problem z otwarciem internet explorer

**Posty:** 45 · przez **bieniok** 27 Kwi 2008, 21:42

Witam przegladarka dziala tylko w trybie awaryjnym

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 21:34:27, on 2008-04-27 Platform: Windows Vista SP1 (WinNT 6.00.1905) MSIE: Internet Explorer v7.00 (7.00.6001.18000) Boot mode: Safe mode with network support Running processes: C:\Windows\Explorer.EXE C:\Program Files\Windows Media Player\wmpnscfg.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.wp.pl/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = O1 - Hosts: ::1 localhost O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" O4 - HKLM\..\Run: [RemoteControl8] "C:\Program Files\CyberLink\PowerDVD8\PDVD8Serv.exe" O4 - HKLM\..\Run: [PDVD8LanguageShortcut] "C:\Program Files\CyberLink\PowerDVD8\Language\Language.exe" O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [Windows Mobile-based device management] %windir%\WindowsMobile\wmdSync.exe O4 - HKLM\..\Run: [MSServer] rundll32.exe C:\Windows\system32\xxywUOgF.dll,#1 O4 - HKLM\..\Run: [NI.UGDCPL_0001_N122M2012] "c:\users\bieniok\appdata\roaming\installer_pl[1].exe" O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - HKCU\..\Run: [AlcoholAutomount] "C:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe" /automount O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Nero\Lib\NMBgMonitor.exe" O4 - HKCU\..\Run: [Nokia.PCSync] "C:\Program Files\Nokia\Nokia PC Suite 6\PCSync2.exe" /NoDialog O4 - HKCU\..\Run: [PC Suite Tray] "C:\Program Files\Nokia\Nokia PC Suite 6\PCSuite.exe" -onlytray O4 - HKCU\..\Run: [MSServer] rundll32.exe C:\Users\bieniok\AppData\Local\Temp\yayaXPhh.dll,#1 O4 - HKCU\..\Run: [cmds] rundll32.exe C:\Users\bieniok\AppData\Local\Temp\qOiFWMee.dll,c O4 - HKCU\..\Run: [e0ed9de0] rundll32.exe "C:\Users\bieniok\AppData\Local\Temp\uvsfwphy.dll",b O4 - HKCU\..\Run: [BMe3deae7c] Rundll32.exe "C:\Users\bieniok\AppData\Local\Temp\bxylmppg.dll",s O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'USŁUGA SIECIOWA') O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe O8 - Extra context menu item: E&ksportuj do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000 O9 - Extra button: Wyślij do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra 'Tools' menuitem: Wyślij &do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL O13 - Gopher Prefix: O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Plugin Control) - http://appldnld.apple.com.edgesuite.net/content.info.apple.com/QuickTime/qtactivex/qtplugin.cab O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - http://www.nvidia.com/content/DriverDownload/srl/2.0.0.1/sysreqlab2.cab O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL O22 - SharedTaskScheduler: Windows DreamScene - {E31004D1-A431-41B8-826F-E902F9D95C81} - C:\Windows\System32\DreamScene.dll O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Common Files\Logishrd\Bluetooth\LBTServ.exe O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe -- End of file - 6693 bytes

Pozdrawiam
bieniok

**Posty:** 18165 · przez **wojtas** 27 Kwi 2008, 21:47

Wykonaj to co jest podane w tym temacie

Zastosuj SDFix . Po pobraniu uruchom go a rozpakuje się do C:\SDFix. Uruchom komputer w trybie awaryjnym (F8 przy stracie systemu). Będąc w awaryjnym uruchom plik RunThis.bat z folderu SDFixa. Zatwierdź czyszczenie przez Y. Poczekaj aż ukończy i komputer zresetuje

Potem wejdz do folderu C:\SDFix wrzuc zawartość pliku Report.txt + log z combofixa oraz daj loga z hijacka

**Posty:** 45 · przez **bieniok** 27 Kwi 2008, 21:59

Program nie dziala RunThis.bat

**Posty:** 18165 · przez **wojtas** 27 Kwi 2008, 22:03

to wykonaj co mozesz

**Posty:** 45 · przez **bieniok** 27 Kwi 2008, 22:10

Log z combofixa

Kod: Zaznacz wszystko: ComboFix 08-04-26.5 - bieniok 2008-04-27 22:03:26.1 - NTFSx86 NETWORK Microsoft® Windows Vista™ Ultimate 6.0.6001.1.1250.1.1045.18.1619 [GMT 2:00] Running from: C:\Users\bieniok\Desktop\ComboFix.exe . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\Windows\system32\xxywUOgF.dll . ((((((((((((((((((((((((( Files Created from 2008-03-27 to 2008-04-27 ))))))))))))))))))))))))))))))) . No new files created in this timespan . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-04-27 19:47 --------- d-----w C:\Users\bieniok\AppData\Roaming\Grisoft 2008-04-27 19:46 --------- d-----w C:\PROGRA~2\Grisoft 2008-04-27 19:34 --------- d-----w C:\Program Files\Trend Micro 2008-04-27 19:28 --------- d-----w C:\Users\bieniok\AppData\Roaming\uTorrent 2008-04-27 19:28 --------- d-----w C:\Users\bieniok\AppData\Roaming\GHISLER 2008-04-27 19:28 --------- d-----w C:\Program Files\uTorrent 2008-04-26 19:24 --------- d-----w C:\Program Files\Norton Ghost 2008-04-26 19:18 --------- d-----w C:\Users\bieniok\AppData\Roaming\Symantec 2008-04-26 19:09 --------- d-----w C:\PROGRA~2\Symantec 2008-04-25 18:54 --------- d-----w C:\Program Files\cwshare 2008-04-25 16:54 --------- d-----w C:\Users\bieniok\AppData\Roaming\vlc 2008-04-25 16:53 --------- d-----w C:\Program Files\VideoLAN 2008-04-23 21:27 --------- d-----w C:\Users\bieniok\AppData\Roaming\Nokia Multimedia Player 2008-04-23 18:17 --------- d-----w C:\Program Files\QuickTime 2008-04-23 14:22 --------- d-----w C:\Users\bieniok\AppData\Roaming\Nokia 2008-04-23 14:22 --------- d-----w C:\PROGRA~2\Installations 2008-04-20 20:51 --------- d-----w C:\Program Files\Google 2008-04-20 19:43 --------- d-----w C:\Program Files\Common Files\Acronis 2008-04-20 19:24 441,760 ----a-w C:\Windows\system32\drivers\timntr.sys 2008-04-20 19:24 44,384 ----a-w C:\Windows\system32\drivers\tifsfilt.sys 2008-04-20 19:23 368,480 ----a-w C:\Windows\system32\drivers\tdrpman.sys 2008-04-20 19:23 129,248 ----a-w C:\Windows\system32\drivers\snapman.sys 2008-04-20 18:56 --------- d-----w C:\PROGRA~2\Acronis 2008-04-20 18:55 --------- d-----w C:\Program Files\Acronis 2008-04-20 10:59 0 ---ha-w C:\Windows\system32\drivers\Msft_User_WpdRapi_01_00_00.Wdf 2008-04-19 10:17 --------- d-----w C:\Program Files\Lavalys 2008-04-15 20:27 --------- d-----w C:\Program Files\Common Files\Adobe 2008-04-13 21:03 --------- d-----w C:\PROGRA~2\Elaborate Bytes 2008-04-13 20:59 --------- d-----w C:\Program Files\Elaborate Bytes 2008-04-12 20:56 --------- d-----w C:\Users\bieniok\AppData\Roaming\PC Suite 2008-04-12 20:23 --------- d-----w C:\Users\bieniok\AppData\Roaming\CyberLink 2008-04-12 20:23 --------- d-----w C:\PROGRA~2\CyberLink 2008-04-12 20:22 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-04-12 20:22 --------- d-----w C:\Program Files\Common Files\CyberLink 2008-04-12 20:21 --------- d-----w C:\Program Files\CyberLink 2008-04-12 20:20 29,480 ----a-w C:\Windows\System32\msxml3a.dll 2008-04-12 17:53 --------- d-----w C:\PROGRA~2\Nokia 2008-04-12 17:52 --------- d-----w C:\Program Files\Nokia 2008-04-12 17:52 --------- d-----w C:\Program Files\Common Files\Nokia 2008-04-12 17:47 0 ---ha-w C:\Windows\system32\drivers\Msft_User_PCCSWpdDriver_01_05_00.Wdf 2008-04-12 17:47 0 ---ha-w C:\Windows\system32\drivers\Msft_Kernel_ccdcmb_01005.Wdf 2008-04-12 17:47 --------- d-----w C:\PROGRA~2\PC Suite 2008-04-12 17:43 --------- d-----w C:\Program Files\DIFX 2008-04-12 17:43 --------- d-----w C:\Program Files\Common Files\PCSuite 2008-04-12 17:42 --------- d-----w C:\Program Files\PC Connectivity Solution 2008-04-12 16:11 0 ---ha-w C:\Windows\system32\drivers\Msft_User_WpdFs_01_00_00.Wdf 2008-04-12 15:42 --------- d-----w C:\Users\bieniok\AppData\Roaming\Consultia 2008-04-12 15:42 --------- d-----w C:\Program Files\CubeDesktop 2008-04-12 15:32 --------- d-----w C:\Program Files\MSXML 4.0 2008-04-12 07:08 --------- d-----w C:\Users\bieniok\AppData\Roaming\Nero 2008-04-12 07:07 --------- d-----w C:\Program Files\Common Files\Nero 2008-04-12 07:04 --------- d-----w C:\Program Files\Nero 2008-04-12 07:04 --------- d-----w C:\PROGRA~2\Nero 2008-04-12 06:46 --------- d-----w C:\PROGRA~2\LogiShrd 2008-04-12 06:45 --------- d-----w C:\Users\bieniok\AppData\Roaming\Logitech 2008-04-12 06:44 --------- d-----w C:\Program Files\Common Files\Logishrd 2008-04-12 06:43 --------- d-----w C:\Users\bieniok\AppData\Roaming\InstallShield 2008-04-12 06:43 --------- d-----w C:\Program Files\Logitech 2008-04-12 06:43 --------- d-----w C:\PROGRA~2\Logitech 2008-04-11 21:51 --------- d-----w C:\Program Files\eMule 2008-04-11 21:51 --------- d-----w C:\PROGRA~2\eMule 2008-04-11 21:41 --------- d-----w C:\Users\bieniok\AppData\Roaming\eMule 2008-04-11 21:26 --------- d-----w C:\PROGRA~2\NVIDIA 2008-04-11 21:23 --------- d-----w C:\Program Files\Common Files\InstallShield 2008-04-11 21:03 --------- d-----w C:\Program Files\SystemRequirementsLab 2008-04-11 20:46 --------- d-----w C:\Program Files\Alcohol Soft 2008-04-11 20:35 --------- d-----w C:\Program Files\BitLocker 2008-04-11 20:34 --------- d-----w C:\Program Files\Microsoft Games 2008-04-11 20:04 --------- d-----w C:\Users\bieniok\AppData\Roaming\ACD Systems 2008-04-11 19:59 --------- d-----w C:\Program Files\Common Files\ACD Systems 2008-04-11 19:59 --------- d-----w C:\Program Files\ACD Systems 2008-04-11 19:59 --------- d-----w C:\PROGRA~2\ACD Systems 2008-04-11 19:55 --------- d-----w C:\Program Files\XviD 2008-04-11 19:55 --------- d-----w C:\Program Files\Apex 2008-04-11 19:54 685,816 ----a-w C:\Windows\system32\drivers\sptd.sys 2008-04-11 19:52 --------- d-----w C:\PROGRA~2\WinZip 2008-04-11 19:45 --------- d-----w C:\PROGRA~2\Microsoft Help 2008-04-11 19:43 --------- d-----w C:\Program Files\MSBuild 2008-04-11 19:43 --------- d-----w C:\Program Files\Microsoft Works 2008-04-11 19:42 --------- d-----w C:\Program Files\Microsoft.NET 2008-04-11 19:41 --------- d-----w C:\Program Files\Microsoft Visual Studio 8 2008-04-11 19:32 --------- d-----w C:\Program Files\Alwil Software 2008-04-11 19:30 --------- d-----w C:\PROGRA~2\Stardock 2008-04-11 19:19 --------- d-----w C:\Program Files\VistaCodecPack 2008-04-11 17:31 --------- d-----w C:\Users\bieniok\AppData\Roaming\Gadu-Gadu 2008-04-11 17:27 --------- d-----w C:\Program Files\Gadu-Gadu 2008-04-11 16:51 --------- d-----w C:\Program Files\Windows Mail 2008-04-11 16:40 --------- d-sh--w C:\PROGRA~2\Ulubione 2008-04-11 16:40 --------- d-sh--w C:\PROGRA~2\Szablony 2008-04-11 16:40 --------- d-sh--w C:\PROGRA~2\Pulpit 2008-04-11 16:40 --------- d-sh--w C:\PROGRA~2\Menu Start 2008-04-11 16:40 --------- d-sh--w C:\PROGRA~2\Dokumenty 2008-04-11 16:40 --------- d-sh--w C:\PROGRA~2\Dane aplikacji 2008-04-11 15:23 38,400 ----a-w C:\Windows\System32\SoundSchemes.exe 2008-03-29 17:32 50,768 ----a-w C:\Windows\system32\drivers\aswMonFlt.sys 2008-03-15 17:07 7,680 ----a-w C:\Windows\System32\ff_vfw.dll 2008-03-14 22:24 93,128 ----a-w C:\Windows\System32\ElbyCDIO.dll 2008-03-12 20:21 678,408 ----a-w C:\Windows\System32\gpprefcl.dll 2008-03-06 22:29 966,656 ----a-w C:\Windows\System32\VSFilter.dll 2008-03-06 09:14 831,048 ----a-w C:\Windows\System32\WudfUpdate_01005.dll . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Sidebar"="C:\Program Files\Windows Sidebar\sidebar.exe" [2008-01-19 00:33 1233920] "Gadu-Gadu"="C:\Program Files\Gadu-Gadu\gg.exe" [2008-03-20 12:04 2127296] "AlcoholAutomount"="C:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe" [2007-08-01 20:17 222592] "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Nero\Lib\NMBgMonitor.exe" [2007-08-03 12:51 202024] "CubeDesktop"="" [] "Nokia.PCSync"="C:\Program Files\Nokia\Nokia PC Suite 6\PCSync2.exe" [2008-03-26 18:41 1232896] "PC Suite Tray"="C:\Program Files\Nokia\Nokia PC Suite 6\PCSuite.exe" [2008-03-28 11:20 1079296] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [2008-01-19 00:38 1008184] "avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2008-03-29 19:37 79224] "GrooveMonitor"="C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-27 00:47 31016] "NvSvc"="C:\Windows\system32\nvsvc.dll" [2007-12-11 17:06 86016] "NvCplDaemon"="C:\Windows\system32\NvCpl.dll" [2007-12-11 17:06 8530464] "NvMediaCenter"="C:\Windows\system32\NvMcTray.dll" [2007-12-11 17:06 81920] "Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2007-11-29 02:17 55824 C:\Windows\KHALMNPR.Exe] "NeroFilterCheck"="C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe" [2007-03-01 15:57 153136] "NBKeyScan"="C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" [2007-08-08 09:25 1828136] "RemoteControl8"="C:\Program Files\CyberLink\PowerDVD8\PDVD8Serv.exe" [2008-03-20 20:23 83240] "PDVD8LanguageShortcut"="C:\Program Files\CyberLink\PowerDVD8\Language\Language.exe" [2007-12-14 11:36 50472] "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 22:16 39792] "Windows Mobile-based device management"="%windir%\WindowsMobile\wmdSync.exe" [ ] "NI.UGDCPL_0001_N122M2012"="c:\users\bieniok\appdata\roaming\installer_pl[1].exe" [ ] "!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 11:25 6731312] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce] "GrpConv"="grpconv -o" [] C:\PROGRA~2\MICROS~1\Windows\STARTM~1\Programs\Startup\ Logitech SetPoint.lnk - C:\Program Files\Logitech\SetPoint\SetPoint.exe [2008-04-12 08:43:55 789008] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "EnableUIADesktopToggle"= 0 (0x0) [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "msacm.divxa32"= divxa32.acm "vidc.XVID"= xvid.dll "VIDC.ACDV"= ACDV.dll [HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules] "TCP Query User{DC42E153-BC4C-4B1E-82DB-D3E049AEE14C}C:\\totalcmd\\totalcmd.exe"= UDP:C:\totalcmd\totalcmd.exe:Total Commander 32 bit international version, file manager replacement for Windows "UDP Query User{BFF44A2C-3AAD-4F89-A455-2341CA282DDF}C:\\totalcmd\\totalcmd.exe"= TCP:C:\totalcmd\totalcmd.exe:Total Commander 32 bit international version, file manager replacement for Windows "{E25048F7-77A1-404C-84F1-3A59FDCB1523}"= UDP:C:\Program Files\Microsoft Office\Office12\GROOVE.EXE:Microsoft Office Groove "{E709DD05-7263-4832-A87F-810191C85EC0}"= TCP:C:\Program Files\Microsoft Office\Office12\GROOVE.EXE:Microsoft Office Groove "{4650D29F-2E74-4EFB-8107-4543621B75D6}"= UDP:C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote "{3507055D-C0D4-4D22-99B5-3660D0E7F5DC}"= TCP:C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote "TCP Query User{5B6D28EF-51C7-4DC6-8621-FBBB4A997DEC}C:\\program files\\cwshare\\cwshare.exe"= UDP:C:\program files\cwshare\cwshare.exe:Config-Tool cwshare "UDP Query User{4F38E9CA-5658-4384-B63B-A0B3E8922A9E}C:\\program files\\cwshare\\cwshare.exe"= TCP:C:\program files\cwshare\cwshare.exe:Config-Tool cwshare "TCP Query User{C087C75B-A963-4C9D-AD73-23A57811C323}C:\\program files\\utorrent\\utorrent.exe"= UDP:C:\program files\utorrent\utorrent.exe:uTorrent "UDP Query User{95932992-0244-461A-B79B-01A249D853E4}C:\\program files\\utorrent\\utorrent.exe"= TCP:C:\program files\utorrent\utorrent.exe:uTorrent "TCP Query User{C3B858D8-BE63-43C4-96AC-99AAED6A67A5}C:\\program files\\emule\\emule.exe"= UDP:C:\program files\emule\emule.exe:eMule "UDP Query User{35C77DD8-34F4-47F8-97FD-B82041CE7C27}C:\\program files\\emule\\emule.exe"= TCP:C:\program files\emule\emule.exe:eMule "TCP Query User{151465B7-9250-48F6-8F92-329FCABB0A0F}C:\\program files\\nokia\\nokia software updater\\nsu_ui_client.exe"= UDP:C:\program files\nokia\nokia software updater\nsu_ui_client.exe:Nokia Software Updater "UDP Query User{CD817C40-A4D7-4DAE-8760-579AE2E6DDDD}C:\\program files\\nokia\\nokia software updater\\nsu_ui_client.exe"= TCP:C:\program files\nokia\nokia software updater\nsu_ui_client.exe:Nokia Software Updater "TCP Query User{475D8FD8-2BC6-4DE6-AAB0-28BACB55C7C8}C:\\program files\\common files\\nokia\\service layer\\a\\nsl_host_process.exe"= UDP:C:\program files\common files\nokia\service layer\a\nsl_host_process.exe:Nokia Service Layer Host Process "UDP Query User{9032B1B4-3D9C-48A5-A355-1B91607DED9C}C:\\program files\\common files\\nokia\\service layer\\a\\nsl_host_process.exe"= TCP:C:\program files\common files\nokia\service layer\a\nsl_host_process.exe:Nokia Service Layer Host Process "{A3E005B7-2419-4E37-95CD-BB026A93DC32}"= C:\Program Files\CyberLink\PowerDVD8\PowerDVD8.EXE:CyberLink PowerDVD 8.0 "TCP Query User{54AEAC78-B103-451F-82EA-80335277621B}C:\\program files\\gadu-gadu\\gg.exe"= UDP:C:\program files\gadu-gadu\gg.exe:Gadu-Gadu - program główny "UDP Query User{0CCAC677-E4E2-47F5-BBCC-C261B77B01BE}C:\\program files\\gadu-gadu\\gg.exe"= TCP:C:\program files\gadu-gadu\gg.exe:Gadu-Gadu - program główny "{CFED39AA-C17B-4F3A-888C-C400D8675736}"= UDP:990:LocalSubnet:LocalSubnet|IF={E179A2E7-E145-4249-AF38-E68DA0AC9008}|%SystemRoot%\system32\svchost.exe|Svc=rapimgr:@%systemroot%\WindowsMobile\wmdSync.exe,-4001 "TCP Query User{94D6F801-1CCE-42D0-B395-A5469931BDFB}C:\\program files\\internet explorer\\iexplore.exe"= UDP:C:\program files\internet explorer\iexplore.exe:Internet Explorer "UDP Query User{ABB5C0CE-1BB1-4C37-A91B-118FE606717C}C:\\program files\\internet explorer\\iexplore.exe"= TCP:C:\program files\internet explorer\iexplore.exe:Internet Explorer R3 yukonwlh;NDIS6.0 Miniport Driver for Marvell Yukon Ethernet Controller;C:\Windows\system32\DRIVERS\yk60x86.sys [2007-12-06 09:51] S1 aswSP;avast! Self Protection;C:\Windows\system32\drivers\aswSP.sys [2008-03-29 19:31] S2 aswFsBlk;aswFsBlk;C:\Windows\system32\DRIVERS\aswFsBlk.sys [2008-03-29 19:35] S2 aswMonFlt;aswMonFlt;C:\Windows\system32\DRIVERS\aswMonFlt.sys [2008-03-29 19:32] S2 RapiMgr;Łączność urządzeń z systemem Windows Mobile;C:\Windows\system32\svchost.exe [2008-01-19 00:33] S2 WcesComm;Łączność z urządzeniem z systemem Windows Mobile 2003;C:\Windows\system32\svchost.exe [2008-01-19 00:33] S3 athr;Sterownik urządzenia rozszerzalnej bezprzewodowej sieci LAN Atheros;C:\Windows\system32\DRIVERS\athr.sys [2006-11-02 09:30] S3 nmwcdnsu;Nokia USB Flashing Phone Parent;C:\Windows\system32\drivers\nmwcdnsu.sys [2008-02-01 15:17] S3 nmwcdnsuc;Nokia USB Flashing Generic;C:\Windows\system32\drivers\nmwcdnsuc.sys [2008-02-01 15:17] S3 pccsmcfd;PCCS Mode Change Filter Driver;C:\Windows\system32\DRIVERS\pccsmcfd.sys [2007-09-17 15:53] S3 upperdev;upperdev;C:\Windows\system32\DRIVERS\usbser_lowerflt.sys [2007-11-29 10:39] S3 UsbserFilt;UsbserFilt;C:\Windows\system32\DRIVERS\usbser_lowerfltj.sys [2007-11-29 10:39] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] GPSvcGroup REG_MULTI_SZ GPSvc WindowsMobile REG_MULTI_SZ wcescomm rapimgr LocalServiceRestricted REG_MULTI_SZ WcesComm RapiMgr *Newly Created Service* - CATCHME *Newly Created Service* - ECACHE [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{7070D8E0-650A-46b3-B03C-9497582E6A74}] %SystemRoot%\system32\soundschemes.exe /AddRegistration . ************************************************************************** catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-04-27 22:05:31 Windows 6.0.6001 Service Pack 1 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... ************************************************************************** . Completion time: 2008-04-27 22:07:09 ComboFix-quarantined-files.txt 2008-04-27 20:06:06 System nie może znaleźć komunikatu dla numeru komunikatu 0x2379 w pliku komunikatów dla Application. System nie może znaleźć komunikatu dla numeru komunikatu 0x2379 w pliku komunikatów dla Application. 211 --- E O F --- 2008-04-25 06:18:41

log z HijackThis

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 22:08:56, on 2008-04-27 Platform: Windows Vista SP1 (WinNT 6.00.1905) MSIE: Internet Explorer v7.00 (7.00.6001.18000) Boot mode: Safe mode with network support Running processes: C:\Program Files\Windows Media Player\wmpnscfg.exe C:\Windows\Explorer.exe C:\Windows\system32\notepad.exe C:\Windows\helppane.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.wp.pl/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = O1 - Hosts: ::1 localhost O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" O4 - HKLM\..\Run: [RemoteControl8] "C:\Program Files\CyberLink\PowerDVD8\PDVD8Serv.exe" O4 - HKLM\..\Run: [PDVD8LanguageShortcut] "C:\Program Files\CyberLink\PowerDVD8\Language\Language.exe" O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [Windows Mobile-based device management] %windir%\WindowsMobile\wmdSync.exe O4 - HKLM\..\Run: [NI.UGDCPL_0001_N122M2012] "c:\users\bieniok\appdata\roaming\installer_pl[1].exe" O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized O4 - HKLM\..\RunOnce: [GrpConv] grpconv -o O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - HKCU\..\Run: [AlcoholAutomount] "C:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe" /automount O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Nero\Lib\NMBgMonitor.exe" O4 - HKCU\..\Run: [Nokia.PCSync] "C:\Program Files\Nokia\Nokia PC Suite 6\PCSync2.exe" /NoDialog O4 - HKCU\..\Run: [PC Suite Tray] "C:\Program Files\Nokia\Nokia PC Suite 6\PCSuite.exe" -onlytray O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'USŁUGA SIECIOWA') O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe O8 - Extra context menu item: E&ksportuj do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000 O9 - Extra button: Wyślij do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra 'Tools' menuitem: Wyślij &do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL O13 - Gopher Prefix: O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Plugin Control) - http://appldnld.apple.com.edgesuite.net/content.info.apple.com/QuickTime/qtactivex/qtplugin.cab O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - http://www.nvidia.com/content/DriverDownload/srl/2.0.0.1/sysreqlab2.cab O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL O22 - SharedTaskScheduler: Windows DreamScene - {E31004D1-A431-41B8-826F-E902F9D95C81} - C:\Windows\System32\DreamScene.dll O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Common Files\Logishrd\Bluetooth\LBTServ.exe O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe -- End of file - 6299 bytes

to co moglem wykonac

Pozdrawiam
bieniok

**Posty:** 18165 · przez **wojtas** 27 Kwi 2008, 23:10

zastosuj:

smitfraudfix z opcji 2
(sciagasz -> uruchamiasz-> klikasz dowolny klawisz -> wpisujesz w programie 2 i enter potem czekasz chwile -> gdy wyskoczy pytanie w programie Do you want to clean the registry ? to wpisujesz literke Y i znowu enter i czekasz do wyskoczenia raportu (znak ze skan dobiegł konca)
wracasz z nowymi logami

**Posty:** 45 · przez **bieniok** 27 Kwi 2008, 23:28

log combofix

Kod: Zaznacz wszystko: ComboFix 08-04-26.5 - bieniok 2008-04-27 23:17:46.1 - NTFSx86 Microsoft® Windows Vista™ Ultimate 6.0.6001.1.1250.1.1045.18.1175 [GMT 2:00] Running from: C:\Users\bieniok\Desktop\ComboFix.exe * Created a new restore point . ((((((((((((((((((((((((( Files Created from 2008-03-27 to 2008-04-27 ))))))))))))))))))))))))))))))) . 2008-04-27 23:12 . 2008-04-27 23:12 4,468 --a------ C:\Windows\System32\tmp.reg 2008-04-27 23:11 . 2008-04-27 23:15 <DIR> d-------- C:\Users\bieniok\SmitfraudFix 2008-04-27 23:11 . 2007-09-06 00:22 289,144 --a------ C:\Windows\System32\VCCLSID.exe 2008-04-27 23:11 . 2006-04-27 17:49 288,417 --a------ C:\Windows\System32\SrchSTS.exe 2008-04-27 23:11 . 2008-04-24 08:10 86,528 --a------ C:\Windows\System32\VACFix.exe 2008-04-27 23:11 . 2008-04-23 22:14 82,944 --a------ C:\Windows\System32\IEDFix.exe 2008-04-27 23:11 . 2008-04-23 22:14 82,944 --a------ C:\Windows\System32\404Fix.exe 2008-04-27 23:11 . 2003-06-05 21:13 53,248 --a------ C:\Windows\System32\Process.exe 2008-04-27 23:11 . 2004-07-31 18:50 51,200 --a------ C:\Windows\System32\dumphive.exe 2008-04-27 23:11 . 2007-10-04 00:36 25,600 --a------ C:\Windows\System32\WS2Fix.exe 2008-04-27 23:05 . 2008-04-27 23:05 <DIR> d-------- C:\SAV32CLI 2008-04-27 21:48 . 2008-04-27 23:06 <DIR> d-------- C:\SDFix 2008-04-27 21:47 . 2008-04-27 21:47 <DIR> d-------- C:\Users\bieniok\AppData\Roaming\Grisoft 2008-04-27 21:47 . 2007-05-30 14:10 10,872 --a------ C:\Windows\System32\drivers\AvgAsCln.sys 2008-04-27 21:46 . 2008-04-27 21:46 <DIR> d-------- C:\Users\All Users\Grisoft 2008-04-27 21:46 . 2008-04-27 21:46 <DIR> d-------- C:\PROGRA~2\Grisoft 2008-04-27 21:34 . 2008-04-27 21:34 <DIR> d-------- C:\Program Files\Trend Micro 2008-04-26 21:18 . 2008-04-26 21:18 <DIR> d-------- C:\Users\bieniok\AppData\Roaming\Symantec 2008-04-26 21:05 . 2008-01-19 19:31 109,360 --a------ C:\Windows\System32\GEARAspi.dll 2008-04-26 21:05 . 2008-01-19 19:31 15,664 --a------ C:\Windows\System32\drivers\GEARAspiWDM.sys 2008-04-26 21:04 . 2008-04-26 21:09 <DIR> d-------- C:\Users\All Users\Symantec 2008-04-26 21:04 . 2008-04-26 21:24 <DIR> d-------- C:\Program Files\Norton Ghost 2008-04-26 21:04 . 2008-04-26 21:09 <DIR> d-------- C:\PROGRA~2\Symantec 2008-04-25 20:57 . 2008-04-25 20:57 24,005 --a------ C:\ignore.list 2008-04-25 18:54 . 2008-04-25 18:54 <DIR> d-------- C:\Users\bieniok\AppData\Roaming\vlc 2008-04-25 18:53 . 2008-04-25 18:53 <DIR> d-------- C:\Program Files\VideoLAN 2008-04-23 23:27 . 2008-04-23 23:27 <DIR> d-------- C:\Users\bieniok\AppData\Roaming\Nokia Multimedia Player 2008-04-23 20:17 . 2008-04-23 20:17 <DIR> d-------- C:\Program Files\QuickTime 2008-04-20 22:51 . 2008-04-20 22:51 <DIR> d-------- C:\Program Files\Google 2008-04-20 21:23 . 2008-04-20 21:23 129,248 --a------ C:\Windows\System32\drivers\snapman.sys 2008-04-20 20:56 . 2008-04-20 20:56 <DIR> d-------- C:\Users\All Users\Acronis 2008-04-20 20:56 . 2008-04-20 20:56 <DIR> d-------- C:\PROGRA~2\Acronis 2008-04-20 20:56 . 2008-04-20 21:24 441,760 --a------ C:\Windows\System32\drivers\timntr.sys 2008-04-20 20:56 . 2008-04-20 21:24 44,384 --a------ C:\Windows\System32\drivers\tifsfilt.sys 2008-04-20 20:55 . 2008-04-20 21:43 <DIR> d-------- C:\Program Files\Common Files\Acronis 2008-04-20 20:55 . 2008-04-20 20:55 <DIR> d-------- C:\Program Files\Acronis 2008-04-20 20:55 . 2008-04-20 21:23 368,480 --a------ C:\Windows\System32\drivers\tdrpman.sys 2008-04-20 12:59 . 2008-04-20 12:59 0 --ah----- C:\Windows\System32\drivers\Msft_User_WpdRapi_01_00_00.Wdf 2008-04-19 12:17 . 2008-04-19 12:17 <DIR> d-------- C:\Program Files\Lavalys 2008-04-15 22:27 . 2008-04-15 22:27 <DIR> d-------- C:\Program Files\Common Files\Adobe 2008-04-15 21:44 . 2008-04-15 22:27 <DIR> d-------- C:\Users\All Users\Adobe 2008-04-14 20:47 . 2008-04-14 20:47 <DIR> d-------- C:\Users\Public\CyberLink 2008-04-13 23:03 . 2008-04-13 23:03 <DIR> d-------- C:\Users\All Users\Elaborate Bytes 2008-04-13 23:03 . 2008-04-13 23:03 <DIR> d-------- C:\PROGRA~2\Elaborate Bytes 2008-04-13 23:03 . 2008-04-13 23:03 43 ---hs---- C:\Users\All Users\.zreglib 2008-04-13 23:03 . 2008-04-13 23:03 43 ---hs---- C:\PROGRA~2\.zreglib 2008-04-13 23:02 . 2008-04-13 23:03 24 ---hs---- C:\Windows\S6A1CC689.tmp 2008-04-13 22:59 . 2008-04-13 22:59 <DIR> d-------- C:\Program Files\Elaborate Bytes 2008-04-12 22:23 . 2008-04-12 22:23 <DIR> d-------- C:\Users\bieniok\AppData\Roaming\CyberLink 2008-04-12 22:23 . 2008-04-12 22:23 <DIR> d-------- C:\Users\All Users\CyberLink 2008-04-12 22:23 . 2008-04-12 22:23 <DIR> d-------- C:\PROGRA~2\CyberLink 2008-04-12 22:22 . 2008-04-12 22:22 <DIR> d-------- C:\Program Files\Common Files\CyberLink 2008-04-12 22:21 . 2008-04-12 22:21 <DIR> d-------- C:\Program Files\CyberLink 2008-04-12 22:21 . 2008-04-12 22:20 29,480 --a------ C:\Windows\System32\msxml3a.dll 2008-04-12 19:53 . 2008-04-12 19:53 <DIR> d-------- C:\Users\All Users\Nokia 2008-04-12 19:53 . 2008-04-12 19:53 <DIR> d-------- C:\PROGRA~2\Nokia 2008-04-12 19:47 . 2008-04-12 19:47 0 --ah----- C:\Windows\System32\drivers\Msft_User_PCCSWpdDriver_01_05_00.Wdf 2008-04-12 19:47 . 2008-04-12 19:47 0 --ah----- C:\Windows\System32\drivers\Msft_Kernel_ccdcmb_01005.Wdf 2008-04-12 19:45 . 2008-04-12 22:56 <DIR> d-------- C:\Users\bieniok\AppData\Roaming\PC Suite 2008-04-12 19:45 . 2008-04-12 19:47 <DIR> d-------- C:\Users\All Users\PC Suite 2008-04-12 19:45 . 2008-04-12 19:47 <DIR> d-------- C:\PROGRA~2\PC Suite 2008-04-12 19:43 . 2008-04-23 16:22 <DIR> d-------- C:\Users\bieniok\AppData\Roaming\Nokia 2008-04-12 19:43 . 2008-04-12 19:43 <DIR> d-------- C:\Program Files\DIFX 2008-04-12 19:43 . 2008-04-12 19:43 <DIR> d-------- C:\Program Files\Common Files\PCSuite 2008-04-12 19:43 . 2008-04-12 19:52 <DIR> d-------- C:\Program Files\Common Files\Nokia 2008-04-12 19:43 . 2007-09-17 15:53 21,632 --a------ C:\Windows\System32\drivers\pccsmcfd.sys 2008-04-12 19:42 . 2008-04-26 21:23 <DIR> d----c--- C:\Windows\System32\DRVSTORE 2008-04-12 19:42 . 2008-04-12 19:42 <DIR> d-------- C:\Program Files\PC Connectivity Solution 2008-04-12 19:41 . 2008-04-12 19:52 <DIR> d-------- C:\Program Files\Nokia 2008-04-12 19:41 . 2008-02-01 15:17 90,624 --a------ C:\Windows\System32\nmwcdcls.dll 2008-04-12 19:25 . 2008-04-23 16:22 <DIR> d-------- C:\Users\All Users\Installations 2008-04-12 19:25 . 2008-04-23 16:22 <DIR> d-------- C:\PROGRA~2\Installations 2008-04-12 18:11 . 2008-04-12 18:11 0 --ah----- C:\Windows\System32\drivers\Msft_User_WpdFs_01_00_00.Wdf 2008-04-12 17:42 . 2008-04-12 17:42 <DIR> d-------- C:\Users\bieniok\AppData\Roaming\Consultia 2008-04-12 17:41 . 2008-04-12 17:42 <DIR> d-------- C:\Program Files\CubeDesktop 2008-04-12 17:32 . 2008-04-12 17:32 <DIR> d-------- C:\Program Files\MSXML 4.0 2008-04-12 09:08 . 2008-04-12 09:08 <DIR> d-------- C:\Users\bieniok\AppData\Roaming\Nero 2008-04-12 09:04 . 2008-04-12 09:04 <DIR> d-------- C:\Users\All Users\Nero 2008-04-12 09:04 . 2008-04-12 09:04 <DIR> d-------- C:\Program Files\Nero 2008-04-12 09:04 . 2008-04-12 09:07 <DIR> d-------- C:\Program Files\Common Files\Nero 2008-04-12 09:04 . 2008-04-12 09:04 <DIR> d-------- C:\PROGRA~2\Nero 2008-04-12 08:46 . 2008-04-12 08:46 <DIR> d-------- C:\Users\All Users\LogiShrd 2008-04-12 08:46 . 2008-04-12 08:46 <DIR> d-------- C:\PROGRA~2\LogiShrd 2008-04-12 08:45 . 2008-04-12 08:45 <DIR> d-------- C:\Users\bieniok\AppData\Roaming\Logitech 2008-04-12 08:44 . 2008-01-09 12:26 301,656 --a------ C:\Windows\System32\BtCoreIf.dll 2008-04-12 08:43 . 2008-04-12 08:43 <DIR> d-------- C:\Users\bieniok\AppData\Roaming\InstallShield 2008-04-12 08:43 . 2008-04-12 08:43 <DIR> d-------- C:\Users\All Users\Logitech 2008-04-12 08:43 . 2008-04-12 08:43 <DIR> d-------- C:\Program Files\Logitech 2008-04-12 08:43 . 2008-04-12 22:22 <DIR> d--h----- C:\Program Files\InstallShield Installation Information 2008-04-12 08:43 . 2008-04-12 08:44 <DIR> d-------- C:\Program Files\Common Files\Logishrd 2008-04-12 08:43 . 2008-04-12 08:43 <DIR> d-------- C:\PROGRA~2\Logitech 2008-04-12 08:43 . 2008-01-09 12:27 170,512 --a------ C:\Windows\System32\kemutb.dll 2008-04-12 08:43 . 2008-01-09 12:28 141,840 --a------ C:\Windows\System32\KemUtil.dll 2008-04-12 08:43 . 2008-01-09 12:28 117,264 --a------ C:\Windows\System32\KemWnd.dll 2008-04-12 08:43 . 2008-01-09 12:28 76,304 --a------ C:\Windows\System32\KemXML.dll 2008-04-11 23:51 . 2008-04-11 23:51 <DIR> d-------- C:\Users\All Users\eMule 2008-04-11 23:51 . 2008-04-11 23:51 <DIR> d-------- C:\PROGRA~2\eMule 2008-04-11 23:41 . 2008-04-11 23:41 <DIR> d-------- C:\Users\bieniok\AppData\Roaming\eMule 2008-04-11 23:41 . 2008-04-11 23:51 <DIR> d-------- C:\Program Files\eMule 2008-04-11 23:34 . 2008-04-27 21:28 <DIR> d-------- C:\Users\bieniok\AppData\Roaming\uTorrent 2008-04-11 23:34 . 2008-04-27 21:28 <DIR> d-------- C:\Program Files\uTorrent 2008-04-11 23:23 . 2008-04-11 23:23 <DIR> d-------- C:\Program Files\Common Files\InstallShield 2008-04-11 23:22 . 2008-04-11 23:22 <DIR> d-------- C:\NVIDIA 2008-04-11 23:03 . 2008-04-11 23:03 <DIR> d-------- C:\Program Files\SystemRequirementsLab 2008-04-11 22:46 . 2008-04-11 22:46 <DIR> d-------- C:\Program Files\Alcohol Soft 2008-04-11 22:36 . 2007-07-20 01:55 233,888 --a------ C:\Windows\System32\DreamScene.dll 2008-04-11 22:35 . 2008-04-11 22:35 <DIR> d-------- C:\Program Files\BitLocker 2008-04-11 22:35 . 2007-02-22 04:26 1,171,848 --a------ C:\Windows\System32\SecureKeyBackupCPL.dll 2008-04-11 22:35 . 2008-03-12 22:21 678,408 --a------ C:\Windows\System32\gpprefcl.dll 2008-04-11 22:35 . 2006-12-21 02:58 711 --a------ C:\Windows\System32\CPSOKBTasks.xml 2008-04-11 22:04 . 2008-04-11 22:04 <DIR> d-------- C:\Users\bieniok\AppData\Roaming\ACD Systems 2008-04-11 21:59 . 2008-04-11 21:59 <DIR> d-------- C:\Users\All Users\ACD Systems 2008-04-11 21:59 . 2008-04-11 21:59 <DIR> d-------- C:\Program Files\Common Files\ACD Systems 2008-04-11 21:59 . 2008-04-11 21:59 <DIR> d-------- C:\Program Files\ACD Systems 2008-04-11 21:59 . 2008-04-11 21:59 <DIR> d-------- C:\PROGRA~2\ACD Systems 2008-04-11 21:55 . 2008-04-11 21:55 <DIR> d-------- C:\Program Files\XviD 2008-04-11 21:55 . 2008-04-11 21:55 <DIR> d-------- C:\Program Files\Apex 2008-04-11 21:54 . 2008-04-11 21:54 685,816 --a------ C:\Windows\System32\drivers\sptd.sys 2008-04-11 21:44 . 2006-10-26 19:56 32,592 --a------ C:\Windows\System32\msonpmon.dll 2008-04-11 21:43 . 2008-04-11 21:43 <DIR> d-------- C:\Program Files\Microsoft Works 2008-04-11 21:42 . 2008-04-11 21:42 <DIR> d-------- C:\Windows\PCHEALTH 2008-04-11 21:42 . 2008-04-11 21:42 <DIR> d-------- C:\Program Files\Microsoft.NET 2008-04-11 21:41 . 2008-04-11 21:41 <DIR> d-------- C:\Program Files\Microsoft Visual Studio 8 2008-04-11 21:41 . 2008-04-25 20:54 <DIR> d-------- C:\Program Files\cwshare 2008-04-11 21:40 . 2008-04-11 21:45 <DIR> d-------- C:\Users\All Users\Microsoft Help . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-04-11 20:34 --------- d-----w C:\Program Files\Microsoft Games 2008-04-11 19:43 --------- d-----w C:\Program Files\MSBuild 2008-04-11 16:51 --------- d-----w C:\Program Files\Windows Mail 2008-04-11 16:40 --------- d-sh--w C:\PROGRA~2\Ulubione 2008-04-11 16:40 --------- d-sh--w C:\PROGRA~2\Szablony 2008-04-11 16:40 --------- d-sh--w C:\PROGRA~2\Pulpit 2008-04-11 16:40 --------- d-sh--w C:\PROGRA~2\Menu Start 2008-04-11 16:40 --------- d-sh--w C:\PROGRA~2\Dokumenty 2008-04-11 16:40 --------- d-sh--w C:\PROGRA~2\Dane aplikacji 2008-03-15 17:07 7,680 ----a-w C:\Windows\System32\ff_vfw.dll 2008-03-14 22:24 93,128 ----a-w C:\Windows\System32\ElbyCDIO.dll 2008-03-06 22:29 966,656 ----a-w C:\Windows\System32\VSFilter.dll 2008-03-06 09:14 831,048 ----a-w C:\Windows\System32\WudfUpdate_01005.dll 2008-03-05 14:03 479,752 ----a-w C:\Windows\System32\XAudio2_0.dll 2008-03-05 14:03 238,088 ----a-w C:\Windows\System32\xactengine3_0.dll 2008-03-05 14:00 25,608 ----a-w C:\Windows\System32\X3DAudio1_3.dll 2008-03-05 13:56 3,786,760 ----a-w C:\Windows\System32\D3DX9_37.dll 2008-03-05 13:56 1,420,824 ----a-w C:\Windows\System32\D3DCompiler_37.dll 2008-02-29 07:14 19,000 ----a-w C:\Windows\System32\kd1394.dll 2008-02-29 07:11 988,216 ----a-w C:\Windows\System32\winload.exe 2008-02-29 07:11 927,288 ----a-w C:\Windows\System32\winresume.exe 2008-02-29 06:53 46,592 ----a-w C:\Windows\System32\setbcdlocale.dll 2008-02-29 06:53 40,960 ----a-w C:\Windows\System32\srclient.dll 2008-02-29 06:53 378,368 ----a-w C:\Windows\System32\srcore.dll 2008-02-29 06:35 6,656 ----a-w C:\Windows\System32\kbd106n.dll 2008-02-29 04:21 2,032,128 ----a-w C:\Windows\System32\win32k.sys 2008-02-29 04:12 318,464 ----a-w C:\Windows\System32\rstrui.exe 2008-02-29 04:12 14,848 ----a-w C:\Windows\System32\srdelayed.exe 2008-02-22 05:05 615,992 ----a-w C:\Windows\System32\ci.dll 2008-02-22 05:01 826,880 ----a-w C:\Windows\System32\wininet.dll 2008-02-22 04:57 295,936 ----a-w C:\Windows\System32\gdi32.dll 2008-02-05 21:07 462,864 ----a-w C:\Windows\System32\d3dx10_37.dll 2008-02-02 21:23 174 --sha-w C:\Program Files\desktop.ini 2008-02-02 21:12 82,432 ----a-w C:\Windows\System32\axaltocm.dll 2008-02-02 21:12 101,888 ----a-w C:\Windows\System32\ifxcardm.dll 2008-02-02 20:45 47,560 ----a-w C:\Windows\System32\SPReview.exe 2008-02-02 20:45 152,576 ----a-w C:\Windows\System32\SPWizUI.dll 2008-02-02 16:04 215,144 ----a-r C:\Windows\pw32a.dll 2008-02-02 16:04 215,144 ----a-r C:\Windows\patchw32.dll . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Sidebar"="C:\Program Files\Windows Sidebar\sidebar.exe" [2008-01-19 00:33 1233920] "Gadu-Gadu"="C:\Program Files\Gadu-Gadu\gg.exe" [2008-03-20 12:04 2127296] "AlcoholAutomount"="C:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe" [2007-08-01 20:17 222592] "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Nero\Lib\NMBgMonitor.exe" [2007-08-03 12:51 202024] "CubeDesktop"="" [] "Nokia.PCSync"="C:\Program Files\Nokia\Nokia PC Suite 6\PCSync2.exe" [2008-03-26 18:41 1232896] "PC Suite Tray"="C:\Program Files\Nokia\Nokia PC Suite 6\PCSuite.exe" [2008-03-28 11:20 1079296] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [2008-01-19 00:38 1008184] "avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2008-03-29 19:37 79224] "GrooveMonitor"="C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-27 00:47 31016] "NvSvc"="C:\Windows\system32\nvsvc.dll" [2007-12-11 17:06 86016] "NvCplDaemon"="C:\Windows\system32\NvCpl.dll" [2007-12-11 17:06 8530464] "NvMediaCenter"="C:\Windows\system32\NvMcTray.dll" [2007-12-11 17:06 81920] "Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2007-11-29 02:17 55824 C:\Windows\KHALMNPR.Exe] "NeroFilterCheck"="C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe" [2007-03-01 15:57 153136] "NBKeyScan"="C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" [2007-08-08 09:25 1828136] "RemoteControl8"="C:\Program Files\CyberLink\PowerDVD8\PDVD8Serv.exe" [2008-03-20 20:23 83240] "PDVD8LanguageShortcut"="C:\Program Files\CyberLink\PowerDVD8\Language\Language.exe" [2007-12-14 11:36 50472] "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 22:16 39792] "Windows Mobile-based device management"="%windir%\WindowsMobile\wmdSync.exe" [ ] "NI.UGDCPL_0001_N122M2012"="c:\users\bieniok\appdata\roaming\installer_pl[1].exe" [ ] "!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 11:25 6731312] C:\PROGRA~2\MICROS~1\Windows\STARTM~1\Programs\Startup\ Logitech SetPoint.lnk - C:\Program Files\Logitech\SetPoint\SetPoint.exe [2008-04-12 08:43:55 789008] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "EnableUIADesktopToggle"= 0 (0x0) [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "msacm.divxa32"= divxa32.acm "vidc.XVID"= xvid.dll "VIDC.ACDV"= ACDV.dll [HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules] "TCP Query User{DC42E153-BC4C-4B1E-82DB-D3E049AEE14C}C:\\totalcmd\\totalcmd.exe"= UDP:C:\totalcmd\totalcmd.exe:Total Commander 32 bit international version, file manager replacement for Windows "UDP Query User{BFF44A2C-3AAD-4F89-A455-2341CA282DDF}C:\\totalcmd\\totalcmd.exe"= TCP:C:\totalcmd\totalcmd.exe:Total Commander 32 bit international version, file manager replacement for Windows "{E25048F7-77A1-404C-84F1-3A59FDCB1523}"= UDP:C:\Program Files\Microsoft Office\Office12\GROOVE.EXE:Microsoft Office Groove "{E709DD05-7263-4832-A87F-810191C85EC0}"= TCP:C:\Program Files\Microsoft Office\Office12\GROOVE.EXE:Microsoft Office Groove "{4650D29F-2E74-4EFB-8107-4543621B75D6}"= UDP:C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote "{3507055D-C0D4-4D22-99B5-3660D0E7F5DC}"= TCP:C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote "TCP Query User{5B6D28EF-51C7-4DC6-8621-FBBB4A997DEC}C:\\program files\\cwshare\\cwshare.exe"= UDP:C:\program files\cwshare\cwshare.exe:Config-Tool cwshare "UDP Query User{4F38E9CA-5658-4384-B63B-A0B3E8922A9E}C:\\program files\\cwshare\\cwshare.exe"= TCP:C:\program files\cwshare\cwshare.exe:Config-Tool cwshare "TCP Query User{C087C75B-A963-4C9D-AD73-23A57811C323}C:\\program files\\utorrent\\utorrent.exe"= UDP:C:\program files\utorrent\utorrent.exe:uTorrent "UDP Query User{95932992-0244-461A-B79B-01A249D853E4}C:\\program files\\utorrent\\utorrent.exe"= TCP:C:\program files\utorrent\utorrent.exe:uTorrent "TCP Query User{C3B858D8-BE63-43C4-96AC-99AAED6A67A5}C:\\program files\\emule\\emule.exe"= UDP:C:\program files\emule\emule.exe:eMule "UDP Query User{35C77DD8-34F4-47F8-97FD-B82041CE7C27}C:\\program files\\emule\\emule.exe"= TCP:C:\program files\emule\emule.exe:eMule "TCP Query User{151465B7-9250-48F6-8F92-329FCABB0A0F}C:\\program files\\nokia\\nokia software updater\\nsu_ui_client.exe"= UDP:C:\program files\nokia\nokia software updater\nsu_ui_client.exe:Nokia Software Updater "UDP Query User{CD817C40-A4D7-4DAE-8760-579AE2E6DDDD}C:\\program files\\nokia\\nokia software updater\\nsu_ui_client.exe"= TCP:C:\program files\nokia\nokia software updater\nsu_ui_client.exe:Nokia Software Updater "TCP Query User{475D8FD8-2BC6-4DE6-AAB0-28BACB55C7C8}C:\\program files\\common files\\nokia\\service layer\\a\\nsl_host_process.exe"= UDP:C:\program files\common files\nokia\service layer\a\nsl_host_process.exe:Nokia Service Layer Host Process "UDP Query User{9032B1B4-3D9C-48A5-A355-1B91607DED9C}C:\\program files\\common files\\nokia\\service layer\\a\\nsl_host_process.exe"= TCP:C:\program files\common files\nokia\service layer\a\nsl_host_process.exe:Nokia Service Layer Host Process "{A3E005B7-2419-4E37-95CD-BB026A93DC32}"= C:\Program Files\CyberLink\PowerDVD8\PowerDVD8.EXE:CyberLink PowerDVD 8.0 "TCP Query User{54AEAC78-B103-451F-82EA-80335277621B}C:\\program files\\gadu-gadu\\gg.exe"= UDP:C:\program files\gadu-gadu\gg.exe:Gadu-Gadu - program główny "UDP Query User{0CCAC677-E4E2-47F5-BBCC-C261B77B01BE}C:\\program files\\gadu-gadu\\gg.exe"= TCP:C:\program files\gadu-gadu\gg.exe:Gadu-Gadu - program główny "{CFED39AA-C17B-4F3A-888C-C400D8675736}"= UDP:990:LocalSubnet:LocalSubnet|IF={E179A2E7-E145-4249-AF38-E68DA0AC9008}|%SystemRoot%\system32\svchost.exe|Svc=rapimgr:@%systemroot%\WindowsMobile\wmdSync.exe,-4001 "TCP Query User{94D6F801-1CCE-42D0-B395-A5469931BDFB}C:\\program files\\internet explorer\\iexplore.exe"= UDP:C:\program files\internet explorer\iexplore.exe:Internet Explorer "UDP Query User{ABB5C0CE-1BB1-4C37-A91B-118FE606717C}C:\\program files\\internet explorer\\iexplore.exe"= TCP:C:\program files\internet explorer\iexplore.exe:Internet Explorer R1 aswSP;avast! Self Protection;C:\Windows\system32\drivers\aswSP.sys [2008-03-29 19:31] R2 aswFsBlk;aswFsBlk;C:\Windows\system32\DRIVERS\aswFsBlk.sys [2008-03-29 19:35] R2 aswMonFlt;aswMonFlt;C:\Windows\system32\DRIVERS\aswMonFlt.sys [2008-03-29 19:32] R2 RapiMgr;Łączność urządzeń z systemem Windows Mobile;C:\Windows\system32\svchost.exe [2008-01-19 00:33] R2 WcesComm;Łączność z urządzeniem z systemem Windows Mobile 2003;C:\Windows\system32\svchost.exe [2008-01-19 00:33] R3 yukonwlh;NDIS6.0 Miniport Driver for Marvell Yukon Ethernet Controller;C:\Windows\system32\DRIVERS\yk60x86.sys [2007-12-06 09:51] S3 athr;Sterownik urządzenia rozszerzalnej bezprzewodowej sieci LAN Atheros;C:\Windows\system32\DRIVERS\athr.sys [2006-11-02 09:30] S3 nmwcdnsu;Nokia USB Flashing Phone Parent;C:\Windows\system32\drivers\nmwcdnsu.sys [2008-02-01 15:17] S3 nmwcdnsuc;Nokia USB Flashing Generic;C:\Windows\system32\drivers\nmwcdnsuc.sys [2008-02-01 15:17] S3 pccsmcfd;PCCS Mode Change Filter Driver;C:\Windows\system32\DRIVERS\pccsmcfd.sys [2007-09-17 15:53] S3 upperdev;upperdev;C:\Windows\system32\DRIVERS\usbser_lowerflt.sys [2007-11-29 10:39] S3 UsbserFilt;UsbserFilt;C:\Windows\system32\DRIVERS\usbser_lowerfltj.sys [2007-11-29 10:39] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] GPSvcGroup REG_MULTI_SZ GPSvc WindowsMobile REG_MULTI_SZ wcescomm rapimgr LocalServiceRestricted REG_MULTI_SZ WcesComm RapiMgr [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{7070D8E0-650A-46b3-B03C-9497582E6A74}] %SystemRoot%\system32\soundschemes.exe /AddRegistration . ************************************************************************** catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-04-27 23:19:35 Windows 6.0.6001 Service Pack 1 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... ************************************************************************** . Completion time: 2008-04-27 23:21:25 ComboFix-quarantined-files.txt 2008-04-27 21:20:19 ComboFix2.txt 2008-04-27 20:07:09 Pre-Run: 29,078,753,280 bajtów wolnych Post-Run: 29,049,294,848 bajtów wolnych 268 --- E O F --- 2008-04-25 06:18:41

log HijackThis

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 23:27:36, on 2008-04-27 Platform: Windows Vista SP1 (WinNT 6.00.1905) MSIE: Internet Explorer v7.00 (7.00.6001.18000) Boot mode: Safe mode with network support Running processes: C:\Windows\Explorer.EXE C:\Program Files\Internet Explorer\iexplore.exe C:\Windows\helppane.exe C:\Program Files\Windows Media Player\wmpnscfg.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = O1 - Hosts: ::1 localhost O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" O4 - HKLM\..\Run: [RemoteControl8] "C:\Program Files\CyberLink\PowerDVD8\PDVD8Serv.exe" O4 - HKLM\..\Run: [PDVD8LanguageShortcut] "C:\Program Files\CyberLink\PowerDVD8\Language\Language.exe" O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [Windows Mobile-based device management] %windir%\WindowsMobile\wmdSync.exe O4 - HKLM\..\Run: [NI.UGDCPL_0001_N122M2012] "c:\users\bieniok\appdata\roaming\installer_pl[1].exe" O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - HKCU\..\Run: [AlcoholAutomount] "C:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe" /automount O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Nero\Lib\NMBgMonitor.exe" O4 - HKCU\..\Run: [Nokia.PCSync] "C:\Program Files\Nokia\Nokia PC Suite 6\PCSync2.exe" /NoDialog O4 - HKCU\..\Run: [PC Suite Tray] "C:\Program Files\Nokia\Nokia PC Suite 6\PCSuite.exe" -onlytray O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'USŁUGA SIECIOWA') O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe O8 - Extra context menu item: E&ksportuj do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000 O9 - Extra button: Wyślij do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra 'Tools' menuitem: Wyślij &do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL O13 - Gopher Prefix: O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Plugin Control) - http://appldnld.apple.com.edgesuite.net/content.info.apple.com/QuickTime/qtactivex/qtplugin.cab O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL O22 - SharedTaskScheduler: Windows DreamScene - {E31004D1-A431-41B8-826F-E902F9D95C81} - C:\Windows\System32\DreamScene.dll O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Common Files\Logishrd\Bluetooth\LBTServ.exe O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe -- End of file - 5876 bytes

**Posty:** 18165 · przez **wojtas** 27 Kwi 2008, 23:47

skasuj"

O1 - Hosts: ::1 localhost
O4 - HKLM\..\Run: [NI.UGDCPL_0001_N122M2012] "c:\users\bieniok\appdata\roaming\installer_pl[1].exe"

**Posty:** 45 · przez **bieniok** 27 Kwi 2008, 23:52

Dziekuje jak narazie udalo mi sie uruchomic internet explorer

Dziekuje wojtas

problem z otwarciem internet explorer

Problem z otwarciem internet explorer

Problem z otwarciem internet explorer

Problem z otwarciem internet explorer

Problem z otwarciem internet explorer

Kto jest na forum