Services.exe Restart Kompa

[Innuedno (Ku Ba90)]

Mam podobny problem co kolega kilka tematów niżej, ale żeby nie bylo bałaganu zakłądam nowy wątek. Po paru minutach robi sie restart

HiJack

Logfile of HijackThis v1.99.1 Scan saved at 14:09:48, on 2007-05-25 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\RUNDLL32.EXE C:\WINDOWS\RTHDCPL.EXE C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe D:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe C:\WINDOWS\system32\nvraidservice.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe D:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe C:\WINDOWS\system32\CTsvcCDA.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\HPZipm12.exe C:\WINDOWS\system32\svchost.exe C:\Documents and Settings\Kuba\Moje dokumenty\Płyta\Gadu-Gadu\gg.exe C:\WINDOWS\system32\wbem\unsecapp.exe C:\WINDOWS\System32\WScript.exe C:\WINDOWS\system32\wuauclt.exe C:\Documents and Settings\Kuba\Moje dokumenty\Płyta\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.bearshare.com/pl/ R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O4 - HKLM…\Run: [nwiz] nwiz.exe /install O4 - HKLM…\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM…\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM…\Run: [sunJavaUpdateSched] “C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe” O4 - HKLM…\Run: [kav] “D:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe” O4 - HKLM…\Run: [NVRaidService] C:\WINDOWS\system32\nvraidservice.exe O4 - HKLM…\Run: [!AVG Anti-Spyware] “C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe” /minimized O4 - HKLM…\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKCU…\Run: [Gadu-Gadu] “C:\Documents and Settings\Kuba\Moje dokumenty\Płyta\Gadu-Gadu\gg.exe” /tray O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra ‘Tools’ menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra button: Web Anti-Virus - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - D:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\scieplugin.dll O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\PROGRA~1\MICROS~1\OFFICE11\REFIEBAR.DLL O16 - DPF: {68282C51-9459-467B-95BF-3C0E89627E55} (MksSkanerOnline Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab O17 - HKLM\System\CCS\Services\Tcpip…{DE56864C-B783-4DC6-A21B-DC7892BCF405}: NameServer = 194.204.159.1 O20 - Winlogon Notify: klogon - C:\WINDOWS\system32\klogon.dll O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe O23 - Service: Kaspersky Anti-Virus 6.0 (AVP) - Unknown owner - D:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe" -r (file missing) O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe O23 - Service: RegVac Registry Service (RegVacService) - Super Win Software, Inc. - d:\Program Files\RegVac Registry Cleaner\RegVserv.exe

Silent

“Silent Runners.vbs”, revision 45, http://www.silentrunners.org/ Operating System: Windows XP SP2 Output limited to non-default values, except where indicated by “{++}” Startup items buried in registry: --------------------------------- HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++} “Gadu-Gadu” = ““C:\Documents and Settings\Kuba\Moje dokumenty\Płyta\Gadu-Gadu\gg.exe” /tray” [“sms-express.com”] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++} “nwiz” = “nwiz.exe /install” [“NVIDIA Corporation”] “NvMediaCenter” = “RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit” [MS] “RTHDCPL” = “RTHDCPL.EXE” [“Realtek Semiconductor Corp.”] “SunJavaUpdateSched” = ““C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe”” [“Sun Microsystems, Inc.”] “kav” = ““D:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe”” [“Kaspersky Lab”] “NVRaidService” = “C:\WINDOWS\system32\nvraidservice.exe” [“NVIDIA Corporation”] “!AVG Anti-Spyware” = ““C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe” /minimized” [“Anti-Malware Development a.s.”] “NvCplDaemon” = “RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup” [MS] HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ {761497BB-D6F0-462C-B6EB-D4DAF1D92D43}(Default) = (no title provided) -> {HKLM…CLSID} = “SSVHelper Class” \InProcServer32(Default) = “C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll” [“Sun Microsystems, Inc.”] HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\ “{42071714-76d4-11d1-8b24-00a0c9068ff3}” = “Rozszerzenie CPL kadrowania wyświetlania” -> {HKLM…CLSID} = “Rozszerzenie CPL kadrowania wyświetlania” \InProcServer32(Default) = “deskpan.dll” [file not found] “{88895560-9AA2-1069-930E-00AA0030EBC8}” = “Rozszerzenie ikony HyperTerminalu” -> {HKLM…CLSID} = “HyperTerminal Icon Ext” \InProcServer32(Default) = “C:\WINDOWS\system32\hticons.dll” [“Hilgraeve, Inc.”] “{A70C977A-BF00-412C-90B7-034C51DA2439}” = “NvCpl DesktopContext Class” -> {HKLM…CLSID} = “DesktopContext Class” \InProcServer32(Default) = “C:\WINDOWS\system32\nvcpl.dll” [“NVIDIA Corporation”] “{FFB699E0-306A-11d3-8BD1-00104B6F7516}” = “Play on my TV helper” -> {HKLM…CLSID} = “NVIDIA CPL Extension” \InProcServer32(Default) = “C:\WINDOWS\system32\nvcpl.dll” [“NVIDIA Corporation”] “{1CDB2949-8F65-4355-8456-263E7C208A5D}” = “Desktop Explorer” -> {HKLM…CLSID} = “Desktop Explorer” \InProcServer32(Default) = “C:\WINDOWS\system32\nvshell.dll” [“NVIDIA Corporation”] “{1E9B04FB-F9E5-4718-997B-B8DA88302A47}” = “Desktop Explorer Menu” -> {HKLM…CLSID} = (no title provided) \InProcServer32(Default) = “C:\WINDOWS\system32\nvshell.dll” [“NVIDIA Corporation”] “{1E9B04FB-F9E5-4718-997B-B8DA88302A48}” = “nView Desktop Context Menu” -> {HKLM…CLSID} = “nView Desktop Context Menu” \InProcServer32(Default) = “C:\WINDOWS\system32\nvshell.dll” [“NVIDIA Corporation”] “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” = “WinRAR shell extension” -> {HKLM…CLSID} = “WinRAR” \InProcServer32(Default) = “C:\Program Files\WinRAR\rarext.dll” [null data] “{21569614-B795-46b1-85F4-E737A8DC09AD}” = “Shell Search Band” -> {HKLM…CLSID} = “Shell Search Band” \InProcServer32(Default) = “C:\WINDOWS\system32\browseui.dll” [MS] “{A155339D-CCCD-4714-85EB-3754B804C9DF}” = “a-squared Free Context Menu Shell Extension” -> {HKLM…CLSID} = “a-squared Free Context Menu” \InProcServer32(Default) = “d:\PROGRA~1\A-SQUA~1\A2FREE~1.DLL” [“Emsi Software GmbH”] “{85E0B171-04FA-11D1-B7DA-00A0C90348D6}” = “Web Anti-Virus” -> {HKLM…CLSID} = “Web Anti-Virus” \InProcServer32(Default) = “D:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\scieplugin.dll” [“Kaspersky Lab”] “{42042206-2D85-11D3-8CFF-005004838597}” = “Microsoft Office HTML Icon Handler” -> {HKLM…CLSID} = (no title provided) \InProcServer32(Default) = “D:\Program Files\Microsoft Office\OFFICE11\msohev.dll” [MS] “{640167b4-59b0-47a6-b335-a6b3c0695aea}” = “Portable Media Devices” -> {HKLM…CLSID} = “Portable Media Devices” \InProcServer32(Default) = “C:\WINDOWS\system32\Audiodev.dll” [MS] “{35786D3C-B075-49b9-88DD-029876E11C01}” = “Portable Devices” -> {HKLM…CLSID} = “Portable Devices” \InProcServer32(Default) = “C:\WINDOWS\system32\wpdshext.dll” [MS] “{D6791A63-E7E2-4fee-BF52-5DED8E86E9B8}” = “Portable Devices Menu” -> {HKLM…CLSID} = “Portable Devices Menu” \InProcServer32(Default) = “C:\WINDOWS\system32\wpdshext.dll” [MS] “{23F0DC38-DC86-49D6-81EC-40C54A204212}” = “ZEN Nano Plus Media Explorer” -> {HKLM…CLSID} = “ZEN Nano Plus Media Explorer” \InProcServer32(Default) = “d:\Program Files\Creative\Creative ZEN Nano Plus\ZEN Nano Plus Media Explorer\CTMvnsu.dll” [“Creative Technology Ltd”] “{4EFE464B-3D0B-4800-A5DE-2321283A3256}” = “QCD Player Icon Manager” -> {HKLM…CLSID} = “MediaIcons Class” \InProcServer32(Default) = “d:\Program Files\Quintessential Player\QCDIcons.dll” [null data] HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\ INFECTION WARNING! “{57B86673-276A-48B2-BAE7-C6DBB3020EB8}” = “AVG Anti-Spyware 7.5” -> {HKLM…CLSID} = “CShellExecuteHookImpl Object” \InProcServer32(Default) = “C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\shellexecutehook.dll” [“Anti-Malware Development a.s.”] HKLM\Software\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\ “WPDShServiceObj” = “{AAA288BA-9A4C-45B0-95D7-94D524869DB5}” -> {HKLM…CLSID} = “WPDShServiceObj Class” \InProcServer32(Default) = “C:\WINDOWS\system32\WPDShServiceObj.dll” [MS] HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ INFECTION WARNING! klogon\DLLName = “C:\WINDOWS\system32\klogon.dll” [“Kaspersky Lab”] HKLM\Software\Classes\PROTOCOLS\Filter\ INFECTION WARNING! text/xml\CLSID = “{807553E5-5146-11D5-A672-00B0D022E945}” -> {HKLM…CLSID} = (no title provided) \InProcServer32(Default) = “C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL” [MS] HKLM\Software\Classes*\shellex\ContextMenuHandlers\ AVG Anti-Spyware(Default) = “{8934FCEF-F5B8-468f-951F-78A921CD3920}” -> {HKLM…CLSID} = “CContextScan Object” \InProcServer32(Default) = “C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\context.dll” [“Anti-Malware Development a.s.”] Kaspersky Anti-Virus(Default) = “{dd230880-495a-11d1-b064-008048ec2fc5}” -> {HKLM…CLSID} = (no title provided) \InProcServer32(Default) = “D:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\shellex.dll” [“Kaspersky Lab”] WinRAR(Default) = “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” -> {HKLM…CLSID} = “WinRAR” \InProcServer32(Default) = “C:\Program Files\WinRAR\rarext.dll” [null data] HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\ AVG Anti-Spyware(Default) = “{8934FCEF-F5B8-468f-951F-78A921CD3920}” -> {HKLM…CLSID} = “CContextScan Object” \InProcServer32(Default) = “C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\context.dll” [“Anti-Malware Development a.s.”] WinRAR(Default) = “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” -> {HKLM…CLSID} = “WinRAR” \InProcServer32(Default) = “C:\Program Files\WinRAR\rarext.dll” [null data] HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\ a2FreeContMenu(Default) = “{A155339D-CCCD-4714-85EB-3754B804C9DF}” -> {HKLM…CLSID} = “a-squared Free Context Menu” \InProcServer32(Default) = “d:\PROGRA~1\A-SQUA~1\A2FREE~1.DLL” [“Emsi Software GmbH”] Kaspersky Anti-Virus(Default) = “{dd230880-495a-11d1-b064-008048ec2fc5}” -> {HKLM…CLSID} = (no title provided) \InProcServer32(Default) = “D:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\shellex.dll” [“Kaspersky Lab”] WinRAR(Default) = “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” -> {HKLM…CLSID} = “WinRAR” \InProcServer32(Default) = “C:\Program Files\WinRAR\rarext.dll” [null data] Active Desktop and Wallpaper: ----------------------------- Active Desktop is disabled at this entry: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState HKCU\Control Panel\Desktop\ “Wallpaper” = “C:\Documents and Settings\Kuba\Dane aplikacji\Mozilla\Firefox\Tapeta pulpitu.bmp” Enabled Scheduled Tasks: ------------------------ “HPpromotions journeysoftware” -> launches: “C:\Program Files\hp\digital imaging\bin\hp promotions\journeysoftware\HPpromo.exe /N “journeysoftware” -r” [“hp”] Winsock2 Service Provider DLLs: ------------------------------- Namespace Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++} 000000000001\LibraryPath = “%SystemRoot%\System32\mswsock.dll” [MS] 000000000002\LibraryPath = “%SystemRoot%\System32\winrnr.dll” [MS] 000000000003\LibraryPath = “%SystemRoot%\System32\mswsock.dll” [MS] Transport Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++} 0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range: %SystemRoot%\system32\mswsock.dll [MS], 01 - 03, 06 - 13 %SystemRoot%\system32\rsvpsp.dll [MS], 04 - 05 Toolbars, Explorer Bars, Extensions: ------------------------------------ Extensions (Tools menu items, main toolbar menu buttons) HKLM\Software\Microsoft\Internet Explorer\Extensions\ {08B0E5C0-4FCB-11CF-AAA5-00401C608501}\ “MenuText” = “Sun Java Console” “CLSIDExtension” = “{CAFEEFAC-0016-0000-0001-ABCDEFFEDCBC}” -> {HKCU…CLSID} = “Java Plug-in 1.6.0_01” \InProcServer32(Default) = “C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll” [“Sun Microsystems, Inc.”] -> {HKLM…CLSID} = “Java Plug-in 1.6.0_01” \InProcServer32(Default) = “C:\Program Files\Java\jre1.6.0_01\bin\npjpi160_01.dll” [“Sun Microsystems, Inc.”] {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E}\ “ButtonText” = “Web Anti-Virus” {92780B25-18CC-41C8-B9BE-3C9C571A8263}\ “ButtonText” = “Badanie” Running Services (Display Name, Service Name, Path {Service DLL}): ------------------------------------------------------------------ AVG Anti-Spyware Guard, AVG Anti-Spyware Guard, “C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe” [“Anti-Malware Development a.s.”] Creative Service for CDROM Access, Creative Service for CDROM Access, “C:\WINDOWS\system32\CTsvcCDA.exe” [“Creative Technology Ltd”] Kaspersky Anti-Virus 6.0, AVP, ““D:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe” -r” [“Kaspersky Lab”] NVIDIA Display Driver Service, NVSvc, “C:\WINDOWS\system32\nvsvc32.exe” [“NVIDIA Corporation”] Pml Driver HPZ12, Pml Driver HPZ12, “C:\WINDOWS\system32\HPZipm12.exe” [“HP”] Print Monitors: --------------- HKLM\System\CurrentControlSet\Control\Print\Monitors\ Microsoft Document Imaging Writer Monitor\Driver = “mdimon.dll” [MS] PCL Language Monitor\Driver = “hpz3l3xu.dll” [“Hewlett-Packard Company”] ---------- + This report excludes default entries except where indicated. + To see *everywhere* the script checks and *everything* it finds, launch it from a command prompt or a shortcut with the -all parameter. + To search all directories of local fixed drives for DESKTOP.INI DLL launch points and all Registry CLSIDs for dormant Explorer Bars, use the -supp parameter or answer “No” at the first message box. ---------- (total run time: 43 seconds, including 12 seconds for message boxes)

Combo

“Kuba” - 2007-05-25 14:40:35 Dodatek Service Pack 2 ComboFix 07-05.25.3V - Running from: “C:\Documents and Settings\Kuba\Pulpit” Rootkit driver xpdt is present. … attempting disinfection xpdt … driver unloaded successfully. ADS removed - system32: deleted 78580 bytes in 1 streams. (((((((((((((((((((((((((((((((((((((((((((((((((( V Log ))))))))))))))))))))))))))))))))))))))))))))))))))))))) C:\WINDOWS\system32\vjbrcluu.dll C:\WINDOWS\system32\uulcrbjv.ini * * * POST RUN FILES/FOLDERS * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * (((((((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) “C:\Program Files\Common Files\Yazzle1730OinUninstaller.exe” Purity Folders: C:\WINDOWS\system32\YMBOLS~1 C:\WINDOWS\SSTEM~1 ((((((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) -------\nm ((((((((((((((((((((((((((((((( Files Created from 2007-04-05 to 2007-05-25 )))))))))))))))))))))))))))))))))) 2007-05-25 13:03 2007-05-25 12:51 2007-05-20 21:14 196,608 --a------ C:\WINDOWS\system32\ssleay32.dll 2007-05-20 21:14 1,040,384 --a------ C:\WINDOWS\system32\libeay32.dll 2007-05-20 19:39 2007-05-20 19:39 2007-05-20 19:38 2007-05-20 19:38 2007-05-20 19:34 24,064 --a------ C:\WINDOWS\system32\msxml3a.dll 2007-05-20 19:34 1,814,528 --------- C:\WINDOWS\UNNeroVision.exe 2007-05-20 19:33 2007-05-20 19:30 569,344 --a------ C:\WINDOWS\system32\imagr5.dll 2007-05-20 19:30 544,768 --a------ C:\WINDOWS\system32\imagx5.dll 2007-05-20 19:30 38,912 --a------ C:\WINDOWS\system32\picn20.dll 2007-05-20 19:30 283,920 --a------ C:\WINDOWS\system32\ImagXpr5.dll 2007-05-20 19:30 155,648 --a------ C:\WINDOWS\system32\NeroCheck.exe 2007-05-20 19:30 106,496 --a------ C:\WINDOWS\system32\TwnLib20.dll 2007-05-20 19:30 2007-05-12 16:14 8,704 --a------ C:\WINDOWS\system32\kbdjpn.dll 2007-05-12 16:14 8,192 --a------ C:\WINDOWS\system32\kbdkor.dll 2007-05-12 16:14 6,144 --a------ C:\WINDOWS\system32\kbd106.dll 2007-05-12 16:14 6,144 --a------ C:\WINDOWS\system32\kbd101c.dll 2007-05-12 16:14 6,144 --a------ C:\WINDOWS\system32\kbd101b.dll 2007-05-12 16:14 5,632 --a------ C:\WINDOWS\system32\kbd103.dll 2007-05-11 13:57 2007-05-11 13:18 2007-05-11 13:13 44,032 --------- C:\WINDOWS\system32\CTSVCCDA.EXE 2007-05-11 13:13 25,088 --------- C:\WINDOWS\system32\CTSVCCTL.EXE 2007-05-11 13:13 2007-05-11 13:13 2007-05-11 13:11 2007-05-10 14:30 2007-05-02 15:50 2007-05-01 15:02 2007-04-28 14:06 43,520 --a------ C:\WINDOWS\system32\CmdLineExt03.dll (((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))) 2007-05-25 11:36:14 -------- d-----w C:\DOCUME~1\Kuba\DANEAP~1\Azureus 2007-05-24 19:22:33 -------- d-----w C:\DOCUME~1\Kuba\DANEAP~1\The Bat! 2007-05-21 18:55:41 -------- d-----w C:\DOCUME~1\Kuba\DANEAP~1\foobar2000 2007-05-20 17:38:20 -------- d–h--w C:\Program Files\InstallShield Installation Information 2007-05-11 11:12:18 -------- d-----w C:\Program Files\Common Files\InstallShield 2007-05-07 14:51:37 -------- d-----w C:\DOCUME~1\Kuba\DANEAP~1\teamspeak2 2007-04-18 16:14:32 2,854,400 ----a-w C:\WINDOWS\system32\msi.dll 2007-04-16 18:31:53 -------- d-----w C:\DOCUME~1\Kuba\DANEAP~1\DeepBurner 2007-04-15 13:55:14 -------- d-----w C:\Program Files\Windows Media Connect 2 2007-04-09 19:46:43 -------- d-----w C:\Program Files\Teamspeak2_RC2 2007-04-08 14:01:19 -------- d-----w C:\DOCUME~1\Kuba\DANEAP~1\The Goalkeeper 2007-04-07 20:27:22 262,884 ----a-w C:\WINDOWS\IPUI_DivXG400.exe 2007-04-02 16:43:35 -------- d-----w C:\DOCUME~1\Kuba\DANEAP~1\GetRightToGo 2007-04-02 11:33:55 283,168 --sha-w C:\WINDOWS\fidbox.dat 2007-04-02 11:12:24 -------- d-----w C:\DOCUME~1\Kuba\DANEAP~1\Lavasoft 2007-04-01 06:52:51 -------- d-----w C:\Program Files\ToniArts 2007-03-25 08:30:13 11,973 ----a-w C:\WINDOWS\system32\drivers\secdrv.sys 2007-03-25 07:30:42 1,289 ----a-w C:\WINDOWS\mozver.dat 2007-03-25 06:47:47 49,712 ----a-w C:\WINDOWS\system32\perfc015.dat 2007-03-25 06:47:47 355,830 ----a-w C:\WINDOWS\system32\perfh015.dat 2007-03-17 13:45:36 293,376 ----a-w C:\WINDOWS\system32\winsrv.dll 2007-03-15 10:00:36 466,432 ----a-w C:\WINDOWS\system32\SkanerOnline.dll 2007-03-11 15:17:57 98,304 ----a-w C:\WINDOWS\system32\CmdLineExt.dll 2007-03-11 14:21:08 -------- d-----w C:\Program Files\Messenger 2007-03-11 14:10:58 639,224 ----a-w C:\WINDOWS\system32\drivers\sptd.sys 2007-03-11 10:47:19 -------- d-----w C:\DOCUME~1\Kuba\DANEAP~1\HP 2007-03-11 10:47:02 81,531 ----a-w C:\WINDOWS\hpfins05.dat 2007-03-11 10:46:39 -------- d-----w C:\Program Files\Common Files\HP 2007-03-11 10:46:37 -------- d-----w C:\Program Files\HP 2007-03-11 10:45:58 -------- d-----w C:\Program Files\Hewlett-Packard 2007-03-11 08:29:37 499,712 ----a-w C:\WINDOWS\system32\msvcp71.dll 2007-03-11 07:30:20 -------- d-----w C:\DOCUME~1\Kuba\DANEAP~1\Media Player Classic 2007-03-10 14:01:32 0 ----a-w C:\WINDOWS\nsreg.dat 2007-03-10 12:50:54 -------- d-----w C:\DOCUME~1\Kuba\DANEAP~1\Help 2007-03-10 12:40:14 -------- d-----w C:\Program Files\Common Files\ODBC 2007-03-10 12:40:11 -------- d-----w C:\Program Files\Common Files\SpeechEngines 2007-03-10 12:02:46 -------- d-----w C:\Program Files\Realtek 2007-03-10 11:58:46 -------- d-----w C:\Program Files\DIFX 2007-03-10 11:50:27 -------- d-----w C:\Program Files\microsoft frontpage 2007-03-10 11:50:15 0 --sha-r C:\MSDOS.SYS 2007-03-10 11:50:15 0 --sha-r C:\IO.SYS 2007-03-10 11:50:15 0 ----a-w C:\CONFIG.SYS 2007-03-10 11:50:15 0 ----a-w C:\AUTOEXEC.BAT 2007-03-10 11:49:26 -------- d–h--w C:\Program Files\WindowsUpdate 2007-03-10 11:49:25 -------- d-----w C:\Program Files\Usługi online 2007-03-10 11:48:29 -------- d-----w C:\Program Files\Common Files\MSSoap 2007-03-10 11:48:18 -------- d-----w C:\Program Files\Movie Maker 2007-03-10 11:47:30 21,856 ----a-w C:\WINDOWS\system32\emptyregdb.dat 2007-03-10 11:47:19 -------- d-----w C:\Program Files\MSN Gaming Zone 2007-03-10 11:47:07 -------- d-----w C:\Program Files\Windows NT 2007-03-08 15:38:47 579,072 ----a-w C:\WINDOWS\system32\user32.dll 2007-03-08 15:38:47 40,960 ----a-w C:\WINDOWS\system32\mf3216.dll 2007-03-08 15:38:47 281,600 ----a-w C:\WINDOWS\system32\gdi32.dll 2007-03-08 15:37:33 1,843,840 ----a-w C:\WINDOWS\system32\win32k.sys 2007-02-21 20:00:28 10,752 ----a-w C:\WINDOWS\system32\ff_vfw.dll 2007-02-05 20:19:48 185,856 ----a-w C:\WINDOWS\system32\upnphost.dll (((((((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects] {761497BB-D6F0-462C-B6EB-D4DAF1D92D43}=C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll [2007-03-14 03:43] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “nwiz”=“nwiz.exe” [2006-03-09 09:29 C:\WINDOWS\system32\nwiz.exe] “NvMediaCenter”=“C:\WINDOWS\system32\NvMcTray.dll” [2006-03-09 09:29] “!AVG Anti-Spyware”=“C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe” [2006-10-07 14:20] “RTHDCPL”=“RTHDCPL.EXE” [] “SunJavaUpdateSched”=“C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe” [2007-03-14 03:43] “kav”=“D:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe” [2006-03-24 19:09] “NVRaidService”=“C:\WINDOWS\system32\nvraidservice.exe” [2006-04-07 11:37] “NvCplDaemon”=“C:\WINDOWS\system32\NvCpl.dll” [2006-03-09 09:29] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “Gadu-Gadu”=“C:\Documents and Settings\Kuba\Moje dokumenty\Płyta\Gadu-Gadu\gg.exe” [] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks] “{57B86673-276A-48B2-BAE7-C6DBB3020EB8}”=“C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\shellexecutehook.dll” [2006-09-28 16:13] Contents of the ‘Scheduled Tasks’ folder 2007-05-24 18:00:00 C:\WINDOWS\tasks\HPpromotions journeysoftware.job ******************************************************************** catchme 0.3.681 W2K/XP/Vista - userland rootkit detector by Gmer, http://www.gmer.net Rootkit scan 2007-05-25 14:43:17 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes … scanning hidden autostart entries … scanning hidden files … scan completed successfully hidden files: 0 ******************************************************************** Completion time: 2007-05-25 14:44:48 - machine was rebooted C:\ComboFix-quarantined-files.txt … 2007-05-25 14:44 — E O F —

[Gutek]

C:\WINDOWS\tasks\HPpromotions journeysoftware.job

usuń plik

Dokończyć skanerami online - Skanery do wyboru

[Innuedno (Ku Ba90)]

Problem zniknął po skanowaniu MKS On-Line