Rajuno
29 Marzec 2011 20:26
#1
Hej
Lubie grac w grę Trackmania. Miałem przerwe w grze- wczoraj zainstalwoałem ponownie. Gra minimalizuje sie do paska. Logi Combofix+HJThis znajduja sie poniżej. Pozdrawiam
ComboFix 11-03-28.01 - Janek 2011-03-28 22:57:04.1.4 - x86 Microsoft Windows XP Professional 5.1.2600.2.1250.48.1045.18.3071.2663 [GMT 2:00] Uruchomiony z: c:\documents and settings\Janek\Moje dokumenty\Pobieranie\ComboFix.exe AV: avast! Antivirus *Disabled/Updated* {7591DB91-41F0-48A3-B128-1A293FD8233D} . . ((((((((((((((((((((((((((((((((((((((( Usunięto ))))))))))))))))))))))))))))))))))))))))))))))))) . . E:\Autorun.inf . . ((((((((((((((((((((((((( Pliki utworzone od 2011-02-28 do 2011-03-28 ))))))))))))))))))))))))))))))) . . 2011-03-27 11:53 . 2011-03-27 12:10 -------- d-----w- c:\documents and settings\All Users\Dane aplikacji\TrackMania 2011-03-27 11:47 . 2011-03-27 11:53 -------- d-----w- c:\program files\TmUnitedForever 2011-03-27 11:45 . 2011-03-27 11:45 -------- d-----w- c:\program files\Microsoft Xbox 360 Accessories 2011-03-27 11:35 . 2011-03-27 11:36 -------- d-----w- c:\program files\Winamp Detect 2011-03-27 11:35 . 2011-03-04 19:44 126448 ------w- c:\windows\system32\pxinsi64.exe 2011-03-27 11:35 . 2011-03-04 19:44 123888 ------w- c:\windows\system32\pxcpyi64.exe 2011-03-27 11:35 . 2011-03-04 19:44 59888 ------w- c:\windows\system32\pxwma.dll 2011-03-24 21:37 . 2011-03-24 21:37 -------- d-----w- c:\program files\AMP WinOFF 2011-03-22 18:38 . 2011-03-22 18:38 12800 ----a-w- c:\program files\Mozilla Firefox\plugins\npwachk.dll 2011-03-11 13:12 . 2011-03-11 13:12 -------- d-----w- c:\documents and settings\Janek\Dane aplikacji\Apple Computer 2011-03-05 18:10 . 2006-08-21 12:28 16896 -c----w- c:\windows\system32\dllcache\fltlib.dll 2011-03-05 18:10 . 2006-08-21 09:14 23040 -c----w- c:\windows\system32\dllcache\fltmc.exe 2011-03-05 18:10 . 2006-08-21 09:14 128896 -c----w- c:\windows\system32\dllcache\fltmgr.sys 2011-03-04 16:21 . 2011-03-04 16:21 -------- d-----w- c:\program files\AVSociety 2011-03-04 09:13 . 2009-08-06 18:23 274288 ----a-w- c:\windows\system32\mucltui.dll 2011-03-04 09:13 . 2009-08-06 18:23 215920 ----a-w- c:\windows\system32\muweb.dll 2011-03-04 09:07 . 2008-11-10 10:41 32656 ----a-w- c:\windows\system32\msonpmon.dll 2011-03-04 09:07 . 2006-10-26 18:56 33104 ----a-w- c:\windows\system32\Spool\prtprocs\w32x86\msonpppr.dll 2011-03-04 09:07 . 2011-03-05 18:11 -------- d-----w- c:\program files\Microsoft Works 2011-03-04 09:07 . 2011-03-04 09:07 -------- d-----w- c:\program files\Microsoft.NET 2011-03-04 09:05 . 2011-03-04 09:05 -------- d-----w- c:\windows\SHELLNEW 2011-03-04 09:05 . 2011-03-04 09:05 -------- d-----w- c:\documents and settings\Janek\Ustawienia lokalne\Dane aplikacji\Microsoft Help 2011-03-04 09:05 . 2011-03-06 09:17 -------- d-----w- c:\documents and settings\All Users\Dane aplikacji\Microsoft Help 2011-03-04 09:05 . 2011-03-04 09:05 -------- d-----r- C:\MSOCache 2011-03-02 18:40 . 2003-06-25 15:05 266360 ----a-w- c:\windows\system32\TweakUI.exe 2011-03-01 13:20 . 2011-03-02 19:49 -------- d-----w- c:\documents and settings\Janek\Dane aplikacji\InstallShield Installation Information 2011-03-01 13:18 . 2011-03-01 13:18 -------- d-----w- c:\program files\DIFX 2011-03-01 13:17 . 2007-07-19 17:14 444776 ----a-w- c:\windows\system32\d3dx10_35.dll 2011-03-01 13:17 . 2007-07-19 17:14 1358192 ----a-w- c:\windows\system32\D3DCompiler_35.dll 2011-03-01 13:17 . 2007-07-19 17:14 3727720 ----a-w- c:\windows\system32\d3dx9_35.dll 2011-03-01 13:17 . 2007-05-16 15:45 443752 ----a-w- c:\windows\system32\d3dx10_34.dll 2011-03-01 13:17 . 2007-05-16 15:45 3497832 ----a-w- c:\windows\system32\d3dx9_34.dll 2011-03-01 13:17 . 2007-05-16 15:45 1124720 ----a-w- c:\windows\system32\D3DCompiler_34.dll 2011-03-01 13:17 . 2007-03-15 15:57 443752 ----a-w- c:\windows\system32\d3dx10_33.dll 2011-03-01 13:17 . 2007-03-12 15:42 1123696 ----a-w- c:\windows\system32\D3DCompiler_33.dll 2011-03-01 13:17 . 2007-03-12 15:42 3495784 ----a-w- c:\windows\system32\d3dx9_33.dll 2011-03-01 13:17 . 2006-11-29 12:06 3426072 ----a-w- c:\windows\system32\d3dx9_32.dll 2011-03-01 13:17 . 2006-07-28 08:30 62744 ----a-w- c:\windows\system32\xinput1_2.dll 2011-02-27 15:33 . 1999-03-23 07:12 299520 ----a-w- c:\windows\uninst.exe 2011-02-27 15:33 . 2011-02-27 15:33 -------- d-----w- c:\documents and settings\Janek\WINDOWS 2011-02-27 15:28 . 2010-03-18 23:11 23360 ----a-w- c:\windows\system32\Ckldrv.sys 2011-02-27 15:28 . 2010-03-18 20:25 126976 ----a-w- c:\windows\system32\Crypserv.exe 2011-02-27 15:28 . 2010-01-20 16:28 11776 ----a-w- c:\windows\Ckrfresh.exe 2011-02-27 15:28 . 2010-01-20 16:28 165888 ----a-r- c:\windows\Ckconfig.exe 2011-02-27 14:59 . 2011-02-27 14:59 -------- d-----w- c:\documents and settings\Janek\Ustawienia lokalne\Dane aplikacji\Pico Technology 2011-02-27 14:57 . 2011-02-27 14:57 -------- d-----w- c:\documents and settings\Janek\Ustawienia lokalne\Dane aplikacji\Downloaded Installations 2011-02-27 13:53 . 2011-02-27 13:53 -------- d-----w- c:\documents and settings\All Users\Dane aplikacji\NCH Software 2011-02-27 13:49 . 2011-02-27 13:49 -------- d-----w- c:\documents and settings\Janek\Ustawienia lokalne\Dane aplikacji\Temp 2011-02-27 13:48 . 2011-02-27 13:48 -------- d-----w- c:\documents and settings\All Users\Dane aplikacji\NCH Swift Sound . . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2011-03-04 19:44 . 2011-01-28 13:34 45648 ------w- c:\windows\system32\drivers\PxHelp20.sys 2011-03-04 19:44 . 2011-01-28 13:34 133616 ------w- c:\windows\system32\pxafs.dll 2011-02-01 13:54 . 2011-02-01 13:55 73728 ----a-w- c:\windows\system32\javacpl.cpl 2011-02-01 13:54 . 2011-02-01 13:55 472808 ----a-w- c:\windows\system32\deployJava1.dll 2011-01-29 11:28 . 2011-01-29 11:28 231248 ----a-w- c:\windows\system32\drivers\truecrypt.sys 2011-01-13 08:47 . 2011-01-28 13:50 38848 ----a-w- c:\windows\avastSS.scr 2011-01-13 08:47 . 2011-01-28 13:50 188216 ----a-w- c:\windows\system32\aswBoot.exe 2011-01-13 08:41 . 2011-01-28 13:51 294608 ----a-w- c:\windows\system32\drivers\aswSP.sys 2011-01-13 08:40 . 2011-01-28 13:51 47440 ----a-w- c:\windows\system32\drivers\aswTdi.sys 2011-01-13 08:40 . 2011-01-28 13:51 100176 ----a-w- c:\windows\system32\drivers\aswmon2.sys 2011-01-13 08:39 . 2011-01-28 13:51 94544 ----a-w- c:\windows\system32\drivers\aswmon.sys 2011-01-13 08:37 . 2011-01-28 13:51 23632 ----a-w- c:\windows\system32\drivers\aswRdr.sys 2011-01-13 08:37 . 2011-01-28 13:51 29392 ----a-w- c:\windows\system32\drivers\aavmker4.sys 2011-01-13 08:37 . 2011-01-28 13:51 17744 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys . . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “Eraser”=“c:\program files\Eraser\eraser.exe” [2009-06-10 334224] “Gadwin PrintScreen”=“c:\program files\Gadwin Systems\PrintScreen\PrintScreen.exe” [2010-10-14 487424] . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “HDAudDeck”=“c:\program files\VIA\VIAudioi\HDADeck\HDeck.exe” [2010-01-18 33714176] “StartCCC”=“c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe” [2010-05-04 102400] “WinampAgent”=“c:\program files\Winamp\winampa.exe” [2011-03-22 74752] “Corel File Shell Monitor”=“c:\program files\Corel\Corel Paint Shop Pro Photo X2\CorelIOMonitor.exe” [2008-01-15 16200] “avast5”=“c:\program files\Alwil Software\Avast5\avastUI.exe” [2011-01-13 3396624] “SunJavaUpdateSched”=“c:\program files\Common Files\Java\Java Update\jusched.exe” [2010-05-14 248552] “Adobe Reader Speed Launcher”=“c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe” [2011-01-31 35760] “Adobe ARM”=“c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe” [2010-09-20 932288] “QuickTime Task”=“c:\program files\QuickTime\QTTask.exe” [2008-05-27 413696] “XboxStat”=“c:\program files\Microsoft Xbox 360 Accessories\XboxStat.exe” [2006-12-21 731976] “Corel Photo Downloader”=“c:\program files\Common Files\Corel\Corel PhotoDownloader\Corel Photo Downloader.exe” [2007-12-14 531784] . [HKEY_USERS.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] “CTFMON.EXE”=“c:\windows\System32\CTFMON.EXE” [2004-08-03 15360] . c:\documents and settings\Janek\Menu Start\Programy\Autostart\ OpenOffice.org 3.3.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2010-12-13 1198592] . [HKLM~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] “%windir%\system32\sessmgr.exe”= “c:\Program Files\Winamp\winamp.exe”= “c:\Program Files\TmUnitedForever\TmForever.exe”= “c:\Program Files\Java\jre6\bin\javaw.exe”= “c:\Program Files\Microsoft Office\Office12\ONENOTE.EXE”= . R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [2011-01-28 294608] R2 a2AntiMalware;Emsisoft Anti-Malware 5.0 - Service;c:\program files\Emsisoft Anti-Malware\a2service.exe [2011-01-31 2964312] R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2011-01-28 17744] R3 VIAHdAudAddService;VIA High Definition Audio Driver Service;c:\windows\system32\drivers\viahduaa.sys [2011-01-27 2106880] S3 a2acc;a2acc;c:\program files\Emsisoft Anti-Malware\a2accx86.sys [2011-01-31 73728] S3 xusb20;Xbox 360 Wireless Receiver for Windows Driver Service;c:\windows\system32\drivers\xusb20.sys [2011-01-28 50048] . Zawartość folderu ‘Zaplanowane zadania’ . 2011-03-09 c:\windows\Tasks\AppleSoftwareUpdate.job - c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-04-11 16:57] . . ------- Skan uzupełniający ------- . uStart Page = hxxp://search.conduit.com?SearchSource= … =CT2117678 IE: E&ksportuj do programu Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000 LSP: c:\program files\HMA! Pro VPN\bin\ForceInterfaceLSP.dll FF - ProfilePath - c:\documents and settings\Janek\Dane aplikacji\Mozilla\Firefox\Profiles\a5nqf1xo.default\ FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.as … ource=3&q={searchTerms} FF - prefs.js: browser.search.selectedEngine - NCH Customized Web Search FF - prefs.js: browser.startup.homepage - http://www.google.pl FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions{972ce4c6-7e08-4474-a285-3208198ce6fd} FF - Ext: Java Console: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} FF - Ext: Java Console: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} FF - Ext: Google Toolbar for Firefox: {3112ca9c-de6d-4884-a869-9855de68056c} - %profile%\extensions{3112ca9c-de6d-4884-a869-9855de68056c} FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions{20a82645-c095-46ed-80e3-08825760534b} FF - Ext: Adblock Plus: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d} - %profile%\extensions{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d} FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET \Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension FF - Ext: Java Quick Starter: jqs@sun.com - c:\program files\Java\jre6\lib\deploy\jqs\ff . . ************************************************************************** . catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2011-03-28 23:01 Windows 5.1.2600 Dodatek Service Pack 2 NTFS . skanowanie ukrytych procesów … . skanowanie ukrytych wpisów autostartu … . HKLM\Software\Microsoft\Windows\CurrentVersion\Run HDAudDeck = c:\program files\VIA\VIAudioi\HDADeck\HDeck.exe 1??? . skanowanie ukrytych plików … . skanowanie pomyślnie ukończone ukryte pliki: 0 . ************************************************************************** . --------------------- Pliki DLL ładowane pod uruchomionymi procesami --------------------- . - - - - - - - > ‘winlogon.exe’(856) c:\windows\system32\Ati2evxx.dll c:\windows\system32\atiadlxx.dll . - - - - - - - > ‘lsass.exe’(912) c:\program files\HMA! Pro VPN\bin\ForceInterfaceLSP.dll . Czas ukończenia: 2011-03-28 23:02:21 ComboFix-quarantined-files.txt 2011-03-28 21:02 . Przed: 421 031 342 080 bajtów wolnych Po: 421 238 398 976 bajtów wolnych . WindowsXP-KB310994-SP2-Pro-BootDisk-PLK.exe [boot loader] timeout=2 default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS [operating systems] c:\cmdcons\BOOTSECT.DAT=“Microsoft Windows Recovery Console” /cmdcons UnsupportedDebug=“do not select this” /debug multi(0)disk(0)rdisk(0)partition(1)\WINDOWS=“Microsoft Windows XP Professional” /fastdetect /NoExecute=OptIn /usepmtimer . - - End Of File - - D57B26393A99FE7FC1EB5FF0A9414A0E
Logfile of Trend Micro HijackThis v2.0.4 Scan saved at 22:30:08, on 2011-03-29 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\Program Files\Emsisoft Anti-Malware\a2service.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\Ati2evxx.exe C:\Program Files\Alwil Software\Avast5\AvastSvc.exe C:\WINDOWS\Explorer.EXE C:\Program Files\VIA\VIAudioi\HDADeck\HDeck.exe C:\Program Files\Winamp\winampa.exe C:\Program Files\Corel\Corel Paint Shop Pro Photo X2\CorelIOMonitor.exe C:\Program Files\Alwil Software\Avast5\avastUI.exe C:\Program Files\Common Files\Java\Java Update\jusched.exe C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe C:\Program Files\Microsoft Xbox 360 Accessories\XboxStat.exe C:\Program Files\Common Files\Corel\Corel PhotoDownloader\Corel Photo Downloader.exe C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe C:\Program Files\Eraser\eraser.exe C:\Program Files\Gadwin Systems\PrintScreen\PrintScreen.exe C:\Program Files\OpenOffice.org 3\program\soffice.exe C:\Program Files\OpenOffice.org 3\program\soffice.bin C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\crypserv.exe C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcAppFlt.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\WINDOWS\system32\PSIService.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcIp.exe C:\Program Files\Mozilla Firefox\plugin-container.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\HMA! Pro VPN\bin\HMA! Pro VPN.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Trend Micro\HiJackThis\HiJackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://search.conduit.com?SearchSource= … =CT2117678 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll O4 - HKLM…\Run: [HDAudDeck] C:\Program Files\VIA\VIAudioi\HDADeck\HDeck.exe 1 O4 - HKLM…\Run: [startCCC] “C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe” MSRun O4 - HKLM…\Run: [WinampAgent] “C:\Program Files\Winamp\winampa.exe” O4 - HKLM…\Run: [Corel File Shell Monitor] C:\Program Files\Corel\Corel Paint Shop Pro Photo X2\CorelIOMonitor.exe O4 - HKLM…\Run: [avast5] “C:\Program Files\Alwil Software\Avast5\avastUI.exe” /nogui O4 - HKLM…\Run: [sunJavaUpdateSched] “C:\Program Files\Common Files\Java\Java Update\jusched.exe” O4 - HKLM…\Run: [Adobe Reader Speed Launcher] “C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe” O4 - HKLM…\Run: [Adobe ARM] “C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe” O4 - HKLM…\Run: [QuickTime Task] “C:\Program Files\QuickTime\QTTask.exe” -atboottime O4 - HKLM…\Run: [XboxStat] “C:\Program Files\Microsoft Xbox 360 Accessories\XboxStat.exe” silentrun O4 - HKLM…\Run: [Corel Photo Downloader] “C:\Program Files\Common Files\Corel\Corel PhotoDownloader\Corel Photo Downloader.exe” -startup O4 - HKCU…\Run: [Eraser] C:\Program Files\Eraser\eraser.exe -hide O4 - HKCU…\Run: [Gadwin PrintScreen] C:\Program Files\Gadwin Systems\PrintScreen\PrintScreen.exe /nosplash O4 - HKCU…\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKUS\S-1-5-18…\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User ‘SYSTEM’) O4 - HKUS.DEFAULT…\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User ‘Default user’) O4 - Startup: OpenOffice.org 3.3.lnk = C:\Program Files\OpenOffice.org 3\program\quickstart.exe O8 - Extra context menu item: E&ksportuj do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000 O9 - Extra button: Wyślij do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra ‘Tools’ menuitem: Wyślij &do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra ‘Tools’ menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O10 - Unknown file in Winsock LSP: c:\program files\hma! pro vpn\bin\forceinterfacelsp.dll O10 - Unknown file in Winsock LSP: c:\program files\hma! pro vpn\bin\forceinterfacelsp.dll O10 - Unknown file in Winsock LSP: c:\program files\hma! pro vpn\bin\forceinterfacelsp.dll O10 - Unknown file in Winsock LSP: c:\program files\hma! pro vpn\bin\forceinterfacelsp.dll O17 - HKLM\System\CCS\Services\Tcpip…{CC7D2DB3-108A-4F38-B2E2-06BB97B78FEC}: NameServer = 208.67.222.222 208.67.220.220 O22 - SharedTaskScheduler: Moduł wstępnego ładowania interfejsu Browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\System32\browseui.dll O22 - SharedTaskScheduler: Demon buforu kategorii składników - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\System32\browseui.dll O23 - Service: Emsisoft Anti-Malware 5.0 - Service (a2AntiMalware) - Emsi Software GmbH - C:\Program Files\Emsisoft Anti-Malware\a2service.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: avast! Antivirus - AVAST Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe O23 - Service: CrypKey License - CrypKey (Canada) Ltd. - C:\WINDOWS\system32\crypserv.exe O23 - Service: ForceWare Intelligent Application Manager (IAM) - Unknown owner - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcAppFlt.exe O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe O23 - Service: ForceWare IP service (nSvcIp) - Unknown owner - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcIp.exe O23 - Service: OpenVPN Service (OpenVPNService) - Unknown owner - C:\Program Files\HMA! Pro VPN\bin\openvpnserv.exe O23 - Service: ProtexisLicensing - Unknown owner - C:\WINDOWS\system32\PSIService.exe – End of file - 7267 bytes
Acorus
30 Marzec 2011 07:30
#2
Rajuno
30 Marzec 2011 13:57
#3
Scan znajduje się poniżej.
http://wklej.to/BoD0E
Acorus
30 Marzec 2011 17:19
#4
Uruchom OTL i w okno (Własne opcje skanowania/Script)wklej:
Kliknij Wykonaj skrypt.W OTL użyj opcji Sprzątanie.Przeskanuj progr.Malwarebytes Anti-Malware.
Acorus
31 Marzec 2011 07:54
#6