prosze o szybka pomoc - system sie sypie

**Posty:** 756 · przez **piotrp_1990** 13 Sie 2007, 18:51

od jakiegoś czasu komp wiesza sie przy odpalaniu plików (mp3 .itp) mozzila sie sypie i znikly zakladki podejrzewam jakiegoś wira czy coś...

oto log:

hijack this

Kod: Zaznacz wszystko: Logfile of HijackThis v1.99.1 Scan saved at 18:32:35, on 2006-08-13 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\csrss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe F:\Moje programy\Avast!\aswUpdSv.exe F:\Moje programy\Avast!\ashServ.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\RTHDCPL.EXE C:\Program Files\Creative\SBAudigy2\Surround Mixer\CTSysVol.exe C:\Program Files\Creative\SBAudigy2\DVDAudio\CTDVDDet.EXE C:\WINDOWS\system32\CTHELPER.EXE C:\Program Files\SyncroSoft\Pos\H2O\cledx.exe C:\WINDOWS\system32\CTsvcCDA.exe C:\WINDOWS\system32\nvsvc32.exe F:\MOJEPR~1\Avast!\ashDisp.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\wdfmgr.exe C:\WINDOWS\system32\MsPMSPSv.exe F:\Moje programy\Avast!\ashWebSv.exe F:\Moje programy\Avast!\ashMaiSv.exe C:\WINDOWS\System32\alg.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe C:\Program Files\D-Link AirPlus\AirPlus.exe C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe C:\Program Files\Mozilla Firefox\firefox.exe F:\Moje programy\Cool Edit Pro2\coolpro2.exe C:\Documents and Settings\Damiano\Pulpit\syfek\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - F:\Moje programy\Adobe Rader 6.0\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {140BD8E3-C167-11D4-B4A3-080000180323} - (no file) O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - F:\Moje programy\BitComet\tools\BitCometBHO.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\SBAudigy2\Surround Mixer\CTSysVol.exe /r O4 - HKLM\..\Run: [CTDVDDET] C:\Program Files\Creative\SBAudigy2\DVDAudio\CTDVDDet.EXE O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE O4 - HKLM\..\Run: [SBDrvDet] C:\Program Files\Creative\SB Drive Det\SBDrvDet.exe /r O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE O4 - HKLM\..\Run: [H2O] C:\Program Files\SyncroSoft\Pos\H2O\cledx.exe O4 - HKLM\..\Run: [avast!] F:\MOJEPR~1\Avast!\ashDisp.exe O4 - HKLM\..\Run: [vsc32cnf.exe] f:\fruity loops\vst, vsti, dx, dxi\edirol vsc\vsc32cnf.exe O4 - HKLM\..\Run: [vscvol.exe] f:\fruity loops\vst, vsti, dx, dxi\edirol vsc\vscvol.exe O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k O4 - HKLM\..\Run: [BearShare] "F:\Moje programy\Bear Share\BearShare.exe" /pause O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe O4 - Global Startup: D-Link AirPlus.lnk = ? O8 - Extra context menu item: Download all links using BitComet - res://F:\Moje programy\BitComet\BitComet.exe/AddAllLink.htm O8 - Extra context menu item: Download all videos using BitComet - res://F:\Moje programy\BitComet\BitComet.exe/AddVideo.htm O8 - Extra context menu item: Download link using &BitComet - res://F:\Moje programy\BitComet\BitComet.exe/AddLink.htm O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://F:\MOJEPR~1\OFFICE~1\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - F:\MOJEPR~1\OFFICE~1\OFFICE11\REFIEBAR.DLL O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra button: Wybierz kierunek tłumaczenia - {CCCE5D70-9AA2-40F1-9C6B-12A255F08500} - F:\Moje programy\Translatica 4\Translatica Integration\bin\win\int\browser\iepolengextension.dll (HKCU) O9 - Extra 'Tools' menuitem: Wybierz kierunek tłumaczenia - {CCCE5D70-9AA2-40F1-9C6B-12A255F08500} - F:\Moje programy\Translatica 4\Translatica Integration\bin\win\int\browser\iepolengextension.dll (HKCU) O9 - Extra button: Tłumacz - {CCCE5D71-9AA2-40F1-9C6B-12A255F08500} - F:\Moje programy\Translatica 4\Translatica Integration\bin\win\int\browser\iepolengextension.dll (HKCU) O9 - Extra 'Tools' menuitem: Tłumacz - {CCCE5D71-9AA2-40F1-9C6B-12A255F08500} - F:\Moje programy\Translatica 4\Translatica Integration\bin\win\int\browser\iepolengextension.dll (HKCU) O9 - Extra button: Zachowaj przetłumaczoną stronę - {CCCE5D72-9AA2-40F1-9C6B-12A255F08500} - F:\Moje programy\Translatica 4\Translatica Integration\bin\win\int\browser\iepolengextension.dll (HKCU) O9 - Extra 'Tools' menuitem: Zachowaj przetłumaczoną stronę - {CCCE5D72-9AA2-40F1-9C6B-12A255F08500} - F:\Moje programy\Translatica 4\Translatica Integration\bin\win\int\browser\iepolengextension.dll (HKCU) O9 - Extra button: Opcje - {CCCE5D73-9AA2-40F1-9C6B-12A255F08500} - F:\Moje programy\Translatica 4\Translatica Integration\bin\win\int\browser\iepolengextension.dll (HKCU) O9 - Extra 'Tools' menuitem: Opcje - {CCCE5D73-9AA2-40F1-9C6B-12A255F08500} - F:\Moje programy\Translatica 4\Translatica Integration\bin\win\int\browser\iepolengextension.dll (HKCU) O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://downloads.ewido.net/ewidoOnlineScan.cab O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - F:\Moje programy\Avast!\aswUpdSv.exe O23 - Service: avast! Antivirus - ALWIL Software - F:\Moje programy\Avast!\ashServ.exe O23 - Service: avast! Mail Scanner - Unknown owner - F:\Moje programy\Avast!\ashMaiSv.exe" /service (file missing) O23 - Service: avast! Web Scanner - Unknown owner - F:\Moje programy\Avast!\ashWebSv.exe" /service (file missing) O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: NBService - Nero AG - F:\Moje programy\Nero 7\Nero BackItUp\NBService.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)

Silent Runners

Kod: Zaznacz wszystko: "Silent Runners.vbs", revision 52, http://www.silentrunners.org/ Operating System: Windows XP SP2 Output limited to non-default values, except where indicated by "{++}" Startup items buried in registry: --------------------------------- HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ {++} "CTFMON.EXE" = "C:\WINDOWS\system32\ctfmon.exe" [MS] "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}" = ""C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"" ["Nero AG"] "swg" = "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" ["Google Inc."] HKLM\Software\Microsoft\Windows\CurrentVersion\Run\ {++} "RTHDCPL" = "RTHDCPL.EXE" ["Realtek Semiconductor Corp."] "Alcmtr" = "ALCMTR.EXE" ["Realtek Semiconductor Corp."] "NvCplDaemon" = "RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup" [MS] "nwiz" = "nwiz.exe /install" ["NVIDIA Corporation"] "NvMediaCenter" = "RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit" [MS] "CTSysVol" = "C:\Program Files\Creative\SBAudigy2\Surround Mixer\CTSysVol.exe /r" ["Creative Technology Ltd"] "CTDVDDET" = "C:\Program Files\Creative\SBAudigy2\DVDAudio\CTDVDDet.EXE" ["Creative Technology Ltd"] "CTHelper" = "CTHELPER.EXE" ["Creative Technology Ltd"] "SBDrvDet" = "C:\Program Files\Creative\SB Drive Det\SBDrvDet.exe /r" ["Creative Technology Ltd"] "UpdReg" = "C:\WINDOWS\UpdReg.EXE" ["Creative Technology Ltd."] "H2O" = "C:\Program Files\SyncroSoft\Pos\H2O\cledx.exe" ["Team H2O"] "avast!" = "F:\MOJEPR~1\Avast!\ashDisp.exe" ["ALWIL Software"] "vsc32cnf.exe" = "f:\fruity loops\vst, vsti, dx, dxi\edirol vsc\vsc32cnf.exe" ["Roland"] "vscvol.exe" = "f:\fruity loops\vst, vsti, dx, dxi\edirol vsc\vscvol.exe" ["Roland"] "NeroCheck" = "C:\WINDOWS\system32\NeroCheck.exe" ["Ahead Software Gmbh"] "NWEReboot" = "(empty string)" [file not found] "NeroFilterCheck" = "C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" ["Nero AG"] "KernelFaultCheck" = "C:\WINDOWS\system32\dumprep 0 -k" "BearShare" = ""F:\Moje programy\Bear Share\BearShare.exe" /pause" ["Free Peers, Inc."] HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\(Default) = (no title provided) -> {HKLM...CLSID} = "AcroIEHlprObj Class" \InProcServer32\(Default) = "F:\Moje programy\Adobe Rader 6.0\Reader\ActiveX\AcroIEHelper.dll" ["Adobe Systems Incorporated"] {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60}\(Default) = "BitComet ClickCapture" -> {HKLM...CLSID} = "BitComet Helper" \InProcServer32\(Default) = "F:\Moje programy\BitComet\tools\BitCometBHO.dll" ["BitComet"] {AA58ED58-01DD-4d91-8333-CF10577473F7}\(Default) = (no title provided) -> {HKLM...CLSID} = "Google Toolbar Helper" \InProcServer32\(Default) = "c:\program files\google\googletoolbar1.dll" ["Google Inc."] {AF69DE43-7D58-4638-B6FA-CE66B5AD205D}\(Default) = (no title provided) -> {HKLM...CLSID} = "Google Toolbar Notifier BHO" \InProcServer32\(Default) = "C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll" ["Google Inc."] HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\ "{42071714-76d4-11d1-8b24-00a0c9068ff3}" = "Rozszerzenie CPL kadrowania wyświetlania" -> {HKLM...CLSID} = "Rozszerzenie CPL kadrowania wyświetlania" \InProcServer32\(Default) = "deskpan.dll" [file not found] "{88895560-9AA2-1069-930E-00AA0030EBC8}" = "Rozszerzenie ikony HyperTerminalu" -> {HKLM...CLSID} = "HyperTerminal Icon Ext" \InProcServer32\(Default) = "C:\WINDOWS\system32\hticons.dll" ["Hilgraeve, Inc."] "{A70C977A-BF00-412C-90B7-034C51DA2439}" = "NvCpl DesktopContext Class" -> {HKLM...CLSID} = "DesktopContext Class" \InProcServer32\(Default) = "C:\WINDOWS\system32\nvcpl.dll" ["NVIDIA Corporation"] "{FFB699E0-306A-11d3-8BD1-00104B6F7516}" = "Play on my TV helper" -> {HKLM...CLSID} = "NVIDIA CPL Extension" \InProcServer32\(Default) = "C:\WINDOWS\system32\nvcpl.dll" ["NVIDIA Corporation"] "{1CDB2949-8F65-4355-8456-263E7C208A5D}" = "Desktop Explorer" -> {HKLM...CLSID} = "Desktop Explorer" \InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"] "{1E9B04FB-F9E5-4718-997B-B8DA88302A47}" = "Desktop Explorer Menu" -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"] "{1E9B04FB-F9E5-4718-997B-B8DA88302A48}" = "nView Desktop Context Menu" -> {HKLM...CLSID} = "nView Desktop Context Menu" \InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"] "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" = "WinRAR shell extension" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "F:\Moje programy\WinRAR\rarext.dll" [null data] "{00020D75-0000-0000-C000-000000000046}" = "Microsoft Office Outlook Desktop Icon Handler" -> {HKLM...CLSID} = "Microsoft Office Outlook" \InProcServer32\(Default) = "F:\MOJEPR~1\OFFICE~1\OFFICE11\MLSHEXT.DLL" [MS] "{0006F045-0000-0000-C000-000000000046}" = "Microsoft Office Outlook Custom Icon Handler" -> {HKLM...CLSID} = "Rozszerzenie ikon plików programu Outlook" \InProcServer32\(Default) = "F:\MOJEPR~1\OFFICE~1\OFFICE11\OLKFSTUB.DLL" [MS] "{42042206-2D85-11D3-8CFF-005004838597}" = "Microsoft Office HTML Icon Handler" -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "F:\Moje programy\Office 2003\OFFICE11\msohev.dll" [MS] "{472083B0-C522-11CF-8763-00608CC02F24}" = "avast" -> {HKLM...CLSID} = "avast" \InProcServer32\(Default) = "F:\Moje programy\Avast!\ashShell.dll" ["ALWIL Software"] HKLM\Software\Classes\PROTOCOLS\Filter\ <<!>> text/xml\CLSID = "{807553E5-5146-11D5-A672-00B0D022E945}" -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL" [MS] HKLM\Software\Classes\*\shellex\ContextMenuHandlers\ avast\(Default) = "{472083B0-C522-11CF-8763-00608CC02F24}" -> {HKLM...CLSID} = "avast" \InProcServer32\(Default) = "F:\Moje programy\Avast!\ashShell.dll" ["ALWIL Software"] WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "F:\Moje programy\WinRAR\rarext.dll" [null data] HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\ WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "F:\Moje programy\WinRAR\rarext.dll" [null data] HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\ avast\(Default) = "{472083B0-C522-11CF-8763-00608CC02F24}" -> {HKLM...CLSID} = "avast" \InProcServer32\(Default) = "F:\Moje programy\Avast!\ashShell.dll" ["ALWIL Software"] WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "F:\Moje programy\WinRAR\rarext.dll" [null data] Group Policies {GPedit.msc branch and setting}: ----------------------------------------------- Note: detected settings may not have any effect. HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\ "shutdownwithoutlogon" = (REG_DWORD) hex:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| Shutdown: Allow system to be shut down without having to log on} "undockwithoutlogon" = (REG_DWORD) hex:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| Devices: Allow undock without having to log on} Active Desktop and Wallpaper: ----------------------------- Active Desktop may be disabled at this entry: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState Displayed if Active Desktop enabled and wallpaper not set by Group Policy: HKCU\Software\Microsoft\Internet Explorer\Desktop\General\ "Wallpaper" = "C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp" Displayed if Active Desktop disabled and wallpaper not set by Group Policy: HKCU\Control Panel\Desktop\ "Wallpaper" = "C:\Documents and Settings\Damiano\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp" Enabled Screen Saver: --------------------- HKCU\Control Panel\Desktop\ "SCRNSAVE.EXE" = "C:\WINDOWS\system32\logon.scr" [MS] Startup items in "Damiano" & "All Users" startup folders: --------------------------------------------------------- C:\Documents and Settings\All Users\Menu Start\Programy\Autostart "D-Link AirPlus" -> shortcut to: "C:\Program Files\D-Link AirPlus\AirPlus.exe" ["D-Link"] Winsock2 Service Provider DLLs: ------------------------------- Namespace Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++} 000000000001\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS] 000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS] 000000000003\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS] Transport Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++} 0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range: %SystemRoot%\system32\mswsock.dll [MS], 01 - 03, 06 - 13 %SystemRoot%\system32\rsvpsp.dll [MS], 04 - 05 Toolbars, Explorer Bars, Extensions: ------------------------------------ Toolbars HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\ "{2318C2B1-4965-11D4-9B18-009027A5CD4F}" -> {HKLM...CLSID} = "&Google" \InProcServer32\(Default) = "c:\program files\google\googletoolbar1.dll" ["Google Inc."] HKLM\Software\Microsoft\Internet Explorer\Toolbar\ "{2318C2B1-4965-11D4-9B18-009027A5CD4F}" = (no title provided) -> {HKLM...CLSID} = "&Google" \InProcServer32\(Default) = "c:\program files\google\googletoolbar1.dll" ["Google Inc."] Explorer Bars HKLM\Software\Microsoft\Internet Explorer\Explorer Bars\ HKLM\Software\Classes\CLSID\{FF059E31-CC5A-4E2E-BF3B-96E929D65503}\(Default) = "&Badanie" Implemented Categories\{00021493-0000-0000-C000-000000000046}\ [vertical bar] InProcServer32\(Default) = "F:\MOJEPR~1\OFFICE~1\OFFICE11\REFIEBAR.DLL" [MS] Extensions (Tools menu items, main toolbar menu buttons) HKCU\Software\Microsoft\Internet Explorer\Extensions\ {CCCE5D70-9AA2-40F1-9C6B-12A255F08500}\ "ButtonText" = "Wybierz kierunek tłumaczenia" "MenuText" = "Wybierz kierunek tłumaczenia" "CLSIDExtension" = "{CC4371F0-D2F6-11D7-BDC4-00605209B788}" -> {HKCU...CLSID} = (no title provided) \InProcServer32\(Default) = "F:\Moje programy\Translatica 4\Translatica Integration\bin\win\int\browser\iepolengextension.dll" ["POLENG"] {CCCE5D71-9AA2-40F1-9C6B-12A255F08500}\ "ButtonText" = "Tłumacz" "MenuText" = "Tłumacz" "CLSIDExtension" = "{CC4371F1-D2F6-11D7-BDC4-00605209B788}" -> {HKCU...CLSID} = (no title provided) \InProcServer32\(Default) = "F:\Moje programy\Translatica 4\Translatica Integration\bin\win\int\browser\iepolengextension.dll" ["POLENG"] {CCCE5D72-9AA2-40F1-9C6B-12A255F08500}\ "ButtonText" = "Zachowaj przetłumaczoną stronę" "MenuText" = "Zachowaj przetłumaczoną stronę" "CLSIDExtension" = "{CC4371F2-D2F6-11D7-BDC4-00605209B788}" -> {HKCU...CLSID} = (no title provided) \InProcServer32\(Default) = "F:\Moje programy\Translatica 4\Translatica Integration\bin\win\int\browser\iepolengextension.dll" ["POLENG"] {CCCE5D73-9AA2-40F1-9C6B-12A255F08500}\ "ButtonText" = "Opcje" "MenuText" = "Opcje" "CLSIDExtension" = "{CC4371F3-D2F6-11D7-BDC4-00605209B788}" -> {HKCU...CLSID} = (no title provided) \InProcServer32\(Default) = "F:\Moje programy\Translatica 4\Translatica Integration\bin\win\int\browser\iepolengextension.dll" ["POLENG"] HKLM\Software\Microsoft\Internet Explorer\Extensions\ {92780B25-18CC-41C8-B9BE-3C9C571A8263}\ "ButtonText" = "Badanie" {FB5F1910-F110-11D2-BB9E-00C04F795683}\ "ButtonText" = "Messenger" "MenuText" = "Windows Messenger" "Exec" = "C:\Program Files\Messenger\msmsgs.exe" [MS] Running Services (Display Name, Service Name, Path {Service DLL}): ------------------------------------------------------------------ avast! Antivirus, avast! Antivirus, ""F:\Moje programy\Avast!\ashServ.exe"" ["ALWIL Software"] avast! iAVS4 Control Service, aswUpdSv, ""F:\Moje programy\Avast!\aswUpdSv.exe"" ["ALWIL Software"] avast! Mail Scanner, avast! Mail Scanner, ""F:\Moje programy\Avast!\ashMaiSv.exe" /service" ["ALWIL Software"] avast! Web Scanner, avast! Web Scanner, ""F:\Moje programy\Avast!\ashWebSv.exe" /service" ["ALWIL Software"] Creative Service for CDROM Access, Creative Service for CDROM Access, "C:\WINDOWS\system32\CTsvcCDA.exe" ["Creative Technology Ltd"] NVIDIA Display Driver Service, NVSvc, "C:\WINDOWS\system32\nvsvc32.exe" ["NVIDIA Corporation"] Windows User Mode Driver Framework, UMWdf, "C:\WINDOWS\system32\wdfmgr.exe" [MS] WMDM PMSP Service, WMDM PMSP Service, "C:\WINDOWS\system32\MsPMSPSv.exe" [MS] Print Monitors: --------------- HKLM\System\CurrentControlSet\Control\Print\Monitors\ Microsoft Document Imaging Writer Monitor\Driver = "mdimon.dll" [MS] ---------- (launch time: 2006-08-13 18:33:20) <<!>>: Suspicious data at a malware launch point. + This report excludes default entries except where indicated. + To see *everywhere* the script checks and *everything* it finds, launch it from a command prompt or a shortcut with the -all parameter. + To search all directories of local fixed drives for DESKTOP.INI DLL launch points, use the -supp parameter or answer "No" at the first message box and "Yes" at the second message box. ---------- (total run time: 36 seconds, including 2 seconds for message boxes)

z gory dzieki

**Posty:** 3854 · przez **Dzi@dek** 13 Sie 2007, 18:58

O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE

W awaryjnym po wyłączeniu przywracania systemu do usunięcia wpis w HJ + plik z dysku.

**Posty:** 756 · przez **piotrp_1990** 13 Sie 2007, 19:18

HJ

Kod: Zaznacz wszystko: Logfile of HijackThis v1.99.1 Scan saved at 19:09:50, on 2006-08-13 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe F:\Moje programy\Avast!\aswUpdSv.exe F:\Moje programy\Avast!\ashServ.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\RTHDCPL.EXE C:\Program Files\Creative\SBAudigy2\Surround Mixer\CTSysVol.exe C:\Program Files\Creative\SBAudigy2\DVDAudio\CTDVDDet.EXE C:\WINDOWS\system32\CTsvcCDA.exe C:\WINDOWS\system32\CTHELPER.EXE C:\WINDOWS\system32\nvsvc32.exe C:\Program Files\SyncroSoft\Pos\H2O\cledx.exe C:\WINDOWS\system32\svchost.exe F:\MOJEPR~1\Avast!\ashDisp.exe C:\WINDOWS\system32\MsPMSPSv.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe C:\Program Files\D-Link AirPlus\AirPlus.exe C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe F:\Moje programy\Avast!\ashMaiSv.exe F:\Moje programy\Avast!\ashWebSv.exe C:\WINDOWS\system32\wuauclt.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Documents and Settings\Damiano\Pulpit\syfek\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - F:\Moje programy\Adobe Rader 6.0\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {140BD8E3-C167-11D4-B4A3-080000180323} - (no file) O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - F:\Moje programy\BitComet\tools\BitCometBHO.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\SBAudigy2\Surround Mixer\CTSysVol.exe /r O4 - HKLM\..\Run: [CTDVDDET] C:\Program Files\Creative\SBAudigy2\DVDAudio\CTDVDDet.EXE O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE O4 - HKLM\..\Run: [SBDrvDet] C:\Program Files\Creative\SB Drive Det\SBDrvDet.exe /r O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE O4 - HKLM\..\Run: [H2O] C:\Program Files\SyncroSoft\Pos\H2O\cledx.exe O4 - HKLM\..\Run: [avast!] F:\MOJEPR~1\Avast!\ashDisp.exe O4 - HKLM\..\Run: [vsc32cnf.exe] f:\fruity loops\vst, vsti, dx, dxi\edirol vsc\vsc32cnf.exe O4 - HKLM\..\Run: [vscvol.exe] f:\fruity loops\vst, vsti, dx, dxi\edirol vsc\vscvol.exe O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k O4 - HKLM\..\Run: [BearShare] "F:\Moje programy\Bear Share\BearShare.exe" /pause O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe O4 - Global Startup: D-Link AirPlus.lnk = ? O8 - Extra context menu item: Download all links using BitComet - res://F:\Moje programy\BitComet\BitComet.exe/AddAllLink.htm O8 - Extra context menu item: Download all videos using BitComet - res://F:\Moje programy\BitComet\BitComet.exe/AddVideo.htm O8 - Extra context menu item: Download link using &BitComet - res://F:\Moje programy\BitComet\BitComet.exe/AddLink.htm O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://F:\MOJEPR~1\OFFICE~1\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - F:\MOJEPR~1\OFFICE~1\OFFICE11\REFIEBAR.DLL O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra button: Wybierz kierunek tłumaczenia - {CCCE5D70-9AA2-40F1-9C6B-12A255F08500} - F:\Moje programy\Translatica 4\Translatica Integration\bin\win\int\browser\iepolengextension.dll (HKCU) O9 - Extra 'Tools' menuitem: Wybierz kierunek tłumaczenia - {CCCE5D70-9AA2-40F1-9C6B-12A255F08500} - F:\Moje programy\Translatica 4\Translatica Integration\bin\win\int\browser\iepolengextension.dll (HKCU) O9 - Extra button: Tłumacz - {CCCE5D71-9AA2-40F1-9C6B-12A255F08500} - F:\Moje programy\Translatica 4\Translatica Integration\bin\win\int\browser\iepolengextension.dll (HKCU) O9 - Extra 'Tools' menuitem: Tłumacz - {CCCE5D71-9AA2-40F1-9C6B-12A255F08500} - F:\Moje programy\Translatica 4\Translatica Integration\bin\win\int\browser\iepolengextension.dll (HKCU) O9 - Extra button: Zachowaj przetłumaczoną stronę - {CCCE5D72-9AA2-40F1-9C6B-12A255F08500} - F:\Moje programy\Translatica 4\Translatica Integration\bin\win\int\browser\iepolengextension.dll (HKCU) O9 - Extra 'Tools' menuitem: Zachowaj przetłumaczoną stronę - {CCCE5D72-9AA2-40F1-9C6B-12A255F08500} - F:\Moje programy\Translatica 4\Translatica Integration\bin\win\int\browser\iepolengextension.dll (HKCU) O9 - Extra button: Opcje - {CCCE5D73-9AA2-40F1-9C6B-12A255F08500} - F:\Moje programy\Translatica 4\Translatica Integration\bin\win\int\browser\iepolengextension.dll (HKCU) O9 - Extra 'Tools' menuitem: Opcje - {CCCE5D73-9AA2-40F1-9C6B-12A255F08500} - F:\Moje programy\Translatica 4\Translatica Integration\bin\win\int\browser\iepolengextension.dll (HKCU) O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://downloads.ewido.net/ewidoOnlineScan.cab O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - F:\Moje programy\Avast!\aswUpdSv.exe O23 - Service: avast! Antivirus - ALWIL Software - F:\Moje programy\Avast!\ashServ.exe O23 - Service: avast! Mail Scanner - Unknown owner - F:\Moje programy\Avast!\ashMaiSv.exe" /service (file missing) O23 - Service: avast! Web Scanner - Unknown owner - F:\Moje programy\Avast!\ashWebSv.exe" /service (file missing) O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: NBService - Nero AG - F:\Moje programy\Nero 7\Nero BackItUp\NBService.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)

SR

Kod: Zaznacz wszystko: "Silent Runners.vbs", revision 52, http://www.silentrunners.org/ Operating System: Windows XP SP2 Output limited to non-default values, except where indicated by "{++}" Startup items buried in registry: --------------------------------- HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ {++} "CTFMON.EXE" = "C:\WINDOWS\system32\ctfmon.exe" [MS] "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}" = ""C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"" ["Nero AG"] "swg" = "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" ["Google Inc."] HKLM\Software\Microsoft\Windows\CurrentVersion\Run\ {++} "RTHDCPL" = "RTHDCPL.EXE" ["Realtek Semiconductor Corp."] "NvCplDaemon" = "RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup" [MS] "nwiz" = "nwiz.exe /install" ["NVIDIA Corporation"] "NvMediaCenter" = "RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit" [MS] "CTSysVol" = "C:\Program Files\Creative\SBAudigy2\Surround Mixer\CTSysVol.exe /r" ["Creative Technology Ltd"] "CTDVDDET" = "C:\Program Files\Creative\SBAudigy2\DVDAudio\CTDVDDet.EXE" ["Creative Technology Ltd"] "CTHelper" = "CTHELPER.EXE" ["Creative Technology Ltd"] "SBDrvDet" = "C:\Program Files\Creative\SB Drive Det\SBDrvDet.exe /r" ["Creative Technology Ltd"] "UpdReg" = "C:\WINDOWS\UpdReg.EXE" ["Creative Technology Ltd."] "H2O" = "C:\Program Files\SyncroSoft\Pos\H2O\cledx.exe" ["Team H2O"] "avast!" = "F:\MOJEPR~1\Avast!\ashDisp.exe" ["ALWIL Software"] "vsc32cnf.exe" = "f:\fruity loops\vst, vsti, dx, dxi\edirol vsc\vsc32cnf.exe" ["Roland"] "vscvol.exe" = "f:\fruity loops\vst, vsti, dx, dxi\edirol vsc\vscvol.exe" ["Roland"] "NeroCheck" = "C:\WINDOWS\system32\NeroCheck.exe" ["Ahead Software Gmbh"] "NWEReboot" = "(empty string)" [file not found] "NeroFilterCheck" = "C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" ["Nero AG"] "KernelFaultCheck" = "C:\WINDOWS\system32\dumprep 0 -k" "BearShare" = ""F:\Moje programy\Bear Share\BearShare.exe" /pause" ["Free Peers, Inc."] HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\(Default) = (no title provided) -> {HKLM...CLSID} = "AcroIEHlprObj Class" \InProcServer32\(Default) = "F:\Moje programy\Adobe Rader 6.0\Reader\ActiveX\AcroIEHelper.dll" ["Adobe Systems Incorporated"] {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60}\(Default) = "BitComet ClickCapture" -> {HKLM...CLSID} = "BitComet Helper" \InProcServer32\(Default) = "F:\Moje programy\BitComet\tools\BitCometBHO.dll" ["BitComet"] {AA58ED58-01DD-4d91-8333-CF10577473F7}\(Default) = (no title provided) -> {HKLM...CLSID} = "Google Toolbar Helper" \InProcServer32\(Default) = "c:\program files\google\googletoolbar1.dll" ["Google Inc."] {AF69DE43-7D58-4638-B6FA-CE66B5AD205D}\(Default) = (no title provided) -> {HKLM...CLSID} = "Google Toolbar Notifier BHO" \InProcServer32\(Default) = "C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll" ["Google Inc."] HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\ "{42071714-76d4-11d1-8b24-00a0c9068ff3}" = "Rozszerzenie CPL kadrowania wyświetlania" -> {HKLM...CLSID} = "Rozszerzenie CPL kadrowania wyświetlania" \InProcServer32\(Default) = "deskpan.dll" [file not found] "{88895560-9AA2-1069-930E-00AA0030EBC8}" = "Rozszerzenie ikony HyperTerminalu" -> {HKLM...CLSID} = "HyperTerminal Icon Ext" \InProcServer32\(Default) = "C:\WINDOWS\system32\hticons.dll" ["Hilgraeve, Inc."] "{A70C977A-BF00-412C-90B7-034C51DA2439}" = "NvCpl DesktopContext Class" -> {HKLM...CLSID} = "DesktopContext Class" \InProcServer32\(Default) = "C:\WINDOWS\system32\nvcpl.dll" ["NVIDIA Corporation"] "{FFB699E0-306A-11d3-8BD1-00104B6F7516}" = "Play on my TV helper" -> {HKLM...CLSID} = "NVIDIA CPL Extension" \InProcServer32\(Default) = "C:\WINDOWS\system32\nvcpl.dll" ["NVIDIA Corporation"] "{1CDB2949-8F65-4355-8456-263E7C208A5D}" = "Desktop Explorer" -> {HKLM...CLSID} = "Desktop Explorer" \InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"] "{1E9B04FB-F9E5-4718-997B-B8DA88302A47}" = "Desktop Explorer Menu" -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"] "{1E9B04FB-F9E5-4718-997B-B8DA88302A48}" = "nView Desktop Context Menu" -> {HKLM...CLSID} = "nView Desktop Context Menu" \InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"] "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" = "WinRAR shell extension" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "F:\Moje programy\WinRAR\rarext.dll" [null data] "{00020D75-0000-0000-C000-000000000046}" = "Microsoft Office Outlook Desktop Icon Handler" -> {HKLM...CLSID} = "Microsoft Office Outlook" \InProcServer32\(Default) = "F:\MOJEPR~1\OFFICE~1\OFFICE11\MLSHEXT.DLL" [MS] "{0006F045-0000-0000-C000-000000000046}" = "Microsoft Office Outlook Custom Icon Handler" -> {HKLM...CLSID} = "Rozszerzenie ikon plików programu Outlook" \InProcServer32\(Default) = "F:\MOJEPR~1\OFFICE~1\OFFICE11\OLKFSTUB.DLL" [MS] "{42042206-2D85-11D3-8CFF-005004838597}" = "Microsoft Office HTML Icon Handler" -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "F:\Moje programy\Office 2003\OFFICE11\msohev.dll" [MS] "{472083B0-C522-11CF-8763-00608CC02F24}" = "avast" -> {HKLM...CLSID} = "avast" \InProcServer32\(Default) = "F:\Moje programy\Avast!\ashShell.dll" ["ALWIL Software"] HKLM\Software\Classes\PROTOCOLS\Filter\ <<!>> text/xml\CLSID = "{807553E5-5146-11D5-A672-00B0D022E945}" -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL" [MS] HKLM\Software\Classes\*\shellex\ContextMenuHandlers\ avast\(Default) = "{472083B0-C522-11CF-8763-00608CC02F24}" -> {HKLM...CLSID} = "avast" \InProcServer32\(Default) = "F:\Moje programy\Avast!\ashShell.dll" ["ALWIL Software"] WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "F:\Moje programy\WinRAR\rarext.dll" [null data] HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\ WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "F:\Moje programy\WinRAR\rarext.dll" [null data] HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\ avast\(Default) = "{472083B0-C522-11CF-8763-00608CC02F24}" -> {HKLM...CLSID} = "avast" \InProcServer32\(Default) = "F:\Moje programy\Avast!\ashShell.dll" ["ALWIL Software"] WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "F:\Moje programy\WinRAR\rarext.dll" [null data] Group Policies {GPedit.msc branch and setting}: ----------------------------------------------- Note: detected settings may not have any effect. HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\ "shutdownwithoutlogon" = (REG_DWORD) hex:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| Shutdown: Allow system to be shut down without having to log on} "undockwithoutlogon" = (REG_DWORD) hex:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| Devices: Allow undock without having to log on} Active Desktop and Wallpaper: ----------------------------- Active Desktop may be disabled at this entry: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState Displayed if Active Desktop enabled and wallpaper not set by Group Policy: HKCU\Software\Microsoft\Internet Explorer\Desktop\General\ "Wallpaper" = "C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp" Displayed if Active Desktop disabled and wallpaper not set by Group Policy: HKCU\Control Panel\Desktop\ "Wallpaper" = "C:\Documents and Settings\Damiano\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp" Enabled Screen Saver: --------------------- HKCU\Control Panel\Desktop\ "SCRNSAVE.EXE" = "C:\WINDOWS\system32\logon.scr" [MS] Startup items in "Damiano" & "All Users" startup folders: --------------------------------------------------------- C:\Documents and Settings\All Users\Menu Start\Programy\Autostart "D-Link AirPlus" -> shortcut to: "C:\Program Files\D-Link AirPlus\AirPlus.exe" ["D-Link"] Winsock2 Service Provider DLLs: ------------------------------- Namespace Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++} 000000000001\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS] 000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS] 000000000003\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS] Transport Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++} 0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range: %SystemRoot%\system32\mswsock.dll [MS], 01 - 03, 06 - 13 %SystemRoot%\system32\rsvpsp.dll [MS], 04 - 05 Toolbars, Explorer Bars, Extensions: ------------------------------------ Toolbars HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\ "{2318C2B1-4965-11D4-9B18-009027A5CD4F}" -> {HKLM...CLSID} = "&Google" \InProcServer32\(Default) = "c:\program files\google\googletoolbar1.dll" ["Google Inc."] HKLM\Software\Microsoft\Internet Explorer\Toolbar\ "{2318C2B1-4965-11D4-9B18-009027A5CD4F}" = (no title provided) -> {HKLM...CLSID} = "&Google" \InProcServer32\(Default) = "c:\program files\google\googletoolbar1.dll" ["Google Inc."] Explorer Bars HKLM\Software\Microsoft\Internet Explorer\Explorer Bars\ HKLM\Software\Classes\CLSID\{FF059E31-CC5A-4E2E-BF3B-96E929D65503}\(Default) = "&Badanie" Implemented Categories\{00021493-0000-0000-C000-000000000046}\ [vertical bar] InProcServer32\(Default) = "F:\MOJEPR~1\OFFICE~1\OFFICE11\REFIEBAR.DLL" [MS] Extensions (Tools menu items, main toolbar menu buttons) HKCU\Software\Microsoft\Internet Explorer\Extensions\ {CCCE5D70-9AA2-40F1-9C6B-12A255F08500}\ "ButtonText" = "Wybierz kierunek tłumaczenia" "MenuText" = "Wybierz kierunek tłumaczenia" "CLSIDExtension" = "{CC4371F0-D2F6-11D7-BDC4-00605209B788}" -> {HKCU...CLSID} = (no title provided) \InProcServer32\(Default) = "F:\Moje programy\Translatica 4\Translatica Integration\bin\win\int\browser\iepolengextension.dll" ["POLENG"] {CCCE5D71-9AA2-40F1-9C6B-12A255F08500}\ "ButtonText" = "Tłumacz" "MenuText" = "Tłumacz" "CLSIDExtension" = "{CC4371F1-D2F6-11D7-BDC4-00605209B788}" -> {HKCU...CLSID} = (no title provided) \InProcServer32\(Default) = "F:\Moje programy\Translatica 4\Translatica Integration\bin\win\int\browser\iepolengextension.dll" ["POLENG"] {CCCE5D72-9AA2-40F1-9C6B-12A255F08500}\ "ButtonText" = "Zachowaj przetłumaczoną stronę" "MenuText" = "Zachowaj przetłumaczoną stronę" "CLSIDExtension" = "{CC4371F2-D2F6-11D7-BDC4-00605209B788}" -> {HKCU...CLSID} = (no title provided) \InProcServer32\(Default) = "F:\Moje programy\Translatica 4\Translatica Integration\bin\win\int\browser\iepolengextension.dll" ["POLENG"] {CCCE5D73-9AA2-40F1-9C6B-12A255F08500}\ "ButtonText" = "Opcje" "MenuText" = "Opcje" "CLSIDExtension" = "{CC4371F3-D2F6-11D7-BDC4-00605209B788}" -> {HKCU...CLSID} = (no title provided) \InProcServer32\(Default) = "F:\Moje programy\Translatica 4\Translatica Integration\bin\win\int\browser\iepolengextension.dll" ["POLENG"] HKLM\Software\Microsoft\Internet Explorer\Extensions\ {92780B25-18CC-41C8-B9BE-3C9C571A8263}\ "ButtonText" = "Badanie" {FB5F1910-F110-11D2-BB9E-00C04F795683}\ "ButtonText" = "Messenger" "MenuText" = "Windows Messenger" "Exec" = "C:\Program Files\Messenger\msmsgs.exe" [MS] Running Services (Display Name, Service Name, Path {Service DLL}): ------------------------------------------------------------------ avast! Antivirus, avast! Antivirus, ""F:\Moje programy\Avast!\ashServ.exe"" ["ALWIL Software"] avast! iAVS4 Control Service, aswUpdSv, ""F:\Moje programy\Avast!\aswUpdSv.exe"" ["ALWIL Software"] avast! Mail Scanner, avast! Mail Scanner, ""F:\Moje programy\Avast!\ashMaiSv.exe" /service" ["ALWIL Software"] avast! Web Scanner, avast! Web Scanner, ""F:\Moje programy\Avast!\ashWebSv.exe" /service" ["ALWIL Software"] Creative Service for CDROM Access, Creative Service for CDROM Access, "C:\WINDOWS\system32\CTsvcCDA.exe" ["Creative Technology Ltd"] NVIDIA Display Driver Service, NVSvc, "C:\WINDOWS\system32\nvsvc32.exe" ["NVIDIA Corporation"] Windows User Mode Driver Framework, UMWdf, "C:\WINDOWS\system32\wdfmgr.exe" [MS] WMDM PMSP Service, WMDM PMSP Service, "C:\WINDOWS\system32\MsPMSPSv.exe" [MS] Print Monitors: --------------- HKLM\System\CurrentControlSet\Control\Print\Monitors\ Microsoft Document Imaging Writer Monitor\Driver = "mdimon.dll" [MS] ---------- (launch time: 2006-08-13 19:10:42) <<!>>: Suspicious data at a malware launch point. + This report excludes default entries except where indicated. + To see *everywhere* the script checks and *everything* it finds, launch it from a command prompt or a shortcut with the -all parameter. + To search all directories of local fixed drives for DESKTOP.INI DLL launch points, use the -supp parameter or answer "No" at the first message box and "Yes" at the second message box. ---------- (total run time: 35 seconds, including 2 seconds for message boxes)

coś jeszcze siedzi?

**Posty:** 18165 · przez **wojtas** 13 Sie 2007, 20:46

skasuj:

O2 - BHO: (no name) - {140BD8E3-C167-11D4-B4A3-080000180323} - (no file)
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k

znasz to:

O4 - HKLM\..\Run: [vsc32cnf.exe] f:\fruity loops\vst, vsti, dx, dxi\edirol vsc\vsc32cnf.exe
O4 - HKLM\..\Run: [vscvol.exe] f:\fruity loops\vst, vsti, dx, dxi\edirol vsc\vscvol.exe

daj loga z combofixa

**Posty:** 756 · przez **piotrp_1990** 16 Sie 2007, 15:46

HJ

Kod: Zaznacz wszystko: Logfile of HijackThis v1.99.1 Scan saved at 15:24, on 2006-08-16 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe F:\Moje programy\Avast!\aswUpdSv.exe F:\Moje programy\Avast!\ashServ.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\RTHDCPL.EXE C:\Program Files\Creative\SBAudigy2\Surround Mixer\CTSysVol.exe C:\Program Files\Creative\SBAudigy2\DVDAudio\CTDVDDet.EXE C:\WINDOWS\system32\CTsvcCDA.exe C:\WINDOWS\system32\CTHELPER.EXE C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\MsPMSPSv.exe C:\Program Files\SyncroSoft\Pos\H2O\cledx.exe F:\MOJEPR~1\Avast!\ashDisp.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe C:\Program Files\D-Link AirPlus\AirPlus.exe F:\Moje programy\Avast!\ashMaiSv.exe F:\Moje programy\Avast!\ashWebSv.exe C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe C:\WINDOWS\system32\wuauclt.exe C:\WINDOWS\system32\cmd.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Documents and Settings\Damiano\Pulpit\syfek\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - F:\Moje programy\Adobe Rader 6.0\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - F:\Moje programy\BitComet\tools\BitCometBHO.dll O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\SBAudigy2\Surround Mixer\CTSysVol.exe /r O4 - HKLM\..\Run: [CTDVDDET] C:\Program Files\Creative\SBAudigy2\DVDAudio\CTDVDDet.EXE O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE O4 - HKLM\..\Run: [SBDrvDet] C:\Program Files\Creative\SB Drive Det\SBDrvDet.exe /r O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE O4 - HKLM\..\Run: [H2O] C:\Program Files\SyncroSoft\Pos\H2O\cledx.exe O4 - HKLM\..\Run: [avast!] F:\MOJEPR~1\Avast!\ashDisp.exe O4 - HKLM\..\Run: [vsc32cnf.exe] f:\fruity loops\vst, vsti, dx, dxi\edirol vsc\vsc32cnf.exe O4 - HKLM\..\Run: [vscvol.exe] f:\fruity loops\vst, vsti, dx, dxi\edirol vsc\vscvol.exe O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe O4 - HKLM\..\Run: [BearShare] "F:\Moje programy\Bear Share\BearShare.exe" /pause O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" O4 - Global Startup: D-Link AirPlus.lnk = ? O8 - Extra context menu item: Download all links using BitComet - res://F:\Moje programy\BitComet\BitComet.exe/AddAllLink.htm O8 - Extra context menu item: Download all videos using BitComet - res://F:\Moje programy\BitComet\BitComet.exe/AddVideo.htm O8 - Extra context menu item: Download link using &BitComet - res://F:\Moje programy\BitComet\BitComet.exe/AddLink.htm O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://F:\MOJEPR~1\OFFICE~1\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - F:\MOJEPR~1\OFFICE~1\OFFICE11\REFIEBAR.DLL O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra button: Wybierz kierunek tłumaczenia - {CCCE5D70-9AA2-40F1-9C6B-12A255F08500} - F:\Moje programy\Translatica 4\Translatica Integration\bin\win\int\browser\iepolengextension.dll (HKCU) O9 - Extra 'Tools' menuitem: Wybierz kierunek tłumaczenia - {CCCE5D70-9AA2-40F1-9C6B-12A255F08500} - F:\Moje programy\Translatica 4\Translatica Integration\bin\win\int\browser\iepolengextension.dll (HKCU) O9 - Extra button: Tłumacz - {CCCE5D71-9AA2-40F1-9C6B-12A255F08500} - F:\Moje programy\Translatica 4\Translatica Integration\bin\win\int\browser\iepolengextension.dll (HKCU) O9 - Extra 'Tools' menuitem: Tłumacz - {CCCE5D71-9AA2-40F1-9C6B-12A255F08500} - F:\Moje programy\Translatica 4\Translatica Integration\bin\win\int\browser\iepolengextension.dll (HKCU) O9 - Extra button: Zachowaj przetłumaczoną stronę - {CCCE5D72-9AA2-40F1-9C6B-12A255F08500} - F:\Moje programy\Translatica 4\Translatica Integration\bin\win\int\browser\iepolengextension.dll (HKCU) O9 - Extra 'Tools' menuitem: Zachowaj przetłumaczoną stronę - {CCCE5D72-9AA2-40F1-9C6B-12A255F08500} - F:\Moje programy\Translatica 4\Translatica Integration\bin\win\int\browser\iepolengextension.dll (HKCU) O9 - Extra button: Opcje - {CCCE5D73-9AA2-40F1-9C6B-12A255F08500} - F:\Moje programy\Translatica 4\Translatica Integration\bin\win\int\browser\iepolengextension.dll (HKCU) O9 - Extra 'Tools' menuitem: Opcje - {CCCE5D73-9AA2-40F1-9C6B-12A255F08500} - F:\Moje programy\Translatica 4\Translatica Integration\bin\win\int\browser\iepolengextension.dll (HKCU) O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://downloads.ewido.net/ewidoOnlineScan.cab O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - F:\Moje programy\Avast!\aswUpdSv.exe O23 - Service: avast! Antivirus - ALWIL Software - F:\Moje programy\Avast!\ashServ.exe O23 - Service: avast! Mail Scanner - Unknown owner - F:\Moje programy\Avast!\ashMaiSv.exe" /service (file missing) O23 - Service: avast! Web Scanner - Unknown owner - F:\Moje programy\Avast!\ashWebSv.exe" /service (file missing) O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe O23 - Service: NBService - Nero AG - F:\Moje programy\Nero 7\Nero BackItUp\NBService.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)

SR

Kod: Zaznacz wszystko: "Silent Runners.vbs", revision 52, http://www.silentrunners.org/ Operating System: Windows XP SP2 Output limited to non-default values, except where indicated by "{++}" NEW SR Startup items buried in registry: --------------------------------- HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ {++} "CTFMON.EXE" = "C:\WINDOWS\system32\ctfmon.exe" [MS] "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}" = ""C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"" ["Nero AG"] HKLM\Software\Microsoft\Windows\CurrentVersion\Run\ {++} "RTHDCPL" = "RTHDCPL.EXE" ["Realtek Semiconductor Corp."] "NvCplDaemon" = "RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup" [MS] "nwiz" = "nwiz.exe /install" ["NVIDIA Corporation"] "NvMediaCenter" = "RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit" [MS] "CTSysVol" = "C:\Program Files\Creative\SBAudigy2\Surround Mixer\CTSysVol.exe /r" ["Creative Technology Ltd"] "CTDVDDET" = "C:\Program Files\Creative\SBAudigy2\DVDAudio\CTDVDDet.EXE" ["Creative Technology Ltd"] "CTHelper" = "CTHELPER.EXE" ["Creative Technology Ltd"] "SBDrvDet" = "C:\Program Files\Creative\SB Drive Det\SBDrvDet.exe /r" ["Creative Technology Ltd"] "UpdReg" = "C:\WINDOWS\UpdReg.EXE" ["Creative Technology Ltd."] "H2O" = "C:\Program Files\SyncroSoft\Pos\H2O\cledx.exe" ["Team H2O"] "avast!" = "F:\MOJEPR~1\Avast!\ashDisp.exe" ["ALWIL Software"] "vsc32cnf.exe" = "f:\fruity loops\vst, vsti, dx, dxi\edirol vsc\vsc32cnf.exe" ["Roland"] "vscvol.exe" = "f:\fruity loops\vst, vsti, dx, dxi\edirol vsc\vscvol.exe" ["Roland"] "NeroCheck" = "C:\WINDOWS\system32\NeroCheck.exe" ["Ahead Software Gmbh"] "NWEReboot" = "(empty string)" [file not found] "NeroFilterCheck" = "C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" ["Nero AG"] "BearShare" = ""F:\Moje programy\Bear Share\BearShare.exe" /pause" ["Free Peers, Inc."] HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\(Default) = (no title provided) -> {HKLM...CLSID} = "AcroIEHlprObj Class" \InProcServer32\(Default) = "F:\Moje programy\Adobe Rader 6.0\Reader\ActiveX\AcroIEHelper.dll" ["Adobe Systems Incorporated"] {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60}\(Default) = "BitComet ClickCapture" -> {HKLM...CLSID} = "BitComet Helper" \InProcServer32\(Default) = "F:\Moje programy\BitComet\tools\BitCometBHO.dll" ["BitComet"] HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\ "{42071714-76d4-11d1-8b24-00a0c9068ff3}" = "Rozszerzenie CPL kadrowania wyświetlania" -> {HKLM...CLSID} = "Rozszerzenie CPL kadrowania wyświetlania" \InProcServer32\(Default) = "deskpan.dll" [file not found] "{88895560-9AA2-1069-930E-00AA0030EBC8}" = "Rozszerzenie ikony HyperTerminalu" -> {HKLM...CLSID} = "HyperTerminal Icon Ext" \InProcServer32\(Default) = "C:\WINDOWS\system32\hticons.dll" ["Hilgraeve, Inc."] "{A70C977A-BF00-412C-90B7-034C51DA2439}" = "NvCpl DesktopContext Class" -> {HKLM...CLSID} = "DesktopContext Class" \InProcServer32\(Default) = "C:\WINDOWS\system32\nvcpl.dll" ["NVIDIA Corporation"] "{FFB699E0-306A-11d3-8BD1-00104B6F7516}" = "Play on my TV helper" -> {HKLM...CLSID} = "NVIDIA CPL Extension" \InProcServer32\(Default) = "C:\WINDOWS\system32\nvcpl.dll" ["NVIDIA Corporation"] "{1CDB2949-8F65-4355-8456-263E7C208A5D}" = "Desktop Explorer" -> {HKLM...CLSID} = "Desktop Explorer" \InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"] "{1E9B04FB-F9E5-4718-997B-B8DA88302A47}" = "Desktop Explorer Menu" -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"] "{1E9B04FB-F9E5-4718-997B-B8DA88302A48}" = "nView Desktop Context Menu" -> {HKLM...CLSID} = "nView Desktop Context Menu" \InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"] "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" = "WinRAR shell extension" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "F:\Moje programy\WinRAR\rarext.dll" [null data] "{00020D75-0000-0000-C000-000000000046}" = "Microsoft Office Outlook Desktop Icon Handler" -> {HKLM...CLSID} = "Microsoft Office Outlook" \InProcServer32\(Default) = "F:\MOJEPR~1\OFFICE~1\OFFICE11\MLSHEXT.DLL" [MS] "{0006F045-0000-0000-C000-000000000046}" = "Microsoft Office Outlook Custom Icon Handler" -> {HKLM...CLSID} = "Rozszerzenie ikon plików programu Outlook" \InProcServer32\(Default) = "F:\MOJEPR~1\OFFICE~1\OFFICE11\OLKFSTUB.DLL" [MS] "{42042206-2D85-11D3-8CFF-005004838597}" = "Microsoft Office HTML Icon Handler" -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "F:\Moje programy\Office 2003\OFFICE11\msohev.dll" [MS] "{472083B0-C522-11CF-8763-00608CC02F24}" = "avast" -> {HKLM...CLSID} = "avast" \InProcServer32\(Default) = "F:\Moje programy\Avast!\ashShell.dll" ["ALWIL Software"] HKLM\Software\Classes\PROTOCOLS\Filter\ <<!>> text/xml\CLSID = "{807553E5-5146-11D5-A672-00B0D022E945}" -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL" [MS] HKLM\Software\Classes\*\shellex\ContextMenuHandlers\ avast\(Default) = "{472083B0-C522-11CF-8763-00608CC02F24}" -> {HKLM...CLSID} = "avast" \InProcServer32\(Default) = "F:\Moje programy\Avast!\ashShell.dll" ["ALWIL Software"] WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "F:\Moje programy\WinRAR\rarext.dll" [null data] HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\ WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "F:\Moje programy\WinRAR\rarext.dll" [null data] HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\ avast\(Default) = "{472083B0-C522-11CF-8763-00608CC02F24}" -> {HKLM...CLSID} = "avast" \InProcServer32\(Default) = "F:\Moje programy\Avast!\ashShell.dll" ["ALWIL Software"] WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "F:\Moje programy\WinRAR\rarext.dll" [null data] Group Policies {GPedit.msc branch and setting}: ----------------------------------------------- Note: detected settings may not have any effect. HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\ "shutdownwithoutlogon" = (REG_DWORD) hex:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| Shutdown: Allow system to be shut down without having to log on} "undockwithoutlogon" = (REG_DWORD) hex:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| Devices: Allow undock without having to log on} Active Desktop and Wallpaper: ----------------------------- Active Desktop may be disabled at this entry: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState Displayed if Active Desktop enabled and wallpaper not set by Group Policy: HKCU\Software\Microsoft\Internet Explorer\Desktop\General\ "Wallpaper" = "C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp" Displayed if Active Desktop disabled and wallpaper not set by Group Policy: HKCU\Control Panel\Desktop\ "Wallpaper" = "C:\Documents and Settings\Damiano\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp" Startup items in "Damiano" & "All Users" startup folders: --------------------------------------------------------- C:\Documents and Settings\All Users\Menu Start\Programy\Autostart "D-Link AirPlus" -> shortcut to: "C:\Program Files\D-Link AirPlus\AirPlus.exe" ["D-Link"] Winsock2 Service Provider DLLs: ------------------------------- Namespace Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++} 000000000001\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS] 000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS] 000000000003\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS] Transport Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++} 0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range: %SystemRoot%\system32\mswsock.dll [MS], 01 - 03, 06 - 13 %SystemRoot%\system32\rsvpsp.dll [MS], 04 - 05 Toolbars, Explorer Bars, Extensions: ------------------------------------ Explorer Bars HKLM\Software\Microsoft\Internet Explorer\Explorer Bars\ HKLM\Software\Classes\CLSID\{FF059E31-CC5A-4E2E-BF3B-96E929D65503}\(Default) = "&Badanie" Implemented Categories\{00021493-0000-0000-C000-000000000046}\ [vertical bar] InProcServer32\(Default) = "F:\MOJEPR~1\OFFICE~1\OFFICE11\REFIEBAR.DLL" [MS] Extensions (Tools menu items, main toolbar menu buttons) HKCU\Software\Microsoft\Internet Explorer\Extensions\ {CCCE5D70-9AA2-40F1-9C6B-12A255F08500}\ "ButtonText" = "Wybierz kierunek tłumaczenia" "MenuText" = "Wybierz kierunek tłumaczenia" "CLSIDExtension" = "{CC4371F0-D2F6-11D7-BDC4-00605209B788}" -> {HKCU...CLSID} = (no title provided) \InProcServer32\(Default) = "F:\Moje programy\Translatica 4\Translatica Integration\bin\win\int\browser\iepolengextension.dll" ["POLENG"] {CCCE5D71-9AA2-40F1-9C6B-12A255F08500}\ "ButtonText" = "Tłumacz" "MenuText" = "Tłumacz" "CLSIDExtension" = "{CC4371F1-D2F6-11D7-BDC4-00605209B788}" -> {HKCU...CLSID} = (no title provided) \InProcServer32\(Default) = "F:\Moje programy\Translatica 4\Translatica Integration\bin\win\int\browser\iepolengextension.dll" ["POLENG"] {CCCE5D72-9AA2-40F1-9C6B-12A255F08500}\ "ButtonText" = "Zachowaj przetłumaczoną stronę" "MenuText" = "Zachowaj przetłumaczoną stronę" "CLSIDExtension" = "{CC4371F2-D2F6-11D7-BDC4-00605209B788}" -> {HKCU...CLSID} = (no title provided) \InProcServer32\(Default) = "F:\Moje programy\Translatica 4\Translatica Integration\bin\win\int\browser\iepolengextension.dll" ["POLENG"] {CCCE5D73-9AA2-40F1-9C6B-12A255F08500}\ "ButtonText" = "Opcje" "MenuText" = "Opcje" "CLSIDExtension" = "{CC4371F3-D2F6-11D7-BDC4-00605209B788}" -> {HKCU...CLSID} = (no title provided) \InProcServer32\(Default) = "F:\Moje programy\Translatica 4\Translatica Integration\bin\win\int\browser\iepolengextension.dll" ["POLENG"] HKLM\Software\Microsoft\Internet Explorer\Extensions\ {92780B25-18CC-41C8-B9BE-3C9C571A8263}\ "ButtonText" = "Badanie" {FB5F1910-F110-11D2-BB9E-00C04F795683}\ "ButtonText" = "Messenger" "MenuText" = "Windows Messenger" "Exec" = "C:\Program Files\Messenger\msmsgs.exe" [MS] Running Services (Display Name, Service Name, Path {Service DLL}): ------------------------------------------------------------------ avast! Antivirus, avast! Antivirus, ""F:\Moje programy\Avast!\ashServ.exe"" ["ALWIL Software"] avast! iAVS4 Control Service, aswUpdSv, ""F:\Moje programy\Avast!\aswUpdSv.exe"" ["ALWIL Software"] avast! Mail Scanner, avast! Mail Scanner, ""F:\Moje programy\Avast!\ashMaiSv.exe" /service" ["ALWIL Software"] avast! Web Scanner, avast! Web Scanner, ""F:\Moje programy\Avast!\ashWebSv.exe" /service" ["ALWIL Software"] Creative Service for CDROM Access, Creative Service for CDROM Access, "C:\WINDOWS\system32\CTsvcCDA.exe" ["Creative Technology Ltd"] NVIDIA Display Driver Service, NVSvc, "C:\WINDOWS\system32\nvsvc32.exe" ["NVIDIA Corporation"] Windows User Mode Driver Framework, UMWdf, "C:\WINDOWS\system32\wdfmgr.exe" [MS] WMDM PMSP Service, WMDM PMSP Service, "C:\WINDOWS\system32\MsPMSPSv.exe" [MS] Print Monitors: --------------- HKLM\System\CurrentControlSet\Control\Print\Monitors\ Microsoft Document Imaging Writer Monitor\Driver = "mdimon.dll" [MS] ---------- (launch time: 2006-08-16 15:32:59) <<!>>: Suspicious data at a malware launch point. + This report excludes default entries except where indicated. + To see *everywhere* the script checks and *everything* it finds, launch it from a command prompt or a shortcut with the -all parameter. + To search all directories of local fixed drives for DESKTOP.INI DLL launch points, use the -supp parameter or answer "No" at the first message box and "Yes" at the second message box. ---------- (total run time: 35 seconds, including 3 seconds for message boxes)

COMBOFIX

Kod: Zaznacz wszystko: ComboFix 07-08-14.4 - "Damiano" 2006-08-16 15:27:11.7 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.241 [GMT 2:00] ((((((((((((((((((((((((( Files Created from 2006-07-16 to 2006-08-16 ))))))))))))))))))))))))))))))) 2006-08-14 11:06 51,200 --a------ C:\WINDOWS\nircmd.exe 2006-08-13 19:08 <DIR> d-------- C:\WINDOWS\pss 2006-08-13 17:55 <DIR> d---s---- C:\DOCUME~1\Damiano\UserData 2006-08-09 14:12 <DIR> d-------- C:\DOCUME~1\Damiano\DANEAP~1\n-Track Studio5 2006-08-09 14:09 5,365,760 --a------ C:\DOCUME~1\Damiano\ntuser.dat 2006-08-01 15:55 0 --ah----- C:\DOCUME~1\Damiano\DANEAP~1\.8D6EC6526E113FCC.sys 2006-08-01 15:54 0 --ah----- C:\DOCUME~1\Damiano\DANEAP~1\.8D6EC6526E113FCB.sys 2006-07-31 19:23 0 --ah----- C:\DOCUME~1\Damiano\DANEAP~1\.8D6EC65272B730B3.sys 2006-07-31 14:39 <DIR> d-------- C:\DOCUME~1\Damiano\Storm Shared Folder 2006-07-26 00:31 <DIR> d-------- C:\DOCUME~1\Damiano\DANEAP~1\Gadu-Gadu (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) 2007-09-30 00:00 536576 --a------ C:\WINDOWS\system32\MSVCR70d.dll 2007-05-05 23:47 --------- d-------- C:\Program Files\DivX 2007-04-30 17:46 745600 --a------ C:\WINDOWS\system32\aswBoot.exe 2007-04-30 17:41 94552 --a------ C:\WINDOWS\system32\drivers\aswmon2.sys 2007-04-30 17:41 85952 --a------ C:\WINDOWS\system32\drivers\aswmon.sys 2007-04-30 17:39 23416 --a------ C:\WINDOWS\system32\drivers\aswRdr.sys 2007-04-30 17:38 43176 --a------ C:\WINDOWS\system32\drivers\aswTdi.sys 2007-04-30 17:37 26888 --a------ C:\WINDOWS\system32\drivers\aavmker4.sys 2007-04-30 17:35 95872 --a------ C:\WINDOWS\system32\AVASTSS.scr 2007-04-16 22:47 33624 --a--c--- C:\WINDOWS\system32\dllcache\wups.dll 2007-04-16 22:47 33624 --a------ C:\WINDOWS\system32\wups.dll 2007-04-16 22:45 92504 --a--c--- C:\WINDOWS\system32\dllcache\cdm.dll 2007-04-16 22:45 92504 --a------ C:\WINDOWS\system32\cdm.dll 2007-04-16 22:45 549720 --a--c--- C:\WINDOWS\system32\dllcache\wuapi.dll 2007-04-16 22:45 549720 --a------ C:\WINDOWS\system32\wuapi.dll 2007-04-16 22:45 53080 --a--c--- C:\WINDOWS\system32\dllcache\wuauclt.exe 2007-04-16 22:45 53080 --a------ C:\WINDOWS\system32\wuauclt.exe 2007-04-16 22:45 43352 --a------ C:\WINDOWS\system32\wups2.dll 2007-04-16 22:45 325976 --a--c--- C:\WINDOWS\system32\dllcache\wucltui.dll 2007-04-16 22:45 325976 --a------ C:\WINDOWS\system32\wucltui.dll 2007-04-16 22:45 203096 --a--c--- C:\WINDOWS\system32\dllcache\wuweb.dll 2007-04-16 22:45 203096 --a------ C:\WINDOWS\system32\wuweb.dll 2007-04-16 22:45 1710936 --a--c--- C:\WINDOWS\system32\dllcache\wuaueng.dll 2007-04-16 22:45 1710936 --a------ C:\WINDOWS\system32\wuaueng.dll 2007-03-28 17:51 --------- d-------- C:\DOCUME~1\Damiano\DANEAP~1\Creative 2007-03-17 15:45 293376 --a--c--- C:\WINDOWS\system32\dllcache\winsrv.dll 2007-03-17 15:45 293376 --a------ C:\WINDOWS\system32\winsrv.dll 2007-03-09 15:48 57344 --a--c--- C:\WINDOWS\system32\dllcache\agentdpv.dll 2007-03-08 17:38 579072 --a--c--- C:\WINDOWS\system32\dllcache\user32.dll 2007-03-08 17:38 579072 --a------ C:\WINDOWS\system32\user32.dll 2007-03-08 17:38 40960 --a--c--- C:\WINDOWS\system32\dllcache\mf3216.dll 2007-03-08 17:38 40960 --a------ C:\WINDOWS\system32\mf3216.dll 2007-03-08 17:38 281600 --a--c--- C:\WINDOWS\system32\dllcache\gdi32.dll 2007-03-08 17:38 281600 --a------ C:\WINDOWS\system32\gdi32.dll 2007-03-08 17:37 1843840 --a--c--- C:\WINDOWS\system32\dllcache\win32k.sys 2007-03-08 17:37 1843840 --a------ C:\WINDOWS\system32\win32k.sys 2007-02-28 18:04 2181632 -----c--- C:\WINDOWS\system32\dllcache\ntoskrnl.exe 2007-02-28 18:04 2137600 -----c--- C:\WINDOWS\system32\dllcache\ntkrnlmp.exe 2007-02-28 18:04 2058880 -----c--- C:\WINDOWS\system32\dllcache\ntkrnlpa.exe 2007-02-28 18:04 2017280 -----c--- C:\WINDOWS\system32\dllcache\ntkrpamp.exe 2007-02-22 21:27 51712 --a------ C:\WINDOWS\wc98pp.dll 2007-02-19 23:51 --------- d-------- C:\Program Files\Rapidown 2007-02-17 00:26 833092 --a------ C:\WINDOWS\Reverence VST plug-in Uninstaller.exe 2007-02-12 14:42 5 --ahs---- C:\WINDOWS\system32\baefcbba7_s.dll 2007-02-12 13:27 --------- d-------- C:\DOCUME~1\Damiano\DANEAP~1\Ableton 2007-02-05 22:19 185856 --a--c--- C:\WINDOWS\system32\dllcache\upnphost.dll 2007-02-05 22:19 185856 --a------ C:\WINDOWS\system32\upnphost.dll 2007-02-02 21:42 --------- d-------- C:\DOCUME~1\Damiano\DANEAP~1\Media Player Classic 2007-01-28 15:29 --------- d-------- C:\DOCUME~1\Damiano\DANEAP~1\Ahead 2007-01-25 15:05 616448 --a--c--- C:\WINDOWS\system32\dllcache\urlmon.dll 2007-01-24 19:46 --------- d-------- C:\Program Files\Common Files\Ahead 2007-01-16 21:06 --------- d-------- C:\DOCUME~1\Damiano\DANEAP~1\POLENG4 2007-01-14 19:40 --------- d-------- C:\Program Files\Common Files\InstallShield 2007-01-13 10:23 --------- d-------- C:\Program Files\K-Lite Codec Pack 2007-01-13 10:23 --------- d-------- C:\Program Files\ffdshow 2007-01-13 10:23 --------- d-------- C:\DOCUME~1\Damiano\DANEAP~1\Real 2007-01-12 18:27 --------- d-------- C:\Program Files\Image-Line 2007-01-06 19:09 --------- d-------- C:\DOCUME~1\Damiano\DANEAP~1\Steinberg 2007-01-06 16:30 2560 --a------ C:\WINDOWS\system32\BitCometRes.dll 2007-01-04 15:58 661504 --a--c--- C:\WINDOWS\system32\dllcache\wininet.dll 2007-01-04 15:58 474112 --a--c--- C:\WINDOWS\system32\dllcache\shlwapi.dll 2007-01-04 15:57 96768 --a--c--- C:\WINDOWS\system32\dllcache\inseng.dll 2007-01-04 15:57 55808 --a--c--- C:\WINDOWS\system32\dllcache\extmgr.dll 2007-01-04 15:57 532480 --a--c--- C:\WINDOWS\system32\dllcache\mstime.dll 2007-01-04 15:57 448512 --a--c--- C:\WINDOWS\system32\dllcache\mshtmled.dll 2007-01-04 15:57 39424 --a--c--- C:\WINDOWS\system32\dllcache\pngfilt.dll 2007-01-04 15:57 357888 --a--c--- C:\WINDOWS\system32\dllcache\dxtmsft.dll 2007-01-04 15:57 3077632 --a--c--- C:\WINDOWS\system32\dllcache\mshtml.dll 2007-01-04 15:57 251392 --a--c--- C:\WINDOWS\system32\dllcache\iepeers.dll 2007-01-04 15:57 205312 --a--c--- C:\WINDOWS\system32\dllcache\dxtrans.dll 2007-01-04 15:57 16384 --a--c--- C:\WINDOWS\system32\dllcache\jsproxy.dll 2007-01-04 15:57 151552 --a--c--- C:\WINDOWS\system32\dllcache\cdfview.dll 2007-01-04 15:57 1494528 --a--c--- C:\WINDOWS\system32\dllcache\shdocvw.dll 2007-01-04 15:57 146432 --a--c--- C:\WINDOWS\system32\dllcache\msrating.dll 2007-01-04 15:57 1055744 --a--c--- C:\WINDOWS\system32\dllcache\danim.dll 2007-01-04 15:57 1023488 --a--c--- C:\WINDOWS\system32\dllcache\browseui.dll 2007-01-04 12:36 18432 --a--c--- C:\WINDOWS\system32\dllcache\iedw.exe 2006-12-26 21:13 --------- d-------- C:\Program Files\ahead 2006-12-26 15:09 536576 --a--c--- C:\WINDOWS\system32\dllcache\msado15.dll 2006-12-26 15:09 200704 --a--c--- C:\WINDOWS\system32\dllcache\msadox.dll 2006-12-26 15:09 180224 --a--c--- C:\WINDOWS\system32\dllcache\msadomd.dll 2006-12-26 15:09 102400 --a--c--- C:\WINDOWS\system32\dllcache\msjro.dll 2006-12-23 19:43 --------- d-------- C:\Program Files\Common Files\Wise Installation Wizard 2006-12-23 19:09 1025 --a------ C:\WINDOWS\system32\sysprs7.dll 2006-12-23 19:09 1025 --a------ C:\WINDOWS\system32\clauth2.dll 2006-12-23 19:09 1025 --a------ C:\WINDOWS\system32\clauth1.dll 2006-12-23 17:31 --------- d-------- C:\Program Files\Messenger 2006-12-23 15:28 --------- d-------- C:\Program Files\Syncrosoft 2006-12-22 23:43 --------- d-------- C:\Program Files\ASIO4ALL v2 2006-12-22 22:31 --------- d-------- C:\Program Files\Skype 2006-12-22 22:30 --------- d-------- C:\DOCUME~1\Damiano\DANEAP~1\Tlen.pl 2006-12-22 22:20 --------- d-------- C:\Program Files\Common Files\Skype 2006-12-22 20:47 368640 --a------ C:\WINDOWS\system32\rewire.dll 2006-12-22 20:11 --------- d-------- C:\Program Files\D-Link AirPlus 2006-12-19 23:51 8482304 --a--c--- C:\WINDOWS\system32\dllcache\shell32.dll 2006-12-19 23:51 135168 --a--c--- C:\WINDOWS\system32\dllcache\shsvcs.dll 2006-12-19 20:18 334336 --a--c--- C:\WINDOWS\system32\dllcache\wiaservc.dll 2006-12-19 20:09 852480 --a--c--- C:\WINDOWS\system32\dllcache\vgx.dll 2006-12-16 13:57 --------- d-------- C:\Program Files\Common Files\KORG 2006-12-16 13:29 --------- d-------- C:\Program Files\URS ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "RTHDCPL"="RTHDCPL.EXE" [2005-09-22 07:36 C:\WINDOWS\RTHDCPL.exe] "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2005-07-20 15:07] "nwiz"="nwiz.exe" [2005-07-20 15:07 C:\WINDOWS\system32\nwiz.exe] "NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2005-07-20 15:07] "CTSysVol"="C:\Program Files\Creative\SBAudigy2\Surround Mixer\CTSysVol.exe" [2003-09-17 11:43] "CTDVDDET"="C:\Program Files\Creative\SBAudigy2\DVDAudio\CTDVDDet.EXE" [2003-06-18 02:00] "CTHelper"="CTHELPER.EXE" [2004-03-19 10:33 C:\WINDOWS\system32\CTHELPER.EXE] "SBDrvDet"="C:\Program Files\Creative\SB Drive Det\SBDrvDet.exe" [2002-12-03 19:06] "UpdReg"="C:\WINDOWS\UpdReg.EXE" [2000-05-11 02:00] "H2O"="C:\Program Files\SyncroSoft\Pos\H2O\cledx.exe" [2005-11-01 01:00] "avast!"="F:\MOJEPR~1\Avast!\ashDisp.exe" [2007-04-30 17:42] "vsc32cnf.exe"="f:\fruity loops\vst" [] "vscvol.exe"="f:\fruity loops\vst" [] "NeroCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 11:50] "NWEReboot"="" [] "NeroFilterCheck"="C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-12 17:40] "BearShare"="F:\Moje programy\Bear Share\BearShare.exe" [2006-07-29 04:48] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:44] "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2006-08-30 16:05] [HKEY_USERS\.default\software\microsoft\windows\currentversion\runonce] "nlsf"=cmd.exe /C move /Y "%SystemRoot%\System32\syssetub.dll" "%SystemRoot%\System32\syssetup.dll" "tscuninstall"=%systemroot%\system32\tscupgrd.exe C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\ D-Link AirPlus.lnk - C:\Program Files\D-Link AirPlus\AirPlus.exe [2006-12-22 20:11:08] R0 iteraid;ITERAID_Service_Install;C:\WINDOWS\system32\DRIVERS\iteraid.sys R1 Asapi;Asapi;C:\WINDOWS\system32\drivers\Asapi.sys R2 RVIEGVST;VSC VST Engine;\??\F:\Fruity Loops\VST, VSTi, DX, DXi\Edirol VSC\RVIEg01VST.sys R2 Vcs;Vcs support;\??\C:\WINDOWS\system32\Drivers\Vcs.sys R3 AIRPLUS;D-Link AirPlus Wireless Adapter;C:\WINDOWS\system32\DRIVERS\airplus.sys R3 CLEDX;Team H2O CLEDX service;C:\WINDOWS\system32\DRIVERS\cledx.sys R3 vsc32;Virtual Sound Canvas 3.2;C:\WINDOWS\system32\DRIVERS\vsc.sys S3 GVCplDrv;GVCplDrv;C:\WINDOWS\system32\drivers\GVCplDrv.sys S3 NPF;NetGroup Packet Filter Driver;C:\WINDOWS\system32\drivers\npf.sys [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\D] AutoRun\command- D:\Autorun.exe ************************************************************************** catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2006-08-16 15:27:49 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** Completion time: 2006-08-16 15:28:15 C:\ComboFix2.txt ... 2006-08-14 11:11 --- E O F ---

wojtas19162 napisał(a):znasz to:

Cytat:
O4 - HKLM\..\Run: [vsc32cnf.exe] f:\fruity loops\vst, vsti, dx, dxi\edirol vsc\vsc32cnf.exe
O4 - HKLM\..\Run: [vscvol.exe] f:\fruity loops\vst, vsti, dx, dxi\edirol vsc\vscvol.exe

znam

**Posty:** 18165 · przez **wojtas** 16 Sie 2007, 17:34

te pliki (beda ukryte)

C:\DOCUME~1\Damiano\DANEAP~1\.8D6EC6526E113FCC.sys
C:\DOCUME~1\Damiano\DANEAP~1\.8D6EC6526E113FCB.sys
C:\DOCUME~1\Damiano\DANEAP~1\.8D6EC65272B730B3.sys
C:\WINDOWS\system32\baefcbba7_s.dll

przeskanuj tu i daj raporty:

http://virusscan.jotti.org/
http://www.virustotal.com/

ten plik na kasacje:

C:\WINDOWS\wc98pp.dll

wklej do notatnika:

REGEDIT 4

[HKEY_USERS\.default\software\microsoft\windows\currentversion\runonce]
"nlsf"=-
"tscuninstall"=-

w notatniku u góry>>>plik zapisz jako>>>Zmien rozszerzenie z TXT na Wszystkie pliki *.* >>> Zapisz pod nazwą FIX.REG

Klikasz dwa razy na powstały plik fix i dodajesz go do rejestru....

potem te raporty oraz log z combofixa

**Posty:** 756 · przez **piotrp_1990** 17 Sie 2007, 00:10

C:\DOCUME~1\Damiano\DANEAP~1\.8D6EC6526E113FCC.sys
C:\DOCUME~1\Damiano\DANEAP~1\.8D6EC6526E113FCB.sys
C:\DOCUME~1\Damiano\DANEAP~1\.8D6EC65272B730B3.sys

tych plików nei mogę przeskanować ponieważ mają po 0 bajtów

raport z pliku

C:\WINDOWS\system32\baefcbba7_s.dll

virusscan:

Kod: Zaznacz wszystko: Scanner results Scan taken on 16 Aug 2007 21:33:29 (GMT) A-Squared Found nothing AntiVir Found nothing ArcaVir Found nothing Avast Found nothing AVG Antivirus Found nothing BitDefender Found nothing ClamAV Found nothing CPsecure Found nothing Dr.Web Found nothing F-Prot Antivirus Found nothing F-Secure Anti-Virus Found nothing Fortinet Found nothing Kaspersky Anti-Virus Found nothing NOD32 Found nothing Norman Virus Control Found nothing Panda Antivirus Found nothing Rising Antivirus Found nothing Sophos Antivirus Found nothing VirusBuster Found nothing VBA32 Found nothing

virustotal:

Kod: Zaznacz wszystko: Antywirus Wersja Ostatnia aktualizacja Wynik AhnLab-V3 2007.8.15.0 2007.08.16 - AntiVir 7.4.1.62 2007.08.16 - Authentium 4.93.8 2007.08.16 - Avast 4.7.1029.0 2007.08.16 - BitDefender 7.2 2007.08.16 - CAT-QuickHeal 9.00 2007.08.16 - ClamAV 0.91 2007.08.16 - eSafe 7.0.15.0 2007.08.16 - eTrust-Vet 31.1.5064 2007.08.16 - Ewido 4.0 2007.08.16 - FileAdvisor 1 2007.08.16 - Fortinet 2.91.0.0 2007.08.16 - F-Prot 4.3.2.48 2007.08.16 - F-Secure 6.70.13030.0 2007.08.16 - Ikarus T3.1.1.12 2007.08.16 - Kaspersky 4.0.2.24 2007.08.16 - McAfee 5099 2007.08.16 - Microsoft 1.2803 2007.08.16 - NOD32v2 2467 2007.08.16 - Norman 5.80.02 2007.08.16 - Panda 9.0.0.4 2007.08.16 - Prevx1 V2 2007.08.16 - Rising 19.36.32.00 2007.08.16 - Sophos 4.20.0 2007.08.12 - Sunbelt 2.2.907.0 2007.08.16 - Symantec 10 2007.08.16 - TheHacker 6.1.8.170 2007.08.15 - VBA32 3.12.2.2 2007.08.16 - VirusBuster 4.3.26:9 2007.08.16 - Webwasher-Gateway 6.0.1 2007.08.16 - Dodatkowe informacje File size: 5 bytes MD5: 8897a5c0fe0315d1639d67ce8791ed31 SHA1: ceb24f1519a8492f70e95eb8764697108caa6194

COMBOFIX

Kod: Zaznacz wszystko: ComboFix 07-08-14.4 - "Damiano" 2006-08-16 23:59:00.8 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.254 [GMT 2:00] ((((((((((((((((((((((((( Files Created from 2006-07-16 to 2006-08-16 ))))))))))))))))))))))))))))))) 2006-08-14 11:06 51,200 --a------ C:\WINDOWS\nircmd.exe 2006-08-13 19:08 <DIR> d-------- C:\WINDOWS\pss 2006-08-13 17:55 <DIR> d---s---- C:\DOCUME~1\Damiano\UserData 2006-08-09 14:12 <DIR> d-------- C:\DOCUME~1\Damiano\DANEAP~1\n-Track Studio5 2006-08-09 14:09 5,365,760 --a------ C:\DOCUME~1\Damiano\ntuser.dat 2006-08-01 15:55 0 --ah----- C:\DOCUME~1\Damiano\DANEAP~1\.8D6EC6526E113FCC.sys 2006-08-01 15:54 0 --ah----- C:\DOCUME~1\Damiano\DANEAP~1\.8D6EC6526E113FCB.sys 2006-07-31 19:23 0 --ah----- C:\DOCUME~1\Damiano\DANEAP~1\.8D6EC65272B730B3.sys 2006-07-31 14:39 <DIR> d-------- C:\DOCUME~1\Damiano\Storm Shared Folder 2006-07-26 00:31 <DIR> d-------- C:\DOCUME~1\Damiano\DANEAP~1\Gadu-Gadu (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) 2007-09-30 00:00 536576 --a------ C:\WINDOWS\system32\MSVCR70d.dll 2007-05-05 23:47 --------- d-------- C:\Program Files\DivX 2007-04-30 17:46 745600 --a------ C:\WINDOWS\system32\aswBoot.exe 2007-04-30 17:41 94552 --a------ C:\WINDOWS\system32\drivers\aswmon2.sys 2007-04-30 17:41 85952 --a------ C:\WINDOWS\system32\drivers\aswmon.sys 2007-04-30 17:39 23416 --a------ C:\WINDOWS\system32\drivers\aswRdr.sys 2007-04-30 17:38 43176 --a------ C:\WINDOWS\system32\drivers\aswTdi.sys 2007-04-30 17:37 26888 --a------ C:\WINDOWS\system32\drivers\aavmker4.sys 2007-04-30 17:35 95872 --a------ C:\WINDOWS\system32\AVASTSS.scr 2007-04-16 22:47 33624 --a--c--- C:\WINDOWS\system32\dllcache\wups.dll 2007-04-16 22:47 33624 --a------ C:\WINDOWS\system32\wups.dll 2007-04-16 22:45 92504 --a--c--- C:\WINDOWS\system32\dllcache\cdm.dll 2007-04-16 22:45 92504 --a------ C:\WINDOWS\system32\cdm.dll 2007-04-16 22:45 549720 --a--c--- C:\WINDOWS\system32\dllcache\wuapi.dll 2007-04-16 22:45 549720 --a------ C:\WINDOWS\system32\wuapi.dll 2007-04-16 22:45 53080 --a--c--- C:\WINDOWS\system32\dllcache\wuauclt.exe 2007-04-16 22:45 53080 --a------ C:\WINDOWS\system32\wuauclt.exe 2007-04-16 22:45 43352 --a------ C:\WINDOWS\system32\wups2.dll 2007-04-16 22:45 325976 --a--c--- C:\WINDOWS\system32\dllcache\wucltui.dll 2007-04-16 22:45 325976 --a------ C:\WINDOWS\system32\wucltui.dll 2007-04-16 22:45 203096 --a--c--- C:\WINDOWS\system32\dllcache\wuweb.dll 2007-04-16 22:45 203096 --a------ C:\WINDOWS\system32\wuweb.dll 2007-04-16 22:45 1710936 --a--c--- C:\WINDOWS\system32\dllcache\wuaueng.dll 2007-04-16 22:45 1710936 --a------ C:\WINDOWS\system32\wuaueng.dll 2007-03-28 17:51 --------- d-------- C:\DOCUME~1\Damiano\DANEAP~1\Creative 2007-03-17 15:45 293376 --a--c--- C:\WINDOWS\system32\dllcache\winsrv.dll 2007-03-17 15:45 293376 --a------ C:\WINDOWS\system32\winsrv.dll 2007-03-09 15:48 57344 --a--c--- C:\WINDOWS\system32\dllcache\agentdpv.dll 2007-03-08 17:38 579072 --a--c--- C:\WINDOWS\system32\dllcache\user32.dll 2007-03-08 17:38 579072 --a------ C:\WINDOWS\system32\user32.dll 2007-03-08 17:38 40960 --a--c--- C:\WINDOWS\system32\dllcache\mf3216.dll 2007-03-08 17:38 40960 --a------ C:\WINDOWS\system32\mf3216.dll 2007-03-08 17:38 281600 --a--c--- C:\WINDOWS\system32\dllcache\gdi32.dll 2007-03-08 17:38 281600 --a------ C:\WINDOWS\system32\gdi32.dll 2007-03-08 17:37 1843840 --a--c--- C:\WINDOWS\system32\dllcache\win32k.sys 2007-03-08 17:37 1843840 --a------ C:\WINDOWS\system32\win32k.sys 2007-02-28 18:04 2181632 -----c--- C:\WINDOWS\system32\dllcache\ntoskrnl.exe 2007-02-28 18:04 2137600 -----c--- C:\WINDOWS\system32\dllcache\ntkrnlmp.exe 2007-02-28 18:04 2058880 -----c--- C:\WINDOWS\system32\dllcache\ntkrnlpa.exe 2007-02-28 18:04 2017280 -----c--- C:\WINDOWS\system32\dllcache\ntkrpamp.exe 2007-02-19 23:51 --------- d-------- C:\Program Files\Rapidown 2007-02-17 00:26 833092 --a------ C:\WINDOWS\Reverence VST plug-in Uninstaller.exe 2007-02-12 14:42 5 --ahs---- C:\WINDOWS\system32\baefcbba7_s.dll 2007-02-12 13:27 --------- d-------- C:\DOCUME~1\Damiano\DANEAP~1\Ableton 2007-02-05 22:19 185856 --a--c--- C:\WINDOWS\system32\dllcache\upnphost.dll 2007-02-05 22:19 185856 --a------ C:\WINDOWS\system32\upnphost.dll 2007-02-02 21:42 --------- d-------- C:\DOCUME~1\Damiano\DANEAP~1\Media Player Classic 2007-01-28 15:29 --------- d-------- C:\DOCUME~1\Damiano\DANEAP~1\Ahead 2007-01-25 15:05 616448 --a--c--- C:\WINDOWS\system32\dllcache\urlmon.dll 2007-01-24 19:46 --------- d-------- C:\Program Files\Common Files\Ahead 2007-01-16 21:06 --------- d-------- C:\DOCUME~1\Damiano\DANEAP~1\POLENG4 2007-01-14 19:40 --------- d-------- C:\Program Files\Common Files\InstallShield 2007-01-13 10:23 --------- d-------- C:\Program Files\K-Lite Codec Pack 2007-01-13 10:23 --------- d-------- C:\Program Files\ffdshow 2007-01-13 10:23 --------- d-------- C:\DOCUME~1\Damiano\DANEAP~1\Real 2007-01-12 18:27 --------- d-------- C:\Program Files\Image-Line 2007-01-06 19:09 --------- d-------- C:\DOCUME~1\Damiano\DANEAP~1\Steinberg 2007-01-06 16:30 2560 --a------ C:\WINDOWS\system32\BitCometRes.dll 2007-01-04 15:58 661504 --a--c--- C:\WINDOWS\system32\dllcache\wininet.dll 2007-01-04 15:58 474112 --a--c--- C:\WINDOWS\system32\dllcache\shlwapi.dll 2007-01-04 15:57 96768 --a--c--- C:\WINDOWS\system32\dllcache\inseng.dll 2007-01-04 15:57 55808 --a--c--- C:\WINDOWS\system32\dllcache\extmgr.dll 2007-01-04 15:57 532480 --a--c--- C:\WINDOWS\system32\dllcache\mstime.dll 2007-01-04 15:57 448512 --a--c--- C:\WINDOWS\system32\dllcache\mshtmled.dll 2007-01-04 15:57 39424 --a--c--- C:\WINDOWS\system32\dllcache\pngfilt.dll 2007-01-04 15:57 357888 --a--c--- C:\WINDOWS\system32\dllcache\dxtmsft.dll 2007-01-04 15:57 3077632 --a--c--- C:\WINDOWS\system32\dllcache\mshtml.dll 2007-01-04 15:57 251392 --a--c--- C:\WINDOWS\system32\dllcache\iepeers.dll 2007-01-04 15:57 205312 --a--c--- C:\WINDOWS\system32\dllcache\dxtrans.dll 2007-01-04 15:57 16384 --a--c--- C:\WINDOWS\system32\dllcache\jsproxy.dll 2007-01-04 15:57 151552 --a--c--- C:\WINDOWS\system32\dllcache\cdfview.dll 2007-01-04 15:57 1494528 --a--c--- C:\WINDOWS\system32\dllcache\shdocvw.dll 2007-01-04 15:57 146432 --a--c--- C:\WINDOWS\system32\dllcache\msrating.dll 2007-01-04 15:57 1055744 --a--c--- C:\WINDOWS\system32\dllcache\danim.dll 2007-01-04 15:57 1023488 --a--c--- C:\WINDOWS\system32\dllcache\browseui.dll 2007-01-04 12:36 18432 --a--c--- C:\WINDOWS\system32\dllcache\iedw.exe 2006-12-26 21:13 --------- d-------- C:\Program Files\ahead 2006-12-26 15:09 536576 --a--c--- C:\WINDOWS\system32\dllcache\msado15.dll 2006-12-26 15:09 200704 --a--c--- C:\WINDOWS\system32\dllcache\msadox.dll 2006-12-26 15:09 180224 --a--c--- C:\WINDOWS\system32\dllcache\msadomd.dll 2006-12-26 15:09 102400 --a--c--- C:\WINDOWS\system32\dllcache\msjro.dll 2006-12-23 19:43 --------- d-------- C:\Program Files\Common Files\Wise Installation Wizard 2006-12-23 19:09 1025 --a------ C:\WINDOWS\system32\sysprs7.dll 2006-12-23 19:09 1025 --a------ C:\WINDOWS\system32\clauth2.dll 2006-12-23 19:09 1025 --a------ C:\WINDOWS\system32\clauth1.dll 2006-12-23 17:31 --------- d-------- C:\Program Files\Messenger 2006-12-23 15:28 --------- d-------- C:\Program Files\Syncrosoft 2006-12-22 23:43 --------- d-------- C:\Program Files\ASIO4ALL v2 2006-12-22 22:31 --------- d-------- C:\Program Files\Skype 2006-12-22 22:30 --------- d-------- C:\DOCUME~1\Damiano\DANEAP~1\Tlen.pl 2006-12-22 22:20 --------- d-------- C:\Program Files\Common Files\Skype 2006-12-22 20:47 368640 --a------ C:\WINDOWS\system32\rewire.dll 2006-12-22 20:11 --------- d-------- C:\Program Files\D-Link AirPlus 2006-12-19 23:51 8482304 --a--c--- C:\WINDOWS\system32\dllcache\shell32.dll 2006-12-19 23:51 135168 --a--c--- C:\WINDOWS\system32\dllcache\shsvcs.dll 2006-12-19 20:18 334336 --a--c--- C:\WINDOWS\system32\dllcache\wiaservc.dll 2006-12-19 20:09 852480 --a--c--- C:\WINDOWS\system32\dllcache\vgx.dll 2006-12-16 13:57 --------- d-------- C:\Program Files\Common Files\KORG 2006-12-16 13:29 --------- d-------- C:\Program Files\URS 2006-12-16 13:12 --------- d-------- C:\Program Files\Common Files\iZotope ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "RTHDCPL"="RTHDCPL.EXE" [2005-09-22 07:36 C:\WINDOWS\RTHDCPL.exe] "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2005-07-20 15:07] "nwiz"="nwiz.exe" [2005-07-20 15:07 C:\WINDOWS\system32\nwiz.exe] "NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2005-07-20 15:07] "CTSysVol"="C:\Program Files\Creative\SBAudigy2\Surround Mixer\CTSysVol.exe" [2003-09-17 11:43] "CTDVDDET"="C:\Program Files\Creative\SBAudigy2\DVDAudio\CTDVDDet.EXE" [2003-06-18 02:00] "CTHelper"="CTHELPER.EXE" [2004-03-19 10:33 C:\WINDOWS\system32\CTHELPER.EXE] "SBDrvDet"="C:\Program Files\Creative\SB Drive Det\SBDrvDet.exe" [2002-12-03 19:06] "UpdReg"="C:\WINDOWS\UpdReg.EXE" [2000-05-11 02:00] "H2O"="C:\Program Files\SyncroSoft\Pos\H2O\cledx.exe" [2005-11-01 01:00] "avast!"="F:\MOJEPR~1\Avast!\ashDisp.exe" [2007-04-30 17:42] "vsc32cnf.exe"="f:\fruity loops\vst" [] "vscvol.exe"="f:\fruity loops\vst" [] "NeroCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 11:50] "NWEReboot"="" [] "NeroFilterCheck"="C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-12 17:40] "BearShare"="F:\Moje programy\Bear Share\BearShare.exe" [2006-07-29 04:48] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:44] "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2006-08-30 16:05] [HKEY_USERS\.default\software\microsoft\windows\currentversion\runonce] "nlsf"=cmd.exe /C move /Y "%SystemRoot%\System32\syssetub.dll" "%SystemRoot%\System32\syssetup.dll" "tscuninstall"=%systemroot%\system32\tscupgrd.exe C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\ D-Link AirPlus.lnk - C:\Program Files\D-Link AirPlus\AirPlus.exe [2006-12-22 20:11:08] R0 iteraid;ITERAID_Service_Install;C:\WINDOWS\system32\DRIVERS\iteraid.sys R1 Asapi;Asapi;C:\WINDOWS\system32\drivers\Asapi.sys R2 RVIEGVST;VSC VST Engine;\??\F:\Fruity Loops\VST, VSTi, DX, DXi\Edirol VSC\RVIEg01VST.sys R2 Vcs;Vcs support;\??\C:\WINDOWS\system32\Drivers\Vcs.sys R3 AIRPLUS;D-Link AirPlus Wireless Adapter;C:\WINDOWS\system32\DRIVERS\airplus.sys R3 CLEDX;Team H2O CLEDX service;C:\WINDOWS\system32\DRIVERS\cledx.sys R3 vsc32;Virtual Sound Canvas 3.2;C:\WINDOWS\system32\DRIVERS\vsc.sys S3 GVCplDrv;GVCplDrv;C:\WINDOWS\system32\drivers\GVCplDrv.sys S3 NPF;NetGroup Packet Filter Driver;C:\WINDOWS\system32\drivers\npf.sys [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\D] AutoRun\command- D:\Autorun.exe ************************************************************************** catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2006-08-16 23:59:59 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** Completion time: 2006-08-17 0:01:37 C:\ComboFix2.txt ... 2006-08-16 15:28 C:\ComboFix3.txt ... 2006-08-14 11:11 --- E O F ---

reszta zgodnie z instrukcja

przy wlozeiu plyty wiecha mi okno
przy wlaczeniu kompa i aplikacji typu gg pyta z firewalla o odblokowanie :cry:

**Posty:** 18165 · przez **wojtas** 17 Sie 2007, 08:23

start>uruchom>regedit>przejdz do klucza:

[HKEY_USERS\.default\software\microsoft\windows\currentversion\runonce]

i wypisz jakie masz tam wpisy

piotrp_1990 napisał(a):przy wlaczeniu kompa i aplikacji typu gg pyta z firewalla o odblokowanie

jaki firewall ten systemowy??

wejdz w panel sterowania> system>sprzet>menadzer urzadzen>Kontrolery IDE ATA/ATAPI>Podstawowy kanał IDE>zaawansowane>zobacz czy Tryb transgeru masz DMA

**Posty:** 756 · przez **piotrp_1990** 17 Sie 2007, 11:07

wojtas19162 napisał(a):[HKEY_USERS\.default\software\microsoft\windows\currentversion\runonce]

wojtas19162 napisał(a):jaki firewall ten systemowy??

systemowy

wojtas19162 napisał(a):masz DMA

tak

**Posty:** 18165 · przez **wojtas** 17 Sie 2007, 11:47

nic w logu nie widac wiecej

**Posty:** 756 · przez **piotrp_1990** 17 Sie 2007, 11:59

a to?

[ Dodano: Dzisiaj o 15:52 ]
dam jeszcze logi raz

HJ

Kod: Zaznacz wszystko: Logfile of HijackThis v1.99.1 Scan saved at 15:42:06, on 2006-08-17 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe F:\Moje programy\Avast!\aswUpdSv.exe F:\Moje programy\Avast!\ashServ.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\RTHDCPL.EXE C:\Program Files\Creative\SBAudigy2\Surround Mixer\CTSysVol.exe C:\Program Files\Creative\SBAudigy2\DVDAudio\CTDVDDet.EXE C:\WINDOWS\system32\CTHELPER.EXE C:\WINDOWS\system32\CTsvcCDA.exe C:\WINDOWS\system32\nvsvc32.exe C:\Program Files\SyncroSoft\Pos\H2O\cledx.exe C:\WINDOWS\system32\svchost.exe F:\MOJEPR~1\Avast!\ashDisp.exe C:\WINDOWS\system32\MsPMSPSv.exe F:\Moje programy\Avast!\ashWebSv.exe F:\Moje programy\Avast!\ashMaiSv.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe C:\Program Files\D-Link AirPlus\AirPlus.exe C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Documents and Settings\Damiano\Pulpit\syfek\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - F:\Moje programy\Adobe Rader 6.0\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - F:\Moje programy\BitComet\tools\BitCometBHO.dll O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\SBAudigy2\Surround Mixer\CTSysVol.exe /r O4 - HKLM\..\Run: [CTDVDDET] C:\Program Files\Creative\SBAudigy2\DVDAudio\CTDVDDet.EXE O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE O4 - HKLM\..\Run: [SBDrvDet] C:\Program Files\Creative\SB Drive Det\SBDrvDet.exe /r O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE O4 - HKLM\..\Run: [H2O] C:\Program Files\SyncroSoft\Pos\H2O\cledx.exe O4 - HKLM\..\Run: [avast!] F:\MOJEPR~1\Avast!\ashDisp.exe O4 - HKLM\..\Run: [vsc32cnf.exe] f:\fruity loops\vst, vsti, dx, dxi\edirol vsc\vsc32cnf.exe O4 - HKLM\..\Run: [vscvol.exe] f:\fruity loops\vst, vsti, dx, dxi\edirol vsc\vscvol.exe O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe O4 - HKLM\..\Run: [BearShare] "F:\Moje programy\Bear Share\BearShare.exe" /pause O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" O4 - Global Startup: D-Link AirPlus.lnk = ? O8 - Extra context menu item: Download all links using BitComet - res://F:\Moje programy\BitComet\BitComet.exe/AddAllLink.htm O8 - Extra context menu item: Download all videos using BitComet - res://F:\Moje programy\BitComet\BitComet.exe/AddVideo.htm O8 - Extra context menu item: Download link using &BitComet - res://F:\Moje programy\BitComet\BitComet.exe/AddLink.htm O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://F:\MOJEPR~1\OFFICE~1\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - F:\MOJEPR~1\OFFICE~1\OFFICE11\REFIEBAR.DLL O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra button: Wybierz kierunek tłumaczenia - {CCCE5D70-9AA2-40F1-9C6B-12A255F08500} - F:\Moje programy\Translatica 4\Translatica Integration\bin\win\int\browser\iepolengextension.dll (HKCU) O9 - Extra 'Tools' menuitem: Wybierz kierunek tłumaczenia - {CCCE5D70-9AA2-40F1-9C6B-12A255F08500} - F:\Moje programy\Translatica 4\Translatica Integration\bin\win\int\browser\iepolengextension.dll (HKCU) O9 - Extra button: Tłumacz - {CCCE5D71-9AA2-40F1-9C6B-12A255F08500} - F:\Moje programy\Translatica 4\Translatica Integration\bin\win\int\browser\iepolengextension.dll (HKCU) O9 - Extra 'Tools' menuitem: Tłumacz - {CCCE5D71-9AA2-40F1-9C6B-12A255F08500} - F:\Moje programy\Translatica 4\Translatica Integration\bin\win\int\browser\iepolengextension.dll (HKCU) O9 - Extra button: Zachowaj przetłumaczoną stronę - {CCCE5D72-9AA2-40F1-9C6B-12A255F08500} - F:\Moje programy\Translatica 4\Translatica Integration\bin\win\int\browser\iepolengextension.dll (HKCU) O9 - Extra 'Tools' menuitem: Zachowaj przetłumaczoną stronę - {CCCE5D72-9AA2-40F1-9C6B-12A255F08500} - F:\Moje programy\Translatica 4\Translatica Integration\bin\win\int\browser\iepolengextension.dll (HKCU) O9 - Extra button: Opcje - {CCCE5D73-9AA2-40F1-9C6B-12A255F08500} - F:\Moje programy\Translatica 4\Translatica Integration\bin\win\int\browser\iepolengextension.dll (HKCU) O9 - Extra 'Tools' menuitem: Opcje - {CCCE5D73-9AA2-40F1-9C6B-12A255F08500} - F:\Moje programy\Translatica 4\Translatica Integration\bin\win\int\browser\iepolengextension.dll (HKCU) O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://downloads.ewido.net/ewidoOnlineScan.cab O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - F:\Moje programy\Avast!\aswUpdSv.exe O23 - Service: avast! Antivirus - ALWIL Software - F:\Moje programy\Avast!\ashServ.exe O23 - Service: avast! Mail Scanner - Unknown owner - F:\Moje programy\Avast!\ashMaiSv.exe" /service (file missing) O23 - Service: avast! Web Scanner - Unknown owner - F:\Moje programy\Avast!\ashWebSv.exe" /service (file missing) O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe O23 - Service: NBService - Nero AG - F:\Moje programy\Nero 7\Nero BackItUp\NBService.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)

SR

Kod: Zaznacz wszystko: "Silent Runners.vbs", revision 52, http://www.silentrunners.org/ Operating System: Windows XP SP2 Output limited to non-default values, except where indicated by "{++}" Startup items buried in registry: --------------------------------- HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ {++} "CTFMON.EXE" = "C:\WINDOWS\system32\ctfmon.exe" [MS] "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}" = ""C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"" ["Nero AG"] HKLM\Software\Microsoft\Windows\CurrentVersion\Run\ {++} "RTHDCPL" = "RTHDCPL.EXE" ["Realtek Semiconductor Corp."] "NvCplDaemon" = "RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup" [MS] "nwiz" = "nwiz.exe /install" ["NVIDIA Corporation"] "NvMediaCenter" = "RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit" [MS] "CTSysVol" = "C:\Program Files\Creative\SBAudigy2\Surround Mixer\CTSysVol.exe /r" ["Creative Technology Ltd"] "CTDVDDET" = "C:\Program Files\Creative\SBAudigy2\DVDAudio\CTDVDDet.EXE" ["Creative Technology Ltd"] "CTHelper" = "CTHELPER.EXE" ["Creative Technology Ltd"] "SBDrvDet" = "C:\Program Files\Creative\SB Drive Det\SBDrvDet.exe /r" ["Creative Technology Ltd"] "UpdReg" = "C:\WINDOWS\UpdReg.EXE" ["Creative Technology Ltd."] "H2O" = "C:\Program Files\SyncroSoft\Pos\H2O\cledx.exe" ["Team H2O"] "avast!" = "F:\MOJEPR~1\Avast!\ashDisp.exe" ["ALWIL Software"] "vsc32cnf.exe" = "f:\fruity loops\vst, vsti, dx, dxi\edirol vsc\vsc32cnf.exe" ["Roland"] "vscvol.exe" = "f:\fruity loops\vst, vsti, dx, dxi\edirol vsc\vscvol.exe" ["Roland"] "NeroCheck" = "C:\WINDOWS\system32\NeroCheck.exe" ["Ahead Software Gmbh"] "NWEReboot" = "(empty string)" [file not found] "NeroFilterCheck" = "C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" ["Nero AG"] "BearShare" = ""F:\Moje programy\Bear Share\BearShare.exe" /pause" ["Free Peers, Inc."] HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\(Default) = (no title provided) -> {HKLM...CLSID} = "AcroIEHlprObj Class" \InProcServer32\(Default) = "F:\Moje programy\Adobe Rader 6.0\Reader\ActiveX\AcroIEHelper.dll" ["Adobe Systems Incorporated"] {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60}\(Default) = "BitComet ClickCapture" -> {HKLM...CLSID} = "BitComet Helper" \InProcServer32\(Default) = "F:\Moje programy\BitComet\tools\BitCometBHO.dll" ["BitComet"] HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\ "{42071714-76d4-11d1-8b24-00a0c9068ff3}" = "Rozszerzenie CPL kadrowania wyświetlania" -> {HKLM...CLSID} = "Rozszerzenie CPL kadrowania wyświetlania" \InProcServer32\(Default) = "deskpan.dll" [file not found] "{88895560-9AA2-1069-930E-00AA0030EBC8}" = "Rozszerzenie ikony HyperTerminalu" -> {HKLM...CLSID} = "HyperTerminal Icon Ext" \InProcServer32\(Default) = "C:\WINDOWS\system32\hticons.dll" ["Hilgraeve, Inc."] "{A70C977A-BF00-412C-90B7-034C51DA2439}" = "NvCpl DesktopContext Class" -> {HKLM...CLSID} = "DesktopContext Class" \InProcServer32\(Default) = "C:\WINDOWS\system32\nvcpl.dll" ["NVIDIA Corporation"] "{FFB699E0-306A-11d3-8BD1-00104B6F7516}" = "Play on my TV helper" -> {HKLM...CLSID} = "NVIDIA CPL Extension" \InProcServer32\(Default) = "C:\WINDOWS\system32\nvcpl.dll" ["NVIDIA Corporation"] "{1CDB2949-8F65-4355-8456-263E7C208A5D}" = "Desktop Explorer" -> {HKLM...CLSID} = "Desktop Explorer" \InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"] "{1E9B04FB-F9E5-4718-997B-B8DA88302A47}" = "Desktop Explorer Menu" -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"] "{1E9B04FB-F9E5-4718-997B-B8DA88302A48}" = "nView Desktop Context Menu" -> {HKLM...CLSID} = "nView Desktop Context Menu" \InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"] "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" = "WinRAR shell extension" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "F:\Moje programy\WinRAR\rarext.dll" [null data] "{00020D75-0000-0000-C000-000000000046}" = "Microsoft Office Outlook Desktop Icon Handler" -> {HKLM...CLSID} = "Microsoft Office Outlook" \InProcServer32\(Default) = "F:\MOJEPR~1\OFFICE~1\OFFICE11\MLSHEXT.DLL" [MS] "{0006F045-0000-0000-C000-000000000046}" = "Microsoft Office Outlook Custom Icon Handler" -> {HKLM...CLSID} = "Rozszerzenie ikon plików programu Outlook" \InProcServer32\(Default) = "F:\MOJEPR~1\OFFICE~1\OFFICE11\OLKFSTUB.DLL" [MS] "{42042206-2D85-11D3-8CFF-005004838597}" = "Microsoft Office HTML Icon Handler" -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "F:\Moje programy\Office 2003\OFFICE11\msohev.dll" [MS] "{472083B0-C522-11CF-8763-00608CC02F24}" = "avast" -> {HKLM...CLSID} = "avast" \InProcServer32\(Default) = "F:\Moje programy\Avast!\ashShell.dll" ["ALWIL Software"] HKLM\Software\Classes\PROTOCOLS\Filter\ <<!>> text/xml\CLSID = "{807553E5-5146-11D5-A672-00B0D022E945}" -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL" [MS] HKLM\Software\Classes\*\shellex\ContextMenuHandlers\ avast\(Default) = "{472083B0-C522-11CF-8763-00608CC02F24}" -> {HKLM...CLSID} = "avast" \InProcServer32\(Default) = "F:\Moje programy\Avast!\ashShell.dll" ["ALWIL Software"] WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "F:\Moje programy\WinRAR\rarext.dll" [null data] HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\ WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "F:\Moje programy\WinRAR\rarext.dll" [null data] HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\ avast\(Default) = "{472083B0-C522-11CF-8763-00608CC02F24}" -> {HKLM...CLSID} = "avast" \InProcServer32\(Default) = "F:\Moje programy\Avast!\ashShell.dll" ["ALWIL Software"] WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "F:\Moje programy\WinRAR\rarext.dll" [null data] Group Policies {GPedit.msc branch and setting}: ----------------------------------------------- Note: detected settings may not have any effect. HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\ "shutdownwithoutlogon" = (REG_DWORD) hex:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| Shutdown: Allow system to be shut down without having to log on} "undockwithoutlogon" = (REG_DWORD) hex:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| Devices: Allow undock without having to log on} Active Desktop and Wallpaper: ----------------------------- Active Desktop may be disabled at this entry: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState Displayed if Active Desktop enabled and wallpaper not set by Group Policy: HKCU\Software\Microsoft\Internet Explorer\Desktop\General\ "Wallpaper" = "C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp" Displayed if Active Desktop disabled and wallpaper not set by Group Policy: HKCU\Control Panel\Desktop\ "Wallpaper" = "C:\Documents and Settings\Damiano\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp" Startup items in "Damiano" & "All Users" startup folders: --------------------------------------------------------- C:\Documents and Settings\All Users\Menu Start\Programy\Autostart "D-Link AirPlus" -> shortcut to: "C:\Program Files\D-Link AirPlus\AirPlus.exe" ["D-Link"] Winsock2 Service Provider DLLs: ------------------------------- Namespace Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++} 000000000001\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS] 000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS] 000000000003\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS] Transport Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++} 0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range: %SystemRoot%\system32\mswsock.dll [MS], 01 - 03, 06 - 13 %SystemRoot%\system32\rsvpsp.dll [MS], 04 - 05 Toolbars, Explorer Bars, Extensions: ------------------------------------ Explorer Bars HKLM\Software\Microsoft\Internet Explorer\Explorer Bars\ HKLM\Software\Classes\CLSID\{FF059E31-CC5A-4E2E-BF3B-96E929D65503}\(Default) = "&Badanie" Implemented Categories\{00021493-0000-0000-C000-000000000046}\ [vertical bar] InProcServer32\(Default) = "F:\MOJEPR~1\OFFICE~1\OFFICE11\REFIEBAR.DLL" [MS] Extensions (Tools menu items, main toolbar menu buttons) HKCU\Software\Microsoft\Internet Explorer\Extensions\ {CCCE5D70-9AA2-40F1-9C6B-12A255F08500}\ "ButtonText" = "Wybierz kierunek tłumaczenia" "MenuText" = "Wybierz kierunek tłumaczenia" "CLSIDExtension" = "{CC4371F0-D2F6-11D7-BDC4-00605209B788}" -> {HKCU...CLSID} = (no title provided) \InProcServer32\(Default) = "F:\Moje programy\Translatica 4\Translatica Integration\bin\win\int\browser\iepolengextension.dll" ["POLENG"] {CCCE5D71-9AA2-40F1-9C6B-12A255F08500}\ "ButtonText" = "Tłumacz" "MenuText" = "Tłumacz" "CLSIDExtension" = "{CC4371F1-D2F6-11D7-BDC4-00605209B788}" -> {HKCU...CLSID} = (no title provided) \InProcServer32\(Default) = "F:\Moje programy\Translatica 4\Translatica Integration\bin\win\int\browser\iepolengextension.dll" ["POLENG"] {CCCE5D72-9AA2-40F1-9C6B-12A255F08500}\ "ButtonText" = "Zachowaj przetłumaczoną stronę" "MenuText" = "Zachowaj przetłumaczoną stronę" "CLSIDExtension" = "{CC4371F2-D2F6-11D7-BDC4-00605209B788}" -> {HKCU...CLSID} = (no title provided) \InProcServer32\(Default) = "F:\Moje programy\Translatica 4\Translatica Integration\bin\win\int\browser\iepolengextension.dll" ["POLENG"] {CCCE5D73-9AA2-40F1-9C6B-12A255F08500}\ "ButtonText" = "Opcje" "MenuText" = "Opcje" "CLSIDExtension" = "{CC4371F3-D2F6-11D7-BDC4-00605209B788}" -> {HKCU...CLSID} = (no title provided) \InProcServer32\(Default) = "F:\Moje programy\Translatica 4\Translatica Integration\bin\win\int\browser\iepolengextension.dll" ["POLENG"] HKLM\Software\Microsoft\Internet Explorer\Extensions\ {92780B25-18CC-41C8-B9BE-3C9C571A8263}\ "ButtonText" = "Badanie" {FB5F1910-F110-11D2-BB9E-00C04F795683}\ "ButtonText" = "Messenger" "MenuText" = "Windows Messenger" "Exec" = "C:\Program Files\Messenger\msmsgs.exe" [MS] Running Services (Display Name, Service Name, Path {Service DLL}): ------------------------------------------------------------------ avast! Antivirus, avast! Antivirus, ""F:\Moje programy\Avast!\ashServ.exe"" ["ALWIL Software"] avast! iAVS4 Control Service, aswUpdSv, ""F:\Moje programy\Avast!\aswUpdSv.exe"" ["ALWIL Software"] avast! Mail Scanner, avast! Mail Scanner, ""F:\Moje programy\Avast!\ashMaiSv.exe" /service" ["ALWIL Software"] avast! Web Scanner, avast! Web Scanner, ""F:\Moje programy\Avast!\ashWebSv.exe" /service" ["ALWIL Software"] Creative Service for CDROM Access, Creative Service for CDROM Access, "C:\WINDOWS\system32\CTsvcCDA.exe" ["Creative Technology Ltd"] NVIDIA Display Driver Service, NVSvc, "C:\WINDOWS\system32\nvsvc32.exe" ["NVIDIA Corporation"] Windows User Mode Driver Framework, UMWdf, "C:\WINDOWS\system32\wdfmgr.exe" [MS] WMDM PMSP Service, WMDM PMSP Service, "C:\WINDOWS\system32\MsPMSPSv.exe" [MS] Print Monitors: --------------- HKLM\System\CurrentControlSet\Control\Print\Monitors\ Microsoft Document Imaging Writer Monitor\Driver = "mdimon.dll" [MS] ---------- (launch time: 2006-08-17 15:42:53) <<!>>: Suspicious data at a malware launch point. + This report excludes default entries except where indicated. + To see *everywhere* the script checks and *everything* it finds, launch it from a command prompt or a shortcut with the -all parameter. + To search all directories of local fixed drives for DESKTOP.INI DLL launch points, use the -supp parameter or answer "No" at the first message box and "Yes" at the second message box. ---------- (total run time: 38 seconds, including 4 seconds for message boxes)

CF

Kod: Zaznacz wszystko: ComboFix 07-08-14.4 - "Damiano" 2006-08-17 15:45:03.9 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.245 [GMT 2:00] ((((((((((((((((((((((((( Files Created from 2006-07-17 to 2006-08-17 ))))))))))))))))))))))))))))))) 2006-08-14 11:06 51,200 --a------ C:\WINDOWS\nircmd.exe 2006-08-13 19:08 <DIR> d-------- C:\WINDOWS\pss 2006-08-13 17:55 <DIR> d---s---- C:\DOCUME~1\Damiano\UserData 2006-08-09 14:12 <DIR> d-------- C:\DOCUME~1\Damiano\DANEAP~1\n-Track Studio5 2006-08-09 14:09 5,365,760 --a------ C:\DOCUME~1\Damiano\ntuser.dat 2006-08-01 15:55 0 --ah----- C:\DOCUME~1\Damiano\DANEAP~1\.8D6EC6526E113FCC.sys 2006-08-01 15:54 0 --ah----- C:\DOCUME~1\Damiano\DANEAP~1\.8D6EC6526E113FCB.sys 2006-07-31 19:23 0 --ah----- C:\DOCUME~1\Damiano\DANEAP~1\.8D6EC65272B730B3.sys 2006-07-31 14:39 <DIR> d-------- C:\DOCUME~1\Damiano\Storm Shared Folder 2006-07-26 00:31 <DIR> d-------- C:\DOCUME~1\Damiano\DANEAP~1\Gadu-Gadu (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) 2007-09-30 00:00 536576 --a------ C:\WINDOWS\system32\MSVCR70d.dll 2007-05-05 23:47 --------- d-------- C:\Program Files\DivX 2007-04-30 17:46 745600 --a------ C:\WINDOWS\system32\aswBoot.exe 2007-04-30 17:41 94552 --a------ C:\WINDOWS\system32\drivers\aswmon2.sys 2007-04-30 17:41 85952 --a------ C:\WINDOWS\system32\drivers\aswmon.sys 2007-04-30 17:39 23416 --a------ C:\WINDOWS\system32\drivers\aswRdr.sys 2007-04-30 17:38 43176 --a------ C:\WINDOWS\system32\drivers\aswTdi.sys 2007-04-30 17:37 26888 --a------ C:\WINDOWS\system32\drivers\aavmker4.sys 2007-04-30 17:35 95872 --a------ C:\WINDOWS\system32\AVASTSS.scr 2007-04-16 22:47 33624 --a--c--- C:\WINDOWS\system32\dllcache\wups.dll 2007-04-16 22:47 33624 --a------ C:\WINDOWS\system32\wups.dll 2007-04-16 22:45 92504 --a--c--- C:\WINDOWS\system32\dllcache\cdm.dll 2007-04-16 22:45 92504 --a------ C:\WINDOWS\system32\cdm.dll 2007-04-16 22:45 549720 --a--c--- C:\WINDOWS\system32\dllcache\wuapi.dll 2007-04-16 22:45 549720 --a------ C:\WINDOWS\system32\wuapi.dll 2007-04-16 22:45 53080 --a--c--- C:\WINDOWS\system32\dllcache\wuauclt.exe 2007-04-16 22:45 53080 --a------ C:\WINDOWS\system32\wuauclt.exe 2007-04-16 22:45 43352 --a------ C:\WINDOWS\system32\wups2.dll 2007-04-16 22:45 325976 --a--c--- C:\WINDOWS\system32\dllcache\wucltui.dll 2007-04-16 22:45 325976 --a------ C:\WINDOWS\system32\wucltui.dll 2007-04-16 22:45 203096 --a--c--- C:\WINDOWS\system32\dllcache\wuweb.dll 2007-04-16 22:45 203096 --a------ C:\WINDOWS\system32\wuweb.dll 2007-04-16 22:45 1710936 --a--c--- C:\WINDOWS\system32\dllcache\wuaueng.dll 2007-04-16 22:45 1710936 --a------ C:\WINDOWS\system32\wuaueng.dll 2007-03-28 17:51 --------- d-------- C:\DOCUME~1\Damiano\DANEAP~1\Creative 2007-03-17 15:45 293376 --a--c--- C:\WINDOWS\system32\dllcache\winsrv.dll 2007-03-17 15:45 293376 --a------ C:\WINDOWS\system32\winsrv.dll 2007-03-09 15:48 57344 --a--c--- C:\WINDOWS\system32\dllcache\agentdpv.dll 2007-03-08 17:38 579072 --a--c--- C:\WINDOWS\system32\dllcache\user32.dll 2007-03-08 17:38 579072 --a------ C:\WINDOWS\system32\user32.dll 2007-03-08 17:38 40960 --a--c--- C:\WINDOWS\system32\dllcache\mf3216.dll 2007-03-08 17:38 40960 --a------ C:\WINDOWS\system32\mf3216.dll 2007-03-08 17:38 281600 --a--c--- C:\WINDOWS\system32\dllcache\gdi32.dll 2007-03-08 17:38 281600 --a------ C:\WINDOWS\system32\gdi32.dll 2007-03-08 17:37 1843840 --a--c--- C:\WINDOWS\system32\dllcache\win32k.sys 2007-03-08 17:37 1843840 --a------ C:\WINDOWS\system32\win32k.sys 2007-02-28 18:04 2181632 -----c--- C:\WINDOWS\system32\dllcache\ntoskrnl.exe 2007-02-28 18:04 2137600 -----c--- C:\WINDOWS\system32\dllcache\ntkrnlmp.exe 2007-02-28 18:04 2058880 -----c--- C:\WINDOWS\system32\dllcache\ntkrnlpa.exe 2007-02-28 18:04 2017280 -----c--- C:\WINDOWS\system32\dllcache\ntkrpamp.exe 2007-02-19 23:51 --------- d-------- C:\Program Files\Rapidown 2007-02-17 00:26 833092 --a------ C:\WINDOWS\Reverence VST plug-in Uninstaller.exe 2007-02-12 14:42 5 --ahs---- C:\WINDOWS\system32\baefcbba7_s.dll 2007-02-12 13:27 --------- d-------- C:\DOCUME~1\Damiano\DANEAP~1\Ableton 2007-02-05 22:19 185856 --a--c--- C:\WINDOWS\system32\dllcache\upnphost.dll 2007-02-05 22:19 185856 --a------ C:\WINDOWS\system32\upnphost.dll 2007-02-02 21:42 --------- d-------- C:\DOCUME~1\Damiano\DANEAP~1\Media Player Classic 2007-01-28 15:29 --------- d-------- C:\DOCUME~1\Damiano\DANEAP~1\Ahead 2007-01-25 15:05 616448 --a--c--- C:\WINDOWS\system32\dllcache\urlmon.dll 2007-01-24 19:46 --------- d-------- C:\Program Files\Common Files\Ahead 2007-01-16 21:06 --------- d-------- C:\DOCUME~1\Damiano\DANEAP~1\POLENG4 2007-01-14 19:40 --------- d-------- C:\Program Files\Common Files\InstallShield 2007-01-13 10:23 --------- d-------- C:\Program Files\K-Lite Codec Pack 2007-01-13 10:23 --------- d-------- C:\Program Files\ffdshow 2007-01-13 10:23 --------- d-------- C:\DOCUME~1\Damiano\DANEAP~1\Real 2007-01-12 18:27 --------- d-------- C:\Program Files\Image-Line 2007-01-06 19:09 --------- d-------- C:\DOCUME~1\Damiano\DANEAP~1\Steinberg 2007-01-06 16:30 2560 --a------ C:\WINDOWS\system32\BitCometRes.dll 2007-01-04 15:58 661504 --a--c--- C:\WINDOWS\system32\dllcache\wininet.dll 2007-01-04 15:58 474112 --a--c--- C:\WINDOWS\system32\dllcache\shlwapi.dll 2007-01-04 15:57 96768 --a--c--- C:\WINDOWS\system32\dllcache\inseng.dll 2007-01-04 15:57 55808 --a--c--- C:\WINDOWS\system32\dllcache\extmgr.dll 2007-01-04 15:57 532480 --a--c--- C:\WINDOWS\system32\dllcache\mstime.dll 2007-01-04 15:57 448512 --a--c--- C:\WINDOWS\system32\dllcache\mshtmled.dll 2007-01-04 15:57 39424 --a--c--- C:\WINDOWS\system32\dllcache\pngfilt.dll 2007-01-04 15:57 357888 --a--c--- C:\WINDOWS\system32\dllcache\dxtmsft.dll 2007-01-04 15:57 3077632 --a--c--- C:\WINDOWS\system32\dllcache\mshtml.dll 2007-01-04 15:57 251392 --a--c--- C:\WINDOWS\system32\dllcache\iepeers.dll 2007-01-04 15:57 205312 --a--c--- C:\WINDOWS\system32\dllcache\dxtrans.dll 2007-01-04 15:57 16384 --a--c--- C:\WINDOWS\system32\dllcache\jsproxy.dll 2007-01-04 15:57 151552 --a--c--- C:\WINDOWS\system32\dllcache\cdfview.dll 2007-01-04 15:57 1494528 --a--c--- C:\WINDOWS\system32\dllcache\shdocvw.dll 2007-01-04 15:57 146432 --a--c--- C:\WINDOWS\system32\dllcache\msrating.dll 2007-01-04 15:57 1055744 --a--c--- C:\WINDOWS\system32\dllcache\danim.dll 2007-01-04 15:57 1023488 --a--c--- C:\WINDOWS\system32\dllcache\browseui.dll 2007-01-04 12:36 18432 --a--c--- C:\WINDOWS\system32\dllcache\iedw.exe 2006-12-26 21:13 --------- d-------- C:\Program Files\ahead 2006-12-26 15:09 536576 --a--c--- C:\WINDOWS\system32\dllcache\msado15.dll 2006-12-26 15:09 200704 --a--c--- C:\WINDOWS\system32\dllcache\msadox.dll 2006-12-26 15:09 180224 --a--c--- C:\WINDOWS\system32\dllcache\msadomd.dll 2006-12-26 15:09 102400 --a--c--- C:\WINDOWS\system32\dllcache\msjro.dll 2006-12-23 19:43 --------- d-------- C:\Program Files\Common Files\Wise Installation Wizard 2006-12-23 19:09 1025 --a------ C:\WINDOWS\system32\sysprs7.dll 2006-12-23 19:09 1025 --a------ C:\WINDOWS\system32\clauth2.dll 2006-12-23 19:09 1025 --a------ C:\WINDOWS\system32\clauth1.dll 2006-12-23 17:31 --------- d-------- C:\Program Files\Messenger 2006-12-23 15:28 --------- d-------- C:\Program Files\Syncrosoft 2006-12-22 23:43 --------- d-------- C:\Program Files\ASIO4ALL v2 2006-12-22 22:31 --------- d-------- C:\Program Files\Skype 2006-12-22 22:30 --------- d-------- C:\DOCUME~1\Damiano\DANEAP~1\Tlen.pl 2006-12-22 22:20 --------- d-------- C:\Program Files\Common Files\Skype 2006-12-22 20:47 368640 --a------ C:\WINDOWS\system32\rewire.dll 2006-12-22 20:11 --------- d-------- C:\Program Files\D-Link AirPlus 2006-12-19 23:51 8482304 --a--c--- C:\WINDOWS\system32\dllcache\shell32.dll 2006-12-19 23:51 135168 --a--c--- C:\WINDOWS\system32\dllcache\shsvcs.dll 2006-12-19 20:18 334336 --a--c--- C:\WINDOWS\system32\dllcache\wiaservc.dll 2006-12-19 20:09 852480 --a--c--- C:\WINDOWS\system32\dllcache\vgx.dll 2006-12-16 13:57 --------- d-------- C:\Program Files\Common Files\KORG 2006-12-16 13:29 --------- d-------- C:\Program Files\URS 2006-12-16 13:12 --------- d-------- C:\Program Files\Common Files\iZotope ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "RTHDCPL"="RTHDCPL.EXE" [2005-09-22 07:36 C:\WINDOWS\RTHDCPL.exe] "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2005-07-20 15:07] "nwiz"="nwiz.exe" [2005-07-20 15:07 C:\WINDOWS\system32\nwiz.exe] "NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2005-07-20 15:07] "CTSysVol"="C:\Program Files\Creative\SBAudigy2\Surround Mixer\CTSysVol.exe" [2003-09-17 11:43] "CTDVDDET"="C:\Program Files\Creative\SBAudigy2\DVDAudio\CTDVDDet.EXE" [2003-06-18 02:00] "CTHelper"="CTHELPER.EXE" [2004-03-19 10:33 C:\WINDOWS\system32\CTHELPER.EXE] "SBDrvDet"="C:\Program Files\Creative\SB Drive Det\SBDrvDet.exe" [2002-12-03 19:06] "UpdReg"="C:\WINDOWS\UpdReg.EXE" [2000-05-11 02:00] "H2O"="C:\Program Files\SyncroSoft\Pos\H2O\cledx.exe" [2005-11-01 01:00] "avast!"="F:\MOJEPR~1\Avast!\ashDisp.exe" [2007-04-30 17:42] "vsc32cnf.exe"="f:\fruity loops\vst" [] "vscvol.exe"="f:\fruity loops\vst" [] "NeroCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 11:50] "NWEReboot"="" [] "NeroFilterCheck"="C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-12 17:40] "BearShare"="F:\Moje programy\Bear Share\BearShare.exe" [2006-07-29 04:48] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:44] "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2006-08-30 16:05] [HKEY_USERS\.default\software\microsoft\windows\currentversion\runonce] "nlsf"=cmd.exe /C move /Y "%SystemRoot%\System32\syssetub.dll" "%SystemRoot%\System32\syssetup.dll" "tscuninstall"=%systemroot%\system32\tscupgrd.exe C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\ D-Link AirPlus.lnk - C:\Program Files\D-Link AirPlus\AirPlus.exe [2006-12-22 20:11:08] R0 iteraid;ITERAID_Service_Install;C:\WINDOWS\system32\DRIVERS\iteraid.sys R1 Asapi;Asapi;C:\WINDOWS\system32\drivers\Asapi.sys R2 RVIEGVST;VSC VST Engine;\??\F:\Fruity Loops\VST, VSTi, DX, DXi\Edirol VSC\RVIEg01VST.sys R2 Vcs;Vcs support;\??\C:\WINDOWS\system32\Drivers\Vcs.sys R3 AIRPLUS;D-Link AirPlus Wireless Adapter;C:\WINDOWS\system32\DRIVERS\airplus.sys R3 CLEDX;Team H2O CLEDX service;C:\WINDOWS\system32\DRIVERS\cledx.sys R3 vsc32;Virtual Sound Canvas 3.2;C:\WINDOWS\system32\DRIVERS\vsc.sys S3 GVCplDrv;GVCplDrv;C:\WINDOWS\system32\drivers\GVCplDrv.sys S3 NPF;NetGroup Packet Filter Driver;C:\WINDOWS\system32\drivers\npf.sys [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\D] AutoRun\command- D:\Autorun.exe ************************************************************************** catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2006-08-17 15:45:52 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** Completion time: 2006-08-17 15:46:31 C:\ComboFix2.txt ... 2006-08-17 00:01 C:\ComboFix3.txt ... 2006-08-16 15:28 --- E O F ---

**Posty:** 18165 · przez **wojtas** 17 Sie 2007, 16:38

piotrp_1990 napisał(a):a to?

jest prawidlowe

Start>uruchom>msconfig>zakladka uruchamianie> wylacz progsy które nie chcesz żeby startowaly z systemem przyspieszy Ci to wlaczanie kompa

**Posty:** 756 · przez **piotrp_1990** 17 Sie 2007, 19:30

więc jak nic nie da sie zrobić?? w logach nic nie ma??

dalej jest to samo co bylo, odznaczylem prawie wszystko czego nie znam w msconfig ale nie jest dalej tak jak powinno byc :cry:

**Posty:** 18165 · przez **wojtas** 17 Sie 2007, 20:16

proponuje skasowac te pliki moze cos pomoze:

C:\DOCUME~1\Damiano\DANEAP~1\.8D6EC6526E113FCC.sys
C:\DOCUME~1\Damiano\DANEAP~1\.8D6EC6526E113FCB.sys
C:\DOCUME~1\Damiano\DANEAP~1\.8D6EC65272B730B3.sys

prosze o szybka pomoc - system sie sypie

prosze o szybka pomoc - system sie sypie

Kto jest na forum