System messenger


(system) #1
Logfile of HijackThis v1.99.1

Scan saved at 06:03:35, on 2008-03-20

Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)


Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\csrss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\RTHDCPL.EXE

C:\WINDOWS\AGRSMMSG.exe

C:\WINDOWS\system32\igfxtray.exe

C:\WINDOWS\system32\hkcmd.exe

C:\WINDOWS\system32\igfxpers.exe

C:\Program Files\Eset\nod32kui.exe

C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe

C:\Program Files\System Control Manager\MGSysCtrl.exe

C:\WINDOWS\system32\igfxsrvc.exe

C:\WINDOWS\system32\rundll32.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Gadu-Gadu\gg.exe

C:\Program Files\Skype\Phone\Skype.exe

C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe

C:\Program Files\Skype\Plugin Manager\skypePM.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\System Control Manager\edd.exe

C:\Program Files\Eset\nod32krn.exe

C:\Program Files\O2Micro Oz128 Driver\o2flash.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\wdfmgr.exe

C:\WINDOWS\system32\wscntfy.exe

C:\WINDOWS\System32\alg.exe

C:\Program Files\Internet Explorer\IEXPLORE.EXE

C:\WINDOWS\system32\wuauclt.exe

C:\Program Files\totalcmd\TOTALCMD.EXE

E:\PROGRAMY\hijackthis\HijackThis.exe


R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.interia.pl/

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll

O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll

O2 - BHO: flashget urlcatch - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\Program Files\FlashGet\jccatch.dll

O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll

O2 - BHO: (no name) - {7BBE7740-1A08-448F-90F5-49B200338270} - C:\WINDOWS\system32\ctl3dv2e.dll

O2 - BHO: (no name) - {ED25F9D7-E051-4D19-8FCA-60CCD67F3774} - c:\windows\system32\esent97f.dll

O2 - BHO: FlashGet GetFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\Program Files\FlashGet\getflash.dll

O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE

O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE

O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe

O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe

O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe

O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe

O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE

O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"

O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe

O4 - HKLM\..\Run: [MGSysCtrl] C:\Program Files\System Control Manager\MGSysCtrl.exe

O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent

O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray

O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized

O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe

O8 - Extra context menu item: &Ściągnij przy pomocy FlashGet'a - C:\Program Files\FlashGet\jc_link.htm

O8 - Extra context menu item: &Ściągnij wszystko przy pomocy FlashGet'a - C:\Program Files\FlashGet\jc_all.htm

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll

O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll

O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe

O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe

O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O16 - DPF: {3D8700FB-86A4-4CB4-B738-6F0FC016AC7D} (MainControl Class) - http://slimak.onet.pl/_m/wirusy/ArcaOnline.cab

O17 - HKLM\System\CCS\Services\Tcpip\..\{40E91EEF-358B-40F6-A5D1-5E748094B6ED}: NameServer = 194.204.152.34,194.204.159.1

O17 - HKLM\System\CCS\Services\Tcpip\..\{C2990DE4-B481-46BF-A38F-3E8609D1D761}: NameServer = 194.204.152.34,194.204.159.1

O17 - HKLM\System\CS1\Services\Tcpip\..\{40E91EEF-358B-40F6-A5D1-5E748094B6ED}: NameServer = 194.204.152.34,194.204.159.1

O17 - HKLM\System\CS2\Services\Tcpip\..\{40E91EEF-358B-40F6-A5D1-5E748094B6ED}: NameServer = 194.204.152.34,194.204.159.1

O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL

O20 - Winlogon Notify: exwxdxng - C:\WINDOWS\SYSTEM32\esent97f.dll

O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll

O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe

O23 - Service: SCM Driver Daemon (NishService) - Unknown owner - C:\Program Files\System Control Manager\edd.exe

O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe

O23 - Service: O2Micro Flash Memory Card Service (o2flash) - O2Micro International - C:\Program Files\O2Micro Oz128 Driver\o2flash.exe

(system) #2

Mam prośbe napisz coś o swoim problemie bo info jest skąpe. A wróżka etat straciła :stuck_out_tongue:


(system) #3

Wyskakuje mi cos takiego za kazdym razem jak wlaczam kompa.


(huber2t) #4

A możesz nam podać co wyskakuje


(system) #5

System messenger-ten napis wyskakuje w pasku zadan.I prosze sprawdzcie mi logi bo cos mi sie wydaje ze mam tam namieszane a ja dopiero pierwszy raz uzywam tego programu.Aha i to jest laptop nie wiem czy to ma jakies znaczenie.


(huber2t) #6

Odinstaluj messengera w dodaj/usuń składniki systemu


(Dmirecki) #7

myszka007 ,

FIX:

Pobierz ComboFix, ale nie uruchamiaj

Wklej do notatnika:

File::

C:\WINDOWS\system32\ctl3dv2e.dll

C:\WINDOWS\SYSTEM32\esent97f.dll

Plik -> zapisz jako -> CFScript.txt

Przeciągnij i upuść ikonkę CFScript.txt na ikonkę ComboFix.exe tak jak tu ->

88953CFScript-createdbyMiekiemoes.gif

Powinno się rozpocząć usuwanie i powstanie log, daj ten log na forum + nowy log z HijackThis.

Jeśli wszystko pójdzie dobrze, to po restarcie usuń ręcznie folder C: **** Qoobox


(system) #8

Oki dzieki za pomoc pomoglo,juz nic nie wyskakuje.


(Dmirecki) #9

:slight_smile:


(system) #10

Logfile of HijackThis v1.99.1

Scan saved at 10:57, on 2008-03-24

Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\RTHDCPL.EXE

C:\WINDOWS\AGRSMMSG.exe

C:\WINDOWS\system32\igfxtray.exe

C:\WINDOWS\system32\hkcmd.exe

C:\WINDOWS\system32\igfxpers.exe

C:\Program Files\Eset\nod32kui.exe

C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe

C:\Program Files\System Control Manager\MGSysCtrl.exe

C:\WINDOWS\system32\ctfmon.exe

C:\WINDOWS\system32\igfxsrvc.exe

C:\Program Files\Gadu-Gadu\gg.exe

C:\Program Files\Skype\Phone\Skype.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Skype\Plugin Manager\skypePM.exe

C:\Program Files\System Control Manager\edd.exe

C:\Program Files\Eset\nod32krn.exe

C:\Program Files\O2Micro Oz128 Driver\o2flash.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\wscntfy.exe

C:\Program Files\Internet Explorer\IEXPLORE.EXE

C:\Program Files\totalcmd\TOTALCMD.EXE

E:\PROGRAMY\hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.interia.pl/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll

O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll

O2 - BHO: flashget urlcatch - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\Program Files\FlashGet\jccatch.dll

O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll

O2 - BHO: FlashGet GetFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\Program Files\FlashGet\getflash.dll

O4 - HKLM..\Run: [RTHDCPL] RTHDCPL.EXE

O4 - HKLM..\Run: [AGRSMMSG] AGRSMMSG.exe

O4 - HKLM..\Run: [igfxTray] C:\WINDOWS\system32\igfxtray.exe

O4 - HKLM..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe

O4 - HKLM..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe

O4 - HKLM..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE

O4 - HKLM..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"

O4 - HKLM..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe

O4 - HKLM..\Run: [MGSysCtrl] C:\Program Files\System Control Manager\MGSysCtrl.exe

O4 - HKCU..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray

O4 - HKCU..\Run: [skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized

O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe

O8 - Extra context menu item: &Ściągnij przy pomocy FlashGet'a - C:\Program Files\FlashGet\jc_link.htm

O8 - Extra context menu item: &Ściągnij wszystko przy pomocy FlashGet'a - C:\Program Files\FlashGet\jc_all.htm

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\npjpi160_05.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\npjpi160_05.dll

O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll

O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe

O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe

O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O16 - DPF: {3D8700FB-86A4-4CB4-B738-6F0FC016AC7D} (MainControl Class) - http://slimak.onet.pl/_m/wirusy/ArcaOnline.cab

O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - http://www.systemrequirementslab.com/sysreqlab2.cab

O17 - HKLM\System\CCS\Services\Tcpip..{40E91EEF-358B-40F6-A5D1-5E748094B6ED}: NameServer = 194.204.152.34,194.204.159.1

O17 - HKLM\System\CCS\Services\Tcpip..{C2990DE4-B481-46BF-A38F-3E8609D1D761}: NameServer = 194.204.152.34,194.204.159.1

O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL

O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll

O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe

O23 - Service: SCM Driver Daemon (NishService) - Unknown owner - C:\Program Files\System Control Manager\edd.exe

O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe

O23 - Service: O2Micro Flash Memory Card Service (o2flash) - O2Micro International - C:\Program Files\O2Micro Oz128 Driver\o2flash.exe


(Dawidex11) #11

Log czysty , jak chcesz możesz podać log z ComboFix'a :arrow: http://download.bleepingcomputer.com/sUBs/ComboFix.exe .

Zasady wklejania logów na forum :arrow: http://forum.dobreprogramy.pl/viewtopic.php?f=16&t=213350 .


(system) #12

ComboFix 08-03-23.5 - Natalka_ 2008-03-24 11:06:23.2 - NTFSx86

Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.1527 [GMT 1:00]

Running from: C:\Downloads\ComboFix.exe

Command switches used :: C:\Downloads\CFScript.txt

* Created a new restore point

* Resident AV is active

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED!!

.

((((((((((((((((((((((((( Files Created from 2008-02-24 to 2008-03-24 )))))))))))))))))))))))))))))))

.

2008-03-23 13:11 . 2008-03-23 13:11

2008-03-23 12:00 . 2007-03-12 16:42 3,495,784 --a------ C:\WINDOWS\system32\d3dx9_33.dll

2008-03-23 11:59 . 2008-03-23 12:00

2008-03-21 19:40 . 2008-03-22 07:40

2008-03-18 06:27 . 2008-03-18 06:27

2008-03-17 20:26 . 2008-03-17 20:41

2008-03-17 20:25 . 2008-03-17 20:25

2008-03-17 19:05 . 2004-08-04 00:35 25,728 --a------ C:\WINDOWS\system32\drivers\hidbth.sys

2008-03-17 19:05 . 2004-08-04 00:35 25,728 --a--c--- C:\WINDOWS\system32\dllcache\hidbth.sys

2008-03-17 19:05 . 2004-08-04 00:38 14,848 --a------ C:\WINDOWS\system32\drivers\kbdhid.sys

2008-03-17 19:05 . 2004-08-04 00:38 14,848 --a--c--- C:\WINDOWS\system32\dllcache\kbdhid.sys

2008-03-17 19:04 . 2004-08-03 23:10 38,016 --a------ C:\WINDOWS\system32\drivers\bthmodem.sys

2008-03-17 19:04 . 2004-08-03 23:10 38,016 --a--c--- C:\WINDOWS\system32\dllcache\bthmodem.sys

2008-03-16 10:19 . 2008-03-16 10:19

2008-03-16 10:19 . 2008-03-16 10:21

2008-03-14 18:48 . 2008-03-14 18:48 1,188,375 --a------ C:\WINDOWS\system32\libeay32.dll

2008-03-14 18:48 . 2008-03-14 18:48 741,632 --a------ C:\WINDOWS\system32\pjsadobb.dat

2008-03-14 18:48 . 2008-03-14 18:48 246,545 --a------ C:\WINDOWS\system32\libssl32.dll

2008-03-14 18:48 . 2008-03-14 18:48 42,752 --a------ C:\WINDOWS\system32\aioafjqx.dat

2008-03-14 18:48 . 2008-03-14 18:48 36,608 --a------ C:\WINDOWS\system32\kthagrrt.dat

2008-03-14 18:48 . 2008-03-14 18:48 35,072 --a------ C:\WINDOWS\system32\rnsbxmxo.dat

2008-03-13 16:18 . 2008-03-13 16:18 120,576 --a------ C:\WINDOWS\system32\hvnlsgss.dat

2008-03-13 15:04 . 2008-03-13 15:07

2008-03-13 15:03 . 2008-03-22 15:25

2008-03-13 14:59 . 2008-03-13 15:00 3,072,054 --a------ C:\WINDOWS\FrameShow Wallpaper.BMP

2008-03-12 22:31 . 2008-03-24 11:06

2008-03-08 18:53 . 2008-03-08 18:53

2008-03-08 18:53 . 2008-03-08 18:53

2008-03-08 18:39 . 2008-03-08 18:48

2008-03-07 06:36 . 2008-03-23 13:45 116 --a------ C:\WINDOWS\NeroDigital.ini

2008-03-06 20:34 . 2008-03-24 10:36

2008-03-01 08:29 . 2008-03-24 09:55

2008-03-01 08:29 . 2008-03-01 08:29 32 --a------ C:\Documents and Settings\All Users\Dane aplikacji\ezsid.dat

2008-03-01 08:28 . 2008-03-01 08:28

2008-03-01 08:28 . 2008-03-01 08:28

2008-03-01 08:28 . 2008-03-24 11:06

2008-03-01 08:20 . 2008-03-24 10:41

2008-02-28 23:29 . 2008-02-28 23:29

2008-02-28 23:29 . 2007-05-02 15:17 94,208 --a------ C:\WINDOWS\system32\MGHwCtrl.dll

2008-02-28 23:29 . 2004-11-02 11:08 32,768 --a------ C:\WINDOWS\system32\MGFPCtrl.dll

2008-02-28 23:29 . 2006-11-06 10:02 24,576 --a------ C:\WINDOWS\system32\MGPwrShm.dll

2008-02-28 23:29 . 2000-11-12 22:39 24,576 --a------ C:\WINDOWS\system32\IdleTrac.dll

2008-02-28 23:29 . 2005-04-28 15:35 23,040 --a------ C:\WINDOWS\system32\MGFPMCE.dll

2008-02-28 23:29 . 2006-07-03 10:31 9,088 --a------ C:\WINDOWS\system32\drivers\MGHwCtrl.sys

2008-02-28 22:58 . 2008-02-28 22:58

2008-02-28 22:57 . 2008-02-28 22:57

2008-02-28 22:57 . 2007-12-24 13:49 7,680 --a------ C:\WINDOWS\system32\ff_vfw.dll

2008-02-28 22:57 . 2007-07-10 17:10 547 --a------ C:\WINDOWS\system32\ff_vfw.dll.manifest

2008-02-28 22:52 . 2008-03-01 08:28

2008-02-28 22:50 . 2008-02-28 22:50

2008-02-28 22:49 . 2008-02-28 22:49

2008-02-28 22:49 . 2008-02-28 22:51

2008-02-28 22:38 . 2008-02-28 22:38

2008-02-28 22:38 . 2008-02-22 02:33 69,632 --a------ C:\WINDOWS\system32\javacpl.cpl

2008-02-28 22:37 . 2008-03-10 06:01

2008-02-28 22:36 . 2008-02-28 22:36

2008-02-28 22:27 . 2008-02-28 22:27

2008-02-28 22:17 . 2008-02-28 22:56

2008-02-28 22:17 . 2008-02-28 22:56

2008-02-28 22:15 . 2008-02-28 22:15

2008-02-28 22:15 . 2008-02-28 22:16

2008-02-28 22:15 . 2004-08-03 22:14 359,040 --a------ C:\WINDOWS\system32\drivers\tcpip.sys.flg

2008-02-28 22:14 . 2008-02-28 22:14

2008-02-28 22:14 . 2008-03-24 11:02

2008-02-28 22:13 . 2008-02-28 22:13

2008-02-28 22:13 . 2008-02-28 22:13

2008-02-28 22:12 . 2008-02-28 22:12

2008-02-28 21:42 . 2008-03-24 10:56

2008-02-28 21:38 . 2008-02-28 21:38 512,096 --a------ C:\WINDOWS\system32\drivers\amon.sys

2008-02-28 21:38 . 2008-02-28 21:38 298,104 --a------ C:\WINDOWS\system32\imon.dll

2008-02-28 21:38 . 2008-02-28 21:38 15,424 --a------ C:\WINDOWS\system32\drivers\nod32drv.sys

2008-02-28 21:37 . 2008-03-13 20:53

2008-02-28 21:28 . 2007-04-05 15:19 546,112 -ra------ C:\WINDOWS\system32\drivers\ar5211.sys

2008-02-28 21:27 . 2007-02-07 08:43 90,880 -ra------ C:\WINDOWS\system32\drivers\Rtenicxp.sys

2008-02-28 21:18 . 2008-02-28 21:18

2008-02-28 21:18 . 2008-02-28 21:18

2008-02-28 21:18 . 2008-02-28 21:18

2008-02-28 21:18 . 2008-02-28 21:18

2008-02-28 21:18 . 2008-03-17 20:51 356,352 --a------ C:\WINDOWS\system32\AegisI5Installer.exe

2008-02-28 21:17 . 2008-02-28 21:17

2008-02-28 21:13 . 2008-02-28 21:13

2008-02-28 21:12 . 2008-02-28 21:12

2008-02-28 21:12 . 2008-02-28 21:12

2008-02-28 21:12 . 2007-04-03 10:04 39,680 --a------ C:\WINDOWS\system32\drivers\o2media.sys

2008-02-28 21:12 . 2007-04-02 16:11 35,712 --a------ C:\WINDOWS\system32\drivers\o2sd.sys

2008-02-28 21:10 . 2008-02-28 21:10 940,794 --a------ C:\WINDOWS\system32\LoopyMusic.wav

2008-02-28 21:10 . 2007-02-26 03:36 180,224 -ra------ C:\WINDOWS\system32\igfxres.dll

2008-02-28 21:10 . 2008-02-28 21:10 146,650 --a------ C:\WINDOWS\system32\BuzzingBee.wav

2008-02-28 21:08 . 2008-02-28 21:08

2008-02-28 21:07 . 2008-02-28 21:07

2008-02-28 21:06 . 2008-02-28 21:13

2008-02-28 21:06 . 2008-02-28 23:29

2008-02-28 21:06 . 2008-02-28 21:06

2008-02-28 21:03 . 2008-02-28 21:03

2008-02-28 21:03 . 2005-05-02 05:10 68,096 --------- C:\WINDOWS\system32\agrsmdel.exe

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2008-03-08 17:39 499,712 ----a-w C:\WINDOWS\system32\msvcp71.dll

2008-03-08 17:39 348,160 ----a-w C:\WINDOWS\system32\msvcr71.dll

2008-03-05 15:03 479,752 ----a-w C:\WINDOWS\system32\XAudio2_0.dll

2008-03-05 15:03 238,088 ----a-w C:\WINDOWS\system32\xactengine3_0.dll

2008-03-05 15:00 25,608 ----a-w C:\WINDOWS\system32\X3DAudio1_3.dll

2008-03-05 14:56 3,786,760 ----a-w C:\WINDOWS\system32\D3DX9_37.dll

2008-03-05 14:56 1,420,824 ----a-w C:\WINDOWS\system32\D3DCompiler_37.dll

2008-02-28 21:12 --------- d-----w C:\Program Files\totalcmd

2008-02-28 20:06 315,392 ----a-w C:\WINDOWS\HideWin.exe

2008-02-28 19:16 --------- d-----w C:\Documents and Settings\Natalka_\Dane aplikacji\AdobeUM

2008-02-28 19:15 --------- d-----w C:\Program Files\Common Files\Adobe

2008-02-28 18:59 --------- d-----w C:\Program Files\microsoft frontpage

2008-02-28 18:58 --------- d-----w C:\Program Files\Usługi online

2008-02-05 22:07 462,864 ----a-w C:\WINDOWS\system32\d3dx10_37.dll

.

------- Sigcheck -------

2004-08-03 22:14 359040 9f4b36614a0fc234525ba224957de55c C:\WINDOWS\system32\dllcache\tcpip.sys

2004-08-03 22:14 359040 6a603809f598332dbedd535bdbce313e C:\WINDOWS\system32\drivers\tcpip.sys

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Note* empty entries legit default entries are not shown

REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-03 23:44 15360]

"Gadu-Gadu"="C:\Program Files\Gadu-Gadu\gg.exe" [2007-11-14 11:54 2131392]

"Skype"="C:\Program Files\Skype\Phone\Skype.exe" [2007-12-12 15:25 21686568]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"RTHDCPL"="RTHDCPL.EXE" [2007-06-13 22:49 16377344 C:\WINDOWS\RTHDCPL.exe]

"AGRSMMSG"="AGRSMMSG.exe" [2006-06-29 06:32 89541 C:\WINDOWS\AGRSMMSG.exe]

"IgfxTray"="C:\WINDOWS\system32\igfxtray.exe" [2007-02-26 03:34 131072]

"HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe" [2007-02-26 03:34 155648]

"Persistence"="C:\WINDOWS\system32\igfxpers.exe" [2007-02-26 03:33 131072]

"nod32kui"="C:\Program Files\Eset\nod32kui.exe" [2008-02-28 21:38 949376]

"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 04:25 144784]

"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 10:50 155648]

"MGSysCtrl"="C:\Program Files\System Control Manager\MGSysCtrl.exe" [2007-06-20 11:11 180736]

[HKEY_USERS.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-03 23:44 15360]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\system32\sessmgr.exe"=

"C:\Program Files\FlashGet\flashget.exe"=

"C:\Program Files\Gadu-Gadu\gg.exe"=

"C:\Program Files\Skype\Phone\Skype.exe"=

"C:\Program Files\DC++\DCPlusPlus.exe"=

R0 O2MDRDR;O2MDRDR;C:\WINDOWS\system32\DRIVERS\o2media.sys [2007-04-03 10:04]

R0 O2SDRDR;O2SDRDR;C:\WINDOWS\system32\DRIVERS\o2sd.sys [2007-04-02 16:11]

R2 NishService;SCM Driver Daemon;C:\Program Files\System Control Manager\edd.exe [2006-03-22 11:07]

R3 MGHwCtrl;MGHwCtrl;C:\WINDOWS\system32\drivers\MGHwCtrl.sys [2006-07-03 10:31]

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs

xgvovciu

.

**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2008-03-24 11:07:11

Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully

hidden files: 0

**************************************************************************

.

--------------------- DLLs Loaded Under Running Processes ---------------------

PROCESS: C:\WINDOWS\system32\lsass.exe

  • C:\Program Files\Eset\pr_imon.dll

(Dawidex11) #13

Jak dla mnie to log czysty.

myszka007 Zasady wklejania logów na forum :arrow: http://forum.dobreprogramy.pl/viewtopic.php?f=16&t=213350 .

Pytanie do Specjalisty :arrow: Czy to jest Okey ?

.

Pozdrawiam , zastosuj się do tych tematów :arrow: Zasady wklejania logów na forum :arrow: http://forum.dobreprogramy.pl/viewtopic.php?f=16&t=213350 , Ważny komunikat dotyczący tytułowania tematów :arrow: http://forum.dobreprogramy.pl/viewtopic.php?f=16&t=66889 , inaczej post może wylądować w Koszu.