Straszne lagi

**Posty:** 378 · przez **TARCZYN** 13 Wrz 2008, 20:39

zawiechy kompa itp:

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 20:36:07, on 2008-09-13 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\RUNDLL32.EXE C:\Program Files\Winamp\winampa.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\AutoConnect\AutoConnect.exe C:\Program Files\Winamp\winamp.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Gadu-Gadu\gg.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza R3 - URLSearchHook: Winamp Search Class - {57BCA5FA-5DBB-45a2-B558-1755C3F6253B} - C:\Program Files\Winamp Toolbar\winamptb.dll R3 - URLSearchHook: SearchSettings Class - {E312764E-7706-43F1-8DAB-FCDD2B1E416D} - C:\Program Files\Search Settings\kb127\SearchSettings.dll O2 - BHO: Winamp Toolbar Loader - {25CEE8EC-5730-41bc-8B58-22DDC8AB8C20} - C:\Program Files\Winamp Toolbar\winamptb.dll O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll O2 - BHO: DealioBHO Class - {6A87B991-A31F-4130-AE72-6D0C294BF082} - C:\Program Files\Dealio\kb127\Dealio.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O2 - BHO: SearchSettings Class - {E312764E-7706-43F1-8DAB-FCDD2B1E416D} - C:\Program Files\Search Settings\kb127\SearchSettings.dll O3 - Toolbar: Winamp Toolbar - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - C:\Program Files\Winamp Toolbar\winamptb.dll O3 - Toolbar: Dealio - {E67C74F4-A00A-4F2C-9FEC-FD9DC004A67F} - C:\Program Files\Dealio\kb127\Dealio.dll O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe" O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - HKCU\..\Run: [AutoConnect] C:\Program Files\AutoConnect\AutoConnect.exe O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O8 - Extra context menu item: &Winamp Search - C:\Documents and Settings\All Users\Dane aplikacji\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html O8 - Extra context menu item: Compare Prices with &Dealio - C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\res\DealioSearch.html O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll O9 - Extra button: Dealio - {E908B145-C847-4e85-B315-07E2E70DECF8} - C:\Program Files\Dealio\kb127\Dealio.dll O9 - Extra 'Tools' menuitem: Dealio - {E908B145-C847-4e85-B315-07E2E70DECF8} - C:\Program Files\Dealio\kb127\Dealio.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O17 - HKLM\System\CCS\Services\Tcpip\..\{5D18A429-CB60-472D-8E8F-9D8EA3046305}: NameServer = 194.204.152.34 217.98.63.164 O17 - HKLM\System\CS1\Services\Tcpip\..\{5D18A429-CB60-472D-8E8F-9D8EA3046305}: NameServer = 194.204.152.34 217.98.63.164 O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe -- End of file - 5112 bytes "Silent Runners.vbs", revision 58, http://www.silentrunners.org/ Operating System: Windows XP SP2 Output limited to non-default values, except where indicated by "{++}" Startup items buried in registry: --------------------------------- HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ {++} "CTFMON.EXE" = "C:\WINDOWS\system32\ctfmon.exe" [MS] "Gadu-Gadu" = ""C:\Program Files\Gadu-Gadu\gg.exe" /tray" ["Gadu-Gadu S.A."] "AutoConnect" = "C:\Program Files\AutoConnect\AutoConnect.exe" ["http://autoconnect.prv.pl"] "SpybotSD TeaTimer" = "C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" ["Safer Networking Limited"] "MSMSGS" = ""C:\Program Files\Messenger\msmsgs.exe" /background" [MS] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++} "NvCplDaemon" = "RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup" [MS] "nwiz" = "nwiz.exe /install" ["NVIDIA Corporation"] "NvMediaCenter" = "RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit" [MS] "SoundMan" = "SOUNDMAN.EXE" ["Realtek Semiconductor Corp."] "WinampAgent" = ""C:\Program Files\Winamp\winampa.exe"" [null data] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ {25CEE8EC-5730-41bc-8B58-22DDC8AB8C20}\(Default) = "Winamp Toolbar Loader" -> {HKLM...CLSID} = "Winamp Toolbar Loader" \InProcServer32\(Default) = "C:\Program Files\Winamp Toolbar\winamptb.dll" ["AOL LLC."] {53707962-6F74-2D53-2644-206D7942484F}\(Default) = (no title provided) -> {HKLM...CLSID} = "Spybot-S&D IE Protection" \InProcServer32\(Default) = "C:\Program Files\Spybot - Search & Destroy\SDHelper.dll" ["Safer Networking Limited"] {6A87B991-A31F-4130-AE72-6D0C294BF082}\(Default) = (no title provided) -> {HKLM...CLSID} = "DealioBHO Class" \InProcServer32\(Default) = "C:\Program Files\Dealio\kb127\Dealio.dll" ["Vendio Services, Inc."] {761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\(Default) = (no title provided) -> {HKLM...CLSID} = "SSVHelper Class" \InProcServer32\(Default) = "C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll" ["Sun Microsystems, Inc."] {E312764E-7706-43F1-8DAB-FCDD2B1E416D}\(Default) = (no title provided) -> {HKLM...CLSID} = "SearchSettings Class" \InProcServer32\(Default) = "C:\Program Files\Search Settings\kb127\SearchSettings.dll" ["Vendio Services, Inc."] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\ "{42071714-76d4-11d1-8b24-00a0c9068ff3}" = "Rozszerzenie CPL kadrowania wyświetlania" -> {HKLM...CLSID} = "Rozszerzenie CPL kadrowania wyświetlania" \InProcServer32\(Default) = "deskpan.dll" [file not found] "{88895560-9AA2-1069-930E-00AA0030EBC8}" = "Rozszerzenie ikony HyperTerminalu" -> {HKLM...CLSID} = "HyperTerminal Icon Ext" \InProcServer32\(Default) = "C:\WINDOWS\system32\hticons.dll" ["Hilgraeve, Inc."] "{A70C977A-BF00-412C-90B7-034C51DA2439}" = "NvCpl DesktopContext Class" -> {HKLM...CLSID} = "DesktopContext Class" \InProcServer32\(Default) = "C:\WINDOWS\system32\nvcpl.dll" ["NVIDIA Corporation"] "{FFB699E0-306A-11d3-8BD1-00104B6F7516}" = "Play on my TV helper" -> {HKLM...CLSID} = "NVIDIA CPL Extension" \InProcServer32\(Default) = "C:\WINDOWS\system32\nvcpl.dll" ["NVIDIA Corporation"] "{1CDB2949-8F65-4355-8456-263E7C208A5D}" = "Desktop Explorer" -> {HKLM...CLSID} = "Desktop Explorer" \InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"] "{1E9B04FB-F9E5-4718-997B-B8DA88302A47}" = "Desktop Explorer Menu" -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"] "{1E9B04FB-F9E5-4718-997B-B8DA88302A48}" = "nView Desktop Context Menu" -> {HKLM...CLSID} = "nView Desktop Context Menu" \InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"] "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" = "WinRAR shell extension" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] "{00020D75-0000-0000-C000-000000000046}" = "Microsoft Office Outlook Desktop Icon Handler" -> {HKLM...CLSID} = "Microsoft Office Outlook" \InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\OFFICE11\MLSHEXT.DLL" [MS] "{0006F045-0000-0000-C000-000000000046}" = "Microsoft Office Outlook Custom Icon Handler" -> {HKLM...CLSID} = "Rozszerzenie ikon plików programu Outlook" \InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\OFFICE11\OLKFSTUB.DLL" [MS] "{42042206-2D85-11D3-8CFF-005004838597}" = "Microsoft Office HTML Icon Handler" -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "C:\Program Files\Microsoft Office\OFFICE11\msohev.dll" [MS] HKLM\SOFTWARE\Classes\PROTOCOLS\Filter\ <<!>> text/xml\CLSID = "{807553E5-5146-11D5-A672-00B0D022E945}" -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL" [MS] HKLM\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\ WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] HKLM\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\ WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] HKLM\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\ WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] Group Policies {GPedit.msc branch and setting}: ----------------------------------------------- Note: detected settings may not have any effect. HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ "shutdownwithoutlogon" = (REG_DWORD) dword:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| Shutdown: Allow system to be shut down without having to log on} "undockwithoutlogon" = (REG_DWORD) dword:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| Devices: Allow undock without having to log on} Active Desktop and Wallpaper: ----------------------------- Active Desktop may be disabled at this entry: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState Displayed if Active Desktop enabled and wallpaper not set by Group Policy: HKCU\Software\Microsoft\Internet Explorer\Desktop\General\ "Wallpaper" = "C:\WINDOWS\web\wallpaper\Idylla.bmp" Displayed if Active Desktop disabled and wallpaper not set by Group Policy: HKCU\Control Panel\Desktop\ "Wallpaper" = "C:\WINDOWS\web\wallpaper\Idylla.bmp" Windows Portable Device AutoPlay Handlers ----------------------------------------- HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers\Handlers\ MPCPlayCDAudioOnArrival\ "Provider" = "Media Player Classic" "InvokeProgID" = "MediaPlayerClassic.Autorun" "InvokeVerb" = "PlayCDAudio" HKLM\SOFTWARE\Classes\MediaPlayerClassic.Autorun\shell\PlayCDAudio\command\(Default) = ""C:\Program Files\K-Lite Codec Pack\Media Player Classic\mplayerc.exe" %1 /cd" ["Gabest"] MPCPlayDVDMovieOnArrival\ "Provider" = "Media Player Classic" "InvokeProgID" = "MediaPlayerClassic.Autorun" "InvokeVerb" = "PlayDVDMovie" HKLM\SOFTWARE\Classes\MediaPlayerClassic.Autorun\shell\PlayDVDMovie\command\(Default) = ""C:\Program Files\K-Lite Codec Pack\Media Player Classic\mplayerc.exe" %1 /dvd" ["Gabest"] MPCPlayMusicFilesOnArrival\ "Provider" = "Media Player Classic" "InvokeProgID" = "MediaPlayerClassic.Autorun" "InvokeVerb" = "PlayMusicFiles" HKLM\SOFTWARE\Classes\MediaPlayerClassic.Autorun\shell\PlayMusicFiles\command\(Default) = ""C:\Program Files\K-Lite Codec Pack\Media Player Classic\mplayerc.exe" %1" ["Gabest"] MPCPlayVideoFilesOnArrival\ "Provider" = "Media Player Classic" "InvokeProgID" = "MediaPlayerClassic.Autorun" "InvokeVerb" = "PlayVideoFiles" HKLM\SOFTWARE\Classes\MediaPlayerClassic.Autorun\shell\PlayVideoFiles\command\(Default) = ""C:\Program Files\K-Lite Codec Pack\Media Player Classic\mplayerc.exe" %1" ["Gabest"] MSPlayCDAudioOnArrival\ "Provider" = "ALLPlayer" "InvokeProgID" = "AllPlayerFile" "InvokeVerb" = "play" HKLM\SOFTWARE\Classes\AllPlayerFile\shell\play\command\(Default) = ""C:\Program Files\ALLPlayer\ALLPlayer.exe" "%1"" ["ALLPlayer"] WinampMTPHandler\ "Provider" = "Winamp" "ProgID" = "Shell.HWEventHandlerShellExecute" "InitCmdLine" = "C:\Program Files\Winamp\winamp.exe" HKLM\SOFTWARE\Classes\Shell.HWEventHandlerShellExecute\CLSID\(Default) = "{FFB8655F-81B9-4fce-B89C-9A6BA76D13E7}" -> {HKLM...CLSID} = "ShellExecute HW Event Handler" \LocalServer32\(Default) = "rundll32.exe shell32.dll,SHCreateLocalServerRunDll {FFB8655F-81B9-4fce-B89C-9A6BA76D13E7}" [MS] WinampPlayMediaOnArrival\ "Provider" = "Winamp" "InvokeProgID" = "Winamp.File" "InvokeVerb" = "Play" HKLM\SOFTWARE\Classes\Winamp.File\shell\Play\command\(Default) = ""C:\Program Files\Winamp\winamp.exe" "%1"" ["Nullsoft"] HKLM\SOFTWARE\Classes\Winamp.File\shell\Play\DropTarget\CLSID = "{46986115-84D6-459c-8F95-52DD653E532E}" -> {HKLM...CLSID} = (no title provided) \LocalServer32\(Default) = ""C:\Program Files\Winamp\winamp.exe"" ["Nullsoft"] Winsock2 Service Provider DLLs: ------------------------------- Namespace Service Providers HKLM\SYSTEM\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++} 000000000001\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS] 000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS] 000000000003\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS] Transport Service Providers HKLM\SYSTEM\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++} 0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range: %SystemRoot%\system32\mswsock.dll [MS], 01 - 04, 07 - 18 %SystemRoot%\system32\rsvpsp.dll [MS], 05 - 06 Toolbars, Explorer Bars, Extensions: ------------------------------------ Toolbars HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\ "{EBF2BA02-9094-4C5A-858B-BB198F3D8DE2}" -> {HKLM...CLSID} = "Winamp Toolbar" \InProcServer32\(Default) = "C:\Program Files\Winamp Toolbar\winamptb.dll" ["AOL LLC."] "{E67C74F4-A00A-4F2C-9FEC-FD9DC004A67F}" -> {HKLM...CLSID} = "Dealio" \InProcServer32\(Default) = "C:\Program Files\Dealio\kb127\Dealio.dll" ["Vendio Services, Inc."] HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ "{EBF2BA02-9094-4C5A-858B-BB198F3D8DE2}" = "Winamp Toolbar" -> {HKLM...CLSID} = "Winamp Toolbar" \InProcServer32\(Default) = "C:\Program Files\Winamp Toolbar\winamptb.dll" ["AOL LLC."] "{E67C74F4-A00A-4F2C-9FEC-FD9DC004A67F}" = (no title provided) -> {HKLM...CLSID} = "Dealio" \InProcServer32\(Default) = "C:\Program Files\Dealio\kb127\Dealio.dll" ["Vendio Services, Inc."] Explorer Bars HKLM\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\ HKLM\SOFTWARE\Classes\CLSID\{FF059E31-CC5A-4E2E-BF3B-96E929D65503}\(Default) = "&Badanie" Implemented Categories\{00021493-0000-0000-C000-000000000046}\ [vertical bar] InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL" [MS] Extensions (Tools menu items, main toolbar menu buttons) HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\ {08B0E5C0-4FCB-11CF-AAA5-00401C608501}\ "MenuText" = "Sun Java Console" "CLSIDExtension" = "{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBC}" -> {HKCU...CLSID} = "Java Plug-in 1.6.0_07" \InProcServer32\(Default) = "C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll" ["Sun Microsystems, Inc."] -> {HKLM...CLSID} = "Java Plug-in 1.6.0_07" \InProcServer32\(Default) = "C:\Program Files\Java\jre1.6.0_07\bin\npjpi160_07.dll" ["Sun Microsystems, Inc."] {92780B25-18CC-41C8-B9BE-3C9C571A8263}\ "ButtonText" = "Badanie" {DFB852A3-47F8-48C4-A200-58CAB36FD2A2}\ "MenuText" = "Spybot - Search && Destroy Configuration" "CLSIDExtension" = "{53707962-6F74-2D53-2644-206D7942484F}" -> {HKLM...CLSID} = "Spybot-S&D IE Protection" \InProcServer32\(Default) = "C:\Program Files\Spybot - Search & Destroy\SDHelper.dll" ["Safer Networking Limited"] {E908B145-C847-4E85-B315-07E2E70DECF8}\ "ButtonText" = "Dealio" "MenuText" = "Dealio" "CLSIDExtension" = "{9F038672-0425-4792-BC9C-36DE3308E8AA}" -> {HKLM...CLSID} = "DealioToolbarHelper Class" \InProcServer32\(Default) = "C:\Program Files\Dealio\kb127\Dealio.dll" ["Vendio Services, Inc."] {FB5F1910-F110-11D2-BB9E-00C04F795683}\ "ButtonText" = "Messenger" "MenuText" = "Windows Messenger" "Exec" = "C:\Program Files\Messenger\msmsgs.exe" [MS] Miscellaneous IE Hijack Points ------------------------------ HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks\ <<H>> "{57BCA5FA-5DBB-45a2-B558-1755C3F6253B}" = (no title provided) -> {HKLM...CLSID} = "Winamp Search Class" \InProcServer32\(Default) = "C:\Program Files\Winamp Toolbar\winamptb.dll" ["AOL LLC."] <<H>> "{E312764E-7706-43F1-8DAB-FCDD2B1E416D}" = (no title provided) -> {HKLM...CLSID} = "SearchSettings Class" \InProcServer32\(Default) = "C:\Program Files\Search Settings\kb127\SearchSettings.dll" ["Vendio Services, Inc."] Running Services (Display Name, Service Name, Path {Service DLL}): ------------------------------------------------------------------ NVIDIA Display Driver Service, NVSvc, "C:\WINDOWS\system32\nvsvc32.exe" ["NVIDIA Corporation"] Windows User Mode Driver Framework, UMWdf, "C:\WINDOWS\system32\wdfmgr.exe" [MS] Print Monitors: --------------- HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors\ Canon BJ Language Monitor PIXMA iP1500\Driver = "CNMLM5y.DLL" ["CANON INC."] Microsoft Document Imaging Writer Monitor\Driver = "mdimon.dll" [MS] ---------- (launch time: 2008-09-13 20:37:33) <<!>>: Suspicious data at a malware launch point. <<H>>: Suspicious data at a browser hijack point. + This report excludes default entries except where indicated. + To see *everywhere* the script checks and *everything* it finds, launch it from a command prompt or a shortcut with the -all parameter. + To search all directories of local fixed drives for DESKTOP.INI DLL launch points, use the -supp parameter or answer "No" at the first message box and "Yes" at the second message box. ---------- (total run time: 27 seconds, including 2 seconds for message boxes)

**Posty:** 684 · przez **djarta** 14 Wrz 2008, 10:13

\InProcServer32\(Default) = "C:\Program Files\Dealio\kb127\Dealio.dll"

Możliwe, że ten folder powoduję Twoje problemy, więc daje go do usuwania.

R3 - URLSearchHook: SearchSettings Class - {E312764E-7706-43F1-8DAB-FCDD2B1E416D} - C:\Program Files\Search Settings\kb127\SearchSettings.dll
O2 - BHO: SearchSettings Class - {E312764E-7706-43F1-8DAB-FCDD2B1E416D} - C:\Program Files\Search Settings\kb127\SearchSettings.dll
O8 - Extra context menu item: &Winamp Search - C:\Documents and Settings\All Users\Dane aplikacji\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html
O9 - Extra button: Dealio - {E908B145-C847-4e85-B315-07E2E70DECF8} - C:\Program Files\Dealio\kb127\Dealio.dll
O9 - Extra 'Tools' menuitem: Dealio - {E908B145-C847-4e85-B315-07E2E70DECF8} - C:\Program Files\Dealio\kb127\Dealio.dll

Te w/w wpisy sfiksuj w Hijacku:
>>Hijack>>scan(Do a system scan only)>>zaznacz je >>Fix checked

Pobierz, ComboFix,ale nie uruchamiaj

Wklej do Notatnika:

Kod: Zaznacz wszystko: Folder:: C:\Program Files\Dealio

>>Plik>>Zapisz jako... >>> CFScript
Przeciągnij i upuść plik CFScript.txt na plik ComboFix.exe
-->

Ma się rozpocząć usuwanie. (i powstanie log).Daj ten log, który powstanie w trakcie usuwania.
Jeśli pójdzie dobrze, to: Po restarcie usuń ręcznie folder C:\Qoobox.

=============================
K.

**Posty:** 378 · przez **TARCZYN** 21 Wrz 2008, 00:04

Kod: Zaznacz wszystko: ComboFix 08-09-20.04 - Marek 2008-09-21 0:01:06.1 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.816 [GMT 2:00] Uruchomiony z: C:\Documents and Settings\Marek\Pulpit\ComboFix.exe Użyto następujących komend :: C:\Documents and Settings\Marek\Pulpit\CFScript.txt * Utworzono nowy punkt przywracania [color=red][b]UWAGA - TEN KOMPUTER NIE MA ZAINSTALOWANEJ KONSOLI ODZYSKIWANIA !![/b][/color] . ((((((((((((((((((((((((( Pliki utworzone od 2008-08-20 do 2008-09-20 ))))))))))))))))))))))))))))))) . 2008-10-15 19:20 . 2008-10-15 19:20 <DIR> d-------- C:\Documents and Settings\Magda\Dane aplikacji\Dev-Cpp 2008-10-02 14:11 . 2004-03-22 17:17 24,816 --a------ C:\WINDOWS\system32\mdimon.dll 2008-10-02 14:11 . 2008-09-18 21:27 421 --a------ C:\WINDOWS\ODBC.INI 2008-10-02 14:10 . 2008-10-02 14:10 <DIR> d-------- C:\Program Files\Microsoft.NET 2008-10-02 14:09 . 2008-10-02 14:10 <DIR> d-------- C:\WINDOWS\SHELLNEW 2008-10-01 20:51 . 2008-10-01 20:51 <DIR> d--h----- C:\BJPrinter 2008-10-01 20:51 . 2004-04-23 17:00 116,736 --a------ C:\WINDOWS\system32\CNMLM5y.DLL 2008-10-01 20:51 . 2004-04-23 17:00 7,680 --a------ C:\WINDOWS\system32\CNMVS5y.DLL 2008-10-01 20:48 . 2004-08-03 23:01 25,856 --a------ C:\WINDOWS\system32\drivers\usbprint.sys 2008-10-01 20:48 . 2004-08-03 23:01 25,856 --a--c--- C:\WINDOWS\system32\dllcache\usbprint.sys 2008-10-01 00:58 . 2008-10-01 00:58 <DIR> d-------- C:\Documents and Settings\Marek\Dane aplikacji\Search Settings 2008-09-30 16:45 . 2008-09-30 16:45 <DIR> d-------- C:\Program Files\Spybot - Search & Destroy 2008-09-30 16:45 . 2008-09-30 18:28 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Spybot - Search & Destroy 2008-09-30 16:11 . 2008-09-30 16:16 <DIR> d-------- C:\Program Files\eMule 2008-09-30 16:04 . 2008-09-30 16:04 <DIR> d-------- C:\Program Files\Search Settings 2008-09-30 16:03 . 2008-09-30 16:03 <DIR> d-------- C:\Documents and Settings\Marek\Dane aplikacji\Dealio 2008-09-30 16:02 . 2008-09-30 16:02 <DIR> d-------- C:\Program Files\Free Audio Pack 2008-09-30 15:46 . 2008-09-30 15:47 <DIR> d-------- C:\downtube 2008-09-29 22:32 . 2008-09-29 22:32 <DIR> d-------- C:\WINDOWS\system32\Lang 2008-09-29 22:32 . 2008-09-29 22:32 940,794 --a------ C:\WINDOWS\system32\LoopyMusic.wav 2008-09-29 22:32 . 2008-09-29 22:32 146,650 --a------ C:\WINDOWS\system32\BuzzingBee.wav 2008-09-20 17:52 . 2008-09-20 17:52 <DIR> d-------- C:\Program Files\SubEdit-Player 2008-09-13 20:36 . 2008-09-13 20:36 <DIR> d-------- C:\Program Files\Trend Micro 2008-09-13 20:25 . 2008-09-13 20:25 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\nView_Profiles 2008-09-11 18:20 . 2008-09-20 17:34 <DIR> d-------- C:\Dev-Cpp 2008-09-11 18:18 . 2008-09-11 18:19 <DIR> d-------- C:\Documents and Settings\Marek\Dane aplikacji\Dev-Cpp 2008-09-10 20:40 . 2008-09-17 19:11 <DIR> d-------- C:\Documents and Settings\Magda\Dane aplikacji\Winamp 2008-09-10 10:30 . 2001-10-26 16:57 12,160 --a------ C:\WINDOWS\system32\drivers\mouhid.sys 2008-09-10 10:30 . 2001-10-26 16:57 12,160 --a--c--- C:\WINDOWS\system32\dllcache\mouhid.sys 2008-09-10 10:30 . 2001-08-17 22:02 9,600 --a------ C:\WINDOWS\system32\drivers\hidusb.sys 2008-09-10 10:30 . 2001-08-17 22:02 9,600 --a--c--- C:\WINDOWS\system32\dllcache\hidusb.sys 2008-09-07 12:53 . 2008-09-07 12:53 <DIR> d-------- C:\Documents and Settings\Magda\Dane aplikacji\Gadu-Gadu 2008-09-07 12:27 . 2008-09-10 18:09 <DIR> d-------- C:\Documents and Settings\Magda\Gadu-Gadu 2008-09-04 22:00 . 2008-09-04 22:00 <DIR> d-------- C:\WINDOWS\Sun 2008-09-04 16:13 . 2008-09-04 21:21 <DIR> d--h----- C:\WINDOWS\$hf_mig$ 2008-09-04 16:13 . 2005-02-25 05:36 22,752 --a------ C:\WINDOWS\system32\spupdsvc.exe 2008-09-02 19:15 . 2008-09-02 19:15 <DIR> d-------- C:\Program Files\Common Files\Adobe 2008-09-02 19:13 . 2008-09-02 19:13 <DIR> d-------- C:\Program Files\ABBYY FineReader 8.0 Professional Edition 2008-09-02 19:13 . 2008-09-02 19:13 <DIR> d-------- C:\Documents and Settings\Marek\Dane aplikacji\ABBYY 2008-08-27 20:56 . 2008-08-27 20:56 <DIR> d-------- C:\Documents and Settings\Marek\Dane aplikacji\Media Player Classic 2008-08-27 20:55 . 2008-08-27 20:55 <DIR> d-------- C:\Program Files\K-Lite Codec Pack 2008-08-27 20:39 . 2008-08-28 00:28 <DIR> d-------- C:\Program Files\NAPI-PROJEKT 2008-08-27 20:39 . 2008-08-27 20:39 <DIR> d-------- C:\Program Files\ALLPlayer 2008-08-27 17:23 . 2008-09-21 00:01 <DIR> d--h----- C:\Documents and Settings\Magda\Ustawienia lokalne 2008-08-27 17:23 . 2008-08-27 17:23 <DIR> dr------- C:\Documents and Settings\Magda\Ulubione 2008-08-27 17:23 . 2008-08-26 22:09 <DIR> d--h----- C:\Documents and Settings\Magda\Szablony 2008-08-27 17:23 . 2008-09-17 19:57 <DIR> d-------- C:\Documents and Settings\Magda\Pulpit 2008-08-27 17:23 . 2008-08-27 17:23 <DIR> dr------- C:\Documents and Settings\Magda\Moje dokumenty 2008-08-27 17:23 . 2008-08-27 00:02 <DIR> dr------- C:\Documents and Settings\Magda\Menu Start 2008-08-27 17:23 . 2008-10-15 19:20 <DIR> dr-h----- C:\Documents and Settings\Magda\Dane aplikacji 2008-08-27 17:23 . 2008-09-07 12:27 <DIR> d-------- C:\Documents and Settings\Magda 2008-08-27 17:23 . 2004-08-04 00:44 221,184 --a------ C:\WINDOWS\system32\wmpns.dll 2008-08-27 09:25 . 2004-08-03 23:08 26,496 --a--c--- C:\WINDOWS\system32\dllcache\usbstor.sys 2008-08-27 02:52 . 2008-08-27 02:52 <DIR> d-------- C:\Documents and Settings\Marek\Dane aplikacji\Gadu-Gadu 2008-08-27 00:06 . 2001-08-17 23:59 3,072 --a------ C:\WINDOWS\system32\drivers\audstub.sys 2008-08-27 00:05 . 2004-08-04 02:35 58,624 --a------ C:\WINDOWS\system32\drivers\redbook.sys 2008-08-27 00:05 . 2001-08-17 23:46 6,400 --a------ C:\WINDOWS\system32\drivers\enum1394.sys 2008-08-27 00:04 . 2008-10-16 14:57 <DIR> d-------- C:\Program Files\AutoConnect 2008-08-27 00:04 . 2004-08-04 02:44 153,088 --a------ C:\WINDOWS\system32\irftp.exe 2008-08-27 00:04 . 2004-08-04 01:00 87,424 --a------ C:\WINDOWS\system32\drivers\irda.sys 2008-08-27 00:04 . 2004-08-04 02:44 77,312 --a------ C:\WINDOWS\system32\usbui.dll 2008-08-27 00:04 . 2004-08-04 02:44 27,648 --a------ C:\WINDOWS\system32\irmon.dll 2008-08-27 00:04 . 2001-08-17 23:51 19,584 --a------ C:\WINDOWS\system32\drivers\rasirda.sys 2008-08-27 00:04 . 2001-08-17 23:51 18,688 --a------ C:\WINDOWS\system32\drivers\irsir.sys 2008-08-27 00:04 . 2004-08-04 02:44 8,192 --a------ C:\WINDOWS\system32\wshirda.dll 2008-08-27 00:03 . 2008-08-27 00:03 <DIR> d-------- C:\Program Files\Sun 2008-08-27 00:02 . 2008-09-14 14:08 <DIR> d-------- C:\WINDOWS\system32\CatRoot2 2008-08-27 00:02 . 2008-08-27 00:02 <DIR> d-------- C:\Program Files\Java 2008-08-27 00:02 . 2008-08-27 00:02 <DIR> dr-h----- C:\Documents and Settings\Default User\Ustawienia lokalne 2008-08-27 00:02 . 2008-08-27 00:02 <DIR> d-------- C:\Documents and Settings\Default User\Ulubione 2008-08-27 00:02 . 2008-08-26 22:09 <DIR> d--h----- C:\Documents and Settings\Default User\Szablony 2008-08-27 00:02 . 2008-08-27 00:02 <DIR> d-------- C:\Documents and Settings\Default User\Pulpit 2008-08-27 00:02 . 2008-08-27 00:02 <DIR> d-------- C:\Documents and Settings\Default User\Moje dokumenty 2008-08-27 00:02 . 2008-08-27 00:02 <DIR> dr------- C:\Documents and Settings\Default User\Menu Start 2008-08-27 00:02 . 2008-08-27 00:02 <DIR> dr-h----- C:\Documents and Settings\Default User\Dane aplikacji 2008-08-27 00:02 . 2008-08-27 00:02 <DIR> d-------- C:\Documents and Settings\All Users\Ulubione 2008-08-27 00:02 . 2008-08-27 00:03 <DIR> d--h----- C:\Documents and Settings\All Users\Szablony 2008-08-27 00:02 . 2008-09-30 16:11 <DIR> d-------- C:\Documents and Settings\All Users\Pulpit 2008-08-27 00:02 . 2008-08-27 00:03 <DIR> dr------- C:\Documents and Settings\All Users\Menu Start 2008-08-27 00:02 . 2008-08-26 22:10 <DIR> dr------- C:\Documents and Settings\All Users\Dokumenty 2008-08-27 00:02 . 2008-09-30 16:45 <DIR> dr-h----- C:\Documents and Settings\All Users\Dane aplikacji 2008-08-27 00:01 . 2008-08-26 22:15 261 --a------ C:\WINDOWS\system32\$winnt$.inf . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-08-27 00:52 --------- d-----w C:\Documents and Settings\Marek\Dane aplikacji\Winamp 2008-08-26 21:59 --------- d-----w C:\Program Files\Common Files\Java 2008-08-26 20:46 --------- d-----w C:\Program Files\Winamp 2008-08-26 20:45 --------- d-----w C:\Program Files\Winamp Toolbar 2008-08-26 20:45 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Winamp Toolbar 2008-08-26 20:39 --------- d-----w C:\Program Files\Gadu-Gadu 2008-08-26 20:30 --------- d-----w C:\Program Files\Realtek Sound Manager 2008-08-26 20:30 --------- d-----w C:\Program Files\AvRack 2008-08-26 20:29 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-08-26 20:29 --------- d-----w C:\Program Files\AMD 2008-08-26 20:28 4,096 ----a-w C:\WINDOWS\gdrv.sys 2008-08-26 20:23 --------- d-----w C:\Program Files\Common Files\InstallShield 2008-08-26 20:21 --------- d-----w C:\Program Files\Thomson 2008-08-26 20:21 --------- d-----w C:\Program Files\Neostrada TP 2008-08-26 20:13 --------- d-----w C:\Program Files\microsoft frontpage 2008-08-26 20:12 --------- d-----w C:\Program Files\Usługi online 2008-07-25 08:34 81,920 ----a-w C:\WINDOWS\system32\dpl100.dll 2008-07-25 08:34 683,520 ----a-w C:\WINDOWS\system32\divx.dll 2008-07-23 16:50 3,596,288 ----a-w C:\WINDOWS\system32\qt-dx331.dll . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks] "{57BCA5FA-5DBB-45a2-B558-1755C3F6253B}"= "C:\Program Files\Winamp Toolbar\winamptb.dll" [2008-07-16 1266992] [HKEY_CLASSES_ROOT\clsid\{57bca5fa-5dbb-45a2-b558-1755c3f6253b}] [HKEY_CLASSES_ROOT\WINAMPTB.AOLTBSearch.1] [HKEY_CLASSES_ROOT\TypeLib\{538CD77C-BFDD-49b0-9562-77419CAB89D1}] [HKEY_CLASSES_ROOT\WINAMPTB.AOLTBSearch] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 15360] "Gadu-Gadu"="C:\Program Files\Gadu-Gadu\gg.exe" [2008-03-20 2127296] "AutoConnect"="C:\Program Files\AutoConnect\AutoConnect.exe" [2006-12-03 310784] "SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2008-01-28 2097488] "MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-08-04 1667584] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2005-06-15 6803456] "NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2005-06-15 86016] "WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2008-08-04 36352] "nwiz"="nwiz.exe" [2005-06-15 C:\WINDOWS\system32\nwiz.exe] "SoundMan"="SOUNDMAN.EXE" [2004-12-22 C:\WINDOWS\SOUNDMAN.EXE] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 15360] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "VIDC.YV12"= yv12vfw.dll [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SearchSettings] --a------ 2008-06-12 16:57 991584 C:\Program Files\Search Settings\SearchSettings.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpeedTouch USB Diagnostics] --a------ 2004-01-26 11:38 866816 C:\Program Files\Thomson\SpeedTouch USB\dragdiag.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpybotSD TeaTimer] -rahs---- 2008-01-28 11:43 2097488 C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched] --a------ 2008-06-10 04:27 144784 C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "C:\\Program Files\\Java\\jre1.6.0_07\\launch4j-tmp\\JDownloader.exe"= "C:\\WINDOWS\\system32\\java.exe"= "C:\\Program Files\\eMule\\emule.exe"= "C:\\Program Files\\Messenger\\msmsgs.exe"= "C:\\Program Files\\Mozilla Firefox\\firefox.exe"= "E:\\CS\\hl.exe"= *Newly Created Service* - PROCEXP90 . - - - - USUNIĘTO PUSTE WPISY - - - - MSConfigStartUp-au - C:\Program Files\Dealio\DealioAU.exe ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-09-21 00:02:00 Windows 5.1.2600 Dodatek Service Pack 2 NTFS skanowanie ukrytych procesów ... skanowanie ukrytych wpisów autostartu ... skanowanie ukrytych plików ... skanowanie pomyślnie ukończone ukryte pliki: 0 ************************************************************************** . Czas ukończenia: 2008-09-21 0:03:04 ComboFix-quarantined-files.txt 2008-09-20 22:02:43 Przed: 9˙408˙241˙664 bajt˘w wolnych Po: 9,491,980,288 bajt˘w wolnych 176 --- E O F --- 2008-09-04 14:13:07

Dodano 21.09.2008 13:35:10:

Kod: Zaznacz wszystko: "Silent Runners.vbs", revision 58, http://www.silentrunners.org/ Operating System: Windows XP SP2 Output limited to non-default values, except where indicated by "{++}" Startup items buried in registry: --------------------------------- HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ {++} "CTFMON.EXE" = "C:\WINDOWS\system32\ctfmon.exe" [MS] "Gadu-Gadu" = ""C:\Program Files\Gadu-Gadu\gg.exe" /tray" ["Gadu-Gadu S.A."] "AutoConnect" = "C:\Program Files\AutoConnect\AutoConnect.exe" ["http://autoconnect.prv.pl"] "SpybotSD TeaTimer" = "C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" ["Safer Networking Limited"] "MSMSGS" = ""C:\Program Files\Messenger\msmsgs.exe" /background" [MS] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++} "NvCplDaemon" = "RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup" [MS] "nwiz" = "nwiz.exe /install" ["NVIDIA Corporation"] "NvMediaCenter" = "RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit" [MS] "SoundMan" = "SOUNDMAN.EXE" ["Realtek Semiconductor Corp."] "WinampAgent" = ""C:\Program Files\Winamp\winampa.exe"" [null data] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ {25CEE8EC-5730-41bc-8B58-22DDC8AB8C20}\(Default) = "Winamp Toolbar Loader" -> {HKLM...CLSID} = "Winamp Toolbar Loader" \InProcServer32\(Default) = "C:\Program Files\Winamp Toolbar\winamptb.dll" ["AOL LLC."] {53707962-6F74-2D53-2644-206D7942484F}\(Default) = (no title provided) -> {HKLM...CLSID} = "Spybot-S&D IE Protection" \InProcServer32\(Default) = "C:\Program Files\Spybot - Search & Destroy\SDHelper.dll" ["Safer Networking Limited"] {6A87B991-A31F-4130-AE72-6D0C294BF082}\(Default) = (no title provided) -> {HKLM...CLSID} = "DealioBHO Class" \InProcServer32\(Default) = "C:\Program Files\Dealio\kb127\Dealio.dll" [file not found] {761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\(Default) = (no title provided) -> {HKLM...CLSID} = "SSVHelper Class" \InProcServer32\(Default) = "C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll" ["Sun Microsystems, Inc."] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\ "{42071714-76d4-11d1-8b24-00a0c9068ff3}" = "Rozszerzenie CPL kadrowania wyświetlania" -> {HKLM...CLSID} = "Rozszerzenie CPL kadrowania wyświetlania" \InProcServer32\(Default) = "deskpan.dll" [file not found] "{88895560-9AA2-1069-930E-00AA0030EBC8}" = "Rozszerzenie ikony HyperTerminalu" -> {HKLM...CLSID} = "HyperTerminal Icon Ext" \InProcServer32\(Default) = "C:\WINDOWS\system32\hticons.dll" ["Hilgraeve, Inc."] "{A70C977A-BF00-412C-90B7-034C51DA2439}" = "NvCpl DesktopContext Class" -> {HKLM...CLSID} = "DesktopContext Class" \InProcServer32\(Default) = "C:\WINDOWS\system32\nvcpl.dll" ["NVIDIA Corporation"] "{FFB699E0-306A-11d3-8BD1-00104B6F7516}" = "Play on my TV helper" -> {HKLM...CLSID} = "NVIDIA CPL Extension" \InProcServer32\(Default) = "C:\WINDOWS\system32\nvcpl.dll" ["NVIDIA Corporation"] "{1CDB2949-8F65-4355-8456-263E7C208A5D}" = "Desktop Explorer" -> {HKLM...CLSID} = "Desktop Explorer" \InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"] "{1E9B04FB-F9E5-4718-997B-B8DA88302A47}" = "Desktop Explorer Menu" -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"] "{1E9B04FB-F9E5-4718-997B-B8DA88302A48}" = "nView Desktop Context Menu" -> {HKLM...CLSID} = "nView Desktop Context Menu" \InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"] "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" = "WinRAR shell extension" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] "{00020D75-0000-0000-C000-000000000046}" = "Microsoft Office Outlook Desktop Icon Handler" -> {HKLM...CLSID} = "Microsoft Office Outlook" \InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\OFFICE11\MLSHEXT.DLL" [MS] "{0006F045-0000-0000-C000-000000000046}" = "Microsoft Office Outlook Custom Icon Handler" -> {HKLM...CLSID} = "Rozszerzenie ikon plików programu Outlook" \InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\OFFICE11\OLKFSTUB.DLL" [MS] "{42042206-2D85-11D3-8CFF-005004838597}" = "Microsoft Office HTML Icon Handler" -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "C:\Program Files\Microsoft Office\OFFICE11\msohev.dll" [MS] HKLM\SOFTWARE\Classes\PROTOCOLS\Filter\ <<!>> text/xml\CLSID = "{807553E5-5146-11D5-A672-00B0D022E945}" -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL" [MS] HKLM\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\ WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] HKLM\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\ WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] HKLM\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\ WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] Default executables: -------------------- <<!>> HKLM\SOFTWARE\Classes\.com\(Default) = "ComFile" Group Policies {GPedit.msc branch and setting}: ----------------------------------------------- Note: detected settings may not have any effect. HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\ "NoDrives" = (REG_DWORD) dword:0x00000000 {unrecognized setting} HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\ "NoDrives" = (REG_DWORD) dword:0x00000000 {unrecognized setting} HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System\ "HideLegacyLogonScripts" = (REG_DWORD) dword:0x00000000 {unrecognized setting} "HideLogoffScripts" = (REG_DWORD) dword:0x00000000 {unrecognized setting} "HideStartupScripts" = (REG_DWORD) dword:0x00000000 {unrecognized setting} "RunLogonScriptSync" = (REG_DWORD) dword:0x00000001 {unrecognized setting} "RunStartupScriptSync" = (REG_DWORD) dword:0x00000000 {unrecognized setting} HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ "shutdownwithoutlogon" = (REG_DWORD) dword:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| Shutdown: Allow system to be shut down without having to log on} "undockwithoutlogon" = (REG_DWORD) dword:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| Devices: Allow undock without having to log on} "DisableRegistryTools" = (REG_DWORD) dword:0x00000000 {unrecognized setting} "HideLegacyLogonScripts" = (REG_DWORD) dword:0x00000000 {unrecognized setting} "HideLogoffScripts" = (REG_DWORD) dword:0x00000000 {unrecognized setting} "RunLogonScriptSync" = (REG_DWORD) dword:0x00000001 {unrecognized setting} "RunStartupScriptSync" = (REG_DWORD) dword:0x00000000 {unrecognized setting} "HideStartupScripts" = (REG_DWORD) dword:0x00000000 {unrecognized setting} Active Desktop and Wallpaper: ----------------------------- Active Desktop may be disabled at this entry: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState Displayed if Active Desktop enabled and wallpaper not set by Group Policy: HKCU\Software\Microsoft\Internet Explorer\Desktop\General\ "Wallpaper" = "C:\WINDOWS\web\wallpaper\Idylla.bmp" Displayed if Active Desktop disabled and wallpaper not set by Group Policy: HKCU\Control Panel\Desktop\ "Wallpaper" = "C:\WINDOWS\web\wallpaper\Idylla.bmp" Windows Portable Device AutoPlay Handlers ----------------------------------------- HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers\Handlers\ MPCPlayCDAudioOnArrival\ "Provider" = "Media Player Classic" "InvokeProgID" = "MediaPlayerClassic.Autorun" "InvokeVerb" = "PlayCDAudio" HKLM\SOFTWARE\Classes\MediaPlayerClassic.Autorun\shell\PlayCDAudio\command\(Default) = ""C:\Program Files\K-Lite Codec Pack\Media Player Classic\mplayerc.exe" %1 /cd" ["Gabest"] MPCPlayDVDMovieOnArrival\ "Provider" = "Media Player Classic" "InvokeProgID" = "MediaPlayerClassic.Autorun" "InvokeVerb" = "PlayDVDMovie" HKLM\SOFTWARE\Classes\MediaPlayerClassic.Autorun\shell\PlayDVDMovie\command\(Default) = ""C:\Program Files\K-Lite Codec Pack\Media Player Classic\mplayerc.exe" %1 /dvd" ["Gabest"] MPCPlayMusicFilesOnArrival\ "Provider" = "Media Player Classic" "InvokeProgID" = "MediaPlayerClassic.Autorun" "InvokeVerb" = "PlayMusicFiles" HKLM\SOFTWARE\Classes\MediaPlayerClassic.Autorun\shell\PlayMusicFiles\command\(Default) = ""C:\Program Files\K-Lite Codec Pack\Media Player Classic\mplayerc.exe" %1" ["Gabest"] MPCPlayVideoFilesOnArrival\ "Provider" = "Media Player Classic" "InvokeProgID" = "MediaPlayerClassic.Autorun" "InvokeVerb" = "PlayVideoFiles" HKLM\SOFTWARE\Classes\MediaPlayerClassic.Autorun\shell\PlayVideoFiles\command\(Default) = ""C:\Program Files\K-Lite Codec Pack\Media Player Classic\mplayerc.exe" %1" ["Gabest"] MSPlayCDAudioOnArrival\ "Provider" = "ALLPlayer" "InvokeProgID" = "AllPlayerFile" "InvokeVerb" = "play" HKLM\SOFTWARE\Classes\AllPlayerFile\shell\play\command\(Default) = ""C:\Program Files\ALLPlayer\ALLPlayer.exe" "%1"" ["ALLPlayer"] WinampMTPHandler\ "Provider" = "Winamp" "ProgID" = "Shell.HWEventHandlerShellExecute" "InitCmdLine" = "C:\Program Files\Winamp\winamp.exe" HKLM\SOFTWARE\Classes\Shell.HWEventHandlerShellExecute\CLSID\(Default) = "{FFB8655F-81B9-4fce-B89C-9A6BA76D13E7}" -> {HKLM...CLSID} = "ShellExecute HW Event Handler" \LocalServer32\(Default) = "rundll32.exe shell32.dll,SHCreateLocalServerRunDll {FFB8655F-81B9-4fce-B89C-9A6BA76D13E7}" [MS] WinampPlayMediaOnArrival\ "Provider" = "Winamp" "InvokeProgID" = "Winamp.File" "InvokeVerb" = "Play" HKLM\SOFTWARE\Classes\Winamp.File\shell\Play\command\(Default) = ""C:\Program Files\Winamp\winamp.exe" "%1"" ["Nullsoft"] HKLM\SOFTWARE\Classes\Winamp.File\shell\Play\DropTarget\CLSID = "{46986115-84D6-459c-8F95-52DD653E532E}" -> {HKLM...CLSID} = (no title provided) \LocalServer32\(Default) = ""C:\Program Files\Winamp\winamp.exe"" ["Nullsoft"] Winsock2 Service Provider DLLs: ------------------------------- Namespace Service Providers HKLM\SYSTEM\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++} 000000000001\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS] 000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS] 000000000003\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS] Transport Service Providers HKLM\SYSTEM\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++} 0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range: %SystemRoot%\system32\mswsock.dll [MS], 01 - 04, 07 - 18 %SystemRoot%\system32\rsvpsp.dll [MS], 05 - 06 Toolbars, Explorer Bars, Extensions: ------------------------------------ Toolbars HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\ "{EBF2BA02-9094-4C5A-858B-BB198F3D8DE2}" -> {HKLM...CLSID} = "Winamp Toolbar" \InProcServer32\(Default) = "C:\Program Files\Winamp Toolbar\winamptb.dll" ["AOL LLC."] "{E67C74F4-A00A-4F2C-9FEC-FD9DC004A67F}" -> {HKLM...CLSID} = "Dealio" \InProcServer32\(Default) = "C:\Program Files\Dealio\kb127\Dealio.dll" [file not found] HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ "{EBF2BA02-9094-4C5A-858B-BB198F3D8DE2}" = "Winamp Toolbar" -> {HKLM...CLSID} = "Winamp Toolbar" \InProcServer32\(Default) = "C:\Program Files\Winamp Toolbar\winamptb.dll" ["AOL LLC."] "{E67C74F4-A00A-4F2C-9FEC-FD9DC004A67F}" = (no title provided) -> {HKLM...CLSID} = "Dealio" \InProcServer32\(Default) = "C:\Program Files\Dealio\kb127\Dealio.dll" [file not found] Explorer Bars HKLM\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\ HKLM\SOFTWARE\Classes\CLSID\{FF059E31-CC5A-4E2E-BF3B-96E929D65503}\(Default) = "&Badanie" Implemented Categories\{00021493-0000-0000-C000-000000000046}\ [vertical bar] InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL" [MS] Extensions (Tools menu items, main toolbar menu buttons) HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\ {08B0E5C0-4FCB-11CF-AAA5-00401C608501}\ "MenuText" = "Sun Java Console" "CLSIDExtension" = "{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBC}" -> {HKCU...CLSID} = "Java Plug-in 1.6.0_07" \InProcServer32\(Default) = "C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll" ["Sun Microsystems, Inc."] -> {HKLM...CLSID} = "Java Plug-in 1.6.0_07" \InProcServer32\(Default) = "C:\Program Files\Java\jre1.6.0_07\bin\npjpi160_07.dll" ["Sun Microsystems, Inc."] {92780B25-18CC-41C8-B9BE-3C9C571A8263}\ "ButtonText" = "Badanie" {DFB852A3-47F8-48C4-A200-58CAB36FD2A2}\ "MenuText" = "Spybot - Search && Destroy Configuration" "CLSIDExtension" = "{53707962-6F74-2D53-2644-206D7942484F}" -> {HKLM...CLSID} = "Spybot-S&D IE Protection" \InProcServer32\(Default) = "C:\Program Files\Spybot - Search & Destroy\SDHelper.dll" ["Safer Networking Limited"] Miscellaneous IE Hijack Points ------------------------------ HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks\ <<H>> "{57BCA5FA-5DBB-45a2-B558-1755C3F6253B}" = (no title provided) -> {HKLM...CLSID} = "Winamp Search Class" \InProcServer32\(Default) = "C:\Program Files\Winamp Toolbar\winamptb.dll" ["AOL LLC."] Running Services (Display Name, Service Name, Path {Service DLL}): ------------------------------------------------------------------ NVIDIA Display Driver Service, NVSvc, "C:\WINDOWS\system32\nvsvc32.exe" ["NVIDIA Corporation"] Windows User Mode Driver Framework, UMWdf, "C:\WINDOWS\system32\wdfmgr.exe" [MS] Print Monitors: --------------- HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors\ Canon BJ Language Monitor PIXMA iP1500\Driver = "CNMLM5y.DLL" ["CANON INC."] Microsoft Document Imaging Writer Monitor\Driver = "mdimon.dll" [MS] ---------- (launch time: 2008-09-21 13:33:11) <<!>>: Suspicious data at a malware launch point. <<H>>: Suspicious data at a browser hijack point. + This report excludes default entries except where indicated. + To see *everywhere* the script checks and *everything* it finds, launch it from a command prompt or a shortcut with the -all parameter. + To search all directories of local fixed drives for DESKTOP.INI DLL launch points, use the -supp parameter or answer "No" at the first message box and "Yes" at the second message box. ---------- (total run time: 28 seconds, including 2 seconds for message boxes)

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 13:34:25, on 2008-09-21 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\wuauclt.exe C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\RUNDLL32.EXE C:\WINDOWS\SOUNDMAN.EXE C:\Program Files\Winamp\winampa.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Gadu-Gadu\gg.exe C:\Program Files\AutoConnect\AutoConnect.exe C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe C:\Program Files\Messenger\msmsgs.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza R3 - URLSearchHook: Winamp Search Class - {57BCA5FA-5DBB-45a2-B558-1755C3F6253B} - C:\Program Files\Winamp Toolbar\winamptb.dll O2 - BHO: Winamp Toolbar Loader - {25CEE8EC-5730-41bc-8B58-22DDC8AB8C20} - C:\Program Files\Winamp Toolbar\winamptb.dll O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll O2 - BHO: DealioBHO Class - {6A87B991-A31F-4130-AE72-6D0C294BF082} - C:\Program Files\Dealio\kb127\Dealio.dll (file missing) O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O3 - Toolbar: Winamp Toolbar - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - C:\Program Files\Winamp Toolbar\winamptb.dll O3 - Toolbar: Dealio - {E67C74F4-A00A-4F2C-9FEC-FD9DC004A67F} - C:\Program Files\Dealio\kb127\Dealio.dll (file missing) O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe" O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - HKCU\..\Run: [AutoConnect] C:\Program Files\AutoConnect\AutoConnect.exe O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O8 - Extra context menu item: Compare Prices with &Dealio - C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\res\DealioSearch.html O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll O17 - HKLM\System\CCS\Services\Tcpip\..\{5D18A429-CB60-472D-8E8F-9D8EA3046305}: NameServer = 194.204.152.34 217.98.63.164 O17 - HKLM\System\CS1\Services\Tcpip\..\{5D18A429-CB60-472D-8E8F-9D8EA3046305}: NameServer = 194.204.152.34 217.98.63.164 O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe -- End of file - 4702 bytes

**Posty:** 684 · przez **djarta** 21 Wrz 2008, 13:48

Wklej do Notatnika:

Kod: Zaznacz wszystko: Folder:: C:\Program Files\Search Settings C:\Documents and Settings\Marek\Dane aplikacji\Dealio C:\Program Files\Dealio DirLook:: C:\downtube Registry:: [-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SearchSettings]

>>Plik>>Zapisz jako... >>> CFScript
Przeciągnij i upuść plik CFScript.txt na plik ComboFix.exe
-->

Ma się rozpocząć usuwanie. (i powstanie log).Daj ten log, który powstanie w trakcie usuwania.
Jeśli pójdzie dobrze, to: Po restarcie usuń ręcznie folder C:\Qoobox.

======================================
K.

**Posty:** 378 · przez **TARCZYN** 21 Wrz 2008, 16:21

Kod: Zaznacz wszystko: ComboFix 08-09-20.04 - Marek 2008-09-21 16:09:38.2 - NTFSx86 MINIMAL Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.1051 [GMT 2:00] Uruchomiony z: C:\Documents and Settings\Marek\Pulpit\ComboFix.exe Użyto następujących komend :: C:\Documents and Settings\Marek\Pulpit\CFScript.txt [color=red][b]UWAGA - TEN KOMPUTER NIE MA ZAINSTALOWANEJ KONSOLI ODZYSKIWANIA !![/b][/color] . ((((((((((((((((((((((((((((((((((((((( Usunięto ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\Documents and Settings\Marek\Dane aplikacji\Dealio C:\Documents and Settings\Marek\Dane aplikacji\Dealio\dinstallhelper.A40570880F3B416CB03CA505495FD003.dll C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\res\alerts.gif C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\res\alerts_over.gif C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\res\alerts_rec.gif C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\res\alerts_rec_over.gif C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\res\chevron-small.gif C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\res\deal_report.jpg C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\res\DealioSearch.html C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\res\deals-leftcap.gif C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\res\ebay_login.jpg C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\res\err_mainwindow.html C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\res\err_toolbar.html C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\res\global_scripts.js C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\res\headerbgthin.jpg C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\res\highlight-bg.png C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\res\logo.gif C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\res\logo_over.gif C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\res\man_toolbar.css C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\res\man_toolbar.html C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\res\man_toolbar.js C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\res\man_toolbarl.js C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\res\post-this-deal.gif C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\res\post-this-deal_over.gif C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\res\scripts.js C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\res\scroller.js C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\res\search-chevron.gif C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\res\search-chevron_over.gif C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\res\search_bg_blink.gif C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\res\separator.gif C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\res\settings.gif C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\res\settings_over.gif C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\res\yahoo-search.png C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\rules\index.76.35 C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\rules\rules.1.10.76 C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\rules\rules.1.109.43 C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\rules\rules.1.110.43 C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\rules\rules.1.12.52 C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\rules\rules.1.13.58 C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\rules\rules.1.130.58 C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\rules\rules.1.135.50 C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\rules\rules.1.153.44 C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\rules\rules.1.155.43 C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\rules\rules.1.156.49 C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\rules\rules.1.16.60 C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\rules\rules.1.161.52 C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\rules\rules.1.178.66 C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\rules\rules.1.184.55 C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\rules\rules.1.188.52 C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\rules\rules.1.189.45 C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\rules\rules.1.196.43 C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\rules\rules.1.198.56 C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\rules\rules.1.199.43 C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\rules\rules.1.200.53 C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\rules\rules.1.201.43 C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\rules\rules.1.202.43 C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\rules\rules.1.203.71 C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\rules\rules.1.205.62 C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\rules\rules.1.213.71 C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\rules\rules.1.214.49 C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\rules\rules.1.215.43 C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\rules\rules.1.216.67 C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\rules\rules.1.217.67 C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\rules\rules.1.218.52 C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\rules\rules.1.219.43 C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\rules\rules.1.220.43 C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\rules\rules.1.221.57 C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\rules\rules.1.222.43 C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\rules\rules.1.223.68 C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\rules\rules.1.226.68 C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\rules\rules.1.227.43 C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\rules\rules.1.228.62 C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\rules\rules.1.229.76 C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\rules\rules.1.23.63 C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\rules\rules.1.239.43 C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\rules\rules.1.24.43 C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\rules\rules.1.240.43 C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\rules\rules.1.241.43 C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\rules\rules.1.242.43 C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\rules\rules.1.243.43 C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\rules\rules.1.244.63 C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\rules\rules.1.245.43 C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\rules\rules.1.247.43 C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\rules\rules.1.248.43 C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\rules\rules.1.249.43 C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\rules\rules.1.250.43 C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\rules\rules.1.251.43 C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\rules\rules.1.252.43 C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\rules\rules.1.253.43 C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\rules\rules.1.254.43 C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\rules\rules.1.255.43 C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\rules\rules.1.256.43 C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\rules\rules.1.257.43 C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\rules\rules.1.279.43 C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\rules\rules.1.28.58 C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\rules\rules.1.282.75 C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\rules\rules.1.283.43 C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\rules\rules.1.284.43 C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\rules\rules.1.289.67 C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\rules\rules.1.290.62 C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\rules\rules.1.291.61 C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\rules\rules.1.296.43 C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\rules\rules.1.297.43 C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\rules\rules.1.304.43 C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\rules\rules.1.307.43 C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\rules\rules.1.308.75 C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\rules\rules.1.31.47 C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\rules\rules.1.310.46 C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\rules\rules.1.311.43 C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\rules\rules.1.315.43 C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\rules\rules.1.316.43 C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\rules\rules.1.317.43 C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\rules\rules.1.318.43 C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\rules\rules.1.319.49 C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\rules\rules.1.32.48 C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\rules\rules.1.334.44 C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\rules\rules.1.335.60 C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\rules\rules.1.336.44 C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\rules\rules.1.337.44 C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\rules\rules.1.338.75 C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\rules\rules.1.339.47 C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\rules\rules.1.34.43 C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\rules\rules.1.340.47 C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\rules\rules.1.341.47 C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\rules\rules.1.349.50 C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\rules\rules.1.35.48 C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\rules\rules.1.350.50 C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\rules\rules.1.351.51 C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\rules\rules.1.352.54 C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\rules\rules.1.353.51 C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\rules\rules.1.354.51 C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\rules\rules.1.357.62 C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\rules\rules.1.358.52 C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\rules\rules.1.359.52 C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\rules\rules.1.360.53 C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\rules\rules.1.361.54 C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\rules\rules.1.362.68 C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\rules\rules.1.363.58 C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\rules\rules.1.364.54 C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\rules\rules.1.365.53 C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\rules\rules.1.367.56 C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\rules\rules.1.368.58 C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\rules\rules.1.369.55 C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\rules\rules.1.370.56 C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\rules\rules.1.371.56 C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\rules\rules.1.372.57 C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\rules\rules.1.373.55 C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\rules\rules.1.375.56 C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\rules\rules.1.376.57 C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\rules\rules.1.377.55 C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\rules\rules.1.378.65 C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\rules\rules.1.384.58 C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\rules\rules.1.386.71 C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\rules\rules.1.387.59 C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\rules\rules.1.388.59 C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\rules\rules.1.389.59 C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\rules\rules.1.390.60 C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\rules\rules.1.391.60 C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\rules\rules.1.392.60 C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\rules\rules.1.393.60 C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\rules\rules.1.394.60 C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\rules\rules.1.396.61 C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\rules\rules.1.397.61 C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\rules\rules.1.398.60 C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\rules\rules.1.399.60 C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\rules\rules.1.403.61 C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\rules\rules.1.404.63 C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\rules\rules.1.405.61 C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\rules\rules.1.406.61 C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\rules\rules.1.407.76 C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\rules\rules.1.408.63 C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\rules\rules.1.409.61 C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\rules\rules.1.412.62 C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\rules\rules.1.413.62 C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\rules\rules.1.414.62 C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\rules\rules.1.415.62 C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\rules\rules.1.416.62 C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\rules\rules.1.417.62 C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\rules\rules.1.418.62 C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\rules\rules.1.419.62 C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\rules\rules.1.420.62 C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\rules\rules.1.421.62 C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\rules\rules.1.423.63 C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\rules\rules.1.424.63 C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\rules\rules.1.425.63 C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\rules\rules.1.426.63 C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\rules\rules.1.427.63 C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\rules\rules.1.428.65 C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\rules\rules.1.429.63 C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\rules\rules.1.430.63 C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\rules\rules.1.432.65 C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\rules\rules.1.433.64 C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\rules\rules.1.434.65 C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\rules\rules.1.435.64 C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\rules\rules.1.436.76 C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\rules\rules.1.437.64 C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\rules\rules.1.438.71 C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\rules\rules.1.439.71 C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\rules\rules.1.440.75 C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\rules\rules.1.442.73 C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\rules\rules.1.443.73 C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\rules\rules.1.444.73 C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\rules\rules.1.445.68 C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\rules\rules.1.446.69 C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\rules\rules.1.450.67 C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\rules\rules.1.451.67 C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\rules\rules.1.452.68 C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\rules\rules.1.453.68 C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\rules\rules.1.454.69 C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\rules\rules.1.456.69 C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\rules\rules.1.457.75 C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\rules\rules.1.458.70 C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\rules\rules.1.459.70 C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\rules\rules.1.460.69 C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\rules\rules.1.462.74 C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\rules\rules.1.463.69 C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\rules\rules.1.464.70 C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\rules\rules.1.465.68 C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\rules\rules.1.468.70 C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\rules\rules.1.469.70 C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\rules\rules.1.470.70 C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\rules\rules.1.471.73 C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\rules\rules.1.472.70 C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\rules\rules.1.478.74 C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\rules\rules.1.479.73 C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\rules\rules.1.480.68 C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\rules\rules.1.481.71 C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\rules\rules.1.482.74 C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\rules\rules.1.49.67 C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\rules\rules.1.50.43 C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\rules\rules.1.500.71 C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\rules\rules.1.501.74 C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\rules\rules.1.502.71 C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\rules\rules.1.51.69 C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\rules\rules.1.52.72 C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\rules\rules.1.520.76 C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\rules\rules.1.521.76 C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\rules\rules.1.522.76 C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\rules\rules.1.53.51 C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\rules\rules.1.531.76 C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\rules\rules.1.532.75 C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\rules\rules.1.534.75 C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\rules\rules.1.54.47 C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\rules\rules.1.55.45 C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\rules\rules.1.56.69 C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\rules\rules.1.57.43 C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\rules\rules.1.58.47 C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\rules\rules.1.593.76 C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\rules\rules.1.595.76 C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\rules\rules.1.63.57 C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\rules\rules.1.66.47 C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\rules\rules.1.70.75 C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\rules\rules.1.71.43 C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\temp\dealio-14152.log C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\temp\dod_cache.xml C:\Program Files\Search Settings C:\Program Files\Search Settings\kb127\SearchSettingsRes409.dll C:\Program Files\Search Settings\SearchSettings.exe . ((((((((((((((((((((((((( Pliki utworzone od 2008-08-21 do 2008-09-21 ))))))))))))))))))))))))))))))) . 2008-10-15 19:20 . 2008-10-15 19:20 <DIR> d-------- C:\Documents and Settings\Magda\Dane aplikacji\Dev-Cpp 2008-10-02 14:11 . 2004-03-22 17:17 24,816 --a------ C:\WINDOWS\system32\mdimon.dll 2008-10-02 14:11 . 2008-09-18 21:27 421 --a------ C:\WINDOWS\ODBC.INI 2008-10-02 14:10 . 2008-10-02 14:10 <DIR> d-------- C:\Program Files\Microsoft.NET 2008-10-02 14:09 . 2008-10-02 14:10 <DIR> d-------- C:\WINDOWS\SHELLNEW 2008-10-01 20:51 . 2008-10-01 20:51 <DIR> d--h----- C:\BJPrinter 2008-10-01 20:51 . 2004-04-23 17:00 116,736 --a------ C:\WINDOWS\system32\CNMLM5y.DLL 2008-10-01 20:51 . 2004-04-23 17:00 7,680 --a------ C:\WINDOWS\system32\CNMVS5y.DLL 2008-10-01 20:48 . 2004-08-03 23:01 25,856 --a------ C:\WINDOWS\system32\drivers\usbprint.sys 2008-10-01 20:48 . 2004-08-03 23:01 25,856 --a--c--- C:\WINDOWS\system32\dllcache\usbprint.sys 2008-10-01 00:58 . 2008-10-01 00:58 <DIR> d-------- C:\Documents and Settings\Marek\Dane aplikacji\Search Settings 2008-09-30 16:45 . 2008-09-30 16:45 <DIR> d-------- C:\Program Files\Spybot - Search & Destroy 2008-09-30 16:45 . 2008-09-30 18:28 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Spybot - Search & Destroy 2008-09-30 16:11 . 2008-09-30 16:16 <DIR> d-------- C:\Program Files\eMule 2008-09-30 16:02 . 2008-09-30 16:02 <DIR> d-------- C:\Program Files\Free Audio Pack 2008-09-30 15:46 . 2008-09-30 15:47 <DIR> d-------- C:\downtube 2008-09-29 22:32 . 2008-09-29 22:32 <DIR> d-------- C:\WINDOWS\system32\Lang 2008-09-29 22:32 . 2008-09-29 22:32 940,794 --a------ C:\WINDOWS\system32\LoopyMusic.wav 2008-09-29 22:32 . 2008-09-29 22:32 146,650 --a------ C:\WINDOWS\system32\BuzzingBee.wav 2008-09-21 00:17 . 2006-12-10 23:32 499,712 --a------ C:\WINDOWS\system32\msvcp71.dll 2008-09-20 17:52 . 2008-09-21 00:08 <DIR> d-------- C:\Program Files\SubEdit-Player 2008-09-13 20:36 . 2008-09-13 20:36 <DIR> d-------- C:\Program Files\Trend Micro 2008-09-13 20:25 . 2008-09-13 20:25 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\nView_Profiles 2008-09-11 18:20 . 2008-09-20 17:34 <DIR> d-------- C:\Dev-Cpp 2008-09-11 18:18 . 2008-09-11 18:19 <DIR> d-------- C:\Documents and Settings\Marek\Dane aplikacji\Dev-Cpp 2008-09-10 20:40 . 2008-09-17 19:11 <DIR> d-------- C:\Documents and Settings\Magda\Dane aplikacji\Winamp 2008-09-10 10:30 . 2001-10-26 16:57 12,160 --a------ C:\WINDOWS\system32\drivers\mouhid.sys 2008-09-10 10:30 . 2001-10-26 16:57 12,160 --a--c--- C:\WINDOWS\system32\dllcache\mouhid.sys 2008-09-10 10:30 . 2001-08-17 22:02 9,600 --a------ C:\WINDOWS\system32\drivers\hidusb.sys 2008-09-10 10:30 . 2001-08-17 22:02 9,600 --a--c--- C:\WINDOWS\system32\dllcache\hidusb.sys 2008-09-07 12:53 . 2008-09-07 12:53 <DIR> d-------- C:\Documents and Settings\Magda\Dane aplikacji\Gadu-Gadu 2008-09-07 12:27 . 2008-09-10 18:09 <DIR> d-------- C:\Documents and Settings\Magda\Gadu-Gadu 2008-09-04 22:00 . 2008-09-04 22:00 <DIR> d-------- C:\WINDOWS\Sun 2008-09-04 16:13 . 2008-09-04 21:21 <DIR> d--h----- C:\WINDOWS\$hf_mig$ 2008-09-04 16:13 . 2005-02-25 05:36 22,752 --a------ C:\WINDOWS\system32\spupdsvc.exe 2008-09-02 19:15 . 2008-09-02 19:15 <DIR> d-------- C:\Program Files\Common Files\Adobe 2008-09-02 19:13 . 2008-09-02 19:13 <DIR> d-------- C:\Program Files\ABBYY FineReader 8.0 Professional Edition 2008-09-02 19:13 . 2008-09-02 19:13 <DIR> d-------- C:\Documents and Settings\Marek\Dane aplikacji\ABBYY 2008-08-27 20:56 . 2008-08-27 20:56 <DIR> d-------- C:\Documents and Settings\Marek\Dane aplikacji\Media Player Classic 2008-08-27 20:55 . 2008-08-27 20:55 <DIR> d-------- C:\Program Files\K-Lite Codec Pack 2008-08-27 20:39 . 2008-08-28 00:28 <DIR> d-------- C:\Program Files\NAPI-PROJEKT 2008-08-27 20:39 . 2008-08-27 20:39 <DIR> d-------- C:\Program Files\ALLPlayer 2008-08-27 17:23 . 2008-09-21 16:12 <DIR> d--h----- C:\Documents and Settings\Magda\Ustawienia lokalne 2008-08-27 17:23 . 2008-08-27 17:23 <DIR> dr------- C:\Documents and Settings\Magda\Ulubione 2008-08-27 17:23 . 2008-08-26 22:09 <DIR> d--h----- C:\Documents and Settings\Magda\Szablony 2008-08-27 17:23 . 2008-09-17 19:57 <DIR> d-------- C:\Documents and Settings\Magda\Pulpit 2008-08-27 17:23 . 2008-08-27 17:23 <DIR> dr------- C:\Documents and Settings\Magda\Moje dokumenty 2008-08-27 17:23 . 2008-08-27 00:02 <DIR> dr------- C:\Documents and Settings\Magda\Menu Start 2008-08-27 17:23 . 2008-10-15 19:20 <DIR> dr-h----- C:\Documents and Settings\Magda\Dane aplikacji 2008-08-27 17:23 . 2008-09-07 12:27 <DIR> d-------- C:\Documents and Settings\Magda 2008-08-27 17:23 . 2004-08-04 00:44 221,184 --a------ C:\WINDOWS\system32\wmpns.dll 2008-08-27 09:25 . 2004-08-03 23:08 26,496 --a--c--- C:\WINDOWS\system32\dllcache\usbstor.sys 2008-08-27 02:52 . 2008-08-27 02:52 <DIR> d-------- C:\Documents and Settings\Marek\Dane aplikacji\Gadu-Gadu 2008-08-27 00:06 . 2001-08-17 23:59 3,072 --a------ C:\WINDOWS\system32\drivers\audstub.sys 2008-08-27 00:05 . 2004-08-04 02:35 58,624 --a------ C:\WINDOWS\system32\drivers\redbook.sys 2008-08-27 00:05 . 2001-08-17 23:46 6,400 --a------ C:\WINDOWS\system32\drivers\enum1394.sys 2008-08-27 00:04 . 2008-09-21 16:02 <DIR> d-------- C:\Program Files\AutoConnect 2008-08-27 00:04 . 2004-08-04 02:44 153,088 --a------ C:\WINDOWS\system32\irftp.exe 2008-08-27 00:04 . 2004-08-04 01:00 87,424 --a------ C:\WINDOWS\system32\drivers\irda.sys 2008-08-27 00:04 . 2004-08-04 02:44 77,312 --a------ C:\WINDOWS\system32\usbui.dll 2008-08-27 00:04 . 2004-08-04 02:44 27,648 --a------ C:\WINDOWS\system32\irmon.dll 2008-08-27 00:04 . 2001-08-17 23:51 19,584 --a------ C:\WINDOWS\system32\drivers\rasirda.sys 2008-08-27 00:04 . 2001-08-17 23:51 18,688 --a------ C:\WINDOWS\system32\drivers\irsir.sys 2008-08-27 00:04 . 2004-08-04 02:44 8,192 --a------ C:\WINDOWS\system32\wshirda.dll 2008-08-27 00:03 . 2008-08-27 00:03 <DIR> d-------- C:\Program Files\Sun 2008-08-27 00:02 . 2008-09-21 00:02 <DIR> d-------- C:\WINDOWS\system32\CatRoot2 2008-08-27 00:02 . 2008-08-27 00:02 <DIR> d-------- C:\Program Files\Java 2008-08-27 00:02 . 2008-08-27 00:02 <DIR> dr-h----- C:\Documents and Settings\Default User\Ustawienia lokalne 2008-08-27 00:02 . 2008-08-27 00:02 <DIR> d-------- C:\Documents and Settings\Default User\Ulubione 2008-08-27 00:02 . 2008-08-26 22:09 <DIR> d--h----- C:\Documents and Settings\Default User\Szablony 2008-08-27 00:02 . 2008-08-27 00:02 <DIR> d-------- C:\Documents and Settings\Default User\Pulpit 2008-08-27 00:02 . 2008-08-27 00:02 <DIR> d-------- C:\Documents and Settings\Default User\Moje dokumenty 2008-08-27 00:02 . 2008-08-27 00:02 <DIR> dr------- C:\Documents and Settings\Default User\Menu Start 2008-08-27 00:02 . 2008-08-27 00:02 <DIR> dr-h----- C:\Documents and Settings\Default User\Dane aplikacji 2008-08-27 00:02 . 2008-08-27 00:02 <DIR> d-------- C:\Documents and Settings\All Users\Ulubione 2008-08-27 00:02 . 2008-08-27 00:03 <DIR> d--h----- C:\Documents and Settings\All Users\Szablony 2008-08-27 00:02 . 2008-09-30 16:11 <DIR> d-------- C:\Documents and Settings\All Users\Pulpit 2008-08-27 00:02 . 2008-08-27 00:03 <DIR> dr------- C:\Documents and Settings\All Users\Menu Start 2008-08-27 00:02 . 2008-08-26 22:10 <DIR> dr------- C:\Documents and Settings\All Users\Dokumenty 2008-08-27 00:02 . 2008-09-30 16:45 <DIR> dr-h----- C:\Documents and Settings\All Users\Dane aplikacji 2008-08-27 00:01 . 2008-08-26 22:15 261 --a------ C:\WINDOWS\system32\$winnt$.inf . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-08-27 00:52 --------- d-----w C:\Documents and Settings\Marek\Dane aplikacji\Winamp 2008-08-26 21:59 --------- d-----w C:\Program Files\Common Files\Java 2008-08-26 20:46 --------- d-----w C:\Program Files\Winamp 2008-08-26 20:45 --------- d-----w C:\Program Files\Winamp Toolbar 2008-08-26 20:45 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Winamp Toolbar 2008-08-26 20:39 --------- d-----w C:\Program Files\Gadu-Gadu 2008-08-26 20:30 --------- d-----w C:\Program Files\Realtek Sound Manager 2008-08-26 20:30 --------- d-----w C:\Program Files\AvRack 2008-08-26 20:29 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-08-26 20:29 --------- d-----w C:\Program Files\AMD 2008-08-26 20:28 4,096 ----a-w C:\WINDOWS\gdrv.sys 2008-08-26 20:23 --------- d-----w C:\Program Files\Common Files\InstallShield 2008-08-26 20:21 --------- d-----w C:\Program Files\Thomson 2008-08-26 20:21 --------- d-----w C:\Program Files\Neostrada TP 2008-08-26 20:13 --------- d-----w C:\Program Files\microsoft frontpage 2008-08-26 20:12 --------- d-----w C:\Program Files\Usługi online 2008-07-25 08:34 81,920 ----a-w C:\WINDOWS\system32\dpl100.dll 2008-07-25 08:34 683,520 ----a-w C:\WINDOWS\system32\divx.dll 2008-07-23 16:50 3,596,288 ----a-w C:\WINDOWS\system32\qt-dx331.dll . (((((((((((((((((((((((((((((((((((((((((((( Look ))))))))))))))))))))))))))))))))))))))))))))))))))))))))) . ---- Directory of C:\downtube ---- 2008-09-30 15:46 77533 --a------ C:\downtube\Uninstal.exe 2007-04-13 19:30 2166784 --a------ C:\downtube\DowntubeWIN32.exe 2007-04-13 19:25 18 --a------ C:\downtube\config\videodir.cfg 2007-04-13 19:25 14 --a------ C:\downtube\config\videoplayer.cfg 2007-04-13 19:25 0 --a------ C:\downtube\config\proxyuser.cfg 2007-04-13 19:25 0 --a------ C:\downtube\config\proxypwd.cfg 2007-04-13 19:25 0 --a------ C:\downtube\config\proxy.cfg 2007-04-13 19:25 0 --a------ C:\downtube\config\encoder.cfg 2007-04-13 19:25 0 --a------ C:\downtube\config\browser.cfg 2007-03-24 22:04 0 --a------ C:\downtube\config\video2.cfg 2007-03-24 22:04 0 --a------ C:\downtube\config\video1.cfg 2007-03-24 22:04 0 --a------ C:\downtube\config\skinz.cfg 2007-03-10 03:01 6656 --a------ C:\downtube\theme\default\Thumbs.db 2007-03-10 02:47 47549 --a------ C:\downtube\theme\default\default-skin.jpg 2007-03-10 02:45 8 --a------ C:\downtube\theme\default\textcolor 2007-03-10 02:42 8 --a------ C:\downtube\theme\default\backcolor 2007-03-08 00:26 25 --a------ C:\downtube\batches\stopdt.bat 2007-03-06 22:42 104 --a------ C:\downtube\batches\convert3gp.bat 2007-03-06 02:54 546468 --a------ C:\downtube\lib\shared.zip 2007-03-06 02:35 16896 --a------ C:\downtube\downtube.exe 2007-02-23 00:51 18 --a------ C:\downtube\config\nfolder.cfg 2007-02-23 00:51 18 --a------ C:\downtube\config\folder.cfg 2007-01-15 21:24 8 --a------ C:\downtube\config\update.cfg 2006-09-19 14:52 77824 --a------ C:\downtube\lib\bz2.pyd 2006-09-19 14:52 655360 --a------ C:\downtube\lib\_ssl.pyd 2006-09-19 14:52 53248 --a------ C:\downtube\lib\_socket.pyd 2006-09-19 14:52 475136 --a------ C:\downtube\lib\unicodedata.pyd 2006-09-19 14:52 2109440 --a------ C:\downtube\python25.dll 2006-09-08 19:58 7260701 --a------ C:\downtube\ffmpeg.exe 2006-05-03 11:06 389120 --a------ C:\downtube\codecs\FLVSplitter.ax ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks] "{57BCA5FA-5DBB-45a2-B558-1755C3F6253B}"= "C:\Program Files\Winamp Toolbar\winamptb.dll" [2008-07-16 1266992] [HKEY_CLASSES_ROOT\clsid\{57bca5fa-5dbb-45a2-b558-1755c3f6253b}] [HKEY_CLASSES_ROOT\WINAMPTB.AOLTBSearch.1] [HKEY_CLASSES_ROOT\TypeLib\{538CD77C-BFDD-49b0-9562-77419CAB89D1}] [HKEY_CLASSES_ROOT\WINAMPTB.AOLTBSearch] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 15360] "Gadu-Gadu"="C:\Program Files\Gadu-Gadu\gg.exe" [2008-03-20 2127296] "AutoConnect"="C:\Program Files\AutoConnect\AutoConnect.exe" [2006-12-03 310784] "SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2008-01-28 2097488] "MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-08-04 1667584] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2005-06-15 6803456] "NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2005-06-15 86016] "WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2008-08-04 36352] "nwiz"="nwiz.exe" [2005-06-15 C:\WINDOWS\system32\nwiz.exe] "SoundMan"="SOUNDMAN.EXE" [2004-12-22 C:\WINDOWS\SOUNDMAN.EXE] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 15360] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "VIDC.YV12"= yv12vfw.dll [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpeedTouch USB Diagnostics] --a------ 2004-01-26 11:38 866816 C:\Program Files\Thomson\SpeedTouch USB\dragdiag.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpybotSD TeaTimer] -rahs---- 2008-01-28 11:43 2097488 C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched] --a------ 2008-06-10 04:27 144784 C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "C:\\Program Files\\Java\\jre1.6.0_07\\launch4j-tmp\\JDownloader.exe"= "C:\\WINDOWS\\system32\\java.exe"= "C:\\Program Files\\eMule\\emule.exe"= "C:\\Program Files\\Messenger\\msmsgs.exe"= "C:\\Program Files\\Mozilla Firefox\\firefox.exe"= "E:\\CS\\hl.exe"= . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-09-21 16:12:14 Windows 5.1.2600 Dodatek Service Pack 2 NTFS skanowanie ukrytych procesów ... skanowanie ukrytych wpisów autostartu ... skanowanie ukrytych plików ... skanowanie pomyślnie ukończone ukryte pliki: 0 ************************************************************************** . Czas ukończenia: 2008-09-21 16:12:49 ComboFix-quarantined-files.txt 2008-09-21 14:12:47 ComboFix2.txt 2008-09-20 22:03:06 Przed: 9˙516˙732˙416 bajt˘w wolnych Po: 9,509,974,016 bajt˘w wolnych 464 --- E O F --- 2008-09-04 14:13:07

Dodano 21.09.2008 16:27:31:

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 16:26:21, on 2008-09-21 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\RUNDLL32.EXE C:\WINDOWS\SOUNDMAN.EXE C:\Program Files\Winamp\winampa.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Gadu-Gadu\gg.exe C:\Program Files\AutoConnect\AutoConnect.exe C:\Program Files\Messenger\msmsgs.exe C:\Program Files\Winamp\winamp.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza R3 - URLSearchHook: Winamp Search Class - {57BCA5FA-5DBB-45a2-B558-1755C3F6253B} - C:\Program Files\Winamp Toolbar\winamptb.dll O2 - BHO: Winamp Toolbar Loader - {25CEE8EC-5730-41bc-8B58-22DDC8AB8C20} - C:\Program Files\Winamp Toolbar\winamptb.dll O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll O2 - BHO: DealioBHO Class - {6A87B991-A31F-4130-AE72-6D0C294BF082} - C:\Program Files\Dealio\kb127\Dealio.dll (file missing) O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O3 - Toolbar: Winamp Toolbar - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - C:\Program Files\Winamp Toolbar\winamptb.dll O3 - Toolbar: Dealio - {E67C74F4-A00A-4F2C-9FEC-FD9DC004A67F} - C:\Program Files\Dealio\kb127\Dealio.dll (file missing) O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe" O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - HKCU\..\Run: [AutoConnect] C:\Program Files\AutoConnect\AutoConnect.exe O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O8 - Extra context menu item: Compare Prices with &Dealio - C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\res\DealioSearch.html O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll O17 - HKLM\System\CCS\Services\Tcpip\..\{5D18A429-CB60-472D-8E8F-9D8EA3046305}: NameServer = 194.204.152.34 217.98.63.164 O17 - HKLM\System\CS1\Services\Tcpip\..\{5D18A429-CB60-472D-8E8F-9D8EA3046305}: NameServer = 194.204.152.34 217.98.63.164 O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe -- End of file - 4602 bytes

Kod: Zaznacz wszystko: "Silent Runners.vbs", revision 58, http://www.silentrunners.org/ Operating System: Windows XP SP2 Output limited to non-default values, except where indicated by "{++}" Startup items buried in registry: --------------------------------- HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ {++} "CTFMON.EXE" = "C:\WINDOWS\system32\ctfmon.exe" [MS] "Gadu-Gadu" = ""C:\Program Files\Gadu-Gadu\gg.exe" /tray" ["Gadu-Gadu S.A."] "AutoConnect" = "C:\Program Files\AutoConnect\AutoConnect.exe" ["http://autoconnect.prv.pl"] "SpybotSD TeaTimer" = "C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" ["Safer Networking Limited"] "MSMSGS" = ""C:\Program Files\Messenger\msmsgs.exe" /background" [MS] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++} "NvCplDaemon" = "RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup" [MS] "nwiz" = "nwiz.exe /install" ["NVIDIA Corporation"] "NvMediaCenter" = "RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit" [MS] "SoundMan" = "SOUNDMAN.EXE" ["Realtek Semiconductor Corp."] "WinampAgent" = ""C:\Program Files\Winamp\winampa.exe"" [null data] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ {25CEE8EC-5730-41bc-8B58-22DDC8AB8C20}\(Default) = "Winamp Toolbar Loader" -> {HKLM...CLSID} = "Winamp Toolbar Loader" \InProcServer32\(Default) = "C:\Program Files\Winamp Toolbar\winamptb.dll" ["AOL LLC."] {53707962-6F74-2D53-2644-206D7942484F}\(Default) = (no title provided) -> {HKLM...CLSID} = "Spybot-S&D IE Protection" \InProcServer32\(Default) = "C:\Program Files\Spybot - Search & Destroy\SDHelper.dll" ["Safer Networking Limited"] {6A87B991-A31F-4130-AE72-6D0C294BF082}\(Default) = (no title provided) -> {HKLM...CLSID} = "DealioBHO Class" \InProcServer32\(Default) = "C:\Program Files\Dealio\kb127\Dealio.dll" [file not found] {761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\(Default) = (no title provided) -> {HKLM...CLSID} = "SSVHelper Class" \InProcServer32\(Default) = "C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll" ["Sun Microsystems, Inc."] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\ "{42071714-76d4-11d1-8b24-00a0c9068ff3}" = "Rozszerzenie CPL kadrowania wyświetlania" -> {HKLM...CLSID} = "Rozszerzenie CPL kadrowania wyświetlania" \InProcServer32\(Default) = "deskpan.dll" [file not found] "{88895560-9AA2-1069-930E-00AA0030EBC8}" = "Rozszerzenie ikony HyperTerminalu" -> {HKLM...CLSID} = "HyperTerminal Icon Ext" \InProcServer32\(Default) = "C:\WINDOWS\system32\hticons.dll" ["Hilgraeve, Inc."] "{A70C977A-BF00-412C-90B7-034C51DA2439}" = "NvCpl DesktopContext Class" -> {HKLM...CLSID} = "DesktopContext Class" \InProcServer32\(Default) = "C:\WINDOWS\system32\nvcpl.dll" ["NVIDIA Corporation"] "{FFB699E0-306A-11d3-8BD1-00104B6F7516}" = "Play on my TV helper" -> {HKLM...CLSID} = "NVIDIA CPL Extension" \InProcServer32\(Default) = "C:\WINDOWS\system32\nvcpl.dll" ["NVIDIA Corporation"] "{1CDB2949-8F65-4355-8456-263E7C208A5D}" = "Desktop Explorer" -> {HKLM...CLSID} = "Desktop Explorer" \InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"] "{1E9B04FB-F9E5-4718-997B-B8DA88302A47}" = "Desktop Explorer Menu" -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"] "{1E9B04FB-F9E5-4718-997B-B8DA88302A48}" = "nView Desktop Context Menu" -> {HKLM...CLSID} = "nView Desktop Context Menu" \InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"] "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" = "WinRAR shell extension" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] "{00020D75-0000-0000-C000-000000000046}" = "Microsoft Office Outlook Desktop Icon Handler" -> {HKLM...CLSID} = "Microsoft Office Outlook" \InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\OFFICE11\MLSHEXT.DLL" [MS] "{0006F045-0000-0000-C000-000000000046}" = "Microsoft Office Outlook Custom Icon Handler" -> {HKLM...CLSID} = "Rozszerzenie ikon plików programu Outlook" \InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\OFFICE11\OLKFSTUB.DLL" [MS] "{42042206-2D85-11D3-8CFF-005004838597}" = "Microsoft Office HTML Icon Handler" -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "C:\Program Files\Microsoft Office\OFFICE11\msohev.dll" [MS] HKLM\SOFTWARE\Classes\PROTOCOLS\Filter\ <<!>> text/xml\CLSID = "{807553E5-5146-11D5-A672-00B0D022E945}" -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL" [MS] HKLM\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\ WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] HKLM\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\ WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] HKLM\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\ WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] Default executables: -------------------- <<!>> HKLM\SOFTWARE\Classes\.com\(Default) = "ComFile" Group Policies {GPedit.msc branch and setting}: ----------------------------------------------- Note: detected settings may not have any effect. HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\ "NoDrives" = (REG_DWORD) dword:0x00000000 {unrecognized setting} HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\ "NoDrives" = (REG_DWORD) dword:0x00000000 {unrecognized setting} HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System\ "HideLegacyLogonScripts" = (REG_DWORD) dword:0x00000000 {unrecognized setting} "HideLogoffScripts" = (REG_DWORD) dword:0x00000000 {unrecognized setting} "HideStartupScripts" = (REG_DWORD) dword:0x00000000 {unrecognized setting} "RunLogonScriptSync" = (REG_DWORD) dword:0x00000001 {unrecognized setting} "RunStartupScriptSync" = (REG_DWORD) dword:0x00000000 {unrecognized setting} HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ "shutdownwithoutlogon" = (REG_DWORD) dword:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| Shutdown: Allow system to be shut down without having to log on} "undockwithoutlogon" = (REG_DWORD) dword:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| Devices: Allow undock without having to log on} "DisableRegistryTools" = (REG_DWORD) dword:0x00000000 {unrecognized setting} "HideLegacyLogonScripts" = (REG_DWORD) dword:0x00000000 {unrecognized setting} "HideLogoffScripts" = (REG_DWORD) dword:0x00000000 {unrecognized setting} "RunLogonScriptSync" = (REG_DWORD) dword:0x00000001 {unrecognized setting} "RunStartupScriptSync" = (REG_DWORD) dword:0x00000000 {unrecognized setting} "HideStartupScripts" = (REG_DWORD) dword:0x00000000 {unrecognized setting} Active Desktop and Wallpaper: ----------------------------- Active Desktop may be disabled at this entry: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState Displayed if Active Desktop enabled and wallpaper not set by Group Policy: HKCU\Software\Microsoft\Internet Explorer\Desktop\General\ "Wallpaper" = "C:\WINDOWS\web\wallpaper\Idylla.bmp" Displayed if Active Desktop disabled and wallpaper not set by Group Policy: HKCU\Control Panel\Desktop\ "Wallpaper" = "C:\WINDOWS\web\wallpaper\Idylla.bmp" Windows Portable Device AutoPlay Handlers ----------------------------------------- HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers\Handlers\ MPCPlayCDAudioOnArrival\ "Provider" = "Media Player Classic" "InvokeProgID" = "MediaPlayerClassic.Autorun" "InvokeVerb" = "PlayCDAudio" HKLM\SOFTWARE\Classes\MediaPlayerClassic.Autorun\shell\PlayCDAudio\command\(Default) = ""C:\Program Files\K-Lite Codec Pack\Media Player Classic\mplayerc.exe" %1 /cd" ["Gabest"] MPCPlayDVDMovieOnArrival\ "Provider" = "Media Player Classic" "InvokeProgID" = "MediaPlayerClassic.Autorun" "InvokeVerb" = "PlayDVDMovie" HKLM\SOFTWARE\Classes\MediaPlayerClassic.Autorun\shell\PlayDVDMovie\command\(Default) = ""C:\Program Files\K-Lite Codec Pack\Media Player Classic\mplayerc.exe" %1 /dvd" ["Gabest"] MPCPlayMusicFilesOnArrival\ "Provider" = "Media Player Classic" "InvokeProgID" = "MediaPlayerClassic.Autorun" "InvokeVerb" = "PlayMusicFiles" HKLM\SOFTWARE\Classes\MediaPlayerClassic.Autorun\shell\PlayMusicFiles\command\(Default) = ""C:\Program Files\K-Lite Codec Pack\Media Player Classic\mplayerc.exe" %1" ["Gabest"] MPCPlayVideoFilesOnArrival\ "Provider" = "Media Player Classic" "InvokeProgID" = "MediaPlayerClassic.Autorun" "InvokeVerb" = "PlayVideoFiles" HKLM\SOFTWARE\Classes\MediaPlayerClassic.Autorun\shell\PlayVideoFiles\command\(Default) = ""C:\Program Files\K-Lite Codec Pack\Media Player Classic\mplayerc.exe" %1" ["Gabest"] MSPlayCDAudioOnArrival\ "Provider" = "ALLPlayer" "InvokeProgID" = "AllPlayerFile" "InvokeVerb" = "play" HKLM\SOFTWARE\Classes\AllPlayerFile\shell\play\command\(Default) = ""C:\Program Files\ALLPlayer\ALLPlayer.exe" "%1"" ["ALLPlayer"] WinampMTPHandler\ "Provider" = "Winamp" "ProgID" = "Shell.HWEventHandlerShellExecute" "InitCmdLine" = "C:\Program Files\Winamp\winamp.exe" HKLM\SOFTWARE\Classes\Shell.HWEventHandlerShellExecute\CLSID\(Default) = "{FFB8655F-81B9-4fce-B89C-9A6BA76D13E7}" -> {HKLM...CLSID} = "ShellExecute HW Event Handler" \LocalServer32\(Default) = "rundll32.exe shell32.dll,SHCreateLocalServerRunDll {FFB8655F-81B9-4fce-B89C-9A6BA76D13E7}" [MS] WinampPlayMediaOnArrival\ "Provider" = "Winamp" "InvokeProgID" = "Winamp.File" "InvokeVerb" = "Play" HKLM\SOFTWARE\Classes\Winamp.File\shell\Play\command\(Default) = ""C:\Program Files\Winamp\winamp.exe" "%1"" ["Nullsoft"] HKLM\SOFTWARE\Classes\Winamp.File\shell\Play\DropTarget\CLSID = "{46986115-84D6-459c-8F95-52DD653E532E}" -> {HKLM...CLSID} = (no title provided) \LocalServer32\(Default) = ""C:\Program Files\Winamp\winamp.exe"" ["Nullsoft"] Winsock2 Service Provider DLLs: ------------------------------- Namespace Service Providers HKLM\SYSTEM\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++} 000000000001\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS] 000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS] 000000000003\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS] Transport Service Providers HKLM\SYSTEM\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++} 0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range: %SystemRoot%\system32\mswsock.dll [MS], 01 - 04, 07 - 18 %SystemRoot%\system32\rsvpsp.dll [MS], 05 - 06 Toolbars, Explorer Bars, Extensions: ------------------------------------ Toolbars HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\ "{EBF2BA02-9094-4C5A-858B-BB198F3D8DE2}" -> {HKLM...CLSID} = "Winamp Toolbar" \InProcServer32\(Default) = "C:\Program Files\Winamp Toolbar\winamptb.dll" ["AOL LLC."] "{E67C74F4-A00A-4F2C-9FEC-FD9DC004A67F}" -> {HKLM...CLSID} = "Dealio" \InProcServer32\(Default) = "C:\Program Files\Dealio\kb127\Dealio.dll" [file not found] HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ "{EBF2BA02-9094-4C5A-858B-BB198F3D8DE2}" = "Winamp Toolbar" -> {HKLM...CLSID} = "Winamp Toolbar" \InProcServer32\(Default) = "C:\Program Files\Winamp Toolbar\winamptb.dll" ["AOL LLC."] "{E67C74F4-A00A-4F2C-9FEC-FD9DC004A67F}" = (no title provided) -> {HKLM...CLSID} = "Dealio" \InProcServer32\(Default) = "C:\Program Files\Dealio\kb127\Dealio.dll" [file not found] Explorer Bars HKLM\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\ HKLM\SOFTWARE\Classes\CLSID\{FF059E31-CC5A-4E2E-BF3B-96E929D65503}\(Default) = "&Badanie" Implemented Categories\{00021493-0000-0000-C000-000000000046}\ [vertical bar] InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL" [MS] Extensions (Tools menu items, main toolbar menu buttons) HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\ {08B0E5C0-4FCB-11CF-AAA5-00401C608501}\ "MenuText" = "Sun Java Console" "CLSIDExtension" = "{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBC}" -> {HKCU...CLSID} = "Java Plug-in 1.6.0_07" \InProcServer32\(Default) = "C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll" ["Sun Microsystems, Inc."] -> {HKLM...CLSID} = "Java Plug-in 1.6.0_07" \InProcServer32\(Default) = "C:\Program Files\Java\jre1.6.0_07\bin\npjpi160_07.dll" ["Sun Microsystems, Inc."] {92780B25-18CC-41C8-B9BE-3C9C571A8263}\ "ButtonText" = "Badanie" {DFB852A3-47F8-48C4-A200-58CAB36FD2A2}\ "MenuText" = "Spybot - Search && Destroy Configuration" "CLSIDExtension" = "{53707962-6F74-2D53-2644-206D7942484F}" -> {HKLM...CLSID} = "Spybot-S&D IE Protection" \InProcServer32\(Default) = "C:\Program Files\Spybot - Search & Destroy\SDHelper.dll" ["Safer Networking Limited"] Miscellaneous IE Hijack Points ------------------------------ HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks\ <<H>> "{57BCA5FA-5DBB-45a2-B558-1755C3F6253B}" = (no title provided) -> {HKLM...CLSID} = "Winamp Search Class" \InProcServer32\(Default) = "C:\Program Files\Winamp Toolbar\winamptb.dll" ["AOL LLC."] Running Services (Display Name, Service Name, Path {Service DLL}): ------------------------------------------------------------------ NVIDIA Display Driver Service, NVSvc, "C:\WINDOWS\system32\nvsvc32.exe" ["NVIDIA Corporation"] Windows User Mode Driver Framework, UMWdf, "C:\WINDOWS\system32\wdfmgr.exe" [MS] Print Monitors: --------------- HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors\ Canon BJ Language Monitor PIXMA iP1500\Driver = "CNMLM5y.DLL" ["CANON INC."] Microsoft Document Imaging Writer Monitor\Driver = "mdimon.dll" [MS] ---------- (launch time: 2008-09-21 16:26:45) <<!>>: Suspicious data at a malware launch point. <<H>>: Suspicious data at a browser hijack point. + This report excludes default entries except where indicated. + To see *everywhere* the script checks and *everything* it finds, launch it from a command prompt or a shortcut with the -all parameter. + To search all directories of local fixed drives for DESKTOP.INI DLL launch points, use the -supp parameter or answer "No" at the first message box and "Yes" at the second message box. ---------- (total run time: 28 seconds, including 1 second for message boxes)

**Posty:** 684 · przez **djarta** 21 Wrz 2008, 17:04

Logi wyglądają na czyste.

Wykonaj to co jest podane w tym temacie (jeśli wykonałeś/łaś to wcześniej to nie rób tego).

Usuń ręcznie folder C:\Qoobox,

Usuń instalkę ComboFix z dysku.

Wykonaj optymalizację autostartu

Przeczyść komputer ATF-Cleaner

Wyłącz i włącz przywracanie systemu na wszystkich dyskach.Instrukcja

Przeskanuj obszar mojego komputera http://www.kaspersky.pl/virusscanner.html (uruchom przez IE) Daj raport z niego na forum.

i tym:

FixIEDef.

==============================
K.

**Posty:** 18165 · przez **wojtas** 21 Wrz 2008, 18:41

O2 - BHO: DealioBHO Class - {6A87B991-A31F-4130-AE72-6D0C294BF082} - C:\Program Files\Dealio\kb127\Dealio.dll (file missing)
O3 - Toolbar: Dealio - {E67C74F4-A00A-4F2C-9FEC-FD9DC004A67F} - C:\Program Files\Dealio\kb127\Dealio.dll (file missing)
O8 - Extra context menu item: Compare Prices with &Dealio - C:\Documents and Settings\Marek\Dane aplikacji\Dealio\kb127\res\DealioSearch.html

to skasuj

**Posty:** 378 · przez **TARCZYN** 21 Wrz 2008, 19:39

Kod: Zaznacz wszystko: ******************************************************************************** * * * FixIEDef Log * * Version 1.6.10.6162 * * * ******************************************************************************** Created at 19:38:34 on Sunday, September 21, 2008 Time Zone : Logged On User : Marek Operating System : Microsoft Windows XP Professional Dodatek Service Pack 2 OS Version : 5.1.2600 System Langauge : Polish Keyboard Layout : Polish Processor : X86 AMD Athlon(tm) 64 Processor 3000+ System Drive : C:\ Windows Directory : C:\WINDOWS System Directory : C:\WINDOWS\system32 System Drive Type : Fixed System Drive Status : READY System Drive Label : System Drive Size : 13.44 GB System Drive Free : 9.09 GB Total Physical Memory: 1279 MB Free Physical Memory : 941 MB Total Page File : 1279 MB Free Page File : 2455 MB Total Virtual Memory : 2048 MB Free Virtual Memory : 1973 MB Boot State : Normal boot -------------------------------------------------------------------------------- !!! Files that have been deleted !!! No malicious files found -------------------------------------------------------------------------------- !!! Directories that have been removed !!! No malicious directories to be removed -------------------------------------------------------------------------------- !!! Registry entries that have been removed !!! No malicious Registry entries found ================================================================================ All Done :) ShadowPuterDude Safe Surfing!!!

**Posty:** 18165 · przez **wojtas** 21 Wrz 2008, 20:47

jest ok

**Posty:** 378 · przez **TARCZYN** 21 Wrz 2008, 20:52

ale lagi sa dalej

Kto jest na forum