Spadek prędkosci

chalk (chalk) 2007-11-06 16:50:00 UTC #1

mam neta w netii 1M i nagle zaobserwoałem spadek szybkoscido 1/4 mozliwosci. przeskanowałem system ad-aware, spy botem antywirusem, niby jest ok a spadek trwa w netii twierdza ze jest ok.uruchomiłem kompa w trybie awaryjnym i zapusciłem combofix i smidfraufixa. Czy ktos pomoze wyjasnic przyczynę i zaradzic problemowi? załączam logi:

"Silent Runners.vbs", revision 52, http://www.silentrunners.org/ Operating System: Windows XP SP2 Output limited to non-default values, except where indicated by "{++}" Startup items buried in registry: --------------------------------- HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ {++} "ares" = ""C:\Program Files\Ares\Ares.exe" -h" ["Ares Development Group"] HKLM\Software\Microsoft\Windows\CurrentVersion\Run\ {++} "MSConfig" = "C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto" [MS] "DialerKiller" = "C:\Program Files\Dialer Killer\DialKill.exe -h" [empty string] "Ashampoo FireWall" = ""C:\Program Files\Ashampoo\Ashampoo FireWall\FireWall.exe" -TRAY" [null data] "avgnt" = ""C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe" /min" ["Avira GmbH"] HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}(Default) = (no title provided) -> {HKLM...CLSID} = "AcroIEHlprObj Class" \InProcServer32(Default) = "C:\Program Files\Adobe\Acrobat 6.0 CE\Reader\ActiveX\AcroIEHelper.dll" ["Adobe Systems Incorporated"] {2F364306-AA45-47B5-9F9D-39A8B94E7EF7}(Default) = "flashget urlcatch" -> {HKLM...CLSID} = "Flashget Catch Url Class" \InProcServer32(Default) = "C:\PROGRA~1\FlashGet\jccatch.dll" ["www.flashget.com"] {761497BB-D6F0-462C-B6EB-D4DAF1D92D43}(Default) = (no title provided) -> {HKLM...CLSID} = "SSVHelper Class" \InProcServer32(Default) = "C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll" ["Sun Microsystems, Inc."] {F156768E-81EF-470C-9057-481BA8380DBA}(Default) = (no title provided) -> {HKLM...CLSID} = "FlashGet GetFlash Class" \InProcServer32(Default) = "C:\Program Files\FlashGet\getflash.dll" ["www.flashget.com"] HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\ "{42071714-76d4-11d1-8b24-00a0c9068ff3}" = "Rozszerzenie CPL kadrowania wyświetlania" -> {HKLM...CLSID} = "Rozszerzenie CPL kadrowania wyświetlania" \InProcServer32(Default) = "deskpan.dll" [file not found] "{88895560-9AA2-1069-930E-00AA0030EBC8}" = "Rozszerzenie ikony HyperTerminalu" -> {HKLM...CLSID} = "HyperTerminal Icon Ext" \InProcServer32(Default) = "C:\WINDOWS\system32\hticons.dll" ["Hilgraeve, Inc."] "{00020D75-0000-0000-C000-000000000046}" = "Microsoft Office Outlook Desktop Icon Handler" -> {HKLM...CLSID} = "Microsoft Office Outlook" \InProcServer32(Default) = "C:\PROGRA~1\MICROS~2\OFFICE11\MLSHEXT.DLL" [MS] "{0006F045-0000-0000-C000-000000000046}" = "Microsoft Office Outlook Custom Icon Handler" -> {HKLM...CLSID} = "Rozszerzenie ikon plików programu Outlook" \InProcServer32(Default) = "C:\PROGRA~1\MICROS~2\OFFICE11\OLKFSTUB.DLL" [MS] "{42042206-2D85-11D3-8CFF-005004838597}" = "Microsoft Office HTML Icon Handler" -> {HKLM...CLSID} = (no title provided) \InProcServer32(Default) = "C:\Program Files\Microsoft Office\OFFICE11\msohev.dll" [MS] "{A5110426-177D-4e08-AB3F-785F10B4439C}" = "Sony Ericsson File Manager" -> {HKLM...CLSID} = "Sony Ericsson File Manager" \InProcServer32(Default) = "C:\Program Files\Sony Ericsson\Mobile2\File Manager\fmgrgui.dll" ["Sony Ericsson Mobile Communications AB"] "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" = "WinRAR shell extension" -> {HKLM...CLSID} = "WinRAR" \InProcServer32(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] "{32020A01-506E-484D-A2A8-BE3CF17601C3}" = "AlcoholShellEx" -> {HKLM...CLSID} = "AlcoholShellEx" \InProcServer32(Default) = "C:\PROGRA~1\ALCOHO~1\ALCOHO~1\AXShlEx.dll" ["Alcohol Soft Development Team"] "{45AC2688-0253-4ED8-97DE-B5370FA7D48A}" = "Shell Extension for Malware scanning" -> {HKLM...CLSID} = "Shell Extension for Malware scanning" \InProcServer32(Default) = "C:\Program Files\AntiVir PersonalEdition Classic\shlext.dll" ["Avira GmbH"] HKLM\Software\Classes\PROTOCOLS\Filter\ <> text/xml\CLSID = "{807553E5-5146-11D5-A672-00B0D022E945}" -> {HKLM...CLSID} = (no title provided) \InProcServer32(Default) = "C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL" [MS] HKLM\Software\Classes*\shellex\ContextMenuHandlers\ MkS_Vir(Default) = "{E64226E0-9DA1-479E-8265-8D65BA327BD4}" -> {HKLM...CLSID} = "MkS_Vir Shell Extension" \InProcServer32(Default) = "/u\mksshell.dll" [file not found] Shell Extension for Malware scanning(Default) = "{45AC2688-0253-4ED8-97DE-B5370FA7D48A}" -> {HKLM...CLSID} = "Shell Extension for Malware scanning" \InProcServer32(Default) = "C:\Program Files\AntiVir PersonalEdition Classic\shlext.dll" ["Avira GmbH"] WinRAR(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\ WinRAR(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\ MkS_Vir(Default) = "{E64226E0-9DA1-479E-8265-8D65BA327BD4}" -> {HKLM...CLSID} = "MkS_Vir Shell Extension" \InProcServer32(Default) = "/u\mksshell.dll" [file not found] Shell Extension for Malware scanning(Default) = "{45AC2688-0253-4ED8-97DE-B5370FA7D48A}" -> {HKLM...CLSID} = "Shell Extension for Malware scanning" \InProcServer32(Default) = "C:\Program Files\AntiVir PersonalEdition Classic\shlext.dll" ["Avira GmbH"] WinRAR(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] Group Policies {GPedit.msc branch and setting}: ----------------------------------------------- Note: detected settings may not have any effect. HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\ "ClearRecentDocsOnExit" = (REG_DWORD) hex:0x00000001 {unrecognized setting} HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\ "shutdownwithoutlogon" = (REG_DWORD) hex:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| Shutdown: Allow system to be shut down without having to log on} "undockwithoutlogon" = (REG_DWORD) hex:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| Devices: Allow undock without having to log on} Active Desktop and Wallpaper: ----------------------------- Active Desktop may be disabled at this entry: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState Displayed if Active Desktop enabled and wallpaper not set by Group Policy: HKCU\Software\Microsoft\Internet Explorer\Desktop\General\ "Wallpaper" = "C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp" Displayed if Active Desktop disabled and wallpaper not set by Group Policy: HKCU\Control Panel\Desktop\ "Wallpaper" = "C:\Documents and Settings\blemer\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp" Startup items in "blemer" & "All Users" startup folders: -------------------------------------------------------- C:\Documents and Settings\All Users\Menu Start\Programy\Autostart "DSLMON" -> shortcut to: "C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe" [empty string] Winsock2 Service Provider DLLs: ------------------------------- Namespace Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++} 000000000001\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS] 000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS] 000000000003\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS] Transport Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++} 0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range: C:\Program Files\Ashampoo\Ashampoo FireWall\spi.dll [null data], 01 - 05, 14 %SystemRoot%\system32\mswsock.dll [MS], 06 - 13, 15 - 17 %SystemRoot%\system32\rsvpsp.dll [MS], 18 - 19 Toolbars, Explorer Bars, Extensions: ------------------------------------ Explorer Bars HKLM\Software\Microsoft\Internet Explorer\Explorer Bars\ HKLM\Software\Classes\CLSID{FF059E31-CC5A-4E2E-BF3B-96E929D65503}(Default) = "&Badanie" Implemented Categories{00021493-0000-0000-C000-000000000046}\ [vertical bar] InProcServer32(Default) = "C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL" [MS] Extensions (Tools menu items, main toolbar menu buttons) HKLM\Software\Microsoft\Internet Explorer\Extensions\ {08B0E5C0-4FCB-11CF-AAA5-00401C608501}\ "MenuText" = "Sun Java Console" "CLSIDExtension" = "{CAFEEFAC-0016-0000-0002-ABCDEFFEDCBC}" -> {HKCU...CLSID} = "Java Plug-in 1.6.0_02" \InProcServer32(Default) = "C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll" ["Sun Microsystems, Inc."] -> {HKLM...CLSID} = "Java Plug-in 1.6.0_02" \InProcServer32(Default) = "C:\Program Files\Java\jre1.6.0_02\bin\npjpi160_02.dll" ["Sun Microsystems, Inc."] {92780B25-18CC-41C8-B9BE-3C9C571A8263}\ "ButtonText" = "Badanie" {D6E814A0-E0C5-11D4-8D29-0050BA6940E3}\ "ButtonText" = "FlashGet" "MenuText" = "FlashGet" "Exec" = "C:\PROGRA~1\FlashGet\flashget.exe" ["FlashGet.com"] Running Services (Display Name, Service Name, Path {Service DLL}): ------------------------------------------------------------------ AntiVir PersonalEdition Classic Guard, AntiVirService, ""C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe"" ["Avira GmbH"] AntiVir PersonalEdition Classic Scheduler, AntiVirScheduler, ""C:\Program Files\AntiVir PersonalEdition Classic\sched.exe"" ["Avira GmbH"] StarWind iSCSI Service, StarWindService, "C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe" ["Rocket Division Software"] Windows User Mode Driver Framework, UMWdf, "C:\WINDOWS\system32\wdfmgr.exe" [MS] Print Monitors: --------------- HKLM\System\CurrentControlSet\Control\Print\Monitors\ Microsoft Document Imaging Writer Monitor\Driver = "mdimon.dll" [MS] ---------- (launch time: 2007-11-06 17:40:15) <>: Suspicious data at a malware launch point. + This report excludes default entries except where indicated. + To see *everywhere* the script checks and *everything* it finds, launch it from a command prompt or a shortcut with the -all parameter. + To search all directories of local fixed drives for DESKTOP.INI DLL launch points, use the -supp parameter or answer "No" at the first message box and "Yes" at the second message box. ---------- (total run time: 44 seconds, including 3 seconds for message boxes)

Logfile of HijackThis v1.99.1

Scan saved at 17:47:27, on 2007-11-06

Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\Dialer Killer\DialKill.exe

C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe

C:\Program Files\AntiVir PersonalEdition Classic\sched.exe

C:\Program Files\Ares\Ares.exe

C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe

C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe

C:\Documents and Settings\blemer\Pulpit\HijackThis.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\Documents and Settings\blemer\Pulpit\blemer.exe

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0 CE\Reader\ActiveX\AcroIEHelper.dll

O2 - BHO: flashget urlcatch - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\PROGRA~1\FlashGet\jccatch.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll

O2 - BHO: FlashGet GetFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\Program Files\FlashGet\getflash.dll

O4 - HKLM..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto

O4 - HKLM..\Run: [DialerKiller] C:\Program Files\Dialer Killer\DialKill.exe -h

O4 - HKLM..\Run: [Ashampoo FireWall] "C:\Program Files\Ashampoo\Ashampoo FireWall\FireWall.exe" -TRAY

O4 - HKLM..\Run: [avgnt] "C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe" /min

O4 - HKCU..\Run: [ares] "C:\Program Files\Ares\Ares.exe" -h

O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe

O8 - Extra context menu item: &Ściągnij przy pomocy FlashGet'a - C:\PROGRA~1\FlashGet\jc_link.htm

O8 - Extra context menu item: &Ściągnij wszystko przy pomocy FlashGet'a - C:\PROGRA~1\FlashGet\jc_all.htm

O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

O8 - Extra context menu item: Pobierz z &BitSpirit - C:\Program Files\BitSpirit\bsurl.htm

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll

O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL

O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe

O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe

O10 - Unknown file in Winsock LSP: c:\program files\ashampoo\ashampoo firewall\spi.dll

O17 - HKLM\System\CCS\Services\Tcpip..{630194E5-0BD6-41EB-8732-16BB29A9618F}: NameServer = 213.241.79.37 83.238.255.76

O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\sched.exe

O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe

O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe

ComboFix 07-08-14.4 - "blemer" 2007-11-06 17:18:45.8 - NTFSx86 MINIMAL Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.398 [GMT 1:00] ((((((((((((((((((((((((( Files Created from 2007-10-06 to 2007-11-06 ))))))))))))))))))))))))))))))) 2007-11-05 14:07 2007-11-05 14:01 2007-11-04 13:52 2007-11-02 23:01 2007-10-26 22:22 2007-10-26 22:02 2007-10-25 11:56 2007-10-25 09:51 2007-10-23 21:38 (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) 2007-11-05 14:01 --------- d--h----- C:\Program Files\InstallShield Installation Information 2007-11-05 13:14 --------- d-------- C:\Program Files\eMule 2007-10-30 12:46 --------- d-------- C:\Program Files\NAPI-PROJEKT 2007-10-29 17:39 --------- d-------- C:\Program Files\Gadu-Gadu 2007-10-29 09:32 1730 --a------ C:\WINDOWS\system32\tmp.reg 2007-10-24 22:27 --------- d-------- C:\Program Files\Winamp 2007-10-22 13:09 --------- d-------- C:\Program Files\Dialer Killer 2007-10-20 22:41 --------- d-------- C:\Program Files\Odkurzacz 2007-10-03 21:52 --------- d-------- C:\Program Files\DivX 2007-10-01 21:26 --------- d-------- C:\DOCUME~1\blemer\DANEAP~1\WebCompiler3 2007-09-28 17:08 156992 --a------ C:\WINDOWS\system32\DivXCodecVersionChecker.exe 2007-09-28 17:07 524288 --a------ C:\WINDOWS\system32\DivXsm.exe 2007-09-28 17:07 3596288 --a------ C:\WINDOWS\system32\qt-dx331.dll 2007-09-28 17:07 200704 --a------ C:\WINDOWS\system32\ssldivx.dll 2007-09-28 17:07 1044480 --a------ C:\WINDOWS\system32\libdivx.dll 2007-09-28 17:05 823296 --a------ C:\WINDOWS\system32\divx_xx0c.dll 2007-09-28 17:05 823296 --a------ C:\WINDOWS\system32\divx_xx07.dll 2007-09-28 17:05 81920 --a------ C:\WINDOWS\system32\dpl100.dll 2007-09-28 17:05 802816 --a------ C:\WINDOWS\system32\divx_xx11.dll 2007-09-28 17:05 739840 --a------ C:\WINDOWS\system32\DivX.dll 2007-09-28 17:05 593920 --a------ C:\WINDOWS\system32\dpuGUI11.dll 2007-09-28 17:05 57344 --a------ C:\WINDOWS\system32\dpv11.dll 2007-09-28 17:05 53248 --a------ C:\WINDOWS\system32\dpuGUI10.dll 2007-09-28 17:05 344064 --a------ C:\WINDOWS\system32\dpus11.dll 2007-09-28 17:05 294912 --a------ C:\WINDOWS\system32\dpu11.dll 2007-09-28 17:05 294912 --a------ C:\WINDOWS\system32\dpu10.dll 2007-09-28 17:05 196608 --a------ C:\WINDOWS\system32\dtu100.dll 2007-09-28 17:05 12288 --a------ C:\WINDOWS\system32\DivXWMPExtType.dll 2007-09-18 23:00 --------- d-------- C:\Program Files\Cartall 2007-09-15 13:45 --------- d-------- C:\Program Files\Ashampoo 2007-09-15 11:58 2560 --a------ C:\WINDOWS_MSRSTRT.EXE 2007-09-14 23:36 --------- d-------- C:\Program Files\Common Files\Wise Installation Wizard 2007-09-13 21:54 --------- d-------- C:\DOCUME~1\blemer\DANEAP~1\GlarySoft 2007-09-12 21:30 --------- d-------- C:\Program Files\Google 2007-09-12 10:50 --------- d-------- C:\Program Files\Crystal Player 2007-09-12 10:50 --------- d-------- C:\DOCUME~1\blemer\DANEAP~1\Crystal Player 2007-08-22 14:19 96768 --a--c--- C:\WINDOWS\system32\dllcache\inseng.dll 2007-08-22 14:19 661504 --a--c--- C:\WINDOWS\system32\dllcache\wininet.dll 2007-08-22 14:19 616448 --a--c--- C:\WINDOWS\system32\dllcache\urlmon.dll 2007-08-22 14:19 55808 --a--c--- C:\WINDOWS\system32\dllcache\extmgr.dll 2007-08-22 14:19 532480 --a--c--- C:\WINDOWS\system32\dllcache\mstime.dll 2007-08-22 14:19 474112 --a--c--- C:\WINDOWS\system32\dllcache\shlwapi.dll 2007-08-22 14:19 449024 --a--c--- C:\WINDOWS\system32\dllcache\mshtmled.dll 2007-08-22 14:19 39424 --a--c--- C:\WINDOWS\system32\dllcache\pngfilt.dll 2007-08-22 14:19 357888 --a--c--- C:\WINDOWS\system32\dllcache\dxtmsft.dll 2007-08-22 14:19 3079168 --a--c--- C:\WINDOWS\system32\dllcache\mshtml.dll 2007-08-22 14:19 251392 --a--c--- C:\WINDOWS\system32\dllcache\iepeers.dll 2007-08-22 14:19 205312 --a--c--- C:\WINDOWS\system32\dllcache\dxtrans.dll 2007-08-22 14:19 16384 --a--c--- C:\WINDOWS\system32\dllcache\jsproxy.dll 2007-08-22 14:19 151552 --a--c--- C:\WINDOWS\system32\dllcache\cdfview.dll 2007-08-22 14:19 1494528 --a--c--- C:\WINDOWS\system32\dllcache\shdocvw.dll 2007-08-22 14:19 146432 --a--c--- C:\WINDOWS\system32\dllcache\msrating.dll 2007-08-22 14:19 1055744 --a--c--- C:\WINDOWS\system32\dllcache\danim.dll 2007-08-22 14:19 1022976 --a--c--- C:\WINDOWS\system32\dllcache\browseui.dll 2007-08-21 11:30 18432 --a--c--- C:\WINDOWS\system32\dllcache\iedw.exe 2007-08-21 10:33 8972 --a------ C:\WINDOWS\pchealth\helpctr\Config\Cntstore.bin 2007-08-21 10:33 2426 --a------ C:\WINDOWS\pchealth\helpctr\PackageStore\SkuStore.bin 2007-08-21 07:18 683520 --a--c--- C:\WINDOWS\system32\dllcache\inetcomm.dll 2007-08-21 07:18 683520 --a------ C:\WINDOWS\system32\inetcomm.dll 2007-08-20 10:29 0 -rahs---- C:\MSDOS.SYS 2007-08-20 10:29 0 -rahs---- C:\IO.SYS 2007-08-20 10:29 0 --a------ C:\CONFIG.SYS 2007-08-20 10:29 0 --a------ C:\AUTOEXEC.BAT --------- C:\Program Files\Mapeciątka ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "MSConfig"="C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe" [2004-08-04 01:44] "DialerKiller"="C:\Program Files\Dialer Killer\DialKill.exe" [2007-07-19 19:14] "Ashampoo FireWall"="C:\Program Files\Ashampoo\Ashampoo FireWall\FireWall.exe" [2007-04-05 13:57] "avgnt"="C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe" [2007-10-14 18:38] [HKEY\_CURRENT\_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ares"="C:\Program Files\Ares\Ares.exe" [2007-05-04 01:32] C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\ DSLMON.lnk - C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe [2007-08-21 22:44:41] [HKEY\_LOCAL\_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdVantage] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ares] "C:\Program Files\Ares\Ares.exe" -h [HKEY\_LOCAL\_MACHINE\software\microsoft\shared tools\msconfig\startupreg\avast!] [HKEY\_LOCAL\_MACHINE\software\microsoft\shared tools\msconfig\startupreg\C:] [HKEY\_LOCAL\_MACHINE\software\microsoft\shared tools\msconfig\startupreg\C:\Program Files] [HKEY\_LOCAL\_MACHINE\software\microsoft\shared tools\msconfig\startupreg\C:\Program Files\NetMeter] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\C:\Program Files\NetMeter\NetMeter.exe] C:\Program Files\NetMeter\NetMeter.exe [HKEY\_LOCAL\_MACHINE\software\microsoft\shared tools\msconfig\startupreg\FreeRAM XP] [HKEY\_LOCAL\_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Odkurzacz-MCD] C:\Program Files\Odkurzacz\odk_mcd.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Sony Ericsson PC Suite] "C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan] SOUNDMAN.EXE [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent] C:\Program Files\Winamp\winampa.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services] "srservice"=2 (0x2) "WZCSVC"=2 (0x2) "AresChatServer"=3 (0x3) "avast! Web Scanner"=3 (0x3) "avast! Mail Scanner"=3 (0x3) "avast! Antivirus"=2 (0x2) "aswUpdSv"=2 (0x2) R0 uliagpkx;ULi AGP Bus Filter Driver;C:\WINDOWS\system32\DRIVERS\agpkx.sys S1 avgio;avgio;\??\C:\Program Files\AntiVir PersonalEdition Classic\avgio.sys S1 avipbb;avipbb;C:\WINDOWS\system32\DRIVERS\avipbb.sys S1 ssmdrv;ssmdrv;C:\WINDOWS\system32\DRIVERS\ssmdrv.sys S2 E4LOADER;General Purpose USB Driver (e4ldr.sys);C:\WINDOWS\system32\Drivers\e4ldr.sys S3 ASFWHide;ASFWHide;\??\C:\DOCUME~1\blemer\USTAWI~1\Temp\ASFWHide S3 avgntflt;avgntflt;\??\C:\Program Files\AntiVir PersonalEdition Classic\avgntflt.sys S3 e4usbaw;USB ADSL2 WAN Adapter;C:\WINDOWS\system32\DRIVERS\e4usbaw.sys S3 MEMSWEEP2;MEMSWEEP2;\??\C:\WINDOWS\system32\15.tmp *Newly Created Service* - E4LOADER ************************************************************************** catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-11-06 17:19:36 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** Completion time: 2007-11-06 17:20:13 --- E O F ---

SmitFraudFix v2.220

Scan done at 17:21:51,10, 2007-11-06

Run from C:\Documents and Settings\blemer\Pulpit\Czyszczenie komputera\SmitfraudFix

OS: Microsoft Windows XP [Wersja 5.1.2600] - Windows_NT

The filesystem type is NTFS

Fix run in safe mode

»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Before SmitFraudFix

jessica (jessica) 2007-11-06 17:11:19 UTC #2

Logi i raporty jednoznacznie wskazują, że jest czysto.

Tak więc z Netii po prostu chcą Cię oszukać.

jessi

chalk (chalk) 2007-11-06 17:28:59 UTC #3

Dla pewności zamieszczę jeszcze loga z DSS-a,bo tam mam wpis o18,którego nie mam w hjt.

Deckard's System Scanner v20070905.67 Run by blemer on 2007-11-06 18:20:27 Computer is in Normal Mode. -------------------------------------------------------------------------------- -- HijackThis (run as blemer.exe) ---------------------------------------------- Unable to find log (file not found); running clone. -- HijackThis Clone ------------------------------------------------------------ Emulating logfile of HijackThis v1.99.1 Scan saved at 2007-11-06 18:20:54 Platform: Windows XP Dodatek Service Pack 2 (5.01.2600) MSIE: Internet Explorer (6.00.2900.2180) Running processes: C:\WINDOWS\system32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe C:\WINDOWS\explorer.exe C:\Program Files\Dialer Killer\DialKill.exe C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe C:\Program Files\AntiVir PersonalEdition Classic\sched.exe C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe C:\Program Files\NetMeter\NetMeter.exe C:\Documents and Settings\blemer\Pulpit\Czyszczenie komputera\dss.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://home.microsoft.com/access/autosearch.asp?p=%s R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = iexplore R1 - HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.microsoft.com/isapi/redir.dl ... r=iesearch F0 - system.ini: Shell=explorer.exe F2 - REG:system.ini: Shell=explorer.exe O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0 CE\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: flashget urlcatch - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\Program Files\FlashGet\jccatch.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll O2 - BHO: FlashGet GetFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\Program Files\FlashGet\getflash.dll O4 - HKEY_LOCAL_MACHINE..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto O4 - HKEY_LOCAL_MACHINE..\Run: [DialerKiller] C:\Program Files\Dialer Killer\DialKill.exe -h O4 - HKEY_LOCAL_MACHINE..\Run: [Ashampoo FireWall] "C:\Program Files\Ashampoo\Ashampoo FireWall\FireWall.exe" -TRAY O4 - HKEY_LOCAL_MACHINE..\Run: [avgnt] "C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe" /min O4 - HKCU..\Run: [ares] "C:\Program Files\Ares\Ares.exe" -h O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe O8 - Extra context menu item: &Ściągnij przy pomocy FlashGet'a - C:\PROGRA~1\FlashGet\jc_link.htm O8 - Extra context menu item: &Ściągnij wszystko przy pomocy FlashGet'a - C:\PROGRA~1\FlashGet\jc_all.htm O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O8 - Extra context menu item: Pobierz z &BitSpirit - C:\Program Files\BitSpirit\bsurl.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - (file missing) O9 - Extra 'Tools' menuitem: (no name) - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - (file missing) O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\flashget.exe O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\flashget.exe O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload.macromedia.com/pub/sh ... wflash.cab O17 - HKLM\SYSTEM\CCS\Services\Tcpip..{630194E5-0BD6-41EB-8732-16BB29A9618F}: NameServer = 213.241.79.37 83.238.255.76 O18 - Protocol: mso-offdap - {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\Program Files\Common Files\Microsoft Shared\Web Components\10\OWC10.DLL O18 - Protocol: mso-offdap11 - {32505114-5902-49B2-880A-1F7738E5A384} - C:\Program Files\Common Files\Microsoft Shared\Web Components\11\OWC11.DLL O18 - Filter: text/xml - {807553E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - \webcheck.dll (file missing) O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - "C:\Program Files\AntiVir PersonalEdition Classic\sched.exe" O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - "C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe" O23 - Service: Ares Chatroom server (AresChatServer) - Ares Development Group - C:\Program Files\Ares\chatServer.exe O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe -- Files created between 2007-10-06 and 2007-11-06 ----------------------------- 2007-11-05 14:07:33 0 d-------- C:\Program Files\MP3 Player Utilities 2007-11-05 14:01:43 0 d-------- C:\Program Files\Actions 2007-11-04 13:52:11 0 d--h----- C:\WINDOWS\PIF 2007-10-26 22:22:25 0 d-------- C:\Program Files\RegCleaner 2007-10-25 09:51:27 0 d--h----- C:\WINDOWS\$hf_mig$ 2007-10-23 21:38:57 0 d-------- C:\WINDOWS\RegisteredPackages -- Find3M Report --------------------------------------------------------------- 2007-11-06 17:21:56 1730 --a------ C:\WINDOWS\system32\tmp.reg 2007-11-05 14:01:43 0 d--h----- C:\Program Files\InstallShield Installation Information 2007-11-05 13:14:54 0 d-------- C:\Program Files\eMule 2007-11-02 23:01:28 0 d-------- C:\Documents and Settings\blemer\Dane aplikacji\Talkback 2007-10-30 12:46:32 0 d-------- C:\Program Files\NAPI-PROJEKT 2007-10-29 17:39:37 0 d-------- C:\Program Files\Gadu-Gadu 2007-10-28 11:05:05 355486 --a------ C:\WINDOWS\system32\perfh015.dat 2007-10-28 11:05:05 49492 --a------ C:\WINDOWS\system32\perfc015.dat 2007-10-26 22:02:03 0 d-------- C:\Documents and Settings\blemer\Dane aplikacji\WinRAR 2007-10-25 11:56:33 0 d-------- C:\Documents and Settings\blemer\Dane aplikacji\DivX 2007-10-24 22:27:10 0 d-------- C:\Program Files\Winamp 2007-10-24 21:09:07 0 d-------- C:\Program Files\Common Files 2007-10-22 13:09:16 0 d-------- C:\Program Files\Dialer Killer 2007-10-20 22:41:31 0 d-------- C:\Program Files\Odkurzacz 2007-10-03 21:52:36 0 d-------- C:\Program Files\DivX 2007-10-01 21:26:26 0 d-------- C:\Documents and Settings\blemer\Dane aplikacji\WebCompiler3 2007-09-28 17:07:52 3596288 --a------ C:\WINDOWS\system32\qt-dx331.dll 2007-09-28 17:05:50 196608 --a------ C:\WINDOWS\system32\dtu100.dll 2007-09-28 17:05:50 81920 --a------ C:\WINDOWS\system32\dpl100.dll 2007-09-28 17:05:40 802816 --a------ C:\WINDOWS\system32\divx_xx11.dll 2007-09-28 17:05:40 823296 --a------ C:\WINDOWS\system32\divx_xx0c.dll 2007-09-28 17:05:40 823296 --a------ C:\WINDOWS\system32\divx_xx07.dll 2007-09-28 17:05:40 739840 --a------ C:\WINDOWS\system32\DivX.dll 2007-09-28 17:05:08 12288 --a------ C:\WINDOWS\system32\DivXWMPExtType.dll 2007-09-28 10:06:59 0 d-------- C:\Program Files\Mapeciątka 2007-09-18 23:00:38 0 d-------- C:\Program Files\Cartall 2007-09-18 23:00:23 4200 --a------ C:\WINDOWS\unins000.dat 2007-09-15 13:45:25 0 d-------- C:\Program Files\Ashampoo 2007-09-15 11:58:41 2560 --a------ C:\WINDOWS_MSRSTRT.EXE 2007-09-14 23:36:08 0 d-------- C:\Program Files\Common Files\Wise Installation Wizard 2007-09-14 21:11:13 4212 ---h----- C:\WINDOWS\system32\zllictbl.dat 2007-09-13 21:54:09 0 d-------- C:\Documents and Settings\blemer\Dane aplikacji\GlarySoft 2007-09-12 21:30:57 0 d-------- C:\Program Files\Google 2007-09-12 10:50:49 0 d-------- C:\Documents and Settings\blemer\Dane aplikacji\Crystal Player 2007-09-12 10:50:22 0 d-------- C:\Program Files\Crystal Player 2007-08-31 20:21:52 4679 --a------ C:\Documents and Settings\blemer\Dane aplikacji\Cabos.plist 2007-08-20 13:24:16 1156 --a------ C:\WINDOWS\mozver.dat 2007-08-20 12:29:55 0 --a------ C:\WINDOWS\nsreg.dat 2007-08-20 12:19:04 62 --ahs---- C:\Documents and Settings\blemer\Dane aplikacji\desktop.ini 2007-08-20 10:29:22 0 -rahs---- C:\MSDOS.SYS 2007-08-20 10:29:22 0 -rahs---- C:\IO.SYS 2007-08-20 10:29:22 0 --a------ C:\CONFIG.SYS 2007-08-20 10:29:22 0 --a------ C:\AUTOEXEC.BAT 2007-08-20 10:25:50 21856 --a------ C:\WINDOWS\system32\emptyregdb.dat -- Registry Dump --------------------------------------------------------------- *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "MSConfig"="C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe" [2004-08-04 01:44] "DialerKiller"="C:\Program Files\Dialer Killer\DialKill.exe" [2007-07-19 19:14] "Ashampoo FireWall"="C:\Program Files\Ashampoo\Ashampoo FireWall\FireWall.exe" [2007-04-05 13:57] "avgnt"="C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe" [2007-10-14 18:38] [HKEY\_CURRENT\_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ares"="C:\Program Files\Ares\Ares.exe" [2007-05-04 01:32] C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\ DSLMON.lnk - C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe [2007-08-21 22:44:41] [HKEY\_CURRENT\_USER\software\microsoft\windows\currentversion\policies\explorer] "ClearRecentDocsOnExit"=1 (0x1) [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon] "Shell"="explorer.exe " [HKEY\_LOCAL\_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdVantage] [HKEY\_LOCAL\_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ares] "C:\Program Files\Ares\Ares.exe" -h [HKEY\_LOCAL\_MACHINE\software\microsoft\shared tools\msconfig\startupreg\avast!] [HKEY\_LOCAL\_MACHINE\software\microsoft\shared tools\msconfig\startupreg\C:] [HKEY\_LOCAL\_MACHINE\software\microsoft\shared tools\msconfig\startupreg\C:\Program Files] [HKEY\_LOCAL\_MACHINE\software\microsoft\shared tools\msconfig\startupreg\C:\Program Files\NetMeter] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\C:\Program Files\NetMeter\NetMeter.exe] C:\Program Files\NetMeter\NetMeter.exe [HKEY\_LOCAL\_MACHINE\software\microsoft\shared tools\msconfig\startupreg\FreeRAM XP] [HKEY\_LOCAL\_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Odkurzacz-MCD] C:\Program Files\Odkurzacz\odk_mcd.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Sony Ericsson PC Suite] "C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan] SOUNDMAN.EXE [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent] C:\Program Files\Winamp\winampa.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services] "srservice"=2 (0x2) "WZCSVC"=2 (0x2) "AresChatServer"=3 (0x3) "avast! Web Scanner"=3 (0x3) "avast! Mail Scanner"=3 (0x3) "avast! Antivirus"=2 (0x2) "aswUpdSv"=2 (0x2) -- End of Deckard's System Scanner: finished at 2007-11-06 18:22:16 ------------

jessica (jessica) 2007-11-06 17:42:02 UTC #4

Jest prawidłowy (http://www.castlecops.com/o18list-62.html)

Jest prawidłowy (http://www.castlecops.com/o18list-62.html).

jessi

Oparte na Discourse, najlepiej oglądać z włączonym JavaScriptem