proszę o sprwadzenie loga...

**Posty:** 1846 · przez **kokos** 14 Sie 2007, 15:48

Witam, włączyłem sobie dziś rano PC i ujrzałem alert NOD'a. Był to jakiś trojanik

więc go usunąłem (poprzez noda

). Obecnie co jakiś czas zamykają mi się programy, które używam, tak więc pewnie jeszcze coś tam siedzi. Proszę o sprawdzenie.

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.0 (BETA) Scan saved at 15:31:16, on 2007-08-14 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Eset\nod32kui.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\Program Files\Eset\nod32krn.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\PnkBstrA.exe C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\explorer.exe C:\Program Files\Konnekt\konnekt.exe C:\Program Files\Mozilla Firefox\firefox.exe D:\hijackthis\HiJackThis_v2.exe R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: rightonadz.biz browser optimizer - {36A91CEC-6C71-4758-B492-397BFC8E96A2} - C:\WINDOWS\system32\gzmrotate.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O2 - BHO: WebAssist - {85589B5D-D53D-4237-A677-46B82EA275F3} - C:\WINDOWS\WebAssist.dll O2 - BHO: IeCatch2 Class - {A5366673-E8CA-11D3-9CD9-0090271D075B} - C:\PROGRA~1\FlashGet\jccatch.dll O2 - BHO: adssite - {F31B3634-12AA-41ca-B021-0685C3B3E4CA} - C:\WINDOWS\system32\nsw1BAE.dll O2 - BHO: XBTP02634 - {F97DA966-F09D-4cab-BF29-75A0026986EA} - C:\PROGRA~1\BEARSH~1\BEARSH~2\MediaBar.dll O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\fgiebar.dll O3 - Toolbar: BearShare MediaBar - {D3DEE18F-DB64-4BEB-9FF1-E1F0A5033E4A} - C:\Program Files\BearShare applications\BearShare MediaBar\MediaBar.dll O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe O4 - HKLM\..\Run: [{39-9A-AB-B8-ZN}] C:\Documents and Settings\Marek\Ustawienia lokalne\Temp\TIP2D002.exe P2D002 O4 - HKLM\..\Run: [adstart] C:\WINDOWS\System32\Rundll32.exe "C:\WINDOWS\system32\gzmrotate.dll" DllVerify O4 - HKCU\..\Run: [RocketDock] "C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe" O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user') O4 - Startup: RocketDock.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe O4 - Startup: TA_Start.lnk = C:\Documents and Settings\Marek\Ustawienia lokalne\Temp\TIP2D002.exe O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O4 - Global Startup: Last.fm Helper.lnk = C:\Program Files\Last.fm\LastFMHelper.exe O8 - Extra context menu item: Ściągnij przy pomocy FlashGet'a - C:\Program Files\FlashGet\jc_link.htm O8 - Extra context menu item: Ściągnij wszystko przy pomocy FlashGet'a - C:\Program Files\FlashGet\jc_all.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {CD995117-98E5-4169-9920-6C12D4C0B548} (HGPlugin9USA Class) - http://gamedownload.ijjimax.com/gamedownload/dist/hgstart/HGPlugin9USA.cab O22 - SharedTaskScheduler: Moduł wstępnego ładowania interfejsu Browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\System32\browseui.dll O22 - SharedTaskScheduler: Demon buforu kategorii składników - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\System32\browseui.dll O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe O23 - Service: PnkBstrB - Unknown owner - C:\WINDOWS\system32\PnkBstrB.exe O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe -- End of file - 6079 bytes

Kod: Zaznacz wszystko: "Silent Runners.vbs", revision 52, http://www.silentrunners.org/ Operating System: Windows XP SP2 Output limited to non-default values, except where indicated by "{++}" Startup items buried in registry: --------------------------------- HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ {++} "RocketDock" = ""C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe"" [null data] "ctfmon.exe" = "C:\WINDOWS\system32\ctfmon.exe" [MS] HKLM\Software\Microsoft\Windows\CurrentVersion\Run\ {++} "nod32kui" = ""C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE" ["Eset "] "NvCplDaemon" = "RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup" [MS] "nwiz" = "nwiz.exe /install" ["NVIDIA Corporation"] "NvMediaCenter" = "RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit" [MS] "SunJavaUpdateSched" = "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe" [null data] "{39-9A-AB-B8-ZN}" = "C:\Documents and Settings\Marek\Ustawienia lokalne\Temp\TIP2D002.exe P2D002" [empty string] "adstart" = "C:\WINDOWS\System32\Rundll32.exe "C:\WINDOWS\system32\gzmrotate.dll" DllVerify" [MS] HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\(Default) = (no title provided) -> {HKLM...CLSID} = "AcroIEHlprObj Class" \InProcServer32\(Default) = "C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll" ["Adobe Systems Incorporated"] {36A91CEC-6C71-4758-B492-397BFC8E96A2}\(Default) = (no title provided) -> {HKLM...CLSID} = "rightonadz.biz browser optimizer" \InProcServer32\(Default) = "C:\WINDOWS\system32\gzmrotate.dll" [empty string] {761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\(Default) = (no title provided) -> {HKLM...CLSID} = "SSVHelper Class" \InProcServer32\(Default) = "C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll" ["Sun Microsystems, Inc."] {85589B5D-D53D-4237-A677-46B82EA275F3}\(Default) = "WebAssist" -> {HKLM...CLSID} = "WebAssist" \InProcServer32\(Default) = "C:\WINDOWS\WebAssist.dll" [null data] {A5366673-E8CA-11D3-9CD9-0090271D075B}\(Default) = (no title provided) -> {HKLM...CLSID} = "IeCatch2 Class" \InProcServer32\(Default) = "C:\PROGRA~1\FlashGet\jccatch.dll" ["Amaze Soft"] {F31B3634-12AA-41ca-B021-0685C3B3E4CA}\(Default) = (no title provided) -> {HKLM...CLSID} = "adssite" \InProcServer32\(Default) = "C:\WINDOWS\system32\nsw1BAE.dll" [empty string] {F97DA966-F09D-4cab-BF29-75A0026986EA}\(Default) = "XBTP02634" -> {HKLM...CLSID} = "XBTP02634 Class" \InProcServer32\(Default) = "C:\PROGRA~1\BEARSH~1\BEARSH~2\MediaBar.dll" ["IE Toolbar"] HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\ "{42071714-76d4-11d1-8b24-00a0c9068ff3}" = "Rozszerzenie CPL kadrowania wyświetlania" -> {HKLM...CLSID} = "Rozszerzenie CPL kadrowania wyświetlania" \InProcServer32\(Default) = "deskpan.dll" [file not found] "{88895560-9AA2-1069-930E-00AA0030EBC8}" = "Rozszerzenie ikony HyperTerminalu" -> {HKLM...CLSID} = "HyperTerminal Icon Ext" \InProcServer32\(Default) = "C:\WINDOWS\System32\hticons.dll" ["Hilgraeve, Inc."] "{B089FE88-FB52-11D3-BDF1-0050DA34150D}" = "NOD32 Context Menu Shell Extension" -> {HKLM...CLSID} = "NOD32 Context Menu Shell Extension" \InProcServer32\(Default) = "C:\Program Files\Eset\nodshex.dll" [null data] "{32020A01-506E-484D-A2A8-BE3CF17601C3}" = "AlcoholShellEx" -> {HKLM...CLSID} = "AlcoholShellEx" \InProcServer32\(Default) = "C:\PROGRA~1\ALCOHO~1\ALCOHO~1\AXShlEx.dll" ["Alcohol Soft Development Team"] "{A70C977A-BF00-412C-90B7-034C51DA2439}" = "NvCpl DesktopContext Class" -> {HKLM...CLSID} = "DesktopContext Class" \InProcServer32\(Default) = "C:\WINDOWS\system32\nvcpl.dll" ["NVIDIA Corporation"] "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" = "WinRAR shell extension" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] "{1CDB2949-8F65-4355-8456-263E7C208A5D}" = "Desktop Explorer" -> {HKLM...CLSID} = "Desktop Explorer" \InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"] "{1E9B04FB-F9E5-4718-997B-B8DA88302A47}" = "Desktop Explorer Menu" -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"] "{1E9B04FB-F9E5-4718-997B-B8DA88302A48}" = "nView Desktop Context Menu" -> {HKLM...CLSID} = "nView Desktop Context Menu" \InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"] "{42042206-2D85-11D3-8CFF-005004838597}" = "Microsoft Office HTML Icon Handler" -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "C:\Program Files\Microsoft Office\Office12\msohevi.dll" [MS] "{993BE281-6695-4BA5-8A2A-7AACBFAAB69E}" = "Microsoft Office Metadata Handler" -> {HKLM...CLSID} = "Microsoft Office Metadata Handler" \InProcServer32\(Default) = "C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\msoshext.dll" [MS] "{C41662BB-1FA0-4CE0-8DC5-9B7F8279FF97}" = "Microsoft Office Thumbnail Handler" -> {HKLM...CLSID} = "Microsoft Office Thumbnail Handler" \InProcServer32\(Default) = "C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\msoshext.dll" [MS] "{13311DA7-1D24-40e5-AE07-7E3750F5DE3C}" = "Right Click Image Converter Extension" -> {HKLM...CLSID} = "Right Click Image Converter Extension" \InProcServer32\(Default) = "C:\Program Files\Kristanix\Right Click Image Converter\extRCIC.dll" [null data] "{23170F69-40C1-278A-1000-000100020000}" = "7-Zip Shell Extension" -> {HKLM...CLSID} = "7-Zip Shell Extension" \InProcServer32\(Default) = "C:\Program Files\7-Zip\7-zip.dll" ["Igor Pavlov"] "{ABC70703-32AF-11d4-90C4-D483A70F4825}" = "CMenuExtender" -> {HKLM...CLSID} = "CMenuExtender" \InProcServer32\(Default) = "C:\WINDOWS\BricoPacks\Vista Inspirat 2\iColorFolder\CMExt.dll" ["Revenger inc."] "{FFB699E0-306A-11d3-8BD1-00104B6F7516}" = "Play on my TV helper" -> {HKLM...CLSID} = "NVIDIA CPL Extension" \InProcServer32\(Default) = "C:\WINDOWS\system32\nvcpl.dll" ["NVIDIA Corporation"] "{D7B7A5AE-9D19-4F9E-9C6F-46C82D22D71C}" = "Wyślij na Fotosik.pl" -> {HKLM...CLSID} = "Wyślij na Fotosik.pl" \InProcServer32\(Default) = "C:\PROGRA~1\FOTOSI~1\FOTOSI~1.DLL" [null data] HKLM\Software\Classes\PROTOCOLS\Filter\ <<!>> text/xml\CLSID = "{807563E5-5146-11D5-A672-00B0D022E945}" -> {HKLM...CLSID} = "Microsoft Office InfoPath XML Mime Filter" \InProcServer32\(Default) = "C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL" [MS] HKLM\Software\Classes\Folder\shellex\ColumnHandlers\ {F9DB5320-233E-11D1-9F84-707F02C10627}\(Default) = "PDF Column Info" -> {HKLM...CLSID} = "PDF Shell Extension" \InProcServer32\(Default) = "C:\Program Files\Adobe\Acrobat 7.0\ActiveX\PDFShell.dll" ["Adobe Systems, Inc."] HKLM\Software\Classes\*\shellex\ContextMenuHandlers\ 7-Zip\(Default) = "{23170F69-40C1-278A-1000-000100020000}" -> {HKLM...CLSID} = "7-Zip Shell Extension" \InProcServer32\(Default) = "C:\Program Files\7-Zip\7-zip.dll" ["Igor Pavlov"] NOD32 Context Menu Shell Extension\(Default) = "{B089FE88-FB52-11D3-BDF1-0050DA34150D}" -> {HKLM...CLSID} = "NOD32 Context Menu Shell Extension" \InProcServer32\(Default) = "C:\Program Files\Eset\nodshex.dll" [null data] Right Click Image Converter\(Default) = "{13311DA7-1D24-40e5-AE07-7E3750F5DE3C}" -> {HKLM...CLSID} = "Right Click Image Converter Extension" \InProcServer32\(Default) = "C:\Program Files\Kristanix\Right Click Image Converter\extRCIC.dll" [null data] WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\ 7-Zip\(Default) = "{23170F69-40C1-278A-1000-000100020000}" -> {HKLM...CLSID} = "7-Zip Shell Extension" \InProcServer32\(Default) = "C:\Program Files\7-Zip\7-zip.dll" ["Igor Pavlov"] CMenuExtender\(Default) = "{ABC70703-32AF-11d4-90C4-D483A70F4825}" -> {HKLM...CLSID} = "CMenuExtender" \InProcServer32\(Default) = "C:\WINDOWS\BricoPacks\Vista Inspirat 2\iColorFolder\CMExt.dll" ["Revenger inc."] WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] {D7B7A5AE-9D19-4F9E-9C6F-46C82D22D71C}\(Default) = "{D7B7A5AE-9D19-4F9E-9C6F-46C82D22D71C}" -> {HKLM...CLSID} = "Wyślij na Fotosik.pl" \InProcServer32\(Default) = "C:\PROGRA~1\FOTOSI~1\FOTOSI~1.DLL" [null data] HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\ NOD32 Context Menu Shell Extension\(Default) = "{B089FE88-FB52-11D3-BDF1-0050DA34150D}" -> {HKLM...CLSID} = "NOD32 Context Menu Shell Extension" \InProcServer32\(Default) = "C:\Program Files\Eset\nodshex.dll" [null data] WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] Group Policies {GPedit.msc branch and setting}: ----------------------------------------------- Note: detected settings may not have any effect. HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\ "NoSetFolders" = (REG_DWORD) hex:0x00000000 {unrecognized setting} "NoSetTaskbar" = (REG_DWORD) hex:0x00000000 {User Configuration|Administrative Templates|Start Menu and Taskbar| Prevent changes to Taskbar and Start Menu Settings} "NoControlPanel" = (REG_DWORD) hex:0x00000000 {unrecognized setting} "NoSaveSettings" = (REG_DWORD) hex:0x00000000 {User Configuration|Administrative Templates|Desktop| Don't save settings at exit} "NoRun" = (REG_DWORD) hex:0x00000000 {unrecognized setting} "NoFind" = (REG_DWORD) hex:0x00000000 {unrecognized setting} "LWA" = (REG_DWORD) hex:0x00000000 {unrecognized setting} "LWB" = (REG_DWORD) hex:0x00000000 {unrecognized setting} "LWC" = (REG_DWORD) hex:0x00000000 {unrecognized setting} "LWD" = (REG_DWORD) hex:0x00000000 {unrecognized setting} "LWE" = (REG_DWORD) hex:0x00000000 {unrecognized setting} "LWF" = (REG_DWORD) hex:0x00000000 {unrecognized setting} "LWG" = (REG_DWORD) hex:0x00000000 {unrecognized setting} "LWH" = (REG_DWORD) hex:0x00000000 {unrecognized setting} "LWI" = (REG_DWORD) hex:0x00000000 {unrecognized setting} "LWJ" = (REG_DWORD) hex:0x00000000 {unrecognized setting} "LWK" = (REG_DWORD) hex:0x00000000 {unrecognized setting} "LWL" = (REG_DWORD) hex:0x00000000 {unrecognized setting} "LWM" = (REG_DWORD) hex:0x00000000 {unrecognized setting} "LWN" = (REG_DWORD) hex:0x00000000 {unrecognized setting} "LWO" = (REG_DWORD) hex:0x00000000 {unrecognized setting} "LWP" = (REG_DWORD) hex:0x00000000 {unrecognized setting} "LWQ" = (REG_DWORD) hex:0x00000000 {unrecognized setting} "LWR" = (REG_DWORD) hex:0x00000000 {unrecognized setting} "LWS" = (REG_DWORD) hex:0x00000000 {unrecognized setting} "LWT" = (REG_DWORD) hex:0x00000000 {unrecognized setting} "LWU" = (REG_DWORD) hex:0x00000000 {unrecognized setting} "LWV" = (REG_DWORD) hex:0x00000000 {unrecognized setting} "LWW" = (REG_DWORD) hex:0x00000000 {unrecognized setting} "LWX" = (REG_DWORD) hex:0x00000000 {unrecognized setting} "LWY" = (REG_DWORD) hex:0x00000000 {unrecognized setting} "LWZ" = (REG_DWORD) hex:0x00000000 {unrecognized setting} "NoDrives" = (REG_DWORD) hex:0x00000000 {unrecognized setting} HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System\ "DisableClock" = (REG_DWORD) hex:0x00000000 {unrecognized setting} "DisableRegistryTools" = (REG_DWORD) hex:0x00000000 {User Configuration|Administrative Templates|System| Prevent access to registry editing tools} "NoDispCPL" = (REG_DWORD) hex:0x00000000 {User Configuration|Administrative Templates|Control Panel|Display| Remove Display in Control Panel} "DisableTaskMgr" = (REG_DWORD) hex:0x00000000 {User Configuration|Administrative Templates|System|Ctrl+Alt+Del Options| Remove Task Manager} HKCU\Software\Policies\Microsoft\Windows\System\ "DisableCMD" = (REG_DWORD) hex:0x00000000 {User Configuration|Administrative Templates|System| Disable the command prompt} HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\ "shutdownwithoutlogon" = (REG_DWORD) hex:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| Shutdown: Allow system to be shut down without having to log on} "undockwithoutlogon" = (REG_DWORD) hex:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| Devices: Allow undock without having to log on} Active Desktop and Wallpaper: ----------------------------- Active Desktop may be disabled at this entry: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState Displayed if Active Desktop enabled and wallpaper not set by Group Policy: HKCU\Software\Microsoft\Internet Explorer\Desktop\General\ "Wallpaper" = "C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp" Displayed if Active Desktop disabled and wallpaper not set by Group Policy: HKCU\Control Panel\Desktop\ "Wallpaper" = "C:\Documents and Settings\Marek\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp" Enabled Screen Saver: --------------------- HKCU\Control Panel\Desktop\ "SCRNSAVE.EXE" = "none" [file not found] Startup items in "Marek" & "All Users" startup folders: ------------------------------------------------------- C:\Documents and Settings\Marek\Menu Start\Programy\Autostart "RocketDock" -> shortcut to: "C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe" [null data] "TA_Start" -> shortcut to: "C:\Documents and Settings\Marek\Ustawienia lokalne\Temp\TIP2D002.exe P2D002" [empty string] C:\Documents and Settings\All Users\Menu Start\Programy\Autostart "Adobe Reader Speed Launch" -> shortcut to: "C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe" ["Adobe Systems Incorporated"] "Last.fm Helper" -> shortcut to: "C:\Program Files\Last.fm\LastFMHelper.exe" [null data] Enabled Scheduled Tasks: ------------------------ "At1" -> launches: "C:\WINDOWS\system32\GN5ewLQO.exe" [file not found] "At10" -> launches: "C:\WINDOWS\system32\GN5ewLQO.exe" [file not found] "At11" -> launches: "C:\WINDOWS\system32\GN5ewLQO.exe" [file not found] "At12" -> launches: "C:\WINDOWS\system32\GN5ewLQO.exe" [file not found] "At13" -> launches: "C:\WINDOWS\system32\GN5ewLQO.exe" [file not found] "At14" -> launches: "C:\WINDOWS\system32\GN5ewLQO.exe" [file not found] "At15" -> launches: "C:\WINDOWS\system32\GN5ewLQO.exe" [file not found] "At16" -> launches: "C:\WINDOWS\system32\GN5ewLQO.exe" [file not found] "At17" -> launches: "C:\WINDOWS\system32\GN5ewLQO.exe" [file not found] "At18" -> launches: "C:\WINDOWS\system32\GN5ewLQO.exe" [file not found] "At19" -> launches: "C:\WINDOWS\system32\GN5ewLQO.exe" [file not found] "At2" -> launches: "C:\WINDOWS\system32\GN5ewLQO.exe" [file not found] "At20" -> launches: "C:\WINDOWS\system32\GN5ewLQO.exe" [file not found] "At21" -> launches: "C:\WINDOWS\system32\GN5ewLQO.exe" [file not found] "At22" -> launches: "C:\WINDOWS\system32\GN5ewLQO.exe" [file not found] "At23" -> launches: "C:\WINDOWS\system32\GN5ewLQO.exe" [file not found] "At24" -> launches: "C:\WINDOWS\system32\GN5ewLQO.exe" [file not found] "At3" -> launches: "C:\WINDOWS\system32\GN5ewLQO.exe" [file not found] "At4" -> launches: "C:\WINDOWS\system32\GN5ewLQO.exe" [file not found] "At5" -> launches: "C:\WINDOWS\system32\GN5ewLQO.exe" [file not found] "At6" -> launches: "C:\WINDOWS\system32\GN5ewLQO.exe" [file not found] "At7" -> launches: "C:\WINDOWS\system32\GN5ewLQO.exe" [file not found] "At8" -> launches: "C:\WINDOWS\system32\GN5ewLQO.exe" [file not found] "At9" -> launches: "C:\WINDOWS\system32\GN5ewLQO.exe" [file not found] Winsock2 Service Provider DLLs: ------------------------------- Namespace Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++} 000000000001\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS] 000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS] 000000000003\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS] 000000000004\LibraryPath = "C:\Program Files\Bonjour\mdnsNSP.dll" ["Apple Computer, Inc."] Transport Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++} 0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range: C:\WINDOWS\System32\imon.dll ["Eset "], 01 - 05, 19 %SystemRoot%\system32\mswsock.dll [MS], 06 - 08, 11 - 18 %SystemRoot%\system32\rsvpsp.dll [MS], 09 - 10 Toolbars, Explorer Bars, Extensions: ------------------------------------ Toolbars HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\ "{D3DEE18F-DB64-4BEB-9FF1-E1F0A5033E4A}" -> {HKLM...CLSID} = "BearShare MediaBar" \InProcServer32\(Default) = "C:\Program Files\BearShare applications\BearShare MediaBar\MediaBar.dll" ["IE Toolbar"] HKLM\Software\Microsoft\Internet Explorer\Toolbar\ "{E0E899AB-F487-11D5-8D29-0050BA6940E3}" = "FlashGet Bar" -> {HKLM...CLSID} = "FlashGet Bar" \InProcServer32\(Default) = "C:\PROGRA~1\FlashGet\fgiebar.dll" ["Amaze Soft"] "{D3DEE18F-DB64-4BEB-9FF1-E1F0A5033E4A}" = (no title provided) -> {HKLM...CLSID} = "BearShare MediaBar" \InProcServer32\(Default) = "C:\Program Files\BearShare applications\BearShare MediaBar\MediaBar.dll" ["IE Toolbar"] Explorer Bars HKLM\Software\Microsoft\Internet Explorer\Explorer Bars\ HKLM\Software\Classes\CLSID\{FF059E31-CC5A-4E2E-BF3B-96E929D65503}\(Default) = "&Poszukaj" Implemented Categories\{00021493-0000-0000-C000-000000000046}\ [vertical bar] InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL" [MS] Extensions (Tools menu items, main toolbar menu buttons) HKLM\Software\Microsoft\Internet Explorer\Extensions\ {08B0E5C0-4FCB-11CF-AAA5-00401C608501}\ "MenuText" = "Sun Java Console" "CLSIDExtension" = "{CAFEEFAC-0016-0000-0001-ABCDEFFEDCBC}" -> {HKCU...CLSID} = "Java Plug-in 1.6.0_01" \InProcServer32\(Default) = "C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll" ["Sun Microsystems, Inc."] -> {HKLM...CLSID} = "Java Plug-in 1.6.0_01" \InProcServer32\(Default) = "C:\Program Files\Java\jre1.6.0_01\bin\npjpi160_01.dll" ["Sun Microsystems, Inc."] {92780B25-18CC-41C8-B9BE-3C9C571A8263}\ "ButtonText" = "Research" {D6E814A0-E0C5-11D4-8D29-0050BA6940E3}\ "ButtonText" = "FlashGet" "MenuText" = "&FlashGet" "Exec" = "C:\PROGRA~1\FlashGet\flashget.exe" ["Amaze Soft"] {FB5F1910-F110-11D2-BB9E-00C04F795683}\ "ButtonText" = "Messenger" "MenuText" = "Windows Messenger" "Exec" = "C:\Program Files\Messenger\msmsgs.exe" [MS] Running Services (Display Name, Service Name, Path {Service DLL}): ------------------------------------------------------------------ ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762##, Bonjour Service, ""C:\Program Files\Bonjour\mDNSResponder.exe"" ["Apple Computer, Inc."] NOD32 Kernel Service, NOD32krn, ""C:\Program Files\Eset\nod32krn.exe"" ["Eset "] NVIDIA Display Driver Service, NVSvc, "C:\WINDOWS\system32\nvsvc32.exe" ["NVIDIA Corporation"] PnkBstrA, PnkBstrA, "C:\WINDOWS\system32\PnkBstrA.exe" [null data] StarWind iSCSI Service, StarWindService, "C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe" ["Rocket Division Software"] Windows User Mode Driver Framework, UMWdf, "C:\WINDOWS\system32\wdfmgr.exe" [MS] Print Monitors: --------------- HKLM\System\CurrentControlSet\Control\Print\Monitors\ hpzlnt05\Driver = "hpzlnt05.dll" ["HP"] ---------- (launch time: 2007-08-14 15:35:48) <<!>>: Suspicious data at a malware launch point. + This report excludes default entries except where indicated. + To see *everywhere* the script checks and *everything* it finds, launch it from a command prompt or a shortcut with the -all parameter. + To search all directories of local fixed drives for DESKTOP.INI DLL launch points, use the -supp parameter or answer "No" at the first message box and "Yes" at the second message box. ---------- (total run time: 295 seconds, including 5 seconds for message boxes)

**Posty:** 18165 · przez **wojtas** 14 Sie 2007, 16:35

zastosuj:

smitfraudfix z opcji 2:

http://siri.urz.free.fr/Fix/SmitfraudFix_En.php

oraz te skanery po kilka razy

VundoFix
http://www.atribune.org/ccount/click.php?id=4

VirtumundoBeGone
http://secured2k.home.comcast.net/tools/VirtumundoBeGone.exe

FixVundo
http://securityresponse.symantec.com/avcenter/FixVundo.exe

**Posty:** 1846 · przez **kokos** 15 Sie 2007, 08:25

Po wykonaniu tych czynności logi wyglądają tak:

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.0 (BETA) Scan saved at 08:12:06, on 2007-08-15 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Eset\nod32kui.exe C:\WINDOWS\System32\Rundll32.exe C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\Program Files\Eset\nod32krn.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\PnkBstrA.exe C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Konnekt\konnekt.exe C:\Program Files\Mozilla Firefox\firefox.exe D:\hijackthis\HiJackThis_v2.exe R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: rightonadz.biz browser optimizer - {36A91CEC-6C71-4758-B492-397BFC8E96A2} - C:\WINDOWS\system32\gzmrotate.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O2 - BHO: WebAssist - {85589B5D-D53D-4237-A677-46B82EA275F3} - C:\WINDOWS\WebAssist.dll O2 - BHO: IeCatch2 Class - {A5366673-E8CA-11D3-9CD9-0090271D075B} - C:\PROGRA~1\FlashGet\jccatch.dll O2 - BHO: adssite - {F31B3634-12AA-41ca-B021-0685C3B3E4CA} - C:\WINDOWS\system32\nsw1BAE.dll O2 - BHO: XBTP02634 - {F97DA966-F09D-4cab-BF29-75A0026986EA} - C:\PROGRA~1\BEARSH~1\BEARSH~2\MediaBar.dll O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\fgiebar.dll O3 - Toolbar: BearShare MediaBar - {D3DEE18F-DB64-4BEB-9FF1-E1F0A5033E4A} - C:\Program Files\BearShare applications\BearShare MediaBar\MediaBar.dll O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [adstart] C:\WINDOWS\System32\Rundll32.exe "C:\WINDOWS\system32\gzmrotate.dll" DllVerify O4 - HKCU\..\Run: [RocketDock] "C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe" O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user') O8 - Extra context menu item: Ściągnij przy pomocy FlashGet'a - C:\Program Files\FlashGet\jc_link.htm O8 - Extra context menu item: Ściągnij wszystko przy pomocy FlashGet'a - C:\Program Files\FlashGet\jc_all.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {CD995117-98E5-4169-9920-6C12D4C0B548} (HGPlugin9USA Class) - http://gamedownload.ijjimax.com/gamedownload/dist/hgstart/HGPlugin9USA.cab O22 - SharedTaskScheduler: Moduł wstępnego ładowania interfejsu Browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\System32\browseui.dll O22 - SharedTaskScheduler: Demon buforu kategorii składników - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\System32\browseui.dll O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe O23 - Service: PnkBstrB - Unknown owner - C:\WINDOWS\system32\PnkBstrB.exe O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe -- End of file - 5431 bytes

Kod: Zaznacz wszystko: "Silent Runners.vbs", revision 52, http://www.silentrunners.org/ Operating System: Windows XP SP2 Output limited to non-default values, except where indicated by "{++}" Startup items buried in registry: --------------------------------- HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ {++} "RocketDock" = ""C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe"" [null data] HKLM\Software\Microsoft\Windows\CurrentVersion\Run\ {++} "nod32kui" = ""C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE" ["Eset "] "NvCplDaemon" = "RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup" [MS] "adstart" = "C:\WINDOWS\System32\Rundll32.exe "C:\WINDOWS\system32\gzmrotate.dll" DllVerify" [MS] HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\(Default) = (no title provided) -> {HKLM...CLSID} = "AcroIEHlprObj Class" \InProcServer32\(Default) = "C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll" ["Adobe Systems Incorporated"] {36A91CEC-6C71-4758-B492-397BFC8E96A2}\(Default) = (no title provided) -> {HKLM...CLSID} = "rightonadz.biz browser optimizer" \InProcServer32\(Default) = "C:\WINDOWS\system32\gzmrotate.dll" [empty string] {761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\(Default) = (no title provided) -> {HKLM...CLSID} = "SSVHelper Class" \InProcServer32\(Default) = "C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll" ["Sun Microsystems, Inc."] {85589B5D-D53D-4237-A677-46B82EA275F3}\(Default) = "WebAssist" -> {HKLM...CLSID} = "WebAssist" \InProcServer32\(Default) = "C:\WINDOWS\WebAssist.dll" [null data] {A5366673-E8CA-11D3-9CD9-0090271D075B}\(Default) = (no title provided) -> {HKLM...CLSID} = "IeCatch2 Class" \InProcServer32\(Default) = "C:\PROGRA~1\FlashGet\jccatch.dll" ["Amaze Soft"] {F31B3634-12AA-41ca-B021-0685C3B3E4CA}\(Default) = (no title provided) -> {HKLM...CLSID} = "adssite" \InProcServer32\(Default) = "C:\WINDOWS\system32\nsw1BAE.dll" [empty string] {F97DA966-F09D-4cab-BF29-75A0026986EA}\(Default) = "XBTP02634" -> {HKLM...CLSID} = "XBTP02634 Class" \InProcServer32\(Default) = "C:\PROGRA~1\BEARSH~1\BEARSH~2\MediaBar.dll" ["IE Toolbar"] HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\ "{42071714-76d4-11d1-8b24-00a0c9068ff3}" = "Rozszerzenie CPL kadrowania wyświetlania" -> {HKLM...CLSID} = "Rozszerzenie CPL kadrowania wyświetlania" \InProcServer32\(Default) = "deskpan.dll" [file not found] "{88895560-9AA2-1069-930E-00AA0030EBC8}" = "Rozszerzenie ikony HyperTerminalu" -> {HKLM...CLSID} = "HyperTerminal Icon Ext" \InProcServer32\(Default) = "C:\WINDOWS\System32\hticons.dll" ["Hilgraeve, Inc."] "{B089FE88-FB52-11D3-BDF1-0050DA34150D}" = "NOD32 Context Menu Shell Extension" -> {HKLM...CLSID} = "NOD32 Context Menu Shell Extension" \InProcServer32\(Default) = "C:\Program Files\Eset\nodshex.dll" [null data] "{32020A01-506E-484D-A2A8-BE3CF17601C3}" = "AlcoholShellEx" -> {HKLM...CLSID} = "AlcoholShellEx" \InProcServer32\(Default) = "C:\PROGRA~1\ALCOHO~1\ALCOHO~1\AXShlEx.dll" ["Alcohol Soft Development Team"] "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" = "WinRAR shell extension" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] "{42042206-2D85-11D3-8CFF-005004838597}" = "Microsoft Office HTML Icon Handler" -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "C:\Program Files\Microsoft Office\Office12\msohevi.dll" [MS] "{993BE281-6695-4BA5-8A2A-7AACBFAAB69E}" = "Microsoft Office Metadata Handler" -> {HKLM...CLSID} = "Microsoft Office Metadata Handler" \InProcServer32\(Default) = "C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\msoshext.dll" [MS] "{C41662BB-1FA0-4CE0-8DC5-9B7F8279FF97}" = "Microsoft Office Thumbnail Handler" -> {HKLM...CLSID} = "Microsoft Office Thumbnail Handler" \InProcServer32\(Default) = "C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\msoshext.dll" [MS] "{13311DA7-1D24-40e5-AE07-7E3750F5DE3C}" = "Right Click Image Converter Extension" -> {HKLM...CLSID} = "Right Click Image Converter Extension" \InProcServer32\(Default) = "C:\Program Files\Kristanix\Right Click Image Converter\extRCIC.dll" [null data] "{23170F69-40C1-278A-1000-000100020000}" = "7-Zip Shell Extension" -> {HKLM...CLSID} = "7-Zip Shell Extension" \InProcServer32\(Default) = "C:\Program Files\7-Zip\7-zip.dll" ["Igor Pavlov"] "{ABC70703-32AF-11d4-90C4-D483A70F4825}" = "CMenuExtender" -> {HKLM...CLSID} = "CMenuExtender" \InProcServer32\(Default) = "C:\WINDOWS\BricoPacks\Vista Inspirat 2\iColorFolder\CMExt.dll" ["Revenger inc."] "{D7B7A5AE-9D19-4F9E-9C6F-46C82D22D71C}" = "Wyślij na Fotosik.pl" -> {HKLM...CLSID} = "Wyślij na Fotosik.pl" \InProcServer32\(Default) = "C:\PROGRA~1\FOTOSI~1\FOTOSI~1.DLL" [null data] "{A70C977A-BF00-412C-90B7-034C51DA2439}" = "NvCpl DesktopContext Class" -> {HKLM...CLSID} = "DesktopContext Class" \InProcServer32\(Default) = "C:\WINDOWS\system32\nvcpl.dll" ["NVIDIA Corporation"] "{FFB699E0-306A-11d3-8BD1-00104B6F7516}" = "Play on my TV helper" -> {HKLM...CLSID} = "NVIDIA CPL Extension" \InProcServer32\(Default) = "C:\WINDOWS\system32\nvcpl.dll" ["NVIDIA Corporation"] "{1CDB2949-8F65-4355-8456-263E7C208A5D}" = "Desktop Explorer" -> {HKLM...CLSID} = "Desktop Explorer" \InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"] "{1E9B04FB-F9E5-4718-997B-B8DA88302A47}" = "Desktop Explorer Menu" -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"] "{1E9B04FB-F9E5-4718-997B-B8DA88302A48}" = "nView Desktop Context Menu" -> {HKLM...CLSID} = "nView Desktop Context Menu" \InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"] HKLM\Software\Classes\PROTOCOLS\Filter\ <<!>> text/xml\CLSID = "{807563E5-5146-11D5-A672-00B0D022E945}" -> {HKLM...CLSID} = "Microsoft Office InfoPath XML Mime Filter" \InProcServer32\(Default) = "C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL" [MS] HKLM\Software\Classes\Folder\shellex\ColumnHandlers\ {F9DB5320-233E-11D1-9F84-707F02C10627}\(Default) = "PDF Column Info" -> {HKLM...CLSID} = "PDF Shell Extension" \InProcServer32\(Default) = "C:\Program Files\Adobe\Acrobat 7.0\ActiveX\PDFShell.dll" ["Adobe Systems, Inc."] HKLM\Software\Classes\*\shellex\ContextMenuHandlers\ 7-Zip\(Default) = "{23170F69-40C1-278A-1000-000100020000}" -> {HKLM...CLSID} = "7-Zip Shell Extension" \InProcServer32\(Default) = "C:\Program Files\7-Zip\7-zip.dll" ["Igor Pavlov"] NOD32 Context Menu Shell Extension\(Default) = "{B089FE88-FB52-11D3-BDF1-0050DA34150D}" -> {HKLM...CLSID} = "NOD32 Context Menu Shell Extension" \InProcServer32\(Default) = "C:\Program Files\Eset\nodshex.dll" [null data] Right Click Image Converter\(Default) = "{13311DA7-1D24-40e5-AE07-7E3750F5DE3C}" -> {HKLM...CLSID} = "Right Click Image Converter Extension" \InProcServer32\(Default) = "C:\Program Files\Kristanix\Right Click Image Converter\extRCIC.dll" [null data] WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\ 7-Zip\(Default) = "{23170F69-40C1-278A-1000-000100020000}" -> {HKLM...CLSID} = "7-Zip Shell Extension" \InProcServer32\(Default) = "C:\Program Files\7-Zip\7-zip.dll" ["Igor Pavlov"] CMenuExtender\(Default) = "{ABC70703-32AF-11d4-90C4-D483A70F4825}" -> {HKLM...CLSID} = "CMenuExtender" \InProcServer32\(Default) = "C:\WINDOWS\BricoPacks\Vista Inspirat 2\iColorFolder\CMExt.dll" ["Revenger inc."] WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] {D7B7A5AE-9D19-4F9E-9C6F-46C82D22D71C}\(Default) = "{D7B7A5AE-9D19-4F9E-9C6F-46C82D22D71C}" -> {HKLM...CLSID} = "Wyślij na Fotosik.pl" \InProcServer32\(Default) = "C:\PROGRA~1\FOTOSI~1\FOTOSI~1.DLL" [null data] HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\ NOD32 Context Menu Shell Extension\(Default) = "{B089FE88-FB52-11D3-BDF1-0050DA34150D}" -> {HKLM...CLSID} = "NOD32 Context Menu Shell Extension" \InProcServer32\(Default) = "C:\Program Files\Eset\nodshex.dll" [null data] WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] Group Policies {GPedit.msc branch and setting}: ----------------------------------------------- Note: detected settings may not have any effect. HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\ "NoSetFolders" = (REG_DWORD) hex:0x00000000 {unrecognized setting} "NoSetTaskbar" = (REG_DWORD) hex:0x00000000 {User Configuration|Administrative Templates|Start Menu and Taskbar| Prevent changes to Taskbar and Start Menu Settings} "NoControlPanel" = (REG_DWORD) hex:0x00000000 {unrecognized setting} "NoSaveSettings" = (REG_DWORD) hex:0x00000000 {User Configuration|Administrative Templates|Desktop| Don't save settings at exit} "NoRun" = (REG_DWORD) hex:0x00000000 {unrecognized setting} "NoFind" = (REG_DWORD) hex:0x00000000 {unrecognized setting} "LWA" = (REG_DWORD) hex:0x00000000 {unrecognized setting} "LWB" = (REG_DWORD) hex:0x00000000 {unrecognized setting} "LWC" = (REG_DWORD) hex:0x00000000 {unrecognized setting} "LWD" = (REG_DWORD) hex:0x00000000 {unrecognized setting} "LWE" = (REG_DWORD) hex:0x00000000 {unrecognized setting} "LWF" = (REG_DWORD) hex:0x00000000 {unrecognized setting} "LWG" = (REG_DWORD) hex:0x00000000 {unrecognized setting} "LWH" = (REG_DWORD) hex:0x00000000 {unrecognized setting} "LWI" = (REG_DWORD) hex:0x00000000 {unrecognized setting} "LWJ" = (REG_DWORD) hex:0x00000000 {unrecognized setting} "LWK" = (REG_DWORD) hex:0x00000000 {unrecognized setting} "LWL" = (REG_DWORD) hex:0x00000000 {unrecognized setting} "LWM" = (REG_DWORD) hex:0x00000000 {unrecognized setting} "LWN" = (REG_DWORD) hex:0x00000000 {unrecognized setting} "LWO" = (REG_DWORD) hex:0x00000000 {unrecognized setting} "LWP" = (REG_DWORD) hex:0x00000000 {unrecognized setting} "LWQ" = (REG_DWORD) hex:0x00000000 {unrecognized setting} "LWR" = (REG_DWORD) hex:0x00000000 {unrecognized setting} "LWS" = (REG_DWORD) hex:0x00000000 {unrecognized setting} "LWT" = (REG_DWORD) hex:0x00000000 {unrecognized setting} "LWU" = (REG_DWORD) hex:0x00000000 {unrecognized setting} "LWV" = (REG_DWORD) hex:0x00000000 {unrecognized setting} "LWW" = (REG_DWORD) hex:0x00000000 {unrecognized setting} "LWX" = (REG_DWORD) hex:0x00000000 {unrecognized setting} "LWY" = (REG_DWORD) hex:0x00000000 {unrecognized setting} "LWZ" = (REG_DWORD) hex:0x00000000 {unrecognized setting} "NoDrives" = (REG_DWORD) hex:0x00000000 {unrecognized setting} HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System\ "DisableClock" = (REG_DWORD) hex:0x00000000 {unrecognized setting} "DisableRegistryTools" = (REG_DWORD) hex:0x00000000 {User Configuration|Administrative Templates|System| Prevent access to registry editing tools} "NoDispCPL" = (REG_DWORD) hex:0x00000000 {User Configuration|Administrative Templates|Control Panel|Display| Remove Display in Control Panel} "DisableTaskMgr" = (REG_DWORD) hex:0x00000000 {User Configuration|Administrative Templates|System|Ctrl+Alt+Del Options| Remove Task Manager} HKCU\Software\Policies\Microsoft\Windows\System\ "DisableCMD" = (REG_DWORD) hex:0x00000000 {User Configuration|Administrative Templates|System| Disable the command prompt} HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\ "shutdownwithoutlogon" = (REG_DWORD) hex:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| Shutdown: Allow system to be shut down without having to log on} "undockwithoutlogon" = (REG_DWORD) hex:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| Devices: Allow undock without having to log on} Active Desktop and Wallpaper: ----------------------------- Active Desktop may be disabled at this entry: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState Displayed if Active Desktop enabled and wallpaper not set by Group Policy: HKCU\Software\Microsoft\Internet Explorer\Desktop\General\ "Wallpaper" = "C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp" Displayed if Active Desktop disabled and wallpaper not set by Group Policy: HKCU\Control Panel\Desktop\ "Wallpaper" = "C:\Documents and Settings\Marek\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp" Enabled Screen Saver: --------------------- HKCU\Control Panel\Desktop\ "SCRNSAVE.EXE" = "none" [file not found] Winsock2 Service Provider DLLs: ------------------------------- Namespace Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++} 000000000001\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS] 000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS] 000000000003\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS] 000000000004\LibraryPath = "C:\Program Files\Bonjour\mdnsNSP.dll" ["Apple Computer, Inc."] Transport Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++} 0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range: C:\WINDOWS\System32\imon.dll ["Eset "], 01 - 05, 19 %SystemRoot%\system32\mswsock.dll [MS], 06 - 08, 11 - 18 %SystemRoot%\system32\rsvpsp.dll [MS], 09 - 10 Toolbars, Explorer Bars, Extensions: ------------------------------------ Toolbars HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\ "{D3DEE18F-DB64-4BEB-9FF1-E1F0A5033E4A}" -> {HKLM...CLSID} = "BearShare MediaBar" \InProcServer32\(Default) = "C:\Program Files\BearShare applications\BearShare MediaBar\MediaBar.dll" ["IE Toolbar"] HKLM\Software\Microsoft\Internet Explorer\Toolbar\ "{E0E899AB-F487-11D5-8D29-0050BA6940E3}" = "FlashGet Bar" -> {HKLM...CLSID} = "FlashGet Bar" \InProcServer32\(Default) = "C:\PROGRA~1\FlashGet\fgiebar.dll" ["Amaze Soft"] "{D3DEE18F-DB64-4BEB-9FF1-E1F0A5033E4A}" = (no title provided) -> {HKLM...CLSID} = "BearShare MediaBar" \InProcServer32\(Default) = "C:\Program Files\BearShare applications\BearShare MediaBar\MediaBar.dll" ["IE Toolbar"] Explorer Bars HKLM\Software\Microsoft\Internet Explorer\Explorer Bars\ HKLM\Software\Classes\CLSID\{FF059E31-CC5A-4E2E-BF3B-96E929D65503}\(Default) = "&Poszukaj" Implemented Categories\{00021493-0000-0000-C000-000000000046}\ [vertical bar] InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL" [MS] Extensions (Tools menu items, main toolbar menu buttons) HKLM\Software\Microsoft\Internet Explorer\Extensions\ {08B0E5C0-4FCB-11CF-AAA5-00401C608501}\ "MenuText" = "Sun Java Console" "CLSIDExtension" = "{CAFEEFAC-0016-0000-0001-ABCDEFFEDCBC}" -> {HKCU...CLSID} = "Java Plug-in 1.6.0_01" \InProcServer32\(Default) = "C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll" ["Sun Microsystems, Inc."] -> {HKLM...CLSID} = "Java Plug-in 1.6.0_01" \InProcServer32\(Default) = "C:\Program Files\Java\jre1.6.0_01\bin\npjpi160_01.dll" ["Sun Microsystems, Inc."] {92780B25-18CC-41C8-B9BE-3C9C571A8263}\ "ButtonText" = "Research" {D6E814A0-E0C5-11D4-8D29-0050BA6940E3}\ "ButtonText" = "FlashGet" "MenuText" = "&FlashGet" "Exec" = "C:\PROGRA~1\FlashGet\flashget.exe" ["Amaze Soft"] {FB5F1910-F110-11D2-BB9E-00C04F795683}\ "ButtonText" = "Messenger" "MenuText" = "Windows Messenger" "Exec" = "C:\Program Files\Messenger\msmsgs.exe" [MS] Running Services (Display Name, Service Name, Path {Service DLL}): ------------------------------------------------------------------ ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762##, Bonjour Service, ""C:\Program Files\Bonjour\mDNSResponder.exe"" ["Apple Computer, Inc."] NOD32 Kernel Service, NOD32krn, ""C:\Program Files\Eset\nod32krn.exe"" ["Eset "] NVIDIA Display Driver Service, NVSvc, "C:\WINDOWS\system32\nvsvc32.exe" ["NVIDIA Corporation"] PnkBstrA, PnkBstrA, "C:\WINDOWS\system32\PnkBstrA.exe" [null data] StarWind iSCSI Service, StarWindService, "C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe" ["Rocket Division Software"] Windows User Mode Driver Framework, UMWdf, "C:\WINDOWS\system32\wdfmgr.exe" [MS] Print Monitors: --------------- HKLM\System\CurrentControlSet\Control\Print\Monitors\ hpzlnt05\Driver = "hpzlnt05.dll" ["HP"] ---------- (launch time: 2007-08-15 08:13:50) <<!>>: Suspicious data at a malware launch point. + This report excludes default entries except where indicated. + To see *everywhere* the script checks and *everything* it finds, launch it from a command prompt or a shortcut with the -all parameter. + The search for DESKTOP.INI DLL launch points on all local fixed drives took 184 seconds. ---------- (total run time: 298 seconds)

**Posty:** 18165 · przez **wojtas** 15 Sie 2007, 09:04

Użyj WWDC :
http://www.firewallleaktester.com/wwdc.htm
Zmień opcje z disable na enable. Uruchom ponownie komputer.
Tak powinny wyglądać porty (NetBIOS może być żółty) :
http://www.firewallleaktester.com/images_site/wwdc.jpg

skasuj w awaryjnym z wylaczonym przywracaniem systemu:

O2 - BHO: rightonadz.biz browser optimizer - {36A91CEC-6C71-4758-B492-397BFC8E96A2} - C:\WINDOWS\system32\gzmrotate.dll
O2 - BHO: WebAssist - {85589B5D-D53D-4237-A677-46B82EA275F3} - C:\WINDOWS\WebAssist.dll
O2 - BHO: adssite - {F31B3634-12AA-41ca-B021-0685C3B3E4CA} - C:\WINDOWS\system32\nsw1BAE.dll
O2 - BHO: XBTP02634 - {F97DA966-F09D-4cab-BF29-75A0026986EA} - C:\PROGRA~1\BEARSH~1\BEARSH~2\MediaBar.dll
O3 - Toolbar: BearShare MediaBar - {D3DEE18F-DB64-4BEB-9FF1-E1F0A5033E4A} - C:\Program Files\BearShare applications\BearShare MediaBar\MediaBar.dll
O4 - HKLM\..\Run: [adstart] C:\WINDOWS\System32\Rundll32.exe "C:\WINDOWS\system32\gzmrotate.dll" DllVerify

potem daj loga z combofixa oraz z hijacka

**Posty:** 1846 · przez **kokos** 15 Sie 2007, 11:44

Proszę bardzo:

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.0 (BETA) Scan saved at 11:33:31, on 2007-08-15 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Eset\nod32kui.exe C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\Program Files\Eset\nod32krn.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\PnkBstrA.exe C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\wuauclt.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Konnekt\konnekt.exe D:\hijackthis\HiJackThis_v2.exe R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O2 - BHO: IeCatch2 Class - {A5366673-E8CA-11D3-9CD9-0090271D075B} - C:\PROGRA~1\FlashGet\jccatch.dll O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\fgiebar.dll O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKCU\..\Run: [RocketDock] "C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe" O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user') O8 - Extra context menu item: Ściągnij przy pomocy FlashGet'a - C:\Program Files\FlashGet\jc_link.htm O8 - Extra context menu item: Ściągnij wszystko przy pomocy FlashGet'a - C:\Program Files\FlashGet\jc_all.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {CD995117-98E5-4169-9920-6C12D4C0B548} (HGPlugin9USA Class) - http://gamedownload.ijjimax.com/gamedownload/dist/hgstart/HGPlugin9USA.cab O22 - SharedTaskScheduler: Moduł wstępnego ładowania interfejsu Browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\System32\browseui.dll O22 - SharedTaskScheduler: Demon buforu kategorii składników - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\System32\browseui.dll O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe O23 - Service: PnkBstrB - Unknown owner - C:\WINDOWS\system32\PnkBstrB.exe O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe -- End of file - 4713 bytes

Kod: Zaznacz wszystko: ComboFix 07-08-14.4 - "Marek" 2007-08-15 11:34:51.1 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.241 [GMT 2:00] ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) C:\WINDOWS\system32\msnav32.ax ((((((((((((((((((((((((( Files Created from 2007-07-15 to 2007-08-15 ))))))))))))))))))))))))))))))) 2007-08-15 11:34 51,200 --a------ C:\WINDOWS\nircmd.exe 2007-08-15 11:27 524,288 --ah----- C:\DOCUME~1\ADMINI~1\NTUSER.DAT 2007-08-15 11:27 <DIR> dr-h----- C:\DOCUME~1\ADMINI~1\Dane aplikacji 2007-08-15 11:27 <DIR> dr------- C:\DOCUME~1\ADMINI~1\Menu Start 2007-08-15 11:27 <DIR> d--h----- C:\DOCUME~1\ADMINI~1\Ustawienia lokalne 2007-08-15 11:27 <DIR> d--h----- C:\DOCUME~1\ADMINI~1\Szablony 2007-08-15 11:27 <DIR> d-------- C:\DOCUME~1\ADMINI~1\Ulubione 2007-08-15 11:27 <DIR> d-------- C:\DOCUME~1\ADMINI~1\Pulpit 2007-08-15 11:27 <DIR> d-------- C:\DOCUME~1\ADMINI~1\Moje dokumenty 2007-08-14 17:27 180,224 --a------ C:\WINDOWS\system32\nvudisp.exe 2007-08-14 17:27 <DIR> d-------- C:\WINDOWS\nview 2007-08-14 16:49 <DIR> d-------- C:\VundoFix Backups 2007-08-14 16:37 1,282 --a------ C:\WINDOWS\system32\tmp.reg 2007-08-14 16:36 53,248 --a------ C:\WINDOWS\system32\Process.exe 2007-08-14 16:36 51,200 --a------ C:\WINDOWS\system32\dumphive.exe 2007-08-14 16:36 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe 2007-08-12 17:17 79,186 --a------ C:\WINDOWS\system32\adssite-remove.exe 2007-08-12 17:17 39,884 --a------ C:\WINDOWS\system32\gzmrot-uninst.exe 2007-08-06 18:38 20,640 --------- C:\WINDOWS\system32\drivers\PxHelp20.sys 2007-08-06 18:37 <DIR> d-------- C:\WINDOWS\RegisteredPackages 2007-08-06 18:33 <DIR> d-------- C:\Program Files\SHOUTcast 2007-08-06 18:28 <DIR> d-------- C:\Program Files\Winamp 2007-08-05 16:14 <DIR> d-------- C:\Program Files\PPStream 2007-08-05 16:14 <DIR> d-------- C:\DOCUME~1\Marek\DANEAP~1\ppstream 2007-08-05 16:08 <DIR> d-------- C:\DOCUME~1\Marek\DANEAP~1\SopCast 2007-08-05 16:07 <DIR> d-------- C:\Program Files\SopCast 2007-07-23 23:46 <DIR> d-------- C:\WINDOWS\system32\appmgmt 2007-07-23 11:03 <DIR> d-------- C:\WINDOWS\system32\Naughty America The Game - Screensaver dir 2007-07-20 02:12 <DIR> d-------- C:\Program Files\Fotosik Manager 2007-07-19 10:13 <DIR> d-------- C:\NVIDIA 2007-07-18 21:19 <DIR> d-------- C:\DOCUME~1\Marek\DANEAP~1\OpenOffice.org2 2007-07-18 21:17 <DIR> d-------- C:\Program Files\OpenOffice.org 2.1 (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) 2007-08-14 23:18 --------- d-------- C:\DOCUME~1\Marek\DANEAP~1\foobar2000 2007-08-08 13:12 --------- d-------- C:\Program Files\Deutsch Translator 2 2007-08-06 13:34 --------- d-------- C:\Program Files\FlashFXP 2007-07-29 20:38 --------- d-------- C:\Program Files\Gadu-Gadu 2007-07-29 09:56 --------- d-------- C:\DOCUME~1\Marek\DANEAP~1\Real 2007-07-23 23:53 --------- d-------- C:\Program Files\Common Files\Ahead 2007-07-23 23:41 --------- d-------- C:\DOCUME~1\Marek\DANEAP~1\Cream Software 2007-07-23 23:11 --------- d-------- C:\Program Files\FlashGet 2007-07-20 17:29 --------- d-------- C:\Program Files\Opera 2007-07-13 13:47 --------- d-------- C:\Program Files\Last.fm 2007-07-13 01:57 --------- d--h----- C:\Program Files\InstallShield Installation Information 2007-07-11 23:11 --------- d-------- C:\DOCUME~1\Marek\DANEAP~1\AdobeUM 2007-07-11 08:08 --------- d-------- C:\Program Files\Chico 2007-07-10 23:03 59 ---h----- C:\WINDOWS\system32\SWCTL.DLL 2007-07-10 01:07 --------- d-------- C:\DOCUME~1\Marek\DANEAP~1\Xfire 2007-07-10 01:03 --------- d---s---- C:\Program Files\Xfire 2007-07-02 15:35 --------- d-------- C:\Program Files\Ashampoo 2007-06-30 16:59 --------- d-------- C:\DOCUME~1\Marek\DANEAP~1\GanymedeNet 2007-06-30 16:37 --------- d-------- C:\Program Files\Ganymede 2007-06-28 21:32 99904 --a------ C:\WINDOWS\system32\PnkBstrB.exe 2007-06-28 16:51 --------- d-------- C:\Program Files\NAPI-PROJEKT 2007-06-21 23:04 22584 --a------ C:\WINDOWS\system32\drivers\PnkBstrK.sys 2007-06-21 16:50 --------- d-------- C:\Program Files\Movie Maker 2007-06-21 16:49 64713 --a------ C:\WINDOWS\BricoPackUninst.cmd 2007-06-21 16:49 6114 --a------ C:\WINDOWS\BricoPackFoldersDelete.cmd 2007-06-21 16:49 219648 --a------ C:\WINDOWS\system32\uxtheme.dll 2007-06-18 12:33 --------- d-------- C:\Program Files\%ramdrv%Image_Grabber_II 2007-06-16 19:49 --------- d-------- C:\DOCUME~1\Marek\DANEAP~1\LimeWire 2007-06-16 19:34 --------- d-------- C:\Program Files\BearShare 2007-06-16 18:26 --------- d-------- C:\Program Files\7-Zip 2007-06-16 18:26 --------- d-------- C:\DOCUME~1\Marek\DANEAP~1\Opera 2007-06-15 14:43 --------- d-------- C:\Program Files\English Translator 3 2007-06-13 20:08 63040 --a------ C:\WINDOWS\system32\PnkBstrA.exe 2007-06-09 00:26 4 --a------ C:\WINDOWS\system32\proc-220146841.bin 2007-06-02 13:23 108144 --a------ C:\WINDOWS\system32\CmdLineExt.dll 2007-05-25 12:25 2724 --a------ C:\WINDOWS\pchealth\HelpCtr\PackageStore\SkuStore.bin 2007-05-25 12:22 8972 --a------ C:\WINDOWS\pchealth\HelpCtr\Config\Cntstore.bin 2007-05-25 11:59 299392 --a------ C:\WINDOWS\system32\imon.dll 2007-05-25 11:50 0 -rahs---- C:\MSDOS.SYS 2007-05-25 11:50 0 -rahs---- C:\IO.SYS 2007-05-25 11:50 0 --a------ C:\CONFIG.SYS 2007-05-25 11:50 0 --a------ C:\AUTOEXEC.BAT ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "nod32kui"="C:\Program Files\Eset\nod32kui.exe" [2007-05-25 11:59] "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2005-08-27 01:31] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "RocketDock"="C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe" [2007-03-19 00:05] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system] "DisableClock"=0 (0x0) "NoDispCPL"=0 (0x0) [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] "NoSetFolders"=0 (0x0) "NoSetTaskbar"=0 (0x0) "LWA"=0 (0x0) "LWB"=0 (0x0) "LWC"=0 (0x0) "LWD"=0 (0x0) "LWE"=0 (0x0) "LWF"=0 (0x0) "LWG"=0 (0x0) "LWH"=0 (0x0) "LWI"=0 (0x0) "LWJ"=0 (0x0) "LWK"=0 (0x0) "LWL"=0 (0x0) "LWM"=0 (0x0) "LWN"=0 (0x0) "LWO"=0 (0x0) "LWP"=0 (0x0) "LWQ"=0 (0x0) "LWR"=0 (0x0) "LWS"=0 (0x0) "LWT"=0 (0x0) "LWU"=0 (0x0) "LWV"=0 (0x0) "LWW"=0 (0x0) "LWX"=0 (0x0) "LWY"=0 (0x0) "LWZ"=0 (0x0) [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Adobe Reader Speed Launch.lnk] path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Adobe Reader Speed Launch.lnk backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Last.fm Helper.lnk] path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Last.fm Helper.lnk backup=C:\WINDOWS\pss\Last.fm Helper.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Marek^Menu Start^Programy^Autostart^RocketDock.lnk] path=C:\Documents and Settings\Marek\Menu Start\Programy\Autostart\RocketDock.lnk backup=C:\WINDOWS\pss\RocketDock.lnkStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Marek^Menu Start^Programy^Autostart^TA_Start.lnk] path=C:\Documents and Settings\Marek\Menu Start\Programy\Autostart\TA_Start.lnk backup=C:\WINDOWS\pss\TA_Start.lnkStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\adstart] C:\WINDOWS\System32\Rundll32.exe "C:\WINDOWS\system32\gzmrotate.dll" DllVerify [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BearShare] "C:\Program Files\BearShare\BearShare.exe" /pause [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033 [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb05.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Konnekt] "C:\Program Files\Konnekt\konnekt.exe" /autostart [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz] nwiz.exe /install [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched] C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\{39-9A-AB-B8-ZN}] C:\Documents and Settings\Marek\Ustawienia lokalne\Temp\TIP2D002.exe P2D002 S3 dump_wmimmc;dump_wmimmc;\??\D:\CABAL\CABAL Online (Europe)\GameGuard\dump_wmimmc.sys ************************************************************************** catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-08-15 11:37:19 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** Completion time: 2007-08-15 11:38:06 C:\ComboFix-quarantined-files.txt ... 2007-08-15 11:37 --- E O F ---

**Posty:** 18165 · przez **wojtas** 15 Sie 2007, 11:56

jesli nie laczysz sie przez proxy skasuj:

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local

nastepnie skasuj te dwa pliki:

C:\WINDOWS\system32\adssite-remove.exe
C:\WINDOWS\system32\gzmrot-uninst.exe

sciagnij: ATF_Cleaner

http://www.atribune.org/ccount/click.php?id=1
zaznacz
Windows Temp
Temporary internet files
i wcisnij EMPTY SELECTED

potem wklejasz do notatnika:

Windows Registry Editor Version 5.00

[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\adstart]

[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\{39-9A-AB-B8-ZN}]

w notatniku u góry>>>plik zapisz jako>>>Zmien rozszerzenie z TXT na Wszystkie pliki *.* >>> Zapisz pod nazwą FIX.REG

Klikasz dwa razy na powstały plik fix i dodajesz go do rejestru....

ten plik:

C:\WINDOWS\system32\SWCTL.DLL

przeskanuj tu i daj raporty:

http://virusscan.jotti.org/
http://www.virustotal.com/

potem nowe logi i raporty

**Posty:** 1846 · przez **kokos** 15 Sie 2007, 14:11

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.0 (BETA) Scan saved at 13:58, on 2007-08-15 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Eset\nod32kui.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\Program Files\Eset\nod32krn.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\PnkBstrA.exe C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Konnekt\konnekt.exe C:\WINDOWS\explorer.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\WINDOWS\system32\cmd.exe D:\hijackthis\HiJackThis_v2.exe C:\WINDOWS\system32\cmd.exe C:\WINDOWS\system32\cmd.exe C:\WINDOWS\system32\cscript.exe C:\WINDOWS\system32\cmd.exe R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O2 - BHO: IeCatch2 Class - {A5366673-E8CA-11D3-9CD9-0090271D075B} - C:\PROGRA~1\FlashGet\jccatch.dll O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\fgiebar.dll O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKCU\..\Run: [RocketDock] "C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe" O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user') O8 - Extra context menu item: Ściągnij przy pomocy FlashGet'a - C:\Program Files\FlashGet\jc_link.htm O8 - Extra context menu item: Ściągnij wszystko przy pomocy FlashGet'a - C:\Program Files\FlashGet\jc_all.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {CD995117-98E5-4169-9920-6C12D4C0B548} (HGPlugin9USA Class) - http://gamedownload.ijjimax.com/gamedownload/dist/hgstart/HGPlugin9USA.cab O22 - SharedTaskScheduler: Moduł wstępnego ładowania interfejsu Browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\System32\browseui.dll O22 - SharedTaskScheduler: Demon buforu kategorii składników - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\System32\browseui.dll O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe O23 - Service: PnkBstrB - Unknown owner - C:\WINDOWS\system32\PnkBstrB.exe O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe -- End of file - 4743 bytes

Kod: Zaznacz wszystko: ComboFix 07-08-14.4 - "Marek" 2007-08-15 13:58:22.2 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.213 [GMT 2:00] ((((((((((((((((((((((((( Files Created from 2007-07-15 to 2007-08-15 ))))))))))))))))))))))))))))))) 2007-08-15 11:34 51,200 --a------ C:\WINDOWS\nircmd.exe 2007-08-15 11:27 524,288 --ah----- C:\DOCUME~1\ADMINI~1\NTUSER.DAT 2007-08-15 11:27 <DIR> dr-h----- C:\DOCUME~1\ADMINI~1\Dane aplikacji 2007-08-15 11:27 <DIR> dr------- C:\DOCUME~1\ADMINI~1\Menu Start 2007-08-15 11:27 <DIR> d--h----- C:\DOCUME~1\ADMINI~1\Ustawienia lokalne 2007-08-15 11:27 <DIR> d--h----- C:\DOCUME~1\ADMINI~1\Szablony 2007-08-15 11:27 <DIR> d-------- C:\DOCUME~1\ADMINI~1\Ulubione 2007-08-15 11:27 <DIR> d-------- C:\DOCUME~1\ADMINI~1\Pulpit 2007-08-15 11:27 <DIR> d-------- C:\DOCUME~1\ADMINI~1\Moje dokumenty 2007-08-14 17:27 180,224 --a------ C:\WINDOWS\system32\nvudisp.exe 2007-08-14 17:27 <DIR> d-------- C:\WINDOWS\nview 2007-08-14 16:49 <DIR> d-------- C:\VundoFix Backups 2007-08-14 16:37 1,282 --a------ C:\WINDOWS\system32\tmp.reg 2007-08-14 16:36 53,248 --a------ C:\WINDOWS\system32\Process.exe 2007-08-14 16:36 51,200 --a------ C:\WINDOWS\system32\dumphive.exe 2007-08-14 16:36 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe 2007-08-06 18:38 20,640 --------- C:\WINDOWS\system32\drivers\PxHelp20.sys 2007-08-06 18:37 <DIR> d-------- C:\WINDOWS\RegisteredPackages 2007-08-06 18:33 <DIR> d-------- C:\Program Files\SHOUTcast 2007-08-06 18:28 <DIR> d-------- C:\Program Files\Winamp 2007-08-05 16:14 <DIR> d-------- C:\Program Files\PPStream 2007-08-05 16:14 <DIR> d-------- C:\DOCUME~1\Marek\DANEAP~1\ppstream 2007-08-05 16:08 <DIR> d-------- C:\DOCUME~1\Marek\DANEAP~1\SopCast 2007-08-05 16:07 <DIR> d-------- C:\Program Files\SopCast 2007-07-23 23:46 <DIR> d-------- C:\WINDOWS\system32\appmgmt 2007-07-23 11:03 <DIR> d-------- C:\WINDOWS\system32\Naughty America The Game - Screensaver dir 2007-07-20 02:12 <DIR> d-------- C:\Program Files\Fotosik Manager 2007-07-19 10:13 <DIR> d-------- C:\NVIDIA 2007-07-18 21:19 <DIR> d-------- C:\DOCUME~1\Marek\DANEAP~1\OpenOffice.org2 2007-07-18 21:17 <DIR> d-------- C:\Program Files\OpenOffice.org 2.1 (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) 2007-08-14 23:18 --------- d-------- C:\DOCUME~1\Marek\DANEAP~1\foobar2000 2007-08-08 13:12 --------- d-------- C:\Program Files\Deutsch Translator 2 2007-08-06 13:34 --------- d-------- C:\Program Files\FlashFXP 2007-07-29 20:38 --------- d-------- C:\Program Files\Gadu-Gadu 2007-07-29 09:56 --------- d-------- C:\DOCUME~1\Marek\DANEAP~1\Real 2007-07-23 23:53 --------- d-------- C:\Program Files\Common Files\Ahead 2007-07-23 23:41 --------- d-------- C:\DOCUME~1\Marek\DANEAP~1\Cream Software 2007-07-23 23:11 --------- d-------- C:\Program Files\FlashGet 2007-07-20 17:29 --------- d-------- C:\Program Files\Opera 2007-07-13 13:47 --------- d-------- C:\Program Files\Last.fm 2007-07-13 01:57 --------- d--h----- C:\Program Files\InstallShield Installation Information 2007-07-11 23:11 --------- d-------- C:\DOCUME~1\Marek\DANEAP~1\AdobeUM 2007-07-11 08:08 --------- d-------- C:\Program Files\Chico 2007-07-10 23:03 59 ---h----- C:\WINDOWS\system32\SWCTL.DLL 2007-07-10 01:07 --------- d-------- C:\DOCUME~1\Marek\DANEAP~1\Xfire 2007-07-10 01:03 --------- d---s---- C:\Program Files\Xfire 2007-07-02 15:35 --------- d-------- C:\Program Files\Ashampoo 2007-06-30 16:59 --------- d-------- C:\DOCUME~1\Marek\DANEAP~1\GanymedeNet 2007-06-30 16:37 --------- d-------- C:\Program Files\Ganymede 2007-06-28 21:32 99904 --a------ C:\WINDOWS\system32\PnkBstrB.exe 2007-06-28 16:51 --------- d-------- C:\Program Files\NAPI-PROJEKT 2007-06-21 23:04 22584 --a------ C:\WINDOWS\system32\drivers\PnkBstrK.sys 2007-06-21 16:50 --------- d-------- C:\Program Files\Movie Maker 2007-06-21 16:49 64713 --a------ C:\WINDOWS\BricoPackUninst.cmd 2007-06-21 16:49 6114 --a------ C:\WINDOWS\BricoPackFoldersDelete.cmd 2007-06-21 16:49 219648 --a------ C:\WINDOWS\system32\uxtheme.dll 2007-06-18 12:33 --------- d-------- C:\Program Files\%ramdrv%Image_Grabber_II 2007-06-16 19:49 --------- d-------- C:\DOCUME~1\Marek\DANEAP~1\LimeWire 2007-06-16 19:34 --------- d-------- C:\Program Files\BearShare 2007-06-16 18:26 --------- d-------- C:\Program Files\7-Zip 2007-06-16 18:26 --------- d-------- C:\DOCUME~1\Marek\DANEAP~1\Opera 2007-06-15 14:43 --------- d-------- C:\Program Files\English Translator 3 2007-06-13 20:08 63040 --a------ C:\WINDOWS\system32\PnkBstrA.exe 2007-06-09 00:26 4 --a------ C:\WINDOWS\system32\proc-220146841.bin 2007-06-02 13:23 108144 --a------ C:\WINDOWS\system32\CmdLineExt.dll 2007-05-25 12:25 2724 --a------ C:\WINDOWS\pchealth\HelpCtr\PackageStore\SkuStore.bin 2007-05-25 12:22 8972 --a------ C:\WINDOWS\pchealth\HelpCtr\Config\Cntstore.bin 2007-05-25 11:59 299392 --a------ C:\WINDOWS\system32\imon.dll 2007-05-25 11:50 0 -rahs---- C:\MSDOS.SYS 2007-05-25 11:50 0 -rahs---- C:\IO.SYS 2007-05-25 11:50 0 --a------ C:\CONFIG.SYS 2007-05-25 11:50 0 --a------ C:\AUTOEXEC.BAT ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "nod32kui"="C:\Program Files\Eset\nod32kui.exe" [2007-05-25 11:59] "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2005-08-27 01:31] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "RocketDock"="C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe" [2007-03-19 00:05] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system] "DisableClock"=0 (0x0) "NoDispCPL"=0 (0x0) [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] "NoSetFolders"=0 (0x0) "NoSetTaskbar"=0 (0x0) "LWA"=0 (0x0) "LWB"=0 (0x0) "LWC"=0 (0x0) "LWD"=0 (0x0) "LWE"=0 (0x0) "LWF"=0 (0x0) "LWG"=0 (0x0) "LWH"=0 (0x0) "LWI"=0 (0x0) "LWJ"=0 (0x0) "LWK"=0 (0x0) "LWL"=0 (0x0) "LWM"=0 (0x0) "LWN"=0 (0x0) "LWO"=0 (0x0) "LWP"=0 (0x0) "LWQ"=0 (0x0) "LWR"=0 (0x0) "LWS"=0 (0x0) "LWT"=0 (0x0) "LWU"=0 (0x0) "LWV"=0 (0x0) "LWW"=0 (0x0) "LWX"=0 (0x0) "LWY"=0 (0x0) "LWZ"=0 (0x0) [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Adobe Reader Speed Launch.lnk] path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Adobe Reader Speed Launch.lnk backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Last.fm Helper.lnk] path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Last.fm Helper.lnk backup=C:\WINDOWS\pss\Last.fm Helper.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Marek^Menu Start^Programy^Autostart^RocketDock.lnk] path=C:\Documents and Settings\Marek\Menu Start\Programy\Autostart\RocketDock.lnk backup=C:\WINDOWS\pss\RocketDock.lnkStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Marek^Menu Start^Programy^Autostart^TA_Start.lnk] path=C:\Documents and Settings\Marek\Menu Start\Programy\Autostart\TA_Start.lnk backup=C:\WINDOWS\pss\TA_Start.lnkStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BearShare] "C:\Program Files\BearShare\BearShare.exe" /pause [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033 [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb05.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Konnekt] "C:\Program Files\Konnekt\konnekt.exe" /autostart [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz] nwiz.exe /install [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched] C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe *Newly Created Service* - CATCHME ************************************************************************** catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-08-15 14:00:42 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** Completion time: 2007-08-15 14:02:03 C:\ComboFix-quarantined-files.txt ... 2007-08-15 14:01 C:\ComboFix2.txt ... 2007-08-15 11:38 --- E O F ---

Kod: Zaznacz wszystko: "Silent Runners.vbs", revision 52, http://www.silentrunners.org/ Operating System: Windows XP SP2 Output limited to non-default values, except where indicated by "{++}" Startup items buried in registry: --------------------------------- HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ {++} "RocketDock" = ""C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe"" [null data] HKLM\Software\Microsoft\Windows\CurrentVersion\Run\ {++} "nod32kui" = ""C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE" ["Eset "] "NvCplDaemon" = "RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup" [MS] HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\(Default) = (no title provided) -> {HKLM...CLSID} = "AcroIEHlprObj Class" \InProcServer32\(Default) = "C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll" ["Adobe Systems Incorporated"] {761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\(Default) = (no title provided) -> {HKLM...CLSID} = "SSVHelper Class" \InProcServer32\(Default) = "C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll" ["Sun Microsystems, Inc."] {A5366673-E8CA-11D3-9CD9-0090271D075B}\(Default) = (no title provided) -> {HKLM...CLSID} = "IeCatch2 Class" \InProcServer32\(Default) = "C:\PROGRA~1\FlashGet\jccatch.dll" ["Amaze Soft"] HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\ "{42071714-76d4-11d1-8b24-00a0c9068ff3}" = "Rozszerzenie CPL kadrowania wyświetlania" -> {HKLM...CLSID} = "Rozszerzenie CPL kadrowania wyświetlania" \InProcServer32\(Default) = "deskpan.dll" [file not found] "{88895560-9AA2-1069-930E-00AA0030EBC8}" = "Rozszerzenie ikony HyperTerminalu" -> {HKLM...CLSID} = "HyperTerminal Icon Ext" \InProcServer32\(Default) = "C:\WINDOWS\System32\hticons.dll" ["Hilgraeve, Inc."] "{B089FE88-FB52-11D3-BDF1-0050DA34150D}" = "NOD32 Context Menu Shell Extension" -> {HKLM...CLSID} = "NOD32 Context Menu Shell Extension" \InProcServer32\(Default) = "C:\Program Files\Eset\nodshex.dll" [null data] "{32020A01-506E-484D-A2A8-BE3CF17601C3}" = "AlcoholShellEx" -> {HKLM...CLSID} = "AlcoholShellEx" \InProcServer32\(Default) = "C:\PROGRA~1\ALCOHO~1\ALCOHO~1\AXShlEx.dll" ["Alcohol Soft Development Team"] "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" = "WinRAR shell extension" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] "{42042206-2D85-11D3-8CFF-005004838597}" = "Microsoft Office HTML Icon Handler" -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "C:\Program Files\Microsoft Office\Office12\msohevi.dll" [MS] "{993BE281-6695-4BA5-8A2A-7AACBFAAB69E}" = "Microsoft Office Metadata Handler" -> {HKLM...CLSID} = "Microsoft Office Metadata Handler" \InProcServer32\(Default) = "C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\msoshext.dll" [MS] "{C41662BB-1FA0-4CE0-8DC5-9B7F8279FF97}" = "Microsoft Office Thumbnail Handler" -> {HKLM...CLSID} = "Microsoft Office Thumbnail Handler" \InProcServer32\(Default) = "C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\msoshext.dll" [MS] "{13311DA7-1D24-40e5-AE07-7E3750F5DE3C}" = "Right Click Image Converter Extension" -> {HKLM...CLSID} = "Right Click Image Converter Extension" \InProcServer32\(Default) = "C:\Program Files\Kristanix\Right Click Image Converter\extRCIC.dll" [null data] "{23170F69-40C1-278A-1000-000100020000}" = "7-Zip Shell Extension" -> {HKLM...CLSID} = "7-Zip Shell Extension" \InProcServer32\(Default) = "C:\Program Files\7-Zip\7-zip.dll" ["Igor Pavlov"] "{ABC70703-32AF-11d4-90C4-D483A70F4825}" = "CMenuExtender" -> {HKLM...CLSID} = "CMenuExtender" \InProcServer32\(Default) = "C:\WINDOWS\BricoPacks\Vista Inspirat 2\iColorFolder\CMExt.dll" ["Revenger inc."] "{D7B7A5AE-9D19-4F9E-9C6F-46C82D22D71C}" = "Wyślij na Fotosik.pl" -> {HKLM...CLSID} = "Wyślij na Fotosik.pl" \InProcServer32\(Default) = "C:\PROGRA~1\FOTOSI~1\FOTOSI~1.DLL" [null data] "{A70C977A-BF00-412C-90B7-034C51DA2439}" = "NvCpl DesktopContext Class" -> {HKLM...CLSID} = "DesktopContext Class" \InProcServer32\(Default) = "C:\WINDOWS\system32\nvcpl.dll" ["NVIDIA Corporation"] "{FFB699E0-306A-11d3-8BD1-00104B6F7516}" = "Play on my TV helper" -> {HKLM...CLSID} = "NVIDIA CPL Extension" \InProcServer32\(Default) = "C:\WINDOWS\system32\nvcpl.dll" ["NVIDIA Corporation"] "{1CDB2949-8F65-4355-8456-263E7C208A5D}" = "Desktop Explorer" -> {HKLM...CLSID} = "Desktop Explorer" \InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"] "{1E9B04FB-F9E5-4718-997B-B8DA88302A47}" = "Desktop Explorer Menu" -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"] "{1E9B04FB-F9E5-4718-997B-B8DA88302A48}" = "nView Desktop Context Menu" -> {HKLM...CLSID} = "nView Desktop Context Menu" \InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"] HKLM\Software\Classes\PROTOCOLS\Filter\ <<!>> text/xml\CLSID = "{807563E5-5146-11D5-A672-00B0D022E945}" -> {HKLM...CLSID} = "Microsoft Office InfoPath XML Mime Filter" \InProcServer32\(Default) = "C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL" [MS] HKLM\Software\Classes\Folder\shellex\ColumnHandlers\ {F9DB5320-233E-11D1-9F84-707F02C10627}\(Default) = "PDF Column Info" -> {HKLM...CLSID} = "PDF Shell Extension" \InProcServer32\(Default) = "C:\Program Files\Adobe\Acrobat 7.0\ActiveX\PDFShell.dll" ["Adobe Systems, Inc."] HKLM\Software\Classes\*\shellex\ContextMenuHandlers\ 7-Zip\(Default) = "{23170F69-40C1-278A-1000-000100020000}" -> {HKLM...CLSID} = "7-Zip Shell Extension" \InProcServer32\(Default) = "C:\Program Files\7-Zip\7-zip.dll" ["Igor Pavlov"] NOD32 Context Menu Shell Extension\(Default) = "{B089FE88-FB52-11D3-BDF1-0050DA34150D}" -> {HKLM...CLSID} = "NOD32 Context Menu Shell Extension" \InProcServer32\(Default) = "C:\Program Files\Eset\nodshex.dll" [null data] Right Click Image Converter\(Default) = "{13311DA7-1D24-40e5-AE07-7E3750F5DE3C}" -> {HKLM...CLSID} = "Right Click Image Converter Extension" \InProcServer32\(Default) = "C:\Program Files\Kristanix\Right Click Image Converter\extRCIC.dll" [null data] WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\ 7-Zip\(Default) = "{23170F69-40C1-278A-1000-000100020000}" -> {HKLM...CLSID} = "7-Zip Shell Extension" \InProcServer32\(Default) = "C:\Program Files\7-Zip\7-zip.dll" ["Igor Pavlov"] CMenuExtender\(Default) = "{ABC70703-32AF-11d4-90C4-D483A70F4825}" -> {HKLM...CLSID} = "CMenuExtender" \InProcServer32\(Default) = "C:\WINDOWS\BricoPacks\Vista Inspirat 2\iColorFolder\CMExt.dll" ["Revenger inc."] WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] {D7B7A5AE-9D19-4F9E-9C6F-46C82D22D71C}\(Default) = "{D7B7A5AE-9D19-4F9E-9C6F-46C82D22D71C}" -> {HKLM...CLSID} = "Wyślij na Fotosik.pl" \InProcServer32\(Default) = "C:\PROGRA~1\FOTOSI~1\FOTOSI~1.DLL" [null data] HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\ NOD32 Context Menu Shell Extension\(Default) = "{B089FE88-FB52-11D3-BDF1-0050DA34150D}" -> {HKLM...CLSID} = "NOD32 Context Menu Shell Extension" \InProcServer32\(Default) = "C:\Program Files\Eset\nodshex.dll" [null data] WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] Group Policies {GPedit.msc branch and setting}: ----------------------------------------------- Note: detected settings may not have any effect. HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\ "NoSetFolders" = (REG_DWORD) hex:0x00000000 {unrecognized setting} "NoSetTaskbar" = (REG_DWORD) hex:0x00000000 {User Configuration|Administrative Templates|Start Menu and Taskbar| Prevent changes to Taskbar and Start Menu Settings} "NoSaveSettings" = (REG_DWORD) hex:0x00000000 {User Configuration|Administrative Templates|Desktop| Don't save settings at exit} "LWA" = (REG_DWORD) hex:0x00000000 {unrecognized setting} "LWB" = (REG_DWORD) hex:0x00000000 {unrecognized setting} "LWC" = (REG_DWORD) hex:0x00000000 {unrecognized setting} "LWD" = (REG_DWORD) hex:0x00000000 {unrecognized setting} "LWE" = (REG_DWORD) hex:0x00000000 {unrecognized setting} "LWF" = (REG_DWORD) hex:0x00000000 {unrecognized setting} "LWG" = (REG_DWORD) hex:0x00000000 {unrecognized setting} "LWH" = (REG_DWORD) hex:0x00000000 {unrecognized setting} "LWI" = (REG_DWORD) hex:0x00000000 {unrecognized setting} "LWJ" = (REG_DWORD) hex:0x00000000 {unrecognized setting} "LWK" = (REG_DWORD) hex:0x00000000 {unrecognized setting} "LWL" = (REG_DWORD) hex:0x00000000 {unrecognized setting} "LWM" = (REG_DWORD) hex:0x00000000 {unrecognized setting} "LWN" = (REG_DWORD) hex:0x00000000 {unrecognized setting} "LWO" = (REG_DWORD) hex:0x00000000 {unrecognized setting} "LWP" = (REG_DWORD) hex:0x00000000 {unrecognized setting} "LWQ" = (REG_DWORD) hex:0x00000000 {unrecognized setting} "LWR" = (REG_DWORD) hex:0x00000000 {unrecognized setting} "LWS" = (REG_DWORD) hex:0x00000000 {unrecognized setting} "LWT" = (REG_DWORD) hex:0x00000000 {unrecognized setting} "LWU" = (REG_DWORD) hex:0x00000000 {unrecognized setting} "LWV" = (REG_DWORD) hex:0x00000000 {unrecognized setting} "LWW" = (REG_DWORD) hex:0x00000000 {unrecognized setting} "LWX" = (REG_DWORD) hex:0x00000000 {unrecognized setting} "LWY" = (REG_DWORD) hex:0x00000000 {unrecognized setting} "LWZ" = (REG_DWORD) hex:0x00000000 {unrecognized setting} "NoDrives" = (REG_DWORD) hex:0x00000000 {unrecognized setting} HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System\ "DisableClock" = (REG_DWORD) hex:0x00000000 {unrecognized setting} "NoDispCPL" = (REG_DWORD) hex:0x00000000 {User Configuration|Administrative Templates|Control Panel|Display| Remove Display in Control Panel} HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\ "shutdownwithoutlogon" = (REG_DWORD) hex:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| Shutdown: Allow system to be shut down without having to log on} "undockwithoutlogon" = (REG_DWORD) hex:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| Devices: Allow undock without having to log on} Active Desktop and Wallpaper: ----------------------------- Active Desktop may be disabled at this entry: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState Displayed if Active Desktop enabled and wallpaper not set by Group Policy: HKCU\Software\Microsoft\Internet Explorer\Desktop\General\ "Wallpaper" = "C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp" Displayed if Active Desktop disabled and wallpaper not set by Group Policy: HKCU\Control Panel\Desktop\ "Wallpaper" = "C:\Documents and Settings\Marek\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp" Winsock2 Service Provider DLLs: ------------------------------- Namespace Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++} 000000000001\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS] 000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS] 000000000003\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS] 000000000004\LibraryPath = "C:\Program Files\Bonjour\mdnsNSP.dll" ["Apple Computer, Inc."] Transport Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++} 0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range: C:\WINDOWS\System32\imon.dll ["Eset "], 01 - 05, 19 %SystemRoot%\system32\mswsock.dll [MS], 06 - 08, 11 - 18 %SystemRoot%\system32\rsvpsp.dll [MS], 09 - 10 Toolbars, Explorer Bars, Extensions: ------------------------------------ Toolbars HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\ "{D3DEE18F-DB64-4BEB-9FF1-E1F0A5033E4A}" -> {HKLM...CLSID} = "BearShare MediaBar" \InProcServer32\(Default) = "C:\Program Files\BearShare applications\BearShare MediaBar\MediaBar.dll" [file not found] HKLM\Software\Microsoft\Internet Explorer\Toolbar\ "{E0E899AB-F487-11D5-8D29-0050BA6940E3}" = "FlashGet Bar" -> {HKLM...CLSID} = "FlashGet Bar" \InProcServer32\(Default) = "C:\PROGRA~1\FlashGet\fgiebar.dll" ["Amaze Soft"] Explorer Bars HKLM\Software\Microsoft\Internet Explorer\Explorer Bars\ HKLM\Software\Classes\CLSID\{FF059E31-CC5A-4E2E-BF3B-96E929D65503}\(Default) = "&Poszukaj" Implemented Categories\{00021493-0000-0000-C000-000000000046}\ [vertical bar] InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL" [MS] Extensions (Tools menu items, main toolbar menu buttons) HKLM\Software\Microsoft\Internet Explorer\Extensions\ {08B0E5C0-4FCB-11CF-AAA5-00401C608501}\ "MenuText" = "Sun Java Console" "CLSIDExtension" = "{CAFEEFAC-0016-0000-0001-ABCDEFFEDCBC}" -> {HKCU...CLSID} = "Java Plug-in 1.6.0_01" \InProcServer32\(Default) = "C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll" ["Sun Microsystems, Inc."] -> {HKLM...CLSID} = "Java Plug-in 1.6.0_01" \InProcServer32\(Default) = "C:\Program Files\Java\jre1.6.0_01\bin\npjpi160_01.dll" ["Sun Microsystems, Inc."] {92780B25-18CC-41C8-B9BE-3C9C571A8263}\ "ButtonText" = "Research" {D6E814A0-E0C5-11D4-8D29-0050BA6940E3}\ "ButtonText" = "FlashGet" "MenuText" = "&FlashGet" "Exec" = "C:\PROGRA~1\FlashGet\flashget.exe" ["Amaze Soft"] {FB5F1910-F110-11D2-BB9E-00C04F795683}\ "ButtonText" = "Messenger" "MenuText" = "Windows Messenger" "Exec" = "C:\Program Files\Messenger\msmsgs.exe" [MS] Running Services (Display Name, Service Name, Path {Service DLL}): ------------------------------------------------------------------ ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762##, Bonjour Service, ""C:\Program Files\Bonjour\mDNSResponder.exe"" ["Apple Computer, Inc."] NOD32 Kernel Service, NOD32krn, ""C:\Program Files\Eset\nod32krn.exe"" ["Eset "] NVIDIA Display Driver Service, NVSvc, "C:\WINDOWS\system32\nvsvc32.exe" ["NVIDIA Corporation"] PnkBstrA, PnkBstrA, "C:\WINDOWS\system32\PnkBstrA.exe" [null data] StarWind iSCSI Service, StarWindService, "C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe" ["Rocket Division Software"] Windows User Mode Driver Framework, UMWdf, "C:\WINDOWS\system32\wdfmgr.exe" [MS] Print Monitors: --------------- HKLM\System\CurrentControlSet\Control\Print\Monitors\ hpzlnt05\Driver = "hpzlnt05.dll" ["HP"] ---------- (launch time: 2007-08-15 14:02:10) <<!>>: Suspicious data at a malware launch point. + This report excludes default entries except where indicated. + To see *everywhere* the script checks and *everything* it finds, launch it from a command prompt or a shortcut with the -all parameter. + The search for DESKTOP.INI DLL launch points on all local fixed drives took 91 seconds. ---------- (total run time: 190 seconds)

**Posty:** 18165 · przez **wojtas** 15 Sie 2007, 15:20

skasuj i powinno byc ok:

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank

Autor postu otrzymał pochwałę

**Posty:** 1846 · przez **kokos** 15 Sie 2007, 15:39

Oki, dzięki wielkie za pomoc

proszę o sprwadzenie loga...

Proszę o sprwadzenie loga...

Kto jest na forum