Logfile of HijackThis v1.99.1
Scan saved at 06:03:35, on 2008-03-20
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\AGRSMMSG.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\Eset\nod32kui.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\Program Files\System Control Manager\MGSysCtrl.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Gadu-Gadu\gg.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Program Files\Skype\Plugin Manager\skypePM.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\System Control Manager\edd.exe
C:\Program Files\Eset\nod32krn.exe
C:\Program Files\O2Micro Oz128 Driver\o2flash.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\totalcmd\TOTALCMD.EXE
E:\PROGRAMY\hijackthis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.interia.pl/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: flashget urlcatch - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\Program Files\FlashGet\jccatch.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: (no name) - {7BBE7740-1A08-448F-90F5-49B200338270} - C:\WINDOWS\system32\ctl3dv2e.dll
O2 - BHO: (no name) - {ED25F9D7-E051-4D19-8FCA-60CCD67F3774} - c:\windows\system32\esent97f.dll
O2 - BHO: FlashGet GetFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\Program Files\FlashGet\getflash.dll
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [MGSysCtrl] C:\Program Files\System Control Manager\MGSysCtrl.exe
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: &Ściągnij przy pomocy FlashGet'a - C:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: &Ściągnij wszystko przy pomocy FlashGet'a - C:\Program Files\FlashGet\jc_all.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe
O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {3D8700FB-86A4-4CB4-B738-6F0FC016AC7D} (MainControl Class) - http://slimak.onet.pl/_m/wirusy/ArcaOnline.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{40E91EEF-358B-40F6-A5D1-5E748094B6ED}: NameServer = 194.204.152.34,194.204.159.1
O17 - HKLM\System\CCS\Services\Tcpip\..\{C2990DE4-B481-46BF-A38F-3E8609D1D761}: NameServer = 194.204.152.34,194.204.159.1
O17 - HKLM\System\CS1\Services\Tcpip\..\{40E91EEF-358B-40F6-A5D1-5E748094B6ED}: NameServer = 194.204.152.34,194.204.159.1
O17 - HKLM\System\CS2\Services\Tcpip\..\{40E91EEF-358B-40F6-A5D1-5E748094B6ED}: NameServer = 194.204.152.34,194.204.159.1
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: exwxdxng - C:\WINDOWS\SYSTEM32\esent97f.dll
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: SCM Driver Daemon (NishService) - Unknown owner - C:\Program Files\System Control Manager\edd.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
O23 - Service: O2Micro Flash Memory Card Service (o2flash) - O2Micro International - C:\Program Files\O2Micro Oz128 Driver\o2flash.exe
Mam prośbe napisz coś o swoim problemie bo info jest skąpe. A wróżka etat straciła
Wyskakuje mi cos takiego za kazdym razem jak wlaczam kompa.
A możesz nam podać co wyskakuje
System messenger-ten napis wyskakuje w pasku zadan.I prosze sprawdzcie mi logi bo cos mi sie wydaje ze mam tam namieszane a ja dopiero pierwszy raz uzywam tego programu.Aha i to jest laptop nie wiem czy to ma jakies znaczenie.
Odinstaluj messengera w dodaj/usuń składniki systemu
myszka007 ,
FIX:
Pobierz ComboFix, ale nie uruchamiaj
Wklej do notatnika:
File::
C:\WINDOWS\system32\ctl3dv2e.dll
C:\WINDOWS\SYSTEM32\esent97f.dll
Plik -> zapisz jako -> CFScript.txt
Przeciągnij i upuść ikonkę CFScript.txt na ikonkę ComboFix.exe tak jak tu ->
Powinno się rozpocząć usuwanie i powstanie log, daj ten log na forum + nowy log z HijackThis.
Jeśli wszystko pójdzie dobrze, to po restarcie usuń ręcznie folder C: ** Qoobox**
Oki dzieki za pomoc pomoglo,juz nic nie wyskakuje.
Logfile of HijackThis v1.99.1
Scan saved at 10:57, on 2008-03-24
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\AGRSMMSG.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\Eset\nod32kui.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\Program Files\System Control Manager\MGSysCtrl.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\Program Files\Gadu-Gadu\gg.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Skype\Plugin Manager\skypePM.exe
C:\Program Files\System Control Manager\edd.exe
C:\Program Files\Eset\nod32krn.exe
C:\Program Files\O2Micro Oz128 Driver\o2flash.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\totalcmd\TOTALCMD.EXE
E:\PROGRAMY\hijackthis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.interia.pl/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: flashget urlcatch - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\Program Files\FlashGet\jccatch.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: FlashGet GetFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\Program Files\FlashGet\getflash.dll
O4 - HKLM…\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM…\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM…\Run: [igfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM…\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM…\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM…\Run: [nod32kui] “C:\Program Files\Eset\nod32kui.exe” /WAITSERVICE
O4 - HKLM…\Run: [sunJavaUpdateSched] “C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe”
O4 - HKLM…\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM…\Run: [MGSysCtrl] C:\Program Files\System Control Manager\MGSysCtrl.exe
O4 - HKCU…\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU…\Run: [Gadu-Gadu] “C:\Program Files\Gadu-Gadu\gg.exe” /tray
O4 - HKCU…\Run: [skype] “C:\Program Files\Skype\Phone\Skype.exe” /nosplash /minimized
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: &Ściągnij przy pomocy FlashGet’a - C:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: &Ściągnij wszystko przy pomocy FlashGet’a - C:\Program Files\FlashGet\jc_all.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\npjpi160_05.dll
O9 - Extra ‘Tools’ menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\npjpi160_05.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe
O9 - Extra ‘Tools’ menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra ‘Tools’ menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra ‘Tools’ menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {3D8700FB-86A4-4CB4-B738-6F0FC016AC7D} (MainControl Class) - http://slimak.onet.pl/_m/wirusy/ArcaOnline.cab
O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - http://www.systemrequirementslab.com/sysreqlab2.cab
O17 - HKLM\System\CCS\Services\Tcpip…{40E91EEF-358B-40F6-A5D1-5E748094B6ED}: NameServer = 194.204.152.34,194.204.159.1
O17 - HKLM\System\CCS\Services\Tcpip…{C2990DE4-B481-46BF-A38F-3E8609D1D761}: NameServer = 194.204.152.34,194.204.159.1
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: SCM Driver Daemon (NishService) - Unknown owner - C:\Program Files\System Control Manager\edd.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
O23 - Service: O2Micro Flash Memory Card Service (o2flash) - O2Micro International - C:\Program Files\O2Micro Oz128 Driver\o2flash.exe
Log czysty , jak chcesz możesz podać log z ComboFix’a http://download.bleepingcomputer.com/sUBs/ComboFix.exe .
Zasady wklejania logów na forum http://forum.dobreprogramy.pl/viewtopic.php?f=16&t=213350 .
ComboFix 08-03-23.5 - Natalka_ 2008-03-24 11:06:23.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.1527 [GMT 1:00]
Running from: C:\Downloads\ComboFix.exe
Command switches used :: C:\Downloads\CFScript.txt
* Created a new restore point
* Resident AV is active
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED
.
((((((((((((((((((((((((( Files Created from 2008-02-24 to 2008-03-24 )))))))))))))))))))))))))))))))
.
2008-03-23 13:11 . 2008-03-23 13:11
2008-03-23 12:00 . 2007-03-12 16:42 3,495,784 --a------ C:\WINDOWS\system32\d3dx9_33.dll
2008-03-23 11:59 . 2008-03-23 12:00
2008-03-21 19:40 . 2008-03-22 07:40
2008-03-18 06:27 . 2008-03-18 06:27
2008-03-17 20:26 . 2008-03-17 20:41
2008-03-17 20:25 . 2008-03-17 20:25
2008-03-17 19:05 . 2004-08-04 00:35 25,728 --a------ C:\WINDOWS\system32\drivers\hidbth.sys
2008-03-17 19:05 . 2004-08-04 00:35 25,728 --a–c— C:\WINDOWS\system32\dllcache\hidbth.sys
2008-03-17 19:05 . 2004-08-04 00:38 14,848 --a------ C:\WINDOWS\system32\drivers\kbdhid.sys
2008-03-17 19:05 . 2004-08-04 00:38 14,848 --a–c— C:\WINDOWS\system32\dllcache\kbdhid.sys
2008-03-17 19:04 . 2004-08-03 23:10 38,016 --a------ C:\WINDOWS\system32\drivers\bthmodem.sys
2008-03-17 19:04 . 2004-08-03 23:10 38,016 --a–c— C:\WINDOWS\system32\dllcache\bthmodem.sys
2008-03-16 10:19 . 2008-03-16 10:19
2008-03-16 10:19 . 2008-03-16 10:21
2008-03-14 18:48 . 2008-03-14 18:48 1,188,375 --a------ C:\WINDOWS\system32\libeay32.dll
2008-03-14 18:48 . 2008-03-14 18:48 741,632 --a------ C:\WINDOWS\system32\pjsadobb.dat
2008-03-14 18:48 . 2008-03-14 18:48 246,545 --a------ C:\WINDOWS\system32\libssl32.dll
2008-03-14 18:48 . 2008-03-14 18:48 42,752 --a------ C:\WINDOWS\system32\aioafjqx.dat
2008-03-14 18:48 . 2008-03-14 18:48 36,608 --a------ C:\WINDOWS\system32\kthagrrt.dat
2008-03-14 18:48 . 2008-03-14 18:48 35,072 --a------ C:\WINDOWS\system32\rnsbxmxo.dat
2008-03-13 16:18 . 2008-03-13 16:18 120,576 --a------ C:\WINDOWS\system32\hvnlsgss.dat
2008-03-13 15:04 . 2008-03-13 15:07
2008-03-13 15:03 . 2008-03-22 15:25
2008-03-13 14:59 . 2008-03-13 15:00 3,072,054 --a------ C:\WINDOWS\FrameShow Wallpaper.BMP
2008-03-12 22:31 . 2008-03-24 11:06
2008-03-08 18:53 . 2008-03-08 18:53
2008-03-08 18:53 . 2008-03-08 18:53
2008-03-08 18:39 . 2008-03-08 18:48
2008-03-07 06:36 . 2008-03-23 13:45 116 --a------ C:\WINDOWS\NeroDigital.ini
2008-03-06 20:34 . 2008-03-24 10:36
2008-03-01 08:29 . 2008-03-24 09:55
2008-03-01 08:29 . 2008-03-01 08:29 32 --a------ C:\Documents and Settings\All Users\Dane aplikacji\ezsid.dat
2008-03-01 08:28 . 2008-03-01 08:28
2008-03-01 08:28 . 2008-03-01 08:28
2008-03-01 08:28 . 2008-03-24 11:06
2008-03-01 08:20 . 2008-03-24 10:41
2008-02-28 23:29 . 2008-02-28 23:29
2008-02-28 23:29 . 2007-05-02 15:17 94,208 --a------ C:\WINDOWS\system32\MGHwCtrl.dll
2008-02-28 23:29 . 2004-11-02 11:08 32,768 --a------ C:\WINDOWS\system32\MGFPCtrl.dll
2008-02-28 23:29 . 2006-11-06 10:02 24,576 --a------ C:\WINDOWS\system32\MGPwrShm.dll
2008-02-28 23:29 . 2000-11-12 22:39 24,576 --a------ C:\WINDOWS\system32\IdleTrac.dll
2008-02-28 23:29 . 2005-04-28 15:35 23,040 --a------ C:\WINDOWS\system32\MGFPMCE.dll
2008-02-28 23:29 . 2006-07-03 10:31 9,088 --a------ C:\WINDOWS\system32\drivers\MGHwCtrl.sys
2008-02-28 22:58 . 2008-02-28 22:58
2008-02-28 22:57 . 2008-02-28 22:57
2008-02-28 22:57 . 2007-12-24 13:49 7,680 --a------ C:\WINDOWS\system32\ff_vfw.dll
2008-02-28 22:57 . 2007-07-10 17:10 547 --a------ C:\WINDOWS\system32\ff_vfw.dll.manifest
2008-02-28 22:52 . 2008-03-01 08:28
2008-02-28 22:50 . 2008-02-28 22:50
2008-02-28 22:49 . 2008-02-28 22:49
2008-02-28 22:49 . 2008-02-28 22:51
2008-02-28 22:38 . 2008-02-28 22:38
2008-02-28 22:38 . 2008-02-22 02:33 69,632 --a------ C:\WINDOWS\system32\javacpl.cpl
2008-02-28 22:37 . 2008-03-10 06:01
2008-02-28 22:36 . 2008-02-28 22:36
2008-02-28 22:27 . 2008-02-28 22:27
2008-02-28 22:17 . 2008-02-28 22:56
2008-02-28 22:17 . 2008-02-28 22:56
2008-02-28 22:15 . 2008-02-28 22:15
2008-02-28 22:15 . 2008-02-28 22:16
2008-02-28 22:15 . 2004-08-03 22:14 359,040 --a------ C:\WINDOWS\system32\drivers\tcpip.sys.flg
2008-02-28 22:14 . 2008-02-28 22:14
2008-02-28 22:14 . 2008-03-24 11:02
2008-02-28 22:13 . 2008-02-28 22:13
2008-02-28 22:13 . 2008-02-28 22:13
2008-02-28 22:12 . 2008-02-28 22:12
2008-02-28 21:42 . 2008-03-24 10:56
2008-02-28 21:38 . 2008-02-28 21:38 512,096 --a------ C:\WINDOWS\system32\drivers\amon.sys
2008-02-28 21:38 . 2008-02-28 21:38 298,104 --a------ C:\WINDOWS\system32\imon.dll
2008-02-28 21:38 . 2008-02-28 21:38 15,424 --a------ C:\WINDOWS\system32\drivers\nod32drv.sys
2008-02-28 21:37 . 2008-03-13 20:53
2008-02-28 21:28 . 2007-04-05 15:19 546,112 -ra------ C:\WINDOWS\system32\drivers\ar5211.sys
2008-02-28 21:27 . 2007-02-07 08:43 90,880 -ra------ C:\WINDOWS\system32\drivers\Rtenicxp.sys
2008-02-28 21:18 . 2008-02-28 21:18
2008-02-28 21:18 . 2008-02-28 21:18
2008-02-28 21:18 . 2008-02-28 21:18
2008-02-28 21:18 . 2008-02-28 21:18
2008-02-28 21:18 . 2008-03-17 20:51 356,352 --a------ C:\WINDOWS\system32\AegisI5Installer.exe
2008-02-28 21:17 . 2008-02-28 21:17
2008-02-28 21:13 . 2008-02-28 21:13
2008-02-28 21:12 . 2008-02-28 21:12
2008-02-28 21:12 . 2008-02-28 21:12
2008-02-28 21:12 . 2007-04-03 10:04 39,680 --a------ C:\WINDOWS\system32\drivers\o2media.sys
2008-02-28 21:12 . 2007-04-02 16:11 35,712 --a------ C:\WINDOWS\system32\drivers\o2sd.sys
2008-02-28 21:10 . 2008-02-28 21:10 940,794 --a------ C:\WINDOWS\system32\LoopyMusic.wav
2008-02-28 21:10 . 2007-02-26 03:36 180,224 -ra------ C:\WINDOWS\system32\igfxres.dll
2008-02-28 21:10 . 2008-02-28 21:10 146,650 --a------ C:\WINDOWS\system32\BuzzingBee.wav
2008-02-28 21:08 . 2008-02-28 21:08
2008-02-28 21:07 . 2008-02-28 21:07
2008-02-28 21:06 . 2008-02-28 21:13
2008-02-28 21:06 . 2008-02-28 23:29
2008-02-28 21:06 . 2008-02-28 21:06
2008-02-28 21:03 . 2008-02-28 21:03
2008-02-28 21:03 . 2005-05-02 05:10 68,096 --------- C:\WINDOWS\system32\agrsmdel.exe
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-03-08 17:39 499,712 ----a-w C:\WINDOWS\system32\msvcp71.dll
2008-03-08 17:39 348,160 ----a-w C:\WINDOWS\system32\msvcr71.dll
2008-03-05 15:03 479,752 ----a-w C:\WINDOWS\system32\XAudio2_0.dll
2008-03-05 15:03 238,088 ----a-w C:\WINDOWS\system32\xactengine3_0.dll
2008-03-05 15:00 25,608 ----a-w C:\WINDOWS\system32\X3DAudio1_3.dll
2008-03-05 14:56 3,786,760 ----a-w C:\WINDOWS\system32\D3DX9_37.dll
2008-03-05 14:56 1,420,824 ----a-w C:\WINDOWS\system32\D3DCompiler_37.dll
2008-02-28 21:12 --------- d-----w C:\Program Files\totalcmd
2008-02-28 20:06 315,392 ----a-w C:\WINDOWS\HideWin.exe
2008-02-28 19:16 --------- d-----w C:\Documents and Settings\Natalka_\Dane aplikacji\AdobeUM
2008-02-28 19:15 --------- d-----w C:\Program Files\Common Files\Adobe
2008-02-28 18:59 --------- d-----w C:\Program Files\microsoft frontpage
2008-02-28 18:58 --------- d-----w C:\Program Files\Usługi online
2008-02-05 22:07 462,864 ----a-w C:\WINDOWS\system32\d3dx10_37.dll
.
------- Sigcheck -------
2004-08-03 22:14 359040 9f4b36614a0fc234525ba224957de55c C:\WINDOWS\system32\dllcache\tcpip.sys
2004-08-03 22:14 359040 6a603809f598332dbedd535bdbce313e C:\WINDOWS\system32\drivers\tcpip.sys
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
“CTFMON.EXE”=“C:\WINDOWS\system32\ctfmon.exe” [2004-08-03 23:44 15360]
“Gadu-Gadu”=“C:\Program Files\Gadu-Gadu\gg.exe” [2007-11-14 11:54 2131392]
“Skype”=“C:\Program Files\Skype\Phone\Skype.exe” [2007-12-12 15:25 21686568]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
“RTHDCPL”=“RTHDCPL.EXE” [2007-06-13 22:49 16377344 C:\WINDOWS\RTHDCPL.exe]
“AGRSMMSG”=“AGRSMMSG.exe” [2006-06-29 06:32 89541 C:\WINDOWS\AGRSMMSG.exe]
“IgfxTray”=“C:\WINDOWS\system32\igfxtray.exe” [2007-02-26 03:34 131072]
“HotKeysCmds”=“C:\WINDOWS\system32\hkcmd.exe” [2007-02-26 03:34 155648]
“Persistence”=“C:\WINDOWS\system32\igfxpers.exe” [2007-02-26 03:33 131072]
“nod32kui”=“C:\Program Files\Eset\nod32kui.exe” [2008-02-28 21:38 949376]
“SunJavaUpdateSched”=“C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe” [2008-02-22 04:25 144784]
“NeroFilterCheck”=“C:\WINDOWS\system32\NeroCheck.exe” [2001-07-09 10:50 155648]
“MGSysCtrl”=“C:\Program Files\System Control Manager\MGSysCtrl.exe” [2007-06-20 11:11 180736]
[HKEY_USERS.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
“CTFMON.EXE”=“C:\WINDOWS\system32\CTFMON.EXE” [2004-08-03 23:44 15360]
[HKLM~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
“%windir%\system32\sessmgr.exe”=
“C:\Program Files\FlashGet\flashget.exe”=
“C:\Program Files\Gadu-Gadu\gg.exe”=
“C:\Program Files\Skype\Phone\Skype.exe”=
“C:\Program Files\DC++\DCPlusPlus.exe”=
R0 O2MDRDR;O2MDRDR;C:\WINDOWS\system32\DRIVERS\o2media.sys [2007-04-03 10:04]
R0 O2SDRDR;O2SDRDR;C:\WINDOWS\system32\DRIVERS\o2sd.sys [2007-04-02 16:11]
R2 NishService;SCM Driver Daemon;C:\Program Files\System Control Manager\edd.exe [2006-03-22 11:07]
R3 MGHwCtrl;MGHwCtrl;C:\WINDOWS\system32\drivers\MGHwCtrl.sys [2006-07-03 10:31]
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
xgvovciu
.
**************************************************************************
catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-03-24 11:07:11
Windows 5.1.2600 Dodatek Service Pack 2 NTFS
scanning hidden processes …
scanning hidden autostart entries …
scanning hidden files …
scan completed successfully
hidden files: 0
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
PROCESS: C:\WINDOWS\system32\lsass.exe
- C:\Program Files\Eset\pr_imon.dll
Jak dla mnie to log czysty.
myszka007 Zasady wklejania logów na forum http://forum.dobreprogramy.pl/viewtopic.php?f=16&t=213350 .
Pytanie do Specjalisty Czy to jest Okey ?
.
Pozdrawiam , zastosuj się do tych tematów Zasady wklejania logów na forum http://forum.dobreprogramy.pl/viewtopic.php?f=16&t=213350 , Ważny komunikat dotyczący tytułowania tematów http://forum.dobreprogramy.pl/viewtopic.php?f=16&t=66889 , inaczej post może wylądować w Koszu.