prosze o sprawdzenie loga

**Posty:** 13 · przez **krakor** 30 Mar 2007, 19:07

Znowu zwolnienie internetu zwiechy kompa. prosze o pomoc

ComboScan v20070306.20 run by wielbie on 2007-03-30 at 18:50:02
Computer is in Normal Mode.
--------------------------------------------------------------------------------

-- HijackThis (run as wielbie.exe) ---------------------------------------------

Logfile of HijackThis v1.99.1
Scan saved at 18:50:15, on 2007-03-30
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Ahead\InCD\InCDsrv.exe
c:\program files\panda software\panda antivirus + firewall 2007\firewall\PNMSRV.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\sstray.exe
C:\Program Files\Panda Software\Panda Antivirus + Firewall 2007\APVXDWIN.EXE
C:\Program Files\Ahead\InCD\InCD.exe
C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Program Files\SAGEM WiFi manager\WLANUTL.exe
C:\Program Files\Common Files\Logitech\KHAL\KHALMNPR.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Panda Software\Panda Antivirus + Firewall 2007\PavFnSvr.exe
C:\Program Files\Common Files\Panda Software\PavShld\pavprsrv.exe
C:\Program Files\Panda Software\Panda Antivirus + Firewall 2007\pavsrv51.exe
C:\Program Files\Panda Software\Panda Antivirus + Firewall 2007\AVENGINE.EXE
C:\Program Files\Panda Software\Panda Antivirus + Firewall 2007\PsImSvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Panda Software\Panda Antivirus + Firewall 2007\TPSrv.exe
c:\program files\panda software\panda antivirus + firewall 2007\WebProxy.exe
C:\Program Files\Tlen.pl\tlen.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\wielbie\Pulpit\Uzyteczne\hijack\comboscan.exe
C:\DOCUME~1\wielbie\Pulpit\UZYTEC~1\hijack\wielbie.exe
C:\Program Files\Panda Software\Panda Antivirus + Firewall 2007\psimreal.exe
C:\Program Files\Panda Software\Panda Antivirus + Firewall 2007\avciman.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://search.bearshare.com/pl/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O4 - HKLM\..\Run: [nForce Tray Options] "sstray.exe" /r
O4 - HKLM\..\Run: [APVXDWIN] "C:\Program Files\Panda Software\Panda Antivirus + Firewall 2007\APVXDWIN.EXE" /s
O4 - HKLM\..\Run: [InCD] "C:\Program Files\Ahead\InCD\InCD.exe"
O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [nwiz] "nwiz.exe" /install
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe"
O4 - HKLM\..\Run: [EPSON Stylus C66 Series] "C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I0S2.EXE" /P23 "EPSON Stylus C66 Series" /O6 "USB001" /M "Stylus C66"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Steam] "c:\progra~1\steam\steam.exe" -silent
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
O4 - Global Startup: Program sieciowy dla SAGEM Wi-Fi 11g USB adapter.lnk = ?
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://downloads.ewido.net/ewidoOnlineScan.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: avldr - C:\WINDOWS\SYSTEM32\avldr.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: InCD Helper (InCDsrv) - Ahead Software AG - C:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Panda Function Service (PAVFNSVR) - Panda Software International - C:\Program Files\Panda Software\Panda Antivirus + Firewall 2007\PavFnSvr.exe
O23 - Service: Panda Process Protection Service (PavPrSrv) - Panda Software - C:\Program Files\Common Files\Panda Software\PavShld\pavprsrv.exe
O23 - Service: Panda anti-virus service (PAVSRV) - Panda Software International - C:\Program Files\Panda Software\Panda Antivirus + Firewall 2007\pavsrv51.exe
O23 - Service: Panda Network Manager (PNMSRV) - Panda Software International - c:\program files\panda software\panda antivirus + firewall 2007\firewall\PNMSRV.EXE
O23 - Service: Panda IManager Service (PSIMSVC) - Panda Software - C:\Program Files\Panda Software\Panda Antivirus + Firewall 2007\PsImSvc.exe
O23 - Service: Panda TPSrv (TPSrv) - Panda Software - C:\Program Files\Panda Software\Panda Antivirus + Firewall 2007\TPSrv.exe

-- Files created between 2007-02-28 and 2007-03-30 -----------------------------

2007-03-22 23:34:07 0 d-------- C:\Temp
2007-03-22 23:32:50 0 d-------- C:\Program Files\ImTOO
2007-03-21 17:39:58 0 d-------- C:\Program Files\Roguescanfix<ROGUES~1>
2007-03-21 16:48:39 0 d-------- C:\!KillBox
2007-03-21 16:47:10 0 d-------- C:\WINDOWS\pss
2007-03-20 20:49:31 217088 --a------ C:\WINDOWS\system32\yv12vfw.dll
2007-03-20 20:49:31 217088 --a------ C:\WINDOWS\system32\i420vfw.dll
2007-03-20 20:49:31 39936 --a------ C:\WINDOWS\system32\huffyuv.dll
2007-03-20 20:49:30 180224 --a------ C:\WINDOWS\system32\xvidvfw.dll
2007-03-20 20:49:30 765952 --a------ C:\WINDOWS\system32\xvidcore.dll
2007-03-20 20:49:30 558592 --a------ C:\WINDOWS\system32\x264vfw.dll
2007-03-20 20:49:30 1565480 --a------ C:\WINDOWS\system32\wmv9vcm.dll
2007-03-20 20:49:30 630784 --a------ C:\WINDOWS\system32\vp7vfw.dll
2007-03-20 20:49:30 438272 --a------ C:\WINDOWS\system32\vp6vfw.dll
2007-03-20 20:49:30 144384 --a------ C:\WINDOWS\system32\Iacenc.dll
2007-03-20 20:49:29 200704 --a------ C:\WINDOWS\system32\ssldivx.dll
2007-03-20 20:49:29 3596288 --a------ C:\WINDOWS\system32\qt-dx331.dll
2007-03-20 20:49:29 1044480 --a------ C:\WINDOWS\system32\libdivx.dll
2007-03-20 20:49:29 196608 --a------ C:\WINDOWS\system32\dtu100.dll
2007-03-20 20:49:29 73728 --a------ C:\WINDOWS\system32\dpl100.dll
2007-03-20 20:49:29 639066 --a------ C:\WINDOWS\system32\divx.dll
2007-03-20 20:49:28 10752 --a------ C:\WINDOWS\system32\ff_vfw.dll
2007-03-20 20:49:26 0 d-------- C:\Program Files\K-Lite Codec Pack<K-LITE~1>
2007-03-19 15:19:34 0 d-------- C:\Program Files\Valve Hammer Editor<VALVEH~1>
2007-03-04 20:15:15 0 d-------- C:\Program Files\BitLord

-- Find3M Report ---------------------------------------------------------------

2007-03-30 18:46:42 0 d-------- C:\Program Files\Steam
2007-03-30 18:41:36 0 d-------- C:\Program Files\Mozilla Firefox<MOZILL~1>
2007-03-30 18:38:35 0 d-------- C:\Program Files\Tlen.pl
2007-03-30 18:27:00 0 d-------- C:\Program Files\Winamp
2007-03-30 18:13:36 0 d-------- C:\Program Files\SAGEM WiFi manager<SAGEMW~1>
2007-03-29 19:07:04 0 d-------- C:\Program Files\VentriloMIX<VENTRI~1>
2007-03-29 13:24:46 0 d-------- C:\Program Files\QuickTime<QUICKT~1>
2007-03-28 22:24:10 0 d-------- C:\Program Files\mIRC
2007-03-26 22:09:07 0 d-------- C:\Program Files\Apple Software Update<APPLES~1>
2007-03-26 22:08:41 0 d-------- C:\Program Files\iTunes
2007-03-25 18:30:36 355486 --a------ C:\WINDOWS\system32\perfh015.dat
2007-03-25 18:30:36 49492 --a------ C:\WINDOWS\system32\perfc015.dat
2007-03-23 00:00:06 0 d-------- C:\Documents and Settings\wielbie\Dane aplikacji\Tlen.pl
2007-03-13 20:32:32 0 d-------- C:\Program Files\RivaTuner v2.0 Final Release<RIVATU~1.0FI>
2007-03-10 22:42:53 0 d-------- C:\Program Files\BearShare<BEARSH~2>
2007-03-04 20:13:30 0 d-------- C:\Documents and Settings\wielbie\Dane aplikacji\uTorrent
2007-02-25 14:27:30 43008 --a------ C:\WINDOWS\system32\~.exe
2007-02-25 14:01:59 0 d---s---- C:\Documents and Settings\wielbie\Dane aplikacji\Microsoft<MICROS~1>
2007-02-24 23:01:20 0 d-------- C:\Documents and Settings\wielbie\Dane aplikacji\Google
2007-02-24 23:00:54 0 d--h----- C:\Program Files\InstallShield Installation Information<INSTAL~1>
2007-02-24 23:00:54 0 d-------- C:\Program Files\Google
2007-02-17 21:07:29 0 d-------- C:\Documents and Settings\wielbie\Dane aplikacji\Help
2007-02-17 20:50:31 0 d-------- C:\Program Files\intercube<INTERC~1>
2007-02-12 15:37:18 0 d-------- C:\Documents and Settings\wielbie\Dane aplikacji\Apple Computer<APPLEC~1>
2007-02-11 19:39:06 0 d-------- C:\Program Files\Java
2007-02-08 01:34:45 0 d-------- C:\Program Files\Ganymede
2007-02-08 00:17:40 0 d-------- C:\Documents and Settings\wielbie\Dane aplikacji\Adobe
2007-02-08 00:15:12 0 d-------- C:\Documents and Settings\wielbie\Dane aplikacji\Opera
2007-02-08 00:01:13 0 d-------- C:\Program Files\Common Files\Adobe
2007-02-08 00:00:22 0 d-------- C:\Program Files\Common Files\Adobe Systems Shared<ADOBES~1>
2007-01-17 23:25:20 2202 --a------ C:\WINDOWS\mozver.dat
2007-01-12 17:38:29 2382 --a------ C:\WINDOWS\system32\tmp.reg
2007-01-01 07:56:00 545 --a------ C:\WINDOWS\UC.PIF
2007-01-01 07:56:00 545 --a------ C:\WINDOWS\RAR.PIF
2007-01-01 07:56:00 545 --a------ C:\WINDOWS\PKZIP.PIF
2007-01-01 07:56:00 545 --a------ C:\WINDOWS\PKUNZIP.PIF
2007-01-01 07:56:00 545 --a------ C:\WINDOWS\NOCLOSE.PIF
2007-01-01 07:56:00 545 --a------ C:\WINDOWS\LHA.PIF
2007-01-01 07:56:00 545 --a------ C:\WINDOWS\ARJ.PIF

-- Registry Dump ---------------------------------------------------------------

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run]
"CTFMON.EXE"="C:\\WINDOWS\\system32\\ctfmon.exe"
"Steam"="\"c:\\progra~1\\steam\\steam.exe\" -silent"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run]
"nForce Tray Options"="\"sstray.exe\" /r"
"APVXDWIN"="\"C:\\Program Files\\Panda Software\\Panda Antivirus + Firewall 2007\\APVXDWIN.EXE\" /s"
"InCD"="\"C:\\Program Files\\Ahead\\InCD\\InCD.exe\""
"Logitech Hardware Abstraction Layer"="KHALMNPR.EXE"
"nwiz"="\"nwiz.exe\" /install"
"SunJavaUpdateSched"="\"C:\\Program Files\\Java\\jre1.5.0_11\\bin\\jusched.exe\""
"EPSON Stylus C66 Series"="\"C:\\WINDOWS\\System32\\spool\\DRIVERS\\W32X86\\3\\E_S4I0S2.EXE\" /P23 \"EPSON Stylus C66 Series\" /O6 \"USB001\" /M \"Stylus C66\""
"QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime"
"NvCplDaemon"="RUNDLL32.EXE C:\\WINDOWS\\system32\\NvCpl.dll,NvStartup"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="iTunesHelper"
"hkey"="HKLM"
"command"="\"C:\\Program Files\\iTunes\\iTunesHelper.exe\""
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="NeroCheck"
"hkey"="HKLM"
"command"="C:\\WINDOWS\\system32\\NeroCheck.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="NvCpl"
"hkey"="HKLM"
"command"="\"RUNDLL32.EXE\" C:\\WINDOWS\\system32\\NvCpl.dll,NvStartup"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="NvMcTray"
"hkey"="HKLM"
"command"="\"RUNDLL32.EXE\" C:\\WINDOWS\\system32\\NvMcTray.dll,NvTaskbarInit"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RivaTunerStartupDaemon]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="RivaTuner"
"hkey"="HKLM"
"command"="\"C:\\Program Files\\RivaTuner v2.0 Final Release\\RivaTuner.exe\" /S"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\sharedtaskscheduler]
"{8d8c2387-7f80-4022-9be6-43630a969558}"="carbinyl"

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"CTFMON.EXE"="C:\\WINDOWS\\system32\\CTFMON.EXE"

[HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\run]
"CTFMON.EXE"="C:\\WINDOWS\\system32\\CTFMON.EXE"

HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avldr

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll"

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Svchost]
HTTPFilter REG_MULTI_SZ HTTPFilter\0\0
LocalService REG_MULTI_SZ Alerter\0WebClient\0LmHosts\0RemoteRegistry\0upnphost\0SSDPSRV\0\0
NetworkService REG_MULTI_SZ DnsCache\0\0
DcomLaunch REG_MULTI_SZ DcomLaunch\0TermService\0\0
rpcss REG_MULTI_SZ RpcSs\0\0
imgsvc REG_MULTI_SZ StiSvc\0\0
termsvcs REG_MULTI_SZ TermService\0\0

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{cd99fa2b-9691-11db-97b6-806d6172696f}]
Shell\AutoRun\command D:\setup.exe

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{cd99fa2c-9691-11db-97b6-806d6172696f}]
Shell\AutoRun\command E:\autorun.exe

-- End of ComboScan: finished at 2007-03-30 at 18:50:52 ------------------------

"Silent Runners.vbs", revision R50, http://www.silentrunners.org/
Operating System: Windows XP SP2
Output limited to non-default values, except where indicated by "{++}"

Startup items buried in registry:
---------------------------------

HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ {++}
"CTFMON.EXE" = "C:\WINDOWS\system32\ctfmon.exe" [MS]
"Steam" = ""c:\progra~1\steam\steam.exe" -silent" ["Valve Corporation"]

HKLM\Software\Microsoft\Windows\CurrentVersion\Run\ {++}
"nForce Tray Options" = ""sstray.exe" /r" ["NVIDIA Corporation"]
"APVXDWIN" = ""C:\Program Files\Panda Software\Panda Antivirus + Firewall 2007\APVXDWIN.EXE" /s" ["Panda Software International"]
"InCD" = ""C:\Program Files\Ahead\InCD\InCD.exe"" ["Ahead Software AG"]
"Logitech Hardware Abstraction Layer" = "KHALMNPR.EXE" ["Logitech Inc."]
"nwiz" = ""nwiz.exe" /install" ["NVIDIA Corporation"]
"SunJavaUpdateSched" = ""C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe"" ["Sun Microsystems, Inc."]
"EPSON Stylus C66 Series" = ""C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I0S2.EXE" /P23 "EPSON Stylus C66 Series" /O6 "USB001" /M "Stylus C66"" ["SEIKO EPSON CORPORATION"]
"QuickTime Task" = ""C:\Program Files\QuickTime\qttask.exe" -atboottime" ["Apple Computer, Inc."]
"NvCplDaemon" = "RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup" [MS]

HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\(Default) = (no title provided)
-> {HKLM...CLSID} = "AcroIEHlprObj Class"
\InProcServer32\(Default) = "C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx" [empty string]
{53707962-6F74-2D53-2644-206D7942484F}\(Default) = (no title provided)
-> {HKLM...CLSID} = (no title provided)
\InProcServer32\(Default) = "C:\Program Files\Spybot - Search & Destroy\SDHelper.dll" ["Safer Networking Limited"]
{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\(Default) = (no title provided)
-> {HKLM...CLSID} = "SSVHelper Class"
\InProcServer32\(Default) = "C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll" ["Sun Microsystems, Inc."]
{E99421FB-68DD-40F0-B4AC-B7027CAE2F1A}\(Default) = (no title provided)
-> {HKLM...CLSID} = "EpsonToolBandKicker Class"
\InProcServer32\(Default) = "C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll" ["SEIKO EPSON CORPORATION"]

HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\
"{42071714-76d4-11d1-8b24-00a0c9068ff3}" = "Rozszerzenie CPL kadrowania wyświetlania"
-> {HKLM...CLSID} = "Rozszerzenie CPL kadrowania wyświetlania"
\InProcServer32\(Default) = "deskpan.dll" [file not found]
"{88895560-9AA2-1069-930E-00AA0030EBC8}" = "Rozszerzenie ikony HyperTerminalu"
-> {HKLM...CLSID} = "HyperTerminal Icon Ext"
\InProcServer32\(Default) = "C:\WINDOWS\system32\hticons.dll" ["Hilgraeve, Inc."]
"{65756541-C65C-11CD-0000-4B656E696100}" = "Panda Antivirus"
-> {HKLM...CLSID} = "Panda Antivirus"
\InProcServer32\(Default) = "C:\Program Files\Panda Software\Panda Antivirus + Firewall 2007\ShellTit.DLL" ["Panda Software International"]
"{950FF917-7A57-46BC-8017-59D9BF474000}" = "Shell Extension for CDRW"
-> {HKLM...CLSID} = "Shell Extension for CDRW"
\InProcServer32\(Default) = "C:\Program Files\Ahead\InCD\incdshx.dll" ["Ahead Software AG"]
"{B41DB860-8EE4-11D2-9906-E49FADC173CA}" = "WinRAR shell extension"
-> {HKLM...CLSID} = "WinRAR"
\InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]
"{A70C977A-BF00-412C-90B7-034C51DA2439}" = "NvCpl DesktopContext Class"
-> {HKLM...CLSID} = "DesktopContext Class"
\InProcServer32\(Default) = "C:\WINDOWS\system32\nvcpl.dll" ["NVIDIA Corporation"]
"{FFB699E0-306A-11d3-8BD1-00104B6F7516}" = "Play on my TV helper"
-> {HKLM...CLSID} = "NVIDIA CPL Extension"
\InProcServer32\(Default) = "C:\WINDOWS\system32\nvcpl.dll" ["NVIDIA Corporation"]
"{1CDB2949-8F65-4355-8456-263E7C208A5D}" = "Desktop Explorer"
-> {HKLM...CLSID} = "Desktop Explorer"
\InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"]
"{1E9B04FB-F9E5-4718-997B-B8DA88302A47}" = "Desktop Explorer Menu"
-> {HKLM...CLSID} = (no title provided)
\InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"]
"{1E9B04FB-F9E5-4718-997B-B8DA88302A48}" = "nView Desktop Context Menu"
-> {HKLM...CLSID} = "nView Desktop Context Menu"
\InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"]
"{B9E1D2CB-CCFF-4AA6-9579-D7A4754030EF}" = "iTunes"
-> {HKLM...CLSID} = "iTunes"
\InProcServer32\(Default) = "C:\Program Files\iTunes\iTunesMiniPlayer.dll" ["Apple Computer, Inc."]

HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\
<<!>> avldr\DLLName = "avldr.dll" ["Panda Software"]

HKLM\Software\Classes\*\shellex\ContextMenuHandlers\
Panda Antivirus\(Default) = "{65756541-C65C-11CD-0000-4B656E696100}"
-> {HKLM...CLSID} = "Panda Antivirus"
\InProcServer32\(Default) = "C:\Program Files\Panda Software\Panda Antivirus + Firewall 2007\ShellTit.DLL" ["Panda Software International"]
WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
-> {HKLM...CLSID} = "WinRAR"
\InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]

HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\
WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
-> {HKLM...CLSID} = "WinRAR"
\InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]

HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\
Panda Antivirus\(Default) = "{65756541-C65C-11CD-0000-4B656E696100}"
-> {HKLM...CLSID} = "Panda Antivirus"
\InProcServer32\(Default) = "C:\Program Files\Panda Software\Panda Antivirus + Firewall 2007\ShellTit.DLL" ["Panda Software International"]
WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
-> {HKLM...CLSID} = "WinRAR"
\InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]

Group Policies {GPedit.msc branch and setting}:
-----------------------------------------------

Note: detected settings may not have any effect.

HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\

"shutdownwithoutlogon" = (REG_DWORD) hex:0x00000001
{Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options|
Shutdown: Allow system to be shut down without having to log on}

"undockwithoutlogon" = (REG_DWORD) hex:0x00000001
{Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options|
Devices: Allow undock without having to log on}

Active Desktop and Wallpaper:
-----------------------------

Active Desktop may be disabled at this entry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState

Displayed if Active Desktop enabled and wallpaper not set by Group Policy:
HKCU\Software\Microsoft\Internet Explorer\Desktop\General\
"Wallpaper" = "C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp"

Displayed if Active Desktop disabled and wallpaper not set by Group Policy:
HKCU\Control Panel\Desktop\
"Wallpaper" = "C:\Documents and Settings\wielbie\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp"

Enabled Screen Saver:
---------------------

HKCU\Control Panel\Desktop\
"SCRNSAVE.EXE" = "C:\WINDOWS\System32\logon.scr" [MS]

**Posty:** 18165 · przez **wojtas** 30 Mar 2007, 20:27

Pobierz i uruchom narzędzie : The Avenger
http://swandog46.geekstogo.com/avenger.zip
Zaznacz opcję Input script manually i kliknij na Lupkę z prawej strony. W okienku, które się otworzy wklejasz:

Files to delete:

C:\WINDOWS\system32\tmp.reg

Klikasz Done, a następnie zielone światełko i zgadzasz się na restart klikając OK.

C:\WINDOWS\system32\~.exe

ten plik wrzuc na skanery te:

http://virusscan.jotti.org/
http://www.virustotal.com/en/indexf.html

Kasujesz ręcznie z dysku plik: C:\Avenger\backup.zip i wklejasz na forum raport: C:\avenger.txt + comboscana i ze skanerow tych 2

**Posty:** 13 · przez **krakor** 31 Mar 2007, 15:46

avanger

Logfile of The Avenger version 1, by Swandog46
Running from registry key:
\Registry\Machine\System\CurrentControlSet\Services\dkgpgwqq

*******************

Script file located at: \??\C:\WINDOWS\fgnqxnju.txt
Script file opened successfully.

Script file read successfully

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

File C:\WINDOWS\system32\tmp.reg deleted successfully.

Completed script processing.

*******************

Finished! Terminate.

malware scan

Scan taken on 31 Mar 2007 13:25:42 (GMT)
AntiVir
Found TR/Crypt.XDR.Gen
ArcaVir
Found nothing
Avast
Found Win32:Gadu-C
AVG Antivirus
Found nothing
BitDefender
Found nothing
ClamAV
Found nothing
Dr.Web
Found DLOADER.Trojan (probable variant)
F-Prot Antivirus
Found W32/Dropper.gen6
F-Secure Anti-Virus
Found nothing
Fortinet
Found nothing
Kaspersky Anti-Virus
Found nothing
NOD32
Found a variant of Win32/TrojanProxy.Dlena
Norman Virus Control
Found nothing
Panda Antivirus
Found nothing
Rising Antivirus
Found nothing
VirusBuster
Found nothing
VBA32
Found nothing

virustotal

Complete scanning result of "_.exe", received in VirusTotal at 03.31.2007, 15:26:15 (CET).

Antivirus Version Update Result
AhnLab-V3 2007.3.31.0 03.31.2007 no virus found
AntiVir 7.3.1.46 03.30.2007 TR/Crypt.XDR.Gen
Authentium 4.93.8 03.31.2007 W32/Dropper.gen6
Avast 4.7.936.0 03.31.2007 Win32:Gadu-C
AVG 7.5.0.447 03.30.2007 no virus found
BitDefender 7.2 03.31.2007 no virus found
CAT-QuickHeal 9.00 03.31.2007 (Suspicious) - DNAScan
ClamAV devel-20070312 03.31.2007 no virus found
DrWeb 4.33 03.31.2007 DLOADER.Trojan
eSafe 7.0.15.0 03.29.2007 no virus found
eTrust-Vet 30.6.3527 03.31.2007 no virus found
Ewido 4.0 03.31.2007 no virus found
FileAdvisor 1 03.31.2007 no virus found
Fortinet 2.85.0.0 03.31.2007 no virus found
F-Prot 4.3.1.45 03.30.2007 W32/Dropper.gen6
F-Secure 6.70.13030.0 03.31.2007 no virus found
Ikarus T3.1.1.3 03.31.2007 no virus found
Kaspersky 4.0.2.24 03.31.2007 no virus found
McAfee 4997 03.31.2007 no virus found
Microsoft 1.2306 03.31.2007 no virus found
NOD32v2 2158 03.30.2007 a variant of Win32/TrojanProxy.Dlena
Norman 5.80.02 03.31.2007 no virus found
Panda 9.0.0.4 03.31.2007 Suspicious file
Prevx1 V2 03.31.2007 no virus found
Sophos 4.16.0 03.30.2007 no virus found
Sunbelt 2.2.907.0 03.31.2007 no virus found
Symantec 10 03.31.2007 no virus found
TheHacker 6.1.6.083 03.30.2007 no virus found
UNA 1.83 03.16.2007 no virus found
VBA32 3.11.3 03.30.2007 no virus found
VirusBuster 4.3.7:9 03.30.2007 no virus found
Webwasher-Gateway 6.0.1 03.31.2007 Trojan.Crypt.XDR.Gen

Aditional Information
File size: 43008 bytes
MD5: 18997762dfc975bd314e14aad47bdea2
SHA1: f988ce3209b34aa546af0642ebd95d533a5c81db

combo

ComboScan v20070306.20 run by wielbie on 2007-03-31 at 15:38:03
Computer is in Normal Mode.
--------------------------------------------------------------------------------

-- HijackThis (run as wielbie.exe) ---------------------------------------------

Logfile of HijackThis v1.99.1
Scan saved at 15:38:09, on 2007-03-31
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Ahead\InCD\InCDsrv.exe
c:\program files\panda software\panda antivirus + firewall 2007\firewall\PNMSRV.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Panda Software\Panda Antivirus + Firewall 2007\APVXDWIN.EXE
C:\Program Files\Ahead\InCD\InCD.exe
C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\progra~1\steam\steam.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Program Files\SAGEM WiFi manager\WLANUTL.exe
C:\Program Files\Common Files\Logitech\KHAL\KHALMNPR.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Panda Software\Panda Antivirus + Firewall 2007\PavFnSvr.exe
C:\Program Files\Common Files\Panda Software\PavShld\pavprsrv.exe
C:\Program Files\Panda Software\Panda Antivirus + Firewall 2007\pavsrv51.exe
C:\Program Files\Panda Software\Panda Antivirus + Firewall 2007\AVENGINE.EXE
C:\Program Files\Panda Software\Panda Antivirus + Firewall 2007\PsImSvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Panda Software\Panda Antivirus + Firewall 2007\TPSrv.exe
c:\program files\panda software\panda antivirus + firewall 2007\WebProxy.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Tlen.pl\tlen.exe
C:\Documents and Settings\wielbie\Pulpit\Uzyteczne\hijack\comboscan.exe
C:\DOCUME~1\wielbie\Pulpit\UZYTEC~1\hijack\wielbie.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://search.bearshare.com/pl/
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O4 - HKLM\..\Run: [APVXDWIN] "C:\Program Files\Panda Software\Panda Antivirus + Firewall 2007\APVXDWIN.EXE" /s
O4 - HKLM\..\Run: [InCD] "C:\Program Files\Ahead\InCD\InCD.exe"
O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [nwiz] "nwiz.exe" /install
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe"
O4 - HKLM\..\Run: [EPSON Stylus C66 Series] "C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I0S2.EXE" /P23 "EPSON Stylus C66 Series" /O6 "USB001" /M "Stylus C66"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Steam] "c:\progra~1\steam\steam.exe" -silent
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
O4 - Global Startup: Program sieciowy dla SAGEM Wi-Fi 11g USB adapter.lnk = ?
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://downloads.ewido.net/ewidoOnlineScan.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: avldr - C:\WINDOWS\SYSTEM32\avldr.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: InCD Helper (InCDsrv) - Ahead Software AG - C:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Panda Function Service (PAVFNSVR) - Panda Software International - C:\Program Files\Panda Software\Panda Antivirus + Firewall 2007\PavFnSvr.exe
O23 - Service: Panda Process Protection Service (PavPrSrv) - Panda Software - C:\Program Files\Common Files\Panda Software\PavShld\pavprsrv.exe
O23 - Service: Panda anti-virus service (PAVSRV) - Panda Software International - C:\Program Files\Panda Software\Panda Antivirus + Firewall 2007\pavsrv51.exe
O23 - Service: Panda Network Manager (PNMSRV) - Panda Software International - c:\program files\panda software\panda antivirus + firewall 2007\firewall\PNMSRV.EXE
O23 - Service: Panda IManager Service (PSIMSVC) - Panda Software - C:\Program Files\Panda Software\Panda Antivirus + Firewall 2007\PsImSvc.exe
O23 - Service: Panda TPSrv (TPSrv) - Panda Software - C:\Program Files\Panda Software\Panda Antivirus + Firewall 2007\TPSrv.exe

-- Files created between 2007-02-28 and 2007-03-31 -----------------------------

2007-03-22 23:34:07 0 d-------- C:\Temp
2007-03-22 23:32:50 0 d-------- C:\Program Files\ImTOO
2007-03-21 17:39:58 0 d-------- C:\Program Files\Roguescanfix<ROGUES~1>
2007-03-21 16:48:39 0 d-------- C:\!KillBox
2007-03-21 16:47:10 0 d-------- C:\WINDOWS\pss
2007-03-20 20:49:31 217088 --a------ C:\WINDOWS\system32\yv12vfw.dll
2007-03-20 20:49:31 217088 --a------ C:\WINDOWS\system32\i420vfw.dll
2007-03-20 20:49:31 39936 --a------ C:\WINDOWS\system32\huffyuv.dll
2007-03-20 20:49:30 180224 --a------ C:\WINDOWS\system32\xvidvfw.dll
2007-03-20 20:49:30 765952 --a------ C:\WINDOWS\system32\xvidcore.dll
2007-03-20 20:49:30 558592 --a------ C:\WINDOWS\system32\x264vfw.dll
2007-03-20 20:49:30 1565480 --a------ C:\WINDOWS\system32\wmv9vcm.dll
2007-03-20 20:49:30 630784 --a------ C:\WINDOWS\system32\vp7vfw.dll
2007-03-20 20:49:30 438272 --a------ C:\WINDOWS\system32\vp6vfw.dll
2007-03-20 20:49:30 144384 --a------ C:\WINDOWS\system32\Iacenc.dll
2007-03-20 20:49:29 200704 --a------ C:\WINDOWS\system32\ssldivx.dll
2007-03-20 20:49:29 3596288 --a------ C:\WINDOWS\system32\qt-dx331.dll
2007-03-20 20:49:29 1044480 --a------ C:\WINDOWS\system32\libdivx.dll
2007-03-20 20:49:29 196608 --a------ C:\WINDOWS\system32\dtu100.dll
2007-03-20 20:49:29 73728 --a------ C:\WINDOWS\system32\dpl100.dll
2007-03-20 20:49:29 639066 --a------ C:\WINDOWS\system32\divx.dll
2007-03-20 20:49:28 10752 --a------ C:\WINDOWS\system32\ff_vfw.dll
2007-03-20 20:49:26 0 d-------- C:\Program Files\K-Lite Codec Pack<K-LITE~1>
2007-03-19 15:19:34 0 d-------- C:\Program Files\Valve Hammer Editor<VALVEH~1>
2007-03-04 20:15:15 0 d-------- C:\Program Files\BitLord

-- Find3M Report ---------------------------------------------------------------

2007-03-31 15:27:36 0 d-------- C:\Program Files\Mozilla Firefox<MOZILL~1>
2007-03-31 15:24:30 0 d-------- C:\Program Files\Tlen.pl
2007-03-31 15:18:47 0 d-------- C:\Program Files\Steam
2007-03-31 14:56:32 0 d-------- C:\Program Files\Winamp
2007-03-31 14:51:23 0 d-------- C:\Program Files\SAGEM WiFi manager<SAGEMW~1>
2007-03-31 14:51:17 0 d-------- C:\Program Files\QuickTime<QUICKT~1>
2007-03-29 19:07:04 0 d-------- C:\Program Files\VentriloMIX<VENTRI~1>
2007-03-28 22:24:10 0 d-------- C:\Program Files\mIRC
2007-03-26 22:09:07 0 d-------- C:\Program Files\Apple Software Update<APPLES~1>
2007-03-26 22:08:41 0 d-------- C:\Program Files\iTunes
2007-03-25 18:30:36 355486 --a------ C:\WINDOWS\system32\perfh015.dat
2007-03-25 18:30:36 49492 --a------ C:\WINDOWS\system32\perfc015.dat
2007-03-23 00:00:06 0 d-------- C:\Documents and Settings\wielbie\Dane aplikacji\Tlen.pl
2007-03-13 20:32:32 0 d-------- C:\Program Files\RivaTuner v2.0 Final Release<RIVATU~1.0FI>
2007-03-10 22:42:53 0 d-------- C:\Program Files\BearShare<BEARSH~2>
2007-03-04 20:13:30 0 d-------- C:\Documents and Settings\wielbie\Dane aplikacji\uTorrent
2007-02-25 14:27:30 43008 --a------ C:\WINDOWS\system32\~.exe
2007-02-25 14:01:59 0 d---s---- C:\Documents and Settings\wielbie\Dane aplikacji\Microsoft<MICROS~1>
2007-02-24 23:01:20 0 d-------- C:\Documents and Settings\wielbie\Dane aplikacji\Google
2007-02-24 23:00:54 0 d--h----- C:\Program Files\InstallShield Installation Information<INSTAL~1>
2007-02-24 23:00:54 0 d-------- C:\Program Files\Google
2007-02-17 21:07:29 0 d-------- C:\Documents and Settings\wielbie\Dane aplikacji\Help
2007-02-17 20:50:31 0 d-------- C:\Program Files\intercube<INTERC~1>
2007-02-12 15:37:18 0 d-------- C:\Documents and Settings\wielbie\Dane aplikacji\Apple Computer<APPLEC~1>
2007-02-11 19:39:06 0 d-------- C:\Program Files\Java
2007-02-08 01:34:45 0 d-------- C:\Program Files\Ganymede
2007-02-08 00:17:40 0 d-------- C:\Documents and Settings\wielbie\Dane aplikacji\Adobe
2007-02-08 00:15:12 0 d-------- C:\Documents and Settings\wielbie\Dane aplikacji\Opera
2007-02-08 00:01:13 0 d-------- C:\Program Files\Common Files\Adobe
2007-02-08 00:00:22 0 d-------- C:\Program Files\Common Files\Adobe Systems Shared<ADOBES~1>
2007-01-17 23:25:20 2202 --a------ C:\WINDOWS\mozver.dat
2007-01-01 07:56:00 545 --a------ C:\WINDOWS\UC.PIF
2007-01-01 07:56:00 545 --a------ C:\WINDOWS\RAR.PIF
2007-01-01 07:56:00 545 --a------ C:\WINDOWS\PKZIP.PIF
2007-01-01 07:56:00 545 --a------ C:\WINDOWS\PKUNZIP.PIF
2007-01-01 07:56:00 545 --a------ C:\WINDOWS\NOCLOSE.PIF
2007-01-01 07:56:00 545 --a------ C:\WINDOWS\LHA.PIF
2007-01-01 07:56:00 545 --a------ C:\WINDOWS\ARJ.PIF

-- Registry Dump ---------------------------------------------------------------

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run]
"CTFMON.EXE"="C:\\WINDOWS\\system32\\ctfmon.exe"
"Steam"="\"c:\\progra~1\\steam\\steam.exe\" -silent"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run]
"APVXDWIN"="\"C:\\Program Files\\Panda Software\\Panda Antivirus + Firewall 2007\\APVXDWIN.EXE\" /s"
"InCD"="\"C:\\Program Files\\Ahead\\InCD\\InCD.exe\""
"Logitech Hardware Abstraction Layer"="KHALMNPR.EXE"
"nwiz"="\"nwiz.exe\" /install"
"SunJavaUpdateSched"="\"C:\\Program Files\\Java\\jre1.5.0_11\\bin\\jusched.exe\""
"EPSON Stylus C66 Series"="\"C:\\WINDOWS\\System32\\spool\\DRIVERS\\W32X86\\3\\E_S4I0S2.EXE\" /P23 \"EPSON Stylus C66 Series\" /O6 \"USB001\" /M \"Stylus C66\""
"QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime"
"NvCplDaemon"="RUNDLL32.EXE C:\\WINDOWS\\system32\\NvCpl.dll,NvStartup"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="iTunesHelper"
"hkey"="HKLM"
"command"="\"C:\\Program Files\\iTunes\\iTunesHelper.exe\""
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="NeroCheck"
"hkey"="HKLM"
"command"="C:\\WINDOWS\\system32\\NeroCheck.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="NvCpl"
"hkey"="HKLM"
"command"="\"RUNDLL32.EXE\" C:\\WINDOWS\\system32\\NvCpl.dll,NvStartup"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="NvMcTray"
"hkey"="HKLM"
"command"="\"RUNDLL32.EXE\" C:\\WINDOWS\\system32\\NvMcTray.dll,NvTaskbarInit"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RivaTunerStartupDaemon]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="RivaTuner"
"hkey"="HKLM"
"command"="\"C:\\Program Files\\RivaTuner v2.0 Final Release\\RivaTuner.exe\" /S"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\sharedtaskscheduler]
"{8d8c2387-7f80-4022-9be6-43630a969558}"="carbinyl"

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"CTFMON.EXE"="C:\\WINDOWS\\system32\\CTFMON.EXE"

[HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\run]
"CTFMON.EXE"="C:\\WINDOWS\\system32\\CTFMON.EXE"

HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avldr

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll"

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Svchost]
HTTPFilter REG_MULTI_SZ HTTPFilter\0\0
LocalService REG_MULTI_SZ Alerter\0WebClient\0LmHosts\0RemoteRegistry\0upnphost\0SSDPSRV\0\0
NetworkService REG_MULTI_SZ DnsCache\0\0
DcomLaunch REG_MULTI_SZ DcomLaunch\0TermService\0\0
rpcss REG_MULTI_SZ RpcSs\0\0
imgsvc REG_MULTI_SZ StiSvc\0\0
termsvcs REG_MULTI_SZ TermService\0\0

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{cd99fa2b-9691-11db-97b6-806d6172696f}]
Shell\AutoRun\command D:\setup.exe

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{cd99fa2c-9691-11db-97b6-806d6172696f}]
Shell\AutoRun\command E:\autorun.exe

-- End of ComboScan: finished at 2007-03-31 at 15:38:52 ------------------------

**Posty:** 18165 · przez **wojtas** 31 Mar 2007, 18:08

w awaryjnym z wylaczonym przywracaniem systemu:

C:\WINDOWS\system32\~.exe

skasuj pogrubiony

przeskanuj kompa www.ewido.com >> wywal wszystko co znajdzie
później odpal SmitfraudFix z opcji 2

http://siri.urz.free.fr/Fix/SmitfraudFix.php
opis >>

http://forum.programosy.pl/trudne-przypadki-i-metody-usuwania-vt41947.html

i przejedź nim dysk.

prosze o sprawdzenie loga

Prosze o sprawdzenie loga

Kto jest na forum