Problem z Win32.TrojanDownloader.Small

michalj82 · 11 Grudzień 2006 13:19

Przy skanowaniu Ad-Aware wykrył Win32.TrojanDownloader.Small, który jest w rejestrze. Pomimo próby usunięcia on dalej jest w systemie.

Oto logi z Hijackthis i Silent Runners:

Logfile of HijackThis v1.99.1 Scan saved at 14:14:01, on 2006-12-11 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\System32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\ZoneLabs\vsmon.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\SOUNDMAN.EXE C:\Program Files\ATI Technologies\ATI.ACE\cli.exe C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe C:\Program Files\DAEMON Tools\daemon.exe C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\HP\Digital Imaging\Product Assistant\bin\hprblog.exe C:\Program Files\ATI Technologies\ATI.ACE\cli.exe C:\Program Files\ATI Technologies\ATI.ACE\cli.exe e:\hijackthis\hijackthis.exe C:\Program Files\Alwil Software\Avast4\ashSimpl.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.pl/ R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll O4 - HKLM…\Run: [soundMan] SOUNDMAN.EXE O4 - HKLM…\Run: [ATICCC] “C:\Program Files\ATI Technologies\ATI.ACE\cli.exe” runtime -Delay O4 - HKLM…\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM…\Run: [Zone Labs Client] “C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe” O4 - HKLM…\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM…\Run: [DAEMON Tools] “C:\Program Files\DAEMON Tools\daemon.exe” -lang 1033 O4 - HKCU…\Run: [AQQ] C:\PROGRA~1\Wapster\AQQ\AQQ.exe O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll O9 - Extra ‘Tools’ menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra ‘Tools’ menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing) O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing) O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

“Silent Runners.vbs”, revision 49, http://www.silentrunners.org/ Operating System: Windows XP SP2 Output limited to non-default values, except where indicated by “{++}” Startup items buried in registry: --------------------------------- HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ {++} “AQQ” = “C:\PROGRA~1\Wapster\AQQ\AQQ.exe” [“AQQ Sp. z o.o.”] HKLM\Software\Microsoft\Windows\CurrentVersion\Run\ {++} “SoundMan” = “SOUNDMAN.EXE” [“Realtek Semiconductor Corp.”] “ATICCC” = ““C:\Program Files\ATI Technologies\ATI.ACE\cli.exe” runtime -Delay” [null data] “avast!” = “C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe” [null data] “Zone Labs Client” = ““C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe”” [“Zone Labs, LLC”] “NeroFilterCheck” = “C:\WINDOWS\system32\NeroCheck.exe” [“Ahead Software Gmbh”] “DAEMON Tools” = ““C:\Program Files\DAEMON Tools\daemon.exe” -lang 1033” [“DT Soft Ltd.”] HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}(Default) = (no title provided) -> {HKLM…CLSID} = “Adobe PDF Reader Link Helper” \InProcServer32(Default) = “C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll” [“Adobe Systems Incorporated”] {53707962-6F74-2D53-2644-206D7942484F}(Default) = (no title provided) -> {HKLM…CLSID} = (no title provided) \InProcServer32(Default) = “C:\PROGRA~1\SPYBOT~1\SDHelper.dll” [“Safer Networking Limited”] {761497BB-D6F0-462C-B6EB-D4DAF1D92D43}(Default) = (no title provided) -> {HKLM…CLSID} = “SSVHelper Class” \InProcServer32(Default) = “C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll” [“Sun Microsystems, Inc.”] HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\ “{42071714-76d4-11d1-8b24-00a0c9068ff3}” = “Rozszerzenie CPL kadrowania wyświetlania” -> {HKLM…CLSID} = “Rozszerzenie CPL kadrowania wyświetlania” \InProcServer32(Default) = “deskpan.dll” [file not found] “{88895560-9AA2-1069-930E-00AA0030EBC8}” = “Rozszerzenie ikony HyperTerminalu” -> {HKLM…CLSID} = “HyperTerminal Icon Ext” \InProcServer32(Default) = “C:\WINDOWS\System32\hticons.dll” [“Hilgraeve, Inc.”] “{5E2121EE-0300-11D4-8D3B-444553540000}” = “Catalyst Context Menu extension” -> {HKLM…CLSID} = “SimpleShlExt Class” \InProcServer32(Default) = “C:\Program Files\ATI Technologies\ATI.ACE\atiacmxx.dll” [empty string] “{472083B0-C522-11CF-8763-00608CC02F24}” = “avast” -> {HKLM…CLSID} = “avast” \InProcServer32(Default) = “C:\Program Files\Alwil Software\Avast4\ashShell.dll” [“ALWIL Software”] “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” = “WinRAR shell extension” -> {HKLM…CLSID} = “WinRAR” \InProcServer32(Default) = “C:\Program Files\WinRAR\rarext.dll” [null data] “{cc86590a-b60a-48e6-996b-41d25ed39a1e}” = “Portable Media Devices Menu” -> {HKLM…CLSID} = “Portable Media Devices Menu” \InProcServer32(Default) = “C:\WINDOWS\system32\Audiodev.dll” [MS] “{0006F045-0000-0000-C000-000000000046}” = “Microsoft Outlook Custom Icon Handler” -> {HKLM…CLSID} = “Rozszerzenie ikon plików programu Outlook” \InProcServer32(Default) = “C:\PROGRA~1\MICROS~2\Office\OLKFSTUB.DLL” [MS] “{B9E1D2CB-CCFF-4AA6-9579-D7A4754030EF}” = “iTunes” -> {HKLM…CLSID} = “iTunes” \InProcServer32(Default) = “C:\Program Files\iTunes\iTunesMiniPlayer.dll” [“Apple Computer, Inc.”] HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ <> AtiExtEvent\DLLName = “Ati2evxx.dll” [“ATI Technologies Inc.”] HKLM\Software\Classes\Folder\shellex\ColumnHandlers\ {F9DB5320-233E-11D1-9F84-707F02C10627}(Default) = “PDF Column Info” -> {HKLM…CLSID} = “PDF Shell Extension” \InProcServer32(Default) = “C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\PDFShell.dll” [“Adobe Systems, Inc.”] HKLM\Software\Classes*\shellex\ContextMenuHandlers\ avast(Default) = “{472083B0-C522-11CF-8763-00608CC02F24}” -> {HKLM…CLSID} = “avast” \InProcServer32(Default) = “C:\Program Files\Alwil Software\Avast4\ashShell.dll” [“ALWIL Software”] WinRAR(Default) = “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” -> {HKLM…CLSID} = “WinRAR” \InProcServer32(Default) = “C:\Program Files\WinRAR\rarext.dll” [null data] HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\ WinRAR(Default) = “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” -> {HKLM…CLSID} = “WinRAR” \InProcServer32(Default) = “C:\Program Files\WinRAR\rarext.dll” [null data] HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\ avast(Default) = “{472083B0-C522-11CF-8763-00608CC02F24}” -> {HKLM…CLSID} = “avast” \InProcServer32(Default) = “C:\Program Files\Alwil Software\Avast4\ashShell.dll” [“ALWIL Software”] WinRAR(Default) = “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” -> {HKLM…CLSID} = “WinRAR” \InProcServer32(Default) = “C:\Program Files\WinRAR\rarext.dll” [null data] Group Policies {GPedit.msc branch and setting}: ----------------------------------------------- Note: detected settings may not have any effect. HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\ “shutdownwithoutlogon” = (REG_DWORD) hex:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| Shutdown: Allow system to be shut down without having to log on} “undockwithoutlogon” = (REG_DWORD) hex:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| Devices: Allow undock without having to log on} Active Desktop and Wallpaper: ----------------------------- Active Desktop may be disabled at this entry: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState Displayed if Active Desktop enabled and wallpaper not set by Group Policy: HKCU\Software\Microsoft\Internet Explorer\Desktop\General\ “Wallpaper” = “C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp” Displayed if Active Desktop disabled and wallpaper not set by Group Policy: HKCU\Control Panel\Desktop\ “Wallpaper” = “C:\Documents and Settings\Sławek\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp” Startup items in “Sławek” & “All Users” startup folders: -------------------------------------------------------- C:\Documents and Settings\All Users\Menu Start\Programy\Autostart “HP Digital Imaging Monitor” -> shortcut to: “C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe” [“Hewlett-Packard Co.”] “Microsoft Office” -> shortcut to: “C:\Program Files\Microsoft Office\Office\OSA9.EXE -b -l” [MS] Winsock2 Service Provider DLLs: ------------------------------- Namespace Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++} 000000000001\LibraryPath = “%SystemRoot%\System32\mswsock.dll” [MS] 000000000002\LibraryPath = “%SystemRoot%\System32\winrnr.dll” [MS] 000000000003\LibraryPath = “%SystemRoot%\System32\mswsock.dll” [MS] Transport Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++} 0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range: %SystemRoot%\system32\mswsock.dll [MS], 01 - 03, 06 - 11 %SystemRoot%\system32\rsvpsp.dll [MS], 04 - 05 Toolbars, Explorer Bars, Extensions: ------------------------------------ Extensions (Tools menu items, main toolbar menu buttons) HKLM\Software\Microsoft\Internet Explorer\Extensions\ {08B0E5C0-4FCB-11CF-AAA5-00401C608501}\ “MenuText” = “Sun Java Console” “CLSIDExtension” = “{CAFEEFAC-0015-0000-0009-ABCDEFFEDCBC}” -> {HKCU…CLSID} = “Java Plug-in 1.5.0_09” \InProcServer32(Default) = “C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll” [“Sun Microsystems, Inc.”] -> {HKLM…CLSID} = “Java Plug-in 1.5.0_09” \InProcServer32(Default) = “C:\Program Files\Java\jre1.5.0_09\bin\npjpi150_09.dll” [“Sun Microsystems, Inc.”] {FB5F1910-F110-11D2-BB9E-00C04F795683}\ “ButtonText” = “Messenger” “MenuText” = “Windows Messenger” “Exec” = “C:\Program Files\Messenger\msmsgs.exe” [MS] Running Services (Display Name, Service Name, Path {Service DLL}): ------------------------------------------------------------------ Ati HotKey Poller, Ati HotKey Poller, “C:\WINDOWS\System32\Ati2evxx.exe” [“ATI Technologies Inc.”] avast! Antivirus, avast! Antivirus, ““C:\Program Files\Alwil Software\Avast4\ashServ.exe”” [null data] avast! iAVS4 Control Service, aswUpdSv, ““C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe”” [null data] avast! Mail Scanner, avast! Mail Scanner, ““C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe” /service” [“ALWIL Software”] avast! Web Scanner, avast! Web Scanner, ““C:\Program Files\Alwil Software\Avast4\ashWebSv.exe” /service” [“ALWIL Software”] TrueVector Internet Monitor, vsmon, “C:\WINDOWS\system32\ZoneLabs\vsmon.exe -service” [“Zone Labs, LLC”] Windows User Mode Driver Framework, UMWdf, “C:\WINDOWS\system32\wdfmgr.exe” [MS] Print Monitors: --------------- HKLM\System\CurrentControlSet\Control\Print\Monitors\ HP Standard TCP/IP Port\Driver = “HpTcpMon.dll” [“Hewlett Packard”] hpzsnt12\Driver = “hpzsnt12.dll” [“HP”] ---------- <>: Suspicious data at a malware launch point. + This report excludes default entries except where indicated. + To see *everywhere* the script checks and *everything* it finds, launch it from a command prompt or a shortcut with the -all parameter. + To search all directories of local fixed drives for DESKTOP.INI DLL launch points, use the -supp parameter or answer “No” at the first message box and “Yes” at the second message box. ---------- (total run time: 57 seconds, including 4 seconds for message boxes)

Proszę o pomoc.

Bieniol · 11 Grudzień 2006 13:22

Czysto

Podaj ścieżkę zainfekowanego pliku, oraz zrób skan AVG AntySpyware 7.5 po update

Przeskanuj komputer programami Ad-aware SE Personal 1.06 oraz Spybot Search & Destroy 1.4

michalj82 · 11 Grudzień 2006 13:27

Oto log z Ad-Aware.

Ad-Aware SE Build 1.06r1 Logfile Created on:11 grudnia 2006 14:12:41 Created with Ad-Aware SE Personal, free for private use. Using definitions file:SE1R138 11.12.2006 »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» References detected during the scan: »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» MRU List(TAC index:0):3 total references Win32.TrojanDownloader.Small(TAC index:7):1 total references »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» Ad-Aware SE Settings =========================== Set : Search for negligible risk entries Set : Search for low-risk threats Set : Safe mode (always request confirmation) Set : Scan active processes Set : Scan registry Set : Deep-scan registry Set : Scan my IE Favorites for banned URLs Set : Scan my Hosts file Extended Ad-Aware SE Settings =========================== Set : Unload recognized processes & modules during scan Set : Scan registry for all users instead of current user only Set : Always try to unload modules before deletion Set : During removal, unload Explorer and IE if necessary Set : Let Windows remove files in use at next reboot Set : Delete quarantined objects after restoring Set : Include basic Ad-Aware settings in log file Set : Include additional Ad-Aware settings in log file Set : Include reference summary in log file Set : Include alternate data stream details in log file Set : Play sound at scan completion if scan locates critical objects 2006-12-11 14:12:41 - Scan started. (Full System Scan) MRU List Object Recognized! Location: : software\microsoft\directdraw\mostrecentapplication Description : most recent application to use microsoft directdraw MRU List Object Recognized! Location: : S-1-5-21-2052111302-329068152-839522115-1003\software\microsoft\windows\currentversion\applets\regedit Description : last key accessed using the microsoft registry editor MRU List Object Recognized! Location: : S-1-5-21-2052111302-329068152-839522115-1003\software\microsoft\windows\currentversion\explorer\runmru Description : mru list for items opened in start | run Listing running processes »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» #:1 [smss.exe] FilePath : \SystemRoot\System32\ ProcessID : 516 ThreadCreationTime : 2006-12-11 12:59:09 BasePriority : Normal #:2 [csrss.exe] FilePath : ??\C:\WINDOWS\system32\ ProcessID : 568 ThreadCreationTime : 2006-12-11 12:59:11 BasePriority : Normal #:3 [winlogon.exe] FilePath : ??\C:\WINDOWS\system32\ ProcessID : 596 ThreadCreationTime : 2006-12-11 12:59:14 BasePriority : High #:4 [services.exe] FilePath : C:\WINDOWS\system32\ ProcessID : 640 ThreadCreationTime : 2006-12-11 12:59:14 BasePriority : Normal FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) ProductVersion : 5.1.2600.2180 ProductName : System operacyjny Microsoft® Windows® CompanyName : Microsoft Corporation FileDescription : Usługi i aplikacja Kontroler InternalName : services.exe LegalCopyright : © Microsoft Corporation. Wszelkie prawa zastrzeżone. OriginalFilename : services.exe #:5 [lsass.exe] FilePath : C:\WINDOWS\system32\ ProcessID : 652 ThreadCreationTime : 2006-12-11 12:59:14 BasePriority : Normal FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) ProductVersion : 5.1.2600.2180 ProductName : Microsoft® Windows® Operating System CompanyName : Microsoft Corporation FileDescription : LSA Shell (Export Version) InternalName : lsass.exe LegalCopyright : © Microsoft Corporation. All rights reserved. OriginalFilename : lsass.exe #:6 [ati2evxx.exe] FilePath : C:\WINDOWS\System32\ ProcessID : 804 ThreadCreationTime : 2006-12-11 12:59:14 BasePriority : Normal FileVersion : 6.14.10.4132 ProductVersion : 6.14.10.4132 ProductName : ATI External Event Utility for WindowsNT and Windows9X CompanyName : ATI Technologies Inc. FileDescription : ATI External Event Utility EXE Module InternalName : ATI2EVXX.EXE LegalCopyright : Copyright © 1999-2004 ATI Technologies Inc. OriginalFilename : ATI2EVXX.EXE #:7 [svchost.exe] FilePath : C:\WINDOWS\system32\ ProcessID : 816 ThreadCreationTime : 2006-12-11 12:59:14 BasePriority : Normal FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) ProductVersion : 5.1.2600.2180 ProductName : Microsoft® Windows® Operating System CompanyName : Microsoft Corporation FileDescription : Generic Host Process for Win32 Services InternalName : svchost.exe LegalCopyright : © Microsoft Corporation. All rights reserved. OriginalFilename : svchost.exe #:8 [svchost.exe] FilePath : C:\WINDOWS\system32\ ProcessID : 880 ThreadCreationTime : 2006-12-11 12:59:14 BasePriority : Normal FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) ProductVersion : 5.1.2600.2180 ProductName : Microsoft® Windows® Operating System CompanyName : Microsoft Corporation FileDescription : Generic Host Process for Win32 Services InternalName : svchost.exe LegalCopyright : © Microsoft Corporation. All rights reserved. OriginalFilename : svchost.exe #:9 [svchost.exe] FilePath : C:\WINDOWS\System32\ ProcessID : 908 ThreadCreationTime : 2006-12-11 12:59:15 BasePriority : Normal FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) ProductVersion : 5.1.2600.2180 ProductName : Microsoft® Windows® Operating System CompanyName : Microsoft Corporation FileDescription : Generic Host Process for Win32 Services InternalName : svchost.exe LegalCopyright : © Microsoft Corporation. All rights reserved. OriginalFilename : svchost.exe #:10 [svchost.exe] FilePath : C:\WINDOWS\System32\ ProcessID : 976 ThreadCreationTime : 2006-12-11 12:59:15 BasePriority : Normal FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) ProductVersion : 5.1.2600.2180 ProductName : Microsoft® Windows® Operating System CompanyName : Microsoft Corporation FileDescription : Generic Host Process for Win32 Services InternalName : svchost.exe LegalCopyright : © Microsoft Corporation. All rights reserved. OriginalFilename : svchost.exe #:11 [svchost.exe] FilePath : C:\WINDOWS\System32\ ProcessID : 1080 ThreadCreationTime : 2006-12-11 12:59:15 BasePriority : Normal FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) ProductVersion : 5.1.2600.2180 ProductName : Microsoft® Windows® Operating System CompanyName : Microsoft Corporation FileDescription : Generic Host Process for Win32 Services InternalName : svchost.exe LegalCopyright : © Microsoft Corporation. All rights reserved. OriginalFilename : svchost.exe #:12 [vsmon.exe] FilePath : C:\WINDOWS\system32\ZoneLabs\ ProcessID : 1152 ThreadCreationTime : 2006-12-11 12:59:16 BasePriority : Normal FileVersion : 6.5.737.000 ProductVersion : 6.5.737.000 ProductName : TrueVector Service CompanyName : Zone Labs, LLC FileDescription : TrueVector Service InternalName : vsmon LegalCopyright : Copyright © 1998-2006, Zone Labs, LLC OriginalFilename : vsmon.exe #:13 [ati2evxx.exe] FilePath : C:\WINDOWS\system32\ ProcessID : 1288 ThreadCreationTime : 2006-12-11 12:59:17 BasePriority : Normal FileVersion : 6.14.10.4132 ProductVersion : 6.14.10.4132 ProductName : ATI External Event Utility for WindowsNT and Windows9X CompanyName : ATI Technologies Inc. FileDescription : ATI External Event Utility EXE Module InternalName : ATI2EVXX.EXE LegalCopyright : Copyright © 1999-2004 ATI Technologies Inc. OriginalFilename : ATI2EVXX.EXE #:14 [explorer.exe] FilePath : C:\WINDOWS\ ProcessID : 1376 ThreadCreationTime : 2006-12-11 12:59:19 BasePriority : Normal FileVersion : 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158) ProductVersion : 6.00.2900.2180 ProductName : System operacyjny Microsoft® Windows® CompanyName : Microsoft Corporation FileDescription : Eksplorator Windows InternalName : explorer LegalCopyright : © Microsoft Corporation. Wszelkie prawa zastrzeżone. OriginalFilename : EXPLORER.EXE #:15 [spoolsv.exe] FilePath : C:\WINDOWS\system32\ ProcessID : 1576 ThreadCreationTime : 2006-12-11 12:59:20 BasePriority : Normal FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) ProductVersion : 5.1.2600.2180 ProductName : Microsoft® Windows® Operating System CompanyName : Microsoft Corporation FileDescription : Spooler SubSystem App InternalName : spoolsv.exe LegalCopyright : © Microsoft Corporation. All rights reserved. OriginalFilename : spoolsv.exe #:16 [soundman.exe] FilePath : C:\WINDOWS\ ProcessID : 1776 ThreadCreationTime : 2006-12-11 12:59:22 BasePriority : Normal FileVersion : 5.1.10 ProductVersion : 5.1.10 ProductName : Realtek Sound Manager CompanyName : Realtek Semiconductor Corp. FileDescription : Realtek Sound Manager InternalName : ALSMTray LegalCopyright : Copyright © 2001-2003 Realtek Semiconductor Corp. OriginalFilename : ALSMTray.exe Comments : Realtek AC97 Audio Sound Manager #:17 [cli.exe] FilePath : C:\Program Files\ATI Technologies\ATI.ACE\ ProcessID : 1788 ThreadCreationTime : 2006-12-11 12:59:22 BasePriority : Normal #:18 [ashdisp.exe] FilePath : C:\PROGRA~1\ALWILS~1\Avast4\ ProcessID : 1796 ThreadCreationTime : 2006-12-11 12:59:22 BasePriority : Normal FileVersion : 5, 0, 0, 0 ProductVersion : 5, 0, 0, 0 ProductName : avast! Antivirus FileDescription : avast! service GUI component InternalName : aswDisp LegalCopyright : Copyright © 2006 ALWIL Software OriginalFilename : aswDisp.exe #:19 [zlclient.exe] FilePath : C:\Program Files\Zone Labs\ZoneAlarm\ ProcessID : 1804 ThreadCreationTime : 2006-12-11 12:59:22 BasePriority : Normal FileVersion : 6.5.737.000 ProductVersion : 6.5.737.000 ProductName : Zone Labs Client CompanyName : Zone Labs, LLC FileDescription : Zone Labs Client InternalName : zlclient LegalCopyright : Copyright © 1998-2006, Zone Labs, LLC OriginalFilename : zlclient.exe #:20 [daemon.exe] FilePath : C:\Program Files\DAEMON Tools\ ProcessID : 1820 ThreadCreationTime : 2006-12-11 12:59:22 BasePriority : Normal #:21 [hpqtra08.exe] FilePath : C:\Program Files\HP\Digital Imaging\bin\ ProcessID : 1884 ThreadCreationTime : 2006-12-11 12:59:23 BasePriority : Normal FileVersion : 53.0.13.000 ProductVersion : 053.000.013.000 ProductName : hp digital imaging - hp all-in-one series CompanyName : Hewlett-Packard Co. FileDescription : HP Digital Imaging Monitor InternalName : HPQTRA00 LegalCopyright : Copyright © Hewlett-Packard Co. 1995-2004 OriginalFilename : HPQTRA00.EXE Comments : HP Digital Imaging Monitor #:22 [aswupdsv.exe] FilePath : C:\Program Files\Alwil Software\Avast4\ ProcessID : 292 ThreadCreationTime : 2006-12-11 12:59:27 BasePriority : Normal #:23 [ashserv.exe] FilePath : C:\Program Files\Alwil Software\Avast4\ ProcessID : 316 ThreadCreationTime : 2006-12-11 12:59:27 BasePriority : High FileVersion : 4, 7, 889, 0 ProductVersion : 4, 7, 0, 0 ProductName : avast! Antivirus FileDescription : avast! antivirus service InternalName : aswServ LegalCopyright : Copyright © 2006 ALWIL Software OriginalFilename : aswServ.exe #:24 [hpqste08.exe] FilePath : C:\Program Files\HP\Digital Imaging\bin\ ProcessID : 364 ThreadCreationTime : 2006-12-11 12:59:32 BasePriority : Normal FileVersion : 53.0.13.000 ProductVersion : 053.000.013.000 ProductName : hp digital imaging - hp all-in-one series CompanyName : Hewlett-Packard Co. FileDescription : HP CUE Status InternalName : HPQSTS00 LegalCopyright : Copyright © Hewlett-Packard Co. 1995-2004 OriginalFilename : HPQSTS00.EXE Comments : HP CUE Status #:25 [svchost.exe] FilePath : C:\WINDOWS\System32\ ProcessID : 1340 ThreadCreationTime : 2006-12-11 12:59:35 BasePriority : Normal FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) ProductVersion : 5.1.2600.2180 ProductName : Microsoft® Windows® Operating System CompanyName : Microsoft Corporation FileDescription : Generic Host Process for Win32 Services InternalName : svchost.exe LegalCopyright : © Microsoft Corporation. All rights reserved. OriginalFilename : svchost.exe #:26 [wdfmgr.exe] FilePath : C:\WINDOWS\system32\ ProcessID : 1640 ThreadCreationTime : 2006-12-11 12:59:37 BasePriority : Normal FileVersion : 5.2.3790.1230 built by: dnsrv(bld4act) ProductVersion : 5.2.3790.1230 ProductName : Microsoft® Windows® Operating System CompanyName : Microsoft Corporation FileDescription : Windows User Mode Driver Manager InternalName : WdfMgr LegalCopyright : © Microsoft Corporation. All rights reserved. OriginalFilename : WdfMgr.exe #:27 [ashwebsv.exe] FilePath : C:\Program Files\Alwil Software\Avast4\ ProcessID : 2264 ThreadCreationTime : 2006-12-11 12:59:42 BasePriority : Normal #:28 [ashmaisv.exe] FilePath : C:\Program Files\Alwil Software\Avast4\ ProcessID : 2300 ThreadCreationTime : 2006-12-11 12:59:42 BasePriority : Normal #:29 [alg.exe] FilePath : C:\WINDOWS\System32\ ProcessID : 2584 ThreadCreationTime : 2006-12-11 12:59:43 BasePriority : Normal FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) ProductVersion : 5.1.2600.2180 ProductName : Microsoft® Windows® Operating System CompanyName : Microsoft Corporation FileDescription : Application Layer Gateway Service InternalName : ALG.exe LegalCopyright : © Microsoft Corporation. All rights reserved. OriginalFilename : ALG.exe #:30 [hprblog.exe] FilePath : C:\Program Files\HP\Digital Imaging\Product Assistant\bin\ ProcessID : 2964 ThreadCreationTime : 2006-12-11 12:59:48 BasePriority : Normal FileVersion : 53.0.13.000 ProductVersion : 053.000.013.000 ProductName : hp digital imaging - hp all-in-one series CompanyName : Hewlett-Packard Co. FileDescription : Hewlett-Packard Product Assistant InternalName : HPRBLOG LegalCopyright : Copyright © Hewlett-Packard Co. 1995-2004 OriginalFilename : HPRBLOG.EXE Comments : Hewlett-Packard Product Assistant #:31 [cli.exe] FilePath : C:\Program Files\ATI Technologies\ATI.ACE\ ProcessID : 3000 ThreadCreationTime : 2006-12-11 12:59:49 BasePriority : Normal #:32 [cli.exe] FilePath : C:\Program Files\ATI Technologies\ATI.ACE\ ProcessID : 3008 ThreadCreationTime : 2006-12-11 12:59:49 BasePriority : Normal #:33 [ad-aware.exe] FilePath : C:\Program Files\Lavasoft\Ad-Aware SE Personal\ ProcessID : 4076 ThreadCreationTime : 2006-12-11 13:12:24 BasePriority : Normal FileVersion : 6.2.0.236 ProductVersion : SE 106 ProductName : Lavasoft Ad-Aware SE CompanyName : Lavasoft Sweden FileDescription : Ad-Aware SE Core application InternalName : Ad-Aware.exe LegalCopyright : Copyright © Lavasoft AB Sweden OriginalFilename : Ad-Aware.exe Comments : All Rights Reserved #:34 [ashavast.exe] FilePath : C:\Program Files\Alwil Software\Avast4\ ProcessID : 1624 ThreadCreationTime : 2006-12-11 13:12:34 BasePriority : Normal FileVersion : 4, 7, 879, 0 ProductVersion : 4, 7, 0, 0 ProductName : avast! Antivirus CompanyName : ALWIL Software FileDescription : Splash screen for Avast! InternalName : aswAvast.exe LegalCopyright : Copyright © 2006 ALWIL Software OriginalFilename : aswAvast.exe Memory scan result: »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» New critical objects: 0 Objects found so far: 3 Started registry scan »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» Win32.TrojanDownloader.Small Object Recognized! Type : Regkey Data : TAC Rating : 7 Category : Malware Comment : Rootkey : HKEY_CLASSES_ROOT Object : interface{2e4bb6be-a75f-4dc0-9500-68203655a2c4} Registry Scan result: »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» New critical objects: 1 Objects found so far: 4 Started deep registry scan »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» 14:13:33 Scan stopped by user Summary Of This Scan »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» Total scanning time:00:00:52.16 Objects scanned:74659 Objects identified:1 Objects ignored:0 New critical objects:1

Bieniol · 11 Grudzień 2006 13:32

Otwórz notatnik i wklej w nim to:

Plik -> zapisz jako -> zmień rozszerzenie na wszystkie pliki -> zapisz pod nazwą FIX.REG

Odpal plik FIX.REG i potwierdź dodanie do rejestru i reset kompa

Przeskanuj jeszcze raz Ad_aware

michalj82 · 11 Grudzień 2006 13:42

Czy ten wpis w notatniku usunie ten syf ?

adam9870 · 11 Grudzień 2006 13:43

FIX podany przez Bieniola spowoduje usunięcie jednego klucza, który jest odpowiedzialny za ten syf.

Po zastosowaniu powinno być ok.

michalj82 · 11 Grudzień 2006 13:47

Niestety ten syf jest dalej obecny.

adam9870 · 11 Grudzień 2006 13:53

Użyj Windows Worms Doors Cleanera zmień znaczki z disable na enable (wszystkie znaczki maja być na zielono, jeżeli któryś z nich będzie na żółto to go zostaw). Po użyciu narzędzia wymagany jest restart.

Zrób skan AVG http://www.ewido.net/en/download/ oraz ad-adware i potem pokaż z nich raporty.

michalj82 · 11 Grudzień 2006 14:05

Windows Worms Door Cleanera używam cały czas. Wszedłem przed chwilą w tryb awaryjny i przy próbie usunięcia tego klucza pokazało się okienko, że wystąpił problem przy próbie usunięcia klucza, ale usunął to co było w kolumnie Dane i zrobiłem też to samo z kluczem w HKEY_CURRENT_USER i teraz znowu jest to samo w kolumnie Dane ale Ad-Aware nie wykrył tego jak włączyłem teraz skanowanie.

adam9870 · 11 Grudzień 2006 14:07

Proszę przeskanować i wrzucić raporty, o które prosiłem.

michalj82 · 11 Grudzień 2006 14:22

Oto raport z Ad-Aware:

Ad-Aware SE Build 1.06r1 Logfile Created on:11 grudnia 2006 15:00:21 Created with Ad-Aware SE Personal, free for private use. Using definitions file:SE1R138 11.12.2006 »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» References detected during the scan: »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» MRU List(TAC index:0):6 total references »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» Ad-Aware SE Settings =========================== Set : Search for negligible risk entries Set : Search for low-risk threats Set : Safe mode (always request confirmation) Set : Scan active processes Set : Scan registry Set : Deep-scan registry Set : Scan my IE Favorites for banned URLs Set : Scan my Hosts file Extended Ad-Aware SE Settings =========================== Set : Unload recognized processes & modules during scan Set : Scan registry for all users instead of current user only Set : Always try to unload modules before deletion Set : During removal, unload Explorer and IE if necessary Set : Let Windows remove files in use at next reboot Set : Delete quarantined objects after restoring Set : Include basic Ad-Aware settings in log file Set : Include additional Ad-Aware settings in log file Set : Include reference summary in log file Set : Include alternate data stream details in log file Set : Play sound at scan completion if scan locates critical objects 2006-12-11 15:00:21 - Scan started. (Full System Scan) MRU List Object Recognized! Location: : C:\Documents and Settings\Sławek\recent Description : list of recently opened documents MRU List Object Recognized! Location: : S-1-5-21-2052111302-329068152-839522115-1003\software\microsoft\windows\currentversion\applets\regedit Description : last key accessed using the microsoft registry editor MRU List Object Recognized! Location: : S-1-5-21-2052111302-329068152-839522115-1003\software\microsoft\windows\currentversion\explorer\comdlg32\lastvisitedmru Description : list of recent programs opened MRU List Object Recognized! Location: : S-1-5-21-2052111302-329068152-839522115-1003\software\microsoft\windows\currentversion\explorer\comdlg32\opensavemru Description : list of recently saved files, stored according to file extension MRU List Object Recognized! Location: : S-1-5-21-2052111302-329068152-839522115-1003\software\microsoft\windows\currentversion\explorer\recentdocs Description : list of recent documents opened MRU List Object Recognized! Location: : S-1-5-21-2052111302-329068152-839522115-1003\software\microsoft\windows\currentversion\explorer\runmru Description : mru list for items opened in start | run Listing running processes »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» #:1 [smss.exe] FilePath : \SystemRoot\System32\ ProcessID : 512 ThreadCreationTime : 2006-12-11 13:57:49 BasePriority : Normal #:2 [csrss.exe] FilePath : ??\C:\WINDOWS\system32\ ProcessID : 568 ThreadCreationTime : 2006-12-11 13:57:51 BasePriority : Normal #:3 [winlogon.exe] FilePath : ??\C:\WINDOWS\system32\ ProcessID : 596 ThreadCreationTime : 2006-12-11 13:57:53 BasePriority : High #:4 [services.exe] FilePath : C:\WINDOWS\system32\ ProcessID : 640 ThreadCreationTime : 2006-12-11 13:57:53 BasePriority : Normal FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) ProductVersion : 5.1.2600.2180 ProductName : System operacyjny Microsoft® Windows® CompanyName : Microsoft Corporation FileDescription : Usługi i aplikacja Kontroler InternalName : services.exe LegalCopyright : © Microsoft Corporation. Wszelkie prawa zastrzeżone. OriginalFilename : services.exe #:5 [lsass.exe] FilePath : C:\WINDOWS\system32\ ProcessID : 652 ThreadCreationTime : 2006-12-11 13:57:53 BasePriority : Normal FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) ProductVersion : 5.1.2600.2180 ProductName : Microsoft® Windows® Operating System CompanyName : Microsoft Corporation FileDescription : LSA Shell (Export Version) InternalName : lsass.exe LegalCopyright : © Microsoft Corporation. All rights reserved. OriginalFilename : lsass.exe #:6 [ati2evxx.exe] FilePath : C:\WINDOWS\System32\ ProcessID : 800 ThreadCreationTime : 2006-12-11 13:57:54 BasePriority : Normal FileVersion : 6.14.10.4132 ProductVersion : 6.14.10.4132 ProductName : ATI External Event Utility for WindowsNT and Windows9X CompanyName : ATI Technologies Inc. FileDescription : ATI External Event Utility EXE Module InternalName : ATI2EVXX.EXE LegalCopyright : Copyright © 1999-2004 ATI Technologies Inc. OriginalFilename : ATI2EVXX.EXE #:7 [svchost.exe] FilePath : C:\WINDOWS\system32\ ProcessID : 812 ThreadCreationTime : 2006-12-11 13:57:54 BasePriority : Normal FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) ProductVersion : 5.1.2600.2180 ProductName : Microsoft® Windows® Operating System CompanyName : Microsoft Corporation FileDescription : Generic Host Process for Win32 Services InternalName : svchost.exe LegalCopyright : © Microsoft Corporation. All rights reserved. OriginalFilename : svchost.exe #:8 [svchost.exe] FilePath : C:\WINDOWS\system32\ ProcessID : 876 ThreadCreationTime : 2006-12-11 13:57:54 BasePriority : Normal FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) ProductVersion : 5.1.2600.2180 ProductName : Microsoft® Windows® Operating System CompanyName : Microsoft Corporation FileDescription : Generic Host Process for Win32 Services InternalName : svchost.exe LegalCopyright : © Microsoft Corporation. All rights reserved. OriginalFilename : svchost.exe #:9 [svchost.exe] FilePath : C:\WINDOWS\System32\ ProcessID : 904 ThreadCreationTime : 2006-12-11 13:57:54 BasePriority : Normal FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) ProductVersion : 5.1.2600.2180 ProductName : Microsoft® Windows® Operating System CompanyName : Microsoft Corporation FileDescription : Generic Host Process for Win32 Services InternalName : svchost.exe LegalCopyright : © Microsoft Corporation. All rights reserved. OriginalFilename : svchost.exe #:10 [svchost.exe] FilePath : C:\WINDOWS\System32\ ProcessID : 964 ThreadCreationTime : 2006-12-11 13:57:54 BasePriority : Normal FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) ProductVersion : 5.1.2600.2180 ProductName : Microsoft® Windows® Operating System CompanyName : Microsoft Corporation FileDescription : Generic Host Process for Win32 Services InternalName : svchost.exe LegalCopyright : © Microsoft Corporation. All rights reserved. OriginalFilename : svchost.exe #:11 [svchost.exe] FilePath : C:\WINDOWS\System32\ ProcessID : 1020 ThreadCreationTime : 2006-12-11 13:57:55 BasePriority : Normal FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) ProductVersion : 5.1.2600.2180 ProductName : Microsoft® Windows® Operating System CompanyName : Microsoft Corporation FileDescription : Generic Host Process for Win32 Services InternalName : svchost.exe LegalCopyright : © Microsoft Corporation. All rights reserved. OriginalFilename : svchost.exe #:12 [vsmon.exe] FilePath : C:\WINDOWS\system32\ZoneLabs\ ProcessID : 1108 ThreadCreationTime : 2006-12-11 13:57:55 BasePriority : Normal FileVersion : 6.5.737.000 ProductVersion : 6.5.737.000 ProductName : TrueVector Service CompanyName : Zone Labs, LLC FileDescription : TrueVector Service InternalName : vsmon LegalCopyright : Copyright © 1998-2006, Zone Labs, LLC OriginalFilename : vsmon.exe #:13 [ati2evxx.exe] FilePath : C:\WINDOWS\system32\ ProcessID : 1332 ThreadCreationTime : 2006-12-11 13:57:59 BasePriority : Normal FileVersion : 6.14.10.4132 ProductVersion : 6.14.10.4132 ProductName : ATI External Event Utility for WindowsNT and Windows9X CompanyName : ATI Technologies Inc. FileDescription : ATI External Event Utility EXE Module InternalName : ATI2EVXX.EXE LegalCopyright : Copyright © 1999-2004 ATI Technologies Inc. OriginalFilename : ATI2EVXX.EXE #:14 [explorer.exe] FilePath : C:\WINDOWS\ ProcessID : 1424 ThreadCreationTime : 2006-12-11 13:57:59 BasePriority : Normal FileVersion : 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158) ProductVersion : 6.00.2900.2180 ProductName : System operacyjny Microsoft® Windows® CompanyName : Microsoft Corporation FileDescription : Eksplorator Windows InternalName : explorer LegalCopyright : © Microsoft Corporation. Wszelkie prawa zastrzeżone. OriginalFilename : EXPLORER.EXE #:15 [spoolsv.exe] FilePath : C:\WINDOWS\system32\ ProcessID : 1572 ThreadCreationTime : 2006-12-11 13:57:59 BasePriority : Normal FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) ProductVersion : 5.1.2600.2180 ProductName : Microsoft® Windows® Operating System CompanyName : Microsoft Corporation FileDescription : Spooler SubSystem App InternalName : spoolsv.exe LegalCopyright : © Microsoft Corporation. All rights reserved. OriginalFilename : spoolsv.exe #:16 [soundman.exe] FilePath : C:\WINDOWS\ ProcessID : 1792 ThreadCreationTime : 2006-12-11 13:58:02 BasePriority : Normal FileVersion : 5.1.10 ProductVersion : 5.1.10 ProductName : Realtek Sound Manager CompanyName : Realtek Semiconductor Corp. FileDescription : Realtek Sound Manager InternalName : ALSMTray LegalCopyright : Copyright © 2001-2003 Realtek Semiconductor Corp. OriginalFilename : ALSMTray.exe Comments : Realtek AC97 Audio Sound Manager #:17 [cli.exe] FilePath : C:\Program Files\ATI Technologies\ATI.ACE\ ProcessID : 1800 ThreadCreationTime : 2006-12-11 13:58:02 BasePriority : Normal #:18 [ashdisp.exe] FilePath : C:\PROGRA~1\ALWILS~1\Avast4\ ProcessID : 1820 ThreadCreationTime : 2006-12-11 13:58:02 BasePriority : Normal FileVersion : 5, 0, 0, 0 ProductVersion : 5, 0, 0, 0 ProductName : avast! Antivirus FileDescription : avast! service GUI component InternalName : aswDisp LegalCopyright : Copyright © 2006 ALWIL Software OriginalFilename : aswDisp.exe #:19 [zlclient.exe] FilePath : C:\Program Files\Zone Labs\ZoneAlarm\ ProcessID : 1832 ThreadCreationTime : 2006-12-11 13:58:02 BasePriority : Normal FileVersion : 6.5.737.000 ProductVersion : 6.5.737.000 ProductName : Zone Labs Client CompanyName : Zone Labs, LLC FileDescription : Zone Labs Client InternalName : zlclient LegalCopyright : Copyright © 1998-2006, Zone Labs, LLC OriginalFilename : zlclient.exe #:20 [daemon.exe] FilePath : C:\Program Files\DAEMON Tools\ ProcessID : 1856 ThreadCreationTime : 2006-12-11 13:58:02 BasePriority : Normal #:21 [hpqtra08.exe] FilePath : C:\Program Files\HP\Digital Imaging\bin\ ProcessID : 1876 ThreadCreationTime : 2006-12-11 13:58:02 BasePriority : Normal FileVersion : 53.0.13.000 ProductVersion : 053.000.013.000 ProductName : hp digital imaging - hp all-in-one series CompanyName : Hewlett-Packard Co. FileDescription : HP Digital Imaging Monitor InternalName : HPQTRA00 LegalCopyright : Copyright © Hewlett-Packard Co. 1995-2004 OriginalFilename : HPQTRA00.EXE Comments : HP Digital Imaging Monitor #:22 [hpqste08.exe] FilePath : C:\Program Files\HP\Digital Imaging\bin\ ProcessID : 424 ThreadCreationTime : 2006-12-11 13:58:10 BasePriority : Normal FileVersion : 53.0.13.000 ProductVersion : 053.000.013.000 ProductName : hp digital imaging - hp all-in-one series CompanyName : Hewlett-Packard Co. FileDescription : HP CUE Status InternalName : HPQSTS00 LegalCopyright : Copyright © Hewlett-Packard Co. 1995-2004 OriginalFilename : HPQSTS00.EXE Comments : HP CUE Status #:23 [aswupdsv.exe] FilePath : C:\Program Files\Alwil Software\Avast4\ ProcessID : 1760 ThreadCreationTime : 2006-12-11 13:58:30 BasePriority : Normal #:24 [ashserv.exe] FilePath : C:\Program Files\Alwil Software\Avast4\ ProcessID : 1152 ThreadCreationTime : 2006-12-11 13:58:30 BasePriority : High FileVersion : 4, 7, 889, 0 ProductVersion : 4, 7, 0, 0 ProductName : avast! Antivirus FileDescription : avast! antivirus service InternalName : aswServ LegalCopyright : Copyright © 2006 ALWIL Software OriginalFilename : aswServ.exe #:25 [svchost.exe] FilePath : C:\WINDOWS\System32\ ProcessID : 312 ThreadCreationTime : 2006-12-11 13:58:32 BasePriority : Normal FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) ProductVersion : 5.1.2600.2180 ProductName : Microsoft® Windows® Operating System CompanyName : Microsoft Corporation FileDescription : Generic Host Process for Win32 Services InternalName : svchost.exe LegalCopyright : © Microsoft Corporation. All rights reserved. OriginalFilename : svchost.exe #:26 [wdfmgr.exe] FilePath : C:\WINDOWS\system32\ ProcessID : 452 ThreadCreationTime : 2006-12-11 13:58:33 BasePriority : Normal FileVersion : 5.2.3790.1230 built by: dnsrv(bld4act) ProductVersion : 5.2.3790.1230 ProductName : Microsoft® Windows® Operating System CompanyName : Microsoft Corporation FileDescription : Windows User Mode Driver Manager InternalName : WdfMgr LegalCopyright : © Microsoft Corporation. All rights reserved. OriginalFilename : WdfMgr.exe #:27 [wmiprvse.exe] FilePath : C:\WINDOWS\System32\wbem\ ProcessID : 2288 ThreadCreationTime : 2006-12-11 13:58:37 BasePriority : Normal FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) ProductVersion : 5.1.2600.2180 ProductName : Microsoft® Windows® Operating System CompanyName : Microsoft Corporation FileDescription : WMI InternalName : Wmiprvse.exe LegalCopyright : © Microsoft Corporation. All rights reserved. OriginalFilename : Wmiprvse.exe #:28 [wmiprvse.exe] FilePath : C:\WINDOWS\System32\wbem\ ProcessID : 2360 ThreadCreationTime : 2006-12-11 13:58:39 BasePriority : Normal FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) ProductVersion : 5.1.2600.2180 ProductName : Microsoft® Windows® Operating System CompanyName : Microsoft Corporation FileDescription : WMI InternalName : Wmiprvse.exe LegalCopyright : © Microsoft Corporation. All rights reserved. OriginalFilename : Wmiprvse.exe #:29 [ashmaisv.exe] FilePath : C:\Program Files\Alwil Software\Avast4\ ProcessID : 2388 ThreadCreationTime : 2006-12-11 13:58:39 BasePriority : Normal #:30 [ashwebsv.exe] FilePath : C:\Program Files\Alwil Software\Avast4\ ProcessID : 2448 ThreadCreationTime : 2006-12-11 13:58:39 BasePriority : Normal #:31 [alg.exe] FilePath : C:\WINDOWS\System32\ ProcessID : 2600 ThreadCreationTime : 2006-12-11 13:58:40 BasePriority : Normal FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) ProductVersion : 5.1.2600.2180 ProductName : Microsoft® Windows® Operating System CompanyName : Microsoft Corporation FileDescription : Application Layer Gateway Service InternalName : ALG.exe LegalCopyright : © Microsoft Corporation. All rights reserved. OriginalFilename : ALG.exe #:32 [hprblog.exe] FilePath : C:\Program Files\HP\Digital Imaging\Product Assistant\bin\ ProcessID : 3036 ThreadCreationTime : 2006-12-11 13:58:45 BasePriority : Normal FileVersion : 53.0.13.000 ProductVersion : 053.000.013.000 ProductName : hp digital imaging - hp all-in-one series CompanyName : Hewlett-Packard Co. FileDescription : Hewlett-Packard Product Assistant InternalName : HPRBLOG LegalCopyright : Copyright © Hewlett-Packard Co. 1995-2004 OriginalFilename : HPRBLOG.EXE Comments : Hewlett-Packard Product Assistant #:33 [cli.exe] FilePath : C:\Program Files\ATI Technologies\ATI.ACE\ ProcessID : 3044 ThreadCreationTime : 2006-12-11 13:58:45 BasePriority : Normal #:34 [cli.exe] FilePath : C:\Program Files\ATI Technologies\ATI.ACE\ ProcessID : 3060 ThreadCreationTime : 2006-12-11 13:58:45 BasePriority : Normal #:35 [ad-aware.exe] FilePath : C:\Program Files\Lavasoft\Ad-Aware SE Personal\ ProcessID : 3336 ThreadCreationTime : 2006-12-11 13:59:02 BasePriority : Normal FileVersion : 6.2.0.236 ProductVersion : SE 106 ProductName : Lavasoft Ad-Aware SE CompanyName : Lavasoft Sweden FileDescription : Ad-Aware SE Core application InternalName : Ad-Aware.exe LegalCopyright : Copyright © Lavasoft AB Sweden OriginalFilename : Ad-Aware.exe Comments : All Rights Reserved #:36 [wuauclt.exe] FilePath : C:\WINDOWS\system32\ ProcessID : 3492 ThreadCreationTime : 2006-12-11 13:59:19 BasePriority : Normal FileVersion : 5.4.3790.2180 (xpsp_sp2_rtm.040803-2158) ProductVersion : 5.4.3790.2180 ProductName : System operacyjny Microsoft® Windows® CompanyName : Microsoft Corporation FileDescription : Aktualizacje automatyczne InternalName : wuauclt.exe LegalCopyright : © Microsoft Corporation. Wszelkie prawa zastrzeżone. OriginalFilename : wuauclt.exe #:37 [avast.setup] FilePath : C:\Program Files\Alwil Software\Avast4\setup\ ProcessID : 3568 ThreadCreationTime : 2006-12-11 13:59:33 BasePriority : Below Normal Memory scan result: »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» New critical objects: 0 Objects found so far: 6 Started registry scan »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» Registry Scan result: »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» New critical objects: 0 Objects found so far: 6 Started deep registry scan »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» Deep registry scan result: »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» New critical objects: 0 Objects found so far: 6 Started Tracking Cookie scan »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» Tracking cookie scan result: »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» New critical objects: 0 Objects found so far: 6 Deep scanning and examining files (C:) »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» Disk Scan Result for C:\ »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» New critical objects: 0 Objects found so far: 6 Deep scanning and examining files (D:) »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» Disk Scan Result for D:\ »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» New critical objects: 0 Objects found so far: 6 Deep scanning and examining files (E:) »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» Disk Scan Result for E:\ »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» New critical objects: 0 Objects found so far: 6 Deep scanning and examining files (F:) »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» Disk Scan Result for F:\ »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» New critical objects: 0 Objects found so far: 6 Scanning Hosts file… Hosts file location:“C:\WINDOWS\system32\drivers\etc\hosts”. »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» Hosts file scan result: »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» 1 entries scanned. New critical objects:0 Objects found so far: 6 Performing conditional scans… »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» Conditional scan result: »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» New critical objects: 0 Objects found so far: 6 15:20:50 Scan Complete Summary Of This Scan »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» Total scanning time:00:20:29.656 Objects scanned:220294 Objects identified:0 Objects ignored:0 New critical objects:0 Za chwilę dam raport z AVG Antispyware. Złączono Posta: 11.12.2006 (Pon) 15:23 Oto raport z Ad-Aware: Ad-Aware SE Build 1.06r1 Logfile Created on:11 grudnia 2006 15:00:21 Created with Ad-Aware SE Personal, free for private use. Using definitions file:SE1R138 11.12.2006 »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» References detected during the scan: »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» MRU List(TAC index:0):6 total references »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» Ad-Aware SE Settings =========================== Set : Search for negligible risk entries Set : Search for low-risk threats Set : Safe mode (always request confirmation) Set : Scan active processes Set : Scan registry Set : Deep-scan registry Set : Scan my IE Favorites for banned URLs Set : Scan my Hosts file Extended Ad-Aware SE Settings =========================== Set : Unload recognized processes & modules during scan Set : Scan registry for all users instead of current user only Set : Always try to unload modules before deletion Set : During removal, unload Explorer and IE if necessary Set : Let Windows remove files in use at next reboot Set : Delete quarantined objects after restoring Set : Include basic Ad-Aware settings in log file Set : Include additional Ad-Aware settings in log file Set : Include reference summary in log file Set : Include alternate data stream details in log file Set : Play sound at scan completion if scan locates critical objects 2006-12-11 15:00:21 - Scan started. (Full System Scan) MRU List Object Recognized! Location: : C:\Documents and Settings\Sławek\recent Description : list of recently opened documents MRU List Object Recognized! Location: : S-1-5-21-2052111302-329068152-839522115-1003\software\microsoft\windows\currentversion\applets\regedit Description : last key accessed using the microsoft registry editor MRU List Object Recognized! Location: : S-1-5-21-2052111302-329068152-839522115-1003\software\microsoft\windows\currentversion\explorer\comdlg32\lastvisitedmru Description : list of recent programs opened MRU List Object Recognized! Location: : S-1-5-21-2052111302-329068152-839522115-1003\software\microsoft\windows\currentversion\explorer\comdlg32\opensavemru Description : list of recently saved files, stored according to file extension MRU List Object Recognized! Location: : S-1-5-21-2052111302-329068152-839522115-1003\software\microsoft\windows\currentversion\explorer\recentdocs Description : list of recent documents opened MRU List Object Recognized! Location: : S-1-5-21-2052111302-329068152-839522115-1003\software\microsoft\windows\currentversion\explorer\runmru Description : mru list for items opened in start | run Listing running processes »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» #:1 [smss.exe] FilePath : \SystemRoot\System32\ ProcessID : 512 ThreadCreationTime : 2006-12-11 13:57:49 BasePriority : Normal #:2 [csrss.exe] FilePath : ??\C:\WINDOWS\system32\ ProcessID : 568 ThreadCreationTime : 2006-12-11 13:57:51 BasePriority : Normal #:3 [winlogon.exe] FilePath : ??\C:\WINDOWS\system32\ ProcessID : 596 ThreadCreationTime : 2006-12-11 13:57:53 BasePriority : High #:4 [services.exe] FilePath : C:\WINDOWS\system32\ ProcessID : 640 ThreadCreationTime : 2006-12-11 13:57:53 BasePriority : Normal FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) ProductVersion : 5.1.2600.2180 ProductName : System operacyjny Microsoft® Windows® CompanyName : Microsoft Corporation FileDescription : Usługi i aplikacja Kontroler InternalName : services.exe LegalCopyright : © Microsoft Corporation. Wszelkie prawa zastrzeżone. OriginalFilename : services.exe #:5 [lsass.exe] FilePath : C:\WINDOWS\system32\ ProcessID : 652 ThreadCreationTime : 2006-12-11 13:57:53 BasePriority : Normal FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) ProductVersion : 5.1.2600.2180 ProductName : Microsoft® Windows® Operating System CompanyName : Microsoft Corporation FileDescription : LSA Shell (Export Version) InternalName : lsass.exe LegalCopyright : © Microsoft Corporation. All rights reserved. OriginalFilename : lsass.exe #:6 [ati2evxx.exe] FilePath : C:\WINDOWS\System32\ ProcessID : 800 ThreadCreationTime : 2006-12-11 13:57:54 BasePriority : Normal FileVersion : 6.14.10.4132 ProductVersion : 6.14.10.4132 ProductName : ATI External Event Utility for WindowsNT and Windows9X CompanyName : ATI Technologies Inc. FileDescription : ATI External Event Utility EXE Module InternalName : ATI2EVXX.EXE LegalCopyright : Copyright © 1999-2004 ATI Technologies Inc. OriginalFilename : ATI2EVXX.EXE #:7 [svchost.exe] FilePath : C:\WINDOWS\system32\ ProcessID : 812 ThreadCreationTime : 2006-12-11 13:57:54 BasePriority : Normal FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) ProductVersion : 5.1.2600.2180 ProductName : Microsoft® Windows® Operating System CompanyName : Microsoft Corporation FileDescription : Generic Host Process for Win32 Services InternalName : svchost.exe LegalCopyright : © Microsoft Corporation. All rights reserved. OriginalFilename : svchost.exe #:8 [svchost.exe] FilePath : C:\WINDOWS\system32\ ProcessID : 876 ThreadCreationTime : 2006-12-11 13:57:54 BasePriority : Normal FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) ProductVersion : 5.1.2600.2180 ProductName : Microsoft® Windows® Operating System CompanyName : Microsoft Corporation FileDescription : Generic Host Process for Win32 Services InternalName : svchost.exe LegalCopyright : © Microsoft Corporation. All rights reserved. OriginalFilename : svchost.exe #:9 [svchost.exe] FilePath : C:\WINDOWS\System32\ ProcessID : 904 ThreadCreationTime : 2006-12-11 13:57:54 BasePriority : Normal FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) ProductVersion : 5.1.2600.2180 ProductName : Microsoft® Windows® Operating System CompanyName : Microsoft Corporation FileDescription : Generic Host Process for Win32 Services InternalName : svchost.exe LegalCopyright : © Microsoft Corporation. All rights reserved. OriginalFilename : svchost.exe #:10 [svchost.exe] FilePath : C:\WINDOWS\System32\ ProcessID : 964 ThreadCreationTime : 2006-12-11 13:57:54 BasePriority : Normal FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) ProductVersion : 5.1.2600.2180 ProductName : Microsoft® Windows® Operating System CompanyName : Microsoft Corporation FileDescription : Generic Host Process for Win32 Services InternalName : svchost.exe LegalCopyright : © Microsoft Corporation. All rights reserved. OriginalFilename : svchost.exe #:11 [svchost.exe] FilePath : C:\WINDOWS\System32\ ProcessID : 1020 ThreadCreationTime : 2006-12-11 13:57:55 BasePriority : Normal FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) ProductVersion : 5.1.2600.2180 ProductName : Microsoft® Windows® Operating System CompanyName : Microsoft Corporation FileDescription : Generic Host Process for Win32 Services InternalName : svchost.exe LegalCopyright : © Microsoft Corporation. All rights reserved. OriginalFilename : svchost.exe #:12 [vsmon.exe] FilePath : C:\WINDOWS\system32\ZoneLabs\ ProcessID : 1108 ThreadCreationTime : 2006-12-11 13:57:55 BasePriority : Normal FileVersion : 6.5.737.000 ProductVersion : 6.5.737.000 ProductName : TrueVector Service CompanyName : Zone Labs, LLC FileDescription : TrueVector Service InternalName : vsmon LegalCopyright : Copyright © 1998-2006, Zone Labs, LLC OriginalFilename : vsmon.exe #:13 [ati2evxx.exe] FilePath : C:\WINDOWS\system32\ ProcessID : 1332 ThreadCreationTime : 2006-12-11 13:57:59 BasePriority : Normal FileVersion : 6.14.10.4132 ProductVersion : 6.14.10.4132 ProductName : ATI External Event Utility for WindowsNT and Windows9X CompanyName : ATI Technologies Inc. FileDescription : ATI External Event Utility EXE Module InternalName : ATI2EVXX.EXE LegalCopyright : Copyright © 1999-2004 ATI Technologies Inc. OriginalFilename : ATI2EVXX.EXE #:14 [explorer.exe] FilePath : C:\WINDOWS\ ProcessID : 1424 ThreadCreationTime : 2006-12-11 13:57:59 BasePriority : Normal FileVersion : 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158) ProductVersion : 6.00.2900.2180 ProductName : System operacyjny Microsoft® Windows® CompanyName : Microsoft Corporation FileDescription : Eksplorator Windows InternalName : explorer LegalCopyright : © Microsoft Corporation. Wszelkie prawa zastrzeżone. OriginalFilename : EXPLORER.EXE #:15 [spoolsv.exe] FilePath : C:\WINDOWS\system32\ ProcessID : 1572 ThreadCreationTime : 2006-12-11 13:57:59 BasePriority : Normal FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) ProductVersion : 5.1.2600.2180 ProductName : Microsoft® Windows® Operating System CompanyName : Microsoft Corporation FileDescription : Spooler SubSystem App InternalName : spoolsv.exe LegalCopyright : © Microsoft Corporation. All rights reserved. OriginalFilename : spoolsv.exe #:16 [soundman.exe] FilePath : C:\WINDOWS\ ProcessID : 1792 ThreadCreationTime : 2006-12-11 13:58:02 BasePriority : Normal FileVersion : 5.1.10 ProductVersion : 5.1.10 ProductName : Realtek Sound Manager CompanyName : Realtek Semiconductor Corp. FileDescription : Realtek Sound Manager InternalName : ALSMTray LegalCopyright : Copyright © 2001-2003 Realtek Semiconductor Corp. OriginalFilename : ALSMTray.exe Comments : Realtek AC97 Audio Sound Manager #:17 [cli.exe] FilePath : C:\Program Files\ATI Technologies\ATI.ACE\ ProcessID : 1800 ThreadCreationTime : 2006-12-11 13:58:02 BasePriority : Normal #:18 [ashdisp.exe] FilePath : C:\PROGRA~1\ALWILS~1\Avast4\ ProcessID : 1820 ThreadCreationTime : 2006-12-11 13:58:02 BasePriority : Normal FileVersion : 5, 0, 0, 0 ProductVersion : 5, 0, 0, 0 ProductName : avast! Antivirus FileDescription : avast! service GUI component InternalName : aswDisp LegalCopyright : Copyright © 2006 ALWIL Software OriginalFilename : aswDisp.exe #:19 [zlclient.exe] FilePath : C:\Program Files\Zone Labs\ZoneAlarm\ ProcessID : 1832 ThreadCreationTime : 2006-12-11 13:58:02 BasePriority : Normal FileVersion : 6.5.737.000 ProductVersion : 6.5.737.000 ProductName : Zone Labs Client CompanyName : Zone Labs, LLC FileDescription : Zone Labs Client InternalName : zlclient LegalCopyright : Copyright © 1998-2006, Zone Labs, LLC OriginalFilename : zlclient.exe #:20 [daemon.exe] FilePath : C:\Program Files\DAEMON Tools\ ProcessID : 1856 ThreadCreationTime : 2006-12-11 13:58:02 BasePriority : Normal #:21 [hpqtra08.exe] FilePath : C:\Program Files\HP\Digital Imaging\bin\ ProcessID : 1876 ThreadCreationTime : 2006-12-11 13:58:02 BasePriority : Normal FileVersion : 53.0.13.000 ProductVersion : 053.000.013.000 ProductName : hp digital imaging - hp all-in-one series CompanyName : Hewlett-Packard Co. FileDescription : HP Digital Imaging Monitor InternalName : HPQTRA00 LegalCopyright : Copyright © Hewlett-Packard Co. 1995-2004 OriginalFilename : HPQTRA00.EXE Comments : HP Digital Imaging Monitor #:22 [hpqste08.exe] FilePath : C:\Program Files\HP\Digital Imaging\bin\ ProcessID : 424 ThreadCreationTime : 2006-12-11 13:58:10 BasePriority : Normal FileVersion : 53.0.13.000 ProductVersion : 053.000.013.000 ProductName : hp digital imaging - hp all-in-one series CompanyName : Hewlett-Packard Co. FileDescription : HP CUE Status InternalName : HPQSTS00 LegalCopyright : Copyright © Hewlett-Packard Co. 1995-2004 OriginalFilename : HPQSTS00.EXE Comments : HP CUE Status #:23 [aswupdsv.exe] FilePath : C:\Program Files\Alwil Software\Avast4\ ProcessID : 1760 ThreadCreationTime : 2006-12-11 13:58:30 BasePriority : Normal #:24 [ashserv.exe] FilePath : C:\Program Files\Alwil Software\Avast4\ ProcessID : 1152 ThreadCreationTime : 2006-12-11 13:58:30 BasePriority : High FileVersion : 4, 7, 889, 0 ProductVersion : 4, 7, 0, 0 ProductName : avast! Antivirus FileDescription : avast! antivirus service InternalName : aswServ LegalCopyright : Copyright © 2006 ALWIL Software OriginalFilename : aswServ.exe #:25 [svchost.exe] FilePath : C:\WINDOWS\System32\ ProcessID : 312 ThreadCreationTime : 2006-12-11 13:58:32 BasePriority : Normal FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) ProductVersion : 5.1.2600.2180 ProductName : Microsoft® Windows® Operating System CompanyName : Microsoft Corporation FileDescription : Generic Host Process for Win32 Services InternalName : svchost.exe LegalCopyright : © Microsoft Corporation. All rights reserved. OriginalFilename : svchost.exe #:26 [wdfmgr.exe] FilePath : C:\WINDOWS\system32\ ProcessID : 452 ThreadCreationTime : 2006-12-11 13:58:33 BasePriority : Normal FileVersion : 5.2.3790.1230 built by: dnsrv(bld4act) ProductVersion : 5.2.3790.1230 ProductName : Microsoft® Windows® Operating System CompanyName : Microsoft Corporation FileDescription : Windows User Mode Driver Manager InternalName : WdfMgr LegalCopyright : © Microsoft Corporation. All rights reserved. OriginalFilename : WdfMgr.exe #:27 [wmiprvse.exe] FilePath : C:\WINDOWS\System32\wbem\ ProcessID : 2288 ThreadCreationTime : 2006-12-11 13:58:37 BasePriority : Normal FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) ProductVersion : 5.1.2600.2180 ProductName : Microsoft® Windows® Operating System CompanyName : Microsoft Corporation FileDescription : WMI InternalName : Wmiprvse.exe LegalCopyright : © Microsoft Corporation. All rights reserved. OriginalFilename : Wmiprvse.exe #:28 [wmiprvse.exe] FilePath : C:\WINDOWS\System32\wbem\ ProcessID : 2360 ThreadCreationTime : 2006-12-11 13:58:39 BasePriority : Normal FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) ProductVersion : 5.1.2600.2180 ProductName : Microsoft® Windows® Operating System CompanyName : Microsoft Corporation FileDescription : WMI InternalName : Wmiprvse.exe LegalCopyright : © Microsoft Corporation. All rights reserved. OriginalFilename : Wmiprvse.exe #:29 [ashmaisv.exe] FilePath : C:\Program Files\Alwil Software\Avast4\ ProcessID : 2388 ThreadCreationTime : 2006-12-11 13:58:39 BasePriority : Normal #:30 [ashwebsv.exe] FilePath : C:\Program Files\Alwil Software\Avast4\ ProcessID : 2448 ThreadCreationTime : 2006-12-11 13:58:39 BasePriority : Normal #:31 [alg.exe] FilePath : C:\WINDOWS\System32\ ProcessID : 2600 ThreadCreationTime : 2006-12-11 13:58:40 BasePriority : Normal FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) ProductVersion : 5.1.2600.2180 ProductName : Microsoft® Windows® Operating System CompanyName : Microsoft Corporation FileDescription : Application Layer Gateway Service InternalName : ALG.exe LegalCopyright : © Microsoft Corporation. All rights reserved. OriginalFilename : ALG.exe #:32 [hprblog.exe] FilePath : C:\Program Files\HP\Digital Imaging\Product Assistant\bin\ ProcessID : 3036 ThreadCreationTime : 2006-12-11 13:58:45 BasePriority : Normal FileVersion : 53.0.13.000 ProductVersion : 053.000.013.000 ProductName : hp digital imaging - hp all-in-one series CompanyName : Hewlett-Packard Co. FileDescription : Hewlett-Packard Product Assistant InternalName : HPRBLOG LegalCopyright : Copyright © Hewlett-Packard Co. 1995-2004 OriginalFilename : HPRBLOG.EXE Comments : Hewlett-Packard Product Assistant #:33 [cli.exe] FilePath : C:\Program Files\ATI Technologies\ATI.ACE\ ProcessID : 3044 ThreadCreationTime : 2006-12-11 13:58:45 BasePriority : Normal #:34 [cli.exe] FilePath : C:\Program Files\ATI Technologies\ATI.ACE\ ProcessID : 3060 ThreadCreationTime : 2006-12-11 13:58:45 BasePriority : Normal #:35 [ad-aware.exe] FilePath : C:\Program Files\Lavasoft\Ad-Aware SE Personal\ ProcessID : 3336 ThreadCreationTime : 2006-12-11 13:59:02 BasePriority : Normal FileVersion : 6.2.0.236 ProductVersion : SE 106 ProductName : Lavasoft Ad-Aware SE CompanyName : Lavasoft Sweden FileDescription : Ad-Aware SE Core application InternalName : Ad-Aware.exe LegalCopyright : Copyright © Lavasoft AB Sweden OriginalFilename : Ad-Aware.exe Comments : All Rights Reserved #:36 [wuauclt.exe] FilePath : C:\WINDOWS\system32\ ProcessID : 3492 ThreadCreationTime : 2006-12-11 13:59:19 BasePriority : Normal FileVersion : 5.4.3790.2180 (xpsp_sp2_rtm.040803-2158) ProductVersion : 5.4.3790.2180 ProductName : System operacyjny Microsoft® Windows® CompanyName : Microsoft Corporation FileDescription : Aktualizacje automatyczne InternalName : wuauclt.exe LegalCopyright : © Microsoft Corporation. Wszelkie prawa zastrzeżone. OriginalFilename : wuauclt.exe #:37 [avast.setup] FilePath : C:\Program Files\Alwil Software\Avast4\setup\ ProcessID : 3568 ThreadCreationTime : 2006-12-11 13:59:33 BasePriority : Below Normal Memory scan result: »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» New critical objects: 0 Objects found so far: 6 Started registry scan »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» Registry Scan result: »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» New critical objects: 0 Objects found so far: 6 Started deep registry scan »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» Deep registry scan result: »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» New critical objects: 0 Objects found so far: 6 Started Tracking Cookie scan »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» Tracking cookie scan result: »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» New critical objects: 0 Objects found so far: 6 Deep scanning and examining files (C:) »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» Disk Scan Result for C:\ »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» New critical objects: 0 Objects found so far: 6 Deep scanning and examining files (D:) »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» Disk Scan Result for D:\ »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» New critical objects: 0 Objects found so far: 6 Deep scanning and examining files (E:) »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» Disk Scan Result for E:\ »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» New critical objects: 0 Objects found so far: 6 Deep scanning and examining files (F:) »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» Disk Scan Result for F:\ »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» New critical objects: 0 Objects found so far: 6 Scanning Hosts file… Hosts file location:“C:\WINDOWS\system32\drivers\etc\hosts”. »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» Hosts file scan result: »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» 1 entries scanned. New critical objects:0 Objects found so far: 6 Performing conditional scans… »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» Conditional scan result: »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» New critical objects: 0 Objects found so far: 6 15:20:50 Scan Complete Summary Of This Scan »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» Total scanning time:00:20:29.656 Objects scanned:220294 Objects identified:0 Objects ignored:0 New critical objects:0 Za chwilę dam raport z AVG Antispyware. [color=darkblue][size=75]Złączono Posta: 11.12.2006 (Pon) 17:13[/size][/color] Proszę, oto raport z AVG Anti-Spyware --------------------------------------------------------- AVG Anti-Spyware - Scan Report --------------------------------------------------------- + Created at: 17:08:19 2006-12-11 + Scan result: F:\System Volume Information_restore{B3019DCD-69D8-410E-B46C-DA64572149E6}\RP89\A0022985.exe -> Adware.MediaTicket : Ignored. ::Report end Z tego co zauważyłem to jest jeszcze jeden temat o tym syfie, może to fałszywy alarm albo wina definicji bo jak ściągnąłem dzisiejsze definicje to nic nie wykrył.