Komputer spowolnił, wyskakuja reklamy

fabokl · 11 Październik 2007 20:25

Przepraszam ale nie wiem czy mam wirusa czy inne badziewie. Mam avast, spybot search and destroy do tego sprawdziłe Ad aware i niby nie mam nic w systemie ale przy wyłanczaniu kompa czasami włancza się okno ze “kończenie pracy programu REKLAMA” cokolwiek to znaczy i stadartowo zaczyna się wieszać czesto na rożnych dziadostwach

Logfile of HijackThis v1.99.1 Scan saved at 21:54:29, on 2007-10-11 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\ehome\ehtray.exe C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe C:\WINDOWS\system32\hkcmd.exe C:\Program Files\HP\HP Software Update\HPWuSchd2.exe C:\WINDOWS\system32\bmwebcfg.exe D:\Programy\NOKIAP~1\NOKIAP~1\LAUNCH~1.EXE C:\Program Files\ERA\blue connect compressor\bmoc.exe C:\WINDOWS\eHome\ehRecvr.exe C:\Program Files\ERA\blue connect compressor\bmctl.exe C:\WINDOWS\eHome\ehSched.exe C:\WINDOWS\system32\HPZipm12.exe D:\Programy\Spybot - Search & Destroy\TeaTimer.exe C:\Program Files\Messenger\msmsgs.exe D:\Programy\Nokia PC Suite 6\Nokia PC Suite 6\PcSync2.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\ITService\mojeOFE\Aktualizator.exe C:\Program Files\ITService\FInwestycyjne\Aktualizator.exe C:\Program Files\Desktop Architect\datray.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe C:\WINDOWS\system32\dllhost.exe C:\PROGRA~1\COMMON~1\Nokia\MPAPI\MPAPI3s.exe C:\WINDOWS\eHome\ehmsas.exe C:\Program Files\Huawei technologies\Huawei UMTS Data Card\HUAWEI Mobile Connect.exe C:\Program Files\ERA\blue connect compressor\bmop.exe C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\Program Files\WinRAR\WinRAR.exe C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Rar$EX00.498\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.pl/ O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - D:\Programy\Spybot - Search & Destroy\SDHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O4 - HKLM…\Run: [bluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,BluetoothAuthenticationAgent O4 - HKLM…\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe O4 - HKLM…\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM…\Run: [sunJavaUpdateSched] “C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe” O4 - HKLM…\Run: [igfxTray] C:\WINDOWS\system32\igfxtray.exe O4 - HKLM…\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe O4 - HKLM…\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe O4 - HKLM…\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE O4 - HKLM…\Run: [Onet.pl AutoUpdate] “C:\Program Files\Common Files\Onet.pl\NewAutoUpdate.exe” /updateexe O4 - HKLM…\Run: [PCSuiteTrayApplication] D:\Programy\NOKIAP~1\NOKIAP~1\LAUNCH~1.EXE -startup O4 - HKLM…\Run: [{067A4D22-0884-4116-9A39-A1A740C8D447}] “C:\Program Files\ERA\blue connect compressor\bmoc” -d O4 - HKCU…\Run: [spybotSD TeaTimer] D:\Programy\Spybot - Search & Destroy\TeaTimer.exe O4 - HKCU…\Run: [MSMSGS] “C:\Program Files\Messenger\msmsgs.exe” /background O4 - HKCU…\Run: [PcSync] D:\Programy\Nokia PC Suite 6\Nokia PC Suite 6\PcSync2.exe /NoDialog O4 - HKCU…\Run: [Aktualizator_mojeOFE] C:\Program Files\ITService\mojeOFE\Aktualizator.exe SLEEP O4 - HKCU…\Run: [Aktualizator] C:\Program Files\ITService\FInwestycyjne\Aktualizator.exe SLEEP O4 - HKCU…\Run: [Desktop Architect] “C:\Program Files\Desktop Architect\datray.exe” -S O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra ‘Tools’ menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra ‘Tools’ menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O10 - Broken Internet access because of LSP provider ‘bmnet.dll’ missing O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan … asinst.cab O17 - HKLM\System\CCS\Services\Tcpip…{B7899DA9-E3D4-41AB-BE00-28AF0A1340D1}: NameServer = 213.158.194.1 213.158.193.38 O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing) O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing) O23 - Service: Bytemobile Web Configurator (bmwebcfg) - Bytemobile, Inc. - C:\WINDOWS\system32\bmwebcfg.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe O23 - Service: ServiceLayer - Nokia. - C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe

i poniżej log z SIlenta

“Silent Runners.vbs”, revision 49, http://www.silentrunners.org/ Operating System: Windows XP SP2 Output limited to non-default values, except where indicated by “{++}” Startup items buried in registry: --------------------------------- HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ {++} “SpybotSD TeaTimer” = “D:\Programy\Spybot - Search & Destroy\TeaTimer.exe” [“Safer Networking Limited”] “MSMSGS” = ““C:\Program Files\Messenger\msmsgs.exe” /background” [MS] “PcSync” = “D:\Programy\Nokia PC Suite 6\Nokia PC Suite 6\PcSync2.exe /NoDialog” [“Time Information Services Ltd.”] “Aktualizator_mojeOFE” = “C:\Program Files\ITService\mojeOFE\Aktualizator.exe SLEEP” [“I.T. SERVICE”] “Aktualizator” = “C:\Program Files\ITService\FInwestycyjne\Aktualizator.exe SLEEP” [“I.T. SERVICE”] “Desktop Architect” = ““C:\Program Files\Desktop Architect\datray.exe” -S” [“Ken Foster”] HKLM\Software\Microsoft\Windows\CurrentVersion\Run\ {++} “BluetoothAuthenticationAgent” = “rundll32.exe bthprops.cpl,BluetoothAuthenticationAgent” [MS] “ehTray” = “C:\WINDOWS\ehome\ehtray.exe” [MS] “avast!” = “C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe” [“ALWIL Software”] “SunJavaUpdateSched” = ““C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe”” [“Sun Microsystems, Inc.”] “IgfxTray” = “C:\WINDOWS\system32\igfxtray.exe” [“Intel Corporation”] “HotKeysCmds” = “C:\WINDOWS\system32\hkcmd.exe” [“Intel Corporation”] “HP Software Update” = “C:\Program Files\HP\HP Software Update\HPWuSchd2.exe” [“Hewlett-Packard Co.”] “Logitech Hardware Abstraction Layer” = “KHALMNPR.EXE” [file not found] “Onet.pl AutoUpdate” = ““C:\Program Files\Common Files\Onet.pl\NewAutoUpdate.exe” /updateexe” [file not found] “PCSuiteTrayApplication” = “D:\Programy\NOKIAP~1\NOKIAP~1\LAUNCH~1.EXE -startup” [“Nokia”] “{067A4D22-0884-4116-9A39-A1A740C8D447}” = ““C:\Program Files\ERA\blue connect compressor\bmoc” -d” [“Bytemobile, Inc.”] HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}(Default) = (no title provided) -> {HKLM…CLSID} = “AcroIEHlprObj Class” \InProcServer32(Default) = “C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll” [“Adobe Systems Incorporated”] {53707962-6F74-2D53-2644-206D7942484F}(Default) = (no title provided) -> {HKLM…CLSID} = (no title provided) \InProcServer32(Default) = “D:\Programy\Spybot - Search & Destroy\SDHelper.dll” [“Safer Networking Limited”] {761497BB-D6F0-462C-B6EB-D4DAF1D92D43}(Default) = (no title provided) -> {HKLM…CLSID} = “SSVHelper Class” \InProcServer32(Default) = “C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll” [“Sun Microsystems, Inc.”] HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\ “{42071714-76d4-11d1-8b24-00a0c9068ff3}” = “Display Panning CPL Extension” -> {HKLM…CLSID} = “Display Panning CPL Extension” \InProcServer32(Default) = “deskpan.dll” [file not found] “{88895560-9AA2-1069-930E-00AA0030EBC8}” = “HyperTerminal Icon Ext” -> {HKLM…CLSID} = “HyperTerminal Icon Ext” \InProcServer32(Default) = “C:\WINDOWS\system32\hticons.dll” [“Hilgraeve, Inc.”] “{cc86590a-b60a-48e6-996b-41d25ed39a1e}” = “Portable Media Devices Menu” -> {HKLM…CLSID} = “Portable Media Devices Menu” \InProcServer32(Default) = “C:\WINDOWS\system32\audiodev.dll” [MS] “{472083B0-C522-11CF-8763-00608CC02F24}” = “avast” -> {HKLM…CLSID} = “avast” \InProcServer32(Default) = “C:\Program Files\Alwil Software\Avast4\ashShell.dll” [“ALWIL Software”] “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” = “WinRAR shell extension” -> {HKLM…CLSID} = “WinRAR” \InProcServer32(Default) = “C:\Program Files\WinRAR\rarext.dll” [null data] “{00020D75-0000-0000-C000-000000000046}” = “Microsoft Office Outlook Desktop Icon Handler” -> {HKLM…CLSID} = “Microsoft Office Outlook” \InProcServer32(Default) = “C:\PROGRA~1\MICROS~2\OFFICE11\MLSHEXT.DLL” [MS] “{0006F045-0000-0000-C000-000000000046}” = “Microsoft Office Outlook Custom Icon Handler” -> {HKLM…CLSID} = “Rozszerzenie ikon plików programu Outlook” \InProcServer32(Default) = “C:\PROGRA~1\MICROS~2\OFFICE11\OLKFSTUB.DLL” [MS] “{42042206-2D85-11D3-8CFF-005004838597}” = “Microsoft Office HTML Icon Handler” -> {HKLM…CLSID} = (no title provided) \InProcServer32(Default) = “C:\Program Files\Microsoft Office\OFFICE11\msohev.dll” [MS] “{416651E4-9C3C-11D9-8BDE-F66BAD1E3F3A}” = “PhoneBrowser” -> {HKLM…CLSID} = “Nokia Phone Browser” \InProcServer32(Default) = “D:\Programy\Nokia PC Suite 6\Nokia PC Suite 6\PhoneBrowser.dll” [“Nokia”] “{08267B21-223F-11d3-ACD4-004F4902B913}” = “Desktop Architect” -> {HKLM…CLSID} = “Desktop Architect” \InProcServer32(Default) = “C:\Program Files\Desktop Architect\dadesk.dll” [“Ken Foster”] “{C52AF81D-F7A0-4AAB-8E87-F80A60CCD396}” = “OpenOffice.org Column Handler” -> {HKLM…CLSID} = (no title provided) \InProcServer32(Default) = ““C:\Program Files\OpenOffice.org 2.2\program\shlxthdl.dll”” [“Sun Microsystems, Inc.”] “{087B3AE3-E237-4467-B8DB-5A38AB959AC9}” = “OpenOffice.org Infotip Handler” -> {HKLM…CLSID} = (no title provided) \InProcServer32(Default) = ““C:\Program Files\OpenOffice.org 2.2\program\shlxthdl.dll”” [“Sun Microsystems, Inc.”] “{63542C48-9552-494A-84F7-73AA6A7C99C1}” = “OpenOffice.org Property Sheet Handler” -> {HKLM…CLSID} = (no title provided) \InProcServer32(Default) = ““C:\Program Files\OpenOffice.org 2.2\program\shlxthdl.dll”” [“Sun Microsystems, Inc.”] “{3B092F0C-7696-40E3-A80F-68D74DA84210}” = “OpenOffice.org Thumbnail Viewer” -> {HKLM…CLSID} = (no title provided) \InProcServer32(Default) = ““C:\Program Files\OpenOffice.org 2.2\program\shlxthdl.dll”” [“Sun Microsystems, Inc.”] HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ <> igfxcui\DLLName = “igfxsrvc.dll” [“Intel Corporation”] HKLM\Software\Classes\PROTOCOLS\Filter\ <> text/xml\CLSID = “{807553E5-5146-11D5-A672-00B0D022E945}” -> {HKLM…CLSID} = (no title provided) \InProcServer32(Default) = “C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL” [MS] HKLM\Software\Classes\Folder\shellex\ColumnHandlers\ {C52AF81D-F7A0-4AAB-8E87-F80A60CCD396}(Default) = “OpenOffice.org Column Handler” -> {HKLM…CLSID} = (no title provided) \InProcServer32(Default) = ““C:\Program Files\OpenOffice.org 2.2\program\shlxthdl.dll”” [“Sun Microsystems, Inc.”] {F9DB5320-233E-11D1-9F84-707F02C10627}(Default) = “PDF Column Info” -> {HKLM…CLSID} = “PDF Shell Extension” \InProcServer32(Default) = “C:\Program Files\Adobe\Acrobat 7.0\ActiveX\PDFShell.dll” [“Adobe Systems, Inc.”] HKLM\Software\Classes*\shellex\ContextMenuHandlers\ avast(Default) = “{472083B0-C522-11CF-8763-00608CC02F24}” -> {HKLM…CLSID} = “avast” \InProcServer32(Default) = “C:\Program Files\Alwil Software\Avast4\ashShell.dll” [“ALWIL Software”] WinRAR(Default) = “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” -> {HKLM…CLSID} = “WinRAR” \InProcServer32(Default) = “C:\Program Files\WinRAR\rarext.dll” [null data] HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\ WinRAR(Default) = “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” -> {HKLM…CLSID} = “WinRAR” \InProcServer32(Default) = “C:\Program Files\WinRAR\rarext.dll” [null data] HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\ avast(Default) = “{472083B0-C522-11CF-8763-00608CC02F24}” -> {HKLM…CLSID} = “avast” \InProcServer32(Default) = “C:\Program Files\Alwil Software\Avast4\ashShell.dll” [“ALWIL Software”] WinRAR(Default) = “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” -> {HKLM…CLSID} = “WinRAR” \InProcServer32(Default) = “C:\Program Files\WinRAR\rarext.dll” [null data] Group Policies {GPedit.msc branch and setting}: ----------------------------------------------- Note: detected settings may not have any effect. HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\ “shutdownwithoutlogon” = (REG_DWORD) hex:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| Shutdown: Allow system to be shut down without having to log on} “undockwithoutlogon” = (REG_DWORD) hex:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| Devices: Allow undock without having to log on} “InstallVisualStyle” = (REG_EXPAND_SZ) C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles {unrecognized setting} “InstallTheme” = (REG_EXPAND_SZ) C:\WINDOWS\Resources\Themes\Royale.theme {unrecognized setting} Active Desktop and Wallpaper: ----------------------------- Active Desktop may be disabled at this entry: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState Displayed if Active Desktop enabled and wallpaper not set by Group Policy: HKCU\Software\Microsoft\Internet Explorer\Desktop\General\ “Wallpaper” = “C:\WINDOWS\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Wallpaper1.bmp” Displayed if Active Desktop disabled and wallpaper not set by Group Policy: HKCU\Control Panel\Desktop\ “Wallpaper” = “C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Wallpaper1.bmp” Enabled Screen Saver: --------------------- HKCU\Control Panel\Desktop\ “SCRNSAVE.EXE” = “d:\DOKUME~1\sceen4.scr” [file not found] Winsock2 Service Provider DLLs: ------------------------------- Namespace Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++} 000000000001\LibraryPath = “%SystemRoot%\system32\wshbth.dll” [MS] 000000000002\LibraryPath = “%SystemRoot%\System32\mswsock.dll” [MS] 000000000003\LibraryPath = “%SystemRoot%\System32\winrnr.dll” [MS] 000000000004\LibraryPath = “%SystemRoot%\System32\mswsock.dll” [MS] Transport Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++} 0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range: bmnet.dll [“Bytemobile, Inc.”], 01 - 03 %SystemRoot%\system32\mswsock.dll [MS], 04 - 07, 10 - 25 %SystemRoot%\system32\rsvpsp.dll [MS], 08 - 09 Toolbars, Explorer Bars, Extensions: ------------------------------------ Explorer Bars HKLM\Software\Microsoft\Internet Explorer\Explorer Bars\ HKLM\Software\Classes\CLSID{FF059E31-CC5A-4E2E-BF3B-96E929D65503}(Default) = “&Badanie” Implemented Categories{00021493-0000-0000-C000-000000000046}\ [vertical bar] InProcServer32(Default) = “C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL” [MS] Extensions (Tools menu items, main toolbar menu buttons) HKLM\Software\Microsoft\Internet Explorer\Extensions\ {08B0E5C0-4FCB-11CF-AAA5-00401C608501}\ “MenuText” = “Sun Java Console” “CLSIDExtension” = “{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBC}” -> {HKCU…CLSID} = “Java Plug-in 1.6.0_03” \InProcServer32(Default) = “C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll” [“Sun Microsystems, Inc.”] -> {HKLM…CLSID} = “Java Plug-in 1.6.0_03” \InProcServer32(Default) = “C:\Program Files\Java\jre1.6.0_03\bin\npjpi160_03.dll” [“Sun Microsystems, Inc.”] {92780B25-18CC-41C8-B9BE-3C9C571A8263}\ “ButtonText” = “Badanie” {FB5F1910-F110-11D2-BB9E-00C04F795683}\ “ButtonText” = “Messenger” “MenuText” = “Windows Messenger” “Exec” = “C:\Program Files\Messenger\msmsgs.exe” [MS] Running Services (Display Name, Service Name, Path {Service DLL}): ------------------------------------------------------------------ avast! Antivirus, avast! Antivirus, ““C:\Program Files\Alwil Software\Avast4\ashServ.exe”” [“ALWIL Software”] avast! iAVS4 Control Service, aswUpdSv, ““C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe”” [“ALWIL Software”] avast! Mail Scanner, avast! Mail Scanner, ““C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe” /service” [“ALWIL Software”] avast! Web Scanner, avast! Web Scanner, ““C:\Program Files\Alwil Software\Avast4\ashWebSv.exe” /service” [“ALWIL Software”] Bluetooth Support Service, BthServ, “C:\WINDOWS\system32\svchost.exe -k bthsvcs” {“C:\WINDOWS\System32\bthserv.dll” [MS]} Bytemobile Web Configurator, bmwebcfg, ““C:\WINDOWS\system32\bmwebcfg.exe”” [“Bytemobile, Inc.”] Media Center Extender Service, McrdSvc, “C:\WINDOWS\ehome\mcrdsvc.exe” [MS] Pml Driver HPZ12, Pml Driver HPZ12, “C:\WINDOWS\system32\HPZipm12.exe” [“HP”] ServiceLayer, ServiceLayer, ““C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe”” [“Nokia.”] Usługa Odbiornik Media Center, ehRecvr, “C:\WINDOWS\eHome\ehRecvr.exe” [MS] Usługa Planowanie nagrywania, ehSched, “C:\WINDOWS\eHome\ehSched.exe” [MS] Print Monitors: --------------- HKLM\System\CurrentControlSet\Control\Print\Monitors\ HP Standard TCP/IP Port\Driver = “HpTcpMon.dll” [“Hewlett Packard”] hpzlnt12\Driver = “hpzlnt12.dll” [“HP”] Microsoft Document Imaging Writer Monitor\Driver = “mdimon.dll” [MS] ---------- <>: Suspicious data at a malware launch point. + This report excludes default entries except where indicated. + To see *everywhere* the script checks and *everything* it finds, launch it from a command prompt or a shortcut with the -all parameter. + To search all directories of local fixed drives for DESKTOP.INI DLL launch points, use the -supp parameter or answer “No” at the first message box and “Yes” at the second message box. ---------- (total run time: 46 seconds, including 6 seconds for message boxes)

prosze o pomoc

Gutek · 11 Październik 2007 22:33

Daj log z ComboFix

Nie podpinaj się pod cudzy temat - wydzielam

fabokl · 12 Październik 2007 22:40

jak włanczam tego combo fix to wyskakuje mi że znaleziono wirusa więc nie wiem czy to ma sens

Złączono Posta : 13.10.2007 (Sob) 0:43

ComboFix 07-10-12.4 - Administrator 2007-10-13 0:37:21.1 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1033.18.112 [GMT 2:00] Running from: C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\RAHGD377\ComboFix[1].exe * Created a new restore point . ((((((((((((((((((((((((( Files Created from 2007-09-12 to 2007-10-12 ))))))))))))))))))))))))))))))) . 2007-10-13 00:36 51,200 --a------ C:\WINDOWS\NirCmd.exe 2007-10-12 13:51 2007-10-12 13:50 2007-10-11 22:23 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe 2007-10-11 22:21 90,112 --a------ C:\WINDOWS\system32\RegDACL.exe 2007-10-11 22:21 53,248 --a------ C:\WINDOWS\system32\process.exe 2007-10-11 22:21 8,925 --a------ C:\clean.bat 2007-10-11 22:21 4,096 --a------ C:\WINDOWS\system32\reboot.exe 2007-10-11 22:21 347 --a------ C:\run2.reg 2007-10-10 10:52 2007-10-10 10:52 2007-10-10 10:41 2007-10-01 09:38 47,399 --a------ C:\WINDOWS\BricoPackUninst.cmd 2007-10-01 09:34 2,165 --a------ C:\WINDOWS\BricoPackFoldersDelete.cmd 2007-10-01 09:33 2007-09-29 18:52 2007-09-29 18:52 1,300 --a------ C:\WINDOWS\system32\cool.dll 2007-09-24 11:37 2007-09-24 11:32 2007-09-23 18:16 2007-09-16 16:18 2007-09-16 16:18 2007-09-15 23:13 2007-09-15 23:12 8,464 --a------ C:\WINDOWS\system32\SpOrder.dll 2007-09-15 22:28 2007-09-15 22:27 2007-09-15 22:24 2007-09-15 22:23 2007-09-15 22:23 2007-09-15 22:23 2007-09-15 22:23 2007-09-15 22:23 2007-09-15 22:23 2007-09-15 22:23 13,312 --a------ C:\WINDOWS\system32\drivers\nmwcdcm.sys 2007-09-15 22:11 2007-09-13 13:41 2007-09-13 13:38 2007-09-12 17:19 17,024 --a------ C:\WINDOWS\system32\drivers\usbohci.sys 2007-09-12 17:19 17,024 --a–c— C:\WINDOWS\system32\dllcache\usbohci.sys 2007-09-12 17:17 2007-09-12 17:17 100,992 --a------ C:\WINDOWS\system32\drivers\ewusbmdm.sys 2007-09-12 17:17 24,448 --a------ C:\WINDOWS\system32\drivers\ewdcsc.sys . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2007-10-11 14:14 --------- d-----w C:\Documents and Settings\Administrator\Application Data\U3 2007-10-05 11:46 --------- d-----w C:\Program Files\Java 2007-10-01 07:38 218,624 ----a-w C:\WINDOWS\system32\uxtheme.dll 2007-09-29 16:52 --------- d–h--w C:\Program Files\InstallShield Installation Information 2007-09-29 16:52 --------- d-----w C:\Program Files\Common Files\InstallShield 2007-09-24 09:06 --------- d-----w C:\Documents and Settings\Administrator\Application Data\mojeOFE 2007-09-08 07:40 --------- d-----w C:\Program Files\Common Files\Onet.pl 2007-09-06 10:09 801,144 ----a-w C:\WINDOWS\system32\aswBoot.exe 2007-09-06 10:05 94,416 ----a-w C:\WINDOWS\system32\drivers\aswmon2.sys 2007-09-06 10:05 92,848 ----a-w C:\WINDOWS\system32\drivers\aswmon.sys 2007-09-06 10:03 23,152 ----a-w C:\WINDOWS\system32\drivers\aswRdr.sys 2007-09-06 10:02 42,912 ----a-w C:\WINDOWS\system32\drivers\aswTdi.sys 2007-09-06 10:00 95,608 ----a-w C:\WINDOWS\system32\AVASTSS.scr 2007-09-06 10:00 26,624 ----a-w C:\WINDOWS\system32\drivers\aavmker4.sys 2007-08-21 09:14 --------- d-----w C:\Documents and Settings\Administrator\Application Data\PowerHouse 2007-08-21 06:15 683,520 ----a-w C:\WINDOWS\system32\inetcomm.dll 2007-07-30 17:19 92,504 ----a-w C:\WINDOWS\system32\cdm.dll 2007-07-30 17:19 549,720 ----a-w C:\WINDOWS\system32\wuapi.dll 2007-07-30 17:19 53,080 ----a-w C:\WINDOWS\system32\wuauclt.exe 2007-07-30 17:19 43,352 ----a-w C:\WINDOWS\system32\wups2.dll 2007-07-30 17:19 325,976 ----a-w C:\WINDOWS\system32\wucltui.dll 2007-07-30 17:19 203,096 ----a-w C:\WINDOWS\system32\wuweb.dll 2007-07-30 17:19 1,712,984 ----a-w C:\WINDOWS\system32\wuaueng.dll 2007-07-30 17:18 33,624 ----a-w C:\WINDOWS\system32\wups.dll . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “BluetoothAuthenticationAgent”=“bthprops.cpl” [2004-08-10 14:00 C:\WINDOWS\system32\bthprops.cpl] “ehTray”=“C:\WINDOWS\ehome\ehtray.exe” [2005-08-05 22:56] “avast!”=“C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe” [2007-09-06 12:06] “SunJavaUpdateSched”=“C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe” [2007-09-25 01:11] “IgfxTray”=“C:\WINDOWS\system32\igfxtray.exe” [2004-02-26 01:42] “HotKeysCmds”=“C:\WINDOWS\system32\hkcmd.exe” [2004-02-26 01:38] “HP Software Update”=“C:\Program Files\HP\HP Software Update\HPWuSchd2.exe” [2005-05-12 08:12] “Logitech Hardware Abstraction Layer”=“KHALMNPR.EXE” [] “Onet.pl AutoUpdate”=“C:\Program Files\Common Files\Onet.pl\NewAutoUpdate.exe” [] “PCSuiteTrayApplication”=“D:\Programy\NOKIAP~1\NOKIAP~1\LAUNCH~1.exe” [2006-06-15 12:36] “{067A4D22-0884-4116-9A39-A1A740C8D447}”=“C:\Program Files\ERA\blue connect compressor\bmoc -d” [] “Reminder”=“D:\Programy\Axa\Remainder.exe” [] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “SpybotSD TeaTimer”=“D:\Programy\Spybot - Search & Destroy\TeaTimer.exe” [2005-05-31 10:04] “MSMSGS”=“C:\Program Files\Messenger\msmsgs.exe” [2004-10-13 18:24] “PcSync”=“D:\Programy\Nokia PC Suite 6\Nokia PC Suite 6\PcSync2.exe” [2006-06-27 16:21] “Aktualizator_mojeOFE”=“C:\Program Files\ITService\mojeOFE\Aktualizator.exe” [2007-09-24 11:32] “Aktualizator”=“C:\Program Files\ITService\FInwestycyjne\Aktualizator.exe” [2007-09-24 11:37] “Desktop Architect”=“C:\Program Files\Desktop Architect\datray.exe” [2001-05-07 18:35] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] “InstallVisualStyle”=C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles “InstallTheme”=C:\WINDOWS\Resources\Themes\Royale.theme R1 tcpipBM;Bytemobile Kernel Network Provider;C:\WINDOWS\system32\drivers\tcpipBM.sys R3 hwdatacard;Huawei DataCard USB Modem and USB Serial;C:\WINDOWS\system32\DRIVERS\ewusbmdm.sys S3 DellBIOS;DellBIOS;??\C:\WINDOWS\DellBIOS.Sys [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2{3bb25230-26e4-11dc-8af7-0010c64d1d55}] AutoRun\command - F:\LaunchU3.exe -a [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2{8ec688d6-546b-11dc-940b-0010c64d1d55}] AutoRun\command - E:\LaunchU3.exe -a . ************************************************************************** catchme 0.3.1169 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-10-13 00:40:00 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes … scanning hidden autostart entries … scanning hidden files … scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2007-10-13 0:41:04 . — E O F —

jessica · 13 Październik 2007 08:27

Nie widzę w logu nic podejrzanego.

Nie widzę także żadnego programu, który ma w nazwie słowo “Reklama”.

Być może któryś z zainstalowanych przez Ciebie programów zawiera w sobie dodatkowy programik?

Musiałbyś przejść do Trybu Awaryjnego i po kolei próbować każdy program, czy po nim pojawi się ta “Reklama”.

Z logu ComboFixa wynika, że te wpisy w Hijacku są bezplikowe, więc je sfiksuj:

>>Hijack>>scan(Do a system scan only)>>zaznacz je >> Fix checked.

jessi