Komputer muli i spowolnił

bartek1602 · 11 Maj 2007 14:18

Wiatm tez mam ten problem i nie za bardzoe wiedzialem jak sie tego pozbyć wiec jesli sie da to prosze o pomoc;) i dodaje log`a HijackThis

Logfile of HijackThis v1.99.1 Scan saved at 16:08:30, on 2007-05-11 Platform: Windows XP Dodatek SP. 1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Ahead\InCD\InCDsrv.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\WINDOWS\System32\nvsvc32.exe C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe C:\WINDOWS\wault.exe C:\WINDOWS\tune.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\WINDOWS\System32\RUNDLL32.EXE C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe C:\Program Files\Ahead\InCD\InCD.exe C:\WINDOWS\SOUNDMAN.EXE C:\Program Files\Wapster\AQQ\AQQ.exe C:\Program Files\Songbird\xulrunner\xulrunner.exe C:\Program Files\Avant Browser\avant.exe C:\Program Files\WinRAR\WinRAR.exe C:\DOCUME~1\Bartek\USTAWI~1\Temp\Rar$EX00.485\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.bearshare.com/pl/ R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx O2 - BHO: My Global Search Bar BHO - {37B85A21-692B-4205-9CAD-2626E4993404} - C:\Program Files\MyGlobalSearch\bar\1.bin\MGSBAR.DLL O2 - BHO: Alcohol Toolbar Helper - {8126A4A5-BFD3-46FE-BBDF-BFB5CF78E489} - C:\Program Files\Alcohol Toolbar\v3.2.0.0\Alcohol_Toolbar.dll O3 - Toolbar: My Global Search Bar - {37B85A29-692B-4205-9CAD-2626E4993404} - C:\Program Files\MyGlobalSearch\bar\1.bin\MGSBAR.DLL O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O3 - Toolbar: Alcohol Toolbar - {ED4BD629-C1B6-4399-8A34-02CCAA921DC9} - C:\Program Files\Alcohol Toolbar\v3.2.0.0\Alcohol_Toolbar.dll O4 - HKLM…\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup O4 - HKLM…\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit O4 - HKLM…\Run: [RemoteControl] “C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe” O4 - HKLM…\Run: [inCD] C:\Program Files\Ahead\InCD\InCD.exe O4 - HKLM…\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM…\Run: [NVMixerTray] “C:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe” O4 - HKLM…\Run: [soundMan] SOUNDMAN.EXE O8 - Extra context menu item: Blokuj wszystkie obrazy z tego serwera - C:\Program Files\Avant Browser\AddAllToADBlackList.htm O8 - Extra context menu item: Dodaj do listy blokowanych reklam - C:\Program Files\Avant Browser\AddToADBlackList.htm O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O8 - Extra context menu item: Otwórz w nowym Avant Browser - C:\Program Files\Avant Browser\OpenInNewBrowser.htm O8 - Extra context menu item: Otwórz wszystkie adresy z tej strony… - C:\Program Files\Avant Browser\OpenAllLinks.htm O8 - Extra context menu item: Podświetl - C:\Program Files\Avant Browser\Highlight.htm O8 - Extra context menu item: Szukaj - C:\Program Files\Avant Browser\Search.htm O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm O9 - Extra ‘Tools’ menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll O16 - DPF: ING Bank Online - https://ssl.bsk.com.pl/bskonl/component/INGOnl.cab O16 - DPF: {17B3533D-F11D-48B4-9EBC-A7C7428A1D0D} (HTMLer Class) - http://www.unitedcontinent.com/fremaker/HTMLer.cab O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing) O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing) O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Ahead\InCD\InCDsrv.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe O23 - Service: Windows Auto Update Tool - Unknown owner - C:\WINDOWS\wault.exe O23 - Service: Windows Tune service - Unknown owner - C:\WINDOWS\tune.exe

Tutaj jest pelen log ehh moja wina PRZEPRASZAM bARDZO ;]

“Silent Runners.vbs”, revision R50, http://www.silentrunners.org/ Operating System: Windows XP Output limited to non-default values, except where indicated by “{++}” Startup items buried in registry: --------------------------------- HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ {++} “PowerBar” = “(empty string)” [file not found] HKLM\Software\Microsoft\Windows\CurrentVersion\Run\ {++} “NvCplDaemon” = “RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup” [MS] “NvMediaCenter” = “RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit” [MS] “RemoteControl” = ““C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe”” [“Cyberlink Corp.”] “InCD” = “C:\Program Files\Ahead\InCD\InCD.exe” [“Nero AG”] “NeroFilterCheck” = “C:\WINDOWS\system32\NeroCheck.exe” [“Ahead Software Gmbh”] “NVMixerTray” = ““C:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe”” [“NVIDIA Corporation”] “SoundMan” = “SOUNDMAN.EXE” [“Realtek Semiconductor Corp.”] HKLM\Software\Microsoft\Active Setup\Installed Components\ {306D6C21-C1B6-4629-986C-E59E1875B8AF}(Default) = (no title provided) \StubPath = ““C:\WINDOWS\System32\rundll32.exe” “C:\Program Files\Messenger\msgsc.dll”,ShowIconsUser” [MS] HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}(Default) = (no title provided) -> {HKLM…CLSID} = “AcroIEHlprObj Class” \InProcServer32(Default) = “C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx” [empty string] {37B85A21-692B-4205-9CAD-2626E4993404}(Default) = “My Global Search Bar BHO” -> {HKLM…CLSID} = “My Global Search Bar BHO” \InProcServer32(Default) = “C:\Program Files\MyGlobalSearch\bar\1.bin\MGSBAR.DLL” [“My Global Search”] {8126A4A5-BFD3-46FE-BBDF-BFB5CF78E489}(Default) = (no title provided) -> {HKLM…CLSID} = “Alcohol Toolbar Helper” \InProcServer32(Default) = “C:\Program Files\Alcohol Toolbar\v3.2.0.0\Alcohol_Toolbar.dll” [null data] HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\ “{42071714-76d4-11d1-8b24-00a0c9068ff3}” = “Rozszerzenie CPL kadrowania wyświetlania” -> {HKLM…CLSID} = “Rozszerzenie CPL kadrowania wyświetlania” \InProcServer32(Default) = “deskpan.dll” [file not found] “{88895560-9AA2-1069-930E-00AA0030EBC8}” = “Rozszerzenie ikony HyperTerminalu” -> {HKLM…CLSID} = “HyperTerminal Icon Ext” \InProcServer32(Default) = “C:\WINDOWS\System32\hticons.dll” [“Hilgraeve, Inc.”] “{A70C977A-BF00-412C-90B7-034C51DA2439}” = “NvCpl DesktopContext Class” -> {HKLM…CLSID} = “DesktopContext Class” \InProcServer32(Default) = “C:\WINDOWS\System32\nvcpl.dll” [“NVIDIA Corporation”] “{1CDB2949-8F65-4355-8456-263E7C208A5D}” = “Desktop Explorer” -> {HKLM…CLSID} = “Desktop Explorer” \InProcServer32(Default) = “C:\WINDOWS\System32\nvshell.dll” [“NVIDIA Corporation”] “{1E9B04FB-F9E5-4718-997B-B8DA88302A47}” = “Desktop Explorer Menu” -> {HKLM…CLSID} = (no title provided) \InProcServer32(Default) = “C:\WINDOWS\System32\nvshell.dll” [“NVIDIA Corporation”] “{1E9B04FB-F9E5-4718-997B-B8DA88302A48}” = “nView Desktop Context Menu” -> {HKLM…CLSID} = “nView Desktop Context Menu” \InProcServer32(Default) = “C:\WINDOWS\System32\nvshell.dll” [“NVIDIA Corporation”] “{950FF917-7A57-46BC-8017-59D9BF474000}” = “Shell Extension for CDRW” -> {HKLM…CLSID} = “Shell Extension for CDRW” \InProcServer32(Default) = “C:\Program Files\Ahead\InCD\incdshx.dll” [“Nero AG”] “{472083B0-C522-11CF-8763-00608CC02F24}” = “avast” -> {HKLM…CLSID} = “avast” \InProcServer32(Default) = “C:\Program Files\Alwil Software\Avast4\ashShell.dll” [“ALWIL Software”] “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” = “WinRAR shell extension” -> {HKLM…CLSID} = “WinRAR” \InProcServer32(Default) = “C:\Program Files\WinRAR\rarext.dll” [null data] “{00020D75-0000-0000-C000-000000000046}” = “Microsoft Office Outlook Desktop Icon Handler” -> {HKLM…CLSID} = “Microsoft Office Outlook” \InProcServer32(Default) = “C:\PROGRA~1\MICROS~2\OFFICE11\MLSHEXT.DLL” [MS] “{0006F045-0000-0000-C000-000000000046}” = “Microsoft Office Outlook Custom Icon Handler” -> {HKLM…CLSID} = “Rozszerzenie ikon plików programu Outlook” \InProcServer32(Default) = “C:\PROGRA~1\MICROS~2\OFFICE11\OLKFSTUB.DLL” [MS] “{42042206-2D85-11D3-8CFF-005004838597}” = “Microsoft Office HTML Icon Handler” -> {HKLM…CLSID} = (no title provided) \InProcServer32(Default) = “C:\Program Files\Microsoft Office\OFFICE11\msohev.dll” [MS] “{FFB699E0-306A-11d3-8BD1-00104B6F7516}” = “Play on my TV helper” -> {HKLM…CLSID} = “NVIDIA CPL Extension” \InProcServer32(Default) = “C:\WINDOWS\System32\nvcpl.dll” [“NVIDIA Corporation”] “{32020A01-506E-484D-A2A8-BE3CF17601C3}” = “AlcoholShellEx” -> {HKLM…CLSID} = “AlcoholShellEx” \InProcServer32(Default) = “C:\PROGRA~1\ALCOHO~1\ALCOHO~1\AxShlex.dll” [“Alcohol Soft Development Team”] “{453D1B6D-BD6A-4FA1-B876-9E4DD848D434}” = “AQQ File Transfer Shell Extension” -> {HKLM…CLSID} = “AQQ File Transfer Shell Extension” \InProcServer32(Default) = “C:\PROGRA~1\Wapster\AQQ\System\AQQSHE~1.DLL” [null data] HKLM\Software\Classes\PROTOCOLS\Filter\ <> text/xml\CLSID = “{807553E5-5146-11D5-A672-00B0D022E945}” -> {HKLM…CLSID} = (no title provided) \InProcServer32(Default) = “C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL” [MS] HKLM\Software\Classes*\shellex\ContextMenuHandlers\ AQQFileTransfer(Default) = “{453D1B6D-BD6A-4FA1-B876-9E4DD848D434}” -> {HKLM…CLSID} = “AQQ File Transfer Shell Extension” \InProcServer32(Default) = “C:\PROGRA~1\Wapster\AQQ\System\AQQSHE~1.DLL” [null data] avast(Default) = “{472083B0-C522-11CF-8763-00608CC02F24}” -> {HKLM…CLSID} = “avast” \InProcServer32(Default) = “C:\Program Files\Alwil Software\Avast4\ashShell.dll” [“ALWIL Software”] WinRAR(Default) = “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” -> {HKLM…CLSID} = “WinRAR” \InProcServer32(Default) = “C:\Program Files\WinRAR\rarext.dll” [null data] HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\ WinRAR(Default) = “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” -> {HKLM…CLSID} = “WinRAR” \InProcServer32(Default) = “C:\Program Files\WinRAR\rarext.dll” [null data] HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\ avast(Default) = “{472083B0-C522-11CF-8763-00608CC02F24}” -> {HKLM…CLSID} = “avast” \InProcServer32(Default) = “C:\Program Files\Alwil Software\Avast4\ashShell.dll” [“ALWIL Software”] WinRAR(Default) = “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” -> {HKLM…CLSID} = “WinRAR” \InProcServer32(Default) = “C:\Program Files\WinRAR\rarext.dll” [null data] Group Policies {GPedit.msc branch and setting}: ----------------------------------------------- Note: detected settings may not have any effect. HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\ “shutdownwithoutlogon” = (REG_DWORD) hex:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| Shutdown: Allow system to be shut down without having to log on} “undockwithoutlogon” = (REG_DWORD) hex:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| Devices: Allow undock without having to log on} Active Desktop and Wallpaper: ----------------------------- Active Desktop may be disabled at this entry: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState Displayed if Active Desktop enabled and wallpaper not set by Group Policy: HKCU\Software\Microsoft\Internet Explorer\Desktop\General\ “Wallpaper” = “C:\Documents and Settings\Bartek\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp” Displayed if Active Desktop disabled and wallpaper not set by Group Policy: HKCU\Control Panel\Desktop\ “Wallpaper” = “C:\Documents and Settings\Bartek\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp” Enabled Screen Saver: --------------------- HKCU\Control Panel\Desktop\ “SCRNSAVE.EXE” = “C:\WINDOWS\System32\logon.scr” [MS] Winsock2 Service Provider DLLs: ------------------------------- Namespace Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++} 000000000001\LibraryPath = “%SystemRoot%\System32\mswsock.dll” [MS] 000000000002\LibraryPath = “%SystemRoot%\System32\winrnr.dll” [MS] 000000000003\LibraryPath = “%SystemRoot%\System32\mswsock.dll” [MS] Transport Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++} 0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range: %SystemRoot%\system32\mswsock.dll [MS], 01 - 03, 06 - 13 %SystemRoot%\system32\rsvpsp.dll [MS], 04 - 05 Toolbars, Explorer Bars, Extensions: ------------------------------------ Toolbars HKCU\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ “{37B85A29-692B-4205-9CAD-2626E4993404}” -> {HKLM…CLSID} = “My Global Search Bar” \InProcServer32(Default) = “C:\Program Files\MyGlobalSearch\bar\1.bin\MGSBAR.DLL” [“My Global Search”] HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\ “{37B85A29-692B-4205-9CAD-2626E4993404}” -> {HKLM…CLSID} = “My Global Search Bar” \InProcServer32(Default) = “C:\Program Files\MyGlobalSearch\bar\1.bin\MGSBAR.DLL” [“My Global Search”] HKLM\Software\Microsoft\Internet Explorer\Toolbar\ “{37B85A29-692B-4205-9CAD-2626E4993404}” = (no title provided) -> {HKLM…CLSID} = “My Global Search Bar” \InProcServer32(Default) = “C:\Program Files\MyGlobalSearch\bar\1.bin\MGSBAR.DLL” [“My Global Search”] “{ED4BD629-C1B6-4399-8A34-02CCAA921DC9}” = “Alcohol Toolbar” -> {HKLM…CLSID} = “Alcohol Toolbar” \InProcServer32(Default) = “C:\Program Files\Alcohol Toolbar\v3.2.0.0\Alcohol_Toolbar.dll” [null data] Explorer Bars HKLM\Software\Microsoft\Internet Explorer\Explorer Bars\ HKLM\Software\Classes\CLSID{FF059E31-CC5A-4E2E-BF3B-96E929D65503}(Default) = “&Badanie” Implemented Categories{00021493-0000-0000-C000-000000000046}\ [vertical bar] InProcServer32(Default) = “C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL” [MS] Extensions (Tools menu items, main toolbar menu buttons) HKLM\Software\Microsoft\Internet Explorer\Extensions\ {92780B25-18CC-41C8-B9BE-3C9C571A8263}\ “ButtonText” = “Badanie” Running Services (Display Name, Service Name, Path {Service DLL}): ------------------------------------------------------------------ avast! Antivirus, avast! Antivirus, ““C:\Program Files\Alwil Software\Avast4\ashServ.exe”” [“ALWIL Software”] avast! iAVS4 Control Service, aswUpdSv, ““C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe”” [“ALWIL Software”] avast! Mail Scanner, avast! Mail Scanner, ““C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe” /service” [“ALWIL Software”] avast! Web Scanner, avast! Web Scanner, ““C:\Program Files\Alwil Software\Avast4\ashWebSv.exe” /service” [“ALWIL Software”] InCD Helper, InCDsrv, “C:\Program Files\Ahead\InCD\InCDsrv.exe” [“Nero AG”] Machine Debug Manager, MDM, ““C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE”” [MS] NVIDIA Display Driver Service, NVSvc, “C:\WINDOWS\System32\nvsvc32.exe” [“NVIDIA Corporation”] StarWind iSCSI Service, StarWindService, “C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe” [“Rocket Division Software”] Windows Auto Update Tool, Windows Auto Update Tool, ““C:\WINDOWS\wault.exe”” [null data] Windows Tune service, Windows Tune service, ““C:\WINDOWS\tune.exe”” [null data] Print Monitors: --------------- HKLM\System\CurrentControlSet\Control\Print\Monitors\ Microsoft Document Imaging Writer Monitor\Driver = “mdimon.dll” [MS] ---------- <>: Suspicious data at a malware launch point. + This report excludes default entries except where indicated. + To see *everywhere* the script checks and *everything* it finds, launch it from a command prompt or a shortcut with the -all parameter. + The search for DESKTOP.INI DLL launch points on all local fixed drives took 30 seconds. ---------- (total run time: 171 seconds)

Pozdrawiam

Uwaga: Jak wklejasz loga to obejmuj go znacznikiem (tagiem) CODE lub QUOTE

Pozdrawiam Gutek2222

Gutek · 11 Maj 2007 14:51

Start >>> Uruchom >>> services.msc >>> zatrzymaj i wyłącz Windows Auto Update Tool i Windows Tune service , w trybie awaryjnym usuń wpisy HJT a pliki i folder ręcznie

bartek1602 · 12 Maj 2007 07:49

Hmm “Windows Auto Update Tool” i “Windows Tune service” zostaly wyłączone ale problem był nadal… a jeśli chodzi o owe pliki :

…to ten zielony usunełem a pozostałych dwóch nie umiałem znaleść…;/ nie jestem jakims pionierem hehe ale mam zamiar sie tego pozbyć…bez formata… ;p aha i dzieki za pomoc

Pozdrawiam!!

adam9870 · 12 Maj 2007 13:17

Proszę wkleić komplet nowych logów, być może plików nie ma na dysku, a jedynie usługi do nich się odwołujące.

bartek1602 · 12 Maj 2007 21:24

Witam znow tutaj sa logi o ktore prosiles nie ma juz tego wirusa … ale jest to powiadomienie ze za iles tam sek, wylaczy sie komputer, co jakis czas to wyskakuje, tam chodzi o przerwnie pracy pliku wault.exe…

Logfile of HijackThis v1.99.1 Scan saved at 23:10:02, on 2007-05-12 Platform: Windows XP Dodatek SP. 1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Ahead\InCD\InCDsrv.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\System32\RUNDLL32.EXE C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe C:\Program Files\Ahead\InCD\InCD.exe C:\WINDOWS\SOUNDMAN.EXE C:\Program Files\D-Tools\daemon.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\WINDOWS\System32\nvsvc32.exe C:\WINDOWS\services.exe C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe E:\gg\Gadu-Gadu\gg.exe C:\Program Files\Avant Browser\avant.exe C:\DOCUME~1\Bartek\USTAWI~1\Temp\Rar$EX00.406\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.bearshare.com/pl/ R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx O2 - BHO: My Global Search Bar BHO - {37B85A21-692B-4205-9CAD-2626E4993404} - C:\Program Files\MyGlobalSearch\bar\1.bin\MGSBAR.DLL (file missing) O2 - BHO: Alcohol Toolbar Helper - {8126A4A5-BFD3-46FE-BBDF-BFB5CF78E489} - C:\Program Files\Alcohol Toolbar\v3.2.0.0\Alcohol_Toolbar.dll O3 - Toolbar: My Global Search Bar - {37B85A29-692B-4205-9CAD-2626E4993404} - C:\Program Files\MyGlobalSearch\bar\1.bin\MGSBAR.DLL (file missing) O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O3 - Toolbar: Alcohol Toolbar - {ED4BD629-C1B6-4399-8A34-02CCAA921DC9} - C:\Program Files\Alcohol Toolbar\v3.2.0.0\Alcohol_Toolbar.dll O4 - HKLM…\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup O4 - HKLM…\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit O4 - HKLM…\Run: [RemoteControl] “C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe” O4 - HKLM…\Run: [inCD] C:\Program Files\Ahead\InCD\InCD.exe O4 - HKLM…\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM…\Run: [NVMixerTray] “C:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe” O4 - HKLM…\Run: [soundMan] SOUNDMAN.EXE O4 - HKLM…\Run: [DAEMON Tools-1033] “C:\Program Files\D-Tools\daemon.exe” -lang 1033 O4 - HKCU…\Run: [MSMSGS] “C:\Program Files\Messenger\msmsgs.exe” /background O4 - HKCU…\Run: [AQQ] C:\PROGRA~1\Wapster\AQQ\AQQ.exe O8 - Extra context menu item: Blokuj wszystkie obrazy z tego serwera - C:\Program Files\Avant Browser\AddAllToADBlackList.htm O8 - Extra context menu item: Dodaj do listy blokowanych reklam - C:\Program Files\Avant Browser\AddToADBlackList.htm O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O8 - Extra context menu item: Otwórz w nowym Avant Browser - C:\Program Files\Avant Browser\OpenInNewBrowser.htm O8 - Extra context menu item: Otwórz wszystkie adresy z tej strony… - C:\Program Files\Avant Browser\OpenAllLinks.htm O8 - Extra context menu item: Podświetl - C:\Program Files\Avant Browser\Highlight.htm O8 - Extra context menu item: Szukaj - C:\Program Files\Avant Browser\Search.htm O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm O9 - Extra ‘Tools’ menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll O16 - DPF: ING Bank Online - https://ssl.bsk.com.pl/bskonl/component/INGOnl.cab O16 - DPF: {17B3533D-F11D-48B4-9EBC-A7C7428A1D0D} (HTMLer Class) - http://www.unitedcontinent.com/fremaker/HTMLer.cab O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing) O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing) O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Ahead\InCD\InCDsrv.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe O23 - Service: Service Controller (Services) - Unknown owner - C:\WINDOWS\services.exe O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe

“Silent Runners.vbs”, revision R50, http://www.silentrunners.org/ Operating System: Windows XP Output limited to non-default values, except where indicated by “{++}” Startup items buried in registry: --------------------------------- HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ {++} “PowerBar” = “(empty string)” [file not found] “MSMSGS” = ““C:\Program Files\Messenger\msmsgs.exe” /background” [MS] “AQQ” = “C:\PROGRA~1\Wapster\AQQ\AQQ.exe” [“AQQ Sp. z o.o.”] HKLM\Software\Microsoft\Windows\CurrentVersion\Run\ {++} “NvCplDaemon” = “RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup” [MS] “NvMediaCenter” = “RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit” [MS] “RemoteControl” = ““C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe”” [“Cyberlink Corp.”] “InCD” = “C:\Program Files\Ahead\InCD\InCD.exe” [“Nero AG”] “NeroFilterCheck” = “C:\WINDOWS\system32\NeroCheck.exe” [“Ahead Software Gmbh”] “NVMixerTray” = ““C:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe”” [“NVIDIA Corporation”] “SoundMan” = “SOUNDMAN.EXE” [“Realtek Semiconductor Corp.”] “DAEMON Tools-1033” = ““C:\Program Files\D-Tools\daemon.exe” -lang 1033” [“DAEMON’S HOME”] HKLM\Software\Microsoft\Active Setup\Installed Components\ {306D6C21-C1B6-4629-986C-E59E1875B8AF}(Default) = (no title provided) \StubPath = ““C:\WINDOWS\System32\rundll32.exe” “C:\Program Files\Messenger\msgsc.dll”,ShowIconsUser” [MS] HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}(Default) = (no title provided) -> {HKLM…CLSID} = “AcroIEHlprObj Class” \InProcServer32(Default) = “C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx” [empty string] {37B85A21-692B-4205-9CAD-2626E4993404}(Default) = “My Global Search Bar BHO” -> {HKLM…CLSID} = “My Global Search Bar BHO” \InProcServer32(Default) = “C:\Program Files\MyGlobalSearch\bar\1.bin\MGSBAR.DLL” [file not found] {8126A4A5-BFD3-46FE-BBDF-BFB5CF78E489}(Default) = (no title provided) -> {HKLM…CLSID} = “Alcohol Toolbar Helper” \InProcServer32(Default) = “C:\Program Files\Alcohol Toolbar\v3.2.0.0\Alcohol_Toolbar.dll” [null data] HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\ “{42071714-76d4-11d1-8b24-00a0c9068ff3}” = “Rozszerzenie CPL kadrowania wyświetlania” -> {HKLM…CLSID} = “Rozszerzenie CPL kadrowania wyświetlania” \InProcServer32(Default) = “deskpan.dll” [file not found] “{88895560-9AA2-1069-930E-00AA0030EBC8}” = “Rozszerzenie ikony HyperTerminalu” -> {HKLM…CLSID} = “HyperTerminal Icon Ext” \InProcServer32(Default) = “C:\WINDOWS\System32\hticons.dll” [“Hilgraeve, Inc.”] “{A70C977A-BF00-412C-90B7-034C51DA2439}” = “NvCpl DesktopContext Class” -> {HKLM…CLSID} = “DesktopContext Class” \InProcServer32(Default) = “C:\WINDOWS\System32\nvcpl.dll” [“NVIDIA Corporation”] “{1CDB2949-8F65-4355-8456-263E7C208A5D}” = “Desktop Explorer” -> {HKLM…CLSID} = “Desktop Explorer” \InProcServer32(Default) = “C:\WINDOWS\System32\nvshell.dll” [“NVIDIA Corporation”] “{1E9B04FB-F9E5-4718-997B-B8DA88302A47}” = “Desktop Explorer Menu” -> {HKLM…CLSID} = (no title provided) \InProcServer32(Default) = “C:\WINDOWS\System32\nvshell.dll” [“NVIDIA Corporation”] “{1E9B04FB-F9E5-4718-997B-B8DA88302A48}” = “nView Desktop Context Menu” -> {HKLM…CLSID} = “nView Desktop Context Menu” \InProcServer32(Default) = “C:\WINDOWS\System32\nvshell.dll” [“NVIDIA Corporation”] “{950FF917-7A57-46BC-8017-59D9BF474000}” = “Shell Extension for CDRW” -> {HKLM…CLSID} = “Shell Extension for CDRW” \InProcServer32(Default) = “C:\Program Files\Ahead\InCD\incdshx.dll” [“Nero AG”] “{472083B0-C522-11CF-8763-00608CC02F24}” = “avast” -> {HKLM…CLSID} = “avast” \InProcServer32(Default) = “C:\Program Files\Alwil Software\Avast4\ashShell.dll” [“ALWIL Software”] “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” = “WinRAR shell extension” -> {HKLM…CLSID} = “WinRAR” \InProcServer32(Default) = “C:\Program Files\WinRAR\rarext.dll” [null data] “{00020D75-0000-0000-C000-000000000046}” = “Microsoft Office Outlook Desktop Icon Handler” -> {HKLM…CLSID} = “Microsoft Office Outlook” \InProcServer32(Default) = “C:\PROGRA~1\MICROS~2\OFFICE11\MLSHEXT.DLL” [MS] “{0006F045-0000-0000-C000-000000000046}” = “Microsoft Office Outlook Custom Icon Handler” -> {HKLM…CLSID} = “Rozszerzenie ikon plików programu Outlook” \InProcServer32(Default) = “C:\PROGRA~1\MICROS~2\OFFICE11\OLKFSTUB.DLL” [MS] “{42042206-2D85-11D3-8CFF-005004838597}” = “Microsoft Office HTML Icon Handler” -> {HKLM…CLSID} = (no title provided) \InProcServer32(Default) = “C:\Program Files\Microsoft Office\OFFICE11\msohev.dll” [MS] “{FFB699E0-306A-11d3-8BD1-00104B6F7516}” = “Play on my TV helper” -> {HKLM…CLSID} = “NVIDIA CPL Extension” \InProcServer32(Default) = “C:\WINDOWS\System32\nvcpl.dll” [“NVIDIA Corporation”] “{32020A01-506E-484D-A2A8-BE3CF17601C3}” = “AlcoholShellEx” -> {HKLM…CLSID} = “AlcoholShellEx” \InProcServer32(Default) = “C:\PROGRA~1\ALCOHO~1\ALCOHO~1\AxShlex.dll” [“Alcohol Soft Development Team”] “{453D1B6D-BD6A-4FA1-B876-9E4DD848D434}” = “AQQ File Transfer Shell Extension” -> {HKLM…CLSID} = “AQQ File Transfer Shell Extension” \InProcServer32(Default) = “C:\PROGRA~1\Wapster\AQQ\System\AQQSHE~1.DLL” [null data] HKLM\Software\Classes\PROTOCOLS\Filter\ <> text/xml\CLSID = “{807553E5-5146-11D5-A672-00B0D022E945}” -> {HKLM…CLSID} = (no title provided) \InProcServer32(Default) = “C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL” [MS] HKLM\Software\Classes*\shellex\ContextMenuHandlers\ AQQFileTransfer(Default) = “{453D1B6D-BD6A-4FA1-B876-9E4DD848D434}” -> {HKLM…CLSID} = “AQQ File Transfer Shell Extension” \InProcServer32(Default) = “C:\PROGRA~1\Wapster\AQQ\System\AQQSHE~1.DLL” [null data] avast(Default) = “{472083B0-C522-11CF-8763-00608CC02F24}” -> {HKLM…CLSID} = “avast” \InProcServer32(Default) = “C:\Program Files\Alwil Software\Avast4\ashShell.dll” [“ALWIL Software”] WinRAR(Default) = “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” -> {HKLM…CLSID} = “WinRAR” \InProcServer32(Default) = “C:\Program Files\WinRAR\rarext.dll” [null data] HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\ WinRAR(Default) = “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” -> {HKLM…CLSID} = “WinRAR” \InProcServer32(Default) = “C:\Program Files\WinRAR\rarext.dll” [null data] HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\ avast(Default) = “{472083B0-C522-11CF-8763-00608CC02F24}” -> {HKLM…CLSID} = “avast” \InProcServer32(Default) = “C:\Program Files\Alwil Software\Avast4\ashShell.dll” [“ALWIL Software”] WinRAR(Default) = “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” -> {HKLM…CLSID} = “WinRAR” \InProcServer32(Default) = “C:\Program Files\WinRAR\rarext.dll” [null data] Group Policies {GPedit.msc branch and setting}: ----------------------------------------------- Note: detected settings may not have any effect. HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\ “shutdownwithoutlogon” = (REG_DWORD) hex:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| Shutdown: Allow system to be shut down without having to log on} “undockwithoutlogon” = (REG_DWORD) hex:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| Devices: Allow undock without having to log on} Active Desktop and Wallpaper: ----------------------------- Active Desktop may be disabled at this entry: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState Displayed if Active Desktop enabled and wallpaper not set by Group Policy: HKCU\Software\Microsoft\Internet Explorer\Desktop\General\ “Wallpaper” = “C:\Documents and Settings\Bartek\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp” Displayed if Active Desktop disabled and wallpaper not set by Group Policy: HKCU\Control Panel\Desktop\ “Wallpaper” = “C:\Documents and Settings\Bartek\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp” Enabled Screen Saver: --------------------- HKCU\Control Panel\Desktop\ “SCRNSAVE.EXE” = “C:\WINDOWS\System32\logon.scr” [MS] Winsock2 Service Provider DLLs: ------------------------------- Namespace Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++} 000000000001\LibraryPath = “%SystemRoot%\System32\mswsock.dll” [MS] 000000000002\LibraryPath = “%SystemRoot%\System32\winrnr.dll” [MS] 000000000003\LibraryPath = “%SystemRoot%\System32\mswsock.dll” [MS] Transport Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++} 0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range: %SystemRoot%\system32\mswsock.dll [MS], 01 - 03, 06 - 13 %SystemRoot%\system32\rsvpsp.dll [MS], 04 - 05 Toolbars, Explorer Bars, Extensions: ------------------------------------ Toolbars HKCU\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ “{37B85A29-692B-4205-9CAD-2626E4993404}” -> {HKLM…CLSID} = “My Global Search Bar” \InProcServer32(Default) = “C:\Program Files\MyGlobalSearch\bar\1.bin\MGSBAR.DLL” [file not found] HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\ “{37B85A29-692B-4205-9CAD-2626E4993404}” -> {HKLM…CLSID} = “My Global Search Bar” \InProcServer32(Default) = “C:\Program Files\MyGlobalSearch\bar\1.bin\MGSBAR.DLL” [file not found] “{ED4BD629-C1B6-4399-8A34-02CCAA921DC9}” -> {HKLM…CLSID} = “Alcohol Toolbar” \InProcServer32(Default) = “C:\Program Files\Alcohol Toolbar\v3.2.0.0\Alcohol_Toolbar.dll” [null data] HKLM\Software\Microsoft\Internet Explorer\Toolbar\ “{37B85A29-692B-4205-9CAD-2626E4993404}” = (no title provided) -> {HKLM…CLSID} = “My Global Search Bar” \InProcServer32(Default) = “C:\Program Files\MyGlobalSearch\bar\1.bin\MGSBAR.DLL” [file not found] “{ED4BD629-C1B6-4399-8A34-02CCAA921DC9}” = “Alcohol Toolbar” -> {HKLM…CLSID} = “Alcohol Toolbar” \InProcServer32(Default) = “C:\Program Files\Alcohol Toolbar\v3.2.0.0\Alcohol_Toolbar.dll” [null data] Explorer Bars HKLM\Software\Microsoft\Internet Explorer\Explorer Bars\ HKLM\Software\Classes\CLSID{FF059E31-CC5A-4E2E-BF3B-96E929D65503}(Default) = “&Badanie” Implemented Categories{00021493-0000-0000-C000-000000000046}\ [vertical bar] InProcServer32(Default) = “C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL” [MS] Extensions (Tools menu items, main toolbar menu buttons) HKLM\Software\Microsoft\Internet Explorer\Extensions\ {92780B25-18CC-41C8-B9BE-3C9C571A8263}\ “ButtonText” = “Badanie” Running Services (Display Name, Service Name, Path {Service DLL}): ------------------------------------------------------------------ avast! Antivirus, avast! Antivirus, ““C:\Program Files\Alwil Software\Avast4\ashServ.exe”” [“ALWIL Software”] avast! iAVS4 Control Service, aswUpdSv, ““C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe”” [“ALWIL Software”] avast! Mail Scanner, avast! Mail Scanner, ““C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe” /service” [“ALWIL Software”] avast! Web Scanner, avast! Web Scanner, ““C:\Program Files\Alwil Software\Avast4\ashWebSv.exe” /service” [“ALWIL Software”] InCD Helper, InCDsrv, “C:\Program Files\Ahead\InCD\InCDsrv.exe” [“Nero AG”] Machine Debug Manager, MDM, ““C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE”” [MS] NVIDIA Display Driver Service, NVSvc, “C:\WINDOWS\System32\nvsvc32.exe” [“NVIDIA Corporation”] Service Controller, Services, ““C:\WINDOWS\services.exe”” [null data] StarWind iSCSI Service, StarWindService, “C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe” [“Rocket Division Software”] Print Monitors: --------------- HKLM\System\CurrentControlSet\Control\Print\Monitors\ Microsoft Document Imaging Writer Monitor\Driver = “mdimon.dll” [MS] ---------- <>: Suspicious data at a malware launch point. + This report excludes default entries except where indicated. + To see *everywhere* the script checks and *everything* it finds, launch it from a command prompt or a shortcut with the -all parameter. + To search all directories of local fixed drives for DESKTOP.INI DLL launch points, use the -supp parameter or answer “No” at the first message box and “Yes” at the second message box. ---------- (total run time: 74 seconds, including 24 seconds for message boxes)

Pozdrawiam i dzieki za pomoc

Gutek · 12 Maj 2007 21:39

Pobierz The Avenger. Wypakuj => uruchom => zaznacz opcję Input script manually => kliknij w taką lupkę => w okienku, które się otworzy wklej:

Drivers to unload: Service Controller Files to delete: C:\WINDOWS\services.exe Folders to delete: C:\Program Files\MyGlobalSearch Registry keys to delete: HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects{37B85A21-692B-4205-9CAD-2626E4993404} HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects{8126A4A5-BFD3-46FE-BBDF-BFB5CF78E489} Registry values to delete: “HKCU\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser” | “{37B85A29-692B-4205-9CAD-2626E4993404}” “HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser” | “{37B85A29-692B-4205-9CAD-2626E4993404}” “HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser” |"{ED4BD629-C1B6-4399-8A34-02CCAA921DC9}" “HKLM\Software\Microsoft\Internet Explorer\Toolbar” | “{37B85A29-692B-4205-9CAD-2626E4993404}” “HKLM\Software\Microsoft\Internet Explorer\Toolbar” | “{ED4BD629-C1B6-4399-8A34-02CCAA921DC9}”

kliknij klawisz Done => teraz kliknij na zielone światełko => powinna pojawić się pewna informacja i kliknij OK (teraz restart).

bartek1602 · 15 Maj 2007 18:34

Dobra i wygenerowal sie log i tyle ?? tak ??

Pozdrawiam

Gutek · 15 Maj 2007 19:49

Logi kontrolnie co zostało

bartek1602 · 15 Maj 2007 20:02

Takie cosik ale ten blad dalej jest i …znow wyskakuje to hamstwo… a wczesniej bylo ale nie dawalo az tak czesto o sobie znac hehe tu masz tego loga /…

////////////////////////////////////////// Avenger Pre-Processor log ////////////////////////////////////////// Syntax error in line — does not appear to be a valid registry path. Line will be ignored. Error code: 1813 Line: HKCU\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser" | “{37B85A29-692B-4205-9CAD-2626E4993404} Syntax error in line — does not appear to be a valid registry path. Line will be ignored. Error code: 1813 Line: HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser” | “{37B85A29-692B-4205-9CAD-2626E4993404} Syntax error in line — does not appear to be a valid registry path. Line will be ignored. Error code: 1813 Line: HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser” |"{ED4BD629-C1B6-4399-8A34-02CCAA921DC9} ////////////////////////////////////////// Logfile of The Avenger version 1, by Swandog46 Running from registry key: \Registry\Machine\System\CurrentControlSet\Services\veoraijs ******************* Script file located at: ??\C:\WINDOWS\System32\bvcrtbre.txt Script file opened successfully. Script file read successfully Backups directory opened successfully at C:\Avenger ******************* Beginning to process script file: Registry key \Registry\Machine\System\CurrentControlSet\Services\Service Controller not found! Unload of driver Service Controller failed! Could not process line: Service Controller Status: 0xc0000034 File C:\WINDOWS\services.exe deleted successfully. Folder C:\Program Files\MyGlobalSearch not found! Deletion of folder C:\Program Files\MyGlobalSearch failed! Could not process line: C:\Program Files\MyGlobalSearch Status: 0xc0000034 Registry key HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects{37B85A21-692B-4205-9CAD-2626E4993404} deleted successfully. Registry key HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects{8126A4A5-BFD3-46FE-BBDF-BFB5CF78E489} deleted successfully. Registry value HKLM\Software\Microsoft\Internet Explorer\Toolbar|{37B85A29-692B-4205-9CAD-2626E4993404} deleted successfully. Registry value HKLM\Software\Microsoft\Internet Explorer\Toolbar|{ED4BD629-C1B6-4399-8A34-02CCAA921DC9} deleted successfully. Completed script processing. ******************* Finished! Terminate.

Gutek · 15 Maj 2007 20:52

Daj log z Combofixa

bartek1602 · 16 Maj 2007 15:08

Prosze oto log z Combofixa

“Bartek” - 2007-05-16 17:01:32 Dodatek Service Pack. 1 ComboFix 07-05.13.2.V - Running from: “C:\Documents and Settings\Bartek\Pulpit\Bartek” ((((((((((((((((((((((((((((((( Files Created from 2007-04-05 to 2007-05-16 )))))))))))))))))))))))))))))))))) 2007-05-16 16:25 1,306,112 --a------ C:\WINDOWS\system32\ctf.exe 2007-05-15 21:49 1,236,992 --a------ C:\WINDOWS\system32\ptr.exe 2007-05-15 21:26 638,976 --a------ C:\WINDOWS\system32\rwo.exe 2007-05-15 21:24 933,888 --a------ C:\WINDOWS\system32\nes.exe 2007-05-15 21:10 69,632 --a------ C:\WINDOWS\system32\osg.exe 2007-05-15 21:03 98,304 --a------ C:\WINDOWS\system32\igc.exe 2007-05-15 20:55 1,306,112 --a------ C:\WINDOWS\system32\sgq.exe 2007-05-15 20:17 2007-05-15 19:49 1,306,112 --a------ C:\WINDOWS\system32\nci.exe 2007-05-15 19:12 2007-05-15 19:07 4,992 --a------ C:\WINDOWS\system32\drivers\MSTEE.sys 2007-05-15 19:05 114,968 --a------ C:\WINDOWS\system32\wuauclt.exe 2007-05-15 19:05 1,081,112 --a------ C:\WINDOWS\system32\wuaueng.dll 2007-05-15 19:03 4,096 --a------ C:\WINDOWS\system32\ksuser.dll 2007-05-15 19:01 24,661 --a------ C:\WINDOWS\system32\spxcoins.dll 2007-05-15 19:01 13,312 --a------ C:\WINDOWS\system32\irclass.dll 2007-05-15 17:07 6,272 -ra------ C:\WINDOWS\system32\drivers\V0220Vfx.sys 2007-05-15 17:07 36,864 -ra------ C:\WINDOWS\system32\V0220Pin.dll 2007-05-15 17:07 36,864 -ra------ C:\WINDOWS\system32\CtCamMgr.dll 2007-05-15 17:07 32,768 -ra------ C:\WINDOWS\V0220Mon.exe 2007-05-15 17:07 32,768 -ra------ C:\WINDOWS\system32\V0220Hwx.dll 2007-05-15 17:07 3,094 -ra------ C:\WINDOWS\system32\drivers\V0220STB.SYS 2007-05-15 17:07 245,760 -ra------ C:\WINDOWS\system32\V0220Cvw.dll 2007-05-15 17:07 20,480 -ra------ C:\WINDOWS\V0220Cfg.exe 2007-05-15 17:07 146,112 -ra------ C:\WINDOWS\system32\drivers\V0220Dev.sys 2007-05-15 17:07 126,976 -ra------ C:\WINDOWS\system32\V0220Vfw.dll 2007-05-15 17:01 2007-05-15 17:00 1,060,864 --a------ C:\WINDOWS\system32\MFC71.DLL 2007-05-15 16:59 2007-05-13 18:51 2007-05-13 18:51 2007-05-13 18:47 2007-05-13 12:01 2007-05-13 11:28 2007-05-13 11:23 41,984 --a------ C:\WINDOWS\Ctregrun.exe 2007-05-13 11:14 86,016 -ra------ C:\WINDOWS\CtDrvIns.exe 2007-05-13 11:14 50,688 --a------ C:\WINDOWS\system32\vfwwdm32.dll 2007-05-13 11:14 20,480 -ra------ C:\WINDOWS\system32\V0220Srv.exe 2007-05-12 22:38 176,128 --a------ C:\WINDOWS\system32\ybw.exe 2007-05-12 22:26 1,306,112 --a------ C:\WINDOWS\system32\gpz.exe 2007-05-12 21:57 146,944 --a------ C:\WINDOWS\system32\vzk.exe 2007-05-12 21:22 1,306,112 --a------ C:\WINDOWS\system32\udx.exe 2007-05-12 19:20 1,306,112 --a------ C:\WINDOWS\system32\sac.exe 2007-05-12 16:09 1,306,112 --a------ C:\WINDOWS\system32\trk.exe 2007-05-12 13:02 176,128 --a------ C:\WINDOWS\system32\yql.exe 2007-05-12 12:31 90,112 --a------ C:\WINDOWS\system32\bwg.exe 2007-05-12 12:27 153,600 --a------ C:\WINDOWS\system32\zaj.exe 2007-05-12 10:08 634,880 --a------ C:\WINDOWS\system32\xup.exe 2007-05-12 10:08 146,944 --a------ C:\WINDOWS\system32\■■■.exe 2007-05-12 09:59 5,248 --a------ C:\WINDOWS\system32\drivers\d347prt.sys 2007-05-12 09:59 155,136 --a------ C:\WINDOWS\system32\drivers\d347bus.sys 2007-05-12 09:59 2007-05-12 09:10 212,992 --a------ C:\WINDOWS\system32\lrm.exe 2007-05-12 09:08 393,216 --a------ C:\WINDOWS\system32\ogl.exe 2007-05-12 07:44 2007-05-11 17:15 1,236,992 --a------ C:\WINDOWS\system32\ttj.exe 2007-05-11 16:43 1,306,112 --a------ C:\WINDOWS\system32\nzm.exe 2007-05-11 15:52 1,306,112 --a------ C:\WINDOWS\system32\okh.exe 2007-05-10 22:24 1,236,992 --a------ C:\WINDOWS\system32\jqh.exe 2007-05-10 22:22 1,236,992 --a------ C:\WINDOWS\system32\zhx.exe 2007-05-10 20:19 545 --a------ C:\WINDOWS\UC.PIF 2007-05-10 20:19 545 --a------ C:\WINDOWS\RAR.PIF 2007-05-10 20:19 545 --a------ C:\WINDOWS\PKZIP.PIF 2007-05-10 20:19 545 --a------ C:\WINDOWS\PKUNZIP.PIF 2007-05-10 20:19 545 --a------ C:\WINDOWS\NOCLOSE.PIF 2007-05-10 20:19 545 --a------ C:\WINDOWS\LHA.PIF 2007-05-10 20:19 545 --a------ C:\WINDOWS\ARJ.PIF 2007-05-10 20:19 2007-05-10 19:42 307,200 --a------ C:\WINDOWS\system32\kya.exe 2007-05-10 12:53 1,236,992 --a------ C:\WINDOWS\system32\jdp.exe 2007-05-10 12:49 1,236,992 --a------ C:\WINDOWS\system32\glc.exe 2007-05-10 08:45 5,120 --a------ C:\WINDOWS\system32\ff_vfw.dll 2007-05-10 08:45 2007-05-10 08:10 1,236,992 --a------ C:\WINDOWS\system32\ghb.exe 2007-05-10 08:03 577,536 --a------ C:\WINDOWS\soundman.exe 2007-05-10 08:03 49,152 --a------ C:\WINDOWS\system32\ChCfg.exe 2007-05-10 08:03 4,017,536 -ra------ C:\WINDOWS\system32\drivers\alcxwdm.sys 2007-05-10 08:02 217,088 --a------ C:\WINDOWS\Alcrmv.exe 2007-05-10 08:02 143,360 --a------ C:\WINDOWS\system32\RtlCPAPI.dll 2007-05-10 08:02 10,528,768 --a------ C:\WINDOWS\system32\RTLCPL.exe 2007-05-10 08:02 2007-05-10 07:45 0 --a------ C:\WINDOWS\system32\ozu.exe 2007-05-10 07:45 0 --a------ C:\WINDOWS\system32\hsh.exe 2007-05-09 20:56 1,306,112 --a------ C:\WINDOWS\system32\vzy.exe 2007-05-09 20:28 2007-05-09 20:06 815,104 --a------ C:\WINDOWS\system32\zts.exe 2007-05-09 19:57 53,248 --a------ C:\WINDOWS\system32\Process.exe 2007-05-09 19:57 39,184 --a------ C:\WINDOWS\system32\Ntrights.exe 2007-05-09 19:57 175,616 --a------ C:\WINDOWS\system32\strings.exe 2007-05-09 19:57 16,384 --a------ C:\WINDOWS\system32\restart.exe 2007-05-09 19:57 126,976 --a------ C:\WINDOWS\system32\zip.exe 2007-05-09 19:57 11,254 --a------ C:\WINDOWS\system32\locate.com 2007-05-09 19:37 1,306,112 --a------ C:\WINDOWS\system32\ren.exe 2007-05-09 19:28 1,306,112 --a------ C:\WINDOWS\system32\agh.exe 2007-05-09 19:19 1,236,992 --a------ C:\WINDOWS\system32\dic.exe 2007-05-09 17:49 1,236,992 --a------ C:\WINDOWS\system32\xnn.exe 2007-05-09 16:02 958,464 --a------ C:\WINDOWS\system32\gzu.exe 2007-05-09 15:57 1,236,992 --a------ C:\WINDOWS\system32\dhz.exe 2007-05-09 14:12 57,344 --a------ C:\WINDOWS\system32\lab.exe 2007-05-08 19:09 2007-05-08 19:09 2007-05-08 17:50 1,236,992 --a------ C:\WINDOWS\system32\eiz.exe 2007-05-08 16:36 1,306,112 --a------ C:\WINDOWS\system32\jlb.exe 2007-05-07 21:12 1,236,992 --a------ C:\WINDOWS\system32\tzx.exe 2007-05-06 20:50 716,800 --a------ C:\WINDOWS\system32\jtu.exe 2007-05-06 20:26 1,306,112 --a------ C:\WINDOWS\system32\qbv.exe 2007-05-06 18:23 1,236,992 --a------ C:\WINDOWS\system32\utf.exe 2007-05-06 16:30 228,937 --a------ C:\WINDOWS\Alcohol_Toolbar_Uninstaller_8500.exe 2007-05-06 16:30 2007-05-06 16:28 639,224 --a------ C:\WINDOWS\system32\drivers\sptd.sys 2007-05-06 16:11 1,306,112 -r-hs---- C:\WINDOWS\tune.exe 2007-05-06 14:30 147,968 --a------ C:\WINDOWS\system32\wiw.exe 2007-05-06 12:12 2007-05-06 12:09 147,968 --a------ C:\WINDOWS\system32\dwm.exe 2007-05-06 11:41 2007-05-06 11:37 1,236,992 -r-hs---- C:\WINDOWS\wault.exe 2007-05-06 11:16 2007-05-06 09:41 17,780 --a------ C:\WINDOWS\fremaker.exe 2007-05-06 09:41 2007-05-05 23:15 147,968 --a------ C:\WINDOWS\system32\vxm.exe 2007-05-05 22:05 565,248 --a------ C:\WINDOWS\system32\xer.exe 2007-05-05 21:41 2007-05-05 21:34 147,968 --a------ C:\WINDOWS\system32\ufa.exe 2007-05-05 21:28 147,968 --a------ C:\WINDOWS\system32\dyw.exe 2007-05-05 21:26 368,640 --a------ C:\WINDOWS\system32\sis.exe 2007-05-05 16:35 83,968 --a------ C:\WINDOWS\system32\drivers\nabtsfec.sys 2007-05-05 16:35 52,096 --a------ C:\WINDOWS\system32\drivers\msdv.sys 2007-05-05 16:35 47,104 --a------ C:\WINDOWS\system32\wstdecod.dll 2007-05-05 16:35 354,816 --a------ C:\WINDOWS\system32\psisdecd.dll 2007-05-05 16:35 18,688 --a------ C:\WINDOWS\system32\drivers\wstcodec.sys 2007-05-05 16:35 16,896 --a------ C:\WINDOWS\system32\msyuv.dll 2007-05-05 16:35 16,384 --a------ C:\WINDOWS\system32\drivers\ccdecode.sys 2007-05-05 16:35 15,104 --a------ C:\WINDOWS\system32\drivers\mpe.sys 2007-05-05 16:35 14,976 --a------ C:\WINDOWS\system32\drivers\streamip.sys 2007-05-05 16:35 11,392 --a------ C:\WINDOWS\system32\drivers\bdasup.sys 2007-05-05 16:35 10,880 --a------ C:\WINDOWS\system32\drivers\slip.sys 2007-05-05 16:35 10,112 --a------ C:\WINDOWS\system32\drivers\ndisip.sys 2007-05-05 16:35 1,769,472 --a------ C:\WINDOWS\system32\dxdiagn.dll 2007-05-05 16:35 1,703,936 --a------ C:\WINDOWS\system32\d3d9.dll 2007-05-05 16:35 1,230,336 --a------ C:\WINDOWS\system32\msvidctl.dll 2007-05-05 14:51 147,968 --a------ C:\WINDOWS\system32\ciq.exe 2007-05-05 11:43 17,920 --a------ C:\WINDOWS\system32\mdimon.dll 2007-05-05 11:40 2007-05-05 11:39 2007-05-05 11:38 2007-05-05 10:40 299,520 --a------ C:\WINDOWS\uninst.exe 2007-05-05 10:40 2007-05-05 10:40 2007-05-05 09:53 2007-05-05 09:49 9,464 --a------ C:\WINDOWS\system32\drivers\cdralw2k.sys 2007-05-05 09:49 9,336 --a------ C:\WINDOWS\system32\drivers\cdr4_xp.sys 2007-05-05 09:49 43,528 --a------ C:\WINDOWS\system32\drivers\PxHelp20.sys 2007-05-05 09:49 129,784 --a------ C:\WINDOWS\system32\pxafs.dll 2007-05-05 09:48 96,768 --a------ C:\WINDOWS\system32\logagent.exe 2007-05-05 09:48 940,544 --a------ C:\WINDOWS\system32\wmspdmoe.dll 2007-05-05 09:48 895,736 --a------ C:\WINDOWS\system32\wmvdmod.dll 2007-05-05 09:48 774,904 --a------ C:\WINDOWS\system32\wmsdmod.dll 2007-05-05 09:48 716,288 --a------ C:\WINDOWS\system32\wmadmoe.dll 2007-05-05 09:48 66,560 --a------ C:\WINDOWS\system32\wpdmtpus.dll 2007-05-05 09:48 61,952 --a------ C:\WINDOWS\system32\wpdconns.dll 2007-05-05 09:48 6,656 --a------ C:\WINDOWS\system32\laprxy.dll 2007-05-05 09:48 47,104 --a------ C:\WINDOWS\system32\uwdf.exe 2007-05-05 09:48 413,944 --a------ C:\WINDOWS\system32\wmspdmod.dll 2007-05-05 09:48 396,528 --a------ C:\WINDOWS\system32\wmadmod.dll 2007-05-05 09:48 38,912 --a------ C:\WINDOWS\system32\wdfmgr.exe 2007-05-05 09:48 364,784 --a------ C:\WINDOWS\system32\MSSCP.dll 2007-05-05 09:48 335,872 --a------ C:\WINDOWS\system32\WMDRMdev.dll 2007-05-05 09:48 331,776 --a------ C:\WINDOWS\system32\wpdmtpdr.dll 2007-05-05 09:48 331,264 --a------ C:\WINDOWS\system32\wpdsp.dll 2007-05-05 09:48 33,792 --a------ C:\WINDOWS\system32\WMDMPS.dll 2007-05-05 09:48 315,904 --a------ C:\WINDOWS\system32\MSWMDM.dll 2007-05-05 09:48 290,816 --a------ C:\WINDOWS\system32\WMDRMNet.dll 2007-05-05 09:48 28,160 --a------ C:\WINDOWS\system32\WMDMLOG.dll 2007-05-05 09:48 25,088 --a------ C:\WINDOWS\system32\MsPMSNSv.dll 2007-05-05 09:48 224,768 --a------ C:\WINDOWS\system32\wmasf.dll 2007-05-05 09:48 221,184 --a------ C:\WINDOWS\system32\qasf.dll 2007-05-05 09:48 18,944 --a------ C:\WINDOWS\system32\drivers\wpdusb.sys 2007-05-05 09:48 173,568 --a------ C:\WINDOWS\system32\MsPMSP.dll 2007-05-05 09:48 164,864 --a------ C:\WINDOWS\system32\cewmdm.dll 2007-05-05 09:48 150,016 --a------ C:\WINDOWS\system32\wmidx.dll 2007-05-05 09:48 15,872 --a------ C:\WINDOWS\system32\wdfapi.dll 2007-05-05 09:48 114,176 --a------ C:\WINDOWS\system32\wpdmtp.dll 2007-05-05 09:48 1,512,448 --a------ C:\WINDOWS\system32\WMVADVE.DLL 2007-05-05 09:48 1,218,808 --a------ C:\WINDOWS\system32\wmvadvd.dll 2007-05-05 09:48 1,119,744 --a------ C:\WINDOWS\system32\wmsdmoe2.dll 2007-05-05 09:48 1,027,072 --a------ C:\WINDOWS\system32\wmnetmgr.dll 2007-05-05 09:48 1,003,008 --a------ C:\WINDOWS\system32\wmvdmoe2.dll 2007-05-05 09:46 2007-05-05 08:58 2007-05-04 22:38 2007-05-04 22:27 2007-05-04 22:25 466,200 --a------ C:\WINDOWS\system32\wuapi.dll 2007-05-04 22:25 41,240 --a------ C:\WINDOWS\system32\wups.dll 2007-05-04 22:25 195,352 --a------ C:\WINDOWS\system32\wuaueng1.dll 2007-05-04 22:25 175,384 --a------ C:\WINDOWS\system32\wuauclt1.exe 2007-05-04 22:25 173,536 --a------ C:\WINDOWS\system32\wuweb.dll 2007-05-04 22:25 128,280 --a------ C:\WINDOWS\system32\wucltui.dll 2007-05-04 22:25 2007-05-04 22:18 2007-05-04 22:13 147,968 -rahs---- C:\WINDOWS\DHCP.EXE 2007-05-04 21:09 24,576 --a------ C:\WINDOWS\system32\xpsp1hfm.exe 2007-05-04 21:05 2007-05-04 20:44 2007-05-04 20:36 2007-05-04 20:36 2007-05-04 20:36 2007-05-04 20:14 2007-05-04 20:02 2007-05-04 20:02 2007-05-04 20:00 172,032 --a------ C:\WINDOWS\system32\nvuide.exe 2007-05-04 20:00 2007-05-04 20:00 2007-05-04 19:59 172,032 --a------ C:\WINDOWS\system32\nvusmb.exe 2007-05-04 19:59 172,032 --a------ C:\WINDOWS\system32\NVUNINST.EXE 2007-05-04 19:59 172,032 --a------ C:\WINDOWS\system32\nvumctl.exe 2007-05-04 19:59 172,032 --a------ C:\WINDOWS\system32\nvugart.exe 2007-05-04 19:59 159,744 --a------ C:\WINDOWS\system32\nvuenet.exe 2007-05-04 19:59 2007-05-04 19:58 2007-05-04 19:51 2007-05-04 19:48 2007-05-04 19:43 2007-05-04 19:41 2007-05-04 19:41 2007-05-04 19:37 2007-05-04 19:28 2007-05-04 19:25 2007-05-04 19:25 2007-05-04 19:25 2007-05-04 19:23 53,693 -ra------ C:\WINDOWS\UNDPX2A.sys 2007-05-04 19:23 15,429 -ra------ C:\WINDOWS\system32\drivers\Sacm2A.sys 2007-05-04 19:23 135,168 -ra------ C:\WINDOWS\UNDPX2A.exe 2007-05-04 19:14 2007-05-04 19:14 2007-05-04 19:14 2007-05-04 19:14 2007-05-04 19:14 2007-05-04 19:14 2007-05-04 19:14 2007-05-04 19:14 2007-05-04 19:14 2007-05-04 19:14 2007-05-04 19:14 2007-05-04 19:14 2007-05-04 19:14 2007-05-04 19:14 2007-05-04 19:14 2007-05-04 19:14 2007-05-04 19:14 2007-05-04 19:14 2007-05-04 19:14 2007-05-04 19:14 2007-05-04 19:14 2007-05-04 19:14 2007-05-04 19:14 2007-05-04 19:14 2007-05-04 19:14 2007-05-04 19:14 2007-05-04 19:14 2007-05-04 19:14 2007-05-04 19:14 2007-05-04 19:14 2007-05-04 19:14 2007-05-04 19:14 2007-05-04 19:14 2007-05-04 19:14 2007-05-04 19:14 2007-05-04 19:14 2007-05-04 19:14 2007-05-04 19:14 2007-05-04 19:14 2007-05-04 19:14 2007-05-04 19:14 2007-05-04 19:14 2007-05-04 19:14 2007-05-04 19:14 2007-05-04 19:14 2007-05-04 19:14 2007-05-04 19:14 2007-05-04 19:14 2007-05-04 19:14 2007-05-04 19:14 2007-05-04 19:14 2007-05-04 19:14 2007-05-04 19:14 2007-05-04 19:14 2007-05-04 19:14 2007-05-04 19:14 2007-05-04 19:14 2007-05-04 18:22 50,048 --a------ C:\WINDOWS\system32\drivers\DMusic.sys 2007-05-04 18:22 5,888 --a------ C:\WINDOWS\system32\drivers\splitter.sys 2007-05-04 18:22 3,072 --a------ C:\WINDOWS\system32\drivers\audstub.sys 2007-05-04 18:21 57,856 --a------ C:\WINDOWS\system32\drivers\redbook.sys 2007-05-04 18:21 2,944 --a------ C:\WINDOWS\system32\drivers\msmpu401.sys 2007-05-04 18:20 2007-05-04 18:20 2007-05-04 18:20 2007-05-04 18:19 72,192 --a------ C:\WINDOWS\system32\storprop.dll 2007-05-04 18:19 70,096 --a------ C:\WINDOWS\system\AVICAP.DLL 2007-05-04 18:19 176,157 --a------ C:\WINDOWS\system32\dgrpsetu.dll 2007-05-04 18:19 103,424 --a------ C:\WINDOWS\system32\EqnClass.Dll 2007-05-04 18:19 10,496 --a------ C:\WINDOWS\system32\drivers\irenum.sys 2007-05-04 18:19 2007-05-04 18:19 2007-05-04 18:19 2007-05-04 18:19 2007-05-04 18:19 2007-05-04 18:19 2007-05-04 18:19 2007-05-04 18:19 2007-05-04 18:19 2007-05-04 18:19 2007-05-04 18:19 2007-05-04 18:19 2007-05-04 18:19 2007-05-04 18:19 2007-05-04 18:19 2007-05-04 18:19 2007-05-04 17:57 95,872 --a------ C:\WINDOWS\system32\AVASTSS.scr 2007-05-04 17:57 94,552 --a------ C:\WINDOWS\system32\drivers\aswmon2.sys 2007-05-04 17:57 85,952 --a------ C:\WINDOWS\system32\drivers\aswmon.sys 2007-05-04 17:57 745,600 --a------ C:\WINDOWS\system32\aswBoot.exe 2007-05-04 17:57 43,176 --a------ C:\WINDOWS\system32\drivers\aswTdi.sys 2007-05-04 17:57 26,888 --a------ C:\WINDOWS\system32\drivers\aavmker4.sys 2007-05-04 17:57 23,416 --a------ C:\WINDOWS\system32\drivers\aswRdr.sys 2007-05-04 17:57 2007-05-04 17:56 499,712 --a------ C:\WINDOWS\system32\msvcp71.dll 2007-05-04 17:56 348,160 --a------ C:\WINDOWS\system32\msvcr71.dll 2007-05-04 17:53 2007-05-04 17:52 16,384 --a------ C:\WINDOWS\system32\lgfwunis.exe 2007-05-04 17:52 102,912 --a------ C:\WINDOWS\system32\Vb6stkit.dll 2007-05-04 17:52 102,160 --a------ C:\WINDOWS\system32\VB6KO.DLL 2007-05-04 17:52 2007-05-04 17:50 306,688 --a------ C:\WINDOWS\IsUninst.exe 2007-05-04 17:50 2007-05-04 17:50 2007-05-04 17:49 476,320 --a------ C:\WINDOWS\system32\ImagXpr7.dll 2007-05-04 17:49 471,040 --a------ C:\WINDOWS\system32\ImagXRA7.dll 2007-05-04 17:49 364,544 --a------ C:\WINDOWS\system32\TwnLib4.dll 2007-05-04 17:49 262,144 --a------ C:\WINDOWS\system32\ImagXR7.dll 2007-05-04 17:49 106,496 --a------ C:\WINDOWS\system32\TwnLib20.dll 2007-05-04 17:49 1,568,768 --a------ C:\WINDOWS\system32\ImagX7.dll 2007-05-04 17:48 99,584 --a------ C:\WINDOWS\system32\drivers\InCDfs.sys 2007-05-04 17:48 8,704 --a------ C:\WINDOWS\system32\drivers\InCDrec.sys 2007-05-04 17:48 29,696 --a------ C:\WINDOWS\system32\drivers\InCDpass.sys 2007-05-04 17:48 28,672 --a------ C:\WINDOWS\system32\drivers\InCDrm.sys 2007-05-04 17:48 2,973,696 --a------ C:\WINDOWS\NuNinst.exe 2007-05-04 17:48 155,648 --a------ C:\WINDOWS\system32\NeroCheck.exe 2007-05-04 17:48 2007-05-04 17:48 2007-05-04 17:48 2007-05-04 17:47 384,512 --a------ C:\WINDOWS\system32\mp4sdmod.dll 2007-05-04 17:47 316,040 --a------ C:\WINDOWS\system32\mp43dmod.dll 2007-05-04 17:47 2007-05-04 17:46 40,960 --a------ C:\Program Files\Uninstall_CDS.exe 2007-05-04 17:46 2007-05-04 17:43 2007-05-04 17:40 843,776 --a------ C:\WINDOWS\system32\nwiz.exe 2007-05-04 17:40 81,920 -ra------ C:\WINDOWS\system32\nvwddi.dll 2007-05-04 17:40 81,920 -ra------ C:\WINDOWS\system32\nvmctray.dll 2007-05-04 17:40 5,222,400 -ra------ C:\WINDOWS\system32\nvoglnt.dll 2007-05-04 17:40 454,656 --a------ C:\WINDOWS\system32\nvshell.dll 2007-05-04 17:40 438,272 --a------ C:\WINDOWS\system32\nvappbar.exe 2007-05-04 17:40 4,112,384 -ra------ C:\WINDOWS\system32\nvcpl.dll 2007-05-04 17:40 352,256 --a------ C:\WINDOWS\system32\keystone.exe 2007-05-04 17:40 241,664 -ra------ C:\WINDOWS\system32\nvnt4cpl.dll 2007-05-04 17:40 172,032 --a------ C:\WINDOWS\system32\nvudisp.exe 2007-05-04 17:40 1,642,496 --a------ C:\WINDOWS\system32\nvwdmcpl.dll 2007-05-04 17:40 1,363,968 --a------ C:\WINDOWS\system32\nview.dll 2007-05-04 17:40 1,110,016 --a------ C:\WINDOWS\system32\nvdspsch.exe 2007-05-04 17:40 1,019,904 --a------ C:\WINDOWS\system32\nvwimg.dll 2007-05-04 17:40 2007-05-04 17:39 32,256 -ra------ C:\WINDOWS\system32\nvcodins.dll 2007-05-04 17:39 32,256 -ra------ C:\WINDOWS\system32\nvcod.dll 2007-05-04 17:39 3,740,032 -ra------ C:\WINDOWS\system32\nv4_disp.dll 2007-05-04 17:39 2,459,968 -ra------ C:\WINDOWS\system32\drivers\nv4_mini.sys 2007-05-04 17:39 114,755 -ra------ C:\WINDOWS\system32\nvsvc32.exe 2007-05-04 17:36 765,952 --a------ C:\WINDOWS\system\crlds3d.dll 2007-05-04 17:36 65,536 --a------ C:\WINDOWS\system32\Audio3D.dll 2007-05-04 17:36 65,536 --a------ C:\WINDOWS\system32\a3d.dll 2007-05-04 17:36 391,552 --a------ C:\WINDOWS\system32\drivers\ALCXSENS.SYS 2007-05-04 17:36 315,392 --a------ C:\WINDOWS\alcupd.exe 2007-05-04 17:36 2007-05-04 17:36 2007-05-04 17:36 2007-05-04 17:34 126,976 --a------ C:\WINDOWS\system32\NVNFINST.DLL 2007-05-04 17:34 122 -ra------ C:\WINDOWS\system32\drivers\ramsed.bin 2007-05-04 17:34 1,024 -ra------ C:\WINDOWS\system32\drivers\jedih2rx.bin 2007-05-04 17:34 2007-05-04 17:34 2007-05-04 17:32 3,407,872 --ah----- C:\DOCUME~1\Bartek\NTUSER.DAT 2007-05-04 17:32 2007-05-04 17:32 2007-05-04 17:32 2007-05-04 17:32 2007-05-04 17:32 2007-05-04 17:32 2007-05-04 17:32 2007-05-04 17:32 2007-05-04 17:31 233,472 --ah----- C:\DOCUME~1\NETWOR~1\NTUSER.DAT 2007-05-04 17:31 233,472 --ah----- C:\DOCUME~1\LOCALS~1\NTUSER.DAT 2007-05-04 17:31 2007-05-04 17:31 2007-05-04 17:31 2007-05-04 17:31 2007-05-04 17:31 2007-05-04 17:28 282,624 —h----- C:\DOCUME~1\DEFAUL~1\NTUSER.DAT 2007-05-04 17:28 112,128 --a------ C:\WINDOWS\system32\mapi32.dll 2007-05-04 17:28 0 -rahs---- C:\MSDOS.SYS 2007-05-04 17:28 0 -rahs---- C:\IO.SYS 2007-05-04 17:28 0 --a------ C:\CONFIG.SYS 2007-05-04 17:28 0 --a------ C:\AUTOEXEC.BAT 2007-05-04 17:28 2007-05-04 17:28 2007-05-04 17:27 2007-05-04 17:27 2007-05-04 17:27 2007-05-04 17:26 81,920 --a------ C:\WINDOWS\system32\isign32.dll 2007-05-04 17:26 73,728 --a------ C:\WINDOWS\system32\ils.dll 2007-05-04 17:26 69,632 --a------ C:\WINDOWS\system32\icwdial.dll 2007-05-04 17:26 69,248 --a------ C:\WINDOWS\system32\drivers\sr.sys 2007-05-04 17:26 67,584 --a------ C:\WINDOWS\system32\acctres.dll 2007-05-04 17:26 65,536 --a------ C:\WINDOWS\system32\msconf.dll 2007-05-04 17:26 63,488 --a------ C:\WINDOWS\system32\srclient.dll 2007-05-04 17:26 61,440 --a------ C:\WINDOWS\system32\icwphbk.dll 2007-05-04 17:26 49,152 --a------ C:\WINDOWS\system32\inetres.dll 2007-05-04 17:26 40,960 --a------ C:\WINDOWS\system32\safrslv.dll 2007-05-04 17:26 39,424 --a------ C:\WINDOWS\system32\safrcdlg.dll 2007-05-04 17:26 33,792 --a------ C:\WINDOWS\system32\racpldlg.dll 2007-05-04 17:26 32,768 --a------ C:\WINDOWS\system32\mnmsrvc.exe 2007-05-04 17:26 32,256 --a------ C:\WINDOWS\system32\mnmdd.dll 2007-05-04 17:26 28,672 --a------ C:\WINDOWS\system32\isrdbg32.dll 2007-05-04 17:26 270,336 --a------ C:\WINDOWS\system32\inetcfg.dll 2007-05-04 17:26 26,624 --a------ C:\WINDOWS\system32\safrdm.dll 2007-05-04 17:26 24,576 --a------ C:\WINDOWS\system32\nmmkcert.dll 2007-05-04 17:26 227,328 --a------ C:\WINDOWS\system32\srrstr.dll 2007-05-04 17:26 221,696 --a------ C:\WINDOWS\system32\qmgr.dll 2007-05-04 17:26 17,408 --a------ C:\WINDOWS\system32\qmgrprxy.dll 2007-05-04 17:26 16,384 --a------ C:\WINDOWS\system32\icfgnt5.dll 2007-05-04 17:26 159,232 --a------ C:\WINDOWS\system32\srsvc.dll 2007-05-04 17:26 12,288 --a------ C:\WINDOWS\system32\nmevtmsg.dll 2007-05-04 17:26 11,264 --a------ C:\WINDOWS\system32\atrace.dll 2007-05-04 17:26 2007-05-04 17:26 2007-05-04 17:26 2007-05-04 17:26 2007-05-04 17:26 2007-05-04 17:26 2007-05-04 17:26 2007-05-04 17:26 2007-05-04 17:25 9,728 --a------ C:\WINDOWS\system32\mstinit.exe 2007-05-04 17:25 81,408 --a------ C:\WINDOWS\system32\msoert2.dll 2007-05-04 17:25 587,776 --a------ C:\WINDOWS\system32\inetcomm.dll 2007-05-04 17:25 253,952 --a------ C:\WINDOWS\system32\mstask.dll 2007-05-04 17:25 23,072 --a------ C:\WINDOWS\system32\emptyregdb.dat 2007-05-04 17:25 228,864 --a------ C:\WINDOWS\system32\msoeacct.dll 2007-05-04 17:25 160,256 --a------ C:\WINDOWS\system32\schedsvc.dll 2007-05-04 17:25 2007-05-04 17:25 2007-05-04 17:25 2007-05-04 17:24 99,328 --a------ C:\WINDOWS\system32\clipbrd.exe 2007-05-04 17:24 9,728 --a------ C:\WINDOWS\system32\xolehlp.dll 2007-05-04 17:24 9,728 --a------ C:\WINDOWS\system32\reset.exe 2007-05-04 17:24 9,216 --a------ C:\WINDOWS\system32\wuauserv.dll 2007-05-04 17:24 9,216 --a------ C:\WINDOWS\system32\icaapi.dll 2007-05-04 17:24 89,088 --a------ C:\WINDOWS\system32\tscfgwmi.dll 2007-05-04 17:24 869,376 --a------ C:\WINDOWS\system32\msdtctm.dll 2007-05-04 17:24 85,504 --a------ C:\WINDOWS\system32\catsrvps.dll 2007-05-04 17:24 83,968 --a------ C:\WINDOWS\system32\mtxoci.dll 2007-05-04 17:24 82,432 --a------ C:\WINDOWS\system32\comrepl.dll 2007-05-04 17:24 80,896 --a------ C:\WINDOWS\system32\charmap.exe 2007-05-04 17:24 75,912 --a------ C:\WINDOWS\system32\rdpwsx.dll 2007-05-04 17:24 73,216 --a------ C:\WINDOWS\system32\avwav.dll 2007-05-04 17:24 61,952 --a------ C:\WINDOWS\system32\rdshost.exe 2007-05-04 17:24 605,696 --a------ C:\WINDOWS\system32\getuname.dll 2007-05-04 17:24 6,144 --a------ C:\WINDOWS\system32\msdtc.exe 2007-05-04 17:24 598,016 --a------ C:\WINDOWS\system32\mstscax.dll 2007-05-04 17:24 582,656 --a------ C:\WINDOWS\system32\catsrvut.dll 2007-05-04 17:24 57,856 --a------ C:\WINDOWS\system32\licwmi.dll 2007-05-04 17:24 57,344 --a------ C:\WINDOWS\system32\sol.exe 2007-05-04 17:24 56,832 --a------ C:\WINDOWS\system32\remotepg.dll 2007-05-04 17:24 56,832 --a------ C:\WINDOWS\system32\colbact.dll 2007-05-04 17:24 55,808 --a------ C:\WINDOWS\system32\freecell.exe 2007-05-04 17:24 54,784 --a------ C:\WINDOWS\system32\msdtclog.dll 2007-05-04 17:24 54,272 --a------ C:\WINDOWS\system32\stclient.dll 2007-05-04 17:24 534,016 --a------ C:\WINDOWS\system32\spider.exe 2007-05-04 17:24 53,248 --a------ C:\WINDOWS\system32\servdeps.dll 2007-05-04 17:24 5,632 --a------ C:\WINDOWS\system32\write.exe 2007-05-04 17:24 5,120 --a------ C:\WINDOWS\system32\dcomcnfg.exe 2007-05-04 17:24 495,616 --a------ C:\WINDOWS\system32\comuid.dll 2007-05-04 17:24 494,592 --a------ C:\WINDOWS\system32\hypertrm.dll 2007-05-04 17:24 468,480 --a------ C:\WINDOWS\system32\clbcatq.dll 2007-05-04 17:24 44,544 --a------ C:\WINDOWS\system32\hticons.dll 2007-05-04 17:24 44,032 --a------ C:\WINDOWS\system32\rdpclip.exe 2007-05-04 17:24 40,960 --a------ C:\WINDOWS\system32\tscupgrd.exe 2007-05-04 17:24 4,608 --a------ C:\WINDOWS\system32\rdpcfgex.dll 2007-05-04 17:24 4,096 --a------ C:\WINDOWS\system32\mtxex.dll 2007-05-04 17:24 390,144 --a------ C:\WINDOWS\system32\mstsc.exe 2007-05-04 17:24 38,024 --a------ C:\WINDOWS\system32\drivers\termdd.sys 2007-05-04 17:24 359,936 --a------ C:\WINDOWS\system32\msdtcprx.dll 2007-05-04 17:24 35,328 --a------ C:\WINDOWS\system32\winchat.exe 2007-05-04 17:24 342,016 --a------ C:\WINDOWS\system32\mspaint.exe 2007-05-04 17:24 33,792 --a------ C:\WINDOWS\system32\regini.exe 2007-05-04 17:24 32,768 --a------ C:\WINDOWS\system32\cfgbkend.dll 2007-05-04 17:24 25,600 --a------ C:\WINDOWS\system32\comaddin.dll 2007-05-04 17:24 25,088 --a------ C:\WINDOWS\system32\mtxlegih.dll 2007-05-04 17:24 231,424 --a------ C:\WINDOWS\system32\avtapi.dll 2007-05-04 17:24 22,528 --a------ C:\WINDOWS\system32\qwinsta.exe 2007-05-04 17:24 22,528 --a------ C:\WINDOWS\system32\msg.exe 2007-05-04 17:24 215,040 --a------ C:\WINDOWS\system32\catsrv.dll 2007-05-04 17:24 201,216 --a------ C:\WINDOWS\system32\termsrv.dll 2007-05-04 17:24 20,480 --a------ C:\WINDOWS\system32\mtxdm.dll 2007-05-04 17:24 20,232 --a------ C:\WINDOWS\system32\drivers\tdtcp.sys 2007-05-04 17:24 19,456 --a------ C:\WINDOWS\system32\qprocess.exe 2007-05-04 17:24 183,296 --a------ C:\WINDOWS\system32\accwiz.exe 2007-05-04 17:24 182,400 --a------ C:\WINDOWS\system32\drivers\rdpdr.sys 2007-05-04 17:24 177,152 --a------ C:\WINDOWS\system32\cmprops.dll 2007-05-04 17:24 17,920 --a------ C:\WINDOWS\system32\tsshutdn.exe 2007-05-04 17:24 17,408 --a------ C:\WINDOWS\system32\qappsrv.exe 2007-05-04 17:24 16,896 --a------ C:\WINDOWS\system32\mmfutil.dll 2007-05-04 17:24 16,384 --a------ C:\WINDOWS\system32\tskill.exe 2007-05-04 17:24 16,384 --a------ C:\WINDOWS\system32\rwinsta.exe 2007-05-04 17:24 16,384 --a------ C:\WINDOWS\system32\avmeter.dll 2007-05-04 17:24 151,040 --a------ C:\WINDOWS\system32\msdtcuiu.dll 2007-05-04 17:24 15,872 --a------ C:\WINDOWS\system32\logoff.exe 2007-05-04 17:24 15,872 --a------ C:\WINDOWS\system32\cdmodem.dll 2007-05-04 17:24 15,360 --a------ C:\WINDOWS\system32\tsdiscon.exe 2007-05-04 17:24 15,360 --a------ C:\WINDOWS\system32\tscon.exe 2007-05-04 17:24 15,360 --a------ C:\WINDOWS\system32\shadow.exe 2007-05-04 17:24 147,456 --a------ C:\WINDOWS\system32\comsnap.dll 2007-05-04 17:24 14,848 --a------ C:\WINDOWS\system32\rdpsnd.dll 2007-05-04 17:24 139,264 --a------ C:\WINDOWS\system32\sndvol32.exe 2007-05-04 17:24 135,680 --a------ C:\WINDOWS\system32\rdchost.dll 2007-05-04 17:24 130,048 --a------ C:\WINDOWS\system32\sessmgr.exe 2007-05-04 17:24 128,000 --a------ C:\WINDOWS\system32\mshearts.exe 2007-05-04 17:24 125,440 --a------ C:\WINDOWS\system32\sndrec32.exe 2007-05-04 17:24 12,288 --a------ C:\WINDOWS\system32\rdsaddin.exe 2007-05-04 17:24 119,808 --a------ C:\WINDOWS\system32\winmine.exe 2007-05-04 17:24 118,272 --a------ C:\WINDOWS\system32\mplay32.exe 2007-05-04 17:24 115,976 --a------ C:\WINDOWS\system32\drivers\rdpwd.sys 2007-05-04 17:24 115,200 --a------ C:\WINDOWS\system32\calc.exe 2007-05-04 17:24 11,144 --a------ C:\WINDOWS\system32\drivers\tdpipe.sys 2007-05-04 17:24 100,864 --a------ C:\WINDOWS\system32\clbcatex.dll 2007-05-04 17:24 1,225 --a------ C:\WINDOWS\system32\usrlogon.cmd 2007-05-04 17:24 1,172,992 --a------ C:\WINDOWS\system32\comsvcs.dll 2007-05-04 17:24 2007-05-04 17:24 2007-05-04 17:24 2007-05-04 17:24 2007-05-04 17:24 (((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))) 2007-05-15 18:15:57 42,496 ----a-w C:\WINDOWS\system32\ftp.exe 2007-05-15 18:15:57 16,896 ----a-w C:\WINDOWS\system32\tftp.exe 2007-05-15 17:16:27 46,756 ----a-w C:\WINDOWS\system32\perfc015.dat 2007-05-15 17:16:27 349,454 ----a-w C:\WINDOWS\system32\perfh015.dat 2007-05-15 17:12:20 133,632 ----a-w C:\WINDOWS\system32\sfc_os.dll 2007-05-04 15:27:07 -------- d-----w C:\Program Files\Usługi online (((((((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects] {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}=C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx [2001-04-16 16:39] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run] “NvCplDaemon”=“RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup” “NvMediaCenter”=“RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit” “RemoteControl”="“C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe”" “InCD”=“C:\Program Files\Ahead\InCD\InCD.exe” “NeroFilterCheck”=“C:\WINDOWS\system32\NeroCheck.exe” “NVMixerTray”="“C:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe”" “DAEMON Tools-1033”="“C:\Program Files\D-Tools\daemon.exe” -lang 1033" “AVFX Engine”=“C:\Program Files\Creative\Creative Live! Cam\VideoFX\StartFX.exe” “V0220Mon.exe”=“C:\WINDOWS\V0220Mon.exe” “SoundMan”=“SOUNDMAN.EXE” “nwiz”=“nwiz.exe /install” [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “NvCplDaemon”=“C:\WINDOWS\System32\NvCpl.dll” [2004-07-13 02:50] “NvMediaCenter”=“C:\WINDOWS\System32\NvMcTray.dll” [2004-07-13 02:50] “RemoteControl”=“C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe” [2004-11-02 20:24] “InCD”=“C:\Program Files\Ahead\InCD\InCD.exe” [2006-03-14 04:06] “NeroFilterCheck”=“C:\WINDOWS\system32\NeroCheck.exe” [2001-07-09 10:50] “NVMixerTray”=“C:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe” [2004-06-03 20:51] “DAEMON Tools-1033”=“C:\Program Files\D-Tools\daemon.exe” [2004-08-22 17:05] “AVFX Engine”=“C:\Program Files\Creative\Creative Live! Cam\VideoFX\StartFX.exe” [2006-06-09 01:11] “V0220Mon.exe”=“C:\WINDOWS\V0220Mon.exe” [2006-06-28 19:01] “SoundMan”=“SOUNDMAN.EXE” []) “nwiz”=“nwiz.exe” [2004-07-13 02:50 C:\WINDOWS\system32\nwiz.exe]) [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “PowerBar”="" []) “MSMSGS”=“C:\Program Files\Messenger\msmsgs.exe” [2002-08-20 15:08] “Creative Live! Cam Manager”=“C:\Program Files\Creative\Creative Live! Cam\Live! Cam Manager\CTLCMgr.exe” [2006-05-31 16:00] “SightSpeed”=“C:\Program Files\SightSpeed\SightSpeed.exe” [2007-05-02 20:38] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run] “PowerBar”="" “MSMSGS”="“C:\Program Files\Messenger\msmsgs.exe” /background" “Creative Live! Cam Manager”="“C:\Program Files\Creative\Creative Live! Cam\Live! Cam Manager\CTLCMgr.exe”" “SightSpeed”=“C:\Program Files\SightSpeed\SightSpeed.exe -minimized” HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa Authentication Packages msv1_0\0\0 Security Packages kerberos\0msv1_0\0schannel\0wdigest\0\0 Notification Packages scecli\0\0 HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\aqq C:\PROGRA~1\Wapster\AQQ\AQQ.exe HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\avast! C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\daemon tools-1033 “C:\Program Files\D-Tools\daemon.exe” -lang 1033 HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\kernelfaultcheck %systemroot%\system32\dumprep 0 -k HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\lgoddfu “C:\Program Files\lg_fwupdate\fwupdate.exe” blrun HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msmsgs “C:\Program Files\Messenger\msmsgs.exe” /background HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz nwiz.exe /install HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\skype “C:\Program Files\Skype\Phone\Skype.exe” /nosplash /minimized HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\watchdog C:\Program Files\mobile PhoneTools\WatchDog.exe HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\winampagent C:\Program Files\Winamp\winampa.exe [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Svchost] LocalService Alerter\0WebClient\0LmHosts\0RemoteRegistry\0upnphost\0SSDPSRV\0\0 NetworkService DnsCache\0\0 rpcss RpcSs\0\0 imgsvc StiSvc\0\0 termsvcs TermService\0\0 HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost ******************************************************************** catchme 0.3.660 W2K/XP/Vista - userland rootkit detector by Gmer, http://www.gmer.net Rootkit scan 2007-05-16 17:04:42 Windows 5.1.2600 Dodatek Service Pack. 1 NTFS scanning hidden processes … scanning hidden services … scanning hidden autostart entries … HKCU\Software\Microsoft\Windows\CurrentVersion\Run PowerBar = ???l?@?l?@???l?@???<!!!~?w???0~?wl?@?l?@???w?O?w???0~?w?~?wp???~?w??? ???M?wp???0??? ???w???R???l?@?l?@???C?w???t?@???l?@?8?@?l?@???s??? scanning hidden files … scan completed successfully hidden processes: 0 hidden services: 0 hidden files: 0 ******************************************************************** Completion time: 2007-05-16 17:04:59 - machine was rebooted C:\ComboFix-quarantined-files.txt … 2007-05-16 17:04