Mulący net

[KOCHAN]

Logfile of HijackThis v1.99.1

Scan saved at 16:15:33, on 2007-08-21

Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)


Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\Firebird\Firebird_1_5\bin\fbguard.exe

C:\Program Files\Eset\nod32krn.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\WINDOWS\system32\PnkBstrA.exe

C:\WINDOWS\SOUNDMAN.EXE

C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe

C:\Program Files\Eset\nod32kui.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\AutoConnect\AutoConnect.exe

C:\Program Files\Gadu-Gadu\gg.exe

C:\Program Files\Firebird\Firebird_1_5\bin\fbserver.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\USDownloader\USDownloader.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\Program Files\Winamp\winamp.exe

C:\Program Files\Winamp\winamp.exe

C:\Documents and Settings\Kochan\Pulpit\hijackthis\HijackThis.exe


R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll

O2 - BHO: FlashFXP Helper for Internet Explorer - {E5A1691B-D188-4419-AD02-90002030B8EE} - C:\PROGRA~1\FlashFXP\IEFlash.dll

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [nwiz] nwiz.exe /install

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit

O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE

O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon

O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE

O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [AutoConnect] C:\Program Files\AutoConnect\AutoConnect.exe

O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O17 - HKLM\System\CCS\Services\Tcpip\..\{0525CF72-4C25-4F4D-BF09-C39004CBA256}: NameServer = 194.204.159.1 217.98.63.164

O17 - HKLM\System\CS1\Services\Tcpip\..\{0525CF72-4C25-4F4D-BF09-C39004CBA256}: NameServer = 194.204.159.1 217.98.63.164

O17 - HKLM\System\CS2\Services\Tcpip\..\{0525CF72-4C25-4F4D-BF09-C39004CBA256}: NameServer = 194.204.159.1 217.98.63.164

O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL

O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll

O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe

O23 - Service: Firebird Guardian - DefaultInstance (FirebirdGuardianDefaultInstance) - The Firebird Project - C:\Program Files\Firebird\Firebird_1_5\bin\fbguard.exe

O23 - Service: Firebird Server - DefaultInstance (FirebirdServerDefaultInstance) - The Firebird Project - C:\Program Files\Firebird\Firebird_1_5\bin\fbserver.exe

O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe

I Silent Runners

“Silent Runners.vbs”, revision 52, http://www.silentrunners.org/ Operating System: Windows XP SP2 Output limited to non-default values, except where indicated by “{++}” Startup items buried in registry: --------------------------------- HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ {++} “CTFMON.EXE” = “C:\WINDOWS\system32\ctfmon.exe” [MS] “AutoConnect” = “C:\Program Files\AutoConnect\AutoConnect.exe” [“http://autoconnect.prv.pl”] “Gadu-Gadu” = ““C:\Program Files\Gadu-Gadu\gg.exe” /tray” [“Gadu-Gadu S.A.”] HKLM\Software\Microsoft\Windows\CurrentVersion\Run\ {++} “NvCplDaemon” = “RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup” [MS] “nwiz” = “nwiz.exe /install” [“NVIDIA Corporation”] “NvMediaCenter” = “RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit” [MS] “SoundMan” = “SOUNDMAN.EXE” [“Realtek Semiconductor Corp.”] “SpeedTouch USB Diagnostics” = ““C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe” /icon” [“THOMSON Telecom Belgium”] “nod32kui” = ““C:\Program Files\Eset\nod32kui.exe” /WAITSERVICE” ["Eset "] HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ {761497BB-D6F0-462C-B6EB-D4DAF1D92D43}(Default) = (no title provided) -> {HKLM…CLSID} = “SSVHelper Class” \InProcServer32(Default) = “C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll” [“Sun Microsystems, Inc.”] {E5A1691B-D188-4419-AD02-90002030B8EE}(Default) = (no title provided) -> {HKLM…CLSID} = “FlashFXP Helper for Internet Explorer” \InProcServer32(Default) = “C:\PROGRA~1\FlashFXP\IEFlash.dll” [“IniCom Networks, Inc.”] HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\ “{42071714-76d4-11d1-8b24-00a0c9068ff3}” = “Rozszerzenie CPL kadrowania wyświetlania” -> {HKLM…CLSID} = “Rozszerzenie CPL kadrowania wyświetlania” \InProcServer32(Default) = “deskpan.dll” [file not found] “{88895560-9AA2-1069-930E-00AA0030EBC8}” = “Rozszerzenie ikony HyperTerminalu” -> {HKLM…CLSID} = “HyperTerminal Icon Ext” \InProcServer32(Default) = “C:\WINDOWS\system32\hticons.dll” [“Hilgraeve, Inc.”] “{A70C977A-BF00-412C-90B7-034C51DA2439}” = “NvCpl DesktopContext Class” -> {HKLM…CLSID} = “DesktopContext Class” \InProcServer32(Default) = “C:\WINDOWS\system32\nvcpl.dll” [“NVIDIA Corporation”] “{FFB699E0-306A-11d3-8BD1-00104B6F7516}” = “Play on my TV helper” -> {HKLM…CLSID} = “NVIDIA CPL Extension” \InProcServer32(Default) = “C:\WINDOWS\system32\nvcpl.dll” [“NVIDIA Corporation”] “{1CDB2949-8F65-4355-8456-263E7C208A5D}” = “Desktop Explorer” -> {HKLM…CLSID} = “Desktop Explorer” \InProcServer32(Default) = “C:\WINDOWS\system32\nvshell.dll” [“NVIDIA Corporation”] “{1E9B04FB-F9E5-4718-997B-B8DA88302A47}” = “Desktop Explorer Menu” -> {HKLM…CLSID} = (no title provided) \InProcServer32(Default) = “C:\WINDOWS\system32\nvshell.dll” [“NVIDIA Corporation”] “{1E9B04FB-F9E5-4718-997B-B8DA88302A48}” = “nView Desktop Context Menu” -> {HKLM…CLSID} = “nView Desktop Context Menu” \InProcServer32(Default) = “C:\WINDOWS\system32\nvshell.dll” [“NVIDIA Corporation”] “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” = “WinRAR shell extension” -> {HKLM…CLSID} = “WinRAR” \InProcServer32(Default) = “C:\Program Files\WinRAR\rarext.dll” [null data] “{B089FE88-FB52-11D3-BDF1-0050DA34150D}” = “NOD32 Context Menu Shell Extension” -> {HKLM…CLSID} = “NOD32 Context Menu Shell Extension” \InProcServer32(Default) = “C:\Program Files\Eset\nodshex.dll” [null data] “{32020A01-506E-484D-A2A8-BE3CF17601C3}” = “AlcoholShellEx” -> {HKLM…CLSID} = “AlcoholShellEx” \InProcServer32(Default) = “C:\PROGRA~1\ALCOHO~1\ALCOHO~1\AXShlEx.dll” [“Alcohol Soft Development Team”] HKLM\Software\Classes*\shellex\ContextMenuHandlers\ NOD32 Context Menu Shell Extension(Default) = “{B089FE88-FB52-11D3-BDF1-0050DA34150D}” -> {HKLM…CLSID} = “NOD32 Context Menu Shell Extension” \InProcServer32(Default) = “C:\Program Files\Eset\nodshex.dll” [null data] WinRAR(Default) = “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” -> {HKLM…CLSID} = “WinRAR” \InProcServer32(Default) = “C:\Program Files\WinRAR\rarext.dll” [null data] HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\ WinRAR(Default) = “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” -> {HKLM…CLSID} = “WinRAR” \InProcServer32(Default) = “C:\Program Files\WinRAR\rarext.dll” [null data] HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\ FineReader8(Default) = “{F7091C74-EBB1-49D7-94C7-FE4886CCC18D}” -> {HKLM…CLSID} = “FineReader8ExplorerContextMenuHandler” \InProcServer32(Default) = “C:\Program Files\ABBYY FineReader 8.0 Professional Edition\FECMenu.dll” [“ABBYY Software”] NOD32 Context Menu Shell Extension(Default) = “{B089FE88-FB52-11D3-BDF1-0050DA34150D}” -> {HKLM…CLSID} = “NOD32 Context Menu Shell Extension” \InProcServer32(Default) = “C:\Program Files\Eset\nodshex.dll” [null data] WinRAR(Default) = “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” -> {HKLM…CLSID} = “WinRAR” \InProcServer32(Default) = “C:\Program Files\WinRAR\rarext.dll” [null data] Group Policies {GPedit.msc branch and setting}: ----------------------------------------------- Note: detected settings may not have any effect. HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\ “NoLowDiskSpaceChecks” = (REG_DWORD) hex:0x00000001 {unrecognized setting} HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\ “shutdownwithoutlogon” = (REG_DWORD) hex:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| Shutdown: Allow system to be shut down without having to log on} “undockwithoutlogon” = (REG_DWORD) hex:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| Devices: Allow undock without having to log on} Active Desktop and Wallpaper: ----------------------------- Active Desktop may be disabled at this entry: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState Displayed if Active Desktop enabled and wallpaper not set by Group Policy: HKCU\Software\Microsoft\Internet Explorer\Desktop\General\ “Wallpaper” = “C:\WINDOWS\web\wallpaper\Idylla.bmp” Displayed if Active Desktop disabled and wallpaper not set by Group Policy: HKCU\Control Panel\Desktop\ “Wallpaper” = “C:\WINDOWS\web\wallpaper\Idylla.bmp” Enabled Screen Saver: --------------------- HKCU\Control Panel\Desktop\ “SCRNSAVE.EXE” = “C:\WINDOWS\system32\logon.scr” [MS] Winsock2 Service Provider DLLs: ------------------------------- Namespace Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++} 000000000001\LibraryPath = “%SystemRoot%\System32\mswsock.dll” [MS] 000000000002\LibraryPath = “%SystemRoot%\System32\winrnr.dll” [MS] 000000000003\LibraryPath = “%SystemRoot%\System32\mswsock.dll” [MS] Transport Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++} 0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range: C:\WINDOWS\system32\imon.dll ["Eset "], 01 - 05, 21 %SystemRoot%\system32\mswsock.dll [MS], 06 - 08, 11 - 20 %SystemRoot%\system32\rsvpsp.dll [MS], 09 - 10 Toolbars, Explorer Bars, Extensions: ------------------------------------ Extensions (Tools menu items, main toolbar menu buttons) HKLM\Software\Microsoft\Internet Explorer\Extensions\ {FB5F1910-F110-11D2-BB9E-00C04F795683}\ “ButtonText” = “Messenger” “MenuText” = “Windows Messenger” “Exec” = “C:\Program Files\Messenger\msmsgs.exe” [MS] Running Services (Display Name, Service Name, Path {Service DLL}): ------------------------------------------------------------------ Firebird Guardian - DefaultInstance, FirebirdGuardianDefaultInstance, “C:\Program Files\Firebird\Firebird_1_5\bin\fbguard.exe -s” [“The Firebird Project”] Firebird Server - DefaultInstance, FirebirdServerDefaultInstance, “C:\Program Files\Firebird\Firebird_1_5\bin\fbserver.exe -s” [“The Firebird Project”] NOD32 Kernel Service, NOD32krn, ““C:\Program Files\Eset\nod32krn.exe”” ["Eset "] NVIDIA Display Driver Service, NVSvc, “C:\WINDOWS\system32\nvsvc32.exe” [“NVIDIA Corporation”] PnkBstrA, PnkBstrA, “C:\WINDOWS\system32\PnkBstrA.exe” [null data] Windows User Mode Driver Framework, UMWdf, “C:\WINDOWS\system32\wdfmgr.exe” [MS] Print Monitors: --------------- HKLM\System\CurrentControlSet\Control\Print\Monitors\ Canon BJ Language Monitor i250\Driver = “CNMLM50.DLL” [“CANON INC.”] ---------- (launch time: 2007-08-21 16:16:37) + This report excludes default entries except where indicated. + To see *everywhere* the script checks and *everything* it finds, launch it from a command prompt or a shortcut with the -all parameter. + The search for DESKTOP.INI DLL launch points on all local fixed drives took 28 seconds. ---------- (total run time: 68 seconds)

[Gutek]

Jeżeli od niedawna muli net to może to być wina Neo - normalne i naturalne

Daj log z ComboFix

[KOCHAN]

muli już od dobrego tygodnia nawet zadzwoniłem do nich z zapytaniem czy coś się dzieje i mega Profesjonaliści stwierdzili że nie.

log z ComboFix

ComboFix 07-08-17.2 - “Kochan” 2007-08-21 16:32:50.1 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.509 [GMT 2:00] * Created a new restore point ((((((((((((((((((((((((( Files Created from 2007-07-21 to 2007-08-21 ))))))))))))))))))))))))))))))) 2007-08-21 16:32 51,200 --a------ C:\WINDOWS\nircmd.exe 2007-08-20 19:23 2007-08-20 19:22 2007-08-20 15:53 2007-08-19 10:02 2007-08-15 12:36 221,184 --a------ C:\WINDOWS\system32\wmpns.dll 2007-08-14 12:31 2007-08-14 12:30 2007-08-13 13:41 73,728 -ra------ C:\WINDOWS\system32\CNMCP50.exe 2007-08-13 13:41 5,632 --a------ C:\WINDOWS\system32\CNMVS50.DLL 2007-08-13 13:41 100,352 --a------ C:\WINDOWS\system32\CNMLM50.DLL 2007-08-13 13:40 2007-08-13 13:38 25,856 --a------ C:\WINDOWS\system32\drivers\usbprint.sys 2007-08-13 11:10 2007-08-13 11:07 2007-08-12 15:20 2007-08-11 19:23 98,304 --a------ C:\WINDOWS\system32\CmdLineExt.dll 2007-08-11 19:15 2007-08-11 18:57 2007-08-11 18:56 2007-08-11 18:56 2007-08-11 18:55 2007-08-11 10:32 356,437 --a------ C:\WINDOWS\system32\GDS32.DLL 2007-08-11 10:32 2007-08-11 10:32 2007-08-09 20:12 2007-08-09 18:09 2007-08-09 11:08 2007-08-09 10:51 2007-08-07 21:21 2007-08-07 18:56 2007-08-06 18:43 73,216 --a------ C:\WINDOWS\ST6UNST.EXE 2007-08-06 18:43 249,856 --------- C:\WINDOWS\Setup1.exe 2007-08-06 18:43 2007-08-06 15:07 2007-08-06 14:46 2007-08-06 10:12 2007-08-06 10:12 2007-08-06 10:12 2007-08-06 09:48 2007-08-06 09:31 674 --a------ C:\WINDOWS\ie-ads-uninst.reg 2007-08-06 09:31 32,768 --a------ C:\WINDOWS\system32\ServiceRepair.exe 2007-08-06 09:31 25,916 --a------ C:\WINDOWS\system32\tcpipbak.reg 2007-08-04 19:32 2007-08-04 19:22 761,856 --a------ C:\WINDOWS\system32\xvidcore.dll 2007-08-04 19:22 157,696 --a------ C:\WINDOWS\system32\unrar.dll 2007-08-04 19:22 2007-08-04 17:29 5,248 --a------ C:\WINDOWS\system32\drivers\a347scsi.sys 2007-08-04 17:29 160,640 --a------ C:\WINDOWS\system32\drivers\a347bus.sys 2007-08-04 17:29 2007-08-03 20:47 2007-08-03 16:24 512,096 --a------ C:\WINDOWS\system32\drivers\amon.sys 2007-08-03 16:24 298,104 --a------ C:\WINDOWS\system32\imon.dll 2007-08-03 16:24 15,424 --a------ C:\WINDOWS\system32\drivers\nod32drv.sys 2007-08-03 16:17 2007-08-03 16:16 2007-08-03 16:03 2007-08-03 16:03 2007-08-03 16:03 2007-08-03 16:03 2007-08-03 16:03 2007-08-03 15:50 2007-08-03 11:48 306,688 --a------ C:\WINDOWS\IsUninst.exe 2007-08-03 11:47 2007-08-02 20:39 66,872 --a------ C:\WINDOWS\system32\PnkBstrA.exe 2007-08-02 20:39 22,328 --a------ C:\WINDOWS\system32\drivers\PnkBstrK.sys 2007-08-02 20:39 103,736 --a------ C:\WINDOWS\system32\PnkBstrB.exe 2007-08-02 20:39 2007-08-02 20:31 2007-08-02 20:30 2007-08-02 19:35 2007-08-02 19:16 2007-08-02 19:15 2007-08-02 19:15 2007-08-02 19:08 36,528 --------- C:\WINDOWS\system32\drivers\PxHelp20.sys 2007-08-02 19:08 2,560 --------- C:\WINDOWS\system32\drivers\cdralw2k.sys 2007-08-02 19:08 2,432 --------- C:\WINDOWS\system32\drivers\cdr4_xp.sys 2007-08-02 19:08 129,784 --------- C:\WINDOWS\system32\pxafs.dll 2007-08-02 19:08 115,880 --------- C:\WINDOWS\system32\pxinsi64.exe 2007-08-02 19:08 2007-08-02 19:04 2007-08-02 18:27 1,156 --a------ C:\WINDOWS\mozver.dat 2007-08-02 18:26 476,320 --------- C:\WINDOWS\system32\ImagXpr7.dll 2007-08-02 18:26 471,040 --------- C:\WINDOWS\system32\ImagXRA7.dll 2007-08-02 18:26 364,544 --------- C:\WINDOWS\system32\TwnLib4.dll 2007-08-02 18:26 262,144 --------- C:\WINDOWS\system32\ImagXR7.dll 2007-08-02 18:26 106,496 --a------ C:\WINDOWS\system32\TwnLib20.dll 2007-08-02 18:26 1,568,768 --------- C:\WINDOWS\system32\ImagX7.dll 2007-08-02 18:25 155,648 --a------ C:\WINDOWS\system32\NeroCheck.exe 2007-08-02 18:25 2007-08-02 18:25 2007-08-02 14:59 2007-08-02 14:11 3,072 --a------ C:\WINDOWS\system32\drivers\audstub.sys 2007-08-02 14:10 77,312 --a------ C:\WINDOWS\system32\usbui.dll 2007-08-02 14:10 58,624 --a------ C:\WINDOWS\system32\drivers\redbook.sys 2007-08-02 14:09 2007-08-02 14:09 2007-08-02 14:09 2007-08-02 14:08 9,936 --a------ C:\WINDOWS\system\LZEXPAND.DLL 2007-08-02 14:08 9,168 --a------ C:\WINDOWS\system\VER.DLL (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) 2007-08-09 18:15 12850647 --a------ C:\Program Files\Winamp.rar 2007-08-04 12:54 2426 --a------ C:\WINDOWS\pchealth\helpctr\PackageStore\SkuStore.bin 2007-08-04 12:53 8972 --a------ C:\WINDOWS\pchealth\helpctr\Config\Cntstore.bin 2007-06-26 08:10 1104896 --a------ C:\WINDOWS\system32\msxml3.dll 2007-06-19 15:32 282112 --a------ C:\WINDOWS\system32\gdi32.dll 2007-06-13 15:23 1034752 --a------ C:\WINDOWS\explorer.exe --------- C:\Program Files\Usługi online --------- C:\Program Files\Kreator wizytówek ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “NvCplDaemon”=“C:\WINDOWS\system32\NvCpl.dll” [2006-08-11 15:43] “nwiz”=“nwiz.exe” [2006-08-11 15:43 C:\WINDOWS\system32\nwiz.exe] “NvMediaCenter”=“C:\WINDOWS\system32\NvMcTray.dll” [2006-08-11 15:43] “SoundMan”=“SOUNDMAN.EXE” [2006-03-02 07:22 C:\WINDOWS\soundman.exe] “SpeedTouch USB Diagnostics”=“C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe” [2004-01-26 11:38] “nod32kui”=“C:\Program Files\Eset\nod32kui.exe” [2007-08-03 16:22] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “CTFMON.EXE”=“C:\WINDOWS\system32\ctfmon.exe” [2004-08-04 02:44] “AutoConnect”=“C:\Program Files\AutoConnect\AutoConnect.exe” [2004-08-28 20:27] “Gadu-Gadu”=“C:\Program Files\Gadu-Gadu\gg.exe” [2007-07-09 09:39] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Gainward] C:\Program Files\VDOTool\TBPanel.exe /A [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched] “C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe” R1 BIOS;BIOS;??\C:\WINDOWS\system32\drivers\BIOS.sys R2 FirebirdGuardianDefaultInstance;Firebird Guardian - DefaultInstance;C:\Program Files\Firebird\Firebird_1_5\bin\fbguard.exe -s R2 TBPanel;TBPanel;C:\WINDOWS\system32\drivers\TBPanel.sys R3 FirebirdServerDefaultInstance;Firebird Server - DefaultInstance;C:\Program Files\Firebird\Firebird_1_5\bin\fbserver.exe -s S3 Cardex;Cardex;??\C:\WINDOWS\system32\drivers\TBPANEL.SYS ************************************************************************** catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-08-21 16:33:34 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes … scanning hidden autostart entries … scanning hidden files … scan completed successfully hidden files: 0 ************************************************************************** Completion time: 2007-08-21 16:34:08 — E O F —

[Gutek]

Zrób optymalizację XP - http://forum.dobreprogramy.pl/viewtopic.php?t=76580