svechost , bonjur , ezula itp

**Posty:** 644 · przez **LUBER** 25 Paź 2007, 23:31

Witam, w msconfig zauważyłem że włącza się coś takiego jak "svechost.exe" , uruchamia się także bonjur plus sb - s&d nie może sobie poradzić z tym syfem.
Starałem się coś sam usuwać , wyłączyłem procesy bonjura oraz wywaliłem go przy pomocy unlockera, wywaliłem też schEchost.exe z autostartu(pliku nie widac) , ale dalej jest syf :< Pozdrawiam.

Zamieszczam log z Hjt:

Logfile of HijackThis v1.99.1
Scan saved at 23:34:55, on 2007-10-25
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0011)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32\svehost.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
D:\PrOgRaMy\Instalki\Internet\HijackThis\HijackThis.exe
C:\Program Files\Alwil Software\Avast4\setup\avast.setup
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\imapi.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: flashget urlcatch - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\Program Files\FlashGet\jccatch.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: FlashGet GetFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\Program Files\FlashGet\getflash.dll
O3 - Toolbar: &Tłumaczenie - {0D704FAD-66E9-4F0A-BFED-4F665770DDB3} - C:\Program Files\Techland\Common\InternetTranslator\InternetTranslator.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [Microsoft Updates] svehost.exe
O4 - HKLM\..\RunServices: [Microsoft Updates] svehost.exe
O8 - Extra context menu item: &Ściągnij przy pomocy FlashGet'a - C:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: &Ściągnij wszystko przy pomocy FlashGet'a - C:\Program Files\FlashGet\jc_all.htm
O8 - Extra context menu item: E&ksportuj do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: Wyślij do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Wyślij &do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {B46B0919-62BA-4D99-A5C4-916B57A6805C} - C:\Program Files\Techland\Common\InternetTranslator\InternetTranslator.dll
O9 - Extra 'Tools' menuitem: @C:\Program Files\Techland\Common\InternetTranslator\InternetTranslator.dll,-103 - {B46B0919-62BA-4D99-A5C4-916B57A6805C} - C:\Program Files\Techland\Common\InternetTranslator\InternetTranslator.dll
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe
O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe
O16 - DPF: {68282C51-9459-467B-95BF-3C0E89627E55} (MksSkanerOnline Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

**Posty:** 3854 · przez **Dzi@dek** 26 Paź 2007, 00:16

Tryb awaryjny po wyłączeniu przywracania systemu.
Kasujesz wpisy a później plik pogrubiony w lokalizacji
C:\WINDOWS\system32\svehost.exe Malware.Trojan.Backdoor.Gen

O4 - HKLM\..\Run: [Microsoft Updates] svehost.exe
O4 - HKLM\..\RunServices: [Microsoft Updates] svehost.exe

**Posty:** 7838 · przez **Lukesh** 26 Paź 2007, 00:26

Proponowalbym tez zastosowac sie do tego tematu: http://forum.programosy.pl/bad-generic-host-process-for-win32-services-vt79489.html

**Posty:** 644 · przez **LUBER** 26 Paź 2007, 11:51

Tryb awaryjny po wyłączeniu przywracania systemu.
Kasujesz wpisy a później plik pogrubiony w lokalizacji
C:\WINDOWS\system32\svehost.exe Malware.Trojan.Backdoor.Gen

Zrobione , nowy log:

Logfile of HijackThis v1.99.1
Scan saved at 11:50:31, on 2007-10-26
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0011)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
D:\PrOgRaMy\Instalki\Internet\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: flashget urlcatch - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\Program Files\FlashGet\jccatch.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: FlashGet GetFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\Program Files\FlashGet\getflash.dll
O3 - Toolbar: &Tłumaczenie - {0D704FAD-66E9-4F0A-BFED-4F665770DDB3} - C:\Program Files\Techland\Common\InternetTranslator\InternetTranslator.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O8 - Extra context menu item: &Ściągnij przy pomocy FlashGet'a - C:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: &Ściągnij wszystko przy pomocy FlashGet'a - C:\Program Files\FlashGet\jc_all.htm
O8 - Extra context menu item: E&ksportuj do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: Wyślij do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Wyślij &do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {B46B0919-62BA-4D99-A5C4-916B57A6805C} - C:\Program Files\Techland\Common\InternetTranslator\InternetTranslator.dll
O9 - Extra 'Tools' menuitem: @C:\Program Files\Techland\Common\InternetTranslator\InternetTranslator.dll,-103 - {B46B0919-62BA-4D99-A5C4-916B57A6805C} - C:\Program Files\Techland\Common\InternetTranslator\InternetTranslator.dll
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe
O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe
O16 - DPF: {68282C51-9459-467B-95BF-3C0E89627E55} (MksSkanerOnline Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

Lukesh napisał(a):Proponowalbym tez zastosowac sie do tego tematu: http://forum.programosy.pl/bad-generic-host-process-for-win32-services-vt79489.html

Oczywiście się zastosowałem

Pozdrawiam

**Posty:** 3854 · przez **Dzi@dek** 26 Paź 2007, 12:31

Czysty.

**Posty:** 18165 · przez **wojtas** 26 Paź 2007, 13:57

daj loga z combofixa

**Posty:** 644 · przez **LUBER** 26 Paź 2007, 16:53

Znalazł i usunął(chyba) 3 pliki po czym nastąpił restart , log:

ComboFix 07-10-26.4 - Łukasz 2007-10-26 16:46:58.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.708 [GMT 2:00]
Running from: C:\Documents and Settings\Łukasz\Moje dokumenty\Downloads\ComboFix.exe
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\system32\drivers\npf.sys
C:\WINDOWS\system32\packet.dll
C:\WINDOWS\system32\wpcap.dll

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.
-------\LEGACY_NPF
-------\NPF

((((((((((((((((((((((((( Files Created from 2007-09-26 to 2007-10-26 )))))))))))))))))))))))))))))))
.

2007-10-26 16:46 51,200 --a------ C:\WINDOWS\NirCmd.exe
2007-10-25 21:16 <DIR> d-------- C:\Program Files\SkanerOnline
2007-10-25 19:20 2,463,976 --a------ C:\WINDOWS\system32\NPSWF32.dll
2007-10-25 19:20 190,696 --a------ C:\WINDOWS\system32\NPSWF32_FlashUtil.exe
2007-10-25 19:14 <DIR> d-------- C:\Program Files\Common Files\Macrovision Shared
2007-10-25 18:29 <DIR> d-------- C:\totalcmd
2007-10-25 18:29 545 --a------ C:\WINDOWS\UC.PIF
2007-10-25 18:29 545 --a------ C:\WINDOWS\RAR.PIF
2007-10-25 18:29 545 --a------ C:\WINDOWS\PKZIP.PIF
2007-10-25 18:29 545 --a------ C:\WINDOWS\PKUNZIP.PIF
2007-10-25 18:29 545 --a------ C:\WINDOWS\NOCLOSE.PIF
2007-10-25 18:29 545 --a------ C:\WINDOWS\LHA.PIF
2007-10-25 18:29 545 --a------ C:\WINDOWS\ARJ.PIF
2007-10-24 16:00 <DIR> d-------- C:\Program Files\Registry Shower 2007
2007-10-24 14:39 <DIR> d-a------ C:\Documents and Settings\All Users\Dane aplikacji\TEMP
2007-10-22 19:54 <DIR> d-------- C:\Documents and Settings\Łukasz\Dane aplikacji\Media Player Classic
2007-10-22 19:54 <DIR> d-------- C:\Documents and Settings\Łukasz\Dane aplikacji\Media Player Classic
2007-10-22 19:54 <DIR> d-------- C:\Documents and Settings\Łukasz\Dane aplikacji\Media Player Classic
2007-10-22 19:53 <DIR> d-------- C:\Program Files\Real Alternative
2007-10-19 18:11 <DIR> d-------- C:\Program Files\Winamp Remote
2007-10-19 18:11 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\OrbNetworks
2007-10-17 22:36 <DIR> dr-h----- C:\Documents and Settings\Łukasz\Dane aplikacji\SecuROM
2007-10-17 22:36 <DIR> dr-h----- C:\Documents and Settings\Łukasz\Dane aplikacji\SecuROM
2007-10-17 22:36 <DIR> dr-h----- C:\Documents and Settings\Łukasz\Dane aplikacji\SecuROM
2007-10-16 23:48 <DIR> d-------- C:\Documents and Settings\LocalService\Moje dokumenty
2007-10-15 15:33 <DIR> d-------- C:\Program Files\Half Life 2 EP2
2007-10-07 14:53 <DIR> d-------- C:\Program Files\Native Instruments
2007-10-06 18:44 <DIR> d-------- C:\Program Files\Teamspeak2_RC2
2007-10-06 18:44 <DIR> d-------- C:\Documents and Settings\Łukasz\Dane aplikacji\teamspeak2
2007-10-06 18:44 <DIR> d-------- C:\Documents and Settings\Łukasz\Dane aplikacji\teamspeak2
2007-10-06 18:44 <DIR> d-------- C:\Documents and Settings\Łukasz\Dane aplikacji\teamspeak2
2007-10-06 01:36 <DIR> d-------- C:\Fraps
2007-10-05 19:58 <DIR> d-------- C:\Program Files\Replay Converter
2007-10-05 19:58 737,280 --a------ C:\WINDOWS\iun6002.exe
2007-10-04 21:31 <DIR> d-------- C:\Program Files\DivX
2007-10-04 21:31 684 --a------ C:\WINDOWS\mozver.dat
2007-10-04 19:54 <DIR> d-------- C:\Program Files\ToniArts
2007-10-04 19:44 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Spybot - Search & Destroy
2007-10-04 17:33 <DIR> d-------- C:\Documents and Settings\Łukasz\Dane aplikacji\Ahead
2007-10-04 17:33 <DIR> d-------- C:\Documents and Settings\Łukasz\Dane aplikacji\Ahead
2007-10-04 17:33 <DIR> d-------- C:\Documents and Settings\Łukasz\Dane aplikacji\Ahead
2007-10-04 16:14 <DIR> d-------- C:\Documents and Settings\Łukasz\Dane aplikacji\Apple Computer
2007-10-04 16:14 <DIR> d-------- C:\Documents and Settings\Łukasz\Dane aplikacji\Apple Computer
2007-10-04 16:14 <DIR> d-------- C:\Documents and Settings\Łukasz\Dane aplikacji\Apple Computer
2007-10-03 09:43 <DIR> d-------- C:\WINDOWS\Sun
2007-10-02 12:28 <DIR> d-------- C:\Documents and Settings\Łukasz\Dane aplikacji\AdobeUM
2007-10-02 12:28 <DIR> d-------- C:\Documents and Settings\Łukasz\Dane aplikacji\AdobeUM
2007-10-02 12:28 <DIR> d-------- C:\Documents and Settings\Łukasz\Dane aplikacji\AdobeUM
2007-09-30 17:17 <DIR> d-------- C:\Program Files\MoorHunt
2007-09-30 17:06 <DIR> d-------- C:\Program Files\Hamachi
2007-09-30 17:06 <DIR> d-------- C:\Documents and Settings\Łukasz\Dane aplikacji\Hamachi
2007-09-30 17:06 <DIR> d-------- C:\Documents and Settings\Łukasz\Dane aplikacji\Hamachi
2007-09-30 17:06 <DIR> d-------- C:\Documents and Settings\Łukasz\Dane aplikacji\Hamachi
2007-09-30 17:06 25,544 --a------ C:\WINDOWS\system32\drivers\hamachi.sys
2007-09-30 13:17 <DIR> d-------- C:\Documents and Settings\Łukasz\Dane aplikacji\Sports Interactive
2007-09-30 13:17 <DIR> d-------- C:\Documents and Settings\Łukasz\Dane aplikacji\Sports Interactive
2007-09-30 13:17 <DIR> d-------- C:\Documents and Settings\Łukasz\Dane aplikacji\Sports Interactive
2007-09-30 13:16 107,888 --a------ C:\WINDOWS\system32\CmdLineExt.dll
2007-09-30 13:15 <DIR> d--h----- C:\Program Files\Zero G Registry
2007-09-30 13:14 <DIR> d--h----- C:\Documents and Settings\Łukasz\InstallAnywhere
2007-09-30 13:14 <DIR> d--h----- C:\Documents and Settings\Łukasz\InstallAnywhere
2007-09-28 00:08 <DIR> d-------- C:\Program Files\eMule
2007-09-27 18:36 <DIR> d-------- C:\Program Files\directx
2007-09-27 18:36 <DIR> d-------- C:\Program Files\CIF USB CAMERA
2007-09-27 18:30 <DIR> d-------- C:\Documents and Settings\ukasz\Ustawienia lokalne
2007-09-27 14:48 <DIR> d-------- C:\Program Files\Alwil Software
2007-09-27 14:48 1,060,864 --a------ C:\WINDOWS\system32\MFC71.dll
2007-09-27 14:48 801,144 --a------ C:\WINDOWS\system32\aswBoot.exe
2007-09-27 14:48 95,608 --a------ C:\WINDOWS\system32\AvastSS.scr
2007-09-27 14:48 94,416 --a------ C:\WINDOWS\system32\drivers\aswmon2.sys
2007-09-27 14:48 92,848 --a------ C:\WINDOWS\system32\drivers\aswmon.sys
2007-09-27 14:48 42,912 --a------ C:\WINDOWS\system32\drivers\aswTdi.sys
2007-09-27 14:48 26,624 --a------ C:\WINDOWS\system32\drivers\aavmker4.sys
2007-09-27 14:48 23,152 --a------ C:\WINDOWS\system32\drivers\aswRdr.sys
2007-09-27 14:45 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Avg7
2007-09-27 14:15 <DIR> d-------- C:\WINDOWS\pss
2007-09-27 14:13 4,000 --a------ C:\ao.dat
2007-09-27 14:11 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Adobe Systems
2007-09-27 14:10 <DIR> d-------- C:\Program Files\Common Files\Adobe Systems Shared
2007-09-27 14:05 58,624 --a------ C:\WINDOWS\system32\drivers\redbook.sys
2007-09-27 14:05 32,592 --a------ C:\WINDOWS\system32\msonpmon.dll
2007-09-27 14:05 25,856 --a------ C:\WINDOWS\system32\drivers\usbprint.sys
2007-09-27 14:05 3,072 --a------ C:\WINDOWS\system32\drivers\audstub.sys
2007-09-27 14:04 <DIR> d-------- C:\Program Files\MSBuild
2007-09-27 14:04 <DIR> d-------- C:\Program Files\Microsoft.NET
2007-09-27 14:04 <DIR> d-------- C:\Program Files\Microsoft Works
2007-09-27 14:04 77,312 --a------ C:\WINDOWS\system32\usbui.dll
2007-09-27 14:04 77,312 --a--c--- C:\WINDOWS\system32\dllcache\usbui.dll
2007-09-27 14:04 42,368 --a------ C:\WINDOWS\system32\drivers\AGP440.SYS
2007-09-27 14:04 42,368 --a--c--- C:\WINDOWS\system32\dllcache\agp440.sys
2007-09-27 14:04 20,992 --a------ C:\WINDOWS\system32\drivers\RTL8139.sys
2007-09-27 14:04 5,504 --a------ C:\WINDOWS\system32\drivers\intelide.sys
2007-09-27 14:03 <DIR> dr------- C:\Program Files
2007-09-27 14:02 <DIR> d-------- C:\WINDOWS\system32\CatRoot2
2007-09-27 14:02 <DIR> d-------- C:\WINDOWS\system32\CatRoot
2007-09-27 14:02 <DIR> d-------- C:\Program Files\Microsoft Visual Studio 8
2007-09-27 14:02 <DIR> dr-h----- C:\Documents and Settings\Default User\Ustawienia lokalne
2007-09-27 14:02 <DIR> d-------- C:\Documents and Settings\Default User\Ulubione
2007-09-27 14:02 <DIR> d--h----- C:\Documents and Settings\Default User\Szablony
2007-09-27 14:02 <DIR> d-------- C:\Documents and Settings\Default User\Pulpit

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-10-26 14:49 3,670,016 ---ha-w C:\Documents and Settings\Łukasz\NTUSER.DAT
2007-10-26 14:49 3,670,016 ---ha-w C:\Documents and Settings\Łukasz\NTUSER.DAT
2007-10-25 19:58 --------- d-----w C:\Program Files\Gadu-Gadu
2007-10-25 19:34 --------- d-----w C:\Program Files\FlashGet
2007-10-25 17:19 --------- d-----w C:\Program Files\Common Files\Adobe
2007-10-25 17:14 --------- d-----w C:\Documents and Settings\Łukasz\Dane aplikacji\Adobe
2007-10-25 17:14 --------- d-----w C:\Documents and Settings\Łukasz\Dane aplikacji\Adobe
2007-10-25 17:14 --------- d-----w C:\Documents and Settings\Łukasz\Dane aplikacji\Adobe
2007-10-25 06:54 --------- d-----w C:\Program Files\Lexmark X1100 Series
2007-10-24 12:37 --------- d--h--w C:\Program Files\InstallShield Installation Information
2007-10-24 05:24 --------- d-----w C:\Documents and Settings\Łukasz\Dane aplikacji\uTorrent
2007-10-24 05:24 --------- d-----w C:\Documents and Settings\Łukasz\Dane aplikacji\uTorrent
2007-10-24 05:24 --------- d-----w C:\Documents and Settings\Łukasz\Dane aplikacji\uTorrent
2007-10-22 17:54 --------- d-----w C:\Documents and Settings\Łukasz\Dane aplikacji\Media Player Classic
2007-10-22 17:54 --------- d-----w C:\Documents and Settings\Łukasz\Dane aplikacji\Media Player Classic
2007-10-22 17:54 --------- d-----w C:\Documents and Settings\Łukasz\Dane aplikacji\Media Player Classic
2007-10-22 17:53 --------- d-----w C:\Documents and Settings\Łukasz\Dane aplikacji\Real
2007-10-22 17:53 --------- d-----w C:\Documents and Settings\Łukasz\Dane aplikacji\Real
2007-10-22 17:53 --------- d-----w C:\Documents and Settings\Łukasz\Dane aplikacji\Real
2007-10-21 17:56 --------- d-----w C:\Documents and Settings\Łukasz\Dane aplikacji\Hamachi
2007-10-21 17:56 --------- d-----w C:\Documents and Settings\Łukasz\Dane aplikacji\Hamachi
2007-10-21 17:56 --------- d-----w C:\Documents and Settings\Łukasz\Dane aplikacji\Hamachi
2007-10-20 19:05 163,644 ----a-w C:\WINDOWS\system32\drivers\secdrv.sys
2007-10-20 19:05 --------- d-----w C:\Documents and Settings\Łukasz\Dane aplikacji\Sports Interactive
2007-10-20 19:05 --------- d-----w C:\Documents and Settings\Łukasz\Dane aplikacji\Sports Interactive
2007-10-20 19:05 --------- d-----w C:\Documents and Settings\Łukasz\Dane aplikacji\Sports Interactive
2007-10-20 11:52 --------- d-----w C:\Program Files\Common Files\InstallShield
2007-10-19 16:11 --------- d-----w C:\Program Files\Winamp
2007-10-17 20:36 --------- d--h--r C:\Documents and Settings\Łukasz\Dane aplikacji\SecuROM
2007-10-17 20:36 --------- d--h--r C:\Documents and Settings\Łukasz\Dane aplikacji\SecuROM
2007-10-17 20:36 --------- d--h--r C:\Documents and Settings\Łukasz\Dane aplikacji\SecuROM
2007-10-17 20:33 --------- d-----w C:\Program Files\DAEMON Tools
2007-10-13 16:43 --------- d-----w C:\Documents and Settings\Łukasz\Dane aplikacji\teamspeak2
2007-10-13 16:43 --------- d-----w C:\Documents and Settings\Łukasz\Dane aplikacji\teamspeak2
2007-10-13 16:43 --------- d-----w C:\Documents and Settings\Łukasz\Dane aplikacji\teamspeak2
2007-10-04 15:38 --------- d-----w C:\Documents and Settings\Łukasz\Dane aplikacji\Ahead
2007-10-04 15:38 --------- d-----w C:\Documents and Settings\Łukasz\Dane aplikacji\Ahead
2007-10-04 15:38 --------- d-----w C:\Documents and Settings\Łukasz\Dane aplikacji\Ahead
2007-10-04 14:14 --------- d-----w C:\Documents and Settings\Łukasz\Dane aplikacji\Apple Computer
2007-10-04 14:14 --------- d-----w C:\Documents and Settings\Łukasz\Dane aplikacji\Apple Computer
2007-10-04 14:14 --------- d-----w C:\Documents and Settings\Łukasz\Dane aplikacji\Apple Computer
2007-10-03 17:18 --------- d-s---w C:\Documents and Settings\Łukasz\Dane aplikacji\Microsoft
2007-10-03 17:18 --------- d-s---w C:\Documents and Settings\Łukasz\Dane aplikacji\Microsoft
2007-10-03 17:18 --------- d-s---w C:\Documents and Settings\Łukasz\Dane aplikacji\Microsoft
2007-10-03 07:43 --------- d-----w C:\Documents and Settings\Łukasz\Dane aplikacji\Sun
2007-10-03 07:43 --------- d-----w C:\Documents and Settings\Łukasz\Dane aplikacji\Sun
2007-10-03 07:43 --------- d-----w C:\Documents and Settings\Łukasz\Dane aplikacji\Sun
2007-10-02 10:28 --------- d-----w C:\Documents and Settings\Łukasz\Dane aplikacji\AdobeUM
2007-10-02 10:28 --------- d-----w C:\Documents and Settings\Łukasz\Dane aplikacji\AdobeUM
2007-10-02 10:28 --------- d-----w C:\Documents and Settings\Łukasz\Dane aplikacji\AdobeUM
2007-09-27 11:50 --------- d-----w C:\Program Files\uTorrent
2007-09-27 11:48 --------- d-----w C:\Program Files\ABBYY FineReader 6.0
2007-09-27 11:48 --------- d-----w C:\Program Files\ABBYY FineReader 5.0 Sprint
2007-09-27 11:38 --------- d-----w C:\Program Files\Intel
2007-09-27 11:29 --------- d-----w C:\Program Files\Common Files\Ahead
2007-09-27 11:28 --------- d-----w C:\Program Files\Nero
2007-09-27 11:28 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Nero
2007-09-27 11:21 --------- d-----w C:\Program Files\Techland
2007-09-27 11:15 --------- d-----w C:\Documents and Settings\Łukasz\Dane aplikacji\Mozilla
2007-09-27 11:15 --------- d-----w C:\Documents and Settings\Łukasz\Dane aplikacji\Mozilla
2007-09-27 11:15 --------- d-----w C:\Documents and Settings\Łukasz\Dane aplikacji\Mozilla
2007-09-27 11:15 --------- d-----w C:\Documents and Settings\Łukasz\Dane aplikacji\Macromedia
2007-09-27 11:15 --------- d-----w C:\Documents and Settings\Łukasz\Dane aplikacji\Macromedia
2007-09-27 11:15 --------- d-----w C:\Documents and Settings\Łukasz\Dane aplikacji\Macromedia
2007-09-27 11:05 --------- d-----w C:\Program Files\Windows Media Connect 2
2007-09-27 11:02 --------- d-----w C:\Program Files\Java
2007-09-27 10:51 685,816 ----a-w C:\WINDOWS\system32\drivers\sptd.sys
2007-09-27 10:49 --------- d-----w C:\Program Files\MarBit
2007-09-27 10:48 684,549 ----a-w C:\WINDOWS\system32\unins000.exe
2007-09-27 10:47 --------- d-----w C:\Program Files\Common Files\Java
2007-09-27 10:32 --------- d-----w C:\Program Files\XP Codec Pack
2007-09-27 10:29 --------- d-----w C:\Program Files\QuickTime
2007-09-27 10:29 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Apple Computer
2007-09-27 10:27 --------- d-----w C:\Documents and Settings\Łukasz\Dane aplikacji\Gadu-Gadu
2007-09-27 10:27 --------- d-----w C:\Documents and Settings\Łukasz\Dane aplikacji\Gadu-Gadu
2007-09-27 10:27 --------- d-----w C:\Documents and Settings\Łukasz\Dane aplikacji\Gadu-Gadu
2007-09-27 10:21 --------- d-----w C:\Program Files\Deutsch Translator 2
2007-09-27 10:20 --------- d-----w C:\Documents and Settings\Łukasz\Dane aplikacji\Identities
2007-09-27 10:20 --------- d-----w C:\Documents and Settings\Łukasz\Dane aplikacji\Identities
2007-09-27 10:20 --------- d-----w C:\Documents and Settings\Łukasz\Dane aplikacji\Identities
2007-09-27 10:15 --------- d-----w C:\Program Files\microsoft frontpage
2007-09-27 10:13 --------- d-----w C:\Program Files\Usługi online
2007-08-17 21:36 97,280 ----a-w C:\WINDOWS\system32\ff_realaac.dll
2007-08-17 21:36 79,872 ----a-w C:\WINDOWS\system32\ff_tremor.dll
2007-08-17 21:36 741,376 ----a-w C:\WINDOWS\system32\audxlib.dll
2007-08-17 21:36 7,680 ----a-w C:\WINDOWS\system32\ff_vfw.dll
2007-08-17 21:36 662,016 ----a-w C:\WINDOWS\system32\xvidcore.dll
2007-08-17 21:36 60,273 ----a-w C:\WINDOWS\system32\pthreadGC2.dll
2007-08-17 21:36 511,488 ----a-w C:\WINDOWS\system32\ff_x264.dll
2007-08-17 21:36 499,712 ----a-w C:\WINDOWS\system32\msvcp71.dll
2007-08-17 21:36 404,480 ----a-w C:\WINDOWS\system32\libmplayer.dll
2007-08-17 21:36 40,960 ----a-w C:\WINDOWS\system32\ff_liba52.dll
2007-08-17 21:36 38,400 ----a-w C:\WINDOWS\system32\ff_unrar.dll
2007-08-17 21:36 3,208,192 ----a-w C:\WINDOWS\system32\libavcodec.dll
2007-08-17 21:36 26,624 ----a-w C:\WINDOWS\system32\ff_wmv9.dll
2007-08-17 21:36 245,760 ----a-w C:\WINDOWS\system32\ff_libfaad2.dll
2007-08-17 21:36 221,184 ----a-w C:\WINDOWS\system32\ff_kernelDeint.dll
2007-08-17 21:36 200,704 ----a-w C:\WINDOWS\system32\TomsMoComp_ff.dll
2007-08-17 21:36 155,648 ----a-w C:\WINDOWS\system32\ff_libdts.dll
2007-08-17 21:36 143,360 ----a-w C:\WINDOWS\system32\ff_theora.dll
2005-07-14 19:31:20 27,648 --sha-w C:\WINDOWS\system32\AVSredirect.dll
2005-06-26 22:32:28 616,448 --sha-r C:\WINDOWS\system32\cygwin1.dll
2005-06-22 05:37:42 45,568 --sha-r C:\WINDOWS\system32\cygz.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-06-29 00:43]
"nwiz"="nwiz.exe" [2007-06-29 00:43 C:\WINDOWS\system32\nwiz.exe]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-06-29 00:43]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-09-06 12:06]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Adobe Reader Speed Launch.lnk]
backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Łukasz^Menu Start^Programy^Autostart^Adobe Gamma.lnk]
backup=C:\WINDOWS\pss\Adobe Gamma.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
"C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Lexmark X1100 Series]
"C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Orb]
"C:\Program Files\Winamp Remote\bin\OrbTray.exe" /background

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
"C:\Program Files\QuickTime\qttask.exe" -atboottime

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan]
SOUNDMAN.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
"C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"

R3 usbscan;Sterownik skanera USB;C:\WINDOWS\system32\DRIVERS\usbscan.sys
S3 SetupNTGLM7X;SetupNTGLM7X;\??\E:\NTGLM7X.sys
S3 USBSTOR;Sterownik magazynu masowego USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS

.
**************************************************************************

catchme 0.3.1232 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-10-26 16:51:05
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-10-26 16:51:24 - machine was rebooted
.
--- E O F ---

PS. Jak widać mam avasta , którego zamierzam wywalić, czy firewall wystarczy zamiast antyvirusa ?

**Posty:** 18165 · przez **wojtas** 26 Paź 2007, 17:12

LUBER napisał(a):PS. Jak widać mam avasta , którego zamierzam wywalić, czy firewall wystarczy zamiast antyvirusa ?

jak dobrze i rozsadnie bedziesz korzystal z internetu to spokojnie Ci wystarczy.ale jednak polecam miec jakiegos antywirusa

**Posty:** 3854 · przez **Dzi@dek** 27 Paź 2007, 18:17

LUBER napisał(a):czy firewall wystarczy zamiast antyvirusa ?

Nie wystarczy.
Masz do wyboru kilka darmowych antywirusów.
Reszta w google.pl

**Posty:** 644 · przez **LUBER** 28 Paź 2007, 14:10

Sorki że jeszcze raz ja ale ten plik po usunięciu po chwili powraca i tak w nieskończoność

Jak sobie z nim poradzić -> chodzi o svehost.exe

Combofix usuwa znowu te same pliki...

ComboFix 07-10-26.4 - Łukasz 2007-10-28 14:31:25.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.808 [GMT 1:00]Running from: D:\PrOgRaMy\Instalki\Internet\ComboFix.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\system32\drivers\npf.sys
C:\WINDOWS\system32\packet.dll
C:\WINDOWS\system32\wpcap.dll

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.
-------\NPF

((((((((((((((((((((((((( Files Created from 2007-09-28 to 2007-10-28 )))))))))))))))))))))))))))))))
.

2007-10-28 13:47 <DIR> d-------- C:\Program Files\Media Player Classic
2007-10-28 13:08 3,727,720 --a------ C:\WINDOWS\system32\d3dx9_35.dll
2007-10-28 13:08 3,497,832 --a------ C:\WINDOWS\system32\d3dx9_34.dll
2007-10-28 13:08 1,358,192 --a------ C:\WINDOWS\system32\D3DCompiler_35.dll
2007-10-28 13:08 1,124,720 --a------ C:\WINDOWS\system32\D3DCompiler_34.dll
2007-10-28 13:08 444,776 --a------ C:\WINDOWS\system32\d3dx10_35.dll
2007-10-28 13:08 443,752 --a------ C:\WINDOWS\system32\d3dx10_34.dll
2007-10-28 13:08 81,768 --a------ C:\WINDOWS\system32\xinput1_3.dll
2007-10-26 15:46 51,200 --a------ C:\WINDOWS\NirCmd.exe
2007-10-25 20:16 <DIR> d-------- C:\Program Files\SkanerOnline
2007-10-25 18:20 2,463,976 --a------ C:\WINDOWS\system32\NPSWF32.dll
2007-10-25 18:20 190,696 --a------ C:\WINDOWS\system32\NPSWF32_FlashUtil.exe
2007-10-25 18:14 <DIR> d-------- C:\Program Files\Common Files\Macrovision Shared
2007-10-25 17:29 <DIR> d-------- C:\totalcmd
2007-10-25 17:29 545 --a------ C:\WINDOWS\UC.PIF
2007-10-25 17:29 545 --a------ C:\WINDOWS\RAR.PIF
2007-10-25 17:29 545 --a------ C:\WINDOWS\PKZIP.PIF
2007-10-25 17:29 545 --a------ C:\WINDOWS\PKUNZIP.PIF
2007-10-25 17:29 545 --a------ C:\WINDOWS\NOCLOSE.PIF
2007-10-25 17:29 545 --a------ C:\WINDOWS\LHA.PIF
2007-10-25 17:29 545 --a------ C:\WINDOWS\ARJ.PIF
2007-10-24 15:00 <DIR> d-------- C:\Program Files\Registry Shower 2007
2007-10-24 13:39 <DIR> d-a------ C:\Documents and Settings\All Users\Dane aplikacji\TEMP
2007-10-22 18:54 <DIR> d-------- C:\Documents and Settings\Łukasz\Dane aplikacji\Media Player Classic
2007-10-22 18:53 <DIR> d-------- C:\Program Files\Real Alternative
2007-10-17 21:36 <DIR> dr-h----- C:\Documents and Settings\Łukasz\Dane aplikacji\SecuROM
2007-10-16 22:48 <DIR> d-------- C:\Documents and Settings\LocalService\Moje dokumenty
2007-10-15 14:33 <DIR> d-------- C:\Program Files\Half Life 2 EP2
2007-10-07 13:53 <DIR> d-------- C:\Program Files\Native Instruments
2007-10-06 17:44 <DIR> d-------- C:\Program Files\Teamspeak2_RC2
2007-10-06 17:44 <DIR> d-------- C:\Documents and Settings\Łukasz\Dane aplikacji\teamspeak2
2007-10-06 00:36 <DIR> d-------- C:\Fraps
2007-10-05 18:58 <DIR> d-------- C:\Program Files\Replay Converter
2007-10-05 18:58 737,280 --a------ C:\WINDOWS\iun6002.exe
2007-10-04 20:31 <DIR> d-------- C:\Program Files\DivX
2007-10-04 20:31 684 --a------ C:\WINDOWS\mozver.dat
2007-10-04 18:54 <DIR> d-------- C:\Program Files\ToniArts
2007-10-04 18:44 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Spybot - Search & Destroy
2007-10-04 16:33 <DIR> d-------- C:\Documents and Settings\Łukasz\Dane aplikacji\Ahead
2007-10-04 15:14 <DIR> d-------- C:\Documents and Settings\Łukasz\Dane aplikacji\Apple Computer
2007-10-03 08:43 <DIR> d-------- C:\WINDOWS\Sun
2007-10-02 11:28 <DIR> d-------- C:\Documents and Settings\Łukasz\Dane aplikacji\AdobeUM
2007-09-30 16:17 <DIR> d-------- C:\Program Files\MoorHunt
2007-09-30 16:06 <DIR> d-------- C:\Program Files\Hamachi
2007-09-30 16:06 <DIR> d-------- C:\Documents and Settings\Łukasz\Dane aplikacji\Hamachi
2007-09-30 16:06 25,544 --a------ C:\WINDOWS\system32\drivers\hamachi.sys
2007-09-30 12:17 <DIR> d-------- C:\Documents and Settings\Łukasz\Dane aplikacji\Sports Interactive
2007-09-30 12:16 107,888 --a------ C:\WINDOWS\system32\CmdLineExt.dll
2007-09-30 12:15 <DIR> d--h----- C:\Program Files\Zero G Registry
2007-09-30 12:14 <DIR> d--h----- C:\Documents and Settings\Łukasz\InstallAnywhere
2007-09-30 12:14 <DIR> d--h----- C:\Documents and Settings\Łukasz\InstallAnywhere

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-10-28 13:34 3,932,160 ---ha-w C:\Documents and Settings\Łukasz\NTUSER.DAT
2007-10-28 13:34 3,932,160 ---ha-w C:\Documents and Settings\Łukasz\NTUSER.DAT
2007-10-28 13:32 4,000 ----a-w C:\ao.dat
2007-10-28 11:50 --------- d-----w C:\Program Files\FlashGet
2007-10-27 12:45 --------- d-----w C:\Documents and Settings\Łukasz\Dane aplikacji\teamspeak2
2007-10-27 10:35 --------- d-----w C:\Documents and Settings\Łukasz\Dane aplikacji\uTorrent
2007-10-26 20:23 --------- d-----w C:\Program Files\Lexmark X1100 Series
2007-10-26 15:56 --------- d-----w C:\Documents and Settings\Łukasz\Dane aplikacji\Hamachi
2007-10-25 19:58 --------- d-----w C:\Program Files\Gadu-Gadu
2007-10-25 17:19 --------- d-----w C:\Program Files\Common Files\Adobe
2007-10-25 17:14 --------- d-----w C:\Documents and Settings\Łukasz\Dane aplikacji\Adobe
2007-10-24 12:37 --------- d--h--w C:\Program Files\InstallShield Installation Information
2007-10-22 17:54 --------- d-----w C:\Documents and Settings\Łukasz\Dane aplikacji\Media Player Classic
2007-10-22 17:53 --------- d-----w C:\Documents and Settings\Łukasz\Dane aplikacji\Real
2007-10-20 19:05 163,644 ----a-w C:\WINDOWS\system32\drivers\secdrv.sys
2007-10-20 19:05 --------- d-----w C:\Documents and Settings\Łukasz\Dane aplikacji\Sports Interactive
2007-10-20 11:52 --------- d-----w C:\Program Files\Common Files\InstallShield
2007-10-19 16:11 --------- d-----w C:\Program Files\Winamp
2007-10-17 20:36 --------- d--h--r C:\Documents and Settings\Łukasz\Dane aplikacji\SecuROM
2007-10-17 20:33 --------- d-----w C:\Program Files\DAEMON Tools
2007-10-09 11:57 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Microsoft Help
2007-10-04 15:38 --------- d-----w C:\Documents and Settings\Łukasz\Dane aplikacji\Ahead
2007-10-04 14:14 --------- d-----w C:\Documents and Settings\Łukasz\Dane aplikacji\Apple Computer
2007-10-03 17:18 --------- d-s---w C:\Documents and Settings\Łukasz\Dane aplikacji\Microsoft
2007-10-03 07:43 --------- d-----w C:\Documents and Settings\Łukasz\Dane aplikacji\Sun
2007-10-02 10:28 --------- d-----w C:\Documents and Settings\Łukasz\Dane aplikacji\AdobeUM
2007-09-27 22:08 --------- d-----w C:\Program Files\eMule
2007-09-27 16:36 --------- d-----w C:\Program Files\directx
2007-09-27 16:36 --------- d-----w C:\Program Files\CIF USB CAMERA
2007-09-27 12:45 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Avg7
2007-09-27 12:11 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Adobe Systems
2007-09-27 12:10 --------- d-----w C:\Program Files\Common Files\Adobe Systems Shared
2007-09-27 12:04 --------- d-----w C:\Program Files\MSBuild
2007-09-27 12:04 --------- d-----w C:\Program Files\Microsoft.NET
2007-09-27 12:04 --------- d-----w C:\Program Files\Microsoft Works
2007-09-27 12:02 --------- d-----w C:\Program Files\Microsoft Visual Studio 8
2007-09-27 11:50 --------- d-----w C:\Program Files\uTorrent
2007-09-27 11:48 --------- d-----w C:\Program Files\ABBYY FineReader 6.0
2007-09-27 11:48 --------- d-----w C:\Program Files\ABBYY FineReader 5.0 Sprint
2007-09-27 11:38 --------- d-----w C:\Program Files\Intel
2007-09-27 11:29 --------- d-----w C:\Program Files\Common Files\Ahead
2007-09-27 11:28 --------- d-----w C:\Program Files\Nero
2007-09-27 11:28 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Nero
2007-09-27 11:21 --------- d-----w C:\Program Files\Techland
2007-09-27 11:15 --------- d-----w C:\Documents and Settings\Łukasz\Dane aplikacji\Mozilla
2007-09-27 11:15 --------- d-----w C:\Documents and Settings\Łukasz\Dane aplikacji\Macromedia
2007-09-27 11:05 --------- d-----w C:\Program Files\Windows Media Connect 2
2007-09-27 11:02 --------- d-----w C:\Program Files\Java
2007-09-27 10:51 685,816 ----a-w C:\WINDOWS\system32\drivers\sptd.sys
2007-09-27 10:49 --------- d-----w C:\Program Files\MarBit
2007-09-27 10:47 --------- d-----w C:\Program Files\Common Files\Java
2007-09-27 10:32 --------- d-----w C:\Program Files\XP Codec Pack
2007-09-27 10:29 --------- d-----w C:\Program Files\QuickTime
2007-09-27 10:29 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Apple Computer
2007-09-27 10:27 --------- d-----w C:\Documents and Settings\Łukasz\Dane aplikacji\Gadu-Gadu
2007-09-27 10:21 --------- d-----w C:\Program Files\Deutsch Translator 2
2007-09-27 10:20 --------- d-----w C:\Documents and Settings\Łukasz\Dane aplikacji\Identities
2007-09-27 10:15 --------- d-----w C:\Program Files\microsoft frontpage
2007-09-27 10:13 --------- d-----w C:\Program Files\Usługi online
2007-08-02 17:15 77,344 ----a-w C:\WINDOWS\symdt32.dll
2005-07-14 19:31:20 27,648 --sha-w C:\WINDOWS\system32\AVSredirect.dll
2005-06-26 22:32:28 616,448 --sha-r C:\WINDOWS\system32\cygwin1.dll
2005-06-22 05:37:42 45,568 --sha-r C:\WINDOWS\system32\cygz.dll
.

((((((((((((((((((((((((((((( snapshot@2007-10-26_16.51.09.57 )))))))))))))))))))))))))))))))))))))))))
.
- 2007-10-20 04:03:30 136,192 ----a-w C:\WINDOWS\catchme.exe
+ 2007-10-20 05:03:30 136,192 ----a-w C:\WINDOWS\catchme.exe
- 2007-03-13 08:57:10 163,328 ----a-w C:\WINDOWS\erdnt\subs\ERDNT.EXE
+ 2007-03-13 09:57:10 163,328 ----a-w C:\WINDOWS\erdnt\subs\ERDNT.EXE
+ 2000-09-18 16:37:00 270,336 ----a-w C:\WINDOWS\imglib.dll
+ 1998-05-11 13:01:00 32,768 ----a-w C:\WINDOWS\SNMPAPI.DLL
+ 2007-10-26 15:08:39 262,144 ----a-w C:\WINDOWS\system32\config\systemprofile\NtUser.dat
+ 2002-12-18 14:46:26 344,064 ------w C:\WINDOWS\system32\msvcr70.dll
- 2001-06-22 23:31:20 278,528 ----a-w C:\WINDOWS\system32\pncrt.dll
+ 2001-06-23 00:31:20 278,528 ----a-w C:\WINDOWS\system32\pncrt.dll
- 1998-03-26 02:57:34 6,656 ----a-w C:\WINDOWS\system32\pndx5016.dll
+ 1998-03-26 03:57:34 6,656 ----a-w C:\WINDOWS\system32\pndx5016.dll
- 1998-05-12 18:36:44 5,632 ----a-w C:\WINDOWS\system32\pndx5032.dll
+ 1998-05-12 19:36:44 5,632 ----a-w C:\WINDOWS\system32\pndx5032.dll
- 2006-10-07 03:18:32 185,952 ----a-w C:\WINDOWS\system32\rmoc3260.dll
+ 2006-10-07 04:18:32 185,952 ----a-w C:\WINDOWS\system32\rmoc3260.dll
- 2007-07-22 16:39:27 279,552 ----a-w C:\WINDOWS\system32\swreg.exe
+ 2007-07-22 17:39:27 279,552 ----a-w C:\WINDOWS\system32\swreg.exe
+ 2006-12-01 21:56:00 96,256 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.ATL_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_cbb27474\ATL80.dll
+ 2006-12-01 21:54:32 479,232 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6b128700\msvcm80.dll
+ 2006-12-01 21:54:34 548,864 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6b128700\msvcp80.dll
+ 2006-12-01 21:54:32 626,688 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6b128700\msvcr80.dll
+ 2006-12-01 23:25:52 1,101,824 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_3bf8fa05\mfc80.dll
+ 2006-12-01 23:25:56 1,093,120 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_3bf8fa05\mfc80u.dll
+ 2006-12-01 23:25:58 69,632 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_3bf8fa05\mfcm80.dll
+ 2006-12-01 23:26:00 57,856 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_3bf8fa05\mfcm80u.dll
+ 2006-12-01 23:08:00 40,960 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80CHS.dll
+ 2006-12-01 23:08:00 45,056 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80CHT.dll
+ 2006-12-01 23:08:00 65,536 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80DEU.dll
+ 2006-12-01 23:08:00 57,344 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80ENU.dll
+ 2006-12-01 23:08:00 61,440 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80ESP.dll
+ 2006-12-01 23:08:00 61,440 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80FRA.dll
+ 2006-12-01 23:08:00 61,440 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80ITA.dll
+ 2006-12-01 23:08:00 49,152 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80JPN.dll
+ 2006-12-01 23:08:00 49,152 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80KOR.dll
+ 2006-12-01 23:46:44 65,536 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.OpenMP_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6c18549a\vcomp.dll
.
-- Snapshot reset to current date --
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-06-28 23:43]
"nwiz"="nwiz.exe" [2007-06-28 23:43 C:\WINDOWS\system32\nwiz.exe]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-06-28 23:43]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Adobe Reader Speed Launch.lnk]
backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Łukasz^Menu Start^Programy^Autostart^Adobe Gamma.lnk]
backup=C:\WINDOWS\pss\Adobe Gamma.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
"C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Lexmark X1100 Series]
"C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Orb]
"C:\Program Files\Winamp Remote\bin\OrbTray.exe" /background

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
"C:\Program Files\QuickTime\qttask.exe" -atboottime

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan]
SOUNDMAN.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
"C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"

R3 usbscan;Sterownik skanera USB;C:\WINDOWS\system32\DRIVERS\usbscan.sys
S3 Bcfilter;Jetico Personal Firewall Network Monitor;C:\WINDOWS\system32\DRIVERS\bcfilter.sys
S3 BcfilterMP;BcfilterMP;C:\WINDOWS\system32\DRIVERS\bcfilter.sys
S3 SetupNTGLM7X;SetupNTGLM7X;\??\E:\NTGLM7X.sys
S3 USBSTOR;Sterownik magazynu masowego USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS

.
**************************************************************************

catchme 0.3.1232 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-10-28 14:35:44
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-10-28 14:36:15 - machine was rebooted
.
--- E O F ---

**Posty:** 237 · przez **Kuba1** 28 Paź 2007, 15:38

Luber sprawa jest prosta, to jest robak i pewnie będzie zawsze powracał, jeśli nie wykonujesz następujących czynności.

Zastosuj się do tych Instrukcji.

Dopiero jak to wykonasz to możesz robić poniższe.

Pobierz narzędzie SDFix

*Klikamy 2 krotknie na ikonę SDFix.exe,program wypakuje się domyślnie do lokalizacji C:\SDFix

*Wchodzimy do trybu awaryjnego z obsługą sieci:
>>>>>>Jak wejść do trybu awaryjnego z obsługą sieci?

*F8 podczas bootowania systemu.
*Używamy narzędzia BootSafe.exe zaznaczamy opcje Safe Mode- Networking i klikamy reboot

*Gdy już jesteśmy w trybie awaryjnym,wchodzimy do folderu SDFix i uruchamiamy narzędzie klikająć
2-krotnie na plik RunThis.bat lewym przyciskiem myszy.

*Wciskamy Y co uruchomi proces usuwania

*Kiedy proces usuwania się zakończy wciskamy dowolny klawisz>>nastąpi restart.

*Po restarcie SDFix dokończy proces usuwania,kiedy w oknie narzędzia SDFix pojawi się napis Finished
klikamy dowolny klawisz,narzędzie zakończy swoją pracę,na pulpicie załadują się ikony.

*Wchodzimy do folderu SDFix i kopiujemy zawartość pliku tekstowego Report.txt i wklejamy go na forum

Wróć z raportem z SDFix,Hijackthis, Silentrunners oraz ComboFix

**Posty:** 644 · przez **LUBER** 28 Paź 2007, 20:20

Oto log:

SDFix: Version 1.112

Run by Łukasz on 2007-10-28 at 19:10

Microsoft Windows XP [Wersja 5.1.2600]

Running From: C:\SDFix

Safe Mode:
Checking Services:

Restoring Windows Registry Values
Restoring Windows Default Hosts File

Rebooting...

Normal Mode:
Checking Files:

No Trojan Files Found

Removing Temp Files...

ADS Check:

C:\WINDOWS
No streams found.

C:\WINDOWS\system32
No streams found.

C:\WINDOWS\system32\svchost.exe
No streams found.

C:\WINDOWS\system32\ntoskrnl.exe
No streams found.

Final Check:

Remaining Services:
------------------

Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

Remaining Files:
---------------

Files with Hidden Attributes:

Thu 14 Jul 2005 27,648 A.SH. --- "C:\WINDOWS\system32\AVSredirect.dll"
Sun 26 Jun 2005 616,448 A.SHR --- "C:\WINDOWS\system32\cygwin1.dll"
Wed 22 Jun 2005 45,568 A.SHR --- "C:\WINDOWS\system32\cygz.dll"
Tue 9 Oct 2007 4,348 A.SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak"
Thu 27 Sep 2007 0 A.SH. --- "C:\Documents and Settings\All Users\DRM\Cache\Indiv01.tmp"

Finished!

**Posty:** 18165 · przez **wojtas** 28 Paź 2007, 23:11

Kuba1 napisał(a):Wróć z raportem z SDFix,Hijackthis, Silentrunners oraz ComboFix

daj te logi

**Posty:** 644 · przez **LUBER** 29 Paź 2007, 00:19

Combofix

ComboFix 07-10-26.4 - Łukasz 2007-10-28 14:31:25.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.808 [GMT 1:00]Running from: D:\PrOgRaMy\Instalki\Internet\ComboFix.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\system32\drivers\npf.sys
C:\WINDOWS\system32\packet.dll
C:\WINDOWS\system32\wpcap.dll

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.
-------\NPF

((((((((((((((((((((((((( Files Created from 2007-09-28 to 2007-10-28 )))))))))))))))))))))))))))))))
.

2007-10-28 13:47 <DIR> d-------- C:\Program Files\Media Player Classic
2007-10-28 13:08 3,727,720 --a------ C:\WINDOWS\system32\d3dx9_35.dll
2007-10-28 13:08 3,497,832 --a------ C:\WINDOWS\system32\d3dx9_34.dll
2007-10-28 13:08 1,358,192 --a------ C:\WINDOWS\system32\D3DCompiler_35.dll
2007-10-28 13:08 1,124,720 --a------ C:\WINDOWS\system32\D3DCompiler_34.dll
2007-10-28 13:08 444,776 --a------ C:\WINDOWS\system32\d3dx10_35.dll
2007-10-28 13:08 443,752 --a------ C:\WINDOWS\system32\d3dx10_34.dll
2007-10-28 13:08 81,768 --a------ C:\WINDOWS\system32\xinput1_3.dll
2007-10-26 15:46 51,200 --a------ C:\WINDOWS\NirCmd.exe
2007-10-25 20:16 <DIR> d-------- C:\Program Files\SkanerOnline
2007-10-25 18:20 2,463,976 --a------ C:\WINDOWS\system32\NPSWF32.dll
2007-10-25 18:20 190,696 --a------ C:\WINDOWS\system32\NPSWF32_FlashUtil.exe
2007-10-25 18:14 <DIR> d-------- C:\Program Files\Common Files\Macrovision Shared
2007-10-25 17:29 <DIR> d-------- C:\totalcmd
2007-10-25 17:29 545 --a------ C:\WINDOWS\UC.PIF
2007-10-25 17:29 545 --a------ C:\WINDOWS\RAR.PIF
2007-10-25 17:29 545 --a------ C:\WINDOWS\PKZIP.PIF
2007-10-25 17:29 545 --a------ C:\WINDOWS\PKUNZIP.PIF
2007-10-25 17:29 545 --a------ C:\WINDOWS\NOCLOSE.PIF
2007-10-25 17:29 545 --a------ C:\WINDOWS\LHA.PIF
2007-10-25 17:29 545 --a------ C:\WINDOWS\ARJ.PIF
2007-10-24 15:00 <DIR> d-------- C:\Program Files\Registry Shower 2007
2007-10-24 13:39 <DIR> d-a------ C:\Documents and Settings\All Users\Dane aplikacji\TEMP
2007-10-22 18:54 <DIR> d-------- C:\Documents and Settings\Łukasz\Dane aplikacji\Media Player Classic
2007-10-22 18:53 <DIR> d-------- C:\Program Files\Real Alternative
2007-10-17 21:36 <DIR> dr-h----- C:\Documents and Settings\Łukasz\Dane aplikacji\SecuROM
2007-10-16 22:48 <DIR> d-------- C:\Documents and Settings\LocalService\Moje dokumenty
2007-10-15 14:33 <DIR> d-------- C:\Program Files\Half Life 2 EP2
2007-10-07 13:53 <DIR> d-------- C:\Program Files\Native Instruments
2007-10-06 17:44 <DIR> d-------- C:\Program Files\Teamspeak2_RC2
2007-10-06 17:44 <DIR> d-------- C:\Documents and Settings\Łukasz\Dane aplikacji\teamspeak2
2007-10-06 00:36 <DIR> d-------- C:\Fraps
2007-10-05 18:58 <DIR> d-------- C:\Program Files\Replay Converter
2007-10-05 18:58 737,280 --a------ C:\WINDOWS\iun6002.exe
2007-10-04 20:31 <DIR> d-------- C:\Program Files\DivX
2007-10-04 20:31 684 --a------ C:\WINDOWS\mozver.dat
2007-10-04 18:54 <DIR> d-------- C:\Program Files\ToniArts
2007-10-04 18:44 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Spybot - Search & Destroy
2007-10-04 16:33 <DIR> d-------- C:\Documents and Settings\Łukasz\Dane aplikacji\Ahead
2007-10-04 15:14 <DIR> d-------- C:\Documents and Settings\Łukasz\Dane aplikacji\Apple Computer
2007-10-03 08:43 <DIR> d-------- C:\WINDOWS\Sun
2007-10-02 11:28 <DIR> d-------- C:\Documents and Settings\Łukasz\Dane aplikacji\AdobeUM
2007-09-30 16:17 <DIR> d-------- C:\Program Files\MoorHunt
2007-09-30 16:06 <DIR> d-------- C:\Program Files\Hamachi
2007-09-30 16:06 <DIR> d-------- C:\Documents and Settings\Łukasz\Dane aplikacji\Hamachi
2007-09-30 16:06 25,544 --a------ C:\WINDOWS\system32\drivers\hamachi.sys
2007-09-30 12:17 <DIR> d-------- C:\Documents and Settings\Łukasz\Dane aplikacji\Sports Interactive
2007-09-30 12:16 107,888 --a------ C:\WINDOWS\system32\CmdLineExt.dll
2007-09-30 12:15 <DIR> d--h----- C:\Program Files\Zero G Registry
2007-09-30 12:14 <DIR> d--h----- C:\Documents and Settings\Łukasz\InstallAnywhere
2007-09-30 12:14 <DIR> d--h----- C:\Documents and Settings\Łukasz\InstallAnywhere

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-10-28 13:34 3,932,160 ---ha-w C:\Documents and Settings\Łukasz\NTUSER.DAT
2007-10-28 13:34 3,932,160 ---ha-w C:\Documents and Settings\Łukasz\NTUSER.DAT
2007-10-28 13:32 4,000 ----a-w C:\ao.dat
2007-10-28 11:50 --------- d-----w C:\Program Files\FlashGet
2007-10-27 12:45 --------- d-----w C:\Documents and Settings\Łukasz\Dane aplikacji\teamspeak2
2007-10-27 10:35 --------- d-----w C:\Documents and Settings\Łukasz\Dane aplikacji\uTorrent
2007-10-26 20:23 --------- d-----w C:\Program Files\Lexmark X1100 Series
2007-10-26 15:56 --------- d-----w C:\Documents and Settings\Łukasz\Dane aplikacji\Hamachi
2007-10-25 19:58 --------- d-----w C:\Program Files\Gadu-Gadu
2007-10-25 17:19 --------- d-----w C:\Program Files\Common Files\Adobe
2007-10-25 17:14 --------- d-----w C:\Documents and Settings\Łukasz\Dane aplikacji\Adobe
2007-10-24 12:37 --------- d--h--w C:\Program Files\InstallShield Installation Information
2007-10-22 17:54 --------- d-----w C:\Documents and Settings\Łukasz\Dane aplikacji\Media Player Classic
2007-10-22 17:53 --------- d-----w C:\Documents and Settings\Łukasz\Dane aplikacji\Real
2007-10-20 19:05 163,644 ----a-w C:\WINDOWS\system32\drivers\secdrv.sys
2007-10-20 19:05 --------- d-----w C:\Documents and Settings\Łukasz\Dane aplikacji\Sports Interactive
2007-10-20 11:52 --------- d-----w C:\Program Files\Common Files\InstallShield
2007-10-19 16:11 --------- d-----w C:\Program Files\Winamp
2007-10-17 20:36 --------- d--h--r C:\Documents and Settings\Łukasz\Dane aplikacji\SecuROM
2007-10-17 20:33 --------- d-----w C:\Program Files\DAEMON Tools
2007-10-09 11:57 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Microsoft Help
2007-10-04 15:38 --------- d-----w C:\Documents and Settings\Łukasz\Dane aplikacji\Ahead
2007-10-04 14:14 --------- d-----w C:\Documents and Settings\Łukasz\Dane aplikacji\Apple Computer
2007-10-03 17:18 --------- d-s---w C:\Documents and Settings\Łukasz\Dane aplikacji\Microsoft
2007-10-03 07:43 --------- d-----w C:\Documents and Settings\Łukasz\Dane aplikacji\Sun
2007-10-02 10:28 --------- d-----w C:\Documents and Settings\Łukasz\Dane aplikacji\AdobeUM
2007-09-27 22:08 --------- d-----w C:\Program Files\eMule
2007-09-27 16:36 --------- d-----w C:\Program Files\directx
2007-09-27 16:36 --------- d-----w C:\Program Files\CIF USB CAMERA
2007-09-27 12:45 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Avg7
2007-09-27 12:11 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Adobe Systems
2007-09-27 12:10 --------- d-----w C:\Program Files\Common Files\Adobe Systems Shared
2007-09-27 12:04 --------- d-----w C:\Program Files\MSBuild
2007-09-27 12:04 --------- d-----w C:\Program Files\Microsoft.NET
2007-09-27 12:04 --------- d-----w C:\Program Files\Microsoft Works
2007-09-27 12:02 --------- d-----w C:\Program Files\Microsoft Visual Studio 8
2007-09-27 11:50 --------- d-----w C:\Program Files\uTorrent
2007-09-27 11:48 --------- d-----w C:\Program Files\ABBYY FineReader 6.0
2007-09-27 11:48 --------- d-----w C:\Program Files\ABBYY FineReader 5.0 Sprint
2007-09-27 11:38 --------- d-----w C:\Program Files\Intel
2007-09-27 11:29 --------- d-----w C:\Program Files\Common Files\Ahead
2007-09-27 11:28 --------- d-----w C:\Program Files\Nero
2007-09-27 11:28 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Nero
2007-09-27 11:21 --------- d-----w C:\Program Files\Techland
2007-09-27 11:15 --------- d-----w C:\Documents and Settings\Łukasz\Dane aplikacji\Mozilla
2007-09-27 11:15 --------- d-----w C:\Documents and Settings\Łukasz\Dane aplikacji\Macromedia
2007-09-27 11:05 --------- d-----w C:\Program Files\Windows Media Connect 2
2007-09-27 11:02 --------- d-----w C:\Program Files\Java
2007-09-27 10:51 685,816 ----a-w C:\WINDOWS\system32\drivers\sptd.sys
2007-09-27 10:49 --------- d-----w C:\Program Files\MarBit
2007-09-27 10:47 --------- d-----w C:\Program Files\Common Files\Java
2007-09-27 10:32 --------- d-----w C:\Program Files\XP Codec Pack
2007-09-27 10:29 --------- d-----w C:\Program Files\QuickTime
2007-09-27 10:29 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Apple Computer
2007-09-27 10:27 --------- d-----w C:\Documents and Settings\Łukasz\Dane aplikacji\Gadu-Gadu
2007-09-27 10:21 --------- d-----w C:\Program Files\Deutsch Translator 2
2007-09-27 10:20 --------- d-----w C:\Documents and Settings\Łukasz\Dane aplikacji\Identities
2007-09-27 10:15 --------- d-----w C:\Program Files\microsoft frontpage
2007-09-27 10:13 --------- d-----w C:\Program Files\Usługi online
2007-08-02 17:15 77,344 ----a-w C:\WINDOWS\symdt32.dll
2005-07-14 19:31:20 27,648 --sha-w C:\WINDOWS\system32\AVSredirect.dll
2005-06-26 22:32:28 616,448 --sha-r C:\WINDOWS\system32\cygwin1.dll
2005-06-22 05:37:42 45,568 --sha-r C:\WINDOWS\system32\cygz.dll
.

((((((((((((((((((((((((((((( snapshot@2007-10-26_16.51.09.57 )))))))))))))))))))))))))))))))))))))))))
.
- 2007-10-20 04:03:30 136,192 ----a-w C:\WINDOWS\catchme.exe
+ 2007-10-20 05:03:30 136,192 ----a-w C:\WINDOWS\catchme.exe
- 2007-03-13 08:57:10 163,328 ----a-w C:\WINDOWS\erdnt\subs\ERDNT.EXE
+ 2007-03-13 09:57:10 163,328 ----a-w C:\WINDOWS\erdnt\subs\ERDNT.EXE
+ 2000-09-18 16:37:00 270,336 ----a-w C:\WINDOWS\imglib.dll
+ 1998-05-11 13:01:00 32,768 ----a-w C:\WINDOWS\SNMPAPI.DLL
+ 2007-10-26 15:08:39 262,144 ----a-w C:\WINDOWS\system32\config\systemprofile\NtUser.dat
+ 2002-12-18 14:46:26 344,064 ------w C:\WINDOWS\system32\msvcr70.dll
- 2001-06-22 23:31:20 278,528 ----a-w C:\WINDOWS\system32\pncrt.dll
+ 2001-06-23 00:31:20 278,528 ----a-w C:\WINDOWS\system32\pncrt.dll
- 1998-03-26 02:57:34 6,656 ----a-w C:\WINDOWS\system32\pndx5016.dll
+ 1998-03-26 03:57:34 6,656 ----a-w C:\WINDOWS\system32\pndx5016.dll
- 1998-05-12 18:36:44 5,632 ----a-w C:\WINDOWS\system32\pndx5032.dll
+ 1998-05-12 19:36:44 5,632 ----a-w C:\WINDOWS\system32\pndx5032.dll
- 2006-10-07 03:18:32 185,952 ----a-w C:\WINDOWS\system32\rmoc3260.dll
+ 2006-10-07 04:18:32 185,952 ----a-w C:\WINDOWS\system32\rmoc3260.dll
- 2007-07-22 16:39:27 279,552 ----a-w C:\WINDOWS\system32\swreg.exe
+ 2007-07-22 17:39:27 279,552 ----a-w C:\WINDOWS\system32\swreg.exe
+ 2006-12-01 21:56:00 96,256 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.ATL_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_cbb27474\ATL80.dll
+ 2006-12-01 21:54:32 479,232 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6b128700\msvcm80.dll
+ 2006-12-01 21:54:34 548,864 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6b128700\msvcp80.dll
+ 2006-12-01 21:54:32 626,688 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6b128700\msvcr80.dll
+ 2006-12-01 23:25:52 1,101,824 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_3bf8fa05\mfc80.dll
+ 2006-12-01 23:25:56 1,093,120 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_3bf8fa05\mfc80u.dll
+ 2006-12-01 23:25:58 69,632 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_3bf8fa05\mfcm80.dll
+ 2006-12-01 23:26:00 57,856 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_3bf8fa05\mfcm80u.dll
+ 2006-12-01 23:08:00 40,960 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80CHS.dll
+ 2006-12-01 23:08:00 45,056 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80CHT.dll
+ 2006-12-01 23:08:00 65,536 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80DEU.dll
+ 2006-12-01 23:08:00 57,344 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80ENU.dll
+ 2006-12-01 23:08:00 61,440 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80ESP.dll
+ 2006-12-01 23:08:00 61,440 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80FRA.dll
+ 2006-12-01 23:08:00 61,440 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80ITA.dll
+ 2006-12-01 23:08:00 49,152 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80JPN.dll
+ 2006-12-01 23:08:00 49,152 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80KOR.dll
+ 2006-12-01 23:46:44 65,536 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.OpenMP_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6c18549a\vcomp.dll
.
-- Snapshot reset to current date --
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-06-28 23:43]
"nwiz"="nwiz.exe" [2007-06-28 23:43 C:\WINDOWS\system32\nwiz.exe]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-06-28 23:43]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Adobe Reader Speed Launch.lnk]
backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Łukasz^Menu Start^Programy^Autostart^Adobe Gamma.lnk]
backup=C:\WINDOWS\pss\Adobe Gamma.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
"C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Lexmark X1100 Series]
"C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Orb]
"C:\Program Files\Winamp Remote\bin\OrbTray.exe" /background

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
"C:\Program Files\QuickTime\qttask.exe" -atboottime

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan]
SOUNDMAN.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
"C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"

R3 usbscan;Sterownik skanera USB;C:\WINDOWS\system32\DRIVERS\usbscan.sys
S3 Bcfilter;Jetico Personal Firewall Network Monitor;C:\WINDOWS\system32\DRIVERS\bcfilter.sys
S3 BcfilterMP;BcfilterMP;C:\WINDOWS\system32\DRIVERS\bcfilter.sys
S3 SetupNTGLM7X;SetupNTGLM7X;\??\E:\NTGLM7X.sys
S3 USBSTOR;Sterownik magazynu masowego USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS

.
**************************************************************************

catchme 0.3.1232 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-10-28 14:35:44
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-10-28 14:36:15 - machine was rebooted
.
--- E O F ---

SDFix

SDFix: Version 1.112

Run by Łukasz on 2007-10-28 at 19:10

Microsoft Windows XP [Wersja 5.1.2600]

Running From: C:\SDFix

Safe Mode:
Checking Services:

Restoring Windows Registry Values
Restoring Windows Default Hosts File

Rebooting...

Normal Mode:
Checking Files:

No Trojan Files Found

Removing Temp Files...

ADS Check:

C:\WINDOWS
No streams found.

C:\WINDOWS\system32
No streams found.

C:\WINDOWS\system32\svchost.exe
No streams found.

C:\WINDOWS\system32\ntoskrnl.exe
No streams found.

Final Check:

Remaining Services:
------------------

Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

Remaining Files:
---------------

Files with Hidden Attributes:

Thu 14 Jul 2005 27,648 A.SH. --- "C:\WINDOWS\system32\AVSredirect.dll"
Sun 26 Jun 2005 616,448 A.SHR --- "C:\WINDOWS\system32\cygwin1.dll"
Wed 22 Jun 2005 45,568 A.SHR --- "C:\WINDOWS\system32\cygz.dll"
Tue 9 Oct 2007 4,348 A.SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak"
Thu 27 Sep 2007 0 A.SH. --- "C:\Documents and Settings\All Users\DRM\Cache\Indiv01.tmp"

Finished!

Silentrunners

"Silent Runners.vbs", revision 52, http://www.silentrunners.org/
Operating System: Windows XP SP2
Output limited to non-default values, except where indicated by "{++}"

Startup items buried in registry:
---------------------------------

HKLM\Software\Microsoft\Windows\CurrentVersion\Run\ {++}
"NvCplDaemon" = "RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup" [MS]
"nwiz" = "nwiz.exe /install" ["NVIDIA Corporation"]
"NvMediaCenter" = "RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit" [MS]

HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\(Default) = (no title provided)
-> {HKLM...CLSID} = "AcroIEHlprObj Class"
\InProcServer32\(Default) = "C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll" ["Adobe Systems Incorporated"]
{2F364306-AA45-47B5-9F9D-39A8B94E7EF7}\(Default) = "flashget urlcatch"
-> {HKLM...CLSID} = "FGCatchUrl"
\InProcServer32\(Default) = "C:\Program Files\FlashGet\jccatch.dll" ["www.flashget.com"]
{53707962-6F74-2D53-2644-206D7942484F}\(Default) = (no title provided)
-> {HKLM...CLSID} = (no title provided)
\InProcServer32\(Default) = "C:\PROGRA~1\SPYBOT~1\SDHelper.dll" ["Safer Networking Limited"]
{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\(Default) = (no title provided)
-> {HKLM...CLSID} = "SSVHelper Class"
\InProcServer32\(Default) = "C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll" ["Sun Microsystems, Inc."]
{F156768E-81EF-470C-9057-481BA8380DBA}\(Default) = (no title provided)
-> {HKLM...CLSID} = "FlashGet GetFlash Class"
\InProcServer32\(Default) = "C:\Program Files\FlashGet\getflash.dll" ["www.flashget.com"]

HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\
"{42071714-76d4-11d1-8b24-00a0c9068ff3}" = "Rozszerzenie CPL kadrowania wyświetlania"
-> {HKLM...CLSID} = "Rozszerzenie CPL kadrowania wyświetlania"
\InProcServer32\(Default) = "deskpan.dll" [file not found]
"{88895560-9AA2-1069-930E-00AA0030EBC8}" = "Rozszerzenie ikony HyperTerminalu"
-> {HKLM...CLSID} = "HyperTerminal Icon Ext"
\InProcServer32\(Default) = "C:\WINDOWS\system32\hticons.dll" ["Hilgraeve, Inc."]
"{B41DB860-8EE4-11D2-9906-E49FADC173CA}" = "WinRAR shell extension"
-> {HKLM...CLSID} = "WinRAR"
\InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]
"{A70C977A-BF00-412C-90B7-034C51DA2439}" = "NvCpl DesktopContext Class"
-> {HKLM...CLSID} = "DesktopContext Class"
\InProcServer32\(Default) = "C:\WINDOWS\system32\nvcpl.dll" ["NVIDIA Corporation"]
"{FFB699E0-306A-11d3-8BD1-00104B6F7516}" = "Play on my TV helper"
-> {HKLM...CLSID} = "NVIDIA CPL Extension"
\InProcServer32\(Default) = "C:\WINDOWS\system32\nvcpl.dll" ["NVIDIA Corporation"]
"{1CDB2949-8F65-4355-8456-263E7C208A5D}" = "Desktop Explorer"
-> {HKLM...CLSID} = "Desktop Explorer"
\InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"]
"{1E9B04FB-F9E5-4718-997B-B8DA88302A47}" = "Desktop Explorer Menu"
-> {HKLM...CLSID} = (no title provided)
\InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"]
"{1E9B04FB-F9E5-4718-997B-B8DA88302A48}" = "nView Desktop Context Menu"
-> {HKLM...CLSID} = "nView Desktop Context Menu"
\InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"]
"{97F68CE3-7146-45FF-BE24-D9A7DD7CB8A2}" = "NeroCoverEd Live Icons"
-> {HKLM...CLSID} = "NeroCoverEdLiveIcons Class"
\InProcServer32\(Default) = "C:\Program Files\Nero\Nero 7\Nero CoverDesigner\CoverEdExtension.dll" ["Nero AG"]
"{0006F045-0000-0000-C000-000000000046}" = "Microsoft Office Outlook Custom Icon Handler"
-> {HKLM...CLSID} = "Outlook File Icon Extension"
\InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\Office12\OLKFSTUB.DLL" [MS]
"{00020D75-0000-0000-C000-000000000046}" = "Microsoft Office Outlook Desktop Icon Handler"
-> {HKLM...CLSID} = "Microsoft Office Outlook"
\InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\Office12\MLSHEXT.DLL" [MS]
"{5858A72C-C2B4-4dd7-B2BF-B76DB1BD9F6C}" = "Microsoft Office OneNote Namespace Extension for Windows Desktop Search"
-> {HKLM...CLSID} = "Microsoft Office OneNote Namespace Extension for Windows Desktop Search"
\InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\Office12\ONFILTER.DLL" [MS]
"{42042206-2D85-11D3-8CFF-005004838597}" = "Microsoft Office HTML Icon Handler"
-> {HKLM...CLSID} = (no title provided)
\InProcServer32\(Default) = "C:\Program Files\Microsoft Office\Office12\msohevi.dll" [MS]
"{993BE281-6695-4BA5-8A2A-7AACBFAAB69E}" = "Microsoft Office Metadata Handler"
-> {HKLM...CLSID} = "Microsoft Office Metadata Handler"
\InProcServer32\(Default) = "C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\msoshext.dll" [MS]
"{C41662BB-1FA0-4CE0-8DC5-9B7F8279FF97}" = "Microsoft Office Thumbnail Handler"
-> {HKLM...CLSID} = "Microsoft Office Thumbnail Handler"
\InProcServer32\(Default) = "C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\msoshext.dll" [MS]
"{DDE4BEEB-DDE6-48fd-8EB5-035C09923F83}" = "UnlockerShellExtension"
-> {HKLM...CLSID} = "UnlockerShellExtension"
\InProcServer32\(Default) = "C:\Program Files\Unlocker\UnlockerCOM.dll" [null data]

HKLM\Software\Classes\PROTOCOLS\Filter\
<<!>> text/xml\CLSID = "{807563E5-5146-11D5-A672-00B0D022E945}"
-> {HKLM...CLSID} = "Microsoft Office InfoPath XML Mime Filter"
\InProcServer32\(Default) = "C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL" [MS]

HKLM\Software\Classes\Folder\shellex\ColumnHandlers\
{F9DB5320-233E-11D1-9F84-707F02C10627}\(Default) = "PDF Column Info"
-> {HKLM...CLSID} = "PDF Shell Extension"
\InProcServer32\(Default) = "C:\Program Files\Adobe\Acrobat 7.0\ActiveX\PDFShell.dll" ["Adobe Systems, Inc."]

HKLM\Software\Classes\*\shellex\ContextMenuHandlers\
Cover Designer\(Default) = "{73FCA462-9BD5-4065-A73F-A8E5F6904EF7}"
-> {HKLM...CLSID} = "NeroCoverEdContextMenu Class"
\InProcServer32\(Default) = "C:\Program Files\Nero\Nero 7\Nero CoverDesigner\CoverEdExtension.dll" ["Nero AG"]
WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
-> {HKLM...CLSID} = "WinRAR"
\InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]

HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\
WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
-> {HKLM...CLSID} = "WinRAR"
\InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]

HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\
UnlockerShellExtension\(Default) = "{DDE4BEEB-DDE6-48fd-8EB5-035C09923F83}"
-> {HKLM...CLSID} = "UnlockerShellExtension"
\InProcServer32\(Default) = "C:\Program Files\Unlocker\UnlockerCOM.dll" [null data]
WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
-> {HKLM...CLSID} = "WinRAR"
\InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]

HKLM\Software\Classes\AllFilesystemObjects\shellex\ContextMenuHandlers\
UnlockerShellExtension\(Default) = "{DDE4BEEB-DDE6-48fd-8EB5-035C09923F83}"
-> {HKLM...CLSID} = "UnlockerShellExtension"
\InProcServer32\(Default) = "C:\Program Files\Unlocker\UnlockerCOM.dll" [null data]

Group Policies {GPedit.msc branch and setting}:
-----------------------------------------------

Note: detected settings may not have any effect.

HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\

"shutdownwithoutlogon" = (REG_DWORD) hex:0x00000001
{Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options|
Shutdown: Allow system to be shut down without having to log on}

"undockwithoutlogon" = (REG_DWORD) hex:0x00000001
{Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options|
Devices: Allow undock without having to log on}

Active Desktop and Wallpaper:
-----------------------------

Active Desktop may be disabled at this entry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState

Displayed if Active Desktop enabled and wallpaper not set by Group Policy:
HKCU\Software\Microsoft\Internet Explorer\Desktop\General\
"Wallpaper" = "C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp"

Displayed if Active Desktop disabled and wallpaper not set by Group Policy:
HKCU\Control Panel\Desktop\
"Wallpaper" = "C:\Documents and Settings\Łukasz\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp"

Winsock2 Service Provider DLLs:
-------------------------------

Namespace Service Providers

HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++}
000000000001\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]
000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS]
000000000003\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]

Transport Service Providers

HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++}
0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range:
%SystemRoot%\system32\mswsock.dll [MS], 01 - 03, 06 - 15
%SystemRoot%\system32\rsvpsp.dll [MS], 04 - 05

Toolbars, Explorer Bars, Extensions:
------------------------------------

Toolbars

HKLM\Software\Microsoft\Internet Explorer\Toolbar\
"{0D704FAD-66E9-4F0A-BFED-4F665770DDB3}" = (no title provided)
-> {HKLM...CLSID} = "&Tłumaczenie"
\InProcServer32\(Default) = "C:\Program Files\Techland\Common\InternetTranslator\InternetTranslator.dll" ["Techland"]

Explorer Bars

HKLM\Software\Microsoft\Internet Explorer\Explorer Bars\

HKLM\Software\Classes\CLSID\{175556B1-4D91-4E9A-9C4B-D6888D5DEE6C}\(Default) = "&Ramka Tłumaczenia"
Implemented Categories\{00021494-0000-0000-C000-000000000046}\ [horizontal bar]
InProcServer32\(Default) = "C:\Program Files\Techland\Common\InternetTranslator\InternetTranslator.dll" ["Techland"]

HKLM\Software\Classes\CLSID\{D553F157-2AB0-4B46-98D2-7BA7CA418491}\(Default) = "&Słownik Podręczny"
Implemented Categories\{00021493-0000-0000-C000-000000000046}\ [vertical bar]
InProcServer32\(Default) = "C:\Program Files\Techland\Common\InternetTranslator\InternetTranslator.dll" ["Techland"]

HKLM\Software\Classes\CLSID\{FF059E31-CC5A-4E2E-BF3B-96E929D65503}\(Default) = "&Poszukaj"
Implemented Categories\{00021493-0000-0000-C000-000000000046}\ [vertical bar]
InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL" [MS]

Extensions (Tools menu items, main toolbar menu buttons)

HKLM\Software\Microsoft\Internet Explorer\Extensions\
{08B0E5C0-4FCB-11CF-AAA5-00401C608501}\
"MenuText" = "Sun Java Console"
"CLSIDExtension" = "{CAFEEFAC-0016-0000-0002-ABCDEFFEDCBC}"
-> {HKCU...CLSID} = "Java Plug-in 1.6.0_02"
\InProcServer32\(Default) = "C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll" ["Sun Microsystems, Inc."]
-> {HKLM...CLSID} = "Java Plug-in 1.6.0_02"
\InProcServer32\(Default) = "C:\Program Files\Java\jre1.6.0_02\bin\npjpi160_02.dll" ["Sun Microsystems, Inc."]

{2670000A-7350-4F3C-8081-5663EE0C6C49}\
"ButtonText" = "Wyślij do programu OneNote"
"MenuText" = "Wyślij &do programu OneNote"
"CLSIDExtension" = "{48E73304-E1D6-4330-914C-F5F514E3486C}"
-> {HKLM...CLSID} = "Send to OneNote from Internet Explorer button"
\InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll" [MS]

{92780B25-18CC-41C8-B9BE-3C9C571A8263}\
"ButtonText" = "Research"

{B46B0919-62BA-4D99-A5C4-916B57A6805C}\
"MenuText" = "@C:\Program Files\Techland\Common\InternetTranslator\InternetTranslator.dll,-103"
"CLSIDExtension" = "{B46B0919-62BA-4D99-A5C4-916B57A6805C}"
-> {HKLM...CLSID} = "InternetTranslatorProperties Class"
\InProcServer32\(Default) = "C:\Program Files\Techland\Common\InternetTranslator\InternetTranslator.dll" ["Techland"]

{D6E814A0-E0C5-11D4-8D29-0050BA6940E3}\
"ButtonText" = "FlashGet"
"MenuText" = "FlashGet"
"Exec" = "C:\Program Files\FlashGet\FlashGet.exe" ["FlashGet.com"]

Running Services (Display Name, Service Name, Path {Service DLL}):
------------------------------------------------------------------

LexBce Server, LexBceS, "C:\WINDOWS\system32\LEXBCES.EXE" ["Lexmark International, Inc."]
NVIDIA Display Driver Service, NVSvc, "C:\WINDOWS\system32\nvsvc32.exe" ["NVIDIA Corporation"]

Print Monitors:
---------------

HKLM\System\CurrentControlSet\Control\Print\Monitors\
Lexmark Network Port\Driver = "LEXLMPM.DLL" ["Lexmark International, Inc."]
Send To Microsoft OneNote Monitor\Driver = "msonpmon.dll" [MS]

---------- (launch time: 2007-10-28 23:15:08)
<<!>>: Suspicious data at a malware launch point.

+ This report excludes default entries except where indicated.
+ To see *everywhere* the script checks and *everything* it finds,
launch it from a command prompt or a shortcut with the -all parameter.
+ The search for DESKTOP.INI DLL launch points on all local fixed drives
took 80 seconds.
---------- (total run time: 127 seconds)

Hijackthis

Logfile of HijackThis v1.99.1
Scan saved at 23:18:57, on 2007-10-28
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0011)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Gadu-Gadu\gg.exe
C:\Program Files\DAEMON Tools\YASU.exe
C:\Program Files\Mozilla Firefox\firefox.exe
D:\PrOgRaMy\Instalki\Internet\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: flashget urlcatch - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\Program Files\FlashGet\jccatch.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: FlashGet GetFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\Program Files\FlashGet\getflash.dll
O3 - Toolbar: &Tłumaczenie - {0D704FAD-66E9-4F0A-BFED-4F665770DDB3} - C:\Program Files\Techland\Common\InternetTranslator\InternetTranslator.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O8 - Extra context menu item: &Ściągnij przy pomocy FlashGet'a - C:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: &Ściągnij wszystko przy pomocy FlashGet'a - C:\Program Files\FlashGet\jc_all.htm
O8 - Extra context menu item: E&ksportuj do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: Wyślij do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Wyślij &do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {B46B0919-62BA-4D99-A5C4-916B57A6805C} - C:\Program Files\Techland\Common\InternetTranslator\InternetTranslator.dll
O9 - Extra 'Tools' menuitem: @C:\Program Files\Techland\Common\InternetTranslator\InternetTranslator.dll,-103 - {B46B0919-62BA-4D99-A5C4-916B57A6805C} - C:\Program Files\Techland\Common\InternetTranslator\InternetTranslator.dll
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe
O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe
O16 - DPF: {68282C51-9459-467B-95BF-3C0E89627E55} (MksSkanerOnline Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

**Posty:** 18165 · przez **wojtas** 29 Paź 2007, 17:42

laczysz sie przez proxy?

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local

nie masz antywirusa ani firewalla... dlatego wraca:

zainstaluj noda32 lub avasta oraz
http://www.programosy.pl/program,kerio-personal-firewall.html

**Posty:** 644 · przez **LUBER** 29 Paź 2007, 19:28

wojtas19162 napisał(a):laczysz sie przez proxy?

nie łącze

antyvirusa chce zainstalować na czysty system

**Posty:** 18165 · przez **wojtas** 29 Paź 2007, 19:31

LUBER napisał(a):nie łącze

to skasuj ten wpis

LUBER napisał(a):antyvirusa chce zainstalować na czysty system

a jaki to ma cel? a zainstaluj av i firewalla i zobacz czy syf wraca....

svechost , bonjur , ezula itp

svechost , bonjur , ezula itp

Kto jest na forum