prosze o sprawdzenie loga

**Posty:** 72 · przez **Quakker** 23 Mar 2007, 17:05

Komp troche ostatnio muli a internet jest bardzo wolny...

Kod: Zaznacz wszystko: Logfile of HijackThis v1.99.1 Scan saved at 15:54:47, on 2007-03-23 Platform: Windows XP (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 (6.00.2600.0000) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\SOUNDMAN.EXE C:\WINDOWS\System32\RUNDLL32.EXE C:\Program Files\D-Tools\daemon.exe C:\Program Files\HP\HP Software Update\HPWuSchd2.exe C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe C:\Program Files\Tlen.pl\tlen.exe C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\WINDOWS\System32\nvsvc32.exe C:\WINDOWS\System32\HPZipm12.exe C:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Documents and Settings\Tomek\Pulpit\HiJack\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.pl/ R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.neostrada.pl/ R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O1 - Hosts: 85.128.55.50 L2authd.lineage2.com O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033 O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe" O4 - HKCU\..\Run: [Komunikator] C:\Program Files\Tlen.pl\tlen.exe O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe O4 - Global Startup: Kalendarz XP.lnk = C:\Program Files\Kalendarz XP\Kalendarz.exe O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm O16 - DPF: {BE833F39-1E0C-468C-BA70-25AAEE55775E} (System Requirements Lab) - http://www.systemrequirementslab.com/sysreqlab.cab O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C1} (GameDesire Pool 8) - http://67.15.101.3/g_bin/pl/billard8_2_0_0_29.cab O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C5} (GameDesire Snooker) - http://67.15.101.3/g_bin/pl/snooker_2_0_0_29.cab O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing) O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing) O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: Kerio Personal Firewall 4 (KPF4) - Kerio Technologies - C:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe

Kod: Zaznacz wszystko: "Silent Runners.vbs", revision R50, http://www.silentrunners.org/ Operating System: Windows XP Output limited to non-default values, except where indicated by "{++}" Startup items buried in registry: --------------------------------- HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ {++} "Komunikator" = "C:\Program Files\Tlen.pl\tlen.exe" ["o2.pl Sp. z o.o."] "Skype" = ""C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized" ["Skype Technologies S.A."] "swg" = "C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe" ["Google Inc."] HKLM\Software\Microsoft\Windows\CurrentVersion\Run\ {++} "SoundMan" = "SOUNDMAN.EXE" ["Realtek Semiconductor Corp."] "NvCplDaemon" = "RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup" [MS] "nwiz" = "nwiz.exe /install" ["NVIDIA Corporation"] "NvMediaCenter" = "RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit" [MS] "DAEMON Tools-1033" = ""C:\Program Files\D-Tools\daemon.exe" -lang 1033" ["DAEMON'S HOME"] "NeroFilterCheck" = "C:\WINDOWS\system32\NeroCheck.exe" ["Ahead Software Gmbh"] "HP Software Update" = "C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" ["Hewlett-Packard Development Company, L.P."] "SunJavaUpdateSched" = ""C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe"" ["Sun Microsystems, Inc."] HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ {761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\(Default) = (no title provided) -> {HKLM...CLSID} = "SSVHelper Class" \InProcServer32\(Default) = "C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll" ["Sun Microsystems, Inc."] {AA58ED58-01DD-4d91-8333-CF10577473F7}\(Default) = (no title provided) -> {HKLM...CLSID} = "Google Toolbar Helper" \InProcServer32\(Default) = "c:\program files\google\googletoolbar2.dll" ["Google Inc."] HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\ "{42071714-76d4-11d1-8b24-00a0c9068ff3}" = "Rozszerzenie CPL kadrowania wyświetlania" -> {HKLM...CLSID} = "Rozszerzenie CPL kadrowania wyświetlania" \InProcServer32\(Default) = "deskpan.dll" [file not found] "{88895560-9AA2-1069-930E-00AA0030EBC8}" = "Rozszerzenie ikony HyperTerminalu" -> {HKLM...CLSID} = "HyperTerminal Icon Ext" \InProcServer32\(Default) = "C:\WINDOWS\System32\hticons.dll" ["Hilgraeve, Inc."] "{A70C977A-BF00-412C-90B7-034C51DA2439}" = "NvCpl DesktopContext Class" -> {HKLM...CLSID} = "DesktopContext Class" \InProcServer32\(Default) = "C:\WINDOWS\System32\nvcpl.dll" ["NVIDIA Corporation"] "{FFB699E0-306A-11d3-8BD1-00104B6F7516}" = "Play on my TV helper" -> {HKLM...CLSID} = "NVIDIA CPL Extension" \InProcServer32\(Default) = "C:\WINDOWS\System32\nvcpl.dll" ["NVIDIA Corporation"] "{1CDB2949-8F65-4355-8456-263E7C208A5D}" = "Desktop Explorer" -> {HKLM...CLSID} = "Desktop Explorer" \InProcServer32\(Default) = "C:\WINDOWS\System32\nvshell.dll" ["NVIDIA Corporation"] "{1E9B04FB-F9E5-4718-997B-B8DA88302A47}" = "Desktop Explorer Menu" -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "C:\WINDOWS\System32\nvshell.dll" ["NVIDIA Corporation"] "{1E9B04FB-F9E5-4718-997B-B8DA88302A48}" = "nView Desktop Context Menu" -> {HKLM...CLSID} = "nView Desktop Context Menu" \InProcServer32\(Default) = "C:\WINDOWS\System32\nvshell.dll" ["NVIDIA Corporation"] "{472083B0-C522-11CF-8763-00608CC02F24}" = "avast" -> {HKLM...CLSID} = "avast" \InProcServer32\(Default) = "C:\Program Files\Alwil Software\Avast4\ashShell.dll" ["ALWIL Software"] "{00020D75-0000-0000-C000-000000000046}" = "Microsoft Office Outlook Desktop Icon Handler" -> {HKLM...CLSID} = "Microsoft Office Outlook" \InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\OFFICE11\MLSHEXT.DLL" [MS] "{0006F045-0000-0000-C000-000000000046}" = "Microsoft Office Outlook Custom Icon Handler" -> {HKLM...CLSID} = "Rozszerzenie ikon plików programu Outlook" \InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\OFFICE11\OLKFSTUB.DLL" [MS] "{42042206-2D85-11D3-8CFF-005004838597}" = "Microsoft Office HTML Icon Handler" -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "C:\Program Files\Microsoft Office\OFFICE11\msohev.dll" [MS] "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" = "WinRAR shell extension" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] HKLM\Software\Classes\PROTOCOLS\Filter\ <<!>> text/xml\CLSID = "{807553E5-5146-11D5-A672-00B0D022E945}" -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL" [MS] HKLM\Software\Classes\*\shellex\ContextMenuHandlers\ avast\(Default) = "{472083B0-C522-11CF-8763-00608CC02F24}" -> {HKLM...CLSID} = "avast" \InProcServer32\(Default) = "C:\Program Files\Alwil Software\Avast4\ashShell.dll" ["ALWIL Software"] WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\ WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\ avast\(Default) = "{472083B0-C522-11CF-8763-00608CC02F24}" -> {HKLM...CLSID} = "avast" \InProcServer32\(Default) = "C:\Program Files\Alwil Software\Avast4\ashShell.dll" ["ALWIL Software"] WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] Group Policies {GPedit.msc branch and setting}: ----------------------------------------------- Note: detected settings may not have any effect. HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\ "shutdownwithoutlogon" = (REG_DWORD) hex:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| Shutdown: Allow system to be shut down without having to log on} "undockwithoutlogon" = (REG_DWORD) hex:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| Devices: Allow undock without having to log on} Active Desktop and Wallpaper: ----------------------------- Active Desktop may be disabled at this entry: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState Displayed if Active Desktop enabled and wallpaper not set by Group Policy: HKCU\Software\Microsoft\Internet Explorer\Desktop\General\ "Wallpaper" = "C:\Documents and Settings\Tomek\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp" Displayed if Active Desktop disabled and wallpaper not set by Group Policy: HKCU\Control Panel\Desktop\ "Wallpaper" = "C:\Documents and Settings\Tomek\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp" Enabled Screen Saver: --------------------- HKCU\Control Panel\Desktop\ "SCRNSAVE.EXE" = "C:\WINDOWS\System32\logon.scr" [MS] Startup items in "Tomek" & "All Users" startup folders: ------------------------------------------------------- C:\Documents and Settings\All Users\Menu Start\Programy\Autostart "HP Digital Imaging Monitor" -> shortcut to: "C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe" ["Hewlett-Packard Development Company, L.P."] "Kalendarz XP" -> shortcut to: "C:\Program Files\Kalendarz XP\Kalendarz.exe" [null data] Winsock2 Service Provider DLLs: ------------------------------- Namespace Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++} 000000000001\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS] 000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS] 000000000003\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS] Transport Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++} 0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range: %SystemRoot%\system32\mswsock.dll [MS], 01 - 03, 06 - 11 %SystemRoot%\system32\rsvpsp.dll [MS], 04 - 05 Toolbars, Explorer Bars, Extensions: ------------------------------------ Toolbars HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\ "{2318C2B1-4965-11D4-9B18-009027A5CD4F}" -> {HKLM...CLSID} = "&Google" \InProcServer32\(Default) = "c:\program files\google\googletoolbar2.dll" ["Google Inc."] HKLM\Software\Microsoft\Internet Explorer\Toolbar\ "{2318C2B1-4965-11D4-9B18-009027A5CD4F}" = (no title provided) -> {HKLM...CLSID} = "&Google" \InProcServer32\(Default) = "c:\program files\google\googletoolbar2.dll" ["Google Inc."] Explorer Bars HKLM\Software\Microsoft\Internet Explorer\Explorer Bars\ HKLM\Software\Classes\CLSID\{FF059E31-CC5A-4E2E-BF3B-96E929D65503}\(Default) = "&Badanie" Implemented Categories\{00021493-0000-0000-C000-000000000046}\ [vertical bar] InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL" [MS] Extensions (Tools menu items, main toolbar menu buttons) HKLM\Software\Microsoft\Internet Explorer\Extensions\ {08B0E5C0-4FCB-11CF-AAA5-00401C608501}\ "MenuText" = "Sun Java Console" "CLSIDExtension" = "{CAFEEFAC-0015-0000-0011-ABCDEFFEDCBC}" -> {HKCU...CLSID} = "Java Plug-in 1.5.0_11" \InProcServer32\(Default) = "C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll" ["Sun Microsystems, Inc."] -> {HKLM...CLSID} = "Java Plug-in 1.5.0_11" \InProcServer32\(Default) = "C:\Program Files\Java\jre1.5.0_11\bin\npjpi150_11.dll" ["Sun Microsystems, Inc."] {92780B25-18CC-41C8-B9BE-3C9C571A8263}\ "ButtonText" = "Badanie" HOSTS file ---------- C:\WINDOWS\System32\drivers\etc\HOSTS maps: 2 domain names to IP addresses, 1 of the IP addresses is *not* localhost! Running Services (Display Name, Service Name, Path {Service DLL}): ------------------------------------------------------------------ avast! Antivirus, avast! Antivirus, ""C:\Program Files\Alwil Software\Avast4\ashServ.exe"" [null data] avast! iAVS4 Control Service, aswUpdSv, ""C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe"" [null data] avast! Mail Scanner, avast! Mail Scanner, ""C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service" ["ALWIL Software"] avast! Web Scanner, avast! Web Scanner, ""C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service" ["ALWIL Software"] Kerio Personal Firewall 4, KPF4, "C:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe" ["Kerio Technologies"] Machine Debug Manager, MDM, ""C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE"" [MS] NVIDIA Display Driver Service, NVSvc, "C:\WINDOWS\System32\nvsvc32.exe" ["NVIDIA Corporation"] Pml Driver HPZ12, Pml Driver HPZ12, "C:\WINDOWS\System32\HPZipm12.exe" ["HP"] Print Monitors: --------------- HKLM\System\CurrentControlSet\Control\Print\Monitors\ LIDIL hpzll4pi\Driver = "hpzll4pi.dll" ["Hewlett-Packard Company"] Microsoft Document Imaging Writer Monitor\Driver = "mdimon.dll" [MS] ---------- <<!>>: Suspicious data at a malware launch point. + This report excludes default entries except where indicated. + To see *everywhere* the script checks and *everything* it finds, launch it from a command prompt or a shortcut with the -all parameter. + The search for DESKTOP.INI DLL launch points on all local fixed drives took 69 seconds. ---------- (total run time: 526 seconds)

**Posty:** 18165 · przez **wojtas** 23 Mar 2007, 17:25

skasuj:

O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm

daj loga z:

http://www.techsupportforum.com/sectools/Deckard/comboscan.exe

**Posty:** 72 · przez **Quakker** 23 Mar 2007, 17:59

Kod: Zaznacz wszystko: ComboScan v20070306.20 run by Tomek on 2007-03-23 at 16:47:56 Computer is in Normal Mode. -------------------------------------------------------------------------------- -- System Restore -------------------------------------------------------------- Successfully created ComboScan Restore Point. -- Last 5 Restore Point(s) -- 16: 2007-03-23 15:47:57 UTC - RP54 - ComboScan Restore Point 15: 2007-03-20 14:20:09 UTC - RP53 - Zainstalowany program DirectX 9.0 14: 2007-03-20 13:59:58 UTC - RP52 - Zainstalowany program DirectX 9.0 13: 2007-03-18 15:24:39 UTC - RP51 - Shockwave Player 12: 2007-03-18 15:06:49 UTC - RP50 - Shockwave Player -- First Restore Point -- 1: 2007-03-12 21:07:17 UTC - RP39 - Installed Lineage II Performed disk cleanup. -- HijackThis (run as Tomek.exe) ----------------------------------------------- Logfile of HijackThis v1.99.1 Scan saved at 16:48:06, on 2007-03-23 Platform: Windows XP (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 (6.00.2600.0000) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\SOUNDMAN.EXE C:\WINDOWS\System32\RUNDLL32.EXE C:\Program Files\D-Tools\daemon.exe C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe C:\Program Files\Tlen.pl\tlen.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\WINDOWS\System32\nvsvc32.exe C:\WINDOWS\System32\HPZipm12.exe C:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Documents and Settings\Tomek\Pulpit\comboscan.exe C:\DOCUME~1\Tomek\Pulpit\HiJack\Tomek.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.pl/ R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.neostrada.pl/ R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O1 - Hosts: 85.128.55.50 L2authd.lineage2.com O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033 O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe" O4 - HKCU\..\Run: [Komunikator] C:\Program Files\Tlen.pl\tlen.exe O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm O16 - DPF: {68282C51-9459-467B-95BF-3C0E89627E55} (MksSkanerOnline Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab O16 - DPF: {BE833F39-1E0C-468C-BA70-25AAEE55775E} (System Requirements Lab) - http://www.systemrequirementslab.com/sysreqlab.cab O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C1} (GameDesire Pool 8) - http://67.15.101.3/g_bin/pl/billard8_2_0_0_29.cab O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C5} (GameDesire Snooker) - http://67.15.101.3/g_bin/pl/snooker_2_0_0_29.cab O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing) O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing) O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: Kerio Personal Firewall 4 (KPF4) - Kerio Technologies - C:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe -- HijackThis Fixed Entries (C:\DOCUME~1\Tomek\Pulpit\HiJack\backups\) --------- backup-20070212-172906-793 O23 - Service: Seagate Communication - Unknown owner - C:\WINDOWS\System32\dllcache\seagatecom.exe backup-20070212-173358-960 O23 - Service: Microsoft Agent - Unknown owner - C:\WINDOWS\System32\dllcache\qxchost.exe backup-20070212-212707-392 O2 - BHO: (no name) - {46D1F873-FD2C-4D16-85CE-A7D9668AE097} - C:\WINDOWS\System32\awtss.dll (file missing) backup-20070313-143519-154 F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,,winwork.exe backup-20070318-085612-192 O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm backup-20070318-085635-222 O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll backup-20070318-085635-753 O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL backup-20070322-203119-184 O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k backup-20070322-203130-287 O4 - HKCU\..\Run: [AnyDVD] C:\Program Files\SlySoft\AnyDVD\AnyDVD.exe backup-20070322-203143-205 O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe backup-20070323-164407-427 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll backup-20070323-164407-970 O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll -- File Associations ----------------------------------------------------------- .bat - batfile - "%1" %* .chm - chm.file - "C:\WINDOWS\hh.exe" %1 .cmd - cmdfile - "%1" %* .com - comfile - "%1" %* .exe - exefile - "%1" %* .hlp - hlpfile - %SystemRoot%\System32\winhlp32.exe %1 .inf - inffile - %SystemRoot%\System32\NOTEPAD.EXE %1 .ini - inifile - %SystemRoot%\System32\NOTEPAD.EXE %1 .js - JSFile - %SystemRoot%\System32\WScript.exe "%1" %* .lnk - lnkfile - {00021401-0000-0000-C000-000000000046} .pif - piffile - "%1" %* .reg - regfile - regedit.exe "%1" .scr - scrfile - "%1" /S .txt - txtfile - %SystemRoot%\system32\NOTEPAD.EXE %1 .vbs - VBSFile - %SystemRoot%\System32\WScript.exe "%1" %* -- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------- 1R Aavmker4 (avast! Asynchronous Virus Monitor) - C:\WINDOWS\system32\drivers\aavmker4.sys 3R ALCXWDM (Service for Realtek AC97 Audio (WDM)) - C:\WINDOWS\system32\drivers\ALCXWDM.SYS 3R AnyDVD - C:\WINDOWS\system32\drivers\AnyDVD.sys 2R aswMon2 (avast! Standard Shield Support) - C:\WINDOWS\system32\drivers\aswmon2.sys 3R aswRdr - C:\WINDOWS\system32\drivers\aswRdr.sys 0R d347bus - C:\WINDOWS\system32\drivers\d347bus.sys 0R d347prt - C:\WINDOWS\system32\drivers\d347prt.sys 3S dump_wmimmc - C:\WINDOWS\System32\drivers\dump_wmimmc.sys (not found) 2R ElbyCDIO (ElbyCDIO Driver) - C:\WINDOWS\system32\drivers\ElbyCDIO.sys 1R fwdrv (Firewall Driver) - C:\WINDOWS\system32\drivers\fwdrv.sys 3R hidusb (Sterownik Microsoft klasy HID) - C:\WINDOWS\system32\drivers\hidusb.sys 1R khips (Kerio HIPS Driver) - C:\WINDOWS\system32\drivers\khips.sys 3R mouhid (Sterownik myszy HID) - C:\WINDOWS\system32\drivers\mouhid.sys 3R ms_mpu401 (Sterownik portu MIDI UART Microsoft MPU-401) - C:\WINDOWS\system32\drivers\msmpu401.sys 3S NPPTNT2 - C:\WINDOWS\system32\npptNT2.sys 3R nv - C:\WINDOWS\system32\drivers\nv4_mini.sys 0R nvatabus - C:\WINDOWS\system32\drivers\nvatabus.sys 3R NVENETFD (NVIDIA nForce Networking Controller Driver) - C:\WINDOWS\system32\drivers\NVENETFD.sys 3R nvnetbus (NVIDIA Network Bus Enumerator) - C:\WINDOWS\system32\drivers\nvnetbus.sys 0R nv_agp (NVIDIA nForce AGP Bus Filter) - C:\WINDOWS\system32\drivers\nv_agp.SYS 0R PxHelp20 - C:\WINDOWS\system32\drivers\PxHelp20.sys 3S usbccgp (Rodzajowy sterownik nadrzędny USB Microsoft) - C:\WINDOWS\system32\drivers\usbccgp.sys 3R usbohci (Sterownik Miniport otwartego kontrolera hosta USB Microsoft) - C:\WINDOWS\system32\drivers\usbohci.sys 3R usbprint (Klasa PRINTER USB Microsoft) - C:\WINDOWS\system32\drivers\usbprint.sys 3S USBSTOR (Sterownik magazynu masowego USB) - C:\WINDOWS\system32\drivers\USBSTOR.SYS 3S USB_RNDIS (ADI Remote NDIS Network Device Driver) - C:\WINDOWS\system32\drivers\usb8023.sys -- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled -------------------- 2R aswUpdSv (avast! iAVS4 Control Service) - "C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe" 2R avast! Antivirus - "C:\Program Files\Alwil Software\Avast4\ashServ.exe" 3R avast! Mail Scanner - "C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service 3R avast! Web Scanner - "C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service 3S gusvc (Google Updater Service) - "C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe" 2R KPF4 (Kerio Personal Firewall 4) - C:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe 2R NVSvc (NVIDIA Display Driver Service) - C:\WINDOWS\System32\nvsvc32.exe 3S ose (Office Source Engine) - C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE 2R Pml Driver HPZ12 - C:\WINDOWS\System32\HPZipm12.exe 3S SCardDrv (Pomocnik karty inteligentnej) - C:\WINDOWS\System32\SCardSvr.exe 2R uploadmgr (Menedżer przekazywania) - C:\WINDOWS\System32\svchost.exe -k netsvcs 3S usprserv (User Privilege Service) - C:\WINDOWS\System32\svchost.exe -k netsvcs 2R WmdmPmSp (Numer seryjny nośnika przenośnego) - C:\WINDOWS\System32\svchost.exe -k netsvcs -- Files created between 2007-02-23 and 2007-03-23 ----------------------------- 2007-03-23 16:00:28 0 d-------- C:\Program Files\SkanerOnline<SKANER~1> 2007-03-22 20:14:13 0 d-------- C:\WUTemp 2007-03-22 15:53:19 182880 --a------ C:\WINDOWS\System32\iuengine.dll 2007-03-20 23:04:08 0 d-------- C:\Program Files\GIMP-2.0 2007-03-20 22:53:02 0 d-------- C:\Program Files\Common Files\GTK 2007-03-18 13:53:47 0 d-------- C:\Program Files\Common Files\Wise Installation Wizard<WISEIN~1> 2007-03-17 11:21:57 0 d-------- C:\Program Files\EA SPORTS<EASPOR~1> 2007-03-16 20:56:35 0 d-------- C:\WINDOWS\System32\appmgmt 2007-03-15 21:19:03 0 d-------- C:\Program Files\Common Files\Skype 2007-03-15 21:18:51 0 d-------- C:\Program Files\Skype 2007-03-15 12:00:36 466432 --a------ C:\WINDOWS\System32\SkanerOnline.dll<SKANER~1.DLL> 2007-03-13 20:12:18 0 d-------- C:\CLICK 2007-03-13 19:44:23 0 d-------- C:\Program Files\SlySoft 2007-03-13 19:43:54 0 d-------- C:\Program Files\DVD Decrypter<DVDDEC~1> 2007-03-13 19:28:00 0 d-------- C:\Program Files\DVD Shrink<DVDSHR~1> 2007-03-13 13:20:48 33130 ---hs---- C:\WINDOWS\System32\winwork.exe 2007-03-12 22:15:12 4682 --a------ C:\WINDOWS\System32\npptNT2.sys 2007-03-12 19:28:25 0 d-------- C:\WINDOWS\Sun 2007-03-11 20:03:01 0 d-------- C:\Program Files\Kalendarz XP<KALEND~1> 2007-03-09 21:27:36 0 d-------- C:\Program Files\SopCast 2007-03-09 21:22:07 0 d-------- C:\Program Files\Google 2007-03-09 21:21:36 0 d-------- C:\Program Files\Java 2007-03-09 21:20:23 0 d-------- C:\Program Files\Common Files\Java 2007-03-03 22:08:38 0 d-------- C:\Program Files\IKEA HomePlanner<IKEAHO~1> 2007-03-01 00:05:26 86016 --a------ C:\WINDOWS\System32\ElbyCDIO.dll 2007-02-28 21:56:07 15440 --a------ C:\WINDOWS\System32\drivers\ElbyCDIO.sys 2007-02-28 21:55:55 77000 --a------ C:\WINDOWS\System32\drivers\AnyDVD.sys 2007-02-28 21:00:08 0 d-------- C:\Program Files\Teamspeak2_RC2<TEAMSP~1> 2007-02-27 19:06:51 0 d-------- C:\Program Files\X-Trader 4<X-TRAD~1> 2007-02-23 22:51:40 0 d-------- C:\Program Files\Media Player Classic<MEDIAP~1> 2007-02-23 22:51:39 0 d-------- C:\Program Files\Real Alternative<REALAL~1> -- Find3M Report --------------------------------------------------------------- 2007-03-23 16:35:47 0 d-------- C:\Documents and Settings\Tomek\Dane aplikacji\Skype 2007-03-22 20:16:57 0 d-------- C:\Program Files\Valve 2007-03-22 16:01:31 0 d-------- C:\Documents and Settings\Tomek\Dane aplikacji\Tlen.pl 2007-03-21 14:10:05 0 d-------- C:\Documents and Settings\Tomek\Dane aplikacji\gtk-2.0 2007-03-18 13:53:22 0 d-------- C:\Program Files\Mozilla Firefox<MOZILL~1> 2007-03-17 19:27:06 0 d-------- C:\Documents and Settings\Tomek\Dane aplikacji\Macromedia<MACROM~1> 2007-03-16 20:56:34 0 d-------- C:\Program Files\Jasc Software Inc<JASCSO~1> 2007-03-16 20:24:05 2240 --a------ C:\WINDOWS\mozver.dat 2007-03-16 19:06:36 0 d-------- C:\Documents and Settings\Tomek\Dane aplikacji\Image Zone Express<IMAGEZ~1> 2007-03-13 19:48:43 0 d-------- C:\Documents and Settings\Tomek\Dane aplikacji\SlySoft 2007-03-12 22:07:17 0 d--h----- C:\Program Files\InstallShield Installation Information<INSTAL~1> 2007-03-12 22:06:42 0 d-------- C:\Documents and Settings\Tomek\Dane aplikacji\InstallShield<INSTAL~1> 2007-03-10 23:39:21 0 d-------- C:\Documents and Settings\Tomek\Dane aplikacji\Google 2007-03-09 21:28:32 0 d-------- C:\Documents and Settings\Tomek\Dane aplikacji\SopCast 2007-03-09 21:23:38 0 d-------- C:\Documents and Settings\Tomek\Dane aplikacji\Sun 2007-03-06 09:20:49 0 d-------- C:\Documents and Settings\Tomek\Dane aplikacji\ppStream 2007-02-28 21:00:55 0 d-------- C:\Documents and Settings\Tomek\Dane aplikacji\teamspeak2<TEAMSP~1> 2007-02-27 18:48:27 0 d-------- C:\Program Files\GanymedeNet<GANYME~1> 2007-02-27 17:03:06 0 d-------- C:\Documents and Settings\Tomek\Dane aplikacji\Real 2007-02-26 17:34:30 0 d---s---- C:\Documents and Settings\Tomek\Dane aplikacji\Microsoft<MICROS~1> 2007-02-22 18:22:49 0 --a------ C:\WINDOWS\nsreg.dat 2007-02-22 18:22:46 0 d-------- C:\Documents and Settings\Tomek\Dane aplikacji\Mozilla 2007-02-22 16:45:33 0 d-------- C:\Documents and Settings\Tomek\Dane aplikacji\GanymedeNet<GANYME~1> 2007-02-21 19:42:42 0 d-------- C:\Program Files\Common Files\SystemRequirementsLab<SYSTEM~1> 2007-02-21 16:09:59 0 d-------- C:\Program Files\GinBillard<GINBIL~1> 2007-02-21 16:09:58 0 d-------- C:\Program Files\Common 2007-02-21 16:09:38 0 d-------- C:\Program Files\Temp 2007-02-21 16:09:38 0 d-------- C:\Program Files\Adv 2007-02-21 14:47:58 126865 --a------ C:\WINDOWS\HPHins12.dat 2007-02-21 14:46:59 0 d-------- C:\Documents and Settings\Tomek\Dane aplikacji\HP 2007-02-21 14:46:52 0 d-------- C:\Program Files\HP 2007-02-21 14:44:13 0 d-------- C:\Program Files\Common Files\HP 2007-02-21 14:43:29 0 d-------- C:\Program Files\Hewlett-Packard<HEWLET~1> 2007-02-21 14:36:31 0 d--h----- C:\Program Files\WindowsUpdate<WINDOW~2> 2007-02-20 14:32:24 0 d-------- C:\Program Files\Common Files\Nero 2007-02-20 14:31:20 0 d-------- C:\Program Files\Ahead 2007-02-20 14:31:04 0 d-------- C:\Program Files\Common Files\Ahead 2007-02-19 21:10:03 0 d-------- C:\Documents and Settings\Tomek\Dane aplikacji\Sports Interactive<SPORTS~1> 2007-02-18 22:15:47 0 d-------- C:\Documents and Settings\Tomek\Dane aplikacji\Media Player Classic<MEDIAP~1> 2007-02-18 13:32:10 0 d-------- C:\Program Files\K-Lite Codec Pack<K-LITE~1> 2007-02-18 13:26:54 0 d-------- C:\Program Files\MarBit 2007-02-18 11:59:45 0 d-------- C:\Program Files\HLSW 2007-02-16 17:39:18 0 d-------- C:\Program Files\Ganymede 2007-02-14 18:31:47 0 d-------- C:\Program Files\SAGEM 2007-02-13 19:37:03 0 d-------- C:\Program Files\Tlen.pl 2007-02-13 19:33:49 355486 --a------ C:\WINDOWS\System32\perfh015.dat 2007-02-13 19:33:49 49492 --a------ C:\WINDOWS\System32\perfc015.dat 2007-02-13 19:03:36 0 d-------- C:\Program Files\Microsoft.NET<MICROS~1.NET> 2007-02-13 19:03:05 0 d-------- C:\Program Files\Microsoft Works<MICROS~4> 2007-02-13 19:00:17 0 d-------- C:\Program Files\Winamp 2007-02-13 18:55:27 0 d-------- C:\Program Files\D-Tools 2007-02-13 18:46:52 0 d-------- C:\Program Files\Alwil Software<ALWILS~1> 2007-02-13 18:44:48 0 d-------- C:\Program Files\Kerio 2007-02-13 18:19:10 0 d-------- C:\Program Files\Common Files\InstallShield<INSTAL~1> 2007-02-13 18:17:17 0 d-------- C:\Program Files\Realtek Sound Manager<REALTE~1> 2007-02-13 18:17:17 0 d-------- C:\Program Files\AvRack 2007-02-13 18:15:41 0 d-------- C:\Program Files\Messenger<MESSEN~1> 2007-02-13 18:15:41 0 d-------- C:\Documents and Settings\Tomek\Dane aplikacji\Identities<IDENTI~1> 2007-02-13 17:48:16 0 d-------- C:\Program Files\microsoft frontpage<MICROS~1> 2007-02-13 17:47:58 0 -rahs---- C:\MSDOS.SYS 2007-02-13 17:47:58 0 -rahs---- C:\IO.SYS 2007-02-13 17:47:58 0 --a------ C:\CONFIG.SYS 2007-02-13 17:47:58 0 --a------ C:\AUTOEXEC.BAT 2007-02-13 17:46:59 0 d-------- C:\Program Files\Usługi online<USUGIO~1> 2007-02-13 17:46:37 0 d-------- C:\Program Files\Movie Maker<MOVIEM~1> 2007-02-13 17:46:02 0 d-------- C:\Program Files\Common Files\MSSoap 2007-02-13 17:45:39 21856 --a------ C:\WINDOWS\System32\emptyregdb.dat<EMPTYR~1.DAT> 2007-02-13 17:45:10 0 d-------- C:\Program Files\MSN Gaming Zone<MSNGAM~1> 2007-02-13 17:45:09 0 d-------- C:\Program Files\Windows NT<WINDOW~1> 2007-02-13 17:35:11 0 d-------- C:\Program Files\Common Files\ODBC 2007-02-13 17:35:09 0 d-------- C:\Program Files\Common Files\SpeechEngines<SPEECH~1> 2007-02-13 17:34:49 62 --ahs---- C:\Documents and Settings\Tomek\Dane aplikacji\desktop.ini 2007-02-01 05:56:06 639066 --a------ C:\WINDOWS\System32\divx.dll 2007-01-30 06:03:42 3596288 --a------ C:\WINDOWS\System32\qt-dx331.dll 2007-01-30 06:03:28 200704 --a------ C:\WINDOWS\System32\ssldivx.dll 2007-01-30 06:03:28 1044480 --a------ C:\WINDOWS\System32\libdivx.dll 2007-01-30 05:56:58 196608 --a------ C:\WINDOWS\System32\dtu100.dll 2007-01-30 05:56:58 73728 --a------ C:\WINDOWS\System32\dpl100.dll 2007-01-20 21:26:06 1565480 --a------ C:\WINDOWS\System32\wmv9vcm.dll 2007-01-19 09:40:42 89088 --a------ C:\WINDOWS\System32\SkanerOnlineUninstall.exe<SKANER~1.EXE> 2007-01-09 18:46:02 10752 --a------ C:\WINDOWS\System32\ff_vfw.dll -- Registry Dump --------------------------------------------------------------- [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run] "Komunikator"="C:\\Program Files\\Tlen.pl\\tlen.exe" "swg"="C:\\Program Files\\Google\\GoogleToolbarNotifier\\1.2.1128.5462\\GoogleToolbarNotifier.exe" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run] "SoundMan"="SOUNDMAN.EXE" "NvCplDaemon"="RUNDLL32.EXE C:\\WINDOWS\\System32\\NvCpl.dll,NvStartup" "nwiz"="nwiz.exe /install" "NvMediaCenter"="RUNDLL32.EXE C:\\WINDOWS\\System32\\NvMcTray.dll,NvTaskbarInit" "DAEMON Tools-1033"="\"C:\\Program Files\\D-Tools\\daemon.exe\" -lang 1033" "NeroFilterCheck"="C:\\WINDOWS\\system32\\NeroCheck.exe" "SunJavaUpdateSched"="\"C:\\Program Files\\Java\\jre1.5.0_11\\bin\\jusched.exe\"" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\IMAIL] "Installed"="1" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MAPI] "Installed"="1" "NoChange"="1" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MSFS] "Installed"="1" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^HP Digital Imaging Monitor.lnk] "path"="C:\\Documents and Settings\\All Users\\Menu Start\\Programy\\Autostart\\HP Digital Imaging Monitor.lnk" "backup"="C:\\WINDOWS\\pss\\HP Digital Imaging Monitor.lnkCommon Startup" "location"="Common Startup" "command"="C:\\PROGRA~1\\HP\\DIGITA~1\\bin\\hpqtra08.exe " "item"="HP Digital Imaging Monitor" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Kalendarz XP.lnk] "path"="C:\\Documents and Settings\\All Users\\Menu Start\\Programy\\Autostart\\Kalendarz XP.lnk" "backup"="C:\\WINDOWS\\pss\\Kalendarz XP.lnkCommon Startup" "location"="Common Startup" "command"="C:\\PROGRA~1\\KALEND~1\\KALEND~1.EXE " "item"="Kalendarz XP" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\avast!] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="ashDisp" "hkey"="HKLM" "command"="C:\\PROGRA~1\\ALWILS~1\\Avast4\\ashDisp.exe" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="ctfmon" "hkey"="HKCU" "command"="C:\\WINDOWS\\System32\\ctfmon.exe" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="HPWuSchd2" "hkey"="HKLM" "command"="C:\\Program Files\\HP\\HP Software Update\\HPWuSchd2.exe" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="msmsgs" "hkey"="HKCU" "command"="\"C:\\Program Files\\Messenger\\msmsgs.exe\" /background" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="Skype" "hkey"="HKCU" "command"="\"C:\\Program Files\\Skype\\Phone\\Skype.exe\" /nosplash /minimized" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="GoogleToolbarNotifier" "hkey"="HKCU" "command"="C:\\Program Files\\Google\\GoogleToolbarNotifier\\1.2.1128.5462\\GoogleToolbarNotifier.exe" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="winampa" "hkey"="HKLM" "command"="C:\\Program Files\\Winamp\\winampa.exe" "inimapping"="0" [HKEY_USERS\.default\software\microsoft\windows\currentversion\run] "CTFMON.EXE"="C:\\WINDOWS\\System32\\CTFMON.EXE" [HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\run] "CTFMON.EXE"="C:\\WINDOWS\\System32\\CTFMON.EXE" [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders] "SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll" [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Svchost] LocalService REG_MULTI_SZ Alerter\0WebClient\0LmHosts\0RemoteRegistry\0upnphost\0SSDPSRV\0\0 NetworkService REG_MULTI_SZ DnsCache\0\0 rpcss REG_MULTI_SZ RpcSs\0\0 imgsvc REG_MULTI_SZ StiSvc\0\0 termsvcs REG_MULTI_SZ TermService\0\0 -- Hosts ----------------------------------------------------------------------- 85.128.55.50 L2authd.lineage2.com -- End of ComboScan: finished at 2007-03-23 at 16:48:49 ------------------------

Kod: Zaznacz wszystko: ComboScan v20070306.20 run by Tomek on 2007-03-23 at 16:47:56 Supplementary logfile - please post this as an attachment with your post. -------------------------------------------------------------------------------- -- System Information ---------------------------------------------------------- Microsoft Windows XP Professional (build 2600) Architecture: X86; Language: Polish CPU 0: AMD Athlon(tm) 64 Processor 3000+ Percentage of Memory in Use: 42% Physical Memory (total/avail): 510.42 MiB / 293.08 MiB Pagefile Memory (total/avail): 1249.27 MiB / 1050.12 MiB Virtual Memory (total/avail): 2047.88 MiB / 2001.51 MiB A: is Removable (No Media) C: is Fixed (NTFS) - 29.29 GiB total, 17.82 GiB free. D: is Fixed (FAT32) - 25.38 GiB total, 7.63 GiB free. E: is Fixed (NTFS) - 19.83 GiB total, 11.54 GiB free. F: is CDROM (No Media) G: is CDROM (CDFS) H: is CDROM (No Media) -- Security Center ------------------------------------------------------------- AUState says computer is in an unknown state. Windows Internal Firewall is enabled. -- Environment Variables ------------------------------------------------------- ALLUSERSPROFILE=C:\Documents and Settings\All Users APPDATA=C:\Documents and Settings\Tomek\Dane aplikacji CLIENTNAME=Console CommonProgramFiles=C:\Program Files\Common Files COMPUTERNAME=TS-KOMPUTER ComSpec=C:\WINDOWS\system32\cmd.exe HOMEDRIVE=C: HOMEPATH=\Documents and Settings\Tomek LOGONSERVER=\\TS-KOMPUTER NUMBER_OF_PROCESSORS=1 OS=Windows_NT Path=C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\Program Files\Common Files\GTK\2.0\bin PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH PROCESSOR_ARCHITECTURE=x86 PROCESSOR_IDENTIFIER=x86 Family 15 Model 12 Stepping 0, AuthenticAMD PROCESSOR_LEVEL=15 PROCESSOR_REVISION=0c00 ProgramFiles=C:\Program Files PROMPT=$P$G SESSIONNAME=Console SystemDrive=C: SystemRoot=C:\WINDOWS TEMP=C:\DOCUME~1\Tomek\USTAWI~1\Temp TMP=C:\DOCUME~1\Tomek\USTAWI~1\Temp USERDOMAIN=TS-KOMPUTER USERNAME=Tomek USERPROFILE=C:\Documents and Settings\Tomek windir=C:\WINDOWS -- User Profiles --------------------------------------------------------------- Tomek [I](admin)[/I] -- Add/Remove Programs --------------------------------------------------------- --> C:\Program Files\Ahead\nero\uninstall\UNNERO.exe /UNINSTALL --> rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf Adobe Flash Player 9 ActiveX --> C:\WINDOWS\System32\Macromed\Flash\FlashUtil9b.exe -uninstallDelete Adobe Shockwave Player --> C:\WINDOWS\system32\Macromed\SHOCKW~1\UNWISE.EXE C:\WINDOWS\system32\Macromed\SHOCKW~1\Install.log ALLPlayer V2.4 --> "C:\Program Files\MarBit\ALLPlayer\unins000.exe" AnyDVD --> "C:\Program Files\SlySoft\AnyDVD\AnyDVD-uninst.exe" /D="C:\Program Files\SlySoft\AnyDVD" Archiwizator WinRAR --> C:\Program Files\WinRAR\uninstall.exe avast! Antivirus --> rundll32 C:\PROGRA~1\ALWILS~1\Avast4\Setup\setiface.dll,RunSetup Counter-Strike 1.6 --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\00\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{9ABFB92D-93DA-49EE-8ABF-F8195DE45CA9}\Setup.exe" -l0x19 DAEMON Tools --> MsiExec.exe /I{3DED3A72-61A8-4B87-98A5-EF0BC8038AA0} DVD Decrypter (Remove Only) --> "C:\Program Files\DVD Decrypter\uninstall.exe" DVD Shrink 3.2 --> "C:\Program Files\DVD Shrink\unins000.exe" EA SPORTS online 2007 --> C:\Program Files\EA SPORTS\EA SPORTS online\EASOUNInstaller.exe GameDesire-Pool & Snooker --> C:\Program Files\Ganymede\uninstaller.exe Google Toolbar for Internet Explorer --> regsvr32 /u /s "c:\program files\google\googletoolbar2.dll" GTK+ 2.10.6-1 runtime environment --> "C:\Program Files\Common Files\GTK\2.0\setup\unins000.exe" HijackThis 1.99.1 --> C:\Documents and Settings\Tomek\Pulpit\HiJack\HijackThis.exe /uninstall HP Customer cenzura! Program 7.0 --> C:\Program Files\HP\Digital Imaging\ExtCapUninstall\hpzscr01.exe -datfile hpqhsc01.dat HP Imaging Device Functions 7.0 --> C:\Program Files\HP\Digital Imaging\DeviceManagement\hpzscr01.exe -datfile hpqbud01.dat HP Photosmart and Deskjet 7.0 Software (plk) --> C:\Program Files\HP\Digital Imaging\{D2A3C9D5-0B56-4656-8277-7EDC65D62B6E}\setup\hpzscr01.exe -datfile hphscr12.dat -showdisconnect -forcereboot HP Photosmart Essential --> MsiExec.exe /X{6994491D-D491-48F1-AE1F-E179C1FFFC2F} HP Software Update --> MsiExec.exe /X{BB85ED9C-AFC9-43BD-B8DC-258C3C7DF72E} HP Solution Center 7.0 --> C:\Program Files\HP\Digital Imaging\eSupport\hpzscr01.exe -datfile hpqbud05.dat IKEA HomePlanner Bedroom --> MsiExec.exe /I{66763074-E033-4AB8-9DCD-76AA30CCD543} J2SE Runtime Environment 5.0 Update 11 --> MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0150110} K-Lite Codec Pack 2.84 Full --> "C:\Program Files\K-Lite Codec Pack\unins000.exe" Kalendarz XP v29.85 --> C:\Program Files\Kalendarz XP\uninstall.exe Kerio Personal Firewall --> MsiExec.exe /X{333BECA0-DED8-4139-A516-8D9E44E22669} Lineage II --> C:\Program Files\InstallShield Installation Information\{076A6FD8-EE45-4A83-B3C9-C7C34E7CAFDD}\setup.exe -runfromtemp -l0x0009 -removeonly livebox tp --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{17342E3B-0818-4A6F-BFF8-99476605ADD6}\Setup.exe" -l0x15 Microsoft Office Professional Edition 2003 --> MsiExec.exe /I{90110415-6000-11D3-8CFE-0150048383C9} Mozilla Firefox (2.0.0.1) --> C:\Program Files\Mozilla Firefox\uninstall\uninst.exe Nero Suite --> C:\Program Files\Common Files\Nero\Uninstall\Setupx.exe /uninstall ExtraUninstallID="" NVIDIA Drivers --> C:\WINDOWS\System32\nvudisp.exe UninstallGUI Pro Evolution Soccer 6 --> C:\PROGRA~1\COMMON~1\INSTAL~1\Driver\9\INTEL3~1\IDriver.exe /M{EBB794ED-D282-4334-92FB-254481EFF514} /l1045 Real Alternative 1.51 --> "C:\Program Files\Real Alternative\unins000.exe" Realtek AC'97 Audio --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{FB08F381-6533-4108-B7DD-039E11FBC27E}\setup.exe" REMOVE Skaner on-line mks_vir --> C:\WINDOWS\System32\SkanerOnlineUninstall.exe Skype 3.1 --> "C:\Program Files\Skype\Phone\unins000.exe" Skype Plugin Manager --> MsiExec.exe /I{3D5E5C0A-5B36-4F98-99A7-287F7DBDCE03} SopCast 1.1.1 --> C:\Program Files\SopCast\uninst.exe System Requirements Lab --> C:\Program Files\Common Files\SystemRequirementsLab\Uninstall.exe TeamSpeak 2 RC2 --> "C:\Program Files\Teamspeak2_RC2\unins000.exe" The GIMP 2.2.13 --> "C:\Program Files\GIMP-2.0\unins000.exe" Tlen.pl --> "C:\Program Files\Tlen.pl\uninstall.exe" UEFA Champions League 2006-2007 --> D:\Tomek\CL\EAUninstall.exe Winamp (remove only) --> "C:\Program Files\Winamp\UninstWA.exe" -- End of ComboScan: finished at 2007-03-23 at 16:48:49 ------------------------

Dalej cos jest z netem

**Posty:** 18165 · przez **wojtas** 23 Mar 2007, 21:24

Użyj WWDC :
http://www.firewallleaktester.com/wwdc.htm
Zmień opcje z disable na enable. Uruchom ponownie komputer.
Tak powinny wyglądać porty (NetBIOS może być żółty) :
http://www.firewallleaktester.com/images_site/wwdc.jpg

Pobierz i uruchom narzędzie : The Avenger
http://swandog46.geekstogo.com/avenger.zip
Zaznacz opcję Input script manually i kliknij na Lupkę z prawej strony. W okienku, które się otworzy wklejasz:

Files to delete:

C:\WINDOWS\System32\winwork.exe

Klikasz Done, a następnie zielone światełko i zgadzasz się na restart klikając OK.
Po restarcie w HijackThis usuwasz wpis/y

Kasujesz ręcznie z dysku plik: C:\Avenger\backup.zip i wklejasz na forum raport: C:\avenger.txt + log z combo

**Posty:** 72 · przez **Quakker** 24 Mar 2007, 20:23

Kod: Zaznacz wszystko: Logfile of The Avenger version 1, by Swandog46 Running from registry key: \Registry\Machine\System\CurrentControlSet\Services\igdcsxcp ******************* Script file located at: \??\C:\Program Files\wbcvgmao.txt Script file opened successfully. Script file read successfully Backups directory opened successfully at C:\Avenger ******************* Beginning to process script file: File C:\WINDOWS\System32\winwork.exe deleted successfully. Completed script processing. ******************* Finished! Terminate.

Kod: Zaznacz wszystko: ComboScan v20070306.20 run by Tomek on 2007-03-24 at 19:13:35 Computer is in Normal Mode. -------------------------------------------------------------------------------- -- HijackThis (run as Tomek.exe) ----------------------------------------------- Logfile of HijackThis v1.99.1 Scan saved at 19:13:38, on 2007-03-24 Platform: Windows XP (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 (6.00.2600.0000) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\SOUNDMAN.EXE C:\WINDOWS\System32\RUNDLL32.EXE C:\Program Files\D-Tools\daemon.exe C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe C:\Program Files\Tlen.pl\tlen.exe C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe C:\program files\valve\steam\steam.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\WINDOWS\System32\nvsvc32.exe C:\WINDOWS\System32\HPZipm12.exe C:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe C:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\Documents and Settings\Tomek\Pulpit\HiJack\comboscan.exe C:\DOCUME~1\Tomek\Pulpit\HiJack\Tomek.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.pl/ R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.neostrada.pl/ R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O1 - Hosts: 85.128.55.50 L2authd.lineage2.com O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033 O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe" O4 - HKCU\..\Run: [Komunikator] C:\Program Files\Tlen.pl\tlen.exe O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe O4 - HKCU\..\Run: [Steam] "c:\program files\valve\steam\steam.exe" -silent O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O16 - DPF: {68282C51-9459-467B-95BF-3C0E89627E55} (MksSkanerOnline Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab O16 - DPF: {BE833F39-1E0C-468C-BA70-25AAEE55775E} (System Requirements Lab) - http://www.systemrequirementslab.com/sysreqlab.cab O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C1} (GameDesire Pool 8) - http://67.15.101.3/g_bin/pl/billard8_2_0_0_29.cab O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C5} (GameDesire Snooker) - http://67.15.101.3/g_bin/pl/snooker_2_0_0_29.cab O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing) O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing) O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: Kerio Personal Firewall 4 (KPF4) - Kerio Technologies - C:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe -- Files created between 2007-02-24 and 2007-03-24 ----------------------------- 2007-03-24 19:12:10 0 d-------- C:\avenger 2007-03-23 21:59:32 20096 --a------ C:\WINDOWS\System32\drivers\MSIRCOMM.sys 2007-03-23 21:56:38 31048 --a------ C:\WINDOWS\System32\drivers\irstusb.sys 2007-03-23 21:54:05 0 d-------- C:\WINDOWS\USB-IrDA 2007-03-23 21:52:35 7680 --a------ C:\WINDOWS\System32\wshirda.dll 2007-03-23 21:52:35 78848 --a------ C:\WINDOWS\System32\irmon.dll 2007-03-23 21:52:35 99840 --a------ C:\WINDOWS\System32\irftp.exe 2007-03-23 21:52:35 19584 --a------ C:\WINDOWS\System32\drivers\rasirda.sys 2007-03-23 21:52:35 55296 --a------ C:\WINDOWS\System32\drivers\irda.sys 2007-03-23 18:28:20 0 d-------- C:\Program Files\WindowsUpdate<WINDOW~2> 2007-03-23 16:00:28 0 d-------- C:\Program Files\SkanerOnline<SKANER~1> 2007-03-20 23:04:08 0 d-------- C:\Program Files\GIMP-2.0 2007-03-20 22:53:02 0 d-------- C:\Program Files\Common Files\GTK 2007-03-18 13:53:47 0 d-------- C:\Program Files\Common Files\Wise Installation Wizard<WISEIN~1> 2007-03-17 11:21:57 0 d-------- C:\Program Files\EA SPORTS<EASPOR~1> 2007-03-16 20:56:35 0 d-------- C:\WINDOWS\System32\appmgmt 2007-03-15 21:19:03 0 d-------- C:\Program Files\Common Files\Skype 2007-03-15 21:18:51 0 d-------- C:\Program Files\Skype 2007-03-15 12:00:36 466432 --a------ C:\WINDOWS\System32\SkanerOnline.dll<SKANER~1.DLL> 2007-03-13 19:44:23 0 d-------- C:\Program Files\SlySoft 2007-03-13 19:43:54 0 d-------- C:\Program Files\DVD Decrypter<DVDDEC~1> 2007-03-13 19:28:00 0 d-------- C:\Program Files\DVD Shrink<DVDSHR~1> 2007-03-12 22:15:12 4682 --a------ C:\WINDOWS\System32\npptNT2.sys 2007-03-12 19:28:25 0 d-------- C:\WINDOWS\Sun 2007-03-11 20:03:01 0 d-------- C:\Program Files\Kalendarz XP<KALEND~1> 2007-03-09 21:27:36 0 d-------- C:\Program Files\SopCast 2007-03-09 21:22:07 0 d-------- C:\Program Files\Google 2007-03-09 21:21:36 0 d-------- C:\Program Files\Java 2007-03-09 21:20:23 0 d-------- C:\Program Files\Common Files\Java 2007-03-03 22:08:38 0 d-------- C:\Program Files\IKEA HomePlanner<IKEAHO~1> 2007-03-01 00:05:26 86016 --a------ C:\WINDOWS\System32\ElbyCDIO.dll 2007-02-28 21:56:07 15440 --a------ C:\WINDOWS\System32\drivers\ElbyCDIO.sys 2007-02-28 21:55:55 77000 --a------ C:\WINDOWS\System32\drivers\AnyDVD.sys 2007-02-28 21:00:08 0 d-------- C:\Program Files\Teamspeak2_RC2<TEAMSP~1> 2007-02-27 19:06:51 0 d-------- C:\Program Files\X-Trader 4<X-TRAD~1> -- Find3M Report --------------------------------------------------------------- 2007-03-24 13:47:17 0 d-------- C:\Program Files\Valve 2007-03-23 21:54:04 0 d--h----- C:\Program Files\InstallShield Installation Information<INSTAL~1> 2007-03-23 17:51:46 0 d-------- C:\Documents and Settings\Tomek\Dane aplikacji\Skype 2007-03-23 17:38:54 0 d-------- C:\Documents and Settings\Tomek\Dane aplikacji\Tlen.pl 2007-03-21 14:10:05 0 d-------- C:\Documents and Settings\Tomek\Dane aplikacji\gtk-2.0 2007-03-18 13:53:22 0 d-------- C:\Program Files\Mozilla Firefox<MOZILL~1> 2007-03-17 19:27:06 0 d-------- C:\Documents and Settings\Tomek\Dane aplikacji\Macromedia<MACROM~1> 2007-03-16 20:56:34 0 d-------- C:\Program Files\Jasc Software Inc<JASCSO~1> 2007-03-16 20:24:05 2240 --a------ C:\WINDOWS\mozver.dat 2007-03-16 19:06:36 0 d-------- C:\Documents and Settings\Tomek\Dane aplikacji\Image Zone Express<IMAGEZ~1> 2007-03-13 19:48:43 0 d-------- C:\Documents and Settings\Tomek\Dane aplikacji\SlySoft 2007-03-12 22:06:42 0 d-------- C:\Documents and Settings\Tomek\Dane aplikacji\InstallShield<INSTAL~1> 2007-03-10 23:39:21 0 d-------- C:\Documents and Settings\Tomek\Dane aplikacji\Google 2007-03-09 21:28:32 0 d-------- C:\Documents and Settings\Tomek\Dane aplikacji\SopCast 2007-03-09 21:23:38 0 d-------- C:\Documents and Settings\Tomek\Dane aplikacji\Sun 2007-03-06 09:20:49 0 d-------- C:\Documents and Settings\Tomek\Dane aplikacji\ppStream 2007-02-28 21:00:55 0 d-------- C:\Documents and Settings\Tomek\Dane aplikacji\teamspeak2<TEAMSP~1> 2007-02-27 18:48:27 0 d-------- C:\Program Files\GanymedeNet<GANYME~1> 2007-02-27 17:03:06 0 d-------- C:\Documents and Settings\Tomek\Dane aplikacji\Real 2007-02-26 17:34:30 0 d---s---- C:\Documents and Settings\Tomek\Dane aplikacji\Microsoft<MICROS~1> 2007-02-23 22:51:43 0 d-------- C:\Program Files\Real Alternative<REALAL~1> 2007-02-23 22:51:40 0 d-------- C:\Program Files\Media Player Classic<MEDIAP~1> 2007-02-22 18:22:49 0 --a------ C:\WINDOWS\nsreg.dat 2007-02-22 18:22:46 0 d-------- C:\Documents and Settings\Tomek\Dane aplikacji\Mozilla 2007-02-22 16:45:33 0 d-------- C:\Documents and Settings\Tomek\Dane aplikacji\GanymedeNet<GANYME~1> 2007-02-21 19:42:42 0 d-------- C:\Program Files\Common Files\SystemRequirementsLab<SYSTEM~1> 2007-02-21 16:09:59 0 d-------- C:\Program Files\GinBillard<GINBIL~1> 2007-02-21 16:09:58 0 d-------- C:\Program Files\Common 2007-02-21 16:09:38 0 d-------- C:\Program Files\Temp 2007-02-21 16:09:38 0 d-------- C:\Program Files\Adv 2007-02-21 14:47:58 126865 --a------ C:\WINDOWS\HPHins12.dat 2007-02-21 14:46:59 0 d-------- C:\Documents and Settings\Tomek\Dane aplikacji\HP 2007-02-21 14:46:52 0 d-------- C:\Program Files\HP 2007-02-21 14:44:13 0 d-------- C:\Program Files\Common Files\HP 2007-02-21 14:43:29 0 d-------- C:\Program Files\Hewlett-Packard<HEWLET~1> 2007-02-20 14:32:24 0 d-------- C:\Program Files\Common Files\Nero 2007-02-20 14:31:20 0 d-------- C:\Program Files\Ahead 2007-02-20 14:31:04 0 d-------- C:\Program Files\Common Files\Ahead 2007-02-19 21:10:03 0 d-------- C:\Documents and Settings\Tomek\Dane aplikacji\Sports Interactive<SPORTS~1> 2007-02-18 22:15:47 0 d-------- C:\Documents and Settings\Tomek\Dane aplikacji\Media Player Classic<MEDIAP~1> 2007-02-18 13:32:10 0 d-------- C:\Program Files\K-Lite Codec Pack<K-LITE~1> 2007-02-18 13:26:54 0 d-------- C:\Program Files\MarBit 2007-02-18 11:59:45 0 d-------- C:\Program Files\HLSW 2007-02-16 17:39:18 0 d-------- C:\Program Files\Ganymede 2007-02-14 18:31:47 0 d-------- C:\Program Files\SAGEM 2007-02-13 19:37:03 0 d-------- C:\Program Files\Tlen.pl 2007-02-13 19:33:49 355486 --a------ C:\WINDOWS\System32\perfh015.dat 2007-02-13 19:33:49 49492 --a------ C:\WINDOWS\System32\perfc015.dat 2007-02-13 19:03:36 0 d-------- C:\Program Files\Microsoft.NET<MICROS~1.NET> 2007-02-13 19:03:05 0 d-------- C:\Program Files\Microsoft Works<MICROS~4> 2007-02-13 19:00:17 0 d-------- C:\Program Files\Winamp 2007-02-13 18:55:27 0 d-------- C:\Program Files\D-Tools 2007-02-13 18:46:52 0 d-------- C:\Program Files\Alwil Software<ALWILS~1> 2007-02-13 18:44:48 0 d-------- C:\Program Files\Kerio 2007-02-13 18:19:10 0 d-------- C:\Program Files\Common Files\InstallShield<INSTAL~1> 2007-02-13 18:17:17 0 d-------- C:\Program Files\Realtek Sound Manager<REALTE~1> 2007-02-13 18:17:17 0 d-------- C:\Program Files\AvRack 2007-02-13 18:15:41 0 d-------- C:\Program Files\Messenger<MESSEN~1> 2007-02-13 18:15:41 0 d-------- C:\Documents and Settings\Tomek\Dane aplikacji\Identities<IDENTI~1> 2007-02-13 17:48:16 0 d-------- C:\Program Files\microsoft frontpage<MICROS~1> 2007-02-13 17:47:58 0 -rahs---- C:\MSDOS.SYS 2007-02-13 17:47:58 0 -rahs---- C:\IO.SYS 2007-02-13 17:47:58 0 --a------ C:\CONFIG.SYS 2007-02-13 17:47:58 0 --a------ C:\AUTOEXEC.BAT 2007-02-13 17:46:59 0 d-------- C:\Program Files\Usługi online<USUGIO~1> 2007-02-13 17:46:37 0 d-------- C:\Program Files\Movie Maker<MOVIEM~1> 2007-02-13 17:46:02 0 d-------- C:\Program Files\Common Files\MSSoap 2007-02-13 17:45:39 21856 --a------ C:\WINDOWS\System32\emptyregdb.dat<EMPTYR~1.DAT> 2007-02-13 17:45:10 0 d-------- C:\Program Files\MSN Gaming Zone<MSNGAM~1> 2007-02-13 17:45:09 0 d-------- C:\Program Files\Windows NT<WINDOW~1> 2007-02-13 17:35:11 0 d-------- C:\Program Files\Common Files\ODBC 2007-02-13 17:35:09 0 d-------- C:\Program Files\Common Files\SpeechEngines<SPEECH~1> 2007-02-13 17:34:49 62 --ahs---- C:\Documents and Settings\Tomek\Dane aplikacji\desktop.ini 2007-02-01 05:56:06 639066 --a------ C:\WINDOWS\System32\divx.dll 2007-01-30 06:03:42 3596288 --a------ C:\WINDOWS\System32\qt-dx331.dll 2007-01-30 06:03:28 200704 --a------ C:\WINDOWS\System32\ssldivx.dll 2007-01-30 06:03:28 1044480 --a------ C:\WINDOWS\System32\libdivx.dll 2007-01-30 05:56:58 196608 --a------ C:\WINDOWS\System32\dtu100.dll 2007-01-30 05:56:58 73728 --a------ C:\WINDOWS\System32\dpl100.dll 2007-01-20 21:26:06 1565480 --a------ C:\WINDOWS\System32\wmv9vcm.dll 2007-01-19 09:40:42 89088 --a------ C:\WINDOWS\System32\SkanerOnlineUninstall.exe<SKANER~1.EXE> 2007-01-09 18:46:02 10752 --a------ C:\WINDOWS\System32\ff_vfw.dll -- Registry Dump --------------------------------------------------------------- [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run] "Komunikator"="C:\\Program Files\\Tlen.pl\\tlen.exe" "swg"="C:\\Program Files\\Google\\GoogleToolbarNotifier\\1.2.1128.5462\\GoogleToolbarNotifier.exe" "Steam"="\"c:\\program files\\valve\\steam\\steam.exe\" -silent" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run] "SoundMan"="SOUNDMAN.EXE" "NvCplDaemon"="RUNDLL32.EXE C:\\WINDOWS\\System32\\NvCpl.dll,NvStartup" "nwiz"="nwiz.exe /install" "NvMediaCenter"="RUNDLL32.EXE C:\\WINDOWS\\System32\\NvMcTray.dll,NvTaskbarInit" "DAEMON Tools-1033"="\"C:\\Program Files\\D-Tools\\daemon.exe\" -lang 1033" "NeroFilterCheck"="C:\\WINDOWS\\system32\\NeroCheck.exe" "SunJavaUpdateSched"="\"C:\\Program Files\\Java\\jre1.5.0_11\\bin\\jusched.exe\"" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\IMAIL] "Installed"="1" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MAPI] "Installed"="1" "NoChange"="1" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MSFS] "Installed"="1" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^HP Digital Imaging Monitor.lnk] "path"="C:\\Documents and Settings\\All Users\\Menu Start\\Programy\\Autostart\\HP Digital Imaging Monitor.lnk" "backup"="C:\\WINDOWS\\pss\\HP Digital Imaging Monitor.lnkCommon Startup" "location"="Common Startup" "command"="C:\\PROGRA~1\\HP\\DIGITA~1\\bin\\hpqtra08.exe " "item"="HP Digital Imaging Monitor" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Kalendarz XP.lnk] "path"="C:\\Documents and Settings\\All Users\\Menu Start\\Programy\\Autostart\\Kalendarz XP.lnk" "backup"="C:\\WINDOWS\\pss\\Kalendarz XP.lnkCommon Startup" "location"="Common Startup" "command"="C:\\PROGRA~1\\KALEND~1\\KALEND~1.EXE " "item"="Kalendarz XP" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\avast!] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="ashDisp" "hkey"="HKLM" "command"="C:\\PROGRA~1\\ALWILS~1\\Avast4\\ashDisp.exe" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="ctfmon" "hkey"="HKCU" "command"="C:\\WINDOWS\\System32\\ctfmon.exe" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="HPWuSchd2" "hkey"="HKLM" "command"="C:\\Program Files\\HP\\HP Software Update\\HPWuSchd2.exe" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="msmsgs" "hkey"="HKCU" "command"="\"C:\\Program Files\\Messenger\\msmsgs.exe\" /background" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="Skype" "hkey"="HKCU" "command"="\"C:\\Program Files\\Skype\\Phone\\Skype.exe\" /nosplash /minimized" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="GoogleToolbarNotifier" "hkey"="HKCU" "command"="C:\\Program Files\\Google\\GoogleToolbarNotifier\\1.2.1128.5462\\GoogleToolbarNotifier.exe" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="winampa" "hkey"="HKLM" "command"="C:\\Program Files\\Winamp\\winampa.exe" "inimapping"="0" [HKEY_USERS\.default\software\microsoft\windows\currentversion\run] "CTFMON.EXE"="C:\\WINDOWS\\System32\\CTFMON.EXE" [HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\run] "CTFMON.EXE"="C:\\WINDOWS\\System32\\CTFMON.EXE" [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders] "SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll" [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Svchost] LocalService REG_MULTI_SZ Alerter\0WebClient\0LmHosts\0RemoteRegistry\0upnphost\0SSDPSRV\0\0 NetworkService REG_MULTI_SZ DnsCache\0\0 rpcss REG_MULTI_SZ RpcSs\0\0 imgsvc REG_MULTI_SZ StiSvc\0\0 termsvcs REG_MULTI_SZ TermService\0\0 [HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{e120cd33-bb88-11db-accc-806d6172696f}] Shell\AutoRun\command G:\AUTORUN.EXE -- End of ComboScan: finished at 2007-03-24 at 19:14:21 ------------------------

**Posty:** 18165 · przez **wojtas** 24 Mar 2007, 20:32

w logu jest ok

prosze o sprawdzenie loga

Prosze o sprawdzenie loga

Kto jest na forum