prosze o sprawdzenie loga

[użytkownik]

Kod: Zaznacz wszystko

Logfile of HijackThis v1.99.1
Scan saved at 15:20:04, on 2007-06-11
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe
C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\cisvc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
C:\Program Files\WinFast\WFTVFM\WFWIZ.exe
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe
C:\Program Files\LClock\LClock.exe
C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe
C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe
C:\Program Files\Common Files\Teleca Shared\CapabilityManager.exe
C:\Program Files\Common Files\Teleca Shared\Generic.exe
C:\Program Files\Sony Ericsson\Mobile2\Mobile Phone Monitor\epmworker.exe
C:\Program Files\Opera\Opera.exe
C:\Program Files\foobar2000\foobar2000.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\TGTSoft\StyleXP\StyleXP.exe
C:\PROGRA~1\Wapster\AQQ\AQQ.exe
C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleil.exe
C:\WINDOWS\BricoPacks\Vista Inspirat\ObjectDock\ObjectDock.exe
C:\WINDOWS\BricoPacks\Vista Inspirat\YzToolbar\YzToolBar.exe
C:\Program Files\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.windowsxlive.net/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.windowsxlive.net
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 127.0.0.1:4001
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {192c5b4a-3efd-40c7-9f99-c472deb8efc0} - C:\Program Files\QualityCodec\isaddon.dll (file missing)
O2 - BHO: PK IE Plugin - {1E1B2879-88FF-11D3-8D96-D7ACAC95951A} - C:\WINDOWS\system32\bpkwb.dll (file missing)
O2 - BHO: IeCatch5 Class - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\PROGRA~1\FlashGet\jccatch.dll
O2 - BHO: URLLink - {4A2AACF3-ADF6-11D5-98A9-00E018981B9E} - C:\Program Files\NewDotNet\newdotnet7_48.dll (file missing)
O2 - BHO: MEGAUPLOADTOOLBAR - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O2 - BHO: Mega Manager IE Click Monitor - {bf00e119-21a3-4fd1-b178-3b8537e75c92} - C:\Program Files\Megaupload\Mega Manager\MegaIEMn.dll
O2 - BHO: TGTSoft Explorer Toolbar Changer - {C333CF63-767F-4831-94AC-E683D962C63C} - C:\Program Files\TGTSoft\StyleXP\TGT_BHO.dll
O2 - BHO: gFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\PROGRA~1\FlashGet\getflash.dll
O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\fgiebar.dll
O3 - Toolbar: Protection Bar - {bf1ced2c-4b3f-4079-a330-864eda5a4cff} - C:\Program Files\QualityCodec\iesplugin.dll (file missing)
O3 - Toolbar: MEGAUPLOADTOOLBAR - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL
O3 - Toolbar: ImageShack Toolbar - {6932D140-ABC4-4073-A44C-D4A541665E35} - C:\WINDOWS\ImageShackToolbar\ImageShackToolbar.dll
O3 - Toolbar: TextAloud - {F053C368-5458-45B2-9B4D-D8914BDDDBFF} - C:\PROGRA~1\TEXTAL~1\TAForIE.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [WinFast Schedule] C:\Program Files\WinFast\WFTVFM\WFWIZ.exe
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [kis] "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe"
O4 - HKLM\..\Run: [DAEMON Tools] "c:\Program Files\DAEMON Tools\daemon.exe" -lang 1045
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [NVMixerTray] "C:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe"
O4 - HKLM\..\Run: [bpk] C:\WINDOWS\system32\bpk.exe
O4 - HKLM\..\Run: [LClock] C:\Program Files\LClock\LClock.exe
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Media Player Classic\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe"
O4 - HKLM\..\Run: [New.net Startup] rundll32 C:\PROGRA~1\NEWDOT~1\NEWDOT~2.DLL,ClientStartup -s
O4 - HKLM\..\Run: [Trickler] "c:\progra~1\2findm~1\partner\trickl~1.exe"
O4 - HKLM\..\Run: [Sony Ericsson PC Suite] "C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions
O4 - HKCU\..\Run: [Dzieńdobry!] \\Bogus\Różne programy\Dzieńdobry!\dziendobry.exe /auto
O4 - HKCU\..\Run: [Hide IP Platinum] C:\Program Files\Hide IP Platinum\hideippla.exe
O4 - HKCU\..\Run: [TransBar] C:\Documents and Settings\Bogdan\Ustawienia lokalne\Dane aplikacji\AKSoftware\TransBar\TransBar.exe /s
O4 - HKCU\..\Run: [STYLEXP] C:\Program Files\TGTSoft\StyleXP\StyleXP.exe -Hide
O4 - HKCU\..\Run: [AQQ] C:\PROGRA~1\Wapster\AQQ\AQQ.exe
O4 - HKCU\..\Run: [ctfnon] C:\Program Files\ctfnon.exe
O4 - HKCU\..\Run: [FreeCall] "C:\Program Files\FreeCall.com\FreeCall\FreeCall.exe" -nosplash -minimized
O4 - Startup: Stardock ObjectDock.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat\ObjectDock\ObjectDock.exe
O4 - Startup: Y'z ToolBar.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat\YzToolbar\YzToolBar.exe
O4 - Global Startup: BlueSoleil.lnk = ?
O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/toolbaredits/menusearch.jhtml?p=ZC
O8 - Extra context menu item: Download All by FlashGet - C:\Program Files\FlashGet\jc_all.htm
O8 - Extra context menu item: Download Link Using Mega Manager... - C:\Program Files\Megaupload\Mega Manager\mm_file.htm
O8 - Extra context menu item: Download using FlashGet - C:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: Post Image to Blog - res://C:\WINDOWS\ImageShackToolbar\ImageShackToolbar.dll/5003
O8 - Extra context menu item: Tag This Image - res://C:\WINDOWS\ImageShackToolbar\ImageShackToolbar.dll/5002
O8 - Extra context menu item: Upload All Images to ImageShack - res://C:\WINDOWS\ImageShackToolbar\ImageShackToolbar.dll/5000
O8 - Extra context menu item: Upload Image to ImageShack - res://C:\WINDOWS\ImageShackToolbar\ImageShackToolbar.dll/5001
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra button: Run WinHTTrack - {36ECAF82-3300-8F84-092E-AFF36D6C7040} - C:\Program Files\WinHTTrack\WinHTTrackIEBar.dll
O9 - Extra 'Tools' menuitem: Launch WinHTTrack - {36ECAF82-3300-8F84-092E-AFF36D6C7040} - C:\Program Files\WinHTTrack\WinHTTrackIEBar.dll
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe
O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O10 - Unknown file in Winsock LSP: c:\program files\bonjour\mdnsnsp.dll
O15 - Trusted Zone: http://toolbar.imageshack.us
O16 - DPF: {6932D140-ABC4-4073-A44C-D4A541665E35} (ImageShack Toolbar) - http://toolbar.imageshack.us/toolbar/ImageShackToolbar.cab
O16 - DPF: {AB86CE53-AC9F-449F-9399-D8ABCA09EC09} (Get_ActiveX Control) - https://h17000.www1.hp.com/ewfrf-JAVA/Secure/HPGetDownloadManager.ocx
O17 - HKLM\System\CCS\Services\Tcpip\..\{0C5C7E94-0529-4F1F-AACD-96943AC51169}: NameServer = 194.204.152.1
O17 - HKLM\System\CCS\Services\Tcpip\..\{F63B2554-383F-4136-8FF6-6F7156690075}: NameServer = 192.168.0.1
O17 - HKLM\System\CS1\Services\Tcpip\..\{0C5C7E94-0529-4F1F-AACD-96943AC51169}: NameServer = 194.204.152.1
O17 - HKLM\System\CS2\Services\Tcpip\..\{0C5C7E94-0529-4F1F-AACD-96943AC51169}: NameServer = 194.204.152.1
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O21 - SSODL: bonspells - {11853d5f-f894-4cc7-bbc3-fc7a9dcfd896} - C:\WINDOWS\system32\okkmtv.dll (file missing)
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Kaspersky Internet Security 6.0 (AVP) - Unknown owner - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe" -r (file missing)
O23 - Service: BlueSoleil Hid Service - Unknown owner - C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: StyleXPService - Unknown owner - C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe



no wiec sparwa wyglada tak:
gdy chce wlaczyc opere to najpeierw musze dlugo czekac i dopiero zaczyna sie ladowac opera a przez ten czas oczekiwania w ogole nie dziala dysk
jest trak taz z innymi programammi (foobar2000, dziobas rar player, ale z Allplayerem tak nie mam )
pomocy
z gory thx za odp.

[Red]

O2 - BHO: (no name) - {192c5b4a-3efd-40c7-9f99-c472deb8efc0} - C:\Program Files\QualityCodec\isaddon.dll (file missing)
O2 - BHO: PK IE Plugin - {1E1B2879-88FF-11D3-8D96-D7ACAC95951A} - C:\WINDOWS\system32\bpkwb.dll (file missing)
O2 - BHO: URLLink - {4A2AACF3-ADF6-11D5-98A9-00E018981B9E} - C:\Program Files\NewDotNet\newdotnet7_48.dll (file missing)
O3 - Toolbar: Protection Bar - {bf1ced2c-4b3f-4079-a330-864eda5a4cff} - C:\Program Files\QualityCodec\iesplugin.dll (file missing)
O4 - HKLM\..\Run: [New.net Startup] rundll32 C:\PROGRA~1\NEWDOT~1\NEWDOT~2.DLL,ClientStartup -s
O4 - HKLM\..\Run: [Trickler] "c:\progra~1\2findm~1\partner\trickl~1.exe"
O4 - HKCU\..\Run: [ctfnon] C:\Program Files\ctfnon.exe
O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/toolbaredits/menusearch.jhtml?p=ZC
O21 - SSODL: bonspells - {11853d5f-f894-4cc7-bbc3-fc7a9dcfd896} - C:\WINDOWS\system32\okkmtv.dll (file missing)

Autor postu otrzymał pochwałę

[użytkownik]

sory ze jetem takim tlumanem ale cytowales to i co? nie wiem co mam zrobic???

[wojtas]

w awaryjnym skasuj podane wpisy oraz pogrubione wywal do kosza potem nowy log

[użytkownik]

O2 - BHO: (no name) - {192c5b4a-3efd-40c7-9f99-c472deb8efc0} - C:\Program Files\QualityCodec\isaddon.dll (file missing)
O2 - BHO: PK IE Plugin - {1E1B2879-88FF-11D3-8D96-D7ACAC95951A} - C:\WINDOWS\system32\bpkwb.dll (file missing)
O2 - BHO: URLLink - {4A2AACF3-ADF6-11D5-98A9-00E018981B9E} - C:\Program Files\NewDotNet\newdotnet7_48.dll (file missing)
O3 - Toolbar: Protection Bar - {bf1ced2c-4b3f-4079-a330-864eda5a4cff} - C:\Program Files\QualityCodec\iesplugin.dll (file missing)
O4 - HKLM\..\Run: [New.net Startup] rundll32 C:\PROGRA~1\NEWDOT~1\NEWDOT~2.DLL,ClientStartup -s
O4 - HKLM\..\Run: [Trickler] "c:\progra~1\2findm~1\partner\trickl~1.exe"
O4 - HKCU\..\Run: [ctfnon] C:\Program Files\ctfnon.exe
O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/toolbaredits/menusearch.jhtml?p=ZC
O21 - SSODL: bonspells - {11853d5f-f894-4cc7-bbc3-fc7a9dcfd896} - C:\WINDOWS\system32\okkmtv.dll (file missing)

no i

Kod: Zaznacz wszystko

O4 - HKLM\..\Run: [Trickler] "c:\progra~1\2findm~1\partner\trickl~1.exe"
O4 - HKCU\..\Run: [ctfnon] C:\Program Files\[b]ctfnon.exe[/b]


tych dwoch nie moge znalesc zeby je skasowac a tam gdzie pisze film missing to jak ja mam to skasowac jak tych plikow nie ma??

wiem ze jestm przymol ale to moj pierwswzy raz i nie bardzo wiem o co chbodzi

[wojtas]

zastosuj:

smitfraudfix z opcji 2:

http://siri.urz.free.fr/Fix/SmitfraudFix_En.php


skasuj te wpisy i wszystkie pogrubione jakie znajdziesz

potem nowy log z hj oraz z:

http://download.bleepingcomputer.com/sUBs/ComboFix.exe

[użytkownik]

a i ten log z combofix byl robiony w trybie awaryjnym nie wiem czy to cos zmienia dlatego pisze

Kod: Zaznacz wszystko

ComboFix 07-06-11.3 - BˆĄd CScript: Dost©p do Hosta skrypt˘w systemu Windows jest wyˆĄczony na tym komputerze. Skontaktuj si© z administratorem, aby uzyska† szczeg˘ˆowe informacje.
"Administrator" - 2007-06-11 17:16:58 - Dodatek Service Pack 2  NTFS  [SAFE MODE]


(((((((((((((((((((((((((((((((((((((((   Other Deletions   )))))))))))))))))))))))))))))))))))))))))))))))))


C:\Program Files\webhancer
C:\Program Files\webhancer\Programs\license.txt
C:\Program Files\webhancer\Programs\readme.txt
C:\Program Files\webhancer\Programs\whAgent.ini


(((((((((((((((((((((((((((((((((((((((   Drivers/Services   )))))))))))))))))))))))))))))))))))))))))))))))))


-------\LEGACY_WINDOWS_LOG


(((((((((((((((((((((((((   Files Created from 2007-05-11 to 2007-06-11  )))))))))))))))))))))))))))))))


2007-06-11 17:14   552   --a------   C:\WINDOWS\system32\d3d8caps.dat
2007-06-11 17:10   49,152   --a------   C:\WINDOWS\nircmd.exe
2007-06-11 17:08   3,818   --a------   C:\WINDOWS\system32\tmp.reg
2007-06-11 17:07   53,248   --a------   C:\WINDOWS\system32\Process.exe
2007-06-11 17:07   51,200   --a------   C:\WINDOWS\system32\dumphive.exe
2007-06-11 17:07   288,417   --a------   C:\WINDOWS\system32\SrchSTS.exe
2007-06-11 17:07   <DIR>   d--------   C:\DOCUME~1\ADMINI~1\SmitfraudFix
2007-06-11 16:19   <DIR>   d--------   C:\DOCUME~1\ADMINI~1\DANEAP~1\Opera
2007-06-11 16:18   786,432   --ah-----   C:\DOCUME~1\ADMINI~1\NTUSER.DAT
2007-06-11 16:18   <DIR>   dr-h-----   C:\DOCUME~1\ADMINI~1\Dane aplikacji
2007-06-11 16:18   <DIR>   dr-------   C:\DOCUME~1\ADMINI~1\Menu Start
2007-06-11 16:18   <DIR>   d--h-----   C:\DOCUME~1\ADMINI~1\Ustawienia lokalne
2007-06-11 16:18   <DIR>   d--h-----   C:\DOCUME~1\ADMINI~1\Szablony
2007-06-11 16:18   <DIR>   d--------   C:\WINDOWS\CSC
2007-06-11 16:18   <DIR>   d--------   C:\DOCUME~1\ADMINI~1\Ulubione
2007-06-11 16:18   <DIR>   d--------   C:\DOCUME~1\ADMINI~1\Pulpit
2007-06-11 16:18   <DIR>   d--------   C:\DOCUME~1\ADMINI~1\Moje dokumenty
2007-06-10 19:43   52,788   --a------   C:\WINDOWS\desctemp.dat
2007-06-03 18:23   <DIR>   d--------   C:\DOCUME~1\Bogdan\.ultramixer
2007-06-03 17:54   719,872   --a------   C:\WINDOWS\system32\devil.dll
2007-06-03 17:54   7,277,568   --a------   C:\WINDOWS\system32\3gpcore.dll
2007-06-03 17:54   60,273   --a------   C:\WINDOWS\system32\pthreadGC2.dll
2007-06-03 17:54   487,479   --a------   C:\WINDOWS\system32\SkinMagic.dll
2007-06-03 17:54   313,344   --a------   C:\WINDOWS\system32\avisynth.dll
2007-06-03 17:54   <DIR>   d--------   C:\WINDOWS\system32\avsplugin
2007-06-03 17:54   <DIR>   d--------   C:\Program Files\Smallvideosoft
2007-05-30 19:24   <DIR>   d--------   C:\Program Files\Conquer 2.0
2007-05-28 21:27   <DIR>   d--------   C:\Program Files\Magic Photo Editor
2007-05-25 18:49   <DIR>   d--------   C:\DOCUME~1\Bogdan\DANEAP~1\uk.co.planetside
2007-05-24 15:31   <DIR>   d--------   C:\DOCUME~1\Bogdan\DANEAP~1\Eltima Software
2007-05-24 15:30   <DIR>   d--------   C:\Program Files\Eltima Software
2007-05-22 18:11   <DIR>   d--------   C:\Program Files\MyPhoneExplorer
2007-05-22 18:11   <DIR>   d--------   C:\DOCUME~1\Bogdan\DANEAP~1\MyPhoneExplorer
2007-05-22 18:00   <DIR>   d--------   C:\DOCUME~1\Bogdan\DANEAP~1\Teleca
2007-05-22 17:58   <DIR>   d----c---   C:\WINDOWS\system32\DRVSTORE
2007-05-22 17:57   <DIR>   d--------   C:\DOCUME~1\ALLUSE~1\DANEAP~1\Teleca
2007-05-22 17:57   <DIR>   d--------   C:\DOCUME~1\ALLUSE~1\DANEAP~1\Sony Ericsson
2007-05-22 17:06   <DIR>   d--------   C:\DOCUME~1\Bogdan\DANEAP~1\FreeCall
2007-05-17 16:39   <DIR>   d--------   C:\Program Files\Ski Park Manager
2007-05-17 10:13   <DIR>   d--------   C:\Program Files\Damian Pasternak
2007-05-13 18:45   <DIR>   d--------   C:\Program Files\Duran
2007-05-12 12:18   <DIR>   d--------   C:\Program Files\Mad Tracks


((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))

2090-10-13 06:45:56   --------   d-----w   C:\Program Files\Common Files\Adobe Systems Shared
2007-06-10 20:12:41   --------   d-----w   C:\Program Files\FlashGet
2007-06-03 19:51:09   --------   d-----w   C:\Program Files\OpenOffice.org1.1.4
2007-05-30 17:24:27   --------   d--h--w   C:\Program Files\InstallShield Installation Information
2007-05-28 14:15:54   --------   d-----w   C:\Program Files\TextAloud
2007-05-24 12:59:01   --------   d-----w   C:\Program Files\Cream Software
2007-05-24 12:57:55   --------   d-----w   C:\Program Files\Pcsx2
2007-05-24 12:57:02   --------   d-----w   C:\Program Files\filesubmit
2007-05-24 12:56:39   --------   d-----w   C:\Program Files\Kaboom_v55
2007-05-24 12:55:49   --------   d-----w   C:\Program Files\ImageSplitter
2007-05-24 12:55:35   --------   d-----w   C:\Program Files\Hp
2007-05-24 12:52:19   --------   d-----w   C:\Program Files\VSD Software
2007-05-24 12:52:12   --------   d-----w   C:\Program Files\ElcomSoft
2007-05-24 12:51:26   --------   d-----w   C:\Program Files\Fma
2007-05-24 12:51:19   --------   d-----w   C:\Program Files\Google
2007-05-22 15:57:55   --------   d-----w   C:\Program Files\Common Files\Teleca Shared
2007-05-22 15:57:29   --------   d-----w   C:\Program Files\Sony Ericsson
2007-05-19 11:10:55   --------   d-----w   C:\Program Files\eMule
2007-05-17 14:18:11   20,480   ----a-w   C:\WINDOWS\system32\H@tKeysH@@k.DLL
2007-05-16 18:16:02   --------   d-----w   C:\Program Files\ACE-HIGH MP3 WAV WMA OGG Converter
2007-05-16 04:47:52   --------   d-----w   C:\Program Files\English Translator 3
2007-05-09 14:48:20   2,319,616   ----a-w   C:\WINDOWS\system32\kernel1.exe
2007-05-09 12:20:56   --------   d-----w   C:\Program Files\Robin Hood - DotC
2007-05-07 15:55:57   23   ----a-w   C:\WINDOWS\system32\sysmwwod.dll
2007-05-07 15:42:49   --------   d-----w   C:\Program Files\Auvisoft Audio Converter
2007-04-26 08:48:03   3,396   ----a-w   C:\WINDOWS\unins001.dat
2007-04-25 12:46:28   --------   d-----w   C:\Program Files\Bonjour
2007-04-25 12:35:39   --------   d-----w   C:\Program Files\Common Files\Macrovision Shared
2007-04-24 16:10:38   --------   d-----w   C:\Program Files\New Star Soccer 3
2007-04-23 17:15:02   --------   d-----w   C:\Program Files\KoolMoves
2007-04-23 15:10:53   --------   d-----w   C:\Program Files\Rocks'n'Diamonds
2007-04-20 19:55:30   --------   d-----w   C:\Program Files\Blaze Gif Creator
2007-04-20 19:08:39   --------   d-----w   C:\Program Files\Common Files\Xuisoft
2007-04-20 18:58:05   --------   d-----w   C:\Program Files\Selteco
2007-04-18 13:43:43   --------   d-----w   C:\Program Files\Symcom
2007-04-17 14:42:59   --------   d-----w   C:\Program Files\SystemRequirementsLab
2007-04-13 17:28:57   --------   d-----w   C:\Program Files\Opera
2007-04-11 11:17:17   --------   d-----w   C:\Program Files\Gra w ciemno
2007-04-06 16:52:39   2,368   ----a-w   C:\WINDOWS\system32\SVKP.sys
2007-03-30 13:15:14   55,949   ----a-w   C:\WINDOWS\system32\x264-uninstall.exe
2007-03-29 12:58:47   5   ----a-w   C:\WINDOWS\system32\SySVid.dat
2007-03-25 12:26:43   79,188   ----a-w   C:\WINDOWS\system32\perfc015.dat
2007-03-25 12:26:43   457,678   ----a-w   C:\WINDOWS\system32\perfh015.dat
2007-03-21 18:54:16   77,312   ----a-w   C:\WINDOWS\system32\TWAIN_32.DLL
2007-03-21 18:54:16   69,632   ----a-w   C:\WINDOWS\system32\TWUNK_32.EXE
2007-03-21 18:54:16   48,560   ----a-w   C:\WINDOWS\system32\TWUNK_16.EXE
2007-03-13 09:04:32   89,839   ----a-w   C:\WINDOWS\TopMail Uninstaller.exe
2007-03-11 14:56:52   164,352   ----a-w   C:\WINDOWS\system32\SpoonUninstall.exe
2007-03-11 14:56:52   12,325   ----a-w   C:\WINDOWS\system32\SpoonUninstall-Jardinains!.dat
2007-01-22 20:49:09   56   --sh--r   C:\WINDOWS\system32\887958BC3D.sys
2007-01-22 20:49:09   1,682   --sha-w   C:\WINDOWS\system32\KGyGaAvL.sys


(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))


*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects]
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}=C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll [2004-12-14 11:56]
{1E1B2879-88FF-11D3-8D96-D7ACAC95951A}=C:\WINDOWS\system32\bpkwb.dll []
{2F364306-AA45-47B5-9F9D-39A8B94E7EF7}=C:\PROGRA~1\FlashGet\jccatch.dll [2006-05-16 15:19]
{4A2AACF3-ADF6-11D5-98A9-00E018981B9E}=C:\Program Files\NewDotNet\newdotnet7_48.dll []
{4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C}=C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL [2006-10-31 08:55]
{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}=C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll [2006-12-15 04:23]
{bf00e119-21a3-4fd1-b178-3b8537e75c92}=C:\Program Files\Megaupload\Mega Manager\MegaIEMn.dll [2006-12-11 18:46]
{C333CF63-767F-4831-94AC-E683D962C63C}=C:\Program Files\TGTSoft\StyleXP\TGT_BHO.dll [2006-05-10 01:13]
{F156768E-81EF-470C-9057-481BA8380DBA}=C:\PROGRA~1\FlashGet\getflash.dll [2006-09-12 10:50]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"nwiz"="nwiz.exe" [2006-07-26 14:00 C:\WINDOWS\system32\nwiz.exe]
"WinFast Schedule"="C:\Program Files\WinFast\WFTVFM\WFWIZ.exe" [2006-03-20 14:53]
"@"="" []
"DAEMON Tools"="c:\Program Files\DAEMON Tools\daemon.exe" [2005-12-10 16:57]
"NVMixerTray"="C:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe" [2004-12-20 17:12]
"LClock"="C:\Program Files\LClock\LClock.exe" [2004-09-20 02:27]
"RealTray"="C:\Program Files\Media Player Classic\RealPlay.exe" [2007-02-12 16:19]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe" [2006-12-15 04:23]
"Trickler"="c:\progra~1\2findm~1\partner\trickl~1.exe" []
"Sony Ericsson PC Suite"="C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" [2005-10-26 17:17]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-07-26 14:00]
"kis"="C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe" [2006-03-24 19:09]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Dzieńdobry!"="\\Bogus\Różne programy\Dzieńdobry!\dziendobry.exe" []
"Hide IP Platinum"="C:\Program Files\Hide IP Platinum\hideippla.exe" []
"TransBar"="C:\Documents and Settings\Bogdan\Ustawienia lokalne\Dane aplikacji\AKSoftware\TransBar\TransBar.exe" [2005-06-01 21:41]
"STYLEXP"="C:\Program Files\TGTSoft\StyleXP\StyleXP.exe" [2006-05-24 20:31]
"AQQ"="C:\PROGRA~1\Wapster\AQQ\AQQ.exe" [2007-02-28 14:18]
"ctfnon"="C:\Program Files\ctfnon.exe" []
"FreeCall"="C:\Program Files\FreeCall.com\FreeCall\FreeCall.exe" []

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoRemoteRecursiveEvents"=1 (0x1)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoSaveSettings"=0 (0x0)
"NoLowDiskSpaceChecks"=1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Adobe Reader Speed Launch.lnk]
path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Adobe Reader Speed Launch.lnk
backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Bogdan^Menu Start^Programy^Autostart^Adobe Gamma.lnk]
path=C:\Documents and Settings\Bogdan\Menu Start\Programy\Autostart\Adobe Gamma.lnk
backup=C:\WINDOWS\pss\Adobe Gamma.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Bogdan^Menu Start^Programy^Autostart^UniSpiker.lnk]
path=C:\Documents and Settings\Bogdan\Menu Start\Programy\Autostart\UniSpiker.lnk
backup=C:\WINDOWS\pss\UniSpiker.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Blaero Start Orb]
C:\Program Files\Blaero Start Orb\Blaero Start Orb.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
"C:\Program Files\QuickTime\qttask.exe" -atboottime

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Styler]
C:\Program Files\Styler\Styler.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\tasmgr]
C:\Program Files\Internet Explorer\tasmgr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\uerscw]
C:\Program Files\Error Safe Free\uerscw.exe -c

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Vista Sidebar]
C:\Program Files\Vista Sidebar\sidebar.exe


[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c3d24b42-3ddc-11db-9e8a-806d6172696f}]
AutoRun\command- E:\ASUSACPI.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{fd2c46ba-3dce-11db-8772-806d6172696f}]
AutoRun\command- E:\ASUSACPI.exe


Contents of the 'Scheduled Tasks' folder
2006-10-12 12:49:40  C:\WINDOWS\tasks\AppleSoftwareUpdate.job

**************************************************************************

catchme 0.3.721 W2K/XP/Vista - userland rootkit detector by Gmer, http://www.gmer.net
Rootkit scan 2007-06-11 17:19:08
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

Completion time: 2007-06-11 17:22:54 - machine was rebooted
C:\ComboFix-quarantined-files.txt ... 2007-06-11 17:22

   --- E O F ---


Kod: Zaznacz wszystko

Logfile of HijackThis v1.99.1
Scan saved at 18:11, on 2007-06-11
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe
C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
C:\Program Files\WinFast\WFTVFM\WFWIZ.exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe
C:\Program Files\LClock\LClock.exe
C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe
C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe
C:\Program Files\Common Files\Teleca Shared\CapabilityManager.exe
C:\WINDOWS\System32\svchost.exe
\Bogus\Różne programy\Dzieńdobry!\dziendobry.exe
C:\Program Files\TGTSoft\StyleXP\StyleXP.exe
C:\PROGRA~1\Wapster\AQQ\AQQ.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleil.exe
C:\WINDOWS\BricoPacks\Vista Inspirat\ObjectDock\ObjectDock.exe
C:\WINDOWS\BricoPacks\Vista Inspirat\YzToolbar\YzToolBar.exe
C:\Program Files\Common Files\Teleca Shared\Generic.exe
C:\Program Files\Sony Ericsson\Mobile2\Mobile Phone Monitor\epmworker.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Opera\Opera.exe
C:\Program Files\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.windowsxlive.net/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 127.0.0.1:4001
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = L1cza
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: PK IE Plugin - {1E1B2879-88FF-11D3-8D96-D7ACAC95951A} - C:\WINDOWS\system32\bpkwb.dll (file missing)
O2 - BHO: IeCatch5 Class - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\PROGRA~1\FlashGet\jccatch.dll
O2 - BHO: URLLink - {4A2AACF3-ADF6-11D5-98A9-00E018981B9E} - C:\Program Files\NewDotNet\newdotnet7_48.dll (file missing)
O2 - BHO: MEGAUPLOADTOOLBAR - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O2 - BHO: Mega Manager IE Click Monitor - {bf00e119-21a3-4fd1-b178-3b8537e75c92} - C:\Program Files\Megaupload\Mega Manager\MegaIEMn.dll
O2 - BHO: TGTSoft Explorer Toolbar Changer - {C333CF63-767F-4831-94AC-E683D962C63C} - C:\Program Files\TGTSoft\StyleXP\TGT_BHO.dll
O2 - BHO: gFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\PROGRA~1\FlashGet\getflash.dll
O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\fgiebar.dll
O3 - Toolbar: MEGAUPLOADTOOLBAR - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL
O3 - Toolbar: ImageShack Toolbar - {6932D140-ABC4-4073-A44C-D4A541665E35} - C:\WINDOWS\ImageShackToolbar\ImageShackToolbar.dll
O3 - Toolbar: TextAloud - {F053C368-5458-45B2-9B4D-D8914BDDDBFF} - C:\PROGRA~1\TEXTAL~1\TAForIE.dll
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [WinFast Schedule] C:\Program Files\WinFast\WFTVFM\WFWIZ.exe
O4 - HKLM\..\Run: [DAEMON Tools] "c:\Program Files\DAEMON Tools\daemon.exe" -lang 1045
O4 - HKLM\..\Run: [NVMixerTray] "C:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe"
O4 - HKLM\..\Run: [LClock] C:\Program Files\LClock\LClock.exe
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Media Player Classic\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe"
O4 - HKLM\..\Run: [Trickler] "c:\progra~1\2findm~1\partner\trickl~1.exe"
O4 - HKLM\..\Run: [Sony Ericsson PC Suite] "C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions
O4 - HKCU\..\Run: [Dzieńdobry!] \\Bogus\Ró?ne programy\Dziendobry!\dziendobry.exe /auto
O4 - HKCU\..\Run: [Hide IP Platinum] C:\Program Files\Hide IP Platinum\hideippla.exe
O4 - HKCU\..\Run: [TransBar] C:\Documents and Settings\Bogdan\Ustawienia lokalne\Dane aplikacji\AKSoftware\TransBar\TransBar.exe /s
O4 - HKCU\..\Run: [STYLEXP] C:\Program Files\TGTSoft\StyleXP\StyleXP.exe -Hide
O4 - HKCU\..\Run: [AQQ] C:\PROGRA~1\Wapster\AQQ\AQQ.exe
O4 - HKCU\..\Run: [ctfnon] C:\Program Files\ctfnon.exe
O4 - HKCU\..\Run: [FreeCall] "C:\Program Files\FreeCall.com\FreeCall\FreeCall.exe" -nosplash -minimized
O4 - Startup: Stardock ObjectDock.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat\ObjectDock\ObjectDock.exe
O4 - Startup: Y'z ToolBar.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat\YzToolbar\YzToolBar.exe
O4 - Global Startup: BlueSoleil.lnk = ?
O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/toolbaredits/menusearch.jhtml?p=ZC
O8 - Extra context menu item: Download All by FlashGet - C:\Program Files\FlashGet\jc_all.htm
O8 - Extra context menu item: Download Link Using Mega Manager... - C:\Program Files\Megaupload\Mega Manager\mm_file.htm
O8 - Extra context menu item: Download using FlashGet - C:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: Post Image to Blog - res://C:\WINDOWS\ImageShackToolbar\ImageShackToolbar.dll/5003
O8 - Extra context menu item: Tag This Image - res://C:\WINDOWS\ImageShackToolbar\ImageShackToolbar.dll/5002
O8 - Extra context menu item: Upload All Images to ImageShack - res://C:\WINDOWS\ImageShackToolbar\ImageShackToolbar.dll/5000
O8 - Extra context menu item: Upload Image to ImageShack - res://C:\WINDOWS\ImageShackToolbar\ImageShackToolbar.dll/5001
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra button: Run WinHTTrack - {36ECAF82-3300-8F84-092E-AFF36D6C7040} - C:\Program Files\WinHTTrack\WinHTTrackIEBar.dll
O9 - Extra 'Tools' menuitem: Launch WinHTTrack - {36ECAF82-3300-8F84-092E-AFF36D6C7040} - C:\Program Files\WinHTTrack\WinHTTrackIEBar.dll
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe
O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O10 - Unknown file in Winsock LSP: c:\program files\bonjour\mdnsnsp.dll
O15 - Trusted Zone: http://toolbar.imageshack.us
O16 - DPF: {6932D140-ABC4-4073-A44C-D4A541665E35} (ImageShack Toolbar) - http://toolbar.imageshack.us/toolbar/ImageShackToolbar.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{0C5C7E94-0529-4F1F-AACD-96943AC51169}: NameServer = 194.204.152.1
O17 - HKLM\System\CCS\Services\Tcpip\..\{F63B2554-383F-4136-8FF6-6F7156690075}: NameServer = 192.168.0.1
O17 - HKLM\System\CS1\Services\Tcpip\..\{0C5C7E94-0529-4F1F-AACD-96943AC51169}: NameServer = 194.204.152.1
O17 - HKLM\System\CS2\Services\Tcpip\..\{0C5C7E94-0529-4F1F-AACD-96943AC51169}: NameServer = 194.204.152.1
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Kaspersky Internet Security 6.0 (AVP) - Unknown owner - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe" -r (file missing)
O23 - Service: BlueSoleil Hid Service - Unknown owner - C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: StyleXPService - Unknown owner - C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe



[wojtas]

wklej do notatnika:

Windows Registry Editor Version 5.00

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1E1B2879-88FF-11D3-8D96-D7ACAC95951A}]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\BrowserHelper Objects\{4A2AACF3-ADF6-11D5-98A9-00E018981B9E}]

[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\tasmgr]

[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\uerscw]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Trickler"=-

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"TransBar"=-
"ctfnon"=-

w notatniku u góry>>>plik zapisz jako>>>Zmien rozszerzenie z TXT na Wszystkie pliki *.* >>> Zapisz pod nazwą FIX.REG

Klikasz dwa razy na powstały plik fix i dodajesz go do rejestru...

Pobierz i uruchom narzędzie : The Avenger
http://swandog46.geekstogo.com/avenger.zip
Zaznacz opcję Input script manually i kliknij na Lupkę z prawej strony. W okienku, które się otworzy wklejasz:

Files to delete:

C:\WINDOWS\system32\tmp.reg
C:\WINDOWS\system32\kernel1.exe

potem zastosuj:

http://www.spywareedge.net/nolop/NoLop.exe

Kasujesz ręcznie z dysku plik: C:\Avenger\backup.zip i wklejasz na forum raport: C:\avenger.txt + log z combofixa + hijack
Klikasz Done, a następnie zielone światełko i zgadzasz się na restart klikając OK.

[użytkownik]

Kod: Zaznacz wszystko

ComboFix 07-06-11.3 - BˆĄd CScript: Dost©p do Hosta skrypt˘w systemu Windows jest wyˆĄczony na tym komputerze. Skontaktuj si© z administratorem, aby uzyska† szczeg˘ˆowe informacje.
"Bogdan" - 2007-06-12 14:31:25 - Dodatek Service Pack 2  NTFS 


(((((((((((((((((((((((((   Files Created from 2007-05-12 to 2007-06-12  )))))))))))))))))))))))))))))))


2007-06-12 14:17   106   --a------   C:\delete.bat
2007-06-12 14:09   667   --a------   C:\FIX.REG
2007-06-11 17:14   552   --a------   C:\WINDOWS\system32\d3d8caps.dat
2007-06-11 17:10   49,152   --a------   C:\WINDOWS\nircmd.exe
2007-06-11 17:07   53,248   --a------   C:\WINDOWS\system32\Process.exe
2007-06-11 17:07   51,200   --a------   C:\WINDOWS\system32\dumphive.exe
2007-06-11 17:07   288,417   --a------   C:\WINDOWS\system32\SrchSTS.exe
2007-06-11 17:07   <DIR>   d--------   C:\DOCUME~1\ADMINI~1\SmitfraudFix
2007-06-11 16:19   <DIR>   d--------   C:\DOCUME~1\ADMINI~1\DANEAP~1\Opera
2007-06-11 16:18   786,432   --ah-----   C:\DOCUME~1\ADMINI~1\NTUSER.DAT
2007-06-11 16:18   <DIR>   dr-h-----   C:\DOCUME~1\ADMINI~1\Dane aplikacji
2007-06-11 16:18   <DIR>   dr-------   C:\DOCUME~1\ADMINI~1\Menu Start
2007-06-11 16:18   <DIR>   d--h-----   C:\DOCUME~1\ADMINI~1\Ustawienia lokalne
2007-06-11 16:18   <DIR>   d--h-----   C:\DOCUME~1\ADMINI~1\Szablony
2007-06-11 16:18   <DIR>   d--------   C:\WINDOWS\CSC
2007-06-11 16:18   <DIR>   d--------   C:\DOCUME~1\ADMINI~1\Ulubione
2007-06-11 16:18   <DIR>   d--------   C:\DOCUME~1\ADMINI~1\Pulpit
2007-06-11 16:18   <DIR>   d--------   C:\DOCUME~1\ADMINI~1\Moje dokumenty
2007-06-10 19:43   52,788   --a------   C:\WINDOWS\desctemp.dat
2007-06-03 18:23   <DIR>   d--------   C:\DOCUME~1\Bogdan\.ultramixer
2007-06-03 17:54   719,872   --a------   C:\WINDOWS\system32\devil.dll
2007-06-03 17:54   7,277,568   --a------   C:\WINDOWS\system32\3gpcore.dll
2007-06-03 17:54   60,273   --a------   C:\WINDOWS\system32\pthreadGC2.dll
2007-06-03 17:54   487,479   --a------   C:\WINDOWS\system32\SkinMagic.dll
2007-06-03 17:54   313,344   --a------   C:\WINDOWS\system32\avisynth.dll
2007-06-03 17:54   <DIR>   d--------   C:\WINDOWS\system32\avsplugin
2007-06-03 17:54   <DIR>   d--------   C:\Program Files\Smallvideosoft
2007-05-30 19:24   <DIR>   d--------   C:\Program Files\Conquer 2.0
2007-05-28 21:27   <DIR>   d--------   C:\Program Files\Magic Photo Editor
2007-05-25 18:49   <DIR>   d--------   C:\DOCUME~1\Bogdan\DANEAP~1\uk.co.planetside
2007-05-24 15:31   <DIR>   d--------   C:\DOCUME~1\Bogdan\DANEAP~1\Eltima Software
2007-05-22 18:11   <DIR>   d--------   C:\Program Files\MyPhoneExplorer
2007-05-22 18:11   <DIR>   d--------   C:\DOCUME~1\Bogdan\DANEAP~1\MyPhoneExplorer
2007-05-22 18:00   <DIR>   d--------   C:\DOCUME~1\Bogdan\DANEAP~1\Teleca
2007-05-22 17:58   <DIR>   d----c---   C:\WINDOWS\system32\DRVSTORE
2007-05-22 17:57   <DIR>   d--------   C:\DOCUME~1\ALLUSE~1\DANEAP~1\Teleca
2007-05-22 17:57   <DIR>   d--------   C:\DOCUME~1\ALLUSE~1\DANEAP~1\Sony Ericsson
2007-05-22 17:06   <DIR>   d--------   C:\DOCUME~1\Bogdan\DANEAP~1\FreeCall
2007-05-17 16:39   <DIR>   d--------   C:\Program Files\Ski Park Manager
2007-05-17 10:13   <DIR>   d--------   C:\Program Files\Damian Pasternak
2007-05-13 18:45   <DIR>   d--------   C:\Program Files\Duran
2007-05-12 12:18   <DIR>   d--------   C:\Program Files\Mad Tracks


((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))

2090-10-13 06:45:56   --------   d-----w   C:\Program Files\Common Files\Adobe Systems Shared
2007-06-11 19:08:58   --------   d-----w   C:\Program Files\FlashGet
2007-06-11 13:25:37   --------   d-----w   C:\DOCUME~1\Bogdan\DANEAP~1\foobar2000
2007-06-03 19:51:09   --------   d-----w   C:\Program Files\OpenOffice.org1.1.4
2007-05-30 17:24:27   --------   d--h--w   C:\Program Files\InstallShield Installation Information
2007-05-28 14:15:54   --------   d-----w   C:\Program Files\TextAloud
2007-05-24 12:59:01   --------   d-----w   C:\Program Files\Cream Software
2007-05-24 12:59:01   --------   d-----w   C:\DOCUME~1\Bogdan\DANEAP~1\Cream Software
2007-05-24 12:57:55   --------   d-----w   C:\Program Files\Pcsx2
2007-05-24 12:57:02   --------   d-----w   C:\Program Files\filesubmit
2007-05-24 12:56:39   --------   d-----w   C:\Program Files\Kaboom_v55
2007-05-24 12:55:49   --------   d-----w   C:\Program Files\ImageSplitter
2007-05-24 12:55:35   --------   d-----w   C:\Program Files\Hp
2007-05-24 12:52:19   --------   d-----w   C:\Program Files\VSD Software
2007-05-24 12:52:12   --------   d-----w   C:\Program Files\ElcomSoft
2007-05-24 12:51:26   --------   d-----w   C:\Program Files\Fma
2007-05-24 12:51:19   --------   d-----w   C:\Program Files\Google
2007-05-22 15:57:55   --------   d-----w   C:\Program Files\Common Files\Teleca Shared
2007-05-22 15:57:29   --------   d-----w   C:\Program Files\Sony Ericsson
2007-05-19 11:10:55   --------   d-----w   C:\Program Files\eMule
2007-05-17 14:18:11   20,480   ----a-w   C:\WINDOWS\system32\H@tKeysH@@k.DLL
2007-05-16 18:16:02   --------   d-----w   C:\Program Files\ACE-HIGH MP3 WAV WMA OGG Converter
2007-05-16 04:47:52   --------   d-----w   C:\Program Files\English Translator 3
2007-05-09 12:20:56   --------   d-----w   C:\Program Files\Robin Hood - DotC
2007-05-07 15:55:57   23   ----a-w   C:\WINDOWS\system32\sysmwwod.dll
2007-05-07 15:42:49   --------   d-----w   C:\Program Files\Auvisoft Audio Converter
2007-05-05 11:00:33   --------   d-----w   C:\DOCUME~1\Bogdan\DANEAP~1\Media Player Classic
2007-04-26 08:48:03   3,396   ----a-w   C:\WINDOWS\unins001.dat
2007-04-25 12:46:28   --------   d-----w   C:\Program Files\Bonjour
2007-04-25 12:35:39   --------   d-----w   C:\Program Files\Common Files\Macrovision Shared
2007-04-24 16:10:38   --------   d-----w   C:\Program Files\New Star Soccer 3
2007-04-23 17:15:02   --------   d-----w   C:\Program Files\KoolMoves
2007-04-23 15:10:53   --------   d-----w   C:\Program Files\Rocks'n'Diamonds
2007-04-20 19:55:30   --------   d-----w   C:\Program Files\Blaze Gif Creator
2007-04-20 19:08:39   --------   d-----w   C:\Program Files\Common Files\Xuisoft
2007-04-20 18:58:05   --------   d-----w   C:\Program Files\Selteco
2007-04-18 13:43:43   --------   d-----w   C:\Program Files\Symcom
2007-04-17 14:42:59   --------   d-----w   C:\Program Files\SystemRequirementsLab
2007-04-13 17:28:57   --------   d-----w   C:\Program Files\Opera
2007-04-07 17:17:39   81,920   ----a-w   C:\DOCUME~1\Bogdan\DANEAP~1\ezpinst.exe
2007-04-07 17:17:39   47,360   ----a-w   C:\DOCUME~1\Bogdan\DANEAP~1\pcouffin.sys
2007-04-06 16:52:39   2,368   ----a-w   C:\WINDOWS\system32\SVKP.sys
2007-03-30 13:15:14   55,949   ----a-w   C:\WINDOWS\system32\x264-uninstall.exe
2007-03-29 12:58:47   5   ----a-w   C:\WINDOWS\system32\SySVid.dat
2007-03-25 12:26:43   79,188   ----a-w   C:\WINDOWS\system32\perfc015.dat
2007-03-25 12:26:43   457,678   ----a-w   C:\WINDOWS\system32\perfh015.dat
2007-03-21 18:54:16   77,312   ----a-w   C:\WINDOWS\system32\TWAIN_32.DLL
2007-03-21 18:54:16   69,632   ----a-w   C:\WINDOWS\system32\TWUNK_32.EXE
2007-03-21 18:54:16   48,560   ----a-w   C:\WINDOWS\system32\TWUNK_16.EXE
2007-03-13 09:04:32   89,839   ----a-w   C:\WINDOWS\TopMail Uninstaller.exe
2007-01-22 20:49:09   56   --sh--r   C:\WINDOWS\system32\887958BC3D.sys
2007-01-22 20:49:09   1,682   --sha-w   C:\WINDOWS\system32\KGyGaAvL.sys


(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))


*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects]
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}=C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll [2004-12-14 11:56]
{1E1B2879-88FF-11D3-8D96-D7ACAC95951A}=C:\WINDOWS\system32\bpkwb.dll []
{2F364306-AA45-47B5-9F9D-39A8B94E7EF7}=C:\PROGRA~1\FlashGet\jccatch.dll [2006-05-16 15:19]
{4A2AACF3-ADF6-11D5-98A9-00E018981B9E}=C:\Program Files\NewDotNet\newdotnet7_48.dll []
{4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C}=C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL [2006-10-31 08:55]
{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}=C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll [2006-12-15 04:23]
{bf00e119-21a3-4fd1-b178-3b8537e75c92}=C:\Program Files\Megaupload\Mega Manager\MegaIEMn.dll [2006-12-11 18:46]
{C333CF63-767F-4831-94AC-E683D962C63C}=C:\Program Files\TGTSoft\StyleXP\TGT_BHO.dll [2006-05-10 01:13]
{F156768E-81EF-470C-9057-481BA8380DBA}=C:\PROGRA~1\FlashGet\getflash.dll [2006-09-12 10:50]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"nwiz"="nwiz.exe" [2006-07-26 14:00 C:\WINDOWS\system32\nwiz.exe]
"WinFast Schedule"="C:\Program Files\WinFast\WFTVFM\WFWIZ.exe" [2006-03-20 14:53]
"@"="" []
"DAEMON Tools"="c:\Program Files\DAEMON Tools\daemon.exe" [2005-12-10 16:57]
"NVMixerTray"="C:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe" [2004-12-20 17:12]
"LClock"="C:\Program Files\LClock\LClock.exe" [2004-09-20 02:27]
"RealTray"="C:\Program Files\Media Player Classic\RealPlay.exe" [2007-02-12 16:19]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe" [2006-12-15 04:23]
"Trickler"="c:\progra~1\2findm~1\partner\trickl~1.exe" []
"Sony Ericsson PC Suite"="C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" [2005-10-26 17:17]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Dzieńdobry!"="\\Bogus\Różne programy\Dzieńdobry!\dziendobry.exe" []
"Hide IP Platinum"="C:\Program Files\Hide IP Platinum\hideippla.exe" []
"STYLEXP"="C:\Program Files\TGTSoft\StyleXP\StyleXP.exe" [2006-05-24 20:31]
"AQQ"="C:\PROGRA~1\Wapster\AQQ\AQQ.exe" [2007-02-28 14:18]
"ctfnon"="C:\Program Files\ctfnon.exe" []
"FreeCall"="C:\Program Files\FreeCall.com\FreeCall\FreeCall.exe" []

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoRemoteRecursiveEvents"=1 (0x1)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoSaveSettings"=0 (0x0)
"NoLowDiskSpaceChecks"=1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Adobe Reader Speed Launch.lnk]
path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Adobe Reader Speed Launch.lnk
backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Bogdan^Menu Start^Programy^Autostart^Adobe Gamma.lnk]
path=C:\Documents and Settings\Bogdan\Menu Start\Programy\Autostart\Adobe Gamma.lnk
backup=C:\WINDOWS\pss\Adobe Gamma.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Bogdan^Menu Start^Programy^Autostart^UniSpiker.lnk]
path=C:\Documents and Settings\Bogdan\Menu Start\Programy\Autostart\UniSpiker.lnk
backup=C:\WINDOWS\pss\UniSpiker.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Blaero Start Orb]
C:\Program Files\Blaero Start Orb\Blaero Start Orb.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
"C:\Program Files\QuickTime\qttask.exe" -atboottime

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Styler]
C:\Program Files\Styler\Styler.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\tasmgr]
C:\Program Files\Internet Explorer\tasmgr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\uerscw]
C:\Program Files\Error Safe Free\uerscw.exe -c

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Vista Sidebar]
C:\Program Files\Vista Sidebar\sidebar.exe


[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c3d24b42-3ddc-11db-9e8a-806d6172696f}]
AutoRun\command- E:\ASUSACPI.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{fd2c46ba-3dce-11db-8772-806d6172696f}]
AutoRun\command- E:\ASUSACPI.exe


Contents of the 'Scheduled Tasks' folder
2006-10-12 12:49:40  C:\WINDOWS\tasks\AppleSoftwareUpdate.job

**************************************************************************

catchme 0.3.721 W2K/XP/Vista - userland rootkit detector by Gmer, http://www.gmer.net
Rootkit scan 2007-06-12 14:34:25
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Dziendobry!"="\\\\Bogus\\Rózne programy\\Dziendobry!\\dziendobry.exe /auto"

Completion time: 2007-06-12 14:35:54
C:\ComboFix-quarantined-files.txt ... 2007-06-12 14:35
C:\ComboFix2.txt ... 2007-06-11 17:22

   --- E O F ---


Kod: Zaznacz wszystko

Logfile of HijackThis v1.99.1
Scan saved at 14:18, on 2007-06-12
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
C:\Program Files\WinFast\WFTVFM\WFWIZ.exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe
C:\Program Files\LClock\LClock.exe
C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe
C:\Program Files\Common Files\Teleca Shared\CapabilityManager.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Teleca Shared\Generic.exe
C:\Program Files\Sony Ericsson\Mobile2\Mobile Phone Monitor\epmworker.exe
C:\Program Files\Opera\Opera.exe
C:\WINDOWS\system32\wuauclt.exe
\Bogus\Różne programy\Dzieńdobry!\dziendobry.exe
C:\Program Files\TGTSoft\StyleXP\StyleXP.exe
C:\PROGRA~1\Wapster\AQQ\AQQ.exe
C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleil.exe
C:\WINDOWS\BricoPacks\Vista Inspirat\ObjectDock\ObjectDock.exe
C:\WINDOWS\BricoPacks\Vista Inspirat\YzToolbar\YzToolBar.exe
C:\Documents and Settings\Bogdan\Pulpit\NoLop.exe
C:\Program Files\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.windowsxlive.net/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 127.0.0.1:4001
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = L1cza
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: PK IE Plugin - {1E1B2879-88FF-11D3-8D96-D7ACAC95951A} - C:\WINDOWS\system32\bpkwb.dll (file missing)
O2 - BHO: IeCatch5 Class - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\PROGRA~1\FlashGet\jccatch.dll
O2 - BHO: URLLink - {4A2AACF3-ADF6-11D5-98A9-00E018981B9E} - C:\Program Files\NewDotNet\newdotnet7_48.dll (file missing)
O2 - BHO: MEGAUPLOADTOOLBAR - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O2 - BHO: Mega Manager IE Click Monitor - {bf00e119-21a3-4fd1-b178-3b8537e75c92} - C:\Program Files\Megaupload\Mega Manager\MegaIEMn.dll
O2 - BHO: TGTSoft Explorer Toolbar Changer - {C333CF63-767F-4831-94AC-E683D962C63C} - C:\Program Files\TGTSoft\StyleXP\TGT_BHO.dll
O2 - BHO: gFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\PROGRA~1\FlashGet\getflash.dll
O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\fgiebar.dll
O3 - Toolbar: MEGAUPLOADTOOLBAR - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL
O3 - Toolbar: ImageShack Toolbar - {6932D140-ABC4-4073-A44C-D4A541665E35} - C:\WINDOWS\ImageShackToolbar\ImageShackToolbar.dll
O3 - Toolbar: TextAloud - {F053C368-5458-45B2-9B4D-D8914BDDDBFF} - C:\PROGRA~1\TEXTAL~1\TAForIE.dll
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [WinFast Schedule] C:\Program Files\WinFast\WFTVFM\WFWIZ.exe
O4 - HKLM\..\Run: [DAEMON Tools] "c:\Program Files\DAEMON Tools\daemon.exe" -lang 1045
O4 - HKLM\..\Run: [NVMixerTray] "C:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe"
O4 - HKLM\..\Run: [LClock] C:\Program Files\LClock\LClock.exe
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Media Player Classic\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe"
O4 - HKLM\..\Run: [Trickler] "c:\progra~1\2findm~1\partner\trickl~1.exe"
O4 - HKLM\..\Run: [Sony Ericsson PC Suite] "C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [kis] "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe"
O4 - HKCU\..\Run: [Dzieńdobry!] \\Bogus\Ró?ne programy\Dziendobry!\dziendobry.exe /auto
O4 - HKCU\..\Run: [Hide IP Platinum] C:\Program Files\Hide IP Platinum\hideippla.exe
O4 - HKCU\..\Run: [STYLEXP] C:\Program Files\TGTSoft\StyleXP\StyleXP.exe -Hide
O4 - HKCU\..\Run: [AQQ] C:\PROGRA~1\Wapster\AQQ\AQQ.exe
O4 - HKCU\..\Run: [ctfnon] C:\Program Files\ctfnon.exe
O4 - HKCU\..\Run: [FreeCall] "C:\Program Files\FreeCall.com\FreeCall\FreeCall.exe" -nosplash -minimized
O4 - Startup: Stardock ObjectDock.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat\ObjectDock\ObjectDock.exe
O4 - Startup: Y'z ToolBar.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat\YzToolbar\YzToolBar.exe
O4 - Global Startup: BlueSoleil.lnk = ?
O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/toolbaredits/menusearch.jhtml?p=ZC
O8 - Extra context menu item: Download All by FlashGet - C:\Program Files\FlashGet\jc_all.htm
O8 - Extra context menu item: Download Link Using Mega Manager... - C:\Program Files\Megaupload\Mega Manager\mm_file.htm
O8 - Extra context menu item: Download using FlashGet - C:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: Post Image to Blog - res://C:\WINDOWS\ImageShackToolbar\ImageShackToolbar.dll/5003
O8 - Extra context menu item: Tag This Image - res://C:\WINDOWS\ImageShackToolbar\ImageShackToolbar.dll/5002
O8 - Extra context menu item: Upload All Images to ImageShack - res://C:\WINDOWS\ImageShackToolbar\ImageShackToolbar.dll/5000
O8 - Extra context menu item: Upload Image to ImageShack - res://C:\WINDOWS\ImageShackToolbar\ImageShackToolbar.dll/5001
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra button: Run WinHTTrack - {36ECAF82-3300-8F84-092E-AFF36D6C7040} - C:\Program Files\WinHTTrack\WinHTTrackIEBar.dll
O9 - Extra 'Tools' menuitem: Launch WinHTTrack - {36ECAF82-3300-8F84-092E-AFF36D6C7040} - C:\Program Files\WinHTTrack\WinHTTrackIEBar.dll
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe
O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O10 - Unknown file in Winsock LSP: c:\program files\bonjour\mdnsnsp.dll
O15 - Trusted Zone: http://toolbar.imageshack.us
O16 - DPF: {6932D140-ABC4-4073-A44C-D4A541665E35} (ImageShack Toolbar) - http://toolbar.imageshack.us/toolbar/ImageShackToolbar.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{0C5C7E94-0529-4F1F-AACD-96943AC51169}: NameServer = 194.204.152.1
O17 - HKLM\System\CCS\Services\Tcpip\..\{F63B2554-383F-4136-8FF6-6F7156690075}: NameServer = 192.168.0.1
O17 - HKLM\System\CS1\Services\Tcpip\..\{0C5C7E94-0529-4F1F-AACD-96943AC51169}: NameServer = 194.204.152.1
O17 - HKLM\System\CS2\Services\Tcpip\..\{0C5C7E94-0529-4F1F-AACD-96943AC51169}: NameServer = 194.204.152.1
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Kaspersky Internet Security 6.0 (AVP) - Unknown owner - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe" -r (file missing)
O23 - Service: BlueSoleil Hid Service - Unknown owner - C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: StyleXPService - Unknown owner - C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe



Kod: Zaznacz wszystko

Logfile of The Avenger version 1, by Swandog46
Running from registry key:
\Registry\Machine\System\CurrentControlSet\Services\lofkvvna

*******************

Script file located at: \??\C:\hulfilob.txt
Script file opened successfully.

Script file read successfully

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

File C:\WINDOWS\system32\tmp.reg deleted successfully.
File C:\WINDOWS\system32\kernel1.exe deleted successfully.

Completed script processing.

*******************

Finished!  Terminate.

[wojtas]

O2 - BHO: PK IE Plugin - {1E1B2879-88FF-11D3-8D96-D7ACAC95951A} - C:\WINDOWS\system32\bpkwb.dll (file missing)
O2 - BHO: IeCatch5 Class - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\PROGRA~1\FlashGet\jccatch.dll
O2 - BHO: URLLink - {4A2AACF3-ADF6-11D5-98A9-00E018981B9E} - C:\Program Files\NewDotNet\newdotnet7_48.dll (file missing)
O4 - HKLM\..\Run: [Trickler] "c:\progra~1\2findm~1\partner\trickl~1.exe"
O4 - HKCU\..\Run: [ctfnon] C:\Program Files\ctfnon.exe
O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/toolbaredits/menusearch.jhtml?p=ZC

Odpalasz hijackthis i zaznaczasz ptaszkami powyższe wpisy i dajesz Fix checked.

Autor postu otrzymał pochwałę

[użytkownik]

thx!!!
duzo plusow za to ze musiales sie meczyc z takim tlokiem jak ja