Logi do sprawdzenia (wolne działanie windowsa)

[Hard]

Chciałbym sprawdzić soje logi z silent runners i hijack this. Ostatnio system mi cos wolno dziala.

Logfile of HijackThis v1.99.1 Scan saved at 13:00:12, on 2008-01-20 Platform: Windows XP (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 (6.00.2600.0000) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\System32\LXSUPMON.EXE C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\Program Files\Ashampoo\Ashampoo FireWall\FireWall.exe C:\WINDOWS\system32\LEXBCES.EXE C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\LEXPPS.EXE C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Documents and Settings\Klodek\Moje dokumenty\Programy\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.pl/ig R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: Idea2 SidebarBrowserMonitor Class - {45AD732C-2CE2-4666-B366-B2214AD57A49} - C:\Program Files\Desktop Sidebar\sbhelp.dll O2 - BHO: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: TGTSoft Explorer Toolbar Changer - {C333CF63-767F-4831-94AC-E683D962C63C} - C:\Program Files\TGTSoft\StyleXP\TGT_BHO.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O3 - Toolbar: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL O4 - HKLM…\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM…\Run: [LXSUPMON] C:\WINDOWS\System32\LXSUPMON.EXE RUN O4 - HKLM…\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM…\Run: [Ashampoo FireWall] “C:\Program Files\Ashampoo\Ashampoo FireWall\FireWall.exe” -TRAY O4 - HKCU…\Run: [Dzieńdobry!] C:\Program Files\VSD Software\Dzieńdobry!\dziendobry.exe /auto O4 - HKCU…\Run: [NBJ] “C:\Program Files\Ahead\Nero BackItUp\NBJ.exe” O8 - Extra context menu item: &Clean Traces - C:\Program Files\DAP\Privacy Package\dapcleanerie.htm O8 - Extra context menu item: &Download with &DAP - C:\Program Files\DAP\dapextie.htm O8 - Extra context menu item: Download &all with DAP - C:\Program Files\DAP\dapextie2.htm O8 - Extra context menu item: Download with GetRight - C:\Program Files\GetRight\GRdownload.htm O8 - Extra context menu item: Open with GetRight Browser - C:\Program Files\GetRight\GRbrowse.htm O9 - Extra button: Subscribe in Desktop Sidebar - {09FE188B-6E85-479e-9411-51FB2220DF80} - C:\Program Files\Desktop Sidebar\sbhelp.dll O9 - Extra ‘Tools’ menuitem: Subscribe in Desktop Sidebar - {09FE188B-6E85-479e-9411-51FB2220DF80} - C:\Program Files\Desktop Sidebar\sbhelp.dll O10 - Unknown file in Winsock LSP: c:\program files\ashampoo\ashampoo firewall\spi.dll O10 - Unknown file in Winsock LSP: c:\program files\ashampoo\ashampoo firewall\spi.dll O10 - Unknown file in Winsock LSP: c:\program files\ashampoo\ashampoo firewall\spi.dll O10 - Unknown file in Winsock LSP: c:\program files\ashampoo\ashampoo firewall\spi.dll O10 - Unknown file in Winsock LSP: c:\program files\ashampoo\ashampoo firewall\spi.dll O10 - Unknown file in Winsock LSP: c:\program files\ashampoo\ashampoo firewall\spi.dll O16 - DPF: {31B7EB4E-8B4B-11D1-A789-00A0CC6651A8} - http://www.cult3d.com/download/cult.cab O16 - DPF: {54823A9D-6BAE-11D5-B519-0050BA2413EB} (ChkDVDCtl Class) - http://www.cyberlink.com/winxp/CheckDVD.cab O17 - HKLM\System\CCS\Services\Tcpip…{8BEAAD2B-97E6-4250-A41A-792210010A93}: NameServer = 192.168.0.1 O17 - HKLM\System\CS1\Services\Tcpip…{8BEAAD2B-97E6-4250-A41A-792210010A93}: NameServer = 192.168.0.1 O17 - HKLM\System\CS2\Services\Tcpip…{8BEAAD2B-97E6-4250-A41A-792210010A93}: NameServer = 192.168.0.1 O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing) O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing) O23 - Service: Firebird Server - MAGIX Instance (FirebirdServerMAGIXInstance) - MAGIX® - C:\MAGIX\Common\Database\bin\fbserver.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE O23 - Service: Microsoft security update service (msupdate) - Unknown owner - c:\windows\system32…\svchost.exe O23 - Service: StyleXPService - Unknown owner - C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe

“Silent Runners.vbs”, revision R50, http://www.silentrunners.org/ Operating System: Windows XP Output limited to non-default values, except where indicated by “{++}” Startup items buried in registry: --------------------------------- HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ {++} “Dzieńdobry!” = “C:\Program Files\VSD Software\Dzieńdobry!\dziendobry.exe /auto” [“VSD Software”] “NBJ” = ““C:\Program Files\Ahead\Nero BackItUp\NBJ.exe”” [“Ahead Software AG”] HKLM\Software\Microsoft\Windows\CurrentVersion\Run\ {++} “NeroFilterCheck” = “C:\WINDOWS\system32\NeroCheck.exe” [“Ahead Software Gmbh”] “LXSUPMON” = “C:\WINDOWS\System32\LXSUPMON.EXE RUN” [“Lexmark International Inc.”] “avast!” = “C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe” [“ALWIL Software”] “Ashampoo FireWall” = ““C:\Program Files\Ashampoo\Ashampoo FireWall\FireWall.exe” -TRAY” [null data] HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}(Default) = (no title provided) -> {HKLM…CLSID} = “AcroIEHlprObj Class” \InProcServer32(Default) = “C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll” [“Adobe Systems Incorporated”] {45AD732C-2CE2-4666-B366-B2214AD57A49}(Default) = “Idea2 SidebarBrowserMonitor Class” -> {HKLM…CLSID} = “Idea2 SidebarBrowserMonitor Class” \InProcServer32(Default) = “C:\Program Files\Desktop Sidebar\sbhelp.dll” [“Idea2”] {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C}(Default) = (no title provided) -> {HKLM…CLSID} = “Megaupload Toolbar” \InProcServer32(Default) = “C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL” ["MEGAUPLOAD "] {53707962-6F74-2D53-2644-206D7942484F}(Default) = (no title provided) -> {HKLM…CLSID} = (no title provided) \InProcServer32(Default) = “C:\PROGRA~1\SPYBOT~1\SDHelper.dll” [“Safer Networking Limited”] {C333CF63-767F-4831-94AC-E683D962C63C}(Default) = “TGTSoft Explorer Toolbar Changer” -> {HKLM…CLSID} = “CoTGT_BHO Class” \InProcServer32(Default) = “C:\Program Files\TGTSoft\StyleXP\TGT_BHO.dll” [null data] HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\ “{42071714-76d4-11d1-8b24-00a0c9068ff3}” = “Rozszerzenie CPL kadrowania wyświetlania” -> {HKLM…CLSID} = “Rozszerzenie CPL kadrowania wyświetlania” \InProcServer32(Default) = “deskpan.dll” [file not found] “{88895560-9AA2-1069-930E-00AA0030EBC8}” = “Rozszerzenie ikony HyperTerminalu” -> {HKLM…CLSID} = “HyperTerminal Icon Ext” \InProcServer32(Default) = “C:\WINDOWS\System32\hticons.dll” [“Hilgraeve, Inc.”] “{B8323370-FF27-11D2-97B6-204C4F4F5020}” = “SmartFTP Shell Extension DLL” -> {HKLM…CLSID} = “SmartFTP Shell Extension DLL” \InProcServer32(Default) = “C:\Program Files\SmartFTP Client 2.0\smarthook.dll” [“SmartFTP”] “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” = “WinRAR shell extension” -> {HKLM…CLSID} = “WinRAR” \InProcServer32(Default) = “C:\Program Files\WinRAR\rarext.dll” [null data] “{C52AF81D-F7A0-4AAB-8E87-F80A60CCD396}” = “OpenOffice.org Column Handler” -> {HKLM…CLSID} = (no title provided) \InProcServer32(Default) = ““C:\Program Files\OpenOffice.ux.pl 2.0.1\program\shlxthdl.dll”” [“Sun Microsystems, Inc.”] “{087B3AE3-E237-4467-B8DB-5A38AB959AC9}” = “OpenOffice.org Infotip Handler” -> {HKLM…CLSID} = (no title provided) \InProcServer32(Default) = ““C:\Program Files\OpenOffice.ux.pl 2.0.1\program\shlxthdl.dll”” [“Sun Microsystems, Inc.”] “{63542C48-9552-494A-84F7-73AA6A7C99C1}” = “OpenOffice.org Property Sheet Handler” -> {HKLM…CLSID} = (no title provided) \InProcServer32(Default) = ““C:\Program Files\OpenOffice.ux.pl 2.0.1\program\shlxthdl.dll”” [“Sun Microsystems, Inc.”] “{3B092F0C-7696-40E3-A80F-68D74DA84210}” = “OpenOffice.org Thumbnail Viewer” -> {HKLM…CLSID} = (no title provided) \InProcServer32(Default) = ““C:\Program Files\OpenOffice.ux.pl 2.0.1\program\shlxthdl.dll”” [“Sun Microsystems, Inc.”] “{F0CB00CD-5A07-4D91-97F5-A8C92CDA93E4}” = “Shell Extensions for RealOne Player” -> {HKLM…CLSID} = “RealOne Player Context Menu Class” \InProcServer32(Default) = “C:\Program Files\Real\RealPlayer\rpshell.dll” [“RealNetworks, Inc.”] “{B9E1D2CB-CCFF-4AA6-9579-D7A4754030EF}” = “iTunes” -> {HKLM…CLSID} = “iTunes” \InProcServer32(Default) = “C:\Program Files\iTunes\iTunesMiniPlayer.dll” [“Apple Computer, Inc.”] “{967B2D40-8B7D-4127-9049-61EA0C2C6DCE}” = “PowerISO” -> {HKLM…CLSID} = “PowerISO” \InProcServer32(Default) = “C:\Program Files\PowerISO\PWRISOSH.DLL” [“PowerISO Computing, Inc.”] “{7A4097B2-6022-4670-995F-DA363EBF947F}” = “Custom shell context menu extension” -> {HKLM…CLSID} = “Custom shell context menu extension” \InProcServer32(Default) = “C:\WINDOWS\System32\shctxex.dll” [empty string] “{472083B0-C522-11CF-8763-00608CC02F24}” = “avast” -> {HKLM…CLSID} = “avast” \InProcServer32(Default) = “C:\Program Files\Alwil Software\Avast4\ashShell.dll” [“ALWIL Software”] “{cc86590a-b60a-48e6-996b-41d25ed39a1e}” = “Portable Media Devices Menu” -> {HKLM…CLSID} = “Portable Media Devices Menu” \InProcServer32(Default) = “C:\WINDOWS\System32\Audiodev.dll” [MS] “{F2185E5D-720E-4956-90D9-75F6AC141575}” = “Idea2 SidebarIconHandler Class” -> {HKLM…CLSID} = “SidebarIconHandler Class” \InProcServer32(Default) = “C:\Program Files\Desktop Sidebar\sbhelp.dll” [“Idea2”] HKLM\Software\Classes\Folder\shellex\ColumnHandlers\ {C52AF81D-F7A0-4AAB-8E87-F80A60CCD396}(Default) = “OpenOffice.org Column Handler” -> {HKLM…CLSID} = (no title provided) \InProcServer32(Default) = ““C:\Program Files\OpenOffice.ux.pl 2.0.1\program\shlxthdl.dll”” [“Sun Microsystems, Inc.”] {F9DB5320-233E-11D1-9F84-707F02C10627}(Default) = “PDF Column Info” -> {HKLM…CLSID} = “PDF Shell Extension” \InProcServer32(Default) = “C:\Program Files\Adobe\Acrobat 7.0\ActiveX\PDFShell.dll” [“Adobe Systems, Inc.”] HKLM\Software\Classes*\shellex\ContextMenuHandlers\ avast(Default) = “{472083B0-C522-11CF-8763-00608CC02F24}” -> {HKLM…CLSID} = “avast” \InProcServer32(Default) = “C:\Program Files\Alwil Software\Avast4\ashShell.dll” [“ALWIL Software”] Custom shell context menu extension(Default) = “{7A4097B2-6022-4670-995F-DA363EBF947F}” -> {HKLM…CLSID} = “Custom shell context menu extension” \InProcServer32(Default) = “C:\WINDOWS\System32\shctxex.dll” [empty string] DAP_Menu(Default) = “{BED4C38B-F765-45AC-8C56-613F76BBF43E}” -> {HKLM…CLSID} = “DAPMenuShellExt Class” \InProcServer32(Default) = “C:\PROGRA~1\DAP\PRIVAC~1\DAPCTX~1.DLL” [“Speedbit Ltd.”] DAP_ShredMenu(Default) = “{BED4C38B-F765-45AC-8C56-613F76BBF43E}” -> {HKLM…CLSID} = “DAPMenuShellExt Class” \InProcServer32(Default) = “C:\PROGRA~1\DAP\PRIVAC~1\DAPCTX~1.DLL” [“Speedbit Ltd.”] PowerISO(Default) = “{967B2D40-8B7D-4127-9049-61EA0C2C6DCE}” -> {HKLM…CLSID} = “PowerISO” \InProcServer32(Default) = “C:\Program Files\PowerISO\PWRISOSH.DLL” [“PowerISO Computing, Inc.”] WinRAR(Default) = “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” -> {HKLM…CLSID} = “WinRAR” \InProcServer32(Default) = “C:\Program Files\WinRAR\rarext.dll” [null data] HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\ Custom shell context menu extension(Default) = “{7A4097B2-6022-4670-995F-DA363EBF947F}” -> {HKLM…CLSID} = “Custom shell context menu extension” \InProcServer32(Default) = “C:\WINDOWS\System32\shctxex.dll” [empty string] DAP_ShredMenu(Default) = “{BED4C38B-F765-45AC-8C56-613F76BBF43E}” -> {HKLM…CLSID} = “DAPMenuShellExt Class” \InProcServer32(Default) = “C:\PROGRA~1\DAP\PRIVAC~1\DAPCTX~1.DLL” [“Speedbit Ltd.”] PowerISO(Default) = “{967B2D40-8B7D-4127-9049-61EA0C2C6DCE}” -> {HKLM…CLSID} = “PowerISO” \InProcServer32(Default) = “C:\Program Files\PowerISO\PWRISOSH.DLL” [“PowerISO Computing, Inc.”] WinRAR(Default) = “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” -> {HKLM…CLSID} = “WinRAR” \InProcServer32(Default) = “C:\Program Files\WinRAR\rarext.dll” [null data] HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\ avast(Default) = “{472083B0-C522-11CF-8763-00608CC02F24}” -> {HKLM…CLSID} = “avast” \InProcServer32(Default) = “C:\Program Files\Alwil Software\Avast4\ashShell.dll” [“ALWIL Software”] PowerISO(Default) = “{967B2D40-8B7D-4127-9049-61EA0C2C6DCE}” -> {HKLM…CLSID} = “PowerISO” \InProcServer32(Default) = “C:\Program Files\PowerISO\PWRISOSH.DLL” [“PowerISO Computing, Inc.”] WinRAR(Default) = “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” -> {HKLM…CLSID} = “WinRAR” \InProcServer32(Default) = “C:\Program Files\WinRAR\rarext.dll” [null data] Group Policies {GPedit.msc branch and setting}: ----------------------------------------------- Note: detected settings may not have any effect. HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\ “shutdownwithoutlogon” = (REG_DWORD) hex:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| Shutdown: Allow system to be shut down without having to log on} “undockwithoutlogon” = (REG_DWORD) hex:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| Devices: Allow undock without having to log on} Active Desktop and Wallpaper: ----------------------------- Active Desktop may be disabled at this entry: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState Displayed if Active Desktop enabled and wallpaper not set by Group Policy: HKCU\Software\Microsoft\Internet Explorer\Desktop\General\ “Wallpaper” = “C:\Documents and Settings\Klodek\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp” Displayed if Active Desktop disabled and wallpaper not set by Group Policy: HKCU\Control Panel\Desktop\ “Wallpaper” = “C:\Documents and Settings\Klodek\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp” Enabled Screen Saver: --------------------- HKCU\Control Panel\Desktop\ “SCRNSAVE.EXE” = “C:\WINDOWS\System32\logon.scr” [MS] Winsock2 Service Provider DLLs: ------------------------------- Namespace Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++} 000000000001\LibraryPath = “%SystemRoot%\System32\mswsock.dll” [MS] 000000000002\LibraryPath = “%SystemRoot%\System32\winrnr.dll” [MS] 000000000003\LibraryPath = “%SystemRoot%\System32\mswsock.dll” [MS] Transport Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++} 0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range: C:\Program Files\Ashampoo\Ashampoo FireWall\spi.dll [null data], 01 - 05, 13 %SystemRoot%\system32\mswsock.dll [MS], 06 - 12, 14 - 16 %SystemRoot%\system32\rsvpsp.dll [MS], 17 - 18 Toolbars, Explorer Bars, Extensions: ------------------------------------ Toolbars HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\ “{4D5C8C2A-D075-11D0-B416-00C04FB90376}” -> {HKLM…CLSID} = “Pasek poleceń Microsoft” \InProcServer32(Default) = “C:\WINDOWS\System32\browseui.dll” [MS] “{4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C}” -> {HKLM…CLSID} = “Megaupload Toolbar” \InProcServer32(Default) = “C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL” ["MEGAUPLOAD "] HKLM\Software\Microsoft\Internet Explorer\Toolbar\ “{4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C}” = (no title provided) -> {HKLM…CLSID} = “Megaupload Toolbar” \InProcServer32(Default) = “C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL” ["MEGAUPLOAD "] Extensions (Tools menu items, main toolbar menu buttons) HKLM\Software\Microsoft\Internet Explorer\Extensions\ {09FE188B-6E85-479E-9411-51FB2220DF80}\ “ButtonText” = “Subscribe in Desktop Sidebar” “MenuText” = “Subscribe in Desktop Sidebar” “CLSIDExtension” = “{45AD732C-2CE2-4666-B366-B2214AD57A49}” -> {HKLM…CLSID} = “Idea2 SidebarBrowserMonitor Class” \InProcServer32(Default) = “C:\Program Files\Desktop Sidebar\sbhelp.dll” [“Idea2”] Miscellaneous IE Hijack Points ------------------------------ HKLM\Software\Microsoft\Internet Explorer\AboutURLs\ <> “Tabs” = “C:\Documents and Settings\Klodek\Dane aplikacji\MEGAUPLOADTOOLBAR\tabwelcome.html” [null data] Running Services (Display Name, Service Name, Path {Service DLL}): ------------------------------------------------------------------ avast! Antivirus, avast! Antivirus, ““C:\Program Files\Alwil Software\Avast4\ashServ.exe”” [“ALWIL Software”] avast! iAVS4 Control Service, aswUpdSv, ““C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe”” [“ALWIL Software”] avast! Mail Scanner, avast! Mail Scanner, ““C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe” /service” [“ALWIL Software”] avast! Web Scanner, avast! Web Scanner, ““C:\Program Files\Alwil Software\Avast4\ashWebSv.exe” /service” [“ALWIL Software”] LexBce Server, LexBceS, “C:\WINDOWS\system32\LEXBCES.EXE” [“Lexmark International, Inc.”] StyleXPService, StyleXPService, ““C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe”” [empty string] Print Monitors: --------------- HKLM\System\CurrentControlSet\Control\Print\Monitors\ Lexmark Network Port\Driver = “LEXLMPM.DLL” [“Lexmark International, Inc.”] ---------- <>: Suspicious data at a browser hijack point. + This report excludes default entries except where indicated. + To see *everywhere* the script checks and *everything* it finds, launch it from a command prompt or a shortcut with the -all parameter. + To search all directories of local fixed drives for DESKTOP.INI DLL launch points, use the -supp parameter or answer “No” at the first message box and “Yes” at the second message box. ---------- (total run time: 741 seconds, including 8 seconds for message boxes)

[arekmalek]

Robaczek

Start-> Uruchom

wklep cmd i OK

wpisz te komendy

SC STOP msupdate SC DELETE msupdate

Użyj combofix i daj log

[Hard]

ComboFix 07-04-25.4V - Running from: “C:\Documents and Settings\Klodek\Moje dokumenty\Programy” ((((((((((((((((((((((((((((((( Files Created from 2007-12-20 to 2008-01-20 )))))))))))))))))))))))))))))))))) 2008-01-17 17:00 49,152 --a------ C:\WINDOWS\rebuild.exe 2008-01-17 16:47 1,611 --a------ C:\WINDOWS\system32\uninstall_pack.bat 2008-01-17 16:47 2008-01-17 16:47 2008-01-17 16:31 2008-01-17 15:01 42,672 --------- C:\WINDOWS\system32\wbsys.dll 2008-01-17 15:01 2008-01-10 22:50 274,432 --a------ C:\WINDOWS\system32\NCTTextToAudio2.dll 2008-01-10 22:50 2008-01-10 20:21 2008-01-10 19:44 2008-01-10 19:43 835,584 --a------ C:\WINDOWS\system32\NCTAudioCDGrabber2.dll 2008-01-10 19:43 479,232 --a------ C:\WINDOWS\system32\NCTAudioVisualization2.dll 2008-01-10 19:43 475,136 --a------ C:\WINDOWS\system32\NCTAudioVisualizationEx2.dll 2008-01-10 19:43 348,160 --a------ C:\WINDOWS\system32\NCTWMAFile2.dll 2008-01-10 19:43 344,064 --a------ C:\WINDOWS\system32\msvcr70.dll 2008-01-10 19:43 1,794,048 --a------ C:\WINDOWS\system32\NCTAudioDesign2.dll 2008-01-04 17:07 2008-01-04 17:04 2008-01-04 15:59 2008-01-03 12:56 2008-01-02 17:28 2008-01-02 17:02 2008-01-02 15:25 2007-12-31 19:01 2007-12-30 20:14 2007-12-30 20:14 2007-12-30 20:12 2007-12-25 16:29 (((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))) 2008-01-19 20:49 30760 --a------ C:\WINDOWS\system32\gdipfontcachev1.dat 2008-01-19 12:37 1632 --a------ C:\WINDOWS\system32\d3d8caps.dat 2008-01-18 19:53 -------- d-------- C:\DOCUME~1\Klodek\DANEAP~1\openoffice.ux.pl2 2008-01-17 21:39 -------- d-------- C:\Program Files\opera 2008-01-17 19:31 -------- d-------- C:\Program Files\getright 2008-01-17 19:17 86 —hs---- C:\DOCUME~1\Klodek\DANEAP~1\desktop.ini 2008-01-17 18:54 -------- d-------- C:\Program Files\windows nt 2008-01-16 22:16 1744 --a------ C:\WINDOWS\system32\d3d9caps.dat 2008-01-13 11:36 -------- d-------- C:\DOCUME~1\Klodek\DANEAP~1\skype 2008-01-04 10:36 -------- d-------- C:\Program Files\hard truck 2008-01-03 19:26 -------- d-------- C:\Program Files\google 2007-12-31 19:55 -------- d–h----- C:\Program Files\installshield installation information 2007-12-19 11:00 515 --a------ C:\WINDOWS\ereg.dat 2007-12-05 20:57 -------- d-------- C:\Program Files\eskimos r2 2007-12-04 15:56 93264 --a------ C:\WINDOWS\system32\drivers\aswmon.sys 2007-12-04 15:55 94544 --a------ C:\WINDOWS\system32\drivers\aswmon2.sys 2007-12-04 15:53 23152 --a------ C:\WINDOWS\system32\drivers\aswRdr.sys 2007-12-04 15:51 42912 --a------ C:\WINDOWS\system32\drivers\aswTdi.sys 2007-12-04 15:49 26624 --a------ C:\WINDOWS\system32\drivers\aavmker4.sys 2007-12-04 14:04 837496 --a------ C:\WINDOWS\system32\aswboot.exe 2007-12-04 13:54 95608 --a------ C:\WINDOWS\system32\avastss.scr 2007-11-30 20:49 107888 --a------ C:\WINDOWS\system32\cmdlineext.dll 2007-11-30 20:49 -------- dr-h----- C:\DOCUME~1\Klodek\DANEAP~1\securom 2007-11-30 12:27 -------- d-------- C:\DOCUME~1\Klodek\DANEAP~1\megauploadtoolbar 2007-11-29 20:08 -------- d-------- C:\Program Files\organizer ucznia 2007-11-29 18:15 -------- d-------- C:\Program Files\fdrlab 2007-11-29 13:31 -------- d-------- C:\Program Files\ultraiso 2007-11-29 09:24 -------- d-------- C:\Program Files\dvd shrink 2007-11-29 09:11 685816 --a------ C:\WINDOWS\system32\drivers\sptd.sys 2007-11-21 21:34 -------- d-------- C:\Program Files\vanbasco’s karaoke player 2007-11-21 10:06 -------- d-------- C:\Program Files\chord buster 2007-11-21 10:02 -------- d-------- C:\Program Files\guitar fx box 2.6 2007-11-21 09:53 -------- d-------- C:\Program Files\audio phonics, inc 2007-11-20 16:58 -------- d-------- C:\Program Files\guitar pro 4 demo 2007-11-10 11:36 79712 --a------ C:\WINDOWS\system32\perfc015.dat 2007-11-10 11:36 465762 --a------ C:\WINDOWS\system32\perfh015.dat 2007-10-31 11:42 14 --a------ C:\WINDOWS\system32\sysenginedrive1.sys 2007-10-24 18:57 1986560 --a------ C:\WINDOWS\system32\nctaudiofile2.dll 2007-10-22 03:39 267272 --a------ C:\WINDOWS\system32\xactengine2_10.dll 2007-10-22 03:37 66056 --a------ C:\WINDOWS\system32\dxdllreg.exe 2007-10-22 03:37 17928 --a------ C:\WINDOWS\system32\x3daudio1_2.dll (((((((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects] {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll {45AD732C-2CE2-4666-B366-B2214AD57A49} C:\Program Files\Desktop Sidebar\sbhelp.dll {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL {53707962-6F74-2D53-2644-206D7942484F} C:\PROGRA~1\SPYBOT~1\SDHelper.dll {C333CF63-767F-4831-94AC-E683D962C63C} C:\Program Files\TGTSoft\StyleXP\TGT_BHO.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run] “NeroFilterCheck”=“C:\WINDOWS\system32\NeroCheck.exe” “LXSUPMON”=“C:\WINDOWS\System32\LXSUPMON.EXE RUN” “avast!”=“C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe” “Ashampoo FireWall”="“C:\Program Files\Ashampoo\Ashampoo FireWall\FireWall.exe” -TRAY" [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run] “Dzieńdobry!”=“C:\Program Files\VSD Software\Dzieńdobry!\dziendobry.exe /auto” “NBJ”="“C:\Program Files\Ahead\Nero BackItUp\NBJ.exe”" HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa Authentication Packages REG_MULTI_SZ msv1_0\0\0 Security Packages REG_MULTI_SZ kerberos\0msv1_0\0schannel\0wdigest\0\0 Notification Packages REG_MULTI_SZ \0scecli\0scecli\0scecli\0\0 [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\rundisabled] “iTunesHelper”="“C:\Program Files\iTunes\iTunesHelper.exe”" “DVDUpgrade”=“DVDUpgrd.exe /async” “RemoteControl”="“C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe”" “QuickTime Task”="“C:\Program Files\QuickTime\qttask.exe” -atboottime" [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Svchost] LocalService REG_MULTI_SZ Alerter\0WebClient\0LmHosts\0RemoteRegistry\0upnphost\0SSDPSRV\0\0 NetworkService REG_MULTI_SZ DnsCache\0\0 rpcss REG_MULTI_SZ RpcSs\0\0 imgsvc REG_MULTI_SZ StiSvc\0\0 termsvcs REG_MULTI_SZ TermService\0\0 HTTPFilter REG_MULTI_SZ HTTPFilter\0\0 ******************************************************************** catchme 0.3.660 W2K/XP/Vista - userland rootkit detector by Gmer, http://www.gmer.net Rootkit scan 2008-01-20 14:43:23 Windows 5.1.2600 NTFS scanning hidden processes … scanning hidden services … scanning hidden autostart entries … scanning hidden files … scan completed successfully hidden processes: 0 hidden services: 0 hidden files: 0 ******************************************************************** Completion time: 08-01-20 14:44:22 - machine was rebooted C:\ComboFix-quarantined-files.txt … 08-01-20 14:44 C:\ComboFix2.txt … 07-08-07 19:02 C:\ComboFix3.txt … 07-08-07 14:47

[Gutek]

Zmiana zasad wklejania logów na forum - viewtopic.php?f=16&t=213350

Zainstaluj SP2

Skan AVG Anti-Spyware 7.5 po update