zaloczam loga podejzliwe linki ...

[bartoex]

Przypadkowe wejscie w jakies linki przeslane od kolegi ...
po tym wylaczenie sie przegladarek i muzyki .

Kod: Zaznacz wszystko

Logfile of HijackThis v1.99.1
Scan saved at 13:47:10, on 2007-09-26
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Program Files\SAGEM WiFi manager\WLANUTL.exe
C:\Program Files\Common Files\Logitech\KhalShared\KHALMNPR.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Raxco\PerfectDisk\PDAgent.exe
C:\WINDOWS\system32\wscntfy.exe
D:\PesLauncher\PesLauncher.exe
D:\Programy\Gadu-Gadu\gg.exe
C:\Program Files\Mozilla Firefox\firefox.exe
D:\Programy\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.wp.pl/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - Global Startup: Logitech SetPoint.lnk = ?
O4 - Global Startup: Program sieciowy dla SAGEM Wi-Fi 11g USB adapter.lnk = ?
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PDAgent - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk\PDAgent.exe
O23 - Service: PDEngine - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk\PDEngine.exe



[Red]

w LOGU masz czysto.

[Kuba1]

Dołącz log z ComboFix i Silentrunnners.

[bartoex]

Kod: Zaznacz wszystko

ComboFix 07-09-21.2 - "BartoeX" 2007-09-26 19:27:35.1 - NTFSx86
Microsoft Windows XP Professional  5.1.2600.2.1250.1.1045.18.289 [GMT 2:00]
* Created a new restore point
.

(((((((((((((((((((((((((   Files Created from 2007-08-26 to 2007-09-26  )))))))))))))))))))))))))))))))
.

2007-09-26 19:27   51,200   --a------   C:\WINDOWS\NirCmd.exe
2007-09-26 14:28   <DIR>   d--------   C:\Program Files\TuneUp Utilities 2006
2007-09-26 14:28   <DIR>   d--------   C:\DOCUME~1\BartoeX\DANEAP~1\TuneUp Software
2007-09-26 14:28   <DIR>   d--------   C:\DOCUME~1\ALLUSE~1\DANEAP~1\TuneUp Software
2007-09-25 22:20   <DIR>   d--------   C:\Program Files\NPCC
2007-09-24 13:56   <DIR>   d--------   C:\Program Files\Common Files\Raxco
2007-09-24 13:56   <DIR>   d--------   C:\DOCUME~1\ALLUSE~1\DANEAP~1\Raxco
2007-09-24 13:55   <DIR>   d--------   C:\Program Files\Raxco
2007-09-19 21:45   <DIR>   d--------   C:\Program Files\Nokia
2007-09-19 21:45   <DIR>   d--------   C:\Program Files\Common Files\PCSuite
2007-09-19 21:45   <DIR>   d--------   C:\Program Files\Common Files\Nokia
2007-09-19 21:45   <DIR>   d--------   C:\DOCUME~1\BartoeX\DANEAP~1\Nokia Multimedia Player
2007-09-19 18:45   <DIR>   d--------   C:\DOCUME~1\BartoeX\DANEAP~1\Media Player Classic
2007-09-19 18:44   <DIR>   d--------   C:\Program Files\QuickTime Alternative
2007-09-15 23:39   <DIR>   d--------   C:\DOCUME~1\ALLUSE~1\DANEAP~1\Spybot - Search & Destroy
2007-09-15 22:14   <DIR>   d--------   C:\Program Files\Hamachi
2007-09-15 20:10   <DIR>   d--------   C:\DOCUME~1\ALLUSE~1\DANEAP~1\NVIDIA
2007-09-14 22:45   <DIR>   d--------   C:\Program Files\WMA-MP3.com
2007-09-14 22:39   <DIR>   d--------   C:\Program Files\Winamp
2007-09-14 22:34   <DIR>   d--------   C:\Program Files\LitexMedia
2007-09-09 20:28   <DIR>   d--------   C:\DOCUME~1\BartoeX\Gadu-Gadu
2007-09-09 15:38   <DIR>   d--------   C:\DOCUME~1\BartoeX\DANEAP~1\Lavasoft
2007-09-09 15:37   <DIR>   d--------   C:\Program Files\Lavasoft
2007-09-09 15:37   <DIR>   d--------   C:\Program Files\Common Files\Wise Installation Wizard
2007-09-09 14:02   23   --ahs----   C:\WINDOWS\system32\cabeb_r.dll
2007-09-09 10:54   <DIR>   d--------   C:\DOCUME~1\BartoeX\DANEAP~1\Gadu-Gadu
2007-09-08 23:19   <DIR>   d--------   C:\DOCUME~1\ALLUSE~1\Documents
2007-09-08 23:19   <DIR>   d--------   C:\DOCUME~1\ALLUSE~1\DANEAP~1\Sony Ericsson
2007-09-08 23:18   <DIR>   d--------   C:\Program Files\Sony Ericsson
2007-09-08 23:18   <DIR>   d--------   C:\DOCUME~1\ALLUSE~1\DANEAP~1\Teleca
2007-09-08 22:46   <DIR>   d--------   C:\Program Files\QuickTime
2007-09-08 22:30   <DIR>   d--------   C:\Program Files\SEMC
2007-09-08 22:28   <DIR>   d--------   C:\WINDOWS\system32\URTTemp
2007-09-08 22:23   <DIR>   d--------   C:\DOCUME~1\BartoeX\DANEAP~1\Teleca
2007-09-08 22:22   <DIR>   d--------   C:\Program Files\Common Files\Teleca Shared
2007-09-08 22:18   6,144   --a------   C:\WINDOWS\system32\drivers\k750cm.sys
2007-09-08 22:18   5,744   --a------   C:\WINDOWS\system32\drivers\k750wh.sys
2007-09-07 15:54   <DIR>   d--------   C:\Program Files\DkZ Studio
2007-09-07 00:24   <DIR>   d--------   C:\Program Files\uTorrent
2007-09-07 00:24   <DIR>   d--------   C:\DOCUME~1\BartoeX\DANEAP~1\uTorrent
2007-09-06 08:56   <DIR>   d--------   C:\Program Files\SystemRequirementsLab
2007-09-06 08:56   <DIR>   d--------   C:\DOCUME~1\BartoeX\SystemRequirementsLab
2007-09-05 23:19   <DIR>   d--------   C:\Program Files\PhotoFiltre
2007-09-05 21:25   69,760   --a------   C:\WINDOWS\system32\drivers\LMouKE.Sys
2007-09-05 21:25   55,808   --a------   C:\WINDOWS\system32\drivers\L8042MOU.SYS
2007-09-05 21:25   53,248   --a------   C:\WINDOWS\system32\KemXML.dll
2007-09-05 21:25   155,648   --a------   C:\WINDOWS\system32\kemutb.dll
2007-09-05 21:25   13,568   --a------   C:\WINDOWS\system32\drivers\L8042Kbd.SYS
2007-09-05 21:25   126,976   --a------   C:\WINDOWS\system32\KemUtil.dll
2007-09-05 21:25   110,592   --a------   C:\WINDOWS\system32\KemWnd.dll
2007-09-05 21:24   94,208   --a------   C:\WINDOWS\KHALMNPR.Exe
2007-09-05 21:24   27,008   --a------   C:\WINDOWS\system32\drivers\LHidKE.Sys
2007-09-05 21:24   <DIR>   d--------   C:\Program Files\Logitech
2007-09-05 21:24   <DIR>   d--------   C:\Program Files\Common Files\Logitech
2007-09-04 23:03   26,496   --a--c---   C:\WINDOWS\system32\dllcache\usbstor.sys
2007-09-04 00:40   <DIR>   d--------   C:\Program Files\Sunbelt Software
2007-09-02 03:08   348,160   --a------   C:\WINDOWS\system32\msvcr71.dll
2007-09-02 03:07   <DIR>   d--------   C:\Program Files\MarBit
2007-09-02 01:43   <DIR>   d--------   C:\Program Files\Imesh
2007-09-02 01:43   <DIR>   d--------   C:\DOCUME~1\BartoeX\DANEAP~1\iMesh
2007-09-01 23:50   25,544   --a------   C:\WINDOWS\system32\drivers\hamachi.sys
2007-09-01 23:50   <DIR>   d--------   C:\DOCUME~1\BartoeX\DANEAP~1\Hamachi
2007-08-31 18:16   314,368   --a------   C:\WINDOWS\IsUninst.exe
2007-08-31 18:16   <DIR>   d--------   C:\DOCUME~1\BartoeX\WINDOWS
2007-08-31 14:50   <DIR>   d--------   C:\DOCUME~1\BartoeX\DANEAP~1\BitTorrent
2007-08-31 14:27   639,224   --a------   C:\WINDOWS\system32\drivers\sptd.sys
2007-08-31 13:50   98,304   --a------   C:\WINDOWS\system32\CmdLineExt.dll
2007-08-30 22:34   <DIR>   d--------   C:\Deckard
2007-08-30 21:02   <DIR>   d--h-----   C:\WINDOWS\$hf_mig$
2007-08-30 11:13   9,715,200   -r-------   C:\WINDOWS\RTLCPL.exe
2007-08-30 11:13   86,016   -r-------   C:\WINDOWS\SoundMan.exe
2007-08-30 11:13   49,152   -r-------   C:\WINDOWS\system32\ChCfg.exe
2007-08-30 11:13   4,419,584   -r-------   C:\WINDOWS\system32\drivers\RtkHDAud.sys
2007-08-30 11:13   2,162,688   -r-------   C:\WINDOWS\MicCal.exe
2007-08-30 11:13   16,342,528   -r-------   C:\WINDOWS\RTHDCPL.exe
2007-08-30 11:13   1,826,816   -r-------   C:\WINDOWS\SkyTel.exe
2007-08-30 11:13   1,191,936   -r-------   C:\WINDOWS\RtlUpd.exe
2007-08-30 11:12   69,632   -r-------   C:\WINDOWS\Alcmtr.exe
2007-08-30 11:12   520,192   -r-------   C:\WINDOWS\RtlExUpd.dll
2007-08-30 11:12   2,808,832   -r-------   C:\WINDOWS\alcwzrd.exe
2007-08-30 11:12   <DIR>   d--------   C:\Program Files\Realtek
2007-08-30 11:10   94,592   -ra------   C:\WINDOWS\system32\drivers\Rtenicxp.sys
2007-08-29 15:14   737,280   --a------   C:\WINDOWS\iun6002.exe
2007-08-28 20:16   <DIR>   d--------   C:\WINDOWS\pss
2007-08-28 16:06   221,184   --a------   C:\WINDOWS\system32\wmpns.dll
2007-08-27 22:35   208,896   --a------   C:\WINDOWS\system32\nvudisp.exe
2007-08-27 22:25   <DIR>   d--------   C:\Program Files\Driver Cleaner
2007-08-26 21:13   <DIR>   d--------   C:\DOCUME~1\BartoeX\DANEAP~1\Help
2007-08-26 10:27   <DIR>   d--------   C:\Program Files\RegCleaner

.
((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-09-09 01:09   ---------   d--h-----   C:\Program Files\InstallShield Installation Information
2007-08-25 04:24   ---------   d--------   C:\DOCUME~1\BartoeX\DANEAP~1\GanymedeNet
2007-08-25 04:11   ---------   d--------   C:\DOCUME~1\BartoeX\DANEAP~1\Logitech
2007-08-25 04:01   ---------   d--------   C:\Program Files\Common Files\InstallShield
2007-08-25 03:48   315392   --a------   C:\WINDOWS\HideWin.exe
2007-08-25 03:48   ---------   d--------   C:\Program Files\DIFX
2007-08-25 03:47   ---------   d--------   C:\DOCUME~1\BartoeX\DANEAP~1\InstallShield
2007-08-25 03:33   ---------   d--------   C:\Program Files\SAGEM WiFi manager
2007-08-25 03:33   ---------   d--------   C:\Program Files\SAGEM
2007-08-25 03:22   ---------   d--------   C:\Program Files\microsoft frontpage
   ---------      C:\Program Files\Usługi online
.

(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
.

*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-08-11 15:43]
"nwiz"="nwiz.exe" [2006-08-11 15:43 C:\WINDOWS\system32\nwiz.exe]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2006-08-11 15:43]
"Logitech Hardware Abstraction Layer"="KHALMNPR.EXE" [2006-03-28 17:38 C:\WINDOWS\KHALMNPR.Exe]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:44]
"SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2007-08-31 16:46]

C:\DOCUME~1\ALLUSE~1\MENUST~1\Programy\AUTOST~1\
Logitech SetPoint.lnk - C:\Program Files\Logitech\SetPoint\SetPoint.exe [2007-09-05 21:25:15]
Program sieciowy dla SAGEM Wi-Fi 11g USB adapter.lnk - C:\Program Files\SAGEM WiFi manager\WLANUTL.exe [2007-08-25 03:33:39]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^BartoeX^Menu Start^Programy^Autostart^hamachi.lnk]
path=C:\Documents and Settings\BartoeX\Menu Start\Programy\Autostart\hamachi.lnk
backup=C:\WINDOWS\pss\hamachi.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BitTorrent]
"C:\Program Files\BitTorrent\bittorrent.exe" --force_start_minimized

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
"C:\Program Files\Messenger\msmsgs.exe" /background

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RTHDCPL]
RTHDCPL.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Sony Ericsson PC Suite]
"C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions

R3 SG762_XP;SAGEM 802.11g XG762 1211B Driver;C:\WINDOWS\system32\DRIVERS\WlanBZXP.sys
S3 SetupNTGLM7X;SetupNTGLM7X;\??\E:\NTGLM7X.sys
S3 USBSTOR;Sterownik magazynu masowego USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
S3 ZDCndis5;ZDCndis5 Protocol Driver;\??\C:\WINDOWS\system32\ZDCndis5.SYS
S3 ZDPNDIS5;ZDPNDIS5 NDIS Protocol Driver;\??\C:\WINDOWS\system32\ZDPNDIS5.SYS

*Newly Created Service* - CATCHME
.
Contents of the 'Scheduled Tasks' folder
"2007-09-26 12:29:15 C:\WINDOWS\Tasks\1-Click Maintenance.job"
- C:\Program Files\TuneUp Utilities 2006\SystemOptimizer.exe
.
**************************************************************************

catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-09-26 19:28:28
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-09-26 19:29:12
.
   --- E O F ---
COMBOFIX

[Red]

Jest nadal czysto.

[bartoex]

Jakies skanery online ?
To tak jakbym mogl prosic to jakies programy do czyszczenia roznych smieci w kompie robaki, rejestr itp ..

[wojtas]

przeskanuj tym skanerem i daj raport:

http://www.kaspersky.pl/virusscanner.html

To tak jakbym mogl prosic to jakies programy do czyszczenia roznych smieci w kompie robaki, .

mozesz uzyc

http://www.programosy.pl/program,avg-anti-spyware.html