Hubikon13 i nie działa menedżer zadań log do sprawdzenia


(Proph3t) #1
Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 12:56:20, on 2009-02-20

Platform: Windows XP Dodatek SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)

Boot mode: Normal


Running processes:

E:\WINDOWS\System32\smss.exe

E:\WINDOWS\system32\winlogon.exe

E:\WINDOWS\system32\services.exe

E:\WINDOWS\system32\lsass.exe

E:\WINDOWS\system32\Ati2evxx.exe

E:\WINDOWS\system32\svchost.exe

E:\WINDOWS\System32\svchost.exe

E:\WINDOWS\system32\Ati2evxx.exe

E:\WINDOWS\system32\spoolsv.exe

E:\WINDOWS\Explorer.EXE

E:\WINDOWS\system32\Rundll32.exe

E:\Program Files\ATI Technologies\ATI.ACE\CLI.EXE

E:\Program Files\HP\HP Software Update\HPWuSchd.exe

E:\Program Files\HP\hpcoretech\hpcmpmgr.exe

E:\WINDOWS\system32\nvraidservice.exe

E:\Program Files\Java\jre1.6.0_07\bin\jusched.exe

E:\Program Files\G DATA\AntiVirus\AVKTray\AVKTray.exe

E:\Program Files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe

E:\Program Files\Creative\MediaSource\Detector\CTDetect.exe

E:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

E:\Program Files\Gadu-Gadu\gg.exe

E:\Program Files\Common Files\G DATA\AVKProxy\AVKProxy.exe

E:\Program Files\G DATA\AntiVirus\AVK\AVKService.exe

E:\Program Files\G DATA\AntiVirus\AVK\AVKWCtl.exe

E:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe

E:\WINDOWS\system32\CTsvcCDA.EXE

E:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe

E:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe

E:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe

E:\Program Files\NVIDIA Corporation\nTune\nTuneService.exe

E:\Program Files\Alcohol Soft\Alcohol 52\StarWind\StarWindServiceAE.exe

E:\WINDOWS\system32\svchost.exe

E:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe

E:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe

E:\WINDOWS\system32\wbem\unsecapp.exe

E:\Program Files\ATI Technologies\ATI.ACE\cli.exe

E:\Program Files\ATI Technologies\ATI.ACE\cli.exe

E:\WINDOWS\system32\wscntfy.exe

E:\Program Files\AIMP2\AIMP2.exe

E:\Program Files\Mozilla Firefox\firefox.exe

E:\Program Files\Opera\opera.exe

E:\Program Files\Trend Micro\HijackThis\HijackThis.exe


O2 - BHO: G DATA WebFilter Class - {0124123D-61B4-456f-AF86-78C53A0790C5} - E:\Program Files\G DATA\AntiVirus\Webfilter\AvkWebIE.dll

O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - E:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - E:\Program Files\Spybot - Search & Destroy\SDHelper.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - E:\Program Files\Java\jre1.6.0_07\bin\ssv.dll

O3 - Toolbar: G DATA WebFilter - {0124123D-61B4-456f-AF86-78C53A0790C5} - E:\Program Files\G DATA\AntiVirus\Webfilter\AvkWebIE.dll

O4 - HKLM\..\Run: [ATICCC] "E:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe"

O4 - HKLM\..\Run: [P17Helper] Rundll32 P17.dll,P17Helper

O4 - HKLM\..\Run: [UpdReg] E:\WINDOWS\UpdReg.EXE

O4 - HKLM\..\Run: [HP Software Update] "E:\Program Files\HP\HP Software Update\HPWuSchd.exe"

O4 - HKLM\..\Run: [HP Component Manager] "E:\Program Files\HP\hpcoretech\hpcmpmgr.exe"

O4 - HKLM\..\Run: [NVRaidService] E:\WINDOWS\system32\nvraidservice.exe

O4 - HKLM\..\Run: [nTrayFw] E:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nTrayFw.exe

O4 - HKLM\..\Run: [SunJavaUpdateSched] "E:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"

O4 - HKLM\..\Run: [G DATA AntiVirus Trayapplication] E:\Program Files\G DATA\AntiVirus\AVKTray\AVKTray.exe

O4 - HKLM\..\Run: [CTSysVol] E:\Program Files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe /r

O4 - HKCU\..\Run: [Creative Detector] E:\Program Files\Creative\MediaSource\Detector\CTDetect.exe /R

O4 - HKCU\..\Run: [NVIDIA nTune] "E:\Program Files\NVIDIA Corporation\nTune\nTuneCmd.exe" clear

O4 - HKCU\..\Run: [AlcoholAutomount] "E:\Program Files\Alcohol Soft\Alcohol 52\axcmd.exe" /automount

O4 - HKCU\..\Run: [ALLUpdate] "E:\Program Files\ALLPlayer\ALLUpdate.exe" "sleep"

O4 - HKCU\..\Run: [SpybotSD TeaTimer] E:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

O4 - HKCU\..\Run: [Gadu-Gadu] "E:\Program Files\Gadu-Gadu\gg.exe" /tray

O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] E:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA')

O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] E:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA')

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] E:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] E:\WINDOWS\system32\CTFMON.EXE (User 'Default user')

O4 - Startup: hamachi.lnk = E:\Program Files\Hamachi\hamachi.exe

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - E:\Program Files\Java\jre1.6.0_07\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - E:\Program Files\Java\jre1.6.0_07\bin\ssv.dll

O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - E:\Program Files\Spybot - Search & Destroy\SDHelper.dll

O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - E:\Program Files\Spybot - Search & Destroy\SDHelper.dll

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - E:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - E:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O10 - Unknown file in Winsock LSP: e:\windows\system32\nwprovau.dll

O17 - HKLM\System\CCS\Services\Tcpip\..\{96B8B5F9-3919-4960-8313-36C80935821F}: NameServer = 77.223.243.27,77.223.243.1

O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - E:\WINDOWS\system32\Ati2evxx.exe

O23 - Service: ATI Smart - Unknown owner - E:\WINDOWS\system32\ati2sgag.exe

O23 - Service: G DATA AntiVirus Proxy (AVKProxy) - G DATA Software - E:\Program Files\Common Files\G DATA\AVKProxy\AVKProxy.exe

O23 - Service: G DATA Scheduler (AVKService) - G DATA Software - E:\Program Files\G DATA\AntiVirus\AVK\AVKService.exe

O23 - Service: Strażnik AntiVirus (AVKWCtl) - G DATA Software AG - E:\Program Files\G DATA\AntiVirus\AVK\AVKWCtl.exe

O23 - Service: BlueSoleil Hid Service - Unknown owner - E:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe

O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - E:\WINDOWS\system32\CTsvcCDA.EXE

O23 - Service: ForceWare Intelligent Application Manager (IAM) - Unknown owner - E:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe

O23 - Service: Forceware Web Interface (ForcewareWebInterface) - Apache Software Foundation - E:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe

O23 - Service: ForceWare IP service (nSvcIp) - NVIDIA - E:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe

O23 - Service: ForceWare user log service (nSvcLog) - NVIDIA - E:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe

O23 - Service: nTune Service (nTuneService) - NVIDIA - E:\Program Files\NVIDIA Corporation\nTune\nTuneService.exe

O23 - Service: Pml Driver HPZ12 - HP - E:\WINDOWS\system32\HPZipm12.exe

O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - E:\Program Files\Alcohol Soft\Alcohol 52\StarWind\StarWindServiceAE.exe


--

End of file - 7526 bytes

Co do tego medżera próbowałem wprowadzić ten wpis rejestru:

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System] 

"DisableTaskMgr"=- 


[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Group Policy Objects\LocalUser\Software\Microsoft\Windows\CurrentVersion\Policies\System] 

"DisableTaskMgr"=- 


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system] 

"DisableTaskMgr"=-

i dalej nie działa :frowning: Poniżej przedstawiam loga z Silent Runners:

"Silent Runners.vbs", revision 59, http://www.silentrunners.org/

Operating System: Windows XP

Output limited to non-default values, except where indicated by "{++}"



Startup items buried in registry:

---------------------------------


HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ {++}

"Creative Detector" = "E:\Program Files\Creative\MediaSource\Detector\CTDetect.exe /R" ["Creative Technology Ltd"]

"NVIDIA nTune" = ""E:\Program Files\NVIDIA Corporation\nTune\nTuneCmd.exe" clear" ["NVIDIA"]

"AlcoholAutomount" = ""E:\Program Files\Alcohol Soft\Alcohol 52\axcmd.exe" /automount" ["Alcohol Soft Development Team"]

"ALLUpdate" = ""E:\Program Files\ALLPlayer\ALLUpdate.exe" "sleep"" [null data]

"SpybotSD TeaTimer" = "E:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" ["Safer Networking Limited"]

"Gadu-Gadu" = ""E:\Program Files\Gadu-Gadu\gg.exe" /tray" ["Gadu-Gadu S.A."]


HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++}

"ATICCC" = ""E:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe"" [null data]

"P17Helper" = "Rundll32 P17.dll,P17Helper" [MS]

"UpdReg" = "E:\WINDOWS\UpdReg.EXE" ["Creative Technology Ltd."]

"HP Software Update" = ""E:\Program Files\HP\HP Software Update\HPWuSchd.exe"" ["Hewlett-Packard"]

"HP Component Manager" = ""E:\Program Files\HP\hpcoretech\hpcmpmgr.exe"" ["Hewlett-Packard Company"]

"NVRaidService" = "E:\WINDOWS\system32\nvraidservice.exe" ["NVIDIA Corporation"]

"nTrayFw" = "E:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nTrayFw.exe" ["NVIDIA Corporation"]

"SunJavaUpdateSched" = ""E:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"" ["Sun Microsystems, Inc."]

"G DATA AntiVirus Trayapplication" = "E:\Program Files\G DATA\AntiVirus\AVKTray\AVKTray.exe" ["G DATA Software"]

"CTSysVol" = "E:\Program Files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe /r" ["Creative Technology Ltd"]


HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\

{0124123D-61B4-456f-AF86-78C53A0790C5}\(Default) = "G DATA WebFilter Class"

  -> {HKLM...CLSID} = "G DATA WebFilter"

                   \InProcServer32\(Default) = "E:\Program Files\G DATA\AntiVirus\Webfilter\AvkWebIE.dll" [null data]

{18DF081C-E8AD-4283-A596-FA578C2EBDC3}\(Default) = "AcroIEHelperStub"

  -> {HKLM...CLSID} = "Adobe PDF Link Helper"

                   \InProcServer32\(Default) = "E:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll" ["Adobe Systems Incorporated"]

{53707962-6F74-2D53-2644-206D7942484F}\(Default) = (no title provided)

  -> {HKLM...CLSID} = "Spybot-S&D IE Protection"

                   \InProcServer32\(Default) = "E:\Program Files\Spybot - Search & Destroy\SDHelper.dll" ["Safer Networking Limited"]

{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\(Default) = (no title provided)

  -> {HKLM...CLSID} = "SSVHelper Class"

                   \InProcServer32\(Default) = "E:\Program Files\Java\jre1.6.0_07\bin\ssv.dll" ["Sun Microsystems, Inc."]


HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\

"{42071714-76d4-11d1-8b24-00a0c9068ff3}" = "Rozszerzenie CPL kadrowania wyświetlania"

  -> {HKLM...CLSID} = "Rozszerzenie CPL kadrowania wyświetlania"

                   \InProcServer32\(Default) = "deskpan.dll" [file not found]

"{88895560-9AA2-1069-930E-00AA0030EBC8}" = "Rozszerzenie ikony HyperTerminalu"

  -> {HKLM...CLSID} = "HyperTerminal Icon Ext"

                   \InProcServer32\(Default) = "E:\WINDOWS\system32\hticons.dll" ["Hilgraeve, Inc."]

"{5E2121EE-0300-11D4-8D3B-444553540000}" = "Catalyst Context Menu extension"

  -> {HKLM...CLSID} = "SimpleShlExt Class"

                   \InProcServer32\(Default) = "E:\Program Files\ATI Technologies\ATI.ACE\atiacmxx.dll" [empty string]

"{B41DB860-8EE4-11D2-9906-E49FADC173CA}" = "WinRAR shell extension"

  -> {HKLM...CLSID} = "WinRAR"

                   \InProcServer32\(Default) = "E:\Program Files\WinRAR\rarext.dll" [null data]

"{1F77B17B-F531-44DB-ACA4-76ABB5010A28}" = "AIMP2: ShellExt"

  -> {HKLM...CLSID} = "AIMP2: ShellExt"

                   \InProcServer32\(Default) = "E:\PROGRA~1\AIMP2\System\AIMP_S~1.DLL" ["AIMP DevTeam"]

"{C52AF81D-F7A0-4AAB-8E87-F80A60CCD396}" = "OpenOffice.org Column Handler"

  -> {HKLM...CLSID} = (no title provided)

                   \InProcServer32\(Default) = ""E:\Program Files\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll"" ["Sun Microsystems, Inc."]

"{087B3AE3-E237-4467-B8DB-5A38AB959AC9}" = "OpenOffice.org Infotip Handler"

  -> {HKLM...CLSID} = (no title provided)

                   \InProcServer32\(Default) = ""E:\Program Files\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll"" ["Sun Microsystems, Inc."]

"{63542C48-9552-494A-84F7-73AA6A7C99C1}" = "OpenOffice.org Property Sheet Handler"

  -> {HKLM...CLSID} = (no title provided)

                   \InProcServer32\(Default) = ""E:\Program Files\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll"" ["Sun Microsystems, Inc."]

"{3B092F0C-7696-40E3-A80F-68D74DA84210}" = "OpenOffice.org Thumbnail Viewer"

  -> {HKLM...CLSID} = (no title provided)

                   \InProcServer32\(Default) = ""E:\Program Files\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll"" ["Sun Microsystems, Inc."]


HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\

<> AtiExtEvent\DLLName = "Ati2evxx.dll" ["ATI Technologies Inc."]


HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\

<> taskmgr.exe\Debugger = "0" [file not found]


HKLM\SOFTWARE\Classes\Folder\shellex\ColumnHandlers\

{C52AF81D-F7A0-4AAB-8E87-F80A60CCD396}\(Default) = "OpenOffice.org Column Handler"

  -> {HKLM...CLSID} = (no title provided)

                   \InProcServer32\(Default) = ""E:\Program Files\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll"" ["Sun Microsystems, Inc."]

{F9DB5320-233E-11D1-9F84-707F02C10627}\(Default) = "PDF Column Info"

  -> {HKLM...CLSID} = "PDF Shell Extension"

                   \InProcServer32\(Default) = "E:\Program Files\Common Files\Adobe\Acrobat\ActiveX\PDFShell.dll" ["Adobe Systems, Inc."]


HKLM\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\

AIMPClassic\(Default) = "{1F77B17B-F531-44DB-ACA4-76ABB5010A28}"

  -> {HKLM...CLSID} = "AIMP2: ShellExt"

                   \InProcServer32\(Default) = "E:\PROGRA~1\AIMP2\System\AIMP_S~1.DLL" ["AIMP DevTeam"]

AVK9CM\(Default) = "{CAF4C320-32F5-11D3-A222-004095200FF2}"

  -> {HKLM...CLSID} = "AVK9ContextMenue"

                   \InProcServer32\(Default) = "E:\Program Files\G DATA\AntiVirus\AVK\ShellExt.dll" ["G DATA Software"]

WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"

  -> {HKLM...CLSID} = "WinRAR"

                   \InProcServer32\(Default) = "E:\Program Files\WinRAR\rarext.dll" [null data]


HKLM\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\

AIMPClassic\(Default) = "{1F77B17B-F531-44DB-ACA4-76ABB5010A28}"

  -> {HKLM...CLSID} = "AIMP2: ShellExt"

                   \InProcServer32\(Default) = "E:\PROGRA~1\AIMP2\System\AIMP_S~1.DLL" ["AIMP DevTeam"]

WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"

  -> {HKLM...CLSID} = "WinRAR"

                   \InProcServer32\(Default) = "E:\Program Files\WinRAR\rarext.dll" [null data]


HKLM\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\

AVK9CM\(Default) = "{CAF4C320-32F5-11D3-A222-004095200FF2}"

  -> {HKLM...CLSID} = "AVK9ContextMenue"

                   \InProcServer32\(Default) = "E:\Program Files\G DATA\AntiVirus\AVK\ShellExt.dll" ["G DATA Software"]

WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"

  -> {HKLM...CLSID} = "WinRAR"

                   \InProcServer32\(Default) = "E:\Program Files\WinRAR\rarext.dll" [null data]



Group Policies {GPedit.msc branch and setting}:

-----------------------------------------------


Note: detected settings may not have any effect.


HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer\PhishingFilter\


"Enabled" = (REG_DWORD) dword:0x00000000

{Computer Configuration|Administrative Templates|Windows Components|Internet Explorer|

Turn off Managing Phishing filter}


HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\


"shutdownwithoutlogon" = (REG_DWORD) dword:0x00000001

{Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options|

Shutdown: Allow system to be shut down without having to log on}


"undockwithoutlogon" = (REG_DWORD) dword:0x00000001

{Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options|

Devices: Allow undock without having to log on}



Active Desktop and Wallpaper:

-----------------------------


Active Desktop may be disabled at this entry:

HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState


Displayed if Active Desktop enabled and wallpaper not set by Group Policy:

HKCU\Software\Microsoft\Internet Explorer\Desktop\General\

"Wallpaper" = "%APPDATA%\Opera\Opera\profile\skin\01798_homeworld_1440x900.bmp"


Displayed if Active Desktop disabled and wallpaper not set by Group Policy:

HKCU\Control Panel\Desktop\

"Wallpaper" = "E:\Documents and Settings\Wołek\Dane aplikacji\Opera\Opera\profile\skin\01798_homeworld_1440x900.bmp"



Enabled Screen Saver:

---------------------


HKCU\Control Panel\Desktop\

"SCRNSAVE.EXE" = "E:\WINDOWS\System32\logon.scr" [MS]



Windows Portable Device AutoPlay Handlers

-----------------------------------------


HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers\Handlers\


AlcoholAutoPlayV2.ReadDisc\

"Provider" = "Alcohol 52%"

"InvokeProgID" = "AlcoholAutoPlayV2"

"InvokeVerb" = "ReadDisc"

HKLM\SOFTWARE\Classes\AlcoholAutoPlayV2\shell\ReadDisc\command\(Default) = ""E:\Program Files\Alcohol Soft\Alcohol 52\alcohol.exe" %1" ["Alcohol Soft Development Team"]


CTPlayAudioOnArrival\

"Provider" = "@E:\Program Files\Creative\MediaSource\CTCMS.CRL,-14345"

"InvokeProgID" = "CTAutoPL.AudioCDPlayer.1"

"InvokeVerb" = "open"

HKLM\SOFTWARE\Classes\CTAutoPL.AudioCDPlayer.1\shell\open\command\(Default) = ""E:\Program Files\Creative\MediaSource\CTCMS.exe" /T=CLASSKEY_AudioCD IN %L PlayNow" ["Creative Technology Ltd"]


CTPlayMusicFilesOnArrival\

"Provider" = "@E:\Program Files\Creative\MediaSource\CTCMS.CRL,-14345"

"InvokeProgID" = "CTAutoPL.MusicFilesPlayer.1"

"InvokeVerb" = "open"

HKLM\SOFTWARE\Classes\CTAutoPL.MusicFilesPlayer.1\shell\open\command\(Default) = ""E:\Program Files\Creative\MediaSource\CTCMS.exe" /Organizer" ["Creative Technology Ltd"]


HPUnloadAutoplay\

"Provider" = "program przegrywanie obrazów hp"

"InvokeProgID" = "HpqUnApl.Autoplay"

"InvokeVerb" = "Play"

HKLM\SOFTWARE\Classes\HpqUnApl.Autoplay\shell\Play\DropTarget\CLSID = "{E1A1C814-FD09-4c9d-BB4A-0394B836A1F0}"

  -> {HKLM...CLSID} = (no title provided)

                   \LocalServer32\(Default) = "E:\Program Files\HP\Digital Imaging\Unload\HpqUnApl.exe" ["Hewlett-Packard"]


MPCPlayCDAudioOnArrival\

"Provider" = "Media Player Classic"

"InvokeProgID" = "MediaPlayerClassic.Autorun"

"InvokeVerb" = "PlayCDAudio"

HKLM\SOFTWARE\Classes\MediaPlayerClassic.Autorun\shell\PlayCDAudio\command\(Default) = ""E:\Program Files\K-Lite Codec Pack\Media Player Classic\mplayerc.exe" %1 /cd" ["mpc-hc@Sourceforge"]


MPCPlayDVDMovieOnArrival\

"Provider" = "Media Player Classic"

"InvokeProgID" = "MediaPlayerClassic.Autorun"

"InvokeVerb" = "PlayDVDMovie"

HKLM\SOFTWARE\Classes\MediaPlayerClassic.Autorun\shell\PlayDVDMovie\command\(Default) = ""E:\Program Files\K-Lite Codec Pack\Media Player Classic\mplayerc.exe" %1 /dvd" ["mpc-hc@Sourceforge"]


MPCPlayMusicFilesOnArrival\

"Provider" = "Media Player Classic"

"InvokeProgID" = "MediaPlayerClassic.Autorun"

"InvokeVerb" = "PlayMusicFiles"

HKLM\SOFTWARE\Classes\MediaPlayerClassic.Autorun\shell\PlayMusicFiles\command\(Default) = ""E:\Program Files\K-Lite Codec Pack\Media Player Classic\mplayerc.exe" %1" ["mpc-hc@Sourceforge"]


MPCPlayVideoFilesOnArrival\

"Provider" = "Media Player Classic"

"InvokeProgID" = "MediaPlayerClassic.Autorun"

"InvokeVerb" = "PlayVideoFiles"

HKLM\SOFTWARE\Classes\MediaPlayerClassic.Autorun\shell\PlayVideoFiles\command\(Default) = ""E:\Program Files\K-Lite Codec Pack\Media Player Classic\mplayerc.exe" %1" ["mpc-hc@Sourceforge"]


MSPlayCDAudioOnArrival\

"Provider" = "ALLPlayer"

"InvokeProgID" = "AllPlayerFile"

"InvokeVerb" = "play"

HKCU\Software\Classes\AllPlayerFile\shell\play\command\(Default) = ""E:\Program Files\ALLPlayer\ALLPlayer.exe" "%1"" ["ALLPlayer"]



Startup items in "Wołek" & "All Users" startup folders:

-------------------------------------------------------


E:\Documents and Settings\Wołek\Menu Start\Programy\Autostart

"hamachi" -> shortcut to: "E:\Program Files\Hamachi\hamachi.exe" ["LogMeIn Inc."]



Enabled Scheduled Tasks:

------------------------


"Ad-Aware Update (Weekly)" -> launches: "E:\Program Files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe update all silent" [file not found]



Winsock2 Service Provider DLLs:

-------------------------------


Namespace Service Providers


HKLM\SYSTEM\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++}

000000000001\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]

000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS]

000000000003\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]

000000000004\LibraryPath = "%SystemRoot%\System32\nwprovau.dll" [MS]


Transport Service Providers


HKLM\SYSTEM\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++}

0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range:

%SYSTEMROOT%\system32\nvappfilter.dll ["NVIDIA"], 01 - 24, 49

%SystemRoot%\system32\mswsock.dll [MS], 25 - 27, 30 - 48

%SystemRoot%\system32\rsvpsp.dll [MS], 28 - 29



Toolbars, Explorer Bars, Extensions:

------------------------------------


Toolbars


HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar\

"{0124123D-61B4-456F-AF86-78C53A0790C5}" = "G DATA WebFilter"

  -> {HKLM...CLSID} = "G DATA WebFilter"

                   \InProcServer32\(Default) = "E:\Program Files\G DATA\AntiVirus\Webfilter\AvkWebIE.dll" [null data]


Extensions (Tools menu items, main toolbar menu buttons)


HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\

{08B0E5C0-4FCB-11CF-AAA5-00401C608501}\

"MenuText" = "Sun Java Console"

"CLSIDExtension" = "{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBC}"

  -> {HKCU...CLSID} = "Java Plug-in 1.6.0_07"

                   \InProcServer32\(Default) = "E:\Program Files\Java\jre1.6.0_07\bin\ssv.dll" ["Sun Microsystems, Inc."]

  -> {HKLM...CLSID} = "Java Plug-in 1.6.0_07"

                   \InProcServer32\(Default) = "E:\Program Files\Java\jre1.6.0_07\bin\npjpi160_07.dll" ["Sun Microsystems, Inc."]


{DFB852A3-47F8-48C4-A200-58CAB36FD2A2}\

"MenuText" = "Spybot - Search && Destroy Configuration"

"CLSIDExtension" = "{53707962-6F74-2D53-2644-206D7942484F}"

  -> {HKLM...CLSID} = "Spybot-S&D IE Protection"

                   \InProcServer32\(Default) = "E:\Program Files\Spybot - Search & Destroy\SDHelper.dll" ["Safer Networking Limited"]


{E2E2DD38-D088-4134-82B7-F2BA38496583}\

"MenuText" = "@xpsp3res.dll,-20001"

"Exec" = "%windir%\Network Diagnostic\xpnetdiag.exe" [MS]



Running Services (Display Name, Service Name, Path {Service DLL}):

------------------------------------------------------------------


Ati HotKey Poller, Ati HotKey Poller, "E:\WINDOWS\system32\Ati2evxx.exe" ["ATI Technologies Inc."]

BlueSoleil Hid Service, BlueSoleil Hid Service, "E:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe" [null data]

Creative Service for CDROM Access, Creative Service for CDROM Access, "E:\WINDOWS\system32\CTsvcCDA.EXE" ["Creative Technology Ltd"]

ForceWare Intelligent Application Manager (IAM), ForceWare Intelligent Application Manager (IAM), "E:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe" [empty string]

ForceWare IP service, nSvcIp, "E:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe" ["NVIDIA"]

ForceWare user log service, nSvcLog, "E:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe" ["NVIDIA"]

Forceware Web Interface, ForcewareWebInterface, ""E:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe" -k runservice" ["Apache Software Foundation"]

G DATA AntiVirus Proxy, AVKProxy, ""E:\Program Files\Common Files\G DATA\AVKProxy\AVKProxy.exe"" ["G DATA Software"]

G DATA Scheduler, AVKService, "E:\Program Files\G DATA\AntiVirus\AVK\AVKService.exe" ["G DATA Software"]

nTune Service, nTuneService, "E:\Program Files\NVIDIA Corporation\nTune\nTuneService.exe /StartService" ["NVIDIA"]

StarWind AE Service, StarWindServiceAE, "E:\Program Files\Alcohol Soft\Alcohol 52\StarWind\StarWindServiceAE.exe" ["Rocket Division Software"]

Strażnik AntiVirus, AVKWCtl, "E:\Program Files\G DATA\AntiVirus\AVK\AVKWCtl.exe" ["G DATA Software AG"]

Windows User Mode Driver Framework, UMWdf, "E:\WINDOWS\system32\wdfmgr.exe" [MS]



Print Monitors:

---------------


HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors\

hpzsnt09\Driver = "hpzsnt09.dll" ["HP"]



---------- (launch time: 2009-02-20 13:04:06)

<>: Suspicious data at a malware launch point.


+ This report excludes default entries except where indicated.

+ To see *everywhere* the script checks and *everything* it finds,

  launch it from a command prompt or a shortcut with the -all parameter.

+ To search all directories of local fixed drives for DESKTOP.INI

  DLL launch points, use the -supp parameter or answer "No" at the

  first message box and "Yes" at the second message box.

---------- (total run time: 206 seconds, including 10 seconds for message boxes)

Dodam iż system posiada dodatek SP3.

Za wszelką pomoc bardzo dziękuję :slight_smile:


(Spandau) #2

Pobierz Combofix przeskanuj system i daj log na forum.

Loga wklej na www.wklejto.pl lub http://www.wklej.org/ a w poście daj tylko linka


(Proph3t) #3

Proszę bardzo - KLIK

-- Dodane 20.02.2009 (Pt) 13:38 --

Menedżer zadań już działą :slight_smile:

Ale prosiłbym jeszcze o sprawdzenie logów.


(Spandau) #4

Log wygląda na czysty

usuń ręcznie folder C: \Qoobox oraz instalkę Combofix z dysku.

Przeczyść system oraz rejestr CCleaner

Wyłącz i włącz przywracanie systemu na wszystkich dyskach. Instrukcja

Jeśli podejrzewasz infekcje możesz przeskanować system Dr.WEB CureIt!


(Proph3t) #5

Z infekcją sobie poradziłem Avast nie dawał rady ale GData Antivirus usunął go bezproblemmowo :slight_smile:

Tylko ten nieszczęsny menedżer który na szczęście już działa.

Dziękuję ślicznie za pomoc