Nie moge usunąć MyGlobalSearch

alfahaks · 11 Listopad 2007 17:11

Witam. Czy coś w tych logach jest nie tak??

Miałem ostatnio małą modernizację kompa tzn. nowa karta GF 7300 GT

i 1.5 GB Ram.

ComboFix 07-11-08.1 - a1 2007-11-11 21:13:28.1 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.1079 [GMT 1:00] Running from: C:\Documents and Settings\a1\Pulpit\ComboFix.exe * Created a new restore point . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\Documents and Settings\a1\Pulpit\internet.lnk C:\Program Files\myglobalsearch C:\Program Files\myglobalsearch\bar\1.bin\M9FFXTBR.JAR C:\Program Files\myglobalsearch\bar\1.bin\M9FFXTBR.MANIFEST C:\Program Files\myglobalsearch\bar\1.bin\M9NTSTBR.JAR C:\Program Files\myglobalsearch\bar\1.bin\M9NTSTBR.MANIFEST C:\Program Files\myglobalsearch\bar\1.bin\M9PLUGIN.DLL C:\Program Files\myglobalsearch\bar\1.bin\MGSBAR.DLL C:\Program Files\myglobalsearch\bar\1.bin\NPMYGLSH.DLL C:\Program Files\myglobalsearch\bar\Cache\00383613 C:\Program Files\myglobalsearch\bar\Cache\0038419C C:\Program Files\myglobalsearch\bar\Cache\00384390.bin C:\Program Files\myglobalsearch\bar\Cache\00384759.bin C:\Program Files\myglobalsearch\bar\Cache\00384A66.bin C:\Program Files\myglobalsearch\bar\Cache\files.ini C:\Program Files\myglobalsearch\bar\History\search C:\Program Files\myglobalsearch\bar\Settings\prevcfg.htm C:\WINDOWS\system32_000003_.tmp.dll C:\WINDOWS\system32_000006_.tmp.dll C:\WINDOWS\system32_000007_.tmp.dll C:\WINDOWS\system32_000008_.tmp.dll C:\WINDOWS\system32_000009_.tmp.dll C:\WINDOWS\system32_000010_.tmp.dll C:\WINDOWS\system32_000012_.tmp.dll C:\WINDOWS\system32_000013_.tmp.dll C:\WINDOWS\system32_000014_.tmp.dll . ((((((((((((((((((((((((( Files Created from 2007-10-11 to 2007-11-11 ))))))))))))))))))))))))))))))) . 2007-11-11 17:59 51,200 --a------ C:\WINDOWS\NirCmd.exe 2007-11-11 08:14 2007-11-10 16:53 2007-11-09 18:41 2007-11-09 10:11 2007-11-08 10:45 2007-11-08 09:35 2007-11-07 19:01 2007-11-07 19:01 2007-11-05 19:59 2007-11-05 19:55 2007-11-05 12:44 15,360 --a------ C:\WINDOWS\system32\drivers\StreamIP.sys 2007-11-05 12:44 15,360 --a–c— C:\WINDOWS\system32\dllcache\streamip.sys 2007-11-05 12:44 11,136 --a------ C:\WINDOWS\system32\drivers\SLIP.sys 2007-11-05 12:44 11,136 --a–c— C:\WINDOWS\system32\dllcache\slip.sys 2007-11-05 12:44 10,880 --a------ C:\WINDOWS\system32\drivers\NdisIP.sys 2007-11-05 12:44 10,880 --a–c— C:\WINDOWS\system32\dllcache\ndisip.sys 2007-11-05 12:44 5,504 --a------ C:\WINDOWS\system32\drivers\MSTEE.sys 2007-11-05 12:44 5,504 --a–c— C:\WINDOWS\system32\dllcache\mstee.sys 2007-11-05 12:43 85,376 --a------ C:\WINDOWS\system32\drivers\NABTSFEC.sys 2007-11-05 12:43 85,376 --a–c— C:\WINDOWS\system32\dllcache\nabtsfec.sys 2007-11-05 12:43 19,328 --a------ C:\WINDOWS\system32\drivers\WSTCODEC.SYS 2007-11-05 12:43 19,328 --a–c— C:\WINDOWS\system32\dllcache\wstcodec.sys 2007-11-05 12:43 17,024 --a------ C:\WINDOWS\system32\drivers\CCDECODE.sys 2007-11-05 12:43 17,024 --a–c— C:\WINDOWS\system32\dllcache\ccdecode.sys 2007-11-05 12:42 54,784 --a------ C:\WINDOWS\system32\vfwwdm32.dll 2007-11-05 12:42 54,784 --a–c— C:\WINDOWS\system32\dllcache\vfwwdm32.dll 2007-11-05 12:39 16,176 --------- C:\WINDOWS\system32\drivers\NVXBAR.SYS 2007-11-05 12:38 141,246 --------- C:\WINDOWS\system32\drivers\NVCAP.SYS 2007-11-05 12:13 2007-11-05 12:13 12,256 --a------ C:\WINDOWS\system32\drivers\TBPanel.sys 2007-10-31 17:29 2007-10-31 17:25 2007-10-31 17:25 2007-10-31 17:25 2007-10-31 17:25 2007-10-31 17:25 2007-10-31 17:25 2007-10-31 17:24 1,733,120 --a------ C:\WINDOWS\system32\G400d.dll 2007-10-31 17:24 322,432 --a------ C:\WINDOWS\system32\drivers\G400m.sys 2007-10-27 19:59 2007-10-27 19:59 3,727,720 --a------ C:\WINDOWS\system32\d3dx9_35.dll 2007-10-27 19:59 1,358,192 --a------ C:\WINDOWS\system32\D3DCompiler_35.dll 2007-10-27 19:59 444,776 --a------ C:\WINDOWS\system32\d3dx10_35.dll 2007-10-27 19:59 278,984 --a------ C:\WINDOWS\system32\drivers\atksgt.sys 2007-10-27 19:59 267,112 --a------ C:\WINDOWS\system32\xactengine2_9.dll 2007-10-27 19:59 25,416 --a------ C:\WINDOWS\system32\drivers\lirsgt.sys 2007-10-27 19:46 2007-10-27 16:23 2007-10-27 15:35 2007-10-27 14:51 2007-10-27 14:51 68,222 --------- C:\WINDOWS\system32\drivers\StMp3Rec.sys 2007-10-27 10:47 2007-10-27 10:47 2007-10-27 10:43 2007-10-27 10:43 2007-10-26 22:20 2007-10-18 15:08 2007-10-18 14:59 2007-10-15 16:29 2007-10-15 16:29 2007-10-15 16:29 2007-10-15 16:29 2007-10-13 09:43 2007-10-13 09:43 2007-10-13 09:41 2007-10-13 09:40 . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2007-11-11 21:03 14,692,640 --sha-w C:\WINDOWS\system32\drivers\fidbox.dat 2007-11-11 21:03 1,301,792 --sha-w C:\WINDOWS\system32\drivers\fidbox2.dat 2007-11-11 21:03 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab 2007-11-11 20:45 198,488 --sha-w C:\WINDOWS\system32\drivers\fidbox.idx 2007-11-11 20:45 123,068 --sha-w C:\WINDOWS\system32\drivers\fidbox2.idx 2007-11-11 20:08 --------- d-----w C:\Documents and Settings\a1\Dane aplikacji\Xfire 2007-11-11 20:08 --------- d-----w C:\Documents and Settings\a1\Dane aplikacji\SiteAdvisor 2007-11-11 19:01 22,328 ----a-w C:\WINDOWS\system32\drivers\PnkBstrK.sys 2007-11-10 13:10 --------- d-----w C:\Program Files\Wiedźmin 2007-11-10 13:05 --------- d–h--w C:\Program Files\InstallShield Installation Information 2007-11-09 18:08 22,328 ----a-w C:\Documents and Settings\a1\Dane aplikacji\PnkBstrK.sys 2007-11-09 17:54 --------- d-----w C:\Program Files\Activision 2007-11-09 17:48 --------- d-----w C:\Program Files\Valve 2007-11-09 17:47 --------- d-----w C:\Program Files\AusLogics BoostSpeed 2007-11-09 17:43 --------- d-----w C:\Documents and Settings\a1\Dane aplikacji\Cream Software 2007-11-08 09:36 --------- d-----w C:\Program Files\Xfire 2007-10-27 18:37 --------- d-----w C:\Program Files\Ahead 2007-10-26 17:32 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Spybot - Search & Destroy 2007-10-15 15:29 --------- d-----w C:\Program Files\Winamp 2007-10-12 16:35 --------- d-----w C:\Program Files\Kolekcja Klasyki 2007-10-10 05:54 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Corel 2007-10-10 05:54 --------- d-----w C:\Documents and Settings\a1\Dane aplikacji\Corel 2007-10-10 05:50 --------- d-----w C:\Program Files\Common Files\Corel 2007-10-10 05:48 --------- d-----w C:\Program Files\Corel 2007-10-09 20:34 --------- d-----w C:\Program Files\Tweak-XP Pro 4 2007-10-05 14:42 --------- d-----w C:\Documents and Settings\a2\Dane aplikacji\CyberLink 2007-09-28 12:19 --------- d-----w C:\Documents and Settings\a2\Dane aplikacji\DemoCreator 2007-09-28 12:18 --------- d-----w C:\Program Files\MP3 Player Utilities 4.09 2007-09-24 19:29 --------- d-----w C:\Documents and Settings\a1\Dane aplikacji\DemoCreator 2007-09-24 19:06 --------- d-----w C:\Program Files\Wondershare 2007-09-16 15:27 --------- d-----w C:\Program Files\Creative 2007-08-26 12:09 136,688 -c–a-w C:\WINDOWS\1 Cool Button Tool Uninstaller.exe 2004-10-01 13:00 40,960 ----a-w C:\Program Files\Uninstall_CDS.exe 2004-09-28 02:00 26,240 -c–a-w C:\WINDOWS\inf\RAMDSK.SYS 2001-11-23 10:08 712,704 ----a-r C:\WINDOWS\inf\OTHER\AUDIO3D.DLL . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE~\Browser Helper Objects{25CEE8EC-5730-41bc-8B58-22DDC8AB8C20}] 2007-10-04 21:06 1135968 --a------ C:\Program Files\Winamp Toolbar\winamptb.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar] “{EBF2BA02-9094-4c5a-858B-BB198F3D8DE2}”= C:\Program Files\Winamp Toolbar\winamptb.dll [2007-10-04 21:06 1135968] [HKEY_CLASSES_ROOT\CLSID{EBF2BA02-9094-4c5a-858B-BB198F3D8DE2}] [HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand.1] [HKEY_CLASSES_ROOT\TypeLib{538CD77C-BFDD-49b0-9562-77419CAB89D1}] [HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand] [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser] “{EBF2BA02-9094-4C5A-858B-BB198F3D8DE2}”= C:\Program Files\Winamp Toolbar\winamptb.dll [2007-10-04 21:06 1135968] [HKEY_CLASSES_ROOT\CLSID{EBF2BA02-9094-4C5A-858B-BB198F3D8DE2}] [HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand.1] [HKEY_CLASSES_ROOT\TypeLib{538CD77C-BFDD-49b0-9562-77419CAB89D1}] [HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “AVP”=“C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe” [2007-03-09 19:50] “NvCplDaemon”=“C:\WINDOWS\system32\NvCpl.dll” [2007-07-23 03:34] “Creative Fatal1ty 1010 Mouse”=“C:\Program Files\Creative\Fatal1ty 1010 Mouse\CTPoint.exe” [2006-01-04 16:40] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “CTFMON.EXE”=“C:\WINDOWS\system32\ctfmon.exe” [2004-08-03 23:44] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] “NoInstrumentation”=0 (0x0) [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon] “UIHost”=“C:\WINDOWS\system32\logonuiX.exe” [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] “AppInit_DLLs”=C:\PROGRA~1\KASPER~1\KASPER~1.0\adialhk.dll [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AVP] “C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe” [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Gainward] C:\Program Files\VDOTool\TBPanel.exe /A [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS] “C:\Program Files\Messenger\msmsgs.exe” /background [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz] nwiz.exe /install [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype] “C:\Program Files\Skype\Phone\Skype.exe” /nosplash /minimized [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-] “Google Desktop Search”=“C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe” /startup “Gadu-Gadu”=“C:\Program Files\Gadu-Gadu\gg.exe” /tray “BoostSpeed”=“C:\Program Files\AusLogics BoostSpeed\boostspeed.exe” /Q “Steam”=“C:\Program Files\Valve\Steam\Steam.exe” -silent “Orb”=“C:\Program Files\Winamp Remote\bin\OrbTray.exe” /background [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-] “C-Media Mixer”=Mixer.exe /startup “LogonStudio”=“C:\Program Files\WinCustomize\LogonStudio\logonstudio.exe” /RANDOM “BootSkin Startup Jobs”=“C:\PROGRA~1\Stardock\WINCUS~1\BootSkin\BootSkin.exe” /StartupJobs “QuickTime Task”=“C:\Program Files\QuickTime\QTTask.exe” -atboottime “ISUSPM”=“C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe” -scheduler “BearShare”=“C:\Program Files\BearShare\BearShare.exe” /pause “InCD”=C:\Program Files\Ahead\InCD\InCD.exe “NeroFilterCheck”=C:\WINDOWS\system32\NeroCheck.exe “Corel Photo Downloader”=“C:\Program Files\Common Files\Corel\Corel PhotoDownloader\Corel Photo Downloader.exe” -startup R0 sfdrv01a;StarForce Protection Environment Driver (version 1.x.a);C:\WINDOWS\system32\drivers\sfdrv01a.sys R2 nvcap;nVidia WDM Video Capture (universal);C:\WINDOWS\system32\DRIVERS\nvcap.sys R2 NVXBAR;nVidia WDM A/V Crossbar;C:\WINDOWS\system32\DRIVERS\NVxbar.sys R3 CtUsbMs;Creative HID USB Filter Driver;C:\WINDOWS\system32\DRIVERS\CtUsbMs.Sys S3 GcKernel;Sterownik filtru Microsoft SideWinder Value Add;C:\WINDOWS\system32\DRIVERS\GcKernel.sys S3 HIDSwvd;Ministerownik wirtualnego urządzenia Microsoft SideWinder HID;C:\WINDOWS\system32\DRIVERS\HIDSwvd.sys . Contents of the ‘Scheduled Tasks’ folder “2007-11-05 20:30:40 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job” - C:\Program Files\Apple Software Update\SoftwareUpdate.exe . ************************************************************************** catchme 0.3.1250 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-11-11 22:03:37 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes … scanning hidden autostart entries … scanning hidden files … scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2007-11-11 22:06:52 - machine was rebooted . — E O F —

Gutek · 11 Listopad 2007 18:23

Zastosuj się do tego Tematu i zmień tytuł tematu na konkretny inaczej KOSZ

Pozdrawiam Gutek2222

usuń wpisy HJT

Daj log z ComboFix

alfahaks · 11 Listopad 2007 21:22

Mam też takie pyt. czy w czasie sprawdzania Combofixem, antywirus powinien mi znajdywać wirusy??? (Mam Kasperskyiego)

Złączono Posta : 11.11.2007 (Nie) 22:22

znalazł ich chyba coś około 15

Gutek · 11 Listopad 2007 21:26

log już czysty, ale

Pobierz program SDFix

alfahaks · 12 Listopad 2007 16:13

SDFix: Version 1.114 Run by a1 on 2007-11-12 at 15:44 Microsoft Windows XP [Wersja 5.1.2600] Running From: C:\SDFix Safe Mode: Checking Services: Restoring Windows Registry Values Restoring Windows Default Hosts File Rebooting… Normal Mode: Checking Files: Trojan Files Found: C:\WINDOWS\SYSTEM32\NVRSEL.DLL - Deleted C:\WINDOWS\SYSTEM32\NVWRSEL.DLL - Deleted C:~GLHTTP1.TMP - Deleted Removing Temp Files… ADS Check: C:\WINDOWS No streams found. C:\WINDOWS\system32 No streams found. C:\WINDOWS\system32\svchost.exe No streams found. C:\WINDOWS\system32\ntoskrnl.exe No streams found. Final Check: catchme 0.3.1262.1 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-11-12 17:06:11 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes … scanning hidden services & system hive … scanning hidden registry entries … [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\A\1\5\1c] “Order”=hex:08,00,00,00,02,00,00,00,b8,01,00,00,01,00,00,00,04,00,00,00,8c,… scanning hidden files … scan completed successfully hidden processes: 0 hidden services: 0 hidden files: 0 Remaining Services: ------------------ Authorized Application Key Export: [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list] Remaining Files: --------------- File Backups: - C:\SDFix\backups\backups.zip Files with Hidden Attributes: Sun 11 Nov 2007 6,219,320 A…H. — “C:\Program Files\Picasa2\setup.exe” Wed 7 Nov 2007 88 …SHR — “C:\WINDOWS\system32\A5BFD3BAD0.sys” Wed 7 Nov 2007 2,516 A.SH. — “C:\WINDOWS\system32\KGyGaAvL.sys” Sun 22 Jul 2007 4,348 A.SH. — “C:\Documents and Settings\All Users\DRM\DRMv1.bak” Tue 28 Aug 2007 401 A.SH. — “C:\Documents and Settings\All Users\DRM\DRMv10.bak” Tue 28 Aug 2007 401 A.SH. — “C:\Documents and Settings\All Users\DRM\DRMv11.bak” Mon 1 Oct 2007 2,571 …HR — “C:\Documents and Settings\a1\Dane aplikacji\SecuROM\UserData\securom_v7_01.bak” Mon 13 Aug 2007 857 …HR — “C:\Documents and Settings\a2\Dane aplikacji\SecuROM\UserData\securom_v7_01.bak” Tue 26 Dec 2006 857 A…HR — “C:\s-dane\Kara\Dane aplikacji\SecuROM\UserData\securom_v7_01.bak” Sun 15 Jun 2003 4,348 A…H. — “C:\s-dane\Kara\Moje dokumenty\Moja muzyka\Kopia zapasowa licencji\drmv1key.bak” Sun 13 Nov 2005 782 A…H. — “C:\s-dane\Kara\Moje dokumenty\Moja muzyka\Kopia zapasowa licencji\drmv1lic.bak” Thu 21 Aug 2003 312 A.SH. — “C:\s-dane\Kara\Moje dokumenty\Moja muzyka\Kopia zapasowa licencji\drmv2key.bak” Sun 15 Jun 2003 4,348 A…H. — “C:\Documents and Settings\a1\Pulpit\Moje dokumenty\Moja muzyka\Kopia zapasowa licencji\drmv1key.bak” Sun 13 Nov 2005 782 A…H. — “C:\Documents and Settings\a1\Pulpit\Moje dokumenty\Moja muzyka\Kopia zapasowa licencji\drmv1lic.bak” Thu 21 Aug 2003 312 A.SH. — “C:\Documents and Settings\a1\Pulpit\Moje dokumenty\Moja muzyka\Kopia zapasowa licencji\drmv2key.bak” Tue 26 Dec 2006 857 A…HR — “C:\s-dane\dane.1\Kara\Dane aplikacji\SecuROM\UserData\securom_v7_01.bak” Finished!

Gutek · 12 Listopad 2007 17:53

Nowy log z Combo

alfahaks · 12 Listopad 2007 19:21

dac new log??

Gutek · 12 Listopad 2007 19:45

Tak nowy