Zhakowane konto wow-a, logi po czyszczeniu

**Posty:** 90 · przez **Slime** 12 Lip 2009, 12:01

Mała prośba. Miałem problem z kontem w wow-ie. Jakiś dziadyga wbił mi się na konto i zarypał mi całą kasę:D. Przeskanowałem kompa pod kątem wszystkiego co możliwe i chciałbym żeby ktoś luknął na logi

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 11:52:31, on 2009-07-12 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\BitDefender\BitDefender 2009\vsserv.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Executive Software\DiskeeperLite\DKService.exe C:\WINDOWS\system32\nvsvc32.exe C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\RTHDCPL.EXE C:\WINDOWS\system32\RUNDLL32.EXE C:\Program Files\BitDefender\BitDefender 2009\bdagent.exe C:\Program Files\HP\HP Software Update\HPWuSchd2.exe C:\WINDOWS\system32\ctfmon.exe C:\program files\steam\steam.exe C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe C:\Program Files\BitDefender\BitDefender 2009\seccenter.exe C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe C:\Program Files\Common Files\Teleca Shared\Generic.exe C:\Program Files\Sony Ericsson\Mobile2\Mobile Phone Monitor\epmworker.exe C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://192.168.10.1/index.asp R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza R3 - URLSearchHook: SrchHook Class - {F4F10C1D-87C7-404A-B4B3-000000000000} - C:\PROGRA~1\DAP\SBSearch.dll (file missing) O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O3 - Toolbar: BitDefender Toolbar - {381FFDE8-2394-4f90-B10D-FC6124A40F8C} - C:\Program Files\BitDefender\BitDefender 2009\IEToolbar.dll O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE O4 - HKLM\..\Run: [JMB36X IDE Setup] C:\WINDOWS\JM\JMInsIDE.exe O4 - HKLM\..\Run: [JMB36X Configure] C:\WINDOWS\system32\JMRaidSetup.exe boot O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe" O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [BDAgent] "C:\Program Files\BitDefender\BitDefender 2009\bdagent.exe" O4 - HKLM\..\Run: [BitDefender Antiphishing Helper] "C:\Program Files\BitDefender\BitDefender 2009\IEShow.exe" O4 - HKLM\..\Run: [Sony Ericsson PC Suite] "C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [Steam] "c:\program files\steam\steam.exe" -silent O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O23 - Service: BitDefender Arrakis Server (Arrakis3) - BitDefender S.R.L. http://www.bitdefender.com - C:\Program Files\Common Files\BitDefender\BitDefender Arrakis Server\bin\Arrakis3.exe O23 - Service: Diskeeper - Executive Software International, Inc. - C:\Program Files\Executive Software\DiskeeperLite\DKService.exe O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe O23 - Service: BitDefender Desktop Update Service (LIVESRV) - Unknown owner - C:\Program Files\Common Files\BitDefender\BitDefender Update Service\livesrv.exe (file missing) O23 - Service: MATLAB Server (matlabserver) - Unknown owner - C:\Program Files\MATLAB71\webserver\bin\win32\matlabserver.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe O23 - Service: BitDefender Virus Shield (VSSERV) - BitDefender S. R. L. - C:\Program Files\BitDefender\BitDefender 2009\vsserv.exe -- End of file - 6315 bytes

Z góry wielkie dzięki

**Posty:** 8001 · przez **Okocza** 12 Lip 2009, 12:25

Slime napisał(a):O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k

fix w hj - nie ma nic groźnego w logu

daj log z rsit, chociaz watpie zeby tam cos bylo..

**Posty:** 90 · przez **Slime** 12 Lip 2009, 13:42

Kod: Zaznacz wszystko: Logfile of random's system information tool 1.06 (written by random/random) Run by Slimak at 2009-07-12 13:41:02 Microsoft Windows XP Professional Dodatek Service Pack 2 System drive C: has 20 GB (26%) free of 76 GB Total RAM: 2046 MB (60% free) Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 13:41:08, on 2009-07-12 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\BitDefender\BitDefender 2009\vsserv.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Executive Software\DiskeeperLite\DKService.exe C:\WINDOWS\system32\nvsvc32.exe C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\RTHDCPL.EXE C:\WINDOWS\system32\RUNDLL32.EXE C:\Program Files\BitDefender\BitDefender 2009\bdagent.exe C:\Program Files\HP\HP Software Update\HPWuSchd2.exe C:\WINDOWS\system32\ctfmon.exe C:\program files\steam\steam.exe C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe C:\Program Files\BitDefender\BitDefender 2009\seccenter.exe C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe C:\Program Files\Common Files\Teleca Shared\Generic.exe C:\Program Files\Sony Ericsson\Mobile2\Mobile Phone Monitor\epmworker.exe C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Tlen.pl\tlen.exe C:\Documents and Settings\Slimak\Pulpit\RSIT.exe C:\Program Files\Trend Micro\HijackThis\Slimak.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://192.168.10.1/index.asp R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza R3 - URLSearchHook: SrchHook Class - {F4F10C1D-87C7-404A-B4B3-000000000000} - C:\PROGRA~1\DAP\SBSearch.dll (file missing) O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O3 - Toolbar: BitDefender Toolbar - {381FFDE8-2394-4f90-B10D-FC6124A40F8C} - C:\Program Files\BitDefender\BitDefender 2009\IEToolbar.dll O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE O4 - HKLM\..\Run: [JMB36X IDE Setup] C:\WINDOWS\JM\JMInsIDE.exe O4 - HKLM\..\Run: [JMB36X Configure] C:\WINDOWS\system32\JMRaidSetup.exe boot O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe" O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [BDAgent] "C:\Program Files\BitDefender\BitDefender 2009\bdagent.exe" O4 - HKLM\..\Run: [BitDefender Antiphishing Helper] "C:\Program Files\BitDefender\BitDefender 2009\IEShow.exe" O4 - HKLM\..\Run: [Sony Ericsson PC Suite] "C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [Steam] "c:\program files\steam\steam.exe" -silent O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O23 - Service: BitDefender Arrakis Server (Arrakis3) - BitDefender S.R.L. http://www.bitdefender.com - C:\Program Files\Common Files\BitDefender\BitDefender Arrakis Server\bin\Arrakis3.exe O23 - Service: Diskeeper - Executive Software International, Inc. - C:\Program Files\Executive Software\DiskeeperLite\DKService.exe O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe O23 - Service: BitDefender Desktop Update Service (LIVESRV) - Unknown owner - C:\Program Files\Common Files\BitDefender\BitDefender Update Service\livesrv.exe (file missing) O23 - Service: MATLAB Server (matlabserver) - Unknown owner - C:\Program Files\MATLAB71\webserver\bin\win32\matlabserver.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe O23 - Service: BitDefender Virus Shield (VSSERV) - BitDefender S. R. L. - C:\Program Files\BitDefender\BitDefender 2009\vsserv.exe -- End of file - 6369 bytes ======Scheduled tasks folder====== C:\WINDOWS\tasks\Ad-Aware Update (Weekly).job ======Registry dump====== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}] Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2009-02-27 75128] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{53707962-6F74-2D53-2644-206D7942484F}] Spybot-S&D IE Protection - C:\PROGRA~1\SPYBOT~1\SDHelper.dll [2009-01-26 1879896] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar] {381FFDE8-2394-4f90-B10D-FC6124A40F8C} - BitDefender Toolbar - C:\Program Files\BitDefender\BitDefender 2009\IEToolbar.dll [2009-04-01 95536] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run] "RTHDCPL"=C:\WINDOWS\RTHDCPL.EXE [2006-11-14 16270848] "SkyTel"=C:\WINDOWS\SkyTel.EXE [2006-05-16 2879488] "Alcmtr"=C:\WINDOWS\ALCMTR.EXE [2005-05-03 69632] "JMB36X IDE Setup"=C:\WINDOWS\JM\JMInsIDE.exe [2006-10-30 36864] "JMB36X Configure"=C:\WINDOWS\system32\JMRaidSetup.exe [2006-10-30 1953792] "NvCplDaemon"=C:\WINDOWS\system32\NvCpl.dll [2009-02-18 13680640] "nwiz"=nwiz.exe /install [] "NvMediaCenter"=C:\WINDOWS\system32\NvMcTray.dll [2009-02-18 86016] "WinampAgent"=C:\Program Files\Winamp\winampa.exe [] "Adobe Reader Speed Launcher"=C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [2009-02-27 35696] "BDAgent"=C:\Program Files\BitDefender\BitDefender 2009\bdagent.exe [2009-04-28 778240] "BitDefender Antiphishing Helper"=C:\Program Files\BitDefender\BitDefender 2009\IEShow.exe [2009-04-01 69632] "Sony Ericsson PC Suite"=C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe [2007-02-20 741376] "HP Software Update"=C:\Program Files\HP\HP Software Update\HPWuSchd2.exe [2006-02-19 49152] "NWEReboot"= [] "NeroFilterCheck"=C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe [2006-01-12 155648] [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"=C:\WINDOWS\system32\ctfmon.exe [2004-08-04 15360] "Steam"=c:\program files\steam\steam.exe [2009-06-11 1217784] "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"=C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe [2006-06-01 94208] "SpybotSD TeaTimer"=C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe [2009-03-05 2260480] C:\Documents and Settings\All Users\Menu Start\Programy\Autostart HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\procexp90.Sys] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Lavasoft Ad-Aware Service] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\procexp90.Sys] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{1a3e09be-1e45-494b-9174-d7385b45bbf5}] [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System] "DisableTaskMgr"=0 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System] "dontdisplaylastusername"=0 "legalnoticecaption"= "legalnoticetext"= "shutdownwithoutlogon"=1 "undockwithoutlogon"=1 [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer] "NoDriveTypeAutoRun"=145 [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] "%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "C:\Program Files\Tlen.pl\tlen.exe"="C:\Program Files\Tlen.pl\tlen.exe:*:Enabled:Komunikator Tlen.pl" "C:\Program Files\Gadu-Gadu\gg.exe"="C:\Program Files\Gadu-Gadu\gg.exe:*:Enabled:Gadu-Gadu - program główny" "D:\World of Warcraft\BackgroundDownloader.exe"="D:\World of Warcraft\BackgroundDownloader.exe:*:Enabled:BackgroundDownloader" "D:\World of Warcraft\BNUpdate.exe"="D:\World of Warcraft\BNUpdate.exe:*:Enabled:BNUpdate" "D:\World of Warcraft\Launcher.exe"="D:\World of Warcraft\Launcher.exe:*:Enabled:Launcher" "D:\World of Warcraft\Wow.exe"="D:\World of Warcraft\Wow.exe:*:Enabled:Wow" "C:\Program Files\uTorrent\uTorrent.exe"="C:\Program Files\uTorrent\uTorrent.exe:*:Enabled:µTorrent" "C:\Program Files\Steam\Steam.exe"="C:\Program Files\Steam\Steam.exe:*:Enabled:Steam Client" "C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe"="C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe:*:Enabled:hpqtra08.exe" "C:\Program Files\HP\Digital Imaging\bin\hpqste08.exe"="C:\Program Files\HP\Digital Imaging\bin\hpqste08.exe:*:Enabled:hpqste08.exe" "C:\Program Files\HP\Digital Imaging\bin\hpofxm08.exe"="C:\Program Files\HP\Digital Imaging\bin\hpofxm08.exe:*:Enabled:hpofxm08.exe" "C:\Program Files\HP\Digital Imaging\bin\hposfx08.exe"="C:\Program Files\HP\Digital Imaging\bin\hposfx08.exe:*:Enabled:hposfx08.exe" "C:\Program Files\HP\Digital Imaging\bin\hposid01.exe"="C:\Program Files\HP\Digital Imaging\bin\hposid01.exe:*:Enabled:hposid01.exe" "C:\Program Files\HP\Digital Imaging\bin\hpqscnvw.exe"="C:\Program Files\HP\Digital Imaging\bin\hpqscnvw.exe:*:Enabled:hpqscnvw.exe" "C:\Program Files\HP\Digital Imaging\bin\hpqkygrp.exe"="C:\Program Files\HP\Digital Imaging\bin\hpqkygrp.exe:*:Enabled:hpqkygrp.exe" "C:\Program Files\HP\Digital Imaging\bin\hpqCopy.exe"="C:\Program Files\HP\Digital Imaging\bin\hpqCopy.exe:*:Enabled:hpqcopy.exe" "C:\Program Files\HP\Digital Imaging\bin\hpfccopy.exe"="C:\Program Files\HP\Digital Imaging\bin\hpfccopy.exe:*:Enabled:hpfccopy.exe" "C:\Program Files\HP\Digital Imaging\bin\hpzwiz01.exe"="C:\Program Files\HP\Digital Imaging\bin\hpzwiz01.exe:*:Enabled:hpzwiz01.exe" "C:\Program Files\HP\Digital Imaging\bin\hpoews01.exe"="C:\Program Files\HP\Digital Imaging\bin\hpoews01.exe:*:Enabled:hpoews01.exe" "C:\Program Files\HP\Digital Imaging\bin\hpqnrs08.exe"="C:\Program Files\HP\Digital Imaging\bin\hpqnrs08.exe:*:Enabled:hpqnrs08.exe" "C:\Program Files\Ventrilo\Ventrilo.exe"="C:\Program Files\Ventrilo\Ventrilo.exe:*:Enabled:Ventrilo.exe" [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list] "%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\C] shell\AutoRun\command - C:\q1alx.exe shell\open\command - C:\q1alx.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{197fbc0e-2355-11de-9b8e-001bfcdb3e77}] shell\AutoRun\command - G:\q1alx.exe shell\open\command - G:\q1alx.exe ======List of files/folders created in the last 1 months====== 2009-07-12 13:41:02 ----D---- C:\rsit 2009-07-12 11:52:16 ----D---- C:\Program Files\Trend Micro 2009-07-12 10:37:17 ----D---- C:\Documents and Settings\Slimak\Dane aplikacji\Malwarebytes 2009-07-12 10:37:10 ----D---- C:\Program Files\Malwarebytes' Anti-Malware 2009-07-12 10:37:10 ----D---- C:\Documents and Settings\All Users\Dane aplikacji\Malwarebytes 2009-07-12 10:21:17 ----D---- C:\Program Files\Spybot - Search & Destroy 2009-07-12 10:21:17 ----D---- C:\Documents and Settings\All Users\Dane aplikacji\Spybot - Search & Destroy 2009-07-12 10:19:16 ----A---- C:\WINDOWS\system32\lsdelete.exe 2009-07-12 09:24:49 ----HDC---- C:\Documents and Settings\All Users\Dane aplikacji\{EF63305C-BAD7-4144-9208-D65528260864} 2009-07-12 09:24:39 ----D---- C:\Program Files\Lavasoft 2009-07-12 09:24:39 ----D---- C:\Documents and Settings\All Users\Dane aplikacji\Lavasoft 2009-07-07 15:48:42 ----D---- C:\WINDOWS\system32\appmgmt 2009-07-07 15:06:32 ----A---- C:\WINDOWS\ntbtlog.txt 2009-07-06 16:44:00 ----D---- C:\WINDOWS\ERDNT 2009-07-06 16:44:00 ----D---- C:\Qoobox 2009-07-06 16:43:59 ----D---- C:\ComboFix 2009-07-06 16:43:58 ----A---- C:\WINDOWS\system32\CF5567.exe 2009-07-06 10:46:28 ----D---- C:\Documents and Settings\Slimak\Dane aplikacji\WordToPDF 2009-07-06 10:46:25 ----D---- C:\Program Files\WordToPDF 2009-07-06 10:40:36 ----D---- C:\Documents and Settings\Slimak\Dane aplikacji\pdf995 2009-07-06 10:40:36 ----A---- C:\WINDOWS\pdf995.ini 2009-07-06 10:36:50 ----D---- C:\Documents and Settings\All Users\Dane aplikacji\pdf995 2009-07-06 10:36:49 ----A---- C:\WINDOWS\system32\pdfmona.dll 2009-07-06 10:36:49 ----A---- C:\WINDOWS\system32\pdf995mon.dll 2009-07-06 10:36:48 ----D---- C:\Program Files\pdf995 2009-07-06 10:27:59 ----A---- C:\WINDOWS\system32\pdfmonnt.dll 2009-06-27 13:06:00 ----D---- C:\Program Files\Executive Software 2009-06-23 22:44:03 ----A---- C:\WINDOWS\uninst.exe ======List of files/folders modified in the last 1 months====== 2009-07-12 12:06:48 ----D---- C:\Program Files\Steam 2009-07-12 11:54:16 ----D---- C:\Program Files\Mozilla Firefox 2009-07-12 11:53:32 ----D---- C:\WINDOWS\system32\CatRoot2 2009-07-12 11:52:16 ----RD---- C:\Program Files 2009-07-12 11:44:53 ----D---- C:\WINDOWS\system32 2009-07-12 11:44:48 ----D---- C:\WINDOWS\Temp 2009-07-12 11:42:02 ----D---- C:\WINDOWS 2009-07-12 11:41:19 ----D---- C:\WINDOWS\system32\drivers 2009-07-12 11:39:45 ----SHD---- C:\RECYCLER 2009-07-12 09:26:52 ----HD---- C:\WINDOWS\inf 2009-07-12 09:26:46 ----SD---- C:\WINDOWS\Tasks 2009-07-12 09:26:44 ----DC---- C:\WINDOWS\system32\DRVSTORE 2009-07-12 09:24:49 ----SHD---- C:\WINDOWS\Installer 2009-07-12 09:24:49 ----HD---- C:\Config.Msi 2009-07-12 09:24:33 ----D---- C:\WINDOWS\WinSxS 2009-07-11 11:25:24 ----A---- C:\WINDOWS\bestplayer.ini 2009-07-11 09:21:27 ----D---- C:\Program Files\PowerArchiver 2009-07-11 09:20:17 ----D---- C:\Documents and Settings\Slimak\Dane aplikacji\uTorrent 2009-07-09 22:11:23 ----A---- C:\WINDOWS\matlab.ini 2009-07-08 11:00:58 ----SD---- C:\Documents and Settings\Slimak\Dane aplikacji\Microsoft 2009-07-07 21:42:07 ----SHD---- C:\WINDOWS\CSC 2009-07-07 15:48:38 ----D---- C:\Program Files\Common Files\Microsoft Shared 2009-07-07 15:48:36 ----D---- C:\WINDOWS\ShellNew 2009-07-07 15:42:38 ----A---- C:\WINDOWS\ODBC.INI 2009-07-07 15:40:50 ----D---- C:\WINDOWS\system 2009-07-07 15:04:38 ----A---- C:\WINDOWS\bdagent.INI 2009-07-07 15:02:13 ----RSHDC---- C:\WINDOWS\system32\dllcache 2009-07-07 11:07:33 ----D---- C:\Program Files\DAP 2009-07-07 11:07:17 ----D---- C:\Documents and Settings\All Users\Dane aplikacji\SpeedBit 2009-07-07 11:06:48 ----AD---- C:\Documents and Settings\All Users\Dane aplikacji\TEMP 2009-07-02 07:37:13 ----A---- C:\WINDOWS\NeroDigital.ini 2009-06-27 13:06:39 ----D---- C:\WINDOWS\Help 2009-06-27 13:06:18 ----D---- C:\Program Files\Common Files\InstallShield 2009-06-27 10:21:25 ----D---- C:\Documents and Settings\Slimak\Dane aplikacji\Real 2009-06-16 17:46:30 ----D---- C:\Klim_mpliki ======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)====== R1 bdftdif;bdftdif; \??\C:\Program Files\Common Files\BitDefender\BitDefender Firewall\bdftdif.sys [] R1 intelppm;Sterownik procesora Intel; C:\WINDOWS\system32\DRIVERS\intelppm.sys [2004-08-04 40320] R2 BDVEDISK;BDVEDISK; \??\C:\Program Files\BitDefender\BitDefender 2009\BDVEDISK.sys [] R3 Arp1394;Protokół klienta 1394 ARP; C:\WINDOWS\system32\DRIVERS\arp1394.sys [2004-08-04 60800] R3 bdfm;BDFM; C:\WINDOWS\system32\drivers\bdfm.sys [2009-03-27 111112] R3 Bdfndisf;BitDefender Firewall NDIS Filter Service; C:\WINDOWS\system32\DRIVERS\bdfndisf.sys [2009-04-01 104328] R3 bdfsfltr;bdfsfltr; C:\WINDOWS\system32\drivers\bdfsfltr.sys [2009-03-27 242184] R3 BDSelfPr;BDSelfPr; \??\C:\Program Files\BitDefender\BitDefender 2009\bdselfpr.sys [] R3 HDAudBus;Microsoft UAA Bus Driver for High Definition Audio; C:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2005-01-07 138752] R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\WINDOWS\system32\drivers\RtkHDAud.sys [2006-11-15 4225920] R3 MTsensor;ATK0110 ACPI UTILITY; C:\WINDOWS\system32\DRIVERS\ASACPI.sys [2004-08-13 5810] R3 NIC1394;Sterownik sieci 1394; C:\WINDOWS\system32\DRIVERS\nic1394.sys [2004-08-04 61824] R3 nv;nv; C:\WINDOWS\system32\DRIVERS\nv4_mini.sys [2009-02-18 6308224] R3 NVENETFD;NVIDIA nForce Networking Controller Driver; C:\WINDOWS\system32\DRIVERS\NVENETFD.sys [2006-02-17 34176] R3 nvnetbus;NVIDIA Network Bus Enumerator; C:\WINDOWS\system32\DRIVERS\nvnetbus.sys [2006-02-17 13056] R3 usbehci;Sterownik Miniport rozszerzonego kontrolera hosta USB 2.0 Microsoft; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2004-08-03 26624] R3 usbhub;Koncentrator z obsługą USB2; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2004-08-03 57600] R3 usbohci;Sterownik Miniport otwartego kontrolera hosta USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbohci.sys [2004-08-03 17024] S3 AVPsys;AVPsys; \??\C:\WINDOWS\system32\drivers\cdaudio.sys [] S3 HPZid412;IEEE-1284.4 Driver HPZid412; C:\WINDOWS\system32\DRIVERS\HPZid412.sys [2006-04-12 49664] S3 HPZipr12;Print Class Driver for IEEE-1284.4 HPZipr12; C:\WINDOWS\system32\DRIVERS\HPZipr12.sys [2006-04-12 16496] S3 HPZius12;USB to IEEE-1284.4 Translation Driver HPZius12; C:\WINDOWS\system32\DRIVERS\HPZius12.sys [2006-04-12 21568] S3 Profos;Profos; \??\C:\Program Files\Common Files\BitDefender\BitDefender Threat Scanner\profos.sys [] S3 s616bus;Sony Ericsson Device 616 driver (WDM); C:\WINDOWS\system32\DRIVERS\s616bus.sys [2007-04-03 83208] S3 s616mdfl;Sony Ericsson Device 616 USB WMC Modem Filter; C:\WINDOWS\system32\DRIVERS\s616mdfl.sys [2007-04-03 15112] S3 s616mdm;Sony Ericsson Device 616 USB WMC Modem Driver; C:\WINDOWS\system32\DRIVERS\s616mdm.sys [2007-04-03 108680] S3 s616mgmt;Sony Ericsson Device 616 USB WMC Device Management Drivers (WDM); C:\WINDOWS\system32\DRIVERS\s616mgmt.sys [2007-04-03 100360] S3 s616nd5;Sony Ericsson Device 616 USB Ethernet Emulation SEMC616 (NDIS); C:\WINDOWS\system32\DRIVERS\s616nd5.sys [2007-04-03 23176] S3 s616obex;Sony Ericsson Device 616 USB WMC OBEX Interface; C:\WINDOWS\system32\DRIVERS\s616obex.sys [2007-04-03 98568] S3 s616unic;Sony Ericsson Device 616 USB Ethernet Emulation SEMC616 (WDM); C:\WINDOWS\system32\DRIVERS\s616unic.sys [2007-04-03 99080] S3 Trufos;Trufos; \??\C:\Program Files\Common Files\BitDefender\BitDefender Threat Scanner\trufos.sys [] S3 usbccgp;Rodzajowy sterownik nadrzędny USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2004-08-03 31616] S3 usbprint;Klasa PRINTER USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2004-08-03 25856] S3 usbscan;Sterownik skanera USB; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-03 15104] S3 USBSTOR;Sterownik magazynu masowego USB; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-03 26496] S3 WpdUsb;WpdUsb; C:\WINDOWS\System32\Drivers\wpdusb.sys [2005-01-28 18944] S4 IntelIde;IntelIde; C:\WINDOWS\system32\drivers\IntelIde.sys [] ======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)====== R2 Diskeeper;Diskeeper; C:\Program Files\Executive Software\DiskeeperLite\DKService.exe [2002-10-16 176128] R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service; C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe [2009-07-03 1029456] R2 NVSvc;NVIDIA Display Driver Service; C:\WINDOWS\system32\nvsvc32.exe [2009-02-18 163908] R2 StarWindService;StarWind iSCSI Service; C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe [2005-04-02 217600] R2 UMWdf;Windows User Mode Driver Framework; C:\WINDOWS\system32\wdfmgr.exe [2005-01-28 38912] R2 VSSERV;BitDefender Virus Shield; C:\Program Files\BitDefender\BitDefender 2009\vsserv.exe [2009-04-01 1626112] S2 LIVESRV;BitDefender Desktop Update Service; C:\Program Files\Common Files\BitDefender\BitDefender Update Service\livesrv.exe /service [] S2 matlabserver;MATLAB Server; C:\Program Files\MATLAB71\webserver\bin\win32\matlabserver.exe [2005-07-27 536576] S2 Pml Driver HPZ12;Pml Driver HPZ12; C:\WINDOWS\system32\HPZipm12.exe [2006-03-03 69632] S3 Arrakis3;BitDefender Arrakis Server; C:\Program Files\Common Files\BitDefender\BitDefender Arrakis Server\bin\Arrakis3.exe [2008-07-17 118784] S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2007-10-24 33800] S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2007-10-24 70144] S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; C:\WINDOWS\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe [2007-10-09 36864] S3 idsvc;Windows CardSpace; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2007-10-11 864256] S3 scan;BitDefender Threat Scanner; C:\WINDOWS\System32\svchost.exe [2004-08-04 14336] S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2007-10-11 122880] -----------------EOF-----------------

**Posty:** 8001 · przez **Okocza** 12 Lip 2009, 13:50

wklej w notatnik

Kod: Zaznacz wszystko: Windows Registry Editor Version 5.00 [-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\C] [-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{197fbc0e-2355-11de-9b8e-001bfcdb3e77}]

zapisz jako fix.reg i odpal - dodajesz do rejestru

Pobierz narzędzie The Avenger i w okienku głównym programu wklej:

Kod: Zaznacz wszystko: Files to delete: C:\q1alx.exe G:\q1alx.exe

Klikasz Done, a następnie zielone światełko i zgadzasz się na restart klikając OK.

wracasz z logiem z RSIT

**Posty:** 90 · przez **Slime** 12 Lip 2009, 14:51

Kod: Zaznacz wszystko: Logfile of random's system information tool 1.06 (written by random/random) Run by Slimak at 2009-07-12 14:50:04 Microsoft Windows XP Professional Dodatek Service Pack 2 System drive C: has 19 GB (25%) free of 76 GB Total RAM: 2046 MB (68% free) Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 14:50:15, on 2009-07-12 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\BitDefender\BitDefender 2009\vsserv.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Executive Software\DiskeeperLite\DKService.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\nvsvc32.exe C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\RTHDCPL.EXE C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\system32\RUNDLL32.EXE C:\Program Files\BitDefender\BitDefender 2009\bdagent.exe C:\Program Files\HP\HP Software Update\HPWuSchd2.exe C:\WINDOWS\system32\ctfmon.exe C:\program files\steam\steam.exe C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe C:\Program Files\BitDefender\BitDefender 2009\seccenter.exe C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe C:\Program Files\Common Files\Teleca Shared\Generic.exe C:\Program Files\Sony Ericsson\Mobile2\Mobile Phone Monitor\epmworker.exe C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Documents and Settings\Slimak\Pulpit\RSIT.exe C:\Program Files\Trend Micro\HijackThis\Slimak.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://192.168.10.1/index.asp R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza R3 - URLSearchHook: SrchHook Class - {F4F10C1D-87C7-404A-B4B3-000000000000} - C:\PROGRA~1\DAP\SBSearch.dll (file missing) O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O3 - Toolbar: BitDefender Toolbar - {381FFDE8-2394-4f90-B10D-FC6124A40F8C} - C:\Program Files\BitDefender\BitDefender 2009\IEToolbar.dll O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE O4 - HKLM\..\Run: [JMB36X IDE Setup] C:\WINDOWS\JM\JMInsIDE.exe O4 - HKLM\..\Run: [JMB36X Configure] C:\WINDOWS\system32\JMRaidSetup.exe boot O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe" O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [BDAgent] "C:\Program Files\BitDefender\BitDefender 2009\bdagent.exe" O4 - HKLM\..\Run: [BitDefender Antiphishing Helper] "C:\Program Files\BitDefender\BitDefender 2009\IEShow.exe" O4 - HKLM\..\Run: [Sony Ericsson PC Suite] "C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [Steam] "c:\program files\steam\steam.exe" -silent O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O23 - Service: BitDefender Arrakis Server (Arrakis3) - BitDefender S.R.L. http://www.bitdefender.com - C:\Program Files\Common Files\BitDefender\BitDefender Arrakis Server\bin\Arrakis3.exe O23 - Service: Diskeeper - Executive Software International, Inc. - C:\Program Files\Executive Software\DiskeeperLite\DKService.exe O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe O23 - Service: BitDefender Desktop Update Service (LIVESRV) - Unknown owner - C:\Program Files\Common Files\BitDefender\BitDefender Update Service\livesrv.exe (file missing) O23 - Service: MATLAB Server (matlabserver) - Unknown owner - C:\Program Files\MATLAB71\webserver\bin\win32\matlabserver.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe O23 - Service: BitDefender Virus Shield (VSSERV) - BitDefender S. R. L. - C:\Program Files\BitDefender\BitDefender 2009\vsserv.exe -- End of file - 6334 bytes ======Scheduled tasks folder====== C:\WINDOWS\tasks\Ad-Aware Update (Weekly).job ======Registry dump====== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}] Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2009-02-27 75128] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{53707962-6F74-2D53-2644-206D7942484F}] Spybot-S&D IE Protection - C:\PROGRA~1\SPYBOT~1\SDHelper.dll [2009-01-26 1879896] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar] {381FFDE8-2394-4f90-B10D-FC6124A40F8C} - BitDefender Toolbar - C:\Program Files\BitDefender\BitDefender 2009\IEToolbar.dll [2009-04-01 95536] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run] "RTHDCPL"=C:\WINDOWS\RTHDCPL.EXE [2006-11-14 16270848] "SkyTel"=C:\WINDOWS\SkyTel.EXE [2006-05-16 2879488] "Alcmtr"=C:\WINDOWS\ALCMTR.EXE [2005-05-03 69632] "JMB36X IDE Setup"=C:\WINDOWS\JM\JMInsIDE.exe [2006-10-30 36864] "JMB36X Configure"=C:\WINDOWS\system32\JMRaidSetup.exe [2006-10-30 1953792] "NvCplDaemon"=C:\WINDOWS\system32\NvCpl.dll [2009-02-18 13680640] "nwiz"=nwiz.exe /install [] "NvMediaCenter"=C:\WINDOWS\system32\NvMcTray.dll [2009-02-18 86016] "WinampAgent"=C:\Program Files\Winamp\winampa.exe [] "Adobe Reader Speed Launcher"=C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [2009-02-27 35696] "BDAgent"=C:\Program Files\BitDefender\BitDefender 2009\bdagent.exe [2009-04-28 778240] "BitDefender Antiphishing Helper"=C:\Program Files\BitDefender\BitDefender 2009\IEShow.exe [2009-04-01 69632] "Sony Ericsson PC Suite"=C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe [2007-02-20 741376] "HP Software Update"=C:\Program Files\HP\HP Software Update\HPWuSchd2.exe [2006-02-19 49152] "NWEReboot"= [] "NeroFilterCheck"=C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe [2006-01-12 155648] [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"=C:\WINDOWS\system32\ctfmon.exe [2004-08-04 15360] "Steam"=c:\program files\steam\steam.exe [2009-06-11 1217784] "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"=C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe [2006-06-01 94208] "SpybotSD TeaTimer"=C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe [2009-03-05 2260480] C:\Documents and Settings\All Users\Menu Start\Programy\Autostart HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\procexp90.Sys] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Lavasoft Ad-Aware Service] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\procexp90.Sys] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{1a3e09be-1e45-494b-9174-d7385b45bbf5}] [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System] "DisableTaskMgr"=0 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System] "dontdisplaylastusername"=0 "legalnoticecaption"= "legalnoticetext"= "shutdownwithoutlogon"=1 "undockwithoutlogon"=1 [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer] "NoDriveTypeAutoRun"=145 [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] "%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "C:\Program Files\Tlen.pl\tlen.exe"="C:\Program Files\Tlen.pl\tlen.exe:*:Enabled:Komunikator Tlen.pl" "C:\Program Files\Gadu-Gadu\gg.exe"="C:\Program Files\Gadu-Gadu\gg.exe:*:Enabled:Gadu-Gadu - program główny" "D:\World of Warcraft\BackgroundDownloader.exe"="D:\World of Warcraft\BackgroundDownloader.exe:*:Enabled:BackgroundDownloader" "D:\World of Warcraft\BNUpdate.exe"="D:\World of Warcraft\BNUpdate.exe:*:Enabled:BNUpdate" "D:\World of Warcraft\Launcher.exe"="D:\World of Warcraft\Launcher.exe:*:Enabled:Launcher" "D:\World of Warcraft\Wow.exe"="D:\World of Warcraft\Wow.exe:*:Enabled:Wow" "C:\Program Files\uTorrent\uTorrent.exe"="C:\Program Files\uTorrent\uTorrent.exe:*:Enabled:µTorrent" "C:\Program Files\Steam\Steam.exe"="C:\Program Files\Steam\Steam.exe:*:Enabled:Steam Client" "C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe"="C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe:*:Enabled:hpqtra08.exe" "C:\Program Files\HP\Digital Imaging\bin\hpqste08.exe"="C:\Program Files\HP\Digital Imaging\bin\hpqste08.exe:*:Enabled:hpqste08.exe" "C:\Program Files\HP\Digital Imaging\bin\hpofxm08.exe"="C:\Program Files\HP\Digital Imaging\bin\hpofxm08.exe:*:Enabled:hpofxm08.exe" "C:\Program Files\HP\Digital Imaging\bin\hposfx08.exe"="C:\Program Files\HP\Digital Imaging\bin\hposfx08.exe:*:Enabled:hposfx08.exe" "C:\Program Files\HP\Digital Imaging\bin\hposid01.exe"="C:\Program Files\HP\Digital Imaging\bin\hposid01.exe:*:Enabled:hposid01.exe" "C:\Program Files\HP\Digital Imaging\bin\hpqscnvw.exe"="C:\Program Files\HP\Digital Imaging\bin\hpqscnvw.exe:*:Enabled:hpqscnvw.exe" "C:\Program Files\HP\Digital Imaging\bin\hpqkygrp.exe"="C:\Program Files\HP\Digital Imaging\bin\hpqkygrp.exe:*:Enabled:hpqkygrp.exe" "C:\Program Files\HP\Digital Imaging\bin\hpqCopy.exe"="C:\Program Files\HP\Digital Imaging\bin\hpqCopy.exe:*:Enabled:hpqcopy.exe" "C:\Program Files\HP\Digital Imaging\bin\hpfccopy.exe"="C:\Program Files\HP\Digital Imaging\bin\hpfccopy.exe:*:Enabled:hpfccopy.exe" "C:\Program Files\HP\Digital Imaging\bin\hpzwiz01.exe"="C:\Program Files\HP\Digital Imaging\bin\hpzwiz01.exe:*:Enabled:hpzwiz01.exe" "C:\Program Files\HP\Digital Imaging\bin\hpoews01.exe"="C:\Program Files\HP\Digital Imaging\bin\hpoews01.exe:*:Enabled:hpoews01.exe" "C:\Program Files\HP\Digital Imaging\bin\hpqnrs08.exe"="C:\Program Files\HP\Digital Imaging\bin\hpqnrs08.exe:*:Enabled:hpqnrs08.exe" "C:\Program Files\Ventrilo\Ventrilo.exe"="C:\Program Files\Ventrilo\Ventrilo.exe:*:Enabled:Ventrilo.exe" [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list] "%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" ======List of files/folders created in the last 1 months====== 2009-07-12 14:41:38 ----D---- C:\Avenger 2009-07-12 14:41:37 ----A---- C:\avenger.txt 2009-07-12 13:41:02 ----D---- C:\rsit 2009-07-12 11:52:16 ----D---- C:\Program Files\Trend Micro 2009-07-12 10:37:17 ----D---- C:\Documents and Settings\Slimak\Dane aplikacji\Malwarebytes 2009-07-12 10:37:10 ----D---- C:\Program Files\Malwarebytes' Anti-Malware 2009-07-12 10:37:10 ----D---- C:\Documents and Settings\All Users\Dane aplikacji\Malwarebytes 2009-07-12 10:21:17 ----D---- C:\Program Files\Spybot - Search & Destroy 2009-07-12 10:21:17 ----D---- C:\Documents and Settings\All Users\Dane aplikacji\Spybot - Search & Destroy 2009-07-12 10:19:16 ----A---- C:\WINDOWS\system32\lsdelete.exe 2009-07-12 09:24:49 ----HDC---- C:\Documents and Settings\All Users\Dane aplikacji\{EF63305C-BAD7-4144-9208-D65528260864} 2009-07-12 09:24:39 ----D---- C:\Program Files\Lavasoft 2009-07-12 09:24:39 ----D---- C:\Documents and Settings\All Users\Dane aplikacji\Lavasoft 2009-07-07 15:48:42 ----D---- C:\WINDOWS\system32\appmgmt 2009-07-07 15:06:32 ----A---- C:\WINDOWS\ntbtlog.txt 2009-07-06 16:44:00 ----D---- C:\WINDOWS\ERDNT 2009-07-06 16:44:00 ----D---- C:\Qoobox 2009-07-06 16:43:59 ----D---- C:\ComboFix 2009-07-06 16:43:58 ----A---- C:\WINDOWS\system32\CF5567.exe 2009-07-06 10:46:28 ----D---- C:\Documents and Settings\Slimak\Dane aplikacji\WordToPDF 2009-07-06 10:46:25 ----D---- C:\Program Files\WordToPDF 2009-07-06 10:40:36 ----D---- C:\Documents and Settings\Slimak\Dane aplikacji\pdf995 2009-07-06 10:40:36 ----A---- C:\WINDOWS\pdf995.ini 2009-07-06 10:36:50 ----D---- C:\Documents and Settings\All Users\Dane aplikacji\pdf995 2009-07-06 10:36:49 ----A---- C:\WINDOWS\system32\pdfmona.dll 2009-07-06 10:36:49 ----A---- C:\WINDOWS\system32\pdf995mon.dll 2009-07-06 10:36:48 ----D---- C:\Program Files\pdf995 2009-07-06 10:27:59 ----A---- C:\WINDOWS\system32\pdfmonnt.dll 2009-06-27 13:06:00 ----D---- C:\Program Files\Executive Software 2009-06-23 22:44:03 ----A---- C:\WINDOWS\uninst.exe ======List of files/folders modified in the last 1 months====== 2009-07-12 14:49:20 ----D---- C:\Program Files\Mozilla Firefox 2009-07-12 14:46:12 ----D---- C:\Program Files\Steam 2009-07-12 14:45:38 ----D---- C:\WINDOWS\system32 2009-07-12 14:45:34 ----D---- C:\WINDOWS\Temp 2009-07-12 14:41:38 ----D---- C:\WINDOWS\system32\drivers 2009-07-12 14:40:53 ----D---- C:\WINDOWS\system32\CatRoot2 2009-07-12 14:39:04 ----D---- C:\Program Files\PowerArchiver 2009-07-12 11:52:16 ----RD---- C:\Program Files 2009-07-12 11:42:02 ----D---- C:\WINDOWS 2009-07-12 11:39:45 ----SHD---- C:\RECYCLER 2009-07-12 09:26:52 ----HD---- C:\WINDOWS\inf 2009-07-12 09:26:46 ----SD---- C:\WINDOWS\Tasks 2009-07-12 09:26:44 ----DC---- C:\WINDOWS\system32\DRVSTORE 2009-07-12 09:24:49 ----SHD---- C:\WINDOWS\Installer 2009-07-12 09:24:49 ----HD---- C:\Config.Msi 2009-07-12 09:24:33 ----D---- C:\WINDOWS\WinSxS 2009-07-11 11:25:24 ----A---- C:\WINDOWS\bestplayer.ini 2009-07-11 09:20:17 ----D---- C:\Documents and Settings\Slimak\Dane aplikacji\uTorrent 2009-07-09 22:11:23 ----A---- C:\WINDOWS\matlab.ini 2009-07-08 11:00:58 ----SD---- C:\Documents and Settings\Slimak\Dane aplikacji\Microsoft 2009-07-07 21:42:07 ----SHD---- C:\WINDOWS\CSC 2009-07-07 15:48:38 ----D---- C:\Program Files\Common Files\Microsoft Shared 2009-07-07 15:48:36 ----D---- C:\WINDOWS\ShellNew 2009-07-07 15:42:38 ----A---- C:\WINDOWS\ODBC.INI 2009-07-07 15:40:50 ----D---- C:\WINDOWS\system 2009-07-07 15:04:38 ----A---- C:\WINDOWS\bdagent.INI 2009-07-07 15:02:13 ----RSHDC---- C:\WINDOWS\system32\dllcache 2009-07-07 11:07:33 ----D---- C:\Program Files\DAP 2009-07-07 11:07:17 ----D---- C:\Documents and Settings\All Users\Dane aplikacji\SpeedBit 2009-07-07 11:06:48 ----AD---- C:\Documents and Settings\All Users\Dane aplikacji\TEMP 2009-07-02 07:37:13 ----A---- C:\WINDOWS\NeroDigital.ini 2009-06-27 13:06:39 ----D---- C:\WINDOWS\Help 2009-06-27 13:06:18 ----D---- C:\Program Files\Common Files\InstallShield 2009-06-27 10:21:25 ----D---- C:\Documents and Settings\Slimak\Dane aplikacji\Real 2009-06-16 17:46:30 ----D---- C:\Klim_mpliki ======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)====== R1 bdftdif;bdftdif; \??\C:\Program Files\Common Files\BitDefender\BitDefender Firewall\bdftdif.sys [] R1 intelppm;Sterownik procesora Intel; C:\WINDOWS\system32\DRIVERS\intelppm.sys [2004-08-04 40320] R2 BDVEDISK;BDVEDISK; \??\C:\Program Files\BitDefender\BitDefender 2009\BDVEDISK.sys [] R3 Arp1394;Protokół klienta 1394 ARP; C:\WINDOWS\system32\DRIVERS\arp1394.sys [2004-08-04 60800] R3 bdfm;BDFM; C:\WINDOWS\system32\drivers\bdfm.sys [2009-03-27 111112] R3 Bdfndisf;BitDefender Firewall NDIS Filter Service; C:\WINDOWS\system32\DRIVERS\bdfndisf.sys [2009-04-01 104328] R3 bdfsfltr;bdfsfltr; C:\WINDOWS\system32\drivers\bdfsfltr.sys [2009-03-27 242184] R3 BDSelfPr;BDSelfPr; \??\C:\Program Files\BitDefender\BitDefender 2009\bdselfpr.sys [] R3 HDAudBus;Microsoft UAA Bus Driver for High Definition Audio; C:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2005-01-07 138752] R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\WINDOWS\system32\drivers\RtkHDAud.sys [2006-11-15 4225920] R3 MTsensor;ATK0110 ACPI UTILITY; C:\WINDOWS\system32\DRIVERS\ASACPI.sys [2004-08-13 5810] R3 NIC1394;Sterownik sieci 1394; C:\WINDOWS\system32\DRIVERS\nic1394.sys [2004-08-04 61824] R3 nv;nv; C:\WINDOWS\system32\DRIVERS\nv4_mini.sys [2009-02-18 6308224] R3 NVENETFD;NVIDIA nForce Networking Controller Driver; C:\WINDOWS\system32\DRIVERS\NVENETFD.sys [2006-02-17 34176] R3 nvnetbus;NVIDIA Network Bus Enumerator; C:\WINDOWS\system32\DRIVERS\nvnetbus.sys [2006-02-17 13056] R3 usbehci;Sterownik Miniport rozszerzonego kontrolera hosta USB 2.0 Microsoft; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2004-08-03 26624] R3 usbhub;Koncentrator z obsługą USB2; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2004-08-03 57600] R3 usbohci;Sterownik Miniport otwartego kontrolera hosta USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbohci.sys [2004-08-03 17024] S3 AVPsys;AVPsys; \??\C:\WINDOWS\system32\drivers\cdaudio.sys [] S3 HPZid412;IEEE-1284.4 Driver HPZid412; C:\WINDOWS\system32\DRIVERS\HPZid412.sys [2006-04-12 49664] S3 HPZipr12;Print Class Driver for IEEE-1284.4 HPZipr12; C:\WINDOWS\system32\DRIVERS\HPZipr12.sys [2006-04-12 16496] S3 HPZius12;USB to IEEE-1284.4 Translation Driver HPZius12; C:\WINDOWS\system32\DRIVERS\HPZius12.sys [2006-04-12 21568] S3 Profos;Profos; \??\C:\Program Files\Common Files\BitDefender\BitDefender Threat Scanner\profos.sys [] S3 s616bus;Sony Ericsson Device 616 driver (WDM); C:\WINDOWS\system32\DRIVERS\s616bus.sys [2007-04-03 83208] S3 s616mdfl;Sony Ericsson Device 616 USB WMC Modem Filter; C:\WINDOWS\system32\DRIVERS\s616mdfl.sys [2007-04-03 15112] S3 s616mdm;Sony Ericsson Device 616 USB WMC Modem Driver; C:\WINDOWS\system32\DRIVERS\s616mdm.sys [2007-04-03 108680] S3 s616mgmt;Sony Ericsson Device 616 USB WMC Device Management Drivers (WDM); C:\WINDOWS\system32\DRIVERS\s616mgmt.sys [2007-04-03 100360] S3 s616nd5;Sony Ericsson Device 616 USB Ethernet Emulation SEMC616 (NDIS); C:\WINDOWS\system32\DRIVERS\s616nd5.sys [2007-04-03 23176] S3 s616obex;Sony Ericsson Device 616 USB WMC OBEX Interface; C:\WINDOWS\system32\DRIVERS\s616obex.sys [2007-04-03 98568] S3 s616unic;Sony Ericsson Device 616 USB Ethernet Emulation SEMC616 (WDM); C:\WINDOWS\system32\DRIVERS\s616unic.sys [2007-04-03 99080] S3 Trufos;Trufos; \??\C:\Program Files\Common Files\BitDefender\BitDefender Threat Scanner\trufos.sys [] S3 usbccgp;Rodzajowy sterownik nadrzędny USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2004-08-03 31616] S3 usbprint;Klasa PRINTER USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2004-08-03 25856] S3 usbscan;Sterownik skanera USB; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-03 15104] S3 USBSTOR;Sterownik magazynu masowego USB; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-03 26496] S3 WpdUsb;WpdUsb; C:\WINDOWS\System32\Drivers\wpdusb.sys [2005-01-28 18944] S4 IntelIde;IntelIde; C:\WINDOWS\system32\drivers\IntelIde.sys [] ======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)====== R2 Diskeeper;Diskeeper; C:\Program Files\Executive Software\DiskeeperLite\DKService.exe [2002-10-16 176128] R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service; C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe [2009-07-03 1029456] R2 NVSvc;NVIDIA Display Driver Service; C:\WINDOWS\system32\nvsvc32.exe [2009-02-18 163908] R2 StarWindService;StarWind iSCSI Service; C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe [2005-04-02 217600] R2 UMWdf;Windows User Mode Driver Framework; C:\WINDOWS\system32\wdfmgr.exe [2005-01-28 38912] R2 VSSERV;BitDefender Virus Shield; C:\Program Files\BitDefender\BitDefender 2009\vsserv.exe [2009-04-01 1626112] S2 LIVESRV;BitDefender Desktop Update Service; C:\Program Files\Common Files\BitDefender\BitDefender Update Service\livesrv.exe /service [] S2 matlabserver;MATLAB Server; C:\Program Files\MATLAB71\webserver\bin\win32\matlabserver.exe [2005-07-27 536576] S2 Pml Driver HPZ12;Pml Driver HPZ12; C:\WINDOWS\system32\HPZipm12.exe [2006-03-03 69632] S3 Arrakis3;BitDefender Arrakis Server; C:\Program Files\Common Files\BitDefender\BitDefender Arrakis Server\bin\Arrakis3.exe [2008-07-17 118784] S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2007-10-24 33800] S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2007-10-24 70144] S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; C:\WINDOWS\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe [2007-10-09 36864] S3 idsvc;Windows CardSpace; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2007-10-11 864256] S3 scan;BitDefender Threat Scanner; C:\WINDOWS\System32\svchost.exe [2004-08-04 14336] S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2007-10-11 122880] -----------------EOF-----------------

**Posty:** 8001 · przez **Okocza** 12 Lip 2009, 15:17

wykonaj optymalizację windowsa

Czysto, wykonaj:

Wykonaj to co jest podane w tym temacie

1. tym programem przejdź komputer)
2. wykonaj optymalizację windowsa
3.sciagnij ATF_Cleaner
zaznacz
Windows Temp
All users Temp
Temporary internet files
Recycle Bin
i wcisnij EMPTY SELECTED
4.Wyłącz przywracanie systemu ( właściwości mój komputer-zakładka przywracanie - wyłącz przywracanie na wszystkich dyskach). Po chwili włącz je powrotem
5. Przeskanuj komputer pod względem Trojanów tym programem
6. Wstaw na forum screen z zakładki uruchamianie (start – uruchom – msconfig – uruchamianie) może uda się cos wyrzucic stamtąd.
7. Przeskanuj obszar mojego komputera http://www.kaspersky.pl/virusscanner.html (uruchom przez IE) Daj raport z niego na forum.

**Posty:** 90 · przez **Slime** 18 Lip 2009, 08:11

Minęło trochę ale niestety nie mam czasu na zabawę z kompem w tyg.
raport z Kasperskyego:

RAPORT KASPERSKY ONLINE SCANNER 7.0
sobota, 18 lipiec 2009
System operacyjny: Microsoft Windows XP Professional Dodatek Service Pack 2 (build 2600)
Wersja Kaspersky Online Scanner: 7.0.26.12
Data ostatniej aktualizacji bazy danych: Friday, July 17, 2009 22:28:15
Liczba wpisów: 2483545
Ustawienia skanowania
Typ bazy danych użytej do skanowania rozszerzona
Skanuj archiwa tak
Skanuj pocztowe bazy danych tak
Obszar skanowania Mój komputer
A:\
C:\
D:\
E:\
F:\
Statystyki skanowania
Przeskanowanych plików 136413
Nazwa zagrożenia 2
Zainfekowanych obiektów 20
Podejrzanych obiektów 0
Czas skanowania 06:41:10

Nazwa pliku Nazwa zagrożenia Liczba zagrożeń
C:\DOCUME~1\Slimak\USTAWI~1\Temp\nmdfgds0.dll/C:\DOCUME~1\Slimak\USTAWI~1\Temp\nmdfgds0.dll Zainfekowany: Trojan-GameThief.Win32.Magania.bmwm 16
C:\Documents and Settings\Slimak\Ustawienia lokalne\Temp\nmdfgds0.dll Zainfekowany: Trojan-GameThief.Win32.Magania.bmwm 1
C:\Documents and Settings\Slimak\Ustawienia lokalne\Temp\olhrwef.exe Zainfekowany: Trojan-GameThief.Win32.Magania.bmwn 1
C:\p.exe Zainfekowany: Trojan-GameThief.Win32.Magania.bmwn 1
D:\p.exe Zainfekowany: Trojan-GameThief.Win32.Magania.bmwn 1
Wybrany obszar został przeskanowany.

Dziad zablokował mi możliwość podglądu ukrytych plików więc (przynajmniej na razie) nie mogę wiele zdziałać

**Posty:** 8001 · przez **Okocza** 18 Lip 2009, 09:47

Kod: Zaznacz wszystko: Files:: C:\DOCUME~1\Slimak\USTAWI~1\Temp\nmdfgds0.dll/C:\DOCUME~1\Slimak\USTAWI~1\Temp\nmdfgds0.dll C:\Documents and Settings\Slimak\Ustawienia lokalne\Temp\nmdfgds0.dll C:\Documents and Settings\Slimak\Ustawienia lokalne\Temp\olhrwef.exe C:\p.exe D:\p.exe

zapisz jako CFScript.txt i przeciągnij na ikonkę combofixa - daj log który się wygeneruje po tym

**Posty:** 90 · przez **Slime** 18 Lip 2009, 10:50

Miałem mały spadek napięcia i komp mi wysiadł:((. Jedyny log jaki mam to po ponownym odpaleniu kompa:

Kod: Zaznacz wszystko: ComboFix 09-07-14.08 - Slimak 2009-07-18 10:38.2.2 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.48.1045.18.2046.1491 [GMT 2:00] Uruchomiony z: c:\documents and settings\Slimak\Pulpit\ComboFix.exe AV: BitDefender Antivirus *On-access scanning enabled* (Outdated) {6C4BB89C-B0ED-4F41-A29C-4373888923BB} FW: BitDefender Firewall *enabled* {4055920F-2E99-48A8-A270-4243D2B8F242} * Rezydentny antywirus jest aktywny . ((((((((((((((((((((((((((((((((((((((( Usunięto ))))))))))))))))))))))))))))))))))))))))))))))))) . . ---- Poprzednie uruchomienie ------- . C:\autorun.inf D:\Autorun.inf . ((((((((((((((((((((((((((((((((((((((( Sterowniki/Usługi ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Legacy_AVPSYS -------\Service_AVPsys ((((((((((((((((((((((((( Pliki utworzone od 2009-06-18 do 2009-07-18 ))))))))))))))))))))))))))))))) . 2009-07-18 05:53 . 2009-07-18 08:23 23328 --sha-w- c:\windows\system32\drivers\fidbox2.dat 2009-07-18 05:53 . 2009-07-18 08:23 315424 --sha-w- c:\windows\system32\drivers\fidbox.dat 2009-07-18 05:39 . 2009-07-18 06:18 -------- d-----w- c:\program files\Common Files\ParetoLogic 2009-07-18 05:39 . 2009-07-18 06:18 -------- d-----w- c:\documents and settings\All Users\Dane aplikacji\ParetoLogic 2009-07-18 05:39 . 2009-07-18 05:39 -------- d-----w- c:\documents and settings\All Users\Dane aplikacji\ParetoLogic Anti-Virus PLUS 2009-07-18 05:38 . 2009-07-18 05:38 -------- d-----w- c:\documents and settings\Slimak\Ustawienia lokalne\Dane aplikacji\Downloaded Installations 2009-07-17 20:57 . 2009-07-17 20:57 -------- d-----w- c:\windows\Sun 2009-07-17 20:56 . 2009-07-17 20:56 410984 ----a-w- c:\windows\system32\deploytk.dll 2009-07-17 20:56 . 2009-07-17 20:56 -------- d-----w- c:\program files\Java 2009-07-17 20:56 . 2009-07-17 20:56 152576 ----a-w- c:\documents and settings\Slimak\Dane aplikacji\Sun\Java\jre1.6.0_14\lzma.dll 2009-07-17 20:51 . 2009-07-17 20:51 -------- d-----w- c:\documents and settings\All Users\Dane aplikacji\Kaspersky Lab 2009-07-17 20:51 . 2009-07-17 20:51 -------- d-----w- c:\windows\system32\Kaspersky Lab 2009-07-12 11:41 . 2009-07-12 11:41 -------- d-----w- C:\rsit 2009-07-12 09:52 . 2009-07-12 09:52 -------- d-----w- c:\program files\Trend Micro 2009-07-12 08:37 . 2009-07-12 08:37 -------- d-----w- c:\documents and settings\Slimak\Dane aplikacji\Malwarebytes 2009-07-12 08:37 . 2009-06-17 09:27 38160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys 2009-07-12 08:37 . 2009-07-12 08:37 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware 2009-07-12 08:37 . 2009-07-12 08:37 -------- d-----w- c:\documents and settings\All Users\Dane aplikacji\Malwarebytes 2009-07-12 08:37 . 2009-06-17 09:27 19096 ----a-w- c:\windows\system32\drivers\mbam.sys 2009-07-12 08:21 . 2009-07-12 09:45 -------- d-----w- c:\documents and settings\All Users\Dane aplikacji\Spybot - Search & Destroy 2009-07-12 08:21 . 2009-07-12 08:22 -------- d-----w- c:\program files\Spybot - Search & Destroy 2009-07-12 08:19 . 2009-07-03 14:49 15688 ----a-w- c:\windows\system32\lsdelete.exe 2009-07-12 07:28 . 2009-07-12 07:28 -------- d-----w- c:\documents and settings\LocalService\Pulpit 2009-07-12 07:26 . 2009-07-03 14:49 64160 ----a-w- c:\windows\system32\drivers\Lbd.sys 2009-07-12 07:24 . 2009-07-12 07:24 -------- dc-h--w- c:\documents and settings\All Users\Dane aplikacji\{EF63305C-BAD7-4144-9208-D65528260864} 2009-07-12 07:24 . 2009-07-08 17:28 2920112 -c--a-w- c:\documents and settings\All Users\Dane aplikacji\{EF63305C-BAD7-4144-9208-D65528260864}\Ad-AwareAE.exe 2009-07-12 07:24 . 2009-07-12 07:26 -------- d-----w- c:\documents and settings\All Users\Dane aplikacji\Lavasoft 2009-07-12 07:24 . 2009-07-12 07:24 -------- d-----w- c:\program files\Lavasoft 2009-07-06 08:46 . 2009-07-06 08:46 -------- d-----w- c:\documents and settings\Slimak\Dane aplikacji\WordToPDF 2009-07-06 08:40 . 2009-07-06 08:40 -------- d-----w- c:\documents and settings\Slimak\Dane aplikacji\pdf995 2009-07-06 08:36 . 2009-07-06 08:56 -------- d-----w- c:\documents and settings\All Users\Dane aplikacji\pdf995 2009-07-06 08:36 . 2009-07-06 08:40 59 ----a-w- c:\windows\wpd99.drv 2009-07-06 08:36 . 2009-07-06 08:38 51716 ----a-w- c:\windows\system32\pdf995mon.dll 2009-07-06 08:36 . 2009-07-06 08:38 249856 ----a-w- c:\windows\system32\pdfmona.dll 2009-07-06 08:27 . 2001-10-28 23:42 116224 ----a-w- c:\windows\system32\pdfmonnt.dll 2009-06-27 11:06 . 2009-06-27 11:06 -------- d-----w- c:\program files\Executive Software 2009-06-23 20:44 . 2009-06-23 20:44 -------- d-----w- c:\documents and settings\Slimak\Bullfrog 2009-06-23 20:44 . 1996-01-09 10:38 283648 ----a-w- c:\windows\uninst.exe 2009-06-23 20:44 . 2009-06-23 20:44 -------- d-----w- c:\documents and settings\Slimak\WINDOWS . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-07-18 08:28 . 2009-04-03 04:40 -------- d-----w- c:\program files\Steam 2009-07-18 08:23 . 2009-07-18 05:53 3236 --sha-w- c:\windows\system32\drivers\fidbox2.idx 2009-07-18 08:23 . 2009-07-18 05:53 6344 --sha-w- c:\windows\system32\drivers\fidbox.idx 2009-07-18 08:06 . 2009-03-26 18:38 -------- d-----w- c:\program files\Tlen.pl 2009-07-18 06:17 . 2009-03-26 18:48 -------- d-----w- c:\program files\PowerArchiver 2009-07-18 05:39 . 2009-03-26 18:29 16368 ----a-w- c:\documents and settings\Slimak\Ustawienia lokalne\Dane aplikacji\GDIPFONTCACHEV1.DAT 2009-07-17 20:45 . 2009-03-26 18:26 -------- d--h--w- c:\program files\InstallShield Installation Information 2009-07-17 14:56 . 2009-04-03 04:38 -------- d-----w- c:\documents and settings\Slimak\Dane aplikacji\uTorrent 2009-07-07 09:07 . 2009-03-27 16:08 -------- d-----w- c:\program files\DAP 2009-07-07 09:07 . 2009-03-27 16:08 -------- d-----w- c:\documents and settings\All Users\Dane aplikacji\SpeedBit 2009-07-07 09:06 . 2009-03-27 16:08 -------- d---a-w- c:\documents and settings\All Users\Dane aplikacji\TEMP 2009-07-06 05:48 . 2009-03-28 21:06 81984 ----a-w- c:\windows\system32\bdod.bin 2009-06-27 11:06 . 2009-03-26 18:19 -------- d-----w- c:\program files\Common Files\InstallShield 2009-04-21 19:13 . 2009-04-21 19:04 120529 ----a-w- c:\windows\hpoins11.dat 2009-06-13 15:37 . 2009-05-06 09:36 134648 ----a-w- c:\program files\mozilla firefox\components\brwsrcmp.dll 2009-04-01 15:17 . 2008-08-13 18:02 49664 ----a-w- c:\program files\mozilla firefox\components\FFComm.dll . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks] "{F4F10C1D-87C7-404A-B4B3-000000000000}"= "c:\progra~1\DAP\SBSearch.dll" [BU] [HKEY_CLASSES_ROOT\clsid\{f4f10c1d-87c7-404a-b4b3-000000000000}] [HKEY_CLASSES_ROOT\SearchHook.SrchHook.1] [HKEY_CLASSES_ROOT\TypeLib\{95EFB171-F3DF-4BEC-9EF7-829A800203E6}] [HKEY_CLASSES_ROOT\SearchHook.SrchHook] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2004-08-03 15360] "Steam"="c:\program files\steam\steam.exe" [2009-06-11 1217784] "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2006-06-01 94208] "SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-02-18 13680640] "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2009-02-18 86016] "WinampAgent"="c:\program files\Winamp\winampa.exe" [BU] "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696] "BDAgent"="c:\program files\BitDefender\BitDefender 2009\bdagent.exe" [2009-04-28 778240] "BitDefender Antiphishing Helper"="c:\program files\BitDefender\BitDefender 2009\IEShow.exe" [2009-04-01 69632] "Sony Ericsson PC Suite"="c:\program files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" [2007-02-20 741376] "HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2006-02-19 49152] "NeroFilterCheck"="c:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-12 155648] "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-07-17 148888] "RTHDCPL"="RTHDCPL.EXE" - c:\windows\RTHDCPL.exe [2006-11-14 16270848] "SkyTel"="SkyTel.EXE" - c:\windows\SkyTel.exe [2006-05-16 2879488] "nwiz"="nwiz.exe" - c:\windows\system32\nwiz.exe [2009-02-18 1657376] "NWEReboot"="" [BU] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-03 15360] c:\documents and settings\All Users\Menu Start\Programy\Autostart\ HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2006-2-19 288472] Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service] @="Service" [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\Tlen.pl\\tlen.exe"= "c:\\Program Files\\Gadu-Gadu\\gg.exe"= "d:\\World of Warcraft\\BackgroundDownloader.exe"= "d:\\World of Warcraft\\BNUpdate.exe"= "d:\\World of Warcraft\\Launcher.exe"= "d:\\World of Warcraft\\Wow.exe"= "c:\\Program Files\\uTorrent\\uTorrent.exe"= "c:\\Program Files\\Steam\\Steam.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"= "c:\\Program Files\\Ventrilo\\Ventrilo.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "3724:TCP"= 3724:TCP:Blizzard Downloader: 3724 R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [2009-07-12 64160] R2 BDVEDISK;BDVEDISK;c:\program files\BitDefender\BitDefender 2009\BDVEDISK.sys [2008-07-02 82696] R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [2009-07-03 1029456] R3 bdfm;BDFM;c:\windows\system32\drivers\bdfm.sys [2008-08-12 111112] R3 Bdfndisf;BitDefender Firewall NDIS Filter Service;c:\windows\system32\drivers\bdfndisf.sys [2008-08-14 104328] S3 Arrakis3;BitDefender Arrakis Server;c:\program files\Common Files\BitDefender\BitDefender Arrakis Server\bin\Arrakis3.exe [2008-07-17 118784] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] bdx REG_MULTI_SZ scan . Zawartość folderu 'Zaplanowane zadania' 2009-07-12 c:\windows\Tasks\Ad-Aware Update (Weekly).job - c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-07-03 14:49] . . ------- Skan uzupełniający ------- . uStart Page = hxxp://192.168.10.1/index.asp IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000 FF - ProfilePath - c:\documents and settings\Slimak\Dane aplikacji\Mozilla\Firefox\Profiles\r8ufyark.default\ FF - prefs.js: browser.startup.homepage - hxxp://www.wp.pl/ FF - prefs.js: keyword.URL - hxxp://search.speedbit.com/searchresults.asp?src=default&q= FF - component: c:\program files\Mozilla Firefox\components\FFComm.dll FF - plugin: c:\documents and settings\Slimak\Dane aplikacji\Mozilla\Firefox\Profiles\r8ufyark.default\extensions\{eaf8a4ef-d221-45ca-9deb-d0934b45fa34}\plugins\npOggX.dll FF - plugin: c:\program files\Mozilla Firefox\plugins\npOggX.dll . ************************************************************************** catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-07-18 10:43 Windows 5.1.2600 Dodatek Service Pack 2 NTFS skanowanie ukrytych procesów ... skanowanie ukrytych wpisów autostartu ... skanowanie ukrytych plików ... skanowanie pomyślnie ukończone ukryte pliki: 0 ************************************************************************** . --------------------- Pliki DLL ładowane pod uruchomionymi procesami --------------------- - - - - - - - > 'explorer.exe'(3848) c:\windows\system32\msi.dll . Czas ukończenia: 2009-07-18 10:46 ComboFix-quarantined-files.txt 2009-07-18 08:46 Przed: 19 900 891 136 bajtów wolnych Po: 19 896 217 600 bajtów wolnych 189

**Posty:** 8001 · przez **Okocza** 18 Lip 2009, 11:10

Slime, wykonaj jeszcze raz ten skrypt... potem usuń folder c:\qoobox i wykonaj skan kasperskym on-line

**Posty:** 90 · przez **Slime** 18 Lip 2009, 16:17

Odpaliłem combofixa i po zakończeniu jego działania coś spowodowało zablokowanie aktualizacji ip i odcięło mi neta. Nie będę się rozpisywać tylko w skrócie. Musiałem na nowo instalować wina:((. Jestem w trakcie skanowania kompa kasperskym i chciałem w tym czasie zapytać się o jakieś oprogramowanie bedące w stanie uchronić mnie przed tego typu syfem. Do tej pory miałem Bitdefendera i jak widać niezbyt się sprawdził

Logi z kaspersky:

Kod: Zaznacz wszystko: RAPORT KASPERSKY ONLINE SCANNER 7.0 sobota, 18 lipiec 2009 System operacyjny: Microsoft Windows XP Professional Dodatek Service Pack 2 (build 2600) Wersja Kaspersky Online Scanner: 7.0.26.12 Data ostatniej aktualizacji bazy danych: Saturday, July 18, 2009 17:43:29 Liczba wpisów: 2489325 Ustawienia skanowania Typ bazy danych użytej do skanowania rozszerzona Skanuj archiwa tak Skanuj pocztowe bazy danych tak Obszar skanowania Mój komputer A:\ C:\ D:\ E:\ Statystyki skanowania Przeskanowanych plików 130258 Nazwa zagrożenia 0 Zainfekowanych obiektów 0 Podejrzanych obiektów 0 Czas skanowania 04:20:51 Nie wykryto zagrożeń. Obszar skanowania jest czysty. Wybrany obszar został przeskanowany.

i dla pewności

Kod: Zaznacz wszystko: Logfile of random's system information tool 1.06 (written by random/random) Run by Slime at 2009-07-18 22:34:49 Microsoft Windows XP Professional Dodatek Service Pack 2 System drive C: has 23 GB (30%) free of 76 GB Total RAM: 2046 MB (69% free) ======Registry dump====== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}] Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2009-07-18 41368] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}] JQSIEStartDetectorImpl Class - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2009-07-18 73728] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run] "NvCplDaemon"=C:\WINDOWS\system32\NvCpl.dll [2008-12-26 13680640] "nwiz"=nwiz.exe /install [] "NvMediaCenter"=C:\WINDOWS\system32\NvMcTray.dll [2008-12-26 86016] "RTHDCPL"=C:\WINDOWS\RTHDCPL.EXE [2006-11-14 16270848] "SkyTel"=C:\WINDOWS\SkyTel.EXE [2006-05-16 2879488] "Alcmtr"=C:\WINDOWS\ALCMTR.EXE [2005-05-03 69632] "JMB36X IDE Setup"=C:\WINDOWS\JM\JMInsIDE.exe [2006-10-30 36864] "JMB36X Configure"=C:\WINDOWS\system32\JMRaidSetup.exe [2006-10-30 1953792] "MSConfig"=C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe [2004-08-04 159744] "SunJavaUpdateSched"=C:\Program Files\Java\jre6\bin\jusched.exe [2009-07-18 148888] "WinampAgent"=C:\Program Files\Winamp\winampa.exe [] "NWEReboot"= [] "NeroFilterCheck"=C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe [2006-01-12 155648] [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"=C:\WINDOWS\system32\ctfmon.exe [2004-08-04 15360] "Komunikator"=C:\Program Files\Tlen.pl\tlen.exe [2007-10-05 6226432] [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce] "MPlayer2_FixUp"=C:\WINDOWS\inf\unregmp2.exe [2004-08-04 208896] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nTrayFw] C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nTrayFw.exe [2006-02-17 270336] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{1a3e09be-1e45-494b-9174-d7385b45bbf5}] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System] "dontdisplaylastusername"=0 "legalnoticecaption"= "legalnoticetext"= "shutdownwithoutlogon"=1 "undockwithoutlogon"=1 [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer] "NoDriveTypeAutoRun"=145 [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] "%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\Apache.exe"="C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\Apache.exe:*:Disabled:Apache HTTP Server" "C:\Program Files\Tlen.pl\tlen.exe"="C:\Program Files\Tlen.pl\tlen.exe:*:Enabled:Komunikator Tlen.pl" "C:\Program Files\Steam\steamapps\ricardo225\counter-strike source\hl2.exe"="C:\Program Files\Steam\steamapps\ricardo225\counter-strike source\hl2.exe:*:Enabled:hl2" "C:\KKNDXtreme\KKND.exe"="C:\KKNDXtreme\KKND.exe:*:Enabled:KKND" [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list] "%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{1122e572-739f-11de-bab3-001bfcdb3e77}] shell\AutoRun\command - F:\autorun.exe ======List of files/folders created in the last 1 months====== 2009-07-18 22:03:55 ----D---- C:\Program Files\Strip Poker Exclusive 4 2009-07-18 21:20:20 ----A---- C:\WINDOWS\IsUninst.exe 2009-07-18 20:36:52 ----A---- C:\WINDOWS\NeroDigital.ini 2009-07-18 20:36:33 ----D---- C:\Documents and Settings\Slime\Dane aplikacji\Media Player Classic 2009-07-18 18:09:48 ----SHD---- C:\System Volume Information 2009-07-18 17:13:44 ----A---- C:\WINDOWS\bestplayer.ini 2009-07-18 16:06:04 ----D---- C:\WINDOWS\LastGood 2009-07-18 15:59:59 ----D---- C:\Documents and Settings\All Users.WINDOWS\Dane aplikacji\ConeXware 2009-07-18 15:59:43 ----A---- C:\WINDOWS\system32\h323log.txt 2009-07-18 15:56:40 ----A---- C:\WINDOWS\system32\usbui.dll 2009-07-18 15:56:20 ----A---- C:\WINDOWS\system32\unrar.dll 2009-07-18 15:56:13 ----A---- C:\WINDOWS\system32\yv12vfw.dll 2009-07-18 15:56:12 ----A---- C:\WINDOWS\system32\xvidvfw.dll 2009-07-18 15:56:12 ----A---- C:\WINDOWS\system32\xvidcore.dll 2009-07-18 15:56:10 ----A---- C:\WINDOWS\system32\qt-dx331.dll 2009-07-18 15:56:10 ----A---- C:\WINDOWS\system32\dpl100.dll 2009-07-18 15:56:09 ----A---- C:\WINDOWS\system32\divx.dll 2009-07-18 15:56:04 ----A---- C:\WINDOWS\system32\ff_vfw.dll.manifest 2009-07-18 15:56:03 ----A---- C:\WINDOWS\system32\ff_vfw.dll 2009-07-18 15:55:55 ----A---- C:\WINDOWS\system32\pthreadGC2.dll 2009-07-18 15:55:55 ----A---- C:\WINDOWS\system32\msvcr71.dll 2009-07-18 15:53:33 ----D---- C:\Documents and Settings\Slime\Dane aplikacji\Gadu-Gadu 2009-07-18 15:52:43 ----A---- C:\WINDOWS\imsins.BAK 2009-07-18 15:52:39 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI 2009-07-18 15:52:38 ----A---- C:\WINDOWS\ODBCINST.INI 2009-07-18 15:52:32 ----RA---- C:\WINDOWS\system32\kbdtuq.dll 2009-07-18 15:52:32 ----RA---- C:\WINDOWS\system32\kbdtuf.dll 2009-07-18 15:52:32 ----RA---- C:\WINDOWS\system32\kbdazel.dll 2009-07-18 15:52:30 ----RA---- C:\WINDOWS\system32\kbdycc.dll 2009-07-18 15:52:30 ----RA---- C:\WINDOWS\system32\kbduzb.dll 2009-07-18 15:52:30 ----RA---- C:\WINDOWS\system32\kbdur.dll 2009-07-18 15:52:30 ----RA---- C:\WINDOWS\system32\kbdtat.dll 2009-07-18 15:52:30 ----RA---- C:\WINDOWS\system32\kbdru1.dll 2009-07-18 15:52:30 ----RA---- C:\WINDOWS\system32\kbdru.dll 2009-07-18 15:52:30 ----RA---- C:\WINDOWS\system32\kbdmon.dll 2009-07-18 15:52:30 ----RA---- C:\WINDOWS\system32\kbdkyr.dll 2009-07-18 15:52:30 ----RA---- C:\WINDOWS\system32\kbdkaz.dll 2009-07-18 15:52:30 ----RA---- C:\WINDOWS\system32\kbdbu.dll 2009-07-18 15:52:30 ----RA---- C:\WINDOWS\system32\kbdblr.dll 2009-07-18 15:52:30 ----RA---- C:\WINDOWS\system32\kbdaze.dll 2009-07-18 15:52:26 ----RA---- C:\WINDOWS\system32\kbdhept.dll 2009-07-18 15:52:26 ----RA---- C:\WINDOWS\system32\kbdhela3.dll 2009-07-18 15:52:26 ----RA---- C:\WINDOWS\system32\kbdhela2.dll 2009-07-18 15:52:26 ----RA---- C:\WINDOWS\system32\kbdhe319.dll 2009-07-18 15:52:26 ----RA---- C:\WINDOWS\system32\kbdhe220.dll 2009-07-18 15:52:26 ----RA---- C:\WINDOWS\system32\kbdhe.dll 2009-07-18 15:52:26 ----RA---- C:\WINDOWS\system32\kbdgkl.dll 2009-07-18 15:52:25 ----RA---- C:\WINDOWS\system32\kbdlv1.dll 2009-07-18 15:52:25 ----RA---- C:\WINDOWS\system32\kbdlv.dll 2009-07-18 15:52:25 ----RA---- C:\WINDOWS\system32\kbdlt1.dll 2009-07-18 15:52:25 ----RA---- C:\WINDOWS\system32\kbdlt.dll 2009-07-18 15:52:25 ----RA---- C:\WINDOWS\system32\kbdest.dll 2009-07-18 15:52:21 ----A---- C:\WINDOWS\system32\kbdycl.dll 2009-07-18 15:52:21 ----A---- C:\WINDOWS\system32\kbdsl1.dll 2009-07-18 15:52:21 ----A---- C:\WINDOWS\system32\kbdsl.dll 2009-07-18 15:52:21 ----A---- C:\WINDOWS\system32\kbdro.dll 2009-07-18 15:52:21 ----A---- C:\WINDOWS\system32\kbdhu1.dll 2009-07-18 15:52:21 ----A---- C:\WINDOWS\system32\kbdhu.dll 2009-07-18 15:52:21 ----A---- C:\WINDOWS\system32\kbdcz2.dll 2009-07-18 15:52:21 ----A---- C:\WINDOWS\system32\kbdcz1.dll 2009-07-18 15:52:21 ----A---- C:\WINDOWS\system32\kbdcz.dll 2009-07-18 15:52:21 ----A---- C:\WINDOWS\system32\kbdcr.dll 2009-07-18 15:52:21 ----A---- C:\WINDOWS\system32\KBDAL.DLL 2009-07-18 15:52:19 ----A---- C:\WINDOWS\system32\irclass.dll 2009-07-18 15:52:18 ----A---- C:\WINDOWS\system32\spxcoins.dll 2009-07-18 15:52:18 ----A---- C:\WINDOWS\system32\dgsetup.dll 2009-07-18 15:52:18 ----A---- C:\WINDOWS\system32\dgrpsetu.dll 2009-07-18 15:52:17 ----A---- C:\WINDOWS\system32\EqnClass.Dll 2009-07-18 15:52:13 ----A---- C:\WINDOWS\TASKMAN.EXE 2009-07-18 15:52:12 ----N---- C:\WINDOWS\system32\CONFIG.TMP 2009-07-18 15:52:11 ----A---- C:\WINDOWS\system32\batt.dll 2009-07-18 15:52:10 ----A---- C:\WINDOWS\NOTEPAD.EXE 2009-07-18 15:52:09 ----A---- C:\WINDOWS\system32\storprop.dll 2009-07-18 15:52:00 ----ASH---- C:\Documents and Settings\All Users.WINDOWS\Dane aplikacji\desktop.ini 2009-07-18 15:50:18 ----RA---- C:\WINDOWS\SET8.tmp 2009-07-18 15:50:15 ----RA---- C:\WINDOWS\SET4.tmp 2009-07-18 15:50:14 ----RA---- C:\WINDOWS\SET3.tmp 2009-07-18 15:50:03 ----SD---- C:\Documents and Settings\All Users.WINDOWS\Dane aplikacji\Microsoft 2009-07-18 15:49:48 ----A---- C:\WINDOWS\setuplog.txt 2009-07-18 15:49:00 ----D---- C:\Documents and Settings\Slime\Dane aplikacji\Winamp 2009-07-18 15:42:53 ----A---- C:\WINDOWS\system32\javaws.exe 2009-07-18 15:42:53 ----A---- C:\WINDOWS\system32\javaw.exe 2009-07-18 15:42:53 ----A---- C:\WINDOWS\system32\java.exe 2009-07-18 15:42:10 ----D---- C:\Program Files\Java 2009-07-18 15:40:52 ----D---- C:\Documents and Settings\Slime\Dane aplikacji\Tlen.pl 2009-07-18 15:37:20 ----A---- C:\WINDOWS\system32\deploytk.dll 2009-07-18 15:33:52 ----D---- C:\Documents and Settings\Slime\Dane aplikacji\Sun 2009-07-18 15:30:25 ----D---- C:\Documents and Settings\Slime\Dane aplikacji\Macromedia 2009-07-18 15:30:23 ----D---- C:\Documents and Settings\Slime\Dane aplikacji\Adobe 2009-07-18 15:24:43 ----D---- C:\WINDOWS\pss 2009-07-18 15:23:13 ----D---- C:\JM 2009-07-18 15:23:06 ----R---- C:\WINDOWS\system32\JMRaidAPI.dll 2009-07-18 15:23:04 ----R---- C:\WINDOWS\system32\JMRaidSetup.exe 2009-07-18 15:22:55 ----D---- C:\WINDOWS\JM 2009-07-18 15:21:30 ----R---- C:\WINDOWS\system32\ChCfg.exe 2009-07-18 15:21:07 ----A---- C:\WINDOWS\system32\ksuser.dll 2009-07-18 15:20:34 ----A---- C:\WINDOWS\system32\spupdsvc.exe 2009-07-18 15:19:56 ----R---- C:\WINDOWS\RtlExUpd.dll 2009-07-18 15:15:34 ----D---- C:\Program Files\NVIDIA Corporation 2009-07-18 15:15:16 ----RA---- C:\WINDOWS\system32\raidmgmt.ini 2009-07-18 15:15:15 ----RA---- C:\WINDOWS\system32\AsusSetup.ini 2009-07-18 15:15:15 ----RA---- C:\WINDOWS\system32\AsusSetup.exe 2009-07-18 15:14:15 ----A---- C:\WINDOWS\system32\CapabilityTable.exe 2009-07-18 15:14:06 ----N---- C:\WINDOWS\system32\nvuide.exe 2009-07-18 15:14:05 ----RA---- C:\WINDOWS\system32\NVCOI.DLL 2009-07-18 15:14:05 ----RA---- C:\WINDOWS\system32\idecoiins.dll 2009-07-18 15:14:05 ----RA---- C:\WINDOWS\system32\idecoi.dll 2009-07-18 15:13:57 ----RA---- C:\WINDOWS\system32\fdco1ins.dll 2009-07-18 15:13:57 ----RA---- C:\WINDOWS\system32\fdco_l2052.dll 2009-07-18 15:13:57 ----RA---- C:\WINDOWS\system32\fdco_l1046.dll 2009-07-18 15:13:57 ----RA---- C:\WINDOWS\system32\fdco_l1042.dll 2009-07-18 15:13:57 ----RA---- C:\WINDOWS\system32\fdco_l1041.dll 2009-07-18 15:13:57 ----RA---- C:\WINDOWS\system32\fdco_l1040.dll 2009-07-18 15:13:57 ----RA---- C:\WINDOWS\system32\fdco_l1036.dll 2009-07-18 15:13:57 ----RA---- C:\WINDOWS\system32\fdco_l1034.dll 2009-07-18 15:13:57 ----RA---- C:\WINDOWS\system32\fdco_l1031.dll 2009-07-18 15:13:57 ----RA---- C:\WINDOWS\system32\fdco_l1028.dll 2009-07-18 15:13:56 ----RA---- C:\WINDOWS\system32\fdco1.dll 2009-07-18 15:13:54 ----RA---- C:\WINDOWS\system32\nvunrm.exe 2009-07-18 15:13:54 ----RA---- C:\WINDOWS\system32\nvconrm.dll 2009-07-18 15:13:54 ----RA---- C:\WINDOWS\system32\bdco1ins.dll 2009-07-18 15:13:54 ----RA---- C:\WINDOWS\system32\bdco1.dll 2009-07-18 15:13:54 ----D---- C:\WINDOWS\NV17241944.TMP 2009-07-18 15:13:53 ----RA---- C:\WINDOWS\system32\nvusmb.exe 2009-07-18 15:13:12 ----A---- C:\WINDOWS\Ascd_log.ini 2009-07-18 15:13:02 ----A---- C:\WINDOWS\Ascd_tmp.ini 2009-07-18 15:12:52 ----D---- C:\Documents and Settings\Slime\Dane aplikacji\Mozilla 2009-07-18 14:15:58 ----D---- C:\WINDOWS\system32\AGEIA 2009-07-18 14:15:58 ----D---- C:\Program Files\AGEIA Technologies 2009-07-18 14:14:59 ----A---- C:\WINDOWS\system32\nvudisp.exe 2009-07-18 14:14:39 ----A---- C:\WINDOWS\system32\NVUNINST.EXE 2009-07-18 14:14:10 ----D---- C:\NVIDIA 2009-07-18 14:13:10 ----SHD---- C:\RECYCLER 2009-07-18 14:11:09 ----D---- C:\Documents and Settings\Slime\Dane aplikacji\Identities 2009-07-18 14:10:49 ----ASH---- C:\Documents and Settings\Slime\Dane aplikacji\desktop.ini 2009-07-18 14:10:48 ----SD---- C:\Documents and Settings\Slime\Dane aplikacji\Microsoft 2009-07-18 14:09:53 ----D---- C:\WINDOWS\Prefetch 2009-07-18 14:09:53 ----A---- C:\WINDOWS\SchedLgU.Txt 2009-07-18 14:05:22 ----A---- C:\WINDOWS\control.ini 2009-07-18 14:05:09 ----A---- C:\WINDOWS\OEWABLog.txt 2009-07-18 14:05:02 ----A---- C:\WINDOWS\system32\mapi32.dll 2009-07-18 14:03:56 ----RAH---- C:\WINDOWS\system32\logonui.exe.manifest 2009-07-18 14:03:47 ----RAH---- C:\WINDOWS\system32\cdplayer.exe.manifest 2009-07-18 14:03:02 ----A---- C:\WINDOWS\system32\atrace.dll 2009-07-18 14:03:00 ----A---- C:\WINDOWS\system32\desktop.ini 2009-07-18 14:03:00 ----A---- C:\WINDOWS\desktop.ini 2009-07-18 14:02:55 ----A---- C:\WINDOWS\system32\nmevtmsg.dll 2009-07-18 14:02:55 ----A---- C:\WINDOWS\system32\acctres.dll 2009-07-18 14:02:54 ----A---- C:\WINDOWS\system32\icfgnt5.dll 2009-07-18 14:02:51 ----A---- C:\WINDOWS\system32\wuweb.dll 2009-07-18 14:02:51 ----A---- C:\WINDOWS\system32\wucltui.dll 2009-07-18 14:02:50 ----A---- C:\WINDOWS\system32\wups.dll 2009-07-18 14:02:50 ----A---- C:\WINDOWS\system32\wuauserv.dll 2009-07-18 14:02:50 ----A---- C:\WINDOWS\system32\wuaueng1.dll 2009-07-18 14:02:50 ----A---- C:\WINDOWS\system32\wuaueng.dll 2009-07-18 14:02:50 ----A---- C:\WINDOWS\system32\wuauclt1.exe 2009-07-18 14:02:50 ----A---- C:\WINDOWS\system32\wuauclt.exe 2009-07-18 14:02:50 ----A---- C:\WINDOWS\system32\wuapi.dll 2009-07-18 14:02:50 ----A---- C:\WINDOWS\system32\bitsprx3.dll 2009-07-18 14:02:50 ----A---- C:\WINDOWS\system32\bitsprx2.dll 2009-07-18 14:02:49 ----A---- C:\WINDOWS\system32\qmgrprxy.dll 2009-07-18 14:02:49 ----A---- C:\WINDOWS\system32\qmgr.dll 2009-07-18 14:02:46 ----A---- C:\WINDOWS\system32\safrslv.dll 2009-07-18 14:02:46 ----A---- C:\WINDOWS\system32\safrdm.dll 2009-07-18 14:02:46 ----A---- C:\WINDOWS\system32\safrcdlg.dll 2009-07-18 14:02:46 ----A---- C:\WINDOWS\system32\racpldlg.dll 2009-07-18 14:02:44 ----A---- C:\WINDOWS\system32\fltlib.dll 2009-07-18 14:02:43 ----A---- C:\WINDOWS\system32\srsvc.dll 2009-07-18 14:02:43 ----A---- C:\WINDOWS\system32\srrstr.dll 2009-07-18 14:02:43 ----A---- C:\WINDOWS\system32\srclient.dll 2009-07-18 14:02:43 ----A---- C:\WINDOWS\system32\fltMc.exe 2009-07-18 14:02:42 ----A---- C:\WINDOWS\system32\nmmkcert.dll 2009-07-18 14:02:42 ----A---- C:\WINDOWS\system32\msoert2.dll 2009-07-18 14:02:42 ----A---- C:\WINDOWS\system32\msoeacct.dll 2009-07-18 14:02:42 ----A---- C:\WINDOWS\system32\msconf.dll 2009-07-18 14:02:42 ----A---- C:\WINDOWS\system32\mnmsrvc.exe 2009-07-18 14:02:42 ----A---- C:\WINDOWS\system32\mnmdd.dll 2009-07-18 14:02:42 ----A---- C:\WINDOWS\system32\isrdbg32.dll 2009-07-18 14:02:42 ----A---- C:\WINDOWS\system32\ils.dll 2009-07-18 14:02:41 ----A---- C:\WINDOWS\system32\schedsvc.dll 2009-07-18 14:02:41 ----A---- C:\WINDOWS\system32\mstinit.exe 2009-07-18 14:02:41 ----A---- C:\WINDOWS\system32\mstask.dll 2009-07-18 14:02:41 ----A---- C:\WINDOWS\system32\inetres.dll 2009-07-18 14:02:41 ----A---- C:\WINDOWS\system32\inetcomm.dll 2009-07-18 14:02:40 ----A---- C:\WINDOWS\system32\isign32.dll 2009-07-18 14:02:40 ----A---- C:\WINDOWS\system32\inetcfg.dll 2009-07-18 14:02:40 ----A---- C:\WINDOWS\system32\icwphbk.dll 2009-07-18 14:02:40 ----A---- C:\WINDOWS\system32\icwdial.dll 2009-07-18 14:01:59 ----D---- C:\Program Files\ComPlus Applications 2009-07-18 14:01:56 ----A---- C:\WINDOWS\vbaddin.ini 2009-07-18 14:01:56 ----A---- C:\WINDOWS\vb.ini 2009-07-18 14:01:33 ----A---- C:\WINDOWS\system32\write.exe 2009-07-18 14:01:27 ----A---- C:\WINDOWS\system32\sndvol32.exe 2009-07-18 14:01:27 ----A---- C:\WINDOWS\system32\hticons.dll 2009-07-18 14:01:26 ----A---- C:\WINDOWS\system32\winchat.exe 2009-07-18 14:01:26 ----A---- C:\WINDOWS\system32\avwav.dll 2009-07-18 14:01:26 ----A---- C:\WINDOWS\system32\avtapi.dll 2009-07-18 14:01:26 ----A---- C:\WINDOWS\system32\avmeter.dll 2009-07-18 14:01:20 ----A---- C:\WINDOWS\system32\winmine.exe 2009-07-18 14:01:20 ----A---- C:\WINDOWS\system32\sol.exe 2009-07-18 14:01:20 ----A---- C:\WINDOWS\system32\getuname.dll 2009-07-18 14:01:20 ----A---- C:\WINDOWS\system32\charmap.exe 2009-07-18 14:01:20 ----A---- C:\WINDOWS\system32\calc.exe 2009-07-18 14:01:19 ----A---- C:\WINDOWS\system32\usrlogon.cmd 2009-07-18 14:01:19 ----A---- C:\WINDOWS\system32\tsshutdn.exe 2009-07-18 14:01:19 ----A---- C:\WINDOWS\system32\tslabels.ini 2009-07-18 14:01:19 ----A---- C:\WINDOWS\system32\tskill.exe 2009-07-18 14:01:19 ----A---- C:\WINDOWS\system32\tsdiscon.exe 2009-07-18 14:01:19 ----A---- C:\WINDOWS\system32\tscon.exe 2009-07-18 14:01:19 ----A---- C:\WINDOWS\system32\shadow.exe 2009-07-18 14:01:19 ----A---- C:\WINDOWS\system32\rwinsta.exe 2009-07-18 14:01:19 ----A---- C:\WINDOWS\system32\reset.exe 2009-07-18 14:01:19 ----A---- C:\WINDOWS\system32\mshearts.exe 2009-07-18 14:01:19 ----A---- C:\WINDOWS\system32\freecell.exe 2009-07-18 14:01:18 ----A---- C:\WINDOWS\system32\regini.exe 2009-07-18 14:01:18 ----A---- C:\WINDOWS\system32\rdpcfgex.dll 2009-07-18 14:01:18 ----A---- C:\WINDOWS\system32\qwinsta.exe 2009-07-18 14:01:18 ----A---- C:\WINDOWS\system32\qappsrv.exe 2009-07-18 14:01:18 ----A---- C:\WINDOWS\system32\msg.exe 2009-07-18 14:01:18 ----A---- C:\WINDOWS\system32\msdtcprf.ini 2009-07-18 14:01:18 ----A---- C:\WINDOWS\system32\logoff.exe 2009-07-18 14:01:18 ----A---- C:\WINDOWS\system32\cdmodem.dll 2009-07-18 14:01:17 ----A---- C:\WINDOWS\system32\stclient.dll 2009-07-18 14:01:17 ----A---- C:\WINDOWS\system32\mtxlegih.dll 2009-07-18 14:01:17 ----A---- C:\WINDOWS\system32\mtxex.dll 2009-07-18 14:01:17 ----A---- C:\WINDOWS\system32\mtxdm.dll 2009-07-18 14:01:17 ----A---- C:\WINDOWS\system32\dcomcnfg.exe 2009-07-18 14:01:17 ----A---- C:\WINDOWS\system32\comsnap.dll 2009-07-18 14:01:17 ----A---- C:\WINDOWS\system32\comrepl.dll 2009-07-18 14:01:17 ----A---- C:\WINDOWS\system32\comaddin.dll 2009-07-18 14:01:12 ----A---- C:\WINDOWS\system32\wmimgmt.msc 2009-07-18 14:01:12 ----A---- C:\WINDOWS\system32\accwiz.exe 2009-07-18 14:01:11 ----A---- C:\WINDOWS\system32\sndrec32.exe 2009-07-18 14:01:11 ----A---- C:\WINDOWS\system32\mspaint.exe 2009-07-18 14:01:11 ----A---- C:\WINDOWS\system32\mplay32.exe 2009-07-18 14:01:11 ----A---- C:\WINDOWS\system32\hypertrm.dll 2009-07-18 14:01:11 ----A---- C:\WINDOWS\system32\clipbrd.exe 2009-07-18 14:01:10 ----A---- C:\WINDOWS\system32\tscfgwmi.dll 2009-07-18 14:01:10 ----A---- C:\WINDOWS\system32\spider.exe 2009-07-18 14:01:10 ----A---- C:\WINDOWS\system32\sessmgr.exe 2009-07-18 14:01:10 ----A---- C:\WINDOWS\system32\remotepg.dll 2009-07-18 14:01:10 ----A---- C:\WINDOWS\system32\rdshost.exe 2009-07-18 14:01:10 ----A---- C:\WINDOWS\system32\rdsaddin.exe 2009-07-18 14:01:10 ----A---- C:\WINDOWS\system32\mstscax.dll 2009-07-18 14:01:10 ----A---- C:\WINDOWS\system32\mstsc.exe 2009-07-18 14:01:09 ----A---- C:\WINDOWS\system32\tscupgrd.exe 2009-07-18 14:01:09 ----A---- C:\WINDOWS\system32\termsrv.dll 2009-07-18 14:01:09 ----A---- C:\WINDOWS\system32\rdpwsx.dll 2009-07-18 14:01:09 ----A---- C:\WINDOWS\system32\rdpsnd.dll 2009-07-18 14:01:09 ----A---- C:\WINDOWS\system32\rdpclip.exe 2009-07-18 14:01:09 ----A---- C:\WINDOWS\system32\rdchost.dll 2009-07-18 14:01:09 ----A---- C:\WINDOWS\system32\qprocess.exe 2009-07-18 14:01:09 ----A---- C:\WINDOWS\system32\icaapi.dll 2009-07-18 14:01:09 ----A---- C:\WINDOWS\system32\cfgbkend.dll 2009-07-18 14:01:08 ----A---- C:\WINDOWS\system32\xolehlp.dll 2009-07-18 14:01:08 ----A---- C:\WINDOWS\system32\mtxoci.dll 2009-07-18 14:01:08 ----A---- C:\WINDOWS\system32\msdtcuiu.dll 2009-07-18 14:01:08 ----A---- C:\WINDOWS\system32\msdtctm.dll 2009-07-18 14:01:08 ----A---- C:\WINDOWS\system32\msdtcprx.dll 2009-07-18 14:01:08 ----A---- C:\WINDOWS\system32\msdtclog.dll 2009-07-18 14:01:08 ----A---- C:\WINDOWS\system32\msdtc.exe 2009-07-18 14:01:07 ----A---- C:\WINDOWS\system32\colbact.dll 2009-07-18 14:01:07 ----A---- C:\WINDOWS\system32\clbcatex.dll 2009-07-18 14:01:07 ----A---- C:\WINDOWS\system32\catsrvut.dll 2009-07-18 14:01:07 ----A---- C:\WINDOWS\system32\catsrvps.dll 2009-07-18 14:01:07 ----A---- C:\WINDOWS\system32\catsrv.dll 2009-07-18 14:01:06 ----A---- C:\WINDOWS\system32\comuid.dll 2009-07-18 14:01:06 ----A---- C:\WINDOWS\system32\comsvcs.dll 2009-07-18 14:01:06 ----A---- C:\WINDOWS\system32\clbcatq.dll 2009-07-18 14:01:01 ----A---- C:\WINDOWS\system32\servdeps.dll 2009-07-18 14:01:01 ----A---- C:\WINDOWS\system32\mmfutil.dll 2009-07-18 14:01:00 ----A---- C:\WINDOWS\system32\licwmi.dll 2009-07-18 14:01:00 ----A---- C:\WINDOWS\system32\cmprops.dll 2009-07-18 11:48:04 ----A---- C:\ComboFix.txt 2009-07-18 10:15:27 ----SH---- C:\Boot.bak 2009-07-18 10:15:10 ----RASHD---- C:\cmdcons 2009-07-18 08:18:15 ----D---- C:\WINDOWS\system32\appmgmt 2009-07-18 07:39:05 ----D---- C:\Program Files\Common Files\ParetoLogic 2009-07-17 22:57:56 ----D---- C:\WINDOWS\Sun 2009-07-17 22:51:03 ----D---- C:\WINDOWS\system32\Kaspersky Lab 2009-07-12 14:41:37 ----A---- C:\avenger.txt 2009-07-12 13:41:02 ----D---- C:\rsit 2009-07-12 11:52:16 ----D---- C:\Program Files\Trend Micro 2009-07-12 10:37:10 ----D---- C:\Program Files\Malwarebytes' Anti-Malware 2009-07-12 10:21:17 ----D---- C:\Program Files\Spybot - Search & Destroy 2009-07-12 09:24:39 ----D---- C:\Program Files\Lavasoft 2009-07-06 16:44:00 ----D---- C:\WINDOWS\ERDNT 2009-07-06 16:44:00 ----D---- C:\Qoobox 2009-06-27 13:06:00 ----D---- C:\Program Files\Executive Software ======List of files/folders modified in the last 1 months====== 2009-07-18 22:03:55 ----RD---- C:\Program Files 2009-07-18 22:01:23 ----D---- C:\WINDOWS 2009-07-18 21:57:53 ----D---- C:\Program Files\Steam 2009-07-18 21:20:19 ----D---- C:\WINDOWS\Temp 2009-07-18 21:18:55 ----HD---- C:\Config.Msi 2009-07-18 21:18:51 ----HD---- C:\WINDOWS\inf 2009-07-18 21:18:26 ----D---- C:\WINDOWS\system32\drivers 2009-07-18 21:18:24 ----SHD---- C:\WINDOWS\Installer 2009-07-18 18:11:10 ----D---- C:\Program Files\PowerArchiver 2009-07-18 18:07:08 ----D---- C:\WINDOWS\system32\Restore 2009-07-18 17:58:24 ----D---- C:\Program Files\Mozilla Firefox 2009-07-18 16:16:28 ----D---- C:\WINDOWS\security 2009-07-18 16:13:12 ----D---- C:\WINDOWS\system32 2009-07-18 16:10:28 ----RSHDC---- C:\WINDOWS\system32\dllcache 2009-07-18 16:10:27 ----D---- C:\WINDOWS\RegisteredPackages 2009-07-18 16:06:06 ----D---- C:\WINDOWS\system32\CatRoot2 2009-07-18 15:57:47 ----D---- C:\Program Files\SubEdit-Player 2009-07-18 15:56:34 ----D---- C:\Program Files\K-Lite Codec Pack 2009-07-18 15:52:33 ----RSD---- C:\WINDOWS\Fonts 2009-07-18 15:52:17 ----D---- C:\WINDOWS\system 2009-07-18 15:49:48 ----D---- C:\WINDOWS\Debug 2009-07-18 15:48:21 ----D---- C:\WINDOWS\system32\Setup 2009-07-18 15:48:14 ----D---- C:\WINDOWS\system32\usmt 2009-07-18 15:48:09 ----D---- C:\WINDOWS\AppPatch 2009-07-18 15:48:08 ----D---- C:\WINDOWS\ehome 2009-07-18 15:48:07 ----D---- C:\WINDOWS\ime 2009-07-18 15:48:06 ----D---- C:\WINDOWS\Media 2009-07-18 15:48:00 ----D---- C:\WINDOWS\PeerNet 2009-07-18 15:47:50 ----D---- C:\WINDOWS\system32\npp 2009-07-18 15:47:46 ----D---- C:\WINDOWS\msagent 2009-07-18 15:46:25 ----D---- C:\WINDOWS\system32\1045 2009-07-18 15:46:23 ----D---- C:\WINDOWS\twain_32 2009-07-18 15:46:19 ----D---- C:\WINDOWS\system32\ras 2009-07-18 15:46:15 ----D---- C:\WINDOWS\system32\icsxml 2009-07-18 15:46:00 ----D---- C:\WINDOWS\system32\ias 2009-07-18 15:45:56 ----D---- C:\WINDOWS\system32\1033 2009-07-18 15:44:57 ----D---- C:\WINDOWS\system32\XPSViewer 2009-07-18 15:44:57 ----D---- C:\WINDOWS\system32\URTTemp 2009-07-18 15:44:56 ----D---- C:\WINDOWS\system32\pl-PL 2009-07-18 15:44:55 ----D---- C:\WINDOWS\system32\en-us 2009-07-18 15:44:51 ----HD---- C:\WINDOWS\ShellNew 2009-07-18 15:44:51 ----D---- C:\WINDOWS\repair 2009-07-18 15:44:50 ----RD---- C:\WINDOWS\Offline Web Pages 2009-07-18 15:44:50 ----D---- C:\WINDOWS\NV10881884.TMP 2009-07-18 15:44:50 ----D---- C:\WINDOWS\Minidump 2009-07-18 15:44:49 ----D---- C:\WINDOWS\Logs 2009-07-18 15:44:46 ----SD---- C:\WINDOWS\Downloaded Program Files 2009-07-18 15:44:45 ----SHD---- C:\WINDOWS\CSC 2009-07-18 15:44:45 ----RSD---- C:\WINDOWS\assembly 2009-07-18 15:44:45 ----HDC---- C:\WINDOWS\$MSI31Uninstall_KB893803v2$ 2009-07-18 15:27:19 ----D---- C:\WINDOWS\WinSxS 2009-07-18 15:27:19 ----D---- C:\WINDOWS\Driver Cache 2009-07-18 15:27:00 ----SH---- C:\boot.ini 2009-07-18 15:27:00 ----A---- C:\WINDOWS\win.ini 2009-07-18 15:27:00 ----A---- C:\WINDOWS\system.ini 2009-07-18 15:23:13 ----HD---- C:\Program Files\InstallShield Installation Information 2009-07-18 15:21:30 ----D---- C:\WINDOWS\system32\RTCOM 2009-07-18 15:17:49 ----D---- C:\WINDOWS\ASUSInstAll 2009-07-18 14:15:52 ----D---- C:\Program Files\Common Files\Wise Installation Wizard 2009-07-18 14:15:10 ----D---- C:\WINDOWS\Help 2009-07-18 14:14:59 ----D---- C:\WINDOWS\nview 2009-07-18 14:10:48 ----D---- C:\Documents and Settings 2009-07-18 14:09:57 ----D---- C:\WINDOWS\SoftwareDistribution 2009-07-18 14:09:53 ----SD---- C:\WINDOWS\Tasks 2009-07-18 14:09:10 ----D---- C:\WINDOWS\system32\config 2009-07-18 14:04:57 ----D---- C:\WINDOWS\Registration 2009-07-18 14:03:59 ----RD---- C:\WINDOWS\Web 2009-07-18 14:03:27 ----D---- C:\WINDOWS\srchasst 2009-07-18 14:03:04 ----D---- C:\WINDOWS\system32\oobe 2009-07-18 14:02:11 ----D---- C:\WINDOWS\system32\Com 2009-07-18 14:01:48 ----D---- C:\WINDOWS\system32\MsDtc 2009-07-18 14:01:34 ----D---- C:\Program Files\Messenger 2009-07-18 14:01:32 ----D---- C:\WINDOWS\Cursors 2009-07-18 14:01:16 ----D---- C:\WINDOWS\system32\wbem 2009-07-18 11:32:36 ----D---- C:\Program Files\Common Files 2009-07-18 10:06:45 ----D---- C:\Program Files\Tlen.pl 2009-07-12 09:26:44 ----DC---- C:\WINDOWS\system32\DRVSTORE 2009-07-07 15:48:38 ----D---- C:\Program Files\Common Files\Microsoft Shared 2009-07-07 11:07:33 ----D---- C:\Program Files\DAP 2009-06-27 13:06:18 ----D---- C:\Program Files\Common Files\InstallShield ======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)====== R1 intelppm;Sterownik procesora Intel; C:\WINDOWS\system32\DRIVERS\intelppm.sys [2004-08-04 40320] R1 WS2IFSL;Środowisko wspomagające dostawcę usług innych niż IFS - Windows Socket 2.0; C:\WINDOWS\System32\drivers\ws2ifsl.sys [2001-08-17 12032] R3 Arp1394;Protokół klienta 1394 ARP; C:\WINDOWS\system32\DRIVERS\arp1394.sys [2004-08-04 60800] R3 HDAudBus;Microsoft UAA Bus Driver for High Definition Audio; C:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2005-01-07 138752] R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\WINDOWS\system32\drivers\RtkHDAud.sys [2006-11-15 4225920] R3 MTsensor;ATK0110 ACPI UTILITY; C:\WINDOWS\system32\DRIVERS\ASACPI.sys [2004-08-13 5810] R3 NIC1394;Sterownik sieci 1394; C:\WINDOWS\system32\DRIVERS\nic1394.sys [2004-08-04 61824] R3 nv;nv; C:\WINDOWS\system32\DRIVERS\nv4_mini.sys [2008-12-26 6301344] R3 NVENETFD;NVIDIA nForce Networking Controller Driver; C:\WINDOWS\system32\DRIVERS\NVENETFD.sys [2006-02-17 34176] R3 nvnetbus;NVIDIA Network Bus Enumerator; C:\WINDOWS\system32\DRIVERS\nvnetbus.sys [2006-02-17 13056] R3 usbehci;Sterownik Miniport rozszerzonego kontrolera hosta USB 2.0 Microsoft; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2004-08-03 26624] R3 usbhub;Koncentrator z obsługą USB2; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2004-08-03 57600] R3 usbohci;Sterownik Miniport otwartego kontrolera hosta USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbohci.sys [2004-08-03 17024] R4 sr;Sterownik filtru Przywracania systemu; C:\WINDOWS\system32\DRIVERS\sr.sys [2004-08-04 73472] S4 IntelIde;IntelIde; C:\WINDOWS\system32\drivers\IntelIde.sys [] ======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)====== R2 ForceWare Intelligent Application Manager (IAM);ForceWare Intelligent Application Manager (IAM); C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe [2006-02-17 139264] R2 ForcewareWebInterface;Forceware Web Interface; C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe [2006-02-17 20543] R2 JavaQuickStarterService;Java Quick Starter; C:\Program Files\Java\jre6\bin\jqs.exe [2009-07-18 152984] R2 nSvcIp;ForceWare IP service; C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe [2006-02-17 127035] R2 nSvcLog;ForceWare user log service; C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe [2006-02-17 61503] R2 NVSvc;NVIDIA Display Driver Service; C:\WINDOWS\system32\nvsvc32.exe [2008-12-26 163908] R2 StarWindService;StarWind iSCSI Service; C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe [2005-04-02 217600] S2 UMWdf;Windows User Mode Driver Framework; C:\WINDOWS\system32\wdfmgr.exe [2004-08-11 38912] -----------------EOF-----------------

**Posty:** 18165 · przez **wojtas** 19 Lip 2009, 16:15

z darmowych to Avira, platne NOD32 lub Kaspersky