Zawieszajacy się Windows Explorer

[pasquali]

Zostałem przekierowany z tego wątku: http://forum.dobreprogramy.pl/viewtopic … 78#1367578

Oto logi:

__________________________________________________ ewido anti-spyware online scanner http://www.ewido.net __________________________________________________ Name: TrackingCookie.Connextra Path: C:\Documents and Settings\Mistrzu\Cookies\mistrzu@connextra[1].txt Risk: Medium Name: TrackingCookie.Tradedoubler Path: C:\Documents and Settings\Mistrzu\Cookies\mistrzu@tradedoubler[1].txt Risk: Medium Name: Adware.Generic Path: HKU\S-1-5-21-4212382003-3264939475-2254161566-1006\Software\Microsoft\Windows\CurrentVersion\Ext\Stats{67982BB7-0F95-44C5-92DC-E3AF3DC19D6D} Risk: Medium Name: TrackingCookie.Tradedoubler Path: :mozilla.52:C:\Documents and Settings\Mistrzu\Application Data\Mozilla\Firefox\Profiles\1rum71tl.default\cookies.txt Risk: Medium Name: TrackingCookie.Tradedoubler Path: :mozilla.53:C:\Documents and Settings\Mistrzu\Application Data\Mozilla\Firefox\Profiles\1rum71tl.default\cookies.txt Risk: Medium Name: TrackingCookie.Tradedoubler Path: :mozilla.54:C:\Documents and Settings\Mistrzu\Application Data\Mozilla\Firefox\Profiles\1rum71tl.default\cookies.txt Risk: Medium Name: TrackingCookie.Tradedoubler Path: :mozilla.55:C:\Documents and Settings\Mistrzu\Application Data\Mozilla\Firefox\Profiles\1rum71tl.default\cookies.txt Risk: Medium Name: TrackingCookie.Imrworldwide Path: :mozilla.59:C:\Documents and Settings\Mistrzu\Application Data\Mozilla\Firefox\Profiles\1rum71tl.default\cookies.txt Risk: Medium Name: TrackingCookie.Imrworldwide Path: :mozilla.60:C:\Documents and Settings\Mistrzu\Application Data\Mozilla\Firefox\Profiles\1rum71tl.default\cookies.txt Risk: Medium Name: TrackingCookie.Fastclick Path: :mozilla.88:C:\Documents and Settings\Mistrzu\Application Data\Mozilla\Firefox\Profiles\1rum71tl.default\cookies.txt Risk: Medium Name: TrackingCookie.Fastclick Path: :mozilla.89:C:\Documents and Settings\Mistrzu\Application Data\Mozilla\Firefox\Profiles\1rum71tl.default\cookies.txt Risk: Medium Name: TrackingCookie.Fastclick Path: :mozilla.91:C:\Documents and Settings\Mistrzu\Application Data\Mozilla\Firefox\Profiles\1rum71tl.default\cookies.txt Risk: Medium Name: TrackingCookie.Fastclick Path: :mozilla.92:C:\Documents and Settings\Mistrzu\Application Data\Mozilla\Firefox\Profiles\1rum71tl.default\cookies.txt Risk: Medium Name: TrackingCookie.Tribalfusion Path: :mozilla.93:C:\Documents and Settings\Mistrzu\Application Data\Mozilla\Firefox\Profiles\1rum71tl.default\cookies.txt Risk: Medium Name: TrackingCookie.Advertising Path: :mozilla.149:C:\Documents and Settings\Mistrzu\Application Data\Mozilla\Firefox\Profiles\1rum71tl.default\cookies.txt Risk: Medium Name: TrackingCookie.Doubleclick Path: :mozilla.150:C:\Documents and Settings\Mistrzu\Application Data\Mozilla\Firefox\Profiles\1rum71tl.default\cookies.txt Risk: Medium Name: TrackingCookie.Casalemedia Path: :mozilla.157:C:\Documents and Settings\Mistrzu\Application Data\Mozilla\Firefox\Profiles\1rum71tl.default\cookies.txt Risk: Medium Name: TrackingCookie.Casalemedia Path: :mozilla.158:C:\Documents and Settings\Mistrzu\Application Data\Mozilla\Firefox\Profiles\1rum71tl.default\cookies.txt Risk: Medium Name: TrackingCookie.Casalemedia Path: :mozilla.159:C:\Documents and Settings\Mistrzu\Application Data\Mozilla\Firefox\Profiles\1rum71tl.default\cookies.txt Risk: Medium Name: TrackingCookie.Casalemedia Path: :mozilla.160:C:\Documents and Settings\Mistrzu\Application Data\Mozilla\Firefox\Profiles\1rum71tl.default\cookies.txt Risk: Medium Name: TrackingCookie.Casalemedia Path: :mozilla.161:C:\Documents and Settings\Mistrzu\Application Data\Mozilla\Firefox\Profiles\1rum71tl.default\cookies.txt Risk: Medium Name: TrackingCookie.Casalemedia Path: :mozilla.162:C:\Documents and Settings\Mistrzu\Application Data\Mozilla\Firefox\Profiles\1rum71tl.default\cookies.txt Risk: Medium Name: TrackingCookie.Hitbox Path: :mozilla.169:C:\Documents and Settings\Mistrzu\Application Data\Mozilla\Firefox\Profiles\1rum71tl.default\cookies.txt Risk: Medium Name: TrackingCookie.Serving-sys Path: :mozilla.172:C:\Documents and Settings\Mistrzu\Application Data\Mozilla\Firefox\Profiles\1rum71tl.default\cookies.txt Risk: Medium Name: TrackingCookie.Serving-sys Path: :mozilla.173:C:\Documents and Settings\Mistrzu\Application Data\Mozilla\Firefox\Profiles\1rum71tl.default\cookies.txt Risk: Medium Name: TrackingCookie.Serving-sys Path: :mozilla.174:C:\Documents and Settings\Mistrzu\Application Data\Mozilla\Firefox\Profiles\1rum71tl.default\cookies.txt Risk: Medium Name: TrackingCookie.Serving-sys Path: :mozilla.175:C:\Documents and Settings\Mistrzu\Application Data\Mozilla\Firefox\Profiles\1rum71tl.default\cookies.txt Risk: Medium Name: TrackingCookie.Serving-sys Path: :mozilla.176:C:\Documents and Settings\Mistrzu\Application Data\Mozilla\Firefox\Profiles\1rum71tl.default\cookies.txt Risk: Medium Name: TrackingCookie.Serving-sys Path: :mozilla.177:C:\Documents and Settings\Mistrzu\Application Data\Mozilla\Firefox\Profiles\1rum71tl.default\cookies.txt Risk: Medium Name: TrackingCookie.Serving-sys Path: :mozilla.178:C:\Documents and Settings\Mistrzu\Application Data\Mozilla\Firefox\Profiles\1rum71tl.default\cookies.txt Risk: Medium Name: TrackingCookie.Yieldmanager Path: :mozilla.182:C:\Documents and Settings\Mistrzu\Application Data\Mozilla\Firefox\Profiles\1rum71tl.default\cookies.txt Risk: Medium Name: TrackingCookie.Yieldmanager Path: :mozilla.183:C:\Documents and Settings\Mistrzu\Application Data\Mozilla\Firefox\Profiles\1rum71tl.default\cookies.txt Risk: Medium Name: TrackingCookie.Yieldmanager Path: :mozilla.184:C:\Documents and Settings\Mistrzu\Application Data\Mozilla\Firefox\Profiles\1rum71tl.default\cookies.txt Risk: Medium Name: TrackingCookie.Yieldmanager Path: :mozilla.185:C:\Documents and Settings\Mistrzu\Application Data\Mozilla\Firefox\Profiles\1rum71tl.default\cookies.txt Risk: Medium Name: TrackingCookie.Tacoda Path: :mozilla.186:C:\Documents and Settings\Mistrzu\Application Data\Mozilla\Firefox\Profiles\1rum71tl.default\cookies.txt Risk: Medium Name: TrackingCookie.Tacoda Path: :mozilla.187:C:\Documents and Settings\Mistrzu\Application Data\Mozilla\Firefox\Profiles\1rum71tl.default\cookies.txt Risk: Medium Name: TrackingCookie.Tacoda Path: :mozilla.188:C:\Documents and Settings\Mistrzu\Application Data\Mozilla\Firefox\Profiles\1rum71tl.default\cookies.txt Risk: Medium Name: TrackingCookie.Tacoda Path: :mozilla.190:C:\Documents and Settings\Mistrzu\Application Data\Mozilla\Firefox\Profiles\1rum71tl.default\cookies.txt Risk: Medium Name: TrackingCookie.Tacoda Path: :mozilla.191:C:\Documents and Settings\Mistrzu\Application Data\Mozilla\Firefox\Profiles\1rum71tl.default\cookies.txt Risk: Medium Name: TrackingCookie.2o7 Path: :mozilla.204:C:\Documents and Settings\Mistrzu\Application Data\Mozilla\Firefox\Profiles\1rum71tl.default\cookies.txt Risk: Medium Name: TrackingCookie.2o7 Path: :mozilla.205:C:\Documents and Settings\Mistrzu\Application Data\Mozilla\Firefox\Profiles\1rum71tl.default\cookies.txt Risk: Medium Name: TrackingCookie.2o7 Path: :mozilla.206:C:\Documents and Settings\Mistrzu\Application Data\Mozilla\Firefox\Profiles\1rum71tl.default\cookies.txt Risk: Medium Name: TrackingCookie.2o7 Path: :mozilla.207:C:\Documents and Settings\Mistrzu\Application Data\Mozilla\Firefox\Profiles\1rum71tl.default\cookies.txt Risk: Medium Name: TrackingCookie.2o7 Path: :mozilla.208:C:\Documents and Settings\Mistrzu\Application Data\Mozilla\Firefox\Profiles\1rum71tl.default\cookies.txt Risk: Medium Name: TrackingCookie.2o7 Path: :mozilla.209:C:\Documents and Settings\Mistrzu\Application Data\Mozilla\Firefox\Profiles\1rum71tl.default\cookies.txt Risk: Medium Name: TrackingCookie.2o7 Path: :mozilla.210:C:\Documents and Settings\Mistrzu\Application Data\Mozilla\Firefox\Profiles\1rum71tl.default\cookies.txt Risk: Medium Name: TrackingCookie.2o7 Path: :mozilla.211:C:\Documents and Settings\Mistrzu\Application Data\Mozilla\Firefox\Profiles\1rum71tl.default\cookies.txt Risk: Medium Name: TrackingCookie.Atdmt Path: :mozilla.220:C:\Documents and Settings\Mistrzu\Application Data\Mozilla\Firefox\Profiles\1rum71tl.default\cookies.txt Risk: Medium Name: TrackingCookie.Connextra Path: :mozilla.229:C:\Documents and Settings\Mistrzu\Application Data\Mozilla\Firefox\Profiles\1rum71tl.default\cookies.txt Risk: Medium Name: TrackingCookie.Connextra Path: :mozilla.230:C:\Documents and Settings\Mistrzu\Application Data\Mozilla\Firefox\Profiles\1rum71tl.default\cookies.txt Risk: Medium Name: TrackingCookie.Connextra Path: :mozilla.231:C:\Documents and Settings\Mistrzu\Application Data\Mozilla\Firefox\Profiles\1rum71tl.default\cookies.txt Risk: Medium Name: TrackingCookie.Adbrite Path: :mozilla.247:C:\Documents and Settings\Mistrzu\Application Data\Mozilla\Firefox\Profiles\1rum71tl.default\cookies.txt Risk: Medium Name: TrackingCookie.Adbrite Path: :mozilla.248:C:\Documents and Settings\Mistrzu\Application Data\Mozilla\Firefox\Profiles\1rum71tl.default\cookies.txt Risk: Medium Name: TrackingCookie.Adbrite Path: :mozilla.250:C:\Documents and Settings\Mistrzu\Application Data\Mozilla\Firefox\Profiles\1rum71tl.default\cookies.txt Risk: Medium Name: TrackingCookie.Clickhype Path: :mozilla.258:C:\Documents and Settings\Mistrzu\Application Data\Mozilla\Firefox\Profiles\1rum71tl.default\cookies.txt Risk: Medium Name: TrackingCookie.Skype Path: :mozilla.313:C:\Documents and Settings\Mistrzu\Application Data\Mozilla\Firefox\Profiles\1rum71tl.default\cookies.txt Risk: Medium Name: TrackingCookie.Skype Path: :mozilla.314:C:\Documents and Settings\Mistrzu\Application Data\Mozilla\Firefox\Profiles\1rum71tl.default\cookies.txt Risk: Medium Name: TrackingCookie.Webtrendslive Path: :mozilla.330:C:\Documents and Settings\Mistrzu\Application Data\Mozilla\Firefox\Profiles\1rum71tl.default\cookies.txt Risk: Medium Name: TrackingCookie.2o7 Path: :mozilla.345:C:\Documents and Settings\Mistrzu\Application Data\Mozilla\Firefox\Profiles\1rum71tl.default\cookies.txt Risk: Medium Name: TrackingCookie.Adtech Path: :mozilla.349:C:\Documents and Settings\Mistrzu\Application Data\Mozilla\Firefox\Profiles\1rum71tl.default\cookies.txt Risk: Medium Name: TrackingCookie.Revsci Path: :mozilla.352:C:\Documents and Settings\Mistrzu\Application Data\Mozilla\Firefox\Profiles\1rum71tl.default\cookies.txt Risk: Medium Name: TrackingCookie.Revsci Path: :mozilla.353:C:\Documents and Settings\Mistrzu\Application Data\Mozilla\Firefox\Profiles\1rum71tl.default\cookies.txt Risk: Medium Name: TrackingCookie.Revsci Path: :mozilla.354:C:\Documents and Settings\Mistrzu\Application Data\Mozilla\Firefox\Profiles\1rum71tl.default\cookies.txt Risk: Medium Name: TrackingCookie.Revsci Path: :mozilla.355:C:\Documents and Settings\Mistrzu\Application Data\Mozilla\Firefox\Profiles\1rum71tl.default\cookies.txt Risk: Medium Name: TrackingCookie.Smartadserver Path: :mozilla.424:C:\Documents and Settings\Mistrzu\Application Data\Mozilla\Firefox\Profiles\1rum71tl.default\cookies.txt Risk: Medium Name: TrackingCookie.Estat Path: :mozilla.425:C:\Documents and Settings\Mistrzu\Application Data\Mozilla\Firefox\Profiles\1rum71tl.default\cookies.txt Risk: Medium Name: TrackingCookie.Hitbox Path: :mozilla.427:C:\Documents and Settings\Mistrzu\Application Data\Mozilla\Firefox\Profiles\1rum71tl.default\cookies.txt Risk: Medium Name: TrackingCookie.Statcounter Path: :mozilla.432:C:\Documents and Settings\Mistrzu\Application Data\Mozilla\Firefox\Profiles\1rum71tl.default\cookies.txt Risk: Medium Name: TrackingCookie.Statcounter Path: :mozilla.433:C:\Documents and Settings\Mistrzu\Application Data\Mozilla\Firefox\Profiles\1rum71tl.default\cookies.txt Risk: Medium Name: TrackingCookie.Skype Path: :mozilla.444:C:\Documents and Settings\Mistrzu\Application Data\Mozilla\Firefox\Profiles\1rum71tl.default\cookies.txt Risk: Medium Name: TrackingCookie.Skype Path: :mozilla.445:C:\Documents and Settings\Mistrzu\Application Data\Mozilla\Firefox\Profiles\1rum71tl.default\cookies.txt Risk: Medium Name: TrackingCookie.Skype Path: :mozilla.446:C:\Documents and Settings\Mistrzu\Application Data\Mozilla\Firefox\Profiles\1rum71tl.default\cookies.txt Risk: Medium Name: TrackingCookie.Skype Path: :mozilla.447:C:\Documents and Settings\Mistrzu\Application Data\Mozilla\Firefox\Profiles\1rum71tl.default\cookies.txt Risk: Medium Name: TrackingCookie.Skype Path: :mozilla.451:C:\Documents and Settings\Mistrzu\Application Data\Mozilla\Firefox\Profiles\1rum71tl.default\cookies.txt Risk: Medium Name: TrackingCookie.Skype Path: :mozilla.452:C:\Documents and Settings\Mistrzu\Application Data\Mozilla\Firefox\Profiles\1rum71tl.default\cookies.txt Risk: Medium Name: TrackingCookie.Skype Path: :mozilla.453:C:\Documents and Settings\Mistrzu\Application Data\Mozilla\Firefox\Profiles\1rum71tl.default\cookies.txt Risk: Medium Name: TrackingCookie.Googleadservices Path: :mozilla.456:C:\Documents and Settings\Mistrzu\Application Data\Mozilla\Firefox\Profiles\1rum71tl.default\cookies.txt Risk: Medium Name: TrackingCookie.Ivwbox Path: :mozilla.470:C:\Documents and Settings\Mistrzu\Application Data\Mozilla\Firefox\Profiles\1rum71tl.default\cookies.txt Risk: Medium Name: TrackingCookie.Webtrends Path: :mozilla.479:C:\Documents and Settings\Mistrzu\Application Data\Mozilla\Firefox\Profiles\1rum71tl.default\cookies.txt Risk: Medium Name: Hijacker.Small Path: C:\Program Files\music_now\inetchk.exe Risk: High

SmitFraudFix v2.255 Scan done at 18:11:02,73, 2007-11-26 Run from C:\Program Files\SmitfraudFix OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT The filesystem type is NTFS Fix run in normal mode »»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Before SmitFraudFix !Attention, following keys are not inevitably infected! SrchSTS.exe by S!Ri Search SharedTaskScheduler’s .dll »»»»»»»»»»»»»»»»»»»»»»»» Killing process »»»»»»»»»»»»»»»»»»»»»»»» hosts 127.0.0.1 localhost »»»»»»»»»»»»»»»»»»»»»»»» Winsock2 Fix S!Ri’s WS2Fix: LSP not Found. »»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix GenericRenosFix by S!Ri »»»»»»»»»»»»»»»»»»»»»»»» Deleting infected files »»»»»»»»»»»»»»»»»»»»»»»» DNS Description: Intel® PRO/100 VE Network Connection - Virtual Machine Network Services Driver DNS Server Search Order: 217.30.129.149 DNS Server Search Order: 217.30.137.200 HKLM\SYSTEM\CCS\Services\Tcpip…{4612E4CE-FBB2-4805-A873-B8F9437BB473}: NameServer=217.30.129.149,217.30.137.200 HKLM\SYSTEM\CCS\Services\Tcpip…{74D0DECD-20CF-4AB2-8516-4BA1DCD92AB5}: DhcpNameServer=83.142.72.4 83.142.72.5 HKLM\SYSTEM\CCS\Services\Tcpip…{DE701550-03D4-49F8-83B4-EEEACE2908FA}: DhcpNameServer=83.142.72.4 83.142.72.5 HKLM\SYSTEM\CS1\Services\Tcpip…{4612E4CE-FBB2-4805-A873-B8F9437BB473}: NameServer=217.30.129.149,217.30.137.200 HKLM\SYSTEM\CS1\Services\Tcpip…{74D0DECD-20CF-4AB2-8516-4BA1DCD92AB5}: DhcpNameServer=83.142.72.4 83.142.72.5 HKLM\SYSTEM\CS1\Services\Tcpip…{DE701550-03D4-49F8-83B4-EEEACE2908FA}: DhcpNameServer=83.142.72.4 83.142.72.5 HKLM\SYSTEM\CS2\Services\Tcpip…{4612E4CE-FBB2-4805-A873-B8F9437BB473}: NameServer=217.30.129.149,217.30.137.200 HKLM\SYSTEM\CS2\Services\Tcpip…{74D0DECD-20CF-4AB2-8516-4BA1DCD92AB5}: DhcpNameServer=83.142.72.4 83.142.72.5 HKLM\SYSTEM\CS2\Services\Tcpip…{DE701550-03D4-49F8-83B4-EEEACE2908FA}: DhcpNameServer=83.142.72.4 83.142.72.5 »»»»»»»»»»»»»»»»»»»»»»»» Deleting Temp Files »»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System !Attention, following keys are not inevitably infected! [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] “System”="" »»»»»»»»»»»»»»»»»»»»»»»» Registry Cleaning Registry Cleaning not selected. »»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler After SmitFraudFix !Attention, following keys are not inevitably infected! SrchSTS.exe by S!Ri Search SharedTaskScheduler’s .dll »»»»»»»»»»»»»»»»»»»»»»»» End “Silent Runners.vbs”, revision 49, http://www.silentrunners.org/ Operating System: Windows XP SP2 Output limited to non-default values, except where indicated by “{++}” Startup items buried in registry: --------------------------------- HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ {++} “ctfmon.exe” = “C:\WINDOWS\system32\ctfmon.exe” [MS] “Komunikator” = “C:\Program Files\Tlen\tlen.exe” [“o2.pl Sp. z o.o.”] “P2kAutostart” = “(empty string)” [file not found] HKLM\Software\Microsoft\Windows\CurrentVersion\Run\ {++} “SunJavaUpdateSched” = ““C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe”” [“Sun Microsystems, Inc.”] “High Definition Audio Property Page Shortcut” = “CHDAudPropShortcut.exe” [“Windows ® Server 2003 DDK provider”] “SynTPEnh” = “C:\Program Files\Synaptics\SynTP\SynTPEnh.exe” [“Synaptics, Inc.”] “ISUSPM Startup” = ““C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe” -startup” [“Macrovision Corporation”] “ISUSScheduler” = ““C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe” -start” [“Macrovision Corporation”] “RecGuard” = “C:\Windows\SMINST\RecGuard.exe” [empty string] “avast!” = “C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe” [“ALWIL Software”] “(Default)” = “(empty string)” [file not found] “QuickTime Task” = ““C:\Program Files\K-Lite Codec Pack\QuickTime\qttask.exe” -atboottime” [“Apple Inc.”] “REGSHAVE” = “C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN” [“FUJI PHOTO FILM CO., LTD.”] “IgfxTray” = “C:\WINDOWS\system32\igfxtray.exe” [“Intel Corporation”] “HotKeysCmds” = “C:\WINDOWS\system32\hkcmd.exe” [“Intel Corporation”] “Persistence” = “C:\WINDOWS\system32\igfxpers.exe” [“Intel Corporation”] HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}(Default) = (no title provided) - {HKLM…CLSID} = “Adobe PDF Reader Link Helper” \InProcServer32(Default) = “C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll” [“Adobe Systems Incorporated”] {761497BB-D6F0-462C-B6EB-D4DAF1D92D43}(Default) = (no title provided) - {HKLM…CLSID} = “SSVHelper Class” \InProcServer32(Default) = “C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll” [“Sun Microsystems, Inc.”] HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\ “{42071714-76d4-11d1-8b24-00a0c9068ff3}” = “Display Panning CPL Extension” - {HKLM…CLSID} = “Display Panning CPL Extension” \InProcServer32(Default) = “deskpan.dll” [file not found] “{88895560-9AA2-1069-930E-00AA0030EBC8}” = “HyperTerminal Icon Ext” - {HKLM…CLSID} = “HyperTerminal Icon Ext” \InProcServer32(Default) = “C:\WINDOWS\system32\hticons.dll” [“Hilgraeve, Inc.”] “{cc86590a-b60a-48e6-996b-41d25ed39a1e}” = “Portable Media Devices Menu” - {HKLM…CLSID} = “Portable Media Devices Menu” \InProcServer32(Default) = “C:\WINDOWS\system32\Audiodev.dll” [MS] “{2F603045-309F-11CF-9774-0020AFD0CFF6}” = “Synaptics Control Panel” - {HKLM…CLSID} = (no title provided) \InProcServer32(Default) = “C:\Program Files\Synaptics\SynTP\SynTPCpl.dll” [“Synaptics, Inc.”] “{7F67036B-66F1-411A-AD85-759FB9C5B0DB}” = “ShellViewRTF” - {HKLM…CLSID} = “ShellViewRTF” \InProcServer32(Default) = “C:\WINDOWS\system32\ShellvRTF.dll” [“XSS”] “{B9E1D2CB-CCFF-4AA6-9579-D7A4754030EF}” = “iTunes” - {HKLM…CLSID} = “iTunes” \InProcServer32(Default) = “C:\Program Files\iTunes\iTunesMiniPlayer.dll” [“Apple Inc.”] “{32020A01-506E-484D-A2A8-BE3CF17601C3}” = “AlcoholShellEx” - {HKLM…CLSID} = “AlcoholShellEx” \InProcServer32(Default) = “C:\PROGRA~1\ALCOHO~1\ALCOHO~1\AxShlex.dll” [“Alcohol Soft Development Team”] “{F0CB00CD-5A07-4D91-97F5-A8C92CDA93E4}” = “Shell Extensions for RealOne Player” - {HKLM…CLSID} = “RealOne Player Context Menu Class” \InProcServer32(Default) = “C:\Program Files\Real Alternative\rpshell.dll” [“RealNetworks, Inc.”] “{42042206-2D85-11D3-8CFF-005004838597}” = “Microsoft Office HTML Icon Handler” - {HKLM…CLSID} = (no title provided) \InProcServer32(Default) = “C:\Program Files\Microsoft Office\Office10\msohev.dll” [MS] “{8D1636FD-CA49-4B4E-90E4-0A20E03A15E8}” = “jetAudio” - {HKLM…CLSID} = “JetFlExt” \InProcServer32(Default) = “C:\Program Files\JetAudio\JetFlExt.dll” [“JetAudio, Inc.”] “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” = “WinRAR shell extension” - {HKLM…CLSID} = “WinRAR” \InProcServer32(Default) = “C:\Program Files\WinRAR\rarext.dll” [null data] “{472083B0-C522-11CF-8763-00608CC02F24}” = “avast” - {HKLM…CLSID} = “avast” \InProcServer32(Default) = “C:\Program Files\Alwil Software\Avast4\ashShell.dll” [“ALWIL Software”] “{A5110426-177D-4e08-AB3F-785F10B4439C}” = “Sony Ericsson File Manager” - {HKLM…CLSID} = “Sony Ericsson File Manager” \InProcServer32(Default) = “C:\Program Files\Sony Ericsson\Mobile2\File Manager\fmgrgui.dll” [“Sony Ericsson Mobile Communications AB”] “{C52AF81D-F7A0-4AAB-8E87-F80A60CCD396}” = “OpenOffice.org Column Handler” - {HKLM…CLSID} = (no title provided) \InProcServer32(Default) = ““C:\Program Files\OpenOffice.org 2.2\program\shlxthdl.dll”” [“Sun Microsystems, Inc.”] “{087B3AE3-E237-4467-B8DB-5A38AB959AC9}” = “OpenOffice.org Infotip Handler” - {HKLM…CLSID} = (no title provided) \InProcServer32(Default) = ““C:\Program Files\OpenOffice.org 2.2\program\shlxthdl.dll”” [“Sun Microsystems, Inc.”] “{63542C48-9552-494A-84F7-73AA6A7C99C1}” = “OpenOffice.org Property Sheet Handler” - {HKLM…CLSID} = (no title provided) \InProcServer32(Default) = ““C:\Program Files\OpenOffice.org 2.2\program\shlxthdl.dll”” [“Sun Microsystems, Inc.”] “{3B092F0C-7696-40E3-A80F-68D74DA84210}” = “OpenOffice.org Thumbnail Viewer” - {HKLM…CLSID} = (no title provided) \InProcServer32(Default) = ““C:\Program Files\OpenOffice.org 2.2\program\shlxthdl.dll”” [“Sun Microsystems, Inc.”] “{8932AEFE-9DB6-4f43-AFB2-5682F55E773A}” = “VPCHostCopyHook” - {HKLM…CLSID} = “VPCHostCopyHook” \InProcServer32(Default) = “C:\Program Files\Microsoft Virtual PC\VPCShExH.DLL” [MS] “{967B2D40-8B7D-4127-9049-61EA0C2C6DCE}” = “PowerISO” - {HKLM…CLSID} = “PowerISO” \InProcServer32(Default) = “C:\Program Files\PowerISO\PWRISOSH.DLL” [“PowerISO Computing, Inc.”] HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ igfxcui\DLLName = “igfxdev.dll” [“Intel Corporation”] HKLM\Software\Classes\Folder\shellex\ColumnHandlers\ {C52AF81D-F7A0-4AAB-8E87-F80A60CCD396}(Default) = “OpenOffice.org Column Handler” - {HKLM…CLSID} = (no title provided) \InProcServer32(Default) = ““C:\Program Files\OpenOffice.org 2.2\program\shlxthdl.dll”” [“Sun Microsystems, Inc.”] {F9DB5320-233E-11D1-9F84-707F02C10627}(Default) = “PDF Column Info” - {HKLM…CLSID} = “PDF Shell Extension” \InProcServer32(Default) = “C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\PDFShell.dll” [“Adobe Systems, Inc.”] HKLM\Software\Classes*\shellex\ContextMenuHandlers\ avast(Default) = “{472083B0-C522-11CF-8763-00608CC02F24}” - {HKLM…CLSID} = “avast” \InProcServer32(Default) = “C:\Program Files\Alwil Software\Avast4\ashShell.dll” [“ALWIL Software”] PowerISO(Default) = “{967B2D40-8B7D-4127-9049-61EA0C2C6DCE}” - {HKLM…CLSID} = “PowerISO” \InProcServer32(Default) = “C:\Program Files\PowerISO\PWRISOSH.DLL” [“PowerISO Computing, Inc.”] WinRAR(Default) = “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” - {HKLM…CLSID} = “WinRAR” \InProcServer32(Default) = “C:\Program Files\WinRAR\rarext.dll” [null data] HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\ jetAudio(Default) = “{8D1636FD-CA49-4B4E-90E4-0A20E03A15E8}” - {HKLM…CLSID} = “JetFlExt” \InProcServer32(Default) = “C:\Program Files\JetAudio\JetFlExt.dll” [“JetAudio, Inc.”] PowerISO(Default) = “{967B2D40-8B7D-4127-9049-61EA0C2C6DCE}” - {HKLM…CLSID} = “PowerISO” \InProcServer32(Default) = “C:\Program Files\PowerISO\PWRISOSH.DLL” [“PowerISO Computing, Inc.”] WinRAR(Default) = “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” - {HKLM…CLSID} = “WinRAR” \InProcServer32(Default) = “C:\Program Files\WinRAR\rarext.dll” [null data] HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\ avast(Default) = “{472083B0-C522-11CF-8763-00608CC02F24}” - {HKLM…CLSID} = “avast” \InProcServer32(Default) = “C:\Program Files\Alwil Software\Avast4\ashShell.dll” [“ALWIL Software”] jetAudio(Default) = “{8D1636FD-CA49-4B4E-90E4-0A20E03A15E8}” - {HKLM…CLSID} = “JetFlExt” \InProcServer32(Default) = “C:\Program Files\JetAudio\JetFlExt.dll” [“JetAudio, Inc.”] PowerISO(Default) = “{967B2D40-8B7D-4127-9049-61EA0C2C6DCE}” - {HKLM…CLSID} = “PowerISO” \InProcServer32(Default) = “C:\Program Files\PowerISO\PWRISOSH.DLL” [“PowerISO Computing, Inc.”] WinRAR(Default) = “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” - {HKLM…CLSID} = “WinRAR” \InProcServer32(Default) = “C:\Program Files\WinRAR\rarext.dll” [null data] Group Policies {policy setting}: -------------------------------- Note: detected settings may not have any effect. HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\ “NoCDBurning” = (REG_DWORD) hex:0x00000000 {unrecognized setting} HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\ “shutdownwithoutlogon” = (REG_DWORD) hex:0x00000001 {Shutdown: Allow system to be shut down without having to log on} “undockwithoutlogon” = (REG_DWORD) hex:0x00000001 {Devices: Allow undock without having to log on} Active Desktop and Wallpaper: ----------------------------- Active Desktop may be disabled at this entry: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState Displayed if Active Desktop enabled and wallpaper not set by Group Policy: HKCU\Software\Microsoft\Internet Explorer\Desktop\General\ “Wallpaper” = “C:\WINDOWS\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Wallpaper1.bmp” Displayed if Active Desktop disabled and wallpaper not set by Group Policy: HKCU\Control Panel\Desktop\ “Wallpaper” = “C:\Documents and Settings\Mistrzu\Local Settings\Application Data\Microsoft\Wallpaper1.bmp” DESKTOP.INI DLL launch in local fixed drive directories: -------------------------------------------------------- D:\cmdcons\DESKTOP.INI [.ShellClassInfo] CLSID={7f67036b-66f1-411a-ad85-759fb9c5b0db} - {HKLM…CLSID}\InProcServer32(Default) = “C:\WINDOWS\system32\ShellvRTF.dll” [“XSS”] D:\MiniNT\DESKTOP.INI [.ShellClassInfo] CLSID={7f67036b-66f1-411a-ad85-759fb9c5b0db} - {HKLM…CLSID}\InProcServer32(Default) = “C:\WINDOWS\system32\ShellvRTF.dll” [“XSS”] D:\I386\DESKTOP.INI [.ShellClassInfo] CLSID={7f67036b-66f1-411a-ad85-759fb9c5b0db} - {HKLM…CLSID}\InProcServer32(Default) = “C:\WINDOWS\system32\ShellvRTF.dll” [“XSS”] D:\PRELOAD\DESKTOP.INI [.ShellClassInfo] CLSID={7f67036b-66f1-411a-ad85-759fb9c5b0db} - {HKLM…CLSID}\InProcServer32(Default) = “C:\WINDOWS\system32\ShellvRTF.dll” [“XSS”] Startup items in “Mistrzu” “All Users” startup folders: --------------------------------------------------------- C:\Documents and Settings\All Users\Start Menu\Programs\Startup “hp psc 1000 series” - shortcut to: “C:\Program Files\HP\Digital Imaging\bin\hpohmr08.exe” [“Hewlett-Packard Co.”] “hpoddt01.exe” - shortcut to: “C:\Program Files\HP\Digital Imaging\bin\hpotdd01.exe” [“Hewlett-Packard”] Enabled Scheduled Tasks: ------------------------ “AppleSoftwareUpdate” - launches: “C:\Program Files\Apple Software Update\SoftwareUpdate.exe -task” [“Apple Inc.”] “FRU Task #Hewlett-Packard#hp psc 1100 series#1195077836” - launches: "C:\Program Files\HP\Digital Imaging\Bin\hpqfrucl.exe -I “#Hewlett-Packard#hp psc 1100 series#1195077836"” [empty string] Winsock2 Service Provider DLLs: ------------------------------- Namespace Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++} 000000000001\LibraryPath = “%SystemRoot%\System32\mswsock.dll” [MS] 000000000002\LibraryPath = “%SystemRoot%\System32\winrnr.dll” [MS] 000000000003\LibraryPath = “%SystemRoot%\System32\mswsock.dll” [MS] Transport Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++} 0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range: %SystemRoot%\system32\mswsock.dll [MS], 01 - 03, 06 - 19 %SystemRoot%\system32\rsvpsp.dll [MS], 04 - 05 Toolbars, Explorer Bars, Extensions: ------------------------------------ Extensions (Tools menu items, main toolbar menu buttons) HKLM\Software\Microsoft\Internet Explorer\Extensions\ {08B0E5C0-4FCB-11CF-AAA5-00401C608501}\ “MenuText” = “Sun Java Console” “CLSIDExtension” = “{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBC}” - {HKCU…CLSID} = “Java Plug-in 1.6.0_03” \InProcServer32(Default) = “C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll” [“Sun Microsystems, Inc.”] - {HKLM…CLSID} = “Java Plug-in 1.6.0_03” \InProcServer32(Default) = “C:\Program Files\Java\jre1.6.0_03\bin\npjpi160_03.dll” [“Sun Microsystems, Inc.”] Running Services (Display Name, Service Name, Path {Service DLL}): ------------------------------------------------------------------ Apple Mobile Device, Apple Mobile Device, ““C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe”” [“Apple, Inc.”] avast! Antivirus, avast! Antivirus, ““C:\Program Files\Alwil Software\Avast4\ashServ.exe”” [“ALWIL Software”] avast! iAVS4 Control Service, aswUpdSv, ““C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe”” [“ALWIL Software”] avast! Mail Scanner, avast! Mail Scanner, ““C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe” /service” [“ALWIL Software”] avast! Web Scanner, avast! Web Scanner, ““C:\Program Files\Alwil Software\Avast4\ashWebSv.exe” /service” [“ALWIL Software”] B’s Recorder GOLD Library General Service, bgsvcgen, “C:\WINDOWS\system32\bgsvcgen.exe” [“B.H.A Corporation”] hpqwmiex, hpqwmiex, “C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe” [“Hewlett-Packard Development Company, L.P.”] HTTP SSL, HTTPFilter, “C:\WINDOWS\System32\svchost.exe -k HTTPFilter” {“C:\WINDOWS\System32\w3ssl.dll” [MS]} LightScribeService Direct Disc Labeling Service, LightScribeService, ““C:\Program Files\Common Files\LightScribe\LSSrvc.exe”” [“Hewlett-Packard Company”] MATLAB Server, matlabserver, “C:\Program Files\MATLAB71\webserver\bin\win32\matlabserver.exe” [null data] ProtexisLicensing, ProtexisLicensing, ““C:\Program Files\Common Files\Protexis\License Service\PSIService.exe”” [null data] StarWind AE Service, StarWindServiceAE, “C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe” [“Rocket Division Software”] Windows User Mode Driver Framework, UMWdf, “C:\WINDOWS\system32\wdfmgr.exe” [MS] Print Monitors: --------------- HKLM\System\CurrentControlSet\Control\Print\Monitors\ hpzsnt07\Driver = “hpzsnt07.dll” [“HP”] ---------- : Suspicious data at a malware launch point. + This report excludes default entries except where indicated. + To see *everywhere* the script checks and *everything* it finds, launch it from a command prompt or a shortcut with the -all parameter. + The search for DESKTOP.INI DLL launch points on all local fixed drives took 395 seconds. ---------- (total run time: 466 seconds)

[Gutek]

Daj log z ComboFix

[pasquali]

ComboFix 07-11-19.4 - Mistrzu 2007-11-28 10:04:20.1 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.2.1250.1.1033.18.82 [GMT 1:00] Running from: C:\instalki\antispyware_adawere_antirootkit_antiSHIT\ComboFix.exe * Created a new restore point . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\WINDOWS\Downloaded Program Files\ODCTOOLS D:\Autorun.inf . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\nm ((((((((((((((((((((((((( Files Created from 2007-10-28 to 2007-11-28 ))))))))))))))))))))))))))))))) . 2007-11-26 18:10 289,144 --a------ C:\WINDOWS\system32\VCCLSID.exe 2007-11-26 18:10 25,600 --a------ C:\WINDOWS\system32\WS2Fix.exe 2007-11-26 18:06 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe 2007-11-26 18:06 53,248 --a------ C:\WINDOWS\system32\Process.exe 2007-11-19 09:54 2007-11-14 22:58 2007-11-14 21:02 2007-11-14 17:00 2007-11-14 17:00 2007-11-14 16:56 2007-11-14 16:48 2007-11-14 16:44 2007-11-13 18:55 2007-11-13 18:54 2007-11-13 18:54 2007-11-13 18:54 2007-11-12 23:31 2007-11-11 11:48 2007-11-11 11:48 2007-11-07 20:25 2007-11-07 20:24 2007-11-05 21:26 2007-10-28 22:16 2007-10-28 21:35 407,104 --a------ C:\WINDOWS\system32\MSHFLXGD.OCX 2007-10-28 21:35 203,976 --a------ C:\WINDOWS\system32\RICHTX32.OCX 2007-10-28 21:15 2007-10-28 16:54 2007-10-28 16:17 . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2007-11-27 12:23 --------- d-----w C:\Program Files\eMule 2007-11-26 17:11 --------- d-----w C:\Program Files\SmitfraudFix 2007-11-18 20:25 --------- d-----w C:\Documents and Settings\All Users\Application Data\Kodak 2007-11-14 17:46 --------- d-----w C:\Program Files\Tlen 2007-11-13 18:56 --------- d-----w C:\Documents and Settings\Mistrzu\Application Data\Tlen.pl 2007-11-12 08:14 12,288 ----a-w C:\WINDOWS\system32\drivers\nhcDriver.sys 2007-10-30 14:40 --------- d-----w C:\Program Files\Mplayer 2007-10-29 08:54 68,728 ----a-w C:\Documents and Settings\Mistrzu\Application Data\GDIPFONTCACHEV1.DAT 2007-10-28 15:15 685,816 ----a-w C:\WINDOWS\system32\drivers\sptd.sys 2007-10-26 21:54 --------- d-----w C:\Documents and Settings\Mistrzu\Application Data\Hamachi 2007-10-24 11:02 --------- d-----w C:\Program Files\Odkurzacz 2007-10-22 13:45 --------- d-----w C:\Program Files\Kodak 2007-10-22 13:41 --------- d–h--w C:\Program Files\InstallShield Installation Information 2007-10-22 13:41 --------- d-----w C:\Program Files\Eli2.0 2007-10-22 13:39 --------- d-----w C:\Program Files\Corel 2007-10-19 13:44 --------- d-----w C:\Program Files\VirtualDJ 2007-10-17 12:47 0 —ha-w C:\WINDOWS\system32\drivers\MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf 2007-10-17 12:47 0 —ha-w C:\WINDOWS\system32\drivers\Msft_Kernel_ggsemc_01005.Wdf 2007-10-17 12:42 19,424 ----a-w C:\WINDOWS\system32\drivers\ggsemc.sys 2007-10-16 11:34 --------- d-----w C:\Program Files\MSXML 6.0 2007-10-15 19:20 --------- d-----w C:\Program Files\Microsoft Virtual PC 2007-10-10 13:31 --------- d-----w C:\Program Files\free pascal 2007-10-09 16:29 --------- d-----w C:\Program Files\FinePixViewer 2007-10-08 15:58 --------- d-----w C:\Documents and Settings\All Users\Application Data\BVRP Software 2007-10-08 15:10 92,064 ----a-w C:\Documents and Settings\Mistrzu\mqdmmdm.sys 2007-10-08 15:10 9,232 ----a-w C:\Documents and Settings\Mistrzu\mqdmmdfl.sys 2007-10-08 15:10 79,328 ----a-w C:\Documents and Settings\Mistrzu\mqdmserd.sys 2007-10-08 15:10 66,656 ----a-w C:\Documents and Settings\Mistrzu\mqdmbus.sys 2007-10-08 15:10 6,208 ----a-w C:\Documents and Settings\Mistrzu\mqdmcmnt.sys 2007-10-08 15:10 5,936 ----a-w C:\Documents and Settings\Mistrzu\mqdmwhnt.sys 2007-10-08 15:10 4,048 ----a-w C:\Documents and Settings\Mistrzu\mqdmcr.sys 2007-10-08 15:10 25,600 ----a-w C:\Documents and Settings\Mistrzu\usbsermptxp.sys 2007-10-08 15:10 22,768 ----a-w C:\Documents and Settings\Mistrzu\usbsermpt.sys 2007-10-08 15:10 --------- d-----w C:\Program Files\Motorola Phone Tools 2007-10-08 15:07 --------- d-----w C:\Program Files\Avanquest update 2007-10-03 17:55 --------- d-----w C:\Documents and Settings\Mistrzu\Application Data\FUJIFILM 2007-10-03 17:47 --------- d-----w C:\Program Files\PIXELA 2007-10-03 17:24 --------- d-----w C:\Documents and Settings\Mistrzu\Application Data\InstallShield 2007-10-03 17:23 --------- d-----w C:\Program Files\REGSHAVE 2007-10-03 06:29 --------- d-----w C:\Program Files\Java 2007-10-02 22:05 --------- d-----w C:\Program Files\iTunes 2007-10-02 22:05 --------- d-----w C:\Program Files\iPod 2007-10-02 22:03 --------- d-----w C:\Program Files\QuickTime 2007-10-02 22:03 --------- d-----w C:\Documents and Settings\All Users\Application Data\Apple Computer 2007-10-02 22:02 --------- d-----w C:\Program Files\Apple Software Update 2007-10-02 22:01 --------- d-----w C:\Program Files\Common Files\Apple 2007-10-02 22:01 --------- d-----w C:\Documents and Settings\All Users\Application Data\Apple 2007-03-13 13:51 8 -c–a-w C:\Documents and Settings\Mistrzu\Application Data\usb.dat.bin 2007-06-04 21:13 56 --sh–r C:\WINDOWS\system32\041CF54FA8.sys 2007-06-25 19:30 88 --sh–r C:\WINDOWS\system32\A84FF51C04.sys 2007-06-25 19:30 3,766 --sha-w C:\WINDOWS\system32\KGyGaAvL.sys . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “ctfmon.exe”=“C:\WINDOWS\system32\ctfmon.exe” [2004-08-04 22:00] “Komunikator”=“C:\Program Files\Tlen\tlen.exe” [2007-09-27 12:43] “P2kAutostart”="" [] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “SunJavaUpdateSched”=“C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe” [2007-09-25 00:11] “High Definition Audio Property Page Shortcut”=“CHDAudPropShortcut.exe” [2006-04-18 12:29 C:\WINDOWS\system32\CHDAudPropShortcut.exe] “SynTPEnh”=“C:\Program Files\Synaptics\SynTP\SynTPEnh.exe” [2006-03-04 06:46] “ISUSPM Startup”=“C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe” [2005-08-12 00:30] “ISUSScheduler”=“C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe” [2005-08-12 00:30] “RecGuard”=“C:\Windows\SMINST\RecGuard.exe” [2005-10-11 18:23] “avast!”=“C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe” [2007-09-06 11:06] “QuickTime Task”=“C:\Program Files\K-Lite Codec Pack\QuickTime\qttask.exe” [2007-06-29 05:24] “REGSHAVE”=“C:\Program Files\REGSHAVE\REGSHAVE.exe” [2002-02-04 21:32] “IgfxTray”=“C:\WINDOWS\system32\igfxtray.exe” [2007-08-24 11:01] “HotKeysCmds”=“C:\WINDOWS\system32\hkcmd.exe” [2007-08-24 11:01] “Persistence”=“C:\WINDOWS\system32\igfxpers.exe” [2007-08-24 11:00] [HKEY_USERS.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] “CTFMON.EXE”=“C:\WINDOWS\system32\ctfmon.exe” [2004-08-04 22:00] C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ hp psc 1000 series.lnk - C:\Program Files\HP\Digital Imaging\bin\hpohmr08.exe [2003-04-09 18:21:38] hpoddt01.exe.lnk - C:\Program Files\HP\Digital Imaging\bin\hpotdd01.exe [2003-04-09 18:11:12] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Photosmart Premier Fast Start.lnk] path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\HP Photosmart Premier Fast Start.lnk backup=C:\WINDOWS\pss\HP Photosmart Premier Fast Start.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk] path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Mistrzu^Start Menu^Programs^StartUp^Adobe Gamma.lnk] path=C:\Documents and Settings\Mistrzu\Start Menu\Programs\StartUp\Adobe Gamma.lnk backup=C:\WINDOWS\pss\Adobe Gamma.lnkStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher] 2007-10-10 18:51 39792 --a------ C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Cpqset] 2006-02-22 16:03 40960 --a------ C:\Program Files\HPQ\Default Settings\cpqset.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update] 2005-02-17 07:11 49152 --a------ C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\hpWirelessAssistant] 2006-02-15 03:49 454656 --a------ C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper] 2007-09-26 13:42 267064 --a------ C:\Program Files\iTunes\iTunesHelper.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Odkurzacz-MCD] 2007-05-03 09:02 264704 --a------ C:\Program Files\Odkurzacz\odk_mcd.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QPService] 2006-04-12 05:54 102400 --a------ C:\Program Files\HP\QuickPlay\QPService.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg] 2006-10-18 08:39 163576 --a------ C:\Program Files\Google\GoogleToolbarNotifier\1.2.908.5008\GoogleToolbarNotifier.exe R2 HWiNFO32;HWiNFO32 Kernel Driver;??\C:\Program Files\HWiNFO32\HWiNFO32.SYS S3 k310bus;Sony Ericsson K310 Driver driver (WDM);C:\WINDOWS\system32\DRIVERS\k310bus.sys S3 k310mdfl;Sony Ericsson K310 USB WMC Modem Filter;C:\WINDOWS\system32\DRIVERS\k310mdfl.sys S3 k310mdm;Sony Ericsson K310 USB WMC Modem Driver;C:\WINDOWS\system32\DRIVERS\k310mdm.sys S3 k310mgmt;Sony Ericsson K310 USB WMC Device Management Drivers (WDM);C:\WINDOWS\system32\DRIVERS\k310mgmt.sys S3 k310obex;Sony Ericsson K310 USB WMC OBEX Interface;C:\WINDOWS\system32\DRIVERS\k310obex.sys S3 ntportio;ntportio;??\C:\instalki\ntportio.sys S3 SER120;OTI Serial port driver;C:\WINDOWS\system32\DRIVERS\SER120.sys S3 USBAAPL;Apple Mobile USB Driver;C:\WINDOWS\system32\Drivers\usbaapl.sys . Contents of the ‘Scheduled Tasks’ folder “2007-11-08 09:33:05 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job” - C:\Program Files\Apple Software Update\SoftwareUpdate.exe “2007-11-25 22:08:01 C:\WINDOWS\Tasks\FRU Task #Hewlett-Packard#hp psc 1100 series#1195077836.job” - C:\Program Files\HP\Digital Imaging\Bin\hpqfrucl.exe4-I . ************************************************************************** catchme 0.3.1262 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-11-28 10:14:36 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes … scanning hidden autostart entries … scanning hidden files … scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2007-11-28 10:16:23 . — E O F —

Po zakończeniu działania ComboFix, dokładnie po restarcie, na tray’u pojawiła się ikonka -czerwona tarcza z krzyzykiem- “Windows Security Alerts”.

[Gutek]

Pobierz program SDFix

[pasquali]

SDFix: Version 1.116 Run by Mistrzu on 2007-11-28 at 23:05 Microsoft Windows XP [Version 5.1.2600] Running From: C:\SDFix Safe Mode: Checking Services: Restoring Windows Registry Values Restoring Windows Default Hosts File Rebooting… Normal Mode: Checking Files: No Trojan Files Found Removing Temp Files… ADS Check: C:\WINDOWS No streams found. C:\WINDOWS\system32 No streams found. C:\WINDOWS\system32\svchost.exe No streams found. C:\WINDOWS\system32\ntoskrnl.exe No streams found. Final Check: catchme 0.3.1262.1 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-11-28 23:16:23 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes … scanning hidden services & system hive … [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg] “s1”=dword:2df9c43f “s2”=dword:110480d0 “h0”=dword:00000001 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04] “p0”=“C:\Program Files\Alcohol Soft\Alcohol 120” “h0”=dword:00000000 “ujdew”=hex:83,fd,96,f6,a0,27,cd,4b,45,7c,62,c6,5d,09,68,bf,96,79,5b,79,f3,… [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control] “WaitToKillServiceTimeout”=“4000” [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\Session Manager\Memory Management\PrefetchParameters] “VideoInitTime”=dword:00000530 [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\Watchdog\Display] “ShutdownCount”=dword:000003e0 [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\ACPI\PNPA000\4&5d18f2df&0] “Service”=“ac13aw8q” [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\SharedAccess\Epoch] “Epoch”=dword:000017e5 [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04] “p0”=“C:\Program Files\Alcohol Soft\Alcohol 120” “h0”=dword:00000000 “ujdew”=hex:83,fd,96,f6,a0,27,cd,4b,45,7c,62,c6,5d,09,68,bf,96,79,5b,79,f3,… [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\SynTP\Parameters] “DetectTimeMS”=dword:000003ad [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\WmiApRpl\Performance] “Last Counter”=dword:000013b8 “Last Help”=dword:000013b9 “Object List”=“4998 4998 5004 5004 5016 5016 5024 5024 5030 5030” scanning hidden registry entries … [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\Paj\x0105czek 5 NxG STD_is1] “SlowInfoCache”=hex:28,02,00,00,01,00,00,00,00,d0,6a,01,00,00,00,00,7a,c5,f8,c7,ff,… “Changed”=dword:00000000 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Perflib] “Last Counter”=dword:0000138a “Last Help”=dword:0000138b [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-19] “RefCount”=dword:00000002 [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Start Menu2\Programs\AidemMedia\Wersje demonstracyjne\Szko\x0142a Kozio\x142ka Mato\x142ka] “Order”=hex:08,00,00,00,02,00,00,00,be,01,00,00,01,00,00,00,03,00,00,00,7e,… scanning hidden files … scan completed successfully hidden processes: 0 hidden services: 0 hidden files: 0 Remaining Services: ------------------ Authorized Application Key Export: [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list] Remaining Files: --------------- Files with Hidden Attributes: Mon 4 Jun 2007 56 …SHR — “C:\WINDOWS\system32\041CF54FA8.sys” Mon 25 Jun 2007 88 …SHR — “C:\WINDOWS\system32\A84FF51C04.sys” Mon 25 Jun 2007 3,766 A.SH. — “C:\WINDOWS\system32\KGyGaAvL.sys” Mon 15 Oct 2007 165,232 A…H. — “C:\Documents and Settings\Mistrzu\Application Data\Microsoft\Virtual PC\VPCKeyboard.dll” Finished!

Dodam, że problem pozostaje;)

[Gutek]

Wklej do Notatnika:

File:: C:\WINDOWS\system32\VCCLSID.exe C:\WINDOWS\system32\WS2Fix.exe C:\WINDOWS\system32\SrchSTS.exe C:\WINDOWS\system32\Process.exe

>>Plik>>Zapisz jako… >>> CFScript (najwygodniej będzie, jeśli zapiszesz w takiej lokalizacji, by ikonka CFScript.txt znalazła się obok ikonki ComboFix.exe )

Przeciągnij i upuść plik CFScript.txt na plik ComboFix.exe (czyli ikonkę CFScript.txt na ikonkę ComboFix.exe )

– podobnie jak na tym obrazku –>

(jeśli pojawi się pytanie " 1 or 2" - to wpisz 1 i naciśnij ENTER) Ma się rozpocząć usuwanie. (i powstanie log)

Po restarcie usuń ręcznie folder C: ** Qoobox**.

Po tym nowy log z Combo

Optymalizacja XP: http://forum.dobreprogramy.pl/viewtopic.php?t=76580 + optymalizacja Autostartu

Czyszczenie rejestru:

RegCleaner - http://www.dobreprogramy.pl/index.php?dz=2t=29id=177

możesz rejestr przelecieć albo

jv16 PowerTools - http://www.dobreprogramy.pl/index.php?dz=2t=29id=509

Opis RegCleaner - http://www.agavk.p9.pl/strony/progra_regcleaner.php

Zobacz - Obsługa jv16 PowerTools

[pasquali]

ComboFix 07-11-19.4 - Mistrzu 2007-11-28 10:04:20.1 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.2.1250.1.1033.18.82 [GMT 1:00] Running from: C:\instalki\antispyware_adawere_antirootkit_antiSHIT\ComboFix.exe * Created a new restore point . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\WINDOWS\Downloaded Program Files\ODCTOOLS D:\Autorun.inf . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\nm ((((((((((((((((((((((((( Files Created from 2007-10-28 to 2007-11-28 ))))))))))))))))))))))))))))))) . 2007-11-26 18:10 289,144 --a------ C:\WINDOWS\system32\VCCLSID.exe 2007-11-26 18:10 25,600 --a------ C:\WINDOWS\system32\WS2Fix.exe 2007-11-26 18:06 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe 2007-11-26 18:06 53,248 --a------ C:\WINDOWS\system32\Process.exe 2007-11-19 09:54 2007-11-14 22:58 2007-11-14 21:02 2007-11-14 17:00 2007-11-14 17:00 2007-11-14 16:56 2007-11-14 16:48 2007-11-14 16:44 2007-11-13 18:55 2007-11-13 18:54 2007-11-13 18:54 2007-11-13 18:54 2007-11-12 23:31 2007-11-11 11:48 2007-11-11 11:48 2007-11-07 20:25 2007-11-07 20:24 2007-11-05 21:26 2007-10-28 22:16 2007-10-28 21:35 407,104 --a------ C:\WINDOWS\system32\MSHFLXGD.OCX 2007-10-28 21:35 203,976 --a------ C:\WINDOWS\system32\RICHTX32.OCX 2007-10-28 21:15 2007-10-28 16:54 2007-10-28 16:17 . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2007-11-27 12:23 --------- d-----w C:\Program Files\eMule 2007-11-26 17:11 --------- d-----w C:\Program Files\SmitfraudFix 2007-11-18 20:25 --------- d-----w C:\Documents and Settings\All Users\Application Data\Kodak 2007-11-14 17:46 --------- d-----w C:\Program Files\Tlen 2007-11-13 18:56 --------- d-----w C:\Documents and Settings\Mistrzu\Application Data\Tlen.pl 2007-11-12 08:14 12,288 ----a-w C:\WINDOWS\system32\drivers\nhcDriver.sys 2007-10-30 14:40 --------- d-----w C:\Program Files\Mplayer 2007-10-29 08:54 68,728 ----a-w C:\Documents and Settings\Mistrzu\Application Data\GDIPFONTCACHEV1.DAT 2007-10-28 15:15 685,816 ----a-w C:\WINDOWS\system32\drivers\sptd.sys 2007-10-26 21:54 --------- d-----w C:\Documents and Settings\Mistrzu\Application Data\Hamachi 2007-10-24 11:02 --------- d-----w C:\Program Files\Odkurzacz 2007-10-22 13:45 --------- d-----w C:\Program Files\Kodak 2007-10-22 13:41 --------- d–h--w C:\Program Files\InstallShield Installation Information 2007-10-22 13:41 --------- d-----w C:\Program Files\Eli2.0 2007-10-22 13:39 --------- d-----w C:\Program Files\Corel 2007-10-19 13:44 --------- d-----w C:\Program Files\VirtualDJ 2007-10-17 12:47 0 —ha-w C:\WINDOWS\system32\drivers\MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf 2007-10-17 12:47 0 —ha-w C:\WINDOWS\system32\drivers\Msft_Kernel_ggsemc_01005.Wdf 2007-10-17 12:42 19,424 ----a-w C:\WINDOWS\system32\drivers\ggsemc.sys 2007-10-16 11:34 --------- d-----w C:\Program Files\MSXML 6.0 2007-10-15 19:20 --------- d-----w C:\Program Files\Microsoft Virtual PC 2007-10-10 13:31 --------- d-----w C:\Program Files\free pascal 2007-10-09 16:29 --------- d-----w C:\Program Files\FinePixViewer 2007-10-08 15:58 --------- d-----w C:\Documents and Settings\All Users\Application Data\BVRP Software 2007-10-08 15:10 92,064 ----a-w C:\Documents and Settings\Mistrzu\mqdmmdm.sys 2007-10-08 15:10 9,232 ----a-w C:\Documents and Settings\Mistrzu\mqdmmdfl.sys 2007-10-08 15:10 79,328 ----a-w C:\Documents and Settings\Mistrzu\mqdmserd.sys 2007-10-08 15:10 66,656 ----a-w C:\Documents and Settings\Mistrzu\mqdmbus.sys 2007-10-08 15:10 6,208 ----a-w C:\Documents and Settings\Mistrzu\mqdmcmnt.sys 2007-10-08 15:10 5,936 ----a-w C:\Documents and Settings\Mistrzu\mqdmwhnt.sys 2007-10-08 15:10 4,048 ----a-w C:\Documents and Settings\Mistrzu\mqdmcr.sys 2007-10-08 15:10 25,600 ----a-w C:\Documents and Settings\Mistrzu\usbsermptxp.sys 2007-10-08 15:10 22,768 ----a-w C:\Documents and Settings\Mistrzu\usbsermpt.sys 2007-10-08 15:10 --------- d-----w C:\Program Files\Motorola Phone Tools 2007-10-08 15:07 --------- d-----w C:\Program Files\Avanquest update 2007-10-03 17:55 --------- d-----w C:\Documents and Settings\Mistrzu\Application Data\FUJIFILM 2007-10-03 17:47 --------- d-----w C:\Program Files\PIXELA 2007-10-03 17:24 --------- d-----w C:\Documents and Settings\Mistrzu\Application Data\InstallShield 2007-10-03 17:23 --------- d-----w C:\Program Files\REGSHAVE 2007-10-03 06:29 --------- d-----w C:\Program Files\Java 2007-10-02 22:05 --------- d-----w C:\Program Files\iTunes 2007-10-02 22:05 --------- d-----w C:\Program Files\iPod 2007-10-02 22:03 --------- d-----w C:\Program Files\QuickTime 2007-10-02 22:03 --------- d-----w C:\Documents and Settings\All Users\Application Data\Apple Computer 2007-10-02 22:02 --------- d-----w C:\Program Files\Apple Software Update 2007-10-02 22:01 --------- d-----w C:\Program Files\Common Files\Apple 2007-10-02 22:01 --------- d-----w C:\Documents and Settings\All Users\Application Data\Apple 2007-03-13 13:51 8 -c–a-w C:\Documents and Settings\Mistrzu\Application Data\usb.dat.bin 2007-06-04 21:13 56 --sh–r C:\WINDOWS\system32\041CF54FA8.sys 2007-06-25 19:30 88 --sh–r C:\WINDOWS\system32\A84FF51C04.sys 2007-06-25 19:30 3,766 --sha-w C:\WINDOWS\system32\KGyGaAvL.sys . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “ctfmon.exe”=“C:\WINDOWS\system32\ctfmon.exe” [2004-08-04 22:00] “Komunikator”=“C:\Program Files\Tlen\tlen.exe” [2007-09-27 12:43] “P2kAutostart”="" [] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “SunJavaUpdateSched”=“C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe” [2007-09-25 00:11] “High Definition Audio Property Page Shortcut”=“CHDAudPropShortcut.exe” [2006-04-18 12:29 C:\WINDOWS\system32\CHDAudPropShortcut.exe] “SynTPEnh”=“C:\Program Files\Synaptics\SynTP\SynTPEnh.exe” [2006-03-04 06:46] “ISUSPM Startup”=“C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe” [2005-08-12 00:30] “ISUSScheduler”=“C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe” [2005-08-12 00:30] “RecGuard”=“C:\Windows\SMINST\RecGuard.exe” [2005-10-11 18:23] “avast!”=“C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe” [2007-09-06 11:06] “QuickTime Task”=“C:\Program Files\K-Lite Codec Pack\QuickTime\qttask.exe” [2007-06-29 05:24] “REGSHAVE”=“C:\Program Files\REGSHAVE\REGSHAVE.exe” [2002-02-04 21:32] “IgfxTray”=“C:\WINDOWS\system32\igfxtray.exe” [2007-08-24 11:01] “HotKeysCmds”=“C:\WINDOWS\system32\hkcmd.exe” [2007-08-24 11:01] “Persistence”=“C:\WINDOWS\system32\igfxpers.exe” [2007-08-24 11:00] [HKEY_USERS.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] “CTFMON.EXE”=“C:\WINDOWS\system32\ctfmon.exe” [2004-08-04 22:00] C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ hp psc 1000 series.lnk - C:\Program Files\HP\Digital Imaging\bin\hpohmr08.exe [2003-04-09 18:21:38] hpoddt01.exe.lnk - C:\Program Files\HP\Digital Imaging\bin\hpotdd01.exe [2003-04-09 18:11:12] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Photosmart Premier Fast Start.lnk] path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\HP Photosmart Premier Fast Start.lnk backup=C:\WINDOWS\pss\HP Photosmart Premier Fast Start.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk] path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Mistrzu^Start Menu^Programs^StartUp^Adobe Gamma.lnk] path=C:\Documents and Settings\Mistrzu\Start Menu\Programs\StartUp\Adobe Gamma.lnk backup=C:\WINDOWS\pss\Adobe Gamma.lnkStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher] 2007-10-10 18:51 39792 --a------ C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Cpqset] 2006-02-22 16:03 40960 --a------ C:\Program Files\HPQ\Default Settings\cpqset.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update] 2005-02-17 07:11 49152 --a------ C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\hpWirelessAssistant] 2006-02-15 03:49 454656 --a------ C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper] 2007-09-26 13:42 267064 --a------ C:\Program Files\iTunes\iTunesHelper.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Odkurzacz-MCD] 2007-05-03 09:02 264704 --a------ C:\Program Files\Odkurzacz\odk_mcd.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QPService] 2006-04-12 05:54 102400 --a------ C:\Program Files\HP\QuickPlay\QPService.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg] 2006-10-18 08:39 163576 --a------ C:\Program Files\Google\GoogleToolbarNotifier\1.2.908.5008\GoogleToolbarNotifier.exe R2 HWiNFO32;HWiNFO32 Kernel Driver;??\C:\Program Files\HWiNFO32\HWiNFO32.SYS S3 k310bus;Sony Ericsson K310 Driver driver (WDM);C:\WINDOWS\system32\DRIVERS\k310bus.sys S3 k310mdfl;Sony Ericsson K310 USB WMC Modem Filter;C:\WINDOWS\system32\DRIVERS\k310mdfl.sys S3 k310mdm;Sony Ericsson K310 USB WMC Modem Driver;C:\WINDOWS\system32\DRIVERS\k310mdm.sys S3 k310mgmt;Sony Ericsson K310 USB WMC Device Management Drivers (WDM);C:\WINDOWS\system32\DRIVERS\k310mgmt.sys S3 k310obex;Sony Ericsson K310 USB WMC OBEX Interface;C:\WINDOWS\system32\DRIVERS\k310obex.sys S3 ntportio;ntportio;??\C:\instalki\ntportio.sys S3 SER120;OTI Serial port driver;C:\WINDOWS\system32\DRIVERS\SER120.sys S3 USBAAPL;Apple Mobile USB Driver;C:\WINDOWS\system32\Drivers\usbaapl.sys . Contents of the ‘Scheduled Tasks’ folder “2007-11-08 09:33:05 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job” - C:\Program Files\Apple Software Update\SoftwareUpdate.exe “2007-11-25 22:08:01 C:\WINDOWS\Tasks\FRU Task #Hewlett-Packard#hp psc 1100 series#1195077836.job” - C:\Program Files\HP\Digital Imaging\Bin\hpqfrucl.exe4-I . ************************************************************************** catchme 0.3.1262 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-11-28 10:14:36 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes … scanning hidden autostart entries … scanning hidden files … scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2007-11-28 10:16:23 . — E O F —

Nie wiem czy tak być powinno ale restart zrobiłem ręcznie, bo program po zakończeniu pracy (czy w trakcie) tego nie wykonał.

[Gutek]

Skan AVG Anti-Spyware 7.5 po update + raport

[pasquali]

--------------------------------------------------------- AVG Anti-Spyware - Scan Report --------------------------------------------------------- + Created at: 20:03:30 2007-11-30 + Scan result: HKU\S-1-5-21-4212382003-3264939475-2254161566-1006\Software\Microsoft\Windows\CurrentVersion\Ext\Stats{67982BB7-0F95-44C5-92DC-E3AF3DC19D6D} -> Adware.Generic : Ignored. C:\Program Files\music_now\inetchk.exe -> Hijacker.Small : Ignored. :mozilla.164:C:\Documents and Settings\Mistrzu\Application Data\Mozilla\Firefox\Profiles\1rum71tl.default\cookies.txt -> TrackingCookie.2o7 : Ignored. :mozilla.165:C:\Documents and Settings\Mistrzu\Application Data\Mozilla\Firefox\Profiles\1rum71tl.default\cookies.txt -> TrackingCookie.2o7 : Ignored. :mozilla.166:C:\Documents and Settings\Mistrzu\Application Data\Mozilla\Firefox\Profiles\1rum71tl.default\cookies.txt -> TrackingCookie.2o7 : Ignored. :mozilla.167:C:\Documents and Settings\Mistrzu\Application Data\Mozilla\Firefox\Profiles\1rum71tl.default\cookies.txt -> TrackingCookie.2o7 : Ignored. :mozilla.168:C:\Documents and Settings\Mistrzu\Application Data\Mozilla\Firefox\Profiles\1rum71tl.default\cookies.txt -> TrackingCookie.2o7 : Ignored. :mozilla.169:C:\Documents and Settings\Mistrzu\Application Data\Mozilla\Firefox\Profiles\1rum71tl.default\cookies.txt -> TrackingCookie.2o7 : Ignored. :mozilla.170:C:\Documents and Settings\Mistrzu\Application Data\Mozilla\Firefox\Profiles\1rum71tl.default\cookies.txt -> TrackingCookie.2o7 : Ignored. :mozilla.171:C:\Documents and Settings\Mistrzu\Application Data\Mozilla\Firefox\Profiles\1rum71tl.default\cookies.txt -> TrackingCookie.2o7 : Ignored. :mozilla.172:C:\Documents and Settings\Mistrzu\Application Data\Mozilla\Firefox\Profiles\1rum71tl.default\cookies.txt -> TrackingCookie.2o7 : Ignored. :mozilla.173:C:\Documents and Settings\Mistrzu\Application Data\Mozilla\Firefox\Profiles\1rum71tl.default\cookies.txt -> TrackingCookie.2o7 : Ignored. :mozilla.542:C:\Documents and Settings\Mistrzu\Application Data\Mozilla\Firefox\Profiles\1rum71tl.default\cookies.txt -> TrackingCookie.2o7 : Ignored. :mozilla.205:C:\Documents and Settings\Mistrzu\Application Data\Mozilla\Firefox\Profiles\1rum71tl.default\cookies.txt -> TrackingCookie.Adbrite : Ignored. :mozilla.209:C:\Documents and Settings\Mistrzu\Application Data\Mozilla\Firefox\Profiles\1rum71tl.default\cookies.txt -> TrackingCookie.Adbrite : Ignored. :mozilla.545:C:\Documents and Settings\Mistrzu\Application Data\Mozilla\Firefox\Profiles\1rum71tl.default\cookies.txt -> TrackingCookie.Adtech : Ignored. :mozilla.432:C:\Documents and Settings\Mistrzu\Application Data\Mozilla\Firefox\Profiles\1rum71tl.default\cookies.txt -> TrackingCookie.Advertising : Ignored. :mozilla.477:C:\Documents and Settings\Mistrzu\Application Data\Mozilla\Firefox\Profiles\1rum71tl.default\cookies.txt -> TrackingCookie.Atdmt : Ignored. :mozilla.290:C:\Documents and Settings\Mistrzu\Application Data\Mozilla\Firefox\Profiles\1rum71tl.default\cookies.txt -> TrackingCookie.Bfast : Ignored. :mozilla.291:C:\Documents and Settings\Mistrzu\Application Data\Mozilla\Firefox\Profiles\1rum71tl.default\cookies.txt -> TrackingCookie.Bfast : Ignored. :mozilla.122:C:\Documents and Settings\Mistrzu\Application Data\Mozilla\Firefox\Profiles\1rum71tl.default\cookies.txt -> TrackingCookie.Casalemedia : Ignored. :mozilla.123:C:\Documents and Settings\Mistrzu\Application Data\Mozilla\Firefox\Profiles\1rum71tl.default\cookies.txt -> TrackingCookie.Casalemedia : Ignored. :mozilla.124:C:\Documents and Settings\Mistrzu\Application Data\Mozilla\Firefox\Profiles\1rum71tl.default\cookies.txt -> TrackingCookie.Casalemedia : Ignored. :mozilla.125:C:\Documents and Settings\Mistrzu\Application Data\Mozilla\Firefox\Profiles\1rum71tl.default\cookies.txt -> TrackingCookie.Casalemedia : Ignored. :mozilla.126:C:\Documents and Settings\Mistrzu\Application Data\Mozilla\Firefox\Profiles\1rum71tl.default\cookies.txt -> TrackingCookie.Casalemedia : Ignored. :mozilla.127:C:\Documents and Settings\Mistrzu\Application Data\Mozilla\Firefox\Profiles\1rum71tl.default\cookies.txt -> TrackingCookie.Casalemedia : Ignored. :mozilla.248:C:\Documents and Settings\Mistrzu\Application Data\Mozilla\Firefox\Profiles\1rum71tl.default\cookies.txt -> TrackingCookie.Clickhype : Ignored. :mozilla.485:C:\Documents and Settings\Mistrzu\Application Data\Mozilla\Firefox\Profiles\1rum71tl.default\cookies.txt -> TrackingCookie.Connextra : Ignored. :mozilla.486:C:\Documents and Settings\Mistrzu\Application Data\Mozilla\Firefox\Profiles\1rum71tl.default\cookies.txt -> TrackingCookie.Connextra : Ignored. :mozilla.487:C:\Documents and Settings\Mistrzu\Application Data\Mozilla\Firefox\Profiles\1rum71tl.default\cookies.txt -> TrackingCookie.Connextra : Ignored. C:\Documents and Settings\Mistrzu\Cookies\mistrzu@connextra[1].txt -> TrackingCookie.Connextra : Ignored. :mozilla.23:C:\Documents and Settings\Mistrzu\Application Data\Mozilla\Firefox\Profiles\1rum71tl.default\cookies.txt -> TrackingCookie.Doubleclick : Ignored. :mozilla.615:C:\Documents and Settings\Mistrzu\Application Data\Mozilla\Firefox\Profiles\1rum71tl.default\cookies.txt -> TrackingCookie.Estat : Ignored. :mozilla.399:C:\Documents and Settings\Mistrzu\Application Data\Mozilla\Firefox\Profiles\1rum71tl.default\cookies.txt -> TrackingCookie.Fastclick : Ignored. :mozilla.400:C:\Documents and Settings\Mistrzu\Application Data\Mozilla\Firefox\Profiles\1rum71tl.default\cookies.txt -> TrackingCookie.Fastclick : Ignored. :mozilla.644:C:\Documents and Settings\Mistrzu\Application Data\Mozilla\Firefox\Profiles\1rum71tl.default\cookies.txt -> TrackingCookie.Googleadservices : Ignored. :mozilla.131:C:\Documents and Settings\Mistrzu\Application Data\Mozilla\Firefox\Profiles\1rum71tl.default\cookies.txt -> TrackingCookie.Hitbox : Ignored. :mozilla.132:C:\Documents and Settings\Mistrzu\Application Data\Mozilla\Firefox\Profiles\1rum71tl.default\cookies.txt -> TrackingCookie.Hitbox : Ignored. :mozilla.133:C:\Documents and Settings\Mistrzu\Application Data\Mozilla\Firefox\Profiles\1rum71tl.default\cookies.txt -> TrackingCookie.Hitbox : Ignored. :mozilla.152:C:\Documents and Settings\Mistrzu\Application Data\Mozilla\Firefox\Profiles\1rum71tl.default\cookies.txt -> TrackingCookie.Hitbox : Ignored. :mozilla.445:C:\Documents and Settings\Mistrzu\Application Data\Mozilla\Firefox\Profiles\1rum71tl.default\cookies.txt -> TrackingCookie.Hitbox : Ignored. :mozilla.617:C:\Documents and Settings\Mistrzu\Application Data\Mozilla\Firefox\Profiles\1rum71tl.default\cookies.txt -> TrackingCookie.Hitbox : Ignored. :mozilla.191:C:\Documents and Settings\Mistrzu\Application Data\Mozilla\Firefox\Profiles\1rum71tl.default\cookies.txt -> TrackingCookie.Imrworldwide : Ignored. :mozilla.192:C:\Documents and Settings\Mistrzu\Application Data\Mozilla\Firefox\Profiles\1rum71tl.default\cookies.txt -> TrackingCookie.Imrworldwide : Ignored. :mozilla.651:C:\Documents and Settings\Mistrzu\Application Data\Mozilla\Firefox\Profiles\1rum71tl.default\cookies.txt -> TrackingCookie.Ivwbox : Ignored. :mozilla.267:C:\Documents and Settings\Mistrzu\Application Data\Mozilla\Firefox\Profiles\1rum71tl.default\cookies.txt -> TrackingCookie.Masterstats : Ignored. :mozilla.25:C:\Documents and Settings\Mistrzu\Application Data\Mozilla\Firefox\Profiles\1rum71tl.default\cookies.txt -> TrackingCookie.Netflame : Ignored. :mozilla.546:C:\Documents and Settings\Mistrzu\Application Data\Mozilla\Firefox\Profiles\1rum71tl.default\cookies.txt -> TrackingCookie.Revsci : Ignored. :mozilla.547:C:\Documents and Settings\Mistrzu\Application Data\Mozilla\Firefox\Profiles\1rum71tl.default\cookies.txt -> TrackingCookie.Revsci : Ignored. :mozilla.548:C:\Documents and Settings\Mistrzu\Application Data\Mozilla\Firefox\Profiles\1rum71tl.default\cookies.txt -> TrackingCookie.Revsci : Ignored. :mozilla.549:C:\Documents and Settings\Mistrzu\Application Data\Mozilla\Firefox\Profiles\1rum71tl.default\cookies.txt -> TrackingCookie.Revsci : Ignored. :mozilla.447:C:\Documents and Settings\Mistrzu\Application Data\Mozilla\Firefox\Profiles\1rum71tl.default\cookies.txt -> TrackingCookie.Serving-sys : Ignored. :mozilla.448:C:\Documents and Settings\Mistrzu\Application Data\Mozilla\Firefox\Profiles\1rum71tl.default\cookies.txt -> TrackingCookie.Serving-sys : Ignored. :mozilla.449:C:\Documents and Settings\Mistrzu\Application Data\Mozilla\Firefox\Profiles\1rum71tl.default\cookies.txt -> TrackingCookie.Serving-sys : Ignored. :mozilla.450:C:\Documents and Settings\Mistrzu\Application Data\Mozilla\Firefox\Profiles\1rum71tl.default\cookies.txt -> TrackingCookie.Serving-sys : Ignored. :mozilla.451:C:\Documents and Settings\Mistrzu\Application Data\Mozilla\Firefox\Profiles\1rum71tl.default\cookies.txt -> TrackingCookie.Serving-sys : Ignored. :mozilla.452:C:\Documents and Settings\Mistrzu\Application Data\Mozilla\Firefox\Profiles\1rum71tl.default\cookies.txt -> TrackingCookie.Serving-sys : Ignored. :mozilla.453:C:\Documents and Settings\Mistrzu\Application Data\Mozilla\Firefox\Profiles\1rum71tl.default\cookies.txt -> TrackingCookie.Serving-sys : Ignored. :mozilla.295:C:\Documents and Settings\Mistrzu\Application Data\Mozilla\Firefox\Profiles\1rum71tl.default\cookies.txt -> TrackingCookie.Skype : Ignored. :mozilla.516:C:\Documents and Settings\Mistrzu\Application Data\Mozilla\Firefox\Profiles\1rum71tl.default\cookies.txt -> TrackingCookie.Skype : Ignored. :mozilla.632:C:\Documents and Settings\Mistrzu\Application Data\Mozilla\Firefox\Profiles\1rum71tl.default\cookies.txt -> TrackingCookie.Skype : Ignored. :mozilla.633:C:\Documents and Settings\Mistrzu\Application Data\Mozilla\Firefox\Profiles\1rum71tl.default\cookies.txt -> TrackingCookie.Skype : Ignored. :mozilla.634:C:\Documents and Settings\Mistrzu\Application Data\Mozilla\Firefox\Profiles\1rum71tl.default\cookies.txt -> TrackingCookie.Skype : Ignored. :mozilla.635:C:\Documents and Settings\Mistrzu\Application Data\Mozilla\Firefox\Profiles\1rum71tl.default\cookies.txt -> TrackingCookie.Skype : Ignored. :mozilla.639:C:\Documents and Settings\Mistrzu\Application Data\Mozilla\Firefox\Profiles\1rum71tl.default\cookies.txt -> TrackingCookie.Skype : Ignored. :mozilla.640:C:\Documents and Settings\Mistrzu\Application Data\Mozilla\Firefox\Profiles\1rum71tl.default\cookies.txt -> TrackingCookie.Skype : Ignored. :mozilla.641:C:\Documents and Settings\Mistrzu\Application Data\Mozilla\Firefox\Profiles\1rum71tl.default\cookies.txt -> TrackingCookie.Skype : Ignored. :mozilla.614:C:\Documents and Settings\Mistrzu\Application Data\Mozilla\Firefox\Profiles\1rum71tl.default\cookies.txt -> TrackingCookie.Smartadserver : Ignored. :mozilla.235:C:\Documents and Settings\Mistrzu\Application Data\Mozilla\Firefox\Profiles\1rum71tl.default\cookies.txt -> TrackingCookie.Statcounter : Ignored. :mozilla.238:C:\Documents and Settings\Mistrzu\Application Data\Mozilla\Firefox\Profiles\1rum71tl.default\cookies.txt -> TrackingCookie.Statcounter : Ignored. :mozilla.239:C:\Documents and Settings\Mistrzu\Application Data\Mozilla\Firefox\Profiles\1rum71tl.default\cookies.txt -> TrackingCookie.Statcounter : Ignored. :mozilla.456:C:\Documents and Settings\Mistrzu\Application Data\Mozilla\Firefox\Profiles\1rum71tl.default\cookies.txt -> TrackingCookie.Tacoda : Ignored. :mozilla.457:C:\Documents and Settings\Mistrzu\Application Data\Mozilla\Firefox\Profiles\1rum71tl.default\cookies.txt -> TrackingCookie.Tacoda : Ignored. :mozilla.459:C:\Documents and Settings\Mistrzu\Application Data\Mozilla\Firefox\Profiles\1rum71tl.default\cookies.txt -> TrackingCookie.Tacoda : Ignored. :mozilla.460:C:\Documents and Settings\Mistrzu\Application Data\Mozilla\Firefox\Profiles\1rum71tl.default\cookies.txt -> TrackingCookie.Tacoda : Ignored. :mozilla.32:C:\Documents and Settings\Mistrzu\Application Data\Mozilla\Firefox\Profiles\1rum71tl.default\cookies.txt -> TrackingCookie.Tradedoubler : Ignored. :mozilla.33:C:\Documents and Settings\Mistrzu\Application Data\Mozilla\Firefox\Profiles\1rum71tl.default\cookies.txt -> TrackingCookie.Tradedoubler : Ignored. :mozilla.34:C:\Documents and Settings\Mistrzu\Application Data\Mozilla\Firefox\Profiles\1rum71tl.default\cookies.txt -> TrackingCookie.Tradedoubler : Ignored. :mozilla.35:C:\Documents and Settings\Mistrzu\Application Data\Mozilla\Firefox\Profiles\1rum71tl.default\cookies.txt -> TrackingCookie.Tradedoubler : Ignored. :mozilla.401:C:\Documents and Settings\Mistrzu\Application Data\Mozilla\Firefox\Profiles\1rum71tl.default\cookies.txt -> TrackingCookie.Tribalfusion : Ignored. :mozilla.137:C:\Documents and Settings\Mistrzu\Application Data\Mozilla\Firefox\Profiles\1rum71tl.default\cookies.txt -> TrackingCookie.Webtrends : Ignored. :mozilla.46:C:\Documents and Settings\Mistrzu\Application Data\Mozilla\Firefox\Profiles\1rum71tl.default\cookies.txt -> TrackingCookie.Webtrendslive : Ignored. :mozilla.309:C:\Documents and Settings\Mistrzu\Application Data\Mozilla\Firefox\Profiles\1rum71tl.default\cookies.txt -> TrackingCookie.Yieldmanager : Ignored. :mozilla.310:C:\Documents and Settings\Mistrzu\Application Data\Mozilla\Firefox\Profiles\1rum71tl.default\cookies.txt -> TrackingCookie.Yieldmanager : Ignored. :mozilla.311:C:\Documents and Settings\Mistrzu\Application Data\Mozilla\Firefox\Profiles\1rum71tl.default\cookies.txt -> TrackingCookie.Yieldmanager : Ignored. :mozilla.312:C:\Documents and Settings\Mistrzu\Application Data\Mozilla\Firefox\Profiles\1rum71tl.default\cookies.txt -> TrackingCookie.Yieldmanager : Ignored. ::Report end

[Gutek]

To nie jest wina syfu

[pasquali]

To co to może być? Masz jakieś pomysły?

Złączono Posta : 02.12.2007 (Nie) 20:09

Noooo, znalazłem powód tego problemu! http://support.microsoft.com/kb/819017/pl

Wyłączyłem usługę Windows Image Acquisition (WIA).

Ale mimo wszystko dzięki! Nie zdawałem sobie sprawy, że mam tyle syfu.

Pzdr