Proszę o interpretację logów i pomoc

[Dariusz_J]

Jak w temacie:

Deckard’s System Scanner v20070826.66

Run by Daruś on 2007-08-28 19:16:08

Computer is in Normal Mode.

---

– System Restore --------------------------------------------------------------

Failed to create restore point; System Restore is disabled (service is not running).

Backed up registry hives.

Performed disk cleanup.

Total Physical Memory: 448 MiB (512 MiB recommended).

– HijackThis (run as Daruś.exe) -----------------------------------------------

Logfile of HijackThis v1.99.1

Scan saved at 19:16:29, on 2007-08-28

Platform: Windows XP (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\System32\VTTimer.exe

C:\WINDOWS\System32\VTtrayp.exe

C:\WINDOWS\System32\FTRTSVC.exe

C:\WINDOWS\SOUNDMAN.EXE

C:\Program Files\Eset\nod32krn.exe

C:\Program Files\Eset\nod32kui.exe

C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe

C:\WINDOWS\System32\svchost.exe

C:\PROGRA~1\NEOSTR~1\TaskBarIcon.exe

C:\Program Files\Canon\CAL\CALMAIN.exe

C:\Program Files\VIA\RAID\raid_tool.exe

C:\PROGRA~1\NEOSTR~1\neostradatp.exe

C:\PROGRA~1\NEOSTR~1\ComComp.exe

C:\PROGRA~1\NEOSTR~1\Toaster.exe

C:\PROGRA~1\NEOSTR~1\Inactivity.exe

C:\PROGRA~1\NEOSTR~1\PollingModule.exe

C:\WINDOWS\System32\ALERTM~1\ALERTM~1.EXE

C:\PROGRA~1\NEOSTR~1\Watch.exe

C:\Documents and Settings\Daruś\Pulpit\dss.exe

C:\DOCUME~1\DARU~1\Pulpit\Daruś.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.wp.pl/

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = neostrada tp

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

O2 - BHO: (no name) - {3088F9C5-1615-4A0B-88B7-E818FA391A2B} - C:\WINDOWS\System32\awtrrqq.dll

O2 - BHO: (no name) - {9007D9A4-F9DB-442C-BBB3-CFFA33286DF5} - C:\WINDOWS\System32\geeby.dll

O4 - HKLM…\Run: [VTTimer] VTTimer.exe

O4 - HKLM…\Run: [VTTrayp] VTtrayp.exe

O4 - HKLM…\Run: [soundMan] SOUNDMAN.EXE

O4 - HKLM…\Run: [WOOWATCH] C:\PROGRA~1\NEOSTR~1\Watch.exe

O4 - HKLM…\Run: [WOOTASKBARICON] C:\PROGRA~1\NEOSTR~1\GestMaj.exe TaskBarIcon.exe

O4 - HKLM…\Run: [nod32kui] “C:\Program Files\Eset\nod32kui.exe” /WAITSERVICE

O4 - HKLM…\Run: [Adobe Photo Downloader] “C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe”

O4 - HKLM…\Run: [Adobe Reader Speed Launcher] “C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe”

O4 - HKLM…\Run: [ymsgupdate2] C:\WINDOWS\system32\ymsng2.exe

O4 - HKCU…\Run: [ymsgupdate2] C:\WINDOWS\system32\ymsng2.exe

O4 - HKCU…\Run: [Odkurzacz-MCD] C:\Program Files\Odkurzacz\odk_mcd.exe

O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE

O4 - Global Startup: VIA RAID TOOL.lnk = C:\Program Files\VIA\RAID\raid_tool.exe

O17 - HKLM\System\CCS\Services\Tcpip…{A90F0EFB-1BF7-4C39-A361-DC5064A68205}: NameServer = 194.204.152.34 217.98.63.164

O20 - Winlogon Notify: awtrrqq - C:\WINDOWS\SYSTEM32\awtrrqq.dll

O20 - Winlogon Notify: geeby - C:\WINDOWS\System32\geeby.dll

O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe

O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe

O23 - Service: Canon Camera Access Library 8 CCALib8seclogon (CCALib8seclogon) - Unknown owner - C:\WINDOWS\System32\acluin.exe

O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exe

O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe

O23 - Service: Windows NT Session Manager (WINNTSMSS) - Unknown owner - C:\WINDOWS\system\smss.exe (file missing)

– HijackThis Fixed Entries (C:\DOCUME~1\DARU~1\Pulpit\backups) ---------------

backup-20070827-185446-362 R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)

backup-20070827-185517-291 R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\NEOSTR~1\SEARCH~1.DLL

backup-20070827-185540-487 O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx

backup-20070827-185602-855 R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://szukaj.wp.pl

backup-20070827-191455-997 O4 - HKCU…\Run: [ymsgupdate2] C:\WINDOWS\system32\ymsng2.exe

backup-20070827-215510-163 O17 - HKLM\System\CCS\Services\Tcpip…{A90F0EFB-1BF7-4C39-A361-DC5064A68205}: NameServer = 194.204.152.34 217.98.63.164

backup-20070827-221643-958 O4 - HKLM…\Run: [ymsgupdate2] C:\WINDOWS\system32\ymsng2.exe

backup-20070827-221657-832 O4 - HKCU…\Run: [ymsgupdate2] C:\WINDOWS\system32\ymsng2.exe

backup-20070827-221731-455 O17 - HKLM\System\CCS\Services\Tcpip…{A90F0EFB-1BF7-4C39-A361-DC5064A68205}: NameServer = 194.204.152.34 217.98.63.164

backup-20070827-230942-873 O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exe

backup-20070828-004808-721 O17 - HKLM\System\CCS\Services\Tcpip…{A90F0EFB-1BF7-4C39-A361-DC5064A68205}: NameServer = 194.204.152.34 217.98.63.164

backup-20070828-012844-584 O17 - HKLM\System\CCS\Services\Tcpip…{A90F0EFB-1BF7-4C39-A361-DC5064A68205}: NameServer = 194.204.152.34 217.98.63.164

backup-20070828-015208-632 O17 - HKLM\System\CCS\Services\Tcpip…{A90F0EFB-1BF7-4C39-A361-DC5064A68205}: NameServer = 194.204.152.34 217.98.63.164

backup-20070828-015616-475 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.neostrada.pl

backup-20070828-190148-757 O17 - HKLM\System\CCS\Services\Tcpip…{A90F0EFB-1BF7-4C39-A361-DC5064A68205}: NameServer = 194.204.152.34 217.98.63.164

– File Associations -----------------------------------------------------------

All associations okay.

– Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled ---------------------

R3 e4usbaw (USB ADSL2 WAN Adapter) - c:\windows\system32\drivers\e4usbaw.sys

S2 IKANLOADER2 (General Purpose USB Driver (e4ldr.sys)) - c:\windows\system32\drivers\e4ldr.sys

S3 PCAMPR5 (PCAMPR5 NDIS Protocol Driver) - c:\windows\system32\pcampr5.sys (file missing)

S3 PCANDIS5 (PCANDIS5 NDIS Protocol Driver) - c:\windows\system32\pcandis5.sys

– Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------

R2 aawservice (Ad-Aware 2007 Service) - c:\program files\lavasoft\ad-aware 2007\aawservice.exe

R2 CCALib8 (Canon Camera Access Library 8) - c:\program files\canon\cal\calmain.exe

R2 FTRTSVC (France Telecom Routing Table Service) - c:\windows\system32\ftrtsvc.exe

S2 CCALib8seclogon (Canon Camera Access Library 8 CCALib8seclogon) - c:\windows\system32\acluin.exe srv

S2 WINNTSMSS (Windows NT Session Manager) - “c:\windows\system\smss.exe” (file missing)

– Device Manager: Disabled ----------------------------------------------------

Class GUID: {4D36E97E-E325-11CE-BFC1-08002BE10318}

Description: Kontroler Uniwersalnej magistrali szeregowej (USB)

Device ID: PCI\VEN_1106&DEV_3104&SUBSYS_50041458&REV_86\3&13C0B0C5&0&84

Manufacturer:

Name: Kontroler Uniwersalnej magistrali szeregowej (USB)

PNP Device ID: PCI\VEN_1106&DEV_3104&SUBSYS_50041458&REV_86\3&13C0B0C5&0&84

Service:

– Files created between 2007-07-28 and 2007-08-28 -----------------------------

2007-08-28 02:43:38 0 d-------- C:\WINDOWS\ERUNT

2007-08-28 02:31:40 0 d-------- C:\Program Files\Odkurzacz

2007-08-28 01:22:26 109056 --a------ C:\WINDOWS\System32\catchme.exe

2007-08-28 01:22:26 9006 --a------ C:\clean.bat

2007-08-28 01:22:25 90112 --a------ C:\WINDOWS\System32\RegDACL.exe

2007-08-28 01:22:25 4096 --a------ C:\WINDOWS\System32\reboot.exe

2007-08-28 01:22:25 53248 --a------ C:\WINDOWS\System32\process.exe http://www.beyondlogic.org; Command Line Process Utility>

2007-08-28 01:17:23 0 dr-h----- C:\Documents and Settings\Daruś\Recent

2007-08-27 00:30:40 113515 --a------ C:\WINDOWS\System32\ymsng2.exe

2007-08-27 00:30:19 2048 --a------ C:\WINDOWS\System32\helperymsng2.exe

2007-08-24 18:35:27 925940 —hs---- C:\WINDOWS\System32\ybeeg.bak2

2007-08-23 22:41:38 6456 —hs---- C:\WINDOWS\System32\ybeeg.bak1

2007-08-23 22:40:57 297568 --a------ C:\WINDOWS\System32\geeby.dll

2007-08-23 22:35:54 43542 --a------ C:\WINDOWS\System32\awtrrqq.dll

2007-08-21 21:08:53 69205 --a------ C:\WINDOWS\System32\msv.exe

2007-08-19 23:29:20 0 d-------- C:\Program Files\Common Files\AVSMedia

2007-08-19 23:29:13 139264 --a------ C:\WINDOWS\System32\xvidvfw.dll

2007-08-19 23:29:13 524288 --a------ C:\WINDOWS\System32\xvidcore.dll

2007-08-19 23:29:12 0 d-------- C:\Program Files\AVS4YOU

2007-08-19 22:48:44 0 d-------- C:\speed_converter

2007-08-19 22:48:35 0 d-------- C:\Program Files\Speed Video Converter

2007-08-19 22:39:33 0 d-------- C:\Program Files\MediaCoder

2007-08-19 19:26:08 0 d-------- C:\Temp

2007-08-19 19:25:21 0 d-------- C:\Program Files\Witcobber

2007-08-19 19:20:42 0 d-------- C:\Program Files\AsfTools 3.1

2007-08-19 19:18:08 0 d-------- C:\Program Files\WMV9_VCM

2007-08-19 19:09:49 0 d-------- C:\Program Files\Absolute Video Converter

2007-08-19 03:58:31 0 d-------- C:\Program Files\WMV To VCD DVD MPEG Converter Pro

2007-08-19 02:29:29 238 --ahs---- C:\WINDOWS\System32\index.dat

2007-08-19 02:29:29 12800 --ahs---- C:\WINDOWS\System32\adadix32p.dll

2007-08-19 02:29:26 337 --ahs---- C:\WINDOWS\System32\3637441342.dat

2007-08-19 02:29:23 61111 -r-hs---- C:\WINDOWS\System32\acluin.exe

2007-08-19 00:22:09 0 d-------- C:\Program Files\Elecard

2007-08-18 22:38:03 0 d-------- C:\Program Files\Common Files\Adobe

2007-08-18 22:37:56 0 d-------- C:\WINDOWS\Downloaded Installations

2007-08-18 22:37:34 0 d-------- C:\Program Files\Google

2007-08-18 21:44:02 0 d—s---- C:\WINDOWS\System32\Microsoft

2007-08-18 21:43:49 0 d-------- C:\Program Files\Lavasoft

2007-08-18 21:43:27 0 d-------- C:\Program Files\Common Files\Wise Installation Wizard

2007-08-18 21:13:22 0 d-------- C:\Program Files\Yahoo!

2007-08-18 21:13:14 0 d-------- C:\Program Files\CCleaner

2007-08-18 12:17:42 0 d-------- C:\Program Files\VideoLAN

2007-08-17 20:38:08 298104 --a------ C:\WINDOWS\System32\imon.dll

2007-08-15 14:49:22 127456 --a------ C:\WINDOWS\System32\IPDETECT.EXE

2007-08-15 14:49:21 116992 --a------ C:\WINDOWS\System32\drivers\e4usbaw.sys

2007-08-15 14:49:21 126489 --a------ C:\WINDOWS\System32\drivers\adiusbaw.sys

2007-08-15 14:49:21 126976 --a------ C:\WINDOWS\System32\coclassfast.dll

2007-08-15 14:49:21 24576 --a------ C:\WINDOWS\enddisk32.exe

2007-08-15 14:49:20 135168 --a------ C:\WINDOWS\System32\unaddrv.exe

2007-08-15 14:49:20 152126 --a------ C:\WINDOWS\System32\drivers\L1E9P2.BIN

2007-08-15 14:49:20 64000 --a------ C:\WINDOWS\System32\drivers\e4ldr.sys

2007-08-15 14:49:20 46892 --a------ C:\WINDOWS\System32\ADADIX16.DLL

2007-08-15 14:49:19 152126 --a------ C:\WINDOWS\System32\drivers\L1E9P1.BIN

2007-08-15 14:49:19 152126 --a------ C:\WINDOWS\System32\drivers\L1E9P0.BIN

2007-08-15 14:49:19 152126 --a------ C:\WINDOWS\System32\drivers\L1E9I2.BIN

2007-08-15 14:49:19 152126 --a------ C:\WINDOWS\System32\drivers\L1E9I1.BIN

2007-08-15 14:49:19 152126 --a------ C:\WINDOWS\System32\drivers\L1E9I0.BIN

2007-08-15 14:49:19 152132 --a------ C:\WINDOWS\System32\drivers\L1E4P2.BIN

2007-08-15 14:49:19 152132 --a------ C:\WINDOWS\System32\drivers\L1E4P1.BIN

2007-08-15 14:49:19 152132 --a------ C:\WINDOWS\System32\drivers\L1E4P0.BIN

2007-08-15 14:49:19 152220 --a------ C:\WINDOWS\System32\drivers\L1E4I2.BIN

2007-08-15 14:49:19 152220 --a------ C:\WINDOWS\System32\drivers\L1E4I1.BIN

2007-08-15 14:49:19 152220 --a------ C:\WINDOWS\System32\drivers\L1E4I0.BIN

2007-08-15 14:49:16 0 d-------- C:\Program Files\SAGEM

2007-08-15 14:48:52 0 d-------- C:\WINDOWS\System32\AlertModule

2007-08-15 14:48:50 94208 --a------ C:\WINDOWS\System32\W32n50.dll

2007-08-15 14:48:50 16128 -----n— C:\WINDOWS\System32\PCANDIS5.SYS

2007-08-15 14:48:45 36864 --a------ C:\WINDOWS\System32\IfHelper.dll

2007-08-15 14:48:45 40960 --a------ C:\WINDOWS\System32\FTRTSVC.exe

2007-08-15 13:30:11 32768 --a------ C:\WINDOWS\System32\WooDial2000.dll

2007-08-15 13:24:58 0 d-------- C:\Program Files\Java Web Start

2007-08-15 13:24:51 41068 -----n— C:\WINDOWS\System32\ActPanel.dll

2007-08-15 13:24:51 0 d-------- C:\Program Files\Java

2007-08-15 13:23:36 0 d-------- C:\Program Files\Neostrada TP

2007-08-15 13:23:03 0 d–hs---- C:\WINDOWS\ftpcache

2007-08-14 23:53:31 0 d-------- C:\Program Files\ShaftProfiler

2007-08-14 23:53:24 73216 --a------ C:\WINDOWS\ST6UNST.EXE

2007-08-14 19:16:17 0 d-------- C:\Program Files\Canon

2007-08-14 19:16:16 0 d-------- C:\Program Files\Common Files\Canon

2007-08-14 19:12:42 438272 --a------ C:\WINDOWS\System32\vp6vfw.dll

2007-08-14 19:12:42 118832 --a------ C:\WINDOWS\System32\SHW32.DLL

2007-08-14 19:04:05 0 d-------- C:\Program Files\EA SPORTS

2007-08-14 19:02:35 0 d-------- C:\WINDOWS\RegisteredPackages

2007-08-14 19:02:01 1769472 --a------ C:\WINDOWS\System32\dxdiagn.dll

2007-08-14 19:02:01 1703936 --a------ C:\WINDOWS\System32\d3d9.dll

2007-08-14 18:40:28 143872 --a------ C:\WINDOWS\System32\iacenc.dll

2007-08-14 18:39:19 204857 --a------ C:\WINDOWS\System32\InstallHelp.dll

2007-08-14 18:39:19 107293 --a------ C:\WINDOWS\System32\GMTUninstall.exe

2007-08-14 18:39:19 0 d-------- C:\Program Files\Friendly Software

2007-08-14 17:46:51 0 d-------- C:\Program Files\DivX

2007-08-14 17:45:59 0 d-------- C:\WINDOWS\Application Data

2007-08-14 17:45:55 0 d-------- C:\Program Files\V1 Home 2.0

2007-08-14 17:45:55 0 d-------- C:\Program Files\Common Files\Moonlight

2007-08-14 16:11:44 0 d-------- C:\Program Files\Realtek Sound Manager

2007-08-14 16:11:43 0 d-------- C:\Program Files\AvRack

2007-08-14 16:11:37 40960 -----n— C:\WINDOWS\System32\ChCfg.exe

2007-08-14 16:11:30 208896 -----n— C:\WINDOWS\alcupd.exe

2007-08-14 16:11:30 139264 -----n— C:\WINDOWS\alcrmv.exe

2007-08-14 16:10:47 0 d-------- C:\Program Files\AMD

2007-08-14 16:10:24 0 d–h----- C:\Program Files\InstallShield Installation Information

2007-08-14 16:08:24 0 d-------- C:\Program Files\VIA

2007-08-14 16:08:14 0 d-------- C:\Program Files\Common Files\InstallShield

2007-08-14 16:06:54 0 d-------- C:\WINDOWS\System32\ReinstallBackups

2007-08-14 16:06:48 306688 --a------ C:\WINDOWS\IsUninst.exe

2007-08-14 14:33:58 0 d-------- C:\WINDOWS\ShellNew

2007-08-14 14:32:47 0 d-------- C:\WINDOWS\Twain32

2007-08-14 12:57:15 0 d—s---- C:\Documents and Settings\Daruś\UserData

2007-08-14 12:57:14 0 d-------- C:\Documents and Settings\Daruś\tvunetworks

2007-08-14 12:49:17 0 d-------- C:\Documents and Settings\Daruś\Gadu-Gadu

2007-08-14 12:48:53 0 d-------- C:\Documents and Settings\Daruś\Application Data

2007-08-14 12:48:53 0 d-------- C:\Documents and Settings\Daruś\Application Data\Microsoft

2007-08-14 12:48:15 0 d-------- C:\Documents and Settings\Daruś.jpi_cache

2007-08-14 12:48:15 0 d-------- C:\Documents and Settings\Daruś.javaws

2007-08-14 12:48:15 0 d-------- C:\Documents and Settings\Daruś.java

2007-08-14 12:48:15 0 d-------- C:\Documents and Settings\Daruś.autodesk

2007-08-14 12:33:29 0 d–hs---- C:\WINDOWS\Installer

2007-08-14 12:33:19 0 d–h----- C:\Documents and Settings\Daruś\Ustawienia lokalne

2007-08-14 12:33:19 0 dr------- C:\Documents and Settings\Daruś\Ulubione

2007-08-14 12:33:19 0 d–h----- C:\Documents and Settings\Daruś\Szablony

2007-08-14 12:33:19 0 dr-h----- C:\Documents and Settings\Daruś\SendTo

2007-08-14 12:33:19 0 d-------- C:\Documents and Settings\Daruś\Pulpit

2007-08-14 12:33:19 0 d–h----- C:\Documents and Settings\Daruś\PrintHood

2007-08-14 12:33:19 0 d–h----- C:\Documents and Settings\Daruś\NetHood

2007-08-14 12:33:19 0 dr------- C:\Documents and Settings\Daruś\Moje dokumenty

2007-08-14 12:33:19 0 dr------- C:\Documents and Settings\Daruś\Menu Start

2007-08-14 12:33:19 0 dr-h----- C:\Documents and Settings\Daruś\Dane aplikacji

2007-08-14 12:33:19 0 d—s---- C:\Documents and Settings\Daruś\Cookies

2007-08-14 12:33:18 2359296 --ah----- C:\Documents and Settings\Daruś\NTUSER.DAT

2007-08-14 12:28:37 0 d–hs---- C:\System Volume Information

2007-08-14 12:28:36 0 d-------- C:\WINDOWS\Prefetch

2007-08-14 11:45:17 0 d-------- C:\WINDOWS

2007-08-14 11:45:17 0 d-------- C:\WINDOWS\WinSxS

2007-08-14 11:45:17 0 dr------- C:\WINDOWS\Web

2007-08-14 11:45:17 0 d-------- C:\WINDOWS\twain_32

2007-08-14 11:45:17 0 d-------- C:\WINDOWS\system32

2007-08-14 11:45:17 0 d-------- C:\WINDOWS\System32\wins

2007-08-14 11:45:17 0 d-------- C:\WINDOWS\System32\wbem

2007-08-14 11:45:17 0 d-------- C:\WINDOWS\System32\usmt

2007-08-14 11:45:17 0 d-------- C:\WINDOWS\System32\spool

2007-08-14 11:45:17 0 d-------- C:\WINDOWS\System32\ShellExt

2007-08-14 11:45:17 0 d-------- C:\WINDOWS\System32\Setup

2007-08-14 11:45:17 0 d-------- C:\WINDOWS\System32\ras

2007-08-14 11:45:17 0 d-------- C:\WINDOWS\System32\oobe

2007-08-14 11:45:17 0 d-------- C:\WINDOWS\System32\npp

2007-08-14 11:45:17 0 d-------- C:\WINDOWS\System32\mui

2007-08-14 11:45:17 0 d-------- C:\WINDOWS\System32\inetsrv

2007-08-14 11:45:17 0 d-------- C:\WINDOWS\System32\IME

2007-08-14 11:45:17 0 d-------- C:\WINDOWS\System32\icsxml

2007-08-14 11:45:17 0 d-------- C:\WINDOWS\System32\ias

2007-08-14 11:45:17 0 d-------- C:\WINDOWS\System32\export

2007-08-14 11:45:17 0 d-------- C:\WINDOWS\System32\drivers

2007-08-14 11:45:17 0 d-------- C:\WINDOWS\System32\drivers\etc

2007-08-14 11:45:17 0 d-------- C:\WINDOWS\System32\drivers\disdn

2007-08-14 11:45:17 0 dr-hs–c- C:\WINDOWS\System32\dllcache

2007-08-14 11:45:17 0 d-------- C:\WINDOWS\System32\dhcp

2007-08-14 11:45:17 0 d-------- C:\WINDOWS\System32\config

2007-08-14 11:45:17 0 d-------- C:\WINDOWS\System32\3com_dmi

2007-08-14 11:45:17 0 d-------- C:\WINDOWS\System32\3076

2007-08-14 11:45:17 0 d-------- C:\WINDOWS\System32\2052

2007-08-14 11:45:17 0 d-------- C:\WINDOWS\System32\1054

2007-08-14 11:45:17 0 d-------- C:\WINDOWS\System32\1045

2007-08-14 11:45:17 0 d-------- C:\WINDOWS\System32\1042

2007-08-14 11:45:17 0 d-------- C:\WINDOWS\System32\1041

2007-08-14 11:45:17 0 d-------- C:\WINDOWS\System32\1037

2007-08-14 11:45:17 0 d-------- C:\WINDOWS\System32\1033

2007-08-14 11:45:17 0 d-------- C:\WINDOWS\System32\1031

2007-08-14 11:45:17 0 d-------- C:\WINDOWS\System32\1028

2007-08-14 11:45:17 0 d-------- C:\WINDOWS\System32\1025

2007-08-14 11:45:17 0 d-------- C:\WINDOWS\system

2007-08-14 11:45:17 0 d-------- C:\WINDOWS\security

2007-08-14 11:45:17 0 d-------- C:\WINDOWS\Resources

2007-08-14 11:45:17 0 d-------- C:\WINDOWS\repair

2007-08-14 11:45:17 0 d-------- C:\WINDOWS\mui

2007-08-14 11:45:17 0 d-------- C:\WINDOWS\msapps

2007-08-14 11:45:17 0 d-------- C:\WINDOWS\msagent

2007-08-14 11:45:17 0 d-------- C:\WINDOWS\Media

2007-08-14 11:45:17 0 d-------- C:\WINDOWS\java

2007-08-14 11:45:17 0 d–h----- C:\WINDOWS\inf

2007-08-14 11:45:17 0 d-------- C:\WINDOWS\ime

2007-08-14 11:45:17 0 d-------- C:\WINDOWS\Help

2007-08-14 11:45:17 0 dr–s---- C:\WINDOWS\Fonts

2007-08-14 11:45:17 0 d-------- C:\WINDOWS\Driver Cache

2007-08-14 11:45:17 0 d-------- C:\WINDOWS\Debug

2007-08-14 11:45:17 0 d-------- C:\WINDOWS\Cursors

2007-08-14 11:45:17 0 d-------- C:\WINDOWS\Connection Wizard

2007-08-14 11:45:17 0 d-------- C:\WINDOWS\Config

2007-08-14 11:45:17 0 d-------- C:\WINDOWS\AppPatch

2007-08-14 11:45:17 0 d-------- C:\WINDOWS\addins

2007-08-14 11:16:24 0 d-------- C:\WINDOWS\System32\xircom

2007-08-14 11:16:24 0 d-------- C:\Program Files\microsoft frontpage

2007-08-14 11:16:06 0 -rahs---- C:\MSDOS.SYS

2007-08-14 11:16:06 0 -rahs---- C:\IO.SYS

2007-08-14 11:16:06 0 --a------ C:\CONFIG.SYS

2007-08-14 11:16:06 0 --a------ C:\AUTOEXEC.BAT

2007-08-14 11:15:06 0 dr------- C:\WINDOWS\Offline Web Pages

2007-08-14 11:15:06 0 d—s---- C:\WINDOWS\Downloaded Program Files

2007-08-14 11:14:34 0 d-------- C:\WINDOWS\srchasst

2007-08-14 11:14:22 0 d-------- C:\WINDOWS\System32\DirectX

2007-08-14 11:14:21 0 d-------- C:\WINDOWS\System32\Macromed

2007-08-14 11:13:48 0 d-------- C:\Program Files\Movie Maker

2007-08-14 11:12:50 0 d-------- C:\WINDOWS\System32\Restore

2007-08-14 11:12:39 0 d-------- C:\WINDOWS\PCHEALTH

2007-08-14 11:12:25 0 d—s---- C:\WINDOWS\Tasks

2007-08-14 11:12:18 0 d-------- C:\Program Files\Common Files\MSSoap

2007-08-14 11:11:43 21856 --a------ C:\WINDOWS\System32\emptyregdb.dat

2007-08-14 11:11:28 0 d-------- C:\WINDOWS\Registration

2007-08-14 11:11:21 0 d–h----- C:\Program Files\WindowsUpdate

2007-08-14 11:11:21 0 d-------- C:\Program Files\Usługi online

2007-08-14 11:11:15 0 d-------- C:\Program Files\Messenger

2007-08-14 11:10:54 0 d-------- C:\Program Files\MSN Gaming Zone

2007-08-14 11:10:37 0 d-------- C:\Program Files\Windows NT

2007-08-14 11:10:12 0 d-------- C:\WINDOWS\System32\MsDtc

2007-08-14 11:10:06 0 d-------- C:\WINDOWS\System32\Com

2007-08-14 10:51:08 0 d-------- C:\Program Files\Common Files\ODBC

2007-08-14 10:51:01 0 d-------- C:\Program Files\Common Files\SpeechEngines

2007-08-14 10:51:00 0 dr------- C:\Program Files

2007-08-14 10:51:00 0 d-------- C:\Program Files\Common Files

2007-08-14 10:49:36 0 d-------- C:\WINDOWS\System32\CatRoot2

2007-08-14 10:49:36 0 d-------- C:\WINDOWS\System32\CatRoot

2007-08-14 10:49:17 0 d-------- C:\Documents and Settings

– Find3M Report ---------------------------------------------------------------

2007-08-20 02:15:47 0 d-------- C:\Documents and Settings\Daruś\Dane aplikacji\Adobe

2007-08-19 23:31:26 0 d-------- C:\Documents and Settings\Daruś\Dane aplikacji\AVS4YOU

2007-08-19 00:08:50 0 d-------- C:\Documents and Settings\Daruś\Dane aplikacji\Google

2007-08-15 15:12:13 355830 --a------ C:\WINDOWS\System32\perfh015.dat

2007-08-15 15:12:13 49712 --a------ C:\WINDOWS\System32\perfc015.dat

2007-08-14 14:32:47 0 d-------- C:\Documents and Settings\Daruś\Dane aplikacji\Microsoft Web Folders

2007-08-14 12:49:17 0 d-------- C:\Documents and Settings\Daruś\Dane aplikacji\ACD Systems

2007-08-14 12:49:16 0 d-------- C:\Documents and Settings\Daruś\Dane aplikacji\CyberLink

2007-08-14 12:49:16 0 d-------- C:\Documents and Settings\Daruś\Dane aplikacji\Canon

2007-08-14 12:49:16 0 d-------- C:\Documents and Settings\Daruś\Dane aplikacji\ATI

2007-08-14 12:49:16 0 d-------- C:\Documents and Settings\Daruś\Dane aplikacji\Apple Computer

2007-08-14 12:49:16 0 d-------- C:\Documents and Settings\Daruś\Dane aplikacji\AdobeUM

2007-08-14 12:49:16 0 d-------- C:\Documents and Settings\Daruś\Dane aplikacji\AdobeAUM

2007-08-14 12:49:15 0 d-------- C:\Documents and Settings\Daruś\Dane aplikacji\Identities

2007-08-14 12:49:15 0 d-------- C:\Documents and Settings\Daruś\Dane aplikacji\Help

2007-08-14 12:49:15 0 d-------- C:\Documents and Settings\Daruś\Dane aplikacji\GanymedeNet

2007-08-14 12:49:13 0 d-------- C:\Documents and Settings\Daruś\Dane aplikacji\Macromedia

2007-08-14 12:49:13 0 d-------- C:\Documents and Settings\Daruś\Dane aplikacji\Leadertech

2007-08-14 12:49:13 0 d-------- C:\Documents and Settings\Daruś\Dane aplikacji\Lavasoft

2007-08-14 12:49:10 0 d-------- C:\Documents and Settings\Daruś\Dane aplikacji\Mozilla

2007-08-14 12:49:09 0 d-------- C:\Documents and Settings\Daruś\Dane aplikacji\Skype

2007-08-14 12:49:09 0 d-------- C:\Documents and Settings\Daruś\Dane aplikacji\Real

2007-08-14 12:49:09 0 d-------- C:\Documents and Settings\Daruś\Dane aplikacji\Petroglyph

2007-08-14 12:49:08 0 d-------- C:\Documents and Settings\Daruś\Dane aplikacji\Xfire

2007-08-14 12:49:08 0 d-------- C:\Documents and Settings\Daruś\Dane aplikacji\vlc

2007-08-14 12:49:08 0 d-------- C:\Documents and Settings\Daruś\Dane aplikacji\TVU networks

2007-08-14 12:49:08 0 d-------- C:\Documents and Settings\Daruś\Dane aplikacji\Symantec

2007-08-14 12:49:08 0 d-------- C:\Documents and Settings\Daruś\Dane aplikacji\SopCast

2007-06-07 21:10:48 20480 --a------ C:\WINDOWS\System32\ac3config.exe

– Registry Dump ---------------------------------------------------------------

*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE~\Browser Helper Objects{3088F9C5-1615-4A0B-88B7-E818FA391A2B}]

2007-08-23 22:35 43542 --a------ C:\WINDOWS\System32\awtrrqq.dll

[HKEY_LOCAL_MACHINE~\Browser Helper Objects{9007D9A4-F9DB-442C-BBB3-CFFA33286DF5}]

2007-08-23 22:41 297568 --a------ C:\WINDOWS\System32\geeby.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

“VTTimer”=“VTTimer.exe” [2005-03-07 21:33 C:\WINDOWS\system32\VTTimer.exe]

“VTTrayp”=“VTtrayp.exe” [2005-01-11 01:33 C:\WINDOWS\system32\VTTrayp.exe]

“SoundMan”=“SOUNDMAN.EXE” [2004-12-22 11:09 C:\WINDOWS\SOUNDMAN.EXE]

“WOOWATCH”=“C:\PROGRA~1\NEOSTR~1\Watch.exe” [2004-08-23 14:49]

“WOOTASKBARICON”=“C:\PROGRA~1\NEOSTR~1\GestMaj.exe” [2004-10-14 16:55]

“nod32kui”=“C:\Program Files\Eset\nod32kui.exe” [2007-08-17 20:36]

“Adobe Photo Downloader”=“C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe” [2007-03-09 11:09]

“Adobe Reader Speed Launcher”=“C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe” [2007-05-11 03:06]

“ymsgupdate2”=“C:\WINDOWS\system32\ymsng2.exe” [2007-08-28 02:05]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

“ymsgupdate2”=“C:\WINDOWS\system32\ymsng2.exe” [2007-08-28 02:05]

“Odkurzacz-MCD”=“C:\Program Files\Odkurzacz\odk_mcd.exe” [2007-05-03 10:02]

C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\

Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office\OSA9.EXE [2000-01-21 08:15:54]

VIA RAID TOOL.lnk - C:\Program Files\VIA\RAID\raid_tool.exe [2007-08-14 16:12:53]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]

“{3088F9C5-1615-4A0B-88B7-E818FA391A2B}”= C:\WINDOWS\System32\awtrrqq.dll [2007-08-23 22:35 43542]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\awtrrqq]

awtrrqq.dll 2007-08-23 22:35 43542 C:\WINDOWS\system32\awtrrqq.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\geeby]

C:\WINDOWS\System32\geeby.dll 2007-08-23 22:41 297568 C:\WINDOWS\system32\geeby.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]

@=“Service”

– End of Deckard’s System Scanner: finished at 2007-08-28 19:17:28 ------------

Komputer działa dość wolno (zwłaszcza widoczne podczas pracy w necie), mój NOD32 wykrywa co jakiś czas infekcje, których nie może się pozbyć.

Dziękuję z góry za pomoc. Pozdrawiam.

Złączono Posta : 28.08.2007 (Wto) 19:27

ogfile of HijackThis v1.99.1

Scan saved at 19:26:33, on 2007-08-28

Platform: Windows XP (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\System32\VTTimer.exe

C:\WINDOWS\System32\VTtrayp.exe

C:\WINDOWS\System32\FTRTSVC.exe

C:\WINDOWS\SOUNDMAN.EXE

C:\Program Files\Eset\nod32krn.exe

C:\Program Files\Eset\nod32kui.exe

C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe

C:\WINDOWS\System32\svchost.exe

C:\PROGRA~1\NEOSTR~1\TaskBarIcon.exe

C:\Program Files\Canon\CAL\CALMAIN.exe

C:\Program Files\VIA\RAID\raid_tool.exe

C:\PROGRA~1\NEOSTR~1\neostradatp.exe

C:\PROGRA~1\NEOSTR~1\ComComp.exe

C:\PROGRA~1\NEOSTR~1\Toaster.exe

C:\PROGRA~1\NEOSTR~1\Inactivity.exe

C:\PROGRA~1\NEOSTR~1\PollingModule.exe

C:\WINDOWS\System32\ALERTM~1\ALERTM~1.EXE

C:\PROGRA~1\NEOSTR~1\Watch.exe

C:\Program Files\Internet Explorer\IEXPLORE.EXE

C:\Documents and Settings\Daruś\Pulpit\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.wp.pl/

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = neostrada tp

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza

O4 - HKLM…\Run: [VTTimer] VTTimer.exe

O4 - HKLM…\Run: [VTTrayp] VTtrayp.exe

O4 - HKLM…\Run: [soundMan] SOUNDMAN.EXE

O4 - HKLM…\Run: [WOOWATCH] C:\PROGRA~1\NEOSTR~1\Watch.exe

O4 - HKLM…\Run: [WOOTASKBARICON] C:\PROGRA~1\NEOSTR~1\GestMaj.exe TaskBarIcon.exe

O4 - HKLM…\Run: [nod32kui] “C:\Program Files\Eset\nod32kui.exe” /WAITSERVICE

O4 - HKLM…\Run: [Adobe Photo Downloader] “C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe”

O4 - HKLM…\Run: [Adobe Reader Speed Launcher] “C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe”

O4 - HKLM…\Run: [ymsgupdate2] C:\WINDOWS\system32\ymsng2.exe

O4 - HKCU…\Run: [ymsgupdate2] C:\WINDOWS\system32\ymsng2.exe

O4 - HKCU…\Run: [Odkurzacz-MCD] C:\Program Files\Odkurzacz\odk_mcd.exe

O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE

O4 - Global Startup: VIA RAID TOOL.lnk = C:\Program Files\VIA\RAID\raid_tool.exe

O17 - HKLM\System\CCS\Services\Tcpip…{A90F0EFB-1BF7-4C39-A361-DC5064A68205}: NameServer = 194.204.152.34 217.98.63.164

O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe

O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe

O23 - Service: Canon Camera Access Library 8 CCALib8seclogon (CCALib8seclogon) - Unknown owner - C:\WINDOWS\System32\acluin.exe

O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exe

O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe

O23 - Service: Windows NT Session Manager (WINNTSMSS) - Unknown owner - C:\WINDOWS\system\smss.exe (file missing)

Dziękuję.

[JAg (Jag1661)]

nie jetem specjalistą od logów, ale zauważyłem,że masz trochę śmieci:

1. ACLUIN.EXE, - das ist eine Kopie des Trojaners IPTB.EXE.

2. ADWARE - AWTQO.DLL, GEEDE.DLL, VTUTR.DLL, GEEBB.DLL …itd - więcej na stronie : http://fileresearchcenter.com/A/AWTQN.DLL-8082.html

3 Trojan Ymsng2.exe is Trojan.Slapew.B. - więcej o nim w: http://securityresponse.symantec.com/av … pew.b.html

Będziesz musiał powalczyć…

Póki nie odpowie Ci ktoś bardziej obeznany - ja bym poczytał o tym świństwie, poszukał w/w plików, odłączył sieć (na trochę), wyłączył przywracanie systemu na wszystkich dyskach, sprawdził powiązania i wyłączył procesy tych plików (ja używam CodeStuffStartera) i spróbował je usunąć ręcznie ( w trybie normalnym Windows lub w trybie awaryjnym) - ewentualnie użył KillBox-a - jeśli wiszą w pamięci.

Następnie skan dobrym antywirusem z NAJNOWSZĄ bazą .

P.s nie używasz nic oprócz NOD-a? ( np. AdAware lub SpyBot S&D, SpyBlaster itp)

P.s - użył bym też HiJack-a - ale przy WYŁĄCZONYM przywracaniu systemu -0 on też ma trochę fajnych opcji

P.s 3 ( ) - przeczytaj to: http://forum.dobreprogramy.pl/viewtopic.php?t=76580 - USUWANIE NIEBEZPIECZNYCH ŚMIECI

[Gutek]

O23 - Service: Windows NT Session Manager (WINNTSMSS) - Unknown owner - C:\WINDOWS\system\smss.exe (file missing)

Pobierz program SDFix

[Dariusz_J]

SDFix: Version 1.100 Run by Daru on 2007-08-28 at 21:36 Microsoft Windows XP [Wersja 5.1.2600] Running From: C:\SDFix Safe Mode: Checking Services: Restoring Windows Registry Values Restoring Windows Default Hosts File Rebooting… Normal Mode: Checking Files: No Trojan Files Found Removing Temp Files… ADS Check: C:\WINDOWS No streams found. C:\WINDOWS\system32 No streams found. C:\WINDOWS\system32\svchost.exe No streams found. C:\WINDOWS\system32\ntoskrnl.exe No streams found. Final Check: Remaining Services: ------------------ Authorized Application Key Export: Remaining Files: --------------- Files with Hidden Attributes: C:\WINDOWS\system32\adadix32p.dll C:\WINDOWS\system32\acluin.exe Finished

Deckard’s System Scanner v20070826.66 Run by Daruś on 2007-08-28 21:44:01 Computer is in Normal Mode. -------------------------------------------------------------------------------- Total Physical Memory: 448 MiB (512 MiB recommended). – HijackThis (run as Daruś.exe) ----------------------------------------------- Unable to find log (file not found); running clone. – HijackThis Clone ------------------------------------------------------------ Emulating logfile of HijackThis v1.99.1 Scan saved at 2007-08-28 21:44:06 Platform: Windows XP (5.01.2600) MSIE: Internet Explorer (6.00.2600.0000) Running processes: C:\WINDOWS\system32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe C:\WINDOWS\explorer.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\FTRTSVC.exe C:\Program Files\ESET\nod32krn.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Canon\CAL\CALMAIN.exe C:\WINDOWS\system32\VTTimer.exe C:\WINDOWS\system32\VTTrayp.exe C:\WINDOWS\SOUNDMAN.EXE C:\Program Files\ESET\nod32kui.exe C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe C:\Program Files\Neostrada TP\TaskBarIcon.exe C:\Program Files\VIA\RAID\raid_tool.exe C:\Program Files\Neostrada TP\neostradatp.exe C:\Program Files\Neostrada TP\ComComp.exe C:\Program Files\Neostrada TP\Toaster.exe C:\Program Files\Neostrada TP\Inactivity.exe C:\Program Files\Neostrada TP\PollingModule.exe C:\WINDOWS\system32\AlertModule\AlertModule.exe C:\Program Files\Neostrada TP\Watch.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\Documents and Settings\Daruś\Pulpit\dss.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://szukaj.wp.pl R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.wp.pl R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://www.google.com/search?q=%s R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = neostrada tp R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza R1 - HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.google.com/ie R1 - HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie R1 - HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {3088F9C5-1615-4A0B-88B7-E818FA391A2B} - C:\WINDOWS\system32\awtrrqq.dll O2 - BHO: (no name) - {4A8AEBC2-C3F3-4221-8CAB-03A5ADA5EA6B} - C:\WINDOWS\system32\geeby.dll O4 - HKEY_LOCAL_MACHINE…\Run: [VTTimer] VTTimer.exe O4 - HKEY_LOCAL_MACHINE…\Run: [VTTrayp] VTtrayp.exe O4 - HKEY_LOCAL_MACHINE…\Run: [soundMan] SOUNDMAN.EXE O4 - HKEY_LOCAL_MACHINE…\Run: [WOOWATCH] C:\PROGRA~1\NEOSTR~1\Watch.exe O4 - HKEY_LOCAL_MACHINE…\Run: [WOOTASKBARICON] C:\PROGRA~1\NEOSTR~1\GestMaj.exe TaskBarIcon.exe O4 - HKEY_LOCAL_MACHINE…\Run: [nod32kui] “C:\Program Files\Eset\nod32kui.exe” /WAITSERVICE O4 - HKEY_LOCAL_MACHINE…\Run: [Adobe Photo Downloader] “C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe” O4 - HKEY_LOCAL_MACHINE…\Run: [Adobe Reader Speed Launcher] “C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe” O4 - HKEY_LOCAL_MACHINE…\Run: [ymsgupdate2] C:\WINDOWS\system32\ymsng2.exe O4 - HKCU…\Run: [ymsgupdate2] C:\WINDOWS\system32\ymsng2.exe O4 - HKCU…\Run: [Odkurzacz-MCD] C:\Program Files\Odkurzacz\odk_mcd.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE O4 - Global Startup: VIA RAID TOOL.lnk = C:\Program Files\VIA\RAID\raid_tool.exe O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/shoc … tor/sw.cab O16 - DPF: {33564D57-9980-0010-8000-00AA00389B71} () - http://download.microsoft.com/download/ … mv9dmo.cab O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} () - http://fpdownload.macromedia.com/get/fl … rashim.cab O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload.macromedia.com/pub/sh … wflash.cab O17 - HKLM\SYSTEM\CCS\Services\Tcpip…{A90F0EFB-1BF7-4C39-A361-DC5064A68205}: NameServer = 194.204.152.34 217.98.63.164 O18 - Protocol: lid - {5C135180-9973-46D9-ABF4-148267CBB8BF} - C:\WINDOWS\system32\msvidctl.dll O20 - Winlogon Notify: awtrrqq - C:\WINDOWS\System32\awtrrqq.dll O20 - Winlogon Notify: geeby - C:\WINDOWS\system32\geeby.dll O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe O23 - Service: Canon Camera Access Library 8 CCALib8seclogon (CCALib8seclogon) - Unknown owner - C:\WINDOWS\System32\acluin.exe srv O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\system32\FTRTSVC.exe O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - “C:\Program Files\Eset\nod32krn.exe” O23 - Service: Windows NT Session Manager (WINNTSMSS) - Unknown owner - “C:\WINDOWS\system\smss.exe” – Files created between 2007-07-28 and 2007-08-28 ----------------------------- 2007-08-28 19:45:14 0 dr-h----- C:\Documents and Settings\Daruś\Recent 2007-08-28 02:43:38 0 d-------- C:\WINDOWS\ERUNT 2007-08-28 02:31:40 0 d-------- C:\Program Files\Odkurzacz 2007-08-28 01:22:26 109056 --a------ C:\WINDOWS\System32\catchme.exe 2007-08-28 01:22:26 9006 --a------ C:\clean.bat 2007-08-28 01:22:25 90112 --a------ C:\WINDOWS\System32\RegDACL.exe 2007-08-28 01:22:25 4096 --a------ C:\WINDOWS\System32\reboot.exe 2007-08-27 00:30:40 113515 --a------ C:\WINDOWS\System32\ymsng2.exe 2007-08-27 00:30:19 2048 --a------ C:\WINDOWS\System32\helperymsng2.exe 2007-08-24 18:35:27 925940 —hs---- C:\WINDOWS\System32\ybeeg.bak2 2007-08-23 22:41:38 6456 —hs---- C:\WINDOWS\System32\ybeeg.bak1 2007-08-23 22:40:57 297568 --a------ C:\WINDOWS\System32\geeby.dll 2007-08-23 22:35:54 43542 --a------ C:\WINDOWS\System32\awtrrqq.dll 2007-08-21 21:08:53 69205 --a------ C:\WINDOWS\System32\msv.exe 2007-08-19 23:29:20 0 d-------- C:\Program Files\Common Files\AVSMedia 2007-08-19 23:29:13 139264 --a------ C:\WINDOWS\System32\xvidvfw.dll 2007-08-19 23:29:13 524288 --a------ C:\WINDOWS\System32\xvidcore.dll 2007-08-19 23:29:12 0 d-------- C:\Program Files\AVS4YOU 2007-08-19 22:48:44 0 d-------- C:\speed_converter 2007-08-19 22:48:35 0 d-------- C:\Program Files\Speed Video Converter 2007-08-19 22:39:33 0 d-------- C:\Program Files\MediaCoder 2007-08-19 19:26:08 0 d-------- C:\Temp 2007-08-19 19:25:21 0 d-------- C:\Program Files\Witcobber 2007-08-19 19:20:42 0 d-------- C:\Program Files\AsfTools 3.1 2007-08-19 19:18:08 0 d-------- C:\Program Files\WMV9_VCM 2007-08-19 19:09:49 0 d-------- C:\Program Files\Absolute Video Converter 2007-08-19 03:58:31 0 d-------- C:\Program Files\WMV To VCD DVD MPEG Converter Pro 2007-08-19 02:29:29 238 --ahs---- C:\WINDOWS\System32\index.dat 2007-08-19 02:29:29 12800 --ahs---- C:\WINDOWS\System32\adadix32p.dll 2007-08-19 02:29:26 337 --ahs---- C:\WINDOWS\System32\3637441342.dat 2007-08-19 02:29:23 61111 -r-hs---- C:\WINDOWS\System32\acluin.exe 2007-08-19 00:22:09 0 d-------- C:\Program Files\Elecard 2007-08-18 22:38:03 0 d-------- C:\Program Files\Common Files\Adobe 2007-08-18 22:37:56 0 d-------- C:\WINDOWS\Downloaded Installations 2007-08-18 22:37:34 0 d-------- C:\Program Files\Google 2007-08-18 21:44:02 0 d—s---- C:\WINDOWS\System32\Microsoft 2007-08-18 21:43:49 0 d-------- C:\Program Files\Lavasoft 2007-08-18 21:43:27 0 d-------- C:\Program Files\Common Files\Wise Installation Wizard 2007-08-18 21:13:22 0 d-------- C:\Program Files\Yahoo! 2007-08-18 21:13:14 0 d-------- C:\Program Files\CCleaner 2007-08-18 12:17:42 0 d-------- C:\Program Files\VideoLAN 2007-08-17 20:38:08 298104 --a------ C:\WINDOWS\System32\imon.dll 2007-08-15 14:49:22 127456 --a------ C:\WINDOWS\System32\IPDETECT.EXE 2007-08-15 14:49:21 116992 --a------ C:\WINDOWS\System32\drivers\e4usbaw.sys 2007-08-15 14:49:21 126489 --a------ C:\WINDOWS\System32\drivers\adiusbaw.sys 2007-08-15 14:49:21 126976 --a------ C:\WINDOWS\System32\coclassfast.dll 2007-08-15 14:49:21 24576 --a------ C:\WINDOWS\enddisk32.exe 2007-08-15 14:49:20 135168 --a------ C:\WINDOWS\System32\unaddrv.exe 2007-08-15 14:49:20 152126 --a------ C:\WINDOWS\System32\drivers\L1E9P2.BIN 2007-08-15 14:49:20 64000 --a------ C:\WINDOWS\System32\drivers\e4ldr.sys 2007-08-15 14:49:20 46892 --a------ C:\WINDOWS\System32\ADADIX16.DLL 2007-08-15 14:49:19 152126 --a------ C:\WINDOWS\System32\drivers\L1E9P1.BIN 2007-08-15 14:49:19 152126 --a------ C:\WINDOWS\System32\drivers\L1E9P0.BIN 2007-08-15 14:49:19 152126 --a------ C:\WINDOWS\System32\drivers\L1E9I2.BIN 2007-08-15 14:49:19 152126 --a------ C:\WINDOWS\System32\drivers\L1E9I1.BIN 2007-08-15 14:49:19 152126 --a------ C:\WINDOWS\System32\drivers\L1E9I0.BIN 2007-08-15 14:49:19 152132 --a------ C:\WINDOWS\System32\drivers\L1E4P2.BIN 2007-08-15 14:49:19 152132 --a------ C:\WINDOWS\System32\drivers\L1E4P1.BIN 2007-08-15 14:49:19 152132 --a------ C:\WINDOWS\System32\drivers\L1E4P0.BIN 2007-08-15 14:49:19 152220 --a------ C:\WINDOWS\System32\drivers\L1E4I2.BIN 2007-08-15 14:49:19 152220 --a------ C:\WINDOWS\System32\drivers\L1E4I1.BIN 2007-08-15 14:49:19 152220 --a------ C:\WINDOWS\System32\drivers\L1E4I0.BIN 2007-08-15 14:49:16 0 d-------- C:\Program Files\SAGEM 2007-08-15 14:48:52 0 d-------- C:\WINDOWS\System32\AlertModule 2007-08-15 14:48:50 94208 --a------ C:\WINDOWS\System32\W32n50.dll 2007-08-15 14:48:50 16128 -----n— C:\WINDOWS\System32\PCANDIS5.SYS 2007-08-15 14:48:45 36864 --a------ C:\WINDOWS\System32\IfHelper.dll 2007-08-15 14:48:45 40960 --a------ C:\WINDOWS\System32\FTRTSVC.exe 2007-08-15 13:30:11 32768 --a------ C:\WINDOWS\System32\WooDial2000.dll 2007-08-15 13:24:58 0 d-------- C:\Program Files\Java Web Start 2007-08-15 13:24:51 41068 -----n— C:\WINDOWS\System32\ActPanel.dll 2007-08-15 13:24:51 0 d-------- C:\Program Files\Java 2007-08-15 13:23:36 0 d-------- C:\Program Files\Neostrada TP 2007-08-15 13:23:03 0 d–hs---- C:\WINDOWS\ftpcache 2007-08-14 23:53:31 0 d-------- C:\Program Files\ShaftProfiler 2007-08-14 23:53:24 73216 --a------ C:\WINDOWS\ST6UNST.EXE 2007-08-14 19:16:17 0 d-------- C:\Program Files\Canon 2007-08-14 19:16:16 0 d-------- C:\Program Files\Common Files\Canon 2007-08-14 19:12:42 438272 --a------ C:\WINDOWS\System32\vp6vfw.dll 2007-08-14 19:12:42 118832 --a------ C:\WINDOWS\System32\SHW32.DLL 2007-08-14 19:04:05 0 d-------- C:\Program Files\EA SPORTS 2007-08-14 19:02:35 0 d-------- C:\WINDOWS\RegisteredPackages 2007-08-14 19:02:01 1769472 --a------ C:\WINDOWS\System32\dxdiagn.dll 2007-08-14 19:02:01 1703936 --a------ C:\WINDOWS\System32\d3d9.dll 2007-08-14 18:40:28 143872 --a------ C:\WINDOWS\System32\iacenc.dll 2007-08-14 18:39:19 204857 --a------ C:\WINDOWS\System32\InstallHelp.dll 2007-08-14 18:39:19 107293 --a------ C:\WINDOWS\System32\GMTUninstall.exe 2007-08-14 18:39:19 0 d-------- C:\Program Files\Friendly Software 2007-08-14 17:46:51 0 d-------- C:\Program Files\DivX 2007-08-14 17:45:59 0 d-------- C:\WINDOWS\Application Data 2007-08-14 17:45:55 0 d-------- C:\Program Files\V1 Home 2.0 2007-08-14 17:45:55 0 d-------- C:\Program Files\Common Files\Moonlight 2007-08-14 16:11:44 0 d-------- C:\Program Files\Realtek Sound Manager 2007-08-14 16:11:43 0 d-------- C:\Program Files\AvRack 2007-08-14 16:11:37 40960 -----n— C:\WINDOWS\System32\ChCfg.exe 2007-08-14 16:11:30 208896 -----n— C:\WINDOWS\alcupd.exe 2007-08-14 16:11:30 139264 -----n— C:\WINDOWS\alcrmv.exe 2007-08-14 16:10:47 0 d-------- C:\Program Files\AMD 2007-08-14 16:10:24 0 d–h----- C:\Program Files\InstallShield Installation Information 2007-08-14 16:08:24 0 d-------- C:\Program Files\VIA 2007-08-14 16:08:14 0 d-------- C:\Program Files\Common Files\InstallShield 2007-08-14 16:06:54 0 d-------- C:\WINDOWS\System32\ReinstallBackups 2007-08-14 16:06:48 306688 --a------ C:\WINDOWS\IsUninst.exe 2007-08-14 14:33:58 0 d-------- C:\WINDOWS\ShellNew 2007-08-14 14:32:47 0 d-------- C:\WINDOWS\Twain32 2007-08-14 12:57:15 0 d—s---- C:\Documents and Settings\Daruś\UserData 2007-08-14 12:57:14 0 d-------- C:\Documents and Settings\Daruś\tvunetworks 2007-08-14 12:49:17 0 d-------- C:\Documents and Settings\Daruś\Gadu-Gadu 2007-08-14 12:48:53 0 d-------- C:\Documents and Settings\Daruś\Application Data 2007-08-14 12:48:53 0 d-------- C:\Documents and Settings\Daruś\Application Data\Microsoft 2007-08-14 12:48:15 0 d-------- C:\Documents and Settings\Daruś.jpi_cache 2007-08-14 12:48:15 0 d-------- C:\Documents and Settings\Daruś.javaws 2007-08-14 12:48:15 0 d-------- C:\Documents and Settings\Daruś.java 2007-08-14 12:48:15 0 d-------- C:\Documents and Settings\Daruś.autodesk 2007-08-14 12:33:29 0 d–hs---- C:\WINDOWS\Installer 2007-08-14 12:33:19 0 d–h----- C:\Documents and Settings\Daruś\Ustawienia lokalne 2007-08-14 12:33:19 0 dr------- C:\Documents and Settings\Daruś\Ulubione 2007-08-14 12:33:19 0 d–h----- C:\Documents and Settings\Daruś\Szablony 2007-08-14 12:33:19 0 dr-h----- C:\Documents and Settings\Daruś\SendTo 2007-08-14 12:33:19 0 d-------- C:\Documents and Settings\Daruś\Pulpit 2007-08-14 12:33:19 0 d–h----- C:\Documents and Settings\Daruś\PrintHood 2007-08-14 12:33:19 0 d–h----- C:\Documents and Settings\Daruś\NetHood 2007-08-14 12:33:19 0 dr------- C:\Documents and Settings\Daruś\Moje dokumenty 2007-08-14 12:33:19 0 dr------- C:\Documents and Settings\Daruś\Menu Start 2007-08-14 12:33:19 0 dr-h----- C:\Documents and Settings\Daruś\Dane aplikacji 2007-08-14 12:33:19 0 d—s---- C:\Documents and Settings\Daruś\Cookies 2007-08-14 12:33:18 2359296 --ah----- C:\Documents and Settings\Daruś\NTUSER.DAT 2007-08-14 12:28:37 0 d–hs---- C:\System Volume Information 2007-08-14 12:28:36 0 d-------- C:\WINDOWS\Prefetch 2007-08-14 11:45:17 0 d-------- C:\WINDOWS 2007-08-14 11:45:17 0 d-------- C:\WINDOWS\WinSxS 2007-08-14 11:45:17 0 dr------- C:\WINDOWS\Web 2007-08-14 11:45:17 0 d-------- C:\WINDOWS\twain_32 2007-08-14 11:45:17 0 d-------- C:\WINDOWS\system32 2007-08-14 11:45:17 0 d-------- C:\WINDOWS\System32\wins 2007-08-14 11:45:17 0 d-------- C:\WINDOWS\System32\wbem 2007-08-14 11:45:17 0 d-------- C:\WINDOWS\System32\usmt 2007-08-14 11:45:17 0 d-------- C:\WINDOWS\System32\spool 2007-08-14 11:45:17 0 d-------- C:\WINDOWS\System32\ShellExt 2007-08-14 11:45:17 0 d-------- C:\WINDOWS\System32\Setup 2007-08-14 11:45:17 0 d-------- C:\WINDOWS\System32\ras 2007-08-14 11:45:17 0 d-------- C:\WINDOWS\System32\oobe 2007-08-14 11:45:17 0 d-------- C:\WINDOWS\System32\npp 2007-08-14 11:45:17 0 d-------- C:\WINDOWS\System32\mui 2007-08-14 11:45:17 0 d-------- C:\WINDOWS\System32\inetsrv 2007-08-14 11:45:17 0 d-------- C:\WINDOWS\System32\IME 2007-08-14 11:45:17 0 d-------- C:\WINDOWS\System32\icsxml 2007-08-14 11:45:17 0 d-------- C:\WINDOWS\System32\ias 2007-08-14 11:45:17 0 d-------- C:\WINDOWS\System32\export 2007-08-14 11:45:17 0 d-------- C:\WINDOWS\System32\drivers 2007-08-14 11:45:17 0 d-------- C:\WINDOWS\System32\drivers\etc 2007-08-14 11:45:17 0 d-------- C:\WINDOWS\System32\drivers\disdn 2007-08-14 11:45:17 0 dr-hs–c- C:\WINDOWS\System32\dllcache 2007-08-14 11:45:17 0 d-------- C:\WINDOWS\System32\dhcp 2007-08-14 11:45:17 0 d-------- C:\WINDOWS\System32\config 2007-08-14 11:45:17 0 d-------- C:\WINDOWS\System32\3com_dmi 2007-08-14 11:45:17 0 d-------- C:\WINDOWS\System32\3076 2007-08-14 11:45:17 0 d-------- C:\WINDOWS\System32\2052 2007-08-14 11:45:17 0 d-------- C:\WINDOWS\System32\1054 2007-08-14 11:45:17 0 d-------- C:\WINDOWS\System32\1045 2007-08-14 11:45:17 0 d-------- C:\WINDOWS\System32\1042 2007-08-14 11:45:17 0 d-------- C:\WINDOWS\System32\1041 2007-08-14 11:45:17 0 d-------- C:\WINDOWS\System32\1037 2007-08-14 11:45:17 0 d-------- C:\WINDOWS\System32\1033 2007-08-14 11:45:17 0 d-------- C:\WINDOWS\System32\1031 2007-08-14 11:45:17 0 d-------- C:\WINDOWS\System32\1028 2007-08-14 11:45:17 0 d-------- C:\WINDOWS\System32\1025 2007-08-14 11:45:17 0 d-------- C:\WINDOWS\system 2007-08-14 11:45:17 0 d-------- C:\WINDOWS\security 2007-08-14 11:45:17 0 d-------- C:\WINDOWS\Resources 2007-08-14 11:45:17 0 d-------- C:\WINDOWS\repair 2007-08-14 11:45:17 0 d-------- C:\WINDOWS\mui 2007-08-14 11:45:17 0 d-------- C:\WINDOWS\msapps 2007-08-14 11:45:17 0 d-------- C:\WINDOWS\msagent 2007-08-14 11:45:17 0 d-------- C:\WINDOWS\Media 2007-08-14 11:45:17 0 d-------- C:\WINDOWS\java 2007-08-14 11:45:17 0 d–h----- C:\WINDOWS\inf 2007-08-14 11:45:17 0 d-------- C:\WINDOWS\ime 2007-08-14 11:45:17 0 d-------- C:\WINDOWS\Help 2007-08-14 11:45:17 0 dr–s---- C:\WINDOWS\Fonts 2007-08-14 11:45:17 0 d-------- C:\WINDOWS\Driver Cache 2007-08-14 11:45:17 0 d-------- C:\WINDOWS\Debug 2007-08-14 11:45:17 0 d-------- C:\WINDOWS\Cursors 2007-08-14 11:45:17 0 d-------- C:\WINDOWS\Connection Wizard 2007-08-14 11:45:17 0 d-------- C:\WINDOWS\Config 2007-08-14 11:45:17 0 d-------- C:\WINDOWS\AppPatch 2007-08-14 11:45:17 0 d-------- C:\WINDOWS\addins 2007-08-14 11:16:24 0 d-------- C:\WINDOWS\System32\xircom 2007-08-14 11:16:24 0 d-------- C:\Program Files\microsoft frontpage 2007-08-14 11:16:06 0 -rahs---- C:\MSDOS.SYS 2007-08-14 11:16:06 0 -rahs---- C:\IO.SYS 2007-08-14 11:16:06 0 --a------ C:\CONFIG.SYS 2007-08-14 11:16:06 0 --a------ C:\AUTOEXEC.BAT 2007-08-14 11:15:06 0 dr------- C:\WINDOWS\Offline Web Pages 2007-08-14 11:15:06 0 d—s---- C:\WINDOWS\Downloaded Program Files 2007-08-14 11:14:34 0 d-------- C:\WINDOWS\srchasst 2007-08-14 11:14:22 0 d-------- C:\WINDOWS\System32\DirectX 2007-08-14 11:14:21 0 d-------- C:\WINDOWS\System32\Macromed 2007-08-14 11:13:48 0 d-------- C:\Program Files\Movie Maker 2007-08-14 11:12:50 0 d-------- C:\WINDOWS\System32\Restore 2007-08-14 11:12:39 0 d-------- C:\WINDOWS\PCHEALTH 2007-08-14 11:12:25 0 d—s---- C:\WINDOWS\Tasks 2007-08-14 11:12:18 0 d-------- C:\Program Files\Common Files\MSSoap 2007-08-14 11:11:43 21856 --a------ C:\WINDOWS\System32\emptyregdb.dat 2007-08-14 11:11:28 0 d-------- C:\WINDOWS\Registration 2007-08-14 11:11:21 0 d–h----- C:\Program Files\WindowsUpdate 2007-08-14 11:11:21 0 d-------- C:\Program Files\Usługi online 2007-08-14 11:11:15 0 d-------- C:\Program Files\Messenger 2007-08-14 11:10:54 0 d-------- C:\Program Files\MSN Gaming Zone 2007-08-14 11:10:37 0 d-------- C:\Program Files\Windows NT 2007-08-14 11:10:12 0 d-------- C:\WINDOWS\System32\MsDtc 2007-08-14 11:10:06 0 d-------- C:\WINDOWS\System32\Com 2007-08-14 10:51:08 0 d-------- C:\Program Files\Common Files\ODBC 2007-08-14 10:51:01 0 d-------- C:\Program Files\Common Files\SpeechEngines 2007-08-14 10:51:00 0 dr------- C:\Program Files 2007-08-14 10:51:00 0 d-------- C:\Program Files\Common Files 2007-08-14 10:49:36 0 d-------- C:\WINDOWS\System32\CatRoot2 2007-08-14 10:49:36 0 d-------- C:\WINDOWS\System32\CatRoot 2007-08-14 10:49:17 0 d-------- C:\Documents and Settings – Find3M Report --------------------------------------------------------------- 2007-08-20 02:15:47 0 d-------- C:\Documents and Settings\Daruś\Dane aplikacji\Adobe 2007-08-19 23:31:26 0 d-------- C:\Documents and Settings\Daruś\Dane aplikacji\AVS4YOU 2007-08-19 00:08:50 0 d-------- C:\Documents and Settings\Daruś\Dane aplikacji\Google 2007-08-15 15:12:13 355830 --a------ C:\WINDOWS\System32\perfh015.dat 2007-08-15 15:12:13 49712 --a------ C:\WINDOWS\System32\perfc015.dat 2007-08-14 14:32:47 0 d-------- C:\Documents and Settings\Daruś\Dane aplikacji\Microsoft Web Folders 2007-08-14 12:49:17 0 d-------- C:\Documents and Settings\Daruś\Dane aplikacji\ACD Systems 2007-08-14 12:49:16 0 d-------- C:\Documents and Settings\Daruś\Dane aplikacji\CyberLink 2007-08-14 12:49:16 0 d-------- C:\Documents and Settings\Daruś\Dane aplikacji\Canon 2007-08-14 12:49:16 0 d-------- C:\Documents and Settings\Daruś\Dane aplikacji\ATI 2007-08-14 12:49:16 0 d-------- C:\Documents and Settings\Daruś\Dane aplikacji\Apple Computer 2007-08-14 12:49:16 0 d-------- C:\Documents and Settings\Daruś\Dane aplikacji\AdobeUM 2007-08-14 12:49:16 0 d-------- C:\Documents and Settings\Daruś\Dane aplikacji\AdobeAUM 2007-08-14 12:49:15 0 d-------- C:\Documents and Settings\Daruś\Dane aplikacji\Identities 2007-08-14 12:49:15 0 d-------- C:\Documents and Settings\Daruś\Dane aplikacji\Help 2007-08-14 12:49:15 0 d-------- C:\Documents and Settings\Daruś\Dane aplikacji\GanymedeNet 2007-08-14 12:49:13 0 d-------- C:\Documents and Settings\Daruś\Dane aplikacji\Macromedia 2007-08-14 12:49:13 0 d-------- C:\Documents and Settings\Daruś\Dane aplikacji\Leadertech 2007-08-14 12:49:13 0 d-------- C:\Documents and Settings\Daruś\Dane aplikacji\Lavasoft 2007-08-14 12:49:10 0 d-------- C:\Documents and Settings\Daruś\Dane aplikacji\Mozilla 2007-08-14 12:49:09 0 d-------- C:\Documents and Settings\Daruś\Dane aplikacji\Skype 2007-08-14 12:49:09 0 d-------- C:\Documents and Settings\Daruś\Dane aplikacji\Real 2007-08-14 12:49:09 0 d-------- C:\Documents and Settings\Daruś\Dane aplikacji\Petroglyph 2007-08-14 12:49:08 0 d-------- C:\Documents and Settings\Daruś\Dane aplikacji\Xfire 2007-08-14 12:49:08 0 d-------- C:\Documents and Settings\Daruś\Dane aplikacji\vlc 2007-08-14 12:49:08 0 d-------- C:\Documents and Settings\Daruś\Dane aplikacji\TVU networks 2007-08-14 12:49:08 0 d-------- C:\Documents and Settings\Daruś\Dane aplikacji\Symantec 2007-08-14 12:49:08 0 d-------- C:\Documents and Settings\Daruś\Dane aplikacji\SopCast 2007-06-07 21:10:48 20480 --a------ C:\WINDOWS\System32\ac3config.exe – Registry Dump --------------------------------------------------------------- *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE~\Browser Helper Objects{3088F9C5-1615-4A0B-88B7-E818FA391A2B}] 2007-08-23 22:35 43542 --a------ C:\WINDOWS\System32\awtrrqq.dll [HKEY_LOCAL_MACHINE~\Browser Helper Objects{4A8AEBC2-C3F3-4221-8CAB-03A5ADA5EA6B}] 2007-08-23 22:41 297568 --a------ C:\WINDOWS\System32\geeby.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “VTTimer”=“VTTimer.exe” [2005-03-07 21:33 C:\WINDOWS\system32\VTTimer.exe] “VTTrayp”=“VTtrayp.exe” [2005-01-11 01:33 C:\WINDOWS\system32\VTTrayp.exe] “SoundMan”=“SOUNDMAN.EXE” [2004-12-22 11:09 C:\WINDOWS\SOUNDMAN.EXE] “WOOWATCH”=“C:\PROGRA~1\NEOSTR~1\Watch.exe” [2004-08-23 14:49] “WOOTASKBARICON”=“C:\PROGRA~1\NEOSTR~1\GestMaj.exe” [2004-10-14 16:55] “nod32kui”=“C:\Program Files\Eset\nod32kui.exe” [2007-08-17 20:36] “Adobe Photo Downloader”=“C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe” [2007-03-09 11:09] “Adobe Reader Speed Launcher”=“C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe” [2007-05-11 03:06] “ymsgupdate2”=“C:\WINDOWS\system32\ymsng2.exe” [2007-08-28 02:05] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “ymsgupdate2”=“C:\WINDOWS\system32\ymsng2.exe” [2007-08-28 02:05] “Odkurzacz-MCD”=“C:\Program Files\Odkurzacz\odk_mcd.exe” [2007-05-03 10:02] C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\ Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office\OSA9.EXE [2000-01-21 08:15:54] VIA RAID TOOL.lnk - C:\Program Files\VIA\RAID\raid_tool.exe [2007-08-14 16:12:53] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks] “{3088F9C5-1615-4A0B-88B7-E818FA391A2B}”= C:\WINDOWS\System32\awtrrqq.dll [2007-08-23 22:35 43542] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\awtrrqq] awtrrqq.dll 2007-08-23 22:35 43542 C:\WINDOWS\system32\awtrrqq.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\geeby] C:\WINDOWS\System32\geeby.dll 2007-08-23 22:41 297568 C:\WINDOWS\system32\geeby.dll [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice] @=“Service” – End of Deckard’s System Scanner: finished at 2007-08-28 21:44:59 ------------

Dzięki z góry za pomoc, Panowie. Pozdrawiam.

Złączono Posta : 28.08.2007 (Wto) 21:48

…P.S. te Canony to prawdopodobnie z płyty instalacyjnej od aparatu cyfrowego.

Złączono Posta : 28.08.2007 (Wto) 21:54

…P.S. 2. Przeskanowałem po tych operacjach NOD-em, który usunął 3 wirusy, natomiast jeden pozostawił (brak było opcji “usuń”); oto on:

C:\Documents and Settings\Daruś\Moje dokumenty\SDFix.exe »RAR »SDFix\apps\Process.exe - Win32/PrcView Program

[Gutek]

[HKEY_LOCAL_MACHINE~\Browser Helper Objects{3088F9C5-1615-4A0B-88B7-E818FA391A2B}] 2007-08-23 22:35 43542 --a------ C:\WINDOWS\System32\awtrrqq.dll [HKEY_LOCAL_MACHINE~\Browser Helper Objects{4A8AEBC2-C3F3-4221-8CAB-03A5ADA5EA6B}] 2007-08-23 22:41 297568 --a------ C:\WINDOWS\System32\geeby.dll HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks] “{3088F9C5-1615-4A0B-88B7-E818FA391A2B}”= C:\WINDOWS\System32\awtrrqq.dll [2007-08-23 22:35 43542] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\awtrrqq] awtrrqq.dll 2007-08-23 22:35 43542 C:\WINDOWS\system32\awtrrqq.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\geeby] C:\WINDOWS\System32\geeby.dll 2007-08-23 22:41 297568 C:\WINDOWS\system32\geeby.dll

Użyj w trybie awaryjnym VundoFix + Trojan.Vundo Removal Tool + VirtumundoBeGone.

Otwórz notatnik i wklej:

Windows Registry Editor Version 5.00 [-HKEY_LOCAL_MACHINE~\Browser Helper Objects{3088F9C5-1615-4A0B-88B7-E818FA391A2B}] [-HKEY_LOCAL_MACHINE~\Browser Helper Objects{4A8AEBC2-C3F3-4221-8CAB-03A5ADA5EA6B}] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks] “{3088F9C5-1615-4A0B-88B7-E818FA391A2B}”=- [-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\awtrrqq] [-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\geeby]

Plik >>> Zapisz jako >>> Zmień rozszerzenie z TXT na Wszystkie pliki >>> Zapisz pod nazwą FIX.REG >>> kliknij dwa razy na utworzony plik FIX.REG i potwierdź dodanie do rejestru >>> restart.

Po tym nowy log z DSS

[Dariusz_J]

Jest mały problem - ściągnąłem te 3 programy, ale nie mogę uruchomić kompa w trybie awaryjnym - F9 nie działa.

W międzyczasie przeskanowałem jednym z ww. programów i:

Symantec Trojan.Vundo Removal Tool 1.5.0 The process “IEXPLORE.EXE” might be affected by the threat. It has been suspended. The process “IEXPLORE.EXE” might be affected by the threat. It has been terminated. C:\Documents and Settings\Daru?: (not scanned) C:\System Volume Information: (not scanned) Trojan.Vundo has been successfully removed from your computer! Here is the report: The total number of the scanned files: 39414 The number of deleted files: 0 The number of viral processes terminated: 1 The number of viral processes suspended: 1 The number of viral threads terminated: 0 The number of registry entries fixed: 0

natomiast Virtmundo niespecjalnie chce działać - chce restartować mi kompa i nie wiem, czy mam mu na to pozwolić.

Pozdrawiam

[Gutek]

W momencie kiedy komputer się resetuje i ma jeszcze czarny ekran klikamy nieustannie i bardzo szybko w klawisz F8. Na starszych kompach ta metoda może się nie sprawdzić gdyż klawisz F8 może być wyłączony lub może być przypisany inny. Np. jeśli komuś po kliknięciu w F8 wyskoczy wybór urządzenia bootującego to znaczy, że u niego klawiszem dzięki, któremu przechodzi się w tryb awaryjny prawdopodobnie jest F5. Problem z metodą F8 polega na strzelaniu w ten klawisz WE WŁAŚCIWYM MOMENCIE: na czarnym ekranie ale nie za wcześnie (inaczej wystąpi błąd klawiatury) i nie za późno (inaczej załaduje się Windows w trybie Normalnym).

[Dariusz_J]

OK, small update:

przeskanowałem w normalnym trybie i żaden z 3 programów nie znajduje już podejrzanego pliku - zaraz pokombinuję jeszcze z F5.

[jessica]

O4 - HKEY_LOCAL_MACHINE…\Run: [ymsgupdate2] C:\WINDOWS\system32\ymsng2.exe O4 - HKCU…\Run: [ymsgupdate2] C:\WINDOWS\system32\ymsng2.exe

To są wpisy Trojana Slapew.B (+ukryty Keylogger)

O23 - Service: Canon Camera Access Library 8 CCALib8seclogon (CCALib8seclogon) - Unknown owner - C:\WINDOWS\System32\acluin.exe srv

To jest usługa Trojana Cimuz.CM (+ukryty Keylogger)

O23 - Service: Windows NT Session Manager (WINNTSMSS) - Unknown owner - “C:\WINDOWS\system\smss.exe”

To jest usługa Trojana/Crypt.ULPM.Gen

2007-08-21 21:08:53 69205 --a------ C:\WINDOWS\System32\msv.exe

To jest plik robaka WORM Ircbot Gen (Keylogger)

2007-08-19 02:29:29 238 --ahs---- C:\WINDOWS\System32\index.dat 2007-08-19 02:29:29 12800 --ahs---- C:\WINDOWS\System32\adadix32p.dll 2007-08-19 02:29:26 337 --ahs---- C:\WINDOWS\System32\3637441342.dat 2007-08-19 02:29:23 61111 -r-hs---- C:\WINDOWS\System32\acluin.exe

Te pliki są nieznane, ale jak widać, powstały zaraz po infekcji Cimuz.CM, który specjalizuje się w wykradaniu haseł, bo jest Keyloggerem. Tak więc te pliki są na 99% danymi zebranymi przez Keyloggera i przygotowane do wysłania.

2007-08-24 18:35:27 925940 —hs---- C:\WINDOWS\System32\ybeeg.bak2 2007-08-23 22:41:38 6456 —hs---- C:\WINDOWS\System32\ybeeg.bak1 2007-08-23 22:40:57 297568 --a------ C:\WINDOWS\System32\geeby.dll 2007-08-23 22:35:54 43542 --a------ C:\WINDOWS\System32\awtrrqq.dll

No te należą do VUNDO.

Nie wiem, jaka sytuacja jest teraz, ale jeśli w logach są dalej te w/w wpisy, to nie zapomnij o usunięciu tych szkodliwych usług, tych szkodliwych plików i tych wpisów.

jessi

[Dariusz_J]

teraz sytuacja jest następująca:

• udało sie uruchomić tryb awaryjny (dzięki za podpowiedź, Gutek), przeskanowałem tymi 3 programami - nic nie wykryły;

• korzystając z bytności w trybie awaryjnym włączyłem SdFix:

SDFix: Version 1.100 Run by Daru on 2007-08-28 at 23:23 Microsoft Windows XP [Wersja 5.1.2600] Running From: C:\SDFix Safe Mode: Checking Services: Restoring Windows Registry Values Restoring Windows Default Hosts File Rebooting… Normal Mode: Checking Files: Trojan Files Found: C:\DOCUME~1\DARU~1\USTAWI~1\Temp\nsp4.tmp - Deleted Removing Temp Files… ADS Check: C:\WINDOWS No streams found. C:\WINDOWS\system32 No streams found. C:\WINDOWS\system32\svchost.exe No streams found. C:\WINDOWS\system32\ntoskrnl.exe No streams found. Final Check: Remaining Services: ------------------ Authorized Application Key Export: Remaining Files: --------------- File Backups: - C:\SDFix\backups\backups.zip Files with Hidden Attributes: C:\WINDOWS\system32\adadix32p.dll C:\WINDOWS\system32\acluin.exe Finished

Jessi, dzieki za analizę. Mam usunąć wymienione przez Ciebie logi poprzez Deckarda ?

I co z tym, o czym Gutek pisał ?

Otwórz notatnik i wklej: Cytat: Windows Registry Editor Version 5.00 [-HKEY_LOCAL_MACHINE~\Browser Helper Objects{3088F9C5-1615-4A0B-88B7-E818FA391A2B}] [-HKEY_LOCAL_MACHINE~\Browser Helper Objects{4A8AEBC2-C3F3-4221-8CAB-03A5ADA5EA6B}] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks] “{3088F9C5-1615-4A0B-88B7-E818FA391A2B}”=- [-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\awtrrqq] [-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\geeby] Plik >>> Zapisz jako >>> Zmień rozszerzenie z TXT na Wszystkie pliki >>> Zapisz pod nazwą FIX.REG >>> kliknij dwa razy na utworzony plik FIX.REG i potwierdź dodanie do rejestru >>> restart. Po tym nowy log z DSS

Pozdrawiam

Złączono Posta : 28.08.2007 (Wto) 23:44

…i aktualny log z Deckarda:

Deckard’s System Scanner v20070826.66 Run by Daruś on 2007-08-28 23:40:48 Computer is in Normal Mode. -------------------------------------------------------------------------------- Total Physical Memory: 448 MiB (512 MiB recommended). – HijackThis (run as Daruś.exe) ----------------------------------------------- Logfile of HijackThis v1.99.1 Scan saved at 23:40:49, on 2007-08-28 Platform: Windows XP (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 (6.00.2600.0000) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\FTRTSVC.exe C:\Program Files\Eset\nod32krn.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Canon\CAL\CALMAIN.exe C:\WINDOWS\System32\VTTimer.exe C:\WINDOWS\System32\VTtrayp.exe C:\WINDOWS\SOUNDMAN.EXE C:\Program Files\Eset\nod32kui.exe C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe C:\PROGRA~1\NEOSTR~1\TaskBarIcon.exe C:\Program Files\VIA\RAID\raid_tool.exe C:\PROGRA~1\NEOSTR~1\neostradatp.exe C:\PROGRA~1\NEOSTR~1\ComComp.exe C:\PROGRA~1\NEOSTR~1\Toaster.exe C:\PROGRA~1\NEOSTR~1\Inactivity.exe C:\PROGRA~1\NEOSTR~1\PollingModule.exe C:\WINDOWS\System32\ALERTM~1\ALERTM~1.EXE C:\PROGRA~1\NEOSTR~1\Watch.exe C:\Documents and Settings\Daruś\Pulpit\dss.exe C:\DOCUME~1\DARU~1\Pulpit\DARU~1.EXE R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.wp.pl/ R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = neostrada tp R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O4 - HKLM…\Run: [VTTimer] VTTimer.exe O4 - HKLM…\Run: [VTTrayp] VTtrayp.exe O4 - HKLM…\Run: [soundMan] SOUNDMAN.EXE O4 - HKLM…\Run: [WOOWATCH] C:\PROGRA~1\NEOSTR~1\Watch.exe O4 - HKLM…\Run: [WOOTASKBARICON] C:\PROGRA~1\NEOSTR~1\GestMaj.exe TaskBarIcon.exe O4 - HKLM…\Run: [nod32kui] “C:\Program Files\Eset\nod32kui.exe” /WAITSERVICE O4 - HKLM…\Run: [Adobe Photo Downloader] “C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe” O4 - HKLM…\Run: [Adobe Reader Speed Launcher] “C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe” O4 - HKLM…\Run: [ymsgupdate2] C:\WINDOWS\system32\ymsng2.exe O4 - HKCU…\Run: [ymsgupdate2] C:\WINDOWS\system32\ymsng2.exe O4 - HKCU…\Run: [Odkurzacz-MCD] C:\Program Files\Odkurzacz\odk_mcd.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE O4 - Global Startup: VIA RAID TOOL.lnk = C:\Program Files\VIA\RAID\raid_tool.exe O17 - HKLM\System\CCS\Services\Tcpip…{A90F0EFB-1BF7-4C39-A361-DC5064A68205}: NameServer = 194.204.152.34 217.98.63.164 O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe O23 - Service: Canon Camera Access Library 8 CCALib8seclogon (CCALib8seclogon) - Unknown owner - C:\WINDOWS\System32\acluin.exe O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exe O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe O23 - Service: Windows NT Session Manager (WINNTSMSS) - Unknown owner - C:\WINDOWS\system\smss.exe (file missing) – Files created between 2007-07-28 and 2007-08-28 ----------------------------- 2007-08-28 22:18:44 0 d-------- C:\VundoFix Backups 2007-08-28 19:45:14 0 dr-h----- C:\Documents and Settings\Daruś\Recent 2007-08-28 02:43:38 0 d-------- C:\WINDOWS\ERUNT 2007-08-28 02:31:40 0 d-------- C:\Program Files\Odkurzacz 2007-08-28 01:22:26 109056 --a------ C:\WINDOWS\System32\catchme.exe 2007-08-28 01:22:26 9006 --a------ C:\clean.bat 2007-08-28 01:22:25 90112 --a------ C:\WINDOWS\System32\RegDACL.exe 2007-08-28 01:22:25 4096 --a------ C:\WINDOWS\System32\reboot.exe 2007-08-27 00:30:40 113515 --a------ C:\WINDOWS\System32\ymsng2.exe 2007-08-27 00:30:19 2048 --a------ C:\WINDOWS\System32\helperymsng2.exe 2007-08-24 18:35:27 925940 —hs---- C:\WINDOWS\System32\ybeeg.bak2 2007-08-23 22:41:38 6456 —hs---- C:\WINDOWS\System32\ybeeg.bak1 2007-08-21 21:08:53 69205 --a------ C:\WINDOWS\System32\msv.exe 2007-08-19 23:29:20 0 d-------- C:\Program Files\Common Files\AVSMedia 2007-08-19 23:29:13 139264 --a------ C:\WINDOWS\System32\xvidvfw.dll 2007-08-19 23:29:13 524288 --a------ C:\WINDOWS\System32\xvidcore.dll 2007-08-19 23:29:12 0 d-------- C:\Program Files\AVS4YOU 2007-08-19 22:48:44 0 d-------- C:\speed_converter 2007-08-19 22:48:35 0 d-------- C:\Program Files\Speed Video Converter 2007-08-19 22:39:33 0 d-------- C:\Program Files\MediaCoder 2007-08-19 19:26:08 0 d-------- C:\Temp 2007-08-19 19:25:21 0 d-------- C:\Program Files\Witcobber 2007-08-19 19:20:42 0 d-------- C:\Program Files\AsfTools 3.1 2007-08-19 19:18:08 0 d-------- C:\Program Files\WMV9_VCM 2007-08-19 19:09:49 0 d-------- C:\Program Files\Absolute Video Converter 2007-08-19 03:58:31 0 d-------- C:\Program Files\WMV To VCD DVD MPEG Converter Pro 2007-08-19 02:29:29 238 --ahs---- C:\WINDOWS\System32\index.dat 2007-08-19 02:29:29 12800 --ahs---- C:\WINDOWS\System32\adadix32p.dll 2007-08-19 02:29:26 337 --ahs---- C:\WINDOWS\System32\3637441342.dat 2007-08-19 02:29:23 61111 -r-hs---- C:\WINDOWS\System32\acluin.exe 2007-08-19 00:22:09 0 d-------- C:\Program Files\Elecard 2007-08-18 22:38:03 0 d-------- C:\Program Files\Common Files\Adobe 2007-08-18 22:37:56 0 d-------- C:\WINDOWS\Downloaded Installations 2007-08-18 22:37:34 0 d-------- C:\Program Files\Google 2007-08-18 21:44:02 0 d—s---- C:\WINDOWS\System32\Microsoft 2007-08-18 21:43:49 0 d-------- C:\Program Files\Lavasoft 2007-08-18 21:43:27 0 d-------- C:\Program Files\Common Files\Wise Installation Wizard 2007-08-18 21:13:22 0 d-------- C:\Program Files\Yahoo! 2007-08-18 21:13:14 0 d-------- C:\Program Files\CCleaner 2007-08-18 12:17:42 0 d-------- C:\Program Files\VideoLAN 2007-08-17 20:38:08 298104 --a------ C:\WINDOWS\System32\imon.dll 2007-08-15 14:49:22 127456 --a------ C:\WINDOWS\System32\IPDETECT.EXE 2007-08-15 14:49:21 116992 --a------ C:\WINDOWS\System32\drivers\e4usbaw.sys 2007-08-15 14:49:21 126489 --a------ C:\WINDOWS\System32\drivers\adiusbaw.sys 2007-08-15 14:49:21 126976 --a------ C:\WINDOWS\System32\coclassfast.dll 2007-08-15 14:49:21 24576 --a------ C:\WINDOWS\enddisk32.exe 2007-08-15 14:49:20 135168 --a------ C:\WINDOWS\System32\unaddrv.exe 2007-08-15 14:49:20 152126 --a------ C:\WINDOWS\System32\drivers\L1E9P2.BIN 2007-08-15 14:49:20 64000 --a------ C:\WINDOWS\System32\drivers\e4ldr.sys 2007-08-15 14:49:20 46892 --a------ C:\WINDOWS\System32\ADADIX16.DLL 2007-08-15 14:49:19 152126 --a------ C:\WINDOWS\System32\drivers\L1E9P1.BIN 2007-08-15 14:49:19 152126 --a------ C:\WINDOWS\System32\drivers\L1E9P0.BIN 2007-08-15 14:49:19 152126 --a------ C:\WINDOWS\System32\drivers\L1E9I2.BIN 2007-08-15 14:49:19 152126 --a------ C:\WINDOWS\System32\drivers\L1E9I1.BIN 2007-08-15 14:49:19 152126 --a------ C:\WINDOWS\System32\drivers\L1E9I0.BIN 2007-08-15 14:49:19 152132 --a------ C:\WINDOWS\System32\drivers\L1E4P2.BIN 2007-08-15 14:49:19 152132 --a------ C:\WINDOWS\System32\drivers\L1E4P1.BIN 2007-08-15 14:49:19 152132 --a------ C:\WINDOWS\System32\drivers\L1E4P0.BIN 2007-08-15 14:49:19 152220 --a------ C:\WINDOWS\System32\drivers\L1E4I2.BIN 2007-08-15 14:49:19 152220 --a------ C:\WINDOWS\System32\drivers\L1E4I1.BIN 2007-08-15 14:49:19 152220 --a------ C:\WINDOWS\System32\drivers\L1E4I0.BIN 2007-08-15 14:49:16 0 d-------- C:\Program Files\SAGEM 2007-08-15 14:48:52 0 d-------- C:\WINDOWS\System32\AlertModule 2007-08-15 14:48:50 94208 --a------ C:\WINDOWS\System32\W32n50.dll 2007-08-15 14:48:50 16128 -----n— C:\WINDOWS\System32\PCANDIS5.SYS 2007-08-15 14:48:45 36864 --a------ C:\WINDOWS\System32\IfHelper.dll 2007-08-15 14:48:45 40960 --a------ C:\WINDOWS\System32\FTRTSVC.exe 2007-08-15 13:30:11 32768 --a------ C:\WINDOWS\System32\WooDial2000.dll 2007-08-15 13:24:58 0 d-------- C:\Program Files\Java Web Start 2007-08-15 13:24:51 41068 -----n— C:\WINDOWS\System32\ActPanel.dll 2007-08-15 13:24:51 0 d-------- C:\Program Files\Java 2007-08-15 13:23:36 0 d-------- C:\Program Files\Neostrada TP 2007-08-15 13:23:03 0 d–hs---- C:\WINDOWS\ftpcache 2007-08-14 23:53:31 0 d-------- C:\Program Files\ShaftProfiler 2007-08-14 23:53:24 73216 --a------ C:\WINDOWS\ST6UNST.EXE 2007-08-14 19:16:17 0 d-------- C:\Program Files\Canon 2007-08-14 19:16:16 0 d-------- C:\Program Files\Common Files\Canon 2007-08-14 19:12:42 438272 --a------ C:\WINDOWS\System32\vp6vfw.dll 2007-08-14 19:12:42 118832 --a------ C:\WINDOWS\System32\SHW32.DLL 2007-08-14 19:04:05 0 d-------- C:\Program Files\EA SPORTS 2007-08-14 19:02:35 0 d-------- C:\WINDOWS\RegisteredPackages 2007-08-14 19:02:01 1769472 --a------ C:\WINDOWS\System32\dxdiagn.dll 2007-08-14 19:02:01 1703936 --a------ C:\WINDOWS\System32\d3d9.dll 2007-08-14 18:40:28 143872 --a------ C:\WINDOWS\System32\iacenc.dll 2007-08-14 18:39:19 204857 --a------ C:\WINDOWS\System32\InstallHelp.dll 2007-08-14 18:39:19 107293 --a------ C:\WINDOWS\System32\GMTUninstall.exe 2007-08-14 18:39:19 0 d-------- C:\Program Files\Friendly Software 2007-08-14 17:46:51 0 d-------- C:\Program Files\DivX 2007-08-14 17:45:59 0 d-------- C:\WINDOWS\Application Data 2007-08-14 17:45:55 0 d-------- C:\Program Files\V1 Home 2.0 2007-08-14 17:45:55 0 d-------- C:\Program Files\Common Files\Moonlight 2007-08-14 16:11:44 0 d-------- C:\Program Files\Realtek Sound Manager 2007-08-14 16:11:43 0 d-------- C:\Program Files\AvRack 2007-08-14 16:11:37 40960 -----n— C:\WINDOWS\System32\ChCfg.exe 2007-08-14 16:11:30 208896 -----n— C:\WINDOWS\alcupd.exe 2007-08-14 16:11:30 139264 -----n— C:\WINDOWS\alcrmv.exe 2007-08-14 16:10:47 0 d-------- C:\Program Files\AMD 2007-08-14 16:10:24 0 d–h----- C:\Program Files\InstallShield Installation Information 2007-08-14 16:08:24 0 d-------- C:\Program Files\VIA 2007-08-14 16:08:14 0 d-------- C:\Program Files\Common Files\InstallShield 2007-08-14 16:06:54 0 d-------- C:\WINDOWS\System32\ReinstallBackups 2007-08-14 16:06:48 306688 --a------ C:\WINDOWS\IsUninst.exe 2007-08-14 14:33:58 0 d-------- C:\WINDOWS\ShellNew 2007-08-14 14:32:47 0 d-------- C:\WINDOWS\Twain32 2007-08-14 12:57:15 0 d—s---- C:\Documents and Settings\Daruś\UserData 2007-08-14 12:57:14 0 d-------- C:\Documents and Settings\Daruś\tvunetworks 2007-08-14 12:49:17 0 d-------- C:\Documents and Settings\Daruś\Gadu-Gadu 2007-08-14 12:48:53 0 d-------- C:\Documents and Settings\Daruś\Application Data 2007-08-14 12:48:53 0 d-------- C:\Documents and Settings\Daruś\Application Data\Microsoft 2007-08-14 12:48:15 0 d-------- C:\Documents and Settings\Daruś.jpi_cache 2007-08-14 12:48:15 0 d-------- C:\Documents and Settings\Daruś.javaws 2007-08-14 12:48:15 0 d-------- C:\Documents and Settings\Daruś.java 2007-08-14 12:48:15 0 d-------- C:\Documents and Settings\Daruś.autodesk 2007-08-14 12:33:29 0 d–hs---- C:\WINDOWS\Installer 2007-08-14 12:33:19 0 d–h----- C:\Documents and Settings\Daruś\Ustawienia lokalne 2007-08-14 12:33:19 0 dr------- C:\Documents and Settings\Daruś\Ulubione 2007-08-14 12:33:19 0 d–h----- C:\Documents and Settings\Daruś\Szablony 2007-08-14 12:33:19 0 dr-h----- C:\Documents and Settings\Daruś\SendTo 2007-08-14 12:33:19 0 d-------- C:\Documents and Settings\Daruś\Pulpit 2007-08-14 12:33:19 0 d–h----- C:\Documents and Settings\Daruś\PrintHood 2007-08-14 12:33:19 0 d–h----- C:\Documents and Settings\Daruś\NetHood 2007-08-14 12:33:19 0 dr------- C:\Documents and Settings\Daruś\Moje dokumenty 2007-08-14 12:33:19 0 dr------- C:\Documents and Settings\Daruś\Menu Start 2007-08-14 12:33:19 0 dr-h----- C:\Documents and Settings\Daruś\Dane aplikacji 2007-08-14 12:33:19 0 d—s---- C:\Documents and Settings\Daruś\Cookies 2007-08-14 12:33:18 2359296 --ah----- C:\Documents and Settings\Daruś\NTUSER.DAT 2007-08-14 12:28:37 0 d–hs---- C:\System Volume Information 2007-08-14 12:28:36 0 d-------- C:\WINDOWS\Prefetch 2007-08-14 11:45:17 0 d-------- C:\WINDOWS 2007-08-14 11:45:17 0 d-------- C:\WINDOWS\WinSxS 2007-08-14 11:45:17 0 dr------- C:\WINDOWS\Web 2007-08-14 11:45:17 0 d-------- C:\WINDOWS\twain_32 2007-08-14 11:45:17 0 d-------- C:\WINDOWS\system32 2007-08-14 11:45:17 0 d-------- C:\WINDOWS\System32\wins 2007-08-14 11:45:17 0 d-------- C:\WINDOWS\System32\wbem 2007-08-14 11:45:17 0 d-------- C:\WINDOWS\System32\usmt 2007-08-14 11:45:17 0 d-------- C:\WINDOWS\System32\spool 2007-08-14 11:45:17 0 d-------- C:\WINDOWS\System32\ShellExt 2007-08-14 11:45:17 0 d-------- C:\WINDOWS\System32\Setup 2007-08-14 11:45:17 0 d-------- C:\WINDOWS\System32\ras 2007-08-14 11:45:17 0 d-------- C:\WINDOWS\System32\oobe 2007-08-14 11:45:17 0 d-------- C:\WINDOWS\System32\npp 2007-08-14 11:45:17 0 d-------- C:\WINDOWS\System32\mui 2007-08-14 11:45:17 0 d-------- C:\WINDOWS\System32\inetsrv 2007-08-14 11:45:17 0 d-------- C:\WINDOWS\System32\IME 2007-08-14 11:45:17 0 d-------- C:\WINDOWS\System32\icsxml 2007-08-14 11:45:17 0 d-------- C:\WINDOWS\System32\ias 2007-08-14 11:45:17 0 d-------- C:\WINDOWS\System32\export 2007-08-14 11:45:17 0 d-------- C:\WINDOWS\System32\drivers 2007-08-14 11:45:17 0 d-------- C:\WINDOWS\System32\drivers\etc 2007-08-14 11:45:17 0 d-------- C:\WINDOWS\System32\drivers\disdn 2007-08-14 11:45:17 0 dr-hs–c- C:\WINDOWS\System32\dllcache 2007-08-14 11:45:17 0 d-------- C:\WINDOWS\System32\dhcp 2007-08-14 11:45:17 0 d-------- C:\WINDOWS\System32\config 2007-08-14 11:45:17 0 d-------- C:\WINDOWS\System32\3com_dmi 2007-08-14 11:45:17 0 d-------- C:\WINDOWS\System32\3076 2007-08-14 11:45:17 0 d-------- C:\WINDOWS\System32\2052 2007-08-14 11:45:17 0 d-------- C:\WINDOWS\System32\1054 2007-08-14 11:45:17 0 d-------- C:\WINDOWS\System32\1045 2007-08-14 11:45:17 0 d-------- C:\WINDOWS\System32\1042 2007-08-14 11:45:17 0 d-------- C:\WINDOWS\System32\1041 2007-08-14 11:45:17 0 d-------- C:\WINDOWS\System32\1037 2007-08-14 11:45:17 0 d-------- C:\WINDOWS\System32\1033 2007-08-14 11:45:17 0 d-------- C:\WINDOWS\System32\1031 2007-08-14 11:45:17 0 d-------- C:\WINDOWS\System32\1028 2007-08-14 11:45:17 0 d-------- C:\WINDOWS\System32\1025 2007-08-14 11:45:17 0 d-------- C:\WINDOWS\system 2007-08-14 11:45:17 0 d-------- C:\WINDOWS\security 2007-08-14 11:45:17 0 d-------- C:\WINDOWS\Resources 2007-08-14 11:45:17 0 d-------- C:\WINDOWS\repair 2007-08-14 11:45:17 0 d-------- C:\WINDOWS\mui 2007-08-14 11:45:17 0 d-------- C:\WINDOWS\msapps 2007-08-14 11:45:17 0 d-------- C:\WINDOWS\msagent 2007-08-14 11:45:17 0 d-------- C:\WINDOWS\Media 2007-08-14 11:45:17 0 d-------- C:\WINDOWS\java 2007-08-14 11:45:17 0 d–h----- C:\WINDOWS\inf 2007-08-14 11:45:17 0 d-------- C:\WINDOWS\ime 2007-08-14 11:45:17 0 d-------- C:\WINDOWS\Help 2007-08-14 11:45:17 0 dr–s---- C:\WINDOWS\Fonts 2007-08-14 11:45:17 0 d-------- C:\WINDOWS\Driver Cache 2007-08-14 11:45:17 0 d-------- C:\WINDOWS\Debug 2007-08-14 11:45:17 0 d-------- C:\WINDOWS\Cursors 2007-08-14 11:45:17 0 d-------- C:\WINDOWS\Connection Wizard 2007-08-14 11:45:17 0 d-------- C:\WINDOWS\Config 2007-08-14 11:45:17 0 d-------- C:\WINDOWS\AppPatch 2007-08-14 11:45:17 0 d-------- C:\WINDOWS\addins 2007-08-14 11:16:24 0 d-------- C:\WINDOWS\System32\xircom 2007-08-14 11:16:24 0 d-------- C:\Program Files\microsoft frontpage 2007-08-14 11:16:06 0 -rahs---- C:\MSDOS.SYS 2007-08-14 11:16:06 0 -rahs---- C:\IO.SYS 2007-08-14 11:16:06 0 --a------ C:\CONFIG.SYS 2007-08-14 11:16:06 0 --a------ C:\AUTOEXEC.BAT 2007-08-14 11:15:06 0 dr------- C:\WINDOWS\Offline Web Pages 2007-08-14 11:15:06 0 d—s---- C:\WINDOWS\Downloaded Program Files 2007-08-14 11:14:34 0 d-------- C:\WINDOWS\srchasst 2007-08-14 11:14:22 0 d-------- C:\WINDOWS\System32\DirectX 2007-08-14 11:14:21 0 d-------- C:\WINDOWS\System32\Macromed 2007-08-14 11:13:48 0 d-------- C:\Program Files\Movie Maker 2007-08-14 11:12:50 0 d-------- C:\WINDOWS\System32\Restore 2007-08-14 11:12:39 0 d-------- C:\WINDOWS\PCHEALTH 2007-08-14 11:12:25 0 d—s---- C:\WINDOWS\Tasks 2007-08-14 11:12:18 0 d-------- C:\Program Files\Common Files\MSSoap 2007-08-14 11:11:43 21856 --a------ C:\WINDOWS\System32\emptyregdb.dat 2007-08-14 11:11:28 0 d-------- C:\WINDOWS\Registration 2007-08-14 11:11:21 0 d–h----- C:\Program Files\WindowsUpdate 2007-08-14 11:11:21 0 d-------- C:\Program Files\Usługi online 2007-08-14 11:11:15 0 d-------- C:\Program Files\Messenger 2007-08-14 11:10:54 0 d-------- C:\Program Files\MSN Gaming Zone 2007-08-14 11:10:37 0 d-------- C:\Program Files\Windows NT 2007-08-14 11:10:12 0 d-------- C:\WINDOWS\System32\MsDtc 2007-08-14 11:10:06 0 d-------- C:\WINDOWS\System32\Com 2007-08-14 10:51:08 0 d-------- C:\Program Files\Common Files\ODBC 2007-08-14 10:51:01 0 d-------- C:\Program Files\Common Files\SpeechEngines 2007-08-14 10:51:00 0 dr------- C:\Program Files 2007-08-14 10:51:00 0 d-------- C:\Program Files\Common Files 2007-08-14 10:49:36 0 d-------- C:\WINDOWS\System32\CatRoot2 2007-08-14 10:49:36 0 d-------- C:\WINDOWS\System32\CatRoot 2007-08-14 10:49:17 0 d-------- C:\Documents and Settings – Find3M Report --------------------------------------------------------------- 2007-08-20 02:15:47 0 d-------- C:\Documents and Settings\Daruś\Dane aplikacji\Adobe 2007-08-19 23:31:26 0 d-------- C:\Documents and Settings\Daruś\Dane aplikacji\AVS4YOU 2007-08-19 00:08:50 0 d-------- C:\Documents and Settings\Daruś\Dane aplikacji\Google 2007-08-15 15:12:13 355830 --a------ C:\WINDOWS\System32\perfh015.dat 2007-08-15 15:12:13 49712 --a------ C:\WINDOWS\System32\perfc015.dat 2007-08-14 14:32:47 0 d-------- C:\Documents and Settings\Daruś\Dane aplikacji\Microsoft Web Folders 2007-08-14 12:49:17 0 d-------- C:\Documents and Settings\Daruś\Dane aplikacji\ACD Systems 2007-08-14 12:49:16 0 d-------- C:\Documents and Settings\Daruś\Dane aplikacji\CyberLink 2007-08-14 12:49:16 0 d-------- C:\Documents and Settings\Daruś\Dane aplikacji\Canon 2007-08-14 12:49:16 0 d-------- C:\Documents and Settings\Daruś\Dane aplikacji\ATI 2007-08-14 12:49:16 0 d-------- C:\Documents and Settings\Daruś\Dane aplikacji\Apple Computer 2007-08-14 12:49:16 0 d-------- C:\Documents and Settings\Daruś\Dane aplikacji\AdobeUM 2007-08-14 12:49:16 0 d-------- C:\Documents and Settings\Daruś\Dane aplikacji\AdobeAUM 2007-08-14 12:49:15 0 d-------- C:\Documents and Settings\Daruś\Dane aplikacji\Identities 2007-08-14 12:49:15 0 d-------- C:\Documents and Settings\Daruś\Dane aplikacji\Help 2007-08-14 12:49:15 0 d-------- C:\Documents and Settings\Daruś\Dane aplikacji\GanymedeNet 2007-08-14 12:49:13 0 d-------- C:\Documents and Settings\Daruś\Dane aplikacji\Macromedia 2007-08-14 12:49:13 0 d-------- C:\Documents and Settings\Daruś\Dane aplikacji\Leadertech 2007-08-14 12:49:13 0 d-------- C:\Documents and Settings\Daruś\Dane aplikacji\Lavasoft 2007-08-14 12:49:10 0 d-------- C:\Documents and Settings\Daruś\Dane aplikacji\Mozilla 2007-08-14 12:49:09 0 d-------- C:\Documents and Settings\Daruś\Dane aplikacji\Skype 2007-08-14 12:49:09 0 d-------- C:\Documents and Settings\Daruś\Dane aplikacji\Real 2007-08-14 12:49:09 0 d-------- C:\Documents and Settings\Daruś\Dane aplikacji\Petroglyph 2007-08-14 12:49:08 0 d-------- C:\Documents and Settings\Daruś\Dane aplikacji\Xfire 2007-08-14 12:49:08 0 d-------- C:\Documents and Settings\Daruś\Dane aplikacji\vlc 2007-08-14 12:49:08 0 d-------- C:\Documents and Settings\Daruś\Dane aplikacji\TVU networks 2007-08-14 12:49:08 0 d-------- C:\Documents and Settings\Daruś\Dane aplikacji\Symantec 2007-08-14 12:49:08 0 d-------- C:\Documents and Settings\Daruś\Dane aplikacji\SopCast 2007-06-07 21:10:48 20480 --a------ C:\WINDOWS\System32\ac3config.exe – Registry Dump --------------------------------------------------------------- *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “VTTimer”=“VTTimer.exe” [2005-03-07 21:33 C:\WINDOWS\system32\VTTimer.exe] “VTTrayp”=“VTtrayp.exe” [2005-01-11 01:33 C:\WINDOWS\system32\VTTrayp.exe] “SoundMan”=“SOUNDMAN.EXE” [2004-12-22 11:09 C:\WINDOWS\SOUNDMAN.EXE] “WOOWATCH”=“C:\PROGRA~1\NEOSTR~1\Watch.exe” [2004-08-23 14:49] “WOOTASKBARICON”=“C:\PROGRA~1\NEOSTR~1\GestMaj.exe” [2004-10-14 16:55] “nod32kui”=“C:\Program Files\Eset\nod32kui.exe” [2007-08-17 20:36] “Adobe Photo Downloader”=“C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe” [2007-03-09 11:09] “Adobe Reader Speed Launcher”=“C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe” [2007-05-11 03:06] “ymsgupdate2”=“C:\WINDOWS\system32\ymsng2.exe” [2007-08-28 02:05] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “ymsgupdate2”=“C:\WINDOWS\system32\ymsng2.exe” [2007-08-28 02:05] “Odkurzacz-MCD”=“C:\Program Files\Odkurzacz\odk_mcd.exe” [2007-05-03 10:02] C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\ Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office\OSA9.EXE [2000-01-21 08:15:54] VIA RAID TOOL.lnk - C:\Program Files\VIA\RAID\raid_tool.exe [2007-08-14 16:12:53] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice] @=“Service” – End of Deckard’s System Scanner: finished at 2007-08-28 23:41:27 ------------

[jessica]

Czy mam rozumieć, że w ogóle nie masz Hijacka?

w takim razie zrób to:

>>Start >>> Uruchom >>> wybierz (lub wpisz) cmd >> zastosować te komendy (po każdej wciśnij “ENTER”):

SC STOP CCALib8seclogon SC DELETE CCALib8seclogon DEL C:\WINDOWS\System32\acluin.exe SC STOP WINNTSMSS SC DELETE WINNTSMSS DEL C:\WINDOWS\system\smss.exe DEL C:\WINDOWS\system32\ymsng2.exe DEL C:\WINDOWS\System32\msv.exe DEL C:\WINDOWS\System32\index.dat DEL C:\WINDOWS\System32\adadix32p.dll DEL C:\WINDOWS\System32\3637441342.dat DEL C:\WINDOWS\System32\acluin.exe DEL C:\WINDOWS\System32\ybeeg.bak2 DEL C:\WINDOWS\System32\ybeeg.bak1 DEL C:\WINDOWS\System32\geeby.dll DEL C:\WINDOWS\System32\awtrrqq.dll

Następnie:

>>Start >>> Uruchom >>> wybierz (lub wpisz) REGEDIT>>OK> >rozwiń ten klucz: >(+)HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run >>w okienku po prawej zaznacz: “ymsgupdate2”>>prawoklik>>usuń >zwiń ten klucz klikając na (-) >rozwiń ten klucz: >(+)HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run >>w okienku po prawej zaznacz: “ymsgupdate2”>>prawoklik>>usuń >zwiń ten klucz klikając na (-)

Potem daj nowy log z Deckarda.

jessi

[Dariusz_J]

Jessi, mam HiJacka, ale zrobiłem w DOSie wg. Twojej instrukcji.

Oto najnowszy Deckard:

Deckard’s System Scanner v20070826.66 Run by Daruś on 2007-08-29 00:32:54 Computer is in Normal Mode. -------------------------------------------------------------------------------- Total Physical Memory: 448 MiB (512 MiB recommended). – HijackThis (run as Daruś.exe) ----------------------------------------------- Logfile of HijackThis v1.99.1 Scan saved at 00:32:57, on 2007-08-29 Platform: Windows XP (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 (6.00.2600.0000) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\FTRTSVC.exe C:\Program Files\Eset\nod32krn.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Canon\CAL\CALMAIN.exe C:\WINDOWS\System32\VTTimer.exe C:\WINDOWS\System32\VTtrayp.exe C:\WINDOWS\SOUNDMAN.EXE C:\Program Files\Eset\nod32kui.exe C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe C:\PROGRA~1\NEOSTR~1\TaskBarIcon.exe C:\Program Files\VIA\RAID\raid_tool.exe C:\PROGRA~1\NEOSTR~1\neostradatp.exe C:\PROGRA~1\NEOSTR~1\ComComp.exe C:\PROGRA~1\NEOSTR~1\Toaster.exe C:\PROGRA~1\NEOSTR~1\Inactivity.exe C:\PROGRA~1\NEOSTR~1\PollingModule.exe C:\WINDOWS\System32\ALERTM~1\ALERTM~1.EXE C:\PROGRA~1\NEOSTR~1\Watch.exe C:\Documents and Settings\Daruś\Pulpit\dss.exe C:\DOCUME~1\DARU~1\Pulpit\DARU~1.EXE R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.wp.pl/ R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = neostrada tp R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O4 - HKLM…\Run: [VTTimer] VTTimer.exe O4 - HKLM…\Run: [VTTrayp] VTtrayp.exe O4 - HKLM…\Run: [soundMan] SOUNDMAN.EXE O4 - HKLM…\Run: [WOOWATCH] C:\PROGRA~1\NEOSTR~1\Watch.exe O4 - HKLM…\Run: [WOOTASKBARICON] C:\PROGRA~1\NEOSTR~1\GestMaj.exe TaskBarIcon.exe O4 - HKLM…\Run: [nod32kui] “C:\Program Files\Eset\nod32kui.exe” /WAITSERVICE O4 - HKLM…\Run: [Adobe Photo Downloader] “C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe” O4 - HKLM…\Run: [Adobe Reader Speed Launcher] “C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe” O4 - HKCU…\Run: [Odkurzacz-MCD] C:\Program Files\Odkurzacz\odk_mcd.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE O4 - Global Startup: VIA RAID TOOL.lnk = C:\Program Files\VIA\RAID\raid_tool.exe O17 - HKLM\System\CCS\Services\Tcpip…{A90F0EFB-1BF7-4C39-A361-DC5064A68205}: NameServer = 194.204.152.34 217.98.63.164 O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exe O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe – Files created between 2007-07-29 and 2007-08-29 ----------------------------- 2007-08-29 00:32:35 0 dr-h----- C:\Documents and Settings\Daruś\Recent 2007-08-28 22:18:44 0 d-------- C:\VundoFix Backups 2007-08-28 02:43:38 0 d-------- C:\WINDOWS\ERUNT 2007-08-28 02:31:40 0 d-------- C:\Program Files\Odkurzacz 2007-08-28 01:22:26 109056 --a------ C:\WINDOWS\System32\catchme.exe 2007-08-28 01:22:26 9006 --a------ C:\clean.bat 2007-08-28 01:22:25 90112 --a------ C:\WINDOWS\System32\RegDACL.exe 2007-08-28 01:22:25 4096 --a------ C:\WINDOWS\System32\reboot.exe 2007-08-27 00:30:19 2048 --a------ C:\WINDOWS\System32\helperymsng2.exe 2007-08-24 18:35:27 925940 —hs---- C:\WINDOWS\System32\ybeeg.bak2 2007-08-23 22:41:38 6456 —hs---- C:\WINDOWS\System32\ybeeg.bak1 2007-08-19 23:29:20 0 d-------- C:\Program Files\Common Files\AVSMedia 2007-08-19 23:29:13 139264 --a------ C:\WINDOWS\System32\xvidvfw.dll 2007-08-19 23:29:13 524288 --a------ C:\WINDOWS\System32\xvidcore.dll 2007-08-19 23:29:12 0 d-------- C:\Program Files\AVS4YOU 2007-08-19 22:48:44 0 d-------- C:\speed_converter 2007-08-19 22:48:35 0 d-------- C:\Program Files\Speed Video Converter 2007-08-19 22:39:33 0 d-------- C:\Program Files\MediaCoder 2007-08-19 19:26:08 0 d-------- C:\Temp 2007-08-19 19:25:21 0 d-------- C:\Program Files\Witcobber 2007-08-19 19:20:42 0 d-------- C:\Program Files\AsfTools 3.1 2007-08-19 19:18:08 0 d-------- C:\Program Files\WMV9_VCM 2007-08-19 19:09:49 0 d-------- C:\Program Files\Absolute Video Converter 2007-08-19 03:58:31 0 d-------- C:\Program Files\WMV To VCD DVD MPEG Converter Pro 2007-08-19 02:29:29 238 --ahs---- C:\WINDOWS\System32\index.dat 2007-08-19 02:29:29 12800 --ahs---- C:\WINDOWS\System32\adadix32p.dll 2007-08-19 02:29:26 337 --ahs---- C:\WINDOWS\System32\3637441342.dat 2007-08-19 02:29:23 61111 -r-hs---- C:\WINDOWS\System32\acluin.exe 2007-08-19 00:22:09 0 d-------- C:\Program Files\Elecard 2007-08-18 22:38:03 0 d-------- C:\Program Files\Common Files\Adobe 2007-08-18 22:37:56 0 d-------- C:\WINDOWS\Downloaded Installations 2007-08-18 22:37:34 0 d-------- C:\Program Files\Google 2007-08-18 21:44:02 0 d—s---- C:\WINDOWS\System32\Microsoft 2007-08-18 21:43:49 0 d-------- C:\Program Files\Lavasoft 2007-08-18 21:43:27 0 d-------- C:\Program Files\Common Files\Wise Installation Wizard 2007-08-18 21:13:22 0 d-------- C:\Program Files\Yahoo! 2007-08-18 21:13:14 0 d-------- C:\Program Files\CCleaner 2007-08-18 12:17:42 0 d-------- C:\Program Files\VideoLAN 2007-08-17 20:38:08 298104 --a------ C:\WINDOWS\System32\imon.dll 2007-08-15 14:49:22 127456 --a------ C:\WINDOWS\System32\IPDETECT.EXE 2007-08-15 14:49:21 116992 --a------ C:\WINDOWS\System32\drivers\e4usbaw.sys 2007-08-15 14:49:21 126489 --a------ C:\WINDOWS\System32\drivers\adiusbaw.sys 2007-08-15 14:49:21 126976 --a------ C:\WINDOWS\System32\coclassfast.dll 2007-08-15 14:49:21 24576 --a------ C:\WINDOWS\enddisk32.exe 2007-08-15 14:49:20 135168 --a------ C:\WINDOWS\System32\unaddrv.exe 2007-08-15 14:49:20 152126 --a------ C:\WINDOWS\System32\drivers\L1E9P2.BIN 2007-08-15 14:49:20 64000 --a------ C:\WINDOWS\System32\drivers\e4ldr.sys 2007-08-15 14:49:20 46892 --a------ C:\WINDOWS\System32\ADADIX16.DLL 2007-08-15 14:49:19 152126 --a------ C:\WINDOWS\System32\drivers\L1E9P1.BIN 2007-08-15 14:49:19 152126 --a------ C:\WINDOWS\System32\drivers\L1E9P0.BIN 2007-08-15 14:49:19 152126 --a------ C:\WINDOWS\System32\drivers\L1E9I2.BIN 2007-08-15 14:49:19 152126 --a------ C:\WINDOWS\System32\drivers\L1E9I1.BIN 2007-08-15 14:49:19 152126 --a------ C:\WINDOWS\System32\drivers\L1E9I0.BIN 2007-08-15 14:49:19 152132 --a------ C:\WINDOWS\System32\drivers\L1E4P2.BIN 2007-08-15 14:49:19 152132 --a------ C:\WINDOWS\System32\drivers\L1E4P1.BIN 2007-08-15 14:49:19 152132 --a------ C:\WINDOWS\System32\drivers\L1E4P0.BIN 2007-08-15 14:49:19 152220 --a------ C:\WINDOWS\System32\drivers\L1E4I2.BIN 2007-08-15 14:49:19 152220 --a------ C:\WINDOWS\System32\drivers\L1E4I1.BIN 2007-08-15 14:49:19 152220 --a------ C:\WINDOWS\System32\drivers\L1E4I0.BIN 2007-08-15 14:49:16 0 d-------- C:\Program Files\SAGEM 2007-08-15 14:48:52 0 d-------- C:\WINDOWS\System32\AlertModule 2007-08-15 14:48:50 94208 --a------ C:\WINDOWS\System32\W32n50.dll 2007-08-15 14:48:50 16128 -----n— C:\WINDOWS\System32\PCANDIS5.SYS 2007-08-15 14:48:45 36864 --a------ C:\WINDOWS\System32\IfHelper.dll 2007-08-15 14:48:45 40960 --a------ C:\WINDOWS\System32\FTRTSVC.exe 2007-08-15 13:30:11 32768 --a------ C:\WINDOWS\System32\WooDial2000.dll 2007-08-15 13:24:58 0 d-------- C:\Program Files\Java Web Start 2007-08-15 13:24:51 41068 -----n— C:\WINDOWS\System32\ActPanel.dll 2007-08-15 13:24:51 0 d-------- C:\Program Files\Java 2007-08-15 13:23:36 0 d-------- C:\Program Files\Neostrada TP 2007-08-15 13:23:03 0 d–hs---- C:\WINDOWS\ftpcache 2007-08-14 23:53:31 0 d-------- C:\Program Files\ShaftProfiler 2007-08-14 23:53:24 73216 --a------ C:\WINDOWS\ST6UNST.EXE 2007-08-14 19:16:17 0 d-------- C:\Program Files\Canon 2007-08-14 19:16:16 0 d-------- C:\Program Files\Common Files\Canon 2007-08-14 19:12:42 438272 --a------ C:\WINDOWS\System32\vp6vfw.dll 2007-08-14 19:12:42 118832 --a------ C:\WINDOWS\System32\SHW32.DLL 2007-08-14 19:04:05 0 d-------- C:\Program Files\EA SPORTS 2007-08-14 19:02:35 0 d-------- C:\WINDOWS\RegisteredPackages 2007-08-14 19:02:01 1769472 --a------ C:\WINDOWS\System32\dxdiagn.dll 2007-08-14 19:02:01 1703936 --a------ C:\WINDOWS\System32\d3d9.dll 2007-08-14 18:40:28 143872 --a------ C:\WINDOWS\System32\iacenc.dll 2007-08-14 18:39:19 204857 --a------ C:\WINDOWS\System32\InstallHelp.dll 2007-08-14 18:39:19 107293 --a------ C:\WINDOWS\System32\GMTUninstall.exe 2007-08-14 18:39:19 0 d-------- C:\Program Files\Friendly Software 2007-08-14 17:46:51 0 d-------- C:\Program Files\DivX 2007-08-14 17:45:59 0 d-------- C:\WINDOWS\Application Data 2007-08-14 17:45:55 0 d-------- C:\Program Files\V1 Home 2.0 2007-08-14 17:45:55 0 d-------- C:\Program Files\Common Files\Moonlight 2007-08-14 16:11:44 0 d-------- C:\Program Files\Realtek Sound Manager 2007-08-14 16:11:43 0 d-------- C:\Program Files\AvRack 2007-08-14 16:11:37 40960 -----n— C:\WINDOWS\System32\ChCfg.exe 2007-08-14 16:11:30 208896 -----n— C:\WINDOWS\alcupd.exe 2007-08-14 16:11:30 139264 -----n— C:\WINDOWS\alcrmv.exe 2007-08-14 16:10:47 0 d-------- C:\Program Files\AMD 2007-08-14 16:10:24 0 d–h----- C:\Program Files\InstallShield Installation Information 2007-08-14 16:08:24 0 d-------- C:\Program Files\VIA 2007-08-14 16:08:14 0 d-------- C:\Program Files\Common Files\InstallShield 2007-08-14 16:06:54 0 d-------- C:\WINDOWS\System32\ReinstallBackups 2007-08-14 16:06:48 306688 --a------ C:\WINDOWS\IsUninst.exe 2007-08-14 14:33:58 0 d-------- C:\WINDOWS\ShellNew 2007-08-14 14:32:47 0 d-------- C:\WINDOWS\Twain32 2007-08-14 12:57:15 0 d—s---- C:\Documents and Settings\Daruś\UserData 2007-08-14 12:57:14 0 d-------- C:\Documents and Settings\Daruś\tvunetworks 2007-08-14 12:49:17 0 d-------- C:\Documents and Settings\Daruś\Gadu-Gadu 2007-08-14 12:48:53 0 d-------- C:\Documents and Settings\Daruś\Application Data 2007-08-14 12:48:53 0 d-------- C:\Documents and Settings\Daruś\Application Data\Microsoft 2007-08-14 12:48:15 0 d-------- C:\Documents and Settings\Daruś.jpi_cache 2007-08-14 12:48:15 0 d-------- C:\Documents and Settings\Daruś.javaws 2007-08-14 12:48:15 0 d-------- C:\Documents and Settings\Daruś.java 2007-08-14 12:48:15 0 d-------- C:\Documents and Settings\Daruś.autodesk 2007-08-14 12:33:29 0 d–hs---- C:\WINDOWS\Installer 2007-08-14 12:33:19 0 d–h----- C:\Documents and Settings\Daruś\Ustawienia lokalne 2007-08-14 12:33:19 0 dr------- C:\Documents and Settings\Daruś\Ulubione 2007-08-14 12:33:19 0 d–h----- C:\Documents and Settings\Daruś\Szablony 2007-08-14 12:33:19 0 dr-h----- C:\Documents and Settings\Daruś\SendTo 2007-08-14 12:33:19 0 d-------- C:\Documents and Settings\Daruś\Pulpit 2007-08-14 12:33:19 0 d–h----- C:\Documents and Settings\Daruś\PrintHood 2007-08-14 12:33:19 0 d–h----- C:\Documents and Settings\Daruś\NetHood 2007-08-14 12:33:19 0 dr------- C:\Documents and Settings\Daruś\Moje dokumenty 2007-08-14 12:33:19 0 dr------- C:\Documents and Settings\Daruś\Menu Start 2007-08-14 12:33:19 0 dr-h----- C:\Documents and Settings\Daruś\Dane aplikacji 2007-08-14 12:33:19 0 d—s---- C:\Documents and Settings\Daruś\Cookies 2007-08-14 12:33:18 2359296 --ah----- C:\Documents and Settings\Daruś\NTUSER.DAT 2007-08-14 12:28:37 0 d–hs---- C:\System Volume Information 2007-08-14 12:28:36 0 d-------- C:\WINDOWS\Prefetch 2007-08-14 11:45:17 0 d-------- C:\WINDOWS 2007-08-14 11:45:17 0 d-------- C:\WINDOWS\WinSxS 2007-08-14 11:45:17 0 dr------- C:\WINDOWS\Web 2007-08-14 11:45:17 0 d-------- C:\WINDOWS\twain_32 2007-08-14 11:45:17 0 d-------- C:\WINDOWS\system32 2007-08-14 11:45:17 0 d-------- C:\WINDOWS\System32\wins 2007-08-14 11:45:17 0 d-------- C:\WINDOWS\System32\wbem 2007-08-14 11:45:17 0 d-------- C:\WINDOWS\System32\usmt 2007-08-14 11:45:17 0 d-------- C:\WINDOWS\System32\spool 2007-08-14 11:45:17 0 d-------- C:\WINDOWS\System32\ShellExt 2007-08-14 11:45:17 0 d-------- C:\WINDOWS\System32\Setup 2007-08-14 11:45:17 0 d-------- C:\WINDOWS\System32\ras 2007-08-14 11:45:17 0 d-------- C:\WINDOWS\System32\oobe 2007-08-14 11:45:17 0 d-------- C:\WINDOWS\System32\npp 2007-08-14 11:45:17 0 d-------- C:\WINDOWS\System32\mui 2007-08-14 11:45:17 0 d-------- C:\WINDOWS\System32\inetsrv 2007-08-14 11:45:17 0 d-------- C:\WINDOWS\System32\IME 2007-08-14 11:45:17 0 d-------- C:\WINDOWS\System32\icsxml 2007-08-14 11:45:17 0 d-------- C:\WINDOWS\System32\ias 2007-08-14 11:45:17 0 d-------- C:\WINDOWS\System32\export 2007-08-14 11:45:17 0 d-------- C:\WINDOWS\System32\drivers 2007-08-14 11:45:17 0 d-------- C:\WINDOWS\System32\drivers\etc 2007-08-14 11:45:17 0 d-------- C:\WINDOWS\System32\drivers\disdn 2007-08-14 11:45:17 0 dr-hs–c- C:\WINDOWS\System32\dllcache 2007-08-14 11:45:17 0 d-------- C:\WINDOWS\System32\dhcp 2007-08-14 11:45:17 0 d-------- C:\WINDOWS\System32\config 2007-08-14 11:45:17 0 d-------- C:\WINDOWS\System32\3com_dmi 2007-08-14 11:45:17 0 d-------- C:\WINDOWS\System32\3076 2007-08-14 11:45:17 0 d-------- C:\WINDOWS\System32\2052 2007-08-14 11:45:17 0 d-------- C:\WINDOWS\System32\1054 2007-08-14 11:45:17 0 d-------- C:\WINDOWS\System32\1045 2007-08-14 11:45:17 0 d-------- C:\WINDOWS\System32\1042 2007-08-14 11:45:17 0 d-------- C:\WINDOWS\System32\1041 2007-08-14 11:45:17 0 d-------- C:\WINDOWS\System32\1037 2007-08-14 11:45:17 0 d-------- C:\WINDOWS\System32\1033 2007-08-14 11:45:17 0 d-------- C:\WINDOWS\System32\1031 2007-08-14 11:45:17 0 d-------- C:\WINDOWS\System32\1028 2007-08-14 11:45:17 0 d-------- C:\WINDOWS\System32\1025 2007-08-14 11:45:17 0 d-------- C:\WINDOWS\system 2007-08-14 11:45:17 0 d-------- C:\WINDOWS\security 2007-08-14 11:45:17 0 d-------- C:\WINDOWS\Resources 2007-08-14 11:45:17 0 d-------- C:\WINDOWS\repair 2007-08-14 11:45:17 0 d-------- C:\WINDOWS\mui 2007-08-14 11:45:17 0 d-------- C:\WINDOWS\msapps 2007-08-14 11:45:17 0 d-------- C:\WINDOWS\msagent 2007-08-14 11:45:17 0 d-------- C:\WINDOWS\Media 2007-08-14 11:45:17 0 d-------- C:\WINDOWS\java 2007-08-14 11:45:17 0 d–h----- C:\WINDOWS\inf 2007-08-14 11:45:17 0 d-------- C:\WINDOWS\ime 2007-08-14 11:45:17 0 d-------- C:\WINDOWS\Help 2007-08-14 11:45:17 0 dr–s---- C:\WINDOWS\Fonts 2007-08-14 11:45:17 0 d-------- C:\WINDOWS\Driver Cache 2007-08-14 11:45:17 0 d-------- C:\WINDOWS\Debug 2007-08-14 11:45:17 0 d-------- C:\WINDOWS\Cursors 2007-08-14 11:45:17 0 d-------- C:\WINDOWS\Connection Wizard 2007-08-14 11:45:17 0 d-------- C:\WINDOWS\Config 2007-08-14 11:45:17 0 d-------- C:\WINDOWS\AppPatch 2007-08-14 11:45:17 0 d-------- C:\WINDOWS\addins 2007-08-14 11:16:24 0 d-------- C:\WINDOWS\System32\xircom 2007-08-14 11:16:24 0 d-------- C:\Program Files\microsoft frontpage 2007-08-14 11:16:06 0 -rahs---- C:\MSDOS.SYS 2007-08-14 11:16:06 0 -rahs---- C:\IO.SYS 2007-08-14 11:16:06 0 --a------ C:\CONFIG.SYS 2007-08-14 11:16:06 0 --a------ C:\AUTOEXEC.BAT 2007-08-14 11:15:06 0 dr------- C:\WINDOWS\Offline Web Pages 2007-08-14 11:15:06 0 d—s---- C:\WINDOWS\Downloaded Program Files 2007-08-14 11:14:34 0 d-------- C:\WINDOWS\srchasst 2007-08-14 11:14:22 0 d-------- C:\WINDOWS\System32\DirectX 2007-08-14 11:14:21 0 d-------- C:\WINDOWS\System32\Macromed 2007-08-14 11:13:48 0 d-------- C:\Program Files\Movie Maker 2007-08-14 11:12:50 0 d-------- C:\WINDOWS\System32\Restore 2007-08-14 11:12:39 0 d-------- C:\WINDOWS\PCHEALTH 2007-08-14 11:12:25 0 d—s---- C:\WINDOWS\Tasks 2007-08-14 11:12:18 0 d-------- C:\Program Files\Common Files\MSSoap 2007-08-14 11:11:43 21856 --a------ C:\WINDOWS\System32\emptyregdb.dat 2007-08-14 11:11:28 0 d-------- C:\WINDOWS\Registration 2007-08-14 11:11:21 0 d–h----- C:\Program Files\WindowsUpdate 2007-08-14 11:11:21 0 d-------- C:\Program Files\Usługi online 2007-08-14 11:11:15 0 d-------- C:\Program Files\Messenger 2007-08-14 11:10:54 0 d-------- C:\Program Files\MSN Gaming Zone 2007-08-14 11:10:37 0 d-------- C:\Program Files\Windows NT 2007-08-14 11:10:12 0 d-------- C:\WINDOWS\System32\MsDtc 2007-08-14 11:10:06 0 d-------- C:\WINDOWS\System32\Com 2007-08-14 10:51:08 0 d-------- C:\Program Files\Common Files\ODBC 2007-08-14 10:51:01 0 d-------- C:\Program Files\Common Files\SpeechEngines 2007-08-14 10:51:00 0 dr------- C:\Program Files 2007-08-14 10:51:00 0 d-------- C:\Program Files\Common Files 2007-08-14 10:49:36 0 d-------- C:\WINDOWS\System32\CatRoot2 2007-08-14 10:49:36 0 d-------- C:\WINDOWS\System32\CatRoot 2007-08-14 10:49:17 0 d-------- C:\Documents and Settings – Find3M Report --------------------------------------------------------------- 2007-08-20 02:15:47 0 d-------- C:\Documents and Settings\Daruś\Dane aplikacji\Adobe 2007-08-19 23:31:26 0 d-------- C:\Documents and Settings\Daruś\Dane aplikacji\AVS4YOU 2007-08-19 00:08:50 0 d-------- C:\Documents and Settings\Daruś\Dane aplikacji\Google 2007-08-15 15:12:13 355830 --a------ C:\WINDOWS\System32\perfh015.dat 2007-08-15 15:12:13 49712 --a------ C:\WINDOWS\System32\perfc015.dat 2007-08-14 14:32:47 0 d-------- C:\Documents and Settings\Daruś\Dane aplikacji\Microsoft Web Folders 2007-08-14 12:49:17 0 d-------- C:\Documents and Settings\Daruś\Dane aplikacji\ACD Systems 2007-08-14 12:49:16 0 d-------- C:\Documents and Settings\Daruś\Dane aplikacji\CyberLink 2007-08-14 12:49:16 0 d-------- C:\Documents and Settings\Daruś\Dane aplikacji\Canon 2007-08-14 12:49:16 0 d-------- C:\Documents and Settings\Daruś\Dane aplikacji\ATI 2007-08-14 12:49:16 0 d-------- C:\Documents and Settings\Daruś\Dane aplikacji\Apple Computer 2007-08-14 12:49:16 0 d-------- C:\Documents and Settings\Daruś\Dane aplikacji\AdobeUM 2007-08-14 12:49:16 0 d-------- C:\Documents and Settings\Daruś\Dane aplikacji\AdobeAUM 2007-08-14 12:49:15 0 d-------- C:\Documents and Settings\Daruś\Dane aplikacji\Identities 2007-08-14 12:49:15 0 d-------- C:\Documents and Settings\Daruś\Dane aplikacji\Help 2007-08-14 12:49:15 0 d-------- C:\Documents and Settings\Daruś\Dane aplikacji\GanymedeNet 2007-08-14 12:49:13 0 d-------- C:\Documents and Settings\Daruś\Dane aplikacji\Macromedia 2007-08-14 12:49:13 0 d-------- C:\Documents and Settings\Daruś\Dane aplikacji\Leadertech 2007-08-14 12:49:13 0 d-------- C:\Documents and Settings\Daruś\Dane aplikacji\Lavasoft 2007-08-14 12:49:10 0 d-------- C:\Documents and Settings\Daruś\Dane aplikacji\Mozilla 2007-08-14 12:49:09 0 d-------- C:\Documents and Settings\Daruś\Dane aplikacji\Skype 2007-08-14 12:49:09 0 d-------- C:\Documents and Settings\Daruś\Dane aplikacji\Real 2007-08-14 12:49:09 0 d-------- C:\Documents and Settings\Daruś\Dane aplikacji\Petroglyph 2007-08-14 12:49:08 0 d-------- C:\Documents and Settings\Daruś\Dane aplikacji\Xfire 2007-08-14 12:49:08 0 d-------- C:\Documents and Settings\Daruś\Dane aplikacji\vlc 2007-08-14 12:49:08 0 d-------- C:\Documents and Settings\Daruś\Dane aplikacji\TVU networks 2007-08-14 12:49:08 0 d-------- C:\Documents and Settings\Daruś\Dane aplikacji\Symantec 2007-08-14 12:49:08 0 d-------- C:\Documents and Settings\Daruś\Dane aplikacji\SopCast 2007-06-07 21:10:48 20480 --a------ C:\WINDOWS\System32\ac3config.exe – Registry Dump --------------------------------------------------------------- *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “VTTimer”=“VTTimer.exe” [2005-03-07 21:33 C:\WINDOWS\system32\VTTimer.exe] “VTTrayp”=“VTtrayp.exe” [2005-01-11 01:33 C:\WINDOWS\system32\VTTrayp.exe] “SoundMan”=“SOUNDMAN.EXE” [2004-12-22 11:09 C:\WINDOWS\SOUNDMAN.EXE] “WOOWATCH”=“C:\PROGRA~1\NEOSTR~1\Watch.exe” [2004-08-23 14:49] “WOOTASKBARICON”=“C:\PROGRA~1\NEOSTR~1\GestMaj.exe” [2004-10-14 16:55] “nod32kui”=“C:\Program Files\Eset\nod32kui.exe” [2007-08-17 20:36] “Adobe Photo Downloader”=“C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe” [2007-03-09 11:09] “Adobe Reader Speed Launcher”=“C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe” [2007-05-11 03:06] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “Odkurzacz-MCD”=“C:\Program Files\Odkurzacz\odk_mcd.exe” [2007-05-03 10:02] C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\ Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office\OSA9.EXE [2000-01-21 08:15:54] VIA RAID TOOL.lnk - C:\Program Files\VIA\RAID\raid_tool.exe [2007-08-14 16:12:53] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice] @=“Service” – End of Deckard’s System Scanner: finished at 2007-08-29 00:33:31 ------------

Pozdrawiam

[Gutek]

Pobierz The Avenger. Wypakuj => uruchom => zaznacz opcję Input script manually => kliknij w taką lupkę => w okienku, które się otworzy wklej:

Files to delete: C:\WINDOWS\System32\reboot.exe C:\WINDOWS\System32\helperymsng2.exe C:\WINDOWS\System32\ybeeg.bak2 C:\WINDOWS\System32\ybeeg.bak1 C:\WINDOWS\System32\index.dat C:\WINDOWS\System32\3637441342.dat C:\WINDOWS\System32\acluin.exe C:\WINDOWS\System32\adadix32p.dll

kliknij klawisz Done => teraz kliknij na zielone światełko => powinna pojawić się pewna informacja i kliknij OK (teraz restart).

po tym nowy log z DSS

[Dariusz_J]

Oto log:

Deckard’s System Scanner v20070826.66 Run by Daruś on 2007-08-29 01:08:32 Computer is in Normal Mode. -------------------------------------------------------------------------------- Total Physical Memory: 448 MiB (512 MiB recommended). – HijackThis (run as Daruś.exe) ----------------------------------------------- Unable to find log (file not found); running clone. – HijackThis Clone ------------------------------------------------------------ Emulating logfile of HijackThis v1.99.1 Scan saved at 2007-08-29 01:08:37 Platform: Windows XP (5.01.2600) MSIE: Internet Explorer (6.00.2600.0000) Running processes: C:\WINDOWS\system32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe C:\WINDOWS\explorer.exe C:\WINDOWS\system32\FTRTSVC.exe C:\Program Files\ESET\nod32krn.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\VTTimer.exe C:\WINDOWS\system32\VTTrayp.exe C:\Program Files\Canon\CAL\CALMAIN.exe C:\WINDOWS\SOUNDMAN.EXE C:\Program Files\ESET\nod32kui.exe C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe C:\Program Files\Neostrada TP\TaskBarIcon.exe C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe C:\Program Files\VIA\RAID\raid_tool.exe C:\Documents and Settings\Daruś\Pulpit\dss.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.google.com/ie R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.wp.pl/ R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://www.google.com/search?q=%s R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = neostrada tp R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza R1 - HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.google.com/ie R1 - HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie R1 - HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O4 - HKEY_LOCAL_MACHINE…\Run: [VTTimer] VTTimer.exe O4 - HKEY_LOCAL_MACHINE…\Run: [VTTrayp] VTtrayp.exe O4 - HKEY_LOCAL_MACHINE…\Run: [soundMan] SOUNDMAN.EXE O4 - HKEY_LOCAL_MACHINE…\Run: [WOOWATCH] C:\PROGRA~1\NEOSTR~1\Watch.exe O4 - HKEY_LOCAL_MACHINE…\Run: [WOOTASKBARICON] C:\PROGRA~1\NEOSTR~1\GestMaj.exe TaskBarIcon.exe O4 - HKEY_LOCAL_MACHINE…\Run: [nod32kui] “C:\Program Files\Eset\nod32kui.exe” /WAITSERVICE O4 - HKEY_LOCAL_MACHINE…\Run: [Adobe Photo Downloader] “C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe” O4 - HKEY_LOCAL_MACHINE…\Run: [Adobe Reader Speed Launcher] “C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe” O4 - HKCU…\Run: [Odkurzacz-MCD] C:\Program Files\Odkurzacz\odk_mcd.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE O4 - Global Startup: VIA RAID TOOL.lnk = C:\Program Files\VIA\RAID\raid_tool.exe O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/shoc … tor/sw.cab O16 - DPF: {33564D57-9980-0010-8000-00AA00389B71} () - http://download.microsoft.com/download/ … mv9dmo.cab O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} () - http://fpdownload.macromedia.com/get/fl … rashim.cab O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload.macromedia.com/pub/sh … wflash.cab O18 - Protocol: lid - {5C135180-9973-46D9-ABF4-148267CBB8BF} - C:\WINDOWS\system32\msvidctl.dll O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\system32\FTRTSVC.exe O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - “C:\Program Files\Eset\nod32krn.exe” – Files created between 2007-07-29 and 2007-08-29 ----------------------------- 2007-08-29 00:36:53 0 dr-h----- C:\Documents and Settings\Daruś\Recent 2007-08-28 22:18:44 0 d-------- C:\VundoFix Backups 2007-08-28 02:43:38 0 d-------- C:\WINDOWS\ERUNT 2007-08-28 02:31:40 0 d-------- C:\Program Files\Odkurzacz 2007-08-28 01:22:26 109056 --a------ C:\WINDOWS\System32\catchme.exe 2007-08-28 01:22:26 9006 --a------ C:\clean.bat 2007-08-28 01:22:25 90112 --a------ C:\WINDOWS\System32\RegDACL.exe 2007-08-19 23:29:20 0 d-------- C:\Program Files\Common Files\AVSMedia 2007-08-19 23:29:13 139264 --a------ C:\WINDOWS\System32\xvidvfw.dll 2007-08-19 23:29:13 524288 --a------ C:\WINDOWS\System32\xvidcore.dll 2007-08-19 23:29:12 0 d-------- C:\Program Files\AVS4YOU 2007-08-19 22:48:44 0 d-------- C:\speed_converter 2007-08-19 22:48:35 0 d-------- C:\Program Files\Speed Video Converter 2007-08-19 22:39:33 0 d-------- C:\Program Files\MediaCoder 2007-08-19 19:26:08 0 d-------- C:\Temp 2007-08-19 19:25:21 0 d-------- C:\Program Files\Witcobber 2007-08-19 19:20:42 0 d-------- C:\Program Files\AsfTools 3.1 2007-08-19 19:18:08 0 d-------- C:\Program Files\WMV9_VCM 2007-08-19 19:09:49 0 d-------- C:\Program Files\Absolute Video Converter 2007-08-19 03:58:31 0 d-------- C:\Program Files\WMV To VCD DVD MPEG Converter Pro 2007-08-19 00:22:09 0 d-------- C:\Program Files\Elecard 2007-08-18 22:38:03 0 d-------- C:\Program Files\Common Files\Adobe 2007-08-18 22:37:56 0 d-------- C:\WINDOWS\Downloaded Installations 2007-08-18 22:37:34 0 d-------- C:\Program Files\Google 2007-08-18 21:44:02 0 d—s---- C:\WINDOWS\System32\Microsoft 2007-08-18 21:43:49 0 d-------- C:\Program Files\Lavasoft 2007-08-18 21:43:27 0 d-------- C:\Program Files\Common Files\Wise Installation Wizard 2007-08-18 21:13:22 0 d-------- C:\Program Files\Yahoo! 2007-08-18 21:13:14 0 d-------- C:\Program Files\CCleaner 2007-08-18 12:17:42 0 d-------- C:\Program Files\VideoLAN 2007-08-17 20:38:08 298104 --a------ C:\WINDOWS\System32\imon.dll 2007-08-15 14:49:22 127456 --a------ C:\WINDOWS\System32\IPDETECT.EXE 2007-08-15 14:49:21 116992 --a------ C:\WINDOWS\System32\drivers\e4usbaw.sys 2007-08-15 14:49:21 126489 --a------ C:\WINDOWS\System32\drivers\adiusbaw.sys 2007-08-15 14:49:21 126976 --a------ C:\WINDOWS\System32\coclassfast.dll 2007-08-15 14:49:21 24576 --a------ C:\WINDOWS\enddisk32.exe 2007-08-15 14:49:20 135168 --a------ C:\WINDOWS\System32\unaddrv.exe 2007-08-15 14:49:20 152126 --a------ C:\WINDOWS\System32\drivers\L1E9P2.BIN 2007-08-15 14:49:20 64000 --a------ C:\WINDOWS\System32\drivers\e4ldr.sys 2007-08-15 14:49:20 46892 --a------ C:\WINDOWS\System32\ADADIX16.DLL 2007-08-15 14:49:19 152126 --a------ C:\WINDOWS\System32\drivers\L1E9P1.BIN 2007-08-15 14:49:19 152126 --a------ C:\WINDOWS\System32\drivers\L1E9P0.BIN 2007-08-15 14:49:19 152126 --a------ C:\WINDOWS\System32\drivers\L1E9I2.BIN 2007-08-15 14:49:19 152126 --a------ C:\WINDOWS\System32\drivers\L1E9I1.BIN 2007-08-15 14:49:19 152126 --a------ C:\WINDOWS\System32\drivers\L1E9I0.BIN 2007-08-15 14:49:19 152132 --a------ C:\WINDOWS\System32\drivers\L1E4P2.BIN 2007-08-15 14:49:19 152132 --a------ C:\WINDOWS\System32\drivers\L1E4P1.BIN 2007-08-15 14:49:19 152132 --a------ C:\WINDOWS\System32\drivers\L1E4P0.BIN 2007-08-15 14:49:19 152220 --a------ C:\WINDOWS\System32\drivers\L1E4I2.BIN 2007-08-15 14:49:19 152220 --a------ C:\WINDOWS\System32\drivers\L1E4I1.BIN 2007-08-15 14:49:19 152220 --a------ C:\WINDOWS\System32\drivers\L1E4I0.BIN 2007-08-15 14:49:16 0 d-------- C:\Program Files\SAGEM 2007-08-15 14:48:52 0 d-------- C:\WINDOWS\System32\AlertModule 2007-08-15 14:48:50 94208 --a------ C:\WINDOWS\System32\W32n50.dll 2007-08-15 14:48:50 16128 -----n— C:\WINDOWS\System32\PCANDIS5.SYS 2007-08-15 14:48:45 36864 --a------ C:\WINDOWS\System32\IfHelper.dll 2007-08-15 14:48:45 40960 --a------ C:\WINDOWS\System32\FTRTSVC.exe 2007-08-15 13:30:11 32768 --a------ C:\WINDOWS\System32\WooDial2000.dll 2007-08-15 13:24:58 0 d-------- C:\Program Files\Java Web Start 2007-08-15 13:24:51 41068 -----n— C:\WINDOWS\System32\ActPanel.dll 2007-08-15 13:24:51 0 d-------- C:\Program Files\Java 2007-08-15 13:23:36 0 d-------- C:\Program Files\Neostrada TP 2007-08-15 13:23:03 0 d–hs---- C:\WINDOWS\ftpcache 2007-08-14 23:53:31 0 d-------- C:\Program Files\ShaftProfiler 2007-08-14 23:53:24 73216 --a------ C:\WINDOWS\ST6UNST.EXE 2007-08-14 19:16:17 0 d-------- C:\Program Files\Canon 2007-08-14 19:16:16 0 d-------- C:\Program Files\Common Files\Canon 2007-08-14 19:12:42 438272 --a------ C:\WINDOWS\System32\vp6vfw.dll 2007-08-14 19:12:42 118832 --a------ C:\WINDOWS\System32\SHW32.DLL 2007-08-14 19:04:05 0 d-------- C:\Program Files\EA SPORTS 2007-08-14 19:02:35 0 d-------- C:\WINDOWS\RegisteredPackages 2007-08-14 19:02:01 1769472 --a------ C:\WINDOWS\System32\dxdiagn.dll 2007-08-14 19:02:01 1703936 --a------ C:\WINDOWS\System32\d3d9.dll 2007-08-14 18:40:28 143872 --a------ C:\WINDOWS\System32\iacenc.dll 2007-08-14 18:39:19 204857 --a------ C:\WINDOWS\System32\InstallHelp.dll 2007-08-14 18:39:19 107293 --a------ C:\WINDOWS\System32\GMTUninstall.exe 2007-08-14 18:39:19 0 d-------- C:\Program Files\Friendly Software 2007-08-14 17:46:51 0 d-------- C:\Program Files\DivX 2007-08-14 17:45:59 0 d-------- C:\WINDOWS\Application Data 2007-08-14 17:45:55 0 d-------- C:\Program Files\V1 Home 2.0 2007-08-14 17:45:55 0 d-------- C:\Program Files\Common Files\Moonlight 2007-08-14 16:11:44 0 d-------- C:\Program Files\Realtek Sound Manager 2007-08-14 16:11:43 0 d-------- C:\Program Files\AvRack 2007-08-14 16:11:37 40960 -----n— C:\WINDOWS\System32\ChCfg.exe 2007-08-14 16:11:30 208896 -----n— C:\WINDOWS\alcupd.exe 2007-08-14 16:11:30 139264 -----n— C:\WINDOWS\alcrmv.exe 2007-08-14 16:10:47 0 d-------- C:\Program Files\AMD 2007-08-14 16:10:24 0 d–h----- C:\Program Files\InstallShield Installation Information 2007-08-14 16:08:24 0 d-------- C:\Program Files\VIA 2007-08-14 16:08:14 0 d-------- C:\Program Files\Common Files\InstallShield 2007-08-14 16:06:54 0 d-------- C:\WINDOWS\System32\ReinstallBackups 2007-08-14 16:06:48 306688 --a------ C:\WINDOWS\IsUninst.exe 2007-08-14 14:33:58 0 d-------- C:\WINDOWS\ShellNew 2007-08-14 14:32:47 0 d-------- C:\WINDOWS\Twain32 2007-08-14 12:57:15 0 d—s---- C:\Documents and Settings\Daruś\UserData 2007-08-14 12:57:14 0 d-------- C:\Documents and Settings\Daruś\tvunetworks 2007-08-14 12:49:17 0 d-------- C:\Documents and Settings\Daruś\Gadu-Gadu 2007-08-14 12:48:53 0 d-------- C:\Documents and Settings\Daruś\Application Data 2007-08-14 12:48:53 0 d-------- C:\Documents and Settings\Daruś\Application Data\Microsoft 2007-08-14 12:48:15 0 d-------- C:\Documents and Settings\Daruś.jpi_cache 2007-08-14 12:48:15 0 d-------- C:\Documents and Settings\Daruś.javaws 2007-08-14 12:48:15 0 d-------- C:\Documents and Settings\Daruś.java 2007-08-14 12:48:15 0 d-------- C:\Documents and Settings\Daruś.autodesk 2007-08-14 12:33:29 0 d–hs---- C:\WINDOWS\Installer 2007-08-14 12:33:19 0 d–h----- C:\Documents and Settings\Daruś\Ustawienia lokalne 2007-08-14 12:33:19 0 dr------- C:\Documents and Settings\Daruś\Ulubione 2007-08-14 12:33:19 0 d–h----- C:\Documents and Settings\Daruś\Szablony 2007-08-14 12:33:19 0 dr-h----- C:\Documents and Settings\Daruś\SendTo 2007-08-14 12:33:19 0 d-------- C:\Documents and Settings\Daruś\Pulpit 2007-08-14 12:33:19 0 d–h----- C:\Documents and Settings\Daruś\PrintHood 2007-08-14 12:33:19 0 d–h----- C:\Documents and Settings\Daruś\NetHood 2007-08-14 12:33:19 0 dr------- C:\Documents and Settings\Daruś\Moje dokumenty 2007-08-14 12:33:19 0 dr------- C:\Documents and Settings\Daruś\Menu Start 2007-08-14 12:33:19 0 dr-h----- C:\Documents and Settings\Daruś\Dane aplikacji 2007-08-14 12:33:19 0 d—s---- C:\Documents and Settings\Daruś\Cookies 2007-08-14 12:33:18 2359296 --ah----- C:\Documents and Settings\Daruś\NTUSER.DAT 2007-08-14 12:28:37 0 d–hs---- C:\System Volume Information 2007-08-14 12:28:36 0 d-------- C:\WINDOWS\Prefetch 2007-08-14 11:45:17 0 d-------- C:\WINDOWS 2007-08-14 11:45:17 0 d-------- C:\WINDOWS\WinSxS 2007-08-14 11:45:17 0 dr------- C:\WINDOWS\Web 2007-08-14 11:45:17 0 d-------- C:\WINDOWS\twain_32 2007-08-14 11:45:17 0 d-------- C:\WINDOWS\system32 2007-08-14 11:45:17 0 d-------- C:\WINDOWS\System32\wins 2007-08-14 11:45:17 0 d-------- C:\WINDOWS\System32\wbem 2007-08-14 11:45:17 0 d-------- C:\WINDOWS\System32\usmt 2007-08-14 11:45:17 0 d-------- C:\WINDOWS\System32\spool 2007-08-14 11:45:17 0 d-------- C:\WINDOWS\System32\ShellExt 2007-08-14 11:45:17 0 d-------- C:\WINDOWS\System32\Setup 2007-08-14 11:45:17 0 d-------- C:\WINDOWS\System32\ras 2007-08-14 11:45:17 0 d-------- C:\WINDOWS\System32\oobe 2007-08-14 11:45:17 0 d-------- C:\WINDOWS\System32\npp 2007-08-14 11:45:17 0 d-------- C:\WINDOWS\System32\mui 2007-08-14 11:45:17 0 d-------- C:\WINDOWS\System32\inetsrv 2007-08-14 11:45:17 0 d-------- C:\WINDOWS\System32\IME 2007-08-14 11:45:17 0 d-------- C:\WINDOWS\System32\icsxml 2007-08-14 11:45:17 0 d-------- C:\WINDOWS\System32\ias 2007-08-14 11:45:17 0 d-------- C:\WINDOWS\System32\export 2007-08-14 11:45:17 0 d-------- C:\WINDOWS\System32\drivers 2007-08-14 11:45:17 0 d-------- C:\WINDOWS\System32\drivers\etc 2007-08-14 11:45:17 0 d-------- C:\WINDOWS\System32\drivers\disdn 2007-08-14 11:45:17 0 dr-hs–c- C:\WINDOWS\System32\dllcache 2007-08-14 11:45:17 0 d-------- C:\WINDOWS\System32\dhcp 2007-08-14 11:45:17 0 d-------- C:\WINDOWS\System32\config 2007-08-14 11:45:17 0 d-------- C:\WINDOWS\System32\3com_dmi 2007-08-14 11:45:17 0 d-------- C:\WINDOWS\System32\3076 2007-08-14 11:45:17 0 d-------- C:\WINDOWS\System32\2052 2007-08-14 11:45:17 0 d-------- C:\WINDOWS\System32\1054 2007-08-14 11:45:17 0 d-------- C:\WINDOWS\System32\1045 2007-08-14 11:45:17 0 d-------- C:\WINDOWS\System32\1042 2007-08-14 11:45:17 0 d-------- C:\WINDOWS\System32\1041 2007-08-14 11:45:17 0 d-------- C:\WINDOWS\System32\1037 2007-08-14 11:45:17 0 d-------- C:\WINDOWS\System32\1033 2007-08-14 11:45:17 0 d-------- C:\WINDOWS\System32\1031 2007-08-14 11:45:17 0 d-------- C:\WINDOWS\System32\1028 2007-08-14 11:45:17 0 d-------- C:\WINDOWS\System32\1025 2007-08-14 11:45:17 0 d-------- C:\WINDOWS\system 2007-08-14 11:45:17 0 d-------- C:\WINDOWS\security 2007-08-14 11:45:17 0 d-------- C:\WINDOWS\Resources 2007-08-14 11:45:17 0 d-------- C:\WINDOWS\repair 2007-08-14 11:45:17 0 d-------- C:\WINDOWS\mui 2007-08-14 11:45:17 0 d-------- C:\WINDOWS\msapps 2007-08-14 11:45:17 0 d-------- C:\WINDOWS\msagent 2007-08-14 11:45:17 0 d-------- C:\WINDOWS\Media 2007-08-14 11:45:17 0 d-------- C:\WINDOWS\java 2007-08-14 11:45:17 0 d–h----- C:\WINDOWS\inf 2007-08-14 11:45:17 0 d-------- C:\WINDOWS\ime 2007-08-14 11:45:17 0 d-------- C:\WINDOWS\Help 2007-08-14 11:45:17 0 dr–s---- C:\WINDOWS\Fonts 2007-08-14 11:45:17 0 d-------- C:\WINDOWS\Driver Cache 2007-08-14 11:45:17 0 d-------- C:\WINDOWS\Debug 2007-08-14 11:45:17 0 d-------- C:\WINDOWS\Cursors 2007-08-14 11:45:17 0 d-------- C:\WINDOWS\Connection Wizard 2007-08-14 11:45:17 0 d-------- C:\WINDOWS\Config 2007-08-14 11:45:17 0 d-------- C:\WINDOWS\AppPatch 2007-08-14 11:45:17 0 d-------- C:\WINDOWS\addins 2007-08-14 11:16:24 0 d-------- C:\WINDOWS\System32\xircom 2007-08-14 11:16:24 0 d-------- C:\Program Files\microsoft frontpage 2007-08-14 11:16:06 0 -rahs---- C:\MSDOS.SYS 2007-08-14 11:16:06 0 -rahs---- C:\IO.SYS 2007-08-14 11:16:06 0 --a------ C:\CONFIG.SYS 2007-08-14 11:16:06 0 --a------ C:\AUTOEXEC.BAT 2007-08-14 11:15:06 0 dr------- C:\WINDOWS\Offline Web Pages 2007-08-14 11:15:06 0 d—s---- C:\WINDOWS\Downloaded Program Files 2007-08-14 11:14:34 0 d-------- C:\WINDOWS\srchasst 2007-08-14 11:14:22 0 d-------- C:\WINDOWS\System32\DirectX 2007-08-14 11:14:21 0 d-------- C:\WINDOWS\System32\Macromed 2007-08-14 11:13:48 0 d-------- C:\Program Files\Movie Maker 2007-08-14 11:12:50 0 d-------- C:\WINDOWS\System32\Restore 2007-08-14 11:12:39 0 d-------- C:\WINDOWS\PCHEALTH 2007-08-14 11:12:25 0 d—s---- C:\WINDOWS\Tasks 2007-08-14 11:12:18 0 d-------- C:\Program Files\Common Files\MSSoap 2007-08-14 11:11:43 21856 --a------ C:\WINDOWS\System32\emptyregdb.dat 2007-08-14 11:11:28 0 d-------- C:\WINDOWS\Registration 2007-08-14 11:11:21 0 d–h----- C:\Program Files\WindowsUpdate 2007-08-14 11:11:21 0 d-------- C:\Program Files\Usługi online 2007-08-14 11:11:15 0 d-------- C:\Program Files\Messenger 2007-08-14 11:10:54 0 d-------- C:\Program Files\MSN Gaming Zone 2007-08-14 11:10:37 0 d-------- C:\Program Files\Windows NT 2007-08-14 11:10:12 0 d-------- C:\WINDOWS\System32\MsDtc 2007-08-14 11:10:06 0 d-------- C:\WINDOWS\System32\Com 2007-08-14 10:51:08 0 d-------- C:\Program Files\Common Files\ODBC 2007-08-14 10:51:01 0 d-------- C:\Program Files\Common Files\SpeechEngines 2007-08-14 10:51:00 0 dr------- C:\Program Files 2007-08-14 10:51:00 0 d-------- C:\Program Files\Common Files 2007-08-14 10:49:36 0 d-------- C:\WINDOWS\System32\CatRoot2 2007-08-14 10:49:36 0 d-------- C:\WINDOWS\System32\CatRoot 2007-08-14 10:49:17 0 d-------- C:\Documents and Settings – Find3M Report --------------------------------------------------------------- 2007-08-20 02:15:47 0 d-------- C:\Documents and Settings\Daruś\Dane aplikacji\Adobe 2007-08-19 23:31:26 0 d-------- C:\Documents and Settings\Daruś\Dane aplikacji\AVS4YOU 2007-08-19 00:08:50 0 d-------- C:\Documents and Settings\Daruś\Dane aplikacji\Google 2007-08-15 15:12:13 355830 --a------ C:\WINDOWS\System32\perfh015.dat 2007-08-15 15:12:13 49712 --a------ C:\WINDOWS\System32\perfc015.dat 2007-08-14 14:32:47 0 d-------- C:\Documents and Settings\Daruś\Dane aplikacji\Microsoft Web Folders 2007-08-14 12:49:17 0 d-------- C:\Documents and Settings\Daruś\Dane aplikacji\ACD Systems 2007-08-14 12:49:16 0 d-------- C:\Documents and Settings\Daruś\Dane aplikacji\CyberLink 2007-08-14 12:49:16 0 d-------- C:\Documents and Settings\Daruś\Dane aplikacji\Canon 2007-08-14 12:49:16 0 d-------- C:\Documents and Settings\Daruś\Dane aplikacji\ATI 2007-08-14 12:49:16 0 d-------- C:\Documents and Settings\Daruś\Dane aplikacji\Apple Computer 2007-08-14 12:49:16 0 d-------- C:\Documents and Settings\Daruś\Dane aplikacji\AdobeUM 2007-08-14 12:49:16 0 d-------- C:\Documents and Settings\Daruś\Dane aplikacji\AdobeAUM 2007-08-14 12:49:15 0 d-------- C:\Documents and Settings\Daruś\Dane aplikacji\Identities 2007-08-14 12:49:15 0 d-------- C:\Documents and Settings\Daruś\Dane aplikacji\Help 2007-08-14 12:49:15 0 d-------- C:\Documents and Settings\Daruś\Dane aplikacji\GanymedeNet 2007-08-14 12:49:13 0 d-------- C:\Documents and Settings\Daruś\Dane aplikacji\Macromedia 2007-08-14 12:49:13 0 d-------- C:\Documents and Settings\Daruś\Dane aplikacji\Leadertech 2007-08-14 12:49:13 0 d-------- C:\Documents and Settings\Daruś\Dane aplikacji\Lavasoft 2007-08-14 12:49:10 0 d-------- C:\Documents and Settings\Daruś\Dane aplikacji\Mozilla 2007-08-14 12:49:09 0 d-------- C:\Documents and Settings\Daruś\Dane aplikacji\Skype 2007-08-14 12:49:09 0 d-------- C:\Documents and Settings\Daruś\Dane aplikacji\Real 2007-08-14 12:49:09 0 d-------- C:\Documents and Settings\Daruś\Dane aplikacji\Petroglyph 2007-08-14 12:49:08 0 d-------- C:\Documents and Settings\Daruś\Dane aplikacji\Xfire 2007-08-14 12:49:08 0 d-------- C:\Documents and Settings\Daruś\Dane aplikacji\vlc 2007-08-14 12:49:08 0 d-------- C:\Documents and Settings\Daruś\Dane aplikacji\TVU networks 2007-08-14 12:49:08 0 d-------- C:\Documents and Settings\Daruś\Dane aplikacji\Symantec 2007-08-14 12:49:08 0 d-------- C:\Documents and Settings\Daruś\Dane aplikacji\SopCast 2007-06-07 21:10:48 20480 --a------ C:\WINDOWS\System32\ac3config.exe – Registry Dump --------------------------------------------------------------- *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “VTTimer”=“VTTimer.exe” [2005-03-07 21:33 C:\WINDOWS\system32\VTTimer.exe] “VTTrayp”=“VTtrayp.exe” [2005-01-11 01:33 C:\WINDOWS\system32\VTTrayp.exe] “SoundMan”=“SOUNDMAN.EXE” [2004-12-22 11:09 C:\WINDOWS\SOUNDMAN.EXE] “WOOWATCH”=“C:\PROGRA~1\NEOSTR~1\Watch.exe” [2004-08-23 14:49] “WOOTASKBARICON”=“C:\PROGRA~1\NEOSTR~1\GestMaj.exe” [2004-10-14 16:55] “nod32kui”=“C:\Program Files\Eset\nod32kui.exe” [2007-08-17 20:36] “Adobe Photo Downloader”=“C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe” [2007-03-09 11:09] “Adobe Reader Speed Launcher”=“C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe” [2007-05-11 03:06] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “Odkurzacz-MCD”=“C:\Program Files\Odkurzacz\odk_mcd.exe” [2007-05-03 10:02] C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\ Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office\OSA9.EXE [2000-01-21 08:15:54] VIA RAID TOOL.lnk - C:\Program Files\VIA\RAID\raid_tool.exe [2007-08-14 16:12:53] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice] @=“Service” – End of Deckard’s System Scanner: finished at 2007-08-29 01:09:15 ------------

Pozdrawiam

[Gutek]

Na koniec Skaner online - http://www.eset.pl/onlinescan

[Dariusz_J]

Przeskanowane - zero zagrożeń

Jesteście wspaniali, dziękuję jak nie wiem co. To Forum to prawdziwy skarb w necie.

Życzę dobrej nocy.

Złączono Posta : 02.09.2007 (Nie) 22:43

Witam ponownie,

Po kilku dniach bezstresowej pracy w necie postanowiłem przeskanować dysk NOD-em. Ku mojemu zdziwueniu, NOD wykrył 2 wirusy - w tym jeden w Virtmundo :o ?

C:\Documents and Settings\Daruś\Moje dokumenty\SDFix.exe »RAR »SDFix\apps\Process.exe - Win32/PrcView Program

C:\Documents and Settings\Daruś\Pulpit\VirtumundoBeGone.exe »NSIS »aaa - Win32/PrcView Program

Czy to możliwe, że nie wszystko zostało usunięte z dysku ? A może NOD32 jest tak nieskuteczny, że znów coś złapałem ?

Co gorsza, NOD nie może usunąć tych wirusów i mam w raporcie: liczba aktywnych wirusów: 2.

Dziękuję z góry za porady, pozdrawiam.