Kasują mi się ważne pliki do Avasta i Spybot S&D - log

Jasiek · 10 Marzec 2007 12:36

Dziwny problem. Pewnie załapałem syfa. Otóż kasują mi się same ważne pliki do Avasta i Spybota. Oczywiście żaden program nie działa. odinstalowanie i ponowna instalka nic nie pomagają. PROSZĘ O POMOC! Z góry dziękuję!

Logfile of HijackThis v1.99.1 Scan saved at 13:32:04, on 2007-03-10 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16414) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe C:\Program Files\Sony\MD Simple Burner\NetMDSB.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Canon\CAL\CALMAIN.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe C:\Program Files\Multimedia Keyboard\PS2USBKbdDrv.exe C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe E:\programy zwykłe\QT\qttask.exe C:\PROGRA~1\Sony\SONICS~1\SsAAD.exe C:\WINDOWS\system32\hldrrr.exe C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleil.exe C:\Program Files\Kalendarz XP\Kalendarz.exe C:\Program Files\Thunderbird-Tray\TBTray.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Documents and Settings\Jasiek\Pulpit\hijackthis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.onet.pl/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.windowsxlive.net R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0 CE\Reader\ActiveX\AcroIEHelper.ocx O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll O4 - HKLM…\Run: [speedTouch USB Diagnostics] “C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe” /icon O4 - HKLM…\Run: [WireLessKeyboard] C:\Program Files\Multimedia Keyboard\PS2USBKbdDrv.exe O4 - HKLM…\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM…\Run: [sunJavaUpdateSched] “C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe” O4 - HKLM…\Run: [QuickTime Task] “E:\programy zwykłe\QT\qttask.exe” -atboottime O4 - HKLM…\Run: [ssAAD.exe] C:\PROGRA~1\Sony\SONICS~1\SsAAD.exe O4 - HKLM…\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe O4 - HKCU…\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - Global Startup: BlueSoleil.lnk = ? O4 - Global Startup: Kalendarz XP.lnk = C:\Program Files\Kalendarz XP\Kalendarz.exe O4 - Global Startup: TB-Tray.lnk = C:\Program Files\Thunderbird-Tray\TBTray.exe O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O11 - Options group: [iNTERNATIONAL] International* O16 - DPF: {68282C51-9459-467B-95BF-3C0E89627E55} (MksSkanerOnline Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab O17 - HKLM\System\CCS\Services\Tcpip…{5EA48174-40B4-471A-9571-9A40ACC0E196}: NameServer = 194.204.159.1 217.98.63.164 O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: BlueSoleil Hid Service - Unknown owner - C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe O23 - Service: NBService - Nero AG - E:\Programy Zwykłe\Nero 7\Nero BackItUp\NBService.exe O23 - Service: MD Simple Burner Service (NetMDSB) - Sony Corporation - C:\Program Files\Sony\MD Simple Burner\NetMDSB.exe O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe O23 - Service: SonicStage SCSI Service (SSScsiSV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SSScsiSV.exe

adam9870 · 10 Marzec 2007 13:28

Masz rootkita Bagle, który blokuje możliwość instalacji etc. jakichkolwiek programów zabezpieczających. HijackThis nie pokaże w całości jego dlatego pokaż jeszcze log z Comboscan i dwa logi z Gmer’a wykonane przy takich ustawieniach:

Zakładka Rootkit >>> zaznaczone wszystko oprócz Pokazuj wszystko >>> kliknij Szukaj >>> czekaj cierpliwie aż skończy >>> Kopiuj >>> wklej do posta
Zakładka Rootkit >>> zaznaczone tylko Usługi i Pokazuj wszystko >>> kliknij Szukaj >>> czekaj cierpliwie aż skończy >>> Kopiuj >>> wklej do posta

Jeśli wszystkie logi nie zmieszczą się bezpośrednio do posta, to umieść je w jakimś serwisie hostingowym jako pliki *.txt, a tu tylko zlinkuj.

http://forum.dobreprogramy.pl/viewtopic.php?t=96929

Monczkin · 10 Marzec 2007 13:31

Jasiek proszę poprawić posta z logiem, zgodnie z zasadami ich wklejania na forum.

Jasiek · 10 Marzec 2007 14:12

ComboScan v20070306.20 run by Jasiek on 2007-03-10 at 15:05:26 Computer is in Normal Mode. -------------------------------------------------------------------------------- – HijackThis (run as Jasiek.exe) ---------------------------------------------- Logfile of HijackThis v1.99.1 Scan saved at 15:05:35, on 2007-03-10 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16414) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe C:\Program Files\Sony\MD Simple Burner\NetMDSB.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Canon\CAL\CALMAIN.exe C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe C:\Program Files\Multimedia Keyboard\PS2USBKbdDrv.exe C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe E:\programy zwykłe\QT\qttask.exe C:\PROGRA~1\Sony\SONICS~1\SsAAD.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleil.exe C:\Program Files\Kalendarz XP\Kalendarz.exe C:\Program Files\Thunderbird-Tray\TBTray.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Documents and Settings\Jasiek\Pulpit\comboscan.exe C:\DOCUME~1\Jasiek\Pulpit\HIJACK~1\Jasiek.exe C:\DOCUME~1\Jasiek\USTAWI~1\Temp~19.exe O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0 CE\Reader\ActiveX\AcroIEHelper.ocx O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll O4 - HKLM…\Run: [speedTouch USB Diagnostics] “C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe” /icon O4 - HKLM…\Run: [WireLessKeyboard] C:\Program Files\Multimedia Keyboard\PS2USBKbdDrv.exe O4 - HKLM…\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM…\Run: [sunJavaUpdateSched] “C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe” O4 - HKLM…\Run: [QuickTime Task] “E:\programy zwykłe\QT\qttask.exe” -atboottime O4 - HKLM…\Run: [ssAAD.exe] C:\PROGRA~1\Sony\SONICS~1\SsAAD.exe O4 - HKLM…\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe O4 - HKCU…\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - Global Startup: BlueSoleil.lnk = ? O4 - Global Startup: Kalendarz XP.lnk = C:\Program Files\Kalendarz XP\Kalendarz.exe O4 - Global Startup: TB-Tray.lnk = C:\Program Files\Thunderbird-Tray\TBTray.exe O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O11 - Options group: [iNTERNATIONAL] International* O16 - DPF: {68282C51-9459-467B-95BF-3C0E89627E55} (MksSkanerOnline Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab O17 - HKLM\System\CCS\Services\Tcpip…{5EA48174-40B4-471A-9571-9A40ACC0E196}: NameServer = 194.204.159.1 217.98.63.164 O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: BlueSoleil Hid Service - Unknown owner - C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe O23 - Service: NBService - Nero AG - E:\Programy Zwykłe\Nero 7\Nero BackItUp\NBService.exe O23 - Service: MD Simple Burner Service (NetMDSB) - Sony Corporation - C:\Program Files\Sony\MD Simple Burner\NetMDSB.exe O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe O23 - Service: SonicStage SCSI Service (SSScsiSV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SSScsiSV.exe – Files created between 2007-02-10 and 2007-03-10 ----------------------------- 2007-03-10 14:49:21 80 --a------ C:\WINDOWS\gmer_uninstall.cmd 2007-03-10 14:11:25 79360 --a------ C:\WINDOWS\system32\swxcacls.exe 2007-03-10 14:11:25 40960 --a------ C:\WINDOWS\system32\swsc.exe 2007-03-10 14:11:25 135168 --a------ C:\WINDOWS\system32\swreg.exe 2007-03-10 14:11:25 288417 --a------ C:\WINDOWS\system32\SrchSTS.exe 2007-03-10 14:11:25 53248 --a------ C:\WINDOWS\system32\Process.exe 2007-03-10 14:11:25 51200 --a------ C:\WINDOWS\system32\dumphive.exe 2007-03-10 13:54:26 2142 --a------ C:\WINDOWS\system32\tmp.reg 2007-03-08 22:26:10 0 d-------- C:\Program Files\SkanerOnline 2007-03-07 16:18:22 8192 --a------ C:\WINDOWS\system32\kbdkor.dll 2007-03-07 16:18:22 8704 --a------ C:\WINDOWS\system32\kbdjpn.dll 2007-03-07 16:18:22 6144 --a------ C:\WINDOWS\system32\kbd106.dll 2007-03-07 16:18:22 5632 --a------ C:\WINDOWS\system32\kbd103.dll 2007-03-07 16:18:20 6144 --a------ C:\WINDOWS\system32\kbd101c.dll 2007-03-07 16:18:15 6144 --a------ C:\WINDOWS\system32\kbd101b.dll 2007-03-05 21:32:36 0 d-------- C:\WINDOWS\exefld 2007-03-05 20:46:09 0 d-------- C:\Documents and Settings\Jasiek\Application Data\Syntrillium 2007-03-04 22:35:35 0 d-------- C:\Program Files\IVT Corporation 2007-03-04 11:14:50 0 d-------- C:\Program Files\Common Files\xing shared 2007-03-04 11:14:23 0 d-------- C:\Program Files\Common Files\Real 2007-03-02 18:59:15 13824 --a------ C:\WINDOWS_g6uninst.exe<_G6UNI~1.EXE> 2007-03-02 18:59:14 0 d-------- C:\Program Files\G6 FTP Server 2007-03-02 18:52:16 5895 --a------ C:\WINDOWS\system32\xkh1udoe84fkszi4a.dll 2007-03-02 18:52:16 14865 --a------ C:\WINDOWS\system32\qke3kixfeflkszi4a.dll 2007-03-02 18:52:16 11220 --a------ C:\WINDOWS\system32\lap20nh3l4dkszi4a.dll 2007-03-02 18:52:09 0 d-------- C:\Program Files\Code-Crafters 2007-03-02 00:10:43 0 d-------- C:\Program Files\PeerGuardian2 2007-02-28 22:13:08 0 d-------- C:\Program Files\Native Instruments 2007-02-18 17:24:51 0 d-------- C:\Program Files\Common Files\Ahead 2007-02-18 14:19:43 0 d-------- C:\Program Files\Sonic Foundry 2007-02-18 14:19:39 572752 --a------ C:\WINDOWS\system32\wmvdmoe.dll 2007-02-18 14:19:39 665424 --a------ C:\WINDOWS\system32\wmv8dmoe.dll 2007-02-18 14:19:39 438608 --a------ C:\WINDOWS\system32\wmv8dmod.dll 2007-02-18 14:19:38 1683792 --a------ C:\WINDOWS\system32\wmvcore2.dll 2007-02-18 14:18:23 0 d-------- C:\Program Files\Sonic Foundry Setup 2007-02-18 10:30:15 0 d-------- C:\WINDOWS\system32\VIRepair 2007-02-15 16:30:49 38951 -----n— C:\WINDOWS\system32\drivers\NETMDUSB.sys 2007-02-15 16:30:49 36232 -----n— C:\WINDOWS\system32\drivers\NETMD033.sys 2007-02-15 16:30:49 35319 -----n— C:\WINDOWS\system32\drivers\NETMD031.sys 2007-02-15 16:30:49 90112 -----n— C:\WINDOWS\snymsico.dll 2007-02-15 16:29:47 765952 --a------ C:\WINDOWS\system32\CDDBUISony.dll 2007-02-15 16:29:47 73728 --a------ C:\WINDOWS\system32\CddbLinkSony.dll 2007-02-15 16:29:47 598016 --a------ C:\WINDOWS\system32\CDDBControlSony.dll 2007-02-15 16:29:46 109568 -----n— C:\WINDOWS\system32\pxinsi64.exe 2007-02-15 16:29:46 108544 -----n— C:\WINDOWS\system32\pxcpyi64.exe 2007-02-15 16:29:46 20640 -----n— C:\WINDOWS\system32\drivers\PxHelp20.sys 2007-02-15 16:29:45 151552 -----n— C:\WINDOWS\system32\pxwma.dll 2007-02-15 16:27:28 0 d-------- C:\Program Files\Sony 2007-02-15 16:26:24 0 d-------- C:\Program Files\Common Files\Sony Shared 2007-02-15 15:20:42 0 d-------- C:\Program Files\Canon 2007-02-15 15:18:35 0 d-------- C:\Program Files\Common Files\Canon 2007-02-14 18:53:59 180224 --a------ C:\WINDOWS\system32\xvidvfw.dll 2007-02-14 18:53:59 765952 --a------ C:\WINDOWS\system32\xvidcore.dll 2007-02-14 18:53:59 1565480 --a------ C:\WINDOWS\system32\wmv9vcm.dll 2007-02-14 18:53:57 200704 --a------ C:\WINDOWS\system32\ssldivx.dll 2007-02-14 18:53:57 3596288 --a------ C:\WINDOWS\system32\qt-dx331.dll 2007-02-14 18:53:57 1044480 --a------ C:\WINDOWS\system32\libdivx.dll 2007-02-14 18:53:57 196608 --a------ C:\WINDOWS\system32\dtu100.dll 2007-02-14 18:53:57 73728 --a------ C:\WINDOWS\system32\dpl100.dll 2007-02-14 18:53:56 639066 --a------ C:\WINDOWS\system32\divx.dll 2007-02-14 18:53:49 0 d-------- C:\Program Files\K-Lite Codec Pack 2007-02-13 18:47:32 86016 --a------ C:\WINDOWS\unvise32qt.exe 2007-02-13 18:45:41 0 d-------- C:\WINDOWS\system32\QuickTime – Find3M Report --------------------------------------------------------------- 2007-03-10 14:57:23 0 d-------- C:\Program Files\Kalendarz XP 2007-03-10 13:50:10 0 d-------- C:\Program Files\Mozilla Thunderbird 2007-03-10 12:44:17 0 d-------- C:\Program Files\Mozilla Firefox 2007-03-05 00:26:19 0 d—s---- C:\Documents and Settings\Jasiek\Dane aplikacji\Microsoft 2007-03-04 22:35:34 0 d–h----- C:\Program Files\InstallShield Installation Information 2007-03-04 21:37:41 0 d-------- C:\Documents and Settings\Jasiek\Dane aplikacji\gtopala 2007-03-04 11:18:58 0 d-------- C:\Documents and Settings\Jasiek\Dane aplikacji\Real 2007-03-03 19:58:35 359046 --a------ C:\WINDOWS\system32\perfh015.dat 2007-03-03 19:58:35 50968 --a------ C:\WINDOWS\system32\perfc015.dat 2007-02-28 21:20:48 0 d-------- C:\Documents and Settings\Jasiek\Dane aplikacji\Identities 2007-02-18 17:33:27 0 d-------- C:\Documents and Settings\Jasiek\Dane aplikacji\Ahead 2007-02-18 14:20:17 0 d-------- C:\Documents and Settings\Jasiek\Dane aplikacji\Sonic Foundry 2007-02-18 10:30:14 0 d-------- C:\Program Files\Styler 2007-02-18 10:30:08 0 d-------- C:\Program Files\VisualTooltip 2007-02-18 10:30:05 0 d-------- C:\Program Files\Vista Sidebar 2007-02-15 16:39:23 0 d-------- C:\Documents and Settings\Jasiek\Dane aplikacji\Sony Corporation 2007-02-15 15:42:06 0 d-------- C:\Documents and Settings\Jasiek\Dane aplikacji\ZoomBrowser EX 2007-02-15 11:31:11 0 d-------- C:\Documents and Settings\Jasiek\Dane aplikacji\Media Player Classic 2007-02-13 10:56:19 0 d-------- C:\Program Files\Java 2007-02-02 21:28:24 0 d-------- C:\Program Files\Microsoft Windows Script 2007-02-02 21:28:12 0 d-------- C:\Documents and Settings\Jasiek\Dane aplikacji\FMA 2007-02-02 20:56:43 0 d-------- C:\Program Files\Windows Media Connect 2 2007-01-31 20:51:43 0 d-------- C:\Documents and Settings\Jasiek\Dane aplikacji\Styler 2007-01-31 20:46:46 0 d-------- C:\Documents and Settings\Jasiek\Dane aplikacji\Stardock 2007-01-29 09:58:06 60416 -----n— C:\WINDOWS\system32\tzchange.exe 2007-01-28 20:26:58 0 d-------- C:\Program Files\Microsoft.NET 2007-01-28 16:40:38 0 d-------- C:\Program Files\Messenger 2007-01-28 16:30:48 0 d-------- C:\Documents and Settings\Jasiek\Dane aplikacji\Sun 2007-01-28 16:30:00 4224 --a------ C:\WINDOWS\mozver.dat 2007-01-28 16:25:38 0 d-------- C:\Program Files\Common Files\Java 2007-01-28 15:37:55 0 d-------- C:\Program Files\Paragon Software 2007-01-28 15:34:23 0 d-------- C:\Program Files\Common Files\Adobe 2007-01-28 15:34:23 0 d-------- C:\Documents and Settings\Jasiek\Dane aplikacji\InterTrust 2007-01-28 15:34:23 0 d-------- C:\Documents and Settings\Jasiek\Dane aplikacji\Adobe 2007-01-28 15:24:50 0 d-------- C:\Program Files\Gadu-Gadu 2007-01-28 14:51:02 0 d-------- C:\Program Files\Thunderbird-Tray 2007-01-28 14:42:27 0 d-------- C:\Documents and Settings\Jasiek\Dane aplikacji\Talkback 2007-01-28 14:42:23 0 d-------- C:\Documents and Settings\Jasiek\Dane aplikacji\Mozilla 2007-01-28 14:42:21 0 d-------- C:\Documents and Settings\Jasiek\Dane aplikacji\Thunderbird 2007-01-28 14:39:38 0 d-------- C:\Program Files\VIA 2007-01-28 14:28:17 0 d-------- C:\Program Files\Alwil Software 2007-01-28 14:17:15 0 d-------- C:\Documents and Settings\Jasiek\Dane aplikacji\ACD Systems 2007-01-28 14:16:55 0 d-------- C:\Program Files\ACD Systems 2007-01-28 14:11:09 0 d-------- C:\Documents and Settings\Jasiek\Dane aplikacji\Macromedia 2007-01-28 14:08:30 0 --a------ C:\WINDOWS\nsreg.dat 2007-01-28 14:06:00 0 d-------- C:\Program Files\Multimedia Keyboard 2007-01-28 13:55:09 0 d-------- C:\Program Files\Common Files\ODBC 2007-01-28 13:55:05 0 d-------- C:\Program Files\Common Files\SpeechEngines 2007-01-28 13:54:30 62 --ahs---- C:\Documents and Settings\Jasiek\Dane aplikacji\desktop.ini 2007-01-28 13:44:11 0 d-------- C:\Program Files\Common Files\InstallShield 2007-01-28 13:43:36 0 d-------- C:\Program Files\ATI Technologies 2007-01-28 13:37:33 0 d-------- C:\Program Files\Creative 2007-01-28 13:35:15 409600 --a------ C:\WINDOWS\system32\wrap_oal.dll 2007-01-28 13:35:15 86016 --a------ C:\WINDOWS\system32\OpenAL32.dll 2007-01-28 13:35:10 0 d-------- C:\Documents and Settings\Jasiek\Dane aplikacji\Creative 2007-01-28 13:14:32 0 d-------- C:\Program Files\Thomson 2007-01-28 13:07:39 0 d-------- C:\Program Files\microsoft frontpage 2007-01-28 13:07:29 0 -rahs---- C:\MSDOS.SYS 2007-01-28 13:07:29 0 -rahs---- C:\IO.SYS 2007-01-28 13:07:29 0 --a------ C:\CONFIG.SYS 2007-01-28 13:07:29 0 --a------ C:\AUTOEXEC.BAT 2007-01-28 13:05:50 0 d–h----- C:\Program Files\WindowsUpdate 2007-01-28 13:05:46 0 d-------- C:\Program Files\Usługi online 2007-01-28 13:04:36 0 d-------- C:\Program Files\Common Files\MSSoap 2007-01-28 13:04:24 0 d-------- C:\Program Files\Movie Maker 2007-01-28 13:03:48 21856 --a------ C:\WINDOWS\system32\emptyregdb.dat 2007-01-28 13:02:34 0 d-------- C:\Program Files\MSN Gaming Zone 2007-01-28 13:02:20 0 d-------- C:\Program Files\Windows NT 2007-01-22 12:00:36 719088 --a------ C:\WINDOWS\system32\SkanerOnline.dll 2007-01-19 09:40:42 89088 --a------ C:\WINDOWS\system32\SkanerOnlineUninstall.exe 2007-01-17 14:17:26 13840 --a------ C:\WINDOWS\system32\wnaspi32.dll 2007-01-15 18:32:07 689280 --a------ C:\WINDOWS\system32\aswBoot.exe 2007-01-15 18:23:20 90112 --a------ C:\WINDOWS\system32\AVASTSS.scr 2007-01-12 09:27:42 232960 --a------ C:\WINDOWS\system32\webcheck.dll 2007-01-12 09:27:42 51712 -----n— C:\WINDOWS\system32\msfeedsbs.dll 2007-01-12 09:27:42 458752 -----n— C:\WINDOWS\system32\msfeeds.dll 2007-01-12 09:27:42 6054400 --a------ C:\WINDOWS\system32\ieframe.dll 2007-01-09 18:46:02 10752 --a------ C:\WINDOWS\system32\ff_vfw.dll 2007-01-08 19:04:54 105984 --a------ C:\WINDOWS\system32\url.dll 2007-01-08 19:04:08 102400 --a------ C:\WINDOWS\system32\occache.dll 2007-01-08 19:02:04 266752 --a------ C:\WINDOWS\system32\iertutil.dll 2007-01-08 19:02:04 44544 --a------ C:\WINDOWS\system32\iernonce.dll 2007-01-08 19:02:02 384000 --a------ C:\WINDOWS\system32\iedkcs32.dll 2007-01-08 19:02:02 383488 -----n— C:\WINDOWS\system32\ieapfltr.dll 2007-01-08 19:02:02 161792 --a------ C:\WINDOWS\system32\ieakui.dll 2007-01-08 19:02:02 230400 --a------ C:\WINDOWS\system32\ieaksie.dll 2007-01-08 19:02:02 153088 --a------ C:\WINDOWS\system32\ieakeng.dll 2007-01-08 19:01:14 17408 --a------ C:\WINDOWS\system32\corpol.dll 2007-01-08 19:00:48 124928 --a------ C:\WINDOWS\system32\advpack.dll 2007-01-08 18:08:14 56832 --a------ C:\WINDOWS\system32\ie4uinit.exe 2007-01-08 18:08:10 13824 --a------ C:\WINDOWS\system32\ieudinit.exe 2006-12-19 22:51:04 135168 --a------ C:\WINDOWS\system32\shsvcs.dll 2006-12-19 19:18:25 334336 --a------ C:\WINDOWS\system32\wiaservc.dll – Registry Dump --------------------------------------------------------------- [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run] “CTFMON.EXE”=“C:\WINDOWS\system32\ctfmon.exe” [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run] “SpeedTouch USB Diagnostics”="“C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe” /icon" “WireLessKeyboard “=“C:\Program Files\Multimedia Keyboard\PS2USBKbdDrv.exe” “avast!”=“C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe” “SunJavaUpdateSched”=”“C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe”” “QuickTime Task”="“E:\programy zwykłe\QT\qttask.exe” -atboottime" “SsAAD.exe”=“C:\PROGRA~1\Sony\SONICS~1\SsAAD.exe” “NeroFilterCheck”=“C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe” [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\IMAIL] “Installed”=“1” [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MAPI] “Installed”=“1” “NoChange”=“1” [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MSFS] “Installed”=“1” [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^BlueSoleil.lnk] “backup”=“C:\WINDOWS\pss\BlueSoleil.lnkCommon Startup” “location”=“Common Startup” “command”="C:\PROGRA~1\IVTCOR~1\BLUESO~1\BLUESO~1.EXE " “item”=“BlueSoleil” [HKEY_USERS.default\software\microsoft\windows\currentversion\run] “CTFMON.EXE”=“C:\WINDOWS\system32\CTFMON.EXE” [HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\run] “CTFMON.EXE”=“C:\WINDOWS\system32\CTFMON.EXE” [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders] “SecurityProviders”=“msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll” SafeBoot registry key needs to be repaired. This machine cannot enter Safe Mode. [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Svchost] HTTPFilter REG_MULTI_SZ HTTPFilter\0\0 LocalService REG_MULTI_SZ Alerter\0WebClient\0LmHosts\0RemoteRegistry\0upnphost\0SSDPSRV\0\0 NetworkService REG_MULTI_SZ DnsCache\0\0 DcomLaunch REG_MULTI_SZ DcomLaunch\0TermService\0\0 rpcss REG_MULTI_SZ RpcSs\0\0 imgsvc REG_MULTI_SZ StiSvc\0\0 termsvcs REG_MULTI_SZ TermService\0\0 WudfServiceGroup REG_MULTI_SZ WUDFSvc\0\0 *newlycreated* - HKEY_LOCAL_MACHINE\system\currentcontrolset\enum\root\LEGACY_M_HOOK – End of ComboScan: finished at 2007-03-10 at 15:06:10 ------------------------

GMER 1.0.12.12086 - http://www.gmer.net Rootkit scan 2007-03-10 15:04:54 Windows 5.1.2600 Dodatek Service Pack 2 ---- Services - GMER 1.0.12 ---- Service [DISABLED] Aavmker4 Service [DISABLED] Abiosdsk Service [DISABLED] abp480n5 Service C:\WINDOWS\system32\DRIVERS\ACPI.sys [bOOT] ACPI Service [DISABLED] ACPIEC Service [DISABLED] adpu160m Service C:\WINDOWS\system32\drivers\aec.sys [MANUAL] aec Service C:\WINDOWS\System32\drivers\afd.sys [sYSTEM] AFD Service [DISABLED] Aha154x Service [DISABLED] aic78u2 Service [DISABLED] aic78xx Service C:\WINDOWS\system32\DRIVERS\alcan5wn.sys [MANUAL] alcan5wn Service C:\WINDOWS\system32\DRIVERS\alcaudsl.sys [MANUAL] alcaudsl Service C:\WINDOWS\system32\svchost.exe [DISABLED] Alerter Service C:\WINDOWS\System32\alg.exe [MANUAL] ALG Service [DISABLED] AliIde Service C:\WINDOWS\system32\DRIVERS\amdk7.sys [sYSTEM] AmdK7 Service [DISABLED] amsint Service C:\WINDOWS\system32\svchost.exe [MANUAL] AppMgmt Service C:\WINDOWS\system32\DRIVERS\arp1394.sys [MANUAL] Arp1394 Service [DISABLED] asc Service [DISABLED] asc3350p Service [DISABLED] asc3550 Service [DISABLED] aswMon2 Service [DISABLED] aswRdr Service [DISABLED] aswTdi Service C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe [DISABLED] aswUpdSv Service C:\WINDOWS\system32\DRIVERS\asyncmac.sys [MANUAL] AsyncMac Service C:\WINDOWS\system32\DRIVERS\atapi.sys [bOOT] atapi Service [DISABLED] Atdisk Service C:\WINDOWS\system32\Ati2evxx.exe [DISABLED] Ati HotKey Poller Service C:\WINDOWS\system32\ati2sgag.exe [AUTO] ATI Smart Service C:\WINDOWS\system32\DRIVERS\ati2mtag.sys [MANUAL] ati2mtag Service Atierecord Service C:\WINDOWS\system32\DRIVERS\atmarpc.sys [MANUAL] Atmarpc Service C:\WINDOWS\System32\svchost.exe [AUTO] AudioSrv Service C:\WINDOWS\system32\DRIVERS\audstub.sys [MANUAL] audstub Service C:\Program Files\Alwil Software\Avast4\ashServ.exe [DISABLED] avast! Antivirus Service C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe [DISABLED] avast! Mail Scanner Service C:\Program Files\Alwil Software\Avast4\ashWebSv.exe [DISABLED] avast! Web Scanner Service BattC Service [sYSTEM] Beep Service C:\WINDOWS\system32\svchost.exe [MANUAL] BITS Service C:\WINDOWS\system32\DRIVERS\blueletaudio.sys [MANUAL] BlueletAudio Service C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe [AUTO] BlueSoleil Hid Service Service C:\WINDOWS\system32\svchost.exe [AUTO] Browser Service C:\WINDOWS\system32\DRIVERS\btnetdrv.sys [MANUAL] BT Service C:\WINDOWS\System32\Drivers\btcusb.sys [MANUAL] Btcsrusb Service C:\WINDOWS\system32\DRIVERS\vbtenum.sys [MANUAL] BTHidEnum Service C:\WINDOWS\System32\Drivers\BTHidMgr.sys [bOOT] BTHidMgr Service [DISABLED] cbidf2k Service C:\Program Files\Canon\CAL\CALMAIN.exe [AUTO] CCALib8 Service C:\WINDOWS\system32\DRIVERS\CCDECODE.sys [MANUAL] CCDECODE Service [DISABLED] cd20xrnt Service [sYSTEM] Cdaudio Service [DISABLED] Cdfs Service C:\WINDOWS\system32\DRIVERS\cdrom.sys [sYSTEM] Cdrom Service [sYSTEM] Changer Service C:\WINDOWS\system32\cisvc.exe [MANUAL] CiSvc Service C:\WINDOWS\system32\clipsrv.exe [DISABLED] ClipSrv Service [DISABLED] CmdIde Service C:\WINDOWS\system32\dllhost.exe [MANUAL] COMSysApp Service ContentFilter Service ContentIndex Service [DISABLED] Cpqarray Service C:\WINDOWS\system32\svchost.exe [AUTO] CryptSvc Service C:\WINDOWS\system32\drivers\ctac32k.sys [MANUAL] ctac32k Service C:\WINDOWS\system32\drivers\ctaud2k.sys [MANUAL] ctaud2k Service C:\WINDOWS\system32\drivers\ctdvda2k.sys [MANUAL] ctdvda2k Service C:\WINDOWS\system32\drivers\ctprxy2k.sys [MANUAL] ctprxy2k Service C:\WINDOWS\system32\drivers\ctsfm2k.sys [MANUAL] ctsfm2k Service [DISABLED] dac2w2k Service [DISABLED] dac960nt Service C:\WINDOWS\system32\svchost.exe [AUTO] DcomLaunch Service C:\WINDOWS\System32\Drivers\DgiVecp.sys [AUTO] DgiVecp Service C:\WINDOWS\system32\svchost.exe [AUTO] Dhcp Service C:\WINDOWS\system32\DRIVERS\disk.sys [bOOT] Disk Service C:\WINDOWS\System32\dmadmin.exe [MANUAL] dmadmin Service C:\WINDOWS\System32\drivers\dmboot.sys [DISABLED] dmboot Service C:\WINDOWS\System32\drivers\dmio.sys [DISABLED] dmio Service C:\WINDOWS\System32\drivers\dmload.sys [DISABLED] dmload Service C:\WINDOWS\System32\svchost.exe [MANUAL] dmserver Service C:\WINDOWS\system32\drivers\DMusic.sys [MANUAL] DMusic Service C:\WINDOWS\system32\svchost.exe [AUTO] Dnscache Service [DISABLED] dpti2o Service C:\WINDOWS\system32\drivers\drmkaud.sys [MANUAL] drmkaud Service C:\WINDOWS\system32\drivers\emupia2k.sys [MANUAL] emupia Service C:\WINDOWS\System32\svchost.exe [AUTO] ERSvc Service C:\WINDOWS\system32\services.exe [AUTO] Eventlog Service C:\WINDOWS\system32\svchost.exe [MANUAL] EventSystem Service [DISABLED] Fastfat Service C:\WINDOWS\System32\svchost.exe [MANUAL] FastUserSwitchingCompatibility Service C:\WINDOWS\system32\DRIVERS\fdc.sys [MANUAL] Fdc Service [sYSTEM] Fips Service C:\WINDOWS\system32\DRIVERS\flpydisk.sys [MANUAL] Flpydisk Service C:\WINDOWS\system32\DRIVERS\fltMgr.sys [bOOT] FltMgr Service [sYSTEM] Fs_Rec Service C:\WINDOWS\system32\DRIVERS\ftdisk.sys [bOOT] Ftdisk Service C:\WINDOWS\system32\DRIVERS\gameenum.sys [MANUAL] gameenum Service C:\WINDOWS\System32\DRIVERS\gmer.sys [MANUAL] gmer Service C:\WINDOWS\system32\DRIVERS\msgpc.sys [MANUAL] Gpc Service C:\WINDOWS\system32\drivers\ha10kx2k.sys [MANUAL] ha10kx2k Service C:\WINDOWS\system32\drivers\hap16v2k.sys [MANUAL] hap16v2k Service C:\WINDOWS\system32\drivers\hap17v2k.sys [MANUAL] hap17v2k Service C:\WINDOWS\System32\svchost.exe [AUTO] helpsvc Service C:\WINDOWS\System32\svchost.exe [DISABLED] HidServ Service C:\WINDOWS\system32\DRIVERS\hidusb.sys [MANUAL] hidusb Service [DISABLED] hpn Service C:\WINDOWS\System32\Drivers\HTTP.sys [MANUAL] HTTP Service C:\WINDOWS\System32\svchost.exe [MANUAL] HTTPFilter Service [sYSTEM] i2omgmt Service [DISABLED] i2omp Service C:\WINDOWS\system32\DRIVERS\imapi.sys [sYSTEM] Imapi Service C:\WINDOWS\system32\imapi.exe [MANUAL] ImapiService Service inetaccs Service [DISABLED] ini910u Service Inport Service [DISABLED] IntelIde Service C:\WINDOWS\system32\DRIVERS\Ip6Fw.sys [DISABLED] Ip6Fw Service C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys [MANUAL] IpFilterDriver Service C:\WINDOWS\system32\DRIVERS\ipinip.sys [MANUAL] IpInIp Service C:\WINDOWS\system32\DRIVERS\ipnat.sys [MANUAL] IpNat Service C:\WINDOWS\system32\DRIVERS\ipsec.sys [sYSTEM] IPSec Service C:\WINDOWS\system32\DRIVERS\irenum.sys [MANUAL] IRENUM Service ISAPISearch Service C:\WINDOWS\system32\DRIVERS\isapnp.sys [bOOT] isapnp Service C:\WINDOWS\system32\DRIVERS\kbdclass.sys [sYSTEM] Kbdclass Service C:\WINDOWS\system32\DRIVERS\kbdhid.sys [sYSTEM] kbdhid Service C:\WINDOWS\system32\drivers\kmixer.sys [MANUAL] kmixer Service [bOOT] KSecDD Service C:\WINDOWS\system32\svchost.exe [AUTO] lanmanserver Service C:\WINDOWS\system32\svchost.exe [AUTO] lanmanworkstation Service [sYSTEM] lbrtfdc Service ldap Service LicenseService Service C:\WINDOWS\system32\svchost.exe [AUTO] LmHosts Service C:\WINDOWS\system32\svchost.exe [DISABLED] Messenger Service [sYSTEM] mnmdd Service C:\WINDOWS\system32\mnmsrvc.exe [MANUAL] mnmsrvc Service [MANUAL] Modem Service C:\WINDOWS\system32\DRIVERS\mouclass.sys [sYSTEM] Mouclass Service C:\WINDOWS\system32\DRIVERS\mouhid.sys [MANUAL] mouhid Service [bOOT] MountMgr Service [DISABLED] mraid35x Service C:\WINDOWS\system32\DRIVERS\mrxdav.sys [MANUAL] MRxDAV Service C:\WINDOWS\system32\DRIVERS\mrxsmb.sys [sYSTEM] MRxSmb Service C:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe [MANUAL] MSCSPTISRV Service C:\WINDOWS\system32\msdtc.exe [MANUAL] MSDTC Service [sYSTEM] Msfs Service C:\WINDOWS\system32\msiexec.exe [MANUAL] MSIServer Service C:\WINDOWS\system32\drivers\MSKSSRV.sys [MANUAL] MSKSSRV Service C:\WINDOWS\system32\drivers\MSPCLOCK.sys [MANUAL] MSPCLOCK Service C:\WINDOWS\system32\drivers\MSPQM.sys [MANUAL] MSPQM Service C:\WINDOWS\system32\DRIVERS\mssmbios.sys [MANUAL] mssmbios Service C:\WINDOWS\system32\drivers\MSTEE.sys [MANUAL] MSTEE Service C:\WINDOWS\system32\drivers\msmpu401.sys [MANUAL] ms_mpu401 Service [bOOT] Mup Service C:\Documents and Settings\Jasiek\Dane aplikacji\hidires\m_hook.sys [MANUAL] m_hook Service C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys [MANUAL] NABTSFEC Service E:\Programy [MANUAL] NBService Service [bOOT] NDIS Service C:\WINDOWS\system32\DRIVERS\NdisIP.sys [MANUAL] NdisIP Service C:\WINDOWS\system32\DRIVERS\ndistapi.sys [MANUAL] NdisTapi Service C:\WINDOWS\system32\DRIVERS\ndisuio.sys [DISABLED] Ndisuio Service C:\WINDOWS\system32\DRIVERS\ndiswan.sys [MANUAL] NdisWan Service [MANUAL] NDProxy Service C:\WINDOWS\system32\DRIVERS\netbios.sys [sYSTEM] NetBIOS Service C:\WINDOWS\system32\DRIVERS\netbt.sys [sYSTEM] NetBT Service C:\WINDOWS\system32\netdde.exe [DISABLED] NetDDE Service C:\WINDOWS\system32\netdde.exe [DISABLED] NetDDEdsdm Service C:\WINDOWS\system32\lsass.exe [MANUAL] Netlogon Service C:\WINDOWS\System32\svchost.exe [MANUAL] Netman Service C:\Program Files\Sony\MD Simple Burner\NetMDSB.exe [AUTO] NetMDSB Service C:\WINDOWS\system32\DRIVERS\nic1394.sys [MANUAL] NIC1394 Service C:\WINDOWS\system32\svchost.exe [MANUAL] Nla Service [sYSTEM] Npfs Service [DISABLED] Ntfs Service C:\WINDOWS\system32\lsass.exe [MANUAL] NtLmSsp Service C:\WINDOWS\system32\svchost.exe [MANUAL] NtmsSvc Service [sYSTEM] Null Service C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys [MANUAL] NwlnkFlt Service C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys [MANUAL] NwlnkFwd Service C:\WINDOWS\system32\DRIVERS\ohci1394.sys [bOOT] ohci1394 Service C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [MANUAL] ose Service C:\WINDOWS\system32\drivers\ctoss2k.sys [MANUAL] ossrv Service Outlook Service C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe [MANUAL] PACSPTISVR Service C:\WINDOWS\system32\DRIVERS\parport.sys [MANUAL] Parport Service [bOOT] PartMgr Service [AUTO] ParVdm Service C:\WINDOWS\system32\DRIVERS\pci.sys [bOOT] PCI Service [sYSTEM] PCIDump Service [DISABLED] PCIIde Service [DISABLED] Pcmcia Service [MANUAL] PDCOMP Service [MANUAL] PDFRAME Service [MANUAL] PDRELI Service [MANUAL] PDRFRAME Service [DISABLED] perc2 Service [DISABLED] perc2hib Service PerfDisk Service PerfNet Service PerfOS Service PerfProc Service C:\WINDOWS\system32\services.exe [AUTO] PlugPlay Service C:\WINDOWS\system32\lsass.exe [AUTO] PolicyAgent Service C:\WINDOWS\system32\DRIVERS\raspptp.sys [MANUAL] PptpMiniport Service C:\WINDOWS\system32\lsass.exe [AUTO] ProtectedStorage Service C:\WINDOWS\system32\DRIVERS\psched.sys [MANUAL] PSched Service C:\WINDOWS\system32\DRIVERS\ptilink.sys [MANUAL] Ptilink Service C:\WINDOWS\System32\Drivers\PxHelp20.sys [bOOT] PxHelp20 Service [DISABLED] ql1080 Service [DISABLED] Ql10wnt Service [DISABLED] ql12160 Service [DISABLED] ql1240 Service [DISABLED] ql1280 Service C:\WINDOWS\system32\DRIVERS\rasacd.sys [sYSTEM] RasAcd Service C:\WINDOWS\system32\svchost.exe [MANUAL] RasAuto Service C:\WINDOWS\system32\DRIVERS\rasl2tp.sys [MANUAL] Rasl2tp Service C:\WINDOWS\system32\svchost.exe [MANUAL] RasMan Service C:\WINDOWS\system32\DRIVERS\raspppoe.sys [MANUAL] RasPppoe Service C:\WINDOWS\system32\DRIVERS\raspti.sys [MANUAL] Raspti Service C:\WINDOWS\system32\DRIVERS\rdbss.sys [sYSTEM] Rdbss Service C:\WINDOWS\System32\DRIVERS\RDPCDD.sys [sYSTEM] RDPCDD Service RDPDD Service RDPNP Service [MANUAL] RDPWD Service C:\WINDOWS\system32\sessmgr.exe [MANUAL] RDSessMgr Service C:\WINDOWS\system32\DRIVERS\redbook.sys [sYSTEM] redbook Service C:\WINDOWS\system32\svchost.exe [DISABLED] RemoteAccess Service C:\WINDOWS\System32\Drivers\RootMdm.sys [MANUAL] ROOTMODEM Service C:\WINDOWS\system32\locator.exe [MANUAL] RpcLocator Service C:\WINDOWS\system32\svchost.exe [AUTO] RpcSs Service C:\WINDOWS\system32\rsvp.exe [MANUAL] RSVP Service C:\WINDOWS\system32\lsass.exe [AUTO] SamSs Service C:\WINDOWS\System32\SCardSvr.exe [MANUAL] SCardSvr Service C:\WINDOWS\System32\svchost.exe [AUTO] Schedule Service C:\WINDOWS\system32\DRIVERS\secdrv.sys [MANUAL] Secdrv Service C:\WINDOWS\System32\svchost.exe [AUTO] seclogon Service C:\WINDOWS\system32\svchost.exe [AUTO] SENS Service C:\WINDOWS\system32\DRIVERS\serenum.sys [MANUAL] serenum Service C:\WINDOWS\system32\DRIVERS\serial.sys [sYSTEM] Serial Service [sYSTEM] Sfloppy Service C:\WINDOWS\system32\svchost.exe [DISABLED] SharedAccess Service C:\WINDOWS\System32\svchost.exe [AUTO] ShellHWDetection Service [DISABLED] Simbad Service C:\WINDOWS\system32\DRIVERS\SLIP.sys [MANUAL] SLIP Service [DISABLED] Sparrow Service C:\WINDOWS\system32\drivers\splitter.sys [MANUAL] splitter Service C:\WINDOWS\system32\spoolsv.exe [AUTO] Spooler Service C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe [MANUAL] SPTISRV Service C:\WINDOWS\system32\DRIVERS\sr.sys [bOOT] sr Service C:\WINDOWS\system32\svchost.exe [AUTO] srservice Service C:\WINDOWS\system32\DRIVERS\srv.sys [MANUAL] Srv Service C:\WINDOWS\system32\svchost.exe [MANUAL] SSDPSRV Service C:\Program Files\Common Files\Sony Shared\AVLib\SSScsiSV.exe [MANUAL] SSScsiSV Service C:\WINDOWS\system32\svchost.exe [AUTO] stisvc Service C:\WINDOWS\system32\DRIVERS\StreamIP.sys [MANUAL] streamip Service C:\WINDOWS\system32\DRIVERS\swenum.sys [MANUAL] swenum Service C:\WINDOWS\system32\drivers\swmidi.sys [MANUAL] swmidi Service C:\WINDOWS\system32\dllhost.exe [MANUAL] SwPrv Service [DISABLED] symc810 Service [DISABLED] symc8xx Service [DISABLED] sym_hi Service [DISABLED] sym_u3 Service C:\WINDOWS\system32\drivers\sysaudio.sys [MANUAL] sysaudio Service C:\WINDOWS\system32\smlogsvc.exe [MANUAL] SysmonLog Service C:\WINDOWS\System32\svchost.exe [MANUAL] TapiSrv Service C:\WINDOWS\system32\DRIVERS\tcpip.sys [sYSTEM] Tcpip Service [MANUAL] TDPIPE Service [MANUAL] TDTCP Service C:\WINDOWS\system32\DRIVERS\termdd.sys [sYSTEM] TermDD Service C:\WINDOWS\System32\svchost.exe [MANUAL] TermService Service C:\WINDOWS\System32\svchost.exe [AUTO] Themes Service [DISABLED] TosIde Service C:\WINDOWS\system32\svchost.exe [AUTO] TrkWks Service TSDDD Service [DISABLED] Udfs Service system32\DRIVERS\UimBus.sys [sYSTEM] UimBus Service System32\Drivers\Uim_IM.sys [sYSTEM] Uim_IM Service [DISABLED] ultra Service C:\WINDOWS\system32\DRIVERS\update.sys [MANUAL] Update Service C:\WINDOWS\system32\svchost.exe [MANUAL] upnphost Service C:\WINDOWS\System32\ups.exe [MANUAL] UPS Service C:\WINDOWS\system32\DRIVERS\usbccgp.sys [MANUAL] usbccgp Service C:\WINDOWS\system32\DRIVERS\usbhub.sys [MANUAL] usbhub Service C:\WINDOWS\system32\DRIVERS\usbprint.sys [MANUAL] usbprint Service C:\WINDOWS\system32\DRIVERS\usbscan.sys [MANUAL] usbscan Service C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [MANUAL] USBSTOR Service C:\WINDOWS\system32\DRIVERS\usbuhci.sys [MANUAL] usbuhci Service C:\WINDOWS\system32\DRIVERS\VComm.sys [MANUAL] VComm Service C:\WINDOWS\System32\Drivers\VcommMgr.sys [MANUAL] VcommMgr Service C:\WINDOWS\System32\drivers\vga.sys [sYSTEM] VgaSave Service C:\WINDOWS\system32\DRIVERS\viaagp.sys [bOOT] viaagp Service C:\WINDOWS\system32\DRIVERS\viaagp1.sys [bOOT] viaagp1 Service C:\WINDOWS\system32\DRIVERS\viaide.sys [bOOT] ViaIde Service [bOOT] VolSnap Service C:\WINDOWS\System32\vssvc.exe [MANUAL] VSS Service C:\WINDOWS\System32\svchost.exe [AUTO] W32Time Service W3SVC Service C:\WINDOWS\system32\DRIVERS\wanarp.sys [MANUAL] Wanarp Service [MANUAL] WDICA Service C:\WINDOWS\system32\drivers\wdmaud.sys [MANUAL] wdmaud Service C:\WINDOWS\system32\svchost.exe [AUTO] WebClient Service C:\WINDOWS\system32\svchost.exe [AUTO] winmgmt Service [MANUAL] Winsock Service WinSock2 Service WinTrust Service C:\WINDOWS\System32\svchost.exe [MANUAL] WmdmPmSN Service WmiApRpl Service C:\WINDOWS\system32\wbem\wmiapsrv.exe [MANUAL] WmiApSrv Service C:\Program Files\Windows Media Player\WMPNetwk.exe [MANUAL] WMPNetworkSvc Service [sYSTEM] WS2IFSL Service C:\WINDOWS\System32\svchost.exe [DISABLED] wscsvc Service C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS [MANUAL] WSTCODEC Service C:\WINDOWS\system32\svchost.exe [DISABLED] wuauserv Service C:\WINDOWS\system32\DRIVERS\WudfPf.sys [MANUAL] WudfPf Service C:\WINDOWS\system32\DRIVERS\wudfrd.sys [MANUAL] WudfRd Service C:\WINDOWS\system32\svchost.exe [MANUAL] WudfSvc Service C:\WINDOWS\System32\svchost.exe [AUTO] WZCSVC Service C:\WINDOWS\System32\svchost.exe [MANUAL] xmlprov Service {059AF98D-BFE1-432A-B0BA-85232908B0BC} Service {D02AD405-5AFE-4DDC-9ADA-F2E4485ACD83} Service {E72B081A-F3FE-4FFD-8605-47567C462894} ---- EOF - GMER 1.0.12 ----

GMER 1.0.12.12086 - http://www.gmer.net Rootkit scan 2007-03-10 15:01:32 Windows 5.1.2600 Dodatek Service Pack 2 ---- System - GMER 1.0.12 ---- SSDT ??\C:\Documents and Settings\Jasiek\Dane aplikacji\hidires\m_hook.sys ZwCreateFile SSDT ??\C:\Documents and Settings\Jasiek\Dane aplikacji\hidires\m_hook.sys ZwEnumerateKey SSDT ??\C:\Documents and Settings\Jasiek\Dane aplikacji\hidires\m_hook.sys ZwEnumerateValueKey SSDT ??\C:\Documents and Settings\Jasiek\Dane aplikacji\hidires\m_hook.sys ZwQueryDirectoryFile SSDT ??\C:\Documents and Settings\Jasiek\Dane aplikacji\hidires\m_hook.sys ZwQueryKey SSDT ??\C:\Documents and Settings\Jasiek\Dane aplikacji\hidires\m_hook.sys ZwQuerySystemInformation ---- Kernel code sections - GMER 1.0.12 ---- .text ntoskrnl.exe!_abnormal_termination + 2CC 804E2928 1 Byte [BC] .text ntoskrnl.exe!_abnormal_termination + 2CE 804E292A 2 Bytes [D2, EC] ---- Processes - GMER 1.0.12 ---- Process C:\WINDOWS\system32\hldrrr.exe (*** hidden *** ) 364 Process C:\WINDOWS\system32\hldrrr.exe (*** hidden *** ) 408 ---- Files - GMER 1.0.12 ---- File C:\Documents and Settings\Jasiek\Dane aplikacji\hidires File C:\Documents and Settings\Jasiek\Dane aplikacji\hidires\hidr.exe File C:\Documents and Settings\Jasiek\Dane aplikacji\hidires\m_hook.sys <-- ROOTKIT ! File C:\Program Files\Movie Maker\Shared File C:\Program Files\Movie Maker\Shared\Empty.txt File C:\Program Files\Movie Maker\Shared\Filters.xml File C:\Program Files\Movie Maker\Shared\news.png File C:\Program Files\Movie Maker\Shared\paint.png File C:\Program Files\Movie Maker\Shared\Profiles File C:\Program Files\Movie Maker\Shared\Profiles\Blank.txt File C:\Program Files\Movie Maker\Shared\Sample1.jpg File C:\Program Files\Movie Maker\Shared\Sample2.jpg File C:\WINDOWS\ime\shared File C:\WINDOWS\ime\shared\res File C:\WINDOWS\system32\hldrrr.exe File C:\WINDOWS\system32\wintems.exe ---- Services - GMER 1.0.12 ---- Service C:\Documents and Settings\Jasiek\Dane aplikacji\hidires\m_hook.sys [MANUAL] m_hook – ROOTKIT ! ---- EOF - GMER 1.0.12 ---- Złączono Posta: 10.03.2007 (Sob) 17:08 I co dalej?? Usunąłem procesy, ale nadal nie mogę zainstalować żadnego antywirusa?? Czy czeka mnie format?? Bo jak tak, to szkoda czasu na pisanie postów