Trojan.Rootkit-15 nie daje się usunąć

Voidan · 16 Luty 2007 00:34

Witam!

MKS online skaner znalazł trojana o nazwie cel90xbe

Niestety nie był w stanie go usunąć. Podobnie mój avast. Trojan zainstalował się jako plik systemowy. Nie daje się usunąć ręcznie (plik chroniony lub aktualnie używany - odmowa dostępu). Próbowałem usunąć go przy restarcie za pomocą Killboxa oraz Hijackthis. Nie dały rady ani w zwykłym trybie, ani w awaryjnym :evil: :evil: :evil:

Jakieś sugestie? I czy potrzebne logi?

Pozdrawiam.

Ryba969 · 16 Luty 2007 09:04

Logi koniecznie z HJT+ Silent runners opis: http://forum.dobreprogramy.pl/viewtopic.php?t=36654

Voidan · 16 Luty 2007 14:57

HijackThis:

Logfile of HijackThis v1.99.1 Scan saved at 14:18:43, on 2007-02-16 Platform: Windows XP (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2600.0000) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\LEXBCES.EXE C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\LEXPPS.EXE C:\Program Files\MKS\Bin\mks_menu.exe C:\Program Files\MKS\Bin\ABregmon.exe C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\Program Files\Gadu-Gadu\gg.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe C:\WINDOWS\System32\nvsvc32.exe C:\WINDOWS\System32\wdfmgr.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\WINDOWS\System32\wuauclt.exe C:\WINDOWS\System32\services.exe C:\WINDOWS\System32\services.exe C:\WINDOWS\System32\services.exe C:\Program Files\Avant Browser\avant.exe C:\Program Files\Adobe\Acrobat 7.0\Reader\AcroRd32.exe C:\WINDOWS\System32\WScript.exe d:\Moje dokumenty\Przemek\Antyviry\hijackthis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll O4 - HKLM…\Run: [MKS_MENU] C:\Program Files\MKS\Bin\mks_menu.exe O4 - HKLM…\Run: [ABREGMON] C:\Program Files\MKS\Bin\ABregmon.exe O4 - HKLM…\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup O4 - HKLM…\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKCU…\Run: [Gadu-Gadu] “C:\Program Files\Gadu-Gadu\gg.exe” /tray O8 - Extra context menu item: Blokuj wszystkie obrazy z tego serwera - C:\Program Files\Avant Browser\AddAllToADBlackList.htm O8 - Extra context menu item: Dodaj do listy blokowanych reklam - C:\Program Files\Avant Browser\AddToADBlackList.htm O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O8 - Extra context menu item: Otwórz w nowym Avant Browser - C:\Program Files\Avant Browser\OpenInNewBrowser.htm O8 - Extra context menu item: Otwórz wszystkie adresy z tej strony… - C:\Program Files\Avant Browser\OpenAllLinks.htm O8 - Extra context menu item: Podświetl - C:\Program Files\Avant Browser\Highlight.htm O8 - Extra context menu item: Szukaj - C:\Program Files\Avant Browser\Search.htm O12 - Plugin for .mid: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin2.dll O12 - Plugin for .mov: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin.dll O12 - Plugin for .mpg: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin3.dll O16 - DPF: {68282C51-9459-467B-95BF-3C0E89627E55} (MksSkanerOnline Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing) O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe

Silent Runners:

“Silent Runners.vbs”, revision 48, http://www.silentrunners.org/ Operating System: Windows XP Output limited to non-default values, except where indicated by “{++}” Startup items buried in registry: --------------------------------- HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++} “Gadu-Gadu” = ““C:\Program Files\Gadu-Gadu\gg.exe” /tray” [“Gadu-Gadu S.A.”] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++} “MKS_MENU” = “C:\Program Files\MKS\Bin\mks_menu.exe” [“MKS Sp. z o.o.”] “ABREGMON” = “C:\Program Files\MKS\Bin\ABregmon.exe” [“ArcaBit”] “NvCplDaemon” = “RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup” [MS] “avast!” = “C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe” [null data] HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}(Default) = (no title provided) -> {HKLM…CLSID} = “Adobe PDF Reader Link Helper” \InProcServer32(Default) = “C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll” [“Adobe Systems Incorporated”] {761497BB-D6F0-462C-B6EB-D4DAF1D92D43}(Default) = (no title provided) -> {HKLM…CLSID} = “SSVHelper Class” \InProcServer32(Default) = “C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll” [“Sun Microsystems, Inc.”] {AA58ED58-01DD-4d91-8333-CF10577473F7}(Default) = (no title provided) -> {HKLM…CLSID} = “Google Toolbar Helper” \InProcServer32(Default) = “c:\program files\google\googletoolbar3.dll” [“Google Inc.”] HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\ “{42071714-76d4-11d1-8b24-00a0c9068ff3}” = “Rozszerzenie CPL kadrowania wyświetlania” -> {HKLM…CLSID} = “Rozszerzenie CPL kadrowania wyświetlania” \InProcServer32(Default) = “deskpan.dll” [file not found] “{88895560-9AA2-1069-930E-00AA0030EBC8}” = “Rozszerzenie ikony HyperTerminalu” -> {HKLM…CLSID} = “HyperTerminal Icon Ext” \InProcServer32(Default) = “C:\WINDOWS\System32\hticons.dll” [“Hilgraeve, Inc.”] “{0006F045-0000-0000-C000-000000000046}” = “Microsoft Outlook Custom Icon Handler” -> {HKLM…CLSID} = “Rozszerzenie ikon plików programu Outlook” \InProcServer32(Default) = “C:\Program Files\Microsoft Office\Office10\OLKFSTUB.DLL” [MS] “{42042206-2D85-11D3-8CFF-005004838597}” = “Microsoft Office HTML Icon Handler” -> {HKLM…CLSID} = (no title provided) \InProcServer32(Default) = “C:\Program Files\Microsoft Office\Office10\msohev.dll” [MS] “{0A082D00-EC93-11D0-B1E6-80580BC10627}” = “Corel Media Folder Root Menu Handler” -> {HKLM…CLSID} = “Corel Media Folder Root Menu Handler” \InProcServer32(Default) = “C:\Corel\Graphics8\programs\CMFFld80.dll” [empty string] “{0FBF99C1-4127-11D1-B1E6-C17E96D9180A}” = “Folder To Corel Media Folder Menu Handler” -> {HKLM…CLSID} = “Folder To Corel Media Folder Menu Handler” \InProcServer32(Default) = “C:\Corel\Graphics8\programs\CMFFld80.dll” [empty string] “{854AF161-1AE1-11D1-AB9B-00C0F00683EB}” = “Corel Media Folder” -> {HKLM…CLSID} = “Corel Media Folder” \InProcServer32(Default) = “C:\Corel\Graphics8\programs\CMFFld80.dll” [empty string] “{E856F161-1AE5-11d1-AB9B-00C0F00683EB}” = “Corel Media Folder” -> {HKLM…CLSID} = “Corel Media Folder” \InProcServer32(Default) = “C:\Corel\Graphics8\programs\CMFFld80.dll” [empty string] “{CDB89701-262F-11D1-AB9C-00C0F00683EB}” = “Corel Media Find Folder” -> {HKLM…CLSID} = “Corel Media Find Folder” \InProcServer32(Default) = “C:\Corel\Graphics8\programs\CMFFld80.dll” [empty string] “{F8152501-455F-11D1-B1E6-444553540000}” = “Corel Media Folder Copy Hook Handler” -> {HKLM…CLSID} = “Corel Media Folder Copy Hook Handler” \InProcServer32(Default) = “C:\Corel\Graphics8\programs\CMFFld80.dll” [empty string] “{8E524B0D-04F0-11D1-B74A-00A0C90646A4}” = “IconFactTemp.NSIconHandlerFactory” -> {HKLM…CLSID} = (no title provided) \InProcServer32(Default) = “C:\Corel\Graphics8\programs\CNSFlt80.dll” [“Corel Corporation”] “{A2AC368A-F883-11D0-B745-00A0C90646A4}” = “NSFiltManDll.FiltManCom” -> {HKLM…CLSID} = (no title provided) \InProcServer32(Default) = “C:\Corel\Graphics8\programs\CNSFlt80.dll” [“Corel Corporation”] “{B63FCD5A-2396-11D1-B762-00A0C90646A4}” = “*d” (unwritable string) -> {HKLM…CLSID} = (no title provided) \InProcServer32(Default) = “C:\Corel\Graphics8\programs\CMFFnd80.dll” [“Corel Corporation”] “{E0D79304-84BE-11CE-9641-444553540000}” = “WinZip” -> {HKLM…CLSID} = “WinZip” \InProcServer32(Default) = “C:\PROGRA~1\WinZip\WZSHLSTB.DLL” [“WinZip Computing, Inc.”] “{E0D79305-84BE-11CE-9641-444553540000}” = “WinZip” -> {HKLM…CLSID} = “WinZip” \InProcServer32(Default) = “C:\PROGRA~1\WinZip\WZSHLSTB.DLL” [“WinZip Computing, Inc.”] “{E0D79306-84BE-11CE-9641-444553540000}” = “WinZip” -> {HKLM…CLSID} = “WinZip” \InProcServer32(Default) = “C:\PROGRA~1\WinZip\WZSHLSTB.DLL” [“WinZip Computing, Inc.”] “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” = “WinRAR shell extension” -> {HKLM…CLSID} = “WinRAR” \InProcServer32(Default) = “C:\Program Files\WinRAR\rarext.dll” [null data] “{1CDB2949-8F65-4355-8456-263E7C208A5D}” = “Desktop Explorer” -> {HKLM…CLSID} = “Desktop Explorer” \InProcServer32(Default) = “C:\WINDOWS\System32\nvshell.dll” [“NVIDIA Corporation”] “{1E9B04FB-F9E5-4718-997B-B8DA88302A47}” = “Desktop Explorer Menu” -> {HKLM…CLSID} = (no title provided) \InProcServer32(Default) = “C:\WINDOWS\System32\nvshell.dll” [“NVIDIA Corporation”] “{A70C977A-BF00-412C-90B7-034C51DA2439}” = “NvCpl DesktopContext Class” -> {HKLM…CLSID} = “DesktopContext Class” \InProcServer32(Default) = “C:\WINDOWS\System32\nvcpl.dll” [“NVIDIA Corporation”] “{1E9B04FB-F9E5-4718-997B-B8DA88302A48}” = “nView Desktop Context Menu” -> {HKLM…CLSID} = “nView Desktop Context Menu” \InProcServer32(Default) = “C:\WINDOWS\System32\nvshell.dll” [“NVIDIA Corporation”] “{FFB699E0-306A-11d3-8BD1-00104B6F7516}” = “Play on my TV helper” -> {HKLM…CLSID} = “NVIDIA CPL Extension” \InProcServer32(Default) = “C:\WINDOWS\System32\nvcpl.dll” [“NVIDIA Corporation”] “{640167b4-59b0-47a6-b335-a6b3c0695aea}” = “Portable Media Devices” -> {HKLM…CLSID} = “Portable Media Devices” \InProcServer32(Default) = “C:\WINDOWS\System32\Audiodev.dll” [MS] “{cc86590a-b60a-48e6-996b-41d25ed39a1e}” = “Portable Media Devices Menu” -> {HKLM…CLSID} = “Portable Media Devices Menu” \InProcServer32(Default) = “C:\WINDOWS\System32\Audiodev.dll” [MS] “{7C9D5882-CB4A-4090-96C8-430BFE8B795B}” = “Webroot Spy Sweeper Context Menu Integration” -> {HKLM…CLSID} = “Webroot Spy Sweeper Context Menu Integration” \InProcServer32(Default) = “C:\PROGRA~1\Webroot\SPYSWE~1\SSCtxMnu.dll” [file not found] “{472083B0-C522-11CF-8763-00608CC02F24}” = “avast” -> {HKLM…CLSID} = “avast” \InProcServer32(Default) = “C:\Program Files\Alwil Software\Avast4\ashShell.dll” [“ALWIL Software”] HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\ “System” = (value not set) HKLM\System\CurrentControlSet\Control\Session Manager\ INFECTION WARNING! “BootExecute” = “autocheck autochk * aswBoot.exe /M:d8ba10c85” [file not found], [MS], [file not found], [null data], [file not found] HKLM\Software\Classes\Folder\shellex\ColumnHandlers\ {F9DB5320-233E-11D1-9F84-707F02C10627}(Default) = “PDF Column Info” -> {HKLM…CLSID} = “PDF Shell Extension” \InProcServer32(Default) = “C:\Program Files\Adobe\Acrobat 7.0\ActiveX\PDFShell.dll” [“Adobe Systems, Inc.”] HKLM\Software\Classes*\shellex\ContextMenuHandlers\ avast(Default) = “{472083B0-C522-11CF-8763-00608CC02F24}” -> {HKLM…CLSID} = “avast” \InProcServer32(Default) = “C:\Program Files\Alwil Software\Avast4\ashShell.dll” [“ALWIL Software”] MkS_Vir(Default) = “{CC4245C0-D511-11D0-8918-444553540000}” -> {HKLM…CLSID} = “MkS_Vir Shell Extension” \InProcServer32(Default) = “C:\Program Files\MKS\Bin\MkSShell.dll” [null data] VersionsMenu(Default) = “{03170921-4754-11cf-AB9A-00C0F00683EB}” -> {HKLM…CLSID} = “Corel Versions” \InProcServer32(Default) = “C:\COREL\Versions\CVersion.dll” [“Corel Corporation Limited”] WinRAR(Default) = “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” -> {HKLM…CLSID} = “WinRAR” \InProcServer32(Default) = “C:\Program Files\WinRAR\rarext.dll” [null data] WinZip(Default) = “{E0D79304-84BE-11CE-9641-444553540000}” -> {HKLM…CLSID} = “WinZip” \InProcServer32(Default) = “C:\PROGRA~1\WinZip\WZSHLSTB.DLL” [“WinZip Computing, Inc.”] WS_FTP(Default) = “{797F3885-5429-11D4-8823-0050DA59922B}” -> {HKLM…CLSID} = “RtClkCtxMenu Class” \InProcServer32(Default) = “d:\Moje dokumenty\Przemek\My eBooks\Small niche system\Adsense pages\auto_hits_machine\Ipswitch\WS_FTP Professional\wsftpsi.dll” [“Ipswitch, Inc. 10 Maguire Road - Suite 220 Lexington, MA 02421”] HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\ FolderToCorelMediaFolder(Default) = “{0FBF99C1-4127-11D1-B1E6-C17E96D9180A}” -> {HKLM…CLSID} = “Folder To Corel Media Folder Menu Handler” \InProcServer32(Default) = “C:\Corel\Graphics8\programs\CMFFld80.dll” [empty string] WinRAR(Default) = “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” -> {HKLM…CLSID} = “WinRAR” \InProcServer32(Default) = “C:\Program Files\WinRAR\rarext.dll” [null data] WinZip(Default) = “{E0D79304-84BE-11CE-9641-444553540000}” -> {HKLM…CLSID} = “WinZip” \InProcServer32(Default) = “C:\PROGRA~1\WinZip\WZSHLSTB.DLL” [“WinZip Computing, Inc.”] HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\ avast(Default) = “{472083B0-C522-11CF-8763-00608CC02F24}” -> {HKLM…CLSID} = “avast” \InProcServer32(Default) = “C:\Program Files\Alwil Software\Avast4\ashShell.dll” [“ALWIL Software”] MkS_Vir(Default) = “{CC4245C0-D511-11D0-8918-444553540000}” -> {HKLM…CLSID} = “MkS_Vir Shell Extension” \InProcServer32(Default) = “C:\Program Files\MKS\Bin\MkSShell.dll” [null data] SpySweeper(Default) = “{7C9D5882-CB4A-4090-96C8-430BFE8B795B}” -> {HKLM…CLSID} = “Webroot Spy Sweeper Context Menu Integration” \InProcServer32(Default) = “C:\PROGRA~1\Webroot\SPYSWE~1\SSCtxMnu.dll” [file not found] VersionsMenu(Default) = “{03170921-4754-11cf-AB9A-00C0F00683EB}” -> {HKLM…CLSID} = “Corel Versions” \InProcServer32(Default) = “C:\COREL\Versions\CVersion.dll” [“Corel Corporation Limited”] WinRAR(Default) = “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” -> {HKLM…CLSID} = “WinRAR” \InProcServer32(Default) = “C:\Program Files\WinRAR\rarext.dll” [null data] WinZip(Default) = “{E0D79304-84BE-11CE-9641-444553540000}” -> {HKLM…CLSID} = “WinZip” \InProcServer32(Default) = “C:\PROGRA~1\WinZip\WZSHLSTB.DLL” [“WinZip Computing, Inc.”] WS_FTP(Default) = “{797F3885-5429-11D4-8823-0050DA59922B}” -> {HKLM…CLSID} = “RtClkCtxMenu Class” \InProcServer32(Default) = “d:\Moje dokumenty\Przemek\My eBooks\Small niche system\Adsense pages\auto_hits_machine\Ipswitch\WS_FTP Professional\wsftpsi.dll” [“Ipswitch, Inc. 10 Maguire Road - Suite 220 Lexington, MA 02421”] Active Desktop and Wallpaper: ----------------------------- Active Desktop is disabled at this entry: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState HKCU\Control Panel\Desktop\ “Wallpaper” = “C:\Documents and Settings\Przemek Sowa\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp” Enabled Screen Saver: --------------------- HKCU\Control Panel\Desktop\ “SCRNSAVE.EXE” = “C:\WINDOWS\System32\AVASTSS.scr” [“ALWIL Software”] Enabled Scheduled Tasks: ------------------------ “MkSUpdate” -> launches: “C:\Program Files\MKS\bin\mks_upd.exe Task” [“MkS Sp. z o. o.”] Winsock2 Service Provider DLLs: ------------------------------- Namespace Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++} 000000000001\LibraryPath = “%SystemRoot%\System32\mswsock.dll” [MS] 000000000002\LibraryPath = “%SystemRoot%\System32\winrnr.dll” [MS] 000000000003\LibraryPath = “%SystemRoot%\System32\mswsock.dll” [MS] Transport Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++} 0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range: %SystemRoot%\system32\mswsock.dll [MS], 01 - 03, 06 - 13 %SystemRoot%\system32\rsvpsp.dll [MS], 04 - 05 Toolbars, Explorer Bars, Extensions: ------------------------------------ Toolbars HKCU\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ “{2318C2B1-4965-11D4-9B18-009027A5CD4F}” -> {HKLM…CLSID} = “&Google” \InProcServer32(Default) = “c:\program files\google\googletoolbar3.dll” [“Google Inc.”] HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\ “{2318C2B1-4965-11D4-9B18-009027A5CD4F}” -> {HKLM…CLSID} = “&Google” \InProcServer32(Default) = “c:\program files\google\googletoolbar3.dll” [“Google Inc.”] HKLM\Software\Microsoft\Internet Explorer\Toolbar\ “{2318C2B1-4965-11D4-9B18-009027A5CD4F}” = (no title provided) -> {HKLM…CLSID} = “&Google” \InProcServer32(Default) = “c:\program files\google\googletoolbar3.dll” [“Google Inc.”] Running Services (Display Name, Service Name, Path {Service DLL}): ------------------------------------------------------------------ avast! Antivirus, avast! Antivirus, ““C:\Program Files\Alwil Software\Avast4\ashServ.exe”” [null data] avast! iAVS4 Control Service, aswUpdSv, ““C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe”” [null data] avast! Web Scanner, avast! Web Scanner, ““C:\Program Files\Alwil Software\Avast4\ashWebSv.exe” /service” [“ALWIL Software”] LexBce Server, LexBceS, “C:\WINDOWS\system32\LEXBCES.EXE” [“Lexmark International, Inc.”] Machine Debug Manager, MDM, ““C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe”” [MS] NVIDIA Display Driver Service, NVSvc, “C:\WINDOWS\System32\nvsvc32.exe” [“NVIDIA Corporation”] Windows User Mode Driver Framework, UMWdf, “C:\WINDOWS\System32\wdfmgr.exe” [MS] Print Monitors: --------------- HKLM\System\CurrentControlSet\Control\Print\Monitors\ Lexmark Network Port\Driver = “LEXLMPM.DLL” [“Lexmark International, Inc.”] ---------- + This report excludes default entries except where indicated. + To see *everywhere* the script checks and *everything* it finds, launch it from a command prompt or a shortcut with the -all parameter. + The search for DESKTOP.INI DLL launch points on all local fixed drives took 513 seconds. + The search for all Registry CLSIDs containing dormant Explorer Bars took 892 seconds. ---------- (total run time: 3085 seconds)

adam9870 · 16 Luty 2007 16:05

Otwórz Notatnik i wklej w nim to:

Plik >>> Zapisz jako >>> Zmień rozszerzenie z TXT na Wszystkie pliki >>> Zapisz pod nazwą FIX.REG >>> kliknij dwa razy na utworzony plik FIX.REG i potwierdź dodanie do rejestru >>> restart.

Gdzie go wykrył? Podaj dokładną lokalizację do zainfekowanego pliku…

Przeskanuj http://www.ewido.net/en/ i wrzuć raport oraz nowy log z Silenta.

Voidan · 18 Luty 2007 15:32

Tekst w notatniku wklejony i dodany do rejestru.

Skaner ewido pozbył się jakoś tytułowego trojana… i ponad 200 innych :evil:

Poniżej nowe logi:

Ewido:

__________________________________________________ ewido anti-spyware online scanner http://www.ewido.net __________________________________________________ Name: TrackingCookie.Burstnet Path: C:\Documents and Settings\Przemek Sowa\Cookies\przemek sowa@burstnet[2].txt Risk: Medium Name: TrackingCookie.Oewabox Path: C:\Documents and Settings\Przemek Sowa\Cookies\przemek sowa@oewabox[1].txt Risk: Medium Name: TrackingCookie.Masterstats Path: C:\Documents and Settings\Przemek Sowa\Cookies\przemek sowa@image.masterstats[1].txt Risk: Medium Name: TrackingCookie.Clickzs Path: C:\Documents and Settings\Przemek Sowa\Cookies\przemek sowa@vip2.clickzs[2].txt Risk: Medium Name: TrackingCookie.Adocean Path: C:\Documents and Settings\Przemek Sowa\Cookies\przemek sowa@pracuj.adocean[1].txt Risk: Medium Name: TrackingCookie.Liveperson Path: C:\Documents and Settings\Przemek Sowa\Cookies\przemek sowa@sales.liveperson[2].txt Risk: Medium Name: TrackingCookie.Yadro Path: C:\Documents and Settings\Przemek Sowa\Cookies\przemek sowa@yadro[2].txt Risk: Medium Name: TrackingCookie.Adocean Path: C:\Documents and Settings\Przemek Sowa\Cookies\przemek sowa@edipresse.adocean[2].txt Risk: Medium Name: TrackingCookie.Adocean Path: C:\Documents and Settings\Przemek Sowa\Cookies\przemek sowa@czgde.adocean[1].txt Risk: Medium Name: TrackingCookie.Adjuggler Path: C:\Documents and Settings\Przemek Sowa\Cookies\przemek sowa@adjuggler[1].txt Risk: Medium Name: TrackingCookie.Adocean Path: C:\Documents and Settings\Przemek Sowa\Cookies\przemek sowa@int.adocean[2].txt Risk: Medium Name: TrackingCookie.Adocean Path: C:\Documents and Settings\Przemek Sowa\Cookies\przemek sowa@gde.adocean[2].txt Risk: Medium Name: TrackingCookie.Overture Path: C:\Documents and Settings\Przemek Sowa\Cookies\przemek sowa@data1.perf.overture[2].txt Risk: Medium Name: TrackingCookie.Clickzs Path: C:\Documents and Settings\Przemek Sowa\Cookies\przemek sowa@cz5.clickzs[1].txt Risk: Medium Name: TrackingCookie.Clickzs Path: C:\Documents and Settings\Przemek Sowa\Cookies\przemek sowa@cz2.clickzs[2].txt Risk: Medium Name: TrackingCookie.Specificclick Path: C:\Documents and Settings\Przemek Sowa\Cookies\przemek sowa@adopt.specificclick[2].txt Risk: Medium Name: TrackingCookie.Adocean Path: C:\Documents and Settings\Przemek Sowa\Cookies\przemek sowa@ad.adocean[2].txt Risk: Medium Name: TrackingCookie.Wegcash Path: C:\Documents and Settings\Przemek Sowa\Cookies\przemek sowa@free.wegcash[2].txt Risk: Medium Name: TrackingCookie.Reliablestats Path: C:\Documents and Settings\Przemek Sowa\Cookies\przemek sowa@stats1.reliablestats[1].txt Risk: Medium Name: TrackingCookie.Clickzs Path: C:\Documents and Settings\Przemek Sowa\Cookies\przemek sowa@cz3.clickzs[2].txt Risk: Medium Name: TrackingCookie.Addcontrol Path: C:\Documents and Settings\Przemek Sowa\Cookies\przemek sowa@axa.addcontrol[1].txt Risk: Medium Name: TrackingCookie.Myaffiliateprogram Path: C:\Documents and Settings\Przemek Sowa\Cookies\przemek sowa@www.myaffiliateprogram[2].txt Risk: Medium Name: TrackingCookie.Adition Path: C:\Documents and Settings\Przemek Sowa\Cookies\przemek sowa@ad.adition[2].txt Risk: Medium Name: TrackingCookie.Com Path: C:\Documents and Settings\Przemek Sowa\Cookies\przemek sowa@com[1].txt Risk: Medium Name: TrackingCookie.Burstnet Path: C:\Documents and Settings\Przemek Sowa\Cookies\przemek sowa@www.burstnet[2].txt Risk: Medium Name: TrackingCookie.Adocean Path: C:\Documents and Settings\Przemek Sowa\Cookies\przemek sowa@idg.adocean[2].txt Risk: Medium Name: TrackingCookie.Clickzs Path: C:\Documents and Settings\Przemek Sowa\Cookies\przemek sowa@cz9.clickzs[2].txt Risk: Medium Name: TrackingCookie.Admarketplace Path: C:\Documents and Settings\Przemek Sowa\Cookies\przemek sowa@admarketplace[1].txt Risk: Medium Name: TrackingCookie.Wegcash Path: C:\Documents and Settings\Przemek Sowa\Cookies\przemek sowa@programs.wegcash[2].txt Risk: Medium Name: TrackingCookie.Itrack Path: C:\Documents and Settings\Przemek Sowa\Cookies\przemek sowa@ilead.itrack[1].txt Risk: Medium Name: TrackingCookie.Clickzs Path: C:\Documents and Settings\Przemek Sowa\Cookies\przemek sowa@cz11.clickzs[2].txt Risk: Medium Name: TrackingCookie.Burstnet Path: C:\Documents and Settings\Przemek Sowa\Cookies\przemek sowa@burstnet[3].txt Risk: Medium Name: TrackingCookie.Adbrite Path: C:\Documents and Settings\Przemek Sowa\Cookies\przemek sowa@www.adbrite[2].txt Risk: Medium Name: TrackingCookie.Adocean Path: C:\Documents and Settings\Przemek Sowa\Cookies\przemek sowa@gg.adocean[1].txt Risk: Medium Name: TrackingCookie.Overture Path: C:\Documents and Settings\Przemek Sowa\Cookies\przemek sowa@data2.perf.overture[2].txt Risk: Medium Name: TrackingCookie.Adocean Path: C:\Documents and Settings\Przemek Sowa\Cookies\przemek sowa@my.adocean[2].txt Risk: Medium Name: TrackingCookie.Tacoda Path: C:\Documents and Settings\Przemek Sowa\Cookies\przemek sowa@anad.tacoda[2].txt Risk: Medium Name: Adware.IntCodec Path: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Internet Explorer Security Plugin 2006 Risk: Medium Name: Adware.Generic Path: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Internet Security Add-On Risk: Medium Name: Adware.Generic Path: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Public Messenger ver 2.03 Risk: Medium Name: Proxy.Small Path: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WinOpts Risk: High Name: Adware.Generic Path: HKU.DEFAULT\Software\Internet Security Risk: Medium Name: Adware.BetterInternet Path: HKU\S-1-5-21-1715567821-839522115-854245398-1003\Software\AuroraHandler Risk: Medium Name: Adware.Generic Path: HKU\S-1-5-18\Software\Internet Security Risk: Medium Name: Downloader.Small Path: C:\WINDOWS\system32\update00822631.exe Risk: High Name: Dropper.Small.ava Path: C:\WINDOWS\system32\update13428241.exe Risk: High Name: Rootkit.Agent.dp Path: C:\WINDOWS\Temp\cel90xbe.sys Risk: High Name: Adware.Gator Path: C:\WINDOWS\Downloaded Program Files\CONFLICT.1\HDPlugin1101.dll Risk: Medium Name: Downloader.Femad Path: C:\WINDOWS\Downloaded Program Files\on.exe Risk: High Name: Adware.BetterInternet Path: C:\WINDOWS\nail.exe Risk: Medium Name: Downloader.Small Path: C:\Documents and Settings\NetworkService\Ustawienia lokalne\Temporary Internet Files\Content.IE5\BYA6YBPR\serv[1] Risk: High Name: Dropper.Small.ava Path: C:\Documents and Settings\NetworkService\Ustawienia lokalne\Temporary Internet Files\Content.IE5\SP41OLCR\video123[1].exe Risk: High Name: TrackingCookie.Clickzs Path: C:\Documents and Settings\Przemek Sowa\Ustawienia lokalne\Temp\Cookies\przemek sowa@cz11.clickzs[2].txt Risk: Medium Name: Logger.Alexa.a Path: C:\Documents and Settings\Przemek Sowa\Pulpit\Test33\test33.EXE Risk: High Name: TrackingCookie.2o7 Path: :mozilla.8:C:\Documents and Settings\Przemek Sowa\Dane aplikacji\Mozilla\Firefox\Profiles\pkxujzvu.default\cookies.txt Risk: Medium Name: TrackingCookie.2o7 Path: :mozilla.9:C:\Documents and Settings\Przemek Sowa\Dane aplikacji\Mozilla\Firefox\Profiles\pkxujzvu.default\cookies.txt Risk: Medium Name: TrackingCookie.Adocean Path: :mozilla.33:C:\Documents and Settings\Przemek Sowa\Dane aplikacji\Mozilla\Firefox\Profiles\pkxujzvu.default\cookies.txt Risk: Medium Name: TrackingCookie.Adocean Path: :mozilla.34:C:\Documents and Settings\Przemek Sowa\Dane aplikacji\Mozilla\Firefox\Profiles\pkxujzvu.default\cookies.txt Risk: Medium Name: TrackingCookie.Tradedoubler Path: :mozilla.49:C:\Documents and Settings\Przemek Sowa\Dane aplikacji\Mozilla\Firefox\Profiles\pkxujzvu.default\cookies.txt Risk: Medium Name: TrackingCookie.Tradedoubler Path: :mozilla.50:C:\Documents and Settings\Przemek Sowa\Dane aplikacji\Mozilla\Firefox\Profiles\pkxujzvu.default\cookies.txt Risk: Medium Name: TrackingCookie.247realmedia Path: :mozilla.71:C:\Documents and Settings\Przemek Sowa\Dane aplikacji\Mozilla\Firefox\Profiles\pkxujzvu.default\cookies.txt Risk: Medium Name: TrackingCookie.Yieldmanager Path: :mozilla.89:C:\Documents and Settings\Przemek Sowa\Dane aplikacji\Mozilla\Firefox\Profiles\pkxujzvu.default\cookies.txt Risk: Medium Name: TrackingCookie.Yieldmanager Path: :mozilla.90:C:\Documents and Settings\Przemek Sowa\Dane aplikacji\Mozilla\Firefox\Profiles\pkxujzvu.default\cookies.txt Risk: Medium Name: TrackingCookie.Statcounter Path: :mozilla.119:C:\Documents and Settings\Przemek Sowa\Dane aplikacji\Mozilla\Firefox\Profiles\pkxujzvu.default\cookies.txt Risk: Medium Name: TrackingCookie.Statcounter Path: :mozilla.120:C:\Documents and Settings\Przemek Sowa\Dane aplikacji\Mozilla\Firefox\Profiles\pkxujzvu.default\cookies.txt Risk: Medium Name: TrackingCookie.Statcounter Path: :mozilla.121:C:\Documents and Settings\Przemek Sowa\Dane aplikacji\Mozilla\Firefox\Profiles\pkxujzvu.default\cookies.txt Risk: Medium Name: TrackingCookie.Statcounter Path: :mozilla.122:C:\Documents and Settings\Przemek Sowa\Dane aplikacji\Mozilla\Firefox\Profiles\pkxujzvu.default\cookies.txt Risk: Medium Name: TrackingCookie.Statcounter Path: :mozilla.123:C:\Documents and Settings\Przemek Sowa\Dane aplikacji\Mozilla\Firefox\Profiles\pkxujzvu.default\cookies.txt Risk: Medium Name: TrackingCookie.Statcounter Path: :mozilla.124:C:\Documents and Settings\Przemek Sowa\Dane aplikacji\Mozilla\Firefox\Profiles\pkxujzvu.default\cookies.txt Risk: Medium Name: TrackingCookie.Statcounter Path: :mozilla.125:C:\Documents and Settings\Przemek Sowa\Dane aplikacji\Mozilla\Firefox\Profiles\pkxujzvu.default\cookies.txt Risk: Medium Name: TrackingCookie.Statcounter Path: :mozilla.126:C:\Documents and Settings\Przemek Sowa\Dane aplikacji\Mozilla\Firefox\Profiles\pkxujzvu.default\cookies.txt Risk: Medium Name: TrackingCookie.Enhance Path: :mozilla.128:C:\Documents and Settings\Przemek Sowa\Dane aplikacji\Mozilla\Firefox\Profiles\pkxujzvu.default\cookies.txt Risk: Medium Name: TrackingCookie.Casinotropez Path: :mozilla.135:C:\Documents and Settings\Przemek Sowa\Dane aplikacji\Mozilla\Firefox\Profiles\pkxujzvu.default\cookies.txt Risk: Medium Name: TrackingCookie.Liveperson Path: :mozilla.140:C:\Documents and Settings\Przemek Sowa\Dane aplikacji\Mozilla\Firefox\Profiles\pkxujzvu.default\cookies.txt Risk: Medium Name: TrackingCookie.Liveperson Path: :mozilla.141:C:\Documents and Settings\Przemek Sowa\Dane aplikacji\Mozilla\Firefox\Profiles\pkxujzvu.default\cookies.txt Risk: Medium Name: TrackingCookie.Hitslink Path: :mozilla.145:C:\Documents and Settings\Przemek Sowa\Dane aplikacji\Mozilla\Firefox\Profiles\pkxujzvu.default\cookies.txt Risk: Medium Name: TrackingCookie.Hitslink Path: :mozilla.146:C:\Documents and Settings\Przemek Sowa\Dane aplikacji\Mozilla\Firefox\Profiles\pkxujzvu.default\cookies.txt Risk: Medium Name: TrackingCookie.Hitslink Path: :mozilla.147:C:\Documents and Settings\Przemek Sowa\Dane aplikacji\Mozilla\Firefox\Profiles\pkxujzvu.default\cookies.txt Risk: Medium Name: TrackingCookie.Hitslink Path: :mozilla.148:C:\Documents and Settings\Przemek Sowa\Dane aplikacji\Mozilla\Firefox\Profiles\pkxujzvu.default\cookies.txt Risk: Medium Name: TrackingCookie.Clickbank Path: :mozilla.162:C:\Documents and Settings\Przemek Sowa\Dane aplikacji\Mozilla\Firefox\Profiles\pkxujzvu.default\cookies.txt Risk: Medium Name: TrackingCookie.Clickbank Path: :mozilla.163:C:\Documents and Settings\Przemek Sowa\Dane aplikacji\Mozilla\Firefox\Profiles\pkxujzvu.default\cookies.txt Risk: Medium Name: TrackingCookie.Trafficmp Path: :mozilla.172:C:\Documents and Settings\Przemek Sowa\Dane aplikacji\Mozilla\Firefox\Profiles\pkxujzvu.default\cookies.txt Risk: Medium Name: TrackingCookie.Trafficmp Path: :mozilla.173:C:\Documents and Settings\Przemek Sowa\Dane aplikacji\Mozilla\Firefox\Profiles\pkxujzvu.default\cookies.txt Risk: Medium Name: TrackingCookie.Trafficmp Path: :mozilla.174:C:\Documents and Settings\Przemek Sowa\Dane aplikacji\Mozilla\Firefox\Profiles\pkxujzvu.default\cookies.txt Risk: Medium Name: TrackingCookie.Trafficmp Path: :mozilla.176:C:\Documents and Settings\Przemek Sowa\Dane aplikacji\Mozilla\Firefox\Profiles\pkxujzvu.default\cookies.txt Risk: Medium Name: TrackingCookie.Trafficmp Path: :mozilla.177:C:\Documents and Settings\Przemek Sowa\Dane aplikacji\Mozilla\Firefox\Profiles\pkxujzvu.default\cookies.txt Risk: Medium Name: TrackingCookie.Trafficmp Path: :mozilla.179:C:\Documents and Settings\Przemek Sowa\Dane aplikacji\Mozilla\Firefox\Profiles\pkxujzvu.default\cookies.txt Risk: Medium Name: TrackingCookie.Doubleclick Path: :mozilla.190:C:\Documents and Settings\Przemek Sowa\Dane aplikacji\Mozilla\Firefox\Profiles\pkxujzvu.default\cookies.txt Risk: Medium Name: TrackingCookie.Atdmt Path: :mozilla.197:C:\Documents and Settings\Przemek Sowa\Dane aplikacji\Mozilla\Firefox\Profiles\pkxujzvu.default\cookies.txt Risk: Medium Name: TrackingCookie.Com Path: :mozilla.198:C:\Documents and Settings\Przemek Sowa\Dane aplikacji\Mozilla\Firefox\Profiles\pkxujzvu.default\cookies.txt Risk: Medium Name: TrackingCookie.Pointroll Path: :mozilla.199:C:\Documents and Settings\Przemek Sowa\Dane aplikacji\Mozilla\Firefox\Profiles\pkxujzvu.default\cookies.txt Risk: Medium Name: TrackingCookie.Pointroll Path: :mozilla.200:C:\Documents and Settings\Przemek Sowa\Dane aplikacji\Mozilla\Firefox\Profiles\pkxujzvu.default\cookies.txt Risk: Medium Name: TrackingCookie.Pointroll Path: :mozilla.201:C:\Documents and Settings\Przemek Sowa\Dane aplikacji\Mozilla\Firefox\Profiles\pkxujzvu.default\cookies.txt Risk: Medium Name: TrackingCookie.Pointroll Path: :mozilla.203:C:\Documents and Settings\Przemek Sowa\Dane aplikacji\Mozilla\Firefox\Profiles\pkxujzvu.default\cookies.txt Risk: Medium Name: TrackingCookie.Burstnet Path: :mozilla.209:C:\Documents and Settings\Przemek Sowa\Dane aplikacji\Mozilla\Firefox\Profiles\pkxujzvu.default\cookies.txt Risk: Medium Name: TrackingCookie.Burstnet Path: :mozilla.210:C:\Documents and Settings\Przemek Sowa\Dane aplikacji\Mozilla\Firefox\Profiles\pkxujzvu.default\cookies.txt Risk: Medium Name: TrackingCookie.Tacoda Path: :mozilla.211:C:\Documents and Settings\Przemek Sowa\Dane aplikacji\Mozilla\Firefox\Profiles\pkxujzvu.default\cookies.txt Risk: Medium Name: TrackingCookie.Tacoda Path: :mozilla.212:C:\Documents and Settings\Przemek Sowa\Dane aplikacji\Mozilla\Firefox\Profiles\pkxujzvu.default\cookies.txt Risk: Medium Name: TrackingCookie.Tacoda Path: :mozilla.213:C:\Documents and Settings\Przemek Sowa\Dane aplikacji\Mozilla\Firefox\Profiles\pkxujzvu.default\cookies.txt Risk: Medium Name: TrackingCookie.Targetnet Path: :mozilla.216:C:\Documents and Settings\Przemek Sowa\Dane aplikacji\Mozilla\Firefox\Profiles\pkxujzvu.default\cookies.txt Risk: Medium Name: TrackingCookie.Targetnet Path: :mozilla.217:C:\Documents and Settings\Przemek Sowa\Dane aplikacji\Mozilla\Firefox\Profiles\pkxujzvu.default\cookies.txt Risk: Medium Name: TrackingCookie.Sexlist Path: :mozilla.220:C:\Documents and Settings\Przemek Sowa\Dane aplikacji\Mozilla\Firefox\Profiles\pkxujzvu.default\cookies.txt Risk: Medium Name: TrackingCookie.Sexlist Path: :mozilla.221:C:\Documents and Settings\Przemek Sowa\Dane aplikacji\Mozilla\Firefox\Profiles\pkxujzvu.default\cookies.txt Risk: Medium Name: TrackingCookie.Sexlist Path: :mozilla.222:C:\Documents and Settings\Przemek Sowa\Dane aplikacji\Mozilla\Firefox\Profiles\pkxujzvu.default\cookies.txt Risk: Medium Name: TrackingCookie.Sexlist Path: :mozilla.223:C:\Documents and Settings\Przemek Sowa\Dane aplikacji\Mozilla\Firefox\Profiles\pkxujzvu.default\cookies.txt Risk: Medium Name: TrackingCookie.Sexcounter Path: :mozilla.224:C:\Documents and Settings\Przemek Sowa\Dane aplikacji\Mozilla\Firefox\Profiles\pkxujzvu.default\cookies.txt Risk: Medium Name: TrackingCookie.Sexcounter Path: :mozilla.225:C:\Documents and Settings\Przemek Sowa\Dane aplikacji\Mozilla\Firefox\Profiles\pkxujzvu.default\cookies.txt Risk: Medium Name: TrackingCookie.Sexcounter Path: :mozilla.226:C:\Documents and Settings\Przemek Sowa\Dane aplikacji\Mozilla\Firefox\Profiles\pkxujzvu.default\cookies.txt Risk: Medium Name: TrackingCookie.Sexcounter Path: :mozilla.227:C:\Documents and Settings\Przemek Sowa\Dane aplikacji\Mozilla\Firefox\Profiles\pkxujzvu.default\cookies.txt Risk: Medium Name: TrackingCookie.Sexcounter Path: :mozilla.228:C:\Documents and Settings\Przemek Sowa\Dane aplikacji\Mozilla\Firefox\Profiles\pkxujzvu.default\cookies.txt Risk: Medium Name: TrackingCookie.Sexcounter Path: :mozilla.229:C:\Documents and Settings\Przemek Sowa\Dane aplikacji\Mozilla\Firefox\Profiles\pkxujzvu.default\cookies.txt Risk: Medium Name: TrackingCookie.Sexcounter Path: :mozilla.230:C:\Documents and Settings\Przemek Sowa\Dane aplikacji\Mozilla\Firefox\Profiles\pkxujzvu.default\cookies.txt Risk: Medium Name: TrackingCookie.Sexcounter Path: :mozilla.231:C:\Documents and Settings\Przemek Sowa\Dane aplikacji\Mozilla\Firefox\Profiles\pkxujzvu.default\cookies.txt Risk: Medium Name: TrackingCookie.Sexcounter Path: :mozilla.232:C:\Documents and Settings\Przemek Sowa\Dane aplikacji\Mozilla\Firefox\Profiles\pkxujzvu.default\cookies.txt Risk: Medium Name: TrackingCookie.Sexcounter Path: :mozilla.233:C:\Documents and Settings\Przemek Sowa\Dane aplikacji\Mozilla\Firefox\Profiles\pkxujzvu.default\cookies.txt Risk: Medium Name: TrackingCookie.Sexcounter Path: :mozilla.234:C:\Documents and Settings\Przemek Sowa\Dane aplikacji\Mozilla\Firefox\Profiles\pkxujzvu.default\cookies.txt Risk: Medium Name: TrackingCookie.Sexcounter Path: :mozilla.235:C:\Documents and Settings\Przemek Sowa\Dane aplikacji\Mozilla\Firefox\Profiles\pkxujzvu.default\cookies.txt Risk: Medium Name: TrackingCookie.Sexcounter Path: :mozilla.236:C:\Documents and Settings\Przemek Sowa\Dane aplikacji\Mozilla\Firefox\Profiles\pkxujzvu.default\cookies.txt Risk: Medium Name: TrackingCookie.Sexcounter Path: :mozilla.237:C:\Documents and Settings\Przemek Sowa\Dane aplikacji\Mozilla\Firefox\Profiles\pkxujzvu.default\cookies.txt Risk: Medium Name: TrackingCookie.Esomniture Path: :mozilla.238:C:\Documents and Settings\Przemek Sowa\Dane aplikacji\Mozilla\Firefox\Profiles\pkxujzvu.default\cookies.txt Risk: Medium Name: TrackingCookie.Sexcounter Path: :mozilla.239:C:\Documents and Settings\Przemek Sowa\Dane aplikacji\Mozilla\Firefox\Profiles\pkxujzvu.default\cookies.txt Risk: Medium Name: TrackingCookie.Sexcounter Path: :mozilla.240:C:\Documents and Settings\Przemek Sowa\Dane aplikacji\Mozilla\Firefox\Profiles\pkxujzvu.default\cookies.txt Risk: Medium Name: TrackingCookie.Sexcounter Path: :mozilla.241:C:\Documents and Settings\Przemek Sowa\Dane aplikacji\Mozilla\Firefox\Profiles\pkxujzvu.default\cookies.txt Risk: Medium Name: TrackingCookie.Sexcounter Path: :mozilla.242:C:\Documents and Settings\Przemek Sowa\Dane aplikacji\Mozilla\Firefox\Profiles\pkxujzvu.default\cookies.txt Risk: Medium Name: TrackingCookie.Sexcounter Path: :mozilla.243:C:\Documents and Settings\Przemek Sowa\Dane aplikacji\Mozilla\Firefox\Profiles\pkxujzvu.default\cookies.txt Risk: Medium Name: TrackingCookie.Sexcounter Path: :mozilla.244:C:\Documents and Settings\Przemek Sowa\Dane aplikacji\Mozilla\Firefox\Profiles\pkxujzvu.default\cookies.txt Risk: Medium Name: TrackingCookie.Sexcounter Path: :mozilla.245:C:\Documents and Settings\Przemek Sowa\Dane aplikacji\Mozilla\Firefox\Profiles\pkxujzvu.default\cookies.txt Risk: Medium Name: TrackingCookie.Sexcounter Path: :mozilla.246:C:\Documents and Settings\Przemek Sowa\Dane aplikacji\Mozilla\Firefox\Profiles\pkxujzvu.default\cookies.txt Risk: Medium Name: TrackingCookie.Sexcounter Path: :mozilla.247:C:\Documents and Settings\Przemek Sowa\Dane aplikacji\Mozilla\Firefox\Profiles\pkxujzvu.default\cookies.txt Risk: Medium Name: TrackingCookie.Sexcounter Path: :mozilla.248:C:\Documents and Settings\Przemek Sowa\Dane aplikacji\Mozilla\Firefox\Profiles\pkxujzvu.default\cookies.txt Risk: Medium Name: TrackingCookie.Sexcounter Path: :mozilla.249:C:\Documents and Settings\Przemek Sowa\Dane aplikacji\Mozilla\Firefox\Profiles\pkxujzvu.default\cookies.txt Risk: Medium Name: TrackingCookie.Sexcounter Path: :mozilla.250:C:\Documents and Settings\Przemek Sowa\Dane aplikacji\Mozilla\Firefox\Profiles\pkxujzvu.default\cookies.txt Risk: Medium Name: TrackingCookie.Sexcounter Path: :mozilla.251:C:\Documents and Settings\Przemek Sowa\Dane aplikacji\Mozilla\Firefox\Profiles\pkxujzvu.default\cookies.txt Risk: Medium Name: TrackingCookie.Sexcounter Path: :mozilla.252:C:\Documents and Settings\Przemek Sowa\Dane aplikacji\Mozilla\Firefox\Profiles\pkxujzvu.default\cookies.txt Risk: Medium Name: TrackingCookie.Esomniture Path: :mozilla.253:C:\Documents and Settings\Przemek Sowa\Dane aplikacji\Mozilla\Firefox\Profiles\pkxujzvu.default\cookies.txt Risk: Medium Name: TrackingCookie.Esomniture Path: :mozilla.254:C:\Documents and Settings\Przemek Sowa\Dane aplikacji\Mozilla\Firefox\Profiles\pkxujzvu.default\cookies.txt Risk: Medium Name: TrackingCookie.Paycounter Path: :mozilla.256:C:\Documents and Settings\Przemek Sowa\Dane aplikacji\Mozilla\Firefox\Profiles\pkxujzvu.default\cookies.txt Risk: Medium Name: TrackingCookie.Esomniture Path: :mozilla.257:C:\Documents and Settings\Przemek Sowa\Dane aplikacji\Mozilla\Firefox\Profiles\pkxujzvu.default\cookies.txt Risk: Medium Name: TrackingCookie.Revenue Path: :mozilla.262:C:\Documents and Settings\Przemek Sowa\Dane aplikacji\Mozilla\Firefox\Profiles\pkxujzvu.default\cookies.txt Risk: Medium Name: TrackingCookie.Information Path: :mozilla.263:C:\Documents and Settings\Przemek Sowa\Dane aplikacji\Mozilla\Firefox\Profiles\pkxujzvu.default\cookies.txt Risk: Medium Name: TrackingCookie.Adocean Path: :mozilla.273:C:\Documents and Settings\Przemek Sowa\Dane aplikacji\Mozilla\Firefox\Profiles\pkxujzvu.default\cookies.txt Risk: Medium Name: TrackingCookie.Adocean Path: :mozilla.274:C:\Documents and Settings\Przemek Sowa\Dane aplikacji\Mozilla\Firefox\Profiles\pkxujzvu.default\cookies.txt Risk: Medium Name: TrackingCookie.Realtracker Path: :mozilla.298:C:\Documents and Settings\Przemek Sowa\Dane aplikacji\Mozilla\Firefox\Profiles\pkxujzvu.default\cookies.txt Risk: Medium Name: TrackingCookie.Realtracker Path: :mozilla.299:C:\Documents and Settings\Przemek Sowa\Dane aplikacji\Mozilla\Firefox\Profiles\pkxujzvu.default\cookies.txt Risk: Medium Name: TrackingCookie.Questionmarket Path: :mozilla.310:C:\Documents and Settings\Przemek Sowa\Dane aplikacji\Mozilla\Firefox\Profiles\pkxujzvu.default\cookies.txt Risk: Medium Name: TrackingCookie.Addynamix Path: :mozilla.311:C:\Documents and Settings\Przemek Sowa\Dane aplikacji\Mozilla\Firefox\Profiles\pkxujzvu.default\cookies.txt Risk: Medium Name: TrackingCookie.Casalemedia Path: :mozilla.316:C:\Documents and Settings\Przemek Sowa\Dane aplikacji\Mozilla\Firefox\Profiles\pkxujzvu.default\cookies.txt Risk: Medium Name: TrackingCookie.Masterstats Path: :mozilla.338:C:\Documents and Settings\Przemek Sowa\Dane aplikacji\Mozilla\Firefox\Profiles\pkxujzvu.default\cookies.txt Risk: Medium Name: TrackingCookie.2o7 Path: :mozilla.356:C:\Documents and Settings\Przemek Sowa\Dane aplikacji\Mozilla\Firefox\Profiles\pkxujzvu.default\cookies.txt Risk: Medium Name: TrackingCookie.Googleadservices Path: :mozilla.357:C:\Documents and Settings\Przemek Sowa\Dane aplikacji\Mozilla\Firefox\Profiles\pkxujzvu.default\cookies.txt Risk: Medium Name: TrackingCookie.Tribalfusion Path: :mozilla.363:C:\Documents and Settings\Przemek Sowa\Dane aplikacji\Mozilla\Firefox\Profiles\pkxujzvu.default\cookies.txt Risk: Medium Name: TrackingCookie.Liveperson Path: :mozilla.369:C:\Documents and Settings\Przemek Sowa\Dane aplikacji\Mozilla\Firefox\Profiles\pkxujzvu.default\cookies.txt Risk: Medium Name: TrackingCookie.Liveperson Path: :mozilla.370:C:\Documents and Settings\Przemek Sowa\Dane aplikacji\Mozilla\Firefox\Profiles\pkxujzvu.default\cookies.txt Risk: Medium Name: TrackingCookie.Googleadservices Path: :mozilla.382:C:\Documents and Settings\Przemek Sowa\Dane aplikacji\Mozilla\Firefox\Profiles\pkxujzvu.default\cookies.txt Risk: Medium Name: TrackingCookie.Ru4 Path: :mozilla.385:C:\Documents and Settings\Przemek Sowa\Dane aplikacji\Mozilla\Firefox\Profiles\pkxujzvu.default\cookies.txt Risk: Medium Name: TrackingCookie.Ru4 Path: :mozilla.386:C:\Documents and Settings\Przemek Sowa\Dane aplikacji\Mozilla\Firefox\Profiles\pkxujzvu.default\cookies.txt Risk: Medium Name: TrackingCookie.Serving-sys Path: :mozilla.387:C:\Documents and Settings\Przemek Sowa\Dane aplikacji\Mozilla\Firefox\Profiles\pkxujzvu.default\cookies.txt Risk: Medium Name: TrackingCookie.Serving-sys Path: :mozilla.388:C:\Documents and Settings\Przemek Sowa\Dane aplikacji\Mozilla\Firefox\Profiles\pkxujzvu.default\cookies.txt Risk: Medium Name: TrackingCookie.Serving-sys Path: :mozilla.389:C:\Documents and Settings\Przemek Sowa\Dane aplikacji\Mozilla\Firefox\Profiles\pkxujzvu.default\cookies.txt Risk: Medium Name: TrackingCookie.Serving-sys Path: :mozilla.390:C:\Documents and Settings\Przemek Sowa\Dane aplikacji\Mozilla\Firefox\Profiles\pkxujzvu.default\cookies.txt Risk: Medium Name: TrackingCookie.Webtrendslive Path: :mozilla.401:C:\Documents and Settings\Przemek Sowa\Dane aplikacji\Mozilla\Firefox\Profiles\pkxujzvu.default\cookies.txt Risk: Medium Name: TrackingCookie.Webtrendslive Path: :mozilla.402:C:\Documents and Settings\Przemek Sowa\Dane aplikacji\Mozilla\Firefox\Profiles\pkxujzvu.default\cookies.txt Risk: Medium Name: TrackingCookie.Valueclick Path: :mozilla.429:C:\Documents and Settings\Przemek Sowa\Dane aplikacji\Mozilla\Firefox\Profiles\pkxujzvu.default\cookies.txt Risk: Medium Name: TrackingCookie.Hitbox Path: :mozilla.430:C:\Documents and Settings\Przemek Sowa\Dane aplikacji\Mozilla\Firefox\Profiles\pkxujzvu.default\cookies.txt Risk: Medium Name: TrackingCookie.Hitbox Path: :mozilla.431:C:\Documents and Settings\Przemek Sowa\Dane aplikacji\Mozilla\Firefox\Profiles\pkxujzvu.default\cookies.txt Risk: Medium Name: TrackingCookie.Qksrv Path: :mozilla.432:C:\Documents and Settings\Przemek Sowa\Dane aplikacji\Mozilla\Firefox\Profiles\pkxujzvu.default\cookies.txt Risk: Medium Name: TrackingCookie.Bfast Path: :mozilla.433:C:\Documents and Settings\Przemek Sowa\Dane aplikacji\Mozilla\Firefox\Profiles\pkxujzvu.default\cookies.txt Risk: Medium Name: TrackingCookie.Qksrv Path: :mozilla.434:C:\Documents and Settings\Przemek Sowa\Dane aplikacji\Mozilla\Firefox\Profiles\pkxujzvu.default\cookies.txt Risk: Medium Name: TrackingCookie.Adserver Path: :mozilla.445:C:\Documents and Settings\Przemek Sowa\Dane aplikacji\Mozilla\Firefox\Profiles\pkxujzvu.default\cookies.txt Risk: Medium Name: TrackingCookie.Mediaplex Path: :mozilla.448:C:\Documents and Settings\Przemek Sowa\Dane aplikacji\Mozilla\Firefox\Profiles\pkxujzvu.default\cookies.txt Risk: Medium Name: TrackingCookie.Hitbox Path: :mozilla.451:C:\Documents and Settings\Przemek Sowa\Dane aplikacji\Mozilla\Firefox\Profiles\pkxujzvu.default\cookies.txt Risk: Medium Name: TrackingCookie.Cqcounter Path: :mozilla.456:C:\Documents and Settings\Przemek Sowa\Dane aplikacji\Mozilla\Firefox\Profiles\pkxujzvu.default\cookies.txt Risk: Medium Name: TrackingCookie.Cqcounter Path: :mozilla.469:C:\Documents and Settings\Przemek Sowa\Dane aplikacji\Mozilla\Firefox\Profiles\pkxujzvu.default\cookies.txt Risk: Medium Name: TrackingCookie.2o7 Path: :mozilla.483:C:\Documents and Settings\Przemek Sowa\Dane aplikacji\Mozilla\Firefox\Profiles\pkxujzvu.default\cookies.txt Risk: Medium Name: TrackingCookie.Liveperson Path: :mozilla.512:C:\Documents and Settings\Przemek Sowa\Dane aplikacji\Mozilla\Firefox\Profiles\pkxujzvu.default\cookies.txt Risk: Medium Name: TrackingCookie.Liveperson Path: :mozilla.513:C:\Documents and Settings\Przemek Sowa\Dane aplikacji\Mozilla\Firefox\Profiles\pkxujzvu.default\cookies.txt Risk: Medium Name: TrackingCookie.Euroclick Path: :mozilla.519:C:\Documents and Settings\Przemek Sowa\Dane aplikacji\Mozilla\Firefox\Profiles\pkxujzvu.default\cookies.txt Risk: Medium Name: TrackingCookie.Euroclick Path: :mozilla.520:C:\Documents and Settings\Przemek Sowa\Dane aplikacji\Mozilla\Firefox\Profiles\pkxujzvu.default\cookies.txt Risk: Medium Name: Adware.SpyMarshal Path: C:\Program Files\SpyMarshal Risk: Medium Name: Adware.SpyMarshal Path: C:\Program Files\SpyMarshal\SpyMarshal1.sm Risk: Medium Name: Adware.SpyMarshal Path: C:\Program Files\SpyMarshal\SpyMarshal.lic Risk: Medium Name: Adware.Generic Path: C:\Program Files\Video ActiveX Object Risk: Medium Name: Adware.Generic Path: C:\Program Files\Video ActiveX Object\uninst.exe Risk: Medium Name: Adware.Generic Path: C:\Program Files\Video ActiveX Object\ts.ico Risk: Medium Name: Adware.Generic Path: C:\Program Files\Video ActiveX Object\ot.ico Risk: Medium Name: Trojan.Agent Path: C:\System Volume Information_restore{A4A82A5D-7591-4630-A19E-6AD5B3ABA7A1}\RP2\A0000091.exe Risk: High Name: Trojan.Agent Path: C:\System Volume Information_restore{A4A82A5D-7591-4630-A19E-6AD5B3ABA7A1}\RP4\A0000194.exe Risk: High Name: Trojan.Agent Path: C:\System Volume Information_restore{A4A82A5D-7591-4630-A19E-6AD5B3ABA7A1}\RP5\A0000201.exe Risk: High Name: Proxy.Dlena.bi Path: C:\System Volume Information_restore{A4A82A5D-7591-4630-A19E-6AD5B3ABA7A1}\RP18\A0027900.dll Risk: High Name: Proxy.Dlena.bi Path: C:\System Volume Information_restore{A4A82A5D-7591-4630-A19E-6AD5B3ABA7A1}\RP22\A0031210.dll Risk: High Name: Backdoor.Agent.abk Path: C:\System Volume Information_restore{A4A82A5D-7591-4630-A19E-6AD5B3ABA7A1}\RP24\A0038313.exe Risk: High Name: Downloader.Small.ddy Path: C:\System Volume Information_restore{A4A82A5D-7591-4630-A19E-6AD5B3ABA7A1}\RP25\A0039370.exe Risk: High Name: Trojan.Agent.ady Path: C:\System Volume Information_restore{A4A82A5D-7591-4630-A19E-6AD5B3ABA7A1}\RP26\A0041406.dll Risk: High Name: Trojan.Agent.ady Path: C:\System Volume Information_restore{A4A82A5D-7591-4630-A19E-6AD5B3ABA7A1}\RP26\A0043406.dll Risk: High Name: Trojan.Agent.ady Path: C:\System Volume Information_restore{A4A82A5D-7591-4630-A19E-6AD5B3ABA7A1}\RP27\A0043457.dll Risk: High Name: Downloader.Small.ddy Path: C:\System Volume Information_restore{A4A82A5D-7591-4630-A19E-6AD5B3ABA7A1}\RP30\A0043553.exe Risk: High Name: Rootkit.Agent.dq Path: C:\System Volume Information_restore{A4A82A5D-7591-4630-A19E-6AD5B3ABA7A1}\RP36\A0051916.exe Risk: High Name: Trojan.Agent.ady Path: C:\System Volume Information_restore{A4A82A5D-7591-4630-A19E-6AD5B3ABA7A1}\RP36\A0051919.sys Risk: High Name: Trojan.Agent.ady Path: C:\System Volume Information_restore{A4A82A5D-7591-4630-A19E-6AD5B3ABA7A1}\RP36\A0051925.dll Risk: High Name: Trojan.Agent.ady Path: C:\System Volume Information_restore{A4A82A5D-7591-4630-A19E-6AD5B3ABA7A1}\RP36\A0051930.sys Risk: High Name: Trojan.Agent.ady Path: C:\System Volume Information_restore{A4A82A5D-7591-4630-A19E-6AD5B3ABA7A1}\RP36\A0051936.DLL Risk: High Name: Trojan.Agent.ady Path: C:\System Volume Information_restore{A4A82A5D-7591-4630-A19E-6AD5B3ABA7A1}\RP36\A0051942.sys Risk: High Name: Trojan.Agent.ady Path: C:\System Volume Information_restore{A4A82A5D-7591-4630-A19E-6AD5B3ABA7A1}\RP37\A0051971.DLL Risk: High Name: Trojan.Agent.ady Path: C:\System Volume Information_restore{A4A82A5D-7591-4630-A19E-6AD5B3ABA7A1}\RP37\A0051978.sys Risk: High Name: Trojan.Agent.ady Path: C:\System Volume Information_restore{A4A82A5D-7591-4630-A19E-6AD5B3ABA7A1}\RP37\A0052007.DLL Risk: High Name: Trojan.Agent.ady Path: C:\System Volume Information_restore{A4A82A5D-7591-4630-A19E-6AD5B3ABA7A1}\RP37\A0052013.sys Risk: High Name: Trojan.Agent.ady Path: C:\System Volume Information_restore{A4A82A5D-7591-4630-A19E-6AD5B3ABA7A1}\RP38\A0052018.DLL Risk: High Name: Trojan.Agent.ady Path: C:\System Volume Information_restore{A4A82A5D-7591-4630-A19E-6AD5B3ABA7A1}\RP38\A0052024.sys Risk: High Name: Rootkit.Agent.dp Path: C:\System Volume Information_restore{A4A82A5D-7591-4630-A19E-6AD5B3ABA7A1}\RP38\A0052028.sys Risk: High Name: Trojan.Agent.ady Path: C:\System Volume Information_restore{A4A82A5D-7591-4630-A19E-6AD5B3ABA7A1}\RP38\A0052032.sys Risk: High Name: Trojan.Agent.ady Path: C:\System Volume Information_restore{A4A82A5D-7591-4630-A19E-6AD5B3ABA7A1}\RP39\A0052082.DLL Risk: High Name: Rootkit.Agent.dp Path: C:!KillBox\cel90xbe.sys Risk: High

HijackThis:

Logfile of HijackThis v1.99.1 Scan saved at 16:21:11, on 2007-02-18 Platform: Windows XP (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2600.0000) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\LEXBCES.EXE C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\LEXPPS.EXE C:\WINDOWS\Explorer.EXE C:\Program Files\MKS\Bin\mks_menu.exe C:\Program Files\MKS\Bin\ABregmon.exe C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\Program Files\Gadu-Gadu\gg.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe C:\WINDOWS\System32\nvsvc32.exe C:\WINDOWS\System32\wdfmgr.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\WINDOWS\System32\wuauclt.exe C:\WINDOWS\system32\NOTEPAD.EXE d:\Moje dokumenty\Przemek\Antyviry\hijackthis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll O4 - HKLM…\Run: [MKS_MENU] C:\Program Files\MKS\Bin\mks_menu.exe O4 - HKLM…\Run: [ABREGMON] C:\Program Files\MKS\Bin\ABregmon.exe O4 - HKLM…\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup O4 - HKLM…\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKCU…\Run: [Gadu-Gadu] “C:\Program Files\Gadu-Gadu\gg.exe” /tray O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O12 - Plugin for .mid: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin2.dll O12 - Plugin for .mov: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin.dll O12 - Plugin for .mpg: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin3.dll O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://downloads.ewido.net/ewidoOnlineScan.cab O16 - DPF: {68282C51-9459-467B-95BF-3C0E89627E55} (MksSkanerOnline Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing) O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE O23 - Service: ieupdater2 (Microsoft IE Updater2) - Unknown owner - C:\Program Files\Avant Browser~tmp0374.exe (file missing) O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe

Silent Runners:

“Silent Runners.vbs”, revision 48, http://www.silentrunners.org/ Operating System: Windows XP Output limited to non-default values, except where indicated by “{++}” Startup items buried in registry: --------------------------------- HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++} “Gadu-Gadu” = ““C:\Program Files\Gadu-Gadu\gg.exe” /tray” [“Gadu-Gadu S.A.”] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++} “MKS_MENU” = “C:\Program Files\MKS\Bin\mks_menu.exe” [“MKS Sp. z o.o.”] “ABREGMON” = “C:\Program Files\MKS\Bin\ABregmon.exe” [“ArcaBit”] “NvCplDaemon” = “RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup” [MS] “avast!” = “C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe” [null data] HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}(Default) = (no title provided) -> {HKLM…CLSID} = “Adobe PDF Reader Link Helper” \InProcServer32(Default) = “C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll” [“Adobe Systems Incorporated”] {761497BB-D6F0-462C-B6EB-D4DAF1D92D43}(Default) = (no title provided) -> {HKLM…CLSID} = “SSVHelper Class” \InProcServer32(Default) = “C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll” [“Sun Microsystems, Inc.”] {AA58ED58-01DD-4d91-8333-CF10577473F7}(Default) = (no title provided) -> {HKLM…CLSID} = “Google Toolbar Helper” \InProcServer32(Default) = “c:\program files\google\googletoolbar3.dll” [“Google Inc.”] HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\ “{42071714-76d4-11d1-8b24-00a0c9068ff3}” = “Rozszerzenie CPL kadrowania wyświetlania” -> {HKLM…CLSID} = “Rozszerzenie CPL kadrowania wyświetlania” \InProcServer32(Default) = “deskpan.dll” [file not found] “{88895560-9AA2-1069-930E-00AA0030EBC8}” = “Rozszerzenie ikony HyperTerminalu” -> {HKLM…CLSID} = “HyperTerminal Icon Ext” \InProcServer32(Default) = “C:\WINDOWS\System32\hticons.dll” [“Hilgraeve, Inc.”] “{0006F045-0000-0000-C000-000000000046}” = “Microsoft Outlook Custom Icon Handler” -> {HKLM…CLSID} = “Rozszerzenie ikon plików programu Outlook” \InProcServer32(Default) = “C:\Program Files\Microsoft Office\Office10\OLKFSTUB.DLL” [MS] “{42042206-2D85-11D3-8CFF-005004838597}” = “Microsoft Office HTML Icon Handler” -> {HKLM…CLSID} = (no title provided) \InProcServer32(Default) = “C:\Program Files\Microsoft Office\Office10\msohev.dll” [MS] “{0A082D00-EC93-11D0-B1E6-80580BC10627}” = “Corel Media Folder Root Menu Handler” -> {HKLM…CLSID} = “Corel Media Folder Root Menu Handler” \InProcServer32(Default) = “C:\Corel\Graphics8\programs\CMFFld80.dll” [empty string] “{0FBF99C1-4127-11D1-B1E6-C17E96D9180A}” = “Folder To Corel Media Folder Menu Handler” -> {HKLM…CLSID} = “Folder To Corel Media Folder Menu Handler” \InProcServer32(Default) = “C:\Corel\Graphics8\programs\CMFFld80.dll” [empty string] “{854AF161-1AE1-11D1-AB9B-00C0F00683EB}” = “Corel Media Folder” -> {HKLM…CLSID} = “Corel Media Folder” \InProcServer32(Default) = “C:\Corel\Graphics8\programs\CMFFld80.dll” [empty string] “{E856F161-1AE5-11d1-AB9B-00C0F00683EB}” = “Corel Media Folder” -> {HKLM…CLSID} = “Corel Media Folder” \InProcServer32(Default) = “C:\Corel\Graphics8\programs\CMFFld80.dll” [empty string] “{CDB89701-262F-11D1-AB9C-00C0F00683EB}” = “Corel Media Find Folder” -> {HKLM…CLSID} = “Corel Media Find Folder” \InProcServer32(Default) = “C:\Corel\Graphics8\programs\CMFFld80.dll” [empty string] “{F8152501-455F-11D1-B1E6-444553540000}” = “Corel Media Folder Copy Hook Handler” -> {HKLM…CLSID} = “Corel Media Folder Copy Hook Handler” \InProcServer32(Default) = “C:\Corel\Graphics8\programs\CMFFld80.dll” [empty string] “{8E524B0D-04F0-11D1-B74A-00A0C90646A4}” = “IconFactTemp.NSIconHandlerFactory” -> {HKLM…CLSID} = (no title provided) \InProcServer32(Default) = “C:\Corel\Graphics8\programs\CNSFlt80.dll” [“Corel Corporation”] “{A2AC368A-F883-11D0-B745-00A0C90646A4}” = “NSFiltManDll.FiltManCom” -> {HKLM…CLSID} = (no title provided) \InProcServer32(Default) = “C:\Corel\Graphics8\programs\CNSFlt80.dll” [“Corel Corporation”] “{B63FCD5A-2396-11D1-B762-00A0C90646A4}” = “*]” (unwritable string) -> {HKLM…CLSID} = (no title provided) \InProcServer32(Default) = “C:\Corel\Graphics8\programs\CMFFnd80.dll” [“Corel Corporation”] “{E0D79304-84BE-11CE-9641-444553540000}” = “WinZip” -> {HKLM…CLSID} = “WinZip” \InProcServer32(Default) = “C:\PROGRA~1\WinZip\WZSHLSTB.DLL” [“WinZip Computing, Inc.”] “{E0D79305-84BE-11CE-9641-444553540000}” = “WinZip” -> {HKLM…CLSID} = “WinZip” \InProcServer32(Default) = “C:\PROGRA~1\WinZip\WZSHLSTB.DLL” [“WinZip Computing, Inc.”] “{E0D79306-84BE-11CE-9641-444553540000}” = “WinZip” -> {HKLM…CLSID} = “WinZip” \InProcServer32(Default) = “C:\PROGRA~1\WinZip\WZSHLSTB.DLL” [“WinZip Computing, Inc.”] “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” = “WinRAR shell extension” -> {HKLM…CLSID} = “WinRAR” \InProcServer32(Default) = “C:\Program Files\WinRAR\rarext.dll” [null data] “{1CDB2949-8F65-4355-8456-263E7C208A5D}” = “Desktop Explorer” -> {HKLM…CLSID} = “Desktop Explorer” \InProcServer32(Default) = “C:\WINDOWS\System32\nvshell.dll” [“NVIDIA Corporation”] “{1E9B04FB-F9E5-4718-997B-B8DA88302A47}” = “Desktop Explorer Menu” -> {HKLM…CLSID} = (no title provided) \InProcServer32(Default) = “C:\WINDOWS\System32\nvshell.dll” [“NVIDIA Corporation”] “{A70C977A-BF00-412C-90B7-034C51DA2439}” = “NvCpl DesktopContext Class” -> {HKLM…CLSID} = “DesktopContext Class” \InProcServer32(Default) = “C:\WINDOWS\System32\nvcpl.dll” [“NVIDIA Corporation”] “{1E9B04FB-F9E5-4718-997B-B8DA88302A48}” = “nView Desktop Context Menu” -> {HKLM…CLSID} = “nView Desktop Context Menu” \InProcServer32(Default) = “C:\WINDOWS\System32\nvshell.dll” [“NVIDIA Corporation”] “{FFB699E0-306A-11d3-8BD1-00104B6F7516}” = “Play on my TV helper” -> {HKLM…CLSID} = “NVIDIA CPL Extension” \InProcServer32(Default) = “C:\WINDOWS\System32\nvcpl.dll” [“NVIDIA Corporation”] “{640167b4-59b0-47a6-b335-a6b3c0695aea}” = “Portable Media Devices” -> {HKLM…CLSID} = “Portable Media Devices” \InProcServer32(Default) = “C:\WINDOWS\System32\Audiodev.dll” [MS] “{cc86590a-b60a-48e6-996b-41d25ed39a1e}” = “Portable Media Devices Menu” -> {HKLM…CLSID} = “Portable Media Devices Menu” \InProcServer32(Default) = “C:\WINDOWS\System32\Audiodev.dll” [MS] “{7C9D5882-CB4A-4090-96C8-430BFE8B795B}” = “Webroot Spy Sweeper Context Menu Integration” -> {HKLM…CLSID} = “Webroot Spy Sweeper Context Menu Integration” \InProcServer32(Default) = “C:\PROGRA~1\Webroot\SPYSWE~1\SSCtxMnu.dll” [file not found] “{472083B0-C522-11CF-8763-00608CC02F24}” = “avast” -> {HKLM…CLSID} = “avast” \InProcServer32(Default) = “C:\Program Files\Alwil Software\Avast4\ashShell.dll” [“ALWIL Software”] HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler\ INFECTION WARNING! “{2016a466-91a2-43c6-97d8-2fd380f065ef}” = “eitheror” -> {HKLM…CLSID} = (no title provided) \InProcServer32(Default) = “C:\WINDOWS\System32\higehsg.dll” [null data] HKLM\Software\Classes\Folder\shellex\ColumnHandlers\ {F9DB5320-233E-11D1-9F84-707F02C10627}(Default) = “PDF Column Info” -> {HKLM…CLSID} = “PDF Shell Extension” \InProcServer32(Default) = “C:\Program Files\Adobe\Acrobat 7.0\ActiveX\PDFShell.dll” [“Adobe Systems, Inc.”] HKLM\Software\Classes*\shellex\ContextMenuHandlers\ avast(Default) = “{472083B0-C522-11CF-8763-00608CC02F24}” -> {HKLM…CLSID} = “avast” \InProcServer32(Default) = “C:\Program Files\Alwil Software\Avast4\ashShell.dll” [“ALWIL Software”] MkS_Vir(Default) = “{CC4245C0-D511-11D0-8918-444553540000}” -> {HKLM…CLSID} = “MkS_Vir Shell Extension” \InProcServer32(Default) = “C:\Program Files\MKS\Bin\MkSShell.dll” [null data] VersionsMenu(Default) = “{03170921-4754-11cf-AB9A-00C0F00683EB}” -> {HKLM…CLSID} = “Corel Versions” \InProcServer32(Default) = “C:\COREL\Versions\CVersion.dll” [“Corel Corporation Limited”] WinRAR(Default) = “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” -> {HKLM…CLSID} = “WinRAR” \InProcServer32(Default) = “C:\Program Files\WinRAR\rarext.dll” [null data] WinZip(Default) = “{E0D79304-84BE-11CE-9641-444553540000}” -> {HKLM…CLSID} = “WinZip” \InProcServer32(Default) = “C:\PROGRA~1\WinZip\WZSHLSTB.DLL” [“WinZip Computing, Inc.”] WS_FTP(Default) = “{797F3885-5429-11D4-8823-0050DA59922B}” -> {HKLM…CLSID} = “RtClkCtxMenu Class” \InProcServer32(Default) = “d:\Moje dokumenty\Przemek\My eBooks\Small niche system\Adsense pages\auto_hits_machine\Ipswitch\WS_FTP Professional\wsftpsi.dll” [“Ipswitch, Inc. 10 Maguire Road - Suite 220 Lexington, MA 02421”] HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\ FolderToCorelMediaFolder(Default) = “{0FBF99C1-4127-11D1-B1E6-C17E96D9180A}” -> {HKLM…CLSID} = “Folder To Corel Media Folder Menu Handler” \InProcServer32(Default) = “C:\Corel\Graphics8\programs\CMFFld80.dll” [empty string] WinRAR(Default) = “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” -> {HKLM…CLSID} = “WinRAR” \InProcServer32(Default) = “C:\Program Files\WinRAR\rarext.dll” [null data] WinZip(Default) = “{E0D79304-84BE-11CE-9641-444553540000}” -> {HKLM…CLSID} = “WinZip” \InProcServer32(Default) = “C:\PROGRA~1\WinZip\WZSHLSTB.DLL” [“WinZip Computing, Inc.”] HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\ avast(Default) = “{472083B0-C522-11CF-8763-00608CC02F24}” -> {HKLM…CLSID} = “avast” \InProcServer32(Default) = “C:\Program Files\Alwil Software\Avast4\ashShell.dll” [“ALWIL Software”] MkS_Vir(Default) = “{CC4245C0-D511-11D0-8918-444553540000}” -> {HKLM…CLSID} = “MkS_Vir Shell Extension” \InProcServer32(Default) = “C:\Program Files\MKS\Bin\MkSShell.dll” [null data] SpySweeper(Default) = “{7C9D5882-CB4A-4090-96C8-430BFE8B795B}” -> {HKLM…CLSID} = “Webroot Spy Sweeper Context Menu Integration” \InProcServer32(Default) = “C:\PROGRA~1\Webroot\SPYSWE~1\SSCtxMnu.dll” [file not found] VersionsMenu(Default) = “{03170921-4754-11cf-AB9A-00C0F00683EB}” -> {HKLM…CLSID} = “Corel Versions” \InProcServer32(Default) = “C:\COREL\Versions\CVersion.dll” [“Corel Corporation Limited”] WinRAR(Default) = “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” -> {HKLM…CLSID} = “WinRAR” \InProcServer32(Default) = “C:\Program Files\WinRAR\rarext.dll” [null data] WinZip(Default) = “{E0D79304-84BE-11CE-9641-444553540000}” -> {HKLM…CLSID} = “WinZip” \InProcServer32(Default) = “C:\PROGRA~1\WinZip\WZSHLSTB.DLL” [“WinZip Computing, Inc.”] WS_FTP(Default) = “{797F3885-5429-11D4-8823-0050DA59922B}” -> {HKLM…CLSID} = “RtClkCtxMenu Class” \InProcServer32(Default) = “d:\Moje dokumenty\Przemek\My eBooks\Small niche system\Adsense pages\auto_hits_machine\Ipswitch\WS_FTP Professional\wsftpsi.dll” [“Ipswitch, Inc. 10 Maguire Road - Suite 220 Lexington, MA 02421”] Active Desktop and Wallpaper: ----------------------------- Active Desktop is disabled at this entry: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState HKCU\Control Panel\Desktop\ “Wallpaper” = “C:\Documents and Settings\Przemek Sowa\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp” Enabled Screen Saver: --------------------- HKCU\Control Panel\Desktop\ “SCRNSAVE.EXE” = “C:\WINDOWS\System32\AVASTSS.scr” [“ALWIL Software”] Enabled Scheduled Tasks: ------------------------ “MkSUpdate” -> launches: “C:\Program Files\MKS\bin\mks_upd.exe Task” [“MkS Sp. z o. o.”] Winsock2 Service Provider DLLs: ------------------------------- Namespace Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++} 000000000001\LibraryPath = “%SystemRoot%\System32\mswsock.dll” [MS] 000000000002\LibraryPath = “%SystemRoot%\System32\winrnr.dll” [MS] 000000000003\LibraryPath = “%SystemRoot%\System32\mswsock.dll” [MS] Transport Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++} 0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range: %SystemRoot%\system32\mswsock.dll [MS], 01 - 03, 06 - 13 %SystemRoot%\system32\rsvpsp.dll [MS], 04 - 05 Toolbars, Explorer Bars, Extensions: ------------------------------------ Toolbars HKCU\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ “{2318C2B1-4965-11D4-9B18-009027A5CD4F}” -> {HKLM…CLSID} = “&Google” \InProcServer32(Default) = “c:\program files\google\googletoolbar3.dll” [“Google Inc.”] HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\ “{2318C2B1-4965-11D4-9B18-009027A5CD4F}” -> {HKLM…CLSID} = “&Google” \InProcServer32(Default) = “c:\program files\google\googletoolbar3.dll” [“Google Inc.”] HKLM\Software\Microsoft\Internet Explorer\Toolbar\ “{2318C2B1-4965-11D4-9B18-009027A5CD4F}” = (no title provided) -> {HKLM…CLSID} = “&Google” \InProcServer32(Default) = “c:\program files\google\googletoolbar3.dll” [“Google Inc.”] Running Services (Display Name, Service Name, Path {Service DLL}): ------------------------------------------------------------------ avast! Antivirus, avast! Antivirus, ““C:\Program Files\Alwil Software\Avast4\ashServ.exe”” [null data] avast! iAVS4 Control Service, aswUpdSv, ““C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe”” [null data] avast! Web Scanner, avast! Web Scanner, ““C:\Program Files\Alwil Software\Avast4\ashWebSv.exe” /service” [“ALWIL Software”] LexBce Server, LexBceS, “C:\WINDOWS\system32\LEXBCES.EXE” [“Lexmark International, Inc.”] Machine Debug Manager, MDM, ““C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe”” [MS] NVIDIA Display Driver Service, NVSvc, “C:\WINDOWS\System32\nvsvc32.exe” [“NVIDIA Corporation”] Windows User Mode Driver Framework, UMWdf, “C:\WINDOWS\System32\wdfmgr.exe” [MS] Print Monitors: --------------- HKLM\System\CurrentControlSet\Control\Print\Monitors\ Lexmark Network Port\Driver = “LEXLMPM.DLL” [“Lexmark International, Inc.”] ---------- + This report excludes default entries except where indicated. + To see *everywhere* the script checks and *everything* it finds, launch it from a command prompt or a shortcut with the -all parameter. + The search for DESKTOP.INI DLL launch points on all local fixed drives took 424 seconds. + The search for all Registry CLSIDs containing dormant Explorer Bars took 919 seconds. ---------- (total run time: 3001 seconds)

Btw - na pasku szybkiego dostępu zainstalowała mi się ikonka “system alert”. Opis mówi (po angielsku), że system wykrył większą liczbę działających spyware’ów i żeby się ich pozbyć kliknij tutaj. Po kliknięciu (zarówno lewym, jak i prawym przyciskiem myszy) otwiera przeglądarkę - adres: http://spydawn.com/?aff=334 Tam, jak widać z adresu, affiliate numer 334 oferuje nam fantastyczny program antywirusowy po niesamowicie korzystnej, promocyjnej wręcz, cenie :^o Jak się pozbyć tego badziewia?

adam9870 · 18 Luty 2007 15:57

Usuń wszystko co zostało znalezione przez ewido.

Start => uruchom => wpisz cmd i kliknij OK => w konsoli, która się otworzy wpisz:

Ściągasz program KillBox, zaznaczasz Delete on reboot , w polu full path of file wklej ścieżki:

C:\Program Files\Avant Browser~tmp0374.exe

C:\WINDOWS\System32\higehsg.dll

po wklejeniu każdej ścieżki z osobna klikasz na czerwonego iksa, ale dopiero po wklejeniu ostatniej zgadzasz się na restart.

Start => uruchom => wpisz regedit i kliknij OK => przejdź do klucza:

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler

i skasuj z prawokliku znajdującą się tam wartość {2016a466-91a2-43c6-97d8-2fd380f065ef}

Usuń wpis HJT.

Użyj narzędzia SmitFraudFix z opcji numer 2 w trybie awaryjnym.

Po wykonaniu wklej nowe logi + zawartość pliku c:\rapport.txt.

Voidan · 18 Luty 2007 21:37

Nie wiem czemu, ale te komendy wyłączenia i usunięcia Microsoft Updater2 nie działają. Wyłączyłem ten proces w services, ale usunąć nie mogę. Wyświetla komunikat:

adam9870 · 18 Luty 2007 22:00

Otwórz notatnik i wklej w nim to:

Plik >>> Zapisz jako >>> Zmień rozszerzenie z TXT na Wszystkie pliki >>> Zapisz pod nazwą FIX.BAT i uruchom go w trybie awaryjnym.

Ewentualnie jeśli powyższy sposób nie zadziała to zrób tak:

Start => Uruchom => wpisz services.msc => zatrzymaj i wyłącz usługę ieupdater2 następnie odpalasz HijackThis Misc Tools => Delete NT service => wpisz Microsoft IE Updater2 => Ok i zresetuj komputer.

Voidan · 19 Luty 2007 13:57

Nowe logi do kontroli:

HijackThis:

Logfile of HijackThis v1.99.1 Scan saved at 14:57:15, on 2007-02-19 Platform: Windows XP (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2600.0000) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\LEXBCES.EXE C:\WINDOWS\system32\LEXPPS.EXE C:\WINDOWS\system32\spoolsv.exe C:\Program Files\MKS\Bin\mks_menu.exe C:\Program Files\MKS\Bin\ABregmon.exe C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\Program Files\Gadu-Gadu\gg.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe C:\WINDOWS\System32\nvsvc32.exe C:\WINDOWS\System32\wdfmgr.exe C:\Program Files\Avant Browser\avant.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\WINDOWS\System32\wuauclt.exe C:\WINDOWS\System32\taskmgr.exe C:\WINDOWS\system32\NOTEPAD.EXE d:\Moje dokumenty\Przemek\Antyviry\hijackthis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll O4 - HKLM…\Run: [MKS_MENU] C:\Program Files\MKS\Bin\mks_menu.exe O4 - HKLM…\Run: [ABREGMON] C:\Program Files\MKS\Bin\ABregmon.exe O4 - HKLM…\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup O4 - HKLM…\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKCU…\Run: [Gadu-Gadu] “C:\Program Files\Gadu-Gadu\gg.exe” /tray O8 - Extra context menu item: Blokuj wszystkie obrazy z tego serwera - C:\Program Files\Avant Browser\AddAllToADBlackList.htm O8 - Extra context menu item: Dodaj do listy blokowanych reklam - C:\Program Files\Avant Browser\AddToADBlackList.htm O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O8 - Extra context menu item: Otwórz w nowym Avant Browser - C:\Program Files\Avant Browser\OpenInNewBrowser.htm O8 - Extra context menu item: Otwórz wszystkie adresy z tej strony… - C:\Program Files\Avant Browser\OpenAllLinks.htm O8 - Extra context menu item: Podświetl - C:\Program Files\Avant Browser\Highlight.htm O8 - Extra context menu item: Szukaj - C:\Program Files\Avant Browser\Search.htm O12 - Plugin for .mid: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin2.dll O12 - Plugin for .mov: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin.dll O12 - Plugin for .mpg: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin3.dll O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://downloads.ewido.net/ewidoOnlineScan.cab O16 - DPF: {68282C51-9459-467B-95BF-3C0E89627E55} (MksSkanerOnline Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing) O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe

Silent Runners:

“Silent Runners.vbs”, revision 48, http://www.silentrunners.org/ Operating System: Windows XP Output limited to non-default values, except where indicated by “{++}” Startup items buried in registry: --------------------------------- HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++} “Gadu-Gadu” = ““C:\Program Files\Gadu-Gadu\gg.exe” /tray” [“Gadu-Gadu S.A.”] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++} “MKS_MENU” = “C:\Program Files\MKS\Bin\mks_menu.exe” [“MKS Sp. z o.o.”] “ABREGMON” = “C:\Program Files\MKS\Bin\ABregmon.exe” [“ArcaBit”] “NvCplDaemon” = “RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup” [MS] “avast!” = “C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe” [null data] HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}(Default) = (no title provided) -> {HKLM…CLSID} = “Adobe PDF Reader Link Helper” \InProcServer32(Default) = “C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll” [“Adobe Systems Incorporated”] {761497BB-D6F0-462C-B6EB-D4DAF1D92D43}(Default) = (no title provided) -> {HKLM…CLSID} = “SSVHelper Class” \InProcServer32(Default) = “C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll” [“Sun Microsystems, Inc.”] {AA58ED58-01DD-4d91-8333-CF10577473F7}(Default) = (no title provided) -> {HKLM…CLSID} = “Google Toolbar Helper” \InProcServer32(Default) = “c:\program files\google\googletoolbar3.dll” [“Google Inc.”] HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\ “{42071714-76d4-11d1-8b24-00a0c9068ff3}” = “Rozszerzenie CPL kadrowania wyświetlania” -> {HKLM…CLSID} = “Rozszerzenie CPL kadrowania wyświetlania” \InProcServer32(Default) = “deskpan.dll” [file not found] “{88895560-9AA2-1069-930E-00AA0030EBC8}” = “Rozszerzenie ikony HyperTerminalu” -> {HKLM…CLSID} = “HyperTerminal Icon Ext” \InProcServer32(Default) = “C:\WINDOWS\System32\hticons.dll” [“Hilgraeve, Inc.”] “{0006F045-0000-0000-C000-000000000046}” = “Microsoft Outlook Custom Icon Handler” -> {HKLM…CLSID} = “Rozszerzenie ikon plików programu Outlook” \InProcServer32(Default) = “C:\Program Files\Microsoft Office\Office10\OLKFSTUB.DLL” [MS] “{42042206-2D85-11D3-8CFF-005004838597}” = “Microsoft Office HTML Icon Handler” -> {HKLM…CLSID} = (no title provided) \InProcServer32(Default) = “C:\Program Files\Microsoft Office\Office10\msohev.dll” [MS] “{0A082D00-EC93-11D0-B1E6-80580BC10627}” = “Corel Media Folder Root Menu Handler” -> {HKLM…CLSID} = “Corel Media Folder Root Menu Handler” \InProcServer32(Default) = “C:\Corel\Graphics8\programs\CMFFld80.dll” [empty string] “{0FBF99C1-4127-11D1-B1E6-C17E96D9180A}” = “Folder To Corel Media Folder Menu Handler” -> {HKLM…CLSID} = “Folder To Corel Media Folder Menu Handler” \InProcServer32(Default) = “C:\Corel\Graphics8\programs\CMFFld80.dll” [empty string] “{854AF161-1AE1-11D1-AB9B-00C0F00683EB}” = “Corel Media Folder” -> {HKLM…CLSID} = “Corel Media Folder” \InProcServer32(Default) = “C:\Corel\Graphics8\programs\CMFFld80.dll” [empty string] “{E856F161-1AE5-11d1-AB9B-00C0F00683EB}” = “Corel Media Folder” -> {HKLM…CLSID} = “Corel Media Folder” \InProcServer32(Default) = “C:\Corel\Graphics8\programs\CMFFld80.dll” [empty string] “{CDB89701-262F-11D1-AB9C-00C0F00683EB}” = “Corel Media Find Folder” -> {HKLM…CLSID} = “Corel Media Find Folder” \InProcServer32(Default) = “C:\Corel\Graphics8\programs\CMFFld80.dll” [empty string] “{F8152501-455F-11D1-B1E6-444553540000}” = “Corel Media Folder Copy Hook Handler” -> {HKLM…CLSID} = “Corel Media Folder Copy Hook Handler” \InProcServer32(Default) = “C:\Corel\Graphics8\programs\CMFFld80.dll” [empty string] “{8E524B0D-04F0-11D1-B74A-00A0C90646A4}” = “IconFactTemp.NSIconHandlerFactory” -> {HKLM…CLSID} = (no title provided) \InProcServer32(Default) = “C:\Corel\Graphics8\programs\CNSFlt80.dll” [“Corel Corporation”] “{A2AC368A-F883-11D0-B745-00A0C90646A4}” = “NSFiltManDll.FiltManCom” -> {HKLM…CLSID} = (no title provided) \InProcServer32(Default) = “C:\Corel\Graphics8\programs\CNSFlt80.dll” [“Corel Corporation”] “{B63FCD5A-2396-11D1-B762-00A0C90646A4}” = “*” (unwritable string) -> {HKLM…CLSID} = (no title provided) \InProcServer32(Default) = “C:\Corel\Graphics8\programs\CMFFnd80.dll” [“Corel Corporation”] “{E0D79304-84BE-11CE-9641-444553540000}” = “WinZip” -> {HKLM…CLSID} = “WinZip” \InProcServer32(Default) = “C:\PROGRA~1\WinZip\WZSHLSTB.DLL” [“WinZip Computing, Inc.”] “{E0D79305-84BE-11CE-9641-444553540000}” = “WinZip” -> {HKLM…CLSID} = “WinZip” \InProcServer32(Default) = “C:\PROGRA~1\WinZip\WZSHLSTB.DLL” [“WinZip Computing, Inc.”] “{E0D79306-84BE-11CE-9641-444553540000}” = “WinZip” -> {HKLM…CLSID} = “WinZip” \InProcServer32(Default) = “C:\PROGRA~1\WinZip\WZSHLSTB.DLL” [“WinZip Computing, Inc.”] “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” = “WinRAR shell extension” -> {HKLM…CLSID} = “WinRAR” \InProcServer32(Default) = “C:\Program Files\WinRAR\rarext.dll” [null data] “{1CDB2949-8F65-4355-8456-263E7C208A5D}” = “Desktop Explorer” -> {HKLM…CLSID} = “Desktop Explorer” \InProcServer32(Default) = “C:\WINDOWS\System32\nvshell.dll” [“NVIDIA Corporation”] “{1E9B04FB-F9E5-4718-997B-B8DA88302A47}” = “Desktop Explorer Menu” -> {HKLM…CLSID} = (no title provided) \InProcServer32(Default) = “C:\WINDOWS\System32\nvshell.dll” [“NVIDIA Corporation”] “{A70C977A-BF00-412C-90B7-034C51DA2439}” = “NvCpl DesktopContext Class” -> {HKLM…CLSID} = “DesktopContext Class” \InProcServer32(Default) = “C:\WINDOWS\System32\nvcpl.dll” [“NVIDIA Corporation”] “{1E9B04FB-F9E5-4718-997B-B8DA88302A48}” = “nView Desktop Context Menu” -> {HKLM…CLSID} = “nView Desktop Context Menu” \InProcServer32(Default) = “C:\WINDOWS\System32\nvshell.dll” [“NVIDIA Corporation”] “{FFB699E0-306A-11d3-8BD1-00104B6F7516}” = “Play on my TV helper” -> {HKLM…CLSID} = “NVIDIA CPL Extension” \InProcServer32(Default) = “C:\WINDOWS\System32\nvcpl.dll” [“NVIDIA Corporation”] “{640167b4-59b0-47a6-b335-a6b3c0695aea}” = “Portable Media Devices” -> {HKLM…CLSID} = “Portable Media Devices” \InProcServer32(Default) = “C:\WINDOWS\System32\Audiodev.dll” [MS] “{cc86590a-b60a-48e6-996b-41d25ed39a1e}” = “Portable Media Devices Menu” -> {HKLM…CLSID} = “Portable Media Devices Menu” \InProcServer32(Default) = “C:\WINDOWS\System32\Audiodev.dll” [MS] “{7C9D5882-CB4A-4090-96C8-430BFE8B795B}” = “Webroot Spy Sweeper Context Menu Integration” -> {HKLM…CLSID} = “Webroot Spy Sweeper Context Menu Integration” \InProcServer32(Default) = “C:\PROGRA~1\Webroot\SPYSWE~1\SSCtxMnu.dll” [file not found] “{472083B0-C522-11CF-8763-00608CC02F24}” = “avast” -> {HKLM…CLSID} = “avast” \InProcServer32(Default) = “C:\Program Files\Alwil Software\Avast4\ashShell.dll” [“ALWIL Software”] HKLM\Software\Classes\Folder\shellex\ColumnHandlers\ {F9DB5320-233E-11D1-9F84-707F02C10627}(Default) = “PDF Column Info” -> {HKLM…CLSID} = “PDF Shell Extension” \InProcServer32(Default) = “C:\Program Files\Adobe\Acrobat 7.0\ActiveX\PDFShell.dll” [“Adobe Systems, Inc.”] HKLM\Software\Classes*\shellex\ContextMenuHandlers\ avast(Default) = “{472083B0-C522-11CF-8763-00608CC02F24}” -> {HKLM…CLSID} = “avast” \InProcServer32(Default) = “C:\Program Files\Alwil Software\Avast4\ashShell.dll” [“ALWIL Software”] MkS_Vir(Default) = “{CC4245C0-D511-11D0-8918-444553540000}” -> {HKLM…CLSID} = “MkS_Vir Shell Extension” \InProcServer32(Default) = “C:\Program Files\MKS\Bin\MkSShell.dll” [null data] VersionsMenu(Default) = “{03170921-4754-11cf-AB9A-00C0F00683EB}” -> {HKLM…CLSID} = “Corel Versions” \InProcServer32(Default) = “C:\COREL\Versions\CVersion.dll” [“Corel Corporation Limited”] WinRAR(Default) = “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” -> {HKLM…CLSID} = “WinRAR” \InProcServer32(Default) = “C:\Program Files\WinRAR\rarext.dll” [null data] WinZip(Default) = “{E0D79304-84BE-11CE-9641-444553540000}” -> {HKLM…CLSID} = “WinZip” \InProcServer32(Default) = “C:\PROGRA~1\WinZip\WZSHLSTB.DLL” [“WinZip Computing, Inc.”] WS_FTP(Default) = “{797F3885-5429-11D4-8823-0050DA59922B}” -> {HKLM…CLSID} = “RtClkCtxMenu Class” \InProcServer32(Default) = “d:\Moje dokumenty\Przemek\My eBooks\Small niche system\Adsense pages\auto_hits_machine\Ipswitch\WS_FTP Professional\wsftpsi.dll” [“Ipswitch, Inc. 10 Maguire Road - Suite 220 Lexington, MA 02421”] HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\ FolderToCorelMediaFolder(Default) = “{0FBF99C1-4127-11D1-B1E6-C17E96D9180A}” -> {HKLM…CLSID} = “Folder To Corel Media Folder Menu Handler” \InProcServer32(Default) = “C:\Corel\Graphics8\programs\CMFFld80.dll” [empty string] WinRAR(Default) = “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” -> {HKLM…CLSID} = “WinRAR” \InProcServer32(Default) = “C:\Program Files\WinRAR\rarext.dll” [null data] WinZip(Default) = “{E0D79304-84BE-11CE-9641-444553540000}” -> {HKLM…CLSID} = “WinZip” \InProcServer32(Default) = “C:\PROGRA~1\WinZip\WZSHLSTB.DLL” [“WinZip Computing, Inc.”] HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\ avast(Default) = “{472083B0-C522-11CF-8763-00608CC02F24}” -> {HKLM…CLSID} = “avast” \InProcServer32(Default) = “C:\Program Files\Alwil Software\Avast4\ashShell.dll” [“ALWIL Software”] MkS_Vir(Default) = “{CC4245C0-D511-11D0-8918-444553540000}” -> {HKLM…CLSID} = “MkS_Vir Shell Extension” \InProcServer32(Default) = “C:\Program Files\MKS\Bin\MkSShell.dll” [null data] SpySweeper(Default) = “{7C9D5882-CB4A-4090-96C8-430BFE8B795B}” -> {HKLM…CLSID} = “Webroot Spy Sweeper Context Menu Integration” \InProcServer32(Default) = “C:\PROGRA~1\Webroot\SPYSWE~1\SSCtxMnu.dll” [file not found] VersionsMenu(Default) = “{03170921-4754-11cf-AB9A-00C0F00683EB}” -> {HKLM…CLSID} = “Corel Versions” \InProcServer32(Default) = “C:\COREL\Versions\CVersion.dll” [“Corel Corporation Limited”] WinRAR(Default) = “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” -> {HKLM…CLSID} = “WinRAR” \InProcServer32(Default) = “C:\Program Files\WinRAR\rarext.dll” [null data] WinZip(Default) = “{E0D79304-84BE-11CE-9641-444553540000}” -> {HKLM…CLSID} = “WinZip” \InProcServer32(Default) = “C:\PROGRA~1\WinZip\WZSHLSTB.DLL” [“WinZip Computing, Inc.”] WS_FTP(Default) = “{797F3885-5429-11D4-8823-0050DA59922B}” -> {HKLM…CLSID} = “RtClkCtxMenu Class” \InProcServer32(Default) = “d:\Moje dokumenty\Przemek\My eBooks\Small niche system\Adsense pages\auto_hits_machine\Ipswitch\WS_FTP Professional\wsftpsi.dll” [“Ipswitch, Inc. 10 Maguire Road - Suite 220 Lexington, MA 02421”] Active Desktop and Wallpaper: ----------------------------- Active Desktop is disabled at this entry: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState HKCU\Control Panel\Desktop\ “Wallpaper” = “C:\Documents and Settings\Przemek Sowa\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp” Enabled Screen Saver: --------------------- HKCU\Control Panel\Desktop\ “SCRNSAVE.EXE” = “C:\WINDOWS\System32\AVASTSS.scr” [“ALWIL Software”] Enabled Scheduled Tasks: ------------------------ “MkSUpdate” -> launches: “C:\Program Files\MKS\bin\mks_upd.exe Task” [“MkS Sp. z o. o.”] Winsock2 Service Provider DLLs: ------------------------------- Namespace Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++} 000000000001\LibraryPath = “%SystemRoot%\System32\mswsock.dll” [MS] 000000000002\LibraryPath = “%SystemRoot%\System32\winrnr.dll” [MS] 000000000003\LibraryPath = “%SystemRoot%\System32\mswsock.dll” [MS] Transport Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++} 0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range: %SystemRoot%\system32\mswsock.dll [MS], 01 - 03, 06 - 13 %SystemRoot%\system32\rsvpsp.dll [MS], 04 - 05 Toolbars, Explorer Bars, Extensions: ------------------------------------ Toolbars HKCU\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ “{2318C2B1-4965-11D4-9B18-009027A5CD4F}” -> {HKLM…CLSID} = “&Google” \InProcServer32(Default) = “c:\program files\google\googletoolbar3.dll” [“Google Inc.”] HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\ “{2318C2B1-4965-11D4-9B18-009027A5CD4F}” -> {HKLM…CLSID} = “&Google” \InProcServer32(Default) = “c:\program files\google\googletoolbar3.dll” [“Google Inc.”] HKLM\Software\Microsoft\Internet Explorer\Toolbar\ “{2318C2B1-4965-11D4-9B18-009027A5CD4F}” = (no title provided) -> {HKLM…CLSID} = “&Google” \InProcServer32(Default) = “c:\program files\google\googletoolbar3.dll” [“Google Inc.”] Running Services (Display Name, Service Name, Path {Service DLL}): ------------------------------------------------------------------ avast! Antivirus, avast! Antivirus, ““C:\Program Files\Alwil Software\Avast4\ashServ.exe”” [null data] avast! iAVS4 Control Service, aswUpdSv, ““C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe”” [null data] avast! Web Scanner, avast! Web Scanner, ““C:\Program Files\Alwil Software\Avast4\ashWebSv.exe” /service” [“ALWIL Software”] LexBce Server, LexBceS, “C:\WINDOWS\system32\LEXBCES.EXE” [“Lexmark International, Inc.”] Machine Debug Manager, MDM, ““C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe”” [MS] NVIDIA Display Driver Service, NVSvc, “C:\WINDOWS\System32\nvsvc32.exe” [“NVIDIA Corporation”] Windows User Mode Driver Framework, UMWdf, “C:\WINDOWS\System32\wdfmgr.exe” [MS] Print Monitors: --------------- HKLM\System\CurrentControlSet\Control\Print\Monitors\ Lexmark Network Port\Driver = “LEXLMPM.DLL” [“Lexmark International, Inc.”] ---------- + This report excludes default entries except where indicated. + To see *everywhere* the script checks and *everything* it finds, launch it from a command prompt or a shortcut with the -all parameter. + To search all directories of local fixed drives for DESKTOP.INI DLL launch points and all Registry CLSIDs for dormant Explorer Bars, use the -supp parameter or answer “No” at the first message box. ---------- (total run time: 1971 seconds, including 18 seconds for message boxes)

SmitFraudFix rapport:

SmitFraudFix v2.142 Scan done at 23:57:22,91, 2007-02-18 Run from d:\Moje dokumenty\Przemek\Antyviry\SmitfraudFix OS: Microsoft Windows XP [Wersja 5.1.2600] - Windows_NT The filesystem type is FAT32 Fix run in safe mode »»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Before SmitFraudFix !Attention, following keys are not inevitably infected! SrchSTS.exe by S!Ri Search SharedTaskScheduler’s .dll »»»»»»»»»»»»»»»»»»»»»»»» Killing process »»»»»»»»»»»»»»»»»»»»»»»» hosts 127.0.0.1 localhost 127.0.0.1 localhost 127.0.0.1 localhost 127.0.0.1 localhost 127.0.0.1 localhost 127.0.0.1 localhost 127.0.0.1 localhost »»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix GenericRenosFix by S!Ri »»»»»»»»»»»»»»»»»»»»»»»» Deleting infected files C:\WINDOWS\system32\dlh9jkdq?.exe Deleted C:\WINDOWS\system32\taskdir.exe Deleted C:\DOCUME~1\ALLUSE~1\MENUST~1\Online Security Guide.url Deleted C:\DOCUME~1\ALLUSE~1\MENUST~1\Security Troubleshooting.url Deleted »»»»»»»»»»»»»»»»»»»»»»»» Deleting Temp Files »»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System !Attention, following keys are not inevitably infected! [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] “system”="" »»»»»»»»»»»»»»»»»»»»»»»» Registry Cleaning Registry Cleaning done. »»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler After SmitFraudFix !Attention, following keys are not inevitably infected! SrchSTS.exe by S!Ri Search SharedTaskScheduler’s .dll »»»»»»»»»»»»»»»»»»»»»»»» End

adam9870 · 19 Luty 2007 14:23

Już jest Ok.

Proponuję zainstalować dodatek Service Pack 2. Poprawia on bezpieczeństwo w systemie etc. Możesz go pobrać stąd:

http://dobreprogramy.pl/index.php?dz=2&t=35&id=795

Voidan · 19 Luty 2007 14:49

WIELKIE DZIĘKI!