proszę o sprawdzenie loga wirus?

**Posty:** 755 · przez **Bartexx** 30 Kwi 2007, 15:46

Witam
Problem polega na tym, że niedawno formatowałem komputer i co około 30 minut w C:\DOCUME~1\Bartek\USTAWI~1\Temp pojawiają sie różne wirusy,konie trojańskie(np.Setup.Exe itp.) nie wiem jaka jest tego przyczyna.
Skanowałem system programami :Avast,Mks Vir Online,S&S destroyer i nie było efektu pliki dalej się pojawiają.Mam jeszcze jedno pytanie czy wirus o rozszerzeniu EXE jesk szkodliwy czy trzeba go uruchomić aby narobił szkód

Log

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\FTRTSVC.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe
C:\PROGRA~1\NEOSTR~1\TaskBarIcon.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\neostrada tp\neostradatp.exe
C:\Program Files\neostrada tp\ComComp.exe
C:\PROGRA~1\NEOSTR~1\Toaster.exe
C:\PROGRA~1\NEOSTR~1\Inactivity.exe
C:\PROGRA~1\NEOSTR~1\PollingModule.exe
C:\WINDOWS\System32\ALERTM~1\ALERTM~1.EXE
C:\Program Files\neostrada tp\Watch.exe
C:\Program Files\Alwil Software\Avast4\ashSimpl.exe
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
C:\Program Files\Gadu-Gadu\gg.exe
C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe
C:\DOCUME~1\Bartek\USTAWI~1\Temp\7exinjs.a8.exe
C:\Documents and Settings\Bartek\Pulpit\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.pl/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = neostrada tp
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\NEOSTR~1\SEARCH~1.DLL
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\NEOSTR~1\Watch.exe
O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\NEOSTR~1\GestMaj.exe TaskBarIcon.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [.nvsvc] C:\WINDOWS\system\smss.exe /w
O4 - HKLM\..\Run: [RivaTunerStartupDaemon] "C:\Program Files\RivaTuner v2.01\RivaTuner.exe" /S
O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe"
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
O4 - Global Startup: Adobe Reader Synchronizer.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe
O9 - Extra button: Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {68282C51-9459-467B-95BF-3C0E89627E55} (MksSkanerOnline Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{B39DE6AC-5D7F-4F3A-B646-D23F13F6DD70}: NameServer = 194.204.159.1 217.98.63.164
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

Pozdrawiam :roll:

przez **jeff** 30 Kwi 2007, 15:55

dołącz nagłowek jeszcze loga

**Posty:** 755 · przez **Bartexx** 30 Kwi 2007, 17:26

hehhe :d
a ja czekam dalej na odpowiedz ;]

**Posty:** 18165 · przez **wojtas** 30 Kwi 2007, 18:12

Bartexx nie rozumiesz??

anders napisał(a):dołącz nagłowek jeszcze loga

**Posty:** 755 · przez **Bartexx** 30 Kwi 2007, 18:26

Logfile of HijackThis v1.99.1
Scan saved at 18:12:25, on 2007-04-30
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

**Posty:** 18165 · przez **wojtas** 30 Kwi 2007, 18:32

Użyj WWDC :
http://www.firewallleaktester.com/wwdc.htm
Zmień opcje z disable na enable. Uruchom ponownie komputer.
Tak powinny wyglądać porty (NetBIOS może być żółty) :
http://www.firewallleaktester.com/images_site/wwdc.jpg

Wyłącz przywracanie systemu ( właściwości mój komputer-zakładka przywracanie - wyłącz przywracanie na wszystkich dyskach)
Start do awaryjnego ( F8 ) przy starcie komputera.

O4 - HKLM\..\Run: [.nvsvc] C:\WINDOWS\system\smss.exe /w << NIE POMYL LOKALIZACJI PLIKU

Odpalasz hijackthis i zaznaczasz ptaszkami powyższe wpisy i dajesz Fix checked.
Pogrubione pliki usuwasz ręcznie z dysku

sciagnij: ATF_Cleaner

http://www.atribune.org/ccount/click.php?id=1
zaznacz
Windows Temp
Temporary internet files
i wcisnij EMPTY SELECTED

potem nowy log + log z combofixa

http://www.techsupportforum.com/sectools/sUBs/ComboFix.exe

**Posty:** 755 · przez **Bartexx** 30 Kwi 2007, 21:33

combofix (troche dużo ;p)

"Bartek" - 07-04-30 21:17:36 Dodatek Service Pack 2
ComboFix 07-04-25.4V - Running from: "C:\Documents and Settings\Bartek\Pulpit\"

((((((((((((((((((((((((((((((( Files Created from 2007-03-28 to 2007-04-30 ))))))))))))))))))))))))))))))))))

2007-04-30 18:09 <DIR> d--h----- C:\WINDOWS\PIF
2007-04-30 15:48 <DIR> d-------- C:\Program Files\Lavalys
2007-04-30 15:40 <DIR> d---s---- C:\DOCUME~1\Bartek\UserData
2007-04-30 15:04 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\Spybot - Search & Destroy
2007-04-30 14:32 <DIR> d-------- C:\Program Files\SkanerOnline
2007-04-30 14:13 <DIR> d-------- C:\WINDOWS\pss
2007-04-30 13:47 81,768 --a------ C:\WINDOWS\system32\xinput1_3.dll
2007-04-30 13:47 62,744 --a------ C:\WINDOWS\system32\xinput1_2.dll
2007-04-30 13:47 443,752 --a------ C:\WINDOWS\system32\d3dx10_33.dll
2007-04-30 13:47 3,495,784 --a------ C:\WINDOWS\system32\d3dx9_33.dll
2007-04-30 13:47 3,426,072 --a------ C:\WINDOWS\system32\d3dx9_32.dll
2007-04-30 13:47 261,480 --a------ C:\WINDOWS\system32\xactengine2_7.dll
2007-04-30 13:47 255,848 --a------ C:\WINDOWS\system32\xactengine2_6.dll
2007-04-30 13:47 251,672 --a------ C:\WINDOWS\system32\xactengine2_5.dll
2007-04-30 13:47 237,848 --a------ C:\WINDOWS\system32\xactengine2_4.dll
2007-04-30 13:47 236,824 --a------ C:\WINDOWS\system32\xactengine2_3.dll
2007-04-30 13:47 2,414,360 --a------ C:\WINDOWS\system32\d3dx9_31.dll
2007-04-30 13:47 2,297,552 --a------ C:\WINDOWS\system32\d3dx9_26.dll
2007-04-30 13:47 15,128 --a------ C:\WINDOWS\system32\x3daudio1_1.dll
2007-04-30 13:47 1,123,696 --a------ C:\WINDOWS\system32\D3DCompiler_33.dll
2007-04-30 13:01 <DIR> d-------- C:\DOCUME~1\Bartek\DANEAP~1\Gadu-Gadu
2007-04-30 12:49 1,165 --a------ C:\WINDOWS\mozver.dat
2007-04-30 12:38 <DIR> d-------- C:\Program Files\RivaTuner v2.01
2007-04-30 12:35 60,273 --a------ C:\WINDOWS\system32\pthreadGC2.dll
2007-04-30 12:35 10,752 --a------ C:\WINDOWS\system32\ff_vfw.dll
2007-04-30 12:35 <DIR> d-------- C:\Program Files\ffdshow
2007-04-30 12:32 36,528 --------- C:\WINDOWS\system32\drivers\PxHelp20.sys
2007-04-30 12:32 2,560 --------- C:\WINDOWS\system32\drivers\cdralw2k.sys
2007-04-30 12:32 2,432 --------- C:\WINDOWS\system32\drivers\cdr4_xp.sys
2007-04-30 12:32 129,784 --------- C:\WINDOWS\system32\pxafs.dll
2007-04-30 12:32 115,880 --------- C:\WINDOWS\system32\pxinsi64.exe
2007-04-30 12:31 <DIR> d-------- C:\WINDOWS\RegisteredPackages
2007-04-30 12:30 <DIR> d-------- C:\Program Files\Winamp
2007-04-30 12:27 1,252 --a------ C:\WINDOWS\unins000.dat
2007-04-30 12:25 <DIR> d-------- C:\DOCUME~1\Bartek\DANEAP~1\Ahead
2007-04-30 12:24 0 -rahs---- C:\MSDOS.SYS
2007-04-30 12:24 0 -rahs---- C:\IO.SYS
2007-04-30 12:24 0 --a------ C:\CONFIG.SYS
2007-04-30 12:24 0 --a------ C:\AUTOEXEC.BAT
2007-04-30 12:24 <DIR> d-------- C:\Program Files\Fraps
2007-04-30 12:23 <DIR> d-------- C:\Program Files\Nero
2007-04-30 12:23 <DIR> d-------- C:\Program Files\Common Files\Ahead
2007-04-30 12:20 <DIR> d-------- C:\Program Files\Lavasoft
2007-04-30 12:20 <DIR> d-------- C:\DOCUME~1\Bartek\DANEAP~1\Lavasoft
2007-04-30 12:13 <DIR> d-------- C:\WINDOWS\system32\appmgmt
2007-04-30 12:13 <DIR> d-------- C:\DOCUME~1\Bartek\Gadu-Gadu
2007-04-30 12:12 <DIR> d-------- C:\DOCUME~1\Bartek\DANEAP~1\ACD Systems
2007-04-30 12:06 <DIR> d-------- C:\DOCUME~1\Bartek\DANEAP~1\Corel
2007-04-30 12:03 2,097,152 --ah----- C:\DOCUME~1\Bartek\NTUSER.DAT
2007-04-30 12:03 <DIR> dr-h----- C:\DOCUME~1\Bartek\Dane aplikacji
2007-04-30 12:03 <DIR> dr------- C:\DOCUME~1\Bartek\Ulubione
2007-04-30 12:03 <DIR> dr------- C:\DOCUME~1\Bartek\Moje dokumenty
2007-04-30 12:03 <DIR> dr------- C:\DOCUME~1\Bartek\Menu Start
2007-04-30 12:03 <DIR> d--h----- C:\DOCUME~1\Bartek\Ustawienia lokalne
2007-04-30 12:03 <DIR> d--h----- C:\DOCUME~1\Bartek\Szablony
2007-04-30 12:03 <DIR> d-------- C:\DOCUME~1\Bartek\Pulpit
2007-04-30 11:29 <DIR> d-------- C:\Program Files\Corel
2007-04-30 11:29 <DIR> d-------- C:\Program Files\Common Files\Corel
2007-04-30 11:29 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\Corel
2007-04-30 11:29 <DIR> d-------- C:\DOCUME~1\ADMINI~1\DANEAP~1\Corel
2007-04-30 11:27 88 -r-hs---- C:\WINDOWS\system32\3C3E1F0307.sys
2007-04-30 11:27 3,350 --ahs---- C:\WINDOWS\system32\KGyGaAvL.sys
2007-04-30 02:42 <DIR> d-------- C:\DOCUME~1\ADMINI~1\DANEAP~1\Gadu-Gadu
2007-04-30 02:13 <DIR> d-------- C:\Program Files\eMule
2007-04-30 01:46 <DIR> d-------- C:\Program Files\Common Files\ACD Systems
2007-04-30 01:46 <DIR> d-------- C:\Program Files\ACD Systems
2007-04-30 01:46 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\ACD Systems
2007-04-30 01:46 <DIR> d-------- C:\DOCUME~1\ADMINI~1\DANEAP~1\ACD Systems
2007-04-30 01:42 <DIR> d-------- C:\WINDOWS\Downloaded Installations
2007-04-30 01:29 <DIR> d--hs---- C:\RECYCLER
2007-04-30 01:27 94,552 --a------ C:\WINDOWS\system32\drivers\aswmon2.sys
2007-04-30 01:27 90,112 --a------ C:\WINDOWS\system32\AvastSS.scr
2007-04-30 01:27 85,952 --a------ C:\WINDOWS\system32\drivers\aswmon.sys
2007-04-30 01:27 733,824 --a------ C:\WINDOWS\system32\aswBoot.exe
2007-04-30 01:27 499,712 --a------ C:\WINDOWS\system32\MSVCP71.dll
2007-04-30 01:27 43,176 --a------ C:\WINDOWS\system32\drivers\aswTdi.sys
2007-04-30 01:27 348,160 --a------ C:\WINDOWS\system32\MSVCR71.dll
2007-04-30 01:27 26,888 --a------ C:\WINDOWS\system32\drivers\aavmker4.sys
2007-04-30 01:27 23,416 --a------ C:\WINDOWS\system32\drivers\aswRdr.sys
2007-04-30 01:27 1,060,864 --a------ C:\WINDOWS\system32\MFC71.dll
2007-04-30 01:27 <DIR> d-------- C:\Program Files\Alwil Software
2007-04-30 01:16 0 --a------ C:\WINDOWS\nsreg.dat
2007-04-30 01:04 <DIR> d-------- C:\Program Files\Gadu-Gadu
2007-04-30 01:04 <DIR> d-------- C:\DOCUME~1\ADMINI~1\Gadu-Gadu
2007-04-30 00:58 208,896 --a------ C:\WINDOWS\system32\NVUNINST.EXE
2007-04-30 00:58 208,896 --a------ C:\WINDOWS\system32\nvudisp.exe
2007-04-30 00:58 <DIR> d-------- C:\WINDOWS\nview
2007-04-30 00:57 32,768 --a------ C:\WINDOWS\system32\WooDial2000.dll
2007-04-30 00:57 <DIR> d-------- C:\Program Files\nVidia
2007-04-30 00:56 64,000 --a------ C:\WINDOWS\system32\drivers\e4ldr.sys
2007-04-30 00:56 50,007 --a------ C:\WINDOWS\system32\drivers\adildr.sys
2007-04-30 00:56 46,892 --a------ C:\WINDOWS\system32\ADADIX16.DLL
2007-04-30 00:56 4,981 --a------ C:\WINDOWS\system32\ADADIX2K.DLL
2007-04-30 00:56 24,576 --a------ C:\WINDOWS\enddisk32.exe
2007-04-30 00:56 22,395 --a------ C:\WINDOWS\system32\drivers\fpga.bin
2007-04-30 00:56 155,648 --a------ C:\WINDOWS\system32\adadix32.dll
2007-04-30 00:56 152,220 --a------ C:\WINDOWS\system32\drivers\L1E4I2.BIN
2007-04-30 00:56 152,220 --a------ C:\WINDOWS\system32\drivers\L1E4I1.BIN
2007-04-30 00:56 152,220 --a------ C:\WINDOWS\system32\drivers\L1E4I0.BIN
2007-04-30 00:56 152,132 --a------ C:\WINDOWS\system32\drivers\L1E4P2.BIN
2007-04-30 00:56 152,132 --a------ C:\WINDOWS\system32\drivers\L1E4P1.BIN
2007-04-30 00:56 152,132 --a------ C:\WINDOWS\system32\drivers\L1E4P0.BIN
2007-04-30 00:56 152,126 --a------ C:\WINDOWS\system32\drivers\L1E9P2.BIN
2007-04-30 00:56 152,126 --a------ C:\WINDOWS\system32\drivers\L1E9P1.BIN
2007-04-30 00:56 152,126 --a------ C:\WINDOWS\system32\drivers\L1E9P0.BIN
2007-04-30 00:56 152,126 --a------ C:\WINDOWS\system32\drivers\L1E9I2.BIN
2007-04-30 00:56 152,126 --a------ C:\WINDOWS\system32\drivers\L1E9I1.BIN
2007-04-30 00:56 152,126 --a------ C:\WINDOWS\system32\drivers\L1E9I0.BIN
2007-04-30 00:56 152,036 --a------ C:\WINDOWS\system32\drivers\L1E4D2.BIN
2007-04-30 00:56 152,034 --a------ C:\WINDOWS\system32\drivers\L1E4D1.BIN
2007-04-30 00:56 152,034 --a------ C:\WINDOWS\system32\drivers\L1E4D0.BIN
2007-04-30 00:56 135,168 --a------ C:\WINDOWS\system32\unaddrv.exe
2007-04-30 00:56 127,456 --a------ C:\WINDOWS\system32\IPDETECT.EXE
2007-04-30 00:56 126,976 --a------ C:\WINDOWS\system32\coclassfast.dll
2007-04-30 00:56 126,489 --a------ C:\WINDOWS\system32\drivers\adiusbaw.sys
2007-04-30 00:56 116,992 --a------ C:\WINDOWS\system32\drivers\e4usbaw.sys
2007-04-30 00:56 <DIR> d-------- C:\Program Files\SAGEM
2007-04-30 00:55 94,208 --a------ C:\WINDOWS\system32\W32n50.dll
2007-04-30 00:55 41,068 --------- C:\WINDOWS\system32\ActPanel.dll
2007-04-30 00:55 40,960 --a------ C:\WINDOWS\system32\FTRTSVC.exe
2007-04-30 00:55 36,864 --a------ C:\WINDOWS\system32\IfHelper.dll
2007-04-30 00:55 16,128 --------- C:\WINDOWS\system32\PCANDIS5.SYS
2007-04-30 00:55 <DIR> d--h----- C:\Program Files\InstallShield Installation Information
2007-04-30 00:55 <DIR> d-------- C:\WINDOWS\system32\AlertModule
2007-04-30 00:55 <DIR> d-------- C:\Program Files\Java Web Start
2007-04-30 00:55 <DIR> d-------- C:\Program Files\Common Files\InstallShield
2007-04-30 00:54 <DIR> d--hs---- C:\WINDOWS\ftpcache
2007-04-30 00:54 <DIR> d-------- C:\Program Files\neostrada tp
2007-04-30 00:53 786,432 --ah----- C:\DOCUME~1\NETWOR~1\NTUSER.DAT
2007-04-30 00:53 786,432 --ah----- C:\DOCUME~1\LOCALS~1\NTUSER.DAT
2007-04-30 00:53 1,310,720 --ah----- C:\DOCUME~1\ADMINI~1\NTUSER.DAT
2007-04-30 00:53 <DIR> dr-h----- C:\DOCUME~1\ADMINI~1\Dane aplikacji
2007-04-30 00:53 <DIR> dr------- C:\DOCUME~1\ADMINI~1\Ulubione
2007-04-30 00:53 <DIR> dr------- C:\DOCUME~1\ADMINI~1\Moje dokumenty
2007-04-30 00:53 <DIR> dr------- C:\DOCUME~1\ADMINI~1\Menu Start
2007-04-30 00:53 <DIR> d--hs---- C:\WINDOWS\Installer
2007-04-30 00:53 <DIR> d--hs---- C:\System Volume Information
2007-04-30 00:53 <DIR> d--h----- C:\DOCUME~1\NETWOR~1\Ustawienia lokalne
2007-04-30 00:53 <DIR> d--h----- C:\DOCUME~1\LOCALS~1\Ustawienia lokalne
2007-04-30 00:53 <DIR> d--h----- C:\DOCUME~1\ADMINI~1\Ustawienia lokalne
2007-04-30 00:53 <DIR> d--h----- C:\DOCUME~1\ADMINI~1\Szablony
2007-04-30 00:53 <DIR> d-------- C:\WINDOWS\SoftwareDistribution
2007-04-30 00:53 <DIR> d-------- C:\WINDOWS\Prefetch
2007-04-30 00:53 <DIR> d-------- C:\DOCUME~1\NETWOR~1\Dane aplikacji
2007-04-30 00:53 <DIR> d-------- C:\DOCUME~1\LOCALS~1\Menu Start
2007-04-30 00:53 <DIR> d-------- C:\DOCUME~1\LOCALS~1\Dane aplikacji
2007-04-30 00:53 <DIR> d-------- C:\DOCUME~1\ADMINI~1\Pulpit
2007-04-30 00:48 95,424 --------- C:\WINDOWS\system32\drivers\slnthal.sys
2007-04-30 00:48 940,544 --a------ C:\WINDOWS\system32\wmspdmoe.dll
2007-04-30 00:48 9,728 --------- C:\WINDOWS\system32\comsdupd.exe
2007-04-30 00:48 88,064 --------- C:\WINDOWS\system32\p2pnetsh.dll
2007-04-30 00:48 870,784 --------- C:\WINDOWS\system32\ati3d1ag.dll
2007-04-30 00:48 86,016 --------- C:\WINDOWS\system32\p2pgasvc.dll
2007-04-30 00:48 86,016 --------- C:\WINDOWS\system32\mdmxsdk.dll
2007-04-30 00:48 81,920 --------- C:\WINDOWS\system32\ieencode.dll
2007-04-30 00:48 81,408 --------- C:\WINDOWS\system32\wscsvc.dll
2007-04-30 00:48 8,192 --------- C:\WINDOWS\system32\smbinst.exe
2007-04-30 00:48 8,192 --------- C:\WINDOWS\system32\bitsprx2.dll
2007-04-30 00:48 78,464 --------- C:\WINDOWS\system32\drivers\usbvideo.sys
2007-04-30 00:48 755,200 --------- C:\WINDOWS\system32\ir50_32.dll
2007-04-30 00:48 75,776 --------- C:\WINDOWS\system32\strmfilt.dll
2007-04-30 00:48 73,832 --------- C:\WINDOWS\system32\slcoinst.dll
2007-04-30 00:48 73,796 --------- C:\WINDOWS\system32\slserv.exe
2007-04-30 00:48 73,216 --------- C:\WINDOWS\system32\drivers\atintuxx.sys
2007-04-30 00:48 71,680 --------- C:\WINDOWS\system32\blastcln.exe
2007-04-30 00:48 701,440 --------- C:\WINDOWS\system32\drivers\ati2mtag.sys
2007-04-30 00:48 7,680 --------- C:\WINDOWS\system32\kbdsmsno.dll
2007-04-30 00:48 7,680 --------- C:\WINDOWS\system32\kbdsmsfi.dll
2007-04-30 00:48 7,168 --------- C:\WINDOWS\system32\kbdukx.dll
2007-04-30 00:48 7,168 --------- C:\WINDOWS\system32\kbdno1.dll
2007-04-30 00:48 7,168 --------- C:\WINDOWS\system32\kbdfi1.dll
2007-04-30 00:48 7,168 --------- C:\WINDOWS\system32\bitsprx3.dll
2007-04-30 00:48 685,056 --------- C:\WINDOWS\system32\drivers\hsfcxts2.sys
2007-04-30 00:48 67,584 --------- C:\WINDOWS\system32\drivers\sdbus.sys
2007-04-30 00:48 63,663 --------- C:\WINDOWS\system32\drivers\ati1rvxx.sys
2007-04-30 00:48 63,488 --------- C:\WINDOWS\system32\drivers\atinxsxx.sys
2007-04-30 00:48 60,416 --------- C:\WINDOWS\system32\fwcfg.dll
2007-04-30 00:48 6,656 --------- C:\WINDOWS\system32\kbdinmal.dll
2007-04-30 00:48 6,656 --------- C:\WINDOWS\system32\kbdinben.dll
2007-04-30 00:48 6,144 --------- C:\WINDOWS\system32\kbdmlt48.dll
2007-04-30 00:48 6,144 --------- C:\WINDOWS\system32\kbdmlt47.dll
2007-04-30 00:48 6,144 --------- C:\WINDOWS\system32\kbdinbe1.dll
2007-04-30 00:48 6,016 --------- C:\WINDOWS\system32\drivers\smbali.sys
2007-04-30 00:48 59,648 --------- C:\WINDOWS\system32\drivers\rfcomm.sys
2007-04-30 00:48 57,856 --------- C:\WINDOWS\system32\drivers\atinbtxx.sys
2007-04-30 00:48 56,623 --------- C:\WINDOWS\system32\drivers\ati1btxx.sys
2007-04-30 00:48 526,848 --------- C:\WINDOWS\system32\p2psvc.dll
2007-04-30 00:48 52,224 --------- C:\WINDOWS\system32\drivers\atinraxx.sys
2007-04-30 00:48 516,768 --------- C:\WINDOWS\system32\ativvaxx.dll
2007-04-30 00:48 50,688 --------- C:\WINDOWS\system32\btpanui.dll
2007-04-30 00:48 50,176 --------- C:\WINDOWS\system32\xmlprovi.dll
2007-04-30 00:48 5,632 --------- C:\WINDOWS\system32\kbdmaori.dll
2007-04-30 00:48 49,152 --------- C:\WINDOWS\system32\powercfg.exe
2007-04-30 00:48 48,640 --------- C:\WINDOWS\system32\pnrpnsp.dll
2007-04-30 00:48 46,464 --------- C:\WINDOWS\system32\drivers\gagp30kx.sys
2007-04-30 00:48 452,736 --------- C:\WINDOWS\system32\drivers\mtxparhm.sys
2007-04-30 00:48 44,928 --------- C:\WINDOWS\system32\drivers\agpcpq.sys
2007-04-30 00:48 44,672 --------- C:\WINDOWS\system32\drivers\uagp35.sys
2007-04-30 00:48 44,032 --------- C:\WINDOWS\system32\twext.dll
2007-04-30 00:48 431,616 --------- C:\WINDOWS\system32\wuapi.dll
2007-04-30 00:48 43,008 --------- C:\WINDOWS\system32\drivers\amdagp.sys
2007-04-30 00:48 427,008 --------- C:\WINDOWS\system32\xpob2res.dll
2007-04-30 00:48 42,752 --------- C:\WINDOWS\system32\drivers\alim1541.sys
2007-04-30 00:48 42,368 --------- C:\WINDOWS\system32\drivers\agp440.sys
2007-04-30 00:48 42,240 --------- C:\WINDOWS\system32\drivers\viaagp.sys
2007-04-30 00:48 413,944 --a------ C:\WINDOWS\system32\wmspdmod.dll
2007-04-30 00:48 41,088 --------- C:\WINDOWS\system32\drivers\sisagp.sys
2007-04-30 00:48 404,990 --------- C:\WINDOWS\system32\drivers\slntamr.sys
2007-04-30 00:48 40,832 --------- C:\WINDOWS\system32\drivers\irbus.sys
2007-04-30 00:48 40,320 --------- C:\WINDOWS\system32\drivers\intelppm.sys
2007-04-30 00:48 4,527,488 --a------ C:\WINDOWS\system32\nv4_disp.dll
2007-04-30 00:48 4,255 --------- C:\WINDOWS\system32\drivers\adv01nt5.dll
2007-04-30 00:48 397,056 --------- C:\WINDOWS\system32\s3gnb.dll
2007-04-30 00:48 384,512 --------- C:\WINDOWS\system32\mp4sdmod.dll
2007-04-30 00:48 38,016 --------- C:\WINDOWS\system32\drivers\bthmodem.sys
2007-04-30 00:48 377,984 --------- C:\WINDOWS\system32\ati2dvaa.dll
2007-04-30 00:48 36,864 --------- C:\WINDOWS\system32\wups.dll
2007-04-30 00:48 36,463 --------- C:\WINDOWS\system32\drivers\ati1tuxx.sys
2007-04-30 00:48 35,456 --------- C:\WINDOWS\system32\drivers\bthprint.sys
2007-04-30 00:48 34,735 --------- C:\WINDOWS\system32\drivers\ati1xsxx.sys
2007-04-30 00:48 338,432 --------- C:\WINDOWS\system32\ir41_qcx.dll
2007-04-30 00:48 327,040 --------- C:\WINDOWS\system32\drivers\ati2mtaa.sys
2007-04-30 00:48 32,866 --------- C:\WINDOWS\system32\slrundll.exe
2007-04-30 00:48 32,866 --------- C:\WINDOWS\slrundll.exe
2007-04-30 00:48 32,768 --------- C:\WINDOWS\system32\ativtmxx.dll
2007-04-30 00:48 32,285 --------- C:\WINDOWS\system32\hsfcisp2.dll
2007-04-30 00:48 312,320 --------- C:\WINDOWS\system32\p2pgraph.dll
2007-04-30 00:48 310,272 --------- C:\WINDOWS\system32\mp43dmod.dll
2007-04-30 00:48 31,744 --------- C:\WINDOWS\system32\drivers\atinxbxx.sys
2007-04-30 00:48 30,671 --------- C:\WINDOWS\system32\drivers\ati1raxx.sys
2007-04-30 00:48 30,208 --------- C:\WINDOWS\system32\bthserv.dll
2007-04-30 00:48 30,080 --------- C:\WINDOWS\system32\drivers\rndismpx.sys
2007-04-30 00:48 3,994,624 --a------ C:\WINDOWS\system32\drivers\nv4_mini.sys
2007-04-30 00:48 3,967 --------- C:\WINDOWS\system32\drivers\adv02nt5.dll
2007-04-30 00:48 3,901 --------- C:\WINDOWS\system32\drivers\siint5.dll
2007-04-30 00:48 3,775 --------- C:\WINDOWS\system32\drivers\adv11nt5.dll
2007-04-30 00:48 3,711 --------- C:\WINDOWS\system32\drivers\adv09nt5.dll
2007-04-30 00:48 3,647 --------- C:\WINDOWS\system32\drivers\adv07nt5.dll
2007-04-30 00:48 3,615 --------- C:\WINDOWS\system32\drivers\adv05nt5.dll
2007-04-30 00:48 3,135 --------- C:\WINDOWS\system32\drivers\adv08nt5.dll
2007-04-30 00:48 29,455 --------- C:\WINDOWS\system32\drivers\ati1xbxx.sys
2007-04-30 00:48 29,184 --------- C:\WINDOWS\system32\sdhcinst.dll
2007-04-30 00:48 29,056 --------- C:\WINDOWS\system32\drivers\ip6fw.sys
2007-04-30 00:48 286,792 --------- C:\WINDOWS\system32\slextspk.dll
2007-04-30 00:48 28,672 --------- C:\WINDOWS\system32\drivers\atinsnxx.sys
2007-04-30 00:48 275,200 --------- C:\WINDOWS\system32\drivers\bthport.sys
2007-04-30 00:48 263,040 --------- C:\WINDOWS\system32\drivers\http.sys
2007-04-30 00:48 26,367 --------- C:\WINDOWS\system32\drivers\ati1snxx.sys
2007-04-30 00:48 25,728 --------- C:\WINDOWS\system32\drivers\hidbth.sys
2007-04-30 00:48 25,471 --------- C:\WINDOWS\system32\drivers\watv10nt.sys
2007-04-30 00:48 25,471 --------- C:\WINDOWS\system32\drivers\atv04nt5.dll
2007-04-30 00:48 25,088 --a------ C:\WINDOWS\system32\MsPMSNSv.dll
2007-04-30 00:48 24,576 --------- C:\WINDOWS\system32\httpapi.dll
2007-04-30 00:48 233,472 --------- C:\WINDOWS\system32\wmpdxm.dll
2007-04-30 00:48 229,376 --------- C:\WINDOWS\system32\ati2cqag.dll
2007-04-30 00:48 221,184 --a------ C:\WINDOWS\system32\wmpns.dll
2007-04-30 00:48 220,032 --------- C:\WINDOWS\system32\drivers\hsfbs2s2.sys
2007-04-30 00:48 22,528 --------- C:\WINDOWS\system32\fltmc.exe
2007-04-30 00:48 22,271 --------- C:\WINDOWS\system32\drivers\watv06nt.sys
2007-04-30 00:48 21,343 --------- C:\WINDOWS\system32\drivers\ati1ttxx.sys
2007-04-30 00:48 21,183 --------- C:\WINDOWS\system32\drivers\atv01nt5.dll
2007-04-30 00:48 201,728 --------- C:\WINDOWS\system32\ati2dvag.dll
2007-04-30 00:48 200,192 --------- C:\WINDOWS\system32\ir50_qc.dll
2007-04-30 00:48 20,992 --------- C:\WINDOWS\system32\bthci.dll
2007-04-30 00:48 2,953,216 --------- C:\WINDOWS\system32\xpsp2res.dll
2007-04-30 00:48 2,113,536 --------- C:\WINDOWS\system32\dxdiagn.dll
2007-04-30 00:48 193,024 --------- C:\WINDOWS\system32\fsquirt.exe
2007-04-30 00:48 190,976 --------- C:\WINDOWS\system32\wmerror.dll
2007-04-30 00:48 188,508 --------- C:\WINDOWS\system32\slgen.dll
2007-04-30 00:48 184,320 --------- C:\WINDOWS\system32\wuaueng1.dll
2007-04-30 00:48 183,808 --------- C:\WINDOWS\system32\ir50_qcx.dll
2007-04-30 00:48 180,360 --------- C:\WINDOWS\system32\drivers\ntmtlfax.sys
2007-04-30 00:48 18,944 --------- C:\WINDOWS\system32\drivers\bthusb.sys
2007-04-30 00:48 17,408 --------- C:\WINDOWS\system32\winshfhc.dll
2007-04-30 00:48 17,279 --------- C:\WINDOWS\system32\drivers\atv10nt5.dll
2007-04-30 00:48 17,024 --------- C:\WINDOWS\system32\drivers\bthenum.sys
2007-04-30 00:48 168,960 --------- C:\WINDOWS\system32\wuauclt1.exe
2007-04-30 00:48 166,912 --------- C:\WINDOWS\system32\drivers\s3gnbm.sys
2007-04-30 00:48 16,896 --------- C:\WINDOWS\system32\fltlib.dll
2007-04-30 00:48 150,016 --a------ C:\WINDOWS\system32\wmidx.dll
2007-04-30 00:48 15,872 --------- C:\WINDOWS\system32\w3ssl.dll
2007-04-30 00:48 15,488 --------- C:\WINDOWS\system32\drivers\mssmbios.sys
2007-04-30 00:48 15,423 --------- C:\WINDOWS\system32\drivers\ch7xxnt5.dll
2007-04-30 00:48 15,104 --------- C:\WINDOWS\system32\drivers\hidir.sys
2007-04-30 00:48 14,336 --------- C:\WINDOWS\system32\drivers\atinpdxx.sys
2007-04-30 00:48 14,336 --------- C:\WINDOWS\system32\auditusr.exe
2007-04-30 00:48 14,143 --------- C:\WINDOWS\system32\drivers\atv06nt5.dll
2007-04-30 00:48 13,824 --------- C:\WINDOWS\system32\wscntfy.exe
2007-04-30 00:48 13,824 --------- C:\WINDOWS\system32\drivers\atinttxx.sys
2007-04-30 00:48 13,824 --------- C:\WINDOWS\system32\drivers\atinmdxx.sys
2007-04-30 00:48 13,824 --------- C:\WINDOWS\system32\cmsetacl.dll
2007-04-30 00:48 13,776 --------- C:\WINDOWS\system32\drivers\recagent.sys
2007-04-30 00:48 13,568 --------- C:\WINDOWS\system32\drivers\wacompen.sys
2007-04-30 00:48 13,240 --------- C:\WINDOWS\system32\drivers\slwdmsup.sys
2007-04-30 00:48 129,536 --------- C:\WINDOWS\system32\xmlprov.dll
2007-04-30 00:48 129,535 --------- C:\WINDOWS\system32\drivers\slnt7554.sys
2007-04-30 00:48 126,686 --------- C:\WINDOWS\system32\drivers\mtlmnt5.sys
2007-04-30 00:48 124,800 --------- C:\WINDOWS\system32\drivers\fltmgr.sys
2007-04-30 00:48 120,320 --------- C:\WINDOWS\system32\wuweb.dll
2007-04-30 00:48 120,320 --------- C:\WINDOWS\system32\ir41_qc.dll
2007-04-30 00:48 12,672 --------- C:\WINDOWS\system32\drivers\usb8023x.sys
2007-04-30 00:48 12,672 --------- C:\WINDOWS\system32\drivers\mutohpen.sys
2007-04-30 00:48 12,047 --------- C:\WINDOWS\system32\drivers\ati1pdxx.sys
2007-04-30 00:48 118,784 --------- C:\WINDOWS\system32\msdadiag.dll
2007-04-30 00:48 116,224 --------- C:\WINDOWS\system32\p2p.dll
2007-04-30 00:48 114,688 --------- C:\WINDOWS\system32\wmpasf.dll
2007-04-30 00:48 113,664 --------- C:\WINDOWS\system32\wucltui.dll
2007-04-30 00:48 11,935 --------- C:\WINDOWS\system32\drivers\wadv11nt.sys
2007-04-30 00:48 11,871 --------- C:\WINDOWS\system32\drivers\wadv09nt.sys
2007-04-30 00:48 11,868 --------- C:\WINDOWS\system32\drivers\mdmxsdk.sys
2007-04-30 00:48 11,807 --------- C:\WINDOWS\system32\drivers\wadv07nt.sys
2007-04-30 00:48 11,615 --------- C:\WINDOWS\system32\drivers\ati1mdxx.sys
2007-04-30 00:48 11,359 --------- C:\WINDOWS\system32\drivers\atv02nt5.dll
2007-04-30 00:48 11,325 --------- C:\WINDOWS\system32\drivers\vchnt5.dll
2007-04-30 00:48 11,295 --------- C:\WINDOWS\system32\drivers\wadv08nt.sys
2007-04-30 00:48 11,136 --------- C:\WINDOWS\system32\drivers\sffdisk.sys
2007-04-30 00:48 108,032 --------- C:\WINDOWS\system32\wshbth.dll
2007-04-30 00:48 104,960 --------- C:\WINDOWS\system32\drivers\atinrvxx.sys
2007-04-30 00:48 100,992 --------- C:\WINDOWS\system32\drivers\bthpan.sys
2007-04-30 00:48 10,240 --------- C:\WINDOWS\system32\drivers\sffp_sd.sys
2007-04-30 00:48 1,888,992 --------- C:\WINDOWS\system32\ati3duag.dll
2007-04-30 00:48 1,737,856 --------- C:\WINDOWS\system32\mtxparhd.dll
2007-04-30 00:48 1,689,088 --------- C:\WINDOWS\system32\d3d9.dll
2007-04-30 00:48 1,309,184 --------- C:\WINDOWS\system32\drivers\mtlstrm.sys
2007-04-30 00:48 1,119,744 --a------ C:\WINDOWS\system32\wmsdmoe2.dll
2007-04-30 00:48 1,041,536 --------- C:\WINDOWS\system32\drivers\hsfdpsp2.sys
2007-04-30 00:48 1,003,008 --a------ C:\WINDOWS\system32\wmvdmoe2.dll
2007-04-30 00:48 <DIR> d-------- C:\WINDOWS\provisioning
2007-04-30 00:48 <DIR> d-------- C:\WINDOWS\peernet
2007-04-30 00:47 <DIR> d-------- C:\WINDOWS\ServicePackFiles
2007-04-30 00:46 15,872 --a------ C:\WINDOWS\system32\spupdsvc.exe
2007-04-30 00:46 <DIR> d-------- C:\WINDOWS\system32\ReinstallBackups
2007-04-30 00:45 <DIR> d-------- C:\WINDOWS\EHome
2007-04-30 00:41 9,410,560 -ra------ C:\WINDOWS\system32\RTLCPL.EXE
2007-04-30 00:41 82,944 --a------ C:\WINDOWS\system32\drivers\wdmaud.sys
2007-04-30 00:41 77,824 -ra------ C:\WINDOWS\SOUNDMAN.EXE
2007-04-30 00:41 7,552 --a------ C:\WINDOWS\system32\drivers\mskssrv.sys
2007-04-30 00:41 60,800 --a------ C:\WINDOWS\system32\drivers\sysaudio.sys
2007-04-30 00:41 60,288 --a------ C:\WINDOWS\system32\drivers\drmk.sys
2007-04-30 00:41 6,400 --a------ C:\WINDOWS\system32\drivers\splitter.sys
2007-04-30 00:41 54,272 --a------ C:\WINDOWS\system32\drivers\swmidi.sys
2007-04-30 00:41 52,864 --a------ C:\WINDOWS\system32\drivers\dmusic.sys
2007-04-30 00:41 5,376 --a------ C:\WINDOWS\system32\drivers\mspclock.sys
2007-04-30 00:41 48,640 --a------ C:\WINDOWS\system32\drivers\stream.sys
2007-04-30 00:41 4,992 --a------ C:\WINDOWS\system32\drivers\mspqm.sys
2007-04-30 00:41 4,096 --a------ C:\WINDOWS\system32\ksuser.dll
2007-04-30 00:41 2,958,784 -ra------ C:\WINDOWS\system32\drivers\ALCXWDM.SYS
2007-04-30 00:41 2,944 --a------ C:\WINDOWS\system32\drivers\drmkaud.sys
2007-04-30 00:41 171,776 --a------ C:\WINDOWS\system32\drivers\kmixer.sys
2007-04-30 00:41 156,672 -ra------ C:\WINDOWS\system32\RTLCPAPI.dll
2007-04-30 00:41 145,792 --a------ C:\WINDOWS\system32\drivers\portcls.sys
2007-04-30 00:41 142,464 --a------ C:\WINDOWS\system32\drivers\aec.sys
2007-04-30 00:41 140,928 --a------ C:\WINDOWS\system32\drivers\ks.sys
2007-04-30 00:40 40,960 -r------- C:\WINDOWS\system32\ChCfg.exe
2007-04-30 00:40 294,912 -r------- C:\WINDOWS\alcupd.exe
2007-04-30 00:40 200,704 -r------- C:\WINDOWS\alcrmv.exe
2007-04-30 00:40 <DIR> d-------- C:\Program Files\Realtek AC97
2007-04-30 00:39 7,680 --------- C:\WINDOWS\system32\drivers\ABIT-IO.SYS

(((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-04-30 01:01 49492 --a------ C:\WINDOWS\system32\perfc015.dat
2007-04-30 01:01 355486 --a------ C:\WINDOWS\system32\perfh015.dat
2007-04-30 00:48 -------- d-------- C:\Program Files\movie maker
2007-04-30 00:48 -------- d-------- C:\Program Files\messenger
2007-04-30 00:47 -------- d-------- C:\Program Files\windows nt
2007-03-15 12:00 466432 --a------ C:\WINDOWS\system32\skaneronline.dll

(((((((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects]
{53707962-6F74-2D53-2644-206D7942484F} C:\PROGRA~1\SPYBOT~1\SDHelper.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run]
"WOOWATCH"="C:\\PROGRA~1\\NEOSTR~1\\Watch.exe"
"WOOTASKBARICON"="C:\\PROGRA~1\\NEOSTR~1\\GestMaj.exe TaskBarIcon.exe"
"SoundMan"="SOUNDMAN.EXE"
"avast!"="C:\\PROGRA~1\\ALWILS~1\\Avast4\\ashDisp.exe"
"RivaTunerStartupDaemon"="\"C:\\Program Files\\RivaTuner v2.01\\RivaTuner.exe\" /S"
"NvCplDaemon"="RUNDLL32.EXE C:\\WINDOWS\\system32\\NvCpl.dll,NvStartup"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run]
"Gadu-Gadu"="\"C:\\Program Files\\Gadu-Gadu\\gg.exe\" /tray"
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="\"C:\\Program Files\\Common Files\\Ahead\\lib\\NMBgMonitor.exe\""

HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa
Authentication Packages REG_MULTI_SZ msv1_0\0\0
Security Packages REG_MULTI_SZ kerberos\0msv1_0\0schannel\0wdigest\0\0
Notification Packages REG_MULTI_SZ scecli\0\0

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="NeroCheck"
"hkey"="HKLM"
"command"="C:\\WINDOWS\\system32\\NeroCheck.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Svchost]
LocalService REG_MULTI_SZ Alerter\0WebClient\0LmHosts\0RemoteRegistry\0upnphost\0SSDPSRV\0\0
NetworkService REG_MULTI_SZ DnsCache\0\0
rpcss REG_MULTI_SZ RpcSs\0\0
imgsvc REG_MULTI_SZ StiSvc\0\0
termsvcs REG_MULTI_SZ TermService\0\0
HTTPFilter REG_MULTI_SZ HTTPFilter\0\0
DcomLaunch REG_MULTI_SZ DcomLaunch\0TermService\0\0

********************************************************************

catchme 0.3.660 W2K/XP/Vista - userland rootkit detector by Gmer, http://www.gmer.net
Rootkit scan 2007-04-30 21:18:24
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden services ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0

********************************************************************

Completion time: 07-04-30 21:18:25
C:\ComboFix-quarantined-files.txt ... 07-04-30 21:18

Hijack

Logfile of HijackThis v1.99.1
Scan saved at 21:15:35, on 2007-04-30
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\PROGRA~1\NEOSTR~1\TaskBarIcon.exe
C:\Program Files\Gadu-Gadu\gg.exe
C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\FTRTSVC.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\neostrada tp\neostradatp.exe
C:\Program Files\neostrada tp\ComComp.exe
C:\PROGRA~1\NEOSTR~1\Toaster.exe
C:\PROGRA~1\NEOSTR~1\Inactivity.exe
C:\PROGRA~1\NEOSTR~1\PollingModule.exe
C:\WINDOWS\System32\ALERTM~1\ALERTM~1.EXE
C:\Program Files\neostrada tp\Watch.exe
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
C:\Documents and Settings\Bartek\Pulpit\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.pl/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = neostrada tp
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\NEOSTR~1\SEARCH~1.DLL
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\NEOSTR~1\Watch.exe
O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\NEOSTR~1\GestMaj.exe TaskBarIcon.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [RivaTunerStartupDaemon] "C:\Program Files\RivaTuner v2.01\RivaTuner.exe" /S
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe"
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
O4 - Global Startup: Adobe Reader Synchronizer.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe
O9 - Extra button: Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {68282C51-9459-467B-95BF-3C0E89627E55} (MksSkanerOnline Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{B39DE6AC-5D7F-4F3A-B646-D23F13F6DD70}: NameServer = 194.204.159.1 217.98.63.164
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

chciałem dodać że po tych zabiegach po pewnym czasie ~20 minut antywirus wyskoczyl ze trojan w tempie ;/

**Posty:** 18165 · przez **wojtas** 30 Kwi 2007, 21:40

wklej do notatnika:

Windows Registry Editor Version 5.00

[-HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Svchost]

w notatniku u góry>>>plik zapisz jako>>>Zmien rozszerzenie z TXT na Wszystkie pliki *.* >>> Zapisz pod nazwą FIX.REG

Klikasz dwa razy na powstały plik fix i dodajesz go do rejestru....

**Posty:** 755 · przez **Bartexx** 30 Kwi 2007, 22:33

wirus nadal sie pojawia ;/

przez **jeff** 30 Kwi 2007, 22:42

wirus nadal sie pojawia ;/

zrobiles to co miales podane ? Daj nowe logi

**Posty:** 755 · przez **Bartexx** 30 Kwi 2007, 23:11

Logfile of HijackThis v1.99.1
Scan saved at 22:56:44, on 2007-04-30
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\PROGRA~1\NEOSTR~1\TaskBarIcon.exe
C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\FTRTSVC.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\neostrada tp\neostradatp.exe
C:\Program Files\neostrada tp\ComComp.exe
C:\PROGRA~1\NEOSTR~1\Toaster.exe
C:\PROGRA~1\NEOSTR~1\Inactivity.exe
C:\PROGRA~1\NEOSTR~1\PollingModule.exe
C:\WINDOWS\System32\ALERTM~1\ALERTM~1.EXE
C:\Program Files\neostrada tp\Watch.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\DOCUME~1\Bartek\USTAWI~1\Temp\23exinjs.a9.exe
C:\WINDOWS\system32\mspaint.exe
C:\Program Files\ACD Systems\ACDSee\8.0\ACDSee8.exe
C:\Program Files\Gadu-Gadu\gg.exe
C:\Documents and Settings\Bartek\Pulpit\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.pl/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\NEOSTR~1\SEARCH~1.DLL
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\NEOSTR~1\Watch.exe
O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\NEOSTR~1\GestMaj.exe TaskBarIcon.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [RivaTunerStartupDaemon] "C:\Program Files\RivaTuner v2.01\RivaTuner.exe" /S
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe"
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
O4 - Global Startup: Adobe Reader Synchronizer.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe
O9 - Extra button: Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {68282C51-9459-467B-95BF-3C0E89627E55} (MksSkanerOnline Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{B39DE6AC-5D7F-4F3A-B646-D23F13F6DD70}: NameServer = 194.204.159.1 217.98.63.164
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

a tu fotka wirusika
http://www.fotosik.pl/pokaz_obrazek/1f9156ba9e689b10.html

mam nadzieje ze nie bedzie trzeba formatować ;/

Znalazłem taki temat o tym uciążliwym wirusie.
Może pomoże wam bo niewiem jak to ustrojstwo usunąć http://www.geekstogo.com/forum/index.php?showtopic=108936
napisane jest po ENG a u mnie ten język kuleje

**Posty:** 18165 · przez **wojtas** 01 Maj 2007, 11:52

zaisntaluj:

http://www.programosy.pl/program,kerio-personal-firewall.html

sciagnij: ATF_Cleaner

http://www.atribune.org/ccount/click.php?id=1
zaznacz
Windows Temp
Temporary internet files
i wcisnij EMPTY SELECTED

masz WWDC??

sciagnij gmera:

http://gmer.net/gmer.zip

1. Zakładka Rootkit >>> zaznaczone wszystko oprócz Pokazuj wszystko >>> kliknij Szukaj >>> czekaj cierpliwie aż skończy >>> Kopiuj >>> wklej do posta
2. Zakładka Rootkit >>> zaznaczone tylko Usługi i Pokazuj wszystko >>> kliknij Szukaj >>> czekaj cierpliwie aż skończy >>> Kopiuj >>> wklej do posta

logi wrzuc na rapida bo sie nie zmieszcza

proszę o sprawdzenie loga wirus?

Proszę o sprawdzenie loga Wirus?

Kto jest na forum