Mam Trojana Win32:Agent-GSA , komp spowalnia!

majster80 · 5 Czerwiec 2007 07:48

Logi!

Logfile of HijackThis v1.99.1 Scan saved at 09:46:23, on 2007-06-05 Platform: Windows XP Dodatek SP. 1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\System32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\Ati2evxx.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\Program Files\ATI Technologies\ATI.ACE\cli.exe C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\WINDOWS\System32\CTHELPER.EXE C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe C:\WINDOWS\System32\ctfmon.exe C:\Program Files\Gadu-Gadu\gg.exe C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\MsPMSPSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\WINDOWS\System32\wuauclt.exe C:\Program Files\WinRAR\WinRAR.exe C:\DOCUME~1\J&G\USTAWI~1\Temp\Rar$EX04.046\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://interia.pl/ R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://interia.pl/ R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: Mega Manager IE Click Monitor - {bf00e119-21a3-4fd1-b178-3b8537e75c92} - C:\Program Files\Megaupload\Mega Manager\MegaIEMn.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O4 - HKLM…\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe O4 - HKLM…\Run: [ATICCC] “C:\Program Files\ATI Technologies\ATI.ACE\cli.exe” runtime O4 - HKLM…\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM…\Run: [CTHelper] CTHELPER.EXE O4 - HKLM…\Run: [updReg] C:\WINDOWS\UpdReg.EXE O4 - HKLM…\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k O4 - HKLM…\Run: [iSUSPM Startup] “C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe” -startup O4 - HKLM…\Run: [iSUSScheduler] “C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe” -start O4 - HKCU…\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe O4 - HKCU…\Run: [Gadu-Gadu] “C:\Program Files\Gadu-Gadu\gg.exe” /tray O4 - Global Startup: ATI CATALYST System Tray.lnk = C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm O9 - Extra ‘Tools’ menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing) O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing) O23 - Service: Sunbelt Kerio Personal Firewall 4 (KPF4) - Sunbelt Software - C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe O23 - Service: FrontLine Drivers Auto Removal (v2) (sfrem02) - Protection Technology (StarForce) - C:\WINDOWS\system32\sfrem02.exe O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe

i runner

“Silent Runners.vbs”, revision R50, http://www.silentrunners.org/ Operating System: Windows XP Output limited to non-default values, except where indicated by “{++}” Startup items buried in registry: --------------------------------- HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ {++} “CTFMON.EXE” = “C:\WINDOWS\System32\ctfmon.exe” [MS] “Gadu-Gadu” = ““C:\Program Files\Gadu-Gadu\gg.exe” /tray” [“Gadu-Gadu S.A.”] HKLM\Software\Microsoft\Windows\CurrentVersion\Run\ {++} “ATIPTA” = “C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe” [“ATI Technologies, Inc.”] “(Default)” = “(empty string)” [file not found] “ATICCC” = ““C:\Program Files\ATI Technologies\ATI.ACE\cli.exe” runtime” [null data] “avast!” = “C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe” [“ALWIL Software”] “CTHelper” = “CTHELPER.EXE” [“Creative Technology Ltd”] “UpdReg” = “C:\WINDOWS\UpdReg.EXE” [“Creative Technology Ltd.”] “KernelFaultCheck” = “C:\WINDOWS\system32\dumprep 0 -k” “ISUSPM Startup” = ““C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe” -startup” [file not found] “ISUSScheduler” = ““C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe” -start” [“InstallShield Software Corporation”] HKLM\Software\Microsoft\Active Setup\Installed Components\ {306D6C21-C1B6-4629-986C-E59E1875B8AF}(Default) = (no title provided) \StubPath = ““C:\WINDOWS\System32\rundll32.exe” “C:\Program Files\Messenger\msgsc.dll”,ShowIconsUser” [MS] HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}(Default) = (no title provided) -> {HKLM…CLSID} = “Adobe PDF Reader Link Helper” \InProcServer32(Default) = “C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll” [“Adobe Systems Incorporated”] {bf00e119-21a3-4fd1-b178-3b8537e75c92}(Default) = “Mega Manager IE Click Monitor” -> {HKLM…CLSID} = “IeMonitorBho Class” \InProcServer32(Default) = “C:\Program Files\Megaupload\Mega Manager\MegaIEMn.dll” [“Megaupload Limited”] HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\ “{42071714-76d4-11d1-8b24-00a0c9068ff3}” = “Rozszerzenie CPL kadrowania wyświetlania” -> {HKLM…CLSID} = “Rozszerzenie CPL kadrowania wyświetlania” \InProcServer32(Default) = “deskpan.dll” [file not found] “{88895560-9AA2-1069-930E-00AA0030EBC8}” = “Rozszerzenie ikony HyperTerminalu” -> {HKLM…CLSID} = “HyperTerminal Icon Ext” \InProcServer32(Default) = “C:\WINDOWS\System32\hticons.dll” [“Hilgraeve, Inc.”] “{5E2121EE-0300-11D4-8D3B-444553540000}” = “Catalyst Context Menu extension” -> {HKLM…CLSID} = “SimpleShlExt Class” \InProcServer32(Default) = “C:\Program Files\ATI Technologies\ATI.ACE\atiacmxx.dll” [empty string] “{472083B0-C522-11CF-8763-00608CC02F24}” = “avast” -> {HKLM…CLSID} = “avast” \InProcServer32(Default) = “C:\Program Files\Alwil Software\Avast4\ashShell.dll” [“ALWIL Software”] “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” = “WinRAR shell extension” -> {HKLM…CLSID} = “WinRAR” \InProcServer32(Default) = “C:\Program Files\WinRAR\rarext.dll” [null data] “{7A4097B2-6022-4670-995F-DA363EBF947F}” = “Custom shell context menu extension” -> {HKLM…CLSID} = “Custom shell context menu extension” \InProcServer32(Default) = “C:\WINDOWS\System32\shctxex.dll” [empty string] “{0006F045-0000-0000-C000-000000000046}” = “Microsoft Outlook Custom Icon Handler” -> {HKLM…CLSID} = “Rozszerzenie ikon plików programu Outlook” \InProcServer32(Default) = “C:\PROGRA~1\MICROS~2\Office\OLKFSTUB.DLL” [MS] HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ <> AtiExtEvent\DLLName = “Ati2evxx.dll” [“ATI Technologies Inc.”] HKLM\Software\Classes\Folder\shellex\ColumnHandlers\ {F9DB5320-233E-11D1-9F84-707F02C10627}(Default) = “PDF Column Info” -> {HKLM…CLSID} = “PDF Shell Extension” \InProcServer32(Default) = “C:\Program Files\Adobe\Acrobat 7.0\ActiveX\PDFShell.dll” [“Adobe Systems, Inc.”] HKLM\Software\Classes*\shellex\ContextMenuHandlers\ avast(Default) = “{472083B0-C522-11CF-8763-00608CC02F24}” -> {HKLM…CLSID} = “avast” \InProcServer32(Default) = “C:\Program Files\Alwil Software\Avast4\ashShell.dll” [“ALWIL Software”] Custom shell context menu extension(Default) = “{7A4097B2-6022-4670-995F-DA363EBF947F}” -> {HKLM…CLSID} = “Custom shell context menu extension” \InProcServer32(Default) = “C:\WINDOWS\System32\shctxex.dll” [empty string] WinRAR(Default) = “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” -> {HKLM…CLSID} = “WinRAR” \InProcServer32(Default) = “C:\Program Files\WinRAR\rarext.dll” [null data] HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\ Custom shell context menu extension(Default) = “{7A4097B2-6022-4670-995F-DA363EBF947F}” -> {HKLM…CLSID} = “Custom shell context menu extension” \InProcServer32(Default) = “C:\WINDOWS\System32\shctxex.dll” [empty string] WinRAR(Default) = “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” -> {HKLM…CLSID} = “WinRAR” \InProcServer32(Default) = “C:\Program Files\WinRAR\rarext.dll” [null data] HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\ avast(Default) = “{472083B0-C522-11CF-8763-00608CC02F24}” -> {HKLM…CLSID} = “avast” \InProcServer32(Default) = “C:\Program Files\Alwil Software\Avast4\ashShell.dll” [“ALWIL Software”] WinRAR(Default) = “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” -> {HKLM…CLSID} = “WinRAR” \InProcServer32(Default) = “C:\Program Files\WinRAR\rarext.dll” [null data] Group Policies {GPedit.msc branch and setting}: ----------------------------------------------- Note: detected settings may not have any effect. HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\ “shutdownwithoutlogon” = (REG_DWORD) hex:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| Shutdown: Allow system to be shut down without having to log on} “undockwithoutlogon” = (REG_DWORD) hex:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| Devices: Allow undock without having to log on} Active Desktop and Wallpaper: ----------------------------- Active Desktop may be disabled at this entry: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState Displayed if Active Desktop enabled and wallpaper not set by Group Policy: HKCU\Software\Microsoft\Internet Explorer\Desktop\General\ “Wallpaper” = “C:\Documents and Settings\J&G\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp” Displayed if Active Desktop disabled and wallpaper not set by Group Policy: HKCU\Control Panel\Desktop\ “Wallpaper” = “C:\Documents and Settings\J&G\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp” Enabled Screen Saver: --------------------- HKCU\Control Panel\Desktop\ “SCRNSAVE.EXE” = “C:\WINDOWS\System32\sstext3d.scr” [MS] Startup items in “J&G” & “All Users” startup folders: ----------------------------------------------------- C:\Documents and Settings\All Users\Menu Start\Programy\Autostart “ATI CATALYST System Tray” -> shortcut to: “C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe SystemTray” [null data] Winsock2 Service Provider DLLs: ------------------------------- Namespace Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++} 000000000001\LibraryPath = “%SystemRoot%\System32\mswsock.dll” [MS] 000000000002\LibraryPath = “%SystemRoot%\System32\winrnr.dll” [MS] 000000000003\LibraryPath = “%SystemRoot%\System32\mswsock.dll” [MS] Transport Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++} 0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range: %SystemRoot%\system32\mswsock.dll [MS], 01 - 03, 06 - 12 %SystemRoot%\system32\rsvpsp.dll [MS], 04 - 05 Running Services (Display Name, Service Name, Path {Service DLL}): ------------------------------------------------------------------ Ati HotKey Poller, Ati HotKey Poller, “C:\WINDOWS\System32\Ati2evxx.exe” [“ATI Technologies Inc.”] avast! Antivirus, avast! Antivirus, ““C:\Program Files\Alwil Software\Avast4\ashServ.exe”” [“ALWIL Software”] avast! iAVS4 Control Service, aswUpdSv, ““C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe”” [“ALWIL Software”] avast! Mail Scanner, avast! Mail Scanner, ““C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe” /service” [“ALWIL Software”] avast! Web Scanner, avast! Web Scanner, ““C:\Program Files\Alwil Software\Avast4\ashWebSv.exe” /service” [“ALWIL Software”] gb, gb, “C:\WINDOWS\System32\svchost.exe -k netsvcs” {“C:\Program Files\Common Files\Microsoft Shared\Web Folders\ibm00001.dll” [null data]} Ulead Burning Helper, UleadBurningHelper, “C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe” [“Ulead Systems, Inc.”] Windows User Mode Driver Framework, UMWdf, “C:\WINDOWS\System32\wdfmgr.exe” [MS] WMDM PMSP Service, WMDM PMSP Service, “C:\WINDOWS\System32\MsPMSPSv.exe” [MS] ---------- <>: Suspicious data at a malware launch point. + This report excludes default entries except where indicated. + To see *everywhere* the script checks and *everything* it finds, launch it from a command prompt or a shortcut with the -all parameter. + The search for DESKTOP.INI DLL launch points on all local fixed drives took 93 seconds. ---------- (total run time: 462 seconds)

Gutek · 5 Czerwiec 2007 13:46

usuń wpisy HJT

Daj log z Combofix

Czyszczenie rejestru:

RegCleaner - http://www.dobreprogramy.pl/index.php?dz=2&t=29&id=177

możesz rejestr przelecieć albo

jv16 PowerTools - http://www.dobreprogramy.pl/index.php?dz=2&t=29&id=509

majster80 · 5 Czerwiec 2007 22:43

wisy usunołem!

oto log z comba

“J&G” - 2007-06-06 0:12:27 Dodatek Service Pack. 1 NTFS ComboFix 07-06-3B - Running from: “C:\Documents and Settings\J&G\Pulpit” ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) C:\Program Files\Common Files\microsoft shared\web folders\ibm00001.dll C:\Program Files\Common Files\microsoft shared\web folders\ibm00002.dll C:\Program Files\video activex object C:\WINDOWS\system32\xpdx.sys ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) -------\LEGACY_GB -------\gb -------\xpdx ((((((((((((((((((((((((( Files Created from 2007-05-05 to 2007-06-05 ))))))))))))))))))))))))))))))) 2007-06-06 00:21 2007-06-06 00:16 2007-06-06 00:06 2007-06-05 21:30 40,960 --a------ C:\tvuynuup.exe 2007-06-05 09:39 3,072 --a------ C:\WINDOWS\system32\drivers\kcp.sys 2007-06-05 09:36 53,248 --a------ C:\WINDOWS\system32\oleauth32.dll 2007-06-05 09:27 57,856 --a------ C:\dvlhfvhu.exe 2007-06-05 09:27 51,712 --a------ C:\mkwm.exe 2007-06-05 09:27 15,872 --a------ C:\mjgakrdu.exe 2007-06-05 09:27 11,264 --a------ C:\tgmvmjba.exe 2007-06-05 09:25 2007-06-05 09:24 2007-06-05 09:22 2007-06-05 09:22 2007-06-05 09:22 2007-06-05 09:19 2007-06-04 11:47 2007-06-04 11:40 2007-06-04 11:25 133,120 --a------ C:\WINDOWS\system32\Winagler.exe 2007-06-04 10:18 2007-06-04 10:17 626,688 --a------ C:\WINDOWS\system32\msvcr80.dll 2007-06-03 18:41 41,776 --a------ C:\WINDOWS\tagm.exe 2007-06-03 18:40 41,776 --a------ C:\WINDOWS\klyd.exe 2007-06-01 18:31 223,128 --a------ C:\WINDOWS\system32\drivers\dtscsi.sys 2007-06-01 18:31 2007-06-01 18:29 90,240 --a------ C:\WINDOWS\system32\drivers\sptd8317.sys 2007-06-01 18:29 664,064 --a------ C:\WINDOWS\system32\drivers\sptd.sys 2007-05-31 13:15 2007-05-31 09:50 2007-05-27 21:32 2007-05-27 20:41 2007-05-27 20:24 2007-05-27 20:17 2007-05-22 20:51 2007-05-22 20:50 2007-05-22 20:50 2007-05-22 20:50 2007-05-18 11:33 2007-05-18 09:21 2007-05-17 23:34 2007-05-17 23:33 2007-05-12 11:03 2007-05-10 21:13 284,840 --a------ C:\WINDOWS\system32\mp4sdmod.dll 2007-05-10 21:12 966,144 --a------ C:\WINDOWS\system32\NCTAudioInformation2.dll 2007-05-10 21:12 877,568 --a------ C:\WINDOWS\system32\NCTAudioFile2.dll 2007-05-10 21:12 835,584 --a------ C:\WINDOWS\system32\NCTAudioCDGrabber2.dll 2007-05-10 21:12 733,184 --a------ C:\WINDOWS\system32\NCTAudioLibrary2.dll 2007-05-10 21:12 614,400 --a------ C:\WINDOWS\system32\NCTMPEGFile.dll 2007-05-10 21:12 471,040 --a------ C:\WINDOWS\system32\NCTVideoCompress.dll 2007-05-10 21:12 286,720 --a------ C:\WINDOWS\system32\NCTAVIFile.dll 2007-05-10 21:12 237,568 --a------ C:\WINDOWS\system32\lame_enc.dll 2007-05-10 21:12 196,608 --a------ C:\WINDOWS\system32\NCTWMAFile2.dll 2007-05-10 21:12 159,744 --a------ C:\WINDOWS\system32\NCTWMVFile.dll 2007-05-10 21:12 106,496 --a------ C:\WINDOWS\system32\NCTVideoFile.dll 2007-05-10 21:12 101,888 --a------ C:\WINDOWS\system32\VB6STKIT.DLL 2007-05-10 21:12 1,662,976 --a------ C:\WINDOWS\system32\NCTAudioCompress2.dll 2007-05-10 21:12 2007-05-10 12:14 2007-05-10 12:14 2007-05-08 16:50 2007-05-08 10:11 2007-05-08 10:07 847,872 --a------ C:\WINDOWS\system32\msimsg.dll 2007-05-08 10:07 74,240 --a------ C:\WINDOWS\system32\msiexec.exe 2007-05-08 10:07 56 -r-hs---- C:\WINDOWS\system32\792EC98A91.sys 2007-05-08 10:07 39,936 --a------ C:\WINDOWS\system32\msisip.dll 2007-05-08 10:07 305,664 --a------ C:\WINDOWS\system32\msihnd.dll 2007-05-08 10:07 3,350 --ahs---- C:\WINDOWS\system32\KGyGaAvL.sys 2007-05-08 10:07 2,086,400 --a------ C:\WINDOWS\system32\msi.dll 2007-05-08 10:07 2007-05-08 10:06 (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) 2007-06-05 22:21:33 519,680 ----a-w C:\WINDOWS\system32\winlogon.exe 2007-06-05 20:36:06 288 ----a-w C:\WINDOWS\system32\DVCStateBkp-{00000001-00000000-00000007-00001102-00000002-100A1102}.dat 2007-06-05 20:36:06 288 ----a-w C:\WINDOWS\system32\DVCState-{00000001-00000000-00000007-00001102-00000002-100A1102}.dat 2007-06-05 07:22:50 -------- d–h--w C:\Program Files\InstallShield Installation Information 2007-05-31 11:17:23 -------- d-----w C:\Program Files\Winamp 2007-05-10 10:42:06 -------- d-----w C:\Program Files\CDex_150 2007-05-08 08:10:41 -------- d-----w C:\Program Files\Common Files\InstallShield 2007-05-03 19:48:50 -------- d-----w C:\Program Files\CDex_151 2007-05-03 10:01:16 -------- d-----w C:\Program Files\ColorCast 2007-05-03 09:56:07 -------- d-----w C:\Program Files\ClearSkin 2007-05-03 09:48:47 -------- d-----w C:\Program Files\JPEGCompress 2007-05-03 09:47:33 978 ----a-w C:\WINDOWS\unins000.dat 2007-04-30 15:46:10 745,600 ----a-w C:\WINDOWS\system32\aswBoot.exe 2007-04-30 15:41:55 85,952 ----a-w C:\WINDOWS\system32\drivers\aswmon.sys 2007-04-30 15:41:42 94,552 ----a-w C:\WINDOWS\system32\drivers\aswmon2.sys 2007-04-30 15:39:41 23,416 ----a-w C:\WINDOWS\system32\drivers\aswRdr.sys 2007-04-30 15:38:51 43,176 ----a-w C:\WINDOWS\system32\drivers\aswTdi.sys 2007-04-30 15:37:23 26,888 ----a-w C:\WINDOWS\system32\drivers\aavmker4.sys 2007-04-30 15:35:28 95,872 ----a-w C:\WINDOWS\system32\AVASTSS.scr 2007-04-29 19:10:05 33,824 ----a-w C:\WINDOWS\system32\drivers\oreans32.sys 2007-04-29 19:09:39 -------- d-----w C:\Program Files\Common Files\AVSMedia 2007-04-29 19:09:17 -------- d-----w C:\Program Files\AVSMedia 2007-04-29 18:31:28 -------- d-----w C:\DOCUME~1\J&G\DANEAP~1\INTERIAPL 2007-04-29 18:30:57 -------- d-----w C:\Program Files\INTERIAPL 2007-04-28 09:43:40 -------- d-----w C:\DOCUME~1\J&G\DANEAP~1\Media Player Classic 2007-04-28 09:41:55 -------- d-----w C:\Program Files\VIDEOzilla 2007-04-28 09:41:13 -------- d-----w C:\Program Files\QuickTime Alternative 2007-04-28 09:41:08 -------- d-----w C:\Program Files\Media Player Classic 2007-04-25 05:42:30 -------- d-----w C:\Program Files\Przegladarka migawek 2007-04-25 05:37:21 -------- d-----w C:\DOCUME~1\J&G\DANEAP~1\Microsoft Web Folders 2007-04-22 09:07:41 -------- d-----w C:\Program Files\Allok Video to FLV Converter 2007-04-19 18:37:09 -------- d-----w C:\Program Files\eTeacher 5 SE 2007-04-19 12:59:59 -------- d-----w C:\Program Files\MIKSOFT 2007-04-19 12:23:27 -------- d-----w C:\Program Files\Ringtone Media Studio 2007-04-19 12:20:03 -------- d-----w C:\Program Files\Avanquest update 2007-04-19 12:20:01 -------- d-----w C:\DOCUME~1\J&G\DANEAP~1\InstallShield 2007-04-19 12:15:41 -------- d-----w C:\Program Files\IrfanView 2007-04-19 12:15:41 -------- d-----w C:\DOCUME~1\J&G\DANEAP~1\Help 2007-04-19 12:15:02 -------- d-----w C:\Program Files\Audacity 1.3 Beta 2007-04-08 15:00:26 -------- d-----w C:\Program Files\MarBit 2007-04-08 14:48:53 -------- d-----w C:\Program Files\DivX 2007-04-07 16:50:49 -------- d–h--w C:\Program Files\WindowsUpdate 2007-03-25 06:36:51 67,078 ----a-w C:\WINDOWS\system32\perfc015.dat 2007-03-25 06:36:51 435,978 ----a-w C:\WINDOWS\system32\perfh015.dat 2007-03-23 09:30:31 0 ----a-w C:\WINDOWS\nsreg.dat 2007-03-23 08:45:27 0 --sha-r C:\MSDOS.SYS 2007-03-23 08:45:27 0 --sha-r C:\IO.SYS 2007-03-23 08:45:27 0 ----a-w C:\CONFIG.SYS 2007-03-23 08:45:27 0 ----a-w C:\AUTOEXEC.BAT 2007-03-23 08:42:40 21,856 ----a-w C:\WINDOWS\system32\emptyregdb.dat 2007-03-22 19:05:00 532,480 ------w C:\WINDOWS\system32\ati2sgag.exe 2007-03-15 01:58:38 315,392 ----a-w C:\WINDOWS\system32\ATIDEMGX.dll 2007-03-15 01:57:34 267,776 ----a-w C:\WINDOWS\system32\ati2dvag.dll 2007-03-15 01:55:38 307,200 ----a-w C:\WINDOWS\system32\atiiiexx.dll 2007-03-15 01:50:39 122,880 ----a-w C:\WINDOWS\system32\atipdlxx.dll 2007-03-15 01:50:27 114,688 ----a-w C:\WINDOWS\system32\Oemdspif.dll 2007-03-15 01:50:19 26,112 ----a-w C:\WINDOWS\system32\Ati2mdxx.exe 2007-03-15 01:50:12 42,496 ----a-w C:\WINDOWS\system32\ati2edxx.dll 2007-03-15 01:49:59 114,688 ----a-w C:\WINDOWS\system32\ati2evxx.dll 2007-03-15 01:48:39 450,560 ----a-w C:\WINDOWS\system32\ati2evxx.exe 2007-03-15 01:47:52 53,248 ----a-w C:\WINDOWS\system32\ATIDDC.DLL 2007-03-15 01:40:10 2,820,544 ----a-w C:\WINDOWS\system32\ati3duag.dll 2007-03-15 01:29:47 1,315,712 ----a-w C:\WINDOWS\system32\ativvaxx.dll 2007-03-15 01:29:32 3,107,788 ----a-w C:\WINDOWS\system32\ativvaxx.dat 2007-03-15 01:19:32 5,402,624 ----a-w C:\WINDOWS\system32\atioglxx.dll 2007-03-15 01:16:14 258,048 ----a-w C:\WINDOWS\system32\atikvmag.dll 2007-03-15 01:14:43 17,408 ----a-w C:\WINDOWS\system32\atitvo32.dll 2007-03-15 01:10:28 356,352 ----a-w C:\WINDOWS\system32\ati2cqag.dll 2007-03-07 23:51:00 129,784 ------w C:\WINDOWS\system32\pxafs.dll 2007-03-06 22:04:53 143,676 ----a-w C:\WINDOWS\system32\atiicdxx.dat 2002-09-28 22:00:00 133,120 --sh–r C:\WINDOWS\system32\ncfsmvmk.exe ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects] {bf00e119-21a3-4fd1-b178-3b8537e75c92}=C:\Program Files\Megaupload\Mega Manager\MegaIEMn.dll [2007-05-14 17:09] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “ATIPTA”=“C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe” [2004-08-25 13:52] “@”="" [] “ATICCC”=“C:\Program Files\ATI Technologies\ATI.ACE\cli.exe” [2004-08-25 15:25] “avast!”=“C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe” [2007-04-30 17:42] “CTHelper”=“CTHELPER.EXE” [2003-08-28 10:45 C:\WINDOWS\system32\CTHELPER.EXE] “ISUSPM Startup”=“C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe” [] “ISUSScheduler”=“C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe” [2005-06-10 10:44] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “CTFMON.EXE”=“C:\WINDOWS\System32\ctfmon.exe” [2002-09-29 00:00] “Gadu-Gadu”=“C:\Program Files\Gadu-Gadu\gg.exe” [2007-01-30 16:58] [HKEY_USERS.default\software\microsoft\windows\currentversion\run] “”= “ATICCC”=“C:\Program Files\ATI Technologies\ATI.ACE\cli.exe” runtime [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Adobe Reader Speed Launch.lnk] path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Adobe Reader Speed Launch.lnk backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Microsoft Office.lnk] path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Microsoft Office.lnk backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Gadu-Gadu] “C:\Program Files\Gadu-Gadu\gg.exe” /tray [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Jet Detection] “C:\Program Files\Creative\SBLive\PROGRAM\ADGJDet.exe” [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent] C:\Program Files\Winamp\winampa.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services] “ERSvc”=2 (0x2) “Creative Service for CDROM Access”=2 (0x2) HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost *netsvcs* ************************************************************************** catchme 0.3.692 W2K/XP/Vista - userland rootkit detector by Gmer, http://www.gmer.net Rootkit scan 2007-06-06 00:30:23 Windows 5.1.2600 Dodatek Service Pack. 1 NTFS detected NTDLL code modification: ZwOpenFile scanning hidden processes … scanning hidden autostart entries … scanning hidden files … scan completed successfully hidden files: 0 ************************************************************************** Completion time: 2007-06-06 0:32:14 - machine was rebooted C:\ComboFix-quarantined-files.txt … 2007-06-06 00:32 — E O F —

Gutek · 6 Czerwiec 2007 11:54

Pobierz The Avenger. Wypakuj => uruchom => zaznacz opcję Input script manually => kliknij w taką lupkę => w okienku, które się otworzy wklej:

kliknij klawisz Done => teraz kliknij na zielone światełko => powinna pojawić się pewna informacja i kliknij OK (teraz restart).

Po tym nowy log

HARDSTYLE · 13 Czerwiec 2007 13:57

Korzystajac z okazji to pisze tu

mam, ten sam problem u siebie

Mam Trojana Win32:Agent-GSA , komp spowalnia i nic nie da sie zrobic

pomozcie mi go usunac

dla pomocy logi z gmera bo HijackThis sie nie odpala jak polowa .exe

GMER 1.0.12.12244 - http://www.gmer.net Rootkit scan 2007-06-13 15:55:49 Windows 5.1.2600 Dodatek Service Pack 2 ---- System - GMER 1.0.12 ---- SSDT ??\C:\WINDOWS\system32\xpdx.sys ZwCreateKey SSDT \SystemRoot\system32\drivers\iksysflt.sys ZwCreateProcess SSDT \SystemRoot\system32\drivers\iksysflt.sys ZwCreateProcessEx SSDT \SystemRoot\system32\drivers\iksysflt.sys ZwDeleteKey SSDT \SystemRoot\system32\drivers\iksysflt.sys ZwDeleteValueKey SSDT ??\C:\WINDOWS\system32\xpdx.sys ZwOpenKey SSDT \SystemRoot\system32\drivers\iksysflt.sys ZwSetValueKey SSDT ??\C:\WINDOWS\system32\xpdx.sys ZwTerminateProcess SSDT \SystemRoot\system32\drivers\iksysflt.sys ZwWriteVirtualMemory ---- Kernel code sections - GMER 1.0.12 ---- ? C:\WINDOWS\system32\DRIVERS\update.sys ? C:\WINDOWS\system32\xpdx.sys Nie można odnaleźć określonego pliku. ? C:\WINDOWS\system32\Drivers\mchInjDrv.sys Nie można odnaleźć określonego pliku. ---- User code sections - GMER 1.0.12 ---- .text C:\WINDOWS\system32\csrss.exe[508] USER32.dll!SetWindowsHookExW 77D5E621 6 Bytes JMP 5F0A0F5A .text C:\WINDOWS\system32\csrss.exe[508] USER32.dll!SetWindowsHookExA 77D602B2 6 Bytes JMP 5F040F5A .text C:\WINDOWS\system32\csrss.exe[508] KERNEL32.dll!LoadLibraryExW 7C801AF1 6 Bytes JMP 5F070F5A .text C:\WINDOWS\system32\winlogon.exe[536] ntdll.dll!NtCreateFile 7C90D682 5 Bytes CALL 7FF923E7 .text C:\WINDOWS\system32\winlogon.exe[536] ntdll.dll!NtCreateProcess 7C90D754 5 Bytes CALL 7FF92434 .text C:\WINDOWS\system32\winlogon.exe[536] ntdll.dll!NtCreateProcessEx 7C90D769 5 Bytes CALL 7FF92441 .text C:\WINDOWS\system32\winlogon.exe[536] kernel32.dll!LoadLibraryExW 7C801AF1 6 Bytes JMP 5F070F5A .text C:\WINDOWS\system32\winlogon.exe[536] USER32.dll!SetWindowsHookExW 77D5E621 6 Bytes JMP 5F0A0F5A .text C:\WINDOWS\system32\winlogon.exe[536] USER32.dll!SetWindowsHookExA 77D602B2 6 Bytes JMP 5F040F5A .text C:\WINDOWS\system32\services.exe[580] ntdll.dll!NtCreateFile 7C90D682 5 Bytes CALL 7FF923E7 .text C:\WINDOWS\system32\services.exe[580] ntdll.dll!NtCreateProcess 7C90D754 5 Bytes CALL 7FF92434 .text C:\WINDOWS\system32\services.exe[580] ntdll.dll!NtCreateProcessEx 7C90D769 5 Bytes CALL 7FF92441 .text C:\WINDOWS\system32\services.exe[580] kernel32.dll!LoadLibraryExW 7C801AF1 6 Bytes JMP 5F070F5A .text C:\WINDOWS\system32\services.exe[580] USER32.dll!SetWindowsHookExW 77D5E621 6 Bytes JMP 5F0A0F5A .text C:\WINDOWS\system32\services.exe[580] USER32.dll!SetWindowsHookExA 77D602B2 6 Bytes JMP 5F040F5A .text C:\WINDOWS\system32\lsass.exe[592] ntdll.dll!NtCreateFile 7C90D682 5 Bytes CALL 7FF923E7 .text C:\WINDOWS\system32\lsass.exe[592] ntdll.dll!NtCreateProcess 7C90D754 5 Bytes CALL 7FF92434 .text C:\WINDOWS\system32\lsass.exe[592] ntdll.dll!NtCreateProcessEx 7C90D769 5 Bytes CALL 7FF92441 .text C:\WINDOWS\system32\lsass.exe[592] kernel32.dll!LoadLibraryExW 7C801AF1 6 Bytes JMP 5F070F5A .text C:\WINDOWS\system32\lsass.exe[592] USER32.dll!SetWindowsHookExW 77D5E621 6 Bytes JMP 5F0A0F5A .text C:\WINDOWS\system32\lsass.exe[592] USER32.dll!SetWindowsHookExA 77D602B2 6 Bytes JMP 5F040F5A .text C:\WINDOWS\system32\svchost.exe[736] ntdll.dll!NtCreateFile 7C90D682 5 Bytes CALL 7FF923E7 .text C:\WINDOWS\system32\svchost.exe[736] ntdll.dll!NtCreateProcess 7C90D754 5 Bytes CALL 7FF92434 .text C:\WINDOWS\system32\svchost.exe[736] ntdll.dll!NtCreateProcessEx 7C90D769 5 Bytes CALL 7FF92441 .text C:\WINDOWS\system32\svchost.exe[736] kernel32.dll!LoadLibraryExW 7C801AF1 6 Bytes JMP 5F070F5A .text C:\WINDOWS\system32\svchost.exe[736] USER32.dll!SetWindowsHookExW 77D5E621 6 Bytes JMP 5F0A0F5A .text C:\WINDOWS\system32\svchost.exe[736] USER32.dll!SetWindowsHookExA 77D602B2 6 Bytes JMP 5F040F5A .text C:\WINDOWS\system32\svchost.exe[796] ntdll.dll!NtCreateFile 7C90D682 5 Bytes CALL 7FFA23E7 .text C:\WINDOWS\system32\svchost.exe[796] ntdll.dll!NtCreateProcess 7C90D754 5 Bytes CALL 7FFA2434 .text C:\WINDOWS\system32\svchost.exe[796] ntdll.dll!NtCreateProcessEx 7C90D769 5 Bytes CALL 7FFA2441 .text C:\WINDOWS\system32\svchost.exe[796] kernel32.dll!LoadLibraryExW 7C801AF1 6 Bytes JMP 5F070F5A .text C:\WINDOWS\system32\svchost.exe[796] USER32.dll!SetWindowsHookExW 77D5E621 6 Bytes JMP 5F0A0F5A .text C:\WINDOWS\system32\svchost.exe[796] USER32.dll!SetWindowsHookExA 77D602B2 6 Bytes JMP 5F040F5A .text C:\WINDOWS\system32\svchost.exe[828] ntdll.dll!NtCreateFile 7C90D682 5 Bytes CALL 7FF523E7 .text C:\WINDOWS\system32\svchost.exe[828] ntdll.dll!NtCreateProcess 7C90D754 5 Bytes CALL 7FF52434 .text C:\WINDOWS\system32\svchost.exe[828] ntdll.dll!NtCreateProcessEx 7C90D769 5 Bytes CALL 7FF52441 .text C:\WINDOWS\system32\svchost.exe[828] kernel32.dll!LoadLibraryExW 7C801AF1 6 Bytes JMP 5F070F5A .text C:\WINDOWS\system32\svchost.exe[828] USER32.dll!SetWindowsHookExW 77D5E621 6 Bytes JMP 5F0A0F5A .text C:\WINDOWS\system32\svchost.exe[828] USER32.dll!SetWindowsHookExA 77D602B2 6 Bytes JMP 5F040F5A .text C:\WINDOWS\system32\svchost.exe[968] ntdll.dll!NtCreateFile 7C90D682 5 Bytes CALL 7FFA23E7 .text C:\WINDOWS\system32\svchost.exe[968] ntdll.dll!NtCreateProcess 7C90D754 5 Bytes CALL 7FFA2434 .text C:\WINDOWS\system32\svchost.exe[968] ntdll.dll!NtCreateProcessEx 7C90D769 5 Bytes CALL 7FFA2441 .text C:\WINDOWS\system32\svchost.exe[968] kernel32.dll!LoadLibraryExW 7C801AF1 6 Bytes JMP 5F070F5A .text C:\WINDOWS\system32\svchost.exe[968] USER32.dll!SetWindowsHookExW 77D5E621 6 Bytes JMP 5F0A0F5A .text C:\WINDOWS\system32\svchost.exe[968] USER32.dll!SetWindowsHookExA 77D602B2 6 Bytes JMP 5F040F5A .text C:\WINDOWS\explorer.exe[1136] ntdll.dll!NtCreateFile 7C90D682 5 Bytes CALL 7FFA23E7 .text C:\WINDOWS\explorer.exe[1136] ntdll.dll!NtCreateProcess 7C90D754 5 Bytes CALL 7FFA2434 .text C:\WINDOWS\explorer.exe[1136] ntdll.dll!NtCreateProcessEx 7C90D769 5 Bytes CALL 7FFA2441 .text C:\WINDOWS\explorer.exe[1136] kernel32.dll!LoadLibraryExW 7C801AF1 6 Bytes JMP 5F070F5A .text C:\WINDOWS\explorer.exe[1136] USER32.dll!SetWindowsHookExW 77D5E621 6 Bytes JMP 5F0A0F5A .text C:\WINDOWS\explorer.exe[1136] USER32.dll!SetWindowsHookExA 77D602B2 6 Bytes JMP 5F040F5A .text C:\WINDOWS\system32\svchost.exe[1148] ntdll.dll!NtCreateFile 7C90D682 5 Bytes CALL 7FFA23E7 .text C:\WINDOWS\system32\svchost.exe[1148] ntdll.dll!NtCreateProcess 7C90D754 5 Bytes CALL 7FFA2434 .text C:\WINDOWS\system32\svchost.exe[1148] ntdll.dll!NtCreateProcessEx 7C90D769 5 Bytes CALL 7FFA2441 .text C:\WINDOWS\system32\svchost.exe[1148] kernel32.dll!LoadLibraryExW 7C801AF1 6 Bytes JMP 5F070F5A .text C:\WINDOWS\system32\svchost.exe[1148] USER32.dll!SetWindowsHookExW 77D5E621 6 Bytes JMP 5F0A0F5A .text C:\WINDOWS\system32\svchost.exe[1148] USER32.dll!SetWindowsHookExA 77D602B2 6 Bytes JMP 5F040F5A .text C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe[1244] ntdll.dll!NtCreateFile 7C90D682 5 Bytes CALL 7FFA23E7 .text C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe[1244] ntdll.dll!NtCreateProcess 7C90D754 5 Bytes CALL 7FFA2434 .text C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe[1244] ntdll.dll!NtCreateProcessEx 7C90D769 5 Bytes CALL 7FFA2441 .text C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe[1244] kernel32.dll!LoadLibraryExW 7C801AF1 6 Bytes JMP 5F070F5A .text C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe[1244] USER32.dll!SetWindowsHookExW 77D5E621 6 Bytes JMP 5F0A0F5A .text C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe[1244] USER32.dll!SetWindowsHookExA 77D602B2 6 Bytes JMP 5F040F5A .text C:\Program Files\Alwil Software\Avast4\ashServ.exe[1304] ntdll.dll!NtCreateFile 7C90D682 5 Bytes CALL 7FF923E7 .text C:\Program Files\Alwil Software\Avast4\ashServ.exe[1304] ntdll.dll!NtCreateProcess 7C90D754 5 Bytes CALL 7FF92434 .text C:\Program Files\Alwil Software\Avast4\ashServ.exe[1304] ntdll.dll!NtCreateProcessEx 7C90D769 5 Bytes CALL 7FF92441 .text C:\Program Files\Alwil Software\Avast4\ashServ.exe[1304] kernel32.dll!LoadLibraryExW 7C801AF1 6 Bytes JMP 5F070F5A .text C:\Program Files\Alwil Software\Avast4\ashServ.exe[1304] USER32.dll!SetWindowsHookExW 77D5E621 6 Bytes JMP 5F0A0F5A .text C:\Program Files\Alwil Software\Avast4\ashServ.exe[1304] USER32.dll!SetWindowsHookExA 77D602B2 6 Bytes JMP 5F040F5A .text C:\WINDOWS\system32\spoolsv.exe[1512] ntdll.dll!NtCreateFile 7C90D682 5 Bytes CALL 7FFA23E7 .text C:\WINDOWS\system32\spoolsv.exe[1512] ntdll.dll!NtCreateProcess 7C90D754 5 Bytes CALL 7FFA2434 .text C:\WINDOWS\system32\spoolsv.exe[1512] ntdll.dll!NtCreateProcessEx 7C90D769 5 Bytes CALL 7FFA2441 .text C:\WINDOWS\system32\spoolsv.exe[1512] kernel32.dll!LoadLibraryExW 7C801AF1 6 Bytes JMP 5F070F5A .text C:\WINDOWS\system32\spoolsv.exe[1512] USER32.dll!SetWindowsHookExW 77D5E621 6 Bytes JMP 5F0A0F5A .text C:\WINDOWS\system32\spoolsv.exe[1512] USER32.dll!SetWindowsHookExA 77D602B2 6 Bytes JMP 5F040F5A .text C:\Program Files\Alwil Software\Avast4\ashWebSv.exe[1628] ntdll.dll!NtCreateFile 7C90D682 5 Bytes CALL 7FF923E7 .text C:\Program Files\Alwil Software\Avast4\ashWebSv.exe[1628] ntdll.dll!NtCreateProcess 7C90D754 5 Bytes CALL 7FF92434 .text C:\Program Files\Alwil Software\Avast4\ashWebSv.exe[1628] ntdll.dll!NtCreateProcessEx 7C90D769 5 Bytes CALL 7FF92441 .text C:\Program Files\Alwil Software\Avast4\ashWebSv.exe[1628] kernel32.dll!LoadLibraryExW 7C801AF1 6 Bytes JMP 5F070F5A .text C:\Program Files\Alwil Software\Avast4\ashWebSv.exe[1628] kernel32.dll!FreeLibrary + 15 7C80AA7B 4 Bytes [BD, 55, EF, F4] .text C:\Program Files\Alwil Software\Avast4\ashWebSv.exe[1628] USER32.dll!SetWindowsHookExW 77D5E621 6 Bytes JMP 5F0A0F5A .text C:\Program Files\Alwil Software\Avast4\ashWebSv.exe[1628] USER32.dll!SetWindowsHookExA 77D602B2 6 Bytes JMP 5F040F5A .text C:\WINDOWS\system32\FTRTSVC.exe[1640] ntdll.dll!NtCreateFile 7C90D682 5 Bytes CALL 7FFA23E7 .text C:\WINDOWS\system32\FTRTSVC.exe[1640] ntdll.dll!NtCreateProcess 7C90D754 5 Bytes CALL 7FFA2434 .text C:\WINDOWS\system32\FTRTSVC.exe[1640] ntdll.dll!NtCreateProcessEx 7C90D769 5 Bytes CALL 7FFA2441 .text C:\WINDOWS\system32\FTRTSVC.exe[1640] kernel32.dll!LoadLibraryExW 7C801AF1 6 Bytes JMP 5F070F5A .text C:\WINDOWS\system32\FTRTSVC.exe[1640] USER32.dll!SetWindowsHookExW 77D5E621 6 Bytes JMP 5F0A0F5A .text C:\WINDOWS\system32\FTRTSVC.exe[1640] USER32.dll!SetWindowsHookExA 77D602B2 6 Bytes JMP 5F040F5A .text C:\Program Files\Alwil Software\Avast4\ashDisp.exe[1648] ntdll.dll!NtCreateFile 7C90D682 5 Bytes CALL 7FFA23E7 .text C:\Program Files\Alwil Software\Avast4\ashDisp.exe[1648] ntdll.dll!NtCreateProcess 7C90D754 5 Bytes CALL 7FFA2434 .text C:\Program Files\Alwil Software\Avast4\ashDisp.exe[1648] ntdll.dll!NtCreateProcessEx 7C90D769 5 Bytes CALL 7FFA2441 .text C:\Program Files\Alwil Software\Avast4\ashDisp.exe[1648] kernel32.dll!LoadLibraryExW 7C801AF1 6 Bytes JMP 5F070F5A .text C:\Program Files\Alwil Software\Avast4\ashDisp.exe[1648] USER32.dll!SetWindowsHookExW 77D5E621 6 Bytes JMP 5F0A0F5A .text C:\Program Files\Alwil Software\Avast4\ashDisp.exe[1648] USER32.dll!SetWindowsHookExA 77D602B2 6 Bytes JMP 5F040F5A .text C:\PROGRA~1\NEOSTR~1\TaskBarIcon.exe[1840] ntdll.dll!NtCreateFile 7C90D682 5 Bytes CALL 7FFA23E7 .text C:\PROGRA~1\NEOSTR~1\TaskBarIcon.exe[1840] ntdll.dll!NtCreateProcess 7C90D754 5 Bytes CALL 7FFA2434 .text C:\PROGRA~1\NEOSTR~1\TaskBarIcon.exe[1840] ntdll.dll!NtCreateProcessEx 7C90D769 5 Bytes CALL 7FFA2441 .text C:\PROGRA~1\NEOSTR~1\TaskBarIcon.exe[1840] kernel32.dll!LoadLibraryExW 7C801AF1 6 Bytes JMP 5F070F5A .text C:\PROGRA~1\NEOSTR~1\TaskBarIcon.exe[1840] USER32.dll!SetWindowsHookExW 77D5E621 6 Bytes JMP 5F0A0F5A .text C:\PROGRA~1\NEOSTR~1\TaskBarIcon.exe[1840] USER32.dll!SetWindowsHookExA 77D602B2 6 Bytes JMP 5F040F5A .text C:\WINDOWS\soundman.exe[1856] ntdll.dll!NtCreateFile 7C90D682 5 Bytes CALL 7FFA23E7 .text C:\WINDOWS\soundman.exe[1856] ntdll.dll!NtCreateProcess 7C90D754 5 Bytes CALL 7FFA2434 .text C:\WINDOWS\soundman.exe[1856] ntdll.dll!NtCreateProcessEx 7C90D769 5 Bytes CALL 7FFA2441 .text C:\WINDOWS\soundman.exe[1856] kernel32.dll!LoadLibraryExW 7C801AF1 6 Bytes JMP 5F070F5A .text C:\WINDOWS\soundman.exe[1856] USER32.dll!SetWindowsHookExW 77D5E621 6 Bytes JMP 5F0A0F5A .text C:\WINDOWS\soundman.exe[1856] USER32.dll!SetWindowsHookExA 77D602B2 6 Bytes JMP 5F040F5A .text C:\WINDOWS\system32\ctfmon.exe[1868] ntdll.dll!NtCreateFile 7C90D682 5 Bytes CALL 7FFA23E7 .text C:\WINDOWS\system32\ctfmon.exe[1868] ntdll.dll!NtCreateProcess 7C90D754 5 Bytes CALL 7FFA2434 .text C:\WINDOWS\system32\ctfmon.exe[1868] ntdll.dll!NtCreateProcessEx 7C90D769 5 Bytes CALL 7FFA2441 .text C:\WINDOWS\system32\ctfmon.exe[1868] kernel32.dll!LoadLibraryExW 7C801AF1 6 Bytes JMP 5F070F5A .text C:\WINDOWS\system32\ctfmon.exe[1868] USER32.dll!SetWindowsHookExW 77D5E621 6 Bytes JMP 5F0A0F5A .text C:\WINDOWS\system32\ctfmon.exe[1868] USER32.dll!SetWindowsHookExA 77D602B2 6 Bytes JMP 5F040F5A .text C:\Program Files\AutoConnect\AutoConnect.exe[1876] ntdll.dll!NtCreateFile 7C90D682 5 Bytes CALL 7FFA23E7 .text C:\Program Files\AutoConnect\AutoConnect.exe[1876] ntdll.dll!NtCreateProcess 7C90D754 5 Bytes CALL 7FFA2434 .text C:\Program Files\AutoConnect\AutoConnect.exe[1876] ntdll.dll!NtCreateProcessEx 7C90D769 5 Bytes CALL 7FFA2441 .text C:\Program Files\AutoConnect\AutoConnect.exe[1876] kernel32.dll!LoadLibraryExW 7C801AF1 6 Bytes JMP 5F070F5A .text C:\Program Files\AutoConnect\AutoConnect.exe[1876] USER32.dll!SetWindowsHookExW 77D5E621 6 Bytes JMP 5F0A0F5A .text C:\Program Files\AutoConnect\AutoConnect.exe[1876] USER32.dll!SetWindowsHookExA 77D602B2 6 Bytes JMP 5F040F5A .text C:\WINDOWS\system32\alg.exe[2404] ntdll.dll!NtCreateFile 7C90D682 5 Bytes CALL 7FFA23E7 .text C:\WINDOWS\system32\alg.exe[2404] ntdll.dll!NtCreateProcess 7C90D754 5 Bytes CALL 7FFA2434 .text C:\WINDOWS\system32\alg.exe[2404] ntdll.dll!NtCreateProcessEx 7C90D769 5 Bytes CALL 7FFA2441 .text C:\WINDOWS\system32\alg.exe[2404] kernel32.dll!LoadLibraryExW 7C801AF1 6 Bytes JMP 5F070F5A .text C:\WINDOWS\system32\alg.exe[2404] kernel32.dll!FreeLibrary + 15 7C80AA7B 4 Bytes [BD, 55, EF, F4] .text C:\WINDOWS\system32\alg.exe[2404] USER32.dll!SetWindowsHookExW 77D5E621 6 Bytes JMP 5F0A0F5A .text C:\WINDOWS\system32\alg.exe[2404] USER32.dll!SetWindowsHookExA 77D602B2 6 Bytes JMP 5F040F5A .text C:\Documents and Settings\PAWEŁ\Pulpit\gmer.exe[2688] ntdll.dll!NtCreateFile 7C90D682 5 Bytes CALL 7FFA23E7 .text C:\Documents and Settings\PAWEŁ\Pulpit\gmer.exe[2688] kernel32.dll!LoadLibraryExW 7C801AF1 6 Bytes JMP 5F070F5A .text C:\Documents and Settings\PAWEŁ\Pulpit\gmer.exe[2688] kernel32.dll!FreeLibrary + 15 7C80AA7B 4 Bytes [BD, 55, EF, F4] .text C:\Documents and Settings\PAWEŁ\Pulpit\gmer.exe[2688] USER32.dll!SetWindowsHookExW 77D5E621 6 Bytes JMP 5F0A0F5A .text C:\Documents and Settings\PAWEŁ\Pulpit\gmer.exe[2688] USER32.dll!SetWindowsHookExA 77D602B2 6 Bytes JMP 5F040F5A .text C:\Program Files\xchat\xchat.exe[2940] ntdll.dll!NtCreateFile 7C90D682 5 Bytes CALL 7FFA23E7 .text C:\Program Files\xchat\xchat.exe[2940] ntdll.dll!NtCreateProcess 7C90D754 5 Bytes CALL 7FFA2434 .text C:\Program Files\xchat\xchat.exe[2940] ntdll.dll!NtCreateProcessEx 7C90D769 5 Bytes CALL 7FFA2441 .text C:\Program Files\xchat\xchat.exe[2940] kernel32.dll!LoadLibraryExW 7C801AF1 6 Bytes JMP 5F070F5A .text C:\Program Files\xchat\xchat.exe[2940] kernel32.dll!FreeLibrary + 15 7C80AA7B 4 Bytes [BD, 55, EF, F4] .text C:\Program Files\xchat\xchat.exe[2940] USER32.dll!SetWindowsHookExW 77D5E621 6 Bytes JMP 5F0A0F5A .text C:\Program Files\xchat\xchat.exe[2940] USER32.dll!SetWindowsHookExA 77D602B2 6 Bytes JMP 5F040F5A .text C:\Program Files\Opera\Opera.exe[3012] ntdll.dll!NtCreateFile 7C90D682 5 Bytes CALL 7FFA23E7 .text C:\Program Files\Opera\Opera.exe[3012] ntdll.dll!NtCreateProcess 7C90D754 5 Bytes CALL 7FFA2434 .text C:\Program Files\Opera\Opera.exe[3012] ntdll.dll!NtCreateProcessEx 7C90D769 5 Bytes CALL 7FFA2441 .text C:\Program Files\Opera\Opera.exe[3012] kernel32.dll!LoadLibraryExW 7C801AF1 6 Bytes JMP 5F070F5A .text C:\Program Files\Opera\Opera.exe[3012] kernel32.dll!FreeLibrary + 15 7C80AA7B 4 Bytes [BD, 55, EF, F4] .text C:\Program Files\Opera\Opera.exe[3012] user32.dll!SetWindowsHookExW 77D5E621 6 Bytes JMP 5F0A0F5A .text C:\Program Files\Opera\Opera.exe[3012] user32.dll!SetWindowsHookExA 77D602B2 6 Bytes JMP 5F040F5A .text C:\WINDOWS\system32\svchost.exe[3440] ntdll.dll!NtCreateFile 7C90D682 5 Bytes CALL 7FFA23E7 .text C:\WINDOWS\system32\svchost.exe[3440] ntdll.dll!NtCreateProcess 7C90D754 5 Bytes CALL 7FFA2434 .text C:\WINDOWS\system32\svchost.exe[3440] ntdll.dll!NtCreateProcessEx 7C90D769 5 Bytes CALL 7FFA2441 .text C:\WINDOWS\system32\svchost.exe[3440] kernel32.dll!LoadLibraryExW 7C801AF1 6 Bytes JMP 5F070F5A .text C:\WINDOWS\system32\svchost.exe[3440] kernel32.dll!FreeLibrary + 15 7C80AA7B 4 Bytes [BD, 55, EF, F4] .text C:\WINDOWS\system32\svchost.exe[3440] USER32.dll!SetWindowsHookExW 77D5E621 6 Bytes JMP 5F0A0F5A .text C:\WINDOWS\system32\svchost.exe[3440] USER32.dll!SetWindowsHookExA 77D602B2 6 Bytes JMP 5F040F5A .text C:\WINDOWS\system32\svchost.exe[3572] ntdll.dll!NtCreateFile 7C90D682 5 Bytes CALL 7FFA23E7 .text C:\WINDOWS\system32\svchost.exe[3572] ntdll.dll!NtCreateProcess 7C90D754 5 Bytes CALL 7FFA2434 .text C:\WINDOWS\system32\svchost.exe[3572] ntdll.dll!NtCreateProcessEx 7C90D769 5 Bytes CALL 7FFA2441 .text C:\WINDOWS\system32\svchost.exe[3572] kernel32.dll!LoadLibraryExW 7C801AF1 6 Bytes JMP 5F070F5A .text C:\WINDOWS\system32\svchost.exe[3572] kernel32.dll!FreeLibrary + 15 7C80AA7B 4 Bytes [BD, 55, EF, F4] .text C:\WINDOWS\system32\svchost.exe[3572] USER32.dll!SetWindowsHookExW 77D5E621 6 Bytes JMP 5F0A0F5A .text C:\WINDOWS\system32\svchost.exe[3572] USER32.dll!SetWindowsHookExA 77D602B2 6 Bytes JMP 5F040F5A ---- Devices - GMER 1.0.12 ---- Device \FileSystem\Ntfs \Ntfs IRP_MJ_CREATE [F78D206B] xpdx.sys ---- Registry - GMER 1.0.12 ---- Reg \Registry\MACHINE\SYSTEM\ControlSet001\Services\xpdx@Type 1 Reg \Registry\MACHINE\SYSTEM\ControlSet001\Services\xpdx@Start 1 Reg \Registry\MACHINE\SYSTEM\ControlSet001\Services\xpdx@ErrorControl 0 Reg \Registry\MACHINE\SYSTEM\ControlSet001\Services\xpdx@ImagePath ??\C:\WINDOWS\system32\xpdx.sys Reg \Registry\MACHINE\SYSTEM\ControlSet001\Services\xpdx@DisplayName xpdx system driver Reg \Registry\MACHINE\SYSTEM\ControlSet001\Services\xpdx@Group Base Reg \Registry\MACHINE\SYSTEM\ControlSet001\Services\xpdx@ExtParamX 0xA9 0x17 0xDA 0xE0 … Reg \Registry\MACHINE\SYSTEM\ControlSet001\Services\xpdx@Checked 1 Reg \Registry\MACHINE\SYSTEM\ControlSet001\Services\xpdx\Security Reg \Registry\MACHINE\SYSTEM\ControlSet001\Services\xpdx@Type 1 Reg \Registry\MACHINE\SYSTEM\ControlSet001\Services\xpdx@Start 1 Reg \Registry\MACHINE\SYSTEM\ControlSet001\Services\xpdx@ErrorControl 0 Reg \Registry\MACHINE\SYSTEM\ControlSet001\Services\xpdx@ImagePath ??\C:\WINDOWS\system32\xpdx.sys Reg \Registry\MACHINE\SYSTEM\ControlSet001\Services\xpdx@DisplayName xpdx system driver Reg \Registry\MACHINE\SYSTEM\ControlSet001\Services\xpdx@Group Base Reg \Registry\MACHINE\SYSTEM\ControlSet001\Services\xpdx@ExtParamX 0xA9 0x17 0xDA 0xE0 … Reg \Registry\MACHINE\SYSTEM\ControlSet001\Services\xpdx@Checked 1 Reg \Registry\MACHINE\SYSTEM\ControlSet001\Services\xpdx\Enum Reg \Registry\MACHINE\SYSTEM\ControlSet001\Services\xpdx@Type 1 Reg \Registry\MACHINE\SYSTEM\ControlSet001\Services\xpdx@Start 1 Reg \Registry\MACHINE\SYSTEM\ControlSet001\Services\xpdx@ErrorControl 0 Reg \Registry\MACHINE\SYSTEM\ControlSet001\Services\xpdx@ImagePath ??\C:\WINDOWS\system32\xpdx.sys Reg \Registry\MACHINE\SYSTEM\ControlSet001\Services\xpdx@DisplayName xpdx system driver Reg \Registry\MACHINE\SYSTEM\ControlSet001\Services\xpdx@Group Base Reg \Registry\MACHINE\SYSTEM\ControlSet001\Services\xpdx@ExtParamX 0xA9 0x17 0xDA 0xE0 … Reg \Registry\MACHINE\SYSTEM\ControlSet001\Services\xpdx@Checked 1 Reg \Registry\MACHINE\SYSTEM\ControlSet002\Services\xpdx@Type 1 Reg \Registry\MACHINE\SYSTEM\ControlSet002\Services\xpdx@Start 1 Reg \Registry\MACHINE\SYSTEM\ControlSet002\Services\xpdx@ErrorControl 0 Reg \Registry\MACHINE\SYSTEM\ControlSet002\Services\xpdx@ImagePath ??\C:\WINDOWS\system32\xpdx.sys Reg \Registry\MACHINE\SYSTEM\ControlSet002\Services\xpdx@DisplayName xpdx system driver Reg \Registry\MACHINE\SYSTEM\ControlSet002\Services\xpdx@Group Base Reg \Registry\MACHINE\SYSTEM\ControlSet002\Services\xpdx@ExtParamX 0xA9 0x17 0xDA 0xE0 … Reg \Registry\MACHINE\SYSTEM\ControlSet002\Services\xpdx@Checked 1 Reg \Registry\MACHINE\SYSTEM\ControlSet002\Services\xpdx\Security Reg \Registry\MACHINE\SYSTEM\ControlSet002\Services\xpdx@Type 1 Reg \Registry\MACHINE\SYSTEM\ControlSet002\Services\xpdx@Start 1 Reg \Registry\MACHINE\SYSTEM\ControlSet002\Services\xpdx@ErrorControl 0 Reg \Registry\MACHINE\SYSTEM\ControlSet002\Services\xpdx@ImagePath ??\C:\WINDOWS\system32\xpdx.sys Reg \Registry\MACHINE\SYSTEM\ControlSet002\Services\xpdx@DisplayName xpdx system driver Reg \Registry\MACHINE\SYSTEM\ControlSet002\Services\xpdx@Group Base Reg \Registry\MACHINE\SYSTEM\ControlSet002\Services\xpdx@ExtParamX 0xA9 0x17 0xDA 0xE0 … Reg \Registry\MACHINE\SYSTEM\ControlSet002\Services\xpdx@Checked 1 Reg \Registry\MACHINE\SYSTEM\CurrentControlSet\Services\xpdx@Type 1 Reg \Registry\MACHINE\SYSTEM\CurrentControlSet\Services\xpdx@Start 1 Reg \Registry\MACHINE\SYSTEM\CurrentControlSet\Services\xpdx@ErrorControl 0 Reg \Registry\MACHINE\SYSTEM\CurrentControlSet\Services\xpdx@ImagePath ??\C:\WINDOWS\system32\xpdx.sys Reg \Registry\MACHINE\SYSTEM\CurrentControlSet\Services\xpdx@DisplayName xpdx system driver Reg \Registry\MACHINE\SYSTEM\CurrentControlSet\Services\xpdx@Group Base Reg \Registry\MACHINE\SYSTEM\CurrentControlSet\Services\xpdx@ExtParamX 0xA9 0x17 0xDA 0xE0 … Reg \Registry\MACHINE\SYSTEM\CurrentControlSet\Services\xpdx@Checked 1 Reg \Registry\MACHINE\SYSTEM\CurrentControlSet\Services\xpdx\Security Reg \Registry\MACHINE\SYSTEM\CurrentControlSet\Services\xpdx@Type 1 Reg \Registry\MACHINE\SYSTEM\CurrentControlSet\Services\xpdx@Start 1 Reg \Registry\MACHINE\SYSTEM\CurrentControlSet\Services\xpdx@ErrorControl 0 Reg \Registry\MACHINE\SYSTEM\CurrentControlSet\Services\xpdx@ImagePath ??\C:\WINDOWS\system32\xpdx.sys Reg \Registry\MACHINE\SYSTEM\CurrentControlSet\Services\xpdx@DisplayName xpdx system driver Reg \Registry\MACHINE\SYSTEM\CurrentControlSet\Services\xpdx@Group Base Reg \Registry\MACHINE\SYSTEM\CurrentControlSet\Services\xpdx@ExtParamX 0xA9 0x17 0xDA 0xE0 … Reg \Registry\MACHINE\SYSTEM\CurrentControlSet\Services\xpdx@Checked 1 Reg \Registry\MACHINE\SYSTEM\CurrentControlSet\Services\xpdx\Enum Reg \Registry\MACHINE\SYSTEM\CurrentControlSet\Services\xpdx@Type 1 Reg \Registry\MACHINE\SYSTEM\CurrentControlSet\Services\xpdx@Start 1 Reg \Registry\MACHINE\SYSTEM\CurrentControlSet\Services\xpdx@ErrorControl 0 Reg \Registry\MACHINE\SYSTEM\CurrentControlSet\Services\xpdx@ImagePath ??\C:\WINDOWS\system32\xpdx.sys Reg \Registry\MACHINE\SYSTEM\CurrentControlSet\Services\xpdx@DisplayName xpdx system driver Reg \Registry\MACHINE\SYSTEM\CurrentControlSet\Services\xpdx@Group Base Reg \Registry\MACHINE\SYSTEM\CurrentControlSet\Services\xpdx@ExtParamX 0xA9 0x17 0xDA 0xE0 … Reg \Registry\MACHINE\SYSTEM\CurrentControlSet\Services\xpdx@Checked 1 ---- EOF - GMER 1.0.12 ----

Złączono Posta : 13.06.2007 (Sro) 15:59

oraz same uslugi

GMER 1.0.12.12244 - http://www.gmer.net Rootkit scan 2007-06-13 15:57:24 Windows 5.1.2600 Dodatek Service Pack 2 ---- Services - GMER 1.0.12 ---- Service [sYSTEM] Aavmker4 Service [DISABLED] Abiosdsk Service [DISABLED] abp480n5 Service C:\WINDOWS\system32\DRIVERS\ACPI.sys [bOOT] ACPI Service [DISABLED] ACPIEC Service [DISABLED] adpu160m Service C:\WINDOWS\system32\drivers\aec.sys [MANUAL] aec Service C:\WINDOWS\System32\drivers\afd.sys [sYSTEM] AFD Service [DISABLED] Aha154x Service [DISABLED] aic78u2 Service [DISABLED] aic78xx Service C:\WINDOWS\system32\drivers\ALCXWDM.SYS [MANUAL] ALCXWDM Service C:\WINDOWS\system32\svchost.exe [DISABLED] Alerter Service C:\WINDOWS\System32\alg.exe [MANUAL] ALG Service [DISABLED] AliIde Service C:\WINDOWS\system32\DRIVERS\amdk7.sys [sYSTEM] AmdK7 Service [DISABLED] amsint Service C:\WINDOWS\system32\svchost.exe [MANUAL] AppMgmt Service [DISABLED] asc Service [DISABLED] asc3350p Service [DISABLED] asc3550 Service [AUTO] aswMon2 Service [MANUAL] aswRdr Service [sYSTEM] aswTdi Service C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe [AUTO] aswUpdSv Service C:\WINDOWS\system32\DRIVERS\asyncmac.sys [MANUAL] AsyncMac Service C:\WINDOWS\system32\DRIVERS\atapi.sys [bOOT] atapi Service [DISABLED] Atdisk Service C:\WINDOWS\system32\DRIVERS\atmarpc.sys [MANUAL] Atmarpc Service C:\WINDOWS\System32\svchost.exe [AUTO] AudioSrv Service C:\WINDOWS\system32\DRIVERS\audstub.sys [MANUAL] audstub Service C:\Program Files\Alwil Software\Avast4\ashServ.exe [AUTO] avast! Antivirus Service C:\Program Files\Alwil Software\Avast4\ashWebSv.exe [MANUAL] avast! Web Scanner Service BattC Service [sYSTEM] Beep Service C:\WINDOWS\system32\svchost.exe [MANUAL] BITS Service C:\WINDOWS\system32\svchost.exe [AUTO] Browser Service [DISABLED] cbidf2k Service [DISABLED] cd20xrnt Service [sYSTEM] Cdaudio Service [DISABLED] Cdfs Service C:\WINDOWS\system32\DRIVERS\cdrom.sys [sYSTEM] Cdrom Service [sYSTEM] Changer Service C:\WINDOWS\system32\cisvc.exe [MANUAL] CiSvc Service C:\WINDOWS\system32\clipsrv.exe [DISABLED] ClipSrv Service [DISABLED] CmdIde Service C:\WINDOWS\system32\dllhost.exe [MANUAL] COMSysApp Service ContentFilter Service ContentIndex Service [DISABLED] Cpqarray Service C:\WINDOWS\system32\svchost.exe [AUTO] CryptSvc Service [DISABLED] dac2w2k Service [DISABLED] dac960nt Service C:\WINDOWS\system32\svchost.exe [AUTO] DcomLaunch Service C:\WINDOWS\system32\svchost.exe [AUTO] Dhcp Service C:\WINDOWS\system32\DRIVERS\disk.sys [bOOT] Disk Service C:\WINDOWS\System32\dmadmin.exe [MANUAL] dmadmin Service C:\WINDOWS\System32\drivers\dmboot.sys [DISABLED] dmboot Service C:\WINDOWS\System32\drivers\dmio.sys [bOOT] dmio Service C:\WINDOWS\System32\drivers\dmload.sys [bOOT] dmload Service C:\WINDOWS\System32\svchost.exe [AUTO] dmserver Service C:\WINDOWS\system32\drivers\DMusic.sys [MANUAL] DMusic Service C:\WINDOWS\system32\svchost.exe [AUTO] Dnscache Service [DISABLED] dpti2o Service C:\WINDOWS\system32\drivers\drmkaud.sys [MANUAL] drmkaud Service C:\WINDOWS\system32\DRIVERS\e4usbaw.sys [MANUAL] e4usbaw Service C:\WINDOWS\System32\svchost.exe [AUTO] ERSvc Service C:\WINDOWS\system32\services.exe [AUTO] Eventlog Service C:\WINDOWS\system32\svchost.exe [MANUAL] EventSystem Service [DISABLED] Fastfat Service C:\WINDOWS\System32\svchost.exe [MANUAL] FastUserSwitchingCompatibility Service C:\WINDOWS\system32\DRIVERS\fdc.sys [MANUAL] Fdc Service [sYSTEM] Fips Service C:\WINDOWS\system32\DRIVERS\flpydisk.sys [MANUAL] Flpydisk Service C:\WINDOWS\system32\DRIVERS\fltMgr.sys [bOOT] FltMgr Service [sYSTEM] Fs_Rec Service C:\WINDOWS\system32\DRIVERS\ftdisk.sys [bOOT] Ftdisk Service C:\WINDOWS\System32\FTRTSVC.exe [AUTO] FTRTSVC Service C:\WINDOWS\system32\DRIVERS\gagp30kx.sys [bOOT] gagp30kx Service C:\WINDOWS\system32\DRIVERS\gameenum.sys [MANUAL] gameenum Service C:\WINDOWS\System32\DRIVERS\gmer.sys [MANUAL] gmer Service C:\WINDOWS\system32\DRIVERS\msgpc.sys [MANUAL] Gpc Service C:\WINDOWS\System32\svchost.exe [AUTO] helpsvc Service C:\WINDOWS\System32\svchost.exe [DISABLED] HidServ Service [DISABLED] hpn Service C:\WINDOWS\System32\Drivers\HTTP.sys [MANUAL] HTTP Service C:\WINDOWS\System32\svchost.exe [MANUAL] HTTPFilter Service [sYSTEM] i2omgmt Service [DISABLED] i2omp Service C:\WINDOWS\system32\DRIVERS\i8042prt.sys [sYSTEM] i8042prt Service C:\WINDOWS\System32\Drivers\e4ldr.sys [AUTO] IKANLOADER2 Service C:\WINDOWS\system32\drivers\ikfileflt.sys [sYSTEM] IKFileFlt Service C:\WINDOWS\system32\drivers\ikfilesec.sys [sYSTEM] IKFileSec Service C:\WINDOWS\system32\drivers\iksysflt.sys [sYSTEM] IkSysFlt Service C:\WINDOWS\system32\drivers\iksyssec.sys [sYSTEM] IKSysSec Service C:\WINDOWS\system32\DRIVERS\imapi.sys [sYSTEM] Imapi Service C:\WINDOWS\system32\imapi.exe [MANUAL] ImapiService Service inetaccs Service [DISABLED] ini910u Service Inport Service [DISABLED] IntelIde Service C:\WINDOWS\system32\DRIVERS\Ip6Fw.sys [MANUAL] Ip6Fw Service C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys [MANUAL] IpFilterDriver Service C:\WINDOWS\system32\DRIVERS\ipinip.sys [MANUAL] IpInIp Service C:\WINDOWS\system32\DRIVERS\ipnat.sys [MANUAL] IpNat Service C:\WINDOWS\system32\DRIVERS\ipsec.sys [sYSTEM] IPSec Service C:\WINDOWS\system32\DRIVERS\irenum.sys [MANUAL] IRENUM Service ISAPISearch Service C:\WINDOWS\system32\DRIVERS\isapnp.sys [bOOT] isapnp Service C:\WINDOWS\system32\DRIVERS\kbdclass.sys [sYSTEM] Kbdclass Service C:\WINDOWS\system32\drivers\kmixer.sys [MANUAL] kmixer Service [bOOT] KSecDD Service C:\WINDOWS\system32\svchost.exe [AUTO] lanmanserver Service C:\WINDOWS\system32\svchost.exe [AUTO] lanmanworkstation Service [sYSTEM] lbrtfdc Service ldap Service LicenseService Service C:\WINDOWS\system32\svchost.exe [AUTO] LmHosts Service C:\WINDOWS\system32\svchost.exe [DISABLED] Messenger Service [sYSTEM] mnmdd Service C:\WINDOWS\system32\mnmsrvc.exe [MANUAL] mnmsrvc Service [MANUAL] Modem Service C:\WINDOWS\system32\DRIVERS\mouclass.sys [sYSTEM] Mouclass Service [bOOT] MountMgr Service [DISABLED] mraid35x Service C:\WINDOWS\system32\DRIVERS\mrxdav.sys [MANUAL] MRxDAV Service C:\WINDOWS\system32\DRIVERS\mrxsmb.sys [sYSTEM] MRxSmb Service C:\WINDOWS\system32\msdtc.exe [MANUAL] MSDTC Service [sYSTEM] Msfs Service C:\WINDOWS\system32\msiexec.exe [MANUAL] MSIServer Service C:\WINDOWS\system32\drivers\MSKSSRV.sys [MANUAL] MSKSSRV Service C:\WINDOWS\system32\drivers\MSPCLOCK.sys [MANUAL] MSPCLOCK Service C:\WINDOWS\system32\drivers\MSPQM.sys [MANUAL] MSPQM Service C:\WINDOWS\system32\DRIVERS\mssmbios.sys [MANUAL] mssmbios Service C:\WINDOWS\system32\drivers\msmpu401.sys [MANUAL] ms_mpu401 Service [bOOT] Mup Service [bOOT] NDIS Service C:\WINDOWS\system32\DRIVERS\ndistapi.sys [MANUAL] NdisTapi Service C:\WINDOWS\system32\DRIVERS\ndisuio.sys [MANUAL] Ndisuio Service C:\WINDOWS\system32\DRIVERS\ndiswan.sys [MANUAL] NdisWan Service [MANUAL] NDProxy Service C:\WINDOWS\system32\DRIVERS\netbios.sys [sYSTEM] NetBIOS Service C:\WINDOWS\system32\DRIVERS\netbt.sys [MANUAL] NetBT Service C:\WINDOWS\system32\netdde.exe [DISABLED] NetDDE Service C:\WINDOWS\system32\netdde.exe [DISABLED] NetDDEdsdm Service C:\WINDOWS\system32\lsass.exe [MANUAL] Netlogon Service C:\WINDOWS\System32\svchost.exe [MANUAL] Netman Service C:\WINDOWS\system32\svchost.exe [MANUAL] Nla Service [sYSTEM] Npfs Service [DISABLED] Ntfs Service C:\WINDOWS\system32\lsass.exe [MANUAL] NtLmSsp Service C:\WINDOWS\system32\svchost.exe [MANUAL] NtmsSvc Service [sYSTEM] Null Service C:\WINDOWS\system32\DRIVERS\nv4_mini.sys [MANUAL] nv Service C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys [MANUAL] NwlnkFlt Service C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys [MANUAL] NwlnkFwd Service C:\WINDOWS\system32\DRIVERS\parport.sys [MANUAL] Parport Service [bOOT] PartMgr Service [AUTO] ParVdm Service C:\WINDOWS\system32\PCAMPR5.SYS [MANUAL] PCAMPR5 Service C:\WINDOWS\system32\PCANDIS5.SYS [MANUAL] PCANDIS5 Service C:\WINDOWS\system32\DRIVERS\pci.sys [bOOT] PCI Service [sYSTEM] PCIDump Service C:\WINDOWS\system32\DRIVERS\pciide.sys [bOOT] PCIIde Service [DISABLED] Pcmcia Service [MANUAL] PDCOMP Service [MANUAL] PDFRAME Service [MANUAL] PDRELI Service [MANUAL] PDRFRAME Service [DISABLED] perc2 Service [DISABLED] perc2hib Service PerfDisk Service PerfNet Service PerfOS Service PerfProc Service C:\WINDOWS\system32\services.exe [AUTO] PlugPlay Service C:\WINDOWS\system32\lsass.exe [AUTO] PolicyAgent Service C:\WINDOWS\system32\DRIVERS\raspptp.sys [MANUAL] PptpMiniport Service C:\WINDOWS\system32\lsass.exe [AUTO] ProtectedStorage Service C:\WINDOWS\system32\DRIVERS\psched.sys [MANUAL] PSched Service C:\WINDOWS\system32\DRIVERS\ptilink.sys [MANUAL] Ptilink Service [DISABLED] ql1080 Service [DISABLED] Ql10wnt Service [DISABLED] ql12160 Service [DISABLED] ql1240 Service [DISABLED] ql1280 Service C:\WINDOWS\system32\DRIVERS\rasacd.sys [sYSTEM] RasAcd Service C:\WINDOWS\system32\svchost.exe [MANUAL] RasAuto Service C:\WINDOWS\system32\DRIVERS\rasl2tp.sys [MANUAL] Rasl2tp Service C:\WINDOWS\system32\svchost.exe [MANUAL] RasMan Service C:\WINDOWS\system32\DRIVERS\raspppoe.sys [MANUAL] RasPppoe Service C:\WINDOWS\system32\DRIVERS\raspti.sys [MANUAL] Raspti Service C:\WINDOWS\system32\DRIVERS\rdbss.sys [sYSTEM] Rdbss Service C:\WINDOWS\System32\DRIVERS\RDPCDD.sys [sYSTEM] RDPCDD Service RDPDD Service C:\WINDOWS\system32\DRIVERS\rdpdr.sys [MANUAL] rdpdr Service RDPNP Service [MANUAL] RDPWD Service C:\WINDOWS\system32\sessmgr.exe [MANUAL] RDSessMgr Service C:\WINDOWS\system32\DRIVERS\redbook.sys [sYSTEM] redbook Service C:\WINDOWS\system32\svchost.exe [DISABLED] RemoteAccess Service C:\WINDOWS\system32\svchost.exe [AUTO] RemoteRegistry Service C:\WINDOWS\system32\locator.exe [MANUAL] RpcLocator Service C:\WINDOWS\system32\svchost.exe [AUTO] RpcSs Service C:\WINDOWS\system32\rsvp.exe [MANUAL] RSVP Service C:\WINDOWS\system32\lsass.exe [AUTO] SamSs Service C:\WINDOWS\System32\SCardSvr.exe [MANUAL] SCardSvr Service C:\WINDOWS\System32\svchost.exe [AUTO] Schedule Service C:\Program Files\Spyware Doctor\svcntaux.exe [AUTO] sdAuxService Service C:\Program Files\Spyware Doctor\swdsvc.exe [AUTO] sdCoreService Service C:\WINDOWS\system32\DRIVERS\secdrv.sys [MANUAL] Secdrv Service C:\WINDOWS\System32\svchost.exe [AUTO] seclogon Service C:\WINDOWS\system32\svchost.exe [AUTO] SENS Service C:\WINDOWS\system32\DRIVERS\serenum.sys [MANUAL] serenum Service C:\WINDOWS\system32\DRIVERS\serial.sys [sYSTEM] Serial Service [sYSTEM] Sfloppy Service C:\WINDOWS\system32\svchost.exe [AUTO] SharedAccess Service C:\WINDOWS\System32\svchost.exe [AUTO] ShellHWDetection Service [DISABLED] Simbad Service C:\WINDOWS\system32\DRIVERS\sisnic.sys [MANUAL] SISNIC Service [DISABLED] Sparrow Service C:\WINDOWS\system32\drivers\splitter.sys [MANUAL] splitter Service C:\WINDOWS\system32\spoolsv.exe [AUTO] Spooler Service C:\WINDOWS\system32\DRIVERS\sr.sys [bOOT] sr Service C:\WINDOWS\system32\svchost.exe [AUTO] srservice Service C:\WINDOWS\system32\DRIVERS\srv.sys [MANUAL] Srv Service C:\WINDOWS\system32\svchost.exe [MANUAL] SSDPSRV Service C:\WINDOWS\system32\svchost.exe [MANUAL] stisvc Service C:\WINDOWS\system32\DRIVERS\swenum.sys [MANUAL] swenum Service C:\WINDOWS\system32\drivers\swmidi.sys [MANUAL] swmidi Service C:\WINDOWS\system32\dllhost.exe [MANUAL] SwPrv Service [DISABLED] symc810 Service [DISABLED] symc8xx Service [DISABLED] sym_hi Service [DISABLED] sym_u3 Service C:\WINDOWS\system32\drivers\sysaudio.sys [MANUAL] sysaudio Service C:\WINDOWS\system32\smlogsvc.exe [MANUAL] SysmonLog Service C:\WINDOWS\System32\svchost.exe [MANUAL] TapiSrv Service C:\WINDOWS\system32\DRIVERS\tcpip.sys [sYSTEM] Tcpip Service [MANUAL] TDPIPE Service [MANUAL] TDTCP Service C:\WINDOWS\system32\DRIVERS\termdd.sys [sYSTEM] TermDD Service C:\WINDOWS\System32\svchost.exe [MANUAL] TermService Service C:\WINDOWS\System32\svchost.exe [AUTO] Themes Service C:\WINDOWS\system32\tlntsvr.exe [DISABLED] TlntSvr Service [DISABLED] TosIde Service C:\WINDOWS\system32\svchost.exe [AUTO] TrkWks Service TSDDD Service [DISABLED] Udfs Service [DISABLED] ultra Service C:\WINDOWS\system32\DRIVERS\update.sys [MANUAL] Update Service C:\WINDOWS\system32\svchost.exe [MANUAL] upnphost Service C:\WINDOWS\System32\ups.exe [MANUAL] UPS Service C:\WINDOWS\system32\DRIVERS\usbehci.sys [MANUAL] usbehci Service C:\WINDOWS\system32\DRIVERS\usbhub.sys [MANUAL] usbhub Service C:\WINDOWS\system32\DRIVERS\usbohci.sys [MANUAL] usbohci Service C:\WINDOWS\System32\drivers\vga.sys [sYSTEM] VgaSave Service [DISABLED] ViaIde Service [bOOT] VolSnap Service C:\WINDOWS\System32\vssvc.exe [MANUAL] VSS Service VxD Service C:\WINDOWS\System32\svchost.exe [AUTO] W32Time Service W3SVC Service C:\WINDOWS\system32\DRIVERS\wanarp.sys [MANUAL] Wanarp Service [MANUAL] WDICA Service C:\WINDOWS\system32\drivers\wdmaud.sys [MANUAL] wdmaud Service C:\WINDOWS\system32\svchost.exe [AUTO] WebClient Service C:\WINDOWS\system32\svchost.exe [AUTO] winmgmt Service [MANUAL] Winsock Service WinSock2 Service WinTrust Service C:\WINDOWS\System32\svchost.exe [MANUAL] WmdmPmSN Service C:\WINDOWS\System32\svchost.exe [MANUAL] Wmi Service WmiApRpl Service C:\WINDOWS\system32\wbem\wmiapsrv.exe [MANUAL] WmiApSrv Service [sYSTEM] WS2IFSL Service C:\WINDOWS\System32\svchost.exe [AUTO] wscsvc Service C:\WINDOWS\system32\svchost.exe [AUTO] wuauserv Service C:\WINDOWS\System32\svchost.exe [AUTO] WZCSVC Service C:\WINDOWS\System32\svchost.exe [MANUAL] xmlprov Service C:\WINDOWS\system32\xpdx.sys [sYSTEM] xpdx Service {4F1A2FC7-A0E7-4097-A9F3-61B4A7901BB8} ---- EOF - GMER 1.0.12 ----