Zainfekowany komputer(Mulenie się)(Wirusy,trojany)


(Nike062) #1

Witam!!

Mam problem z mulącym się komputerem.Otóż tak:jak włączam przeglądarke(tak samo sie dzieje przy Firefox czy IE) zanim się włączy czekam ok.20 sekund :frowning: Jak wlącze jakąś gre z niskimi wymaganiami(to laguje się)W czasie pracy mam wyłączone procesy i dlatego podejrzewa zainfekowanie kompa(wirusy,trojany itp)Proszę o sprawdzenie logi

HijackThis:

Logfile of Trend Micro HijackThis v2.0.2

    Scan saved at 09:53:39, on 2007-12-30

    Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)

    MSIE: Internet Explorer v7.00 (7.00.6000.16574)

    Boot mode: Normal


    Running processes:

    C:\WINDOWS\System32\smss.exe

    C:\WINDOWS\system32\winlogon.exe

    C:\WINDOWS\system32\services.exe

    C:\WINDOWS\system32\lsass.exe

    C:\WINDOWS\system32\Ati2evxx.exe

    C:\WINDOWS\system32\svchost.exe

    C:\WINDOWS\System32\svchost.exe

    C:\WINDOWS\system32\Ati2evxx.exe

    C:\WINDOWS\system32\spoolsv.exe

    C:\WINDOWS\System32\inetsrv\inetinfo.exe

    C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe

    C:\WINDOWS\system32\oodag.exe

    C:\WINDOWS\system32\PnkBstrA.exe

    C:\WINDOWS\System32\tcpsvcs.exe

    C:\WINDOWS\System32\snmp.exe

    C:\Program Files\Alcohol Soft\Alcohol 52\StarWind\StarWindServiceAE.exe

    C:\WINDOWS\system32\UAService7.exe

    C:\WINDOWS\System32\mqsvc.exe

    C:\WINDOWS\System32\mqtgsvc.exe

    C:\WINDOWS\Explorer.EXE

    C:\WINDOWS\system32\wscntfy.exe

    C:\WINDOWS\Mixer.exe

    C:\Program Files\Konnekt\konnekt.exe

    C:\WINDOWS\system32\ctfmon.exe

    C:\Program Files\Skype\Phone\Skype.exe

    C:\Program Files\Skype\Plugin Manager\skypePM.exe

    C:\PROGRA~1\Mozilla Firefox\firefox.exe

    C:\Program Files\Winamp\winamp.exe

    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe


    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=proxy.icpnet.pl:8080

    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza

    R3 - URLSearchHook: Harmony Hollow Software Toolbar - {3806b089-6759-411d-b2c3-b7995a9f34d7} - C:\Program Files\Harmony_Hollow_Software\tbHar0.dll

    O2 - BHO: Harmony Hollow Software Toolbar - {3806b089-6759-411d-b2c3-b7995a9f34d7} - C:\Program Files\Harmony_Hollow_Software\tbHar0.dll

    O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL

    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll

    O3 - Toolbar: Harmony Hollow Software Toolbar - {3806b089-6759-411d-b2c3-b7995a9f34d7} - C:\Program Files\Harmony_Hollow_Software\tbHar0.dll

    O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup

    O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe"

    O4 - HKLM\..\Run: [Spamihilator] "C:\Program Files\Spamihilator\spamihilator.exe"

    O4 - HKCU\..\Run: [Konnekt] "C:\Program Files\Konnekt\konnekt.exe" /autostart

    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe

    O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'USŁUGA LOKALNA')

    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'USŁUGA SIECIOWA')

    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')

    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')

    O8 - Extra context menu item: E&ksportuj do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000

    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll

    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll

    O9 - Extra button: Wyślij do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll

    O9 - Extra 'Tools' menuitem: Wyślij &do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll

    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL

    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

    O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL

    O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL

    O20 - AppInit_DLLs: c:\windows\system32\tustqnk.dll,C:\PROGRA~1\KASPER~1.0\adialhk.dll

    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe

    O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe

    O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe

    O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe

    O23 - Service: O&O Defrag - O&O Software GmbH - C:\WINDOWS\system32\oodag.exe

    O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe

    O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 52\StarWind\StarWindServiceAE.exe

    O23 - Service: SecuROM User Access Service (V7) (UserAccess7) - Sony DADC Austria AG. - C:\WINDOWS\system32\UAService7.exe


    --

    End of file - 5800 bytes

SilentRunners:

"Silent Runners.vbs", revision 52, http://www.silentrunners.org/

    Operating System: Windows XP SP2

    Output limited to non-default values, except where indicated by "{++}"



    Startup items buried in registry:

    ---------------------------------


    HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ {++}

    "Konnekt" = ""C:\Program Files\Konnekt\konnekt.exe" /autostart" ["Stamina"]

    "CTFMON.EXE" = "C:\WINDOWS\system32\ctfmon.exe" [MS]


    HKLM\Software\Microsoft\Windows\CurrentVersion\Run\ {++}

    "C-Media Mixer" = "Mixer.exe /startup" ["C-Media Electronic Inc. (www.cmedia.com.tw)"]

    "StartCCC" = ""C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe"" [null data]

    "Spamihilator" = ""C:\Program Files\Spamihilator\spamihilator.exe"" ["Michel Krämer"]


    HKLM\Software\Microsoft\Active Setup\Installed Components\

    >{26923b43-4d38-484f-9b9e-de460746276c}\(Default) = "Internet Explorer"

                                            \StubPath = "C:\WINDOWS\system32\ie4uinit.exe -UserIconConfig" [MS]


    HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\

    {3806b089-6759-411d-b2c3-b7995a9f34d7}\(Default) = "*n" (unwritable string)

      -> {HKLM...CLSID} = "Harmony Hollow Software Toolbar"

                       \InProcServer32\(Default) = "C:\Program Files\Harmony_Hollow_Software\tbHar0.dll" ["Conduit Ltd."]

    {72853161-30C5-4D22-B7F9-0BBC1D38A37E}\(Default) = (no title provided)

      -> {HKLM...CLSID} = "Groove GFS Browser Helper"

                       \InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL" [MS]

    {761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\(Default) = (no title provided)

      -> {HKLM...CLSID} = "SSVHelper Class"

                       \InProcServer32\(Default) = "C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll" ["Sun Microsystems, Inc."]


    HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\

    "{42071714-76d4-11d1-8b24-00a0c9068ff3}" = "Rozszerzenie CPL kadrowania wyświetlania"

      -> {HKLM...CLSID} = "Rozszerzenie CPL kadrowania wyświetlania"

                       \InProcServer32\(Default) = "deskpan.dll" [file not found]

    "{88895560-9AA2-1069-930E-00AA0030EBC8}" = "Rozszerzenie ikony HyperTerminalu"

      -> {HKLM...CLSID} = "HyperTerminal Icon Ext"

                       \InProcServer32\(Default) = "C:\WINDOWS\System32\hticons.dll" [file not found]

    "{e57ce731-33e8-4c51-8354-bb4de9d215d1}" = "Uniwersalne urządzenia Plug and Play"

      -> {HKLM...CLSID} = "Uniwersalne urządzenia Plug and Play"

                       \InProcServer32\(Default) = "C:\WINDOWS\system32\upnpui.dll" [MS]

    "{453D1B6D-BD6A-4FA1-B876-9E4DD848D434}" = "AQQ File Transfer Shell Extension"

      -> {HKLM...CLSID} = "AQQ File Transfer Shell Extension"

                       \InProcServer32\(Default) = "C:\PROGRA~1\WapSter\AQQ\System\AQQSHE~1.DLL" [file not found]

    "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" = "WinRAR shell extension"

      -> {HKLM...CLSID} = "WinRAR"

                       \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]

    "{72853161-30C5-4D22-B7F9-0BBC1D38A37E}" = "Groove GFS Browser Helper"

      -> {HKLM...CLSID} = "Groove GFS Browser Helper"

                       \InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL" [MS]

    "{2A541AE1-5BF6-4665-A8A3-CFA9672E4291}" = "Groove GFS Explorer Bar"

      -> {HKLM...CLSID} = "Groove Folder Synchronization"

                       \InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL" [MS]

    "{A449600E-1DC6-4232-B948-9BD794D62056}" = "Groove GFS Stub Icon Handler"

      -> {HKLM...CLSID} = "Groove GFS Stub Icon Handler"

                       \InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL" [MS]

    "{B5A7F190-DDA6-4420-B3BA-52453494E6CD}" = "Groove GFS Stub Execution Hook"

      -> {HKLM...CLSID} = "Groove GFS Stub Execution Hook"

                       \InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL" [MS]

    "{6C467336-8281-4E60-8204-430CED96822D}" = "Groove GFS Context Menu Handler"

      -> {HKLM...CLSID} = "Groove GFS Context Menu Handler"

                       \InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL" [MS]

    "{387E725D-DC16-4D76-B310-2C93ED4752A0}" = "Groove XML Icon Handler"

      -> {HKLM...CLSID} = "Groove XML Icon Handler"

                       \InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL" [MS]

    "{16F3DD56-1AF5-4347-846D-7C10C4192619}" = "Groove Explorer Icon Overlay 3 (GFS Folder)"

      -> {HKLM...CLSID} = "Groove Explorer Icon Overlay 3 (GFS Folder)"

                       \InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL" [MS]

    "{AB5C5600-7E6E-4B06-9197-9ECEF74D31CC}" = "Groove Explorer Icon Overlay 2 (GFS Stub)"

      -> {HKLM...CLSID} = "Groove Explorer Icon Overlay 2 (GFS Stub)"

                       \InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL" [MS]

    "{2916C86E-86A6-43FE-8112-43ABE6BF8DCC}" = "Groove Explorer Icon Overlay 4 (GFS Unread Mark)"

      -> {HKLM...CLSID} = "Groove Explorer Icon Overlay 4 (GFS Unread Mark)"

                       \InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL" [MS]

    "{99FD978C-D287-4F50-827F-B2C658EDA8E7}" = "Groove Explorer Icon Overlay 1 (GFS Unread Stub)"

      -> {HKLM...CLSID} = "Groove Explorer Icon Overlay 1 (GFS Unread Stub)"

                       \InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL" [MS]

    "{920E6DB1-9907-4370-B3A0-BAFC03D81399}" = "Groove Explorer Icon Overlay 2.5 (GFS Unread Folder)"

      -> {HKLM...CLSID} = "Groove Explorer Icon Overlay 2.5 (GFS Unread Folder)"

                       \InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL" [MS]

    "{0006F045-0000-0000-C000-000000000046}" = "Microsoft Office Outlook Custom Icon Handler"

      -> {HKLM...CLSID} = "Outlook File Icon Extension"

                       \InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\Office12\OLKFSTUB.DLL" [MS]

    "{00020D75-0000-0000-C000-000000000046}" = "Microsoft Office Outlook Desktop Icon Handler"

      -> {HKLM...CLSID} = "Microsoft Office Outlook"

                       \InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\Office12\MLSHEXT.DLL" [MS]

    "{5858A72C-C2B4-4dd7-B2BF-B76DB1BD9F6C}" = "Microsoft Office OneNote Namespace Extension for Windows Desktop Search"

      -> {HKLM...CLSID} = "Microsoft Office OneNote Namespace Extension for Windows Desktop Search"

                       \InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\Office12\ONFILTER.DLL" [MS]

    "{42042206-2D85-11D3-8CFF-005004838597}" = "Microsoft Office HTML Icon Handler"

      -> {HKLM...CLSID} = (no title provided)

                       \InProcServer32\(Default) = "C:\Program Files\Microsoft Office\Office12\msohevi.dll" [MS]

    "{993BE281-6695-4BA5-8A2A-7AACBFAAB69E}" = "Microsoft Office Metadata Handler"

      -> {HKLM...CLSID} = "Microsoft Office Metadata Handler"

                       \InProcServer32\(Default) = "C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\msoshext.dll" [MS]

    "{C41662BB-1FA0-4CE0-8DC5-9B7F8279FF97}" = "Microsoft Office Thumbnail Handler"

      -> {HKLM...CLSID} = "Microsoft Office Thumbnail Handler"

                       \InProcServer32\(Default) = "C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\msoshext.dll" [MS]

    "{C52AF81D-F7A0-4AAB-8E87-F80A60CCD396}" = "OpenOffice.org Column Handler"

      -> {HKLM...CLSID} = (no title provided)

                       \InProcServer32\(Default) = ""C:\Program Files\OpenOffice.org 2.3\program\shlxthdl.dll"" ["Sun Microsystems, Inc."]

    "{087B3AE3-E237-4467-B8DB-5A38AB959AC9}" = "OpenOffice.org Infotip Handler"

      -> {HKLM...CLSID} = (no title provided)

                       \InProcServer32\(Default) = ""C:\Program Files\OpenOffice.org 2.3\program\shlxthdl.dll"" ["Sun Microsystems, Inc."]

    "{63542C48-9552-494A-84F7-73AA6A7C99C1}" = "OpenOffice.org Property Sheet Handler"

      -> {HKLM...CLSID} = (no title provided)

                       \InProcServer32\(Default) = ""C:\Program Files\OpenOffice.org 2.3\program\shlxthdl.dll"" ["Sun Microsystems, Inc."]

    "{3B092F0C-7696-40E3-A80F-68D74DA84210}" = "OpenOffice.org Thumbnail Viewer"

      -> {HKLM...CLSID} = (no title provided)

                       \InProcServer32\(Default) = ""C:\Program Files\OpenOffice.org 2.3\program\shlxthdl.dll"" ["Sun Microsystems, Inc."]

    "{97F68CE3-7146-45FF-BE24-D9A7DD7CB8A2}" = "NeroCoverEd Live Icons"

      -> {HKLM...CLSID} = "NeroCoverEdLiveIcons Class"

                       \InProcServer32\(Default) = "C:\Program Files\Nero\Nero8\Nero CoverDesigner\CoverEdExtension.dll" ["Nero AG"]

    "{B327765E-D724-4347-8B16-78AE18552FC3}" = "NeroDigitalIconHandler"

      -> {HKLM...CLSID} = "NeroDigitalIconHandler Class"

                       \InProcServer32\(Default) = "C:\Program Files\Common Files\Nero\Lib\NeroDigitalExt.dll" ["Nero AG"]

    "{7F1CF152-04F8-453A-B34C-E609530A9DC8}" = "NeroDigitalPropSheetHandler"

      -> {HKLM...CLSID} = "NeroDigitalPropSheetHandler Class"

                       \InProcServer32\(Default) = "C:\Program Files\Common Files\Nero\Lib\NeroDigitalExt.dll" ["Nero AG"]

    "{5E2121EE-0300-11D4-8D3B-444553540000}" = "Catalyst Context Menu extension"

      -> {HKLM...CLSID} = "SimpleShlExt Class"

                       \InProcServer32\(Default) = "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\atiacmxx.dll" [empty string]


    HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\

    <> "{B5A7F190-DDA6-4420-B3BA-52453494E6CD}" = "Groove GFS Stub Execution Hook"

      -> {HKLM...CLSID} = "Groove GFS Stub Execution Hook"

                       \InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL" [MS]


    HKLM\Software\Microsoft\Windows NT\CurrentVersion\Windows\

    <> "AppInit_DLLs" = "c:\windows\system32\tustqnk.dll,C:\PROGRA~1\KASPER~1.0\adialhk.dll" [file not found]


    HKLM\System\CurrentControlSet\Control\Session Manager\

    <> "BootExecute" = "autocheck autochk *"|"OODBS" ["O&O Software GmbH"]


    HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\

    <> AtiExtEvent\DLLName = "Ati2evxx.dll" ["ATI Technologies Inc."]


    HKLM\Software\Classes\PROTOCOLS\Filter\

    <> text/xml\CLSID = "{807563E5-5146-11D5-A672-00B0D022E945}"

      -> {HKLM...CLSID} = "Microsoft Office InfoPath XML Mime Filter"

                       \InProcServer32\(Default) = "C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL" [MS]


    HKLM\Software\Classes\Folder\shellex\ColumnHandlers\

    {7D4D6379-F301-4311-BEBA-E26EB0561882}\(Default) = "NeroDigitalExt.NeroDigitalColumnHandler"

      -> {HKLM...CLSID} = "NeroDigitalColumnHandler Class"

                       \InProcServer32\(Default) = "C:\Program Files\Common Files\Nero\Lib\NeroDigitalExt.dll" ["Nero AG"]

    {C52AF81D-F7A0-4AAB-8E87-F80A60CCD396}\(Default) = "OpenOffice.org Column Handler"

      -> {HKLM...CLSID} = (no title provided)

                       \InProcServer32\(Default) = ""C:\Program Files\OpenOffice.org 2.3\program\shlxthdl.dll"" ["Sun Microsystems, Inc."]


    HKLM\Software\Classes\*\shellex\ContextMenuHandlers\

    AQQFileTransfer\(Default) = "{453D1B6D-BD6A-4FA1-B876-9E4DD848D434}"

      -> {HKLM...CLSID} = "AQQ File Transfer Shell Extension"

                       \InProcServer32\(Default) = "C:\PROGRA~1\WapSter\AQQ\System\AQQSHE~1.DLL" [file not found]

    Cover Designer\(Default) = "{73FCA462-9BD5-4065-A73F-A8E5F6904EF7}"

      -> {HKLM...CLSID} = "NeroCoverEdContextMenu Class"

                       \InProcServer32\(Default) = "C:\Program Files\Nero\Nero8\Nero CoverDesigner\CoverEdExtension.dll" ["Nero AG"]

    WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"

      -> {HKLM...CLSID} = "WinRAR"

                       \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]

    XXX Groove GFS Context Menu Handler XXX\(Default) = "{6C467336-8281-4E60-8204-430CED96822D}"

      -> {HKLM...CLSID} = "Groove GFS Context Menu Handler"

                       \InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL" [MS]


    HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\

    WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"

      -> {HKLM...CLSID} = "WinRAR"

                       \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]

    XXX Groove GFS Context Menu Handler XXX\(Default) = "{6C467336-8281-4E60-8204-430CED96822D}"

      -> {HKLM...CLSID} = "Groove GFS Context Menu Handler"

                       \InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL" [MS]


    HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\

    WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"

      -> {HKLM...CLSID} = "WinRAR"

                       \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]

    XXX Groove GFS Context Menu Handler XXX\(Default) = "{6C467336-8281-4E60-8204-430CED96822D}"

      -> {HKLM...CLSID} = "Groove GFS Context Menu Handler"

                       \InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL" [MS]


    HKLM\Software\Classes\AllFilesystemObjects\shellex\ContextMenuHandlers\

    XXX Groove GFS Context Menu Handler XXX\(Default) = "{6C467336-8281-4E60-8204-430CED96822D}"

      -> {HKLM...CLSID} = "Groove GFS Context Menu Handler"

                       \InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL" [MS]



    Group Policies {GPedit.msc branch and setting}:

    -----------------------------------------------


    Note: detected settings may not have any effect.


    HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\


    "NoDrives" = (REG_BINARY) hex:00 00 00 00

    {unrecognized setting}


    HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\


    "shutdownwithoutlogon" = (REG_DWORD) hex:0x00000000

    {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options|

    Shutdown: Allow system to be shut down without having to log on}


    "undockwithoutlogon" = (REG_DWORD) hex:0x00000000

    {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options|

    Devices: Allow undock without having to log on}



    Active Desktop and Wallpaper:

    -----------------------------


    Active Desktop may be disabled at this entry:

    HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState


    Displayed if Active Desktop disabled and wallpaper not set by Group Policy:

    HKCU\Control Panel\Desktop\

    "Wallpaper" = "C:\Documents and Settings\MD\Dane aplikacji\Mozilla\Firefox\Tapeta pulpitu.bmp"



    Enabled Screen Saver:

    ---------------------


    HKCU\Control Panel\Desktop\

    "SCRNSAVE.EXE" = "C:\WINDOWS\System32\logon.scr" [MS]



    Winsock2 Service Provider DLLs:

    -------------------------------


    Namespace Service Providers


    HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++}

    000000000001\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]

    000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS]

    000000000003\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]


    Transport Service Providers


    HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++}

    0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range:

    %SystemRoot%\system32\mswsock.dll [MS], 01 - 03, 06 - 15

    %SystemRoot%\system32\rsvpsp.dll [MS], 04 - 05



    Toolbars, Explorer Bars, Extensions:

    ------------------------------------


    Toolbars


    HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\

    "{3806B089-6759-411D-B2C3-B7995A9F34D7}"

      -> {HKLM...CLSID} = "Harmony Hollow Software Toolbar"

                       \InProcServer32\(Default) = "C:\Program Files\Harmony_Hollow_Software\tbHar0.dll" ["Conduit Ltd."]


    HKLM\Software\Microsoft\Internet Explorer\Toolbar\

    "{3806B089-6759-411D-B2C3-B7995A9F34D7}" = "Harmony Hollow Software Toolbar"

      -> {HKLM...CLSID} = "Harmony Hollow Software Toolbar"

                       \InProcServer32\(Default) = "C:\Program Files\Harmony_Hollow_Software\tbHar0.dll" ["Conduit Ltd."]


    Explorer Bars


    HKLM\Software\Microsoft\Internet Explorer\Explorer Bars\


    HKLM\Software\Classes\CLSID\{2A541AE1-5BF6-4665-A8A3-CFA9672E4291}\(Default) = "Groove Folder Synchronization"

    Implemented Categories\{00021493-0000-0000-C000-000000000046}\ [vertical bar]

    InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL" [MS]


    HKLM\Software\Classes\CLSID\{FF059E31-CC5A-4E2E-BF3B-96E929D65503}\(Default) = "&Poszukaj"

    Implemented Categories\{00021493-0000-0000-C000-000000000046}\ [vertical bar]

    InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL" [MS]


    Extensions (Tools menu items, main toolbar menu buttons)


    HKLM\Software\Microsoft\Internet Explorer\Extensions\

    {08B0E5C0-4FCB-11CF-AAA5-00401C608501}\

    "MenuText" = "Sun Java Console"

    "CLSIDExtension" = "{CAFEEFAC-0016-0000-0002-ABCDEFFEDCBC}"

      -> {HKCU...CLSID} = "Java Plug-in 1.6.0_02"

                       \InProcServer32\(Default) = "C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll" ["Sun Microsystems, Inc."]

      -> {HKLM...CLSID} = "Java Plug-in 1.6.0_02"

                       \InProcServer32\(Default) = "C:\Program Files\Java\jre1.6.0_02\bin\npjpi160_02.dll" ["Sun Microsystems, Inc."]


    {2670000A-7350-4F3C-8081-5663EE0C6C49}\

    "ButtonText" = "Wyślij do programu OneNote"

    "MenuText" = "Wyślij &do programu OneNote"

    "CLSIDExtension" = "{48E73304-E1D6-4330-914C-F5F514E3486C}"

      -> {HKLM...CLSID} = "Send to OneNote from Internet Explorer button"

                       \InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll" [MS]


    {92780B25-18CC-41C8-B9BE-3C9C571A8263}\

    "ButtonText" = "Research"


    {E2E2DD38-D088-4134-82B7-F2BA38496583}\

    "MenuText" = "@xpsp3res.dll,-20001"

    "Exec" = "%windir%\Network Diagnostic\xpnetdiag.exe" [MS]


    {FB5F1910-F110-11D2-BB9E-00C04F795683}\

    "ButtonText" = "Messenger"

    "MenuText" = "Windows Messenger"

    "Exec" = "C:\Program Files\Messenger\msmsgs.exe" [MS]



    Miscellaneous IE Hijack Points

    ------------------------------


    HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks\

    <> "{3806b089-6759-411d-b2c3-b7995a9f34d7}" = (no title provided)

      -> {HKLM...CLSID} = "Harmony Hollow Software Toolbar"

                       \InProcServer32\(Default) = "C:\Program Files\Harmony_Hollow_Software\tbHar0.dll" ["Conduit Ltd."]



    Running Services (Display Name, Service Name, Path {Service DLL}):

    ------------------------------------------------------------------


    Ati HotKey Poller, Ati HotKey Poller, "C:\WINDOWS\system32\Ati2evxx.exe" ["ATI Technologies Inc."]

    Message Queuing, MSMQ, "C:\WINDOWS\System32\mqsvc.exe" [MS]

    Message Queuing Triggers, MSMQTriggers, "C:\WINDOWS\System32\mqtgsvc.exe" [MS]

    Nero BackItUp Scheduler 3, Nero BackItUp Scheduler 3, "C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe" ["Nero AG"]

    O&O Defrag, O&O Defrag, "C:\WINDOWS\system32\oodag.exe" ["O&O Software GmbH"]

    PnkBstrA, PnkBstrA, "C:\WINDOWS\system32\PnkBstrA.exe" [null data]

    SecuROM User Access Service (V7), UserAccess7, "C:\WINDOWS\system32\UAService7.exe" ["Sony DADC Austria AG."]

    StarWind AE Service, StarWindServiceAE, "C:\Program Files\Alcohol Soft\Alcohol 52\StarWind\StarWindServiceAE.exe" ["Rocket Division Software"]

    Usługi Simple TCP/IP, SimpTcp, "C:\WINDOWS\System32\tcpsvcs.exe" [MS]

    Windows User Mode Driver Framework, UMWdf, "C:\WINDOWS\system32\wdfmgr.exe" [MS]



    Print Monitors:

    ---------------


    HKLM\System\CurrentControlSet\Control\Print\Monitors\

    LPR Port\Driver = "lprmon.dll" [MS]

    Microsoft Shared Fax Monitor\Driver = "FXSMON.DLL" [MS]

    Send To Microsoft OneNote Monitor\Driver = "msonpmon.dll" [MS]



    ---------- (launch time: 2007-12-30 10:01:22)

    <>: Suspicious data at a malware launch point.

    <>: Suspicious data at a browser hijack point.


    + This report excludes default entries except where indicated.

    + To see *everywhere* the script checks and *everything* it finds,

      launch it from a command prompt or a shortcut with the -all parameter.

    + The search for DESKTOP.INI DLL launch points on all local fixed drives

      took 90 seconds.

    ---------- (total run time: 209 seconds)

Combofix:

http://wklej.org/id/d9c56401a1

Z góry dziękuje za pomoc;] :slight_smile:


(Gutek) #2

Wklej do Notatnika:

Driver::

bfastfao

>>Plik>>Zapisz jako... >>> CFScript (najwygodniej będzie, jeśli zapiszesz w takiej lokalizacji, by ikonka CFScript.txt znalazła się obok ikonki ComboFix.exe )

Przeciągnij i upuść plik CFScript.txt na plik ComboFix.exe (czyli ikonkę CFScript.txt na ikonkę ComboFix.exe )

– podobnie jak na tym obrazku -->88953CFScript-createdbyMiekiemoes.gif

(jeśli pojawi się pytanie " 1 or 2" - to wpisz 1 i naciśnij ENTER) Ma się rozpocząć usuwanie. (i powstanie log)

Po restarcie usuń ręcznie folder C: **** Qoobox.