Nie wiem co robić bo z tych rzeczach jestem zielony
Daje wam logi z ComboFixa i Hijacka :
ComboFix :
- Kod: Zaznacz wszystko
ComboFix 09-06-18.02 - Daniel 2009-06-19 11:14.5 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1250.48.1045.18.510.247 [GMT 2:00]
Uruchomiony z: c:\documents and settings\Daniel\Pulpit\ComboFix.exe
AV: avast! antivirus 4.8.1335 [VPS 090618-0] *On-access scanning enabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
.
((((((((((((((((((((((((((((((((((((((( Usunięto )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\windows\system32\hattric
c:\documents and settings\Daniel\Dane aplikacji\Microsoft\Internet Explorer\Quick Launch\avast! Antivirus.lnk
c:\documents and settings\Daniel\Dane aplikacji\wiaserva.log
c:\documents and settings\Daniel\Menu Start\Programy\Autostart\rncsys32.exe
c:\windows\system32\drivers\22a32c2f.sys
.
((((((((((((((((((((((((((((((((((((((( Sterowniki/Usługi )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\Service_AVPsys
((((((((((((((((((((((((( Pliki utworzone od 2009-05-19 do 2009-06-19 )))))))))))))))))))))))))))))))
.
2009-06-16 20:48 . 2009-06-16 20:48 -------- d-----w- c:\program files\Ventrilo
2009-06-16 20:47 . 2009-06-16 20:47 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard
2009-06-16 18:15 . 2009-06-16 18:15 -------- d-----w- c:\program files\CCleaner
2009-06-14 00:54 . 2006-06-26 00:49 1867776 ----a-w- c:\windows\system32\python24.dll
2009-06-14 00:50 . 2009-06-19 01:37 -------- d-----w- c:\program files\Tibia Auto
2009-06-13 23:37 . 2009-06-13 23:38 -------- d-----w- c:\program files\TibiaBot NG
2009-06-13 23:27 . 2009-06-16 05:24 -------- d---a-w- c:\documents and settings\All Users\Dane aplikacji\TEMP
2009-06-13 23:26 . 2009-06-19 01:37 -------- d-----w- c:\program files\ElfBot NG
2009-06-13 23:26 . 2009-06-13 23:26 535651 --sh--w- c:\windows\smss.cmd
2009-06-11 13:45 . 2009-06-11 13:45 -------- d-----w- c:\program files\7-Zip
2009-06-10 19:22 . 2009-06-10 19:22 -------- d-----w- c:\documents and settings\Daniel\WapSter
2009-06-10 19:21 . 2009-06-10 19:21 -------- d-----w- c:\program files\WapSter
2009-06-09 04:29 . 2009-06-09 04:29 -------- d-----w- c:\documents and settings\Kamyk\Dane aplikacji\Kamerzysta
2009-06-09 04:29 . 2009-06-09 04:29 -------- d-----w- c:\documents and settings\Kamyk\Dane aplikacji\AutoUpdate
2009-06-08 20:49 . 2009-06-08 20:49 -------- d-----w- c:\documents and settings\Daniel\Dane aplikacji\Kamerzysta
2009-06-08 20:49 . 2009-06-08 20:49 -------- d-----w- c:\program files\Onet
2009-06-07 20:54 . 2009-06-16 19:31 -------- d-----w- c:\documents and settings\Daniel\Dane aplikacji\Tibia
2009-06-07 20:54 . 2009-06-19 01:37 -------- d-----w- c:\program files\Tibia
2009-06-07 17:58 . 2009-06-07 20:29 -------- d-----w- c:\documents and settings\Daniel\Dane aplikacji\Ahead
2009-06-07 12:37 . 2009-06-07 12:37 -------- d-----w- c:\documents and settings\Daniel\Dane aplikacji\OpenFM
2009-06-07 11:18 . 2009-06-16 20:52 -------- d-----w- c:\documents and settings\Daniel\Dane aplikacji\Ventrilo
2009-06-07 09:33 . 2009-06-07 12:39 -------- d-----w- c:\documents and settings\Daniel\Dane aplikacji\Nowe Gadu-Gadu
2009-06-07 09:08 . 2009-06-19 08:49 -------- d-----w- c:\documents and settings\Daniel\Dane aplikacji\skypePM
2009-06-02 04:43 . 2009-06-18 16:30 -------- d-----w- c:\documents and settings\Kamyk\Dane aplikacji\Tibia
2009-05-28 22:54 . 2009-02-05 20:06 51376 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2009-05-28 22:54 . 2009-02-05 20:06 23152 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2009-05-28 22:54 . 2009-02-05 20:05 26944 ----a-w- c:\windows\system32\drivers\aavmker4.sys
2009-05-28 22:54 . 2009-02-05 20:04 97480 ----a-w- c:\windows\system32\AvastSS.scr
2009-05-28 22:54 . 2009-02-05 20:08 93296 ----a-w- c:\windows\system32\drivers\aswmon.sys
2009-05-28 22:54 . 2009-02-05 20:08 94032 ----a-w- c:\windows\system32\drivers\aswmon2.sys
2009-05-28 22:54 . 2009-02-05 20:07 114768 ----a-w- c:\windows\system32\drivers\aswSP.sys
2009-05-28 22:54 . 2009-02-05 20:07 20560 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2009-05-28 22:54 . 2009-02-05 20:11 1256296 ----a-w- c:\windows\system32\aswBoot.exe
2009-05-28 22:31 . 2009-05-28 22:31 -------- d-----w- c:\documents and settings\All Users\Dane aplikacji\ESET
2009-05-28 22:09 . 2009-05-28 22:09 -------- d-----w- c:\documents and settings\All Users\Dane aplikacji\FLEXnet
2009-05-28 21:50 . 2009-05-28 21:50 -------- d-----w- c:\program files\Bonjour
2009-05-28 21:33 . 2009-05-28 21:33 -------- d-----w- c:\program files\Common Files\Macrovision Shared
2009-05-28 21:32 . 2009-05-28 21:54 -------- d-----w- c:\program files\Adobe Photoshop CS3
2009-05-28 09:23 . 2009-05-28 09:23 42088 ----a-w- c:\documents and settings\Daniel\Dane aplikacji\Nowe Gadu-Gadu\_userdata\ggbho.1.dll
2009-05-28 08:34 . 2009-05-28 08:34 11264 ----a-w- c:\documents and settings\Daniel\Dane aplikacji\Nowe Gadu-Gadu\_userdata\npgg.1.dll
2009-05-27 22:15 . 2009-05-27 22:15 604416 ----a-w- c:\windows\system32\TUProgSt.exe
2009-05-27 22:14 . 2009-05-27 22:14 -------- d-----w- c:\documents and settings\All Users\Dane aplikacji\TuneUp Software
2009-05-27 22:14 . 2009-05-29 19:44 -------- d-----w- c:\program files\TuneUp Utilities 2009
2009-05-27 22:14 . 2009-05-27 22:14 -------- d-sh--w- c:\documents and settings\All Users\Dane aplikacji\{55A29068-F2CE-456C-9148-C869879E2357}
2009-05-27 22:05 . 2009-05-27 22:05 -------- d-sh--w- c:\documents and settings\Daniel\IECompatCache
2009-05-27 21:59 . 2009-05-27 21:59 -------- dc----w- c:\documents and settings\All Users\Dane aplikacji\{83C91755-2546-441D-AC40-9A6B4B860800}
2009-05-27 16:44 . 2009-05-27 16:44 -------- d-----w- c:\documents and settings\Kamyk\Ustawienia lokalne\Dane aplikacji\Ahead
2009-05-27 16:11 . 2009-05-27 16:11 -------- d-----w- c:\documents and settings\Kamyk\Dane aplikacji\Gadu-Gadu
2009-05-27 16:08 . 2009-05-27 16:10 -------- d-----w- c:\documents and settings\Kamyk\Gadu-Gadu
2009-05-27 15:56 . 2009-06-18 18:08 -------- d-----w- c:\documents and settings\Kamyk\Dane aplikacji\AIMP
2009-05-26 19:21 . 2009-06-11 14:43 -------- d-----w- c:\program files\Gadu-Gadu
2009-05-25 14:00 . 2009-05-25 14:00 -------- d-----w- c:\documents and settings\Kamyk\Dane aplikacji\AdobeUM
2009-05-25 14:00 . 2009-05-25 14:00 -------- d-----w- c:\documents and settings\Kamyk\Ustawienia lokalne\Dane aplikacji\Adobe
2009-05-25 13:53 . 2009-05-25 13:53 -------- d-----w- c:\documents and settings\Kamyk\.gstreamer-0.10
2009-05-25 13:52 . 2009-05-25 14:06 -------- d-----w- c:\documents and settings\Kamyk\Dane aplikacji\Nowe Gadu-Gadu
2009-05-25 13:51 . 2009-05-25 13:51 -------- d-----w- c:\documents and settings\Kamyk\Dane aplikacji\OpenFM
2009-05-25 13:46 . 2009-05-25 13:46 -------- d-----w- c:\documents and settings\Kamyk\Dane aplikacji\Winamp
2009-05-24 22:40 . 2009-05-27 22:10 -------- d-----w- c:\documents and settings\Daniel\Ustawienia lokalne\Dane aplikacji\Google
2009-05-24 22:40 . 2009-05-24 22:40 -------- d-----w- c:\windows\system32\IOSUBSYS
2009-05-24 18:40 . 2009-05-26 16:45 -------- d-----w- c:\documents and settings\All Users\Dane aplikacji\ipla
2009-05-24 18:17 . 2009-05-24 18:17 25280 ----a-w- c:\windows\system32\drivers\hamachi.sys
2009-05-22 20:47 . 2009-05-22 20:47 -------- d-----w- c:\documents and settings\Kamyk\Ustawienia lokalne\Dane aplikacji\Mozilla
2009-05-22 20:41 . 2009-05-22 20:41 -------- d-sh--w- c:\documents and settings\Kamyk\PrivacIE
2009-05-22 20:38 . 2009-05-22 20:38 -------- d-----w- c:\documents and settings\Kamyk\Ustawienia lokalne\Dane aplikacji\Help
2009-05-21 22:16 . 2008-06-19 15:24 28544 ----a-w- c:\windows\system32\drivers\pavboot.sys
2009-05-21 21:52 . 2009-05-21 21:52 -------- d-----w- c:\documents and settings\Daniel\.thumbnails
2009-05-21 21:47 . 2009-05-21 22:09 -------- d-----w- c:\documents and settings\Daniel\.gimp-2.6
2009-05-21 21:47 . 2009-05-21 21:47 -------- d-----w- c:\documents and settings\Daniel\.gegl-0.0
2009-05-21 18:21 . 1997-01-15 22:00 29696 ----a-w- c:\windows\system32\VB5STKIT.DLL
2009-05-21 18:21 . 2007-04-11 19:52 185344 ----a-w- c:\windows\system32\iwpsetup.exe
2009-05-21 17:39 . 2009-05-21 17:39 -------- d-----w- c:\windows\Downloaded Installations
2009-05-21 17:11 . 2009-05-21 22:44 -------- d-----w- c:\program files\A4Desk
2009-05-21 16:05 . 2009-05-26 22:19 -------- d-----w- c:\documents and settings\Daniel\Dane aplikacji\Cream Software
.
(((((((((((((((((((((((((((((((((((((((( Sekcja Find3M ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-06-19 09:22 . 2009-04-04 18:42 -------- d-----w- c:\program files\AutoConnect
2009-06-19 09:16 . 2009-04-03 20:54 -------- d-----w- c:\documents and settings\Daniel\Dane aplikacji\Skype
2009-06-19 08:50 . 2009-04-16 19:26 -------- d-----w- c:\documents and settings\Daniel\Dane aplikacji\AIMP
2009-06-09 17:28 . 2009-04-28 16:43 -------- d-----w- c:\program files\Common Files\Onet.pl
2009-06-07 12:39 . 2009-05-13 17:08 -------- d-----w- c:\documents and settings\All Users\Dane aplikacji\OpenFM
2009-06-04 20:26 . 2009-04-22 21:21 -------- d-----w- c:\program files\Odkurzacz
2009-05-29 17:24 . 2009-03-27 17:48 721904 ----a-w- c:\windows\system32\drivers\sptd.sys
2009-05-28 22:10 . 2009-03-27 21:39 69624 ----a-w- c:\documents and settings\Daniel\Ustawienia lokalne\Dane aplikacji\GDIPFONTCACHEV1.DAT
2009-05-28 21:53 . 2009-04-09 13:40 -------- d-----w- c:\program files\Common Files\Adobe
2009-05-26 22:50 . 2009-03-27 17:37 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-05-19 14:12 . 2009-05-19 14:12 -------- d-----w- c:\documents and settings\Kamyk\Dane aplikacji\SlipStream
2009-05-16 21:10 . 2009-03-28 01:31 -------- d-----w- c:\documents and settings\Daniel\Dane aplikacji\uTorrent
2009-05-13 23:36 . 2009-04-26 17:45 -------- d-----w- c:\program files\Common Files\Nero
2009-05-13 23:32 . 2009-03-27 18:34 -------- d-----w- c:\documents and settings\All Users\Dane aplikacji\Nero
2009-05-13 23:09 . 2009-03-27 18:34 -------- d-----w- c:\program files\Nero
2009-05-07 15:44 . 2004-08-03 23:44 346112 ----a-w- c:\windows\system32\localspl.dll
2009-05-03 00:43 . 2009-03-27 20:10 410984 ----a-w- c:\windows\system32\deploytk.dll
2009-05-03 00:40 . 2009-03-27 20:10 152576 ----a-w- c:\documents and settings\Daniel\Dane aplikacji\Sun\Java\jre1.6.0_13\lzma.dll
2009-04-29 04:32 . 2007-01-04 13:05 670720 ----a-w- c:\windows\system32\wininet.dll
2009-04-29 04:32 . 2009-05-11 17:23 81920 ----a-w- c:\windows\system32\ieencode.dll
2009-04-29 00:14 . 2009-03-27 18:59 -------- d-----w- c:\program files\Asprate
2009-04-26 11:41 . 2009-04-26 11:41 3156992 --sh--w- c:\documents and settings\Daniel\Moje dokumentyWei6D3_save2pc.exe
2009-04-25 22:51 . 2009-04-25 22:51 2560 ----a-w- c:\windows\_MSRSTRT.EXE
2009-04-25 17:05 . 2009-04-21 19:01 -------- d-----w- c:\program files\USB Disk Win98 Driver
2009-04-21 18:58 . 2009-03-27 17:49 -------- d-----w- c:\program files\Common Files\InstallShield
2009-04-21 18:09 . 2009-04-21 18:09 -------- d-----w- c:\program files\microsoft frontpage
2009-04-20 15:59 . 2009-04-20 15:59 36913 ----a-w- c:\windows\BricoPackUninst.cmd
2009-04-20 15:59 . 2009-04-20 15:54 2155 ----a-w- c:\windows\BricoPackFoldersDelete.cmd
2009-04-20 15:59 . 2007-03-10 01:31 219648 ----a-w- c:\windows\system32\uxtheme.dll
2009-04-19 19:58 . 2007-03-10 01:32 1848192 ----a-w- c:\windows\system32\win32k.sys
2009-04-17 12:11 . 2001-10-26 17:15 75486 ----a-w- c:\windows\system32\perfc015.dat
2009-04-17 12:11 . 2001-10-26 17:15 352982 ----a-w- c:\windows\system32\perfh015.dat
2009-04-15 15:31 . 2007-03-10 01:33 583168 ----a-w- c:\windows\system32\rpcrt4.dll
2009-04-14 09:31 . 2009-04-14 09:31 419328 ----a-w- c:\documents and settings\All Users\Dane aplikacji\Skype\Plugins\Plugins\[u]0[/u]4B3EC9B2B5945A1B7AFC5FAFC297401\THSkypePlugin.dll
2009-04-14 09:31 . 2009-04-14 09:31 1010688 ----a-w- c:\documents and settings\All Users\Dane aplikacji\Skype\Plugins\Plugins\[u]0[/u]4B3EC9B2B5945A1B7AFC5FAFC297401\UninstallTalkingHeadz.exe
2009-04-14 09:31 . 2009-04-14 09:31 9871152 ----a-w- c:\documents and settings\All Users\Dane aplikacji\Skype\Plugins\Plugins\[u]0[/u]4B3EC9B2B5945A1B7AFC5FAFC297401\TalkingHeadzSetup.exe
2009-04-10 21:18 . 2009-04-10 21:18 249856 ------w- c:\windows\Setup1.exe
2009-04-10 21:17 . 2009-04-10 21:17 73216 ----a-w- c:\windows\ST6UNST.EXE
2009-04-06 18:32 . 2009-03-27 17:12 86327 ----a-w- c:\windows\pchealth\helpctr\OfflineCache\index.dat
2009-04-05 20:48 . 2009-04-05 20:48 4 ----a-w- c:\windows\system32\proc-220146841.bin
2009-04-03 20:55 . 2009-04-03 20:55 56 ---ha-w- c:\windows\system32\ezsidmv.dat
2009-03-29 11:42 . 2009-03-27 17:10 23016 ----a-w- c:\windows\system32\emptyregdb.dat
2009-03-29 11:10 . 2009-03-29 11:10 245 ----a-w- c:\windows\tmp6764828.bat
2009-03-28 00:56 . 2009-03-28 00:56 33824 ----a-w- c:\windows\system32\drivers\oreans32.sys
2009-03-27 18:08 . 2009-03-27 18:08 0 ----a-w- c:\windows\nsreg.dat
.
((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2004-08-03 15360]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2006-11-16 139264]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2009-04-16 24264488]
"AutoConnect"="c:\program files\AutoConnect\AutoConnect.exe" [2004-08-28 295424]
"Odkurzacz-MCD"="c:\program files\Odkurzacz\odk_mcd.exe" [2008-08-16 264704]
"Gadu-Gadu"="c:\program files\Gadu-Gadu\gg.exe" [2007-04-17 2113536]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-10-22 7700480]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-26 31016]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2006-10-22 86016]
"BigDog305"="c:\windows\VM305_STI.EXE" [2007-04-09 57344]
"USB Storage Toolbox"="c:\program files\USB Disk Win98 Driver\Res.EXE" [2005-09-14 65536]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-05-03 148888]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2009-02-05 81000]
"Systool"="c:\windows\smss.cmd" [2009-06-13 535651]
"SoundMan"="SOUNDMAN.EXE" - c:\windows\SOUNDMAN.EXE [2005-11-11 90112]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-03 15360]
c:\documents and settings\All Users\Menu Start\Programy\Autostart\
DSLMON.lnk - c:\program files\SAGEM\SAGEM F@st 800-840\dslmon.exe [2009-3-27 1205840]
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Gadu-Gadu\\gg.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Program Files\\Java\\jre6\\launch4j-tmp\\JDownloader.exe"=
"c:\\WINDOWS\\system32\\java.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
R0 pavboot;pavboot;c:\windows\system32\drivers\pavboot.sys [2009-05-22 28544]
R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2009-05-29 114768]
R1 SLEE_13_DRIVER;Steganos Live Encryption Engine 13 [Driver];c:\windows\system32\drivers\slee13.sys [2005-10-04 17:42 74240]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2009-05-29 20560]
R3 e4usbaw;USB ADSL2 WAN Adapter;c:\windows\system32\drivers\e4usbaw.sys [2009-03-27 104344]
R3 ZSMC0305;A4 TECH PC Camera V;c:\windows\system32\drivers\usbVM305.sys [2009-04-16 391688]
S2 AlerterALG;Urządzenie alarmowe AlerterALG;c:\documents and settings\Daniel\svchost.exe run --> c:\documents and settings\Daniel\svchost.exe run [?]
S2 E4LOADER;General Purpose USB Driver (e4ldr.sys);c:\windows\system32\drivers\e4ldr.sys [2009-03-27 69656]
S3 npggsvc;nProtect GameGuard Service;c:\windows\system32\GameMon.des -service --> c:\windows\system32\GameMon.des -service [?]
S3 NTProcDrv;Process creation detector for NT.;\??\c:\documents and settings\Daniel\Pulpit\NtProcDrv.sys --> c:\documents and settings\Daniel\Pulpit\NtProcDrv.sys [?]
S3 XDva224;XDva224;\??\c:\windows\system32\XDva224.sys --> c:\windows\system32\XDva224.sys [?]
.
- - - - USUNIĘTO PUSTE WPISY - - - -
HKU-Default-RunOnce-SSS2006 - c:\program files\Steganos Security Suite 2006\SSS2006.exe
.
------- Skan uzupełniający -------
.
uStart Page = hxxp://www.entretieneteds.vze.com
IE: E&ksportuj do programu Microsoft Excel - c:\progra~1\MICROS~1\Office12\EXCEL.EXE/3000
TCP: {874AB105-4D52-4A41-8B7B-EF3F7E13DF65} = 213.241.79.37 83.238.255.76
FF - ProfilePath -
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-06-19 11:22
Windows 5.1.2600 Dodatek Service Pack 2 NTFS
skanowanie ukrytych procesów ...
skanowanie ukrytych wpisów autostartu ...
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
BigDog305 = c:\windows\VM305_STI.EXE VIMICRO USB PC Camera (ZC0305)???????????????????0?????????@??????????????
skanowanie ukrytych plików ...
skanowanie pomyślnie ukończone
ukryte pliki: 0
**************************************************************************
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\npggsvc]
"ImagePath"="c:\windows\system32\GameMon.des -service"
.
--------------------- ZABLOKOWANE KLUCZE REJESTRU ---------------------
[HKEY_USERS\S-1-5-21-343818398-2077806209-725345543-1003\Software\Microsoft\SystemCertificates\AddressBook*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
.
--------------------- Pliki DLL ładowane pod uruchomionymi procesami ---------------------
- - - - - - - > 'explorer.exe'(2708)
c:\program files\Gadu-Gadu\ggwhook.dll
c:\windows\system32\browselc.dll
c:\program files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
c:\program files\Microsoft Office\Office12\1045\GrooveIntlResource.dll
.
------------------------ Pozostałe uruchomione procesy ------------------------
.
c:\program files\Alwil Software\Avast4\aswUpdSv.exe
c:\program files\Alwil Software\Avast4\ashServ.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\windows\system32\nvsvc32.exe
c:\windows\system32\wdfmgr.exe
c:\program files\Alwil Software\Avast4\ashMaiSv.exe
c:\program files\Alwil Software\Avast4\ashWebSv.exe
c:\windows\system32\rundll32.exe
c:\program files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
.
**************************************************************************
.
Czas ukończenia: 2009-06-19 11:27 - komputer został uruchomiony ponownie
ComboFix-quarantined-files.txt 2009-06-19 09:27
Przed: 16 803 692 544 bajtów wolnych
Po: 16 772 493 312 bajtów wolnych
254 --- E O F --- 2009-06-11 05:57
HijackThis :
- Kod: Zaznacz wszystko
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:30:18, on 2009-06-19
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\VM305_STI.EXE
C:\Program Files\USB Disk Win98 Driver\Res.EXE
C:\Program Files\Java\jre6\bin\jusched.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\smss.cmd
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
C:\Program Files\AutoConnect\AutoConnect.exe
C:\Program Files\Gadu-Gadu\gg.exe
C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.entretieneteds.vze.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~1\Office12\GRA8E1~1.DLL
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: IEPluginBHO - {F5CC7F02-6F4E-4462-B5B1-394A57FD3E0D} - C:\Documents and Settings\Daniel\Dane aplikacji\Nowe Gadu-Gadu\_userdata\ggbho.1.dll
O3 - Toolbar: (no name) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - (no file)
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [BigDog305] C:\WINDOWS\VM305_STI.EXE VIMICRO USB PC Camera (ZC0305)
O4 - HKLM\..\Run: [USB Storage Toolbox] C:\Program Files\USB Disk Win98 Driver\Res.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [Systool] C:\WINDOWS\smss.cmd
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [AutoConnect] C:\Program Files\AutoConnect\AutoConnect.exe
O4 - HKCU\..\Run: [Odkurzacz-MCD] C:\Program Files\Odkurzacz\odk_mcd.exe
O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: BootLogXP.lnk = C:\Program Files\Greatis\BootLog XP\BootLogXP.exe
O4 - Startup: smgr34.exe
O4 - Startup: Tworzenie wycinków ekranu i uruchamianie programu OneNote 2007.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
O8 - Extra context menu item: E&ksportuj do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~1\Office12\EXCEL.EXE/3000
O9 - Extra button: Wyślij do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Wyślij &do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~1\Office12\REFIEBAR.DLL
O17 - HKLM\System\CCS\Services\Tcpip\..\{874AB105-4D52-4A41-8B7B-EF3F7E13DF65}: NameServer = 213.241.79.37 83.238.255.76
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~1\Office12\GR99D3~1.DLL
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Urządzenie alarmowe AlerterALG (AlerterALG) - Unknown owner - C:\Documents and Settings\Daniel\svchost.exe (file missing)
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: nProtect GameGuard Service (npggsvc) - Unknown owner - C:\WINDOWS\system32\GameMon.des.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Cor :D poration - C:\WINDOWS\system32\nvsvc32.exe
--
End of file - 6813 bytes
Pomóżcie
