Problem - chyba adware

ja-kubus · 24 Listopad 2007 14:54

prosimy pomóżcie. :puppydogeyes:

komp taty sie wziął i posypał, jakies straszne adware “live safety” i obciążony procesor na 100%.

cudem zrobiony log Hijack’iem w awaryjnym trybie:

Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 15:52:46, on 2007-11-24 Platform: Windows 2000 SP4 (WinNT 5.00.2195) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Boot mode: Safe mode Running processes: C:\WINNT\System32\smss.exe C:\WINNT\system32\winlogon.exe C:\WINNT\system32\services.exe C:\WINNT\system32\lsass.exe C:\WINNT\system32\svchost.exe C:\WINNT\System32\WBEM\WinMgmt.exe C:\WINNT\Explorer.EXE C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://default.home R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://keyword.netscape.com/keyword/%s R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx O3 - Toolbar: Alcohol Toolbar - {ED4BD629-C1B6-4399-8A34-02CCAA921DC9} - C:\Program Files\Alcohol Toolbar\v3.2.0.0\Alcohol_Toolbar.dll O3 - Toolbar: Security Toolbar - {11A69AE4-FBED-4832-A2BF-45AF82825583} - C:\WINNT\system32\xnkzpfjv.dll O4 - HKLM…\Run: [soundMan] SOUNDMAN.EXE O4 - HKLM…\Run: [HPDJ Taskbar Utility] C:\WINNT\system32\spool\drivers\w32x86\3\hpztsb07.exe O4 - HKLM…\Run: [NVCLOCK] rundll32 nvclock.dll,fnNvclock O4 - HKLM…\Run: [REGSHAVE] C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN O4 - HKLM…\Run: [MKS_MENU] C:\Program Files\MKS\Bin\mks_menu.exe O4 - HKLM…\Run: [nwiz] nwiz.exe /install O4 - HKLM…\Run: [ABREGMON] C:\Program Files\MKS\Bin\ABregmon.exe O4 - HKLM…\Run: [PPMemCheck] C:\PROGRA~1\PESTPA~1\PPMemCheck.exe O4 - HKLM…\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINNT\system32\NvCpl.dll,NvStartup O4 - HKLM…\Run: [CookiePatrol] C:\PROGRA~1\PESTPA~1\CookiePatrol.exe O4 - HKLM…\Run: [atwtusb] atwtusb.exe beta O4 - HKLM…\Run: [DAEMON Tools] “C:\Program Files\DAEMON Tools\daemon.exe” -lang 1033 O4 - HKLM…\Run: [synchronization Manager] mobsync.exe /logon O4 - HKLM…\Run: [PCSuiteTrayApplication] C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -startup O4 - HKLM…\Run: [F-Secure Manager] “C:\Program Files\F-Secure Internet Security\Common\FSM32.EXE” /splash O4 - HKLM…\Run: [F-Secure TNB] “C:\Program Files\F-Secure Internet Security\TNB\TNBUtil.exe” /CHECKALL /WAITFORSW O4 - HKLM…\Run: [F-Secure Startup Wizard] “C:\Program Files\F-Secure Internet Security\FSGUI\FSSW.EXE” /reboot O4 - HKLM…\RunServices: [Microsoft] svcUpdate.exe O4 - HKCU…\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINNT\System32\NVMCTRAY.DLL,NvTaskbarInit O4 - HKCU…\Run: [skype] “C:\Program Files\Skype\Phone\Skype.exe” /nosplash /minimized O4 - HKCU…\Run: [H/PC Connection Agent] “C:\PROGRA~1\MI3AA1~1\wcescomm.exe” O4 - HKCU…\Run: [Gadu-Gadu] “C:\Program Files\Gadu-Gadu\gg.exe” /tray O4 - HKCU…\Run: [PcSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog O4 - HKCU…\Run: [uSBPhone] “C:\Program Files\USBPhone\USBPhone.exe” O4 - HKUS.DEFAULT…\Run: [internat.exe] internat.exe (User ‘Default user’) O4 - HKUS.DEFAULT…\Run: [Nokia.PCSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog (User ‘Default user’) O4 - HKUS.DEFAULT…\RunOnce: [^SetupICWDesktop] C:\Program Files\Internet Explorer\Connection Wizard\icwconn1.exe /desktop (User ‘Default user’) O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat\Reader\reader_sl.exe O8 - Extra context menu item: &Zablokuj to okienko - C:\Program Files\F-Secure Internet Security\Anti-Spyware\blockpopups.htm O8 - Extra context menu item: Transfer with Image Converter 2 - C:\Program Files\Sony\Image Converter 2\menu.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra ‘Tools’ menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll O9 - Extra ‘Tools’ menuitem: Create Mobile Favorite… - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll O9 - Extra button: Osłona programu IE - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\F-Secure Internet Security\Anti-Spyware\ieshield.dll O9 - Extra ‘Tools’ menuitem: Osłona programu IE… - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\F-Secure Internet Security\Anti-Spyware\ieshield.dll O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\WINNT\System32\shdocvw.dll O9 - Extra ‘Tools’ menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\WINNT\System32\shdocvw.dll O13 - DefaultPrefix: O13 - WWW. Prefix: http://ehttp.cc/? O16 - DPF: RaptisoftGameLoader - http://miniclip.com/hamsterball/raptisoftgameloader.cab O16 - DPF: {03F998B2-0E00-11D3-A498-00104B6EB52E} (MetaStreamCtl Class) - https://components.viewpoint.com/MTSIns … ntent.html O16 - DPF: {288C5F13-7E52-4ADA-A32E-F5BF9D125F98} (CR64Loader Object) - http://www.miniclip.com/platypus/miniclipGameLoader.dll O16 - DPF: {31B7EB4E-8B4B-11D1-A789-00A0CC6651A8} (Cult3D ActiveX Player) - http://www.cult3d.com/download/cult.cab O16 - DPF: {EB387D2F-E27B-4D36-979E-847D1036C65D} (QDiagHUpdateObj Class) - http://h30043.www3.hp.com/hpdj/en/check/qdiagh.cab?323 O17 - HKLM\System\CCS\Services\Tcpip…{06B20C27-A6A1-4ACF-990E-8677E3174FA3}: NameServer = 194.204.152.34,194.204.159.1 O17 - HKLM\System\CCS\Services\Tcpip…{59E623D1-0BAE-4E3D-A06A-D7AA709DC2AE}: NameServer = 217.172.224.92,89.228.7.226 O17 - HKLM\System\CS1\Services\Tcpip…{06B20C27-A6A1-4ACF-990E-8677E3174FA3}: NameServer = 194.204.152.34,194.204.159.1 O17 - HKLM\System\CS2\Services\Tcpip…{06B20C27-A6A1-4ACF-990E-8677E3174FA3}: NameServer = 194.204.152.34,194.204.159.1 O23 - Service: ArcaBit NetMonitor (ABNetMon) - ArcaBit sp. z o.o. - C:\Program Files\MKS\Bin\NetMonSV.exe O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: Autodesk Licensing Service - Unknown owner - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe O23 - Service: F-Secure Anti-Virus 2006 (BackWeb Plug-in - 4476822) - F-Secure Internet Security 2005 - C:\PROGRA~1\F-SECU~1\backweb\4476822\Program\SERVIC~1.EXE O23 - Service: Usługa administracyjna Menedżera dysków logicznych (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - F-Secure Corporation - C:\Program Files\F-Secure Internet Security\Anti-Virus\fsgk32st.exe O23 - Service: fsbwsys - F-Secure Corp. - C:\Program Files\F-Secure Internet Security\backweb\4476822\program\fsbwsys.exe O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\F-Secure Internet Security\FWES\Program\fsdfwd.exe O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\F-Secure Internet Security\Common\FSMA32.EXE O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe O23 - Service: MkSUpdateInt - MkS Sp. z o. o. - C:\Program Files\MKS\bin\MkSUpdateInt.exe O23 - Service: MkS_Vir Monitor (MksVirMonSvc) - Unknown owner - C:\Program Files\MKS\Bin\mksmonsv.exe O23 - Service: MkS_Scan - Unknown owner - C:\Program Files\MKS\Bin\mks_scan.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINNT\System32\nvsvc32.exe O23 - Service: ScsiAccess - Unknown owner - C:\Program Files\Photodex\ProShowGold\ScsiAccess.exe O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe O23 - Service: Securom User Access for Windows 2000 and Windows XP a technology by Sony DADC (UserAccess) - Unknown owner - C:\Program Files\Common Files\YDP\UserAccessManager\useraccess.exe O24 - Desktop Component 1: Paris International—Guides and guided tours of Paris and France in many languages by minibus, bus and car, holiday packages, online. - http://www.paris-tours-guides.com/ – End of file - 9183 bytes

Kaka2 · 24 Listopad 2007 15:25

ja-kubus proszę zapoznaj się z tą stroną oraz tym tematem, a następnie popraw tytuł tematu, używając przycisku

Gutek · 24 Listopad 2007 15:53

usuń wpisy HJT

Daj log z ComboFix

ja-kubus · 24 Listopad 2007 16:15

zrobiłem jak napisane wyżej.

ten badziew wyszedl, ale dalej procesor jest na 100% cały czas.

logi HJT i ComboFixem:

Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 18:35:18, on 2007-11-24 Platform: Windows 2000 SP4 (WinNT 5.00.2195) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Boot mode: Normal Running processes: C:\WINNT\System32\smss.exe C:\WINNT\system32\winlogon.exe C:\WINNT\system32\services.exe C:\WINNT\system32\lsass.exe C:\WINNT\system32\svchost.exe C:\WINNT\system32\spoolsv.exe C:\Program Files\MKS\Bin\NetMonSV.exe C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe C:\PROGRA~1\F-SECU~1\backweb\4476822\Program\SERVIC~1.EXE C:\WINNT\System32\svchost.exe C:\Program Files\F-Secure Internet Security\Anti-Virus\fsgk32st.exe C:\Program Files\F-Secure Internet Security\Anti-Virus\FSGK32.EXE C:\Program Files\F-Secure Internet Security\backweb\4476822\program\fsbwsys.exe C:\Program Files\F-Secure Internet Security\Common\FSMA32.EXE C:\Program Files\F-Secure Internet Security\Common\FSMB32.EXE C:\Program Files\Common Files\LightScribe\LSSrvc.exe C:\Program Files\F-Secure Internet Security\Common\FCH32.EXE C:\Program Files\MKS\Bin\mksmonsv.exe C:\Program Files\F-Secure Internet Security\Common\FAMEH32.EXE C:\Program Files\F-Secure Internet Security\Anti-Virus\fsqh.exe C:\WINNT\System32\nvsvc32.exe C:\Program Files\F-Secure Internet Security\Anti-Virus\fsrw.exe C:\WINNT\system32\regsvc.exe C:\WINNT\system32\MSTask.exe C:\Program Files\Photodex\ProShowGold\ScsiAccess.exe C:\WINNT\system32\stisvc.exe C:\Program Files\Common Files\YDP\UserAccessManager\useraccess.exe C:\WINNT\System32\WBEM\WinMgmt.exe C:\WINNT\System32\mspmspsv.exe C:\WINNT\system32\svchost.exe C:\WINNT\Explorer.EXE C:\WINNT\SOUNDMAN.EXE C:\WINNT\system32\spool\drivers\w32x86\3\hpztsb07.exe C:\Program Files\MKS\Bin\mks_menu.exe C:\Program Files\MKS\Bin\ABregmon.exe C:\PROGRA~1\PESTPA~1\PPMemCheck.exe C:\PROGRA~1\PESTPA~1\CookiePatrol.exe C:\WINNT\system32\atwtusb.exe C:\Program Files\DAEMON Tools\daemon.exe C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe C:\Program Files\F-Secure Internet Security\Common\FSM32.EXE C:\WINNT\system32\rundll32.exe C:\Program Files\Unlocker\UnlockerAssistant.exe C:\WINNT\system32\RUNDLL32.EXE C:\Program Files\Skype\Phone\Skype.exe C:\PROGRA~1\MI3AA1~1\wcescomm.exe C:\Program Files\Gadu-Gadu\gg.exe C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe C:\Program Files\USBPhone\USBPhone.exe C:\Program Files\Adobe\Acrobat\Reader\reader_sl.exe C:\Program Files\F-Secure Internet Security\backweb\4476822\Program\fspex.exe C:\PROGRA~1\MI3AA1~1\rapimgr.exe C:\Program Files\F-Secure Internet Security\FWES\Program\fsdfwd.exe C:\Program Files\PC Connectivity Solution\ServiceLayer.exe C:\Program Files\F-Secure Internet Security\Anti-Virus\fssm32.exe C:\Program Files\MKS\Bin\mks_scan.exe C:\Program Files\Common Files\Nokia\MPAPI\MPAPI3s.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://default.home R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://keyword.netscape.com/keyword/%s R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O2 - BHO: Alcohol Toolbar Helper - {8126A4A5-BFD3-46FE-BBDF-BFB5CF78E489} - C:\Program Files\Alcohol Toolbar\v3.2.0.0\Alcohol_Toolbar.dll O4 - HKLM…\Run: [soundMan] SOUNDMAN.EXE O4 - HKLM…\Run: [HPDJ Taskbar Utility] C:\WINNT\system32\spool\drivers\w32x86\3\hpztsb07.exe O4 - HKLM…\Run: [NVCLOCK] rundll32 nvclock.dll,fnNvclock O4 - HKLM…\Run: [REGSHAVE] C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN O4 - HKLM…\Run: [MKS_MENU] C:\Program Files\MKS\Bin\mks_menu.exe O4 - HKLM…\Run: [nwiz] nwiz.exe /install O4 - HKLM…\Run: [ABREGMON] C:\Program Files\MKS\Bin\ABregmon.exe O4 - HKLM…\Run: [PPMemCheck] C:\PROGRA~1\PESTPA~1\PPMemCheck.exe O4 - HKLM…\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINNT\system32\NvCpl.dll,NvStartup O4 - HKLM…\Run: [CookiePatrol] C:\PROGRA~1\PESTPA~1\CookiePatrol.exe O4 - HKLM…\Run: [atwtusb] atwtusb.exe beta O4 - HKLM…\Run: [DAEMON Tools] “C:\Program Files\DAEMON Tools\daemon.exe” -lang 1033 O4 - HKLM…\Run: [synchronization Manager] mobsync.exe /logon O4 - HKLM…\Run: [PCSuiteTrayApplication] C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -startup O4 - HKLM…\Run: [F-Secure Manager] “C:\Program Files\F-Secure Internet Security\Common\FSM32.EXE” /splash O4 - HKLM…\Run: [F-Secure TNB] “C:\Program Files\F-Secure Internet Security\TNB\TNBUtil.exe” /CHECKALL /WAITFORSW O4 - HKLM…\Run: [F-Secure Startup Wizard] “C:\Program Files\F-Secure Internet Security\FSGUI\FSSW.EXE” /reboot O4 - HKLM…\Run: [unlockerAssistant] “C:\Program Files\Unlocker\UnlockerAssistant.exe” O4 - HKCU…\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINNT\System32\NVMCTRAY.DLL,NvTaskbarInit O4 - HKCU…\Run: [skype] “C:\Program Files\Skype\Phone\Skype.exe” /nosplash /minimized O4 - HKCU…\Run: [H/PC Connection Agent] “C:\PROGRA~1\MI3AA1~1\wcescomm.exe” O4 - HKCU…\Run: [Gadu-Gadu] “C:\Program Files\Gadu-Gadu\gg.exe” /tray O4 - HKCU…\Run: [PcSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog O4 - HKCU…\Run: [uSBPhone] “C:\Program Files\USBPhone\USBPhone.exe” O4 - HKUS.DEFAULT…\Run: [internat.exe] internat.exe (User ‘Default user’) O4 - HKUS.DEFAULT…\Run: [Nokia.PCSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog (User ‘Default user’) O4 - HKUS.DEFAULT…\RunOnce: [^SetupICWDesktop] C:\Program Files\Internet Explorer\Connection Wizard\icwconn1.exe /desktop (User ‘Default user’) O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat\Reader\reader_sl.exe O4 - Global Startup: F-Secure Anti-Virus 2006.lnk = C:\Program Files\F-Secure Internet Security\backweb\4476822\Program\fspex.exe O8 - Extra context menu item: &Zablokuj to okienko - C:\Program Files\F-Secure Internet Security\Anti-Spyware\blockpopups.htm O8 - Extra context menu item: Transfer with Image Converter 2 - C:\Program Files\Sony\Image Converter 2\menu.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra ‘Tools’ menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll O9 - Extra ‘Tools’ menuitem: Create Mobile Favorite… - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll O9 - Extra button: Osłona programu IE - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\F-Secure Internet Security\Anti-Spyware\ieshield.dll O9 - Extra ‘Tools’ menuitem: Osłona programu IE… - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\F-Secure Internet Security\Anti-Spyware\ieshield.dll O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\WINNT\System32\shdocvw.dll O9 - Extra ‘Tools’ menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\WINNT\System32\shdocvw.dll O13 - DefaultPrefix: O16 - DPF: RaptisoftGameLoader - http://miniclip.com/hamsterball/raptisoftgameloader.cab O16 - DPF: {03F998B2-0E00-11D3-A498-00104B6EB52E} (MetaStreamCtl Class) - https://components.viewpoint.com/MTSIns … ntent.html O16 - DPF: {288C5F13-7E52-4ADA-A32E-F5BF9D125F98} (CR64Loader Object) - http://www.miniclip.com/platypus/miniclipGameLoader.dll O16 - DPF: {31B7EB4E-8B4B-11D1-A789-00A0CC6651A8} (Cult3D ActiveX Player) - http://www.cult3d.com/download/cult.cab O16 - DPF: {EB387D2F-E27B-4D36-979E-847D1036C65D} (QDiagHUpdateObj Class) - http://h30043.www3.hp.com/hpdj/en/check/qdiagh.cab?323 O17 - HKLM\System\CCS\Services\Tcpip…{06B20C27-A6A1-4ACF-990E-8677E3174FA3}: NameServer = 194.204.152.34,194.204.159.1 O17 - HKLM\System\CCS\Services\Tcpip…{59E623D1-0BAE-4E3D-A06A-D7AA709DC2AE}: NameServer = 217.172.224.92,89.228.7.226 O17 - HKLM\System\CS1\Services\Tcpip…{06B20C27-A6A1-4ACF-990E-8677E3174FA3}: NameServer = 194.204.152.34,194.204.159.1 O17 - HKLM\System\CS2\Services\Tcpip…{06B20C27-A6A1-4ACF-990E-8677E3174FA3}: NameServer = 194.204.152.34,194.204.159.1 O20 - Winlogon Notify: ATWinLog - C:\WINNT\SYSTEM32\ATWinLog.dll O20 - Winlogon Notify: wvutqrp - wvutqrp.dll (file missing) O20 - Winlogon Notify: xnkzpfjv - xnkzpfjv.dll (file missing) O23 - Service: ArcaBit NetMonitor (ABNetMon) - ArcaBit sp. z o.o. - C:\Program Files\MKS\Bin\NetMonSV.exe O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: Autodesk Licensing Service - Unknown owner - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe O23 - Service: F-Secure Anti-Virus 2006 (BackWeb Plug-in - 4476822) - F-Secure Internet Security 2005 - C:\PROGRA~1\F-SECU~1\backweb\4476822\Program\SERVIC~1.EXE O23 - Service: Usługa administracyjna Menedżera dysków logicznych (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - F-Secure Corporation - C:\Program Files\F-Secure Internet Security\Anti-Virus\fsgk32st.exe O23 - Service: fsbwsys - F-Secure Corp. - C:\Program Files\F-Secure Internet Security\backweb\4476822\program\fsbwsys.exe O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\F-Secure Internet Security\FWES\Program\fsdfwd.exe O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\F-Secure Internet Security\Common\FSMA32.EXE O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe O23 - Service: MkSUpdateInt - MkS Sp. z o. o. - C:\Program Files\MKS\bin\MkSUpdateInt.exe O23 - Service: MkS_Vir Monitor (MksVirMonSvc) - Unknown owner - C:\Program Files\MKS\Bin\mksmonsv.exe O23 - Service: MkS_Scan - Unknown owner - C:\Program Files\MKS\Bin\mks_scan.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINNT\System32\nvsvc32.exe O23 - Service: ScsiAccess - Unknown owner - C:\Program Files\Photodex\ProShowGold\ScsiAccess.exe O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe O23 - Service: Securom User Access for Windows 2000 and Windows XP a technology by Sony DADC (UserAccess) - Unknown owner - C:\Program Files\Common Files\YDP\UserAccessManager\useraccess.exe O24 - Desktop Component 1: Paris International—Guides and guided tours of Paris and France in many languages by minibus, bus and car, holiday packages, online. - http://www.paris-tours-guides.com/ – End of file - 12027 bytes

ComboFix 07-11-19.3 - m 2007-11-24 18:36:45.2 - NTFSx86 Microsoft Windows 2000 Professional 5.0.2195.4.1250.1.1045.18.345 [GMT 1:00]Running from: C:\Documents and Settings\m\Pulpit\000\ComboFix.exe . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\WINNT\system32\xnkzpfjv.dllbox . ((((((((((((((((((((((((( Files Created from 2007-10-24 to 2007-11-24 ))))))))))))))))))))))))))))))) . 2007-11-24 18:44 16,384 --a----t- C:\WINNT\system32\Perflib_Perfdata_5d4.dat 2007-11-24 13:42 2007-11-24 13:42 28 --a------ C:\WINNT\system32\slootniw01.dll 2007-11-24 12:48 2007-11-23 23:03 2007-11-23 22:36 2007-11-23 22:36 70,864 --a------ C:\WINNT\system32\drivers\fsdfw.sys 2007-11-23 22:36 33,584 --a------ C:\WINNT\system32\drivers\fsndis5.sys 2007-11-23 22:23 2007-11-23 22:23 118,842 -r------- C:\WINNT\bwUnin-6.3.2.116-4476822L.exe 2007-11-23 22:22 2007-11-23 11:26 749,968 —hs---- C:\WINNT\system32\rehhsbgt.ini 2007-11-23 11:26 83,520 --a------ C:\WINNT\system32\whrntqps.dll 2007-11-23 11:25 85,056 --a------ C:\WINNT\system32\tgbshher.dll 2007-11-23 11:24 71,232 --a------ C:\WINNT\system32\pxfgvvwq.exe 2007-11-23 11:23 145,984 --a------ C:\WINNT\system32\rrjpesqy.dll 2007-11-23 11:10 2007-11-22 00:02 2007-11-22 00:02 2007-11-22 00:02 229,057 --a------ C:\WINNT\Alcohol_Toolbar_Uninstaller_7000.exe 2007-11-21 23:48 . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2007-11-24 17:32 --------- d-----w C:\Program Files\PestPatrol 2007-11-24 17:32 --------- d-----w C:\Documents and Settings\m\Dane aplikacji\Skype 2007-11-24 16:24 --------- d-----w C:\Program Files\TrojanHunter 4.0 2007-11-23 21:34 --------- d-----w C:\Program Files\Lavasoft 2007-11-23 21:34 --------- d-----w C:\Documents and Settings\m\Dane aplikacji\Lavasoft 2007-11-23 11:15 --------- d-----w C:\Program Files\NoAdware 2007-11-23 11:15 --------- d-----w C:\Program Files\BearShare 2007-11-21 22:57 685,816 ----a-w C:\WINNT\system32\drivers\sptd.sys 2007-11-21 22:48 --------- d-----w C:\Program Files\Elaborate Bytes 2007-10-25 21:26 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\DVD Shrink 2007-10-18 16:53 --------- d-----w C:\Program Files\Nokia 2007-10-18 16:53 --------- d-----w C:\Program Files\Common Files\Nokia 2007-10-18 16:53 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Nokia 2007-10-18 16:26 --------- d-----w C:\Documents and Settings\m\Dane aplikacji\PC Suite 2007-10-15 06:02 --------- d-----w C:\Program Files\eMule 2005-06-08 07:42 302 —ha-w C:\Documents and Settings\m\hpothb07.dat 2005-06-08 07:41 0 —ha-w C:\Documents and Settings\Default User\hpothb07.dat 2005-06-08 07:41 0 —ha-w C:\Documents and Settings\All Users\hpothb07.dat 2005-06-08 07:41 0 —ha-w C:\Documents and Settings\Administrator\hpothb07.dat 2005-06-08 07:41 0 —ha-w C:\Documents and Settings\administrator poczty\hpothb07.dat . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “NvMediaCenter”=“RUNDLL32.exe” [00-03-21 01:00 C:\WINNT\system32\rundll32.exe] “Skype”=“C:\Program Files\Skype\Phone\Skype.exe” [06-05-15 14:40] “H/PC Connection Agent”=“C:\PROGRA~1\MI3AA1~1\wcescomm.exe” [05-11-15 18:44] “Gadu-Gadu”=“C:\Program Files\Gadu-Gadu\gg.exe” [06-11-14 10:12] “PcSync”=“C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe” [07-06-19 09:17] “USBPhone”=“C:\Program Files\USBPhone\USBPhone.exe” [06-07-05 04:04] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “SoundMan”=“SOUNDMAN.EXE” [02-09-11 03:57 C:\WINNT\SOUNDMAN.EXE] “HPDJ Taskbar Utility”=“C:\WINNT\system32\spool\drivers\w32x86\3\hpztsb07.exe” [02-12-10 01:19] “NVCLOCK”=“nvclock.dll” [02-08-29 00:37 C:\WINNT\system32\nvclock.dll] “REGSHAVE”=“C:\Program Files\REGSHAVE\REGSHAVE.exe” [02-02-04 22:32] “MKS_MENU”=“C:\Program Files\MKS\Bin\mks_menu.exe” [06-02-11 11:34] “nwiz”=“nwiz.exe” [03-11-17 10:33 C:\WINNT\system32\nwiz.exe] “ABREGMON”=“C:\Program Files\MKS\Bin\ABregmon.exe” [05-11-25 10:26] “PPMemCheck”=“C:\PROGRA~1\PESTPA~1\PPMemCheck.exe” [03-04-19 07:53] “NvCplDaemon”=“RUNDLL32.exe” [00-03-21 01:00 C:\WINNT\system32\rundll32.exe] “CookiePatrol”=“C:\PROGRA~1\PESTPA~1\CookiePatrol.exe” [05-01-10 09:35] “atwtusb”=“atwtusb.exe” [05-09-21 18:08 C:\WINNT\system32\ATWTUSB.EXE] “DAEMON Tools”=“C:\Program Files\DAEMON Tools\daemon.exe” [05-12-10 15:57] “Synchronization Manager”=“mobsync.exe” [03-06-19 20:05 C:\WINNT\system32\mobsync.exe] “PCSuiteTrayApplication”=“C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe” [07-06-18 14:10] “F-Secure Manager”=“C:\Program Files\F-Secure Internet Security\Common\FSM32.exe” [05-06-02 23:37] “F-Secure TNB”=“C:\Program Files\F-Secure Internet Security\TNB\TNBUtil.exe” [05-07-18 15:51] “F-Secure Startup Wizard”=“C:\Program Files\F-Secure Internet Security\FSGUI\FSSW.exe” [05-08-23 14:38] “UnlockerAssistant”=“C:\Program Files\Unlocker\UnlockerAssistant.exe” [06-09-07 18:19] [HKEY_USERS.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] “internat.exe”=“internat.exe” [00-03-21 01:00 C:\WINNT\system32\internat.exe] “Nokia.PCSync”=“C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe” [07-06-19 09:17] [HKEY_USERS.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce] “^SetupICWDesktop”=“C:\Program Files\Internet Explorer\Connection Wizard\icwconn1.exe” [03-06-19 20:05] C:\Documents and Settings\m\Menu Start\Programy\Autostart\ Adobe Gamma.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2003-06-06 23:04:50] C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\ Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat\Reader\reader_sl.exe [2005-09-24 06:05:26] F-Secure Anti-Virus 2006.lnk - C:\Program Files\F-Secure Internet Security\backweb\4476822\Program\fspex.exe [2007-11-23 22:23:59] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] “NoStartMenuPinnedList”= 0 (0x0) “NoStartMenuMFUprogramsList”= 0 (0x0) “NoUserNameInStartMenu”= 0 (0x0) “NoStartMenuSubFolders”= 0 (0x0) “NoCommonGroups”= 0 (0x0) “NoRecentDocsMenu”= 0 (0x0) “NoPrinterTabs”= 0 (0x0) “NoDeletePrinter”= 0 (0x0) “NoAddPrinter”= 0 (0x0) “NoPrinters”= 0 (0x0) “NoFavoritesMenu”= 0 (0x0) “NoSetFolders”= 0 (0x0) “NoShellSearchButton”= 0 (0x0) “NoToolbarCustomize”= 0 (0x0) “NoRecentDocsNetHood”= 0 (0x0) “NoChangeAnimation”= 0 (0x0) “NoChangeKeyboardNavigationIndicators”= 0 (0x0) [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ActiveSync] WcesWlgn.dll 05-11-15 18:44 7168 C:\WINNT\system32\WcesWlgn.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ATWinLog] ATWinLog.dll 05-06-17 18:51 49152 C:\WINNT\system32\ATWinLog.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\wvutqrp] wvutqrp.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\xnkzpfjv] xnkzpfjv.dll R0 FSFW;F-Secure Firewall Driver;C:\WINNT\system32\drivers\fsdfw.sys R1 ABTDI;ABTDI;??\C:\Program Files\MKS\Bin\ABTDI.sys R1 cdawdm;cdawdm;C:\WINNT\system32\DRIVERS\cdawdm.sys R1 kbfilter;Keyboard Filter Driver;C:\WINNT\system32\drivers\kbfilter.sys R2 BackWeb Plug-in - 4476822;F-Secure Anti-Virus 2006;C:\PROGRA~1\F-SECU~1\backweb\4476822\Program\SERVIC~1.EXE R2 F-Secure Filter;F-Secure File System Filter;??\C:\Program Files\F-Secure Internet Security\Anti-Virus\Win2K\FSfilter.sys R2 F-Secure Gatekeeper;F-Secure Gatekeeper;??\C:\Program Files\F-Secure Internet Security\Anti-Virus\Win2K\FSgk.sys R2 F-Secure Recognizer;F-Secure File System Recognizer;??\C:\Program Files\F-Secure Internet Security\Anti-Virus\Win2K\FSrec.sys R2 U3sHlpDr;U3sHlpDr;??\C:\WINNT\System32\Drivers\U3sHlpDr.sys R3 EUSBMASS;eUSB Mass Storage Driver;C:\WINNT\system32\DRIVERS\EUSBMASS.SYS R3 MksMonEn;MkS_Mon Kernel Engine;??\C:\Program Files\MKS\Bin\MksMonEn.sys R3 MksMonEv;MkS_Mon Kernel Events;??\C:\Program Files\MKS\Bin\MksMonEv.sys R3 MksMonFd;MkS_Mon Kernel Filter Driver;??\C:\Program Files\MKS\Bin\mksmonfd.sys R3 usbhub20;USB 2.0 Root Hub Support;C:\WINNT\system32\DRIVERS\usbhub20.sys S1 aiptektp;HyperPen;C:\WINNT\system32\DRIVERS\aiptektp.sys S1 sglfb;sglfb;C:\WINNT\system32\drivers\sglfb.sys S3 Amps2prt;A4Tech PS/2 Port Mouse Driver;C:\WINNT\system32\DRIVERS\Amps2prt.sys S3 BTCOMM;BTCOMM;C:\WINNT\system32\drivers\Btcomm.sys S3 BTKRNBDG;Bluetooth COM Bridge;C:\WINNT\system32\DRIVERS\btkrnbdg.sys S3 BTNetFilter;Bluetooth Network Filter;??\C:\WINNT\system32\drivers\BTNetFilter.sys S3 pohci13F;pohci13F;??\C:\DOCUME~1\m\USTAWI~1\Temp\pohci13F.sys S3 SetupNTGLM7X;SetupNTGLM7X;??\D:\NTGLM7X.sys S3 SmartCd;SmartCd;C:\WINNT\system32\Drivers\SmartCd.sys S3 usb_rndisy;USB RNDIS Adapter;C:\WINNT\system32\DRIVERS\usb8023y.sys S3 V3CB012D;FinePix Digital Camera 030616;C:\WINNT\system32\Drivers\V3CB012D.SYS S3 viafilter;VIA USB Filter;C:\WINNT\system32\Drivers\viausb.sys . Contents of the ‘Scheduled Tasks’ folder “2007-11-24 10:34:01 C:\WINNT\Tasks\MkSUpdate.job” - C:\Program Files\MKS\bin\mks_upd.exe . ************************************************************************** catchme 0.3.1262 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-11-24 18:44:53 Windows 5.0.2195 Service Pack 4 NTFS scanning hidden processes … scanning hidden autostart entries … scanning hidden files … ************************************************************************** [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\VGAUTI] “ImagePath”="??\C:\WINNT\system32\DRIVERS\VGAUTI.sys" . Completion time: 2007-11-24 18:48:02 - machine was rebooted C:\ComboFix2.txt … 07-11-24 18:05 . — E O F —