Trojan patched - wklejam loga , prosze o pomoc

[gardenowa]

witam, po dzisiejszej aktualizacji bazy wirusow- mam avasta, ciagle milam komunikat ze mam wirusa trojan patched dl

wklejam loga z hijacka, chcialam tez z comofixa ale nie moge bo ciagle mi pisze ze … has expired i to z kazda wersja jaka znajde na necie

Logfile of HijackThis v1.99.1 Scan saved at 13:44:03, on 2007-11-18 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe E:\Program Files\BearShare\BearShare.exe C:\Program Files\QuickTime\qttask.exe C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\crypserv.exe C:\Program Files\ewido anti-malware\ewidoctrl.exe C:\Program Files\Common Files\LightScribe\LSSrvc.exe C:\Program Files\Cyberlink\Shared Files\RichVideo.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe C:\WINDOWS\system32\wuauclt.exe C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\explorer.exe C:\Program Files\NAPI-PROJEKT\napisy.exe C:\Program Files\Tlen.pl\tlen.exe C:\Program Files\Mozilla Firefox\firefox.exe E:\wszystko\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://onet.pl/ R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O4 - HKLM…\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM…\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd O4 - HKLM…\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe O4 - HKLM…\Run: [HP Software Update] “C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe” O4 - HKLM…\Run: [RemoteControl] “C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe” O4 - HKLM…\Run: [LanguageShortcut] E:\Language\Language.exe O4 - HKLM…\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe O4 - HKLM…\Run: [RapidLeecher] C:\Program Files\RapidLeecher\RapidLeecher.exe /M O4 - HKLM…\Run: [bearShare] “E:\Program Files\BearShare\BearShare.exe” /pause O4 - HKLM…\Run: [iSUSPM] “C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe” -scheduler O4 - HKLM…\Run: [QuickTime Task] “C:\Program Files\QuickTime\qttask.exe” -atboottime O4 - HKCU…\Run: [updateMgr] “C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe” AcRdB7_0_9 -reboot 1 O4 - HKCU…\Run: [bgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] “C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe” O4 - HKCU…\Run: [bitComet] “C:\Program Files\BitComet\BitComet.exe” /tray O4 - Startup: Mopy Points Collector.lnk = C:\MOPYFISH\GETPOINT.EXE O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~1\Office10\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra ‘Tools’ menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra ‘Tools’ menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing) O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing) O23 - Service: Crypkey License - Unknown owner - C:\WINDOWS\SYSTEM32\crypserv.exe O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\Cyberlink\Shared Files\RichVideo.exe

[popula]

Spróbuj pobrać TEGO ComboFix’a (na dole strony).

[gardenowa]

Spróbuj pobrać TEGO ComboFix’a (na dole strony).

nie da rady to samo, sciagnelam deckards

oto wynik

Deckard’s System Scanner v20071014.68 Run by Administrator on 2007-11-18 14:23:50 Computer is in Normal Mode. -------------------------------------------------------------------------------- – System Restore -------------------------------------------------------------- Successfully created a Deckard’s System Scanner Restore Point. – Last 2 Restore Point(s) – 2: 2007-11-18 13:24:01 UTC - RP363 - Deckard’s System Scanner Restore Point 1: 2007-11-18 13:22:45 UTC - RP362 - Punkt kontrolny systemu Backed up registry hives. Performed disk cleanup. System Drive C: has 0.59 GiB (less than 15%) free. – HijackThis (run as Administrator.exe) --------------------------------------- Logfile of HijackThis v1.99.1 Scan saved at 14:25:35, on 2007-11-18 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe E:\Program Files\BearShare\BearShare.exe C:\Program Files\QuickTime\qttask.exe C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\crypserv.exe C:\Program Files\ewido anti-malware\ewidoctrl.exe C:\Program Files\Common Files\LightScribe\LSSrvc.exe C:\Program Files\Cyberlink\Shared Files\RichVideo.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe C:\WINDOWS\system32\wuauclt.exe C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\explorer.exe C:\Program Files\NAPI-PROJEKT\napisy.exe C:\Program Files\Tlen.pl\tlen.exe C:\Documents and Settings\Administrator\Pulpit\dss.exe E:\wszystko\Administrator.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://onet.pl/ R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O4 - HKLM…\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM…\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd O4 - HKLM…\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe O4 - HKLM…\Run: [HP Software Update] “C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe” O4 - HKLM…\Run: [RemoteControl] “C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe” O4 - HKLM…\Run: [LanguageShortcut] E:\Language\Language.exe O4 - HKLM…\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe O4 - HKLM…\Run: [RapidLeecher] C:\Program Files\RapidLeecher\RapidLeecher.exe /M O4 - HKLM…\Run: [bearShare] “E:\Program Files\BearShare\BearShare.exe” /pause O4 - HKLM…\Run: [iSUSPM] “C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe” -scheduler O4 - HKLM…\Run: [QuickTime Task] “C:\Program Files\QuickTime\qttask.exe” -atboottime O4 - HKCU…\Run: [updateMgr] “C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe” AcRdB7_0_9 -reboot 1 O4 - HKCU…\Run: [bgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] “C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe” O4 - HKCU…\Run: [bitComet] “C:\Program Files\BitComet\BitComet.exe” /tray O4 - Startup: Mopy Points Collector.lnk = C:\MOPYFISH\GETPOINT.EXE O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~1\Office10\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra ‘Tools’ menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra ‘Tools’ menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing) O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing) O23 - Service: Crypkey License - Unknown owner - C:\WINDOWS\SYSTEM32\crypserv.exe O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\Cyberlink\Shared Files\RichVideo.exe – HijackThis Fixed Entries (E:\wszystko\backups) ----------------------------- backup-20050921-214714-573 O16 - DPF: {15AD6789-CDB4-47E1-A9DA-992EE8E6BAD6} - http://static.windupdates.com/cab/Media … e-c282.cab backup-20050921-214715-453 O16 - DPF: {17D72920-7A15-11D4-921E-0080C8DA7A5E} (AimSp32 Class) - http://rimmel.ai-media.com/save/makeover.cab backup-20051020-210658-498 O2 - BHO: Internet Explorer Web Content Guard - {1B77D30A-81C9-497A-8647-142F7511B1FB} - C:\WINDOWS\System32\strwxcd.dll backup-20051020-210658-306 O4 - HKCU…\Run: [Microsoft Update] tclt32.exe backup-20051215-220005-903 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.netpede.com/ backup-20051215-220005-883 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.netpede.com/ backup-20051215-220005-663 O4 - HKLM…\Run: [userinit] C:\Program Files\Common Files\system\lsass.exe backup-20051215-220005-872 O4 - Global Startup: KVG.exe backup-20051222-202558-367 O4 - Global Startup: KVG.exe backup-20051224-101311-808 O4 - Global Startup: KVG.exe backup-20060101-171727-571 R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = c:\secure32.html backup-20060101-171727-114 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = c:\secure32.html backup-20060101-171727-894 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = c:\secure32.html backup-20060101-171727-289 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = c:\secure32.html backup-20060101-171727-104 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = c:\secure32.html backup-20060101-171727-926 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = c:\secure32.html backup-20060101-171727-193 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza backup-20060101-171727-392 O4 - HKLM…\Run: [PayTime] C:\WINDOWS\System32\paytime.exe backup-20060101-171727-136 O4 - HKLM…\Run: [NI.UWFX5_0001_N57M2112] “C:\DOCUME~1\AGNIES~1\USTAWI~1\Temp\5.tmp” -nag backup-20060101-171727-873 O4 - HKCU…\Run: [PayTime] C:\WINDOWS\System32\paytime.exe backup-20060101-171727-397 O4 - HKCU…\Run: [aupd] C:\WINDOWS\System32\sywsvcs.exe backup-20060101-171727-827 O4 - Global Startup: KVG.exe backup-20060101-171727-635 O20 - Winlogon Notify: avpe32 - C:\WINDOWS\SYSTEM32\avpe32.dll backup-20060109-190308-632 O4 - Global Startup: KVG.exe backup-20060514-202904-692 O2 - BHO: Internet Explorer Web Content Guard - {1B77D30A-81C9-497A-8647-142F7511B1FB} - C:\WINDOWS\System32\strwxcd.dll backup-20060514-202904-871 O4 - HKLM…\Run: [WhenUSearchWHSE] “C:\Program Files\WhenUSearch\whse.exe” backup-20060514-202904-266 O4 - HKCU…\Run: [WhenUSave] “C:\Program Files\Save\Save.exe” backup-20060514-202904-903 O9 - Extra button: (no name) - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - (no file) backup-20060514-202905-411 O20 - Winlogon Notify: WRNotifier - WRLogonNTF.dll (file missing) backup-20060929-212727-338 O4 - Startup: PowerReg Scheduler.exe backup-20061118-222238-319 O20 - Winlogon Notify: rpcc - C:\WINDOWS\system32\rpcc.dll backup-20061118-225712-830 O4 - HKLM…\Run: [bearShare] “C:\Program Files\BearShare\BearShare.exe” /pause backup-20061118-225712-825 O4 - HKLM…\Run: [Windows Update Notifier] “C:\WINDOWS\system32\winalert.exe” backup-20061118-225712-221 O4 - HKCU…\Run: [Regscan] C:\WINDOWS\system32\regscan.exe backup-20061118-225712-857 O4 - Startup: PowerReg Scheduler.exe backup-20061118-225718-421 O21 - SSODL: CsdProvider - {523455E4-ABCD-ABCD-1114-D709ADD3DDAB} - C:\WINDOWS\system32\CsdProvider.dll (file missing) backup-20061118-225812-793 O20 - Winlogon Notify: rpcc - C:\WINDOWS\system32\rpcc.dll (file missing) backup-20070208-220953-947 R1 - HKCU\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://search.bearshare.com/sidebar.html?src=ssb backup-20070208-220954-791 R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://search.bearshare.com/sidebar.html?src=ssb backup-20070208-220954-186 R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://search.bearshare.com/sidebar.html?src=ssb backup-20070208-220954-686 R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://search.bearshare.com/sidebar.html?src=ssb backup-20070208-220954-180 R3 - URLSearchHook: (no name) - {00A6FAF6-072E-44cf-8957-5838F569A31D} - C:\Program Files\MyWebSearch\SrchAstt\2.bin\MWSSRCAS.DLL backup-20070208-220954-556 O2 - BHO: MyWebSearch Search Assistant BHO - {00A6FAF1-072E-44cf-8957-5838F569A31D} - C:\Program Files\MyWebSearch\SrchAstt\2.bin\MWSSRCAS.DLL backup-20070208-220957-582 O2 - BHO: mwsBar BHO - {07B18EA1-A523-4961-B6BB-170DE4475CCA} - C:\Program Files\MyWebSearch\bar\2.bin\MWSBAR.DLL backup-20070208-220959-924 O2 - BHO: My Global Search Bar BHO - {37B85A21-692B-4205-9CAD-2626E4993404} - C:\Program Files\MyGlobalSearch\bar\3.bin\MGSBAR.DLL backup-20070208-220959-712 O3 - Toolbar: My &Web Search - {07B18EA9-A523-4961-B6BB-170DE4475CCA} - C:\Program Files\MyWebSearch\bar\2.bin\MWSBAR.DLL backup-20070208-220959-813 O3 - Toolbar: My Global Search Bar - {37B85A29-692B-4205-9CAD-2626E4993404} - C:\Program Files\MyGlobalSearch\bar\3.bin\MGSBAR.DLL backup-20070208-220959-336 O4 - HKLM…\Run: [My Web Search Bar] rundll32 C:\PROGRA~1\MYWEBS~1\bar\2.bin\MWSBAR.DLL,S backup-20070208-220959-766 O4 - Startup: PowerReg Scheduler.exe backup-20070208-221000-794 O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/toolbaredi … jhtml?p=ZJ – File Associations ----------------------------------------------------------- .cpl - cplfile - shell\cplopen\command - rundll32.exe shell32.dll,Control_RunDLL “%1”,%* .cpl - cplfile - shell\runas\command - rundll32.exe shell32.dll,Control_RunDLLAsUser “%1”,%* – Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------- R1 ewido security suite driver - c:\program files\ewido anti-malware\guard.sys R1 NetworkX - c:\windows\system32\ckldrv.sys R1 VIAPFD - c:\windows\system32\drivers\viapfd.sys S1 EXAMPLE - c:\windows\system32\main.sys (file missing) S3 cmuda (C-Media WDM Audio Interface) - c:\windows\system32\drivers\cmuda.sys S3 Ip6Fw (Sterownik Zapory systemu Windows IPv6) - c:\windows\system32\drivers\ip6fw.sys (file missing) S3 Runtime - c:\windows\system32\drivers\runtime.sys (file missing) S3 ssm_bus (Samsung Mobile USB Device II 1.0 driver (WDM)) - c:\windows\system32\drivers\ssm_bus.sys S3 ssm_mdfl (Samsung Mobile USB Modem II 1.0 Filter) - c:\windows\system32\drivers\ssm_mdfl.sys S3 ssm_mdm (Samsung Mobile USB Modem II 1.0 Drivers) - c:\windows\system32\drivers\ssm_mdm.sys – Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled -------------------- R2 Crypkey License - crypserv.exe R3 NMIndexingService - “c:\program files\common files\ahead\lib\nmindexingservice.exe” S4 ewido security suite guard - c:\program files\ewido anti-malware\ewidoguard.exe – Device Manager: Disabled ---------------------------------------------------- No disabled devices found. – Scheduled Tasks ------------------------------------------------------------- 2007-11-12 17:20:02 284 --a------ C:\WINDOWS\Tasks\AppleSoftwareUpdate.job – Files created between 2007-10-18 and 2007-11-18 ----------------------------- 2007-11-18 10:59:48 0 d-------- C:\Program Files\Bullfrog 2007-11-07 18:09:24 0 d–hs---- C:\FOUND.000 2007-11-03 23:46:22 0 d-------- C:\CD1 2007-10-30 19:36:13 0 d-------- C:\Downloads 2007-10-30 19:35:55 0 d-------- C:\Program Files\BitComet 2007-10-28 21:41:32 0 d-------- C:\Program Files\Hair Pro 2006 Light 2007-10-24 21:16:30 217088 --a------ C:\WINDOWS\system32\yv12vfw.dll http://www.helixcommunity.org; Helix YV12 YUV Codec> 2007-10-24 21:16:27 3596288 --a------ C:\WINDOWS\system32\qt-dx331.dll 2007-10-24 21:16:26 81920 --a------ C:\WINDOWS\system32\dpl100.dll 2007-10-24 21:16:23 7680 --a------ C:\WINDOWS\system32\ff_vfw.dll 2007-10-24 21:16:18 0 d-------- C:\Program Files\K-Lite Codec Pack 2007-10-20 06:32:55 0 d-------- C:\Program Files\CyberLink DVD Solution 2007-10-19 20:28:01 40960 --a------ C:\Program Files\Uninstall_CDS.exe – Find3M Report --------------------------------------------------------------- 2007-10-24 21:39:28 0 d-------- C:\Documents and Settings\Administrator\Dane aplikacji\Media Player Classic 2007-10-08 21:23:48 0 d-------- C:\Program Files\DX-Ball 2007-09-28 18:05:40 739840 --a------ C:\WINDOWS\system32\divx.dll 2007-09-14 07:02:10 545 --a------ C:\WINDOWS\UC.PIF 2007-09-14 07:02:10 545 --a------ C:\WINDOWS\RAR.PIF 2007-09-14 07:02:10 545 --a------ C:\WINDOWS\PKZIP.PIF 2007-09-14 07:02:10 545 --a------ C:\WINDOWS\PKUNZIP.PIF 2007-09-14 07:02:10 545 --a------ C:\WINDOWS\NOCLOSE.PIF 2007-09-14 07:02:10 545 --a------ C:\WINDOWS\LHA.PIF 2007-09-14 07:02:10 545 --a------ C:\WINDOWS\ARJ.PIF 2007-09-07 18:55:48 32 --a------ C:\WINDOWS\hip 2007-09-04 18:56:10 164352 --a------ C:\WINDOWS\system32\unrar.dll 2007-09-01 16:08:06 32 --a------ C:\WINDOWS\go 2007-08-26 12:02:44 0 --a------ C:\Documents and Settings\Administrator\Dane aplikacji\AVSDVDPlayer.m3u 2007-08-26 11:24:46 73216 --a------ C:\WINDOWS\ST6UNST.EXE – Registry Dump --------------------------------------------------------------- *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “avast!”=“C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe” [2007-09-06 12:06] “Cmaudio”=“cmicnfg.cpl” [] “WinampAgent”=“C:\Program Files\Winamp\winampa.exe” [] “HP Software Update”=“C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe” [] “RemoteControl”=“C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe” [2004-11-02 20:24] “LanguageShortcut”=“E:\Language\Language.exe” [2007-01-08 22:17] “NeroFilterCheck”=“C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe” [2006-01-12 15:40] “RapidLeecher”=“C:\Program Files\RapidLeecher\RapidLeecher.exe” [] “BearShare”=“E:\Program Files\BearShare\BearShare.exe” [2006-08-01 17:04] “ISUSPM”=“C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe” [] “QuickTime Task”=“C:\Program Files\QuickTime\qttask.exe” [2006-09-01 15:57] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “updateMgr”=“C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe” [2006-03-30 16:45] “BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}”=“C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe” [2006-12-23 18:05] “BitComet”=“C:\Program Files\BitComet\BitComet.exe” [] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer] “ForceClassicControlPanel”=1 (0x1) [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2{0d9f1e10-32b4-11dc-80f3-806d6172696f}] AutoRun\command- F:\autorun.exe – End of Deckard’s System Scanner: finished at 2007-11-18 14:26:07 ------------

[Gutek]

Prawoklik na Mój Komputer>>Przywracanie systemu>> wyłącz przywracanie systemu na wszystkich dyskach.