proszę o sprawdzenie loga.

[siwykotla]

Nie wiem jakim cudem pojawił mi się na górze pasek security toolbar7.1. Nie można tego usunąć w żaden sposób, otwierają mi się jakies strony i spowalnia internet. Proszę o pomoc.

Kod: Zaznacz wszystko

[quote][quote]Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 13:31, on 2007-11-24
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\WINDOWS\System32\DLA\DLACTRLW.EXE
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\BearShare\BearShare.exe
C:\Program Files\Winamp\winampa.exe
C:\WINDOWS\CameraFixer.exe
C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe
C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE
C:\Program Files\D-Tools\daemon.exe
C:\Program Files\Ringz Studio\Storm Codec\QTTask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\RALINK\Common\RaUI.exe
C:\Program Files\Common Files\Sonic Shared\CineTray.exe
C:\PROGRA~1\COMMON~1\Nokia\MPAPI\MPAPI3s.exe
C:\Program Files\Common Files\Teleca Shared\Generic.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Sony Ericsson\Mobile\Mobile Phone Monitor\epmworker.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.interia.pl/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://www.crawler.com/search/ie.aspx?tb_id=66020
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,CustomizeSearch = http://dnl.crawler.com/support/sa_customize.aspx?TbId=66020
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Media Holding Enterprises, LLC - {0D39A900-0F3A-4C29-A254-3E65244FDC34} - C:\Program Files\ContextTool\ContextTool-2.dll
O2 - BHO: RXResultTracker Class - {59879FA4-4790-461c-A1CC-4EC4DE4CA483} - C:\Program Files\RXToolBar\sfcont.dll (file missing)
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: NetSprint Toolbar - {D7778770-4603-4b95-9070-0D608A7E108C} - (no file)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: IE Custom Tools - {70CC76D5-A4EE-4F25-9931-B109A63E298E} - C:\Program Files\Video Add-on\ictmdl.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [SetRefresh] C:\Program Files\Compaq\SetRefresh\SetRefresh.exe
O4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [BearShare] "C:\Program Files\BearShare\BearShare.exe" /pause
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [StormCodec_Helper] "C:\Program Files\Ringz Studio\Storm Codec\StormSet.exe" /S /opti
O4 - HKLM\..\Run: [CameraFixer] C:\WINDOWS\CameraFixer.exe
O4 - HKLM\..\Run: [Sony Ericsson PC Suite] "C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions
O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE -startup
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe"  -lang 1033
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\Ringz Studio\Storm Codec\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray
O4 - HKCU\..\Run: [SpeedX] C:\PROGRA~1\MyPortal\Speed-X\SpeedX.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [PcSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog
O4 - HKCU\..\Run: [AntiSpywareShield] C:\Program Files\AntiSpywareShield\AntiSpywareShield.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: PowerReg Scheduler V3.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Ralink Wireless Utility.lnk = C:\Program Files\RALINK\Common\RaUI.exe
O4 - Global Startup: Sonic CinePlayer Quick Launch.lnk = C:\Program Files\Common Files\Sonic Shared\CineTray.exe
O8 - Extra context menu item: &Search - http://kn.bar.need2find.com/KN/menusearch.html?p=KN
O8 - Extra context menu item: Add to AMV Convert Tool... - C:\Program Files\MP3 Player Utilities 4.00\AMVConverter\grab.html
O8 - Extra context menu item: Add to AMV Converter... - C:\Program Files\MP3 Player Utilities 4.09\AMVConverter\grab.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: MediaManager tool grab multimedia file - C:\Program Files\MP3 Player Utilities 4.09\MediaManager\grab.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_03\bin\npjpi150_03.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_03\bin\npjpi150_03.dll
O9 - Extra button: Ň×ȤąşÎď - {DE60714F-AC17-427e-861A-FD60CBDF119A} - http://click2.ad4all.net/url2/urlmanage/url.asp?id=1 (file missing)
O9 - Extra 'Tools' menuitem: Ň×ȤąşÎď - {DE60714F-AC17-427e-861A-FD60CBDF119A} - http://click2.ad4all.net/url2/urlmanage/url.asp?id=1 (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {C4925E65-7A1E-11D2-8BB4-00A0C9CC72C3} (Virtools WebPlayer Class) - http://a532.g.akamai.net/7/532/6712/6c5b0a1ae398e3/player.virtools.com/downloads/player/Install2.5/Installer.exe
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - https://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O16 - DPF: {DEB21AD3-FDA4-42F6-B57D-EE696A675EE8} (IPSUploader Control) - http://asp03.photoprintit.de/microsite/1661/defaults/activex/IPSUploader.cab
O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C1} (GameDesire Pool 8) - http://67.15.101.33/g_bin/pl/billard8_2_0_0_35.cab
O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C4} (GameDesire Pool Training) - http://67.15.101.3/g_bin/pl/billardt_2_0_0_31.cab
O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C5} (GameDesire Snooker) - http://67.15.101.33/g_bin/pl/snooker_2_0_0_35.cab
O16 - DPF: {FE0BD779-44EE-4A4B-AA2E-743C63F2E5E6} (IWinAmpActiveX Class) - http://pdl.stream.aol.com/downloads/aol/unagi/ampx_en_dl.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{6040EEFF-B200-47FD-854D-F464E17AA31E}: NameServer = 213.76.158.10,194.204.159.1
O17 - HKLM\System\CCS\Services\Tcpip\..\{A8C9CBED-7A69-4B21-BD8A-3B26BB9A27B3}: NameServer = 213.76.158.10,194.204.159.1
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O22 - SharedTaskScheduler: haeckel - {8373a2e0-bdd0-42bd-b4ec-ba5451eb6607} - C:\WINDOWS\system32\moywh.dll
O23 - Service: Urządzenie mobilne Apple (Apple Mobile Device) - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Harmonogram automatycznej usługi LiveUpdate - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Usługa iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

--
End of file - 12813 bytes
[quote][/quote][/quote][/quote]

[wojtas]

przenosze do dzialu BEZPIECZEŃSTWO

Wykonaj to co jest podane w tym temacie

zastosuj:

smitfraudfix z opcji 2

Zastosuj SDFix . Po pobraniu uruchom go a rozpakuje się do C:\SDFix. Uruchom komputer w trybie awaryjnym (F8 przy stracie systemu). Będąc w awaryjnym uruchom plik RunThis.bat z folderu SDFixa. Zatwierdź czyszczenie przez Y. Poczekaj aż ukończy i komputer zresetuje


Potem wejdz do folderu SDFix wrzuc zawartość pliku Report.txt + log z hijacka oraz z combofixa (tylko

[siwykotla]

Zrobilem tak jak kazałeś tyle że w folderze SDFix nie ma RunThis.bat i nie wiem co mam dalej robić.

[wojtas]

to sciagnij jeszcze raz SDFixa... jesli dalej nie bedzie to wtedy daj loga z hijacka nowego i combofixa

[siwykotla]

I nic nie zniknęło. Dalej ten sam problem. Poniżej daje log z combofixa i i hajacka


log combofix:

ComboFix 07-11-19.3 - Daniel 2007-11-23 17:56:13.1 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.2.1250.1.1045.18.157 [GMT 1:00] Running from: C:\Documents and Settings\Daniel\Pulpit\ComboFix.exe * Created a new restore point . ((((((((((((((((((((((((( Files Created from 2007-10-23 to 2007-11-23 ))))))))))))))))))))))))))))))) . 2007-11-22 17:35 d-------- C:\Program Files\Trend Micro 2007-11-21 12:03 d-------- C:\Program Files\GRAUCZO 2007-11-20 20:01 d-------- C:\Program Files\Gimnazjum klasa 1 - Planeta Nowa 2007-11-19 17:55 d-------- C:\Program Files\PlayMP3z 2007-11-19 17:55 d-------- C:\Program Files\ContextTool 2007-11-18 17:12 d-------- C:\Program Files\SymNetDrv 2007-11-18 16:11 4,608 --a------ C:\WINDOWS\system32\drivers\symlcbrd.sys 2007-11-18 16:10 124,016 --a------ C:\WINDOWS\system32\drivers\SYMEVENT.SYS 2007-11-18 15:18 d-------- C:\Program Files\Video Add-on 2007-11-17 19:22 d-------- C:\Program Files\iTunes 2007-11-17 19:22 d-------- C:\Program Files\iPod 2007-11-17 19:14 d-------- C:\Program Files\Common Files\Apple 2007-11-15 15:29 545 --a------ C:\WINDOWS\system32\game.cfg 2007-11-15 15:29 248 --a------ C:\WINDOWS\system32\config.cfg 2007-11-15 15:29 5 --a------ C:\WINDOWS\system32\detail.cfg 2007-11-15 15:26 d-------- C:\Team17 2007-11-14 15:38 d-------- C:\Program Files\D-Tools 2007-11-14 15:38 156,800 --a------ C:\WINDOWS\system32\drivers\d346bus.sys 2007-11-14 15:38 5,248 --a------ C:\WINDOWS\system32\drivers\d346prt.sys 2007-11-06 12:16 d-------- C:\Documents and Settings\All Users\Dane aplikacji\Apple 2007-11-02 13:17 d-------- C:\Program Files\GameSpy Arcade 2007-11-02 13:01 d-------- C:\Program Files\Colin McRae Rally 04 2007-11-01 08:13 d-------- C:\Program Files\Norton Security Scan 2007-10-28 15:04 d-------- C:\Documents and Settings\Daniel\Dane aplikacji\Nokia Multimedia Player 2007-10-28 15:01 d-------- C:\Documents and Settings\Daniel\Dane aplikacji\Nokia 2007-10-27 14:39 d-------- C:\Program Files\DIFX 2007-10-27 14:39 d-------- C:\Documents and Settings\Daniel\Phone Browser 2007-10-27 14:37 d-------- C:\Program Files\Common Files\PCSuite 2007-10-27 14:37 d-------- C:\Program Files\Common Files\Nokia 2007-10-27 14:37 d-------- C:\Documents and Settings\Daniel\Dane aplikacji\PC Suite 2007-10-27 14:37 d-------- C:\Documents and Settings\All Users\Dane aplikacji\PC Suite 2007-10-27 14:37 13,312 --a------ C:\WINDOWS\system32\drivers\nmwcdcm.sys 2007-10-27 14:36 d-------- C:\Program Files\Nokia 2007-10-27 14:36 d-------- C:\Documents and Settings\All Users\Dane aplikacji\Downloaded Installations 2007-10-25 09:06 d-------- C:\WINDOWS\OpenOfficePortable 2007-10-24 22:38 d-------- C:\Program Files\FERRO Software 2007-10-24 22:38 d-------- C:\Documents and Settings\Daniel\Dane aplikacji\Ferro Software 2007-10-24 22:11 d-------- C:\Documents and Settings\All Users\Dane aplikacji\Microsoft Help . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2007-11-23 16:30 --------- d-----w C:\Documents and Settings\Daniel\Dane aplikacji\GanymedeNet 2007-11-23 10:54 --------- d-----w C:\Program Files\Common Files\Symantec Shared 2007-11-22 22:00 --------- d-----w C:\Documents and Settings\Daniel\Dane aplikacji\Skype 2007-11-20 11:39 --------- d-----w C:\Program Files\Ganymede 2007-11-18 16:17 --------- d-----w C:\Program Files\Norton AntiVirus 2007-11-18 16:13 --------- d-----w C:\Program Files\Symantec 2007-11-18 16:12 --------- d---a-w C:\Documents and Settings\All Users\Dane aplikacji\TEMP 2007-11-18 15:14 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Symantec 2007-11-17 18:23 12,800 --s-a-w C:\WINDOWS\system32\moywh.dll 2007-11-17 18:22 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Apple Computer 2007-11-15 14:26 --------- d--h--w C:\Program Files\InstallShield Installation Information 2007-11-13 06:14 --------- d-----w C:\Program Files\Gadu-Gadu 2007-11-06 11:16 --------- d-----w C:\Program Files\Apple Software Update 2007-11-01 09:50 --------- d-----w C:\Program Files\Hard Truck 2007-10-31 13:14 --------- d-----w C:\Program Files\Era futbolu 2002 2007-10-30 21:28 --------- d-----w C:\Program Files\NiemPol 2007-10-25 16:44 8,488,960 ----a-w C:\WINDOWS\system32\dllcache\shell32.dll 2007-10-24 21:15 --------- d-----w C:\Program Files\Microsoft Works 2007-10-22 09:40 --------- d-----w C:\Program Files\directx 2007-10-22 09:39 --------- d-----w C:\Program Files\AidemMedia 2007-10-20 12:40 --------- d-----w C:\Program Files\Davilex Games 2007-10-17 10:44 --------- d-----w C:\Documents and Settings\Daniel\Dane aplikacji\Teleca 2007-10-17 10:39 --------- d-----w C:\Documents and Settings\Daniel\Dane aplikacji\Sony Ericsson 2007-10-17 10:39 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Teleca 2007-10-17 10:38 --------- d-----w C:\Program Files\Common Files\Teleca Shared 2007-10-17 10:38 --------- d-----w C:\Program Files\Common Files\Sony Ericsson Shared 2007-10-17 10:38 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Sony Ericsson 2007-10-17 06:23 --------- d-----w C:\Program Files\Sony Ericsson 2007-10-16 17:06 164,352 ----a-w C:\WINDOWS\system32\SpoonUninstall.exe 2007-10-04 20:43 --------- d-----w C:\Documents and Settings\Daniel\Dane aplikacji\Tibia 2007-10-04 20:34 --------- d-----w C:\Program Files\Tibia 2007-10-01 12:00 --------- d-----w C:\Program Files\Winamp 2007-09-30 18:04 --------- d-----w C:\Program Files\MyPortal 2007-09-27 13:16 --------- d-----w C:\Program Files\Sims 2007-05-16 21:32 6,221,304 ----a-w C:\Program Files\winamp535_full_emusic-7plus.exe 2007-05-16 21:31 2,072,512 ----a-w C:\Program Files\Winamp_POLSKA_wersja.exe 2006-08-27 12:51 0 ----a-w C:\Documents and Settings\Daniel\Dane aplikacji\wklnhst.dat . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{0D39A900-0F3A-4C29-A254-3E65244FDC34}] 2007-06-27 21:27 1044480 --a------ C:\Program Files\ContextTool\ContextTool-2.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{59879FA4-4790-461c-A1CC-4EC4DE4CA483}] C:\Program Files\RXToolBar\sfcont.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar] "{70CC76D5-A4EE-4F25-9931-B109A63E298E}"= C:\Program Files\Video Add-on\ictmdl.dll [2007-11-18 15:18 81920] [HKEY_CLASSES_ROOT\clsid\{70cc76d5-a4ee-4f25-9931-b109a63e298e}] [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser] "{70CC76D5-A4EE-4F25-9931-B109A63E298E}"= C:\Program Files\Video Add-on\ictmdl.dll [2007-11-18 15:18 81920] [HKEY_CLASSES_ROOT\clsid\{70cc76d5-a4ee-4f25-9931-b109a63e298e}] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-06-10 10:12] "Gadu-Gadu"="C:\Program Files\Gadu-Gadu\gg.exe" [2007-05-10 15:36] "SpeedX"="C:\PROGRA~1\MyPortal\Speed-X\SpeedX.exe" [] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 09:00] "PcSync"="C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2006-06-27 15:21] "AntiSpywareShield"="C:\Program Files\AntiSpywareShield\AntiSpywareShield.exe" [] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2006-01-04 20:05] "SetRefresh"="C:\Program Files\Compaq\SetRefresh\SetRefresh.exe" [2003-11-20 20:01] "DLA"="C:\WINDOWS\System32\DLA\DLACTRLW.EXE" [2005-09-28 04:10] "ISUSPM Startup"="C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-07-27 15:50] "ISUSScheduler"="C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [2004-07-27 15:50] "HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2005-12-15 10:18] "NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 11:50] "BearShare"="C:\Program Files\BearShare\BearShare.exe" [2006-08-01 16:04] "WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2007-05-14 23:22] "StormCodec_Helper"="C:\Program Files\Ringz Studio\Storm Codec\StormSet.exe" [2005-03-24 13:52] "CameraFixer"="C:\WINDOWS\CameraFixer.exe" [2005-12-06 12:08] "Sony Ericsson PC Suite"="C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" [2007-06-13 07:16] "PCSuiteTrayApplication"="C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.exe" [2006-06-15 11:36] "DAEMON Tools-1033"="C:\Program Files\D-Tools\daemon.exe" [2004-03-12 22:43] "QuickTime Task"="C:\Program Files\Ringz Studio\Storm Codec\QTTask.exe" [2007-11-14 23:43] "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-11-15 13:11] "ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2007-02-22 10:58] "SSC_UserPrompt"="C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe" [2005-07-29 10:35] "Symantec NetDriver Monitor"="C:\PROGRA~1\SYMNET~1\SNDMon.exe" [2007-11-18 17:12] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 09:00] C:\Documents and Settings\Daniel\Menu Start\Programy\Autostart\ PowerReg Scheduler V3.exe [2007-09-12 10:48:36] C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\ Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2004-12-14 03:44:06] HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2005-12-15 10:40:44] Ralink Wireless Utility.lnk - C:\Program Files\RALINK\Common\RaUI.exe [2006-09-19 15:52:56] Sonic CinePlayer Quick Launch.lnk - C:\Program Files\Common Files\Sonic Shared\CineTray.exe [2005-10-15 01:01:00] [hklm\software\microsoft\windows\currentversion\explorer\sharedtaskscheduler] "{8373a2e0-bdd0-42bd-b4ec-ba5451eb6607}"= C:\WINDOWS\system32\moywh.dll [2007-11-17 19:23 12800] R0 d346bus;d346bus;C:\WINDOWS\system32\DRIVERS\d346bus.sys R0 d346prt;d346prt;C:\WINDOWS\system32\Drivers\d346prt.sys R2 Harmonogram automatycznej usługi LiveUpdate;Harmonogram automatycznej usługi LiveUpdate;"C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe" R3 WmBEnum;Logitech Virtual Bus Enumerator Driver;C:\WINDOWS\system32\drivers\WmBEnum.sys R3 WmXlCore;Logitech WingMan Translation Layer Driver;C:\WINDOWS\system32\drivers\WmXlCore.sys S3 KS-959;MA-620 USB Infrared Adapter;C:\WINDOWS\system32\DRIVERS\KS-959.sys S3 rockusb;Driver for rockusb Device;C:\WINDOWS\system32\DRIVERS\rockusb.sys S3 s125bus;Sony Ericsson Device 125 driver (WDM);C:\WINDOWS\system32\DRIVERS\s125bus.sys S3 s125mdfl;Sony Ericsson Device 125 USB WMC Modem Filter;C:\WINDOWS\system32\DRIVERS\s125mdfl.sys S3 s125mdm;Sony Ericsson Device 125 USB WMC Modem Driver;C:\WINDOWS\system32\DRIVERS\s125mdm.sys S3 s125mgmt;Sony Ericsson Device 125 USB WMC Device Management Drivers (WDM);C:\WINDOWS\system32\DRIVERS\s125mgmt.sys S3 s125obex;Sony Ericsson Device 125 USB WMC OBEX Interface;C:\WINDOWS\system32\DRIVERS\s125obex.sys S3 WmFilter;Logitech WingMan HID Filter Driver;C:\WINDOWS\system32\drivers\WmFilter.sys S3 WmVirHid;Logitech Virtual Hid Device Driver;C:\WINDOWS\system32\drivers\WmVirHid.sys *Newly Created Service* - CATCHME . Contents of the 'Scheduled Tasks' folder "2007-11-17 16:07:06 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job" - C:\Program Files\Apple Software Update\SoftwareUpdate.exe "2007-11-18 15:26:12 C:\WINDOWS\Tasks\Norton AntiVirus - Skanuj komputer - Daniel.job" - C:\PROGRA~1\NORTON~1\Navw32.exe .

log hijack:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 13:31, on 2007-11-24
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\WINDOWS\System32\DLA\DLACTRLW.EXE
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\BearShare\BearShare.exe
C:\Program Files\Winamp\winampa.exe
C:\WINDOWS\CameraFixer.exe
C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe
C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE
C:\Program Files\D-Tools\daemon.exe
C:\Program Files\Ringz Studio\Storm Codec\QTTask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\RALINK\Common\RaUI.exe
C:\Program Files\Common Files\Sonic Shared\CineTray.exe
C:\PROGRA~1\COMMON~1\Nokia\MPAPI\MPAPI3s.exe
C:\Program Files\Common Files\Teleca Shared\Generic.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Sony Ericsson\Mobile\Mobile Phone Monitor\epmworker.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.interia.pl/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://www.crawler.com/search/ie.aspx?tb_id=66020
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,CustomizeSearch = http://dnl.crawler.com/support/sa_customize.aspx?TbId=66020
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Media Holding Enterprises, LLC - {0D39A900-0F3A-4C29-A254-3E65244FDC34} - C:\Program Files\ContextTool\ContextTool-2.dll
O2 - BHO: RXResultTracker Class - {59879FA4-4790-461c-A1CC-4EC4DE4CA483} - C:\Program Files\RXToolBar\sfcont.dll (file missing)
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: NetSprint Toolbar - {D7778770-4603-4b95-9070-0D608A7E108C} - (no file)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: IE Custom Tools - {70CC76D5-A4EE-4F25-9931-B109A63E298E} - C:\Program Files\Video Add-on\ictmdl.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [SetRefresh] C:\Program Files\Compaq\SetRefresh\SetRefresh.exe
O4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [BearShare] "C:\Program Files\BearShare\BearShare.exe" /pause
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [StormCodec_Helper] "C:\Program Files\Ringz Studio\Storm Codec\StormSet.exe" /S /opti
O4 - HKLM\..\Run: [CameraFixer] C:\WINDOWS\CameraFixer.exe
O4 - HKLM\..\Run: [Sony Ericsson PC Suite] "C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions
O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE -startup
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\Ringz Studio\Storm Codec\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray
O4 - HKCU\..\Run: [SpeedX] C:\PROGRA~1\MyPortal\Speed-X\SpeedX.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [PcSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog
O4 - HKCU\..\Run: [AntiSpywareShield] C:\Program Files\AntiSpywareShield\AntiSpywareShield.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: PowerReg Scheduler V3.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Ralink Wireless Utility.lnk = C:\Program Files\RALINK\Common\RaUI.exe
O4 - Global Startup: Sonic CinePlayer Quick Launch.lnk = C:\Program Files\Common Files\Sonic Shared\CineTray.exe
O8 - Extra context menu item: &Search - http://kn.bar.need2find.com/KN/menusearch.html?p=KN
O8 - Extra context menu item: Add to AMV Convert Tool... - C:\Program Files\MP3 Player Utilities 4.00\AMVConverter\grab.html
O8 - Extra context menu item: Add to AMV Converter... - C:\Program Files\MP3 Player Utilities 4.09\AMVConverter\grab.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: MediaManager tool grab multimedia file - C:\Program Files\MP3 Player Utilities 4.09\MediaManager\grab.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_03\bin\npjpi150_03.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_03\bin\npjpi150_03.dll
O9 - Extra button: Ň×ȤąşÎď - {DE60714F-AC17-427e-861A-FD60CBDF119A} - http://click2.ad4all.net/url2/urlmanage/url.asp?id=1 (file missing)
O9 - Extra 'Tools' menuitem: Ň×ȤąşÎď - {DE60714F-AC17-427e-861A-FD60CBDF119A} - http://click2.ad4all.net/url2/urlmanage/url.asp?id=1 (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {C4925E65-7A1E-11D2-8BB4-00A0C9CC72C3} (Virtools WebPlayer Class) - http://a532.g.akamai.net/7/532/6712/6c5b0a1ae398e3/player.virtools.com/downloads/player/Install2.5/Installer.exe
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - https://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O16 - DPF: {DEB21AD3-FDA4-42F6-B57D-EE696A675EE8} (IPSUploader Control) - http://asp03.photoprintit.de/microsite/1661/defaults/activex/IPSUploader.cab
O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C1} (GameDesire Pool - http://67.15.101.33/g_bin/pl/billard8_2_0_0_35.cab
O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C4} (GameDesire Pool Training) - http://67.15.101.3/g_bin/pl/billardt_2_0_0_31.cab
O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C5} (GameDesire Snooker) - http://67.15.101.33/g_bin/pl/snooker_2_0_0_35.cab
O16 - DPF: {FE0BD779-44EE-4A4B-AA2E-743C63F2E5E6} (IWinAmpActiveX Class) - http://pdl.stream.aol.com/downloads/aol/unagi/ampx_en_dl.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{6040EEFF-B200-47FD-854D-F464E17AA31E}: NameServer = 213.76.158.10,194.204.159.1
O17 - HKLM\System\CCS\Services\Tcpip\..\{A8C9CBED-7A69-4B21-BD8A-3B26BB9A27B3}: NameServer = 213.76.158.10,194.204.159.1
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O22 - SharedTaskScheduler: haeckel - {8373a2e0-bdd0-42bd-b4ec-ba5451eb6607} - C:\WINDOWS\system32\moywh.dll
O23 - Service: Urządzenie mobilne Apple (Apple Mobile Device) - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Harmonogram automatycznej usługi LiveUpdate - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Usługa iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

--
End of file - 12813 bytes

[wojtas]

log z combofixa Ci nie wyszedl popraw go

[siwykotla]

z combofixa daje jeszcze raz bo jakis neprzejrzysty

ComboFix 07-11-19.3 - Daniel 2007-11-23 17:56:13.1 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.2.1250.1.1045.18.157 [GMT 1:00] Running from: C:\Documents and Settings\Daniel\Pulpit\ComboFix.exe * Created a new restore point . ((((((((((((((((((((((((( Files Created from 2007-10-23 to 2007-11-23 ))))))))))))))))))))))))))))))) . 2007-11-22 17:35 d-------- C:\Program Files\Trend Micro 2007-11-21 12:03 d-------- C:\Program Files\GRAUCZO 2007-11-20 20:01 d-------- C:\Program Files\Gimnazjum klasa 1 - Planeta Nowa 2007-11-19 17:55 d-------- C:\Program Files\PlayMP3z 2007-11-19 17:55 d-------- C:\Program Files\ContextTool 2007-11-18 17:12 d-------- C:\Program Files\SymNetDrv 2007-11-18 16:11 4,608 --a------ C:\WINDOWS\system32\drivers\symlcbrd.sys 2007-11-18 16:10 124,016 --a------ C:\WINDOWS\system32\drivers\SYMEVENT.SYS 2007-11-18 15:18 d-------- C:\Program Files\Video Add-on 2007-11-17 19:22 d-------- C:\Program Files\iTunes 2007-11-17 19:22 d-------- C:\Program Files\iPod 2007-11-17 19:14 d-------- C:\Program Files\Common Files\Apple 2007-11-15 15:29 545 --a------ C:\WINDOWS\system32\game.cfg 2007-11-15 15:29 248 --a------ C:\WINDOWS\system32\config.cfg 2007-11-15 15:29 5 --a------ C:\WINDOWS\system32\detail.cfg 2007-11-15 15:26 d-------- C:\Team17 2007-11-14 15:38 d-------- C:\Program Files\D-Tools 2007-11-14 15:38 156,800 --a------ C:\WINDOWS\system32\drivers\d346bus.sys 2007-11-14 15:38 5,248 --a------ C:\WINDOWS\system32\drivers\d346prt.sys 2007-11-06 12:16 d-------- C:\Documents and Settings\All Users\Dane aplikacji\Apple 2007-11-02 13:17 d-------- C:\Program Files\GameSpy Arcade 2007-11-02 13:01 d-------- C:\Program Files\Colin McRae Rally 04 2007-11-01 08:13 d-------- C:\Program Files\Norton Security Scan 2007-10-28 15:04 d-------- C:\Documents and Settings\Daniel\Dane aplikacji\Nokia Multimedia Player 2007-10-28 15:01 d-------- C:\Documents and Settings\Daniel\Dane aplikacji\Nokia 2007-10-27 14:39 d-------- C:\Program Files\DIFX 2007-10-27 14:39 d-------- C:\Documents and Settings\Daniel\Phone Browser 2007-10-27 14:37 d-------- C:\Program Files\Common Files\PCSuite 2007-10-27 14:37 d-------- C:\Program Files\Common Files\Nokia 2007-10-27 14:37 d-------- C:\Documents and Settings\Daniel\Dane aplikacji\PC Suite 2007-10-27 14:37 d-------- C:\Documents and Settings\All Users\Dane aplikacji\PC Suite 2007-10-27 14:37 13,312 --a------ C:\WINDOWS\system32\drivers\nmwcdcm.sys 2007-10-27 14:36 d-------- C:\Program Files\Nokia 2007-10-27 14:36 d-------- C:\Documents and Settings\All Users\Dane aplikacji\Downloaded Installations 2007-10-25 09:06 d-------- C:\WINDOWS\OpenOfficePortable 2007-10-24 22:38 d-------- C:\Program Files\FERRO Software 2007-10-24 22:38 d-------- C:\Documents and Settings\Daniel\Dane aplikacji\Ferro Software 2007-10-24 22:11 d-------- C:\Documents and Settings\All Users\Dane aplikacji\Microsoft Help . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2007-11-23 16:30 --------- d-----w C:\Documents and Settings\Daniel\Dane aplikacji\GanymedeNet 2007-11-23 10:54 --------- d-----w C:\Program Files\Common Files\Symantec Shared 2007-11-22 22:00 --------- d-----w C:\Documents and Settings\Daniel\Dane aplikacji\Skype 2007-11-20 11:39 --------- d-----w C:\Program Files\Ganymede 2007-11-18 16:17 --------- d-----w C:\Program Files\Norton AntiVirus 2007-11-18 16:13 --------- d-----w C:\Program Files\Symantec 2007-11-18 16:12 --------- d---a-w C:\Documents and Settings\All Users\Dane aplikacji\TEMP 2007-11-18 15:14 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Symantec 2007-11-17 18:23 12,800 --s-a-w C:\WINDOWS\system32\moywh.dll 2007-11-17 18:22 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Apple Computer 2007-11-15 14:26 --------- d--h--w C:\Program Files\InstallShield Installation Information 2007-11-13 06:14 --------- d-----w C:\Program Files\Gadu-Gadu 2007-11-06 11:16 --------- d-----w C:\Program Files\Apple Software Update 2007-11-01 09:50 --------- d-----w C:\Program Files\Hard Truck 2007-10-31 13:14 --------- d-----w C:\Program Files\Era futbolu 2002 2007-10-30 21:28 --------- d-----w C:\Program Files\NiemPol 2007-10-25 16:44 8,488,960 ----a-w C:\WINDOWS\system32\dllcache\shell32.dll 2007-10-24 21:15 --------- d-----w C:\Program Files\Microsoft Works 2007-10-22 09:40 --------- d-----w C:\Program Files\directx 2007-10-22 09:39 --------- d-----w C:\Program Files\AidemMedia 2007-10-20 12:40 --------- d-----w C:\Program Files\Davilex Games 2007-10-17 10:44 --------- d-----w C:\Documents and Settings\Daniel\Dane aplikacji\Teleca 2007-10-17 10:39 --------- d-----w C:\Documents and Settings\Daniel\Dane aplikacji\Sony Ericsson 2007-10-17 10:39 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Teleca 2007-10-17 10:38 --------- d-----w C:\Program Files\Common Files\Teleca Shared 2007-10-17 10:38 --------- d-----w C:\Program Files\Common Files\Sony Ericsson Shared 2007-10-17 10:38 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Sony Ericsson 2007-10-17 06:23 --------- d-----w C:\Program Files\Sony Ericsson 2007-10-16 17:06 164,352 ----a-w C:\WINDOWS\system32\SpoonUninstall.exe 2007-10-04 20:43 --------- d-----w C:\Documents and Settings\Daniel\Dane aplikacji\Tibia 2007-10-04 20:34 --------- d-----w C:\Program Files\Tibia 2007-10-01 12:00 --------- d-----w C:\Program Files\Winamp 2007-09-30 18:04 --------- d-----w C:\Program Files\MyPortal 2007-09-27 13:16 --------- d-----w C:\Program Files\Sims 2007-05-16 21:32 6,221,304 ----a-w C:\Program Files\winamp535_full_emusic-7plus.exe 2007-05-16 21:31 2,072,512 ----a-w C:\Program Files\Winamp_POLSKA_wersja.exe 2006-08-27 12:51 0 ----a-w C:\Documents and Settings\Daniel\Dane aplikacji\wklnhst.dat . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{0D39A900-0F3A-4C29-A254-3E65244FDC34}] 2007-06-27 21:27 1044480 --a------ C:\Program Files\ContextTool\ContextTool-2.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{59879FA4-4790-461c-A1CC-4EC4DE4CA483}] C:\Program Files\RXToolBar\sfcont.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar] "{70CC76D5-A4EE-4F25-9931-B109A63E298E}"= C:\Program Files\Video Add-on\ictmdl.dll [2007-11-18 15:18 81920] [HKEY_CLASSES_ROOT\clsid\{70cc76d5-a4ee-4f25-9931-b109a63e298e}] [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser] "{70CC76D5-A4EE-4F25-9931-B109A63E298E}"= C:\Program Files\Video Add-on\ictmdl.dll [2007-11-18 15:18 81920] [HKEY_CLASSES_ROOT\clsid\{70cc76d5-a4ee-4f25-9931-b109a63e298e}] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-06-10 10:12] "Gadu-Gadu"="C:\Program Files\Gadu-Gadu\gg.exe" [2007-05-10 15:36] "SpeedX"="C:\PROGRA~1\MyPortal\Speed-X\SpeedX.exe" [] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 09:00] "PcSync"="C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2006-06-27 15:21] "AntiSpywareShield"="C:\Program Files\AntiSpywareShield\AntiSpywareShield.exe" [] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2006-01-04 20:05] "SetRefresh"="C:\Program Files\Compaq\SetRefresh\SetRefresh.exe" [2003-11-20 20:01] "DLA"="C:\WINDOWS\System32\DLA\DLACTRLW.EXE" [2005-09-28 04:10] "ISUSPM Startup"="C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-07-27 15:50] "ISUSScheduler"="C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [2004-07-27 15:50] "HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2005-12-15 10:18] "NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 11:50] "BearShare"="C:\Program Files\BearShare\BearShare.exe" [2006-08-01 16:04] "WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2007-05-14 23:22] "StormCodec_Helper"="C:\Program Files\Ringz Studio\Storm Codec\StormSet.exe" [2005-03-24 13:52] "CameraFixer"="C:\WINDOWS\CameraFixer.exe" [2005-12-06 12:08] "Sony Ericsson PC Suite"="C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" [2007-06-13 07:16] "PCSuiteTrayApplication"="C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.exe" [2006-06-15 11:36] "DAEMON Tools-1033"="C:\Program Files\D-Tools\daemon.exe" [2004-03-12 22:43] "QuickTime Task"="C:\Program Files\Ringz Studio\Storm Codec\QTTask.exe" [2007-11-14 23:43] "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-11-15 13:11] "ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2007-02-22 10:58] "SSC_UserPrompt"="C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe" [2005-07-29 10:35] "Symantec NetDriver Monitor"="C:\PROGRA~1\SYMNET~1\SNDMon.exe" [2007-11-18 17:12] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 09:00] C:\Documents and Settings\Daniel\Menu Start\Programy\Autostart\ PowerReg Scheduler V3.exe [2007-09-12 10:48:36] C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\ Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2004-12-14 03:44:06] HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2005-12-15 10:40:44] Ralink Wireless Utility.lnk - C:\Program Files\RALINK\Common\RaUI.exe [2006-09-19 15:52:56] Sonic CinePlayer Quick Launch.lnk - C:\Program Files\Common Files\Sonic Shared\CineTray.exe [2005-10-15 01:01:00] [hklm\software\microsoft\windows\currentversion\explorer\sharedtaskscheduler] "{8373a2e0-bdd0-42bd-b4ec-ba5451eb6607}"= C:\WINDOWS\system32\moywh.dll [2007-11-17 19:23 12800] R0 d346bus;d346bus;C:\WINDOWS\system32\DRIVERS\d346bus.sys R0 d346prt;d346prt;C:\WINDOWS\system32\Drivers\d346prt.sys R2 Harmonogram automatycznej usługi LiveUpdate;Harmonogram automatycznej usługi LiveUpdate;"C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe" R3 WmBEnum;Logitech Virtual Bus Enumerator Driver;C:\WINDOWS\system32\drivers\WmBEnum.sys R3 WmXlCore;Logitech WingMan Translation Layer Driver;C:\WINDOWS\system32\drivers\WmXlCore.sys S3 KS-959;MA-620 USB Infrared Adapter;C:\WINDOWS\system32\DRIVERS\KS-959.sys S3 rockusb;Driver for rockusb Device;C:\WINDOWS\system32\DRIVERS\rockusb.sys S3 s125bus;Sony Ericsson Device 125 driver (WDM);C:\WINDOWS\system32\DRIVERS\s125bus.sys S3 s125mdfl;Sony Ericsson Device 125 USB WMC Modem Filter;C:\WINDOWS\system32\DRIVERS\s125mdfl.sys S3 s125mdm;Sony Ericsson Device 125 USB WMC Modem Driver;C:\WINDOWS\system32\DRIVERS\s125mdm.sys S3 s125mgmt;Sony Ericsson Device 125 USB WMC Device Management Drivers (WDM);C:\WINDOWS\system32\DRIVERS\s125mgmt.sys S3 s125obex;Sony Ericsson Device 125 USB WMC OBEX Interface;C:\WINDOWS\system32\DRIVERS\s125obex.sys S3 WmFilter;Logitech WingMan HID Filter Driver;C:\WINDOWS\system32\drivers\WmFilter.sys S3 WmVirHid;Logitech Virtual Hid Device Driver;C:\WINDOWS\system32\drivers\WmVirHid.sys *Newly Created Service* - CATCHME . Contents of the 'Scheduled Tasks' folder "2007-11-17 16:07:06 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job" - C:\Program Files\Apple Software Update\SoftwareUpdate.exe "2007-11-18 15:26:12 C:\WINDOWS\Tasks\Norton AntiVirus - Skanuj komputer - Daniel.job" - C:\PROGRA~1\NORTON~1\Navw32.exe .

[wojtas]

ten log jest niewyrazny.... zobacz tu jak u innych wygladal log

[siwykotla]

teraz dobrze???

ComboFix 07-11-19.3 - Daniel 2007-11-23 17:56:13.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1250.1.1045.18.157 [GMT 1:00]
Running from: C:\Documents and Settings\Daniel\Pulpit\ComboFix.exe
* Created a new restore point
.

((((((((((((((((((((((((( Files Created from 2007-10-23 to 2007-11-23 )))))))))))))))))))))))))))))))
.

2007-11-22 17:35 <DIR> d-------- C:\Program Files\Trend Micro
2007-11-21 12:03 <DIR> d-------- C:\Program Files\GRAUCZO
2007-11-20 20:01 <DIR> d-------- C:\Program Files\Gimnazjum klasa 1 - Planeta Nowa
2007-11-19 17:55 <DIR> d-------- C:\Program Files\PlayMP3z
2007-11-19 17:55 <DIR> d-------- C:\Program Files\ContextTool
2007-11-18 17:12 <DIR> d-------- C:\Program Files\SymNetDrv
2007-11-18 16:11 4,608 --a------ C:\WINDOWS\system32\drivers\symlcbrd.sys
2007-11-18 16:10 124,016 --a------ C:\WINDOWS\system32\drivers\SYMEVENT.SYS
2007-11-18 15:18 <DIR> d-------- C:\Program Files\Video Add-on
2007-11-17 19:22 <DIR> d-------- C:\Program Files\iTunes
2007-11-17 19:22 <DIR> d-------- C:\Program Files\iPod
2007-11-17 19:14 <DIR> d-------- C:\Program Files\Common Files\Apple
2007-11-15 15:29 545 --a------ C:\WINDOWS\system32\game.cfg
2007-11-15 15:29 248 --a------ C:\WINDOWS\system32\config.cfg
2007-11-15 15:29 5 --a------ C:\WINDOWS\system32\detail.cfg
2007-11-15 15:26 <DIR> d-------- C:\Team17
2007-11-14 15:38 <DIR> d-------- C:\Program Files\D-Tools
2007-11-14 15:38 156,800 --a------ C:\WINDOWS\system32\drivers\d346bus.sys
2007-11-14 15:38 5,248 --a------ C:\WINDOWS\system32\drivers\d346prt.sys
2007-11-06 12:16 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Apple
2007-11-02 13:17 <DIR> d-------- C:\Program Files\GameSpy Arcade
2007-11-02 13:01 <DIR> d-------- C:\Program Files\Colin McRae Rally 04
2007-11-01 08:13 <DIR> d-------- C:\Program Files\Norton Security Scan
2007-10-28 15:04 <DIR> d-------- C:\Documents and Settings\Daniel\Dane aplikacji\Nokia Multimedia Player
2007-10-28 15:01 <DIR> d-------- C:\Documents and Settings\Daniel\Dane aplikacji\Nokia
2007-10-27 14:39 <DIR> d-------- C:\Program Files\DIFX
2007-10-27 14:39 <DIR> d-------- C:\Documents and Settings\Daniel\Phone Browser
2007-10-27 14:37 <DIR> d-------- C:\Program Files\Common Files\PCSuite
2007-10-27 14:37 <DIR> d-------- C:\Program Files\Common Files\Nokia
2007-10-27 14:37 <DIR> d-------- C:\Documents and Settings\Daniel\Dane aplikacji\PC Suite
2007-10-27 14:37 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\PC Suite
2007-10-27 14:37 13,312 --a------ C:\WINDOWS\system32\drivers\nmwcdcm.sys
2007-10-27 14:36 <DIR> d-------- C:\Program Files\Nokia
2007-10-27 14:36 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Downloaded Installations
2007-10-25 09:06 <DIR> d-------- C:\WINDOWS\OpenOfficePortable
2007-10-24 22:38 <DIR> d-------- C:\Program Files\FERRO Software
2007-10-24 22:38 <DIR> d-------- C:\Documents and Settings\Daniel\Dane aplikacji\Ferro Software
2007-10-24 22:11 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Microsoft Help

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-11-23 16:30 --------- d-----w C:\Documents and Settings\Daniel\Dane aplikacji\GanymedeNet
2007-11-23 10:54 --------- d-----w C:\Program Files\Common Files\Symantec Shared
2007-11-22 22:00 --------- d-----w C:\Documents and Settings\Daniel\Dane aplikacji\Skype
2007-11-20 11:39 --------- d-----w C:\Program Files\Ganymede
2007-11-18 16:17 --------- d-----w C:\Program Files\Norton AntiVirus
2007-11-18 16:13 --------- d-----w C:\Program Files\Symantec
2007-11-18 16:12 --------- d---a-w C:\Documents and Settings\All Users\Dane aplikacji\TEMP
2007-11-18 15:14 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Symantec
2007-11-17 18:23 12,800 --s-a-w C:\WINDOWS\system32\moywh.dll
2007-11-17 18:22 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Apple Computer
2007-11-15 14:26 --------- d--h--w C:\Program Files\InstallShield Installation Information
2007-11-13 06:14 --------- d-----w C:\Program Files\Gadu-Gadu
2007-11-06 11:16 --------- d-----w C:\Program Files\Apple Software Update
2007-11-01 09:50 --------- d-----w C:\Program Files\Hard Truck
2007-10-31 13:14 --------- d-----w C:\Program Files\Era futbolu 2002
2007-10-30 21:28 --------- d-----w C:\Program Files\NiemPol
2007-10-25 16:44 8,488,960 ----a-w C:\WINDOWS\system32\dllcache\shell32.dll
2007-10-24 21:15 --------- d-----w C:\Program Files\Microsoft Works
2007-10-22 09:40 --------- d-----w C:\Program Files\directx
2007-10-22 09:39 --------- d-----w C:\Program Files\AidemMedia
2007-10-20 12:40 --------- d-----w C:\Program Files\Davilex Games
2007-10-17 10:44 --------- d-----w C:\Documents and Settings\Daniel\Dane aplikacji\Teleca
2007-10-17 10:39 --------- d-----w C:\Documents and Settings\Daniel\Dane aplikacji\Sony Ericsson
2007-10-17 10:39 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Teleca
2007-10-17 10:38 --------- d-----w C:\Program Files\Common Files\Teleca Shared
2007-10-17 10:38 --------- d-----w C:\Program Files\Common Files\Sony Ericsson Shared
2007-10-17 10:38 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Sony Ericsson
2007-10-17 06:23 --------- d-----w C:\Program Files\Sony Ericsson
2007-10-16 17:06 164,352 ----a-w C:\WINDOWS\system32\SpoonUninstall.exe
2007-10-04 20:43 --------- d-----w C:\Documents and Settings\Daniel\Dane aplikacji\Tibia
2007-10-04 20:34 --------- d-----w C:\Program Files\Tibia
2007-10-01 12:00 --------- d-----w C:\Program Files\Winamp
2007-09-30 18:04 --------- d-----w C:\Program Files\MyPortal
2007-09-27 13:16 --------- d-----w C:\Program Files\Sims
2007-05-16 21:32 6,221,304 ----a-w C:\Program Files\winamp535_full_emusic-7plus.exe
2007-05-16 21:31 2,072,512 ----a-w C:\Program Files\Winamp_POLSKA_wersja.exe
2006-08-27 12:51 0 ----a-w C:\Documents and Settings\Daniel\Dane aplikacji\wklnhst.dat
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{0D39A900-0F3A-4C29-A254-3E65244FDC34}]
2007-06-27 21:27 1044480 --a------ C:\Program Files\ContextTool\ContextTool-2.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{59879FA4-4790-461c-A1CC-4EC4DE4CA483}]
C:\Program Files\RXToolBar\sfcont.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{70CC76D5-A4EE-4F25-9931-B109A63E298E}"= C:\Program Files\Video Add-on\ictmdl.dll [2007-11-18 15:18 81920]

[HKEY_CLASSES_ROOT\clsid\{70cc76d5-a4ee-4f25-9931-b109a63e298e}]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser]
"{70CC76D5-A4EE-4F25-9931-B109A63E298E}"= C:\Program Files\Video Add-on\ictmdl.dll [2007-11-18 15:18 81920]

[HKEY_CLASSES_ROOT\clsid\{70cc76d5-a4ee-4f25-9931-b109a63e298e}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-06-10 10:12]
"Gadu-Gadu"="C:\Program Files\Gadu-Gadu\gg.exe" [2007-05-10 15:36]
"SpeedX"="C:\PROGRA~1\MyPortal\Speed-X\SpeedX.exe" []
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 09:00]
"PcSync"="C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2006-06-27 15:21]
"AntiSpywareShield"="C:\Program Files\AntiSpywareShield\AntiSpywareShield.exe" []

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2006-01-04 20:05]
"SetRefresh"="C:\Program Files\Compaq\SetRefresh\SetRefresh.exe" [2003-11-20 20:01]
"DLA"="C:\WINDOWS\System32\DLA\DLACTRLW.EXE" [2005-09-28 04:10]
"ISUSPM Startup"="C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-07-27 15:50]
"ISUSScheduler"="C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [2004-07-27 15:50]
"HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2005-12-15 10:18]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 11:50]
"BearShare"="C:\Program Files\BearShare\BearShare.exe" [2006-08-01 16:04]
"WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2007-05-14 23:22]
"StormCodec_Helper"="C:\Program Files\Ringz Studio\Storm Codec\StormSet.exe" [2005-03-24 13:52]
"CameraFixer"="C:\WINDOWS\CameraFixer.exe" [2005-12-06 12:08]
"Sony Ericsson PC Suite"="C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" [2007-06-13 07:16]
"PCSuiteTrayApplication"="C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.exe" [2006-06-15 11:36]
"DAEMON Tools-1033"="C:\Program Files\D-Tools\daemon.exe" [2004-03-12 22:43]
"QuickTime Task"="C:\Program Files\Ringz Studio\Storm Codec\QTTask.exe" [2007-11-14 23:43]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-11-15 13:11]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2007-02-22 10:58]
"SSC_UserPrompt"="C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe" [2005-07-29 10:35]
"Symantec NetDriver Monitor"="C:\PROGRA~1\SYMNET~1\SNDMon.exe" [2007-11-18 17:12]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 09:00]

C:\Documents and Settings\Daniel\Menu Start\Programy\Autostart\
PowerReg Scheduler V3.exe [2007-09-12 10:48:36]

C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\
Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2004-12-14 03:44:06]
HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2005-12-15 10:40:44]
Ralink Wireless Utility.lnk - C:\Program Files\RALINK\Common\RaUI.exe [2006-09-19 15:52:56]
Sonic CinePlayer Quick Launch.lnk - C:\Program Files\Common Files\Sonic Shared\CineTray.exe [2005-10-15 01:01:00]

[hklm\software\microsoft\windows\currentversion\explorer\sharedtaskscheduler]
"{8373a2e0-bdd0-42bd-b4ec-ba5451eb6607}"= C:\WINDOWS\system32\moywh.dll [2007-11-17 19:23 12800]

R0 d346bus;d346bus;C:\WINDOWS\system32\DRIVERS\d346bus.sys
R0 d346prt;d346prt;C:\WINDOWS\system32\Drivers\d346prt.sys
R2 Harmonogram automatycznej usługi LiveUpdate;Harmonogram automatycznej usługi LiveUpdate;"C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe"
R3 WmBEnum;Logitech Virtual Bus Enumerator Driver;C:\WINDOWS\system32\drivers\WmBEnum.sys
R3 WmXlCore;Logitech WingMan Translation Layer Driver;C:\WINDOWS\system32\drivers\WmXlCore.sys
S3 KS-959;MA-620 USB Infrared Adapter;C:\WINDOWS\system32\DRIVERS\KS-959.sys
S3 rockusb;Driver for rockusb Device;C:\WINDOWS\system32\DRIVERS\rockusb.sys
S3 s125bus;Sony Ericsson Device 125 driver (WDM);C:\WINDOWS\system32\DRIVERS\s125bus.sys
S3 s125mdfl;Sony Ericsson Device 125 USB WMC Modem Filter;C:\WINDOWS\system32\DRIVERS\s125mdfl.sys
S3 s125mdm;Sony Ericsson Device 125 USB WMC Modem Driver;C:\WINDOWS\system32\DRIVERS\s125mdm.sys
S3 s125mgmt;Sony Ericsson Device 125 USB WMC Device Management Drivers (WDM);C:\WINDOWS\system32\DRIVERS\s125mgmt.sys
S3 s125obex;Sony Ericsson Device 125 USB WMC OBEX Interface;C:\WINDOWS\system32\DRIVERS\s125obex.sys
S3 WmFilter;Logitech WingMan HID Filter Driver;C:\WINDOWS\system32\drivers\WmFilter.sys
S3 WmVirHid;Logitech Virtual Hid Device Driver;C:\WINDOWS\system32\drivers\WmVirHid.sys

*Newly Created Service* - CATCHME
.
Contents of the 'Scheduled Tasks' folder
"2007-11-17 16:07:06 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
"2007-11-18 15:26:12 C:\WINDOWS\Tasks\Norton AntiVirus - Skanuj komputer - Daniel.job"
- C:\PROGRA~1\NORTON~1\Navw32.exe
.

[wojtas]

prawie... tylko log na dole jest troche uciety wklej caly log oraz log z hijacka

[siwykotla]

To jest cały log. a log z hijacka jest troche wyzej

[wojtas]

skasuj:

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://www.crawler.com/search/ie.aspx?tb_id=66020
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,CustomizeSearch = http://dnl.crawler.com/support/sa_customize.aspx?TbId=66020
O2 - BHO: Media Holding Enterprises, LLC - {0D39A900-0F3A-4C29-A254-3E65244FDC34} - C:\Program Files\ContextTool\ContextTool-2.dll
O2 - BHO: RXResultTracker Class - {59879FA4-4790-461c-A1CC-4EC4DE4CA483} - C:\Program Files\RXToolBar\sfcont.dll (file missing)
O3 - Toolbar: NetSprint Toolbar - {D7778770-4603-4b95-9070-0D608A7E108C} - (no file)
O3 - Toolbar: IE Custom Tools - {70CC76D5-A4EE-4F25-9931-B109A63E298E} - C:\Program Files\Video Add-on\ictmdl.dll
O4 - HKCU\..\Run: [AntiSpywareShield] C:\Program Files\AntiSpywareShield\AntiSpywareShield.exe
O4 - Startup: PowerReg Scheduler V3.exe
O8 - Extra context menu item: &Search - http://kn.bar.need2find.com/KN/menusearch.html?p=KN
O9 - Extra button: Ň×ȤąşÎď - {DE60714F-AC17-427e-861A-FD60CBDF119A} - http://click2.ad4all.net/url2/urlmanage/url.asp?id=1 (file missing)
O9 - Extra 'Tools' menuitem: Ň×ȤąşÎď - {DE60714F-AC17-427e-861A-FD60CBDF119A} - http://click2.ad4all.net/url2/urlmanage/url.asp?id=1 (file missing)
O16 - DPF: {C4925E65-7A1E-11D2-8BB4-00A0C9CC72C3} (Virtools WebPlayer Class) - http://a532.g.akamai.net/7/532/6712/6c5b0a1ae398e3/player.virtools.com/downloads/player/Install2.5/Installer.exe
O22 - SharedTaskScheduler: haeckel - {8373a2e0-bdd0-42bd-b4ec-ba5451eb6607} - C:\WINDOWS\system32\moywh.dll

Zastosuj SDFix . Po pobraniu uruchom go a rozpakuje się do C:\SDFix. Uruchom komputer w trybie awaryjnym (F8 przy stracie systemu). Będąc w awaryjnym uruchom plik RunThis.bat z folderu SDFixa. Zatwierdź czyszczenie przez Y. Poczekaj aż ukończy i komputer zresetuje


Otworz notatnik i wklej w nim to:

File::
C:\WINDOWS\system32\moywh.dll
C:\WINDOWS\system32\game.cfg
C:\WINDOWS\system32\config.cfg
C:\WINDOWS\system32\detail.cfg
C:\Documents and Settings\Daniel\Dane aplikacji\wklnhst.dat
C:\Documents and Settings\Daniel\Menu Start\Programy\Autostart\PowerReg Scheduler V3.exe

Folder::
C:\Program Files\ContextTool
C:\Program Files\Video Add-on
C:\Program Files\AntiSpywareShield

Plik >>> zapisz jako CFScript.txt .Plik przeciągnij i upuść na ikonę ComboFixa (tak jak tu ) . Potwierdz >>> zresetuje sie komputer

(jeśli pojawi się pytanie "1 or 2" - to wpisz 1 i naciśnij ENTER). Rozpocznie się proces usuwania

zastosuj

smitfraudfix z opcji 2 w trybie awaryjnym
(sciagnij, wejdz do trybu awaryjnego, odpal plik, potem przycisnij 2 i enter)

Potem wejdz do folderu SDFix wrzuc zawartość pliku Report.txt + log z combofixa oraz z hijacka