Zablokowany Task Manager [log]

[sfeter]

Cztery dni temu kupilem komputer i powoli instaluje na nim programy wczoraj “odkrylem” ze nie mam dostepu do Task Managera. Jestem jedynym uzytkownikiem zalogowanym jako admin. Podejzewam jakiegos wirusa ale nie wiem jak i gdzie go szukac

Logfile of Trend Micro HijackThis v2.0.0 (BETA)

Scan saved at 06:40:51, on 2008-03-16

Platform: Windows XP SP3, v.3282 (WinNT 5.01.2600)

Boot mode: Normal


Running processes:

I:\WINDOWS\System32\smss.exe

I:\WINDOWS\system32\winlogon.exe

I:\WINDOWS\system32\services.exe

I:\WINDOWS\system32\lsass.exe

I:\WINDOWS\system32\svchost.exe

I:\WINDOWS\System32\svchost.exe

I:\Program Files\Alwil Software\Avast4\aswUpdSv.exe

I:\Program Files\Alwil Software\Avast4\ashServ.exe

I:\WINDOWS\system32\spoolsv.exe

I:\WINDOWS\Explorer.EXE

I:\WINDOWS\system32\ctfmon.exe

I:\WINDOWS\system32\RUNDLL32.EXE

I:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe

I:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

I:\Program Files\Canon\MyPrinter\BJMyPrt.exe

I:\Program Files\PowerISO\PWRISOVM.EXE

I:\WINDOWS\RTHDCPL.EXE

I:\Program Files\Winamp\winampa.exe

I:\Program Files\Tlen.pl\tlen.exe

I:\Program Files\Gadu-Gadu\gg.exe

I:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe

I:\Program Files\Google\Google Updater\GoogleUpdater.exe

I:\Program Files\Logitech\SetPoint\SetPoint.exe

I:\Program Files\SEC\Natural Color Pro\NCProTray.exe

I:\Program Files\Common Files\Logitech\KhalShared\KHALMNPR.EXE

I:\WINDOWS\BricoPacks\Vista Inspirat 2\YzShadow\YzShadow.exe

I:\Program Files\Bat\X_Bat.exe

I:\WINDOWS\system32\aspimgr.exe

I:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

I:\WINDOWS\system32\nvsvc32.exe

I:\Program Files\Alwil Software\Avast4\ashMaiSv.exe

I:\Program Files\Alwil Software\Avast4\ashWebSv.exe

I:\WINDOWS\System32\svchost.exe

I:\Program Files\Azureus\Azureus.exe

I:\Program Files\Internet Explorer\IEXPLORE.EXE

I:\Documents and Settings\sfeter\Local Settings\Temporary Internet Files\Content.IE5\V5ZJ60XO\HiJackThis_v2[1].exe


R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://onet.pl/

O2 - BHO: BatBHO - {63F7460B-C831-4142-A4AA-5EC303EC4343} - I:\Program Files\Bat\Bat.dll

O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - I:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL

O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - i:\program files\google\googletoolbar1.dll

O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - I:\Program Files\Google\GoogleToolbarNotifier\2.1.1119.1736\swg.dll

O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - i:\program files\google\googletoolbar1.dll

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE I:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [nwiz] nwiz.exe /install

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE I:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit

O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE

O4 - HKLM\..\Run: [NeroFilterCheck] I:\WINDOWS\system32\NeroCheck.exe

O4 - HKLM\..\Run: [GrooveMonitor] "I:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"

O4 - HKLM\..\Run: [avast!] I:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

O4 - HKLM\..\Run: [CanonMyPrinter] I:\Program Files\Canon\MyPrinter\BJMyPrt.exe /logon

O4 - HKLM\..\Run: [PWRISOVM.EXE] I:\Program Files\PowerISO\PWRISOVM.EXE

O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE

O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE

O4 - HKLM\..\Run: [WinampAgent] "I:\Program Files\Winamp\winampa.exe"

O4 - HKCU\..\Run: [swg] I:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

O4 - HKCU\..\Run: [Komunikator] I:\Program Files\Tlen.pl\tlen.exe

O4 - HKCU\..\Run: [Gadu-Gadu] "I:\Program Files\Gadu-Gadu\gg.exe" /tray

O4 - HKCU\..\Run: [RocketDock] "I:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe"

O4 - HKCU\..\Run: [ctfmon.exe] I:\WINDOWS\system32\ctfmon.exe

O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] I:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] I:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] I:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] I:\WINDOWS\system32\CTFMON.EXE (User 'Default user')

O4 - Startup: Adobe Gamma.lnk = I:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe

O4 - Startup: Bat - Auto Update.lnk = I:\Program Files\Bat\Bat.exe

O4 - Startup: RocketDock.lnk = I:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe

O4 - Startup: TransBar.lnk = I:\WINDOWS\BricoPacks\Vista Inspirat 2\TransBar\TransBar.exe

O4 - Startup: Y'z Shadow.lnk = I:\WINDOWS\BricoPacks\Vista Inspirat 2\YzShadow\YzShadow.exe

O4 - Global Startup: Google Updater.lnk = I:\Program Files\Google\Google Updater\GoogleUpdater.exe

O4 - Global Startup: Logitech SetPoint.lnk = ?

O4 - Global Startup: NCProTray.lnk = ?

O8 - Extra context menu item: E&ksportuj do programu Microsoft Excel - res://I:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000

O9 - Extra button: Wyslij do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - I:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll

O9 - Extra 'Tools' menuitem: Wyslij &do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - I:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - I:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - I:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - I:\Program Files\Messenger\msmsgs.exe

O10 - Unknown file in Winsock LSP: i:\windows\system32\nwprovau.dll

O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - I:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL

O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - I:\WINDOWS\system32\browseui.dll

O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - I:\WINDOWS\system32\browseui.dll

O23 - Service: Adobe LM Service - Adobe Systems - I:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe

O23 - Service: Microsoft ASPI Manager (aspimgr) - Unknown owner - I:\WINDOWS\system32\aspimgr.exe

O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - I:\Program Files\Alwil Software\Avast4\aswUpdSv.exe

O23 - Service: avast! Antivirus - ALWIL Software - I:\Program Files\Alwil Software\Avast4\ashServ.exe

O23 - Service: avast! Mail Scanner - ALWIL Software - I:\Program Files\Alwil Software\Avast4\ashMaiSv.exe

O23 - Service: avast! Web Scanner - ALWIL Software - I:\Program Files\Alwil Software\Avast4\ashWebSv.exe

O23 - Service: Google Updater Service (gusvc) - Google - I:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - I:\WINDOWS\system32\nvsvc32.exe


--

End of file - 7143 bytes

jesli ktos widzi tu problem to prosze o porade

dzieki

[5uck (Suck)]

tak, masz syfa w: I:\WINDOWS\system32\aspimgr.exe

sciągnij, zainstaluj i przeskanuj kompa spybot search&destroy

lub posłuż się tym: http://www.2-spyware.com/remove-asprox.html

[sfeter]

dzieki, sprawdze jak tylko wroce do domu

[addmir (Dmirecki)]

start >> uruchom >> wklep cmd

wpisz:

sc stop aspimgr >> ENTER

sc delete aspimgr >> ENTER

Pobierz ComboFix, ale nie uruchamiaj

Wklej do notatnika:

File::

C:\WINDOWS\system32\aspimgr.exe

Plik -> zapisz jako -> CFScript.txt

Przeciągnij i upuść ikonkę CFScript.txt na ikonkę ComboFix.exe tak jak tu ->

Powinno się rozpocząć usuwanie i powstanie log, daj ten log na forum + nowy log z HijackThis.

Jeśli wszystko pójdzie dobrze, to po restarcie usuń ręcznie plik C: ** Qoobox**

[sfeter]

>addmir

poszedlem za twoimi wskazowkami i mam juz dostep do task managera

wielkie dzieki

log z hijackthis:

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 22:39:53, on 2008-03-16

Platform: Windows XP SP3, v.3282 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP3 (6.00.2900.3282)

Boot mode: Normal


Running processes:

I:\WINDOWS\System32\smss.exe

I:\WINDOWS\system32\winlogon.exe

I:\WINDOWS\system32\services.exe

I:\WINDOWS\system32\lsass.exe

I:\WINDOWS\system32\svchost.exe

I:\WINDOWS\System32\svchost.exe

I:\Program Files\Alwil Software\Avast4\aswUpdSv.exe

I:\Program Files\Alwil Software\Avast4\ashServ.exe

I:\WINDOWS\system32\spoolsv.exe

I:\WINDOWS\system32\ctfmon.exe

I:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

I:\WINDOWS\system32\nvsvc32.exe

I:\WINDOWS\system32\RUNDLL32.EXE

I:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe

I:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

I:\Program Files\Canon\MyPrinter\BJMyPrt.exe

I:\Program Files\PowerISO\PWRISOVM.EXE

I:\WINDOWS\RTHDCPL.EXE

I:\Program Files\Winamp\winampa.exe

I:\Program Files\Tlen.pl\tlen.exe

I:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe

I:\Program Files\Google\Google Updater\GoogleUpdater.exe

I:\Program Files\Logitech\SetPoint\SetPoint.exe

I:\Program Files\SEC\Natural Color Pro\NCProTray.exe

I:\Program Files\Common Files\Logitech\KhalShared\KHALMNPR.EXE

I:\WINDOWS\BricoPacks\Vista Inspirat 2\YzShadow\YzShadow.exe

I:\Program Files\Alwil Software\Avast4\ashMaiSv.exe

I:\Program Files\Alwil Software\Avast4\ashWebSv.exe

I:\Program Files\Bat\X_Bat.exe

I:\WINDOWS\explorer.exe

I:\WINDOWS\System32\svchost.exe

I:\Program Files\Internet Explorer\IEXPLORE.EXE

I:\Program Files\Common Files\Logitech\WebColct\webcolct.exe

I:\Program Files\Winamp\winamp.exe

I:\Program Files\Trend Micro\HijackThis\HijackThis.exe


R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://onet.pl/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

O2 - BHO: BatBHO - {63F7460B-C831-4142-A4AA-5EC303EC4343} - I:\Program Files\Bat\Bat.dll

O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - I:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL

O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - i:\program files\google\googletoolbar1.dll

O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - I:\Program Files\Google\GoogleToolbarNotifier\2.1.1119.1736\swg.dll

O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - i:\program files\google\googletoolbar1.dll

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE I:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [nwiz] nwiz.exe /install

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE I:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit

O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE

O4 - HKLM\..\Run: [NeroFilterCheck] I:\WINDOWS\system32\NeroCheck.exe

O4 - HKLM\..\Run: [GrooveMonitor] "I:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"

O4 - HKLM\..\Run: [avast!] I:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

O4 - HKLM\..\Run: [CanonMyPrinter] I:\Program Files\Canon\MyPrinter\BJMyPrt.exe /logon

O4 - HKLM\..\Run: [PWRISOVM.EXE] I:\Program Files\PowerISO\PWRISOVM.EXE

O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE

O4 - HKLM\..\Run: [WinampAgent] "I:\Program Files\Winamp\winampa.exe"

O4 - HKCU\..\Run: [swg] I:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

O4 - HKCU\..\Run: [Komunikator] I:\Program Files\Tlen.pl\tlen.exe

O4 - HKCU\..\Run: [RocketDock] "I:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe"

O4 - HKCU\..\Run: [ctfmon.exe] I:\WINDOWS\system32\ctfmon.exe

O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] I:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] I:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] I:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] I:\WINDOWS\system32\CTFMON.EXE (User 'Default user')

O4 - Startup: Adobe Gamma.lnk = I:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe

O4 - Startup: Bat - Auto Update.lnk = I:\Program Files\Bat\Bat.exe

O4 - Startup: RocketDock.lnk = I:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe

O4 - Startup: TransBar.lnk = I:\WINDOWS\BricoPacks\Vista Inspirat 2\TransBar\TransBar.exe

O4 - Startup: Y'z Shadow.lnk = I:\WINDOWS\BricoPacks\Vista Inspirat 2\YzShadow\YzShadow.exe

O4 - Global Startup: Google Updater.lnk = I:\Program Files\Google\Google Updater\GoogleUpdater.exe

O4 - Global Startup: Logitech SetPoint.lnk = ?

O4 - Global Startup: NCProTray.lnk = ?

O8 - Extra context menu item: E&ksportuj do programu Microsoft Excel - res://I:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000

O9 - Extra button: Wyslij do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - I:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll

O9 - Extra 'Tools' menuitem: Wyslij &do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - I:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - I:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - I:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - I:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - I:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - I:\Program Files\Messenger\msmsgs.exe

O10 - Unknown file in Winsock LSP: i:\windows\system32\nwprovau.dll

O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - I:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL

O23 - Service: Adobe LM Service - Adobe Systems - I:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe

O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - I:\Program Files\Alwil Software\Avast4\aswUpdSv.exe

O23 - Service: avast! Antivirus - ALWIL Software - I:\Program Files\Alwil Software\Avast4\ashServ.exe

O23 - Service: avast! Mail Scanner - ALWIL Software - I:\Program Files\Alwil Software\Avast4\ashMaiSv.exe

O23 - Service: avast! Web Scanner - ALWIL Software - I:\Program Files\Alwil Software\Avast4\ashWebSv.exe

O23 - Service: Google Updater Service (gusvc) - Google - I:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - I:\WINDOWS\system32\nvsvc32.exe


--

End of file - 6970 bytes

i z combofixa

ComboFix 08-03-14.4 - sfeter 2008-03-16 22:30:33.1 - NTFSx86

[sfeter]

po chwilowym sukcesie i probie aktualizacji IE do wersji 7 wlaczyly sie 3 alerty w avascie i ponownie Task Manager nie dziala

log

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 23:12:58, on 2008-03-16

Platform: Windows XP SP3, v.3282 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP3 (6.00.2900.3282)

Boot mode: Normal


Running processes:

I:\WINDOWS\System32\smss.exe

I:\WINDOWS\system32\winlogon.exe

I:\WINDOWS\system32\services.exe

I:\WINDOWS\system32\lsass.exe

I:\WINDOWS\system32\svchost.exe

I:\WINDOWS\System32\svchost.exe

I:\Program Files\Alwil Software\Avast4\aswUpdSv.exe

I:\Program Files\Alwil Software\Avast4\ashServ.exe

I:\WINDOWS\system32\spoolsv.exe

I:\WINDOWS\Explorer.EXE

I:\WINDOWS\system32\ctfmon.exe

I:\WINDOWS\system32\RUNDLL32.EXE

I:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe

I:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

I:\Program Files\Canon\MyPrinter\BJMyPrt.exe

I:\Program Files\PowerISO\PWRISOVM.EXE

I:\WINDOWS\RTHDCPL.EXE

I:\Program Files\Winamp\winampa.exe

I:\Program Files\Tlen.pl\tlen.exe

I:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe

I:\Program Files\Google\Google Updater\GoogleUpdater.exe

I:\Program Files\Logitech\SetPoint\SetPoint.exe

I:\Program Files\SEC\Natural Color Pro\NCProTray.exe

I:\Program Files\Common Files\Logitech\KhalShared\KHALMNPR.EXE

I:\Program Files\Bat\X_Bat.exe

I:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

I:\WINDOWS\system32\nvsvc32.exe

I:\Program Files\Alwil Software\Avast4\ashMaiSv.exe

I:\Program Files\Alwil Software\Avast4\ashWebSv.exe

I:\WINDOWS\System32\svchost.exe

I:\Program Files\Internet Explorer\IEXPLORE.EXE

I:\Program Files\Trend Micro\HijackThis\HijackThis.exe


R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://onet.pl/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

O2 - BHO: BatBHO - {63F7460B-C831-4142-A4AA-5EC303EC4343} - I:\Program Files\Bat\Bat.dll

O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - I:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL

O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - i:\program files\google\googletoolbar1.dll

O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - I:\Program Files\Google\GoogleToolbarNotifier\2.1.1119.1736\swg.dll

O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - i:\program files\google\googletoolbar1.dll

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE I:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [nwiz] nwiz.exe /install

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE I:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit

O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE

O4 - HKLM\..\Run: [NeroFilterCheck] I:\WINDOWS\system32\NeroCheck.exe

O4 - HKLM\..\Run: [GrooveMonitor] "I:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"

O4 - HKLM\..\Run: [avast!] I:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

O4 - HKLM\..\Run: [CanonMyPrinter] I:\Program Files\Canon\MyPrinter\BJMyPrt.exe /logon

O4 - HKLM\..\Run: [PWRISOVM.EXE] I:\Program Files\PowerISO\PWRISOVM.EXE

O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE

O4 - HKLM\..\Run: [WinampAgent] "I:\Program Files\Winamp\winampa.exe"

O4 - HKCU\..\Run: [swg] I:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

O4 - HKCU\..\Run: [Komunikator] I:\Program Files\Tlen.pl\tlen.exe

O4 - HKCU\..\Run: [RocketDock] "I:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe"

O4 - HKCU\..\Run: [ctfmon.exe] I:\WINDOWS\system32\ctfmon.exe

O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] I:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] I:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] I:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] I:\WINDOWS\system32\CTFMON.EXE (User 'Default user')

O4 - Startup: Adobe Gamma.lnk = I:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe

O4 - Startup: Bat - Auto Update.lnk = I:\Program Files\Bat\Bat.exe

O4 - Startup: RocketDock.lnk = I:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe

O4 - Startup: TransBar.lnk = I:\WINDOWS\BricoPacks\Vista Inspirat 2\TransBar\TransBar.exe

O4 - Startup: Y'z Shadow.lnk = I:\WINDOWS\BricoPacks\Vista Inspirat 2\YzShadow\YzShadow.exe

O4 - Global Startup: Google Updater.lnk = I:\Program Files\Google\Google Updater\GoogleUpdater.exe

O4 - Global Startup: Logitech SetPoint.lnk = ?

O4 - Global Startup: NCProTray.lnk = ?

O8 - Extra context menu item: E&ksportuj do programu Microsoft Excel - res://I:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000

O9 - Extra button: Wyslij do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - I:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll

O9 - Extra 'Tools' menuitem: Wyslij &do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - I:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - I:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - I:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - I:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - I:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - I:\Program Files\Messenger\msmsgs.exe

O10 - Unknown file in Winsock LSP: i:\windows\system32\nwprovau.dll

O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - I:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL

O23 - Service: Adobe LM Service - Adobe Systems - I:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe

O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - I:\Program Files\Alwil Software\Avast4\aswUpdSv.exe

O23 - Service: avast! Antivirus - ALWIL Software - I:\Program Files\Alwil Software\Avast4\ashServ.exe

O23 - Service: avast! Mail Scanner - ALWIL Software - I:\Program Files\Alwil Software\Avast4\ashMaiSv.exe

O23 - Service: avast! Web Scanner - ALWIL Software - I:\Program Files\Alwil Software\Avast4\ashWebSv.exe

O23 - Service: Google Updater Service (gusvc) - Google - I:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - I:\WINDOWS\system32\nvsvc32.exe


--

End of file - 6691 bytes

[sfeter]

spybot search&destroy rozwiazal problem.

ale ze mnie maruda