Przeglądarki nie owtierają stron, komunikatory dzialają

Pawsonek · 29 Grudzień 2009 13:51

Witam serdecznie, otóż znów zgłaszam się do Was z problemem licząc na pomoc z Waszej strony. Znajomy podrzucił mi laptopa, gdzie ma problem z otwieraniem stron internetowych, nagle przestały się wczytywać. GG działa, Skype też, nie ma problemów. Przesiedzieliśmy całą noc na google i faktycznie problemu jest sporo, ale odpowiedzi nie są do końca pomocne, ani dnsy ani inne duperele takie jak odinstalowanie symantec itd nie pomagają. Obecnie ma na laptopie avasta i praktycznie nic więcej, komputer służy do pracy. Zero zbędnych programów. Nie działa ani Opera, ani Mozilla a już tym bardziej IE 7.

Wszystkie zapory wyłączone windowsowskie, może czegoś w avascie nie wyłączyłem, ale na czas próby go wyłączałem całkowicie.

Zamieszczę na wszelki wypadek gdyby ktoś chciał zerknąć na logi combofix, hijackthis, silentrunner. Korzystamy z blueconnect oraz wifi ale i nieomieszkaliśmy podpiąć pod sieciówkę i cały czas to samo, coś blokuje tylko nie wiadomo co :(. Dziwny bałagan jest po wpisaniu w wiersz poleceń ipconfig/all również zamieszczam screena.

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 01:39:53, on 2009-12-29

Platform: Windows XP Dodatek SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16945)

Boot mode: Normal


Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\ibmpmsvc.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\ThinkPad\Bluetooth Software\bin\btwdins.exe

C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe

C:\Program Files\Alwil Software\Avast4\ashServ.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\ThinkPad\ConnectUtilities\AcPrfMgrSvc.exe

C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe

C:\Program Files\Intel\WiFi\bin\EvtEng.exe

C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe

C:\Program Files\Java\jre6\bin\jqs.exe

C:\WINDOWS\system32\HPZipm12.exe

C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe

C:\WINDOWS\system32\svchost.exe

c:\program files\lenovo\system update\suservice.exe

C:\Program Files\Common Files\Lenovo\tvt_reg_monitor_svc.exe

C:\WINDOWS\System32\TPHDEXLG.exe

C:\Program Files\Lenovo\Rescue and Recovery\rrpservice.exe

C:\Program Files\Lenovo\Rescue and Recovery\rrservice.exe

c:\Program Files\Common Files\Lenovo\Scheduler\tvtsched.exe

C:\Program Files\Lenovo\Rescue and Recovery\ADM\IUService.exe

C:\Program Files\ThinkPad\ConnectUtilities\AcSvc.exe

C:\Program Files\Pure Networks\Network Magic\nmsrvc.exe

C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe

C:\Program Files\Alwil Software\Avast4\ashWebSv.exe

C:\Program Files\ThinkPad\ConnectUtilities\SvcGuiHlpr.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\igfxtray.exe

C:\WINDOWS\system32\hkcmd.exe

C:\WINDOWS\system32\igfxpers.exe

C:\Program Files\Common Files\Lenovo\Scheduler\scheduler_proxy.exe

C:\WINDOWS\system32\igfxsrvc.exe

C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Skype\Phone\Skype.exe

C:\Program Files\Diskeeper Corporation\Diskeeper\DkIcon.exe

C:\WINDOWS\system32\wbem\wmiapsrv.exe

C:\Program Files\Alwil Software\Avast4\setup\avast.setup

C:\Documents and Settings\User\Pulpit\HiJackThis.exe


R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://lenovo.live.com

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://g.msn.com.pl/0SEPLPL/SAOS01?FORM=TOOLBR

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://wp.pl/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://lenovo.live.com

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://lenovo.live.com

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = 

R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://g.msn.com.pl/0SEPLPL/SAOS01?FORM=TOOLBR

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,First Home Page = http://go.microsoft.com/fwlink/?LinkId=54843

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll

O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL

O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll

O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll

O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll

O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

O2 - BHO: IEPluginBHO - {F5CC7F02-6F4E-4462-B5B1-394A57FD3E0D} - C:\Documents and Settings\User\Dane aplikacji\Gadu-Gadu 10\_userdata\ggbho.2.dll

O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll

O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe

O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe

O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe

O4 - HKLM\..\Run: [TVT Scheduler Proxy] C:\Program Files\Common Files\Lenovo\Scheduler\scheduler_proxy.exe

O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized

O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray

O4 - HKLM\..\Policies\Explorer\Run: [] 

O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA')

O4 - HKUS\S-1-5-19\..\RunOnce: [] (User 'USŁUGA LOKALNA')

O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA')

O4 - HKUS\S-1-5-20\..\RunOnce: [] (User 'USŁUGA SIECIOWA')

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\S-1-5-18\..\RunOnce: [] (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')

O4 - HKUS\.DEFAULT\..\RunOnce: [] (User 'Default user')

O9 - Extra button: Wyślij do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll

O9 - Extra 'Tools' menuitem: Wyślij &do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll

O9 - Extra button: (no name) - {5067A26B-1337-4436-8AFE-EE169C2DA79F} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll

O9 - Extra 'Tools' menuitem: Skype add-on for Internet Explorer - {5067A26B-1337-4436-8AFE-EE169C2DA79F} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll

O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab

O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL

O20 - Winlogon Notify: ACNotify - ACNotify.dll (file missing)

O23 - Service: Ac Profile Manager Service (AcPrfMgrSvc) - Lenovo - C:\Program Files\ThinkPad\ConnectUtilities\AcPrfMgrSvc.exe

O23 - Service: Access Connections Main Service (AcSvc) - Lenovo - C:\Program Files\ThinkPad\ConnectUtilities\AcSvc.exe

O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe

O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe

O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe

O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe

O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\ThinkPad\Bluetooth Software\bin\btwdins.exe

O23 - Service: Diskeeper - Diskeeper Corporation - C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe

O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel(R) Corporation - C:\Program Files\Intel\WiFi\bin\EvtEng.exe

O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: Harmonogram automatycznej usługi LiveUpdate - Unknown owner - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe (file missing)

O23 - Service: ThinkPad PM Service (IBMPMSVC) - Lenovo - C:\WINDOWS\system32\ibmpmsvc.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe

O23 - Service: IviRegMgr - InterVideo - C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe

O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe

O23 - Service: Pure Networks Net2Go Service (nmraapache) - Pure Networks, Inc. - C:\Program Files\Pure Networks\Network Magic\WebServer\bin\nmraapache.exe

O23 - Service: Pure Networks Network Magic Service (nmservice) - Pure Networks, Inc. - C:\Program Files\Pure Networks\Network Magic\nmsrvc.exe

O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel(R) Corporation - C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe

O23 - Service: System Update (SUService) - Lenovo Group Limited - c:\program files\lenovo\system update\suservice.exe

O23 - Service: ThinkVantage Registry Monitor Service - Lenovo Group Limited - C:\Program Files\Common Files\Lenovo\tvt_reg_monitor_svc.exe

O23 - Service: ThinkPad HDD APS Logging Service (TPHDEXLGSVC) - Lenovo. - C:\WINDOWS\System32\TPHDEXLG.exe

O23 - Service: TVT Backup Protection Service - Unknown owner - C:\Program Files\Lenovo\Rescue and Recovery\rrpservice.exe

O23 - Service: TVT Backup Service - Lenovo Group Limited - C:\Program Files\Lenovo\Rescue and Recovery\rrservice.exe

O23 - Service: TVT Scheduler - Lenovo Group Limited - c:\Program Files\Common Files\Lenovo\Scheduler\tvtsched.exe

O23 - Service: tvtnetwk - Unknown owner - C:\Program Files\Lenovo\Rescue and Recovery\ADM\IUService.exe


--

End of file - 10900 bytes

ComboFix 09-12-27.04 - User 2009-12-29 1:54.1.2 - x86

Microsoft Windows XP Professional 5.1.2600.3.1250.48.1045.18.2038.1382 [GMT 1:00]

Uruchomiony z: c:\documents and settings\User\Pulpit\ComboFix.exe

AV: avast! antivirus 4.8.1368 [VPS 091127-1] *On-access scanning disabled* (Outdated) {7591DB91-41F0-48A3-B128-1A293FD8233D}


UWAGA - TEN KOMPUTER NIE MA ZAINSTALOWANEJ KONSOLI ODZYSKIWANIA 

.


((((((((((((((((((((((((((((((((((((((( Usunięto )))))))))))))))))))))))))))))))))))))))))))))))))

.


c:\recycler\S-1-5-21-2943949757-1962858057-2206686436-500


.

((((((((((((((((((((((((( Pliki utworzone od 2009-11-28 do 2009-12-29 )))))))))))))))))))))))))))))))

.


2009-12-25 19:22 . 2009-12-25 19:22	--------	d-----w-	c:\documents and settings\User\Ustawienia lokalne\Dane aplikacji\Opera

2009-12-25 19:22 . 2009-12-25 19:22	--------	d-----w-	c:\program files\Opera

2009-12-25 09:31 . 2009-12-25 09:31	--------	d-----w-	c:\documents and settings\NetworkService\Dane aplikacji\Intel

2009-12-25 09:31 . 2009-12-25 09:31	--------	d-----w-	c:\documents and settings\Administrator\Dane aplikacji\Intel

2009-12-25 09:31 . 2009-09-15 11:34	5977216	----a-w-	c:\windows\system32\drivers\NETw5x32.sys

2009-12-25 09:31 . 2009-09-15 11:19	2756608	----a-w-	c:\windows\system32\NETw5r32.dll

2009-12-25 09:31 . 2009-09-15 11:18	675840	----a-w-	c:\windows\system32\NETw5c32.dll

2009-12-25 09:31 . 2009-12-25 09:31	--------	d-----w-	c:\documents and settings\User\Dane aplikacji\Intel

2009-12-25 09:31 . 2009-12-25 09:31	--------	d-----w-	c:\documents and settings\LocalService\Dane aplikacji\Intel

2009-12-25 09:30 . 2009-12-25 09:30	--------	d-----w-	c:\program files\Common Files\Intel

2009-12-25 09:30 . 2009-12-25 09:30	--------	d-----w-	c:\documents and settings\All Users\Dane aplikacji\Intel

2009-12-25 08:29 . 2009-11-24 23:48	23120	----a-w-	c:\windows\system32\drivers\aswRdr.sys

2009-12-25 08:29 . 2009-11-24 23:49	48560	----a-w-	c:\windows\system32\drivers\aswTdi.sys

2009-12-25 08:29 . 2009-11-24 23:47	27408	----a-w-	c:\windows\system32\drivers\aavmker4.sys

2009-12-25 08:29 . 2009-11-24 23:47	97480	----a-w-	c:\windows\system32\AvastSS.scr

2009-12-25 08:29 . 2009-11-24 23:51	93424	----a-w-	c:\windows\system32\drivers\aswmon.sys

2009-12-25 08:29 . 2009-11-24 23:50	94160	----a-w-	c:\windows\system32\drivers\aswmon2.sys

2009-12-25 08:29 . 2009-11-24 23:50	114768	----a-w-	c:\windows\system32\drivers\aswSP.sys

2009-12-25 08:29 . 2009-11-24 23:50	20560	----a-w-	c:\windows\system32\drivers\aswFsBlk.sys

2009-12-25 08:29 . 2009-11-24 23:54	1280480	----a-w-	c:\windows\system32\aswBoot.exe

2009-12-25 08:29 . 2009-12-25 08:29	--------	d-----w-	c:\program files\Alwil Software

2009-12-25 07:09 . 2009-12-25 07:09	--------	d-----w-	C:\kaspersky

2009-12-25 07:00 . 2009-12-25 07:00	28264	----a-w-	c:\documents and settings\Administrator\Ustawienia lokalne\Dane aplikacji\GDIPFONTCACHEV1.DAT

2009-12-25 07:00 . 2008-04-14 17:20	14720	----a-w-	c:\windows\system32\drivers\kbdhid.sys

2009-12-25 07:00 . 2008-04-14 17:20	14720	----a-w-	c:\windows\system32\dllcache\kbdhid.sys

2009-12-25 06:21 . 2009-12-25 06:21	--------	d-----w-	c:\documents and settings\Administrator\Ustawienia lokalne\Dane aplikacji\Winamp Toolbar

2009-12-25 06:20 . 2009-12-25 06:20	--------	d-----w-	c:\documents and settings\Administrator\Ustawienia lokalne\Dane aplikacji\Mozilla

2009-12-22 09:43 . 2007-04-20 09:40	100992	----a-w-	c:\windows\system32\drivers\ewusbmdm.sys

2009-12-22 09:43 . 2007-04-20 09:40	24448	----a-w-	c:\windows\system32\drivers\ewdcsc.sys

2009-12-17 11:12 . 2009-12-17 11:12	--------	d-----w-	c:\documents and settings\All Users\Dane aplikacji\OpenFM

2009-12-17 11:12 . 2009-12-17 11:12	--------	d-----w-	c:\documents and settings\User\Dane aplikacji\OpenFM

2009-12-17 11:11 . 2009-12-17 11:15	--------	d-----w-	c:\documents and settings\User\Dane aplikacji\Gadu-Gadu 10

2009-12-02 17:52 . 2009-12-02 17:52	37376	----a-w-	c:\documents and settings\User\Dane aplikacji\Gadu-Gadu 10\_userdata\ggbho.2.dll

2009-12-02 17:52 . 2009-12-02 17:52	11776	----a-w-	c:\documents and settings\User\Dane aplikacji\Gadu-Gadu 10\_userdata\npgg.2.dll


.

(((((((((((((((((((((((((((((((((((((((( Sekcja Find3M ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2009-12-29 01:02 . 2009-09-27 21:03	--------	d-----w-	c:\documents and settings\User\Dane aplikacji\Skype

2009-12-29 00:29 . 2008-07-02 15:30	89036	----a-w-	c:\windows\system32\perfc015.dat

2009-12-29 00:29 . 2008-07-02 15:30	500540	----a-w-	c:\windows\system32\perfh015.dat

2009-12-28 23:57 . 2008-07-02 15:21	--------	d---a-w-	c:\documents and settings\All Users\Dane aplikacji\Symantec

2009-12-28 23:57 . 2008-07-02 15:21	--------	d-----w-	c:\program files\Common Files\Symantec Shared

2009-12-28 23:56 . 2008-07-02 15:21	--------	d-----w-	c:\program files\Symantec

2009-12-28 23:52 . 2008-07-02 15:08	--------	d-----w-	c:\program files\ThinkVantage

2009-12-28 23:50 . 2008-07-02 15:15	--------	d-----w-	c:\program files\Google

2009-12-28 23:37 . 2008-07-02 15:04	--------	d-----w-	c:\program files\Common Files\Lenovo

2009-12-28 23:37 . 2008-07-02 14:57	--------	d-----w-	c:\program files\Lenovo

2009-12-25 09:30 . 2008-07-02 14:54	--------	d-----w-	c:\program files\Intel

2009-12-22 09:43 . 2008-07-02 14:55	--------	d--h--w-	c:\program files\InstallShield Installation Information

2009-12-17 20:48 . 2008-07-02 18:19	--------	d-----w-	c:\program files\Gadu-Gadu

2009-12-13 13:51 . 2008-07-02 18:27	--------	d---a-w-	c:\documents and settings\User\Dane aplikacji\skypePM

2009-10-29 07:44 . 2008-07-02 15:31	832512	----a-w-	c:\windows\system32\wininet.dll

2009-10-29 07:44 . 2008-07-02 15:30	78336	----a-w-	c:\windows\system32\ieencode.dll

2009-10-29 07:44 . 2008-07-02 15:30	17408	------w-	c:\windows\system32\corpol.dll

2009-10-21 05:40 . 2008-07-02 15:31	75776	----a-w-	c:\windows\system32\strmfilt.dll

2009-10-21 05:40 . 2008-07-02 15:30	25088	----a-w-	c:\windows\system32\httpapi.dll

2009-10-20 16:20 . 2008-07-02 15:31	265728	----a-w-	c:\windows\system32\drivers\http.sys

2009-10-20 14:15 . 2008-07-02 16:42	28264	----a-w-	c:\documents and settings\User\Ustawienia lokalne\Dane aplikacji\GDIPFONTCACHEV1.DAT

2009-10-13 10:34 . 2008-07-02 15:31	271360	----a-w-	c:\windows\system32\oakley.dll

2009-10-12 13:40 . 2008-07-02 15:31	79872	----a-w-	c:\windows\system32\raschap.dll

2009-10-12 13:40 . 2008-07-02 15:31	150016	----a-w-	c:\windows\system32\rastls.dll

.


((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru ))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane  

REGEDIT4


[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Skype"="c:\program files\Skype\Phone\Skype.exe" [2009-09-02 25623336]

"Gadu-Gadu"="c:\program files\Gadu-Gadu\gg.exe" [2008-03-20 2127296]

"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"IgfxTray"="c:\windows\system32\igfxtray.exe" [2007-09-07 141848]

"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2007-09-07 162328]

"Persistence"="c:\windows\system32\igfxpers.exe" [2007-09-07 137752]

"TVT Scheduler Proxy"="c:\program files\Common Files\Lenovo\Scheduler\scheduler_proxy.exe" [2007-07-11 540672]

"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2009-11-24 81000]


[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]


[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\tpfnf2]

2006-09-06 07:37	34344	----a-w-	c:\program files\Lenovo\HOTKEY\notifyf2.dll


[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\tphotkey]

2006-12-14 02:06	28672	----a-w-	c:\program files\Lenovo\HOTKEY\tphklock.dll


[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^BTTray.lnk]

path=c:\documents and settings\All Users\Menu Start\Programy\Autostart\BTTray.lnk

backup=c:\windows\pss\BTTray.lnkCommon Startup


[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Digital Line Detect.lnk]

path=c:\documents and settings\All Users\Menu Start\Programy\Autostart\Digital Line Detect.lnk

backup=c:\windows\pss\Digital Line Detect.lnkCommon Startup


[HKLM\~\startupfolder\C:^Documents and Settings^User^Menu Start^Programy^Autostart^Lenovo Registration.lnk]

path=c:\documents and settings\User\Menu Start\Programy\Autostart\Lenovo Registration.lnk

backup=c:\windows\pss\Lenovo Registration.lnkStartup


[HKLM\~\startupfolder\C:^Documents and Settings^User^Menu Start^Programy^Autostart^Tworzenie wycinków ekranu i uruchamianie programu OneNote 2007.lnk]

path=c:\documents and settings\User\Menu Start\Programy\Autostart\Tworzenie wycinków ekranu i uruchamianie programu OneNote 2007.lnk

backup=c:\windows\pss\Tworzenie wycinków ekranu i uruchamianie programu OneNote 2007.lnkStartup


[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ACTray]

2007-07-05 12:58	413696	----a-w-	c:\program files\ThinkPad\ConnectUtilities\ACTray.exe


[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ACWLIcon]

2007-07-05 12:51	126976	----a-w-	c:\program files\ThinkPad\ConnectUtilities\ACWLIcon.exe


[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]

2008-01-11 20:16	39792	----a-w-	c:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe


[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AMSG]

2007-02-01 18:00	419376	----a-w-	c:\program files\ThinkVantage\AMSG\Amsg.exe


[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ares]

2008-12-13 04:23	882176	----a-w-	c:\program files\Ares\Ares.exe


[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BLOG]

2007-09-05 16:18	208896	----a-w-	c:\progra~1\ThinkPad\UTILIT~1\BATLOGEX.DLL


[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DiskeeperSystray]

2006-05-18 14:24	196696	----a-w-	c:\program files\Diskeeper Corporation\Diskeeper\DkIcon.exe


[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DLA]

2006-02-02 03:20	122940	----a-w-	c:\windows\system32\DLA\DLACTRLW.EXE


[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EZEJMNAP]

2007-03-28 17:32	243248	----a-w-	c:\progra~1\ThinkPad\UTILIT~1\EZEJMNAP.EXE


[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM Startup]

2004-07-27 14:50	221184	----a-w-	c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe


[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSScheduler]

2004-07-27 14:50	81920	----a-w-	c:\program files\Common Files\Installshield\UpdateService\issch.exe


[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LPManager]

2007-07-12 17:11	124256	----a-w-	c:\progra~1\Lenovo\LENOVO~2\LPMGR.EXE


[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]

2008-04-14 17:21	1695232	----a-w-	c:\program files\Messenger\msmsgs.exe


[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nmapp]

2007-03-14 13:42	321088	----a-w-	c:\program files\Pure Networks\Network Magic\nmapp.exe


[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PWRMGRTR]

2007-09-05 16:18	200704	----a-w-	c:\progra~1\ThinkPad\UTILIT~1\PWRMGRTR.DLL


[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]

2008-05-27 08:50	413696	----a-w-	c:\program files\QuickTime\QTTask.exe


[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMAX]

2007-04-03 17:55	839680	----a-w-	c:\program files\Analog Devices\SoundMAX\SMax4.exe


[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMAXPnP]

2007-04-09 07:23	1015808	----a-w-	c:\program files\Analog Devices\Core\smax4pnp.exe


[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]

2009-01-04 19:11	136600	----a-w-	c:\program files\Java\jre6\bin\jusched.exe


[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SynTPEnh]

2007-07-05 10:07	512000	----a-w-	c:\program files\Synaptics\SynTP\SynTPEnh.exe


[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SynTPLpr]

2007-07-05 10:07	110592	----a-w-	c:\program files\Synaptics\SynTP\SynTPLpr.exe


[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TPFNF7]

2007-04-09 18:03	58416	----a-w-	c:\program files\Lenovo\NPDIRECT\tpfnf7sp.exe


[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TPHOTKEY]

2007-03-09 05:49	66176	----a-w-	c:\program files\Lenovo\HOTKEY\TPOSDSVC.exe


[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TpShocks]

2007-09-28 11:28	181544	----a-w-	c:\windows\system32\TpShocks.exe


[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TVT Scheduler Proxy]

2007-07-11 18:53	540672	----a-w-	c:\program files\Common Files\Lenovo\Scheduler\scheduler_proxy.exe


[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent]

2009-03-09 15:49	37888	----a-w-	c:\program files\Winamp\winampa.exe


[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]

"DisableMonitoring"=dword:00000001


[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]

"DisableMonitoring"=dword:00000001


[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]

"DisableMonitoring"=dword:00000001


[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]

"EnableFirewall"= 0 (0x0)


[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=

"c:\\Program Files\\BitComet\\BitComet.exe"=

"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

"c:\\Program Files\\Opera\\opera.exe"=

"c:\\WINDOWS\\system32\\igfxsrvc.exe"=


[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]

"13479:TCP"= 13479:TCP:BitComet 13479 TCP

"13479:UDP"= 13479:UDP:BitComet 13479 UDP


R0 TPDIGIMN;TPDIGIMN;c:\windows\system32\drivers\ApsHM86.sys [2007-09-28 19504]

R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2009-12-25 114768]

R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2009-12-25 20560]

R2 TVT Backup Protection Service;TVT Backup Protection Service;c:\program files\Lenovo\Rescue and Recovery\rrpservice.exe [2007-07-11 569344]

R3 TVTI2C;Lenovo SM bus driver;c:\windows\system32\drivers\tvti2c.sys [2007-05-22 30336]

S2 Harmonogram automatycznej usługi LiveUpdate;Harmonogram automatycznej usługi LiveUpdate;"c:\program files\Symantec\LiveUpdate\ALUSchedulerSvc.exe" --> c:\program files\Symantec\LiveUpdate\ALUSchedulerSvc.exe [?]

.

------- Skan uzupełniający -------

.

uStart Page = hxxp://wp.pl/

mStart Page = hxxp://lenovo.live.com

uSearchURL,(Default) = hxxp://g.msn.com.pl/0SEPLPL/SAOS01?FORM=TOOLBR

FF - ProfilePath - c:\documents and settings\User\Dane aplikacji\Mozilla\Firefox\Profiles\aedqxs5x.default\

FF - prefs.js: browser.startup.homepage - hxxp://www.interia.pl/

FF - prefs.js: network.proxy.ftp - localhost

FF - prefs.js: network.proxy.ftp_port - 3128

FF - prefs.js: network.proxy.gopher - localhost

FF - prefs.js: network.proxy.gopher_port - 3128

FF - prefs.js: network.proxy.http - localhost

FF - prefs.js: network.proxy.http_port - 3128

FF - prefs.js: network.proxy.socks - localhost

FF - prefs.js: network.proxy.socks_port - 3128

FF - prefs.js: network.proxy.ssl - localhost

FF - prefs.js: network.proxy.ssl_port - 3128

FF - prefs.js: network.proxy.type - 4

FF - plugin: c:\documents and settings\User\Dane aplikacji\Gadu-Gadu 10\_userdata\npgg.2.dll

FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

.

- - - - USUNIĘTO PUSTE WPISY - - - -


Notify-ACNotify - ACNotify.dll

MSConfigStartUp-AwaySch - c:\program files\Lenovo\AwayTask\AwaySch.EXE

MSConfigStartUp-ccApp - c:\program files\Common Files\Symantec Shared\ccApp.exe

MSConfigStartUp-cssauth - c:\program files\Lenovo\Client Security Solution\cssauth.exe

MSConfigStartUp-osCheck - c:\program files\Norton Internet Security\osCheck.exe

MSConfigStartUp-swg - c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

AddRemove-HijackThis - c:\documents and settings\User\Pulpit\HijackThis.exe




**************************************************************************

skanowanie ukrytych procesów ...  


skanowanie ukrytych wpisów autostartu ... 


skanowanie ukrytych plików ...  


skanowanie pomyślnie ukończone

ukryte pliki: 


**************************************************************************

.

--------------------- Pliki DLL ładowane pod uruchomionymi procesami ---------------------


- - - - - - - > 'winlogon.exe'(728)

c:\program files\ThinkPad\ConnectUtilities\ACNotify.dll

c:\program files\ThinkPad\ConnectUtilities\AcSvcStub.dll

c:\program files\ThinkPad\ConnectUtilities\AcLocSettings.dll

c:\program files\ThinkPad\ConnectUtilities\ACHelper.dll

c:\program files\Lenovo\HOTKEY\tphklock.dll


- - - - - - - > 'explorer.exe'(3460)

c:\windows\system32\WININET.dll

c:\program files\Gadu-Gadu\ggwhook.dll

.

------------------------ Pozostałe uruchomione procesy ------------------------

.

c:\windows\system32\ibmpmsvc.exe

c:\program files\ThinkPad\Bluetooth Software\bin\btwdins.exe

c:\program files\Alwil Software\Avast4\aswUpdSv.exe

c:\program files\Alwil Software\Avast4\ashServ.exe

c:\program files\ThinkPad\ConnectUtilities\AcPrfMgrSvc.exe

c:\program files\Diskeeper Corporation\Diskeeper\DkService.exe

c:\program files\Intel\WiFi\bin\EvtEng.exe

c:\program files\Common Files\InterVideo\RegMgr\iviRegMgr.exe

c:\program files\Java\jre6\bin\jqs.exe

c:\windows\system32\HPZipm12.exe

c:\program files\Common Files\Intel\WirelessCommon\RegSrvc.exe

c:\program files\lenovo\system update\suservice.exe

c:\program files\Common Files\Lenovo\tvt_reg_monitor_svc.exe

c:\windows\System32\TPHDEXLG.exe

c:\program files\Lenovo\Rescue and Recovery\rrservice.exe

c:\program files\Common Files\Lenovo\Scheduler\tvtsched.exe

c:\program files\Lenovo\Rescue and Recovery\ADM\IUService.exe

c:\windows\system32\wdfmgr.exe

c:\program files\ThinkPad\ConnectUtilities\AcSvc.exe

c:\program files\Pure Networks\Network Magic\nmsrvc.exe

c:\program files\Alwil Software\Avast4\ashMaiSv.exe

c:\program files\Alwil Software\Avast4\ashWebSv.exe

c:\windows\system32\wbem\wmiapsrv.exe

c:\windows\system32\wbem\unsecapp.exe

c:\program files\ThinkPad\ConnectUtilities\SvcGuiHlpr.exe

c:\windows\system32\wscntfy.exe

c:\windows\system32\igfxsrvc.exe

.

**************************************************************************

.

Czas ukończenia: 2009-12-29 02:05:54 - komputer został uruchomiony ponownie

ComboFix-quarantined-files.txt 2009-12-29 01:05


Przed: 126 756 753 408 bajtów wolnych

Po: 126 821 740 544 bajtów wolnych


- - End Of File - - 36187E1DB84A0F7262BC94CD80D21DE3

[/code]

[code]“Silent Runners.vbs”, revision 59, http://www.silentrunners.org/ Operating System: Windows XP Output limited to non-default values, except where indicated by “{++}” Startup items buried in registry: --------------------------------- HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ {++} “CTFMON.EXE” = “C:\WINDOWS\system32\ctfmon.exe” [MS] “Skype” = ““C:\Program Files\Skype\Phone\Skype.exe” /nosplash /minimized” [“Skype Technologies S.A.”] “Gadu-Gadu” = ““C:\Program Files\Gadu-Gadu\gg.exe” /tray” [“Gadu-Gadu S.A.”] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++} “IgfxTray” = “C:\WINDOWS\system32\igfxtray.exe” [“Intel Corporation”] “HotKeysCmds” = “C:\WINDOWS\system32\hkcmd.exe” [“Intel Corporation”] “Persistence” = “C:\WINDOWS\system32\igfxpers.exe” [“Intel Corporation”] “TVT Scheduler Proxy” = “C:\Program Files\Common Files\Lenovo\Scheduler\scheduler_proxy.exe” [“Lenovo Group Limited”] “avast!” = “C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe” [“ALWIL Software”] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}(Default) = (no title provided) -> {HKLM…CLSID} = “Adobe PDF Reader Link Helper” \InProcServer32(Default) = “C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll” [“Adobe Systems Incorporated”] {22BF413B-C6D2-4d91-82A9-A0F997BA588C}(Default) = “Skype add-on (mastermind)” -> {HKLM…CLSID} = “Skype add-on (mastermind)” \InProcServer32(Default) = “C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll” [“Skype Technologies S.A.”] {5CA3D70E-1895-11CF-8E15-001234567890}(Default) = (no title provided) -> {HKLM…CLSID} = “DriveLetterAccess” \InProcServer32(Default) = “C:\WINDOWS\System32\DLA\DLASHX_W.DLL” [“Sonic Solutions”] {761497BB-D6F0-462C-B6EB-D4DAF1D92D43}(Default) = (no title provided) -> {HKLM…CLSID} = “Java™ Plug-In SSV Helper” \InProcServer32(Default) = “C:\Program Files\Java\jre6\bin\ssv.dll” [“Sun Microsystems, Inc.”] {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0}(Default) = (no title provided) -> {HKLM…CLSID} = “Windows Live Toolbar Helper” \InProcServer32(Default) = “C:\Program Files\Windows Live Toolbar\msntb.dll” [MS] {DBC80044-A445-435b-BC74-9C25C1C588A9}(Default) = (no title provided) -> {HKLM…CLSID} = “Java™ Plug-In 2 SSV Helper” \InProcServer32(Default) = “C:\Program Files\Java\jre6\bin\jp2ssv.dll” [“Sun Microsystems, Inc.”] {E7E6F031-17CE-4C07-BC86-EABFE594F69C}(Default) = “JQSIEStartDetectorImpl” -> {HKLM…CLSID} = “JQSIEStartDetectorImpl Class” \InProcServer32(Default) = “C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll” [“Sun Microsystems, Inc.”] {F5CC7F02-6F4E-4462-B5B1-394A57FD3E0D}(Default) = “IEPluginBHO” -> {HKLM…CLSID} = “IEPluginBHO Class” \InProcServer32(Default) = “C:\Documents and Settings\User\Dane aplikacji\Gadu-Gadu 10_userdata\ggbho.2.dll” [“GG Network S.A.”] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\ “{42071714-76d4-11d1-8b24-00a0c9068ff3}” = “Rozszerzenie CPL kadrowania wyświetlania” -> {HKLM…CLSID} = “Rozszerzenie CPL kadrowania wyświetlania” \InProcServer32(Default) = “deskpan.dll” [file not found] “{88895560-9AA2-1069-930E-00AA0030EBC8}” = “Rozszerzenie ikony HyperTerminalu” -> {HKLM…CLSID} = “HyperTerminal Icon Ext” \InProcServer32(Default) = “C:\WINDOWS\system32\hticons.dll” [“Hilgraeve, Inc.”] “{EFA24E62-B078-11d0-89E4-00C04FC9E26E}” = “History Band” -> {HKLM…CLSID} = “History Band” \InProcServer32(Default) = “C:\WINDOWS\system32\shdocvw.dll” [MS] “{cc86590a-b60a-48e6-996b-41d25ed39a1e}” = “Portable Media Devices Menu” -> {HKLM…CLSID} = “Portable Media Devices Menu” \InProcServer32(Default) = “C:\WINDOWS\system32\Audiodev.dll” [MS] “{6af09ec9-b429-11d4-a1fb-0090960218cb}” = “My Bluetooth Places” -> {HKLM…CLSID} = “Moje miejsca interfejsu Bluetooth” \InProcServer32(Default) = “C:\WINDOWS\system32\btneighborhood.dll” [“Broadcom Corporation.”] “{7842554E-6BED-11D2-8CDB-B05550C10000}” = “Monitor” -> {HKLM…CLSID} = “Monitor Class” \InProcServer32(Default) = “C:\WINDOWS\system32\btncopy.dll” [“Broadcom Corporation.”] “{5CA3D70E-1895-11CF-8E15-001234567890}” = “DriveLetterAccess” -> {HKLM…CLSID} = “DriveLetterAccess” \InProcServer32(Default) = “C:\WINDOWS\System32\DLA\DLASHX_W.DLL” [“Sonic Solutions”] “{C55C499D-3518-44a1-998E-796AC5FC989D}” = “NetworkMagic” -> {HKLM…CLSID} = “Network Magic Folders” \InProcServer32(Default) = “C:\Program Files\Pure Networks\Network Magic\nmspce2.dll” [“Pure Networks, Inc.”] “{33F85093-44BB-4587-B25B-FFD05D5B9916}” = “NetworkMagic” -> {HKLM…CLSID} = “Network Magic Folders” \InProcServer32(Default) = “C:\Program Files\Pure Networks\Network Magic\nmspce2.dll” [“Pure Networks, Inc.”] “{5858A72C-C2B4-4dd7-B2BF-B76DB1BD9F6C}” = “Microsoft Office OneNote Namespace Extension for Windows Desktop Search” -> {HKLM…CLSID} = “Microsoft Office OneNote Namespace Extension for Windows Desktop Search” \InProcServer32(Default) = “C:\PROGRA~1\MICROS~2\Office12\ONFILTER.DLL” [MS] “{42042206-2D85-11D3-8CFF-005004838597}” = “Microsoft Office HTML Icon Handler” -> {HKLM…CLSID} = (no title provided) \InProcServer32(Default) = “C:\Program Files\Microsoft Office\Office12\msohevi.dll” [MS] “{993BE281-6695-4BA5-8A2A-7AACBFAAB69E}” = “Microsoft Office Metadata Handler” -> {HKLM…CLSID} = “Microsoft Office Metadata Handler” \InProcServer32(Default) = “C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\msoshext.dll” [MS] “{C41662BB-1FA0-4CE0-8DC5-9B7F8279FF97}” = “Microsoft Office Thumbnail Handler” -> {HKLM…CLSID} = “Microsoft Office Thumbnail Handler” \InProcServer32(Default) = “C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\msoshext.dll” [MS] “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” = “WinRAR shell extension” -> {HKLM…CLSID} = “WinRAR” \InProcServer32(Default) = “C:\Program Files\WinRAR\rarext.dll” [“Alexander Roshal”] “{472083B0-C522-11CF-8763-00608CC02F24}” = “avast” -> {HKLM…CLSID} = “avast” \InProcServer32(Default) = “C:\Program Files\Alwil Software\Avast4\ashShell.dll” [“ALWIL Software”] HKLM\SYSTEM\CurrentControlSet\Control\Lsa\ <> “Notification Packages” = “scecli”|“ACGina” HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ <> ACNotify\DLLName = “ACNotify.dll” [file not found] <> igfxcui\DLLName = “igfxdev.dll” [“Intel Corporation”] <> tpfnf2\DLLName = “C:\Program Files\Lenovo\HOTKEY\notifyf2.dll” [null data] <> tphotkey\DLLName = “C:\Program Files\Lenovo\HOTKEY\tphklock.dll” [null data] HKLM\SOFTWARE\Classes\PROTOCOLS\Filter\ <> text/xml\CLSID = “{807563E5-5146-11D5-A672-00B0D022E945}” -> {HKLM…CLSID} = “Microsoft Office InfoPath XML Mime Filter” \InProcServer32(Default) = “C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL” [MS] HKLM\SOFTWARE\Classes\Folder\shellex\ColumnHandlers\ {F9DB5320-233E-11D1-9F84-707F02C10627}(Default) = “PDF Column Info” -> {HKLM…CLSID} = “PDF Shell Extension” \InProcServer32(Default) = “C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\PDFShell.dll” [“Adobe Systems, Inc.”] HKLM\SOFTWARE\Classes*\shellex\ContextMenuHandlers\ avast(Default) = “{472083B0-C522-11CF-8763-00608CC02F24}” -> {HKLM…CLSID} = “avast” \InProcServer32(Default) = “C:\Program Files\Alwil Software\Avast4\ashShell.dll” [“ALWIL Software”] WinRAR(Default) = “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” -> {HKLM…CLSID} = “WinRAR” \InProcServer32(Default) = “C:\Program Files\WinRAR\rarext.dll” [“Alexander Roshal”] HKLM\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\ WinRAR(Default) = “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” -> {HKLM…CLSID} = “WinRAR” \InProcServer32(Default) = “C:\Program Files\WinRAR\rarext.dll” [“Alexander Roshal”] HKLM\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\ avast(Default) = “{472083B0-C522-11CF-8763-00608CC02F24}” -> {HKLM…CLSID} = “avast” \InProcServer32(Default) = “C:\Program Files\Alwil Software\Avast4\ashShell.dll” [“ALWIL Software”] WinRAR(Default) = “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” -> {HKLM…CLSID} = “WinRAR” \InProcServer32(Default) = “C:\Program Files\WinRAR\rarext.dll” [“Alexander Roshal”] Group Policies {GPedit.msc branch and setting}: ----------------------------------------------- Note: detected settings may not have any effect. HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\ “HonorAutoRunSetting” = (REG_DWORD) dword:0x00000001 {unrecognized setting} “NoCDBurning” = (REG_DWORD) dword:0x00000000 {unrecognized setting} HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System\ “DisableTaskMgr” = (REG_DWORD) dword:0x00000000 {User Configuration|Administrative Templates|System|Ctrl+Alt+Del Options| Remove Task Manager} “DisableRegistryTools” = (REG_DWORD) dword:0x00000000 {User Configuration|Administrative Templates|System| Prevent access to registry editing tools} HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ “shutdownwithoutlogon” = (REG_DWORD) dword:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| Shutdown: Allow system to be shut down without having to log on} “undockwithoutlogon” = (REG_DWORD) dword:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| Devices: Allow undock without having to log on} “DisableStatusMessages” = (REG_DWORD) dword:0x00000000 {unrecognized setting} “DisableTaskMgr” = (REG_DWORD) dword:0x00000000 {unrecognized setting} HKLM\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore\ “DisableSR” = (REG_DWORD) dword:0x00000000 {Computer Configuration|Administrative Templates|System|System Restore| Turn off System Restore} “DisableConfig” = (REG_DWORD) dword:0x00000000 {Computer Configuration|Administrative Templates|System|System Restore| Turn off Configuration} Active Desktop and Wallpaper: ----------------------------- Active Desktop may be disabled at this entry: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState Displayed if Active Desktop enabled and wallpaper not set by Group Policy: HKCU\Software\Microsoft\Internet Explorer\Desktop\General\ “Wallpaper” = “C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp” Displayed if Active Desktop disabled and wallpaper not set by Group Policy: HKCU\Control Panel\Desktop\ “Wallpaper” = “C:\Documents and Settings\User\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp” Enabled Screen Saver: --------------------- HKCU\Control Panel\Desktop\ “SCRNSAVE.EXE” = “C:\WINDOWS\system32\logon.scr” [MS] Windows Portable Device AutoPlay Handlers ----------------------------------------- HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers\Handlers\ IviCDBurningOnArrival\ “Provider” = “@C:\Program Files\InterVideo\WCreator3\WCreator.exe,-57344” “InvokeProgID” = “InterVideo WinDVD Creator .wcp” “InvokeVerb” = “open” HKLM\SOFTWARE\Classes\InterVideo WinDVD Creator .wcp\shell\open\command(Default) = “C:\Program Files\InterVideo\WCreator3\WCreator.exe “%L”” [“InterVideo Inc.”] IviDVDEventHandler\ “Provider” = “InterVideo WinDVD” “InvokeProgID” = “Ivi.MediaFile” “InvokeVerb” = “play” HKLM\SOFTWARE\Classes\Ivi.MediaFile\shell\play\command(Default) = ““C:\Program Files\InterVideo\WinDVD\WinDVD.exe” %1” [“InterVideo Inc.”] IviVideoCameraArrival\ “Provider” = “@C:\Program Files\InterVideo\WCreator3\WCreator.exe,-57344” “ProgID” = “Shell.HWEventHandlerShellExecute” “InitCmdLine” = ““C:\Program Files\InterVideo\WCreator3\WCreator.exe” --capture” HKLM\SOFTWARE\Classes\Shell.HWEventHandlerShellExecute\CLSID(Default) = “{FFB8655F-81B9-4fce-B89C-9A6BA76D13E7}” -> {HKLM…CLSID} = “ShellExecute HW Event Handler” \LocalServer32(Default) = “rundll32.exe shell32.dll,SHCreateLocalServerRunDll {FFB8655F-81B9-4fce-B89C-9A6BA76D13E7}” [MS] IviVideoCDHandler\ “Provider” = “InterVideo WinDVD” “InvokeProgID” = “Ivi.MediaFile” “InvokeVerb” = “play” HKLM\SOFTWARE\Classes\Ivi.MediaFile\shell\play\command(Default) = ““C:\Program Files\InterVideo\WinDVD\WinDVD.exe” %1” [“InterVideo Inc.”] Picasa2ImportPicturesOnArrival\ “Provider” = “Picasa2” “InvokeProgID” = “picasa2.autoplay” “InvokeVerb” = “import” HKLM\SOFTWARE\Classes\picasa2.autoplay\shell\import\command(Default) = "C:\Program Files\Picasa2\Picasa2.exe “%1"” [“Google Inc.”] SonicSCAudioCDTask\ “Provider” = “RecordNow Audio” “InvokeProgID” = “Sonic.SonicCentral” “InvokeVerb” = “AudioCDTask” HKLM\SOFTWARE\Classes\Sonic.SonicCentral\shell\AudioCDTask\Command(Default) = ““C:\Program Files\Common Files\Sonic Shared\Sonic Central\Main\Mediahub.exe” /Launch {EBD22732-1CC3-4CD7-9A45-B8D98DA0E784}” [null data] SonicSCCopyCD\ “Provider” = “RecordNow Copy” “InvokeProgID” = “Sonic.SonicCentral” “InvokeVerb” = “ExactCopyJob” HKLM\SOFTWARE\Classes\Sonic.SonicCentral\shell\ExactCopyJob\Command(Default) = ““C:\Program Files\Common Files\Sonic Shared\Sonic Central\Main\Mediahub.exe” /Launch {49B235A3-1C3E-4802-9B5C-BAFBE69A3C85}” [null data] SonicSCCopyDisc\ “Provider” = “RecordNow Copy” “InvokeProgID” = “Sonic.SonicCentral” “InvokeVerb” = “ExactCopyJob” HKLM\SOFTWARE\Classes\Sonic.SonicCentral\shell\ExactCopyJob\Command(Default) = ““C:\Program Files\Common Files\Sonic Shared\Sonic Central\Main\Mediahub.exe” /Launch {49B235A3-1C3E-4802-9B5C-BAFBE69A3C85}” [null data] SonicSCDataProject\ “Provider” = “RecordNow Data” “InvokeProgID” = “Sonic.SonicCentral” “InvokeVerb” = “DataGuide” HKLM\SOFTWARE\Classes\Sonic.SonicCentral\shell\DataGuide\Command(Default) = ““C:\Program Files\Common Files\Sonic Shared\Sonic Central\Main\Mediahub.exe” /Launch Data” [null data] SonicSCDataTask\ “Provider” = “RecordNow Data” “InvokeProgID” = “Sonic.SonicCentral” “InvokeVerb” = “DataTask” HKLM\SOFTWARE\Classes\Sonic.SonicCentral\shell\DataTask\Command(Default) = ““C:\Program Files\Common Files\Sonic Shared\Sonic Central\Main\Mediahub.exe” /Launch {0BAC5C34-DF45-4C0F-8D64-8E92DCCF007D}” [null data] WinampMTPHandler\ “Provider” = “Winamp” “ProgID” = “Shell.HWEventHandlerShellExecute” “InitCmdLine” = “C:\Program Files\Winamp\winamp.exe” HKLM\SOFTWARE\Classes\Shell.HWEventHandlerShellExecute\CLSID(Default) = “{FFB8655F-81B9-4fce-B89C-9A6BA76D13E7}” -> {HKLM…CLSID} = “ShellExecute HW Event Handler” \LocalServer32(Default) = “rundll32.exe shell32.dll,SHCreateLocalServerRunDll {FFB8655F-81B9-4fce-B89C-9A6BA76D13E7}” [MS] WinampPlayMediaOnArrival\ “Provider” = “Winamp” “InvokeProgID” = “Winamp.File” “InvokeVerb” = “Play” HKLM\SOFTWARE\Classes\Winamp.File\shell\Play\command(Default) = "“C:\Program Files\Winamp\winamp.exe” “%1"” [“Nullsoft”] HKLM\SOFTWARE\Classes\Winamp.File\shell\Play\DropTarget\CLSID = “{46986115-84D6-459c-8F95-52DD653E532E}” -> {HKLM…CLSID} = (no title provided) \LocalServer32(Default) = ““C:\Program Files\Winamp\winamp.exe”” [“Nullsoft”] Enabled Scheduled Tasks: ------------------------ “Sprawdź aktualizacje paska narzędzi Windows Live Toolbar” -> launches: “C:\Program Files\Windows Live Toolbar\MSNTBUP.EXE” [MS] Winsock2 Service Provider DLLs: ------------------------------- Namespace Service Providers HKLM\SYSTEM\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++} 000000000001\LibraryPath = “%SystemRoot%\System32\mswsock.dll” [MS] 000000000002\LibraryPath = “%SystemRoot%\System32\winrnr.dll” [MS] 000000000003\LibraryPath = “%SystemRoot%\System32\mswsock.dll” [MS] Transport Service Providers HKLM\SYSTEM\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++} 0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range: %SystemRoot%\system32\mswsock.dll [MS], 01 - 03, 06 - 32 %SystemRoot%\system32\rsvpsp.dll [MS], 04 - 05 Toolbars, Explorer Bars, Extensions: ------------------------------------ Toolbars HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\ “{BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0}” -> {HKLM…CLSID} = “Windows Live Toolbar” \InProcServer32(Default) = “C:\Program Files\Windows Live Toolbar\msntb.dll” [MS] HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ “{BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0}” = (no title provided) -> {HKLM…CLSID} = “Windows Live Toolbar” \InProcServer32(Default) = “C:\Program Files\Windows Live Toolbar\msntb.dll” [MS] Explorer Bars HKLM\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\ HKLM\SOFTWARE\Classes\CLSID{FF059E31-CC5A-4E2E-BF3B-96E929D65503}(Default) = “&Poszukaj” Implemented Categories{00021493-0000-0000-C000-000000000046}\ [vertical bar] InProcServer32(Default) = “C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL” [MS] Extensions (Tools menu items, main toolbar menu buttons) HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\ {2670000A-7350-4F3C-8081-5663EE0C6C49}\ “ButtonText” = “Wyślij do programu OneNote” “MenuText” = “Wyślij &do programu OneNote” “CLSIDExtension” = “{48E73304-E1D6-4330-914C-F5F514E3486C}” -> {HKLM…CLSID} = “Send to OneNote from Internet Explorer button” \InProcServer32(Default) = “C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll” [MS] {5067A26B-1337-4436-8AFE-EE169C2DA79F}\ “MenuText” = “Skype add-on for Internet Explorer” “CLSIDExtension” = “{77BF5300-1474-4EC7-9980-D32B190E9B07}” -> {HKLM…CLSID} = “Skype add-on (button)” \InProcServer32(Default) = “C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll” [“Skype Technologies S.A.”] {77BF5300-1474-4EC7-9980-D32B190E9B07}\ “ButtonText” = “Skype” “CLSIDExtension” = “{77BF5300-1474-4EC7-9980-D32B190E9B07}” -> {HKLM…CLSID} = “Skype add-on (button)” \InProcServer32(Default) = “C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll” [“Skype Technologies S.A.”] {92780B25-18CC-41C8-B9BE-3C9C571A8263}\ “ButtonText” = “Research” {E2E2DD38-D088-4134-82B7-F2BA38496583}\ “MenuText” = “@xpsp3res.dll,-20001” “Exec” = “%windir%\Network Diagnostic\xpnetdiag.exe” [MS] {FB5F1910-F110-11D2-BB9E-00C04F795683}\ “ButtonText” = “Messenger” “MenuText” = “Windows Messenger” “Exec” = “C:\Program Files\Messenger\msmsgs.exe” [MS] Running Services (Display Name, Service Name, Path {Service DLL}): ------------------------------------------------------------------ Ac Profile Manager Service, AcPrfMgrSvc, “C:\Program Files\ThinkPad\ConnectUtilities\AcPrfMgrSvc.exe” ["Lenovo "] Access Connections Main Service, AcSvc, “C:\Program Files\ThinkPad\ConnectUtilities\AcSvc.exe” ["Lenovo "] avast! Antivirus, avast! Antivirus, ““C:\Program Files\Alwil Software\Avast4\ashServ.exe”” [“ALWIL Software”] avast! iAVS4 Control Service, aswUpdSv, ““C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe”” [“ALWIL Software”] avast! Mail Scanner, avast! Mail Scanner, ““C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe” /service” [“ALWIL Software”] avast! Web Scanner, avast! Web Scanner, ““C:\Program Files\Alwil Software\Avast4\ashWebSv.exe” /service” [“ALWIL Software”] Bluetooth Service, btwdins, “C:\Program Files\ThinkPad\Bluetooth Software\bin\btwdins.exe” [“Broadcom Corporation.”] Diskeeper, Diskeeper, ““C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe”” [“Diskeeper Corporation”] Intel® PROSet/Wireless Event Log, EvtEng, “C:\Program Files\Intel\WiFi\bin\EvtEng.exe” [“Intel® Corporation”] Intel® PROSet/Wireless Registry Service, RegSrvc, “C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe” [“Intel® Corporation”] IviRegMgr, IviRegMgr, “C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe” [“InterVideo”] Java Quick Starter, JavaQuickStarterService, ““C:\Program Files\Java\jre6\bin\jqs.exe” -service -config “C:\Program Files\Java\jre6\lib\deploy\jqs\jqs.conf”” [“Sun Microsystems, Inc.”] Karta wydajności WMI, WmiApSrv, “C:\WINDOWS\system32\wbem\wmiapsrv.exe” [MS] Pml Driver HPZ12, Pml Driver HPZ12, “C:\WINDOWS\system32\HPZipm12.exe” [“HP”] Pure Networks Network Magic Service, nmservice, ““C:\Program Files\Pure Networks\Network Magic\nmsrvc.exe”” [“Pure Networks, Inc.”] System Update, SUService, “c:\program files\lenovo\system update\suservice.exe” [null data] ThinkPad HDD APS Logging Service, TPHDEXLGSVC, “System32\TPHDEXLG.exe” [“Lenovo.”] ThinkPad PM Service, IBMPMSVC, “C:\WINDOWS\system32\ibmpmsvc.exe” [“Lenovo”] ThinkVantage Registry Monitor Service, ThinkVantage Registry Monitor Service, ““C:\Program Files\Common Files\Lenovo\tvt_reg_monitor_svc.exe”” [“Lenovo Group Limited”] TVT Backup Protection Service, TVT Backup Protection Service, ““C:\Program Files\Lenovo\Rescue and Recovery\rrpservice.exe”” [null data] TVT Backup Service, TVT Backup Service, ““C:\Program Files\Lenovo\Rescue and Recovery\rrservice.exe”” [“Lenovo Group Limited”] TVT Scheduler, TVT Scheduler, ““c:\Program Files\Common Files\Lenovo\Scheduler\tvtsched.exe”” [“Lenovo Group Limited”] tvtnetwk, tvtnetwk, “C:\Program Files\Lenovo\Rescue and Recovery\ADM\IUService.exe” [null data] Usługa Pomocnik IPv6, 6to4, “C:\WINDOWS\system32\svchost.exe -k netsvcs” {“C:\WINDOWS\System32\6to4svc.dll” [MS]} Windows User Mode Driver Framework, UMWdf, “C:\WINDOWS\system32\wdfmgr.exe” [MS] Print Monitors: --------------- HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors\ hpzlnt12\Driver = “hpzlnt12.dll” [“HP”] Port drukarki interfejsu Bluetooth\Driver = “bthcrp.dll” [“Broadcom Corporation.”] Send To Microsoft OneNote Monitor\Driver = “msonpmon.dll” [MS] ---------- (launch time: 2009-12-29 01:41:20) <>: Suspicious data at a malware launch point. + This report excludes default entries except where indicated. + To see *everywhere* the script checks and *everything* it finds, launch it from a command prompt or a shortcut with the -all parameter. + The search for DESKTOP.INI DLL launch points on all local fixed drives took 129 seconds. ---------- (total run time: 186 seconds)

w0rek · 29 Grudzień 2009 14:18

Spróbuj w konsoli wpisać: “netsh winsock reset” i zrestartuj

to potecenie resetuje wszystkie ustawienia sieci

sid25 · 29 Grudzień 2009 14:29

ja bym przeskanował kompa jakimś dobrym antyvirem i anty malware, dla avasta ja bym nie ufał z doświadczenia

Pawsonek · 29 Grudzień 2009 14:37

Avast jest usunięty, zapory powyłączane, w koncoli już wpisywałem “netsh winsock reset” i niestety nic. Skanowanie też było… komp czysty

w0rek · 29 Grudzień 2009 15:15

Czy adresy sieciowe wpisujesz ręcznie ?

bogna2009 · 29 Grudzień 2009 15:37

Klasyk

Wpisz z palca dns-y tepsy i będzie dobrze.