Problem z dllhost i urdvxc

[dawidowski (Davids)]

Logfile of The Avenger version 1, by Swandog46 Running from registry key: \Registry\Machine\System\CurrentControlSet\Services\swhhktyr ******************* Script file located at: ??\C:\tx^mombl.txt Script file opened successfully. Script file read successfully Backups directory opened successfully at C:\Avenger ******************* Beginning to process script file: File C:\WINDOWS\system32\awtqnlm.dll deleted successfully. File C:\WINDOWS\system32\awvts.dll deleted successfully. File C:\WINDOWS\system32\ddabc.dll deleted successfully. File C:\WINDOWS\system32\ddccd.dll deleted successfully. File C:\WINDOWS\system32\efcyvvs.dll deleted successfully. File C:\WINDOWS\system32\gebabba.dll deleted successfully. File C:\WINDOWS\system32\gebcb.dll deleted successfully. File C:\WINDOWS\system32\gebcy.dll deleted successfully. File C:\WINDOWS\system32\gebya.dll deleted successfully. File C:\WINDOWS\system32\geeby.dll deleted successfully. File C:\WINDOWS\system32\geedb.dll deleted successfully. File C:\WINDOWS\system32\hgghiij.dll deleted successfully. File C:\WINDOWS\system32\jkhff.dll deleted successfully. File C:\WINDOWS\system32\jkhhe.dll deleted successfully. File C:\WINDOWS\system32\jkkli.dll deleted successfully. File C:\WINDOWS\system32\mljgd.dll deleted successfully. File C:\WINDOWS\system32\mljgf.dll deleted successfully. File C:\WINDOWS\system32\mljji.dll deleted successfully. File C:\WINDOWS\system32\mljjj.dll deleted successfully. File C:\WINDOWS\system32\mllmk.dll deleted successfully. File C:\WINDOWS\system32\nnnommn.dll deleted successfully. File C:\WINDOWS\system32\opnkjjg.dll deleted successfully. File C:\WINDOWS\system32\opnlmml.dll deleted successfully. File C:\WINDOWS\system32\opnooom.dll deleted successfully. File C:\WINDOWS\system32\pmkjj.dll deleted successfully. File C:\WINDOWS\system32\pmnno.dll deleted successfully. File C:\WINDOWS\system32\rqrrpol.dll deleted successfully. File C:\WINDOWS\system32\ssqpq.dll deleted successfully. File C:\WINDOWS\system32\ssttt.dll deleted successfully. File C:\WINDOWS\system32\vturo.dll deleted successfully. File C:\WINDOWS\system32\vtutq.dll deleted successfully. File C:\WINDOWS\system32\vtutt.dll deleted successfully. File C:\WINDOWS\system32\yayxvts.dll deleted successfully. File C:\WINDOWS\system32\yayyayy.dll deleted successfully. Completed script processing. ******************* Finished! Terminate.

[Bieniol (Bbieniol)]

Ten raport nam nie wystarczy. Wklej nowe logi

[dawidowski (Davids)]

Log z GMERA

1. Zakładka Rootkit > zaznacz wszystko oprócz Pokaż wszystko > kliknij Szukaj

GMER 1.0.12.12010 - http://www.gmer.net Rootkit scan 2007-01-20 10:15:08 Windows 5.1.2600 Dodatek Service Pack. 1 ---- System - GMER 1.0.12 ---- SSDT \SystemRoot\system32\drivers\fwdrv.sys ZwClose SSDT \SystemRoot\system32\drivers\fwdrv.sys ZwCreateFile SSDT \SystemRoot\system32\drivers\fwdrv.sys ZwCreateKey SSDT \SystemRoot\system32\drivers\fwdrv.sys ZwCreateProcess SSDT \SystemRoot\system32\drivers\fwdrv.sys ZwCreateProcessEx SSDT \SystemRoot\system32\drivers\fwdrv.sys ZwCreateThread SSDT \SystemRoot\system32\drivers\fwdrv.sys ZwDeleteFile SSDT \SystemRoot\system32\drivers\fwdrv.sys ZwDeleteKey SSDT \SystemRoot\system32\drivers\fwdrv.sys ZwDeleteValueKey SSDT sptd.sys ZwEnumerateKey SSDT sptd.sys ZwEnumerateValueKey SSDT \SystemRoot\system32\drivers\khips.sys ZwLoadDriver SSDT \SystemRoot\system32\drivers\khips.sys ZwMapViewOfSection SSDT \SystemRoot\system32\drivers\fwdrv.sys ZwOpenFile SSDT \SystemRoot\system32\drivers\fwdrv.sys ZwOpenKey SSDT sptd.sys ZwQueryKey SSDT sptd.sys ZwQueryValueKey SSDT \SystemRoot\system32\drivers\fwdrv.sys ZwResumeThread SSDT \SystemRoot\system32\drivers\fwdrv.sys ZwSetInformationFile SSDT \SystemRoot\system32\drivers\fwdrv.sys ZwSetValueKey SSDT \SystemRoot\system32\drivers\fwdrv.sys ZwWriteFile ---- Kernel code sections - GMER 1.0.12 ---- .text ntoskrnl.exe!KeInitializeInterrupt + B67 804DA23C 1 Byte [06] .text ntoskrnl.exe!KeI386Call16BitCStyleFunction + 170 805025EC 4 Bytes [10, 01, D8, F4] .text ntoskrnl.exe!KeI386Call16BitCStyleFunction + 1A0 8050261C 4 Bytes [20, F9, D7, F4] .text ntoskrnl.exe!KeI386Call16BitCStyleFunction + 1B0 8050262C 4 Bytes [E0, BE, D7, F4] .text ntoskrnl.exe!KeI386Call16BitCStyleFunction + 1C8 80502644 8 Bytes [20, EF, D7, F4, 90, ED, D7, …] .text ntoskrnl.exe!KeI386Call16BitCStyleFunction + 1E0 8050265C 4 Bytes [80, F4, D7, F4] .text … PAGENDSM NDIS.sys!NdisMIndicateStatus F75EF87D 6 Bytes [FF, 25, 88, 15, DF, F4] .text ntdll.dll!NtClose 77F758AA 5 Bytes JMP 72033FAA .text ntdll.dll!NtCreateProcess 77F759F4 5 Bytes JMP 72034135 .text ntdll.dll!NtCreateProcessEx 77F75A03 5 Bytes JMP 72034019 .text ntdll.dll!NtCreateSection 77F75A21 5 Bytes JMP 72033FC8 ---- User code sections - GMER 1.0.12 ---- .text C:\WINDOWS\system32\nvsvc32.exe[272] kernel32.dll!VirtualProtect 77E6169E 5 Bytes JMP 00130090 .text C:\WINDOWS\system32\nvsvc32.exe[272] kernel32.dll!WriteProcessMemory 77E61A94 5 Bytes JMP 00130694 .text C:\WINDOWS\system32\nvsvc32.exe[272] kernel32.dll!CreateProcessW 77E61B8E 5 Bytes JMP 001302C0 .text C:\WINDOWS\system32\nvsvc32.exe[272] kernel32.dll!CreateProcessA 77E61BBC 5 Bytes JMP 00130234 .text C:\WINDOWS\system32\nvsvc32.exe[272] kernel32.dll!WinExec 77E6FD35 5 Bytes JMP 00130464 .text C:\WINDOWS\system32\nvsvc32.exe[272] kernel32.dll!CreateProcessInternalA 77E73306 5 Bytes JMP 0013034C .text C:\WINDOWS\system32\nvsvc32.exe[272] kernel32.dll!VirtualAllocEx 77E7AC24 5 Bytes JMP 0013011C .text C:\WINDOWS\system32\nvsvc32.exe[272] kernel32.dll!VirtualAlloc 77E7AC72 5 Bytes JMP 00130004 .text C:\WINDOWS\system32\nvsvc32.exe[272] kernel32.dll!CreateRemoteThread 77E7BC9F 5 Bytes JMP 001304F0 .text C:\WINDOWS\system32\nvsvc32.exe[272] kernel32.dll!CreateThread 77E7BE53 5 Bytes JMP 0013057C .text C:\WINDOWS\system32\nvsvc32.exe[272] kernel32.dll!VirtualProtectEx 77E7D258 5 Bytes JMP 001301A8 .text C:\WINDOWS\system32\nvsvc32.exe[272] kernel32.dll!CreateProcessInternalW 77E8033A 5 Bytes JMP 001303D8 .text C:\WINDOWS\system32\nvsvc32.exe[272] kernel32.dll!SetThreadContext 77E9391A 5 Bytes JMP 00130608 .text C:\WINDOWS\system32\nvsvc32.exe[272] USER32.dll!SetWindowsHookExA 77D45006 5 Bytes JMP 00130720 .text C:\WINDOWS\system32\nvsvc32.exe[272] USER32.dll!SetWindowsHookExW 77D4506A 5 Bytes JMP 001307AC .text C:\WINDOWS\system32\rundll32.exe[284] kernel32.dll!VirtualProtect 77E6169E 5 Bytes JMP 00070090 .text C:\WINDOWS\system32\rundll32.exe[284] kernel32.dll!WriteProcessMemory 77E61A94 5 Bytes JMP 00070694 .text C:\WINDOWS\system32\rundll32.exe[284] kernel32.dll!CreateProcessW 77E61B8E 5 Bytes JMP 000702C0 .text C:\WINDOWS\system32\rundll32.exe[284] kernel32.dll!CreateProcessA 77E61BBC 5 Bytes JMP 00070234 .text C:\WINDOWS\system32\rundll32.exe[284] kernel32.dll!WinExec 77E6FD35 5 Bytes JMP 00070464 .text C:\WINDOWS\system32\rundll32.exe[284] kernel32.dll!CreateProcessInternalA 77E73306 5 Bytes JMP 0007034C .text C:\WINDOWS\system32\rundll32.exe[284] kernel32.dll!VirtualAllocEx 77E7AC24 5 Bytes JMP 0007011C .text C:\WINDOWS\system32\rundll32.exe[284] kernel32.dll!VirtualAlloc 77E7AC72 5 Bytes JMP 00070004 .text C:\WINDOWS\system32\rundll32.exe[284] kernel32.dll!CreateRemoteThread 77E7BC9F 5 Bytes JMP 000704F0 .text C:\WINDOWS\system32\rundll32.exe[284] kernel32.dll!CreateThread 77E7BE53 5 Bytes JMP 0007057C .text C:\WINDOWS\system32\rundll32.exe[284] kernel32.dll!VirtualProtectEx 77E7D258 5 Bytes JMP 000701A8 .text C:\WINDOWS\system32\rundll32.exe[284] kernel32.dll!CreateProcessInternalW 77E8033A 5 Bytes JMP 000703D8 .text C:\WINDOWS\system32\rundll32.exe[284] kernel32.dll!SetThreadContext 77E9391A 5 Bytes JMP 00070608 .text C:\WINDOWS\system32\rundll32.exe[284] USER32.dll!SetWindowsHookExA 77D45006 5 Bytes JMP 00070720 .text C:\WINDOWS\system32\rundll32.exe[284] USER32.dll!SetWindowsHookExW 77D4506A 5 Bytes JMP 000707AC .text C:\WINDOWS\system32\devldr32.exe[308] kernel32.dll!VirtualProtect 77E6169E 5 Bytes JMP 00070090 .text C:\WINDOWS\system32\devldr32.exe[308] kernel32.dll!WriteProcessMemory 77E61A94 5 Bytes JMP 00070694 .text C:\WINDOWS\system32\devldr32.exe[308] kernel32.dll!CreateProcessW 77E61B8E 5 Bytes JMP 000702C0 .text C:\WINDOWS\system32\devldr32.exe[308] kernel32.dll!CreateProcessA 77E61BBC 5 Bytes JMP 00070234 .text C:\WINDOWS\system32\devldr32.exe[308] kernel32.dll!WinExec 77E6FD35 5 Bytes JMP 00070464 .text C:\WINDOWS\system32\devldr32.exe[308] kernel32.dll!CreateProcessInternalA 77E73306 5 Bytes JMP 0007034C .text C:\WINDOWS\system32\devldr32.exe[308] kernel32.dll!VirtualAllocEx 77E7AC24 5 Bytes JMP 0007011C .text C:\WINDOWS\system32\devldr32.exe[308] kernel32.dll!VirtualAlloc 77E7AC72 5 Bytes JMP 00070004 .text C:\WINDOWS\system32\devldr32.exe[308] kernel32.dll!CreateRemoteThread 77E7BC9F 5 Bytes JMP 000704F0 .text C:\WINDOWS\system32\devldr32.exe[308] kernel32.dll!CreateThread 77E7BE53 5 Bytes JMP 0007057C .text C:\WINDOWS\system32\devldr32.exe[308] kernel32.dll!VirtualProtectEx 77E7D258 5 Bytes JMP 000701A8 .text C:\WINDOWS\system32\devldr32.exe[308] kernel32.dll!CreateProcessInternalW 77E8033A 5 Bytes JMP 000703D8 .text C:\WINDOWS\system32\devldr32.exe[308] kernel32.dll!SetThreadContext 77E9391A 5 Bytes JMP 00070608 .text C:\WINDOWS\system32\devldr32.exe[308] USER32.dll!SetWindowsHookExA 77D45006 5 Bytes JMP 00070720 .text C:\WINDOWS\system32\devldr32.exe[308] USER32.dll!SetWindowsHookExW 77D4506A 5 Bytes JMP 000707AC .text C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe[340] kernel32.dll!VirtualProtect 77E6169E 5 Bytes JMP 00130090 .text C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe[340] kernel32.dll!WriteProcessMemory 77E61A94 5 Bytes JMP 00130694 .text C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe[340] kernel32.dll!CreateProcessW 77E61B8E 5 Bytes JMP 001302C0 .text C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe[340] kernel32.dll!CreateProcessA 77E61BBC 5 Bytes JMP 00130234 .text C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe[340] kernel32.dll!WinExec 77E6FD35 5 Bytes JMP 00130464 .text C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe[340] kernel32.dll!CreateProcessInternalA 77E73306 5 Bytes JMP 0013034C .text C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe[340] kernel32.dll!VirtualAllocEx 77E7AC24 5 Bytes JMP 0013011C .text C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe[340] kernel32.dll!VirtualAlloc 77E7AC72 5 Bytes JMP 00130004 .text C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe[340] kernel32.dll!CreateRemoteThread 77E7BC9F 5 Bytes JMP 001304F0 .text C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe[340] kernel32.dll!CreateThread 77E7BE53 5 Bytes JMP 0013057C .text C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe[340] kernel32.dll!VirtualProtectEx 77E7D258 5 Bytes JMP 001301A8 .text C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe[340] kernel32.dll!CreateProcessInternalW 77E8033A 5 Bytes JMP 001303D8 .text C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe[340] kernel32.dll!SetThreadContext 77E9391A 5 Bytes JMP 00130608 .text C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe[340] USER32.dll!SetWindowsHookExA 77D45006 5 Bytes JMP 00130720 .text C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe[340] USER32.dll!SetWindowsHookExW 77D4506A 5 Bytes JMP 001307AC .text C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe[340] WS2_32.dll!socket 71A53C22 5 Bytes JMP 001308C4 .text C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe[340] WS2_32.dll!connect 71A53E5D 5 Bytes JMP 00130950 .text C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe[340] WS2_32.dll!bind 71A53ECE 5 Bytes JMP 00130838 .text C:\WINDOWS\system32\svchost.exe[380] kernel32.dll!VirtualProtect 77E6169E 5 Bytes JMP 00070090 .text C:\WINDOWS\system32\svchost.exe[380] kernel32.dll!WriteProcessMemory 77E61A94 5 Bytes JMP 00070694 .text C:\WINDOWS\system32\svchost.exe[380] kernel32.dll!CreateProcessW 77E61B8E 5 Bytes JMP 000702C0 .text C:\WINDOWS\system32\svchost.exe[380] kernel32.dll!CreateProcessA 77E61BBC 5 Bytes JMP 00070234 .text C:\WINDOWS\system32\svchost.exe[380] kernel32.dll!WinExec 77E6FD35 5 Bytes JMP 00070464 .text C:\WINDOWS\system32\svchost.exe[380] kernel32.dll!CreateProcessInternalA 77E73306 5 Bytes JMP 0007034C .text C:\WINDOWS\system32\svchost.exe[380] kernel32.dll!VirtualAllocEx 77E7AC24 5 Bytes JMP 0007011C .text C:\WINDOWS\system32\svchost.exe[380] kernel32.dll!VirtualAlloc 77E7AC72 5 Bytes JMP 00070004 .text C:\WINDOWS\system32\svchost.exe[380] kernel32.dll!CreateRemoteThread 77E7BC9F 5 Bytes JMP 000704F0 .text C:\WINDOWS\system32\svchost.exe[380] kernel32.dll!CreateThread 77E7BE53 5 Bytes JMP 0007057C .text C:\WINDOWS\system32\svchost.exe[380] kernel32.dll!VirtualProtectEx 77E7D258 5 Bytes JMP 000701A8 .text C:\WINDOWS\system32\svchost.exe[380] kernel32.dll!CreateProcessInternalW 77E8033A 5 Bytes JMP 000703D8 .text C:\WINDOWS\system32\svchost.exe[380] kernel32.dll!SetThreadContext 77E9391A 5 Bytes JMP 00070608 .text C:\WINDOWS\system32\svchost.exe[380] USER32.dll!SetWindowsHookExA 77D45006 5 Bytes JMP 00070720 .text C:\WINDOWS\system32\svchost.exe[380] USER32.dll!SetWindowsHookExW 77D4506A 5 Bytes JMP 000707AC .text C:\PROGRA~1\A4Tech\Mouse\Amoumain.exe[436] kernel32.dll!VirtualProtect 77E6169E 5 Bytes JMP 00130090 .text C:\PROGRA~1\A4Tech\Mouse\Amoumain.exe[436] kernel32.dll!WriteProcessMemory 77E61A94 5 Bytes JMP 00130694 .text C:\PROGRA~1\A4Tech\Mouse\Amoumain.exe[436] kernel32.dll!CreateProcessW 77E61B8E 5 Bytes JMP 001302C0 .text C:\PROGRA~1\A4Tech\Mouse\Amoumain.exe[436] kernel32.dll!CreateProcessA 77E61BBC 5 Bytes JMP 00130234 .text C:\PROGRA~1\A4Tech\Mouse\Amoumain.exe[436] kernel32.dll!WinExec 77E6FD35 5 Bytes JMP 00130464 .text C:\PROGRA~1\A4Tech\Mouse\Amoumain.exe[436] kernel32.dll!CreateProcessInternalA 77E73306 5 Bytes JMP 0013034C .text C:\PROGRA~1\A4Tech\Mouse\Amoumain.exe[436] kernel32.dll!VirtualAllocEx 77E7AC24 5 Bytes JMP 0013011C .text C:\PROGRA~1\A4Tech\Mouse\Amoumain.exe[436] kernel32.dll!VirtualAlloc 77E7AC72 5 Bytes JMP 00130004 .text C:\PROGRA~1\A4Tech\Mouse\Amoumain.exe[436] kernel32.dll!CreateRemoteThread 77E7BC9F 5 Bytes JMP 001304F0 .text C:\PROGRA~1\A4Tech\Mouse\Amoumain.exe[436] kernel32.dll!CreateThread 77E7BE53 5 Bytes JMP 0013057C .text C:\PROGRA~1\A4Tech\Mouse\Amoumain.exe[436] kernel32.dll!VirtualProtectEx 77E7D258 5 Bytes JMP 001301A8 .text C:\PROGRA~1\A4Tech\Mouse\Amoumain.exe[436] kernel32.dll!CreateProcessInternalW 77E8033A 5 Bytes JMP 001303D8 .text C:\PROGRA~1\A4Tech\Mouse\Amoumain.exe[436] kernel32.dll!SetThreadContext 77E9391A 5 Bytes JMP 00130608 .text C:\PROGRA~1\A4Tech\Mouse\Amoumain.exe[436] USER32.dll!SetWindowsHookExA 77D45006 5 Bytes JMP 00130720 .text C:\PROGRA~1\A4Tech\Mouse\Amoumain.exe[436] USER32.dll!SetWindowsHookExW 77D4506A 5 Bytes JMP 001307AC .text C:\WINDOWS\system32\rundll32.exe[480] kernel32.dll!VirtualProtect 77E6169E 5 Bytes JMP 00070090 .text C:\WINDOWS\system32\rundll32.exe[480] kernel32.dll!WriteProcessMemory 77E61A94 5 Bytes JMP 00070694 .text C:\WINDOWS\system32\rundll32.exe[480] kernel32.dll!CreateProcessW 77E61B8E 5 Bytes JMP 000702C0 .text C:\WINDOWS\system32\rundll32.exe[480] kernel32.dll!CreateProcessA 77E61BBC 5 Bytes JMP 00070234 .text C:\WINDOWS\system32\rundll32.exe[480] kernel32.dll!WinExec 77E6FD35 5 Bytes JMP 00070464 .text C:\WINDOWS\system32\rundll32.exe[480] kernel32.dll!CreateProcessInternalA 77E73306 5 Bytes JMP 0007034C .text C:\WINDOWS\system32\rundll32.exe[480] kernel32.dll!VirtualAllocEx 77E7AC24 5 Bytes JMP 0007011C .text C:\WINDOWS\system32\rundll32.exe[480] kernel32.dll!VirtualAlloc 77E7AC72 5 Bytes JMP 00070004 .text C:\WINDOWS\system32\rundll32.exe[480] kernel32.dll!CreateRemoteThread 77E7BC9F 5 Bytes JMP 000704F0 .text C:\WINDOWS\system32\rundll32.exe[480] kernel32.dll!CreateThread 77E7BE53 5 Bytes JMP 0007057C .text C:\WINDOWS\system32\rundll32.exe[480] kernel32.dll!VirtualProtectEx 77E7D258 5 Bytes JMP 000701A8 .text C:\WINDOWS\system32\rundll32.exe[480] kernel32.dll!CreateProcessInternalW 77E8033A 5 Bytes JMP 000703D8 .text C:\WINDOWS\system32\rundll32.exe[480] kernel32.dll!SetThreadContext 77E9391A 5 Bytes JMP 00070608 .text C:\WINDOWS\system32\rundll32.exe[480] USER32.dll!SetWindowsHookExA 77D45006 5 Bytes JMP 00070720 .text C:\WINDOWS\system32\rundll32.exe[480] USER32.dll!SetWindowsHookExW 77D4506A 5 Bytes JMP 000707AC .text C:\Program Files\Winamp\winampa.exe[488] kernel32.dll!VirtualProtect 77E6169E 5 Bytes JMP 00070090 .text C:\Program Files\Winamp\winampa.exe[488] kernel32.dll!WriteProcessMemory 77E61A94 5 Bytes JMP 00070694 .text C:\Program Files\Winamp\winampa.exe[488] kernel32.dll!CreateProcessW 77E61B8E 5 Bytes JMP 000702C0 .text C:\Program Files\Winamp\winampa.exe[488] kernel32.dll!CreateProcessA 77E61BBC 5 Bytes JMP 00070234 .text C:\Program Files\Winamp\winampa.exe[488] kernel32.dll!WinExec 77E6FD35 5 Bytes JMP 00070464 .text C:\Program Files\Winamp\winampa.exe[488] kernel32.dll!CreateProcessInternalA 77E73306 5 Bytes JMP 0007034C .text C:\Program Files\Winamp\winampa.exe[488] kernel32.dll!VirtualAllocEx 77E7AC24 5 Bytes JMP 0007011C .text C:\Program Files\Winamp\winampa.exe[488] kernel32.dll!VirtualAlloc 77E7AC72 5 Bytes JMP 00070004 .text C:\Program Files\Winamp\winampa.exe[488] kernel32.dll!CreateRemoteThread 77E7BC9F 5 Bytes JMP 000704F0 .text C:\Program Files\Winamp\winampa.exe[488] kernel32.dll!CreateThread 77E7BE53 5 Bytes JMP 0007057C .text C:\Program Files\Winamp\winampa.exe[488] kernel32.dll!VirtualProtectEx 77E7D258 5 Bytes JMP 000701A8 .text C:\Program Files\Winamp\winampa.exe[488] kernel32.dll!CreateProcessInternalW 77E8033A 5 Bytes JMP 000703D8 .text C:\Program Files\Winamp\winampa.exe[488] kernel32.dll!SetThreadContext 77E9391A 5 Bytes JMP 00070608 .text C:\Program Files\Winamp\winampa.exe[488] USER32.dll!SetWindowsHookExA 77D45006 5 Bytes JMP 00070720 .text C:\Program Files\Winamp\winampa.exe[488] USER32.dll!SetWindowsHookExW 77D4506A 5 Bytes JMP 000707AC .text C:\WINDOWS\system32\wdfmgr.exe[496] kernel32.dll!VirtualProtect 77E6169E 5 Bytes JMP 00070090 .text C:\WINDOWS\system32\wdfmgr.exe[496] kernel32.dll!WriteProcessMemory 77E61A94 5 Bytes JMP 00070694 .text C:\WINDOWS\system32\wdfmgr.exe[496] kernel32.dll!CreateProcessW 77E61B8E 5 Bytes JMP 000702C0 .text C:\WINDOWS\system32\wdfmgr.exe[496] kernel32.dll!CreateProcessA 77E61BBC 5 Bytes JMP 00070234 .text C:\WINDOWS\system32\wdfmgr.exe[496] kernel32.dll!WinExec 77E6FD35 5 Bytes JMP 00070464 .text C:\WINDOWS\system32\wdfmgr.exe[496] kernel32.dll!CreateProcessInternalA 77E73306 5 Bytes JMP 0007034C .text C:\WINDOWS\system32\wdfmgr.exe[496] kernel32.dll!VirtualAllocEx 77E7AC24 5 Bytes JMP 0007011C .text C:\WINDOWS\system32\wdfmgr.exe[496] kernel32.dll!VirtualAlloc 77E7AC72 5 Bytes JMP 00070004 .text C:\WINDOWS\system32\wdfmgr.exe[496] kernel32.dll!CreateRemoteThread 77E7BC9F 5 Bytes JMP 000704F0 .text C:\WINDOWS\system32\wdfmgr.exe[496] kernel32.dll!CreateThread 77E7BE53 5 Bytes JMP 0007057C .text C:\WINDOWS\system32\wdfmgr.exe[496] kernel32.dll!VirtualProtectEx 77E7D258 5 Bytes JMP 000701A8 .text C:\WINDOWS\system32\wdfmgr.exe[496] kernel32.dll!CreateProcessInternalW 77E8033A 5 Bytes JMP 000703D8 .text C:\WINDOWS\system32\wdfmgr.exe[496] kernel32.dll!SetThreadContext 77E9391A 5 Bytes JMP 00070608 .text C:\WINDOWS\system32\wdfmgr.exe[496] USER32.dll!SetWindowsHookExA 77D45006 5 Bytes JMP 00070720 .text C:\WINDOWS\system32\wdfmgr.exe[496] USER32.dll!SetWindowsHookExW 77D4506A 5 Bytes JMP 000707AC .text C:\Program Files\QuickTime\qttask.exe[612] kernel32.dll!VirtualProtect 77E6169E 5 Bytes JMP 00130090 .text C:\Program Files\QuickTime\qttask.exe[612] kernel32.dll!WriteProcessMemory 77E61A94 5 Bytes JMP 00130694 .text C:\Program Files\QuickTime\qttask.exe[612] kernel32.dll!CreateProcessW 77E61B8E 5 Bytes JMP 001302C0 .text C:\Program Files\QuickTime\qttask.exe[612] kernel32.dll!CreateProcessA 77E61BBC 5 Bytes JMP 00130234 .text C:\Program Files\QuickTime\qttask.exe[612] kernel32.dll!WinExec 77E6FD35 5 Bytes JMP 00130464 .text C:\Program Files\QuickTime\qttask.exe[612] kernel32.dll!CreateProcessInternalA 77E73306 5 Bytes JMP 0013034C .text C:\Program Files\QuickTime\qttask.exe[612] kernel32.dll!VirtualAllocEx 77E7AC24 5 Bytes JMP 0013011C .text C:\Program Files\QuickTime\qttask.exe[612] kernel32.dll!VirtualAlloc 77E7AC72 5 Bytes JMP 00130004 .text C:\Program Files\QuickTime\qttask.exe[612] kernel32.dll!CreateRemoteThread 77E7BC9F 5 Bytes JMP 001304F0 .text C:\Program Files\QuickTime\qttask.exe[612] kernel32.dll!CreateThread 77E7BE53 5 Bytes JMP 0013057C .text C:\Program Files\QuickTime\qttask.exe[612] kernel32.dll!VirtualProtectEx 77E7D258 5 Bytes JMP 001301A8 .text C:\Program Files\QuickTime\qttask.exe[612] kernel32.dll!CreateProcessInternalW 77E8033A 5 Bytes JMP 001303D8 .text C:\Program Files\QuickTime\qttask.exe[612] kernel32.dll!SetThreadContext 77E9391A 5 Bytes JMP 00130608 .text C:\Program Files\QuickTime\qttask.exe[612] USER32.dll!SetWindowsHookExA 77D45006 5 Bytes JMP 00130720 .text C:\Program Files\QuickTime\qttask.exe[612] USER32.dll!SetWindowsHookExW 77D4506A 5 Bytes JMP 001307AC .text C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe[640] kernel32.dll!VirtualProtect 77E6169E 5 Bytes JMP 00130090 .text C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe[640] kernel32.dll!WriteProcessMemory 77E61A94 5 Bytes JMP 00130694 .text C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe[640] kernel32.dll!CreateProcessW 77E61B8E 5 Bytes JMP 001302C0 .text C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe[640] kernel32.dll!CreateProcessA 77E61BBC 5 Bytes JMP 00130234 .text C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe[640] kernel32.dll!WinExec 77E6FD35 5 Bytes JMP 00130464 .text C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe[640] kernel32.dll!CreateProcessInternalA 77E73306 5 Bytes JMP 0013034C .text C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe[640] kernel32.dll!VirtualAllocEx 77E7AC24 5 Bytes JMP 0013011C .text C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe[640] kernel32.dll!VirtualAlloc 77E7AC72 5 Bytes JMP 00130004 .text C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe[640] kernel32.dll!CreateRemoteThread 77E7BC9F 5 Bytes JMP 001304F0 .text C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe[640] kernel32.dll!CreateThread 77E7BE53 5 Bytes JMP 0013057C .text C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe[640] kernel32.dll!VirtualProtectEx 77E7D258 5 Bytes JMP 001301A8 .text C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe[640] kernel32.dll!CreateProcessInternalW 77E8033A 5 Bytes JMP 001303D8 .text C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe[640] kernel32.dll!SetThreadContext 77E9391A 5 Bytes JMP 00130608 .text C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe[640] USER32.dll!SetWindowsHookExA 77D45006 5 Bytes JMP 00130720 .text C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe[640] USER32.dll!SetWindowsHookExW 77D4506A 5 Bytes JMP 001307AC .text C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe[640] WS2_32.dll!socket 71A53C22 5 Bytes JMP 001308C4 .text C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe[640] WS2_32.dll!connect 71A53E5D 5 Bytes JMP 00130950 .text C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe[640] WS2_32.dll!bind 71A53ECE 5 Bytes JMP 00130838 .text C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe[648] kernel32.dll!VirtualProtect 77E6169E 5 Bytes JMP 00130090 .text C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe[648] kernel32.dll!WriteProcessMemory 77E61A94 5 Bytes JMP 00130694 .text C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe[648] kernel32.dll!CreateProcessW 77E61B8E 5 Bytes JMP 001302C0 .text C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe[648] kernel32.dll!CreateProcessA 77E61BBC 5 Bytes JMP 00130234 .text C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe[648] kernel32.dll!WinExec 77E6FD35 5 Bytes JMP 00130464 .text C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe[648] kernel32.dll!CreateProcessInternalA 77E73306 5 Bytes JMP 0013034C .text C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe[648] kernel32.dll!VirtualAllocEx 77E7AC24 5 Bytes JMP 0013011C .text C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe[648] kernel32.dll!VirtualAlloc 77E7AC72 5 Bytes JMP 00130004 .text C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe[648] kernel32.dll!CreateRemoteThread 77E7BC9F 5 Bytes JMP 001304F0 .text C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe[648] kernel32.dll!CreateThread 77E7BE53 5 Bytes JMP 0013057C .text C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe[648] kernel32.dll!VirtualProtectEx 77E7D258 5 Bytes JMP 001301A8 .text C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe[648] kernel32.dll!CreateProcessInternalW 77E8033A 5 Bytes JMP 001303D8 .text C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe[648] kernel32.dll!SetThreadContext 77E9391A 5 Bytes JMP 00130608 .text C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe[648] WININET.dll!InternetConnectA 761D5DE6 5 Bytes JMP 00130F54 .text C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe[648] WININET.dll!InternetConnectW 761DAA8A 5 Bytes JMP 00130FE0 .text C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe[648] WININET.dll!InternetOpenA 761E017D 5 Bytes JMP 00130D24 .text C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe[648] WININET.dll!InternetOpenW 761E08D4 5 Bytes JMP 00130DB0 .text C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe[648] WININET.dll!InternetOpenUrlA 761E1DEF 5 Bytes JMP 00130E3C .text C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe[648] WININET.dll!InternetOpenUrlW 76210D67 5 Bytes JMP 00130EC8 .text C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe[648] USER32.dll!SetWindowsHookExA 77D45006 5 Bytes JMP 00130720 .text C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe[648] USER32.dll!SetWindowsHookExW 77D4506A 5 Bytes JMP 001307AC .text C:\WINDOWS\system32\ctfmon.exe[732] kernel32.dll!VirtualProtect 77E6169E 5 Bytes JMP 00070090 .text C:\WINDOWS\system32\ctfmon.exe[732] kernel32.dll!WriteProcessMemory 77E61A94 5 Bytes JMP 00070694 .text C:\WINDOWS\system32\ctfmon.exe[732] kernel32.dll!CreateProcessW 77E61B8E 5 Bytes JMP 000702C0 .text C:\WINDOWS\system32\ctfmon.exe[732] kernel32.dll!CreateProcessA 77E61BBC 5 Bytes JMP 00070234 .text C:\WINDOWS\system32\ctfmon.exe[732] kernel32.dll!WinExec 77E6FD35 5 Bytes JMP 00070464 .text C:\WINDOWS\system32\ctfmon.exe[732] kernel32.dll!CreateProcessInternalA 77E73306 5 Bytes JMP 0007034C .text C:\WINDOWS\system32\ctfmon.exe[732] kernel32.dll!VirtualAllocEx 77E7AC24 5 Bytes JMP 0007011C .text C:\WINDOWS\system32\ctfmon.exe[732] kernel32.dll!VirtualAlloc 77E7AC72 5 Bytes JMP 00070004 .text C:\WINDOWS\system32\ctfmon.exe[732] kernel32.dll!CreateRemoteThread 77E7BC9F 5 Bytes JMP 000704F0 .text C:\WINDOWS\system32\ctfmon.exe[732] kernel32.dll!CreateThread 77E7BE53 5 Bytes JMP 0007057C .text C:\WINDOWS\system32\ctfmon.exe[732] kernel32.dll!VirtualProtectEx 77E7D258 5 Bytes JMP 000701A8 .text C:\WINDOWS\system32\ctfmon.exe[732] kernel32.dll!CreateProcessInternalW 77E8033A 5 Bytes JMP 000703D8 .text C:\WINDOWS\system32\ctfmon.exe[732] kernel32.dll!SetThreadContext 77E9391A 5 Bytes JMP 00070608 .text C:\WINDOWS\system32\ctfmon.exe[732] USER32.dll!SetWindowsHookExA 77D45006 5 Bytes JMP 00070720 .text C:\WINDOWS\system32\ctfmon.exe[732] USER32.dll!SetWindowsHookExW 77D4506A 5 Bytes JMP 000707AC .text C:\WINDOWS\system32\csrss.exe[752] USER32.dll!SetWindowsHookExA 77D45006 5 Bytes JMP 00160720 .text C:\WINDOWS\system32\csrss.exe[752] USER32.dll!SetWindowsHookExW 77D4506A 5 Bytes JMP 001607AC .text C:\WINDOWS\system32\csrss.exe[752] KERNEL32.dll!VirtualProtect 77E6169E 5 Bytes JMP 00160090 .text C:\WINDOWS\system32\csrss.exe[752] KERNEL32.dll!WriteProcessMemory 77E61A94 5 Bytes JMP 00160694 .text C:\WINDOWS\system32\csrss.exe[752] KERNEL32.dll!CreateProcessW 77E61B8E 5 Bytes JMP 001602C0 .text C:\WINDOWS\system32\csrss.exe[752] KERNEL32.dll!CreateProcessA 77E61BBC 5 Bytes JMP 00160234 .text C:\WINDOWS\system32\csrss.exe[752] KERNEL32.dll!WinExec 77E6FD35 5 Bytes JMP 00160464 .text C:\WINDOWS\system32\csrss.exe[752] KERNEL32.dll!CreateProcessInternalA 77E73306 5 Bytes JMP 0016034C .text C:\WINDOWS\system32\csrss.exe[752] KERNEL32.dll!VirtualAllocEx 77E7AC24 5 Bytes JMP 0016011C .text C:\WINDOWS\system32\csrss.exe[752] KERNEL32.dll!VirtualAlloc 77E7AC72 5 Bytes JMP 00160004 .text C:\WINDOWS\system32\csrss.exe[752] KERNEL32.dll!CreateRemoteThread 77E7BC9F 5 Bytes JMP 001604F0 .text C:\WINDOWS\system32\csrss.exe[752] KERNEL32.dll!CreateThread 77E7BE53 5 Bytes JMP 0016057C .text C:\WINDOWS\system32\csrss.exe[752] KERNEL32.dll!VirtualProtectEx 77E7D258 5 Bytes JMP 001601A8 .text C:\WINDOWS\system32\csrss.exe[752] KERNEL32.dll!CreateProcessInternalW 77E8033A 5 Bytes JMP 001603D8 .text C:\WINDOWS\system32\csrss.exe[752] KERNEL32.dll!SetThreadContext 77E9391A 5 Bytes JMP 00160608 .text C:\WINDOWS\system32\winlogon.exe[776] kernel32.dll!VirtualProtect 77E6169E 5 Bytes JMP 00070090 .text C:\WINDOWS\system32\winlogon.exe[776] kernel32.dll!WriteProcessMemory 77E61A94 5 Bytes JMP 00070694 .text C:\WINDOWS\system32\winlogon.exe[776] kernel32.dll!CreateProcessW 77E61B8E 5 Bytes JMP 000702C0 .text C:\WINDOWS\system32\winlogon.exe[776] kernel32.dll!CreateProcessA 77E61BBC 5 Bytes JMP 00070234 .text C:\WINDOWS\system32\winlogon.exe[776] kernel32.dll!WinExec 77E6FD35 5 Bytes JMP 00070464 .text C:\WINDOWS\system32\winlogon.exe[776] kernel32.dll!CreateProcessInternalA 77E73306 5 Bytes JMP 0007034C .text C:\WINDOWS\system32\winlogon.exe[776] kernel32.dll!VirtualAllocEx 77E7AC24 5 Bytes JMP 0007011C .text C:\WINDOWS\system32\winlogon.exe[776] kernel32.dll!VirtualAlloc 77E7AC72 5 Bytes JMP 00070004 .text C:\WINDOWS\system32\winlogon.exe[776] kernel32.dll!CreateRemoteThread 77E7BC9F 5 Bytes JMP 000704F0 .text C:\WINDOWS\system32\winlogon.exe[776] kernel32.dll!CreateThread 77E7BE53 5 Bytes JMP 0007057C .text C:\WINDOWS\system32\winlogon.exe[776] kernel32.dll!VirtualProtectEx 77E7D258 5 Bytes JMP 000701A8 .text C:\WINDOWS\system32\winlogon.exe[776] kernel32.dll!CreateProcessInternalW 77E8033A 5 Bytes JMP 000703D8 .text C:\WINDOWS\system32\winlogon.exe[776] kernel32.dll!SetThreadContext 77E9391A 5 Bytes JMP 00070608 .text C:\WINDOWS\system32\winlogon.exe[776] USER32.dll!SetWindowsHookExA 77D45006 5 Bytes JMP 00070720 .text C:\WINDOWS\system32\winlogon.exe[776] USER32.dll!SetWindowsHookExW 77D4506A 5 Bytes JMP 000707AC .text C:\WINDOWS\system32\winlogon.exe[776] WS2_32.dll!socket 71A53C22 5 Bytes JMP 000708C4 .text C:\WINDOWS\system32\winlogon.exe[776] WS2_32.dll!connect 71A53E5D 5 Bytes JMP 00070950 .text C:\WINDOWS\system32\winlogon.exe[776] WS2_32.dll!bind 71A53ECE 5 Bytes JMP 00070838 .text C:\WINDOWS\system32\winlogon.exe[776] WININET.dll!InternetConnectA 761D5DE6 5 Bytes JMP 00070F54 .text C:\WINDOWS\system32\winlogon.exe[776] WININET.dll!InternetConnectW 761DAA8A 5 Bytes JMP 00070FE0 .text C:\WINDOWS\system32\winlogon.exe[776] WININET.dll!InternetOpenA 761E017D 5 Bytes JMP 00070D24 .text C:\WINDOWS\system32\winlogon.exe[776] WININET.dll!InternetOpenW 761E08D4 5 Bytes JMP 00070DB0 .text C:\WINDOWS\system32\winlogon.exe[776] WININET.dll!InternetOpenUrlA 761E1DEF 5 Bytes JMP 00070E3C .text C:\WINDOWS\system32\winlogon.exe[776] WININET.dll!InternetOpenUrlW 76210D67 5 Bytes JMP 00070EC8 .text C:\WINDOWS\system32\services.exe[824] kernel32.dll!VirtualProtect 77E6169E 5 Bytes JMP 00070090 .text C:\WINDOWS\system32\services.exe[824] kernel32.dll!WriteProcessMemory 77E61A94 5 Bytes JMP 00070694 .text C:\WINDOWS\system32\services.exe[824] kernel32.dll!CreateProcessW 77E61B8E 5 Bytes JMP 000702C0 .text C:\WINDOWS\system32\services.exe[824] kernel32.dll!CreateProcessA 77E61BBC 5 Bytes JMP 00070234 .text C:\WINDOWS\system32\services.exe[824] kernel32.dll!WinExec 77E6FD35 5 Bytes JMP 00070464 .text C:\WINDOWS\system32\services.exe[824] kernel32.dll!CreateProcessInternalA 77E73306 5 Bytes JMP 0007034C .text C:\WINDOWS\system32\services.exe[824] kernel32.dll!VirtualAllocEx 77E7AC24 5 Bytes JMP 0007011C .text C:\WINDOWS\system32\services.exe[824] kernel32.dll!VirtualAlloc 77E7AC72 5 Bytes JMP 00070004 .text C:\WINDOWS\system32\services.exe[824] kernel32.dll!CreateRemoteThread 77E7BC9F 5 Bytes JMP 000704F0 .text C:\WINDOWS\system32\services.exe[824] kernel32.dll!CreateThread 77E7BE53 5 Bytes JMP 0007057C .text C:\WINDOWS\system32\services.exe[824] kernel32.dll!VirtualProtectEx 77E7D258 5 Bytes JMP 000701A8 .text C:\WINDOWS\system32\services.exe[824] kernel32.dll!CreateProcessInternalW 77E8033A 5 Bytes JMP 000703D8 .text C:\WINDOWS\system32\services.exe[824] kernel32.dll!SetThreadContext 77E9391A 5 Bytes JMP 00070608 .text C:\WINDOWS\system32\services.exe[824] USER32.dll!SetWindowsHookExA 77D45006 5 Bytes JMP 00070720 .text C:\WINDOWS\system32\services.exe[824] USER32.dll!SetWindowsHookExW 77D4506A 5 Bytes JMP 000707AC .text C:\WINDOWS\system32\services.exe[824] WS2_32.dll!socket 71A53C22 5 Bytes JMP 000708C4 .text C:\WINDOWS\system32\services.exe[824] WS2_32.dll!connect 71A53E5D 5 Bytes JMP 00070950 .text C:\WINDOWS\system32\services.exe[824] WS2_32.dll!bind 71A53ECE 5 Bytes JMP 00070838 .text C:\WINDOWS\system32\lsass.exe[836] kernel32.dll!VirtualProtect 77E6169E 5 Bytes JMP 00070090 .text C:\WINDOWS\system32\lsass.exe[836] kernel32.dll!WriteProcessMemory 77E61A94 5 Bytes JMP 00070694 .text C:\WINDOWS\system32\lsass.exe[836] kernel32.dll!CreateProcessW 77E61B8E 5 Bytes JMP 000702C0 .text C:\WINDOWS\system32\lsass.exe[836] kernel32.dll!CreateProcessA 77E61BBC 5 Bytes JMP 00070234 .text C:\WINDOWS\system32\lsass.exe[836] kernel32.dll!WinExec 77E6FD35 5 Bytes JMP 00070464 .text C:\WINDOWS\system32\lsass.exe[836] kernel32.dll!CreateProcessInternalA 77E73306 5 Bytes JMP 0007034C .text C:\WINDOWS\system32\lsass.exe[836] kernel32.dll!VirtualAllocEx 77E7AC24 5 Bytes JMP 0007011C .text C:\WINDOWS\system32\lsass.exe[836] kernel32.dll!VirtualAlloc 77E7AC72 5 Bytes JMP 00070004 .text C:\WINDOWS\system32\lsass.exe[836] kernel32.dll!CreateRemoteThread 77E7BC9F 5 Bytes JMP 000704F0 .text C:\WINDOWS\system32\lsass.exe[836] kernel32.dll!CreateThread 77E7BE53 5 Bytes JMP 0007057C .text C:\WINDOWS\system32\lsass.exe[836] kernel32.dll!VirtualProtectEx 77E7D258 5 Bytes JMP 000701A8 .text C:\WINDOWS\system32\lsass.exe[836] kernel32.dll!CreateProcessInternalW 77E8033A 5 Bytes JMP 000703D8 .text C:\WINDOWS\system32\lsass.exe[836] kernel32.dll!SetThreadContext 77E9391A 5 Bytes JMP 00070608 .text C:\WINDOWS\system32\lsass.exe[836] USER32.dll!SetWindowsHookExA 77D45006 5 Bytes JMP 00070720 .text C:\WINDOWS\system32\lsass.exe[836] USER32.dll!SetWindowsHookExW 77D4506A 5 Bytes JMP 000707AC .text C:\WINDOWS\system32\lsass.exe[836] WS2_32.dll!socket 71A53C22 5 Bytes JMP 000708C4 .text C:\WINDOWS\system32\lsass.exe[836] WS2_32.dll!connect 71A53E5D 5 Bytes JMP 00070950 .text C:\WINDOWS\system32\lsass.exe[836] WS2_32.dll!bind 71A53ECE 5 Bytes JMP 00070838 .text C:\Program Files\Gadu-Gadu\gg.exe[988] kernel32.dll!VirtualProtect 77E6169E 5 Bytes JMP 00130090 .text C:\Program Files\Gadu-Gadu\gg.exe[988] kernel32.dll!WriteProcessMemory 77E61A94 5 Bytes JMP 00130694 .text C:\Program Files\Gadu-Gadu\gg.exe[988] kernel32.dll!CreateProcessW 77E61B8E 5 Bytes JMP 001302C0 .text C:\Program Files\Gadu-Gadu\gg.exe[988] kernel32.dll!CreateProcessA 77E61BBC 5 Bytes JMP 00130234 .text C:\Program Files\Gadu-Gadu\gg.exe[988] kernel32.dll!WinExec 77E6FD35 5 Bytes JMP 00130464 .text C:\Program Files\Gadu-Gadu\gg.exe[988] kernel32.dll!CreateProcessInternalA 77E73306 5 Bytes JMP 0013034C .text C:\Program Files\Gadu-Gadu\gg.exe[988] kernel32.dll!VirtualAllocEx 77E7AC24 5 Bytes JMP 0013011C .text C:\Program Files\Gadu-Gadu\gg.exe[988] kernel32.dll!VirtualAlloc 77E7AC72 5 Bytes JMP 00130004 .text C:\Program Files\Gadu-Gadu\gg.exe[988] kernel32.dll!CreateRemoteThread 77E7BC9F 5 Bytes JMP 001304F0 .text C:\Program Files\Gadu-Gadu\gg.exe[988] kernel32.dll!CreateThread 77E7BE53 5 Bytes JMP 0013057C .text C:\Program Files\Gadu-Gadu\gg.exe[988] kernel32.dll!VirtualProtectEx 77E7D258 5 Bytes JMP 001301A8 .text C:\Program Files\Gadu-Gadu\gg.exe[988] kernel32.dll!CreateProcessInternalW 77E8033A 5 Bytes JMP 001303D8 .text C:\Program Files\Gadu-Gadu\gg.exe[988] kernel32.dll!SetThreadContext 77E9391A 5 Bytes JMP 00130608 .text C:\Program Files\Gadu-Gadu\gg.exe[988] USER32.dll!SetWindowsHookExA 77D45006 5 Bytes JMP 00130720 .text C:\Program Files\Gadu-Gadu\gg.exe[988] USER32.dll!SetWindowsHookExW 77D4506A 5 Bytes JMP 001307AC .text C:\Program Files\Gadu-Gadu\gg.exe[988] WS2_32.dll!socket 71A53C22 5 Bytes JMP 001308C4 .text C:\Program Files\Gadu-Gadu\gg.exe[988] WS2_32.dll!connect 71A53E5D 5 Bytes JMP 00130950 .text C:\Program Files\Gadu-Gadu\gg.exe[988] WS2_32.dll!bind 71A53ECE 5 Bytes JMP 00130838 .text C:\Program Files\Gadu-Gadu\gg.exe[988] WININET.dll!InternetConnectA 761D5DE6 5 Bytes JMP 00130F54 .text C:\Program Files\Gadu-Gadu\gg.exe[988] WININET.dll!InternetConnectW 761DAA8A 5 Bytes JMP 00130FE0 .text C:\Program Files\Gadu-Gadu\gg.exe[988] WININET.dll!InternetOpenA 761E017D 5 Bytes JMP 00130D24 .text C:\Program Files\Gadu-Gadu\gg.exe[988] WININET.dll!InternetOpenW 761E08D4 5 Bytes JMP 00130DB0 .text C:\Program Files\Gadu-Gadu\gg.exe[988] WININET.dll!InternetOpenUrlA 761E1DEF 5 Bytes JMP 00130E3C .text C:\Program Files\Gadu-Gadu\gg.exe[988] WININET.dll!InternetOpenUrlW 76210D67 5 Bytes JMP 00130EC8 .text C:\WINDOWS\system32\svchost.exe[996] kernel32.dll!VirtualProtect 77E6169E 5 Bytes JMP 00070090 .text C:\WINDOWS\system32\svchost.exe[996] kernel32.dll!WriteProcessMemory 77E61A94 5 Bytes JMP 00070694 .text C:\WINDOWS\system32\svchost.exe[996] kernel32.dll!CreateProcessW 77E61B8E 5 Bytes JMP 000702C0 .text C:\WINDOWS\system32\svchost.exe[996] kernel32.dll!CreateProcessA 77E61BBC 5 Bytes JMP 00070234 .text C:\WINDOWS\system32\svchost.exe[996] kernel32.dll!WinExec 77E6FD35 5 Bytes JMP 00070464 .text C:\WINDOWS\system32\svchost.exe[996] kernel32.dll!CreateProcessInternalA 77E73306 5 Bytes JMP 0007034C .text C:\WINDOWS\system32\svchost.exe[996] kernel32.dll!VirtualAllocEx 77E7AC24 5 Bytes JMP 0007011C .text C:\WINDOWS\system32\svchost.exe[996] kernel32.dll!VirtualAlloc 77E7AC72 5 Bytes JMP 00070004 .text C:\WINDOWS\system32\svchost.exe[996] kernel32.dll!CreateRemoteThread 77E7BC9F 5 Bytes JMP 000704F0 .text C:\WINDOWS\system32\svchost.exe[996] kernel32.dll!CreateThread 77E7BE53 5 Bytes JMP 0007057C .text C:\WINDOWS\system32\svchost.exe[996] kernel32.dll!VirtualProtectEx 77E7D258 5 Bytes JMP 000701A8 .text C:\WINDOWS\system32\svchost.exe[996] kernel32.dll!CreateProcessInternalW 77E8033A 5 Bytes JMP 000703D8 .text C:\WINDOWS\system32\svchost.exe[996] kernel32.dll!SetThreadContext 77E9391A 5 Bytes JMP 00070608 .text C:\WINDOWS\system32\svchost.exe[996] WS2_32.dll!socket 71A53C22 5 Bytes JMP 000708C4 .text C:\WINDOWS\system32\svchost.exe[996] WS2_32.dll!connect 71A53E5D 5 Bytes JMP 00070950 .text C:\WINDOWS\system32\svchost.exe[996] WS2_32.dll!bind 71A53ECE 5 Bytes JMP 00070838 .text C:\WINDOWS\system32\svchost.exe[996] USER32.dll!SetWindowsHookExA 77D45006 5 Bytes JMP 00070720 .text C:\WINDOWS\system32\svchost.exe[996] USER32.dll!SetWindowsHookExW 77D4506A 5 Bytes JMP 000707AC .text C:\WINDOWS\system32\svchost.exe[1012] kernel32.dll!VirtualProtect 77E6169E 5 Bytes JMP 00070090 .text C:\WINDOWS\system32\svchost.exe[1012] kernel32.dll!WriteProcessMemory 77E61A94 5 Bytes JMP 00070694 .text C:\WINDOWS\system32\svchost.exe[1012] kernel32.dll!CreateProcessW 77E61B8E 5 Bytes JMP 000702C0 .text C:\WINDOWS\system32\svchost.exe[1012] kernel32.dll!CreateProcessA 77E61BBC 5 Bytes JMP 00070234 .text C:\WINDOWS\system32\svchost.exe[1012] kernel32.dll!WinExec 77E6FD35 5 Bytes JMP 00070464 .text C:\WINDOWS\system32\svchost.exe[1012] kernel32.dll!CreateProcessInternalA 77E73306 5 Bytes JMP 0007034C .text C:\WINDOWS\system32\svchost.exe[1012] kernel32.dll!VirtualAllocEx 77E7AC24 5 Bytes JMP 0007011C .text C:\WINDOWS\system32\svchost.exe[1012] kernel32.dll!VirtualAlloc 77E7AC72 5 Bytes JMP 00070004 .text C:\WINDOWS\system32\svchost.exe[1012] kernel32.dll!CreateRemoteThread 77E7BC9F 5 Bytes JMP 000704F0 .text C:\WINDOWS\system32\svchost.exe[1012] kernel32.dll!CreateThread 77E7BE53 5 Bytes JMP 0007057C .text C:\WINDOWS\system32\svchost.exe[1012] kernel32.dll!VirtualProtectEx 77E7D258 5 Bytes JMP 000701A8 .text C:\WINDOWS\system32\svchost.exe[1012] kernel32.dll!CreateProcessInternalW 77E8033A 5 Bytes JMP 000703D8 .text C:\WINDOWS\system32\svchost.exe[1012] kernel32.dll!SetThreadContext 77E9391A 5 Bytes JMP 00070608 .text C:\WINDOWS\system32\svchost.exe[1012] USER32.dll!SetWindowsHookExA 77D45006 5 Bytes JMP 00070720 .text C:\WINDOWS\system32\svchost.exe[1012] USER32.dll!SetWindowsHookExW 77D4506A 5 Bytes JMP 000707AC .text C:\WINDOWS\system32\svchost.exe[1012] WS2_32.dll!socket 71A53C22 5 Bytes JMP 000708C4 .text C:\WINDOWS\system32\svchost.exe[1012] WS2_32.dll!connect 71A53E5D 5 Bytes JMP 00070950 .text C:\WINDOWS\system32\svchost.exe[1012] WS2_32.dll!bind 71A53ECE 5 Bytes JMP 00070838 .text C:\WINDOWS\system32\svchost.exe[1012] WININET.dll!InternetConnectA 761D5DE6 5 Bytes JMP 00070F54 .text C:\WINDOWS\system32\svchost.exe[1012] WININET.dll!InternetConnectW 761DAA8A 5 Bytes JMP 00070FE0 .text C:\WINDOWS\system32\svchost.exe[1012] WININET.dll!InternetOpenA 761E017D 5 Bytes JMP 00070D24 .text C:\WINDOWS\system32\svchost.exe[1012] WININET.dll!InternetOpenW 761E08D4 5 Bytes JMP 00070DB0 .text C:\WINDOWS\system32\svchost.exe[1012] WININET.dll!InternetOpenUrlA 761E1DEF 5 Bytes JMP 00070E3C .text C:\WINDOWS\system32\svchost.exe[1012] WININET.dll!InternetOpenUrlW 76210D67 5 Bytes JMP 00070EC8 .text C:\Program Files\Messenger\msmsgs.exe[1056] kernel32.dll!VirtualProtect 77E6169E 5 Bytes JMP 00140090 .text C:\Program Files\Messenger\msmsgs.exe[1056] kernel32.dll!WriteProcessMemory 77E61A94 5 Bytes JMP 00140694 .text C:\Program File

[adam9870]

Wklej nowy log z l2mfix, silenta oraz hijacka.

[dawidowski (Davids)]

2. Zakładka Rootkit > zaznacz tylko Usługi oraz Pokaż wszystko > kliknij Szukaj

GMER 1.0.12.12010 - http://www.gmer.net Rootkit scan 2007-01-20 10:19:35 Windows 5.1.2600 Dodatek Service Pack. 1 ---- Services - GMER 1.0.12 ---- Service [sYSTEM] Aavmker4 Service [DISABLED] Abiosdsk Service [DISABLED] abp480n5 Service C:\WINDOWS\System32\DRIVERS\ACPI.sys [bOOT] ACPI Service [DISABLED] ACPIEC Service C:\WINDOWS\System32\Drivers\adildr.sys [AUTO] ADILOADER Service C:\WINDOWS\System32\DRIVERS\adiusbaw.sys [MANUAL] adiusbaw Service [DISABLED] adpu160m Service C:\WINDOWS\system32\drivers\aec.sys [MANUAL] aec Service C:\WINDOWS\System32\drivers\afd.sys [AUTO] AFD Service [DISABLED] Aha154x Service [DISABLED] aic78u2 Service [DISABLED] aic78xx Service C:\WINDOWS\System32\svchost.exe [MANUAL] Alerter Service C:\WINDOWS\System32\alg.exe [MANUAL] ALG Service [DISABLED] AliIde Service C:\WINDOWS\System32\DRIVERS\Amfilter.sys [sYSTEM] Amfilter Service [DISABLED] amsint Service C:\WINDOWS\System32\DRIVERS\Amusbprt.sys [MANUAL] Amusbprt Service C:\WINDOWS\system32\svchost.exe [MANUAL] AppMgmt Service [DISABLED] asc Service [DISABLED] asc3350p Service [DISABLED] asc3550 Service [AUTO] aswMon2 Service [MANUAL] aswRdr Service [sYSTEM] aswTdi Service C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe [AUTO] aswUpdSv Service C:\WINDOWS\System32\DRIVERS\asyncmac.sys [MANUAL] AsyncMac Service C:\WINDOWS\System32\DRIVERS\atapi.sys [bOOT] atapi Service [DISABLED] Atdisk Service C:\WINDOWS\System32\DRIVERS\atmarpc.sys [MANUAL] Atmarpc Service C:\WINDOWS\System32\svchost.exe [AUTO] AudioSrv Service C:\WINDOWS\System32\DRIVERS\audstub.sys [MANUAL] audstub Service C:\Program Files\Alwil Software\Avast4\ashServ.exe [AUTO] avast! Antivirus Service C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe [MANUAL] avast! Mail Scanner Service C:\Program Files\Alwil Software\Avast4\ashWebSv.exe [DISABLED] avast! Web Scanner Service BattC Service [sYSTEM] Beep Service C:\WINDOWS\System32\svchost.exe [MANUAL] BITS Service C:\WINDOWS\System32\svchost.exe [AUTO] Browser Service C:\WINDOWS\System32\drivers\CDAC11BA.EXE [AUTO] C-DillaCdaC11BA Service [DISABLED] cbidf2k Service [DISABLED] cd20xrnt Service C:\WINDOWS\System32\drivers\CDAC15BA.SYS [AUTO] CdaC15BA Service [sYSTEM] Cdaudio Service [DISABLED] Cdfs Service C:\WINDOWS\System32\DRIVERS\cdrom.sys [sYSTEM] Cdrom Service [sYSTEM] Changer Service C:\WINDOWS\system32\cisvc.exe [MANUAL] CiSvc Service C:\WINDOWS\system32\clipsrv.exe [MANUAL] ClipSrv Service [DISABLED] CmdIde Service C:\WINDOWS\System32\dllhost.exe [MANUAL] COMSysApp Service ContentFilter Service ContentIndex Service [DISABLED] Cpqarray Service C:\WINDOWS\system32\svchost.exe [AUTO] CryptSvc Service C:\WINDOWS\System32\DRIVERS\ctljystk.sys [MANUAL] ctljystk Service ctlntsvc Service [DISABLED] dac2w2k Service [DISABLED] dac960nt Service C:\WINDOWS\System32\svchost.exe [AUTO] Dhcp Service C:\WINDOWS\System32\DRIVERS\disk.sys [bOOT] Disk Service C:\WINDOWS\system\dllhost.exe [AUTO] DLLHOST32 Service C:\WINDOWS\System32\dmadmin.exe [MANUAL] dmadmin Service C:\WINDOWS\System32\drivers\dmboot.sys [DISABLED] dmboot Service C:\WINDOWS\System32\drivers\dmio.sys [bOOT] dmio Service C:\WINDOWS\System32\drivers\dmload.sys [bOOT] dmload Service C:\WINDOWS\System32\svchost.exe [AUTO] dmserver Service C:\WINDOWS\system32\drivers\DMusic.sys [MANUAL] DMusic Service C:\WINDOWS\System32\svchost.exe [AUTO] Dnscache Service [DISABLED] dpti2o Service C:\WINDOWS\system32\drivers\drmkaud.sys [MANUAL] drmkaud Service C:\WINDOWS\System32\Drivers\dtscsi.sys [MANUAL] dtscsi Service C:\WINDOWS\system32\drivers\emu10k1m.sys [MANUAL] emu10k Service C:\WINDOWS\system32\drivers\ctlfacem.sys [MANUAL] emu10k1 Service C:\WINDOWS\System32\svchost.exe [AUTO] ERSvc Service C:\WINDOWS\system32\services.exe [AUTO] Eventlog Service C:\WINDOWS\System32\svchost.exe [MANUAL] EventSystem Service [DISABLED] Fastfat Service C:\WINDOWS\System32\svchost.exe [MANUAL] FastUserSwitchingCompatibility Service C:\WINDOWS\System32\DRIVERS\fdc.sys [MANUAL] Fdc Service C:\WINDOWS\System32\DRIVERS\fetnd5.sys [MANUAL] FETNDIS Service [sYSTEM] Fips Service C:\WINDOWS\System32\DRIVERS\flpydisk.sys [MANUAL] Flpydisk Service [sYSTEM] Fs_Rec Service C:\WINDOWS\System32\DRIVERS\ftdisk.sys [bOOT] Ftdisk Service C:\WINDOWS\system32\drivers\fwdrv.sys [sYSTEM] fwdrv Service C:\WINDOWS\System32\DRIVERS\gameenum.sys [MANUAL] gameenum Service C:\WINDOWS\System32\DRIVERS\gmer.sys [MANUAL] gmer Service C:\WINDOWS\System32\DRIVERS\msgpc.sys [MANUAL] Gpc Service C:\WINDOWS\System32\svchost.exe [AUTO] helpsvc Service C:\WINDOWS\System32\svchost.exe [DISABLED] HidServ Service C:\WINDOWS\System32\DRIVERS\hidusb.sys [MANUAL] hidusb Service [DISABLED] hpn Service C:\WINDOWS\System32\DRIVERS\HPZid412.sys [MANUAL] HPZid412 Service C:\WINDOWS\System32\DRIVERS\HPZipr12.sys [MANUAL] HPZipr12 Service C:\WINDOWS\System32\DRIVERS\HPZius12.sys [MANUAL] HPZius12 Service [sYSTEM] i2omgmt Service [DISABLED] i2omp Service C:\WINDOWS\System32\DRIVERS\i8042prt.sys [sYSTEM] i8042prt Service C:\WINDOWS\System32\DRIVERS\imapi.sys [sYSTEM] Imapi Service C:\WINDOWS\System32\imapi.exe [MANUAL] ImapiService Service inetaccs Service [DISABLED] ini910u Service Inport Service [DISABLED] IntelIde Service C:\WINDOWS\System32\DRIVERS\ipfltdrv.sys [MANUAL] IpFilterDriver Service C:\WINDOWS\System32\DRIVERS\ipinip.sys [MANUAL] IpInIp Service C:\WINDOWS\System32\DRIVERS\ipnat.sys [MANUAL] IpNat Service C:\WINDOWS\System32\DRIVERS\ipsec.sys [sYSTEM] IPSec Service C:\WINDOWS\System32\DRIVERS\irenum.sys [MANUAL] IRENUM Service ISAPISearch Service C:\WINDOWS\System32\DRIVERS\isapnp.sys [bOOT] isapnp Service C:\WINDOWS\System32\DRIVERS\kbdclass.sys [sYSTEM] Kbdclass Service C:\WINDOWS\system32\drivers\khips.sys [sYSTEM] khips Service C:\WINDOWS\system32\drivers\kmixer.sys [MANUAL] kmixer Service C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe [AUTO] KPF4 Service [bOOT] KSecDD Service C:\WINDOWS\System32\svchost.exe [AUTO] lanmanserver Service C:\WINDOWS\System32\svchost.exe [AUTO] lanmanworkstation Service [sYSTEM] lbrtfdc Service ldap Service LicenseService Service C:\WINDOWS\System32\svchost.exe [AUTO] LmHosts Service C:\WINDOWS\System32\DRIVERS\ltmdmnt.sys [MANUAL] ltmodem5 Service C:\WINDOWS\System32\svchost.exe [DISABLED] Messenger Service [sYSTEM] mnmdd Service C:\WINDOWS\System32\mnmsrvc.exe [MANUAL] mnmsrvc Service [MANUAL] Modem Service C:\WINDOWS\system32\drivers\MODEMCSA.sys [MANUAL] MODEMCSA Service C:\WINDOWS\System32\DRIVERS\mouclass.sys [sYSTEM] Mouclass Service C:\WINDOWS\System32\DRIVERS\mouhid.sys [MANUAL] mouhid Service [bOOT] MountMgr Service [DISABLED] mraid35x Service C:\WINDOWS\System32\DRIVERS\mrxdav.sys [MANUAL] MRxDAV Service C:\WINDOWS\System32\DRIVERS\mrxsmb.sys [sYSTEM] MRxSmb Service C:\WINDOWS\System32\msdtc.exe [MANUAL] MSDTC Service [sYSTEM] Msfs Service C:\WINDOWS\System32\msiexec.exe [MANUAL] MSIServer Service C:\WINDOWS\system32\drivers\MSKSSRV.sys [MANUAL] MSKSSRV Service C:\WINDOWS\system32\drivers\MSPCLOCK.sys [MANUAL] MSPCLOCK Service C:\WINDOWS\system32\drivers\MSPQM.sys [MANUAL] MSPQM Service [bOOT] Mup Service [bOOT] NDIS Service C:\WINDOWS\System32\DRIVERS\ndistapi.sys [MANUAL] NdisTapi Service C:\WINDOWS\System32\DRIVERS\ndisuio.sys [MANUAL] Ndisuio Service C:\WINDOWS\System32\DRIVERS\ndiswan.sys [MANUAL] NdisWan Service [MANUAL] NDProxy Service C:\WINDOWS\System32\DRIVERS\netbios.sys [sYSTEM] NetBIOS Service C:\WINDOWS\System32\DRIVERS\netbt.sys [AUTO] NetBT Service C:\WINDOWS\system32\netdde.exe [MANUAL] NetDDE Service C:\WINDOWS\system32\netdde.exe [MANUAL] NetDDEdsdm Service C:\WINDOWS\System32\lsass.exe [MANUAL] Netlogon Service C:\WINDOWS\System32\svchost.exe [MANUAL] Netman Service C:\WINDOWS\System32\svchost.exe [MANUAL] Nla Service [sYSTEM] Npfs Service [DISABLED] Ntfs Service C:\WINDOWS\System32\lsass.exe [MANUAL] NtLmSsp Service C:\WINDOWS\system32\svchost.exe [MANUAL] NtmsSvc Service [sYSTEM] Null Service C:\WINDOWS\System32\DRIVERS\nv4_mini.sys [MANUAL] nv Service C:\WINDOWS\System32\nvsvc32.exe [AUTO] NVSvc Service C:\WINDOWS\System32\DRIVERS\nwlnkflt.sys [MANUAL] NwlnkFlt Service C:\WINDOWS\System32\DRIVERS\nwlnkfwd.sys [MANUAL] NwlnkFwd Service C:\WINDOWS\System32\DRIVERS\parport.sys [MANUAL] Parport Service [bOOT] PartMgr Service [AUTO] ParVdm Service C:\WINDOWS\System32\DRIVERS\pci.sys [bOOT] PCI Service [sYSTEM] PCIDump Service C:\WINDOWS\System32\DRIVERS\pciide.sys [bOOT] PCIIde Service [DISABLED] Pcmcia Service [MANUAL] PDCOMP Service [MANUAL] PDFRAME Service [MANUAL] PDRELI Service [MANUAL] PDRFRAME Service [DISABLED] perc2 Service [DISABLED] perc2hib Service PerfDisk Service PerfNet Service PerfOS Service PerfProc Service C:\WINDOWS\system32\services.exe [AUTO] PlugPlay Service C:\WINDOWS\System32\lsass.exe [AUTO] PolicyAgent Service C:\WINDOWS\System32\DRIVERS\raspptp.sys [MANUAL] PptpMiniport Service C:\WINDOWS\System32\DRIVERS\processr.sys [sYSTEM] Processor Service C:\WINDOWS\system32\lsass.exe [AUTO] ProtectedStorage Service C:\WINDOWS\System32\DRIVERS\psched.sys [MANUAL] PSched Service C:\WINDOWS\System32\DRIVERS\ptilink.sys [MANUAL] Ptilink Service C:\WINDOWS\System32\Drivers\PxHelp20.sys [bOOT] PxHelp20 Service [DISABLED] ql1080 Service [DISABLED] Ql10wnt Service [DISABLED] ql12160 Service [DISABLED] ql1240 Service [DISABLED] ql1280 Service C:\WINDOWS\System32\DRIVERS\rasacd.sys [sYSTEM] RasAcd Service C:\WINDOWS\System32\svchost.exe [MANUAL] RasAuto Service C:\WINDOWS\System32\DRIVERS\rasl2tp.sys [MANUAL] Rasl2tp Service C:\WINDOWS\System32\svchost.exe [MANUAL] RasMan Service C:\WINDOWS\System32\DRIVERS\raspppoe.sys [MANUAL] RasPppoe Service C:\WINDOWS\System32\DRIVERS\raspti.sys [MANUAL] Raspti Service C:\WINDOWS\System32\DRIVERS\rdbss.sys [sYSTEM] Rdbss Service C:\WINDOWS\System32\DRIVERS\RDPCDD.sys [sYSTEM] RDPCDD Service RDPDD Service C:\WINDOWS\System32\DRIVERS\rdpdr.sys [MANUAL] rdpdr Service RDPNP Service [MANUAL] RDPWD Service C:\WINDOWS\system32\sessmgr.exe [MANUAL] RDSessMgr Service C:\WINDOWS\System32\DRIVERS\redbook.sys [sYSTEM] redbook Service C:\WINDOWS\System32\svchost.exe [DISABLED] RemoteAccess Service C:\WINDOWS\system32\svchost.exe [DISABLED] RemoteRegistry Service C:\WINDOWS\System32\locator.exe [MANUAL] RpcLocator Service C:\WINDOWS\system32\svchost.exe [AUTO] RpcSs Service C:\WINDOWS\System32\rsvp.exe [MANUAL] RSVP Service C:\WINDOWS\system32\lsass.exe [AUTO] SamSs Service C:\WINDOWS\System32\SCardSvr.exe [MANUAL] SCardDrv Service C:\WINDOWS\System32\SCardSvr.exe [MANUAL] SCardSvr Service C:\WINDOWS\System32\svchost.exe [AUTO] Schedule Service C:\WINDOWS\System32\DRIVERS\secdrv.sys [AUTO] Secdrv Service C:\WINDOWS\System32\svchost.exe [AUTO] seclogon Service C:\WINDOWS\system32\svchost.exe [AUTO] SENS Service C:\WINDOWS\System32\DRIVERS\serenum.sys [MANUAL] serenum Service C:\WINDOWS\System32\DRIVERS\serial.sys [sYSTEM] Serial Service [sYSTEM] Sfloppy Service C:\WINDOWS\system32\drivers\sfmanm.sys [MANUAL] sfman Service C:\WINDOWS\System32\svchost.exe [AUTO] SharedAccess Service C:\WINDOWS\System32\svchost.exe [AUTO] ShellHWDetection Service [DISABLED] Simbad Service [DISABLED] Sparrow Service C:\WINDOWS\system32\drivers\splitter.sys [MANUAL] splitter Service C:\WINDOWS\system32\spoolsv.exe [AUTO] Spooler Service C:\WINDOWS\System32\Drivers\sptd.sys [bOOT] sptd Service C:\WINDOWS\System32\DRIVERS\sr.sys [DISABLED] sr Service C:\WINDOWS\System32\svchost.exe [AUTO] srservice Service C:\WINDOWS\System32\DRIVERS\srv.sys [MANUAL] Srv Service C:\WINDOWS\System32\svchost.exe [DISABLED] SSDPSRV Service C:\WINDOWS\System32\svchost.exe [AUTO] stisvc Service C:\WINDOWS\System32\DRIVERS\swenum.sys [MANUAL] swenum Service C:\WINDOWS\system32\drivers\swmidi.sys [MANUAL] swmidi Service C:\WINDOWS\System32\dllhost.exe [MANUAL] SwPrv Service [DISABLED] symc810 Service [DISABLED] symc8xx Service [DISABLED] sym_hi Service [DISABLED] sym_u3 Service C:\WINDOWS\system32\drivers\sysaudio.sys [MANUAL] sysaudio Service C:\WINDOWS\system32\smlogsvc.exe [MANUAL] SysmonLog Service C:\WINDOWS\System32\svchost.exe [MANUAL] TapiSrv Service C:\WINDOWS\System32\DRIVERS\tcpip.sys [sYSTEM] Tcpip Service [MANUAL] TDPIPE Service [MANUAL] TDTCP Service C:\WINDOWS\System32\DRIVERS\termdd.sys [sYSTEM] TermDD Service C:\WINDOWS\System32\svchost.exe [MANUAL] TermService Service C:\WINDOWS\System32\svchost.exe [AUTO] Themes Service C:\WINDOWS\System32\tlntsvr.exe [DISABLED] TlntSvr Service [DISABLED] TosIde Service C:\WINDOWS\system32\svchost.exe [AUTO] TrkWks Service TSDDD Service [DISABLED] Udfs Service [DISABLED] ultra Service C:\WINDOWS\System32\wdfmgr.exe [AUTO] UMWdf Service C:\WINDOWS\System32\DRIVERS\update.sys [MANUAL] Update Service C:\WINDOWS\System32\svchost.exe [AUTO] uploadmgr Service C:\WINDOWS\System32\svchost.exe [DISABLED] upnphost Service C:\WINDOWS\System32\ups.exe [MANUAL] UPS Service C:\WINDOWS\System32\DRIVERS\usbccgp.sys [MANUAL] usbccgp Service C:\WINDOWS\System32\DRIVERS\usbehci.sys [MANUAL] usbehci Service C:\WINDOWS\System32\DRIVERS\usbhub.sys [MANUAL] usbhub Service C:\WINDOWS\System32\DRIVERS\usbprint.sys [MANUAL] usbprint Service C:\WINDOWS\System32\DRIVERS\usbscan.sys [MANUAL] usbscan Service C:\WINDOWS\System32\DRIVERS\USBSTOR.SYS [MANUAL] USBSTOR Service C:\WINDOWS\System32\DRIVERS\usbuhci.sys [MANUAL] usbuhci Service C:\WINDOWS\System32\drivers\vga.sys [sYSTEM] VgaSave Service C:\WINDOWS\System32\DRIVERS\viaide.sys [bOOT] ViaIde Service [bOOT] VolSnap Service C:\WINDOWS\System32\vssvc.exe [MANUAL] VSS Service C:\WINDOWS\System32\svchost.exe [AUTO] W32Time Service W3SVC Service C:\WINDOWS\System32\DRIVERS\wanarp.sys [MANUAL] Wanarp Service [MANUAL] WDICA Service C:\WINDOWS\system32\drivers\wdmaud.sys [MANUAL] wdmaud Service C:\WINDOWS\System32\svchost.exe [AUTO] WebClient Service C:\WINDOWS\system32\svchost.exe [AUTO] winmgmt Service [MANUAL] Winsock Service WinSock2 Service WinTrust Service C:\WINDOWS\System32\svchost.exe [MANUAL] WmdmPmSN Service C:\WINDOWS\System32\svchost.exe [MANUAL] Wmi Service WmiApRpl Service C:\WINDOWS\System32\wbem\wmiapsrv.exe [MANUAL] WmiApSrv Service [DISABLED] wscsvc Service C:\WINDOWS\system32\svchost.exe [AUTO] wuauserv Service C:\WINDOWS\System32\svchost.exe [AUTO] WZCSVC Service {9D270569-3052-4F4A-86AC-BFEF6411E418} ---- EOF - GMER 1.0.12 ----

[Joan (Joan Sunshine)]

Hmm nie wiem dlaczego ale Silent pokazuje, że ten śmieć jeszcze siedzi…

Drivers to unload: DLLHOST32 Files to delete: C:\WINDOWS\system\dllhost.exe

Ścieżki do wklejenia do Avengera, resztę procedury znasz, daj nowe logi, też z SDFix…

[dawidowski (Davids)]

Czy skasować tą ścieżkę???

C:\WINDOWS\system\dllhost.exe

[adam9870]

Avenger i SDFix powinni ją skasować. Więc wykonaj czynności podane przez Joan i wklej nowe logi, o które prosiła (bez Gmer’a)

[dawidowski (Davids)]

Przepraszam ale te logi powyżej są wklejone przed skasowaniem ścieżki w avangerze podanej przez Joan także teraz dopiero wklejam nowe logi po kolei:

Logfile of The Avenger version 1, by Swandog46 Running from registry key: \Registry\Machine\System\CurrentControlSet\Services\rolxexrr ******************* Script file located at: ??\C:\Documents and Settings\lcivwojj.txt Script file opened successfully. Script file read successfully Backups directory opened successfully at C:\Avenger ******************* Beginning to process script file: Driver DLLHOST32 unloaded successfully. File C:\WINDOWS\system\dllhost.exe deleted successfully. Completed script processing. ******************* Finished! Terminate.

Złączono Posty : 20.01.2007 (Sob) 11:41

Logfile of HijackThis v1.99.1 Scan saved at 11:45:10, on 2007-01-20 Platform: Windows XP Dodatek SP. 1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\System32\drivers\CDAC11BA.EXE C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe C:\WINDOWS\System32\nvsvc32.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe C:\WINDOWS\System32\RUNDLL32.EXE C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\PROGRA~1\A4Tech\Mouse\Amoumain.exe C:\Program Files\Winamp\winampa.exe C:\Program Files\QuickTime\qttask.exe C:\WINDOWS\System32\devldr32.exe C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe C:\WINDOWS\System32\ctfmon.exe C:\WINDOWS\System32\rundll32.exe C:\Program Files\Gadu-Gadu\gg.exe C:\WINDOWS\system32\notepad.exe C:\Program Files\Messenger\msmsgs.exe C:\Program Files\Google\GoogleToolbarNotifier\1.2.908.5008\GoogleToolbarNotifier.exe C:\Program Files\Skype\Phone\Skype.exe C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Skype\Plugin Manager\SkypePM.exe C:\Programiki systemowe\hijack\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.interia.pl/ R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0 CE\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {086F3ADF-92EA-4415-877E-C7DD7DD64F14} - C:\WINDOWS\System32\yayyayy.dll (file missing) O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\PROGRA~1\Skype\Phone\IEPlugin\SKYPEI~1.DLL O2 - BHO: (no name) - {37148FCF-7532-499F-833E-DFD1765CE5C7} - C:\WINDOWS\System32\awvvs.dll O2 - BHO: (no name) - {53598F12-7F66-44A7-855E-9A943C095213} - C:\WINDOWS\System32\vtsqp.dll (file missing) O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O2 - BHO: (no name) - {7DA39570-5FD2-4f18-94B4-20730CB3F727} - C:\WINDOWS\System32\okcyhisn.dll (file missing) O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O4 - HKLM…\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup O4 - HKLM…\Run: [nwiz] nwiz.exe /install O4 - HKLM…\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit O4 - HKLM…\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM…\Run: [WheelMouse] C:\PROGRA~1\A4Tech\Mouse\Amoumain.exe O4 - HKLM…\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe O4 - HKLM…\Run: [bearFlix] “C:\Program Files\BearFlix\BearFlix.exe” /pause O4 - HKLM…\Run: [QuickTime Task] “C:\Program Files\QuickTime\qttask.exe” -atboottime O4 - HKLM…\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM…\Run: [sunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe O4 - HKLM…\Run: [DllRunning] rundll32.exe “C:\WINDOWS\System32\kxxjdbuc.dll”,setvm O4 - HKCU…\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe O4 - HKCU…\Run: [Gadu-Gadu] “C:\Program Files\Gadu-Gadu\gg.exe” /tray O4 - HKCU…\Run: [MSMSGS] “C:\Program Files\Messenger\msmsgs.exe” /background O4 - HKCU…\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.908.5008\GoogleToolbarNotifier.exe O4 - HKCU…\Run: [skype] “C:\Program Files\Skype\Phone\Skype.exe” /nosplash /minimized O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra ‘Tools’ menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\PROGRA~1\Skype\Phone\IEPlugin\SKYPEI~1.DLL O16 - DPF: {A9ED6AA2-D9D4-4D71-9586-E293E2E3580B} (GameDesire Marbles&Diamonds&Runes) - http://67.15.101.3/g_bin/pl/marbles_2_0_0_27.cab O17 - HKLM\System\CCS\Services\Tcpip…{AA2F0D70-32E6-46CC-BF6D-3C5C7139F183}: NameServer = 194.204.152.34 217.98.63.164 O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O20 - Winlogon Notify: awvvs - C:\WINDOWS\System32\awvvs.dll O20 - Winlogon Notify: ljjhhge - ljjhhge.dll (file missing) O20 - Winlogon Notify: vtsqp - C:\WINDOWS\System32\vtsqp.dll (file missing) O20 - Winlogon Notify: yayyayy - yayyayy.dll (file missing) O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing) O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\System32\drivers\CDAC11BA.EXE O23 - Service: Sunbelt Kerio Personal Firewall 4 (KPF4) - Sunbelt Software - C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe

Złączono Posty : 20.01.2007 (Sob) 11:44

L2MFIX find log 051206 These are the registry keys present ********************************************************************************** Winlogon/notify: Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\awvvs] “Asynchronous”=dword:00000001 “DllName”=“C:\WINDOWS\System32\awvvs.dll” “Impersonate”=dword:00000000 “Startup”=“SysLogon” “Logoff”=“SysLogoff” [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain] “Asynchronous”=dword:00000000 “Impersonate”=dword:00000000 “DllName”=hex(2):63,00,72,00,79,00,70,00,74,00,33,00,32,00,2e,00,64,00,6c,00,\ 6c,00,00,00 “Logoff”=“ChainWlxLogoffEvent” [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet] “Asynchronous”=dword:00000000 “Impersonate”=dword:00000000 “DllName”=hex(2):63,00,72,00,79,00,70,00,74,00,6e,00,65,00,74,00,2e,00,64,00,\ 6c,00,6c,00,00,00 “Logoff”=“CryptnetWlxLogoffEvent” [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll] “DLLName”=“cscdll.dll” “Logon”=“WinlogonLogonEvent” “Logoff”=“WinlogonLogoffEvent” “ScreenSaver”=“WinlogonScreenSaverEvent” “Startup”=“WinlogonStartupEvent” “Shutdown”=“WinlogonShutdownEvent” “StartShell”=“WinlogonStartShellEvent” “Impersonate”=dword:00000000 “Asynchronous”=dword:00000001 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ljjhhge] “Asynchronous”=dword:00000001 “DllName”=“ljjhhge.dll” “Impersonate”=dword:00000000 “Logon”=“Logon” “Logoff”=“Logoff” [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ScCertProp] “DLLName”=“wlnotify.dll” “Logon”=“SCardStartCertProp” “Logoff”=“SCardStopCertProp” “Lock”=“SCardSuspendCertProp” “Unlock”=“SCardResumeCertProp” “Enabled”=dword:00000001 “Impersonate”=dword:00000001 “Asynchronous”=dword:00000001 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Schedule] “Asynchronous”=dword:00000000 “DllName”=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\ 6c,00,6c,00,00,00 “Impersonate”=dword:00000000 “StartShell”=“SchedStartShell” “Logoff”=“SchedEventLogOff” [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy] “Logoff”=“WLEventLogoff” “Impersonate”=dword:00000000 “Asynchronous”=dword:00000001 “DllName”=hex(2):73,00,63,00,6c,00,67,00,6e,00,74,00,66,00,79,00,2e,00,64,00,\ 6c,00,6c,00,00,00 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn] “DLLName”=“WlNotify.dll” “Lock”=“SensLockEvent” “Logon”=“SensLogonEvent” “Logoff”=“SensLogoffEvent” “Safe”=dword:00000001 “MaxWait”=dword:00000258 “StartScreenSaver”=“SensStartScreenSaverEvent” “StopScreenSaver”=“SensStopScreenSaverEvent” “Startup”=“SensStartupEvent” “Shutdown”=“SensShutdownEvent” “StartShell”=“SensStartShellEvent” “PostShell”=“SensPostShellEvent” “Disconnect”=“SensDisconnectEvent” “Reconnect”=“SensReconnectEvent” “Unlock”=“SensUnlockEvent” “Impersonate”=dword:00000001 “Asynchronous”=dword:00000001 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\termsrv] “Asynchronous”=dword:00000000 “DllName”=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\ 6c,00,6c,00,00,00 “Impersonate”=dword:00000000 “Logoff”=“TSEventLogoff” “Logon”=“TSEventLogon” “PostShell”=“TSEventPostShell” “Shutdown”=“TSEventShutdown” “StartShell”=“TSEventStartShell” “Startup”=“TSEventStartup” “MaxWait”=dword:00000258 “Reconnect”=“TSEventReconnect” “Disconnect”=“TSEventDisconnect” [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\vtsqp] “Asynchronous”=dword:00000001 “DllName”=“C:\WINDOWS\System32\vtsqp.dll” “Impersonate”=dword:00000000 “Startup”=“SysLogon” “Logoff”=“SysLogoff” [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlballoon] “DLLName”=“wlnotify.dll” “Logon”=“RegisterTicketExpiredNotificationEvent” “Logoff”=“UnregisterTicketExpiredNotificationEvent” “Impersonate”=dword:00000001 “Asynchronous”=dword:00000001 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\yayyayy] “Asynchronous”=dword:00000001 “DllName”=“yayyayy.dll” “Impersonate”=dword:00000000 “Logon”=“Logon” “Logoff”=“Logoff” ********************************************************************************** useragent: Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform] ********************************************************************************** Shell Extension key: Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved] “{00022613-0000-0000-C000-000000000046}”=“Karta wˆa˜ciwo˜ci pliku multimedialnego” “{176d6597-26d3-11d1-b350-080036a75b03}”=“ZarzĄdzanie skanerem ICM” “{1F2E5C40-9550-11CE-99D2-00AA006E086C}”=“Strona zabezpieczeä NTFS” “{3EA48300-8CF6-101B-84FB-666CCB9BCD32}”=“Strona wˆa˜ciwo˜ci OLE Docfile” “{40dd6e20-7c17-11ce-a804-00aa003ca9f6}”=“Rozszerzenia powˆoki dla udost©pniania zasob˘w” “{41E300E0-78B6-11ce-849B-444553540000}”=“PlusPack CPL Extension” “{42071712-76d4-11d1-8b24-00a0c9068ff3}”=“Rozszerzenie CPL karty graficznej” “{42071713-76d4-11d1-8b24-00a0c9068ff3}”=“Rozszerzenie CPL monitora wy˜wietlania” “{42071714-76d4-11d1-8b24-00a0c9068ff3}”=“Rozszerzenie CPL kadrowania wy˜wietlania” “{4E40F770-369C-11d0-8922-00A024AB2DBB}”=“Strona zabezpieczeä usˆugi DS” “{513D916F-2A8E-4F51-AEAB-0CBC76FB1AF8}”=“Strona zgodno˜ci” “{56117100-C0CD-101B-81E2-00AA004AE837}”=“Program obsˆugi danych wycinkowych powˆoki” “{59099400-57FF-11CE-BD94-0020AF85B590}”=“Rozszerzenie Disc Copy” “{59be4990-f85c-11ce-aff7-00aa003ca9f6}”=“Rozszerzenia powˆoki dla obiekt˘w Microsoft Windows Network” “{5DB2625A-54DF-11D0-B6C4-0800091AA605}”=“ZarzĄdzanie monitorem ICM” “{675F097E-4C4D-11D0-B6C1-0800091AA605}”=“ZarzĄdzanie drukarkĄ ICM” “{764BF0E1-F219-11ce-972D-00AA00A14F56}”=“Rozszerzenia powˆoki dla kompresji plik˘w” “{77597368-7b15-11d0-a0c2-080036af3f03}”=“Rozszerzenie powˆoki drukarek sieci Web” “{7988B573-EC89-11cf-9C00-00AA00A14F56}”=“Disk Quota UI” “{853FE2B1-B769-11d0-9C4E-00C04FB6C6FA}”=“Menu kontekstowe szyfrowania” “{85BBD920-42A0-1069-A2E4-08002B30309D}”=“Akt˘wka” “{88895560-9AA2-1069-930E-00AA0030EBC8}”=“Rozszerzenie ikony HyperTerminalu” “{BD84B380-8CA2-1069-AB1D-08000948F534}”=“Fonts” “{DBCE2480-C732-101B-BE72-BA78E9AD5B27}”=“Profil ICC” “{F37C5810-4D3F-11d0-B4BF-00AA00BBB723}”=“Strona zabezpieczeä drukarek” “{f81e9010-6ea4-11ce-a7ff-00aa003ca9f6}”=“Rozszerzenia powˆoki dla udost©pniania zasob˘w” “{f92e8c40-3d33-11d2-b1aa-080036a75b03}”=“Display TroubleShoot CPL Extension” “{7444C717-39BF-11D1-8CD9-00C04FC29D45}”=“Rozszerzenie Crypto PKO” “{7444C719-39BF-11D1-8CD9-00C04FC29D45}”=“Rozszerzenie Crypto Sign” “{7007ACC7-3202-11D1-AAD2-00805FC1270E}”=“PoˆĄczenia sieciowe” “{992CFFA0-F557-101A-88EC-00DD010CCC48}”=“PoˆĄczenia sieciowe” “{E211B736-43FD-11D1-9EFB-0000F8757FCD}”="&Skanery i aparaty fotograficzne" “{FB0C9C8A-6C50-11D1-9F1D-0000F8757FCD}”="&Skanery i aparaty fotograficzne" “{905667aa-acd6-11d2-8080-00805f6596d2}”="&Skanery i aparaty fotograficzne" “{3F953603-1008-4f6e-A73A-04AAC7A992F1}”="&Skanery i aparaty fotograficzne" “{83bbcbf3-b28a-4919-a5aa-73027445d672}”="&Skanery i aparaty fotograficzne" “{F0152790-D56E-4445-850E-4F3117DB740C}”=“Remote Sessions CPL Extension” “{5F327514-6C5E-4d60-8F16-D07FA08A78ED}”=“Auto Update Property Sheet Extension” “{60254CA5-953B-11CF-8C96-00AA00B8708C}”=“Rozszerzenia powˆoki dla hosta skrypt˘w systemu Windows” “{2206CDB2-19C1-11D1-89E0-00C04FD7A829}”=“Microsoft Data Link” “{DD2110F0-9EEF-11cf-8D8E-00AA0060F5BF}”=“Tasks Folder Icon Handler” “{797F1E90-9EDD-11cf-8D8E-00AA0060F5BF}”=“Tasks Folder Shell Extension” “{D6277990-4C6A-11CF-8D87-00AA0060F5BF}”=“Zaplanowane zadania” “{0DF44EAA-FF21-4412-828E-260A8728E7F1}”=“Pasek zadaä i menu Start” “{2559a1f0-21d7-11d4-bdaf-00c04f60b9f0}”=“Wyszukaj” “{2559a1f1-21d7-11d4-bdaf-00c04f60b9f0}”=“Pomoc i obsˆuga techniczna” “{2559a1f2-21d7-11d4-bdaf-00c04f60b9f0}”=“Pomoc i obsˆuga techniczna” “{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}”=“Uruchom…” “{2559a1f4-21d7-11d4-bdaf-00c04f60b9f0}”=“Internet” “{2559a1f5-21d7-11d4-bdaf-00c04f60b9f0}”=“E-mail” “{D20EA4E1-3957-11d2-A40B-0C5020524152}”=“Czcionki” “{D20EA4E1-3957-11d2-A40B-0C5020524153}”=“Narz©dzia administracyjne” “{875CB1A1-0F29-45de-A1AE-CFB4950D0B78}”=“Audio Media Properties Handler” “{40C3D757-D6E4-4b49-BB41-0E5BBEA28817}”=“Video Media Properties Handler” “{E4B29F9D-D390-480b-92FD-7DDB47101D71}”=“Wav Properties Handler” “{87D62D94-71B3-4b9a-9489-5FE6850DC73E}”=“Avi Properties Handler” “{A6FD9E45-6E44-43f9-8644-08598F5A74D9}”=“Midi Properties Handler” “{c5a40261-cd64-4ccf-84cb-c394da41d590}”=“Video Thumbnail Extractor” “{5E6AB780-7743-11CF-A12B-00AA004AE837}”=“Pasek narz©dzi programu Microsoft Internet” “{22BF0C20-6DA7-11D0-B373-00A0C9034938}”=“Stan pobierania” “{91EA3F8B-C99B-11d0-9815-00C04FD91972}”=“Folder powˆoki zwi©kszonej” “{6413BA2C-B461-11d1-A18A-080036B11A03}”=“Folder powˆoki zwi©kszonej 2” “{F61FFEC1-754F-11d0-80CA-00AA005B4383}”=“BandProxy” “{7BA4C742-9E81-11CF-99D3-00AA004AE837}”=“Pasek przeglĄdarki Microsoft” “{30D02401-6A81-11d0-8274-00C04FD5AE38}”=“Pasek wyszukiwania” “{32683183-48a0-441b-a342-7c2a440a9478}”=“Pasek multimedi˘w” “{169A0691-8DF9-11d1-A1C4-00C04FD75D13}”=“Wyszukiwanie w okienku” “{07798131-AF23-11d1-9111-00A0C98BA67D}”=“Wyszukiwanie w sieci Web” “{AF4F6510-F982-11d0-8595-00AA004CD6D8}”=“Narz©dzie opcji drzewa rejestru” “{01E04581-4EEE-11d0-BFE9-00AA005B4383}”="&Adres" “{A08C11D2-A228-11d0-825B-00AA005B4383}”=“Pole edycji adresu” “{00BB2763-6A77-11D0-A535-00C04FD7D062}”=“Autouzupeˆnianie Microsoft” “{7376D660-C583-11d0-A3A5-00C04FD706EC}”=“Wyodr©bnianie obraz˘w Trident” “{6756A641-DE71-11d0-831B-00AA005B4383}”=“Lista autouzupeˆniania MRU” “{6935DB93-21E8-4ccc-BEB9-9FE3C77A297A}”=“Niestandardowa lista autouzupeˆniania MRU” “{7e653215-fa25-46bd-a339-34a2790f3cb7}”=“Dost©pny” “{acf35015-526e-4230-9596-becbe19f0ac9}”=“Pasek podr©czny ˜ledzenia” “{E0E11A09-5CB8-4B6C-8332-E00720A168F2}”=“Analizator paska adresu” “{00BB2764-6A77-11D0-A535-00C04FD7D062}”=“Lista autouzupeˆniania historii Microsoft” “{03C036F1-A186-11D0-824A-00AA005B4383}”=“Lista autouzupeˆniania folderu powˆoki Microsoft” “{00BB2765-6A77-11D0-A535-00C04FD7D062}”=“Kontener wielu list autouzupeˆniania Microsoft” “{ECD4FC4E-521C-11D0-B792-00A0C90312E1}”=“Menu witryny paska powˆoki” “{3CCF8A41-5C85-11d0-9796-00AA00B90ADF}”=“Shell DeskBarApp” “{ECD4FC4C-521C-11D0-B792-00A0C90312E1}”=“Pasek pulpitu powˆoki” “{ECD4FC4D-521C-11D0-B792-00A0C90312E1}”=“Shell Rebar BandSite” “{DD313E04-FEFF-11d1-8ECD-0000F87A470C}”=“Pomoc dla uľytkownika” “{EF8AD2D1-AE36-11D1-B2D2-006097DF8C11}”=“Globalne ustawienia folder˘w” “{EFA24E61-B078-11d0-89E4-00C04FC9E26E}”=“Favorites Band” “{0A89A860-D7B1-11CE-8350-444553540000}”=“Shell Automation Inproc Service” “{E7E4BC40-E76A-11CE-A9BB-00AA004AE837}”=“Shell DocObject Viewer” “{A5E46E3A-8849-11D1-9D8C-00C04FC99D61}”=“Microsoft Browser Architecture” “{FBF23B40-E3F0-101B-8488-00AA003E56F8}”=“InternetShortcut” “{3C374A40-BAE4-11CF-BF7D-00AA006946EE}”=“Microsoft Url History Service” “{FF393560-C2A7-11CF-BFF4-444553540000}”=“Historia” “{7BD29E00-76C1-11CF-9DD0-00A0C9034933}”=“Tymczasowe pliki internetowe” “{7BD29E01-76C1-11CF-9DD0-00A0C9034933}”=“Tymczasowe pliki internetowe” “{CFBFAE00-17A6-11D0-99CB-00C04FD64497}”=“Microsoft Url Search Hook” “{A2B0DD40-CC59-11d0-A3A5-00C04FD706EC}”=“Ekran powitalny pakietu IE4” “{67EA19A0-CCEF-11d0-8024-00C04FD75D13}”=“CDF Extension Copy Hook” “{131A6951-7F78-11D0-A979-00C04FD705A2}”=“ISFBand OC” “{9461b922-3c5a-11d2-bf8b-00c04fb93661}”=“Search Assistant OC” “{3DC7A020-0ACD-11CF-A9BB-00AA004AE837}”=“Internet” “{871C5380-42A0-1069-A2EA-08002B30309D}”=“Internet Name Space” “{EFA24E64-B078-11d0-89E4-00C04FC9E26E}”=“Pasek eksploratora” “{9E56BE60-C50F-11CF-9A2C-00A0C90A90CE}”=“Sendmail service” “{9E56BE61-C50F-11CF-9A2C-00A0C90A90CE}”=“Sendmail service” “{88C6C381-2E85-11D0-94DE-444553540000}”=“Folder pami©ci podr©cznej ActiveX” “{E6FB5E20-DE35-11CF-9C87-00AA005127ED}”=“WebCheck” “{ABBE31D0-6DAE-11D0-BECA-00C04FD940BE}”=“Subscription Mgr” “{F5175861-2688-11d0-9C5E-00AA00A45957}”=“Folder subskrypcji” “{08165EA0-E946-11CF-9C87-00AA005127ED}”=“WebCheckWebCrawler” “{E3A8BDE6-ABCE-11d0-BC4B-00C04FD929DB}”=“WebCheckChannelAgent” “{E8BB6DC0-6B4E-11d0-92DB-00A0C90C2BD7}”=“TrayAgent” “{7D559C10-9FE9-11d0-93F7-00AA0059CE02}”=“Code Download Agent” “{E6CC6978-6B6E-11D0-BECA-00C04FD940BE}”=“ConnectionAgent” “{D8BD2030-6FC9-11D0-864F-00AA006809D9}”=“PostAgent” “{7FC0B86E-5FA7-11d1-BC7C-00C04FD929DB}”=“WebCheck SyncMgr Handler” “{352EC2B7-8B9A-11D1-B8AE-006008059382}”=“Menedľer aplikacji powˆoki” “{0B124F8F-91F0-11D1-B8B5-006008059382}”=“Wyliczanie zainstalowanych aplikacji” “{CFCCC7A0-A282-11D1-9082-006008059382}”=“Publikator aplikacji Darwin” “{e84fda7c-1d6a-45f6-b725-cb260c236066}”=“Shell Image Verbs” “{66e4e4fb-f385-4dd0-8d74-a2efd1bc6178}”=“Shell Image Data Factory” “{3F30C968-480A-4C6C-862D-EFC0897BB84B}”=“GDI+program wyodr©bniajĄcy miniatury plik˘w” “{9DBD2C50-62AD-11d0-B806-00C04FD706EC}”=“Informacje podsumowujĄce obsˆugi miniatur (DOCFILES)” “{EAB841A0-9550-11cf-8C16-00805F1408F3}”=“Wyodr©bnianie miniatur HTML” “{eb9b1153-3b57-4e68-959a-a3266bc3d7fe}”=“Shell Image Property Handler” “{CC6EEFFB-43F6-46c5-9619-51D571967F7D}”=“Kreator publikacji w sieci Web” “{add36aa8-751a-4579-a266-d66f5202ccbb}”=“Zamawianie odbitek w sieci Web” “{6b33163c-76a5-4b6c-bf21-45de9cd503a1}”=“Obiekt powˆoki kreatora publikacji” “{58f1f272-9240-4f51-b6d4-fd63d1618591}”=“Kreator uzyskiwania profilu usˆugi Passport” “{7A9D77BD-5403-11d2-8785-2E0420524153}”=“Konta uľytkownik˘w” “{BD472F60-27FA-11cf-B8B4-444553540000}”=“Compressed (zipped) Folder Right Drag Handler” “{888DCA60-FC0A-11CF-8F0F-00C04FD7D062}”=“Compressed (zipped) Folder SendTo Target” “{f39a0dc0-9cc8-11d0-a599-00c04fd64433}”=“Plik kanaˆu” “{f3aa0dc0-9cc8-11d0-a599-00c04fd64434}”=“Skr˘t kanaˆu” “{f3ba0dc0-9cc8-11d0-a599-00c04fd64435}”=“Obiekt obsˆugi kanaˆu” “{f3da0dc0-9cc8-11d0-a599-00c04fd64437}”=“Channel Menu” “{f3ea0dc0-9cc8-11d0-a599-00c04fd64438}”=“Channel Properties” “{63da6ec0-2e98-11cf-8d82-444553540000}”=“FTP Folders Webview” “{883373C3-BF89-11D1-BE35-080036B11A03}”=“Microsoft DocProp Shell Ext” “{A9CF0EAE-901A-4739-A481-E35B73E47F6D}”=“Microsoft DocProp Inplace Edit Box Control” “{8EE97210-FD1F-4B19-91DA-67914005F020}”=“Microsoft DocProp Inplace ML Edit Box Control” “{0EEA25CC-4362-4A12-850B-86EE61B0D3EB}”=“Microsoft DocProp Inplace Droplist Combo Control” “{6A205B57-2567-4A2C-B881-F787FAB579A3}”=“Microsoft DocProp Inplace Calendar Control” “{28F8A4AC-BBB3-4D9B-B177-82BFC914FA33}”=“Microsoft DocProp Inplace Time Control” “{8A23E65E-31C2-11d0-891C-00A024AB2DBB}”=“Directory Query UI” “{9E51E0D0-6E0F-11d2-9601-00C04FA31A86}”=“Shell properties for a DS object” “{163FDC20-2ABC-11d0-88F0-00A024AB2DBB}”=“Directory Object Find” “{F020E586-5264-11d1-A532-0000F8757D7E}”=“Directory Start/Search Find” “{0D45D530-764B-11d0-A1CA-00AA00C16E65}”=“Directory Property UI” “{62AE1F9A-126A-11D0-A14B-0800361B1103}”=“Directory Context Menu Verbs” “{ECF03A33-103D-11d2-854D-006008059367}”=“MyDocs Copy Hook” “{ECF03A32-103D-11d2-854D-006008059367}”=“MyDocs Drop Target” “{4a7ded0a-ad25-11d0-98a8-0800361b1103}”=“MyDocs Properties” “{750fdf0e-2a26-11d1-a3ea-080036587f03}”=“Offline Files Menu” “{10CFC467-4392-11d2-8DB4-00C04FA31A66}”=“Offline Files Folder Options” “{AFDB1F70-2A4C-11d2-9039-00C04F8EEB3E}”=“Folder plik˘w trybu offline” “{143A62C8-C33B-11D1-84FE-00C04FA34A14}”=“Microsoft Agent Character Property Sheet Handler” “{ECCDF543-45CC-11CE-B9BF-0080C87CDBA6}”=“DfsShell” “{60fd46de-f830-4894-a628-6fa81bc0190d}”="%DESC_PublishDropTarget%" “{7A80E4A8-8005-11D2-BCF8-00C04F72C717}”=“MMC Icon Handler” “{0CD7A5C0-9F37-11CE-AE65-08002B2E1262}”=".CAB file viewer" “{32714800-2E5F-11d0-8B85-00AA0044F941}”="&Do os˘b…" “{8DD448E6-C188-4aed-AF92-44956194EB1F}”=“Windows Media Player Play as Playlist Context Menu Handler” “{CE3FB1D1-02AE-4a5f-A6E9-D9F1B4073E6C}”=“Windows Media Player Burn Audio CD Context Menu Handler” “{F1B9284F-E9DC-4e68-9D7E-42362A59F0FD}”=“Windows Media Player Add to Playlist Context Menu Handler” “{A70C977A-BF00-412C-90B7-034C51DA2439}”=“NvCpl DesktopContext Class” “{FFB699E0-306A-11d3-8BD1-00104B6F7516}”=“Play on my TV helper” “{1CDB2949-8F65-4355-8456-263E7C208A5D}”=“Desktop Explorer” “{1E9B04FB-F9E5-4718-997B-B8DA88302A47}”=“Desktop Explorer Menu” “{1E9B04FB-F9E5-4718-997B-B8DA88302A48}”=“nView Desktop Context Menu” “{472083B0-C522-11CF-8763-00608CC02F24}”=“avast” “{BDEADF00-C265-11D0-BCED-00A0C90AB50F}”=“Foldery w sieci Web” “{42042206-2D85-11D3-8CFF-005004838597}”=“Microsoft Office HTML Icon Handler” “{B41DB860-8EE4-11D2-9906-E49FADC173CA}”=“WinRAR shell extension” “{36A21736-36C2-4C11-8ACB-D4136F2B57BD}”=“AutoCAD Digital Signatures Icon Overlay Handler” “{AC1DB655-4F9A-4c39-8AD2-A65324A4C446}”=“Autodesk Drawing Preview” “{640167b4-59b0-47a6-b335-a6b3c0695aea}”=“Portable Media Devices” “{cc86590a-b60a-48e6-996b-41d25ed39a1e}”=“Portable Media Devices Menu” ********************************************************************************** HKEY ROOT CLASSIDS: ********************************************************************************** Files Found are not all bad files: C:\WINDOWS\SYSTEM32\ awvvs.dll Fri 2007-01-19 14:58:28 …SH. 277 044 270,55 K cpvusgss.dll Mon 2007-01-15 15:24:20 A… 81 684 79,77 K rqrqnon.dll Fri 2007-01-19 15:13:28 …SH. 22 029 21,51 K vtuuurq.dll Fri 2007-01-19 16:57:52 …SH. 22 029 21,51 K wvuvsrr.dll Fri 2007-01-19 15:20:38 …SH. 22 029 21,51 K 5 items found: 5 files (4 H/S), 0 directories. Total of file sizes: 424 815 bytes 414,86 K Locate .tmp files: No matches found. ********************************************************************************** Directory Listing of system files: Wolumin w stacji C nie ma etykiety. Numer seryjny woluminu: 6CED-99C4 Katalog: C:\WINDOWS\System32 2007-01-20 11:46 450˙597 svvwa.ini 2007-01-19 16:57 22˙029 vtuuurq.dll 2007-01-19 15:20 22˙029 wvuvsrr.dll 2007-01-19 15:13 22˙029 rqrqnon.dll 2007-01-19 14:58 444˙120 svvwa.bak1 2007-01-19 14:58 277˙044 awvvs.dll 2007-01-18 14:25 2006-08-19 18:51 6 plik(˘w) 1˙237˙848 bajt˘w 2 katalog(˘w) 31˙723˙057˙152 bajt˘w wolnych

[Joan (Joan Sunshine)]

No jeszcze trochę zostało.

Files to delete: C:\WINDOWS\System32\svvwa.ini C:\WINDOWS\System32\vtuuurq.dll C:\WINDOWS\System32\wvuvsrr.dll C:\WINDOWS\System32\rqrqnon.dll C:\WINDOWS\System32\svvwa.bak1 C:\WINDOWS\System32\awvvs.dll

Oczywiście Avenger,

O20 - Winlogon Notify: awvvs - C:\WINDOWS\System32\awvvs.dll O20 - Winlogon Notify: ljjhhge - ljjhhge.dll (file missing) O20 - Winlogon Notify: vtsqp - C:\WINDOWS\System32\vtsqp.dll (file missing) O20 - Winlogon Notify: yayyayy - yayyayy.dll (file missing)

Fix w HJT i komplecik logów

[dawidowski (Davids)]

SDFix: Version 1.56 **************** 2007-01-20 - 11:56:44,95 Microsoft Windows XP [Wersja 5.1.2600] Running From: C:\SDFix Stage One - Safe Mode Checking Services… Service Name: File Path: Starting Registry Repairs… Restoring Default Hosts File… Stage One Complete Rebooting… Stage Two - Normal Mode Checking For Malware: -------------------- C:\WINDOWS\system32\i Backing Up and Removing any Files Found… Alternate Stream Check: C:\WINDOWS\system32 No streams found. Final Check: Remaining Services: ------------------ Remaining Files: --------------- Backups Folder: - C:\SDFix\backups\backups.zip Checking for files with Hidden Attributes: C:\NTDETECT.COM C:\WINDOWS\system32\awvvs.dll C:\WINDOWS\system32\rqrqnon.dll C:\WINDOWS\system32\vtuuurq.dll C:\WINDOWS\system32\wvuvsrr.dll C:\Program Files\Autodesk\Autodesk Express Viewer\Setup.exe C:\WINDOWS\system32\cdplayer.exe.manifest C:\WINDOWS\system32\logonui.exe.manifest C:\IO.SYS C:\MSDOS.SYS C:\pagefile.sys FINISHED!

Złączono Posty : 20.01.2007 (Sob) 12:04

Logfile of The Avenger version 1, by Swandog46 Running from registry key: \Registry\Machine\System\CurrentControlSet\Services\acjoodaj ******************* Script file located at: ??\C:\WINDOWS\ybxihhhw.txt Script file opened successfully. Script file read successfully Backups directory opened successfully at C:\Avenger ******************* Beginning to process script file: File C:\WINDOWS\System32\svvwa.ini deleted successfully. File C:\WINDOWS\System32\vtuuurq.dll deleted successfully. File C:\WINDOWS\System32\wvuvsrr.dll deleted successfully. File C:\WINDOWS\System32\rqrqnon.dll deleted successfully. File C:\WINDOWS\System32\svvwa.bak1 deleted successfully. File C:\WINDOWS\System32\awvvs.dll deleted successfully. Completed script processing. ******************* Finished! Terminate.

Złączono Posty : 20.01.2007 (Sob) 12:11

Nowy log z HijackThis

Logfile of HijackThis v1.99.1 Scan saved at 12:14:43, on 2007-01-20 Platform: Windows XP Dodatek SP. 1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\System32\drivers\CDAC11BA.EXE C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe C:\WINDOWS\System32\nvsvc32.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe C:\WINDOWS\System32\RUNDLL32.EXE C:\WINDOWS\System32\rundll32.exe C:\WINDOWS\System32\devldr32.exe C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\PROGRA~1\A4Tech\Mouse\Amoumain.exe C:\Program Files\Winamp\winampa.exe C:\Program Files\QuickTime\qttask.exe C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe C:\WINDOWS\System32\ctfmon.exe C:\Program Files\Gadu-Gadu\gg.exe C:\Program Files\Messenger\msmsgs.exe C:\WINDOWS\system32\notepad.exe C:\Program Files\Google\GoogleToolbarNotifier\1.2.908.5008\GoogleToolbarNotifier.exe C:\Program Files\Skype\Phone\Skype.exe C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Skype\Plugin Manager\SkypePM.exe C:\Programiki systemowe\hijack\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.interia.pl/ R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0 CE\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {086F3ADF-92EA-4415-877E-C7DD7DD64F14} - C:\WINDOWS\System32\yayyayy.dll (file missing) O2 - BHO: (no name) - {14573F9F-6C18-4A5E-B253-D7D2E40CE9E9} - C:\WINDOWS\System32\awvvs.dll (file missing) O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\PROGRA~1\Skype\Phone\IEPlugin\SKYPEI~1.DLL O2 - BHO: (no name) - {53598F12-7F66-44A7-855E-9A943C095213} - C:\WINDOWS\System32\vtsqp.dll (file missing) O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O2 - BHO: (no name) - {7DA39570-5FD2-4f18-94B4-20730CB3F727} - C:\WINDOWS\System32\okcyhisn.dll (file missing) O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O4 - HKLM…\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup O4 - HKLM…\Run: [nwiz] nwiz.exe /install O4 - HKLM…\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit O4 - HKLM…\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM…\Run: [WheelMouse] C:\PROGRA~1\A4Tech\Mouse\Amoumain.exe O4 - HKLM…\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe O4 - HKLM…\Run: [bearFlix] “C:\Program Files\BearFlix\BearFlix.exe” /pause O4 - HKLM…\Run: [QuickTime Task] “C:\Program Files\QuickTime\qttask.exe” -atboottime O4 - HKLM…\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM…\Run: [sunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe O4 - HKLM…\Run: [DllRunning] rundll32.exe “C:\WINDOWS\System32\kxxjdbuc.dll”,setvm O4 - HKCU…\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe O4 - HKCU…\Run: [Gadu-Gadu] “C:\Program Files\Gadu-Gadu\gg.exe” /tray O4 - HKCU…\Run: [MSMSGS] “C:\Program Files\Messenger\msmsgs.exe” /background O4 - HKCU…\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.908.5008\GoogleToolbarNotifier.exe O4 - HKCU…\Run: [skype] “C:\Program Files\Skype\Phone\Skype.exe” /nosplash /minimized O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra ‘Tools’ menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\PROGRA~1\Skype\Phone\IEPlugin\SKYPEI~1.DLL O16 - DPF: {A9ED6AA2-D9D4-4D71-9586-E293E2E3580B} (GameDesire Marbles&Diamonds&Runes) - http://67.15.101.3/g_bin/pl/marbles_2_0_0_27.cab O17 - HKLM\System\CCS\Services\Tcpip…{AA2F0D70-32E6-46CC-BF6D-3C5C7139F183}: NameServer = 194.204.152.34 217.98.63.164 O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing) O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\System32\drivers\CDAC11BA.EXE O23 - Service: Sunbelt Kerio Personal Firewall 4 (KPF4) - Sunbelt Software - C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe

Złączono Posty : 20.01.2007 (Sob) 12:12

Nowy log z L2MFIX

L2MFIX find log 051206 These are the registry keys present ********************************************************************************** Winlogon/notify: Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain] “Asynchronous”=dword:00000000 “Impersonate”=dword:00000000 “DllName”=hex(2):63,00,72,00,79,00,70,00,74,00,33,00,32,00,2e,00,64,00,6c,00,\ 6c,00,00,00 “Logoff”=“ChainWlxLogoffEvent” [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet] “Asynchronous”=dword:00000000 “Impersonate”=dword:00000000 “DllName”=hex(2):63,00,72,00,79,00,70,00,74,00,6e,00,65,00,74,00,2e,00,64,00,\ 6c,00,6c,00,00,00 “Logoff”=“CryptnetWlxLogoffEvent” [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll] “DLLName”=“cscdll.dll” “Logon”=“WinlogonLogonEvent” “Logoff”=“WinlogonLogoffEvent” “ScreenSaver”=“WinlogonScreenSaverEvent” “Startup”=“WinlogonStartupEvent” “Shutdown”=“WinlogonShutdownEvent” “StartShell”=“WinlogonStartShellEvent” “Impersonate”=dword:00000000 “Asynchronous”=dword:00000001 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ScCertProp] “DLLName”=“wlnotify.dll” “Logon”=“SCardStartCertProp” “Logoff”=“SCardStopCertProp” “Lock”=“SCardSuspendCertProp” “Unlock”=“SCardResumeCertProp” “Enabled”=dword:00000001 “Impersonate”=dword:00000001 “Asynchronous”=dword:00000001 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Schedule] “Asynchronous”=dword:00000000 “DllName”=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\ 6c,00,6c,00,00,00 “Impersonate”=dword:00000000 “StartShell”=“SchedStartShell” “Logoff”=“SchedEventLogOff” [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy] “Logoff”=“WLEventLogoff” “Impersonate”=dword:00000000 “Asynchronous”=dword:00000001 “DllName”=hex(2):73,00,63,00,6c,00,67,00,6e,00,74,00,66,00,79,00,2e,00,64,00,\ 6c,00,6c,00,00,00 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn] “DLLName”=“WlNotify.dll” “Lock”=“SensLockEvent” “Logon”=“SensLogonEvent” “Logoff”=“SensLogoffEvent” “Safe”=dword:00000001 “MaxWait”=dword:00000258 “StartScreenSaver”=“SensStartScreenSaverEvent” “StopScreenSaver”=“SensStopScreenSaverEvent” “Startup”=“SensStartupEvent” “Shutdown”=“SensShutdownEvent” “StartShell”=“SensStartShellEvent” “PostShell”=“SensPostShellEvent” “Disconnect”=“SensDisconnectEvent” “Reconnect”=“SensReconnectEvent” “Unlock”=“SensUnlockEvent” “Impersonate”=dword:00000001 “Asynchronous”=dword:00000001 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\termsrv] “Asynchronous”=dword:00000000 “DllName”=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\ 6c,00,6c,00,00,00 “Impersonate”=dword:00000000 “Logoff”=“TSEventLogoff” “Logon”=“TSEventLogon” “PostShell”=“TSEventPostShell” “Shutdown”=“TSEventShutdown” “StartShell”=“TSEventStartShell” “Startup”=“TSEventStartup” “MaxWait”=dword:00000258 “Reconnect”=“TSEventReconnect” “Disconnect”=“TSEventDisconnect” [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlballoon] “DLLName”=“wlnotify.dll” “Logon”=“RegisterTicketExpiredNotificationEvent” “Logoff”=“UnregisterTicketExpiredNotificationEvent” “Impersonate”=dword:00000001 “Asynchronous”=dword:00000001 ********************************************************************************** useragent: Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform] ********************************************************************************** Shell Extension key: Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved] “{00022613-0000-0000-C000-000000000046}”=“Karta waciwoci pliku multimedialnego” “{176d6597-26d3-11d1-b350-080036a75b03}”=“ZarzĄdzanie skanerem ICM” “{1F2E5C40-9550-11CE-99D2-00AA006E086C}”=“Strona zabezpieczeä NTFS” “{3EA48300-8CF6-101B-84FB-666CCB9BCD32}”=“Strona waciwoci OLE Docfile” “{40dd6e20-7c17-11ce-a804-00aa003ca9f6}”=“Rozszerzenia powoki dla udost©pniania zasob˘w” “{41E300E0-78B6-11ce-849B-444553540000}”=“PlusPack CPL Extension” “{42071712-76d4-11d1-8b24-00a0c9068ff3}”=“Rozszerzenie CPL karty graficznej” “{42071713-76d4-11d1-8b24-00a0c9068ff3}”=“Rozszerzenie CPL monitora wywietlania” “{42071714-76d4-11d1-8b24-00a0c9068ff3}”=“Rozszerzenie CPL kadrowania wywietlania” “{4E40F770-369C-11d0-8922-00A024AB2DBB}”=“Strona zabezpieczeä usugi DS” “{513D916F-2A8E-4F51-AEAB-0CBC76FB1AF8}”=“Strona zgodnoci” “{56117100-C0CD-101B-81E2-00AA004AE837}”=“Program obsugi danych wycinkowych powoki” “{59099400-57FF-11CE-BD94-0020AF85B590}”=“Rozszerzenie Disc Copy” “{59be4990-f85c-11ce-aff7-00aa003ca9f6}”=“Rozszerzenia powoki dla obiekt˘w Microsoft Windows Network” “{5DB2625A-54DF-11D0-B6C4-0800091AA605}”=“ZarzĄdzanie monitorem ICM” “{675F097E-4C4D-11D0-B6C1-0800091AA605}”=“ZarzĄdzanie drukarkĄ ICM” “{764BF0E1-F219-11ce-972D-00AA00A14F56}”=“Rozszerzenia powoki dla kompresji plik˘w” “{77597368-7b15-11d0-a0c2-080036af3f03}”=“Rozszerzenie powoki drukarek sieci Web” “{7988B573-EC89-11cf-9C00-00AA00A14F56}”=“Disk Quota UI” “{853FE2B1-B769-11d0-9C4E-00C04FB6C6FA}”=“Menu kontekstowe szyfrowania” “{85BBD920-42A0-1069-A2E4-08002B30309D}”=“Akt˘wka” “{88895560-9AA2-1069-930E-00AA0030EBC8}”=“Rozszerzenie ikony HyperTerminalu” “{BD84B380-8CA2-1069-AB1D-08000948F534}”=“Fonts” “{DBCE2480-C732-101B-BE72-BA78E9AD5B27}”=“Profil ICC” “{F37C5810-4D3F-11d0-B4BF-00AA00BBB723}”=“Strona zabezpieczeä drukarek” “{f81e9010-6ea4-11ce-a7ff-00aa003ca9f6}”=“Rozszerzenia powoki dla udost©pniania zasob˘w” “{f92e8c40-3d33-11d2-b1aa-080036a75b03}”=“Display TroubleShoot CPL Extension” “{7444C717-39BF-11D1-8CD9-00C04FC29D45}”=“Rozszerzenie Crypto PKO” “{7444C719-39BF-11D1-8CD9-00C04FC29D45}”=“Rozszerzenie Crypto Sign” “{7007ACC7-3202-11D1-AAD2-00805FC1270E}”=“PoĄczenia sieciowe” “{992CFFA0-F557-101A-88EC-00DD010CCC48}”=“PoĄczenia sieciowe” “{E211B736-43FD-11D1-9EFB-0000F8757FCD}”="&Skanery i aparaty fotograficzne" “{FB0C9C8A-6C50-11D1-9F1D-0000F8757FCD}”="&Skanery i aparaty fotograficzne" “{905667aa-acd6-11d2-8080-00805f6596d2}”="&Skanery i aparaty fotograficzne" “{3F953603-1008-4f6e-A73A-04AAC7A992F1}”="&Skanery i aparaty fotograficzne" “{83bbcbf3-b28a-4919-a5aa-73027445d672}”="&Skanery i aparaty fotograficzne" “{F0152790-D56E-4445-850E-4F3117DB740C}”=“Remote Sessions CPL Extension” “{5F327514-6C5E-4d60-8F16-D07FA08A78ED}”=“Auto Update Property Sheet Extension” “{60254CA5-953B-11CF-8C96-00AA00B8708C}”=“Rozszerzenia powoki dla hosta skrypt˘w systemu Windows” “{2206CDB2-19C1-11D1-89E0-00C04FD7A829}”=“Microsoft Data Link” “{DD2110F0-9EEF-11cf-8D8E-00AA0060F5BF}”=“Tasks Folder Icon Handler” “{797F1E90-9EDD-11cf-8D8E-00AA0060F5BF}”=“Tasks Folder Shell Extension” “{D6277990-4C6A-11CF-8D87-00AA0060F5BF}”=“Zaplanowane zadania” “{0DF44EAA-FF21-4412-828E-260A8728E7F1}”=“Pasek zadaä i menu Start” “{2559a1f0-21d7-11d4-bdaf-00c04f60b9f0}”=“Wyszukaj” “{2559a1f1-21d7-11d4-bdaf-00c04f60b9f0}”=“Pomoc i obsuga techniczna” “{2559a1f2-21d7-11d4-bdaf-00c04f60b9f0}”=“Pomoc i obsuga techniczna” “{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}”=“Uruchom…” “{2559a1f4-21d7-11d4-bdaf-00c04f60b9f0}”=“Internet” “{2559a1f5-21d7-11d4-bdaf-00c04f60b9f0}”=“E-mail” “{D20EA4E1-3957-11d2-A40B-0C5020524152}”=“Czcionki” “{D20EA4E1-3957-11d2-A40B-0C5020524153}”=“Narz©dzia administracyjne” “{875CB1A1-0F29-45de-A1AE-CFB4950D0B78}”=“Audio Media Properties Handler” “{40C3D757-D6E4-4b49-BB41-0E5BBEA28817}”=“Video Media Properties Handler” “{E4B29F9D-D390-480b-92FD-7DDB47101D71}”=“Wav Properties Handler” “{87D62D94-71B3-4b9a-9489-5FE6850DC73E}”=“Avi Properties Handler” “{A6FD9E45-6E44-43f9-8644-08598F5A74D9}”=“Midi Properties Handler” “{c5a40261-cd64-4ccf-84cb-c394da41d590}”=“Video Thumbnail Extractor” “{5E6AB780-7743-11CF-A12B-00AA004AE837}”=“Pasek narz©dzi programu Microsoft Internet” “{22BF0C20-6DA7-11D0-B373-00A0C9034938}”=“Stan pobierania” “{91EA3F8B-C99B-11d0-9815-00C04FD91972}”=“Folder powoki zwi©kszonej” “{6413BA2C-B461-11d1-A18A-080036B11A03}”=“Folder powoki zwi©kszonej 2” “{F61FFEC1-754F-11d0-80CA-00AA005B4383}”=“BandProxy” “{7BA4C742-9E81-11CF-99D3-00AA004AE837}”=“Pasek przeglĄdarki Microsoft” “{30D02401-6A81-11d0-8274-00C04FD5AE38}”=“Pasek wyszukiwania” “{32683183-48a0-441b-a342-7c2a440a9478}”=“Pasek multimedi˘w” “{169A0691-8DF9-11d1-A1C4-00C04FD75D13}”=“Wyszukiwanie w okienku” “{07798131-AF23-11d1-9111-00A0C98BA67D}”=“Wyszukiwanie w sieci Web” “{AF4F6510-F982-11d0-8595-00AA004CD6D8}”=“Narz©dzie opcji drzewa rejestru” “{01E04581-4EEE-11d0-BFE9-00AA005B4383}”="&Adres" “{A08C11D2-A228-11d0-825B-00AA005B4383}”=“Pole edycji adresu” “{00BB2763-6A77-11D0-A535-00C04FD7D062}”=“Autouzupenianie Microsoft” “{7376D660-C583-11d0-A3A5-00C04FD706EC}”=“Wyodr©bnianie obraz˘w Trident” “{6756A641-DE71-11d0-831B-00AA005B4383}”=“Lista autouzupeniania MRU” “{6935DB93-21E8-4ccc-BEB9-9FE3C77A297A}”=“Niestandardowa lista autouzupeniania MRU” “{7e653215-fa25-46bd-a339-34a2790f3cb7}”=“Dost©pny” “{acf35015-526e-4230-9596-becbe19f0ac9}”=“Pasek podr©czny ledzenia” “{E0E11A09-5CB8-4B6C-8332-E00720A168F2}”=“Analizator paska adresu” “{00BB2764-6A77-11D0-A535-00C04FD7D062}”=“Lista autouzupeniania historii Microsoft” “{03C036F1-A186-11D0-824A-00AA005B4383}”=“Lista autouzupeniania folderu powoki Microsoft” “{00BB2765-6A77-11D0-A535-00C04FD7D062}”=“Kontener wielu list autouzupeniania Microsoft” “{ECD4FC4E-521C-11D0-B792-00A0C90312E1}”=“Menu witryny paska powoki” “{3CCF8A41-5C85-11d0-9796-00AA00B90ADF}”=“Shell DeskBarApp” “{ECD4FC4C-521C-11D0-B792-00A0C90312E1}”=“Pasek pulpitu powoki” “{ECD4FC4D-521C-11D0-B792-00A0C90312E1}”=“Shell Rebar BandSite” “{DD313E04-FEFF-11d1-8ECD-0000F87A470C}”=“Pomoc dla uľytkownika” “{EF8AD2D1-AE36-11D1-B2D2-006097DF8C11}”=“Globalne ustawienia folder˘w” “{EFA24E61-B078-11d0-89E4-00C04FC9E26E}”=“Favorites Band” “{0A89A860-D7B1-11CE-8350-444553540000}”=“Shell Automation Inproc Service” “{E7E4BC40-E76A-11CE-A9BB-00AA004AE837}”=“Shell DocObject Viewer” “{A5E46E3A-8849-11D1-9D8C-00C04FC99D61}”=“Microsoft Browser Architecture” “{FBF23B40-E3F0-101B-8488-00AA003E56F8}”=“InternetShortcut” “{3C374A40-BAE4-11CF-BF7D-00AA006946EE}”=“Microsoft Url History Service” “{FF393560-C2A7-11CF-BFF4-444553540000}”=“Historia” “{7BD29E00-76C1-11CF-9DD0-00A0C9034933}”=“Tymczasowe pliki internetowe” “{7BD29E01-76C1-11CF-9DD0-00A0C9034933}”=“Tymczasowe pliki internetowe” “{CFBFAE00-17A6-11D0-99CB-00C04FD64497}”=“Microsoft Url Search Hook” “{A2B0DD40-CC59-11d0-A3A5-00C04FD706EC}”=“Ekran powitalny pakietu IE4” “{67EA19A0-CCEF-11d0-8024-00C04FD75D13}”=“CDF Extension Copy Hook” “{131A6951-7F78-11D0-A979-00C04FD705A2}”=“ISFBand OC” “{9461b922-3c5a-11d2-bf8b-00c04fb93661}”=“Search Assistant OC” “{3DC7A020-0ACD-11CF-A9BB-00AA004AE837}”=“Internet” “{871C5380-42A0-1069-A2EA-08002B30309D}”=“Internet Name Space” “{EFA24E64-B078-11d0-89E4-00C04FC9E26E}”=“Pasek eksploratora” “{9E56BE60-C50F-11CF-9A2C-00A0C90A90CE}”=“Sendmail service” “{9E56BE61-C50F-11CF-9A2C-00A0C90A90CE}”=“Sendmail service” “{88C6C381-2E85-11D0-94DE-444553540000}”=“Folder pami©ci podr©cznej ActiveX” “{E6FB5E20-DE35-11CF-9C87-00AA005127ED}”=“WebCheck” “{ABBE31D0-6DAE-11D0-BECA-00C04FD940BE}”=“Subscription Mgr” “{F5175861-2688-11d0-9C5E-00AA00A45957}”=“Folder subskrypcji” “{08165EA0-E946-11CF-9C87-00AA005127ED}”=“WebCheckWebCrawler” “{E3A8BDE6-ABCE-11d0-BC4B-00C04FD929DB}”=“WebCheckChannelAgent” “{E8BB6DC0-6B4E-11d0-92DB-00A0C90C2BD7}”=“TrayAgent” “{7D559C10-9FE9-11d0-93F7-00AA0059CE02}”=“Code Download Agent” “{E6CC6978-6B6E-11D0-BECA-00C04FD940BE}”=“ConnectionAgent” “{D8BD2030-6FC9-11D0-864F-00AA006809D9}”=“PostAgent” “{7FC0B86E-5FA7-11d1-BC7C-00C04FD929DB}”=“WebCheck SyncMgr Handler” “{352EC2B7-8B9A-11D1-B8AE-006008059382}”=“Menedľer aplikacji powoki” “{0B124F8F-91F0-11D1-B8B5-006008059382}”=“Wyliczanie zainstalowanych aplikacji” “{CFCCC7A0-A282-11D1-9082-006008059382}”=“Publikator aplikacji Darwin” “{e84fda7c-1d6a-45f6-b725-cb260c236066}”=“Shell Image Verbs” “{66e4e4fb-f385-4dd0-8d74-a2efd1bc6178}”=“Shell Image Data Factory” “{3F30C968-480A-4C6C-862D-EFC0897BB84B}”=“GDI+program wyodr©bniajĄcy miniatury plik˘w” “{9DBD2C50-62AD-11d0-B806-00C04FD706EC}”=“Informacje podsumowujĄce obsugi miniatur (DOCFILES)” “{EAB841A0-9550-11cf-8C16-00805F1408F3}”=“Wyodr©bnianie miniatur HTML” “{eb9b1153-3b57-4e68-959a-a3266bc3d7fe}”=“Shell Image Property Handler” “{CC6EEFFB-43F6-46c5-9619-51D571967F7D}”=“Kreator publikacji w sieci Web” “{add36aa8-751a-4579-a266-d66f5202ccbb}”=“Zamawianie odbitek w sieci Web” “{6b33163c-76a5-4b6c-bf21-45de9cd503a1}”=“Obiekt powoki kreatora publikacji” “{58f1f272-9240-4f51-b6d4-fd63d1618591}”=“Kreator uzyskiwania profilu usugi Passport” “{7A9D77BD-5403-11d2-8785-2E0420524153}”=“Konta uľytkownik˘w” “{BD472F60-27FA-11cf-B8B4-444553540000}”=“Compressed (zipped) Folder Right Drag Handler” “{888DCA60-FC0A-11CF-8F0F-00C04FD7D062}”=“Compressed (zipped) Folder SendTo Target” “{f39a0dc0-9cc8-11d0-a599-00c04fd64433}”=“Plik kanau” “{f3aa0dc0-9cc8-11d0-a599-00c04fd64434}”=“Skr˘t kanau” “{f3ba0dc0-9cc8-11d0-a599-00c04fd64435}”=“Obiekt obsugi kanau” “{f3da0dc0-9cc8-11d0-a599-00c04fd64437}”=“Channel Menu” “{f3ea0dc0-9cc8-11d0-a599-00c04fd64438}”=“Channel Properties” “{63da6ec0-2e98-11cf-8d82-444553540000}”=“FTP Folders Webview” “{883373C3-BF89-11D1-BE35-080036B11A03}”=“Microsoft DocProp Shell Ext” “{A9CF0EAE-901A-4739-A481-E35B73E47F6D}”=“Microsoft DocProp Inplace Edit Box Control” “{8EE97210-FD1F-4B19-91DA-67914005F020}”=“Microsoft DocProp Inplace ML Edit Box Control” “{0EEA25CC-4362-4A12-850B-86EE61B0D3EB}”=“Microsoft DocProp Inplace Droplist Combo Control” “{6A205B57-2567-4A2C-B881-F787FAB579A3}”=“Microsoft DocProp Inplace Calendar Control” “{28F8A4AC-BBB3-4D9B-B177-82BFC914FA33}”=“Microsoft DocProp Inplace Time Control” “{8A23E65E-31C2-11d0-891C-00A024AB2DBB}”=“Directory Query UI” “{9E51E0D0-6E0F-11d2-9601-00C04FA31A86}”=“Shell properties for a DS object” “{163FDC20-2ABC-11d0-88F0-00A024AB2DBB}”=“Directory Object Find” “{F020E586-5264-11d1-A532-0000F8757D7E}”=“Directory Start/Search Find” “{0D45D530-764B-11d0-A1CA-00AA00C16E65}”=“Directory Property UI” “{62AE1F9A-126A-11D0-A14B-0800361B1103}”=“Directory Context Menu Verbs” “{ECF03A33-103D-11d2-854D-006008059367}”=“MyDocs Copy Hook” “{ECF03A32-103D-11d2-854D-006008059367}”=“MyDocs Drop Target” “{4a7ded0a-ad25-11d0-98a8-0800361b1103}”=“MyDocs Properties” “{750fdf0e-2a26-11d1-a3ea-080036587f03}”=“Offline Files Menu” “{10CFC467-4392-11d2-8DB4-00C04FA31A66}”=“Offline Files Folder Options” “{AFDB1F70-2A4C-11d2-9039-00C04F8EEB3E}”=“Folder plik˘w trybu offline” “{143A62C8-C33B-11D1-84FE-00C04FA34A14}”=“Microsoft Agent Character Property Sheet Handler” “{ECCDF543-45CC-11CE-B9BF-0080C87CDBA6}”=“DfsShell” “{60fd46de-f830-4894-a628-6fa81bc0190d}”="%DESC_PublishDropTarget%" “{7A80E4A8-8005-11D2-BCF8-00C04F72C717}”=“MMC Icon Handler” “{0CD7A5C0-9F37-11CE-AE65-08002B2E1262}”=".CAB file viewer" “{32714800-2E5F-11d0-8B85-00AA0044F941}”="&Do os˘b…" “{8DD448E6-C188-4aed-AF92-44956194EB1F}”=“Windows Media Player Play as Playlist Context Menu Handler” “{CE3FB1D1-02AE-4a5f-A6E9-D9F1B4073E6C}”=“Windows Media Player Burn Audio CD Context Menu Handler” “{F1B9284F-E9DC-4e68-9D7E-42362A59F0FD}”=“Windows Media Player Add to Playlist Context Menu Handler” “{A70C977A-BF00-412C-90B7-034C51DA2439}”=“NvCpl DesktopContext Class” “{FFB699E0-306A-11d3-8BD1-00104B6F7516}”=“Play on my TV helper” “{1CDB2949-8F65-4355-8456-263E7C208A5D}”=“Desktop Explorer” “{1E9B04FB-F9E5-4718-997B-B8DA88302A47}”=“Desktop Explorer Menu” “{1E9B04FB-F9E5-4718-997B-B8DA88302A48}”=“nView Desktop Context Menu” “{472083B0-C522-11CF-8763-00608CC02F24}”=“avast” “{BDEADF00-C265-11D0-BCED-00A0C90AB50F}”=“Foldery w sieci Web” “{42042206-2D85-11D3-8CFF-005004838597}”=“Microsoft Office HTML Icon Handler” “{B41DB860-8EE4-11D2-9906-E49FADC173CA}”=“WinRAR shell extension” “{36A21736-36C2-4C11-8ACB-D4136F2B57BD}”=“AutoCAD Digital Signatures Icon Overlay Handler” “{AC1DB655-4F9A-4c39-8AD2-A65324A4C446}”=“Autodesk Drawing Preview” “{640167b4-59b0-47a6-b335-a6b3c0695aea}”=“Portable Media Devices” “{cc86590a-b60a-48e6-996b-41d25ed39a1e}”=“Portable Media Devices Menu” ********************************************************************************** HKEY ROOT CLASSIDS: ********************************************************************************** Files Found are not all bad files: C:\WINDOWS\SYSTEM32\ cpvusgss.dll Mon 2007-01-15 15:24:20 A… 81 684 79,77 K 1 item found: 1 file, 0 directories. Total of file sizes: 81 684 bytes 79,77 K Locate .tmp files: No matches found. ********************************************************************************** Directory Listing of system files: Wolumin w stacji C nie ma etykiety. Numer seryjny woluminu: 6CED-99C4 Katalog: C:\WINDOWS\System32 2007-01-18 14:25 2006-08-19 18:51 0 plik(˘w) 0 bajt˘w 2 katalog(˘w) 31˙722˙577˙920 bajt˘w wolnych

Złączono Posty : 20.01.2007 (Sob) 12:47

“Silent Runners.vbs”, revision 49, http://www.silentrunners.org/ Operating System: Windows XP Output limited to non-default values, except where indicated by “{++}” Startup items buried in registry: --------------------------------- HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ {++} “CTFMON.EXE” = “C:\WINDOWS\System32\ctfmon.exe” [MS] “Gadu-Gadu” = ““C:\Program Files\Gadu-Gadu\gg.exe” /tray” [“Gadu-Gadu Sp. z oo”] “MSMSGS” = ““C:\Program Files\Messenger\msmsgs.exe” /background” [MS] “swg” = “C:\Program Files\Google\GoogleToolbarNotifier\1.2.908.5008\GoogleToolbarNotifier.exe” [“Google Inc.”] “Skype” = ““C:\Program Files\Skype\Phone\Skype.exe” /nosplash /minimized” [“Skype Technologies S.A.”] HKLM\Software\Microsoft\Windows\CurrentVersion\Run\ {++} “NvCplDaemon” = “RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup” [MS] “nwiz” = “nwiz.exe /install” [“NVIDIA Corporation”] “NvMediaCenter” = “RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit” [MS] “avast!” = “C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe” [null data] “WheelMouse” = “C:\PROGRA~1\A4Tech\Mouse\Amoumain.exe” [“A4Tech Co., Ltd.”] “WinampAgent” = “C:\Program Files\Winamp\winampa.exe” [null data] “BearFlix” = ““C:\Program Files\BearFlix\BearFlix.exe” /pause” [file not found] “QuickTime Task” = ““C:\Program Files\QuickTime\qttask.exe” -atboottime” [“Apple Computer, Inc.”] “NeroFilterCheck” = “C:\WINDOWS\system32\NeroCheck.exe” [“Ahead Software Gmbh”] “SunJavaUpdateSched” = “C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe” [“Sun Microsystems, Inc.”] “DllRunning” = “rundll32.exe “C:\WINDOWS\System32\kxxjdbuc.dll”,setvm” [MS] HKLM\Software\Microsoft\Active Setup\Installed Components\ {306D6C21-C1B6-4629-986C-E59E1875B8AF}(Default) = (no title provided) \StubPath = ““C:\WINDOWS\System32\rundll32.exe” “C:\Program Files\Messenger\msgsc.dll”,ShowIconsUser” [MS] HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}(Default) = (no title provided) -> {HKLM…CLSID} = “AcroIEHlprObj Class” \InProcServer32(Default) = “C:\Program Files\Adobe\Acrobat 6.0 CE\Reader\ActiveX\AcroIEHelper.dll” [“Adobe Systems Incorporated”] {086F3ADF-92EA-4415-877E-C7DD7DD64F14}(Default) = (no title provided) -> {HKLM…CLSID} = (no title provided) \InProcServer32(Default) = “C:\WINDOWS\System32\yayyayy.dll” [file not found] {14573F9F-6C18-4A5E-B253-D7D2E40CE9E9}(Default) = (no title provided) -> {HKLM…CLSID} = (no title provided) \InProcServer32(Default) = “C:\WINDOWS\System32\awvvs.dll” [file not found] {22BF413B-C6D2-4d91-82A9-A0F997BA588C}(Default) = “Skype add-on (mastermind)” -> {HKLM…CLSID} = “Skype add-on (mastermind)” \InProcServer32(Default) = “C:\PROGRA~1\Skype\Phone\IEPlugin\SKYPEI~1.DLL” [“Skype Technologies S.A.”] {53598F12-7F66-44A7-855E-9A943C095213}(Default) = (no title provided) -> {HKLM…CLSID} = (no title provided) \InProcServer32(Default) = “C:\WINDOWS\System32\vtsqp.dll” [file not found] {53707962-6F74-2D53-2644-206D7942484F}(Default) = (no title provided) -> {HKLM…CLSID} = (no title provided) \InProcServer32(Default) = “C:\Program Files\Spybot - Search & Destroy\SDHelper.dll” [“Safer Networking Limited”] {761497BB-D6F0-462C-B6EB-D4DAF1D92D43}(Default) = (no title provided) -> {HKLM…CLSID} = “SSVHelper Class” \InProcServer32(Default) = “C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll” [“Sun Microsystems, Inc.”] {7DA39570-5FD2-4f18-94B4-20730CB3F727}(Default) = (no title provided) -> {HKLM…CLSID} = (no title provided) \InProcServer32(Default) = “C:\WINDOWS\System32\okcyhisn.dll” [file not found] {AA58ED58-01DD-4d91-8333-CF10577473F7}(Default) = (no title provided) -> {HKLM…CLSID} = “Google Toolbar Helper” \InProcServer32(Default) = “c:\program files\google\googletoolbar1.dll” [“Google Inc.”] HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\ “{42071714-76d4-11d1-8b24-00a0c9068ff3}” = “Rozszerzenie CPL kadrowania wyświetlania” -> {HKLM…CLSID} = “Rozszerzenie CPL kadrowania wyświetlania” \InProcServer32(Default) = “deskpan.dll” [file not found] “{88895560-9AA2-1069-930E-00AA0030EBC8}” = “Rozszerzenie ikony HyperTerminalu” -> {HKLM…CLSID} = “HyperTerminal Icon Ext” \InProcServer32(Default) = “C:\WINDOWS\System32\hticons.dll” [“Hilgraeve, Inc.”] “{A70C977A-BF00-412C-90B7-034C51DA2439}” = “NvCpl DesktopContext Class” -> {HKLM…CLSID} = “DesktopContext Class” \InProcServer32(Default) = “C:\WINDOWS\System32\nvcpl.dll” [“NVIDIA Corporation”] “{FFB699E0-306A-11d3-8BD1-00104B6F7516}” = “Play on my TV helper” -> {HKLM…CLSID} = “NVIDIA CPL Extension” \InProcServer32(Default) = “C:\WINDOWS\System32\nvcpl.dll” [“NVIDIA Corporation”] “{1CDB2949-8F65-4355-8456-263E7C208A5D}” = “Desktop Explorer” -> {HKLM…CLSID} = “Desktop Explorer” \InProcServer32(Default) = “C:\WINDOWS\System32\nvshell.dll” [“NVIDIA Corporation”] “{1E9B04FB-F9E5-4718-997B-B8DA88302A47}” = “Desktop Explorer Menu” -> {HKLM…CLSID} = (no title provided) \InProcServer32(Default) = “C:\WINDOWS\System32\nvshell.dll” [“NVIDIA Corporation”] “{1E9B04FB-F9E5-4718-997B-B8DA88302A48}” = “nView Desktop Context Menu” -> {HKLM…CLSID} = “nView Desktop Context Menu” \InProcServer32(Default) = “C:\WINDOWS\System32\nvshell.dll” [“NVIDIA Corporation”] “{472083B0-C522-11CF-8763-00608CC02F24}” = “avast” -> {HKLM…CLSID} = “avast” \InProcServer32(Default) = “C:\Program Files\Alwil Software\Avast4\ashShell.dll” [“ALWIL Software”] “{42042206-2D85-11D3-8CFF-005004838597}” = “Microsoft Office HTML Icon Handler” -> {HKLM…CLSID} = (no title provided) \InProcServer32(Default) = “C:\Program Files\Microsoft Office\Office10\msohev.dll” [MS] “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” = “WinRAR shell extension” -> {HKLM…CLSID} = “WinRAR” \InProcServer32(Default) = “C:\Program Files\WinRAR\rarext.dll” [null data] “{36A21736-36C2-4C11-8ACB-D4136F2B57BD}” = “AutoCAD Digital Signatures Icon Overlay Handler” -> {HKLM…CLSID} = “AcSignIcon” \InProcServer32(Default) = “C:\WINDOWS\System32\AcSignIcon.dll” [“Autodesk”] “{AC1DB655-4F9A-4c39-8AD2-A65324A4C446}” = “Autodesk Drawing Preview” -> {HKLM…CLSID} = “ACTHUMBNAIL” \InProcServer32(Default) = “C:\Program Files\Common Files\Autodesk Shared\Thumbnail\AcThumbnail16.dll” [“Autodesk”] “{cc86590a-b60a-48e6-996b-41d25ed39a1e}” = “Portable Media Devices Menu” -> {HKLM…CLSID} = “Portable Media Devices Menu” \InProcServer32(Default) = “C:\WINDOWS\System32\Audiodev.dll” [MS] HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\ <> “{086F3ADF-92EA-4415-877E-C7DD7DD64F14}” = “*e” (unwritable string) -> {HKLM…CLSID} = (no title provided) \InProcServer32(Default) = “C:\WINDOWS\System32\yayyayy.dll” [file not found] HKLM\Software\Classes*\shellex\ContextMenuHandlers\ avast(Default) = “{472083B0-C522-11CF-8763-00608CC02F24}” -> {HKLM…CLSID} = “avast” \InProcServer32(Default) = “C:\Program Files\Alwil Software\Avast4\ashShell.dll” [“ALWIL Software”] WinRAR(Default) = “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” -> {HKLM…CLSID} = “WinRAR” \InProcServer32(Default) = “C:\Program Files\WinRAR\rarext.dll” [null data] HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\ WinRAR(Default) = “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” -> {HKLM…CLSID} = “WinRAR” \InProcServer32(Default) = “C:\Program Files\WinRAR\rarext.dll” [null data] HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\ avast(Default) = “{472083B0-C522-11CF-8763-00608CC02F24}” -> {HKLM…CLSID} = “avast” \InProcServer32(Default) = “C:\Program Files\Alwil Software\Avast4\ashShell.dll” [“ALWIL Software”] WinRAR(Default) = “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” -> {HKLM…CLSID} = “WinRAR” \InProcServer32(Default) = “C:\Program Files\WinRAR\rarext.dll” [null data] Default executables: -------------------- HKCU\Software\Classes.scr(Default) = “AutoCADScriptFile” <> HKCU\Software\Classes\AutoCADScriptFile\shell\open\command(Default) = "“C:\WINDOWS\notepad.exe” “%1"” [MS] Group Policies {GPedit.msc branch and setting}: ----------------------------------------------- Note: detected settings may not have any effect. HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\ “NoActiveDesktop” = (REG_DWORD) hex:0x00000000 {User Configuration|Administrative Templates|Desktop|Desktop / Active Desktop| Disable Active Desktop} “NoSaveSettings” = (REG_DWORD) hex:0x00000000 {User Configuration|Administrative Templates|Desktop| Don’t save settings at exit} “ClassicShell” = (REG_DWORD) hex:0x00000000 {User Configuration|Administrative Templates|Windows Components|Windows Explorer| Enable Classic Shell / Turn on Classic Shell} “NoThemesTab” = (REG_DWORD) hex:0x00000000 {unrecognized setting} “ForceActiveDesktopOn” = (REG_DWORD) hex:0x00000000 {User Configuration|Administrative Templates|Desktop|Desktop / Active Desktop| Enable Active Desktop} HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\ “NoActiveDesktopChanges” = (REG_DWORD) hex:0x00000000 {unrecognized setting} HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System\ “NoDispAppearancePage” = (REG_DWORD) hex:0x00000000 {unrecognized setting} “NoColorChoice” = (REG_DWORD) hex:0x00000000 {unrecognized setting} “NoSizeChoice” = (REG_DWORD) hex:0x00000000 {unrecognized setting} “NoDispBackgroundPage” = (REG_DWORD) hex:0x00000000 {User Configuration|Administrative Templates|Control Panel|Display| Hide Desktop tab} “NoDispScrSavPage” = (REG_DWORD) hex:0x00000000 {unrecognized setting} “NoDispCPL” = (REG_DWORD) hex:0x00000000 {User Configuration|Administrative Templates|Control Panel|Display| Remove Display in Control Panel} “NoVisualStyleChoice” = (REG_DWORD) hex:0x00000000 {unrecognized setting} “NoDispSettingsPage” = (REG_DWORD) hex:0x00000000 {unrecognized setting} HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\ “shutdownwithoutlogon” = (REG_DWORD) hex:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| Shutdown: Allow system to be shut down without having to log on} “undockwithoutlogon” = (REG_DWORD) hex:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| Devices: Allow undock without having to log on} Active Desktop and Wallpaper: ----------------------------- Active Desktop may be disabled at this entry: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState Displayed if Active Desktop enabled and wallpaper not set by Group Policy: HKCU\Software\Microsoft\Internet Explorer\Desktop\General\ “Wallpaper” = “C:\Documents and Settings\Dawid\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp” Displayed if Active Desktop disabled and wallpaper not set by Group Policy: HKCU\Control Panel\Desktop\ “Wallpaper” = “C:\Documents and Settings\Dawid\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp” Enabled Screen Saver: --------------------- HKCU\Control Panel\Desktop\ “SCRNSAVE.EXE” = “C:\WINDOWS\System32\logon.scr” [MS] Startup items in “Dawid” & “All Users” startup folders: ------------------------------------------------------- C:\Documents and Settings\All Users\Menu Start\Programy\Autostart “DSLMON” -> shortcut to: “C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe” [empty string] “Microsoft Office” -> shortcut to: “C:\Program Files\Microsoft Office\Office10\OSA.EXE -b -l” [MS] Winsock2 Service Provider DLLs: ------------------------------- Namespace Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++} 000000000001\LibraryPath = “%SystemRoot%\System32\mswsock.dll” [MS] 000000000002\LibraryPath = “%SystemRoot%\System32\winrnr.dll” [MS] 000000000003\LibraryPath = “%SystemRoot%\System32\mswsock.dll” [MS] Transport Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++} 0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range: %SystemRoot%\system32\mswsock.dll [MS], 01 - 03, 06 - 15 %SystemRoot%\system32\rsvpsp.dll [MS], 04 - 05 Toolbars, Explorer Bars, Extensions: ------------------------------------ Toolbars HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\ “{2318C2B1-4965-11D4-9B18-009027A5CD4F}” -> {HKLM…CLSID} = “&Google” \InProcServer32(Default) = “c:\program files\google\googletoolbar1.dll” [“Google Inc.”] “{74DD705D-6834-439C-A735-A6DBE2677452}” -> {HKLM…CLSID} = “&VSAdd-in” \InProcServer32(Default) = “C:\Program Files\VSAdd-in\VSAdd-in.dll” [file not found] HKLM\Software\Microsoft\Internet Explorer\Toolbar\ “{2318C2B1-4965-11D4-9B18-009027A5CD4F}” = (no title provided) -> {HKLM…CLSID} = “&Google” \InProcServer32(Default) = “c:\program files\google\googletoolbar1.dll” [“Google Inc.”] Extensions (Tools menu items, main toolbar menu buttons) HKLM\Software\Microsoft\Internet Explorer\Extensions\ {08B0E5C0-4FCB-11CF-AAA5-00401C608501}\ “MenuText” = “Sun Java Console” “CLSIDExtension” = “{CAFEEFAC-0015-0000-0006-ABCDEFFEDCBC}” -> {HKCU…CLSID} = “Java Plug-in” \InProcServer32(Default) = “C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll” [“Sun Microsystems, Inc.”] -> {HKLM…CLSID} = “Java Plug-in 1.5.0_06” \InProcServer32(Default) = “C:\Program Files\Java\jre1.5.0_06\bin\npjpi150_06.dll” [“Sun Microsystems, Inc.”] {77BF5300-1474-4EC7-9980-D32B190E9B07}\ “ButtonText” = “Skype” “CLSIDExtension” = “{77BF5300-1474-4EC7-9980-D32B190E9B07}” -> {HKLM…CLSID} = “Skype add-on (button)” \InProcServer32(Default) = “C:\PROGRA~1\Skype\Phone\IEPlugin\SKYPEI~1.DLL” [“Skype Technologies S.A.”] Running Services (Display Name, Service Name, Path {Service DLL}): ------------------------------------------------------------------ avast! Antivirus, avast! Antivirus, ““C:\Program Files\Alwil Software\Avast4\ashServ.exe”” [null data] avast! iAVS4 Control Service, aswUpdSv, ““C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe”” [null data] avast! Mail Scanner, avast! Mail Scanner, ““C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe” /service” [“ALWIL Software”] C-DillaCdaC11BA, C-DillaCdaC11BA, “C:\WINDOWS\System32\drivers\CDAC11BA.EXE” [“Macrovision”] NVIDIA Display Driver Service, NVSvc, “C:\WINDOWS\System32\nvsvc32.exe” [“NVIDIA Corporation”] Sunbelt Kerio Personal Firewall 4, KPF4, “C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe” [“Sunbelt Software”] Windows User Mode Driver Framework, UMWdf, “C:\WINDOWS\System32\wdfmgr.exe” [MS] Print Monitors: --------------- HKLM\System\CurrentControlSet\Control\Print\Monitors\ PCL Language Monitor\Driver = “hpz3l3xu.dll” [“Hewlett-Packard Company”] ---------- <>: Suspicious data at a malware launch point. + This report excludes default entries except where indicated. + To see *everywhere* the script checks and *everything* it finds, launch it from a command prompt or a shortcut with the -all parameter. + To search all directories of local fixed drives for DESKTOP.INI DLL launch points, use the -supp parameter or answer “No” at the first message box and “Yes” at the second message box. ---------- (total run time: 1498 seconds, including 18 seconds for message boxes)

Złączono Posty : 20.01.2007 (Sob) 12:53

Póki co bardzo dziękuję zauważyłem jużduże postępy w firewallu nie ma juz dllhost takze jest dobrze ale po starcie systemu występuje jeszcze komunikat:

RUNDLL Wystąpił błąd podczas ładowania C:\WINDOWS\System32\kxxjdbuc.dll Nie można odnaleźć określonego modułu

Poza tym w Firewallu pojawiło się jeszcze takie połączenie jak:

Application Layer Gataway Service (jest to protokół TPC)

mam nadzieję, że nie jest to nic groźnego

Złączono Posty : 01.02.2007 (Czw) 23:25

Jestem świeżo po formacie także problem z dllhost zniknął ale niestety pojawił się inny z którym nota bene nie pierwszy raz sie spotykam mianowicie chodzi o taką kwestie ze po podłączeniu do internetu net chodzi przez chwile po czym wyskakuje komunikat…

Trwa zamykanie systemu. Zapisz wszystkie rozpoczęte prace i wyloguj się.

po minucie komp się resetuje. Kiedyś miałem nakładki windowsa ale niestety już ichnie posiadam. Poniżej załączam log z hijack

Logfile of HijackThis v1.99.1 Scan saved at 23:21:32, on 2007-02-01 Platform: Windows XP Dodatek SP. 1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe C:\WINDOWS\System32\nvsvc32.exe C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\PROGRA~1\A4Tech\Mouse\Amoumain.exe C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\WINDOWS\System32\ctfmon.exe C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe C:\WINDOWS\System32\devldr32.exe C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe C:\PROGRA~1\WINZIP\wzqkpick.exe C:\Programiki systemowe\hijackthis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0 CE\Reader\ActiveX\AcroIEHelper.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O4 - HKLM…\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup O4 - HKLM…\Run: [nwiz] nwiz.exe /install O4 - HKLM…\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit O4 - HKLM…\Run: [WheelMouse] C:\PROGRA~1\A4Tech\Mouse\Amoumain.exe O4 - HKLM…\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM…\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKCU…\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm O9 - Extra ‘Tools’ menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing) O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing) O23 - Service: Sunbelt Kerio Personal Firewall 4 (KPF4) - Sunbelt Software - C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe

Złączono Posty : 01.02.2007 (Czw) 23:33

Dodatkowo występują jeszcze w firewallu takie procesy jak wcescomm, wcesmgr, rpimgr, cappmgr