Keylogger Tibia

Dwid_816400701 · 22 Maj 2007 18:18

Logfile of HijackThis v1.99.1 Scan saved at 20:15:40, on 2007-05-22 Platform: Windows XP (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2600.0000) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\explorer.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\System32\nvsvc32.exe C:\Program Files\Alcohol Soft\Alcohol 52\StarWind\StarWindService.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe C:\progra~1\intern~1\rundll32.exe C:\Program Files\Alwil Software\Avast4\ashDisp.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\program files\internet explorer\iexplore.exe C:\Program Files\Alwil Software\Avast4\ashSimpl.exe C:\DOCUME~1\graland\Pulpit\MATEUS~1.SCR C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Tibia\Tibia.exe C:\program files\internet explorer\iexplore.exe C:\Program Files\WinRAR\WinRAR.exe C:\Documents and Settings\graland\Pulpit\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.pl/ R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza F2 - REG:system.ini: Shell=explorer.exe O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O4 - HKLM…\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup O4 - Startup: Skrót do ashDisp.lnk = C:\Program Files\Alwil Software\Avast4\ashDisp.exe O8 - Extra context menu item: Add to AMV Convert Tool… - C:\Program Files\MP3 Player Utilities 4.00\AMVConverter\grab.html O8 - Extra context menu item: MediaManager tool grab multimedia file - C:\Program Files\MP3 Player Utilities 4.00\MediaManager\grab.html O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll O9 - Extra ‘Tools’ menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll O9 - Extra button: eBay - Homepage - {EF79EAC5-3452-4E02-B8BD-BA4C89F1AC7A} - C:\Program Files\IrfanView\Ebay\Ebay.htm O16 - DPF: {5A09E43F-A0A7-4ABF-AF80-11367CF1DC8F} (MainControl Class) - http://mks.com.pl/skaner/SkanerOnline.cab O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupda … 0014879691 O17 - HKLM\System\CCS\Services\Tcpip…{8265D49A-2AD0-4D5B-96CF-5F24A3570DD3}: NameServer = 192.168.2.254 O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\ O20 - Winlogon Notify: WRNotifier - C:\WINDOWS\SYSTEM32\WRLogonNTF.dll O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing) O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing) O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: NBService - Nero AG - C:\Nero 7\Nero BackItUp\NBService.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe O23 - Service: O&O Defrag (OODefrag) - O&O Software GmbH - C:\WINDOWS\System32\oodag.exe O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 52\StarWind\StarWindService.exe O23 - Service: Webroot Spy Sweeper Engine (WebrootSpySweeperService) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe

Złączono Posta : 22.05.2007 (Wto) 21:05

+ctrl+alt+del+ wywołuje program kalkulator :x

Gutek · 22 Maj 2007 19:14

Daj log z Combofix

Dwid_816400701 · 22 Maj 2007 19:47

… regedit is missing :? nic dobrego ręce opadają a procesu nie idzie wyłączyć bo jak :? Silent run… muli, więc jest bezradny z niego logo nie wykrzesam :-x

Gutek · 22 Maj 2007 19:54

usuń wpis HJT

a to co na pulpicie?

w trybie awaryjnym usuń plik

Dwid_816400701 · 22 Maj 2007 20:00

Logfile of HijackThis v1.99.1 Scan saved at 21:58:18, on 2007-05-22 Platform: Windows XP (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2600.0000) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\explorer.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\System32\nvsvc32.exe C:\Program Files\Alcohol Soft\Alcohol 52\StarWind\StarWindService.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe C:\progra~1\intern~1\rundll32.exe C:\Program Files\Alwil Software\Avast4\ashDisp.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Winamp\winampa.exe C:\Program Files\Winamp\winamp.exe C:\Documents and Settings\graland\Pulpit\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.pl/ R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza F2 - REG:system.ini: Shell=explorer.exe O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O4 - HKLM…\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup O4 - HKLM…\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe O4 - Startup: Skrót do ashDisp.lnk = C:\Program Files\Alwil Software\Avast4\ashDisp.exe O8 - Extra context menu item: Add to AMV Convert Tool… - C:\Program Files\MP3 Player Utilities 4.00\AMVConverter\grab.html O8 - Extra context menu item: MediaManager tool grab multimedia file - C:\Program Files\MP3 Player Utilities 4.00\MediaManager\grab.html O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll O9 - Extra ‘Tools’ menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll O9 - Extra button: eBay - Homepage - {EF79EAC5-3452-4E02-B8BD-BA4C89F1AC7A} - C:\Program Files\IrfanView\Ebay\Ebay.htm O16 - DPF: {5A09E43F-A0A7-4ABF-AF80-11367CF1DC8F} (MainControl Class) - http://mks.com.pl/skaner/SkanerOnline.cab O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupda … 0014879691 O17 - HKLM\System\CCS\Services\Tcpip…{8265D49A-2AD0-4D5B-96CF-5F24A3570DD3}: NameServer = 192.168.2.254 O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\ O20 - Winlogon Notify: WRNotifier - C:\WINDOWS\SYSTEM32\WRLogonNTF.dll O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing) O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing) O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: NBService - Nero AG - C:\Nero 7\Nero BackItUp\NBService.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe O23 - Service: O&O Defrag (OODefrag) - O&O Software GmbH - C:\WINDOWS\System32\oodag.exe O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 52\StarWind\StarWindService.exe O23 - Service: Webroot Spy Sweeper Engine (WebrootSpySweeperService) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe

Już go wywaliłem. Wpisz jak chcesz, w google keylogger Tibia i będziesz widział specjalny projekt, pewny plik podszywa się pod svchost, ale HJ go nie widzi :?

02 BHO usunięty :?

Gutek · 22 Maj 2007 20:13

Nic nie usunięte, to co było jest

Log z Combo musisz wrzucić

Dwid_816400701 · 23 Maj 2007 04:28

Combo “C:/WINDOWS/regedit.exe is missing” :?

Joan · 23 Maj 2007 14:13

Może Comboscan ruszy

Dwid_816400701 · 23 Maj 2007 16:28

Deckard’s System Scanner v20070426.43 Run by graland on 2007-05-23 at 18:08:06 Computer is in Normal Mode. -------------------------------------------------------------------------------- – System Restore -------------------------------------------------------------- System Restore is disabled; attempting to re-enable…success. – Last 1 Restore Point(s) – 1: 2007-05-23 14:08:10 UTC - RP1 - Punkt kontrolny systemu Backed up registry hives. Performed disk cleanup. – HijackThis (run as graland.exe) --------------------------------------------- Logfile of HijackThis v1.99.1 Scan saved at 18:15:10, on 2007-05-23 Platform: Windows XP (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2600.0000) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\explorer.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\System32\nvsvc32.exe C:\Program Files\Alcohol Soft\Alcohol 52\StarWind\StarWindService.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe C:\progra~1\intern~1\rundll32.exe C:\Program Files\Winamp\winampa.exe C:\Program Files\Alwil Software\Avast4\ashDisp.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Documents and Settings\graland\Pulpit\dss.exe C:\DOCUME~1\graland\Pulpit\graland.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.pl/ R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza F2 - REG:system.ini: Shell=explorer.exe O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O4 - HKLM…\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup O4 - HKLM…\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe O4 - Startup: Skrót do ashDisp.lnk = C:\Program Files\Alwil Software\Avast4\ashDisp.exe O8 - Extra context menu item: Add to AMV Convert Tool… - C:\Program Files\MP3 Player Utilities 4.00\AMVConverter\grab.html O8 - Extra context menu item: MediaManager tool grab multimedia file - C:\Program Files\MP3 Player Utilities 4.00\MediaManager\grab.html O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll O9 - Extra ‘Tools’ menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll O9 - Extra button: eBay - Homepage - {EF79EAC5-3452-4E02-B8BD-BA4C89F1AC7A} - C:\Program Files\IrfanView\Ebay\Ebay.htm O16 - DPF: {5A09E43F-A0A7-4ABF-AF80-11367CF1DC8F} (MainControl Class) - http://mks.com.pl/skaner/SkanerOnline.cab O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupda … 0014879691 O17 - HKLM\System\CCS\Services\Tcpip…{8265D49A-2AD0-4D5B-96CF-5F24A3570DD3}: NameServer = 192.168.2.254 O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\ O20 - Winlogon Notify: WRNotifier - C:\WINDOWS\SYSTEM32\WRLogonNTF.dll O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing) O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing) O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: NBService - Nero AG - C:\Nero 7\Nero BackItUp\NBService.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe O23 - Service: O&O Defrag (OODefrag) - O&O Software GmbH - C:\WINDOWS\System32\oodag.exe O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 52\StarWind\StarWindService.exe O23 - Service: Webroot Spy Sweeper Engine (WebrootSpySweeperService) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe – HijackThis Fixed Entries (C:\DOCUME~1\graland\Pulpit\backups) -------------- backup-20070522-220051-517 O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) – File Associations ----------------------------------------------------------- .cpl - cplfile - shell\cplopen\command - rundll32.exe shell32.dll,Control_RunDLL %1,%* .cpl - cplfile - shell\runas\command - rundll32.exe shell32.dll,Control_RunDLLAsUser %1,%* .js - EdHTMLFile_2 - DefaultIcon - C:\Program Files\Binboy\EdHTMLv5.0\EdHTML.exe,2 .js - EdHTMLFile_2 - shell\open\command - “C:\Program Files\Binboy\EdHTMLv5.0\EdHTML.exe” “%1” .vbs - VBSFile.SymantecDisabled - DefaultIcon - %SystemRoot%\System32\WScript.exe,2 .vbs - VBSFile.SymantecDisabled - shell\open\command - %SystemRoot%\System32\WScript.exe “%1” %* .vbs - VBSFile.SymantecDisabled - shell\edit\command - %SystemRoot%\System32\Notepad.exe %1 – Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------- R0 hotcore - c:\windows\system32\drivers\hotcore.sys R0 SSFS0509 (Spy Sweeper File System Filer Driver: 0509) - c:\windows\system32\drivers\ssfs0509.sys http://www.webroot.com); Spy Sweeper SDK> R0 SSHRMD (Spy Sweeper Hookrack MiniDriver) - c:\windows\system32\drivers\sshrmd.sys http://www.webroot.com); Spy Sweeper SDK> R0 SSIDRV (Spy Sweeper Interdiction Driver) - c:\windows\system32\drivers\ssidrv.sys http://www.webroot.com); Spy Sweeper SDK> R1 NPPTNT2 - c:\windows\system32\npptnt2.sys R1 UserPort - c:\windows\system32\drivers\userport.sys R3 3xHybrid (3xHybrid service) - c:\windows\system32\drivers\3xhybrid.sys R3 RT2500 (RT2500 Wireless Driver) - c:\windows\system32\drivers\rt2500.sys R3 SiS7012 (Service for AC’97 Sample Driver (WDM)) - c:\windows\system32\drivers\sis7012.sys R3 SSKBFD (Webroot Spy Sweeper Keylogger Shield Keyboard Filter) - c:\windows\system32\drivers\sskbfd.sys http://www.webroot.com); Spy Sweeper SDK> R3 vaxscsi - c:\windows\system32\drivers\vaxscsi.sys S3 ddxgb - c:\docume~1\graland\ustawi~1\temp\ddxgb.sys (file missing) S3 dtscsi - c:\windows\system32\drivers\dtscsi.sys (file missing) S3 FreshIO - c:\program files\freshdevices\freshdiagnose\freshio.sys (file missing) S3 StMp3Rec (Player Recovery Device Control Driver) - c:\windows\system32\drivers\stmp3rec.sys – Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled -------------------- S2 OODefrag (O&O Defrag) - c:\windows\system32\oodag.exe S3 NBService - c:\nero 7\nero backitup\nbservice.exe – Files created between 2007-04-23 and 2007-05-23 ----------------------------- 2007-05-22 19:14:54 0 d-------- C:\Program Files\Advanced Batch Converter 2007-05-11 14:31:09 0 d-------- C:\Program Files\MP3 Player Utilities 4.00 2007-05-10 18:43:01 0 d-------- C:\Program Files\LEGO Company 2007-05-09 17:44:31 0 d-------- C:\Program Files\Tibia 2007-05-08 20:53:04 0 d-------- C:\Program Files\FLVPlayer – Find3M Report --------------------------------------------------------------- 2007-05-22 21:57:15 0 d-------- C:\Program Files\Winamp 2007-05-20 21:59:42 0 d-------- C:\Program Files\Gadu-Gadu 2007-05-19 08:50:43 0 d-------- C:\Documents and Settings\graland\Dane aplikacji\Winamp 2007-05-17 17:35:42 0 d-------- C:\Program Files\Messenger Plus! Live 2007-05-17 17:35:41 0 d-------- C:\Program Files\MSN Messenger 2007-05-10 18:43:15 0 d-------- C:\Documents and Settings\graland\Dane aplikacji\LEGO Company 2007-04-23 06:18:16 0 d-------- C:\Documents and Settings\graland\Dane aplikacji\The Bat! 2007-04-22 12:39:23 0 d-------- C:\Program Files\Mistrz Klawiatury II 2007-04-22 12:38:13 968 --a------ C:\WINDOWS\unins000.dat 2007-04-18 17:39:10 0 d-------- C:\Program Files\AidemMedia 2007-04-17 21:43:14 0 d-------- C:\Documents and Settings\graland\Dane aplikacji\Gadu-Gadu 2007-04-17 21:27:17 22237 --a----c- C:\WINDOWS\mozver.dat 2007-04-11 15:14:41 0 d-------- C:\Program Files\BearShare 2007-04-06 15:33:03 0 d-------- C:\Program Files\Deluxe Ski Jump 3 2007-03-28 21:01:24 0 d-------- C:\Program Files\Travian 2007-03-25 10:31:48 2560 --a----c- C:\WINDOWS_MSRSTRT.EXE 2007-03-24 14:35:54 0 d–h----- C:\Program Files\InstallShield Installation Information 2007-03-24 14:32:57 0 d-------- C:\Program Files\Maxthon 2007-03-24 07:31:44 0 d-------- C:\Program Files\SpeedSim 2007-03-10 08:37:08 12 --a------ C:\WINDOWS\CosmosClockPrefs 2007-03-10 08:35:15 219392 --a------ C:\WINDOWS\COSMOS~1.scr 2007-03-10 08:35:15 4467562 --a------ C:\WINDOWS\COSMOS~1.exe 2007-03-05 16:13:32 225280 --a------ C:\Program Files\Uninstall My Global Search Bar.dll 2007-02-23 08:29:58 524288 --a------ C:\WINDOWS\System32\DivXsm.exe 2007-02-23 08:29:56 3596288 --a------ C:\WINDOWS\System32\qt-dx331.dll 2007-02-23 08:29:49 200704 --a----c- C:\WINDOWS\System32\ssldivx.dll http://www.openssl.org/; The OpenSSL Toolkit> 2007-02-23 08:29:49 1044480 --a----c- C:\WINDOWS\System32\libdivx.dll http://www.openssl.org/; The OpenSSL Toolkit> 2007-02-23 08:25:24 196608 --a----c- C:\WINDOWS\System32\dtu100.dll 2007-02-23 08:25:24 73728 --a------ C:\WINDOWS\System32\dpl100.dll 2007-02-23 08:25:23 53248 --a----c- C:\WINDOWS\System32\dpuGUI10.dll 2007-02-23 08:25:22 57344 --a----c- C:\WINDOWS\System32\dpv11.dll 2007-02-23 08:25:22 344064 --a----c- C:\WINDOWS\System32\dpus11.dll 2007-02-23 08:25:22 593920 --a----c- C:\WINDOWS\System32\dpuGUI11.dll 2007-02-23 08:25:22 294912 --a----c- C:\WINDOWS\System32\dpu11.dll 2007-02-23 08:25:22 294912 --a----c- C:\WINDOWS\System32\dpu10.dll 2007-02-23 08:25:19 802816 --a------ C:\WINDOWS\System32\divx_xx11.dll 2007-02-23 08:25:19 823296 --a------ C:\WINDOWS\System32\divx_xx0c.dll 2007-02-23 08:25:19 823296 --a------ C:\WINDOWS\System32\divx_xx07.dll 2007-02-23 08:25:19 639066 --a------ C:\WINDOWS\System32\DivX.dll – Registry Dump --------------------------------------------------------------- [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects] {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll {53707962-6F74-2D53-2644-206D7942484F} C:\PROGRA~1\SPYBOT~1\SDHelper.dll {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll {9030D464-4C02-4ABF-8ECC-5164760863C6} C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run] “NvCplDaemon”=“RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup” “WinampAgent”=“C:\Program Files\Winamp\winampa.exe” [HKEY_USERS.default\software\microsoft\windows\currentversion\run] “CTFMON.EXE”=“C:\WINDOWS\System32\CTFMON.EXE” [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system] "NoDispBackgroundPage "=dword:00000000 “NoDispScrSavPage”=dword:00000000 “NoDispAppearancePage “=dword:00000000 “NoDispSettingsPage “=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer\run] “rundll32”=”\progra~1\intern~1\rundll32.exe” [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] “NoDeletePrinter”=dword:00000001 “NoAddPrinter”=dword:00000001 “NoSetFolders”=dword:00000001 “NoRun”=dword:00000001 “NoFind”=dword:00000001 “NoClose “=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks] “{EDB0E980-90BD-11D4-8599-0008C7D3B6F8}”=“Eudora’s Shell Extension” HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\taskmgr.exe debugger REG_SZ \windows\system32\calc.exe HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa Authentication Packages REG_MULTI_SZ msv1_0\0\0 Security Packages REG_MULTI_SZ kerberos\0msv1_0\0schannel\0wdigest\0\0 Notification Packages REG_MULTI_SZ scecli\0\0 HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\WebrootSpySweeperService [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Gadu-Gadu] “key”=“SOFTWARE\Microsoft\Windows\CurrentVersion\Run” “item”=“gg” “hkey”=“HKCU” “command”=”“C:\Program Files\Gadu-Gadu\gg.exe” /tray” “inimapping”=“0” [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper] “key”=“SOFTWARE\Microsoft\Windows\CurrentVersion\Run” “item”=“iTunesHelper” “hkey”=“HKLM” “command”=”“C:\Program Files\iTunes\iTunesHelper.exe”” “inimapping”=“0” [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KMWakeup] “key”=“SOFTWARE\Microsoft\Windows\CurrentVersion\Run” “item”=“kmwakeup” “hkey”=“HKCU” “command”=“C:\Program Files\KM Wakeup\kmwakeup.exe” “inimapping”=“0” [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Zinio DLM] “key”=“SOFTWARE\Microsoft\Windows\CurrentVersion\Run” “item”=“ZinioDeliveryManager” “hkey”=“HKCU” “command”=“C:\Program Files\Zinio\ZinioDeliveryManager.exe /autostart” “inimapping”=“0” [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Svchost] LocalService REG_MULTI_SZ Alerter\0WebClient\0LmHosts\0RemoteRegistry\0upnphost\0SSDPSRV\0\0 NetworkService REG_MULTI_SZ DnsCache\0\0 rpcss REG_MULTI_SZ RpcSs\0\0 imgsvc REG_MULTI_SZ StiSvc\0\0 termsvcs REG_MULTI_SZ TermService\0\0 – End of Deckard’s System Scanner: finished at 2007-05-23 at 18:16:02 ---------

Gutek · 23 Maj 2007 20:20

Dokończyć skanerami online - Skanery do wyboru

Dwid_816400701 · 24 Maj 2007 17:04

Póki co, to zostawię sprawę otwartą. Spod Linuxa pogram. Tylko, że trochę mi żal jednej rzeczy, ale cóż. Linux RULE