"wykryto poteencjalną infekcję"

**Posty:** 140 · przez **Jaramaniak** 09 Lut 2008, 15:47

mam pytanie.

od pewnego czasu co chwile pojawia mi sie komunikat programu avast

"Zbyt dużo identycznych wiadomości w wyznaczonym czasie

Nadawca: "giacomo Gottesman" <giacomo-rrebbero@able-pc.com>
Odbiorca: baloghrita@vivamail.hu
Temat: Enhance your stature with this brand new medical breakthrough"

i tak parenascie razy... albo wbija mi sie automatycznie na strone windows live.

nie wiem o co w tym chodzi, moze wiecie cos na ten temat?

**Posty:** 7838 · przez **Lukesh** 09 Lut 2008, 15:52

Zastosuj sie do wskazowek z tematu: http://forum.programosy.pl/bad-generic-host-process-for-win32-services-vt79489.html
:arrow:

Zrob skan on-line www.ewido.com
:arrow:

Pokaz log z ComboFix: http://www.programosy.pl/program,combofix.html
:arrow:

Zastosuj SDFix . Po pobraniu uruchom go a rozpakuje się do C:\SDFix. Uruchom komputer w trybie awaryjnym (F8 przy stracie systemu). Będąc w awaryjnym uruchom plik RunThis.bat z folderu SDFixa. Zatwierdź czyszczenie przez Y. Poczekaj aż ukończy i komputer zresetuje

zastosuj:
SDFix

Potem wejdz do folderu C:\SDFix wrzuc zawartość pliku Report.txt

:arrow:

na sam koniec wstaw CALE logi wg opisu: http://forum.programosy.pl/hijackthis-amp-silent-runners-gtobsuga-i-umieszczanie-vt9452.html

Pamietaj o wstawieniu logow w tagi

**Posty:** 140 · przez **Jaramaniak** 09 Lut 2008, 15:58

nie rozumiem z tymi log'ami... mogę popróbować ale pisze na forum że jak się na tym nie znam to lepiej nie próbwać bo mogę cos spieprzyć.

[ Dodano: Dzisiaj o 15:39 ]
teraz wyskoczył mi błąd systemu windows i pisze że musi on zostać zrestartowany żeby nie uszkodzić komputera i było zrzucanie pamięci fizycznej na kompa. to nie pierwszy raz.

**Posty:** 3854 · przez **Dzi@dek** 09 Lut 2008, 17:04

Jaramaniak napisał(a):że jak się na tym nie znam to lepiej nie próbwać

Nie dotyczy to osób którzy wstawiają logi.
Daj i nie bój się.

**Posty:** 140 · przez **Jaramaniak** 09 Lut 2008, 17:07

ok ale przez jaki program? bo ten comboFix cos mi nie wlacza sie...

**Posty:** 3854 · przez **Dzi@dek** 09 Lut 2008, 17:10

http://forum.programosy.pl/hijackthis-amp-silent-runners-gtobsuga-i-umieszczanie-vt9452.html
hijackthis

**Posty:** 140 · przez **Jaramaniak** 09 Lut 2008, 17:24

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 16:23:48, on 2008-02-09 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\SOUNDMAN.EXE C:\Program Files\ATI Technologies\ATI.ACE\cli.exe C:\WINDOWS\VM305_STI.EXE C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\Program Files\cFosSpeed\cFosSpeed.exe C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\AutoConnect\AutoConnect.exe C:\Program Files\cFosSpeed\spd.exe C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe C:\WINDOWS\system32\cisvc.exe C:\Program Files\Common Files\LightScribe\LSSrvc.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\PROGRA~1\MOZILL~1\FIREFOX.EXE C:\WINDOWS\system32\wuauclt.exe C:\WINDOWS\system32\cidaemon.exe C:\Documents and Settings\Miki\Pulpit\HiJackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.bearshare.com/pl R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Neostrada TP R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\NEOSTR~1\SEARCH~1.DLL R3 - URLSearchHook: (no name) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file) O3 - Toolbar: (no name) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - (no file) O3 - Toolbar: My Global Search Bar - {37B85A29-692B-4205-9CAD-2626E4993404} - C:\Program Files\MyGlobalSearch\bar\3.bin\MGSBAR.DLL O3 - Toolbar: (no name) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file) O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime O4 - HKLM\..\Run: [BigDog305] C:\WINDOWS\VM305_STI.EXE VIMICRO USB PC Camera (ZC0305) O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [cFosSpeed] C:\Program Files\cFosSpeed\cFosSpeed.exe O4 - HKLM\..\Run: [adiras] adiras.exe O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\Program Files\NOKIA\Nokia PC Suite 6\LaunchApplication.exe -startup O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [AutoConnect] C:\Program Files\AutoConnect\AutoConnect.exe O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe (User 'Default user') O4 - Startup: Tworzenie wycinków ekranu i uruchamianie programu OneNote 2007.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE O4 - Global Startup: ATI CATALYST – pasek zadań.lnk = C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe O8 - Extra context menu item: &Ściągnij przy pomocy FlashGet'a - C:\Program Files\FlashGet\jc_link.htm O8 - Extra context menu item: &Ściągnij wszystko przy pomocy FlashGet'a - C:\Program Files\FlashGet\jc_all.htm O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O8 - Extra context menu item: E&ksportuj do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000 O9 - Extra button: Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll O9 - Extra button: Wyślij do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra 'Tools' menuitem: Wyślij &do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} - C:\Program Files\Yahoo!\Common\yinsthelper.dll O16 - DPF: {CAFEEFAC-0014-0000-0003-ABCDEFFEDCBA} (Java Runtime Environment 1.4.0_03) - O17 - HKLM\System\CCS\Services\Tcpip\..\{6B8FB721-98CD-4524-89AA-6A3DB549ECF7}: NameServer = 194.204.159.1 217.98.63.164 O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe O23 - Service: cFosSpeed System Service (cFosSpeedS) - cFos Software GmbH - C:\Program Files\cFosSpeed\spd.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe O23 - Service: iPod Service - Unknown owner - C:\Program Files\iPod\bin\iPodService.exe (file missing) O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe O23 - Service: PACSPTISVR - Unknown owner - C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe -- End of file - 8276 bytes

**Posty:** 3854 · przez **Dzi@dek** 09 Lut 2008, 17:31

Odpal hijack - scan - zaznacz V przy tych wpisach i klikij Fix Checked:

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.bearshare.com/pl
R3 - URLSearchHook: (no name) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O3 - Toolbar: (no name) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - (no file)
O3 - Toolbar: My Global Search Bar - {37B85A29-692B-4205-9CAD-2626E4993404} - C:\Program Files\MyGlobalSearch\bar\3.bin\MGSBAR.DLL
O3 - Toolbar: (no name) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)

Pogrubiony folder usuń ręcznie z dysku.

Spróbuj z tym combofix-em dać loga.

**Posty:** 140 · przez **Jaramaniak** 09 Lut 2008, 17:38

tego folderu recznie sie nie da usunąć.

a program combofix nie odpala. ulamek sekundy pojawia sie niebieskie okno w ktorym zauwazylem "nie mozna..." i dalej nic bo za szybko sie zamyka.

**Posty:** 3854 · przez **Dzi@dek** 09 Lut 2008, 17:41

Wyłącz internet i antywirusa i spróbuj z combo.

Uruchom komputer w trybie awaryjnym i usuń ten folder.
Daj nowy log z hijackthis

**Posty:** 140 · przez **Jaramaniak** 09 Lut 2008, 18:10

jeszcze pojawiły mi się jakieś dziwne foldery...

i strasznie mi net zmula...

**Posty:** 3854 · przez **Dzi@dek** 09 Lut 2008, 18:15

Zrób to o co prosiłem.

**Posty:** 140 · przez **Jaramaniak** 09 Lut 2008, 18:38

zrobiłem to co kazałeś, poza comboFixem, bo ten dalej mi nie odpala...

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 17:36:06, on 2008-02-09 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\SOUNDMAN.EXE C:\Program Files\ATI Technologies\ATI.ACE\cli.exe C:\WINDOWS\VM305_STI.EXE C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\AutoConnect\AutoConnect.exe C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe C:\WINDOWS\system32\cisvc.exe C:\Program Files\Common Files\LightScribe\LSSrvc.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\PROGRA~1\MOZILL~1\FIREFOX.EXE C:\WINDOWS\system32\wuauclt.exe C:\WINDOWS\system32\wuauclt.exe C:\Documents and Settings\Miki\Pulpit\HiJackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Neostrada TP R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\NEOSTR~1\SEARCH~1.DLL O3 - Toolbar: (no name) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file) O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime O4 - HKLM\..\Run: [BigDog305] C:\WINDOWS\VM305_STI.EXE VIMICRO USB PC Camera (ZC0305) O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [adiras] adiras.exe O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\Program Files\NOKIA\Nokia PC Suite 6\LaunchApplication.exe -startup O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [AutoConnect] C:\Program Files\AutoConnect\AutoConnect.exe O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe (User 'Default user') O4 - Startup: Tworzenie wycinków ekranu i uruchamianie programu OneNote 2007.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE O4 - Global Startup: ATI CATALYST – pasek zadań.lnk = C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe O8 - Extra context menu item: &Ściągnij przy pomocy FlashGet'a - C:\Program Files\FlashGet\jc_link.htm O8 - Extra context menu item: &Ściągnij wszystko przy pomocy FlashGet'a - C:\Program Files\FlashGet\jc_all.htm O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O8 - Extra context menu item: E&ksportuj do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000 O9 - Extra button: Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll O9 - Extra button: Wyślij do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra 'Tools' menuitem: Wyślij &do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} - C:\Program Files\Yahoo!\Common\yinsthelper.dll O16 - DPF: {CAFEEFAC-0014-0000-0003-ABCDEFFEDCBA} (Java Runtime Environment 1.4.0_03) - O17 - HKLM\System\CCS\Services\Tcpip\..\{6B8FB721-98CD-4524-89AA-6A3DB549ECF7}: NameServer = 194.204.159.1 217.98.63.164 O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe O23 - Service: iPod Service - Unknown owner - C:\Program Files\iPod\bin\iPodService.exe (file missing) O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe O23 - Service: PACSPTISVR - Unknown owner - C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe -- End of file - 7622 bytes

[ Dodano: Dzisiaj o 17:40 ]
albo np przekierowywuje mnie dalej na jakieś strony, np.

http://85.12.43.71/go/?cmp=vm_mg_other&nid=md&uid=c81cbe18d59f11dcb7b8f67608deffff&rid=kkii22&guid=b3ee5c31ffac477393872c30f9d85b8a&affid=67608&lid=&url=

**Posty:** 18165 · przez **wojtas** 09 Lut 2008, 18:51

daj loga z dss'a

**Posty:** 140 · przez **Jaramaniak** 09 Lut 2008, 18:57

Kod: Zaznacz wszystko: Deckard's System Scanner v20071014.68 Run by Miki on 2008-02-09 17:53:44 Computer is in Normal Mode. -------------------------------------------------------------------------------- -- System Restore -------------------------------------------------------------- Successfully created a Deckard's System Scanner Restore Point. -- Last 5 Restore Point(s) -- 21: 2008-02-09 16:53:56 UTC - RP131 - Deckard's System Scanner Restore Point 20: 2008-02-09 16:16:18 UTC - RP130 - restore point availability check 19: 2008-02-09 16:07:57 UTC - RP129 - restore point availability check 18: 2008-02-09 13:38:22 UTC - RP128 - Software Distribution Service 3.0 17: 2008-02-07 21:11:49 UTC - RP127 - Software Distribution Service 3.0 -- First Restore Point -- 1: 2008-02-07 17:12:20 UTC - RP111 - Software Distribution Service 3.0 Backed up registry hives. Performed disk cleanup. [color=red]Percentage of Memory in Use: 76% (more than 75%).[/color] [color=red]System Drive C: has 0.47 GiB (less than 15%) free.[/color] -- HijackThis (run as Miki.exe) ------------------------------------------------ Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 17:55:05, on 2008-02-09 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\SOUNDMAN.EXE C:\Program Files\ATI Technologies\ATI.ACE\cli.exe C:\WINDOWS\VM305_STI.EXE C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\AutoConnect\AutoConnect.exe C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe C:\WINDOWS\system32\cisvc.exe C:\Program Files\Common Files\LightScribe\LSSrvc.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\PROGRA~1\MOZILL~1\FIREFOX.EXE C:\WINDOWS\system32\wuauclt.exe C:\WINDOWS\system32\cidaemon.exe C:\Program Files\FlashGet\flashget.exe C:\Documents and Settings\Miki\Pulpit\dss.exe C:\DOCUME~1\Miki\Pulpit\Miki.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Neostrada TP R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\NEOSTR~1\SEARCH~1.DLL O2 - BHO: (no name) - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - (no file) O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: flashget urlcatch - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\Program Files\FlashGet\jccatch.dll O2 - BHO: My Global Search Bar BHO - {37B85A21-692B-4205-9CAD-2626E4993404} - C:\Program Files\MyGlobalSearch\bar\3.bin\MGSBAR.DLL (file missing) O2 - BHO: (no name) - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - (no file) O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll O2 - BHO: (no name) - {935F4CF7-D3F5-4814-A9B7-87D89D178049} - C:\WINDOWS\system32\ssqpo.dll O2 - BHO: (no name) - {A00CA75C-DEDD-4474-9088-5D6363D69338} - C:\WINDOWS\system32\rqrqopo.dll O2 - BHO: e404 helper - {F10587E9-0E47-4CBE-ABCD-7DD20B8622FF} - C:\Program Files\Helper\1202404148.dll O2 - BHO: FlashGet GetFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\Program Files\FlashGet\getflash.dll O3 - Toolbar: (no name) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file) O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime O4 - HKLM\..\Run: [BigDog305] C:\WINDOWS\VM305_STI.EXE VIMICRO USB PC Camera (ZC0305) O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [adiras] adiras.exe O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\Program Files\NOKIA\Nokia PC Suite 6\LaunchApplication.exe -startup O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [AutoConnect] C:\Program Files\AutoConnect\AutoConnect.exe O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe (User 'Default user') O4 - Startup: Tworzenie wycinków ekranu i uruchamianie programu OneNote 2007.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE O4 - Global Startup: ATI CATALYST – pasek zadań.lnk = C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe O8 - Extra context menu item: &Ściągnij przy pomocy FlashGet'a - C:\Program Files\FlashGet\jc_link.htm O8 - Extra context menu item: &Ściągnij wszystko przy pomocy FlashGet'a - C:\Program Files\FlashGet\jc_all.htm O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O8 - Extra context menu item: E&ksportuj do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000 O9 - Extra button: Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll O9 - Extra button: Wyślij do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra 'Tools' menuitem: Wyślij &do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} - C:\Program Files\Yahoo!\Common\yinsthelper.dll O16 - DPF: {CAFEEFAC-0014-0000-0003-ABCDEFFEDCBA} (Java Runtime Environment 1.4.0_03) - O17 - HKLM\System\CCS\Services\Tcpip\..\{6B8FB721-98CD-4524-89AA-6A3DB549ECF7}: NameServer = 194.204.159.1 217.98.63.164 O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O20 - Winlogon Notify: rqrqopo - C:\WINDOWS\SYSTEM32\rqrqopo.dll O20 - Winlogon Notify: winrkp32 - C:\WINDOWS\SYSTEM32\winrkp32.dll O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe O23 - Service: iPod Service - Unknown owner - C:\Program Files\iPod\bin\iPodService.exe (file missing) O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe O23 - Service: PACSPTISVR - Unknown owner - C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe -- End of file - 9058 bytes -- HijackThis Fixed Entries (C:\DOCUME~1\Miki\Pulpit\backups\) ----------------- backup-20080209-163636-274 O3 - Toolbar: My Global Search Bar - {37B85A29-692B-4205-9CAD-2626E4993404} - C:\Program Files\MyGlobalSearch\bar\3.bin\MGSBAR.DLL backup-20080209-163636-284 R3 - URLSearchHook: (no name) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file) backup-20080209-163636-367 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.bearshare.com/pl backup-20080209-163636-459 O3 - Toolbar: (no name) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - (no file) -- File Associations ----------------------------------------------------------- [COLOR=red].bat - batfile - DefaultIcon - C:\WINDOWS\System32\shell32.dll,-153[/COLOR] [COLOR=red].cpl - cplfile - shell\cplopen\command - rundll32.exe shell32.dll,Control_RunDLL "%1",%*[/COLOR] [COLOR=red].cpl - cplfile - shell\runas\command - rundll32.exe shell32.dll,Control_RunDLLAsUser "%1",%*[/COLOR] [COLOR=red].hlp - hlpfile - DefaultIcon - C:\WINDOWS\hh.exe,0[/COLOR] [COLOR=red].inf - inffile - DefaultIcon - C:\WINDOWS\System32\shell32.dll,-151[/COLOR] [COLOR=red].ini - inifile - DefaultIcon - C:\WINDOWS\System32\shell32.dll,-151[/COLOR] [COLOR=red].reg - regfile - DefaultIcon - C:\WINDOWS\regedit.exe,1[/COLOR] [COLOR=red].reg - regfile - shell\open\command - "regedit.exe" "%1"[/COLOR] [COLOR=red].txt - txtfile - DefaultIcon - C:\WINDOWS\system32\shell32.dll,-152[/COLOR] -- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------- R0 sfdrv01 (StarForce Protection Environment Driver (version 1.x)) - c:\windows\system32\drivers\sfdrv01.sys <Not Verified; Protection Technology; StarForce Protection System> R0 sfhlp02 (StarForce Protection Helper Driver (version 2.x)) - c:\windows\system32\drivers\sfhlp02.sys <Not Verified; Protection Technology; StarForce Protection System> R0 vax347b - c:\windows\system32\drivers\vax347b.sys R0 vax347s - c:\windows\system32\drivers\vax347s.sys S3 dtscsi - c:\windows\system32\drivers\dtscsi.sys (file missing) -- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled -------------------- S3 iPod Service - "c:\program files\ipod\bin\ipodservice.exe" (file missing) S3 PACSPTISVR - "c:\program files\common files\sony shared\avlib\pacsptisvr.exe" <Not Verified; ; PACSPTISVR Module> S3 ServiceLayer - "c:\program files\pc connectivity solution\servicelayer.exe" <Not Verified; Nokia.; PC Connectivity Solution> -- Device Manager: Disabled ---------------------------------------------------- Class GUID: {4D36E96C-E325-11CE-BFC1-08002BE10318} Description: Crystal WDM MPU-401 Compatible Device ID: ROOT\MEDIA\0000 Manufacturer: Crystal Semiconductor Name: Crystal WDM MPU-401 Compatible PNP Device ID: ROOT\MEDIA\0000 Service: cwbmidi_device Class GUID: {EEC5AD98-8080-425F-922A-DABF3DE3F69A} Description: Nokia Windows Portable Device Driver Device ID: ROOT\WPD\0000 Manufacturer: Nokia Name: Nokia 6300 PNP Device ID: ROOT\WPD\0000 Service: WUDFRd -- Scheduled Tasks ------------------------------------------------------------- 2007-09-22 12:59:48 284 --a------ C:\WINDOWS\Tasks\AppleSoftwareUpdate.job -- Files created between 2008-01-09 and 2008-02-09 ----------------------------- 2008-02-09 15:02:04 3508 --a------ C:\Start_.cmd 2008-02-09 15:02:01 0 d-------- C:\327882R2FWJFW 2008-02-08 18:48:35 0 d-------- C:\Odkurzacz 2008-02-07 20:15:06 0 d-------- C:\Program Files\Hamachi 2008-02-07 18:12:10 257551 --ahs---- C:\WINDOWS\system32\opqss.ini2 2008-02-07 18:11:59 331264 --a------ C:\WINDOWS\system32\ssqpo.dll 2008-02-07 18:08:11 2 --a------ C:\1948880548 2008-02-07 18:07:18 54764 --a------ C:\WINDOWS\system32\4fdw.dll 2008-02-07 18:07:14 0 d-------- C:\Program Files\Helper 2008-02-07 18:07:14 37446 --a------ C:\hljsdsm.exe 2008-02-07 18:07:10 58368 --a------ C:\xjoukm.exe 2008-02-07 18:06:50 41472 --a------ C:\WINDOWS\system32\rqrqopo.dll 2008-02-07 18:06:30 23552 --a------ C:\WINDOWS\system32\winrkp32.dll 2008-02-02 11:30:29 0 d-------- C:\Program Files\Microsoft Works 2008-02-02 11:30:08 0 d-------- C:\Program Files\MSBuild 2008-02-02 11:27:14 0 d-------- C:\Program Files\Microsoft.NET 2008-02-02 11:21:07 0 d-------- C:\WINDOWS\SHELLNEW 2008-02-02 11:19:25 0 dr-h----- C:\MSOCache 2008-02-02 09:11:44 0 d--h----- C:\WINDOWS\$hf_mig$ 2008-02-01 22:55:04 0 d-------- C:\Program Files\VSD Software 2008-01-27 15:05:11 0 d-------- C:\Program Files\Common Files\Sony Ericsson Shared 2008-01-27 15:03:28 0 d-------- C:\WINDOWS\Downloaded Installations 2008-01-19 14:33:03 0 d-------- C:\Program Files\AdVantage 2008-01-19 14:22:03 0 d-------- C:\Program Files\DAEMON Tools 2008-01-15 20:01:35 98304 --a------ C:\WINDOWS\system32\IStestDLL.dll <Not Verified; ; IStestDLL Dynamic Link Library> 2008-01-15 20:00:22 28672 --a------ C:\WINDOWS\system32\ISkeyObject.dll <Not Verified; ; ISkeyObject Dynamic Link Library> 2008-01-15 20:00:20 0 d-------- C:\Program Files\Octatec 2008-01-12 12:55:35 0 d-------- C:\Program Files\YouTube Video Downloader 2008-01-10 21:52:23 0 d-------- C:\Program Files\FLV to AVI MPEG WMV 3GP MP4 iPod Converter -- Find3M Report --------------------------------------------------------------- 2008-02-09 17:53:32 0 d-------- C:\Program Files\FlashGet 2008-02-09 17:33:27 0 d-------- C:\Program Files\AutoConnect 2008-02-08 17:11:03 0 d-------- C:\Program Files\Neostrada TP 2008-02-07 20:26:54 0 d-------- C:\Documents and Settings\Miki\Dane aplikacji\Hamachi 2008-02-02 11:29:10 0 d-------- C:\Program Files\Common Files 2008-02-02 11:05:38 0 d-------- C:\Documents and Settings\Miki\Dane aplikacji\uTorrent 2008-02-02 11:02:12 0 d--h----- C:\Program Files\InstallShield Installation Information 2008-02-02 09:08:58 0 d-------- C:\Documents and Settings\Miki\Dane aplikacji\ATI 2008-01-31 18:57:52 0 d-------- C:\Documents and Settings\Miki\Dane aplikacji\Tibia 2008-01-27 15:06:37 0 d-------- C:\Program Files\Common Files\Teleca Shared 2008-01-19 14:53:21 0 d-------- C:\Documents and Settings\Miki\Dane aplikacji\Sports Interactive 2008-01-19 14:22:04 0 d-------- C:\Documents and Settings\Miki\Dane aplikacji\DAEMON Tools 2008-01-16 10:01:25 0 d-------- C:\Documents and Settings\Miki\Dane aplikacji\Adobe 2008-01-12 15:53:02 0 d-------- C:\Documents and Settings\Miki\Dane aplikacji\GanymedeNet 2008-01-12 14:27:21 0 d-------- C:\Program Files\Gadu-Gadu 2008-01-12 11:55:14 0 d-------- C:\Documents and Settings\Miki\Dane aplikacji\Nokia 2008-01-11 20:42:30 0 d-------- C:\Program Files\Ganymede 2008-01-08 19:14:34 436322 --a------ C:\WINDOWS\system32\perfh015.dat 2008-01-08 19:14:34 67298 --a------ C:\WINDOWS\system32\perfc015.dat 2008-01-06 13:25:34 0 d-------- C:\Program Files\VstPlugins 2008-01-06 13:18:38 0 d-------- C:\Program Files\ASIO4ALL v2 2008-01-05 19:26:02 4382 --a----c- C:\WINDOWS\mozver.dat 2008-01-01 14:34:59 168 --a------ C:\WINDOWS\system32\proc1395793746.bin 2007-12-30 17:35:47 0 d-------- C:\Program Files\YourWare Solutions 2007-12-29 19:10:20 23640 --a----c- C:\WINDOWS\system32\emptyregdb.dat 2007-12-29 17:49:08 0 d-------- C:\Program Files\ATI Technologies 2007-12-25 13:09:53 0 d-------- C:\Program Files\uTorrent 2007-12-23 13:14:24 21840 --a-----t C:\WINDOWS\system32\SIntfNT.dll 2007-12-23 13:14:24 17212 --a-----t C:\WINDOWS\system32\SIntf32.dll 2007-12-23 13:14:24 12067 --a-----t C:\WINDOWS\system32\SIntf16.dll 2007-12-21 21:07:43 0 d-------- C:\Program Files\CCleaner 2007-12-21 21:07:43 0 d-------- C:\Program Files\7-Zip 2007-12-15 11:58:40 0 d-------- C:\Program Files\No-IP 2007-12-13 19:52:12 0 d-------- C:\Program Files\Java 2007-12-13 19:49:12 0 d-------- C:\Program Files\Common Files\Java 2007-12-11 19:48:28 0 d-------- C:\Program Files\Winamp 2007-12-11 19:48:28 0 d-------- C:\Program Files\QuickTime 2007-12-11 19:48:28 0 d-------- C:\Program Files\IrfanView 2007-12-11 09:21:48 0 d-------- C:\Documents and Settings\Miki\Dane aplikacji\Skype -- Registry Dump --------------------------------------------------------------- *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{935F4CF7-D3F5-4814-A9B7-87D89D178049}] 2008-02-07 18:12 331264 --a------ C:\WINDOWS\system32\ssqpo.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A00CA75C-DEDD-4474-9088-5D6363D69338}] 2008-02-07 18:06 41472 --a------ C:\WINDOWS\system32\rqrqopo.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{F10587E9-0E47-4CBE-ABCD-7DD20B8622FF}] 2008-02-07 18:09 12800 --a------ C:\Program Files\Helper\1202404148.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SoundMan"="SOUNDMAN.EXE" [2006-01-11 15:08 C:\WINDOWS\soundman.exe] "ATICCC"="C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" [2005-08-06 01:07] "BigDog305"="C:\WINDOWS\VM305_STI.exe" [2005-08-05 08:15] "TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2007-06-09 20:28] "adiras"="adiras.exe" [] "GrooveMonitor"="C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [2007-08-24 07:00] "PCSuiteTrayApplication"="C:\Program Files\NOKIA\Nokia PC Suite 6\LaunchApplication.exe" [2007-03-23 13:20] "avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-12-04 14:00] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2006-03-02 13:00] "AutoConnect"="C:\Program Files\AutoConnect\AutoConnect.exe" [2004-08-28 19:27] [HKEY_USERS\.default\software\microsoft\windows\currentversion\run] "Nokia.PCSync"=C:\Program Files\NOKIA\Nokia PC Suite 6\PcSync2.exe /NoDialog -- Hosts ----------------------------------------------------------------------- 127.0.0.1 abcsearch.com 127.0.0.1 admin.abcsearch.com 127.0.0.1 www3.abcsearch.com #[Browseraid] 127.0.0.1 www.abcsearch.com 127.0.0.1 abc517.net #[Trojan.Mitglieder.H] 127.0.0.1 acestats.com 127.0.0.1 www.acestats.com 127.0.0.1 actualnames.com #[Parasite.ActualNames] 127.0.0.1 www.actualnames.com 127.0.0.1 ad-up.com 4685 more entries in hosts file. -- End of Deckard's System Scanner: finished at 2008-02-09 17:56:28 ------------

[ Dodano: Dzisiaj o 17:58 ]

Kod: Zaznacz wszystko: Deckard's System Scanner v20071014.68 Run by Miki on 2008-02-09 17:53:44 Computer is in Normal Mode. -------------------------------------------------------------------------------- -- System Restore -------------------------------------------------------------- Successfully created a Deckard's System Scanner Restore Point. -- Last 5 Restore Point(s) -- 21: 2008-02-09 16:53:56 UTC - RP131 - Deckard's System Scanner Restore Point 20: 2008-02-09 16:16:18 UTC - RP130 - restore point availability check 19: 2008-02-09 16:07:57 UTC - RP129 - restore point availability check 18: 2008-02-09 13:38:22 UTC - RP128 - Software Distribution Service 3.0 17: 2008-02-07 21:11:49 UTC - RP127 - Software Distribution Service 3.0 -- First Restore Point -- 1: 2008-02-07 17:12:20 UTC - RP111 - Software Distribution Service 3.0 Backed up registry hives. Performed disk cleanup. [color=red]Percentage of Memory in Use: 76% (more than 75%).[/color] [color=red]System Drive C: has 0.47 GiB (less than 15%) free.[/color] -- HijackThis (run as Miki.exe) ------------------------------------------------ Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 17:55:05, on 2008-02-09 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\SOUNDMAN.EXE C:\Program Files\ATI Technologies\ATI.ACE\cli.exe C:\WINDOWS\VM305_STI.EXE C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\AutoConnect\AutoConnect.exe C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe C:\WINDOWS\system32\cisvc.exe C:\Program Files\Common Files\LightScribe\LSSrvc.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\PROGRA~1\MOZILL~1\FIREFOX.EXE C:\WINDOWS\system32\wuauclt.exe C:\WINDOWS\system32\cidaemon.exe C:\Program Files\FlashGet\flashget.exe C:\Documents and Settings\Miki\Pulpit\dss.exe C:\DOCUME~1\Miki\Pulpit\Miki.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Neostrada TP R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\NEOSTR~1\SEARCH~1.DLL O2 - BHO: (no name) - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - (no file) O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: flashget urlcatch - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\Program Files\FlashGet\jccatch.dll O2 - BHO: My Global Search Bar BHO - {37B85A21-692B-4205-9CAD-2626E4993404} - C:\Program Files\MyGlobalSearch\bar\3.bin\MGSBAR.DLL (file missing) O2 - BHO: (no name) - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - (no file) O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll O2 - BHO: (no name) - {935F4CF7-D3F5-4814-A9B7-87D89D178049} - C:\WINDOWS\system32\ssqpo.dll O2 - BHO: (no name) - {A00CA75C-DEDD-4474-9088-5D6363D69338} - C:\WINDOWS\system32\rqrqopo.dll O2 - BHO: e404 helper - {F10587E9-0E47-4CBE-ABCD-7DD20B8622FF} - C:\Program Files\Helper\1202404148.dll O2 - BHO: FlashGet GetFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\Program Files\FlashGet\getflash.dll O3 - Toolbar: (no name) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file) O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime O4 - HKLM\..\Run: [BigDog305] C:\WINDOWS\VM305_STI.EXE VIMICRO USB PC Camera (ZC0305) O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [adiras] adiras.exe O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\Program Files\NOKIA\Nokia PC Suite 6\LaunchApplication.exe -startup O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [AutoConnect] C:\Program Files\AutoConnect\AutoConnect.exe O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe (User 'Default user') O4 - Startup: Tworzenie wycinków ekranu i uruchamianie programu OneNote 2007.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE O4 - Global Startup: ATI CATALYST – pasek zadań.lnk = C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe O8 - Extra context menu item: &Ściągnij przy pomocy FlashGet'a - C:\Program Files\FlashGet\jc_link.htm O8 - Extra context menu item: &Ściągnij wszystko przy pomocy FlashGet'a - C:\Program Files\FlashGet\jc_all.htm O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O8 - Extra context menu item: E&ksportuj do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000 O9 - Extra button: Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll O9 - Extra button: Wyślij do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra 'Tools' menuitem: Wyślij &do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} - C:\Program Files\Yahoo!\Common\yinsthelper.dll O16 - DPF: {CAFEEFAC-0014-0000-0003-ABCDEFFEDCBA} (Java Runtime Environment 1.4.0_03) - O17 - HKLM\System\CCS\Services\Tcpip\..\{6B8FB721-98CD-4524-89AA-6A3DB549ECF7}: NameServer = 194.204.159.1 217.98.63.164 O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O20 - Winlogon Notify: rqrqopo - C:\WINDOWS\SYSTEM32\rqrqopo.dll O20 - Winlogon Notify: winrkp32 - C:\WINDOWS\SYSTEM32\winrkp32.dll O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe O23 - Service: iPod Service - Unknown owner - C:\Program Files\iPod\bin\iPodService.exe (file missing) O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe O23 - Service: PACSPTISVR - Unknown owner - C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe -- End of file - 9058 bytes -- HijackThis Fixed Entries (C:\DOCUME~1\Miki\Pulpit\backups\) ----------------- backup-20080209-163636-274 O3 - Toolbar: My Global Search Bar - {37B85A29-692B-4205-9CAD-2626E4993404} - C:\Program Files\MyGlobalSearch\bar\3.bin\MGSBAR.DLL backup-20080209-163636-284 R3 - URLSearchHook: (no name) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file) backup-20080209-163636-367 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.bearshare.com/pl backup-20080209-163636-459 O3 - Toolbar: (no name) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - (no file) -- File Associations ----------------------------------------------------------- [COLOR=red].bat - batfile - DefaultIcon - C:\WINDOWS\System32\shell32.dll,-153[/COLOR] [COLOR=red].cpl - cplfile - shell\cplopen\command - rundll32.exe shell32.dll,Control_RunDLL "%1",%*[/COLOR] [COLOR=red].cpl - cplfile - shell\runas\command - rundll32.exe shell32.dll,Control_RunDLLAsUser "%1",%*[/COLOR] [COLOR=red].hlp - hlpfile - DefaultIcon - C:\WINDOWS\hh.exe,0[/COLOR] [COLOR=red].inf - inffile - DefaultIcon - C:\WINDOWS\System32\shell32.dll,-151[/COLOR] [COLOR=red].ini - inifile - DefaultIcon - C:\WINDOWS\System32\shell32.dll,-151[/COLOR] [COLOR=red].reg - regfile - DefaultIcon - C:\WINDOWS\regedit.exe,1[/COLOR] [COLOR=red].reg - regfile - shell\open\command - "regedit.exe" "%1"[/COLOR] [COLOR=red].txt - txtfile - DefaultIcon - C:\WINDOWS\system32\shell32.dll,-152[/COLOR] -- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------- R0 sfdrv01 (StarForce Protection Environment Driver (version 1.x)) - c:\windows\system32\drivers\sfdrv01.sys <Not Verified; Protection Technology; StarForce Protection System> R0 sfhlp02 (StarForce Protection Helper Driver (version 2.x)) - c:\windows\system32\drivers\sfhlp02.sys <Not Verified; Protection Technology; StarForce Protection System> R0 vax347b - c:\windows\system32\drivers\vax347b.sys R0 vax347s - c:\windows\system32\drivers\vax347s.sys S3 dtscsi - c:\windows\system32\drivers\dtscsi.sys (file missing) -- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled -------------------- S3 iPod Service - "c:\program files\ipod\bin\ipodservice.exe" (file missing) S3 PACSPTISVR - "c:\program files\common files\sony shared\avlib\pacsptisvr.exe" <Not Verified; ; PACSPTISVR Module> S3 ServiceLayer - "c:\program files\pc connectivity solution\servicelayer.exe" <Not Verified; Nokia.; PC Connectivity Solution> -- Device Manager: Disabled ---------------------------------------------------- Class GUID: {4D36E96C-E325-11CE-BFC1-08002BE10318} Description: Crystal WDM MPU-401 Compatible Device ID: ROOT\MEDIA\0000 Manufacturer: Crystal Semiconductor Name: Crystal WDM MPU-401 Compatible PNP Device ID: ROOT\MEDIA\0000 Service: cwbmidi_device Class GUID: {EEC5AD98-8080-425F-922A-DABF3DE3F69A} Description: Nokia Windows Portable Device Driver Device ID: ROOT\WPD\0000 Manufacturer: Nokia Name: Nokia 6300 PNP Device ID: ROOT\WPD\0000 Service: WUDFRd -- Scheduled Tasks ------------------------------------------------------------- 2007-09-22 12:59:48 284 --a------ C:\WINDOWS\Tasks\AppleSoftwareUpdate.job -- Files created between 2008-01-09 and 2008-02-09 ----------------------------- 2008-02-09 15:02:04 3508 --a------ C:\Start_.cmd 2008-02-09 15:02:01 0 d-------- C:\327882R2FWJFW 2008-02-08 18:48:35 0 d-------- C:\Odkurzacz 2008-02-07 20:15:06 0 d-------- C:\Program Files\Hamachi 2008-02-07 18:12:10 257551 --ahs---- C:\WINDOWS\system32\opqss.ini2 2008-02-07 18:11:59 331264 --a------ C:\WINDOWS\system32\ssqpo.dll 2008-02-07 18:08:11 2 --a------ C:\1948880548 2008-02-07 18:07:18 54764 --a------ C:\WINDOWS\system32\4fdw.dll 2008-02-07 18:07:14 0 d-------- C:\Program Files\Helper 2008-02-07 18:07:14 37446 --a------ C:\hljsdsm.exe 2008-02-07 18:07:10 58368 --a------ C:\xjoukm.exe 2008-02-07 18:06:50 41472 --a------ C:\WINDOWS\system32\rqrqopo.dll 2008-02-07 18:06:30 23552 --a------ C:\WINDOWS\system32\winrkp32.dll 2008-02-02 11:30:29 0 d-------- C:\Program Files\Microsoft Works 2008-02-02 11:30:08 0 d-------- C:\Program Files\MSBuild 2008-02-02 11:27:14 0 d-------- C:\Program Files\Microsoft.NET 2008-02-02 11:21:07 0 d-------- C:\WINDOWS\SHELLNEW 2008-02-02 11:19:25 0 dr-h----- C:\MSOCache 2008-02-02 09:11:44 0 d--h----- C:\WINDOWS\$hf_mig$ 2008-02-01 22:55:04 0 d-------- C:\Program Files\VSD Software 2008-01-27 15:05:11 0 d-------- C:\Program Files\Common Files\Sony Ericsson Shared 2008-01-27 15:03:28 0 d-------- C:\WINDOWS\Downloaded Installations 2008-01-19 14:33:03 0 d-------- C:\Program Files\AdVantage 2008-01-19 14:22:03 0 d-------- C:\Program Files\DAEMON Tools 2008-01-15 20:01:35 98304 --a------ C:\WINDOWS\system32\IStestDLL.dll <Not Verified; ; IStestDLL Dynamic Link Library> 2008-01-15 20:00:22 28672 --a------ C:\WINDOWS\system32\ISkeyObject.dll <Not Verified; ; ISkeyObject Dynamic Link Library> 2008-01-15 20:00:20 0 d-------- C:\Program Files\Octatec 2008-01-12 12:55:35 0 d-------- C:\Program Files\YouTube Video Downloader 2008-01-10 21:52:23 0 d-------- C:\Program Files\FLV to AVI MPEG WMV 3GP MP4 iPod Converter -- Find3M Report --------------------------------------------------------------- 2008-02-09 17:53:32 0 d-------- C:\Program Files\FlashGet 2008-02-09 17:33:27 0 d-------- C:\Program Files\AutoConnect 2008-02-08 17:11:03 0 d-------- C:\Program Files\Neostrada TP 2008-02-07 20:26:54 0 d-------- C:\Documents and Settings\Miki\Dane aplikacji\Hamachi 2008-02-02 11:29:10 0 d-------- C:\Program Files\Common Files 2008-02-02 11:05:38 0 d-------- C:\Documents and Settings\Miki\Dane aplikacji\uTorrent 2008-02-02 11:02:12 0 d--h----- C:\Program Files\InstallShield Installation Information 2008-02-02 09:08:58 0 d-------- C:\Documents and Settings\Miki\Dane aplikacji\ATI 2008-01-31 18:57:52 0 d-------- C:\Documents and Settings\Miki\Dane aplikacji\Tibia 2008-01-27 15:06:37 0 d-------- C:\Program Files\Common Files\Teleca Shared 2008-01-19 14:53:21 0 d-------- C:\Documents and Settings\Miki\Dane aplikacji\Sports Interactive 2008-01-19 14:22:04 0 d-------- C:\Documents and Settings\Miki\Dane aplikacji\DAEMON Tools 2008-01-16 10:01:25 0 d-------- C:\Documents and Settings\Miki\Dane aplikacji\Adobe 2008-01-12 15:53:02 0 d-------- C:\Documents and Settings\Miki\Dane aplikacji\GanymedeNet 2008-01-12 14:27:21 0 d-------- C:\Program Files\Gadu-Gadu 2008-01-12 11:55:14 0 d-------- C:\Documents and Settings\Miki\Dane aplikacji\Nokia 2008-01-11 20:42:30 0 d-------- C:\Program Files\Ganymede 2008-01-08 19:14:34 436322 --a------ C:\WINDOWS\system32\perfh015.dat 2008-01-08 19:14:34 67298 --a------ C:\WINDOWS\system32\perfc015.dat 2008-01-06 13:25:34 0 d-------- C:\Program Files\VstPlugins 2008-01-06 13:18:38 0 d-------- C:\Program Files\ASIO4ALL v2 2008-01-05 19:26:02 4382 --a----c- C:\WINDOWS\mozver.dat 2008-01-01 14:34:59 168 --a------ C:\WINDOWS\system32\proc1395793746.bin 2007-12-30 17:35:47 0 d-------- C:\Program Files\YourWare Solutions 2007-12-29 19:10:20 23640 --a----c- C:\WINDOWS\system32\emptyregdb.dat 2007-12-29 17:49:08 0 d-------- C:\Program Files\ATI Technologies 2007-12-25 13:09:53 0 d-------- C:\Program Files\uTorrent 2007-12-23 13:14:24 21840 --a-----t C:\WINDOWS\system32\SIntfNT.dll 2007-12-23 13:14:24 17212 --a-----t C:\WINDOWS\system32\SIntf32.dll 2007-12-23 13:14:24 12067 --a-----t C:\WINDOWS\system32\SIntf16.dll 2007-12-21 21:07:43 0 d-------- C:\Program Files\CCleaner 2007-12-21 21:07:43 0 d-------- C:\Program Files\7-Zip 2007-12-15 11:58:40 0 d-------- C:\Program Files\No-IP 2007-12-13 19:52:12 0 d-------- C:\Program Files\Java 2007-12-13 19:49:12 0 d-------- C:\Program Files\Common Files\Java 2007-12-11 19:48:28 0 d-------- C:\Program Files\Winamp 2007-12-11 19:48:28 0 d-------- C:\Program Files\QuickTime 2007-12-11 19:48:28 0 d-------- C:\Program Files\IrfanView 2007-12-11 09:21:48 0 d-------- C:\Documents and Settings\Miki\Dane aplikacji\Skype -- Registry Dump --------------------------------------------------------------- *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{935F4CF7-D3F5-4814-A9B7-87D89D178049}] 2008-02-07 18:12 331264 --a------ C:\WINDOWS\system32\ssqpo.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A00CA75C-DEDD-4474-9088-5D6363D69338}] 2008-02-07 18:06 41472 --a------ C:\WINDOWS\system32\rqrqopo.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{F10587E9-0E47-4CBE-ABCD-7DD20B8622FF}] 2008-02-07 18:09 12800 --a------ C:\Program Files\Helper\1202404148.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SoundMan"="SOUNDMAN.EXE" [2006-01-11 15:08 C:\WINDOWS\soundman.exe] "ATICCC"="C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" [2005-08-06 01:07] "BigDog305"="C:\WINDOWS\VM305_STI.exe" [2005-08-05 08:15] "TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2007-06-09 20:28] "adiras"="adiras.exe" [] "GrooveMonitor"="C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [2007-08-24 07:00] "PCSuiteTrayApplication"="C:\Program Files\NOKIA\Nokia PC Suite 6\LaunchApplication.exe" [2007-03-23 13:20] "avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-12-04 14:00] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2006-03-02 13:00] "AutoConnect"="C:\Program Files\AutoConnect\AutoConnect.exe" [2004-08-28 19:27] [HKEY_USERS\.default\software\microsoft\windows\currentversion\run] "Nokia.PCSync"=C:\Program Files\NOKIA\Nokia PC Suite 6\PcSync2.exe /NoDialog -- Hosts ----------------------------------------------------------------------- 127.0.0.1 abcsearch.com 127.0.0.1 admin.abcsearch.com 127.0.0.1 www3.abcsearch.com #[Browseraid] 127.0.0.1 www.abcsearch.com 127.0.0.1 abc517.net #[Trojan.Mitglieder.H] 127.0.0.1 acestats.com 127.0.0.1 www.acestats.com 127.0.0.1 actualnames.com #[Parasite.ActualNames] 127.0.0.1 www.actualnames.com 127.0.0.1 ad-up.com 4685 more entries in hosts file. -- End of Deckard's System Scanner: finished at 2008-02-09 17:56:28 ------------

**Posty:** 18165 · przez **wojtas** 09 Lut 2008, 19:21

Wykonaj to co jest podane w tym temacie

zastosuj:

smitfraudfix z opcji 2

Zastosuj SDFix . Po pobraniu uruchom go a rozpakuje się do C:\SDFix. Uruchom komputer w trybie awaryjnym (F8 przy stracie systemu). Będąc w awaryjnym uruchom plik RunThis.bat z folderu SDFixa. Zatwierdź czyszczenie przez Y. Poczekaj aż ukończy i komputer zresetuje

Potem wejdz do folderu C:\SDFix wrzuc zawartość pliku Report.txt + log z DSS

**Posty:** 140 · przez **Jaramaniak** 09 Lut 2008, 19:25

mam to juz dawno i nie mam z tym problemów...

przed momentem zwiesił mi się komp, lecz przedtem był znow niebieski ekran
jakiś blad 0x0000008e . juz nic z tego nie wiem.

**Posty:** 18165 · przez **wojtas** 09 Lut 2008, 19:29

wykonaj to o co prosilem masz wirusy

**Posty:** 140 · przez **Jaramaniak** 09 Lut 2008, 19:33

czy mozesz mi powiedziec co mam zrobic z tym smitfraudfix ? bo sciagnalem i nie wiem co dalej...

**Posty:** 18165 · przez **wojtas** 09 Lut 2008, 19:43

wlaczasz wpisujesz 2 i enter i czekasz

"wykryto poteencjalną infekcję"

"wykryto poteencjalną infekcję"

Kto jest na forum