2x moje dokumenty i programy w pasku zadań

**Posty:** 58 · przez **Melkor** 18 Maj 2008, 11:02

Witam, mam pewien problem. Otóż, po uruchomieniu Windowsa wyskakują dwa okienka Moje Dokumenty, do tego (używam Xfire'a oraz Tlena) w pasku zadań widnieją właśnie te dwa programy. Nie działa na nie PPM >> Zamknij, po prostu są i nie da się z nimi nic zrobić. Mogę, oczywiście zakończyć ich procesy, ale wtedy wyłączę Tlena Xfire'a ,a tego nie chcę. Po prostu chcę żeby chodziły one w "tle".

Windows XP Professional Service Pack 2

Intel(R) Core(TM)2 Quad CPU Q9300 @ 2.50GHz (4 CPUs)

4096MB RAM

Antywirus: NOD32 (zapora wyłączona) - skanowane

Program antyszpiegowski: Spy Sweeper - skanowane

Jakieś propozycję?
Z góry dzięki

**Posty:** 7956 · przez **Magik** 18 Maj 2008, 15:16

takie cuda dot. "Moje dokumenty" powoduje

Kod: Zaznacz wszystko: psw.Sboy.a

wklej log z
http://forum.programosy.pl/hijackthis-amp-silent-runners-gtobsuga-i-umieszczanie-vt9452.html
i
http://forum.programosy.pl/jak-generujemy-logi-z-combofixa-oraz-dssa-vt95026.html

D!

**Posty:** 58 · przez **Melkor** 18 Maj 2008, 17:23

HiJackThis:

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 17:13:43, on 2008-05-17 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\EXPLORER.EXE C:\WINDOWS\RTHDCPL.EXE C:\WINDOWS\system32\RUNDLL32.EXE C:\Program Files\Creative\Shared Files\Module Loader\DLLML.exe C:\WINDOWS\CTHELPER.EXE C:\WINDOWS\system32\CTXFIHLP.EXE C:\Program Files\Creative\Sound Blaster X-Fi\Volume Panel\VolPanlu.exe C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe C:\Program Files\PowerISO\PWRISOVM.EXE C:\WINDOWS\SYSTEM32\CTXFISPI.EXE C:\Program Files\ESET\ESET Smart Security\egui.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\Winamp\winampa.exe C:\Program Files\HP\HP Software Update\HPWuSchd2.exe C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe C:\Program Files\Skype\Phone\Skype.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe C:\Program Files\Common Files\InterVideo\DeviceService\DevSvc.exe C:\WINDOWS\system32\CTsvcCDA.exe C:\Program Files\ESET\ESET Smart Security\ekrn.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe C:\Program Files\Marvell\61xx\svc\mvraidsvc.exe C:\Program Files\Marvell\61xx\Apache2\bin\Apache.exe C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe C:\WINDOWS\BricoPacks\Vista Inspirat 2\UberIcon\UberIcon Manager.exe C:\Program Files\Xfire\xfire.exe C:\Program Files\Marvell\61xx\Apache2\bin\Apache.exe C:\WINDOWS\BricoPacks\Vista Inspirat 2\YzShadow\YzShadow.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\IoctlSvc.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\PnkBstrA.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe C:\Program Files\PC Connectivity Solution\ServiceLayer.exe C:\WINDOWS\system32\wscntfy.exe C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\Skype\Plugin Manager\skypePM.exe C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe C:\WINDOWS\system32\wuauclt.exe C:\Program Files\Tlen.pl\tlen.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.trymicrosoftoffice.com/connect.aspx?cmd=office_ota&dialect_id=en-CA&app=officepro&ms_rs=ota&key_id=7ae647c5-96ac-495c-8453-c771535600a4&rtc=dell&key_type=trial R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = socks= R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza F2 - REG:system.ini: UserInit=userinit.exe,EXPLORER.EXE O2 - BHO: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files\HP\Smart Web Printing\hpswp_printenhancer.dll O2 - BHO: HP Print Clips - {053F9267-DC04-4294-A72C-58F732D338C0} - C:\Program Files\HP\Smart Web Printing\hpswp_framework.dll O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE O4 - HKLM\..\Run: [NvCplDaemon] "RUNDLL32.EXE" C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] "nwiz.exe" /install O4 - HKLM\..\Run: [NvMediaCenter] "RUNDLL32.EXE" C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [AudioDrvEmulator] "C:\Program Files\Creative\Shared Files\Module Loader\DLLML.exe" -1 AudioDrvEmulator "C:\Program Files\Creative\Shared Files\Module Loader\Audio Emulator\AudDrvEm.dll" O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE O4 - HKLM\..\Run: [CTxfiHlp] CTXFIHLP.EXE O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE O4 - HKLM\..\Run: [VolPanel] "C:\Program Files\Creative\Sound Blaster X-Fi\Volume Panel\VolPanlu.exe" /r O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [PWRISOVM.EXE] "C:\Program Files\PowerISO\PWRISOVM.EXE" O4 - HKLM\..\Run: [NeroFilterCheck] "C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe" O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" O4 - HKLM\..\Run: [BootSkin Startup Jobs] "C:\PROGRA~1\Stardock\WINCUS~1\BootSkin\BootSkin.exe" /StartupJobs O4 - HKLM\..\Run: [LogonStudio] "C:\Program Files\WinCustomize\LogonStudio\logonstudio.exe" /RANDOM O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET Smart Security\egui.exe" /hide /waitservice O4 - HKLM\..\Run: [PCSuiteTrayApplication] "C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe" -startup O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [UVS11 Preload] "C:\Program Files\Ulead Systems\Ulead VideoStudio 11\uvPL.exe" O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe" O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" O4 - HKLM\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe" /startintray O4 - HKCU\..\Run: [Komunikator] C:\Program Files\Tlen.pl\tlen.exe O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized O4 - HKCU\..\Run: [IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" ASO-616B5711-6DAE-4795-A05F-39A1E5104020 O4 - HKCU\..\Run: [wsctf.exe] wsctf.exe O4 - HKCU\..\Run: [EXPLORER.EXE] EXPLORER.EXE O4 - HKUS\S-1-5-18\..\Run: [PcSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [PcSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog (User 'Default user') O4 - Startup: RocketDock.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe O4 - Startup: TransBar.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat 2\TransBar\TransBar.exe O4 - Startup: UberIcon.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat 2\UberIcon\UberIcon Manager.exe O4 - Startup: Xfire.lnk = C:\Program Files\Xfire\xfire.exe O4 - Startup: Y'z Shadow.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat 2\YzShadow\YzShadow.exe O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe O8 - Extra context menu item: E&ksportuj do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra button: Kolekcja wycinków HP - {58ECB495-38F0-49cb-A538-10282ABF65E7} - C:\Program Files\HP\Smart Web Printing\hpswp_extensions.dll O9 - Extra button: Zaznaczanie HP Smart - {700259D7-1666-479a-93B1-3250410481E8} - C:\Program Files\HP\Smart Web Printing\hpswp_extensions.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/softwareupdate/su2/ocx/15035/CTPID.cab O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O20 - AppInit_DLLs: C:\PROGRA~1\KASPER~1\KASPER~1.0\adialhk.dll O23 - Service: Urządzenie mobilne Apple (Apple Mobile Device) - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: Capture Device Service - InterVideo Inc. - C:\Program Files\Common Files\InterVideo\DeviceService\DevSvc.exe O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET Smart Security\ekrn.exe O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: Usługa iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: Marvell RAID Event Agent (Marvell RAID) - Unknown owner - C:\Program Files\Marvell\61xx\svc\mvraidsvc.exe O23 - Service: MRU Web Service (MRUWebService) - Apache Software Foundation - C:\Program Files\Marvell\61xx\Apache2\bin\Apache.exe O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: PLFlash DeviceIoControl Service - Prolific Technology Inc. - C:\WINDOWS\system32\IoctlSvc.exe O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe O23 - Service: Webroot Spy Sweeper Engine (WebrootSpySweeperService) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe

Combofix

Kod: Zaznacz wszystko: ComboFix 08-05-15.3 - Mateusz 2008-05-17 17:18:04.1 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.1999 [GMT 2:00] Running from: C:\Documents and Settings\Mateusz\Moje dokumenty\Wszystko po trochu\ComboFix.exe * Created a new restore point * Resident AV is active [color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color] . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\Documents and Settings\All Users\Menu Start\Programy\BulletProofSoft.com C:\Documents and Settings\All Users\Menu Start\Programy\BulletProofSoft.com\Youtube Video Grabber\Help.lnk C:\Documents and Settings\All Users\Menu Start\Programy\BulletProofSoft.com\Youtube Video Grabber\Uninstall.lnk C:\Documents and Settings\All Users\Menu Start\Programy\BulletProofSoft.com\Youtube Video Grabber\Video Grabber.lnk C:\Documents and Settings\Mama\Ustawienia lokalne\Dane aplikacji\Microsoft\Windows Media\10.0\WMSDKNSD.XML C:\Program Files\BulletProofSoft.com C:\Program Files\BulletProofSoft.com\Youtube Video Grabber\Clip.exe C:\Program Files\BulletProofSoft.com\Youtube Video Grabber\Help.chm C:\Program Files\BulletProofSoft.com\Youtube Video Grabber\Main.swf C:\Program Files\BulletProofSoft.com\Youtube Video Grabber\Parse.wvi C:\Program Files\BulletProofSoft.com\Youtube Video Grabber\unins000.dat C:\Program Files\BulletProofSoft.com\Youtube Video Grabber\unins000.exe C:\Program Files\BulletProofSoft.com\Youtube Video Grabber\YG VideoGrabber.exe C:\WINDOWS\system32\AutoRun.inf . ((((((((((((((((((((((((( Files Created from 2008-04-17 to 2008-05-17 ))))))))))))))))))))))))))))))) . 2008-05-17 17:13 . 2008-05-17 17:13 <DIR> d-------- C:\Program Files\Trend Micro 2008-05-17 01:28 . 2008-05-17 01:29 <DIR> d-------- C:\Program Files\Sky Games 2008-05-17 01:28 . 2008-05-17 01:28 <DIR> d-------- C:\Program Files\Common Files\Oberon Media 2008-05-17 00:04 . 2008-05-17 10:39 664 --a------ C:\WINDOWS\system32\d3d9caps.dat 2008-05-17 00:04 . 2008-05-17 00:04 552 --a------ C:\WINDOWS\system32\d3d8caps.dat 2008-05-16 21:08 . 2008-05-16 21:08 <DIR> d-------- C:\Program Files\Black Isle 2008-05-16 21:08 . 1998-10-07 12:54 327,168 --a------ C:\WINDOWS\IsUn0415.exe 2008-05-16 20:19 . 2008-05-16 20:19 <DIR> d-------- C:\WINDOWS\Sun 2008-05-16 20:18 . 2008-05-16 20:18 <DIR> d-------- C:\Program Files\Java 2008-05-16 20:18 . 2008-05-16 20:18 <DIR> d-------- C:\Program Files\Common Files\Java 2008-05-16 20:18 . 2008-02-22 02:33 69,632 --a------ C:\WINDOWS\system32\javacpl.cpl 2008-05-16 12:17 . 2008-05-17 00:42 <DIR> d-------- C:\Fraps 2008-05-16 12:17 . 2008-05-17 01:28 <DIR> d-a------ C:\Documents and Settings\All Users\Dane aplikacji\TEMP 2008-05-16 12:07 . 2008-05-16 12:07 <DIR> d-------- C:\Program Files\Webroot 2008-05-16 12:07 . 2008-05-16 12:07 <DIR> d-------- C:\Documents and Settings\Mateusz\Dane aplikacji\Webroot 2008-05-16 12:07 . 2008-05-16 12:07 <DIR> d-------- C:\Documents and Settings\LocalService\Dane aplikacji\Webroot 2008-05-16 12:07 . 2008-05-16 12:07 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Webroot 2008-05-16 12:07 . 2008-01-04 20:56 1,526,640 --a------ C:\WINDOWS\WRSetup.dll 2008-05-16 12:07 . 2008-01-04 20:34 163,696 --a------ C:\WINDOWS\system32\drivers\ssidrv.sys 2008-05-16 12:07 . 2008-01-04 20:34 23,920 --a------ C:\WINDOWS\system32\drivers\sskbfd.sys 2008-05-16 12:07 . 2008-01-04 20:34 21,872 --a------ C:\WINDOWS\system32\drivers\sshrmd.sys 2008-05-16 12:07 . 2008-01-04 20:34 20,336 --a------ C:\WINDOWS\system32\drivers\SSFS0BB9.sys 2008-05-15 22:14 . 2008-05-15 22:14 <DIR> d-------- C:\Program Files\Common Files\Screaming Bee 2008-05-15 22:14 . 2008-05-15 22:14 <DIR> d-------- C:\Documents and Settings\Mateusz\Dane aplikacji\Screaming Bee 2008-05-15 21:46 . 2008-05-15 21:47 <DIR> d-------- C:\vcs5core 2008-05-15 21:46 . 2008-05-15 21:46 <DIR> d-------- C:\vcs5BGEffects 2008-05-15 21:46 . 2008-05-15 21:46 <DIR> d-------- C:\AV_LOGS 2008-05-15 21:25 . 2008-05-16 21:40 2,940 --a------ C:\drmHeader.bin 2008-05-14 20:29 . 2008-05-14 20:29 <DIR> d-------- C:\Program Files\Codec Pack - All In 1 2008-05-14 16:34 . 2008-05-14 16:34 <DIR> d-------- C:\Program Files\Widget Magnum 2008-05-14 16:34 . 2008-05-14 16:34 <DIR> d-------- C:\Program Files\Common Files\Adobe AIR 2008-05-14 15:35 . 2008-05-14 15:35 <DIR> d-------- C:\Documents and Settings\Mateusz\Dane aplikacji\Apple Computer 2008-05-14 01:03 . 2008-05-14 01:03 <DIR> d-------- C:\Downloaded Videos 2008-05-14 01:02 . 2007-06-11 22:04 2,267,368 --a------ C:\WINDOWS\system32\Flash.ocx 2008-05-14 01:02 . 2002-03-04 12:27 1,140,472 --a------ C:\WINDOWS\system32\IGUltraGrid20.ocx 2008-05-14 01:02 . 2004-03-08 23:00 131,856 --a------ C:\WINDOWS\system32\MSADODC.ocx 2008-05-14 01:02 . 2000-07-15 05:00 101,888 --a------ C:\WINDOWS\system32\VB6STKIT.DLL 2008-05-14 01:02 . 2001-04-20 01:28 28,672 --a------ C:\WINDOWS\system32\SysTray.ocx 2008-05-13 23:17 . 2008-05-13 23:17 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\FLEXnet 2008-05-13 22:19 . 2008-05-13 22:19 <DIR> d-------- C:\Documents and Settings\Mateusz\Dane aplikacji\DivX 2008-05-13 22:18 . 2008-05-13 22:18 <DIR> d-------- C:\Program Files\Mozilla Firefox 3 Beta 5 2008-05-13 22:18 . 2008-05-13 22:18 <DIR> d-------- C:\Program Files\DivX 2008-05-13 22:18 . 2008-03-21 22:30 120,056 --------- C:\WINDOWS\system32\pxcpyi64.exe 2008-05-13 22:18 . 2008-03-21 22:30 118,520 --------- C:\WINDOWS\system32\pxinsi64.exe 2008-05-13 22:09 . 2008-05-13 22:09 <DIR> d-------- C:\Program Files\Xvid 2008-05-13 22:09 . 2007-06-28 18:52 765,952 --a------ C:\WINDOWS\system32\xvidcore.dll 2008-05-13 22:09 . 2007-06-28 18:54 180,224 --a------ C:\WINDOWS\system32\xvidvfw.dll 2008-05-13 21:39 . 2008-05-13 21:39 <DIR> d---s---- C:\Documents and Settings\Mateusz\UserData 2008-05-13 21:28 . 2008-05-13 21:28 <DIR> d-------- C:\Documents and Settings\Mateusz\Dane aplikacji\HP 2008-05-13 21:26 . 2008-05-13 21:26 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\WEBREG 2008-05-13 21:26 . 2008-05-13 21:26 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Hewlett-Packard 2008-05-13 21:26 . 2007-03-08 06:20 49,920 -ra------ C:\WINDOWS\system32\drivers\HPZid412.sys 2008-05-13 21:26 . 2007-03-08 06:20 16,496 -ra------ C:\WINDOWS\system32\drivers\HPZipr12.sys 2008-05-13 21:25 . 2007-03-17 18:11 675,840 -ra------ C:\WINDOWS\system32\hpowiax3.dll 2008-05-13 21:25 . 2007-03-17 18:11 569,344 -ra------ C:\WINDOWS\system32\hpotscl3.dll 2008-05-13 21:25 . 2007-03-08 06:20 364,544 -ra------ C:\WINDOWS\system32\hppldcoi.dll 2008-05-13 21:25 . 2007-03-08 06:20 309,760 -ra------ C:\WINDOWS\system32\difxapi.dll 2008-05-13 21:25 . 2007-03-17 18:11 303,104 -ra------ C:\WINDOWS\system32\hpovst10.dll 2008-05-13 21:25 . 2007-03-30 17:07 267,864 -ra------ C:\WINDOWS\system32\hpzids01.dll 2008-05-13 21:25 . 2007-03-28 14:01 117,760 --a------ C:\WINDOWS\system32\hpzll5ha.dll 2008-05-13 21:25 . 2007-03-08 06:20 21,568 -ra------ C:\WINDOWS\system32\drivers\HPZius12.sys 2008-05-13 21:15 . 2008-05-13 21:15 <DIR> d-------- C:\Documents and Settings\Mateusz\Dane aplikacji\HPAppData 2008-05-13 21:15 . 2008-05-13 21:15 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\HPSSUPPLY 2008-05-13 21:14 . 2008-05-13 21:14 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\HP Product Assistant 2008-05-13 21:14 . 2008-05-13 21:14 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\HP 2008-05-13 21:13 . 2008-05-13 21:13 <DIR> d-------- C:\Program Files\Hewlett-Packard 2008-05-13 21:13 . 2008-05-13 21:13 <DIR> d-------- C:\Program Files\Common Files\HP 2008-05-13 21:13 . 2008-05-13 21:13 <DIR> d-------- C:\Program Files\Common Files\Hewlett-Packard 2008-05-13 21:12 . 2008-05-13 21:15 <DIR> d-------- C:\Program Files\HP 2008-05-13 21:12 . 2004-08-03 23:01 25,856 --a------ C:\WINDOWS\system32\drivers\usbprint.sys 2008-05-13 21:12 . 2004-08-03 23:01 25,856 --a--c--- C:\WINDOWS\system32\dllcache\usbprint.sys 2008-05-13 21:10 . 2008-05-13 21:26 153,522 --a------ C:\WINDOWS\hpoins14.dat 2008-05-13 21:10 . 2007-06-06 01:07 2,000 --------- C:\WINDOWS\hpomdl14.dat 2008-05-13 17:55 . 2008-05-13 17:55 <DIR> d-------- C:\Program Files\MarBit 2008-05-13 16:52 . 2008-05-13 16:52 <DIR> d-------- C:\WINDOWS\system32\QuickTime 2008-05-13 16:52 . 2008-05-13 16:52 <DIR> d-------- C:\Program Files\TechSmith 2008-05-13 16:52 . 2008-05-13 16:52 <DIR> d-------- C:\Program Files\Common Files\TechSmith Shared 2008-05-13 16:52 . 2008-05-13 16:52 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\TechSmith 2008-05-13 16:52 . 2008-03-12 02:37 107,864 --a------ C:\WINDOWS\system32\tsccvid.dll 2008-05-13 16:29 . 2008-05-04 12:28 60,273 --a------ C:\WINDOWS\system32\pthreadGC2.dll 2008-05-13 16:29 . 2008-05-04 12:28 7,680 --a------ C:\WINDOWS\system32\ff_vfw.dll 2008-05-13 16:29 . 2008-05-04 12:28 547 --a------ C:\WINDOWS\system32\ff_vfw.dll.manifest 2008-05-13 16:23 . 2003-03-19 11:03 544,768 --a------ C:\WINDOWS\system32\msvcr71d.dll 2008-05-13 16:23 . 2002-01-05 14:37 344,064 --a------ C:\WINDOWS\system32\msvcr70.dll 2008-05-13 16:22 . 2008-05-13 16:25 <DIR> d-------- C:\Program Files\Magic Video Converter 2008-05-13 16:22 . 2004-05-26 21:37 719,872 --a------ C:\WINDOWS\system32\devil.dll 2008-05-13 16:22 . 2006-09-16 19:44 314,368 --a------ C:\WINDOWS\system32\avisynth.dll 2008-05-13 14:58 . 2004-08-04 00:44 91,136 --a------ C:\WINDOWS\system32\kswdmcap.ax 2008-05-13 14:58 . 2004-08-04 00:44 91,136 --a--c--- C:\WINDOWS\system32\dllcache\kswdmcap.ax 2008-05-13 14:58 . 2004-08-04 00:44 61,952 --a------ C:\WINDOWS\system32\kstvtune.ax 2008-05-13 14:58 . 2004-08-04 00:44 61,952 --a--c--- C:\WINDOWS\system32\dllcache\kstvtune.ax 2008-05-13 14:58 . 2004-08-04 00:44 54,784 --a------ C:\WINDOWS\system32\vfwwdm32.dll 2008-05-13 14:58 . 2004-08-04 00:44 54,784 --a--c--- C:\WINDOWS\system32\dllcache\vfwwdm32.dll 2008-05-13 14:58 . 2004-08-04 00:44 43,008 --a------ C:\WINDOWS\system32\ksxbar.ax 2008-05-13 14:58 . 2004-08-04 00:44 43,008 --a--c--- C:\WINDOWS\system32\dllcache\ksxbar.ax 2008-05-13 14:58 . 2004-08-04 00:44 28,672 --a------ C:\WINDOWS\system32\vidcap.ax 2008-05-13 14:58 . 2004-08-04 00:44 28,672 --a--c--- C:\WINDOWS\system32\dllcache\vidcap.ax 2008-05-13 14:58 . 2004-08-03 22:58 5,376 --a------ C:\WINDOWS\system32\MSPCLOCK.sys 2008-05-13 14:56 . 2004-08-03 23:08 31,616 --a------ C:\WINDOWS\system32\drivers\usbccgp.sys 2008-05-13 14:56 . 2004-08-03 23:08 31,616 --a--c--- C:\WINDOWS\system32\dllcache\usbccgp.sys 2008-05-13 14:49 . 2008-05-13 14:49 <DIR> d-------- C:\Drivers 2008-05-13 14:49 . 2001-11-05 09:23 299,923 --a------ C:\WINDOWS\system32\drivers\sonyhcs.sys 2008-05-13 14:49 . 2002-10-15 22:41 102,220 --a------ C:\WINDOWS\system32\drivers\sonypvs1.sys 2008-05-13 14:49 . 2001-07-03 20:33 53,248 --a------ C:\WINDOWS\system32\SONYHCY.DLL 2008-05-13 14:49 . 2001-11-05 09:23 38,739 --a------ C:\WINDOWS\system32\drivers\sonyhcc.sys 2008-05-13 14:49 . 2001-11-05 09:23 6,097 --a------ C:\WINDOWS\system32\drivers\sonyhcb.sys 2008-05-13 14:49 . 2001-07-03 20:39 3,654 --a------ C:\WINDOWS\system32\drivers\Sonyhcp.dll 2008-05-13 14:42 . 2008-05-13 14:48 <DIR> d-------- C:\Documents and Settings\Mateusz\Dane aplikacji\Ulead Systems 2008-05-13 14:41 . 2008-05-13 14:41 <DIR> d-------- C:\Program Files\Windows Media Components 2008-05-13 14:41 . 2008-05-13 14:41 <DIR> d-------- C:\Program Files\Common Files\InterVideo 2008-05-13 14:41 . 2008-05-13 14:41 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\InterVideo 2008-05-13 14:41 . 2007-03-27 19:56 210,456 --a------ C:\WINDOWS\system32\IVIresizeW7.dll 2008-05-13 14:41 . 2007-03-27 19:56 206,360 --a------ C:\WINDOWS\system32\IVIresizeA6.dll 2008-05-13 14:41 . 2007-03-27 19:56 198,168 --a------ C:\WINDOWS\system32\IVIresizeP6.dll 2008-05-13 14:41 . 2007-03-27 19:56 198,168 --a------ C:\WINDOWS\system32\IVIresizeM6.dll 2008-05-13 14:41 . 2007-03-27 19:56 194,072 --a------ C:\WINDOWS\system32\IVIresizePX.dll 2008-05-13 14:41 . 2007-03-27 19:56 26,136 --a------ C:\WINDOWS\system32\IVIresize.dll 2008-05-13 14:40 . 2008-05-13 14:40 <DIR> d-------- C:\Program Files\Ulead Systems 2008-05-13 14:40 . 2008-05-13 14:41 <DIR> d-------- C:\Program Files\Common Files\Ulead Systems 2008-05-13 14:40 . 2008-05-13 14:42 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Ulead Systems 2008-05-13 09:48 . 2008-05-13 09:48 <DIR> d-------- C:\Documents and Settings\Mama\Dane aplikacji\PC Suite 2008-05-13 08:31 . 2008-05-17 17:09 54,156 --ah----- C:\WINDOWS\QTFont.qfn 2008-05-13 08:31 . 2008-05-13 08:31 1,409 --a------ C:\WINDOWS\QTFont.for 2008-05-13 08:30 . 2008-05-13 08:30 <DIR> d-------- C:\Program Files\iTunes 2008-05-13 08:30 . 2008-05-13 08:30 <DIR> d-------- C:\Program Files\iPod . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-05-13 12:49 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-05-08 20:14 6,643,712 ----a-w C:\WINDOWS\system32\logonuiX.exe 2008-04-23 17:35 --------- d-----w C:\Program Files\Common Files\InstallShield 2008-04-18 15:17 278,984 ----a-w C:\WINDOWS\system32\drivers\atksgt.sys 2008-04-18 15:17 25,416 ----a-w C:\WINDOWS\system32\drivers\lirsgt.sys 2008-04-18 13:17 --------- d--h--w C:\Program Files\Creative Installation Information 2008-04-18 13:15 --------- d-----w C:\Program Files\Creative 2008-04-18 13:12 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Creative 2008-04-17 18:04 219,648 ----a-w C:\WINDOWS\system32\uxtheme.dll 2008-04-16 12:07 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Microsoft Help 2008-04-16 12:05 --------- d-----w C:\Program Files\Activation Assistant for the 2007 Microsoft Office suites 2008-04-16 12:05 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\{623D32E9-0C62-4453-AD44-98B31F52A5E1} 2008-04-16 12:00 --------- d-----w C:\Program Files\Microsoft Works 2008-04-16 11:21 --------- d-----w C:\Documents and Settings\Administrator\Dane aplikacji\Creative 2008-04-16 11:17 --------- d-----w C:\Program Files\Common Files\Creative 2008-04-16 11:14 86,016 ----a-w C:\WINDOWS\system32\OpenAL32.dll 2008-04-16 11:14 409,600 ----a-w C:\WINDOWS\system32\wrap_oal.dll 2008-04-16 11:06 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\nView_Profiles 2008-04-16 11:04 --------- d-----w C:\Program Files\My Company Name 2008-04-15 14:51 --------- d-----w C:\Program Files\Marvell 2008-04-15 14:38 --------- d-----w C:\Program Files\Attansic 2008-04-15 14:30 --------- d-----w C:\Program Files\Realtek 2008-04-15 13:43 315,392 ----a-w C:\WINDOWS\HideWin.exe 2008-04-15 13:42 --------- d-----w C:\Program Files\Intel 2008-04-15 13:32 --------- d-----w C:\Program Files\microsoft frontpage 2008-04-15 13:31 --------- d-----w C:\Program Files\Usługi online 2008-03-31 21:25 831,488 ----a-w C:\WINDOWS\system32\divx_xx0a.dll 2008-03-31 21:25 823,296 ----a-w C:\WINDOWS\system32\divx_xx0c.dll 2008-03-31 21:25 823,296 ----a-w C:\WINDOWS\system32\divx_xx07.dll 2008-03-31 21:25 802,816 ----a-w C:\WINDOWS\system32\divx_xx11.dll 2008-03-31 21:25 682,496 ----a-w C:\WINDOWS\system32\DivX.dll 2008-03-31 21:25 161,096 ----a-w C:\WINDOWS\system32\DivXCodecVersionChecker.exe 2008-03-21 20:30 3,596,288 ----a-w C:\WINDOWS\system32\qt-dx331.dll 2008-03-21 20:30 200,704 ----a-w C:\WINDOWS\system32\ssldivx.dll 2008-03-21 20:30 129,784 ------w C:\WINDOWS\system32\pxafs.dll 2008-03-21 20:30 1,044,480 ----a-w C:\WINDOWS\system32\libdivx.dll 2008-03-21 20:28 81,920 ----a-w C:\WINDOWS\system32\dpl100.dll 2008-03-21 20:28 593,920 ----a-w C:\WINDOWS\system32\dpuGUI11.dll 2008-03-21 20:28 57,344 ----a-w C:\WINDOWS\system32\dpv11.dll 2008-03-21 20:28 53,248 ----a-w C:\WINDOWS\system32\dpuGUI10.dll 2008-03-21 20:28 344,064 ----a-w C:\WINDOWS\system32\dpus11.dll 2008-03-21 20:28 294,912 ----a-w C:\WINDOWS\system32\dpu11.dll 2008-03-21 20:28 294,912 ----a-w C:\WINDOWS\system32\dpu10.dll 2008-03-21 20:28 196,608 ----a-w C:\WINDOWS\system32\dtu100.dll 2008-03-21 20:28 12,288 ----a-w C:\WINDOWS\system32\DivXWMPExtType.dll 2008-03-12 18:27 50,520 ----a-w C:\WINDOWS\system32\csvidcap.dll 2008-02-28 15:38 972,072 ----a-w C:\WINDOWS\UNNeroMediaHome.exe 2008-02-26 14:14 972,072 ----a-w C:\WINDOWS\UNRecode.exe 2008-02-18 14:04 95,600 ----a-w C:\WINDOWS\system32\NeroCo.dll 2006-06-23 06:48 32,768 ----a-r C:\WINDOWS\inf\UpdateUSB.exe 2004-09-28 02:00 26,240 ----a-w C:\WINDOWS\inf\RAMDSK.SYS . ------- Sigcheck ------- 2007-08-02 14:00 693248 7d46293106e58ca7878509ccc4071f2f C:\WINDOWS\system32\wininet.dll 2007-08-02 14:00 975872 196c130d31317fe53de984220b5e13b9 C:\WINDOWS\explorer.exe . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Komunikator"="C:\Program Files\Tlen.pl\tlen.exe" [2008-01-15 17:09 6290944] "Skype"="C:\Program Files\Skype\Phone\Skype.exe" [2008-02-06 18:21 21898024] "IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" [2008-02-28 17:07 1828136] "wsctf.exe"="wsctf.exe" [] "EXPLORER.EXE"="EXPLORER.EXE" [2007-08-02 14:00 975872 C:\WINDOWS\explorer.exe] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "RTHDCPL"="RTHDCPL.EXE" [2007-03-21 08:49 16126464 C:\WINDOWS\RTHDCPL.exe] "NvCplDaemon"="RUNDLL32.exe" [2007-08-02 14:00 33280 C:\WINDOWS\system32\rundll32.exe] "nwiz"="nwiz.exe" [2008-01-10 13:20 1626112 C:\WINDOWS\system32\nwiz.exe] "NvMediaCenter"="RUNDLL32.exe" [2007-08-02 14:00 33280 C:\WINDOWS\system32\rundll32.exe] "AudioDrvEmulator"="C:\Program Files\Creative\Shared Files\Module Loader\DLLML.exe" [2005-11-04 18:07 49152] "CTHelper"="CTHELPER.EXE" [2006-05-24 06:20 17920 C:\WINDOWS\CTHELPER.EXE] "CTxfiHlp"="CTXFIHLP.EXE" [2006-05-24 06:20 18944 C:\WINDOWS\system32\CTXFIHLP.EXE] "UpdReg"="C:\WINDOWS\UpdReg.EXE" [2000-05-11 01:00 90112] "VolPanel"="C:\Program Files\Creative\Sound Blaster X-Fi\Volume Panel\VolPanlu.exe" [2006-07-13 14:11 122880] "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 22:16 39792] "PWRISOVM.EXE"="C:\Program Files\PowerISO\PWRISOVM.EXE" [2008-03-15 01:50 233472] "NeroFilterCheck"="C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe" [2008-02-28 09:59 570664] "NBKeyScan"="C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" [2008-02-18 16:29 2221352] "BootSkin Startup Jobs"="C:\PROGRA~1\Stardock\WINCUS~1\BootSkin\BootSkin.exe" [2004-04-26 16:21 270336] "LogonStudio"="C:\Program Files\WinCustomize\LogonStudio\logonstudio.exe" [2002-09-03 18:38 987187] "egui"="C:\Program Files\ESET\ESET Smart Security\egui.exe" [2008-03-13 16:48 1443072] "PCSuiteTrayApplication"="C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe" [2006-11-28 14:12 222720] "QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-03-28 23:37 413696] "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-03-30 10:36 267048] "UVS11 Preload"="C:\Program Files\Ulead Systems\Ulead VideoStudio 11\uvPL.exe" [2007-09-12 12:17 340136] "WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2008-04-01 20:49 36352] "HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2007-03-11 21:34 49152] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 04:25 144784] "SpySweeper"="C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe" [2008-01-04 20:56 5367664] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "PcSync"="C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2006-11-09 17:15 1634304] C:\Documents and Settings\Administrator\Menu Start\Programy\Autostart\ RocketDock.lnk - C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe [2007-03-19 00:05:02 630784] TransBar.lnk - C:\WINDOWS\BricoPacks\Vista Inspirat 2\TransBar\TransBar.exe [2005-06-01 21:41:18 65536] UberIcon.lnk - C:\WINDOWS\BricoPacks\Vista Inspirat 2\UberIcon\UberIcon Manager.exe [2006-05-21 09:43:08 180224] Xfire.lnk - C:\Program Files\Xfire\xfire.exe [2008-04-23 00:29:52 2998608] Y'z Shadow.lnk - C:\WINDOWS\BricoPacks\Vista Inspirat 2\YzShadow\YzShadow.exe [2006-05-21 09:43:14 155648] C:\Documents and Settings\Mateusz\Menu Start\Programy\Autostart\ RocketDock.lnk - C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe [2007-03-19 00:05:02 630784] TransBar.lnk - C:\WINDOWS\BricoPacks\Vista Inspirat 2\TransBar\TransBar.exe [2005-06-01 21:41:18 65536] UberIcon.lnk - C:\WINDOWS\BricoPacks\Vista Inspirat 2\UberIcon\UberIcon Manager.exe [2006-05-21 09:43:08 180224] Xfire.lnk - C:\Program Files\Xfire\xfire.exe [2008-04-23 00:29:52 2998608] Y'z Shadow.lnk - C:\WINDOWS\BricoPacks\Vista Inspirat 2\YzShadow\YzShadow.exe [2006-05-21 09:43:14 155648] C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\ HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2007-03-11 21:26:24 210520] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon] "UIHost"="C:\\WINDOWS\\system32\\logonuiX.exe" [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "AppInit_DLLs"=C:\PROGRA~1\KASPER~1\KASPER~1.0\adialhk.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "VIDC.XFR1"= xfcodec.dll "msacm.dvacm"= C:\PROGRA~1\COMMON~1\ULEADS~1\Vio\Dvacm.acm "msacm.MPEGacm"= C:\PROGRA~1\COMMON~1\ULEADS~1\MPEG\MPEGacm.acm "msacm.ulmp3acm"= C:\PROGRA~1\COMMON~1\ULEADS~1\MPEG\ulmp3acm.acm [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "C:\\Program Files\\Marvell\\61xx\\Apache2\\bin\\Apache.exe"= "C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"= "C:\\Program Files\\Tlen.pl\\tlen.exe"= "C:\\Program Files\\Xfire\\xfire.exe"= "C:\\Program Files\\uTorrent\\uTorrent.exe"= "C:\\Documents and Settings\\Mateusz\\Moje dokumenty\\Wszystko po trochu\\Call of Duty\\CoDMP.exe"= "C:\\WINDOWS\\system32\\PnkBstrA.exe"= "C:\\WINDOWS\\system32\\PnkBstrB.exe"= "C:\\Program Files\\eMule\\emule.exe"= "C:\\Program Files\\BitTorrent\\bittorrent.exe"= "C:\\Program Files\\DNA\\btdna.exe"= "C:\\Program Files\\Activision\\Call of Duty 4 - Modern Warfare\\iw3mp.exe"= "C:\\Program Files\\The All-Seeing Eye\\eye.exe"= "C:\\Program Files\\Electronic Arts\\Crytek\\Crysis\\Bin32\\Crysis.exe"= "C:\\Program Files\\Electronic Arts\\Crytek\\Crysis\\Bin32\\CrysisDedicatedServer.exe"= "C:\\Program Files\\Bonjour\\mDNSResponder.exe"= "C:\\Program Files\\iTunes\\iTunes.exe"= "C:\\Program Files\\Skype\\Phone\\Skype.exe"= R0 mv61xx;mv61xx;C:\WINDOWS\system32\DRIVERS\mv61xx.sys [2007-05-25 05:35] R2 Marvell RAID;Marvell RAID Event Agent;C:\Program Files\Marvell\61xx\svc\mvraidsvc.exe [2007-04-21 00:40] R2 MRUWebService;MRU Web Service;"C:\Program Files\Marvell\61xx\Apache2\bin\Apache.exe" -k runservice [] R3 AtcL001;NDIS Miniport Driver for Attansic L1 Gigabit Ethernet Controller;C:\WINDOWS\system32\DRIVERS\atl01_xp.sys [2007-03-15 08:12] R3 DFE528TX;D-Link DFE-528TX PCI Adapter;C:\WINDOWS\system32\DRIVERS\DLKRTL.SYS [2002-06-24 06:30] R3 ha20x2k;Creative 20X HAL Driver;C:\WINDOWS\system32\drivers\ha20x2k.sys [2006-05-24 05:40] S3 SCREAMINGBDRIVER;Screaming Bee Audio;C:\WINDOWS\system32\drivers\ScreamingBAudio.sys [] S3 sonypvs1;Sony Digital Imaging Video2;C:\WINDOWS\system32\DRIVERS\sonypvs1.sys [2002-10-15 22:41] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12 hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc *Newly Created Service* - CATCHME . Contents of the 'Scheduled Tasks' folder "2008-05-13 06:29:34 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job" - C:\Program Files\Apple Software Update\SoftwareUpdate.exe . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-05-17 17:20:50 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2008-05-17 17:21:41 ComboFix-quarantined-files.txt 2008-05-17 15:21:31 Pre-Run: 418,077,274,112 bajtów wolnych Post-Run: 418,934,128,640 bajtów wolnych 325

**Posty:** 7956 · przez **Magik** 18 Maj 2008, 17:42

co do HJT

Kod: Zaznacz wszystko: O4 - HKCU\..\Run: [wsctf.exe] wsctf.exe O4 - HKCU\..\Run: [EXPLORER.EXE] EXPLORER.EXE

w trybie awaryjnym kasujesz te wpisy, bo trojanek siedzi az milo :!:

**Posty:** 58 · przez **Melkor** 18 Maj 2008, 20:31

przykro mi ale nie jestem do konca obeznany w tych sprawach.
jak te wpisy wykasować, gdy już jestem w trybie awaryjnym?

**Posty:** 7956 · przez **Magik** 18 Maj 2008, 20:42

Melkor napisał(a):przykro mi ale nie jestem do konca obeznany w tych sprawach.
jak te wpisy wykasować, gdy już jestem w trybie awaryjnym?

http://forum.programosy.pl/hijackthis-amp-silent-runners-gtobsuga-i-umieszczanie-vt9452.html

punkt 4//usuwanie szkodliwych wpisow

Po usnieciu wpisow///zrob jeszcze taka operacje made by okocza:
1. Ściągnij OTMoveIt i go włacz i odpal go z opcji CleanUp

2. wykonaj optymalizację windowsa
3.sciagnij ATF_Cleaner
zaznacz
Windows Temp
All users Temp
Temporary internet files
Recycle Bin
i wcisnij EMPTY SELECTED
4.Wyłącz przywracanie systemu ( właściwości mój komputer-zakładka przywracanie - wyłącz przywracanie na wszystkich dyskach). Po chwili włącz je powrotem

**Posty:** 58 · przez **Melkor** 19 Maj 2008, 15:26

Dzięki czarodzieju;) wszystko pyka, po wirusach ani śladu:)

**Posty:** 5 · przez **sobolx** 12 Cze 2008, 12:54

witam
mam podobny problem do kolegi wyżej, otwierają mi się przy starcie 2 okna moich dokumentów.
logi:
combofix:

ComboFix 08-06-10.5 - Sobol 2008-06-12 12:06:45.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1250.1.1045.18.569 [GMT 2:00]
Running from: C:\Documents and Settings\Sobol\Pulpit\ComboFix.exe
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((( Files Created from 2008-05-12 to 2008-06-12 )))))))))))))))))))))))))))))))
.

2008-06-12 11:53 . 2008-06-12 11:53 <DIR> d-------- C:\Program Files\Trend Micro
2008-06-12 11:35 . 2008-06-12 11:35 <DIR> d-------- C:\_OTMoveIt
2008-06-12 11:01 . 2008-06-12 11:08 <DIR> d--h----- C:\Windows\msdownld.tmp
2008-06-12 11:01 . 2008-06-12 11:01 <DIR> d-------- C:\Windows\Logs
2008-06-12 10:51 . 2008-06-12 10:51 <DIR> d-------- C:\Program Files\Zone Labs
2008-06-09 18:17 . 2008-06-09 18:17 <DIR> d-------- C:\Program Files\Common Files\Adobe Systems Shared
2008-06-09 18:17 . 2008-06-09 18:17 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Adobe Systems
2008-06-08 18:06 . 2008-06-08 18:06 <DIR> d-------- C:\TYCOON
2008-06-03 09:24 . 2008-06-03 09:24 <DIR> d-------- C:\Documents and Settings\Sobol\Dane aplikacji\Sonic
2008-06-03 09:23 . 2008-06-03 09:23 <DIR> d-------- C:\Documents and Settings\Sobol\Dane aplikacji\Leadertech
2008-06-03 09:22 . 2008-06-03 09:23 <DIR> d-------- C:\Program Files\PDFCreator
2008-06-03 09:22 . 2004-03-09 01:00 662,288 --a------ C:\Windows\system32\MSCOMCT2.OCX
2008-06-03 09:22 . 1998-06-24 01:00 137,000 --a------ C:\Windows\system32\MSMAPI32.OCX
2008-06-03 09:22 . 2001-10-28 17:42 116,224 --a------ C:\Windows\system32\pdfcmnnt.dll
2008-06-03 09:22 . 1998-07-06 01:00 23,552 --a------ C:\Windows\system32\MSMPIDE.DLL
2008-06-01 16:11 . 2008-06-01 16:13 340 --a------ C:\Windows\WINCMD.INI
2008-06-01 15:58 . 2008-06-02 20:06 <DIR> d-------- C:\Program Files\Mgutil
2008-06-01 15:58 . 2008-06-01 16:10 1,303 --a------ C:\Windows\mgutil_reg.ini
2008-06-01 15:58 . 2008-06-01 15:58 30 --a------ C:\Windows\mgutil_win.ini
2008-06-01 15:51 . 2008-06-01 15:57 <DIR> d-------- C:\Program Files\Smarty Uninstaller Pro
2008-06-01 15:51 . 2004-03-09 00:00 212,240 --a------ C:\Windows\system32\RICHTX32.OCX
2008-06-01 15:51 . 2007-08-15 12:09 167,683 --a------ C:\Windows\system32\COMCT232.OCX
2008-06-01 15:51 . 2007-08-15 12:09 40,960 --a------ C:\Windows\system32\ssubtmr6.dll
2008-05-28 17:59 . 2008-05-28 17:59 <DIR> d-------- C:\cino
2008-05-28 17:55 . 2008-05-28 18:38 <DIR> d-------- C:\Documents and Settings\Sobol\Dane aplikacji\BESTplayer
2008-05-25 23:01 . 2008-05-25 23:01 <DIR> d-------- C:\Program Files\Opera
2008-05-25 13:59 . 2008-06-02 13:47 796 --a------ C:\rollback.ini
2008-05-25 13:28 . 2008-05-25 13:28 <DIR> d-------- C:\Program Files\ZoneAlarmSB
2008-05-25 13:27 . 2008-05-26 13:07 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\MailFrontier
2008-05-25 13:27 . 2004-04-27 05:40 11,264 --a------ C:\Windows\system32\SpOrder.dll
2008-05-25 13:27 . 2008-06-02 18:41 4,212 ---h----- C:\Windows\system32\zllictbl.dat
2008-05-25 13:26 . 2008-06-12 10:51 <DIR> d-------- C:\Windows\Internet Logs
2008-05-25 12:41 . 2008-05-25 12:41 <DIR> d-------- C:\Program Files\Lavasoft
2008-05-25 12:41 . 2008-05-25 12:42 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Lavasoft
2008-05-25 12:40 . 2008-05-25 12:40 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2008-05-23 00:22 . 2008-05-23 00:22 3,596,288 --a------ C:\Windows\system32\qt-dx331.dll
2008-05-23 00:22 . 2008-05-23 00:22 524,288 --a------ C:\Windows\system32\DivXsm.exe
2008-05-23 00:22 . 2008-05-23 00:22 4,816 --a------ C:\Windows\system32\divxsm.tlb
2008-05-23 00:20 . 2008-05-23 00:20 1,044,480 --a------ C:\Windows\system32\libdivx.dll
2008-05-23 00:20 . 2008-05-23 00:20 200,704 --a------ C:\Windows\system32\ssldivx.dll
2008-05-23 00:19 . 2008-05-23 00:19 352,401 --a------ C:\Windows\system32\DivXMedia.ax
2008-05-23 00:19 . 2008-05-23 00:19 196,608 --a------ C:\Windows\system32\dtu100.dll
2008-05-23 00:19 . 2008-05-23 00:19 161,096 --a------ C:\Windows\system32\DivXCodecVersionChecker.exe
2008-05-23 00:19 . 2008-05-23 00:19 81,920 --a------ C:\Windows\system32\dpl100.dll
2008-05-23 00:19 . 2008-05-23 00:19 416 --a------ C:\Windows\system32\dtu100.dll.manifest
2008-05-23 00:19 . 2008-05-23 00:19 416 --a------ C:\Windows\system32\dpl100.dll.manifest
2008-05-23 00:18 . 2008-05-23 00:18 12,288 --a------ C:\Windows\system32\DivXWMPExtType.dll
2008-05-21 18:35 . 2008-05-21 18:35 <DIR> d-------- C:\Program Files\Gadu-Gadu
2008-05-18 22:18 . 2005-07-20 12:48 59,904 --a------ C:\Windows\system32\zlib.dll
2008-05-18 22:17 . 2008-05-18 22:17 <DIR> d-------- C:\Program Files\SoftprojectGP
2008-05-18 22:04 . 2008-05-18 22:04 <DIR> d-------- C:\Program Files\Ashampoo
2008-05-18 01:26 . 2008-02-22 02:33 69,632 --a------ C:\Windows\system32\javacpl.cpl
2008-05-16 11:58 . 2008-05-16 11:58 12,632 --a------ C:\Windows\system32\lsdelete.exe
2008-05-13 00:14 . 1998-10-07 12:54 327,168 --a------ C:\Windows\IsUn0415.exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-06-12 10:04 --------- d-----w C:\Program Files\Mozilla Thunderbird
2008-06-12 09:50 --------- d-----w C:\Program Files\eMule
2008-06-10 00:09 --------- d-----w C:\Program Files\DivX
2008-06-09 16:19 --------- d-----w C:\Program Files\Common Files\Adobe
2008-06-01 07:39 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Zylom
2008-05-28 14:40 22,328 ----a-w C:\WINDOWS\system32\drivers\PnkBstrK.sys
2008-05-22 19:47 --------- d---a-w C:\Documents and Settings\All Users\Dane aplikacji\TEMP
2008-05-21 16:51 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\hpqLog
2008-05-21 16:27 --------- d-----w C:\Program Files\Google
2008-05-21 16:03 --------- d-----w C:\Program Files\CamStudio
2008-05-17 23:26 --------- d-----w C:\Program Files\Java
2008-05-17 17:28 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Microsoft Help
2008-05-11 20:00 --------- d-----w C:\Program Files\MarBit
2008-05-10 10:26 --------- d-----w C:\Documents and Settings\Sobol\Dane aplikacji\DivX
2008-05-09 20:35 --------- d-----w C:\Program Files\DAEMON Tools
2008-05-09 20:21 --------- d-----w C:\Program Files\SkanerOnline
2008-05-05 19:54 --------- d-----w C:\Program Files\Xvid
2008-05-05 19:51 --------- d-----w C:\Program Files\JockerSoft
2008-04-29 20:15 --------- d-----w C:\Documents and Settings\Sobol\Dane aplikacji\AdobeUM
2008-04-29 09:20 15,648 ----a-w C:\WINDOWS\system32\drivers\NSDriver.sys
2008-04-29 09:19 15,648 ----a-w C:\WINDOWS\system32\drivers\Awrtrd.sys
2008-04-29 09:19 12,960 ----a-w C:\WINDOWS\system32\drivers\Awrtpd.sys
2008-04-26 09:26 --------- d-----w C:\Program Files\Zylom Games
2008-04-25 16:16 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Spybot - Search & Destroy
2008-04-25 15:49 --------- d-----w C:\Program Files\Spybot - Search & Destroy
2008-04-25 12:35 --------- d-----w C:\Program Files\Picasa2
2008-04-23 19:39 --------- d-----w C:\Program Files\Winamp
2008-04-23 19:39 --------- d-----w C:\Documents and Settings\Sobol\Dane aplikacji\Winamp
2008-04-23 18:50 --------- d-----w C:\Documents and Settings\Sobol\Dane aplikacji\Thunderbird
2008-04-23 04:49 --------- d-----w C:\Program Files\MSXML 6.0
2008-04-23 04:49 --------- d-----w C:\Program Files\Microsoft CAPICOM 2.1.0.2
2008-04-22 19:04 --------- d-----w C:\Documents and Settings\Sobol\Dane aplikacji\InterVideo
2008-04-22 16:20 --------- d-----w C:\Program Files\Microsoft Visual Studio 8
2008-04-22 08:16 --------- d-----w C:\Program Files\Uniblue
2008-04-22 08:16 --------- d-----w C:\Documents and Settings\Sobol\Dane aplikacji\Uniblue
2008-04-22 05:40 --------- d-----w C:\Documents and Settings\Sobol\Dane aplikacji\Sony
2008-04-22 05:40 --------- d-----w C:\Documents and Settings\Sobol\Dane aplikacji\Publish Providers
2008-04-22 04:24 --------- d-----w C:\Program Files\Vstplugins
2008-04-22 04:23 --------- d-----w C:\Program Files\Sony
2008-04-22 04:23 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Sony
2008-04-22 03:30 --------- d-----w C:\Program Files\MSBuild
2008-04-22 03:26 --------- d-----w C:\Program Files\Reference Assemblies
2008-04-22 02:58 --------- d-----w C:\Program Files\Sony Setup
2008-04-22 02:58 --------- d-----w C:\Documents and Settings\Sobol\Dane aplikacji\Sony Setup
2008-04-21 22:22 --------- d-----w C:\Program Files\Microsoft Works
2008-04-21 22:20 --------- d-----w C:\Program Files\Microsoft.NET
2008-04-21 22:06 --------- d-----w C:\Documents and Settings\Sobol\Dane aplikacji\SampleView
2008-04-21 22:01 --------- d-----w C:\Documents and Settings\Sobol\Dane aplikacji\Gadu-Gadu
2008-04-21 21:52 --------- d-----w C:\Program Files\Windows Media Connect
2008-04-21 21:52 --------- d-----w C:\Program Files\Usługi online
2008-04-21 21:52 --------- d-----w C:\Program Files\Synaptics
2008-04-21 21:51 --------- d-----w C:\Program Files\Sonic
2008-04-21 21:50 --------- d-----w C:\Program Files\microsoft frontpage
2008-04-21 21:50 --------- d-----w C:\Program Files\Hp
2008-04-21 21:50 --------- d-----w C:\Program Files\Hewlett-Packard
2008-04-21 21:50 --------- d-----w C:\Program Files\Fingerprint Sensor
2008-04-21 21:50 --------- d-----w C:\Program Files\Common Files\TiVo Shared
2008-04-21 21:49 --------- d-----w C:\Program Files\Common Files\SureThing Shared
2008-04-21 21:49 --------- d-----w C:\Program Files\Common Files\Sonic Shared
2008-04-21 21:49 --------- d-----w C:\Program Files\Common Files\LightScribe
2008-04-21 21:49 --------- d-----w C:\Program Files\Common Files\Java
2008-04-21 21:49 --------- d-----w C:\Program Files\Common Files\InstallShield
2008-04-21 21:49 --------- d-----w C:\Program Files\Analog Devices
2008-04-21 21:46 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\InstallShield
2008-04-21 21:34 --------- d-----w C:\Program Files\Symantec
2008-04-21 21:34 --------- d-----w C:\Program Files\Common Files\Symantec Shared
2008-04-21 21:34 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Symantec
2008-04-21 21:29 --------- d--h--w C:\Program Files\Common Files\AssortedEngines
2008-04-21 21:14 --------- d-----w C:\Program Files\Total Video Converter
2008-04-21 21:06 685,816 ----a-w C:\WINDOWS\system32\drivers\sptd.sys
2008-04-21 20:27 --------- d-----w C:\Documents and Settings\Sobol\Dane aplikacji\Talkback
2008-04-21 13:20 --------- d-----w C:\Program Files\WIDCOMM
2008-04-21 13:18 1,817 --sha-r C:\WINDOWS\system32\drivers\103C_HP_NTBK_HP Compaq nx7400 (RH673ES#AKD)_YN_0U_QCNU6462HXV_E410312241_46_I30A2_SHP_VKBC Version 40.17_B68YGU Ver. F.08_T061023_WXH2_L415_M1016_J120_7Intel_8Core2 T5500_91.66_#080421_N14E4170C_(RH673ES#AKD).MRK
2008-04-21 13:18 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-04-21 13:18 --------- d-----w C:\Program Files\InterVideo
2008-04-21 13:16 --------- d-----w C:\Program Files\Skróty programów
2008-04-21 13:14 --------- d-----w C:\Program Files\HPQ
2008-03-20 08:30 131,072 ----a-w C:\ArmyOps.exe
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{F0D4B239-DA4B-4DAF-81E4-DFEE4931A4AA}"= "C:\Program Files\ZoneAlarmSB\bar\1.bin\SPYBLOCK.DLL" [2008-05-25 13:28 262144]

[HKEY_CLASSES_ROOT\clsid\{f0d4b239-da4b-4daf-81e4-dfee4931a4aa}]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser]
"{F0D4B239-DA4B-4DAF-81E4-DFEE4931A4AA}"= C:\Program Files\ZoneAlarmSB\bar\1.bin\SPYBLOCK.DLL [2008-05-25 13:28 262144]

[HKEY_CLASSES_ROOT\clsid\{f0d4b239-da4b-4daf-81e4-dfee4931a4aa}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 10:00 15360]
"SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2008-01-28 11:43 2097488]
"EXPLORER.EXE"="EXPLORER.EXE" [2007-06-13 15:23 1034752 C:\Windows\explorer.exe]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AGRSMMSG"="AGRSMMSG.exe" [2006-01-30 03:00 88203 C:\Windows\AGRSMMSG.exe]
"SoundMAXPnP"="C:\Program Files\Analog Devices\Core\smax4pnp.exe" [2005-05-20 10:11 925696]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 04:25 144784]
"HP Software Update"="C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe" [2005-02-16 23:11 49152]
"DLA"="C:\WINDOWS\System32\DLA\DLACTRLW.EXE" [2005-08-31 05:20 122940]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2005-11-10 20:04 761945]
"igfxtray"="C:\WINDOWS\system32\igfxtray.exe" [2006-03-23 14:17 94208]
"igfxhkcmd"="C:\WINDOWS\system32\hkcmd.exe" [2006-03-23 14:13 77824]
"igfxpers"="C:\WINDOWS\system32\igfxpers.exe" [2006-03-23 14:17 118784]
"hpWirelessAssistant"="C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe" [2006-02-14 10:49 454656]
"QlbCtrl"="C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2006-03-02 15:39 131072]
"Cpqset"="C:\Program Files\HPQ\Default Settings\cpqset.exe" [2006-02-22 08:03 40960]
"Recguard"="C:\WINDOWS\Sminst\Recguard.exe" [2005-12-20 15:51 1187840]
"Reminder"="C:\WINDOWS\Creator\Remind_XP.exe" [2006-01-23 16:11 802816]
"Scheduler"="C:\WINDOWS\SMINST\Scheduler.exe" [2006-02-15 15:43 892928]
"WatchDog"="C:\Program Files\InterVideo\DVD Check\DVDCheck.exe" [2005-11-08 11:59 184320]
"SoundMAX"="C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" [2005-05-06 14:06 716800]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 10:00 15360]

C:\Documents and Settings\Sobol\Menu Start\Programy\Autostart\
Adobe Gamma.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-03-16 19:16:50 113664]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\OneCard]
C:\Program Files\HPQ\IAM\Bin\AsWlnPkg.dll 2005-07-25 20:41 40960 C:\Program Files\HPQ\IAM\Bin\AsWlnPkg.dll

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^BTTray.lnk]
backup=C:\WINDOWS\pss\BTTray.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
--a------ 2008-01-11 22:16 39792 C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Eraser]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent]
--a------ 2008-04-01 20:49 36352 C:\Program Files\Winamp\winampa.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\WINDOWS\\SMINST\\Scheduler.exe"=
"C:\\AmArmy\\System\\ArmyOps.exe"=
"C:\\Program Files\\eMule\\emule.exe"=
"C:\\moye\\Quake III Arena\\quake3.exe"=

R2 ASChannel;Local Communication Channel;C:\WINDOWS\System32\svchost.exe [2004-08-04 10:00]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
Cognizance REG_MULTI_SZ ASChannel

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{051e414d-10fb-11dd-9122-0018debeb097}]
\Shell\AutoRun\command - EXPLORER.EXE
\Shell\explore\Command - EXPLORER.EXE
\Shell\open\Command - EXPLORER.EXE

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{051e4150-10fb-11dd-9122-0018debeb097}]
\Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL UFO.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{82da9cb2-363f-11dd-b9c2-0018debeb097}]
\Shell\AutoRun\command - H:\setupSNK.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{9e63e94a-11d9-11dd-9125-0018debeb097}]
\Shell\AutoRun\command - H:\t.com
\Shell\explore\Command - H:\t.com
\Shell\open\Command - H:\t.com

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{cae673f8-1b42-11dd-9130-0018debeb097}]
\Shell\AutoRun\command - rthrw.com
\Shell\explore\Command - rthrw.com
\Shell\open\Command - rthrw.com

.
Contents of the 'Scheduled Tasks' folder
"2008-06-11 09:03:27 C:\WINDOWS\Tasks\Uniblue SpeedUpMyPC Nag.job"
- C:\Program Files\Uniblue\SpeedUpMyPC 3\SpeedUpMyPC.exe
"2008-04-22 08:16:28 C:\WINDOWS\Tasks\Uniblue SpeedUpMyPC.job"
- C:\Program Files\Uniblue\SpeedUpMyPC 3\SpeedUpMyPC.exe
.
**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-06-12 12:10:14
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Cpqset = C:\Program Files\HPQ\Default Settings\cpqset.exe?????? ???@???????????????@? ????X??????(?@???????@

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\Windows\system32\dllhost.exe
C:\Program Files\HPQ\IAM\Bin\asghost.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Windows\system32\PnkBstrA.exe
C:\Windows\system32\wdfmgr.exe
C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
C:\Windows\system32\igfxsrvc.exe
C:\PROGRA~1\HPQ\Shared\HPQTOA~1.EXE
.
**************************************************************************
.
Completion time: 2008-06-12 12:12:35 - machine was rebooted
ComboFix-quarantined-files.txt 2008-06-12 10:12:32

Pre-Run: 14,142,283,776 bajtów wolnych
Post-Run: 14,054,227,968 bajt˘w wolnych

257 --- E O F --- 2008-05-16 01:01:41

hijackthis:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:59:45, on 2008-06-12
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0013)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\Program Files\HPQ\IAM\bin\asghost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
C:\WINDOWS\System32\DLA\DLACTRLW.EXE
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe
C:\WINDOWS\Sminst\Recguard.exe
C:\WINDOWS\SMINST\Scheduler.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
C:\PROGRA~1\HPQ\Shared\HPQTOA~1.EXE
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://onet.pl/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: HP Credential Manager for ProtectTools - {DF21F1DB-80C6-11D3-9483-B03D0EC10000} - C:\Program Files\HPQ\IAM\Bin\ItIeAddIN.dll
O2 - BHO: ZoneAlarm Spy Blocker BHO - {F0D4B231-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\ZoneAlarmSB\bar\1.bin\SPYBLOCK.DLL
O3 - Toolbar: Winamp Toolbar - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - (no file)
O3 - Toolbar: ZoneAlarm Spy Blocker - {F0D4B239-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\ZoneAlarmSB\bar\1.bin\SPYBLOCK.DLL
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [SoundMAX] C:\Program Files\Analog Devices\SoundMAX\Smax4.exe /tray
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
O4 - HKLM\..\Run: [QlbCtrl] %ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
O4 - HKLM\..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\Sminst\Recguard.exe
O4 - HKLM\..\Run: [Reminder] C:\WINDOWS\Creator\Remind_XP.exe
O4 - HKLM\..\Run: [Scheduler] C:\WINDOWS\SMINST\Scheduler.exe
O4 - HKLM\..\Run: [WatchDog] C:\Program Files\InterVideo\DVD Check\DVDCheck.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [EXPLORER.EXE] EXPLORER.EXE
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O8 - Extra context menu item: E&ksportuj do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Wyślij do interfejsu &Bluetooth - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.hp.com
O16 - DPF: {68282C51-9459-467B-95BF-3C0E89627E55} (MksSkanerOnline Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab
O20 - Winlogon Notify: OneCard - C:\Program Files\HPQ\IAM\Bin\AsWlnPkg.dll
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - c:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: PC Angel (PCA) - SoftThinks - C:\WINDOWS\SMINST\PCAngel.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O24 - Desktop Component 0: (no name) - (no file)

--
End of file - 7251 bytes

starczy tak jak w przypadku wyżej usunąć :

O4 - HKCU\..\Run: [EXPLORER.EXE] EXPLORER.EXE

czy mam więcej roboty?
dzięki za odpowiedź

**Posty:** 7956 · przez **Magik** 15 Cze 2008, 17:49

sobolx napisał(a):witam
mam podobny problem do kolegi wyżej,

zakladaj na przyszlosc nowy temat :!:

Kod: Zaznacz wszystko: O3 - Toolbar: Winamp Toolbar - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - (no file) O4 - HKCU\..\Run: [EXPLORER.EXE] EXPLORER.EXE O24 - Desktop Component 0: (no name) - (no file)

dajesz na fix i log z combo jeszcze raz......

**Posty:** 5 · przez **sobolx** 16 Cze 2008, 10:22

dzięki za pomoc. już działa normalnie...

log z combofix:

ComboFix 08-06-15.4 - Sobol 2008-06-16 9:26:50.3 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1250.1.1045.18.686 [GMT 2:00]
Running from: C:\Documents and Settings\Sobol\Pulpit\ComboFix.exe

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((( Files Created from 2008-05-16 to 2008-06-16 )))))))))))))))))))))))))))))))
.

2008-06-13 15:03 . 2008-06-13 15:04 1,374 --a------ C:\Windows\imsins.BAK
2008-06-12 13:30 . 2008-06-12 13:30 <DIR> d-------- C:\Program Files\Gadu-Gadu
2008-06-12 13:15 . 2008-06-12 13:15 <DIR> d-------- C:\Program Files\IrfanView
2008-06-12 11:53 . 2008-06-12 11:53 <DIR> d-------- C:\Program Files\Trend Micro
2008-06-12 11:35 . 2008-06-12 11:35 <DIR> d-------- C:\_OTMoveIt
2008-06-12 11:11 . 2008-04-23 09:20 6,066,176 --------- C:\Windows\system32\dllcache\ieframe.dll
2008-06-12 11:11 . 2007-04-17 11:32 2,455,488 --------- C:\Windows\system32\dllcache\ieapfltr.dat
2008-06-12 11:11 . 2007-03-08 07:11 1,036,288 --------- C:\Windows\system32\dllcache\ieframe.dll.mui
2008-06-12 11:11 . 2008-04-23 09:20 459,264 --------- C:\Windows\system32\dllcache\msfeeds.dll
2008-06-12 11:11 . 2008-04-23 09:20 383,488 --------- C:\Windows\system32\dllcache\ieapfltr.dll
2008-06-12 11:11 . 2008-04-23 09:20 267,776 --------- C:\Windows\system32\dllcache\iertutil.dll
2008-06-12 11:11 . 2008-04-23 09:20 63,488 --------- C:\Windows\system32\dllcache\icardie.dll
2008-06-12 11:11 . 2008-04-23 09:20 52,224 --------- C:\Windows\system32\dllcache\msfeedsbs.dll
2008-06-12 11:11 . 2008-04-22 09:39 13,824 --------- C:\Windows\system32\dllcache\ieudinit.exe
2008-06-12 11:10 . 2008-04-14 17:53 273,024 --------- C:\Windows\system32\drivers\bthport.sys
2008-06-12 11:10 . 2008-04-14 17:53 273,024 --------- C:\Windows\system32\dllcache\bthport.sys
2008-06-12 11:01 . 2008-06-12 11:08 <DIR> d--h----- C:\Windows\msdownld.tmp
2008-06-12 11:01 . 2008-06-13 23:47 <DIR> d-------- C:\Windows\Logs
2008-06-12 10:51 . 2008-06-12 10:51 <DIR> d-------- C:\Program Files\Zone Labs
2008-06-09 18:17 . 2008-06-09 18:17 <DIR> d-------- C:\Program Files\Common Files\Adobe Systems Shared
2008-06-09 18:17 . 2008-06-09 18:17 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Adobe Systems
2008-06-03 09:24 . 2008-06-03 09:24 <DIR> d-------- C:\Documents and Settings\Sobol\Dane aplikacji\Sonic
2008-06-03 09:23 . 2008-06-03 09:23 <DIR> d-------- C:\Documents and Settings\Sobol\Dane aplikacji\Leadertech
2008-06-03 09:22 . 2008-06-13 23:47 <DIR> d-------- C:\Program Files\PDFCreator
2008-06-03 09:22 . 2004-03-09 01:00 662,288 --a------ C:\Windows\system32\MSCOMCT2.OCX
2008-06-03 09:22 . 1998-06-24 01:00 137,000 --a------ C:\Windows\system32\MSMAPI32.OCX
2008-06-03 09:22 . 2001-10-28 17:42 116,224 --a------ C:\Windows\system32\pdfcmnnt.dll
2008-06-03 09:22 . 1998-07-06 01:00 23,552 --a------ C:\Windows\system32\MSMPIDE.DLL
2008-06-01 16:11 . 2008-06-01 16:13 340 --a------ C:\Windows\WINCMD.INI
2008-06-01 15:58 . 2008-06-13 23:47 <DIR> d-------- C:\Program Files\Mgutil
2008-06-01 15:58 . 2008-06-01 16:10 1,303 --a------ C:\Windows\mgutil_reg.ini
2008-06-01 15:58 . 2008-06-01 15:58 30 --a------ C:\Windows\mgutil_win.ini
2008-06-01 15:51 . 2008-06-01 15:57 <DIR> d-------- C:\Program Files\Smarty Uninstaller Pro
2008-06-01 15:51 . 2004-03-09 00:00 212,240 --a------ C:\Windows\system32\RICHTX32.OCX
2008-06-01 15:51 . 2007-08-15 12:09 167,683 --a------ C:\Windows\system32\COMCT232.OCX
2008-06-01 15:51 . 2007-08-15 12:09 40,960 --a------ C:\Windows\system32\ssubtmr6.dll
2008-05-28 17:59 . 2008-05-28 17:59 <DIR> d-------- C:\cino
2008-05-28 17:55 . 2008-05-28 18:38 <DIR> d-------- C:\Documents and Settings\Sobol\Dane aplikacji\BESTplayer
2008-05-25 23:01 . 2008-05-25 23:01 <DIR> d-------- C:\Program Files\Opera
2008-05-25 13:59 . 2008-06-02 13:47 796 --a------ C:\rollback.ini
2008-05-25 13:28 . 2008-05-25 13:28 <DIR> d-------- C:\Program Files\ZoneAlarmSB
2008-05-25 13:27 . 2008-05-26 13:07 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\MailFrontier
2008-05-25 13:27 . 2004-04-27 05:40 11,264 --a------ C:\Windows\system32\SpOrder.dll
2008-05-25 13:27 . 2008-06-02 18:41 4,212 ---h----- C:\Windows\system32\zllictbl.dat
2008-05-25 13:26 . 2008-06-13 23:47 <DIR> d-------- C:\Windows\Internet Logs
2008-05-25 12:41 . 2008-05-25 12:41 <DIR> d-------- C:\Program Files\Lavasoft
2008-05-25 12:41 . 2008-05-25 12:42 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Lavasoft
2008-05-25 12:40 . 2008-05-25 12:40 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2008-05-23 00:22 . 2008-05-23 00:22 3,596,288 --a------ C:\Windows\system32\qt-dx331.dll
2008-05-23 00:22 . 2008-05-23 00:22 524,288 --a------ C:\Windows\system32\DivXsm.exe
2008-05-23 00:22 . 2008-05-23 00:22 4,816 --a------ C:\Windows\system32\divxsm.tlb
2008-05-23 00:20 . 2008-05-23 00:20 1,044,480 --a------ C:\Windows\system32\libdivx.dll
2008-05-23 00:20 . 2008-05-23 00:20 200,704 --a------ C:\Windows\system32\ssldivx.dll
2008-05-23 00:19 . 2008-05-23 00:19 352,401 --a------ C:\Windows\system32\DivXMedia.ax
2008-05-23 00:19 . 2008-05-23 00:19 196,608 --a------ C:\Windows\system32\dtu100.dll
2008-05-23 00:19 . 2008-05-23 00:19 161,096 --a------ C:\Windows\system32\DivXCodecVersionChecker.exe
2008-05-23 00:19 . 2008-05-23 00:19 81,920 --a------ C:\Windows\system32\dpl100.dll
2008-05-23 00:19 . 2008-05-23 00:19 416 --a------ C:\Windows\system32\dtu100.dll.manifest
2008-05-23 00:19 . 2008-05-23 00:19 416 --a------ C:\Windows\system32\dpl100.dll.manifest
2008-05-23 00:18 . 2008-05-23 00:18 12,288 --a------ C:\Windows\system32\DivXWMPExtType.dll
2008-05-18 22:18 . 2005-07-20 12:48 59,904 --a------ C:\Windows\system32\zlib.dll
2008-05-18 22:17 . 2008-05-18 22:17 <DIR> d-------- C:\Program Files\SoftprojectGP
2008-05-18 22:04 . 2008-05-18 22:04 <DIR> d-------- C:\Program Files\Ashampoo
2008-05-18 01:26 . 2008-02-22 02:33 69,632 --a------ C:\Windows\system32\javacpl.cpl
2008-05-16 11:58 . 2008-05-16 11:58 12,632 --a------ C:\Windows\system32\lsdelete.exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-06-15 21:37 --------- d-----w C:\Program Files\Mozilla Thunderbird
2008-06-12 09:50 --------- d-----w C:\Program Files\eMule
2008-06-10 00:09 --------- d-----w C:\Program Files\DivX
2008-06-09 16:19 --------- d-----w C:\Program Files\Common Files\Adobe
2008-06-01 07:39 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Zylom
2008-05-30 23:22 823,296 ----a-w C:\WINDOWS\system32\divx_xx0c.dll
2008-05-30 23:22 823,296 ----a-w C:\WINDOWS\system32\divx_xx07.dll
2008-05-30 23:22 815,104 ----a-w C:\WINDOWS\system32\divx_xx0a.dll
2008-05-30 23:22 802,816 ----a-w C:\WINDOWS\system32\divx_xx11.dll
2008-05-30 23:22 683,520 ----a-w C:\WINDOWS\system32\DivX.dll
2008-05-30 23:22 593,920 ----a-w C:\WINDOWS\system32\dpuGUI11.dll
2008-05-30 23:22 57,344 ----a-w C:\WINDOWS\system32\dpv11.dll
2008-05-30 23:22 53,248 ----a-w C:\WINDOWS\system32\dpuGUI10.dll
2008-05-30 23:22 344,064 ----a-w C:\WINDOWS\system32\dpus11.dll
2008-05-30 23:22 294,912 ----a-w C:\WINDOWS\system32\dpu11.dll
2008-05-30 23:22 294,912 ----a-w C:\WINDOWS\system32\dpu10.dll
2008-05-30 12:19 507,400 ----a-w C:\WINDOWS\system32\XAudio2_1.dll
2008-05-30 12:18 238,088 ----a-w C:\WINDOWS\system32\xactengine3_1.dll
2008-05-30 12:17 65,032 ----a-w C:\WINDOWS\system32\XAPOFX1_0.dll
2008-05-30 12:17 25,608 ----a-w C:\WINDOWS\system32\X3DAudio1_4.dll
2008-05-30 12:11 467,984 ----a-w C:\WINDOWS\system32\d3dx10_38.dll
2008-05-30 12:11 3,850,760 ----a-w C:\WINDOWS\system32\D3DX9_38.dll
2008-05-30 12:11 1,491,992 ----a-w C:\WINDOWS\system32\D3DCompiler_38.dll
2008-05-28 14:40 22,328 ----a-w C:\WINDOWS\system32\drivers\PnkBstrK.sys
2008-05-28 14:40 107,832 ----a-w C:\WINDOWS\system32\PnkBstrB.exe
2008-05-22 19:47 --------- d---a-w C:\Documents and Settings\All Users\Dane aplikacji\TEMP
2008-05-21 16:51 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\hpqLog
2008-05-21 16:27 --------- d-----w C:\Program Files\Google
2008-05-21 16:03 --------- d-----w C:\Program Files\CamStudio
2008-05-17 23:26 --------- d-----w C:\Program Files\Java
2008-05-17 17:28 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Microsoft Help
2008-05-11 20:00 --------- d-----w C:\Program Files\MarBit
2008-05-10 10:26 --------- d-----w C:\Documents and Settings\Sobol\Dane aplikacji\DivX
2008-05-09 20:35 --------- d-----w C:\Program Files\DAEMON Tools
2008-05-09 20:21 --------- d-----w C:\Program Files\SkanerOnline
2008-05-08 12:28 202,752 ----a-w C:\WINDOWS\system32\drivers\rmcast.sys
2008-05-08 12:28 202,752 ------w C:\WINDOWS\system32\dllcache\rmcast.sys
2008-05-07 05:16 1,291,264 ----a-w C:\WINDOWS\system32\quartz.dll
2008-05-07 05:16 1,291,264 ------w C:\WINDOWS\system32\dllcache\quartz.dll
2008-05-05 19:54 33,021 ----a-w C:\WINDOWS\system32\CoreVorbis-uninstall.exe
2008-05-05 19:54 --------- d-----w C:\Program Files\Xvid
2008-05-05 19:51 --------- d-----w C:\Program Files\JockerSoft
2008-04-29 20:15 --------- d-----w C:\Documents and Settings\Sobol\Dane aplikacji\AdobeUM
2008-04-29 09:20 15,648 ----a-w C:\WINDOWS\system32\drivers\NSDriver.sys
2008-04-29 09:19 15,648 ----a-w C:\WINDOWS\system32\drivers\Awrtrd.sys
2008-04-29 09:19 12,960 ----a-w C:\WINDOWS\system32\drivers\Awrtpd.sys
2008-04-26 09:26 --------- d-----w C:\Program Files\Zylom Games
2008-04-25 16:16 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Spybot - Search & Destroy
2008-04-25 15:49 --------- d-----w C:\Program Files\Spybot - Search & Destroy
2008-04-25 15:23 66,872 ----a-w C:\WINDOWS\system32\PnkBstrA.exe
2008-04-25 12:35 --------- d-----w C:\Program Files\Picasa2
2008-04-23 23:20 3,591,680 ----a-w C:\WINDOWS\system32\dllcache\mshtml.dll
2008-04-23 19:39 --------- d-----w C:\Program Files\Winamp
2008-04-23 19:39 --------- d-----w C:\Documents and Settings\Sobol\Dane aplikacji\Winamp
2008-04-23 18:50 --------- d-----w C:\Documents and Settings\Sobol\Dane aplikacji\Thunderbird
2008-04-23 04:49 --------- d-----w C:\Program Files\MSXML 6.0
2008-04-23 04:49 --------- d-----w C:\Program Files\Microsoft CAPICOM 2.1.0.2
2008-04-22 19:04 --------- d-----w C:\Documents and Settings\Sobol\Dane aplikacji\InterVideo
2008-04-22 16:20 --------- d-----w C:\Program Files\Microsoft Visual Studio 8
2008-04-22 08:16 --------- d-----w C:\Program Files\Uniblue
2008-04-22 08:16 --------- d-----w C:\Documents and Settings\Sobol\Dane aplikacji\Uniblue
2008-04-22 07:43 70,656 ----a-w C:\WINDOWS\system32\dllcache\ie4uinit.exe
2008-04-22 07:43 625,664 ----a-w C:\WINDOWS\system32\dllcache\iexplore.exe
2008-04-22 05:40 --------- d-----w C:\Documents and Settings\Sobol\Dane aplikacji\Sony
2008-04-22 05:40 --------- d-----w C:\Documents and Settings\Sobol\Dane aplikacji\Publish Providers
2008-04-22 04:24 --------- d-----w C:\Program Files\Vstplugins
2008-04-22 04:23 --------- d-----w C:\Program Files\Sony
2008-04-22 04:23 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Sony
2008-04-22 03:30 --------- d-----w C:\Program Files\MSBuild
2008-04-22 03:26 --------- d-----w C:\Program Files\Reference Assemblies
2008-04-22 02:58 --------- d-----w C:\Program Files\Sony Setup
2008-04-22 02:58 --------- d-----w C:\Documents and Settings\Sobol\Dane aplikacji\Sony Setup
2008-04-21 22:22 --------- d-----w C:\Program Files\Microsoft Works
2008-04-21 22:20 --------- d-----w C:\Program Files\Microsoft.NET
2008-04-21 22:06 --------- d-----w C:\Documents and Settings\Sobol\Dane aplikacji\SampleView
2008-04-21 22:01 --------- d-----w C:\Documents and Settings\Sobol\Dane aplikacji\Gadu-Gadu
2008-04-21 21:52 --------- d-----w C:\Program Files\Windows Media Connect
2008-04-21 21:52 --------- d-----w C:\Program Files\Usługi online
2008-04-21 21:52 --------- d-----w C:\Program Files\Synaptics
2008-04-21 21:51 --------- d-----w C:\Program Files\Sonic
2008-04-21 21:50 --------- d-----w C:\Program Files\microsoft frontpage
2008-04-21 21:50 --------- d-----w C:\Program Files\Hp
2008-04-21 21:50 --------- d-----w C:\Program Files\Hewlett-Packard
2008-04-21 21:50 --------- d-----w C:\Program Files\Fingerprint Sensor
2008-04-21 21:50 --------- d-----w C:\Program Files\Common Files\TiVo Shared
2008-04-21 21:49 --------- d-----w C:\Program Files\Common Files\SureThing Shared
2008-04-21 21:49 --------- d-----w C:\Program Files\Common Files\Sonic Shared
2008-04-21 21:49 --------- d-----w C:\Program Files\Common Files\LightScribe
2008-04-21 21:49 --------- d-----w C:\Program Files\Common Files\Java
2008-04-21 21:49 --------- d-----w C:\Program Files\Common Files\InstallShield
2008-04-21 21:49 --------- d-----w C:\Program Files\Analog Devices
2008-04-21 21:46 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\InstallShield
2008-04-21 21:34 --------- d-----w C:\Program Files\Symantec
2008-04-21 21:34 --------- d-----w C:\Program Files\Common Files\Symantec Shared
2008-04-21 21:34 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Symantec
2008-04-21 21:29 --------- d--h--w C:\Program Files\Common Files\AssortedEngines
2008-04-21 21:14 --------- d-----w C:\Program Files\Total Video Converter
2008-04-21 21:06 685,816 ----a-w C:\WINDOWS\system32\drivers\sptd.sys
2008-04-21 20:27 --------- d-----w C:\Documents and Settings\Sobol\Dane aplikacji\Talkback
2008-04-21 13:20 --------- d-----w C:\Program Files\WIDCOMM
.

((((((((((((((((((((((((((((( snapshot@2008-06-16_ 9.15.54,67 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-06-16 06:56:36 2,048 --s-a-w C:\WINDOWS\bootstat.dat
+ 2008-06-16 07:26:04 2,048 --s-a-w C:\WINDOWS\bootstat.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{F0D4B239-DA4B-4DAF-81E4-DFEE4931A4AA}"= "C:\Program Files\ZoneAlarmSB\bar\1.bin\SPYBLOCK.DLL" [2008-05-25 13:28 262144]

[HKEY_CLASSES_ROOT\clsid\{f0d4b239-da4b-4daf-81e4-dfee4931a4aa}]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser]
"{F0D4B239-DA4B-4DAF-81E4-DFEE4931A4AA}"= C:\Program Files\ZoneAlarmSB\bar\1.bin\SPYBLOCK.DLL [2008-05-25 13:28 262144]

[HKEY_CLASSES_ROOT\clsid\{f0d4b239-da4b-4daf-81e4-dfee4931a4aa}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 10:00 15360]
"SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2008-01-28 11:43 2097488]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AGRSMMSG"="AGRSMMSG.exe" [2006-01-30 03:00 88203 C:\Windows\AGRSMMSG.exe]
"SoundMAXPnP"="C:\Program Files\Analog Devices\Core\smax4pnp.exe" [2005-05-20 10:11 925696]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 04:25 144784]
"HP Software Update"="C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe" [2005-02-16 23:11 49152]
"DLA"="C:\WINDOWS\System32\DLA\DLACTRLW.EXE" [2005-08-31 05:20 122940]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2005-11-10 20:04 761945]
"igfxtray"="C:\WINDOWS\system32\igfxtray.exe" [2006-03-23 14:17 94208]
"igfxhkcmd"="C:\WINDOWS\system32\hkcmd.exe" [2006-03-23 14:13 77824]
"igfxpers"="C:\WINDOWS\system32\igfxpers.exe" [2006-03-23 14:17 118784]
"hpWirelessAssistant"="C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe" [2006-02-14 10:49 454656]
"QlbCtrl"="C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2006-03-02 15:39 131072]
"Cpqset"="C:\Program Files\HPQ\Default Settings\cpqset.exe" [2006-02-22 08:03 40960]
"Recguard"="C:\WINDOWS\Sminst\Recguard.exe" [2005-12-20 15:51 1187840]
"Reminder"="C:\WINDOWS\Creator\Remind_XP.exe" [2006-01-23 16:11 802816]
"Scheduler"="C:\WINDOWS\SMINST\Scheduler.exe" [2006-02-15 15:43 892928]
"WatchDog"="C:\Program Files\InterVideo\DVD Check\DVDCheck.exe" [2005-11-08 11:59 184320]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 10:00 15360]

C:\Documents and Settings\Sobol\Menu Start\Programy\Autostart\
Adobe Gamma.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-03-16 19:16:50 113664]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\OneCard]
C:\Program Files\HPQ\IAM\Bin\AsWlnPkg.dll 2005-07-25 20:41 40960 C:\Program Files\HPQ\IAM\Bin\AsWlnPkg.dll

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^BTTray.lnk]
backup=C:\WINDOWS\pss\BTTray.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
--a------ 2008-01-11 22:16 39792 C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Eraser]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent]
--a------ 2008-04-01 20:49 36352 C:\Program Files\Winamp\winampa.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\WINDOWS\\SMINST\\Scheduler.exe"=
"C:\\AmArmy\\System\\ArmyOps.exe"=
"C:\\Program Files\\eMule\\emule.exe"=
"C:\\moye\\Quake III Arena\\quake3.exe"=
"C:\\Program Files\\Gadu-Gadu\\gg.exe"=

R2 ASChannel;Local Communication Channel;C:\WINDOWS\System32\svchost.exe [2004-08-04 10:00]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
Cognizance REG_MULTI_SZ ASChannel

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{051e414d-10fb-11dd-9122-0018debeb097}]
\Shell\AutoRun\command - EXPLORER.EXE
\Shell\explore\Command - EXPLORER.EXE
\Shell\open\Command - EXPLORER.EXE

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{051e4150-10fb-11dd-9122-0018debeb097}]
\Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL UFO.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{cae673f8-1b42-11dd-9130-0018debeb097}]
\Shell\AutoRun\command - rthrw.com
\Shell\explore\Command - rthrw.com
\Shell\open\Command - rthrw.com

.
Contents of the 'Scheduled Tasks' folder
"2008-06-11 09:03:27 C:\WINDOWS\Tasks\Uniblue SpeedUpMyPC Nag.job"
- C:\Program Files\Uniblue\SpeedUpMyPC 3\SpeedUpMyPC.exe
"2008-04-22 08:16:28 C:\WINDOWS\Tasks\Uniblue SpeedUpMyPC.job"
- C:\Program Files\Uniblue\SpeedUpMyPC 3\SpeedUpMyPC.exe
.
**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-06-16 09:29:24
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Cpqset = C:\Program Files\HPQ\Default Settings\cpqset.exe?????? ???@???????????????@? ????X??????(?@???????@

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-06-16 9:30:10
ComboFix-quarantined-files.txt 2008-06-16 07:30:06
ComboFix2.txt 2008-06-16 07:16:02
ComboFix3.txt 2008-06-12 10:12:36

Pre-Run: 15,133,786,112 bajtów wolnych
Post-Run: 15,120,670,720 bajtów wolnych

275 --- E O F --- 2008-06-13 13:05:25

**Posty:** 7956 · przez **Magik** 16 Cze 2008, 12:09

Log juz jest czysty
mozesz jeszcze na koniec :arrow:

1. Ściągnij OTMoveIt i go włacz i odpal go z opcji CleanUp

2. wykonaj optymalizację windowsa
3.sciagnij ATF_Cleaner
zaznacz
Windows Temp
All users Temp
Temporary internet files
Recycle Bin
i wcisnij EMPTY SELECTED

**Posty:** 5 · przez **sobolx** 16 Cze 2008, 12:59

wielkie dzięki za pomoc.
pozdrawiam

**Posty:** 18165 · przez **wojtas** 16 Cze 2008, 13:27

wklej do notatnika
[quote:cenzura!]
Windows Registry Editor Version 5.00

[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{051e414d-10fb-11dd-9122-0018debeb097}]

[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{051e4150-10fb-11dd-9122-0018debeb097}]

[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{cae673f8-1b42-11dd-9130-0018debeb097}][/quote:cenzura!]

w notatniku u góry>>>plik zapisz jako>>>Zmien rozszerzenie z TXT na Wszystkie pliki *.* >>> Zapisz pod nazwą FIX.REG

Klikasz dwa razy na powstały plik fix i dodajesz go do rejestru....

**Posty:** 5 · przez **sobolx** 16 Cze 2008, 13:32

zrobione. dzięki

2x moje dokumenty i programy w pasku zadań

2x Moje dokumenty i programy w pasku zadań

Kto jest na forum