Printer.exe - błąd przy uruchamianiu kompa

spman · 28 Wrzesień 2007 21:54

strasznie długo wczytuje mi sie windows, juz po wpisaniu hasła do uzytkownika, gdy łądowane są ustawienia osobiste, a gdy się załaduje to wyskakuej mi nastepujący komunikat “C:\WINDOWS\System32\printer.exe”

Prosze o sprawdzenie mi loga

Logfile of HijackThis v1.99.1 Scan saved at 23:54:16, on 2007-09-28 Platform: Windows XP (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 (6.00.2600.0000) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe C:\PROGRA~1\Grisoft\AVG7\avgemc.exe C:\WINDOWS\System32\nvsvc32.exe C:\WINDOWS\system32\ZoneLabs\vsmon.exe C:\WINDOWS\Explorer.exe C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe C:\PROGRA~1\Grisoft\AVG7\avgcc.exe C:\WINDOWS\System32\RUNDLL32.EXE C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe C:\WINDOWS\SOUNDMAN.EXE C:\WINDOWS\System32\ctfmon.exe C:\Program Files\Messenger\msmsgs.exe C:\Program Files\OpenOffice.ux.pl 2.0.1\program\soffice.exe C:\Program Files\OpenOffice.ux.pl 2.0.1\program\soffice.BIN C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\Total Commander\TOTALCMD.EXE D:\Utils\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\System32\printer.exe O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O4 - HKLM…\Run: [Zone Labs Client] “C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe” O4 - HKLM…\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP O4 - HKLM…\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup O4 - HKLM…\Run: [nwiz] nwiz.exe /install O4 - HKLM…\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit O4 - HKLM…\Run: [sunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe O4 - HKLM…\Run: [soundMan] SOUNDMAN.EXE O4 - HKCU…\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe O4 - HKCU…\Run: [MSMSGS] “C:\Program Files\Messenger\msmsgs.exe” /background O4 - Startup: OpenOffice.ux.pl 2.0.1.lnk = C:\Program Files\OpenOffice.ux.pl 2.0.1\program\quickstart.exe O7 - HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra ‘Tools’ menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O17 - HKLM\System\CCS\Services\Tcpip…{00E2124A-686A-41C9-87E7-5BF7230EC3B0}: NameServer = 194.204.159.1,194.204.152.34 O17 - HKLM\System\CS1\Services\Tcpip…{00E2124A-686A-41C9-87E7-5BF7230EC3B0}: NameServer = 194.204.159.1,194.204.152.34 O17 - HKLM\System\CS2\Services\Tcpip…{00E2124A-686A-41C9-87E7-5BF7230EC3B0}: NameServer = 194.204.159.1,194.204.152.34 O20 - AppInit_DLLs: C:\WINDOWS\System32\stdole32.dat O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

Gutek · 28 Wrzesień 2007 23:29

daruj sobie

usuń wpisy HJT

Użyj SmitFraudFix wybierz opcji nr 2 , oczywiście w trybie awaryjnym i po tym - Daj log z ComboFix

spman · 29 Wrzesień 2007 05:42

ComboFix 07-09-21.2 - “Spman” 2007-09-29 7:39:35.1 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.0.1250.48.1045.18.316 [GMT 2:00] * Created a new restore point . ((((((((((((((((((((((((( Files Created from 2007-08-28 to 2007-09-29 ))))))))))))))))))))))))))))))) . 2007-09-29 07:35 53,248 --a------ C:\WINDOWS\system32\Process.exe 2007-09-29 07:35 51,200 --a------ C:\WINDOWS\system32\dumphive.exe 2007-09-29 07:35 289,144 --a------ C:\WINDOWS\system32\VCCLSID.exe 2007-09-29 07:35 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe 2007-09-29 07:35 25,088 --a------ C:\WINDOWS\system32\WS2Fix.exe 2007-09-29 07:35 1,074 --a------ C:\WINDOWS\system32\tmp.reg 2007-09-29 07:33 51,200 --a------ C:\WINDOWS\NirCmd.exe 2007-09-28 21:06 70,144 --a–c— C:\WINDOWS\system32\dllcache\usbui.dll 2007-09-28 21:06 50,688 --a–c— C:\WINDOWS\system32\dllcache\usbhub.sys 2007-09-28 21:06 123,264 --a–c— C:\WINDOWS\system32\dllcache\usbport.sys 2007-09-28 21:06 2007-09-28 20:36 2007-09-28 20:28 2007-09-28 20:28 2007-09-28 20:28 2007-09-28 20:28 2007-09-28 20:26 2007-09-28 20:06 337,320 -ra------ C:\WINDOWS\system32\difxapi.dll 2007-09-28 20:06 2007-09-28 19:57 20,640 --------- C:\WINDOWS\system32\drivers\PxHelp20.sys 2007-09-28 19:55 2007-09-28 19:43 2007-09-28 19:38 2007-09-28 19:28 2007-09-28 19:08 2007-09-28 19:06 57,088 --a------ C:\WINDOWS\system32\drivers\redbook.sys 2007-09-28 19:06 3,072 --a------ C:\WINDOWS\system32\drivers\audstub.sys 2007-09-28 19:05 70,144 --a------ C:\WINDOWS\system32\usbui.dll 2007-09-28 19:05 34,112 --a------ C:\WINDOWS\system32\drivers\an983.sys 2007-09-28 19:04 2007-09-28 19:04 2007-09-28 19:04 2007-09-28 19:04 2007-09-28 19:04 2007-09-28 19:04 2007-09-28 19:04 2007-09-28 19:04 2007-09-28 19:04 2007-09-28 19:04 2007-09-28 19:04 2007-09-28 19:04 2007-09-28 19:04 . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2007-09-28 18:51 --------- d-------- C:\Program Files\Common Files\InstallShield 2007-09-28 18:50 15525 --a------ C:\WINDOWS\prods104.exe 2007-09-28 18:49 499712 --a------ C:\WINDOWS\system32\msvcp71.dll 2007-09-28 18:49 348160 --a------ C:\WINDOWS\system32\msvcr71.dll 2007-09-28 18:42 15525 --a------ C:\WINDOWS\prods193.exe 2007-09-28 18:14 --------- d-------- C:\Program Files\microsoft frontpage --------- C:\Program Files\Usługi online . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “Zone Labs Client”=“C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe” [2005-01-26 04:23] “AVG7_CC”=“C:\PROGRA~1\Grisoft\AVG7\avgcc.exe” [2007-09-28 18:49] “NvCplDaemon”=“C:\WINDOWS\System32\NvCpl.dll” [2006-10-22 12:22] “nwiz”=“nwiz.exe” [2006-10-22 12:22 C:\WINDOWS\system32\nwiz.exe] “NvMediaCenter”=“C:\WINDOWS\System32\NvMcTray.dll” [2006-10-22 12:22] “SunJavaUpdateSched”=“C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe” [2005-11-10 13:03] “SoundMan”=“SOUNDMAN.EXE” [2006-11-17 05:42 C:\WINDOWS\soundman.exe] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “CTFMON.EXE”=“C:\WINDOWS\System32\ctfmon.exe” [2001-10-30 13:00] “MSMSGS”=“C:\Program Files\Messenger\msmsgs.exe” [2001-08-02 07:14] C:\DOCUME~1\Spman\MENUST~1\Programy\AUTOST~1\ OpenOffice.ux.pl 2.0.1.lnk - C:\Program Files\OpenOffice.ux.pl 2.0.1\program\quickstart.exe [2006-01-03 23:50:50] R3 AN983;Karta ADMtek AN983/AN985/ADM951X 10/100Mbps Fast Ethernet;C:\WINDOWS\System32\DRIVERS\AN983.sys *Newly Created Service* - CATCHME . ************************************************************************** catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-09-29 07:40:12 Windows 5.1.2600 NTFS scanning hidden processes … scanning hidden autostart entries … scanning hidden files … scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2007-09-29 7:40:33 . — E O F —

jessica · 29 Wrzesień 2007 07:48

Jakieś nieznane pliki.

Sprawdź je na --> http://virusscan.jotti.org/

Opis, jak korzystać z JOTTI --> http://otfans.pl/forums/showthread.php?tid=552

albo na http://www.virustotal.com/en/indexf.html.

(korzysta się podobnie jak z JOTTI).

Nie widzę nic więcej podejrzanego.

Pokaż raport z użycia SmitfraudFixa (z C:\SmitfraudFix.txt)

jessi

spman · 29 Wrzesień 2007 13:07

SmitFraudFix v2.233 Scan done at 7:35:28,51, 2007-09-29 Run from D:\Utils\Rejestr\SmitfraudFix OS: Microsoft Windows XP [Wersja 5.1.2600] - Windows_NT The filesystem type is NTFS Fix run in safe mode »»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Before SmitFraudFix !Attention, following keys are not inevitably infected! SrchSTS.exe by S!Ri Search SharedTaskScheduler’s .dll »»»»»»»»»»»»»»»»»»»»»»»» Killing process »»»»»»»»»»»»»»»»»»»»»»»» hosts 192.168.200.3 ad.doubleclick.net 192.168.200.3 ad.fastclick.net 192.168.200.3 ads.fastclick.net 192.168.200.3 ar.atwola.com 192.168.200.3 atdmt.com 192.168.200.3 avp.ch 192.168.200.3 avp.com 192.168.200.3 avp.ru 192.168.200.3 awaps.net 192.168.200.3 banner.fastclick.net 192.168.200.3 banners.fastclick.net 192.168.200.3 ca.com 192.168.200.3 click.atdmt.com 192.168.200.3 clicks.atdmt.com 192.168.200.3 customer.symantec.com 192.168.200.3 dispatch.mcafee.com 192.168.200.3 download.mcafee.com 192.168.200.3 downloads-us1.kaspersky-labs.com 192.168.200.3 downloads-us2.kaspersky-labs.com 192.168.200.3 downloads-us3.kaspersky-labs.com 192.168.200.3 downloads1.kaspersky-labs.com 192.168.200.3 downloads2.kaspersky-labs.com 192.168.200.3 downloads3.kaspersky-labs.com 192.168.200.3 downloads4.kaspersky-labs.com 192.168.200.3 engine.awaps.net 192.168.200.3 f-secure.com 192.168.200.3 fastclick.net 192.168.200.3 ftp.avp.ch 192.168.200.3 ftp.downloads1.kaspersky-labs.com 192.168.200.3 ftp.downloads2.kaspersky-labs.com 192.168.200.3 ftp.downloads3.kaspersky-labs.com 192.168.200.3 ftp.f-secure.com 192.168.200.3 ftp.kasperskylab.ru 192.168.200.3 ftp.sophos.com 192.168.200.3 ids.kaspersky-labs.com 192.168.200.3 kaspersky-labs.com 192.168.200.3 kaspersky.com 192.168.200.3 liveupdate.symantec.com 192.168.200.3 liveupdate.symantecliveupdate.com 192.168.200.3 mast.mcafee.com 192.168.200.3 mcafee.com 192.168.200.3 media.fastclick.net 192.168.200.3 my-etrust.com 192.168.200.3 nai.com 192.168.200.3 networkassociates.com 192.168.200.3 norton.com 192.168.200.3 phx.corporate-ir.net 192.168.200.3 rads.mcafee.com 192.168.200.3 secure.nai.com 192.168.200.3 securityresponse.symantec.com 192.168.200.3 service1.symantec.com 192.168.200.3 sophos.com 192.168.200.3 spd.atdmt.com 192.168.200.3 symantec.com 192.168.200.3 trendmicro.com 192.168.200.3 update.symantec.com 192.168.200.3 updates.symantec.com 192.168.200.3 updates1.kaspersky-labs.com 192.168.200.3 updates2.kaspersky-labs.com 192.168.200.3 updates3.kaspersky-labs.com 192.168.200.3 updates4.kaspersky-labs.com 192.168.200.3 updates5.kaspersky-labs.com 192.168.200.3 us.mcafee.com 192.168.200.3 vil.nai.com 192.168.200.3 viruslist.com 192.168.200.3 viruslist.ru 192.168.200.3 virusscan.jotti.org 192.168.200.3 virustotal.com 192.168.200.3 http://www.avp.ch 192.168.200.3 http://www.avp.com 192.168.200.3 http://www.avp.ru 192.168.200.3 http://www.awaps.net 192.168.200.3 http://www.ca.com 192.168.200.3 http://www.f-secure.com 192.168.200.3 http://www.fastclick.net 192.168.200.3 http://www.grisoft.com 192.168.200.3 http://www.kaspersky-labs.com 192.168.200.3 http://www.kaspersky.com 192.168.200.3 http://www.kaspersky.ru 192.168.200.3 http://www.mcafee.com 192.168.200.3 http://www.my-etrust.com 192.168.200.3 http://www.nai.com 192.168.200.3 http://www.networkassociates.com 192.168.200.3 http://www.sophos.com 192.168.200.3 http://www.symantec.com 192.168.200.3 http://www.symantec.com 192.168.200.3 http://www.trendmicro.com 192.168.200.3 http://www.viruslist.com 192.168.200.3 http://www.viruslist.ru 192.168.200.3 http://www.virustotal.com 192.168.200.3 www3.ca.com »»»»»»»»»»»»»»»»»»»»»»»» Winsock2 Fix S!Ri’s WS2Fix: LSP not Found. »»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix GenericRenosFix by S!Ri »»»»»»»»»»»»»»»»»»»»»»»» Deleting infected files C:\WINDOWS\system32\printer.exe Deleted »»»»»»»»»»»»»»»»»»»»»»»» DNS HKLM\SYSTEM\CCS\Services\Tcpip…{00E2124A-686A-41C9-87E7-5BF7230EC3B0}: NameServer=194.204.159.1,194.204.152.34 HKLM\SYSTEM\CS1\Services\Tcpip…{00E2124A-686A-41C9-87E7-5BF7230EC3B0}: NameServer=194.204.159.1,194.204.152.34 HKLM\SYSTEM\CS2\Services\Tcpip…{00E2124A-686A-41C9-87E7-5BF7230EC3B0}: NameServer=194.204.159.1,194.204.152.34 »»»»»»»»»»»»»»»»»»»»»»»» Deleting Temp Files »»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System !Attention, following keys are not inevitably infected! [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] “System”="" »»»»»»»»»»»»»»»»»»»»»»»» Registry Cleaning Registry Cleaning done. »»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler After SmitFraudFix !Attention, following keys are not inevitably infected! SrchSTS.exe by S!Ri Search SharedTaskScheduler’s .dll »»»»»»»»»»»»»»»»»»»»»»»» Reboot C:\WINDOWS\system32\stdole32.dat Please, Reboot and Run SmitfraudFix option 2 once again. »»»»»»»»»»»»»»»»»»»»»»»» End Złączono Posta: 29.09.2007 (Sob) 15:13 2007-09-28 18:50 15525 --a------ C:\WINDOWS\prods104.exe 2007-09-28 18:42 15525 --a------ C:\WINDOWS\prods193.exe Sprawdzilem je antywirusem i to sa dialery. Wykasowywuje:)

jessica · 29 Wrzesień 2007 14:29

Tak, o tym dowiedziałam się przy okazji innego tematu, tyle, że tam były inne cyferki.

Oczywiście do usunięcia.

Daj jeszcze raz log z ComboFixa oraz użyj -->SDFix

Uwaga: Da się go uruchomić tylko w Trybie Awaryjnym.

Pokaż Report.txt znajdujący się w folderze SDFix.

jessi

spman · 30 Wrzesień 2007 07:52

LOG z COMBOFIX

ComboFix 07-09-21.2 - “Spman” 2007-09-29 16:56:25.2 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.0.1250.48.1045.18.243 [GMT 2:00] . ((((((((((((((((((((((((( Files Created from 2007-08-28 to 2007-09-29 ))))))))))))))))))))))))))))))) . 2007-09-29 16:33 1,165 --a------ C:\WINDOWS\mozver.dat 2007-09-29 16:28 0 --a------ C:\WINDOWS\nsreg.dat 2007-09-29 16:20 2007-09-29 15:29 42,912 --a------ C:\WINDOWS\system32\drivers\aswTdi.sys 2007-09-29 15:29 26,624 --a------ C:\WINDOWS\system32\drivers\aavmker4.sys 2007-09-29 15:29 23,152 --a------ C:\WINDOWS\system32\drivers\aswRdr.sys 2007-09-29 15:28 95,608 --a------ C:\WINDOWS\system32\AvastSS.scr 2007-09-29 15:28 94,416 --a------ C:\WINDOWS\system32\drivers\aswmon2.sys 2007-09-29 15:28 92,848 --a------ C:\WINDOWS\system32\drivers\aswmon.sys 2007-09-29 15:28 801,144 --a------ C:\WINDOWS\system32\aswBoot.exe 2007-09-29 15:28 1,060,864 --a------ C:\WINDOWS\system32\MFC71.dll 2007-09-29 15:28 2007-09-29 07:35 53,248 --a------ C:\WINDOWS\system32\Process.exe 2007-09-29 07:35 51,200 --a------ C:\WINDOWS\system32\dumphive.exe 2007-09-29 07:35 289,144 --a------ C:\WINDOWS\system32\VCCLSID.exe 2007-09-29 07:35 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe 2007-09-29 07:35 25,088 --a------ C:\WINDOWS\system32\WS2Fix.exe 2007-09-29 07:35 1,074 --a------ C:\WINDOWS\system32\tmp.reg 2007-09-29 07:33 51,200 --a------ C:\WINDOWS\NirCmd.exe 2007-09-28 21:06 70,144 --a–c— C:\WINDOWS\system32\dllcache\usbui.dll 2007-09-28 21:06 50,688 --a–c— C:\WINDOWS\system32\dllcache\usbhub.sys 2007-09-28 21:06 123,264 --a–c— C:\WINDOWS\system32\dllcache\usbport.sys 2007-09-28 21:06 2007-09-28 20:36 2007-09-28 20:28 2007-09-28 20:28 2007-09-28 20:28 2007-09-28 20:28 2007-09-28 20:26 2007-09-28 20:06 337,320 -ra------ C:\WINDOWS\system32\difxapi.dll 2007-09-28 20:06 2007-09-28 19:57 20,640 --------- C:\WINDOWS\system32\drivers\PxHelp20.sys 2007-09-28 19:55 2007-09-28 19:43 2007-09-28 19:38 2007-09-28 19:28 2007-09-28 19:08 2007-09-28 19:06 57,088 --a------ C:\WINDOWS\system32\drivers\redbook.sys 2007-09-28 19:06 3,072 --a------ C:\WINDOWS\system32\drivers\audstub.sys 2007-09-28 19:05 70,144 --a------ C:\WINDOWS\system32\usbui.dll 2007-09-28 19:05 34,112 --a------ C:\WINDOWS\system32\drivers\an983.sys 2007-09-28 19:04 2007-09-28 19:04 2007-09-28 19:04 2007-09-28 19:04 2007-09-28 19:04 2007-09-28 19:04 2007-09-28 19:04 2007-09-28 19:04 2007-09-28 19:04 2007-09-28 19:04 2007-09-28 19:04 2007-09-28 19:04 2007-09-28 19:04 . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2007-09-28 18:51 --------- d-------- C:\Program Files\Common Files\InstallShield 2007-09-28 18:49 499712 --a------ C:\WINDOWS\system32\msvcp71.dll 2007-09-28 18:49 348160 --a------ C:\WINDOWS\system32\msvcr71.dll 2007-09-28 18:14 --------- d-------- C:\Program Files\microsoft frontpage --------- C:\Program Files\Usługi online . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “Zone Labs Client”=“C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe” [2005-01-26 04:23] “AVG7_CC”=“C:\PROGRA~1\Grisoft\AVG7\avgcc.exe” [2007-09-28 18:49] “NvCplDaemon”=“C:\WINDOWS\System32\NvCpl.dll” [2006-10-22 12:22] “nwiz”=“nwiz.exe” [2006-10-22 12:22 C:\WINDOWS\system32\nwiz.exe] “NvMediaCenter”=“C:\WINDOWS\System32\NvMcTray.dll” [2006-10-22 12:22] “SunJavaUpdateSched”=“C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe” [2005-11-10 13:03] “SoundMan”=“SOUNDMAN.EXE” [2006-11-17 05:42 C:\WINDOWS\soundman.exe] “avast!”=“C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe” [2007-09-06 12:06] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “CTFMON.EXE”=“C:\WINDOWS\System32\ctfmon.exe” [2001-10-30 13:00] “MSMSGS”=“C:\Program Files\Messenger\msmsgs.exe” [2001-08-02 07:14] C:\DOCUME~1\Spman\MENUST~1\Programy\AUTOST~1\ OpenOffice.ux.pl 2.0.1.lnk - C:\Program Files\OpenOffice.ux.pl 2.0.1\program\quickstart.exe [2006-01-03 23:50:50] R3 AN983;Karta ADMtek AN983/AN985/ADM951X 10/100Mbps Fast Ethernet;C:\WINDOWS\System32\DRIVERS\AN983.sys *Newly Created Service* - AAVMKER4 *Newly Created Service* - ASWMON2 *Newly Created Service* - ASWRDR *Newly Created Service* - ASWTDI *Newly Created Service* - ASWUPDSV *Newly Created Service* - AVAST!_ANTIVIRUS *Newly Created Service* - AVAST!_MAIL_SCANNER *Newly Created Service* - AVAST!_WEB_SCANNER . ************************************************************************** catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-09-29 16:57:06 Windows 5.1.2600 NTFS scanning hidden processes … scanning hidden autostart entries … scanning hidden files … scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2007-09-29 16:57:31 C:\ComboFix2.txt … 2007-09-29 07:40 . — E O F –

Log z SDFix

SDFix: Version 1.107 Run by Spman on 2007-09-30 at 09:35 Microsoft Windows XP [Wersja 5.1.2600] Running From: C:\SDFix Safe Mode: Checking Services: Restoring Windows Registry Values Restoring Windows Default Hosts File Rebooting… Normal Mode: Checking Files: No Trojan Files Found Removing Temp Files… ADS Check: C:\WINDOWS No streams found. C:\WINDOWS\system32 No streams found. C:\WINDOWS\system32\svchost.exe No streams found. C:\WINDOWS\system32\ntoskrnl.exe No streams found. Final Check: Remaining Services: ------------------ Authorized Application Key Export: [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list] Remaining Files: --------------- Files with Hidden Attributes: Finished!

jessica · 30 Wrzesień 2007 08:47

Nie widzę już nic podejrzanego.

jessi