Skocz do zawartości


Zdjęcie

[Pomoc] Logi HijackThis ...


  • Zaloguj się, aby dodać odpowiedź
4 odpowiedzi w tym temacie

#1 rafal194

rafal194

    Zaawansowany użytkownik

  • 413 postów

Napisano 31 10 2008 - 17:28

Oto moje problemy które skłoniły ,mnie do wstawienia logów.

1 Temat
2 Temat

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 16:11:02, on 2008-10-31
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16735)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Common Files\BinarySense\hldasvc.exe
C:\Program Files\Common Files\BinarySense\hldasvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\NORTON~1\NSR\Agent\VProSvc.exe
C:\PROGRA~1\NORTON~1\NORTON~1\NPROTECT.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\NORTON~1\NORTON~1\SPEEDD~1\NOPDB.EXE
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\PROGRA~1\NORTON~1\NSR\Agent\NSRTray.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\VisualTaskTips\VisualTaskTips.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\Skype\Plugin Manager\skypePM.exe
C:\Program Files\Nowe Gadu-Gadu\gg.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\explorer.exe
C:\Documents and Settings\rafal\Pulpit\HiJackThis\HiJackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O2 - BHO: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files\HP\Smart Web Printing\hpswp_printenhancer.dll
O2 - BHO: HP Print Clips - {053F9267-DC04-4294-A72C-58F732D338C0} - C:\Program Files\HP\Smart Web Printing\hpswp_framework.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [DriverMagicLogon] "C:\Program Files\SymplisIT\DriverMagic\dmschedule.exe" /boot
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [NSRKey] C:\PROGRA~1\NORTON~1\NSR\Agent\NSRTray.exe
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKLM\..\Run: [EasyTuneVPro] C:\Program Files\Gigabyte\ET5Pro\ETcall.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\isuspm.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [VisualTaskTips] C:\Program Files\VisualTaskTips\VisualTaskTips.exe
O4 - HKCU\..\Run: [Nowe Gadu-Gadu] "C:\Program Files\Nowe Gadu-Gadu\gg.exe"
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Program sieciowy dla SAGEM Wi-Fi 11g USB adapter.lnk = ?
O9 - Extra button: Kolekcja wycinków HP - {58ECB495-38F0-49cb-A538-10282ABF65E7} - C:\Program Files\HP\Smart Web Printing\hpswp_extensions.dll
O9 - Extra button: Express Cleanup - {5E638779-1818-4754-A595-EF1C63B87A56} - C:\Program Files\Norton SystemWorks Premier\Norton Cleanup\WCQuick.lnk
O9 - Extra 'Tools' menuitem: Express Cleanup - {5E638779-1818-4754-A595-EF1C63B87A56} - C:\Program Files\Norton SystemWorks Premier\Norton Cleanup\WCQuick.lnk
O9 - Extra button: Zaznaczanie HP Smart - {700259D7-1666-479a-93B1-3250410481E8} - C:\Program Files\HP\Smart Web Printing\hpswp_extensions.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O18 - Protocol: hddlife - {BD758015-47D9-477A-8873-4B688A2BC0E2} - "C:\Program Files\Common Files\BinarySense\hlAPP.dll" (file missing)
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Harmonogram automatycznej usługi LiveUpdate - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: HDDlife HDD Access service - BinarySense, Inc. - C:\Program Files\Common Files\BinarySense\hldasvc.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
O23 - Service: Norton Save and Restore - Symantec Corporation - C:\PROGRA~1\NORTON~1\NSR\Agent\VProSvc.exe
O23 - Service: Norton UnErase Protection (NProtectService) - Symantec Corporation - C:\PROGRA~1\NORTON~1\NORTON~1\NPROTECT.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Speed Disk service - Symantec Corporation - C:\PROGRA~1\NORTON~1\NORTON~1\SPEEDD~1\NOPDB.EXE
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe

--
End of file - 9446 bytes



ComboFix 08-10-30.12 - rafal 2008-10-31 16:06:47.1 - NTFSx86
Microsoft Windows XP Professional  5.1.2600.2.1250.1.1045.18.468 [GMT 1:00]
Uruchomiony z: C:\Documents and Settings\rafal\Pulpit\combofix\ComboFix.exe
 * Utworzono nowy punkt przywracania

[COLOR=RED][B]UWAGA - TEN KOMPUTER NIE MA ZAINSTALOWANEJ KONSOLI ODZYSKIWANIA [img]http://www.forum.tweaks.pl/public/style_emoticons/default/excl.gif[/img][/B][/COLOR]
.

(((((((((((((((((((((((((((((((((((((((   Usunięto   )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\system32\AutoRun.inf
C:\WINDOWS\vmreg32.dll

.
(((((((((((((((((((((((((   Pliki utworzone od 2008-09-28 do 2008-10-31  )))))))))))))))))))))))))))))))
.

2008-10-31 14:42 . 2008-10-31 14:45	<DIR>	d--------	C:\Documents and Settings\rafal\Dane aplikacji\Nowe Gadu-Gadu
2008-10-31 14:41 . 2008-10-31 14:41	<DIR>	d--------	C:\Program Files\Nowe Gadu-Gadu
2008-10-28 18:36 . 2008-10-28 18:36	<DIR>	d--------	C:\Program Files\PowerQuest
2008-10-28 18:22 . 2007-03-07 13:27	13,840	--a------	C:\WINDOWS\system32\wnaspi32.dll
2008-10-27 18:50 . 2008-10-27 18:50	<DIR>	d--------	C:\WINDOWS\Sun
2008-10-27 18:49 . 2008-10-27 18:49	<DIR>	d--------	C:\Program Files\Java
2008-10-27 18:49 . 2008-10-27 18:49	410,976	--a------	C:\WINDOWS\system32\deploytk.dll
2008-10-27 18:49 . 2008-10-27 18:49	73,728	--a------	C:\WINDOWS\system32\javacpl.cpl
2008-10-27 12:00 . 2008-10-27 12:00	<DIR>	d--------	C:\Documents and Settings\rafal\Dane aplikacji\Symantec
2008-10-26 17:41 . 2008-10-26 17:41	<DIR>	d--------	C:\Program Files\MCS Studios
2008-10-26 17:41 . 2005-12-14 22:17	237,568	--a------	C:\WINDOWS\system32\mcstabs.ocx
2008-10-26 17:41 . 2000-07-15 00:00	101,888	--a------	C:\WINDOWS\system32\VB6STKIT.DLL
2008-10-26 17:41 . 1998-06-18 00:00	89,360	--a------	C:\WINDOWS\system32\VB5DB.DLL
2008-10-26 13:59 . 2008-10-26 13:59	<DIR>	d--h-----	C:\WINDOWS\system32\GroupPolicy
2008-10-25 22:37 . 2008-10-25 22:38	<DIR>	d--------	C:\WINDOWS\system32\NtmsData
2008-10-25 22:10 . 2005-05-03 11:43	69,632	-r-------	C:\WINDOWS\Alcmtr.exe
2008-10-25 22:09 . 2006-11-24 13:47	40,136	--a------	C:\WINDOWS\system32\drivers\ET5Drv.sys
2008-10-25 22:09 . 2008-10-31 14:20	24,944	--a------	C:\WINDOWS\system32\drivers\GVTDrv.sys
2008-10-25 22:06 . 2008-10-25 22:18	<DIR>	d--------	C:\Program Files\Gigabyte
2008-10-25 22:06 . 2008-10-25 22:06	<DIR>	d--------	C:\Documents and Settings\All Users\Dane aplikacji\InstallShield
2008-10-25 22:06 . 1998-10-02 18:00	327,168	--a------	C:\WINDOWS\IsUninst.exe
2008-10-25 22:06 . 2005-02-17 06:15	73,728	--a------	C:\WINDOWS\system32\ISUSPM.cpl
2008-10-25 18:56 . 2008-10-27 16:14	8,059	--a------	C:\WINDOWS\gdrv.sys
2008-10-25 17:04 . 2007-07-30 18:19	271,224	--a------	C:\WINDOWS\system32\mucltui.dll
2008-10-25 17:04 . 2007-07-30 18:19	207,736	--a------	C:\WINDOWS\system32\muweb.dll
2008-10-25 17:04 . 2007-07-30 18:18	30,072	--a------	C:\WINDOWS\system32\mucltui.dll.mui
2008-10-25 16:37 . 2008-10-25 16:37	<DIR>	d--h-----	C:\WINDOWS\PIF
2008-10-25 16:23 . 2008-10-27 12:00	<DIR>	d--------	C:\Program Files\Norton SystemWorks Premier
2008-10-25 16:23 . 2008-10-25 16:23	109,744	--a------	C:\WINDOWS\system32\drivers\SYMEVENT.SYS
2008-10-25 16:23 . 2008-10-25 16:23	48,824	--a------	C:\WINDOWS\system32\S32EVNT1.DLL
2008-10-25 16:23 . 2008-10-25 16:23	8,014	--a------	C:\WINDOWS\system32\drivers\SYMEVENT.CAT
2008-10-25 16:23 . 2008-10-25 16:23	805	--a------	C:\WINDOWS\system32\drivers\SYMEVENT.INF
2008-10-25 16:22 . 2008-10-25 16:24	<DIR>	d--------	C:\Program Files\Symantec
2008-10-25 16:21 . 2008-10-25 18:50	<DIR>	d--------	C:\Program Files\PerformanceTest
2008-10-25 16:21 . 2008-10-25 16:21	<DIR>	d--------	C:\Program Files\CheckIt
2008-10-25 15:13 . 2008-10-25 15:13	<DIR>	d--------	C:\Program Files\Microsoft Silverlight
2008-10-25 15:05 . 2008-10-25 15:05	160	--a------	C:\WINDOWS\MyDrivers.ini
2008-10-25 14:55 . 2008-10-25 14:55	<DIR>	d--------	C:\Program Files\My Drivers
2008-10-25 14:39 . 2008-10-25 14:42	<DIR>	d--------	C:\Program Files\Driver Magician
2008-10-25 14:39 . 2004-09-28 10:13	526,184	--a------	C:\WINDOWS\system32\XceedCry.dll
2008-10-25 14:39 . 2005-01-12 10:19	456,536	--a------	C:\WINDOWS\system32\XCEEDZIP.DLL
2008-10-25 14:39 . 2004-03-08 23:00	224,016	--a------	C:\WINDOWS\system32\Tabctl32.ocx
2008-10-25 14:39 . 2004-08-11 14:55	110,602	--a------	C:\WINDOWS\system32\xcdsfx32.bin
2008-10-24 22:03 . 2008-10-24 22:15	<DIR>	d--------	C:\WINDOWS\SxsCaPendDel
2008-10-24 21:29 . 2008-10-27 12:00	<DIR>	d--------	C:\Program Files\Common Files\Symantec Shared
2008-10-24 21:29 . 2008-10-25 16:33	<DIR>	d--------	C:\Documents and Settings\All Users\Dane aplikacji\Symantec
2008-10-24 19:20 . 2008-10-24 19:20	<DIR>	d--------	C:\WINDOWS\NU_DATA
2008-10-23 22:07 . 2008-10-30 15:08	13	--a------	C:\WINDOWS\popcinfo.dat
2008-10-23 21:22 . 2008-10-24 22:48	<DIR>	d--------	C:\WINDOWS\Downloaded Installations
2008-10-23 21:22 . 2008-10-23 21:22	<DIR>	d--------	C:\Program Files\SymplisIT
2008-10-23 21:15 . 2008-10-23 21:15	<DIR>	d--------	C:\WINDOWS\system32\pl-pl
2008-10-23 21:15 . 2008-10-03 18:26	6,066,176	-----c---	C:\WINDOWS\system32\dllcache\ieframe.dll
2008-10-23 21:15 . 2007-04-17 10:32	2,455,488	-----c---	C:\WINDOWS\system32\dllcache\ieapfltr.dat
2008-10-23 21:15 . 2007-03-08 06:11	1,036,288	-----c---	C:\WINDOWS\system32\dllcache\ieframe.dll.mui
2008-10-23 21:15 . 2008-08-26 09:26	459,264	-----c---	C:\WINDOWS\system32\dllcache\msfeeds.dll
2008-10-23 21:15 . 2008-08-26 09:26	383,488	-----c---	C:\WINDOWS\system32\dllcache\ieapfltr.dll
2008-10-23 21:15 . 2008-08-26 09:26	267,776	-----c---	C:\WINDOWS\system32\dllcache\iertutil.dll
2008-10-23 21:15 . 2008-08-26 09:26	63,488	-----c---	C:\WINDOWS\system32\dllcache\icardie.dll
2008-10-23 21:15 . 2008-08-26 09:26	52,224	-----c---	C:\WINDOWS\system32\dllcache\msfeedsbs.dll
2008-10-23 21:15 . 2008-08-25 09:38	13,824	-----c---	C:\WINDOWS\system32\dllcache\ieudinit.exe
2008-10-23 20:50 . 2008-10-23 20:50	<DIR>	d--------	C:\Program Files\MSXML 4.0
2008-10-23 20:05 . 2008-10-25 17:34	<DIR>	d--------	C:\WINDOWS\system32\CatRoot_bak
2008-10-23 20:03 . 2008-06-14 19:01	273,024	---------	C:\WINDOWS\system32\drivers\bthport.sys
2008-10-23 20:03 . 2008-06-14 19:01	273,024	-----c---	C:\WINDOWS\system32\dllcache\bthport.sys
2008-10-23 20:02 . 2008-08-14 14:46	2,181,632	-----c---	C:\WINDOWS\system32\dllcache\ntoskrnl.exe
2008-10-23 20:02 . 2008-08-14 14:46	2,137,600	-----c---	C:\WINDOWS\system32\dllcache\ntkrnlmp.exe
2008-10-23 20:02 . 2008-08-14 14:46	2,059,008	-----c---	C:\WINDOWS\system32\dllcache\ntkrnlpa.exe
2008-10-23 20:02 . 2008-08-14 14:46	2,017,280	-----c---	C:\WINDOWS\system32\dllcache\ntkrpamp.exe
2008-10-23 19:59 . 2008-10-23 19:59	<DIR>	d--------	C:\Wstawione własne
2008-10-23 19:58 . 2008-10-24 22:48	<DIR>	d--h-----	C:\WINDOWS\$hf_mig$
2008-10-23 19:47 . 2008-10-23 19:51	<DIR>	d--------	C:\Documents and Settings\rafal\Dane aplikacji\PlayFirst
2008-10-23 19:47 . 2008-10-23 19:51	<DIR>	d--------	C:\Documents and Settings\All Users\Dane aplikacji\PlayFirst
2008-10-23 19:10 . 2008-10-23 19:11	<DIR>	d--------	C:\Documents and Settings\rafal\Dane aplikacji\Super-Cow
2008-10-23 19:09 . 2008-10-23 19:11	<DIR>	d--------	C:\Program Files\Supercow
2008-10-23 19:09 . 2008-10-23 19:09	<DIR>	d--------	C:\Program Files\ReflexiveArcade
2008-10-23 18:01 . 2008-10-23 18:01	<DIR>	d--------	C:\Program Files\UltraISO
2008-10-23 18:01 . 2008-10-23 18:01	<DIR>	d--------	C:\Program Files\Common Files\EZB Systems
2008-10-22 18:19 . 2008-10-30 17:14	<DIR>	d--hs----	C:\Boot
2008-10-22 18:19 . 2008-01-18 23:45	333,203	-rahs----	C:\bootmgr
2008-10-22 18:19 . 2008-10-28 19:12	8,192	-ra-s----	C:\BOOTSECT.BAK
2008-10-22 18:18 . 2008-10-22 18:18	<DIR>	d--------	C:\Program Files\Common Files\Adobe
2008-10-22 18:10 . 2008-10-22 18:10	<DIR>	d--------	C:\Documents and Settings\rafal\Dane aplikacji\HP
2008-10-22 17:35 . 2008-10-28 19:24	<DIR>	d--hs----	C:\$RECYCLE.BIN
2008-10-22 17:35 . 2007-03-17 12:41	171,136	-rahs----	C:\grldr
2008-10-22 15:41 . 2008-10-28 19:01	1,905	--a------	C:\WINDOWS\diagwrn.xml
2008-10-22 15:41 . 2008-10-28 19:01	1,905	--a------	C:\WINDOWS\diagerr.xml
2008-10-21 20:42 . 2008-10-21 20:42	<DIR>	d--------	C:\Documents and Settings\rafal\Dane aplikacji\GanymedeNet
2008-10-21 20:42 . 2008-10-21 20:42	1,020	--a------	C:\WINDOWS\mozver.dat
2008-10-21 20:42 . 2008-10-24 14:35	168	--a------	C:\WINDOWS\system32\proc-1037709799.bin
2008-10-21 19:24 . 2008-10-21 19:24	<DIR>	d--------	C:\Program Files\VisualTaskTips
2008-10-21 19:17 . 2008-10-21 19:17	<DIR>	d--------	C:\Program Files\Unlocker
2008-10-21 19:14 . 2008-10-21 19:14	<DIR>	d--------	C:\Program Files\CCleaner
2008-10-21 17:48 . 2008-10-21 17:48	<DIR>	d--------	C:\Program Files\Common Files\BinarySense
2008-10-21 17:48 . 2008-10-21 17:48	<DIR>	d--------	C:\Program Files\BinarySense
2008-10-21 17:48 . 2008-10-21 17:48	<DIR>	d--------	C:\Documents and Settings\rafal\Dane aplikacji\BinarySense
2008-10-21 17:48 . 2008-10-31 14:20	<DIR>	d-a------	C:\Documents and Settings\All Users\Dane aplikacji\TEMP
2008-10-21 17:36 . 2008-10-31 16:00	<DIR>	d--------	C:\Documents and Settings\rafal\Dane aplikacji\skypePM
2008-10-21 17:36 . 2008-10-21 17:36	56	--ah-----	C:\WINDOWS\system32\ezsidmv.dat
2008-10-21 17:35 . 2008-10-21 17:35	<DIR>	dr-------	C:\Program Files\Skype
2008-10-21 17:35 . 2008-10-21 17:35	<DIR>	d--------	C:\Program Files\Common Files\Skype
2008-10-21 17:35 . 2008-10-31 15:56	<DIR>	d--------	C:\Documents and Settings\rafal\Dane aplikacji\Skype
2008-10-21 17:35 . 2008-10-21 17:35	<DIR>	d--------	C:\Documents and Settings\All Users\Dane aplikacji\Skype
2008-10-21 15:20 . 2008-10-21 15:20	<DIR>	d--------	C:\Program Files\<a href="http://www.download.net.pl/219/IrfanView/">IrfanView</a>
2008-10-21 15:18 . 2008-10-21 15:18	<DIR>	d--------	C:\Documents and Settings\All Users\Dane aplikacji\Office Genuine Advantage
2008-10-21 15:09 . 2008-10-21 15:09	<DIR>	d--------	C:\WINDOWS\system32\Lang
2008-10-21 15:09 . 2008-10-21 15:09	940,794	--a------	C:\WINDOWS\system32\LoopyMusic.wav
2008-10-21 15:09 . 2008-10-21 15:09	146,650	--a------	C:\WINDOWS\system32\BuzzingBee.wav
2008-10-21 13:43 . 2008-10-21 13:43	<DIR>	d--------	C:\Program Files\Intel
2008-10-21 13:43 . 2008-10-21 13:43	<DIR>	d--------	C:\Intel
2008-10-21 13:43 . 2007-07-26 15:15	53,248	--a------	C:\WINDOWS\system32\CSVer.dll
2008-10-21 13:37 . 2008-10-21 13:37	<DIR>	d--------	C:\WINDOWS\OPTIONS
2008-10-21 13:37 . 2008-10-25 22:10	<DIR>	d--------	C:\Program Files\Realtek
2008-10-21 13:37 . 2007-08-07 10:40	98,944	-ra------	C:\WINDOWS\system32\drivers\Rtenicxp.sys
2008-10-21 13:37 . 2008-08-07 10:38	9,728	--a------	C:\WINDOWS\system32\RtNicProp32.dll
2008-10-21 12:23 . 2008-10-21 12:23	<DIR>	d--------	C:\Documents and Settings\rafal\Dane aplikacji\Xentient
2008-10-21 08:12 . 2008-10-21 08:13	<DIR>	d--------	C:\Documents and Settings\rafal\Gadu-Gadu

.
((((((((((((((((((((((((((((((((((((((((   Sekcja Find3M   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-10-31 13:44	---------	d-----w	C:\Program Files\Gadu-Gadu
2008-10-28 17:37	---------	d--h--w	C:\Program Files\InstallShield Installation Information
2008-10-25 21:06	---------	d-----w	C:\Program Files\Common Files\InstallShield
2008-10-21 20:05	---------	d-----w	C:\Program Files\Zylom Games
2008-10-21 14:06	319,488	----a-w	C:\WINDOWS\HideWin.exe
2008-10-21 08:32	---------	d-----w	C:\Program Files\HD Tune Pro
2008-10-21 08:16	---------	d-----w	C:\Program Files\Xentient
2008-10-21 08:08	---------	d-----w	C:\Program Files\Lavalys
2008-10-21 07:58	---------	d-----w	C:\Documents and Settings\rafal\Dane aplikacji\Zylom
2008-10-21 07:58	---------	d-----w	C:\Documents and Settings\All Users\Dane aplikacji\Zylom
2008-10-21 07:58	---------	d-----w	C:\Documents and Settings\All Users\Dane aplikacji\Sandlot Games
2008-10-21 07:17	---------	d-----w	C:\Program Files\OpenOffice.org 3
2008-10-21 07:17	---------	d-----w	C:\Documents and Settings\rafal\Dane aplikacji\OpenOffice.org
2008-10-21 07:10	---------	d-----w	C:\Program Files\Opera
2008-10-21 06:56	---------	d-----w	C:\Program Files\Alwil Software
2008-10-21 06:50	---------	d-----w	C:\Program Files\SAGEM WiFi manager
2008-10-21 06:50	---------	d-----w	C:\Program Files\SAGEM
2008-10-21 06:50	---------	d-----w	C:\Documents and Settings\rafal\Dane aplikacji\InstallShield
2008-10-21 06:44	---------	d-----w	C:\Documents and Settings\All Users\Dane aplikacji\WEBREG
2008-10-21 06:43	---------	d-----w	C:\Documents and Settings\All Users\Dane aplikacji\Hewlett-Packard
2008-10-21 06:41	---------	d-----w	C:\Program Files\HP
2008-10-21 06:41	---------	d-----w	C:\Documents and Settings\rafal\Dane aplikacji\HPAppData
2008-10-21 06:41	---------	d-----w	C:\Documents and Settings\All Users\Dane aplikacji\HPSSUPPLY
2008-10-21 06:40	---------	d-----w	C:\Program Files\Hewlett-Packard
2008-10-21 06:40	---------	d-----w	C:\Program Files\Common Files\HP
2008-10-21 06:40	---------	d-----w	C:\Documents and Settings\All Users\Dane aplikacji\HP Product Assistant
2008-10-21 06:40	---------	d-----w	C:\Documents and Settings\All Users\Dane aplikacji\HP
2008-10-21 06:39	---------	d-----w	C:\Program Files\Common Files\Hewlett-Packard
2008-10-21 06:23	---------	d-----w	C:\Program Files\microsoft frontpage
2008-10-21 06:22	---------	d-----w	C:\Program Files\Usługi online
2008-09-15 15:40	1,846,272	----a-w	C:\WINDOWS\system32\win32k.sys
2008-08-28 10:04	333,056	----a-w	C:\WINDOWS\system32\drivers\srv.sys
2008-08-26 08:27	826,368	----a-w	C:\WINDOWS\system32\wininet.dll
2008-08-14 13:46	2,137,600	----a-w	C:\WINDOWS\system32\ntoskrnl.exe
2008-08-14 13:46	2,017,280	----a-w	C:\WINDOWS\system32\ntkrnlpa.exe
2008-07-15 11:58	524,288	----a-w	C:\WINDOWS\RtlExUpd.dll
2008-07-07 20:33	253,952	----a-w	C:\WINDOWS\system32\es.dll
.

(((((((((((((((((((((((((((((((((((((   Wpisy startowe rejestru   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane 
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-03 15360]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-08-03 1667584]
"Skype"="C:\Program Files\Skype\Phone\Skype.exe" [2008-10-10 25795368]
"VisualTaskTips"="C:\Program Files\VisualTaskTips\VisualTaskTips.exe" [2008-06-22 65536]
"Nowe Gadu-Gadu"="C:\Program Files\Nowe Gadu-Gadu\gg.exe" [2008-10-10 6500960]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-06-28 8466432]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-06-28 81920]
"HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2007-03-11 49152]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2008-07-19 78008]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-05-11 40048]
"DriverMagicLogon"="C:\Program Files\SymplisIT\DriverMagic\dmschedule.exe" [2008-10-23 69632]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2006-10-27 107112]
"NSRKey"="C:\PROGRA~1\NORTON~1\NSR\Agent\NSRTray.exe" [2006-11-02 1582744]
"Symantec PIF AlertEng"="C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [2008-01-29 583048]
"EasyTuneVPro"="C:\Program Files\Gigabyte\ET5Pro\ETcall.exe" [2007-07-26 20480]
"ISUSPM Startup"="C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\isuspm.exe" [2005-02-17 221184]
"ISUSScheduler"="C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [2005-02-17 81920]
"SunJavaUpdateSched"="C:\Program Files\Java\jre6\bin\jusched.exe" [2008-10-27 136600]
"nwiz"="nwiz.exe" [2007-06-28 C:\WINDOWS\system32\nwiz.exe]
"RTHDCPL"="RTHDCPL.EXE" [2007-07-05 C:\WINDOWS\RTHDCPL.exe]
"SkyTel"="SkyTel.EXE" [2007-06-15 C:\WINDOWS\SkyTel.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-03 15360]

C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\
HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2007-03-11 210520]
Program sieciowy dla SAGEM Wi-Fi 11g USB adapter.lnk - C:\Program Files\SAGEM WiFi manager\WLANUTL.exe [2008-10-21 950272]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\WINDOWS\\system32\\dpvsetup.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\SymplisIT\\DriverMagic\\DriverMagic.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"8461:TCP"= 8461:TCP:GoD High Port
"8462:TCP"= 8462:TCP:GoD Low Port

R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-07-19 78416]
R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-07-19 20560]
R2 BCMNTIO;BCMNTIO;C:\PROGRA~1\CheckIt\DIAGNO~1\BCMNTIO.sys [2004-03-05 3744]
R2 Harmonogram automatycznej usługi LiveUpdate;Harmonogram automatycznej usługi LiveUpdate;C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe [2006-09-09 198336]
R2 HDDlife HDD Access service;HDDlife HDD Access service;C:\Program Files\Common Files\BinarySense\hldasvc.exe [2008-02-15 832760]
R2 JavaQuickStarterService;Java Quick Starter;C:\Program Files\Java\jre6\bin\jqs.exe [2008-10-27 152984]
R2 MAPMEM;MAPMEM;C:\PROGRA~1\CheckIt\DIAGNO~1\MAPMEM.sys [2004-03-05 3904]
R2 Norton Save and Restore;Norton Save and Restore;C:\PROGRA~1\NORTON~1\NSR\Agent\VProSvc.exe [2006-11-02 2111128]
R3 SG762_XP;SAGEM 802.11g XG762 1211B Driver;C:\WINDOWS\system32\DRIVERS\WlanBZXP.sys [2007-01-10 450560]
S3 ZDCndis5;ZDCndis5 Protocol Driver;C:\WINDOWS\system32\ZDCndis5.SYS [ ]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12	REG_MULTI_SZ   	Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt	REG_MULTI_SZ   	hpqcxs08 hpqddsvc

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{fcad9646-a2c9-11dd-8c16-806d6172696f}]
\Shell\AutoRun\command - F:\setup.exe

*Newly Created Service* - PROCEXP90
.
Zawartość folderu 'Zaplanowane zadania'

2008-10-27 C:\WINDOWS\Tasks\Funkcja One Button Checkup pakietu Norton SystemWorks.job
- C:\Program Files\Norton SystemWorks Premier\OBC.exe [2006-11-30 11:06]

2008-10-21 C:\WINDOWS\Tasks\WebReg Photosmart C4200 series.job
- C:\Program Files\HP\Digital Imaging\bin\hpqwrg.exe [2007-03-11 20:27]
.
- - - - USUNIĘTO PUSTE WPISY - - - -

Notify-WgaLogon - (no file)


.
------- Skan uzupełniający -------
.
FireFox -: Profile - C:\Documents and Settings\rafal\Dane aplikacji\Mozilla\Firefox\Profiles\67y2vr6g.default\
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-10-31 16:07:57
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

skanowanie ukrytych procesów ... 

skanowanie ukrytych wpisów autostartu ...

skanowanie ukrytych plików ... 

skanowanie pomyślnie ukończone
ukryte pliki: 0

**************************************************************************
.
Czas ukończenia: 2008-10-31 16:08:38
ComboFix-quarantined-files.txt  2008-10-31 15:08:35

Przed: 34 353 586 176 bajtów wolnych
Po: 34,478,596,096 bajtów wolnych

257	--- E O F ---	2008-10-24 21:48:12



combofix usunoł mi pliki (vmreg32.dll )

Zdziwiło mnie ze konsoli odzyskiwania niema.Ale przecież ją uruchamia się z płyty instalacyjnej.Dobrze myślę.

  • 0

#2 Macsch15

Macsch15

    Profesjonalista

  • 3 705 postów

Napisano 31 10 2008 - 17:57

HijackThis czysto

  • 0

#3 rafal194

rafal194

    Zaawansowany użytkownik

  • 413 postów

Napisano 31 10 2008 - 19:17

Dzięki,poczekam jeszcze może ktoś zanalizuje ComboFixa
  • 0

#4 ordynat

ordynat

    Zaawansowany użytkownik

  • 804 postów

Napisano 31 10 2008 - 21:55

ComboFix też czysty.

O Konsoli i ComboFixie>http://www.searchengines.pl/index.php?showtopic=86306 -niżej strony.

ordynat
  • 0

#5 rafal194

rafal194

    Zaawansowany użytkownik

  • 413 postów

Napisano 31 10 2008 - 22:06

Dzięki serdeczne.

  • 0

Zobacz więcej tematów z tagiem: Norton AntiVirus



Użytkownicy przeglądający ten temat: 0

0 użytkowników, 0 gości, 0 anonimowych