[log] problem z aplikacja ntkrnlpy.exe i windowsem

**Posty:** 114 · przez **Łukasz G.** 16 Sie 2008, 20:13

Witam.
Chciałbym prosić aby ktoś mądry sprawdził log.
Problemy jakie miewamto:
- w menadzeze aplikacja ntkrnlpy.exe caly czas zajmuje 99% procent kompa (musiałem ja zamknac bo nie mogłem zeskanować kompa)
- windows nie wykonuje poleceń np: gdy wciskam prawy myszy nie wyskakuje mi okienko z poleceniami, lub wogóle nie otwiera folderów lub dysków
- komputer zamulony i twarde dyski chodzą bez przerwy.
Z góry dzieki

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 19:02:15, on 2008-08-16 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.5730.0011) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\csrss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\Program Files\ASUS\AI Suite\AiNap\AiNap.exe C:\WINDOWS\system32\ctfmon.exe C:\WINDOWS\system32\pg.exe C:\WINDOWS\system32\pg.exe C:\WINDOWS\system32\iexplorer.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\CTsvcCDA.exe C:\Program Files\Common Files\Portrait Displays\Shared\DTSRVC.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\NVIDIA Corporation\nTune\nTuneService.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\PnkBstrA.exe C:\WINDOWS\system32\RUNDLL32.EXE C:\WINDOWS\system32\rapimgr.exe C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe C:\Program Files\O2\bin\sprtsvc.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\service.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\temps.exe C:\WINDOWS\System32\alg.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\wbem\wmiapsrv.exe C:\Program Files\Portrait Displays\HP My Display\DTHtml.exe C:\Program Files\Common Files\Portrait Displays\Shared\HookManager.exe C:\Program Files\HP\HP Software Update\HPWuSchd2.exe C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe C:\WINDOWS\system32\keyiftpk.exe C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe C:\Program Files\PC Connectivity Solution\ServiceLayer.exe C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\V0230Mon.exe C:\Program Files\Creative\Creative Live! Cam\VideoFX\StartFX.exe C:\WINDOWS\system32\Rundll32.exe C:\Program Files\DAEMON Tools\daemon.exe C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\O2\bin\sprtcmd.exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe C:\Program Files\Logitech\SetPoint\SetPoint.exe C:\Program Files\MSI\SecureDoc\Logon.exe C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe C:\Program Files\Gadu-Gadu\gg.exe I:\Program Files\Tlen.pl\tlen.exe C:\Program Files\Java\jre1.6.0_05\bin\jucheck.exe C:\WINDOWS\system32\notepad.exe C:\WINDOWS\system32\notepad.exe C:\WINDOWS\system32\notepad.exe C:\WINDOWS\system32\notepad.exe C:\WINDOWS\system32\notepad.exe C:\WINDOWS\system32\notepad.exe C:\WINDOWS\system32\notepad.exe C:\WINDOWS\system32\notepad.exe C:\WINDOWS\system32\notepad.exe C:\WINDOWS\system32\notepad.exe C:\WINDOWS\system32\notepad.exe C:\WINDOWS\system32\notepad.exe C:\Program Files\Internet Explorer\iexplore.exe I:\Instalki\HijackThis.exe I:\Program Files\FlashGet\flashget.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe C:\WINDOWS\system32\wbem\wmiprvse.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://wp.pl/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\sichost.exe O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll O2 - BHO: flashget urlcatch - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - I:\Program Files\FlashGet\jccatch.dll O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O2 - BHO: Skype Control Class - {9018F6A8-2495-45DF-9F16-C738F8F3C8FF} - C:\WINDOWS\system32\SkypeComm.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.0.1225.9868\swg.dll O2 - BHO: FlashGet GetFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - I:\Program Files\FlashGet\getflash.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll O4 - HKLM\..\Run: [Ai Nap] "C:\Program Files\ASUS\AI Suite\AiNap\AiNap.exe" O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe" O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe O4 - HKLM\..\Run: [DT HPW] C:\Program Files\Portrait Displays\HP My Display\DTHtml.exe -startup_folder O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -startup O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent O4 - HKLM\..\Run: [C:\WINDOWS\system32\V0230Cvw.dll] C:\WINDOWS\system32\RegSvr32.exe /s C:\WINDOWS\system32\V0230Cvw.dll O4 - HKLM\..\Run: [V0230Mon.exe] C:\WINDOWS\V0230Mon.exe O4 - HKLM\..\Run: [AVFX Engine] C:\Program Files\Creative\Creative Live! Cam\VideoFX\StartFX.exe O4 - HKLM\..\Run: [VolPanel] "C:\Program Files\Creative\Sound Blaster X-Fi\Volume Panel\VolPanlu.exe" /r O4 - HKLM\..\Run: [P17Helper] Rundll32 SPIRun.dll,RunDLLEntry O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033 O4 - HKLM\..\Run: [CloneCDTray] "C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe" /s O4 - HKLM\..\Run: [DmwClient] "dmwclient.exe" O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [O2] "C:\Program Files\O2\bin\sprtcmd.exe" /P O2 O4 - HKLM\..\Run: [xsbvgzd] C:\WINDOWS\system32\xsbvgzd.exe O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [NVIDIA nTune] "C:\Program Files\NVIDIA Corporation\nTune\nTuneCmd.exe" clear O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" O4 - HKCU\..\Run: [AlcoholAutomount] "C:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe" /automount O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe O4 - HKLM\..\Policies\Explorer\Run: [kcodn] knx32.exe O4 - HKLM\..\Policies\Explorer\Run: [dljj_df] C:\WINDOWS\system\llzjy080814.exe O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-19\..\RunOnce: [nlpo_01] cmd.exe /c md "%USERPROFILE%\Ustawienia lokalne\Temp" (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-19\..\RunOnce: [nlpo_03] cmd.exe /c md "%SystemRoot%\System32\dllcache" (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-19\..\RunOnce: [nlpo_04] cmd.exe /C move /Y "%SystemRoot%\System32\syssetub.dll" "%SystemRoot%\System32\syssetup.dll" (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-19\..\RunOnce: [nlpo_05] rundll32 advpack.dll,LaunchINFSection nlite.inf,nLiteReg (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-19\..\RunOnce: [nlpo_06] rundll32 advpack.dll,LaunchINFSection nlite.inf,S (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-20\..\RunOnce: [nlpo_01] cmd.exe /c md "%USERPROFILE%\Ustawienia lokalne\Temp" (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe O4 - Global Startup: SecureDoc.lnk = C:\Program Files\MSI\SecureDoc\Logon.exe O8 - Extra context menu item: &Stáhnout &vše FlashGetem - I:\Program Files\FlashGet\jc_all.htm O8 - Extra context menu item: &Ściągnij przy pomocy FlashGet'a - I:\Program Files\FlashGet\jc_link.htm O8 - Extra context menu item: &Ściągnij wszystko przy pomocy FlashGet'a - I:\Program Files\FlashGet\jc_all.htm O8 - Extra context menu item: E&ksportuj do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra button: Statystyki dla ochrony WWW - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\SCIEPlgn.dll O9 - Extra button: Wyślij do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra 'Tools' menuitem: Wyślij &do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - I:\Program Files\FlashGet\FlashGet.exe O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - I:\Program Files\FlashGet\FlashGet.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O15 - Trusted Zone: http://www.msi.com.tw O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://downloads.ewido.net/ewidoOnlineScan.cab O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - http://tools.ebayimg.com/eps/wl/activex/eBay_Enhanced_Picture_Control_v1-0-24-0.cab O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1209628295968 O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1209628289765 O16 - DPF: {8167C273-DF59-4416-B647-C8BB2C7EE83E} (WebSDev Control) - http://liveupdate.msi.com.tw/autobios/LOnline/install.cab O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/su2/CTL_V02002/ocx/15034/CTPID.cab O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O20 - AppInit_DLLs: zsqf.dll,ytfa.dll,ytfb.dll,ytfc.dll keyiftp.dll O20 - Winlogon Notify: xy3safe - C:\WINDOWS\system32\360mon.dll O21 - SSODL: adsntzt.dll - {E0F3526A-4165-4589-80CD-50B6FBAC3BDA} - C:\WINDOWS\system32\adsntzt.dll O21 - SSODL: wendykze.dll - {21BE5FDF-D4CB-4850-AD99-21E68B50BF3F} - C:\WINDOWS\system32\wendykze.dll O21 - SSODL: dpvvoxmh.dll - {2876D76C-CAAA-4313-AF97-8D1D9A2A1087} - C:\WINDOWS\system32\dpvvoxmh.dll O21 - SSODL: lweurqhx.dll - {71A78CD4-E470-4a18-8457-E0E0283DD507} - C:\WINDOWS\system32\lweurqhx.dll O21 - SSODL: catsrvwl.dll - {AF976DCD-754F-4ac2-BE49-951DC7AA57D2} - C:\WINDOWS\system32\catsrvwl.dll O21 - SSODL: dispexcb.dll - {76D44356-B494-443a-BEDC-AA68DE4255E6} - C:\WINDOWS\system32\dispexcb.dll O21 - SSODL: tscfgwmijxsj.dll - {2CB77746-8ECC-40ca-8217-10CA8BE5EFC8} - C:\WINDOWS\system32\tscfgwmijxsj.dll O21 - SSODL: comuidsg.dll - {898E02AB-9372-4a2c-9C4A-FFE1AF61097F} - C:\WINDOWS\system32\comuidsg.dll O21 - SSODL: slbiopfs2.dll - {EB9660D8-E1CD-4ff0-B4A9-00CD907F928A} - C:\WINDOWS\system32\slbiopfs2.dll O21 - SSODL: bootvidgj.dll - {D3112B69-A745-4805-874E-ABD480EA1299} - C:\WINDOWS\system32\bootvidgj.dll O23 - Service: 1 - Unknown owner - C:\WINDOWS\system32\pg.exe O23 - Service: 360tray - Unknown owner - C:\WINDOWS\system32\Fuck.exe O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: Kaspersky Internet Security 7.0 (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe O23 - Service: Portrait Displays Display Tune Service (DTSRVC) - Unknown owner - C:\Program Files\Common Files\Portrait Displays\Shared\DTSRVC.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: Usługa iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Common Files\Logitech\Bluetooth\LBTServ.exe O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe O23 - Service: National Instruments Domain Service (NIDomain) - Unknown owner - C:\WINDOWS\system32\ntkrnlpy.exe O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe O23 - Service: nTune Service (nTuneService) - NVIDIA - C:\Program Files\NVIDIA Corporation\nTune\nTuneService.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe O23 - Service: Remote Tracking Client Service (RMTCS) - Unknown owner - C:\WINDOWS\system32\rapimgr.exe O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe O23 - Service: SupportSoft Sprocket Service (O2) (sprtsvc_O2) - SupportSoft, Inc. - C:\Program Files\O2\bin\sprtsvc.exe O23 - Service: SupportSoft RemoteAssist - SupportSoft, Inc. - C:\Program Files\Common Files\Supportsoft\bin\ssrc.exe O23 - Service: Desktop Drivers (TopdeskDriver) - Unknown owner - C:\WINDOWS\system32\explsore.exe O23 - Service: Distributed Link Tracking Client Service (TrackingSS) - Unknown owner - C:\WINDOWS\system32\service.exe O23 - Service: Windows Accounts Driver (WindowsRemote) - Unknown owner - C:\WINDOWS\system32\temps.exe -- End of file - 16869 bytes

Kod: Zaznacz wszystko: ComboFix 08-08-15.04 - Godi 2008-08-16 19:15:33.1 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.2456 [GMT 1:00] Running from: C:\Documents and Settings\Godi\Pulpit\ComboFix.exe * Created a new restore point [color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color] . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\bot.txt C:\Documents and Settings\All Users\lljydf16.ini C:\Documents and Settings\All Users\lljydf32.ini C:\Documents and Settings\Godi\Cookies\godi@2.stat.cashbill[1].txt C:\Documents and Settings\Godi\Cookies\godi@2o7[2].txt C:\Documents and Settings\Godi\Cookies\godi@2o7[3].txt C:\Documents and Settings\Godi\Cookies\godi@a.playboy[1].txt C:\Documents and Settings\Godi\Cookies\godi@a.tiscali.co[1].txt C:\Documents and Settings\Godi\Cookies\godi@a.tuifly[1].txt C:\Documents and Settings\Godi\Cookies\godi@ad.yieldmanager[1].txt C:\Documents and Settings\Godi\Cookies\godi@ad.yieldmanager[2].txt C:\Documents and Settings\Godi\Cookies\godi@ad.yieldmanager[3].txt C:\Documents and Settings\Godi\Cookies\godi@ad2.pl.mediainter[1].txt C:\Documents and Settings\Godi\Cookies\godi@ad2.pl.mediainter[2].txt C:\Documents and Settings\Godi\Cookies\godi@adidm07.idmnet[1].txt C:\Documents and Settings\Godi\Cookies\godi@adserver.mobile.net[2].txt C:\Documents and Settings\Godi\Cookies\godi@advertising[1].txt C:\Documents and Settings\Godi\Cookies\godi@americanexpress[2].txt C:\Documents and Settings\Godi\Cookies\godi@bizrate.co[1].txt C:\Documents and Settings\Godi\Cookies\godi@cgi5.ebay.co[2].txt C:\Documents and Settings\Godi\Cookies\godi@connextra[11].txt C:\Documents and Settings\Godi\Cookies\godi@contextweb[1].txt C:\Documents and Settings\Godi\Cookies\godi@ebay.co[1].txt C:\Documents and Settings\Godi\Cookies\godi@ebay.co[2].txt C:\Documents and Settings\Godi\Cookies\godi@ebay.co[4].txt C:\Documents and Settings\Godi\Cookies\godi@ebay[10].txt C:\Documents and Settings\Godi\Cookies\godi@ebay[5].txt C:\Documents and Settings\Godi\Cookies\godi@ehg-autotrader.hitbox[3].txt C:\Documents and Settings\Godi\Cookies\godi@ehg-dig.hitbox[1].txt C:\Documents and Settings\Godi\Cookies\godi@ehg-globalgamingleague.hitbox[1].txt C:\Documents and Settings\Godi\Cookies\godi@ehg-nokiafin.hitbox[2].txt C:\Documents and Settings\Godi\Cookies\godi@ehg-reed.hitbox[2].txt C:\Documents and Settings\Godi\Cookies\godi@ehg-tfl.hitbox[1].txt C:\Documents and Settings\Godi\Cookies\godi@ehg-tfl.hitbox[4].txt C:\Documents and Settings\Godi\Cookies\godi@etology[3].txt C:\Documents and Settings\Godi\Cookies\godi@euros4click[2].txt C:\Documents and Settings\Godi\Cookies\godi@indexstats[2].txt C:\Documents and Settings\Godi\Cookies\godi@info.timeout[1].txt C:\Documents and Settings\Godi\Cookies\godi@info.timeout[2].txt C:\Documents and Settings\Godi\Cookies\godi@insightexpressai[2].txt C:\Documents and Settings\Godi\Cookies\godi@komtrack[2].txt C:\Documents and Settings\Godi\Cookies\godi@mobile[3].txt C:\Documents and Settings\Godi\Cookies\godi@mulinks[1].txt C:\Documents and Settings\Godi\Cookies\godi@nuggad[2].txt C:\Documents and Settings\Godi\Cookies\godi@onet[1].txt C:\Documents and Settings\Godi\Cookies\godi@onet[2].txt C:\Documents and Settings\Godi\Cookies\godi@peach.bskyb[1].txt C:\Documents and Settings\Godi\Cookies\godi@picturehost[1].txt C:\Documents and Settings\Godi\Cookies\godi@pixmania.co[5].txt C:\Documents and Settings\Godi\Cookies\godi@reklama.londynek[1].txt C:\Documents and Settings\Godi\Cookies\godi@reviews.ebay.co[2].txt C:\Documents and Settings\Godi\Cookies\godi@reviews.ebay.co[3].txt C:\Documents and Settings\Godi\Cookies\godi@revsci[1].txt C:\Documents and Settings\Godi\Cookies\godi@serving-sys[1].txt C:\Documents and Settings\Godi\Cookies\godi@cenzura-spam[2].txt C:\Documents and Settings\Godi\Cookies\godi@specificclick[3].txt C:\Documents and Settings\Godi\Cookies\godi@statcounter[1].txt C:\Documents and Settings\Godi\Cookies\godi@statcounter[3].txt C:\Documents and Settings\Godi\Cookies\godi@tour.twistys[1].txt C:\Documents and Settings\Godi\Cookies\godi@tradedoubler[2].txt C:\Documents and Settings\Godi\Cookies\godi@travelovo[1].txt C:\Documents and Settings\Godi\Cookies\godi@uk.ebayrtm[2].txt C:\Documents and Settings\Godi\Cookies\godi@wss.hrs[1].txt C:\Documents and Settings\Godi\Cookies\godi@ww0.timeout[1].txt C:\Documents and Settings\Godi\Cookies\godi@www.pixmania-pro.co[2].txt C:\Documents and Settings\Godi\Cookies\godi@www.pixmania.co[3].txt C:\Documents and Settings\Godi\Cookies\godi@www.pixmania.co[4].txt C:\Documents and Settings\Godi\Cookies\godi@www.planetgizmo.co[1].txt C:\Documents and Settings\Godi\Cookies\godi@www.rapidsearching[2].txt C:\Documents and Settings\Godi\Cookies\godi@www.smog[2].txt C:\Documents and Settings\Godi\Cookies\godi@www.viprasys[2].txt C:\Documents and Settings\Godi\Cookies\godi@yahoo[3].txt C:\Documents and Settings\Godi\Cookies\godi@youtube[1].txt C:\Documents and Settings\Godi\Dane aplikacji\macromedia\Flash Player\#SharedObjects\WRNUUA5K\interclick.com C:\Documents and Settings\Godi\Dane aplikacji\macromedia\Flash Player\#SharedObjects\WRNUUA5K\interclick.com\ud.sol C:\Documents and Settings\Godi\Dane aplikacji\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#interclick.com C:\Documents and Settings\Godi\Dane aplikacji\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#interclick.com\settings.sol C:\WINDOWS\7779.exe C:\WINDOWS\system\llzjy080814.exe C:\WINDOWS\system32\360mon.dll C:\WINDOWS\system32\adsntzt.dll C:\WINDOWS\system32\adsntzt.nls C:\WINDOWS\system32\AutoRun.inf C:\WINDOWS\system32\baccops.dll C:\WINDOWS\system32\bootvidgj.dll C:\WINDOWS\system32\bootvidgj.nls C:\WINDOWS\system32\catsrvwl.dll C:\WINDOWS\system32\catsrvwl.nls C:\WINDOWS\system32\cliconfgzx.dll C:\WINDOWS\system32\cliconfgzx.nls C:\WINDOWS\system32\cmonos.dll C:\WINDOWS\system32\comuidsg.dll C:\WINDOWS\system32\comuidsg.nls C:\WINDOWS\system32\ddserh.dll C:\WINDOWS\system32\dearnts.dll C:\WINDOWS\system32\discard.ini C:\WINDOWS\system32\dispexcb.dll C:\WINDOWS\system32\dispexcb.nls C:\WINDOWS\system32\dpvvoxmh.dll C:\WINDOWS\system32\dpvvoxmh.nls C:\WINDOWS\system32\fmcvxy.dll C:\WINDOWS\system32\fsrgeb.dll C:\WINDOWS\system32\hhrdxd.dll C:\WINDOWS\system32\hourpx2.dll C:\WINDOWS\system32\jacknove.dll C:\WINDOWS\system32\jdsaex.dll C:\WINDOWS\system32\jhfrxz.dll C:\WINDOWS\system32\jolinos.dll C:\WINDOWS\system32\keyiftp.dll C:\WINDOWS\system32\keyiftpk.exe C:\WINDOWS\system32\kgfghd.dll C:\WINDOWS\system32\kncer32.exe C:\WINDOWS\system32\knx32.dll C:\WINDOWS\system32\knx32.exe C:\WINDOWS\system32\lenowos.dll C:\WINDOWS\system32\lweurqhx.dll C:\WINDOWS\system32\lweurqhx.nls C:\WINDOWS\system32\mttwfh.dll C:\WINDOWS\system32\Nessery.sys C:\WINDOWS\system32\nvidons.dll C:\WINDOWS\system32\offscrl.dll C:\WINDOWS\system32\pedadt.dll C:\WINDOWS\system32\rapimgr.exe C:\WINDOWS\system32\rmbsony.dll C:\WINDOWS\system32\service.exe C:\WINDOWS\system32\sgdewg.dll C:\WINDOWS\system32\SkypeComm.dll C:\WINDOWS\system32\slbiopfs2.dll C:\WINDOWS\system32\slbiopfs2.nls C:\WINDOWS\system32\sovlost.exe C:\WINDOWS\system32\ssdtti.sys C:\WINDOWS\system32\sufost.ini C:\WINDOWS\system32\sunesn.dll C:\WINDOWS\system32\sunesnk.exe C:\WINDOWS\system32\sychost.exe C:\WINDOWS\system32\tdfhex.dll C:\WINDOWS\system32\tdggrz.dll C:\WINDOWS\system32\temps.exe C:\WINDOWS\system32\therbrek.dll C:\WINDOWS\system32\tmp90.tmp C:\WINDOWS\system32\tscfgwmijxsj.dll C:\WINDOWS\system32\tscfgwmijxsj.nls C:\WINDOWS\system32\wklsdd.dll C:\WINDOWS\system32\woswelc.dll C:\WINDOWS\system32\wrqszl.dll C:\WINDOWS\system32\wyrsdj.dll C:\WINDOWS\system32\xpsbos.dll C:\WINDOWS\system32\xxpopo.dll C:\WINDOWS\system32\zgtwfx.dll C:\WINDOWS\system32\zsdgff.dll C:\WINDOWS\system32\zsqf.dll . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Legacy_NESSERY -------\Legacy_RESSDT -------\Legacy_RMTCS -------\Legacy_TRACKINGSS -------\Service_msiffei -------\Service_RESSDT -------\Service_RMTCS -------\Service_TrackingSS -------\Legacy_WindowsRemote -------\Service_WindowsRemote ((((((((((((((((((((((((( Files Created from 2003-07-16 to 2003-08-16 ))))))))))))))))))))))))))))))) . 2008-08-16 18:22 . 2004-08-04 01:44 395,776 --a------ C:\WINDOWS\system32\tmplljydf0.exe 2008-08-16 18:22 . 2008-08-16 18:22 36,933 --a------ C:\WINDOWS\system32\ntkrnlpy.exe 2008-08-16 18:22 . 2008-08-16 18:22 12,514 --a------ C:\WINDOWS\system32\mstmpxmlfun.xml 2008-08-16 08:46 . 2008-08-16 08:46 23,040 ---hs---- C:\WINDOWS\system32\explsore.exe 2008-08-16 08:45 . 2008-08-16 08:45 24,576 --a------ C:\WINDOWS\system32\reglako.dll 2008-08-16 08:44 . 2008-08-16 08:44 9,728 --a------ C:\WINDOWS\system32\ckthersk.exe 2008-08-16 08:43 . 2008-08-16 08:43 579,360 --a------ C:\WINDOWS\system32\wendykze.dll 2008-08-16 08:43 . 2004-08-04 01:44 395,776 --a------ C:\WINDOWS\system32\tmplljydf2.exe 2008-08-16 08:43 . 2008-08-16 08:43 288 --a------ C:\WINDOWS\system32\wendykze.nls 2008-08-15 19:35 . 2008-08-15 19:35 1,015,956 --a------ C:\WINDOWS\system32\kbdgrms.dll 2008-08-15 19:35 . 2008-08-15 19:35 24,576 --a------ C:\WINDOWS\system32\zfashl.dll 2008-08-15 19:35 . 2008-08-15 19:35 148 --a------ C:\WINDOWS\system32\kbdgrms.nls 2008-08-15 19:34 . 2008-08-15 19:34 28,672 --a------ C:\WINDOWS\system32\lensch.dll 2008-08-15 19:34 . 2008-08-15 19:34 24,576 --a------ C:\WINDOWS\system32\rmchamp.dll 2008-08-15 19:33 . 2008-08-15 19:33 24,576 --a------ C:\WINDOWS\system32\johandy.dll 2008-08-15 19:33 . 2008-08-15 19:33 24,576 ---hs---- C:\WINDOWS\system32\exlpogj.dll 2008-08-15 19:33 . 2008-08-15 19:33 24,576 --a------ C:\WINDOWS\system32\dualey.dll 2008-08-15 19:33 . 2008-08-15 19:33 24,576 --a------ C:\WINDOWS\system32\candayl.dll 2008-08-15 14:13 . 2008-08-15 14:13 32,768 --a------ C:\WINDOWS\system32\pg.exe 2008-08-15 11:13 . 2008-08-15 11:13 23,882 ---hs---- C:\WINDOWS\system32\Fuck.exe 2008-08-10 20:37 . 2008-08-10 20:37 24,576 --a------ C:\WINDOWS\system32\tesxdx.dll 2008-08-10 20:35 . 2008-08-10 20:35 24,576 --a------ C:\WINDOWS\system32\ckicps.dll 2008-08-10 20:29 . 2008-08-16 08:45 171 --a------ C:\WINDOWS\system32\winsYs.reg 2008-07-30 19:05 . 2008-05-02 02:38 301,656 --a------ C:\WINDOWS\system32\BtCoreIf.dll 2008-07-12 17:19 . 2008-07-12 17:19 5,120 --ahs---- C:\WINDOWS\system32\Thumbs.db 2008-07-03 19:38 . 1998-05-20 21:36 254,976 --a------ C:\WINDOWS\system32\xaudio.dll 2008-06-15 11:57 . 2007-11-29 10:39 95,744 --a------ C:\WINDOWS\system32\nmwcdcocls.dll 2008-05-27 10:50 . 2008-05-27 10:50 90,112 --a------ C:\WINDOWS\system32\QuickTimeVR.qtx 2008-05-27 10:50 . 2008-05-27 10:50 57,344 --a------ C:\WINDOWS\system32\QuickTime.qts 2008-04-21 15:28 . 2008-04-21 15:28 4 --a------ C:\WINDOWS\system32\proc-1037709799.bin 2008-02-27 20:39 . 2001-07-03 21:33 53,248 --a------ C:\WINDOWS\system32\SONYHCY.DLL 2008-02-17 14:45 . 2007-11-14 15:52 1,097,728 --a------ C:\WINDOWS\system32\iTunesMobileDevice.dll 2008-02-17 14:45 . 2007-11-14 15:52 311,296 --a------ C:\WINDOWS\system32\QTMLClient.dll 2008-02-11 20:10 . 2003-06-13 00:25 7,062 --a------ C:\WINDOWS\system32\audiopid.vxd 2008-02-11 20:08 . 1999-12-12 18:01 44,032 --------- C:\WINDOWS\system32\CTSVCCDA.EXE 2008-02-11 20:08 . 1999-11-17 18:00 25,088 --------- C:\WINDOWS\system32\CTSVCCTL.EXE 2008-02-11 20:07 . 2006-11-28 03:14 782,336 -ra------ C:\WINDOWS\system32\tmp4D.tmp 2008-02-11 20:07 . 2008-02-11 20:20 409,600 --a------ C:\WINDOWS\system32\wrap_oal.dll 2008-02-11 20:07 . 2005-12-08 12:54 120,832 --a------ C:\WINDOWS\system32\sfms32.dll 2008-02-11 20:07 . 2008-02-11 20:20 114,688 --a------ C:\WINDOWS\system32\OpenAL32.dll 2008-02-11 20:07 . 2005-12-08 12:54 21,504 --a------ C:\WINDOWS\system32\sfman32.dll 2008-02-11 20:07 . 2007-04-20 16:28 3,118 --------- C:\WINDOWS\system32\AudioDrv.ini 2008-02-11 20:07 . 2003-04-11 11:26 59 --a------ C:\WINDOWS\system32\default4.sfm 2008-02-11 20:06 . 2000-12-13 11:21 7,572,224 --------- C:\WINDOWS\system32\CT8MGM.SF2 2008-02-11 20:06 . 2003-07-24 13:17 4,174,814 --a------ C:\WINDOWS\system32\ct4mgm.sf2 2008-02-11 20:06 . 1999-09-23 00:18 2,167,684 --------- C:\WINDOWS\system32\CT2MGM.SF2 2008-02-10 23:47 . 2006-11-28 03:14 782,336 -ra------ C:\WINDOWS\system32\tmp4C.tmp 2008-02-10 23:47 . 2003-04-02 00:13 139,264 -ra------ C:\WINDOWS\system32\EAX.DLL 2008-02-10 23:47 . 2006-01-25 15:55 137,728 --a------ C:\WINDOWS\system32\P17res.dll 2008-02-10 23:47 . 2003-10-02 19:48 53,248 --a------ C:\WINDOWS\system32\P17CPI.dll 2008-02-10 23:47 . 2007-09-26 11:17 22,862 --a------ C:\WINDOWS\system32\Ludap17.ini 2008-02-10 23:47 . 2008-06-15 14:54 584 --a------ C:\WINDOWS\system32\settingsbkup.sfm 2008-02-10 23:47 . 2008-06-15 14:54 584 --a------ C:\WINDOWS\system32\settings.sfm 2008-02-10 23:47 . 2005-03-08 15:17 54 --a------ C:\WINDOWS\system32\ctzapxx.ini 2008-01-29 12:02 . 2008-01-29 12:02 107,368 --a------ C:\WINDOWS\system32\GEARAspi.dll 2008-01-17 01:58 . 2008-02-29 19:52 107,832 --a------ C:\WINDOWS\system32\PnkBstrB.exe 2008-01-17 01:58 . 2008-01-17 02:18 66,872 --a------ C:\WINDOWS\system32\PnkBstrA.exe 2008-01-17 00:50 . 2007-05-08 09:59 137,216 --a------ C:\WINDOWS\system32\OemSpi.dll 2008-01-17 00:50 . 2005-06-27 11:37 133,632 --a------ C:\WINDOWS\system32\CtDvInst.dll 2008-01-17 00:50 . 2002-04-11 02:41 65,536 --a------ C:\WINDOWS\system32\A3d.dll 2008-01-17 00:50 . 2006-07-03 13:43 10,752 --a------ C:\WINDOWS\system32\SPIRun.dll 2007-11-30 11:41 . 2000-05-22 09:58 647,872 --------- C:\WINDOWS\system32\Mscomct2.ocx 2007-11-23 18:38 . 2004-08-04 01:44 159,232 --a------ C:\WINDOWS\system32\ptpusd.dll 2007-11-23 18:38 . 2001-10-26 18:29 5,632 --a------ C:\WINDOWS\system32\ptpusb.dll 2007-11-16 23:27 . 2006-02-06 07:54 24,064 -ra------ C:\WINDOWS\system32\PostProc.dll 2007-11-16 23:11 . 2007-11-16 23:11 5 --a------ C:\WINDOWS\system32\SndDrv32a_k.oxc 2007-11-16 23:11 . 2007-11-16 23:11 5 --ahs---- C:\WINDOWS\system32\AuxDrv32b_k.oxc 2007-11-16 18:30 . 2007-11-30 19:22 44 --a------ C:\WINDOWS\system32\msssc.dll 2007-11-04 22:48 . 2007-11-04 22:48 8 --a------ C:\WINDOWS\system32\nvModes.dat 2007-11-04 18:44 . 2007-11-04 18:44 107,888 --a------ C:\WINDOWS\system32\CmdLineExt.dll 2007-10-28 13:05 . 2004-08-30 15:25 438,272 --a------ C:\WINDOWS\system32\vp6vfw.dll 2007-10-28 13:05 . 2004-12-10 11:06 327,680 --a------ C:\WINDOWS\system32\vp6dec.ax 2007-10-28 13:05 . 2007-04-12 16:01 118,832 --a------ C:\WINDOWS\system32\SHW32.DLL 2007-10-26 19:48 . 2004-08-04 00:44 153,088 --a------ C:\WINDOWS\system32\irftp.exe 2007-10-26 19:48 . 2004-08-04 00:44 27,648 --a------ C:\WINDOWS\system32\irmon.dll 2007-10-26 19:48 . 2004-08-04 00:44 8,192 --a------ C:\WINDOWS\system32\wshirda.dll 2007-10-21 13:09 . 2008-02-01 15:17 90,624 --a------ C:\WINDOWS\system32\nmwcdcls.dll 2007-10-02 22:50 . 2008-02-22 03:33 69,632 --a------ C:\WINDOWS\system32\javacpl.cpl 2007-09-30 18:54 . 2007-03-31 06:11 267,864 --a------ C:\WINDOWS\system32\hpzids01.dll 2007-09-30 18:54 . 2007-03-28 14:01 117,760 --a------ C:\WINDOWS\system32\hpzll5ha.dll 2007-09-30 04:05 . 2003-07-03 02:35 16,384 --a------ C:\WINDOWS\system32\FileOps.exe 2007-09-20 02:41 . 2007-10-21 13:11 <DIR> d-------- C:\WINDOWS\system32\LogFiles 2007-09-20 02:29 . 2008-11-24 07:13 1,966,080 --a------ C:\WINDOWS\system32\cdintf251.dll 2007-09-17 23:54 . 2007-09-17 23:54 <DIR> d-------- C:\WINDOWS\system32\AGEIA 2007-09-17 01:53 . 2008-08-03 21:29 <DIR> d----c--- C:\WINDOWS\system32\DRVSTORE 2007-09-17 01:53 . 2007-06-22 12:34 1,419,232 --a------ C:\WINDOWS\system32\WdfCoInstaller01005.dll 2007-09-17 01:53 . 2008-05-02 02:39 170,512 --a------ C:\WINDOWS\system32\kemutb.dll 2007-09-17 01:53 . 2008-05-02 02:39 145,936 --a------ C:\WINDOWS\system32\KemUtil.dll 2007-09-17 01:53 . 2008-05-02 02:40 117,264 --a------ C:\WINDOWS\system32\KemWnd.dll 2007-09-17 01:53 . 2008-05-02 02:40 84,496 --a------ C:\WINDOWS\system32\KemXML.dll 2007-09-17 01:25 . 2006-10-26 19:56 32,592 --a------ C:\WINDOWS\system32\msonpmon.dll 2007-09-17 01:13 . 2007-03-08 00:51 129,784 --------- C:\WINDOWS\system32\pxafs.dll 2007-09-17 00:40 . 2007-09-17 00:40 <DIR> d-------- C:\WINDOWS\system32\pl-pl 2007-09-16 22:21 . 2007-06-29 01:54 356,352 --a------ C:\WINDOWS\system32\NVUNINST.EXE 2007-09-16 22:21 . 2007-06-29 00:43 356,352 --a------ C:\WINDOWS\system32\nvudisp.exe 2007-09-16 22:21 . 2007-09-16 23:53 127,254 --a------ C:\WINDOWS\system32\nvapps.xml 2007-09-16 22:21 . 2007-06-29 00:43 17,463 --a------ C:\WINDOWS\system32\nvdisp.nvu 2007-09-16 21:20 . 2006-01-10 09:50 24,576 -ra------ C:\WINDOWS\system32\AsIO.dll 2007-09-16 20:26 . 2004-08-04 01:44 130,048 --a------ C:\WINDOWS\system32\ksproxy.ax 2007-09-16 20:26 . 2004-08-04 01:44 4,096 --a------ C:\WINDOWS\system32\ksuser.dll 2007-09-16 20:07 . 2004-08-04 01:44 21,504 --a------ C:\WINDOWS\system32\hidserv.dll 2007-09-16 20:05 . 2007-09-16 20:05 <DIR> d-------- C:\WINDOWS\system32\xircom 2007-09-16 20:05 . 2004-08-04 00:44 77,312 --a------ C:\WINDOWS\system32\usbui.dll 2007-09-16 20:02 . 2008-08-16 19:24 <DIR> d-------- C:\WINDOWS\system32\DllCache 2007-09-16 20:02 . 2003-08-16 19:23 <DIR> d-------- C:\WINDOWS\system32\CatRoot2 2007-09-16 20:02 . 2008-02-27 20:41 <DIR> d-------- C:\WINDOWS\system32\CatRoot 2007-09-16 20:02 . 2004-08-04 00:44 10,752 --------- C:\WINDOWS\system32\smtpapi.dll 2007-09-16 20:02 . 2004-08-04 00:44 9,728 --------- C:\WINDOWS\system32\rwnh.dll 2007-09-16 20:02 . 2004-08-03 22:59 9,728 --------- C:\WINDOWS\system32\comsdupd.exe 2007-09-16 20:00 . 2007-09-16 19:15 261 --a------ C:\WINDOWS\system32\$winnt$.inf 2007-07-30 19:18 . 2007-07-30 19:18 207,736 --a------ C:\WINDOWS\system32\muweb.dll 2007-07-24 15:17 . 2007-07-24 15:17 81,920 --a------ C:\WINDOWS\system32\dns-sd.exe 2007-07-24 15:17 . 2007-07-24 15:17 61,440 --a------ C:\WINDOWS\system32\dnssd.dll 2007-06-28 12:51 . 2007-06-28 12:51 206,088 --a------ C:\WINDOWS\system32\klogon.dll 2007-06-19 08:59 . 2007-06-19 08:59 70,400 --a------ C:\WINDOWS\system32\PhysXLoader.dll 2007-06-08 08:11 . 2007-06-08 08:11 831,048 --a------ C:\WINDOWS\system32\WudfUpdate_01005.dll 2007-04-23 20:11 . 2007-04-23 20:11 287,256 -ra------ C:\WINDOWS\system32\AbaleZip.dll 2007-04-20 07:57 . 2007-04-20 07:57 489,000 --a------ C:\WINDOWS\system32\PhysX.cpl 2007-04-20 07:57 . 2007-04-20 07:57 53,248 --a------ C:\WINDOWS\system32\AgCPanelTraditionalChinese.dll 2007-04-20 07:57 . 2007-04-20 07:57 53,248 --a------ C:\WINDOWS\system32\AgCPanelSwedish.dll 2007-04-20 07:57 . 2007-04-20 07:57 53,248 --a------ C:\WINDOWS\system32\AgCPanelSpanish.dll 2007-04-20 07:57 . 2007-04-20 07:57 53,248 --a------ C:\WINDOWS\system32\AgCPanelSimplifiedChinese.dll 2007-04-20 07:57 . 2007-04-20 07:57 53,248 --a------ C:\WINDOWS\system32\AgCPanelPortugese.dll 2007-04-20 07:57 . 2007-04-20 07:57 53,248 --a------ C:\WINDOWS\system32\AgCPanelKorean.dll 2007-04-20 07:57 . 2007-04-20 07:57 53,248 --a------ C:\WINDOWS\system32\AgCPanelJapanese.dll . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-08-16 18:23 263,341,600 --sha-w C:\WINDOWS\system32\drivers\fidbox.dat 2008-08-16 18:23 2,372,640 --sha-w C:\WINDOWS\system32\drivers\fidbox2.dat 2008-08-16 18:22 3,545,696 --sha-w C:\WINDOWS\system32\drivers\fidbox.idx 2008-08-16 18:22 234,944 --sha-w C:\WINDOWS\system32\drivers\fidbox2.idx 2008-08-16 18:02 --------- d-----w C:\Program Files\Trend Micro 2008-08-16 17:22 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab 2008-08-16 07:44 24,576 ----a-w C:\WINDOWS\system32\ckthers.dll 2008-08-15 18:34 14,531 ----a-w C:\WINDOWS\wow.exe 2008-08-15 18:31 36,352 ----a-w C:\WINDOWS\lvse01.exe 2008-08-15 02:11 --------- d-----w C:\Documents and Settings\Godi\Dane aplikacji\Skype 2008-08-14 17:38 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\SupportSoft 2008-08-14 17:37 --------- d-----w C:\Program Files\O2 2008-08-14 16:55 --------- d-----w C:\Program Files\Common Files\SupportSoft 2008-08-05 20:36 --------- d-----w C:\Program Files\NAPI-PROJEKT 2008-08-03 20:34 --------- d-----w C:\Program Files\iTunes 2008-08-03 20:33 --------- d-----w C:\Program Files\iPod 2008-08-03 20:32 --------- d-----w C:\Program Files\QuickTime 2008-08-03 20:32 --------- d-----w C:\Program Files\Bonjour 2008-08-03 20:30 --------- d-----w C:\Program Files\Apple Software Update 2008-08-03 11:23 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-07-30 18:06 --------- d-----w C:\Program Files\Common Files\Logitech 2008-07-30 18:06 --------- d-----w C:\Program Files\Common Files\Logishrd 2008-07-22 19:32 32,000 ----a-w C:\WINDOWS\system32\drivers\usbaapl.sys 2008-07-03 22:43 --------- d-----w C:\Program Files\SlySoft 2008-07-03 18:38 --------- d-----w C:\Program Files\Carrot 2008-07-03 18:29 --------- d-----w C:\Program Files\VirtualDJ 2008-07-03 18:23 --------- d-----w C:\Program Files\AtomixMP3 2008-06-30 20:57 --------- d-----w C:\Documents and Settings\Godi\Dane aplikacji\teamspeak2 2008-06-21 18:25 --------- d-----w C:\Program Files\danny_kay1710 2008-06-17 23:54 223,128 ----a-w C:\WINDOWS\system32\drivers\dtscsi.sys 2008-06-17 23:54 --------- d-----w C:\Program Files\DAEMON Tools 2008-06-15 10:58 0 ---ha-w C:\WINDOWS\system32\drivers\Msft_Kernel_ccdcmb_01005.Wdf 2008-06-15 10:57 --------- d-----w C:\Program Files\Nokia 2008-06-15 10:57 --------- d-----w C:\Program Files\MSXML 6.0 2008-06-15 10:56 --------- d-----w C:\Program Files\Common Files\Nokia 2008-06-15 10:50 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Installations 2008-06-11 14:25 --------- d-----w C:\Program Files\K-Lite Codec Pack 2008-06-11 00:44 --------- d-----w C:\Documents and Settings\Godi\Dane aplikacji\Media Player Classic 2008-05-28 19:16 96,966 ----a-w C:\WINDOWS\system32\drivers\klin.dat 2008-05-28 19:16 88,262 ----a-w C:\WINDOWS\system32\drivers\klick.dat 2008-05-28 19:16 112,144 ----a-w C:\WINDOWS\system32\drivers\kl1.sys 2008-05-23 13:16 --------- d-----w C:\Documents and Settings\Godi\Dane aplikacji\GanymedeNet 2008-05-18 14:16 --------- d-----w C:\Program Files\Google 2008-05-04 18:54 --------- d-----w C:\Program Files\Ganymede 2008-04-30 11:59 --------- d-----w C:\Program Files\Winamp 2008-04-20 00:45 --------- d-----w C:\Program Files\Common Files\NSV 2008-04-19 23:48 --------- d-----w C:\Program Files\Streamripper 2008-04-19 23:48 --------- d-----w C:\Documents and Settings\Godi\Dane aplikacji\streamripper 2008-03-31 21:25 682,496 ----a-w C:\WINDOWS\system32\divx.dll 2008-03-28 17:41 7,680 ----a-w C:\WINDOWS\system32\ff_vfw.dll 2008-03-25 17:36 --------- d-----w C:\Documents and Settings\Godi\Dane aplikacji\Creative 2008-03-25 16:40 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Microsoft Help 2008-03-21 20:30 3,596,288 ----a-w C:\WINDOWS\system32\qt-dx331.dll 2008-03-21 20:28 81,920 ----a-w C:\WINDOWS\system32\dpl100.dll 2008-03-08 08:21 --------- d-----w C:\Program Files\Java 2008-02-29 18:52 22,328 ----a-w C:\WINDOWS\system32\drivers\PnkBstrK.sys 2008-02-29 02:13 36,880 ----a-w C:\WINDOWS\system32\drivers\LMouFilt.Sys 2008-02-29 02:13 35,344 ----a-w C:\WINDOWS\system32\drivers\LHidFilt.Sys 2008-02-29 02:13 28,944 ----a-w C:\WINDOWS\system32\drivers\LUsbFilt.sys 2008-02-29 02:12 76,304 ----a-w C:\WINDOWS\KHALMNPR.Exe 2008-02-11 19:10 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Creative 2008-02-11 19:09 --------- d--h--w C:\Program Files\Creative Installation Information 2008-02-11 19:08 --------- d-----w C:\Program Files\Creative 2008-02-11 19:08 --------- d-----w C:\Program Files\Common Files\Creative 2008-02-06 22:52 --------- d-----w C:\Program Files\Damian Pasternak 2008-02-01 14:17 8,320 ----a-w C:\WINDOWS\system32\drivers\nmwcdnsuc.sys 2008-02-01 14:17 138,112 ----a-w C:\WINDOWS\system32\drivers\nmwcdnsu.sys 2008-01-29 11:01 16,168 ----a-w C:\WINDOWS\system32\drivers\GEARAspiWDM.sys 2008-01-23 00:42 --------- d-----w C:\Documents and Settings\Godi\Dane aplikacji\Talkback 2008-01-17 00:59 22,328 ----a-w C:\Documents and Settings\Godi\Dane aplikacji\PnkBstrK.sys 2008-01-10 12:16 159,839 ----a-w C:\WINDOWS\system32\xvidvfw.dll 2008-01-10 12:15 755,027 ----a-w C:\WINDOWS\system32\xvidcore.dll 2008-01-09 20:26 --------- d-----w C:\Program Files\Gadu-Gadu 2007-12-12 01:04 --------- d-----w C:\Program Files\mobile PhoneTools 2007-12-12 01:04 --------- d-----w C:\Program Files\LiveUpdate 2007-12-12 01:04 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\BVRP Software 2007-12-12 00:38 --------- d-----w C:\Program Files\WAP Upload 2007-12-12 00:33 0 ---ha-w C:\WINDOWS\system32\drivers\Msft_Kernel_motmodem_01005.Wdf 2007-12-12 00:29 --------- d-----w C:\Program Files\Common Files\Motorola Shared 2007-12-10 00:25 --------- d-----w C:\Program Files\FAR 2007-12-02 10:48 --------- d-----w C:\Documents and Settings\Godi\Dane aplikacji\Gadu-Gadu 2007-11-30 10:39 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\muvee Technologies 2007-11-30 10:38 --------- d-----w C:\Program Files\SightSpeed 2007-11-29 20:50 --------- d-----w C:\Documents and Settings\Godi\Dane aplikacji\Nokia Multimedia Player 2007-11-29 09:39 8,064 ----a-w C:\WINDOWS\system32\drivers\usbser_lowerfltj.sys 2007-11-29 09:39 8,064 ----a-w C:\WINDOWS\system32\drivers\usbser_lowerflt.sys 2007-11-29 09:39 19,328 ----a-w C:\WINDOWS\system32\drivers\ccdcmbo.sys 2007-11-29 09:39 16,896 ----a-w C:\WINDOWS\system32\drivers\ccdcmb.sys 2007-11-23 18:46 --------- d-----w C:\Documents and Settings\Godi\Dane aplikacji\Apple Computer 2007-11-23 17:56 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Apple Computer 2007-11-23 17:55 --------- d-----w C:\Program Files\Common Files\Apple 2007-11-23 17:55 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Apple 2007-11-18 11:33 --------- d-----w C:\Documents and Settings\Godi\Dane aplikacji\PC Suite 2007-11-16 22:11 --------- d-----w C:\Program Files\jv16 PowerTools 2005 2007-11-16 20:54 --------- d-----w C:\Program Files\GameSpy Arcade 2007-11-11 00:17 --------- d-----w C:\Documents and Settings\Godi\Dane aplikacji\Nokia 2007-11-04 21:46 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\nView_Profiles 2007-11-04 17:44 --------- d--h--r C:\Documents and Settings\Godi\Dane aplikacji\SecuROM 2007-10-21 20:46 --------- d-----w C:\Program Files\Skype 2007-10-21 20:46 --------- d-----w C:\Program Files\Common Files\Skype . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 01:44 15360] "NVIDIA nTune"="C:\Program Files\NVIDIA Corporation\nTune\nTuneCmd.exe" [2007-04-04 14:20 81920] "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2007-01-15 16:14 147456] "AlcoholAutomount"="C:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe" [2004-05-06 13:10 220672] "swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-10-19 21:11 68856] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Ai Nap"="C:\Program Files\ASUS\AI Suite\AiNap\AiNap.exe" [2006-10-24 15:45 1418752] "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-06-29 00:43 8466432] "NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-06-29 00:43 81920] "GrooveMonitor"="C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-27 00:47 31016] "NeroFilterCheck"="C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-12 15:40 155648] "DT HPW"="C:\Program Files\Portrait Displays\HP My Display\DTHtml.exe" [2007-04-25 12:36 280064] "HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2007-03-11 21:34 49152] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 05:25 144784] "PCSuiteTrayApplication"="C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe" [2007-06-18 15:10 271360] "C:\WINDOWS\system32\V0230Cvw.dll"="C:\WINDOWS\system32\V0230Cvw.dll" [2006-09-21 18:01 294912] "V0230Mon.exe"="C:\WINDOWS\V0230Mon.exe" [2006-09-06 18:01 32768] "AVFX Engine"="C:\Program Files\Creative\Creative Live! Cam\VideoFX\StartFX.exe" [2006-08-16 02:12 24576] "VolPanel"="C:\Program Files\Creative\Sound Blaster X-Fi\Volume Panel\VolPanlu.exe" [2007-02-28 18:50 180224] "DAEMON Tools"="C:\Program Files\DAEMON Tools\daemon.exe" [2005-12-10 15:57 133016] "CloneCDTray"="C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe" [2006-09-28 20:21 57344] "AppleSyncNotifier"="C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2008-07-22 20:42 116040] "QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-05-27 10:50 413696] "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-07-30 10:47 289064] "O2"="C:\Program Files\O2\bin\sprtcmd.exe" [2008-03-28 22:47 198184] "xsbvgzd"="C:\WINDOWS\system32\xsbvgzd.exe" [1996-08-15 19:32 22520] "AVP"="C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe" [2007-06-28 12:51 218376] "nwiz"="nwiz.exe" [2007-06-29 00:43 1626112 C:\WINDOWS\system32\nwiz.exe] "Logitech Hardware Abstraction Layer"="KHALMNPR.EXE" [2008-02-29 03:12 76304 C:\WINDOWS\KHALMNPR.Exe] "Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2008-02-29 03:12 76304 C:\WINDOWS\KHALMNPR.Exe] "BluetoothAuthenticationAgent"="bthprops.cpl" [2004-08-04 01:44 110592 C:\WINDOWS\system32\bthprops.cpl] "P17Helper"="SPIRun.dll" [2006-07-03 13:43 10752 C:\WINDOWS\system32\SPIRun.dll] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 01:44 15360] "Nokia.PCSync"="C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2007-06-19 10:17 1241088] C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\ Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-24 07:05:26 29696] Logitech SetPoint.lnk - C:\Program Files\Logitech\SetPoint\SetPoint.exe [2008-07-30 19:05:48 805392] SecureDoc.lnk - C:\Program Files\MSI\SecureDoc\Logon.exe [2007-09-16 22:19:21 82944] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LBTWlgn] 2008-05-02 02:42 72208 c:\Program Files\Common Files\Logitech\Bluetooth\LBTWLgn.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "VIDC.YV12"= yv12vfw.dll [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup] @="" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DmwClient] --a------ 2008-08-02 21:28 337408 I:\Program Files\DMW Client 3\dmwclient.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype] -ra------ 2007-09-13 13:31 22880040 C:\Program Files\Skype\Phone\Skype.exe [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusDisableNotify"=dword:00000001 "UpdatesDisableNotify"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "I:\\Program Files\\FlashGet\\FlashGet.exe"= "I:\\Program Files\\HLSW\\hlsw.exe"= "I:\\Program Files\\Tlen.pl\\tlen.exe"= "C:\\Program Files\\Gadu-Gadu\\gg.exe"= "C:\\Program Files\\Messenger\\msmsgs.exe"= "C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"= "C:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"= "C:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"= "J:\\wc\\wic.exe"= "J:\\wc\\wic_online.exe"= "J:\\wc\\wic_ds.exe"= "C:\\WINDOWS\\system32\\PnkBstrA.exe"= "C:\\WINDOWS\\system32\\PnkBstrB.exe"= "J:\\cd4\\iw3mp.exe"= "C:\\Program Files\\Bonjour\\mDNSResponder.exe"= "C:\\Program Files\\iTunes\\iTunes.exe"= "C:\\Program Files\\O2\\bin\\wificfg.exe"= "C:\\Program Files\\O2\\agent\\bin\\bcont.exe"= "C:\\Program Files\\Common Files\\SupportSoft\\bin\\ssrc.exe"= "C:\\Program Files\\O2\\agent\\bin\\bcont_nm.exe"= "C:\\Program Files\\Skype\\Phone\\Skype.exe"= R2 1;1;C:\WINDOWS\system32\pg.exe [2008-08-15 14:13] R2 360tray;360tray;C:\WINDOWS\system32\Fuck.exe [2008-08-15 11:13] R2 NIDomain;National Instruments Domain Service;C:\WINDOWS\system32\ntkrnlpy.exe [2008-08-16 18:22] R2 sprtsvc_O2;SupportSoft Sprocket Service (O2);C:\Program Files\O2\bin\sprtsvc.exe [2007-06-07 16:19] R3 klim5;Kaspersky Anti-Virus NDIS Filter;C:\WINDOWS\system32\DRIVERS\klim5.sys [2007-04-04 14:58] S2 TopdeskDriver;Desktop Drivers;C:\WINDOWS\system32\explsore.exe [2008-08-16 08:46] S3 nmwcdnsu;Nokia USB Flashing Phone Parent;C:\WINDOWS\system32\drivers\nmwcdnsu.sys [2008-02-01 15:17] S3 nmwcdnsuc;Nokia USB Flashing Generic;C:\WINDOWS\system32\drivers\nmwcdnsuc.sys [2008-02-01 15:17] S3 PRODIGY;PRODIGY;C:\WINDOWS\system32\Drivers\PRODIGY.SYS [2006-08-29 15:56] S3 usbscan;Sterownik skanera USB;C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-03 23:58] S3 USBSTOR;Sterownik magazynu masowego USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-03 23:08] S3 V0230Vfx;V0230Vfx;C:\WINDOWS\system32\DRIVERS\V0230Vfx.sys [2006-03-23 18:00] S3 V0230VID;Live! Cam Video IM Pro;C:\WINDOWS\system32\DRIVERS\V0230VID.sys [2006-09-28 18:01] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{b767e0d7-8539-11dc-b222-001a924b0197}] \Shell\AutoRun\command - L:\Autorun.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{fd3bb991-6485-11dc-90ca-806d6172696f}] \Shell\AutoRun\command - K:\setup\rsrc\Autorun.exe \Shell\dinstall\command - K:\Directx\dxsetup.exe *Newly Created Service* - BEEP . Contents of the 'Scheduled Tasks' folder 2008-08-03 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job - C:\Program Files\Apple Software Update\SoftwareUpdate.exe [2008-04-11 17:57] . - - - - ORPHANS REMOVED - - - - HKLM-Run-DmwClient - dmwclient.exe HKLM-Explorer_Run-dljj_df - C:\WINDOWS\system\llzjy080814.exe . ------- Supplementary Scan ------- . FireFox -: Profile - C:\Documents and Settings\Godi\Dane aplikacji\Mozilla\Firefox\Profiles\v1igy26j.default\ FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://wp.pl/ ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2003-08-16 19:24:00 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... C:\DOCUME~1\Godi\USTAWI~1\Temp\_tf7.tmp C:\WINDOWS\system32\xsbvgzd.dll 41240 bytes executable scan completed successfully hidden files: 2 ************************************************************************** [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\run] "C:\\WINDOWS\\system32\\V0230Cvw.dll"="C:\\WINDOWS\\system32\\RegSvr32.exe /s C:\\WINDOWS\\system32\\V0230Cvw.dll" . ------------------------ Other Running Processes ------------------------ . C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\system32\rundll32.exe C:\Program Files\Common Files\Portrait Displays\Shared\HookManager.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\WINDOWS\system32\CTSVCCDA.EXE C:\Program Files\Common Files\Portrait Displays\Shared\DTSRVC.exe C:\WINDOWS\system32\rundll32.exe C:\Program Files\NVIDIA Corporation\nTune\nTuneService.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\PnkBstrA.exe C:\Program Files\PC Connectivity Solution\ServiceLayer.exe C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe C:\Program Files\iPod\bin\iPodService.exe C:\WINDOWS\system32\wbem\wmiapsrv.exe C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.exe C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe . ************************************************************************** . Completion time: 2008-08-16 19:26:45 - machine was rebooted ComboFix-quarantined-files.txt 2008-08-16 18:26:42 Pre-Run: 2,989,395,968 bajtów wolnych Post-Run: 5,425,274,880 bajt˘w wolnych 564

**Posty:** 18165 · przez **wojtas** 17 Sie 2008, 12:08

Wykonaj to co jest podane w tym temacie

Zastosuj SDFix . Po pobraniu uruchom go a rozpakuje się do C:\SDFix. Uruchom komputer w trybie awaryjnym (F8 przy stracie systemu). Będąc w awaryjnym uruchom plik RunThis.bat z folderu SDFixa. Zatwierdź czyszczenie przez Y. Poczekaj aż ukończy i komputer zresetuje

Potem wejdz do folderu C:\SDFix wrzuc zawartość pliku Report.txt + log z combofixa oraz daj loga z hijacka