Proszę sprawdzić moje logi

slimak281 · 8 Październik 2007 14:42

zrobilem scanowanie poszczegolnymi programami, chce wiedziec czy wszystko jest ok:fixwareout, Hijack this,Silent Runners,combofix. Prosze o pomoc :):

p.s Mialem czerwony pulpit cyt: “my privacy is in danger”, juz usunalem pare rzeczy i zniknal, ale chce sie upewnic czy jeszcze zadnego syfu nie ma.

Hijack:

Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 15:20:06, on 2007-10-08 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Eset\nod32krn.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Analog Devices\Core\smax4pnp.exe C:\WINDOWS\system32\hkcmd.exe C:\WINDOWS\system32\igfxpers.exe C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\Program Files\Eset\nod32kui.exe C:\Program Files\Winamp\winampa.exe C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe C:\WINDOWS\vsnpstd.exe C:\Program Files\Tlen.pl\tlen.exe C:\Program Files\Skype\Phone\Skype.exe C:\Program Files\DAEMON Tools\daemon.exe C:\WINDOWS\system32\notepad.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Skype\Plugin Manager\skypePM.exe C:\Program Files\Opera\Opera.exe C:\WINDOWS\system32\wuauclt.exe C:\WINDOWS\system32\wscntfy.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll O4 - HKLM…\Run: [soundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe O4 - HKLM…\Run: [soundMAX] C:\Program Files\Analog Devices\SoundMAX\Smax4.exe /tray O4 - HKLM…\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe O4 - HKLM…\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe O4 - HKLM…\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe O4 - HKLM…\Run: [synTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe O4 - HKLM…\Run: [nod32kui] “C:\Program Files\Eset\nod32kui.exe” /WAITSERVICE O4 - HKLM…\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe O4 - HKLM…\Run: [Adobe Reader Speed Launcher] “C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe” O4 - HKLM…\Run: [sunJavaUpdateSched] “C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe” O4 - HKLM…\Run: [snpstd] C:\WINDOWS\vsnpstd.exe O4 - HKCU…\Run: [Komunikator] C:\Program Files\Tlen.pl\tlen.exe O4 - HKCU…\Run: [skype] “C:\Program Files\Skype\Phone\Skype.exe” /nosplash /minimized O4 - HKCU…\Run: [DAEMON Tools] “C:\Program Files\DAEMON Tools\daemon.exe” -lang 1033 O4 - HKUS\S-1-5-19…\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User ‘USŁUGA LOKALNA’) O4 - HKUS\S-1-5-20…\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User ‘USŁUGA SIECIOWA’) O4 - HKUS\S-1-5-18…\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User ‘SYSTEM’) O4 - HKUS.DEFAULT…\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User ‘Default user’) O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll O9 - Extra ‘Tools’ menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe – End of file - 3514 bytes

fixwareout:

Username “—limak” - 2007-10-08 15:20:39 [Fixwareout edited 9/01/2007] ~~~Prerun check Pomyślnie opróżniono pamięć podręczną programu rozpoznawania nazw DNS. System was rebooted successfully.~~~ Postrun check HKLM\SOFTWARE~\Winlogon\ “System”="" … … ~~~Misc files. …~~~ Checking for older varients. … ~Current runs (hklm hkcu “run” Keys Only) [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “SoundMAXPnP”=“C:\Program Files\Analog Devices\Core\smax4pnp.exe” “SoundMAX”=“C:\Program Files\Analog Devices\SoundMAX\Smax4.exe /tray” “igfxtray”=“C:\WINDOWS\system32\igfxtray.exe” “igfxhkcmd”=“C:\WINDOWS\system32\hkcmd.exe” “igfxpers”=“C:\WINDOWS\system32\igfxpers.exe” “SynTPEnh”=“C:\Program Files\Synaptics\SynTP\SynTPEnh.exe” “nod32kui”="“C:\Program Files\Eset\nod32kui.exe” /WAITSERVICE" “WinampAgent”=“C:\Program Files\Winamp\winampa.exe” “Adobe Reader Speed Launcher”="“C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe”" “SunJavaUpdateSched”="“C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe”" “snpstd”=“C:\WINDOWS\vsnpstd.exe” [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “Komunikator”=“C:\Program Files\Tlen.pl\tlen.exe” “Skype”="“C:\Program Files\Skype\Phone\Skype.exe” /nosplash /minimized" “DAEMON Tools”="“C:\Program Files\DAEMON Tools\daemon.exe” -lang 1033" … Hosts file was reset, If you use a custom hosts file please replace it…~ End report ~~~~~

Silent Runners:

“Silent Runners.vbs”, revision 52, http://www.silentrunners.org/ Operating System: Windows XP SP2 Output limited to non-default values, except where indicated by “{++}” Startup items buried in registry: --------------------------------- HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ {++} “Komunikator” = “C:\Program Files\Tlen.pl\tlen.exe” [“o2.pl Sp. z o.o.”] “Skype” = ““C:\Program Files\Skype\Phone\Skype.exe” /nosplash /minimized” [“Skype Technologies S.A.”] “DAEMON Tools” = ““C:\Program Files\DAEMON Tools\daemon.exe” -lang 1033” [“DT Soft Ltd.”] HKLM\Software\Microsoft\Windows\CurrentVersion\Run\ {++} “SoundMAXPnP” = “C:\Program Files\Analog Devices\Core\smax4pnp.exe” [“Analog Devices, Inc.”] “SoundMAX” = “C:\Program Files\Analog Devices\SoundMAX\Smax4.exe /tray” [“Analog Devices, Inc.”] “igfxtray” = “C:\WINDOWS\system32\igfxtray.exe” [“Intel Corporation”] “igfxhkcmd” = “C:\WINDOWS\system32\hkcmd.exe” [“Intel Corporation”] “igfxpers” = “C:\WINDOWS\system32\igfxpers.exe” [“Intel Corporation”] “SynTPEnh” = “C:\Program Files\Synaptics\SynTP\SynTPEnh.exe” [“Synaptics, Inc.”] “nod32kui” = ““C:\Program Files\Eset\nod32kui.exe” /WAITSERVICE” ["Eset "] “Adobe Reader Speed Launcher” = ““C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe”” [“Adobe Systems Incorporated”] “SunJavaUpdateSched” = ““C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe”” [“Sun Microsystems, Inc.”] “snpstd” = “C:\WINDOWS\vsnpstd.exe” [empty string] HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}(Default) = (no title provided) -> {HKLM…CLSID} = “Adobe PDF Reader Link Helper” \InProcServer32(Default) = “C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll” [“Adobe Systems Incorporated”] {761497BB-D6F0-462C-B6EB-D4DAF1D92D43}(Default) = (no title provided) -> {HKLM…CLSID} = “SSVHelper Class” \InProcServer32(Default) = “C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll” [“Sun Microsystems, Inc.”] HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\ “{42071714-76d4-11d1-8b24-00a0c9068ff3}” = “Rozszerzenie CPL kadrowania wyświetlania” -> {HKLM…CLSID} = “Rozszerzenie CPL kadrowania wyświetlania” \InProcServer32(Default) = “deskpan.dll” [file not found] “{88895560-9AA2-1069-930E-00AA0030EBC8}” = “Rozszerzenie ikony HyperTerminalu” -> {HKLM…CLSID} = “HyperTerminal Icon Ext” \InProcServer32(Default) = “C:\WINDOWS\system32\hticons.dll” [“Hilgraeve, Inc.”] “{2F603045-309F-11CF-9774-0020AFD0CFF6}” = “Synaptics Control Panel” -> {HKLM…CLSID} = (no title provided) \InProcServer32(Default) = “C:\Program Files\Synaptics\SynTP\SynTPCpl.dll” [“Synaptics, Inc.”] “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” = “WinRAR shell extension” -> {HKLM…CLSID} = “WinRAR” \InProcServer32(Default) = “C:\Program Files\WinRAR\rarext.dll” [null data] “{B089FE88-FB52-11D3-BDF1-0050DA34150D}” = “NOD32 Context Menu Shell Extension” -> {HKLM…CLSID} = “NOD32 Context Menu Shell Extension” \InProcServer32(Default) = “C:\Program Files\Eset\nodshex.dll” [null data] “{C52AF81D-F7A0-4AAB-8E87-F80A60CCD396}” = “OpenOffice.org Column Handler” -> {HKLM…CLSID} = (no title provided) \InProcServer32(Default) = ““C:\Program Files\OpenOfficeT7 2.2.1\program\shlxthdl.dll”” [“Sun Microsystems, Inc.”] “{087B3AE3-E237-4467-B8DB-5A38AB959AC9}” = “OpenOffice.org Infotip Handler” -> {HKLM…CLSID} = (no title provided) \InProcServer32(Default) = ““C:\Program Files\OpenOfficeT7 2.2.1\program\shlxthdl.dll”” [“Sun Microsystems, Inc.”] “{63542C48-9552-494A-84F7-73AA6A7C99C1}” = “OpenOffice.org Property Sheet Handler” -> {HKLM…CLSID} = (no title provided) \InProcServer32(Default) = ““C:\Program Files\OpenOfficeT7 2.2.1\program\shlxthdl.dll”” [“Sun Microsystems, Inc.”] “{3B092F0C-7696-40E3-A80F-68D74DA84210}” = “OpenOffice.org Thumbnail Viewer” -> {HKLM…CLSID} = (no title provided) \InProcServer32(Default) = ““C:\Program Files\OpenOfficeT7 2.2.1\program\shlxthdl.dll”” [“Sun Microsystems, Inc.”] “{AD392E40-428C-459F-961E-9B147782D099}” = “UltraISO” -> {HKLM…CLSID} = “UIContextMenu Class” \InProcServer32(Default) = “C:\Program Files\UltraISO\isoshell.dll” [“EZB Systems, Inc.”] HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ <> igfxcui\DLLName = “igfxdev.dll” [“Intel Corporation”] HKLM\Software\Classes\Folder\shellex\ColumnHandlers\ {C52AF81D-F7A0-4AAB-8E87-F80A60CCD396}(Default) = “OpenOffice.org Column Handler” -> {HKLM…CLSID} = (no title provided) \InProcServer32(Default) = ““C:\Program Files\OpenOfficeT7 2.2.1\program\shlxthdl.dll”” [“Sun Microsystems, Inc.”] {F9DB5320-233E-11D1-9F84-707F02C10627}(Default) = “PDF Column Info” -> {HKLM…CLSID} = “PDF Shell Extension” \InProcServer32(Default) = “C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\PDFShell.dll” [“Adobe Systems, Inc.”] HKLM\Software\Classes*\shellex\ContextMenuHandlers\ NOD32 Context Menu Shell Extension(Default) = “{B089FE88-FB52-11D3-BDF1-0050DA34150D}” -> {HKLM…CLSID} = “NOD32 Context Menu Shell Extension” \InProcServer32(Default) = “C:\Program Files\Eset\nodshex.dll” [null data] WinRAR(Default) = “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” -> {HKLM…CLSID} = “WinRAR” \InProcServer32(Default) = “C:\Program Files\WinRAR\rarext.dll” [null data] HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\ UltraISO(Default) = “{AD392E40-428C-459F-961E-9B147782D099}” -> {HKLM…CLSID} = “UIContextMenu Class” \InProcServer32(Default) = “C:\Program Files\UltraISO\isoshell.dll” [“EZB Systems, Inc.”] WinRAR(Default) = “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” -> {HKLM…CLSID} = “WinRAR” \InProcServer32(Default) = “C:\Program Files\WinRAR\rarext.dll” [null data] HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\ NOD32 Context Menu Shell Extension(Default) = “{B089FE88-FB52-11D3-BDF1-0050DA34150D}” -> {HKLM…CLSID} = “NOD32 Context Menu Shell Extension” \InProcServer32(Default) = “C:\Program Files\Eset\nodshex.dll” [null data] UltraISO(Default) = “{AD392E40-428C-459F-961E-9B147782D099}” -> {HKLM…CLSID} = “UIContextMenu Class” \InProcServer32(Default) = “C:\Program Files\UltraISO\isoshell.dll” [“EZB Systems, Inc.”] WinRAR(Default) = “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” -> {HKLM…CLSID} = “WinRAR” \InProcServer32(Default) = “C:\Program Files\WinRAR\rarext.dll” [null data] Group Policies {GPedit.msc branch and setting}: ----------------------------------------------- Note: detected settings may not have any effect. HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\ “shutdownwithoutlogon” = (REG_DWORD) hex:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| Shutdown: Allow system to be shut down without having to log on} “undockwithoutlogon” = (REG_DWORD) hex:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| Devices: Allow undock without having to log on} Active Desktop and Wallpaper: ----------------------------- Active Desktop may be disabled at this entry: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState Displayed if Active Desktop enabled and wallpaper not set by Group Policy: HKCU\Software\Microsoft\Internet Explorer\Desktop\General\ “Wallpaper” = “C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp” Displayed if Active Desktop disabled and wallpaper not set by Group Policy: HKCU\Control Panel\Desktop\ “Wallpaper” = “C:\Documents and Settings\Ślimak\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp” Winsock2 Service Provider DLLs: ------------------------------- Namespace Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++} 000000000001\LibraryPath = “%SystemRoot%\System32\mswsock.dll” [MS] 000000000002\LibraryPath = “%SystemRoot%\System32\winrnr.dll” [MS] 000000000003\LibraryPath = “%SystemRoot%\System32\mswsock.dll” [MS] Transport Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++} 0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range: C:\WINDOWS\system32\imon.dll ["Eset "], 01 - 05, 11 %SystemRoot%\system32\mswsock.dll [MS], 06 - 08, 12 - 23 %SystemRoot%\system32\rsvpsp.dll [MS], 09 - 10 Toolbars, Explorer Bars, Extensions: ------------------------------------ Extensions (Tools menu items, main toolbar menu buttons) HKLM\Software\Microsoft\Internet Explorer\Extensions\ {08B0E5C0-4FCB-11CF-AAA5-00401C608501}\ “MenuText” = “Sun Java Console” “CLSIDExtension” = “{CAFEEFAC-0016-0000-0002-ABCDEFFEDCBC}” -> {HKCU…CLSID} = “Java Plug-in 1.6.0_02” \InProcServer32(Default) = “C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll” [“Sun Microsystems, Inc.”] -> {HKLM…CLSID} = “Java Plug-in 1.6.0_02” \InProcServer32(Default) = “C:\Program Files\Java\jre1.6.0_02\bin\npjpi160_02.dll” [“Sun Microsystems, Inc.”] Running Services (Display Name, Service Name, Path {Service DLL}): ------------------------------------------------------------------ NOD32 Kernel Service, NOD32krn, ““C:\Program Files\Eset\nod32krn.exe”” ["Eset "] Windows User Mode Driver Framework, UMWdf, “C:\WINDOWS\system32\wdfmgr.exe” [MS] ---------- (launch time: 2007-10-08 16:22:36) <>: Suspicious data at a malware launch point. + This report excludes default entries except where indicated. + To see *everywhere* the script checks and *everything* it finds, launch it from a command prompt or a shortcut with the -all parameter. + The search for DESKTOP.INI DLL launch points on all local fixed drives took 10 seconds. ---------- (total run time: 35 seconds)

combofix:

ComboFix 07-10-07.2 - —limak 2007-10-08 15:56:38.2 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.566 [GMT 2:00] Running from: E:\Instalki\Anty virusowe\ComboFix.exe . ((((((((((((((((((((((((( Files Created from 2007-09-08 to 2007-10-08 ))))))))))))))))))))))))))))))) . 2007-10-08 12:24 51,200 --a------ C:\WINDOWS\NirCmd.exe 2007-10-08 12:10 2,540 --a------ C:\WINDOWS\system32\tmp.reg 2007-10-08 11:40 2007-10-07 23:55 73,728 --a------ C:\WINDOWS\SrchPlug.dll 2007-10-07 22:27 2007-10-07 22:18 545 --a------ C:\WINDOWS\UC.PIF 2007-10-07 22:18 545 --a------ C:\WINDOWS\RAR.PIF 2007-10-07 22:18 545 --a------ C:\WINDOWS\PKZIP.PIF 2007-10-07 22:18 545 --a------ C:\WINDOWS\PKUNZIP.PIF 2007-10-07 22:18 545 --a------ C:\WINDOWS\NOCLOSE.PIF 2007-10-07 22:18 545 --a------ C:\WINDOWS\LHA.PIF 2007-10-07 22:18 545 --a------ C:\WINDOWS\ARJ.PIF 2007-10-07 22:18 2007-10-04 22:04 2007-10-04 22:04 2007-10-04 21:55 2007-10-04 21:41 2007-10-04 21:34 2007-10-04 21:25 685,816 --a------ C:\WINDOWS\system32\drivers\sptd.sys 2007-10-04 19:10 2007-10-03 00:53 2007-10-03 00:15 2007-09-23 23:26 5,504 --a------ C:\WINDOWS\system32\drivers\MSTEE.sys 2007-09-23 23:26 15,360 --a------ C:\WINDOWS\system32\drivers\StreamIP.sys 2007-09-23 23:26 11,136 --a------ C:\WINDOWS\system32\drivers\SLIP.sys 2007-09-23 23:26 10,880 --a------ C:\WINDOWS\system32\drivers\NdisIP.sys 2007-09-23 23:25 85,376 --a------ C:\WINDOWS\system32\drivers\NABTSFEC.sys 2007-09-23 23:25 19,328 --a------ C:\WINDOWS\system32\drivers\WSTCODEC.SYS 2007-09-23 23:25 17,024 --a------ C:\WINDOWS\system32\drivers\CCDECODE.sys 2007-09-23 22:07 2007-09-23 22:07 2007-09-23 22:07 2007-09-23 15:40 54,784 --a–c— C:\WINDOWS\system32\dllcache\vfwwdm32.dll 2007-09-23 15:40 54,784 --a------ C:\WINDOWS\system32\vfwwdm32.dll 2007-09-22 19:57 53,248 --a------ C:\WINDOWS\system32\dsnpstd.dll 2007-09-22 19:57 53,248 --a------ C:\WINDOWS\amcap.exe 2007-09-22 19:57 40,960 --a------ C:\WINDOWS\vsnpstd.exe 2007-09-22 19:57 301,824 --a------ C:\WINDOWS\system32\drivers\snpstd.sys 2007-09-22 19:57 245,408 --a------ C:\WINDOWS\system32\unicows.dll 2007-09-22 19:56 61,440 --a------ C:\WINDOWS\system32\csnpstd.dll 2007-09-22 19:56 40,960 --a------ C:\WINDOWS\system32\rsnpstd.dll 2007-09-22 19:56 36,864 --a------ C:\WINDOWS\system32\vsnpstd.dll 2007-09-22 19:56 20,480 --a------ C:\WINDOWS\usnpstd.exe 2007-09-22 19:56 2007-09-21 15:17 2007-09-21 14:53 5,632 --a------ C:\WINDOWS\system32\ptpusb.dll 2007-09-21 14:53 159,232 --a------ C:\WINDOWS\system32\ptpusd.dll 2007-09-21 14:53 15,104 --a–c— C:\WINDOWS\system32\dllcache\usbscan.sys 2007-09-21 14:53 15,104 --a------ C:\WINDOWS\system32\drivers\usbscan.sys 2007-09-20 13:22 2007-09-20 13:21 2007-09-18 17:09 2007-09-18 16:47 2007-09-18 16:47 2007-09-18 16:47 2007-09-18 15:37 9,600 --a–c— C:\WINDOWS\system32\dllcache\hidusb.sys 2007-09-18 15:37 9,600 --a------ C:\WINDOWS\system32\drivers\hidusb.sys 2007-09-18 15:37 12,160 --a–c— C:\WINDOWS\system32\dllcache\mouhid.sys 2007-09-18 15:37 12,160 --a------ C:\WINDOWS\system32\drivers\mouhid.sys 2007-09-18 01:55 2007-09-18 01:52 2007-09-18 01:00 69,632 --------- C:\WINDOWS\system32\bcmwlD2K.EXE 2007-09-18 01:00 604,928 --a------ C:\WINDOWS\system32\drivers\BCMWL5.SYS 2007-09-18 01:00 176,128 --------- C:\WINDOWS\system32\bcmwlu00.EXE 2007-09-17 22:30 45,568 --a------ C:\WINDOWS\system32\drivers\bcm4sbxp.sys . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2007-09-22 19:56 --------- d–h----- C:\Program Files\InstallShield Installation Information 2007-09-18 00:56 512096 --a------ C:\WINDOWS\system32\drivers\amon.sys 2007-09-18 00:56 299392 --a------ C:\WINDOWS\system32\imon.dll 2007-09-18 00:56 15424 --a------ C:\WINDOWS\system32\drivers\nod32drv.sys 2007-09-17 23:42 --------- d-------- C:\Program Files\Tlen.pl 2007-09-17 23:19 --------- d-------- C:\Program Files\Synaptics 2007-09-17 23:19 --------- d-------- C:\Program Files\Common Files\InstallShield 2007-09-17 23:18 --------- d-------- C:\Program Files\Texas Instruments Inc 2007-09-17 23:16 --------- d-------- C:\Program Files\Analog Devices 2007-09-17 23:15 --------- d-------- C:\Program Files\HPQ 2007-09-17 23:07 --------- d-------- C:\Program Files\microsoft frontpage --------- C:\Program Files\Usługi online . ((((((((((((((((((((((((((((( snapshot@2007-10-08_12.28.44.60 ))))))))))))))))))))))))))))))))))))))))) . ----a-w 40,326 2007-10-08 13:26:22 C:\WINDOWS\system32\perfc009.dat ----a-w 49,910 2007-10-08 13:26:22 C:\WINDOWS\system32\perfc015.dat ----a-w 311,938 2007-10-08 13:26:22 C:\WINDOWS\system32\perfh009.dat ----a-w 356,068 2007-10-08 13:26:22 C:\WINDOWS\system32\perfh015.dat ----a-w 134,144 2004-08-03 22:44:10 C:\WINDOWS\system32\spool\drivers\w32x86\3\PS5UI.DLL ----a-w 464,384 2004-08-03 22:44:10 C:\WINDOWS\system32\spool\drivers\w32x86\3\PSCRIPT5.DLL . ----a-w 40,326 2007-10-08 10:23:06 C:\WINDOWS\system32\perfc009.dat ----a-w 49,910 2007-10-08 10:23:06 C:\WINDOWS\system32\perfc015.dat ----a-w 311,938 2007-10-08 10:23:06 C:\WINDOWS\system32\perfh009.dat ----a-w 356,068 2007-10-08 10:23:06 C:\WINDOWS\system32\perfh015.dat . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “SoundMAXPnP”=“C:\Program Files\Analog Devices\Core\smax4pnp.exe” [2005-05-20 09:11] “SoundMAX”=“C:\Program Files\Analog Devices\SoundMAX\Smax4.exe” [2005-05-06 14:06] “igfxtray”=“C:\WINDOWS\system32\igfxtray.exe” [2006-06-06 10:09] “igfxhkcmd”=“C:\WINDOWS\system32\hkcmd.exe” [2006-06-06 10:06] “igfxpers”=“C:\WINDOWS\system32\igfxpers.exe” [2006-06-06 10:10] “SynTPEnh”=“C:\Program Files\Synaptics\SynTP\SynTPEnh.exe” [2007-06-07 17:47] “nod32kui”=“C:\Program Files\Eset\nod32kui.exe” [2007-09-18 00:56] “WinampAgent”=“C:\Program Files\Winamp\winampa.exe” [2007-05-15 00:22] “Adobe Reader Speed Launcher”=“C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe” [2007-05-11 03:06] “SunJavaUpdateSched”=“C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe” [2007-07-12 04:00] “snpstd”=“C:\WINDOWS\vsnpstd.exe” [2003-12-31 17:39] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “Komunikator”=“C:\Program Files\Tlen.pl\tlen.exe” [2007-02-12 12:01] “Skype”=“C:\Program Files\Skype\Phone\Skype.exe” [2007-08-31 17:40] “DAEMON Tools”=“C:\Program Files\DAEMON Tools\daemon.exe” [2007-08-16 13:24] R1 ISODrive;ISO DVD/CD-ROM Device Driver;??\C:\Program Files\UltraISO\drivers\ISODrive.sys R3 AEAudioService;AEAudio Service;C:\WINDOWS\system32\drivers\AEAudio.sys [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\F] AutoRun\command- F:\plyta/setup.exe . ************************************************************************** catchme 0.3.1169 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-10-08 15:57:15 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes … scanning hidden autostart entries … scanning hidden files … scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2007-10-08 15:57:37 C:\ComboFix-quarantined-files.txt … 2007-10-08 15:57 . — E O F —

PROSZE O POMOC.

Agaton · 8 Październik 2007 14:55

slimak281

Ważny komunikat dotyczący tytułowania tematów

Proszę poprawić tytuł tematu na konkretny, mówiący o problemie.

Na Forum używamy polskich znaków.

Proszę poprawić pisownię w opisie problemu.

W celu dokonania korekty proszę użyć przycisku

Zignorowanie prośby będzie skutkowało usunięciem tematu do Kosza.

jessica · 8 Październik 2007 17:28

Logi czyste.

jessi