prosze o sprawdzenie loga

[filipyo]

Witam
Caly czas cos jest wysylane z mojego kompa i mam zawalony caly upload net przez to zwolnil

Logfile of HijackThis v1.99.1
Scan saved at 14:02:03, on 2006-07-07
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\NEOSTR~1\CnxMon.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe
C:\Program Files\Neostrada TP\taskbaricon.exe
C:\WINDOWS\system32\wscntfy.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Java\jre1.5.0_05\bin\jusched.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9BE.EXE
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\AutoConnect\AutoConnect.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\Konnekt\konnekt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\JetAudio\jetAudio.exe
C:\Documents and Settings\Filip\Pulpit\hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.neostrada.pl/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Neostrada TP
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\NEOSTR~1\SEARCH~1.DLL
O2 - BHO: IeCatch2 Class - {A5366673-E8CA-11D3-9CD9-0090271D075B} - C:\PROGRA~1\FlashGet\jccatch.dll
O4 - HKLM\..\Run: [WooCnxMon] C:\PROGRA~1\NEOSTR~1\CnxMon.exe
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon
O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\NEOSTR~1\Watch.exe
O4 - HKLM\..\Run: [WOOTASKBARICON] C:\Program Files\Neostrada TP\taskbaricon.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_05\bin\jusched.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [EPSON Stylus CX3600 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9BE.EXE /P26 "EPSON Stylus CX3600 Series" /O6 "USB001" /M "Stylus CX3600"
O4 - HKLM\..\Run: [Zone Labs Client] C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [AutoConnect] C:\Program Files\AutoConnect\AutoConnect.exe
O4 - Startup: Skrót do zlclient.lnk = C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
O8 - Extra context menu item: Download All by FlashGet - C:\Program Files\FlashGet\jc_all.htm
O8 - Extra context menu item: Download using FlashGet - C:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_05\bin\npjpi150_05.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_05\bin\npjpi150_05.dll
O9 - Extra button: ATI TV - {44226DFF-747E-4edc-B30C-78752E50CD0C} - C:\Program Files\ATI Multimedia\tv\EXPLBAR.DLL
O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe
O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{0F5F06A2-FCA0-4F73-A6FD-8AAADC801E2A}: NameServer = 194.204.152.34 217.98.63.164
O17 - HKLM\System\CS1\Services\Tcpip\..\{0F5F06A2-FCA0-4F73-A6FD-8AAADC801E2A}: NameServer = 194.204.152.34 217.98.63.164
O17 - HKLM\System\CS2\Services\Tcpip\..\{0F5F06A2-FCA0-4F73-A6FD-8AAADC801E2A}: NameServer = 194.204.152.34 217.98.63.164
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
O23 - Service: X10 Device Network Service (x10nets) - Unknown owner - C:\PROGRA~1\ATIMUL~1\RemCtrl\x10nets.exe (file missing)

[Red]

W logu jest zupełnie czysto .Moze napiszesz cos wiecej ,jakies skreny do tego

[filipyo]

Poprostu cos przez jakis program/syf jest wysylane z mojego kompa caly czas i jak chce wrzucic jakis plik to zamiast miec powiedzmy 10kb uploadu mam 1/3kb

[Red]

poprosze cie o dwa logi :
1 http://download.bleepingcomputer.com/sUBs/combofix.exe

2 http://www.kaspersky.pl/virusscanner.html

wklej je na forum

[filipyo]

Start Time= 2006-07-07 17:34:40,44
Running from: C:\Documents and Settings\Filip\Pulpit\Nowy folder

QuickScan did not find any signs of infected files

(((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))))


2006-07-07 17:34:00 683 ( A.... ) "C:\Combo.bat"
2006-07-07 12:43:10 ( .D... ) "C:\Program Files\CDex_150"
2006-07-02 20:56:38 ( .D... ) "C:\Program Files\LitexMedia"
2006-07-02 19:23:56 7792 ( A.... ) "C:\WINDOWS\system32\kernels8.exe"
2006-06-28 20:10:20 ( .D... ) "C:\Program Files\MarBit"
2006-06-27 17:05:10 ( .D... ) "C:\Program Files\Konami"
2006-06-26 23:14:08 1415680 ( A.... ) "C:\WINDOWS\system32\WMV9VCM.dll"
2006-06-26 23:12:24 155648 ( A.... ) "C:\WINDOWS\system32\xvidvfw.dll"
2006-06-26 23:12:14 679936 ( A.... ) "C:\WINDOWS\system32\xvidcore.dll"
2006-06-26 23:11:48 626688 ( A.... ) "C:\WINDOWS\system32\xvid.dll"
2006-06-21 11:14:36 ( .D... ) "C:\Program Files\Gadu-Gadu2"
2006-06-16 23:36:28 14640 ( A.... ) "C:\WINDOWS\system32\vxgame2.exe"
2006-06-16 23:36:26 24576 ( A.... ) "C:\WINDOWS\system32\vxgame1.exe"
2006-06-16 23:32:36 3072 ( A.... ) "C:\WINDOWS\system32\vxgame6.exe3072.exe"
2006-06-16 14:44:56 15 ( A.... ) "C:\WINDOWS\system32\dlh9jkdq8.exe"
2006-06-12 22:04:04 352256 ( A.... ) "C:\WINDOWS\eSellerateEngine.dll"
2006-06-10 11:58:02 ( .D... ) "C:\Program Files\Lavasoft"
2006-06-10 11:03:52 18286 ( A.... ) "C:\WINDOWS\xpupdate.exe"
2006-06-10 11:03:52 4287 ( A.... ) "C:\WINDOWS\system32\dlh9jkdq5.exe"
2006-06-10 11:03:50 2518 ( A.... ) "C:\WINDOWS\system32\dlh9jkdq1.exe"
2006-06-05 16:26:40 ( .D... ) "C:\Program Files\Konnekt"
2006-06-05 16:09:02 ( .D... ) "C:\Documents and Settings\Filip\Dane aplikacji\stamina"
2006-06-04 15:15:44 ( .D... ) "C:\Documents and Settings\Filip\Dane aplikacji\AVS Video Converter"
2006-06-04 15:11:42 ( .D... ) "C:\Program Files\Common Files\AVSMedia"
2006-06-04 15:11:40 ( .D... ) "C:\Program Files\AVSMedia"
2006-06-03 21:45:06 ( .D... ) "C:\Documents and Settings\Filip\Dane aplikacji\VoipDiscount"
2006-06-02 18:25:44 ( .D... ) "C:\Documents and Settings\Filip\Dane aplikacji\IMVU"
2006-05-31 11:02:04 624640 ( A.... ) "C:\WINDOWS\system32\aswBoot.exe"
2006-05-31 10:54:36 90112 ( A.... ) "C:\WINDOWS\system32\AVASTSS.scr"
2006-05-29 21:14:12 ( .D... ) "C:\Program Files\Ubisoft"
2006-05-20 22:13:58 ( .D... ) "C:\Program Files\Winamp"
2006-05-20 17:01:52 ( .D... ) "C:\Program Files\Easy RealMedia Tools"
2006-05-18 18:07:50 ( .D... ) "C:\Program Files\SHOUTcast"
2006-05-16 22:23:56 339968 ( ..... ) "C:\WINDOWS\system32\pxwave.dll"
2006-05-16 22:23:56 28672 ( ..... ) "C:\WINDOWS\system32\vxblock.dll"
2006-05-16 22:23:54 1257472 ( ..... ) "C:\WINDOWS\system32\pxsfs.dll"
2006-05-16 22:23:54 450560 ( ..... ) "C:\WINDOWS\system32\pxdrv.dll"
2006-05-16 22:23:54 430080 ( ..... ) "C:\WINDOWS\system32\px.dll"
2006-05-16 22:23:54 176128 ( ..... ) "C:\WINDOWS\system32\pxmas.dll"
2006-05-16 22:23:54 61440 ( ..... ) "C:\WINDOWS\system32\pxhpinst.exe"
2006-05-16 22:23:54 57344 ( ..... ) "C:\WINDOWS\system32\pxcpya64.exe"
2006-05-16 22:23:54 56832 ( ..... ) "C:\WINDOWS\system32\pxinsa64.exe"
2006-05-09 22:36:46 6656 ( A.... ) "C:\WINDOWS\system32\WdfMgr.exe"
2006-05-09 22:36:46 6656 ( A.... ) "C:\WINDOWS\system32\uWDF.exe"
2006-05-09 22:26:34 10394624 ( A.... ) "C:\WINDOWS\system32\wmp.dll"
2006-05-09 22:26:34 7706112 ( A.... ) "C:\WINDOWS\system32\wmploc.dll"
2006-05-09 22:26:34 1641472 ( ..... ) "C:\WINDOWS\system32\wmpencen.dll"
2006-05-09 22:26:34 1280000 ( A.... ) "C:\WINDOWS\system32\WMSPDMOE.dll"
2006-05-09 22:26:34 1063424 ( A.... ) "C:\WINDOWS\system32\WMADMOE.dll"
2006-05-09 22:26:34 992256 ( A.... ) "C:\WINDOWS\system32\WMNetMgr.dll"
2006-05-09 22:26:34 705024 ( A.... ) "C:\WINDOWS\system32\WMADMOD.dll"
2006-05-09 22:26:34 564736 ( A.... ) "C:\WINDOWS\system32\WMSPDMOD.dll"
2006-05-09 22:26:34 433152 ( ..... ) "C:\WINDOWS\system32\wmpeffects.dll"
2006-05-09 22:26:34 417280 ( A.... ) "C:\WINDOWS\system32\wmdrmdev.dll"
2006-05-09 22:26:34 337408 ( A.... ) "C:\WINDOWS\system32\wmdrmnet.dll"
2006-05-09 22:26:34 306688 ( A.... ) "C:\WINDOWS\system32\MSWMDM.dll"
2006-05-09 22:26:34 301056 ( A.... ) "C:\WINDOWS\system32\wmpdxm.dll"
2006-05-09 22:26:34 267776 ( ..... ) "C:\WINDOWS\system32\Audiodev.dll"
2006-05-09 22:26:34 237056 ( A.... ) "C:\WINDOWS\system32\wmpasf.dll"
2006-05-09 22:26:34 221696 ( A.... ) "C:\WINDOWS\system32\wmasf.dll"
2006-05-09 22:26:34 219648 ( A.... ) "C:\WINDOWS\system32\CEWMDM.dll"
2006-05-09 22:26:34 212480 ( A.... ) "C:\WINDOWS\system32\msnetobj.dll"
2006-05-09 22:26:34 203776 ( ..... ) "C:\WINDOWS\system32\wmpsrcwp.dll"
2006-05-09 22:26:34 201728 ( A.... ) "C:\WINDOWS\system32\qasf.dll"
2006-05-09 22:26:34 165376 ( A.... ) "C:\WINDOWS\system32\MsPMSP.dll"
2006-05-09 22:26:34 155136 ( A.... ) "C:\WINDOWS\system32\wmidx.dll"
2006-05-09 22:26:34 135680 ( ..... ) "C:\WINDOWS\system32\wmpps.dll"
2006-05-09 22:26:34 97792 ( A.... ) "C:\WINDOWS\system32\wmpshell.dll"
2006-05-09 22:26:34 36864 ( A.... ) "C:\WINDOWS\system32\WMDMPS.dll"
2006-05-09 22:26:34 31744 ( A.... ) "C:\WINDOWS\system32\WMDMLOG.dll"
2006-05-09 22:26:34 26112 ( A.... ) "C:\WINDOWS\system32\MsPMSNSv.dll"
2006-05-09 22:26:34 4096 ( A.... ) "C:\WINDOWS\system32\wmvdmoe2.dll"
2006-05-09 22:26:34 4096 ( A.... ) "C:\WINDOWS\system32\wmvdmod.dll"
2006-05-09 22:26:34 4096 ( A.... ) "C:\WINDOWS\system32\WMVADVE.DLL"
2006-05-09 22:26:34 4096 ( A.... ) "C:\WINDOWS\system32\WMVADVD.dll"
2006-05-09 22:26:34 4096 ( A.... ) "C:\WINDOWS\system32\wmsdmoe2.dll"
2006-05-09 22:26:34 4096 ( A.... ) "C:\WINDOWS\system32\wmsdmod.dll"
2006-05-09 22:26:34 4096 ( A.... ) "C:\WINDOWS\system32\wdfApi.dll"
2006-05-09 22:26:34 4096 ( A.... ) "C:\WINDOWS\system32\MPG4DMOD.dll"
2006-05-09 22:26:34 4096 ( A.... ) "C:\WINDOWS\system32\MP4SDMOD.dll"
2006-05-09 22:26:34 4096 ( A.... ) "C:\WINDOWS\system32\MP43DMOD.dll"
2006-05-09 22:26:32 218112 ( A.... ) "C:\WINDOWS\system32\wmerror.dll"
2006-05-09 22:26:32 9728 ( A.... ) "C:\WINDOWS\system32\LAPRXY.dll"
2006-05-09 22:26:32 7168 ( A.... ) "C:\WINDOWS\system32\asferror.dll"
2006-05-09 22:22:32 2463744 ( A.... ) "C:\WINDOWS\system32\wmvcore.dll"
2006-05-09 21:02:02 84480 ( A.... ) "C:\WINDOWS\system32\logagent.exe"
2006-05-09 21:01:06 1463808 ( ..... ) "C:\WINDOWS\system32\WMVDECOD.dll"
2006-05-09 21:01:06 1359360 ( ..... ) "C:\WINDOWS\system32\WMVSDECD.dll"
2006-05-09 21:00:58 1455616 ( ..... ) "C:\WINDOWS\system32\WMVENCOD.dll"
2006-05-09 21:00:58 770560 ( ..... ) "C:\WINDOWS\system32\WMVSENCD.dll"
2006-05-09 21:00:58 299520 ( ..... ) "C:\WINDOWS\system32\MP4SDECD.dll"
2006-05-09 21:00:58 241152 ( ..... ) "C:\WINDOWS\system32\MPG4DECD.dll"
2006-05-09 21:00:56 636928 ( ..... ) "C:\WINDOWS\system32\WMVXENCD.dll"
2006-05-09 21:00:56 241152 ( ..... ) "C:\WINDOWS\system32\MP43DECD.dll"
2006-05-09 21:00:22 546816 ( ..... ) "C:\WINDOWS\system32\wmpmde.dll"
2006-05-09 21:00:08 382976 ( ..... ) "C:\WINDOWS\system32\MFPLAT.dll"
2006-05-09 21:00:02 1350656 ( A.... ) "C:\WINDOWS\system32\drmv2clt.dll"
2006-05-09 20:59:34 513536 ( ..... ) "C:\WINDOWS\system32\wmdrmsdk.dll"
2006-05-09 20:59:20 417280 ( A.... ) "C:\WINDOWS\system32\MSSCP.dll"
2006-05-09 20:59:18 229376 ( ..... ) "C:\WINDOWS\system32\drmupgds.exe"
2006-05-09 20:59:14 585216 ( A.... ) "C:\WINDOWS\system32\blackbox.dll"
2006-05-09 20:58:54 3745280 ( ..... ) "C:\WINDOWS\system32\WpdShext.dll"
2006-05-09 20:58:54 52224 ( ..... ) "C:\WINDOWS\system32\WPDShServiceObj.dll"
2006-05-09 20:58:54 13824 ( ..... ) "C:\WINDOWS\system32\wpdshextautoplay.exe"
2006-05-09 20:58:50 670208 ( A.... ) "C:\WINDOWS\system32\wpd_ci.dll"
2006-05-09 20:58:50 103424 ( ..... ) "C:\WINDOWS\system32\PortableDeviceWiaCompat.dll"
2006-05-09 20:58:48 345600 ( ..... ) "C:\WINDOWS\system32\PortableDeviceApi.dll"
2006-05-09 20:58:48 188928 ( ..... ) "C:\WINDOWS\system32\PortableDeviceWMDRM.dll"
2006-05-09 20:58:48 101376 ( ..... ) "C:\WINDOWS\system32\PortableDeviceClassExtension.dll"
2006-05-09 20:58:46 343552 ( A.... ) "C:\WINDOWS\system32\WPDSp.dll"
2006-05-09 20:58:40 144896 ( A.... ) "C:\WINDOWS\system32\wpdmtp.dll"
2006-05-09 20:58:40 55808 ( A.... ) "C:\WINDOWS\system32\wpdmtpus.dll"
2006-05-09 20:58:40 35840 ( A.... ) "C:\WINDOWS\system32\wpdconns.dll"
2006-05-09 20:58:38 168960 ( ..... ) "C:\WINDOWS\system32\PortableDeviceTypes.dll"
2006-05-09 20:58:38 13312 ( A.... ) "C:\WINDOWS\system32\wpdtrace.dll"
2006-05-09 20:57:06 11264 ( ..... ) "C:\WINDOWS\system32\ehETW.dll"
2006-05-09 20:45:20 304640 ( ..... ) "C:\WINDOWS\system32\MSDelta.dll"
2006-05-09 20:00:48 22752 ( A.... ) "C:\WINDOWS\system32\spupdsvc.exe"
2006-05-04 16:16:00 23 ( A.... ) "C:\WINDOWS\system32\sysmwwod.dll"
2006-04-11 14:30:44 93752 ( ..... ) "C:\WINDOWS\system32\WUDFCoinstaller.dll"
2006-04-11 14:27:18 304640 ( ..... ) "C:\WINDOWS\system32\WUDFx.dll"
2006-04-11 14:27:18 130048 ( ..... ) "C:\WINDOWS\system32\WudfHost.exe"
2006-04-11 14:26:56 54272 ( ..... ) "C:\WINDOWS\system32\WudfSvc.dll"
2006-04-11 14:26:44 158208 ( ..... ) "C:\WINDOWS\system32\WudfPlatform.dll"


(((((((((((((((((((((((((((((((((((((( Files Created - Last 30days )))))))))))))))))))))))))))))))))))))))))))


2006-07-07 17:33 683 C:\Combo.bat
2006-07-02 19:23 7˙792 C:\WINDOWS\system32\kernels8.exe
2006-06-26 23:14 1˙415˙680 C:\WINDOWS\system32\WMV9VCM.dll
2006-06-26 23:12 679˙936 C:\WINDOWS\system32\xvidcore.dll
2006-06-26 23:11 626˙688 C:\WINDOWS\system32\xvid.dll
2006-06-17 00:52 536˙399˙872 C:\hiberfil.sys
2006-06-12 22:04 352˙256 C:\WINDOWS\eSellerateEngine.dll
2006-06-10 11:05 3˙072 C:\WINDOWS\system32\vxgame6.exe3072.exe
2006-06-10 11:04 24˙576 C:\WINDOWS\system32\vxgame1.exe
2006-06-10 11:04 14˙640 C:\WINDOWS\system32\vxgame2.exe
2006-06-10 11:03 4˙287 C:\WINDOWS\system32\dlh9jkdq5.exe
2006-06-10 11:03 2˙518 C:\WINDOWS\system32\dlh9jkdq1.exe
2006-06-10 11:03 18˙286 C:\WINDOWS\xpupdate.exe
2006-06-09 10:42 15 C:\WINDOWS\system32\dlh9jkdq8.exe
2006-06-05 17:12 61˙440 C:\WINDOWS\system32\pxhpinst.exe
2006-06-05 17:12 57˙344 C:\WINDOWS\system32\pxcpya64.exe
2006-06-05 17:12 56˙832 C:\WINDOWS\system32\pxinsa64.exe
2006-06-05 17:12 1˙257˙472 C:\WINDOWS\system32\pxsfs.dll
2006-06-04 20:59 22˙752 C:\WINDOWS\system32\spupdsvc.exe
2006-06-04 15:11 974˙848 C:\WINDOWS\system32\mfc70.dll
2006-06-04 15:11 487˙424 C:\WINDOWS\system32\msvcp70.dll
2006-06-04 15:11 413˙760 C:\WINDOWS\system32\mpg4c32.dll
2006-06-04 15:11 344˙064 C:\WINDOWS\system32\msvcr70.dll
2006-06-04 15:11 261˙632 C:\WINDOWS\system32\mcdvd_32.dll
2006-06-04 15:11 24˙576 C:\WINDOWS\system32\msxml3a.dll
2006-06-04 15:11 1˙700˙352 C:\WINDOWS\system32\GdiPlus.dll


(((((((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries are not shown

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run]
"WooCnxMon"="C:\\PROGRA~1\\NEOSTR~1\\CnxMon.exe"
"SpeedTouch USB Diagnostics"="\"C:\\Program Files\\Thomson\\SpeedTouch USB\\Dragdiag.exe\" /icon"
"WOOWATCH"="C:\\PROGRA~1\\NEOSTR~1\\Watch.exe"
"WOOTASKBARICON"="C:\\Program Files\\Neostrada TP\\taskbaricon.exe"
"avast!"="C:\\PROGRA~1\\ALWILS~1\\Avast4\\ashDisp.exe"
"SunJavaUpdateSched"="C:\\Program Files\\Java\\jre1.5.0_05\\bin\\jusched.exe"
"NeroFilterCheck"="C:\\WINDOWS\\system32\\NeroCheck.exe"
"EPSON Stylus CX3600 Series"="C:\\WINDOWS\\System32\\spool\\DRIVERS\\W32X86\\3\\E_FATI9BE.EXE /P26 \"EPSON Stylus CX3600 Series\" /O6 \"USB001\" /M \"Stylus CX3600\""
"Zone Labs Client"="C:\\Program Files\\Zone Labs\\ZoneAlarm\\zlclient.exe"
"ATICCC"="\"C:\\Program Files\\ATI Technologies\\ATI.ACE\\cli.exe\" runtime -Delay"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\IMAIL]
"Installed"="1"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MAPI]
"Installed"="1"
"NoChange"="1"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MSFS]
"Installed"="1"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run]
"CTFMON.EXE"="C:\\WINDOWS\\system32\\ctfmon.exe"
@=""
"ATI Launchpad"=""
"AutoConnect"="C:\\Program Files\\AutoConnect\\AutoConnect.exe"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"DisableTaskMgr"=dword:00000000

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components]
"DeskHtmlVersion"=dword:00000110
"DeskHtmlMinorVersion"=dword:00000005
"Settings"=dword:00000001
"GeneralFlags"=dword:00000001

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\0]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="Moja bieżąca strona główna"
"Flags"=dword:00000002
"Position"=hex:2c,00,00,00,cc,00,00,00,00,00,00,00,34,03,00,00,e2,02,00,00,00,\
00,00,00,01,00,00,00,01,00,00,00,01,00,00,00,00,00,00,00,00,00,00,00
"CurrentState"=hex:04,00,00,40
"OriginalStateInfo"=hex:18,00,00,00,ff,ff,00,00,ff,ff,00,00,ff,ff,ff,ff,ff,ff,\
ff,ff,04,00,00,00
"RestoredStateInfo"=hex:18,00,00,00,6a,02,00,00,23,00,00,00,a4,00,00,00,9a,00,\
00,00,01,00,00,00

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"CTFMON.EXE"="C:\\WINDOWS\\system32\\CTFMON.EXE"

a tego drugiego cos nie daje rady daje zgadzam sie ale nic nie reaguje

[Red]

Ten jeden wystarczy ,wstepnie >>>jest smietnik w postaci :

2006-06-10 11:05 3˙072 C:\WINDOWS\system32\vxgame6.exe3072.exe
2006-06-10 11:04 24˙576 C:\WINDOWS\system32\vxgame1.exe
2006-06-10 11:04 14˙640 C:\WINDOWS\system32\vxgame2.exe
2006-06-10 11:03 4˙287 C:\WINDOWS\system32\dlh9jkdq5.exe
2006-06-10 11:03 2˙518 C:\WINDOWS\system32\dlh9jkdq1.exe
2006-06-10 11:03 18˙286 C:\WINDOWS\xpupdate.exe
2006-06-09 10:42 15 C:\WINDOWS\system32\dlh9jkdq8.exe
2006-07-02 19:23 7˙792 C:\WINDOWS\system32\kernels8.exe

prosze obowiazkowo zastosowac dwa programy do usuwania:

1 http://siri.urz.free.fr/Fix/SmitfraudFix.php

odpalisz go z opcji 2 i poczekasz na zakonczenie działania...

2 http://www.europe.f-secure.com/exclude/blacklight/blbeta.exe

odpalisz z opcji fix i poczekasz na zakonczenie
po dzialaniu restart kompa i sprawdz jak sie zachowuje

ps
warto jeszcze przeleciec system:
http://www.ewido.net/en/download/
i usunac wszystko co znajdzie