Svchost 100%

[sugar_1299392758 (sugar!!!)]

Proces czasami skacze do 100%.Mam wyłączone automatyczne aktualizacje. Na innym forum poradzili usunąć jeden plik temp z katalogu windowsa i jedną bibliotekę oraz wyłączyć usługi po poprzednim antywirusie,co też uczyniłam. Porty w wwdc mam zamknięte.

Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 01:24:43, on 2007-08-25 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16512) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\spoolsv.exe D:\ewido\AVG Anti-Spyware 7.5\guard.exe C:\WINDOWS\system32\lxczcoms.exe C:\Program Files\mks_vir_2007\bin\MksFwall.exe C:\Program Files\mks_vir_2007\bin\MksPC.exe C:\Program Files\mks_vir_2007\bin\MksVirMonSvc.exe C:\Program Files\MySQL\MySQL Server 5.0\bin\mysqld-nt.exe C:\WINDOWS\System32\PAStiSvc.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\MsPMSPSv.exe C:\WINDOWS\system32\wscntfy.exe C:\Program Files\mks_vir_2007\bin\mksregmon.exe C:\Program Files\mks_vir_2007\bin\mks_mail.exe C:\Program Files\mks_vir_2007\bin\mkstray.exe C:\Program Files\Lexmark 1200 Series\lxczbmgr.exe C:\Program Files\Lexmark 1200 Series\lxczbmon.exe D:\SUPERAntiSpyware\SUPERAntiSpyware.exe C:\Program Files\MSI\Core Center\CoreCenter.exe C:\PROGRA~1\MICROS~2\OFFICE11\OUTLOOK.EXE C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE D:\Screamer\Screamer Radio\screamer.exe D:\Firefox\firefox.exe C:\Program Files\Windows Media Player\wmplayer.exe D:\Access Manager\AccessManager.exe C:\Program Files\mks_vir_2007\bin\mksupdate.exe C:\Program Files\mks_vir_2007\bin\mks_scan.exe C:\WINDOWS\explorer.exe C:\WINDOWS\system32\NOTEPAD.EXE D:\HijackThis\HijackThis.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - D:\Spybot\SPYBOT~1\SDHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O2 - BHO: FoxyTunes Toolbar Helper - {784D8FBC-4165-4D88-90FB-62907ACDD045} - C:\Program Files\FoxyTunes\ForInternetExplorer\components\IE\FoxyTunesForIE.dll O3 - Toolbar: FoxyTunes Toolbar - {1D1901C3-F72A-46f3-9DBB-0AAA0DEEF6DF} - C:\Program Files\FoxyTunes\ForInternetExplorer\components\IE\FoxyTunesForIE.dll O4 - HKLM…\Run: [MKSRegmon] C:\Program Files\mks_vir_2007\bin\mksregmon.exe O4 - HKLM…\Run: [mks_mail] C:\Program Files\mks_vir_2007\bin\mks_mail.exe O4 - HKLM…\Run: [mkstray] C:\Program Files\mks_vir_2007\bin\mkstray.exe O4 - HKLM…\Run: [lxczbmgr.exe] “C:\Program Files\Lexmark 1200 Series\lxczbmgr.exe” O4 - HKLM…\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto O4 - HKCU…\Run: [sUPERAntiSpyware] D:\SUPERAntiSpyware\SUPERAntiSpyware.exe O4 - HKUS\S-1-5-19…\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User ‘USŁUGA LOKALNA’) O4 - HKUS\S-1-5-20…\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User ‘USŁUGA SIECIOWA’) O4 - HKUS\S-1-5-18…\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User ‘SYSTEM’) O4 - HKUS.DEFAULT…\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User ‘Default user’) O4 - Global Startup: CoreCenter.lnk = C:\Program Files\MSI\Core Center\CoreCenter.exe O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra ‘Tools’ menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra ‘Tools’ menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll O10 - Unknown file in Winsock LSP: c:\program files\mks_vir_2007\bin\mkslsp.dll O10 - Unknown file in Winsock LSP: c:\program files\mks_vir_2007\bin\mkslsp.dll O10 - Unknown file in Winsock LSP: c:\program files\mks_vir_2007\bin\mkslsp.dll O10 - Unknown file in Winsock LSP: c:\program files\mks_vir_2007\bin\mkslsp.dll O15 - Trusted Zone: http://www.msi.com.tw O15 - Trusted Zone: http://*.mks.com.pl O16 - DPF: {01010E00-5E80-11D8-9E86-0007E96C65AE} (SupportSoft SmartIssue) - http://www.symantec.com/techsupp/asa/ctrl/tgctlsi.cab O16 - DPF: {01012101-5E80-11D8-9E86-0007E96C65AE} (SupportSoft Script Runner Class) - http://www.symantec.com/techsupp/asa/ctrl/tgctlsr.cab O16 - DPF: {0A5FD7C5-A45C-49FC-ADB5-9952547D5715} (Creative Software AutoUpdate) - http://www.creative.com/su/ocx/15030/CTSUEng.cab O16 - DPF: {0B79F48A-E8D6-11DB-9283-E25056D89593} (F-Secure Online Scanner 3.1) - http://support.f-secure.com/ols/fscax.cab O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partne … nicode.cab O16 - DPF: {10ABC6DB-E091-4EAE-98DD-21B5A2460714} (DetInstaller Class) - http://www.pandasoftware.es/avchecker/c … etInst.cab O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://download.ewido.net/ewidoOnlineScan.cab O16 - DPF: {1F2F4C9E-6F09-47BC-970D-3C54734667FE} - http://www.symantec.com/techsupp/asa/ctrl/LSSupCtl.cab O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/Shar … vSniff.cab O16 - DPF: {2ED9BC2B-4DF1-472E-9B5E-55477D2C97F5} (Microsoft Data Collection Control) - https://support.microsoft.com/OAS/ActiveX/odc.cab O16 - DPF: {3D8700FB-86A4-4CB4-B738-6F0FC016AC7D} (MainControl Class) - http://arcaonline.arcabit.com/ArcaOnline.cab O16 - DPF: {512FC5A1-7DE1-43F1-BC0C-371622FCB409} (TotalScan Installer Class) - http://www.nanoscan.com/as/v1/cabs/ascstubie.cab O16 - DPF: {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} (OnlineScanner Control) - http://www.eset.eu/buxus/docs/programs/ … canner.cab O16 - DPF: {5A09E43F-A0A7-4ABF-AF80-11367CF1DC8F} (MainControl Class) - http://mks.com.pl/skaner/SkanerOnline.cab O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resourc … oscan8.cab O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/resour … se8300.cab O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/microso … 7993523000 O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/Shar … /cabsa.cab O16 - DPF: {68282C51-9459-467B-95BF-3C0E89627E55} (MainControl Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microso … 7993502921 O16 - DPF: {8167C273-DF59-4416-B647-C8BB2C7EE83E} (WebSDev Control) - http://liveupdate.msi.com.tw/autobios/L … nstall.cab O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan … asinst.cab O16 - DPF: {9D190AE6-C81E-4039-8061-978EBAD10073} - http://support.f-secure.com/ols/fscax.cab O16 - DPF: {BB21F850-63F4-4EC9-BF9D-565BD30C9AE9} - http://ax.emsisoft.com/asquared.cab O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - http://www.symantec.com/techsupp/asa/ctrl/SymAData.cab O16 - DPF: {E7544C6C-CFD6-43EA-B4E9-360CEE20BDF7} - http://www.mks.com.pl/skaner/SkanerOnline.cab O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/su/ocx/15030/CTPID.cab O17 - HKLM\System\CCS\Services\Tcpip…{9F3F9F70-4FD4-4564-9EC2-CDEBA7CA94CE}: NameServer = 194.204.159.1 217.98.63.164 O20 - Winlogon Notify: !SASWinLogon - D:\SUPERAntiSpyware\SASWINLO.dll O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - D:\ewido\AVG Anti-Spyware 7.5\guard.exe O23 - Service: lxcz_device - - C:\WINDOWS\system32\lxczcoms.exe O23 - Service: MksFwall - MKS Sp z o.o. - C:\Program Files\mks_vir_2007\bin\MksFwall.exe O23 - Service: MksPC - Unknown owner - C:\Program Files\mks_vir_2007\bin\MksPC.exe O23 - Service: MksUpdate - MKS Sp. z o. o. - C:\Program Files\mks_vir_2007\bin\mksupdate.exe O23 - Service: mks_vir file monitor (MksVirMonSvc) - Unknown owner - C:\Program Files\mks_vir_2007\bin\MksVirMonSvc.exe O23 - Service: MkS_Scan - Unknown owner - C:\Program Files\mks_vir_2007\bin\mks_scan.exe O23 - Service: MySQL - Unknown owner - C:\Program.exe (file missing) O23 - Service: STI Simulator - Unknown owner - C:\WINDOWS\System32\PAStiSvc.exe – End of file - 9926 bytes

silent cz 1 http://www.wklej.org/id/552511d40e

silent cz 2 http://www.wklej.org/id/feda8aa923

ComboFix 07-08-14.4 - “PAULA” 2007-08-25 1:31:55.4 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.2.1250.1.1045.18.117 [GMT 2:00] ((((((((((((((((((((((((( Files Created from 2007-07-24 to 2007-08-24 ))))))))))))))))))))))))))))))) 2007-08-24 22:41 206 --a------ C:\WINDOWS\system32\afaed_r.dll 2007-08-24 22:15 2007-08-23 21:11 2007-08-21 04:28 2007-08-18 20:01 10,592,256 --a------ C:\DOCUME~1\PAULA\ntuser.dat 2007-08-17 19:25 2007-08-17 19:19 2007-08-17 19:15 2007-08-17 02:12 2007-08-17 00:44 51,200 --a------ C:\WINDOWS\nircmd.exe 2007-08-15 01:24 2007-08-15 00:16 2007-08-13 06:04 2007-08-13 06:02 2007-08-13 06:01 1,310,720 --ah----- C:\DOCUME~1\JUSTYN~1.000\ntuser.dat 2007-08-13 06:01 2007-08-13 06:01 2007-08-13 06:01 2007-08-13 06:01 2007-08-13 06:01 2007-08-13 06:01 2007-08-13 06:01 2007-08-11 17:37 262,144 --a------ C:\DOCUME~1\JUSTYN~1.PAU\ntuser.dat 2007-08-07 01:19 2007-08-06 22:52 40,960 --a------ C:\WINDOWS\system32\lxczvs.dll 2007-08-06 22:52 344,064 --a------ C:\WINDOWS\system32\lxczcoin.dll 2007-08-06 20:52 87,040 --a–c— C:\WINDOWS\system32\dllcache\wiafbdrv.dll 2007-08-06 20:52 87,040 --a------ C:\WINDOWS\system32\wiafbdrv.dll 2007-08-06 20:52 40,960 --a------ C:\Temp\rtdrvmon.exe 2007-08-06 20:49 15,104 --a–c— C:\WINDOWS\system32\dllcache\usbscan.sys 2007-08-06 20:49 15,104 --a------ C:\WINDOWS\system32\drivers\usbscan.sys 2007-08-06 20:46 25,856 --a–c— C:\WINDOWS\system32\dllcache\usbprint.sys 2007-08-06 20:46 25,856 --a------ C:\WINDOWS\system32\drivers\usbprint.sys 2007-08-06 20:25 45,056 --a------ C:\WINDOWS\system32\LXPRMON.DLL 2007-08-06 20:25 32,768 --a------ C:\WINDOWS\system32\LXPMONUI.DLL 2007-08-06 20:24 98,345 --a------ C:\WINDOWS\system32\IMHOST32.DLL 2007-08-06 20:24 339,968 --a------ C:\WINDOWS\system32\IMGMAN32.DLL 2007-08-06 20:24 12,288 --a------ C:\WINDOWS\system32\LXPMONRC.DLL 2007-08-06 20:24 2007-08-06 20:24 2007-08-06 20:22 2007-08-06 20:21 991,232 --a------ C:\WINDOWS\system32\lxczusb1.dll 2007-08-06 20:21 983,107 --a------ C:\WINDOWS\system32\lxczgf.dll 2007-08-06 20:21 94,208 --a------ C:\WINDOWS\system32\lxczpplc.dll 2007-08-06 20:21 94,208 --a------ C:\WINDOWS\system32\lxczcur.dll 2007-08-06 20:21 90,112 --a------ C:\WINDOWS\system32\lxczinsr.dll 2007-08-06 20:21 73,728 -ra------ C:\WINDOWS\system32\lxczcfg.dll 2007-08-06 20:21 73,728 --a------ C:\WINDOWS\system32\lxczcu.dll 2007-08-06 20:21 696,320 --a------ C:\WINDOWS\system32\lxczhbn3.dll 2007-08-06 20:21 684,032 --a------ C:\WINDOWS\system32\lxczcomc.dll 2007-08-06 20:21 643,072 --a------ C:\WINDOWS\system32\lxczpmui.dll 2007-08-06 20:21 585,728 --a------ C:\WINDOWS\system32\lxczlmpm.dll 2007-08-06 20:21 537,520 --a------ C:\WINDOWS\system32\lxczcoms.exe 2007-08-06 20:21 462,848 --a------ C:\WINDOWS\system32\lxczjswr.dll 2007-08-06 20:21 421,888 --a------ C:\WINDOWS\system32\lxczcomm.dll 2007-08-06 20:21 413,696 --a------ C:\WINDOWS\system32\lxczutil.dll 2007-08-06 20:21 413,696 --a------ C:\WINDOWS\system32\lxczinpa.dll 2007-08-06 20:21 397,312 --a------ C:\WINDOWS\system32\lxcziesc.dll 2007-08-06 20:21 385,968 --a------ C:\WINDOWS\system32\lxczih.exe 2007-08-06 20:21 381,872 --a------ C:\WINDOWS\system32\lxczcfg.exe 2007-08-06 20:21 323,584 --a------ C:\WINDOWS\system32\LXCZhcp.dll 2007-08-06 20:21 274,432 --a------ C:\WINDOWS\system32\LXCZinst.dll 2007-08-06 20:21 163,840 --a------ C:\WINDOWS\system32\lxczprox.dll 2007-08-06 20:21 155,648 --a------ C:\WINDOWS\system32\lxczinsb.dll 2007-08-06 20:21 131,072 --a------ C:\WINDOWS\system32\lxczins.dll 2007-08-06 20:21 1,224,704 --a------ C:\WINDOWS\system32\lxczserv.dll 2007-08-06 20:21 2007-08-06 15:39 2007-08-06 15:38 2007-08-03 22:21 16,384 --a----t- C:\Temp\Perflib_Perfdata_9e8.dat (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) 2060-08-18 20:02 1496064 --------- C:\WINDOWS\system32\CC3250MT.DLL 2060-08-18 19:40 909824 --------- C:\WINDOWS\system32\CP3245MT.DLL 2060-08-18 19:40 24064 --------- C:\WINDOWS\system32\BORLNDMM.DLL 2007-08-21 04:54 --------- d–h----- C:\Program Files\InstallShield Installation Information 2007-08-19 02:34 --------- d-------- C:\Program Files\mks_vir_2007 2007-08-08 16:30 19456 --a------ C:\WINDOWS\system32\OnlineScannerLang.dll 2007-08-02 18:11 253952 --a------ C:\WINDOWS\system32\OnlineScannerDLLA.dll 2007-08-02 18:11 241664 --a------ C:\WINDOWS\system32\OnlineScannerDLLW.dll 2007-07-30 19:19 92504 --a–c— C:\WINDOWS\system32\dllcache\cdm.dll 2007-07-30 19:19 92504 --a------ C:\WINDOWS\system32\cdm.dll 2007-07-30 19:19 53080 --a–c— C:\WINDOWS\system32\dllcache\wuauclt.exe 2007-07-30 19:19 53080 --a------ C:\WINDOWS\system32\wuauclt.exe 2007-07-30 19:19 325976 --a–c— C:\WINDOWS\system32\dllcache\wucltui.dll 2007-07-30 19:19 325976 --a------ C:\WINDOWS\system32\wucltui.dll 2007-07-30 19:19 203096 --a–c— C:\WINDOWS\system32\dllcache\wuweb.dll 2007-07-30 19:19 203096 --a------ C:\WINDOWS\system32\wuweb.dll 2007-07-30 19:19 1712984 --a–c— C:\WINDOWS\system32\dllcache\wuaueng.dll 2007-07-30 19:19 1712984 --a------ C:\WINDOWS\system32\wuaueng.dll 2007-07-30 19:18 207736 --a------ C:\WINDOWS\system32\muweb.dll 2007-07-27 15:49 225355 --a------ C:\WINDOWS\system32\lnod32apiW.dll 2007-07-27 15:49 196683 --a------ C:\WINDOWS\system32\lnod32apiA.dll 2007-07-27 14:20 --------- d-------- C:\Program Files\ArcaMicroScan 2007-07-19 08:58 3583488 --a–c— C:\WINDOWS\system32\dllcache\mshtml.dll 2007-07-18 20:34 --------- d-------- C:\Program Files\Windows Live Safety Center 2007-07-18 16:39 6144 --a------ C:\WINDOWS\system32\mksidsa.sys 2007-07-18 16:39 15360 --a------ C:\WINDOWS\system32\mksfwallt.sys 2007-07-18 16:39 13312 --a------ C:\WINDOWS\system32\mksfwallf.sys 2007-07-18 16:39 11776 --a------ C:\WINDOWS\system32\mksidsf.sys 2007-07-13 01:32 765952 -----c— C:\WINDOWS\system32\dllcache\vgx.dll 2007-07-01 16:05 --------- d-------- C:\DOCUME~1\PAULA\DANEAP~1\Ahead 2007-06-29 17:16 --------- d-------- C:\Program Files\MySQL 2007-06-27 16:09 823808 --a–c— C:\WINDOWS\system32\dllcache\wininet.dll 2007-06-27 16:09 671232 --a–c— C:\WINDOWS\system32\dllcache\mstime.dll 2007-06-27 16:09 6058496 -----c— C:\WINDOWS\system32\dllcache\ieframe.dll 2007-06-27 16:09 52224 -----c— C:\WINDOWS\system32\dllcache\msfeedsbs.dll 2007-06-27 16:09 477696 --a–c— C:\WINDOWS\system32\dllcache\mshtmled.dll 2007-06-27 16:09 459264 -----c— C:\WINDOWS\system32\dllcache\msfeeds.dll 2007-06-27 16:09 44544 -----c— C:\WINDOWS\system32\dllcache\iernonce.dll 2007-06-27 16:09 27648 --a–c— C:\WINDOWS\system32\dllcache\jsproxy.dll 2007-06-27 16:09 267776 -----c— C:\WINDOWS\system32\dllcache\iertutil.dll 2007-06-27 16:09 232960 -----c— C:\WINDOWS\system32\dllcache\webcheck.dll 2007-06-27 16:09 193024 --a–c— C:\WINDOWS\system32\dllcache\msrating.dll 2007-06-27 16:09 1152000 --a–c— C:\WINDOWS\system32\dllcache\urlmon.dll 2007-06-27 16:09 105984 -----c— C:\WINDOWS\system32\dllcache\url.dll 2007-06-27 16:09 102400 -----c— C:\WINDOWS\system32\dllcache\occache.dll 2007-06-27 16:08 384512 -----c— C:\WINDOWS\system32\dllcache\iedkcs32.dll 2007-06-27 16:08 383488 -----c— C:\WINDOWS\system32\dllcache\ieapfltr.dll 2007-06-27 16:08 230400 -----c— C:\WINDOWS\system32\dllcache\ieaksie.dll 2007-06-27 16:08 153088 -----c— C:\WINDOWS\system32\dllcache\ieakeng.dll 2007-06-27 16:08 132608 --a–c— C:\WINDOWS\system32\dllcache\extmgr.dll 2007-06-27 16:08 124928 -----c— C:\WINDOWS\system32\dllcache\advpack.dll 2007-06-27 10:30 625152 -----c— C:\WINDOWS\system32\dllcache\iexplore.exe 2007-06-27 10:27 63488 -----c— C:\WINDOWS\system32\dllcache\ie4uinit.exe 2007-06-27 10:27 13824 -----c— C:\WINDOWS\system32\dllcache\ieudinit.exe 2007-06-27 09:00 161792 -----c— C:\WINDOWS\system32\dllcache\ieakui.dll 2007-06-26 18:27 0 --a------ C:\AUTOEXEC.BAT 2007-06-26 08:10 1104896 --a------ C:\WINDOWS\system32\msxml3.dll 2007-06-26 08:10 1104896 -----c— C:\WINDOWS\system32\dllcache\msxml3.dll 2007-06-19 15:32 282112 --a------ C:\WINDOWS\system32\gdi32.dll 2007-06-19 15:32 282112 -----c— C:\WINDOWS\system32\dllcache\gdi32.dll 2007-06-13 15:23 1034752 --a------ C:\WINDOWS\explorer.exe 2007-06-13 15:23 1034752 -----c— C:\WINDOWS\system32\dllcache\explorer.exe 2007-06-13 11:10 77824 --a------ C:\WINDOWS\system32\OnlineScannerUninstaller.exe ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “MKSRegmon”=“C:\Program Files\mks_vir_2007\bin\mksregmon.exe” [2007-05-24 05:06] “mks_mail”=“C:\Program Files\mks_vir_2007\bin\mks_mail.exe” [2007-05-24 05:06] “mkstray”=“C:\Program Files\mks_vir_2007\bin\mkstray.exe” [2007-06-29 16:41] “lxczbmgr.exe”=“C:\Program Files\Lexmark 1200 Series\lxczbmgr.exe” [2007-02-09 00:55] “MSConfig”=“C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe” [2004-08-04 14:00] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “SUPERAntiSpyware”=“D:\SUPERAntiSpyware\SUPERAntiSpyware.exe” [2007-06-21 14:06] [HKEY_USERS.default\software\microsoft\windows\currentversion\run] “DWQueuedReporting”=“C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe” -t C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\ CoreCenter.lnk - C:\Program Files\MSI\Core Center\CoreCenter.exe [2006-03-15 00:42:18] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] “NoRecentDocsMenu”=1 (0x1) [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify!SASWinLogon] D:\SUPERAntiSpyware\SASWINLO.dll 2007-04-19 13:41 294912 D:\SUPERAntiSpyware\SASWINLO.dll [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MkS_Scan] @=“service” [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Adobe Reader Speed Launch.lnk] path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Adobe Reader Speed Launch.lnk backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Adobe Reader Synchronizer.lnk] path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Adobe Reader Synchronizer.lnk backup=C:\WINDOWS\pss\Adobe Reader Synchronizer.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Color Calibration.lnk] backup=C:\WINDOWS\pss\Color Calibration.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^DSLMON.lnk] backup=C:\WINDOWS\pss\DSLMON.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^MagicTune3.5.lnk] backup=C:\WINDOWS\pss\MagicTune3.5.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg!AVG Anti-Spyware] “D:\ewido\AVG Anti-Spyware 7.5\avgas.exe” /minimized [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl] “C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe” [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched] “C:\Program Files\Java\jre1.5.0_08\bin\jusched.exe” [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-] “NBJ”=“C:\Program Files\Ahead\Nero BackItUp\NBJ.exe” R0 mksidsa;mksidsa;C:\WINDOWS\system32\mksidsa.sys R1 mksfwallf;mksfwallf;??\C:\WINDOWS\system32\mksfwallf.sys R1 mksfwallt;mksfwallt;??\C:\WINDOWS\system32\mksfwallt.sys R2 LANPkt;Realtek LANPkt Protocol;C:\WINDOWS\system32\DRIVERS\LANPkt.sys R2 lxcz_device;lxcz_device;C:\WINDOWS\system32\lxczcoms.exe -service R2 MksFwall;MksFwall;“C:\Program Files\mks_vir_2007\bin\MksFwall.exe” R2 MksPC;MksPC;“C:\Program Files\mks_vir_2007\bin\MksPC.exe” R2 MksUpdate;MksUpdate;“C:\Program Files\mks_vir_2007\bin\mksupdate.exe” R3 mksidsf;mksidsf;??\C:\WINDOWS\system32\mksidsf.sys R3 MksMonEn;MksMonEn;??\C:\Program Files\mks_vir_2007\bin\MksMonEn.sys R3 MksMonEv;MksMonEv;??\C:\Program Files\mks_vir_2007\bin\MksMonEv.sys R3 MksMonFd;MksMonFd;??\C:\Program Files\mks_vir_2007\bin\MksMonFd.sys R3 NETIMFLT;PANDA NDIS IM Filter Miniport;C:\WINDOWS\system32\DRIVERS\netimflt.sys R3 PAC207;SoC PC-Camer@;C:\WINDOWS\system32\DRIVERS\pfc027.sys R3 PCAlertDriver;PCAlertDriver;??\C:\Program Files\MSI\Core Center\NTGLM7X.sys R3 RushTopDevice;RushTopDevice;??\C:\Program Files\MSI\Core Center\RushTop.sys R3 usbscan;Sterownik skanera USB;C:\WINDOWS\system32\DRIVERS\usbscan.sys S3 GMSIPCI;GMSIPCI;??\D:\INSTALL\GMSIPCI.SYS S3 PCASp50;PCASp50 NDIS Protocol Driver;C:\WINDOWS\system32\Drivers\PCASp50.sys S3 USBSTOR;Sterownik magazynu masowego USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS ************************************************************************** catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-08-25 01:33:27 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes … scanning hidden autostart entries … scanning hidden files … scan completed successfully hidden files: 0 ************************************************************************** Completion time: 2007-08-25 1:35:13 C:\ComboFix2.txt … 2007-08-25 00:51 C:\ComboFix3.txt … 2007-08-25 00:44 — E O F —

[jessica]

W logach nie widzę żadnej infekcji.

Chyba trochę się pogubiłam: jakiego używasz Antivirusa, bo w logach widzę wpisy trzech Antivirusów: MKS, Kaspersky, Panda?

Poza tym widzę ponad 300 pozycji podpiętych do *HKLM\System\CurrentControlSet\Control\Session Manager*

INFECTION WARNING! “BootExecute” = "autocheck autochk , w tym baaardzo dużo wpisów Pandy. Jeszcze nigdy nie widziałam tylu wpisów Pandy w “BootExecute”.

Moim skromnym zdaniem to musi być obciążające dla systemu.

Ale powtarzam: to nie infekcja.

jessi

[sugar_1299392758 (sugar!!!)]

Mam teraz tylko mks-a. Pandę odinstalowałam, i niestety również nieudolnie próbowałam pozbyć się jej resztek przy pomocy jvPowerTools co skończyło się niedziałającym mksem i przywracaniem systemu. Mogę prosić o pomoc w usunięciu tego co niepotrzebne ? Może wystarczy wyczyścić te wpisy w rejestrze ?

[jessica]

Usuwanie resztek Pandy jest bardzo kłopotliwe, choć bardzo potrzebne.

Do odinstalowania Pandy najlepiej było zainstalować specjalny program, przygotowany przez Pandę. Ale teraz, gdy zostały tylko resztki, to nie ma chyba sensu.

Spróbuj skorzystać z rad zawartych TUTAJ.

A już teraz możesz zrobić porządek z “BootExecute”:

Wklej do Notatnika:

Windows Registry Editor Version 5.00


[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager]

"BootExecute"=hex(7):61,00,75,00,74,00,6f,00,63,00,68,00,65,00,63,00,6b,00,20,\

  00,61,00,75,00,74,00,6f,00,63,00,68,00,6b,00,20,00,2a,00,00,00,00,00

Z menu Notatnika >>> Plik >>> Zapisz jako >>> Ustaw rozszerzenie na Wszystkie pliki >>> Zapisz jako FIX.REG

Plik uruchomić. (dwuklik)

Powodzenia!

jessi