proszę o sprawdzenie loga

**Posty:** 66 · przez **bengacz** 02 Gru 2007, 21:50

Witam, komputer muli, podejrzewam że coś we wpisach siedzi.

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 20:50:28, on 2007-12-02 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\SYSTEM32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Eset\nod32krn.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\PnkBstrA.exe C:\WINDOWS\System32\svchost.exe D:\Program Files\A4Tech\Mouse\Amoumain.exe C:\WINDOWS\system32\LVCOMSX.EXE C:\Program Files\Eset\nod32kui.exe C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe C:\Program Files\Boingo\GoBoingo\GoBoingo.exe C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe D:\Program Files\Teamspeak2_RC2\TeamSpeak.exe D:\ET\etmin.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Gadu-Gadu\gg.exe C:\Documents and Settings\Janusz\Pulpit\HiJackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.pl/ R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 83.206.30.2:8080 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0 CE\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: Winamp Toolbar BHO - {25CEE8EC-5730-41bc-8B58-22DDC8AB8C20} - C:\Program Files\Winamp Toolbar\winamptb.dll O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll O3 - Toolbar: &Save Flash - {4064EA35-578D-4073-A834-C96D82CBCF40} - C:\Program Files\Save Flash\SaveFlash.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll O3 - Toolbar: Winamp Toolbar - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - C:\Program Files\Winamp Toolbar\winamptb.dll O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [WheelMouse] D:\Program Files\A4Tech\Mouse\Amoumain.exe O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" O4 - HKLM\..\Run: [GoBoingo] C:\Program Files\Boingo\GoBoingo\GoBoingo.exe O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe O4 - HKCU\..\Run: [Orb] "C:\Program Files\Winamp Remote\bin\OrbTray.exe" /background O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user') O8 - Extra context menu item: &Winamp Toolbar Search - C:\Documents and Settings\All Users\Dane aplikacji\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://D:\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O16 - DPF: {68282C51-9459-467B-95BF-3C0E89627E55} (MksSkanerOnline Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{313680C5-372A-4350-BDAD-1812DD29DA01}: NameServer = 192.168.1.1 O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing) O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcap\rpcapd.exe -- End of file - 5426 bytes

i silent runners

Kod: Zaznacz wszystko: "Silent Runners.vbs", revision 52, http://www.silentrunners.org/ Operating System: Windows XP SP2 Output limited to non-default values, except where indicated by "{++}" Startup items buried in registry: --------------------------------- HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ {++} "Gadu-Gadu" = ""C:\Program Files\Gadu-Gadu\gg.exe" /tray" ["Gadu-Gadu S.A."] "swg" = "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" ["Google Inc."] "Orb" = ""C:\Program Files\Winamp Remote\bin\OrbTray.exe" /background" ["Orb Networks"] HKLM\Software\Microsoft\Windows\CurrentVersion\Run\ {++} "NvCplDaemon" = "RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup" [MS] "nwiz" = "nwiz.exe /install" ["NVIDIA Corporation"] "NvMediaCenter" = "RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit" [MS] "WheelMouse" = "D:\Program Files\A4Tech\Mouse\Amoumain.exe" ["A4Tech Co., Ltd."] "LVCOMSX" = "C:\WINDOWS\system32\LVCOMSX.EXE" ["Logitech Inc."] "nod32kui" = ""C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE" ["Eset "] "SunJavaUpdateSched" = ""C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"" ["Sun Microsystems, Inc."] "GoBoingo" = "C:\Program Files\Boingo\GoBoingo\GoBoingo.exe" ["Boingo Wireless, Inc."] HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\(Default) = (no title provided) -> {HKLM...CLSID} = "AcroIEHlprObj Class" \InProcServer32\(Default) = "C:\Program Files\Adobe\Acrobat 6.0 CE\Reader\ActiveX\AcroIEHelper.dll" ["Adobe Systems Incorporated"] {25CEE8EC-5730-41bc-8B58-22DDC8AB8C20}\(Default) = "Winamp Toolbar BHO" -> {HKLM...CLSID} = "Winamp Toolbar BHO" \InProcServer32\(Default) = "C:\Program Files\Winamp Toolbar\winamptb.dll" ["AOL LLC"] {53707962-6F74-2D53-2644-206D7942484F}\(Default) = (no title provided) -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "C:\PROGRA~1\SPYBOT~1\SDHelper.dll" ["Safer Networking Limited"] {761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\(Default) = (no title provided) -> {HKLM...CLSID} = "SSVHelper Class" \InProcServer32\(Default) = "C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll" ["Sun Microsystems, Inc."] {AA58ED58-01DD-4d91-8333-CF10577473F7}\(Default) = (no title provided) -> {HKLM...CLSID} = "Google Toolbar Helper" \InProcServer32\(Default) = "c:\program files\google\googletoolbar1.dll" ["Google Inc."] {AF69DE43-7D58-4638-B6FA-CE66B5AD205D}\(Default) = (no title provided) -> {HKLM...CLSID} = "Google Toolbar Notifier BHO" \InProcServer32\(Default) = "C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll" ["Google Inc."] HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\ "{42071714-76d4-11d1-8b24-00a0c9068ff3}" = "Rozszerzenie CPL kadrowania wyświetlania" -> {HKLM...CLSID} = "Rozszerzenie CPL kadrowania wyświetlania" \InProcServer32\(Default) = "deskpan.dll" [file not found] "{88895560-9AA2-1069-930E-00AA0030EBC8}" = "Rozszerzenie ikony HyperTerminalu" -> {HKLM...CLSID} = "HyperTerminal Icon Ext" \InProcServer32\(Default) = "C:\WINDOWS\System32\hticons.dll" ["Hilgraeve, Inc."] "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" = "WinRAR shell extension" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] "{A70C977A-BF00-412C-90B7-034C51DA2439}" = "NvCpl DesktopContext Class" -> {HKLM...CLSID} = "DesktopContext Class" \InProcServer32\(Default) = "C:\WINDOWS\system32\nvcpl.dll" ["NVIDIA Corporation"] "{FFB699E0-306A-11d3-8BD1-00104B6F7516}" = "Play on my TV helper" -> {HKLM...CLSID} = "NVIDIA CPL Extension" \InProcServer32\(Default) = "C:\WINDOWS\system32\nvcpl.dll" ["NVIDIA Corporation"] "{1CDB2949-8F65-4355-8456-263E7C208A5D}" = "Desktop Explorer" -> {HKLM...CLSID} = "Desktop Explorer" \InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"] "{1E9B04FB-F9E5-4718-997B-B8DA88302A47}" = "Desktop Explorer Menu" -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"] "{1E9B04FB-F9E5-4718-997B-B8DA88302A48}" = "nView Desktop Context Menu" -> {HKLM...CLSID} = "nView Desktop Context Menu" \InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"] "{400CFEE2-39D0-46DC-96DF-E0BB5A4324B3}" = "My Logitech Pictures" -> {HKLM...CLSID} = "My Logitech Pictures" \InProcServer32\(Default) = "C:\Program Files\Logitech\Video\Namespc2.dll" ["Logitech Inc."] "{00020D75-0000-0000-C000-000000000046}" = "Microsoft Office Outlook Desktop Icon Handler" -> {HKLM...CLSID} = "Microsoft Office Outlook" \InProcServer32\(Default) = "D:\PROGRA~1\MICROS~1\OFFICE11\MLSHEXT.DLL" [MS] "{0006F045-0000-0000-C000-000000000046}" = "Microsoft Office Outlook Custom Icon Handler" -> {HKLM...CLSID} = "Rozszerzenie ikon plików programu Outlook" \InProcServer32\(Default) = "D:\PROGRA~1\MICROS~1\OFFICE11\OLKFSTUB.DLL" [MS] "{42042206-2D85-11D3-8CFF-005004838597}" = "Microsoft Office HTML Icon Handler" -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "D:\Program Files\Microsoft Office\OFFICE11\msohev.dll" [MS] "{B327765E-D724-4347-8B16-78AE18552FC3}" = "NeroDigitalIconHandler" -> {HKLM...CLSID} = "NeroDigitalIconHandler Class" \InProcServer32\(Default) = "C:\Program Files\Common Files\Ahead\Lib\NeroDigitalExt.dll" ["Nero AG"] "{7F1CF152-04F8-453A-B34C-E609530A9DC8}" = "NeroDigitalPropSheetHandler" -> {HKLM...CLSID} = "NeroDigitalPropSheetHandler Class" \InProcServer32\(Default) = "C:\Program Files\Common Files\Ahead\Lib\NeroDigitalExt.dll" ["Nero AG"] "{46E22146-59C0-4136-9233-FB7720E777B2}" = "EzCddax extension" -> {HKLM...CLSID} = "EzCddax Class" \InProcServer32\(Default) = "D:\Program Files\Easy CD-DA Extractor 10\ezcddax10.dll" [null data] "{B089FE88-FB52-11D3-BDF1-0050DA34150D}" = "NOD32 Context Menu Shell Extension" -> {HKLM...CLSID} = "NOD32 Context Menu Shell Extension" \InProcServer32\(Default) = "C:\Program Files\Eset\nodshex.dll" [null data] HKLM\Software\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\ "WPDShServiceObj" = "{AAA288BA-9A4C-45B0-95D7-94D524869DB5}" -> {HKLM...CLSID} = "WPDShServiceObj Class" \InProcServer32\(Default) = "C:\WINDOWS\system32\WPDShServiceObj.dll" [MS] HKLM\System\CurrentControlSet\Control\Session Manager\ <<!>> "BootExecute" = "autocheck autochk *"|"OODBS" [file not found] HKLM\Software\Classes\PROTOCOLS\Filter\ <<!>> text/xml\CLSID = "{807553E5-5146-11D5-A672-00B0D022E945}" -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL" [MS] HKLM\Software\Classes\Folder\shellex\ColumnHandlers\ {7D4D6379-F301-4311-BEBA-E26EB0561882}\(Default) = "NeroDigitalExt.NeroDigitalColumnHandler" -> {HKLM...CLSID} = "NeroDigitalColumnHandler Class" \InProcServer32\(Default) = "C:\Program Files\Common Files\Ahead\Lib\NeroDigitalExt.dll" ["Nero AG"] HKLM\Software\Classes\*\shellex\ContextMenuHandlers\ EzCddax\(Default) = "{46E22146-59C0-4136-9233-FB7720E777B2}" -> {HKLM...CLSID} = "EzCddax Class" \InProcServer32\(Default) = "D:\Program Files\Easy CD-DA Extractor 10\ezcddax10.dll" [null data] NOD32 Context Menu Shell Extension\(Default) = "{B089FE88-FB52-11D3-BDF1-0050DA34150D}" -> {HKLM...CLSID} = "NOD32 Context Menu Shell Extension" \InProcServer32\(Default) = "C:\Program Files\Eset\nodshex.dll" [null data] WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\ WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\ NOD32 Context Menu Shell Extension\(Default) = "{B089FE88-FB52-11D3-BDF1-0050DA34150D}" -> {HKLM...CLSID} = "NOD32 Context Menu Shell Extension" \InProcServer32\(Default) = "C:\Program Files\Eset\nodshex.dll" [null data] WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] Group Policies {GPedit.msc branch and setting}: ----------------------------------------------- Note: detected settings may not have any effect. HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\ "shutdownwithoutlogon" = (REG_DWORD) hex:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| Shutdown: Allow system to be shut down without having to log on} "undockwithoutlogon" = (REG_DWORD) hex:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| Devices: Allow undock without having to log on} Active Desktop and Wallpaper: ----------------------------- Active Desktop may be disabled at this entry: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState

haxfix

Kod: Zaznacz wszystko: HAXFIX logfile - by Marckie version 4.60 2007-12-02 21:07:25,85 --- Checking for Haxdoor --- checking for a3d files a3d files not found checking for matching notify keys no matching notify keys found checking for matching services matching services found ASPI32 checking for matching safeboot services no matching safeboot services found checking for other Haxdoor-files no other Haxdoor-files found --- Checking for Goldun --- checking for SSODL keys no ssodl keys found checking for notify keys no notify keys found checking for services no services found checking for other Goldun-files no other Goldun-files found checking iexplore.exe iexplore.exe is not infected --- Catchme logfile - thank you Gmer --- catchme 0.3.1262.1 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-12-02 21:07:25 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... scanning hidden services & system hive ... [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg] "s1"=dword:2df9c43f "s2"=dword:110480d0 "h0"=dword:00000002 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04] "h0"=dword:00000000 "ujdew"=hex:7d,d6,b1,2f,5b,54,77,99,cb,81,26,cc,c0,ea,ed,61,a8,0b,a8,6c,4d,.. [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4] "h0"=dword:00000001 "khjeh"=hex:3f,24,54,95,4e,68,14,62,63,74,e7,94,41,fd,81,cf,d0,3d,8a,a3,d3,.. "p0"="D:\Program Files\DAEMON Tools\" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001] "a0"=hex:20,01,00,00,5e,60,77,af,57,bf,dd,69,8a,d5,5a,e1,1e,1a,63,6c,90,.. "khjeh"=hex:b8,d4,8f,fb,8e,ab,ed,ea,4b,66,34,24,75,83,d1,cd,75,57,09,47,d3,.. [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40] "khjeh"=hex:ac,8d,fa,05,87,0c,ad,3c,9d,ea,1d,81,1f,1a,e1,ef,e7,6d,50,49,d0,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04] "h0"=dword:00000000 "ujdew"=hex:7d,d6,b1,2f,5b,54,77,99,cb,81,26,cc,c0,ea,ed,61,a8,0b,a8,6c,4d,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4] "h0"=dword:00000001 "khjeh"=hex:3f,24,54,95,4e,68,14,62,63,74,e7,94,41,fd,81,cf,d0,3d,8a,a3,d3,.. "p0"="D:\Program Files\DAEMON Tools\" [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001] "a0"=hex:20,01,00,00,5e,60,77,af,57,bf,dd,69,8a,d5,5a,e1,1e,1a,63,6c,90,.. "khjeh"=hex:b8,d4,8f,fb,8e,ab,ed,ea,4b,66,34,24,75,83,d1,cd,75,57,09,47,d3,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40] "khjeh"=hex:ac,8d,fa,05,87,0c,ad,3c,9d,ea,1d,81,1f,1a,e1,ef,e7,6d,50,49,d0,.. scanning hidden registry entries ... [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\System] "OODEFRAG08.00.00.01WORKSTATION"="BB76BAAC6CF60B scanning hidden files ... C:\Program Files\HaxFix\temp1.txt C:\Program Files\HaxFix\temp2.txt C:\Program Files\HaxFix\temp3.txt C:\Program Files\HaxFix\temp4.txt scan completed successfully hidden processes: 0 hidden services: 0 hidden files: 4 --- Analysing Catchme logfile --- no matching regkeys found Finished!

**Posty:** 18165 · przez **wojtas** 02 Gru 2007, 22:28

znasz to:

O4 - HKLM\..\Run: [GoBoingo] C:\Program Files\Boingo\GoBoingo\GoBoingo.exe

daj loga z combofixa (tylko przed uzyciem go zmien date w komputerze np. na 15.11.2007 zeby byla wczesniejsza niz dzisiejsza data)

**Posty:** 66 · przez **bengacz** 04 Gru 2007, 21:22

goboingo to sniffer albo jakis progs do wifi był.

Kod: Zaznacz wszystko: ComboFix 07-12-02.6 - Janusz 2007-11-20 20:15:59.4 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.236 [GMT 1:00] Running from: C:\Documents and Settings\Janusz\Pulpit\ComboFix(2).exe * Created a new restore point . ((((((((((((((((((((((((( Files Created from 2007-11-02 to 2007-12-02 ))))))))))))))))))))))))))))))) . 2007-12-02 21:06 . 2001-05-25 06:01 90,112 --a------ C:\WINDOWS\system32\RegDACL.exe 2007-12-02 21:06 . 2005-01-13 20:41 53,248 --a------ C:\WINDOWS\system32\process.exe 2007-12-02 21:06 . 2007-10-11 14:42 8,925 --a------ C:\clean.bat 2007-12-02 21:06 . 2004-07-22 12:15 4,096 --a------ C:\WINDOWS\system32\reboot.exe 2007-12-02 21:06 . 2007-10-11 08:55 347 --a------ C:\run2.reg 2007-12-02 20:46 . 2007-12-02 20:46 <DIR> d-------- C:\Program Files\Winamp Toolbar 2007-12-02 20:46 . 2007-12-02 20:46 <DIR> d-------- C:\Program Files\Winamp Remote 2007-12-02 20:46 . 2007-12-02 20:46 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Winamp Toolbar 2007-12-02 20:46 . 2007-12-02 20:46 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\OrbNetworks 2007-11-25 00:17 . 2007-11-25 00:17 <DIR> d-------- C:\Program Files\A4Tech 2007-11-24 23:33 . 2004-08-24 07:43 36,864 --a------ C:\WINDOWS\system32\Amhooker.dll 2007-11-24 23:33 . 2006-05-09 09:27 13,824 --a------ C:\WINDOWS\system32\drivers\Amps2prt.sys 2007-11-24 23:33 . 2006-05-09 09:26 13,312 --a------ C:\WINDOWS\system32\drivers\SETEE8.tmp 2007-11-20 16:15 . 2007-05-13 23:17 21,888 --a------ C:\WINDOWS\system32\drivers\hopperp.sys 2007-11-16 18:15 . 2006-12-15 03:09 49,265 --a------ C:\WINDOWS\system32\jpicpl32.cpl 2007-11-16 18:14 . 2007-11-16 18:15 <DIR> d-------- C:\Program Files\Java 2007-11-16 18:12 . 2007-11-16 18:12 <DIR> d-------- C:\Program Files\Common Files\Java 2007-11-10 16:27 . 2007-01-20 21:26 1,565,480 --a------ C:\WINDOWS\system32\wmv9vcm.dll 2007-11-10 16:27 . 2007-01-30 06:03 1,044,480 --a------ C:\WINDOWS\system32\libdivx.dll 2007-11-10 16:27 . 2007-01-30 06:03 200,704 --a------ C:\WINDOWS\system32\ssldivx.dll 2007-11-10 16:27 . 2007-01-30 05:56 196,608 --a------ C:\WINDOWS\system32\dtu100.dll 2007-11-09 21:22 . 2007-11-09 21:22 <DIR> d-------- C:\Program Files\directx . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2007-12-04 18:11 --------- d-----w C:\Documents and Settings\Janusz\Dane aplikacji\teamspeak2 2007-12-03 18:46 --------- d-----w C:\Documents and Settings\Janusz\Dane aplikacji\Skype 2007-12-02 20:53 --------- d-----w C:\Program Files\mIRC 2007-12-02 20:17 22,328 ----a-w C:\WINDOWS\system32\drivers\PnkBstrK.sys 2007-12-02 20:17 107,832 ----a-w C:\WINDOWS\system32\PnkBstrB.exe 2007-12-02 19:47 --------- d-----w C:\Program Files\Winamp 2007-12-02 18:59 --------- d-----w C:\Program Files\Wolfenstein - Enemy Territory 2007-12-02 18:01 --------- d-----w C:\Documents and Settings\Janusz\Dane aplikacji\Xfire 2007-11-30 12:11 --------- d-s---w C:\Program Files\Xfire 2007-11-01 11:21 --------- d-----w C:\Program Files\BE Inspired! Upper-Intermediate 2007-11-01 11:14 --------- d-----w C:\Program Files\Windows Media Connect 2 2007-11-01 09:48 --------- d--h--w C:\Program Files\InstallShield Installation Information 2007-11-01 09:48 --------- d-----w C:\Program Files\Common Files\Panda Software 2007-11-01 09:45 512,096 ----a-w C:\WINDOWS\system32\drivers\amon.sys 2007-11-01 09:45 298,104 ----a-w C:\WINDOWS\system32\imon.dll 2007-11-01 09:45 15,424 ----a-w C:\WINDOWS\system32\drivers\nod32drv.sys 2007-10-31 21:51 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\sentinel 2007-10-31 21:48 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Backup 2007-10-31 21:19 --------- d-----w C:\Program Files\Common Files\Symantec Shared 2007-10-18 15:42 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab 2007-10-17 20:07 --------- d---a-w C:\Documents and Settings\All Users\Dane aplikacji\TEMP 2007-10-13 09:35 --------- d-----w C:\Program Files\WinPcap 2007-09-28 18:35 4,608 ----a-w C:\WINDOWS\system32\w95inf32.dll 2007-09-12 12:47 83 ----a-w C:\Program Files\setsms.INI 2007-05-13 22:17 21,888 ----a-w C:\WINDOWS\inf\hopperp.sys . ((((((((((((((((((((((((((((( snapshot@2007-11-01_11.55.56.80 ))))))))))))))))))))))))))))))))))))))))) . - 2007-10-29 17:56:19 136,192 ----a-w C:\WINDOWS\catchme.exe + 2007-11-27 02:58:11 140,288 ----a-w C:\WINDOWS\catchme.exe - 2006-12-01 10:45:28 317,440 ----a-w C:\WINDOWS\inf\unregmp2.exe + 2004-08-03 23:44:28 208,896 ----a-w C:\WINDOWS\inf\unregmp2.exe - 2006-12-01 10:42:34 7,168 ----a-w C:\WINDOWS\system32\asferror.dll + 2004-08-03 23:42:38 8,192 ----a-w C:\WINDOWS\system32\asferror.dll - 2007-05-31 06:44:56 740,442 ----a-w C:\WINDOWS\system32\divx.dll + 2007-02-01 04:56:06 639,066 ----a-w C:\WINDOWS\system32\divx.dll - 2007-04-23 00:02:36 73,728 ----a-w C:\WINDOWS\system32\dpl100.dll + 2007-01-30 04:56:58 73,728 ----a-w C:\WINDOWS\system32\dpl100.dll - 2006-12-15 15:09:24 8,704 ----a-r C:\WINDOWS\system32\drivers\Amfilter.sys + 2006-01-11 06:33:32 8,704 ----a-w C:\WINDOWS\system32\drivers\Amfilter.sys - 2006-12-15 15:09:50 13,824 ----a-r C:\WINDOWS\system32\drivers\Amusbprt.sys + 2006-05-09 08:26:06 13,312 ----a-w C:\WINDOWS\system32\drivers\Amusbprt.sys - 2003-04-04 13:07:20 30,336 ----a-w C:\WINDOWS\system32\drivers\npf.sys + 2005-08-02 21:10:13 32,512 ----a-w C:\WINDOWS\system32\drivers\npf.sys - 2006-09-27 21:53:22 36,560 ------w C:\WINDOWS\system32\drivers\pxhelp20.sys + 2007-03-07 23:51:00 43,528 ------w C:\WINDOWS\system32\drivers\pxhelp20.sys - 2007-06-03 12:31:28 10,752 ----a-w C:\WINDOWS\system32\ff_vfw.dll + 2007-02-21 20:00:28 10,752 ----a-w C:\WINDOWS\system32\ff_vfw.dll - 2007-08-31 08:21:31 209,696 ----a-w C:\WINDOWS\system32\FNTCACHE.DAT + 2007-11-01 16:56:56 208,104 ----a-w C:\WINDOWS\system32\FNTCACHE.DAT - 2006-11-09 12:28:20 49,248 ----a-w C:\WINDOWS\system32\java.exe + 2006-12-15 00:30:58 49,248 ----a-w C:\WINDOWS\system32\java.exe - 2006-11-09 12:28:30 53,346 ----a-w C:\WINDOWS\system32\javaw.exe + 2006-12-15 00:31:06 53,346 ----a-w C:\WINDOWS\system32\javaw.exe - 2006-11-09 14:07:32 127,078 ----a-w C:\WINDOWS\system32\javaws.exe + 2006-12-15 02:09:14 127,078 ----a-w C:\WINDOWS\system32\javaws.exe + 2005-11-08 22:26:46 38,400 ----a-w C:\WINDOWS\system32\moveex.exe + 2004-03-24 02:12:34 17,280 ----a-w C:\WINDOWS\system32\nsndis5.sys + 2004-03-24 02:49:36 94,208 ----a-w C:\WINDOWS\system32\nsndis50.dll - 2003-04-04 13:03:00 57,344 ----a-w C:\WINDOWS\system32\packet.dll + 2005-08-02 21:08:09 81,920 ----a-w C:\WINDOWS\system32\packet.dll - 2002-03-02 02:10:02 53,299 ----a-w C:\WINDOWS\system32\pthreadVC.dll + 2005-08-02 21:24:01 53,299 ----a-w C:\WINDOWS\system32\pthreadVC.dll - 2006-09-27 21:53:22 514,808 ----a-w C:\WINDOWS\system32\px.dll + 2007-03-07 23:51:00 547,576 ------w C:\WINDOWS\system32\px.dll - 2006-08-25 03:47:00 129,784 ------w C:\WINDOWS\system32\pxafs.dll + 2007-03-07 23:51:00 129,784 ------w C:\WINDOWS\system32\pxafs.dll - 2006-08-25 03:47:00 63,144 ------w C:\WINDOWS\system32\pxcpya64.exe + 2007-03-07 23:51:00 64,760 ------w C:\WINDOWS\system32\pxcpya64.exe - 2006-09-27 21:53:22 477,944 ----a-w C:\WINDOWS\system32\pxdrv.dll + 2007-03-07 23:51:00 510,712 ------w C:\WINDOWS\system32\pxdrv.dll - 2006-09-27 21:53:22 68,344 ------w C:\WINDOWS\system32\pxhpinst.exe + 2007-03-07 23:51:00 72,440 ------w C:\WINDOWS\system32\pxhpinst.exe - 2006-08-25 03:47:00 62,632 ------w C:\WINDOWS\system32\pxinsa64.exe + 2007-03-07 23:51:00 64,760 ------w C:\WINDOWS\system32\pxinsa64.exe - 2006-09-27 21:53:22 183,032 ----a-w C:\WINDOWS\system32\pxmas.dll + 2007-03-07 23:51:00 187,128 ------w C:\WINDOWS\system32\pxmas.dll - 2006-08-25 03:47:00 1,309,432 ------w C:\WINDOWS\system32\pxsfs.dll + 2007-03-07 23:51:00 1,628,920 ------w C:\WINDOWS\system32\pxsfs.dll - 2006-09-27 21:53:23 379,640 ----a-w C:\WINDOWS\system32\pxwave.dll + 2007-03-07 23:51:00 379,640 ------w C:\WINDOWS\system32\pxwave.dll - 2007-04-23 00:15:30 3,596,288 ----a-w C:\WINDOWS\system32\qt-dx331.dll + 2007-01-30 05:03:42 3,596,288 ----a-w C:\WINDOWS\system32\qt-dx331.dll + 2006-12-15 15:09:24 8,704 ----a-r C:\WINDOWS\system32\ReinstallBackups\[u]0[/u]000\DriverFiles\Amfilter.sys + 2006-12-15 15:09:50 13,824 ----a-r C:\WINDOWS\system32\ReinstallBackups\[u]0[/u]000\DriverFiles\Amusbprt.sys + 2006-12-15 15:09:24 8,704 ----a-r C:\WINDOWS\system32\ReinstallBackups\[u]0[/u]005\DriverFiles\Amfilter.sys + 2006-12-15 15:09:50 13,824 ----a-r C:\WINDOWS\system32\ReinstallBackups\[u]0[/u]005\DriverFiles\Amusbprt.sys - 2006-08-25 03:47:00 39,672 ------w C:\WINDOWS\system32\vxblock.dll + 2007-03-07 23:51:00 39,672 ------w C:\WINDOWS\system32\vxblock.dll - 2006-12-01 10:45:42 258,560 ------w C:\WINDOWS\system32\wmerror.dll + 2004-08-03 23:43:42 190,976 ----a-w C:\WINDOWS\system32\wmerror.dll - 2006-10-18 20:47:20 10,834,432 ------w C:\WINDOWS\system32\wmp.dll + 2006-04-24 14:40:00 4,730,880 ----a-w C:\WINDOWS\system32\wmp.dll - 2006-10-18 20:47:20 242,688 ------w C:\WINDOWS\system32\wmpasf.dll + 2004-08-03 23:44:16 114,688 ----a-w C:\WINDOWS\system32\wmpasf.dll - 2006-10-18 20:47:20 314,880 ------w C:\WINDOWS\system32\wmpdxm.dll + 2004-08-03 23:44:16 233,472 ----a-w C:\WINDOWS\system32\wmpdxm.dll - 2006-12-01 11:01:50 8,277,504 ----a-w C:\WINDOWS\system32\wmploc.dll + 2004-08-03 23:43:44 2,977,792 ----a-w C:\WINDOWS\system32\wmploc.dll - 2006-12-01 10:46:18 99,840 ----a-w C:\WINDOWS\system32\wmpshell.dll + 2004-08-03 23:44:16 102,400 ----a-w C:\WINDOWS\system32\wmpshell.dll - 2003-04-04 12:54:48 208,896 ----a-w C:\WINDOWS\system32\wpcap.dll + 2005-08-02 21:18:45 233,472 ----a-w C:\WINDOWS\system32\wpcap.dll - 2007-04-28 12:54:36 593,920 ----a-w C:\WINDOWS\system32\xvidcore.dll + 2006-11-01 13:52:38 765,952 ----a-w C:\WINDOWS\system32\xvidcore.dll - 2006-11-01 12:54:30 180,224 ----a-w C:\WINDOWS\system32\xvidvfw.dll + 2006-11-01 13:54:30 180,224 ----a-w C:\WINDOWS\system32\xvidvfw.dll - 2004-01-25 16:18:44 217,088 ----a-w C:\WINDOWS\system32\yv12vfw.dll + 2004-01-25 17:18:44 217,088 ----a-w C:\WINDOWS\system32\yv12vfw.dll . -- Snapshot reset to current date -- . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{25CEE8EC-5730-41bc-8B58-22DDC8AB8C20}] 2007-10-04 21:06 1135968 --a------ C:\Program Files\Winamp Toolbar\winamptb.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar] "{EBF2BA02-9094-4C5A-858B-BB198F3D8DE2}"= C:\Program Files\Winamp Toolbar\winamptb.dll [2007-10-04 21:06 1135968] [HKEY_CLASSES_ROOT\clsid\{ebf2ba02-9094-4c5a-858b-bb198f3d8de2}] [HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand.1] [HKEY_CLASSES_ROOT\TypeLib\{538CD77C-BFDD-49b0-9562-77419CAB89D1}] [HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand] [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser] "{EBF2BA02-9094-4C5A-858B-BB198F3D8DE2}"= C:\Program Files\Winamp Toolbar\winamptb.dll [2007-10-04 21:06 1135968] [HKEY_CLASSES_ROOT\clsid\{ebf2ba02-9094-4c5a-858b-bb198f3d8de2}] [HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand.1] [HKEY_CLASSES_ROOT\TypeLib\{538CD77C-BFDD-49b0-9562-77419CAB89D1}] [HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Gadu-Gadu"="C:\Program Files\Gadu-Gadu\gg.exe" [2007-01-30 15:58] "swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-09-08 18:49] "Orb"="C:\Program Files\Winamp Remote\bin\OrbTray.exe" [2007-10-23 01:47] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NvCplDaemon"="RUNDLL32.exe" [2004-08-04 00:44 C:\WINDOWS\system32\rundll32.exe] "nwiz"="nwiz.exe" [2006-10-22 12:22 C:\WINDOWS\system32\nwiz.exe] "NvMediaCenter"="RUNDLL32.exe" [2004-08-04 00:44 C:\WINDOWS\system32\rundll32.exe] "WheelMouse"="D:\Program Files\A4Tech\Mouse\Amoumain.exe" [2006-02-17 10:14] "LVCOMSX"="C:\WINDOWS\system32\LVCOMSX.EXE" [2005-07-19 17:32] "nod32kui"="C:\Program Files\Eset\nod32kui.exe" [2007-11-01 10:45] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe" [2006-12-15 03:23] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-08-04 00:44] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Logitech Desktop Messenger.lnk] path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Logitech Desktop Messenger.lnk backup=C:\WINDOWS\pss\Logitech Desktop Messenger.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Janusz^Menu Start^Programy^Autostart^OpenOffice.ux.pl 2.0.4.lnk] path=C:\Documents and Settings\Janusz\Menu Start\Programy\Autostart\OpenOffice.ux.pl 2.0.4.lnk backup=C:\WINDOWS\pss\OpenOffice.ux.pl 2.0.4.lnkStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools] D:\Program Files\DAEMON Tools\daemon.exe -lang 1033 [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechVideoRepair] 2005-06-08 15:24 458752 --a------ C:\Program Files\Logitech\Video\ISStart.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechVideoTray] 2005-06-08 15:14 217088 --a------ C:\Program Files\Logitech\Video\LogiTray.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Picasa Media Detector] 2007-09-28 02:17 443968 --a------ D:\Program Files\Picasa2\PicasaMediaDetector.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype] C:\Program Files\Skype\Phone\Skype.exe /nosplash /minimized R2 HopperP;WiFi Hopper (XP);C:\WINDOWS\system32\DRIVERS\hopperp.sys R3 RT2400PCI;802.11b WLAN PCI;C:\WINDOWS\system32\DRIVERS\RT2400.sys S3 NPF;NetGroup Packet Filter Driver;C:\WINDOWS\system32\drivers\npf.sys S3 NSNDIS5;NSNDIS5 NDIS Protocol Driver;\??\C:\WINDOWS\system32\NSNDIS5.SYS S3 PCASp50;PCASp50 NDIS Protocol Driver;C:\WINDOWS\system32\Drivers\PCASp50.sys S3 ss_bus;SAMSUNG Mobile USB Device 1.0 driver (WDM);C:\WINDOWS\system32\DRIVERS\ss_bus.sys S3 ss_mdfl;SAMSUNG Mobile USB Modem 1.0 Filter;C:\WINDOWS\system32\DRIVERS\ss_mdfl.sys S3 ss_mdm;SAMSUNG Mobile USB Modem 1.0 Drivers;C:\WINDOWS\system32\DRIVERS\ss_mdm.sys . ************************************************************************** catchme 0.3.1318 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-12-02 20:18:05 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2007-12-02 20:19:02 C:\ComboFix2.txt ... 2007-11-02 12:10 C:\ComboFix3.txt ... 2007-11-02 11:55 . --- E O F ---

**Posty:** 3854 · przez **Dzi@dek** 04 Gru 2007, 22:40

Usuń te pliki w awaryjnym po wyłączeniu przywracania systemu.:

C:\WINDOWS\system32\process.exe
C:\clean.bat
C:\run2.reg

**Posty:** 66 · przez **bengacz** 05 Gru 2007, 01:53

ok usunąłem, nowy log z combofixa

Kod: Zaznacz wszystko: ComboFix 07-12-02.6 - Janusz 2007-11-20 0:41:28.5 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.268 [GMT 1:00] Running from: C:\Documents and Settings\Janusz\Pulpit\ComboFix(2).exe . ((((((((((((((((((((((((( Files Created from 2007-11-02 to 2007-12-02 ))))))))))))))))))))))))))))))) . 2007-12-02 21:06 . 2001-05-25 06:01 90,112 --a------ C:\WINDOWS\system32\RegDACL.exe 2007-12-02 21:06 . 2004-07-22 12:15 4,096 --a------ C:\WINDOWS\system32\reboot.exe 2007-12-02 20:46 . 2007-12-02 20:46 <DIR> d-------- C:\Program Files\Winamp Toolbar 2007-12-02 20:46 . 2007-12-02 20:46 <DIR> d-------- C:\Program Files\Winamp Remote 2007-12-02 20:46 . 2007-12-02 20:46 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Winamp Toolbar 2007-12-02 20:46 . 2007-12-02 20:46 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\OrbNetworks 2007-11-25 00:17 . 2007-11-25 00:17 <DIR> d-------- C:\Program Files\A4Tech 2007-11-24 23:33 . 2004-08-24 07:43 36,864 --a------ C:\WINDOWS\system32\Amhooker.dll 2007-11-24 23:33 . 2006-05-09 09:27 13,824 --a------ C:\WINDOWS\system32\drivers\Amps2prt.sys 2007-11-24 23:33 . 2006-05-09 09:26 13,312 --a------ C:\WINDOWS\system32\drivers\SETEE8.tmp 2007-11-20 16:15 . 2007-05-13 23:17 21,888 --a------ C:\WINDOWS\system32\drivers\hopperp.sys 2007-11-16 18:15 . 2006-12-15 03:09 49,265 --a------ C:\WINDOWS\system32\jpicpl32.cpl 2007-11-16 18:14 . 2007-11-16 18:15 <DIR> d-------- C:\Program Files\Java 2007-11-16 18:12 . 2007-11-16 18:12 <DIR> d-------- C:\Program Files\Common Files\Java 2007-11-10 16:27 . 2007-01-20 21:26 1,565,480 --a------ C:\WINDOWS\system32\wmv9vcm.dll 2007-11-10 16:27 . 2007-01-30 06:03 1,044,480 --a------ C:\WINDOWS\system32\libdivx.dll 2007-11-10 16:27 . 2007-01-30 06:03 200,704 --a------ C:\WINDOWS\system32\ssldivx.dll 2007-11-10 16:27 . 2007-01-30 05:56 196,608 --a------ C:\WINDOWS\system32\dtu100.dll 2007-11-09 21:22 . 2007-11-09 21:22 <DIR> d-------- C:\Program Files\directx . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2007-12-03 18:46 --------- d-----w C:\Documents and Settings\Janusz\Dane aplikacji\Skype 2007-12-02 22:45 --------- d-----w C:\Documents and Settings\Janusz\Dane aplikacji\Xfire 2007-12-02 22:29 --------- d-----w C:\Documents and Settings\Janusz\Dane aplikacji\teamspeak2 2007-12-02 20:53 --------- d-----w C:\Program Files\mIRC 2007-12-02 20:17 22,328 ----a-w C:\WINDOWS\system32\drivers\PnkBstrK.sys 2007-12-02 20:17 107,832 ----a-w C:\WINDOWS\system32\PnkBstrB.exe 2007-12-02 19:47 --------- d-----w C:\Program Files\Winamp 2007-12-02 18:59 --------- d-----w C:\Program Files\Wolfenstein - Enemy Territory 2007-11-30 12:11 --------- d-s---w C:\Program Files\Xfire 2007-11-01 11:21 --------- d-----w C:\Program Files\BE Inspired! Upper-Intermediate 2007-11-01 11:14 --------- d-----w C:\Program Files\Windows Media Connect 2 2007-11-01 09:48 --------- d--h--w C:\Program Files\InstallShield Installation Information 2007-11-01 09:48 --------- d-----w C:\Program Files\Common Files\Panda Software 2007-11-01 09:45 512,096 ----a-w C:\WINDOWS\system32\drivers\amon.sys 2007-11-01 09:45 298,104 ----a-w C:\WINDOWS\system32\imon.dll 2007-11-01 09:45 15,424 ----a-w C:\WINDOWS\system32\drivers\nod32drv.sys 2007-10-31 21:51 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\sentinel 2007-10-31 21:48 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Backup 2007-10-31 21:19 --------- d-----w C:\Program Files\Common Files\Symantec Shared 2007-10-18 15:42 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab 2007-10-17 20:07 --------- d---a-w C:\Documents and Settings\All Users\Dane aplikacji\TEMP 2007-10-13 09:35 --------- d-----w C:\Program Files\WinPcap 2007-09-28 18:35 4,608 ----a-w C:\WINDOWS\system32\w95inf32.dll 2007-09-12 12:47 83 ----a-w C:\Program Files\setsms.INI 2007-05-13 22:17 21,888 ----a-w C:\WINDOWS\inf\hopperp.sys . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{25CEE8EC-5730-41bc-8B58-22DDC8AB8C20}] 2007-10-04 21:06 1135968 --a------ C:\Program Files\Winamp Toolbar\winamptb.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar] "{EBF2BA02-9094-4C5A-858B-BB198F3D8DE2}"= C:\Program Files\Winamp Toolbar\winamptb.dll [2007-10-04 21:06 1135968] [HKEY_CLASSES_ROOT\clsid\{ebf2ba02-9094-4c5a-858b-bb198f3d8de2}] [HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand.1] [HKEY_CLASSES_ROOT\TypeLib\{538CD77C-BFDD-49b0-9562-77419CAB89D1}] [HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand] [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser] "{EBF2BA02-9094-4C5A-858B-BB198F3D8DE2}"= C:\Program Files\Winamp Toolbar\winamptb.dll [2007-10-04 21:06 1135968] [HKEY_CLASSES_ROOT\clsid\{ebf2ba02-9094-4c5a-858b-bb198f3d8de2}] [HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand.1] [HKEY_CLASSES_ROOT\TypeLib\{538CD77C-BFDD-49b0-9562-77419CAB89D1}] [HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Gadu-Gadu"="C:\Program Files\Gadu-Gadu\gg.exe" [2007-01-30 15:58] "swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-09-08 18:49] "Orb"="C:\Program Files\Winamp Remote\bin\OrbTray.exe" [2007-10-23 01:47] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NvCplDaemon"="RUNDLL32.exe" [2004-08-04 00:44 C:\WINDOWS\system32\rundll32.exe] "nwiz"="nwiz.exe" [2006-10-22 12:22 C:\WINDOWS\system32\nwiz.exe] "NvMediaCenter"="RUNDLL32.exe" [2004-08-04 00:44 C:\WINDOWS\system32\rundll32.exe] "WheelMouse"="D:\Program Files\A4Tech\Mouse\Amoumain.exe" [2006-02-17 10:14] "LVCOMSX"="C:\WINDOWS\system32\LVCOMSX.EXE" [2005-07-19 17:32] "nod32kui"="C:\Program Files\Eset\nod32kui.exe" [2007-11-01 10:45] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe" [2006-12-15 03:23] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-08-04 00:44] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Logitech Desktop Messenger.lnk] path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Logitech Desktop Messenger.lnk backup=C:\WINDOWS\pss\Logitech Desktop Messenger.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Janusz^Menu Start^Programy^Autostart^OpenOffice.ux.pl 2.0.4.lnk] path=C:\Documents and Settings\Janusz\Menu Start\Programy\Autostart\OpenOffice.ux.pl 2.0.4.lnk backup=C:\WINDOWS\pss\OpenOffice.ux.pl 2.0.4.lnkStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools] D:\Program Files\DAEMON Tools\daemon.exe -lang 1033 [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechVideoRepair] 2005-06-08 15:24 458752 --a------ C:\Program Files\Logitech\Video\ISStart.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechVideoTray] 2005-06-08 15:14 217088 --a------ C:\Program Files\Logitech\Video\LogiTray.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Picasa Media Detector] 2007-09-28 02:17 443968 --a------ D:\Program Files\Picasa2\PicasaMediaDetector.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype] C:\Program Files\Skype\Phone\Skype.exe /nosplash /minimized R2 HopperP;WiFi Hopper (XP);C:\WINDOWS\system32\DRIVERS\hopperp.sys R3 RT2400PCI;802.11b WLAN PCI;C:\WINDOWS\system32\DRIVERS\RT2400.sys S3 NPF;NetGroup Packet Filter Driver;C:\WINDOWS\system32\drivers\npf.sys S3 NSNDIS5;NSNDIS5 NDIS Protocol Driver;\??\C:\WINDOWS\system32\NSNDIS5.SYS S3 PCASp50;PCASp50 NDIS Protocol Driver;C:\WINDOWS\system32\Drivers\PCASp50.sys S3 ss_bus;SAMSUNG Mobile USB Device 1.0 driver (WDM);C:\WINDOWS\system32\DRIVERS\ss_bus.sys S3 ss_mdfl;SAMSUNG Mobile USB Modem 1.0 Filter;C:\WINDOWS\system32\DRIVERS\ss_mdfl.sys S3 ss_mdm;SAMSUNG Mobile USB Modem 1.0 Drivers;C:\WINDOWS\system32\DRIVERS\ss_mdm.sys . ************************************************************************** catchme 0.3.1318 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-12-02 00:43:30 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2007-12-02 0:44:14 C:\ComboFix2.txt ... 2007-12-02 20:19 C:\ComboFix3.txt ... 2007-11-02 12:10 . --- E O F ---

oraz hijack

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 00:49:06, on 2007-12-02 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\SYSTEM32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Eset\nod32krn.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\PnkBstrA.exe D:\Program Files\A4Tech\Mouse\Amoumain.exe C:\WINDOWS\system32\LVCOMSX.EXE C:\WINDOWS\System32\svchost.exe C:\Program Files\Eset\nod32kui.exe C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe C:\WINDOWS\system32\wuauclt.exe C:\WINDOWS\explorer.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Gadu-Gadu\gg.exe C:\Documents and Settings\Janusz\Pulpit\Programy do FIX\HiJackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.pl/ R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 83.206.30.2:8080 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0 CE\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: Winamp Toolbar BHO - {25CEE8EC-5730-41bc-8B58-22DDC8AB8C20} - C:\Program Files\Winamp Toolbar\winamptb.dll O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll O3 - Toolbar: &Save Flash - {4064EA35-578D-4073-A834-C96D82CBCF40} - C:\Program Files\Save Flash\SaveFlash.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll O3 - Toolbar: Winamp Toolbar - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - C:\Program Files\Winamp Toolbar\winamptb.dll O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [WheelMouse] D:\Program Files\A4Tech\Mouse\Amoumain.exe O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe" O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe O4 - HKCU\..\Run: [Orb] "C:\Program Files\Winamp Remote\bin\OrbTray.exe" /background O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user') O8 - Extra context menu item: &Winamp Toolbar Search - C:\Documents and Settings\All Users\Dane aplikacji\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://D:\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll O16 - DPF: {68282C51-9459-467B-95BF-3C0E89627E55} (MksSkanerOnline Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{313680C5-372A-4350-BDAD-1812DD29DA01}: NameServer = 192.168.1.1 O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing) O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcap\rpcapd.exe -- End of file - 5288 bytes

Silent Runners

Kod: Zaznacz wszystko: "Silent Runners.vbs", revision 52, http://www.silentrunners.org/ Operating System: Windows XP SP2 Output limited to non-default values, except where indicated by "{++}" Startup items buried in registry: --------------------------------- HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ {++} "Gadu-Gadu" = ""C:\Program Files\Gadu-Gadu\gg.exe" /tray" ["Gadu-Gadu S.A."] "swg" = "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" ["Google Inc."] "Orb" = ""C:\Program Files\Winamp Remote\bin\OrbTray.exe" /background" ["Orb Networks"] HKLM\Software\Microsoft\Windows\CurrentVersion\Run\ {++} "NvCplDaemon" = "RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup" [MS] "nwiz" = "nwiz.exe /install" ["NVIDIA Corporation"] "NvMediaCenter" = "RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit" [MS] "WheelMouse" = "D:\Program Files\A4Tech\Mouse\Amoumain.exe" ["A4Tech Co., Ltd."] "LVCOMSX" = "C:\WINDOWS\system32\LVCOMSX.EXE" ["Logitech Inc."] "nod32kui" = ""C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE" ["Eset "] "SunJavaUpdateSched" = ""C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe"" ["Sun Microsystems, Inc."] HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\(Default) = (no title provided) -> {HKLM...CLSID} = "AcroIEHlprObj Class" \InProcServer32\(Default) = "C:\Program Files\Adobe\Acrobat 6.0 CE\Reader\ActiveX\AcroIEHelper.dll" ["Adobe Systems Incorporated"] {25CEE8EC-5730-41bc-8B58-22DDC8AB8C20}\(Default) = "Winamp Toolbar BHO" -> {HKLM...CLSID} = "Winamp Toolbar BHO" \InProcServer32\(Default) = "C:\Program Files\Winamp Toolbar\winamptb.dll" ["AOL LLC"] {53707962-6F74-2D53-2644-206D7942484F}\(Default) = (no title provided) -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "C:\PROGRA~1\SPYBOT~1\SDHelper.dll" ["Safer Networking Limited"] {761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\(Default) = (no title provided) -> {HKLM...CLSID} = "SSVHelper Class" \InProcServer32\(Default) = "C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll" ["Sun Microsystems, Inc."] {AA58ED58-01DD-4d91-8333-CF10577473F7}\(Default) = (no title provided) -> {HKLM...CLSID} = "Google Toolbar Helper" \InProcServer32\(Default) = "c:\program files\google\googletoolbar1.dll" ["Google Inc."] {AF69DE43-7D58-4638-B6FA-CE66B5AD205D}\(Default) = (no title provided) -> {HKLM...CLSID} = "Google Toolbar Notifier BHO" \InProcServer32\(Default) = "C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll" ["Google Inc."] HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\ "{42071714-76d4-11d1-8b24-00a0c9068ff3}" = "Rozszerzenie CPL kadrowania wyświetlania" -> {HKLM...CLSID} = "Rozszerzenie CPL kadrowania wyświetlania" \InProcServer32\(Default) = "deskpan.dll" [file not found] "{88895560-9AA2-1069-930E-00AA0030EBC8}" = "Rozszerzenie ikony HyperTerminalu" -> {HKLM...CLSID} = "HyperTerminal Icon Ext" \InProcServer32\(Default) = "C:\WINDOWS\System32\hticons.dll" ["Hilgraeve, Inc."] "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" = "WinRAR shell extension" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] "{A70C977A-BF00-412C-90B7-034C51DA2439}" = "NvCpl DesktopContext Class" -> {HKLM...CLSID} = "DesktopContext Class" \InProcServer32\(Default) = "C:\WINDOWS\system32\nvcpl.dll" ["NVIDIA Corporation"] "{FFB699E0-306A-11d3-8BD1-00104B6F7516}" = "Play on my TV helper" -> {HKLM...CLSID} = "NVIDIA CPL Extension" \InProcServer32\(Default) = "C:\WINDOWS\system32\nvcpl.dll" ["NVIDIA Corporation"] "{1CDB2949-8F65-4355-8456-263E7C208A5D}" = "Desktop Explorer" -> {HKLM...CLSID} = "Desktop Explorer" \InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"] "{1E9B04FB-F9E5-4718-997B-B8DA88302A47}" = "Desktop Explorer Menu" -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"] "{1E9B04FB-F9E5-4718-997B-B8DA88302A48}" = "nView Desktop Context Menu" -> {HKLM...CLSID} = "nView Desktop Context Menu" \InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"] "{400CFEE2-39D0-46DC-96DF-E0BB5A4324B3}" = "My Logitech Pictures" -> {HKLM...CLSID} = "My Logitech Pictures" \InProcServer32\(Default) = "C:\Program Files\Logitech\Video\Namespc2.dll" ["Logitech Inc."] "{00020D75-0000-0000-C000-000000000046}" = "Microsoft Office Outlook Desktop Icon Handler" -> {HKLM...CLSID} = "Microsoft Office Outlook" \InProcServer32\(Default) = "D:\PROGRA~1\MICROS~1\OFFICE11\MLSHEXT.DLL" [MS] "{0006F045-0000-0000-C000-000000000046}" = "Microsoft Office Outlook Custom Icon Handler" -> {HKLM...CLSID} = "Rozszerzenie ikon plików programu Outlook" \InProcServer32\(Default) = "D:\PROGRA~1\MICROS~1\OFFICE11\OLKFSTUB.DLL" [MS] "{42042206-2D85-11D3-8CFF-005004838597}" = "Microsoft Office HTML Icon Handler" -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "D:\Program Files\Microsoft Office\OFFICE11\msohev.dll" [MS] "{B327765E-D724-4347-8B16-78AE18552FC3}" = "NeroDigitalIconHandler" -> {HKLM...CLSID} = "NeroDigitalIconHandler Class" \InProcServer32\(Default) = "C:\Program Files\Common Files\Ahead\Lib\NeroDigitalExt.dll" ["Nero AG"] "{7F1CF152-04F8-453A-B34C-E609530A9DC8}" = "NeroDigitalPropSheetHandler" -> {HKLM...CLSID} = "NeroDigitalPropSheetHandler Class" \InProcServer32\(Default) = "C:\Program Files\Common Files\Ahead\Lib\NeroDigitalExt.dll" ["Nero AG"] "{46E22146-59C0-4136-9233-FB7720E777B2}" = "EzCddax extension" -> {HKLM...CLSID} = "EzCddax Class" \InProcServer32\(Default) = "D:\Program Files\Easy CD-DA Extractor 10\ezcddax10.dll" [null data] "{B089FE88-FB52-11D3-BDF1-0050DA34150D}" = "NOD32 Context Menu Shell Extension" -> {HKLM...CLSID} = "NOD32 Context Menu Shell Extension" \InProcServer32\(Default) = "C:\Program Files\Eset\nodshex.dll" [null data] HKLM\Software\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\ "WPDShServiceObj" = "{AAA288BA-9A4C-45B0-95D7-94D524869DB5}" -> {HKLM...CLSID} = "WPDShServiceObj Class" \InProcServer32\(Default) = "C:\WINDOWS\system32\WPDShServiceObj.dll" [MS] HKLM\System\CurrentControlSet\Control\Session Manager\ <<!>> "BootExecute" = "autocheck autochk *"|"OODBS" [file not found] HKLM\Software\Classes\PROTOCOLS\Filter\ <<!>> text/xml\CLSID = "{807553E5-5146-11D5-A672-00B0D022E945}" -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL" [MS] HKLM\Software\Classes\Folder\shellex\ColumnHandlers\ {7D4D6379-F301-4311-BEBA-E26EB0561882}\(Default) = "NeroDigitalExt.NeroDigitalColumnHandler" -> {HKLM...CLSID} = "NeroDigitalColumnHandler Class" \InProcServer32\(Default) = "C:\Program Files\Common Files\Ahead\Lib\NeroDigitalExt.dll" ["Nero AG"] HKLM\Software\Classes\*\shellex\ContextMenuHandlers\ EzCddax\(Default) = "{46E22146-59C0-4136-9233-FB7720E777B2}" -> {HKLM...CLSID} = "EzCddax Class" \InProcServer32\(Default) = "D:\Program Files\Easy CD-DA Extractor 10\ezcddax10.dll" [null data] NOD32 Context Menu Shell Extension\(Default) = "{B089FE88-FB52-11D3-BDF1-0050DA34150D}" -> {HKLM...CLSID} = "NOD32 Context Menu Shell Extension" \InProcServer32\(Default) = "C:\Program Files\Eset\nodshex.dll" [null data] WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\ WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\ NOD32 Context Menu Shell Extension\(Default) = "{B089FE88-FB52-11D3-BDF1-0050DA34150D}" -> {HKLM...CLSID} = "NOD32 Context Menu Shell Extension" \InProcServer32\(Default) = "C:\Program Files\Eset\nodshex.dll" [null data] WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] Group Policies {GPedit.msc branch and setting}: ----------------------------------------------- Note: detected settings may not have any effect. HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\ "shutdownwithoutlogon" = (REG_DWORD) hex:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| Shutdown: Allow system to be shut down without having to log on} "undockwithoutlogon" = (REG_DWORD) hex:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| Devices: Allow undock without having to log on} Active Desktop and Wallpaper: ----------------------------- Active Desktop may be disabled at this entry: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState Winsock2 Service Provider DLLs: ------------------------------- Namespace Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++} 000000000001\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS] 000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS] 000000000003\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS] Transport Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++} 0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range: C:\WINDOWS\system32\imon.dll ["Eset "], 01 - 05, 21 %SystemRoot%\system32\mswsock.dll [MS], 06 - 08, 11 - 20 %SystemRoot%\system32\rsvpsp.dll [MS], 09 - 10 Toolbars, Explorer Bars, Extensions: ------------------------------------ Toolbars HKCU\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ "{2318C2B1-4965-11D4-9B18-009027A5CD4F}" -> {HKLM...CLSID} = "&Google" \InProcServer32\(Default) = "c:\program files\google\googletoolbar1.dll" ["Google Inc."] HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\ "{4064EA35-578D-4073-A834-C96D82CBCF40}" -> {HKLM...CLSID} = "&Save Flash" \InProcServer32\(Default) = "C:\Program Files\Save Flash\SaveFlash.dll" ["TODO: <Company name>"] "{2318C2B1-4965-11D4-9B18-009027A5CD4F}" -> {HKLM...CLSID} = "&Google" \InProcServer32\(Default) = "c:\program files\google\googletoolbar1.dll" ["Google Inc."] "{EBF2BA02-9094-4C5A-858B-BB198F3D8DE2}" -> {HKLM...CLSID} = "Winamp Toolbar" \InProcServer32\(Default) = "C:\Program Files\Winamp Toolbar\winamptb.dll" ["AOL LLC"] HKLM\Software\Microsoft\Internet Explorer\Toolbar\ "{4064EA35-578D-4073-A834-C96D82CBCF40}" = (no title provided) -> {HKLM...CLSID} = "&Save Flash" \InProcServer32\(Default) = "C:\Program Files\Save Flash\SaveFlash.dll" ["TODO: <Company name>"] "{2318C2B1-4965-11D4-9B18-009027A5CD4F}" = (no title provided) -> {HKLM...CLSID} = "&Google" \InProcServer32\(Default) = "c:\program files\google\googletoolbar1.dll" ["Google Inc."] "{EBF2BA02-9094-4C5A-858B-BB198F3D8DE2}" = "Winamp Toolbar" -> {HKLM...CLSID} = "Winamp Toolbar" \InProcServer32\(Default) = "C:\Program Files\Winamp Toolbar\winamptb.dll" ["AOL LLC"] Explorer Bars HKLM\Software\Microsoft\Internet Explorer\Explorer Bars\ HKLM\Software\Classes\CLSID\{FF059E31-CC5A-4E2E-BF3B-96E929D65503}\(Default) = "&Badanie" Implemented Categories\{00021493-0000-0000-C000-000000000046}\ [vertical bar] InProcServer32\(Default) = "D:\PROGRA~1\MICROS~1\OFFICE11\REFIEBAR.DLL" [MS] Extensions (Tools menu items, main toolbar menu buttons) HKLM\Software\Microsoft\Internet Explorer\Extensions\ {08B0E5C0-4FCB-11CF-AAA5-00401C608501}\ "MenuText" = "Sun Java Console" "CLSIDExtension" = "{CAFEEFAC-0015-0000-0011-ABCDEFFEDCBC}" -> {HKCU...CLSID} = "Java Plug-in 1.5.0_11" \InProcServer32\(Default) = "C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll" ["Sun Microsystems, Inc."] -> {HKLM...CLSID} = "Java Plug-in 1.5.0_11" \InProcServer32\(Default) = "C:\Program Files\Java\jre1.5.0_11\bin\npjpi150_11.dll" ["Sun Microsystems, Inc."] Running Services (Display Name, Service Name, Path {Service DLL}): ------------------------------------------------------------------ NOD32 Kernel Service, NOD32krn, ""C:\Program Files\Eset\nod32krn.exe"" ["Eset "] NVIDIA Display Driver Service, NVSvc, "C:\WINDOWS\system32\nvsvc32.exe" ["NVIDIA Corporation"] PnkBstrA, PnkBstrA, "C:\WINDOWS\system32\PnkBstrA.exe" [null data] Print Monitors: --------------- HKLM\System\CurrentControlSet\Control\Print\Monitors\ hpzsnt10\Driver = "hpzsnt10.dll" ["HP"] Microsoft Document Imaging Writer Monitor\Driver = "mdimon.dll" [MS] ---------- (launch time: 2007-12-02 00:49:35) <<!>>: Suspicious data at a malware launch point. + This report excludes default entries except where indicated. + To see *everywhere* the script checks and *everything* it finds, launch it from a command prompt or a shortcut with the -all parameter. + To search all directories of local fixed drives for DESKTOP.INI DLL launch points, use the -supp parameter or answer "No" at the first message box and "Yes" at the second message box. ---------- (total run time: 65 seconds, including 5 seconds for message boxes)

**Posty:** 3854 · przez **Dzi@dek** 05 Gru 2007, 10:18

Czysty

proszę o sprawdzenie loga

proszę o sprawdzenie loga

Kto jest na forum