Programy nagle przestały działać

marios24 · 18 Grudzień 2007 20:55

Jakas infekcja spowodowała błedne działanie programow w moim systemie.Prosze o sprawdzenie logów.

Logfile of HijackThis v1.99.1 Scan saved at 21:30:07, on 2007-12-18 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\System32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Intel\Wireless\Bin\EvtEng.exe C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\Program Files\Eset\nod32krn.exe C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.EXE D:\Rozne\Nokia Pc Suite\Nokia PC Suite 6\LaunchApplication.exe C:\WINDOWS\sm56hlpr.exe C:\WINDOWS\RTHDCPL.EXE C:\Programy\PDVDServ.exe C:\WINDOWS\ATK0100\HControl.exe C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb08.exe C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe C:\Program Files\DAEMON Tools\daemon.exe C:\Program Files\Asus\Asus ChkMail\ChkMail.exe C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHsp.exe C:\Program Files\Toshiba\Bluetooth Toshiba Stack\tosOBEX.exe C:\Program Files\PC Connectivity Solution\ServiceLayer.exe C:\WINDOWS\ATK0100\ATKOSD.exe C:\Program Files\Toshiba\Bluetooth Toshiba Stack\tosBtProc.exe C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqimzone.exe C:\WINDOWS\system32\wuauclt.exe C:\Programy\AutoConnect\AutoConnect.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Documents and Settings\Marios\Pulpit\hijackthis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programy\ActiveX\AcroIEHelper.dll O4 - HKLM…\Run: [TrayServer] C:\Programy\TrayServer.exe O4 - HKLM…\Run: [PCSuiteTrayApplication] D:\Rozne\Nokia Pc Suite\Nokia PC Suite 6\LaunchApplication.exe -startup O4 - HKLM…\Run: [sMSERIAL] sm56hlpr.exe O4 - HKLM…\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM…\Run: [RemoteControl] C:\Programy\PDVDServ.exe O4 - HKLM…\Run: [HControl] C:\WINDOWS\ATK0100\HControl.exe O4 - HKLM…\Run: [HP Software Update] C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe O4 - HKLM…\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb08.exe O4 - HKLM…\Run: [DeviceDiscovery] C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe O4 - HKLM…\Run: [DAEMON Tools] “C:\Program Files\DAEMON Tools\daemon.exe” -lang 1033 O4 - HKLM…\Run: [EOUApp] “C:\Program Files\Intel\Wireless\Bin\EOUWiz.exe” O4 - HKLM…\Run: [Power_Gear] C:\Program Files\ASUS\Power4 Gear\BatteryLife.exe 1 O4 - HKLM…\Run: [nod32kui] “C:\Program Files\Eset\nod32kui.exe” /WAITSERVICE O4 - HKLM…\Run: [ASUS Live Update] C:\Program Files\ASUS\ASUS Live Update\ALU.exe O4 - HKLM…\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM…\Run: [AtiPTA] atiptaxx.exe O4 - HKLM…\Run: [intelWireless] “C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe” /tf Intel PROSet/Wireless O4 - HKCU…\Run: [AutoConnect] C:\Programy\AutoConnect\AutoConnect.exe O4 - HKCU…\Run: [Gadu-Gadu] “C:\Programy\Gadu-Gadu\gg.exe” /tray O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Programy\Reader\reader_sl.exe O4 - Global Startup: ASUS ChkMail.lnk = C:\Program Files\Asus\Asus ChkMail\ChkMail.exe O4 - Global Startup: Bluetooth Manager.lnk = ? O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe O4 - Global Startup: HP Image Zone - szybkie uruchamianie.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqthb08.exe O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Programy\MICROS~1\OFFICE11\REFIEBAR.DLL O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra ‘Tools’ menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O17 - HKLM\System\CCS\Services\Tcpip…{636EF263-1D90-4AD3-BA1E-5DE6C5C413DE}: NameServer = 194.204.159.1 217.98.63.164 O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: Intel® PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe O23 - Service: Firebird Server - MAGIX Instance (FirebirdServerMAGIXInstance) - Unknown owner - C:\Common\Database\bin\fbserver.exe (file missing) O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe O23 - Service: Intel® PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe O23 - Service: Intel® PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe

ComboFix 07-12-18.1 - Marios 2007-12-18 21:45:56.10 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.504 [GMT 1:00] Running from: C:\Documents and Settings\Marios\Pulpit\ComboFix.exe . ((((((((((((((((((((((((( Files Created from 2007-11-18 to 2007-12-18 ))))))))))))))))))))))))))))))) . 2007-12-18 20:55 . 2007-12-18 20:55 335 --a------ C:\WINDOWS\mozregistry.dat 2007-12-18 16:07 . 2007-12-18 16:07 2007-12-18 16:06 . 2007-12-18 16:06 2007-12-18 15:53 . 2007-12-18 15:53 2007-12-18 15:53 . 2007-12-18 15:53 2007-12-18 15:52 . 2007-12-18 15:52 2007-12-18 15:48 . 2004-08-03 22:58 15,104 --a------ C:\WINDOWS\system32\drivers\usbscan.sys 2007-12-18 15:48 . 2004-08-03 22:58 15,104 --a–c— C:\WINDOWS\system32\dllcache\usbscan.sys 2007-12-18 15:47 . 2007-12-18 15:47 2007-12-18 15:46 . 2007-12-18 15:46 2007-12-18 15:45 . 2007-12-18 16:05 77,052 --a------ C:\WINDOWS\hpgins06.dat 2007-12-18 15:45 . 2004-08-03 23:08 31,616 --a------ C:\WINDOWS\system32\drivers\usbccgp.sys 2007-12-18 15:45 . 2004-08-03 23:08 31,616 --a–c— C:\WINDOWS\system32\dllcache\usbccgp.sys 2007-12-18 15:45 . 2005-06-07 09:35 713 --------- C:\WINDOWS\hpgmdl06.dat 2007-12-18 15:44 . 2007-12-18 15:44 1,409 --a------ C:\WINDOWS\system32\tmpF2B25.FOT 2007-12-18 15:44 . 2007-12-18 15:44 1,409 --a------ C:\WINDOWS\system32\tmpE6B25.FOT 2007-12-18 15:44 . 2007-12-18 15:44 1,409 --a------ C:\WINDOWS\system32\tmpCAB25.FOT 2007-12-18 15:44 . 2007-12-18 15:44 1,409 --a------ C:\WINDOWS\system32\tmp93C25.FOT 2007-12-18 15:44 . 2007-12-18 15:44 1,409 --a------ C:\WINDOWS\system32\tmp77C25.FOT 2007-12-18 15:44 . 2007-12-18 15:44 1,409 --a------ C:\WINDOWS\system32\tmp6AC25.FOT 2007-12-18 15:44 . 2007-12-18 15:44 1,409 --a------ C:\WINDOWS\system32\tmp5EC25.FOT 2007-12-18 15:44 . 2007-12-18 15:44 1,409 --a------ C:\WINDOWS\system32\tmp41D25.FOT 2007-12-13 21:48 . 2007-12-13 21:48 2007-12-13 21:35 . 2007-12-13 21:35 2007-12-11 23:00 . 2007-12-11 23:00 2007-12-07 11:39 . 2007-12-07 11:39 2007-12-07 11:24 . 2001-07-06 13:41 569,344 --a------ C:\WINDOWS\system32\imagr5.dll 2007-12-07 11:24 . 2001-07-06 11:44 544,768 --a------ C:\WINDOWS\system32\imagx5.dll 2007-12-07 11:24 . 2001-07-06 17:24 283,920 --a------ C:\WINDOWS\system32\ImagXpr5.dll 2007-12-07 11:24 . 2003-12-19 19:48 89,184 --a------ C:\WINDOWS\system32\drivers\imagedrv.sys 2007-12-07 11:24 . 2004-01-14 18:57 57,344 --a------ C:\WINDOWS\system32\ImageDrive.cpl 2007-12-07 11:24 . 2001-06-26 07:15 38,912 --a------ C:\WINDOWS\system32\picn20.dll 2007-12-06 11:20 . 2007-12-06 11:20 2007-12-05 12:15 . 2007-12-05 12:15 2007-12-05 12:15 . 2007-12-05 12:15 2007-12-05 12:07 . 2007-12-05 12:07 2007-12-03 22:18 . 2007-12-03 22:18 2007-12-02 21:06 . 2007-12-02 21:06 2007-11-28 22:34 . 2007-11-28 22:34 2007-11-28 21:30 . 2007-11-28 23:58 2007-11-27 11:18 . 2007-11-27 11:18 2007-11-27 11:18 . 2007-11-27 11:18 2007-11-21 17:37 . 2007-11-21 17:37 2007-11-21 17:37 . 2007-11-21 17:37 223,128 --a------ C:\WINDOWS\system32\drivers\dtscsi.sys 2007-11-20 21:36 . 2007-11-20 21:37 2007-11-20 20:23 . 2007-11-20 20:23 642,560 --a------ C:\WINDOWS\system32\drivers\sptd.sys 2007-11-20 20:23 . 2007-11-20 20:23 96,256 --a------ C:\WINDOWS\system32\drivers\sptd2637.sys 2007-11-20 19:06 . 2007-11-28 22:01 2007-11-20 19:05 . 2007-11-20 22:35 . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2007-12-18 14:50 --------- d-----w C:\Program Files\Hewlett-Packard 2007-12-13 20:48 --------- d-----w C:\Program Files\Common Files\Adobe 2007-12-07 10:22 --------- d-----w C:\Program Files\Ahead 2007-12-03 21:18 23 ----a-w C:\WINDOWS\system32\drivers\adidsl.cfg 2007-11-20 18:02 --------- d–h--w C:\Program Files\InstallShield Installation Information 2007-11-08 11:39 --------- d-----w C:\Documents and Settings\Marios\Dane aplikacji\AdobeUM 2007-11-01 14:28 --------- d-----w C:\Documents and Settings\Marios\Dane aplikacji\CyberLink 2007-10-28 23:36 --------- d-----w C:\Documents and Settings\Marios\Dane aplikacji\Dev-Cpp 2007-10-27 18:36 --------- d-----w C:\Documents and Settings\Marios\Dane aplikacji\Nokia Multimedia Player 2007-10-25 17:58 73,216 ----a-w C:\WINDOWS\ST6UNST.EXE 2007-10-25 17:58 249,856 ------w C:\WINDOWS\Setup1.exe 2007-10-25 15:09 --------- d-----w C:\Documents and Settings\Marios\Dane aplikacji\PC Suite 2007-10-25 15:09 --------- d-----w C:\Documents and Settings\Marios\Dane aplikacji\Datalayer 2007-10-24 20:51 --------- d-----w C:\Documents and Settings\Marios\Dane aplikacji\Nokia 2007-10-24 20:50 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\PC Suite 2007-10-24 20:49 --------- d-----w C:\Program Files\PC Connectivity Solution 2007-10-24 20:49 --------- d-----w C:\Program Files\DIFX 2007-10-24 20:49 --------- d-----w C:\Program Files\Common Files\PCSuite 2007-10-24 20:49 --------- d-----w C:\Program Files\Common Files\Nokia 2007-10-24 20:48 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Downloaded Installations 2007-10-24 17:52 --------- d-----w C:\Program Files\Microsoft.NET 2007-10-23 22:37 --------- d-----w C:\Program Files\Common Files\MAGIX Shared 2007-10-23 22:37 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\MAGIX 2007-10-23 21:29 --------- d-----w C:\Documents and Settings\Marios\Dane aplikacji\ABBYY 2007-10-23 20:47 --------- d-----w C:\Documents and Settings\Marios\Dane aplikacji\Gadu-Gadu 2007-10-23 20:01 --------- d-----w C:\Program Files\MultiRes 2007-10-23 20:00 451,072 ----a-w C:\WINDOWS\Radeon Omega Drivers v3.8.360 Uninstall.exe 2007-10-23 18:46 --------- d-----w C:\Documents and Settings\Marios\Dane aplikacji\Thunderbird 2007-10-23 18:46 --------- d-----w C:\Documents and Settings\Marios\Dane aplikacji\Talkback 2007-10-23 17:51 --------- d-----w C:\Documents and Settings\Marios\Dane aplikacji\Media Player Classic 2007-10-23 17:47 --------- d-----w C:\Program Files\Winamp 2007-10-23 17:46 --------- d-----w C:\Program Files\Media Player Classic 2007-10-23 17:41 --------- d-----w C:\Program Files\Common Files\Ahead 2007-10-23 17:19 --------- d-----w C:\Program Files\Java Web Start 2007-10-23 17:19 --------- d-----w C:\Program Files\Java 2007-10-23 17:17 --------- d-----w C:\Program Files\Asus 2007-10-23 17:06 --------- d-----w C:\Program Files\Toshiba 2007-10-23 16:40 512,096 ----a-w C:\WINDOWS\system32\drivers\amon.sys 2007-10-23 16:40 298,104 ----a-w C:\WINDOWS\system32\imon.dll 2007-10-23 16:40 15,424 ----a-w C:\WINDOWS\system32\drivers\nod32drv.sys 2007-10-23 11:59 568,712 ----a-w C:\WINDOWS\WMIDiag.exe 2007-10-23 10:28 --------- d-----w C:\Documents and Settings\Marios\Dane aplikacji\Intel 2007-10-23 10:27 21,275 ----a-w C:\WINDOWS\system32\drivers\AegisP.sys 2007-10-23 10:27 --------- d-----w C:\WINDOWS\system32\config\systemprofile\Dane aplikacji\Intel 2007-10-23 10:27 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Intel 2007-10-23 10:26 --------- d-----w C:\Program Files\Intel 2007-10-23 10:23 --------- d-----w C:\Program Files\Wireless Console 2 2007-10-23 10:21 --------- d-----w C:\Program Files\Synaptics 2007-10-23 10:19 --------- d-----w C:\Program Files\Realtek 2007-10-23 10:19 --------- d-----w C:\Program Files\Common Files\InstallShield 2007-10-23 10:17 --------- d-----w C:\Documents and Settings\Marios\Dane aplikacji\ATI 2007-10-23 10:14 --------- d-----w C:\Program Files\ATI Technologies 2007-10-23 10:06 --------- d-----w C:\Program Files\microsoft frontpage 2007-10-23 10:05 558,142 ----a-w C:\WINDOWS\java\Packages\8A2FXJHF.ZIP 2007-10-23 10:05 155,995 ----a-w C:\WINDOWS\java\Packages\WQJ1ZXR1.ZIP 2007-10-23 10:02 --------- d-----w C:\Program Files\Usługi online 2005-05-11 22:36 12,288 ----a-w C:\WINDOWS\Fonts\RandFont.dll . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “AutoConnect”=“C:\Programy\AutoConnect\AutoConnect.exe” [2004-08-28 19:27] “Gadu-Gadu”=“C:\Programy\Gadu-Gadu\gg.exe” [2007-07-09 08:39] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “TrayServer”=“C:\Programy\TrayServer.exe” [2006-10-04 14:41] “PCSuiteTrayApplication”=“D:\Rozne\Nokia Pc Suite\Nokia PC Suite 6\LaunchApplication.exe” [2006-11-28 13:12] “SMSERIAL”=“sm56hlpr.exe” [2005-05-27 00:12 C:\WINDOWS\sm56hlpr.exe] “RTHDCPL”=“RTHDCPL.EXE” [2005-09-06 13:39 C:\WINDOWS\RTHDCPL.EXE] “RemoteControl”=“C:\Programy\PDVDServ.exe” [2004-11-02 19:24] “HControl”=“C:\WINDOWS\ATK0100\HControl.exe” [2005-11-10 12:47] “HP Software Update”=“C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe” [2002-12-17 11:40] “HPDJ Taskbar Utility”=“C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb08.exe” [2003-03-11 11:08] “DeviceDiscovery”=“C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe” [2002-12-02 20:56] “DAEMON Tools”=“C:\Program Files\DAEMON Tools\daemon.exe” [2005-12-10 15:57] “EOUApp”=“C:\Program Files\Intel\Wireless\Bin\EOUWiz.exe” [2005-12-28 11:00] “Power_Gear”=“C:\Program Files\ASUS\Power4 Gear\BatteryLife.exe” [2005-10-05 16:50] “nod32kui”=“C:\Program Files\Eset\nod32kui.exe” [2007-10-23 17:40] “ASUS Live Update”=“C:\Program Files\ASUS\ASUS Live Update\ALU.exe” [2005-11-02 18:33] “RegistryMechanic”="" [] “NeroFilterCheck”=“C:\WINDOWS\system32\NeroCheck.exe” [2001-07-09 10:50] “AtiPTA”=“atiptaxx.exe” [2006-02-22 01:05 C:\WINDOWS\system32\atiptaxx.exe] “IntelWireless”=“C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe” [2005-12-28 10:56] [HKEY_USERS.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] “CTFMON.EXE”=“C:\WINDOWS\System32\CTFMON.EXE” [2004-08-03 23:44] “PcSync”=“D:\Rozne\Nokia Pc Suite\Nokia PC Suite 6\PcSync2.exe” [2006-11-09 16:15] C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\ Adobe Reader Speed Launch.lnk - C:\Programy\Reader\reader_sl.exe [2005-09-23 22:05:26] ASUS ChkMail.lnk - C:\Program Files\Asus\Asus ChkMail\ChkMail.exe [2007-10-23 11:29:51] Bluetooth Manager.lnk - C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe [2005-12-07 13:01:32] DSLMON.lnk - C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe [2007-12-03 22:18:17] HP Image Zone - szybkie uruchamianie.lnk - C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqthb08.exe [2005-05-12 00:49:24] S3 FirebirdServerMAGIXInstance;Firebird Server - MAGIX Instance;C:\Common\Database\bin\fbserver.exe [] . Contents of the ‘Scheduled Tasks’ folder “2007-12-15 10:47:13 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job” - C:\Program Files\Apple Software Update\SoftwareUpdate.exe . ************************************************************************** catchme 0.3.1333 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-12-18 21:46:42 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes … scanning hidden autostart entries … scanning hidden files … scan completed successfully hidden files: 0 ************************************************************************** . --------------------- DLLs Loaded Under Running Processes --------------------- PROCESS: C:\WINDOWS\system32\lsass.exe [5.01.2600.2180] -> C:\Program Files\Eset\pr_imon.dll . Completion time: 2007-12-18 21:47:08