Trojan mnie dopadł

**Posty:** 684 · przez **kalcyt13** 12 Sie 2008, 09:47

Prosze o pomoc. Avast co chwilę wyje o nowym zagrożeniu. Teraz chwilowo go wyłączyłem.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 09:44:06, on 2008-08-12
Platform: Windows XP Dodatek SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal

Running processes:
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Eset\nod32krn.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\oodag.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
C:\Program Files\DialNet\WrOS.EXE
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe
C:\Program Files\DialNet\winpppoverethernet.exe
C:\WINDOWS\system32\lphcnj0j0ecep.exe
C:\Program Files\rhcjj0j0ecep\rhcjj0j0ecep.exe
C:\Program Files\Eset\nod32kui.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\pphcnj0j0ecep.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe
O4 - HKLM\..\Run: [a-winpoet-service] "C:\Program Files\DialNet\winpppoverethernet.exe"
O4 - HKLM\..\Run: [] "C:\PROGRA~1\DialNet\FPLICE~1.EXE zhimakaimen//WINPOET_QUITTING_EVENT"
O4 - HKLM\..\Run: [z-WrDialer] "C:\Program Files\DialNet\wrdialer.exe"
O4 - HKLM\..\Run: [lphcnj0j0ecep] C:\WINDOWS\system32\lphcnj0j0ecep.exe
O4 - HKLM\..\Run: [SMrhcjj0j0ecep] C:\Program Files\rhcjj0j0ecep\rhcjj0j0ecep.exe
O4 - HKLM\..\Run: [C:\WINDOWS\system32\kdxqf.exe] C:\WINDOWS\system32\kdxqf.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: E&ksportuj do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_05\bin\npjpi142_05.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_05\bin\npjpi142_05.dll
O9 - Extra button: Wyślij do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Wyślij &do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{D00ADFD7-4B7A-4A18-9769-C0B84E014826}: NameServer = 217.30.129.149 217.30.137.200
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: O&O Defrag - O&O Software GmbH - C:\WINDOWS\system32\oodag.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
O23 - Service: WinPPPoverEthernet - Fine Point Technologies, Inc. - C:\Program Files\DialNet\WrOS.EXE

--
End of file - 6752 bytes

**Posty:** 8001 · przez **Okocza** 12 Sie 2008, 09:57

kalcyt13, wstaw log w odpoiwednie tagi

przeczytaj-zanim-wstawisz-logi-na-forum-vt93842.html

**Posty:** 684 · przez **kalcyt13** 12 Sie 2008, 10:00

Przepraszam/

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 10:00:13, on 2008-08-12 Platform: Windows XP Dodatek SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512) Boot mode: Normal Running processes: C:\WINDOWS\system32\csrss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Eset\nod32krn.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\oodag.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe C:\Program Files\DialNet\WrOS.EXE C:\WINDOWS\System32\alg.exe C:\WINDOWS\system32\ctfmon.exe C:\WINDOWS\RTHDCPL.EXE C:\WINDOWS\system32\RUNDLL32.EXE C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe C:\Program Files\DialNet\winpppoverethernet.exe C:\WINDOWS\system32\lphcnj0j0ecep.exe C:\Program Files\rhcjj0j0ecep\rhcjj0j0ecep.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\WINDOWS\system32\pphcnj0j0ecep.exe C:\WINDOWS\system32\wuauclt.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe C:\WINDOWS\system32\wbem\wmiprvse.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe O4 - HKLM\..\Run: [a-winpoet-service] "C:\Program Files\DialNet\winpppoverethernet.exe" O4 - HKLM\..\Run: [] "C:\PROGRA~1\DialNet\FPLICE~1.EXE zhimakaimen//WINPOET_QUITTING_EVENT" O4 - HKLM\..\Run: [z-WrDialer] "C:\Program Files\DialNet\wrdialer.exe" O4 - HKLM\..\Run: [lphcnj0j0ecep] C:\WINDOWS\system32\lphcnj0j0ecep.exe O4 - HKLM\..\Run: [SMrhcjj0j0ecep] C:\Program Files\rhcjj0j0ecep\rhcjj0j0ecep.exe O4 - HKLM\..\Run: [C:\WINDOWS\system32\kdxqf.exe] C:\WINDOWS\system32\kdxqf.exe O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O8 - Extra context menu item: E&ksportuj do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_05\bin\npjpi142_05.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_05\bin\npjpi142_05.dll O9 - Extra button: Wyślij do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra 'Tools' menuitem: Wyślij &do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O17 - HKLM\System\CCS\Services\Tcpip\..\{D00ADFD7-4B7A-4A18-9769-C0B84E014826}: NameServer = 217.30.129.149 217.30.137.200 O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: O&O Defrag - O&O Software GmbH - C:\WINDOWS\system32\oodag.exe O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe O23 - Service: WinPPPoverEthernet - Fine Point Technologies, Inc. - C:\Program Files\DialNet\WrOS.EXE -- End of file - 6716 bytes

**Posty:** 8001 · przez **Okocza** 12 Sie 2008, 10:13

Kod: Zaznacz wszystko: C:\WINDOWS\system32\lphcnj0j0ecep.exe C:\Program Files\rhcjj0j0ecep\rhcjj0j0ecep.exe C:\WINDOWS\system32\pphcnj0j0ecep.exe O4 - HKLM\..\Run: [lphcnj0j0ecep] C:\WINDOWS\system32\lphcnj0j0ecep.exe O4 - HKLM\..\Run: [SMrhcjj0j0ecep] C:\Program Files\rhcjj0j0ecep\rhcjj0j0ecep.exe O4 - HKLM\..\Run: [C:\WINDOWS\system32\kdxqf.exe] C:\WINDOWS\system32\kdxqf.exe

to na fix w hj i daj log z cf

**Posty:** 684 · przez **kalcyt13** 12 Sie 2008, 11:41

C:\WINDOWS\system32\lphcnj0j0ecep.exe
C:\Program Files\rhcjj0j0ecep\rhcjj0j0ecep.exe
C:\WINDOWS\system32\pphcnj0j0ecep.exe

Okocza, te pozycje mi się nie wyświetlają. Można je jakoś usunąć inaczej?

**Posty:** 8001 · przez **Okocza** 12 Sie 2008, 11:43

zrób to w normalnym trybie...

log z cf wstaw..

**Posty:** 684 · przez **kalcyt13** 12 Sie 2008, 12:09

Okocza, możemy raz jeszcze zacząć. Coś pokopałem.

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 12:05, on 2008-08-12 Platform: Windows XP Dodatek SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512) Boot mode: Normal Running processes: C:\WINDOWS\system32\csrss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\savedump.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\oodag.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe C:\Program Files\DialNet\WrOS.EXE C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\WINDOWS\System32\alg.exe C:\WINDOWS\system32\ctfmon.exe C:\WINDOWS\RTHDCPL.EXE C:\WINDOWS\system32\RUNDLL32.EXE C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe C:\Program Files\DialNet\winpppoverethernet.exe C:\WINDOWS\system32\wuauclt.exe C:\WINDOWS\system32\wbem\wmiprvse.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe O4 - HKLM\..\Run: [a-winpoet-service] "C:\Program Files\DialNet\winpppoverethernet.exe" O4 - HKLM\..\Run: [] "C:\PROGRA~1\DialNet\FPLICE~1.EXE zhimakaimen//WINPOET_QUITTING_EVENT" O4 - HKLM\..\Run: [z-WrDialer] "C:\Program Files\DialNet\wrdialer.exe" O4 - HKLM\..\Run: [C:\WINDOWS\system32\kdxqf.exe] C:\WINDOWS\system32\kdxqf.exe O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O8 - Extra context menu item: E&ksportuj do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_05\bin\npjpi142_05.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_05\bin\npjpi142_05.dll O9 - Extra button: Wyślij do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra 'Tools' menuitem: Wyślij &do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O17 - HKLM\System\CCS\Services\Tcpip\..\{D00ADFD7-4B7A-4A18-9769-C0B84E014826}: NameServer = 217.30.129.149 217.30.137.200 O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: O&O Defrag - O&O Software GmbH - C:\WINDOWS\system32\oodag.exe O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe O23 - Service: WinPPPoverEthernet - Fine Point Technologies, Inc. - C:\Program Files\DialNet\WrOS.EXE -- End of file - 6621 bytes

**Posty:** 684 · przez **djarta** 12 Sie 2008, 12:11

Pomogę trochę dla okoczy, jeśli pozwoli. :wink:

Okocza cię prosiła żebyś dał log z ComboFixa a nie z HJT. :wink:

**Posty:** 2 · przez **Maggie Fitzgerald** 12 Sie 2008, 12:14

Kod: Zaznacz wszystko: O4 - HKLM\..\Run: []" O4 - HKLM\..\Run: [C:\WINDOWS\system32\kdxqf.exe] C:\WINDOWS\system32\kdxqf.exe

fix w hjt i pokaż loga z combofixa

**Posty:** 684 · przez **djarta** 12 Sie 2008, 12:15

O4 - HKLM\..\Run: [] "C:\PROGRA~1\DialNet\FPLICE~1.EXE zhimakaimen//WINPOET_QUITTING_EVENT"
O4 - HKLM\..\Run: [z-WrDialer] "C:\Program Files\DialNet\wrdialer.exe"

Nie fixuj tych 2 wpisów,oni są od twojego internetu!!

**Posty:** 8001 · przez **Okocza** 12 Sie 2008, 12:24

Maggie Fitzgerald, zanim zajmiesz się sprawdzaniem logów przeczytaj:

http://www.forum.programosy.pl/informacja-dla-wszystkich-userow-sprawdzajacych-logi-vt90172.html

kalcyt13,

fixujesz tylko to

Kod: Zaznacz wszystko: O4 - HKLM\..\Run: [C:\WINDOWS\system32\kdxqf.exe] C:\WINDOWS\system32\kdxqf.exe

Zastosuj SDFix . Po pobraniu uruchom go a rozpakuje się do C:\SDFix. Uruchom komputer w trybie awaryjnym (F8 przy stracie systemu). Będąc w awaryjnym uruchom plik RunThis.bat z folderu SDFixa. Zatwierdź czyszczenie przez Y. Poczekaj aż ukończy i komputer zresetuje

Potem wejdz do folderu C:\SDFix wrzuc zawartość pliku Report.txt + log z combofixa oraz daj loga z hijacka

**Posty:** 684 · przez **kalcyt13** 12 Sie 2008, 12:25

Mam problem z CF. Jak robię skan, to potem mam błękitny ekran. To normalne? Mam to przeczekać?

**Posty:** 8001 · przez **Okocza** 12 Sie 2008, 12:26

kalcyt13 napisał(a):błękitny ekran

'

co jest napisane na tym BSoD :?:

poza tym zastosuj to co było w moim poprzednim poście.

**Posty:** 684 · przez **kalcyt13** 12 Sie 2008, 12:29

Zupełnie czysty ekran. Nic nie jest napisane... Teraz polecę SDFix-em

**Posty:** 8001 · przez **Okocza** 12 Sie 2008, 12:31

kalcyt13 napisał(a):Zupełnie czysty ekran.

czyli w oknie Combofixa się to dzieje :?:

Bo myślałem że masz BSoD

w takim razie skoro nie możesz dać Combofixa daj log z DSS'a

**Posty:** 684 · przez **kalcyt13** 12 Sie 2008, 12:37

Kod: Zaznacz wszystko: Deckard's System Scanner v20071014.68 Run by darek on 2008-08-12 12:34:51 Computer is in Normal Mode. -------------------------------------------------------------------------------- -- System Restore -------------------------------------------------------------- Successfully created a Deckard's System Scanner Restore Point. -- Last 5 Restore Point(s) -- 5: 2008-08-12 10:34:55 UTC - RP5 - Deckard's System Scanner Restore Point 4: 2008-08-12 10:18:18 UTC - RP4 - Operacja przywracania 3: 2008-08-12 10:00:23 UTC - RP3 - Operacja przywracania 2: 2008-08-12 09:47:58 UTC - RP2 - ComboFix created restore point 1: 2008-08-12 09:47:38 UTC - RP1 - Punkt kontrolny systemu Backed up registry hives. Performed disk cleanup. -- HijackThis (run as darek.exe) ----------------------------------------------- Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 12:35, on 2008-08-12 Platform: Windows XP Dodatek SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512) Boot mode: Normal Running processes: C:\WINDOWS\system32\csrss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\svchost.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\oodag.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe C:\Program Files\DialNet\WrOS.EXE C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\WINDOWS\System32\alg.exe C:\WINDOWS\system32\ctfmon.exe C:\WINDOWS\RTHDCPL.EXE C:\WINDOWS\system32\RUNDLL32.EXE C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe C:\Program Files\DialNet\winpppoverethernet.exe C:\Program Files\Mozilla Firefox\firefox.exe E:\POBIERANIE PLIKÓW\dss.exe C:\WINDOWS\system32\wbem\wmiprvse.exe C:\PROGRA~1\TRENDM~1\HIJACK~1\darek.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe O4 - HKLM\..\Run: [a-winpoet-service] "C:\Program Files\DialNet\winpppoverethernet.exe" O4 - HKLM\..\Run: [] "C:\PROGRA~1\DialNet\FPLICE~1.EXE zhimakaimen//WINPOET_QUITTING_EVENT" O4 - HKLM\..\Run: [z-WrDialer] "C:\Program Files\DialNet\wrdialer.exe" O4 - HKLM\..\Run: [C:\WINDOWS\system32\kdxqf.exe] C:\WINDOWS\system32\kdxqf.exe O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O8 - Extra context menu item: E&ksportuj do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_05\bin\npjpi142_05.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_05\bin\npjpi142_05.dll O9 - Extra button: Wyślij do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra 'Tools' menuitem: Wyślij &do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O17 - HKLM\System\CCS\Services\Tcpip\..\{D00ADFD7-4B7A-4A18-9769-C0B84E014826}: NameServer = 217.30.129.149 217.30.137.200 O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: O&O Defrag - O&O Software GmbH - C:\WINDOWS\system32\oodag.exe O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe O23 - Service: WinPPPoverEthernet - Fine Point Technologies, Inc. - C:\Program Files\DialNet\WrOS.EXE -- End of file - 6569 bytes -- HijackThis Fixed Entries (C:\PROGRA~1\TRENDM~1\HIJACK~1\backups\) ----------- backup-20080812-112609-232 O4 - HKLM\..\Run: [SMrhcjj0j0ecep] C:\Program Files\rhcjj0j0ecep\rhcjj0j0ecep.exe backup-20080812-112609-315 O4 - HKLM\..\Run: [lphcnj0j0ecep] C:\WINDOWS\system32\lphcnj0j0ecep.exe backup-20080812-112609-407 O4 - HKLM\..\Run: [C:\WINDOWS\system32\kdxqf.exe] C:\WINDOWS\system32\kdxqf.exe backup-20080812-122704-563 O4 - HKLM\..\Run: [C:\WINDOWS\system32\kdxqf.exe] C:\WINDOWS\system32\kdxqf.exe -- File Associations ----------------------------------------------------------- [COLOR=red].cpl - cplfile - shell\cplopen\command - rundll32.exe shell32.dll,Control_RunDLL "%1",%*[/COLOR] [COLOR=red].cpl - cplfile - shell\runas\command - rundll32.exe shell32.dll,Control_RunDLLAsUser "%1",%*[/COLOR] -- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------- R2 CX23880 (WinFast CX2388x WDM Video Capture.) - c:\windows\system32\drivers\cx88vid.sys <Not Verified; Leadtek Research Inc.; CX2388x Video Capture Driver> R2 CXAVXBAR (WinFast CX2388x WDM Crossbar.) - c:\windows\system32\drivers\cxavxbar.sys <Not Verified; Leadtek Research Inc.; CX2388x AVStream Crossbar Driver> R2 CXTUNE (WinFast CX2388x WDM TVTuner.) - c:\windows\system32\drivers\cx88tune.sys <Not Verified; Leadtek Research Inc.; CX2388x Tuner Driver> R2 TopWinPoETDriver (WinPoET PPPoE Optimized Driver) - c:\windows\system32\drivers\wrkpoet2000.sys R3 FPD (Fine Point Packet Service) - c:\windows\system32\drivers\fpd.sys <Not Verified; Politecnico di Torino; NPF Driver> R3 WrKPoET2000 - c:\program files\dialnet\wrkpoet2000.sys S3 WFIOCTL - c:\program files\winfast\wftvfm\wfioctl.sys <Not Verified; Leadtek Research Inc.; WinFast MultiMedia Device Driver (Windows 2000/XP)> -- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled -------------------- R2 WinPPPoverEthernet - c:\program files\dialnet\wros.exe <Not Verified; Fine Point Technologies, Inc.; Fine Point WROS> S3 ServiceLayer - "c:\program files\pc connectivity solution\servicelayer.exe" <Not Verified; Nokia.; PC Connectivity Solution> -- Device Manager: Disabled ---------------------------------------------------- Class GUID: {EEC5AD98-8080-425F-922A-DABF3DE3F69A} Description: Nokia E65 Device ID: ROOT\WPD\0000 Manufacturer: Nokia Name: Nokia E65 PNP Device ID: ROOT\WPD\0000 Service: WUDFRd -- Files created between 2008-07-12 and 2008-08-12 ----------------------------- 2008-08-12 12:18:51 0 d-------- C:\Program Files\rhcjj0j0ecep 2008-08-12 12:16:32 0 d-------- C:\ComboFix(2) 2008-08-12 11:47:32 68096 --a------ C:\WINDOWS\zip.exe 2008-08-12 11:47:32 161792 --a------ C:\WINDOWS\swreg.exe <Not Verified; SteelWerX; SteelWerX Registry Editor> 2008-08-12 11:47:32 80412 --a------ C:\WINDOWS\grep.exe 2008-08-12 11:47:31 49152 --a------ C:\WINDOWS\VFind.exe 2008-08-12 11:47:31 212480 --a------ C:\WINDOWS\swxcacls.exe <Not Verified; SteelWerX; SteelWerX Extended Configurator ACLists> 2008-08-12 11:47:31 136704 --a------ C:\WINDOWS\swsc.exe <Not Verified; SteelWerX; SteelWerX Service Controller> 2008-08-12 11:47:31 98816 --a------ C:\WINDOWS\sed.exe 2008-08-12 11:47:31 89504 --a------ C:\WINDOWS\fdsv.exe <Not Verified; Smallfrogs Studio; > 2008-08-12 09:40:18 0 d-------- C:\Program Files\Trend Micro 2008-08-12 09:05:40 0 d-------- C:\Nod32 v2.5 2008-08-12 08:47:07 94208 --a------ C:\WINDOWS\system32\pphcnj0j0ecep.exe 2008-08-12 08:37:49 60928 --a------ C:\WINDOWS\system32\blphcnj0j0ecep.scr <Not Verified; Sysinternals; Sysinternals Blue Screen> 2008-08-12 08:37:12 129536 --a------ C:\WINDOWS\system32\lphcnj0j0ecep.exe 2008-08-11 23:14:33 14336 --a------ C:\WINDOWS\system32\el32.dll 2008-08-11 10:49:28 0 d-------- C:\Program Files\Common Files\PCSuite 2008-08-11 10:49:27 0 d-------- C:\Program Files\Common Files\Nokia 2008-08-11 10:49:13 0 d-------- C:\Program Files\PC Connectivity Solution 2008-08-10 21:25:12 0 d-------- C:\WINDOWS\system32\oodag 2008-08-08 20:57:11 0 d-------- C:\WINDOWS\Sun 2008-08-08 18:13:19 5 --ahs---- C:\WINDOWS\system32\acae9_s.dll 2008-08-08 17:35:23 210032 --a------ C:\WINDOWS\system32\DBCLIENT.DLL 2008-08-07 20:17:32 0 d-------- C:\WINDOWS\pss 2008-08-07 19:08:22 86016 --a------ C:\WINDOWS\system32\CNMCP66.exe <Not Verified; CANON INC.; Canon BJ Raster Printer Driver Installer> 2008-08-07 19:08:18 0 d--h----- C:\BJPrinter 2008-08-07 15:10:04 0 d-------- C:\Program Files\Common Files\Ulead Systems 2008-08-07 15:09:35 49152 --a------ C:\WINDOWS\system32\TempDel.EXE <Not Verified; Leadtek Research Inc.; Leadtek Research Inc. TempDel> 2008-08-07 15:09:33 9446 --a------ C:\WINDOWS\system32\drivers\WFIOCTL.sys <Not Verified; Leadtek Research Inc.; WinFast MultiMedia Device Driver (Windows 2000/XP)> 2008-08-07 15:09:30 0 d-------- C:\Program Files\WinFast 2008-08-07 15:06:50 0 d-------- C:\WINDOWS\system32\WinFast 2008-08-07 15:06:50 9728 --a------ C:\WINDOWS\system32\drivers\cxavxbar.sys <Not Verified; Leadtek Research Inc.; CX2388x AVStream Crossbar Driver> 2008-08-07 15:06:50 162944 --a------ C:\WINDOWS\system32\drivers\cx88vid.sys <Not Verified; Leadtek Research Inc.; CX2388x Video Capture Driver> 2008-08-07 15:06:50 50816 --a------ C:\WINDOWS\system32\drivers\cx88tune.sys <Not Verified; Leadtek Research Inc.; CX2388x Tuner Driver> 2008-08-07 15:06:49 0 d-------- C:\Program Files\Leadtek Research Inc 2008-08-07 14:40:03 0 d--hs---- C:\WINDOWS\Installer 2008-08-07 14:40:02 0 d-------- C:\Program Files\Common Files\ODBC 2008-08-07 14:40:01 0 d-------- C:\Program Files\Common Files\SpeechEngines 2008-08-07 14:40:00 0 dr------- C:\Program Files 2008-08-07 14:40:00 0 d-------- C:\Program Files\Common Files 2008-08-07 14:37:50 0 d-------- C:\WINDOWS\system32\CatRoot2 2008-08-07 14:37:50 0 d-------- C:\WINDOWS\system32\CatRoot 2008-08-07 14:37:31 0 d--hs---- C:\System Volume Information 2008-08-07 14:37:31 0 d-------- C:\Documents and Settings 2008-08-07 14:34:20 0 d-------- C:\WINDOWS 2008-08-07 14:34:20 0 d-------- C:\WINDOWS\WinSxS 2008-08-07 14:34:20 0 dr------- C:\WINDOWS\Web 2008-08-07 14:34:20 0 d-------- C:\WINDOWS\twain_32 2008-08-07 14:34:20 0 d-------- C:\WINDOWS\system32 2008-08-07 14:34:20 0 d-------- C:\WINDOWS\system32\wins 2008-08-07 14:34:20 0 d-------- C:\WINDOWS\system32\wbem 2008-08-07 14:34:20 0 d-------- C:\WINDOWS\system32\usmt 2008-08-07 14:34:20 0 d-------- C:\WINDOWS\system32\spool 2008-08-07 14:34:20 0 d-------- C:\WINDOWS\system32\ShellExt 2008-08-07 14:34:20 0 d-------- C:\WINDOWS\system32\Setup 2008-08-07 14:34:20 0 d-------- C:\WINDOWS\system32\ras 2008-08-07 14:34:20 0 d-------- C:\WINDOWS\system32\oobe 2008-08-07 14:34:20 0 d-------- C:\WINDOWS\system32\npp 2008-08-07 14:34:20 0 d-------- C:\WINDOWS\system32\mui 2008-08-07 14:34:20 0 d-------- C:\WINDOWS\system32\inetsrv 2008-08-07 14:34:20 0 d-------- C:\WINDOWS\system32\IME 2008-08-07 14:34:20 0 d-------- C:\WINDOWS\system32\icsxml 2008-08-07 14:34:20 0 d-------- C:\WINDOWS\system32\ias 2008-08-07 14:34:20 0 d-------- C:\WINDOWS\system32\export 2008-08-07 14:34:20 0 d-------- C:\WINDOWS\system32\drivers 2008-08-07 14:34:20 0 d-------- C:\WINDOWS\system32\drivers\etc 2008-08-07 14:34:20 0 d-------- C:\WINDOWS\system32\drivers\disdn 2008-08-07 14:34:20 0 dr-hs--c- C:\WINDOWS\system32\dllcache 2008-08-07 14:34:20 0 d-------- C:\WINDOWS\system32\dhcp 2008-08-07 14:34:20 0 d-------- C:\WINDOWS\system32\config 2008-08-07 14:34:20 0 d-------- C:\WINDOWS\system32\3com_dmi 2008-08-07 14:34:20 0 d-------- C:\WINDOWS\system32\3076 2008-08-07 14:34:20 0 d-------- C:\WINDOWS\system32\2052 2008-08-07 14:34:20 0 d-------- C:\WINDOWS\system32\1054 2008-08-07 14:34:20 0 d-------- C:\WINDOWS\system32\1045 2008-08-07 14:34:20 0 d-------- C:\WINDOWS\system32\1042 2008-08-07 14:34:20 0 d-------- C:\WINDOWS\system32\1041 2008-08-07 14:34:20 0 d-------- C:\WINDOWS\system32\1037 2008-08-07 14:34:20 0 d-------- C:\WINDOWS\system32\1033 2008-08-07 14:34:20 0 d-------- C:\WINDOWS\system32\1031 2008-08-07 14:34:20 0 d-------- C:\WINDOWS\system32\1028 2008-08-07 14:34:20 0 d-------- C:\WINDOWS\system32\1025 2008-08-07 14:34:20 0 d-------- C:\WINDOWS\system 2008-08-07 14:34:20 0 d-------- C:\WINDOWS\security 2008-08-07 14:34:20 0 d-------- C:\WINDOWS\Resources 2008-08-07 14:34:20 0 d-------- C:\WINDOWS\repair 2008-08-07 14:34:20 0 d-------- C:\WINDOWS\Provisioning 2008-08-07 14:34:20 0 d-------- C:\WINDOWS\PeerNet 2008-08-07 14:34:20 0 d-------- C:\WINDOWS\pchealth 2008-08-07 14:34:20 0 d-------- C:\WINDOWS\mui 2008-08-07 14:34:20 0 d-------- C:\WINDOWS\msapps 2008-08-07 14:34:20 0 d-------- C:\WINDOWS\msagent 2008-08-07 14:34:20 0 d-------- C:\WINDOWS\Media 2008-08-07 14:34:20 0 d-------- C:\WINDOWS\java 2008-08-07 14:34:20 0 d--h----- C:\WINDOWS\inf 2008-08-07 14:34:20 0 d-------- C:\WINDOWS\ime 2008-08-07 14:34:20 0 d-------- C:\WINDOWS\Help 2008-08-07 14:34:20 0 dr--s---- C:\WINDOWS\Fonts 2008-08-07 14:34:20 0 d-------- C:\WINDOWS\ehome 2008-08-07 14:34:20 0 d-------- C:\WINDOWS\Driver Cache 2008-08-07 14:34:20 0 d-------- C:\WINDOWS\Debug 2008-08-07 14:34:20 0 d-------- C:\WINDOWS\Cursors 2008-08-07 14:34:20 0 d-------- C:\WINDOWS\Connection Wizard 2008-08-07 14:34:20 0 d-------- C:\WINDOWS\Config 2008-08-07 14:34:20 0 d-------- C:\WINDOWS\AppPatch 2008-08-07 14:34:20 0 d-------- C:\WINDOWS\addins 2008-08-07 14:03:51 0 d-------- C:\Program Files\Microsoft Works 2008-08-07 14:03:45 0 d-------- C:\Program Files\MSBuild 2008-08-07 14:00:58 0 d-------- C:\WINDOWS\SHELLNEW 2008-08-07 14:00:23 0 dr-h----- C:\MSOCache 2008-08-07 13:54:04 0 --a------ C:\WINDOWS\nsreg.dat 2008-08-07 13:50:54 0 d-------- C:\Program Files\Opera 2008-08-07 13:39:52 0 d-------- C:\WINDOWS\Prefetch 2008-08-07 13:38:15 0 d-------- C:\WINDOWS\system32\PreInstall 2008-08-07 13:38:14 0 d--h----- C:\WINDOWS\$hf_mig$ 2008-08-07 13:35:39 0 d-------- C:\WINDOWS\system32\pl-pl 2008-08-07 13:35:38 0 d-------- C:\WINDOWS\system32\pl 2008-08-07 13:35:38 0 d-------- C:\WINDOWS\system32\bits 2008-08-07 13:35:38 0 d-------- C:\WINDOWS\l2schemas 2008-08-07 13:33:55 0 d-------- C:\WINDOWS\ServicePackFiles 2008-08-07 13:32:18 0 d-------- C:\WINDOWS\network diagnostic 2008-08-07 13:27:24 0 d-------- C:\WINDOWS\system32\SoftwareDistribution 2008-08-07 13:24:03 30336 --a------ C:\WINDOWS\system32\drivers\fpd.sys <Not Verified; Politecnico di Torino; NPF Driver> 2008-08-07 13:23:55 1056768 --a------ C:\WINDOWS\system32\ROBOEX32.DLL <Not Verified; Blue Sky Software Corporation.; RoboHELP Classic 2000> 2008-08-07 13:23:55 52214 --a------ C:\WINDOWS\system32\drivers\WrKPoET2000.sys 2008-08-07 13:23:53 0 d-------- C:\Program Files\DialNet 2008-08-07 13:19:47 0 d-------- C:\Program Files\Windows Media Connect 2 2008-08-07 13:19:05 0 d-------- C:\WINDOWS\system32\LogFiles 2008-08-07 13:19:05 0 d-------- C:\WINDOWS\system32\drivers\UMDF 2008-08-07 13:16:21 0 d-------- C:\Program Files\Common Files\Adobe 2008-08-07 13:14:46 364544 -----n--- C:\WINDOWS\system32\TwnLib4.dll <Not Verified; Pegasus Imaging Corp.; TwnLib4> 2008-08-07 13:14:46 106496 --a------ C:\WINDOWS\system32\TwnLib20.dll <Not Verified; Pegasus Software; TWNLIB20> 2008-08-07 13:14:45 155648 --a------ C:\WINDOWS\system32\NeroCheck.exe <Not Verified; Ahead Software Gmbh; Ahead Software Gmbh NeroCheck> 2008-08-07 13:14:45 471040 -----n--- C:\WINDOWS\system32\ImagXRA7.dll <Not Verified; Pegasus Imaging Corp.; ImagXpress7> 2008-08-07 13:14:45 262144 -----n--- C:\WINDOWS\system32\ImagXR7.dll <Not Verified; Pegasus Imaging Corp.; ImagXpress7> 2008-08-07 13:14:45 1568768 -----n--- C:\WINDOWS\system32\ImagX7.dll <Not Verified; Pegasus Imaging Corp.; ImagXpress7> 2008-08-07 13:14:44 0 d-------- C:\Program Files\Common Files\Ahead 2008-08-07 13:14:43 0 d-------- C:\Program Files\Ahead 2008-08-07 13:11:39 0 d-------- C:\Program Files\Java 2008-08-07 13:11:38 0 d-------- C:\Program Files\Common Files\Java 2008-08-07 13:11:00 0 d-------- C:\Program Files\IrfanView 2008-08-07 13:09:14 0 d-------- C:\Program Files\Google 2008-08-07 13:09:04 0 d-------- C:\Program Files\Skype 2008-08-07 13:09:04 0 d-------- C:\Program Files\Common Files\Skype 2008-08-07 13:08:15 0 d-------- C:\Program Files\Gadu-Gadu 2008-08-07 13:04:46 0 d-------- C:\Program Files\Alwil Software 2008-08-07 13:04:21 0 d-------- C:\Program Files\MarBit 2008-08-07 13:02:10 0 d-------- C:\Program Files\My Company Name 2008-08-07 13:01:15 0 d-------- C:\WINDOWS\nview 2008-08-07 12:59:16 0 d-------- C:\Program Files\XP Codec Pack 2008-08-07 12:53:09 0 d-------- C:\WINDOWS\system32\Lang 2008-08-07 12:52:13 49152 -r------- C:\WINDOWS\system32\ChCfg.exe 2008-08-07 12:52:02 0 d-------- C:\WINDOWS\system32\RTCOM 2008-08-07 12:51:44 0 d-------- C:\Program Files\Realtek 2008-08-07 12:51:43 0 d--h----- C:\Program Files\InstallShield Installation Information 2008-08-07 12:51:42 315392 --a------ C:\WINDOWS\HideWin.exe <Not Verified; Realtek Semiconductor Corp.; HD Audio Hide windows program> 2008-08-07 12:51:41 520192 -r------- C:\WINDOWS\RtlExUpd.dll <Not Verified; Realtek Semiconductor Corp.; RtlExUpd Dynamic Link Library> 2008-08-07 12:51:38 0 d-------- C:\Program Files\Common Files\InstallShield 2008-08-07 12:51:18 0 d-------- C:\Program Files\DIFX 2008-08-07 12:51:17 0 d-------- C:\WINDOWS\system32\ReinstallBackups 2008-08-07 12:51:15 0 d------c- C:\WINDOWS\system32\DRVSTORE 2008-08-07 12:50:53 1732 --a------ C:\WINDOWS\system32\drivers\nvphy.bin 2008-08-07 12:48:38 0 d-------- C:\WINDOWS\SoftwareDistribution 2008-08-07 12:48:35 0 d---s---- C:\WINDOWS\system32\Microsoft 2008-08-07 12:46:28 0 d-------- C:\WINDOWS\system32\xircom 2008-08-07 12:46:28 0 d-------- C:\Program Files\microsoft frontpage 2008-08-07 12:46:09 0 -rahs---- C:\MSDOS.SYS 2008-08-07 12:46:09 0 -rahs---- C:\IO.SYS 2008-08-07 12:46:09 0 --a------ C:\CONFIG.SYS 2008-08-07 12:46:09 0 --a------ C:\AUTOEXEC.BAT 2008-08-07 12:45:20 0 dr------- C:\WINDOWS\Offline Web Pages 2008-08-07 12:45:20 0 d---s---- C:\WINDOWS\Downloaded Program Files 2008-08-07 12:45:12 0 d--h----- C:\Program Files\WindowsUpdate 2008-08-07 12:45:10 0 d-------- C:\Program Files\Usługi online 2008-08-07 12:44:59 0 d-------- C:\WINDOWS\system32\DirectX 2008-08-07 12:44:35 0 d---s---- C:\WINDOWS\Tasks 2008-08-07 12:44:34 0 d-------- C:\Program Files\Common Files\MSSoap 2008-08-07 12:44:32 0 d-------- C:\WINDOWS\srchasst 2008-08-07 12:44:31 0 d-------- C:\WINDOWS\system32\Macromed 2008-08-07 12:44:26 0 d-------- C:\Program Files\Movie Maker 2008-08-07 12:44:21 0 d-------- C:\WINDOWS\system32\Restore 2008-08-07 12:43:53 21856 --a------ C:\WINDOWS\system32\emptyregdb.dat 2008-08-07 12:43:40 0 d-------- C:\WINDOWS\Registration 2008-08-07 12:43:30 0 d-------- C:\Program Files\Messenger 2008-08-07 12:43:27 0 d-------- C:\Program Files\MSN Gaming Zone 2008-08-07 12:43:07 0 d-------- C:\Program Files\Windows NT 2008-08-07 12:43:05 0 d-------- C:\WINDOWS\system32\MsDtc 2008-08-07 12:43:04 0 d-------- C:\WINDOWS\system32\Com -- Find3M Report --------------------------------------------------------------- 2008-08-12 12:18:51 0 d-------- C:\Documents and Settings\darek\Dane aplikacji\rhcjj0j0ecep 2008-08-11 23:02:15 26624 --a------ C:\WINDOWS\system32\userinit.exe 2008-08-11 19:12:19 0 d-------- C:\Documents and Settings\darek\Dane aplikacji\Skype 2008-08-11 12:35:49 0 d-------- C:\Documents and Settings\darek\Dane aplikacji\Corel 2008-08-11 10:52:29 0 d-------- C:\Documents and Settings\darek\Dane aplikacji\Nokia 2008-08-11 10:52:27 0 d-------- C:\Documents and Settings\darek\Dane aplikacji\PC Suite 2008-08-08 17:24:20 0 d-------- C:\Documents and Settings\darek\Dane aplikacji\AdobeUM 2008-08-07 23:20:24 0 d-------- C:\Documents and Settings\darek\Dane aplikacji\Media Player Classic 2008-08-07 23:20:12 0 d-------- C:\Documents and Settings\darek\Dane aplikacji\Adobe 2008-08-07 14:39:37 62 --ahs---- C:\Documents and Settings\darek\Dane aplikacji\desktop.ini 2008-08-07 14:28:41 0 d-------- C:\Documents and Settings\darek\Dane aplikacji\WinRAR 2008-08-07 14:05:24 359178 --a------ C:\WINDOWS\system32\perfh015.dat 2008-08-07 14:05:24 50968 --a------ C:\WINDOWS\system32\perfc015.dat 2008-08-07 14:04:30 0 d-------- C:\Documents and Settings\darek\Dane aplikacji\Macromedia 2008-08-07 13:54:03 0 d-------- C:\Documents and Settings\darek\Dane aplikacji\Mozilla 2008-08-07 13:50:59 0 d-------- C:\Documents and Settings\darek\Dane aplikacji\Opera 2008-08-07 13:48:50 0 d-------- C:\Documents and Settings\darek\Dane aplikacji\Gadu-Gadu 2008-08-07 13:42:03 0 d-------- C:\Documents and Settings\darek\Dane aplikacji\Google 2008-08-07 13:11:45 0 d-------- C:\Documents and Settings\darek\Dane aplikacji\Sun 2008-08-07 12:50:48 0 d-------- C:\Documents and Settings\darek\Dane aplikacji\InstallShield 2008-08-07 12:49:19 0 d-------- C:\Documents and Settings\darek\Dane aplikacji\Identities -- Registry Dump --------------------------------------------------------------- *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "RTHDCPL"="RTHDCPL.EXE" [2007-09-03 09:52 C:\WINDOWS\RTHDCPL.exe] "Alcmtr"="ALCMTR.EXE" [2005-05-03 12:43 C:\WINDOWS\Alcmtr.exe] "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2008-04-11 11:33] "nwiz"="nwiz.exe" [2008-04-11 11:33 C:\WINDOWS\system32\nwiz.exe] "NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2008-04-11 11:33] "avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2008-07-19 16:38] "SunJavaUpdateSched"="C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe" [2004-06-03 22:05] "a-winpoet-service"="C:\Program Files\DialNet\winpppoverethernet.exe" [2007-07-06 08:40] "@"="C:\PROGRA~1\DialNet\FPLICE~1.exe" [2007-07-04 16:27] "z-WrDialer"="C:\Program Files\DialNet\wrdialer.exe" [2007-07-11 17:11] "C:\WINDOWS\system32\kdxqf.exe"="C:\WINDOWS\system32\kdxqf.exe" [2008-04-14 22:51] "MSConfig"="C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe" [2008-04-14 22:51] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2008-04-14 22:51] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system] "NoDispBackgroundPage"=1 (0x1) "NoDispScrSavPage"=1 (0x1) "DisableRegistryTools"=0 (0x0) [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon] "System"="kdxqf.exe" [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\dimsntfy] C:\WINDOWS\System32\dimsntfy.dll [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\PSEXESVC] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\vds] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{533C5B84-EC70-11D2-9505-00C04F79DEAF}] @="Volume shadow copy" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Adobe Reader Speed Launch.lnk] path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Adobe Reader Speed Launch.lnk backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] eapsvcs eaphost dot3svc dot3svc HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs napagent hkmsvc -- End of Deckard's System Scanner: finished at 2008-08-12 12:37:02 ------------

**Posty:** 8001 · przez **Okocza** 12 Sie 2008, 12:48

Kod: Zaznacz wszystko: O4 - HKLM\..\Run: [C:\WINDOWS\system32\kdxqf.exe] C:\WINDOWS\system32\kdxqf.exe

fix w hj

Kod: Zaznacz wszystko: Files to delete: C:\WINDOWS\zip.exe C:\WINDOWS\swreg.exe C:\WINDOWS\grep.exe C:\WINDOWS\VFind.exe C:\WINDOWS\swxcacls.exe C:\WINDOWS\swsc.exe C:\WINDOWS\sed.exe C:\WINDOWS\fdsv.exe C:\WINDOWS\system32\pphcnj0j0ecep.exe C:\WINDOWS\system32\blphcnj0j0ecep.scr C:\WINDOWS\system32\lphcnj0j0ecep.exe Folders to delete: C:\Program Files\rhcjj0j0ecep C:\Documents and Settings\darek\Dane aplikacji\rhcjj0j0ecep

narzedzia-do-usuwania-plikow-vt96629.html

pobierz avengera i wklej to co powyżej dałem

---------------------------

otworz notatnik i wklej:

Kod: Zaznacz wszystko: Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "C:\WINDOWS\system32\kdxqf.exe"=- [-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]

zapisz jako fix.reg i odpal

wracasz z logami z hijacka i z DSS'a. czekamy na sdfixa

**Posty:** 684 · przez **kalcyt13** 12 Sie 2008, 12:49

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 12:47, on 2008-08-12 Platform: Windows XP Dodatek SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512) Boot mode: Normal Running processes: C:\WINDOWS\system32\csrss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\savedump.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\RTHDCPL.EXE C:\WINDOWS\system32\RUNDLL32.EXE C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe C:\Program Files\DialNet\winpppoverethernet.exe C:\WINDOWS\system32\ctfmon.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\oodag.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe C:\Program Files\DialNet\WrOS.EXE C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\WINDOWS\System32\alg.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\WINDOWS\system32\wuauclt.exe C:\WINDOWS\system32\wbem\wmiprvse.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe O4 - HKLM\..\Run: [a-winpoet-service] "C:\Program Files\DialNet\winpppoverethernet.exe" O4 - HKLM\..\Run: [] "C:\PROGRA~1\DialNet\FPLICE~1.EXE zhimakaimen//WINPOET_QUITTING_EVENT" O4 - HKLM\..\Run: [z-WrDialer] "C:\Program Files\DialNet\wrdialer.exe" O4 - HKLM\..\Run: [C:\WINDOWS\system32\kdxqf.exe] C:\WINDOWS\system32\kdxqf.exe O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O8 - Extra context menu item: E&ksportuj do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_05\bin\npjpi142_05.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_05\bin\npjpi142_05.dll O9 - Extra button: Wyślij do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra 'Tools' menuitem: Wyślij &do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O17 - HKLM\System\CCS\Services\Tcpip\..\{D00ADFD7-4B7A-4A18-9769-C0B84E014826}: NameServer = 217.30.129.149 217.30.137.200 O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: O&O Defrag - O&O Software GmbH - C:\WINDOWS\system32\oodag.exe O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe O23 - Service: WinPPPoverEthernet - Fine Point Technologies, Inc. - C:\Program Files\DialNet\WrOS.EXE -- End of file - 6694 bytes

Przepraszam, zapomniałem o tym logu. Dziwną ikonkę mam na pulpicie: Antivirus XP 2008. I właśnie pod tą lokalizacją, którą miałem wywalić...

**Posty:** 8001 · przez **Okocza** 12 Sie 2008, 12:51

kalcyt13, wykonaj to o co prosiłem w poprzednim poście. bez tego nie ruszymy dalej

**Posty:** 684 · przez **kalcyt13** 12 Sie 2008, 13:04

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 13:00, on 2008-08-12 Platform: Windows XP Dodatek SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512) Boot mode: Normal Running processes: C:\WINDOWS\system32\csrss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\RTHDCPL.EXE C:\WINDOWS\system32\RUNDLL32.EXE C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe C:\Program Files\DialNet\winpppoverethernet.exe C:\WINDOWS\system32\ctfmon.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\oodag.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe C:\Program Files\DialNet\WrOS.EXE C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\WINDOWS\System32\alg.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\WINDOWS\system32\wuauclt.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe C:\WINDOWS\system32\wbem\wmiprvse.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe O4 - HKLM\..\Run: [a-winpoet-service] "C:\Program Files\DialNet\winpppoverethernet.exe" O4 - HKLM\..\Run: [] "C:\PROGRA~1\DialNet\FPLICE~1.EXE zhimakaimen//WINPOET_QUITTING_EVENT" O4 - HKLM\..\Run: [z-WrDialer] "C:\Program Files\DialNet\wrdialer.exe" O4 - HKLM\..\Run: [C:\WINDOWS\system32\kdxqf.exe] C:\WINDOWS\system32\kdxqf.exe O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O8 - Extra context menu item: E&ksportuj do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_05\bin\npjpi142_05.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_05\bin\npjpi142_05.dll O9 - Extra button: Wyślij do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra 'Tools' menuitem: Wyślij &do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O17 - HKLM\System\CCS\Services\Tcpip\..\{D00ADFD7-4B7A-4A18-9769-C0B84E014826}: NameServer = 217.30.129.149 217.30.137.200 O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: O&O Defrag - O&O Software GmbH - C:\WINDOWS\system32\oodag.exe O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe O23 - Service: WinPPPoverEthernet - Fine Point Technologies, Inc. - C:\Program Files\DialNet\WrOS.EXE -- End of file - 6660 bytes

Kod: Zaznacz wszystko: Deckard's System Scanner v20071014.68 Run by darek on 2008-08-12 13:03:02 Computer is in Normal Mode. -------------------------------------------------------------------------------- -- HijackThis (run as darek.exe) ----------------------------------------------- Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 13:03, on 2008-08-12 Platform: Windows XP Dodatek SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512) Boot mode: Normal Running processes: C:\WINDOWS\system32\csrss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\RTHDCPL.EXE C:\WINDOWS\system32\RUNDLL32.EXE C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe C:\Program Files\DialNet\winpppoverethernet.exe C:\WINDOWS\system32\ctfmon.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\oodag.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe C:\Program Files\DialNet\WrOS.EXE C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\WINDOWS\System32\alg.exe C:\Program Files\Mozilla Firefox\firefox.exe E:\POBIERANIE PLIKÓW\dss.exe C:\PROGRA~1\TRENDM~1\HIJACK~1\darek.exe C:\WINDOWS\system32\wbem\wmiprvse.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe O4 - HKLM\..\Run: [a-winpoet-service] "C:\Program Files\DialNet\winpppoverethernet.exe" O4 - HKLM\..\Run: [] "C:\PROGRA~1\DialNet\FPLICE~1.EXE zhimakaimen//WINPOET_QUITTING_EVENT" O4 - HKLM\..\Run: [z-WrDialer] "C:\Program Files\DialNet\wrdialer.exe" O4 - HKLM\..\Run: [C:\WINDOWS\system32\kdxqf.exe] C:\WINDOWS\system32\kdxqf.exe O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O8 - Extra context menu item: E&ksportuj do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_05\bin\npjpi142_05.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_05\bin\npjpi142_05.dll O9 - Extra button: Wyślij do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra 'Tools' menuitem: Wyślij &do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O17 - HKLM\System\CCS\Services\Tcpip\..\{D00ADFD7-4B7A-4A18-9769-C0B84E014826}: NameServer = 217.30.129.149 217.30.137.200 O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: O&O Defrag - O&O Software GmbH - C:\WINDOWS\system32\oodag.exe O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe O23 - Service: WinPPPoverEthernet - Fine Point Technologies, Inc. - C:\Program Files\DialNet\WrOS.EXE -- End of file - 6642 bytes -- Files created between 2008-07-12 and 2008-08-12 ----------------------------- 2008-08-12 09:40:18 0 d-------- C:\Program Files\Trend Micro 2008-08-12 09:05:40 0 d-------- C:\Nod32 v2.5 2008-08-11 23:14:33 14336 --a------ C:\WINDOWS\system32\el32.dll 2008-08-11 10:49:28 0 d-------- C:\Program Files\Common Files\PCSuite 2008-08-11 10:49:27 0 d-------- C:\Program Files\Common Files\Nokia 2008-08-11 10:49:13 0 d-------- C:\Program Files\PC Connectivity Solution 2008-08-10 21:25:12 0 d-------- C:\WINDOWS\system32\oodag 2008-08-08 20:57:11 0 d-------- C:\WINDOWS\Sun 2008-08-08 18:13:19 5 --ahs---- C:\WINDOWS\system32\acae9_s.dll 2008-08-08 17:35:23 210032 --a------ C:\WINDOWS\system32\DBCLIENT.DLL 2008-08-07 20:17:32 0 d-------- C:\WINDOWS\pss 2008-08-07 19:08:22 86016 --a------ C:\WINDOWS\system32\CNMCP66.exe <Not Verified; CANON INC.; Canon BJ Raster Printer Driver Installer> 2008-08-07 19:08:18 0 d--h----- C:\BJPrinter 2008-08-07 15:10:04 0 d-------- C:\Program Files\Common Files\Ulead Systems 2008-08-07 15:09:35 49152 --a------ C:\WINDOWS\system32\TempDel.EXE <Not Verified; Leadtek Research Inc.; Leadtek Research Inc. TempDel> 2008-08-07 15:09:33 9446 --a------ C:\WINDOWS\system32\drivers\WFIOCTL.sys <Not Verified; Leadtek Research Inc.; WinFast MultiMedia Device Driver (Windows 2000/XP)> 2008-08-07 15:09:30 0 d-------- C:\Program Files\WinFast 2008-08-07 15:06:50 0 d-------- C:\WINDOWS\system32\WinFast 2008-08-07 15:06:50 9728 --a------ C:\WINDOWS\system32\drivers\cxavxbar.sys <Not Verified; Leadtek Research Inc.; CX2388x AVStream Crossbar Driver> 2008-08-07 15:06:50 162944 --a------ C:\WINDOWS\system32\drivers\cx88vid.sys <Not Verified; Leadtek Research Inc.; CX2388x Video Capture Driver> 2008-08-07 15:06:50 50816 --a------ C:\WINDOWS\system32\drivers\cx88tune.sys <Not Verified; Leadtek Research Inc.; CX2388x Tuner Driver> 2008-08-07 15:06:49 0 d-------- C:\Program Files\Leadtek Research Inc 2008-08-07 14:40:03 0 d--hs---- C:\WINDOWS\Installer 2008-08-07 14:40:02 0 d-------- C:\Program Files\Common Files\ODBC 2008-08-07 14:40:01 0 d-------- C:\Program Files\Common Files\SpeechEngines 2008-08-07 14:40:00 0 dr------- C:\Program Files 2008-08-07 14:40:00 0 d-------- C:\Program Files\Common Files 2008-08-07 14:37:50 0 d-------- C:\WINDOWS\system32\CatRoot2 2008-08-07 14:37:50 0 d-------- C:\WINDOWS\system32\CatRoot 2008-08-07 14:37:31 0 d--hs---- C:\System Volume Information 2008-08-07 14:37:31 0 d-------- C:\Documents and Settings 2008-08-07 14:34:20 0 d-------- C:\WINDOWS 2008-08-07 14:34:20 0 d-------- C:\WINDOWS\WinSxS 2008-08-07 14:34:20 0 dr------- C:\WINDOWS\Web 2008-08-07 14:34:20 0 d-------- C:\WINDOWS\twain_32 2008-08-07 14:34:20 0 d-------- C:\WINDOWS\system32 2008-08-07 14:34:20 0 d-------- C:\WINDOWS\system32\wins 2008-08-07 14:34:20 0 d-------- C:\WINDOWS\system32\wbem 2008-08-07 14:34:20 0 d-------- C:\WINDOWS\system32\usmt 2008-08-07 14:34:20 0 d-------- C:\WINDOWS\system32\spool 2008-08-07 14:34:20 0 d-------- C:\WINDOWS\system32\ShellExt 2008-08-07 14:34:20 0 d-------- C:\WINDOWS\system32\Setup 2008-08-07 14:34:20 0 d-------- C:\WINDOWS\system32\ras 2008-08-07 14:34:20 0 d-------- C:\WINDOWS\system32\oobe 2008-08-07 14:34:20 0 d-------- C:\WINDOWS\system32\npp 2008-08-07 14:34:20 0 d-------- C:\WINDOWS\system32\mui 2008-08-07 14:34:20 0 d-------- C:\WINDOWS\system32\inetsrv 2008-08-07 14:34:20 0 d-------- C:\WINDOWS\system32\IME 2008-08-07 14:34:20 0 d-------- C:\WINDOWS\system32\icsxml 2008-08-07 14:34:20 0 d-------- C:\WINDOWS\system32\ias 2008-08-07 14:34:20 0 d-------- C:\WINDOWS\system32\export 2008-08-07 14:34:20 0 d-------- C:\WINDOWS\system32\drivers 2008-08-07 14:34:20 0 d-------- C:\WINDOWS\system32\drivers\etc 2008-08-07 14:34:20 0 d-------- C:\WINDOWS\system32\drivers\disdn 2008-08-07 14:34:20 0 dr-hs--c- C:\WINDOWS\system32\dllcache 2008-08-07 14:34:20 0 d-------- C:\WINDOWS\system32\dhcp 2008-08-07 14:34:20 0 d-------- C:\WINDOWS\system32\config 2008-08-07 14:34:20 0 d-------- C:\WINDOWS\system32\3com_dmi 2008-08-07 14:34:20 0 d-------- C:\WINDOWS\system32\3076 2008-08-07 14:34:20 0 d-------- C:\WINDOWS\system32\2052 2008-08-07 14:34:20 0 d-------- C:\WINDOWS\system32\1054 2008-08-07 14:34:20 0 d-------- C:\WINDOWS\system32\1045 2008-08-07 14:34:20 0 d-------- C:\WINDOWS\system32\1042 2008-08-07 14:34:20 0 d-------- C:\WINDOWS\system32\1041 2008-08-07 14:34:20 0 d-------- C:\WINDOWS\system32\1037 2008-08-07 14:34:20 0 d-------- C:\WINDOWS\system32\1033 2008-08-07 14:34:20 0 d-------- C:\WINDOWS\system32\1031 2008-08-07 14:34:20 0 d-------- C:\WINDOWS\system32\1028 2008-08-07 14:34:20 0 d-------- C:\WINDOWS\system32\1025 2008-08-07 14:34:20 0 d-------- C:\WINDOWS\system 2008-08-07 14:34:20 0 d-------- C:\WINDOWS\security 2008-08-07 14:34:20 0 d-------- C:\WINDOWS\Resources 2008-08-07 14:34:20 0 d-------- C:\WINDOWS\repair 2008-08-07 14:34:20 0 d-------- C:\WINDOWS\Provisioning 2008-08-07 14:34:20 0 d-------- C:\WINDOWS\PeerNet 2008-08-07 14:34:20 0 d-------- C:\WINDOWS\pchealth 2008-08-07 14:34:20 0 d-------- C:\WINDOWS\mui 2008-08-07 14:34:20 0 d-------- C:\WINDOWS\msapps 2008-08-07 14:34:20 0 d-------- C:\WINDOWS\msagent 2008-08-07 14:34:20 0 d-------- C:\WINDOWS\Media 2008-08-07 14:34:20 0 d-------- C:\WINDOWS\java 2008-08-07 14:34:20 0 d--h----- C:\WINDOWS\inf 2008-08-07 14:34:20 0 d-------- C:\WINDOWS\ime 2008-08-07 14:34:20 0 d-------- C:\WINDOWS\Help 2008-08-07 14:34:20 0 dr--s---- C:\WINDOWS\Fonts 2008-08-07 14:34:20 0 d-------- C:\WINDOWS\ehome 2008-08-07 14:34:20 0 d-------- C:\WINDOWS\Driver Cache 2008-08-07 14:34:20 0 d-------- C:\WINDOWS\Debug 2008-08-07 14:34:20 0 d-------- C:\WINDOWS\Cursors 2008-08-07 14:34:20 0 d-------- C:\WINDOWS\Connection Wizard 2008-08-07 14:34:20 0 d-------- C:\WINDOWS\Config 2008-08-07 14:34:20 0 d-------- C:\WINDOWS\AppPatch 2008-08-07 14:34:20 0 d-------- C:\WINDOWS\addins 2008-08-07 14:03:51 0 d-------- C:\Program Files\Microsoft Works 2008-08-07 14:03:45 0 d-------- C:\Program Files\MSBuild 2008-08-07 14:00:58 0 d-------- C:\WINDOWS\SHELLNEW 2008-08-07 14:00:23 0 dr-h----- C:\MSOCache 2008-08-07 13:54:04 0 --a------ C:\WINDOWS\nsreg.dat 2008-08-07 13:50:54 0 d-------- C:\Program Files\Opera 2008-08-07 13:39:52 0 d-------- C:\WINDOWS\Prefetch 2008-08-07 13:38:15 0 d-------- C:\WINDOWS\system32\PreInstall 2008-08-07 13:38:14 0 d--h----- C:\WINDOWS\$hf_mig$ 2008-08-07 13:35:39 0 d-------- C:\WINDOWS\system32\pl-pl 2008-08-07 13:35:38 0 d-------- C:\WINDOWS\system32\pl 2008-08-07 13:35:38 0 d-------- C:\WINDOWS\system32\bits 2008-08-07 13:35:38 0 d-------- C:\WINDOWS\l2schemas 2008-08-07 13:33:55 0 d-------- C:\WINDOWS\ServicePackFiles 2008-08-07 13:32:18 0 d-------- C:\WINDOWS\network diagnostic 2008-08-07 13:27:24 0 d-------- C:\WINDOWS\system32\SoftwareDistribution 2008-08-07 13:24:03 30336 --a------ C:\WINDOWS\system32\drivers\fpd.sys <Not Verified; Politecnico di Torino; NPF Driver> 2008-08-07 13:23:55 1056768 --a------ C:\WINDOWS\system32\ROBOEX32.DLL <Not Verified; Blue Sky Software Corporation.; RoboHELP Classic 2000> 2008-08-07 13:23:55 52214 --a------ C:\WINDOWS\system32\drivers\WrKPoET2000.sys 2008-08-07 13:23:53 0 d-------- C:\Program Files\DialNet 2008-08-07 13:19:47 0 d-------- C:\Program Files\Windows Media Connect 2 2008-08-07 13:19:05 0 d-------- C:\WINDOWS\system32\LogFiles 2008-08-07 13:19:05 0 d-------- C:\WINDOWS\system32\drivers\UMDF 2008-08-07 13:16:21 0 d-------- C:\Program Files\Common Files\Adobe 2008-08-07 13:14:46 364544 -----n--- C:\WINDOWS\system32\TwnLib4.dll <Not Verified; Pegasus Imaging Corp.; TwnLib4> 2008-08-07 13:14:46 106496 --a------ C:\WINDOWS\system32\TwnLib20.dll <Not Verified; Pegasus Software; TWNLIB20> 2008-08-07 13:14:45 155648 --a------ C:\WINDOWS\system32\NeroCheck.exe <Not Verified; Ahead Software Gmbh; Ahead Software Gmbh NeroCheck> 2008-08-07 13:14:45 471040 -----n--- C:\WINDOWS\system32\ImagXRA7.dll <Not Verified; Pegasus Imaging Corp.; ImagXpress7> 2008-08-07 13:14:45 262144 -----n--- C:\WINDOWS\system32\ImagXR7.dll <Not Verified; Pegasus Imaging Corp.; ImagXpress7> 2008-08-07 13:14:45 1568768 -----n--- C:\WINDOWS\system32\ImagX7.dll <Not Verified; Pegasus Imaging Corp.; ImagXpress7> 2008-08-07 13:14:44 0 d-------- C:\Program Files\Common Files\Ahead 2008-08-07 13:14:43 0 d-------- C:\Program Files\Ahead 2008-08-07 13:11:39 0 d-------- C:\Program Files\Java 2008-08-07 13:11:38 0 d-------- C:\Program Files\Common Files\Java 2008-08-07 13:11:00 0 d-------- C:\Program Files\IrfanView 2008-08-07 13:09:14 0 d-------- C:\Program Files\Google 2008-08-07 13:09:04 0 d-------- C:\Program Files\Skype 2008-08-07 13:09:04 0 d-------- C:\Program Files\Common Files\Skype 2008-08-07 13:08:15 0 d-------- C:\Program Files\Gadu-Gadu 2008-08-07 13:04:46 0 d-------- C:\Program Files\Alwil Software 2008-08-07 13:04:21 0 d-------- C:\Program Files\MarBit 2008-08-07 13:02:10 0 d-------- C:\Program Files\My Company Name 2008-08-07 13:01:15 0 d-------- C:\WINDOWS\nview 2008-08-07 12:59:16 0 d-------- C:\Program Files\XP Codec Pack 2008-08-07 12:53:09 0 d-------- C:\WINDOWS\system32\Lang 2008-08-07 12:52:13 49152 -r------- C:\WINDOWS\system32\ChCfg.exe 2008-08-07 12:52:02 0 d-------- C:\WINDOWS\system32\RTCOM 2008-08-07 12:51:44 0 d-------- C:\Program Files\Realtek 2008-08-07 12:51:43 0 d--h----- C:\Program Files\InstallShield Installation Information 2008-08-07 12:51:42 315392 --a------ C:\WINDOWS\HideWin.exe <Not Verified; Realtek Semiconductor Corp.; HD Audio Hide windows program> 2008-08-07 12:51:41 520192 -r------- C:\WINDOWS\RtlExUpd.dll <Not Verified; Realtek Semiconductor Corp.; RtlExUpd Dynamic Link Library> 2008-08-07 12:51:38 0 d-------- C:\Program Files\Common Files\InstallShield 2008-08-07 12:51:18 0 d-------- C:\Program Files\DIFX 2008-08-07 12:51:17 0 d-------- C:\WINDOWS\system32\ReinstallBackups 2008-08-07 12:51:15 0 d------c- C:\WINDOWS\system32\DRVSTORE 2008-08-07 12:50:53 1732 --a------ C:\WINDOWS\system32\drivers\nvphy.bin 2008-08-07 12:48:38 0 d-------- C:\WINDOWS\SoftwareDistribution 2008-08-07 12:48:35 0 d---s---- C:\WINDOWS\system32\Microsoft 2008-08-07 12:46:28 0 d-------- C:\WINDOWS\system32\xircom 2008-08-07 12:46:28 0 d-------- C:\Program Files\microsoft frontpage 2008-08-07 12:46:09 0 -rahs---- C:\MSDOS.SYS 2008-08-07 12:46:09 0 -rahs---- C:\IO.SYS 2008-08-07 12:46:09 0 --a------ C:\CONFIG.SYS 2008-08-07 12:46:09 0 --a------ C:\AUTOEXEC.BAT 2008-08-07 12:45:20 0 dr------- C:\WINDOWS\Offline Web Pages 2008-08-07 12:45:20 0 d---s---- C:\WINDOWS\Downloaded Program Files 2008-08-07 12:45:12 0 d--h----- C:\Program Files\WindowsUpdate 2008-08-07 12:45:10 0 d-------- C:\Program Files\Usługi online 2008-08-07 12:44:59 0 d-------- C:\WINDOWS\system32\DirectX 2008-08-07 12:44:35 0 d---s---- C:\WINDOWS\Tasks 2008-08-07 12:44:34 0 d-------- C:\Program Files\Common Files\MSSoap 2008-08-07 12:44:32 0 d-------- C:\WINDOWS\srchasst 2008-08-07 12:44:31 0 d-------- C:\WINDOWS\system32\Macromed 2008-08-07 12:44:26 0 d-------- C:\Program Files\Movie Maker 2008-08-07 12:44:21 0 d-------- C:\WINDOWS\system32\Restore 2008-08-07 12:43:53 21856 --a------ C:\WINDOWS\system32\emptyregdb.dat 2008-08-07 12:43:40 0 d-------- C:\WINDOWS\Registration 2008-08-07 12:43:30 0 d-------- C:\Program Files\Messenger 2008-08-07 12:43:27 0 d-------- C:\Program Files\MSN Gaming Zone 2008-08-07 12:43:07 0 d-------- C:\Program Files\Windows NT 2008-08-07 12:43:05 0 d-------- C:\WINDOWS\system32\MsDtc 2008-08-07 12:43:04 0 d-------- C:\WINDOWS\system32\Com -- Find3M Report --------------------------------------------------------------- 2008-08-11 23:02:15 26624 --a------ C:\WINDOWS\system32\userinit.exe 2008-08-11 19:12:19 0 d-------- C:\Documents and Settings\darek\Dane aplikacji\Skype 2008-08-11 12:35:49 0 d-------- C:\Documents and Settings\darek\Dane aplikacji\Corel 2008-08-11 10:52:29 0 d-------- C:\Documents and Settings\darek\Dane aplikacji\Nokia 2008-08-11 10:52:27 0 d-------- C:\Documents and Settings\darek\Dane aplikacji\PC Suite 2008-08-08 17:24:20 0 d-------- C:\Documents and Settings\darek\Dane aplikacji\AdobeUM 2008-08-07 23:20:24 0 d-------- C:\Documents and Settings\darek\Dane aplikacji\Media Player Classic 2008-08-07 23:20:12 0 d-------- C:\Documents and Settings\darek\Dane aplikacji\Adobe 2008-08-07 14:39:37 62 --ahs---- C:\Documents and Settings\darek\Dane aplikacji\desktop.ini 2008-08-07 14:28:41 0 d-------- C:\Documents and Settings\darek\Dane aplikacji\WinRAR 2008-08-07 14:05:24 359178 --a------ C:\WINDOWS\system32\perfh015.dat 2008-08-07 14:05:24 50968 --a------ C:\WINDOWS\system32\perfc015.dat 2008-08-07 14:04:30 0 d-------- C:\Documents and Settings\darek\Dane aplikacji\Macromedia 2008-08-07 13:54:03 0 d-------- C:\Documents and Settings\darek\Dane aplikacji\Mozilla 2008-08-07 13:50:59 0 d-------- C:\Documents and Settings\darek\Dane aplikacji\Opera 2008-08-07 13:48:50 0 d-------- C:\Documents and Settings\darek\Dane aplikacji\Gadu-Gadu 2008-08-07 13:42:03 0 d-------- C:\Documents and Settings\darek\Dane aplikacji\Google 2008-08-07 13:11:45 0 d-------- C:\Documents and Settings\darek\Dane aplikacji\Sun 2008-08-07 12:50:48 0 d-------- C:\Documents and Settings\darek\Dane aplikacji\InstallShield 2008-08-07 12:49:19 0 d-------- C:\Documents and Settings\darek\Dane aplikacji\Identities -- Registry Dump --------------------------------------------------------------- *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "RTHDCPL"="RTHDCPL.EXE" [2007-09-03 09:52 C:\WINDOWS\RTHDCPL.exe] "Alcmtr"="ALCMTR.EXE" [2005-05-03 12:43 C:\WINDOWS\Alcmtr.exe] "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2008-04-11 11:33] "nwiz"="nwiz.exe" [2008-04-11 11:33 C:\WINDOWS\system32\nwiz.exe] "NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2008-04-11 11:33] "avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2008-07-19 16:38] "SunJavaUpdateSched"="C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe" [2004-06-03 22:05] "a-winpoet-service"="C:\Program Files\DialNet\winpppoverethernet.exe" [2007-07-06 08:40] "@"="C:\PROGRA~1\DialNet\FPLICE~1.exe" [2007-07-04 16:27] "z-WrDialer"="C:\Program Files\DialNet\wrdialer.exe" [2007-07-11 17:11] "C:\WINDOWS\system32\kdxqf.exe"="C:\WINDOWS\system32\kdxqf.exe" [2008-04-14 22:51] "MSConfig"="C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe" [2008-04-14 22:51] "KernelFaultCheck"="C:\WINDOWS\system32\dumprep 0 -k" [] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2008-04-14 22:51] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system] "NoDispBackgroundPage"=1 (0x1) "NoDispScrSavPage"=1 (0x1) "DisableRegistryTools"=0 (0x0) [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon] "System"="kdxqf.exe" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\PSEXESVC] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\vds] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{533C5B84-EC70-11D2-9505-00C04F79DEAF}] @="Volume shadow copy" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Adobe Reader Speed Launch.lnk] path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Adobe Reader Speed Launch.lnk backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] eapsvcs eaphost dot3svc dot3svc HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs napagent hkmsvc -- End of Deckard's System Scanner: finished at 2008-08-12 13:03:57 ------------

Kto jest na forum