Prosze o sprawdzenie

rafijagger · 5 Październik 2008 10:11

Logfile of HijackThis v1.99.1

Scan saved at 10:57:03, on 2008-10-05

Platform: Windows XP Dodatek SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16705)

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Ahead\InCD\InCDsrv.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe

C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

C:\WINDOWS\explorer.exe

C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\wanmpsvc.exe

C:\WINDOWS\system32\ctfmon.exe

C:\WINDOWS\system32\WgaTray.exe

C:\Program Files\AOL 9.0 VR\waol.exe

C:\Program Files\Common Files\AOL\1156526376\ee\aolsoftware.exe

c:\program files\common files\aol\1156526376\ee\services\antiSpywareApp\ver2_0_12\AOLSP Scheduler.exe

C:\Program Files\AOL 9.0 VR\shellmon.exe

C:\Program Files\Common Files\AOL\Topspeed\3.0\aoltpsd3.exe

C:\WINDOWS\system32\taskmgr.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\Documents and Settings\user\Pulpit\hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://my.safeappsoftware.com/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza

R3 - URLSearchHook: Winamp Search Class - {57BCA5FA-5DBB-45a2-B558-1755C3F6253B} - C:\Program Files\Winamp Toolbar\winamptb.dll

R3 - URLSearchHook: AOLTBSearch Class - {EA756889-2338-43DB-8F07-D1CA6FB9C90D} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll

F2 - REG:system.ini: Shell=explorer.exe

O1 - Hosts: 127.255.255.255 serial.alcohol-soft.com

O1 - Hosts: 127.255.255.255 www.alcohol-soft.com

O1 - Hosts: 127.255.255.255 images.alcohol-soft.com

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll

O2 - BHO: Winamp Toolbar Loader - {25CEE8EC-5730-41bc-8B58-22DDC8AB8C20} - C:\Program Files\Winamp Toolbar\winamptb.dll

O2 - BHO: Alcohol Toolbar Helper - {52D06F97-5511-43FA-8FDA-C481864FD26E} - C:\Program Files\Alcohol Toolbar\v3.2.0.0\Alcohol_Toolbar.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll

O2 - BHO: AOL Toolbar Launcher - {7C554162-8CB7-45A4-B8F4-8EA1C75885F9} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll

O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll

O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.0.1225.9868\swg.dll

O3 - Toolbar: AOL Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll

O3 - Toolbar: (no name) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)

O3 - Toolbar: Alcohol Toolbar - {4C4E7CDB-5BFC-4D74-83E2-8AE659B7EDA2} - C:\Program Files\Alcohol Toolbar\v3.2.0.0\Alcohol_Toolbar.dll

O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll

O3 - Toolbar: Winamp Toolbar - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - C:\Program Files\Winamp Toolbar\winamptb.dll

O4 - HKCU…\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU…\Run: [Registry Helper] “C:\Program Files\Registry Helper\LaunchRegistryHelper.Exe” “C:\Program Files\Registry Helper\RegistryHelper.Exe” /boot

O4 - HKCU…\Run: [Disk Cleaner] “C:\Program Files\Disk Cleaner\LaunchDiskCleaner.Exe” “C:\Program Files\Disk Cleaner\DiskCleaner.Exe” /boot

O8 - Extra context menu item: &AOL Toolbar Search - c:\program files\aol\aol toolbar 2.0\resources\en-GB\local\search.html

O8 - Extra context menu item: &Winamp Search - C:\Documents and Settings\All Users\Dane aplikacji\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html

O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000

O8 - Extra context menu item: Transfer by Image Converter 3 - C:\PROGRAM FILES\SONY\IMAGE CONVERTER 3\menu.htm

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll

O9 - Extra ‘Tools’ menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll

O9 - Extra button: AOL Toolbar - {3369AF0D-62E9-4bda-8103-B4C75499B578} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll

huber2t · 5 Październik 2008 10:13

fix w hijackthis

Podaj log z Combofix

rafijagger · 5 Październik 2008 10:49

ComboFix 08-10-04.07 - user 2008-10-05 11:20:44.1 - NTFSx86

Uruchomiony z: C:\Documents and Settings\user\Pulpit\ComboFix.exe

UWAGA - TEN KOMPUTER NIE MA ZAINSTALOWANEJ KONSOLI ODZYSKIWANIA

.

((((((((((((((((((((((((((((((((((((((( Usunięto )))))))))))))))))))))))))))))))))))))))))))))))))

.

C:\Documents and Settings\All Users\Dane aplikacji\Starware343

C:\Documents and Settings\All Users\Dane aplikacji\Starware343\buttons\FindIt.bmp

C:\Documents and Settings\All Users\Dane aplikacji\Starware343\buttons\FindItHot.bmp

C:\Documents and Settings\All Users\Dane aplikacji\Starware343\buttons\findithotxp.png

C:\Documents and Settings\All Users\Dane aplikacji\Starware343\buttons\finditxp.png

C:\Documents and Settings\All Users\Dane aplikacji\Starware343\buttons\Highlight.bmp

C:\Documents and Settings\All Users\Dane aplikacji\Starware343\buttons\HighlightHot.bmp

C:\Documents and Settings\All Users\Dane aplikacji\Starware343\buttons\highlighthotxp.png

C:\Documents and Settings\All Users\Dane aplikacji\Starware343\buttons\highlightxp.png

C:\Documents and Settings\All Users\Dane aplikacji\Starware343\buttons\maps.bmp

C:\Documents and Settings\All Users\Dane aplikacji\Starware343\buttons\maps_over.bmp

C:\Documents and Settings\All Users\Dane aplikacji\Starware343\buttons\Reference.bmp

C:\Documents and Settings\All Users\Dane aplikacji\Starware343\buttons\ReferenceHot.bmp

C:\Documents and Settings\All Users\Dane aplikacji\Starware343\buttons\referencehotxp.png

C:\Documents and Settings\All Users\Dane aplikacji\Starware343\buttons\referencexp.png

C:\Documents and Settings\All Users\Dane aplikacji\Starware343\buttons\starware_toolbar_icon.bmp

C:\Documents and Settings\All Users\Dane aplikacji\Starware343\buttons\Weather.bmp

C:\Documents and Settings\All Users\Dane aplikacji\Starware343\buttons\weatherhotxp.png

C:\Documents and Settings\All Users\Dane aplikacji\Starware343\buttons\weatherxp.png

C:\Documents and Settings\All Users\Dane aplikacji\Starware343\contexts\error.xml

C:\Documents and Settings\All Users\Dane aplikacji\Starware343\contexts\related.xml

C:\Documents and Settings\All Users\Dane aplikacji\Starware343\contexts\Travel.xml

C:\Documents and Settings\All Users\Dane aplikacji\Starware343\images\walertXP.bmp

C:\Documents and Settings\All Users\Dane aplikacji\Starware343\SimpleUpdate\ProductMessagingConfig.xml

C:\Documents and Settings\All Users\Dane aplikacji\Starware343\SimpleUpdate\ProductMessagingConfig.xml.backup

C:\Documents and Settings\All Users\Dane aplikacji\Starware343\SimpleUpdate\SimpleUpdateConfig.xml

C:\Documents and Settings\All Users\Dane aplikacji\Starware343\SimpleUpdate\SimpleUpdateConfig.xml.backup

C:\Documents and Settings\All Users\Dane aplikacji\Starware343\SimpleUpdate\TimerManagerConfig.xml

C:\Documents and Settings\All Users\Dane aplikacji\Starware343\SimpleUpdate\TimerManagerConfig.xml.backup

C:\Documents and Settings\All Users\Menu Start\Programy\WinAntiVirus Pro 2006

C:\Documents and Settings\user\Dane aplikacji\Starware343

C:\Documents and Settings\user\Dane aplikacji\Starware343\BrowserSearch\BrowserSearch.xml

C:\Documents and Settings\user\Dane aplikacji\Starware343\BrowserSearch\BrowserSearch.xml.backup

C:\Documents and Settings\user\Dane aplikacji\Starware343\Configurator\Configurator.xml

C:\Documents and Settings\user\Dane aplikacji\Starware343\Configurator\Configurator.xml.backup

C:\Documents and Settings\user\Dane aplikacji\Starware343\ErrorSearch\ErrorSearchOptions.xml

C:\Documents and Settings\user\Dane aplikacji\Starware343\ErrorSearch\ErrorSearchOptions.xml.backup

C:\Documents and Settings\user\Dane aplikacji\Starware343\Games\GamesOptions.xml

C:\Documents and Settings\user\Dane aplikacji\Starware343\Games\GamesOptions.xml.backup

C:\Documents and Settings\user\Dane aplikacji\Starware343\Games\images\active\Games0.bmp

C:\Documents and Settings\user\Dane aplikacji\Starware343\Layouts\ToolbarLayout.xml

C:\Documents and Settings\user\Dane aplikacji\Starware343\Layouts\ToolbarLayout.xml.backup

C:\Documents and Settings\user\Dane aplikacji\Starware343\Manager\ManagerOptions.xml

C:\Documents and Settings\user\Dane aplikacji\Starware343\Manager\ManagerOptions.xml.backup

C:\Documents and Settings\user\Dane aplikacji\Starware343\Maps\MapsOptions.xml

C:\Documents and Settings\user\Dane aplikacji\Starware343\Maps\MapsOptions.xml.backup

C:\Documents and Settings\user\Dane aplikacji\Starware343\Movies\images\active\Movies0.bmp

C:\Documents and Settings\user\Dane aplikacji\Starware343\Movies\MoviesOptions.xml

C:\Documents and Settings\user\Dane aplikacji\Starware343\Movies\MoviesOptions.xml.backup

C:\Documents and Settings\user\Dane aplikacji\Starware343\Reference\ReferenceOptions.xml

C:\Documents and Settings\user\Dane aplikacji\Starware343\Reference\ReferenceOptions.xml.backup

C:\Documents and Settings\user\Dane aplikacji\Starware343\RelatedSearch\RelatedSearchOptions.xml

C:\Documents and Settings\user\Dane aplikacji\Starware343\RelatedSearch\RelatedSearchOptions.xml.backup

C:\Documents and Settings\user\Dane aplikacji\Starware343\ScreensaversMarketingSitePager\images\active\ScreensaversMarketingSitePager0.bmp

C:\Documents and Settings\user\Dane aplikacji\Starware343\ScreensaversMarketingSitePager\ScreensaversMarketingSitePagerOptions.xml

C:\Documents and Settings\user\Dane aplikacji\Starware343\ScreensaversMarketingSitePager\ScreensaversMarketingSitePagerOptions.xml.backup

C:\Documents and Settings\user\Dane aplikacji\Starware343\Toolbar\TBProductsOptions.xml

C:\Documents and Settings\user\Dane aplikacji\Starware343\Toolbar\TBProductsOptions.xml.backup

C:\Documents and Settings\user\Dane aplikacji\Starware343\ToolbarLogo\ToolbarLogoOptions.xml

C:\Documents and Settings\user\Dane aplikacji\Starware343\ToolbarLogo\ToolbarLogoOptions.xml.backup

C:\Documents and Settings\user\Dane aplikacji\Starware343\ToolbarSearch\ToolbarSearchOptions.xml

C:\Documents and Settings\user\Dane aplikacji\Starware343\ToolbarSearch\ToolbarSearchOptions.xml.backup

C:\Documents and Settings\user\Dane aplikacji\Starware343\TravelSearch\TravelSearchOptions.xml

C:\Documents and Settings\user\Dane aplikacji\Starware343\TravelSearch\TravelSearchOptions.xml.backup

C:\Documents and Settings\user\Dane aplikacji\Starware343\Weather\AlertArchive.xml

C:\Documents and Settings\user\Dane aplikacji\Starware343\Weather\WeatherOptions.xml

C:\Documents and Settings\user\Dane aplikacji\Starware343\Weather\WeatherOptions.xml.backup

C:\Program Files\Common Files\companion wizard

C:\Program Files\Common Files\companion wizard\log.txt

C:\Program Files\Common Files\companion wizard\WapCHK.dll

C:\Program Files\Starware343

C:\Program Files\Starware343\brand.bmp

C:\Program Files\Starware343\Starware343Config.xml

C:\Program Files\Starware343\Starware343Uninstall.exe

C:\WA6P

C:\WINDOWS\dialerexe.ini

.

((((((((((((((((((((((((((((((((((((((( Sterowniki/Usługi )))))))))))))))))))))))))))))))))))))))))))))))))

.

-------\Legacy_FOPN

-------\Legacy_WINDOWS_LOG

-------\Service_FOPN

-------\Service_vspf

-------\Service_vspf_hk

-------\Service_Windows Log

((((((((((((((((((((((((( Pliki utworzone od 2008-09-05 do 2008-10-05 )))))))))))))))))))))))))))))))

.

2008-10-05 00:59 . 2008-10-05 00:59

2008-10-05 00:58 . 2008-10-05 01:12

2008-10-04 23:27 . 2008-10-04 23:27

2008-10-04 23:14 . 2008-10-04 23:46

2008-10-01 23:29 . 2008-10-01 23:29

2008-09-25 21:03 . 2007-05-12 17:04

2008-09-25 19:45 . 2008-09-25 22:02

2008-09-25 19:34 . 2008-09-25 22:22 167 --a------ C:\WINDOWS\wcx_ftp.ini

2008-09-25 19:30 . 2008-09-25 19:30

2008-09-21 19:04 . 2008-09-21 19:04

2008-09-21 18:23 . 2008-09-21 18:23

2008-09-21 18:17 . 2008-09-21 19:59

2008-09-19 21:30 . 2008-09-19 21:30

2008-09-19 21:25 . 2008-09-19 21:30

2008-09-19 20:53 . 2004-08-03 22:41 1,309,184 --------- C:\WINDOWS\system32\drivers\mtlstrm.sys

2008-09-19 20:53 . 2004-08-03 22:41 1,041,536 --------- C:\WINDOWS\system32\drivers\hsfdpsp2.sys

2008-09-19 20:53 . 2004-08-03 22:41 685,056 --------- C:\WINDOWS\system32\drivers\hsfcxts2.sys

2008-09-19 20:53 . 2004-08-03 22:29 452,736 --------- C:\WINDOWS\system32\drivers\mtxparhm.sys

2008-09-19 20:53 . 2004-08-03 22:41 220,032 --------- C:\WINDOWS\system32\drivers\hsfbs2s2.sys

2008-09-19 20:53 . 2004-07-17 22:55 129,045 --------- C:\WINDOWS\system32\drivers\cxthsfs2.cty

2008-09-19 20:53 . 2004-08-03 22:41 126,686 --------- C:\WINDOWS\system32\drivers\mtlmnt5.sys

2008-09-19 20:53 . 2004-08-03 22:41 11,868 --------- C:\WINDOWS\system32\drivers\mdmxsdk.sys

2008-09-17 19:51 . 2008-09-17 19:51

2008-09-17 19:50 . 2008-10-01 23:01

.

(((((((((((((((((((((((((((((((((((((((( Sekcja Find3M ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2008-10-05 09:38 --------- d-----w C:\Program Files\eMule

2008-10-04 22:34 --------- d-----w C:\Documents and Settings\user\Dane aplikacji\Azureus

2008-10-02 21:22 --------- d-----w C:\Documents and Settings\user\Dane aplikacji\Skype

2008-10-01 21:58 --------- d-----w C:\Program Files\Championship Manager 2007

2008-10-01 17:20 --------- d-----w C:\Program Files\Winamp

2008-09-08 16:58 --------- d-----w C:\Program Files\SkanerOnline

2008-09-06 18:26 --------- d-----w C:\Program Files\TVUPlayer

2008-08-24 09:20 --------- d-----w C:\Program Files\AOL 9.0 VR

2008-08-23 20:36 --------- d-----w C:\Program Files\iTunes

2008-08-23 20:36 --------- d-----w C:\Program Files\iPod

2008-08-23 20:34 --------- d-----w C:\Program Files\QuickTime

2008-08-23 20:34 --------- d-----w C:\Program Files\Bonjour

2008-08-23 20:32 --------- d-----w C:\Program Files\Apple Software Update

2008-08-23 20:31 --------- d-----w C:\Program Files\Common Files\Apple

2008-08-23 20:31 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Apple

2008-08-17 17:04 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\TVU Networks

2008-03-09 16:40 20,336 ----a-w C:\Documents and Settings\user\Dane aplikacji\GDIPFONTCACHEV1.DAT

2006-11-11 17:52 0 ----a-w C:\Program Files\Common Files\err.log

.

((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane

REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]

“{57BCA5FA-5DBB-45a2-B558-1755C3F6253B}”= “C:\Program Files\Winamp Toolbar\winamptb.dll” [2008-07-16 1266992]

[HKEY_CLASSES_ROOT\clsid{57bca5fa-5dbb-45a2-b558-1755c3f6253b}]

[HKEY_CLASSES_ROOT\WINAMPTB.AOLTBSearch.1]

[HKEY_CLASSES_ROOT\TypeLib{538CD77C-BFDD-49b0-9562-77419CAB89D1}]

[HKEY_CLASSES_ROOT\WINAMPTB.AOLTBSearch]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

“ctfmon.exe”=“C:\WINDOWS\system32\ctfmon.exe” [2008-04-14 15360]

[HKEY_USERS.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

“CTFMON.EXE”=“C:\WINDOWS\system32\CTFMON.EXE” [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]

“msacm.avis”= ff_acm.acm

[HKLM~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Adobe Gamma Loader.lnk]

path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Adobe Gamma Loader.lnk

backup=C:\WINDOWS\pss\Adobe Gamma Loader.lnkCommon Startup

[HKLM~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Adobe Reader Speed Launch.lnk]

path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Adobe Reader Speed Launch.lnk

backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup

[HKLM~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^AOL 9.0 Tray Icon.lnk]

path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\AOL 9.0 Tray Icon.lnk

backup=C:\WINDOWS\pss\AOL 9.0 Tray Icon.lnkCommon Startup

[HKLM~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^AOL Companion.lnk]

path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\AOL Companion.lnk

backup=C:\WINDOWS\pss\AOL Companion.lnkCommon Startup

[HKLM~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^hpoddt01.exe.lnk]

path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\hpoddt01.exe.lnk

backup=C:\WINDOWS\pss\hpoddt01.exe.lnkCommon Startup

[HKLM~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Logitech Desktop Messenger.lnk]

path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Logitech Desktop Messenger.lnk

backup=C:\WINDOWS\pss\Logitech Desktop Messenger.lnkCommon Startup

[HKLM~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Logitech SetPoint.lnk]

path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Logitech SetPoint.lnk

backup=C:\WINDOWS\pss\Logitech SetPoint.lnkCommon Startup

[HKLM~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Microsoft Office.lnk]

path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Microsoft Office.lnk

backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg%FP%Friendly fts.exe]

–a------ 2003-05-06 08:28 72192 C:\Program Files\VoyagerTest\fts.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AOLDialer]

-ra------ 2007-12-07 16:30 71008 C:\Program Files\Common Files\AOL\ACS\AOLDial.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AppleSyncNotifier]

–a------ 2008-07-22 20:42 116040 C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATIPTA]

–a------ 2003-09-02 20:10 335872 C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE]

–a------ 2008-04-14 18:21 15360 C:\WINDOWS\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DSLAGENTEXE]

--------- 2003-08-19 11:47 16384 C:\Program Files\BT Voyager 105 ADSL Modem\dslagent.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DSLSTATEXE]

--------- 2003-06-28 14:10 1658965 C:\Program Files\BT Voyager 105 ADSL Modem\dslstat.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Gadu-Gadu]

–a------ 2007-07-09 08:39 2119104 C:\Program Files\Gadu-Gadu\gg.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HostManager]

–a------ 2006-11-17 14:21 50736 C:\Program Files\Common Files\AOL\1156526376\ee\aolsoftware.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\InCD]

--------- 2004-09-13 10:51 1450096 C:\Program Files\Ahead\InCD\InCD.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]

–a------ 2008-07-30 10:47 289064 C:\Program Files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\mRouterConfig]

–a------ 2006-03-02 11:54 290816 C:\Program Files\Intuwave\Shared\mRouterRuntime\mRouterConfig.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]

--------- 2008-04-14 18:21 1695232 C:\Program Files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]

–a------ 2001-07-09 10:50 155648 C:\WINDOWS\system32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PC Suite for Smartphones]

-ra------ 2007-05-28 10:14 528384 C:\Program Files\Sony Ericsson\Mobile4\Application Launcher\Application Launcher.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ppmate]

–a------ 2006-10-27 10:43 1495111 C:\Program Files\PPMate\PPMate\ppmate.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]

–a------ 2008-05-27 10:50 413696 C:\Program Files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RealTray]

–a------ 2006-02-25 07:00 26112 C:\Program Files\Real\RealPlayer\realplay.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]

-ra------ 2007-07-02 17:10 23237416 C:\Program Files\Skype\Phone\Skype.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SSC_UserPrompt]

–a------ 2004-11-02 16:59 218240 C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]

–a------ 2005-11-10 13:03 36975 C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]

–a------ 2007-07-17 20:48 68856 C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Symantec NetDriver Monitor]

–a------ 2006-11-15 10:13 100056 C:\PROGRA~1\SYMNET~1\SNDMon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\updateMgr]

-ra------ 2006-03-30 16:45 313472 C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATIModeChange]

–a------ 2001-09-03 23:00 28672 C:\WINDOWS\system32\Ati2mdxx.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center]

“AntiVirusOverride”=dword:00000001

“FirewallOverride”=dword:00000001

[HKLM~\services\sharedaccess\parameters\firewallpolicy\standardprofile]

“EnableFirewall”= 0 (0x0)

[HKLM~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

“%windir%\system32\sessmgr.exe”=

“C:\WINDOWS\system32\ftp.exe”=

“%windir%\Network Diagnostic\xpnetdiag.exe”=

“C:\Program Files\Bonjour\mDNSResponder.exe”=

“C:\Program Files\iTunes\iTunes.exe”=

“C:\Program Files\sina\SAP\SAPlatform.exe”=

“C:\Program Files\Common Files\AOL\Loader\aolload.exe”=

“C:\Program Files\Common Files\AOL\1156526376\ee\aolsoftware.exe”=

“C:\Program Files\PPMate\PPMate\ppmate.exe”=

“C:\Program Files\Skype\Phone\Skype.exe”=

“C:\Program Files\uTorrent\uTorrent.exe”=

“C:\Program Files\Common Files\AOL\ACS\AOLDial.exe”=

“C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe”=

“C:\Program Files\Common Files\AOL\1156526376\ee\AOLServiceHost.exe”=

“C:\Program Files\AOL 9.0a\waol.exe”=

“C:\Program Files\AOL 9.0 VR\waol.exe”=

“C:\Program Files\Common Files\AOL\System Information\sinf.exe”=

“C:\Program Files\Common Files\AOL\TopSpeed\3.0\aoltpsd3.exe”=

“C:\Program Files\eMule\emule.exe”=

[HKLM~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]

“3389:TCP”= 3389:TCP:@xpsp2res.dll,-22009

R2 GDTdiInterceptor;GDTdiInterceptor;C:\WINDOWS\system32\drivers\GDTdiIcpt.sys [2006-10-02 27219]

R3 lanusb;GlobeSpan USB ADSL LAN Modem;C:\WINDOWS\system32\DRIVERS\glausb.sys [2003-08-15 138402]

R3 LucentSoftModem;Lucent Technologies Soft Modem;C:\WINDOWS\system32\DRIVERS\LTSM.sys [2001-08-17 802683]

R3 PPPoEWin;PPPoEWin Miniport;C:\WINDOWS\system32\DRIVERS\PPPoEWin.SYS [2003-09-25 104375]

S3 ICScsiSV;Image Converter SCSI Service;C:\Program Files\Sony\IMAGE CONVERTER 3\ICScsiSV.exe [2007-01-26 75952]

S3 IcVzMonLauncher;IcVzMonLauncher;C:\Program Files\Sony\IMAGE CONVERTER 3\IcVzMonLauncher.exe [2007-01-26 67760]

S3 Image Converter video recording monitor for VAIO Entertainment;Image Converter video recording monitor for VAIO Entertainment;C:\Program Files\Sony\IMAGE CONVERTER 3\IcVzMon.exe [2007-01-26 43184]

.

Zawartość folderu ‘Zaplanowane zadania’

2008-08-23 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job

C:\Program Files\Apple Software Update\SoftwareUpdate.exe [2008-04-11 17:57]

2008-10-04 C:\WINDOWS\Tasks\RegCure Program Check.job

C:\Program Files\RegCure\RegCure.exe [2008-04-21 22:21]

2008-10-04 C:\WINDOWS\Tasks\RegCure.job

C:\Program Files\RegCure\RegCure.exe [2008-04-21 22:21]

.

- - - USUNIĘTO PUSTE WPISY - - - -

HKCU-Run-Registry Helper - C:\Program Files\Registry Helper\LaunchRegistryHelper.Exe

HKCU-Run-Disk Cleaner - C:\Program Files\Disk Cleaner\LaunchDiskCleaner.Exe

MSConfigStartUp-Adobe Photo Downloader - C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe

MSConfigStartUp-Advanced Tools Check - C:\PROGRA~1\NORTON~1\AdvTools\ADVCHK.EXE

MSConfigStartUp-ccApp - C:\Program Files\Common Files\Symantec Shared\ccApp.exe

MSConfigStartUp-ccRegVfy - C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe

MSConfigStartUp-DC6_check - C:\Program Files\Common Files\dc6_startupmon.exe

MSConfigStartUp-ERS_check - C:\Program Files\Common Files\ers_startupmon.exe

MSConfigStartUp-FreeCall - C:\Program Files\FreeCall.com\FreeCall\FreeCall.exe

MSConfigStartUp-LDM - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe

MSConfigStartUp-NAV CfgWiz - C:\Program Files\Norton AntiVirus\CfgWiz.exe

MSConfigStartUp-Orb - C:\Program Files\Winamp Remote\bin\OrbTray.exe

MSConfigStartUp-PCSuiteTrayApplication - C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe

MSConfigStartUp-uwa6pcw - C:\Program Files\Common Files\uwa6pcw.exe

MSConfigStartUp-WMAAD - C:\Program Files\Sony\WALKMAN Launcher\WMAAD.exe

MSConfigStartUp-Logitech Hardware Abstraction Layer - KHALMNPR.EXE

.

------- Skan uzupełniający -------

.

FireFox -: Profile - C:\Documents and Settings\user\Dane aplikacji\Mozilla\Firefox\Profiles\y27laew6.default\

FireFox -: prefs.js - SEARCH.DEFAULTURL - hxxp://slirsredirect.search.aol.com/sli … ie7query=

FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://www.ebay.co.uk/

FF -: plugin - C:\Documents and Settings\user\Dane aplikacji\Mozilla\Firefox\Profiles\y27laew6.default\extensions\firefox@tvunetworks.com\plugins\npTVUAx.dll

FF -: plugin - C:\Program Files\Adobe\Acrobat 7.0\Reader\browser\nppdf32.dll

FF -: plugin - C:\Program Files\DivX\DivX Content Uploader\npUpload.dll

FF -: plugin - C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll

FF -: plugin - C:\Program Files\Java\jre1.5.0_06\bin\NPJava11.dll

FF -: plugin - C:\Program Files\Java\jre1.5.0_06\bin\NPJava12.dll

FF -: plugin - C:\Program Files\Java\jre1.5.0_06\bin\NPJava13.dll

FF -: plugin - C:\Program Files\Java\jre1.5.0_06\bin\NPJava14.dll

FF -: plugin - C:\Program Files\Java\jre1.5.0_06\bin\NPJava32.dll

FF -: plugin - C:\Program Files\Java\jre1.5.0_06\bin\NPJPI150_06.dll

FF -: plugin - C:\Program Files\Java\jre1.5.0_06\bin\NPOJI610.dll

FF -: plugin - C:\Program Files\Mozilla Firefox\plugins\np_gp.dll

FF -: plugin - C:\Program Files\Mozilla Firefox\plugins\npmozax.dll

FF -: plugin - C:\Program Files\Mozilla Firefox\plugins\npqtplugin8.dll

FF -: plugin - C:\Program Files\Mozilla Firefox\plugins\npunagi2.dll

FF -: plugin - C:\Program Files\QuickTime\Plugins\npqtplugin8.dll

FF -: plugin - C:\Program Files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll

.

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2008-10-05 11:29:41

Windows 5.1.2600 Dodatek Service Pack 3 NTFS

skanowanie ukrytych procesów …

skanowanie ukrytych wpisów autostartu …

skanowanie ukrytych plików …

skanowanie pomyślnie ukończone

ukryte pliki: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet002\Services\MySql]

“ImagePath”=“c:\usr/MYSQL/bin/mysqld.exe”

.

--------------------- Pliki DLL ładowane pod uruchomionymi procesami ---------------------

PROCES: C:\WINDOWS\explorer.exe

?:\WINDOWS\system32\MLANG.dll
?:\WINDOWS\system32\MLANG.dll
?:\WINDOWS\system32\MLANG.dll
?:\WINDOWS\system32\MLANG.dll

.

------------------------ Pozostałe uruchomione procesy ------------------------

.

C:\WINDOWS\system32\ati2evxx.exe

C:\Program Files\Ahead\InCD\InCDsrv.exe

C:\Program Files\Common Files\AOL\ACS\AOLacsd.exe

C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\WINDOWS\wanmpsvc.exe

C:\WINDOWS\system32\WgaTray.exe

.

**************************************************************************

.

Czas ukończenia: 2008-10-05 11:40:03 - komputer został uruchomiony ponownie

ComboFix-quarantined-files.txt 2008-10-05 10:39:49

Przed: 8 413 701 632 bajtów wolnych

Po: 8,450,638,336 bajtów wolnych

354 — E O F — 2008-10-01 17:17:49

huber2t · 5 Październik 2008 11:34

W logu nic nie widzę

usuń ręcznie folder C: \Qoobox , usuń instalkę Combofix z dysku.

Przeczyść komputer Ccleanerem

Wykonaj optymalizację autostartu

Wyłącz i włącz przywracanie systemu na wszystkich dyskach. Instrukcja

Przeskanuj obszar całego komputera http://www.kaspersky.pl/virusscanner.html (uruchom przez IE) Daj raport z niego na forum

lub

Dr.WEB CureIt!

Agaton · 5 Październik 2008 13:59

rafijagger ,

Zapoznaj się z tematem Ważny komunikat dotyczący tytułowania tematów - popraw tytuł na konkretny, mówiący o problemie, opisz również dokładnie problem. W celu dokonania zaleconej korekty - proszę użyć przycisku

Zignorowanie zalecenia będzie skutkowało usunięciem tematu do Kosza.

W związku ze zmianą, jaka obowiązuje przy wklejaniu logów w tym dziale, przeczytaj i zastosuj się do Tematu