prosze o sprawdzenie loga

[ostry99]

witam, od pewnego czasu nie moge zapanowac nad komputerem.. wyswietlaja mi sie komunikaty ze komputer jest zagrożony, a takze co chwila wylacza i wlacza mi sie komputer

zamieszczam loga z HJ:

Logfile of HijackThis v1.99.1
Scan saved at 18:58:57, on 2007-04-26
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\windows\System32\smss.exe
C:\windows\SYSTEM32\winlogon.exe
C:\windows\system32\services.exe
C:\windows\system32\savedump.exe
C:\windows\system32\lsass.exe
C:\windows\system32\Ati2evxx.exe
C:\windows\system32\svchost.exe
C:\windows\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\windows\system32\spoolsv.exe
C:\WINDOWS\runservice.exe
C:\WINDOWS\system32\UAService7.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\windows\SYSTEM32\Ati2evxx.exe
C:\windows\system32\WgaTray.exe
C:\windows\Explorer.EXE
C:\windows\system32\idleserv.exe
C:\windows\system32\tmrsrv32.exe
C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe
C:\Program Files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\TRIXX\TRIXX.exe
C:\windows\SOUNDMAN.EXE
C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe
C:\windows\system32\uvnx.exe
C:\PROGRA~1\Alwil Software\Avast4\ashDisp.exe
C:\windows\system32\wuauclt.exe
C:\Program Files\Gadu-Gadu\gg.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe
C:\Program Files\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe
C:\Program Files\WinRAR\WinRAR.exe
C:\DOCUME~1\MATEUSZ\USTAWI~1\Temp\Rar$EX00.859\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.onet.pl/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon
O4 - HKLM\..\Run: [VirtualCloneDrive] "C:\Program Files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe" /s
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime
O4 - HKLM\..\Run: [TRIXX] "C:\Program Files\TRIXX\TRIXX.exe" -s
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [Anti-Blaxx Manager] C:\Program Files\Anti-Blaxx\Anti-Blaxx.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe
O4 - HKLM\..\Run: [DC6_check] "C:\Program Files\Common Files\WinAntiVirus Pro 2006\dc6_startupmon.exe"
O4 - HKLM\..\Run: [ERS_check] "C:\Program Files\Common Files\WinAntiVirus Pro 2006\ers_startupmon.exe"
O4 - HKLM\..\Run: [uvnx] c:\windows\system32\uvnx.exe
O4 - HKLM\..\Run: [PrintDrive] rundll32.exe "C:\windows\system32\ipqxwham.dll",setvm
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\Alwil Software\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [SpyAway] C:\Program Files\SpyAway\spyaway.exe
O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_7 -reboot 1
O4 - HKCU\..\Run: [NBJ] "C:\Program Files\Ahead\Nero BackItUp\NBJ.exe"
O4 - HKCU\..\Run: [Firewall auto setup] C:\DOCUME~1\MATEUSZ\USTAWI~1\Temp\winlogon.exe
O4 - Startup: Cyber-shot Viewer Media Check Tool.lnk = C:\Program Files\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe
O4 - Startup: Neostrada tp.lnk = ?
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: ATI CATALYST – pasek zadań.lnk = C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {83AFB5CA-ED35-11D4-A452-0080C8D85045} (GameDesire Poker Games) - http://67.15.101.3/g_bin/eng/poker_2_0_0_44.cab
O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C1} (GameDesire Pool - http://67.15.101.3/g_bin/eng/billard8_2_0_0_30.cab
O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C5} (GameDesire Snooker) - http://67.15.101.3/g_bin/eng/snooker_2_0_0_31.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{96938C11-A654-435C-BADB-2452291687BD}: NameServer = 194.204.159.1 217.98.63.164
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\windows\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: LicCtrl Service (LicCtrlService) - Unknown owner - C:\WINDOWS\runservice.exe
O23 - Service: Panda Process Protection Service (PavPrSrv) - Unknown owner - C:\Program Files\Common Files\Panda Software\PavShld\pavprsrv.exe (file missing)
O23 - Service: SecuROM User Access Service (V7) (UserAccess7) - Unknown owner - C:\WINDOWS\system32\UAService7.exe

[prog]

Na początek:


1. Pobierz SmitFraudFix.
Użyj go z opcji drugiej, czyli uruchom, wklep 2 i ENTER.
Nie wiem czy usuwa SpyAway, ale warto sprawdzić.


2. Daj logi z comboscan + silentrunners.

[ostry99]

SmitFraudFix v2.171

Scan done at 19:21:04,96, 2007-04-26
Run from C:\Program Files\Mozilla Firefox\SmitfraudFix
OS: Microsoft Windows XP [Wersja 5.1.2600] - Windows_NT
The filesystem type is NTFS
Fix run in normal mode

»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Before SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{b59f3ba4-98da-4b5f-8a2d-7b56fb11140b}"="buprestidae"


»»»»»»»»»»»»»»»»»»»»»»»» Killing process


»»»»»»»»»»»»»»»»»»»»»»»» hosts


127.0.0.1 localhost

»»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix

GenericRenosFix by S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» Deleting infected files

C:\windows\loader.exe Deleted
C:\windows\susp.exe Deleted
C:\windows\Tasks\At?.job Deleted
C:\DOCUME~1\ALLUSE~1\MENUST~1\Online Security Guide.url Deleted
C:\DOCUME~1\ALLUSE~1\MENUST~1\Security Troubleshooting.url Deleted
C:\DOCUME~1\MATEUSZ\Ulubione\Online Security Test.url Deleted
C:\Program Files\AntiVermins\ Deleted
C:\Program Files\PestCapture\ Deleted
C:\Program Files\serial.zip Deleted
C:\Program Files\Video ActiveX Object\ Deleted

»»»»»»»»»»»»»»»»»»»»»»»» DNS

Description: WAN (PPP/SLIP) Interface
DNS Server Search Order: 194.204.159.1
DNS Server Search Order: 217.98.63.164

HKLM\SYSTEM\CCS\Services\Tcpip\..\{96938C11-A654-435C-BADB-2452291687BD}: NameServer=194.204.159.1 217.98.63.164
HKLM\SYSTEM\CS1\Services\Tcpip\..\{96938C11-A654-435C-BADB-2452291687BD}: NameServer=194.204.152.34 217.98.63.164
HKLM\SYSTEM\CS2\Services\Tcpip\..\{96938C11-A654-435C-BADB-2452291687BD}: NameServer=194.204.159.1 217.98.63.164
HKLM\SYSTEM\CS3\Services\Tcpip\..\{96938C11-A654-435C-BADB-2452291687BD}: NameServer=194.204.159.1 217.98.63.164


»»»»»»»»»»»»»»»»»»»»»»»» Deleting Temp Files


»»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
!!!Attention, following keys are not inevitably infected!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"System"=""


»»»»»»»»»»»»»»»»»»»»»»»» Registry Cleaning

Registry Cleaning done.

»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler After SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll


»»»»»»»»»»»»»»»»»»»»»»»» End

[prog]

Ok, coś usunął - daj proszę logi z comboscana i silentrunners.

[ Dodano: Dzisiaj o 19:50 ]
Związku z PW.

SILENT OBSLUGA I UMIESZCZANIE(ostatni post):
http://forum.programosy.pl/hijackthis-amp-silent-runners-gtobsuga-i-umieszczanie-vt9452.html

COMBOSCAN (ostatni post):
http://forum.programosy.pl/dodatkowe-narzedzia-do-usuwania-i-ochrony-vt42021.html

[ostry99]

ComboScan

Kod: Zaznacz wszystko

ComboScan v20070306.20 run by MATEUSZ on 2007-04-27 at 12:57:29
Computer is in Normal Mode.
--------------------------------------------------------------------------------

-- System Restore --------------------------------------------------------------

Successfully created ComboScan Restore Point.


-- Last 5 Restore Point(s) --
10: 2007-04-27 10:57:48 UTC - RP10 - ComboScan Restore Point
9: 2007-04-18 14:32:24 UTC - RP9 - Usunięte Panda Antivirus + Firewall 2007
8: 2007-04-18 14:27:26 UTC - RP8 - ??????? Counter-Strike 1.6
7: 2007-04-18 14:19:04 UTC - RP7 - Software Distribution Service 2.0
6: 2007-04-17 11:42:44 UTC - RP6 - Software Distribution Service 2.0


-- First Restore Point --
1: 2007-03-24 12:04:06 UTC - RP1 - Punkt kontrolny systemu


Performed disk cleanup.


-- HijackThis (run as MATEUSZ.exe) ---------------------------------------------

Logfile of HijackThis v1.99.1
Scan saved at 12:58:46, on 2007-04-27
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\windows\System32\smss.exe
C:\windows\SYSTEM32\winlogon.exe
C:\windows\system32\services.exe
C:\windows\system32\lsass.exe
C:\windows\system32\Ati2evxx.exe
C:\windows\system32\svchost.exe
C:\windows\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\windows\system32\spoolsv.exe
C:\WINDOWS\runservice.exe
C:\WINDOWS\system32\UAService7.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\windows\SYSTEM32\Ati2evxx.exe
C:\windows\system32\WgaTray.exe
C:\windows\Explorer.EXE
C:\windows\system32\tmrsrv32.exe
C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe
C:\Program Files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\TRIXX\TRIXX.exe
C:\windows\SOUNDMAN.EXE
C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe
C:\windows\system32\uvnx.exe
C:\PROGRA~1\Alwil Software\Avast4\ashDisp.exe
C:\Program Files\Gadu-Gadu\gg.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe
C:\Program Files\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe
C:\Program Files\Ikari's Chat Qlient\Chat.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\MATEUSZ\Pulpit\comboscan.exe
C:\PROGRA~1\HIJACK~1\MATEUSZ.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O2 - BHO: (no name) - {00000026-8735-428D-B81F-DD098223B25F} - (no file)
O2 - BHO: (no name) - {00000250-0320-4dd4-be4f-7566d2314352} - (no file)
O2 - BHO: (no name) - {000006b1-19b5-414a-849f-2a3c64ae6939} - (no file)
O2 - BHO: (no name) - {06dfedaa-6196-11d5-bfc8-00508b4a487d} - (no file)
O2 - BHO: (no name) - {09129E55-4ADE-475A-B32D-B960DB0BA5E0} - C:\windows\system32\yayywxw.dll
O2 - BHO: (no name) - {13197ace-6851-45c3-a7ff-c281324d5489} - (no file)
O2 - BHO: (no name) - {1557B435-8242-4686-9AA3-9265BF7525A4} - C:\windows\system32\gvqkggbb.dll
O2 - BHO: (no name) - {30000273-8230-4dd4-be4f-6889d1e74167} - (no file)
O2 - BHO: (no name) - {3DB596F2-7605-49A4-81CB-3A0976765D97} - C:\windows\system32\qnpwkkrk.dll
O2 - BHO: (no name) - {43E2FE1D-17D4-287F-A33D-6AE3379AAA97} - C:\windows\system32\sfcvzzfr.dll (file missing)
O2 - BHO: (no name) - {4e1075f4-eec4-4a86-add7-cd5f52858c31} - (no file)
O2 - BHO: (no name) - {4e7bd74f-2b8d-469e-92c6-ce7eb590a94d} - (no file)
O2 - BHO: (no name) - {53C330D6-A4AB-419B-B45D-FD4411C1FEF4} - (no file)
O2 - BHO: (no name) - {5929cd6e-2062-44a4-b2c5-2c7e78fbab38} - (no file)
O2 - BHO: (no name) - {5dafd089-24b1-4c5e-bd42-8ca72550717b} - (no file)
O2 - BHO: (no name) - {5fa6752a-c4a0-4222-88c2-928ae5ab4966} - (no file)
O2 - BHO: (no name) - {669695bc-a811-4a9d-8cdf-ba8c795f261e} - (no file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O2 - BHO: (no name) - {8674aea0-9d3d-11d9-99dc-00600f9a01f1} - (no file)
O2 - BHO: Hgni_BHO - {888826A1-3C63-4687-8696-482FDBB129DF} - C:\windows\system32\hgni_ecol.dll
O2 - BHO: (no name) - {965a592f-8efa-4250-8630-7960230792f1} - (no file)
O2 - BHO: (no name) - {AB5B926A-1E0F-454E-8F57-9523B933C5AB} - C:\windows\system32\mlljj.dll
O2 - BHO: (no name) - {b8875bfe-b021-11d4-bfa8-00508b8e9bd3} - (no file)
O2 - BHO: (no name) - {bb936323-19fa-4521-ba29-eca6a121bc78} - (no file)
O2 - BHO: (no name) - {ca1d1b05-9c66-11d5-a009-000103c1e50b} - (no file)
O2 - BHO: (no name) - {cf021f40-3e14-23a5-cba2-717765728274} - (no file)
O2 - BHO: msnhlp32.msn_hlp - {EEFBE5D6-FEFF-4CB4-AA26-6A464090CB89} - C:\windows\system32\msnhlp32.dll
O2 - BHO: (no name) - {fc3a74e5-f281-4f10-ae1e-733078684f3c} - (no file)
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon
O4 - HKLM\..\Run: [VirtualCloneDrive] "C:\Program Files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe" /s
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime
O4 - HKLM\..\Run: [TRIXX] "C:\Program Files\TRIXX\TRIXX.exe" -s
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [Anti-Blaxx Manager] C:\Program Files\Anti-Blaxx\Anti-Blaxx.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe
O4 - HKLM\..\Run: [DC6_check] "C:\Program Files\Common Files\WinAntiVirus Pro 2006\dc6_startupmon.exe"
O4 - HKLM\..\Run: [ERS_check] "C:\Program Files\Common Files\WinAntiVirus Pro 2006\ers_startupmon.exe"
O4 - HKLM\..\Run: [uvnx] c:\windows\system32\uvnx.exe
O4 - HKLM\..\Run: [PrintDrive] rundll32.exe "C:\windows\system32\ipqxwham.dll",setvm
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\Alwil Software\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [SpyAway] C:\Program Files\SpyAway\spyaway.exe
O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_7 -reboot 1
O4 - HKCU\..\Run: [NBJ] "C:\Program Files\Ahead\Nero BackItUp\NBJ.exe"
O4 - HKCU\..\Run: [Firewall auto setup] C:\DOCUME~1\MATEUSZ\USTAWI~1\Temp\winlogon.exe
O4 - Startup: Cyber-shot Viewer Media Check Tool.lnk = C:\Program Files\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe
O4 - Startup: Neostrada tp.lnk = ?
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: ATI CATALYST – pasek zadań.lnk = C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {83AFB5CA-ED35-11D4-A452-0080C8D85045} (GameDesire Poker Games) - http://67.15.101.3/g_bin/eng/poker_2_0_0_44.cab
O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C1} (GameDesire Pool 8) - http://67.15.101.3/g_bin/eng/billard8_2_0_0_30.cab
O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C5} (GameDesire Snooker) - http://67.15.101.3/g_bin/eng/snooker_2_0_0_31.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{96938C11-A654-435C-BADB-2452291687BD}: NameServer = 194.204.159.1 217.98.63.164
O20 - Winlogon Notify: mlljj - C:\windows\system32\mlljj.dll
O20 - Winlogon Notify: WgaLogon - C:\windows\SYSTEM32\WgaLogon.dll
O20 - Winlogon Notify: yayywxw - C:\windows\SYSTEM32\yayywxw.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\windows\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: LicCtrl Service (LicCtrlService) - Unknown owner - C:\WINDOWS\runservice.exe
O23 - Service: Panda Process Protection Service (PavPrSrv) - Unknown owner - C:\Program Files\Common Files\Panda Software\PavShld\pavprsrv.exe (file missing)
O23 - Service: SecuROM User Access Service (V7) (UserAccess7) - Unknown owner - C:\WINDOWS\system32\UAService7.exe


-- File Associations -----------------------------------------------------------

.bat - batfile - "%1" %*
.chm - chm.file - "C:\WINDOWS\hh.exe" %1
.cmd - cmdfile - "%1" %*
.com - comfile - "%1" %*
.exe - exefile - "%1" %*
.hlp - hlpfile - %SystemRoot%\System32\winhlp32.exe %1
.inf - inffile - %SystemRoot%\System32\NOTEPAD.EXE %1
.ini - inifile - %SystemRoot%\System32\NOTEPAD.EXE %1
.js - JSFile - %SystemRoot%\System32\WScript.exe "%1" %*
.lnk - lnkfile - {00021401-0000-0000-C000-000000000046}
.pif - piffile - "%1" %*
.reg - regfile - regedit.exe "%1"
.scr - scrfile - "%1" /S
.txt - txtfile - %SystemRoot%\system32\NOTEPAD.EXE %1
.vbs - VBSFile - %SystemRoot%\System32\WScript.exe "%1" %*


-- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled ---------------------

1R Aavmker4 (avast! Asynchronous Virus Monitor) - C:\WINDOWS\system32\drivers\aavmker4.sys
2R ACEDRV07 - C:\WINDOWS\system32\drivers\ACEDRV07.sys
3R alcan5wn (SpeedTouch USB ADSL PPP Networking Driver (NDISWAN)) - C:\WINDOWS\system32\drivers\alcan5wn.sys
3R alcaudsl (SpeedTouch ADSL Modem ATM Transport) - C:\WINDOWS\system32\drivers\alcaudsl.sys
3R ALCXWDM (Service for Realtek AC97 Audio (WDM)) - C:\WINDOWS\system32\drivers\alcxwdm.sys
2R aswMon2 (avast! Standard Shield Support) - C:\WINDOWS\system32\drivers\aswmon2.sys
3R aswRdr - C:\WINDOWS\system32\drivers\aswRdr.sys
1R aswTdi (avast! Network Shield Support) - C:\WINDOWS\system32\drivers\aswTdi.sys
3R ati2mtag - C:\WINDOWS\system32\drivers\ati2mtag.sys
2R ElbyCDIO (ElbyCDIO Driver) - C:\WINDOWS\system32\drivers\ElbyCDIO.sys
3R ElbyDelay - C:\WINDOWS\system32\drivers\ElbyDelay.sys
0S FOPN - C:\windows\system32\Drivers\FOPN.sys (not found)
3S hamachi (Hamachi Network Interface) - C:\WINDOWS\system32\drivers\hamachi.sys
3S HidUsb (Sterownik Microsoft klasy HID) - C:\WINDOWS\system32\drivers\hidusb.sys
1R intelppm (Sterownik procesora Intel) - C:\WINDOWS\system32\drivers\intelppm.sys
2S PavProc (Panda Process Protection Driver) - C:\WINDOWS\system32\DRIVERS\PavProc.sys (not found)
0R PxHelp20 - C:\WINDOWS\system32\drivers\pxhelp20.sys
3R RTL8023xp (Realtek 10/100/1000 NIC Family all in one NDIS XP Driver) - C:\WINDOWS\system32\drivers\Rtnicxp.sys
3S rtl8139 (Sterownik NT karty Realtek RTL8139(A/B/C)-based PCI Fast Ethernet) - C:\WINDOWS\system32\drivers\RTL8139.sys
0R sfdrv01 (StarForce Protection Environment Driver (version 1.x)) - C:\WINDOWS\system32\drivers\sfdrv01.sys
0R sfhlp02 (StarForce Protection Helper Driver (version 2.x)) - C:\WINDOWS\system32\drivers\sfhlp02.sys
0R sfsync04 (StarForce Protection Synchronization Driver (version 4.x)) - C:\WINDOWS\system32\drivers\sfsync04.sys
3S SONYPVU1 (Sterownik filtru USB Sony (SONYPVU1)) - C:\WINDOWS\system32\drivers\SONYPVU1.SYS
0R sptd - C:\WINDOWS\system32\drivers\sptd.sys
1R TRIXX - C:\Program Files\TRIXX\TRIXXDriver.sys
3R usbehci (Sterownik Miniport rozszerzonego kontrolera hosta USB 2.0 Microsoft) - C:\WINDOWS\system32\drivers\usbehci.sys
3R usbohci (Sterownik Miniport otwartego kontrolera hosta USB Microsoft) - C:\WINDOWS\system32\drivers\usbohci.sys
3S USBSTOR (Sterownik magazynu masowego USB) - C:\WINDOWS\system32\drivers\USBSTOR.SYS
0R VClone - C:\WINDOWS\system32\drivers\VClone.sys
1S vspf - C:\windows\system32\drivers\vspf5.sys (not found)
1S vspf_hk - C:\windows\system32\drivers\vspf_hk5.sys (not found)
4S WS2IFSL (Środowisko wspomagające dostawcę usług innych niż IFS - Windows Socket 2.0) - C:\WINDOWS\system32\drivers\ws2ifsl.sys


-- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------

3S aspnet_state (ASP.NET State Service) - C:\windows\Microsoft.NET\Framework\v1.1.4322\aspnet_state.exe
2R aswUpdSv (avast! iAVS4 Control Service) - "C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe"
2R Ati HotKey Poller - C:\windows\system32\Ati2evxx.exe
2S ATI Smart - C:\WINDOWS\system32\ati2sgag.exe
2R avast! Antivirus - "C:\Program Files\Alwil Software\Avast4\ashServ.exe"
3R avast! Mail Scanner - "C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service
3R avast! Web Scanner - "C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service
3S IDriverT (InstallDriver Table Manager) - "C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe"
2R LicCtrlService (LicCtrl Service) - C:\WINDOWS\runservice.exe
2S PavPrSrv (Panda Process Protection Service) - "C:\Program Files\Common Files\Panda Software\PavShld\pavprsrv.exe"
2R UMWdf (Windows User Mode Driver Framework) - C:\WINDOWS\system32\wdfmgr.exe
2R UserAccess7 (SecuROM User Access Service (V7)) - C:\WINDOWS\system32\UAService7.exe


-- Files created between 2007-03-27 and 2007-04-27 -----------------------------

2007-04-26 19:21:40      3146 --a------ C:\windows\system32\tmp.reg
2007-04-26 19:20:43     79360 --a------ C:\windows\system32\swxcacls.exe
2007-04-26 19:20:43     40960 --a------ C:\windows\system32\swsc.exe
2007-04-26 19:20:43    135168 --a------ C:\windows\system32\swreg.exe
2007-04-26 19:20:43    288417 --a------ C:\windows\system32\SrchSTS.exe
2007-04-26 19:20:43     53248 --a------ C:\windows\system32\Process.exe
2007-04-26 19:20:43     51200 --a------ C:\windows\system32\dumphive.exe
2007-04-26 16:43:31     18432 --a------ C:\windows\sysrlb32.exe
2007-04-26 16:27:30         0 d-------- C:\Program Files\SpyAway
2007-04-26 16:10:09     26112 --a------ C:\windows\vxddsk.exe
2007-04-26 16:10:08     32512 --a------ C:\windows\wml.exe
2007-04-26 16:10:08     28160 --a------ C:\windows\system32\wml.exe
2007-04-26 16:10:08     18176 --a------ C:\windows\system32\vxddsk.exe
2007-04-26 16:10:07     27648 --a------ C:\windows\satmat.exe
2007-04-26 16:10:07     12544 --a------ C:\windows\Biprep.exe
2007-04-26 16:10:07     10752 --a------ C:\windows\bi.dll
2007-04-26 16:10:07     31744 --a------ C:\windows\7search.dll
2007-04-26 16:10:06     14080 --a------ C:\windows\stcloader.exe<STCLOA~1.EXE>
2007-04-26 16:10:06     28672 --a------ C:\windows\pbar.dll
2007-04-26 16:10:06     20224 --a------ C:\windows\flt.dll
2007-04-26 16:10:06     21248 --a------ C:\windows\764.exe
2007-04-26 16:10:05     30208 --a------ C:\windows\voiceip.dll
2007-04-26 16:10:05     18944 --a------ C:\windows\swin32.dll
2007-04-26 16:10:05     20992 --a------ C:\windows\cdsm32.dll
2007-04-26 16:10:05     20736 --a------ C:\windows\bokja.exe
2007-04-26 16:10:04      9984 --a------ C:\windows\mssvr.exe
2007-04-26 16:10:04     15104 --a------ C:\windows\mspphe.dll
2007-04-26 16:09:59     32000 --a------ C:\windows\bjam.dll
2007-04-26 16:09:57     15616 --a------ C:\windows\system32\MSIXU.DLL
2007-04-26 16:09:57     14336 --a------ C:\windows\2020search2.dll<2020SE~2.DLL>
2007-04-26 16:09:57     24832 --a------ C:\windows\2020search.dll<2020SE~1.DLL>
2007-04-26 16:09:56     12288 --a------ C:\windows\system32\WER8274.DLL
2007-04-26 16:09:56     32000 --a------ C:\windows\salm.exe
2007-04-26 16:09:56     30976 --a------ C:\windows\180ax.exe
2007-04-26 16:09:55     23552 --a------ C:\windows\updatetc.exe
2007-04-26 16:09:55     11776 --a------ C:\windows\saiemod.dll
2007-04-26 16:09:27     21504 --a------ C:\windows\system32\msnhlp32.dll
2007-04-26 16:09:16     17408 --a------ C:\windows\system32\tmrsrv32.exe
2007-04-26 16:08:08     81412 --a------ C:\windows\system32\idleserv.exe
2007-04-26 16:07:58     12800 --a------ C:\windows\system32\user_32.dll
2007-04-25 21:51:01    119296 --a------ C:\windows\system32\hgni_ecol.dll<HGNI_E~1.DLL>
2007-04-25 21:50:47    155648 --a------ C:\windows\mgrab.exe
2007-04-25 16:33:30     43176 --a------ C:\windows\system32\drivers\aswTdi.sys
2007-04-25 16:33:30     23416 --a------ C:\windows\system32\drivers\aswRdr.sys
2007-04-25 16:33:30     26888 --a------ C:\windows\system32\drivers\aavmker4.sys
2007-04-25 16:33:21     90112 --a------ C:\windows\system32\AvastSS.scr
2007-04-25 16:33:17     94552 --a------ C:\windows\system32\drivers\aswmon2.sys
2007-04-25 16:33:17     85952 --a------ C:\windows\system32\drivers\aswmon.sys
2007-04-25 16:33:06    733824 --a------ C:\windows\system32\aswBoot.exe
2007-04-24 21:42:41    123972 --a------ C:\windows\system32\ipqxwham.dll
2007-04-23 21:42:31    123972 --a------ C:\windows\system32\ghentesm.dll
2007-04-23 19:00:40     83456 --a------ C:\windows\install.exe
2007-04-23 17:39:46     18432 --a------ C:\windows\ul.exe
2007-04-23 16:51:46   1040384 --a------ C:\windows\system32\libeay32.dll
2007-04-23 16:51:12    196608 --a------ C:\windows\system32\ssleay32.dll
2007-04-23 16:49:39     18432 --a------ C:\windows\system32\uvnx.exe
2007-04-23 16:49:38     18432 --a----c- C:\U.exe
2007-04-23 15:42:08         0 d-------- C:\Program Files\Common Files\Companion Wizard<COMPAN~1>
2007-04-23 15:39:57         0 d--hs--c- C:\WA6P
2007-04-23 15:39:11      8704 --a------ C:\windows\system32\SpOrder.dll
2007-04-23 15:39:04         0 d-------- C:\Program Files\WinAntiVirus Pro 2006<WINANT~1>
2007-04-23 15:39:04         0 d-------- C:\Program Files\Common Files\WinAntiVirus Pro 2006<WINANT~1>
2007-04-22 21:42:13    123972 --a------ C:\windows\system32\ucmqgvsi.dll
2007-04-21 21:42:11    123972 --a------ C:\windows\system32\naqghlup.dll
2007-04-21 21:41:58     49204 --a------ C:\windows\system32\gvqkggbb.dll
2007-04-18 14:03:27    125460 --a------ C:\windows\system32\qnpwkkrk.dll
2007-04-18 14:03:20    123972 --a------ C:\windows\system32\deqsihle.dll
2007-04-17 14:03:18    123972 --a------ C:\windows\system32\vqktivnd.dll
2007-04-16 14:03:03    123972 --a------ C:\windows\system32\fvufgaof.dll
2007-04-15 14:02:27    123972 --a------ C:\windows\system32\jymuasci.dll
2007-04-14 18:51:12    123972 --a------ C:\windows\system32\pitsaiih.dll
2007-04-13 15:50:01    123972 --a------ C:\windows\system32\wqikxhyd.dll
2007-04-12 15:49:43    123972 --a------ C:\windows\system32\fxuqpvyi.dll
2007-04-11 14:46:55    123972 --a------ C:\windows\system32\gusbsplr.dll
2007-04-10 14:08:00    496152 ---hs---- C:\windows\system32\jjllm.bak2<JJLLM~2.BAK>
2007-04-09 20:00:06     26694 --a------ C:\windows\system32\ljjhihi.dll
2007-04-09 14:07:38    489493 ---hs---- C:\windows\system32\jjllm.bak1<JJLLM~1.BAK>
2007-04-09 14:07:10    280676 ---hs---- C:\windows\system32\mlljj.dll
2007-04-09 14:01:08         2 --a------ C:\windows\system32\wnscpsv.exe
2007-04-09 14:01:06         0 d-------- C:\Program Files\Outerinfo<OUTERI~1>
2007-04-09 14:01:06         0 d-------- C:\Program Files\Common Files\?ymbols
2007-04-09 14:00:07     26694 --a------ C:\windows\system32\yayywxw.dll
2007-04-06 11:15:11    856064 --a------ C:\windows\system32\xvidcore.dll
2007-04-04 14:49:33         0 d--h----- C:\windows\$hf_mig$
2007-03-28 23:07:19         0 d-------- C:\Program Files\AidemMedia<AIDEMM~1>


-- Find3M Report ---------------------------------------------------------------

2007-04-27 11:28:37    481068 --a------ C:\windows\system32\perfh015.dat
2007-04-27 11:28:37     82738 --a------ C:\windows\system32\perfc015.dat
2007-04-27 11:24:24       777 --ahs---- C:\windows\system32\mmf.sys
2007-04-26 19:20:40         0 d-------- C:\Program Files\Mozilla Firefox<MOZILL~1>
2007-04-23 15:42:27       704 --a------ C:\Documents and Settings\MATEUSZ\Dane aplikacji\update.log
2007-04-23 15:39:42         0 d-------- C:\Documents and Settings\MATEUSZ\Dane aplikacji\WinAntiVirus Pro 2006<WINANT~1>
2007-04-18 16:39:27         0 d-------- C:\Program Files\Common Files\Panda Software<PANDAS~1>
2007-04-18 16:33:53         0 d-------- C:\Program Files\Skype
2007-04-18 16:20:14         0 d-------- C:\Documents and Settings\MATEUSZ\Dane aplikacji\Skype
2007-04-18 14:55:15         0 d-------- C:\Program Files\Ikari's Chat Qlient
2007-04-18 13:20:03         0 d-------- C:\Program Files\Winamp
2007-04-17 22:17:50         0 d-------- C:\Program Files\Gadu-Gadu<GADU-G~1>
2007-04-17 14:12:50         0 d-------- C:\Program Files\Messenger<MESSEN~1>
2007-04-17 14:12:48         0 d-------- C:\Program Files\TRIXX
2007-04-12 15:29:56      4000 --a----c- C:\ao.dat
2007-04-09 20:00:05    197886 --a------ C:\Program Files\update.zip
2007-04-06 11:15:45         0 d-------- C:\Program Files\K-Lite Codec Pack
2007-04-05 19:26:11         0 d-------- C:\Program Files\GameShadow
2007-04-04 22:16:36         0 d-------- C:\Program Files\mIRC
2007-03-30 08:21:20         0 d-------- C:\Documents and Settings\MATEUSZ\Dane aplikacji\uTorrent
2007-03-30 00:54:18         0 d-------- C:\Program Files\utorrent
2007-03-28 23:04:39         0 d-------- C:\Documents and Settings\MATEUSZ\Dane aplikacji\Adobe
2007-03-23 19:24:28         0 d-------- C:\Program Files\Cheating-Death
2007-03-23 19:19:07         0 d-------- C:\Program Files\vanBasco's Karaoke Player<VANBAS~1>
2007-03-23 19:07:17         0 d-------- C:\Program Files\Java
2007-03-23 19:06:44         0 d-------- C:\Program Files\eSkiMoS R2<ESKIMO~1>
2007-03-23 19:06:31         0 d-------- C:\Program Files\DivX
2007-03-23 18:53:28         0 d-------- C:\Program Files\BearShare<BEARSH~1>
2007-03-23 18:52:55         0 d-------- C:\Program Files\MarBit
2007-03-18 12:39:39         0 d--h----- C:\Program Files\InstallShield Installation Information<INSTAL~1>
2007-03-18 12:39:06         0 d-------- C:\Program Files\Deluxe Ski Jump 3
2007-03-17 15:45:36    293376 --a------ C:\windows\system32\winsrv.dll
2007-03-16 21:45:54         0 d-------- C:\Documents and Settings\MATEUSZ\Dane aplikacji\GanymedeNet<GANYME~1>
2007-03-13 17:30:08    186541 --a------ C:\Program Files\update2.exe
2007-03-09 20:26:55         0 d-------- C:\Program Files\Common Files\Adobe
2007-03-09 14:34:09         0 dr-h----- C:\Documents and Settings\MATEUSZ\Dane aplikacji\SecuROM
2007-03-08 17:38:47    579072 --a------ C:\windows\system32\user32.dll
2007-03-08 17:38:47     40960 --a------ C:\windows\system32\mf3216.dll
2007-03-08 17:38:47    281600 --a------ C:\windows\system32\gdi32.dll
2007-03-08 17:37:33   1843840 --a------ C:\windows\system32\win32k.sys
2007-03-06 21:15:31         0 d-------- C:\Program Files\Opera
2007-03-02 23:22:29         0 d-------- C:\Program Files\GanymedeNet
2007-02-27 18:57:25         0 d-------- C:\Documents and Settings\MATEUSZ\Dane aplikacji\Microgaming<MICROG~1>
2007-02-12 16:14:37      1168 --a----c- C:\windows\mozver.dat
2007-02-09 19:43:09    386630 -rahs---- C:\Program Files\wunauclt.zip
2007-02-09 19:43:09    386630 -rahs---- C:\Program Files\wunauclt.tbe
2007-02-09 19:34:48    420816 --a------ C:\windows\system32\wunauclt.exe
2007-02-09 19:34:48    420816 --a------ C:\Program Files\wunauclt.exe
2007-02-05 22:19:48    185856 --a------ C:\windows\system32\upnphost.dll
2007-01-29 10:58:06     60416 --------- C:\windows\system32\tzchange.exe


-- Registry Dump ---------------------------------------------------------------


[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run]
"Gadu-Gadu"="\"C:\\Program Files\\Gadu-Gadu\\gg.exe\" /tray"
"MSMSGS"="\"C:\\Program Files\\Messenger\\msmsgs.exe\" /background"
"updateMgr"="\"C:\\Program Files\\Adobe\\Acrobat 7.0\\Reader\\AdobeUpdateManager.exe\" AcRdB7_0_7 -reboot 1"
"NBJ"="\"C:\\Program Files\\Ahead\\Nero BackItUp\\NBJ.exe\""
"Firewall auto setup"="C:\\DOCUME~1\\MATEUSZ\\USTAWI~1\\Temp\\winlogon.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run]
"SpeedTouch USB Diagnostics"="\"C:\\Program Files\\Thomson\\SpeedTouch USB\\Dragdiag.exe\" /icon"
"VirtualCloneDrive"="\"C:\\Program Files\\Elaborate Bytes\\VirtualCloneDrive\\VCDDaemon.exe\" /s"
"NWEReboot"=""
"ATIPTA"="\"C:\\Program Files\\ATI Technologies\\ATI Control Panel\\atiptaxx.exe\""
"ATICCC"="\"C:\\Program Files\\ATI Technologies\\ATI.ACE\\cli.exe\" runtime"
"TRIXX"="\"C:\\Program Files\\TRIXX\\TRIXX.exe\" -s"
"SoundMan"="SOUNDMAN.EXE"
"Anti-Blaxx Manager"="C:\\Program Files\\Anti-Blaxx\\Anti-Blaxx.exe"
"SunJavaUpdateSched"="C:\\Program Files\\Java\\jre1.5.0_09\\bin\\jusched.exe"
"DC6_check"="\"C:\\Program Files\\Common Files\\WinAntiVirus Pro 2006\\dc6_startupmon.exe\""
"ERS_check"="\"C:\\Program Files\\Common Files\\WinAntiVirus Pro 2006\\ers_startupmon.exe\""
"uvnx"="c:\\windows\\system32\\uvnx.exe"
"PrintDrive"="rundll32.exe \"C:\\windows\\system32\\ipqxwham.dll\",setvm"
"avast!"="C:\\PROGRA~1\\Alwil Software\\Avast4\\ashDisp.exe"
"SpyAway"="C:\\Program Files\\SpyAway\\spyaway.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\IMAIL]
"Installed"="1"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MAPI]
"NoChange"="1"
"Installed"="1"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MSFS]
"Installed"="1"
   

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{09129E55-4ADE-475A-B32D-B960DB0BA5E0}"=""

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"DisableTaskMgr"=dword:00000001

HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\mlljj
HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\yayywxw

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll"

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Svchost]
HTTPFilter   REG_MULTI_SZ      HTTPFilter\0\0
LocalService   REG_MULTI_SZ      Alerter\0WebClient\0LmHosts\0RemoteRegistry\0upnphost\0SSDPSRV\0\0
NetworkService   REG_MULTI_SZ      DnsCache\0\0
DcomLaunch   REG_MULTI_SZ      DcomLaunch\0TermService\0\0
rpcss   REG_MULTI_SZ      RpcSs\0\0
imgsvc   REG_MULTI_SZ      StiSvc\0\0
termsvcs   REG_MULTI_SZ      TermService\0\0


[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{979fc5eb-562f-11db-bb98-000e5024e946}]
Shell\AutoRun\command   H:\Autorun.exe


-- End of ComboScan: finished at 2007-04-27 at 13:00:43 ------------------------

Kod: Zaznacz wszystko

ComboScan v20070306.20 run by MATEUSZ on 2007-04-27 at 12:57:29
Supplementary logfile - please post this as an attachment with your post.
--------------------------------------------------------------------------------

-- System Information ----------------------------------------------------------

Microsoft Windows XP Professional (build 2600) SP 2.0
Architecture: X86; Language: Polish

CPU 0: Intel(R) Pentium(R) 4 CPU 3.06GHz
CPU 1: Intel(R) Pentium(R) 4 CPU 3.06GHz
Percentage of Memory in Use: 39%
Physical Memory (total/avail): 1023.36 MiB / 616.48 MiB
Pagefile Memory (total/avail): 2461.44 MiB / 2076.57 MiB
Virtual Memory (total/avail): 2047.88 MiB / 1994.76 MiB

A: is Removable (Unformatted)
C: is Fixed (NTFS) - 39.06 GiB total, 31.09 GiB free.
D: is Fixed (NTFS) - 58.59 GiB total, 52.4 GiB free.
E: is Fixed (NTFS) - 48.83 GiB total, 37.2 GiB free.
F: is Fixed (NTFS) - 39.82 GiB total, 36.78 GiB free.
G: is CDROM (No Media)
H: is CDROM (UDF)


-- Security Center -------------------------------------------------------------

AUOptions is scheduled to auto-install.
Windows Internal Firewall is enabled.


-- Environment Variables -------------------------------------------------------

ALLUSERSPROFILE=C:\Documents and Settings\All Users
APPDATA=C:\Documents and Settings\MATEUSZ\Dane aplikacji
CLIENTNAME=Console
CommonProgramFiles=C:\Program Files\Common Files
COMPUTERNAME=PC-D5738A182C7F
ComSpec=C:\windows\system32\cmd.exe
FP_NO_HOST_CHECK=NO
HOMEDRIVE=C:
HOMEPATH=\Documents and Settings\MATEUSZ
LOGONSERVER=\\PC-D5738A182C7F
NewEnvironment1=C:\Program Files\ATI Technologies\ATI.ACE\
NUMBER_OF_PROCESSORS=2
OS=Windows_NT
Path=C:\windows\SYSTEM32;C:\windows;C:\windows\SYSTEM32\WBEM;C:\PROGRAM FILES\ATI TECHNOLOGIES\ATI CONTROL PANEL
PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
PROCESSOR_ARCHITECTURE=x86
PROCESSOR_IDENTIFIER=x86 Family 15 Model 4 Stepping 9, GenuineIntel
PROCESSOR_LEVEL=15
PROCESSOR_REVISION=0409
ProgramFiles=C:\Program Files
PROMPT=$P$G
SESSIONNAME=Console
SystemDrive=C:
SystemRoot=C:\windows
TEMP=C:\DOCUME~1\MATEUSZ\USTAWI~1\Temp
TMP=C:\DOCUME~1\MATEUSZ\USTAWI~1\Temp
USERDOMAIN=PC-D5738A182C7F
USERNAME=MATEUSZ
USERPROFILE=C:\Documents and Settings\MATEUSZ
windir=C:\windows


-- User Profiles ---------------------------------------------------------------

MATEUSZ [I](admin)[/I]


-- Add/Remove Programs ---------------------------------------------------------

--> C:\Program Files\Ahead\nero\uninstall\UNNERO.exe /UNINSTALL
--> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\10\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{4E7DC12A-3597-4A94-9429-F6C6987361B1}\setup.exe" -l0x9  /removeonly -removeonly
--> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\10\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{7DADB304-AF20-48C3-A780-4B4133A08817}\setup.exe" -l0x9  /removeonly -removeonly
--> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\10\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{9C423CF6-2DAA-4A37-94B8-59D7ECC7DB13}\setup.exe" -l0x9  /removeonly -removeonly
--> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\10\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{FA6CC4B4-7741-4F8D-8E81-15C4BAB9869B}\setup.exe" -l0x9  /removeonly -removeonly
--> rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf
Adobe Reader 7.0.7 --> MsiExec.exe /I{AC76BA86-7AD7-1033-7B44-A70000000000}
Aktualizacja dla systemu Windows XP (KB894391) --> "C:\WINDOWS\$NtUninstallKB894391$\spuninst\spuninst.exe"
Aktualizacja dla systemu Windows XP (KB898461) --> "C:\WINDOWS\$NtUninstallKB898461$\spuninst\spuninst.exe"
Aktualizacja dla systemu Windows XP (KB900485) --> "C:\WINDOWS\$NtUninstallKB900485$\spuninst\spuninst.exe"
Aktualizacja dla systemu Windows XP (KB908531) --> "C:\WINDOWS\$NtUninstallKB908531$\spuninst\spuninst.exe"
Aktualizacja dla systemu Windows XP (KB910437) --> "C:\WINDOWS\$NtUninstallKB910437$\spuninst\spuninst.exe"
Aktualizacja dla systemu Windows XP (KB911280) --> "C:\WINDOWS\$NtUninstallKB911280$\spuninst\spuninst.exe"
Aktualizacja dla systemu Windows XP (KB916595) --> "C:\WINDOWS\$NtUninstallKB916595$\spuninst\spuninst.exe"
Aktualizacja dla systemu Windows XP (KB920872) --> "C:\WINDOWS\$NtUninstallKB920872$\spuninst\spuninst.exe"
Aktualizacja dla systemu Windows XP (KB922582) --> "C:\WINDOWS\$NtUninstallKB922582$\spuninst\spuninst.exe"
Aktualizacja dla systemu Windows XP (KB929338) --> "C:\windows\$NtUninstallKB929338$\spuninst\spuninst.exe"
Aktualizacja dla systemu Windows XP (KB931836) --> "C:\WINDOWS\$NtUninstallKB931836$\spuninst\spuninst.exe"
Aktualizacja zabezpieczeń dla systemu Windows XP (KB890046) --> "C:\WINDOWS\$NtUninstallKB890046$\spuninst\spuninst.exe"
Aktualizacja zabezpieczeń dla systemu Windows XP (KB893756) --> "C:\WINDOWS\$NtUninstallKB893756$\spuninst\spuninst.exe"
Aktualizacja zabezpieczeń dla systemu Windows XP (KB896358) --> "C:\WINDOWS\$NtUninstallKB896358$\spuninst\spuninst.exe"
Aktualizacja zabezpieczeń dla systemu Windows XP (KB896423) --> "C:\WINDOWS\$NtUninstallKB896423$\spuninst\spuninst.exe"
Aktualizacja zabezpieczeń dla systemu Windows XP (KB896424) --> "C:\WINDOWS\$NtUninstallKB896424$\spuninst\spuninst.exe"
Aktualizacja zabezpieczeń dla systemu Windows XP (KB896428) --> "C:\WINDOWS\$NtUninstallKB896428$\spuninst\spuninst.exe"
Aktualizacja zabezpieczeń dla systemu Windows XP (KB899587) --> "C:\WINDOWS\$NtUninstallKB899587$\spuninst\spuninst.exe"
Aktualizacja zabezpieczeń dla systemu Windows XP (KB899589) --> "C:\WINDOWS\$NtUninstallKB899589$\spuninst\spuninst.exe"
Aktualizacja zabezpieczeń dla systemu Windows XP (KB899591) --> "C:\WINDOWS\$NtUninstallKB899591$\spuninst\spuninst.exe"
Aktualizacja zabezpieczeń dla systemu Windows XP (KB900725) --> "C:\WINDOWS\$NtUninstallKB900725$\spuninst\spuninst.exe"
Aktualizacja zabezpieczeń dla systemu Windows XP (KB901017) --> "C:\WINDOWS\$NtUninstallKB901017$\spuninst\spuninst.exe"
Aktualizacja zabezpieczeń dla systemu Windows XP (KB901214) --> "C:\WINDOWS\$NtUninstallKB901214$\spuninst\spuninst.exe"
Aktualizacja zabezpieczeń dla systemu Windows XP (KB902400) --> "C:\WINDOWS\$NtUninstallKB902400$\spuninst\spuninst.exe"
Aktualizacja zabezpieczeń dla systemu Windows XP (KB904706) --> "C:\WINDOWS\$NtUninstallKB904706$\spuninst\spuninst.exe"
Aktualizacja zabezpieczeń dla systemu Windows XP (KB905414) --> "C:\WINDOWS\$NtUninstallKB905414$\spuninst\spuninst.exe"
Aktualizacja zabezpieczeń dla systemu Windows XP (KB905749) --> "C:\WINDOWS\$NtUninstallKB905749$\spuninst\spuninst.exe"
Aktualizacja zabezpieczeń dla systemu Windows XP (KB908519) --> "C:\WINDOWS\$NtUninstallKB908519$\spuninst\spuninst.exe"
Aktualizacja zabezpieczeń dla systemu Windows XP (KB911562) --> "C:\WINDOWS\$NtUninstallKB911562$\spuninst\spuninst.exe"
Aktualizacja zabezpieczeń dla systemu Windows XP (KB911567) --> "C:\WINDOWS\$NtUninstallKB911567$\spuninst\spuninst.exe"
Aktualizacja zabezpieczeń dla systemu Windows XP (KB911927) --> "C:\WINDOWS\$NtUninstallKB911927$\spuninst\spuninst.exe"
Aktualizacja zabezpieczeń dla systemu Windows XP (KB912919) --> "C:\WINDOWS\$NtUninstallKB912919$\spuninst\spuninst.exe"
Aktualizacja zabezpieczeń dla systemu Windows XP (KB913433) --> C:\WINDOWS\system32\MacroMed\Flash\genuinst.exe C:\WINDOWS\system32\MacroMed\Flash\KB913433.inf
Aktualizacja zabezpieczeń dla systemu Windows XP (KB913580) --> "C:\WINDOWS\$NtUninstallKB913580$\spuninst\spuninst.exe"
Aktualizacja zabezpieczeń dla systemu Windows XP (KB914388) --> "C:\WINDOWS\$NtUninstallKB914388$\spuninst\spuninst.exe"
Aktualizacja zabezpieczeń dla systemu Windows XP (KB914389) --> "C:\WINDOWS\$NtUninstallKB914389$\spuninst\spuninst.exe"
Aktualizacja zabezpieczeń dla systemu Windows XP (KB917159) --> "C:\WINDOWS\$NtUninstallKB917159$\spuninst\spuninst.exe"
Aktualizacja zabezpieczeń dla systemu Windows XP (KB917344) --> "C:\WINDOWS\$NtUninstallKB917344$\spuninst\spuninst.exe"
Aktualizacja zabezpieczeń dla systemu Windows XP (KB917422) --> "C:\WINDOWS\$NtUninstallKB917422$\spuninst\spuninst.exe"
Aktualizacja zabezpieczeń dla systemu Windows XP (KB917953) --> "C:\WINDOWS\$NtUninstallKB917953$\spuninst\spuninst.exe"
Aktualizacja zabezpieczeń dla systemu Windows XP (KB918118) --> "C:\WINDOWS\$NtUninstallKB918118$\spuninst\spuninst.exe"
Aktualizacja zabezpieczeń dla systemu Windows XP (KB918439) --> "C:\WINDOWS\$NtUninstallKB918439$\spuninst\spuninst.exe"
Aktualizacja zabezpieczeń dla systemu Windows XP (KB918899) --> "C:\WINDOWS\$NtUninstallKB918899$\spuninst\spuninst.exe"
Aktualizacja zabezpieczeń dla systemu Windows XP (KB919007) --> "C:\WINDOWS\$NtUninstallKB919007$\spuninst\spuninst.exe"
Aktualizacja zabezpieczeń dla systemu Windows XP (KB920213) --> "C:\WINDOWS\$NtUninstallKB920213$\spuninst\spuninst.exe"
Aktualizacja zabezpieczeń dla systemu Windows XP (KB920214) --> "C:\WINDOWS\$NtUninstallKB920214$\spuninst\spuninst.exe"
Aktualizacja zabezpieczeń dla systemu Windows XP (KB920670) --> "C:\WINDOWS\$NtUninstallKB920670$\spuninst\spuninst.exe"
Aktualizacja zabezpieczeń dla systemu Windows XP (KB920683) --> "C:\WINDOWS\$NtUninstallKB920683$\spuninst\spuninst.exe"
Aktualizacja zabezpieczeń dla systemu Windows XP (KB920685) --> "C:\WINDOWS\$NtUninstallKB920685$\spuninst\spuninst.exe"
Aktualizacja zabezpieczeń dla systemu Windows XP (KB921398) --> "C:\WINDOWS\$NtUninstallKB921398$\spuninst\spuninst.exe"
Aktualizacja zabezpieczeń dla systemu Windows XP (KB921883) --> "C:\WINDOWS\$NtUninstallKB921883$\spuninst\spuninst.exe"
Aktualizacja zabezpieczeń dla systemu Windows XP (KB922616) --> "C:\WINDOWS\$NtUninstallKB922616$\spuninst\spuninst.exe"
Aktualizacja zabezpieczeń dla systemu Windows XP (KB922760) --> "C:\WINDOWS\$NtUninstallKB922760$\spuninst\spuninst.exe"
Aktualizacja zabezpieczeń dla systemu Windows XP (KB922819) --> "C:\WINDOWS\$NtUninstallKB922819$\spuninst\spuninst.exe"
Aktualizacja zabezpieczeń dla systemu Windows XP (KB923191) --> "C:\WINDOWS\$NtUninstallKB923191$\spuninst\spuninst.exe"
Aktualizacja zabezpieczeń dla systemu Windows XP (KB923414) --> "C:\WINDOWS\$NtUninstallKB923414$\spuninst\spuninst.exe"
Aktualizacja zabezpieczeń dla systemu Windows XP (KB923694) --> "C:\WINDOWS\$NtUninstallKB923694$\spuninst\spuninst.exe"
Aktualizacja zabezpieczeń dla systemu Windows XP (KB923980) --> "C:\WINDOWS\$NtUninstallKB923980$\spuninst\spuninst.exe"
Aktualizacja zabezpieczeń dla systemu Windows XP (KB924191) --> "C:\WINDOWS\$NtUninstallKB924191$\spuninst\spuninst.exe"
Aktualizacja zabezpieczeń dla systemu Windows XP (KB924270) --> "C:\WINDOWS\$NtUninstallKB924270$\spuninst\spuninst.exe"
Aktualizacja zabezpieczeń dla systemu Windows XP (KB924496) --> "C:\WINDOWS\$NtUninstallKB924496$\spuninst\spuninst.exe"
Aktualizacja zabezpieczeń dla systemu Windows XP (KB924667) --> "C:\WINDOWS\$NtUninstallKB924667$\spuninst\spuninst.exe"
Aktualizacja zabezpieczeń dla systemu Windows XP (KB925454) --> "C:\WINDOWS\$NtUninstallKB925454$\spuninst\spuninst.exe"
Aktualizacja zabezpieczeń dla systemu Windows XP (KB925486) --> "C:\WINDOWS\$NtUninstallKB925486$\spuninst\spuninst.exe"
Aktualizacja zabezpieczeń dla systemu Windows XP (KB925902) --> "C:\windows\$NtUninstallKB925902$\spuninst\spuninst.exe"
Aktualizacja zabezpieczeń dla systemu Windows XP (KB926255) --> "C:\WINDOWS\$NtUninstallKB926255$\spuninst\spuninst.exe"
Aktualizacja zabezpieczeń dla systemu Windows XP (KB926436) --> "C:\WINDOWS\$NtUninstallKB926436$\spuninst\spuninst.exe"
Aktualizacja zabezpieczeń dla systemu Windows XP (KB927779) --> "C:\WINDOWS\$NtUninstallKB927779$\spuninst\spuninst.exe"
Aktualizacja zabezpieczeń dla systemu Windows XP (KB927802) --> "C:\WINDOWS\$NtUninstallKB927802$\spuninst\spuninst.exe"
Aktualizacja zabezpieczeń dla systemu Windows XP (KB928090) --> "C:\WINDOWS\$NtUninstallKB928090$\spuninst\spuninst.exe"
Aktualizacja zabezpieczeń dla systemu Windows XP (KB928255) --> "C:\WINDOWS\$NtUninstallKB928255$\spuninst\spuninst.exe"
Aktualizacja zabezpieczeń dla systemu Windows XP (KB928843) --> "C:\WINDOWS\$NtUninstallKB928843$\spuninst\spuninst.exe"
Aktualizacja zabezpieczeń dla systemu Windows XP (KB929969) --> "C:\WINDOWS\$NtUninstallKB929969$\spuninst\spuninst.exe"
Aktualizacja zabezpieczeń dla systemu Windows XP (KB930178) --> "C:\windows\$NtUninstallKB930178$\spuninst\spuninst.exe"
Aktualizacja zabezpieczeń dla systemu Windows XP (KB931261) --> "C:\windows\$NtUninstallKB931261$\spuninst\spuninst.exe"
Aktualizacja zabezpieczeń dla systemu Windows XP (KB931784) --> "C:\windows\$NtUninstallKB931784$\spuninst\spuninst.exe"
Aktualizacja zabezpieczeń dla systemu Windows XP (KB932168) --> "C:\windows\$NtUninstallKB932168$\spuninst\spuninst.exe"
Aktualizacja zabezpieczeń dla Windows XP (KB923689) --> "C:\WINDOWS\$NtUninstallKB923689$\spuninst\spuninst.exe"
Anti-Blaxx 1.17 --> "C:\Program Files\Anti-Blaxx\unins000.exe"
Archiwizator WinRAR --> C:\Program Files\WinRAR\uninstall.exe
Ashampoo Burning Studio 5 --> "e:\Program Files\Ashampoo\Ashampoo Burning Studio 5\Uninstall\BS5_Uninstall.EXE"
ATI Catalyst Control Center --> MsiExec.exe /I{86EC42B5-346E-4BAB-948D-58E021EA4BD1}
ATI Display Driver --> rundll32 C:\WINDOWS\system32\atiiiexx.dll,_InfEngUnInstallINFFile_RunDLL@16 -force_restart -flags:0x2010001 -inf_class:DISPLAY -clean
ATI HYDRAVISION --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{083F79E4-6FE9-46FB-A6C6-4F8862742947}\setup.exe"
avast! Antivirus --> rundll32 C:\PROGRA~1\Alwil Software\Avast4\Setup\setiface.dll,RunSetup
Companion wizard --> C:\Program Files\Common Files\Companion Wizard\compwiz.exe -u
DirectShow Pack (remove only) --> "C:\Program Files\DirectShow Pack\uninst-dshowpack.exe"
Double Vibration Controller 3 --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\0700\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{E22F239F-953C-4C6C-8CAC-2CE1C26CCB2D}\setup.exe" -l0x9
ffdshow (remove only) --> "C:\Program Files\ffdshow\uninstall.exe"
Gadu-Gadu 7.6 --> C:\Program Files\Gadu-Gadu\Setup.exe
HijackThis 1.99.1 --> C:\DOCUME~1\MATEUSZ\USTAWI~1\Temp\Rar$EX00.422\HijackThis.exe /uninstall
ICeQ --> "C:\Program Files\Ikari's Chat Qlient\unins000.exe"
J2SE Runtime Environment 5.0 Update 9 --> MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0150090}
K-Lite Mega Codec Pack 1.58 --> "D:\Program Files\K-Lite Codec Pack\unins001.exe"
Microsoft Office 2000 Premium --> MsiExec.exe /I{00000415-78E1-11D2-B60F-006097C998E7}
mIRC --> "C:\Program Files\mIRC\mirc.exe" -uninstall
Mozilla Firefox (2.0.0.3) --> C:\Program Files\Mozilla Firefox\uninstall\helper.exe
Narzędzie Software Uninstall Utility firmy ATI --> C:\Program Files\ATI Technologies\UninstallAll\AtiCimUn.exe
Need for Speed™ Carbon --> E:\Program Files\Electronic Arts\Need for Speed Carbon\EAUninstall.exe
Nero Suite --> C:\Program Files\Common Files\Nero\Uninstall\Setupx.exe /uninstall ExtraUninstallID=""
Opera 9.01 --> MsiExec.exe /X{0049F6AE-4FE2-4C43-A039-60FCE98A1986}
Outerinfo --> "C:\Program Files\Common Files\Yazzle1667OinUninstaller.exe"
Panel sterowania ATI --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{0BEDBD4E-2D34-47B5-9973-57E62B29307C}\setup.exe"
Poprawka systemu Windows XP - KB873339 --> C:\WINDOWS\$NtUninstallKB873339$\spuninst\spuninst.exe
Poprawka systemu Windows XP - KB885835 --> C:\WINDOWS\$NtUninstallKB885835$\spuninst\spuninst.exe
Poprawka systemu Windows XP - KB885836 --> C:\WINDOWS\$NtUninstallKB885836$\spuninst\spuninst.exe
Poprawka systemu Windows XP - KB886185 --> C:\WINDOWS\$NtUninstallKB886185$\spuninst\spuninst.exe
Poprawka systemu Windows XP - KB887472 --> C:\WINDOWS\$NtUninstallKB887472$\spuninst\spuninst.exe
Poprawka systemu Windows XP - KB888302 --> C:\WINDOWS\$NtUninstallKB888302$\spuninst\spuninst.exe
Poprawka systemu Windows XP - KB890859 --> "C:\WINDOWS\$NtUninstallKB890859$\spuninst\spuninst.exe"
Poprawka systemu Windows XP - KB891781 --> C:\WINDOWS\$NtUninstallKB891781$\spuninst\spuninst.exe
Realtek AC'97 Audio --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{FB08F381-6533-4108-B7DD-039E11FBC27E}\setup.exe" -l0x15  -removeonly
Sapphire TRIXX --> "C:\Program Files\TRIXX\Uninstall.exe"
Sony Picture Utility --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\10\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{D5068583-D569-468B-9755-5FBF5848F46F}\setup.exe" -l0x9  /removeonly uninstall -removeonly
Sony USB Driver --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{5C29CB8B-AC1E-4114-8D68-9CD080140D4A}\Setup.exe" UNINSTALL
SpeedTouch USB Software --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{D41FAAA9-8048-4906-86B2-9AADEA1FA0B7}\Setup.exe"  /l0009 -Control_Panel
SpyAway 1.01.0007 --> "C:\Program Files\SpyAway\uninstall.exe" -u
Testy gimnazjalne Mat-przyrodnicze (wersja demonstracyjna) --> C:\Program Files\AidemMedia\Demo\TestMatprzy\SXUNINST.EXE
VirtualCloneDrive --> "C:\Program Files\Elaborate Bytes\VirtualCloneDrive\vcd-uninst.exe" /D="C:\Program Files\Elaborate Bytes\VirtualCloneDrive"
Winamp (remove only) --> "C:\Program Files\Winamp\UninstWA.exe"


-- End of ComboScan: finished at 2007-04-27 at 13:00:43 ------------------------


[ Dodano: Dzisiaj o 13:45 ]
LOG Z SILLENT RUNNERS MUSIALEM PODZIELIC NA 3 CZESCI GDYZ BYL ZA DLUGI:

1 CZESC

Kod: Zaznacz wszystko

"Silent Runners.vbs", revision R50, http://www.silentrunners.org/
Operating System: Windows XP SP2
Output limited to non-default values, except where indicated by "{++}"


Startup items buried in registry:
---------------------------------

HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ {++}
"Gadu-Gadu" = ""C:\Program Files\Gadu-Gadu\gg.exe" /tray" ["Gadu-Gadu S.A."]
"MSMSGS" = ""C:\Program Files\Messenger\msmsgs.exe" /background" [MS]
"updateMgr" = ""C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_7 -reboot 1" ["Adobe Systems Incorporated"]
"NBJ" = ""C:\Program Files\Ahead\Nero BackItUp\NBJ.exe"" ["Ahead Software AG"]
"Firewall auto setup" = "C:\DOCUME~1\MATEUSZ\USTAWI~1\Temp\winlogon.exe" [file not found]

HKLM\Software\Microsoft\Windows\CurrentVersion\Run\ {++}
"SpeedTouch USB Diagnostics" = ""C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon" ["THOMSON Telecom Belgium"]
"VirtualCloneDrive" = ""C:\Program Files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe" /s" ["Elaborate Bytes AG"]
"NWEReboot" = "(empty string)" [file not found]
"ATIPTA" = ""C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"" ["ATI Technologies, Inc."]
"ATICCC" = ""C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime" [null data]
"TRIXX" = ""C:\Program Files\TRIXX\TRIXX.exe" -s" ["Sapphire Technologies"]
"SoundMan" = "SOUNDMAN.EXE" ["Realtek Semiconductor Corp."]
"Anti-Blaxx Manager" = "C:\Program Files\Anti-Blaxx\Anti-Blaxx.exe" [file not found]
"SunJavaUpdateSched" = "C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe" ["Sun Microsystems, Inc."]
"DC6_check" = ""C:\Program Files\Common Files\WinAntiVirus Pro 2006\dc6_startupmon.exe"" [file not found]
"ERS_check" = ""C:\Program Files\Common Files\WinAntiVirus Pro 2006\ers_startupmon.exe"" [file not found]
"uvnx" = "c:\windows\system32\uvnx.exe" ["Microcoft Corporation"]
"PrintDrive" = "rundll32.exe "C:\windows\system32\ipqxwham.dll",setvm" [MS]
"avast!" = "C:\PROGRA~1\Alwil Software\Avast4\ashDisp.exe" ["ALWIL Software"]
"SpyAway" = "C:\Program Files\SpyAway\spyaway.exe" ["SpyAway Inc."]

HKLM\Software\Microsoft\Active Setup\Installed Components\
{Y479C6D0-OTRW-U5GH-S1EE-E02310B4E666}\(Default) = (no title provided)
                                       \StubPath   = "C:\windows\system32\tmrsrv32.exe" ["Microsoft"]

HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\
{09129E55-4ADE-475A-B32D-B960DB0BA5E0}\(Default) = (no title provided)
  -> {HKLM...CLSID} = (no title provided)
                   \InProcServer32\(Default) = "C:\windows\system32\yayywxw.dll" [null data]
{1557B435-8242-4686-9AA3-9265BF7525A4}\(Default) = (no title provided)
  -> {HKLM...CLSID} = (no title provided)
                   \InProcServer32\(Default) = "C:\windows\system32\gvqkggbb.dll" [null data]
{3DB596F2-7605-49A4-81CB-3A0976765D97}\(Default) = (no title provided)
  -> {HKLM...CLSID} = (no title provided)
                   \InProcServer32\(Default) = "C:\windows\system32\qnpwkkrk.dll" [null data]
{43E2FE1D-17D4-287F-A33D-6AE3379AAA97}\(Default) = (no title provided)
  -> {HKLM...CLSID} = (no title provided)
                   \InProcServer32\(Default) = "C:\windows\system32\sfcvzzfr.dll" [file not found]
{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\(Default) = (no title provided)
  -> {HKLM...CLSID} = "SSVHelper Class"
                   \InProcServer32\(Default) = "C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll" ["Sun Microsystems, Inc."]
{888826A1-3C63-4687-8696-482FDBB129DF}\(Default) = (no title provided)
  -> {HKLM...CLSID} = "Hgni_BHO"
                   \InProcServer32\(Default) = "C:\windows\system32\hgni_ecol.dll" [null data]
{AB5B926A-1E0F-454E-8F57-9523B933C5AB}\(Default) = (no title provided)
  -> {HKLM...CLSID} = (no title provided)
                   \InProcServer32\(Default) = "C:\windows\system32\mlljj.dll" [null data]
{EEFBE5D6-FEFF-4CB4-AA26-6A464090CB89}\(Default) = (no title provided)
  -> {HKLM...CLSID} = "msnhlp32.msn_hlp"
                   \InProcServer32\(Default) = "C:\windows\system32\msnhlp32.dll" ["Microsoft"]

HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\
"{42071714-76d4-11d1-8b24-00a0c9068ff3}" = "Rozszerzenie CPL kadrowania wyświetlania"
  -> {HKLM...CLSID} = "Rozszerzenie CPL kadrowania wyświetlania"
                   \InProcServer32\(Default) = "deskpan.dll" [file not found]
"{88895560-9AA2-1069-930E-00AA0030EBC8}" = "Rozszerzenie ikony HyperTerminalu"
  -> {HKLM...CLSID} = "HyperTerminal Icon Ext"
                   \InProcServer32\(Default) = "C:\WINDOWS\system32\hticons.dll" ["Hilgraeve, Inc."]
"{0006F045-0000-0000-C000-000000000046}" = "Microsoft Outlook Custom Icon Handler"
  -> {HKLM...CLSID} = "Rozszerzenie ikon plików programu Outlook"
                   \InProcServer32\(Default) = "C:\PROGRA~1\Microsoft Office\Office\OLKFSTUB.DLL" [MS]
"{B7056B8E-4F99-44f8-8CBD-282390FE5428}" = "VirtualCloneDrive"
  -> {HKLM...CLSID} = "VirtualCloneDrive Shell Extension"
                   \InProcServer32\(Default) = "C:\Program Files\Elaborate Bytes\VirtualCloneDrive\ElbyVCDShell.dll" ["Elaborate Bytes AG"]
"{EB47FF00-225E-11D2-9E1D-00A0C9AB0EEE}" = "eLicense Control"
  -> {HKLM...CLSID} = "eLicense Control"
                   \InProcServer32\(Default) = "C:\WINDOWS\lcmmfu.cpl" [null data]
"{cc86590a-b60a-48e6-996b-41d25ed39a1e}" = "Portable Media Devices Menu"
  -> {HKLM...CLSID} = "Portable Media Devices Menu"
                   \InProcServer32\(Default) = "C:\windows\system32\Audiodev.dll" [MS]
"{5E2121EE-0300-11D4-8D3B-444553540000}" = "Catalyst Context Menu extension"
  -> {HKLM...CLSID} = "SimpleShlExt Class"
                   \InProcServer32\(Default) = "C:\Program Files\ATI Technologies\ATI.ACE\atiacmxx.dll" [empty string]
"{B41DB860-8EE4-11D2-9906-E49FADC173CA}" = "WinRAR shell extension"
  -> {HKLM...CLSID} = "WinRAR"
                   \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]
"{472083B0-C522-11CF-8763-00608CC02F24}" = "avast"
  -> {HKLM...CLSID} = "avast"
                   \InProcServer32\(Default) = "C:\Program Files\Alwil Software\Avast4\ashShell.dll" ["ALWIL Software"]

HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\
<<!>> "{09129E55-4ADE-475A-B32D-B960DB0BA5E0}" = "*g" (unwritable string)
  -> {HKLM...CLSID} = (no title provided)
                   \InProcServer32\(Default) = "C:\windows\system32\yayywxw.dll" [null data]

wiecej czesci nie moge dac bo by post byl za dlugi a nowego nie da rady napisac

[prog]

Jest źle.

Zastosuj po kilka razy w trybie awaryjnym te o to automaty:
=> http://www.atribune.org/ccount/click.php?id=4
=> http://securityresponse.symantec.com/avcenter/FixVundo.exe
=> http://secured2k.home.comcast.net/tools/VirtumundoBeGone.exe
=> http://noahdfear.geekstogo.com/


Potem nowe logi: comboscan + silentrunners.

[ostry99]

Kod: Zaznacz wszystko

ComboScan v20070306.20 run by MATEUSZ on 2007-04-27 at 19:12:23
Computer is in Normal Mode.
--------------------------------------------------------------------------------



-- HijackThis (run as MATEUSZ.exe) ---------------------------------------------

Logfile of HijackThis v1.99.1
Scan saved at 19:12:24, on 2007-04-27
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\windows\System32\smss.exe
C:\windows\SYSTEM32\winlogon.exe
C:\windows\system32\services.exe
C:\windows\system32\lsass.exe
C:\windows\system32\Ati2evxx.exe
C:\windows\system32\svchost.exe
C:\windows\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\windows\system32\spoolsv.exe
C:\WINDOWS\runservice.exe
C:\WINDOWS\system32\UAService7.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\windows\SYSTEM32\Ati2evxx.exe
C:\windows\system32\WgaTray.exe
C:\windows\Explorer.EXE
C:\windows\system32\tmrsrv32.exe
C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe
C:\Program Files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\TRIXX\TRIXX.exe
C:\windows\SOUNDMAN.EXE
C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe
C:\windows\system32\uvnx.exe
C:\PROGRA~1\Alwil Software\Avast4\ashDisp.exe
C:\Program Files\Gadu-Gadu\gg.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe
C:\Program Files\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe
C:\Program Files\Ikari's Chat Qlient\Chat.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\MATEUSZ\Pulpit\comboscan.exe
C:\PROGRA~1\HIJACK~1\MATEUSZ.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O2 - BHO: (no name) - {00000026-8735-428D-B81F-DD098223B25F} - (no file)
O2 - BHO: (no name) - {00000250-0320-4dd4-be4f-7566d2314352} - (no file)
O2 - BHO: (no name) - {000006b1-19b5-414a-849f-2a3c64ae6939} - (no file)
O2 - BHO: (no name) - {06dfedaa-6196-11d5-bfc8-00508b4a487d} - (no file)
O2 - BHO: (no name) - {09129E55-4ADE-475A-B32D-B960DB0BA5E0} - C:\windows\system32\yayywxw.dll (file missing)
O2 - BHO: (no name) - {13197ace-6851-45c3-a7ff-c281324d5489} - (no file)
O2 - BHO: (no name) - {1557B435-8242-4686-9AA3-9265BF7525A4} - C:\windows\system32\gvqkggbb.dll
O2 - BHO: (no name) - {30000273-8230-4dd4-be4f-6889d1e74167} - (no file)
O2 - BHO: (no name) - {3DB596F2-7605-49A4-81CB-3A0976765D97} - C:\windows\system32\qnpwkkrk.dll
O2 - BHO: (no name) - {43E2FE1D-17D4-287F-A33D-6AE3379AAA97} - C:\windows\system32\sfcvzzfr.dll (file missing)
O2 - BHO: (no name) - {4e1075f4-eec4-4a86-add7-cd5f52858c31} - (no file)
O2 - BHO: (no name) - {4e7bd74f-2b8d-469e-92c6-ce7eb590a94d} - (no file)
O2 - BHO: (no name) - {53C330D6-A4AB-419B-B45D-FD4411C1FEF4} - (no file)
O2 - BHO: (no name) - {5929cd6e-2062-44a4-b2c5-2c7e78fbab38} - (no file)
O2 - BHO: (no name) - {5dafd089-24b1-4c5e-bd42-8ca72550717b} - (no file)
O2 - BHO: (no name) - {5fa6752a-c4a0-4222-88c2-928ae5ab4966} - (no file)
O2 - BHO: (no name) - {669695bc-a811-4a9d-8cdf-ba8c795f261e} - (no file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O2 - BHO: (no name) - {8674aea0-9d3d-11d9-99dc-00600f9a01f1} - (no file)
O2 - BHO: Hgni_BHO - {888826A1-3C63-4687-8696-482FDBB129DF} - C:\windows\system32\hgni_ecol.dll
O2 - BHO: (no name) - {93E7BB29-6F92-45F1-936F-FC19FB25E488} - C:\windows\system32\mlljj.dll (file missing)
O2 - BHO: (no name) - {965a592f-8efa-4250-8630-7960230792f1} - (no file)
O2 - BHO: (no name) - {b8875bfe-b021-11d4-bfa8-00508b8e9bd3} - (no file)
O2 - BHO: (no name) - {bb936323-19fa-4521-ba29-eca6a121bc78} - (no file)
O2 - BHO: (no name) - {ca1d1b05-9c66-11d5-a009-000103c1e50b} - (no file)
O2 - BHO: (no name) - {cf021f40-3e14-23a5-cba2-717765728274} - (no file)
O2 - BHO: msnhlp32.msn_hlp - {EEFBE5D6-FEFF-4CB4-AA26-6A464090CB89} - C:\windows\system32\msnhlp32.dll
O2 - BHO: (no name) - {fc3a74e5-f281-4f10-ae1e-733078684f3c} - (no file)
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon
O4 - HKLM\..\Run: [VirtualCloneDrive] "C:\Program Files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe" /s
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime
O4 - HKLM\..\Run: [TRIXX] "C:\Program Files\TRIXX\TRIXX.exe" -s
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [Anti-Blaxx Manager] C:\Program Files\Anti-Blaxx\Anti-Blaxx.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe
O4 - HKLM\..\Run: [DC6_check] "C:\Program Files\Common Files\WinAntiVirus Pro 2006\dc6_startupmon.exe"
O4 - HKLM\..\Run: [ERS_check] "C:\Program Files\Common Files\WinAntiVirus Pro 2006\ers_startupmon.exe"
O4 - HKLM\..\Run: [uvnx] c:\windows\system32\uvnx.exe
O4 - HKLM\..\Run: [PrintDrive] rundll32.exe "C:\windows\system32\ipqxwham.dll",setvm
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\Alwil Software\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [SpyAway] C:\Program Files\SpyAway\spyaway.exe
O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_7 -reboot 1
O4 - HKCU\..\Run: [NBJ] "C:\Program Files\Ahead\Nero BackItUp\NBJ.exe"
O4 - HKCU\..\Run: [Firewall auto setup] C:\DOCUME~1\MATEUSZ\USTAWI~1\Temp\winlogon.exe
O4 - Startup: Cyber-shot Viewer Media Check Tool.lnk = C:\Program Files\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe
O4 - Startup: Neostrada tp.lnk = ?
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: ATI CATALYST – pasek zadań.lnk = C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {83AFB5CA-ED35-11D4-A452-0080C8D85045} (GameDesire Poker Games) - http://67.15.101.3/g_bin/eng/poker_2_0_0_44.cab
O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C1} (GameDesire Pool 8) - http://67.15.101.3/g_bin/eng/billard8_2_0_0_30.cab
O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C5} (GameDesire Snooker) - http://67.15.101.3/g_bin/eng/snooker_2_0_0_31.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{96938C11-A654-435C-BADB-2452291687BD}: NameServer = 194.204.159.1 217.98.63.164
O20 - Winlogon Notify: WgaLogon - C:\windows\SYSTEM32\WgaLogon.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\windows\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: LicCtrl Service (LicCtrlService) - Unknown owner - C:\WINDOWS\runservice.exe
O23 - Service: Panda Process Protection Service (PavPrSrv) - Unknown owner - C:\Program Files\Common Files\Panda Software\PavShld\pavprsrv.exe (file missing)
O23 - Service: SecuROM User Access Service (V7) (UserAccess7) - Unknown owner - C:\WINDOWS\system32\UAService7.exe


-- Files created between 2007-03-27 and 2007-04-27 -----------------------------

2007-04-27 15:59:20     25719 --a----c- C:\smitfrau.reg
2007-04-27 15:59:20     16824 --a----c- C:\replace.cmd
2007-04-27 15:59:20      3451 --a----c- C:\delfiles.cmd
2007-04-27 15:50:13         0 d------c- C:\smitRem
2007-04-27 15:36:23         0 d------c- C:\VundoFix Backups<VUNDOF~1>
2007-04-26 19:21:40      3146 --a------ C:\windows\system32\tmp.reg
2007-04-26 19:20:43     79360 --a------ C:\windows\system32\swxcacls.exe
2007-04-26 19:20:43     40960 --a------ C:\windows\system32\swsc.exe
2007-04-26 19:20:43    135168 --a------ C:\windows\system32\swreg.exe
2007-04-26 19:20:43    288417 --a------ C:\windows\system32\SrchSTS.exe
2007-04-26 19:20:43     53248 --a------ C:\windows\system32\Process.exe
2007-04-26 19:20:43     51200 --a------ C:\windows\system32\dumphive.exe
2007-04-26 16:43:31     18432 --a------ C:\windows\sysrlb32.exe
2007-04-26 16:27:30         0 d-------- C:\Program Files\SpyAway
2007-04-26 16:10:09     26112 --a------ C:\windows\vxddsk.exe
2007-04-26 16:10:08     32512 --a------ C:\windows\wml.exe
2007-04-26 16:10:08     28160 --a------ C:\windows\system32\wml.exe
2007-04-26 16:10:08     18176 --a------ C:\windows\system32\vxddsk.exe
2007-04-26 16:10:07     27648 --a------ C:\windows\satmat.exe
2007-04-26 16:10:07     12544 --a------ C:\windows\Biprep.exe
2007-04-26 16:10:07     10752 --a------ C:\windows\bi.dll
2007-04-26 16:10:07     31744 --a------ C:\windows\7search.dll
2007-04-26 16:10:06     14080 --a------ C:\windows\stcloader.exe<STCLOA~1.EXE>
2007-04-26 16:10:06     28672 --a------ C:\windows\pbar.dll
2007-04-26 16:10:06     20224 --a------ C:\windows\flt.dll
2007-04-26 16:10:06     21248 --a------ C:\windows\764.exe
2007-04-26 16:10:05     30208 --a------ C:\windows\voiceip.dll
2007-04-26 16:10:05     18944 --a------ C:\windows\swin32.dll
2007-04-26 16:10:05     20992 --a------ C:\windows\cdsm32.dll
2007-04-26 16:10:05     20736 --a------ C:\windows\bokja.exe
2007-04-26 16:10:04      9984 --a------ C:\windows\mssvr.exe
2007-04-26 16:10:04     15104 --a------ C:\windows\mspphe.dll
2007-04-26 16:09:59     32000 --a------ C:\windows\bjam.dll
2007-04-26 16:09:57     15616 --a------ C:\windows\system32\MSIXU.DLL
2007-04-26 16:09:57     14336 --a------ C:\windows\2020search2.dll<2020SE~2.DLL>
2007-04-26 16:09:57     24832 --a------ C:\windows\2020search.dll<2020SE~1.DLL>
2007-04-26 16:09:56     12288 --a------ C:\windows\system32\WER8274.DLL
2007-04-26 16:09:56     32000 --a------ C:\windows\salm.exe
2007-04-26 16:09:56     30976 --a------ C:\windows\180ax.exe
2007-04-26 16:09:55     23552 --a------ C:\windows\updatetc.exe
2007-04-26 16:09:55     11776 --a------ C:\windows\saiemod.dll
2007-04-26 16:09:27     21504 --a------ C:\windows\system32\msnhlp32.dll
2007-04-26 16:09:16     17408 --a------ C:\windows\system32\tmrsrv32.exe
2007-04-26 16:08:08     81412 --a------ C:\windows\system32\idleserv.exe
2007-04-26 16:07:58     12800 --a------ C:\windows\system32\user_32.dll
2007-04-25 21:51:01    119296 --a------ C:\windows\system32\hgni_ecol.dll<HGNI_E~1.DLL>
2007-04-25 21:50:47    155648 --a------ C:\windows\mgrab.exe
2007-04-25 16:33:30     43176 --a------ C:\windows\system32\drivers\aswTdi.sys
2007-04-25 16:33:30     23416 --a------ C:\windows\system32\drivers\aswRdr.sys
2007-04-25 16:33:30     26888 --a------ C:\windows\system32\drivers\aavmker4.sys
2007-04-25 16:33:21     90112 --a------ C:\windows\system32\AvastSS.scr
2007-04-25 16:33:17     94552 --a------ C:\windows\system32\drivers\aswmon2.sys
2007-04-25 16:33:17     85952 --a------ C:\windows\system32\drivers\aswmon.sys
2007-04-25 16:33:06    733824 --a------ C:\windows\system32\aswBoot.exe
2007-04-23 19:00:40     83456 --a------ C:\windows\install.exe
2007-04-23 17:39:46     18432 --a------ C:\windows\ul.exe
2007-04-23 16:51:46   1040384 --a------ C:\windows\system32\libeay32.dll
2007-04-23 16:51:12    196608 --a------ C:\windows\system32\ssleay32.dll
2007-04-23 16:49:39     18432 --a------ C:\windows\system32\uvnx.exe
2007-04-23 16:49:38     18432 --a----c- C:\U.exe
2007-04-23 15:42:08         0 d-------- C:\Program Files\Common Files\Companion Wizard<COMPAN~1>
2007-04-23 15:39:57         0 d--hs--c- C:\WA6P
2007-04-23 15:39:11      8704 --a------ C:\windows\system32\SpOrder.dll
2007-04-23 15:39:04         0 d-------- C:\Program Files\WinAntiVirus Pro 2006<WINANT~1>
2007-04-23 15:39:04         0 d-------- C:\Program Files\Common Files\WinAntiVirus Pro 2006<WINANT~1>
2007-04-21 21:41:58     49204 --a------ C:\windows\system32\gvqkggbb.dll
2007-04-18 14:03:27    125460 --a------ C:\windows\system32\qnpwkkrk.dll
2007-04-09 14:01:08         2 --a------ C:\windows\system32\wnscpsv.exe
2007-04-09 14:01:06         0 d-------- C:\Program Files\Outerinfo<OUTERI~1>
2007-04-09 14:01:06         0 d-------- C:\Program Files\Common Files\?ymbols
2007-04-06 11:15:11    856064 --a------ C:\windows\system32\xvidcore.dll
2007-04-04 14:49:33         0 d--h----- C:\windows\$hf_mig$
2007-03-28 23:07:19         0 d-------- C:\Program Files\AidemMedia<AIDEMM~1>


-- Find3M Report ---------------------------------------------------------------

2007-04-27 16:04:41    484074 --a------ C:\windows\system32\perfh015.dat
2007-04-27 16:04:41     83782 --a------ C:\windows\system32\perfc015.dat
2007-04-27 16:00:30       777 --ahs---- C:\windows\system32\mmf.sys
2007-04-27 15:49:42         0 d-------- C:\Program Files\Mozilla Firefox<MOZILL~1>
2007-04-23 15:42:27       704 --a------ C:\Documents and Settings\MATEUSZ\Dane aplikacji\update.log
2007-04-23 15:39:42         0 d-------- C:\Documents and Settings\MATEUSZ\Dane aplikacji\WinAntiVirus Pro 2006<WINANT~1>
2007-04-18 16:39:27         0 d-------- C:\Program Files\Common Files\Panda Software<PANDAS~1>
2007-04-18 16:33:53         0 d-------- C:\Program Files\Skype
2007-04-18 16:20:14         0 d-------- C:\Documents and Settings\MATEUSZ\Dane aplikacji\Skype
2007-04-18 14:55:15         0 d-------- C:\Program Files\Ikari's Chat Qlient
2007-04-18 13:20:03         0 d-------- C:\Program Files\Winamp
2007-04-17 22:17:50         0 d-------- C:\Program Files\Gadu-Gadu<GADU-G~1>
2007-04-17 14:12:50         0 d-------- C:\Program Files\Messenger<MESSEN~1>
2007-04-17 14:12:48         0 d-------- C:\Program Files\TRIXX
2007-04-12 15:29:56      4000 --a----c- C:\ao.dat
2007-04-09 20:00:05    197886 --a------ C:\Program Files\update.zip
2007-04-06 11:15:45         0 d-------- C:\Program Files\K-Lite Codec Pack
2007-04-05 19:26:11         0 d-------- C:\Program Files\GameShadow
2007-04-04 22:16:36         0 d-------- C:\Program Files\mIRC
2007-03-30 08:21:20         0 d-------- C:\Documents and Settings\MATEUSZ\Dane aplikacji\uTorrent
2007-03-30 00:54:18         0 d-------- C:\Program Files\utorrent
2007-03-28 23:04:39         0 d-------- C:\Documents and Settings\MATEUSZ\Dane aplikacji\Adobe
2007-03-23 19:24:28         0 d-------- C:\Program Files\Cheating-Death
2007-03-23 19:19:07         0 d-------- C:\Program Files\vanBasco's Karaoke Player<VANBAS~1>
2007-03-23 19:07:17         0 d-------- C:\Program Files\Java
2007-03-23 19:06:44         0 d-------- C:\Program Files\eSkiMoS R2<ESKIMO~1>
2007-03-23 19:06:31         0 d-------- C:\Program Files\DivX
2007-03-23 18:53:28         0 d-------- C:\Program Files\BearShare<BEARSH~1>
2007-03-23 18:52:55         0 d-------- C:\Program Files\MarBit
2007-03-18 12:39:39         0 d--h----- C:\Program Files\InstallShield Installation Information<INSTAL~1>
2007-03-18 12:39:06         0 d-------- C:\Program Files\Deluxe Ski Jump 3
2007-03-17 15:45:36    293376 --a------ C:\windows\system32\winsrv.dll
2007-03-16 21:45:54         0 d-------- C:\Documents and Settings\MATEUSZ\Dane aplikacji\GanymedeNet<GANYME~1>
2007-03-13 17:30:08    186541 --a------ C:\Program Files\update2.exe
2007-03-09 20:26:55         0 d-------- C:\Program Files\Common Files\Adobe
2007-03-09 14:34:09         0 dr-h----- C:\Documents and Settings\MATEUSZ\Dane aplikacji\SecuROM
2007-03-08 17:38:47    579072 --a------ C:\windows\system32\user32.dll
2007-03-08 17:38:47     40960 --a------ C:\windows\system32\mf3216.dll
2007-03-08 17:38:47    281600 --a------ C:\windows\system32\gdi32.dll
2007-03-08 17:37:33   1843840 --a------ C:\windows\system32\win32k.sys
2007-03-06 21:15:31         0 d-------- C:\Program Files\Opera
2007-03-02 23:22:29         0 d-------- C:\Program Files\GanymedeNet
2007-02-27 18:57:25         0 d-------- C:\Documents and Settings\MATEUSZ\Dane aplikacji\Microgaming<MICROG~1>
2007-02-12 16:14:37      1168 --a----c- C:\windows\mozver.dat
2007-02-09 19:43:09    386630 -rahs---- C:\Program Files\wunauclt.zip
2007-02-09 19:43:09    386630 -rahs---- C:\Program Files\wunauclt.tbe
2007-02-09 19:34:48    420816 --a------ C:\windows\system32\wunauclt.exe
2007-02-09 19:34:48    420816 --a------ C:\Program Files\wunauclt.exe
2007-02-05 22:19:48    185856 --a------ C:\windows\system32\upnphost.dll
2007-01-29 10:58:06     60416 --------- C:\windows\system32\tzchange.exe


-- Registry Dump ---------------------------------------------------------------


[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run]
"Gadu-Gadu"="\"C:\\Program Files\\Gadu-Gadu\\gg.exe\" /tray"
"MSMSGS"="\"C:\\Program Files\\Messenger\\msmsgs.exe\" /background"
"updateMgr"="\"C:\\Program Files\\Adobe\\Acrobat 7.0\\Reader\\AdobeUpdateManager.exe\" AcRdB7_0_7 -reboot 1"
"NBJ"="\"C:\\Program Files\\Ahead\\Nero BackItUp\\NBJ.exe\""
"Firewall auto setup"="C:\\DOCUME~1\\MATEUSZ\\USTAWI~1\\Temp\\winlogon.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run]
"SpeedTouch USB Diagnostics"="\"C:\\Program Files\\Thomson\\SpeedTouch USB\\Dragdiag.exe\" /icon"
"VirtualCloneDrive"="\"C:\\Program Files\\Elaborate Bytes\\VirtualCloneDrive\\VCDDaemon.exe\" /s"
"NWEReboot"=""
"ATIPTA"="\"C:\\Program Files\\ATI Technologies\\ATI Control Panel\\atiptaxx.exe\""
"ATICCC"="\"C:\\Program Files\\ATI Technologies\\ATI.ACE\\cli.exe\" runtime"
"TRIXX"="\"C:\\Program Files\\TRIXX\\TRIXX.exe\" -s"
"SoundMan"="SOUNDMAN.EXE"
"Anti-Blaxx Manager"="C:\\Program Files\\Anti-Blaxx\\Anti-Blaxx.exe"
"SunJavaUpdateSched"="C:\\Program Files\\Java\\jre1.5.0_09\\bin\\jusched.exe"
"DC6_check"="\"C:\\Program Files\\Common Files\\WinAntiVirus Pro 2006\\dc6_startupmon.exe\""
"ERS_check"="\"C:\\Program Files\\Common Files\\WinAntiVirus Pro 2006\\ers_startupmon.exe\""
"uvnx"="c:\\windows\\system32\\uvnx.exe"
"PrintDrive"="rundll32.exe \"C:\\windows\\system32\\ipqxwham.dll\",setvm"
"avast!"="C:\\PROGRA~1\\Alwil Software\\Avast4\\ashDisp.exe"
"SpyAway"="C:\\Program Files\\SpyAway\\spyaway.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\IMAIL]
"Installed"="1"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MAPI]
"NoChange"="1"
"Installed"="1"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MSFS]
"Installed"="1"
   

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{09129E55-4ADE-475A-B32D-B960DB0BA5E0}"=""

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"DisableTaskMgr"=dword:00000001

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll"

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Svchost]
HTTPFilter   REG_MULTI_SZ      HTTPFilter\0\0
LocalService   REG_MULTI_SZ      Alerter\0WebClient\0LmHosts\0RemoteRegistry\0upnphost\0SSDPSRV\0\0
NetworkService   REG_MULTI_SZ      DnsCache\0\0
DcomLaunch   REG_MULTI_SZ      DcomLaunch\0TermService\0\0
rpcss   REG_MULTI_SZ      RpcSs\0\0
imgsvc   REG_MULTI_SZ      StiSvc\0\0
termsvcs   REG_MULTI_SZ      TermService\0\0


[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{979fc5eb-562f-11db-bb98-000e5024e946}]
Shell\AutoRun\command   H:\Autorun.exe


-- End of ComboScan: finished at 2007-04-27 at 19:12:45 ------------------------


Kod: Zaznacz wszystko

"Silent Runners.vbs", revision R50, http://www.silentrunners.org/
Operating System: Windows XP SP2
Output limited to non-default values, except where indicated by "{++}"


Startup items buried in registry:
---------------------------------

HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ {++}
"Gadu-Gadu" = ""C:\Program Files\Gadu-Gadu\gg.exe" /tray" ["Gadu-Gadu S.A."]
"MSMSGS" = ""C:\Program Files\Messenger\msmsgs.exe" /background" [MS]
"updateMgr" = ""C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_7 -reboot 1" ["Adobe Systems Incorporated"]
"NBJ" = ""C:\Program Files\Ahead\Nero BackItUp\NBJ.exe"" ["Ahead Software AG"]
"Firewall auto setup" = "C:\DOCUME~1\MATEUSZ\USTAWI~1\Temp\winlogon.exe" [file not found]

HKLM\Software\Microsoft\Windows\CurrentVersion\Run\ {++}
"SpeedTouch USB Diagnostics" = ""C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon" ["THOMSON Telecom Belgium"]
"VirtualCloneDrive" = ""C:\Program Files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe" /s" ["Elaborate Bytes AG"]
"NWEReboot" = "(empty string)" [file not found]
"ATIPTA" = ""C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"" ["ATI Technologies, Inc."]
"ATICCC" = ""C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime" [null data]
"TRIXX" = ""C:\Program Files\TRIXX\TRIXX.exe" -s" ["Sapphire Technologies"]
"SoundMan" = "SOUNDMAN.EXE" ["Realtek Semiconductor Corp."]
"Anti-Blaxx Manager" = "C:\Program Files\Anti-Blaxx\Anti-Blaxx.exe" [file not found]
"SunJavaUpdateSched" = "C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe" ["Sun Microsystems, Inc."]
"DC6_check" = ""C:\Program Files\Common Files\WinAntiVirus Pro 2006\dc6_startupmon.exe"" [file not found]
"ERS_check" = ""C:\Program Files\Common Files\WinAntiVirus Pro 2006\ers_startupmon.exe"" [file not found]
"uvnx" = "c:\windows\system32\uvnx.exe" ["Microcoft Corporation"]
"PrintDrive" = "rundll32.exe "C:\windows\system32\ipqxwham.dll",setvm" [MS]
"avast!" = "C:\PROGRA~1\Alwil Software\Avast4\ashDisp.exe" ["ALWIL Software"]
"SpyAway" = "C:\Program Files\SpyAway\spyaway.exe" ["SpyAway Inc."]

HKLM\Software\Microsoft\Active Setup\Installed Components\
{F146C9B1-VMVQ-A9RC-NUFL-D02300B4E999}\(Default) = (no title provided)
                                       \StubPath   = "C:\windows\system32\tmrsrv32.exe" ["Microsoft"]

HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\
{09129E55-4ADE-475A-B32D-B960DB0BA5E0}\(Default) = (no title provided)
  -> {HKLM...CLSID} = (no title provided)
                   \InProcServer32\(Default) = "C:\windows\system32\yayywxw.dll" [file not found]
{1557B435-8242-4686-9AA3-9265BF7525A4}\(Default) = (no title provided)
  -> {HKLM...CLSID} = (no title provided)
                   \InProcServer32\(Default) = "C:\windows\system32\gvqkggbb.dll" [null data]
{3DB596F2-7605-49A4-81CB-3A0976765D97}\(Default) = (no title provided)
  -> {HKLM...CLSID} = (no title provided)
                   \InProcServer32\(Default) = "C:\windows\system32\qnpwkkrk.dll" [null data]
{43E2FE1D-17D4-287F-A33D-6AE3379AAA97}\(Default) = (no title provided)
  -> {HKLM...CLSID} = (no title provided)
                   \InProcServer32\(Default) = "C:\windows\system32\sfcvzzfr.dll" [file not found]
{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\(Default) = (no title provided)
  -> {HKLM...CLSID} = "SSVHelper Class"
                   \InProcServer32\(Default) = "C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll" ["Sun Microsystems, Inc."]
{888826A1-3C63-4687-8696-482FDBB129DF}\(Default) = (no title provided)
  -> {HKLM...CLSID} = "Hgni_BHO"
                   \InProcServer32\(Default) = "C:\windows\system32\hgni_ecol.dll" [null data]
{93E7BB29-6F92-45F1-936F-FC19FB25E488}\(Default) = (no title provided)
  -> {HKLM...CLSID} = (no title provided)
                   \InProcServer32\(Default) = "C:\windows\system32\mlljj.dll" [file not found]
{EEFBE5D6-FEFF-4CB4-AA26-6A464090CB89}\(Default) = (no title provided)
  -> {HKLM...CLSID} = "msnhlp32.msn_hlp"
                   \InProcServer32\(Default) = "C:\windows\system32\msnhlp32.dll" ["Microsoft"]

HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\
"{42071714-76d4-11d1-8b24-00a0c9068ff3}" = "Rozszerzenie CPL kadrowania wyświetlania"
  -> {HKLM...CLSID} = "Rozszerzenie CPL kadrowania wyświetlania"
                   \InProcServer32\(Default) = "deskpan.dll" [file not found]
"{88895560-9AA2-1069-930E-00AA0030EBC8}" = "Rozszerzenie ikony HyperTerminalu"
  -> {HKLM...CLSID} = "HyperTerminal Icon Ext"
                   \InProcServer32\(Default) = "C:\WINDOWS\system32\hticons.dll" ["Hilgraeve, Inc."]


[wojtas]

Użyj WWDC :
http://www.firewallleaktester.com/wwdc.htm
Zmień opcje z disable na enable. Uruchom ponownie komputer.
Tak powinny wyglądać porty (NetBIOS może być żółty) :
http://www.firewallleaktester.com/images_site/wwdc.jpg

Pobierz i uruchom narzędzie : The Avenger
http://swandog46.geekstogo.com/avenger.zip
Zaznacz opcję Input script manually i kliknij na Lupkę z prawej strony. W okienku, które się otworzy wklejasz:

Files to delete:

C:\windows\system32\wunauclt.exe
C:\Program Files\wunauclt.exe
C:\Program Files\wunauclt.tbe
C:\Program Files\wunauclt.zip
C:\Program Files\update2.exe
C:\windows\system32\wnscpsv.exe
C:\windows\system32\gvqkggbb.dll
C:\windows\system32\msnhlp32.dll
C:\windows\system32\hgni_ecol.dll
C:\windows\system32\qnpwkkrk.dll
C:\windows\system32\ipqxwham.dll
c:\windows\system32\uvnx.exe
C:\DOCUME~1\MATEUSZ\USTAWI~1\Temp\winlogon.exe
C:\windows\system32\tmp.reg
C:\windows\sysrlb32.exe
C:\windows\vxddsk.exe
C:\windows\vxddsk.exe
C:\windows\wml.exe
C:\windows\system32\wml.exe
C:\windows\system32\vxddsk.exe
C:\windows\satmat.exe
C:\windows\Biprep.exe
C:\windows\bi.dll
C:\windows\7search.dll
C:\windows\stcloader.exe
C:\windows\pbar.dll
C:\windows\flt.dll
C:\windows\764.exe
C:\windows\voiceip.dll
C:\windows\swin32.dll
C:\windows\cdsm32.dll
C:\windows\bokja.exe
C:\windows\mssvr.exe
C:\windows\mspphe.dll
C:\windows\bjam.dll
C:\windows\system32\MSIXU.DLL
C:\windows\2020search2.dll
C:\windows\2020search.dll
C:\windows\system32\WER8274.DLL
C:\windows\salm.exe
C:\windows\180ax.exe
C:\windows\updatetc.exe
C:\windows\saiemod.dll
C:\windows\system32\msnhlp32.dll
C:\windows\system32\tmrsrv32.exe
C:\windows\system32\idleserv.exe
C:\windows\system32\user_32.dll
C:\windows\system32\hgni_ecol.dll
C:\windows\mgrab.exe
C:\windows\install.exe
C:\windows\ul.exe
C:\U.exe

Folders to delete:


C:\Program Files\Common Files\WinAntiVirus Pro 2006
C:\VundoFix Backups
C:\Program Files\SpyAway

Klikasz Done, a następnie zielone światełko i zgadzasz się na restart klikając OK.
Po restarcie w HijackThis usuwasz wpis/y

O2 - BHO: (no name) - {00000026-8735-428D-B81F-DD098223B25F} - (no file)
O2 - BHO: (no name) - {00000250-0320-4dd4-be4f-7566d2314352} - (no file)
O2 - BHO: (no name) - {000006b1-19b5-414a-849f-2a3c64ae6939} - (no file)
O2 - BHO: (no name) - {06dfedaa-6196-11d5-bfc8-00508b4a487d} - (no file)
O2 - BHO: (no name) - {09129E55-4ADE-475A-B32D-B960DB0BA5E0} - C:\windows\system32\yayywxw.dll (file missing)
O2 - BHO: (no name) - {13197ace-6851-45c3-a7ff-c281324d5489} - (no file)
O2 - BHO: (no name) - {1557B435-8242-4686-9AA3-9265BF7525A4} - C:\windows\system32\gvqkggbb.dll
O2 - BHO: (no name) - {30000273-8230-4dd4-be4f-6889d1e74167} - (no file)
O2 - BHO: (no name) - {3DB596F2-7605-49A4-81CB-3A0976765D97} - C:\windows\system32\qnpwkkrk.dll
O2 - BHO: (no name) - {43E2FE1D-17D4-287F-A33D-6AE3379AAA97} - C:\windows\system32\sfcvzzfr.dll (file missing)
O2 - BHO: (no name) - {4e1075f4-eec4-4a86-add7-cd5f52858c31} - (no file)
O2 - BHO: (no name) - {4e7bd74f-2b8d-469e-92c6-ce7eb590a94d} - (no file)
O2 - BHO: (no name) - {53C330D6-A4AB-419B-B45D-FD4411C1FEF4} - (no file)
O2 - BHO: (no name) - {5929cd6e-2062-44a4-b2c5-2c7e78fbab38} - (no file)
O2 - BHO: (no name) - {5dafd089-24b1-4c5e-bd42-8ca72550717b} - (no file)
O2 - BHO: (no name) - {5fa6752a-c4a0-4222-88c2-928ae5ab4966} - (no file)
O2 - BHO: (no name) - {669695bc-a811-4a9d-8cdf-ba8c795f261e} - (no file)
O2 - BHO: (no name) - {8674aea0-9d3d-11d9-99dc-00600f9a01f1} - (no file)
O2 - BHO: Hgni_BHO - {888826A1-3C63-4687-8696-482FDBB129DF} - C:\windows\system32\hgni_ecol.dll
O2 - BHO: (no name) - {93E7BB29-6F92-45F1-936F-FC19FB25E488} - C:\windows\system32\mlljj.dll (file missing)
O2 - BHO: (no name) - {965a592f-8efa-4250-8630-7960230792f1} - (no file)
O2 - BHO: (no name) - {b8875bfe-b021-11d4-bfa8-00508b8e9bd3} - (no file)
O2 - BHO: (no name) - {bb936323-19fa-4521-ba29-eca6a121bc78} - (no file)
O2 - BHO: (no name) - {ca1d1b05-9c66-11d5-a009-000103c1e50b} - (no file)
O2 - BHO: (no name) - {cf021f40-3e14-23a5-cba2-717765728274} - (no file)
O2 - BHO: msnhlp32.msn_hlp - {EEFBE5D6-FEFF-4CB4-AA26-6A464090CB89} - C:\windows\system32\msnhlp32.dll
O2 - BHO: (no name) - {fc3a74e5-f281-4f10-ae1e-733078684f3c} - (no file)
O4 - HKLM\..\Run: [DC6_check] "C:\Program Files\Common Files\WinAntiVirus Pro 2006\dc6_startupmon.exe"
O4 - HKLM\..\Run: [ERS_check] "C:\Program Files\Common Files\WinAntiVirus Pro 2006\ers_startupmon.exe"
O4 - HKLM\..\Run: [uvnx] c:\windows\system32\uvnx.exe
O4 - HKLM\..\Run: [PrintDrive] rundll32.exe "C:\windows\system32\ipqxwham.dll",setv
O4 - HKLM\..\Run: [SpyAway] C:\Program Files\SpyAway\spyaway.exe
O4 - HKCU\..\Run: [Firewall auto setup] C:\DOCUME~1\MATEUSZ\USTAWI~1\Temp\winlogon.exe

Kasujesz ręcznie z dysku plik: C:\Avenger\backup.zip i wklejasz na forum raport: C:\avenger.txt + log z combofixa i silent runenrs

>>combofix:

http://www.techsupportforum.com/sectools/sUBs/ComboFix.exe

[ostry99]

Kod: Zaznacz wszystko

File C:\windows\vxddsk.exe deleted successfully.


File C:\windows\vxddsk.exe not found!
Deletion of file C:\windows\vxddsk.exe failed!

Could not process line:
C:\windows\vxddsk.exe
Status: 0xc0000034

File C:\windows\wml.exe deleted successfully.
File C:\windows\system32\wml.exe deleted successfully.
File C:\windows\system32\vxddsk.exe deleted successfully.
File C:\windows\satmat.exe deleted successfully.
File C:\windows\Biprep.exe deleted successfully.
File C:\windows\bi.dll deleted successfully.
File C:\windows\7search.dll deleted successfully.
File C:\windows\stcloader.exe deleted successfully.
File C:\windows\pbar.dll deleted successfully.
File C:\windows\flt.dll deleted successfully.
File C:\windows\764.exe deleted successfully.
File C:\windows\voiceip.dll deleted successfully.
File C:\windows\swin32.dll deleted successfully.
File C:\windows\cdsm32.dll deleted successfully.
File C:\windows\bokja.exe deleted successfully.
File C:\windows\mssvr.exe deleted successfully.
File C:\windows\mspphe.dll deleted successfully.
File C:\windows\bjam.dll deleted successfully.
File C:\windows\system32\MSIXU.DLL deleted successfully.
File C:\windows\2020search2.dll deleted successfully.
File C:\windows\2020search.dll deleted successfully.
File C:\windows\system32\WER8274.DLL deleted successfully.
File C:\windows\salm.exe deleted successfully.
File C:\windows\180ax.exe deleted successfully.
File C:\windows\updatetc.exe deleted successfully.
File C:\windows\saiemod.dll deleted successfully.


File C:\windows\system32\msnhlp32.dll not found!
Deletion of file C:\windows\system32\msnhlp32.dll failed!

Could not process line:
C:\windows\system32\msnhlp32.dll
Status: 0xc0000034

File C:\windows\system32\tmrsrv32.exe deleted successfully.
File C:\windows\system32\idleserv.exe deleted successfully.
File C:\windows\system32\user_32.dll deleted successfully.


File C:\windows\system32\hgni_ecol.dll not found!
Deletion of file C:\windows\system32\hgni_ecol.dll failed!

Could not process line:
C:\windows\system32\hgni_ecol.dll
Status: 0xc0000034

File C:\windows\mgrab.exe deleted successfully.
File C:\windows\install.exe deleted successfully.
File C:\windows\ul.exe deleted successfully.
File C:\U.exe deleted successfully.
Folder C:\Program Files\Common Files\WinAntiVirus Pro 2006 deleted successfully.
Folder C:\VundoFix Backups deleted successfully.
Folder C:\Program Files\SpyAway deleted successfully.

Completed script processing.

*******************

Finished!  Terminate.

Kod: Zaznacz wszystko

ComboScan v20070306.20 run by MATEUSZ on 2007-04-28 at 16:03:58
Computer is in Normal Mode.
--------------------------------------------------------------------------------



-- HijackThis (run as MATEUSZ.exe) ---------------------------------------------

Logfile of HijackThis v1.99.1
Scan saved at 16:04:00, on 2007-04-28
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\windows\System32\smss.exe
C:\windows\SYSTEM32\winlogon.exe
C:\windows\system32\services.exe
C:\windows\system32\lsass.exe
C:\windows\system32\Ati2evxx.exe
C:\windows\system32\svchost.exe
C:\windows\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\windows\system32\spoolsv.exe
C:\WINDOWS\runservice.exe
C:\WINDOWS\system32\UAService7.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\windows\SYSTEM32\Ati2evxx.exe
C:\windows\system32\WgaTray.exe
C:\windows\Explorer.EXE
C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe
C:\Program Files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\TRIXX\TRIXX.exe
C:\windows\SOUNDMAN.EXE
C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe
C:\PROGRA~1\Alwil Software\Avast4\ashDisp.exe
C:\Program Files\Gadu-Gadu\gg.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe
C:\Program Files\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\windows\system32\NOTEPAD.EXE
C:\windows\System32\WScript.exe
C:\Documents and Settings\MATEUSZ\Pulpit\comboscan.exe
C:\PROGRA~1\HIJACK~1\MATEUSZ.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O2 - BHO: (no name) - {73364D99-1240-4dff-B12A-67E448373148} - C:\windows\system32\ipv6mons.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon
O4 - HKLM\..\Run: [VirtualCloneDrive] "C:\Program Files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe" /s
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime
O4 - HKLM\..\Run: [TRIXX] "C:\Program Files\TRIXX\TRIXX.exe" -s
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [Anti-Blaxx Manager] C:\Program Files\Anti-Blaxx\Anti-Blaxx.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\Alwil Software\Avast4\ashDisp.exe
O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_7 -reboot 1
O4 - HKCU\..\Run: [NBJ] "C:\Program Files\Ahead\Nero BackItUp\NBJ.exe"
O4 - Startup: Cyber-shot Viewer Media Check Tool.lnk = C:\Program Files\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe
O4 - Startup: Neostrada tp.lnk = ?
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: ATI CATALYST – pasek zadań.lnk = C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {83AFB5CA-ED35-11D4-A452-0080C8D85045} (GameDesire Poker Games) - http://67.15.101.3/g_bin/eng/poker_2_0_0_44.cab
O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C1} (GameDesire Pool 8) - http://67.15.101.3/g_bin/eng/billard8_2_0_0_30.cab
O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C5} (GameDesire Snooker) - http://67.15.101.3/g_bin/eng/snooker_2_0_0_31.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{96938C11-A654-435C-BADB-2452291687BD}: NameServer = 194.204.159.1 217.98.63.164
O20 - Winlogon Notify: WgaLogon - C:\windows\SYSTEM32\WgaLogon.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\windows\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: LicCtrl Service (LicCtrlService) - Unknown owner - C:\WINDOWS\runservice.exe
O23 - Service: Panda Process Protection Service (PavPrSrv) - Unknown owner - C:\Program Files\Common Files\Panda Software\PavShld\pavprsrv.exe (file missing)
O23 - Service: SecuROM User Access Service (V7) (UserAccess7) - Unknown owner - C:\WINDOWS\system32\UAService7.exe


-- Files created between 2007-03-28 and 2007-04-28 -----------------------------

2007-04-28 13:14:09     47200 --a------ C:\windows\system32\ipv6mons.dll
2007-04-28 13:13:59     80384 --a------ C:\windows\installer.exe<INSTAL~1.EXE>
2007-04-28 13:13:26     10756 --a------ C:\windows\loader.exe
2007-04-27 15:59:20     25719 --a----c- C:\smitfrau.reg
2007-04-27 15:59:20     16824 --a----c- C:\replace.cmd
2007-04-27 15:59:20      3451 --a----c- C:\delfiles.cmd
2007-04-27 15:50:13         0 d------c- C:\smitRem
2007-04-26 19:20:43     79360 --a------ C:\windows\system32\swxcacls.exe
2007-04-26 19:20:43     40960 --a------ C:\windows\system32\swsc.exe
2007-04-26 19:20:43    135168 --a------ C:\windows\system32\swreg.exe
2007-04-26 19:20:43    288417 --a------ C:\windows\system32\SrchSTS.exe
2007-04-26 19:20:43     53248 --a------ C:\windows\system32\Process.exe
2007-04-26 19:20:43     51200 --a------ C:\windows\system32\dumphive.exe
2007-04-25 16:33:30     43176 --a------ C:\windows\system32\drivers\aswTdi.sys
2007-04-25 16:33:30     23416 --a------ C:\windows\system32\drivers\aswRdr.sys
2007-04-25 16:33:30     26888 --a------ C:\windows\system32\drivers\aavmker4.sys
2007-04-25 16:33:21     90112 --a------ C:\windows\system32\AvastSS.scr
2007-04-25 16:33:17     94552 --a------ C:\windows\system32\drivers\aswmon2.sys
2007-04-25 16:33:17     85952 --a------ C:\windows\system32\drivers\aswmon.sys
2007-04-25 16:33:06    733824 --a------ C:\windows\system32\aswBoot.exe
2007-04-23 16:51:46   1040384 --a------ C:\windows\system32\libeay32.dll
2007-04-23 16:51:12    196608 --a------ C:\windows\system32\ssleay32.dll
2007-04-23 15:42:08         0 d-------- C:\Program Files\Common Files\Companion Wizard<COMPAN~1>
2007-04-23 15:39:57         0 d--hs--c- C:\WA6P
2007-04-23 15:39:11      8704 --a------ C:\windows\system32\SpOrder.dll
2007-04-23 15:39:04         0 d-------- C:\Program Files\WinAntiVirus Pro 2006<WINANT~1>
2007-04-09 14:01:06         0 d-------- C:\Program Files\Outerinfo<OUTERI~1>
2007-04-09 14:01:06         0 d-------- C:\Program Files\Common Files\?ymbols
2007-04-06 11:15:11    856064 --a------ C:\windows\system32\xvidcore.dll
2007-04-04 14:49:33         0 d--h----- C:\windows\$hf_mig$
2007-03-28 23:07:19         0 d-------- C:\Program Files\AidemMedia<AIDEMM~1>


-- Find3M Report ---------------------------------------------------------------

2007-04-28 15:58:31    485744 --a------ C:\windows\system32\perfh015.dat
2007-04-28 15:58:31     84362 --a------ C:\windows\system32\perfc015.dat
2007-04-28 15:54:21       777 --ahs---- C:\windows\system32\mmf.sys
2007-04-28 14:52:01      1668 --a----c- C:\windows\mozver.dat
2007-04-28 14:52:01         0 d-------- C:\Program Files\Mozilla Firefox<MOZILL~1>
2007-04-23 15:42:27       704 --a------ C:\Documents and Settings\MATEUSZ\Dane aplikacji\update.log
2007-04-23 15:39:42         0 d-------- C:\Documents and Settings\MATEUSZ\Dane aplikacji\WinAntiVirus Pro 2006<WINANT~1>
2007-04-18 16:39:27         0 d-------- C:\Program Files\Common Files\Panda Software<PANDAS~1>
2007-04-18 16:33:53         0 d-------- C:\Program Files\Skype
2007-04-18 16:20:14         0 d-------- C:\Documents and Settings\MATEUSZ\Dane aplikacji\Skype
2007-04-18 14:55:15         0 d-------- C:\Program Files\Ikari's Chat Qlient
2007-04-18 13:20:03         0 d-------- C:\Program Files\Winamp
2007-04-17 22:17:50         0 d-------- C:\Program Files\Gadu-Gadu<GADU-G~1>
2007-04-17 14:12:50         0 d-------- C:\Program Files\Messenger<MESSEN~1>
2007-04-17 14:12:48         0 d-------- C:\Program Files\TRIXX
2007-04-12 15:29:56      4000 --a----c- C:\ao.dat
2007-04-09 20:00:05    197886 --a------ C:\Program Files\update.zip
2007-04-06 11:15:45         0 d-------- C:\Program Files\K-Lite Codec Pack
2007-04-05 19:26:11         0 d-------- C:\Program Files\GameShadow
2007-04-04 22:16:36         0 d-------- C:\Program Files\mIRC
2007-03-30 08:21:20         0 d-------- C:\Documents and Settings\MATEUSZ\Dane aplikacji\uTorrent
2007-03-30 00:54:18         0 d-------- C:\Program Files\utorrent
2007-03-28 23:04:39         0 d-------- C:\Documents and Settings\MATEUSZ\Dane aplikacji\Adobe
2007-03-23 19:24:28         0 d-------- C:\Program Files\Cheating-Death
2007-03-23 19:19:07         0 d-------- C:\Program Files\vanBasco's Karaoke Player<VANBAS~1>
2007-03-23 19:07:17         0 d-------- C:\Program Files\Java
2007-03-23 19:06:44         0 d-------- C:\Program Files\eSkiMoS R2<ESKIMO~1>
2007-03-23 19:06:31         0 d-------- C:\Program Files\DivX
2007-03-23 18:53:28         0 d-------- C:\Program Files\BearShare<BEARSH~1>
2007-03-23 18:52:55         0 d-------- C:\Program Files\MarBit
2007-03-18 12:39:39         0 d--h----- C:\Program Files\InstallShield Installation Information<INSTAL~1>
2007-03-18 12:39:06         0 d-------- C:\Program Files\Deluxe Ski Jump 3
2007-03-17 15:45:36    293376 --a------ C:\windows\system32\winsrv.dll
2007-03-16 21:45:54         0 d-------- C:\Documents and Settings\MATEUSZ\Dane aplikacji\GanymedeNet<GANYME~1>
2007-03-09 20:26:55         0 d-------- C:\Program Files\Common Files\Adobe
2007-03-09 14:34:09         0 dr-h----- C:\Documents and Settings\MATEUSZ\Dane aplikacji\SecuROM
2007-03-08 17:38:47    579072 --a------ C:\windows\system32\user32.dll
2007-03-08 17:38:47     40960 --a------ C:\windows\system32\mf3216.dll
2007-03-08 17:38:47    281600 --a------ C:\windows\system32\gdi32.dll
2007-03-08 17:37:33   1843840 --a------ C:\windows\system32\win32k.sys
2007-03-06 21:15:31         0 d-------- C:\Program Files\Opera
2007-03-02 23:22:29         0 d-------- C:\Program Files\GanymedeNet
2007-02-05 22:19:48    185856 --a------ C:\windows\system32\upnphost.dll
2007-01-29 10:58:06     60416 --------- C:\windows\system32\tzchange.exe


-- Registry Dump ---------------------------------------------------------------


[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run]
"Gadu-Gadu"="\"C:\\Program Files\\Gadu-Gadu\\gg.exe\" /tray"
"MSMSGS"="\"C:\\Program Files\\Messenger\\msmsgs.exe\" /background"
"updateMgr"="\"C:\\Program Files\\Adobe\\Acrobat 7.0\\Reader\\AdobeUpdateManager.exe\" AcRdB7_0_7 -reboot 1"
"NBJ"="\"C:\\Program Files\\Ahead\\Nero BackItUp\\NBJ.exe\""

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run]
"SpeedTouch USB Diagnostics"="\"C:\\Program Files\\Thomson\\SpeedTouch USB\\Dragdiag.exe\" /icon"
"VirtualCloneDrive"="\"C:\\Program Files\\Elaborate Bytes\\VirtualCloneDrive\\VCDDaemon.exe\" /s"
"NWEReboot"=""
"ATIPTA"="\"C:\\Program Files\\ATI Technologies\\ATI Control Panel\\atiptaxx.exe\""
"ATICCC"="\"C:\\Program Files\\ATI Technologies\\ATI.ACE\\cli.exe\" runtime"
"TRIXX"="\"C:\\Program Files\\TRIXX\\TRIXX.exe\" -s"
"SoundMan"="SOUNDMAN.EXE"
"Anti-Blaxx Manager"="C:\\Program Files\\Anti-Blaxx\\Anti-Blaxx.exe"
"SunJavaUpdateSched"="C:\\Program Files\\Java\\jre1.5.0_09\\bin\\jusched.exe"
"avast!"="C:\\PROGRA~1\\Alwil Software\\Avast4\\ashDisp.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\IMAIL]
"Installed"="1"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MAPI]
"NoChange"="1"
"Installed"="1"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MSFS]
"Installed"="1"
   

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{09129E55-4ADE-475A-B32D-B960DB0BA5E0}"=""

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"DisableTaskMgr"=dword:00000001

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll"

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Svchost]
HTTPFilter   REG_MULTI_SZ      HTTPFilter\0\0
LocalService   REG_MULTI_SZ      Alerter\0WebClient\0LmHosts\0RemoteRegistry\0upnphost\0SSDPSRV\0\0
NetworkService   REG_MULTI_SZ      DnsCache\0\0
DcomLaunch   REG_MULTI_SZ      DcomLaunch\0TermService\0\0
rpcss   REG_MULTI_SZ      RpcSs\0\0
imgsvc   REG_MULTI_SZ      StiSvc\0\0
termsvcs   REG_MULTI_SZ      TermService\0\0


[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{979fc5eb-562f-11db-bb98-000e5024e946}]
Shell\AutoRun\command   H:\Autorun.exe


-- End of ComboScan: finished at 2007-04-28 at 16:04:44 ------------------------

Kod: Zaznacz wszystko

"Silent Runners.vbs", revision R50, http://www.silentrunners.org/
Operating System: Windows XP SP2
Output limited to non-default values, except where indicated by "{++}"


Startup items buried in registry:
---------------------------------

HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ {++}
"Gadu-Gadu" = ""C:\Program Files\Gadu-Gadu\gg.exe" /tray" ["Gadu-Gadu S.A."]
"MSMSGS" = ""C:\Program Files\Messenger\msmsgs.exe" /background" [MS]
"updateMgr" = ""C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_7 -reboot 1" ["Adobe Systems Incorporated"]
"NBJ" = ""C:\Program Files\Ahead\Nero BackItUp\NBJ.exe"" ["Ahead Software AG"]
"Firewall auto setup" = "C:\DOCUME~1\MATEUSZ\USTAWI~1\Temp\winlogon.exe" [file not found]

HKLM\Software\Microsoft\Windows\CurrentVersion\Run\ {++}
"SpeedTouch USB Diagnostics" = ""C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon" ["THOMSON Telecom Belgium"]
"VirtualCloneDrive" = ""C:\Program Files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe" /s" ["Elaborate Bytes AG"]
"NWEReboot" = "(empty string)" [file not found]
"ATIPTA" = ""C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"" ["ATI Technologies, Inc."]
"ATICCC" = ""C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime" [null data]
"TRIXX" = ""C:\Program Files\TRIXX\TRIXX.exe" -s" ["Sapphire Technologies"]
"SoundMan" = "SOUNDMAN.EXE" ["Realtek Semiconductor Corp."]
"Anti-Blaxx Manager" = "C:\Program Files\Anti-Blaxx\Anti-Blaxx.exe" [file not found]
"SunJavaUpdateSched" = "C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe" ["Sun Microsystems, Inc."]
"DC6_check" = ""C:\Program Files\Common Files\WinAntiVirus Pro 2006\dc6_startupmon.exe"" [file not found]
"ERS_check" = ""C:\Program Files\Common Files\WinAntiVirus Pro 2006\ers_startupmon.exe"" [file not found]
"uvnx" = "c:\windows\system32\uvnx.exe" ["Microcoft Corporation"]
"PrintDrive" = "rundll32.exe "C:\windows\system32\ipqxwham.dll",setvm" [MS]
"avast!" = "C:\PROGRA~1\Alwil Software\Avast4\ashDisp.exe" ["ALWIL Software"]
"SpyAway" = "C:\Program Files\SpyAway\spyaway.exe" ["SpyAway Inc."]

HKLM\Software\Microsoft\Active Setup\Installed Components\
{F146C9B1-VMVQ-A9RC-NUFL-D02300B4E999}\(Default) = (no title provided)
                                       \StubPath   = "C:\windows\system32\tmrsrv32.exe" ["Microsoft"]

HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\
{09129E55-4ADE-475A-B32D-B960DB0BA5E0}\(Default) = (no title provided)
  -> {HKLM...CLSID} = (no title provided)
                   \InProcServer32\(Default) = "C:\windows\system32\yayywxw.dll" [file not found]
{1557B435-8242-4686-9AA3-9265BF7525A4}\(Default) = (no title provided)
  -> {HKLM...CLSID} = (no title provided)
                   \InProcServer32\(Default) = "C:\windows\system32\gvqkggbb.dll" [null data]
{3DB596F2-7605-49A4-81CB-3A0976765D97}\(Default) = (no title provided)
  -> {HKLM...CLSID} = (no title provided)
                   \InProcServer32\(Default) = "C:\windows\system32\qnpwkkrk.dll" [null data]
{43E2FE1D-17D4-287F-A33D-6AE3379AAA97}\(Default) = (no title provided)
  -> {HKLM...CLSID} = (no title provided)
                   \InProcServer32\(Default) = "C:\windows\system32\sfcvzzfr.dll" [file not found]
{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\(Default) = (no title provided)
  -> {HKLM...CLSID} = "SSVHelper Class"
                   \InProcServer32\(Default) = "C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll" ["Sun Microsystems, Inc."]
{888826A1-3C63-4687-8696-482FDBB129DF}\(Default) = (no title provided)
  -> {HKLM...CLSID} = "Hgni_BHO"
                   \InProcServer32\(Default) = "C:\windows\system32\hgni_ecol.dll" [null data]
{93E7BB29-6F92-45F1-936F-FC19FB25E488}\(Default) = (no title provided)
  -> {HKLM...CLSID} = (no title provided)
                   \InProcServer32\(Default) = "C:\windows\system32\mlljj.dll" [file not found]
{EEFBE5D6-FEFF-4CB4-AA26-6A464090CB89}\(Default) = (no title provided)
  -> {HKLM...CLSID} = "msnhlp32.msn_hlp"
                   \InProcServer32\(Default) = "C:\windows\system32\msnhlp32.dll" ["Microsoft"]

HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\
"{42071714-76d4-11d1-8b24-00a0c9068ff3}" = "Rozszerzenie CPL kadrowania wyświetlania"
  -> {HKLM...CLSID} = "Rozszerzenie CPL kadrowania wyświetlania"
                   \InProcServer32\(Default) = "deskpan.dll" [file not found]
"{88895560-9AA2-1069-930E-00AA0030EBC8}" = "Rozszerzenie ikony HyperTerminalu"
  -> {HKLM...CLSID} = "HyperTerminal Icon Ext"
                   \InProcServer32\(Default) = "C:\WINDOWS\system32\hticons.dll" ["Hilgraeve, Inc."]
"{0006F045-0000-0000-C000-000000000046}" = "Microsoft Outlook Custom Icon Handler"
  -> {HKLM...CLSID} = "Rozszerzenie ikon plików programu Outlook"
                   \InProcServer32\(Default) = "C:\PROGRA~1\Microsoft Office\Office\OLKFSTUB.DLL" [MS]
"{B7056B8E-4F99-44f8-8CBD-282390FE5428}" = "VirtualCloneDrive"
  -> {HKLM...CLSID} = "VirtualCloneDrive Shell Extension"
                   \InProcServer32\(Default) = "C:\Program Files\Elaborate Bytes\VirtualCloneDrive\ElbyVCDShell.dll" ["Elaborate Bytes AG"]
"{EB47FF00-225E-11D2-9E1D-00A0C9AB0EEE}" = "eLicense Control"
  -> {HKLM...CLSID} = "eLicense Control"
                   \InProcServer32\(Default) = "C:\WINDOWS\lcmmfu.cpl" [null data]
"{cc86590a-b60a-48e6-996b-41d25ed39a1e}" = "Portable Media Devices Menu"
  -> {HKLM...CLSID} = "Portable Media Devices Menu"
                   \InProcServer32\(Default) = "C:\windows\system32\Audiodev.dll" [MS]
"{5E2121EE-0300-11D4-8D3B-444553540000}" = "Catalyst Context Menu extension"
  -> {HKLM...CLSID} = "SimpleShlExt Class"
                   \InProcServer32\(Default) = "C:\Program Files\ATI Technologies\ATI.ACE\atiacmxx.dll" [empty string]
"{B41DB860-8EE4-11D2-9906-E49FADC173CA}" = "WinRAR shell extension"
  -> {HKLM...CLSID} = "WinRAR"
                   \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]
"{472083B0-C522-11CF-8763-00608CC02F24}" = "avast"
  -> {HKLM...CLSID} = "avast"
                   \InProcServer32\(Default) = "C:\Program Files\Alwil Software\Avast4\ashShell.dll" ["ALWIL Software"]

HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\
<<!>> "{09129E55-4ADE-475A-B32D-B960DB0BA5E0}" = "*n" (unwritable string)
  -> {HKLM...CLSID} = (no title provided)
                   \InProcServer32\(Default) = "C:\windows\system32\yayywxw.dll" [file not found]

HKLM\System\CurrentControlSet\Control\Session Manager\
<<!>> "BootExecute" = "autocheck autochk *"|"stera" [file not found]

HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\
<<!>> AtiExtEvent\DLLName = "Ati2evxx.dll" ["ATI Technologies Inc."]

HKLM\Software\Classes\Folder\shellex\ColumnHandlers\
{F9DB5320-233E-11D1-9F84-707F02C10627}\(Default) = "PDF Column Info"
  -> {HKLM...CLSID} = "PDF Shell Extension"
                   \InProcServer32\(Default) = "C:\Program Files\Adobe\Acrobat 7.0\ActiveX\PDFShell.dll" ["Adobe Systems, Inc."]

HKLM\Software\Classes\*\shellex\ContextMenuHandlers\
avast\(Default) = "{472083B0-C522-11CF-8763-00608CC02F24}"
  -> {HKLM...CLSID} = "avast"
                   \InProcServer32\(Default) = "C:\Program Files\Alwil Software\Avast4\ashShell.dll" ["ALWIL Software"]
WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
  -> {HKLM...CLSID} = "WinRAR"
                   \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]

HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\
WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
  -> {HKLM...CLSID} = "WinRAR"
                   \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]

HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\
avast\(Default) = "{472083B0-C522-11CF-8763-00608CC02F24}"
  -> {HKLM...CLSID} = "avast"
                   \InProcServer32\(Default) = "C:\Program Files\Alwil Software\Avast4\ashShell.dll" ["ALWIL Software"]
WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
  -> {HKLM...CLSID} = "WinRAR"
                   \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]


Group Policies {GPedit.msc branch and setting}:
-----------------------------------------------

Note: detected settings may not have any effect.

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System\

"DisableTaskMgr" = (REG_DWORD) hex:0x00000001
{User Configuration|Administrative Templates|System|Ctrl+Alt+Del Options|
Remove Task Manager}

HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\

"shutdownwithoutlogon" = (REG_DWORD) hex:0x00000001
{Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options|
Shutdown: Allow system to be shut down without having to log on}

"undockwithoutlogon" = (REG_DWORD) hex:0x00000001
{Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options|
Devices: Allow undock without having to log on}


Active Desktop and Wallpaper:
-----------------------------

Active Desktop may be disabled at this entry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState

Displayed if Active Desktop enabled and wallpaper not set by Group Policy:
HKCU\Software\Microsoft\Internet Explorer\Desktop\General\
"Wallpaper" = "C:\windows\system32\config\systemprofile\Pulpit\bez tytułu.bmp"


Startup items in "MATEUSZ" & "All Users" startup folders:
---------------------------------------------------------

C:\Documents and Settings\MATEUSZ\Menu Start\Programy\Autostart
"Cyber-shot Viewer Media Check Tool" -> shortcut to: "C:\Program Files\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe" ["Sony Corporation"]
"Neostrada tp" -> shortcut to: "" [file not found]

C:\Documents and Settings\All Users\Menu Start\Programy\Autostart
"Adobe Reader Speed Launch" -> shortcut to: "C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe" ["Adobe Systems Incorporated"]
"ATI CATALYST – pasek zadań" -> shortcut to: "C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe SystemTray" [null data]
"Microsoft Office" -> shortcut to: "C:\Program Files\Microsoft Office\Office\OSA9.EXE -b -l" [MS]


Winsock2 Service Provider DLLs:
-------------------------------

Namespace Service Providers

HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++}
000000000001\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]
000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS]
000000000003\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]

Transport Service Providers

HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++}
0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range:
%SystemRoot%\system32\mswsock.dll [MS], 01 - 03, 06 - 15
%SystemRoot%\system32\rsvpsp.dll [MS], 04 - 05


Toolbars, Explorer Bars, Extensions:
------------------------------------

Extensions (Tools menu items, main toolbar menu buttons)

HKLM\Software\Microsoft\Internet Explorer\Extensions\
{08B0E5C0-4FCB-11CF-AAA5-00401C608501}\
"MenuText" = "Sun Java Console"
"CLSIDExtension" = "{CAFEEFAC-0015-0000-0009-ABCDEFFEDCBC}"
  -> {HKCU...CLSID} = "Java Plug-in 1.5.0_09"
                   \InProcServer32\(Default) = "C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll" ["Sun Microsystems, Inc."]
  -> {HKLM...CLSID} = "Java Plug-in 1.5.0_09"
                   \InProcServer32\(Default) = "C:\Program Files\Java\jre1.5.0_09\bin\npjpi150_09.dll" ["Sun Microsystems, Inc."]

{FB5F1910-F110-11D2-BB9E-00C04F795683}\
"ButtonText" = "Messenger"
"MenuText" = "Windows Messenger"
"Exec" = "C:\Program Files\Messenger\msmsgs.exe" [MS]


Running Services (Display Name, Service Name, Path {Service DLL}):
------------------------------------------------------------------

Ati HotKey Poller, Ati HotKey Poller, "C:\windows\system32\Ati2evxx.exe" ["ATI Technologies Inc."]
avast! Antivirus, avast! Antivirus, ""C:\Program Files\Alwil Software\Avast4\ashServ.exe"" ["ALWIL Software"]
avast! iAVS4 Control Service, aswUpdSv, ""C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe"" ["ALWIL Software"]
avast! Mail Scanner, avast! Mail Scanner, ""C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service" ["ALWIL Software"]
avast! Web Scanner, avast! Web Scanner, ""C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service" ["ALWIL Software"]
LicCtrl Service, LicCtrlService, "C:\WINDOWS\runservice.exe" [null data]
SecuROM User Access Service (V7), UserAccess7, "C:\WINDOWS\system32\UAService7.exe" [null data]
Windows User Mode Driver Framework, UMWdf, "C:\WINDOWS\system32\wdfmgr.exe" [MS]


----------
<<!>>: Suspicious data at a malware launch point.

+ This report excludes default entries except where indicated.
+ To see *everywhere* the script checks and *everything* it finds,
  launch it from a command prompt or a shortcut with the -all parameter.
+ To search all directories of local fixed drives for DESKTOP.INI
  DLL launch points, use the -supp parameter or answer "No" at the
  first message box and "Yes" at the second message box.
---------- (total run time: 50 seconds, including 3 seconds for message boxes)

[wojtas]

zastosuj :

smitfraudfix z opcji 2:

http://siri.urz.free.fr/Fix/SmitfraudFix_En.php

oraz te skanery po kilka razy w awaryjnym trybie

VundoFix
http://www.atribune.org/ccount/click.php?id=4

VirtumundoBeGone
http://secured2k.home.comcast.net/tools/VirtumundoBeGone.exe

FixVundo
http://securityresponse.symantec.com/avcenter/FixVundo.exe

[ostry99]

Ok, dzieki za wszystko

Naprawde juz myslalem ze tylko format mi moze pomoc, a tu dzieki Wam udalo sie usunac te wirusy.. Dobra robota panowie

[wojtas]

ostry99 jeszcze uzyj po kilka razy tych saknerow potem daj loga

z silenta i combofixa:

>>combofix:

http://www.techsupportforum.com/sectools/sUBs/ComboFix.exe

[ostry99]

Te programy ktorych uzylem w trybie awaryjnym nic nie wykrywaja. Komputr nadal mi sie wylacza. nawet podczas dzialania Combofixa.

"Silent Runners.vbs", revision R50, http://www.silentrunners.org/
Operating System: Windows XP SP2
Output limited to non-default values, except where indicated by "{++}"


Startup items buried in registry:
---------------------------------

HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ {++}
"Gadu-Gadu" = ""C:\Program Files\Gadu-Gadu\gg.exe" /tray" ["Gadu-Gadu S.A."]
"MSMSGS" = ""C:\Program Files\Messenger\msmsgs.exe" /background" [MS]
"updateMgr" = ""C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_7 -reboot 1" ["Adobe Systems Incorporated"]
"NBJ" = ""C:\Program Files\Ahead\Nero BackItUp\NBJ.exe"" ["Ahead Software AG"]

HKLM\Software\Microsoft\Windows\CurrentVersion\Run\ {++}
"SpeedTouch USB Diagnostics" = ""C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon" ["THOMSON Telecom Belgium"]
"VirtualCloneDrive" = ""C:\Program Files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe" /s" ["Elaborate Bytes AG"]
"NWEReboot" = "(empty string)" [file not found]
"ATIPTA" = ""C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"" ["ATI Technologies, Inc."]
"ATICCC" = ""C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime" [null data]
"TRIXX" = ""C:\Program Files\TRIXX\TRIXX.exe" -s" ["Sapphire Technologies"]
"SoundMan" = "SOUNDMAN.EXE" ["Realtek Semiconductor Corp."]
"Anti-Blaxx Manager" = "C:\Program Files\Anti-Blaxx\Anti-Blaxx.exe" [file not found]
"SunJavaUpdateSched" = "C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe" ["Sun Microsystems, Inc."]
"avast!" = "C:\PROGRA~1\Alwil Software\Avast4\ashDisp.exe" ["ALWIL Software"]

HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\
{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\(Default) = (no title provided)
-> {HKLM...CLSID} = "SSVHelper Class"
\InProcServer32\(Default) = "C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll" ["Sun Microsystems, Inc."]
{F6104497-54FD-4688-9162-5115CC8AB0FB}\(Default) = "XBTP01621"
-> {HKLM...CLSID} = "XBTP01621 Class"
\InProcServer32\(Default) = "C:\PROGRA~1\BEARSH~2\BEARSH~2\MediaBar.dll" ["IE Toolbar"]

HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\
"{42071714-76d4-11d1-8b24-00a0c9068ff3}" = "Rozszerzenie CPL kadrowania wyświetlania"
-> {HKLM...CLSID} = "Rozszerzenie CPL kadrowania wyświetlania"
\InProcServer32\(Default) = "deskpan.dll" [file not found]
"{88895560-9AA2-1069-930E-00AA0030EBC8}" = "Rozszerzenie ikony HyperTerminalu"
-> {HKLM...CLSID} = "HyperTerminal Icon Ext"
\InProcServer32\(Default) = "C:\WINDOWS\system32\hticons.dll" ["Hilgraeve, Inc."]
"{0006F045-0000-0000-C000-000000000046}" = "Microsoft Outlook Custom Icon Handler"
-> {HKLM...CLSID} = "Rozszerzenie ikon plików programu Outlook"
\InProcServer32\(Default) = "C:\PROGRA~1\Microsoft Office\Office\OLKFSTUB.DLL" [MS]
"{B7056B8E-4F99-44f8-8CBD-282390FE5428}" = "VirtualCloneDrive"
-> {HKLM...CLSID} = "VirtualCloneDrive Shell Extension"
\InProcServer32\(Default) = "C:\Program Files\Elaborate Bytes\VirtualCloneDrive\ElbyVCDShell.dll" ["Elaborate Bytes AG"]
"{EB47FF00-225E-11D2-9E1D-00A0C9AB0EEE}" = "eLicense Control"
-> {HKLM...CLSID} = "eLicense Control"
\InProcServer32\(Default) = "C:\WINDOWS\lcmmfu.cpl" [null data]
"{cc86590a-b60a-48e6-996b-41d25ed39a1e}" = "Portable Media Devices Menu"
-> {HKLM...CLSID} = "Portable Media Devices Menu"
\InProcServer32\(Default) = "C:\windows\system32\Audiodev.dll" [MS]
"{5E2121EE-0300-11D4-8D3B-444553540000}" = "Catalyst Context Menu extension"
-> {HKLM...CLSID} = "SimpleShlExt Class"
\InProcServer32\(Default) = "C:\Program Files\ATI Technologies\ATI.ACE\atiacmxx.dll" [empty string]
"{B41DB860-8EE4-11D2-9906-E49FADC173CA}" = "WinRAR shell extension"
-> {HKLM...CLSID} = "WinRAR"
\InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]
"{472083B0-C522-11CF-8763-00608CC02F24}" = "avast"
-> {HKLM...CLSID} = "avast"
\InProcServer32\(Default) = "C:\Program Files\Alwil Software\Avast4\ashShell.dll" ["ALWIL Software"]

HKLM\System\CurrentControlSet\Control\Session Manager\
<<!>> "BootExecute" = "autocheck autochk *"|"stera" [file not found]

HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\
<<!>> AtiExtEvent\DLLName = "Ati2evxx.dll" ["ATI Technologies Inc."]

HKLM\Software\Classes\Folder\shellex\ColumnHandlers\
{F9DB5320-233E-11D1-9F84-707F02C10627}\(Default) = "PDF Column Info"
-> {HKLM...CLSID} = "PDF Shell Extension"
\InProcServer32\(Default) = "C:\Program Files\Adobe\Acrobat 7.0\ActiveX\PDFShell.dll" ["Adobe Systems, Inc."]

HKLM\Software\Classes\*\shellex\ContextMenuHandlers\
avast\(Default) = "{472083B0-C522-11CF-8763-00608CC02F24}"
-> {HKLM...CLSID} = "avast"
\InProcServer32\(Default) = "C:\Program Files\Alwil Software\Avast4\ashShell.dll" ["ALWIL Software"]
WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
-> {HKLM...CLSID} = "WinRAR"
\InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]

HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\
WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
-> {HKLM...CLSID} = "WinRAR"
\InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]

HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\
avast\(Default) = "{472083B0-C522-11CF-8763-00608CC02F24}"
-> {HKLM...CLSID} = "avast"
\InProcServer32\(Default) = "C:\Program Files\Alwil Software\Avast4\ashShell.dll" ["ALWIL Software"]
WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
-> {HKLM...CLSID} = "WinRAR"
\InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]


Group Policies {GPedit.msc branch and setting}:
-----------------------------------------------

Note: detected settings may not have any effect.

HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\

"shutdownwithoutlogon" = (REG_DWORD) hex:0x00000001
{Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options|
Shutdown: Allow system to be shut down without having to log on}

"undockwithoutlogon" = (REG_DWORD) hex:0x00000001
{Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options|
Devices: Allow undock without having to log on}


Active Desktop and Wallpaper:
-----------------------------

Active Desktop may be disabled at this entry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState

Displayed if Active Desktop enabled and wallpaper not set by Group Policy:
HKCU\Software\Microsoft\Internet Explorer\Desktop\General\
"Wallpaper" = "C:\windows\system32\config\systemprofile\Pulpit\bez tytułu.bmp"


Startup items in "MATEUSZ" & "All Users" startup folders:
---------------------------------------------------------

C:\Documents and Settings\MATEUSZ\Menu Start\Programy\Autostart
"Cyber-shot Viewer Media Check Tool" -> shortcut to: "C:\Program Files\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe" ["Sony Corporation"]
"Neostrada tp" -> shortcut to: "" [file not found]

C:\Documents and Settings\All Users\Menu Start\Programy\Autostart
"Adobe Reader Speed Launch" -> shortcut to: "C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe" ["Adobe Systems Incorporated"]
"ATI CATALYST – pasek zadań" -> shortcut to: "C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe SystemTray" [null data]
"Microsoft Office" -> shortcut to: "C:\Program Files\Microsoft Office\Office\OSA9.EXE -b -l" [MS]


Winsock2 Service Provider DLLs:
-------------------------------

Namespace Service Providers

HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++}
000000000001\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]
000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS]
000000000003\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]

Transport Service Providers

HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++}
0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range:
%SystemRoot%\system32\mswsock.dll [MS], 01 - 03, 06 - 15
%SystemRoot%\system32\rsvpsp.dll [MS], 04 - 05


Toolbars, Explorer Bars, Extensions:
------------------------------------

Toolbars

HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\
"{D3DEE18F-DB64-4BEB-9FF1-E1F0A5033E4A}"
-> {HKLM...CLSID} = "BearShare MediaBar"
\InProcServer32\(Default) = "C:\Program Files\BearShare applications\BearShare MediaBar\MediaBar.dll" ["IE Toolbar"]

HKLM\Software\Microsoft\Internet Explorer\Toolbar\
"{D3DEE18F-DB64-4BEB-9FF1-E1F0A5033E4A}" = (no title provided)
-> {HKLM...CLSID} = "BearShare MediaBar"
\InProcServer32\(Default) = "C:\Program Files\BearShare applications\BearShare MediaBar\MediaBar.dll" ["IE Toolbar"]

Extensions (Tools menu items, main toolbar menu buttons)

HKLM\Software\Microsoft\Internet Explorer\Extensions\
{08B0E5C0-4FCB-11CF-AAA5-00401C608501}\
"MenuText" = "Sun Java Console"
"CLSIDExtension" = "{CAFEEFAC-0015-0000-0009-ABCDEFFEDCBC}"
-> {HKCU...CLSID} = "Java Plug-in 1.5.0_09"
\InProcServer32\(Default) = "C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll" ["Sun Microsystems, Inc."]
-> {HKLM...CLSID} = "Java Plug-in 1.5.0_09"
\InProcServer32\(Default) = "C:\Program Files\Java\jre1.5.0_09\bin\npjpi150_09.dll" ["Sun Microsystems, Inc."]

{FB5F1910-F110-11D2-BB9E-00C04F795683}\
"ButtonText" = "Messenger"
"MenuText" = "Windows Messenger"
"Exec" = "C:\Program Files\Messenger\msmsgs.exe" [MS]


Miscellaneous IE Hijack Points
------------------------------

C:\WINDOWS\INF\IERESET.INF (used to "Reset Web Settings")

Added lines (compared with English-language version):
: ˙ţ[ V e r s i o n ]

: S i g n a t u r e = " $ C H I C A G O $ "

: A d v a n c e d I N F = 2 . 5 , " Y o u n e e d a n e w v e r s i o n o f a d v p a c k . d l l "

:

: [ R e s t o r e H o m e P a g e ]

: A d d R e g = R e s t o r e H o m e P a g e . r e g

:

: [ R e s t o r e B r o w s e r S e t t i n g s ]

: A d d R e g = R e s t o r e B r o w s e r S e t t i n g s . r e g

: D e l R e g = D e l e t e T e m p l a t e s . r e g , D e l e t e A u t o s e a r c h . r e g

:

: [ R e s t o r e H o m e P a g e . r e g ]

: H K C U , " S o f t w a r e \ M i c r o s o f t \ I n t e r n e t E x p l o r e r \ M a i n " , " S t a r t P a g e " , 0 , % S T A R T _ P A G E _ U R L %

:

: [ R e s t o r e B r o w s e r S e t t i n g s . r e g ]

: H K L M , " S o f t w a r e \ M i c r o s o f t \ I n t e r n e t E x p l o r e r \ M a i n " , " D e f a u l t _ P a g e _ U R L " , 0 , % S T A R T _ P A G E _ U R L %

: H K L M , " S o f t w a r e \ M i c r o s o f t \ I n t e r n e t E x p l o r e r \ M a i n " , " D e f a u l t _ S e a r c h _ U R L " , 0 , % S E A R C H _ P A G E _ U R L %

: H K L M , " S o f t w a r e \ M i c r o s o f t \ I n t e r n e t E x p l o r e r \ M a i n " , " S e a r c h P a g e " , 0 , % S E A R C H _ P A G E _ U R L %

: H K L M , " S o f t w a r e \ M i c r o s o f t \ I n t e r n e t E x p l o r e r \ M a i n \ U r l T e m p l a t e " , " 1 " , 0 , " w w w . % s . c o m "

: H K L M , " S o f t w a r e \ M i c r o s o f t \ I n t e r n e t E x p l o r e r \ M a i n \ U r l T e m p l a t e " , " 2 " , 0 , " w w w . % s . o r g "

: H K L M , " S o f t w a r e \ M i c r o s o f t \ I n t e r n e t E x p l o r e r \ M a i n \ U r l T e m p l a t e " , " 3 " , 0 , " w w w . % s . n e t "

: H K L M , " S o f t w a r e \ M i c r o s o f t \ I n t e r n e t E x p l o r e r \ M a i n \ U r l T e m p l a t e " , " 4 " , 0 , " w w w . % s . e d u "

: H K C U , " S o f t w a r e \ M i c r o s o f t \ I n t e r n e t E x p l o r e r \ M a i n " , " S e a r c h P a g e " , 0 , % S E A R C H _ P A G E _ U R L %

:

: ; N O T E ( a n d r e w g u ) i e 5 . 5 b # 1 0 8 2 5 9 - a u t o s e a r c h s e t t i n g s a r e n o t p r o p e r l y r e s e t

: H K C U , " S o f t w a r e \ M i c r o s o f t \ I n t e r n e t E x p l o r e r \ S e a r c h U r l " , " P r o v i d e r " , 0 , " "

:

: t m "

: t m "

: H K L M , " S o f t w a r e \ M i c r o s o f t \ W i n d o w s \ C u r r e n t V e r s i o n \ I n t e r n e t S e t t i n g s \ S a f e S i t e s " , % S A F E S I T E _ V A L U E % , 0 , " h t t p : / / i e . s e a r c h . m s n . c o m / * "

:

: [ D e l e t e T e m p l a t e s . r e g ]

: H K L M , " S o f t w a r e \ M i c r o s o f t \ I n t e r n e t E x p l o r e r \ M a i n \ U r l T e m p l a t e " , " 5 "

: H K L M , " S o f t w a r e \ M i c r o s o f t \ I n t e r n e t E x p l o r e r \ M a i n \ U r l T e m p l a t e " , " 6 "

: H K L M , " S o f t w a r e \ M i c r o s o f t \ I n t e r n e t E x p l o r e r \ M a i n \ U r l T e m p l a t e " , " 7 "

: H K L M , " S o f t w a r e \ M i c r o s o f t \ I n t e r n e t E x p l o r e r \ M a i n \ U r l T e m p l a t e " , " 8 "

: H K L M , " S o f t w a r e \ M i c r o s o f t \ I n t e r n e t E x p l o r e r \ M a i n \ U r l T e m p l a t e " , " 9 "

:

: [ D e l e t e A u t o s e a r c h . r e g ]

: ; N O T E ( a n d r e w g u ) i e 5 . 5 b # 1 0 8 2 5 9 - a u t o s e a r c h s e t t i n g s a r e n o t p r o p e r l y r e s e t

: H K C U , " S o f t w a r e \ M i c r o s o f t \ I n t e r n e t E x p l o r e r \ M a i n " , " A u t o S e a r c h "

:

: [ S t r i n g s ]

: S T A R T _ P A G E _ U R L = " h t t p : / / w w w . m i c r o s o f t . c o m / i s a p i / r e d i r . d l l ? p r d = i e & p v e r = 6 & a r = m s n h o m e "

: S E A R C H _ P A G E _ U R L = " h t t p : / / w w w . m i c r o s o f t . c o m / i s a p i / r e d i r . d l l ? p r d = i e & a r = i e s e a r c h "

: S A F E S I T E _ V A L U E = " i e . s e a r c h . m s n . c o m "

:

: ; I M P O R T A N T N O T E :

: ; I E b r a n d i n g d l l ( i e d k c s 3 2 . d l l ) u s e s t h e f o l l o w i n g e n t r i e s t o r e s t o r e t h e d e f a u l t M S v a l u e s .

: ; I n t h e v a n i l l a v e r s i o n o f I E , t h e v a l u e s m u s t b e t h e s a m e a s t h e i r c o r r e s p o n d i n g n o n M S _ * v a l u e s .

: ; F o r e x a m p l e , S T A R T _ P A G E _ U R L a n d M S _ S T A R T _ P A G E _ U R L m u s t h a v e t h e s a m e U R L i n t h e I E v e r s i o n r e l e a s e d b y M S .

: M S _ S T A R T _ P A G E _ U R L = " h t t p : / / w w w . m i c r o s o f t . c o m / i s a p i / r e d i r . d l l ? p r d = i e & p v e r = 6 & a r = m s n h o m e "

:

Missing lines (compared with English-language version):
[Version]: 2 lines
[RestoreHomePage]: 1 line
[RestoreHomePage.reg]: 1 line
[RestoreBrowserSettings.reg]: 12 lines
[DeleteTemplates.reg]: 5 lines
[DeleteAutosearch.reg]: 1 line
[Strings]: 1 line
[RestoreBrowserSettings]: 2 lines
[Strings]: 3 lines


Running Services (Display Name, Service Name, Path {Service DLL}):
------------------------------------------------------------------

Ati HotKey Poller, Ati HotKey Poller, "C:\windows\system32\Ati2evxx.exe" ["ATI Technologies Inc."]
avast! Antivirus, avast! Antivirus, ""C:\Program Files\Alwil Software\Avast4\ashServ.exe"" ["ALWIL Software"]
avast! iAVS4 Control Service, aswUpdSv, ""C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe"" ["ALWIL Software"]
avast! Mail Scanner, avast! Mail Scanner, ""C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service" ["ALWIL Software"]
avast! Web Scanner, avast! Web Scanner, ""C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service" ["ALWIL Software"]
LicCtrl Service, LicCtrlService, "C:\WINDOWS\runservice.exe" [null data]
SecuROM User Access Service (V7), UserAccess7, "C:\WINDOWS\system32\UAService7.exe" [null data]
Windows User Mode Driver Framework, UMWdf, "C:\WINDOWS\system32\wdfmgr.exe" [MS]


----------
<<!>>: Suspicious data at a malware launch point.

+ This report excludes default entries except where indicated.
+ To see *everywhere* the script checks and *everything* it finds,
launch it from a command prompt or a shortcut with the -all parameter.
+ To search all directories of local fixed drives for DESKTOP.INI
DLL launch points, use the -supp parameter or answer "No" at the
first message box and "Yes" at the second message box.
---------- (total run time: 76 seconds, including 4 seconds for message boxes)

"MATEUSZ" - 07-04-29 13:39:58 Dodatek Service Pack 2
ComboFix 07-04-25.4V - Running from: "F:\"


(((((((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))


~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ Purity ~ ~ ~ ~ ~ ~ ~ ~~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~
Folders Quarantined:
C:\qoobox\purity\C\Program Files\Common Files\YMBOLS~1
C:\qoobox\purity\C\WINDOWS\SEMBLY~1
C:\qoobox\purity\C\WINDOWS\SEMBLY~1\??sembly
C:\qoobox\purity\C\WINDOWS\SEMBLY~1\??sembly\ctxad-552.0000
C:\qoobox\purity\C\WINDOWS\SEMBLY~1\??sembly\ctxad-552.0001
C:\qoobox\purity\C\WINDOWS\SEMBLY~1\??sembly\ctxad-552.0002


((((((((((((((((((((((((((((((( Files Created from 2007-03-28 to 2007-04-29 ))))))))))))))))))))))))))))))))))


2007-04-29 13:39 49,152 --a------ C:\WINDOWS\nircmd.exe
2007-04-29 11:16 2,934 --a------ C:\WINDOWS\system32\tmp.reg
2007-04-29 11:10 <DIR> d----c--- C:\VundoFix Backups
2007-04-29 11:09 <DIR> d--hs---- C:\WINDOWS\CSC
2007-04-28 22:10 <DIR> d----c--- C:\avenger
2007-04-28 14:50 0 --a------ C:\WINDOWS\nsreg.dat
2007-04-28 14:48 524,288 --ah----- C:\DOCUME~1\ADMINI~1\NTUSER.DAT
2007-04-28 14:48 <DIR> dr-h-c--- C:\DOCUME~1\ADMINI~1\Dane aplikacji
2007-04-28 14:48 <DIR> dr---c--- C:\DOCUME~1\ADMINI~1\Menu Start
2007-04-28 14:48 <DIR> d--h-c--- C:\DOCUME~1\ADMINI~1\Ustawienia lokalne
2007-04-28 14:48 <DIR> d--h-c--- C:\DOCUME~1\ADMINI~1\Szablony
2007-04-28 14:48 <DIR> d----c--- C:\DOCUME~1\ADMINI~1\Ulubione
2007-04-28 14:48 <DIR> d----c--- C:\DOCUME~1\ADMINI~1\Pulpit
2007-04-28 14:48 <DIR> d----c--- C:\DOCUME~1\ADMINI~1\Moje dokumenty
2007-04-28 13:13 80,384 --a------ C:\WINDOWS\installer.exe
2007-04-27 21:00 <DIR> d-------- C:\DOCUME~1\MATEUSZ\DANEAP~1\BearShare
2007-04-27 20:59 <DIR> d-------- C:\Program Files\BearShare Applications
2007-04-27 15:59 25,719 --a--c--- C:\smitfrau.reg
2007-04-27 15:59 16,824 --a--c--- C:\replace.cmd
2007-04-27 15:50 <DIR> d----c--- C:\smitRem
2007-04-26 19:20 53,248 --a------ C:\WINDOWS\system32\Process.exe
2007-04-26 19:20 51,200 --a------ C:\WINDOWS\system32\dumphive.exe
2007-04-26 19:20 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe
2007-04-26 16:49 4 --a------ C:\WINDOWS\system32\stfv.bin
2007-04-26 16:10 12 --a------ C:\WINDOWS\system32\sl.bin
2007-04-26 16:08 12 --a------ C:\WINDOWS\system32\gtv_sd.bin
2007-04-25 16:33 94,552 --a------ C:\WINDOWS\system32\drivers\aswmon2.sys
2007-04-25 16:33 90,112 --a------ C:\WINDOWS\system32\AvastSS.scr
2007-04-25 16:33 85,952 --a------ C:\WINDOWS\system32\drivers\aswmon.sys
2007-04-25 16:33 733,824 --a------ C:\WINDOWS\system32\aswBoot.exe
2007-04-25 16:33 43,176 --a------ C:\WINDOWS\system32\drivers\aswTdi.sys
2007-04-25 16:33 26,888 --a------ C:\WINDOWS\system32\drivers\aavmker4.sys
2007-04-25 16:33 23,416 --a------ C:\WINDOWS\system32\drivers\aswRdr.sys
2007-04-23 16:51 196,608 --a------ C:\WINDOWS\system32\ssleay32.dll
2007-04-23 16:51 1,040,384 --a------ C:\WINDOWS\system32\libeay32.dll
2007-04-23 15:42 <DIR> d-------- C:\Program Files\Common Files\Companion Wizard
2007-04-23 15:39 8,704 --a------ C:\WINDOWS\system32\SpOrder.dll
2007-04-23 15:39 <DIR> d--hsc--- C:\WA6P
2007-04-23 15:39 <DIR> d----c--- C:\DOCUME~1\ALLUSE~1\DANEAP~1\WinAntiVirus Pro 2006
2007-04-23 15:39 <DIR> d-------- C:\Program Files\WinAntiVirus Pro 2006
2007-04-23 15:39 <DIR> d-------- C:\DOCUME~1\MATEUSZ\DANEAP~1\WinAntiVirus Pro 2006
2007-04-09 14:01 <DIR> d-------- C:\DOCUME~1\NETWOR~1\Menu Start
2007-04-06 11:15 856,064 --a------ C:\WINDOWS\system32\xvidcore.dll
2007-04-06 11:15 <DIR> d----c--- C:\DOCUME~1\ALLUSE~1\DANEAP~1\Apple Computer
2007-04-04 14:49 <DIR> d--h----- C:\WINDOWS\$hf_mig$
2007-03-28 23:07 <DIR> d-------- C:\Program Files\AidemMedia


(((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))))

Rootkit driver pe386 is present. A rootkit scan is required
Rootkit driver pe386 is present. ... attempting disinfection
msguard ...... driver unloaded successfully.

2007-04-29 13:42 777 --ahs---- C:\WINDOWS\system32\mmf.sys
2007-04-29 13:41 90858 --a------ C:\WINDOWS\system32\perfc015.dat
2007-04-29 13:41 504448 --a------ C:\WINDOWS\system32\perfh015.dat
2007-04-28 20:06 3112 --a------ C:\Program Files\hdpcnkra.txt
2007-04-28 14:52 1668 --a--c--- C:\WINDOWS\mozver.dat
2007-04-23 15:42 704 --a------ C:\DOCUME~1\MATEUSZ\DANEAP~1\update.log
2007-04-18 16:33 -------- d-------- C:\Program Files\skype
2007-04-18 16:20 -------- d-------- C:\DOCUME~1\MATEUSZ\DANEAP~1\skype
2007-04-18 14:55 -------- d-------- C:\Program Files\ikari's chat qlient
2007-04-18 13:20 -------- d-------- C:\Program Files\winamp
2007-04-17 22:17 -------- d-------- C:\Program Files\gadu-gadu
2007-04-17 14:12 -------- d-------- C:\Program Files\trixx
2007-04-17 14:12 -------- d-------- C:\Program Files\messenger
2007-04-12 15:29 4000 --a--c--- C:\ao.dat
2007-04-09 20:00 197886 --a------ C:\Program Files\update.zip
2007-04-06 11:15 -------- d-------- C:\Program Files\k-lite codec pack
2007-04-05 19:26 -------- d-------- C:\Program Files\gameshadow
2007-04-04 22:16 -------- d-------- C:\Program Files\mirc
2007-03-30 08:21 -------- d-------- C:\DOCUME~1\MATEUSZ\DANEAP~1\utorrent
2007-03-30 00:54 -------- d-------- C:\Program Files\utorrent
2007-03-23 19:24 -------- d-------- C:\Program Files\cheating-death
2007-03-23 19:19 -------- d-------- C:\Program Files\vanbasco's karaoke player
2007-03-23 19:06 -------- d-------- C:\Program Files\eskimos r2
2007-03-23 19:06 -------- d-------- C:\Program Files\divx
2007-03-23 18:53 -------- d-------- C:\Program Files\bearshare
2007-03-23 18:52 -------- d-------- C:\Program Files\marbit
2007-03-18 12:39 -------- d--h----- C:\Program Files\installshield installation information
2007-03-18 12:39 -------- d-------- C:\Program Files\deluxe ski jump 3
2007-03-17 15:45 293376 --a------ C:\WINDOWS\system32\winsrv.dll
2007-03-16 21:45 -------- d-------- C:\DOCUME~1\MATEUSZ\DANEAP~1\ganymedenet
2007-03-09 14:34 -------- dr-h----- C:\DOCUME~1\MATEUSZ\DANEAP~1\securom
2007-03-08 17:38 579072 --a------ C:\WINDOWS\system32\user32.dll
2007-03-08 17:38 40960 --a------ C:\WINDOWS\system32\mf3216.dll
2007-03-08 17:38 281600 --a------ C:\WINDOWS\system32\gdi32.dll
2007-03-08 17:37 1843840 --a------ C:\WINDOWS\system32\win32k.sys
2007-03-06 21:15 -------- d-------- C:\Program Files\opera
2007-03-02 23:22 -------- d-------- C:\Program Files\ganymedenet
2007-02-05 22:19 185856 --a------ C:\WINDOWS\system32\upnphost.dll


(((((((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))


*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects]
{761497BB-D6F0-462C-B6EB-D4DAF1D92D43} C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
{F6104497-54FD-4688-9162-5115CC8AB0FB} C:\PROGRA~1\BEARSH~2\BEARSH~2\MediaBar.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run]
"SpeedTouch USB Diagnostics"="\"C:\\Program Files\\Thomson\\SpeedTouch USB\\Dragdiag.exe\" /icon"
"VirtualCloneDrive"="\"C:\\Program Files\\Elaborate Bytes\\VirtualCloneDrive\\VCDDaemon.exe\" /s"
"NWEReboot"=""
"ATIPTA"="\"C:\\Program Files\\ATI Technologies\\ATI Control Panel\\atiptaxx.exe\""
"ATICCC"="\"C:\\Program Files\\ATI Technologies\\ATI.ACE\\cli.exe\" runtime"
"TRIXX"="\"C:\\Program Files\\TRIXX\\TRIXX.exe\" -s"
"SoundMan"="SOUNDMAN.EXE"
"Anti-Blaxx Manager"="C:\\Program Files\\Anti-Blaxx\\Anti-Blaxx.exe"
"SunJavaUpdateSched"="C:\\Program Files\\Java\\jre1.5.0_09\\bin\\jusched.exe"
"avast!"="C:\\PROGRA~1\\Alwil Software\\Avast4\\ashDisp.exe"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run]
"Gadu-Gadu"="\"C:\\Program Files\\Gadu-Gadu\\gg.exe\" /tray"
"MSMSGS"="\"C:\\Program Files\\Messenger\\msmsgs.exe\" /background"
"updateMgr"="\"C:\\Program Files\\Adobe\\Acrobat 7.0\\Reader\\AdobeUpdateManager.exe\" AcRdB7_0_7 -reboot 1"
"NBJ"="\"C:\\Program Files\\Ahead\\Nero BackItUp\\NBJ.exe\""

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{09129E55-4ADE-475A-B32D-B960DB0BA5E0}"=""

HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa
Authentication Packages REG_MULTI_SZ msv1_0\0\0
Security Packages REG_MULTI_SZ kerberos\0msv1_0\0schannel\0wdigest\0\0
Notification Packages REG_MULTI_SZ scecli\0\0


[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Svchost]
HTTPFilter REG_MULTI_SZ HTTPFilter\0\0
LocalService REG_MULTI_SZ Alerter\0WebClient\0LmHosts\0RemoteRegistry\0upnphost\0SSDPSRV\0\0
NetworkService REG_MULTI_SZ DnsCache\0\0
DcomLaunch REG_MULTI_SZ DcomLaunch\0TermService\0\0
rpcss REG_MULTI_SZ RpcSs\0\0
imgsvc REG_MULTI_SZ StiSvc\0\0
termsvcs REG_MULTI_SZ TermService\0\0


[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{979fc5eb-562f-11db-bb98-000e5024e946}]
Shell\AutoRun\command H:\Autorun.exe

********************************************************************

catchme 0.3.660 W2K/XP/Vista - userland rootkit detector by Gmer, http://www.gmer.net
Rootkit scan 2007-04-29 13:44:22
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden services ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0


********************************************************************

Completion time: 07-04-29 13:44:49 - machine was rebooted
C:\ComboFix-quarantined-files.txt ... 07-04-29 13:44
C:\ComboFix2.txt ... 07-04-29 13:39

[wojtas]

Użyj narzędzia Rustock.b-fix
http://www.unicorn.ksiezyc.pl/cyber/index.php/topic,1247.0.html

Pobierz i uruchom narzędzie : The Avenger
http://swandog46.geekstogo.com/avenger.zip
Zaznacz opcję Input script manually i kliknij na Lupkę z prawej strony. W okienku, które się otworzy wklejasz:

Files to delete:

C:\WINDOWS\system32\tmp.reg
C:\WINDOWS\installer.exe
C:\WINDOWS\system32\mmf.sys
C:\Program Files\hdpcnkra.txt
C:\Program Files\update.zip
C:\DOCUME~1\MATEUSZ\DANEAP~1\update.log

Folders to delete:

C:\Program Files\BearShare Applications
C:\DOCUME~1\ALLUSE~1\DANEAP~1\WinAntiVirus Pro 2006
C:\DOCUME~1\MATEUSZ\DANEAP~1\WinAntiVirus Pro 2006
C:\Program Files\WinAntiVirus Pro 2006

Klikasz Done, a następnie zielone światełko i zgadzasz się na restart klikając OK.


Kasujesz ręcznie z dysku plik: C:\Avenger\backup.zip i wklejasz na forum raport: C:\avenger.txt + log z combfixa

[ostry99]

Kod: Zaznacz wszystko

Logfile of The Avenger version 1, by Swandog46
Running from registry key:
\Registry\Machine\System\CurrentControlSet\Services\kwyxuygk

*******************

Script file located at: \??\C:\Documents and Settings\pglfsrox.txt
Script file opened successfully.

Script file read successfully

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

File C:\WINDOWS\system32\tmp.reg deleted successfully.
File C:\WINDOWS\installer.exe deleted successfully.
File C:\WINDOWS\system32\mmf.sys deleted successfully.
File C:\Program Files\hdpcnkra.txt deleted successfully.
File C:\Program Files\update.zip deleted successfully.
File C:\DOCUME~1\MATEUSZ\DANEAP~1\update.log deleted successfully.
Folder C:\Program Files\BearShare Applications deleted successfully.
Folder C:\DOCUME~1\ALLUSE~1\DANEAP~1\WinAntiVirus Pro 2006 deleted successfully.
Folder C:\DOCUME~1\MATEUSZ\DANEAP~1\WinAntiVirus Pro 2006 deleted successfully.


Could not delete folder C:\Program Files\WinAntiVirus Pro 2006
Deletion of folder C:\Program Files\WinAntiVirus Pro 2006 failed!

Could not process line:
C:\Program Files\WinAntiVirus Pro 2006
Status: 0xc0000035


Completed script processing.

*******************

Finished!  Terminate.

Kod: Zaznacz wszystko


"MATEUSZ" - 07-04-29 18:51:30    Dodatek Service Pack 2 
ComboFix 07-04-25.4V - Running from: "C:\Documents and Settings\MATEUSZ\Pulpit\"


((((((((((((((((((((((((((((((((((((((((((((   Other Deletions   )))))))))))))))))))))))))))))))))))))))))))))))))


~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~    Purity    ~ ~ ~ ~ ~ ~ ~ ~~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~
Folders Quarantined:
C:\qoobox\purity\C\Program Files\Common Files\YMBOLS~1
C:\qoobox\purity\C\WINDOWS\SEMBLY~1
C:\qoobox\purity\C\WINDOWS\SEMBLY~1\??sembly
C:\qoobox\purity\C\WINDOWS\SEMBLY~1\??sembly\ctxad-552.0000
C:\qoobox\purity\C\WINDOWS\SEMBLY~1\??sembly\ctxad-552.0001
C:\qoobox\purity\C\WINDOWS\SEMBLY~1\??sembly\ctxad-552.0002


(((((((((((((((((((((((((((((((   Files Created from 2007-03-28 to 2007-04-29  ))))))))))))))))))))))))))))))))))


2007-04-29 18:47   <DIR>   d----c---   C:\avenger
2007-04-29 18:46   777   --ahs----   C:\WINDOWS\system32\mmf.sys
2007-04-29 18:36   <DIR>   d----c---   C:\Rustbfix
2007-04-29 16:39   <DIR>   d----c---   C:\Microgaming
2007-04-29 16:39   <DIR>   d--------   C:\WINDOWS\system32\FlashAX
2007-04-29 13:39   49,152   --a------   C:\WINDOWS\nircmd.exe
2007-04-29 11:10   <DIR>   d----c---   C:\VundoFix Backups
2007-04-29 11:09   <DIR>   d--hs----   C:\WINDOWS\CSC
2007-04-28 14:50   0   --a------   C:\WINDOWS\nsreg.dat
2007-04-28 14:48   524,288   --ah-----   C:\DOCUME~1\ADMINI~1\NTUSER.DAT
2007-04-28 14:48   <DIR>   dr-h-c---   C:\DOCUME~1\ADMINI~1\Dane aplikacji
2007-04-28 14:48   <DIR>   dr---c---   C:\DOCUME~1\ADMINI~1\Menu Start
2007-04-28 14:48   <DIR>   d--h-c---   C:\DOCUME~1\ADMINI~1\Ustawienia lokalne
2007-04-28 14:48   <DIR>   d--h-c---   C:\DOCUME~1\ADMINI~1\Szablony
2007-04-28 14:48   <DIR>   d----c---   C:\DOCUME~1\ADMINI~1\Ulubione
2007-04-28 14:48   <DIR>   d----c---   C:\DOCUME~1\ADMINI~1\Pulpit
2007-04-28 14:48   <DIR>   d----c---   C:\DOCUME~1\ADMINI~1\Moje dokumenty
2007-04-27 21:00   <DIR>   d--------   C:\DOCUME~1\MATEUSZ\DANEAP~1\BearShare
2007-04-27 15:59   25,719   --a--c---   C:\smitfrau.reg
2007-04-27 15:59   16,824   --a--c---   C:\replace.cmd
2007-04-27 15:50   <DIR>   d----c---   C:\smitRem
2007-04-26 19:20   53,248   --a------   C:\WINDOWS\system32\Process.exe
2007-04-26 19:20   51,200   --a------   C:\WINDOWS\system32\dumphive.exe
2007-04-26 19:20   288,417   --a------   C:\WINDOWS\system32\SrchSTS.exe
2007-04-26 16:49   4   --a------   C:\WINDOWS\system32\stfv.bin
2007-04-26 16:10   12   --a------   C:\WINDOWS\system32\sl.bin
2007-04-26 16:08   12   --a------   C:\WINDOWS\system32\gtv_sd.bin
2007-04-25 16:33   94,552   --a------   C:\WINDOWS\system32\drivers\aswmon2.sys
2007-04-25 16:33   90,112   --a------   C:\WINDOWS\system32\AvastSS.scr
2007-04-25 16:33   85,952   --a------   C:\WINDOWS\system32\drivers\aswmon.sys
2007-04-25 16:33   733,824   --a------   C:\WINDOWS\system32\aswBoot.exe
2007-04-25 16:33   43,176   --a------   C:\WINDOWS\system32\drivers\aswTdi.sys
2007-04-25 16:33   26,888   --a------   C:\WINDOWS\system32\drivers\aavmker4.sys
2007-04-25 16:33   23,416   --a------   C:\WINDOWS\system32\drivers\aswRdr.sys
2007-04-23 16:51   196,608   --a------   C:\WINDOWS\system32\ssleay32.dll
2007-04-23 16:51   1,040,384   --a------   C:\WINDOWS\system32\libeay32.dll
2007-04-23 15:42   <DIR>   d--------   C:\Program Files\Common Files\Companion Wizard
2007-04-23 15:39   8,704   --a------   C:\WINDOWS\system32\SpOrder.dll
2007-04-23 15:39   <DIR>   d--hsc---   C:\WA6P
2007-04-23 15:39   <DIR>   d--------   C:\Program Files\WinAntiVirus Pro 2006
2007-04-09 14:01   <DIR>   d--------   C:\DOCUME~1\NETWOR~1\Menu Start
2007-04-06 11:15   856,064   --a------   C:\WINDOWS\system32\xvidcore.dll
2007-04-06 11:15   <DIR>   d----c---   C:\DOCUME~1\ALLUSE~1\DANEAP~1\Apple Computer
2007-04-04 14:49   <DIR>   d--h-----   C:\WINDOWS\$hf_mig$
2007-03-28 23:07   <DIR>   d--------   C:\Program Files\AidemMedia


((((((((((((((((((((((((((((((((((((((((((((((((   Find3M Report   )))))))))))))))))))))))))))))))))))))))))))))))))))))


2007-04-29 18:53   --------   d--------   C:\DOCUME~1\MATEUSZ\DANEAP~1\microgaming
2007-04-29 18:50   92946   --a------   C:\WINDOWS\system32\perfc015.dat
2007-04-29 18:50   510460   --a------   C:\WINDOWS\system32\perfh015.dat
2007-04-29 16:57   4000   --a--c---   C:\ao.dat
2007-04-28 14:52   1668   --a--c---   C:\WINDOWS\mozver.dat
2007-04-18 16:33   --------   d--------   C:\Program Files\skype
2007-04-18 16:20   --------   d--------   C:\DOCUME~1\MATEUSZ\DANEAP~1\skype
2007-04-18 14:55   --------   d--------   C:\Program Files\ikari's chat qlient
2007-04-18 13:20   --------   d--------   C:\Program Files\winamp
2007-04-17 22:17   --------   d--------   C:\Program Files\gadu-gadu
2007-04-17 14:12   --------   d--------   C:\Program Files\trixx
2007-04-17 14:12   --------   d--------   C:\Program Files\messenger
2007-04-06 11:15   --------   d--------   C:\Program Files\k-lite codec pack
2007-04-05 19:26   --------   d--------   C:\Program Files\gameshadow
2007-04-04 22:16   --------   d--------   C:\Program Files\mirc
2007-03-30 08:21   --------   d--------   C:\DOCUME~1\MATEUSZ\DANEAP~1\utorrent
2007-03-30 00:54   --------   d--------   C:\Program Files\utorrent
2007-03-23 19:24   --------   d--------   C:\Program Files\cheating-death
2007-03-23 19:19   --------   d--------   C:\Program Files\vanbasco's karaoke player
2007-03-23 19:06   --------   d--------   C:\Program Files\eskimos r2
2007-03-23 19:06   --------   d--------   C:\Program Files\divx
2007-03-23 18:53   --------   d--------   C:\Program Files\bearshare
2007-03-23 18:52   --------   d--------   C:\Program Files\marbit
2007-03-18 12:39   --------   d--h-----   C:\Program Files\installshield installation information
2007-03-18 12:39   --------   d--------   C:\Program Files\deluxe ski jump 3
2007-03-17 15:45   293376   --a------   C:\WINDOWS\system32\winsrv.dll
2007-03-16 21:45   --------   d--------   C:\DOCUME~1\MATEUSZ\DANEAP~1\ganymedenet
2007-03-09 14:34   --------   dr-h-----   C:\DOCUME~1\MATEUSZ\DANEAP~1\securom
2007-03-08 17:38   579072   --a------   C:\WINDOWS\system32\user32.dll
2007-03-08 17:38   40960   --a------   C:\WINDOWS\system32\mf3216.dll
2007-03-08 17:38   281600   --a------   C:\WINDOWS\system32\gdi32.dll
2007-03-08 17:37   1843840   --a------   C:\WINDOWS\system32\win32k.sys
2007-03-06 21:15   --------   d--------   C:\Program Files\opera
2007-03-02 23:22   --------   d--------   C:\Program Files\ganymedenet
2007-02-05 22:19   185856   --a------   C:\WINDOWS\system32\upnphost.dll


((((((((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))


*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects]
{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}   C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
{F6104497-54FD-4688-9162-5115CC8AB0FB}   C:\PROGRA~1\BEARSH~2\BEARSH~2\MediaBar.dll [x]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run]
"SpeedTouch USB Diagnostics"="\"C:\\Program Files\\Thomson\\SpeedTouch USB\\Dragdiag.exe\" /icon"
"VirtualCloneDrive"="\"C:\\Program Files\\Elaborate Bytes\\VirtualCloneDrive\\VCDDaemon.exe\" /s"
"NWEReboot"=""
"ATIPTA"="\"C:\\Program Files\\ATI Technologies\\ATI Control Panel\\atiptaxx.exe\""
"ATICCC"="\"C:\\Program Files\\ATI Technologies\\ATI.ACE\\cli.exe\" runtime"
"TRIXX"="\"C:\\Program Files\\TRIXX\\TRIXX.exe\" -s"
"SoundMan"="SOUNDMAN.EXE"
"Anti-Blaxx Manager"="C:\\Program Files\\Anti-Blaxx\\Anti-Blaxx.exe"
"SunJavaUpdateSched"="C:\\Program Files\\Java\\jre1.5.0_09\\bin\\jusched.exe"
"avast!"="C:\\PROGRA~1\\Alwil Software\\Avast4\\ashDisp.exe"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run]
"Gadu-Gadu"="\"C:\\Program Files\\Gadu-Gadu\\gg.exe\" /tray"
"MSMSGS"="\"C:\\Program Files\\Messenger\\msmsgs.exe\" /background"
"updateMgr"="\"C:\\Program Files\\Adobe\\Acrobat 7.0\\Reader\\AdobeUpdateManager.exe\" AcRdB7_0_7 -reboot 1"
"NBJ"="\"C:\\Program Files\\Ahead\\Nero BackItUp\\NBJ.exe\""

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{09129E55-4ADE-475A-B32D-B960DB0BA5E0}"=""

HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa
   Authentication Packages   REG_MULTI_SZ      msv1_0\0\0
   Security Packages   REG_MULTI_SZ      kerberos\0msv1_0\0schannel\0wdigest\0\0
   Notification Packages   REG_MULTI_SZ      scecli\0\0


[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Svchost]
HTTPFilter   REG_MULTI_SZ      HTTPFilter\0\0
LocalService   REG_MULTI_SZ      Alerter\0WebClient\0LmHosts\0RemoteRegistry\0upnphost\0SSDPSRV\0\0
NetworkService   REG_MULTI_SZ      DnsCache\0\0
DcomLaunch   REG_MULTI_SZ      DcomLaunch\0TermService\0\0
rpcss   REG_MULTI_SZ      RpcSs\0\0
imgsvc   REG_MULTI_SZ      StiSvc\0\0
termsvcs   REG_MULTI_SZ      TermService\0\0


[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{979fc5eb-562f-11db-bb98-000e5024e946}]
Shell\AutoRun\command   H:\Autorun.exe

********************************************************************

catchme 0.3.660 W2K/XP/Vista - userland rootkit detector by Gmer, http://www.gmer.net
Rootkit scan 2007-04-29 18:54:26
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden services ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0


********************************************************************

Completion time: 07-04-29 18:54:37
C:\ComboFix-quarantined-files.txt ... 07-04-29 18:54
C:\ComboFix3.txt ... 07-04-29 13:39

[wojtas]

sciagnij gmera:

http://gmer.net/gmer.zip

W Gmerze w zakładce CMD z zaznaczoną opcją CMD.EXE wklej:

gmer -killall
gmer -del file C:\WINDOWS\system32\mmf.sys
gmer -del file C:\VundoFix Backups
gmer -del file C:\Program Files\WinAntiVirus Pro 2006
gmer –reboot

potem te pliki :

C:\WINDOWS\system32\stfv.bin
C:\WINDOWS\system32\sl.bin
C:\WINDOWS\system32\gtv_sd.bin

wrzuc na skanery

http://virusscan.jotti.org/
http://www.virustotal.com/

powiedz czy cos wykryly

potem logi z gmera w opcji:

1. Zakładka Rootkit >>> zaznaczone wszystko oprócz Pokazuj wszystko >>> kliknij Szukaj >>> czekaj cierpliwie aż skończy >>> Kopiuj >>> wklej do posta
2. Zakładka Rootkit >>> zaznaczone tylko Usługi i Pokazuj wszystko >>> kliknij Szukaj >>> czekaj cierpliwie aż skończy >>> Kopiuj >>> wklej do posta

oraz combofix

wrzuc te 3 logi na rapida

[ostry99]

Te pliki z gmera gdy wkleje to pozniej kliknac uruchom czy po prostu ok ? Gdy klikam uruchom to wyskakuje jakis blad.

Skanery nic nie wykryly.

Podczas robienia tego 1 loga z gmera wyskoczył bląd i komputer sie sam wylaczyl.

[prog]

Daj combofixa i drugi log z gmera.

[ostry99]

http://rs77.rapidshare.com/files/28710959/gmer.txt

http://rapidshare.com/files/28711188/ComboFix.txt.html

[wojtas]

Wklej do Notatnika:

gmer -del file C:\qoobox
gmer -del file C:\WINDOWS\system32\mmf.sys
gmer -del file C:\Program Files\WinAntiVirus Pro 2006
gmer -reboot

Plik >>> zapisz jako >>> zmien rozszerzenie z TXT na wszystkie typy plików >>> zapisz pod nazwa FIX.BAT

Uruchamiasz Gmera, w zakładce Procesy wybierasz Gmer Awaryjny. Komp się zresetuje i uruchomi się Gmer. Wybierasz znów zakładkę Procesy i na dole w Poleceniu przez trzy kropki wskazujesz plik FIX.BAT po czym go uruchamiasz. (dwuklik)