\WINDOWS\system32\AVASTSS.scr 2007-07-26 13:48 94,552 --a------ C:\WINDOWS\system32\drivers\aswmon2.sys 2007-07-26 13:48 85,952 --a------ C:\WINDOWS\system32\drivers\aswmon.sys 2007-07-26 13:48 745,600 --a------ C:\WINDOWS\system32\aswBoot.exe 2007-07-26 13:48 43,176 --a------ C:\WINDOWS\system32\drivers\aswTdi.sys 2007-07-26 13:48 26,888 --a------ C:\WINDOWS\system32\drivers\aavmker4.sys 2007-07-26 13:48 23,416 --a------ C:\WINDOWS\system32\drivers\aswRdr.sys 2007-07-26 13:48 <DIR> d-------- C:\Program Files\Alwil Software 2007-07-25 11:35 <DIR> d-------- C:\sysreset 2007-07-24 22:20 545 --a------ C:\WINDOWS\UC.PIF 2007-07-24 22:20 545 --a------ C:\WINDOWS\RAR.PIF 2007-07-24 22:20 545 --a------ C:\WINDOWS\PKZIP.PIF 2007-07-24 22:20 545 --a------ C:\WINDOWS\PKUNZIP.PIF 2007-07-24 22:20 545 --a------ C:\WINDOWS\NOCLOSE.PIF 2007-07-24 22:20 545 --a------ C:\WINDOWS\LHA.PIF 2007-07-24 22:20 545 --a------ C:\WINDOWS\ARJ.PIF 2007-07-24 22:20 <DIR> d-------- C:\totalcmd 2007-07-24 12:49 <DIR> d-------- C:\Program Files\GetRight 2007-07-24 12:49 <DIR> d-------- C:\Downloads 2007-07-23 23:14 <DIR> d-------- C:\Program Files\NAPI-PROJEKT 2007-07-23 17:24 327,168 --a------ C:\WINDOWS\IsUn0415.exe 2007-07-23 14:31 <DIR> d-------- C:\Program Files\Real Alternative 2007-07-23 14:31 <DIR> d-------- C:\Program Files\Media Player Classic 2007-07-23 14:31 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\Real 2007-07-23 14:31 <DIR> d-------- C:\DOCUME~1\Ailish\DANEAP~1\Real 2007-07-22 15:46 <DIR> d-------- C:\Program Files\Common Files\Sonic Shared 2007-07-22 15:46 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\Sonic 2007-07-22 15:45 <DIR> d-------- C:\Program Files\Common Files\HP 2007-07-22 15:43 <DIR> d-------- C:\WINDOWS\system32\URTTEMP 2007-07-22 15:42 <DIR> d-------- C:\Program Files\Hewlett-Packard 2007-07-22 15:41 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\HP 2007-07-22 15:40 51,120 -ra------ C:\WINDOWS\system32\drivers\HPZid412.sys 2007-07-22 15:40 16,496 -ra------ C:\WINDOWS\system32\drivers\HPZipr12.sys 2007-07-22 15:39 37,376 --a------ C:\WINDOWS\system32\hpz3l3xu.dll 2007-07-22 15:30 94,208 --a------ C:\WINDOWS\system32\HPZipt12.dll 2007-07-22 15:30 69,632 --a------ C:\WINDOWS\system32\HPZipm12.exe 2007-07-22 15:30 61,440 --a------ C:\WINDOWS\system32\HPZinw12.exe 2007-07-22 15:30 57,344 --a------ C:\WINDOWS\system32\HPZisn12.dll 2007-07-22 15:30 306,688 --a------ C:\WINDOWS\IsUninst.exe 2007-07-22 15:30 278,584 --a------ C:\WINDOWS\system32\HPZidr12.dll 2007-07-22 15:30 204,800 --a------ C:\WINDOWS\system32\HPZipr12.dll 2007-07-22 15:22 <DIR> d-------- C:\Program Files\HP 2007-07-22 15:11 81,141 --a------ C:\WINDOWS\hpfins05.dat 2007-07-22 15:11 1,547 --------- C:\WINDOWS\hpfmdl05.dat 2007-07-22 15:11 <DIR> d-------- C:\DOCUME~1\Ailish\DANEAP~1\HP 2007-07-22 15:08 31,616 --a--c--- C:\WINDOWS\system32\dllcache\usbccgp.sys 2007-07-22 15:08 31,616 --a------ C:\WINDOWS\system32\drivers\usbccgp.sys 2007-07-22 15:08 25,856 --a--c--- C:\WINDOWS\system32\dllcache\usbprint.sys 2007-07-22 15:08 25,856 --a------ C:\WINDOWS\system32\drivers\usbprint.sys 2007-07-22 09:29 3,997 --a------ C:\WINDOWS\fjdtbjie.exe 2007-07-22 09:27 3,997 --a------ C:\WINDOWS\g1afq33s.exe 2007-07-22 09:27 3,997 --a------ C:\WINDOWS\78c4csq4.exe 2007-07-22 09:26 3,997 --a------ C:\WINDOWS\lzqmdiri.exe 2007-07-22 09:26 3,997 --a------ C:\WINDOWS\cnsofuym.exe 2007-07-22 09:26 3,997 --a------ C:\WINDOWS\bugkivsp.exe 2007-07-22 09:26 3,997 --a------ C:\WINDOWS\5vi08ehd.exe 2007-07-21 22:25 26,496 --a--c--- C:\WINDOWS\system32\dllcache\usbstor.sys 2007-07-21 21:44 <DIR> d-------- C:\Program Files\Techland 2007-07-19 23:19 <DIR> d-------- C:\DOCUME~1\Ailish\DANEAP~1\ACD Systems 2007-07-19 19:57 9,856 --a------ C:\WINDOWS\system32\drivers\pfc.sys 2007-07-19 19:57 <DIR> d-------- C:\Program Files\Common Files\ACD Systems 2007-07-19 19:57 <DIR> d-------- C:\Program Files\ACD Systems 2007-07-19 19:57 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\ACD Systems 2007-07-19 09:50 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\Adobe Systems 2007-07-19 09:49 <DIR> d-------- C:\Program Files\Common Files\Adobe Systems Shared 2007-07-19 09:38 <DIR> d-------- C:\DOCUME~1\Ailish\DANEAP~1\Media Player Classic 2007-07-18 23:43 17,920 --a------ C:\WINDOWS\system32\mdimon.dll 2007-07-18 23:41 <DIR> d-------- C:\WINDOWS\SHELLNEW 2007-07-18 23:40 <DIR> d-------- C:\Program Files\Microsoft.NET 2007-07-18 23:37 <DIR> dr-h----- C:\MSOCache 2007-07-18 23:35 2,957,312 --------- C:\WINDOWS\UNNMP.exe 2007-07-18 23:34 <DIR> d-------- C:\Program Files\Common Files\LightScribe 2007-07-18 23:33 163,840 --a------ C:\WINDOWS\system32\NeroCheck.exe 2007-07-18 23:33 <DIR> d-------- C:\Program Files\Common Files\Nero 2007-07-18 23:31 24,064 --------- C:\WINDOWS\system32\msxml3a.dll 2007-07-18 23:31 2,973,696 --------- C:\WINDOWS\UNNeroVision.exe 2007-07-18 23:30 476,320 --------- C:\WINDOWS\system32\ImagXpr7.dll 2007-07-18 23:30 471,040 --------- C:\WINDOWS\system32\ImagXRA7.dll (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) 2007-08-01 23:51 2560 --a------ C:\WINDOWS\system32\BitCometRes.dll 2007-07-22 15:44 88422 --a------ C:\WINDOWS\system32\perfc015.dat 2007-07-22 15:44 497076 --a------ C:\WINDOWS\system32\perfh015.dat --------- C:\Program Files\Usługi online ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SoundMan"="SOUNDMAN.EXE" [2004-01-08 20:54 C:\WINDOWS\SOUNDMAN.EXE] "ATICCC"="C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" [2006-01-02 16:41] "DAEMON Tools-1033"="C:\Program Files\D-Tools\daemon.exe" [2004-08-22 17:05] "HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2005-05-11 23:12] "avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-04-30 17:42] "Flashget"="C:\Program Files\FlashGet\FlashGet.exe" [2007-03-20 12:40] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:44] "Gadu-Gadu"="C:\Program Files\Gadu-Gadu\gg.exe" [2007-07-09 09:39] C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\ GetRight - Tray Icon.lnk - C:\Program Files\GetRight\getright.exe [2007-07-24 12:49:25] HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2005-05-11 23:23:26] HP Image Zone - szybkie uruchamianie.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe [2005-05-12 00:49:24] R3 ALCXSENS;Service for WDM 3D Audio Driver;C:\WINDOWS\system32\drivers\ALCXSENS.SYS S3 idsvc;Windows CardSpace;"C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe" S4 NetTcpPortSharing;Net.Tcp Port Sharing Service;"C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe" Contents of the 'Scheduled Tasks' folder 2007-08-04 10:00:00 C:\WINDOWS\Tasks\HPpromotions journeysoftware.job - C:\Program Files\hp\digital imaging\bin\hp promotions\journeysoftware\HPpromo.exe 2007-07-30 14:02:08 C:\WINDOWS\Tasks\WebReg Deskjet 5900 series.job - C:\Program Files\HP\Digital Imaging\bin\hpqwrg.exe ************************************************************************** catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-08-04 23:36:03 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... scanning hidden registry entries ... [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths] "Directory"="C:\Documents and Settings\LocalService\Ustawienia lokalne\Temporary Internet Files\Content.IE5" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1] "CachePath"="C:\Documents and Settings\LocalService\Ustawienia lokalne\Temporary Internet Files\Content.IE5\Cache1" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2] "CachePath"="C:\Documents and Settings\LocalService\Ustawienia lokalne\Temporary Internet Files\Content.IE5\Cache2" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3] "CachePath"="C:\Documents and Settings\LocalService\Ustawienia lokalne\Temporary Internet Files\Content.IE5\Cache3" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4] "CachePath"="C:\Documents and Settings\LocalService\Ustawienia lokalne\Temporary Internet Files\Content.IE5\Cache4" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Prefetcher] "TracesProcessed"=dword:00000144 [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\A\1\5\1c] "Order"=hex:08,00,00,00,02,00,00,00,b8,01,00,00,01,00,00,00,04,00,00,00,8c,.. [HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache] "C:\Program Files\Maxthon\Maxthon.exe"="Maxthon Web Browser" scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** Completion time: 2007-08-04 23:38:07 - machine was rebooted C:\ComboFix-quarantined-files.txt ... 2007-08-04 23:37 --- E O F ---

Kod: Zaznacz wszystko: Logfile of The Avenger version 1, by Swandog46 Running from registry key: \Registry\Machine\System\CurrentControlSet\Services\mamlctpg ******************* Script file located at: \??\C:\Program Files\fkgmcppe.txt Script file opened successfully. Script file read successfully Backups directory opened successfully at C:\Avenger ******************* Beginning to process script file: Driver DomainService unloaded successfully. File C:\WINDOWS\system32\qwerty12.exe deleted successfully. File C:\WINDOWS\SYSTEM32\calpol.dll deleted successfully. File c:\windows\system32\gebyxuv.dll deleted successfully. File C:\WINDOWS\system32\tmpD.tmp.dll deleted successfully. File C:\WINDOWS\opqqnn.dll deleted successfully. Completed script processing. ******************* Finished! Terminate.

Kod: Zaznacz wszystko: "Silent Runners.vbs", revision R51, http://www.silentrunners.org/ Operating System: Windows XP SP2 Output limited to non-default values, except where indicated by "{++}" Startup items buried in registry: --------------------------------- HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ {++} "CTFMON.EXE" = "C:\WINDOWS\system32\ctfmon.exe" [MS] "Gadu-Gadu" = ""C:\Program Files\Gadu-Gadu\gg.exe" /tray" ["Gadu-Gadu S.A."] HKLM\Software\Microsoft\Windows\CurrentVersion\Run\ {++} "SoundMan" = "SOUNDMAN.EXE" ["Realtek Semiconductor Corp."] "ATICCC" = ""C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay" [null data] "DAEMON Tools-1033" = ""C:\Program Files\D-Tools\daemon.exe" -lang 1033" ["DAEMON'S HOME"] "HP Software Update" = "C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" ["Hewlett-Packard Co."] "avast!" = "C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" ["ALWIL Software"] "Flashget" = "C:\Program Files\FlashGet\FlashGet.exe /min" ["FlashGet.com"] HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\(Default) = (no title provided) -> {HKLM...CLSID} = "Adobe PDF Reader Link Helper" \InProcServer32\(Default) = "C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll" ["Adobe Systems Incorporated"] {2F364306-AA45-47B5-9F9D-39A8B94E7EF7}\(Default) = "flashget urlcatch" -> {HKLM...CLSID} = "FGCatchUrl" \InProcServer32\(Default) = "C:\Program Files\FlashGet\jccatch.dll" ["www.flashget.com"] {31FF080D-12A3-439A-A2EF-4BA95A3148E8}\(Default) = (no title provided) -> {HKLM...CLSID} = "bho2gr Class" \InProcServer32\(Default) = "C:\Program Files\GetRight\xx2gr.dll" ["Headlight Software, Inc."] {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60}\(Default) = "BitComet ClickCapture" -> {HKLM...CLSID} = "BitComet Helper" \InProcServer32\(Default) = "C:\Program Files\BitComet\tools\BitCometBHO_1.1.7.4.dll" ["BitComet"] {724d43a9-0d85-11d4-9908-00400523e39a}\(Default) = (no title provided) -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "C:\Program Files\Siber Systems\AI RoboForm\roboform.dll" ["Siber Systems"] {F156768E-81EF-470C-9057-481BA8380DBA}\(Default) = (no title provided) -> {HKLM...CLSID} = "FlashGet GetFlash Class" \InProcServer32\(Default) = "C:\Program Files\FlashGet\getflash.dll" ["www.flashget.com"] HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\ "{42071714-76d4-11d1-8b24-00a0c9068ff3}" = "Rozszerzenie CPL kadrowania wyświetlania" -> {HKLM...CLSID} = "Rozszerzenie CPL kadrowania wyświetlania" \InProcServer32\(Default) = "deskpan.dll" [file not found] "{88895560-9AA2-1069-930E-00AA0030EBC8}" = "Rozszerzenie ikony HyperTerminalu" -> {HKLM...CLSID} = "HyperTerminal Icon Ext" \InProcServer32\(Default) = "C:\WINDOWS\System32\hticons.dll" ["Hilgraeve, Inc."] "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" = "WinRAR shell extension" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] "{5E2121EE-0300-11D4-8D3B-444553540000}" = "Catalyst Context Menu extension" -> {HKLM...CLSID} = "SimpleShlExt Class" \InProcServer32\(Default) = "C:\Program Files\ATI Technologies\ATI.ACE\atiacmxx.dll" [empty string] "{00020D75-0000-0000-C000-000000000046}" = "Microsoft Office Outlook Desktop Icon Handler" -> {HKLM...CLSID} = "Microsoft Office Outlook" \InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\OFFICE11\MLSHEXT.DLL" [MS] "{0006F045-0000-0000-C000-000000000046}" = "Microsoft Office Outlook Custom Icon Handler" -> {HKLM...CLSID} = "Rozszerzenie ikon plików programu Outlook" \InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\OFFICE11\OLKFSTUB.DLL" [MS] "{42042206-2D85-11D3-8CFF-005004838597}" = "Microsoft Office HTML Icon Handler" -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "C:\Program Files\Microsoft Office\OFFICE11\msohev.dll" [MS] "{472083B0-C522-11CF-8763-00608CC02F24}" = "avast" -> {HKLM...CLSID} = "avast" \InProcServer32\(Default) = "C:\Program Files\Alwil Software\Avast4\ashShell.dll" ["ALWIL Software"] HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ <<!>> AtiExtEvent\DLLName = "Ati2evxx.dll" ["ATI Technologies Inc."] HKLM\Software\Classes\PROTOCOLS\Filter\ <<!>> text/xml\CLSID = "{807553E5-5146-11D5-A672-00B0D022E945}" -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL" [MS] HKLM\Software\Classes\Folder\shellex\ColumnHandlers\ {F9DB5320-233E-11D1-9F84-707F02C10627}\(Default) = "PDF Column Info" -> {HKLM...CLSID} = "PDF Shell Extension" \InProcServer32\(Default) = "C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\PDFShell.dll" ["Adobe Systems, Inc."] HKLM\Software\Classes\*\shellex\ContextMenuHandlers\ avast\(Default) = "{472083B0-C522-11CF-8763-00608CC02F24}" -> {HKLM...CLSID} = "avast" \InProcServer32\(Default) = "C:\Program Files\Alwil Software\Avast4\ashShell.dll" ["ALWIL Software"] WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\ WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\ avast\(Default) = "{472083B0-C522-11CF-8763-00608CC02F24}" -> {HKLM...CLSID} = "avast" \InProcServer32\(Default) = "C:\Program Files\Alwil Software\Avast4\ashShell.dll" ["ALWIL Software"] WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] Group Policies {GPedit.msc branch and setting}: ----------------------------------------------- Note: detected settings may not have any effect. HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\ "shutdownwithoutlogon" = (REG_DWORD) hex:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| Shutdown: Allow system to be shut down without having to log on} "undockwithoutlogon" = (REG_DWORD) hex:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| Devices: Allow undock without having to log on} Active Desktop and Wallpaper: ----------------------------- Active Desktop may be disabled at this entry: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState Displayed if Active Desktop enabled and wallpaper not set by Group Policy: HKCU\Software\Microsoft\Internet Explorer\Desktop\General\ "Wallpaper" = "C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp" Startup items in "Ailish" & "All Users" startup folders: -------------------------------------------------------- C:\Documents and Settings\All Users\Menu Start\Programy\Autostart "GetRight - Tray Icon" -> shortcut to: "C:\Program Files\GetRight\getright.exe" ["Headlight Software, Inc."] "HP Digital Imaging Monitor" -> shortcut to: "C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe" ["Hewlett-Packard Co."] "HP Image Zone - szybkie uruchamianie" -> shortcut to: "C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe -s" [null data] Enabled Scheduled Tasks: ------------------------ "HPpromotions journeysoftware" -> launches: "C:\Program Files\hp\digital imaging\bin\hp promotions\journeysoftware\HPpromo.exe /N "journeysoftware" -r" ["hp"] "WebReg Deskjet 5900 series" -> launches: "C:\Program Files\HP\Digital Imaging\bin\hpqwrg.exe "Deskjet 5900 series"" ["Hewlett-Packard Co."] Winsock2 Service Provider DLLs: ------------------------------- Namespace Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++} 000000000001\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS] 000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS] 000000000003\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS] 000000000004\LibraryPath = "C:\Program Files\Bonjour\mdnsNSP.dll" ["Apple Computer, Inc."] Transport Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++} 0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range: %SystemRoot%\system32\mswsock.dll [MS], 01 - 03, 06 - 13 %SystemRoot%\system32\rsvpsp.dll [MS], 04 - 05 Toolbars, Explorer Bars, Extensions: ------------------------------------ Toolbars HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\ "{724D43A0-0D85-11D4-9908-00400523E39A}" -> {HKLM...CLSID} = "&RoboForm" \InProcServer32\(Default) = "C:\Program Files\Siber Systems\AI RoboForm\roboform.dll" ["Siber Systems"] HKLM\Software\Microsoft\Internet Explorer\Toolbar\ "{724D43A0-0D85-11D4-9908-00400523E39A}" = (no title provided) -> {HKLM...CLSID} = "&RoboForm" \InProcServer32\(Default) = "C:\Program Files\Siber Systems\AI RoboForm\roboform.dll" ["Siber Systems"] Explorer Bars HKLM\Software\Microsoft\Internet Explorer\Explorer Bars\ HKLM\Software\Classes\CLSID\{E7A829CC-671F-4C3D-B590-8C0AEA72E6B2}\(Default) = "BitComet Search" Implemented Categories\{00021493-0000-0000-C000-000000000046}\ [vertical bar] InProcServer32\(Default) = "C:\Program Files\BitComet\tools\BitCometBHO_1.1.7.4.dll" ["BitComet"] HKLM\Software\Classes\CLSID\{FF059E31-CC5A-4E2E-BF3B-96E929D65503}\(Default) = "&Badanie" Implemented Categories\{00021493-0000-0000-C000-000000000046}\ [vertical bar] InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL" [MS] Extensions (Tools menu items, main toolbar menu buttons) HKLM\Software\Microsoft\Internet Explorer\Extensions\ {320AF880-6646-11D3-ABEE-C5DBF3571F46}\ "ButtonText" = "Wypełnij pola" "MenuText" = "Wypełnij Pola" "Script" = "file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html" [file not found] {320AF880-6646-11D3-ABEE-C5DBF3571F49}\ "ButtonText" = "Zapisz" "MenuText" = "Zapisz Pola" "Script" = "file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html" [file not found] {461CC20B-FB6E-4F16-8FE8-C29359DB100E}\ "ButtonText" = "BitComet Search" {724D43AA-0D85-11D4-9908-00400523E39A}\ "ButtonText" = "RoboForm" "MenuText" = "Pasek Narzędzi RoboForm" "Script" = "file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html" [file not found] {92780B25-18CC-41C8-B9BE-3C9C571A8263}\ "ButtonText" = "Badanie" {D6E814A0-E0C5-11D4-8D29-0050BA6940E3}\ "ButtonText" = "FlashGet" "MenuText" = "FlashGet" "Exec" = "C:\Program Files\FlashGet\FlashGet.exe" ["FlashGet.com"] {FB5F1910-F110-11D2-BB9E-00C04F795683}\ "ButtonText" = "Messenger" "MenuText" = "Windows Messenger" "Exec" = "C:\Program Files\Messenger\msmsgs.exe" [MS] Running Services (Display Name, Service Name, Path {Service DLL}): ------------------------------------------------------------------ ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762##, Bonjour Service, ""C:\Program Files\Bonjour\mDNSResponder.exe"" ["Apple Computer, Inc."] Ati HotKey Poller, Ati HotKey Poller, "C:\WINDOWS\system32\Ati2evxx.exe" ["ATI Technologies Inc."] avast! Antivirus, avast! Antivirus, ""C:\Program Files\Alwil Software\Avast4\ashServ.exe"" ["ALWIL Software"] avast! iAVS4 Control Service, aswUpdSv, ""C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe"" ["ALWIL Software"] avast! Mail Scanner, avast! Mail Scanner, ""C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service" ["ALWIL Software"] avast! Web Scanner, avast! Web Scanner, ""C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service" ["ALWIL Software"] LightScribeService Direct Disc Labeling Service, LightScribeService, ""C:\Program Files\Common Files\LightScribe\LSSrvc.exe"" ["Hewlett-Packard Company"] Print Monitors: --------------- HKLM\System\CurrentControlSet\Control\Print\Monitors\ Microsoft Document Imaging Writer Monitor\Driver = "mdimon.dll" [MS] PCL Language Monitor\Driver = "hpz3l3xu.dll" ["Hewlett-Packard Company"] ---------- (launch time: 2007-08-04 23:41:16) <<!>>: Suspicious data at a malware launch point. + This report excludes default entries except where indicated. + To see *everywhere* the script checks and *everything* it finds, launch it from a command prompt or a shortcut with the -all parameter. + The search for DESKTOP.INI DLL launch points on all local fixed drives took 144 seconds. ---------- (total run time: 197 seconds)

Kod: Zaznacz wszystko: Logfile of HijackThis v1.99.1 Scan saved at 23:45:06, on 2007-08-04 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\Program Files\Common Files\LightScribe\LSSrvc.exe C:\WINDOWS\SOUNDMAN.EXE C:\Program Files\ATI Technologies\ATI.ACE\cli.exe C:\Program Files\D-Tools\daemon.exe C:\Program Files\HP\HP Software Update\HPWuSchd2.exe C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\WINDOWS\system32\wscntfy.exe C:\Program Files\ATI Technologies\ATI.ACE\cli.exe C:\Program Files\ATI Technologies\ATI.ACE\cli.exe C:\Program Files\Maxthon\Maxthon.exe D:\Instal !!!!\HijackThis.exe R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: flashget urlcatch - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\Program Files\FlashGet\jccatch.dll O2 - BHO: bho2gr Class - {31FF080D-12A3-439A-A2EF-4BA95A3148E8} - C:\Program Files\GetRight\xx2gr.dll O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.1.7.4.dll O2 - BHO: (no name) - {724d43a9-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll O2 - BHO: FlashGet GetFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\Program Files\FlashGet\getflash.dll O3 - Toolbar: &RoboForm - {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033 O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [Flashget] C:\Program Files\FlashGet\FlashGet.exe /min O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - Global Startup: GetRight - Tray Icon.lnk = C:\Program Files\GetRight\getright.exe O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe O4 - Global Startup: HP Image Zone - szybkie uruchamianie.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm O8 - Extra context menu item: &Ściągnij przy pomocy FlashGet'a - C:\Program Files\FlashGet\jc_link.htm O8 - Extra context menu item: &Ściągnij wszystko przy pomocy FlashGet'a - C:\Program Files\FlashGet\jc_all.htm O8 - Extra context menu item: Download with GetRight - C:\Program Files\GetRight\GRdownload.htm O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O8 - Extra context menu item: Open with GetRight Browser - C:\Program Files\GetRight\GRbrowse.htm O8 - Extra context menu item: Pasek Narzędzi RoboForm - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html O8 - Extra context menu item: Personalizuj Menu - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html O8 - Extra context menu item: Wypełnij Pola - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html O8 - Extra context menu item: Zapisz Pola - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html O9 - Extra button: Wypełnij pola - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html O9 - Extra 'Tools' menuitem: Wypełnij Pola - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html O9 - Extra button: Zapisz - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html O9 - Extra 'Tools' menuitem: Zapisz Pola - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html O9 - Extra button: BitComet Search - {461CC20B-FB6E-4f16-8FE8-C29359DB100E} - C:\Program Files\BitComet\tools\BitCometBHO_1.1.7.4.dll O9 - Extra button: RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html O9 - Extra 'Tools' menuitem: Pasek Narzędzi RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O10 - Unknown file in Winsock LSP: c:\program files\bonjour\mdnsnsp.dll O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing) O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing) O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

**Posty:** 18165 · przez **wojtas** 05 Sie 2007, 09:09

uruchom narzędzie
The Avenger
Zaznacz opcję Input script manually i kliknij na Lupkę z prawej strony. W okienku, które się otworzy wklejasz:

Files to delete:

C:\WINDOWS\system32\dmscom.dll.vir
C:\WINDOWS\system32\irct32.dll.vir
C:\WINDOWS\system32\EcPpnrBl.exe
C:\WINDOWS\fjdtbjie.exe
C:\WINDOWS\g1afq33s.exe
C:\WINDOWS\78c4csq4.exe
C:\WINDOWS\lzqmdiri.exe
C:\WINDOWS\cnsofuym.exe
C:\WINDOWS\bugkivsp.exe
C:\WINDOWS\5vi08ehd.exe

Klikasz Done, a następnie zielone światełko i zgadzasz się na restart klikając OK.

Kasujesz ręcznie z dysku plik: C:\Avenger\backup.zip i wklejasz na forum raport: C:\avenger.txt + log z combofixa

**Posty:** 62 · przez **Ailish** 05 Sie 2007, 09:31

Kod: Zaznacz wszystko: "Silent Runners.vbs", revision R51, http://www.silentrunners.org/ Operating System: Windows XP SP2 Output limited to non-default values, except where indicated by "{++}" Startup items buried in registry: --------------------------------- HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ {++} "CTFMON.EXE" = "C:\WINDOWS\system32\ctfmon.exe" [MS] "Gadu-Gadu" = ""C:\Program Files\Gadu-Gadu\gg.exe" /tray" ["Gadu-Gadu S.A."] HKLM\Software\Microsoft\Windows\CurrentVersion\Run\ {++} "SoundMan" = "SOUNDMAN.EXE" ["Realtek Semiconductor Corp."] "ATICCC" = ""C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay" [null data] "DAEMON Tools-1033" = ""C:\Program Files\D-Tools\daemon.exe" -lang 1033" ["DAEMON'S HOME"] "HP Software Update" = "C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" ["Hewlett-Packard Co."] "avast!" = "C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" ["ALWIL Software"] "Flashget" = "C:\Program Files\FlashGet\FlashGet.exe /min" ["FlashGet.com"] HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\(Default) = (no title provided) -> {HKLM...CLSID} = "Adobe PDF Reader Link Helper" \InProcServer32\(Default) = "C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll" ["Adobe Systems Incorporated"] {2F364306-AA45-47B5-9F9D-39A8B94E7EF7}\(Default) = "flashget urlcatch" -> {HKLM...CLSID} = "FGCatchUrl" \InProcServer32\(Default) = "C:\Program Files\FlashGet\jccatch.dll" ["www.flashget.com"] {31FF080D-12A3-439A-A2EF-4BA95A3148E8}\(Default) = (no title provided) -> {HKLM...CLSID} = "bho2gr Class" \InProcServer32\(Default) = "C:\Program Files\GetRight\xx2gr.dll" ["Headlight Software, Inc."] {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60}\(Default) = "BitComet ClickCapture" -> {HKLM...CLSID} = "BitComet Helper" \InProcServer32\(Default) = "C:\Program Files\BitComet\tools\BitCometBHO_1.1.7.4.dll" ["BitComet"] {724d43a9-0d85-11d4-9908-00400523e39a}\(Default) = (no title provided) -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "C:\Program Files\Siber Systems\AI RoboForm\roboform.dll" ["Siber Systems"] {F156768E-81EF-470C-9057-481BA8380DBA}\(Default) = (no title provided) -> {HKLM...CLSID} = "FlashGet GetFlash Class" \InProcServer32\(Default) = "C:\Program Files\FlashGet\getflash.dll" ["www.flashget.com"] HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\ "{42071714-76d4-11d1-8b24-00a0c9068ff3}" = "Rozszerzenie CPL kadrowania wyświetlania" -> {HKLM...CLSID} = "Rozszerzenie CPL kadrowania wyświetlania" \InProcServer32\(Default) = "deskpan.dll" [file not found] "{88895560-9AA2-1069-930E-00AA0030EBC8}" = "Rozszerzenie ikony HyperTerminalu" -> {HKLM...CLSID} = "HyperTerminal Icon Ext" \InProcServer32\(Default) = "C:\WINDOWS\System32\hticons.dll" ["Hilgraeve, Inc."] "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" = "WinRAR shell extension" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] "{5E2121EE-0300-11D4-8D3B-444553540000}" = "Catalyst Context Menu extension" -> {HKLM...CLSID} = "SimpleShlExt Class" \InProcServer32\(Default) = "C:\Program Files\ATI Technologies\ATI.ACE\atiacmxx.dll" [empty string] "{00020D75-0000-0000-C000-000000000046}" = "Microsoft Office Outlook Desktop Icon Handler" -> {HKLM...CLSID} = "Microsoft Office Outlook" \InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\OFFICE11\MLSHEXT.DLL" [MS] "{0006F045-0000-0000-C000-000000000046}" = "Microsoft Office Outlook Custom Icon Handler" -> {HKLM...CLSID} = "Rozszerzenie ikon plików programu Outlook" \InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\OFFICE11\OLKFSTUB.DLL" [MS] "{42042206-2D85-11D3-8CFF-005004838597}" = "Microsoft Office HTML Icon Handler" -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "C:\Program Files\Microsoft Office\OFFICE11\msohev.dll" [MS] "{472083B0-C522-11CF-8763-00608CC02F24}" = "avast" -> {HKLM...CLSID} = "avast" \InProcServer32\(Default) = "C:\Program Files\Alwil Software\Avast4\ashShell.dll" ["ALWIL Software"] HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ <<!>> AtiExtEvent\DLLName = "Ati2evxx.dll" ["ATI Technologies Inc."] HKLM\Software\Classes\PROTOCOLS\Filter\ <<!>> text/xml\CLSID = "{807553E5-5146-11D5-A672-00B0D022E945}" -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL" [MS] HKLM\Software\Classes\Folder\shellex\ColumnHandlers\ {F9DB5320-233E-11D1-9F84-707F02C10627}\(Default) = "PDF Column Info" -> {HKLM...CLSID} = "PDF Shell Extension" \InProcServer32\(Default) = "C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\PDFShell.dll" ["Adobe Systems, Inc."] HKLM\Software\Classes\*\shellex\ContextMenuHandlers\ avast\(Default) = "{472083B0-C522-11CF-8763-00608CC02F24}" -> {HKLM...CLSID} = "avast" \InProcServer32\(Default) = "C:\Program Files\Alwil Software\Avast4\ashShell.dll" ["ALWIL Software"] WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\ WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\ avast\(Default) = "{472083B0-C522-11CF-8763-00608CC02F24}" -> {HKLM...CLSID} = "avast" \InProcServer32\(Default) = "C:\Program Files\Alwil Software\Avast4\ashShell.dll" ["ALWIL Software"] WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] Group Policies {GPedit.msc branch and setting}: ----------------------------------------------- Note: detected settings may not have any effect. HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\ "shutdownwithoutlogon" = (REG_DWORD) hex:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| Shutdown: Allow system to be shut down without having to log on} "undockwithoutlogon" = (REG_DWORD) hex:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| Devices: Allow undock without having to log on} Active Desktop and Wallpaper: ----------------------------- Active Desktop may be disabled at this entry: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState Displayed if Active Desktop enabled and wallpaper not set by Group Policy: HKCU\Software\Microsoft\Internet Explorer\Desktop\General\ "Wallpaper" = "C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp" Startup items in "Ailish" & "All Users" startup folders: -------------------------------------------------------- C:\Documents and Settings\All Users\Menu Start\Programy\Autostart "GetRight - Tray Icon" -> shortcut to: "C:\Program Files\GetRight\getright.exe" ["Headlight Software, Inc."] "HP Digital Imaging Monitor" -> shortcut to: "C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe" ["Hewlett-Packard Co."] "HP Image Zone - szybkie uruchamianie" -> shortcut to: "C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe -s" [null data] Enabled Scheduled Tasks: ------------------------ "HPpromotions journeysoftware" -> launches: "C:\Program Files\hp\digital imaging\bin\hp promotions\journeysoftware\HPpromo.exe /N "journeysoftware" -r" ["hp"] "WebReg Deskjet 5900 series" -> launches: "C:\Program Files\HP\Digital Imaging\bin\hpqwrg.exe "Deskjet 5900 series"" ["Hewlett-Packard Co."] Winsock2 Service Provider DLLs: ------------------------------- Namespace Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++} 000000000001\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS] 000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS] 000000000003\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS] 000000000004\LibraryPath = "C:\Program Files\Bonjour\mdnsNSP.dll" ["Apple Computer, Inc."] Transport Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++} 0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range: %SystemRoot%\system32\mswsock.dll [MS], 01 - 03, 06 - 13 %SystemRoot%\system32\rsvpsp.dll [MS], 04 - 05 Toolbars, Explorer Bars, Extensions: ------------------------------------ Toolbars HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\ "{724D43A0-0D85-11D4-9908-00400523E39A}" -> {HKLM...CLSID} = "&RoboForm" \InProcServer32\(Default) = "C:\Program Files\Siber Systems\AI RoboForm\roboform.dll" ["Siber Systems"] HKLM\Software\Microsoft\Internet Explorer\Toolbar\ "{724D43A0-0D85-11D4-9908-00400523E39A}" = (no title provided) -> {HKLM...CLSID} = "&RoboForm" \InProcServer32\(Default) = "C:\Program Files\Siber Systems\AI RoboForm\roboform.dll" ["Siber Systems"] Explorer Bars HKLM\Software\Microsoft\Internet Explorer\Explorer Bars\ HKLM\Software\Classes\CLSID\{E7A829CC-671F-4C3D-B590-8C0AEA72E6B2}\(Default) = "BitComet Search" Implemented Categories\{00021493-0000-0000-C000-000000000046}\ [vertical bar] InProcServer32\(Default) = "C:\Program Files\BitComet\tools\BitCometBHO_1.1.7.4.dll" ["BitComet"] HKLM\Software\Classes\CLSID\{FF059E31-CC5A-4E2E-BF3B-96E929D65503}\(Default) = "&Badanie" Implemented Categories\{00021493-0000-0000-C000-000000000046}\ [vertical bar] InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL" [MS] Extensions (Tools menu items, main toolbar menu buttons) HKLM\Software\Microsoft\Internet Explorer\Extensions\ {320AF880-6646-11D3-ABEE-C5DBF3571F46}\ "ButtonText" = "Wypełnij pola" "MenuText" = "Wypełnij Pola" "Script" = "file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html" [file not found] {320AF880-6646-11D3-ABEE-C5DBF3571F49}\ "ButtonText" = "Zapisz" "MenuText" = "Zapisz Pola" "Script" = "file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html" [file not found] {461CC20B-FB6E-4F16-8FE8-C29359DB100E}\ "ButtonText" = "BitComet Search" {724D43AA-0D85-11D4-9908-00400523E39A}\ "ButtonText" = "RoboForm" "MenuText" = "Pasek Narzędzi RoboForm" "Script" = "file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html" [file not found] {92780B25-18CC-41C8-B9BE-3C9C571A8263}\ "ButtonText" = "Badanie" {D6E814A0-E0C5-11D4-8D29-0050BA6940E3}\ "ButtonText" = "FlashGet" "MenuText" = "FlashGet" "Exec" = "C:\Program Files\FlashGet\FlashGet.exe" ["FlashGet.com"] {FB5F1910-F110-11D2-BB9E-00C04F795683}\ "ButtonText" = "Messenger" "MenuText" = "Windows Messenger" "Exec" = "C:\Program Files\Messenger\msmsgs.exe" [MS] Running Services (Display Name, Service Name, Path {Service DLL}): ------------------------------------------------------------------ ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762##, Bonjour Service, ""C:\Program Files\Bonjour\mDNSResponder.exe"" ["Apple Computer, Inc."] Ati HotKey Poller, Ati HotKey Poller, "C:\WINDOWS\system32\Ati2evxx.exe" ["ATI Technologies Inc."] avast! Antivirus, avast! Antivirus, ""C:\Program Files\Alwil Software\Avast4\ashServ.exe"" ["ALWIL Software"] avast! iAVS4 Control Service, aswUpdSv, ""C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe"" ["ALWIL Software"] avast! Mail Scanner, avast! Mail Scanner, ""C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service" ["ALWIL Software"] avast! Web Scanner, avast! Web Scanner, ""C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service" ["ALWIL Software"] LightScribeService Direct Disc Labeling Service, LightScribeService, ""C:\Program Files\Common Files\LightScribe\LSSrvc.exe"" ["Hewlett-Packard Company"] Print Monitors: --------------- HKLM\System\CurrentControlSet\Control\Print\Monitors\ Microsoft Document Imaging Writer Monitor\Driver = "mdimon.dll" [MS] PCL Language Monitor\Driver = "hpz3l3xu.dll" ["Hewlett-Packard Company"] ---------- (launch time: 2007-08-05 09:17:47) <<!>>: Suspicious data at a malware launch point. + This report excludes default entries except where indicated. + To see *everywhere* the script checks and *everything* it finds, launch it from a command prompt or a shortcut with the -all parameter. + The search for DESKTOP.INI DLL launch points on all local fixed drives took 199 seconds. ---------- (total run time: 264 seconds)

Kod: Zaznacz wszystko: Logfile of HijackThis v1.99.1 Scan saved at 09:25:15, on 2007-08-05 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\SOUNDMAN.EXE C:\Program Files\ATI Technologies\ATI.ACE\cli.exe C:\Program Files\D-Tools\daemon.exe C:\Program Files\HP\HP Software Update\HPWuSchd2.exe C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\Program Files\FlashGet\FlashGet.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Gadu-Gadu\gg.exe C:\Program Files\GetRight\getright.exe C:\Program Files\Maxthon\Maxthon.exe C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe C:\Program Files\GetRight\getright.exe C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\Program Files\Common Files\LightScribe\LSSrvc.exe C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\WINDOWS\system32\wscntfy.exe C:\Program Files\ATI Technologies\ATI.ACE\cli.exe C:\Program Files\ATI Technologies\ATI.ACE\cli.exe D:\Instal !!!!\HijackThis.exe R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: flashget urlcatch - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\Program Files\FlashGet\jccatch.dll O2 - BHO: bho2gr Class - {31FF080D-12A3-439A-A2EF-4BA95A3148E8} - C:\Program Files\GetRight\xx2gr.dll O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.1.7.4.dll O2 - BHO: (no name) - {724d43a9-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll O2 - BHO: FlashGet GetFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\Program Files\FlashGet\getflash.dll O3 - Toolbar: &RoboForm - {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033 O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [Flashget] C:\Program Files\FlashGet\FlashGet.exe /min O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - Global Startup: GetRight - Tray Icon.lnk = C:\Program Files\GetRight\getright.exe O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe O4 - Global Startup: HP Image Zone - szybkie uruchamianie.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm O8 - Extra context menu item: &Ściągnij przy pomocy FlashGet'a - C:\Program Files\FlashGet\jc_link.htm O8 - Extra context menu item: &Ściągnij wszystko przy pomocy FlashGet'a - C:\Program Files\FlashGet\jc_all.htm O8 - Extra context menu item: Download with GetRight - C:\Program Files\GetRight\GRdownload.htm O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O8 - Extra context menu item: Open with GetRight Browser - C:\Program Files\GetRight\GRbrowse.htm O8 - Extra context menu item: Pasek Narzędzi RoboForm - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html O8 - Extra context menu item: Personalizuj Menu - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html O8 - Extra context menu item: Wypełnij Pola - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html O8 - Extra context menu item: Zapisz Pola - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html O9 - Extra button: Wypełnij pola - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html O9 - Extra 'Tools' menuitem: Wypełnij Pola - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html O9 - Extra button: Zapisz - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html O9 - Extra 'Tools' menuitem: Zapisz Pola - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html O9 - Extra button: BitComet Search - {461CC20B-FB6E-4f16-8FE8-C29359DB100E} - C:\Program Files\BitComet\tools\BitCometBHO_1.1.7.4.dll O9 - Extra button: RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html O9 - Extra 'Tools' menuitem: Pasek Narzędzi RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O10 - Unknown file in Winsock LSP: c:\program files\bonjour\mdnsnsp.dll O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing) O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing) O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

Kod: Zaznacz wszystko: ComboFix 07-08-04.3 - "Ailish" 2007-08-04 23:28:48.1 [GMT 2:00] - NTFS Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.Prawda ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) C:\DOCUME~1\Ailish\DANEAP~1\tmp9.tmp.exe C:\DOCUME~1\Ailish\DANEAP~1\tmpA.tmp.exe C:\DOCUME~1\Ailish\DANEAP~1\tmpC3.tmp.exe C:\DOCUME~1\Ailish\DANEAP~1\tmpC4.tmp.exe C:\DOCUME~1\Ailish\DANEAP~1\tmpC5.tmp.exe C:\DOCUME~1\Ailish\DANEAP~1\tmpD.tmp.exe C:\WINDOWS\system32\dndcdd1fff.dat C:\WINDOWS\system32\ipv6mons.dll C:\WINDOWS\system32\mljge.exe C:\WINDOWS\system32\mllmm.exe C:\WINDOWS\system32\tmpC5.tmp.dll ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) -------\LEGACY_DOMAINSERVICE ((((((((((((((((((((((((( Files Created from 2007-07-04 to 2007-08-04 ))))))))))))))))))))))))))))))) 2007-08-04 23:28 51,200 --a------ C:\WINDOWS\nircmd.exe 2007-08-04 21:19 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\FLEXnet 2007-08-04 21:04 92,726 --a------ C:\WINDOWS\system32\dmscom.dll.vir 2007-08-04 20:59 <DIR> d-------- C:\VundoFix Backups 2007-08-04 20:53 53,248 --a------ C:\WINDOWS\system32\Process.exe 2007-08-04 20:53 51,200 --a------ C:\WINDOWS\system32\dumphive.exe 2007-08-04 20:53 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe 2007-08-04 20:53 2,058 --a------ C:\WINDOWS\system32\tmp.reg 2007-08-04 13:40 <DIR> d-------- C:\Program Files\Bonjour 2007-08-04 13:20 <DIR> d-------- C:\Program Files\Common Files\Macrovision Shared 2007-08-04 06:29 92,730 --a------ C:\WINDOWS\system32\irct32.dll.vir 2007-08-03 16:43 <DIR> d-------- C:\Program Files\PRO100 2007-08-03 14:54 <DIR> d-------- C:\Program Files\PRO100 Demo 2007-08-02 01:25 <DIR> d-------- C:\Mojdom3D 2007-08-01 23:49 <DIR> d-------- C:\Program Files\BitComet 2007-08-01 18:02 24,128 --a------ C:\WINDOWS\system32\EcPpnrBl.exe 2007-07-29 21:59 <DIR> d-------- C:\Program Files\Pro100 3.51 2007-07-27 14:59 <DIR> d-------- C:\Szybki kurs francuskiego 2007-07-27 14:58 <DIR> d-------- C:\DOCUME~1\Ailish\WINDOWS 2007-07-27 12:40 <DIR> d-------- C:\Program Files\FlashGet 2007-07-27 10:48 <DIR> d-------- C:\Program Files\Kodak 2007-07-27 06:34 <DIR> d-------- C:\Program Files\Matroska Pack 2007-07-26 13:48 95,872 --a------ C:\WINDOWS\system32\AVASTSS.scr 2007-07-26 13:48 94,552 --a------ C:\WINDOWS\system32\drivers\aswmon2.sys 2007-07-26 13:48 85,952 --a------ C:\WINDOWS\system32\drivers\aswmon.sys 2007-07-26 13:48 745,600 --a------ C:\WINDOWS\system32\aswBoot.exe 2007-07-26 13:48 43,176 --a------ C:\WINDOWS\system32\drivers\aswTdi.sys 2007-07-26 13:48 26,888 --a------ C:\WINDOWS\system32\drivers\aavmker4.sys 2007-07-26 13:48 23,416 --a------ C:\WINDOWS\system32\drivers\aswRdr.sys 2007-07-26 13:48 <DIR> d-------- C:\Program Files\Alwil Software 2007-07-25 11:35 <DIR> d-------- C:\sysreset 2007-07-24 22:20 545 --a------ C:\WINDOWS\UC.PIF 2007-07-24 22:20 545 --a------ C:\WINDOWS\RAR.PIF 2007-07-24 22:20 545 --a------ C:\WINDOWS\PKZIP.PIF 2007-07-24 22:20 545 --a------ C:\WINDOWS\PKUNZIP.PIF 2007-07-24 22:20 545 --a------ C:\WINDOWS\NOCLOSE.PIF 2007-07-24 22:20 545 --a------ C:\WINDOWS\LHA.PIF 2007-07-24 22:20 545 --a------ C:\WINDOWS\ARJ.PIF 2007-07-24 22:20 <DIR> d-------- C:\totalcmd 2007-07-24 12:49 <DIR> d-------- C:\Program Files\GetRight 2007-07-24 12:49 <DIR> d-------- C:\Downloads 2007-07-23 23:14 <DIR> d-------- C:\Program Files\NAPI-PROJEKT 2007-07-23 17:24 327,168 --a------ C:\WINDOWS\IsUn0415.exe 2007-07-23 14:31 <DIR> d-------- C:\Program Files\Real Alternative 2007-07-23 14:31 <DIR> d-------- C:\Program Files\Media Player Classic 2007-07-23 14:31 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\Real 2007-07-23 14:31 <DIR> d-------- C:\DOCUME~1\Ailish\DANEAP~1\Real 2007-07-22 15:46 <DIR> d-------- C:\Program Files\Common Files\Sonic Shared 2007-07-22 15:46 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\Sonic 2007-07-22 15:45 <DIR> d-------- C:\Program Files\Common Files\HP 2007-07-22 15:43 <DIR> d-------- C:\WINDOWS\system32\URTTEMP 2007-07-22 15:42 <DIR> d-------- C:\Program Files\Hewlett-Packard 2007-07-22 15:41 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\HP 2007-07-22 15:40 51,120 -ra------ C:\WINDOWS\system32\drivers\HPZid412.sys 2007-07-22 15:40 16,496 -ra------ C:\WINDOWS\system32\drivers\HPZipr12.sys 2007-07-22 15:39 37,376 --a------ C:\WINDOWS\system32\hpz3l3xu.dll 2007-07-22 15:30 94,208 --a------ C:\WINDOWS\system32\HPZipt12.dll 2007-07-22 15:30 69,632 --a------ C:\WINDOWS\system32\HPZipm12.exe 2007-07-22 15:30 61,440 --a------ C:\WINDOWS\system32\HPZinw12.exe 2007-07-22 15:30 57,344 --a------ C:\WINDOWS\system32\HPZisn12.dll 2007-07-22 15:30 306,688 --a------ C:\WINDOWS\IsUninst.exe 2007-07-22 15:30 278,584 --a------ C:\WINDOWS\system32\HPZidr12.dll 2007-07-22 15:30 204,800 --a------ C:\WINDOWS\system32\HPZipr12.dll 2007-07-22 15:22 <DIR> d-------- C:\Program Files\HP 2007-07-22 15:11 81,141 --a------ C:\WINDOWS\hpfins05.dat 2007-07-22 15:11 1,547 --------- C:\WINDOWS\hpfmdl05.dat 2007-07-22 15:11 <DIR> d-------- C:\DOCUME~1\Ailish\DANEAP~1\HP 2007-07-22 15:08 31,616 --a--c--- C:\WINDOWS\system32\dllcache\usbccgp.sys 2007-07-22 15:08 31,616 --a------ C:\WINDOWS\system32\drivers\usbccgp.sys 2007-07-22 15:08 25,856 --a--c--- C:\WINDOWS\system32\dllcache\usbprint.sys 2007-07-22 15:08 25,856 --a------ C:\WINDOWS\system32\drivers\usbprint.sys 2007-07-22 09:29 3,997 --a------ C:\WINDOWS\fjdtbjie.exe 2007-07-22 09:27 3,997 --a------ C:\WINDOWS\g1afq33s.exe 2007-07-22 09:27 3,997 --a------ C:\WINDOWS\78c4csq4.exe 2007-07-22 09:26 3,997 --a------ C:\WINDOWS\lzqmdiri.exe 2007-07-22 09:26 3,997 --a------ C:\WINDOWS\cnsofuym.exe 2007-07-22 09:26 3,997 --a------ C:\WINDOWS\bugkivsp.exe 2007-07-22 09:26 3,997 --a------ C:\WINDOWS\5vi08ehd.exe 2007-07-21 22:25 26,496 --a--c--- C:\WINDOWS\system32\dllcache\usbstor.sys 2007-07-21 21:44 <DIR> d-------- C:\Program Files\Techland 2007-07-19 23:19 <DIR> d-------- C:\DOCUME~1\Ailish\DANEAP~1\ACD Systems 2007-07-19 19:57 9,856 --a------ C:\WINDOWS\system32\drivers\pfc.sys 2007-07-19 19:57 <DIR> d-------- C:\Program Files\Common Files\ACD Systems 2007-07-19 19:57 <DIR> d-------- C:\Program Files\ACD Systems 2007-07-19 19:57 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\ACD Systems 2007-07-19 09:50 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\Adobe Systems 2007-07-19 09:49 <DIR> d-------- C:\Program Files\Common Files\Adobe Systems Shared 2007-07-19 09:38 <DIR> d-------- C:\DOCUME~1\Ailish\DANEAP~1\Media Player Classic 2007-07-18 23:43 17,920 --a------ C:\WINDOWS\system32\mdimon.dll 2007-07-18 23:41 <DIR> d-------- C:\WINDOWS\SHELLNEW 2007-07-18 23:40 <DIR> d-------- C:\Program Files\Microsoft.NET 2007-07-18 23:37 <DIR> dr-h----- C:\MSOCache 2007-07-18 23:35 2,957,312 --------- C:\WINDOWS\UNNMP.exe 2007-07-18 23:34 <DIR> d-------- C:\Program Files\Common Files\LightScribe 2007-07-18 23:33 163,840 --a------ C:\WINDOWS\system32\NeroCheck.exe 2007-07-18 23:33 <DIR> d-------- C:\Program Files\Common Files\Nero 2007-07-18 23:31 24,064 --------- C:\WINDOWS\system32\msxml3a.dll 2007-07-18 23:31 2,973,696 --------- C:\WINDOWS\UNNeroVision.exe 2007-07-18 23:30 476,320 --------- C:\WINDOWS\system32\ImagXpr7.dll 2007-07-18 23:30 471,040 --------- C:\WINDOWS\system32\ImagXRA7.dll (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) 2007-08-01 23:51 2560 --a------ C:\WINDOWS\system32\BitCometRes.dll 2007-07-22 15:44 88422 --a------ C:\WINDOWS\system32\perfc015.dat 2007-07-22 15:44 497076 --a------ C:\WINDOWS\system32\perfh015.dat --------- C:\Program Files\Usługi online ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SoundMan"="SOUNDMAN.EXE" [2004-01-08 20:54 C:\WINDOWS\SOUNDMAN.EXE] "ATICCC"="C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" [2006-01-02 16:41] "DAEMON Tools-1033"="C:\Program Files\D-Tools\daemon.exe" [2004-08-22 17:05] "HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2005-05-11 23:12] "avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-04-30 17:42] "Flashget"="C:\Program Files\FlashGet\FlashGet.exe" [2007-03-20 12:40] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:44] "Gadu-Gadu"="C:\Program Files\Gadu-Gadu\gg.exe" [2007-07-09 09:39] C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\ GetRight - Tray Icon.lnk - C:\Program Files\GetRight\getright.exe [2007-07-24 12:49:25] HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2005-05-11 23:23:26] HP Image Zone - szybkie uruchamianie.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe [2005-05-12 00:49:24] R3 ALCXSENS;Service for WDM 3D Audio Driver;C:\WINDOWS\system32\drivers\ALCXSENS.SYS S3 idsvc;Windows CardSpace;"C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe" S4 NetTcpPortSharing;Net.Tcp Port Sharing Service;"C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe" Contents of the 'Scheduled Tasks' folder 2007-08-04 10:00:00 C:\WINDOWS\Tasks\HPpromotions journeysoftware.job - C:\Program Files\hp\digital imaging\bin\hp promotions\journeysoftware\HPpromo.exe 2007-07-30 14:02:08 C:\WINDOWS\Tasks\WebReg Deskjet 5900 series.job - C:\Program Files\HP\Digital Imaging\bin\hpqwrg.exe ************************************************************************** catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-08-04 23:36:03 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... scanning hidden registry entries ... [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths] "Directory"="C:\Documents and Settings\LocalService\Ustawienia lokalne\Temporary Internet Files\Content.IE5" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1] "CachePath"="C:\Documents and Settings\LocalService\Ustawienia lokalne\Temporary Internet Files\Content.IE5\Cache1" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2] "CachePath"="C:\Documents and Settings\LocalService\Ustawienia lokalne\Temporary Internet Files\Content.IE5\Cache2" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3] "CachePath"="C:\Documents and Settings\LocalService\Ustawienia lokalne\Temporary Internet Files\Content.IE5\Cache3" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4] "CachePath"="C:\Documents and Settings\LocalService\Ustawienia lokalne\Temporary Internet Files\Content.IE5\Cache4" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Prefetcher] "TracesProcessed"=dword:00000144 [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\A\1\5\1c] "Order"=hex:08,00,00,00,02,00,00,00,b8,01,00,00,01,00,00,00,04,00,00,00,8c,.. [HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache] "C:\Program Files\Maxthon\Maxthon.exe"="Maxthon Web Browser" scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** Completion time: 2007-08-04 23:38:07 - machine was rebooted C:\ComboFix-quarantined-files.txt ... 2007-08-04 23:37 --- E O F ---

Kod: Zaznacz wszystko: Logfile of The Avenger version 1, by Swandog46 Running from registry key: \Registry\Machine\System\CurrentControlSet\Services\mamlctpg ******************* Script file located at: \??\C:\Program Files\fkgmcppe.txt Script file opened successfully. Script file read successfully Backups directory opened successfully at C:\Avenger ******************* Beginning to process script file: Driver DomainService unloaded successfully. File C:\WINDOWS\system32\qwerty12.exe deleted successfully. File C:\WINDOWS\SYSTEM32\calpol.dll deleted successfully. File c:\windows\system32\gebyxuv.dll deleted successfully. File C:\WINDOWS\system32\tmpD.tmp.dll deleted successfully. File C:\WINDOWS\opqqnn.dll deleted successfully. Completed script processing. ******************* Finished! Terminate.

**Posty:** 18165 · przez **wojtas** 05 Sie 2007, 09:57

nie wykonales tego polecnia z avengerem?? bo w logu w combofixie nadal sa wirusy... kazalem Ci co innego wkleic do avengera a Ty wkleiles dwa razy to samo

**Posty:** 62 · przez **Ailish** 05 Sie 2007, 10:15

Sorry, nie wiem co sie stało. Chyba się jeszcze do końca nie obudziłam. Juz się poprawiam

Kod: Zaznacz wszystko: Logfile of The Avenger version 1, by Swandog46 Running from registry key: \Registry\Machine\System\CurrentControlSet\Services\hdutsgwc ******************* Script file located at: \??\C:\WINDOWS\system32\wghqcwim.txt Script file opened successfully. Script file read successfully Backups directory opened successfully at C:\Avenger ******************* Beginning to process script file: File C:\WINDOWS\system32\dmscom.dll.vir deleted successfully. File C:\WINDOWS\system32\irct32.dll.vir deleted successfully. File C:\WINDOWS\system32\EcPpnrBl.exe deleted successfully. File C:\WINDOWS\fjdtbjie.exe deleted successfully. File C:\WINDOWS\g1afq33s.exe deleted successfully. File C:\WINDOWS\78c4csq4.exe deleted successfully. File C:\WINDOWS\lzqmdiri.exe deleted successfully. File C:\WINDOWS\cnsofuym.exe deleted successfully. File C:\WINDOWS\bugkivsp.exe deleted successfully. File C:\WINDOWS\5vi08ehd.exe deleted successfully. Completed script processing. ******************* Finished! Terminate.

Kod: Zaznacz wszystko: ComboFix 07-08-04.3 - "Ailish" 2007-08-05 10:00:53.2 [GMT 2:00] - NTFS Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.Prawda ((((((((((((((((((((((((( Files Created from 2007-07-05 to 2007-08-05 ))))))))))))))))))))))))))))))) 2007-08-04 23:28 51,200 --a------ C:\WINDOWS\nircmd.exe 2007-08-04 21:19 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\FLEXnet 2007-08-04 20:59 <DIR> d-------- C:\VundoFix Backups 2007-08-04 20:53 53,248 --a------ C:\WINDOWS\system32\Process.exe 2007-08-04 20:53 51,200 --a------ C:\WINDOWS\system32\dumphive.exe 2007-08-04 20:53 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe 2007-08-04 20:53 2,058 --a------ C:\WINDOWS\system32\tmp.reg 2007-08-04 13:40 <DIR> d-------- C:\Program Files\Bonjour 2007-08-04 13:20 <DIR> d-------- C:\Program Files\Common Files\Macrovision Shared 2007-08-03 16:43 <DIR> d-------- C:\Program Files\PRO100 2007-08-03 14:54 <DIR> d-------- C:\Program Files\PRO100 Demo 2007-08-02 01:25 <DIR> d-------- C:\Mojdom3D 2007-08-01 23:49 <DIR> d-------- C:\Program Files\BitComet 2007-07-29 21:59 <DIR> d-------- C:\Program Files\Pro100 3.51 2007-07-27 14:59 <DIR> d-------- C:\Szybki kurs francuskiego 2007-07-27 14:58 <DIR> d-------- C:\DOCUME~1\Ailish\WINDOWS 2007-07-27 12:40 <DIR> d-------- C:\Program Files\FlashGet 2007-07-27 10:48 <DIR> d-------- C:\Program Files\Kodak 2007-07-27 06:34 <DIR> d-------- C:\Program Files\Matroska Pack 2007-07-26 13:48 95,872 --a------ C:\WINDOWS\system32\AVASTSS.scr 2007-07-26 13:48 94,552 --a------ C:\WINDOWS\system32\drivers\aswmon2.sys 2007-07-26 13:48 85,952 --a------ C:\WINDOWS\system32\drivers\aswmon.sys 2007-07-26 13:48 745,600 --a------ C:\WINDOWS\system32\aswBoot.exe 2007-07-26 13:48 43,176 --a------ C:\WINDOWS\system32\drivers\aswTdi.sys 2007-07-26 13:48 26,888 --a------ C:\WINDOWS\system32\drivers\aavmker4.sys 2007-07-26 13:48 23,416 --a------ C:\WINDOWS\system32\drivers\aswRdr.sys 2007-07-26 13:48 <DIR> d-------- C:\Program Files\Alwil Software 2007-07-25 11:35 <DIR> d-------- C:\sysreset 2007-07-24 22:20 545 --a------ C:\WINDOWS\UC.PIF 2007-07-24 22:20 545 --a------ C:\WINDOWS\RAR.PIF 2007-07-24 22:20 545 --a------ C:\WINDOWS\PKZIP.PIF 2007-07-24 22:20 545 --a------ C:\WINDOWS\PKUNZIP.PIF 2007-07-24 22:20 545 --a------ C:\WINDOWS\NOCLOSE.PIF 2007-07-24 22:20 545 --a------ C:\WINDOWS\LHA.PIF 2007-07-24 22:20 545 --a------ C:\WINDOWS\ARJ.PIF 2007-07-24 22:20 <DIR> d-------- C:\totalcmd 2007-07-24 12:49 <DIR> d-------- C:\Program Files\GetRight 2007-07-24 12:49 <DIR> d-------- C:\Downloads 2007-07-23 23:14 <DIR> d-------- C:\Program Files\NAPI-PROJEKT 2007-07-23 17:24 327,168 --a------ C:\WINDOWS\IsUn0415.exe 2007-07-23 14:31 <DIR> d-------- C:\Program Files\Real Alternative 2007-07-23 14:31 <DIR> d-------- C:\Program Files\Media Player Classic 2007-07-23 14:31 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\Real 2007-07-23 14:31 <DIR> d-------- C:\DOCUME~1\Ailish\DANEAP~1\Real 2007-07-22 15:46 <DIR> d-------- C:\Program Files\Common Files\Sonic Shared 2007-07-22 15:46 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\Sonic 2007-07-22 15:45 <DIR> d-------- C:\Program Files\Common Files\HP 2007-07-22 15:43 <DIR> d-------- C:\WINDOWS\system32\URTTEMP 2007-07-22 15:42 <DIR> d-------- C:\Program Files\Hewlett-Packard 2007-07-22 15:41 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\HP 2007-07-22 15:40 51,120 -ra------ C:\WINDOWS\system32\drivers\HPZid412.sys 2007-07-22 15:40 16,496 -ra------ C:\WINDOWS\system32\drivers\HPZipr12.sys 2007-07-22 15:39 37,376 --a------ C:\WINDOWS\system32\hpz3l3xu.dll 2007-07-22 15:30 94,208 --a------ C:\WINDOWS\system32\HPZipt12.dll 2007-07-22 15:30 69,632 --a------ C:\WINDOWS\system32\HPZipm12.exe 2007-07-22 15:30 61,440 --a------ C:\WINDOWS\system32\HPZinw12.exe 2007-07-22 15:30 57,344 --a------ C:\WINDOWS\system32\HPZisn12.dll 2007-07-22 15:30 306,688 --a------ C:\WINDOWS\IsUninst.exe 2007-07-22 15:30 278,584 --a------ C:\WINDOWS\system32\HPZidr12.dll 2007-07-22 15:30 204,800 --a------ C:\WINDOWS\system32\HPZipr12.dll 2007-07-22 15:22 <DIR> d-------- C:\Program Files\HP 2007-07-22 15:11 81,141 --a------ C:\WINDOWS\hpfins05.dat 2007-07-22 15:11 1,547 --------- C:\WINDOWS\hpfmdl05.dat 2007-07-22 15:11 <DIR> d-------- C:\DOCUME~1\Ailish\DANEAP~1\HP 2007-07-22 15:08 31,616 --a--c--- C:\WINDOWS\system32\dllcache\usbccgp.sys 2007-07-22 15:08 31,616 --a------ C:\WINDOWS\system32\drivers\usbccgp.sys 2007-07-22 15:08 25,856 --a--c--- C:\WINDOWS\system32\dllcache\usbprint.sys 2007-07-22 15:08 25,856 --a------ C:\WINDOWS\system32\drivers\usbprint.sys 2007-07-21 22:25 26,496 --a--c--- C:\WINDOWS\system32\dllcache\usbstor.sys 2007-07-21 21:44 <DIR> d-------- C:\Program Files\Techland 2007-07-19 23:19 <DIR> d-------- C:\DOCUME~1\Ailish\DANEAP~1\ACD Systems 2007-07-19 19:57 9,856 --a------ C:\WINDOWS\system32\drivers\pfc.sys 2007-07-19 19:57 <DIR> d-------- C:\Program Files\Common Files\ACD Systems 2007-07-19 19:57 <DIR> d-------- C:\Program Files\ACD Systems 2007-07-19 19:57 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\ACD Systems 2007-07-19 09:50 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\Adobe Systems 2007-07-19 09:49 <DIR> d-------- C:\Program Files\Common Files\Adobe Systems Shared 2007-07-19 09:38 <DIR> d-------- C:\DOCUME~1\Ailish\DANEAP~1\Media Player Classic 2007-07-18 23:43 17,920 --a------ C:\WINDOWS\system32\mdimon.dll 2007-07-18 23:41 <DIR> d-------- C:\WINDOWS\SHELLNEW 2007-07-18 23:40 <DIR> d-------- C:\Program Files\Microsoft.NET 2007-07-18 23:37 <DIR> dr-h----- C:\MSOCache 2007-07-18 23:35 2,957,312 --------- C:\WINDOWS\UNNMP.exe 2007-07-18 23:34 <DIR> d-------- C:\Program Files\Common Files\LightScribe 2007-07-18 23:33 163,840 --a------ C:\WINDOWS\system32\NeroCheck.exe 2007-07-18 23:33 <DIR> d-------- C:\Program Files\Common Files\Nero 2007-07-18 23:31 24,064 --------- C:\WINDOWS\system32\msxml3a.dll 2007-07-18 23:31 2,973,696 --------- C:\WINDOWS\UNNeroVision.exe 2007-07-18 23:30 476,320 --------- C:\WINDOWS\system32\ImagXpr7.dll 2007-07-18 23:30 471,040 --------- C:\WINDOWS\system32\ImagXRA7.dll 2007-07-18 23:30 38,912 --------- C:\WINDOWS\system32\picn20.dll 2007-07-18 23:30 364,544 --------- C:\WINDOWS\system32\TwnLib4.dll 2007-07-18 23:30 262,144 --------- C:\WINDOWS\system32\ImagXR7.dll 2007-07-18 23:30 106,496 --a------ C:\WINDOWS\system32\TwnLib20.dll 2007-07-18 23:30 1,568,768 --------- C:\WINDOWS\system32\ImagX7.dll 2007-07-18 23:30 <DIR> d-------- C:\Program Files\Common Files\Ahead 2007-07-18 23:30 <DIR> d-------- C:\Program Files\Ahead 2007-07-18 23:30 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\Ahead 2007-07-18 22:24 5,248 --a------ C:\WINDOWS\system32\drivers\d347prt.sys 2007-07-18 22:24 155,136 --a------ C:\WINDOWS\system32\drivers\d347bus.sys (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) 2007-08-01 23:51 2560 --a------ C:\WINDOWS\system32\BitCometRes.dll 2007-07-22 15:44 88422 --a------ C:\WINDOWS\system32\perfc015.dat 2007-07-22 15:44 497076 --a------ C:\WINDOWS\system32\perfh015.dat --------- C:\Program Files\Usługi online ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SoundMan"="SOUNDMAN.EXE" [2004-01-08 20:54 C:\WINDOWS\SOUNDMAN.EXE] "ATICCC"="C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" [2006-01-02 16:41] "DAEMON Tools-1033"="C:\Program Files\D-Tools\daemon.exe" [2004-08-22 17:05] "HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2005-05-11 23:12] "avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-04-30 17:42] "Flashget"="C:\Program Files\FlashGet\FlashGet.exe" [2007-03-20 12:40] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:44] "Gadu-Gadu"="C:\Program Files\Gadu-Gadu\gg.exe" [2007-07-09 09:39] C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\ GetRight - Tray Icon.lnk - C:\Program Files\GetRight\getright.exe [2007-07-24 12:49:25] HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2005-05-11 23:23:26] HP Image Zone - szybkie uruchamianie.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe [2005-05-12 00:49:24] R3 ALCXSENS;Service for WDM 3D Audio Driver;C:\WINDOWS\system32\drivers\ALCXSENS.SYS S3 idsvc;Windows CardSpace;"C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe" S4 NetTcpPortSharing;Net.Tcp Port Sharing Service;"C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe" Contents of the 'Scheduled Tasks' folder 2007-08-04 10:00:00 C:\WINDOWS\Tasks\HPpromotions journeysoftware.job - C:\Program Files\hp\digital imaging\bin\hp promotions\journeysoftware\HPpromo.exe 2007-07-30 14:02:08 C:\WINDOWS\Tasks\WebReg Deskjet 5900 series.job - C:\Program Files\HP\Digital Imaging\bin\hpqwrg.exe ************************************************************************** catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-08-05 10:03:45 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... scanning hidden registry entries ... [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Prefetcher] "TracesProcessed"=dword:00000300 [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\A\1\5\1c] "Order"=hex:08,00,00,00,02,00,00,00,b8,01,00,00,01,00,00,00,04,00,00,00,8c,.. scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** Completion time: 2007-08-05 10:04:50 C:\ComboFix-quarantined-files.txt ... 2007-08-05 10:04 C:\ComboFix2.txt ... 2007-08-04 23:38 --- E O F ---

**Posty:** 18165 · przez **wojtas** 05 Sie 2007, 10:27

skasuj:

C:\VundoFix Backups

i bedzie ok

proszę o spr. loga - komp muli

Proszę o spr. loga - komp muli

Kto jest na forum