prosze o sprawdzenie loga

**Posty:** 28 · przez **VoX** 30 Paź 2007, 18:54

skanowałem antywirusem on-line nic nie wykryło... skanowanie spybot'em sypware doctor nie powiodło się gdyż po jakims czasie tak mi zamula kompa, że nic sie nie da zrobic i wszystko staje LOG:

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Firebird\Firebird_1_5\bin\fbguard.exe
c:\usr\MYSQL\bin\mysqld.exe
D:\Programy\Spyware Doctor\svcntaux.exe
D:\Programy\Spyware Doctor\swdsvc.exe
E:\Instalki\Alcohol 120\StarWind\StarWindServiceAE.exe
C:\WINDOWS\System32\wdfmgr.exe
C:\Program Files\Firebird\Firebird_1_5\bin\fbserver.exe
C:\WINDOWS\Explorer.EXE
D:\Programy\Spyware Doctor\SDTrayApp.exe
C:\WINDOWS\soundman.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Unlocker\UnlockerAssistant.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\System32\ctfmon.exe
C:\WINDOWS\System32\wuauclt.exe
D:\Programy\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\FlashGet\flashget.exe
D:\hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://softwarereferral.com/jump.php?wmid=6010&mid=MjI6Ojg5&lid=2
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\System32\alg.exe,C:\WINDOWS\System32\alg.exe,
O1 - Hosts: 82.146.60.44 postbank.de
O1 - Hosts: 82.146.60.44 www.postbank.de
O1 - Hosts: 82.146.60.44 banking.postbank.de
O1 - Hosts: 82.146.60.44 direkt.postbank.de
O1 - Hosts: 82.146.60.44 www.smile.co.uk
O1 - Hosts: 82.146.60.44 smile.co.uk
O1 - Hosts: 82.146.60.44 cahoot.com
O1 - Hosts: 82.146.60.44 www.cahoot.com
O1 - Hosts: 82.146.60.44 www.cahoot.co.uk
O1 - Hosts: 82.146.60.44 cahoot.co.uk
O1 - Hosts: 82.146.60.44 www.co-operativebank.co.uk
O1 - Hosts: 82.146.60.44 co-operativebank.co.uk
O1 - Hosts: 82.146.60.44 www.co-operativebank.com
O1 - Hosts: 82.146.60.44 co-operativebank.com
O1 - Hosts: 82.146.60.44 personal.barclays.co.uk
O1 - Hosts: 82.146.60.44 barclays.co.uk
O1 - Hosts: 82.146.60.44 ibank.barclays.co.uk
O1 - Hosts: 82.146.60.44 www.barclays.co.uk
O1 - Hosts: 82.146.60.44 barclays.touchclarity.com
O1 - Hosts: 82.146.60.44 hsbc.co.uk
O1 - Hosts: 82.146.60.44 www.hsbc.co.uk
O1 - Hosts: 82.146.60.44 hsbc.touchclarity.com
O1 - Hosts: 82.146.60.44 www1.member-hsbc-group.com
O1 - Hosts: 82.146.60.44 lloydstsb.co.uk
O1 - Hosts: 82.146.60.44 www.lloydstsb.co.uk
O1 - Hosts: 82.146.60.44 lloydstsb.com
O1 - Hosts: 82.146.60.44 www.lloydstsb.com
O1 - Hosts: 82.146.60.44 mi.lloydstsb.com
O1 - Hosts: 82.146.60.44 www.woolwich.co.uk
O1 - Hosts: 82.146.60.44 woolwich.co.uk
O1 - Hosts: 82.146.60.44 www.deutsche-bank.de
O1 - Hosts: 82.146.60.44 deutsche-bank.de
O1 - Hosts: 82.146.60.44 meine.deutsche-bank.de
O1 - Hosts: 82.146.60.44 www.anbusiness.com
O1 - Hosts: 82.146.60.44 anbusiness.com
O1 - Hosts: 82.146.60.44 www.abbeyinternational.com
O1 - Hosts: 82.146.60.44 www.barclays.com
O1 - Hosts: 82.146.60.44 barclays.com
O1 - Hosts: 82.146.60.44 ibank.internationalbanking.barclays.com
O1 - Hosts: 82.146.60.44 offshore.hsbc.com
O1 - Hosts: 82.146.60.44 www.lloydstsb-offshore.com
O1 - Hosts: 82.146.60.44 lloydstsb-offshore.com
O2 - BHO: MSVPS System - {077F45D5-5CC9-4FC8-A7BB-9D79836A6066} - C:\WINDOWS\movctrlnkd.dll
O2 - BHO: BitComet Helper - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - D:\BitComet\tools\BitCometBHO_1.1.7.4.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - D:\Programy\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: IeCatch2 Class - {A5366673-E8CA-11D3-9CD9-0090271D075B} - C:\PROGRA~1\FlashGet\jccatch.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\fgiebar.dll
O3 - Toolbar: The nssfrch - {AC9BBDB2-8FCD-49C8-96F7-CC3CF7B453CD} - C:\WINDOWS\nssfrch.dll
O4 - HKLM\..\Run: [SoundMan] soundman.exe
O4 - HKLM\..\Run: [Microsoft Network Services Controller] C:\WINDOWS\System32\mmsvc32.exe
O4 - HKLM\..\Run: [Spools Service Controller] C:\WINDOWS\System32\spools.exe
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe"
O4 - HKLM\..\Run: [UnlockerAssistant] "C:\Program Files\Unlocker\UnlockerAssistant.exe"
O4 - HKLM\..\Run: [SDTray] "D:\Programy\Spyware Doctor\SDTrayApp.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [Firewall auto setup] C:\DOCUME~1\VoX\USTAWI~1\Temp\winlogon.exe
O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray
O4 - HKCU\..\Run: [Odkurzacz-MCD] C:\Program Files\Odkurzacz\odk_mcd.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] D:\Programy\Spybot - Search & Destroy\TeaTimer.exe
O8 - Extra context menu item: &D&ownload &with BitComet - res://D:\BitComet\BitComet.exe/AddLink.htm
O8 - Extra context menu item: &D&ownload all video with BitComet - res://D:\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: &D&ownload all with BitComet - res://D:\BitComet\BitComet.exe/AddAllLink.htm
O8 - Extra context menu item: Ściągnij przy pomocy FlashGet'a - C:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: Ściągnij wszystko przy pomocy FlashGet'a - C:\Program Files\FlashGet\jc_all.htm
O9 - Extra button: BitComet Search - {461CC20B-FB6E-4f16-8FE8-C29359DB100E} - D:\BitComet\tools\BitCometBHO_1.1.7.4.dll
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe
O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - D:\Programy\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - D:\Programy\Spybot - Search & Destroy\SDHelper.dll
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {68282C51-9459-467B-95BF-3C0E89627E55} (MksSkanerOnline Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O20 - Winlogon Notify: mszsrn32 - C:\WINDOWS\system32\mszsrn32.dll
O21 - SSODL: MSN Messenger - {280A7B65-8F00-438F-3E5A-1F039433FE60} - C:\WINDOWS\system32\dssdll32.dll
O21 - SSODL: bxsbang - {6B591935-F286-49B6-B6AB-3B6D398F0446} - C:\WINDOWS\bxsbang.dll
O21 - SSODL: ocgrep - {1E1A8708-FCEE-4093-B522-2699B0297DEF} - C:\WINDOWS\ocgrep.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Firebird Guardian - DefaultInstance (FirebirdGuardianDefaultInstance) - The Firebird Project - C:\Program Files\Firebird\Firebird_1_5\bin\fbguard.exe
O23 - Service: Firebird Server - DefaultInstance (FirebirdServerDefaultInstance) - The Firebird Project - C:\Program Files\Firebird\Firebird_1_5\bin\fbserver.exe
O23 - Service: MySql - Unknown owner - c:\usr/MYSQL/bin/mysqld.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - D:\Programy\Spyware Doctor\svcntaux.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - D:\Programy\Spyware Doctor\swdsvc.exe
O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - E:\Instalki\Alcohol 120\StarWind\StarWindServiceAE.exe

**Posty:** 3854 · przez **Dzi@dek** 30 Paź 2007, 19:13

Wklej pełnego loga z nagłówkiem.

**Posty:** 28 · przez **VoX** 30 Paź 2007, 19:53

Kod: Zaznacz wszystko: Logfile of HijackThis v1.99.1 Scan saved at 18:34:57, on 2007-10-30 Platform: Windows XP Dodatek SP. 1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\csrss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\System32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Firebird\Firebird_1_5\bin\fbguard.exe c:\usr\MYSQL\bin\mysqld.exe D:\Programy\Spyware Doctor\svcntaux.exe D:\Programy\Spyware Doctor\swdsvc.exe E:\Instalki\Alcohol 120\StarWind\StarWindServiceAE.exe C:\WINDOWS\System32\wdfmgr.exe C:\Program Files\Firebird\Firebird_1_5\bin\fbserver.exe C:\WINDOWS\Explorer.EXE D:\Programy\Spyware Doctor\SDTrayApp.exe C:\WINDOWS\soundman.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE C:\Program Files\Unlocker\UnlockerAssistant.exe C:\WINDOWS\System32\ctfmon.exe C:\Program Files\Gadu-Gadu\gg.exe D:\Programy\Spybot - Search & Destroy\TeaTimer.exe C:\WINDOWS\System32\wuauclt.exe C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe D:\hijackthis\HijackThis.exe C:\WINDOWS\system32\cmd.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://softwarereferral.com/jump.php?wmid=6010&mid=MjI6Ojg5&lid=2 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\System32\alg.exe,C:\WINDOWS\System32\alg.exe, O1 - Hosts: 82.146.60.44 postbank.de O1 - Hosts: 82.146.60.44 www.postbank.de O1 - Hosts: 82.146.60.44 banking.postbank.de O1 - Hosts: 82.146.60.44 direkt.postbank.de O1 - Hosts: 82.146.60.44 www.smile.co.uk O1 - Hosts: 82.146.60.44 smile.co.uk O1 - Hosts: 82.146.60.44 cahoot.com O1 - Hosts: 82.146.60.44 www.cahoot.com O1 - Hosts: 82.146.60.44 www.cahoot.co.uk O1 - Hosts: 82.146.60.44 cahoot.co.uk O1 - Hosts: 82.146.60.44 www.co-operativebank.co.uk O1 - Hosts: 82.146.60.44 co-operativebank.co.uk O1 - Hosts: 82.146.60.44 www.co-operativebank.com O1 - Hosts: 82.146.60.44 co-operativebank.com O1 - Hosts: 82.146.60.44 personal.barclays.co.uk O1 - Hosts: 82.146.60.44 barclays.co.uk O1 - Hosts: 82.146.60.44 ibank.barclays.co.uk O1 - Hosts: 82.146.60.44 www.barclays.co.uk O1 - Hosts: 82.146.60.44 barclays.touchclarity.com O1 - Hosts: 82.146.60.44 hsbc.co.uk O1 - Hosts: 82.146.60.44 www.hsbc.co.uk O1 - Hosts: 82.146.60.44 hsbc.touchclarity.com O1 - Hosts: 82.146.60.44 www1.member-hsbc-group.com O1 - Hosts: 82.146.60.44 lloydstsb.co.uk O1 - Hosts: 82.146.60.44 www.lloydstsb.co.uk O1 - Hosts: 82.146.60.44 lloydstsb.com O1 - Hosts: 82.146.60.44 www.lloydstsb.com O1 - Hosts: 82.146.60.44 mi.lloydstsb.com O1 - Hosts: 82.146.60.44 www.woolwich.co.uk O1 - Hosts: 82.146.60.44 woolwich.co.uk O1 - Hosts: 82.146.60.44 www.deutsche-bank.de O1 - Hosts: 82.146.60.44 deutsche-bank.de O1 - Hosts: 82.146.60.44 meine.deutsche-bank.de O1 - Hosts: 82.146.60.44 www.anbusiness.com O1 - Hosts: 82.146.60.44 anbusiness.com O1 - Hosts: 82.146.60.44 www.abbeyinternational.com O1 - Hosts: 82.146.60.44 www.barclays.com O1 - Hosts: 82.146.60.44 barclays.com O1 - Hosts: 82.146.60.44 ibank.internationalbanking.barclays.com O1 - Hosts: 82.146.60.44 offshore.hsbc.com O1 - Hosts: 82.146.60.44 www.lloydstsb-offshore.com O1 - Hosts: 82.146.60.44 lloydstsb-offshore.com O2 - BHO: MSVPS System - {077F45D5-5CC9-4FC8-A7BB-9D79836A6066} - C:\WINDOWS\movctrlnkd.dll O2 - BHO: BitComet Helper - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - D:\BitComet\tools\BitCometBHO_1.1.7.4.dll O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - D:\Programy\Spybot - Search & Destroy\SDHelper.dll O2 - BHO: IeCatch2 Class - {A5366673-E8CA-11D3-9CD9-0090271D075B} - C:\PROGRA~1\FlashGet\jccatch.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\fgiebar.dll O3 - Toolbar: The nssfrch - {AC9BBDB2-8FCD-49C8-96F7-CC3CF7B453CD} - C:\WINDOWS\nssfrch.dll O4 - HKLM\..\Run: [SoundMan] soundman.exe O4 - HKLM\..\Run: [Microsoft Network Services Controller] C:\WINDOWS\System32\mmsvc32.exe O4 - HKLM\..\Run: [Spools Service Controller] C:\WINDOWS\System32\spools.exe O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" O4 - HKLM\..\Run: [UnlockerAssistant] "C:\Program Files\Unlocker\UnlockerAssistant.exe" O4 - HKLM\..\Run: [SDTray] "D:\Programy\Spyware Doctor\SDTrayApp.exe" O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe O4 - HKCU\..\Run: [Firewall auto setup] C:\DOCUME~1\VoX\USTAWI~1\Temp\winlogon.exe O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - HKCU\..\Run: [Odkurzacz-MCD] C:\Program Files\Odkurzacz\odk_mcd.exe O4 - HKCU\..\Run: [SpybotSD TeaTimer] D:\Programy\Spybot - Search & Destroy\TeaTimer.exe O8 - Extra context menu item: &D&ownload &with BitComet - res://D:\BitComet\BitComet.exe/AddLink.htm O8 - Extra context menu item: &D&ownload all video with BitComet - res://D:\BitComet\BitComet.exe/AddVideo.htm O8 - Extra context menu item: &D&ownload all with BitComet - res://D:\BitComet\BitComet.exe/AddAllLink.htm O8 - Extra context menu item: Ściągnij przy pomocy FlashGet'a - C:\Program Files\FlashGet\jc_link.htm O8 - Extra context menu item: Ściągnij wszystko przy pomocy FlashGet'a - C:\Program Files\FlashGet\jc_all.htm O9 - Extra button: BitComet Search - {461CC20B-FB6E-4f16-8FE8-C29359DB100E} - D:\BitComet\tools\BitCometBHO_1.1.7.4.dll O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - D:\Programy\Spybot - Search & Destroy\SDHelper.dll O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - D:\Programy\Spybot - Search & Destroy\SDHelper.dll O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {68282C51-9459-467B-95BF-3C0E89627E55} (MksSkanerOnline Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab O20 - Winlogon Notify: mszsrn32 - C:\WINDOWS\system32\mszsrn32.dll O21 - SSODL: MSN Messenger - {280A7B65-8F00-438F-3E5A-1F039433FE60} - C:\WINDOWS\system32\dssdll32.dll O21 - SSODL: bxsbang - {6B591935-F286-49B6-B6AB-3B6D398F0446} - C:\WINDOWS\bxsbang.dll O21 - SSODL: ocgrep - {1E1A8708-FCEE-4093-B522-2699B0297DEF} - C:\WINDOWS\ocgrep.dll O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: Firebird Guardian - DefaultInstance (FirebirdGuardianDefaultInstance) - The Firebird Project - C:\Program Files\Firebird\Firebird_1_5\bin\fbguard.exe O23 - Service: Firebird Server - DefaultInstance (FirebirdServerDefaultInstance) - The Firebird Project - C:\Program Files\Firebird\Firebird_1_5\bin\fbserver.exe O23 - Service: MySql - Unknown owner - c:\usr/MYSQL/bin/mysqld.exe O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - D:\Programy\Spyware Doctor\svcntaux.exe O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - D:\Programy\Spyware Doctor\swdsvc.exe O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - E:\Instalki\Alcohol 120\StarWind\StarWindServiceAE.exe

jeszcze teraz zmieniła mi sie tapeta z napisem "Your Privacy is in danger" i wyskakuje mi pełno jakiś komunikatów np.

"Windows Security Alert"
Windows has detected an Internet attac attempt....

Prosze o pomoc

**Posty:** 18165 · przez **wojtas** 30 Paź 2007, 20:30

Wykonaj to co jest podane w tym temacie

zastosuj:

smitfraudfix z opcji 2

oraz te skanery po kilka razy

VundoFix

VirtumundoBeGone

FixVundo

Zastosuj rowniez SDFix . Po pobraniu uruchom go a rozpakuje się do C:\SDFix. Uruchom komputer w trybie awaryjnym (F8 przy stracie systemu). Będąc w awaryjnym uruchom plik RunThis.bat z folderu SDFixa. Zatwierdź czyszczenie przez Y. Poczekaj aż ukończy i komputer zresetuje

Potem wejdz do folderu SDFix wrzuc zawartość pliku Report.txt + log z combofixa oraz z hijacka

**Posty:** 28 · przez **VoX** 30 Paź 2007, 21:46

Kod: Zaznacz wszystko: Logfile of HijackThis v1.99.1 Scan saved at 20:40, on 2007-10-30 Platform: Windows XP Dodatek SP. 1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\csrss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\System32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\cmd.exe C:\WINDOWS\System32\alg.exe C:\Program Files\Firebird\Firebird_1_5\bin\fbguard.exe C:\WINDOWS\soundman.exe C:\Program Files\Unlocker\UnlockerAssistant.exe c:\usr\MYSQL\bin\mysqld.exe C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE D:\Programy\Spyware Doctor\SDTrayApp.exe C:\WINDOWS\System32\ctfmon.exe C:\Program Files\Gadu-Gadu\gg.exe D:\Programy\Spybot - Search & Destroy\TeaTimer.exe D:\Programy\Spyware Doctor\svcntaux.exe D:\Programy\Spyware Doctor\swdsvc.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe E:\Instalki\Alcohol 120\StarWind\StarWindServiceAE.exe C:\WINDOWS\System32\wdfmgr.exe C:\WINDOWS\system32\cmd.exe C:\Program Files\Firebird\Firebird_1_5\bin\fbserver.exe C:\Program Files\Winamp\winamp.exe C:\WINDOWS\System32\wuauclt.exe D:\hijackthis\HijackThis.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O1 - Hosts: 82.146.60.44 postbank.de O1 - Hosts: 82.146.60.44 www.postbank.de O1 - Hosts: 82.146.60.44 banking.postbank.de O1 - Hosts: 82.146.60.44 direkt.postbank.de O1 - Hosts: 82.146.60.44 www.smile.co.uk O1 - Hosts: 82.146.60.44 smile.co.uk O1 - Hosts: 82.146.60.44 cahoot.com O1 - Hosts: 82.146.60.44 www.cahoot.com O1 - Hosts: 82.146.60.44 www.cahoot.co.uk O1 - Hosts: 82.146.60.44 cahoot.co.uk O1 - Hosts: 82.146.60.44 www.co-operativebank.co.uk O1 - Hosts: 82.146.60.44 co-operativebank.co.uk O1 - Hosts: 82.146.60.44 www.co-operativebank.com O1 - Hosts: 82.146.60.44 co-operativebank.com O1 - Hosts: 82.146.60.44 personal.barclays.co.uk O1 - Hosts: 82.146.60.44 barclays.co.uk O1 - Hosts: 82.146.60.44 ibank.barclays.co.uk O1 - Hosts: 82.146.60.44 www.barclays.co.uk O1 - Hosts: 82.146.60.44 barclays.touchclarity.com O1 - Hosts: 82.146.60.44 hsbc.co.uk O1 - Hosts: 82.146.60.44 www.hsbc.co.uk O1 - Hosts: 82.146.60.44 hsbc.touchclarity.com O1 - Hosts: 82.146.60.44 www1.member-hsbc-group.com O1 - Hosts: 82.146.60.44 lloydstsb.co.uk O1 - Hosts: 82.146.60.44 www.lloydstsb.co.uk O1 - Hosts: 82.146.60.44 lloydstsb.com O1 - Hosts: 82.146.60.44 www.lloydstsb.com O1 - Hosts: 82.146.60.44 mi.lloydstsb.com O1 - Hosts: 82.146.60.44 www.woolwich.co.uk O1 - Hosts: 82.146.60.44 woolwich.co.uk O1 - Hosts: 82.146.60.44 www.deutsche-bank.de O1 - Hosts: 82.146.60.44 deutsche-bank.de O1 - Hosts: 82.146.60.44 meine.deutsche-bank.de O1 - Hosts: 82.146.60.44 www.anbusiness.com O1 - Hosts: 82.146.60.44 anbusiness.com O1 - Hosts: 82.146.60.44 www.abbeyinternational.com O1 - Hosts: 82.146.60.44 www.barclays.com O1 - Hosts: 82.146.60.44 barclays.com O1 - Hosts: 82.146.60.44 ibank.internationalbanking.barclays.com O1 - Hosts: 82.146.60.44 offshore.hsbc.com O1 - Hosts: 82.146.60.44 www.lloydstsb-offshore.com O1 - Hosts: 82.146.60.44 lloydstsb-offshore.com O2 - BHO: MSVPS System - {077F45D5-5CC9-4FC8-A7BB-9D79836A6066} - C:\WINDOWS\movctrlnkd.dll (file missing) O2 - BHO: BitComet Helper - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - D:\BitComet\tools\BitCometBHO_1.1.7.4.dll O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - D:\Programy\Spybot - Search & Destroy\SDHelper.dll O2 - BHO: IeCatch2 Class - {A5366673-E8CA-11D3-9CD9-0090271D075B} - C:\PROGRA~1\FlashGet\jccatch.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\fgiebar.dll O3 - Toolbar: The nssfrch - {AC9BBDB2-8FCD-49C8-96F7-CC3CF7B453CD} - C:\WINDOWS\nssfrch.dll (file missing) O4 - HKLM\..\Run: [SoundMan] soundman.exe O4 - HKLM\..\Run: [Microsoft Network Services Controller] C:\WINDOWS\System32\mmsvc32.exe O4 - HKLM\..\Run: [Spools Service Controller] C:\WINDOWS\System32\spools.exe O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" O4 - HKLM\..\Run: [UnlockerAssistant] "C:\Program Files\Unlocker\UnlockerAssistant.exe" O4 - HKLM\..\Run: [SDTray] "D:\Programy\Spyware Doctor\SDTrayApp.exe" O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - HKCU\..\Run: [Odkurzacz-MCD] C:\Program Files\Odkurzacz\odk_mcd.exe O4 - HKCU\..\Run: [SpybotSD TeaTimer] D:\Programy\Spybot - Search & Destroy\TeaTimer.exe O8 - Extra context menu item: &D&ownload &with BitComet - res://D:\BitComet\BitComet.exe/AddLink.htm O8 - Extra context menu item: &D&ownload all video with BitComet - res://D:\BitComet\BitComet.exe/AddVideo.htm O8 - Extra context menu item: &D&ownload all with BitComet - res://D:\BitComet\BitComet.exe/AddAllLink.htm O8 - Extra context menu item: Ściągnij przy pomocy FlashGet'a - C:\Program Files\FlashGet\jc_link.htm O8 - Extra context menu item: Ściągnij wszystko przy pomocy FlashGet'a - C:\Program Files\FlashGet\jc_all.htm O9 - Extra button: BitComet Search - {461CC20B-FB6E-4f16-8FE8-C29359DB100E} - D:\BitComet\tools\BitCometBHO_1.1.7.4.dll O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - D:\Programy\Spybot - Search & Destroy\SDHelper.dll O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - D:\Programy\Spybot - Search & Destroy\SDHelper.dll O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {68282C51-9459-467B-95BF-3C0E89627E55} (MksSkanerOnline Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab O20 - Winlogon Notify: mszsrn32 - C:\WINDOWS\system32\mszsrn32.dll O21 - SSODL: MSN Messenger - {280A7B65-8F00-438F-3E5A-1F039433FE60} - C:\WINDOWS\system32\dssdll32.dll O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: Firebird Guardian - DefaultInstance (FirebirdGuardianDefaultInstance) - The Firebird Project - C:\Program Files\Firebird\Firebird_1_5\bin\fbguard.exe O23 - Service: Firebird Server - DefaultInstance (FirebirdServerDefaultInstance) - The Firebird Project - C:\Program Files\Firebird\Firebird_1_5\bin\fbserver.exe O23 - Service: MySql - Unknown owner - c:\usr/MYSQL/bin/mysqld.exe O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - D:\Programy\Spyware Doctor\svcntaux.exe O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - D:\Programy\Spyware Doctor\swdsvc.exe O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - E:\Instalki\Alcohol 120\StarWind\StarWindServiceAE.exe

Kod: Zaznacz wszystko: SmitFraudFix v2.245 Scan done at 19:48:13,02, 2007-10-30 Run from D:\SmitfraudFix OS: Microsoft Windows XP [Wersja 5.1.2600] - Windows_NT The filesystem type is NTFS Fix run in normal mode »»»»»»»»»»»»»»»»»»»»»»»» Process C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\csrss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\System32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\soundman.exe C:\WINDOWS\System32\ctfmon.exe C:\Program Files\Firebird\Firebird_1_5\bin\fbguard.exe D:\Programy\Spyware Doctor\svcntaux.exe D:\Programy\Spyware Doctor\swdsvc.exe C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe E:\Instalki\Alcohol 120\StarWind\StarWindServiceAE.exe C:\Program Files\Firebird\Firebird_1_5\bin\fbserver.exe C:\WINDOWS\System32\wuauclt.exe C:\Program Files\FlashGet\flashget.exe C:\WINDOWS\explorer.exe C:\Program Files\Internet Explorer\iexplore.exe C:\WINDOWS\system32\cmd.exe C:\WINDOWS\System32\wbem\wmiprvse.exe »»»»»»»»»»»»»»»»»»»»»»»» hosts »»»»»»»»»»»»»»»»»»»»»»»» C:\ »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32 »»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\VoX »»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\VoX\Application Data »»»»»»»»»»»»»»»»»»»»»»»» Start Menu »»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\VoX\Ulubione »»»»»»»»»»»»»»»»»»»»»»»» Desktop »»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files »»»»»»»»»»»»»»»»»»»»»»»» Corrupted keys »»»»»»»»»»»»»»»»»»»»»»»» Desktop Components [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0] "Source"="file:///C:\\WINDOWS\\privacy_danger\\index.htm" "SubscribedURL"="" "FriendlyName"="Privacy Protection" [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\1] "Source"="About:Home" "SubscribedURL"="About:Home" "FriendlyName"="Moja bieľĄca strona g˘wna" »»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler !!!Attention, following keys are not inevitably infected!!! SrchSTS.exe by S!Ri Search SharedTaskScheduler's .dll »»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs !!!Attention, following keys are not inevitably infected!!! [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] "AppInit_DLLs"="" »»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System !!!Attention, following keys are not inevitably infected!!! [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] "System"="" "SystemId"=dword:81645f92 »»»»»»»»»»»»»»»»»»»»»»»» Rustock »»»»»»»»»»»»»»»»»»»»»»»» DNS Description: Karta Realtek RTL8139 Family PCI Fast Ethernet NIC - Sterownik miniport Harmonogramu pakietów DNS Server Search Order: 192.168.0.1 DNS Server Search Order: 194.204.152.34 HKLM\SYSTEM\CCS\Services\Tcpip\..\{82C735BC-3AF0-43DC-ADEA-684DAB957158}: DhcpNameServer=192.168.0.1 194.204.152.34 HKLM\SYSTEM\CS1\Services\Tcpip\..\{82C735BC-3AF0-43DC-ADEA-684DAB957158}: DhcpNameServer=192.168.0.1 194.204.152.34 HKLM\SYSTEM\CS2\Services\Tcpip\..\{82C735BC-3AF0-43DC-ADEA-684DAB957158}: DhcpNameServer=192.168.0.1 194.204.152.34 HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=192.168.0.1 194.204.152.34 HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=192.168.0.1 194.204.152.34 HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=192.168.0.1 194.204.152.34 »»»»»»»»»»»»»»»»»»»»»»»» Scanning for wininet.dll infection »»»»»»»»»»»»»»»»»»»»»»»» End

Program combofix uruchomiłem coś mi sie tam połądowało ale loga zandego nie mam

**Posty:** 18165 · przez **wojtas** 30 Paź 2007, 22:11

O1 - Hosts: 82.146.60.44 www.smile.co.uk
O1 - Hosts: 82.146.60.44 smile.co.uk
O1 - Hosts: 82.146.60.44 cahoot.com
O1 - Hosts: 82.146.60.44 www.cahoot.com
O1 - Hosts: 82.146.60.44 www.cahoot.co.uk
O1 - Hosts: 82.146.60.44 cahoot.co.uk
O1 - Hosts: 82.146.60.44 www.co-operativebank.co.uk
O1 - Hosts: 82.146.60.44 co-operativebank.co.uk
O1 - Hosts: 82.146.60.44 www.co-operativebank.com
O1 - Hosts: 82.146.60.44 co-operativebank.com
O1 - Hosts: 82.146.60.44 personal.barclays.co.uk
O1 - Hosts: 82.146.60.44 barclays.co.uk
O1 - Hosts: 82.146.60.44 ibank.barclays.co.uk
O1 - Hosts: 82.146.60.44 www.barclays.co.uk
O1 - Hosts: 82.146.60.44 barclays.touchclarity.com
O1 - Hosts: 82.146.60.44 hsbc.co.uk
O1 - Hosts: 82.146.60.44 www.hsbc.co.uk
O1 - Hosts: 82.146.60.44 hsbc.touchclarity.com
O1 - Hosts: 82.146.60.44 www1.member-hsbc-group.com
O1 - Hosts: 82.146.60.44 lloydstsb.co.uk
O1 - Hosts: 82.146.60.44 www.lloydstsb.co.uk
O1 - Hosts: 82.146.60.44 lloydstsb.com
O1 - Hosts: 82.146.60.44 www.lloydstsb.com
O1 - Hosts: 82.146.60.44 mi.lloydstsb.com
O1 - Hosts: 82.146.60.44 www.woolwich.co.uk
O1 - Hosts: 82.146.60.44 woolwich.co.uk
O1 - Hosts: 82.146.60.44 www.deutsche-bank.de
O1 - Hosts: 82.146.60.44 deutsche-bank.de
O1 - Hosts: 82.146.60.44 meine.deutsche-bank.de
O1 - Hosts: 82.146.60.44 www.anbusiness.com
O1 - Hosts: 82.146.60.44 anbusiness.com
O1 - Hosts: 82.146.60.44 www.abbeyinternational.com
O1 - Hosts: 82.146.60.44 www.barclays.com
O1 - Hosts: 82.146.60.44 barclays.com
O1 - Hosts: 82.146.60.44 ibank.internationalbanking.barclays.com
O1 - Hosts: 82.146.60.44 offshore.hsbc.com
O1 - Hosts: 82.146.60.44 www.lloydstsb-offshore.com
O1 - Hosts: 82.146.60.44 lloydstsb-offshore.com
O2 - BHO: MSVPS System - {077F45D5-5CC9-4FC8-A7BB-9D79836A6066} - C:\WINDOWS\movctrlnkd.dll (file missing)
O3 - Toolbar: The nssfrch - {AC9BBDB2-8FCD-49C8-96F7-CC3CF7B453CD} - C:\WINDOWS\nssfrch.dll (file missing)
O20 - Winlogon Notify: mszsrn32 - C:\WINDOWS\system32\mszsrn32.dll
O21 - SSODL: MSN Messenger - {280A7B65-8F00-438F-3E5A-1F039433FE60} - C:\WINDOWS\system32\dssdll32.dll

Odpalasz hijackthis i zaznaczasz ptaszkami powyższe wpisy i dajesz Fix checked.

Zastosuj SDFix . Po pobraniu uruchom go a rozpakuje się do C:\SDFix. Uruchom komputer w trybie awaryjnym (F8 przy stracie systemu). Będąc w awaryjnym uruchom plik RunThis.bat z folderu SDFixa. Zatwierdź czyszczenie przez Y. Poczekaj aż ukończy i komputer zresetuje

Potem wejdz do folderu SDFix wrzuc zawartość pliku Report.txt + log z dss'a oraz z hijacka

**Posty:** 237 · przez **Kuba1** 30 Paź 2007, 22:14

Troszke mało to co nam dałeś :roll:

Log z ComboFix powinieneś mieć w lokalizacji C:\ComboFix.txt

SmitFraudFix prosze pokazać z opcji nr 2 w trybie awaryjnym.

Potrzebny jest także raport z SDFix.

**Posty:** 28 · przez **VoX** 31 Paź 2007, 17:01

Odpalasz hijackthis i zaznaczasz ptaszkami powyższe wpisy i dajesz Fix checked.

wyskakuje mi takie coś za kazdym razem:
www.kswaldemarc.yoyo.pl/blad.JPG

LOG SDFix:

Kod: Zaznacz wszystko: SDFix: Version 1.112 Run by VoX on 2007-10-31 at 15:40 Microsoft Windows XP [Wersja 5.1.2600] Running From: C:\SDFix\SDFix Safe Mode: Checking Services: Restoring Windows Registry Values Restoring Windows Default Hosts File Rebooting... Normal Mode: Checking Files: Trojan Files Found: C:\WINDOWS\system32\spools.exe - Deleted Removing Temp Files... ADS Check: C:\WINDOWS No streams found. C:\WINDOWS\system32 No streams found. C:\WINDOWS\system32\svchost.exe No streams found. C:\WINDOWS\system32\ntoskrnl.exe No streams found. Final Check: Remaining Services: ------------------ Authorized Application Key Export: [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] "C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE"="C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE:*:Enabled:Enabled" [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list] Remaining Files: --------------- File Backups: - C:\SDFix\SDFix\backups\backups.zip Files with Hidden Attributes: Finished!

LOG DSS:
main.txt

Kod: Zaznacz wszystko: Deckard's System Scanner v20071014.68 Run by VoX on 2002-09-02 00:49:40 Computer is in Normal Mode. -------------------------------------------------------------------------------- -- System Restore -------------------------------------------------------------- -- Last 3 Restore Point(s) -- 3: 2002-09-01 22:44:25 UTC - RP35 - Deckard's System Scanner Restore Point 2: 2007-10-30 19:23:23 UTC - RP34 - ComboFix created restore point 1: 2002-09-01 22:03:41 UTC - RP33 - Removed Steam Backed up registry hives. Performed disk cleanup. [color=red]Total Physical Memory: 384 MiB (512 MiB recommended).[/color] [color=red]System Drive C: has 0.2 GiB (less than 15%) free.[/color] -- HijackThis (run as VoX.exe) ------------------------------------------------- Unable to find log (file not found); running clone. -- HijackThis Clone ------------------------------------------------------------ Emulating logfile of Trend Micro HijackThis v2.0.2 Scan saved at 2002-09-02 00:50:08 Platform: Windows XP Dodatek Service Pack. 1 (5.01.2600) MSIE: Internet Explorer (6.00.2800.1106) Boot mode: Normal Running processes: C:\WINDOWS\system32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\ati2evxx.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\explorer.exe C:\WINDOWS\soundman.exe C:\Program Files\Unlocker\UnlockerAssistant.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Gadu-Gadu\gg.exe C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe D:\Programy\Spybot - Search & Destroy\TeaTimer.exe C:\Program Files\Firebird\Firebird_1_5\bin\fbguard.exe C:\usr\mysql\bin\mysqld.exe E:\Instalki\Alcohol 120\StarWind\StarWindServiceAE.exe C:\Program Files\Firebird\Firebird_1_5\bin\fbserver.exe C:\WINDOWS\system32\wuauclt.exe D:\dss.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O1 - Hosts: 82.146.60.44 postbank.de O1 - Hosts: 82.146.60.44 www.postbank.de O1 - Hosts: 82.146.60.44 banking.postbank.de O1 - Hosts: 82.146.60.44 direkt.postbank.de O1 - Hosts: 82.146.60.44 www.smile.co.uk O1 - Hosts: 82.146.60.44 smile.co.uk O1 - Hosts: 82.146.60.44 cahoot.com O1 - Hosts: 82.146.60.44 www.cahoot.com O1 - Hosts: 82.146.60.44 www.cahoot.co.uk O1 - Hosts: 82.146.60.44 cahoot.co.uk O1 - Hosts: 82.146.60.44 www.co-operativebank.co.uk O1 - Hosts: 82.146.60.44 co-operativebank.co.uk O1 - Hosts: 82.146.60.44 www.co-operativebank.com O1 - Hosts: 82.146.60.44 co-operativebank.com O1 - Hosts: 82.146.60.44 personal.barclays.co.uk O1 - Hosts: 82.146.60.44 barclays.co.uk O1 - Hosts: 82.146.60.44 ibank.barclays.co.uk O1 - Hosts: 82.146.60.44 www.barclays.co.uk O1 - Hosts: 82.146.60.44 barclays.touchclarity.com O1 - Hosts: 82.146.60.44 hsbc.co.uk O1 - Hosts: 82.146.60.44 www.hsbc.co.uk O1 - Hosts: 82.146.60.44 hsbc.touchclarity.com O1 - Hosts: 82.146.60.44 www1.member-hsbc-group.com O1 - Hosts: 82.146.60.44 lloydstsb.co.uk O1 - Hosts: 82.146.60.44 www.lloydstsb.co.uk O1 - Hosts: 82.146.60.44 lloydstsb.com O1 - Hosts: 82.146.60.44 www.lloydstsb.com O1 - Hosts: 82.146.60.44 mi.lloydstsb.com O1 - Hosts: 82.146.60.44 www.woolwich.co.uk O1 - Hosts: 82.146.60.44 woolwich.co.uk O1 - Hosts: 82.146.60.44 www.deutsche-bank.de O1 - Hosts: 82.146.60.44 deutsche-bank.de O1 - Hosts: 82.146.60.44 meine.deutsche-bank.de O1 - Hosts: 82.146.60.44 www.anbusiness.com O1 - Hosts: 82.146.60.44 anbusiness.com O1 - Hosts: 82.146.60.44 www.abbeyinternational.com O1 - Hosts: 82.146.60.44 www.barclays.com O1 - Hosts: 82.146.60.44 barclays.com O1 - Hosts: 82.146.60.44 ibank.internationalbanking.barclays.com O1 - Hosts: 82.146.60.44 offshore.hsbc.com O1 - Hosts: 82.146.60.44 www.lloydstsb-offshore.com O1 - Hosts: 82.146.60.44 lloydstsb-offshore.com O2 - BHO: BitComet Helper - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - D:\BitComet\tools\BitCometBHO_1.1.7.4.dll O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - D:\Programy\Spybot - Search & Destroy\SDHelper.dll O2 - BHO: IeCatch2 Class - {A5366673-E8CA-11D3-9CD9-0090271D075B} - C:\Program Files\FlashGet\Jccatch.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\system32\msdxm.ocx O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\Program Files\FlashGet\fgiebar.dll O4 - HKLM\..\Run: [SoundMan] soundman.exe O4 - HKLM\..\Run: [Microsoft Network Services Controller] C:\WINDOWS\System32\mmsvc32.exe O4 - HKLM\..\Run: [Spools Service Controller] C:\WINDOWS\System32\spools.exe O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" O4 - HKLM\..\Run: [UnlockerAssistant] "C:\Program Files\Unlocker\UnlockerAssistant.exe" O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - HKCU\..\Run: [Odkurzacz-MCD] C:\Program Files\Odkurzacz\odk_mcd.exe O4 - HKCU\..\Run: [SpybotSD TeaTimer] D:\Programy\Spybot - Search & Destroy\TeaTimer.exe O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETWORK SERVICE') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user') O8 - Extra context menu item: &D&ownload &with BitComet - res://D:\BitComet\BitComet.exe/AddLink.htm O8 - Extra context menu item: &D&ownload all video with BitComet - res://D:\BitComet\BitComet.exe/AddVideo.htm O8 - Extra context menu item: &D&ownload all with BitComet - res://D:\BitComet\BitComet.exe/AddAllLink.htm O8 - Extra context menu item: Ściągnij przy pomocy FlashGet'a - C:\Program Files\FlashGet\jc_link.htm O8 - Extra context menu item: Ściągnij wszystko przy pomocy FlashGet'a - C:\Program Files\FlashGet\jc_all.htm O9 - Extra button: BitComet Search - {461CC20B-FB6E-4f16-8FE8-C29359DB100E} - (file missing) O9 - Extra button: Pokrewne - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\Web\related.htm O9 - Extra 'Tools' menuitem: @shdoclc.dll,-864 - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\Web\related.htm O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\flashget.exe O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\flashget.exe O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - D:\Programy\Spybot - Search & Destroy\SDHelper.dll O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - D:\Programy\Spybot - Search & Destroy\SDHelper.dll O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {33564D57-0000-0010-8000-00AA00389B71} () - http://download.microsoft.com/download/F/6/E/F6E491A6-77E1-4E20-9F5F-94901338C922/wmv9VCM.CAB O16 - DPF: {68282C51-9459-467B-95BF-3C0E89627E55} (MksSkanerOnline Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab O21 - SSODL: MSN Messenger - {280A7B65-8F00-438F-3E5A-1F039433FE60} - C:\WINDOWS\system32\dssdll32.dll O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: Firebird Guardian - DefaultInstance (FirebirdGuardianDefaultInstance) - The Firebird Project - C:\Program Files\Firebird\Firebird_1_5\bin\fbguard.exe O23 - Service: Firebird Server - DefaultInstance (FirebirdServerDefaultInstance) - The Firebird Project - C:\Program Files\Firebird\Firebird_1_5\bin\fbserver.exe O23 - Service: MySql - Unknown owner - c:\usr/MYSQL/bin/mysqld.exe O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - E:\Instalki\Alcohol 120\StarWind\StarWindServiceAE.exe -- End of file - 7921 bytes -- HijackThis Fixed Entries (D:\HIJACK~1\backups\) ----------------------------- backup-20020902-012251-845 O1 - Hosts: 82.146.60.44 smile.co.uk backup-20020902-012251-684 O1 - Hosts: 82.146.60.44 cahoot.com backup-20020902-012251-464 O1 - Hosts: 82.146.60.44 www.cahoot.com backup-20020902-012251-859 O1 - Hosts: 82.146.60.44 www.cahoot.co.uk backup-20020902-012251-673 O1 - Hosts: 82.146.60.44 cahoot.co.uk backup-20020902-012251-496 O1 - Hosts: 82.146.60.44 www.co-operativebank.co.uk backup-20020902-012251-763 O1 - Hosts: 82.146.60.44 co-operativebank.co.uk backup-20020902-012251-257 O1 - Hosts: 82.146.60.44 www.co-operativebank.com backup-20020902-012251-171 O1 - Hosts: 82.146.60.44 co-operativebank.com backup-20020902-012251-164 O1 - Hosts: 82.146.60.44 personal.barclays.co.uk backup-20020902-012251-918 O1 - Hosts: 82.146.60.44 barclays.co.uk backup-20020902-012251-655 O1 - Hosts: 82.146.60.44 ibank.barclays.co.uk backup-20020902-012251-179 O1 - Hosts: 82.146.60.44 www.barclays.co.uk backup-20020902-012251-608 O1 - Hosts: 82.146.60.44 barclays.touchclarity.com backup-20020902-012251-850 O1 - Hosts: 82.146.60.44 hsbc.co.uk backup-20020902-012251-125 O1 - Hosts: 82.146.60.44 www.hsbc.co.uk backup-20020902-012251-769 O1 - Hosts: 82.146.60.44 hsbc.touchclarity.com backup-20020902-012251-318 O1 - Hosts: 82.146.60.44 www1.member-hsbc-group.com backup-20020902-012251-623 O1 - Hosts: 82.146.60.44 lloydstsb.co.uk backup-20020902-012251-395 O1 - Hosts: 82.146.60.44 www.lloydstsb.co.uk backup-20020902-012251-346 O1 - Hosts: 82.146.60.44 lloydstsb.com backup-20020902-012251-228 O1 - Hosts: 82.146.60.44 www.lloydstsb.com backup-20020902-012251-581 O1 - Hosts: 82.146.60.44 mi.lloydstsb.com backup-20020902-012251-523 O1 - Hosts: 82.146.60.44 www.woolwich.co.uk backup-20020902-012251-961 O1 - Hosts: 82.146.60.44 woolwich.co.uk backup-20020902-012251-382 O1 - Hosts: 82.146.60.44 www.deutsche-bank.de backup-20020902-012251-329 O1 - Hosts: 82.146.60.44 deutsche-bank.de backup-20020902-012251-442 O1 - Hosts: 82.146.60.44 meine.deutsche-bank.de backup-20020902-012251-368 O1 - Hosts: 82.146.60.44 www.anbusiness.com backup-20020902-012251-592 O1 - Hosts: 82.146.60.44 anbusiness.com backup-20020902-012251-653 O1 - Hosts: 82.146.60.44 www.abbeyinternational.com backup-20020902-012251-938 O1 - Hosts: 82.146.60.44 www.barclays.com backup-20020902-012251-350 O1 - Hosts: 82.146.60.44 barclays.com backup-20020902-012251-378 O1 - Hosts: 82.146.60.44 ibank.internationalbanking.barclays.com backup-20020902-012251-560 O1 - Hosts: 82.146.60.44 offshore.hsbc.com backup-20020902-012251-978 O1 - Hosts: 82.146.60.44 www.lloydstsb-offshore.com backup-20020902-012251-878 O1 - Hosts: 82.146.60.44 lloydstsb-offshore.com backup-20020902-012251-444 O2 - BHO: MSVPS System - {077F45D5-5CC9-4FC8-A7BB-9D79836A6066} - C:\WINDOWS\movctrlnkd.dll (file missing) backup-20020902-012251-745 O3 - Toolbar: The nssfrch - {AC9BBDB2-8FCD-49C8-96F7-CC3CF7B453CD} - C:\WINDOWS\nssfrch.dll (file missing) backup-20020902-012251-106 O20 - Winlogon Notify: mszsrn32 - C:\WINDOWS\system32\mszsrn32.dll backup-20020902-012254-659 O21 - SSODL: MSN Messenger - {280A7B65-8F00-438F-3E5A-1F039433FE60} - C:\WINDOWS\system32\dssdll32.dll backup-20020902-012351-704 O1 - Hosts: 82.146.60.44 smile.co.uk backup-20020902-012351-874 O1 - Hosts: 82.146.60.44 cahoot.com backup-20020902-012351-671 O1 - Hosts: 82.146.60.44 www.cahoot.com backup-20020902-012351-280 O1 - Hosts: 82.146.60.44 www.cahoot.co.uk backup-20020902-012351-453 O1 - Hosts: 82.146.60.44 cahoot.co.uk backup-20020902-012351-464 O1 - Hosts: 82.146.60.44 www.co-operativebank.co.uk -- File Associations ----------------------------------------------------------- [COLOR=red].cpl - cplfile - shell\cplopen\command - rundll32.exe shell32.dll,Control_RunDLL "%1",%*[/COLOR] -- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------- R2 dsniff - c:\windows\system32\drivers\dsniff.sys S3 catchme - c:\docume~1\vox\ustawi~1\temp\catchme.sys (file missing) -- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled -------------------- R2 FirebirdGuardianDefaultInstance (Firebird Guardian - DefaultInstance) - c:\program files\firebird\firebird_1_5\bin\fbguard.exe -s <Not Verified; The Firebird Project; Firebird SQL Server> R2 MySql - c:\usr/mysql/bin/mysqld.exe R2 StarWindServiceAE (StarWind AE Service) - e:\instalki\alcohol 120\starwind\starwindserviceae.exe <Not Verified; Rocket Division Software; StarWind Alcohol Edition> R3 FirebirdServerDefaultInstance (Firebird Server - DefaultInstance) - c:\program files\firebird\firebird_1_5\bin\fbserver.exe -s <Not Verified; The Firebird Project; Firebird SQL Server> -- Device Manager: Disabled ---------------------------------------------------- Class GUID: {4D36E97B-E325-11CE-BFC1-08002BE10318} Description: SCSI/RAID Host Controller Device ID: ACPI\PNPA000\4&5D18F2DF&1 Manufacturer: (Standard mass storage controllers) Name: SCSI/RAID Host Controller PNP Device ID: ACPI\PNPA000\4&5D18F2DF&1 Service: anz1pg0v -- Files created between 2002-08-02 and 2002-09-02 ----------------------------- 2007-10-30 21:33:24 52661 --a------ C:\WINDOWS\System32\vPeeqXiU.exe 2007-10-30 21:13:31 0 d-------- C:\WINDOWS\ERUNT 2007-10-30 20:42:32 1010 --a------ C:\WINDOWS\System32\tmp.reg 2007-10-30 20:42:09 25600 --a------ C:\WINDOWS\System32\WS2Fix.exe 2007-10-30 20:42:09 289144 --a------ C:\WINDOWS\System32\VCCLSID.exe <Not Verified; S!Ri; > 2007-10-30 20:42:09 288417 --a------ C:\WINDOWS\System32\SrchSTS.exe <Not Verified; S!Ri; SrchSTS> 2007-10-30 20:42:09 53248 --a------ C:\WINDOWS\System32\Process.exe <Not Verified; http://www.beyondlogic.org; Command Line Process Utility> 2007-10-30 20:42:09 51200 --a------ C:\WINDOWS\System32\dumphive.exe 2007-10-30 20:38:28 196608 --a------ C:\WINDOWS\System32\RqgDeFbd.exe 2007-10-20 22:27:09 0 d-------- C:\Program Files\Avery Dennison 2007-10-13 17:53:01 0 d-------- C:\Program Files\Real Alternative 2007-10-13 17:53:01 0 d-------- C:\Program Files\Media Player Classic 2007-10-09 19:51:48 0 d-------- C:\usr 2007-10-05 15:55:49 259072 --a------ C:\WINDOWS\System32\tgqQGuVr.exe 2007-09-25 14:43:56 8192 --a------ C:\WINDOWS\System32\psvc.exe 2007-09-22 13:58:29 0 d-------- C:\Program Files\IrfanView 2007-09-20 20:46:58 1703936 --a------ C:\WINDOWS\System32\d3d9.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System> 2007-09-20 20:46:57 1769472 --a------ C:\WINDOWS\System32\dxdiagn.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System> 2007-09-17 22:23:54 208896 --a------ C:\WINDOWS\System32\lame_enc.dll <Not Verified; www.mp3dev.org; Lame MP3 Encoder> 2007-09-17 22:23:54 90112 --a------ C:\WINDOWS\System32\AVMiniWeb.exe <Not Verified; AVConverter Technologies Co.,Ltd.; AVConverter Mini Web Server Application> 2007-09-17 22:23:53 520192 --a------ C:\WINDOWS\System32\AVmmfecd.exe <Not Verified; YAMAHA CORPORATION; WSC-MA2 (UTF-8)> 2007-09-17 22:23:53 438272 --a------ C:\WINDOWS\System32\AVawbecd.exe 2007-09-17 22:23:52 380928 --a------ C:\WINDOWS\System32\AVawbdcd.exe 2007-09-17 22:23:52 266240 --a------ C:\WINDOWS\System32\AVamrecd.exe 2007-09-17 22:23:51 0 d-------- C:\Program Files\MRConverter 2007-09-16 22:32:03 0 d-------- C:\Program Files\Lavalys 2007-09-10 17:29:50 0 d-------- C:\Program Files\FileZilla Client 2007-09-10 16:01:40 0 d-------- C:\Program Files\MarBit 2007-09-10 15:59:18 163840 --a------ C:\WINDOWS\System32\unrar.dll 2007-09-10 15:58:53 217088 --a------ C:\WINDOWS\System32\yv12vfw.dll <Not Verified; www.helixcommunity.org; Helix YV12 YUV Codec> 2007-09-10 15:58:51 282624 --a------ C:\WINDOWS\System32\xvidvfw.dll 2007-09-10 15:58:51 1559040 --a------ C:\WINDOWS\System32\xvidcore.dll 2007-09-10 15:58:50 3596288 --a------ C:\WINDOWS\System32\qt-dx331.dll 2007-09-10 15:58:50 73728 --a------ C:\WINDOWS\System32\dpl100.dll <Not Verified; DivX, Inc.; DivX, Inc. dpl100> 2007-09-10 15:58:41 740442 --a------ C:\WINDOWS\System32\divx.dll <Not Verified; DivX, Inc.; DivX®> 2007-09-10 15:58:36 7680 --a------ C:\WINDOWS\System32\ff_vfw.dll 2007-09-10 15:58:32 0 d-------- C:\Program Files\K-Lite Codec Pack 2007-09-09 19:20:10 0 d-------- C:\WINDOWS\System32\ActiveScan 2007-09-09 15:03:12 2560 --a------ C:\WINDOWS\System32\bitcometres.dll <Not Verified; BitComet; BitComet BCTP Helper> 2007-09-09 14:02:58 12289 --a------ C:\WINDOWS\System32\dssdll32.dll 2007-09-09 14:02:30 0 d-------- C:\Program Files\Common Files\NSV 2007-09-09 14:01:56 17920 --a------ C:\WINDOWS\System32\drivers\dsniff.sys 2007-09-08 11:08:44 685816 --a------ C:\WINDOWS\System32\drivers\sptd.sys 2007-09-08 11:06:33 0 d-------- C:\Program Files\DAEMON Tools 2007-09-08 09:47:46 0 d-------- C:\Program Files\ZaraSoft 2007-09-07 15:37:45 0 d--hs---- C:\WINDOWS\CSC 2007-09-07 15:31:37 0 d-------- C:\NVIDIA 2007-09-07 15:30:55 0 d-------- C:\Downloads 2007-09-07 15:14:07 0 d-------- C:\WINDOWS\LastGood 2007-09-07 14:23:46 0 d-------- C:\WINDOWS\System32\AdCache 2007-09-07 14:23:22 0 d-------- C:\Program Files\FlashGet 2007-09-06 18:52:39 0 d---s---- C:\WINDOWS\System32\Microsoft 2007-09-06 18:17:17 0 d-------- C:\Program Files\SpacialAudio 2007-09-06 18:17:06 0 d-------- C:\Program Files\Firebird 2007-09-06 17:53:32 0 d-------- C:\WINDOWS\System32\ReinstallBackups 2007-09-06 17:53:17 0 d-------- C:\WINDOWS\OPTIONS 2007-09-06 17:49:06 0 d-------- C:\Program Files\Avance Sound Manager 2007-09-06 17:49:04 0 d-------- C:\Program Files\AvRack 2007-09-06 17:49:03 584 -r------- C:\WINDOWS\System32\drivers\alcxinit.dat 2007-09-06 17:49:03 124416 -ra------ C:\WINDOWS\soundman.exe <Not Verified; Avance Logic, Inc.; Avance Sound Effect Manager v.4.1> 2007-09-06 17:49:03 217088 -ra------ C:\WINDOWS\alcupd.exe <Not Verified; Avance Logic, Inc.; Update Application for Avance AC'97> 2007-09-06 17:49:02 151552 -ra------ C:\WINDOWS\alcrmv.exe <Not Verified; Avance Logic, Inc.; Avance AC'97 Removing Tool for INTEL, VIA, SIS ALI Chipset> 2007-09-06 17:49:02 0 d--h----- C:\Program Files\InstallShield Installation Information 2007-09-06 17:48:03 0 d-------- C:\Program Files\Common Files\InstallShield 2007-09-06 17:47:31 381440 --a------ C:\WINDOWS\System32\Counter.exe 2007-09-06 17:47:30 387584 --a------ C:\WINDOWS\System32\LostRun.exe 2007-09-06 17:47:30 351232 --a------ C:\WINDOWS\System32\CheckPath.exe 2007-09-06 17:47:28 532480 --a------ C:\WINDOWS\System32\DeleteFiles.exe 2007-09-06 17:47:26 382464 --a------ C:\WINDOWS\System32\Restart.exe 2007-09-06 17:47:25 374784 --a------ C:\WINDOWS\System32\RunAP.exe 2007-09-06 17:47:24 306688 --a------ C:\WINDOWS\IsUninst.exe <Not Verified; InstallShield Software Corporation; InstallShield® unInstaller> 2007-09-06 01:39:43 0 d-------- C:\WINDOWS\RegisteredPackages 2007-09-06 01:37:27 0 d-------- C:\Program Files\Winamp 2007-09-06 01:33:08 0 d-------- C:\WINDOWS\LastGood.Tmp 2007-09-06 01:27:44 0 d-------- C:\Program Files\Gadu-Gadu 2007-09-06 01:25:51 0 d--hs---- C:\WINDOWS\Installer 2007-09-06 01:22:22 0 d--hs---- C:\System Volume Information <SYSTEM~1> 2007-09-06 01:22:14 0 d-------- C:\WINDOWS\Prefetch 2007-09-06 01:17:08 0 d-------- C:\WINDOWS\System32\xircom 2007-09-06 01:17:07 0 d-------- C:\Program Files\microsoft frontpage 2007-09-06 01:16:20 0 -rahs---- C:\MSDOS.SYS 2007-09-06 01:16:20 0 -rahs---- C:\IO.SYS 2007-09-06 01:16:20 0 --a------ C:\CONFIG.SYS 2007-09-06 01:16:20 0 --a------ C:\AUTOEXEC.BAT 2007-09-06 01:14:14 0 dr------- C:\WINDOWS\Offline Web Pages 2007-09-06 01:14:14 0 d---s---- C:\WINDOWS\Downloaded Program Files 2007-09-06 01:13:33 0 d-------- C:\WINDOWS\System32\DirectX 2007-09-06 01:12:51 0 d---s---- C:\WINDOWS\Tasks 2007-09-06 01:12:48 0 d-------- C:\Program Files\Common Files\MSSoap 2007-09-06 01:12:44 0 d-------- C:\WINDOWS\srchasst 2007-09-06 01:12:43 0 d-------- C:\WINDOWS\System32\Macromed 2007-09-06 01:12:41 0 d-------- C:\Program Files\Movie Maker 2007-09-06 01:12:37 0 d-------- C:\WINDOWS\System32\Restore 2007-09-06 01:12:37 0 d-------- C:\WINDOWS\PCHealth 2007-09-06 01:11:31 21856 --a------ C:\WINDOWS\System32\emptyregdb.dat 2007-09-06 01:11:10 0 d-------- C:\WINDOWS\Registration 2007-09-06 01:10:59 0 d--h----- C:\Program Files\WindowsUpdate 2007-09-06 01:10:59 0 d-------- C:\Program Files\Usługi online 2007-09-06 01:10:47 0 d-------- C:\Program Files\Messenger 2007-09-06 01:10:42 0 d-------- C:\Program Files\MSN Gaming Zone 2007-09-06 01:10:01 0 d-------- C:\Program Files\Windows NT 2007-09-06 01:09:55 0 d-------- C:\WINDOWS\System32\MsDtc 2007-09-06 01:09:55 0 d-------- C:\WINDOWS\System32\Com 2007-04-03 09:52:19 131072 --a------ C:\WINDOWS\System32\wnaspi32_.dll <Not Verified; Ahead Software AG im Stoeckmaedle 18 76307 Karlsbad, Germany Fax: ++49-7248-911-888 e-mail: info@nero.com; Nero WnAspi32> 2007-03-15 12:00:36 466432 --a------ C:\WINDOWS\System32\SkanerOnline.dll <Not Verified; MKS Sp. z o. o.; SkanerOnline> 2007-01-19 09:40:42 89088 --a------ C:\WINDOWS\System32\SkanerOnlineUninstall.exe <Not Verified; MKS Sp. z o.o.; SkanerOnlineUninstall Application> 2005-09-23 07:28:56 32768 --a------ C:\WINDOWS\System32\netfxperf.dll <Not Verified; Microsoft Corporation; Microsoft (R) .NET Framework> 2005-09-23 07:28:52 74240 --a------ C:\WINDOWS\System32\mscories.dll <Not Verified; Microsoft Corporation; Microsoft® .NET Framework> 2005-09-23 07:28:52 150016 --a------ C:\WINDOWS\System32\mscorier.dll <Not Verified; Microsoft Corporation; Microsoft® .NET Framework> 2005-09-23 07:28:52 270848 --a------ C:\WINDOWS\System32\mscoree.dll <Not Verified; Microsoft Corporation; Microsoft® .NET Framework> 2005-09-23 07:28:38 83456 --a------ C:\WINDOWS\System32\dfshim.dll <Not Verified; Microsoft Corporation; Microsoft® .NET Framework> 2004-09-24 01:31:08 233472 --a------ C:\WINDOWS\System32\libmySQL.dll 2004-09-24 01:31:00 3481600 --a------ C:\WINDOWS\System32\php5ts.dll <Not Verified; The PHP Group; PHP Script Interpreter> 2004-09-21 14:08:52 1331200 --a------ C:\WINDOWS\System32\php4ts.dll <Not Verified; The PHP Group; PHP Thread Safe> 2003-06-23 02:44:36 1415680 --a------ C:\WINDOWS\System32\wmv9vcm.dll <Not Verified; Microsoft Corporation; Windows Media Video 9 VCM> 2002-09-29 00:00:00 448348 --a------ C:\WINDOWS\System32\perfh015.dat 2002-09-29 00:00:00 74450 --a------ C:\WINDOWS\System32\perfc015.dat 2002-09-03 02:47:20 0 d-------- C:\WINDOWS 2002-09-03 02:47:20 0 d-------- C:\WINDOWS\WinSxS 2002-09-03 02:47:20 0 dr------- C:\WINDOWS\Web 2002-09-03 02:47:20 0 d-------- C:\WINDOWS\twain_32 2002-09-03 02:47:20 0 d-------- C:\WINDOWS\system32 2002-09-03 02:47:20 0 d-------- C:\WINDOWS\System32\wins 2002-09-03 02:47:20 0 d-------- C:\WINDOWS\System32\wbem 2002-09-03 02:47:20 0 d-------- C:\WINDOWS\System32\usmt 2002-09-03 02:47:20 0 d-------- C:\WINDOWS\System32\spool 2002-09-03 02:47:20 0 d-------- C:\WINDOWS\System32\ShellExt 2002-09-03 02:47:20 0 d-------- C:\WINDOWS\System32\Setup 2002-09-03 02:47:20 0 d-------- C:\WINDOWS\System32\ras 2002-09-03 02:47:20 0 d-------- C:\WINDOWS\System32\oobe 2002-09-03 02:47:20 0 d-------- C:\WINDOWS\System32\npp 2002-09-03 02:47:20 0 d-------- C:\WINDOWS\System32\mui 2002-09-03 02:47:20 0 d-------- C:\WINDOWS\System32\inetsrv 2002-09-03 02:47:20 0 d-------- C:\WINDOWS\System32\IME 2002-09-03 02:47:20 0 d-------- C:\WINDOWS\System32\icsxml 2002-09-03 02:47:20 0 d-------- C:\WINDOWS\System32\ias 2002-09-03 02:47:20 0 d-------- C:\WINDOWS\System32\export 2002-09-03 02:47:20 0 d-------- C:\WINDOWS\System32\drivers 2002-09-03 02:47:20 0 d-------- C:\WINDOWS\System32\drivers\etc 2002-09-03 02:47:20 0 d-------- C:\WINDOWS\System32\drivers\disdn 2002-09-03 02:47:20 0 dr-hs--c- C:\WINDOWS\System32\dllcache 2002-09-03 02:47:20 0 d-------- C:\WINDOWS\System32\dhcp 2002-09-03 02:47:20 0 d-------- C:\WINDOWS\System32\config 2002-09-03 02:47:20 0 d-------- C:\WINDOWS\System32\3com_dmi 2002-09-03 02:47:20 0 d-------- C:\WINDOWS\System32\3076 2002-09-03 02:47:20 0 d-------- C:\WINDOWS\System32\2052 2002-09-03 02:47:20 0 d-------- C:\WINDOWS\System32\1054 2002-09-03 02:47:20 0 d-------- C:\WINDOWS\System32\1045 2002-09-03 02:47:20 0 d-------- C:\WINDOWS\System32\1042 2002-09-03 02:47:20 0 d-------- C:\WINDOWS\System32\1041 2002-09-03 02:47:20 0 d-------- C:\WINDOWS\System32\1037 2002-09-03 02:47:20 0 d-------- C:\WINDOWS\System32\1033 2002-09-03 02:47:20 0 d-------- C:\WINDOWS\System32\1031 2002-09-03 02:47:20 0 d-------- C:\WINDOWS\System32\1028 2002-09-03 02:47:20 0 d-------- C:\WINDOWS\System32\1025 2002-09-03 02:47:20 0 d-------- C:\WINDOWS\system 2002-09-03 02:47:20 0 d-------- C:\WINDOWS\security 2002-09-03 02:47:20 0 d-------- C:\WINDOWS\Resources 2002-09-03 02:47:20 0 d-------- C:\WINDOWS\repair 2002-09-03 02:47:20 0 d-------- C:\WINDOWS\mui 2002-09-03 02:47:20 0 d-------- C:\WINDOWS\msapps 2002-09-03 02:47:20 0 d-------- C:\WINDOWS\msagent 2002-09-03 02:47:20 0 d-------- C:\WINDOWS\Media 2002-09-03 02:47:20 0 d-------- C:\WINDOWS\java 2002-09-03 02:47:20 0 d--h----- C:\WINDOWS\inf 2002-09-03 02:47:20 0 d-------- C:\WINDOWS\ime 2002-09-03 02:47:20 0 d-------- C:\WINDOWS\Help 2002-09-03 02:47:20 0 dr--s---- C:\WINDOWS\Fonts 2002-09-03 02:47:20 0 d-------- C:\WINDOWS\Driver Cache 2002-09-03 02:47:20 0 d-------- C:\WINDOWS\Debug 2002-09-03 02:47:20 0 d-------- C:\WINDOWS\Cursors 2002-09-03 02:47:20 0 d-------- C:\WINDOWS\Connection Wizard 2002-09-03 02:47:20 0 d-------- C:\WINDOWS\Config 2002-09-03 02:47:20 0 d-------- C:\WINDOWS\AppPatch 2002-09-03 02:47:20 0 d-------- C:\WINDOWS\addins 2002-09-03 02:02:12 0 d-------- C:\Program Files\Common Files\ODBC 2002-09-03 02:02:08 0 d-------- C:\Program Files\Common Files\SpeechEngines 2002-09-03 02:02:07 0 dr------- C:\Program Files 2002-09-03 02:02:07 0 d-------- C:\Program Files\Common Files 2002-09-03 02:00:56 0 d-------- C:\WINDOWS\System32\CatRoot2 2002-09-03 02:00:56 0 d-------- C:\WINDOWS\System32\CatRoot 2002-09-03 02:00:32 0 d-------- C:\Documents and Settings 2002-09-02 19:17:19 259072 --a------ C:\WINDOWS\System32\TsgyVLHk.exe 2002-09-02 15:35:33 259072 --a------ C:\WINDOWS\System32\kryAUrWd.exe 2002-09-02 15:14:44 259072 --a------ C:\WINDOWS\System32\EEEAWsvD.exe 2002-09-02 09:57:38 259072 --a------ C:\WINDOWS\System32\beYOhstL.exe 2002-09-02 07:00:33 259072 --a------ C:\WINDOWS\System32\pGQXoMbI.exe 2002-09-02 04:36:00 23040 --a------ C:\WINDOWS\System32\mszsrn32.dll 2002-09-02 04:21:33 259072 --a------ C:\WINDOWS\System32\stYqEeMI.exe 2002-09-02 03:58:23 0 d-------- C:\WINDOWS\System32\ebay 2002-09-02 03:39:18 259072 --a------ C:\WINDOWS\System32\CYkQPaAT.exe 2002-09-02 03:13:11 259072 --a------ C:\WINDOWS\System32\LUCrUjso.exe 2002-09-02 03:05:12 0 d-------- C:\Program Files\Common Files\DirectX 2002-09-02 02:50:26 0 d-------- C:\Program Files\MP3Producer 2002-09-02 02:29:53 8464 --a------ C:\WINDOWS\System32\sporder.dll <Not Verified; Microsoft Corporation; Microsoft(R) Windows (R) 2000 Operating System> 2002-09-02 02:29:52 0 d-------- C:\Program Files\AFreeConverter 2002-09-02 02:10:32 0 d-------- C:\Program Files\MoorHunt 2002-09-02 01:53:41 0 d-------- C:\WINDOWS\San Andreas Mod Installer 2002-09-02 01:33:14 259072 --a------ C:\WINDOWS\System32\uymNshra.exe 2002-09-02 01:26:49 0 d-------- C:\Program Files\Lendasoft 2002-09-02 01:05:07 202726 --a------ C:\WINDOWS\System32\ChrIpIWL.exe 2002-09-02 01:00:06 259072 --a------ C:\WINDOWS\System32\eKilKvQN.exe 2002-09-02 00:58:17 0 d-------- C:\Program Files\Skype 2002-09-02 00:49:00 0 d-------- C:\Program Files\Odkurzacz 2002-09-02 00:41:38 202726 -r------- C:\WINDOWS\System32\spools.exe 2002-09-02 00:41:33 202726 --a------ C:\WINDOWS\System32\hRHkoLOy.exe 2002-09-02 00:41:32 0 --a------ C:\WINDOWS\ativpsrm.bin 2002-09-02 00:37:07 593920 -----n--- C:\WINDOWS\System32\ati2sgag.exe <Not Verified; ; ATI Smart> 2002-09-02 00:36:30 0 d-------- C:\Program Files\ATI Technologies 2002-09-02 00:35:06 0 d-------- C:\ATI 2002-09-02 00:27:49 0 d-------- C:\WINDOWS\pss 2002-09-02 00:21:56 0 d-------- C:\Program Files\SHOUTcast 2002-09-02 00:08:05 263680 --a------ C:\WINDOWS\System32\bbot.exe 2002-09-02 00:07:19 52661 -r------- C:\WINDOWS\System32\mmsvc32.exe 2002-09-02 00:06:24 0 d-------- C:\Program Files\SkanerOnline 2002-09-02 00:05:52 259072 --a------ C:\WINDOWS\System32\HhiXqthE.exe 2002-09-02 00:04:48 25088 --a------ C:\WINDOWS\System32\rch.exe 2002-09-02 00:04:11 0 d-------- C:\Program Files\MultiRes 2002-09-02 00:03:59 70144 --a------ C:\WINDOWS\System32\gate.exe 2002-09-02 00:03:47 0 d-------- C:\WINDOWS\System32\appmgmt 2002-09-02 00:03:45 259072 --a------ C:\WINDOWS\System32\QwLMQTmf.exe 2002-09-02 00:03:13 259072 --a------ C:\WINDOWS\System32\tMsgfnon.exe 2002-09-02 00:03:13 259072 --a------ C:\WINDOWS\System32\kabdeWqJ.exe 2002-09-02 00:02:49 259072 --a------ C:\WINDOWS\System32\PxfaobtN.exe 2002-09-02 00:02:39 259072 --a------ C:\WINDOWS\System32\hFCormBp.exe 2002-09-02 00:02:35 0 d-------- C:\Program Files\Radeon Omega Drivers 2002-09-02 00:02:04 52427 --a------ C:\WINDOWS\System32\UTDTa.exe 2002-09-02 00:01:57 259072 --a------ C:\WINDOWS\System32\IdHIsGPn.exe 2002-09-02 00:01:44 263680 --a------ C:\WINDOWS\System32\UoXnTwwm.exe 2002-09-02 00:01:25 259072 --a------ C:\WINDOWS\System32\fXaXYyjo.exe 2002-09-02 00:01:22 259072 --a------ C:\WINDOWS\System32\AoaXfjAR.exe -- Find3M Report --------------------------------------------------------------- 2007-09-20 15:05:24 0 d-------- C:\Documents and Settings\VoX\Dane aplikacji\Gadu-Gadu 2007-09-17 14:04:22 0 d-------- C:\Documents and Settings\VoX\Dane aplikacji\Macromedia 2007-09-06 01:25:47 0 d-------- C:\Documents and Settings\VoX\Dane aplikacji\Identities 2002-09-03 02:01:41 62 --ahs---- C:\Documents and Settings\VoX\Dane aplikacji\desktop.ini 2002-09-02 03:58:50 0 d-------- C:\Documents and Settings\VoX\Dane aplikacji\Ashampoo 2002-09-02 02:53:45 0 d-------- C:\Documents and Settings\VoX\Dane aplikacji\FileZilla 2002-09-02 01:59:08 0 d-------- C:\Documents and Settings\VoX\Dane aplikacji\Media Player Classic 2002-09-02 00:53:27 0 d-------- C:\Documents and Settings\VoX\Dane aplikacji\Skype 2002-09-02 00:51:02 0 d-------- C:\Documents and Settings\VoX\Dane aplikacji\Real 2002-09-02 00:42:37 0 d-------- C:\Documents and Settings\VoX\Dane aplikacji\ATI -- Registry Dump --------------------------------------------------------------- *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SoundMan"="soundman.exe" [2001-12-20 03:37 C:\WINDOWS\soundman.exe] "Microsoft Network Services Controller"="C:\WINDOWS\System32\mmsvc32.exe" [2007-10-30 21:33] "Spools Service Controller"="C:\WINDOWS\System32\spools.exe" [2002-09-02 00:41] "StartCCC"="C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2006-11-10 12:35] "UnlockerAssistant"="C:\Program Files\Unlocker\UnlockerAssistant.exe" [2006-09-07 19:19] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\System32\ctfmon.exe" [2002-09-29 00:00] "Gadu-Gadu"="C:\Program Files\Gadu-Gadu\gg.exe" [2007-07-09 09:39] "Odkurzacz-MCD"="C:\Program Files\Odkurzacz\odk_mcd.exe" [2007-05-03 10:02] "SpybotSD TeaTimer"="D:\Programy\Spybot - Search & Destroy\TeaTimer.exe" [2007-10-07 12:04] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad] "MSN Messenger"= {280A7B65-8F00-438F-3E5A-1F039433FE60} - %SystemRoot%\system32\dssdll32.dll [ ] -- Hosts ----------------------------------------------------------------------- 82.146.60.44 postbank.de 82.146.60.44 www.postbank.de 82.146.60.44 banking.postbank.de 82.146.60.44 direkt.postbank.de 82.146.60.44 www.smile.co.uk 82.146.60.44 smile.co.uk 82.146.60.44 cahoot.com 82.146.60.44 www.cahoot.com 82.146.60.44 www.cahoot.co.uk 82.146.60.44 cahoot.co.uk 32 more entries in hosts file. -- End of Deckard's System Scanner: finished at 2002-09-02 00:55:57 ------------

extra.txt

Kod: Zaznacz wszystko: Deckard's System Scanner v20071014.68 Extra logfile - please post this as an attachment with your post. -------------------------------------------------------------------------------- -- System Information ---------------------------------------------------------- Microsoft Windows XP Professional (build 2600) SP 1.0 Architecture: X86; Language: Polish CPU 0: AMD Duron(tm) processor Percentage of Memory in Use: 68% Physical Memory (total/avail): 383.48 MiB / 120.45 MiB Pagefile Memory (total/avail): 1046.05 MiB / 744.4 MiB Virtual Memory (total/avail): 2047.88 MiB / 1924.14 MiB A: is Removable (No Media) C: is Fixed (NTFS) - 4.88 GiB total, 0.2 GiB free. D: is Fixed (FAT32) - 22.6 GiB total, 0.62 GiB free. E: is Fixed (FAT32) - 9.77 GiB total, 1.36 GiB free. F: is CDROM (No Media) G: is CDROM (No Media) \\.\PHYSICALDRIVE0 - ST340810A - 37.27 GiB - 3 partitions \PARTITION0 (bootable) - Instalowalny system plików - 4.88 GiB - C: \PARTITION1 - Unknown - 9.77 GiB - E: \PARTITION2 - Unknown - 22.61 GiB - D: -- Security Center ------------------------------------------------------------- AUState says computer is in an unknown state. -- Environment Variables ------------------------------------------------------- ALLUSERSPROFILE=C:\Documents and Settings\All Users APPDATA=C:\Documents and Settings\VoX\Dane aplikacji CLIENTNAME=Console CommonProgramFiles=C:\Program Files\Common Files COMPUTERNAME=VOX-HUOQRCQPZHU ComSpec=C:\WINDOWS\system32\cmd.exe HOMEDRIVE=C: HOMEPATH=\Documents and Settings\VoX LOGONSERVER=\\VOX-HUOQRCQPZHU NUMBER_OF_PROCESSORS=1 OS=Windows_NT Path=C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\system32\wbem;C:\Program Files\ATI Technologies\ATI.ACE\Core-Static PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH PROCESSOR_ARCHITECTURE=x86 PROCESSOR_IDENTIFIER=x86 Family 6 Model 7 Stepping 1, AuthenticAMD PROCESSOR_LEVEL=6 PROCESSOR_REVISION=0701 ProgramFiles=C:\Program Files PROMPT=$P$G SESSIONNAME=Console SystemDrive=C: SystemRoot=C:\WINDOWS TEMP=C:\DOCUME~1\VoX\USTAWI~1\Temp TMP=C:\DOCUME~1\VoX\USTAWI~1\Temp USERDOMAIN=VOX-HUOQRCQPZHU USERNAME=VoX USERPROFILE=C:\Documents and Settings\VoX windir=C:\WINDOWS -- User Profiles --------------------------------------------------------------- VoX [I](admin)[/I] Administrator [I](new local, admin)[/I] -- Add/Remove Programs --------------------------------------------------------- --> rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf Adobe Flash Player 9 ActiveX --> C:\WINDOWS\System32\Macromed\Flash\FlashUtil9c.exe -uninstallUnlock Adobe Shockwave Player --> C:\WINDOWS\system32\Macromed\SHOCKW~1\UNWISE.EXE C:\WINDOWS\system32\Macromed\SHOCKW~1\Install.log AFreeConverter 2.24 --> "C:\Program Files\AFreeConverter\unins000.exe" ALLPlayer V2.2 --> C:\Program Files\MarBit\ALLPlayer\UnGins.exe "C:\Program Files\MarBit\ALLPlayer\install.log" Archiwizator WinRAR --> C:\Program Files\WinRAR\uninstall.exe ATI - Software Uninstall Utility --> C:\Program Files\ATI Technologies\UninstallAll\AtiCimUn.exe ATI Catalyst Control Center --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{055EE59D-217B-43A7-ABFF-507B966405D8}\setup.exe" -l0x0 ATI Display Driver --> rundll32 C:\WINDOWS\System32\atiiiexx.dll,_InfEngUnInstallINFFile_RunDLL@16 -force_restart -flags:0x2010001 -inf_class:DISPLAY -clean AtomixMP3 v2.2 --> D:\PROGRAMY\ATOMIX~1\UNWISE.EXE D:\PROGRAMY\ATOMIX~1\INSTALL.LOG Avance AC'97 Audio --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{FB08F381-6533-4108-B7DD-039E11FBC27E}\setup.exe" REMOVE DesignPro 5 --> C:\PROGRA~1\COMMON~1\INSTAL~1\Driver\9\INTEL3~1\IDriver.exe /M{DF57E946-4885-4EEA-A958-D5F82CB21B99} EVEREST Home Edition v2.20 --> "C:\Program Files\Lavalys\EVEREST Home Edition\unins000.exe" FileZilla Client 3.0.1 --> C:\Program Files\FileZilla Client\uninstall.exe Firebird 1.5.2.4731 --> "C:\Program Files\Firebird\Firebird_1_5\unins000.exe" FlashGet(JetCar) --> C:\PROGRA~1\FlashGet\UNWISE.EXE C:\PROGRA~1\FlashGet\INSTALL.LOG Free Games Offer, Desktop Shortcut --> MsiExec.exe /X{31DABA20-10A1-4746-9D9F-57955B8DFF66} Gadu-Gadu 7.7 --> C:\Program Files\Gadu-Gadu\Setup.exe GTA San Andreas --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\10\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{D417C96A-FCC7-4590-A1BB-FAF73F5BC98E}\setup.exe" -l0x9 -removeonly HijackThis 1.99.1 --> D:\hijackthis\HijackThis.exe /uninstall IrfanView (remove only) --> C:\Program Files\IrfanView\iv_uninstall.exe K-Lite Codec Pack 3.4.0 Full --> "C:\Program Files\K-Lite Codec Pack\unins000.exe" Microsoft Visual C++ 2005 Redistributable --> MsiExec.exe /X{A49F249F-0C91-497F-86DF-B2585E8E76B7} Mobile Ringtone Converter 2.3.60 --> "C:\Program Files\MRConverter\unins000.exe" MoorHunt 0.4.0.0 --> "C:\Program Files\MoorHunt\unins000.exe" MP3Producer --> C:\Program Files\MP3Producer\Uninstall.exe MultiRes (remove only) --> C:\Program Files\MultiRes\uninstal.exe Need for Speed Underground 2 --> D:\NFS\EAUninstall.exe Odkurzacz 10.9 Pro --> "C:\Program Files\Odkurzacz\unins000.exe" Panda ActiveScan --> C:\WINDOWS\System32\ASUninst.exe Panda ActiveScan Radeon Omega Drivers v3.8.252 Setup Files and Tools --> "C:\WINDOWS\Radeon Omega Drivers v3.8.252 Uninstall.exe" "/U:C:\Program Files\Radeon Omega Drivers\v3.8.252\Omega Uninstall.xml" Real Alternative 1.23 --> "C:\Program Files\Real Alternative\unins000.exe" RTLSetup --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{97AA0C55-AFAD-4126-B21C-F1318FB6DADA}\Setup.exe" -l0x9 REMOVE SAM Broadcaster (remove only) --> "C:\Program Files\SpacialAudio\SAMBC\uninstall.exe" San Andreas Mod Installer --> "C:\WINDOWS\San Andreas Mod Installer\uninstall.exe" "/U:E:\Gry\MOD GTA SA\Uninstall\uninstall.xml" SHOUTcast DNAS (remove only) --> "C:\Program Files\SHOUTcast\uninst-dnas.exe" SHOUTcast Source DSP 1.9.0 (remove only) --> C:\Program Files\Winamp\uninst-dsp.exe Skaner on-line mks_vir --> C:\WINDOWS\System32\SkanerOnlineUninstall.exe Skype (BETA) --> "C:\Program Files\Skype\Phone\unins000.exe" Spybot - Search & Destroy --> "D:\Programy\Spybot - Search & Destroy\unins000.exe" Unlocker 1.8.5 --> C:\Program Files\Unlocker\uninst.exe Winamp (remove only) --> "C:\Program Files\Winamp\UninstWA.exe" -- Application Event Log ------------------------------------------------------- Event Record #/Type556 / Error Event Submitted/Written: 09/02/2002 00:53:47 AM Event ID/Source: 11 / crypt32 Event Description: Nie można wyodrębnić głównej listy innych firm z pliku cab automatycznej aktualizacji z: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>, wystąpił błąd: 0x800b0101 Event Record #/Type553 / Error Event Submitted/Written: 09/02/2002 00:53:47 AM Event ID/Source: 11 / crypt32 Event Description: Nie można wyodrębnić głównej listy innych firm z pliku cab automatycznej aktualizacji z: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>, wystąpił błąd: 0x800b0101 Event Record #/Type552 / Error Event Submitted/Written: 09/02/2002 00:50:49 AM Event ID/Source: 11 / crypt32 Event Description: Nie można wyodrębnić głównej listy innych firm z pliku cab automatycznej aktualizacji z: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>, wystąpił błąd: 0x800b0101 Event Record #/Type549 / Error Event Submitted/Written: 09/02/2002 00:50:49 AM Event ID/Source: 11 / crypt32 Event Description: Nie można wyodrębnić głównej listy innych firm z pliku cab automatycznej aktualizacji z: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>, wystąpił błąd: 0x800b0101 Event Record #/Type548 / Error Event Submitted/Written: 09/02/2002 00:50:30 AM Event ID/Source: 11 / crypt32 Event Description: Nie można wyodrębnić głównej listy innych firm z pliku cab automatycznej aktualizacji z: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>, wystąpił błąd: 0x800b0101 -- Security Event Log ---------------------------------------------------------- No Errors/Warnings found. -- System Event Log ------------------------------------------------------------ Event Record #/Type3464 / Error Event Submitted/Written: 10/30/2007 10:22:43 PM Event ID/Source: 12294 / ati2mtag Event Description: CRT invalid display type Event Record #/Type3462 / Error Event Submitted/Written: 10/30/2007 09:57:24 PM / 10/30/2007 09:57:25 PM Event ID/Source: 12294 / ati2mtag Event Description: CRT invalid display type Event Record #/Type3454 / Error Event Submitted/Written: 10/30/2007 09:34:12 PM Event ID/Source: 7023 / Service Control Manager Event Description: Usługa Harmonogram zadań zakończyła działanie; wystąpił następujący błąd: %%87 Event Record #/Type3452 / Error Event Submitted/Written: 10/30/2007 09:32:50 PM / 10/30/2007 09:33:21 PM Event ID/Source: 12294 / ati2mtag Event Description: CRT invalid display type Event Record #/Type3438 / Error Event Submitted/Written: 10/30/2007 09:18:31 PM Event ID/Source: 7023 / Service Control Manager Event Description: Usługa Harmonogram zadań zakończyła działanie; wystąpił następujący błąd: %%87 -- End of Deckard's System Scanner: finished at 2002-09-02 00:55:57 ------------

LOG HijackThis:

Kod: Zaznacz wszystko: Logfile of HijackThis v1.99.1 Scan saved at 01:05, on 2002-09-02 Platform: Windows XP Dodatek SP. 1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\System32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\soundman.exe C:\Program Files\Unlocker\UnlockerAssistant.exe C:\WINDOWS\System32\ctfmon.exe C:\Program Files\Gadu-Gadu\gg.exe C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe D:\Programy\Spybot - Search & Destroy\TeaTimer.exe C:\Program Files\Firebird\Firebird_1_5\bin\fbguard.exe c:\usr\MYSQL\bin\mysqld.exe E:\Instalki\Alcohol 120\StarWind\StarWindServiceAE.exe C:\Program Files\Firebird\Firebird_1_5\bin\fbserver.exe C:\WINDOWS\System32\wuauclt.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\WINDOWS\notepad.exe C:\WINDOWS\notepad.exe C:\Program Files\FileZilla Client\filezilla.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\WINDOWS\system32\NOTEPAD.EXE D:\hijackthis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O1 - Hosts: 82.146.60.44 postbank.de O1 - Hosts: 82.146.60.44 www.postbank.de O1 - Hosts: 82.146.60.44 banking.postbank.de O1 - Hosts: 82.146.60.44 direkt.postbank.de O1 - Hosts: 82.146.60.44 www.smile.co.uk O1 - Hosts: 82.146.60.44 smile.co.uk O1 - Hosts: 82.146.60.44 cahoot.com O1 - Hosts: 82.146.60.44 www.cahoot.com O1 - Hosts: 82.146.60.44 www.cahoot.co.uk O1 - Hosts: 82.146.60.44 cahoot.co.uk O1 - Hosts: 82.146.60.44 www.co-operativebank.co.uk O1 - Hosts: 82.146.60.44 co-operativebank.co.uk O1 - Hosts: 82.146.60.44 www.co-operativebank.com O1 - Hosts: 82.146.60.44 co-operativebank.com O1 - Hosts: 82.146.60.44 personal.barclays.co.uk O1 - Hosts: 82.146.60.44 barclays.co.uk O1 - Hosts: 82.146.60.44 ibank.barclays.co.uk O1 - Hosts: 82.146.60.44 www.barclays.co.uk O1 - Hosts: 82.146.60.44 barclays.touchclarity.com O1 - Hosts: 82.146.60.44 hsbc.co.uk O1 - Hosts: 82.146.60.44 www.hsbc.co.uk O1 - Hosts: 82.146.60.44 hsbc.touchclarity.com O1 - Hosts: 82.146.60.44 www1.member-hsbc-group.com O1 - Hosts: 82.146.60.44 lloydstsb.co.uk O1 - Hosts: 82.146.60.44 www.lloydstsb.co.uk O1 - Hosts: 82.146.60.44 lloydstsb.com O1 - Hosts: 82.146.60.44 www.lloydstsb.com O1 - Hosts: 82.146.60.44 mi.lloydstsb.com O1 - Hosts: 82.146.60.44 www.woolwich.co.uk O1 - Hosts: 82.146.60.44 woolwich.co.uk O1 - Hosts: 82.146.60.44 www.deutsche-bank.de O1 - Hosts: 82.146.60.44 deutsche-bank.de O1 - Hosts: 82.146.60.44 meine.deutsche-bank.de O1 - Hosts: 82.146.60.44 www.anbusiness.com O1 - Hosts: 82.146.60.44 anbusiness.com O1 - Hosts: 82.146.60.44 www.abbeyinternational.com O1 - Hosts: 82.146.60.44 www.barclays.com O1 - Hosts: 82.146.60.44 barclays.com O1 - Hosts: 82.146.60.44 ibank.internationalbanking.barclays.com O1 - Hosts: 82.146.60.44 offshore.hsbc.com O1 - Hosts: 82.146.60.44 www.lloydstsb-offshore.com O1 - Hosts: 82.146.60.44 lloydstsb-offshore.com O2 - BHO: BitComet Helper - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - D:\BitComet\tools\BitCometBHO_1.1.7.4.dll O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - D:\Programy\Spybot - Search & Destroy\SDHelper.dll O2 - BHO: IeCatch2 Class - {A5366673-E8CA-11D3-9CD9-0090271D075B} - C:\PROGRA~1\FlashGet\jccatch.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\fgiebar.dll O4 - HKLM\..\Run: [SoundMan] soundman.exe O4 - HKLM\..\Run: [Microsoft Network Services Controller] C:\WINDOWS\System32\mmsvc32.exe O4 - HKLM\..\Run: [Spools Service Controller] C:\WINDOWS\System32\spools.exe O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" O4 - HKLM\..\Run: [UnlockerAssistant] "C:\Program Files\Unlocker\UnlockerAssistant.exe" O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - HKCU\..\Run: [Odkurzacz-MCD] C:\Program Files\Odkurzacz\odk_mcd.exe O4 - HKCU\..\Run: [SpybotSD TeaTimer] D:\Programy\Spybot - Search & Destroy\TeaTimer.exe O8 - Extra context menu item: &D&ownload &with BitComet - res://D:\BitComet\BitComet.exe/AddLink.htm O8 - Extra context menu item: &D&ownload all video with BitComet - res://D:\BitComet\BitComet.exe/AddVideo.htm O8 - Extra context menu item: &D&ownload all with BitComet - res://D:\BitComet\BitComet.exe/AddAllLink.htm O8 - Extra context menu item: Ściągnij przy pomocy FlashGet'a - C:\Program Files\FlashGet\jc_link.htm O8 - Extra context menu item: Ściągnij wszystko przy pomocy FlashGet'a - C:\Program Files\FlashGet\jc_all.htm O9 - Extra button: BitComet Search - {461CC20B-FB6E-4f16-8FE8-C29359DB100E} - D:\BitComet\tools\BitCometBHO_1.1.7.4.dll O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - D:\Programy\Spybot - Search & Destroy\SDHelper.dll O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - D:\Programy\Spybot - Search & Destroy\SDHelper.dll O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {68282C51-9459-467B-95BF-3C0E89627E55} (MksSkanerOnline Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab O21 - SSODL: MSN Messenger - {280A7B65-8F00-438F-3E5A-1F039433FE60} - C:\WINDOWS\system32\dssdll32.dll O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: Firebird Guardian - DefaultInstance (FirebirdGuardianDefaultInstance) - The Firebird Project - C:\Program Files\Firebird\Firebird_1_5\bin\fbguard.exe O23 - Service: Firebird Server - DefaultInstance (FirebirdServerDefaultInstance) - The Firebird Project - C:\Program Files\Firebird\Firebird_1_5\bin\fbserver.exe O23 - Service: MySql - Unknown owner - c:\usr/MYSQL/bin/mysqld.exe O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - E:\Instalki\Alcohol 120\StarWind\StarWindServiceAE.exe

[/b]

**Posty:** 3854 · przez **Dzi@dek** 31 Paź 2007, 17:18

VoX napisał(a):wyskakuje mi takie coś za kazdym razem:

W spybocie masz zaznaczona opcję - chroń plik hosts lub tylko do odczytu - odznacz to.

**Posty:** 18165 · przez **wojtas** 31 Paź 2007, 17:22

Otworz notatnik i wklej w nim to:

File::
C:\WINDOWS\System32\RqgDeFbd.exe
C:\WINDOWS\System32\vPeeqXiU.exe
C:\WINDOWS\System32\tgqQGuVr.exe
C:\WINDOWS\System32\psvc.exe
C:\WINDOWS\System32\dssdll32.dll
C:\WINDOWS\System32\drivers\dsniff.sys
C:\WINDOWS\system32\mszsrn32.dll
C:\WINDOWS\System32\TsgyVLHk.exe
C:\WINDOWS\System32\kryAUrWd.exe
C:\WINDOWS\System32\EEEAWsvD.exe
C:\WINDOWS\System32\beYOhstL.exe
C:\WINDOWS\System32\pGQXoMbI.exe
C:\WINDOWS\System32\stYqEeMI.exe
C:\WINDOWS\System32\CYkQPaAT.exe
C:\WINDOWS\System32\LUCrUjso.exe
C:\WINDOWS\System32\uymNshra.exe
C:\WINDOWS\System32\ChrIpIWL.exe
C:\WINDOWS\System32\eKilKvQN.exe
C:\WINDOWS\System32\hRHkoLOy.exe
C:\WINDOWS\System32\bbot.exe
C:\WINDOWS\System32\mmsvc32.exe
C:\WINDOWS\System32\HhiXqthE.exe
C:\WINDOWS\System32\rch.exe
C:\WINDOWS\System32\gate.exe
C:\WINDOWS\System32\QwLMQTmf.exe
C:\WINDOWS\System32\tMsgfnon.exe
C:\WINDOWS\System32\kabdeWqJ.exe
C:\WINDOWS\System32\PxfaobtN.exe
C:\WINDOWS\System32\hFCormBp.exe
C:\WINDOWS\System32\UTDTa.exe
C:\WINDOWS\System32\IdHIsGPn.exe
C:\WINDOWS\System32\UoXnTwwm.exe
C:\WINDOWS\System32\fXaXYyjo.exe
C:\WINDOWS\System32\AoaXfjAR.exe

Driver::
dsniff

Plik >>> zapisz jako CFScript.txt .Plik przeciągnij i upuść na ikonę ComboFixa (tak jak tu ) . Potwierdz >>> zresetuje sie komputer

(jeśli pojawi się pytanie "1 or 2" - to wpisz 1 i naciśnij ENTER). Rozpocznie się proces usuwania

Otwórz HijackThis >>> Config >>> Misc Tools >>> Open HOSTS File manager >>> podświetl wszystkie wpisy z wyjątkiem 127.0.0.1 localhost (ten ma być) i skasuj. Zapisz zmiany w pliku.

skasuj te wpisy:

O21 - SSODL: MSN Messenger - {280A7B65-8F00-438F-3E5A-1F039433FE60} - C:\WINDOWS\system32\dssdll32.dll
O4 - HKLM\..\Run: [Microsoft Network Services Controller] C:\WINDOWS\System32\mmsvc32.exe
O4 - HKLM\..\Run: [Spools Service Controller] C:\WINDOWS\System32\spools.exe

Potem nowy log z hijacka oraz combofixa. log z combofixa powinien byc tu:

C:\ComboFix.txt

**Posty:** 28 · przez **VoX** 31 Paź 2007, 18:10

podświetl wszystkie wpisy z wyjątkiem 127.0.0.1 localhost (ten ma być) i skasuj. Zapisz zmiany w pliku.

w tym kłopot, że jest tylko "127.0.0.1 localhost "

reszta zrobiona

LOG:

ComboFix

Kod: Zaznacz wszystko: ComboFix 07-10-29.1 - VoX 2002-09-02 1:58:28.2 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.1.1250.1.1045.18.120 [GMT 2:00] Running from: D:\ComboFix.exe Command switches used :: C:\Documents and Settings\VoX\Pulpit\CFScript.txt * Created a new restore point FILE:: C:\WINDOWS\System32\AoaXfjAR.exe C:\WINDOWS\System32\bbot.exe C:\WINDOWS\System32\beYOhstL.exe C:\WINDOWS\System32\ChrIpIWL.exe C:\WINDOWS\System32\CYkQPaAT.exe C:\WINDOWS\System32\drivers\dsniff.sys C:\WINDOWS\System32\dssdll32.dll C:\WINDOWS\System32\EEEAWsvD.exe C:\WINDOWS\System32\eKilKvQN.exe C:\WINDOWS\System32\fXaXYyjo.exe C:\WINDOWS\System32\gate.exe C:\WINDOWS\System32\hFCormBp.exe C:\WINDOWS\System32\HhiXqthE.exe C:\WINDOWS\System32\hRHkoLOy.exe C:\WINDOWS\System32\IdHIsGPn.exe C:\WINDOWS\System32\kabdeWqJ.exe C:\WINDOWS\System32\kryAUrWd.exe C:\WINDOWS\System32\LUCrUjso.exe C:\WINDOWS\System32\mmsvc32.exe C:\WINDOWS\system32\mszsrn32.dll C:\WINDOWS\System32\pGQXoMbI.exe C:\WINDOWS\System32\psvc.exe C:\WINDOWS\System32\PxfaobtN.exe C:\WINDOWS\System32\QwLMQTmf.exe C:\WINDOWS\System32\rch.exe C:\WINDOWS\System32\RqgDeFbd.exe C:\WINDOWS\System32\stYqEeMI.exe C:\WINDOWS\System32\tgqQGuVr.exe C:\WINDOWS\System32\tMsgfnon.exe C:\WINDOWS\System32\TsgyVLHk.exe C:\WINDOWS\System32\UoXnTwwm.exe C:\WINDOWS\System32\UTDTa.exe C:\WINDOWS\System32\uymNshra.exe C:\WINDOWS\System32\vPeeqXiU.exe . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\WINDOWS\System32\AoaXfjAR.exe C:\WINDOWS\System32\bbot.exe C:\WINDOWS\System32\beYOhstL.exe C:\WINDOWS\System32\ChrIpIWL.exe C:\WINDOWS\System32\CYkQPaAT.exe C:\WINDOWS\System32\drivers\dsniff.sys C:\WINDOWS\System32\dssdll32.dll C:\WINDOWS\System32\EEEAWsvD.exe C:\WINDOWS\System32\eKilKvQN.exe C:\WINDOWS\System32\fXaXYyjo.exe C:\WINDOWS\System32\gate.exe C:\WINDOWS\System32\hFCormBp.exe C:\WINDOWS\System32\HhiXqthE.exe C:\WINDOWS\System32\hRHkoLOy.exe C:\WINDOWS\System32\IdHIsGPn.exe C:\WINDOWS\System32\kabdeWqJ.exe C:\WINDOWS\System32\kryAUrWd.exe C:\WINDOWS\System32\LUCrUjso.exe C:\WINDOWS\System32\mmsvc32.exe C:\WINDOWS\system32\mszsrn32.dll C:\WINDOWS\System32\pGQXoMbI.exe C:\WINDOWS\System32\psvc.exe C:\WINDOWS\System32\PxfaobtN.exe C:\WINDOWS\System32\QwLMQTmf.exe C:\WINDOWS\System32\rch.exe C:\WINDOWS\System32\RqgDeFbd.exe C:\WINDOWS\System32\stYqEeMI.exe C:\WINDOWS\System32\tgqQGuVr.exe C:\WINDOWS\System32\tMsgfnon.exe C:\WINDOWS\System32\TsgyVLHk.exe C:\WINDOWS\System32\UoXnTwwm.exe C:\WINDOWS\System32\UTDTa.exe C:\WINDOWS\System32\uymNshra.exe C:\WINDOWS\System32\vPeeqXiU.exe . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\LEGACY_POOF -------\LEGACY_PROTECT -------\LEGACY_SYSLIBRARY -------\LEGACY_DSNIFF -------\dsniff ((((((((((((((((((((((((( Files Created from 2007-09-28 to 2007-10-29 ))))))))))))))))))))))))))))))) . 2007-10-30 20:22 51,200 --a------ C:\WINDOWS\NirCmd.exe 2007-10-30 20:13 <DIR> d-------- C:\WINDOWS\ERUNT 2007-10-30 19:42 289,144 --a------ C:\WINDOWS\system32\VCCLSID.exe 2007-10-30 19:42 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe 2007-10-30 19:42 53,248 --a------ C:\WINDOWS\system32\Process.exe 2007-10-30 19:42 51,200 --a------ C:\WINDOWS\system32\dumphive.exe 2007-10-30 19:42 25,600 --a------ C:\WINDOWS\system32\WS2Fix.exe 2007-10-30 19:42 1,010 --a------ C:\WINDOWS\system32\tmp.reg 2007-10-20 21:27 <DIR> d-------- C:\Program Files\Avery Dennison 2007-10-20 21:27 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Avery 2007-10-13 16:53 <DIR> d-------- C:\Program Files\Real Alternative 2007-10-13 16:53 <DIR> d-------- C:\Program Files\Media Player Classic 2007-10-09 18:51 <DIR> d-------- C:\usr 2007-09-29 04:21 9,854,976 --a------ C:\WINDOWS\system32\atioglx2.dll 2007-09-29 04:07 356,352 --a------ C:\WINDOWS\system32\ATIDEMGX.dll 2007-09-29 04:06 268,800 --a--c--- C:\WINDOWS\system32\dllcache\ati2dvag.dll 2007-09-29 04:06 268,800 --a------ C:\WINDOWS\system32\ati2dvag.dll 2007-09-29 04:05 2,456,064 --a------ C:\WINDOWS\system32\drivers\ati2mtag.sys 2007-09-29 04:05 2,456,064 --a--c--- C:\WINDOWS\system32\dllcache\ati2mtag.sys 2007-09-29 03:58 143,360 --a------ C:\WINDOWS\system32\atipdlxx.dll 2007-09-29 03:58 122,880 --a------ C:\WINDOWS\system32\Oemdspif.dll 2007-09-29 03:58 43,520 --a------ C:\WINDOWS\system32\ati2edxx.dll 2007-09-29 03:58 26,112 --a------ C:\WINDOWS\system32\Ati2mdxx.exe 2007-09-29 03:57 122,880 --a------ C:\WINDOWS\system32\ati2evxx.dll 2007-09-29 03:56 483,328 --a------ C:\WINDOWS\system32\ati2evxx.exe 2007-09-29 03:55 53,248 --a------ C:\WINDOWS\system32\ATIDDC.DLL 2007-09-29 03:49 307,200 --a------ C:\WINDOWS\system32\atiiiexx.dll 2007-09-29 03:47 3,130,720 --a------ C:\WINDOWS\system32\ati3duag.dll 2007-09-29 03:47 172,032 --a------ C:\WINDOWS\system32\atiok3x2.dll 2007-09-29 03:36 3,107,788 --a------ C:\WINDOWS\system32\ativvaxx.dat 2007-09-29 03:36 3,107,788 --a------ C:\WINDOWS\system32\ativva5x.dat 2007-09-29 03:36 1,593,600 --a------ C:\WINDOWS\system32\ativvaxx.dll 2007-09-29 03:36 972,072 --a------ C:\WINDOWS\system32\ativva6x.dat 2007-09-29 03:23 5,435,392 --a------ C:\WINDOWS\system32\atioglxx.dll 2007-09-29 03:22 376,832 --a------ C:\WINDOWS\system32\atikvmag.dll 2007-09-29 03:20 17,408 --a------ C:\WINDOWS\system32\atitvo32.dll 2007-09-29 03:19 49,152 --a------ C:\WINDOWS\system32\drivers\ati2erec.dll 2007-09-29 03:14 499,712 --a------ C:\WINDOWS\system32\ati2cqag.dll . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2007-10-30 19:31 --------- d-----w C:\Program Files\FlashGet 2007-10-30 19:22 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Spybot - Search & Destroy 2007-10-20 20:26 --------- d-----w C:\Program Files\Common Files\InstallShield 2007-09-29 05:46 47,376 ----a-w C:\WINDOWS\system32\drivers\ativvpxx.vp 2007-09-28 19:05 593,920 ------w C:\WINDOWS\system32\ati2sgag.exe 2007-09-20 13:05 --------- d-----w C:\Documents and Settings\VoX\Dane aplikacji\Gadu-Gadu 2007-09-17 20:29 --------- d-----w C:\Program Files\MRConverter 2007-09-16 20:32 --------- d-----w C:\Program Files\Lavalys 2007-09-10 14:01 --------- d-----w C:\Program Files\MarBit 2007-09-10 13:58 --------- d-----w C:\Program Files\K-Lite Codec Pack 2007-09-09 12:02 --------- d-----w C:\Program Files\Common Files\NSV 2007-09-08 09:08 685,816 ----a-w C:\WINDOWS\system32\drivers\sptd.sys 2007-09-08 07:47 --------- d-----w C:\Program Files\ZaraSoft 2007-09-06 16:17 --------- d-----w C:\Program Files\SpacialAudio 2007-09-06 16:17 --------- d-----w C:\Program Files\Firebird 2007-09-06 15:49 --------- d-----w C:\Program Files\AvRack 2007-09-06 15:49 --------- d-----w C:\Program Files\Avance Sound Manager 2007-09-05 23:17 --------- d-----w C:\Program Files\microsoft frontpage 2007-09-05 23:13 --------- d-----w C:\Program Files\Usługi online 2007-07-29 15:51 7,680 ----a-w C:\WINDOWS\system32\ff_vfw.dll . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SoundMan"="soundman.exe" [2001-12-20 02:37 C:\WINDOWS\soundman.exe] "Microsoft Network Services Controller"="C:\WINDOWS\System32\mmsvc32.exe" [] "Spools Service Controller"="C:\WINDOWS\System32\spools.exe" [2002-09-01 23:41] "StartCCC"="C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2006-11-10 11:35] "UnlockerAssistant"="C:\Program Files\Unlocker\UnlockerAssistant.exe" [2006-09-07 18:19] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\System32\ctfmon.exe" [2002-09-28 23:00] "Gadu-Gadu"="C:\Program Files\Gadu-Gadu\gg.exe" [2007-07-09 08:39] "Odkurzacz-MCD"="C:\Program Files\Odkurzacz\odk_mcd.exe" [2007-05-03 09:02] "SpybotSD TeaTimer"="D:\Programy\Spybot - Search & Destroy\TeaTimer.exe" [2007-10-07 12:04] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad] "MSN Messenger"= {280A7B65-8F00-438F-3E5A-1F039433FE60} - %SystemRoot%\system32\dssdll32.dll [ ] R2 FirebirdGuardianDefaultInstance;Firebird Guardian - DefaultInstance;C:\Program Files\Firebird\Firebird_1_5\bin\fbguard.exe -s R3 FirebirdServerDefaultInstance;Firebird Server - DefaultInstance;C:\Program Files\Firebird\Firebird_1_5\bin\fbserver.exe -s . ************************************************************************** catchme 0.3.1239 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-10-29 02:02:53 Windows 5.1.2600 Dodatek Service Pack. 1 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2007-10-29 2:04:16 - machine was rebooted . --- E O F ---

HijackThis

Kod: Zaznacz wszystko: Logfile of HijackThis v1.99.1 Scan saved at 02:26:31, on 2007-10-29 Platform: Windows XP Dodatek SP. 1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\System32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Firebird\Firebird_1_5\bin\fbguard.exe c:\usr\MYSQL\bin\mysqld.exe E:\Instalki\Alcohol 120\StarWind\StarWindServiceAE.exe C:\Program Files\Firebird\Firebird_1_5\bin\fbserver.exe C:\WINDOWS\soundman.exe C:\Program Files\Unlocker\UnlockerAssistant.exe C:\WINDOWS\System32\ctfmon.exe C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE D:\Programy\Spybot - Search & Destroy\TeaTimer.exe C:\WINDOWS\System32\wuauclt.exe C:\Program Files\Gadu-Gadu\gg.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE D:\hijackthis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: BitComet Helper - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - D:\BitComet\tools\BitCometBHO_1.1.7.4.dll O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - D:\Programy\Spybot - Search & Destroy\SDHelper.dll O2 - BHO: IeCatch2 Class - {A5366673-E8CA-11D3-9CD9-0090271D075B} - C:\PROGRA~1\FlashGet\jccatch.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\fgiebar.dll O4 - HKLM\..\Run: [SoundMan] soundman.exe O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" O4 - HKLM\..\Run: [UnlockerAssistant] "C:\Program Files\Unlocker\UnlockerAssistant.exe" O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - HKCU\..\Run: [Odkurzacz-MCD] C:\Program Files\Odkurzacz\odk_mcd.exe O4 - HKCU\..\Run: [SpybotSD TeaTimer] D:\Programy\Spybot - Search & Destroy\TeaTimer.exe O8 - Extra context menu item: &D&ownload &with BitComet - res://D:\BitComet\BitComet.exe/AddLink.htm O8 - Extra context menu item: &D&ownload all video with BitComet - res://D:\BitComet\BitComet.exe/AddVideo.htm O8 - Extra context menu item: &D&ownload all with BitComet - res://D:\BitComet\BitComet.exe/AddAllLink.htm O8 - Extra context menu item: Ściągnij przy pomocy FlashGet'a - C:\Program Files\FlashGet\jc_link.htm O8 - Extra context menu item: Ściągnij wszystko przy pomocy FlashGet'a - C:\Program Files\FlashGet\jc_all.htm O9 - Extra button: BitComet Search - {461CC20B-FB6E-4f16-8FE8-C29359DB100E} - D:\BitComet\tools\BitCometBHO_1.1.7.4.dll O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - D:\Programy\Spybot - Search & Destroy\SDHelper.dll O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - D:\Programy\Spybot - Search & Destroy\SDHelper.dll O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {68282C51-9459-467B-95BF-3C0E89627E55} (MksSkanerOnline Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: Firebird Guardian - DefaultInstance (FirebirdGuardianDefaultInstance) - The Firebird Project - C:\Program Files\Firebird\Firebird_1_5\bin\fbguard.exe O23 - Service: Firebird Server - DefaultInstance (FirebirdServerDefaultInstance) - The Firebird Project - C:\Program Files\Firebird\Firebird_1_5\bin\fbserver.exe O23 - Service: MySql - Unknown owner - c:\usr/MYSQL/bin/mysqld.exe O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - E:\Instalki\Alcohol 120\StarWind\StarWindServiceAE.exe

**Posty:** 18165 · przez **wojtas** 31 Paź 2007, 18:34

wklej do notatnika

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"MSN Messenger"=-

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Microsoft Network Services Controller"=-
"Spools Service Controller"=-

w notatniku u góry>>>plik zapisz jako>>>Zmien rozszerzenie z TXT na Wszystkie pliki *.* >>> Zapisz pod nazwą FIX.REG

Klikasz dwa razy na powstały plik fix i dodajesz go do rejestru....

**Posty:** 28 · przez **VoX** 31 Paź 2007, 23:21

i to wszystko? Dzięki wielkie! mysle ze juz jest OK... jest tylko mały problem jak włączam komputer to troche długo mi się pulpit wczytuje... co moze byc powodem ?(myśle, ze nie warto zakładac nowego tematu)

**Posty:** 18165 · przez **wojtas** 31 Paź 2007, 23:24

Start>uruchom>msconfig>zakladka uruchamianie> wylacz progsy które nie chcesz żeby startowaly z systemem przyspieszy Ci to wlaczanie kompa

te mozesz odznaczyc (nie kasuj w hijacku)

O4 - HKLM\..\Run: [UnlockerAssistant] "C:\Program Files\Unlocker\UnlockerAssistant.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [Odkurzacz-MCD] C:\Program Files\Odkurzacz\odk_mcd.exe

prosze o sprawdzenie loga

Prosze o sprawdzenie loga

Kto jest na forum